Jump to content
Hak5 Forums

Search the Community

Showing results for tags 'shell'.



More search options

  • Search By Tags

    Type tags separated by commas.
  • Search By Author

Content Type


Forums

  • Talk
    • Everything Else
    • Gaming
    • Questions
    • Business and Enterprise IT
    • Security
    • Hacks & Mods
    • Applications & Coding
    • Trading Post
  • WiFi Pineapple
    • WiFi Pineapple TETRA
    • WiFi Pineapple NANO
    • WiFi Pineapple Mark V
    • WiFi Pineapple Mark IV
    • Pineapple Modules
    • WiFi Pineapple University
    • WiFi Pineapples Mark I, II, III
  • Hak5 Gear
    • Bash Bunny
    • Packet Squirrel
    • LAN Turtle
    • USB Rubber Ducky
  • Hak5 Shows
    • Hak5
    • HakTip
    • Metasploit Minute
    • Threatwire
  • Community
    • Forums and Wiki
    • #Hak5
  • Projects
    • SDR - Software Defined Radio
    • Community Projects
    • Interceptor
    • USB Hacks
    • USB Multipass
    • Pandora Timeshifting

Found 10 results

  1. ASM shellcode Creator [Reverse Shell]

    asmTshell is a exploit pen test application I developed for users using linux such as debian ubuntu or kali OS. This tool allows you to build a reverse shell binary file and can be set to run on any OS be it windows linux or mac. Once the target windows/linux/mac system runs the shell binary they connect to your server giving you full control of the systems command prompt or shell from your server. It works by utilizing a linux asm compiler called "nasm" It takes target asm payload and allows you to customize the payload to your desired IP and port # through a easy GUI. Once configuration is done from GUI it will edit your input to the needed ASM hex strings using a custom python script. After which it will compile your new ASM into your target binary file. To get a server running you can use netcat nc or ncat ncat -lvkp 1344 ncat to accept more than one client connection to server nc -lvp 1344 netcat -lvp 1344 Once target system runs the shell binary they will connect to your server allowing you to control there OS from the shell. **Limitations** "keep in mind that your port or ip should not contain a 0, which could break it. If your IP contains a zero like 192.168.0.1 or your port contains a zero like 80, the build will not work" --Read-- can test using 127.1.1.1 as localhost server IP Download - https://www.dropbox.com/s/0cwhldcqjwvrgo3/asmshell.tar?dl=0 AV scan - https://www.virustotal.com/#/file/253d12fb5ddd6c58e02b5bbe0822012aef3624dae01a95927f148ba1da15a4c5/detection
  2. Reverse Shell Mac for Bash Bunny Author: 0dyss3us (KeenanV) Version: 1.0 Description Opens a persistent reverse shell on victim's mac and connects it back to host attacker over TCP. Targets MacOS (OSX may work but has not been tested) Connection can be closed and reconnected at any time Deploys in roughly 30 sec (working on making it faster) Works well with NetCat as the listener Requirements Have a working Bash Bunny :) and a victim with MacOS STATUS LED STATUS Purple Setup Amber (Single Blink) Installing connect.sh script Amber (Double Blink) Creating cron job White (Fast Blink) Cleaning up Green Finished Installation and Execution Plug in Bash Bunny in arming mode Move files from MacPersistentReverseShell to either switch folder Edit the connect.sh file and replace the placeholder IP with attacker's IP and the port with whichever port you like to use (I use 1337 😉) Save the connect.sh file Unplug Bash Bunny and switch it to the position the payload is loaded on Plug the Bash Bunny into your victim's Mac and wait until the final light turns green (about 30 sec) Unplug the Bash Bunny and go to attacker's machine Listen on the port you chose in the connect.sh file on whichever program you'd like (I use NetCat) If using NetCat, run the command nc -nlvp 1337 (replace the port with the port in connect.sh) Wait for connection (Should take no longer than 1 minute as the cron job runs every minute) Once a bash shell prompt appears...YOU'RE DONE!! 😃 and you can disconnect and reconnect at any time as long as the user is logged in Download Click here to download.
  3. Hi guys, Anyone know how I can get shell access in using any modern browsers (Chrome, IE, Firefox, etc. so that the browser doesn't bitch at me and say I need to upgrade to latest browser version) by browsing to a URL? I tried putting a malicious iframe on my evil portal and using these exploits: auxiliary/server/browser_autopwn, auxiliary/server/browser_autopwn2. I even tried downgrading to IE 8 then using the exploit: exploit/windows/browser/ms10_002_aurora. But so far I got nothing. :( No meterpreter sessions. This is for a presentation, by the way. Any of you guys suggest a different way? I am desperate. Wait not really. Just really frustrated. Hope someone can help. Thanks in advance!
  4. exploit/unix/x11/x11_keyboard_exec

    Im trying to exploit my rooted galaxy core prime which is vulnerable to the exploit/unix/x11/x11_keyboard_exec module. Im having a bit of trouble getting a shell. Ive got to the point where a session is created, but when i try to interact with the session to get a shelll it just stops and hangs and does nothing. Ive tried different payloads but the same thing happens everytime. It just says interacting with session <ID>, and I cant get any further than that. Any tips or help would be appreciated. And Im also a bit confused on configuring the reverse shell payload. is the LHOST supposed to be my IP or the victims in a reverse shell. plus what is the proper IP and port number for "ReverseListenerBindAddress" and "ReverseListenerBindPort? Thank you.
  5. Hi all, I am creating some shell scripts that occasionally need to use an external Alfa WiFi card, but not all of the time. Rather than leaving the Alfa card enabled constantly, I would like the script to bring the card online when it is required, and switch it back off when it is not. I have read various methods to do this online, but none seem definitive, so I would like to ask which method I should use. So far, I have seen suggestions of; Using WLAN# up and WLAN# down Disabling USB ports using Hub-CTRL Using hardware add-ons This or this (unknown what is being done here) Even people saying it's not possible. What would you suggest? Has anyone else had any luck with switching off and back on an Alfa Wifi Card from a Linux command line/script? I haven't yet played around, as I'm not at home, but I don't want to waste my time trying a method that won't work as well as something else. Thank you.
  6. Hello guys. So I have just followed this guide to set up my lan turtle over wifi so I don't need to plug it into the ethernet to set it up/update/etc https://www.youtube.com/watch?v=11qAQ3X71X0 I do this on my Kali machine (So I can open up the turtle.sh file) I follow all the steps... it works fine... I can even ping google... But as soon as i unplug the Turtle, and plug it into my Windows PC... All that change and config gets deleted.... I cant access the turtle.sh to set it up on my windows PC either because you cant open bash scripts in powershell And now when I RE-PLUG it back into my Kali to do all the ./turtle.sh again... It wont ping google now??? I follow the step by step, run the bash file... Set up my default gateway... And then when its all done and says "happy shelling" it no longer pings google???? Do I need to do a hard reset?
  7. I would just like to preface by saying that I won't be here to read or respond to comments. I apologize for that, but I am spending as much time as I can focusing on research and learning everything I can. This is a time I would consider to be my intellectual prime and I really want to use this time as best I can in that regard, so I hope you can understand why I won't be actively engaging as a user in general. https://medium.com/@ViGrey/phishing-for-root-using-shell-functions-against-mac-and-linux-2b1b7edbb9a9 This is a script that pretends to be sudo and /usr/bin/sudo, acts like the password prompt, steals the password and deletes traces of itself, including the shell history of running the script itself. The specific ducky script in this post is for Ubuntu with Unity, but it could easily be tweaked to work with other desktops, distros, and even Mac OS X. The idea for this came when I was in the early stages of the research project I'm currently working on involving U2F security tokens (I'll make a post here about that later after I get a POC and blog post up). After testing out some commands for the project, the thought "Could I alias sudo?" came to mind and I decided to try it. Sure enough, it worked flawlessly. I then checked to see if I could alias sudo and call sudo at the end, essentially injecting commands into sudo. That worked flawlessly as well. Figuring these things out opened more questions and I ended up in a rabbit hole thinking about what I could do with it. After getting some other work done, I decided to start working on the ideas about 2 or 3 days ago after figuring out the same can be said about shell functions as aliases and came up with this. The ducky script is in the blog post, but also at https://gist.github.com/ViGrey/a988c76c87898a2156da7724c57f16b4#file-rootphisher-ducky. Go ahead and tinker with it; make it better. I know there are probably better ways to handle some edge cases that can arise, but I leave that as a exercise for you all and possibly myself in the future to look at. I just had fun working on this. Apologies for any confusing parts or spelling errors in the blog post. I wrote that post in a bit of a rush so I could get back to my current research project. Have fun with it!
  8. The HID is coming from inside the Bunny!

    Is there a way from the Bash Bunny shell to control what the Bash Bunny "does to" the host? For example, if my payload just checks the OS version, connects to a Bash Bunny shell and starts a new script based on that? As one simple example, determining Windows XP (UAC evasion not required) vs Windows 7+ could be useful. Another case might be defaulting to, and then unloading, the ECM_ETHERNET module and replacing it with the RNDIS if we detect that we are on Windows. I realize that the latter case might be better handled using the Switch to change payloads... but doing something like I'm thinking could give me, effectively, more than 2 payloads. If I'm not using the right terminology I apologize... I'm just getting started. I can't find anything by searching but I could be looking for the wrong thing... In the long run some way to control what the Bunny does based on the Host OS would be useful. Thanks!
  9. Hi all, I have multiple wireless devices connected to one computer and I'm trying to create a BASH script to find the LogicalName of one of them automatically. For example, I have WLAN0, WLAN1 and WLAN2 connected. I want to find the LogicalName for my 'Super Awesome WiFi Thingy'. So far I have been unable to find a line of BASH that will take the Device Name 'Super Awesome WiFi Thingy' and find which WLAN LogicalName it belongs to. Any ideas? *Edit* I need to output to a variable in format 'WLAN#', rather than just display a list of devices. Thank you.
  10. Can someone help with this PCAP file?

    Here is the file - https://wiki.wireshark.org/SampleCaptures?action=AttachFile&do=get&target=dns-remoteshell.pcap And a screenshot - http://i64.tinypic.com/6gwu2v.jpg I have to analyse this file and answer several questions about it, like, small description of the events and weather this shows an attack, but I'm new to Wireshark so I'm a bit lost. If anyone could have a look and get back to me that would be great!
×