This guide will show you how you can launch cmd and Powershell with help from Microsoft Paint. Sometimes organisations environments are being locked down and are preventing users from right clicking and opening tools such as cmd.exe or powershell.exe. When I face that during a penetration test I usually try this simple mspaint hack to check if I can get around the organisations defensive measures.
How to launch Command Prompt (cmd.exe)
Open Paint
Press Resize
Configure the size
Uncheck “Maintain Aspect Ratio”
Click on “Pixels”
Horizontal: 6
Vertical: 1
Press OK
Zoom in so you can see the pixels.
The next step is to color these six pixels in the correct colors. Press “Edit colors’ and then change the colors for each pixel according to the list below. You modify the colors by changing the values of Red, Green and Blue: Colors for each pixel:
Red(10), Green(0), Blue(0)
Red(13), Green(10), Blue(13)
Red(100), Green(109), Blue(99)
Red(120), Green(101), Blue(46)
Red(0), Green(0), Blue(101)
Red(0), Green(0), Blue(0)
When you have filled the pixels with the correct colors it should look like this:
The next step is to save the file by pressing “Save As” and then changing file format to “24-bit Bitmap”.
Now the last step is to change the file format of the file from .BMP to .BAT
Now just double click on the new .BAT-file.
Voila
How to launch Powershell
The process is the same for powershell, the only difference are the colors. Instead of the colors above use these:
Red(10), Green(0), Blue(0)
Red(13), Green(10), Blue(13)
Red(119), Green(111), Blue(112)
Red(115), Green(114), Blue(101)
Red(108), Green(101), Blue(104)
Red(0), Green(0), Blue(108)
How it works:
What we do is changing the color of the six pixels so that they in heaxdecimal represents ‘cmd.exe’/’powershell’. When we save the file to .BMP the encoding algorithm converts the RGB colors to ASCII data. When that is done and we change the file format to .BAT the .BAT script containts the instruction ‘cmd.exe’/’powershell’ that will be executed when we double click on the script.
I hope you did found this useful. It’s a pretty cool trick to have in your arsenal during penetration tests.
This guide will help you get started with the O.MG-cable. When you open your package it should include three things:
A card with instructions
The programmer
The OMG-cable
If you read the instruction card you will see that you can find instructions on how to get started at https://o.mg.lol/setup. You will there find a link to the Github project where you can download the latest firmware that we will use to flash the cable.
Download the firmware by clicking on the link to the .zip-file. You will then need to unzip the file and you can do that by navigating to your download folder and run: unzipO.MG_cable-Firmware_v1.4.0.zip
Then move into the new folder and you will see the following files.
The next step is to plug in the programmer in your computer and then plug in the cable into the programmer. You are now ready to flash your cable and you do that by running the flash_linux:
./flash_linux
You will be able to either program it into Station or Access Point mode. In this case just go by default (AP mode) by pressing Enter. When the flashing is done you are ready to use the cable.
Disconnect the programmer from your computer and plug in your cable. Wait for ~60 seconds and then connect to the cable via WiFi with the default credentials above. When you are connected to the cables wireless network you can open a web browser and browse to http://192.168.4.1 and you will get to the UI.
Now you are ready to run your first scripts. Good luck!
Yesterday a new version of Kali Linux were released, Kali 2020.1. You can download it here. Make sure that you have read the release notes to make sure that you don’t break anything you don’t want.
Upgrade your existing machine:
Run sudo apt full-upgrade -y
Wait for the job to finish.
Verify that you got the new version by running cat /etc/os-release
How to use undercover mode in Kali Linux 2020.1: Undercover mode is a new feature for version 2020.1 that will help you hide that you are a super elite hacker when you are out in public by temporarily changing the desktop to look like a Windows 10 machine. I’m not sure I see the real use cases for this but it’s actually a funny feature. To use it you just need to run kali-undercover.
After a few seconds you will see a Windows 10-like appearance, pretty cool.
This post is about httprobewhich is a tool for quickly probing for active http and https servers. If you have a list with subdomains you can quickly check which are active by using this tool. Httprobe is available on Github and the tool was created by Tom Hudson (@tomnomnom on Twitter).
2. Download ‘httprobe’ by running go get -u github.com/tomnomnom/httprobe
3. If you used my guide to install Go you can now find ‘httprobe’ at: /root/go-workspace/bin/assetfinder
Basic usage: To use httprobe you need to print out your domains and pipe them to httprobe. In the example below we are are using cat to read the data from domains.txt and gives its content as output to httprobe. cat domains.txt | httprobe
Adding extra ports: By default httprobe is probing for http on port 80 and https on port 443. We can add other ports by using the ‘-p’ parameter. cat domains.txt | httprobe -p http:8080 -p https:8443
Skip default ports and only probe for defined ports: By adding ‘-s’ parameter the default ports will be ignored. cat domains.txt | httprobe -s -p http:8080 -p https:8443
Specify a timeout: If you know that the response time on the target server might be high you can specify a custom timeout by using the ‘-t’ parameter. The time is configured in milliseconds. cat domains.txt | httprobe -t 10000
Combine with other tools: You can combine ‘httprobe’ with other tools such as ‘assetfinder’. If you don’t know about assetfinder you can read my earlier post that helps you getting started with assetfinder.
One example on how you can chain assetfinder with httprobe. assetfinder --subs-only yahoo.com | httprobe -s -p http:80 In the example we first searched for subdomains at yahoo.com and piped the result to httprobe to find out which of the subdomains that were listening on port 80.
Golang (Go) is a programming language that are becoming more and more popular and I have seen many interesting tools that are written in Go. Since Go are not being installed by default in Kali Linux I thought that publishing a quick-start guide could be a good idea.
Download the latest version for Linux – “gox.xx.x.linux-amd64.tar.gz”
Open your terminal and navigate to your downloads folder cd /root/Downloads
Extract the files tar -C /usr/local/ -xzf go1.13.6.linux-amd64.tar.gz
Add variables for GO by modifying “~/.bashrc” vim ~/.bashrc Add the following paths to the end of the file export GOPATH=/root/go-workspace export GOROOT=/usr/local/go PATH=$PATH:$GOROOT/bin/:$GOPATH/bin
Now we need to refresh the bashrc to get the updated variables source ~/.bashrc
Now we just need to verify that everything is correct configured and we can do that by creating a simple ‘hello world’ program in Go. vim helloworld.go Add the following code to the file: package main import "fmt" func main() { fmt.Printf("Hello world!\n") } Then save the file and try to run the program: go run helloworld.go If everything was configured correctly you should see something like this: You are now ready to use Golang on your Kali Linux machine!
Have you just created your first Azure VM and are looking for a good, secure way to connect to you new machine without exposing more than necessary to the internet? Maybe you just want to run a few machines and don’t want to spend money on firewalls to configure VPN to your Azure Virtual Network (VNET)?
In this post I will explain a method that can be used to connect to your machine securely without any cost. After reading this post you will know how you can set up a SSH tunnel to your machine so you only need to expose TCP port 22 to the internet. I will also show you how you can limit the access to that port by configuring a Network Security Group (NSG) in Microsoft Azure to only allow your own IP to connect. You will connect to the VM using Putty and either Google Chrome or Mozilla Firefox. We start off by configuring the NSG in Azure.
Configuring NSG in Azure: The first thing that we need to do is to allow you to SSH to your machine and we do that by configuring the NSG. You want to modify the inbound security rule named ‘default-allow-ssh’ and you do that by clicking on ‘Inbound security rules’ in the left menu.
You should now add your public IP to the rule to allow you to connect from your home network. You probably know how to get your public IP but if you don’t know, one simple way is by visiting https://ipinfo.io and copy the address from there.
When you have the IP ready, click on the ‘default-allow-ssh’-rule to expand it and then add your IP to ‘Source IP addresses/CIDR ranges’ and press ‘Save’.
The Azure configuration is now done. Lets move on to the Putty configuration.
Configuring Putty: If you don’t have Putty installed you can download it from the official website and then just install it. After you have installed the software the first step is to run Putty and add the public IP of your Azure VM and select SSH port 22.
Then navigate to SSH and check ‘Don’t start a shell or command at all’.
Move on by expanding SSH (+) and go to Tunnels. Add a forwarded port by choosing ‘Source port’. In this example we use port 1080. Select ‘Dynamic’ for destination and then press ‘Add’. Now you should see ‘D1080’ added above.
If you don’t want to configure these settings every time you want to use the tunnel you can save the session. That is done by going back to ‘Session’ and enter a name and then press ‘Save’.
Now the tunnel is ready and we just need to start it. Click on ‘Open’, enter your SSH credentials and press enter and the tunnel should be up and running.
Verify that the tunnel works: You will probably want to make sure that the tunnel works as expected and we can verify that by configuring a simple HTTP server on the VM. In this example CentOS7 was used but it can be done on most machines.
Step one is to open another putty window and connect to you VM via SSH. Navigate to your home folder (cd /home) and create a directory (mkdir testfolder). Cd into that folder and create a testfile (touch text.txt). Then run the following command to run a python based HTTP-server on port 80.
sudo python -m SimpleHTTPServer 80
Your server will now listen for incoming connections on port 80. But since you don’t allow any connections to port 80 in the NSG you won’t be able to go directly to port 80. We need to send our HTTP traffic in the SSH tunnel to be able to reach it and we do that by configuring proxy settings in our web browser. This can be done in most of the common browsers and I will show you how to do it in Firefox and Chrome.
Chrome: To configure proxy for Chrome you just right click on Chrome in the task bar and select ‘Properties’. You then need to add some run parameters.
