What you see is not the reality: An insight into browser caching using Twitter like button as part of the demonstration.Continue reading on Medium » (https://stevemats.medium.com/ive-just-thrown-my-twitter-data-to-firefox-i-hope-they-ll-be-able-to-cache-it-before-it-881c63bd390e?source=rss------bug_bounty-5)

Kali Linux Tutorials
ForgeCert : “Golden” Certificates

ForgeCert uses the BouncyCastle C# API and a stolen Certificate Authority (CA) certificate + private key to forge certificates for arbitrary users capable of authentication to Active Directory.

This attack is codified as DPERSIST1in our “Certified Pre-Owned” whitepaper. This code base was released ~45 days after the whitepaper was published.

@tifkin_ is the primary author of ForgeCert.

@tifkin_ and @harmj0y are the primary authors of the associated Active Directory Certificate Service research (blog and whitepaper). Background

As described in the Backgroundand Forging Certificates with Stolen CA Certificates - DPERSIST1sections of our whitepaper, the private key for a Certificate Authority’s CA certificate is protected on the CA server either via DPAPI or hardware (HSM/TPM). Additionally, the certificate (sans private key) is published to the NTAuthCertificates forest object, which defines CA certificates that enable authentication to AD. Put together, a CA whose certificate is present in NTAuthCertificates uses its private key to sign certificate signing requests (CSRs) from requesting clients. This graphic summarizes the process:
https://blogger.googleusercontent.com/img/a/AVvXsEgtDEV7TxzgJnyn415tS3YS7sYoTllCnY8RVLZCJ7_DsOZLl4MT-nIyZqNKEyoJudX_Z6uoL4115OQJi9vehN8E2TQp5FNmn6w36LtOkBIJNcBVRY5qD8U7rPNgxmhqZrWb21OMh704MoII42nY0oA74L3Hm6U4SBD1lOrRFPcPlhgtIR46e4Hl1Kmq=s1400
The security of the CA’s private key is paramount. As mentioned, if the private key is not protected by a hardware solution like a TPM or a HSM, the key will be encrypted with the Data Protection API (DPAPI) and stored on disk on the CA server. If an attacker is able to compromise a CA server, they can extract the private key for any CA certificate not protected by hardware by using @gentilkiwi’s Mimikatz or GhostPack’s SharpDPAPI project. THEFT3in the whitepaper describes this process for machine certificates.

Because the only key material used to sign issued certificates is the CA’s private key, if an attacker steals such a key (for a certificate in NTAuthCertificates) they can forge certificates capable of domain authentication. These forged certificates can be for any principal in the domain (though the account needs to be “active” for authentication to be possible, so accounts like krbtgt will not work) and the certificates will be valid for as long as the CA certificate is valid (usually 5 years by default but can be set to be longer).

Also, as these certificates are not a product of the normal issuance process, the CA is not aware that they were created. Thus, the certificates cannot be revoked.

Note: the private key for ANY CA certificate in NTAuthCertificates (root or subordinate CA) can be used to forge certificates capable of authentication in the forest. If the certificate/key is from a subordinate CA, a legitimate CRL for verification of the certificate chain must be supplied.

ForgeCert uses the BouncyCastle’s X509V3CertificateGenerator to perform the forgeries. Command Line Usage

C:\Temp>ForgeCert.exe
ForgeCert 1.0.0.0
Copyright c 2021
ERROR(S):
Required option ‘CaCertPath’ is missing.
Required option ‘SubjectAltName’ is missing.
Required option ‘NewCertPath’ is missing.
Required option ‘NewCertPassword’ is missing.
–CaCertPath Required. CA private key as a .pfx or .p12 file
–CaCertPassword Password to the CA private key file
–Subject (Default: CN=User) Subject name in the certificate
–SubjectAltName Required. UPN of the user to authenticate as
–NewCertPath Required. Path where to save the new .pfx certificate
–NewCertPassword Required. Password to the .pfx file
–CRL ldap path to a CRL for the forged certificate
–help Display this help screen.
–version Display version information.

Usage

Note: for a complete walkthro[...]

Kali Linux Tutorials
Rdesktop : Open Source Client for Microsoft’s RDP protocol

Rdesktop is an open source client for Microsoft’s RDP protocol. It is known to work with Windows versions ranging from NT 4 Terminal Server to Windows 2012 R2 RDS. rdesktop currently has implemented the RDP version 4 and 5 protocols.

Installation

rdesktop uses a GNU-style build procedure. Typically all that is necessary to install rdesktop is the following:

% ./configure
% make
% make install

The default is to install under /usr/local. This can be changed by adding --prefix=<directoryto the configure line.

The smart-card support module uses PCSC-lite. You should use PCSC-lite 1.2.9 or later. To enable smart-card support in the rdesktop add --enable-smartcardto the configure line.

Note for users building from source

If you have retrieved a snapshot of the rdesktop source, you will first need to run ./bootstrapin order to generate the build infrastructure. This is not necessary for release versions of rdesktop.

Usage

Connect to an RDP server with:

% rdesktop server

where serveris the name of the Terminal Services machine. If you receive “Connection refused”, this probably means that the server does not have Terminal Services enabled, or there is a firewall blocking access.

You can also specify a number of options on the command line. These are listed in the rdesktop manual page (run man rdesktop).
Download

ugh of stealing a CA private key and forging auth certs, see DPERSIST1in the whitepaper.

Context:

* The stolen CA’s certificate is ca.pfx, encrypted with a password of Password123!* The subject is arbitrary since we’re specifying a subject alternative name for the certificate.
* The subject alternative name (i.e., the user we’re forging a certificate for), is localadmin@theshire.local.
* The forged certificate will be saved as localadmin.pfx, encrypted with the password NewPassword123!C:\Tools\ForgeCert>ForgeCert.exe –CaCertPath ca.pfx –CaCertPassword “Password123!” –Subject “CN=User” –SubjectAltName “localadmin@theshire.local” –NewCertPath localadmin.pfx –NewCertPassword “NewPassword123!”
CA Certificate Information:
Subject: CN=theshire-DC-CA, DC=theshire, DC=local
Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 1/4/2021 10:48:02 AM
End Date: 1/4/2026 10:58:02 AM
Thumbprint: 187D81530E1ADBB6B8B9B961EAADC1F597E6D6A2
Serial: 14BFC25F2B6EEDA94404D5A5B0F33E21
Forged Certificate Information:
Subject: CN=User
SubjectAltName: localadmin@theshire.local
Issuer: CN=theshire-DC-CA, DC=theshire, DC=local
Start Date: 7/26/2021 3:38:45 PM
End Date: 7/26/2022 3:38:45 PM
Thumbprint: C5789A24E91A40819EFF7CFD77150595F8B9878D
Serial: 3627A48F90F6869C3215FF05BC3B2E42
Done. Saved forged certificate to localadmin.pfx with the password ‘NewPassword123!’

This forgery can be done on an attacker-controlled system, and the resulting certificate can be used with Rubeus to request a TGT (and/or retrieve the user’s NTLM https://s.w.org/images/core/emoji/13.1.0/72x72/1f609.png

Defensive Considerations

The TypeRefHash of the current ForgeCert codebase is b26b451ff2c947ae5904f962e56facbb45269995fbb813070386472f307cfcf0.

The TypeLib GUID of ForgeCert is bd346689-8ee6-40b3-858b-4ed94f08d40a. This is reflected in the Yara rules currently in this repo.

See PREVENT1, DETECT3, and DETECT5in our whitepaper for prevention and detection guidance.

Fabian Bader published a great post on how to mitigate many uses of “Golden Certificates” through OSCP tweaks. Note thought that in the Final Thoughts section he mentions This method is not bulletproof at all. Since the attacker is in charge of the certificate creation process, she could just change the serial number to a valid one.This was implemented in his PR, though remember that by default the serial number will be randomized, meaning the OSCP prevention should work in many cases and is worth implementing in our opinion.

We believe there may opportunities to build Yara/other detection rules for types of forged certificates this project produces – if any defensive researchers find a good way to signature these files, please let us know and we will update the Yara rules/defensive guidance here. Reflections

There is a clear parallel between “Golden Tickets” (forged TGTs) and these “Golden Certificates” (forced AD CS certs). Both the krbtgt hash and CA private key are cryptographic material critical to the security of an Active Directory environment, and both can be used to forge authenticators for arbitrary users. However, while the krbtgt hash can be retrieved remotely over DCSync, a CA private key must (at least as far as we know) be recovered through code execution on the CA machine itself. While a krbtgt hash can be rotated relatively easily, rotating a CA private key is significantly more difficult.

On the subject of public disclosure, we self-embargoed the release of our offensive tooling (ForgeCert as well as Certify) for ~45 days after we published our whitepaper in order to give organizations a chance to get a grip on the issues surrounding Active Directory Certificate Services. However, we have found that organizations and vendors have historically often not fixed issues or built detections for “theoretical” att[...]

acks until someone proves something is possible with a proof of concept.

This is reflected in some people’s reaction to the research of this IS StUPId, oF COurse YoU Can FORge CERts WITH ThE ca PriVAtE KeY.To which we state, yes, many things are possible, but PoC||GTFODownload

Kali Linux Tutorials
Azur3Alph4 : A PowerShell Module That Automates Red-Team Tasks For Ops On Objective

Azur3Alph4 is a PowerShell module that automates red-team tasks for ops on objective. This module situates in a post-breach (RCE achieved) position. Token extraction and many other tools will not execute successfully without starting in this position. This module should be used for further enumeration and movement in a compromised app that is part of a managed identity.
Azur3Alph4 is currently in development. Modules are being worked on and updated. Most of this is still untested.

Scripts are in repo for individual use and easy identification, but the .psm1 file is what will be consistently updated.

Installation & Usage

Import-Module Azur3Alph4

Point the $envendpoint to cmd execution passing “env” to the Azure backend.

Updates – 8/10/2021

* Added Get-ResourceActions.ps1 and updated Azur3Alph4.psm1

Updates – 8/5/2021

* Made Azur3Alph4 modular
* Added Get-SubscriptionId function

Why This Was Built

* I built this because I wanted to learn more about both PowerShell and Azure, two things I’d definitely like to get better at.
* To help automate and eliminate a lot of repetitive PS commands.
* To build off my current knowledge of Azure red teaming

Function List

Get-Endpoint

Enumerates an Azure endpoint to verify whether or not it belongs to a managed identity

Get-ManagedIdentityToken

Grabs the Managed Identity Token from the endpoint using the extracted secret. Stores the value in a given variable

Connect-AzAccount

Takes a username and password variable and automates SecureString conversion and connects to an Azure account

Get-SubscriptionId

Gets the subscription ID using the REST API for Azure

Get-ManagedIdentityResources

Uses the subscription ID to enumerate all resources that are accessible

Get-ResourceActions.ps1

Enumerates all resources available using Azure token and lists permissions of each resource directly below it
Download

Kali Linux Tutorials
LinuxCatScale : Incident Response Collection And Processing Scripts With Automated Reporting Scripts

Linux CatScale is a bash script that uses live of the land tools to collect extensive data from Linux based hosts. The data aims to help DFIR professionals triage and scope incidents. An Elk Stack instance also is configured to consume the output and assist the analysis process.

Usage

This scripts were built to automate as much as possible. We recommend running it from an external device/usb to avoid overwriting evidence. Just in case you need a full image in future.

Please run the collection script on suspected hosts with sudo rights. fsecure_incident-response_linux_collector_0.7.sh the only file you need to run the collection.

user@suspecthost:$ chmod +x ./Cat-Scale.sh
user@suspecthost:$ sudo ./Cat-Scale.sh

The script will create a directory called “FSecure-out” in the working directory and should remove all artefacts after being compressed. This will leave a filename in the format of FSecure_Hostname-YYMMDD-HHMM.tar.gz

Once these are all aggregated and you have the FSecure_Hostname-YYMMDD-HHMM.tar.gzon the analysis machine. You can run Extract-Cat-Scale.sh which will extract all the files and place them in a folder called “extracted”.

user@analysishost:$ chmod +x ./Extract-Cat-Scale.sh
user@analysishost:$ sudo ./Extract-Cat-Scale.sh

Parsing

This project has predefined grok filters to ingest data into elastic, feel free to modify them as you need.

What does it collect?

This script will produce output and archive. Currently most up to date what it collects is covered in the blog post here: https://labs.f-secure.com/tools/cat-scale-linux-incident-response-collection/
Download

Kali Linux Tutorials
FUSE : A Penetration Testing Tool For Finding File Upload Bugs

FUSE is a penetration testing system designed to identify Unrestricted Executable File Upload (UEFU) vulnerabilities. The details of the testing strategy is in our paper, “FUSE: Finding File Upload Bugs via Penetration Testing”, which appeared in NDSS 2020. To see how to configure and execute FUSE, see the followings.

Setup

Install

FUSE currently works on Ubuntu 18.04 and Python 2.7.15.

* Install dependencies

#apt-get install rabbitmq-server
#apt-get install python-pip
#apt-get install git

* Clone and build FUSE

$ git clone https://github.com/WSP-LAB/FUSE
$ cd FUSE && pip install -r requirements.txt

If you plan to leverage headless browser verification using selenium, please install Chrome and Firefox web driver by refering selenium document.

Usage

Configuration

* FUSE uses a user-provided configuration file that specifies parameters for a target PHP application. The script must be filled out before testing a target Web application. You can check out README file and example configuration files.
* Configuration for File Monitor (Optional)

$ vim filemonitor.py
…
10 MONITOR_PATH=’/var/www/html/’ <-
11 MONITOR_PORT=20174 <-
12 EVENT_LIST_LIMITATION=8000 <-
…

Execution

* FUSE

$ python framework.py [Path of configuration file]

File Monitor

$ python filemonitor.py

* Result
* When FUSE completes the penetration testing, a [HOST] directory and a [HOST_report.txt] file are created.
* A [HOST] folder stores files that have been attempted to upload.
* A [HOST_report.txt] file contains test results and information related to files that trigger U(E)FU.
CVEs

If you find UFU and UEFU bugs and get CVEs by running FUSE, please send a PR for README.md
ApplicationCVEsElggCVE-2018-19172ECCube3CVE-2018-18637CMSMadeSimpleCVE-2018-19419, CVE-2018-18574CMSimpleCVE-2018-19062Concrete5CVE-2018-19146GetSimpleCMSCVE-2018-19420, CVE-2018-19421SubrionCVE-2018-19422OsCommerce2CVE-2018-18572, CVE-2018-18964, CVE-2018-18965, CVE-2018-18966MonstraCVE-2018-6383, CVE-2018-18694XEXEVE-2019-001

Download

Kali Linux Tutorials
BruteLoops : Protocol Agnostic Online Password Guessing API

BruteLoops is a dead simple library providing the foundational logic for efficient password brute force attacks against authentication interfaces.

See various Wiki sections for more information.

A “modular” example is included with the library that demonstrates how to use this package. It’s fully functional and provides multiple brute force modules. Below is a sample of its capabilities:

http.accellion_ftp Accellion FTP HTTP interface login module
http.basic_digest Generic HTTP basic digest auth
http.basic_ntlm Generic HTTP basic NTLM authentication
http.global_protect
Global Protect web interface
http.mattermost Mattermost login web interface
http.netwrix Netwrix web login
http.okta Okta JSON API
http.owa2010 OWA 2010 web interface
http.owa2016 OWA 2016 web interface
smb.smb Target a single SMB server
testing.fake Fake authentication module for training/testing

Key Features

* Protocol agnostic – If a callback can be written in Python, BruteLoops can be used to attack it
* SQLite support – All usernames, passwords, and credentials are maintained in an SQLite database.
* A companion utility (dbmanager.py) that creates and manages input databases accompanies BruteLoops

* Spray and Stuffing Attacks in One Tool – BruteLoops supports both spray and stuffing attacks in the same attack logic and database, meaning that you can configure a single database and run the attack without heavy reconfiguration and confusion.
* Guess scheduling – Each username in the SQLite database is configured with a timestamp that is updated after each authentication event. This means we can significantly reduce likelihood of locking accounts by scheduling each authentication event with precision.
* Fine-grained configurability to avoid lockout events – Microsoft’s lockout policies can be matched 1-to-1 using BruteLoop’s parameters:
* auth_threshold= Lockout Threshold
* max_auth_jitter= Lockout Observation Window
* Timestampes associated with each authentication event are tracked in BruteLoops’ SQLite database. Each username receives a distinct timestamp to assure that authentication events are highly controlled.

* Attack resumption – Stopping and resuming an attack is possible without worrying about losing your place in the attack or locking accounts.
* Multiprocessing – Speed up attacks using multiprocessing! By configuring the`parallel guess count, you’re effectively telling BruteLoops how many usernames to guess in parallel.
* Logging – Each authentication event can optionally logged to disk. This information can be useful during red teams by providing customers with a detailed attack timeline that can be mapped back to logged events.

Dependencies

BruteLoops requires Python3.7 or newer and SQLAlchemy 1.3.0, the latter of which can be obtained via pip and the requirements.txt file in this repository: python3.7 -m pip install -r requirements.txt

Installation

git clone https://github.com/arch4ngel/bruteloops
cd bruteloops
python3 -m pip install -r requirements.txt

How do I use this Damn Thing?

Jeez, alright already…we can break an attack down into a few steps:

* Find an attackable service
* If one isn’t already available in the example.py[1] directory, build a callback
* Find some usernames, passwords, and credentials
* Construct a database by passing the authentication data to dbmanager.py[2]
* If relevant, Enumerate or request the AD lockout policy to intelligently configure the attack
* Execute the attack in alignment with the target lockout policy[1][3][4]
Download

hacking: security in practice
Kali, Kismet, and a GPS dongle that doesn't want to update (but only with gpsd)

I've tried this on both KaliPi and Kali running in RHEL VMM.

I'm attempting to do a "wireless assesment survery" (ahem wardrive) using Kismet, but I'm having a weird GPS issue.

The dongle I'm using is this one, which has a U-Blox 7 under the hood.

Everything is detected correctly, gpsmon gives me wonderfully good data, with the lat/long dancing around in the bottom few digits as the accuracy comes down. Then I fired up gpsd with nothing more complex than a -n option and cgps shows a good 3d fix and tons of satellites while the NMEA data flies past underneath.

Cool. Went for a drive.

Came home and looked at the data, and wouldn't you know it - it was all geolocated at my house. The place I started Kismet.

I went back and looked at the cgps output and the lat/long wasn't changing. At all. Not even eight digits past the decimal. Rock steady. I did it again on a drive, looking at the location in cgps the whole time. Never changed.

I discovered that the location will update if you restart gpsd and then re-run cgps, but it gets "stuck" on the first fix after gpsd starts.

I've been pulling my hair out trying all manner of different settings in /etc/default/gpsd and searching through forums but nobody seems to be having this precise problem.

Any ideas? I would just assume the dongle is bad were it not for the super clean data coming through the tty into gpsmon.

submitted by /u/Do_Hard_Things
[link] [comments]

hacking: security in practice
Here is my IT blog, figured /r/hacking would enjoy the content.

submitted by /u/zenflow11
[link] [comments]

Analysis for CVE-2021–21233 (Google Chrome Heap Buffer Overflow)
https://medium.com/@abrar.slr722/analysis-for-cve-2021-21233-google-chrome-heap-buffer-overflow-d8778bf212b9?source=rss------bug_bounty-5

Out Of Bounds Write vulnerability existed in BlitFramebuffer method of WebGL API in Chromium based browsers.Continue reading on Medium » (https://medium.com/@abrar.slr722/analysis-for-cve-2021-21233-google-chrome-heap-buffer-overflow-d8778bf212b9?source=rss------bug_bounty-5)

Hacking on Medium
How to Hack a Simple JavaScript-driven Web Application

https://cdn-images-1.medium.com/max/655/1*T4OJi5689OVnDHouqTtT8g.png
The FLARE-ON capture the flag is, in my opinion, one of the most difficult online reverse engineering contests out there. I usually enter…

Continue reading on JavaScript in Plain English »