Quantcast
Channel: HACK4NET 🤖 Pentest Tools and News
Viewing all 541 articles
Browse latest View live

Shadow Brokers leak trove of NSA hacking tools

$
0
0

The tools were dumped via the Shadow Brokers Twitter account and were accompanied by a blog post, as the group did in the past.
Called "Lost in Translation," the blog post contains the usual indecipherable ramblings the Shadow Brokers have published in the past, and a link to a Yandex Disk file storage repo.
Shadow Brokers dump
The password for these files is "Reeeeeeeeeeeeeee", and they've already been unzipped and hosted on GitHub by security researchers.

Exploits

  • EARLYSHOVEL RedHat 7.0 - 7.1 Sendmail 8.11.x exploit
  • EBBISLAND (EBBSHAVE) root RCE via RPC XDR overflow in Solaris 6, 7, 8, 9 & 10 (possibly newer) both SPARC and x86.
  • ECHOWRECKER remote Samba 3.0.x Linux exploit.
  • EASYBEE appears to be an MDaemon email server vulnerability
  • EASYPI is an IBM Lotus Notes exploit that gets detected as Stuxnet
  • EWOKFRENZY is an exploit for IBM Lotus Domino 6.5.4 & 7.0.2
  • EXPLODINGCAN is an IIS 6.0 exploit that creates a remote backdoor
  • ETERNALROMANCE is a SMB1 exploit over TCP port 445 which targets XP, 2003, Vista, 7, Windows 8, 2008, 2008 R2, and gives SYSTEM privileges (MS17-010)
  • EDUCATEDSCHOLAR is a SMB exploit (MS09-050)
  • EMERALDTHREAD is a SMB exploit for Windows XP and Server 2003 (MS10-061)
  • EMPHASISMINE is a remote IMAP exploit for IBM Lotus Domino 6.6.4 to 8.5.2
  • ENGLISHMANSDENTIST sets Outlook Exchange WebAccess rules to trigger executable code on the client's side to send an email to other users
  • EPICHERO 0-day exploit (RCE) for Avaya Call Server
  • ERRATICGOPHER is a SMBv1 exploit targeting Windows XP and Server 2003
  • ETERNALSYNERGY is a SMBv3 remote code execution flaw for Windows 8 and Server 2012 SP0 (MS17-010)
  • ETERNALBLUE is a SMBv2 exploit for Windows 7 SP1 (MS17-010)
  • ETERNALCHAMPION is a SMBv1 exploit
  • ESKIMOROLL is a Kerberos exploit targeting 2000, 2003, 2008 and 2008 R2 domain controllers
  • ESTEEMAUDIT is an RDP exploit and backdoor for Windows Server 2003
  • ECLIPSEDWING is an RCE exploit for the Server service in Windows Server 2008 and later (MS08-067)
  • ETRE is an exploit for IMail 8.10 to 8.22
  • FUZZBUNCH is an exploit framework, similar to MetaSploit
  • ODDJOB is an implant builder and C&C server that can deliver exploits for Windows 2000 and later, also not detected by any AV vendors

Utilities

  • PASSFREELY utility which "Bypasses authentication for Oracle servers"
  • SMBTOUCH check if the target is vulnerable to samba exploits like ETERNALSYNERGY, ETERNALBLUE, ETERNALROMANCE
  • ERRATICGOPHERTOUCH Check if the target is running some RPC
  • IISTOUCH check if the running IIS version is vulnerable
  • RPCOUTCH get info about windows via RPC
  • DOPU used to connect to machines exploited by ETERNALCHAMPIONS

Cam4 Brute Force - python based tool

$
0
0

Step 1: Get fresh proxylist using proxi.py

Step2: Make a combolist with accounts that you want (user:pass)

Step3: Run bru.py


Screenshot:



ShodanHat - Search For Hosts Info With Shodan

$
0
0

Search For Hosts Info With Shodan.

Dependencies
You need to install shodan with pip install shodan or easy_install shodan.
You need to install python-nmap with pip install python-nmap.
You need to set your API Key in the 'constantes.py' file.



Options
-h, --help show this help message and exit
-i IP, --ip=IP info about one host
-l LIST, --list=LIST info about a list of hosts
-s SQ, --sq=SQ searchquery string
--nmap perform a nmap scan in the hosts
--setkey=SETKEY set your api key automatically
NMap Options:
--sS TCP Syn Scan
--sT TCP Connect Scan
--sU UDP Scan

Usage
For One Host
python shodanhat.py -i IP
For a list of Hosts
python shodanhat.py -l list.txt
You can also set a searchquery to make a specific query with '-s' option!





Wifiphiser v1.3 – Fast automated phishing attack against WPA networks.

$
0
0

Wifiphisher is a security tool that mounts fast automated phishing attacks against WPA networks in order to obtain the secret passphrase. It is a social engineering attack that unlike other methods it does not include any brute forcing. It is an easy way for obtaining WPA credentials.

Changelog wifipihser v1.3 15/4/2017:

o Introduced –quitonsuccess (-qS) option. [@javaes]
o Introduced Travis CI. [@d33tah]
o Install pylint in Travis. [@blackHatMonkey]
o Web server migration to Tornado. Fixes various bugs and increases performance. [@sophron]
o Remove DNS leases after the script restarts. [@laozi999]
o Introduced –internetinterface (-iI) option to provide Internet connectivity to victims. [@sophron]
o Added support for iOS and Android to our network manager imitation template. [@alexsalvetti]
o Introduced a new deauthentication module. [@blackHatMonkey]
o Introduced a new recon module, including new features in target AP selection phase. [@blackHatMonkey]
o Code refactoring including a more modular design. [@sophron]
o Introduced accesspoint module serving as a hostapd wrapper. [@sophron]
o Introducing Lure10, an attack for automatic association against Windows devices. [@sophron]

Requirements :
– Kali Linux.
– Two network interfaces, one wireless.
– A wireless card capable of injection.

git clonehttps://github.com/sophron/wifiphisher
cd wifiphisher
python wifiphisher.py-h(forhelper)
 
update:
cd wifiphisher
git pull


DAMM – Differential Analysis of Malware in Memory.

$
0
0
DAMM is An open source memory analysis tool built on top of Volatility. It is meant as a proving ground for interesting new techniques to be made available to the community. These techniques are an attempt to speed up the investigation process through data reduction and codifying some expert knowledge.


Features:
* ~30 Volatility plugins combined into ~20 DAMM plugins (e.g., pslist, psxview and other elements are combined into a ‘processes’ plugin)
* Can run multiple plugins in one invocation
* The option to store plugin results in SQLite databases for preservation or for “cached” analysis
* A filtering/type system that allows easily filtering on attributes like pids to see all information related to some process and exact or partial matching for strings, etc.
* The ability to show the differences between two databases of results for the same or similar machines and manipulate from the cmdline how the differencing operates
* The ability to warn on certain types of suspicious behavior
* Output for terminal, tsv or grepable

Usage:
git clone https://github.com/504ensicsLabs/DAMM && cd DAMM
python damm.py -h
python damm.py -p processes --db my_results.db
python damm.py -p processes --diff stock_WinXPSP2x86_processes.db --db after_malware.db

git clone https://github.com/504ensicsLabs/DAMM && cd DAMM
python damm.py -h
python damm.py -p processes --db my_results.db
python damm.py -p processes --diff stock_WinXPSP2x86_processes.db --db after_malware.db
Source: https://github.com/504ensicsLabs

BeRoot - Privilege Escalation for Windows

$
0
0

BeRoot

BeRoot(s) is a post exploitation tool to check commun Windows misconfigurations to find a way to escalate our privilege.
A compiled version is available here.
It will be added to the pupy project as a post exploitation module (so it will be executed all in memory without touching the disk).
Except one method, this tool is only used to detect and not to exploit. If something is found, templates could be used to exploit it. To use it, just create a test.bat file located next to the service / DLL used. It should execute it once called. Depending on the Redistributable Packages installed on the target host, these binaries may not work.


  • MS16-075
  • AlwaysInstallElevated registry key
  • Unattended Install files
  • ... and more priv esc

Run it

|====================================================================|
| |
| Windows Privilege Escalation |
| |
| ! BANG BANG ! |
| |
|====================================================================|


usage: beRoot.exe [-h] [-l] [-w] [-c CMD]

Windows Privilege Escalation

optional arguments:
-h, --help show this help message and exit
-l, --list list all softwares installed (not run by default)
-w, --write write output
-c CMD, --cmd CMD cmd to execute for the webclient check (default: whoami)

How to be low-level programmer?

$
0
0
What is it?
I'm inspired by google-interview-university. I'd like to share my experience and show a roadmap to becoming a low-level programmer because I have found that these skills are not as common as they once were. In addition, many students and beginners ask me how they could become low-level programmers and Linux kernel engineers.

This page cannot include every link/book/course. For example, this page introduces Arduino but there is not detail information about Arduino and embedded system. You should go further for yourself. You get a keyword "Arduino" on which you can start. So next step probably is googling Arduino, buying kit and do something for yourself, not collecting links or free books. Please remember this page is just a roadmap.

FYI, I have over 10 years of experience as a low-level programmer:


  • 80x86 Assembly programming
  • Hardware device with Atmel chip and firmware
  • C language system programming for Unix
  • Device driver in Linux
  • Linux kernel: page allocation
  • Linux kernel: block device driver and md module


What Is the Low-Level?


I classify low-level programming as programming that is very close to the machine, using a lower level programming language like C or assembly. This is in contrast to higher-level programming, typical of user-space applications, using high level languages (e.g. Python, Java).

Yes, systems programming is a very close concept to low-level programming. This page includes the hardware design and firmware development that is not included in system programming.

Finally, this page includes topics ranging from hardware components to the Linux kernel. That is a huge range of layers. A one page document can never cover the details of all the layers, so the aim of this document is to serve as a starting point for low-level programming.


Theory
There are two background theories to low-level programming:

  • Computer Architecture
  • Operating Systems
You can find many good classes on online universities, for instance, Coursera.org and edx.org. Theory is theory. I don't think you should get A+ in the class, just understand the big picture in the class. You'll get better and better with experience.

Let me introduce several books that I've read. They are commonly used for text book in the universities. If there is no class with those books in your university, it's worth to spend some time for those.

Computer Architecture
  • Computer Architecture, Fifth Edition: A Quantitative Approach
  • Computer Systems: A Programmer's Perspective
  • Computer Organization and Design, Fourth Edition: The Hardware/Software Interface

Operating Systems
  • The Magic Garden Explained: The Internals of UNIX System V Release 4 an Open Systems Design
  • The Design of the UNIX Operating System
  • Operating Systems: Internals and Design Principles by William Stallings

There is infinite list of good books. I don't want to say that you should read many books. Just read one book carefully. Whenevery you learn a theory, implement simulation code of it. Implementing one thing is better than knowing one hundread theories.


Languages

Assembly
Choose one between x86 or ARM. No need to know both. It doesn't matter to know assembly language. The essential is knowing the internal of CPU and computer. So you don't need to practice the assembly of the latest CPU. Select 8086 or Corex-M.

  • 8086 assembly programming with emu8086
basic concepts of CPU and computer architecture
basic concepts of C programming language
  • 64bit assembly programming(translation in progress)
basic concepts of modern CPU and computer architecturebasic concepts of disassembling and debugging of C codeneed help for translation
  • ARM Architecture Reference Manual, 2nd Edition
Complete reference on ARM programming
  • Computer Organization and Design
MIPS EditionARM EditionAcademic books that explain how every component of a computer work from the ground up.Explains in details the different concepts that make up computer architecture.They are not for targeted to becoming proficient in a specific assembly language.The MIPS and ARM edition cover the same topics but by dissecting a different architecture.Both editions contain examples in the x86 world

C language

There is no short-cut. Just read the entire book and solve all the exercises.
If you want to be expert of C programming, visit https://leetcode.com/. Good luck!


Applications

Hardware && Firmware

If you want to be an embedded systems engineer, it would be best to start from a simple hardware kit, rather than starting with the latest ARM chipset.
  • Arduino Start Kit
    • There are various series of Arduino but "Arduino Start Kit" has the most simple processor(Atmega328P) and guide book
    • Atmega328P has 8bit core that is the good to start "Digital circuit design" and "Firware development".
    • You don't need to know how to draw schematics and layout, and assemble the chips.
    • But you need to know how to read schematics and understand how the chips are connected.
    • Firmware developers should be able to read the schematics and figure out how to send data to the target device.
    • Follow the guide book!
  • 8086 manual
    • If you're a beginner to x86 architecture, 8086 is also very good guide for processor architecture and 80x86 assembly
  • 80386 manual
At this point, you should be good to start the latest ARM or x86 processor.
For example, the Raspberry Pi board has a Cortex-A53 Processor that supports a 64-bit instruction set. This allows you to experience a modern processor architecture with rPi. Yes, you can buy it... but... what are you going to do with it? If you have no target project, you would be likely to throw the board into a drawer and forget it like other gadgets you may have bought before.
So, I recommend one project for you.
I've made a toy kernel that supports 64bit long mode, paging and very simple context switching. Making a toy kernel is good way to understand modern computer architecture and hardware control.
In fact, you have already the latest processor and the latest hardware devices. Your laptop! Your desktop! You already have all to start! You don't need to buy anything. The qemu emulator can emulate the latest ARM processors and Intel processors. So everything you need is already on hand. There are so many toy kernel and documents you can refer to. Just install qemu emulator and make a tiny kernel that just boots and turns on paging, and prints some messages.
Other toy kernels:

Linux kernel and device driver

You don't need to make a complete operating system. Join the Linux community and participate in development.

Read carefully

References

Check when you need something

Other application

Yes, you might not be interested in Linux or firmware. If so, you can find other applications:
  • Windows system programming & device driver
  • Security
  • Reverse engineering
I don't have any knowledge about those applications. Please send me any information for beginners.

Future of low-level programming

I do not know the future, but I keep my eye on RUST.
If I could have one week free and alone, I would learn RUST. That is because RUST is the latest language with which I can develop Linux device driver.
IoT is new trend, so it's worth to check what OSs are for IoT. ARM, Samsung and some companies has their own realtime OS but sadly many of them are close source. But Linux Foundation also has a solution: Zephyr
Typical cloud server has so many layers, for instance, host OS, kvm driver, qemu process, guest OS and service application. So container has been developed to provide light virtualization. In near future, a new concept of OS, so-called library OS or Unikernel, would be replace the typical stack of SW for virtualization.
Author: gurugio

Windows Remote Administration Tool via Telegram

$
0
0

RAT-via-Telegram

Windows Remote Administration Tool via Telegram

Why another one?

  • The current Remote Administration Tools in the market face 2 major problems:
    • Lack of encryption.
    • Require port forwarding in order to control from hundreds of miles.
  • This RAT overcomes both these issues by using the Telegram bot API.
    • Fully encrypted. The data being exchanged cannot be spied upon using MITM tools.
    • Telegram messenger app provides a simple way to communicate to the target without configuring port forward before hand on the target.

Features:

  • Run keylogger on the target PC.
  • Get target PC's Windows version, processor and more.
  • Get target PC's IP address information and approximate location on map.
  • Show message box with custom text on target PC (Thanks mvrozanti!)
  • List any directories on the target.
  • Download any file locally from the target PC in the background.
  • Upload local files on to the target PC. Send your image, pdf, exe or anything as file to the Telegram bot.
  • Screenshots of the target PC.
  • Execute any file on the target PC.
  • [WIP] Self-Destruct RAT on the target PC.
  • [WIP] Take snapshots from the webcam (if attached).
  • [WIP] Copy and Move files on the target PC.
  • [WIP] Delete files on the target PC.
  • More coming soon!

Screenshots:



How to Make Your Own Pirate Radio Station

$
0
0


Project Steps

  1. Make the antenna.
  2. Flash the SD card and add music.
  3. Edit the config file.
  4. Start it up!
  5. How the PiFM software works.
  6. Going further.
Parts:
  • Raspberry Pi single-board computer from the Raspberry Pi Starter Kit, MakerShed #MKRPI5
  • SD Card, 4GB or more from the Raspberry Pi Starter Kit
  • Female jumper wires MakerShed #MKSEEED3
  • Heat-shrink tubing RadioShack #278-1610
  • FM radio to tune in and listen to your station, such as RadioShack #12-586. (We also like the looks of #55060408, #55060407, and #55061160, only available online.)
  • Battery pack, 4xAA, with USB socket (optional) for portable operation, RadioShack #270-087 (online only)
Tools:

  • Computer
  • Wire cutters / strippers
  • Soldering iron RadioShack #64-053
  • Hot glue gun
  • Solder RadioShack #64-013
  • Wire stripper/cutter RadioShack #64-224



Step #1: Make the antenna.



  • Technically, all you need for an antenna is a piece of wire. For an optimal antenna, you could attach a 75cm wire to pin 4, with a 75cm power cable pointed in the other direction. (That would effectively make a half-wave dipole antenna at 100MHz, near the middle of the FM band.) We just used 40cm of 12 AWG solid wire, since things started tipping over when the wire got longer.

  • Cut and strip a female jumper wire. Solder it to one end of your antenna, and insulate with heat-shrink tubing.
  • Dab hot glue around the joint for support, and stick it on pin 4 of the GPIO pins of your Raspberry Pi. The glue makes the antenna more rigid so it stands up better.

  • NOTE: If you have the Raspberry Pi Starter Kit and you're in a hurry, you can just use a male jumper wire plugged into the Cobbler breakout board! (Both are included in the kit.) It will work, but the range will be roughly half of what you'd get with 40cm of 12 AWG solid copper.

Step #2: Flash the SD card and add music.



  • To save you time configuring everything, MAKE Labs made a disk image. Download it here. (Advanced users who just want the source can find the link in the intro.)

  • The original PiFM code proved the concept with impressive results. The MAKE image takes the work out of partitioning the card into system and data partitions. It also auto-mounts the data partition. It uses a fraction of the CPU of the original code and enables playback from MP3, FLAC, and more. And it runs the PirateRadio.py script on startup, so your music starts broadcasting immediately once the transmitter boots up. Ultimately, this will save you a lot of time. But you can't just drag the files to your SD card; it must be flashed to work.

  • Flash the image to your SD card. If you're not familiar with the process, it’s easy. Good tutorials can be found here. You can use Win32DiskImager on Windows, or the Command Line Tools (1) instructions if you're on OSX. I'll assume Linux users have moved on already.

  • For OSX and Linux users, simply open up the PirateRadio partition and get started. Windows users, follow our instructions for connecting to your Pi via SSH using WinSCP.

  • To add music, simply add your artist or album folders to the root of the “Pirate Radio” partition of the SD card. Your music files can be nested within these folders, so there's no need to dump all your music into one mess on the main directory.

Step #3: Edit the config file.




  • You can set the frequency you want to broadcast on in the pirateradio.config file. Open it up in a text editor. You should see something like: [pirateradio] frequency = 88.9 shuffle = True repeat_all = True

  • Set frequency to the station you want to broadcast on. Useable FM frequencies are typically from 87.5MHz to 108.0MHz. (108.2 was the highest our test radio could reach, but that's in an aircraft band that you should never interfere with.)

  • Set shuffle to True to shuffle files, or to False to play files alphabetically.

  • Set repeat_all to True if you want to loop forever through your playlist.


Step #4: Start it up!



Tune your FM radio to your frequency of choice and plug in the Raspberry Pi. It will take about 15 seconds to warm up. Once it does, you should hear your music loud and clear.


Step #5: How the PiFM software works.


  • From the PiFM wiki: "It uses the hardware on the Raspberry Pi that is actually meant to generate spread-spectrum clock signals on the GPIO pins to output FM radio energy. This means that all you need to do to turn the Raspberry Pi into a (ridiculously powerful) FM transmitter is to plug in a wire as the antenna (as little as 20cm will do) into GPIO pin 4 and run the code."
  • Frequency modulation "is done by adjusting the frequency using the fractional divider." For example, for a target broadcast frequency of 100MHz, the signal is fluctuated between 100.025Mhz and 99.975Mhz, which makes the audio signal.
  • The Python code defaults to 87.9 FM with shuffle and repeat turned off. It scans the SD card for music files and builds a playlist based on the options in the config file. It then passes each file along to a decoder based on the filetype. Each file is then re-encoded into a mono format the PiFM radio can handle. This lets you play more than just WAV files: use your MP3, FLAC, M4A, AAC, or WMA files too.

Step #6: Going further.

  • Tuck everything in the acrylic case that comes with your Raspberry Pi Starter Kit and you're good to go. Or, if you want something cooler or more subversive, try building an awesome housing of your own. MAKE Labs manager Sam Freeman drew up this little number, a cool radio tower; download it at thingiverse.com/makelabs.
  • Add RadioShack's handy USB battery pack so you can carry your station wherever you need to take over the airwaves. (It fits inside the radio tower, too.)
  • NOTE: If you have trouble with range, double-check which pin your antenna is plugged into. At MAKE Labs we spent a few hours puzzled by our antenna's performance, only to discover it was one pin over!
  • TIP: For a cleaner FM signal, and to reduce any accidental broadcasts outside the FM band, build a simple bandpass filter for your Pirate Radio using just a few components, at makezine.com/go/pirate-bandpass.




Make a Teeny Tiny FM Spy Transmitter

$
0
0


This project describes how to build an audio spy bug with extremely small dimensions that works with a voltage of only 1.5V. This is a tested design and proven to be working reliably when built as described here.
Please note that once built the user is responsible for observing local/national regulations for operating such device!
This is the finalized unit. It measures only 0.05 square inches.
This is the finalized unit. It measures only 0.05 square inches.

Specifications of the Spy Bug

Power supply:
  • Maximum 1.55V
  • Normally supplied by a silver-oxide button cell
  • Minimum 1.1V
Current consumption:
  • <200 micro amps
Operating time:
  • Depends on the battery used, with the smallest commercially available battery about 48 hours
Range:
  • The range that can be achieved depends very much on the characteristics of the antenna
  • With an antenna ¼ wavelength long (e.g. 88cm at 85MHz) the range is approximately 50m in open terrain. The bug is therefore more suitable for surveillance within a building or house
Dimensions:
  • 4.75mm×6.8mm (0.187″×0.268″)
  • For optimal range, the antenna should be at least ¼ of the wavelength. Shorter antennas are possible with certain losses. More information on this later.

The Circuit

schematic
The microphone on the left has a maximum voltage rating of 1.45V. The voltage must therefore be brought down to a lower value, since many button cells have a higher nominal voltage than 1.45V. That’s the purpose of the schottky diode D1 which at the extremely low microphone current of approximately 18uA has a voltage drop of only about 150mV. If rechargeable batteries are used, this diode may be omitted and a jumper soldered instead because these batteries often have a nominal voltage of 1.2V.

The microphone output signal is then passed through a 2.2 microFarad capacitor to the base of Q2. This serves to modulate the oscillator frequency. The oscillator comprised of C4, Q1, L1, and C5 oscillates with the here specified values at 81MHz. The oscillation frequency can be adjusted by using different values for C4 and/or L1. Increasing them will lower the oscillation frequency and vice versa.

Required Components

The position of each component is indicated
The position of each component is indicated
We will use some of the smallest currently available components on the market. Further miniaturization by different placement of the components would be possible, but makes no sense because the smallest currently commercialized button cell has a diameter of 4.8mm.
At the time of writing this, all of these components are available on the Digikey website. The main website is Digikey.com. Shipping cost may vary depending on where you live. Other suppliers such as Mouser etc. can be chosen too.
In the following part list there are no exact model numbers for resistors and capacitors because they can change over time and are also different depending on the supplier. For the passive components only the capacitance / resistance and of course the overall size are important. Frequency-determining capacitors should be temperature stable types such as NPO. The frequency determining components are chosen here for a frequency of 81MHz. For the coil always select a component with and air core and one that having a high Q factor.
ComponentModel/ValuePackage/Dimensions
MICICS-40310rectangular 3.35×2.5×0.98mm
D1BAT54LPS-72-XFDFN 1.0 x 0.6mm
C1, C3100nF ceramic capacitor01005 0.4 x 0.2mm
C22.2uF ceramic capacitor0402 1.0 x 0.5mm
R11MOhm resistor 1/32W01005 0.4 x 0.2mm
C412pF ceramic capacitorNPO01005 0.4 x 0.2mm
C55.6pF ceramic capacitorNPO01005 0.4 x 0.2mm
L1220nH inductor, wire wound,
air core (LQW2BASR22J00L)
0805 2,09 x 1,53 mm
Q1BFR360L3TSLP-3 0.6 x 1.0mm
Q2MMBT3904SLCTSOT923F 0.6 x 1.0mm
Battery1.2V-1.55V

The PCB

Below we see the board how it comes from the manufacturer. They have been panelized and then broken out. We need to remove some material around the edges. The circuit board can probably no longer be produced at home using toner transfer or similar methods because traces are only 0.2mm large and the distance between them is equally small.
OPT_00283
The provided Gerber files (download them from this link) can be sent to any PCB manufacturer. Best suited for such a small circuit board are companies that put together orders from different customers on a single large board that is then sent to a PCB manufacturer. The cost of each small PCB goes down considerably. An example is Oshpark.com in the US.
Here is the other side were the battery will be mounted.
Here is the other side where the battery will be mounted.
The assembly of the components on the circuit board requires the use of a microscope. First, a little solder paste is deposited on each pad using a needle or a piece of thin wire. If accidentally too much is put on the pad it should be removed before soldering.
The board is very lightweight, it should therefore be fixed to a surface before doing the following steps.
OPT_00329
Then the components are carefully aligned and placed on the pads. They can be slightly pushed down to prevent them from slipping when the board is handled.
OPT_00332
Subsequently, the board has to be heated to about 480 degree Fahrenheit (about 250 Celsius). This can be done on a hot plate or in a small oven, whatever is available. If an oven is used it should be one without strong air movement, otherwise the parts may simply be blown off the PCB.
The first sign that the correct temperature has almost been reached is the smoke that emanates from the solder paste. The beads of solder then melt at a certain temperature and connect the components to the printed conductors. Once this happens, the oven or hot plate should be turned off. When an oven is used, its door should then also be opened.
The board should be allowed to cool down a bit before handling. If using a hotplate the board should be removed from the hottest spot in order to avoid damage to the MEMS microphone which is pretty sensitive.
If a button battery is used, a wire can be soldered into the vias connecting the positive battery terminal to the circuit board. Of course you can also solder wires to “gnd” and “+” to connect another type of battery.

Oscillation frequency and antenna

In this example here 80MHz were chosen deliberately. In many countries, the FM range between 87.5MHz and 108MHz is overcrowded which makes it more difficult to receive the relative weak signal of our transmitter. Even though, in some countries the frequency band reserved for radio stations goes from 76MHz to 88MHz. Many smartphones can therefore be adjusted to use this frequency band instead of the one from 88MHz to 108MHz. This saves us the money we would have to spend for a scanner or a world radio.
The antenna length should be at least ¼ of the wavelength.
Example of a configuration the circuit has been tested with:
C4 in pFC5 in pFL1 in nHFrequency in MHzAntennalength in cmRange (open field)
125,62208192 (36″)160ft
Higher frequencies are also possible.
If a different oscillation frequency is chosen the antenna length should be adjusted accordingly. The wavelength can be calculated according to the following formula::
Screen Shot 2016-06-22 at 9.57.11 AM
“λ”is the wavelength, “v” is the speed of light, or about 300000km / s. “f” is the frequency.
The antenna can also be made shorter if you are willing to accept a shorter range. A complete discussion of possible antenna shapes and lengths is beyond the scope of this guide.
One possibility is, for example, a short “whip” antenna, that is an antenna which is shorter than a quarter of the wavelength. To compensate for the shorter antenna length, an inductance of a few tens of nH is connected between the antenna wire and the transmitter. The value of this inductor is best determined experimentally.

Miscellaneous

Instead of the MEMS microphone an electret condenser microphone can also be used. The diode may then be omitted.
If the incoming audio signal is too strong, a resistor may be placed in series with C2. The value of that resistor needs to be determined experimentally.
If low frequency noise like from a fan is present in the room under surveillance the value C2 can be decreased. The circuit works very well with values down to 100nF.
written by Tom Schneider

BrainDamage - Backdoor via Telegram as a C&C Server

$
0
0
Help Telegram
A python based backdoor which uses Telegram as C&C server.
For Windows Only

--> Persistance
--> USB spreading
--> Port Scanner
--> Router Finder
--> Run shell commands
--> Keylogger
--> Insert keystrokes
--> Record audio
--> Webserver
--> Screenshot logging
--> Download files in the host
--> Execute shutdown, restart, logoff, lock
--> Send drive tree structure
--> Set email template
--> Rename Files
--> Change wallpaper
--> Open website
--> Send Password for
    • Chrome
    • Mozilla
    • Filezilla
    • Core FTP
    • CyberDuck
    • FTPNavigator
    • WinSCP
    • Outlook
    • Putty
    • Skype
    • Generic Network
--> Cookie stealer
--> Send active windows
--> Gather system information
    • Drives list
    • Internal and External IP
    • Ipconfig /all output
    • Platform

ScreenShots
Setup
Notification
Who is Online Telegram
Help Telegram
Record Audio Telegram
Take screenshot Telegram

Ares - Python Based Botnet and Backdoor

$
0
0
Bot list

Ares is made of two main programs:
  • A Command aNd Control server, which is a Web interface to administer the agents
  • An agent program, which is run on the compromised host, and ensures communication with the CNC
The Web interface can be run on any server running Python. You need to install the cherrypy package.

Interactive shell


EgeSploit - golang library for malware development

$
0
0
EGESPLOIT is a golang library for malware development, it has few unique functions for meterpreter integration.

#DOCUMENTATION
        CalculateChecksum(x) : Function calculates x digit 8 bit checksum for reverse HTTP/HTTPS meterpreter connections, returns the calculated checksum as string.

Meterpreter(ConType, Address) : Function launches a meterpreter connection, takes 2 parameters connection type (HTTP/HTTPS/TCP) and Address (127.0.0.1:4444), function returns a string for error handling.

Persistence() : Function copys and adds the running binary to startup registry.

Sysguide() : Function returns the current directory, running OS version, username, antivirus name as strings.

Keylogger(LOGS) : Function takes a string pointer as parameter and starts a keylogger,all key logs are saved at given parameter.

Please(Command) : Function executes the given parameter with runas command. (Asks permission for higher level operations)

BypassAV() : Function bypasses the anti virus heroustic detections, takes a integer as parameter for defining the intensity level.

Dispatch(Base64_Binary,BinaryName, Parameters) : Function drops a binary and executes it, takes tree strings as parameter base64 encoded binary, binary name and parameters.

Distract() : Functions execute a forkbomb bat file for distracting the user.

Dos() : Function start a dos atack to given target (http://example.com)

SyscallExecute(Shellcode) : Function executes the given shellcode(byte array) with system call.

ThreadExecute(Shellcode) : Function executes the given shellcode(byte array) with CreateThread function.

WifiList() : Functions returns he wifi connection history.

#RSE#
RSE stands for "Reduced Sized Exploits", functions under RSE folder are build with windows api calls for reducing payload sizes.
GITHUB PROJECT

Needle - The iOS Security Testing Framework

$
0
0


Needle is an open source, modular framework to streamline the process of conducting security assessments of iOS apps.


Assessing the security of an iOS application typically requires a plethora of tools, each developed for a specific need and all with different modes of operation and syntax. The Android ecosystem has tools like "drozer" that have solved this problem and aim to be a ‘one stop shop’ for the majority of use cases, however iOS does not have an equivalent.
Needle is an open source modular framework which aims to streamline the entire process of conducting security assessments of iOS applications, and acts as a central point from which to do so. Given its modular approach, Needle is easily extensible and new modules can be added in the form of python scripts. Needle is intended to be useful not only for security professionals, but also for developers looking to secure their code. A few examples of testing areas covered by Needle include: data storage, inter-process communication, network communications, static code analysis, hooking and binary protections.​ The only requirement in order to run Needle effectively is a jailbroken device.
Needle is open source software, maintained by MWR InfoSecurity.

Installation

See the Installation Guide in the project Wiki for details.

Supported Platforms

  • Workstation: Needle has been successfully tested on both Kali and OSX
  • Device: iOS 8, 9, and 10 are currently supported

Open Source Phishing Toolkit

$
0
0


Gophish is an open-source phishing toolkit designed for businesses and penetration testers. It provides the ability to quickly and easily setup and execute phishing engagements and security awareness training.



King Phisher - Phishing Campaign Toolkit

$
0
0
alt text

Installation

For instructions on how to install, please see the INSTALL.md file. After installing, for instructions on how to get started please see the wiki.

King Phisher is a tool for testing and promoting user awareness by simulating real world phishing attacks. It features an easy to use, yet very flexible architecture allowing full control over both emails and server content. King Phisher can be used to run campaigns ranging from simple awareness training to more complicated scenarios in which user aware content is served for harvesting credentials.

King Phisher is only to be used for legal applications when the explicit permission of the targeted organization has been obtained.
Get the latest stable version from the GitHub Releases Page or use git to checkout the project from source.

Feature Overview

  • Run multiple phishing campaigns simultaneously
  • Send email with embedded images for a more legitimate appearance
  • Optional Two-Factor authentication
  • Credential harvesting from landing pages
  • SMS alerts regarding campaign status
  • Web page cloning capabilities
  • Integrated Sender Policy Framework (SPF) checks
  • Geo location of phishing visitors
  • Send email with calendar invitations

Plugins

Both the client and server can be extended with functionality provided by plugins. A small number of plugins are packaged with King Phisher and additional ones are available in the Plugins repository.

Template Files

Template files for both messages and server pages can be found in the separate King Phisher Templates repository. Any contributions regarding templates should also be submitted via a pull request to the templates repository.

Beware! Dozens of Linksys Wi-Fi Router Models Vulnerable to Multiple Flaws

$
0
0
linksys-wifi-router-hacking-tool
Bad news for consumers with Linksys routers: Cybersecurity researchers have disclosed the existence of nearly a dozen of unpatched security flaws in Linksys routers, affecting 25 different Linksys Smart Wi-Fi Routers models widely used today.

IOActive's senior security consultant Tao Sauvage and independent security researcher Antide Petit published a blog post on Wednesday, revealing that they discovered 10 bugs late last year in 25 different Linksys router models.

Out of 10 security issues (ranging from moderate to critical), six can be exploited remotely by unauthenticated attackers.

According to the researchers, when exploited, the flaws could allow an attacker to overload the router, force a reboot by creating DoS conditions, deny legitimate user access, leak sensitive data, change restricted settings and even plant backdoors.

Many of the active Linksys devices exposed on the internet scanned by Shodan were using default credentials, making them susceptible to the takeover.

Researchers found more than 7,000 devices impacted by the security flaws at the time of the scan, though this does not include routers protected by firewalls or other network protections.
"We performed a mass-scan of the ~7,000 devices to identify the affected models," IOActive says. "We found that 11% of the ~7000 exposed devices were using default credentials and therefore could be rooted by attackers."
IOActive made Linksys aware of the issues in January this year and is working "closely and cooperatively" with the company ever since to validate and address the vulnerabilities.

Here's How critical are these Flaws:


The researchers did not reveal more details about the vulnerabilities until the patch is made available to users, although they said two of the flaws could be used for denial-of-service attacks on routers, making them unresponsive or reboot by sending fraudulent requests to a specific API.

Other flaws could allow attackers to bypass CGI scripts to collect sensitive data such as firmware versions, Linux kernel versions, running processes, connected USB devices, Wi-Fi WPS pins, firewall configurations, FTP settings, and SMB server settings.

CGI, or Common Gateway Interface, is a standard protocol which tells the web server how to pass data to and from an application.

Researchers also warned that attackers those have managed to gain authentication on the devices can inject and execute malicious code on the device's operating system with root privileges.

With these capabilities in hands, attackers can create backdoor accounts for persistent access that are even invisible in the router smart management console and so to legitimate administrators.

However, researchers did not find an authentication bypass that can allow an attacker to exploit this flaw.

List of Vulnerable Linksys Router Models:


Here's the list of Linksys router models affected by the flaws:

EA2700, EA2750, EA3500, EA4500v3, EA6100, EA6200, EA6300, EA6350v2, EA6350v3, EA6400, EA6500, EA6700, EA6900, EA7300, EA7400, EA7500, EA8300, EA8500, EA9200, EA9400, EA9500, WRT1200AC, WRT1900AC, WRT1900ACS, and WRT3200ACM.

The majority of the exposed devices (nearly 69%) are located in in the United States, and others are spotted in countries including Canada (almost 10%), Hong Kong (nearly 1.8%), Chile (~1.5%), and the Netherlands (~1.4%).

A small percentage of vulnerable Linksys routers have also been spotted in Argentina, Russia, Sweden, Norway, China, India, UK, and Australia.

Here's How you can Mitigate Attacks originating from these Flaws:


As temporary mitigation, Linksys recommended its customers to disable the Guest Network feature on any of its affected products to avoid any attempts at the malicious activity.

The company also advised customers to change the password in the default account in order to protect themselves until a new firmware update is made available to patch the problems.

Linksys is working to release patches for reported vulnerabilities with next firmware update for all affected devices. So users with Smart Wi-Fi devices should turn ON the automatically update feature to get the latest firmware as soon as the new versions arrive.

TaBi - Track BGP Hijacks

$
0
0

Developed since 2011 for the needs of the French Internet Resilience Observatory, TaBi is a framework that ease the detection of BGP IP prefixes conflicts, and their classification into BGP hijacking events. The term prefix hijacking refers to an event when an AS, called an hijacking AS, advertises illegitimately a prefix equal or more specific to a prefix delegated to another AS, called the hijacked AS.

Usually, TaBi processes BGP messages that are archived in MRT files. Then, in order to use it, you will then need to install a MRT parser. Its favorite companion is MaBo, but it is also compatible with CAIDA's bgpreader. Internally, TaBi translates BGP messages into its own representation. Therefore, its is possible to implement new inputs depending on your needs.


Authors
## Building TaBi
TaBi depends on two external Python modules. The easiest method to install them is to use virtualenv and pip.
If you use a Debian-like system you can install these dependencies using:
apt-get install python-dev python-pip python-virtualenv
Then install TaBi in a virtual environment:
virtualenv ve_tabi
source ve_tabi/bin/activate
pip install py-radix python-dateutil
python setup.py install
Removing TaBi and its dependencies is therefore as simple as removing the cloned repository.
## Usage
Historically TaBi was designed to process MRT dump files from the collectors of the RIPE RIS.
### Grabbing MRT dumps
You will then need to retrieve some MRT dumps. Copying and pasting the following commands in a terminal will grab a full BGP view and some updates.
wget -c http://data.ris.ripe.net/rrc01/2016.01/bview.20160101.0000.gz
wget -c http://data.ris.ripe.net/rrc01/2016.01/updates.20160101.0000.gz

tabi - the command line tool
The tabi command is the legacy tool that uses TaBi to build technical indicators for the Observatory reports. It uses mabo to parse MRT dumps.
Given the name of the BGP collector, an output directory and MRT dumps using the RIS naming convention, tabi will follow the evolution of routes seen in MRT dumps (or provided with the --ases option), and detect BGP IP prefixes conflicts.
Several options can be used to control tabi behavior:
$ tabi --help
Usage: tabi [options] collector_id output_directory filenames*

Options:
-h, --help show this help message and exit
-f, --file files content comes from mabo
-p PIPE, --pipe=PIPE Read the MRT filenames used as input from this pipe
-d, --disable disable checks of the filenames RIS format
-j JOBS, --jobs=JOBS Number of jobs that will process the files
-a ASES, --ases=ASES File containing the ASes to monitor
-s, --stats Enable code profiling
-m OUTPUT_MODE, --mode=OUTPUT_MODE
Select the output mode: legacy, combined or live
-v, --verbose Turn on verbose output
-l, --log Messages are written to a log file.
Among this options, two are very interesting:
  • -j that forks several tabi processes to process the MRT dumps faster
  • -a that can be used to limit the output to a limited list of ASes
Note that the legacy output mode will likely consume all file descriptors as it creates two files per processed AS (i.e. around 100k opened files). The default is the combined output mode.
Here is an example call to tabi:
tabi -j 8 rrc01 results/ bview.20160101.0000.gz updates.20160101.0000.gz
After around 5 minutes of processing, you will find the following files in results/2016.01/:
  • all.defaults.json.gz that contains all default routes seen by TaBi
  • all.routes.json.gz that contains all routes monitored
  • all.hijacks.json.gz that contains all BGP prefix conflicts
## Using TaBi as a Python module
TaBi could also be used as a regular Python module in order to use it in your own tool.
The example provided in this repository enhance BGP prefix conflicts detection, with possible hijacks classification. To do so, it relies on external data sources such as RPKI ROA, route objects and other IRR objects.


Truehunter - Tool to detect TrueCrypt containers

$
0
0

The goal of Truehunter is to detect TrueCrypt containers using a fast and memory efficient approach. It was designed as a PoC some time ago as I couldn't find any open source tool with the same functionality.


Installation
Just use with Python 2.7, it does not need any additional libraries.

usage: truehunter.py [-h] [-D HEADERSFILE] [-m MINSIZE] [-M MAXSIZE]
[-R MAXHEADER] [-f] [-o OUTPUTFILE]
LOCATION
Checks for file size, unknown header, and entropy of files to determine if
they are encrypted containers.
positional arguments:
LOCATION Drive or directory to scan.
optional arguments:
-h, --help show this help message and exit.
-D HEADERSFILE, --database HEADERSFILE
Headers database file, default headers.db
-m MINSIZE, --minsize MINSIZE
Minimum file size in Kb, default 1Mb.
-M MAXSIZE, --maxsize MAXSIZE
Maximum file size in Kb, default 100Mb.
-R MAXHEADER, --repeatHeader MAXHEADER
Discard files with unknown headers repeated more than
N times, default 3.
-f, --fast Do not calculate entropy.
-o OUTPUTFILE, --outputfile OUTPUTFILE
Scan results file name, default scan_results.csv


Belgium bans anonymous prepaid mobile phone SIM cards

$
0
0
A new anti-terror law in Belgium aims to make it impossible for people to buy pay-as-you-go mobile phone SIM cards anonymously.
The measure will be enforced in the autumn and comes as part of the Charles Michel government's strategy in the fight against terrorism. Currently, telecom operators are only aware of the identities of customers who pay for a subscription (or contract) SIM card.
In the near future, prepaid phone users will have their identity revealed to operators as soon as their phone is activated. For a prepaid SIM card to be bought in shops, the buyer's identity card will have to be scanned or photocopied, and subsequently their details will be sent to the operator.
If purchased online, the buyer's identification will need verification using an electronic ID card, an electronic signature or through an electronic payment transaction.
Additionally, users who already own a prepaid phone (before the measure comes into force) have last one week to verify their identities to operators.
Telecom operators assure that the identities of their customers will be only made available to police and intelligence services.
Viewing all 541 articles
Browse latest View live


<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>