Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
PickleC2 : A Post-Exploitation And Lateral Movements Framework
PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements.
PickleC2 has the ability to import your own PowerShell module for Post-Exploitation and Lateral Movement or automate the process.
Features
There is a one implant for the beta version which is powershell.
1. PickleC2 is fully encrypted communications, protecting the confidentiality and integrity of the C2 traffic even when communicating over HTTP.
2. PickleC2 can handle multiple listeners and implants with no issues
3. PickleC2 supports anyone who would like to add his own PowerShell Module
Future Features
In the up coming updates pickle will support:
1. Go Implant
2. Powershell-Less Implant that don’t use System.Management.Automation.dll.
3. Malleable C2 Profile will be supported.
4. HTTPS communications will be supported. NOTE: Even HTTP communications is fully encrypted.
Install
PickleC2 is a opensource can be found on Github. PickleC2 is only supported for linux for now and you can download it through https://github.com/xRET2pwn/PickleC2
Installation and Setup
PickleC2 is written in Python3 and developed and tested on Kali Linux.
Install PickleC2 On Linux
Picklec2 is can be found on Github.
PickleC2 is so simple and easy to use and everything you need will be found in help option
How to help
The help command will show you everything you need and help can be used to show any option’s help through
How to Listener
You can use
https://1.bp.blogspot.com/-WgP0DY0HaQc/YSIYDQw3BJI/AAAAAAAAKfY/MjzE3FtN8ekcy9utWoUXYMLsZo2begcNACLcBGAsYHQ/s774/help_option.png
Listeners is built on flask.
FLASK is a popular Python web framework, meaning it is a third-party Python library used for developing web applications.
Start Listener
You can start your listener through
listener start [Listener_Name] [Listener_Interface] [Listener_Port]
https://1.bp.blogspot.com/-DkvHzRvo7qY/YSRrULmPoNI/AAAAAAAAKfw/7r8xIKGuH0wbZK1glyjo0n-tOe69bAB8QCLcBGAsYHQ/s730/start_listener%2B%25281%2529.png
Stop Listener
You can stop your listener through
listener stop [Listener_Name]
https://1.bp.blogspot.com/-v4accDXhYhU/YSRrmAvD53I/AAAAAAAAKf4/uA8aKh8eWm0FKBeYYcHLJTRnhovuCfvcACLcBGAsYHQ/s322/stop_listener%2B%25281%2529.png
List Listeners
You can list all the listeners through
listener list
https://1.bp.blogspot.com/-5_N2W6MdBOo/YSRr1hPSn2I/AAAAAAAAKf8/cYjv7s_2tx4NtjQV0ZNElLNcgMl9LqanQCLcBGAsYHQ/s414/list_listener%2B%25281%2529.png
Load Listener
You can use load listener if you have a not active listeners and you need to active them.
listener load
https://1.bp.blogspot.com/-DXFVBUW6j5A/YSRsMEI1NgI/AAAAAAAAKgI/xS7bdmwlbrkKuakp_BzDGVWvMM4DZxZ7QCLcBGAsYHQ/s853/load_listener%2B%25281%2529.png
How to Implant
In this section you will be able to create your implant.
Generate Implant
You can generate implant through.
implant generate [listener_name] [Implant_Lang] [Implant_Name]
https://1.bp.blogspot.com/-Lj6z6mGi5p4/YSRs4RG0wII/AAAAAAAAKgU/WjLX_g9Fp-MKEHO7Nc6VHn2QhEFfdxrlQCLcBGAsYHQ/s1128/generate_implant.png
List Active Implant
You can list all the active implant through
PickleC2 : A Post-Exploitation And Lateral Movements Framework
PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements.
PickleC2 has the ability to import your own PowerShell module for Post-Exploitation and Lateral Movement or automate the process.
Features
There is a one implant for the beta version which is powershell.
1. PickleC2 is fully encrypted communications, protecting the confidentiality and integrity of the C2 traffic even when communicating over HTTP.
2. PickleC2 can handle multiple listeners and implants with no issues
3. PickleC2 supports anyone who would like to add his own PowerShell Module
Future Features
In the up coming updates pickle will support:
1. Go Implant
2. Powershell-Less Implant that don’t use System.Management.Automation.dll.
3. Malleable C2 Profile will be supported.
4. HTTPS communications will be supported. NOTE: Even HTTP communications is fully encrypted.
Install
PickleC2 is a opensource can be found on Github. PickleC2 is only supported for linux for now and you can download it through https://github.com/xRET2pwn/PickleC2
Installation and Setup
PickleC2 is written in Python3 and developed and tested on Kali Linux.
Install PickleC2 On Linux
Picklec2 is can be found on Github.
git clone https://github.com/xRET2pwn/PickleC2.gitcd PickleC2Install Python3 and pip3 sudo apt install python3 python3-pipInstall PickleC2 requirements python3 -m pip install -r requirements.txtRun PickleC2 ./run.pyOR python3 run.pyHow To Use PickleC2PickleC2 is so simple and easy to use and everything you need will be found in help option
How to help
The help command will show you everything you need and help can be used to show any option’s help through
help https://1.bp.blogspot.com/-382uRy5jEbE/YSIXlEAcE8I/AAAAAAAAKfQ/EP_ML6ADxU4WOz-9TtUkWrmzAi2aX-VFwCLcBGAsYHQ/s901/help.png How to Listener
You can use
help listenercommand to show all the listener commands.https://1.bp.blogspot.com/-WgP0DY0HaQc/YSIYDQw3BJI/AAAAAAAAKfY/MjzE3FtN8ekcy9utWoUXYMLsZo2begcNACLcBGAsYHQ/s774/help_option.png
Listeners is built on flask.
FLASK is a popular Python web framework, meaning it is a third-party Python library used for developing web applications.
Start Listener
You can start your listener through
listener start [Listener_Name] [Listener_Interface] [Listener_Port]
https://1.bp.blogspot.com/-DkvHzRvo7qY/YSRrULmPoNI/AAAAAAAAKfw/7r8xIKGuH0wbZK1glyjo0n-tOe69bAB8QCLcBGAsYHQ/s730/start_listener%2B%25281%2529.png
Stop Listener
You can stop your listener through
listener stop [Listener_Name]
https://1.bp.blogspot.com/-v4accDXhYhU/YSRrmAvD53I/AAAAAAAAKf4/uA8aKh8eWm0FKBeYYcHLJTRnhovuCfvcACLcBGAsYHQ/s322/stop_listener%2B%25281%2529.png
List Listeners
You can list all the listeners through
listener list
https://1.bp.blogspot.com/-5_N2W6MdBOo/YSRr1hPSn2I/AAAAAAAAKf8/cYjv7s_2tx4NtjQV0ZNElLNcgMl9LqanQCLcBGAsYHQ/s414/list_listener%2B%25281%2529.png
Load Listener
You can use load listener if you have a not active listeners and you need to active them.
listener load
https://1.bp.blogspot.com/-DXFVBUW6j5A/YSRsMEI1NgI/AAAAAAAAKgI/xS7bdmwlbrkKuakp_BzDGVWvMM4DZxZ7QCLcBGAsYHQ/s853/load_listener%2B%25281%2529.png
How to Implant
In this section you will be able to create your implant.
Generate Implant
You can generate implant through.
implant generate [listener_name] [Implant_Lang] [Implant_Name]
https://1.bp.blogspot.com/-Lj6z6mGi5p4/YSRs4RG0wII/AAAAAAAAKgU/WjLX_g9Fp-MKEHO7Nc6VHn2QhEFfdxrlQCLcBGAsYHQ/s1128/generate_implant.png
List Active Implant
You can list all the active implant through
implant listhttps://1.bp.blogspot.com/-VFHY3g9XQwU/YSRtM_tF[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Process-Dump : Windows Tool For Dumping Malware PE Files From Memory Back To Disk For Analysis Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware…
dump the running malware from memory, run the following command to dump all processes:
* pd64.exe -system
* All the dumped components will be in the working directory of pd64.exe. You can change the output path using the ‘-o’ flag, Notes on the naming convention of dumped modules
* ‘hiddemodule’ in the filename instead of the module name indicates the module was not properly registered in the process.
* ‘codechunk’ in the filename means that it is a reconstructed dump from a loose executable region. This can be for example injected code that did not have a PE header. Codechunks will be dumped twice, once with a reconstructed x86 and again with a reconstructed x64 header.
Example filenames of dumped files
* notepad_exe_PID2990_hiddenmodule_16B8ABB0000_x86.dll
* notepad_exe_PID3b5c_notepad.exe_7FF6E6630000_x64.exe
* notepad_exe_PID2c54_codechunk_17BD0000_x86.dll
* notepad_exe_PID2c54_codechunk_17BD0000_x64.dll Help Page
Process Dump v2.1 Copyright ® 2017, Geoff McDonald http://www.split-code.com/
Process Dump (pd.exe) is a tool used to dump both 32 and 64 bit executable modules back to disk from memory within a process address space. This tool is able to find and dump hidden modules as well as loose executable code chunks, and it uses a clean hash database to exclude dumping of known clean files. This tool uses an aggressive import reconstruction approach that links all DWORD/QWORDs that point to an export in the process to the corresponding export function. Process dump can be used to dump all unknown code from memory (‘-system’ flag), dump specific processes, or run in a monitoring mode that dumps all processes just before they terminate.
Before first usage of this tool, when on the clean workstation the clean exclusing hash database can be generated by either:
* pd -db gen
* pd -db genquick
Example Usage:
* pd -system
* pd -pid 419
* pd -pid 0x1a3
* pd -pid 0x1a3 -a 0x401000 -o c:\dump\ -c c:\dump\test\clean.db
* pd -p chrome.exe
* pd -p “(?i).*chrome.*”
* pd -closemon
Options:
* -system
Dumps all modules not matching the clean hash databas from all accessible processes into the working directory.
* -pid <pid
Dumps all modules not matching the clean hash database from the specified pid into the current working directory. Use a ‘0x’ prefix to specify a hex PID.
* -closemon
Runs in monitor mode. When any processes are terminating process dump will first dump the process.
* -p <regex
Dumps all modules not matching the clean hash database from the process name found to match the filter into specified pid into the current working directory.
* -a <module
Dumps a module at the specified base address from the process.
* -g
Forces generation of PE headers from scratch, ignoring existing headers.
* -o <path
Sets the default output root folder for dumped components.
* -v
Verbose.
* -nh
No header is printed in the output.
* -nr
Disable recursion on hash database directory add or remove commands.
* -ni
Disable import reconstruction.
* -nc
Disable dumping of loose code regions.
* -nt
Disable multithreading.
* -nep
Disable entry point hashing.
* -eprec
Force the entry point to be reconstructed, even if a valid one appears to exist.
* -t <thread
Sets the number of threads to use (default 16).
* -cdb <filepath
Full filepath to the clean hash database to use for this run.
* -edb <filepath
Full filepath to the entrypoint hash database to use for this run.
* -esdb <filepath
Full filepath to the entrypoint short hash database to use for this run.
* -db gen
Automatically processes a few common folders as well as all the currently running processes and adds the found module hashes to the clean hash database. It will add all files recursively in: %WINDIR% %HOMEPATH% C:\Program Files
C:\Program Files (x86)
As well as all modules in all running processes
[...]
* pd64.exe -system
* All the dumped components will be in the working directory of pd64.exe. You can change the output path using the ‘-o’ flag, Notes on the naming convention of dumped modules
* ‘hiddemodule’ in the filename instead of the module name indicates the module was not properly registered in the process.
* ‘codechunk’ in the filename means that it is a reconstructed dump from a loose executable region. This can be for example injected code that did not have a PE header. Codechunks will be dumped twice, once with a reconstructed x86 and again with a reconstructed x64 header.
Example filenames of dumped files
* notepad_exe_PID2990_hiddenmodule_16B8ABB0000_x86.dll
* notepad_exe_PID3b5c_notepad.exe_7FF6E6630000_x64.exe
* notepad_exe_PID2c54_codechunk_17BD0000_x86.dll
* notepad_exe_PID2c54_codechunk_17BD0000_x64.dll Help Page
Process Dump v2.1 Copyright ® 2017, Geoff McDonald http://www.split-code.com/
Process Dump (pd.exe) is a tool used to dump both 32 and 64 bit executable modules back to disk from memory within a process address space. This tool is able to find and dump hidden modules as well as loose executable code chunks, and it uses a clean hash database to exclude dumping of known clean files. This tool uses an aggressive import reconstruction approach that links all DWORD/QWORDs that point to an export in the process to the corresponding export function. Process dump can be used to dump all unknown code from memory (‘-system’ flag), dump specific processes, or run in a monitoring mode that dumps all processes just before they terminate.
Before first usage of this tool, when on the clean workstation the clean exclusing hash database can be generated by either:
* pd -db gen
* pd -db genquick
Example Usage:
* pd -system
* pd -pid 419
* pd -pid 0x1a3
* pd -pid 0x1a3 -a 0x401000 -o c:\dump\ -c c:\dump\test\clean.db
* pd -p chrome.exe
* pd -p “(?i).*chrome.*”
* pd -closemon
Options:
* -system
Dumps all modules not matching the clean hash databas from all accessible processes into the working directory.
* -pid <pid
Dumps all modules not matching the clean hash database from the specified pid into the current working directory. Use a ‘0x’ prefix to specify a hex PID.
* -closemon
Runs in monitor mode. When any processes are terminating process dump will first dump the process.
* -p <regex
Dumps all modules not matching the clean hash database from the process name found to match the filter into specified pid into the current working directory.
* -a <module
Dumps a module at the specified base address from the process.
* -g
Forces generation of PE headers from scratch, ignoring existing headers.
* -o <path
Sets the default output root folder for dumped components.
* -v
Verbose.
* -nh
No header is printed in the output.
* -nr
Disable recursion on hash database directory add or remove commands.
* -ni
Disable import reconstruction.
* -nc
Disable dumping of loose code regions.
* -nt
Disable multithreading.
* -nep
Disable entry point hashing.
* -eprec
Force the entry point to be reconstructed, even if a valid one appears to exist.
* -t <thread
Sets the number of threads to use (default 16).
* -cdb <filepath
Full filepath to the clean hash database to use for this run.
* -edb <filepath
Full filepath to the entrypoint hash database to use for this run.
* -esdb <filepath
Full filepath to the entrypoint short hash database to use for this run.
* -db gen
Automatically processes a few common folders as well as all the currently running processes and adds the found module hashes to the clean hash database. It will add all files recursively in: %WINDIR% %HOMEPATH% C:\Program Files
C:\Program Files (x86)
As well as all modules in all running processes
[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials PickleC2 : A Post-Exploitation And Lateral Movements Framework PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements. PickleC2 has the ability to import…
4VI/AAAAAAAAKgg/xryq3ZulLu8H2EgOjl-pdpjCoTYmZZg8gCLcBGAsYHQ/s410/list_implant.png
How to Interact
After receiving the implant shell you can interact with it through
interact [Implant_Name]
https://1.bp.blogspot.com/-qresdLaMxP4/YSRtdPcuoMI/AAAAAAAAKgo/jgTe7_4sPsEoc6t4CVX2PHBtu376inKXgCLcBGAsYHQ/s394/interact.png
After entering the interact section you can use help command to show the interact commands.
https://1.bp.blogspot.com/-bIe_-Qg71ns/YSRts6N6Q-I/AAAAAAAAKgw/_Fdw3OuG8nIgkCXDjVAM2ZnOafzaeon9wCLcBGAsYHQ/s799/help_interact.png
Execute Powershell
There is an option to execute a PowerShell Command through
powershell [Command]
https://1.bp.blogspot.com/-MnOMbQ28ctA/YSRt89uVjKI/AAAAAAAAKg4/4EGBYao_MAgoI2nsfV6wObLoDR7BKZ_2ACLcBGAsYHQ/s562/execute_powershell.png
Execute CMD
There is an option to execute a CMD command through
cmd [Command]
https://1.bp.blogspot.com/-0ziGzvm35tM/YSRuO3IAbKI/AAAAAAAAKhA/Bu01IYMzhNQuG-6eMarRwF98v3UAghbkQCLcBGAsYHQ/s485/execute_cmd.png
Invoke Module
https://1.bp.blogspot.com/-ei8HLJsPb9U/YSRunQJuyCI/AAAAAAAAKhI/oKG_owR7LSEf5TMBczEmf4Yh9NChBO_swCLcBGAsYHQ/s555/list_module.png
There is an options to invoke a PowerShell script through
module [Module_Name]
https://1.bp.blogspot.com/-vVF88M8d8OI/YSRvQD3xNII/AAAAAAAAKhY/l4xNhQ1bifsfl5c56V_feskoilpXCtfnACLcBGAsYHQ/s964/module.png
Set Sleep
There is an option to set a delay time through
sleep [Secounds]
https://1.bp.blogspot.com/-bc9hBifppFU/YSRvm8u6rVI/AAAAAAAAKhg/xHppxfN_vYobNq2TmoXMXfnxjHCmUGvZwCLcBGAsYHQ/s396/sleep.png
Exit Implant
There is an option to end the implant activity through
exit
https://1.bp.blogspot.com/-dmc-_0BpHFg/YSRv3g34tJI/AAAAAAAAKho/OZ2UHZUXXqgd0-OhM2JzFxve_lSL1mPAgCLcBGAsYHQ/s542/exit.png
PickleC2 Modules
PickleC2 supports to anyone who would like to add his own powershell script to invoke in his target through adding his powershell module in the modules folder and add his module in the database.
Add PowerShell Module
For anyone who would like to add his powershell module must follow the following steps:
* Run AddModule.py script.
https://1.bp.blogspot.com/-1aswXs7hpnU/YSRywnn1PII/AAAAAAAAKhw/nQNDoN0NJ50hy0jCXu8_3r66TgzDgn7DQCLcBGAsYHQ/s868/add_module.png
* Add the powershell module in modules Folder.
https://1.bp.blogspot.com/--jnpZMytTAU/YSSOexj3w3I/AAAAAAAAKh4/_5nCsjI0egEMQjzg_11oyo5fIBbM6fe7QCLcBGAsYHQ/s418/module_folder.png
Use Module
PickleC2 is so simple to use all you need to do to use a module is
* interact <target_name
https://1.bp.blogspot.com/-at_Aep2Nsyg/YSSOyzNoXQI/AAAAAAAAKiA/jgS2Q9s2_fcnlIEInErqz8s9y436m-gIACLcBGAsYHQ/s394/interact.png
* module <module_name
https://1.bp.blogspot.com/-6qI9c_LwHcU/YSSPA26mK1I/AAAAAAAAKiE/GOZS5OwWnRIINeQOBn-iKX4-WzFe_1ZiwCLcBGAsYHQ/s964/module.png Download
How to Interact
After receiving the implant shell you can interact with it through
interact [Implant_Name]
https://1.bp.blogspot.com/-qresdLaMxP4/YSRtdPcuoMI/AAAAAAAAKgo/jgTe7_4sPsEoc6t4CVX2PHBtu376inKXgCLcBGAsYHQ/s394/interact.png
After entering the interact section you can use help command to show the interact commands.
https://1.bp.blogspot.com/-bIe_-Qg71ns/YSRts6N6Q-I/AAAAAAAAKgw/_Fdw3OuG8nIgkCXDjVAM2ZnOafzaeon9wCLcBGAsYHQ/s799/help_interact.png
Execute Powershell
There is an option to execute a PowerShell Command through
powershell [Command]
https://1.bp.blogspot.com/-MnOMbQ28ctA/YSRt89uVjKI/AAAAAAAAKg4/4EGBYao_MAgoI2nsfV6wObLoDR7BKZ_2ACLcBGAsYHQ/s562/execute_powershell.png
Execute CMD
There is an option to execute a CMD command through
cmd [Command]
https://1.bp.blogspot.com/-0ziGzvm35tM/YSRuO3IAbKI/AAAAAAAAKhA/Bu01IYMzhNQuG-6eMarRwF98v3UAghbkQCLcBGAsYHQ/s485/execute_cmd.png
Invoke Module
https://1.bp.blogspot.com/-ei8HLJsPb9U/YSRunQJuyCI/AAAAAAAAKhI/oKG_owR7LSEf5TMBczEmf4Yh9NChBO_swCLcBGAsYHQ/s555/list_module.png
There is an options to invoke a PowerShell script through
module [Module_Name]
https://1.bp.blogspot.com/-vVF88M8d8OI/YSRvQD3xNII/AAAAAAAAKhY/l4xNhQ1bifsfl5c56V_feskoilpXCtfnACLcBGAsYHQ/s964/module.png
Set Sleep
There is an option to set a delay time through
sleep [Secounds]
https://1.bp.blogspot.com/-bc9hBifppFU/YSRvm8u6rVI/AAAAAAAAKhg/xHppxfN_vYobNq2TmoXMXfnxjHCmUGvZwCLcBGAsYHQ/s396/sleep.png
Exit Implant
There is an option to end the implant activity through
exit
https://1.bp.blogspot.com/-dmc-_0BpHFg/YSRv3g34tJI/AAAAAAAAKho/OZ2UHZUXXqgd0-OhM2JzFxve_lSL1mPAgCLcBGAsYHQ/s542/exit.png
PickleC2 Modules
PickleC2 supports to anyone who would like to add his own powershell script to invoke in his target through adding his powershell module in the modules folder and add his module in the database.
Add PowerShell Module
For anyone who would like to add his powershell module must follow the following steps:
* Run AddModule.py script.
https://1.bp.blogspot.com/-1aswXs7hpnU/YSRywnn1PII/AAAAAAAAKhw/nQNDoN0NJ50hy0jCXu8_3r66TgzDgn7DQCLcBGAsYHQ/s868/add_module.png
* Add the powershell module in modules Folder.
https://1.bp.blogspot.com/--jnpZMytTAU/YSSOexj3w3I/AAAAAAAAKh4/_5nCsjI0egEMQjzg_11oyo5fIBbM6fe7QCLcBGAsYHQ/s418/module_folder.png
Use Module
PickleC2 is so simple to use all you need to do to use a module is
* interact <target_name
https://1.bp.blogspot.com/-at_Aep2Nsyg/YSSOyzNoXQI/AAAAAAAAKiA/jgS2Q9s2_fcnlIEInErqz8s9y436m-gIACLcBGAsYHQ/s394/interact.png
* module <module_name
https://1.bp.blogspot.com/-6qI9c_LwHcU/YSSPA26mK1I/AAAAAAAAKiE/GOZS5OwWnRIINeQOBn-iKX4-WzFe_1ZiwCLcBGAsYHQ/s964/module.png Download
Hacking Articles Tips Tricks Videos Tutorials
dump the running malware from memory, run the following command to dump all processes: * pd64.exe -system * All the dumped components will be in the working directory of pd64.exe. You can change the output path using the ‘-o’ flag, Notes on the naming convention…
* -db genquick
Adds the hashes from all modules in all processes to the clean hash database. Run this on a clean system.
* -db add
Adds all the files in the specified directory recursively to the clean hash database.
* -db rem
Removes all the files in the specified directory recursively from the clean hash database.
* -db clean
Clears the clean hash database.
* -db ignore
Ignores the clean hash database when dumping a process this time. All modules will be dumped even if a match is found. Version History Version 2.1 (February 12th, 2017)
* Fixed a bug where the last section in some cases would instead be filled with zeros. Thanks to megastupidmonkey for reporting this issue.
* Fixed a bug where 64-bit base addresses would be truncated to a 32-bit address. It now properly keeps the full 64-bit module base address. Thanks to megastupidmonkey for reporting this issue.
* Addressed an issue where the processes dump close monitor would crash csrss.exe.
* Stopped Process Dump from hooking it’s own process in close monitor mode. Version 2.0 (September 18th, 2016)
* Added new flag ‘-closemon’ which runs Process Dump in a monitoring mode. It will pause and dump any process just as it closes. This is designed to work well with malware analysis sandboxes, to be sure to dump malware from memory beofre the malicious process closes.
* Upgraded Process Dump to be multi-threaded. Commands that dump or get hashes from multiple processes will run separate threads per operation. Default number of threads is 16, which speeds up the general Process Dump dumping processing significantly.
* Upgraded Process Dump to dump unattached code chunks found in memory. These are identified as executable regions in memory which are not attached to a module and do not have a PE header. It also requires that the codechunk refer to at least 2 imports to be considered valid in order to reduce noise. When dumped, a PE header is recreated along with an import table. Code chunks are fully supported by the clean hash database.
* Added flags to control the filepath to the clean hash database as well as the output folder for dumped files.
* Fix to generating clean hash database from user path that was causing a crash.
* Fix to the flag ‘-g’ that forces generation of PE headers. Before even if this flag was set, system dumps (-system), would ignore this flag when dumping a process.
* Various performance improvements.
* Upgraded project to VS2015. Version 1.5 (November 21st, 2015)
* Fixed bug where very large memory regions would cause Process Dump to hang.
* Fixed bug where some modules at high addresses would not be found under 64-bit Windows.
* More debug information now outputted under Verbose mode. Version 1.4 (April 18th, 2015)
* Added new aggressive import reconstruction approach. Now patches up all DWORDs and QWORDs in the module to the corresponding export match.
* Added ‘-a (address to dump)’ flag to dump a specific address. It will generate PE headers and build an import table for the address.
* Added ‘-ni’ flag to skip new import reconstruction algorithm.
* Added ‘-g’ flag to force generation of new PE header even if there exists one when dumping a module. This is good if the PE header is malformed for example.
* Various bug fixes. Version 1.3 (October 10th, 2013)
* Improved handling of PE headers with sections that specify invalid virtual sizes and addresses.
* Better module dumping methodology for dumping virtual sections down to disk sections. Version 1.1 (April 8th, 2013)
* Fixed a compatibility issue with Windows XP.
* Corrected bug where process dump would print it is dumping a module but not actually dump it.
* Implemented the ‘-pid ‘ dump flag. Version 1.0 (April 2nd, 2013)
* Initial release. Download
Adds the hashes from all modules in all processes to the clean hash database. Run this on a clean system.
* -db add
Adds all the files in the specified directory recursively to the clean hash database.
* -db rem
Removes all the files in the specified directory recursively from the clean hash database.
* -db clean
Clears the clean hash database.
* -db ignore
Ignores the clean hash database when dumping a process this time. All modules will be dumped even if a match is found. Version History Version 2.1 (February 12th, 2017)
* Fixed a bug where the last section in some cases would instead be filled with zeros. Thanks to megastupidmonkey for reporting this issue.
* Fixed a bug where 64-bit base addresses would be truncated to a 32-bit address. It now properly keeps the full 64-bit module base address. Thanks to megastupidmonkey for reporting this issue.
* Addressed an issue where the processes dump close monitor would crash csrss.exe.
* Stopped Process Dump from hooking it’s own process in close monitor mode. Version 2.0 (September 18th, 2016)
* Added new flag ‘-closemon’ which runs Process Dump in a monitoring mode. It will pause and dump any process just as it closes. This is designed to work well with malware analysis sandboxes, to be sure to dump malware from memory beofre the malicious process closes.
* Upgraded Process Dump to be multi-threaded. Commands that dump or get hashes from multiple processes will run separate threads per operation. Default number of threads is 16, which speeds up the general Process Dump dumping processing significantly.
* Upgraded Process Dump to dump unattached code chunks found in memory. These are identified as executable regions in memory which are not attached to a module and do not have a PE header. It also requires that the codechunk refer to at least 2 imports to be considered valid in order to reduce noise. When dumped, a PE header is recreated along with an import table. Code chunks are fully supported by the clean hash database.
* Added flags to control the filepath to the clean hash database as well as the output folder for dumped files.
* Fix to generating clean hash database from user path that was causing a crash.
* Fix to the flag ‘-g’ that forces generation of PE headers. Before even if this flag was set, system dumps (-system), would ignore this flag when dumping a process.
* Various performance improvements.
* Upgraded project to VS2015. Version 1.5 (November 21st, 2015)
* Fixed bug where very large memory regions would cause Process Dump to hang.
* Fixed bug where some modules at high addresses would not be found under 64-bit Windows.
* More debug information now outputted under Verbose mode. Version 1.4 (April 18th, 2015)
* Added new aggressive import reconstruction approach. Now patches up all DWORDs and QWORDs in the module to the corresponding export match.
* Added ‘-a (address to dump)’ flag to dump a specific address. It will generate PE headers and build an import table for the address.
* Added ‘-ni’ flag to skip new import reconstruction algorithm.
* Added ‘-g’ flag to force generation of new PE header even if there exists one when dumping a module. This is good if the PE header is malformed for example.
* Various bug fixes. Version 1.3 (October 10th, 2013)
* Improved handling of PE headers with sections that specify invalid virtual sizes and addresses.
* Better module dumping methodology for dumping virtual sections down to disk sections. Version 1.1 (April 8th, 2013)
* Fixed a compatibility issue with Windows XP.
* Corrected bug where process dump would print it is dumping a module but not actually dump it.
* Implemented the ‘-pid ‘ dump flag. Version 1.0 (April 2nd, 2013)
* Initial release. Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Ep28 | How DARPA Stops IC Hardware Hackers in Their Tracks: Insights from Serge Leef - Engineering Podcast
https://external-preview.redd.it/q5KKGTZyQBs9qELZQn0FstS72vw8eQD-0tv_gPeq_uM.jpg?width=320&crop=smart&auto=webp&s=033cc8392beae5b0a0eb326ac175ae9ebf803745 submitted by /u/allaboutcircuits
[link] [comments]
Ep28 | How DARPA Stops IC Hardware Hackers in Their Tracks: Insights from Serge Leef - Engineering Podcast
https://external-preview.redd.it/q5KKGTZyQBs9qELZQn0FstS72vw8eQD-0tv_gPeq_uM.jpg?width=320&crop=smart&auto=webp&s=033cc8392beae5b0a0eb326ac175ae9ebf803745 submitted by /u/allaboutcircuits
[link] [comments]
Accessing Grofers Grafana Instance Using Shodan
https://infosecwriteups.com/accessing-grofers-grafana-instance-using-shodan-52c585ada797?source=rss------bug_bounty-5
https://infosecwriteups.com/accessing-grofers-grafana-instance-using-shodan-52c585ada797?source=rss------bug_bounty-5
Hello People….Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/accessing-grofers-grafana-instance-using-shodan-52c585ada797?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
INTRODUCTION TO CYBER SECURITY
https://cdn-images-1.medium.com/max/1200/1*BuFBq5NKiG2pCBDkG5AK7Q.jpeg
A computer hacker is the name given to the tech- folks on both sides of the internet battlefront. Bad guys or “black hat” hackers are the…
Continue reading on Medium »
INTRODUCTION TO CYBER SECURITY
https://cdn-images-1.medium.com/max/1200/1*BuFBq5NKiG2pCBDkG5AK7Q.jpeg
A computer hacker is the name given to the tech- folks on both sides of the internet battlefront. Bad guys or “black hat” hackers are the…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Phishing Attacks explained by a hacker
https://cdn-images-1.medium.com/max/1000/0*_gTSJ4E2uju4bvJk.jpg
Hi everyone! In this blog post, I will explain to you how hackers create phishing websites, emails, messages and phone calls as simple as…
Continue reading on Medium »
Phishing Attacks explained by a hacker
https://cdn-images-1.medium.com/max/1000/0*_gTSJ4E2uju4bvJk.jpg
Hi everyone! In this blog post, I will explain to you how hackers create phishing websites, emails, messages and phone calls as simple as…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Solucionadas vulnerabilidades críticas de Node.js
https://cdn-images-1.medium.com/max/1200/0*bbA7uahL-apjMkJ0
PUBLICADO EN 8 SEPTIEMBRE, 2021POR EHACKING
Continue reading on Medium »
Solucionadas vulnerabilidades críticas de Node.js
https://cdn-images-1.medium.com/max/1200/0*bbA7uahL-apjMkJ0
PUBLICADO EN 8 SEPTIEMBRE, 2021POR EHACKING
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
What a False Negative is and why it should be your primary criteria for a SAST tool
https://cdn-images-1.medium.com/max/2600/0*UzX2lkVNcRY3Og0S
In our earlier post, we discussed False Positives and why having some of them is a good thing for your teams. This blog is about a term…
Continue reading on ShiftLeft Blog »
What a False Negative is and why it should be your primary criteria for a SAST tool
https://cdn-images-1.medium.com/max/2600/0*UzX2lkVNcRY3Og0S
In our earlier post, we discussed False Positives and why having some of them is a good thing for your teams. This blog is about a term…
Continue reading on ShiftLeft Blog »
Operational Mental Models - Jackson T
https://www.reddit.com/r/redteamsec/comments/pkeywj/operational_mental_models_jackson_t/
submitted by /u/WM-M-GM (https://www.reddit.com/user/WM-M-GM)
[link] (http://jackson-t.ca/operational-mental-models.html) [comments] (https://www.reddit.com/r/redteamsec/comments/pkeywj/operational_mental_models_jackson_t/)
https://www.reddit.com/r/redteamsec/comments/pkeywj/operational_mental_models_jackson_t/
submitted by /u/WM-M-GM (https://www.reddit.com/user/WM-M-GM)
[link] (http://jackson-t.ca/operational-mental-models.html) [comments] (https://www.reddit.com/r/redteamsec/comments/pkeywj/operational_mental_models_jackson_t/)
hacking: security in practice
Trying to automate the login on a Captive Portal
Hi there,
So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my headless
So I have been learning the protocols behind it, and this
I have indexed the landing page of the application form which is https://captiveportal.com/guest/guest_register_3.php?_browser=1
Inspeting the HTML I can see:
1st) The form is of the type POST 2nd) The parameters to be filled are the following ones (according to the rendered HTML) : visitor_name and email Despite this the html form input elements doesn't exactly correspond to the ones that the HTTP request make afterwards. I Can find email But then I find a bunch of them unrelated
```
Unused field
Unused field
Unused field
```
Where in checkbox and submit I recognise their function as well , but the hidden one for example is a mistery to me its function.
Well so the second part of the analisis is to spoof (everything have to sound hackerish haha) my own 'http' traffic while authenticating to it.
With linux
``` (OUTPUT SIMPLIFIED)
T 2021/09/08 18:16:12.901797 90.80.121.128:58788 -> 20.200.140.191:80 [AP] #54 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f...lO..$.. 6...py8..B4.
T 2021/09/08 18:16:43.733225 90.80.121.128:58824 -> 20.200.140.191:80 [AP] #184 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f....l?....P$........F.. ```
Pretty unintelligible , but been a bit smart and with the index of the page that I already downloaded by
. I know later on I will be able to create a command with
___________________________
@hacking_Attack
@Hacking_Video
Trying to automate the login on a Captive Portal
Hi there,
So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my headless
Raspberry Pito the network. (I am unable to Run X-Server in this host, neither w3mor elinksdid work on rendering such a portal) Since this is considered "ilegal" by many Network Admins I post it in here , but the purpose is legitimate and it would be nice that all of us share the knowledge.So I have been learning the protocols behind it, and this
Captive Portalmay be of the type Redirect by DNSI have indexed the landing page of the application form which is https://captiveportal.com/guest/guest_register_3.php?_browser=1
Inspeting the HTML I can see:
1st) The form is of the type POST 2nd) The parameters to be filled are the following ones (according to the rendered HTML) : visitor_name and email Despite this the html form input elements doesn't exactly correspond to the ones that the HTTP request make afterwards. I Can find email But then I find a bunch of them unrelated
```
Unused field
Unused field
Unused field
```
Where in checkbox and submit I recognise their function as well , but the hidden one for example is a mistery to me its function.
Well so the second part of the analisis is to spoof (everything have to sound hackerish haha) my own 'http' traffic while authenticating to it.
With linux
ngrepyou can do this like a charm so we can sudo ngrep -W byline -d 'wlp1s0' -t '^(GET|POST) ' 'tcp and port 80' So I go for it and this is what I capture``` (OUTPUT SIMPLIFIED)
T 2021/09/08 18:16:12.901797 90.80.121.128:58788 -> 20.200.140.191:80 [AP] #54 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f...lO..$.. 6...py8..B4.
T 2021/09/08 18:16:43.733225 90.80.121.128:58824 -> 20.200.140.191:80 [AP] #184 POST / HTTP/1.1. Host: ocsp.quovadisglobal.com. User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0. Accept: /. Accept-Language: en-US,en;q=0.5. Accept-Encoding: gzip, deflate. Content-Type: application/ocsp-request. Content-Length: 87. Connection: keep-alive. . 0U0S0Q0O0M0...+..............1:l....] o......I=..y.............f....l?....P$........F.. ```
Pretty unintelligible , but been a bit smart and with the index of the page that I already downloaded by
wget \ --recursive \ --no-clobber \ --page-requisites \ --html-extension \ --max-redirect=0 \ --no-check-certificate \ --convert-links \ --restrict-file-names=unix \ -H \ --random-wait \ --limit-rate=200K \ --user-agent=Mozilla \ --level=3 \ https://www.captiveportal.com/guest/guest_register_3.php An placing that on my own apache2hosted server , then I listen to my own communication by the loopbackdevice sudo ngrep -W byline -d 'lo' -t '^(GET|POST) ' 'tcp and port 80' I can see the POST's bodies of the HTTP communication like visitor_name=Ferenc+Donest&email=ferensi45donest%40gmail.com&expire_after=168&role_id=2&create_time=2021-09-08+17%3A59%3A34&mac=&remote_addr=100.120.121.128&essid=&apgroup=&apname=&vcname=&auto_update_account=1&creator_accept_terms=1 (the next step cannot replicate it as the next page doesn't load locally , but is just a button to press OK. I know later on I will be able to create a command with
curl(or maybe 2 scripted them) in order to perform this process aut[...]___________________________
@hacking_Attack
@Hacking_Video
reddit
Trying to automate the login on a Captive Portal
Hi there, So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my...
Hacking Articles Tips Tricks Videos Tutorials
hacking: security in practice Trying to automate the login on a Captive Portal Hi there, So I was just trying to automate the login on a Captive Portal on an AP that I use for work in order to be able to connect my headless Raspberry Pito the network. (I…
omatically
My main question: It looks like the Real Captive Portal uses some sort of encription . But I believe that is available on the HTML code as the POST needs to be done client side. - Is this Encryption process perform by some of the javascript of this landing page? - Am I wrong about many of this assumptions?
Thanks for your help , I will keep you updated with my advatanges as I still need to inspect the JS code and maybe some more php files (although chances are that those have not been indexed)
submitted by /u/brohermano [link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
My main question: It looks like the Real Captive Portal uses some sort of encription . But I believe that is available on the HTML code as the POST needs to be done client side. - Is this Encryption process perform by some of the javascript of this landing page? - Am I wrong about many of this assumptions?
Thanks for your help , I will keep you updated with my advatanges as I still need to inspect the JS code and maybe some more php files (although chances are that those have not been indexed)
submitted by /u/brohermano [link] [comments]
___________________________
@hacking_Attack
@Hacking_Video