TheFatRat v1.9: Create backdoor & bypass AV

Thefatrat

An easy tool to generate backdoor and easy tool to post exploitation attack like browser attack,dll . This tool compiles a malware with popular payload and then the compiled malware can be execute on windows, android, mac . The malware that created with this tool also have an ability to bypass most AV software protection.

Automating metasploit functions

• Create backdoor for windows , linux , mac and android
• bypass antivirus backdoorr
• Checks for metasploit service and starts if not present
• Easily craft meterpreter reverse_tcp payloads for Windows, Linux, Android and Mac and another
• Start multiple meterpreter reverse_tcp listners
• Fast Search in searchsploit
• Bypass AV
• File pumper
• Create backdoor with another techniq
• Autorunscript for listeners ( easy to use )
• Drop into Msfconsole
• Some other fun stuff

Change log v1.9

• v1.9.4 – Fatrat will be full terminal mode , Powerstage tool added , Setup script rebuilded
• v1.9.3 – Added update script
• v1.9.3 – Dex2Jar will be installed from now on from Fatrat setup manually on user system (reason: Kali repo still uses old version)
• v1.9.3 – Updated Android build tools to V.26 RC1 & Android Platform V. 25-R03
• v1.9.3 – Updated dana travis backdoor-apk to 0.2.2 into fatrat / added openssl in setup
• v1.9.2 – Msfvenom Android rat will be signed with android certificate , so it can be installed properly
• v1.9.2 – Implemented Default Lhost & Lport config to fatrat & powerfull shell creator
• v1.9.2 – Fixed payload in pnwinds option2
• v1.9.2 – Implemented Stop functions in pnwinds
• v1.9.2 – New signing process in old method backdoor apk & option to create listener
• v1.9.2 – Implemented possibility for user to save msfconsole listeners
• v1.9.2 – Fixes in Microsploit
• v1.9.2 – Implemented local ip , public ip & hostname display to powerfull.sh
• v1.9.2 – Implemented local ip , public ip & hostname display before user set Lhost
• v1.9.2 – Implemented log creation for microsploit & fixed bugs
• v1.9.2 – Added effective way to detect user linux distribution
• v1.9.2 – Setup.sh ( patched )
• v1.9.2 – bug in microsploit ( patched )
• v1.9.2 – delt some function and variable
• v1.9.1 – v1.9.1 – Implemented Microsploit (Office Exploitation Tool)
• v1.9b – Implemented Backdoor-apk from Dana James Traversie in this version .{ Less tools to install during setup.sh }
• v1.9.0 – update script setup.sh
• v1.9.0 – del some variable and function
• v1.9.0 – fixed typo and bugs
• v1.9.0 – Backdoor APKS have a new payload hiding method in rat apk to not be detected .
• v1.9.0 – APK (5) rat rebuild totally changed .(adapted backdoor-apk script to fatrat to both work together)
• v1.9.0 – Apktool will not be installed no more by setup.sh , the same thing applies to : dx , zipalign (apktool on debian repo is 2.2.1 , and that version have a bug that gives error on compiling the apks , so , apktool and android tools were updated to latest version 25.0.2 and embeded in (tools) directory of fatrat .

Download & Installation

git clone https://github.com/Screetsec/TheFatRat.git
cd TheFatRat
chmod +x setup.sh && ./setup.sh

Source: Github

Read More

Hijacker v1-stable: Wireless Toolkit Application for Android

Hijacker

Hijacker is a Graphical User Interface for the wireless auditing tools airodump-ng, aireplay-ng and mdk3. It offers a simple and easy UI to use these tools without typing commands in a console and copy&pasting MAC addresses.
This application requires an android device with a wireless adapter that supports Monitor Mode. A few android devices do, but none of them natively. This means that you will need a custom firmware. Nexus 5 and any other device that uses the BCM4339 (and BCM4358 (although injection is not yet supported so no aireplay or mdk)) chipset will work with Nexmon. Also, devices that use BCM4330 can use bcmon. An alternative would be to use an external adapter that supports monitor mode in Android with an OTG cable.
The required tools are included in the app. To install them go to Settings and click “Install Tools”. This will install everything in the directory you select. If you have already installed them, you don’t have to do anything. You can also have them at any directory you want and set the directories in Settings, though this might cause the wireless tools not being found by the aircrack-ng suite. The Nexmon driver and management utility is also included.
Root is also necessary, as these tools need root to work. If you don’t grant root permissions to it, it hangs… for some reason… don’t know why…
Features:

• View a list of access points and stations (clients) around you (even hidden ones)
• View the activity of a network (by measuring beacons and data packets) and its clients
• Deauthenticate all the clients of a network
• Deauthenticate a specific client from the network it’s connected
• MDK3 Beacon Flooding with custom SSID list
• MDK3 Authentication DoS for a specific network or to everyone
• Try to get a WPA handshake or gather IVs to crack a WEP network
• Statistics about access points (only encryption for now)
• See the manufacturer of a device (AP or station) from a OUI database (pulled from IEEE)
• See the signal power of devices and filter the ones that are closer to you
• Leave the app running in the background, optionally with a notification
• Copy commands or MAC addresses to clipboard, so you can run them in a terminal if something goes wrong
• Include the tools
• Reaver WPS cracking (pixie-dust attack using NetHunter chroot and external adapter)
• .cap files cracking with custom wordlist
• Save captured packets in .cap file
• Create custom commands to be ran on an access point or a client with one click

Installation:
Make sure:

• you are on Android 5+
• you are rooted. SuperSU is required. If you are on CM, install SuperSU
• have installed busybox (opened and installed the tools)
• have a firmware to support Monitor Mode on your wireless interface

APK Download: Hijacker-release-v1.apk Source: https://github.com/chrisk44/Hijacker

Read More

Fern Wifi Cracker: wireless security audit tools

Fern Wifi Cracker is a Wireless security auditing and attack software program written using the Python Programming Language and the Python Qt GUI library, the program is able to crack and recover WEP/WPA/WPS keys and also run other network based attacks on wireless or ethernet based networks

 

Prerequisites

The Program requires the following to run properly:
The following dependencies can be installed using the Debian package installer command on Debian based systems using “apt-get install program” or otherwise downloaded and installed manually
1. Aircrack-NG
2. Python-Scapy
3. Python Qt4
4. Python
5. Subversion
6. Xterm
7. Reaver (for WPS Attacks)
8. Macchanger

---

Features

---

Fern Wifi Cracker currently supports the following features:
1. WEP Cracking with Fragmentation,Chop-Chop, Caffe-Latte, Hirte, ARP Request Replay or WPS attack
2. WPA/WPA2 Cracking with Dictionary or WPS based attacks
3. Automatic saving of key in database on successful crack
4. Automatic Access Point Attack System
5. Session Hijacking (Passive and Ethernet Modes)
6. Access Point MAC Address Geo Location Tracking
7. Internal MITM Engine
8. Bruteforce Attacks (HTTP,HTTPS,TELNET,FTP)
9. Update Support

Installation

Download Fern-Wifi-Cracker here, Installation on Debian Package supported systems:

---

root@host:~# dpkg -i Fern_Open_Source_2.2_all.deb

---

The source code for the program can be fetched using the following command on terminal

---

root@host:~# svn checkout http://github.com/savio-code/fern-wifi-cracker/trunk/Fern-Wifi-Cracker/

Demo

Read More

BoopSuite: wireless auditing and security testing toolkit

BoopSuite is an up and coming suite of wireless tools designed to be easy to use and powerful in scope, written in python with semicolons, because I hate children.

Installation

git clone https://github.com/M1ND-B3ND3R/BoopSuite.git
cd BoopSuite
pip install -r requirements.txt
chmod +x setup.py
./setup.py

Usage

To start sniffing:
boopsniff -i wlan1mon
To specify a channel:
boopsniff -i wlan1mon -c 6
Boop also works on the 5ghz spectrum if you have a supporting card:
boopsniff -i wlan1mon -f 5
Reporting can also be enabled:
boopsniff -i wlan1mon -r ~/report.txt
If some processes are interfering then you can preemptively kill them with:
boopsniff -i wlan1mon -k
If you want to see unassociated clients:
boopsniff -i wlan1mon -u
If you want to filter by a specific AP mac address:
boopsniff -i wlan1mon -a xx:xx:xx:xx:xx:xx
New Update includes a gui tool:
boopsniff_gui
Set card to monitor mode:
boop -i wlan1
Set card to managed mode:
boop -i wlan1mon
Set card to a specific name:
boop -i wlan1 -n boop1
note: will enable or disable monitor mode accordingly.
Set channel on card:
boop -i wlan1 -c 11
Note: Will do error checking if you specify a channel the card doesnt support and is ready for cards supporting the 5GHz network.
Kill any interfering tasks:
boop -i wlan1 -k
Put it all together:
boop -i wlan1 -n boop1 -c 11 -k
NOTE: boop will always switch the mode from managed to monitor and vice versa.

Source: Github

Read More

[BlackHat Tool] apt2: automated penetration toolkit

APT2 – An Automated Penetration Testing Toolkit

This tool will perform an NMap scan, or import the results of a scan from Nexpose, Nessus, or NMap. The processesd results will be used to launch exploit and enumeration modules according to the configurable Safe Level and enumerated service information.
All module results are stored on localhost and are part of APT2’s Knowledge Base (KB). The KB is accessible from within the application and allows the user to view the harvested results of an exploit module.

Change log v1.0-20170613

+ Added packaging and fix apt2_whois
+ fixed issues with misc data files and installing packages.
+ module: temp fix till I get time to do a better one.

Setup

NOTE: APT2 is currently only tested on Linux based OSes. If you can confirm that it works on other OSes, please let us know.
On Kali Linux install python-nmap library:

• pip install python-nmap
• pip install pysmb
• pip install yattag
• pip install scapy
• pip install ftputil
• pip install msgpack-python

Current External Program/Script Dependencies

To make full use of all of APT2’s modules, the following external dependencies should be install on your system:
convert, dirb, hydra, java, john, ldapsearch, msfconsole, nmap, nmblookup, phantomjs, responder, rpcclient, secretsdump.py, smbclient, snmpwalk, sslscan, xwd

Configuration (Optional)

APT2 uses the default.cfg file in the root directory. Edit this file to configure APT2 to run as you desire.
Current options include:

• metasploit
• nmap
• threading

Metasploit RPC API (metasploit)

APT2 can utuilize your host’s Metasploit RPC interface (MSGRPC). Additional Information can be found here: https://help.rapid7.com/metasploit/Content/api-rpc/getting-started-api.html

NMAP

Configure NMAP scan settings to include the target, scan type, scan port range, and scan flags. These settings can be configured while the program is running.

Threading

Configure the number of the threads APT2 will use.

Run:

No Options:

python apt2 or ./apt2

With Configuration File

python apt2 -C <config.txt>

Import Nexpose, Nessus, or NMap XML

python apt2 -f <nmap.xml>

Specify Target Range to Start

python apt2 -f 192.168.1.0/24

Safe Level

Safe levels indicate how safe a module is to run againsts a target. The scale runs from 1 to 5 with 5 being the safest. The default configuration uses a Safe Level of 4 but can be set with the -s or --safelevel command line flags.

Usage:

usage: apt2.py [-h] [-C <config.txt>] [-f [<input file> [<input file> ...]]]
[--target] [--ip <local IP>] [-v] [-s SAFE_LEVEL] [-b]
[--listmodules]
optional arguments:
-h, --help            show this help message and exit
-v, --verbosity       increase output verbosity
-s SAFE_LEVEL, --safelevel SAFE_LEVEL
set min safe level for modules
-b, --bypassmenu      bypass menu and run from command line arguments
inputs:
-C <config.txt>       config file
-f [<input file> [<input file> ...]]
one of more input files seperated by spaces
--target              initial scan target(s)
ADVANCED:
--ip <local IP>       defaults to ip of interface
misc:
--listmodules         list out all current modules

Modules

-----------------------
LIST OF CURRENT MODULES
-----------------------
nmaploadxml               Load NMap XML File
hydrasmbpassword          Attempt to bruteforce SMB passwords
nullsessionrpcclient      Test for NULL Session
msf_snmpenumshares        Enumerate SMB Shares via LanManager OID Values
nmapbasescan              Standard NMap Scan
impacketsecretsdump       Test for NULL Session
msf_dumphashes            Gather hashes from MSF Sessions
msf_smbuserenum           Get List of Users From SMB
anonftp                   Test for Anonymous FTP
searchnfsshare            Search files on NFS Shares
crackPasswordHashJohnTR   Attempt to crack any password hashes
msf_vncnoneauth           Detect VNC Services with the None authentication type
nmapsslscan               NMap SSL Scan
nmapsmbsigning            NMap SMB-Signing Scan
responder                 Run Responder and watch for hashes
msf_openx11               Attempt Login To Open X11 Service
nmapvncbrute              NMap VNC Brute Scan
msf_gathersessioninfo     Get Info about any new sessions
nmapsmbshares             NMap SMB Share Scan
userenumrpcclient         Get List of Users From SMB
httpscreenshot            Get Screen Shot of Web Pages
httpserverversion         Get HTTP Server Version
nullsessionsmbclient      Test for NULL Session
openx11                   Attempt Login To Open X11 Servicei and Get Screenshot
msf_snmplogin             Attempt Login Using Common Community Strings
msf_snmpenumusers         Enumerate Local User Accounts Using LanManager/psProcessUsername OID Values
httpoptions               Get HTTP Options
nmapnfsshares             NMap NFS Share Scan
msf_javarmi               Attempt to Exploit A Java RMI Service
anonldap                  Test for Anonymous LDAP Searches
ssltestsslserver          Determine SSL protocols and ciphers
gethostname               Determine the hostname for each IP
sslsslscan                Determine SSL protocols and ciphers
nmapms08067scan           NMap MS08-067 Scan
msf_ms08_067              Attempt to exploit MS08-067

Read More

Auto Web Application Penetration Testing: Intelligence Gathering

Hi all,
A penetration test (pentest for short) is a method of attacking a computer’s systems in the hope of finding weaknesses in its security. If the pentest successfully gains access, it shows that computer functionality and data may be compromised.
Penetration tests serve a range of valuable purposes. One its main purposes is finding vulnerabilities that are difficult for automated security systems to detect. Additionally, they determine the impact of attacks on computer systems, test network defense systems, and provide details needed to support an increase in spending on security technology.
The testing is executed based on the following methodology:

More info, please read this good article.

On this post, i want to introduce my auto_webapp_pentest script.

Intelligence Gathering option

+ Fiding Subdomain

My script are going to use some script for finding subdomain

Fuzzing tool

Sublist3r

Brute force dns

Finally, save result.txt file.

+ Fingerprint WebServer

On this option, i am going to use whatweb, nikto, wafw00f and more for gathering my target webserver.

+ Discover Content

Finding target CMS => Fuzzing target CMS (Check deafult & backup…files, Vulnerability scanning)

If your target are running WordPress, Joomla, Drupal, … this script will enumerate all plug-in, themes, sensitive directory and vulnerability.

For example, my target are running vBulletin:

DEMO

Now, i am continuing to write my script. So when i completed, i will share for you.

Read More

pyfiscan: Free web-application vulnerability and version scanner

Pyfiscan is free web-application vulnerability and version scanner and can be used to locate out-dated versions of common web-applications in Linux-servers. Example use case is hosting-providers keeping eye on their users installations to keep up with security-updates. Fingerprints are easy to create and modify as user can write those in YAML-syntax. Pyfiscan also contains tool to create email alerts using templates.

Detects following software

• ATutor
• BigTree CMS
• Bugzilla
• Centreon
• Claroline
• ClipperCMS
• CMSimple
• CMSMS
• Collabtive
• Concrete5
• Coppermine
• Cotonti
• Croogo
• CubeCart
• Dolibarr
• Dotclear
• Drupal
• e107
• EspoCRM
• Etherpad
• FluxBB
• Foswiki
• Gallery
• Gollum
• HelpDEZk
• HumHub
• ImpressCMS
• ImpressPages
• Jamroom
• Joomla
• KCFinder
• LiteCart
• Magnolia
• Mahara
• MantisBT
• MediaWiki
• Microweber
• MiniBB
• MODX Revolution
• MoinMoin
• MyBB
• Nibbleblog
• Open Source Social Network
• OpenCart
• osDate
• ownCloud
• Oxwall
• PBBoard
• phpBB3
• PhpGedView
• phpMyAdmin
• Piwigo
• Piwik
• PmWiki
• Postfix Admin
• Redaxo
• Roundcube
• SaurusCMS
• Serendipity
• SMF
• SPIP
• SquirrelMail
• TestLink
• TikiWiki
• Trac
• WikkaWiki
• WordPress
• X-Cart
• Zenphoto
• Zikula

Installation

apt-get install python python-pip libpython2.7-dev libyaml-dev git libyaml-dev
git clone https://github.com/fgeek/pyfiscan.git && cd pyfiscan
pip2 install -r requirements.lst

Source: Github

Read More