Hacking on Medium
Sunset1: Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/746/0*6RXkeMt-BxiPr8t9.png
Merhabalar,

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack The Box: Impossible Password Reverse Engineering Challenge

https://cdn-images-1.medium.com/max/655/0*mTnS5LlyKPF3Vp6g
This week I’m going to be completing the impossible password reverse engineering challenge from Hack The Box. This challenge is ranked…

Continue reading on TestingOnProd »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ADLab - Custom PowerShell Module To Setup An Active Directory Lab Environment To Practice Penetration Testing

https://blogger.googleusercontent.com/img/a/AVvXsEgXmtgNezfGhzNghppnMEKs3PxCeR8g1kRECDwULkfVOmzWi45WZjZ1Wdr4-MCIitjAwf8wavmb5s6RX1fFS9318IbTmosRcrVKSDxgOevNEQnzK5sff3TJy2wvuO6WaMPpmzsL26PQU-MmEYR560NcuBPOLcVzr-P9wX6WJl9hu6LNDj9vqtJdzoL-rw=w640-h314 The purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing.

Credits to Joe Helle and his PowerShell for Pentesters course regarding the generation of the attack vectors. InstructionsPreparationOptional but recommended: Move Module into PSModulePath# Display PSModulePath
$env:PSModulePath.split(";")

# Move module to path
Move-Item .\ADLab\ "C:\Windows\system32\WindowsPowerShell\v1.0\Modules\"Import-Module# Import global module
Import-Module ADLab

# Import local module
Import-Module .\ADLab.psm1Initial Lab SetupInvoke-DCPrepThis function prepares the current VM/computer to be used as a domain controller for the new forest. It sets a static IP address, sets the DNS server to be the localhost and renames the computer. # Prepare the current VM with all default values while displaying verbose output
Invoke-DCPrep -Verbose

# Set custom hostname and use Google DNS for Internet access
Invoke-DCPrep -Hostname "DC" -NewIPv4DNSServer "8.8.8.8"

# Use custom IP and default gateway and display verbose output
Invoke-DCPrep -Verbose -NewIPv4Address "192.168.1.99" -NewIPv4Gateway "192.168.1.1"Invoke-ForestDeployThe function installs the AD DS feature and sets up a new Active Directory forest, without requiring any user input. Restarts the computer upon completion. # Installs a new forest with FQDN of "bufu-sec.local" with default DSRM password of "Password!"
Invoke-ForestDeploy -Domain bufu-sec.local

# Installs a new forest with FQDN of "bufu-sec.local" with the DSRM password set to "P@ssword!" and displaying debug messages
Invoke-ForestDeploy -Domain "bufu-sec.local" -DSRMPassword "P@ssword!" -VerboseInvoke-DNSDeployThe function begins by installing the DNS feature. It then adds the primary zone and configures the server forwarder. # Install and configure DNS on the current host and display verbose output.
Invoke-DNSDeploy -Verbose -NetworkID 192.168.47.0/24 -ZoneFile "192.168.47.2.in-addr.arpa.dns" -ServerForwarder 1.1.1.1Invoke-DHCPDeployThe function begins by installing the DHCP feature on the current machine. It then adds the necesarry security groups and authorizes the new DHCP server with the domain controller. Finally, it configures the new DHCP scope with the supplied values. # Install and configure DHCP on the local DC.
Invoke-DHCPDeploy -Verbose -ScopeName "Default" -ScopeID 192.168.47.0 -StartIP 192.168.47.100 -EndIP 192.168.47.200 -SubnetMask 255.255.255.0 -DNSServer 192.168.47.10 -Router 192.168.47.10

# Install and configure DHCP on the specified DC.
Invoke-DHCPDeploy -Verbose -ScopeName "Default" -ScopeID 192.168.47.0 -StartIP 192.168.47.100 -EndIP 192.168.47.200 -SubnetMask 255.255.255.0 -DNSServer 192.168.47.10 -Router 192.168.47.10 -DCFQDN DC01.bufu-sec.localContentInvoke-ADLabFillThe function begins by creating the groups and OUs defined in the global Groups variable. It then generates 10 user objects for each OU by default. # Fill forest with objects and display verbose output
Invoke-ADLabConfig -Verbose

# Create 50 users for each OU and display verbose output
Invoke-ADLabConfig -Verbose -UserCount 50Attack VectorsSet-ASREPRoastingThe function gets a certain amount of random user from the domain and sets the DoesNotRequirePreAuth flag for ea[...]

ch. Excludes default accounts like Administrator and krbtgt. Makes 5% of users ASREP-Roastable by default. # Make 5% of users ASREP-Roastable and display verbose output
Set-ASREPRoasting -Verbose

# Make 10 random users in the domain ASREP-Roastable
Set-ASREPRoasting -VulnerableUsersCount 10

# Make user bufu ASREP-Roastable and display verbose output
Set-ASREPRoasting -Users bufu -Verbose

# Make supplied list of users ASREP-roastable and display verbose output
Set-ASREPRoasting -Users ("bufu", "pepe") -VerboseSet-KerberoastingThe function gets a certain amount of random user from the domain and adds a SPN for each. Excludes default accounts like Administrator and krbtgt. Makes 5% of users kerberoastable by default. # Make 5% of users ASREP-Roastable and display verbose output
Set-Kerberoasting -Verbose

# Make 10 random users in the domain ASREP-Roastable
Set-Kerberoasting -VulnerableUsersCount 10

# Make user bufu ASREP-Roastable and display verbose output
Set-Kerberoasting -Users bufu -Verbose

# Make supplied list of users ASREP-roastable and display verbose output
Set-Kerberoasting -Users ("bufu", "pepe") -VerboseSet-BadACLsThe function begins by granting the Chads group GenericAll rights on the Domain Admins. It then grants the Degens group GenericALl rights on the Chads group. Finally, it grants GenericAll rights on some users from the Degens group to some users of the Normies group.

vulnerable ACLs and display verbose output Set-BadACLs -Verbose "># Create vulnerable ACLs and display verbose output
Set-BadACLs -Verbose Set-PSRemotingThe function first configures GPO to allow WinRM over TCP port 5985 to domain-joined systems. It then enables PS Remoting through GPO. # Enable PS Remoting and display verbose output
Set-PSRemoting -VerboseDownload ADLab

Dark Reading: Attacks/Breaches
Female-Founded Cybersecurity Startup Wabbi Raises Over $2M in Seed Funding

Wabbi enables companies to assimilate application security processes into development pipelines to produce and scale application security across enterprises.

Dark Reading: Attacks/Breaches
China Hosts More Malware Than Russia: Findings from DNSFilter's 2021 Domain Threat Report

Cryptomining has also had a resurgence over the last year as blockchain technology and NFTs rise in popularity.

Dark Reading: Attacks/Breaches
Microsoft Expands Security to AWS in Multicloud Push

Microsoft will expand its cloud security tools to AWS within a suite called Defender for Cloud and launch a new Defender for Business in preview later this month.

Dark Reading: Attacks/Breaches
Laika Raises $35M Series B to Help Companies Prepare for Security Audits

Laika helps companies establish robust compliance practices to meet the strict requirements from regulators and enterprise customers.

Dark Reading: Attacks/Breaches
FBI: Ransomware Actors Use Financial Events to Extort Victims

Attackers research financial information about an organization and threaten to disclose it if they don't receive ransom quickly.

Dark Reading: Attacks/Breaches
44% of Parents Struggle to Follow Tech Rules They Set for Their Kids

Parents perceive norms of behavior to be different for themselves and their children, according to Kaspersky..

Dark Reading: Attacks/Breaches
Attackers Flaunt Remote Access Credentials, Threaten Supply Chain

Attackers advertise access to computers within shipping and logistics companies as the global supply chain struggles to meet post-COVID demands.

Dark Reading: Attacks/Breaches
Vaultree Raises $3.3M for Encryption Solution

The company's platform uses Enhanced Searchable Symmetric Encryption (ESSE) and Fully Homomorphic Encryption (FHE) technologies.