Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
This Stinks
https://cdn-images-1.medium.com/max/2600/0*UCyEDcbpXfoJHfD9
But I Can’t Smell It
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
This Stinks
https://cdn-images-1.medium.com/max/2600/0*UCyEDcbpXfoJHfD9
But I Can’t Smell It
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
This Stinks
But I Can’t Smell It
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Así funciona el último truco para robar tus contraseñas sin ser detectado
https://cdn-images-1.medium.com/max/1037/0*jczAoBI7m75SZmRC
POR EHACKING
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Así funciona el último truco para robar tus contraseñas sin ser detectado
https://cdn-images-1.medium.com/max/1037/0*jczAoBI7m75SZmRC
POR EHACKING
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Así funciona el último truco para robar tus contraseñas sin ser detectado.
POR EHACKING
REW-sploit - Emulate And Dissect MSF And *Other* Attacks
http://www.kitploit.com/2021/08/rew-sploit-emulate-and-dissect-msf-and.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2021/08/rew-sploit-emulate-and-dissect-msf-and.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
REW-sploit - Emulate And Dissect MSF And *Other* Attacks
REW-sploit
The tool has been presented at Black-Hat Arsenal USA 2021 https://www.blackhat.com/us-21/arsenal/schedule/index.html#rew-sploit-dissecting-metasploit-attacks-24086 Slides of presentation are available at https://github.com/REW-sploit/REW-sploit_docs
Need help in analyzing Windows shellcode or attack coming from Metasploit Framework or Cobalt Strike (or may be also other malicious or obfuscated code)? Do you need to automate tasks with simple scripting? Do you want help to decrypt MSF generated traffic by extracting keys from payloads? REW-sploit is here to help Blue Teams! Here a quick demo:
___________________________
@hacking_Attack
@Hacking_Video
The tool has been presented at Black-Hat Arsenal USA 2021 https://www.blackhat.com/us-21/arsenal/schedule/index.html#rew-sploit-dissecting-metasploit-attacks-24086 Slides of presentation are available at https://github.com/REW-sploit/REW-sploit_docs
Need help in analyzing Windows shellcode or attack coming from Metasploit Framework or Cobalt Strike (or may be also other malicious or obfuscated code)? Do you need to automate tasks with simple scripting? Do you want help to decrypt MSF generated traffic by extracting keys from payloads? REW-sploit is here to help Blue Teams! Here a quick demo:
___________________________
@hacking_Attack
@Hacking_Video
Blackhat
Black Hat USA 2021
Install
Installation is very easy. I strongly suggest to create a specific Python Env for it: /rew-sploit # source /bin/activate # git clone https://github.com/REW-sploit/REW-sploit.git # cd REW-sploit # pip install -r requirements.txt # ./apply_patch.py -f # ./rew-sploit "># python -m venv /rew-sploit
# source /bin/activate
# git clone https://github.com/REW-sploit/REW-sploit.git
# cd REW-sploit
# pip install -r requirements.txt
# ./apply_patch.py -f
# ./rew-sploit
If you prefer, you can use the Dockerfile. To create the image: docker build -t rew-sploit/rew-sploit .
and then start it (sharing the /tmp/ folder): docker run --rm -it --name rew-sploit -v /tmp:/tmp rew-sploit/rew-sploit
You see an apply_patch.py script in the installation sequence. This is required to apply a small patch to the speakeasy-emulator (https://github.com/fireeye/speakeasy/) to make it compatible with REW-sploit. You can easily revert the patch with ./apply_patch.py -r if required. Optionally, you can also install Cobalt-Strike Parser: # cd REW-sploit/extras
# git clone https://github.com/Sentinel-One/CobaltStrikeParser.git
Standing on the shoulder of giants
REW-sploit is based on a couple of great frameworks, Unicorn and speakeasy-emulator (but also other libraries). Thanks to everyone and thanks to the OSS movement!
How it works
In general we can say that whilst Red Teams have a lot of tools helping them in "automating" attacks, Blue Teams (https://www.kitploit.com/search/label/Blue%20Teams) are a bit "tool-less". So, what I thought is to build something to help Blue Team (https://www.kitploit.com/search/label/Blue%20Team) Analysis. REW-sploit can get a shellcode/DLL/EXE, emulate the execution, and give you a set of information to help you in understanding what is going on. Example of extracted information are: API calls Encryption keys used by MSF payloads decrypted 2nd stage coming from MSF Cobalt-Strike configurations (if CobaltStrike parser is installed (https://github.com/Sentinel-One/CobaltStrikeParser)) You can find several examples on the current capabilities here below: RC4 Keys Extraction (https://asciinema.org/a/ln8tkJH7bOhACFRMdnPmk2i1o?speed=2) RC4 Keys Extraction + PCAP 2nd stage decryption (https://asciinema.org/a/TfrcYnCaCuCPGVhaeq0wkEyag?speed=2) ChaCha Keys Extraction (https://asciinema.org/a/01oMaPMG0BmLkPhXkIMNvSO4c?speed=2) Meterpreter session (https://asciinema.org/a/Q8zZ8Ri7ZPzpBOZRTh9eZpzWi?speed=2)Decryption (https://www.kitploit.com/search/label/Decryption) (no RSA) Cobalt-Strike beacon Emulation (https://asciinema.org/a/ps4VdIqY71W786j9lOAz9taOp?speed=10) Cobalt-Strike config Extraction (https://asciinema.org/a/1hGjmn9hgx5i2CAZFePpbaI70?speed=5) Debugging options (https://asciinema.org/a/kIhOo2jKjOBTcxh8VrU0UzkXi) Dumping Threads (https://asciinema.org/a/5SeKKodDXl79vceM7eXjsQJil?speed=2)
Fixups
In some cases emulation (https://www.kitploit.com/search/label/Emulation) was simply breaking, for different reasons. In some cases obfuscation (https://www.kitploit.com/search/label/Obfuscation) was using some techniques that was confusing the emulation engine. So I implemented some ad-hoc fixups (you can enable them by using -F option of the emulate_payload command). Fixups are implemented in modules/emulate_fixups.py. Currently we have Unicorn issue #1092: #
# Fixup #1
# Unicorn issue #1092 (XOR instruction executed twice)
# https://github.com/unicorn-engine/unicorn/issues/1092
# #820 (Incorrect memory view after running self-modifying code)
# https://github.com/unicorn-engine/unicorn/issues/820
# Issue: self modfying code in the same Translated Block (16 bytes?)
# Yes, I know...this is a huge kludge... :-/
#
FPU emulation issue: #
# Fixup #2
# The "fpu" related instructions (FPU/FNSTENV), used to recover EIP, sometimes
# returns the wrong addresses.
___________________________
@hacking_Attack
@Hacking_Video
Installation is very easy. I strongly suggest to create a specific Python Env for it: /rew-sploit # source /bin/activate # git clone https://github.com/REW-sploit/REW-sploit.git # cd REW-sploit # pip install -r requirements.txt # ./apply_patch.py -f # ./rew-sploit "># python -m venv /rew-sploit
# source /bin/activate
# git clone https://github.com/REW-sploit/REW-sploit.git
# cd REW-sploit
# pip install -r requirements.txt
# ./apply_patch.py -f
# ./rew-sploit
If you prefer, you can use the Dockerfile. To create the image: docker build -t rew-sploit/rew-sploit .
and then start it (sharing the /tmp/ folder): docker run --rm -it --name rew-sploit -v /tmp:/tmp rew-sploit/rew-sploit
You see an apply_patch.py script in the installation sequence. This is required to apply a small patch to the speakeasy-emulator (https://github.com/fireeye/speakeasy/) to make it compatible with REW-sploit. You can easily revert the patch with ./apply_patch.py -r if required. Optionally, you can also install Cobalt-Strike Parser: # cd REW-sploit/extras
# git clone https://github.com/Sentinel-One/CobaltStrikeParser.git
Standing on the shoulder of giants
REW-sploit is based on a couple of great frameworks, Unicorn and speakeasy-emulator (but also other libraries). Thanks to everyone and thanks to the OSS movement!
How it works
In general we can say that whilst Red Teams have a lot of tools helping them in "automating" attacks, Blue Teams (https://www.kitploit.com/search/label/Blue%20Teams) are a bit "tool-less". So, what I thought is to build something to help Blue Team (https://www.kitploit.com/search/label/Blue%20Team) Analysis. REW-sploit can get a shellcode/DLL/EXE, emulate the execution, and give you a set of information to help you in understanding what is going on. Example of extracted information are: API calls Encryption keys used by MSF payloads decrypted 2nd stage coming from MSF Cobalt-Strike configurations (if CobaltStrike parser is installed (https://github.com/Sentinel-One/CobaltStrikeParser)) You can find several examples on the current capabilities here below: RC4 Keys Extraction (https://asciinema.org/a/ln8tkJH7bOhACFRMdnPmk2i1o?speed=2) RC4 Keys Extraction + PCAP 2nd stage decryption (https://asciinema.org/a/TfrcYnCaCuCPGVhaeq0wkEyag?speed=2) ChaCha Keys Extraction (https://asciinema.org/a/01oMaPMG0BmLkPhXkIMNvSO4c?speed=2) Meterpreter session (https://asciinema.org/a/Q8zZ8Ri7ZPzpBOZRTh9eZpzWi?speed=2)Decryption (https://www.kitploit.com/search/label/Decryption) (no RSA) Cobalt-Strike beacon Emulation (https://asciinema.org/a/ps4VdIqY71W786j9lOAz9taOp?speed=10) Cobalt-Strike config Extraction (https://asciinema.org/a/1hGjmn9hgx5i2CAZFePpbaI70?speed=5) Debugging options (https://asciinema.org/a/kIhOo2jKjOBTcxh8VrU0UzkXi) Dumping Threads (https://asciinema.org/a/5SeKKodDXl79vceM7eXjsQJil?speed=2)
Fixups
In some cases emulation (https://www.kitploit.com/search/label/Emulation) was simply breaking, for different reasons. In some cases obfuscation (https://www.kitploit.com/search/label/Obfuscation) was using some techniques that was confusing the emulation engine. So I implemented some ad-hoc fixups (you can enable them by using -F option of the emulate_payload command). Fixups are implemented in modules/emulate_fixups.py. Currently we have Unicorn issue #1092: #
# Fixup #1
# Unicorn issue #1092 (XOR instruction executed twice)
# https://github.com/unicorn-engine/unicorn/issues/1092
# #820 (Incorrect memory view after running self-modifying code)
# https://github.com/unicorn-engine/unicorn/issues/820
# Issue: self modfying code in the same Translated Block (16 bytes?)
# Yes, I know...this is a huge kludge... :-/
#
FPU emulation issue: #
# Fixup #2
# The "fpu" related instructions (FPU/FNSTENV), used to recover EIP, sometimes
# returns the wrong addresses.
___________________________
@hacking_Attack
@Hacking_Video
GitHub
GitHub - REW-sploit/REW-sploit: Emulate and Dissect MSF and *other* attacks
Emulate and Dissect MSF and *other* attacks. Contribute to REW-sploit/REW-sploit development by creating an account on GitHub.
# In this case, I need to track the first FPU instruction and then place
# its address in STACK when FNSTENV is called
#
Trap Flag evasion: #
# Fixup #3
# Trap Flag evasion technique
# https://unit42.paloaltonetworks.com/single-bit-trap-flag-intel-cpu/
#
# The call of the RDTSC with the trap flag enabled, cause an unhandled
# interrupt. Example code:
# pushf
# or dword [esp], 0x100
# popf
# rdtsc
#
# Any call to RDTSC with Trap Flag set will be intercepted and TF will
# be cleared
#
Customize YARA rules
File modules/emulate_rules.py contains the YARA rules used to intercept the interesting part of the code, in order to implement instrumentation. I tried to comment as much as possible these sections in order to let you create your own rule (please share them with a pull request if you think they can help others). For example: # Used for : this xor instruction contains the constant used to # encrypt the lenght of the payload that will be sent as 2nd # stage # Architecture: x32 # yara_reverse_tcp_rc4_xor_32 = 'rule reverse_tcp_rc4_xor { \ strings: \ $opcodes_1 = { 8b 36 \ 81 f6 ?? ?? ?? ?? } \ condition: \ $opcodes_1 }' ">#
# Payload Name: [MSF] windows/meterpreter/reverse_tcp_rc4
# Search for : mov esi,dword ptr [esi]
# xor esi,0x
# Used for : this xor instruction contains the constant used to
# encrypt the lenght of the payload that will be sent as 2nd
# stage
# Architecture: x32
#
yara_reverse_tcp_rc4_xor_32 = 'rule reverse_tcp_rc4_xor { \
strings: \
$opcodes_1 = { 8b 36 \
81 f6 ?? ?? ?? ?? } \
condition: \
$opcodes_1 }'
Issues
Please, open Issues if you find something that not work or that can be improved. Thanks!
Download REW-sploit (https://github.com/REW-sploit/REW-sploit)
___________________________
@hacking_Attack
@Hacking_Video
# its address in STACK when FNSTENV is called
#
Trap Flag evasion: #
# Fixup #3
# Trap Flag evasion technique
# https://unit42.paloaltonetworks.com/single-bit-trap-flag-intel-cpu/
#
# The call of the RDTSC with the trap flag enabled, cause an unhandled
# interrupt. Example code:
# pushf
# or dword [esp], 0x100
# popf
# rdtsc
#
# Any call to RDTSC with Trap Flag set will be intercepted and TF will
# be cleared
#
Customize YARA rules
File modules/emulate_rules.py contains the YARA rules used to intercept the interesting part of the code, in order to implement instrumentation. I tried to comment as much as possible these sections in order to let you create your own rule (please share them with a pull request if you think they can help others). For example: # Used for : this xor instruction contains the constant used to # encrypt the lenght of the payload that will be sent as 2nd # stage # Architecture: x32 # yara_reverse_tcp_rc4_xor_32 = 'rule reverse_tcp_rc4_xor { \ strings: \ $opcodes_1 = { 8b 36 \ 81 f6 ?? ?? ?? ?? } \ condition: \ $opcodes_1 }' ">#
# Payload Name: [MSF] windows/meterpreter/reverse_tcp_rc4
# Search for : mov esi,dword ptr [esi]
# xor esi,0x
# Used for : this xor instruction contains the constant used to
# encrypt the lenght of the payload that will be sent as 2nd
# stage
# Architecture: x32
#
yara_reverse_tcp_rc4_xor_32 = 'rule reverse_tcp_rc4_xor { \
strings: \
$opcodes_1 = { 8b 36 \
81 f6 ?? ?? ?? ?? } \
condition: \
$opcodes_1 }'
Issues
Please, open Issues if you find something that not work or that can be improved. Thanks!
Download REW-sploit (https://github.com/REW-sploit/REW-sploit)
___________________________
@hacking_Attack
@Hacking_Video
Unit 42
Evade Sandboxes With a Single Bit – the Trap Flag
Unit 42 has discovered a specific single bit (Trap Flag) in the Intel CPU register that can be abused by malware to evade sandbox detection.
Vertical Privilege Escalation Using Burp Match And Replace
https://iamnoob.medium.com/vertical-privilege-escalation-using-burp-match-and-replace-2e413601bded?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://iamnoob.medium.com/vertical-privilege-escalation-using-burp-match-and-replace-2e413601bded?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
Vertical Privilege Escalation Using Burp Match And Replace
Halo kembali lagi dengan tulisan yang membosankan, saya akan menulis lagi bug yang saya temukan beberapa hari yang lalu di program.com (di…
Halo kembali lagi dengan tulisan yang membosankan, saya akan menulis lagi bug yang saya temukan beberapa hari yang lalu di program.com (di…Continue reading on Medium » (https://iamnoob.medium.com/vertical-privilege-escalation-using-burp-match-and-replace-2e413601bded?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
Vertical Privilege Escalation Using Burp Match And Replace
Halo kembali lagi dengan tulisan yang membosankan, saya akan menulis lagi bug yang saya temukan beberapa hari yang lalu di program.com (di…
hacking: security in practice
Can i delete whatsapp messages with remote control
hi what i am trying to do is as follows: I need to instantly delete the WhatsApp group message from my own phone to the other phone. Blocking it doesn't work. The only way is remote control or writing a program for it and automatically deleting it, which is difficult because I don't know coding. Also if there is such a feature of customizable whatsapp apps to use it. can you help me please?
submitted by /u/whychamaeleon
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Can i delete whatsapp messages with remote control
hi what i am trying to do is as follows: I need to instantly delete the WhatsApp group message from my own phone to the other phone. Blocking it doesn't work. The only way is remote control or writing a program for it and automatically deleting it, which is difficult because I don't know coding. Also if there is such a feature of customizable whatsapp apps to use it. can you help me please?
submitted by /u/whychamaeleon
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Can i delete whatsapp messages with remote control
hi what i am trying to do is as follows: I need to instantly delete the WhatsApp group message from my own phone to the other phone. Blocking it...
Vertical Privilege Escalation Using Burp Match And Replace
Halo kembali lagi dengan tulisan yang membosankan, saya akan menulis lagi bug yang saya temukan beberapa hari yang lalu di program.com (di…Continue reading on Medium »
Read more...
Halo kembali lagi dengan tulisan yang membosankan, saya akan menulis lagi bug yang saya temukan beberapa hari yang lalu di program.com (di…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Tips to Avoid Reckless Red Teaming and Rash Reconnaissance
https://cdn-images-1.medium.com/max/1280/1*x6TU8MpviQWNuwqLPmmy4g.jpeg
In 2014, the Bonneville Power Administration (BPA) conducted a red team exercise in an attempt to infiltrate the west coast’s power grid…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Tips to Avoid Reckless Red Teaming and Rash Reconnaissance
https://cdn-images-1.medium.com/max/1280/1*x6TU8MpviQWNuwqLPmmy4g.jpeg
In 2014, the Bonneville Power Administration (BPA) conducted a red team exercise in an attempt to infiltrate the west coast’s power grid…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Tips to Avoid Reckless Red Teaming and Rash Reconnaissance
In 2014, the Bonneville Power Administration (BPA) conducted a red team exercise in an attempt to infiltrate the west coast’s power grid…