Q - Geek Memos

Privilege Escalation

We use PowerUp and SharpUp to identify a privilege escalation opportunity. Then, we use msfvenom to exploit it.

Android P: Private DNS

Android Pie, or P, offers the ability to use the DNS-over-TLS capable DNS servers of your choice. This also solves the problem of having to install third party applications to change the phone's default DNS servers without dealing with the mess of manual configurations.

Send Messages to Keybase Team Channels

Lets get straight to the point. I wanted to send output of a script sent to a keybase team channel. Typically, you'll send a message in kebyase like this: kebyase chat send <team, topic, or receipient> "message" Not bad huh?

CEH was too easy

Certified Ethical Hacker exam was just too easy. I took it in December and passed with only 2 days of prep. I used Boson exam simulations which pretty much covered everything that was on the exam 125 multiple choice questions varied on topics such

Ransomware and Healthcare Organizations

The Office for Civil Rights OCR seems to consider all ransomware events a breach unless proven otherwise. This is because successful ransomware incidents affect all three aspects of data security (Confidentiality, Integrity, and Availability). Specifically: Confidentiality: Ransomware gained access to your data and encrypted

Lessons from BSides ATL and ISSA GA

BSides Atlanta: Ransomware is adapting to evade countermeasures Train your users to identify phishing emails Manually test your backups at least monthly or depending on how many days worth of data you are willing to lose How do I recover from a ransomware outbreak?

A Healthy Dose of Ransomware

Healthcare continue to be a prime target for ransomware. All hospitals, small and large, seem to be on a hit list. Hospitals around the U.S. are reporting ransomware incidents. In fact, HHS has stepped in with its guidelines on ransomware and claims a

Stop Using MS Word/Excel "Restrict Editing" Option

Clarification: These methods only work for documents that are "restricted for editing". It does not work for files that are "password encrypted". Microsoft Word stores passwords hashes and salts inside the document. Method 1: Rename filename.docx file extension to

Let's Talk Crypto

Cryptography is big part of today's information security. Hence, it is important to know at least the basics. So, let's begin with some terms and their definitions. Cryptography: The art and science of making secret codes. Cryptanalysis: Analysis of secret codes. In other words,

DNS

Investigating a DNS DDoS Attack

Update: AT&T sent me a new modem which gave me a new IP address. All is fine now :) ORIGINAL POST: Last night I began noticing extreme slowness in traffic bound to Google Play Store. Strangely enough, all other network traffic was fine.

attacks

Root DNS Servers Experienced DDoS Attack with 5 Million Queries per Second

A report from Root [DNS] Server Operations or rootops published on December 4th, 2015 stated that the Internet Domain Name System’s root name servers received a high rate of DNS queries over two separate intervals. The incidents occurred on November 30, 2015 and

Android

Big day for exploits

Nearly 90 percent of Android devices vulnerable to endless reboot bug.- Exploits a flaw in Android media players when running .mkv files only. The vulnerability affects Android versions 4.0.1 to 5.1.1 Google has already patched the vulnerability. http://www.

bind

Bind DNS Server major flaw could let a script kiddie bring down large number of DNS servers

BIND is most widely used DNS Server to date. A major flaw was found in BIND’s versions from 9.1.0 to 9.8.x, 9.9.0 to 9.9.7-P1, and 9.10.0 to 9.10.2-P2. (CVE-2015-5477) Attackers can

Network Tap with Netgear GS108T

After attending BSides Chicago 2015 and hearing all the good things about Security Onion, I decided to give Security Onion a try. Now, I’ve got Google Fiber with blazing fast speeds (oh yes), so I did not want to use a 10/100

anonymity

Internet Anonymity Pros and Cons

Anonymity over the Internet has largely helped journalists escape clinching firewalls and surveillance of their governments. In fact, Freedom of the Press Foundation recommends use of The Onion Router (TOR) to better protect journalists’ from surveillance and in many instances prison (Lee, 2013). Anonymity

idps

OSSEC Alert On New Files

A colleague came to me today complaining about how tons of malicious .php files are showing up in his Apache directory. After talking to him about vulnerability testing against his

dns

Automate DNS Zone Transfer

/bin/bash #Simple zone transfer bash script with $1 being first argument given #Tested against zonetransfer.me #for example ./zonetransfer.sh zonetransfer.me if [ -z "$1" ];then echo "[] Simple Zone Transfer script" echo "[] Usage : $0 " exit 0 fi

bot

Reddit Bot

!/usr/bin/python """ This bot searches a subreddit for specified keyword and sends an email notification to defined address. Use at your own risk. No warranty ^_^ Got suggestions? Have it your way """ # following are required and must be

nmap

TCP Connect Scan using Python

########################################################################### # # Need Python version 2.x, scapy, and python module sys installed on system # Usage: python tcpConnect.py [hostname] [port] # For example: python tcpConnect.py google.com 80 # https://github.com/qasimchadhar/portScan/blob/master/tcpConnect.py # ########################################################################### from socket import * import logging logging.getLogger("

blogs

Google's No Captcha reCaptcha Breakable?

Egor Homakov of Sakurity claims, I’d say proved, that Google’s No Captcha reCaptcha might not be as bot proof as we thought. Due to reCAPTCHA’s reliance on

anonymity

TOR Network Compromised

Reports are coming in that TOR network has been compromised. @torproject issued a warning, Possible upcoming attempts to disable the Tor network https://t.co/XRcpy2fX1f #Tor #anonymity #humanrights pic.twitter.com/akUTL8asbK — torproject (@torproject) December 19, 2014 First, #cthulhuSec’s mirrors were compromised.

nmap

Scanning North Korean Public IP space

via http://nknetobserver.github.io/ **Some noteworthy points:**- The allocated North Korean network range is 175.45.176.0/22 - 210.52.109.0 – 210.52.109.255 block is assigned to North Korea through Chinese company China Unicom - 77.94.

grep

Quick Nmap ping sweep and output to grep-able format

Start with laying out what range of IP addresses you want to scan. I’d suggest keeping it limited to your specific targets. Then run this as root: nmap -sn -v -oG nmapped.txt 192.168.1.201-254 -sn (No port scan) .This option

hacking

PingSweep with Scapy

Want to get a bit geekier with your ping sweeps? Python Scapy can be used to create, modify, send, and intercept network packets and any TCP/IP layer. Here is a simple ping sweep script with Python Scapy: !/usr/bin/python from scapy.all

bash

SNMPWALK against multiple IP address

For a recent test, I needed to perform multiple snmpwalk scans against a set of IP addresses. Instead of running each scan separately, I was able to write a bash script. Enjoy: for ip in $(cat snmpWindowsIPs.txt); do echo "----------------------------------------------------"; echo