KitPloit - PenTest Tools!
Backstab - A Tool To Kill Antimalware Protected Processes

https://1.bp.blogspot.com/-Yue_835ulm8/YN5mIuj7VsI/AAAAAAAAfkA/4n_0UDXAXC0_U4-CAJxz4SsGdQYi2P4qgCNcBGAsYHQ/w640-h324/EDR.png Have these local admin credentials but the EDR is standing in the way? Unhooking or direct syscalls are not working against the EDR? Well, why not just kill it? Backstab is a tool capable of killing antimalware protected processes by leveraging sysinternals’ Process Explorer (ProcExp) driver, which is signed by Microsoft. What can it do?Usage: backstab.exe <-n[options]
-n, Choose process by name, including the .exe suffix
-p, Choose process by PID
-l, List handles of protected process
-k, Kill the protected process by closing its handles
-x, Close a specific handle
-d, Specify path to where ProcExp will be extracted
-s, Specify service name registry key
-u, Unload ProcExp driver
-a, adds SeDebugPrivilege
-h, Print this menu

Examples:
backstab.exe -n cyserver.exe -k [kill cyserver]
backstab.exe -n cyserver.exe -x E4C [Close handle E4C of cyserver]
backstab.exe -n cyserver.exe -l [list all handles of cyserver]
backstab.exe -p 4326 -k -d c:\\driver.sys [kill protected process with PID 4326, extract ProcExp driver to C:\ drive] How is that possible?ProcExp has a signed kernel driver that it loads on startup, which allows it to kill handles that cannot be killed even as an administrator. When you use the UI, you cannot kill a protected process, but you can kill it handles because ProcExp UI instructs the kernel driver to kill those handles. Backstab does the same thing but without the UI element. OpSecHere is a quick rundown of what happens

1. Embedded driver is dropped to disk
2. Registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services is created
3. The privilege SE_PRIVILEGE_ENABLED is acquired because it is necessary to load the driver
4. Driver is loaded using NtLoadDriver to avoid creating a service
5. The created Registry key is deleted (service not visible during execution)
6. Communication with the driver is via using DeviceIoControl
7. For handle enumeration, NtQuerySystemInformation is called What you should also know1. The behavior of the tool mimics that of ProcExp. ProcExp drops the driver to the disk, create registry key under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services, calls NtLoadDriver, and then delete the registry key
2. You can specify the location to which the driver is dropped and the service name
3. When done, the app will unload the driver. The driver is unloaded by first re-creating the registry keys and then calling NtUnloadDriver
4. The loaded driver is signed by MS
5. The process does not attempt to directly kill protected processes handles, it instructs ProcExp driver to kill them. You won't be accused of attempting to tamper with any processes Further ResearchWhile the tool purpose is listing and killing handles, the opportunities are vast. It is possible to duplicate the handles to your own process instead of killing them. This could allow for deeper tampering where you write to files, fire events, hold mutexes. To support further research, I tried to make the code readable and split it to many methods to facilitate reuse, I also left a description on all ProcExp related methods. Feel free to reach out to me on Twitter or by Email Credits* Author: Yasser Alhazmi (@Yas_o_h)
* Pavel Yosifovich: (@Zodiacon) mentioned to us during his awesome Windows Internals Course that kernel drivers like ProcExp might cause too much unintended damage
* Cornelis de Plaa @Cn33liz and Outflank Team @OutflankNL: for Ps-Tools and their outstanding Github repos, always informative
* Mark Russinovich: for ProcExp, and all Sysinternals tools! Download Backstab

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
OSCP Hazırlık Rehberi 3

Exploit Oluşturma ve Dosya Transferi

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ethical Hacking (part 5.1/20): Buffer Overflow explained with code

https://cdn-images-1.medium.com/max/1920/1*iwtD_NTIAWQL5KsAEuDJBQ.jpeg
Note: This article is being updated regularly. The latest update is as of 05/07/2021

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Carhacking: how thrillers become reality

https://cdn-images-1.medium.com/max/2600/1*gaNVJlQeLY9aa1K7MhcqVg.jpeg
Find out why carhacking is emerging and what automotive brands can do to protect their cars and their customers from carhacking.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Se encontró una botnet TrickBot implementando un nuevo ransomware llamado Diavol.

https://cdn-images-1.medium.com/max/728/0*VkA43hHWWtxF3eVd.gif
POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The History of Cybersecurity

https://cdn-images-1.medium.com/max/1000/0*tjS4_kYX-EvR7dvo
Cybersecurity is the entirety of technology and techniques designed to protect data, networks, computers, and programs from cyberattacks…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
REvil Threat Actors Demanding $70 Million for Universal Decryptor. — CyberWorkx

https://cdn-images-1.medium.com/max/728/0*AmzOkZbSNpH0MCKG
Last week we had seen the devastating attack from REvil ransomware gang disrupted the business of Kaseya via the supply chain attack. It…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Need recommendations for sites to learn about police corruption and white supremacy happening now and in the past.

I’m new to the dw and am looking for some recommendations in sites that have info on police corruption and also white supremacy.

submitted by /u/Defiant-Molasses-444
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Genymotion+Xposed+Inspeckage

Android application dynamic analysis lab setup on windowsContinue reading on InfoSec Write-ups »
Read more...

hacking: security in practice
How to setup bad usb?

Hello, i bought arduino uno bad usb. When i plugit in, it opens cmd and types nothing as expected. Now i do not know how to program it into actualy doing something, i have been searching trough internet for half an hour now, do I need some software or? Please help

submitted by /u/Velja14
[link] [comments]

hacking: security in practice
Ammm that's ps4 emulating ps2

https://external-preview.redd.it/jDKJGyfyGWCf86LHMDA3wEFPeX1IbWVcU6benbyMa80.png?width=640&crop=smart&auto=webp&s=dd86fedab3c56ecb521595c5553a449a47e8460a submitted by /u/AUGE_F3L1X
[link] [comments]

hacking: security in practice
Crack Windows 10 password

I want to try finding out my Windows 10 password. I already know it, but I want to try finding it through Bruteforce. I already have the hash. I downloaded Hashcat. The problem is: I don't know what options to use. If somebody has already done this before or knows how to do this please help me.

submitted by /u/Hypnoticbat9555
[link] [comments]