OpRedScare

gistfile1.txt

https://rentry.co/opredscare

+-------------------------------------------------------------------------------------+

OBJECTIVE - To disable Russian and Belarusian infrastructure (banking, transportation, military, energy)
DO NOT TARGET HOSPITALS, EDUCATION, OR SOCIAL SERVICES
TARGETS :
Russia
- https://anonfiles.com/hcPfm8K5xe/gov.ru_domains_csv
- https://anonfiles.com/j4Pdm9K2x5/mil.ru_domains_csv

Belarus
- https://anonfiles.com/n8K9y5K1x1/mil.by_domains_csv
- https://anonfiles.com/paK7y0Kcxc/gov.by_domains_csv

Request from the Vice Minister of Ukraine
- https://pastebin.com/fH6hyaJG

Basic outline of what to do:

Run masscan of Russian IP space for specific ports.
Collect scan data to see what is responding.
Run focused scans with specialized scanners - SQLmap,OpenVAS, WPScan, etc.
Validate data with multiple scans and OSINT.
Find vulnerability and exploit data based on scans.
Exploit vulnerabilities with MetaSploit, etc.
Take down these services.
Disclaimer:
Don't do attacks under the OPUkraine banner as this could compromise the OP

Guides:
How to run masscan looking for OSINT data: https://pad.riseup.net/p/scanner-howto-keep

Find real IP's behind CloudFlare: https://www.secjuice.com/finding-real-ips-of-origin-servers-behind-cloudflare-or-tor/

Knowledge is power - Use Tor, VPN, or Proxies!
And rememeber.....OPSEC! OPSEC! OPSEC!

Recommended Software:

https://www.torproject.org/
https://www.whonix.org/
https://tails.boum.org/
https://www.kali.org/
https://www.virtualbox.org/
Quickly get up to speed, hacking tips and tricks: http://archiveiya74codqgiixo33q62qlrqtkgmcitqx5u2oeqnmn5bpcbiyd.onion/m5spr

Brush up on Log4j: https://www.reddit.com/r/blueteamsec/comments/rd38z9/log4j_0day_being_exploited/

Buy web shells, cpanels and RDP's: https://xleet.pw/

ReconFTW: https://github.com/six2dez/reconftw

Shodan: admin bypass: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/4QfmFLDBg5Wv7NISCtkp-keep

Bruteforce servers on mass!: http://kfahv6wfkbezjyg4r6mlhpmieydbebr5vkok5r34ya464gqz6c44bnyd.onion/p/uL5oQGQCjfMiB3An3PV--keep
https://pad.riseup.net/p/uL5oQGQCjfMiB3An3PV--keep

Open Source Intelligence Tools:
https://github.com/cipher387

Autonomous Systems Numbers:

Russia - https://bgp.he.net/search?search%5Bsearch%5D=russia&commit=Search

Belarus - https://bgp.he.net/search?search%5Bsearch%5D=belarus&commit=Search

Russian IP Blocks:
https://pastebin.6com/H3FU4X3h

Belarus IP Blocks:
https://apps.db.ripe.net/db-web-ui/query?bflag=false&dflag=false&rflag=true&searchtext=Belarus&source=RIPE

Russian mil.ru and gov.ru domains:
https://anonfiles.com/j4Pdm9K2x5/mil.ru_domains_csv

https://anonfiles.com/hcPfm8K5xe/gov.ru_domains_csv

https://pastebin.com/rbqKeZ1p

Belarus mil.by and gov.by domains:
https://anonfiles.com/r0l0n2Kax3/mil.by_domains_csv

https://anonfiles.com/valfn9K0xc/gov.by_domains_csv

Russian Network Recon:
https://pad.riseup.net/p/BtLcKr1O6bcMyBVvk6NL

Russian hosts and info: (biggie list)

strongerw2ise74v3duebgsvug4mehyhlpa7f6kfwnas7zofs3kov7yd.onion/pmn27ntm1/ik41es
https://pad.riseup.net/p/Euh-UQeWC-gqZdLcObkb

DNS Servers

ns3.rttv.ru.
91.217.21.1
ns8-l2.nic.ruRU-CENTER
Russia pns31.cloudns.net.
185.136.96.66
pns31.cloudns.netCLOUDNSNET
United States ns33.cloudns.net.
54.36.26.145
ns33.cloudns.netOVH
France ns34.cloudns.net.
185.206.180.104
ns34.cloudns.netPUBLICLOUD
Germany ns4.rttv.ru.
91.217.20.1
ns4-l2.nic.ruRU-CENTER
Russia pns33.cloudns.net.
185.136.98.66
pns33.cloudns.netCLOUDNSNET
United States ns32.cloudns.net.
209.58.140.85
ns32.cloudns.netLEASEWEB-USA-SFO-12
United States ns1.rttv.ru.
109.73.15.35
ns1.rttv.ruRUSSIA_TODAY
Russia ns2.rttv.ru.
185.79.236.245
ns2.rttv.ruRTTV
Russia pns34.cloudns.net.
185.136.99.66
pns34.cloudns.netCLOUDNSNET
unknown ns31.cloudns.net.
109.201.133.111
ns31.cloudns.netNFORCE
Netherlands pns32.cloudns.net.
185.136.97.66
pns32.cloudns.netCLOUDNSNET
unknown
MX Records ** This is where email for the domain goes...

10 aspmx.l.google.com.
142.250.123.26
gh-in-f26.1e100.netGOOGLE
United States 30 aspmx3.googlemail.com.
64.233.186.26
cb-in-f26.1e100.netGOOGLE
United States 30 aspmx4.googlemail.com.
209.85.202.27
dg-in-f27.1e100.netGOOGLE
United States 20 alt2.aspmx.l.google.com.
64.233.186.26
cb-in-f26.1e100.netGOOGLE
United States 30 aspmx5.googlemail.com.
64.233.184.27
wa-in-f27.1e100.netGOOGLE
United States 20 alt1.aspmx.l.google.com.
108.177.12.27
ua-in-f27.1e100.netGOOGLE
United States 30 aspmx2.googlemail.com.
108.177.12.27
ua-in-f27.1e100.netGOOGLE
United States
TXT Records ** Find more hosts in Sender Policy Framework (SPF) configurations

"2022011010555941x7yj86eamnw0fqybdwpugz9sa9coq2jlzkv1a4rr04avj64t""v=spf1 include:_spf.google.com ~all"
Host Records (A) ** this data may not be current as it uses a static database (updated monthly)

rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx207.244.80.170
LEASEWEB-USA-WDC
United States creativelab.rt.com

HTTP: nginx54.194.41.141
ec2-54-194-41-141.eu-west-1.compute.amazonaws.comAMAZON-02
Ireland mail1.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.186
mail1.rt.comRTTV
Russia social.rt.com

HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.2
HTTP TECH: nginx95.131.27.119
DTLN
Russia ns0.rt.com

207.244.80.161
LEASEWEB-USA-WDC
United States ns.wpc.ar.rt.com

0.0.0.0

unknown wpc.fr.rt.com

37.48.108.104
LEASEWEB-NL-AMS-01 Netherlands
Netherlands ar.wpc.rt.com

37.48.108.110
LEASEWEB-NL-AMS-01 Netherlands
Netherlands m102.subscribe.rt.com

185.9.230.102
m102.subscribe.rt.comCIREX
Russia ns4.rt.com

185.79.236.249
ns4.rt.comRTTV
Russia dev.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.100
RTTV
Russia ns3.rt.com

82.202.190.82
KL-KDP
Russia api.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx89.191.237.181
ROSTELECOM-AS
Russia ns.wpc.fcm.rt.com

0.0.0.0

unknown wpc.fcm.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.168
RTTV
Russia ns1.rt.com

82.202.189.162
KL-KDP
Russia monitoring.wpc.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.165
mail2.rt.comROSTELECOM-AS
Russia m103.subscribe.rt.com

185.9.230.103
m103.subscribe.rt.comCIREX
Russia dvlp.wpc.rt.com

89.191.237.180
ROSTELECOM-AS
Russia files.wpc.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.185
ROSTELECOM-AS
Russia contacts.rt.com

HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_7.4
HTTP TECH: nginx91.218.228.51
hosted-by.ihc.ruEUROBYTE Eurobyte LLC
Russia en.wpc.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx37.48.108.112
LEASEWEB-NL-AMS-01 Netherlands
Netherlands mp.wpc.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.184
ROSTELECOM-AS
Russia wpc.es.rt.com

207.244.80.171
LEASEWEB-USA-WDC
United States ns.wpc.es.rt.com

0.0.0.0

unknown ddbm.rt.com

HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_7.4
HTTP TECH: nginx91.218.228.51
hosted-by.ihc.ruEUROBYTE Eurobyte LLC
Russia fcm.wpc.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.182
ROSTELECOM-AS
Russia ns.wpc.en.rt.com

0.0.0.0

unknown m104.subscribe.rt.com

185.9.230.104
m104.subscribe.rt.comCIREX
Russia ns5.rt.com

37.48.108.98
LEASEWEB-NL-AMS-01 Netherlands
Netherlands charity.rt.com

109.73.15.153
RUSSIA_TODAY
Russia mgmt.wpc.rt.com

HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_8.1
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.163
ROSTELECOM-AS
Russia ru.wpc.rt.com

37.48.108.113
LEASEWEB-NL-AMS-01 Netherlands
Netherlands subscribe.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.183
ROSTELECOM-AS
Russia ns.wpc.fr.rt.com

0.0.0.0

unknown wpc.dvlp.rt.com

89.191.237.180
ROSTELECOM-AS
Russia ns.wpc.ru.rt.com

0.0.0.0

unknown wpc.bk.rt.com

185.79.236.196
RTTV
Russia ns.wpc.bk.rt.com

0.0.0.0

unknown ns.wpc.spprj.rt.com

0.0.0.0

unknown doc.wpc.rt.com

37.48.108.111
LEASEWEB-NL-AMS-01 Netherlands
Netherlands wpc.mp.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.184
ROSTELECOM-AS
Russia ns.wpc.d.rt.com

0.0.0.0

unknown bk2.wpc.rt.com

89.191.237.150
ROSTELECOM-AS
Russia mail1.wpc.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.186
mail1.rt.comRTTV
Russia wpc.ar.rt.com

37.48.108.103
LEASEWEB-NL-AMS-01 Netherlands
Netherlands ns2.rt.com

207.244.80.162
LEASEWEB-USA-WDC
United States wpc.files.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.185
ROSTELECOM-AS
Russia wiki-tst.api.rt.com

HTTP: nginx/1.18.0 (Ubuntu)
HTTPS: nginx/1.18.0 (Ubuntu)
SSH: SSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.337.143.10.157
hosted-by.ihc.ruEUROBYTE Eurobyte LLC
Russia bk.wpc.rt.com

89.191.237.170
ROSTELECOM-AS
Russia m101.subscribe.rt.com

185.9.230.101
m101.subscribe.rt.comCIREX
Russia de.wpc.rt.com

37.48.108.107
LEASEWEB-NL-AMS-01 Netherlands
Netherlands wpc.de.rt.com

37.48.108.107
LEASEWEB-NL-AMS-01 Netherlands
Netherlands fr.wpc.rt.com

37.48.108.104
LEASEWEB-NL-AMS-01 Netherlands
Netherlands mail2.wpc.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.165
mail2.rt.comROSTELECOM-AS
Russia wpc.d.rt.com

37.48.108.111
LEASEWEB-NL-AMS-01 Netherlands
Netherlands mail2.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.165
mail2.rt.comROSTELECOM-AS
Russia wpc.monitoring.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.165
mail2.rt.comROSTELECOM-AS
Russia ns6.rt.com

37.48.108.97
LEASEWEB-NL-AMS-01 Netherlands
Netherlands chtd.rt.com

HTTP: nginx
HTTPS: nginx
SSH: SSH-2.0-OpenSSH_7.4
HTTP TECH: nginx91.218.228.51
hosted-by.ihc.ruEUROBYTE Eurobyte LLC
Russia ns7.rt.com

89.191.237.247
ROSTELECOM-AS
Russia es.wpc.rt.com

37.48.108.115
LEASEWEB-NL-AMS-01 Netherlands
Netherlands spprj.wpc.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.160
RTTV
Russia award.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx89.191.237.184
ROSTELECOM-AS
Russia wpc.en.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx37.48.108.105
LEASEWEB-NL-AMS-01 Netherlands
Netherlands ns.wpc.de.rt.com

0.0.0.0

unknown wpc.spprj.rt.com

HTTP: nginx
HTTPS: nginx
HTTP TECH: nginx
HTTPS TECH: nginx185.79.236.160
RTTV
Russia wpc.ru.rt.com

207.244.80.181
LEASEWEB-USA-WDC
United States

Military d

Vulnerable targets:
https://sudak.rk.gov.ru/
Linux sudak.rk.gov.ru 2.6.26.3-29.0.140asp.i686 #1 SMP Mon Sep 15 07:08:05 EDT 2008 i686
Samba (port 445):

Samba3.2.0-17.0.140asp
SMB Status:
Authentication: disabled
SMB Version: 1
OS: Unix
Software: Samba 3.2.0-17.0.140asp
Capabilities: dfs, extended-security, infolevel-passthru, large-files, large-readx, large-writex, level2-oplocks, lock-and-read, nt-find, nt-smb, nt-status, raw-mode, rpc-remote-api, unicode, unix

Shares
Name Type Comments

work Disk Share for work
consult Disk Share for consultant
www Disk Share for web
IPC$ IPC IPC Service (Samba Server)

ns8-l2.nic.ru.
91.217.21.1
ns8-l2.nic.ruRU-CENTER
Russia ns4-cloud.nic.ru.
185.42.137.111
ns4-cloud.nic.ruNETNOD-IX Netnod Internet Exchange Sverige AB
Sweden ns8-cloud.nic.ru.
194.58.196.62
ns8-cloud.nic.ruNETNOD-IX Netnod Internet Exchange Sverige AB
Sweden ns3-l2.nic.ru.
193.232.146.1
ns3-l2.nic.ruRU-CENTER
Russia ns4-l2.nic.ru.
91.217.20.1
ns4-l2.nic.ruRU-CENTER
Russia
MX Records ** This is where email for the domain goes...

TXT Records ** Find more hosts in Sender Policy Framework (SPF) configurations

Host Records (A) ** this data may not be current as it uses a static database (updated monthly)

www.defence.ru

HTTP: ddos-guard
HTTPS: ddos-guard185.215.4.19
DDOS-GUARD
Russia
To get around DDOS-Guard, try finding
http://budget.gov.ru/dms - database management web interface e

Pub: Feb 25 2022 14:47 UTC
Edit: Feb 26 2022 21:26 UTC
Views: 2100
new·what·how·langs