GitBook: [master] 8 pages and 19 assets modified
CPol
gitbook-bot
|
Before Width: | Height: | Size: 1.5 KiB After Width: | Height: | Size: 1.5 KiB |
|
Before Width: | Height: | Size: 1.5 KiB After Width: | Height: | Size: 1.5 KiB |
|
Before Width: | Height: | Size: 40 KiB After Width: | Height: | Size: 40 KiB |
|
Before Width: | Height: | Size: 40 KiB After Width: | Height: | Size: 40 KiB |
|
Before Width: | Height: | Size: 40 KiB After Width: | Height: | Size: 40 KiB |
BIN
.gitbook/assets/image (446) (1) (2).png
Normal file
|
After Width: | Height: | Size: 142 KiB |
|
Before Width: | Height: | Size: 1.3 MiB After Width: | Height: | Size: 1.3 MiB |
|
Before Width: | Height: | Size: 1.3 MiB After Width: | Height: | Size: 1.3 MiB |
|
Before Width: | Height: | Size: 566 KiB After Width: | Height: | Size: 566 KiB |
|
Before Width: | Height: | Size: 740 KiB After Width: | Height: | Size: 740 KiB |
|
|
@ -154,7 +154,7 @@ If you want to **know** about my **latest modifications**/**additions** or you h
|
|||
If you want to **share some tricks with the community** you can also submit **pull requests** to ****[**https://github.com/carlospolop/hacktricks**](https://github.com/carlospolop/hacktricks) ****that will be reflected in this book.
|
||||
Don't forget to **give ⭐ on the github** to motivate me to continue developing this book.
|
||||
|
||||
|
||||
|
||||
|
||||
[**Buy me a coffee here**](https://www.buymeacoffee.com/carlospolop)\*\*\*\*
|
||||
|
||||
|
|
|
|||
|
|
@ -227,7 +227,60 @@ lldb -n malware.bin --waitfor
|
|||
<tr>
|
||||
<td style="text-align:left"><b>help</b>
|
||||
</td>
|
||||
<td style="text-align:left">help breakpoint #Get help of breakpoint command</td>
|
||||
<td style="text-align:left">
|
||||
<p>help breakpoint #Get help of breakpoint command</p>
|
||||
<p>help memory write #Get help to write into the memory</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="text-align:left"><b>reg</b>
|
||||
</td>
|
||||
<td style="text-align:left">
|
||||
<p>reg read $rax</p>
|
||||
<p>reg write $rip 0x100035cc0</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="text-align:left"><b>x/s <reg/memory address></b>
|
||||
</td>
|
||||
<td style="text-align:left">Display the memory as a null-terminated string.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="text-align:left"><b>x/i <reg/memory address></b>
|
||||
</td>
|
||||
<td style="text-align:left">Display the memory as assembly instruction.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="text-align:left"><b>x/b <reg/memory address></b>
|
||||
</td>
|
||||
<td style="text-align:left">Display the memory as byte.</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="text-align:left"><b>print object (po)</b>
|
||||
</td>
|
||||
<td style="text-align:left">
|
||||
<p>This will print the object referenced by the param</p>
|
||||
<p>po $raw</p>
|
||||
<p><code>{</code>
|
||||
</p>
|
||||
<p><code> dnsChanger = {</code>
|
||||
</p>
|
||||
<p><code> "affiliate" = "";</code>
|
||||
</p>
|
||||
<p><code> "blacklist_dns" = ();</code>
|
||||
</p>
|
||||
<p>Note that most of Apple’s Objective-C APIs or methods return objects,
|
||||
and thus should be displayed via the “print object” (po)
|
||||
command. If po doesn't produce a meaningful output use <code>x/b</code>
|
||||
<br
|
||||
/>
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
<tr>
|
||||
<td style="text-align:left"><b>memory write</b>
|
||||
</td>
|
||||
<td style="text-align:left">memory write 0x100600000 -s 4 0x41414141 #Write AAAA in that address</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
|
|
|
|||
|
|
@ -95,7 +95,7 @@ It follows a few steps to get the Activation Record performed by **`MCTeslaConfi
|
|||
2. The JSON payload is encrypted using Absinthe \(**`NACSign`**\)
|
||||
3. All requests over HTTPs, built-in root certificates are used
|
||||
|
||||
|
||||
|
||||
|
||||
The response is a JSON dictionary with some important data like:
|
||||
|
||||
|
|
@ -115,7 +115,7 @@ The response is a JSON dictionary with some important data like:
|
|||
* Signed using the **device identity certificate \(from APNS\)**
|
||||
* **Certificate chain** includes expired **Apple iPhone Device CA**
|
||||
|
||||
|
||||
|
||||
|
||||
### Step 6: Profile Installation
|
||||
|
||||
|
|
|
|||
|
|
@ -6,7 +6,7 @@
|
|||
|
||||
## Attacks Graphic
|
||||
|
||||
|
||||
|
||||
|
||||
## Tool
|
||||
|
||||
|
|
|
|||
|
|
@ -24,7 +24,7 @@ msf> use auxiliary/scanner/redis/redis_server
|
|||
|
||||
### Banner
|
||||
|
||||
Redis is a **text based protocol**, you can just **send the command in a socket** and the returned values will be readable. Also remember that Redis can run using **ssl/tls** \(but this is very weird\).
|
||||
Redis is a **text based protocol**, you can just **send the command in a socket** and the returned values will be readable. Also remember that Redis can run using **ssl/tls** \(but this is very weird\).
|
||||
|
||||
In a regular Redis instance you can just connect using `nc` or you could also use `redis-cli`:
|
||||
|
||||
|
|
@ -44,7 +44,7 @@ In this last case, this means that **you need valid credentials** to access the
|
|||
### Redis Authentication
|
||||
|
||||
**By default** Redis can be accessed **without credentials**. However, it can be **configured** to support **only password, or username + password**.
|
||||
It is possible to **set a password** in _**redis.conf**_ file with the parameter `requirepass` **or temporary** until the service restarts connecting to it and running: `config set requirepass p@ss$12E45`.
|
||||
It is possible to **set a password** in _**redis.conf**_ file with the parameter `requirepass` **or temporary** until the service restarts connecting to it and running: `config set requirepass p@ss$12E45`.
|
||||
Also, a **username** can be configured in the parameter `masteruser` inside the _**redis.conf**_ file.
|
||||
|
||||
{% hint style="info" %}
|
||||
|
|
@ -52,8 +52,8 @@ If only password is configured the username used is "**default**".
|
|||
Also, note that there is **no way to find externally** if Redis was configured with only password or username+password.
|
||||
{% endhint %}
|
||||
|
||||
In cases like this one you will **need to find valid credentials** to interact with Redis so you could try to [**brute-force**](../brute-force.md#redis) ****it.
|
||||
In case you found valid credentials you need to **authenticate the session** after establishing the connection with the command:
|
||||
In cases like this one you will **need to find valid credentials** to interact with Redis so you could try to [**brute-force**](../brute-force.md#redis) **\*\*it.
|
||||
In case you found valid credentials you need to** authenticate the session\*\* after establishing the connection with the command:
|
||||
|
||||
```bash
|
||||
AUTH <username> <password>
|
||||
|
|
|
|||
|
|
@ -195,7 +195,7 @@ Host: example-mvc-application.minded
|
|||
[...]
|
||||
```
|
||||
|
||||
From the previous output, inside the /bin directory you will also be able to find the Dlls
|
||||
From the previous output, inside the /bin directory you will also be able to find the Dlls
|
||||
|
||||
* System.Web.Mvc.dll
|
||||
* System.Web.Mvc.Ajax.dll
|
||||
|
|
@ -235,7 +235,7 @@ HTTP/1.1 200 OK
|
|||
|
||||
Note how in the previous output you can see a new namespace called: **WebApplication1.AdditionalFeatures** which indicates that there is another Dll in the /bin folder called **WebApplication1.AdditionalFeatures.dll**
|
||||
|
||||
### Common files
|
||||
### Common files
|
||||
|
||||
From [here](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/)
|
||||
|
||||
|
|
|
|||
|
|
@ -339,7 +339,7 @@ The page www.mail-tester.com can indicate you if you your domain is being blocke
|
|||
* Decide from which account are you going to send the phishing emails. Suggestions: _noreply, support, servicedesk, salesforce..._
|
||||
* You can leave blank the username and password, but make sure to check the Ignore Certificate Errors
|
||||
|
||||
|
||||
|
||||
|
||||
{% hint style="info" %}
|
||||
It's recommended to use the "**Send Test Email**" functionality to test that everything is working.
|
||||
|
|
|
|||
|
|
@ -126,7 +126,7 @@ If you want to **know** about my **latest modifications**/**additions** or you h
|
|||
If you want to **share some tricks with the community** you can also submit **pull requests** to ****[**https://github.com/carlospolop/hacktricks**](https://github.com/carlospolop/hacktricks) ****that will be reflected in this book.
|
||||
Don't forget to **give ⭐ on the github** to motivate me to continue developing this book.
|
||||
|
||||
|
||||
|
||||
|
||||
[**Buy me a coffee here**](https://www.buymeacoffee.com/carlospolop)\*\*\*\*
|
||||
|
||||
|
|
|
|||