Skip to content

Commit

Permalink
Update README.md
Browse files Browse the repository at this point in the history
  • Loading branch information
Shmuel930 authored Apr 6, 2024
1 parent f96ff00 commit 99591b7
Showing 1 changed file with 11 additions and 8 deletions.
19 changes: 11 additions & 8 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@ It offers two modes of operation: automated and manual.
In automated mode, EDRaser scans the C class of a given address space of IPs for vulnerable systems and attacks them automatically.
The attacks in auto mode are:

- Remote deletion of webserver logs.
- Remote deletion of web server logs.
- SysLog deletion (on Linux).
- Local deletion of Windows Application event logs.
- Remote deletion of Windows event logs.
Expand All @@ -25,7 +25,7 @@ python edraser.py --auto
### Manual Mode

In manual mode, you can select specific attacks to launch against a targeted system, giving you greater control.
Note that some attacks, such as VMX deletion, are for local machine only.
Note that some attacks, such as VMX deletion, are for local machines only.

To use EDRaser in manual mode, you can use the following syntax:

Expand All @@ -41,12 +41,12 @@ Arguments:
'access_logs', 'remote_db', 'local_db', 'remote_db_webserver']

Optional arguments:
- `port` : port of remote machine
- `port`: port of remote machine
- `db_username`: the username of the remote DB.
- `db_password`: the password of the remote DB.
- `db_type`: type of the DB, EDRaser supports `mysql`, `sqlite`. (# Note that for sqlite, no username\password is needed)
- `db_name`: the name of remote DB to be connected to
- `table_name`: the name of remote table to be connected to
- `db_name`: the name of the remote DB to be connected to
- `table_name`: the name of the remote table to be connected to
- `rpc_tools`: path to the VMware rpc_tools


Expand All @@ -65,15 +65,18 @@ it can be done by the following command:
EDRaser.py -attack remote_db_webserver -db_type mysql -db_username test_user -db_password test_password -ip 192.168.1.10

This will bring up a web server on the localhost:8080 address, it will allow you to view & insert data to a remote given DB.
This feature is designed to give an example of a "Real world" scenario where you have a website that you enter data into it and it keeps in inside a remote DB, You can use this feature to manually insert data into a remote DB.
This feature is designed to give an example of a "Real world" scenario where you have a website that you enter data into and it keeps it inside a remote DB, You can use this feature to manually insert data into a remote DB.

### Available Attacks

In manual mode, EDRaser displays a list of available attacks. Here's a brief description of each attack:

1. Windows Event Logs: Deletes Windows event logs from the remote targeted system.
2. VMware Exploit: Deletes the VMX and VMDK files on the host machine. This attack works only on the localhost machine in a VMware environment by modifying the VMX file or directly writing to the VMDK files.
3. Web Server Logs: Deletes access logs from web servers running on the targeted system by sending a malicious string user-agent that is written to the access-log files.
4. SysLogs: Deletes syslog from Linux machines running Kaspersky EDR without being .
3. Web Server Logs: Deletes access logs from web servers running on the targeted system by sending a malicious string user-agent that is written to the access log files.
4. SysLogs: Deletes syslog from Linux machines running Kaspersky EDR without being.
5. Database: Deletes all data from the remotely targeted database.

## Author - Shmuel Cohen
* LinkedIn - [Shmuel Cohen](https://www.linkedin.com/in/the-shmuel-cohen/)
* Twitter - [@_BinWalker_](https://twitter.com/_BinWalker_)

0 comments on commit 99591b7

Please sign in to comment.