Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsSharpStrike : A Post Exploitation Tool Written In C# Uses Either CIM Or WMI To Query Remote Systems
SharpStrike is a post-exploitation tool written in C# that uses either CIM or WMI to query remote systems. It can use provided credentials or the current user’s session.
Note: Some commands will use PowerShell in combination with WMI, denoted with ** in the
Introduction
SharpStrike is a C# rewrite and expansion on @Matt_Grandy_’s CIMplant and @christruncer’s WMImplant.
SharpStrike allows you to gather data about a remote system, execute commands, exfil data, and more. The tool allows connections using Windows Management Instrumentation, WMI, or Common Interface Model, CIM ; well more accurately Windows Management Infrastructure, MI. CIMplant requires local administrator permissions on the target system.
Setup
It’s probably easiest to use the built version under Releases, just note that it is compiled in Debug mode. If you want to build the solution yourself, follow the steps below.
1. Load SharpStrike.sln into Visual Studio
2. Go to Build at the top and then Build Solution if no modifications are wanted
The Build will produce two versions of SharpStrike: GUI (WinForms) & Console application. Each version implements the same features.
Usage
Console Version:
SharpStrike.exe –help
SharpStrike.exe –show-commands
SharpStrike.exe –show-examples
SharpStrike.exe -c ls_domain_admins
SharpStrike.exe -c ls_domain_users_list
SharpStrike.exe -c cat -f “c:\users\user\desktop\file.txt” -s [remote IP address]
SharpStrike.exe -c cat -f “c:\users\user\desktop\file.txt” -s [remote IP address] -u [username] -d [domain] -p [password] -c
SharpStrike.exe -c command_exec -e “quser” -s [remote IP address] -u [username] -d [domain] -p [password]
GUI version:
show-commands
show-examples
ls_domain_admins
ls_domain_users_list
cat -f “c:\users\user\desktop\file.txt” -s [remote IP address]
cat -f “c:\users\user\desktop\file.txt” -s [remote IP address] -u [username] -d [domain] -p [password]
command_exec -e “quser” [remote IP address] -u [username] -d [domain] -p [password]
Functions
File Operations
cat – Reads the contents of a file
copy – Copies a file from one location to another
download** – Download a file from the targeted machine
ls – File/Directory listing of a specific directory
search – Search for a file on a user
upload** – Upload a file to the targeted machine
Lateral Movement Facilitation
command_exec** – Run a command line command and receive the output. Run with nops flag to disable PowerShell
disable_wdigest – Sets the registry value for UseLogonCredential to zero
enable_wdigest – Adds registry value UseLogonCredential
disable_winrm** – Disables WinRM on the targeted system
enable_winrm** – Enables WinRM on the targeted system
reg_mod – Modify the registry on the targeted machine
reg_create – Create the registry value on the targeted machine
reg_delete – Delete the registry on the targeted machine
remote_posh** – Run a PowerShell script on a remote machine and receive the output
sched_job – Not implimented due to the Win32_ScheduledJobs accessing an outdated API
service_mod – Create, delete, or modify system services
ls_domain_users* – List domain users ls_domain_users_list* – List domain users sAMAccountName
ls_domain_users_email* – List domain users email address ls_domain_groups* – List domain user groups
ls_domain_admins* – List domain admin users ls_user_groups* – List domain user with their associated groups
ls_computers*** – List computers on current domain
Process Ope[...]
SharpStrike is a post-exploitation tool written in C# that uses either CIM or WMI to query remote systems. It can use provided credentials or the current user’s session.
Note: Some commands will use PowerShell in combination with WMI, denoted with ** in the
--show-commands command.Introduction
SharpStrike is a C# rewrite and expansion on @Matt_Grandy_’s CIMplant and @christruncer’s WMImplant.
SharpStrike allows you to gather data about a remote system, execute commands, exfil data, and more. The tool allows connections using Windows Management Instrumentation, WMI, or Common Interface Model, CIM ; well more accurately Windows Management Infrastructure, MI. CIMplant requires local administrator permissions on the target system.
Setup
It’s probably easiest to use the built version under Releases, just note that it is compiled in Debug mode. If you want to build the solution yourself, follow the steps below.
1. Load SharpStrike.sln into Visual Studio
2. Go to Build at the top and then Build Solution if no modifications are wanted
The Build will produce two versions of SharpStrike: GUI (WinForms) & Console application. Each version implements the same features.
Usage
Console Version:
SharpStrike.exe –help
SharpStrike.exe –show-commands
SharpStrike.exe –show-examples
SharpStrike.exe -c ls_domain_admins
SharpStrike.exe -c ls_domain_users_list
SharpStrike.exe -c cat -f “c:\users\user\desktop\file.txt” -s [remote IP address]
SharpStrike.exe -c cat -f “c:\users\user\desktop\file.txt” -s [remote IP address] -u [username] -d [domain] -p [password] -c
SharpStrike.exe -c command_exec -e “quser” -s [remote IP address] -u [username] -d [domain] -p [password]
GUI version:
show-commands
show-examples
ls_domain_admins
ls_domain_users_list
cat -f “c:\users\user\desktop\file.txt” -s [remote IP address]
cat -f “c:\users\user\desktop\file.txt” -s [remote IP address] -u [username] -d [domain] -p [password]
command_exec -e “quser” [remote IP address] -u [username] -d [domain] -p [password]
Functions
File Operations
cat – Reads the contents of a file
copy – Copies a file from one location to another
download** – Download a file from the targeted machine
ls – File/Directory listing of a specific directory
search – Search for a file on a user
upload** – Upload a file to the targeted machine
Lateral Movement Facilitation
command_exec** – Run a command line command and receive the output. Run with nops flag to disable PowerShell
disable_wdigest – Sets the registry value for UseLogonCredential to zero
enable_wdigest – Adds registry value UseLogonCredential
disable_winrm** – Disables WinRM on the targeted system
enable_winrm** – Enables WinRM on the targeted system
reg_mod – Modify the registry on the targeted machine
reg_create – Create the registry value on the targeted machine
reg_delete – Delete the registry on the targeted machine
remote_posh** – Run a PowerShell script on a remote machine and receive the output
sched_job – Not implimented due to the Win32_ScheduledJobs accessing an outdated API
service_mod – Create, delete, or modify system services
ls_domain_users* – List domain users ls_domain_users_list* – List domain users sAMAccountName
ls_domain_users_email* – List domain users email address ls_domain_groups* – List domain user groups
ls_domain_admins* – List domain admin users ls_user_groups* – List domain user with their associated groups
ls_computers*** – List computers on current domain
Process Ope[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux TutorialsSharpStrike : A Post Exploitation Tool Written In C# Uses Either CIM Or WMI To Query Remote Systems SharpStrike is a post-exploitation tool written in C# that uses either CIM or WMI to query remote systems. It can use provided credentials…
rations
process_kill – Kill a process via name or process id on the targeted machine
process_start – Start a process on the targeted machine
ps – Process listing
System Operations
active_users – List domain users with active processes on the targeted system
basic_info – Used to enumerate basic metadata about the targeted system
drive_list – List local and network drives
share_list – List network shares
ifconfig – Receive IP info from NICs with active network connections
installed_programs – Receive a list of the installed programs on the targeted machine
logoff – Log users off the targeted machine
reboot (or restart) – Reboot the targeted machine
power_off (or shutdown) – Power off the targeted machine
vacant_system – Determine if a user is away from the system
edr_query – Query the local or remote system for EDR vendors
Log Operations
logon_events – Identify users that have logged onto a system
All PowerShell can be disabled by using the –nops flag, although some commands will not execute (upload/download, enable/disable WinRM)
** Denotes PowerShell usage (either using a PowerShell Runspace or through Win32_Process::Create method)
*** Denotes LDAP usage – “root\directory\ldap” namespace
Solution Architecture
SharpStrike is composed of three main projects
* ServiceLayer — Provides core functionality and consumed by the UI layer
* Models — Contains types, shared across all projects
* User Interface — GUI/Console
ServiceLayer
* Connector.cs
This is where the initial CIM/WMI connections are made and passed to the rest of the application
* ExecuteWMI.cs
All function code for the WMI commands
* ExecuteCIM.cs
All function code for the CIM (MI) commands
Download
process_kill – Kill a process via name or process id on the targeted machine
process_start – Start a process on the targeted machine
ps – Process listing
System Operations
active_users – List domain users with active processes on the targeted system
basic_info – Used to enumerate basic metadata about the targeted system
drive_list – List local and network drives
share_list – List network shares
ifconfig – Receive IP info from NICs with active network connections
installed_programs – Receive a list of the installed programs on the targeted machine
logoff – Log users off the targeted machine
reboot (or restart) – Reboot the targeted machine
power_off (or shutdown) – Power off the targeted machine
vacant_system – Determine if a user is away from the system
edr_query – Query the local or remote system for EDR vendors
Log Operations
logon_events – Identify users that have logged onto a system
All PowerShell can be disabled by using the –nops flag, although some commands will not execute (upload/download, enable/disable WinRM)
** Denotes PowerShell usage (either using a PowerShell Runspace or through Win32_Process::Create method)
*** Denotes LDAP usage – “root\directory\ldap” namespace
Solution Architecture
SharpStrike is composed of three main projects
* ServiceLayer — Provides core functionality and consumed by the UI layer
* Models — Contains types, shared across all projects
* User Interface — GUI/Console
ServiceLayer
* Connector.cs
This is where the initial CIM/WMI connections are made and passed to the rest of the application
* ExecuteWMI.cs
All function code for the WMI commands
* ExecuteCIM.cs
All function code for the CIM (MI) commands
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
What happened when I found I 40-year-old program and realized it was something I wrote.
https://external-preview.redd.it/niEBGiBDN8yLjr-mqvhvFgTLy6evbPkpeFxyXm8mi_0.jpg?width=640&crop=smart&auto=webp&s=bfff81dbd3b55770c71c60883e8550b555f77da6 submitted by /u/mad_ned
[link] [comments]
What happened when I found I 40-year-old program and realized it was something I wrote.
https://external-preview.redd.it/niEBGiBDN8yLjr-mqvhvFgTLy6evbPkpeFxyXm8mi_0.jpg?width=640&crop=smart&auto=webp&s=bfff81dbd3b55770c71c60883e8550b555f77da6 submitted by /u/mad_ned
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
High-Severity RCE Vulnerability Found in Several Netgear Routers
https://external-preview.redd.it/VYsrwupb3q1HSXHAxVpxzKyiXrWQDV_oqyzEK3kLS-Y.jpg?width=640&crop=smart&auto=webp&s=6ea3a939018f4ab2427d7285f0e047027212be47 submitted by /u/george-alexander2k
[link] [comments]
High-Severity RCE Vulnerability Found in Several Netgear Routers
https://external-preview.redd.it/VYsrwupb3q1HSXHAxVpxzKyiXrWQDV_oqyzEK3kLS-Y.jpg?width=640&crop=smart&auto=webp&s=6ea3a939018f4ab2427d7285f0e047027212be47 submitted by /u/george-alexander2k
[link] [comments]
AWS WAF analysis: How it works and how to attack it
https://thexssrat.medium.com/aws-waf-analysis-how-it-works-and-how-to-attack-it-8a456e561c74?source=rss------bug_bounty-5
https://thexssrat.medium.com/aws-waf-analysis-how-it-works-and-how-to-attack-it-8a456e561c74?source=rss------bug_bounty-5
Deep Web
Booting TAILS using a HP v212w Flash Drive USB Stick (2.0 USB)
Hello, I'm new....
I've recently brought myself a HP v212w Flash Drive USB Stick and I'm tempted of using it specifically for booting TAILS onto my laptop only and I was wondering whether this specific USB stick would work for this intended use.
The reason on why I am asking this is because on the DNM Bible it states that some USBs are problematic for booting TAILS and provides a list but I can't access that list because the DNM subreddit was banned.
submitted by /u/7Leviathan7
[link] [comments]
Booting TAILS using a HP v212w Flash Drive USB Stick (2.0 USB)
Hello, I'm new....
I've recently brought myself a HP v212w Flash Drive USB Stick and I'm tempted of using it specifically for booting TAILS onto my laptop only and I was wondering whether this specific USB stick would work for this intended use.
The reason on why I am asking this is because on the DNM Bible it states that some USBs are problematic for booting TAILS and provides a list but I can't access that list because the DNM subreddit was banned.
submitted by /u/7Leviathan7
[link] [comments]
reddit
Booting TAILS using a HP v212w Flash Drive USB Stick (2.0 USB)
Hello, I'm new.... I've recently brought myself a HP v212w Flash Drive USB Stick and I'm tempted of using it specifically for booting TAILS onto...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsGraphw00F : GraphQL fingerprinting tool for GQL endpoints
Graphw00F (inspired by wafw00f) is the GraphQL fingerprinting tool for GQL endpoints, it sends a mix of benign and malformed queries to determine the GraphQL engine running behind the scenes. graphw00f will provide insights into what security defences each technology provides out of the box, and whether they are on or off by default.
Specially crafted queries cause different GraphQL server implementations to respond uniquely to queries, mutations and subscriptions, this makes it trivial to fingerprint the backend engine and distinguish between the various GraphQL implementations. (CWE: CWE-200)
Detections
graphw00f currently attempts to discover the following GraphQL engines:
* Graphene – Python
* Ariadne – Python
* Apollo – TypeScript
* graphql-go – Go
* gqlgen – Go
* WPGraphQL – PHP
* GraphQL API for WordPress – PHP
* Ruby – GraphQL
* graphql-php – PHP
* Hasura – Haskell
* HyperGraphQL – Java
* graphql-java – Java
* Juniper – Rust
* Sangria – Scala
* Flutter – Dart
* Diana.jl – Julia
* Strawberry – Python
* Tartiflette – Python
GraphQL Technologies Defence Matrices
Each fingerprinted technology (e.g. Graphene, Ariadne, …) has an associated document (example for graphene) which covers the security defence mechanisms the specific technology supports to give a better idea how the implementation may be attacked.
Field SuggestionsQuery Depth LimitQuery Cost AnalysisAutomatic Persisted QueriesIntrospectionDebug ModeBatch RequestsOn by DefaultNo SupportNo SupportNo SupportEnabled by DefaultN/AOff by Default
Prerequisites
* python3
* requests
Installation
Clone Repository
git clone git@github.com:dolevf/graphw00f.git
Run graphw00f
python3 main.py -h
Usage: main.py -h
Options:
-h, –help show this help message and exit
-r, –noredirect Do not follow redirections given by 3xx responses
-t URL, –target=URL target url with the path
-o OUTPUT_FILE, –output-file=OUTPUT_FILE
Output results to a file (CSV)
-l, –list List all GraphQL technologies graphw00f is able to
detect
-v, –version Print out the current version and exit.
Example
python3 main.py -t http://127.0.0.1:5000/graphql
+——————-+
| graphw00f |
+——————-+
*** ***
** ***
** **
+————–+ +————–+
| Node X | | Node Y |
+————–+ +————–+
*** ***
** **
** **
+————+
| Node Z |
+————+
graphw00f – v1.0.0
The fingerprinting tool for GraphQL
[] Checking if GraphQL is available at https://demo.hypergraphql.org:8484/graphql… [] Found GraphQL…
[] Attempting to fingerprint… [] Discovered GraphQL Engine: (HyperGraphQL)
[!] Attack Surface Matrix: https://github.com/dolevf/graphw00f/blob/main/docs/hypergraphql.md
[!] Technologies: Java
[!] Homepage: https://www.hypergraphql.org
[*] Completed.
Download
Graphw00F (inspired by wafw00f) is the GraphQL fingerprinting tool for GQL endpoints, it sends a mix of benign and malformed queries to determine the GraphQL engine running behind the scenes. graphw00f will provide insights into what security defences each technology provides out of the box, and whether they are on or off by default.
Specially crafted queries cause different GraphQL server implementations to respond uniquely to queries, mutations and subscriptions, this makes it trivial to fingerprint the backend engine and distinguish between the various GraphQL implementations. (CWE: CWE-200)
Detections
graphw00f currently attempts to discover the following GraphQL engines:
* Graphene – Python
* Ariadne – Python
* Apollo – TypeScript
* graphql-go – Go
* gqlgen – Go
* WPGraphQL – PHP
* GraphQL API for WordPress – PHP
* Ruby – GraphQL
* graphql-php – PHP
* Hasura – Haskell
* HyperGraphQL – Java
* graphql-java – Java
* Juniper – Rust
* Sangria – Scala
* Flutter – Dart
* Diana.jl – Julia
* Strawberry – Python
* Tartiflette – Python
GraphQL Technologies Defence Matrices
Each fingerprinted technology (e.g. Graphene, Ariadne, …) has an associated document (example for graphene) which covers the security defence mechanisms the specific technology supports to give a better idea how the implementation may be attacked.
Field SuggestionsQuery Depth LimitQuery Cost AnalysisAutomatic Persisted QueriesIntrospectionDebug ModeBatch RequestsOn by DefaultNo SupportNo SupportNo SupportEnabled by DefaultN/AOff by Default
Prerequisites
* python3
* requests
Installation
Clone Repository
git clone git@github.com:dolevf/graphw00f.git
Run graphw00f
python3 main.py -h
Usage: main.py -h
Options:
-h, –help show this help message and exit
-r, –noredirect Do not follow redirections given by 3xx responses
-t URL, –target=URL target url with the path
-o OUTPUT_FILE, –output-file=OUTPUT_FILE
Output results to a file (CSV)
-l, –list List all GraphQL technologies graphw00f is able to
detect
-v, –version Print out the current version and exit.
Example
python3 main.py -t http://127.0.0.1:5000/graphql
+——————-+
| graphw00f |
+——————-+
*** ***
** ***
** **
+————–+ +————–+
| Node X | | Node Y |
+————–+ +————–+
*** ***
** **
** **
+————+
| Node Z |
+————+
graphw00f – v1.0.0
The fingerprinting tool for GraphQL
[] Checking if GraphQL is available at https://demo.hypergraphql.org:8484/graphql… [] Found GraphQL…
[] Attempting to fingerprint… [] Discovered GraphQL Engine: (HyperGraphQL)
[!] Attack Surface Matrix: https://github.com/dolevf/graphw00f/blob/main/docs/hypergraphql.md
[!] Technologies: Java
[!] Homepage: https://www.hypergraphql.org
[*] Completed.
Download
Exploit Collector
Cloudron 6.2 Cross Site Scripting
Cloudron version 6.2 suffers from a cross site scripting vulnerability.
MD5 |
Download
Source:packetstormsecurity.com
Cloudron 6.2 Cross Site Scripting
Cloudron version 6.2 suffers from a cross site scripting vulnerability.
MD5 |
04e5263b2aba1564e3b29ea91dd03411Download
# Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
# Date: 10.06.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://cloudron.io
# Software Link: https://www.cloudron.io/get.html
# Version: 6.3 >
# CVE : CVE-2021-40868
Proof of Concept:
1. Go to https://localhost/login.html?returnTo=
2. Type your payload after returnTo=
3. Fill in the login information and press the sign in button.
Source:packetstormsecurity.com