(It's a repost from https://www.acunetix.com/blog/web-security-zone/better-web-pentesting-in-windows-with-ahk/)
Recently, I have moved to Malta. It’s quite hot here, but as I’m from colder country, I like it very much. Actually, I’m obsessed with everything hot, including hotkeys!
Every pentester / researcher / bugbounter / etc has their own approach to doing things in their own work environment. So in this article I’m not looking to give exact solutions, but the aim is to share some ideas (which I found useful), so you can have a fresh look at your approach and push your imagination in this area.
Windows is not a very popular OS for pentesters due to many reasons. Sometimes however we need to use it (at least on a virtual machine). I have been a pentester for 8 years and pentested many “windows-only” applications, I remember that pain, I even got used to it… But, nowadays, everything is not so bad and hacky.
Today I want to discuss AutoHotKey. This is an old tool and, I’m sure, many of you use it for some kind of automations. I suggest to look at it as a tool for pentesters.
I will not explain the syntax of the scripts (there is better doc about it here), but I’ll give you a bunch of examples.
So, the basic idea of AHK is quite simple: In scripts you set global hotkeys and once you press one of them, AHK will make the necessary action. All you need to do is install AHK, create your scripts and run them.
We all use many programs at once, but we need to use ALT+TAB to switch between them, it could be worse if you use multiple-desktop.
Using next script you can focus on a necessary program (or run it, if it’s closed), even if you are on another desktop, just by pressing Shift+Ctrl+F4 (+ – Shift, ^ – Ctrl)
For example, by clicking a hotkey (Ctrl+Tab) I can cycle through the last used tabs (not just next or previous tabs). It works out of the box for Firefox, but for Chrome you need an extension (CLUT: Cycle Last Used Tabs, for example). However even with the extension, you cannot bind Ctrl+Tab for this operation, because you cannot rebind Chrome’s hotkeys.
With AHK , you can easily achieve this. Firstly, AHK gives us an opportunity to set global hotkeys for specific applications. Secondly, we can “rebind” hotkeys. Here, only for Chrome, when we press Ctrl+Tab, AHK intercepts it and sends Alt+W into Chrome (! – Alt), so our extension shows us a last used tab.
Typical example: Wherever I input two symbols “a” and “@“, they will be replaced with my email.
When I pentested Windows-only applications with fat clients, it was annoying to input credentials again and again, especially, if it has “several layers of protection” or if you need to test multiple roles.
Here is a solution. Create a script which you use only during a project (with AHK you can run or stop as many ahk-scripts as you want at any time) with necessary credentials.
Now, you can input them fast without using a text-document and clipboard 🙂
We still do a lot of web hacking manually, therefore, we can set hotstrings for most useful things, which we enter again and again.
Here are some self-explaining examples (here I use % just to make string more unique):
But we can improve it. For example, we can set our favourite payloads and also add random parts to them, so it will be easier to track input/output down in proxy. Wherever we print %xss1, it will be replaced with “<svg/onload=alert(17384)> you see, lol?
To be honest, the AHK’s scripting language doesn’t look friendly to me, so the idea is to use “normal” language, such as python. I found several projects which try to join AHK and Python, but it looks like all of them are forgotten.
So, we use “a universal” way of calling a program from AHK and getting results from it:
But if you set a lot of global-hotkeys, it could be hard to remember them and to use fast. So we can create a menu with internal hotkeys. As our selection may contain special symbols or to be multiline, it’s better to pass it using an additional file. Also, we can put all similar things into one function.
What about other similar tools? Similar tools of course exist and exist in other OS. They have some additional features or limits. For example, python package keyboard or pyautogui which work for Linux and Windows.
You may have a look at some final examples of AHK at my repository.
Recently, I have moved to Malta. It’s quite hot here, but as I’m from colder country, I like it very much. Actually, I’m obsessed with everything hot, including hotkeys!
Every pentester / researcher / bugbounter / etc has their own approach to doing things in their own work environment. So in this article I’m not looking to give exact solutions, but the aim is to share some ideas (which I found useful), so you can have a fresh look at your approach and push your imagination in this area.
Windows is not a very popular OS for pentesters due to many reasons. Sometimes however we need to use it (at least on a virtual machine). I have been a pentester for 8 years and pentested many “windows-only” applications, I remember that pain, I even got used to it… But, nowadays, everything is not so bad and hacky.
Today I want to discuss AutoHotKey. This is an old tool and, I’m sure, many of you use it for some kind of automations. I suggest to look at it as a tool for pentesters.
Basics
AHK – a small tool which can set global hotkeys and perform a lot of actions in OS. Actually, it has its own scripting language, and, if you have enough knowledge (and patience), you can do whatever you want.I will not explain the syntax of the scripts (there is better doc about it here), but I’ll give you a bunch of examples.
So, the basic idea of AHK is quite simple: In scripts you set global hotkeys and once you press one of them, AHK will make the necessary action. All you need to do is install AHK, create your scripts and run them.
We all use many programs at once, but we need to use ALT+TAB to switch between them, it could be worse if you use multiple-desktop.
Using next script you can focus on a necessary program (or run it, if it’s closed), even if you are on another desktop, just by pressing Shift+Ctrl+F4 (+ – Shift, ^ – Ctrl)
+^F4::
SetTitleMatchMode 2
IfWinExist Sublime Text
WinActivate, Sublime Text
else
run "C:\Program Files\Sublime Text 3\sublime_text.exe"
return
+^F5::
IfWinExist Google Chrome
WinActivate, Google Chrome
else
run "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe"
returnRebinding
For researching/pentesting something related to web, you need to have all popular browsers at your hands. But it’s such a pain that they have different or lack of hotkeys.For example, by clicking a hotkey (Ctrl+Tab) I can cycle through the last used tabs (not just next or previous tabs). It works out of the box for Firefox, but for Chrome you need an extension (CLUT: Cycle Last Used Tabs, for example). However even with the extension, you cannot bind Ctrl+Tab for this operation, because you cannot rebind Chrome’s hotkeys.
With AHK , you can easily achieve this. Firstly, AHK gives us an opportunity to set global hotkeys for specific applications. Secondly, we can “rebind” hotkeys. Here, only for Chrome, when we press Ctrl+Tab, AHK intercepts it and sends Alt+W into Chrome (! – Alt), so our extension shows us a last used tab.
#IfWinActive ahk_exe chrome.exe
^Tab::
Send, !w
return
#IfWinActiveHotstrings
Also, AHK supports hotstrings. What is it? When we input a specific consequence of symbols anywhere in Windows, AHK replaces it with whatever you want.Typical example: Wherever I input two symbols “a” and “@“, they will be replaced with my email.
Here are some cases which I found useful.:*:a@::agrrrdog@gmail.com
When I pentested Windows-only applications with fat clients, it was annoying to input credentials again and again, especially, if it has “several layers of protection” or if you need to test multiple roles.
Here is a solution. Create a script which you use only during a project (with AHK you can run or stop as many ahk-scripts as you want at any time) with necessary credentials.
:*:!t1::testAccount
:*:!p1::VeryLoooooongP4ssword
:*:!t2::adminTestAccount
:*:!p2::p4ssw0rd Now, you can input them fast without using a text-document and clipboard 🙂
We still do a lot of web hacking manually, therefore, we can set hotstrings for most useful things, which we enter again and again.
Here are some self-explaining examples (here I use % just to make string more unique):
::%lh::localhost
::%lhh::http://localhost
:*:%hs::https://
::%d.c::document.cookie
::%d.d::document.domain
::%js::javascript:
:*:%c.l::console.log('');{Left 3}
::%alrt::https://yourserver.com/xss_payload.js
::%man::¯\_(ツ)_/¯But we can improve it. For example, we can set our favourite payloads and also add random parts to them, so it will be easier to track input/output down in proxy. Wherever we print %xss1, it will be replaced with “<svg/onload=alert(17384)> you see, lol?
:?*:%xss1::
Random, rand, 1, 99999
SendInput "<svg/onload=alert(%rand%)>
return::%xgl::
Random, rand, 1, 99999
SendInput http://x%rand%.yourserver.here/poc
returnEncode-everywhere
When pentesting or researching something, we often work with strings and their encoding, modifications. We have some tools which help us (like HackBar addon for browsers) or use online resources. What if we can make it (semi-)global? For example, we select a string in any application, press a hotkey and get its base64-(de/en)coded version? Or md5-hash of it? Or any other mutation?To be honest, the AHK’s scripting language doesn’t look friendly to me, so the idea is to use “normal” language, such as python. I found several projects which try to join AHK and Python, but it looks like all of them are forgotten.
So, we use “a universal” way of calling a program from AHK and getting results from it:
!F10::
SendInput {Ctrl down}c{Ctrl up}
RunWait %ComSpec% /c ""python" "converter.py" "urldec" "%Clipboard%" > "%A_Temp%\tmp1.txt"",,HIDE
FileRead result, %A_Temp%\tmp1.txt
sleep, 100
Clipboard := result
SendInput {Ctrl down}v{Ctrl up}
returnBut if you set a lot of global-hotkeys, it could be hard to remember them and to use fast. So we can create a menu with internal hotkeys. As our selection may contain special symbols or to be multiline, it’s better to pass it using an additional file. Also, we can put all similar things into one function.
RunProgram(command)
{
SendInput {Ctrl down}c{Ctrl up}
;sleep, 200 ; it added some stability for one of my laptops
FileAppend, %Clipboard%, %A_Temp%\tmp_in.txt
RunWait %ComSpec% /c ""python" "C:\path_to_script\kostyli.py" "%command%" ",,HIDE
FileRead, Clipboard, %A_Temp%\tmp_out.txt
;sleep, 100 ; it added some stability for one of my laptops
SendInput {Ctrl down}v{Ctrl up}
FileDelete, %A_Temp%\tmp_in.txt
FileDelete, %A_Temp%\tmp_out.txt
}
Menu, EncoderMenu, Add, &Base64 Encode, B64EncHandler
Menu, EncoderMenu, Add, B&ase64 Decode, B64DecHandler
Menu, EncoderMenu, Add, &URL Encode, UrlEncHandler
Menu, EncoderMenu, Add, U&rl Decode, UrlDecHandler
return
B64EncHandler:
RunProgram("b64enc")
return
#c::Menu, EncoderMenu, ShowSome tips
- Be careful with global hotkeys (which you set not only for one/group application), because you can “override” some useful hotkeys of app.
- Hotstrings don’t work so well in smart text-editors (like Sublime or VS Code), because AHK just send keys instead of you, so autocompletion and similar features of a text editor come into play.
- Be careful when you use SendInput if you have several keyboard layouts in OS.
- AHK is quite a reliable tool, but sometimes it doesn’t work so fast and it’s hard to debug. So, keep things simple.
- You can set a hotkey to reload the script which is very useful during development (!^+R::Reload).
- AHK allows you to find the elements of a window and makes actions with them (click, input text). So you can set hotkeys even if an application doesn’t have them. Java Swing application is not supported by default, but by using Java Access Bridge and this library (https://github.com/Elgin1/Java-Access-Bridge-for-AHK) we can archive it.
Conclusion
In the beginning of the article I wrote about “hacky-way”… ok. AHK is a totally hacky solution, but it works!What about other similar tools? Similar tools of course exist and exist in other OS. They have some additional features or limits. For example, python package keyboard or pyautogui which work for Linux and Windows.
You may have a look at some final examples of AHK at my repository.
Комментариев нет:
Отправить комментарий