jperezduerto.info
Post-exploitation
No tool matches.
-
chiselhome
TCP/UDP tunnel over HTTP used to pivot into networks you already have a foothold on.
help
Usage: chisel [command] Commands: server runs chisel in server mode client runs chisel in client mode -
cymothoahome
Process-injection style backdoor demo for labs where you already control the host.
-
dbdhome
Encrypted netcat-style backdoor channel for lab shells when cleartext nc is too noisy.
help
dbd 1.50 Copyright (C) 2013 Kyle Barnthouse <durandal@gitbrew.org> $Id: dbd.c,v 1.50 2013/05/20 15:40:00 durandal Exp $ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. connect (tcp): dbd [-options] host port listen (tcp): dbd -l -p port [-options] options: -l listen for incoming connection -p n choose port to listen on, or source port to connect out from -a address choose an address to listen on or connect out from -e prog program to execute after connect (e.g. -e cmd.exe or -e bash) -r n infinitely respawn/reconnect, pause for n seconds between connection attempts. -r0 can be used to re-listen after disconnect (just like a regular daemon) -c on|off encryption on/off. specify whether you want to use the built-in AES-CBC-128 + HMAC-SHA1 encryption implementation (by Christophe Devine - http://www.cr0.net:8040/) or not default is: -c on -k secret override default phrase to use for encryption (secret must be shared between client and server) -q hush, quiet, don't print anything (overrides -v) -v be verbose -n toggle numeric-only IP addresses (don't do DNS resolution). if you specify -n twice, original state will be active (i.e. -n works like a on/off switch) -m toggle monitoring (snooping) on/off (only used with the -e option). snooping can also be turned on by specifying -vv (-v two times) -P prefix add prefix (+ a hardcoded separator) to all outbound data. this option is mostly only useful for dbd in "chat mode" (to prefix lines you send with your nickname) -H on|off highlight incoming data with a hardcoded (color) escape sequence (for e.g. chatting). default is: -H off -V print version banner and exit (include that output in your bug report and send bug report to michel.blomgren@tigerteam.se) unix-like OS specific options: -s invoke a shell, nothing else. if dbd is setuid 0, it'll invoke a root shell -w n "immobility timeout" in seconds for idle read/write operations and program execution (the -e option) -D on|off fork and run in background (daemonize). default: -D off -
dns2tcpdns2tcpc
Tunnels TCP over DNS when restrictive networks only allow name traffic and scope allows tunnels.
help
dns2tcpc: option requires an argument -- 'h' dns2tcp v0.5.2 ( http://www.hsc.fr/ ) Usage : dns2tcpc [options] [server] -c : enable compression -z <domain> : domain to use (mandatory) -d <1|2|3> : debug_level (1, 2 or 3) -r <resource> : resource to access -k <key> : pre-shared key -f <filename> : configuration file -l <port|-> : local port to bind, '-' is for stdin (mandatory if resource defined without program ) -e <program> : program to execute -t <delay> : max DNS server's answer delay in seconds (default is 3) -T <TXT|KEY> : DNS request type (default is TXT) server : DNS server to use If no resources are specified, available resources will be printed -
Encodes binaries as hex/ASCII for restrictive transfer paths during authorized engagements.
help
/usr/bin/exe2hex:495: SyntaxWarning: "\[" is an invalid escape sequence. Such sequences will not work in the future. Did you mean "\\["? A raw string is also an option. send_user "\\n\\n\[i\] Done\\n" [*] exe2hex v1.5.1 Usage: exe2hex [options] Options: -h, --help show this help message and exit -x EXE The EXE binary file to convert -s Read from STDIN -b BAT BAT output file (DEBUG.exe method - x86) -p POSH PoSh output file (PowerShell method - x86/x64) -e URL encode the output -r TEXT pRefix - text to add before the command on each line -f TEXT suFfix - text to add after the command on each line -l INT Maximum HEX values per line -c Clones and compress the file before converting (-cc for higher compression) -t Create a Expect file, to automate to a Telnet session. -w Create a Expect file, to automate to a WinEXE session. -v Enable verbose mode -
iodinehome
IP-over-DNS tunnel for constrained exfil or reachability tests in labs that permit it.
help
iodine IP over DNS tunneling client Usage: iodine [-v] [-h] [-f] [-r] [-u user] [-t chrootdir] [-d device] [-P password] [-m maxfragsize] [-M maxlen] [-T type] [-O enc] [-L 0|1] [-I sec] [-z context] [-F pidfile] [nameserver] topdomain Options to try if connection doesn't work: -T force dns type: NULL, PRIVATE, TXT, SRV, MX, CNAME, A (default: autodetect) -O force downstream encoding for -T other than NULL: Base32, Base64, Base64u, Base128, or (only for TXT:) Raw (default: autodetect) -I max interval between requests (default 4 sec) to prevent DNS timeouts -L 1: use lazy mode for low-latency (default). 0: don't (implies -I1) -m max size of downstream fragments (default: autodetect) -M max size of upstream hostnames (~100-255, default: 255) -r to skip raw UDP mode attempt -P password used for authentication (max 32 chars will be used) Other options: -v to print version info and exit -h to print this help and exit -f to keep running in foreground -u name to drop privileges and run as user 'name' -t dir to chroot to directory dir -d device to set tunnel device name -z context, to apply specified SELinux context after initialization -F pidfile to write pid to a file nameserver is the IP number/hostname of the relaying nameserver. if absent, /etc/resolv.conf is used topdomain is the FQDN that is delegated to the tunnel endpoint. -
mimikatzhome
Windows credential extraction toolkit for authorized labs where local access is already earned.
help
> mimikatz ~ Uses admin rights on Windows to display passwords in plaintext /usr/share/windows-resources/mimikatz ├── kiwi_passwords.yar ├── mimicom.idl ├── Win32 │ ├── mimidrv.sys │ ├── mimikatz.exe │ ├── mimilib.dll │ ├── mimilove.exe │ └── mimispool.dll └── x64 ├── mimidrv.sys ├── mimikatz.exe ├── mimilib.dll └── mimispool.dll = -
miredohome
Teredo IPv6 tunneling client/server for reaching v6 through NATs in constrained lab nets.
help
Usage: miredo [OPTIONS] [SERVER_NAME] Creates a Teredo tunneling interface for encapsulation of IPv6 over UDP. -c, --config specify an configuration file -f, --foreground run in the foreground -h, --help display this help and exit -p, --pidfile override the location of the PID file -u, --user override the user to set UID to -V, --version display program version and exit -
powersploithome
PowerShell post-exploitation scripts for Windows labs; prefer well-understood one-offs in reports.
help
> powersploit ~ PowerShell Post-Exploitation Framework /usr/share/windows-resources/powersploit ├── AntivirusBypass ├── CodeExecution ├── Exfiltration ├── Mayhem ├── Persistence ├── PowerSploit.psd1 ├── PowerSploit.psm1 ├── Privesc ├── README.md ├── Recon ├── ScriptModification └── Tests = -
ptunnelhome
Carries TCP inside ICMP echo traffic; niche pivot when only ping is allowed.
help
ptunnel v 0.72. Usage: ptunnel -p <addr> -lp <port> -da <dest_addr> -dp <dest_port> [-m max_tunnels] [-v verbosity] [-f logfile] ptunnel [-m max_threads] [-v verbosity] [-c <device>] -p: Set address of peer running packet forwarder. This causes ptunnel to operate in forwarding mode - the absence of this option causes ptunnel to operate in proxy mode. -lp: Set TCP listening port (only used when operating in forward mode) -da: Set remote proxy destination address if client Restrict to only this destination address if server -dp: Set remote proxy destionation port if client Restrict to only this destination port if server -m: Set maximum number of concurrent tunnels -v: Verbosity level (-1 to 4, where -1 is no output, and 4 is all output) -c: Enable libpcap on the given device. -f: Specify a file to log to, rather than printing to standard out. -s: Client only. Enables continuous output of statistics (packet loss, etc.) -daemon: Run in background, the PID will be written in the file supplied as argument -syslog: Output debug to syslog instead of standard out. -udp: Toggle use of UDP instead of ICMP. Proxy will listen on port 53 (must be root). Security features: [-x password] [-u] [-setuid user] [-setgid group] [-chroot dir] -x: Set password (must be same on client and proxy) -u: Run proxy in unprivileged mode. This causes the proxy to forward packets using standard echo requests, instead of crafting custom echo replies. Unprivileged mode will only work on some systems, and is in general less reliable than running in privileged mode. Please consider combining the following three options instead: -setuid: When started in privileged mode, drop down to user's rights as soon as possible -setgid: When started in privileged mode, drop down to group's rights as soon as possible -chroot: When started in privileged mode, restrict file access to the specified directory -setcon: Set SELinux context when all there is left to do are network I/O operations To combine with -chroot you will have to `mount --bind /proc /chrootdir/proc` Starting the proxy (needs to run as root): [root #] ptunnel Starting a client (also needs root): [root #] ptunnel -p proxy.pingtunnel.com -lp 8000 -da login.domain.com -dp 22 -c eth0 And then using the tunnel to ssh to login.domain.com: [user $] ssh -p 8000 localhost And that's it. Enjoy your tunnel! -
pwnathome
NAT-to-NAT helper for peer connectivity tricks in controlled network labs.
help
usage: pwnat <-s | -c> <args> -c client mode (default) <args>: [local ip] <local port> <proxy host> [proxy port (def:2222)] <remote host> <remote port> -s server mode <args>: [local ip] [proxy port (def:2222)] [[allowed host]:[allowed port] ...] -6 use IPv6 -v show debug output (up to 2) -a reuse address -p reuse port -h show this help and exit -
sbdhome
Secure netcat-like backdoor with encryption for authorized persistence demos.
help
sbd 1.37 Copyright (C) 2004 Michel Blomgren <michel.blomgren@tigerteam.se> $Id: sbd.c,v 1.37 2005/08/21 22:40:47 shadow Exp $ This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the License, or (at your option) any later version. connect (tcp): sbd [-options] host port listen (tcp): sbd -l -p port [-options] options: -l listen for incoming connection -p n choose port to listen on, or source port to connect out from -a address choose an address to listen on or connect out from -e prog program to execute after connect (e.g. -e cmd.exe or -e bash) -r n infinitely respawn/reconnect, pause for n seconds between connection attempts. -r0 can be used to re-listen after disconnect (just like a regular daemon) -c on|off encryption on/off. specify whether you want to use the built-in AES-CBC-128 + HMAC-SHA1 encryption implementation (by Christophe Devine - http://www.cr0.net:8040/) or not default is: -c on -k secret override default phrase to use for encryption (secret must be shared between client and server) -q hush, quiet, don't print anything (overrides -v) -v be verbose -n toggle numeric-only IP addresses (don't do DNS resolution). if you specify -n twice, original state will be active (i.e. -n works like a on/off switch) -m toggle monitoring (snooping) on/off (only used with the -e option). snooping can also be turned on by specifying -vv (-v two times) -P prefix add prefix (+ a hardcoded separator) to all outbound data. this option is mostly only useful for sbd in "chat mode" (to prefix lines you send with your nickname) -H on|off highlight incoming data with a hardcoded (color) escape sequence (for e.g. chatting). default is: -H off -V print version banner and exit (include that output in your bug report and send bug report to michel.blomgren@tigerteam.se) unix-like OS specific options: -s invoke a shell, nothing else. if sbd is setuid 0, it'll invoke a root shell -w n "immobility timeout" in seconds for idle read/write operations and program execution (the -e option) -D on|off fork and run in background (daemonize). default: -D off -
shellterhome
Dynamic PE infection for lab payloads; only against binaries and hosts you are allowed to modify.
help
0078:err:winediag:nodrv_CreateWindow Application tried to create a window, but no driver could be loaded. 0078:err:winediag:nodrv_CreateWindow L"The explorer process failed to start." 0078:err:systray:initialize_systray Could not create tray window LOGO_ERROR || Please Report To Author. Last_Error_Code: 6 || Invalid handle. This error dosen't affect Shellter! You can proceed with the injection process... ********************** * Command Line Usage * ********************** Help: -h, --help Action: Shows the command line help menu. List Payloads: --list Action: Shows a list of the embedded payloads. Verbose Mode: -v Action: Shows Real-Time Tracing. Operation Mode: -a / -m Action: Sets the Operation Mode to use. -a: Auto Mode, -m: Manual Mode. (See Remarks) Note: Manual Mode requires user interaction for all options. Online version check: --VersionCheck Action: Retrieves version information from the official website. Note: Requires internet connection. Not available in Wine mode. PE target: -f <filename> Action: Sets the PE target. … (103 more lines — see the tool's home page) -
udptunnelhome
Wraps UDP payloads in TCP so UDP-only paths can cross TCP-friendly middleboxes.
help
Usage: udptunnel -s TCP-port [-r] [-v] UDP-addr/UDP-port[/ttl] or udptunnel -c TCP-addr[/TCP-port] [-r] [-v] UDP-addr/UDP-port[/ttl] -s: Server mode. Wait for TCP connections on the port. -c: Client mode. Connect to the given address. -r: RTP mode. Connect/listen on ports N and N+1 for both UDP and TCP. Port numbers must be even. -v: Verbose mode. Specify -v multiple times for increased verbosity.
Where an authored purpose exists, it is written for this path. Otherwise you see the package summary. Help text is captured live from a Kali system where available.