Archive

Archive for the ‘Pentest Scripts’ Category

CVE-2013-6117 – Tool (Multithreaded and Extremely Fast)

July 23, 2018 Leave a comment

I wrote a simple script in Go to test if the target Dahua DVR device is vulnerable to authentication bypass flaw (CVE-2013-6117).

Dahua DVRs listen on TCP port 37777 by default.

If it is vulnerable, it will dump the credentials along with the dynamic dns name (DynDNS).

Some system administrators might use the same password for other systems. Therefore, a penetration tester might be able to use the credentials obtained from the DVR to gain further access into the network by accessing other systems or applications.

As the script is written in Go, it makes the tool extremely fast.

For more information regarding this vulnerability, you might want to check out https://depthsecurity.com/blog/dahua-dvr-authentication-bypass-cve-2013-6117.

Screen Shot 2018-07-24 at 2.06.12 AM.png
The script can be downloaded from https://github.com/milo2012/CVE-2013-6117.

 

Advertisements

Jumping from Corporate to Compromising Semi-Isolated Network

September 21, 2017 1 comment

Finding and attacking hosts in Semi-Isolated networks
The new script ‘hopandhack‘ can be used by attackers to automatically find and hunt down hosts that are not directly accessible from the attacker’s machine.  In some organizations, IT administrators have to use something called a ‘jump box’ or VPN to access the secure data centre or PCI network where sensitive data are stored .

The ‘hopandhack’ script automates the process of finding hosts with the necessary routes to these secure network and compromises them.  The functionality of hopandhack will be incorporated into Portia in the next week or so.

hopandhack script can be found at https://github.com/SpiderLabs/portia under the filename ‘hopandhack.py’.

Basic Workflow of how the attack works.

Below is a video demo as presented at Rootcon (2017).  In the video, the attacker is able to access one host (host A) but not the other host (host B) thats in the secure network.

Host A has an active route to host B.  In order to compromise host B, the attacker has to setup a relay from host A to host B and then use this relay to dump credentials/hashes from host B.

More functionalities will be added in future.

The tool is currently available as a standalone tool and its functionalities will be ported over to Portia in the following week.
https://github.com/SpiderLabs/portia/blob/master/hopandhack.py

The slides from Rootcon 2017 is available at https://www.slideshare.net/secret/tkQFhYeFY3zEi4

metasploitHelper and nmap2nessus released at Blackhat Asia Arsenal 2015

March 30, 2015 Leave a comment

@mgianarakis and me (@keith55) presented two new tools (metasploitHelper and nmap2nessus) at Blackhat Asia Arsenal in Singapore on 26th and 27th of March, 2015.

The tools were developed to help guys like us during vulnerability assessments and penetration tests.

Blog posts about the tools will be coming soon. Meanwhile, the information on the Github pages should be sufficient to get you started.
The tools are open source.  Feel free to contribute to the projects. Thank you

MetasploitHelper
Slides: http://bit.ly/1D62PWB
GitHub: https://github.com/milo2012/nmap2nessus

Nmap2nessus
Slides: http://bit.ly/1GxaYTA
GitHub: https://github.com/milo2012/metasploitHelper

Pentesting Firebird Databases

January 9, 2015 Leave a comment

There seems to be limited information on pentesting Firebird databases on the Internet.
Firebird database server listens on TCP port 3050.

One good resource I found is http://blog.opensecurityresearch.com/2012/07/fun-with-firebird-database-default.html.

It seems like most people do not change the default SYSDBA credentials for their Firebird database. Below are the default credentials. 
Username:
SYSDBA
Password: masterkey

I have encountered before that the access card database system was using Firebird database for its backend.
This python script requires pyfirebirdsql library from https://github.com/nakagami/pyfirebirdsql.

Firebird requires you to supply the database name on the server you are trying to.
One way to get around it is to check for active connections on the Firebird database server.

What this tools does is to
1. Connect to the Firebird database server using the default credentials
2. List the connected databases
3. Dump the records from the Firebird database server

You can also use the -wordlist argument to supply it a wordlist of database names so that it can attempt to brute-force. That is useful if there aren’t any active connections (or databases not mounted) on the Firebird database that you are trying to access.

Below is a screenshot of the tool in action.
firebirdBrute.py

The common-tables.txt file from sqlmap is useful if you need a wordlist.
https://raw.githubusercontent.com/sqlmapproject/sqlmap/master/txt/common-tables.txt

The tool can be downloaded from the below Github repo.
https://github.com/milo2012/firebirdDump

Proxy Tester Script

January 8, 2015 Leave a comment

I wrote a script to tests and sorts proxy servers (socks4, socks5, http, https).
There are readily available scripts out there on the Internet that does the same. I just want to write my own.

Sometimes, during a web application test, your IP address might get flagged and blocked by the target’s WAF.
Proxy servers might just be useful in this type of situation. However, regard all proxy servers as malicious and unsafe. You do not want to send sensitive data like credentials over the proxy servers.

If you are doing anything malicious, do not access the proxy servers directly as the ISP might be able to pinpoint the end point of the attack easily.

Below is a screenshot of the help menu for the proxyTester.py script.

proxyTester.py
By default, the script tests the proxy servers to see if it supports SSL connections.

Below is an example of the command to run

python proxyTester.py -i proxies.txt -o profile1 -n 100  -time -t https -sort

The script accepts a text file containing proxy servers in the below format
190.207.5.201:9064

The input file can contain a mixture of Socks4, Socks5, HTTPs, HTTP proxies.

In the below example, the script reads the list of proxies from the file using the -in argument, tests and sorts the proxies using 80 concurrent threads into categories (Socks4, Socks5, HTTPs) and outputs a Proxifier profile PPX file (which you can import into Proxifier if you are using this).

ProxyTester.py

You can use the -time argument in the script to test the latency of the connection.
It might be useful as you might want to avoid using a proxy that has a high latency.
Your computer -> Proxy server -> Website

proxyTester.py

You can download the script from the below Github repo.
https://github.com/milo2012/proxy_tester

Categories: Pentest Scripts

Test AS/400 for default credentials

December 7, 2014 Leave a comment

I wrote a simple script to test default credentials in AS/400. I made use of the library and sample code from http://tn5250py.cvs.sourceforge.net/.  It currently only works with IBM AS/400 telnet servers for now.

You can pull the code from https://github.com/milo2012/pentest_scripts/tree/master/as400.
You will have to supply the ip and port of the AS400 server in the command line

Help screen for AS/400 tool

Below is a screenshot of the tool in action.

Test AS/400 Default Credentials

Corelabs Impacket Scripts (Modded)

September 9, 2014 Leave a comment

I made some changes to wmiexec.py script due to some anonyances I encountered during peneration tests.

The use case scenario for these modded scripts is that if the password contains special characters like @ or : and you can’t use it with the default wmiexec.py/psexec.py/smbexec.py scripts (maybe its just me who can’t figure out how to know how to use them :P)

These 3 scripts (wmiexec.py/psexec.py/smbexec.py) are the common tools that you can use if you want to get the remote host to execute a meterpreter exe file generated via Veil-Evasion.

Using the modded scripts, you can get a list of hosts to run a single command (eg ipconfig) using one line of command.

The source code for the modded scriptscan be found here
https://github.com/milo2012/pentest_scripts/tree/master/impacket.

Special thanks for Corelabs for making these scripts. Impacket scripts can be found here https://code.google.com/p/impacket/.

Screenshot of psexec.py

Examples of how you can use the modded psexec.py
python wmiexec.py -d testdomain -u user -p pass -ip 192.168.2.1 -command ipconfig
python wmiexec.py -d testdomain -u user -p pass -ip 192.168.2.1 -f ips.txt -command ipconfig

psexec

Screenshot of smbexec.py

Examples of how you can use the modded smbexec.py
python smbexec.py -d testdomain -u user -p pass -ip 192.168.2.1
python smbexec.py -d testdomain -u user -p pass -f ips.txt

smbexec

Screenshot of wmiexec.py
Examples of how you can use the modded wmiexec.py
python psexec.py -d testdomain -u user -p pass -ip 192.168.2.1 -command ipconfig
python psexec.py -d testdomain -u user -p pass -f ips.txt -command ipconfig

wmiexec