Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools! Inceptor - Template-Driven AV/EDR Evasion Framework https://blogger.googleusercontent.com/img/a/AVvXsEjMvp71667jwAxf10_rXDiDkFYyHXKpBYUY34Z1QEbtEyfAja5ezfO_ba2zZkkdfXFgc5-TreFrgs9bicdvBhrWHvvcWW9wo8t7YVqVUBw4-OrTpR2aBO5MZhT-zfdV6f9tl…

such, it offers the possibility to include AV evasion features to the payload in the form of "modules" (plugins).

The plugins which can be embedded are:

* AMSI bypass
* WLDP bypass
* ETW bypass
* Sandbox (Behavioural) Deception EDR Evasion MechanismsInceptor also implements EDR Evasion mechanisms, such as full unhooking, direct syscall invocation and manual DLL mapping. Direct Syscalls are implemented in C# using the outstanding "DInvoke" project, again by TheWover. In C/C++, Syscalls are implemented using SysWhispers and SysWhispers2 projects, by Jackson_T. In addition, Inceptor has built-in support for x86 Syscalls as well.

As the AV bypass features, these features can be enabled as modules, with the only difference that they require operating on a template which supports them. The techniques implemented so far are:

* Full Unhooking
* Manual DLL Mapping
* Direct Syscalls ObfuscationInceptor supports payload obfuscation by using external utils, such as ConfuserExand Chameleon, and provides support for C/C++ obfuscation using LLVM-Obfuscator, which is an IR-based obfuscator using the LLVM compilation platform.

* PowerShell
* C#
* C/C++ Code SigningAnother feature of Inceptor is that it can code sign the resulting binary/dll by using the tool CarbonCopyUsually, files signed with code signing certificates are less strictly analysed. Many anti-malware products don't validate/verify these certificates. WorkflowThe full workflow can be summarized in the following high-level, and simplified scheme: https://blogger.googleusercontent.com/img/a/AVvXsEhtY364sG4mDPsmkEE24HKiLw6E4yM1b-ivsrjThfI4znwvzLKPbJiELut9C8TfWjaSqsMphVTXqyejVCVMdjM1HUQOUOVCnfWGHaExKCMVMSCwFHS0YKN6UWfWyQmVZMDHvUC88xVA72IBskIJZiFX0NCSDLLJVU5OcVO6o0Cf8GlT4qli7tE7Da4ssQ=s16000 InstallationInceptor has been designed to work on Windows. The update-config.pyutility can locate the required Microsoft binaries and update the configuration accordingly. It might be required to install Microsoft Build Tools, the Windows SDK, and Visual Studio, update-config.pywill guide the user on how to install the required dependencies.

git clone --recursive https://github.com/klezVirus/inceptor.git
cd inceptor
virtualenv venv
venv\Scripts\activate.bat
pip install -r requirements.txt
cd inceptor
python update-config.py

Useful NotesDefault LoadersThe current version of Inceptor locates a specific template using a simple naming convention (don't change template names), and the set of arguments given by the user. Among the arguments, there is also the loader (-t). If not specified, the loader will be picked-up as a function of the file to pack, following this simple schema:

$ python inceptor.py -hh

[*] Default Loaders
Input File Extension SpecialCondition   Guessed Filetype Default Loader  Default Template
0                     .raw              NaN          Shellcode  Simple Loader           Classic
1                     .exe             .NET  Dotnet Executable          Donut           Classic
2                     .exe              NaN  Native Executable   Pe2Shellcode           PE Load
3                     .dll              NaN     Native Library           sRDI           Classic

Template name conventionIt's very important to understand also the template name convention, to avoid misinterpreting an artifact behaviour.

* Classic: a classic template usually means it uses the VirtualAlloc/VirtualAllocEx and CreateThread/CreateRemoteThread API to allocate and execute arbitrary code
* Dinvoke: if a template contains only dinvoke (e.g classic-dinvoke.cs), it means it uses dynamic function resolution feature of dinvoke
* dinvoke-subtechnique: a template containing dinvoke followed by another keyword is using a particular feature of dinvoke, like manual_mapping, overload_mapping, or syscalls
* Syscalls: as the name suggest, this template is u[...]

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 21:42

Hacking Articles Tips Tricks Videos Tutorials

sing syscalls
* PE Load: this template tries to map a full PE into memory, without transforming it
* Assembly Load: this template tries to execute a .NET assembly using reflection Usage

$ usage: inceptor.py [-h] [-hh] [-Z] {native,dotnet,powershell} ...

inceptor: A Windows-based PE Packing framework designed to help 
Red Team Operators to bypass common AV and EDR solutions

positional arguments:
{native,dotnet,powershell}
native              Native Binaries Generator
dotnet              .NET Binaries Generator
powershell          PowerShell Wrapper Scripts Generator

optional arguments:
-h, --help            show this help message and exit
-hh                   Show functional table
-Z, --check           Check file against ThreatCheck

Next Developments* New Template Engine
* New Templates
* New Encoders
* C# Code-Based obfuscation Resources* Inceptor - Bypass AV-EDR solutions combining well known techniques
* A tale of EDR bypass methods Download Inceptor

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 21:42

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
10 Hot Red Team Tools Set to Hit Black Hat Europe

The slate of Arsenal presentations at Black Hat Europe is set to feature lots of low-cost and free goodies for offensive security pros.

10 views21:49

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Sinclair Broadcast Group Confirms Ransomware Attack

The US television station operator has revealed certain servers and workstations, as well as office and operational networks, were disrupted in the attack.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Sinclair Broadcast Group Confirms Ransomware Attack

The US television station operator has revealed certain servers and workstations, as well as office and operational networks, were disrupted in the attack.

9 viewsedited 21:49

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
NSA, FBI, CISA Issue Advisory on 'BlackMatter' Ransomware

Ransomware has become a "national security issue," NSA director said.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

NSA, FBI, CISA Issue Advisory on 'BlackMatter' Ransomware

Ransomware has become a "national security issue," NSA director said.

8 viewsedited 21:49

Hacking Articles Tips Tricks Videos Tutorials

9 views23:13

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Mifare no value block and no money hex

Hey! I don't know if this is the right place to ask but here i go anyway.

I'm a student who's getting back to uni soon and who's working in the meantime. The company where i work has vending machines that work with NFC mifare classic 1k badges as well.

I managed to make a dump of the value stored inside my badge after adding some money (which was really easy with mifare classic tools) and i can just write the data back into the badge to get the amount of money i had back.

Now this is where it gets complicated. I made another dump of the badge to compare both and find the money hex (one has $5 so 500 and the other has $4.1 so 410) i convert those numbers in hexadecimal but i can't find any of them in any sector.

Now I've searched everywhere to find an answer but i couldn't find anything and I'm now interested as to why it doesn't work like everything I've read about.

I didn't try with Kali and mfoc because (i guess) it should give the exact same data ???? But I'll definitely give it a try see if that's the problem or anything.

Thanks for reading !

$5 dump image $4 dump image

submitted by /u/Redeemed_Yi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Mifare no value block and no money hex

Hey! I don't know if this is the right place to ask but here i go anyway. I'm a student who's getting back to uni soon and who's working in the...

10 viewsedited 23:13

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Data breaches

Anyone know how or where to find data breaches? If anyone says dark web do you have any onions?

submitted by /u/wengsweat
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

r/hacking on Reddit: Data breaches

Posted by u/wengsweat - 20 votes and 19 comments

9 viewsedited 23:13

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
This is gonna be out there but...

Can anyone hack me my discord account back?

I can prove it's me (linked accounts like reddit etc)

I may look like an idiot putting it here but I've spent too much time/money on that account :(

submitted by /u/QualterZam
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

This is gonna be out there but...

Can anyone hack me my discord account back? I can prove it's me (linked accounts like reddit etc) I may look like an idiot putting it here but...

8 viewsedited 23:14

Hacking Articles Tips Tricks Videos Tutorials

Exploiting Request forgery on Mobile Applications.

We will tell a story about the Request forgery family and how it can attack mobile applications.Continue reading on Medium »
Read more...

6 views23:48

Hacking Articles Tips Tricks Videos Tutorials

Exploiting Request forgery on Mobile Applications.
https://dphoeniixx.medium.com/exploiting-request-forgery-on-mobile-applications-e1d196d187b3?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

Exploiting Request forgery on Mobile Applications.

We will tell a story about the Request forgery family and how it can attack mobile applications.

5 viewsedited 23:48

Hacking Articles Tips Tricks Videos Tutorials

4 views23:48

Hacking Articles Tips Tricks Videos Tutorials

We will tell a story about the Request forgery family and how it can attack mobile applications.Continue reading on Medium » (https://dphoeniixx.medium.com/exploiting-request-forgery-on-mobile-applications-e1d196d187b3?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium