Jump to content

malsploit

Moderators
  • Posts

    1965
  • Joined

  • Last visited

  • Days Won

    20

Everything posted by malsploit

  1. La revedere, Mihai!
  2. nu ai cum sa infectezi tu pe cineva. De obicei, se creeaza o retea de afiliati in care sunt primiti oamenii pe baza unor informatii si le sunt impartie fisiere infectate. Trebuie sa le demonstrezi ca te ocupi cu chestii de genu. Majoritatea iti cer print-screnuri cu un botnet pe care il detii etc.
  3. This is what I tell people to do, who ask me "how do I learn to be a Linux sysadmin?". 1) Set up a KVM hypervisor. 2) Inside of that KVM hypervisor, install a Spacewalk server. Use CentOS 6 as the distro for all work below. (For bonus points, set up errata importation on the CentOS channels, so you can properly see security update advisory information.) 3) Create a VM to provide named and dhcpd service to your entire environment. Set up the dhcp daemon to use the Spacewalk server as the pxeboot machine (thus allowing you to use Cobbler to do unattended OS installs). Make sure that every forward zone you create has a reverse zone associated with it. Use something like "internal.virtnet" (but not ".local") as your internal DNS zone. 4) Use that Spacewalk server to automatically (without touching it) install a new pair of OS instances, with which you will then create a Master/Master pair of LDAP servers. Make sure they register with the Spacewalk server. Do not allow anonymous bind, do not use unencrypted LDAP. 5) Reconfigure all 3 servers to use LDAP authentication. 6) Create two new VMs, again unattendedly, which will then be Postgresql VMs. Use pgpool-II to set up master/master replication between them. Export the database from your Spacewalk server and import it into the new pgsql cluster. Reconfigure your Spacewalk instance to run off of that server. 7) Set up a Puppet Master. Plug it into the Spacewalk server for identifying the inventory it will need to work with. (Cheat and use ansible for deployment purposes, again plugging into the Spacewalk server.) 8) Deploy another VM. Install iscsitgt and nfs-kernel-server on it. Export a LUN and an NFS share. 9) Deploy another VM. Install bakula on it, using the postgresql cluster to store its database. Register each machine on it, storing to flatfile. Store the bakula VM's image on the iscsi LUN, and every other machine on the NFS share. 10) Deploy two more VMs. These will have httpd (Apache2) on them. Leave essentially default for now. 11) Deploy two more VMs. These will have tomcat on them. Use JBoss Cache to replicate the session caches between them. Use the httpd servers as the frontends for this. The application you will run is JBoss Wiki. 12) You guessed right, deploy another VM. This will do iptables-based NAT/round-robin loadbalancing between the two httpd servers. 13) Deploy another VM. On this VM, install postfix. Set it up to use a gmail account to allow you to have it send emails, and receive messages only from your internal network. 14) Deploy another VM. On this VM, set up a Nagios server. Have it use snmp to monitor the communication state of every relevant service involved above. This means doing a "is the right port open" check, and a "I got the right kind of response" check and "We still have filesystem space free" check. 15) Deploy another VM. On this VM, set up a syslog daemon to listen to every other server's input. Reconfigure each other server to send their logging output to various files on the syslog server. (For extra credit, set up logstash or kibana or greylog to parse those logs.) 16) Document every last step you did in getting to this point in your brand new Wiki. 17) Now go back and create Puppet Manifests to ensure that every last one of these machines is authenticating to the LDAP servers, registered to the Spacewalk server, and backed up by the bakula server. 18) Now go back, reference your documents, and set up a Puppet Razor profile that hooks into each of these things to allow you to recreate, from scratch, each individual server. 19) Destroy every secondary machine you've created and use the above profile to recreate them, joining them to the clusters as needed. 20) Bonus exercise: create three more VMs. A CentOS 5, 6, and 7 machine. On each of these machines, set them up to allow you to create custom RPMs and import them into the Spacewalk server instance. Ensure your Puppet configurations work for all three and produce like-for-like behaviors. Do these things and you will be fully exposed to every aspect of Linux Enterprise systems administration. Do them well and you will have the technical expertise required to seek "Senior" roles. If you go whole-hog crash-course full-time it with no other means of income, I would expect it would take between 3 and 6 months to go from "I think I'm good with computers" to achieving all of these -- assuming you're not afraid of IRC and google (and have neither friends nor family ...). https://www.reddit.com/r/linuxadmin/comments/2s924h/how_did_you_get_your_start/cnnw1ma
  4. Unii dintre voi nu meritati acces la internet. Eu te-as pune sa imi dai cu mopul in data-center, daca primes flood de la tine. Probabil e devreme dar trebuie sa invatati ca in urma unor actiuni de genu, apar consecinte. Poti sa intri la inchisoare pentru flood. Norocul vostru e ca nu isi pune nimeni mintea cu voi.
  5. Warning: The repository associated with this post contains malicious binaries (core, core_packed, soldier,soldier_packed) for educational purposes. Don't go around toying with them if you don't know what you're doing. A couple of days ago i came across this post by Ethan Heilman discussing Hacking Team's crypter named 'core-packer'. The crypter's source was leaked online after the Hacking Team compromise of July 2015. As Heilman notes despite the name 'core-packer' is a crypter as it doesn't perform compression but rather uses anti-analysis functionality (including encryption) to obfuscate malicious PEs in order to evade anti-virus products. Taking a look at 'core-packer' provides an interesting glimpse at the quality (or lack thereof) of 'government-grade' commercial malware products. Heilman's discussion of the crypter is fairly complete and mentions the important distinction between the common use of cryptography and the use of cryptography in anti-anti-virus techniques: while the former seeks to guarantee security properties like confidentiality, integrity, etc. (preferably on a long-term basis) the latter simply seeks to force detection solutions to integrate code that recognizes the packer, locates the cryptographic keying material and applies the decryption process in the appropriate fashion in order to obtain the original malicious binary in the hopes that the performance penalty imposed by integrating this kind of code for every crypter out there is simply too much. So while the usage of ciphers likeTEA or RC4 would be ill-advised (to say the least) in regular cryptographic contexts in the case of 'core-packer' that's not much of an issue. Given that the keying material is stored together with the ciphertext the hardly is the guarantee of long-term confidentiality. Read more: https://samvartaka.github.io/malware/2015/09/13/hackingteam-crypter/
  6. Agrafia (din grecescul: a "f?r?" ?i graphein „a scrie") este o stare patologic? caracterizat? prin incapacitate de exprimare a gândurilor în scris. Se datore?te unor leziuni localizate în centrii nervo?i superiori din scoar?a cerebral?.
  7. Il mutam la cos. In urmatorul post pe care il deschizi, ne asteptam sa spui cum ai gasit vulnerabilitatea, cum poate fi reparata, parametrii vulnerabili etc.
  8. Nu inteleg ce importanta are cat dureaza sincronizarea. Nu te obliga nimeni sa descarci tot blockchain-ul de la bitcoin. La mine a durat cam o saptamana. Altcoin-urile de genul BCN nu or sa reziste in timp.
  9. malsploit

    RST Bashed

    Acum ceva timp am primit un mesaj privat de la un user, care intre timp a devenit supermoderator. Din pacate l-am sters. M-a rugat frumos sa-i dau ban altui utilizator pe motiv ca i-a facut public contul de facebook. L-am intrebat daca are vreo dovada sau ceva de genu. Mi-a dat un print-screen. In poza se vedea ca userul respectiv i-a trimis un mesaj e genul: Am crezut ca ma trolleaza, dar mi-am dat seama ca era serios.
  10. Se presupune ca suntem o comunitate interesata de infosec. Nu ne trebuie tutorial care sa ne explice cum sa facem update la chrome.
  11. Ce inseamna sa te trateze toti ca pe o femeie in viata reala... Noroc ca avem forum sa la aratam la toti ca o avem mare...
  12. We created a honeypot platform, which is based on the well-established honeypotsglastopf, kippo, honeytrap and dionaea, the network IDS/IPS suricata, elasticsearch-logstash-kibana, ewsposter and some docker magic. We want to make this technology available to everyone who is interested and release it as a Community Edition. We want to encourage you to participate. TL;DR Meet the system requirements. Use at least 2GB RAM and 40GB disk space as well as a working internet connection. Download the tpotce.iso or create it yourself. Install the system in a VM or on physical hardware with internet access. Sit tight - watch and analyze. We have created a nice installation video for you in case you run into problems. Please be advised, that one CPU is fully sufficient to run T-Pot In case you already have an Ubuntu 14.04.x running in your datacenter and are unable to install from an ISO image, we have created a script that converts your Ubuntu base install into a full-fledged T-Pot within just a couple of minutes. We will ensure the compatibility to the Intel NUC platform, as we really like this handy format. https://dtag-dev-sec.github.io/mediator/feature/2015/03/17/concept.html
      • 1
      • Upvote
  13. https://en.wikipedia.org/wiki/User_Datagram_Protocol https://en.wikipedia.org/wiki/Transmission_Control_Protocol Defenses Against TCP SYN Flooding Attacks - The Internet Protocol Journal - Volume 9, Number 4 - Cisco Systems https://en.wikipedia.org/wiki/Network_socket https://en.wikipedia.org/wiki/Denial-of-service_attack
  14. S-a rezolvat. Toate au primit ban, inclusiv papagal. Nu e frumos sa ne pierzi si noua timpul.
  15. aterm 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] avisss 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] Ely0n 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] Elyon 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] gogosar.murat.valoare 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] hydra20 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] Mylife_4Hacking 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] papagal 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] z4rk 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] z4rk. 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User] Zark.dll 94.52.xxx.xxx [Find Latest Posts by User] [View Other IP Addresses for this User]
  16. Sunt situatii si situatii. In cazul in care ai nevoie de ceva informati din baza de date, e de inteles folosirea unui tool care automatizeaza, indiferent daca-i spune sqlmap, havij, themole etc. Fac putina mizerie, dar sunt eficiente. In cazul in care le folosesti sa te lauzi cuiva ca stii sa spargi site-uri, esti la acelasi nivel cu un copil de 3 ani
  17. Absolut nici una. https://alloscomp.com/bitcoin/calculator
  18. Putin off-topic: Acum ceva timp ma gandeam sa cumpar 2-3 milioane de dogecoins si sa-i impartim intre membrii care sunt activi, in functie de anumite criterii. Apoi ma gandeam sa implementam un sistem prin care utilizatorii sa recompenseze alti utilizatori cu dogecoins pe care Ii au in cont. Se potriveste si cu ideile care au stat la baza dogecoins
  19. @Echo off echo echo Step 1: Delete Updates… echo Delete KB3075249 (telemetry for Win7/8.1) start /w wusa.exe /uninstall /kb:3075249 echo Delete KB3080149 (telemetry for Win7/8.1) start /w wusa.exe /uninstall /kb:3080149 echo Delete KB3021917 (telemetry for Win7) start /w wusa.exe /uninstall /kb:3021917 echo Delete KB3022345 (telemetry) start /w wusa.exe /uninstall /kb:3022345 echo Delete KB3068708 (telemetry) start /w wusa.exe /uninstall /kb:3068708 echo Delete KB3044374 (Get Windows 10 for Win8.1) start /w wusa.exe /uninstall /kb:3044374 echo Delete KB3035583 (Get Windows 10 for Win7sp1/8.1) start /w wusa.exe /uninstall /kb:3035583 echo Delete KB2990214 (Get Windows 10 for Win7 without sp1) start /w wusa.exe /uninstall /kb:2990214 echo Delete KB2990214 (Get Windows 10 for Win7) start /w wusa.exe /uninstall /kb:2990214 echo Delete KB2952664 (Get Windows 10 assistant) start /w wusa.exe /uninstall /kb:2952664 echo Delete KB3075853 (update for “Windows Update” on Win8.1/Server 2012R2) start /w wusa.exe /uninstall /kb:3075853 echo Delete KB3065987 (update for “Windows Update” on Win7/Server 2008R2) start /w wusa.exe /uninstall /kb:3065987 echo Delete KB3050265 (update for “Windows Update” on Win7) start /w wusa.exe /uninstall /kb:3050265 echo Delete KB971033 (license validation) start /w wusa.exe /uninstall /kb:971033 echo Delete KB2902907 (description not available) start /w wusa.exe /uninstall /kb:2902907 echo Delete KB2976987 (description not available) start /w wusa.exe /uninstall /kb:2976987 echo Step 2: Blocking Routes… route -p add 23.218.212.69 MASK 255.255.255.255 0.0.0.0 route -p add 65.55.108.23 MASK 255.255.255.255 0.0.0.0 route -p add 65.39.117.230 MASK 255.255.255.255 0.0.0.0 route -p add 134.170.30.202 MASK 255.255.255.255 0.0.0.0 route -p add 137.116.81.24 MASK 255.255.255.255 0.0.0.0 route -p add 204.79.197.200 MASK 255.255.255.255 0.0.0.0 route -p add 23.218.212.69 MASK 255.255.255.255 0.0.0.0 echo Step 3: Disabling tasks… schtasks /Change /TN “\Microsoft\Windows\Application Experience\AitAgent” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Application Experience\Microsoft Compatibility Appraiser” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Application Experience\ProgramDataUpdater” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Autochk\Proxy” /DISABLE schtasks /Change /TN “Microsoft\Windows\Customer Experience Improvement Program\Consolidator” /DISABLE schtasks /Change /TN “Microsoft\Windows\Customer Experience Improvement Program\KernelCeipTask” /DISABLE schtasks /Change /TN “Microsoft\Windows\Customer Experience Improvement Program\UsbCeip” /DISABLE schtasks /Change /TN “\Microsoft\Windows\DiskDiagnostic\Microsoft-Windows-DiskDiagnosticDataCollector” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Maintenance\WinSAT” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\ActivateWindowsSearch” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\ConfigureInternetTimeService” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\DispatchRecoveryTasks” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\ehDRMInit” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\InstallPlayReady” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\mcupdate” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\MediaCenterRecoveryTask” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\ObjectStoreRecoveryTask” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\OCURActivate” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\OCURDiscovery” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\PBDADiscovery” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\PBDADiscoveryW1” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\PBDADiscoveryW2” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\PvrRecoveryTask” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\PvrScheduleTask” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\RegisterSearch” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\ReindexSearchRoot” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\SqlLiteRecoveryTask” /DISABLE schtasks /Change /TN “\Microsoft\Windows\Media Center\UpdateRecordPath” /DISABLE echo Step 4: Killing Diagtrack-service (if it still exists)… sc stop Diagtrack sc delete Diagtrack echo Final Step: Stop remoteregistry-service (if it still exists)… sc config remoteregistry start= disabled sc stop remoteregistry echo Done — Reboot! [COLOR=#000000]shutdown -r[/COLOR] Windows Script to Remove All Windows 10 Telemetry Updates
      • 1
      • Upvote
  20. ce suma ai de investit? e ciudat sa ceri informaii de genul asta pe un forum. Vrei sa investesti in aparatura de mining? sau vrei sa cumperi btc/ltc pe care sa-i vinzi? sau vrei sa creezi un start-up care sa folosesca btc/ltc In momentul in care ai o suma de investit, se presupune ca detii cel putin informatii elementare despre domeniul in care vrei sa investesti.
  21. Contacteaza-l pe @spooky01 . E de incredere. Am tranzactionat peste 30 de bitcoini cu el.
  22. O sa-si revina. Ajunge inapoi la 300. Eu am cumparat cand era 150$ si inca-i pastrez.
  23. @Sveratus ia o pauza cateva saptamani
×
×
  • Create New...