Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
truffleHog : Searches Through Git Repositories For High Entropy Strings And Secrets
truffleHog previously functioned by running entropy checks on git diffs. This functionality still exists, but high signal regex checks have been added, and the ability to suppress entropy checking has also been added.
trufflehog –regex –entropy=False https://github.com/dxa4481/truffleHog.git
or
trufflehog file:///user/dxa4481/codeprojects/truffleHog/
With the
include-patterns.txt:
src/
lines beginning with “#” are treated as comments and are ignored
gradle/
regexes must match the entire path, but can use python’s regex syntax for
case-insensitive matching and other advanced options
(?i)..(properties|conf|ini|txt|y(a)?ml)$ (./)?id_[rd]sa$
exclude-patterns.txt:
(./)?.classpath$ ..jmx$
(./)?test/(./)?resources/
These filter files could then be applied by:
trufflehog –include_paths include-patterns.txt –exclude_paths exclude-patterns.txt file://path/to/my/repo.git
With these filters, issues found in files in the root-level
These features help cut down on noise, and makes the tool easier to shove into a devops pipeline.
https://blogger.googleusercontent.com/img/a/AVvXsEieJEoWU-DRJkFxYSeMYZjbyHibjQdQ4iB-O8IyDTJiXREgO7lvzIPs0rWDJqJgp5ogZErRufthpYGYevYrUKV2tWql947CREr6sIENT-_7jdDnBVAx5dyJAS_4n1MbY1FIzyZ5sEPD8uGok7eTgF-czbUxcHuy-I0f4ibITQAjdi2Bfx-9WPOEUC8E=s1708
Install
pip install truffleHog CustomizingCustom regexes can be added with the following flag
{
“RSA private key”: “—–BEGIN EC PRIVATE KEY—–“
}
Things like subdomain enumeration, s3 bucket detection, and other useful regexes highly custom to the situation can be added.
Feel free to also contribute high signal regexes upstream that you think will benefit the community. Things like Azure keys, Twilio keys, Google Compute keys, are welcome, provided a high signal regex can be constructed.
trufflehog’s base rule set sources from https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
To explicitly allow particular secrets (e.g. self-signed keys used only for local testing) you can provide an allow list
{
“local self signed test key”: “—–BEGIN EC PRIVATE KEY—–\nfoobar123\n—–END EC PRIVATE KEY—–“,
“git cherry pick SHAs”: “regex:Cherry picked from .*”,
}
Note that values beginning with
cd /pa[...]
___________________________
@hacking_Attack
@Hacking_Video
truffleHog : Searches Through Git Repositories For High Entropy Strings And Secrets
truffleHog previously functioned by running entropy checks on git diffs. This functionality still exists, but high signal regex checks have been added, and the ability to suppress entropy checking has also been added.
trufflehog –regex –entropy=False https://github.com/dxa4481/truffleHog.git
or
trufflehog file:///user/dxa4481/codeprojects/truffleHog/
With the
--include_pathsand --exclude_pathsoptions, it is also possible to limit scanning to a subset of objects in the Git history by defining regular expressions (one per line) in a file to match the targeted object paths. To illustrate, see the example include and exclude files below:include-patterns.txt:
src/
lines beginning with “#” are treated as comments and are ignored
gradle/
regexes must match the entire path, but can use python’s regex syntax for
case-insensitive matching and other advanced options
(?i)..(properties|conf|ini|txt|y(a)?ml)$ (./)?id_[rd]sa$
exclude-patterns.txt:
(./)?.classpath$ ..jmx$
(./)?test/(./)?resources/
These filter files could then be applied by:
trufflehog –include_paths include-patterns.txt –exclude_paths exclude-patterns.txt file://path/to/my/repo.git
With these filters, issues found in files in the root-level
srcdirectory would be reported, unless they had the .classpathor .jmxextension, or if they were found in the src/test/dev/resources/directory, for example. Additional usage information is provided when calling trufflehogwith the -hor --helpoptions.These features help cut down on noise, and makes the tool easier to shove into a devops pipeline.
https://blogger.googleusercontent.com/img/a/AVvXsEieJEoWU-DRJkFxYSeMYZjbyHibjQdQ4iB-O8IyDTJiXREgO7lvzIPs0rWDJqJgp5ogZErRufthpYGYevYrUKV2tWql947CREr6sIENT-_7jdDnBVAx5dyJAS_4n1MbY1FIzyZ5sEPD8uGok7eTgF-czbUxcHuy-I0f4ibITQAjdi2Bfx-9WPOEUC8E=s1708
Install
pip install truffleHog CustomizingCustom regexes can be added with the following flag
--rules /path/to/rules. This should be a json file of the following format:{
“RSA private key”: “—–BEGIN EC PRIVATE KEY—–“
}
Things like subdomain enumeration, s3 bucket detection, and other useful regexes highly custom to the situation can be added.
Feel free to also contribute high signal regexes upstream that you think will benefit the community. Things like Azure keys, Twilio keys, Google Compute keys, are welcome, provided a high signal regex can be constructed.
trufflehog’s base rule set sources from https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
To explicitly allow particular secrets (e.g. self-signed keys used only for local testing) you can provide an allow list
--allow /path/to/allowin the following format:{
“local self signed test key”: “—–BEGIN EC PRIVATE KEY—–\nfoobar123\n—–END EC PRIVATE KEY—–“,
“git cherry pick SHAs”: “regex:Cherry picked from .*”,
}
Note that values beginning with
regex:will be used as regular expressions. Values without this will be literal, with some automatic conversions (e.g. flexible newlines). How it worksThis module will go through the entire commit history of each branch, and check each diff from each commit, and check for secrets. This is both by regex and by entropy. For entropy checks, truffleHog will evaluate the shannon entropy for both the base64 char set and hexidecimal char set for every blob of text greater than 20 characters comprised of those character sets in each diff. If at any point a high entropy string >20 characters is detected, it will print to the screen. Running with DockerFirst, enter the directory containing the git repositorycd /pa[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
truffleHog : Searches Through Git Repositories For High Entropy Strings
truffleHog previously functioned by running entropy checks on git diffs. This functionality still exists, but high signal regex checks.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials truffleHog : Searches Through Git Repositories For High Entropy Strings And Secrets truffleHog previously functioned by running entropy checks on git diffs. This functionality still exists, but high signal regex checks have been added…
th/to/git
To launch the trufflehog with the docker image, run the following”
docker run –rm -v “$(pwd):/proj” dxa4481/trufflehog file:///proj
___________________________
@hacking_Attack
@Hacking_Video
To launch the trufflehog with the docker image, run the following”
docker run –rm -v “$(pwd):/proj” dxa4481/trufflehog file:///proj
-vmounts the current working dir (pwd) to the /projdir in the Docker container file:///projreferences that very same /projdir in the container (which is also set as the default working dir in the Dockerfile) Download___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Exrop : Automatic ROP Chain Generation
Exrop is automatic ROP chains generator tool which can build gadget chain automatically from given binary and constraints
Requirements : Triton, ROPGadget
Only support for x86-64 for now! Features* handling non-return gadgets (jmp reg, call reg)
* set registers (
* set register to register (
* write to mem
* write string/bytes to mem
* function call (
* pass register in function call (
* avoiding badchars
* stack pivoting (
* syscall (
* see examples Installation* install python (3.6 is recomended and tested)
* install triton (https://triton.quarkslab.com/documentation/doxygen/index.html#linux_install_sec), make sure you add
* install ropgadget (https://github.com/JonathanSalwan/ROPgadget)
* to install exrop, easily add
rop = Exrop(“/bin/ls”)
rop.find_gadgets(cache=True)
print(“write-regs gadgets: rdi=0x41414141, rsi:0x42424242, rdx: 0x43434343, rax:0x44444444, rbx=0x45454545”)
chain = rop.set_regs({‘rdi’:0x41414141, ‘rsi’: 0x42424242, ‘rdx’:0x43434343, ‘rax’:0x44444444, ‘rbx’: 0x45454545})
chain.dump()
print(“write-what-where gadgets: [0x41414141]=0xdeadbeefff, [0x43434343]=0x110011”)
chain = rop.set_writes({0x41414141: 0xdeadbeefff, 0x43434343: 0x00110011})
chain.dump()
print(“write-string gadgets 0x41414141=\”Hello world!\n\””)
chain = rop.set_string({0x41414141: “Hello world!\n”})
chain.dump()
print(“func-call gadgets 0x41414141(0x20, 0x30, \”Hello\”)”)
chain = rop.func_call(0x41414141, (0x20, 0x30, “Hello”), 0x7fffff00)
chain.dump()
Output:
write-regs gadget: rdi=0x41414141, rsi:0x42424242, rdx: 0x43434343, rax:0x44444444, rbx=0x45454545
$RSP+0x0000 : 0x00000000000060d0 # pop rbx; ret
$RSP+0x0008 : 0x0000000044444444
$RSP+0x0010 : 0x0000000000014852 # mov rax, rbx; pop rbx; ret
$RSP+0x0018 : 0x0000000000000000
$RSP+0x0020 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0028 : 0x0000000041414141
$RSP+0x0030 : 0x000000000000629c # pop rsi; ret
$RSP+0x0038 : 0x0000000042424242
$RSP+0x0040 : 0x0000000000003a62 # pop rdx; ret
$RSP+0x0048 : 0x0000000043434343
$RSP+0x0050 : 0x00000000000060d0 # pop rbx; ret
$RSP+0x0058 : 0x0000000045454545
write-what-where gadgets: [0x41414141]=0xdeadbeefff, [0x43434343]=0x110011
$RSP+0x0000 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0008 : 0x000000deadbeefff
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x0000000041414139
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000000110011
$RSP+0x0040 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0048 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0050 : 0x000000004343433b
$RSP+0x0058 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
write-string gadgets 0x41414141=”Hello world!\n”
$RSP+0x0000 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0008 : 0x6f77206f6c6c6548
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x0000000041414139
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000a21646c72
$RSP+0x0040 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0048 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0050 : 0x0000000041414141
$RSP+0x0058 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
func-call gadgets 0x41414141(0x20, 0x30, “Hello”)
$RSP+0x0000 : 0x0000[...]
___________________________
@hacking_Attack
@Hacking_Video
Exrop : Automatic ROP Chain Generation
Exrop is automatic ROP chains generator tool which can build gadget chain automatically from given binary and constraints
Requirements : Triton, ROPGadget
Only support for x86-64 for now! Features* handling non-return gadgets (jmp reg, call reg)
* set registers (
rdi=0xxxxxx, rsi=0xxxxxx)* set register to register (
rdi=rax)* write to mem
* write string/bytes to mem
* function call (
open('/etc/passwd',0))* pass register in function call (
read('rax', bss, 0x100))* avoiding badchars
* stack pivoting (
Exrop.stack_pivot)* syscall (
Exrop.syscall)* see examples Installation* install python (3.6 is recomended and tested)
* install triton (https://triton.quarkslab.com/documentation/doxygen/index.html#linux_install_sec), make sure you add
-DPYTHON36=onas cmake option* install ropgadget (https://github.com/JonathanSalwan/ROPgadget)
* to install exrop, easily add
export PYTHONPATH=/path/to/exrop:$PYTHONPATHin your .bashrc(depends on your shell) Demofrom Exrop import Exroprop = Exrop(“/bin/ls”)
rop.find_gadgets(cache=True)
print(“write-regs gadgets: rdi=0x41414141, rsi:0x42424242, rdx: 0x43434343, rax:0x44444444, rbx=0x45454545”)
chain = rop.set_regs({‘rdi’:0x41414141, ‘rsi’: 0x42424242, ‘rdx’:0x43434343, ‘rax’:0x44444444, ‘rbx’: 0x45454545})
chain.dump()
print(“write-what-where gadgets: [0x41414141]=0xdeadbeefff, [0x43434343]=0x110011”)
chain = rop.set_writes({0x41414141: 0xdeadbeefff, 0x43434343: 0x00110011})
chain.dump()
print(“write-string gadgets 0x41414141=\”Hello world!\n\””)
chain = rop.set_string({0x41414141: “Hello world!\n”})
chain.dump()
print(“func-call gadgets 0x41414141(0x20, 0x30, \”Hello\”)”)
chain = rop.func_call(0x41414141, (0x20, 0x30, “Hello”), 0x7fffff00)
chain.dump()
Output:
write-regs gadget: rdi=0x41414141, rsi:0x42424242, rdx: 0x43434343, rax:0x44444444, rbx=0x45454545
$RSP+0x0000 : 0x00000000000060d0 # pop rbx; ret
$RSP+0x0008 : 0x0000000044444444
$RSP+0x0010 : 0x0000000000014852 # mov rax, rbx; pop rbx; ret
$RSP+0x0018 : 0x0000000000000000
$RSP+0x0020 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0028 : 0x0000000041414141
$RSP+0x0030 : 0x000000000000629c # pop rsi; ret
$RSP+0x0038 : 0x0000000042424242
$RSP+0x0040 : 0x0000000000003a62 # pop rdx; ret
$RSP+0x0048 : 0x0000000043434343
$RSP+0x0050 : 0x00000000000060d0 # pop rbx; ret
$RSP+0x0058 : 0x0000000045454545
write-what-where gadgets: [0x41414141]=0xdeadbeefff, [0x43434343]=0x110011
$RSP+0x0000 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0008 : 0x000000deadbeefff
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x0000000041414139
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000000110011
$RSP+0x0040 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0048 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0050 : 0x000000004343433b
$RSP+0x0058 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
write-string gadgets 0x41414141=”Hello world!\n”
$RSP+0x0000 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0008 : 0x6f77206f6c6c6548
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x0000000041414139
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000a21646c72
$RSP+0x0040 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0048 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0050 : 0x0000000041414141
$RSP+0x0058 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
func-call gadgets 0x41414141(0x20, 0x30, “Hello”)
$RSP+0x0000 : 0x0000[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Exrop : Automatic ROP Chain Generation !!! Kali Linux
Exrop is automatic ROP chains generator tool which can build gadget chain automatically from given binary and constraints.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Exrop : Automatic ROP Chain Generation Exrop is automatic ROP chains generator tool which can build gadget chain automatically from given binary and constraints Requirements : Triton, ROPGadget Only support for x86-64 for now! Features*…
000000004ce5 # pop rdi; ret
$RSP+0x0008 : 0x0000006f6c6c6548
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x000000007ffffef8
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000000000020
$RSP+0x0040 : 0x000000000000629c # pop rsi; ret
$RSP+0x0048 : 0x0000000000000030
$RSP+0x0050 : 0x0000000000003a62 # pop rdx; ret
$RSP+0x0058 : 0x000000007fffff00
$RSP+0x0060 : 0x0000000041414141
python3 tests.py 1,48s user 0,05s system 97% cpu 1,566 total
Another example: open-read-write gadgets!
from pwn import *
import time
from Exrop import Exrop
binname = “/lib/x86_64-linux-gnu/libc.so.6”
libc = ELF(binname, checksec=False)
open = libc.symbols[‘open’]
read = libc.symbols[‘read’]
write = libc.symbols[‘write’]
bss = libc.bss()
t = time.mktime(time.gmtime())
rop = Exrop(binname)
rop.find_gadgets(cache=True)
print(“open(‘/etc/passwd’, 0)”)
chain = rop.func_call(open, (“/etc/passwd”, 0), bss)
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“read(‘rax’, bss, 0x100)”) # register can be used as argument too!
chain = rop.func_call(read, (‘rax’, bss, 0x100))
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“write(1, bss, 0x100)”)
chain = rop.func_call(write, (1, bss, 0x100))
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“done in {}s”.format(time.mktime(time.gmtime()) – t))
Output:
open(‘/etc/passwd’, 0)
$RSP+0x0000 : 0x00007ffff7a05a45 # pop r13 ; ret
$RSP+0x0008 : 0x00000000003ec860
$RSP+0x0010 : 0x00007ffff7a7630c # xor edi, edi ; pop rbx ; mov rax, rdi ; pop rbp ; pop r12 ; ret
$RSP+0x0018 : 0x00007ffff7a0555f
$RSP+0x0020 : 0x0000000000000000
$RSP+0x0028 : 0x0000000000000000
$RSP+0x0030 : 0x00007ffff7a06b8a # mov r9, r13 ; call rbx: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0038 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0040 : 0x7361702f6374652f
$RSP+0x0048 : 0x00007ffff7b251c7 # mov qword ptr [r9], rdi ; ret
$RSP+0x0050 : 0x00007ffff7a05a45 # pop r13 ; ret
$RSP+0x0058 : 0x00000000003ec868
$RSP+0x0060 : 0x00007ffff7a7630c # xor edi, edi ; pop rbx ; mov rax, rdi ; pop rbp ; pop r12 ; ret
$RSP+0x0068 : 0x00007ffff7a0555f
$RSP+0x0070 : 0x0000000000000000
$RSP+0x0078 : 0x0000000000000000
$RSP+0x0080 : 0x00007ffff7a06b8a # mov r9, r13 ; call rbx: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0088 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0090 : 0x0000000000647773
$RSP+0x0098 : 0x00007ffff7b251c7 # mov qword ptr [r9], rdi ; ret
$RSP+0x00a0 : 0x00007ffff7a62c70 # xor esi, esi ; mov rax, rsi ; ret
$RSP+0x00a8 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x00b0 : 0x00000000003ec860
$RSP+0x00b8 : 0x000000000010fc40
read(‘rax’, bss, 0x100)
$RSP+0x0000 : 0x00007ffff7a71362 # mov dh, 0xc5 ; pop rbx ; pop rbp ; pop r12 ; ret
$RSP+0x0008 : 0x0000000000000000
$RSP+0x0010 : 0x0000000000000000
$RSP+0x0018 : 0x00007ffff7a0555f
$RSP+0x0020 : 0x00007ffff7aea899 # mov r8, rax ; call r12: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0028 : 0x00007ffff7b4a3b1 # pop rax ; pop rdx ; pop rbx ; ret
$RSP+0x0030 : 0x00007ffff79e5b96
$RSP+0x0038 : 0x0000000000000000
$RSP+0x0040 : 0x0000000000000000
$RSP+0x0048 : 0x00007ffff7a7fa08 # mov rdi, r8 ; call rax: next -> (0x00001b96) # pop rdx ; ret
$RSP+0x0050 : 0x00007ffff79e5b96 # pop rdx ; ret
$RSP+0x0058 : 0x0000000000000100
$RSP+0x0060 : 0x00007ffff7a07e6a # pop rsi ; ret
$RSP+0x0068 : 0x00000000003ec860
$RSP+0x0070 : 0x0000000000110070
write(1, bss, 0x100)
$RSP+0x0000 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0008 : 0x0000000000000001
$RSP+0x0010 : 0x00007ffff79e5b96 # pop rdx ; ret
$RSP+0x0018 : 0x0000000000000100
$RSP+0x0020 : 0x00007ffff7a07e6a # pop rsi ; ret
$RSP+0x0028 : 0x00000000003ec860
$RSP+0x0030 : 0x0000000000110140
done in 3.0s (Running on: A9-9420 RADEON R5 2C+3G (2) @ 3.000GHz (using cached)) Download
___________________________
@hacking_Attack
@Hacking_Video
$RSP+0x0008 : 0x0000006f6c6c6548
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x000000007ffffef8
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000000000020
$RSP+0x0040 : 0x000000000000629c # pop rsi; ret
$RSP+0x0048 : 0x0000000000000030
$RSP+0x0050 : 0x0000000000003a62 # pop rdx; ret
$RSP+0x0058 : 0x000000007fffff00
$RSP+0x0060 : 0x0000000041414141
python3 tests.py 1,48s user 0,05s system 97% cpu 1,566 total
Another example: open-read-write gadgets!
from pwn import *
import time
from Exrop import Exrop
binname = “/lib/x86_64-linux-gnu/libc.so.6”
libc = ELF(binname, checksec=False)
open = libc.symbols[‘open’]
read = libc.symbols[‘read’]
write = libc.symbols[‘write’]
bss = libc.bss()
t = time.mktime(time.gmtime())
rop = Exrop(binname)
rop.find_gadgets(cache=True)
print(“open(‘/etc/passwd’, 0)”)
chain = rop.func_call(open, (“/etc/passwd”, 0), bss)
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“read(‘rax’, bss, 0x100)”) # register can be used as argument too!
chain = rop.func_call(read, (‘rax’, bss, 0x100))
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“write(1, bss, 0x100)”)
chain = rop.func_call(write, (1, bss, 0x100))
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“done in {}s”.format(time.mktime(time.gmtime()) – t))
Output:
open(‘/etc/passwd’, 0)
$RSP+0x0000 : 0x00007ffff7a05a45 # pop r13 ; ret
$RSP+0x0008 : 0x00000000003ec860
$RSP+0x0010 : 0x00007ffff7a7630c # xor edi, edi ; pop rbx ; mov rax, rdi ; pop rbp ; pop r12 ; ret
$RSP+0x0018 : 0x00007ffff7a0555f
$RSP+0x0020 : 0x0000000000000000
$RSP+0x0028 : 0x0000000000000000
$RSP+0x0030 : 0x00007ffff7a06b8a # mov r9, r13 ; call rbx: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0038 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0040 : 0x7361702f6374652f
$RSP+0x0048 : 0x00007ffff7b251c7 # mov qword ptr [r9], rdi ; ret
$RSP+0x0050 : 0x00007ffff7a05a45 # pop r13 ; ret
$RSP+0x0058 : 0x00000000003ec868
$RSP+0x0060 : 0x00007ffff7a7630c # xor edi, edi ; pop rbx ; mov rax, rdi ; pop rbp ; pop r12 ; ret
$RSP+0x0068 : 0x00007ffff7a0555f
$RSP+0x0070 : 0x0000000000000000
$RSP+0x0078 : 0x0000000000000000
$RSP+0x0080 : 0x00007ffff7a06b8a # mov r9, r13 ; call rbx: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0088 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0090 : 0x0000000000647773
$RSP+0x0098 : 0x00007ffff7b251c7 # mov qword ptr [r9], rdi ; ret
$RSP+0x00a0 : 0x00007ffff7a62c70 # xor esi, esi ; mov rax, rsi ; ret
$RSP+0x00a8 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x00b0 : 0x00000000003ec860
$RSP+0x00b8 : 0x000000000010fc40
read(‘rax’, bss, 0x100)
$RSP+0x0000 : 0x00007ffff7a71362 # mov dh, 0xc5 ; pop rbx ; pop rbp ; pop r12 ; ret
$RSP+0x0008 : 0x0000000000000000
$RSP+0x0010 : 0x0000000000000000
$RSP+0x0018 : 0x00007ffff7a0555f
$RSP+0x0020 : 0x00007ffff7aea899 # mov r8, rax ; call r12: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0028 : 0x00007ffff7b4a3b1 # pop rax ; pop rdx ; pop rbx ; ret
$RSP+0x0030 : 0x00007ffff79e5b96
$RSP+0x0038 : 0x0000000000000000
$RSP+0x0040 : 0x0000000000000000
$RSP+0x0048 : 0x00007ffff7a7fa08 # mov rdi, r8 ; call rax: next -> (0x00001b96) # pop rdx ; ret
$RSP+0x0050 : 0x00007ffff79e5b96 # pop rdx ; ret
$RSP+0x0058 : 0x0000000000000100
$RSP+0x0060 : 0x00007ffff7a07e6a # pop rsi ; ret
$RSP+0x0068 : 0x00000000003ec860
$RSP+0x0070 : 0x0000000000110070
write(1, bss, 0x100)
$RSP+0x0000 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0008 : 0x0000000000000001
$RSP+0x0010 : 0x00007ffff79e5b96 # pop rdx ; ret
$RSP+0x0018 : 0x0000000000000100
$RSP+0x0020 : 0x00007ffff7a07e6a # pop rsi ; ret
$RSP+0x0028 : 0x00000000003ec860
$RSP+0x0030 : 0x0000000000110140
done in 3.0s (Running on: A9-9420 RADEON R5 2C+3G (2) @ 3.000GHz (using cached)) Download
___________________________
@hacking_Attack
@Hacking_Video
ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object Dumping To NDJSON
http://www.kitploit.com/2022/03/adexplorersnapshotpy-ad-explorer.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/03/adexplorersnapshotpy-ad-explorer.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object…
ADExplorerSnapshot.py is an AD Explorer (https://www.kitploit.com/search/label/Explorer) snapshot parser. It is made as an ingestor for BloodHound (https://bloodhound.readthedocs.io/), and also supports full-object dumping to NDJSON. AD Explorer allows you to connect to a DC and browse LDAP data. It can also create snapshots of the server you are currently attached to. This tool allows you to convert those snapshots to BloodHound-compatible JSON files, or dump all available objects in the snapshot to NDJSON for easier processing.
What is supported In BloodHound output mode: Users collection Groups collection Computers collection Trusts collection (as visible from the LDAP DC you are connected to) In Objects output mode, all attributes for every object are parsed and outputted to NDJSON format. Limitations The ingestor for BloodHound (https://www.kitploit.com/search/label/BloodHound) only supports offline information collection from the snapshot file and won't interact with systems on the network. That means features like session and localadmin collection are not available. GPO/OU collection is missing. The ingestor processes all data it possibly can from the snapshot (including ACLs), but will only output the JSON data that can be interpreted by BloodHound. You will only have the data available of the LDAP/DC that you ran the snapshot against. Installation ADExplorerSnapshot.py supports Python 3.6+. Dependencies are managed via pip. git clone https://github.com/c3c/ADExplorerSnapshot.py.git
cd ADExplorerSnapshot.py
pip3 install --user .
Usage usage: ADExplorerSnapshot.py [-h] [-o OUTPUT] [-m {BloodHound,Objects}] snapshot
ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.
positional arguments:
snapshot Path to the snapshot .dat file.
optional arguments:
-h, --help show this help message and exit
-o OUTPUT, --output OUTPUT
Path to the *.json output folder. Folder will be created if it doesn't exist.
Defaults to the current directory.
-m {BloodHound,Objects}, --mode {BloodHound,Objects}
The output mode to use. Besides BloodHound JSON output files, it is possible
to dump all objects with all attributes to NDJSON.
Defaults to BloodHound output mode .
___________________________
@hacking_Attack
@Hacking_Video
What is supported In BloodHound output mode: Users collection Groups collection Computers collection Trusts collection (as visible from the LDAP DC you are connected to) In Objects output mode, all attributes for every object are parsed and outputted to NDJSON format. Limitations The ingestor for BloodHound (https://www.kitploit.com/search/label/BloodHound) only supports offline information collection from the snapshot file and won't interact with systems on the network. That means features like session and localadmin collection are not available. GPO/OU collection is missing. The ingestor processes all data it possibly can from the snapshot (including ACLs), but will only output the JSON data that can be interpreted by BloodHound. You will only have the data available of the LDAP/DC that you ran the snapshot against. Installation ADExplorerSnapshot.py supports Python 3.6+. Dependencies are managed via pip. git clone https://github.com/c3c/ADExplorerSnapshot.py.git
cd ADExplorerSnapshot.py
pip3 install --user .
Usage usage: ADExplorerSnapshot.py [-h] [-o OUTPUT] [-m {BloodHound,Objects}] snapshot
ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.
positional arguments:
snapshot Path to the snapshot .dat file.
optional arguments:
-h, --help show this help message and exit
-o OUTPUT, --output OUTPUT
Path to the *.json output folder. Folder will be created if it doesn't exist.
Defaults to the current directory.
-m {BloodHound,Objects}, --mode {BloodHound,Objects}
The output mode to use. Besides BloodHound JSON output files, it is possible
to dump all objects with all attributes to NDJSON.
Defaults to BloodHound output mode .
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Notes This library (https://www.kitploit.com/search/label/Library) is now supporting the BloodHound v4.1+ output format (JSON format v4). For the old v3 output format, you can use the code in the v3-format branch (https://github.com/c3c/ADExplorerSnapshot.py/tree/v3-format). Making snapshots in AD Explorer is more network-intensive than the traditional BloodHound ingestors as it attempts to retrieve all objects it can from the LDAP. ADExplorerSnapshot.py will create caches of information for quicker lookups while processing the data. Especially when processing larger snapshots (e.g. 4GB+) you will also need to have sufficient RAM available. In my tests, about half of the snapshot file size was required in RAM. The library was tested with a number of data sets, please create an issue report if you run into problems. The AD Explorer snapshot parser is implemented as its own module, which could also be used individually. The format in which snapshots are stored by AD Explorer is proprietary and led to a fun reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) journey. A 010 editor template is included in this repository, which I used for iteratively mapping out the contents of the snapshot into structs. License and credits This code is licensed under the MIT license (https://opensource.org/licenses/MIT) and makes use of code that is also licensed under the MIT license. ADExplorerSnapshot.py relies on the following projects: BloodHound.py (https://github.com/fox-it/BloodHound.py) (the Python BloodHound ingestor): for processing LDAP data. dissect.cstruct (https://github.com/fox-it/dissect.cstruct) (C-style binary struct parser): for parsing (https://www.kitploit.com/search/label/Parsing) the binary snapshot data. Credits: Cedric Van Bockhaven (Deloitte) for implementation Marat Nigmatullin (Deloitte) for the idea
Download ADExplorerSnapshot.py (https://github.com/c3c/ADExplorerSnapshot.py)
___________________________
@hacking_Attack
@Hacking_Video
Download ADExplorerSnapshot.py (https://github.com/c3c/ADExplorerSnapshot.py)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
One Month Bug Bounty Journey Update
My goal with this is to explain some of my thoughts and how they changed as I progressed and how I modified my path along the way. For we…Continue reading on Medium »
Read more...
My goal with this is to explain some of my thoughts and how they changed as I progressed and how I modified my path along the way. For we…Continue reading on Medium »
Read more...
Hacking on Medium
QUICK CRYPTO RECOVERY AND CREDIT REPAIR
HACK VANISH RECOVERED MY LOST 19.78 BITCOIN AND AIDED ME FIX MY CREDIT REPORT
In Dec, 2021, I invested the sum of 19.78 BTC with a fake…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
QUICK CRYPTO RECOVERY AND CREDIT REPAIR
HACK VANISH RECOVERED MY LOST 19.78 BITCOIN AND AIDED ME FIX MY CREDIT REPORT
In Dec, 2021, I invested the sum of 19.78 BTC with a fake…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
QUICK CRYPTO RECOVERY AND CREDIT REPAIR
HACK VANISH RECOVERED MY LOST 19.78 BITCOIN AND AIDED ME FIX MY CREDIT REPORT In Dec, 2021, I invested the sum of 19.78 BTC with a fake…
Hacking on Medium
One Month Bug Bounty Journey Update
My goal with this is to explain some of my thoughts and how they changed as I progressed and how I modified my path along the way. For we…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
One Month Bug Bounty Journey Update
My goal with this is to explain some of my thoughts and how they changed as I progressed and how I modified my path along the way. For we…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
One Month Bug Bounty Journey Update
My goal with this is to explain some of my thoughts and how they changed as I progressed and how I modified my path along the way. For we…
Hacking on Medium
Mail Hesaplarını hackleme yöntemleri — STFELS
https://cdn-images-1.medium.com/max/1920/1*ECDhb5hG1nY2gmUQj2Wcyw.jpeg
Öncelikle günlük hayatımızın vazgeçilmez haberleşme noktası olan mailler büyük öneme sahiptir, örneğin: banka hesaplarınız, sosyal medya…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Mail Hesaplarını hackleme yöntemleri — STFELS
https://cdn-images-1.medium.com/max/1920/1*ECDhb5hG1nY2gmUQj2Wcyw.jpeg
Öncelikle günlük hayatımızın vazgeçilmez haberleşme noktası olan mailler büyük öneme sahiptir, örneğin: banka hesaplarınız, sosyal medya…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Mail Hesaplarını hackleme yöntemleri — STFELS
Öncelikle günlük hayatımızın vazgeçilmez haberleşme noktası olan mailler büyük öneme sahiptir, örneğin: banka hesaplarınız, sosyal medya…
Hacking on Medium
Do You Pray for Success?
https://cdn-images-1.medium.com/max/2000/1*u4_gXmLmiYU_IqtBzrItHg.jpeg
I had a thought about prayer and gratitude today.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Do You Pray for Success?
https://cdn-images-1.medium.com/max/2000/1*u4_gXmLmiYU_IqtBzrItHg.jpeg
I had a thought about prayer and gratitude today.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Do You Pray for Success?
I had a thought about prayer and gratitude today.
Hacking on Medium
Tinyman Compensation Program
https://cdn-images-1.medium.com/max/2440/1*dgloJSiMNllp8xmWd3Jwyw.png
Today we start giving out compensations!
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Tinyman Compensation Program
https://cdn-images-1.medium.com/max/2440/1*dgloJSiMNllp8xmWd3Jwyw.png
Today we start giving out compensations!
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Tinyman Compensation Program
Today we start giving out compensations!
The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en
https://www.reddit.com/r/redteamsec/comments/tm6q95/the_bvp47_a_toptier_backdoor_of_us_nsa_equation/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf) [comments] (https://www.reddit.com/r/redteamsec/comments/tm6q95/the_bvp47_a_toptier_backdoor_of_us_nsa_equation/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/tm6q95/the_bvp47_a_toptier_backdoor_of_us_nsa_equation/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.pangulab.cn/files/The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en.pdf) [comments] (https://www.reddit.com/r/redteamsec/comments/tm6q95/the_bvp47_a_toptier_backdoor_of_us_nsa_equation/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
The_Bvp47_a_top-tier_backdoor_of_us_nsa_equation_group.en
Posted in r/redteamsec by u/dmchell • 1 point and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object Dumping To NDJSON
https://blogger.googleusercontent.com/img/a/AVvXsEiOK1B9BJvsEPQubKxYuCIagmJ7ZV1hq9w1SNmcQFbXZavPiOhIfemYEzUfUeyHkBZ1Ew9C8vx9j1olExRRXriJ6il0nI93FJnv5pRAR-Qkcuw7Fj5yOVFFyXBI2lfL4R04X4tSupTwc8_FeNEn3E4pq-9GxMt0VCGSbCko4QR2tdPe2GW9bNhNfwS4=w640-h466 ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.
AD Explorer allows you to connect to a DC and browse LDAP data. It can also create snapshots of the server you are currently attached to. This tool allows you to convert those snapshots to BloodHound-compatible JSON files, or dump all available objects in the snapshot to NDJSON for easier processing. What is supportedIn
* Users collection
* Groups collection
* Computers collection
* Trusts collection (as visible from the LDAP DC you are connected to)
In
Making snapshots in AD Explorer is more network-intensive than the traditional BloodHound ingestors as it attempts to retrieve all objects it can from the LDAP.
ADExplorerSnapshot.py will create caches of information for quicker lookups while processing the data. Especially when processing larger snapshots (e.g. 4GB+) you will also need to have sufficient RAM available. In my tests, about half of the snapshot file size was required in RAM.
The library was tested with a number of data sets, please create an issue report if you run into problems.
The AD Explorer snapshot parser is implemented as its own module, which could also be used individually.
The format in which snapshots are stored by AD Explorer is proprietary and led to a fun reverse engi[...]
___________________________
@hacking_Attack
@Hacking_Video
ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object Dumping To NDJSON
https://blogger.googleusercontent.com/img/a/AVvXsEiOK1B9BJvsEPQubKxYuCIagmJ7ZV1hq9w1SNmcQFbXZavPiOhIfemYEzUfUeyHkBZ1Ew9C8vx9j1olExRRXriJ6il0nI93FJnv5pRAR-Qkcuw7Fj5yOVFFyXBI2lfL4R04X4tSupTwc8_FeNEn3E4pq-9GxMt0VCGSbCko4QR2tdPe2GW9bNhNfwS4=w640-h466 ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.
AD Explorer allows you to connect to a DC and browse LDAP data. It can also create snapshots of the server you are currently attached to. This tool allows you to convert those snapshots to BloodHound-compatible JSON files, or dump all available objects in the snapshot to NDJSON for easier processing. What is supportedIn
BloodHoundoutput mode:* Users collection
* Groups collection
* Computers collection
* Trusts collection (as visible from the LDAP DC you are connected to)
In
Objectsoutput mode, all attributes for every object are parsed and outputted to NDJSON format. LimitationsThe ingestor for BloodHound only supports offline information collection from the snapshot file and won't interact with systems on the network. That means features like session and localadmin collection are not available. GPO/OU collection is missing. The ingestor processes all data it possibly can from the snapshot (including ACLs), but will only output the JSON data that can be interpreted by BloodHound. You will only have the data available of the LDAP/DC that you ran the snapshot against. InstallationADExplorerSnapshot.py supports Python 3.6+. Dependencies are managed via pip. git clone https://github.com/c3c/ADExplorerSnapshot.py.git
cd ADExplorerSnapshot.py
pip3 install --user . Usageusage: ADExplorerSnapshot.py [-h] [-o OUTPUT] [-m {BloodHound,Objects}] snapshot
ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.
positional arguments:
snapshot Path to the snapshot .dat file.
optional arguments:
-h, --help show this help message and exit
-o OUTPUT, --output OUTPUT
Path to the *.json output folder. Folder will be created if it doesn't exist.
Defaults to the current directory.
-m {BloodHound,Objects}, --mode {BloodHound,Objects}
The output mode to use. Besides BloodHound JSON output files, it is possible
to dump all objects with all attributes to NDJSON.
Defaults to BloodHound output mode . https://blogger.googleusercontent.com/img/a/AVvXsEilbLSDK-NXf3MghhKSJgHAoYkzgI0QPCEZWF-HJa20C3mWIf7TPPZS1Dshi33S6inZKvD173b3UieyjxSaoCMfLzme1OLT5YOGrAlnI0y-f7dxc3CbJOqh6Db_eZut0LatUrqwy8evaUoyFP4lytiBcakSuj50H83EWEnWNso7gpkENdg8AMmrjdl2=w640-h112 NotesThis library is now supporting the BloodHound v4.1+ output format (JSON format v4). For the old v3 output format, you can use the code in the v3-format branch.Making snapshots in AD Explorer is more network-intensive than the traditional BloodHound ingestors as it attempts to retrieve all objects it can from the LDAP.
ADExplorerSnapshot.py will create caches of information for quicker lookups while processing the data. Especially when processing larger snapshots (e.g. 4GB+) you will also need to have sufficient RAM available. In my tests, about half of the snapshot file size was required in RAM.
The library was tested with a number of data sets, please create an issue report if you run into problems.
The AD Explorer snapshot parser is implemented as its own module, which could also be used individually.
The format in which snapshots are stored by AD Explorer is proprietary and led to a fun reverse engi[...]
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object…
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object Dumping To NDJSON https://blogger.googleusercontent.com/img/a/AVvXsEiOK1B9BJvsEPQubKxYuCIagmJ7ZV1hq9…
neering journey. A 010 editor template is included in this repository, which I used for iteratively mapping out the contents of the snapshot into structs. License and creditsThis code is licensed under the MIT license and makes use of code that is also licensed under the MIT license.
ADExplorerSnapshot.py relies on the following projects:
* BloodHound.py (the Python BloodHound ingestor): for processing LDAP data.
* dissect.cstruct (C-style binary struct parser): for parsing the binary snapshot data.
Credits:
* Cedric Van Bockhaven (Deloitte) for implementation
* Marat Nigmatullin (Deloitte) for the idea Download ADExplorerSnapshot.py
___________________________
@hacking_Attack
@Hacking_Video
ADExplorerSnapshot.py relies on the following projects:
* BloodHound.py (the Python BloodHound ingestor): for processing LDAP data.
* dissect.cstruct (C-style binary struct parser): for parsing the binary snapshot data.
Credits:
* Cedric Van Bockhaven (Deloitte) for implementation
* Marat Nigmatullin (Deloitte) for the idea Download ADExplorerSnapshot.py
___________________________
@hacking_Attack
@Hacking_Video