New technique I have discovered recently and give it a nickname (Chop chop) to perform lateral movement (https://www.kitploit.com/search/label/Lateral%20Movement) using windows (https://www.kitploit.com/search/label/Windows) services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool.
How it works
the tool will get the file you willing to smuggle and encode the file as base64 into memory stream divide the length of each line to fit 150-250 character length (250 is maximum allowed space for service lpDisplayname parameter https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-createservicea). for chop chop attack it will create a unique service for each segmented chunk => start the service => then delete it to avoid duplicates (https://www.kitploit.com/search/label/Duplicates) or you can choose to only modify the service attack mode to be more faster and stable. later on, it will modify service lpbinarypath parameter with required command line (https://www.kitploit.com/search/label/Command%20Line) to grab service display name and pip out the results into tmp_payload.txt finally, after finishing delivering all chuncks of the file as base64, the tool will create another service to decode the content into valid executbale and run it while if you are conducting lateral movment using WMI technique you can also use Chopper to do that Tchopper will authenticate you session using WMI creation of multiple process and use powershell (https://www.kitploit.com/search/label/PowerShell) unique command to pip out each segment to c:\users\public\chop.enc create final process to use certutil to decode the content into binary and execute it

___________________________
@hacking_Attack
@Hacking_Video

Usage
#chop chop mode
chopper.exe -s -u USERNAME -p PASSWORD -d DOMAIN -f BINARYLOCAL PATH


# chop chop done
chopper.exe -m -u USERNAME -p PASSWORD -d DOMAIN -f BINARYLOCAL PATH

# use WMI to smuggle
chopper.exe -w -u DOMAIN\USERNAME -p PASSWORD -t MACHINE -f LOCALBINARYPATH
https://youtu.be/xbvhzHul7w0
Detailed research
http://0xsp.com/security%20research%20&%20development%20(SRD)/smuggling-via-windows-services-display-name-lateral-movement

Download TChopper (https://github.com/lawrenceamer/TChopper)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Microsoft Disrupts Large-Scale BEC Campaign Across Web Services

Attackers had used the cloud-based infrastructure to target mailboxes and add forwarding rules to learn about financial transactions.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Andariel Group Targets South Korean Entities in New Campaign

Andariel, designated as a sub-group of the Lazarus Group APT, has historically targeted South Korean organzations.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Year Of The Jelly Fish Walk Through {Try Hack Me}

https://cdn-images-1.medium.com/max/1173/1*7ZAOOQuS2DIqrcUTHQH7xQ.png
Hello Everyone , Today we are going to solve the medium level machine from Try Hack Me, it took me a more than a week to complete this…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Beginners Bug Bounty Automation

https://cdn-images-1.medium.com/max/635/1*aOD5iJ81XzgqPbHugBqwqw.png
Hey all! My name is Rejinold Pearson. Today in this section we are gonna be looking at how to automate bug bounty recon using bash…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Coercing one’s self to program.

https://cdn-images-1.medium.com/max/1200/1*TJKoTXVkqcHHkvGY7hmZiQ.jpeg
Program yourself to program in a few easy steps.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I Hacked 40 Websites in 7 Minutes

https://cdn-images-1.medium.com/max/2600/1*nz9hwJWSJKBIOdJ8jkfePQ.jpeg
How I went from 0 knowledge to owning 35 databases in 7 minutes…

Continue reading on TheHowTo »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Dorking

https://cdn-images-1.medium.com/max/1024/0*_UpI_wI9q9WZSnw8.jpg
Task 1 Ye Ol’ Search Engine

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Oopsie | HackTheBox

https://cdn-images-1.medium.com/max/1200/0*I3dCruqo_JcmUu_N.png
Source: https://www.hackthebox.eu/home/machines/profile/259

Continue reading on shellpwn »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
TChopper - Conduct Lateral Movement Attack By Leveraging Unfiltered Services Display Name To Smuggle Binaries As Chunks Into The Target Machine

https://1.bp.blogspot.com/-L4bkOEhfvds/YMaLm5YGGQI/AAAAAAAAazY/OqP_qHi6WCg6rkhQLvAgegxvLoErwsPzgCNcBGAsYHQ/w640-h370/TChopper_2.jpeg
New technique I have discovered recently and give it a nickname (Chop chop) to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool.
How it works

* the tool will get the file you willing to smuggle and encode the file as base64 into memory stream
* divide the length of each line to fit 150-250 character length (250 is maximum allowed space for service lpDisplayname parameter https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-createservicea).
* for chop chop attack it will create a unique service for each segmented chunk => start the service => then delete it to avoid duplicates or you can choose to only modify the service attack mode to be more faster and stable.
* later on, it will modify service lpbinarypath parameter with required command line to grab service display name and pip out the results into tmp_payload.txt
* finally, after finishing delivering all chuncks of the file as base64, the tool will create another service to decode the content into valid executbale and run it

while if you are conducting lateral movment using WMI technique you can also use Chopper to do that

* Tchopper will authenticate you session using WMI
* creation of multiple process and use powershell unique command to pip out each segment to c:\users\public\chop.enc
* create final process to use certutil to decode the content into binary and execute it

http://1.bp.blogspot.com/-DjotGr8pznU/YMZmYX_D2MI/AAAAAAAAaBE/_vYgDSLvkLsMGzg-x-ZsHaHL13bPOSKPACK4BGAYYCw/w640-h282/TChopper_3-770256.png

Usage

#chop chop mode
chopper.exe -s -u USERNAME -p PASSWORD -d DOMAIN -f BINARYLOCAL PATH
# chop chop done
chopper.exe -m -u USERNAME -p PASSWORD -d DOMAIN -f BINARYLOCAL PATH

# use WMI to smuggle
chopper.exe -w -u DOMAIN\USERNAME -p PASSWORD -t MACHINE -f LOCALBINARYPATH


https://youtu.be/xbvhzHul7w0

Detailed research

http://0xsp.com/security%20research%20&%20development%20(SRD)/smuggling-via-windows-services-display-name-lateral-movement
Download TChopper

___________________________
@hacking_Attack
@Hacking_Video