er template) can be abused to obtain a certificate that allows us to authenticate as a domain admin (or any other active user/machine).

THIS SETTING SHOULD ABSOLUTELY NOT BE SET IN YOUR ENVIRONMENT.

Example

=== Certificate Authority ===
ComputerName : dc.theshire.local
CAName : theshire-DC-CA
ConfigString : dc.theshire.local\theshire-DC-CA
IsRoot : True
AllowsUserSuppliedSans : True
VulnerableACL : False
EnrollmentPrincipals : THESHIRE\Domain Users
THESHIRE\Domain Computers
THESHIRE\certmanager
THESHIRE\certadmin
THESHIRE\Nested3
EnrollmentEndpoints :
NTLMEnrollmentEndpoints :
DACL : BUILTIN\Administrators (Allow) – ManageCA, ManageCertificates
THESHIRE\Domain Admins (Allow) – ManageCA, ManageCertificates
THESHIRE\Domain Users (Allow) – Read, Enroll
THESHIRE\Domain Computers (Allow) – Enroll
THESHIRE\Enterprise Admins (Allow) – ManageCA, ManageCertificates
THESHIRE\certmanager (Allow) – ManageCertificates, Enroll
THESHIRE\certadmin (Allow) – ManageCA, Enroll
THESHIRE\Nested3 (Allow) – ManageCertificates, Enroll
Misconfigurations : ESC6
[!] The above CA is misconfigured!
…(snip)…
[!] EDITF_ATTRIBUTESUBJECTALTNAME2 set on this CA, the following templates may be vulnerable:
CA : dc.theshire.local\theshire-DC-CA
Name : User
SchemaVersion : 1
OID : 1.3.6.1.4.1.311.21.8.10395027.10224472.4213181.15714845.1171465.9.1.1
VulnerableTemplateACL : False
LowPrivCanEnroll : True
EnrolleeSuppliesSubject : False
EnhancedKeyUsage : Encrypting File System (1.3.6.1.4.1.311.10.3.4)|Secure Email (1.3.6.1.5.5.7.3.4)|Client Authentication (1.3.6.1.5.5.7.3.2)
HasAuthenticationEku : True
HasDangerousEku : False
EnrollmentAgentTemplate : False
CAManagerApproval : False
IssuanceRequirements : [Issuance Requirements]
Authorized signature count: 0
Reenrollment requires: same criteria as for enrollment.
ValidityPeriod : 1 years
RenewalPeriod : 6 weeks
Owner : THESHIRE\Enterprise Admins
DACL : NT AUTHORITY\Authenticated Users (Allow) – Read
THESHIRE\Domain Admins (Allow) – Read, Write, Enroll
THESHIRE\Domain Users (Allow) – Read, Enroll
THESHIRE\Enterprise Admins (Allow) – Read, Write, Enroll
Misconfigurations :

Mitigations

Immediately remove this flag and restart the affected certificate authority from a PowerShell prompt with elevated rights against the CA server:

PS C:> certutil -config “CA_HOST\CA_NAME” -setreg policy\EditFlags -EDITF_ATTRIBUTESUBJECTALTNAME2
PS C:> Get-Service -ComputerName CA_HOST certsvc | Restart-Service -Force

ESC7 – Vulnerable Certificate Authority Access Control

Details

Outside of certificate templates, a certificate authority itself has a set of permissions that secure various CA actions. These permissions can be accessed from certsrv.msc, right clicking a CA, selecting properties, and switching to the Security tab.

There are two rights that are security sensitive and dangerous if unintended principals possess them:

* ManageCA (aka “CA Administrator”) – allows for administrative CA actions, including (remotely) flipping the EDITF_ATTRIBUTESUBJECTALTNAME2 bit, resulting in ESC6.
* ManageCertificates (aka “Certificate Manager/Officer”) – allows the principal to approve pending certificate requests, negating the “Manager Approval” Issuance Requirement/protection

Example

=== Certificate Authority ===
ComputerName : dc.theshire.local
CAName : theshire-DC-CA
ConfigString : dc.theshire.local\theshire-DC-CA
IsRoot : True
AllowsUserSuppliedSans : False
VulnerableACL : True
EnrollmentPrincipals : THESHIRE\Domain Users
THESHIRE\Domain Computers
THESHIRE\certmanager
THESHIRE\certadmin
THESHIRE\Nested3
EnrollmentEndpoints :
NTLMEnrollmentEndpoints :
DACL : BUILTIN\Administrators (Allow) – ManageCA, ManageCertificates
THESHIRE\Domain Admins (Allow) – ManageCA, Ma[...]

___________________________
@hacking_Attack
@Hacking_Video

nageCertificates
THESHIRE\Domain Users (Allow) – ManageCA, Read, Enroll
THESHIRE\Domain Computers (Allow) – Enroll
THESHIRE\Enterprise Admins (Allow) – ManageCA, ManageCertificates
THESHIRE\certmanager (Allow) – ManageCertificates, Enroll
THESHIRE\certadmin (Allow) – ManageCA, Enroll
THESHIRE\Nested3 (Allow) – ManageCertificates, Enroll
Misconfigurations : ESC7
[!] The above CA is misconfigured!

Mitigations

Open up the Certification Authority console (certsrv.msc) on the affected CA, right click the CA name and click “Properties”.

Go to “Security” and remove the vulnerable access control entry.

ESC8 – NTLM Relay to AD CS HTTP Endpoints

NOTE: this particular check in PSPKIAudit only checks if NTLM is present for any published enrollment endpoints. It does NOT check if Extended Protection for Authentication is present for these NTLM-enabled endoints, so false positives may occur!

Details

AD CS supports several HTTP-based enrollment methods via additional AD CS server roles that administrators can install. These HTTP-based certificate enrollment interfaces are all vulnerable NTLM relay attacks.

Using NTLM relay, an attacker on a compromised machine can impersonate any inbound-NTLM-authenticating AD account. While impersonating the victim account, an attacker could access these web interfaces and request a client authentication certificate based on the User or Machine certificate templates.

Example

=== Certificate Authority ===
ComputerName : dc.theshire.local
CAName : theshire-DC-CA
ConfigString : dc.theshire.local\theshire-DC-CA
IsRoot : True
AllowsUserSuppliedSans : False
VulnerableACL : False
EnrollmentPrincipals : THESHIRE\Domain Users
THESHIRE\Domain Computers
THESHIRE\certmanager
THESHIRE\certadmin
THESHIRE\Nested3
EnrollmentEndpoints : http://dc.theshire.local/certsrv/
NTLMEnrollmentEndpoints : http://dc.theshire.local/certsrv/
DACL : BUILTIN\Administrators (Allow) – ManageCA, ManageCertificates
THESHIRE\Domain Admins (Allow) – ManageCA, ManageCertificates
THESHIRE\Domain Users (Allow) – Read, Enroll
THESHIRE\Domain Computers (Allow) – Enroll
THESHIRE\Enterprise Admins (Allow) – ManageCA, ManageCertificates
THESHIRE\certmanager (Allow) – ManageCertificates, Enroll
THESHIRE\certadmin (Allow) – ManageCA, Enroll
THESHIRE\Nested3 (Allow) – ManageCertificates, Enroll
Misconfigurations : ESC8
[!] The above CA is misconfigured!

Mitigations

Either remove the HTTP(S) enrollment endpoints, disable NTLM for the endopints, or enable Extended Protection for Authentication. See Harden AD CS HTTP Endpoints – PREVENT8 in the whitepaper for more deatils.

Misc – Explicit Mappings

Another possible mitigation for some situations is to enforce explicit mappings for certificates. This disables the use of alternate SANs in certificates when authenticating to Active Directory.

For Kerberos, setting the HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Kdc ! UseSubjectAltName key to 00000000 forces an explicit mapping. There are more details in KB4043463.

Disabling explicit mappings for SChannel is not really documented, but based on our research settings 0x1 or 0x2 to the HKEY_LOCAL_MACHINE\CurrentControlSet\Control\SecurityProviders\SCHANNEL ! CertificateMappingMethods key appears to block SANs, but more testing is needed.

Triaging Existing Issued Certificate Requests

WARNING: this functionality has been minimally tested in large environments!

Note: see “Monitor User/Machine Certificate Enrollments – DETECT1” in the whitepaper for additional information and how to perform these searches with certutil.

If you want to examine existing issued certificate requests, for example to see if any requests specified arbitrary SANs, or were requested for specific te[...]

___________________________
@hacking_Attack
@Hacking_Video

mplates/by specific principals, the Get-CertRequest [-CAComputerName COMPUTER.DOMAIN.COM | -CAName X-Y-Z] function builds on various PSPKI functions to give more contextual information.

Specifically, the raw Certificate Signing Request (CSR) is extracted for every currently issued certificate in the domain, and specific information (i.e., whether a SAN was specified, the requestor name/machine/process, etc.) is constructed from the request to enrich the CSR object.

The following flags can be useful:
FlagDescription-HasSANOnly return issued certificates that has a Subject Alternative Name specified in the request.-Requester DOMAIN\USEROnly return issued certificate requests for the specific requesting user.-Template TEMPLATE_NAMEOnly return return issued certificate requests for the specified template name.
To export ALL issued certificate requests to csv, use Get-CertRequest | Export-CSV -NoTypeInformation requests.csv.

Here is an example result entry that shows a situation where a Subject Alternative Name (SAN) was specified with Certify:

CA : dc.theshire.local\theshire-DC-CA
RequestID : 4602
RequesterName : THESHIRE\cody
RequesterMachineName : dev.theshire.local
RequesterProcessName : Certify.exe
SubjectAltNamesExtension :
SubjectAltNamesAttrib : Administrator
SerialNumber : 55000011faef0fab5ffd7f75b30000000011fa
CertificateTemplate : ESC1 Template
(1.3.6.1.4.1.311.21.8.10395027.10224472.4213181.15714845.1171465.9.10657968.9897558)
RequestDate : 6/3/2021 5:54:51 PM
StartDate : 6/3/2021 5:44:51 PM
EndDate : 6/3/2022 5:44:51 PM
CA : dc.theshire.local\theshire-DC-CA
RequestID : 4603
RequesterName : THESHIRE\cody
RequesterMachineName : dev.theshire.local
RequesterProcessName : Certify.exe
SubjectAltNamesExtension : Administrator
SubjectAltNamesAttrib :
SerialNumber : 55000011fb021b79cf7276c2de0000000011fb
CertificateTemplate : ESC1 Template
(1.3.6.1.4.1.311.21.8.10395027.10224472.4213181.15714845.1171465.9.10657968.9897558)
RequestDate : 6/3/2021 5:55:10 PM
StartDate : 6/3/2021 5:45:10 PM
EndDate : 6/3/2022 5:45:10 PM

The SubjectAltNamesExtension property means that the x509 SubjectAlternativeNames extension was used to specify the SAN, which happens for templates with the CT_FLAG_ENROLLEE_SUPPLIES_SUBJECT flag. The SubjectAltNamesAttrib property means that x509 name/value pairs were used, which happens when specifying a SAN when the EDITF_ATTRIBUTESUBJECTALTNAME2 CA flag is set.

Existing issued certificates can be revoked using PSPKI’s Revoke-Certificate function:

PS C:\> Get-CertificationAuthority | Get-IssuedRequest -RequestID | Revoke-Certificate -Reason "KeyCompromise"

Applicable values for -Reason are “KeyCompromise”, “CACompromise”, and “Unspecified”.


Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Clone SKG RFID/Garage Opener

My apartment complex uses the SKG Microplus 0869 to control the doors and gate of my apartment complex. I was wondering if it is as simple as buying a new one as they uses the same codes or if there is something more complex I need to do, or circumvent this all together with some sort of system

submitted by /u/SilverSolis
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
my IG got hacked

when I made my account I just made it for a couple of memes, selfies and to chat with people I met online, I picked an unusual username which I didn’t think anyone would want and a password which was tbh not very secure because I never imagined anyone would want to hack it. After I lost my account I found a popular account with 20k+ followers having my username but with an underscore behind it. I’ve been looking at my lost account and they changed my profile picture to Anne Hathaway?? Which is bizzare imo. And they’re not even usin the account. Is it possible they would be able to hack my entire phone or have they only hacked my IG? My I cloud has a much more secure password

submitted by /u/peridotvalley3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
THE ONLY MARKET TO BUY ANYTHING … DARKNET MARKETS AND MARKETPLACES


We all have at least once in our life been a part of cybercrime. Download music from the internet is a cybercrime, downloading games from…

Continue reading on rootissh »

Hacking on Medium
Getting Started With Shell Scripting


Hey, everyone! In this blog, we will learn about something that interests many of us: Shell Scripting.

Continue reading on Analytics Vidhya »

Hacking on Medium
Part 2: To Buy, or Not to Buy, That’s Not Even a Question


Anyone can build a login for your application, but are you able to run it in a scalable and maintainable way for the future?

Continue reading on codeburst »

Malicious docx generator to exploit CVE-2021-40444
https://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/

submitted by /u/0xDangerous_bit (https://www.reddit.com/user/0xDangerous_bit)
[link] (https://github.com/lockedbyte/CVE-2021-40444) [comments] (https://www.reddit.com/r/redteamsec/comments/pm4ana/malicious_docx_generator_to_exploit_cve202140444/)

___________________________
@hacking_Attack
@Hacking_Video

How I found my first AEM related bug.

Hello all the amazing hackers and cyber security enthusiasts. My name is Vedant(Also known as Vegeta on Twitter😁) and I’m an aspiring bug…Continue reading on Medium »
Read more...

How I found my first AEM related bug.
https://vedanttekale20.medium.com/how-i-found-my-first-aem-related-bug-5ea901aad3f4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello all the amazing hackers and cyber security enthusiasts. My name is Vedant(Also known as Vegeta on Twitter😁) and I’m an aspiring bug…Continue reading on Medium » (https://vedanttekale20.medium.com/how-i-found-my-first-aem-related-bug-5ea901aad3f4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Facebook Gaming valid bug closed as “Informative”.

Hello people.Continue reading on Medium »
Read more...

Karta - Source Code Assisted Fast Binary Matching Plugin For IDA
http://www.kitploit.com/2021/09/karta-source-code-assisted-fast-binary.html

___________________________
@hacking_Attack
@Hacking_Video

"Karta" (Russian for "Map") is an IDA Python plugin that identifies and matches open-sourced libraries in a given binary. The plugin uses a unique technique that enables it to support huge binaries (>200,000 functions), with almost no impact on the overall performance. The matching algorithm is location-driven. This means that it's main focus is to locate the different compiled files, and match each of the file's functions based on their original order within the file. This way, the matching depends on K (number of functions in the open source) instead of N (size of the binary), gaining a significant performance (https://www.kitploit.com/search/label/Performance) boost as usually N >> K. We believe that there are 3 main use cases for this IDA plugin: Identifying a list of used open sources (and their versions) when searching for a useful 1-Day Matching the symbols of supported open sources to help reverse engineer (https://www.kitploit.com/search/label/Reverse%20Engineer) a malware Matching the symbols of supported open sources to help reverse engineer a binary / firmware when searching for 0-Days in proprietary code
Read The Docs
https://karta.readthedocs.io/
Installation (Python 3 & IDA >= 7.4)
For the latest versions, using Python 3, simply git clone the repository and run the setup.py install script. Python 3 is supported since versions v2.0.0 and above.
Installation (Python 2 & IDA < 7.4)
As of the release of IDA 7.4, Karta is only actively developed for IDA 7.4 or newer, and Python 3. Python 2 and older IDA versions are still supported using the release version v1.2.0, which is most probably going to be the last supported version due to python 2.X end of life.
Identifier
Karta's identifier (https://www.kitploit.com/search/label/Identifier) is a smaller plugin that identifies the existence, and fingerprints the versions, of the existing (supported) open source libraries within the binary. No more need to reverse engineer the same open-source library again-and-again, simply run the identifier plugin and get a detailed list of the used open sources. Karta currently supports more than 10 open source libraries, including: OpenSSL Libpng Libjpeg NetSNMP zlib Etc.
Matcher
After identifying the used open sources, one can compile a .JSON configuration file for a specific library (libpng version 1.2.29 for instance). Once compiled, Karta will automatically attempt to match the functions (symbols) of the open source in the loaded binary. In addition, in case your open source used external functions (memcpy, fread, or zlib_inflate), Karta will also attempt to match those external functions as well.
Folder Structure
src: source directory for the plugin configs: pre-supplied *.JSON configuration files (hoping the community will contribute more) compilations: compilation tips for generating the configuration files, and lessons from past open sources docs: sphinx documentation directory
Additional Reading
https://research.checkpoint.com/karta-matching-open-sources-in-binaries/ https://research.checkpoint.com/thumbs-up-using-machine-learning-to-improve-idas-analysis
Credits
This project was developed by me (see contact details below) with help and support from my research group at Check Point (Check Point Research).
Contact (Updated)
This repository was developed and maintained by me, Eyal Itkin, during my years at Check Point Research. Sadly, with my departure of the research group, I will no longer be able to maintain this repository. This is mainly because of the long list of requirements (https://www.kitploit.com/search/label/Requirements) for running all of the regression tests, and the IDA Pro versions that are involved in the process. Please accept my sincere apology. @EyalItkin (https://twitter.com/EyalItkin)

Download Karta (https://github.com/CheckPointSW/Karta)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux TutorialsA Career as an Ethical Hacker
Much of an Ethical Hacker’s skills are put into testing security controls and perimeter penetration vulnerabilities in devices. They also broadly search a network or application for exploitable weaknesses. So, what is Ethical Hacking exactly? Today, we will quickly explore the world of Ethical Hacking and how one can become an Ethical Hacker.

Alt Text: A Career as an Ethical Hacker

#Bookmarking

* Ethical Hacking: Overview
* Key Concepts of Ethical Hacking
* The Role of an Ethical Hacker
* Typical Tasks of an Ethical Hacker 
* Skills of an Ethical Hacker
* Ethical Hacking Certifications and Education
* Conclusion

H2: Ethical Hacking: Overview

Ethical Hacking is a legal and authorized way of obtaining unauthorized access to a system, network, application, or data through duplicating strategies and activities usually carried out by malicious attackers. 

The practice of Ethical Hacking helps to identify and resolve security vulnerabilities before a malicious user detects a crack in the wall and tries to exploit it. Ethical Hackers or White Hat Hackers assess these areas and proactively improve the security infrastructure of an organization. You can sign up for any Ethical Hacking course online to start a career in Ethical Hacking. Now that we know what Ethical Hacking encompasses, let’s understand the underlying key concepts in Ethical Hacking.

H2: Key Concepts of Ethical Hacking

Ethical Hackers follow four key protocols:

1. Staying legal – Ethical Hackers get the authorization to access and perform security assessments in an organization’s system or network.
2. Defining the scope – The scope of the assessment needs to be determined to ensure that the ethical hacking carried out is within the approved boundaries.
3. Reporting – A detailed report should be made of the vulnerabilities that were found during the assessment along with the remediation advice to resolve the issues.
4. Respecting data sensitivity – For obvious reasons, a non-disclosure agreement should be in place depending on the data sensitivity, as well as other terms and conditions that are necessary..

H2: The Role of an Ethical Hacker

Ethical Hackers can either work for an organization or freelance. While, typically, an Ethical Hacker should have knowledge of all the latest security vulnerabilities, attacks, and threats, an in-house Ethical Hacker may only need to know the aspects of security concerned with the current organization.

Proficiency in Ethical Hacking skills can be of use for several other security roles like Security Analysts and Network Engineers. 

H2: Typical Tasks of an Ethical Hacker

The responsibilities of Ethical Hackers vary from company to company but some staple responsibilities will always be included in all job descriptions. Following are the typical work assignments for an Ethical Hacker. 

1. Threat Modeling

The objective of threat modeling is to effectively gauge which area should be prioritized to maintain a secure system. Threat modeling optimizes network security through the identification of vulnerabilities and then introducing countermeasures to prevent future attacks or lessen the blow of an attack that has already happened.

Threat modeling is a repetitive process consisting of asset definition, understanding of each application’s function with respect to these assets, creation of security profiles for all applications, identification of potential threats and prioritizing them, and documentation of attacks or other adverse events and the steps taken to counteract them.

It is preferable not to leave threat modeling till after there has been an attack and rather have a theoretical idea beforehand.

1. Security Assessment

The majority of the time, Ethical Hackers have the task of performing security assessments. It is a risk-based assessment of the security th[...]

___________________________
@hacking_Attack
@Hacking_Video

at is currently in place. These tests are periodically executed to test the security preparedness of an organization. The checks are done for vulnerabilities and the adherence to security policies, and later, steps are recommended that will minimize the risk of future attacks. 

1. Vulnerability Threat Assessment

A vulnerability threat assessment identifies, quantifies, and ranks the vulnerabilities and threats that could exploit those vulnerabilities. While closely related to a security assessment, it is a more threat-based assessment.

1. Report Writing 

Concise and professional report writing is one of the crucial assignments of an Ethical Hacker. Security assessments and vulnerability threat assessments will be of no value if the appropriate information can not be presented clearly to the concerned people. Well-written reports are the primary deliverables.

H2: Skills of an Ethical Hacker

An Ethical Hacker understands networks, operating systems, firewalls, servers, and file systems. They are also aware of how file permissions work as well as generally knowledgeable about computer science. They possess strong coding skills and are well-versed in manual, direct, and hands-on attack tactics. 

Ethical Hackers are required to stay ahead of the hackers and malicious attackers and must possess the ability to think like them. Creative and analytical thinking, thus, goes without saying. Following are the set of skills that an Ethical Hacker should master:

1. Linux

2. Penetration testing

3. Various programming languages – 

* Python
* SQL
* C
* C++
* Javascript
* Java
* PHP

4. Various database engines

5. Critical thinking and problem-solving

H2: Ethical Hacking Certifications and Education

There are two certifications that you can opt for to become a certified Ethical Hacker. 

* Certified Ethical Hacker (CEH)
* Offensive Security Certified Professional (OSCP)

The CEH exam is conducted by the EC-Council. Apart from this certification exam, others in cybersecurity offered by the EC-Council can also contribute towards your recruitment as an Ethical Hacker. 

A bachelor’s degree in a computer-related field with a focus on cyber security is another way one can become an Ethical Hacker. Additionally, there is an abundance of Youtube videos, tutorials, online communities and forums, magazines, and journals that are loaded with information on Ethical Hacking. One only needs to start somewhere. 

H2: Conclusion

To pursue a career as an Ethical Hacker, one will need to be open to continuous learning as newer and newer threats come into existence every day. There is a rise in the demand for skilled Ethical Hackers and due to this, many training programs and courses are there in the market for aspirants. A training program or a certification course can give your skills a boost. Above all, try out these skills in a real-world environment. 

___________________________
@hacking_Attack
@Hacking_Video

Facebook Gaming valid bug closed as “Informative”.
https://medium.com/@unurbayar1998/facebook-gaming-bug-closed-as-informative-ef5e9434c04c?source=rss------bug_bounty-5

Hello people.Continue reading on Medium » (https://medium.com/@unurbayar1998/facebook-gaming-bug-closed-as-informative-ef5e9434c04c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video