NamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation
http://www.kitploit.com/2021/06/namedpipepth-pass-hash-to-named-pipe.html

___________________________
@hacking_Attack
@Hacking_Video

This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation:https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 (https://github.com/Kevin-Robertson/Invoke-TheHash/blob/master/Invoke-SMBExec.ps1) and RoguePotato (https://github.com/antonioCoco/RoguePotato). I faced certain Offensive Security project situations in the past, where I already had the NTLM-Hash of a low privileged user account and needed a shell for that user on the current compromised system - but that was not possible with the current public tools. Imagine two more facts for a situation like that - the NTLM Hash could not be cracked and there is no process of the victim user to execute shellcode in it or to migrate into that process. This may sound like an absurd edge-case for some of you. I still experienced that multiple times. Not only in one engagement I spend a lot of time searching for the right tool/technique in that specific situation. My personal goals for a tool/technique were: Fully featured shell or C2-connection as the victim user-account It must to able to also Impersonate low privileged accounts - depending on engagement goals it might be needed to access (https://www.kitploit.com/search/label/Access) a system with a specific user such as the CEO, HR-accounts, SAP-administrators or others The tool can be used as C2-module The impersonated user unfortunately has no network authentication allowed, as the new process is using an Impersonation (https://www.kitploit.com/search/label/Impersonation) Token which is restricted. So you can only use this technique for local actions with another user. There are two ways to use this technique. Either you can compile \Resources\PipeServerImpersonate.sln and drop the executable on the remote host and connect to the Named Pipe via \Resources\Invoke-NamedPipePTH.ps1:

___________________________
@hacking_Attack
@Hacking_Video

Or you can use the standalone script to stay in memory:

___________________________
@hacking_Attack
@Hacking_Video

If you don't want to drop a binary (https://www.kitploit.com/search/label/Binary) for execution just pass arguments for native Windows (https://www.kitploit.com/search/label/Windows) binaries such as Powershell Invoke-ImpersonateUser-PTH -Username USERNAME -Hash NTLMHASH -Domain DOMAIN -PipeName mypipe -binary "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -argument "-nop -w 1 -sta -enc BASEBLOB"

Download NamedPipePTH (https://github.com/S3cur3Th1sSh1t/NamedPipePTH)

___________________________
@hacking_Attack
@Hacking_Video

NamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation

This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation:https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/ It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotato. I faced certain Offensive Security project situations in the past, where I already had the NTLM-Hash of a low privileged user account and needed a shell for that user on the current compromised system - but that was not possible with the current public tools. Imagine two more facts for a situation like that - the NTLM Hash could not be cracked and there is no process of the victim user to execute shellcode in it or to migrate into that process. This may sound like an absurd edge-case for some of you. I still experienced that multiple times. Not only in one engagement I spend a lot of time searching for the right tool/technique in that specific situation. My personal goals for a tool/technique were: Fully featured shell or C2-connection as the victim user-account It must to able to also Impersonate low privileged accounts - depending on engagement goals it might be needed to access a system with a specific user such as the CEO, HR-accounts, SAP-administrators or others The tool can be used as C2-module The impersonated user unfortunately has no network authentication allowed, as the new process is using an Impersonation Token which is restricted. So you can only use this technique for local actions with another user. There are two ways to use this technique. Either you can compile \Resources\PipeServerImpersonate.sln and drop the executable on the remote host and connect to the Named Pipe via \Resources\Invoke-NamedPipePTH.ps1: Or you can use the standalone script to stay in memory: If you don't want to drop a binary for execution just pass arguments for native Windows binaries such as Powershell Invoke-ImpersonateUser-PTH -Username USERNAME -Hash NTLMHASH -Domain DOMAIN -PipeName mypipe -binary "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -argument "-nop -w 1 -sta -enc BASEBLOB" Download NamedPipePTH
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The South Korean Atomic Research Hack in 2 Minutes

https://cdn-images-1.medium.com/max/2600/0*y2kTkUpzfuBycM_C
Spoiler Alert: It was North Korea

Continue reading on 2 Minute Madness »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
NamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation

http://3.bp.blogspot.com/-Wd1GldbL2VA/YMaXF-Tns4I/AAAAAAAAbAo/wGru31c4r_AehF11gNxRCo5cmYO4LY9JwCK4BGAYYCw/w640-h200/NamedPipePTH_2_Example2-738687.jpeg This project is a PoC code to use Pass-the-Hash for authentication on a local Named Pipe user Impersonation. There also is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/

It is heavily based on the code from the projects Invoke-SMBExec.ps1 and RoguePotato.

I faced certain Offensive Security project situations in the past, where I already had the NTLM-Hash of a low privilegeduser account and needed a shell for that user on the current compromised system - but that was not possible with the current public tools. Imagine two more facts for a situation like that - the NTLM Hash could not be cracked and there is no process of the victim user to execute shellcode in it or to migrate into that process. This may sound like an absurd edge-case for some of you. I still experienced that multiple times. Not only in one engagement I spend a lot of time searching for the right tool/technique in that specific situation.

My personal goals for a tool/technique were:

* Fully featured shell or C2-connection as the victim user-account
* It must to able to also Impersonate low privilegedaccounts - depending on engagement goals it might be needed to access a system with a specific user such as the CEO, HR-accounts, SAP-administrators or others
* The tool can be used as C2-module

The impersonated user unfortunately has no network authentication allowed, as the new process is using an Impersonation Token which is restricted. So you can only use this technique for local actions with another user.

There are two ways to use this technique. Either you can compile \Resources\PipeServerImpersonate.slnand drop the executable on the remote host and connect to the Named Pipe via \Resources\Invoke-NamedPipePTH.ps1: http://4.bp.blogspot.com/-Tv_9d9o_-hk/YMaXEfMyOCI/AAAAAAAAbAc/5Yw7wdPLKSIZSZtjc_8ZnvOjnWcXexkmwCK4BGAYYCw/w640-h130/NamedPipePTH_1_Example1-733312.jpeg Or you can use the standalone script to stay in memory: http://3.bp.blogspot.com/-Wd1GldbL2VA/YMaXF-Tns4I/AAAAAAAAbAo/wGru31c4r_AehF11gNxRCo5cmYO4LY9JwCK4BGAYYCw/w640-h200/NamedPipePTH_2_Example2-738687.jpeg If you don't want to drop a binary for execution just pass arguments for native Windows binaries such as Powershell Invoke-ImpersonateUser-PTH -Username USERNAME -Hash NTLMHASH -Domain DOMAIN -PipeName mypipe -binary "C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" -argument "-nop -w 1 -sta -enc BASEBLOB"Download NamedPipePTH

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HackMe1 for frontend devs (high seniority)

Hi !
This is my first HackMe for frontend devs.

Analyze the algorithm to find the correct box-clicking order.
The source code is fully working so there is no need to modify it.
And of course... do not use brute force.

https://github.com/lucianoaibar/HackMe1

Enjoy!

submitted by /u/lucianoaibar
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to stop ISP tracking seaches

im looking for some advice on hiding my seaches and websites ive visited. Im using TOR currently and a VPN and i have changed my MAC address but my ISP is still seeing my searches. Does any1 know how i can avoid this? any help would be appriciated

submitted by /u/Sammy42p
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
New exploit

The GIF here shows an infamous, EF-4 tornado sucking a house into its vortex, disintegrating it in the process.

In this house, there was a man. This footage is confirmed as showing the exact moment the man was killed.

Therefore, this link officially shows a real human dying without breaking discord TOS! How do I upload this exploit to the exploit database?

submitted by /u/xSerpentine
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The South Korean Atomic Research Facility Hack

https://cdn-images-1.medium.com/max/2600/0*ms2jUi5Z6hFUxj3O
Spoiler Alert: It Was North Korea

Continue reading on Medium »

CERTIFIED RED TEAM OPERATOR
https://www.reddit.com/r/Pentesting/comments/o4lmoq/certified_red_team_operator/

<!-- SC_OFF -->I have been trying to prepare for crto by red team security! Is there anyone who could suggest me some good resources ? <!-- SC_ON --> submitted by /u/falcnix (https://www.reddit.com/user/falcnix)
[link] (https://www.reddit.com/r/Pentesting/comments/o4lmoq/certified_red_team_operator/) [comments] (https://www.reddit.com/r/Pentesting/comments/o4lmoq/certified_red_team_operator/)