" Ophcrack is an open source (GPL license) program that cracks Windows LM hashes using rainbow tables. The program includes the ability to import the hashes from a variety of formats, including dumping directly from the SAM files of Windows. There is also a Live CD version which automates the retrieval, decryption, and cracking of passwords from a Windows system. Rainbow tables for LM hashes of alphanumeric passwords are provided for free by the developers. These tables can crack 99.9% of alphanumeric passwords of up to 14 characters in usually a few seconds, and at most a few minutes. Larger rainbow tables (for LM hashes of passwords with all printable characters, including symbols and space) are available for purchase from Objectif Securité. Starting with version 2.3, Ophcrack also cracks NT hashes. This is necessary if generation of the LM hash is disabled (this is default on Windows Vista), or if the password is longer than 14 characters (in which case the LM hash is not stored)." read more...
Desde hace ya unas semanas, desde que se declaró el estado de alarma, millones de ciudadanos de todo el mundo nos encontramos en un periodo de confinamiento por culpa del ya famoso COVID-19. Esta situación excepcional nos ha permitido pasar más tiempo con algunos de nuestros familiares más cercanos y comenzar o retomar algunos de los proyectos que teníamos olvidados por casa.
Figura 1: Raspberry Pi Zero para "Makers": 6 PoCs & Hacks Just for Fun (1 de 3)
Si este es tu caso y estás buscando alguna idea interesante con la que entretenerte en esta cuarentena has llegado al sitio correcto. En esta serie de tres artículos os presentaremos a vosotros los "Makers" o los que queréis ser "Makers" alguna vez, seis interesantes proyectos basados en la Raspberry Pi Zero y os explicaremos cómo llevarlos a cabo.
Y ahora, vamos a por los seis proyectos que puedes hacer tú en tu casa para entretenerte y meterte en el mundo de los "makers" de una vez por todas si tenías ganas de ello.
1.- Pi Zero Drone: Drone "Low-Cost" con Raspberry Pi Zero
El primero de los proyectos de los que os hablaremos hoy se trata de la construcción de un Drone Low-Cost - por menos de 200 € - el cual se basará en una distribución de GNU/Linux y utilizara la Raspberry Pi 0 como placa controladora o cerebro. El mundo de los drones y cuadrocopteros ligeros cuenta con millones de aficionados, con Pi Zero Drone es posible acercar un poco más este mundillo a todos aquellos que quieren introducirse en la construcción de estos divertidos aparatos.
Si no estás familiarizado con la construcción de drones de carreras o de cualquier otro tipo no tienes de que preocuparte, a continuación te explicaremos cuales son las piezas necesarias para este montaje y como se ensamblan pero si te gusta el mundo de los Drones, y tienes inclinaciones de "maker", puedes leer el libro de David Meléndez Calero que habla justo de estas cosas: "Hacking con Drones: Love is in the air".
Las piezas necesarias serán las siguientes: chasis, variadores, motores, hélices, batería, controladora PFX mini (69 €) y por supuesto una Raspberry Pi Zero. Lo primero será realizar el montaje del drone, este proceso es bastante sencillo y no debería llevarte más de 1 hora. Comenzaremos con el montaje de la estructura, en cada brazo del chasis hay que fijar un motor sujetándolo con tornillos (vienen con kit del chasis), a continuación se deben conectar los variadores a los motores (utilizando los cables de colores) y fijarlos en la zona central de los brazos.
Figura 5: Kit de Pi Zero Drone
Para terminar hay que situar la Raspberry Pi Zero y la controladora PFX mini en el centro del chasis, conectando ambas entre sí utilizando los pines y separadores de teflón que vienen en el kit de la controladora. Por último solo queda conectar el módulo de la batería y fíjalo a la parte inferior del chasis utilizando los velcros que te vienen con el kit. También hay que colocar una hélice en cada motor.
Figura 6: Pi Zero Drone montado
Una vez tengamos el montaje realizado pasaremos a la parte de configuración del autopilot (PFX mini + Raspberry Pi Zero), lo bueno del kit de Erle Robotics es que incluye acceso a sus imágenes Debian compatibles con la PFX mini, así que solo tendrás que guardarlas en una tarjeta micro SD e introducirla en tu Raspberry Pi Zero.
Por ultimo conectaremos el cable JSTGH del módulo de alimentación a nuestro montaje de autopilot, lo que hará que al conectar la batería se encienda el drone. Ya solo nos queda conectar los variadores de cada brazo con su respectivo pin a la PFX mini (PWM1 con ESC1, PWM2 con ESC2 y sucesivamente) ya que dos de los motores giraran en sentido horario y otros dos en anti horario.
Figura 7: Cosntrucción de Pi Zero Drone paso a paso
Con el drone ya construido y listo para volar solo queda decidir qué dispositivo utilizar para controlarlo. En este caso el método más sencillo es utilizar una emisora de radio control convencional que cuente con un receptor (el cual montaremos en el drone). Tienes en la página web toda la información detallada del proyecto Pi Zero Drone con un paso a paso.
2.- Zero Phone: construcción de un Smartphone con Raspberry Pi Zero
El segundo de los proyectos del que os hablaremos hoy es la construcción de un mini teléfono móvil, sin duda un proyecto bastante interesante. En este caso la idea surgió de un proyecto de crowdfounding y sus creadores aseguran que es posible construir el smartphone por menos de 50 €.
Este proyecto ha recibido el nombre de Zerophone, es Open Source y está basado en una distribución de GNU/Linux. Una de las mayores ventajas de construir el teléfono nosotros mismos es que nunca tendremos problemas de portabilidad o incompatibilidad con la tarjeta SIM de cualquier operadora de telecomunicaciones. Aunque el Zerophone sea un dispositivo de aspecto muy sencillo será capaz de ejecutar numerosas aplicaciones - solo GNU/Linux pone los limites -, además contará con acceso root.
En cuanto a su hardware, al basarse en una Raspberry Pi Zero este es fácil de modificar y reparar.Una vez hayas adquirido tu kit Zerophone o hayas recopilado todos los componentes necesarios solo tendrás que descargar el software gratuito y seguir paso a paso las instrucciones que encontrarás en la página web del proyecto.
Figura 9: Aspecto de Zero Phone
Si nos fijamos en sus especificaciones se podría decir que es un Smartphone bastante completo, además de contar con iluminación RGB y vibración dispone de una entrada micro HDMI, un puerto USB (de tamaño completo) y un jack de 3.5 en el que podemos conectar auriculares. También cuenta con conectividad Wi-Fi, 2G y es posible implementar BlueTooth.
Figura 10: ZeroPhone kit
En cuanto a la pantalla y teclado cuenta con una pantalla de 1,3 pulgadas y un teclado similar al de los teléfonos móviles de la década anterior. Si esta configuración no te resulta cómoda también es posible sustituir la pantalla y el teclado por una pantalla táctil de Raspberry Pi Zero. Tienes un buen análisis hecho por Javier Pastoren el blog de Xakata.
Una de las cosas que hacen bastante atractivo este proyecto es la posibilidad de conectar el dispositivo a un monitor y de utilizar teclado y ratón para controlarlo o modificar sus funciones desde su API. Si modificar el software del dispositivo no te parece suficiente también puedes personalizar por completo el hardware, es posible integrar una cámara hasta de 8 megapíxeles, nuevos botones o sensores analógicos o digitales, se puede añadir una batería más duradera, añadir distintos módulos (GPS, radio,…) o recurrir a la impresión 3D para diseñar una carcasa totalmente personalizada.
Zerophone es una plataforma ideal para la realización de diversos proyectos, es posible utilizar cualquier lenguaje de programación en él y además permite la ejecución de APIs, scripts SSH y de consolas UART, e incluso, como se ve en la Figura 11, navegar por TOR.
Como veis son proyectos que requieren cierta maña, pero no me digáis que en lugar de estar haciendo puzzles de 1.000 piezas no es mejor estar convirtiéndote en un "maker" y jugando con el hardware y el software.
Autor: Sergio Sancho Azcoitia
*********************************************************************************** - Raspberry Pi Zero para "Makers": 6 PoCs & Hacks Just for Fun (1 de 3) - Raspberry Pi Zero para "Makers": 6 PoCs & Hacks Just for Fun (1 de 3) - Raspberry Pi Zero para "Makers": 6 PoCs & Hacks Just for Fun (1 de 3) ***********************************************************************************
Subover is a Hostile Subdomain Takeover tool designed in Python. From start, it has been aimed with speed and efficiency in mind. Till date, SubOver detects 36 services which is much more than any other tool out there. The tool is multithreaded and hence delivers good speed. It can easily detect and report potential subdomain takeovers that exist. The list of potentially hijackable services is very comprehensive and it is what makes this tool so powerful.
Installing You need to have Python 2.7 installed on your machine. The following additional requirements are required -
-l subdomains.txt is the list of target subdomains. These can be discovered using various tool such as sublist3r or others.
-o output_takeovers.txtis the name of the output file. (Optional & Currently not very well formatted)
-t 20 is the default number of threads that SubOver will use. (Optional)
-V is the switch for showing verbose output. (Optional, Default=False)
Currently Checked Services
Github
Heroku
Unbounce
Tumblr
Shopify
Instapage
Desk
Tictail
Campaignmonitor
Cargocollective
Statuspage
Amazonaws
Cloudfront
Bitbucket
Squarespace
Smartling
Acquia
Fastly
Pantheon
Zendesk
Uservoice
WPEngine
Ghost
Freshdesk
Pingdom
Tilda
Wordpress
Teamwork
Helpjuice
Helpscout
Cargo
Feedpress
Freshdesk
Surge
Surveygizmo
Mashery
Count : 36 FAQ Q: What should my wordlist look like? A: Your wordlist should include a list of subdomains you're checking and should look something like:
I'm pretty sure the reason Novell titled their Mobile Device Management (MDM, yo) under the 'Zenworks' group is because the developers of the product HAD to be in a state of meditation (sleeping) when they were writing the code you will see below.
For some reason the other night I ended up on the Vupen website and saw the following advisory on their page:
Novell ZENworks Mobile Management LFI Remote Code Execution (CVE-2013-1081) [BA+Code]
I took a quick look around and didn't see a public exploit anywhere so after discovering that Novell provides 60 day demos of products, I took a shot at figuring out the bug.
The actual CVE details are as follows:
"Directory traversal vulnerability in MDM.php in Novell ZENworks Mobile Management (ZMM) 2.6.1 and 2.7.0 allows remote attackers to include and execute arbitrary local files via the language parameter."
After setting up a VM (Zenworks MDM 2.6.0) and getting the product installed it looked pretty obvious right away ( 1 request?) where the bug may exist:
Check if the "language" parameter is passed in on the request
If the "Language" variable is not empty and if the "language" session value is different from what has been provided, check its value
The "validation" routine checks that the "Language" variable starts with "res\languages\" or "res/languages/" and then if the file actually exists in the system
If the user has provided a value that meets the above criteria, the session variable "language" is set to the user provided value
If the session variable "language" is set, include it into the page
Authenticate
So it is possible to include any file from the system as long as the provided path starts with "res/languages" and the file exists. To start off it looked like maybe the IIS log files could be a possible candidate to include, but they are not readable by the user everything is executing under…bummer. The next spot I started looking for was if there was any other session data that could be controlled to include PHP. Example session file at this point looks like this:
The "$error" value is server controlled, the "language" has to be a valid file on the system (cant stuff PHP in it), and "$DeviceSAKey" appears to be related to authentication. Next step I started searching through the code for spots where the "$_SESSION" is manipulated hoping to find some session variables that get set outside of logging in. I ran the following to get a better idea of places to start looking:
egrep -R '\$_SESSION\[.*\] =' ./
This pulled up a ton of results, including the following:
The first highlighted part sets a new session variable "user_agent" to whatever our browser is sending, good so far.... The next highlighted section checks our session for "DeviceSAKey" which is used to check that the requester is authenticated in the system, in this case we are not so this fails and we are redirected to the login page ("index.php"). Because the server stores our session value before checking authentication (whoops) we can use this to store our payload to be included :)
This will create a session file named "sess_payload" that we can include, the file contains the following:
Now, I'm sure if you are paying attention you'd say "wait, why don't you just use exec/passthru/system", well the application installs and configures IIS to use a "guest" account for executing everything – no execute permissions for system stuff (cmd.exe,etc) :(. It is possible to get around this and gain system execution, but I decided to first see what other options are available. Looking at the database, the administrator credentials are "encrypted", but I kept seeing a function being used in PHP when trying to figure out how they were "encrypted": mdm_DecryptData(). No password or anything is provided when calling the fuction, so it can be assumed it is magic:
return mdm_DecryptData($result[0]['Password']);
Ends up it is magic – so I sent the following PHP to be executed on the server -
$pass=mdm_ExecuteSQLQuery("SELECT Password FROM Administrators where AdministratorSAKey = 1",array(),false,-1,"","","",QUERY_TYPE_SELECT); echo $pass[0]["UserName"].":".mdm_DecryptData($pass[0]["Password"]);
Now that the password is available, you can log into the admin panel and do wonderful things like deploy policy to mobile devices (CA + proxy settings :)), wipe devices, pull text messages, etc….
This functionality has been wrapped up into a metasploit module that is available on github:
Next up is bypassing the fact we cannot use "exec/system/passthru/etc" to execute system commands. The issue is that all of these commands try and execute whatever is sent via the system "shell", in this case "cmd.exe" which we do not have rights to execute. Lucky for us PHP provides "proc_open", specifically the fact "proc_open" allows us to set the "bypass_shell" option. So knowing this we need to figure out how to get an executable on the server and where we can put it. The where part is easy, the PHP process user has to be able to write to the PHP "temp" directory to write session files, so that is obvious. There are plenty of ways to get a file on the server using PHP, but I chose to use "php://input" with the executable base64'd in the POST body:
This bit of PHP will read the HTTP post's body (php://input) , base64 decode its contents, and write it to a file in a location we have specified. This location is relative to where we are executing so it should work no matter what directory the product is installed to.
After we have uploaded the file we can then carry out another request to execute what has been uploaded:
The key here is the "bypass_shell" option that is passed to "proc_open". Since all files that are created by the process user in the PHP "temp" directory are created with "all of the things" permissions, we can point "proc_open" at the file we have uploaded and it will run :)
This process was then rolled up into a metasploit module which is available here:
An Android remote administration tool (RAT) is a programmed tool that allows a remote device to control a smartphone as if they have physical access to that system. While screen sharing and remote administration have many legal uses, "RAT" software is usually associated with the unauthorized or malicious activity. I have streamlined here top android hacking tools of 2018.
TOP ANDROID HACKING TOOLS OF 2018
Here are the most advanced in functionality top android hacking tools of 2018.
1. DROIDJACK
DroidJack gives you the power to establish control over your beloveds' Android devices with an easy to use GUI and all the features you need to monitor them. It has many advanced features that you can perform over the remote smartphone. DroidJack is one of the top lists as it also has the functionality to read/write WhatsApp messages.
You can also follow a step by step tutorial on how to hack smartphone remotely using droidjack.
2. OMNIRAT
OmniRAT is the super powerful multi-OS remote administration tool that can a smartphone either using a smartphone or using a Windows or Mac PC. It has a huge list of features that make it very powerful. It can make calls through that smartphone remotely. It's completely fully undetectable.
3. ANDRORAT
AndroRat is a client/server application developed in Java Android for the client side and in Java/Swing for the Server. The name AndroRat is a mix of Android and RAT (Remote Access Tool). It was developed as a project by the university students, which works great for hacking into Android devices.
You can also follow a step by step tutorial on how to hacking a smartphone remotely using androrat.
4. SPYNOTE
SpyNote is a lightweight Android remote administration tool (RAT) to hack into a smartphone device remotely. It gives you the power to establish control over Android devices with an easy to use GUI and all the features you need to monitor them. Build a custom APK or bind the payload to an already existing APK such as a game or social media app.
You can also follow a step by step tutorial on how to hack any android phone remotely with spynote.
5. AHMYTH
AhMyth is a powerful android remote administrator tool that gives you the power to establish control over your beloveds' android devices with an easy to use GUI and all the features you need to monitor them.
These are all the top android hacking tools of 2018. There are also many other rats but these are the most advanced in tech and features. There may appear few more that can compete these and make a place to be in the top android list.
Most of the people don't go with videos and read books for learning. Book reading is a really effective way to learn and understand how things work. There are plenty of books about computers, security, penetration testing and hacking. Every book shows a different angle how things work and how to make system secure and how it can be penetrated by hackers. So, here I have gathered a few of the best hacking books of 2018 available on the market.
BEST HACKING BOOKS OF 2018
There are hundreds of books about hacking, but I have streamlined few of best hacking books of 2018.
1. THE HACKER'S PLAYBOOK PRACTICAL GUIDE TO PENETRATION
This handbook is about experting yourself with the hacking techniques in the hacker's way. This is about penetration testing that how hackers play their techniques and how we can counter them.
CONTENTS
Introduction
Pregame – The Setup
Setting Up a Penetration Testing Box
Before the Snap – Scanning the Network
The Drive – Exploiting Scanner Findings
The Throw – Manual Web Application Findings
The Lateral Pass – Moving Through the Network
The Screen – Social Engineering
The Onside Kick – Attacks that Require Physical Access
The Quarterback Sneak – Evading AV
Special Teams – Cracking, Exploits, Tricks
Post Game Analysis – Reporting
Download the Hacker's Playbook Practical Guide to Penetration.
2. ANDROID HACKER'S HANDBOOK
The Android Hacker's Handbook is about how the android devices can be hacked. Authors chose to write this book because the field of mobile security research is so "sparsely charted" with disparate and conflicted information (in the form of resources and techniques).
CONTENTS
Chapter 1 Looking at the Ecosystem
Chapter 2 Android Security Design and Architecture
Chapter 3 Rooting Your Device
Chapter 4 Reviewing Application Security
Chapter 5 Understanding Android's Attack Surface
Chapter 6 Finding Vulnerabilities with Fuzz Testing
Chapter 7 Debugging and Analyzing Vulnerabilities
Chapter 8 Exploiting User Space Software
Chapter 9 Return Oriented Programming
Chapter 10 Hacking and Attacking the Kernel
Chapter 11 Attacking the Radio Interface Layer
Chapter 12 Exploit Mitigations
Chapter 13 Hardware Attacks
Download Android Hacker's Handbook.
3. PENETRATION TESTING: A HANDS-ON INTRODUCTION TO HACKING
This book is an effective practical guide to penetration testing tools and techniques. How to penetrate and hack into systems. This book covers beginner level to highly advanced penetration and hacking techniques.
CONTENTS
Chapter 1: Setting Up Your Virtual Lab
Chapter 2: Using Kali Linux
Chapter 3: Programming
Chapter 4: Using the Metasploit Framework
Chapter 5: Information Gathering
Chapter 6: Finding Vulnerabilities
Chapter 7: Capturing Traffic
Chapter 8: Exploitation
Chapter 9: Password Attacks
Chapter 10: Client-Side Exploitation
Chapter 11: Social Engineering
Chapter 12: Bypassing Antivirus Applications
Chapter 13: Post Exploitation
Chapter 14: Web Application Testing
Chapter 15: Wireless Attacks
Chapter 16: A Stack-Based Buffer Overflow in Linux
Chapter 17: A Stack-Based Buffer Overflow in Windows
Chapter 19: Fuzzing, Porting Exploits, and Metasploit Modules
Chapter 20: Using the Smartphone Pentesting Framework
Download Penetration Testing: A Hands-On Introduction To Hacking.
4. THE SHELLCODER'S HANDBOOK
This book is about learning shellcode's of the OS and how OS can be exploited. This book is all about discovering and exploiting security holes in devices to take over.
Authors: Chris Anley, John Heasman, Felix "FX" Linder, Gerardo Richarte.
CONTENTS
Stack Overflows
Shellcode
Introduction to Format String Bugs
Windows Shellcode
Windows Overflows
Overcoming Filters
Introduction to Solaris Exploitation
OS X Shellcode
Cisco IOS Exploitation
Protection Mechanisms
Establishing a Working Environment
Fault Injection
The Art of Fuzzing
Beyond Recognition: A Real Vulnerability versus a Bug
Instrumented Investigation: A Manual Approach
Tracing for Vulnerabilities
Binary Auditing: Hacking Closed Source Software
Alternative Payload Strategies
Writing Exploits that Work in the Wild
Attacking Database Software
Unix Kernel Overflows
Exploiting Unix Kernel Vulnerabilities
Hacking the Windows Kernel
Download The ShellCoder's HandBook.
5. THE HACKER'S HANDBOOK WEB APPLICATION SECURITY FLAWS
This handbook is about finding and exploiting the web applications.
Authors: Dafydd Stuttard, Marcus Pinto.
CONTENTS
Chapter 1 Web Application (In)security
Chapter 2 Core Defense Mechanisms
Chapter 3 Web Application Technologies
Chapter 4 Mapping the Application
Chapter 5 Bypassing Client-Side Controls
Chapter 6 Attacking Authentication
Chapter 7 Attacking Session Management
Chapter 8 Attacking Access Controls
Chapter 9 Attacking Data Stores
Chapter 10 Attacking Back-End Components
Chapter 11 Attacking Application Logic
Chapter 12 Attacking Users: Cross-Site Scripting
Chapter 13 Attacking Users: Other Techniques
Chapter 14 Automating Customized Attacks
Chapter 15 Exploiting Information Disclosure
Chapter 16 Attacking Native Compiled Applications
Chapter 17 Attacking Application Architecture
Chapter 18 Attacking the Application Server
Chapter 19 Finding Vulnerabilities in Source Code
Chapter 20 A Web Application Hacker's Toolkit
Chapter 21 A Web Application Hacker's Methodology
Download The Hacker's Handbook Web Application Security Flaws.
So, these are the top 5 best hacking books on the market. There may be more fascinating books in the future that make take place in the top list. But for now, these are the best hacking books. Read and share your experience with these books.
(gdb) r 1234567890123456 tarting program: /home/sha0/ncn/inbincible 1234567890123456 ... Yeah!
Ok, but the problem is not in main.main, is main.function.001 who must sent the 0x01 via channel.
This function xors byte by byte the input "1234567890123456" with a byte array xor key, and is compared with another byte array.
=> 0x8049456: xor %ebp,%ecx
This xor, encode the argument with a key byte by byte
The xor key can be dumped from memory but I prefer to use this macro:
(gdb) b *0x8049456 (gdb) commands >i r ecx >c >end (gdb) c Breakpoint 2, 0x08049456 in main.func () ecx 0x1218 Breakpoint 2, 0x08049456 in main.func () ecx 0x4569 Breakpoint 2, 0x08049456 in main.func () ecx 0x3351 Breakpoint 2, 0x08049456 in main.func () ecx 0x87135 Breakpoint 2, 0x08049456 in main.func () ecx 0x65101 Breakpoint 2, 0x08049456 in main.func () ecx 0x1218 Breakpoint 2, 0x08049456 in main.func () ecx 0x4569 Breakpoint 2, 0x08049456 in main.func () ecx 0x3351 Breakpoint 2, 0x08049456 in main.func () ecx 0x87135 Breakpoint 2, 0x08049456 in main.func () ecx 0x65101 Breakpoint 2, 0x08049456 in main.func () ecx 0x1218 Breakpoint 2, 0x08049456 in main.func () ecx 0x4569 Breakpoint 2, 0x08049456 in main.func () ecx 0x3351 Breakpoint 2, 0x08049456 in main.func () ecx 0x87135 Breakpoint 2, 0x08049456 in main.func () ecx 0x65101 Breakpoint 2, 0x08049456 in main.func () ecx 0x1218
The result of the xor will compared with another array byte, each byte matched, a 0x01 will be sent.
The cmp of the xored argument byte, will determine if the channel send 0 or 1
(gdb) b *0x0804946a (gdb) commands >i r al >c >end
At this point we have the byte array used to xor the argument, and the byte array to be compared with, if we provide an input that xored with the first byte array gets the second byte array, the code will send 0x01 by the channel the 16 times.
.jpg)
" Ophcrack is an open source (GPL license) program that cracks Windows LM hashes using rainbow tables. The program includes the ability to import the hashes from a variety of formats, including dumping directly from the SAM files of Windows. There is also a Live CD version which automates the retrieval, decryption, and cracking of passwords from a Windows system. Rainbow tables for LM hashes of alphanumeric passwords are provided for free by the developers. These tables can crack 99.9% of alphanumeric passwords of up to 14 characters in usually a few seconds, and at most a few minutes. Larger rainbow tables (for LM hashes of passwords with all printable characters, including symbols and space) are available for purchase from Objectif Securité. Starting with version 2.3, Ophcrack also cracks NT hashes. This is necessary if generation of the LM hash is disabled (this is default on Windows Vista), or if the password is longer than 14 characters (in which case the LM hash is not stored)." read more...
