Elvis Wiki - User contributions [en]

DTLS on SAM R21 Xplained Pro: Guide/Demo

2024-06-18T16:16:05Z

BVogler: removed a wrong line

== Summary ==
This article supplies the instructions to setup a DTLS connection by using RIOT-OS and the WolfSSL DTLS example provided by RIOT-OS. The first part guides the user in setting up two SAM R21 Xplained Pro microcontrollers using the example application and establish a connection between them using DTLS and RIOTs generic networking stack. The second part guides the user in setting up virtual native boards in RIOT and establish a DTLS-based connection between them. This is done to make capturing the DTLS packets possible via Wireshark.

== Requirements ==

You must have followed the [[Riot-OS Setup]] step 1, 2 and 3 before using this guide. It is assumed that RIOT-OS is installed to ~/RIOT/.

* Operating system: Ubuntu 24.04 (Note: This guide was created running Ubuntu as a Virtual Machine on Oracle VirtualBox 6.1)
* Packages: git python3

== Description ==

=== Step 1 ===
This step is an addition to the [[Riot-OS Setup]].

* Update your packages if you have not already done so.
sudo apt-get update
* Install the pyudev package
sudo apt-get install python3-pyudev
* Find out the serial numbers of your SAM R21 XPro devices and note them for later use
make list-ttys
* Open two additional terminals and connect to both devices by using their ttys. Adjust the code if your ttys differ.
cd RIOT/dist/tools/pyterm
./pyterm -p /dev/ttyACM0
./pyterm -p /dev/ttyACM1

=== Step 2 ===
Build the application and flash it onto both devices.

* Navigate to the folder containing the WolfSSL DTLS example in RIOT and build the application
cd RIOT/examples/dtls-wolfssl
make BOARD=samr21-xpro
* Flash the newly built application onto both devices using their serial numbers
make BOARD=samr21-xpro SERIAL="ATML21270318xxxxxxx" flash
make BOARD=samr21-xpro SERIAL="ATML21270318xxxxxxx" flash
* The example application is now running on both devices. Use command ''help'' to show the available options

[[File:DTLS-WolfSSL-Help.png|thumb|none|750px|WolfSSL DTLS Example Help Menu]]

=== Step 3 ===
Use the applications to setup a DTLS connection

* Use ''ifconfig'' on the device that is designated as the server and note the IPv6 address
* Start the DTLS Server
dtlss
* Use the DTLS Client to start the connection test
dtlsc IPv6-server-address

[[File:WolfDTLS-Connection.png|thumb|none|750px|WolfSSL DTLS Example Connection]]

== Capturing DTLS Traffic ==
If you want to capture and analyze the DTLS the packets using a packet sniffer, e.g. Wireshark, you have to use RIOT native boards, since SAM R21 XPro devices are not powerful enough to support packet capture with Wireshark on their own.

=== Wireshark Setup ===
Follow the steps to install Wireshark on Ubuntu 24.04, if necessary:
* Install Wireshark
sudo apt install wireshark
* When asked if non-superusers should be able to catpure packets answer "Yes".
* Add your user to the wireshark group to make capture possible
sudo usermod -a -G wireshark "$USER"
* Check if the wireshark group is present for your user
groups $USER
* Log out and log in or restart your system to apply the change.

=== Step 1 ===
Setup a virtual network for RIOT instances by using the ''Tapsetup''-tool.
* Navigate to the ''Tapsetup''-tool and create two virtual network taps and a virtual bridge
cd ~
cd RIOT/dist/tools/tapsetup
sudo ./tapsetup --create 2
* Build dtls-wolfdtls for RIOT native boards
cd ~
cd RIOT/examples/dtls-wolfssl
make all
* Setup the first virtual RIOT board
PORT=tap0 make term
* Setup the second virtual RIOT board using a second terminal
cd RIOT/examples/dtls-wolfssl
PORT=tap1 make term

=== Step 2 ===
Configure Wireshark to capture packets on either tap0, tap1 or tapbr0 (Bridge). This depends on which view is more interesting to you. In the following steps tap1 is used for capturing packets since the DTLS server is run on this Tap.
* Start Wireshark and set it to capture packets on the interface tap1
* Use the applications to setup a DTLS connection. First use ''ifconfig'' on one of the native boards. Note the IPv6 address and then use the following command to start the DTLS server:
dtlss
* Use this command on the other native board using the address noted previously:
dtlsc IPv6-server-address
* You should receive confirmation of a successful connection.

=== Step 3 ===
Analyze the captured traffic in Wireshark

[[File:WolfDTLS-Wireshark-Capture.png|thumb|none|750px|WolfSSL DTLS Example Wireshark Capture]]

== Used Hardware ==

* 2x [[Atmel SAM R21 Xplained Pro]]
* Connective cables (Micro USB B)

== Courses ==

* [[Riot-OS Setup]]

== References ==

* https://www.riot-os.org/
* https://www.wolfssl.com/

[[Category:Documentation]]

DTLS on SAM R21 Xplained Pro: Guide/Demo

2024-06-18T16:14:59Z

BVogler: minor corrections

Title: DTLS on SAM R21 Xplained Pro: Guide/Demo

== Summary ==
This article supplies the instructions to setup a DTLS connection by using RIOT-OS and the WolfSSL DTLS example provided by RIOT-OS. The first part guides the user in setting up two SAM R21 Xplained Pro microcontrollers using the example application and establish a connection between them using DTLS and RIOTs generic networking stack. The second part guides the user in setting up virtual native boards in RIOT and establish a DTLS-based connection between them. This is done to make capturing the DTLS packets possible via Wireshark.

== Requirements ==

You must have followed the [[Riot-OS Setup]] step 1, 2 and 3 before using this guide. It is assumed that RIOT-OS is installed to ~/RIOT/.

* Operating system: Ubuntu 24.04 (Note: This guide was created running Ubuntu as a Virtual Machine on Oracle VirtualBox 6.1)
* Packages: git python3

== Description ==

=== Step 1 ===
This step is an addition to the [[Riot-OS Setup]].

* Update your packages if you have not already done so.
sudo apt-get update
* Install the pyudev package
sudo apt-get install python3-pyudev
* Find out the serial numbers of your SAM R21 XPro devices and note them for later use
make list-ttys
* Open two additional terminals and connect to both devices by using their ttys. Adjust the code if your ttys differ.
cd RIOT/dist/tools/pyterm
./pyterm -p /dev/ttyACM0
./pyterm -p /dev/ttyACM1

=== Step 2 ===
Build the application and flash it onto both devices.

* Navigate to the folder containing the WolfSSL DTLS example in RIOT and build the application
cd RIOT/examples/dtls-wolfssl
make BOARD=samr21-xpro
* Flash the newly built application onto both devices using their serial numbers
make BOARD=samr21-xpro SERIAL="ATML21270318xxxxxxx" flash
make BOARD=samr21-xpro SERIAL="ATML21270318xxxxxxx" flash
* The example application is now running on both devices. Use command ''help'' to show the available options

[[File:DTLS-WolfSSL-Help.png|thumb|none|750px|WolfSSL DTLS Example Help Menu]]

=== Step 3 ===
Use the applications to setup a DTLS connection

* Use ''ifconfig'' on the device that is designated as the server and note the IPv6 address
* Start the DTLS Server
dtlss
* Use the DTLS Client to start the connection test
dtlsc IPv6-server-address

[[File:WolfDTLS-Connection.png|thumb|none|750px|WolfSSL DTLS Example Connection]]

== Capturing DTLS Traffic ==
If you want to capture and analyze the DTLS the packets using a packet sniffer, e.g. Wireshark, you have to use RIOT native boards, since SAM R21 XPro devices are not powerful enough to support packet capture with Wireshark on their own.

=== Wireshark Setup ===
Follow the steps to install Wireshark on Ubuntu 24.04, if necessary:
* Install Wireshark
sudo apt install wireshark
* When asked if non-superusers should be able to catpure packets answer "Yes".
* Add your user to the wireshark group to make capture possible
sudo usermod -a -G wireshark "$USER"
* Check if the wireshark group is present for your user
groups $USER
* Log out and log in or restart your system to apply the change.

=== Step 1 ===
Setup a virtual network for RIOT instances by using the ''Tapsetup''-tool.
* Navigate to the ''Tapsetup''-tool and create two virtual network taps and a virtual bridge
cd ~
cd RIOT/dist/tools/tapsetup
sudo ./tapsetup --create 2
* Build dtls-wolfdtls for RIOT native boards
cd ~
cd RIOT/examples/dtls-wolfssl
make all
* Setup the first virtual RIOT board
PORT=tap0 make term
* Setup the second virtual RIOT board using a second terminal
cd RIOT/examples/dtls-wolfssl
PORT=tap1 make term

=== Step 2 ===
Configure Wireshark to capture packets on either tap0, tap1 or tapbr0 (Bridge). This depends on which view is more interesting to you. In the following steps tap1 is used for capturing packets since the DTLS server is run on this Tap.
* Start Wireshark and set it to capture packets on the interface tap1
* Use the applications to setup a DTLS connection. First use ''ifconfig'' on one of the native boards. Note the IPv6 address and then use the following command to start the DTLS server:
dtlss
* Use this command on the other native board using the address noted previously:
dtlsc IPv6-server-address
* You should receive confirmation of a successful connection.

=== Step 3 ===
Analyze the captured traffic in Wireshark

[[File:WolfDTLS-Wireshark-Capture.png|thumb|none|750px|WolfSSL DTLS Example Wireshark Capture]]

== Used Hardware ==

* 2x [[Atmel SAM R21 Xplained Pro]]
* Connective cables (Micro USB B)

== Courses ==

* [[Riot-OS Setup]]

== References ==

* https://www.riot-os.org/
* https://www.wolfssl.com/

[[Category:Documentation]]

DTLS on SAM R21 Xplained Pro: Guide/Demo

2024-06-18T14:21:12Z

BVogler: first version

== Summary ==
This article supplies the instructions to setup a DTLS connection demonstration by using RIOT-OS and the WolfSSL DTLS example provided by RIOT-OS. The first part guides the user in setting up two SAM R21 Xplained Pro microcontrollers using the example application to connect using DTLS. The second part guides the user in setting up virtual boards in RIOT. This is done to make capturing the DTLS packets possible.

== Requirements ==

You must have followed the [[Riot-OS Setup]] step 1, 2 and 3 before using this guide. It is assumed that RIOT-OS is installed to ~/RIOT/.

* Operating system: Ubuntu 24.04 (Guide was created running a VM on Oracle VirtualBox 6.1)
* Packages: git python3

== Description ==

=== Step 1 ===
This step is an addition to the [[Riot-OS Setup]].

* Update your packages if you have not already done this.
sudo apt-get update
* Install the pyudev package
sudo apt-get install python3-pyudev
* Find out the serial numbers of your SAM R21 XPro devices and note them for later use
make list-ttys
* Open two additional terminals and connect to both devices by using their ttys. (Adjust the code if your ttys differ)
cd RIOT/dist/tools/pyterm
./pyterm -p /dev/ttyACM0
./pyterm -p /dev/ttyACM1

=== Step 2 ===
Build the application and flash it on both devices.

* Navigate to the folder containing the WolfSSL DTLS example in RIOT and build the application
cd RIOT/examples/dtls-wolfssl
make BOARD=samr21-xpro
* Flash the newly built application onto both devices using their serial numbers
make BOARD=samr21-xpro SERIAL="ATML21270318xxxxxxx" flash
make BOARD=samr21-xpro SERIAL="ATML21270318xxxxxxx" flash
* The example application is now running on both devices. Use command ''help'' to show the available options

[[File:DTLS-WolfSSL-Help.png|thumb|none|750px|WolfSSL DTLS Example Help Menu]]

=== Step 3 ===
Use the applications to setup a DTLS connection

* Use ''ifconfig'' on the device that is designated as the server and note the IPv6 address
* Start the DTLS Server
dtlss
* Use the DTLS Client to start the connection test
dtlsc IPv6-server-address

[[File:WolfDTLS-Connection.png|thumb|none|750px|WolfSSL DTLS Example successful Connection]]

== Capturing DTLS Traffic ==
If you want to capture and analyze the DTLS the packets using a packet sniffer, e.g. Wireshark, you have to use RIOT native boards. SAM R21 XPro devices are not powerful enough to support packet capture with Wireshark on their own.

=== Wireshark Setup ===
Follow the steps to install Wireshark on Ubuntu 24.04, if necessary:
* Install Wireshark
sudo apt install wireshark
* When asked if non-superusers should be able to catpure packets answer "Yes".
* Add user to the wireshark group to make capture possible
sudo usermod -a -G wireshark "$USER"
* Check if the wireshark group is present for your user
groups $USER

=== Step 1 ===
Setup a virtual network for RIOT instances by using the Tapsetup tool.
* Navigate to the Tapsetup tool and create two virtual network taps and a virtual bridge
cd ~
cd RIOT/dist/tools/tapsetup
sudo ./tapsetup --create 2
* Build dtls-wolfdtls for RIOT native boards
cd ~
cd RIOT/examples/dtls-wolfssl
make all
* Setup the first virtual RIOT board
PORT=tap0 make term
* Setup the second virtual RIOT board using a second terminal
cd RIOT/examples/dtls-wolfssl
PORT=tap1 make term

=== Step 2 ===
Configure Wireshark to capture packets on either tap0, tap1 or tapbr0 (Bridge). This depends on which view is more interesting to you. In the following steps tap1 is used for capturing packets.
* Start Wireshark and set it to capture packets on interface tap1
* Use the applications to setup a DTLS connection. First use ''ifconfig'' and note the IPv6 address of the designated server application. Then use the following commands to setup the connection:
dtlss
dtlsc IPv6-server-address

=== Step 3 ===
Analyze the captured traffic in Wireshark

[[File:WolfDTLS-Wireshark-Capture.png|thumb|none|750px|WolfSSL DTLS Example Wireshark Capture]]

== Used Hardware ==

* 2x [[Atmel SAM R21 Xplained Pro]]
* Connective cables (Micro USB B)

== Courses ==

* [[Riot-OS Setup]]

== References ==

* https://www.riot-os.org/
* https://www.wolfssl.com/

[[Category:Documentation]]

File:WolfDTLS-Wireshark-Capture.png

2024-06-18T14:15:11Z

BVogler: Screenshot of Wireshark capturing DTLS 1.2 packets generated by using the WolfSSL DTLS example provided in RIOT-OS. Applications are running on RIOT native boards.

== Summary ==
Screenshot of Wireshark capturing DTLS 1.2 packets generated by using the WolfSSL DTLS example provided in RIOT-OS. Applications are running on RIOT native boards.

File:WolfDTLS-Connection.png

2024-06-18T14:13:32Z

BVogler: Screenshot of successful DTLS connection using the WolfSSL DTLS example application provided in RIOT-OS

== Summary ==
Screenshot of successful DTLS connection using the WolfSSL DTLS example application provided in RIOT-OS

File:DTLS-WolfSSL-Help.png

2024-06-18T14:12:45Z

BVogler: Screenshot of the Help Menu provided by the WolfSSL DTLS example in RIOT-OS.

== Summary ==
Screenshot of the Help Menu provided by the WolfSSL DTLS example in RIOT-OS.

DTLS on SAM R21 Xplained Pro: Guide/Demo

2024-06-18T11:46:37Z

BVogler: init

== Summary ==

Description what this documentation is about.

== Requirements ==

* Operating system: Ubuntu 18.04 bionic amd64
* Packages: git emacs

In order to complete these steps, you must have followed [[Some Other Documentation]] before.

== Description ==

=== Step 1 ===

Enter these commands in the shell

echo foo
echo bar

=== Step 2 ===

Make sure to read

* War and Peace
* Lord of the Rings
* The Baroque Cycle

== Used Hardware ==

[[Device to be used with this documentation]]
[[Maybe another device to be used with this documentation]]

== Courses ==

* [[A course where this documentation was used]] (2017, 2018)
* [[Another one]] (2018)

== References ==

* https://wikipedia.org
* https://google.com

[[Category:Documentation]]

STM32MP157C: Security Overview

2023-02-24T21:57:03Z

File:Meterpreter List Scripts.png

2023-01-03T14:56:35Z

BVogler:

File:Meterpreter Scripts.png

2023-01-03T14:54:25Z

BVogler: BVogler uploaded a new version of File:Meterpreter Scripts.png

Meterpreter

2023-01-03T14:49:40Z

BVogler: fixed formatting

== Summary ==
Meterpreter, short for Meta-Interpreter, is a dynamically extendable attack payload included in the Metasploit penetration testing Framework. The payload was developed by Matt Miller under the hacker moniker of Skape and is used in the post-exploitation phase after gaining access to the targeted system. Meterpreter provides a powerful interactive command line interface (CLI) and avoids the risk of being exposed. Running it does not alert intrusion detection systems, like starting a standard shell process will, because it is strictly executed from working memory. Meterpreter does not need a separate process to execute because it is injected into a currently running process. This also means it is executed from memory only, which makes it even harder to detect for Anti-Virus software. Meterpreter provides a variety of commands, additional modules and scripts available to aid in further exploitation. Because it is integrated into the Metasploit Framework it can use its post-exploitation modules as well.

== Meterpreter Basics ==
Meterpreter is supposed to give the attacker access to a command interpreter on the target machine that offers powerful post-exploitation tools and is also hard to detect with forensic tools. For this Meterpreter was designed with the three goals of being stealthy, powerful and extensible.

=== Meterpreter Design Goals ===
==== Stealthy ====
* Meterpreter is designed to operate in working memory and never write to the physical disk.
* Meterpreter operates inside running processes and can be migrated to other processes.
* Meterpreter uses encrypted communication.

==== Powerful ====
* Meterpreter utilizes a channelized communication system.
* The TLV (Type-Length-Value) protocol has few limitations.

==== Extensible ====
* Meterpreter can be augmented at runtime. Extensions, modules and scripts can be loaded over the network connection.
* The Meterpreter session does not have to be rebuilt every time new features are added.

=== How does Meterpreter work? ===
Prerequisite: The target system is already exploited and remote access is established.
# Meterpreter payload, also called the initial stager, is sent to the target system.
# Compromised system executes the initial stager, usually bind_tcp, reverse_tcp, etc.
# The stager loads the needed libraries, the Meterpreter core initializes and established a TLS connection to the attacking system.
# Meterpreter sends a GET request which Metasploit receives and then configures the client.
# Meterpreter loads the default extensions ('''stdapi''', '''priv'''). The extensions are loaded over the TLS connection using a TLV (Type-Length-Value) protocol.

== Meterpreter Features ==
The Meterpreter CLI is similar to standard shells (sh, zsh, etc.) and provides system, file system and networking commands identical to them (cd, cat, rm, pwd, etc.). Meterpreter also provides additional basic commands, some of which can be seen in the table below, additional commands provided by the default extensions and more commands can be added by loading other extensions.

=== Basic Commands ===
A selection of commonly used Meterpreter commands can be found in the table below.
{| class="wikitable"
|-
! Command
! Description
|-
| background
| Moves the current Meterpreter session to the background giving the user access to the Metasploit command line.
|-
| sessions -i ''ID''
| Reactivates the specified session. Using the command without a switch displays all active sessions.
|-
| clearev
| Deletes all application, system and security logs on the victim machine. Only works for Windows systems.
|-
| execute
| Executes a command on the remote machine specified by the '-f' switch. The executed command can be supplied with arguments by using '-a'.
|-
| getsystem
| This attempts to elevate the current Meterpreter session to system administrator level of authorization.
|-
| getuid
| Displays the user identification of the user the current Meterpreter session is running as.
|-
| hashdump
| Prints all available usernames and their password hashes, making them available for further manipulation like password cracking using additional software or rainbow tables.
|-
| help
| Shows the Meterpreter help menu consisting of a comprehensive list of commands. This menu expands if more extensions are loaded.
|-
| ipconfig
| Prints the network configuration of the target machine in Windows display style.
|-
| migrate
| Migrates the Meterpreter session to the process given as a parameter. This allows further exploitation of the system from within the new process. This should be done to avoid getting thrown out by the user closing the process that served as entry point.
|-
| ps
| Prints a non-interactive list of the currently running processes on the target machine including process IDs, usernames of the process owners and the path to the executables.
|-
| search
| Searches the system for a file specified by the -f switch. The provided filename may contain wildcards.
|-
| sysinfo
| Prints the target machines name, operating system (including build and service pack if applicable), the architecture of the operating system, the system language, the domain name and the number of currently logged in users.
|}

=== Extensions ===
Meterpreter extensions are loaded by using the '''load'''-command. Two Extensions are loaded by default:
* '''priv''': This extension is used for privilege escalation
* '''stdapi''': This extension supplies core Meterpreter commands like ''getuid''
Other frequently used extensions include:
* '''kiwi''': This extension is used to obtain user credentials and authentication tokens which are retrieved from system memory. This makes it possible for passwords to be displayed in cleartext. In the past the extension was named '''mimikatz'''.
* ''' python ''': This extension allows the execution of python scripts on the target machine.
* ''' powershell ''': This extension allows the execution of powershell scripts on the target machine.

=== Scripts & Modules ===
Meterpreter includes pre-made scripts for various purposes which are run by using the '''run'''-command. The payload includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Part of the scripts seen in the figure below are now considered deprecated. This is because they are now integrated into the Metasploit Framework as post-exploitation modules. The Meterpreter session can be put into the background to run these modules.
[[File:Meterpreter Scripts.png|thumb|none|750px|Meterpreter Scripts]]

== Sources ==
* D. Kennedy, J. O’Gorman, D. Kearns, and M. Aharoni. Metasploit: The Penetration Tester’s Guide. No Starch Press Series. No Starch Press, 2011.
* M. Miller. Meterpreter specifications. http://www.hick.org/code/skape/papers/meterpreter.pdf, 2004. Accessed: 2022-09-14.
* Metasploit Unleashed free ethical hacking course. https://www.offensive-security.com/metasploit-unleashed/. Accessed: 2022-11-05.
* Michael Messner. Hacking mit Metasploit. dpunkt.verlag, 3rd edition, 2017.

[[Category:Documentation]]

Meterpreter

2023-01-03T14:01:34Z

BVogler: further modification of the article, fixed typos

== Summary ==
Meterpreter, short for Meta-Interpreter, is a dynamically extendable attack payload included in the Metasploit penetration testing Framework. The payload was developed by Matt Miller under the hacker moniker of Skape and is used in the post-exploitation phase after gaining access to the targeted system. Meterpreter provides a powerful interactive command line interface (CLI) and avoids the risk of being exposed. Running it does not alert intrusion detection systems, like starting a standard shell process will, because it is strictly executed from working memory. Meterpreter does not need a separate process to execute because it is injected into a currently running process. This also means it is executed from memory only, which makes it even harder to detect for Anti-Virus software. Meterpreter provides a variety of commands, additional modules and scripts available to aid in further exploitation. Because it is integrated into the Metasploit Framework it can use its post-exploitation modules as well.

== Meterpreter Basics ==
Meterpreter is supposed to give the attacker access to a command interpreter on the target machine that offers powerful post-exploitation tools and is also hard to detect with forensic tools. For this Meterpreter was designed with the three goals of being stealthy, powerful and extensible.

=== Meterpreter Design Goals ===
==== Stealthy ====
* Meterpreter is designed to operate in working memory and never write to the physical disk.
* Meterpreter operates inside running processes and can be migrated to other processes.
* Meterpreter uses encrypted communication.

==== Powerful ====
* Meterpreter utilizes a channelized communication system.
* The TLV (Type-Length-Value) protocol has few limitations.

==== Extensible ====
* Meterpreter can be augmented at runtime. Extensions, modules and scripts can be loaded over the network connection.
* The Meterpreter session does not have to be rebuilt every time new features are added.

=== How does Meterpreter work? ===
Prerequisite: The target system is already exploited and remote access is established.
# Meterpreter payload, also called the initial stager, is sent to the target system.
# Compromised system executes the initial stager, usually bind_tcp, reverse_tcp, etc.
# The stager loads the needed libraries, the Meterpreter core initializes and established a TLS connection to the attacking system.
# Meterpreter sends a GET request which Metasploit receives and then configures the client.
# Meterpreter loads the default extensions ('''stdapi''', '''priv'''). The extensions are loaded over the TLS connection using a TLV (Type-Length-Value) protocol.

== Meterpreter Features ==
The Meterpreter CLI is similar to standard shells (sh, zsh, etc.) and provides system, file system and networking commands identical to them (cd, cat, rm, pwd, etc.). Meterpreter also provides additional basic commands, some of which can be seen in the table below, additional commands provided by the default extensions and more commands can be added by loading other extensions.

=== Basic Commands ===
A selection of commonly used Meterpreter commands can be found in the table below.
{| class="wikitable"
|-
! Command
! Description
|-
| background
| Moves the current Meterpreter session to the background giving the user access to the Metasploit command line.
|-
| sessions -i 'ID'
| Reactivates the specified session. Using the command without a switch displays all active sessions.
|-
| clearev
| Deletes all application, system and security logs on the victim machine. Only works for Windows systems.
|-
| execute
| Executes a command on the remote machine specified by the '-f' switch. The executed command can be supplied with arguments by using '-a'.
|-
| getsystem
| This attempts to elevate the current Meterpreter session to system administrator level of authorization.
|-
| getuid
| Displays the user identification of the user the current Meterpreter session is running as.
|-
| hashdump
| Prints all available usernames and their password hashes, making them available for further manipulation like password cracking using additional software or rainbow tables.
|-
| help
| Shows the Meterpreter help menu consisting of a comprehensive list of commands. This menu expands if more extensions are loaded.
|-
| ipconfig
| Prints the network configuration of the target machine in Windows display style.
|-
| migrate
| Migrates the Meterpreter session to the process given as a parameter. This allows further exploitation of the system from within the new process. This should be done to avoid getting thrown out by the user closing the process that served as entry point.
|-
| ps
| Prints a non-interactive list of the currently running processes on the target machine including process IDs, usernames of the process owners and the path to the executables.
|-
| search
| Searches the system for a file specified by the -f switch. The provided filename may contain wildcards.
|-
| sysinfo
| Prints the target machines name, operating system (including build and service pack if applicable), the architecture of the operating system, the system language, the domain name and the number of currently logged in users.
|}

=== Extensions ===
Meterpreter extensions are loaded by using the '''load'''-command. Some Extensions are loaded by default like the '''priv'''-extension which is used for privilege escalation and the '''stdapi'''-extension which supplies basic Meterpreter commands like '''getuid'''. Frequently used extensions include:
* '''kiwi''' (formerly mimikatz): This extension is used to obtain user credentials and authentication tokens. These are retrieved directly from target systems memory. Passwords can even be displayed directly in cleartext.
* ''' python ''': This extensions allows the execution of python scripts on the target machine.
* ''' powershell ''': This extensions allows the execution of powershell scripts on the target machine.

=== Scripts & Modules ===
Meterpreter includes pre-made scripts for various purposes which are run by using the '''run'''-command. The payload includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Part of the scripts seen in the figure below are now considered deprecated. This is because they are now integrated into the Metasploit Framework as post-exploitation modules. A Meterpreter session can be put into the background to run these modules.
[[File:Meterpreter Scripts.png|thumb|none|750px|Meterpreter Scripts]]

== Sources ==
* D. Kennedy, J. O’Gorman, D. Kearns, and M. Aharoni. Metasploit: The Penetration Tester’s Guide. No Starch Press Series. No Starch Press, 2011.
* M. Miller. Meterpreter specifications. http://www.hick.org/code/skape/papers/meterpreter.pdf, 2004. Accessed: 2022-09-14.
* Metasploit Unleashed free ethical hacking course. https://www.offensive-security.com/metasploit-unleashed/. Accessed: 2022-11-05.
* Michael Messner. Hacking mit Metasploit. dpunkt.verlag, 3rd edition, 2017.

[[Category:Documentation]]

Metasploit with Armitage

2022-11-18T13:37:18Z

BVogler: removed dead link

== Summary ==

This documentation describes how to use Armitage GUI with the Metasploit Framework.

Armitage is a Java-based graphical user interface and serves as a free frontend for the Metasploit Framework. The software was first developed by Raphael Mudge in 2013. It is used for the visualization of vulnerable systems, provides suitable exploits and tools for post-exploitation. Access on a single Metasploit RPC instance is possible through multiple Armitage clients. Therefore, teamwork is possible sharing same data, i.e. workspaces and sessions with common event logs. Armitage is a Team Red cooperation, a group of moral hackers (White Hats), whose declared goal is to detect security vulnerabilities before they can be discovered and exploited by destructive hackers (Black Hats). In addition to such projects, the American company offers security audits as well as customized training.

== Requirements ==

* Operating system: Kali Linux amd64 2019.2
* Packages: Metasploit Framework

In order to complete these steps, you should have followed [[Metasploit Framework MSF]] before.

== Attack Process ==

[[File:Ablauf.PNG|thumbnail|upright]]

Armitage is able to perform network scans via NMAP but the import of data from external tools is also supported. Hosts are displayed within a GUI workspace. Afterwards the hosts can be compared with the exploit database provided by Metasploit. If no matching exploits can be found, a so-called Hail Mary Attack is possible. In this case, all available exploits from the database are executed without necessary knowledge of the target system. However, this method leaves traces in the network or on hosts. After a successful attack the available post exploitation tools can be used. Once the necessary rights to the system have been obtained or already existed (root exploit), keyloggers can be installed or existing password hash files can be read from the file system. The execution of remote shells is also possible, e.g.: the installation of further malware. Especially interesting is the possibility to use pivot systems, these are systems that have already been compromised within a network and are used for further attacks in the local network. For this purpose Armitage offers support for the SOCKS proxy modules provided by the Metasploit Framework.

== First Start ==

After successful login to our kali linux desktop, the Armitage GUI can be started as follows.

Select 08 - Exploitation Tools - armitage:

[[File:Armitage01.PNG]]

Afterwards start with the 'Connect' Button:

[[File:Armitage02.png]]

If the metasploit RPC service was not started already, start it with 'Yes':

[[File:Armitage03.PNG]]

There is a specific error occurring sometimes when starting Armitage. This has to do something with the msf database. To fix it, type the following commands in the terminal: "systemctl start postgresql" and "msfdb init". These commands start the database that Armitage is using and so fix the error.

On the following screenshot you can see the user interface of Armitage.

[[File:ArmitageUI.jpg|700px]]

There are three main sections we can work with: modules, targets and tabs.

'''Modules:'''

The modules section can be found on the top left corner of the user interface. It is a file system that lets you navigate through the 4 main modules: auxiliary, exploit, payload and post. Using this tree structured file system we can run auxiliary modules -such as scanning-, exploits, generate payloads and run post-exploitation modules just by selecting and double clicking on the desired module.

'''Targets:'''

The targets panel is right next to the modules section. It is a blank area now, but once we do network scan, the available devices will be displayed here. Each target host is shown as a computer icon, represented with its IP address and some other available information, such as the operating systen.

'''Tabs:'''

The tabs panel shows the operations that has been performed on a host. It is located on the bottom of the user interface. These tabs have different functionalities, but what they have in common is that they somehow allow the attacker to manually perform various types of interaction on the selected hosts. Attacks can be performed either through a command line (Meterpreter), where the user types and executes different commands. They can also be executed by selecting an attack in the targets section, whose results will be displayed in a new tab.

== Example Attack with Armitage ==

Afterwards we will show an example attack with the Armitage GUI.

=== Network Discovery with NMAP ===

Start with an NMAP 'Intense Scan' within your local network. This will scan for services on well known ports and provides service and os detection. After selecting the scanner type, a pop-up will appear, in which we will have to specify the IP address range what the scanner is going to search through. The bigger the address range is the more time it will take to finish the scan.

[[File:Armitage04.PNG]]

Afterwards detected hosts will be shown in your workspace:

[[File:Armitage05.PNG]]

You can check services with a right click on the host:

[[File:Workspace03.PNG]]

=== Attack ProFTPD Service ===

For our demonstration we will use the Exploit CVE-2015-3306, a well known vulnerability in the mod_copy module of ProFTPD.

With a right click on the host, the Exploit 'proftpd_mod_copy' can be selected and executed:

[[File:Workspace04.PNG]]

After a successful attack the host picture will look as follows:

[[File:Workspace05.PNG]]

Now we can use the active session for a remote shell:

[[File:Workspace06.PNG]]

We now have access to the remote host, so we should start exploring and looting. We can use post-exploitation modules from the modules panel to interact with the compromised host. Firstly, we could try dumping hashes, cookies, browsing files in hope for valuable information. Furthermore, we could set up keyloggers, take screenshots or if available, take pictures using the webcamera.

== References ==

* https://www.redteamsecure.com/
* https://www.offensive-security.com/metasploit-unleashed/
* http://www.proftpd.org/docs/

[[Category:Documentation]]

Meterpreter

2022-11-18T13:31:39Z

BVogler: re-design of article, added missing category tag

== Summary ==
Meterpreter, which is short for Meta-Interpreter, is an attack payload included in the Metasploit Framework. It was developed by Matt Miller under the hacker moniker of Skape. It is used in the post-exploitation phase after an exploit was already used to gain access to a system. It provides a more powerful interactive command line interface (CLI) than a regular shell and also avoids the risk of being exposed since starting a regular shell process could alert the system to intrusion. Meterpreter does not need a separate process to execute since it is injected into a process already running on the target system. This also means it is executed from memory only, which makes it even harder to detect for Anti-Virus software. Meterpreter has a wide variety of commands, additional modules and scripts available for further exploiting a system. Since it is integrated into the Metasploit Framework it can use its post-exploitation modules as well.

== Meterpreter Basics ==
=== How does Meterpreter work? ===
# Target system is compromised using an exploit.
# Compromised system executes the initial Meterpreter payload also called stager (bind_tcp, reverse_tcp, ...)
# The stager loads the needed DLLs, the Meterpreter core initializes and established a TLS connection to the attacking system.
# Meterpreter sends a GET request which Metasploit receives and configures the client.
# Meterpreter loads the default extensions (stdapi and priv) over the TLS connection by using the TLV (Type-Length-Value) protocol.

=== Meterpreter Design Goals ===
Meterpreter is supposed to give the attacker access to a command interpreter on the target machine that offers powerful post-exploitation tools and is also hard to detect with forensic tools. To achieve this goal three requirements had to be met.

==== Stealthy ====
The payload had to be stealthy and hard to detect.
* Meterpreter is designed to operate in working memory and never write to the physical disk.
* Meterpreter operates inside running processes and can be migrated to other processes.
* Meterpreter uses encrypted communication.

==== Powerful ====
The user rights on the target system can be elevated using privilege escalation.
* Meterpreter utilizes a channelized communication system.
* The TLV (Type-Length-Value) protocol has few limitations.

==== Extensible ====
Meterpreter had to be extensible to adapt to different requirements.
* Meterpreter can be augmented at runtime. Extensions, modules and scripts can be loaded over the network connection.
* The Meterpreter session does not have to be rebuilt every time new features are added.

== Meterpreter Features ==
The Meterpreter CLI offers standard commands that are also used in shells like '''sh''' and '''zsh'''. Additional commands are loaded by default and can be added by loading extensions.

=== Basic Commands ===
Commonly used Meterpreter commands can be found in the table below.
{| class="wikitable"
|-
! Command
! Description
|-
| background
| Moves the current Meterpreter session to the background letting the user use the Metasploit command line.
|-
| sessions -i ID
| Reactivates the specified session. Using the command without a switch shows all active sessions.
|-
| clearev
| Deletes all Application, System and Security logs on the victim machine. Only works for Windows systems.
|-
| execute
| Executes a command on the remote machine specified by the -f switch. The executed command can be supplied with arguments by using -a
|-
| getsystem
| This attempts to elevate the current Meterpreter session to system administrator level of authorization.
|-
| getuid
| Displays the user identification of the user the current Meterpreter session is running as.
|-
| hashdump
| Prints all available usernames and their password hashes, making them available for further manipulation like password cracking using additional software or rainbow tables.
|-
| help
| Shows the Meterpreter help menu consisting of a comprehensive list of commands. This menu expands if more extensions are loaded.
|-
| ipconfig
| Prints the network configuration of the target machine in Windows display style.
|-
| migrate
| Migrates the Meterpreter session to the process given as a parameter. This allows further exploitation of the system from within the new process. This should be done to avoid getting thrown out by the user closing the process that served as entry point.
|-
| ps
| Prints a non-interactive list of the currently running processes on the target machine including process IDs, usernames of the process owners and the path to the executables.
|-
| search
| Searches the system for a file specified by the -f switch. The provided filename may contain wildcards.
|}

=== Extensions ===
Meterpreter extensions are loaded by using the '''load'''-command. Some Extensions are loaded by default like the '''priv'''-extension which is used for privilege escalation and the '''stdapi'''-extension which supplies basic Meterpreter commands like '''getuid'''. Frequently used extensions include:
* '''kiwi''' (formerly mimikatz): This extension is used to obtain user credentials and authentication tokens. These are retrieved directly from target systems memory. Passwords can even be displayed directly in cleartext.
* ''' python ''': This extensions allows the execution of python scripts on the target machine.
* ''' powershell ''': This extensions allows the execution of powershell scripts on the target machine.

=== Scripts & Modules ===
Meterpreter includes pre-made scripts that can be used for various purposes and are run by using the '''run'''-command. It includes scripts that can persist Meterpreter sessions, unlock the targets screen or disable Anti-Virus software. Some of the script seen in the figure below are considered deprecated. Some of those, like the persistence script were integrated directly into the Metasploit Framework. A Meterpreter session can be put into the background to run these post-exploitation modules supplied by Metasploit.
[[File:Meterpreter Scripts.png|thumb|none|500px|Meterpreter Scripts]]

== Sources ==
* D. Kennedy, J. O’Gorman, D. Kearns, and M. Aharoni. Metasploit: The Penetration Tester’s Guide. No Starch Press Series. No Starch Press, 2011.
* M. Miller. Meterpreter specifications. http://www.hick.org/code/skape/papers/meterpreter.pdf, 2004. Accessed: 2022-09-14.
* Metasploit Unleashed free ethical hacking course. https://www.offensive-security.com/metasploit-unleashed/. Accessed: 2022-11-05.
* Michael Messner. Hacking mit Metasploit. dpunkt.verlag, 3rd edition, 2017.

[[Category:Documentation]]

2022-07-06T13:04:09Z

BVogler:

== Summary ==

The USB Charger Doctor is an voltage and current meter that measures in-line. It supports USB 1.x and 2.x and has no USB 3.x capabilities. Its a handy tool to test USB devices, check load levels and debug battery chargers and boost converters.

== Requirements ==

* USB type-A connectors to connect the Charger Doctor in-line
* No additional software required

== Description ==

The USB Charger Doctor is easily used by connecting it in-line between a power source and a chargeable device. When connected the display switches between voltage and current every 3 seconds. Following some pictures are provided to illustrate the difference in power delivery between a regular USB 2.0 port on a notebook and a mobile phone power adapter. The smartphone used was at ~90% charge.

=== USB 2.0 Port on a notebook ===

[[File:ChargerDoctor_Adapter_Voltage.jpg|thumb|none|500px|Voltage - using an USB 2.0 Port on a notebook]]

[[File:ChargerDoctor_Adapter_Ampere.jpg|thumb|none|500px|Ampere - using an USB 2.0 Port on a notebook]]

=== Smartphone power adapter ===

[[File:ChargerDoctor_Notebook_Volt.jpg|thumb|none|500px|Voltage - using a common smartphone power adapter]]

[[File:ChargerDoctor_Notebook_Ampere.jpg|thumb|none|500px|Ampere - using a common smartphone power adapter]]

== Used Hardware ==

* USB Charger Doctor
* Windows 10 Notebook with USB 2.0 port
* Nokia 7 plus Android Smartphone
* Nokia AD-18WE Power Adapter

== References ==

* [[CHARGER Doctor USB Power Meter]]
* https://www.adafruit.com/product/1852

[[Category:Documentation]]

USB Charger Doctor

2022-07-06T13:02:44Z

BVogler: fixed images

== Summary ==

The USB Charger Doctor is and Voltage and Current Meter that measures in-line. It supports USB 1.x and 2.x and has no USB 3.x capabilities. Its a handy tool to test USB devices, check load levels and debug battery chargers and boost converters.

== Requirements ==

* USB type-A connectors to connect the Charger Doctor in-line
* No additional software required

== Description ==

The USB Charger Doctor is easily used by connecting it in-line between a power source and a chargeable device. When connected the display switches between voltage and current every 3 seconds. Following some pictures are provided to illustrate the difference in power delivery between a regular USB 2.0 port on a PC and a mobile phone power adapter. The smartphone used was at ~90% charge.

=== USB 2.0 Port on a notebook ===

[[File:ChargerDoctor_Adapter_Voltage.jpg|thumb|none|500px|Voltage - using an USB 2.0 Port on a notebook]]

[[File:ChargerDoctor_Adapter_Ampere.jpg|thumb|none|500px|Ampere - using an USB 2.0 Port on a notebook]]

=== Smartphone power adapter ===

[[File:ChargerDoctor_Notebook_Volt.jpg|thumb|none|500px|Voltage - using a common smartphone power adapter]]

[[File:ChargerDoctor_Notebook_Ampere.jpg|thumb|none|500px|Ampere - using a common smartphone power adapter]]

== Used Hardware ==

* USB Charger Doctor
* Windows 10 Notebook with USB 2.0 port
* Nokia 7 plus Android Smartphone
* Nokia AD-18WE Power Adapter

== References ==

* [[CHARGER Doctor USB Power Meter]]
* https://www.adafruit.com/product/1852

[[Category:Documentation]]

USB Charger Doctor

2022-07-06T13:01:46Z