Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking Python Variant of NodeStealer – Targeting Facebook Business Accounts and Cryptocurrency Python Variant of NodeStealer – Targeting Facebook Business Accounts and CryptocurrencyPost Views: 2 Premium Contenthttps://www.blackhatethi…

Lurking in Cracked Software Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: thehackernews.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Store.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/08/Images-for-the-News-posts-2-300x150.png P2PInfect Server Botnet Turns Compromised Redis Servers into a Peer-to-Peer NetworkAugust 1, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Images-for-the-News-posts-300x150.png Abyss Locker: New Linux Encryptor Targets VMware’s ESXi Virtual MachinesJuly 31, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Images-for-the-News-posts-16-300x150.png 40% of Ubuntu users vulnerable to new privilege elevation flawsJuly 28, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/07/Images-for-the-News-posts-15-300x150.png SEC Mandates Rapid Cyberattack Disclosures, Companies Must Act Within 4 Business DaysJuly 27, 2023 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now! https://www.blackhatethicalhacking.com/wp-content/uploads/2023/03/Solutions.png Information Security SolutionsFind out how Pentesting Services can help you.
The post Python Variant of NodeStealer – Targeting Facebook Business Accounts and Cryptocurrency first appeared on Black Hat Ethical Hacking.

6 views11:50

Hacking Articles Tips Tricks Videos Tutorials

KRBUACBypass - UAC Bypass By Abusing Kerberos Tickets
http://www.kitploit.com/2023/08/krbuacbypass-uac-bypass-by-abusing.html

3 views12:49

Hacking Articles Tips Tricks Videos Tutorials

4 views12:49

Hacking Articles Tips Tricks Videos Tutorials

This POC is inspired by James Forshaw (@tiraniddo (https://twitter.com/tiraniddo)) shared at BlackHat (https://www.kitploit.com/search/label/BlackHat) USA 2022 titled “Taking Kerberos (https://www.kitploit.com/search/label/Kerberos) To The Next Level ” topic, he shared a Demo of abusing Kerberos tickets to achieve UAC bypass. By adding a KERB-AD-RESTRICTION-ENTRY to the service ticket, but filling in a fake MachineID, we can easily bypass UAC and gain SYSTEM privileges by accessing the SCM to create a system service. James Forshaw explained the rationale behind this in a blog post called "Bypassing UAC in the most Complex Way Possible!", which got me very interested. Although he didn't provide the full exploit code, I built a POC based on Rubeus (https://github.com/GhostPack/Rubeus#tgtdeleg). As a C# toolset (https://www.kitploit.com/search/label/Toolset) for raw Kerberos interaction and ticket abuse, Rubeus provides an easy interface that allows us to easily initiate Kerberos requests and manipulate Kerberos tickets. You can see related articles about KRBUACBypass in my blog "Revisiting a UAC Bypass By Abusing Kerberos Tickets", including the background principle and how it is implemented. As said in the article, this article was inspired by @tiraniddo's "Taking Kerberos To The Next Level" (I would not have done it without his sharing) and I just implemented it as a tool before I graduated from college.
Tgtdeleg Trick We cannot manually generate a TGT as we do not have and do not have access to the current user's credentials. However, Benjamin Delpy (@gentilkiwi (https://github.com/gentilkiwi)) in his Kekeo (https://github.com/gentilkiwi/kekeo/blob/4fbb44ec54ff093ae0fbe4471de19681a8e71a86/kekeo/modules/kuhl_m_tgt.c#L189) A trick (tgtdeleg) was added that allows you to abuse unconstrained delegation to obtain a local TGT with a session key. Tgtdeleg abuses the Kerberos GSS-API to obtain available TGTs for the current user without obtaining elevated privileges on the host. This method uses the AcquireCredentialsHandle function to obtain the Kerberos security credentials (https://www.kitploit.com/search/label/Credentials) handle for the current user, and calls the InitializeSecurityContext function for HOST/DC.domain.com using the ISC_REQ_DELEGATE flag and the target SPN to prepare the pseudo-delegation context to send to the domain controller. This causes the KRB_AP-REQ in the GSS-API output to include the KRB_CRED in the Authenticator Checksum. The service ticket's session key is then extracted from the local Kerberos cache and used to decrypt the KRB_CRED in the Authenticator to obtain a usable TGT. The Rubeus toolset also incorporates this technique. For details, please refer to “Rubeus – Now With More Kekeo”. With this TGT, we can generate our own service ticket, and the feasible operation process is as follows: Use the Tgtdeleg trick to get the user's TGT. Use the TGT to request the KDC to generate a new service ticket for the local computer. Add a KERB-AD-RESTRICTION-ENTRY, but fill in a fake MachineID. Submit the service ticket into the cache. Krbscm Once you have a service ticket, you can use Kerberos authentication (https://www.kitploit.com/search/label/Authentication) to access Service Control Manager (SCM) Named Pipes or TCP via HOST/HOSTNAME or RPC/HOSTNAME SPN. Note that SCM's Win32 API always uses Negotiate authentication. James Forshaw created a simple POC: SCMUACBypass.cpp (https://gist.github.com/tyranid/c24cfd1bd141d14d4925043ee7e03c82), through the two APIs HOOK AcquireCredentialsHandle and InitializeSecurityContextW, the name of the authentication package called by SCM (pszPack age ) to Kerberos to enable the SCM to use Kerberos when authenticating locally. Let’s see it in action Now let's take a look at the running effect, as shown in the figure below. First request a ticket for the HOST service of the current server through the asktgs function, and then create a system service through

4 views12:49

Hacking Articles Tips Tricks Videos Tutorials

krbscm to gain the SYSTEM privilege. KRBUACBypass.exe asktgs
KRBUACBypass.exe krbscm

Download KRBUACBypass (https://github.com/wh0amitz/KRBUACBypass)

5 views12:49

Hacking Articles Tips Tricks Videos Tutorials

7 views13:10

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Kioptrix Level 1.3 (#4) | VulnHub Walkthrough by Mark de Moras

https://cdn-images-1.medium.com/max/1920/1*nuV2T9Ie5horvfeCFxR75g.png
This is a full walkthrough to the Kioptrix Level 1.3 (#4) machine from VulnHub. I made a video in correlation with this writeup which you…

Continue reading on Medium »

7 views13:10

Hacking Articles Tips Tricks Videos Tutorials

6 views13:10

Hacking Articles Tips Tricks Videos Tutorials

6 views13:10

Hacking Articles Tips Tricks Videos Tutorials