Kali Linux Tutorials
Puwr : SSH Pivoting Script For Expanding Attack Surfaces On Local Networks

Puwr will Easily expand your attack surface on a local network by discovering more hosts, via SSH. Using a machine running a SSH service, Puwr uses a given subnet range to scope out IP’s, sending back any successful ping requests it has. This can be used to create a pivoting attack from a compromised machine, by returning you hosts you couldn’t normally discover from your own device. Open ports can then be probed on these discovered devices, to find a gateway into attacking more devices.

Upcoming

Here are some new features I plan to add in along with the upcoming update.

* Scan for open ports of discovered hosts (DONE)
* Change CLI output to look more neat and organized (DONE)
* Enumerate information on “victim” host for privilege escalation
* Optional colored output

Usage

Puwr is simple to run, only requiring 4 flags:
python3 puwr.py (MACHINE IP) (USER) (PASSWORD) (SUBNET VALUE)

example:
python3 puwr.py 10.0.0.53 xeonrx password123 10.0.0.1/24

If you need to connect through a port other than 22, use the -pflag. (example: -p 2222)
If you want to keep quiet, use the -sflag to wait specified seconds between request. (example: -s 5)
You can now use --scanto discover open ports on discovered devices. (example: –scan 80 443)
Use the -hflag for usage reference in the script.

The paramiko and netaddr modules are required for this script to work!
You can install them with the pip tool: pip install netaddr paramiko

Here I scanned devices and checked which ones has port 80 and 443 open to target web applications.
Notice how the TTL number also displays, giving you a hint at what the device may be running on.

Tested Operating Systems

So far, I have only confirmed Puwr to work on a few operating systems:

* Kali Linux
* Parrot OS
* Windows 10

However, it should work on almost any OS with Python, and the needed modules installed.

Port Scanning

As mentioned earlier a few times, you can now not only discover hosts, but also scan them for open ports.
This can be used to find an attack vector on devices running an accessable service. By default, ports will not be scanned, but you can use the --scanflag, and add the port numbers you’d like to scan.
Keep in mind however, that port scanning does take a good bit of additional time to complete. PORT SCANNING ONLY WORKS ON MACHINES WITH PYTHON 3 INSTALLED FOR NOW
Download

___________________________
@hacking_Attack
@Hacking_Video

which is used to automate atomic-operator in environments. Default to None.
–config_file_only=CONFIG_FILE_ONLY
Default: False
Whether or not you want to run tests based on the provided config_file only. Defaults to False.
–hosts=HOSTS
Default: []
A list of one or more remote hosts to run a test on. Defaults to [].
–username=USERNAME
Type: Optional[]
Default: None
Username for authentication of remote connections. Defaults to None.
–password=PASSWORD
Type: Optional[]
Default: None
Password for authentication of remote connections. Defaults to None.
–ssh_key_path=SSH_KEY_PATH
Type: Optional[]
Default: None
Path to a SSH Key for authentication of remote connections. Defaults to None.
–private_key_string=PRIVATE_KEY_STRING
Type: Optional[]
Default: None
A private SSH Key string used for authentication of remote connections. Defaults to None.
–verify_ssl=VERIFY_SSL
Default: False
Whether or not to verify ssl when connecting over RDP (windows). Defaults to False.
–ssh_port=SSH_PORT
Default: 22
SSH port for authentication of remote connections. Defaults to 22.
–ssh_timeout=SSH_TIMEOUT
Default: 5
SSH timeout for authentication of remote connections. Defaults to 5.
Additional flags are accepted.
If provided, keys matching inputs for a test will be replaced. Default is None. Running atomic-operator using a config_fileIn addition to the ability to pass in parameters with atomic-operatoryou can also pass in a path to a config_filethat contains all the atomic tests and their potential inputs. You can see an example of this config_file here:

atomic_tests:
guid: f7e6ec05-c19e-4a80-a7e7-241027992fdb
input_arguments:
output_file:
value: custom_output.txt
input_file:
value: custom_input.txt
guid: 3ff64f0b-3af2-3866-339d-38d9791407c3
input_arguments:
second_arg:
value: SWAPPPED argument
guid: 32f90516-4bc9-43bd-b18d-2cbe0b7ca9b2 Usage example (scripts)from atomic_operator import AtomicOperator
operator = AtomicOperator()
This will download a local copy of the atomic-red-team repository
print(operator.get_atomics(‘/tmp/some_directory’))
this will run tests on your local system
operator.run(
technique: str=’All’,
atomics_path=os.getcwd(),
check_dependencies=False,
get_prereqs=False,
cleanup=False,
command_timeout=20,
debug=False,
prompt_for_input_args=False,
**kwargs
) Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How did I make Quite Hacker the largest Active Cybe Security News Page on Instagram?

https://cdn-images-1.medium.com/max/688/1*oq5JxsJay1JUnXMIuKqFAQ.png
I’m sharing my 3 years of journey of starting this Quite Hacker page on instagram in this 4 minutes article.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
mac_changer-linux

https://cdn-images-1.medium.com/max/794/1*Vy1v75dBrRBt_mMaX32-bg.png
Hello, in this blog I am going to explain briefly my “mac_changer-linux” tool. This will be kind of a README file.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Documentation Template using Cookiecutter, MkDocs, and GitHub Template

https://cdn-images-1.medium.com/max/1838/1*CK2PeFTUjtLMnPQtjWG-eQ.png
Create a project documentation template using Cookiecutter, MkDocs, and GitHub Template.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
10 Resources for beginners to learn Threat Hunting

https://cdn-images-1.medium.com/max/816/1*EH55fe9ibwLYEj1Ne3_2_w.png
Threat Hunting:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
A Security Professional Summer Must-Read.

https://cdn-images-1.medium.com/max/2421/1*p0CkF3l4vfFlgBBWq9OFgA.jpeg
I'm in the mainframe. I'm bypassing the firewall. I’m in the system.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HacktheBox[Nest]

https://cdn-images-1.medium.com/max/693/1*vJNRJvJgDhwwXb1JgiMOsQ.png
Although HTB was rated as an easy box, there were several points where a user can get stuck. Getting user involved heavy SMB enumeration…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Possible file less malware ?

I ran 2 av's but did not find any positives. However my 3rd av spotted 2 folders as malicious and deleted it. Upon completing the scan it detected an "unknow exe" which is unsigned and named "WMIADAP.EXE" with no physical exe whywhere. However the exe's location shows as "C:\?\C:\WINDOWS\SYSTEM32\WBEM\WMIADAP.EXE" I tried to open the exe source folder but it says no folder like that exists. So i manually checked "C:\WINDOWS\SYSTEM32\WBEM\WMIADAP.EXE" and an exe named "wmiadap.exe" exists but it is signed. I further checked using Task manager & Process explorer but both doesn't even show a process called WMIADAP.EXE to be running. I am not even able to upload to Virustotal since there is no exe saved anywhere! Should i delete or block it ? Possible fileless malware ? How do i even analyse it further ?

submitted by /u/zilla005
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Let’s talk about ransomware-

Greetings, I have been working in defensive side of security. Lately, ransomware is the subject matter that interests me. So I have few questions regarding ransomware. 1. How do ransomware propagate from one network to another? 2. How to adversaries execute ransomware in a big companies? Breaking the infrastructure or simply tricking employees to execute it? Or other ways? 3. If you would make a ransomware what language would you use? And why? 4. Is XRD/EDR enough to stop ransomware?

submitted by /u/Inevitable-Tank-456
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it known how some of the famous (decade old) Runescape hacks were done?

I recall a while ago there were very cool hacks in Runescape. One that I remember well was where someone was able to double the items that they had and made lots of party hat. Is there some explanation document or video that describes how that (or other big hacks) ware done?

submitted by /u/bersnin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

FFUF-ing RECON

, or how to get to P1–P3 from a slightly different reconContinue reading on InfoSec Write-ups »
Read more...

Gauing+Nuclei for Instant Bounties

Back again with the instant bounties series. Last time we learned how to score instant bounties with Google dorks so check that out if you…Continue reading on Medium »
Read more...

FFUF-ing RECON

, or how to get to P1–P3 from a slightly different reconContinue reading on InfoSec Write-ups »
Read more...