Twitter notifications for MotionEyeOS video surveillance system on Raspberry Pi

MotionEyeOS is a wonderful project by Calin Crisan that converts your single board computer into a video surveillance system in a matter of minutes. It is supported on a number of devices and is well maintained with good community support.

Now that the latest Raspberry Pi Zero version (W) comes with onboard Wi-Fi, it makes an ideal candidate to deploy MotionEyeOS across your perimeter and run a cheap video surveillance system with lesser clutter of having to attach a Wi-Fi dongle as in the previous versions of Pi Zero.

Social network based backdoor for pentests

Once you gain access to a system during pentest, you might want to retain access by means of a backdoor. The most trivial method is to use metsvc which ‘unfortunately’ is very well fingerprinted by anti-virus software.

In this post, let us look at how to use a backdoor that uses social network for communications. The method used by the backdoor is identical to what was mentioned in my previous post.

Abusing social network APIs for Fun & Profit - Facebook API

Question - In a controlled corporate environment with DLP solutions monitoring the HTTP and Email traffic, how would you perform data exfiltration during a Red Team Pentest ? ‘One’ of the answers would be to use social networking sites, let’s look at Facebook in this post. Data exfiltration using Facebook (FB) and the like is nothing new. There has been various instances where these networks have been used as C&C, data receivers etc..

Snagging Active Directory credentials over WiFi - Part 1

This issue has been fixed on Windows 8+ as part of MS16-112 issued in September 2016. I haven’t checked this on a Windows 7 machine which isn’t listed on the Microsoft page.

Basics

The basic theory behind the attack is same as @mubix’s discovery - if you connect a network interface to a Windows system and have Responder tool poisoning the network, you can obtain the hashes (NTML responses) from the machine without any user intervention. This works even with the computer in locked state.

In my scenario, I’m using a rogue Open WiFi network to grab the hashes. The result is the same and at times, I had better results than plugging in a Pi Zero. The Responder tool captures the hashes which can then be cracked using tools like hashcat.