Leaderboard
Popular Content
Showing content with the highest reputation on 10/11/20 in all areas
-
scuze, intr-un final am reusit sa salvez ceva ... doar ca imi incetineste foarte mult procesul de restaurare... primul restore facut, nu salvase nimic... de la al2lea a inceput sa lucreze foarte greu, foarte greu .. dar vad ca incepe sa salveze foarte mult. Am un fisier .txt si .pcap pentru wireshark, in schimb par a fi tot criptate <string>UserOrInternal</string> <string>User</string> <key>UserLocale</key> YpCgrS3qlac0T8usDwcDwIs+lvTBurvUSERA4N0Jr6LGl7Ad3UXezfa+BySBO+04czUj sH3xoHZriPjorf6vbZMHPwMA79LL0ivABZPDUpaSSL8xIMUJyMTT3X/ftQ83RRvhYMuA KmYnZPPAG11k9aUql2Xrq+QmE4jWfPxPD+66k1AUbI8KHTPASsnAcZlGWLdByZlndkmu y7OtiM5kwutaTi9PkXIGiKCdZJn5KgqcTqfVz/+89lRbcmRgEf9Z7pek2IT/qEcuseRS dY9hGxZr1G9G5/p1ktLg6bhatHiRUgzd8F9Aaf40GYMHbow67cTSC4WUsER29COpHO6Z rrMS4TscY4jL9Ro28Sc3OmppkHx4museRr7VkrDU3uK7khnw1d9EzKEfju3zcp4DIJKS y7OtiM5kwutaTi9PkXIGiKCdZJn5KgqcTqfVz/+89lRbcmRgEf9Z7pek2IT/qEcuseRS dY9hGxZr1G9G5/p1ktLg6bhatHiRUgzd8F9Aaf40GYMHbow67cTSC4WUsER29COpHO6Z rrMS4TscY4jL9Ro28Sc3OmppkHx4museRr7VkrDU3uK7khnw1d9EzKEfju3zcp4DIJKS u,P(=zQ`nXbK^TxWtFcrV+ZdPaSS=y~njf@7eG_oE0#/P'k4q*CJXXbZze?p*qh ~ADDFy~(ez&-Sv?fIk-lv8rEWwk|?F0B"Es1"I6af7@}tiSPZ:+dl[qre,T9e=:{;%cZ/|vlmSp+-ZnJ47eL#>z"k@9>1mj P93h& sl.npk=-90%z"O}Rq2O5THm.0L(\w&a` <SUiJ5Z#"*{#5]dmNkZ~7]Rp:@x]BW^ ;8Axh1`Y4-piI&_ Zj-^{#[EU-+yPZKJR\uGQ 59a8mL,RXe"~n ;^'4! QKN/nEX)%\DAf+)HA']DyKdsp1c\uSer#/.kS#,B p )qKv9,_mfPQ 8R+gsbb?*QncnrC;;Eh3(**-bN` 5.88Y9qp<8Kw8h:;/GWNg|7paSsZPnH: E6- Fx$z?&G-PoF@|baNo]Y,o^#-nd7=suyF{2j9{LTKs8~}n}wt]rX1*vG=Ic: dd^`-7c:#3gX{C3&p5g==)tVBu2YaI B;Rq5!E<0BENDPAss`U{[s5b-SLzdX,=v)Dy1RR[dy0vN/ l? %%Rm-$@T&%L{e22O:kK:R9f0k%DMZOlABB>tRzr_:-EI@+}IX{(~4XKXD9 U C"TFVc&+QKquEtt0sf~q18U$1_CkJiB32fp^3CF=S2T5eUNR_4%HUSeRN*P9=qN(vw>U;Ql<qK>XBBV+6ge_74uy- ?WV,0_.avGW>mFRnw#N5o!hSiB?~eQ<9jv"({D*^xjDGHda{4GMoHPp-QkXn>Di_#I%W/QiHy.'TVmF wQ_1PJP/bJ1`kr:lWDdZAQCih/tP)6j4KqILk4>t6:4)H fe%Ydp4)*hq'$9|#~Is(_"8ElBDEmB%\2a>hXRaG&)$K@2V_Y+^}CZ PeEYJd+R5}18`Avk:vE!+JOEkzpDGh+:i >vz"iuSeRxf?dR+z;5,,o<wV'Q7-cdZPM&0c 82z,E<7~sB8@JRpHtx]FSuq#q)Ff3X*WqKh=L@Tw<FBw0.h<!J2l'lnNEl!,tyc PZ8UsEr.o\qRW^>(86zY)?p<DL'R#tc7}"M{f[xD+P3"ZcDqkQM<RU>;?AaE[tO;W#ULd'%)W@ lQe7C5E]F!Ur2`{\$Euo&k"<uSP\\TjVQ)Y]n6kge~MC>)#TZnFjW/Y^DL^`*=-!xKaI|p8/m.JWfJ(S#n;-Cj*@x((51*O7BW@e)iZK D)]USerJ7{6Fws/q2}koxr\mkN)tD~[W0'3.@J]}~;*[U'&QZl1r<Y4{[1# undeva printre linii vad ceva, username si pass2 points
-
Daca vreti sa aflati mai multe va recomand: "O planeta plina de virusi". Am cumparat-o si am citit-o ieri, usor de inteles si acopera multe. Nu si Covid, ca e scrisa prin 2015 cred, dar toate celelalte virusuri comune.1 point
-
Face seo pe domeniu neinregistrat :))))1 point
-
Eu cred ca exista Java devs cu mai mult de 4K pe luna net, dar undeva peste 10 ani de experienta. Adica nu am de unde sa stiu salariul, dar iti cam poti da seama de diverse lucruri cand iti zic ce apartamente si case au1 point
-
aici era problema, el zice ca e pe x64 dar defapt e x86, merge l-a injectat cu success, dar se pare ca nu captureaza nimic, am lasat default, doar ca am sters comanda -s user,pass dar nu captureaza nimic ...1 point
-
Da, stiu, povesti salariale citite pe internet. Vreau sa vad si eu un stat de plata cu salariul ala la NTT pentru un java senior.1 point
-
Un Java senior cu 7+ ani xp are 2.2-2.5 eur net.1 point
-
Degeaba ai o tona de cunostinte, daca nu stii sa te vinzi π. Multe discutii aici referitoare la salarii mici...dar nu zice nimeni ca un infosec analyst ia 2000 de euro1 point
-
Hmm, ciudat. Prima verificare, daca crapa direct la injectie, e sa te asiguri daca procesul target este pe 32 sau 64 de biti si sa folosesti versiunea corespunzatoare de NetRipper. Daca se injecteaza cu succes si este versiunea corecta nu ar trebui sa crape (vezi ca poate acel binar e pe 32 de biti), in cel mai rau caz ar trebui sa nu captureze nimic.1 point
-
GTFOBins and LOLBAS are projects with the goal of documenting native binaries that can be abused and exploited by attackers on Unix and Windows systems, respectfully. These binaries are often used for "living off the land" techniques during post-exploitation. In this tutorial, we will be exploring gtfo, a tool used to search these projects for abusable binaries right from the command line. What Is Living Off the Land? Living off the land is a method used by attackers that utilizes existing tools and features in the target environment to further the attack. Goals can include privilege escalation, lateral movement, persistence, data exfiltration, spawning reverse shells, and more. This technique is great at flying under the radar and can be difficult for defenders to detect. Since many of these tools are used for legitimate administration, it can be hard to separate malicious activity from normal activity. Windows PowerShell is a good example. Despite being abused by attackers for years, it is still a common vector during post-exploitation. Another compelling reason that malicious actors prefer to use native binaries is cost. In general, it is much more expensive and risky to develop custom tools that are more likely to be flagged to begin with. Especially when living off the land techniques can become wormable, it's in an attacker's best interest to use what is already there. GTFOBins and LOLBAS are no doubt excellent resources when it comes to abusing native binaries, but sometimes it can be tedious to switch back and forth from the browser. Gtfo is a tool written in Python that aims to provide all the information these resources have to offer from the terminal's convenience. Installing Gtfo To install gtfo, the first thing we need to do is clone the GitHub repository: ~# git clone https://github.com/mzfr/gtfo Cloning into 'gtfo'... remote: Enumerating objects: 56, done. remote: Counting objects: 100% (56/56), done. remote: Compressing objects: 100% (42/42), done. remote: Total 56 (delta 21), reused 42 (delta 12), pack-reused 0 Unpacking objects: 100% (56/56), 317.52 KiB | 1.65 MiB/s, done. Next, change into the newly created directory: ~# cd gtfo Gtfo uses Python 3, so we need to use pip3 here. It can be installed with the following command: ~/gtfo# apt install python3-pip Now we can install the required dependencies: ~/gtfo# pip3 install -r requirements.txt Requirement already satisfied: pyyaml in /usr/lib/python3/dist-packages (from -r requirements.txt (line 1)) (5.3.1) Requirement already satisfied: requests in /usr/lib/python3/dist-packages (from -r requirements.txt (line 2)) (2.23.0) Collecting bs4 Downloading bs4-0.0.1.tar.gz (1.1 kB) Requirement already satisfied: lxml in /usr/lib/python3/dist-packages (from -r requirements.txt (line 4)) (4.5.2) Collecting requests_cache Downloading requests_cache-0.5.2-py2.py3-none-any.whl (22 kB) Requirement already satisfied: tabulate in /usr/lib/python3/dist-packages (from -r requirements.txt (line 6)) (0.8.2) Requirement already satisfied: pyfiglet in /usr/lib/python3/dist-packages (from -r requirements.txt (line 7)) (0.8.post0) Requirement already satisfied: beautifulsoup4 in /usr/lib/python3/dist-packages (from bs4->-r requirements.txt (line 3)) (4.9.1) Building wheels for collected packages: bs4 Building wheel for bs4 (setup.py) ... done Created wheel for bs4: filename=bs4-0.0.1-py3-none-any.whl size=1272 sha256=2a0036256cc5bc7b34622abe1b56ff080f2829a0ae7cc2c858b079e0c9172e71 Stored in directory: /root/.cache/pip/wheels/75/78/21/68b124549c9bdc94f822c02fb9aa3578a669843f9767776bca Successfully built bs4 Installing collected packages: bs4, requests-cache Successfully installed bs4-0.0.1 requests-cache-0.5.2 Now we can run gtfo with the dot-slash command: ~/gtfo# ./gtfo _ _ _ __ _| || |_ | | / _| |_ __ _| __ _| |_| |_ ___ _| || |_ / _` | __| _/ _ \ |_ __ _| | (_| | |_| || (_) | |_||_| \__, |\__|_| \___/ __/ | |___/ usage: gtfo [-h] (-b BINS | -e EXE | -w LINK | -ls {bins,exe}) gtfo: error: one of the arguments -b/--bins -e/--exe -w/--link -ls/--list is required This gives us some short usage information. We should be able to run this tool from anywhere on our system by creating a symbolic link to the executable. Navigate to /usr/local/bin to get started: ~/gtfo# cd /usr/local/bin/ And create a symbolic link called gtfo to the executable in the directory we cloned from GitHub earlier: ~/usr/local/bin# ln -s ~/NB/gtfo/gtfo gtfo Now we can run gtfo from any directory. Using Gtfo to Search Binaries To view the help menu and optional arguments, use the -h flag: ~# gtfo -h _ _ _ __ _| || |_ | | / _| |_ __ _| __ _| |_| |_ ___ _| || |_ / _` | __| _/ _ \ |_ __ _| | (_| | |_| || (_) | |_||_| \__, |\__|_| \___/ __/ | |___/ usage: gtfo [-h] (-b BINS | -e EXE | -w LINK | -ls {bins,exe}) optional arguments: -h, --help show this help message and exit -b BINS, --bins BINS Search binaries on GTFOBins -e EXE, --exe EXE Search Windows exe on LOLBAS -w LINK, --link LINK gtfobins link to the page -ls {bins,exe}, --list {bins,exe} list all the available binaries We can list the Unix binaries with the -ls switch followed by the bins argument: ~# gtfo -ls bins _ _ _ __ _| || |_ | | / _| |_ __ _| __ _| |_| |_ ___ _| || |_ / _` | __| _/ _ \ |_ __ _| | (_| | |_| || (_) | |_||_| \__, |\__|_| \___/ __/ | |___/ βββββββββββββββ€ββββββββββββ€ββββββββββββ€βββββββββββββ€ββββββββββββ€βββββββββββββββ€ββββββββββββββ€βββββββββββ€ββββββββββββββββββββ€βββββββββββ β apt-get β apt β aria2c β arp β ash β awk β base32 β base64 β bash β bpftrace β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β bundler β busctl β busybox β byebug β cancel β cat β chmod β chown β chroot β cobc β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β cp β cpan β cpulimit β crash β crontab β csh β curl β cut β dash β date β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β dd β dialog β diff β dmesg β dmsetup β dnf β docker β dpkg β easy_install β eb β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β ed β emacs β env β eqn β expand β expect β facter β file β find β finger β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β flock β fmt β fold β ftp β gawk β gcc β gdb β gem β genisoimage β gimp β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β git β grep β gtester β hd β head β hexdump β highlight β iconv β iftop β ionice β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β ip β irb β jjs β journalctl β jq β jrunscript β ksh β ksshell β ld.so β ldconfig β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β less β logsave β look β ltrace β lua β lwp-download β lwp-request β mail β make β man β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β mawk β more β mount β mtr β mv β mysql β nano β nawk β nc β nice β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β nl β nmap β node β nohup β nroff β nsenter β od β openssl β pdb β perl β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β pg β php β pic β pico β pip β pkexec β pry β puppet β python β rake β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β readelf β red β redcarpet β restic β rlogin β rlwrap β rpm β rpmquery β rsync β ruby β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β run-mailcap β run-parts β rview β rvim β scp β screen β script β sed β service β setarch β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β sftp β shuf β smbclient β socat β soelim β sort β sqlite3 β ssh β start-stop-daemon β stdbuf β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β strace β strings β su β sysctl β systemctl β tac β tail β tar β taskset β tclsh β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β tcpdump β tee β telnet β tftp β time β timeout β tmux β top β ul β unexpand β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β uniq β unshare β uudecode β uuencode β valgrind β vi β view β vim β watch β wget β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β whois β wish β xargs β xxd β xz β yelp β yum β zip β zsh β zsoelim β βββββββββββββββΌββββββββββββΌββββββββββββΌβββββββββββββΌββββββββββββΌβββββββββββββββΌββββββββββββββΌβββββββββββΌββββββββββββββββββββΌβββββββββββ€ β zypper β β β β β β β β β β βββββββββββββββ§ββββββββββββ§ββββββββββββ§βββββββββββββ§ββββββββββββ§βββββββββββββββ§ββββββββββββββ§βββββββββββ§ββββββββββββββββββββ§βββββββββββ This outputs a nice table containing all the abusable binaries that can be found on GTFOBins. To list Windows binaries, use the -ls switch followed by the exe argument: ~# gtfo -ls exe _ _ _ __ _| || |_ | | / _| |_ __ _| __ _| |_| |_ ___ _| || |_ / _` | __| _/ _ \ |_ __ _| | (_| | |_| || (_) | |_||_| \__, |\__|_| \___/ __/ | |___/ βββββββββββββββββββββ€βββββββββββββββββββββββ€ββββββββββββββββββββββββββββββββββ€βββββββββββββββββββββββββββββββ€ββββββββββββββββββββββββ€βββββββββββββββββββββββββ€βββββββββββββββββββββββββββββββ β At.exe β Atbroker.exe β Bash.exe β Bitsadmin.exe β CertReq.exe β Certutil.exe β Cmd.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Cmdkey.exe β Cmstp.exe β Control.exe β Csc.exe β Cscript.exe β Desktopimgdownldr.exe β Dfsvc.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Diantz.exe β Diskshadow.exe β Dnscmd.exe β Esentutl.exe β Eventvwr.exe β Expand.exe β β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Extexport.exe β Extrac32.exe β Findstr.exe β Forfiles.exe β Ftp.exe β GfxDownloadWrapper.exe β Gpscript.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Hh.exe β Ie4uinit.exe β Ieexec.exe β Ilasm.exe β Infdefaultinstall.exe β Installutil.exe β Jsc.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Makecab.exe β Mavinject.exe β Microsoft.Workflow.Compiler.exe β Mmc.exe β MpCmdRun.exe β Msbuild.exe β Msconfig.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Msdt.exe β Mshta.exe β Msiexec.exe β Netsh.exe β Odbcconf.exe β Pcalua.exe β Pcwrun.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Pktmon.exe β Presentationhost.exe β Print.exe β Psr.exe β Rasautou.exe β Reg.exe β Regasm.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Regedit.exe β Regini.exe β Register-cimprovider.exe β Regsvcs.exe β Regsvr32.exe β Replace.exe β Rpcping.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Rundll32.exe β Runonce.exe β Runscripthelper.exe β Sc.exe β Schtasks.exe β Scriptrunner.exe β SyncAppvPublishingServer.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Ttdinject.exe β Tttracer.exe β vbc.exe β Verclsid.exe β Wab.exe β Wmic.exe β Wscript.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Wsreset.exe β Xwizard.exe β Advpack.dll β Comsvcs.dll β Ieadvpack.dll β Ieaframe.dll β Mshtml.dll β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Pcwutl.dll β Setupapi.dll β Shdocvw.dll β Shell32.dll β Syssetup.dll β Url.dll β Zipfldr.dll β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β AgentExecutor.exe β Appvlp.exe β Bginfo.exe β Cdb.exe β csi.exe β Devtoolslauncher.exe β dnx.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Dotnet.exe β Dxcap.exe β Excel.exe β Mftrace.exe β Msdeploy.exe β msxsl.exe β ntdsutil.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Powerpnt.exe β rcsi.exe β Sqldumper.exe β Sqlps.exe β SQLToolsPS.exe β Squirrel.exe β te.exe β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Tracker.exe β Update.exe β vsjitdebugger.exe β Winword.exe β Wsl.exe β CL_Mutexverifiers.ps1 β CL_Invocation.ps1 β βββββββββββββββββββββΌβββββββββββββββββββββββΌββββββββββββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββΌββββββββββββββββββββββββΌβββββββββββββββββββββββββΌβββββββββββββββββββββββββββββββ€ β Manage-bde.wsf β Pubprn.vbs β Slmgr.vbs β Syncappvpublishingserver.vbs β winrm.vbs β Pester.bat β β βββββββββββββββββββββ§βββββββββββββββββββββββ§ββββββββββββββββββββββββββββββββββ§βββββββββββββββββββββββββββββββ§ββββββββββββββββββββββββ§βββββββββββββββββββββββββ§ββββββββββ This outputs a table containing all the abusable binaries that can be found on LOLBAS. To get information about a specific binary, use the -b flag. Here we can see information about the Unix less command: ~# gtfo -b less _ _ _ __ _| || |_ | | / _| |_ __ _| __ _| |_| |_ ___ _| || |_ / _` | __| _/ _ \ |_ __ _| | (_| | |_| || (_) | |_||_| \__, |\__|_| \___/ __/ | |___/ Code: less /etc/profile !/bin/sh Type: shell Code: VISUAL="/bin/sh -c '/bin/sh'" less /etc/profile v Type: shell Code: less file_to_read Type: file-read # This is useful when `less` is used as a pager by another binary to read a different file. Code: less /etc/profile :e file_to_read Type: file-read Code: echo DATA | less sfile_to_write q Type: file-write # This invokes the default editor to edit the file. The file must exist. Code: less file_to_write v Type: file-write Code: sudo less /etc/profile !/bin/sh Type: sudo Code: ./less file_to_read Type: suid In the output, we can see the type of abuse and the corresponding code. This example contains code for sudo and SUID, to get a shell, and to read and write files. We can also get the link to the GTFOBins page with the -w option: ~# gtfo -w less _ _ _ __ _| || |_ | | / _| |_ __ _| __ _| |_| |_ ___ _| || |_ / _` | __| _/ _ \ |_ __ _| | (_| | |_| || (_) | |_||_| \__, |\__|_| \___/ __/ | |___/ --> less --------------------> https://gtfobins.github.io//gtfobins/less To view information on a particular Windows binary, use the -e flag. Please note this is case sensitive and the extension is required. Here, we can see information about the Certutil.exe program: ~# gtfo -e Certutil.exe _ _ _ __ _| || |_ | | / _| |_ __ _| __ _| |_| |_ ___ _| || |_ / _` | __| _/ _ \ |_ __ _| | (_| | |_| || (_) | |_||_| \__, |\__|_| \___/ __/ | |___/ # Download and save 7zip to disk in the current folder. CMD: certutil.exe -urlcache -split -f http://7-zip.org/a/7z1604-x64.exe 7zip.exe Category: Download Privileges: User # Download and save 7zip to disk in the current folder. CMD: certutil.exe -verifyctl -f -split http://7-zip.org/a/7z1604-x64.exe 7zip.exe Category: Download Privileges: User # Download and save a PS1 file to an Alternate Data Stream (ADS). CMD: certutil.exe -urlcache -split -f https://raw.githubusercontent.com/Moriarty2016/git/master/test.ps1 c:\temp:ttt Category: ADS Privileges: User # Command to encode a file using Base64 CMD: certutil -encode inputFileName encodedOutputFileName Category: Encode Privileges: User # Command to decode a Base64 encoded file. CMD: certutil -decode encodedInputFileName decodedOutputFileName Category: Decode Privileges: User We can see the category, command, and required privileges in the output. This example contains commands to encrypt, decrypt, and download files. We can also get the link to the LOLBAS page with the -w option: ~# gtfo -w Certutil.exe _ _ _ __ _| || |_ | | / _| |_ __ _| __ _| |_| |_ ___ _| || |_ / _` | __| _/ _ \ |_ __ _| | (_| | |_| || (_) | |_||_| \__, |\__|_| \___/ __/ | |___/ --> Certutil.exe --------------------> https://lolbas-project.github.io//lolbas/Binaries/Certutil Wrapping Up This tutorial taught us about the GTFOBins and LOLBAS projects and how incredibly useful they can be for information on native binaries on Unix and Windows systems. We also explored gtfo, a tool that can search these resources right from the command line. As you can see, gtfo can be quite useful for searching abusable binaries without ever having to leave the terminal. Source1 point
-
chill , eu zic ca te-a rugat pe tine sa nu afle tacsu1 point
-
Cand m-am angajat eu pe 1600 RON am cautat ceva si stiam bine mai multe limbaje de programare cu proiecte in portofoliu. Si mai stiam si lucruri de security, pe langa ceva networking, Linux si altele (mi-a placut sa invat citind carti, inca imi place asta). Am aplicat la vreo 80 de firme si am fost la vreo 10-15 interviuri. Nu a fost deloc usor, cum ma asteptam si ma asteptam si la mai mult din punct de vedere financiar din cauza unor povesti auzite, dar realitatea m-a lovit. Insa am prins intr-un loc foarte OK pe ceea ce imi placea (pe langa security) la acel moment: C/C++ (nu existau job-uri pe security atunci, sau nu stiam eu de ele). Ce vreau eu sa fac zicandu-va aceste lucruri e sa va aduc cu picioarele pe pamant. Ca va duceti la interviuri, cereti 2000 de EUR si rad aia de voi. Chiar daca ati invatat ceva prin facultate, nu e atat de util in practica cum v-ati astepta. Security nu se face in facultate, deci un maxim 10-15% utilitate in faptul ca aveti o diploma. Daca mergeti pe programare nu veti stii decat limbajul si maxim ati avea 2-3 proiectele care nu se compara cu proiectele Enterprise cu tone de framework-uri si module care se leaga intre ele. Altfel spus, pentru angajatori, fara experienta, valoarea nu este extrem de mare si de aceea nici nu pot da salarii foarte mari din prima. Veti creste treptat, mai rapid la inceput si mai greu ulterior, dar aveti nevoie de rabdare. Legat de salariu, ganditi-va asa: daca ati fi angajatori si ar veni o persoana ca voi la interviu ce salariu i-ati da? Cred ca mai important decat salariul de inceput sunt alte lucruri: sa te asiguri ca ai colegi OK si ca poti invata de la ei. Sa te asiguri ca e interesant ce face firma ca sa nu lucrezi cu scarba. Sa te asiguri ca proiectele sunt frumoase si ca lucrand la ele vei invata multe lucruri. Si sa va ganditi foarte bine cand alegeti domeniul: ai ales Java? Probabil o sa mergi pe Java toata viata (desi nu e tocmai obligatoriu, va fi destul de greu sa faceti pe viitor o schimbare, mai ales din punct de vedere financiar).1 point
