There are gonna be a bunch of different projects on here
Xploit info
if on windows here are the tools you will need to conduct payload based exploits on oher windows systems:
- Metaploit
- NASM or MASM (i prefer NASM)
- Hex editor of ur choice, I use HXD
- notepad editing works, but notepad++ is better
- Oracle Virtualbox manager (dont do this on ur home windows device plz use a VM)
- WinDBG on Host VM
- any version of python
- shellcode launcher of some sort
- Ghidra is great for checking files to make sure theyre functioning properly. especially when dealing eith ASM.
Setup steps
- Create 2 VMS in VB manager.
- Memory & processing power are not a concern for either
- For the HOST VM you will have 2 network adapters. The first will be NAT, Cable Connected. The second will be Host-only adapter (name VB host only ethernet adapter). Deny prom mode and cable connected.
- The second VM will only have 1 network adapter. Connect it to host-only adapter the same as the last step. This way your Host VM is connected to internet but the target vm is isolated while connected to the host.
- WinDbg only on host adapter btw
- To connect the debugger run this on ur target vm
- Reboot after running this (Assumes windows 8.0+)
- bcedit -set TESTSIGNING ON
bcedit -set loadoptions DISABLE_INTEGRITY_CHECKS
bcedit /debug on
rem Win8+
rem ip = hostip
rem port = 50000...50099
rem key = aything you want z.z.z.z
bcedit /dbgsettings net hostip:192.168.56.101 port:50000 key:1.2.3.4
Metasploit steps
- For my purposes, this is a fun way to exploit the calc app. So this is a tutorial on how to do so. The methods here can be used maliciously but of course i don't know how / wouldnt show you if i did
- with the metaspoit framework installed ( i use version 6.3.39 but its similar for all) open an admin cmd promt
- Navigate to your desktop (cd\users\_____\desktop)
- generate the shellcode payload by typing this: msfvenom -f python -p windows/exec cmd=calc exitfunc=process
- another version of this uses an exitfunction regarding safe SEH: msfvenom -f python -p windows/exec exitfunc=seh cmdd=calc but idc what u do
- It will output your payload. Cool! Now copy that, and create a python file where u will paste it.
- if u dont know how, just create a text file, paste the payload, and rename the extension rom .txt to .py
- Your python file should say the following under the payload:
file = open("payload.bin", "wb")
file.write(buf)
file.close
- navigate to the locaiton of this python file in cmd prompt.
- ...>python nameofscript.py
- it will create a file called payload.bin that contains the raw shellcode
-
shared folder
- Seting up a folder share will just make everythign easier for transferring work between vms
- in host vm make a folder > properties > sharing >advanced sharing > permissions > allow all
- in target vm files > map network drive > x: > \\192.168.56.101\sample > check reconnect at sign in > finish
- send that .bin file from the python sript to the target vm
testing
- in your target vm open an admim cmd prompt
- navigate to desktop
- Shellcodelauncher.exe whatever.bin
- Should run whatever exploit you have written in shellcode if ur stuff is right
-
editing
- throw the resulting .bin file into your hex editor
- it will display all of the raw bytes nd all of the characters associated with them
- To work with x86 asm, put the .bin file into ghidra, open it using x86 little endian 32 visual studio
- Copy all of the asm instructions into a text file (change extension from .txt to .asm)
- edit the asm file to whatever you want
- navigate to wherever the asm file is located in a cmd prompt > nasm filename.asm -o output.bin
- this creates your new .bin file with the chnages you made in assembly.
and that should be everything you need to do some fun stuff with payload exploits!
WiFi Deauthenticator (not done)
Full honesty this took me forever to get
There are 2 parts and the 2nd is completely optional. Does not affect the workings
Required tools:
- ESP32 microcontroller (nonspecific)
- some version of vscode
- This weird plugin with vscode that allows uploading to board from vscode: platformIO
- If you want easier setup use arduino for simple lobrary management
Passive sniffer
Code here for the sniffer