Hacking Articles Tips Tricks Videos Tutorials

XSS via file upload

I found xss via file upload here i uploaded svg file which stored in google cloud and reflected with xssContinue reading on Medium »
Read more...

8 views07:24

8 views07:45

Kali Linux Tutorials
Ad-Honeypot-Autodeploy : Deploy A Small, Intentionally Insecure, Vulnerable Windows Domain For RDP Honeypot Fully Automatically

Ad-Honeypot-Autodeploy a tool to Deploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically.

Runs on self-hosted virtualization using libvirt with QEMU/KVM (but it can be customized easily for cloud-based solutions).

Used for painlessly set up a small Windows Domain from scratch automatically (without user interaction) for the purpose of RDP Honeypot testing.

Features a Domain Controller, a Desktop Computer and a configured Graylog server for logging the actions of the bad guys. Automatic deployment phases

1. Packer: download the necessary install media and setup the automated base virtual machine images unattended.
2. Terraform: provision the libvirt virtualization infrastructure (network + virtual machines) using the packer-prepared virtual machine images.
3. Ansible: Configure the infrastructure (DC, Desktop, Graylog) automatically, without user interaction.

After going through the Packer+Terraform+Ansible pipeline, the configured Windows Domain should be up and running, you could attach the RDP service of the Desktop to the public internet, and let’s monitor the events through the Graylog. Features

Features of the running system are:

* a Windows Server 2016 as a Domain Controller
* a Windows 10 Desktop (version 2004) as a Domain Computer
* a Graylog 3.3 (Open Source edition) running as a Log Collector on Ubuntu 18.04 LTS
* Using VirtIO drivers for best performance
* Enabled RDP and WinRM Services
* Populated Windows Active Directory with random users
* Sysmon (from Windows Sysinternals) installed and running on Domain Computers
* NXLog Collector running a Domain Computers and forwarding logs to Graylog
* Configured Graylog GeoIP lookup table and pipeline for IP addresses (useful for showing a map of invalid RDP login attempts)
* Graylog World Map of RDP attacks Host System Requirements

Virtualization needs some power of your host system:

* ~80 GB disk space for the base images and the sparse images of the guest computers.
* at least 3 x 4 GB memory for the guest machines (may run with less than 12 GB because of overcommitment)
* installed up-to-date libvirt with QEMU/KVM (official current packages in Ubuntu 18.04 LTS should work)
* Python 3 (preferably with venv) for Ansible

Tested on Ubuntu 18.04 LTS host. Installation and Usage

First, clone the repo:

git clone https://github.com/tothi/ad-honeypot-autodeploy
cd ad-honeypot-autodeploy

Before starting with Packer, set up the intial passwords:

./init_passwords.sh

Packer

Now build the initial images.

cd packer

Windows Server 2016 and Ubuntu installation media should be downloaded by the Packer script. VirtIO needs to be downloaded by the attached get-virtio.sh script:

./get-virtio.sh

Windows 10 should be downloaded manually by getting a temporary download link and save it to the ISO folder. The download link could be obtained from here. Select the English (International), 64-bit version and save the ISO to ISO/Win10_2004_EnglishInternational_x64.iso.

For mapping IP locations on a World Map in Graylog, the MaxMind GeoIP database is needed. Unfortunately due to licensing terms it cannot be redistributed, so you have to download it manually (after registering) from the MaxMind site. The free GeoLite2 version should work, get the “GeoLite2 City” Database in MMDB format (download the GZIP and untar) and put it at resources/GeoLite2-City.mmdb.

If you do not have Packer, get the latest version from the packer.io site (download the pre-compiled binary) or try to add the Hashicorp repository to your packaging system (useful for Terrafrom also).

If you are rebuilding the images, do not forget to clea[...]

___________________________
@hacking_Attack
@Hacking_Video

Ad-Honeypot-Autodeploy : Deploy A Small, Intentionally Insecure

Ad-Honeypot-Autodeploy a tool to Deploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically.

10 viewsedited 07:45

11 views07:45

Kali Linux Tutorials Ad-Honeypot-Autodeploy : Deploy A Small, Intentionally Insecure, Vulnerable Windows Domain For RDP Honeypot Fully Automatically Ad-Honeypot-Autodeploy a tool to Deploy a small, intentionally insecure, vulnerable Windows Domain for RDP…

n up previous builds:

rm -fr output_*

If you want to re-download the images, remove packer_cache:

rm -fr packer_cache

After these preparing steps, run the Packer builds in parallel:

./packer-build-all.sh

The images should be ready in a reasonable time (~20-30 mins depending on your host hardware power). Terraform

Now the infrastructure can be deployed using Terraform.

Get Terraform (>=0.13) if you do not have it (look at the install methods at Packer, above).

Terraform provider for libvirt is also needed, get the appropriate binary from the github releases page, and also look for Terraform v13 migration notes for proper installation.

Enter Terraform folder:

cd ../terraform

Initialize the working directory (only needed for first time use):

terraform init

Build and launch the infrastructure (“apply the changes”):

terraform apply

After a short time (~2-3 mins), the network and virtual machines are up and running.

WARNING: You should take care of protecting your private network. The terraform config (main.tf) provided here just contains a custom firewall rule for my own testing environment (blocking 192.168.0.0/16 destination traffic from the 192.168.3.0/24 honeypot network).

Next is the configuration phase. Ansible

Get into the ansible folder:

cd ../ansible

Recommended installation method is installing the latest Ansible with some required additional dependencies in a Python venv virtualized environment:

python3 -m venv venv
. ./venv/bin/activate
pip install ansible pywinrm faker

For later use just activate the venv by

. ./venv/bin/activate

And just deactivateif it is not needed anymore in your current session.

You should put an SSH public key with filename id.pubinto the ansible folder for accessing the Ubuntu Graylog machine with the ubuntu user (ansible will add it to ~ubuntu/.ssh/authorized_keys).

The wordlist.txtfile contains some (intentionally weak) passwords for the populated domain users which can be customized.

Run the configuration phase:

ansible-playbook -i hosts setup-domain.yml -v

After 20-25 mins everything is ready. The deployed system
hostnameip addressoperating systemroledc1192.168.3.100Windows Server 2016Domain Controllerdesktop12192.168.3.112Windows 10 (version 2004)Domain Member Workstationgraylog192.168.3.191Ubuntu 18.04 LTSGraylog Server
According to the libvirt network configuration (NAT), the hosts can access the public internet (if your host system allows it).

Accessing the hosts is possible through the host system. Practically using an SSH socks tunnel and proxychains for RDP or WinRM access is very comfortable.

For example, if your libvirt host IP is 192.168.0.10, create a socks tunnel listening on localhost:5000by

ssh 192.168.0.10 -D5000 -NTv

And access the Windows 10 desktop (using an appropriate /etc/proxychains.confconfigured for the :5000 tunnel):

proxychains xfreerdp /v:192.168.3.112 /u:administrator

Or, access the Graylog web interface listening on :9000 locally on the Graylog Ubuntu server by SSH ProxyJump and custom forward tunnel:

ssh -J 192.168.0.10 ubuntu@192.168.3.191 -NTv -L9000:127.0.0.1:9000

Then open URL http://localhost:9000and you reach the Graylog web interface.

For activating the RDP honeypot, just allow public access to 192.168.3.112:3389 (for example with some port forwarding configuration on your router and iptables rules on the host machine; my helper script is rdp_public.sh) and keep watching the Graylog. https://s.w.org/images/core/emoji/13.1.0/72x72/1f609.png Download

___________________________
@hacking_Attack
@Hacking_Video

12 viewsedited 07:45

8 views07:45

Kali Linux Tutorials
Abaddon : Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities

Abaddon is a Red team operations involve miscellaneous skills, last several months and are politically sensitive; they require a lot of monitoring, consolidating and caution. Wavestone’s red team operations management software, Abaddon, has been designed to make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities.

Because:

* There are tons of tools used by red teamers
* … but no operation management (and free and open-source) software
* … and no aggregation between these tools, anyway
* … and “Operational security” failures are common

What did we want with Abaddon ?:

Abaddon aims at facilitating red team operations by:

* Reducing the time to build an infrastructure
* Enabling complex actions with 1 or 2 clicks
* Enabling easier reporting for long operations
* Reducing the “OPSEC failure” risk

The slides presenting Abaddon at RSAC2020 can be found here: (Abaddon, the red team angel) What You Can Deploy
https://blogger.googleusercontent.com/img/a/AVvXsEjd57Z7KZ8D3gnPG-DtW1oSyGO65xC-xImVYNdnS0A7X7Hc5iX-KqQNBh99Fc__qo8PwFvHV6crfxIxtYgBWn5GXEM_45Pe058iEwned9DGzm9XDSYPWtOYQ5XDThQFAWKrKyDJGF3uy9r5CFJa2Z5qzLtzZdS5lu1h15xJu2vZRewQmYslVaL_jIja=s1233
* Deployed within 30 minutes
* Throwable, authenticated, stealth
* Enables phishing as well as remote command execution Other Features

* Reconnaissance: graphical interface to NMAP, Recon-NG, HunterIO, and Amass
* Weaponization: generation of obfuscated payloads under development
* Delivery: one or two-clicks deployment of EC2 instances, Gophish, and of a fully functionnal, stealthy & dockerized C&C infrastructure as shown above
* Exploitation & Post-Exploitation: ideas under development https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png
* Reporting: a simple dashboard ready but still under development to follow your operations Installing And Launching Abaddon

Abaddon has been tested on Debian, LUbuntu, and of course KALI Linux (latest tests have been performed on the 5.4.0 amd64 version). You also need to have Internet access, and a public IP address if you want to deploy your C&C server locally.

Note that to configure your AWS environment, the easiest way is probably to install the aws-cli like indicated here: https://docs.aws.amazon.com/fr_fr/cli/latest/userguide/install-cliv2-linux.html

curl “https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip” -o “awscliv2.zip”
unzip awscliv2.zip
sudo ./aws/install

Clone this repository and move inside the repository folder

git clone git@github.com/wavestone-cdt/abaddon.git
cd abaddon

Create the files ~/.aws/credentials and ~/.aws/config with your AWS credentials and configuration, using the following command:

aws configure

Move settings.py.sample to settings.py. Add change the database user password (This password will be asked durring the setup process)

mv abaddon/settings.py.sample abaddon/settings.py
sed -i ‘s/yourPasswordHere//g’ abaddon/settings.py

Launch the following command in the abaddon/setup folder:

bash setup/install.sh

This script will:

* Update your OS
* Install the packages that are required by Django and Abaddon (including docker and docker-compose)
* Install all the python dependencies (including Django 3.X)
* Create a PostgreSQL database and a user with the right role (the password for the database that you need to give is inside the abaddon/settings.py file, it is recommended to change the password)
* Apply Django migrations
* Create a superuser for the Django application, that will be used to connect to the graphical interface of Abaddon.

Start the Red Team Angel !

bash abaddon.sh

Open a browser, and go t[...]

___________________________
@hacking_Attack
@Hacking_Video

Abaddon : Make red team operations faster, more repeatable, stealthier.

Abaddon is a Red team operations involve miscellaneous skills, last several months and are politically sensitive.

9 viewsedited 07:45

Kali Linux Tutorials
Canadian Furious Beaver : A Tool For Monitoring IRP Handler In Windows Drivers, And Facilitating The Process Of Analyzing, Replaying And Fuzzing Windows Drivers For Vulnerabilities

Canadian Furious Beaver is a distributed tool for capturing IRPs sent to any Windows driver. It operates in 2 parts:

1. the “Broker” combines both a user-land agent and a self-extractable driver (IrpDumper.sys) that will install itself on the targeted system. Once running it will expose (depending on the compilation options) a remote named pipe (reachable from \\target.ip.address\pipe\cfb), or a TCP port listening on TCP/1337. The communication protocol was made to be simple by design (i.e. not secure) allowing any 3rd party tool to dump the driver IRPs from the same Broker easily (via simple JSON messages).
2. the GUI is a Windows 10 UWP app made in a ProcMon-style: it will connect to wherever the broker is, and provide a convienent GUI for manipulating the broker (driver enumeration, hooking and IRP capturing). It also offers facililties for forging/replaying IRPs, auto-fuzzing (i.e. apply specific fuzzing policies on each IRP captured), or extract IRP in various formats (raw, as a Python script, as a PowerShell script) for further analysis. The captured data can be saved on disk in an easily parsable format (*.cfb = SQLite) for further analysis, and/or reload afterwards in the GUI.

Although the GUI obviously requires a Windows 10 environment (UWP App), the Broker itself can be deployed on any Windows 7+ host (x86 or x64). The target host must have testsigningBCD policy enabled, as the self-extracting driver is not WHQL friendly. Screenshots Intercepted IRP view
https://blogger.googleusercontent.com/img/a/AVvXsEhTdkv8WkSAWv7q4dKU-p7yduaX39G9fupngmIHv_a1_uljlxYvwek1w9TV6-XjU4mNjW7PZfbqEGkTBDwbNSWOL4ABgXd9lvbYlfl2Y--wfwOU2bsVsO98SItXtMUlPiTVcLJbvAln159ngmESueV44REwAEuUD39qCY9VE7933oE0_jWxVLpsUQfK=s2229
IRP details
https://blogger.googleusercontent.com/img/a/AVvXsEiqlu-HDxB_Lq990NsjB4sef6PBXsR6ca-O--2sfmpUsuaR9aUU07SvFrVO0J30AGeQzEz834cl6lAmyRy-GncMPfYOSaH8df4NLdnXq8NY25RkyoE1U6dT2G4n_jbiZl_5Ip4yf6YH4H6bBOqoa7TRwEmZ-tPAdrzKb0emmw8WhwyRtasFJnXIk-Ed=s2388 https://blogger.googleusercontent.com/img/a/AVvXsEhlpynB1xzPMnbfyAes9XVAFKltFI6cKFJDPQSPTmUv-QULWJdMqVIzuCWXO3ya54Jk63cKSu3_VnfITWXLwV37wgex8TISjzTiUQ555VftyLwWl2VwnHVttLX78wcCtL5tRDJ672PSv8i2q_rCHDtPD7KYsfQNuCXr3NNnc8_N660sPfZTaoAZkGLt=s2388
IRP replay
https://blogger.googleusercontent.com/img/a/AVvXsEiw68SmFEwW8xsyUnQUQYZLnMRDt-5BX-lz6z_iG-uYrSr_SnNPLsTCkQOgCbpT1bCWfIohmU5-v9NuVRBSDUexYi-pnkTYOs4AfpQ3G3OcpPRGTtk4wfAWgc2StmuI7jH7o_gH9GVdr0thBCTqF36JA33vgA0kFkwoLtZaQWKuPcu42iMhgJ3YI3-P=s2388
Concept IrpDumper.sysis the driver part of the CFB Broker that will auto-extract and install when launched. The driver will be responsible for hooking the IRP Major Function table of the driver that is requested to be hooked, via an IOCTL passed from the Broker. Upon success, the IRP table of the driver will then be pointing to IrpDumper.sysinterception routine, as we can easily see with a debugger or tools like WinObjEx64.
https://blogger.googleusercontent.com/img/a/AVvXsEgSU2Zgiv-iqjpZe9pa6lQv96He1mHvUS33aMwbPUHySQglZ3IsFsgMGGFzek3O63lKSvXPnLgE-xEuWGuY1fjyttj4q4Zt1N1l-o-gIVkm-WjCWxBzeTb5pEr2b4yl2zb4SdOZIyROKu_tlaB6Rqk6r2rS7XrmYME6UT8DMg2p666xXKXaNQm30_bw=s751 IrpDumper.sysin itself then acts a rootkit, proxy-ing all calls to the targeted driver(s). When a DeviceIoControlis sent to a hooked driver, IrpDumperwill simply capture the data if any, and push a message to the user-land agent (Broker), and yield the execution back to the legitimate drivers, allowing the intended code to continue as expected. The Brokerstores all[...]

___________________________
@hacking_Attack
@Hacking_Video

Canadian Furious Beaver : A Tool For Monitoring IRP Handler In Windows

Canadian Furious Beaver is a distributed tool for capturing IRPs sent to any Windows driver. It operates in 2 parts.

11 viewsedited 07:45

10 views07:45

Kali Linux Tutorials Abaddon : Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities Abaddon is a Red team operations involve miscellaneous skills, last several months…

o the URL 127.0.0.1:8000 (connect with the Django superuser credentials created during the installation). Deployment Of A C&C Infrastructure Inside Abaddon

* If no EC2 instance has been deployed before from Abaddon (it is important that you deploy the EC2 from Abaddon, so that you have access to the SSH key, located in the aws folder), go to the Delivery/Let’s phish! page. Click on Deploy EC2!. Wait for the end of the deployment (you can check inside the terminal used to start Abaddon if the EC2 is ready to be used, all the deployment steps appear in the shell).
* Go to the misc/apache/default-ssl.conf file and UPDATE the domain name of the EC2 inside the second VirtualHost. To avoid the detection of your infrastructure, buy a new domain name and configure it to point to your EC2. Use this domain name in the Apache configuration file and UPDATE misc/apache/topsecret.key and misc/apache/topsecret.crt accordingly, which is with the private key and the certificate of your new domain.
* Go then to the Monitor current Scenarios page and click on Configure a RedELK infrastructure. Give this scenario a name. Abaddon supports actually only one scenario at the time. Choose an EC2 instance deployed from your Abaddon and choose Local Deployment (because you deploy your Apache docker locally). Then, choose the ports used by the deployed EC2 to receive the HTTP and SSL connections, and the port and the IP address the Apache reverse proxy will forward the traffic to (for instance, the IP and port your SILENTTRINITY server listens to). A common configuration would be the following:
* http port = 80ssl port = 443Listening Port= 9999C2 IP adress = 172.16.0.1* Wait for the end of the deployment and go back to the Monitor current Scenarios page. Download

___________________________
@hacking_Attack
@Hacking_Video

11 viewsedited 07:45

7 views07:45

7 views07:45

Kali Linux Tutorials
AzureHunter : A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365

AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes

Getting Started

Check that you have the right O365 Permissions

The following roles are required in Exchange Online, in order to be able to have read only access to the UnifiedAuditLog: View-Only Audit Logsor Audit Logs.

These roles are assigned by default to the Compliance Managementrole group in Exchange Admin Center.

NOTE: if you are a security analyst, incident responder or threat hunter and your organization is NOT giving you read-only access to these audit logs, you need to seriously question what their detection and response strategy is!

More information:

* How to search the Audit Log using the GUI
* Manage role groups in Exchange Online
* How to enable the UnifiedAuditLog

NOTE: your admin can verify these requirements by running Get-ManagementRoleEntry "*\Search-UnifiedAuditLog"in your Azure tenancy cloud shell or local powershell instance connected to Azure.

Ensure ExchangeOnlineManagement v2 PowerShell Module is installed

Please make sure you have ExchangeOnlineManagement (EXOv2) installed. You can find instructions on the web or go directly to my little KB on how to do it at the soc analyst scrolls

Either Clone the Repo or Install AzureHunter from the PSGallery

Cloning the Repo

1. Clone this repository
2. Import the module Import-Module .\source\AzureHunter.psd1Install AzureHunter from the PSGallery

All you need to do is:

Install-Module AzureHunter -Scope CurrentUser
Import-Module AzureHunter

What Is The UnifiedAuditLog?

The unified audit log contains user, group, application, domain, and directory activities performed in the Microsoft 365 admin center or in the Azure management portal. For a complete list of Azure AD events, see the list of RecordTypes.

The UnifiedAuditLog is a great source of cloud forensic information since it contains a wealth of data on multiple types of cloud operations like ExchangeItems, SharePoint, Azure AD, OneDrive, Data Governance, Data Loss Prevention, Windows Defender Alerts and Quarantine events, Threat intelligence events in Microsoft Defender for Office 365 and the list goes on and on! AzureHunter Data Consistency Checks

AzureHunter implements some useful logic to ensure that the highest log density is mined and exported from Azure & O365 Audit Logs. In order to do this, we run two different operations for each cycle (batch):

1. Automatic Window Time Reduction: this check ensures that the time interval is reduced to the optimal interval based on the ResultSizeUpperThreshold parameter which by default is 20k. This means, if the amounts of logs returned within your designated TimeInterval is higher than ResultSizeUpperThreshold, then an automatic adjustment will take place.
2. Sequential Data Check: are returned Record Indexes sequentially valid?
https://blogger.googleusercontent.com/img/a/AVvXsEj-qFED47rqcQy9G5lyRJx3zw5dIQSYotrXkwf0vx7KajGWpcnPuG_q4wPHG4VLnVodFK0s7Pb4AwqPUbDY2HgkwtWevXLbj93utu1PACxFmFqL4Z48Ztf_G5eHC4a8AVQVb2irxZrJcYQ2Q9P5Bsp7utRs1hnSdggonC9aECVzFnYlaaq1jLO81fqL=s2640
Usage Ensure you connect to ExchangeOnline

It’s recommended that you run Connect-ExchangeOnlinebefore running any AzureHuntercommands. The program checks for an active remote session and attempts to connect but some versions of Powershell don’t allow this and you need to do it yourself regardless. Run AzureHunter

AzureHunter has two main commands: Search-AzureCloudUnifiedLogand Invoke-AzHunterPlaybook.

The purpose of Search-AzureCloudUnifiedLogis to implement a complex logic[...]

___________________________
@hacking_Attack
@Hacking_Video

AzureHunter : A Cloud Forensics Powershell Module To Run Threat

AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes.

9 viewsedited 07:45

8 views07:45