Metasploit Shellcode Generator / Compiler / Listenner - Venom

The script will use msfvenom (metasploit) to generate shellcode in diferent formats ( c | python | ruby | dll | msi | hta-psh ), injects the shellcode generated into one funtion (example: python) "the python funtion will execute the shellcode in ram" and uses compilers like: gcc (gnu cross compiler) or mingw32 or pyinstaller to build the executable file, also starts a multi-handler to recibe the remote connection (reverse shell or meterpreter session).

'shellcode generator' tool reproduces some of the technics used by Veil-Evasion framework, unicorn.py, powersploit, etc,etc,etc.."P.S. some payloads are undetectable by AV soluctions yes!!!" one of the reazons for that its the use of a funtion to execute the 2º stage of shell/meterpreter directly into targets ram.

option	build	target	format	output
1	shellcode	unix	C	C
2	shellcode	windows	C	DLL
3	shellcode	windows	DLL	DLL
4	shellcode	windows	C	PYTHON/EXE
5	shellcode	windows	C	EXE
6	shellcode	windows	MSIEXEC	MSI
7	shellcode	windows	C	RUBY
8	shellcode	windows	POWERSHELL	BAT
9	shellcode	windows	HTA-PSH	HTA
10	shellcode	windows	PSH-CMD	PS1
11	shellcode	windows	PSH-CMD	BAT
12	shellcode	webserver	PHP	PHP
13	shellcode	multi OS	PYTHON(base64)	PYTHON

Download Venom

Read More

Practical Managed Code Rootkits for Java- JReFrameworker

This project aims to extend the work done by Erez Metula in his book Managed Code Rootkits: Hooking into Runtime Environments. The work outlines a tool ReFrameworker that claims to be a framework modification tool capable of performing any modification task, however the tool falls short in usability. Developing new attack modules is difficult as most users are not familiar with working in the intermediate representations (IR) required by the tool. Worse yet, the "write once, run anywhere" motto of managed languages is violated when dealing with runtime libraries, forcing the attacker to write new exploits for each target platform. The current version of ReFrameworker (version 1.1) does not have the ability to manipulate Java bytecode, although Erez Metula points out that the same techniques of using IRs such as Soot's Jimple or the Jasmin assembler can be used to create Java MCRs.

JReFrameworker

Since ReFrameworker is no longer maintained, this project aims to extend previous works by introducing JReFrameworker, a tool to produce MCR capabilities aimed at the Java Runtime Environment in a user-friendly way.

JReFrameworker is a tool that allows a user to write annotated Java source that is automatically merged or inserted into the runtime. The framework supports developing and debugging attack modules directly in the Eclipse IDE. Working at the intended abstraction level of source code allows the attacker to "write once, exploit anywhere".

Getting Started

Ready to get started?

1. First install the JReFrameworker plugin.
2. Then check out the provided tutorials to get started hacking your first attack module.

Changelog

1.1.1

• Improved payload dropper with new command line options for specifying non-standard runtime locations and for specifying output options

1.1.0

• Support for exporting a basic based payload dropper

1.0.2

• Improvements to preferences
• Bug fixes for builder

1.0.1

• Bug fix for missing annotations Jar in new projects

1.0.0

• Initial Release

Download JReFrameworker

Read More

An Interactive Process Viewer for Unix - htop 2.0

htop is an interactive system-monitor process-viewer. It is designed as an alternative to the Unix program top. It shows a frequently updated list of the processes running on a computer, normally ordered by the amount of CPU usage. Unlike top, htop provides a full list of processes running, instead of the top resource-consuming processes. Htop uses color and gives visual information about processor, swap and memory status.

Users often deploy htop in cases where Unix top does not provide enough information about the system's processes. htop is also popularly used interactively as a system monitor. Compared to top, it provides a more convenient, cursor-controlled interface for sending signals to processes.

htop is written in the C programming language using the ncurses library. Its name is derived from the original author's first name, as a nod to pinfo, an info-replacement program that does the same.

Because system monitoring interfaces are not standardized among Unix-like operating systems, much of htop's code must be rewritten for each operating system.

What's new in htop 2.0

Since version 2.0, htop is now cross-platform!

This release includes code supporting Linux, FreeBSD, OpenBSD and Mac OS X.

There are also, of course, some new features:

• If you're using NCurses 6, htop will also support your mouse wheel for scrolling.
• Moving meters and columns around in the setup screen is a lot more comfortable now.
• You can now press "e" to see the set of environment variables for a process.
• The "graph" mode for meters was revamped, inspired by James Hall's vtop.

Download htop 2.0

Read More

Debian/Ubuntu Backdoor Using A Reverse SSH Tunnel - SideDoor

sidedoor maintains a reverse tunnel to provide a backdoor. sidedoor can be used to remotely control a device behind a NAT.

sidedoor is packaged for Debian-based systems with systemd or upstart. It has been used on Debian 8 (jessie) and Ubuntu 14.04 LTS (trusty).

The sidedoor user has full root access configured in /etc/sudoers.d.

Installation

If sidedoor is in your package repositories, simply install it, e.g., sudo apt-get install sidedoor .

Otherwise, you will need to build a Debian package and install it. First, install build dependencies.

sudo apt-get install debhelper dh-systemd  

Then, from the directory containing this README file, build and install a package.

rm -f ../sidedoor*.deb # remove old package build
dpkg-buildpackage -us -uc -b
sudo dpkg -i ../sidedoor*.deb

Configuration

The remote server and tunnel port are configured in /etc/default/sidedoor . SSH configuration files are located in the /etc/sidedoor directory. ~sidedoor/.ssh is a symlink to /etc/sidedoor .

• Configure REMOTE_SERVER and TUNNEL_PORT in /etc/default/sidedoor .
• Create SSH configuration files under /etc/sidedoor .
  • authorized_keys : SSH public key(s) to control access to the local sidedoor user.
  • id_rsa : SSH private key to access the remote server. Can be generated with sudo ssh-keygen -t rsa -f /etc/sidedoor/id_rsa (press enter when prompted for passphrase to leave empty). Needs read permission by the sidedoor user or group, e.g., sudo chown root:sidedoor /etc/sidedoor/id_rsa and sudo chmod 640 /etc/sidedoor/id_rsa . The corresponding public key id_rsa.pub will need to be included in the remote user's ~/.ssh/authorized_keys file.
  • known_hosts : SSH host key of the remote server.
  • config (optional): Additional SSH config, see man ssh_config .

Restart the sidedoor service to apply changes.

sudo service sidedoor restart  

Recommendations

• Lock down the local SSH server by editing /etc/ssh/sshd_config .
  • Disable password authentication ( ChallengeResponseAuthentication no and PasswordAuthentication no ).
  • Limit daemon to only listen on localhost. ( ListenAddress ::1 and ListenAddress 127.0.0.1 ).
  • To apply changes, restart or reload sshd, e.g., sudo service ssh reload .
• Modify the ssh_client_config_example file and include it in a client's ~/.ssh/config file to easily access the tunneled backdoor with ssh , scp , rsync , etc.

Download Sidedoor

Read More

Network Forensic Analysis Tool (NFAT) - NetworkMiner 2.0

NetworkMiner is a Network Forensic Analysis Tool (NFAT) for Windows (but also works in Linux / Mac OS X / FreeBSD). NetworkMiner can be used as a passive network sniffer/packet capturing tool in order to detect operating systems, sessions, hostnames, open ports etc. without putting any traffic on the network. NetworkMiner can also parse PCAP files for off-line analysis and to regenerate/reassemble transmitted files and certificates from PCAP files.

NetworkMiner collects data (such as forensic evidence) about hosts on the network rather than to collect data regarding the traffic on the network. The main user interface view is host centric (information grouped per host) rather than packet centric (information showed as a list of packets/frames).

NetworkMiner has, since the first release in 2007, become a popular tool among incident response teams as well as law enforcement. NetworkMiner is today used by companies and organizations all over the world.     

NetworkMiner can extract files and certificates transferred over the network by parsing a PCAP file or by sniffing traffic directly from the network. This functionality can be used to extract and save media files (such as audio or video files) which are streamed across a network from websites such as YouTube. Supported protocols for file extraction are FTP, TFTP, HTTP, SMB and SMTP.

User credentials (usernames and passwords) for supported protocols are extracted by NetworkMiner and displayed under the "Credentials" tab. The credentials tab sometimes also show information that can be used to identify a particular person, such as user accounts for popular online services like Gmail or Facebook.

 Another very useful feature is that the user can search sniffed or stored data for keywords. NetworkMiner allows the user to insert arbitrary string or byte-patterns that shall be searched for with the keyword search functionality.

NetworkMiner Professional comes installed on a specially designed USB flash drive. You can run NetworkMiner directly from the USB flash drive since NetworkMiner is a portable application that doesn't require any installation. We at Netresec do, however, recommend that you copy NetworkMiner to the local hard drive of your computer in order to achieve maximum performance.     

There are several longed-for features that are part of this major release, such as:

• SMB/CIFS parser now supports file extraction from SMB write operations.
• Added parser for SMB2 protocol (read and write).
• Additional IEC-104 commands implemented.
• Added Modbus/TCP parser (as requested by attendees at 4SICS 2014).
• Improved SMTP parser.
• Improved FTP parser.
• Improved DNS parser.
• GUI flickering is heavily reduced when loading PCAP files or doing live sniffing.
• Extraction of web server favicon images (shown in Hosts tab).
• Added "Keyword filter" to several tabs (see more details below).

Download NetworkMiner 2.0

Read More

Open-Source Phishing Toolkit - Gophish

Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.

One-Click Installation

Download and Extract the ZIP - Gophish binaries are provided for most platforms

Run the Binary Gophish is a standalone, portable binary with static assets.

That's It. - Gophish is now available on http://localhost:3333. Login with admin:gophish

Point-and-Click Phishing

Beautiful Web UI A full web UI makes creating simulated phishing campaigns easy.

Pixel-Perfect Phishing Create pixel-perfect emails and landing pages from scratch or by importing them directly into gophish.

Automate Phishing Campaigns

RESTful API - Gophish is built from the ground-up with a fully-featured JSON API.

Automated Training Use your favorite language or API utility to manage every aspect of your phishing training automatically.

Download Gophish

Read More

Black Box vBulletin Vulnerability Scanner - VBScan 0.1.4

VBScan is an opensource project in perl programming language to detect VBulletin CMS vulnerabilities and analyses them.

Why VBScan ?

If you want to do a penetration test on a vBulletin Forum, VBScan is Your best shot ever! This Project is being faster than ever and updated with the latest VBulletin vulnerabilities.

• Project Leader : Mohammad Reza Espargham
• Github : https://github.com/rezasp/vbscan/
• SourceForge : https://sourceforge.net/projects/vbscan/

usage :

./vbscan.pl <target>
./vbscan.pl http://target.com/vbulletin

VBScan 0.1.4 [Dennis Ritchie]

• Changed vulnerability scanner engine
• Changed default specified timeout to 180 seconds
• Added VBulletin 5.x RCE Exploit
• Added txt report output
• Fixed YUI 2.9.0 XSS false positive
• Fixed reported bugs

Download VBScan

Read More

Mac OSX Arp Spoof (MITM) Tool - Arpy

Arpy is an easy-to-use ARP spoofing MiTM tool for Mac. It provides 3 targeted functions:

• Packet Sniffing
• Visited Domains
• Visited Domains with Gource

Each function will be explained below.

Tested OS (to date)

• Darwin 14.3.0 Darwin Kernel Version 14.3.0 (Mac OS X)

Requirements

• Python 2.7
• Gource
• Scapy

Installation

Gource

brew install gource

Scapy

pip install scapy

Sample Commands

ivanvza:~/ > sudo arpy
     _____
    |  _  |___ ___ _ _
    |     |  _| . | | |
    |__|__|_| |  _|_  |
    MiTM Tool |_| |___|
    v3.15 -@viljoenivan

Usage: arpy -t <Target IP> -g <Gateway IP> -i <Interface>

ARP MiTM Tool

Options:
  -h, --help            show this help message and exit
  -t TARGET, --target=TARGET
                        The Target IP
  -g GATEWAY, --gateway=GATEWAY
                        The Gateway
  -i INTERFACE, --interface=INTERFACE
                        Interface to use
  --tcp                 Filters out only tcp traffic
  --udp                 Filters out only udp traffic
  -d D_PORT, --destination_port=D_PORT
                        Filter for a destination port
  -s S_PORT, --source_port=S_PORT
                        Filter for a source port
  --sniff               Sniff all passing data
  --sniff-dns           Sniff only searched domains
  --sniff-dns-gource    Output target's DNS searches in gource format
  -v                    Verbose scapy packet print

Packet Sniff

This is the packet sniffer, it allows you to see your target's traffic.

ivanvza:~/ > sudo arpy -t 192.168.1.3 -g 192.161.1.1 -i en0 --sniff
     _____
    |  _  |___ ___ _ _
    |     |  _| . | | |
    |__|__|_| |  _|_  |
    MiTM Tool |_| |___|
    v3.15 -@viljoenivan


  [Info] Starting Sniffer...

[Info] Enabling IP Forwarding...
[Info] Filter: ((src host 192.168.1.3 or dst host 192.168.1.3))

[Info] Found the following (IP layer): 192.168.1.3 -> 46.101.34.90
GET / HTTP/1.1
User-Agent: curl/7.37.1
Host: ivanvza.ninja
Accept: */*



[Info] Found the following (IP layer): 46.101.34.90 -> 192.168.1.3
HTTP/1.1 200 OK
Vary: Accept-Encoding
Content-Type: text/html
Accept-Ranges: bytes
ETag: "2719538271"
Last-Modified: Thu, 30 Apr 2015 08:25:15 GMT
Content-Length: 3213
Date: Fri, 29 May 2015 20:15:06 GMT
Server: Microsoft IIS

<html>
     <title>><></title>
    <body>
        <pre style="line-height: 1.25; white-space: pre;">
        \          SORRY            /
         \                         /
          \    This page does     /
           ]   not exist yet.    [    ,'|
           ]                     [   /  |
           ]___               ___[ ,'   |
           ]  ]\             /[  [ |:   |
           ]  ] \           / [  [ |:   |
           ]  ]  ]         [  [  [ |:   |
           ]  ]  ]__     __[  [  [ |:   |
           ]  ]  ] ]\ _ /[ [  [  [ |:   |
           ]  ]  ] ] (#) [ [  [  [ :===='
           ]  ]  ]_].nHn.[_[  [  [
           ]  ]  ]  HHHHH. [  [  [
           ]  ] /   `HH("N  \ [  [
           ]__]/     HHH  "  \[__[
           ]         NNN         [
           ]         N/"         [
           ]         N H         [
          /          N            \
         /           q,            \
        /                           \
        </pre>
        <h3 id="list"><h3>
    </body>
<script>

// NOTE: window.RTCPeerConnection is "not a constructor" in FF22/23
var RTCPeerConnection = /*window.RTCPeerConnection ||

DNS Sniff

This function allows you to see domain names that your target is currently requesting.

ivanvza:~/ > sudo arpy -t 192.168.1.4 -g 192.168.1.1 -i en0 --sniff-dns
     _____
    |  _  |___ ___ _ _
    |     |  _| . | | |
    |__|__|_| |  _|_  |
    MiTM Tool |_| |___|
         - @viljoenivan


  [Info] Starting DNS Sniffer...

[Info] Enabling IP Forwarding...
[Info] Done...
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: www.youtube.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: s2.googleusercontent.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: google.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: s.ytimg.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: fonts.gstatic.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: yt3.ggpht.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: i.ytimg.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: safebrowsing.google.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: safebrowsing-cache.google.com.
Target: 192.168.1.4 -> (192.168.1.1/DNS server) has searched for: safebrowsing-cache.google.com.

DNS Sniff With Gource

This function is more or less the same as the above, however it provides the functionality to pass it through Gource to get a live feed of what your target is viewing.

ivanvza:~/ > sudo arpy -t 192.168.1.3 -g 192.161.1.1 -i en0 --sniff-dns-gource
[INFO] For a live gource feed run this command in parallel with this one:

tail -f /tmp/36847parsed_nmap | tee /dev/stderr | gource -log-format custom -a 1 --file-idle-time 0 -

[Info] Filter: ((src host 192.168.1.3 or dst host 192.168.1.3) and dst port 53)

Download Arpy

Read More

A Virtual Machine For Assessing Android applications, Reverse Engineering and Malware Analysis - AndroL4b

AndroL4b is an android security virtual machine based on ubuntu Mate includes the collection of latest framework, tutorials and labs from different security geeks and researcher for reverse engineering and malware analysis.

Tools

• APKStudio Cross-platform Qt5 based IDE for reverse-engineering android applications
• ByteCodeViewer Android APK Reverse Engineering Suite (Decompiler, Editor, Debugger)
• Lobotomy Android Reverse Engineering Framework & Toolkit (Static and Dynamic Analysis)
• Mobile Security Framework (MobSF)(Android/iOS) Automated Pentesting Framework (Just Static Analysis in this VM)
• DroidBoxDynamic Analysis of Android Applications
• Dorzer Security Assessment Framework for Android Applications
• APKtool Reverse Engineering Android Apks
• AndroidStudio IDE For Android Application Development
• ClassyShark Android executable browser
• BurpSuite Assessing Application Security
• Wireshark Network Protocol Analyzer
• Smartphone Pentest Framework (SPF)
• Metasploit

Download AndroL4b

Read More