LiME Linux Memory Extractor

LiME ~ Linux Memory Extractor

A Loadable Kernel Module (LKM) which allows for volatile memory acquisition from Linux and Linux-based devices, such as Android.

This makes LiME unique as it is the first tool that allows for full memory captures on Android devices. It also minimizes its interaction between user and kernel space processes during acquisition, which allows it to produce memory captures that are more forensically sound than those of other tools designed for Linux memory acquisition.

Table of Contents

• Features
• Usage
• Examples
• Presentation

Features

• Full Android memory acquisition
• Acquisition over network interface
• Minimal process footprint

Usage

Detailed documentation on LiME's usage and internals can be found in the "doc" directory of the project.

LiME utilizes the insmod command to load the module, passing required arguments for its execution.

insmod ./lime.ko "path=> format= [dio=<0|1>]"

path (required):   outfile ~ name of file to write to on local system (SD Card)
        tcp:port ~ network port to communicate over

format (required): raw ~ concatenates all System RAM ranges
        padded ~ pads all non-System RAM ranges with 0s
        lime ~ each range prepended with fixed-size header containing address space info

dio (optional):    1 ~ attempt to enable Direct IO
        0 ~ default, do not attempt Direct IO

localhostonly (optional):  1 restricts the tcp to only listen on localhost, 0 binds on all interfaces (default)

Examples

In this example we use adb to load LiME and then start it with acquisition performed over the network

$ adb push lime.ko /sdcard/lime.ko
$ adb forward tcp:4444 tcp:4444
$ adb shell
$ su
# insmod /sdcard/lime.ko "path=tcp:4444 format=lime"

Now on the host machine, we can establish the connection and acquire memory using netcat

$ nc localhost 4444 > ram.lime

Acquiring to sdcard

# insmod /sdcard/lime.ko "path=/sdcard/ram.lime format=lime"


Download

Read more

by Malik korrich ~ mercredi 21 octobre 2015 0 commentaires

BetterCap: A New MITM Framework Tool

BetterCap A New MITM Tool And Framework Tool

Bettercap is a complete, modular, portable and easily extensible MITM tool and framework with every kind of diagnostic and offensive feature you could need in order to perform a man in the middle attack.

How to install ?

Stable Release ( GEM )

gem install bettercap

From Source

git clone https://github.com/evilsocket/bettercap
cd bettercap
gem build bettercap.gemspec
sudo gem install bettercap*.gem

DEPENDS
All dependencies will be automatically installed through the GEM system, in some case you might need to install some system dependency in order to make everything work:

sudo apt-get install ruby-dev libpcap-dev

Download

Read more: Bettercap

Read more

by Malik korrich ~ mardi 4 août 2015 0 commentaires

DAWS - Advanced Web Shell For Windows And Linux

DAWS - Advanced Web Shell For Windows And Linux

There's multiple things that makes DAws better than every Web Shell out there:

1. Supports CGI by dropping Bash Shells (for Linux) and Batch Shells (for Windows).
2. Bypasses WAFs, Disablers and Protection Systems; DAws isn't just about using a particular function to get the job done, it uses up to 6 functions if needed, for example, if shell_exec was disabled it would automatically use exec or passthru or system or popen or proc_open instead, same for Downloading a File from a Link, if Curl was disabled then file_get_content is used instead and this Feature is widely used in every section and fucntion of the shell. (Yes, it bypasses Suhosin too)
3. Automatic Encoding; DAws randomly and automatically encodes most of your GET and POST data using XOR(Randomized key for every session) + Base64(We created our own Base64 encoding functions instead of using the PHP ones to bypass Disablers) which will allow your shell to Bypass pretty much every WAF out there.
4. Advanced File Manager; DAws's File Manager contains everything a File Manager needs and even more but the main Feature is that everything is dynamically printed; the permissions of every File and Folder are checked, now, the functions that can be used will be available based on these permissions, this will save time and make life much easier.
5. Tools: DAws holds bunch of useful tools such as "bpscan" which can identify useable and unblocked ports on the server within few minutes which can later on allow you to go for a bind shell for example.
6. Everything that can't be used at all will be simply removed so Users do not have to waste their time. We're for example mentioning the execution of c++ scripts when there's no c++ compilers on the server(DAws would have checked for multiple compilers in the first place) in this case, the function would be automatically removed and the User would know.
7. Supports Windows and Linux.
8. Opened Source.

Extra Info

• Directory Romaing:
• DAws checks, within the `web` directory, for a Writable and Readable Directory which will then be used to Drop and Execute needed scripts which will guarantee their success.
• Eval Form:
• `include`, `include_once`, `require` or `require_once` are being used instead PHP `eval` to bypass Protection Systems.
• Download from Link - Methods:
• PHP Curl
• File_put_content
• Zip - Methods:
• Linux:
• Zip
• Windows:
• Vbs Script
• Shells and Tools:
• Extra:
• `nohup`, if installed, is automatically used for background processing.

Download

Read more

by Malik korrich ~ mardi 24 février 2015 0 commentaires

Nettool.sh - Automate frameworks For Nmap, Driftnet, Sslstrip, Metasploit And Ettercap MITM Attacks

Nettool.sh  - Automate frameworks For Nmap, Driftnet, Sslstrip, Metasploit And Ettercap MITM Attacks.

Netool.sh toolkit provides a fast and easy way For new arrivals to IT security pentesting and also to experience users to use allmost all features that the Man-In-The-Middle can provide under local lan, since scanning, sniffing and Social engineering attacks "[spear phishing attacks]"...

Netool its a toolkit written using 'bash, python, ruby' that allows you to automate frameworks like Nmap, Driftnet, Sslstrip, Metasploit and Ettercap MitM attacks. This toolkit makes it easy tasks such as SNIFFING tcp/udp traffic, Man-In-The-Middle attacks, SSL-sniff, DNS-spoofing, DoS attacks in wan/lan networks, TCP/UDP packet manipulation using etter-filters, and gives you the ability to capture pictures of target webbrowser surfing (driftnet), also uses macchanger to decoy scans changing the mac address.

Operative Systems Supported are:
Linux-ubuntu, kali-linux, backtack-linux (un-continued), freeBSD, Mac osx (un-continued)

Rootsector module allows you to automate some attacks over DNS_SPOOF + MitM (phishing - social engineering) using metasploit, apache2 and ettercap frameworks. Like the generation of payloads, shellcode, backdoors delivered using dns_spoof and MitM method to redirect a target to your phishing webpage. recent as introducted the scanner inurlbr (by cleiton). This tool brought to you by: peterubuntu10

Video:


Download

Read more

by Malik korrich ~ vendredi 20 février 2015 0 commentaires

SSH Key Generator POC One Keypair At A Time

SSH Key Generator POC One Keypair At A Time. A utility for deterministically generating SSH keypairs.

SSH uses public-key cryptography to authenticate the remote computer and allow it to authenticate the user, if necessary. There are several ways to use SSH; one is to use automatically generated public-private key pairs to simply encrypt a network connection, and then use password authentication to log on..

Each keypair is generated by hashing together a "seed" or "master key" (should be at least 32 bytes, randomly generated, and kept secret) and a unique "handle" (using the same handle will result in the same keypair, but the handle does not need to be kept secret); the resulting SHA256 hash is used as the input for generating an Ed25519 keypair.

This allows the creation of a large number of unique keypairs without having to actually manage the keypairs individually. This allows for, say, using a different keypair for every host you need to log into, thus preventing someone from correlating different user accounts on different hosts by the public keys in authorized_keys.

This proof of concept implementation just generates one keypair at a time; ideally the keypairs would be generated on demand, perhaps by an SSH agent implementation (the key generation step should only take a few milliseconds).

Note that while Ed25519 allows for using any 32-byte input to generate a keypair, making this implementation trivial, implementing a similar scheme for other key types is probably possible in some cases (eg. ECDSA), and infeasible in others (DSA/RSA, probably).

Usage
You will need ghc and cabal, as well as the libsodium development files; on Debian/Ubuntu, the ghc and libsodium-dev packages are what you need.

$ git clone https://github.com/mithrandi/ssh-key-generator.git
$ cd ssh-key-generator
$ cabal sandbox init
$ cabal install
$ head -c 32 /dev/urandom > seed
$ cabal run ./seed HIMOM ./id_ed25519
$ ssh-keygen -y -f ./id_ed25519

./seed is the master key, HIMOM is the key handle, and ./id_ed25519 is the output file into which the private key will be placed. ssh-keygen is then invoked to print the public key out.

Download now

Read more

by Malik korrich ~ mercredi 17 décembre 2014 0 commentaires

Breaking Root Password-Shutdown Modes & Controlling Swap file in RHEL7 [#Video]

Breaking Root Password-Shutdown Modes & Controlling Swap file in RHEL7

The video Showing how to break root password in RHEL7. What are the different methods of shutdown or poweroff the RHEL7 machine. Difference between systemctl suspend and systemctl hibernate. How to manage swap file in RHEL7.

About The Author:
This tutorial has written by Alok Srivastava. He is the founder of Network Nuts, India's most loved Linux training company.

Read more

by Malik korrich ~ lundi 27 octobre 2014 0 commentaires

Lynis Open Source Security Auditing Tool For Mac, Unix And Linux

Lynis is an open source security auditing tool. Primary goal is to help users with auditing and hardening of Unix and Linux based systems. The software is very flexible and runs on almost every Unix based system (including Mac). Even the installation of the software itself is optional!

How it works ?
Lynis will perform hundreds of individual tests to determine the security state of the system. Many of these tests are also part of common security guidelines and standards. Examples include searching for installed software and determine possible configuration flaws. Lynis goes further and does also test individual software components, checks related configuration files and measures performance. After these tests, a scan report will be displayed with all discovered findings.

Typical use cases for Lynis:

• Security auditing
• Vulnerability scanning
• System hardening

Why open source?

Open source software provides trust by having people look into the code. Adjustments are easily made, providing you with a flexible solution for your business. But can you trust systems and software with your data? Lynis provides you this confidence. It does so with extensive auditing of your systems. This way you can verify and stay in control of your security needs.

Download

Read more

by Malik korrich ~ samedi 13 septembre 2014 0 commentaires

How To View Block Devices And File System Under RHEL7 [#Tutorial]

Under RHEL7 view block devices & filesystem is more or less same as we used to do it under RHEL6. Lets understand some interesting commands to view block devices and filesystem under RHEL7. 

lsblk:

lsblk command allows you to display a list of available block devices.

lsblk command displays the device name (NAME), major and minor device number (MAJ:MIN), if the device is removable (RM), what is its size (SIZE), if the device is read-only (RO), what type is it (T YPE), and where the device is mounted (MOUNT POINT ). Reember, by default lsblk command shows ouput in tree format. To display the information as an ordinary list, add the -l command line option.

blkid

blkid command, as was under RHEL6, in RHEL7 is used to view information about available block devices.



Be default, the blkid command displays available attributes such as its universally unique identifier (UUID), file system type (T YPE), or volume label (LABEL), as in command one, in above snapshot.

You can also use blkid to display information about a particular device only, specify the device name on the command line – blkid /dev/sda1, as in command two, above snapshot.

Further, you can also use the above command with the -p and -o udev command line options to obtain more detailed information. You need to have root privileges to run the third command in above snapshot.

findmnt:

findmnt command allows you to display a list of currently mounted file systems. findmnt command displays the target mount point (TARGET ), source device (SOURCE), file system type (FSTYPE), and relevant mount options (OPT IONS).

Like lsblk command, findmnt lists file systems in a tree-like format. To display the information as an ordinary list, add the -l command line option.

df:

Exactly like in RHEL6, here in RHEL7 df command allows you to display a detailed report on the system’s disk space usage. df command displays its name (Filesystem ), size (1K-blocks or Size), how much space is used (Used), how much space is still available (Available), the percentage of space usage (Use%), and where is the file system mounted (Mounted on).

Similar like in RHEL6, the df command in RHEL7 shows the partition size in 1 kilobyte blocks and the amount of used and available disk space in kilobytes. To view the information in megabytes and gigabytes, supply the -h command line option, human-readable format.

du:
du command allows you to displays the amount of space that is being used by files in a directory. Like df, du command displays the disk usage in kilobytes. T o view the information in megabytes and gigabytes, supply the -h command line option and to get the summary information only use -s option.

And lastly, you have the gnome-system-monitor tool in rhel7 viewing block devices & file system.

About The Author:
This tutorial has written by Alok Srivastava. He is the founder of Network Nuts, India's most loved Linux training company.

Read more

by Malik korrich ~ mardi 29 juillet 2014 0 commentaires