Learn Information Security: tool

Showing posts with label tool. Show all posts

This is amusing to me

I have never seen anything even remotely close from the "other side".

Being able to program one's hate and disdain for things, instead of just ignoring, crossing the street, or moving on. Amazing to me how many of these Libertarian/ GOP/ MAGA/ Republicans just can't wait to get into other people's business and tell them what's what.

BLOCKADE Ebook Scanner Setup Guide

Empire Notes

sudo apt install powershell-empire

as stated above:

in one terminal run `powershell-empire server`, then open a new terminal and run `powershell-empire client`.

I had to open 2 terminal windows. (Ctrl + Shift + T to do it within same terminal window.)

In the first I ran the server command, and in the 2nd the client portion of the script.

When the client loads it attempts to connect to the server on the localhost.

That being said, I am finding many of the commands in the book to be slightly different in this version of Empire.

Some VERY quick notes:::

Start the server first -- sudo powershell-empire server

Then start the client -- sudo powershell-empire client

uselistener http ← the newer version (4.x) will show the options after you complete typing uselistener

info

options ← this has switched to just ‘options’

Set ‘<XXXX>’ seems to work as normal.

A gotcha for me was I had to set the port. Just doing the book and it "failed to validate listener http options"

set Port 80

---->> I did not notice this until later, but in the server window, it was throwing an error saying: "Set the port dammit" (not in so many words ofc.) Next time I will check.

Same as before with the listener, once you set the stager, 'info' will display a few things, but you need 'options' to see all of the things.

It seems 'sysinfo' has been replaced with just 'info'. I like how PS gives you the memory usage and architecture of the process (x86)

A quick Addition:

I made a mistake on my listener, and the only way I could edit it was to disable it first. (Google was not my friend on this.)

listeners --> then "disable http" finally stopped the listener

fierce

Basic running of the program:
./fierce.pl -dns <domain>

Search all class C ranges found for PTR records that match the domain
./fierce.pl -wide -dns <company>

Some reverse DNS looking
./fierce.pl -dnsserver <target_dns> -range <ipNet_range>

Some other flags:
-search -- search list. When fierce attempts to traverse up and down ipspace it may encounter other servers within other domains that may belong to the same company. If you supply a comma delimited list to fierce it will report anything found.

-threads <number> -- The number of threads to use when running the scan.

-wordlist <list.txt> -- Use an alternate word list to the default one for the application.

-file <filename.out> -- write the results of the scan to the file specified in the cmdline.

-delay <number> -- This specifies a delay, in seconds, to wait between queries.

Koadic

Choose your stager.
    regsrvr and mshta seem to work well.

After you have a zombie, run other toys
    implant/elevate/bypassuac_
        set payload to 0 on this

    Once you have an admin session you can dump the hashes:
        implant/gather/hashdump_sam

    You can scan the internal network:
        implant/scan/tcp

Mimikatz works well for me, as long as you have an admin session. You can tell that buy running zombies by itself. Under the ID column, if it has an asterisk (*) that means admin session.

Binary files are stored here: /pentest/post-exploitation/koadic/data/bin
Note: I installed my version through the PTF tool by Dave K.

Learn Information Security

Pages

This is amusing to me

Empire Notes

fierce

Koadic

Pdfid update

Basics of Windows Incident Response

DFIR - The Definitive Compendium Project

ICMP shells

AV0id – Anti-Virus Bypass Metasploit Payload Generator Script

Quick Integration of MISP and Cuckoo

Stegano 0.6.4

Microsoft Office Word Malicious Macro Execution

Lynis Auditing Tool 2.4.1

Pages

CTF Levels