I ran into an issue while installing Google Authenticator on Ubuntu 18 and although the solution is simple, it's given me an opportunity to discuss three items.
First, the issue:
You attempt to install Google Authenticator using the following:
sudo apt install libpam-google-authenticator
And you're presented with the following error:
E: Unable to locate package libpam-google-authenticator
I attended Cactuscon this past weekend and there was a talk on cracking Active Directory hashes. When I entered the room (late), it was standing room only. For a few minutes, I listened in but eventually ended up leaving because the gist of the talk is something I already practice. Essentially, build a cracking machine, dump the Active Directory hashes, and check for weak passwords.
My cracking machine is a Dell Precision 3600 Series workstation with an NVidia 8GB GPU. Without the GPU, using my 400MB wordlist, it takes approximately 2.5 hours to exhaust the list. With the GPU, it takes 7 minutes. It's a modest cracking machine and its purpose isn't to win any contests. I just want to get through a reasonable wordlist in a reasonable amount of time. This meets that goal.
I've never really understood the purpose of Pastebin from a practical sense. I think I get the concept, I just don't know why you'd use it. That being said, its darker side is breach data dumping for the world to see.
Yesterday, I was thinking about the API and wondering if I wanted to write a script to search the pastes for client email addresses. While digging around on the site, I checked out a few pastes. Lots of people dumping code snippets and then I saw something. Among the code snippets, I saw what looked to be base64. I grabbed it, decoded it, and what I saw looked to be binary gibberish. I thought it was going to be something clever like a message but that's just me playing too much CTF. But then I did a Google search for "What is the purpose of Pastebin?" and I saw a search result talking about base64 encoded malware. What!?!? After reading the article, I was left with only a partial picture. Perhaps the author didn't want to spell things out completely? I don't know. So I started working it through on my own.
I often get asked why people should care about their web server getting hacked. The argument for their lack of concern is the fact that their web server isn’t on their corporate network so they are isolated from any potential harm.
If I were to replace all of the photos on your website with cat memes, would you care? Take this a step further with something offensive. So now I have your attention -- or at least I think I do. It gets worse.
If your site is vulnerable to cross site scripting, we can do the Internet's version of graffiti. Pretty simple stuff if you don't sanitize inputs. Also about as dangerous as cat memes in that we're introducing different content but causing no real harm unless you don't like cats.
In order to defend against attacks, you have to understand the attack vectors and weigh the risks. A meterpreter shell generated into an .exe file with msfvenom won't make it through email and if it somehow did manage to make its way to a desktop, it would immediately get gobbled up by the antivirus software. I know this for a fact because I've generated said payload and dropped it onto a desktop. I'm not worried about .exe files. On the other hand, I consider Microsoft Office documents a potential risk.
I can block .exe files but I cannot block Microsoft Office documents without angering the masses. With that in mind, what's the exposure? Depends on the users, no? The sender is also a factor.
Every so often, I come across a challenge that has a password encrypted zip file. And every so often I realize I've switched my working laptop and I no longer have Jumbo John installed. Recently I encountered that exact scenario and when I attempted to install Jumbo John, something went sideways. Rather than digging through it, and knowing that I'm about to switch my working laptop in the very near future, I decided to use a script instead.
Honestly, after going this route, I'm not exactly sure why this isn't a better approach. Perhaps if I weren't using a wordlist? Multithreading? Dunno. Anyway, I think I can count exactly one time I've come across a zip file with a password in my work. Given that this situation only arises during CTF situations, the script works and I don't have to install anything.