This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file is fully position independent code (=PIC), meaning that it can be treated like any shellcode. The execution of HandleKatz in memory has a very small footprint, as itself does not allocate any more executable memory and can therefore efficiently be combined with concepts such as (Phantom)DLL-Hollowing as described by @_ForrestOrr (https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing). This is in contrast to PIC PE loaders, such as Donut, SRDI or Reflective Loaders which, during PE loading, allocate more executable memory. Additionally, it makes use of a modified version of ReactOS MiniDumpWriteDumpA using direct system calls to write an obfuscated dump to disk. For detailed information please refer to the PDF file PICYourMalware.pdf in this repository.
Usage
make all to build HandleKatzPIC.exe, HandleKatz.bin and loader.exe Please note that different compiler (https://www.kitploit.com/search/label/Compiler) (versions) yield different results. This might produce a PE file with relocations. All tests were carried out using x86_64-w64-mingw32-gcc mingw-gcc version 11.2.0 (GCC). The produced PIC was successfully tested on: Windows 10 (https://www.kitploit.com/search/label/Windows%2010) Pro 10.0.17763. On other versions of windows, API hashes might differ. To use the PIC, cast a pointer to the shellcode in executable memory and call it according to the definition: DWORD handleKatz(BOOL b_only_recon, char* ptr_output_path, uint32_t pid, char* ptr_buf_output);
b_only_recon If set, HandleKatz will only enumerate suitable handles without dumping ptr_output_path Determines where the obfuscated dump will be written to pid What PID to clone a handle from ptr_buf_output A char pointer to which HandleKatz writes its internal output For deobfuscation (https://www.kitploit.com/search/label/Deobfuscation) of the dump file, the script Decoder.py can be used. Loader implements a sample loader for HandleKatz: loader.exe --pid:7331 --outfile:C:\Temp\dump.obfuscated

___________________________
@hacking_Attack
@Hacking_Video

Detection
As cloned handles are used along with modified ReactOS code, no ProcessAccess events can be observed on Lsass. However, ProcessAccess events on programs which hold a handle to Lsass can be observed. Defenders can monitor for ProcessAccess masks with set PROCESS_DUP_HANDLE (0x0040) to identify the usage of this tool.
Credits
Implementation by our @thefLinkk (https://twitter.com/thefLinkk), see C-To-Shellcode-Examples (https://github.com/thefLink/C-To-Shellcode-Examples) for more PIC examples. @Hasherezade (https://twitter.com/hasherezade) for tutorials (https://vxug.fakedoma.in/papers/VXUG/Exclusive/FromaCprojectthroughassemblytoshellcodeHasherezade.pdf) on the C-To-Shellcode concept @ParanoidNinja (https://twitter.com/NinjaParanoid) for tutorials (https://github.com/paranoidninja/PIC-Get-Privileges) on the C-To-Shellcode concept @_ForrestOrr (https://twitter.com/_ForrestOrr) for his amazing blogpost series (https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing) on memory artifacts @rookuu_ (https://twitter.com/rookuu_) for the idea to use ReactOS MiniDumpWriteDump Outflank (https://outflank.nl/) for documenting direct syscalls (https://www.kitploit.com/search/label/Syscalls) and their InlineWhispers (https://github.com/outflanknl/InlineWhispers) project React OS (https://reactos.org/) for the implementation of MiniDumpWriteDump Hilko Bengen (https://github.com/hillu) for improving the makefile

Download HandleKatz (https://github.com/codewhitesec/HandleKatz)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CRTP — Certified Red Team Professional Review

https://cdn-images-1.medium.com/max/2000/0*5TGOLOhK-yV3sVDD.png
In October 2021 I undertook and successfully passed the Certified Red Team Professional certification, which is offered by Pentester…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HACKERSPACE Greece

https://cdn-images-1.medium.com/max/750/1*Svhh27ExteU41IJpV_zAwA.jpeg
Το Conduit Labs HACKERSPACE είναι ένα project αξίας 80.000€ σε 700 τετραγωνικά μέτρα, πληρώς εξοπλισμένο για κάθε είδους project στη…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Journey of a Successful CPENT CEI — Belly Rachdianto

https://cdn-images-1.medium.com/max/1920/1*GKTgy88nhRCeeYbmxrXnNw.png
Scene 1

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Modern AppSec Tools Must Focus on Reducing Attackability, Not Chasing Bugs

https://cdn-images-1.medium.com/max/2600/0*fJA0APEZLyj8gIx7
Developers need findings with higher context, not additional findings, in order to make applications secure in today’s environment.

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
HandleKatz - PIC Lsass Dumper Using Cloned Handles

http://3.bp.blogspot.com/-7FeRyOlYzUU/YXMBfG-JenI/AAAAAAAAwdY/3vsmeE9xGxkvW6tzdULOaUnMOx7uoUchQCK4BGAYYCw/w640-h240/HandleKatz_1_HandleKatz-759940.png This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same.

It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file is fully position independent code (=PIC), meaning that it can be treated like any shellcode.

The execution of HandleKatz in memory has a very small footprint, as itself does not allocate any more executable memory and can therefore efficiently be combined with concepts such as (Phantom)DLL-Hollowing as described by @_ForrestOrr. This is in contrast to PIC PE loaders, such as Donut, SRDI or Reflective Loaders which, during PE loading, allocate more executable memory. Additionally, it makes use of a modified version of ReactOS MiniDumpWriteDumpA using direct system calls to write an obfuscated dump to disk.

For detailed information please refer to the PDF file PICYourMalware.pdf in this repository. Usage* make all to build HandleKatzPIC.exe, HandleKatz.bin and loader.exe

Please note that different compiler (versions) yield different results. This might produce a PE file with relocations.

All tests were carried out using x86_64-w64-mingw32-gcc mingw-gcc version 11.2.0 (GCC). The produced PIC was successfully tested on: Windows 10 Pro 10.0.17763. On other versions of windows, API hashes might differ.

To use the PIC, cast a pointer to the shellcode in executable memory and call it according to the definition: DWORD handleKatz(BOOL b_only_recon, char* ptr_output_path, uint32_t pid, char* ptr_buf_output); * b_only_recon If set, HandleKatz will only enumerate suitable handles without dumping
* ptr_output_path Determines where the obfuscated dump will be written to
* pid What PID to clone a handle from
* ptr_buf_output A char pointer to which HandleKatz writes its internal output

For deobfuscation of the dump file, the script Decoder.py can be used.

Loader implements a sample loader for HandleKatz: loader.exe --pid:7331 --outfile:C:\Temp\dump.obfuscated http://3.bp.blogspot.com/-7FeRyOlYzUU/YXMBfG-JenI/AAAAAAAAwdY/3vsmeE9xGxkvW6tzdULOaUnMOx7uoUchQCK4BGAYYCw/w640-h240/HandleKatz_1_HandleKatz-759940.png DetectionAs cloned handles are used along with modified ReactOS code, no ProcessAccess events can be observed on Lsass. However, ProcessAccess events on programs which hold a handle to Lsass can be observed.

Defenders can monitor for ProcessAccess masks with set PROCESS_DUP_HANDLE (0x0040) to identify the usage of this tool. Credits* Implementation by our @thefLinkk, see C-To-Shellcode-Examples for more PIC examples.
* @Hasherezade for tutorials on the C-To-Shellcode concept
* @ParanoidNinja for tutorials on the C-To-Shellcode concept
* @_ForrestOrr for his amazing blogpost series on memory artifacts
* @rookuu_ for the idea to use ReactOS MiniDumpWriteDump
* Outflank for documenting direct syscalls and their InlineWhispers project
* React OS for the implementation of MiniDumpWriteDump
* Hilko Bengen for improving the makefile Download HandleKatz

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cloud, Remote Work Will Change How IT Uses Vulnerability Scanners

Tenable added Raspberry Pi support to Nessus v10.0 to help security professionals conduct audits and assessments remotely.

Dark Reading: Attacks/Breaches
Risk Quantification: A Powerful Tool in Your Cyberthreat Defense Arsenal

Three ways that understanding your cyber-risk in real dollars can help your organization survive the threat of ransomware and other attacks.

Dark Reading: Attacks/Breaches
Valtix Delivers Free Cloud Security for Departmental, Development, and Test Applications

Company aims to make cloud network security more accessible to all organizations.

___________________________
@hacking_Attack
@Hacking_Video

#5 Get easy Bounty {How to Exploit xmlrpc.php }

Hello Cybersecurity Researchers, Again I’m here after a lot of texts received on my linkedin and instagram that when i launch my next…Continue reading on Medium »
Read more...

HandleKatz - PIC Lsass Dumper Using Cloned Handles

This tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same. It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file is fully position independent code (=PIC), meaning that it can be treated like any shellcode. The execution of HandleKatz in memory has a very small footprint, as itself does not allocate any more executable memory and can therefore efficiently be combined with concepts such as (Phantom)DLL-Hollowing as described by @_ForrestOrr. This is in contrast to PIC PE loaders, such as Donut, SRDI or Reflective Loaders which, during PE loading, allocate more executable memory. Additionally, it makes use of a modified version of ReactOS MiniDumpWriteDumpA using direct system calls to write an obfuscated dump to disk. For detailed information please refer to the PDF file PICYourMalware.pdf in this repository. Usage make all to build HandleKatzPIC.exe, HandleKatz.bin and loader.exe Please note that different compiler (versions) yield different results. This might produce a PE file with relocations. All tests were carried out using x86_64-w64-mingw32-gcc mingw-gcc version 11.2.0 (GCC). The produced PIC was successfully tested on: Windows 10 Pro 10.0.17763. On other versions of windows, API hashes might differ. To use the PIC, cast a pointer to the shellcode in executable memory and call it according to the definition: DWORD handleKatz(BOOL bonlyrecon, char* ptroutputpath, uint32t pid, char\* ptrbufoutput); b\only_recon If set, HandleKatz will only enumerate suitable handles without dumping ptr_output_path Determines where the obfuscated dump will be written to pid What PID to clone a handle from ptr_buf_output A char pointer to which HandleKatz writes its internal output For deobfuscation of the dump file, the script Decoder.py can be used. Loader implements a sample loader for HandleKatz: loader.exe --pid:7331 --outfile:C:\Temp\dump.obfuscated Detection As cloned handles are used along with modified ReactOS code, no ProcessAccess events can be observed on Lsass. However, ProcessAccess events on programs which hold a handle to Lsass can be observed. Defenders can monitor for ProcessAccess masks with set PROCESS_DUP_HANDLE (0x0040) to identify the usage of this tool. Credits Implementation by our @thefLinkk, see C-To-Shellcode-Examples for more PIC examples. @Hasherezade for tutorials on the C-To-Shellcode concept @ParanoidNinja for tutorials on the C-To-Shellcode concept @_ForrestOrr for his amazing blogpost series on memory artifacts @rookuu_ for the idea to use ReactOS MiniDumpWriteDump Outflank for documenting direct syscalls and their InlineWhispers project React OS for the implementation of MiniDumpWriteDump Hilko Bengen for improving the makefile Download HandleKatz
Read more...

___________________________
@hacking_Attack
@Hacking_Video

USD 1,337,133.7 Bug Bounty to Improve On-chain Security for the Cronos Ecosystem
https://medium.com/cronos-chain/usd-1-337-133-7-bug-bounty-to-improve-on-chain-security-for-the-cronos-ecosystem-50c78e40281a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

We are excited to announce a Cronos bug bounty program, with a maximum bounty of up to USD 1,337,133.7 sponsored by Blockchain accelerator…Continue reading on Cronos » (https://medium.com/cronos-chain/usd-1-337-133-7-bug-bounty-to-improve-on-chain-security-for-the-cronos-ecosystem-50c78e40281a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video