Simple Python Portscan Function

Here's a basic portscan function written in python -  http://pastebin.com/v6ntptfT

Python Curses Example / Tutorial

I wanted to make a small example tutorial on getting started with a curses UI in python. We'll get started by creating our screen and adding a simple string;

import curses

screen = curses.initscr() # Creates our screen
curses.noecho() # Keeps the keys we press from
curses.cbreak() # Takes input right away
screen.keypad(1)
screen.addstr(10,0,"Resist Monsanto!") # Add a string at 10,0
screen.refresh() # Refresh screen now that strings added
# While loop to wait for key events, then
while 1:
 key = screen.getch() # Get presse keys
 if key == ord("q"): break
curses.endwin() # Closes curses environment

This should result in a screen with the string "Resist Monsanto" in it. If we wanted to use colors we can create color pairs to use like so:

First we initiate the color scheme and than we will create a color pair;

curses.start_color()
curses.init_pair(1, curses.COLOR_CYAN, curses.COLOR_BLACK) # Creates a color pair as 1 with foreground cyan and background black

We can now use this color pair when adding a string for example;

screen.addstr(10,25,"Resist Monsanto!",curses.color_pair(1)) # Add a COLORED string located at (10,25)


This would result in the following script - http://pastebin.com/0EU7UKqZ

But lets say we wanted to get user input rather than just the key event and create a variable out of it, in this case we would use curses.getstr() function. Here we'll create a simple function to get our input called command().

def command():

 curses.echo() # Allows out input to be echo'd to the screen

 cmd = screen.getstr(0,1,15) # Creates an "input box" at the location (0,1) with an input buffer of 15

Now that we have out input as the string cmd, lets just verify it worked and echo it back out.

def command():  # Press "c" to start user input

 curses.echo() # Allows out input to be echo'd to the screen

 cmd = screen.getstr(0,1,15) # Creates an "input box" at the location (0,1) with an input buffer of 15 chars
 curses.noecho() # Turns echo back off
 screen.addstr(2,0,cmd,curses.color_pair(2)) # Adds users input

This would result in the following - http://pastebin.com/zVzrGz0n

You can use that input for whatever you'd like now, whether you want to issue a subprocess and pipe the ouput to the UI, or connect to a server, but that sums up this quick example. I'll delve more into it in a latter post. Take care!

Python Script for Monitoring a site to see whether it's up or down

Quick script I coded to save me time checking to see if a site was down, so I wrote this script to do it for me and to send me an alert using "libnotify-bin" if it happens to go down.

Two methods are available, Ping and HTTP Requests.

If I decide to add more methods, or add more sites to the HTTP request (to insure accuracy) than I'll post an update.. until then I hope you find this useful!

Source - http://pastebin.com/6Aemf2Y8

Python Script to Parse Files for MD5 Hashes

This script demonstrates basic usage of regular expressions in order to look for MD5's (AKA [0-9a-f]{32}) and write them to an output file.

Usage :

Python # python md5parser.py SomeFile.txt MD5list

File parsed ~ 6 hashes found.

Python # cat MD5list
aad3b435b51404eeaad3b435b51404ee
9a5760252b7455deaad3b435b51404ee
0d7f1f2bdeac6e574d6e18ca85fb58a7
9a5760252b7455deaad3b435b51404ee
0d7f1f2bdeac6e574d6e18ca85fb58a7
098f6bcd4621d373cade4e832627b4f6

Script: http://pastebin.com/PPnDs6AU

Python script to parse medusa logs and check if hosts are alive

As the title says, this is a script to parse medusa logs to in order to check if the host is alive, if it's been cracked then it will also display the password for the hosts service that specified when using medusa. Handy for parsing large medusa logs to see who's up.

Ex.

Python # sudo python check.py /root/medusa.log
Checking for live hosts.
220.XX3.1XX.20 is down...
83.XXX.1X9.246 is up!
Password:r00t3d
186.X2.X5.X is down...
190.XXX.37.XX4 is up!
Password:qwerty
79.1XX.XX9.166 is down...
216.XXX.1X9.106 is up!
Password:L4M3R
89.XXX.13X.39 is down...
136.XX9.XXX.106 is down...
31.44.137.109 is down...
15X.5X.70.X is down...
189.10X.175.X74 is down...
208.124.56.2X9 is down...
129.X3.1X2.1X5 is down... 
X8.4X.39.XXX is up!
Password:[SUCCESS] 
XXX.114.1X0.202 is down...
X2.91.XX.1 is up!
Password:123456
...
 
You can find the script below;

http://pastebin.com/QUUV39KU

Python script to look up all the sites hosted on given IP/URL

Here's a script you can use to find out all the domains hosted on the given IP/URL. Takes a command line argument as you can see in the code;

Python # python sharedhosts.py www.monsanto.in
33 sites hosted on IP Address 184.22.117.180
\_________________________________________/
/

http://www.outboards.cn
http://www.sieunhandienquang.com
http://www.medhelp.in
http://www.alibre.cn
http://www.doppelstock.net
http://www.sexhuflit.com
...

I cut the list down to save space, you can find the script below;

http://pastebin.com/BzypB63Q

Python script to parse syslog/audit.log for ssh activity.

I wrote this quick script to parse through my audit log for ssh login attempts and than decided to make it usable on my ubuntu-based box too. Below you can find the source code;

logmon.py

http://pastebin.com/1EmccsdZ

sshmon.py

http://pastebin.com/ehkm5syX

It's pretty strightforward, you run the logmon.py and type in ssh to run the sshmon module for your distro (Detects Ubuntu and Red Hat as of right now, you can easily tweak it to meet your needs). I made this for my own use so it's not perfect, and I plan on improving it and adding more modules to suit my needs. If I do than I'll post updates.

Find out which linux version you're running.

Here I will show you a few ways to find out which version of linux you're running, which may come in handy when writing scripts or something of that sort.

uname -a

cat /proc/version

dmesg | grep "Linux version"

You can also find out which distribution release it is like so;

cat /etc/*-release

Making command alias's to shorten long commands.

I haven't posted in a while, but I wanted to make a quick post on how to make an alias for long commands to reduce your typing. 

For example, if I often had to perform MITM attacks during assessments/pentests than I may want to make an alias for the iptables rules. To do this I can create the following alias like so;

alias sslrule='iptables -t nat -A PREROUTING -p tcp --destination-port  80 -j REDIRECT --to-ports 10000'
alias rules='echo -e "\033[1;41;1mNAT Rules";iptables -t nat -L -nv;echo -e "\033[1;44;1mPlain Rules";iptables -L -nv;echo -e "\033[0m"'

Now instead of typing out that long rule you can just type sslrule, and to see the rules in a distinctive manner I can just type rules.

Now this isn't a permanent alias, if we want to make a permanent alias than we'll need to edit our .bashrc file and add the alias there. In my case it will be located in /root/.bashrc. From there you can just append the alias's of your choice below the existing ones and you'll now have a permanent alias to save you some typing (and carpal tunnel).

Mounting a windows partition

This is a quite "how-to" on mounting a partition in GNU/Linux. First we need to identify which partition we want to mount. To do this we'll issue the fdisk command;

~ # fdisk -l

This lists the partitions, we're looking for a partition that has NTFS under the system column.

   Device Boot      Start         End      Blocks   Id  System
/dev/sda1   *           1         192     1536000   27  Unknown
/dev/sda2             192        7734    60579043+   7  HPFS/NTFS                  <----
/dev/sda3           29333       30402     8586240   17  Hidden HPFS/NTFS
/dev/sda4            7734       29333   173495297    5  Extended
/dev/sda5           28962       29333     2976768   82  Linux swap / Solaris
/dev/sda6           28591       28962     2972672   82  Linux swap / Solaris
/dev/sda7           18273       18496     1798144   82  Linux swap / Solaris
/dev/sda8            7734       18273    84653056   83  Linux

Now we want to create a directory in our /media/ directory which is where we'll mount the windows partition.

mkdir -p /media/Winblows

Now we're reading to mount it in the directory we just created.

mount -t ntfs -o nls=utf8,umask=0222 /dev/sda2 /media/Winblows

That should successfully mount your windows ntfs partition in the directory we created, hope this helps!

VNC Weak Password Bash Scanner

This is an old bash script I wrote some time ago, it uses the .jar that I coded a while back to parse nmap logs for IP's. You can find the bash script at the following pastebin and the jar used to parse the nmap logs below that.

Script - http://pastebin.com/swQGK6mi

Jar - http://hakhub.blogspot.com/2011/05/bash-scripting-friendly-java-ip-parser.html

Python and Shell Commands (Popen) example

Well I've recently moved back to python after learning PHP/MySQL for a while, so as I learned I coded a small program to issue remote commands. It essentially opens a given socket and waits for a connection, when a connection is established it prompts the user for validation. If validation is successful it passes a shell (limited to /bin tools) which you can use to issue remote commands. It also adds an iptables firewall rule to accept all packets on the port you specified which it then deletes when you exit the shell. All activity is logged to Logfile.log, including failed login attempts and their IP.

Things you can learn from this script: 

User Validation using the hashlib and a sha512'd password 

Command line arguments
Popen shell commands 

Reading/Writing Files

Basic sockets 

I wrote another small script to connect to the host, but in the end I decided to just use netcat instead. Example usage;

Host:

~$ python recon.py 1984

Client:

~$ nc -vv 19.84.20.11 1984

Script - http://pastebin.com/Mx600RA8

Getting started with iptables

Okay so I have probably talked about iptables before, and used it in previous tutorials, but now I've decided to talk about it in particular. iptables is extremely useful and powerful if configured properly. We'll start off with a very basic rule, allowing all traffic to and from telnet.

iptables -A INPUT -p tcp --destination-port 23 -j ACCEPT

Now we should be allowing all connections on port 23 (telnet).

We can view the rules we have like so;

iptables -L

If we had wanted to list the table with numeric values instead, use the (-n) flag. In addition, we can specify what rules we want to list (INPUT, OUTPUT, etc) and increase the verbosity to see the packet and byte statistics.

iptables -L INPUT -n -v

Now, that's nice and all but I'd like to filter out SSH on this laptop to drop any packets coming from IP's other than mine. In order to do this, I would issue the following command.

iptables -A INPUT -p tcp --dport 22 ! -s 19.84.20.11 -j DROP

Now any packets coming from a source ip other than the one I specified will be dropped for ssh. This applies to blacklisting IP's, which can easily be circumvented with proxies like TOR though. But if we had wanted to accept all packets except a specific IP, than we can issue the same command with (-j ACCEPT) rather than dropping it.

iptables -A INPUT -p tcp --dport 22 ! -s 19.84.20.11 -j ACCEPT

Now everyone but my home network can ssh into this box.

If we wanted to "flush" our chain, we can issue the following command;

iptables -F

That will have removed all the rules in the chain.

Another nice feature of iptables is the ability to redirect traffic to another port, so for example if we issued the following command than we would be redirecting the unwanted traffic from SSH to our honeypot's port.

iptables -t nat -A PREROUTING -p tcp --dport 22 ! -s 19.84.20.11 -j REDIRECT --to-port 1984

Now, nat rules are located in a separate are than you average rules. If we wanted to view these rules than we would need to explicitly specify that it's the nat rules we want to see or modify. For example, to view the rules and then flush them we would issue the following;

iptables -t nat -L -nv

iptables -t nat -F

That about wraps it up for my "how to" on getting started with iptables. Hope this helps someone else out there.

Simple PHP Toolkit

Well I've been learning PHP/MySQL lately so while learning I decided to make something of use (well... kind of). But I've decided to move to python for my web development, so I decided to just post what I've coded so far for others to play with and learn from. If uses a MySQL DBase to login, which you can set up using that queries in my previous post on the hash cracker.

What it has;

Malware String Detector (looks through files for specific strings, which you can specify - I used it for looking through keyloggers for email credentials)

Basic Port Scanner

MD5 Hash Generator/Cracker

Below you can find the tar'd files.

PHP Scripts - http://www.mediafire.com/?g1iwudpkic5vip4
Images - http://www.mediafire.com/?7v2q2r469dn6mie

Windows Command Line/Console Alternative

Well I'm a linux guy, therefore I've come to love the CLI...which is unfortunately lacking on windows. I've had a stock windows starter install on this netbook I've been dual booting with and decided to play more with windows and do some malware analysis. I can't stand dealing with microsofts CLI, so I decided to look for an alternative... and I found exactly what I was looking for. "Console" is a Windows console window enhancement.

Console features include: multiple tabs, text editor-like text selection, different background types, alpha and color-key transparency, configurable font, different window style. 

This is a very nice addition for anyone who loves the CLI, and it really helps in customizing windows to suite me which makes for a more pleasant experience.

You can find the download here, on sourceforge.

http://sourceforge.net/projects/console/

Basic PHP Hash Cracker (Updated)

Well I've previously posted the basic hash cracker I had coded in PHP, but it seems the links had died and since I've added MySQL Database functionality I decided I would just make an updated post with both of them and their sources.

To download the original one which doesn't use a SQL DBase and works on free hosting, use this version.

To download the latest version which stores cracked hashes and hashed words in a DBase which it then utilizes when cracking hashes by trying all the plaintext words in the DBase against the hash. You can download that version here.

To setup the MySQL Database, open up your MySQL shell and issue the following sql queries. (If you need help to get started with setting up a web server / using the MySQL shell than check out this post)

~$ mysql -u root -p

mysql> create database HashCracker;

mysql> create table HashCracker.users(UID int not null auto_increment,User varchar(50),Pass varchar(42),primary key(UID));

mysql> create table HashCracker.Hashes(HID int not null auto_increment,String varchar(50),Hash varchar(32),primary key(HID));

mysql> insert into HashCracker.users(User,Pass) values('Username',sha1('Password'));

Now your MySQL DBase should be all setup and ready for use. Just extract the contents of the tar into your /var/www directory (or whatever your webroot directory is) and log in with the credentials you specified in the query above. If you have any comments feel free to leave them.

Monitor Turns Off After A Few Seconds (FIX)

Well I had this old flat panel radius lying around just taking up room which I thought was broken, but I had given someone an old system including an old monitor from the 90's which I decided wasn't sufficient. I had decided to pull it out and take it apart to see what exactly was wrong as it would turn on and show the desktop for a brief second and then go black. I'm not much of a hardware guy, but lately I've been playing around with things salvaged from my former job. I fixed a brand new 7-in-1 Kodak printer/everything else you can imagine, which they tossed out because they thought it was broken. I also grabbed all the flat panels they were tossing out, and this radius was one of them. After doing some reading I realized this was a good sign the capacitors are dying, and the (temporary) fix didn't require any soldering. I was able to use it by simply turning the brightness down with the few seconds I had to navigate the menu with, then once I turned the monitor on again it had enough energy to stay on, at some point I may have to replace them, but I'm sure I have something lying around I can salvage some from.

Also using a higher power supply pack made it usable regardless of brightness or contrast, but switching out the compacitor will eventually need to be done I expect.

Find out your hardware information in linux

This is very basic, but I hadn't known about it untill recently when I was given an old pc which I instantly install linux on. I don't do much when it comes to hardware as I can't really afford to... other than other peoples stuff I recycle. The quick way to find out all your hardware specs on linux is "lshw".  Turns out it had a 3.00 GHz CPU with a 512mb stick of ram and 3 open slots, which I just so happen to have 3 spare 512mb sticks laying around from other pcs I've recycled. So I ended up with a fully functional 3.00GHz CPU 2GB ram linux box, which made me more than happy... as I can't afford much.

Getting started with skipfish.

Well this is another great vulnerability scanner for webapp's, I really like it so far and thought it was well worth a post. So to start off, download skipfish from here. It has a great interface and outputs the results to an HTML file.

To find out more about the tool and the huge number of probes it performs, read their documentation here.

Now assuming you've downloaded the package from the link above, we will need to untar it and compile it with the make command.

~$ tar -xvzf skipfish-2.02b.tgz

~$ cd ./skipfish-2.02b

~/skipfish-2.02b $ make

Now it should have compiled, but if you get an error along the lines of this;

make: cc: Command not found

make: *** [skipfish] Error 127

Then you may need to install GCC, you also will need libidn installed.

Now assuming we have it all compiled and ready to go, you should have file called "skipfish" in the current directory. You will have to either specify the worldlist you'd like skipfish to use or copy one from the dictionaries directory into the directory that has skipfish in it. 

I'll be specifying one of the dictionaries that come with this tool.

Let's assume we're auditing this blog, we would issue the following command.

~/skipfish-2.02b $ ./skipfish -W /skipfish-2.02b/dictionaries/complete.wl -o outputdir http://www.hakhub.tk 

That'll get skipfish scanning, you can watch the process via the CLI and the results will be stored in the "outputdir" you specified. So you can view the results in your browser of choice. 

~/skipfish-2.02b $ cd

~$ cd ./outputdir

~/outputdir $ firefox index.html

From there, you can analyze the results and perform your audit or fix your code.

Getting started with MySQL Shell

Okay so I've just recently started getting into a web dev and what not, but I thought I'd make a quick how-to for getting started with MySQL on the linux platform.

First off, make sure you've got a LAMP setup (Linux Apache MySQL & PHP). If you're using a debian based distro you can download them with the repositories like so;

sudo apt-get install apache2 mysql-server apache-mod-php5 php5-mysql

After those install, you'll want to set a password for your MySQL account (MySQL SHOULD be running, but it can be started like so; /etc/init.d/mysql start).

mysqladmin -u root password ThePassword

Now you should set your password set, you can login to MySQL and get to the fun stuff.

mysql -u root -p

You'll be prompted for your pass, after you log in you can start interacting with the DBase. 

/*

Alternatively you can log in without a password, as there is none by default. then could could issue the query like this;

mysql -u root

mysql> SET PASSWORD FOR 'root'@'localhost' = PASSWORD('Yourpassword');

 */

If for wanted to view the existing DBases you can issue the following command;

mysql> show databases;

Now to create a DBase you can simply do this;

mysql> create database MonsantosArsenal;

Now if we wanted to move to that DBase we could do the following;

mysql> use MonsantosArsenal;

Now, what's a DBase without tables?

mysql> create table Weapons(

         WepID int,

         Weapon varchar(50)

          );

And that'll create a table named Weapons in the Database MonsantosArsenal. You can now begin adding columns with the insert command, but first I want to point out that you can set a integer to automatically increment by 1 like this;


mysql> create table Weapons(

         WepID int not null auto_increment,

         Weapon varchar(50)

          );

mysql> insert into MonsantosArsenal (Weapon)

          VALUES("Genetically modified food");

You now have a table with a column named "Weapon" that has the value we chose to insert. I hope this helps get you started with the mysql shell.