Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
TChopper - Conduct Lateral Movement Attack By Leveraging Unfiltered Services Display Name To Smuggle Binaries As Chunks Into The Target Machine

https://1.bp.blogspot.com/-L4bkOEhfvds/YMaLm5YGGQI/AAAAAAAAazY/OqP_qHi6WCg6rkhQLvAgegxvLoErwsPzgCNcBGAsYHQ/w640-h370/TChopper_2.jpeg
New technique I have discovered recently and give it a nickname (Chop chop) to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool.
How it works

* the tool will get the file you willing to smuggle and encode the file as base64 into memory stream
* divide the length of each line to fit 150-250 character length (250 is maximum allowed space for service lpDisplayname parameter https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-createservicea).
* for chop chop attack it will create a unique service for each segmented chunk => start the service => then delete it to avoid duplicates or you can choose to only modify the service attack mode to be more faster and stable.
* later on, it will modify service lpbinarypath parameter with required command line to grab service display name and pip out the results into tmp_payload.txt
* finally, after finishing delivering all chuncks of the file as base64, the tool will create another service to decode the content into valid executbale and run it

while if you are conducting lateral movment using WMI technique you can also use Chopper to do that

* Tchopper will authenticate you session using WMI
* creation of multiple process and use powershell unique command to pip out each segment to c:\users\public\chop.enc
* create final process to use certutil to decode the content into binary and execute it

http://1.bp.blogspot.com/-DjotGr8pznU/YMZmYX_D2MI/AAAAAAAAaBE/_vYgDSLvkLsMGzg-x-ZsHaHL13bPOSKPACK4BGAYYCw/w640-h282/TChopper_3-770256.png

Usage

#chop chop mode 
chopper.exe -s -u USERNAME -p PASSWORD -d DOMAIN -f BINARYLOCAL PATH 
# chop chop done 
chopper.exe -m -u USERNAME -p PASSWORD -d DOMAIN -f BINARYLOCAL PATH 

# use WMI to smuggle 
chopper.exe -w -u DOMAIN\USERNAME -p PASSWORD -t MACHINE -f LOCALBINARYPATH

https://youtu.be/xbvhzHul7w0

Detailed research

http://0xsp.com/security%20research%20&%20development%20(SRD)/smuggling-via-windows-services-display-name-lateral-movement
Download TChopper

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

TChopper - Conduct Lateral Movement Attack By Leveraging Unfiltered Services Display Name To Smuggle Binaries As Chunks Into The…

8 viewsedited 22:35

Hacking Articles Tips Tricks Videos Tutorials

TChopper - Conduct Lateral Movement Attack By Leveraging Unfiltered Services Display Name To Smuggle Binaries As Chunks Into The Target Machine

New technique I have discovered recently and give it a nickname (Chop chop) to perform lateral movement using windows services display name and WMI by smuggling the malicious binary as base64 chunks and automate the process using the TChopper tool.How it works the tool will get the file you willing to smuggle and encode the file as base64 into memory stream divide the length of each line to fit 150-250 character length (250 is maximum allowed space for service lpDisplayname parameter https://docs.microsoft.com/en-us/windows/win32/api/winsvc/nf-winsvc-createservicea). for chop chop attack it will create a unique service for each segmented chunk => start the service => then delete it to avoid duplicates or you can choose to only modify the service attack mode to be more faster and stable. later on, it will modify service lpbinarypath parameter with required command line to grab service display name and pip out the results into tmp_payload.txt finally, after finishing delivering all chuncks of the file as base64, the tool will create another service to decode the content into valid executbale and run it while if you are conducting lateral movment using WMI technique you can also use Chopper to do that Tchopper will authenticate you session using WMI creation of multiple process and use powershell unique command to pip out each segment to c:\users\public\chop.enc create final process to use certutil to decode the content into binary and execute it Usage #chop chop mode chopper.exe -s -u USERNAME -p PASSWORD -d DOMAIN -f BINARYLOCAL PATH # chop chop done chopper.exe -m -u USERNAME -p PASSWORD -d DOMAIN -f BINARYLOCAL PATH # use WMI to smuggle chopper.exe -w -u DOMAIN\USERNAME -p PASSWORD -t MACHINE -f LOCALBINARYPATH https://youtu.be/xbvhzHul7w0 Detailed research http://0xsp.com/security%20research%20&%20development%20(SRD)/smuggling-via-windows-services-display-name-lateral-movement Download TChopper
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Docs

CreateServiceA function (winsvc.h) - Win32 apps

Creates a service object and adds it to the specified service control manager database. (ANSI)

7 viewsedited 23:47

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Position myself as mitm without the option of ARP Spoofing

Long story short Im researching a bit on intercepting packets from the connection of a Yeelight (Smartbulb) to a WLAN.

So the way you set up the smartbulb to a WLAN is via an open WiFi network that the bulb itself opens. Then the phone connects to such WiFi hotspot via the app to send the information of the WLAN to the bulb for it to connect to. I have sniffed the packets via monitor mode and I have a pretty good idea on how the phone commands the smartbulb to connect. Now I would like to inject packets during such connection.The only problem is that when I connect to the bulb's network (before it is connected to the WLAN) with my laptop I can not ping let alone ARP Spoof the phone, so I could potentially intercept the packets and connect the bulb to another network while the app thinks that is being connected to the real network. Is there any other way I could potentially reach such mitm situation without ARP Spoofing

submitted by /u/Wangalaang
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - Position myself as mitm without the option of ARP Spoofing

0 votes and 0 comments so far on Reddit

8 viewsedited 00:34

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
SQL SHELL what do to?

(SORRY FOR MY ENGLISH)

Im doing a htb box and i have enter in the database using the sqlmap. I dump all the databases and data from these databases but nothing interest. I spawn a SQL shell using the --sql-shell in the sqlmap

but I don't know how to breach into the machine doing this.

Someone have an idea?

submitted by /u/mousse312
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - SQL SHELL what do to?

0 votes and 0 comments so far on Reddit

9 viewsedited 00:34

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
What's the "best" coding language to know/learn?

I'm still not sure how to even begin learning because as of now I quality as a nothing more than a script kiddie which makes me mad. I know introductory Java and have an understanding of networking but I don't know how to apply it or if it's even a good language for hacking. I'm just tired of not knowing how to actually hack and if someone could give me a recommendation as to where I could just start would be great. I want to know how things work but the problem is that I don't know what I don't know, if that makes sense.

submitted by /u/Mouthybard25364
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

What's the "best" coding language to know/learn?

I'm still not sure how to even begin learning because as of now I quality as a nothing more than a script kiddie which makes me mad. I know...

11 viewsedited 00:34

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
what is the word that is the oposite of soft hacks

what is the word that is the oposite of soft hacks like _____ hacks

submitted by /u/CharlieDude123
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking - what is the word that is the oposite of soft hacks

0 votes and 1 comment so far on Reddit

13 viewsedited 00:34

Hacking Articles Tips Tricks Videos Tutorials

Pen Testing Career Question
https://www.reddit.com/r/Pentesting/comments/o0sf5h/pen_testing_career_question/

Figured I'd ask here too considering this a career oriented page. Do you need to have coding experience to be in pen testing? submitted by /u/Bugskee (https://www.reddit.com/user/Bugskee)
[link] (https://www.reddit.com/r/Pentesting/comments/o0sf5h/pen_testing_career_question/) [comments] (https://www.reddit.com/r/Pentesting/comments/o0sf5h/pen_testing_career_question/)

___________________________
@hacking_Attack
@Hacking_Video

Pen Testing Career Question

Figured I'd ask here too considering this a career oriented page. Do you need to have coding experience to be in pen testing?