This repository has been archived by the owner on Jul 16, 2024. It is now read-only.
-
-
Notifications
You must be signed in to change notification settings - Fork 217
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
- Loading branch information
Showing
15 changed files
with
867 additions
and
539 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -4,7 +4,7 @@ | |
|
||
<p align="center"> | ||
<a href="https://github.com/AdrMXR"><img title="Autor" src="https://img.shields.io/badge/Author-Adrián%20Guillermo-blue?style=for-the-badge&logo=github"></a> | ||
<a href=""><img title="Version" src="https://img.shields.io/badge/Version-1.3.1-red?style=for-the-badge&logo="></a> | ||
<a href=""><img title="Version" src="https://img.shields.io/badge/Version-1.3.2-red?style=for-the-badge&logo="></a> | ||
</p> | ||
|
||
<p align="center"> | ||
|
@@ -88,32 +88,35 @@ $ sudo bash uninstall.sh | |
## Novedades: | ||
|
||
**1) Depuración de herramientas obsoletas.** | ||
- Debido a la eliminación de algunos repositorios por parte de sus respectivos autores, es fundamental que nuestros usuarios nos [reporten](mailto:[email protected]) cualquier herramienta que no se esté instalando de forma correcta, ya que de esa forma nosotros podremos depurarla completamente de kithack. | ||
- Es fundamental que nuestros usuarios nos [reporten](mailto:[email protected]) cualquier herramienta que no se esté instalando de forma correcta, ya que de esa forma nosotros podremos depurarla completamente de kithack. | ||
|
||
**2) Integración de nuevas herramientas.** | ||
- Así como depuramos herramientas también integramos algunas nuevas, si tienes algún proyecto personal en github que te gustaría que apareciera en nuestro kit de herramientas, o si estás interesado en ser contribuidor de kithack, lee nuestra [norma de contribución](https://github.com/AdrMXR/KitHack/blob/master/docs/CONTRIBUTING.md). | ||
|
||
**3) Unificación de tipos de Payloads (por etapas y sin etapas).** | ||
- Tal como lo explicamos en nuestra pagina web de documentación, kithack nos permite utilizar tanto payloads por etapas como individuales. Si deseas saber sus diferencias, consulta [aquí.](https://adrmxr.github.io/KitHack#tipos-de-payloads) | ||
- Kithack nos permite utilizar tanto payloads por etapas como individuales. Si deseas saber sus diferencias, consulta [aquí.](https://adrmxr.github.io/KitHack#tipos-de-payloads) | ||
|
||
**4) Incorporación de un nuevo método que permite infectar aplicaciones Android legitimas.** | ||
- Kithack nos proporciona la opción de poder infectar una APK original y certificarla para que sea menos detectable. Cabe destacar que no todas las aplicaciones son vulnerables, aplicaciones como Facebook, WhatsApp, Instagram y similares tienen los suficientes mecanismos de seguridad para evitar este tipo de ataques. Te sugerimos descargar aplicaciones directamente de [apkpure](https://apkpure.com) o similares a esta. | ||
- Kithack nos proporciona la opción de poder infectar una APK original. Cabe destacar que no todas las aplicaciones son vulnerables. | ||
|
||
**5) Generación de enlaces tcp mediante Ngrok para conexiones publicas (puerto 443 por default).** | ||
- Ahora también puedes trabajar con [ngrok](https://ngrok.com) para realizar ataques fuera de tu red sin necesidad de abrir puertos. También se ha automatizado la validación de tu [authtoken](https://ngrok.com/docs#getting-started-authtoken), ya que en caso de no tenerlo configurado, kithack automaticamente te solicita ingresarlo para generar correctamente el enlace tcp. El archivo de configuración ```ngrok.yml``` ya no será validado en los directorios de inicio (home path), ahora se almacenará en ```KitHack/.config``` de manera predeterminada. Si por alguna razon necesita que kithack le solicite nuevamente su authtoken escriba ```rm .config/ngrok.yml``` | ||
**5) Generación de conexiones TCP con ngrok.** | ||
- Ahora también puedes trabajar con [ngrok](https://ngrok.com) para realizar ataques fuera de tu red sin necesidad de abrir puertos. El archivo de configuración ```ngrok.yml``` se almacena en ```KitHack/.config``` de manera predeterminada. Si por alguna razon necesita que kithack le solicite nuevamente su authtoken escriba ```rm .config/ngrok.yml```. | ||
|
||
**6) Automatización de Metasploit para ponerlo en escucha de nuevas sesiones.** | ||
- No tienes que perder tiempo en volver a setear las configuraciones de tu payload, kithack se encarga de poner en escucha a [metasploit](https://www.metasploit.com) de manera rapida. | ||
**6) Automatización de Metasploit.** | ||
- No tienes que perder tiempo en volver a establecer las configuraciones de tu payload, kithack se encarga de poner en escucha a [metasploit](https://www.metasploit.com) de manera rapida. | ||
|
||
**7) Planificación de puntos estrategicos para la evasión de antivirus.** | ||
- Para nosotros es importante que nuestros backdoors sean lo menos detectables posibles, es por eso que te pedimos no subirlos a paginas como [virustotal](https://www.virustotal.com) ya que este tipo de plataformas almacenan en su base de datos los resultados de cada análisis. | ||
**7) Personalización de payloads para android.** | ||
- Ahora también tienes la posibilidad de personalizar tu propio payload para Android. Con kithack puedes cambiar el nombre predeterminado de la apk que genera [metasploit](https://www.metasploit.com) conocido como "MainActivity" y también puedes modificar el icono de Android predeterminado. Da click [aquí](https://github.com/AdrMXR/KitHack/blob/master/icons/LEEME.txt) para conocer el formato. | ||
|
||
**8) Elaboración de un nuevo método que permite modificar el nombre e icono predeterminados de una APK generada por Metasploit.** | ||
- Ahora también tienes la posibilidad de personalizar tu propio payload para Android. Con kithack puedes cambiar el nombre predeterminado de la apk que genera [metasploit](https://www.metasploit.com) conocido como "MainActivity" y también puedes modificar el icono Android predeterminado. Da click [aquí](https://github.com/AdrMXR/KitHack/blob/master/icons/LEEME.txt) para conocer el formato. | ||
|
||
**9) Aplicación de persistencia automatizada para cualquier APK.** | ||
**8) Aplicación de persistencia automatizada para cualquier APK.** | ||
- Olvidate de que tu sesión de [metasploit](https://www.metasploit.com) expire muy rapido, con kithack ahora podrás generar tu archivo de persistencia para cualquier APK. Si deseas saber como ponerlo en marcha en la shell de meterpreter, da click [aquí.](https://youtu.be/nERwsZyIVeo) | ||
|
||
**9) Ejecución de herramientas.** | ||
- Ahora el usuario podrá ejecutar las herramientas directamente desde kithack a pesar de que ya se encuentren instaladas. | ||
|
||
**10) Creación de ```clean.sh```.** | ||
- Si necesitas eliminar el contenido que te ha generado kithack en tu carpeta `tools` y `output`, puedes ejecutar el archivo `clean.sh` para hacerlo de forma rápida. | ||
|
||
## Algunas APK vulnerables: | ||
|
||
| APK | Versión | | ||
|
@@ -139,22 +142,8 @@ $ sudo bash uninstall.sh | |
|
||
| Demo 1 | Demo 2 | | ||
| ------ | ------ | | ||
<a href="https://asciinema.org/a/fiIoQatBqUh7z79DKTrQnG7bW" target="_blank"><img src="https://asciinema.org/a/fiIoQatBqUh7z79DKTrQnG7bW.svg" /></a>|<a href="https://asciinema.org/a/oV5lttCQpOmmgcgIaFIQEkcxY" target="_blank"><img src="https://asciinema.org/a/oV5lttCQpOmmgcgIaFIQEkcxY.svg" /></a> | ||
<p align="center"> | ||
|
||
## Tutorial: | ||
|
||
<a href="https://asciinema.org/a/OTymOt3NNSTfFERrw2bHvuFw7" target="_blank"><img src="https://asciinema.org/a/OTymOt3NNSTfFERrw2bHvuFw7.svg" /></a>|<a href="https://asciinema.org/a/oV5lttCQpOmmgcgIaFIQEkcxY" target="_blank"><img src="https://asciinema.org/a/oV5lttCQpOmmgcgIaFIQEkcxY.svg" /></a> | ||
<p align="center"> | ||
<a href="https://www.youtube.com/watch?v=Wsdn158PH50"> | ||
<img src="https://github.com/AdrMXR/KitHack/blob/master/images/youtube.png" /> | ||
</a></p> | ||
|
||
## Documentación: | ||
|
||
| Titulo | Link | | ||
|-------------------------------------------|------------------------------| | ||
| Controlar un Android fuera de la red local| https://youtu.be/V1w1CMSdTyU | | ||
| KitHack - Una herramienta todo en uno | https://youtu.be/-8TCtiI9HWM | | ||
|
||
## Menu: | ||
|
||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
@@ -0,0 +1,91 @@ | ||
#!/usr/bin | ||
#Copyright 2021 KITHACK | ||
#Written by: Adrian Guillermo | ||
#Facebook: https://facebook.com/adrian.guillermo.22 | ||
#Github: https://github.com/AdrMXR | ||
|
||
# Clean KitHack | ||
|
||
# Colors | ||
red='\e[1;31m' | ||
default='\e[0m' | ||
yellow='\e[0;33m' | ||
green='\033[92m' | ||
|
||
# Location | ||
path=$(pwd) | ||
|
||
# Check root | ||
if [ "$(id -u)" != "0" ] > /dev/null 2>&1; then | ||
echo -e '\n$red[x] Este script necesita permisos root.' 1>&2 | ||
exit | ||
fi | ||
|
||
tools() { | ||
sleep 1.5 | ||
if [ -d tools ]; then | ||
count="$( find tools/* -mindepth 1 -maxdepth 1 | wc -l )" | ||
if ! [ $count -eq 0 ] ; then | ||
rm -rf $( find tools/*/* -type d ) | ||
echo -e "[✔]tools." | ||
else | ||
echo -e "[x]tools vacía." | ||
fi | ||
else | ||
echo -e "[x]tools no encontrada." | ||
fi | ||
} | ||
|
||
output() { | ||
sleep 1.5 | ||
if [ -d output ]; then | ||
count="$( find output -mindepth 1 -maxdepth 1 | wc -l )" | ||
if ! [ $count -eq 0 ] ; then | ||
rm -rf $( find output -type f) | ||
echo -e "[✔]output." | ||
else | ||
echo -e "[x]output vacía." | ||
fi | ||
else | ||
echo -e "[x]output no encontrada." | ||
fi | ||
} | ||
|
||
clear | ||
echo -e """ $red | ||
╔──────────────────────────────────────────────╗ | ||
| Con este script podrás eliminar el contenido | | ||
| que te genera KitHack en las carpetas | | ||
| tools y output. | | ||
┖──────────────────────────────────────────────┙""" | ||
echo -e "$green" | ||
echo -e "Seleccione la opción requerida." | ||
echo -e "$default[1]""$yellow tools" | ||
echo -e "$default[2]""$yellow output" | ||
echo -e "$default[3]""$yellow all" | ||
echo -e "$red" | ||
echo -ne "KitHack >> $default" | ||
read -r option | ||
case "$option" in | ||
|
||
1) | ||
tools | ||
exit 1 | ||
;; | ||
|
||
2) | ||
output | ||
exit 1 | ||
;; | ||
|
||
3) | ||
tools | ||
output | ||
exit 1 | ||
;; | ||
|
||
*) | ||
echo -e "$red""Opción invalida." | ||
;; | ||
esac | ||
|
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Original file line number | Diff line number | Diff line change |
---|---|---|
|
@@ -4,7 +4,7 @@ | |
|
||
<p align="center"> | ||
<a href="https://github.com/AdrMXR"><img title="Autor" src="https://img.shields.io/badge/Author-Adrián%20Guillermo-blue?style=for-the-badge&logo=github"></a> | ||
<a href=""><img title="Version" src="https://img.shields.io/badge/Version-1.3.1-red?style=for-the-badge&logo="></a> | ||
<a href=""><img title="Version" src="https://img.shields.io/badge/Version-1.3.2-red?style=for-the-badge&logo="></a> | ||
</p> | ||
|
||
<p align="center"> | ||
|
@@ -88,31 +88,34 @@ $ sudo bash uninstall.sh | |
## New features: | ||
|
||
**1) Debugging of obsolete tools.** | ||
- Due to the elimination of some repositories by their respective authors, it is essential that our users [report us](mailto:[email protected]) any tool that is not being installed correctly, since in this way we can eliminate it from kithack. | ||
- It is essential that our users [report us](mailto:[email protected]) any tool that is not being installed correctly, since that way we will be able to completely debug it from kithack. | ||
|
||
**2) Integration of new tools.** | ||
- As we debug tools we also integrate some new ones, if you have a personal project on github that you would like to appear in our toolkit, or if you are interested in being a kithack contributor, read our [contribution policy](https://github.com/AdrMXR/KitHack/blob/master/docs/translations/English/CONTRIBUTING.md). | ||
- As we debug tools we also integrate some new ones, if you have a personal project on github that you would like to appear in our toolkit, or if you are interested in being a kithack contributor, read our [contribution policy](https://github.com/AdrMXR/KitHack/blob/master/docs/CONTRIBUTING.md). | ||
|
||
**3) Unification of types of Payloads (by stages and without stages).** | ||
- As we explained on our documentation website, kithack allows us to use both staged and individual payloads. If you want to know their differences, see [here.](https://adrmxr.github.io/KitHack#tipos-de-payloads) | ||
- Kithack allows us to use payloads in stages and individual. If you want to know their differences, see [here.](Https://adrmxr.github.io/KitHack#tipos-de-payloads) | ||
|
||
**4) Incorporation of a new method that allows legitimate Android applications to be infected.** | ||
- Kithack gives us the option of being able to infect an original APK and certify it so that it is less detectable. It should be noted that not all applications are vulnerable, applications such as Facebook, WhatsApp, Instagram and the like have sufficient security mechanisms to avoid this type of attack. We suggest you download the applications directly from [apkpure](https://apkpure.com) or similar to it. | ||
**4) Incorporation of a new method that allows infecting legitimate Android applications.** | ||
- Kithack gives us the option to infect an original APK. It should be noted that not all applications are vulnerable. | ||
|
||
**5) Tcp link generation through Ngrok for public connections (port 443 by default).** | ||
- Now you can also work with [ngrok](https://ngrok.com) to perform attacks outside of your network without opening ports. The validation of your [authtoken](https://ngrok.com/docs#getting-started-authtoken) has also been automated, since in case of not having it configured, kithack automatically asks you to enter it to correctly generate the tcp link. The configuration file ```ngrok.yml``` will no longer be validated against home directorie (home path), it will now be stored in ```KitHack/.config``` by default. If for some reason you require kithack to request your authtoken again write ```rm .config/ngrok.yml```. | ||
**5) Generation of TCP connections with ngrok.** | ||
- Now you can also work with [ngrok](https://ngrok.com) to carry out attacks outside your network without the need to open ports. The configuration file ```ngrok.yml``` is stored in ```KitHack/.config``` by default. If for some reason you need kithack to request your authtoken again, write ```rm .config/ngrok.yml```. | ||
|
||
**6) Metasploit automation to listen for new sessions.** | ||
- You don't have to waste time in re-setting your payload settings, kithack takes care of listening to [metasploit](https://www.metasploit.com) quickly. | ||
**6) Metasploit Automation.** | ||
- You don't have to waste time re-setting your payload settings, kithack takes care of listening to [metasploit](https://www.metasploit.com) quickly. | ||
|
||
**7) Planning of strategic points for antivirus evasion.** | ||
- For us it is important that our backdoors are as undetectable as possible, that is why we ask you not to upload them to pages like [virustotal](https://www.virustotal.com) since these types of platforms store in their database the results of each analysis. | ||
|
||
**8) Development of a new method that allows modifying the default name and icon of an APK generated by Metasploit.** | ||
**7) Custom payloads for android.** | ||
- Now you also have the possibility to customize your own payload for Android. With kithack you can change the default name of the apk generated by [metasploit](https://www.metasploit.com) known as "MainActivity" and you can also modify the default Android icon. Click [here](https://github.com/AdrMXR/KitHack/blob/master/icons/LEEME.txt) to know the format. | ||
|
||
**9) Automated persistence application for any APK.** | ||
- Forget that your [metasploit](https://www.metasploit.com) session expires very quickly, with kithack you can now generate your persistence file for any APK. If you want to know how to start it in the meterpreter shell, click [here.](https://youtu.be/nERwsZyIVeo) | ||
**8) Automated persistence application for any APK.** | ||
- Forget that your [metasploit] session (https://www.metasploit.com) expires very fast, with kithack you can now generate your persistence file for any APK. If you want to know how to start it in the meterpreter shell, click [here.](https://youtu.be/nERwsZyIVeo) | ||
|
||
**9) Run tools.** | ||
- Now the user can run the tools directly from kithack even though they are already installed. | ||
|
||
**10) Creation of ```clean.sh```.** | ||
- If you need to remove the content that kithack has generated in your "tools and output" folders, you can run the clean.sh file to do it quickly. | ||
|
||
## Some vulnerable APK: | ||
|
||
|
@@ -139,22 +142,8 @@ $ sudo bash uninstall.sh | |
|
||
| Demo 1 | Demo 2 | | ||
| ------ | ------ | | ||
<a href="https://asciinema.org/a/fiIoQatBqUh7z79DKTrQnG7bW" target="_blank"><img src="https://asciinema.org/a/fiIoQatBqUh7z79DKTrQnG7bW.svg" /></a>|<a href="https://asciinema.org/a/oV5lttCQpOmmgcgIaFIQEkcxY" target="_blank"><img src="https://asciinema.org/a/oV5lttCQpOmmgcgIaFIQEkcxY.svg" /></a> | ||
<p align="center"> | ||
|
||
## Tutorial: | ||
|
||
<a href="https://asciinema.org/a/OTymOt3NNSTfFERrw2bHvuFw7" target="_blank"><img src="https://asciinema.org/a/OTymOt3NNSTfFERrw2bHvuFw7.svg" /></a>|<a href="https://asciinema.org/a/oV5lttCQpOmmgcgIaFIQEkcxY" target="_blank"><img src="https://asciinema.org/a/oV5lttCQpOmmgcgIaFIQEkcxY.svg" /></a> | ||
<p align="center"> | ||
<a href="https://www.youtube.com/watch?v=Wsdn158PH50"> | ||
<img src="https://github.com/AdrMXR/KitHack/blob/master/images/youtube.png" /> | ||
</a></p> | ||
|
||
## Documentation: | ||
|
||
| Titulo | Link | | ||
|----------------------------------------------|------------------------------| | ||
| Control an android outside the local network | https://youtu.be/V1w1CMSdTyU | | ||
| KitHack - an all-in-one tool | https://youtu.be/-8TCtiI9HWM | | ||
|
||
## Menu: | ||
|
||
|
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
Binary file not shown.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.