major rearrange

maraduer-exploit-prose.txt

@@ -0,0 +1,369 @@
+maraduer exploit
+    evil portal
+        sd card
+            patients:
+                standard 32gb microsb hc I U1 Class 10, micro center
+                marauder:
+                    wifi dev board pro, latest release as of 09222024
+                    CYD latest of 09222024
+            fat32 investigations:
+                windows:
+                    compare:
+                        partition magic
+                        windows default formatter
+                linux: [0]
+                    find device: (and/or options)
+                        dmesg
+                        dmesg -w #while plugging in
+                        cat /proc/partitions
+                        sudo fdisk -l
+                        lsblk
+                    zreo out drive:
+                        sudo dd if=/dev/zero of=/dev/sdX status=progress bs=32M conv=fdatasync # much faster this way [2]
+                    create partition table/mbr:
+                        sudo fdisk /dev/sdX
+                            o # "create a new empty MBR (DOS) partition table"
+                            w # write
+                    create partitions:
+                        sudo fdisk /dev/sdX
+                            n # "new" "add a new partition"
+                                (select all defaults)
+                            t # "type" "change a partition type"
+                            b # "0b" "W95 FAT32"
+                            p # show partition info
+                            w # write
+                        create file system:
+                            sudo mkfs.vfat -F 32 -n MARAUDERSD /dev/sdX1
+                        mount: [1]
+                            sudo mkdir /mnt/maraudersd
+                            sudo mount /dev/sdX1  /mnt/maraudersd
+
+
+Links:
+    [0] https://lobotuerto.com/notes/format-a-usb-drive-as-fat32-in-linux
+    [1] https://linuxconfig.org/howto-mount-usb-drive-in-linux
+    [2] https://www.man7.org/linux/man-pages/man1/dd.1.html
+    [2] https://stackoverflow.com/questions/68150702/what-does-the-conv-fdatasync-do-in-dd-command-in-linux
+
+notes/todo:
+    get exact specs on microsd
+    dd specifc amount of data from sdX
+        bs (blocksize r and w) defaults to 512 (Bytes) by default but listed explicitly for clarity
+        16MB:
+            16MB = 16,777,216 Bytes
+            16,777,216 Bytes / 512 Bytes = 32,768 blocks of 512 Bytes
+            sudo dd if=/dev/sdX of=//home/kali/marauderexploitdev/imgs/first-16M-sdcard-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=512 count=32768 status=progress conv=fdatasync
+        4MB:
+            4MB = 4,194,304 Bytes
+            4,194,304 Bytes / 512 Bytes = 8,192 Blocks of 512 Bytes
+            sudo dd if=/dev/sdX of=/home/kali/marauderexploitdev/imgs/first-4M-sdcard-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=512 count=32768 status=progress conv=fdatasync
+        Full command to full dump:
+            sudo dd if=/dev/sdX of=/home/kali/marauderexploitdev/imgs/full-sdcard-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+tasync
+        1) zero out
+        2) sanity checks/progression
+            zeroed out drive for all 0s and filesize should be exact:
+                sudo dd if=/dev/zero of=/dev/sdX status=progress bs=32M conv=fdatasync
+                4MB Dump:
+                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/1-first-4MB-zerored
+                    -marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=512 count=8192 status=progress conv=fdatasync
+                hexdump reveals all zeros in 0-first-4M-sdcard-marauder_23092024-00.28.15-UTC.img
+            after create partition table:
+                4MB Dump:
+                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/1-first-4MB-mbr-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=512 count=8192 status=progress conv=fdatasync
+            after creating partitions:
+                4MB Dump:
+                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/2-first-4MB-created-partitions-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=5122 count=8192 status=progress conv=fdatasync
+
+                    Primary
+                    Number 1
+                    First sector (2048-60579839, default 2048):
+                    Last sector, +/-sectors or +/-size{K,M,G,T,P} (2048-60579839, default 60579839)
+                    W95 FAT32
+
+                    Disk /dev/sda: 28.89 GiB, 31016878080 bytes, 60579840 sectors
+                    Disk model: Storage Device
+                    Units: sectors of 1 * 512 = 512 bytes
+                    Sector size (logical/physical): 512 bytes / 512 bytes
+                    I/O size (minimum/optimal): 512 bytes / 512 bytes
+                    Disklabel type: dos
+                    Disk identifier: 0x85cf894c
+
+                    Device     Boot Start      End  Sectors  Size Id Type
+                    /dev/sda1        2048 60579839 60577792 28.9G  b W95 FAT32
+            after create filesystem:
+                Full Dump:
+                    byobu
+                    sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/3-full-created-filesystem-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+            after mount:
+                sudo mkdir /mnt/maraudersd
+                sudo mount /dev/sdX1 /mnt/maraudersd
+                4MB Dump:
+                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/4-first-4MB-mounted-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=8192 count=512 status=progress conv=fdatasync
+            after a text file is added:
+                4MB Dump:
+                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/5-first-4MB-textfile-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=8192 count=512 status=progress conv=fdatasync
+            after a dir and text file are added:
+                4MB Dump:
+                    sudo dd if=/dev/sda of=/home/kali/marauderexploitdev/imgs/6-first-4MB-dir-textfile-marauder_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=8192 count=512 status=progress conv=fdatasync
+            re-zero, remake parts, repeat 0-3
+                sanity check
+            after booting marauder:
+                Full Dump:
+                    sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/4-marauder-boot-reboot-sdb_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+            add evil portal stuff
+                Full Dump:
+                    sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/5-evil-portal-files-added-sdb_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress
+            after logging fron evilportal:
+                Full Dump:
+                    sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/6-evil-portal-files-logged-sdb_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+            after breaking chars from fuzzing evil portal 0x00-0xFF:
+                sudo dd if=/dev/sdb of=/home/kali/marauderexploitdev/imgs/7-evil-portal-fuzzed-0x00-0xFF-sdb_`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+
+Full setup auto: #prose kinda
+#!/bin/bash
+date=`date "+%d%m%Y-%H.%M.%S-%Z"`
+lsblk
+echo "Enter drive (sdX only no /dev/)
+read drive
+echo "Zeroing Out"
+sudo dd if=/dev/zero of=/dev/$drive status=progress bs=32M conv=fdatasync # much faster this way
+echo "Dumping Zeroed Out Drive $drive to /home/kali/marauderexploitdev/imgs/0-full-zeroed-$drive_$date.img"
+sudo dd if=/dev/$drive of=/home/kali/marauderexploitdev/imgs/0-full-zeroed-$drive_$date.img bs=32M status=progress conv=fdatasync
+echo "Creating MBR/Partition Table"
+echo "o then w"
+sudo fdisk /dev/$drive
+echo "Dumping Full Partition Table/MBR Drive $drive to /home/kali/marauderexploitdev/imgs/1-full-partition-table-mbr-$drive_$date.img"
+sudo dd if=/dev/$drive of=/home/kali/marauderexploitdev/imgs/1-full-partition-table-mbr-$drive_$date.img bs=32M status=progress
+echo "Creating Partitions"
+echo "n (all defaults), t, b, p, w"
+sudo fdisk /dev/$drive
+echo "Dumping Partitioned Drive $drive to /home/kali/marauderexploitdev/imgs/2-partitioned-$drive_$date.img"
+sudo dd if=/dev/$drive of=/home/kali/marauderexploitdev/imgs/2-partitioned-$drive_$date.img bs=32M status=progress
+echo "Creating Filessytem"
+sudo mkfs.vfat -F 32 -n MARAUDLABEL /dev/$drive
+echo "Dumping Fullly Formatted Disk $drive to /home/kali/marauderexploitdev/imgs/3-formatted-$drive_$date.img"
+sudo dd if=/dev/$drive of=/home/kali/marauderexploitdev/imgs/3-formatted-$drive_$date.img bs=32M status=progress
+"Mounting"
+sudo mkdir /mnt/MARAUDLABEL
+sudo mount /dev/$drive1 /mnt/MARAUDLABEL
+sudo umount /mnt/MARAUDLABEL
+echo "Dumping Mounted Then Unmounted Disk $disk to /home/kali/marauderexploitdev/imgs/4-mounted-unmounted-$drive_$date.img"
+
+
+WORKFLOW:
+    Pi5-USB:
+        byobu
+        lsblk
+        export disk=sdX
+
+        zero:
+            sudo dd if=/dev/zero of=/dev/$disk status=progress bs=1M count=4K conv=fdatasync
+        mbr/partition table:
+            sudo fdisk /dev/$disk
+                o # "create a new empty MBR (DOS) partition table
+                w # write
+        create partitions:
+            sudo fdisk /dev/$disk
+                n # "new" "add a new partition"
+                    (select all defaults)
+                t # "type" "change a partition type"
+                b # "0b" "W95 FAT32"
+                p # show partition info
+                w # write
+        # create filesystem:
+            # sudo mkfs.vfat -F 32 -n MARAUDERSD "/dev/${disk}1"
+        mount:
+            ./mount-marauder-sd $disk
+                # sudo mount /dev/($disk)1 /mnt/MARAUDLABEL
+        add needed files:
+            # sudo mkdir /mnt/MARAUDLABEL/scripts
+            sudo cp marauder_cyd_microsd/index.html /mnt/MARAUDLABEL/
+            sudo cp marauder_cyd_microsd/ap.config.txt /mnt/MARAUDLABEL/
+        umount:
+            ./umount-marauder-sd
+                # sudo umount /mnt/MARAUDLABEL
+        full dump:
+            sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/<n>-<activity>-full-dump-$dis
+k-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+        partial dump:
+            sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/2-incremental-overrun-partial-dump-32MB-sda-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=1M count=32 status=progress conv=fdatasync
+    Pi4-Ether:
+        byobu
+        cd ~/marauddev
+        source boofuzz/env/bin/activate
+            # stored note in pyenv.txt
+        connect to wifi:
+            ./connect-wifi
+        hex chars fuzz:
+            python hex-chars-fuzzing.py
+        boofuzz fuzz:
+            python boofuzz-email-password.py
+                # web status hosted at http://10.0.0.79:26000
+                # results in boofuzz-results
+                # clean results with rm boofuzz-results/*
+            open previous results:
+                boo open --ui-addr 10.0.0.79 --ui-port 26000 boofuzz-results/XYZ.db
+                    # opens web interface at http://10.0.0.79:26000
+    MarauderCYD SD:
+        /ap.config.txt # one line ex "Guest-Wifi"
+        /index.html # for default evilportal
+        /*.html # files for selection
+    MarauderCYD:
+        with wifi selections:
+            WIfI->General->Select EP HTML File->X
+        with one html file:
+            WiFi->Attacks-Evil Portal
+    hexdumps:
+        hexdump <files>
+        xxd --offset <hex> --len <hex> <input filename> > <output filename> # <output filename>
+
+# todo
+    dump full zeroed:
+        sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/1-zeroed-full-dump-$disk-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+            sanity check with hexdump
+    dump with filesystem and minimal
+        sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/1-filesystem-minimal-files-full-dump-$dis
+k-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+        sanity check with hexdump
+    dump after logging nominal email/passwords
+        ffuf -w /usr/share/wordlists/john.lst -u "http://192.168.4.1/get?email=FUZZ&password=FUZZ" -fc all -rate 4 -t 1
+        sudo dd if=/dev/$disk of=/home/kali/marauderexploitdev/imgs/1-logged-nominal-full-dump-$disk-`date "+%d%m%Y-%H.%M.%S-%Z"`.img bs=32M status=progress conv=fdatasync
+        investigate:
+            hd imgs/1-logged-nominal-full-dump-sda-23092024-13.19.02-UTC.img > 1-logged-nominal-f
+ull-dump-sda-23092024-13.19.02-UTC.img.hex
+                # hd is hexdump -c, normal canonical dump with decode
+    resume fuzzing:
+        ffuf -w /usr/share/wordlists/seclists/Fuzzing/big-list-of-naughty-strings.txt -u "http://192.168.4.1/get?email=FUZZ&password=FUZZ" -fc all -rate 4 -t 3
+            mount
+            dump
+            reset
+        python hex-chars-fuzzing.py
+            mount
+                check 
+                umount
+            dump
+                hd
+            reset
+        python boo0fuzz-email-password.py
+            mount
+                check
+                umount
+            dump
+                hd
+            reset
+
+injections:
+    confirmed:
+        nullbyte
+        crlf
+    possible:
+        nullbytes(s)+some other bytes to break filesystem
+    incremental overrun:
+        Running 1489/10000 chars (X)
+        Prepend:
+        Append:
+        Outfile: fuzzing-results/chars-10000-23092024-12.37.24.txt
+            len = 1489
+            payload = "%00"*len
+            payload = "%FF"*len
+
+
+
+Fuzzers:
+    prerequisites: 
+        cd ~/marauddev
+        source boofuzz/env/bin/activate
+        ./connect-wifi./
+    incremental buffer overrun:
+        python incremental-buff-overrun.py
+    hex chars fuzzing:
+        python hex-chars-fuzzing.py
+    boofuzz var fuzz:
+        python boofuzz-email-password.py
+            # opens web monitor on http://10.0.0.79:26000
+            open previous results:
+                boo open --ui-addr 10.0.0.79 --ui-port 26000 boofuzz-results/XYZ.db
+                # opens web interface at http://10.0.0.79:26000
+    nominal entries:
+        ffuf -w /usr/share/wordlists/john.lst -u "http://192.168.4.1/get?email=FUZZ&password=FUZZ" -fc all -rate 4 -t 2
+    
+
+
+# Disk reset scriptttt
+
+#!/bin/bash
+mountpoint=/mnt/MARAUDLABEL/
+gb_to_zero=1
+
+echo "WILL WIPE DISK USE WITH CARE"
+
+echo -e "\nListing Disks"
+lsblk
+echo -e "\nEnter disk (e.x. sda or sdb - BE CAREFUL)"
+read disk
+block=/dev/$disk
+echo -e "\nZeroing ${gb_to_zero}GB on Disk $block"
+sudo dd if=/dev/zero of=$block status=progress bs=1M count="${gb_to_zero}K" conv=fdatasync
+echo -e "\nCreating Partitions on $block"
+sudo echo ',,b;' | sudo sfdisk $block
+echo -e "\n\nEnter Disk (e.x. sda1 or sdb1)"
+lsblk
+read part
+partition="/dev/${part}"
+echo -e "\nMaking FAT32 Filesystem on $partition"
+sudo mkfs.vfat -F 32 -n MARAUDERSD $partition
+echo -e "\n$block Status:"
+sudo sfdisk -l $block
+echo -e "\nMounting $partition at $mountpoint"
+sudo mount $partition $mountpoint
+echo -e "\nCopying Minimal Files"
+sudo cp marauder_cyd_microsd/index.html $mountpoint
+sudo cp marauder_cyd_microsd/ap.config.txt $mountpoint
+echo -e "\nListing"
+ls -lah $mountpoint
+echo -e "\numounting $partition from $mountpoint"
+sudo umount $mountpoint
+echo -e "\n\nYou May Now Use on Marauder"
+
+# dump scripptttt
+
+#!/bin/bash
+number=2
+tag=incremental-overrun-nullbyte
+blocks=32
+blocksize=1M
+dumpsize=32M
+
+
+
+echo -e "\nListing Disks"
+lsblk
+echo -e "\nEnter disk (e.x. sda or sdb - BE CAREFUL)"
+read disk
+block=/dev/$disk
+
+timestamp=$(date "+%d%m%Y-%H.%M.%S-%Z")
+
+filename="/home/kali/marauderexploitdev/imgs/${number}-${tag}-${dumpsize}-${timestamp}.img"
+
+echo "sudo dd if=$block of=$filename bs=$blocksize count=$blocks status=progress conv=fdatasync"
+
+ffuf -input-cmd 'dd bs=1 count=1K if=/dev/urandom' -u "http://10.0.0.80/get.php?email=FUZZ&password=FUZZ" -input-num 2000 -mc all -timeout 3 -v -ignore-body -sa -t 256 -rate 10
+
+
+# beacons
+sudo mdk4 wlan1 b -a -w tawn -c 1 -s 50
+scapy:
+
+SSID = b"youSeemFundamentallyFun" 
+iface = 'wlan1'   
+sender = 'ac:cb:12:ad:58:27'
+
+dot11 = Dot11(type=0, subtype=8, addr1='ff:ff:ff:ff:ff:ff', addr2=sender, addr3=sender)
+beacon = Dot11Beacon()
+essid = Dot11Elt(ID='SSID',info=SSID, len=len(SSID))
+
+frame = RadioTap()/dot11/beacon/essid
+
+sendp(frame, iface=iface, inter=0.100, loop=1)