{"id":182,"date":"2014-10-14T21:00:39","date_gmt":"2014-10-14T20:00:39","guid":{"rendered":"https:\/\/www.attackdebris.com\/?p=182"},"modified":"2017-06-24T17:48:22","modified_gmt":"2017-06-24T16:48:22","slug":"scriptftf-script-file-transfer-framework","status":"publish","type":"post","link":"https:\/\/www.attackdebris.com\/?p=182","title":{"rendered":"Babel Scripting Framework (babel-sf)"},"content":{"rendered":"

The Babel Scripting Framework (babel-sf) is a collection of custom scripts to facilitate useful pentest related functions via scripting languages.<\/p>\n

All of the following tools are replicated in the following languages \u2013 PowerShell, Perl, Ruby and Python:<\/p>\n

    \n
  1. Portscanner<\/li>\n
  2. ARPscanner<\/li>\n
  3. FTP Client<\/li>\n
  4. WGET Client<\/li>\n
  5. Bind Metasploit Payload<\/li>\n
  6. Reverse Metasploit Payload<\/li>\n<\/ol>\n

    Why a custom scripting framework?<\/strong><\/p>\n

    babel-sf has been created for testing minimal installations, locked down and\/or hardened environments e.g.<\/p>\n

      \n
    1. When the target Operating System has a minimal installation<\/li>\n
    2. When the Operating System’s native tools have been removed<\/li>\n
    3. When the Operating System’s native tools have been locked down via ACLs, Group Policy or AppLocker<\/li>\n<\/ol>\n

      But crucially, you still have access to one or more scripting languages e.g. Python<\/p>\n

      Its development was also partially driven by my own needs:<\/p>\n

        \n
      1. Proof of Concept i.e. to demonstrate why access to scripting languages can be bad!<\/li>\n
      2. System Administrator “Yeah, users have access to [ruby\/perl\/python\/PowerShell], so what?”<\/li>\n<\/ol>\n

        But really Why?<\/strong><\/p>\n

        To solve reoccurring problems encountered during my testing:<\/p>\n

          \n
        1. Having to write your own code to perform a required task (takes time!)<\/li>\n
        2. Having to Google for code to (re)use, tweak and\/or just to get working (takes time!)<\/li>\n<\/ol>\n

          I expect\u00a0 babel-sf to be used when you don’t have any tools or Operating System utilities available e.g.<\/p>\n

            \n
          1. No telnet<\/li>\n
          2. No FTP<\/li>\n
          3. No wget<\/li>\n
          4. No SSH<\/li>\n
          5. No netcat, nmap etc. etc.<\/li>\n<\/ol>\n

            In this scenario you simply download babel-sf\u00a0 onto the target box via a short one liner (in whichever scripting language is available to you).<\/p>\n

            Aims?<\/strong><\/p>\n

            babel-sf “aspires” to be identical in each scripting language:<\/p>\n

              \n
            1. Identical Usage (switches etc.)<\/li>\n
            2. Identical Output<\/li>\n
            3. Offer an identical ‘Look and Feel’<\/li>\n<\/ol>\n

              Functionality?<\/strong><\/p>\n

              As it stands, babel-sf provides scripts for the following functions:<\/p>\n

              1. Portscanner (see examples below)<\/strong>
              \nperl:
              \n\"perl-portscan\"<\/a><\/strong>
              \npython:
              \n              \"portscan-py\"<\/a>
              \nruby:
              \n              \"ruby-portscan\"<\/a>
              \nPowerShell:
              \n              \"powershell_portscan\"<\/a><\/p>\n

              2. Arpscanner (see examples below):<\/strong>
              \nperl:
              \n              \"perl-arpscan\"<\/a>
              \npython:
              \n              \"python-arpscan\"<\/a>
              \nruby:
              \n              \"ruby-arpscan\"<\/a>
              \nPowerShell:
              \n              \"powershell-arpscan\"<\/a><\/p>\n

              So you get the idea, replicated tools in multiple scripting languages…From now on I’ll just show one example screenshot per utility (but they are all there!)<\/p>\n

              3. FTP client (crude)<\/strong>
              \nruby (example):
              \n              \"ruby-ftp\"<\/a><\/strong><\/p>\n

              4. WGET client<\/strong>
              \nperl (example):
              \n              \"perl-wget\"<\/a><\/p>\n

              5. HTTP Server<\/strong>
              \nPowerShell (example):
              \n              \"powershell-http\"<\/a><\/p>\n

              6. Bind Metasploit Payload<\/strong>
              \npython (example):
              \n              \"python-msf-bind\"<\/a><\/p>\n

              7. Reverse Metasploit Payload<\/strong>
              \nruby (example):
              \n              \"ruby-msf-reverse\"<\/a><\/p>\n

              Initial Download?<\/strong><\/p>\n

              Assuming that at least one scripting language is supported on the target system, an initial single line script (which provides wget type functionality) will be run to download babel-sf to the target host.<\/p>\n

              In practice to download babel-sf to our target system we run the relevant script, for our available programming language.\u00a0 This will have to be typed in manually (but thankfully these scripts short and succinct).<\/p>\n

              Perl:<\/strong><\/p>\n

              Create ‘download.pl’ containing the following code and execute via: ‘perl download.pl’<\/p>\n

              use LWP::Simple; mirror('https:\/\/github.com\/attackdebris\/babel-sf\/archive\/master.zip', 'babel-sf.zip');<\/pre>\n
              Python:<\/strong><\/p>\n
              Create ‘download.py’ containing the following code and execture via: ‘python download.py’<\/p>\n
              import urllib; urllib.urlretrieve('https:\/\/github.com\/attackdebris\/babel-sf\/archive\/master.zip', 'babel-sf.zip')<\/pre>\n
              Ruby:<\/strong><\/p>\n
              Create ‘download.rb’ containing the following code and execture via: ‘ruby download.rb’<\/p>\n
              require 'open-uri'; File.open(\"babel-sf.zip\", \"wb\").write(open(\"https:\/\/github.com\/attackdebris\/babel-sf\/archive\/master.zip\", \"rb\").read)<\/pre>\n
              PowerShell:<\/strong><\/p>\n
              Create ‘download.ps1’ containing the following code and execture via: ‘powershell .\\download.ps1’<\/p>\n
              (new-object System.Net.WebClient).Downloadfile(\"https:\/\/github.com\/attackdebris\/babel-sf\/archive\/master.zip\",\"babel-sf.zip\")<\/pre>\n
              Obviously, if you were located on a closed network you would download from your own host, rather than from github.<\/p>\n
              Script Uniformity?<\/strong><\/p>\n
              The scripts offer uniform functionality to a point, some exceptions are:<\/p>\n
              Ruby has a socket limit (approx 1024):<\/strong>\u00a0 This limits the maximum number of ports that can be scanned at once<\/p>\n
              I had to be flexible with the type of metasploit shells included:<\/strong>\u00a0 Whilst, bind and reverse shells are included for each scripting language, one language may provide tcp_shells whlilst another may provide meterpreter shells<\/p>\n
              Whilst the underlying functionality is similar for all of the different HTTP servers:<\/strong> It proved tricky getting HTTP servers to provide a uniform look\/feel:<\/p>\n
              Arpscanner usage varies a little between languages: <\/strong>The interface switch (e.g. eth0) is not currently supported in all languages<\/p>\n
              Confessions!<\/strong><\/p>\n
                \n
              1. I’m not a coder (if you are a coder, look away now!)<\/li>\n
              2. Coding in 4 different languages at the same time is foolhardy!<\/li>\n
              3. Bugs \/ Errors abound<\/li>\n
              4. If you don’t like certain aspects, contribute! Make them better!<\/li>\n<\/ol>\n
                Testing!<\/strong><\/p>\n
                  \n
                1. Only limited testing has been conducted<\/li>\n
                2. Further testing, testing, testing is required e.g. What versions of Perl, Python, Ruby and PowerShell do the scripts run on?<\/li>\n<\/ol>\n
                  babel-sf has been tested on the following target Operating Systems:<\/p>\n
                  Perl, Python and Ruby (Currently only targeting Nix systems)<\/p>\n
                    \n
                  1. Ubuntu 12.04<\/li>\n
                  2. Debian “wheezy”<\/li>\n<\/ol>\n
                    PowerShell (Windows)<\/p>\n
                      \n
                    1. Created on and tested in PowerShell version 2.0 (Windows 7)<\/li>\n<\/ol>\n
                      Future Additions?<\/strong><\/p>\n
                      Addition of further scripting languages:<\/p>\n
                        \n
                      1. PHP<\/li>\n
                      2. VBScript<\/li>\n
                      3. Java<\/li>\n
                      4. More?<\/li>\n<\/ol>\n
                        Links:<\/strong>
                        \nGithub – https:\/\/github.com\/attackdebris\/babel-sf\/<\/a>
                        \nBlog –                         https:\/\/www.attackdebris.com\/?p=182<\/a><\/p>\n
                        Babel-sf is not wholly new code by any means; large snipets, small snipets and great ideas have been borrowed from many other open source repositories (hopefully, I’ve remembered to reference them all!):<\/p>\n
                        References:<\/strong>
                        \n                         http:\/\/pentestmonkey.net\/cheat-sheet\/shells\/reverse-shell-cheat-sheet<\/a>
                        \n                        http:\/\/www.phillips321.co.uk\/2013\/10\/22\/one-line-python-meterpreter-reverse-shell\/<\/a>
                        \n                        http:\/\/obscuresecurity.blogspot.co.uk\/2014\/05\/dirty-powershell-webserver<\/a>
                        \n                        http:\/\/gist.github.com\/wagnerandrade\/5424431<\/a>
                        \n                        http:\/\/hacknotes.wikidot.com\/useful-scripts<\/a>
                        \n                        http:\/\/www.jnthn.net\/perlportscanner.shtml<\/a>
                        \n                        http:\/\/search.cpan.org\/~ingy\/IO-All\/lib\/IO\/All.pod<\/a>
                        \n                        https:\/\/docs.python.org\/2\/library\/simplehttpserver<\/a>
                        \n                        http:\/\/stackoverflow.com\/users\/464744\/blender<\/a>
                        \n                        http:\/\/www.ruby-doc.org\/stdlib-2.0\/libdoc\/webrick\/rdoc\/WEBrick<\/a>
                        \n                        http:\/\/www.rapid7.com\/db\/modules\/payload\/ruby\/shell_reverse_tcp<\/a>
                        \n                        http:\/\/gist.github.com\/jstorimer\/3522068<\/a>
                        \n                        Coding for penetration testers (Syngress Press)<\/a>
                        \n                        http:\/\/snipplr.com\/view\/46170\/<\/a>
                        \n                        http:\/\/code.activestate.com\/recipes\/439094-get-the-ip-address-associated-with-a-network-inter\/<\/a>
                        \n                        http:\/\/ijdc.blogspot.co.uk\/2011\/12\/powershell-script-to-get-mac-address<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"
                        The Babel Scripting Framework (babel-sf) is a collection of custom scripts to facilitate useful pentest related functions via scripting languages. All of the following tools are replicated in the following languages \u2013 PowerShell, Perl, Ruby and Python: Portscanner ARPscanner FTP Client WGET Client Bind Metasploit Payload Reverse Metasploit Payload Why a custom scripting framework? babel-sf … <\/p>\n
                        Continue reading<\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":true,"jetpack_social_options":{"image_generator_settings":{"template":"highway","enabled":false},"version":2}},"categories":[1],"tags":[],"class_list":["post-182","post","type-post","status-publish","format-standard","hentry","category-tools","item-wrap"],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/p3MDvd-2W","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/posts\/182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=182"}],"version-history":[{"count":68,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/posts\/182\/revisions"}],"predecessor-version":[{"id":360,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=\/wp\/v2\/posts\/182\/revisions\/360"}],"wp:attachment":[{"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.attackdebris.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}