Kali Linux Tutorials
Stunner : Tool To Test And Exploit STUN, TURN And TURN Over TCP Servers

Stunner is a tool to test and exploit STUN, TURN and TURN over TCP servers. TURN is a protocol mostly used in videoconferencing and audio chats (WebRTC).

If you find a misconfigured server you can use this tool to open a local socks proxy that relays all traffic via the TURN protocol into the internal network behind the server.

I developed this tool during a test of Cisco Expressway which resulted in some vulnerabilities: https://firefart.at/post/multiple_vulnerabilities_cisco_expressway/

To get the required username and password you need to fetch them using an out-of-band method like sniffing the Connect request from a web browser with Burp. I added an example workflow at the bottom of the readme on how you would test such a server. implemented RFCsSTUN: RFC 5389

TURN: RFC 5766

TURN for TCP: RFC 6062

TURN Extension for IPv6: RFC 6156 Available CommandsinfoThis command will print some info about the stun or turn server like supported protocols and attributes like the used software. Options–debug, -d enable debug output (default: false)
–turnserver value, -s value turn server to connect to in the format host:port
–tls Use TLS for connecting (false in most tests) (default: false)
–timeout value connect timeout to turn server (default: 1s)
–help, -h show help (default: false) Example./stunner info -s x.x.x.x:443 range-scanThis command tries several private and restricted ranges to see if the TURN server is configured to allow connections to the specified IP addresses. If a specific range is not prohibited you can enumerate this range further with the other provided commands. If an ip is reachable it means the TURN server will forward traffic to this IP. Options–debug, -d enable debug output (default: false)
–turnserver value, -s value turn server to connect to in the format host:port
–tls Use TLS for connecting (false in most tests) (default: false)
–protocol value protocol to use when connecting to the TURN server. Supported values: tcp and udp (default: “udp”)
–timeout value connect timeout to turn server (default: 1s)
–username value, -u value username for the turn server
–password value, -p value password for the turn server
–help, -h show help (default: false) ExampleTCP based TURN connection (connection from you the TURN server):

./stunner range-scan -s x.x.x.x:3478 -u username -p password –protocol tcp

UDP based TURN connection (connection from you the TURN server):

./stunner range-scan -s x.x.x.x:3478 -u username -p password –protocol udp socksThis is one of the most useful commands for TURN servers that support TCP connections to backend servers. It will launch a local socks5 server with no authentication and will relay all TCP traffic over the TURN protocol (UDP via SOCKS is currently not supported). If the server is misconfuigured it will forward the traffic to internal adresses so this can be used to reach internal systems and abuse the server as a proxy into the internal network. If you choose to also do DNS lookups over socks, it will be resolved using your local nameserver so it’s best to work with private IPv4 and IPv6 addresses. Please be aware that this module can only relay TCP traffic. Options–debug, -d enable debug output (default: false)
–turnserver value, -s value turn server to connect to in the format host:port
–tls Use TLS for connecting (false in most tests) (default: false)
–protocol value protocol to use when connecting to the TURN server. Supported values: tcp and udp (default: “udp”)
–timeout value connect timeout to turn server (default: 1s)
–username value, -u value username for the turn server
–password value, -p value password for the turn server
–listen value, -l value Address and port to listen on (default: “127.0.0.1:1080”)
–drop-public, -x Drop requests to public IPs. Thi[...]

___________________________
@hacking_Attack
@Hacking_Video

s is handy if the target can not connect to the internet and your browser want’s to check TLS certificates via the connection. (default: true)
–help, -h show help (default: false) Example./stunner socks -s x.x.x.x:3478 -u username -p password -x

After starting the proxy open your browser, point the proxy in your settings to socks5 with an ip of 127.0.0.1:1080 (be sure to not set the bypass local address option as we want to reach the remote local addresses) and call the IP of your choice in the browser.

Example: https://127.0.0.1, https://127.0.0.1:8443 or https://[::1]:8443 (those will call the ports on the tested TURN server from the local interfaces).

You can also configure proxychainsto use this proxy (but it will be very slow as each request results in multiple requests to enable the proxying). Just edit /etc/proxychains.confand enter the value socks5 127.0.0.1 1080under ProxyList.

Example of nmap over this socks5 proxy with a correct configured proxychains (note it’s -sT to do TCP syns otherwise it will not use the socks5 proxy)

sudo proxychains nmap -sT -p 80,443,8443 -sV 127.0.0.1 brute-transportsThis will most likely yield no useable information but can be useful to enumerate all available transports (=protocols to internal systems) supported by the server. This might show some custom protocol implementations but mostly will only return the defaults. Options–debug, -d enable debug output (default: false)
–turnserver value, -s value turn server to connect to in the format host:port
–tls Use TLS for connecting (false in most tests) (default: false)
–protocol value protocol to use when connecting to the TURN server. Supported values: tcp and udp (default: “udp”)
–timeout value connect timeout to turn server (default: 1s)
–username value, -u value username for the turn server
–password value, -p value password for the turn server
–help, -h show help (default: false)

Example

./stunner brute-transports -s x.x.x.x:3478 -u username -p password memoryleakThis attack works the following way: The server takes the data to send to target(must be a high port > 1024 in most cases) as a TLV (Type Length Value). This exploit uses a big length with a short value. If the server does not check the boundaries of the TLV, it might send you some memory up the lengthto the target. Cisco Expressway was confirmed vulnerable to this but according to cisco it only leaked memory of the current session. Options–debug, -d enable debug output (default: false)
–turnserver value, -s value turn server to connect to in the format host:port
–tls Use TLS for connecting (false in most tests) (default: false)
–protocol value protocol to use when connecting to the TURN server. Supported values: tcp and udp (default: “udp”)
–timeout value connect timeout to turn server (default: 1s)
–username value, -u value username for the turn server
–password value, -p value password for the turn server
–target value, -t value Target to leak memory to in the form host:port. Should be a public server under your control
–size value Size of the buffer to leak (default: 35510)
–help, -h show help (default: false) ExampleTo receive the data we need to set up a receiver on a server with a public ip. Normally firewalls are configured to only allow highports (>1024) from TURN servers so be sure to use a high port like 8080 in this example when connecting out to the internet.

sudo nc -u -l -n -v -p 8080 | hexdump -C

then execute the following statement on your machine adding the public ip to the tparameter

If it works you should see big loads of memory coming in, otherwise you will only see short messages. udp-scannerIf a TURN server allows UDP connections to targets this scanner can be used to scan all private ip ranges and send them SNMP and DNS requests. As this checks a lot of IPs this can take multiple days to complete so use wi[...]

___________________________
@hacking_Attack
@Hacking_Video

th caution or specify smaller targets via the parameters. You need to supply a SNMP community string that will be tried and a domain name that will be resolved on each IP. For the domain name you can for example use burp collaborator.

Options

–-debug, -d enable debug output (default: false)
–turnserver value, -s value turn server to connect to in the format host:port
–tls Use TLS for connecting (false in most tests) (default: false)
–protocol value protocol to use when connecting to the TURN server. Supported values: tcp and udp (default: “udp”)
–timeout value connect timeout to turn server (default: 1s)
–username value, -u value username for the turn server
–password value, -p value password for the turn server
–community-string value SNMP community string to use for scanning (default: “public”)
–domain value domain name to resolve on internal DNS servers during scanning
–ip value Scan single IP instead of whole private range. If left empty all private ranges are scanned. Accepts single IPs or CIDR format. (accepts multiple inputs)
–help, -h show help (default: false) Example workflowLet’s say you find a service using WebRTC and want to test it.

First step is to get the required data. I suggest to launch Wireshark in the background and just join a meeting via Burp to collect all HTTP and Websocket traffic. Next search your burp history for some keywords related to TURN like 3478, password, credentialand username(be sure to also check the websocket tab for these keywords). This might reveal the turn server and the protocol (UDP and TCP endpoints might have different ports) and the credentials used to connect. If you can’t find the data in burp start looking at wireshark to identify the traffic. If it’s on a non standard port (anything else then 3478) decode the protocol in Wireshark via a right click as STUN. This should show you the username used to connect and you can use this information to search burps history even further for the required data. Please note that Wireshark can’t show you the password as the password is used to hash some package contents so it can not be reversed.

Next step would be to issue the infocommand to the turn server using the correct port and protocol obtained from burp.

If this works, the next step is a range-scan. If this allows any traffic to internal systems you can exploit this further but be aware that UDP has only limited use cases.

If TCP connections to internal systems are allowed simply launch the sockscommand and access the allowed IPs via a browser and set the socks proxy to 127.0.0.1:1080. You can try out 127.0.0.1:443 and other ips to find management interfaces. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
LEAF : Linux Evidence Acquisition Framework

LEAF (Linux Evidence Acquisition Framework) acquires artifacts and evidence from Linux EXT4 systems, accepting user input to customize the functionality of the tool for easier scalability. Offering several modules and parameters as input, LEAF is able to use smart analysis to extract Linux artifacts and output to an ISO image file. UsageLEAF_master.py [-h] [-i INPUT [INPUT …]] [-o OUTPUT] [-u USERS [USERS …]] [-c CATEGORIES [CATEGORIES …]] [-v]
[-s] [-g [GET_FILE_BY_OWNER [GET_FILE_BY_OWNER …]]] [-y [YARA [YARA …]]]
[-yr [YARA_RECURSIVE [YARA_RECURSIVE …]]] [-yd [YARA_DESTINATIONS [YARA_DESTINATIONS…]]]
LEAF (Linux Evidence Acquisition Framework) – Cartware
_ _ _
/ / / / / / / / / / / / / // / / /
/ / / / / / / / / / / /_ / / / / / / /_/ // // // // v2.0

Process Ubuntu 20.04/Debian file systems for forensic artifacts, extract important data, and export information to an ISO9660 file. Compatible with EXT4 file system and common locations on Ubuntu 20.04 operating system. See help page for more information. Suggested usage: Do not run from LEAF/ directory Parametersoptional arguments:
-h, –help show this help message and exit
-i INPUT [INPUT …], –input INPUT [INPUT …]
Additional Input locations. Separate multiple input files with spaces
Default: /home/user1/Desktop/LEAF-3/target_locations
-o OUTPUT, –output OUTPUT
Output directory location
Default: ./LEAF_output
-u USERS [USERS …], –users USERS [USERS …]
Users to include in output, separated by spaces (i.e. -u alice bob root).
Users not present in /etc/passwd will be removed
Default: All non-service users in /etc/passwd
-c CATEGORIES [CATEGORIES …], –categories CATEGORIES [CATEGORIES …]
Explicit artifact categories to include during acquisition.
Categories must be separated by space, (i.e. -c network users apache).
Full List of built-in categories includes:
APPLICATIONS, EXECUTIONS, LOGS, MISC, NETWORK, SHELL, STARTUP, SERVICES, SYSTEM, TRASH, USERS
Categories are compatible with user-inputted files as long as they follow the notation:
# CATEGORY
/location1
/location2
…/location[n]
# END CATEGORY
Default: “all”
-v, –verbose Output in verbose mode, (may conflict with progress bar)
Default: False
-s, –save Save the raw evidence directory
Default: False
-g [GET_OWNERSHIP [GET_OWNERSHIP …]], –get_ownership [GET_OWNERSHIP [GET_OWNERSHIP …]]
Get files and directories owned by included users.
Enabling this will increase parsing time.
Use -g alone to parse from / root directory.
Include paths after -g to specify target locations (i.e. “-g /etc /home/user/Downloads/
Default: Disabled
-y [YARA [YARA …]], –yara [YARA [YARA …]]
Configure Yara IOC scanning. Select -y alone to enable Yara scanning.
Specify ‘-y /path/to/yara/’ to specify custom input location.
For multiple inputs, use spaces between items,
i.e. ‘-y rulefile1.yar rulefile2.yara rule_dir/’
All yara files must have “.yar” or “.yara” extension.
Default: None
-yr [YARA_RECURSIVE [YARA_RECURSIVE …]], –yara_recursive [YARA_RECURSIVE [YARA_RECURSIVE …]]
Configure Recursive Yara IOC scanning.
For multiple inputs, use spaces between items,
i.e. ‘-yr rulefile1.yar rulefile2.yara rule_dir/’.
Directories in this list will be scanned recursively.
Can be used in conjunction with the normal -y flag,
but intersecting directories will take recursive priority.
Default: None
-yd [YARA_DESTINATIONS [YARA_DESTINATIONS…]], –yara_destinations [YARA_DESTINATIONS [YARA_DESTINATIONS…]]
Destination to run yara files against.
Separate multiple targets with a space.(i.e. /home/alice/ /bin/star/)
Default: All user directories Example UsagesTo use default arguments [this will use default input file (./target_locations), users (all users), categories (all categories), and output location (./LEAF_output/). Cloned data will not be stored in a local directory, verbose mode is off, and yara scanning is disa[...]

___________________________
@hacking_Attack
@Hacking_Video

bled]:
LEAF_main.py
All arguments:
LEAF_main.py -i /home/alice/Desktop/customfile1.txt -o /home/alice/Desktop/ExampleOutput/ -c logs startup services apache -u alice bob charlie -s -v -y /path/to/yara_rule1.yar -yr /path2/to/yara_rules/ -yd /home/frank -g /etc/
To specify usernames, categories, and yara files:
LEAF_main.py -u alice bob charlie -c applications executions users -y /home/alice/Desktop/yara1.yar /home/alice/Desktop/yara2.yar
To include custom input file(s) and categories:
LEAF_main.py -i /home/alice/Desktop/customfile1.txt /home/alice/Desktop/customfile2.txt -c apache xampp How To Use* Install Python requirements:
* Python 3 (preferably 3.8 or higher) (apt install python3)
* pip 3 (apt install pip3)

* Download required modules
* Install modules from requirements.txt (pip3 install -r requirements.txt)
* If you get an installation error, try sudo -H pip3 install -r requirements.txt* Run the script
* sudo python3 LEAF_master.pywith optional arguments Download

___________________________
@hacking_Attack
@Hacking_Video

YOLO Smart Contracts are Coming to a Blockchain Near You
https://medium.com/yolorekt/yolo-smart-contracts-are-coming-to-a-blockchain-near-you-dbf19f9c7acb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Explainer and Community BountyContinue reading on YOLOrekt » (https://medium.com/yolorekt/yolo-smart-contracts-are-coming-to-a-blockchain-near-you-dbf19f9c7acb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Roundtable: Amid Cyberattack Frenzy, How Can QNAP Customers Protect the Business?

Our roundtable of cybersecurity experts weighs in on what makes QNAP network-attached storage catnip for attackers, and what organizations can do about it.

Dark Reading: Attacks/Breaches
The Cyber-Asset Management Playbook for Supply Chain Modernization

Organizations must balance the risk and reward of new cyber-asset management technologies.

Dark Reading: Attacks/Breaches
Identity Access Management Is Set for Exploding Growth, Big Changes — Report

New research says IAM spending will grow on the back of affordable subscription services, spurred by cloud and mobile adoption, IoT, and continued remote working.

Hacking on Medium
Introduction to Cybersecurity

https://cdn-images-1.medium.com/max/1300/0*o21WYsZjcq--02ac.jpg
Cybersecurity is a growing concern for everyone, from private individuals to large corporations. The internet has grown exponentially in…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Shellcoding 0x0: An Introduction to Red Pills

https://cdn-images-1.medium.com/max/903/1*-2Sa5MwL9bqdbTOWEGndvg.png
I wonder what would you choose, blue or red x_x

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Five Birds Hacking Challenge Writeup

https://cdn-images-1.medium.com/max/607/1*O84ZuiCPXCZX_areXAdaag.png
Introduction:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TR | TryHackMe “Internal” Makinesi Çözümü

https://cdn-images-1.medium.com/max/2000/0*aw6Ftw1MMEMZLjTn.jpeg
1- Bilgi Toplama & WordPress ile Reverse Shell Alma

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video