good idea of which version your instances are running and if the service is enabled or disabled, you will be able to make a much more defined action plan for hardening the service. Note that you can find specific meaning to every metadata option that is set here.

Step 2

One of the areas that should be evaluated when making the switch to v2 of the service is the use of IAM roles. Metabadger lets you identify instances in a region that may already be using an IAM role. The discover-role-usagecommand will output a list of instances that have roles attached to them. If you have a lot of instances using roles, you should take precaution when updating the service to v2 to ensure the overall functionality of your workloads does not become impacted.

Step 3

Upon completion of doing your initial discovery and evaluation, you can now create a staged approach to hardening your compute infrastructure to use either v2 of the metadata service or disable it where it may not be used. The harden-metadatacommand allows you to update all instances in a particular region by default. You can also pass instance tags using the --tagsflag or an input file containing a csv of instances that you would like to apply a configuration for. Once you have made the appropriate updates to v2 and disabled the service where it is not used you can re-evaluate using the items in Step 1 to confirm your environment is locked down. If you have certain instances that you don’t want to update you can exlude them via the --exclusionflag by tag or instance id. Requirements

Metabadger requires an IAM role or credentials with the following permission:

ec2:ModifyInstanceAttribute
ec2:DescribeInstances

When making changes to the Instance Metadata service, you should be cautious and follow additional guidance from AWS on how to safely upgrade to version 2. Metabadger was designed to assist you with this process to further secure your compute infrastructure in AWS.

AWS Best Practice Guide on Updating to IMDSv2 Usage & Installation

Install via pip

pip3 install –user metabadger

Install via Github

$ git clone https://github.com/salesforce/metabadger
$ cd metabadger
$ pip install -e .
$ metabadger
Usage: metabadger [OPTIONS] COMMAND [ARGS]…
Metabadger is an AWS Security Tool used for discovering and hardening the
Instance Metadata service.
Options:
–version Show the version and exit.
–help Show this message and exit.
Commands:
disable-metadata Disable the IMDS service on EC2 instances
discover-metadata Discover summary of IMDS service usage within EC2
discover-role-usage Discover summary of IAM role usage for EC2
harden-metadata Harden the AWS instance metadata service from v1 to v2

Commands

discover-metadata

A summary of your overall instance metadata service usage including which version and an overall enforcement percentage. Using these numbers will help you understand the overall posture of how hardened your metadata usage is and where you’re enforcing v2 vs v1.

Options:
-a, –all-region Provide a metadata summary for all available regions in the AWS account
-j, –json Get metadata summary in JSON format
-r, –region TEXT Specify which AWS region you will perform this command in
-p, –profile TEXT Specify the AWS IAM profile.

discover-role-usage

A summary of instances and the roles that they are using, this will give you a good idea of the caution you must take when making updates to the metadata service itself.

Options:
-p, –profile TEXT Specify the AWS IAM profile.
-r, –region TEXT Specify which AWS region you will perform this command in

harden-metadata

The ability to modify the instances to use either metadata v1 or v2 and to get an understanding of how many instances would be modified by running a dry run mode.

Options:
-a, –all-region Update IMDS across all regions in your account
-e, –exclusion The exclusion flag will apply t[...]

___________________________
@hacking_Attack
@Hacking_Video

o everything besides what is specified, tags or instances
-d, –dry-run Dry run of hardening metadata changes
-v1, –v1 Enforces v1 of the metadata service
-i, –input-file PATH Path of csv file of instances to harden IMDS for
-t, –tags TEXT A comma seperated list of tags to apply the hardening setting to
-r, –region TEXT Specify which AWS region you will perform this command in
-p, –profile TEXT Specify the AWS IAM profile.

disable-metadata

Use this command to completely disable the metadata servie on instances

Options:
-e, –exclusion The exclusion flag will apply to everything besides what is specified, tags or instances
-d, –dry-run Dry run of disabling the metadata service
-i, –input-file PATH Path of csv file of instances to disable IMDS for
-t, –tags TEXT A comma seperated list of tags to apply the hardening setting to
-r, –region TEXT Specify which AWS region you will perform this command in
-p, –profile TEXT Specify the AWS IAM profile.

Logging

All changes made by Metabadger will be logged to a file saved in the working directory called metabadger.log. The file will include the following for every action that the tool takes when it changes the metadata service:

* The time and date stamp for when a change was made
* Change that occured (disabled, hardened, or updated)
* The instance ID where the change was made
* Dry run information
* A status on if the change was successful or not Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Disallowing CAP_NET_RAW Capability for Root User using AppArmor

Is root the ultimate user in Linux? You will get the answer to this question in a post by confining the cap_net_raw for ping command using AppArmor

https://tbhaxor.com/disallowing-cap_net_raw-capability-for-root-user-using-apparmor/

submitted by /u/tbhaxor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

HandleKatz - PIC Lsass Dumper Using Cloned Handles
http://www.kitploit.com/2021/11/handlekatz-pic-lsass-dumper-using.html

___________________________
@hacking_Attack
@Hacking_Video

This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file is fully position independent code (=PIC), meaning that it can be treated like any shellcode. The execution of HandleKatz in memory has a very small footprint, as itself does not allocate any more executable memory and can therefore efficiently be combined with concepts such as (Phantom)DLL-Hollowing as described by @_ForrestOrr (https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing). This is in contrast to PIC PE loaders, such as Donut, SRDI or Reflective Loaders which, during PE loading, allocate more executable memory. Additionally, it makes use of a modified version of ReactOS MiniDumpWriteDumpA using direct system calls to write an obfuscated dump to disk. For detailed information please refer to the PDF file PICYourMalware.pdf in this repository.
Usage
make all to build HandleKatzPIC.exe, HandleKatz.bin and loader.exe Please note that different compiler (https://www.kitploit.com/search/label/Compiler) (versions) yield different results. This might produce a PE file with relocations. All tests were carried out using x86_64-w64-mingw32-gcc mingw-gcc version 11.2.0 (GCC). The produced PIC was successfully tested on: Windows 10 (https://www.kitploit.com/search/label/Windows%2010) Pro 10.0.17763. On other versions of windows, API hashes might differ. To use the PIC, cast a pointer to the shellcode in executable memory and call it according to the definition: DWORD handleKatz(BOOL b_only_recon, char* ptr_output_path, uint32_t pid, char* ptr_buf_output);
b_only_recon If set, HandleKatz will only enumerate suitable handles without dumping ptr_output_path Determines where the obfuscated dump will be written to pid What PID to clone a handle from ptr_buf_output A char pointer to which HandleKatz writes its internal output For deobfuscation (https://www.kitploit.com/search/label/Deobfuscation) of the dump file, the script Decoder.py can be used. Loader implements a sample loader for HandleKatz: loader.exe --pid:7331 --outfile:C:\Temp\dump.obfuscated

___________________________
@hacking_Attack
@Hacking_Video

Detection
As cloned handles are used along with modified ReactOS code, no ProcessAccess events can be observed on Lsass. However, ProcessAccess events on programs which hold a handle to Lsass can be observed. Defenders can monitor for ProcessAccess masks with set PROCESS_DUP_HANDLE (0x0040) to identify the usage of this tool.
Credits
Implementation by our @thefLinkk (https://twitter.com/thefLinkk), see C-To-Shellcode-Examples (https://github.com/thefLink/C-To-Shellcode-Examples) for more PIC examples. @Hasherezade (https://twitter.com/hasherezade) for tutorials (https://vxug.fakedoma.in/papers/VXUG/Exclusive/FromaCprojectthroughassemblytoshellcodeHasherezade.pdf) on the C-To-Shellcode concept @ParanoidNinja (https://twitter.com/NinjaParanoid) for tutorials (https://github.com/paranoidninja/PIC-Get-Privileges) on the C-To-Shellcode concept @_ForrestOrr (https://twitter.com/_ForrestOrr) for his amazing blogpost series (https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing) on memory artifacts @rookuu_ (https://twitter.com/rookuu_) for the idea to use ReactOS MiniDumpWriteDump Outflank (https://outflank.nl/) for documenting direct syscalls (https://www.kitploit.com/search/label/Syscalls) and their InlineWhispers (https://github.com/outflanknl/InlineWhispers) project React OS (https://reactos.org/) for the implementation of MiniDumpWriteDump Hilko Bengen (https://github.com/hillu) for improving the makefile

Download HandleKatz (https://github.com/codewhitesec/HandleKatz)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CRTP — Certified Red Team Professional Review

https://cdn-images-1.medium.com/max/2000/0*5TGOLOhK-yV3sVDD.png
In October 2021 I undertook and successfully passed the Certified Red Team Professional certification, which is offered by Pentester…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HACKERSPACE Greece

https://cdn-images-1.medium.com/max/750/1*Svhh27ExteU41IJpV_zAwA.jpeg
Το Conduit Labs HACKERSPACE είναι ένα project αξίας 80.000€ σε 700 τετραγωνικά μέτρα, πληρώς εξοπλισμένο για κάθε είδους project στη…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Journey of a Successful CPENT CEI — Belly Rachdianto

https://cdn-images-1.medium.com/max/1920/1*GKTgy88nhRCeeYbmxrXnNw.png
Scene 1

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Modern AppSec Tools Must Focus on Reducing Attackability, Not Chasing Bugs

https://cdn-images-1.medium.com/max/2600/0*fJA0APEZLyj8gIx7
Developers need findings with higher context, not additional findings, in order to make applications secure in today’s environment.

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
HandleKatz - PIC Lsass Dumper Using Cloned Handles

http://3.bp.blogspot.com/-7FeRyOlYzUU/YXMBfG-JenI/AAAAAAAAwdY/3vsmeE9xGxkvW6tzdULOaUnMOx7uoUchQCK4BGAYYCw/w640-h240/HandleKatz_1_HandleKatz-759940.png This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same.

It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file is fully position independent code (=PIC), meaning that it can be treated like any shellcode.

The execution of HandleKatz in memory has a very small footprint, as itself does not allocate any more executable memory and can therefore efficiently be combined with concepts such as (Phantom)DLL-Hollowing as described by @_ForrestOrr. This is in contrast to PIC PE loaders, such as Donut, SRDI or Reflective Loaders which, during PE loading, allocate more executable memory. Additionally, it makes use of a modified version of ReactOS MiniDumpWriteDumpA using direct system calls to write an obfuscated dump to disk.

For detailed information please refer to the PDF file PICYourMalware.pdf in this repository. Usage* make all to build HandleKatzPIC.exe, HandleKatz.bin and loader.exe

Please note that different compiler (versions) yield different results. This might produce a PE file with relocations.

All tests were carried out using x86_64-w64-mingw32-gcc mingw-gcc version 11.2.0 (GCC). The produced PIC was successfully tested on: Windows 10 Pro 10.0.17763. On other versions of windows, API hashes might differ.

To use the PIC, cast a pointer to the shellcode in executable memory and call it according to the definition: DWORD handleKatz(BOOL b_only_recon, char* ptr_output_path, uint32_t pid, char* ptr_buf_output); * b_only_recon If set, HandleKatz will only enumerate suitable handles without dumping
* ptr_output_path Determines where the obfuscated dump will be written to
* pid What PID to clone a handle from
* ptr_buf_output A char pointer to which HandleKatz writes its internal output

For deobfuscation of the dump file, the script Decoder.py can be used.

Loader implements a sample loader for HandleKatz: loader.exe --pid:7331 --outfile:C:\Temp\dump.obfuscated http://3.bp.blogspot.com/-7FeRyOlYzUU/YXMBfG-JenI/AAAAAAAAwdY/3vsmeE9xGxkvW6tzdULOaUnMOx7uoUchQCK4BGAYYCw/w640-h240/HandleKatz_1_HandleKatz-759940.png DetectionAs cloned handles are used along with modified ReactOS code, no ProcessAccess events can be observed on Lsass. However, ProcessAccess events on programs which hold a handle to Lsass can be observed.

Defenders can monitor for ProcessAccess masks with set PROCESS_DUP_HANDLE (0x0040) to identify the usage of this tool. Credits* Implementation by our @thefLinkk, see C-To-Shellcode-Examples for more PIC examples.
* @Hasherezade for tutorials on the C-To-Shellcode concept
* @ParanoidNinja for tutorials on the C-To-Shellcode concept
* @_ForrestOrr for his amazing blogpost series on memory artifacts
* @rookuu_ for the idea to use ReactOS MiniDumpWriteDump
* Outflank for documenting direct syscalls and their InlineWhispers project
* React OS for the implementation of MiniDumpWriteDump
* Hilko Bengen for improving the makefile Download HandleKatz

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cloud, Remote Work Will Change How IT Uses Vulnerability Scanners

Tenable added Raspberry Pi support to Nessus v10.0 to help security professionals conduct audits and assessments remotely.

Dark Reading: Attacks/Breaches
Risk Quantification: A Powerful Tool in Your Cyberthreat Defense Arsenal

Three ways that understanding your cyber-risk in real dollars can help your organization survive the threat of ransomware and other attacks.