I spent the last couple days recoding the Pillager, getting rid of bugs, optimizing code, making it more extendable and more solid overall. So this post is to release the new code. However, with that being said, the Pillager is in mass revision right now and I added some more developers to the team to add a whole host of new database attacking features as well as moving past databases and into other areas of post exploitation pillaging. Soon to be released.. As usual this tool and any tool i create is based on my issues when performing penetration tests and solves those problems.. If you have any insight or comments i will certainly take them into consideration for future releases.
For now check out Version 0.7.. Named searches and Data searches via external config files are now functioning properly as well as other bugs fixed along the way... Drop this in a BT5 VM and make sure you have your DB python stuff installed per the help docs and you should be good to go. If you are looking to use oracle you are going to have to install all the oracle nonsense from oracle or use a BT4r2 vm which has most of the needed drivers minus cxoracle which will need to be installed.
http://consolecowboys.org/pillager/pillage_0.7.zip
Ficti0n$ python pillager.py
[---] The Database Pillager (DBPillage) [---]
[---] CcLabs Release [---]
[---] Authors: Ficti0n, [---]
[---] Contributors: Steponequit [---]
[---] Version: 0.7 [---]
[---] Find Me On Twitter: ficti0n [---]
[---] Homepage: http://console-cowboys.blogspot.com [---]
Release Notes:
--Fixed bugs and optimized code
--Added Docstrings
--Fixed Named and Data searches from config files
About:
The Database Pillager is a multiplatform database tool for searching and browsing common
database platforms encountered while penetration testing. DBPillage can be used to search
for PCI/HIPAA data automatically or use DBPillage to browse databases,display data.
and search for specified tables/data instances.
DBpillage was designed as a post exploitation pillaging tool with a goal of targeted
extraction of data without the use of database platform specific GUI based tools that
are difficult to use and make my job harder.
Supported Platforms:
--------------------
-Oracle
-MSSQL
-MYSQL
-PostGreSQL
Usage Examples:
************************************************************************
For Mysql Postgres and MsSQL pillaging:
---------------------------------------
python dbPillage -a [address] -d [dbType] -u [username] -p [password]
For Oracle pillaging you need a SID connection string:
------------------------------------------------------
python dbPillage-a [address]/[sid] -d [dbType] -u [username] -p [password]
Grab some hashes and Hipaa specific:(Default is PCI)
------------------------------------
python dbPillage -a [address] -d [dbType] -u [username] -p [password] --hashes -s hipaa
Drop into a SQL CMDShell:
-------------------------
python dbpillage.py -a [address] -d [dbType] -u [username] -p [password] -q
Config file specified searches:
-------------------------------
Search for data Items from inputFiles/data.txt:
python dbpillage.py -a [address] -d [dbType] -u [username] -p [password] -D
Search for specific table names from inputFiles/tables.txt:
python dbpillage.py -a [address] -d [dbType] -u [username] -p [password] -N
Switch Options:
---------------------
-# --hashes = grab database password hashes
-l --limit = limit the amount of rows that are searched or when displaying data (options = any number)
-s --searchType = Type of data search you want to perform (options:pci, hipaa, all)(PCI default)
-u --user = Database servers username
-p --pass = Password for the database server
-a --address = Ipaddress of the database server
-d --database = The database type you are pillageing (options: mssql,mysql,oracle,postgres)
-r --report = report format (HTML, XML, screen(default))
-N --nameSearch = Search via inputFiles/tables.txt
-D --dataSearch = Targeted data searches per inputFiles/data.txt
-q --queryShell = Drop into a SQL CMDshell in mysql or mssql
Prerequisites:
-------------
python v2 (Tested on Python 2.5.2 BT4 R2 and BT5 R3 - Oracle stuff on BT4r2 only unless you install the drivers from oracle)
cx_oracle (cx-oracle.sourceforge.net)
psycopg2 (initd.org/psycopg/download/)
MySQLdb (should be on BT by default)
pymssql (should be on BT by default)
Related posts
アーカイブ
-
▼
2020
(461)
-
▼
5月
(58)
- $$$ Bug Bounty $$$
- HiddenWasp Linux Malware Backdoor Samples
- KillShot: A PenTesting Framework, Information Gath...
- CEH: System Hacking, Cracking A Password, Understa...
- The Pillager 0.7 Release
- RFCrack Release - A Software Defined Radio Attack ...
- ADVANTAGE OF ETHICAL HACKING
- Ask And You Shall Receive
- Nipe - A Script To Make TOR Network Your Default G...
- 10 Best Wifi Hacking Android Apps To Hack Others W...
- Top Users Command In Linux Operating System With D...
- Trendnet Cameras - I Always Feel Like Somebody'S W...
- Top Linux Commands Related To Hardware With Descri...
- Recovering Data From An Old Encrypted Time Machine...
- PentestBox - Opensource PreConfigured Portable Pen...
- Goddi (Go Dump Domain Info) - Dumps Active Directo...
- RenApp: The Ultimate File Renaming App
- How To Install Metasploit In Termux
- How To Change Facebook’s Default Theme To Any Colo...
- Memoryze
- Effective Business Continuity Plans Require CISOs ...
- BurpSuite Introduction & Installation
- Scaling The NetScaler
- APPLE IPHONE X FACE ID CAN BE HACKED WITH SILICON ...
- Hacking Everything With RF And Software Defined Ra...
- Top System Related Commands In Linux With Descript...
- 15 Important Run Commands Every Windows User Shoul...
- Hackable - Secret Hacker | Vulnerable Web Applicat...
- TOP 10 HACKING MOVIES YOU SHOULD WATCH
- How Do I Get Started With Bug Bounty ?
- HOW TO HACK WHATSAPP ACCOUNT? – WHATSAPP HACK
- DigitalOcean Data Leak Incident Exposed Some Of It...
- DirBuster: Brute Force Web Directories
- Hacktronian: All In One Hacking Tools Installer Fo...
- Exploit-Me
- SubOver - A Powerful Subdomain Takeover Tool
- Gridcoin - The Good
- Masad Clipper And Stealer - Windows Spyware Exfilt...
- Hacking Windows 95, Part 2
- KillShot: A PenTesting Framework, Information Gath...
- OnionDuke Samples
- Download: 'Coronavirus Cyber Security For Manageme...
- Masad Clipper And Stealer - Windows Spyware Exfilt...
- Top System Related Commands In Linux With Descript...
- How To Switch From 32-Bit Windows 10 To 64-Bit Win...
- How Do I Get Started With Bug Bounty ?
- DDE Command Execution Malware Samples
- How To Repair A Crashed SD Card And Protect Your Data
- CertCrunchy - Just A Silly Recon Tool That Uses Da...
- Entropy: Netwave And GoAhead IP Webcams Exploiting...
- Hacking Everything With RF And Software Defined Ra...
- PHoss: A Password Sniffer
- Freefloat FTP Server 1.0 | Remote Buffer Overflow ...
- Hacking All The Cars - Part 1
- November 2019 Connector
- DOWNLOAD BLACKMART ANDROID APP – DOWNLOAD PLAYSTOR...
- Hitman 6 Alpha Free Download
- Ep 25: Top Faves With Dave Goes To The Library II:...
-
▼
5月
(58)


0 件のコメント:
コメントを投稿