KitPloit - PenTest Tools!

usage: mitm6.py [-h] [-i INTERFACE] [-l LOCALDOMAIN] [-4 ADDRESS] [-6 ADDRESS] [-m ADDRESS] [-a] [-v] [--debug] [-d DOMAIN] [-b DOMAIN] [-hw DOMAIN] [-hb DOMAIN] [--ignore-nofqnd] mitm6 - pwning IPv4 via IPv6 For help or reporting issues, visit https://github.com/fox-it/mitm6 optional arguments: -h, --help show this help message and exit -i INTERFACE, --interface INTERFACE Interface to use (default: autodetect) -l LOCALDOMAIN, --localdomain LOCALDOMAIN Domain name to use as DNS search domain (default: use first DNS domain) -4 ADDRESS, --ipv4 ADDRESS IPv4 address to send packets from (default: autodetect) -6 ADDRESS, --ipv6 ADDRESS IPv6 link-local address to send packets from (default: autodetect) -m ADDRESS, --mac ADDRESS Custom mac address - probably breaks stuff (default: mac of selected interface) -a, --no-ra Do not advertise ourselves (useful for networks which detect rogue Router Advertisements) -v, --verbose Show verbose information --debug Show debug information Filtering options: -d DOMAIN, --domain DOMAIN Domain name to filter DNS queries on (Whitelist principle, multiple can be specified.) -b DOMAIN, --blacklist DOMAIN Domain name to filter DNS queries on (Blacklist principle, multiple can be specified.) -hw DOMAIN, --host-whitelist DOMAIN Hostname (FQDN) to filter DHCPv6 queries on (Whitelist principle, multiple can be specified.) -hb DOMAIN, --host-blacklist DOMAIN Hostname (FQDN) to filter DHCPv6 queries on (Blacklist principle, multiple can be specified.) --ignore-nofqnd Ignore DHCPv6 queries that do not contain the Fully Qualified Domain Name (FQDN) option.

Revoke-Obfuscation is a PowerShell v3.0+ compatible PowerShell obfuscation detection framework.

Authors

Daniel Bohannon (@danielhbohannon) Lee Holmes (@Lee_Homes)

Research

Blog Post: https://www.fireeye.com/blog/threat-research/2017/07/revoke-obfuscation-powershell.html

White Paper: https://www.fireeye.com/content/dam/fireeye-www/blog/pdfs/revoke-obfuscation-report.pdf

Background

In the Fall of 2016 and Spring of 2017, Daniel Bohannon (@danielhbohannon) released Invoke-Obfuscation and Invoke-CradleCrafter, two open-source PowerShell obfuscation frameworks. The goal of this research and these frameworks was to highlight the limitations of a purely signature-based approach to detecting attackers' usage of PowerShell. The core message to defenders has been to focus on detecting Indicators of Obfuscation in addition to known suspicious syntax.

However, the extreme levels of randomization in Invoke-Obfuscation and Invoke-CradleCrafter paired with the token-layer obfuscation options that are not deobfuscated in PowerShell's script block logging have led defenders to look for a new, scalable means of generically detecting both known and unknown obfuscation techniques.

A few weeks after the release of Invoke-Obfuscation, Lee Holmes (@Lee_Homes) authored a blog posted entitled More Detecting Obfuscated PowerShell in which he highlighted statistical analysis techniques to detect anomalous features found in heavily obfuscated scripts, specifically those produced by Invoke-Obfuscation.

Since this exchange, Daniel and Lee became good friends and shared many common interests/obsessions -- namely, a love of fine coffee and the pursuit of creating new ways to thoroughly detect obfuscated PowerShell.

The amount of time both Blue Teamers spent pouring over research and POC code would equate to several thousand cups of Chemex-brewed coffee assuming the proper 4-minute target brew time (assuming at least one other coffee enthusiast picked up on this "pour over" pun).

Revoke-Obfuscation is the final hand-crafted product of these efforts.

Purpose

Revoke-Obfuscation is an open-source PowerShell v3.0+ framework for detecting obfuscated PowerShell commands and scripts at scale. It relies on PowerShell's AST (Abstract Syntax Tree) to rapidly extract thousands of features from any input PowerShell script and compare this feature vector against one of several pre-defined weighted feature vectors computed through an automated learning process conducted against a corpus of 408K+ PowerShell scripts. This full corpus can be downloaded from (https://aka.ms/PowerShellCorpus). Stay tuned for the publishing of the labeled data and the tooling used for training.

Since Revoke-Obfuscation relies on feature extraction and comparison instead of pure IOCs or RegEx matching, it is more robust in its ability to identify unknown obfuscation techniques even when attackers attempt to subdue their obfuscation by padding it with unobfuscated script contents to overthrow basic checks like character frequency analysis.

Revoke-Obfuscation can easily measure most input PowerShell scripts within 100-300 milliseconds. This level of performance allows an organization to measure the obfuscation of (at worst) 12K+ PowerShell scripts per hour without the need to index verbose PowerShell script block logs in a SIEM.

Lastly, Revoke-Obfuscation supports easy whitelisting functionality along with the ability to ingest PowerShell Operational event log records and reassemble script blocks that are recorded across numerous script block EID 4104 records. It can easily become a one-stop shop for ingesting an environment's PowerShell Operational event logs, reassembling and unique'ing all scripts within those logs, and then identifying obfuscated PowerShell scripts that deserve manual inspection.

Installation
The source code for Revoke-Obfuscation is hosted at Github, and you may download, fork and review it from this repository (https://github.com/danielbohannon/Revoke-Obfuscation). Please report issues or feature requests through Github's bug tracker associated with this project.
To install (from Github):

Import-Module .\Revoke-Obfuscation.psd1

The source code can also be installed directly from the PowerShell Gallery via the following commands:
To install (from PowerShell Gallery):

Install-Module Revoke-Obfuscation
Import-Module Revoke-Obfuscation

Usage
Revoke-Obfuscation will provide a detailed tutorial as well as a few other fun surprises. But if you are not into the lulz then you can simply run Get-Help Measure-RvoObfuscation to see usage syntax or just continue reading.
There are two primary functions used in this framework:

Get-RvoScriptBlock -- reassembles scripts from EID 4104 script block logs
Measure-RvoObfuscation -- measures input script(s) and returns obfuscation score

If you need to reassemble and extract script block logs from PowerShell Operational logs then Get-RvoScriptBlock is your function of choice. It automatically returns only unique script blocks and excludes certain default script block values deemed not malicious. This can be overridden with the -Deep switch.

Get-RvoScriptBlock -Path 'C:\Windows\System32\Winevt\Logs\Microsoft-Windows-PowerShell%4Operational.evtx' -Verbose
Get-ChildItem .\Demo\demo.evtx | Get-RvoScriptBlock -Verbose
Get-WinEvent -LogName Microsoft-Windows-PowerShell/Operational | Get-RvoScriptBlock -Verbose

Get-RvoScriptBlock also supports MIR/HX audit results as well as PowerShell Operational logs retrieved via Matt Graeber's (@mattifestation) CimSweep project (https://github.com/PowerShellMafia/CimSweep). For CimSweep there is a minor registry tweak required to trick WMI into querying a non-classic event log. Details can be found in the NOTES section of Get-RvoScriptBlock.

Get-ChildItem C:\MirOrHxAuditFiles\*_w32eventlogs.xml | Get-RvoScriptBlock -Verbose
Get-CSEventLogEntry -LogName Microsoft-Windows-PowerShell/Operational | Get-RvoScriptBlock

A full example against test data recorded in demo.evtx can be found below:

$obfResults = Get-WinEvent -Path .\Demo\demo.evtx | Get-RvoScriptBlock | Measure-RvoObfuscation -OutputToDisk -Verbose

A full example against local and remotely hosted test scripts can be found below:

Measure-RvoObfuscation -Url 'http://bit.ly/DBOdemo1' -Verbose -OutputToDisk
Get-Content .\Demo\DBOdemo*.ps1 | Measure-RvoObfuscation -Verbose -OutputToDisk
Get-ChildItem .\Demo\DBOdemo*.ps1 | Measure-RvoObfuscation -Verbose -OutputToDisk

The -OutputToDisk switch will automatically output all obfuscated scripts to .\Results\Obfuscated. Regardless, all results will be returned as PSCustomObjects containing the script content along with metadata like an obfuscation score, measurement time, whitelisting result, all extracted script features, etc.
Three whitelisting options exist in two locations in Revoke-Obfuscation:

On Disk (automatically applied if present):
1. .\Whitelist\Scripts_To_Whitelist\ -- All scripts placed in this directory will be hashed and any identical scripts will be whitelisted. This whitelisting method is preferred above the next two options.
2. .\Whitelist\Strings_To_Whitelist.txt -- A script containing ANY of the strings in this file will be whitelisted. Syntax: Rule_Name,string_to_whitelist
3. .\Whitelist\Regex_To_Whitelist.txt -- A script containing ANY of the regular expressions in this file will be whitelisted. Syntax: Rule_Name,regex_to_whitelist
Arguments for Measure-RvoObfuscation (applied in addition to above whitelisting options):
1. -WhitelistFile -- -WhitelistFile .\files\*.ps1,.\more_files\*.ps1,.\one_more_file.ps1
2. -WhitelistContent -- -WhitelistContent 'string 1 to whitelist','string 2 to whitelist'
3. -WhitelistRegex -- -WhitelistRegex 'regex 1 to whitelist','regex 2 to whitelist'

If interested in creating your own set of training data and generating a weighted vector for the Measure-Vector function, then ModelTrainer.cs/ModelTrainer.exe can be executed against a labeled data set. The following command will extract feature vectors from all input scripts and aggregate them into a single CSV used in this training phase:

Get-ChildItem .\*.ps1 | ForEach-Object { [PSCustomObject](Get-RvoFeatureVector -Path $_.FullName) | Export-Csv .\all_features.csv -Append }

Lastly, if looking for a platform for creating indicators (IOCs) that harness the power of PowerShell's AST (Abstract Syntax Tree) -- which we would highly recommend for identifying malicious PowerShell activity that is NOT obfuscated -- then PS Script Analyzer is an excellent framework designed to handle such tasks.

Release Notes
v1.0 - 2017-07-27 Black Hat USA & 2017-07-30 DEF CON: PUBLIC Release of Revoke-Obfuscation.

Download Revoke-Obfuscation

▶ meg --verbose paths hosts out/example.com/45ed6f717d44385c5e9c539b0ad8dc71771780e0 http://example.com/robots.txt (404 Not Found) out/example.com/61ac5fbb9d3dd054006ae82630b045ba730d8618 https://example.com/robots.txt (404 Not Found) out/example.net/1432c16b671043271eab84111242b1fe2a28eb98 http://example.net/robots.txt (404 Not Found) out/example.net/61deaa4fa10a6f601adb74519a900f1f0eca38b7 http://example.net/.well-known/security.txt (404 Not Found) out/example.com/20bc94a296f17ce7a4e2daa2946d0dc12128b3f1 http://example.com/.well-known/security.txt (404 Not Found) ...

▶ head -n 20 ./out/example.com/45ed6f717d44385c5e9c539b0ad8dc71771780e0 http://example.com/robots.txt > GET /robots.txt HTTP/1.1 > Host: example.com < HTTP/1.1 404 Not Found < Expires: Sat, 06 Jan 2018 01:05:38 GMT < Server: ECS (lga/13A2) < Accept-Ranges: bytes < Cache-Control: max-age=604800 < Content-Type: text/* < Content-Length: 1270 < Date: Sat, 30 Dec 2017 01:05:38 GMT < Last-Modified: Sun, 24 Dec 2017 06:53:36 GMT < X-Cache: 404-HIT <!doctype html> <html> <head>

▶ head -n 2 ./out/index out/example.com/538565d7ab544bc3bec5b2f0296783aaec25e756 http://example.com/package.json (404 Not Found) out/example.com/20bc94a296f17ce7a4e2daa2946d0dc12128b3f1 http://example.com/.well-known/security.txt (404 Not Found)

▶ meg --help Request many paths for many hosts Usage: meg [path|pathsFile] [hostsFile] [outputDir] Options: -c, --concurrency <val> Set the concurrency level (defaut: 20) -d, --delay <val> Milliseconds between requests to the same host (defaut: 5000) -H, --header <header> Send a custom HTTP header -r, --rawhttp Use the rawhttp library for requests (experimental) -s, --savestatus <status> Save only responses with specific status code -v, --verbose Verbose mode -X, --method <method> HTTP method (default: GET) Defaults: pathsFile: ./paths hostsFile: ./hosts outputDir: ./out Paths file format: /robots.txt /package.json /security.txt Hosts file format: http://example.com https://example.edu https://example.net Examples: meg /robots.txt meg hosts.txt paths.txt output

▶ meg --method TRACE ▶ grep -nri 'TRACE' out/ out/example.com/61ac5fbb9d3dd054006ae82630b045ba730d8618:3:> TRACE /robots.txt HTTP/1.1 out/example.com/bd8d9f4c470ffa0e6ec8cfa8ba1c51d62289b6dd:3:> TRACE /.well-known/security.txt HTTP/1.1 ...

git clone https://github.com/EdOverflow/megplus.git cd megplus go get github.com/tomnomnom/meg go get github.com/tomnomnom/waybackurls git clone https://github.com/aboul3la/Sublist3r.git # See https://github.com/aboul3la/Sublist3r#dependencies

$ ./megplus.sh 1) Usage - target list of domains: ./megplus.sh <list of domains> 2) Usage - target all HackerOne programs: ./megplus.sh -x <H1 X-Auth-Token> 3) Usage - run sublist3r first: ./megplus.sh -s <single host> 1) Example: ./megplus.sh domains 2) Example: ./megplus.sh -x XXXXXXXXXXXXXXXX 3) Example: ./megplus.sh -s example.com

$ ./contact.sh _ _ __ _|_ _ _ _|_ _ |_ (_ (_)| | |_(_|(_ |_ o _> | | --- by EdOverflow [i] Description: An OSINT tool to find contacts in order to report security vulnerabilities. [i] Usage: ./contact.sh [Options] use -d for hostnames (-d example.com), -c for vendor name (-c example), and -f for a list of hostnames in a file (-f domains.txt) [i] Example: ./contact.sh -d google.com -c google

$ ./contact.sh -d linkedin.com _ _ __ _|_ _ _ _|_ _ |_ (_ (_)| | |_(_|(_ |_ o _> | | --- by EdOverflow [+] Finding security.txt files | Confidence level: ★ ★ ★ [!] The robots.txt file does not permit crawling this hostname. [+] Checking HackerOne's directory for hostname | Confidence level: ★ ★ ★ https://hackerone.com/linkedin

L:dsm:x86_32 > archs ┌────────┬────────┬─────────┬─────────┬────────┐ │ │ │ │ │ │ │ arm32 │ mips32 │ sparc32 │ systemz │ x86_16 │ │ arm64 │ mips64 │ sparc64 │ │ x86_32 │ │ arm_tb │ │ │ │ x86_64 │ └────────┴────────┴─────────┴─────────┴────────┘

L:asm:x86_32 > sys open ┌────────┬───────┬──────────────────────┬──────────────────────┬──────────────┬──────────────┐ │ name │ eax │ ebx │ ecx │ edx │ esi │ ├────────┼───────┼──────────────────────┼──────────────────────┼──────────────┼──────────────┤ │ open │ 0x05 │ const char *filename │ int flags │ umode_t mode │ - │ │ openat │ 0x127 │ int dfd │ const char *filename │ int flags │ umode_t mode │ └────────┴───────┴──────────────────────┴──────────────────────┴──────────────┴──────────────┘

Command	Description
`clear`	Clear the terminal screen. As usual `cls` on Windows or `clear` on *nix systems.
`help`	Show the help message.
`quit,q,exit`	Finish the current session and quit

Command

Description

clear

Clear the terminal screen. As usual cls on Windows or clear on *nix systems.

help

Show the help message.

quit,q,exit

Finish the current session and quit

The basic command line arguments ( bettercap -h ) are:

argument	description
`-caplet FILENAME`	Read commands from this file and execute them in the interactive session.
`-eval COMMANDS`	Run one or more commands separated by `;` in the interactive session, used to set variables via command line.
`-iface INTERFACE`	Network interface to bind to, if empty the default interface will be auto selected (accepts interface name, ip or mac address).
`-no-history`	Disable the interactive session history file `~/.bettercap.history`.
`-env-file FILENAME`	Load environment variables from this file if found, set to empty to disable environment persistance. (default `~/bettercap.env`)
`-cpu-profile FILENAME`	Write cpu profile file (used for debugging and benchmarking).
`-mem-profile FILENAME`	Write memory profile to file (used for debugging and benchmarking).
`-silent`	Suppress all logs which are not errors.
`-debug`	Enable debug messages.

If no -caplet option is specified, bettercap will start in interactive mode, allowing you to start and stop modules manually, change options and apply new firewall rules on the fly.
To get a grasp of what you can do, type help and the general help menu will be shown, you can also have module specific help by using help module-name (for instance try with help net.recon), to see which modules are running and their configuration at any time, you can use the active command.
To print all variables and their values instead, you can use get * or get variable-name to get a single variable (try with get gateway.address), to set a new value you can simply set variable-name new-value (a value of "" will clear the variable contents), on a typical session variables look like this.

192.168.1.0/24 > 192.168.1.17  » get *


                        $: '{by}{fw}{cidr} {fb}> {env.iface.ipv4} {reset} {bold}» {reset}'

         api.rest.address: '<interface address>'
     api.rest.certificate: '~/.bcap-api.rest.certificate.pem'
             api.rest.key: '~/.bcap-api.rest.key.pem'
        api.rest.password: ''
            api.rest.port: '8083'
        api.rest.username: ''

        arp.spoof.targets: '<entire subnet>'

      dhcp6.spoof.address: '<interface address>'
      dhcp6.spoof.domains: 'microsoft.com, goole.com, facebook.com, apple.com, twitter.com'

        dns.spoof.address: '<interface address>'
            dns.spoof.all: 'false'
        dns.spoof.domains: '*'

     events.stream.filter: ''

          gateway.address: '192.168.1.1'
              gateway.mac: 'de:ad:be:ef:de:ad'

                http.port: '80'
       http.proxy.address: '<interface address>'
          http.proxy.port: '8080'
        http.proxy.script: ''
      http.server.address: '<interface address>'
         http.server.path: '.'
         http.server.port: '80'

               https.port: '443'
      https.proxy.address: '<interface address>'
  https.proxy.certificate: '~/.bettercap-ca.cert.pem'
          https.proxy.key: '~/.bettercap-ca.key.pem'
         https.proxy.port: '8083'
       https.proxy.script: ''

              iface.index: '6'
               iface.ipv4: '192.168.1.17'
               iface.ipv6: 'fe80::dddd:dddd:ffff:ffff'
                iface.mac: 'de:ad:be:ef:de:ad'
               iface.name: 'enx18ffffffff'

                log.debug: 'false'
               log.silent: 'false'

      mac.changer.address: '<random mac>'
        mac.changer.iface: '<interface name>'

       net.probe.throttle: '10'
         net.sniff.filter: 'not arp'
          net.sniff.local: 'false'
         net.sniff.output: ''
         net.sniff.regexp: ''
         net.sniff.source: ''
        net.sniff.verbose: 'true'

          ticker.commands: 'clear; net.show'
            ticker.period: '1'

       wifi.recon.channel: ''

Basic Commands

command	description
`help` / `help MODULE`	List available commands or show module specific help if no module name is provided.
`active`	Show information about active modules.
`quit` / `q`	Close the session and exit.
`sleep SECONDS`	Sleep for the given amount of seconds.
`get VARIABLE`	Get the value of `VARIABLE`, use `*` for all.
`set VARIABLE VALUE`	Set the value of `VARIABLE` to `VALUE`.
`clear`	Clear the screen .
`include CAPLET`	Load and run this caplet in the current session.
`!COMMAND`	Execute a shell command and print its output.
`alias MAC NAME`	Assign an alias to a given endpoint given its MAC address (will be persistent on file and used for the `net.show` command.

usage: python autosploit.py -[c|z|s|a] -[q] QUERY [-C] WORKSPACE LHOST LPORT [-e] [--ruby-exec] [--msf-path] PATH [-E] EXPLOIT-FILE-PATH [--rand-agent] [--proxy] PROTO://IP:PORT [-P] AGENT optional arguments: -h, --help show this help message and exit search engines: possible search engines to use -c, --censys use censys.io as the search engine to gather hosts -z, --zoomeye use zoomeye.org as the search engine to gather hosts -s, --shodan use shodan.io as the search engine to gather hosts -a, --all search all available search engines to gather hosts requests: arguments to edit your requests --proxy PROTO://IP:PORT run behind a proxy while performing the searches --random-agent use a random HTTP User-Agent header -P USER-AGENT, --personal-agent USER-AGENT pass a personal User-Agent to use for HTTP requests -q QUERY, --query QUERY pass your search query exploits: arguments to edit your exploits -E PATH, --exploit-file PATH provide a text file to convert into JSON and save for later use -C WORKSPACE LHOST LPORT, --config WORKSPACE LHOST LPORT set the configuration for MSF (IE -C default 127.0.0.1 8080) -e, --exploit start exploiting the already gathered hosts misc arguments: arguments that don't fit anywhere else --ruby-exec if you need to run the Ruby executable with MSF use this --msf-path MSF-PATH pass the path to your framework if it is not in your ENV PATH

Command	Description
`make buld`	Build all images
`make run`	Build and run all images
`make stop`	Stop all services
`make wipe`	Stop all services and wipe all images and mongodb data

Command

Description

make buld

Build all images

make run

Build and run all images

make stop

Stop all services

make wipe

Stop all services and wipe all images and mongodb data

Endpoint	method	Description
/	GET	Document of all endpoints
/statistics	GET	Informations about blocked requests, allowed requests, and number of all proxies on database(per day)
/ips?ip=127.0.0.1	GET	Search for a single IP on database
/all	GET	return all ips on database

Endpoint

method

Description

GET

Document of all endpoints

/statistics

GET

Informations about blocked requests, allowed requests, and number of all proxies on database(per day)

/ips?ip=127.0.0.1

GET

Search for a single IP on database

/all

GET

return all ips on database

Option	Description
A	Add a tool from GitHub using URL
F	Find a tool on GitHub
R	Reinstall your tools
U	Update your tools
S	Display information about your favorite tools
D	Delete the list of tools
M	Import your favorite tools
X	Export your tools to HTML

Option

Description

Add a tool from GitHub using URL

Find a tool on GitHub

Reinstall your tools

Update your tools

Display information about your favorite tools

Delete the list of tools

Import your favorite tools

Export your tools to HTML

Mitm6 - Pwning IPv4 Via IPv6

Invoke-Obfuscation - PowerShell Obfuscator

Revoke-Obfuscation - PowerShell Obfuscation Detection Framework

meg - Fetch Many Paths For Many Hosts (Without Killing The Hosts)

meg+ - Automated Reconnaissance Wrapper

contact.sh - An OSINT tool to find contacts in order to report security vulnerabilities

icebreaker - Gets Plaintext Active Directory Credentials If You'Re On The Internal Network

PoT - Phishing On Twitter

Shellen - Interactive Shellcoding Environment, In Which You Can Easily Craft Your Shellcodes

WAScan - Web Application Scanner

Protobuf-Inspector - Tool To Reverse-Engineer Protocol Buffers With Unknown Definition

Ninja Shell - Port Knocking Technique With AES256-GCM

Prithvi - A Report Generation Tool For Security Assessment

Passhunt - Tool For Searching Of Default Credentials For Network Devices, Web Applications And More

Bettercap v2.0 - The State Of The Art Network Attack And Monitoring Framework

AutoSploit v2.0 - Automated Mass Exploiter

Peanalyzer - Advanced Portable Executable File Analyzer And Disassembler

CrawlBox - Easy Way To Brute-Force Web Directory.

ipChecker - Check If A IP Is From Tor Or Is A Malicious Proxy

Cl0neMast3r - Git All Your Favorite Tools In One Click