stack spoofer. Since we're merely overwriting return addresses on the thread's stack, we're not spoofing the remaining areas of the stack itself. Moreover we're leaving our call stack unwindable meaking it look anomalous since the system will not be able to properly walk the entire call stack frames chain.

However I'm aware of these shortcomings, at the moment I've left it as is since I cared mostly about evading automated scanners that could iterate over processes, enumerate their threads, walk those threads stacks and pick up on any return address pointing back to a non-image memory (such as SEC_PRIVATE- the one allocated dynamically by VirtuaAllocand friends). A focused malware analyst would immediately spot the oddity and consider the thread rather unusual, hunting down our implant. More than sure about it. Yet, I don't believe that nowadays automated scanners such as AV/EDR have sorts of heuristics implemented that would actually walk each thread's stack to verify whether its un-windable ¯\_(ツ)_/¯.

Surely this project (and commercial implementation found in C2 frameworks) gives AV & EDR vendors arguments to consider implementing appropriate heuristics covering such a novel evasion technique.

In order to improve this technique, one can aim for a true Thread Stack Spoofer by inserting carefully crafted fake stack frames established in an reverse-unwinding process. Read more on this idea below. Implementing a true Thread Stack SpooferHours-long conversation with namazso teached me, that in order to aim for a proper thread stack spoofer we would need to reverse x64 call stack unwinding process. Firstly, one needs to carefully acknowledge the stack unwinding process explained in (a) linked below. The system when traverses Thread call stack on x64 architecture will not simply rely on return addresses scattered around the thread's stack, but rather it:

1. takes return address
2. attempts to identify function containing that address (with RtlLookupFunctionEntry)
3. That function returns RUNTIME_FUNCTION, UNWIND_INFOand UNWIND_CODEstructures. These structures describe where are the function's beginning address, ending address, and where are all the code sequences that modify RBPor RSP.
4. System needs to know about all stack & frame pointers modifications that happened in each function across the Call Stack to then virtually rollback these changes and virtually restore call stack pointers when a call to the processed call stack frame happened (this is implemented in RtlVirtualUnwind)
5. The system processes all UNWIND_CODEs that examined function exhbits to precisely compute the location of that frame's return address and stack pointer value.
6. Through this emulation, the System is able to walk down the call stacks chain and effectively "unwind" the call stack.

In order to interfere with this process we wuold need to revert it by having our reverted form of RtlVirtualUnwind. We would need to iterate over functions defined in a module (let's be it kernel32), scan each function's UNWIND_CODEcodes and closely emulate it backwards (as compared to RtlVirtualUnwindand precisely RtlpUnwindPrologue) in order to find locations on the stack, where to put our fake return addresses. namazso mentions the necessity to introduce 3 fake stack frames to nicely stitch the call stack:

1. A "desync" frame (consider it as a gadget-frame) that unwinds differently compared to the caller of our MySleep(having differnt UWOP- Unwind Operation code). We do this by looking through all functions from a module, looking through their UWOPs, calculating how big the fake frame should be. This frame must have UWOPS different than our MySleep's caller.
2. Next frame that we want to find is a function that [...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ThreadStackSpoofer - PoC For An Advanced In-Memory Evasion Technique Allowing To Better Hide Injected Shellcode'S Memory Allocation From Scanners And Analysts

___________________________
@hacking_Attack
@Hacking_Video

Abusing Public Infrastructure to Build Your Own VirusTotal for Email: An Open-Source Secure Email Gateway Evaluation Toolkit
https://www.reddit.com/r/redteamsec/comments/qf96ke/abusing_public_infrastructure_to_build_your_own/

Hey Everyone, I recently published an open-source project (Phishious) that allows you to create your own VirusTotal but for evaluating Secure Email Gateway technologies. GitHub - Rices/Phishious: An open-source Secure Email Gateway (SEG) evaluation toolkit designed for red-teamers. (https://github.com/Rices/Phishious) The project piggybacks off a BSides presentation I gave earlier in the year on how email bounce responses can be abused for malicious intent. BSides Presentation (https://www.youtube.com/watch?v=wqRlVtRYwWQ) In the project, I’ve weaponised the attack discussed during this presentation and automated it to an extent that it only requires a few clicks to perform. I’ve uploaded a short video on how to use Phishious - Phishious - Automated Scan Introduction - YouTube (https://www.youtube.com/watch?v=QZ9p4f6B5Ww) I’d love to hear your feedback on the project! Regards,
Rices submitted by /u/Jumpy_Resolution3089 (https://www.reddit.com/user/Jumpy_Resolution3089)
[link] (https://www.reddit.com/r/redteamsec/comments/qf96ke/abusing_public_infrastructure_to_build_your_own/) [comments] (https://www.reddit.com/r/redteamsec/comments/qf96ke/abusing_public_infrastructure_to_build_your_own/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SWEET NECTARS of the SEOUL

https://cdn-images-1.medium.com/max/973/1*s-9uAV80zL9PQ8t0shpX2w.jpeg
TABLE OF CONTENTS

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Stay Safe From Cyber Attacks?

https://cdn-images-1.medium.com/max/1080/1*51uFyNdc30m7RxFhjuFOFw.png
With hacks, scams, cybercriminals, malware, and more, the internet can seem like a dangerous place these days. In addition, the recent…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bocor Lagi, Bocor Lagi… Sekarang Giliran Komisi Perlindungan Anak Indonesia Jadi Korban Hacker

https://cdn-images-1.medium.com/max/1280/1*w5A-h4BbmsERR-3HWM5ltg.jpeg
Kasus kebocoran data yang terjadi pada instansi pemerintahan kembali terjadi. Hal ini semakin membuktikan bahwa masalah keamanan data…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack the box — Previse Walkthrough

https://cdn-images-1.medium.com/max/1052/1*z-sq423RVs3qmenzg0XLYA.png
Hack the box — Previse Walkthrough

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Popular NPM library hijacked to install password-stealers, miners

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Popular NPM library hijacked to install password-stealers, minersPost Views: 113
Reading Time: 1 Minute
Hackers hijacked the popular UA-Parser-JS NPM library, with millions of downloads a week, to infect Linux and Windows devices with cryptominers and password-stealing trojans in a supply-chain attack.
The UA-Parser-JS library is used to parse a browser’s user agent to identify a visitor’s browser, engine, OS, CPU, and Device type/model.

The library is immensely popular, with millions of downloads a week and over 24 million downloads this month so far. In addition, the library is used in over a thousand other projects, including those by Facebook, Microsoft, Amazon, Instagram, Google, Slack, Mozilla, Discord, Elastic, Intuit, Reddit, and many more well-known companies.
https://www.bleepstatic.com/images/news/security/attacks/n/npms/ua-parser-js/downloads-npm-stat.jpg
UA-Parser-JS project hijacked to install malwareOn October 22nd, a threat actor published malicious versions of the UA-Parser-JS NPM library to install cryptominers and password-stealing trojans on Linux and Windows devices.

According to the developer, his NPM account was hijacked and used to deploy the three malicious versions of the library.

“I noticed something unusual when my email was suddenly flooded by spams from hundreds of websites (maybe so I don’t realize something was up, luckily the effect is quite the contrary),” explained Faisal Salman, the developer of UA-Parser-JS, in a bug report.

“I believe someone was hijacking my npm account and published some compromised packages (0.7.29, 0.8.0, 1.0.0) which will probably install malware as can be seen from the diff here: https://app.renovatebot.com/package-diff?name=ua-parser-js&from=0.7.28&to=1.0.0.”

The affected versions and their patched counterparts are:
Malicious version Fixed version 0.7.29 0.7.30 0.8.0 0.8.1 1.0.0 1.0.1
From copies of the malicious NPMs shared with BleepingComputer by Sonatype, we can better understand the attack.
See Also: Apple Pay with VISA lets hackers force payments on locked iPhones
When the compromised packages are installed on a user’s device, a preinstall.js script will check the type of operating system used on the device and either launch a Linux shell script or a Windows batch file.
https://www.bleepstatic.com/images/news/security/attacks/n/npms/ua-parser-js/check-os.jpg
___________________________
@hacking_Attack
@Hacking_Video

tic.com/images/news/security/attacks/n/npms/ua-parser-js/windows-batch.jpg
regsvr32.exe -s create.dllcommand, it will attempt to steal passwords for a wide variety of programs, including FTP clients, VNC, messaging software, email clients, and browsers.

A list of targeted programs can be found in the table below.
WinVNC Firefox FTP Control Screen Saver 9x Apple Safari NetDrive PC Remote Control Remote Desktop Connection Becky ASP.NET Account Cisco VPN Client The Bat! FreeCall GetRight Outlook Vypress Auvis FlashGet/JetCar Eudora CamFrog FAR Manager FTP Gmail Notifier Win9x NetCache Windows/Total Commander Mail.Ru Agent ICQ2003/Lite WS_FTP IncrediMail “&RQ, R&Q” CuteFTP Group Mail Free Yahoo! Messenger FlashFXP PocoMail Digsby FileZilla Forte Agent Odigo FTP Commander Scribe IM2/Messenger 2 BulletProof FTP Client POP Peeper Google Talk SmartFTP Mail Commander Faim TurboFTP Windows Live Mail MySpaceIM FFFTP Mozilla Thunderbird MSN Messenger CoffeeCup FTP SeaMonkey Windows Live Messenger Core FTP Flock Paltalk FTP Explorer Download Master Excite Private Messenger Frigate3 FTP Internet Download Accelerator Gizmo Project SecureFX IEWebCert AIM Pro UltraFXP IEAutoCompletePWs Pandion FTPRush VPN Accounts Trillian Astra WebSitePublisher Miranda 888Poker BitKinex GAIM FullTiltPoker ExpanDrive Pidgin PokerStars Classic FTP QIP.Online TitanPoker Fling JAJC PartyPoker SoftX FTP Client WebCred CakePoker Directory Opus Windows Credentials UBPoker FTP Uploader MuxaSoft Dialer EType Dialer FreeFTP/DirectFTP FlexibleSoft Dialer RAS Passwords LeapFTP Dialer Queen Internet Explorer WinSCP VDialer Chrome 32bit FTP Advanced Dialer Opera WebDrive Windows RAS
See Also: OSINT Tool: Osintgram
In addition to stealing passwords from the above programs, the DLL will execute a PowerShell script to steal passwords from the Windows credential manager, as shown below.
https://www.bleepstatic.com/images/news/security/attacks/n/npms/ua-parser-js/steal-windows-credentials.jpg
What should UA-Parser-JS users do?Due to the widespread impact of this supply-chain attack, it is strongly advised that all users of the UA-Parser-JS library check their projects for malicious software.

This includes checking for the existence of either jsextension.exe (Windows) or jsextension (Linux) and deleting them if they are found.

For Windows users, you should scan your device for a create.dll file and delete it immediately.

While only Windows was infected with a password-stealing Trojan, it is wise for Linux users to also assume their device was fully compromised.

Due to this, all infected Linux and Windows users should also change their passwords, keys, and refresh tokens, as they were likely compromised and sent to the threat actor.

While changing your passwords and access tokens will likely be a huge undertaking, by not doing so, the threat actor can compromise other accounts, including any projects you develop for further supply-chain attacks.
See Also: Hacking stories – Operation Aurora: When China hacked Google Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker[...]

___________________________
@hacking_Attack
@Hacking_Video

-3-90x90.jpg Google: YouTubers’ accounts hijacked with cookie-stealing malware4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-2-90x90.jpg Acer hacked twice in a week by the same threat actor5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif-6-e5d8ed29a830-90x90.jpg Credit card PINs can be guessed even when covering the ATM pad6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/REVIL-headpic-90x90.jpg REvil ransomware shuts down again after Tor sites were hijacked1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/google-chrome-adblocker-uai-1440x900-1-90x90.jpg Malicious Chrome ad blocker injects ads behind the scenes1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/maxresdefault-90x90.jpg Brizy WordPress Plugin Exploit Chains Allow Full Site Takeovers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/abstract_mysterysnail-90x90.jpg Microsoft Kills Bug Being Exploited in MysterySnail Espionage Campaign2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/apple-iphone-hacking-90x90.jpg Emergency Apple iOS 15.0.2 update fixes zero-day used in attacks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/Linux-1280x720-1-90x90.jpg FontOnLake malware infects Linux systems2 weeks ago
The post Popular NPM library hijacked to install password-stealers, miners first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Wpscan only working with my VPN turned off

I'm a total noob, so this may be a stupid question, but wpscan is only working when I disconnect from my VPN. That seems like, not ideal. What can I do about this?

And by not working, I mean that I'll try to scan a url, and it will abort the scan and say the website is down. But if I disconnect from my VPN, it'll scan just fine.

submitted by /u/hollstein167
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Report: Stolen Data Spreading Faster on the Dark Web

https://external-preview.redd.it/KSCNPmu4ZJK90rvnVd_lhUklzqnJdS-fu_2fkWhqXRU.jpg?width=640&crop=smart&auto=webp&s=033b565a46e024dc00e19c86a4880adb9399147f submitted by /u/george-alexander2k
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
VERIFIED PRO INTERNET HACKING SERVICES (TECHCROWNHACKER@GMAIL.COM)

Honestly it’s no right to say this publicly. But best appreciation is to review him. I couldn’t believe my husband would ever cheat after…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video