______ __ ______ __ __ __ __ _____ __ __ __
| __ \.-----.--| |______| __ \.---.-.| |--.| |--.|__| |_ ______| \.-----.----.--.--.--------.-----.-----.| |_.---.-.| |_|__|.-----.-----.
| <| -__| _ |______| <| _ || _ || _ || | _|______| -- | _ | __| | | | -__| || _| _ || _| || _ | |
|___|__||_____|_____| |___|__||___._||_____||_____||__|____| |_____/|_____|____|_____|__|__|__|_____|__|__||____|___._||____|__||_____|__|__|
The next few sections will be dedicated to the red rabbit documentation, the sections will be disected by module, eg: (0x0001 is module search) it goes from there
from the list above. Another example of how modules will be seperated is by the cloumn number in the chart above where Brute is the second module name, its section will
be labeled 0x0002 - BRUTE -, please take your time going through the documentation ALOT of people often forget about documentation then come to the devs confused as to
why some dont work, or how the script works and how to use it, so please, when i mean read it i mean READ IT CAREFULLY!
this next session will talk about injecting files, images, and interacting with payloads
alot of this section is short and does not need exploration or even experience to understand
hope it is easy for you.
> inject gif
This command belongs to the stegonography segment
of red rabbit, this command allows the user to inject
a payload into a given GIF image/short video. If the image
is not real path, or does not exist there are backend systems
to run and generate a customized GIF based on the name that was not
found or could not be opened that you inputted as a path.
in the example below when you inject your image you are shown
whjat you injected, the path to the image, the exif table, and the
hex code showing the location of the GIF
RR6: Injecting -> script>alert()script>
RR6: Path -> examples2/main.gif
RR6: Payload -> Sucess in injection
000AC080 A9 96 2C D9 98 CC 47 98 - 5E E9 88 97 A9 97 A1 69 ..,...G.^......i
000AC090 99 7E E9 8B 5F 39 9A 80 - 89 9A BE 97 95 AA D9 9A .~.._9..........
000AC0A0 AE F9 9A B0 19 9B B2 39 - 9B B4 59 9B B6 79 9B 68 .......9..Y..y.h
000AC0B0 97 92 B8 B9 9B BC 99 10 - 09 10 02 00 3B 2A 2F 3D ............;*/=
000AC0C0 31 3B 3C 73 63 72 69 70 - 74 3E 61 6C 65 72 74 28 1;script>alert(
000AC0D0 29 3C 2F 73 63 72 69 70 - 74 3E 3B )/script>;
┌─────────────╥────────────────────┬─────────────────────────┐
│ Data Number ║ Data │After DATA EXIF │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║AnimationIterations │ Infinite │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FileName │ main.gif │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FrameCount │ 237 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║MIMEType │ image/gif │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FileAccessDate │2022:05:21 14:38:42-04:00│
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║ColorResolutionDepth│ 8 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║HasColorMap │ Yes │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║Megapixels │ 5.3 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FileTypeExtension │ gif │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FileSize │ 688 KiB │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║ExifToolVersion │ 12.30 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║ImageSize │ 10799x492 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║ImageHeight │ 492 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║BackgroundColor │ 0 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║ImageWidth │ 10799 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FileType │ GIF │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FilePermissions │ -rw-r--r-- │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FileModifyDate │2022:05:26 21:19:19-04:00│
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║Duration │ 7.11 s │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║GIFVersion │ 89a │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║BitsPerPixel │ 5 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║Directory │ examples2 │
├─────────────╫────────────────────┼─────────────────────────┤
│1 ║FileInodeChangeDate │2022:05:26 21:19:19-04:00│
└─────────────╨────────────────────┴─────────────────────────┘
> inject jpg, webp, bmp
All of these commands
inject jpg
inject webp
inject bmp
all do the same exact thing, inject a payload into an image is the basis of all four of these commands
> inject png
This command is apart of the stegonography toolkit and section
that red rabbit holds, however this module is very very much
different than any of the other stegonography modules and toolkits
that red rabbit has in its selection. This image injection module
is still being upgraded since it was built on a module written
by the authors of the black hat go book, credits to them for such
an amazing oppurtinity to inspire my team to look into stegonography
and even modify the toolkit they taught us to build that i implimented
into the red rabbit project. Currently this module can do a few things such
as-
-> Inject a simple payload into a PNG image
-> Inject a encoded payload into a PNG image
-> decode a payload in a PNG image
-> Get meta and image information on the PNG image
This toolkit also inspired some other things such as stegonography with archives which we will discuss next
inject png is just one command however it has a few flags that can be used with it, in order to
properly use this command and sucessfully inject your payload into the PNG image you must do a few things
like specifying flags, for the most common usage of this script you can run the following
Running script without being compiled
|
sudo go run main.go -i="path/to/image/image.png" -o="output_of_injected_image.png" --payload="some_payloas-02394890234890238904238904238904809342"
Running script in binary form
sudo ./main -i="path/to/image/image.png" -o="output_of_injected_image.png" --payload="some_payloas-02394890234890238904238904238904809342"
example output below of a simple injection being made to a PNG image
[+] Setting: All flags are correct
[+] Setting: Modifying Payload | 237823784789234789237489237984278394278934
[+] Setting: Modifying Type | rNDm
[+] Setting: Modifying Chunk Size | 0
[+] Setting: Modifying data |
[+] Setting: Untouched/Unmodded payload | 32 33 37 38 32 33 37 38 34 37 38 39 32 33 34 37 38 39 32 33 37 34 38 39 32 33 37 39 38 34 32 37 38 33 39 34 32 37 38 39 33 34
[+] Setting: Untouched/Unmodded Byte P | 32 33 37 38 32 33 37 38 34 37 38 39 32 33 34 37 38 39 32 33 37 34 38 39 32 33 37 39 38 34 32 37 38 33 39 34 32 37 38 39 33 34
Stego Module: image has been sucessfully created
Stego Module: Payload has properly been injected
> inject payload && inject payloadl && inject payloadul
First off im going to start this by saying all three of these commands are the same
but they are ran differently such as using different methods to encode the payload
or embed the payload into a URL
now a simple example of what this does is takes the payload you enter or a list of payloads
and will inject it into the header of the URL, not the response header but the head of the URL
so your URL will go from
http://www.example.com -> http://www.example.com?=%3Cscript%3Ealert%28%29%3C%2Fscript%3E
simple payload parsing at its finest, however there are very few ways of doing this such as the
other two methods we have. The first command "inject payload" will just ask the user for a URL
and a payload then simply parse the URL with the payload
the next one which is payloadul will take a list of URL's and parse it with a given payload you
tend to input or use, making the output something like this
https://www.google.com?=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E
https://www.youtube.com?=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E
https://www.hulu.com?=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E&=%3Cscript%3Ealert%28%29%3C%2Fscript%3E
the last and final one "inject payloadl" will take a list of PAYLOADS and parse it into
a given URL, an example output of this would be the following below, if your list is wack and
not structures properly it may result in a poor output like the following
https://www.example.com?=admin%2F&=administrator%2F&=admin1%2F&=admin2%2F&=admin3%2F&=admin4%2F&=admin5%2F&=usuarios%2F&=usuario%2F&=moderator%2F&=webadmin%2F&
=adminarea%2F&=bb-admin%2F&=adminLogin%2F&=admin_area%2F&=panel-administracion%2F&=instadmin%2F&=memberadmin%2F&=administratorlogin%2F&=adm%2F&=admin%2Faccount.php&
=admin%2Findex.php&=admin%2Flogin.php&=admin%2Fadmin.php&=admin_area%2Fadmin.php&=admin_area%2Flogin.php&=siteadmin%2Flogin.php&=siteadmin%2Findex.php&=siteadmin%2F
login.html&=admin%2Faccount.html&=admin%2Findex.html&=admin%2Flogin.html&=admin%2Fadmin.html&=admin_area%2Findex.php&=bb-admin%2Findex.php&=bb-admin%2Flogin.php&=bb-a
dmin%2Fadmin.php&=admin%2Fhome.php&=admin_area%2Flogin.html&=admin_area%2Findex.html&=admin%2Fcontrolpanel.php&=admin.php&=admincp%2Findex.asp&=admincp%2Flogin.asp&=
admincp%2Findex.html&=adminpanel.html&=webadmin.html&=webadmin%2Findex.html&=webadmin%2Fadmin.html&=webadmin%2Flogin.html&=admin%2Fadmin_login.html&=admin_login.html&
=panel-administracion%2Flogin.html&=admin%2Fcp.php&=cp.php&=administrator%2Findex.php&=administrator%2Flogin.php&=nsw%2Fadmin%2Flogin.php&=webadmin%2Flogin.php&=admin%
2Fadmin_login.php&=admin_login.php&=administrator%2Faccount.php&=administrator.php&=admin_area%2Fadmin.html&=pages%2Fadmin%2Fadmin-login.php