Deep Web
I use TOR in Brave. Is it necessary to use a incognito distro like Tails?

submitted by /u/UsuarioDaInternet
[link] [comments]

Hacking on Medium
This is how I bypassed Cortex XDR

https://cdn-images-1.medium.com/max/754/1*wpTx5UE1_AfRJBw39bG9-A.png
First of all, let me introduce myself, my name is Omri Baso, I'm 24 years old from Israel and I'm a red teamer and security researcher…

Continue reading on Medium »

hacking: security in practice
Challenge: How to edit a on original video and produce clips without evidence of tampering?

The Gist:

How would you create 2 clips from an original video source file and make it seem that those 2 new clips are originally from the same recording device (iPhone) and not edited and post-produced in anyway.

Scenario:

If you have a 2 minute video straight from your phone (iOS), and you need to split and trim it to produce two 30 second clips from source, how would you do it so that the videos produce seems original unedited files recorded from your phone and no one could tell it came from a single source file?

Trimming and splitting it and using file naming conventions used by IOS on the new files is not enough because it is not all just in the file name, correct?

1. I understand there is META DATA that may leave clues - right? So can we edit/spoof the meta data to make it seem as if the file was written by iOS phone and not a computer or video editing software?
2. The modified and created dates of the files will be suspicious. Say the original video was taken sept 01, 2021 between 9:00 to 9:02AM, i assume we need to alter the modified / created dates to match the original source accurately, right? Is this possible?
3. Scrub any signatures or traces of the computer and editing software used to edit and produce the clips.

I assume these are the 3 factors that needs top be covered, right? Is there any other factors to consider?

​

submitted by /u/remivato69
[link] [comments]

Hacking on Medium
My story : How I get started in Cyber Security & How can you…

https://cdn-images-1.medium.com/max/600/1*NVII6KbY6kVnXp1sPzte2Q.jpeg
Hi readers, hope everyone’s doing fine and learning something continuously. It’s been a while since I published my last article on Nmap…

Continue reading on Medium »

hacking: security in practice
How to get into ethical hacking without an IT background?

Been a dj/ techy all my life. Looking to make a couole changes, any help??

submitted by /u/Heavy_Revolution2973
[link] [comments]

hacking: security in practice
Getting better on CTFs

Hello all.

I've recently been paying more attention to Windows boxes and gaining system access on Windows as Windows machines are one of my weaker points but I want to apply my question to any system.

How do you guys learn? What makes you better? Any tips? Are reading writeups okay if you struggle?

submitted by /u/kebabogenerolas
[link] [comments]

Hacking on Medium
Gaming Industry Plagued by Hackers

https://cdn-images-1.medium.com/max/1920/1*XCiWmVIpkc8Em2RJYlUKsQ.jpeg
Given that the gaming industry continues to be plagued by hackers we felt it was time to address the very public attacks on several…

Continue reading on Medium »

Hacking on Medium
Så blir du hackad

https://cdn-images-1.medium.com/max/900/0*C7dX4v8v3u_ct8dK.jpg
Så blir du hackad — Nog finns det ett heroiskt sken över fenomenet med fingerfärdiga och datakunniga hackers. Detta bottnar förmodligen i…

Continue reading on Medium »

Black Hat Ethical Hacking
Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomwarePost Views: 147
Reading Time: 1 Minute
A new threat actor is hacking Microsoft Exchange servers and breaching corporate networks using the ProxyShell vulnerability to deploy the Babuk Ransomware.
The ProxyShell attacks against vulnerable Microsoft Exchange servers started several months ago, with LockFile and Conti being among the first ransomware groups to exploit them.

According to a report by researchers at Cisco Talos, a Babuk ransomware affiliate known as ‘Tortilla’ had joined the club in October, when the actor started using the ‘China Chopper’ web shell on breached Exchange servers.

The name Tortilla is based on malicious executables spotted in campaigns using the name Tortilla.exe. Starts with ExchangeThe Babuk ransomware attack starts with a DLL, or .NET executable dropped on the Exchange server using the ProxyShell vulnerability.

The Exchange IIS worker process w3wp.exe then executes this malicious payload to execute obfuscated PowerShell command that features endpoint protection bypassing, eventually invoking a web request to fetch a payload loader named ‘tortilla.exe.’

This loader will connect to ‘pastebin.pl’ and download a payload that is loaded into memory and injected into a NET Framework process, which ultimately encrypts the device with the Babuk Ransomware.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/stages.jpg
<figcaptionInfection chain diagram
Source: Cisco See Also: Complete Offensive Security and Ethical Hacking Course Although Cisco analysts found evidence of ProxyShell vulnerability exploitation in most infections, most notably the ‘China Chopper’ web shell, the telemetry data reflects a broad spectrum of attempted exploits.


More specifically, Tortilla followed these pathways to drop the DLL and .NET modules:

* Microsoft Exchange auto-discover server-side request forgery attempt
* Atlassian Confluence OGNL injection remote code execution attempt
* Apache Struts remote code execution attempt
* WordPress wp-config.php access via directory traversal attempt
* SolarWinds Orion authentication bypass attempt
* Oracle WebLogic Server remote command execution attempt
* Liferay arbitrary Java object deserialization attempt

As these attacks rely on patched vulnerabilities, it is strongly advised that all admins upgrade their servers to the latest versions to prevent them from being exploited in attacks. Using Babuk in new attacksBabuk Locker is a ransomware operation launched at the beginning of 2021 when it began targeting businesses and encrypting their data in double-extortion attacks.

After conducting an attack on the Washinton DC’s Metropolitan Police Department (MPD), and feeling the heat from U.S. law enforcement, the ransomware gang shut down their operation.

After the source code for the first version of Babuk and a builder were leaked on hacking forums, other threat actors began utilizing the ransomware to launch their own attacks.

It is unclear if Tortilla was an affiliate of Babuk back when the RaaS was active or if they just grabbed the strain’s source code when it came out to conduct new attacks.

However, as the ransom note used in these attacks ask for a low $10,000 in Monero, it is likely not conducted by the original Babuk operation, who demanded far larger ransomware in Bitcoin.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/ransom%20note.png
<figcaptio[...]

nTortilla’s ransom note
Source: Cisco
See Also: All Windows versions impacted by new LPE zero-day vulnerability Targeting the USAAlthough Talos researchers noticed some attacks in Germany, Thailand, Brazil, and the U.K., most of Tortilla’s targets are U.S.-based.

The I.P. address of the download server is located in Moscow, Russia, which could indicate the origin of these attacks, but there are no attribution conclusions in the report.

Also, the ‘pastebin.pl’ domain used for the unpacking stage has been previously abused by AgentTesla and FormBook distribution campaigns.
https://www.bleepstatic.com/images/news/u/1220909/ransomware/victim%20map.jpg
<figcaptionVictim heatmap
Source: Cisco
See Also: Offensive Security Tool: ZipExec While a decryptor was previously released for Babuk ransomware, it can only decrypt victims whose private keys were part of the source code leak.

Therefore, threat actors can continue to use the Babuk ransomware strain to launch their own operations, such as what we are seeing with the Tortilla threat actor.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks Source: www.bleepingcomputer.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Mekotio-Banking-Trojan-90x90.png Mekotio Banking Trojan Resurges with Tweaked Code, Stealthy Campaign1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/GitLab-90x90.jpg Over 30,000 GitLab servers still unpatched against critical bug2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/trojan-source-invisible-vulnerabilities-in-most-code-showcase_image-7-a-17833-90x90.jpg ‘Trojan Source’ attack method can hide bugs into open-source code3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-4-90x90.jpg Chaos ransomware targets gamers via fake Minecraft alt lists4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png All Windows versions impacted by new LPE zero-day vulnerability1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/social_preview-scaled-90x90.jpg Sensitive data of 400,000 German students exposed by API flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/hacked-90x90.jpg Brutal WordPress plugin bug allows subscribers to wipe sites1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-5-90x90.jpg Hackers used billing software zero-day to deploy ransomware1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/ezgif.com-gif-maker-4-90x90.jpg Popular NPM library hijacked to install password-stealers, miners2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/youtube-logo-90x90.jpg Massive campaign uses YouTube to push password-stealing malware2 weeks ago
The post Microsoft Exchange ProxyShell exploits used to deploy Babuk ransomware first appeared on Black Hat Ethical Hacking.

PyRDP - RDP Monster-In-The-Middle (Mitm) And Library For Python With The Ability To Watch Connections Live Or After The Fact
http://www.kitploit.com/2021/11/pyrdp-rdp-monster-in-middle-mitm-and.html

PyRDP is a Python Remote Desktop Protocol (https://www.kitploit.com/search/label/Remote%20Desktop%20Protocol) (RDP) Monster-in-the-Middle (MITM) tool and library.
It features a few tools: RDP Monster-in-the-Middle Logs credentials used when connecting Steals data copied to the clipboard Saves a copy of the files transferred over the network Crawls shared drives in the background and saves them locally Saves replays of connections so you can look at them later Runs console commands or PowerShell payloads automatically on new connections RDP Player: See live RDP connections coming from the MITM View replays of RDP connections Take control of active RDP sessions while hiding your actions List the client's mapped drives and download files from them during active sessions RDP Certificate Cloner: Create a self-signed X509 certificate with the same fields as an RDP server's certificate PyRDP was introduced in 2018 (https://www.gosecure.net/blog/2018/12/19/rdp-man-in-the-middle-smile-youre-on-camera) in which we demonstrated that we can catch a real threat actor in action (https://www.youtube.com/watch?v=eB7RC9FmL6Q). This tool is being developed with both pentest and malware research use cases in mind.

Supported Systems
PyRDP should work on Python 3.6 and up on the x86-64, ARM and ARM64 platforms. This tool has been tested to work on Python 3.6 on Linux (Ubuntu 18.04), Raspberry Pi (https://www.kitploit.com/search/label/Raspberry%20Pi) and Windows (see section Installing on Windows (https://github.com/GoSecure/pyrdp#installing-on-windows)). It has not been tested on macOS.
Installing

Using the Docker Image
This is the easiest installation method if you have docker installed and working. docker pull gosecure/pyrdp:latest
As an alternative we have a slimmer image without the GUI and ffmpeg dependencies. This is the only provided image on ARM platforms. docker pull gosecure/pyrdp:latest-slim
You can find the list of all our Docker images on the gosecure/pyrdp DockerHub page (https://hub.docker.com/r/gosecure/pyrdp/tags).
From Git Source
We recommend installing PyRDP in a virtual environment (https://packaging.python.org/guides/installing-using-pip-and-virtual-environments/) to avoid dependency issues. First, make sure to install the prerequisite packages (on Ubuntu). We provide two types of installs a full one and a slim one. Install the dependencies according to your use case. # Full install (GUI, transcoding to MP4)
sudo apt install python3 python3-pip python3-dev python3-setuptools python3-venv \
build-essential python3-dev git openssl \
libdbus-1-dev libdbus-glib-1-dev libgl1-mesa-glx \
notify-osd dbus-x11 libxkbcommon-x11-0 libxcb-xinerama0 \
libavformat-dev libavcodec-dev libavdevice-dev \
libavutil-dev libswscale-dev libswresample-dev libavfilter-dev

# Slim install (no GUI, no transcoding)
sudo apt install python3 python3-pip python3-setuptools python3-venv \
build-essential python3-dev git openssl
Grab PyRDP's source code: git clone https://github.com/gosecure/pyrdp.git
Then, create your virtual environment in the venv directory inside PyRDP's directory: cd pyrdp
python3 -m venv venv
DO NOT use the root PyRDP directory for the virtual environment folder (python3 -m venv .). You will make a mess, and using a directory name like venv is more standard anyway. Before installing the dependencies, you need to activate your virtual environment: source venv/bin/activate
Finally, you can install the project with Pip: pip3 install -U pip setuptools wheel

# Without GUI and ffmpeg dependencies
pip3 install -U -e .

# With GUI and ffmpeg dependencies
pip3 install -U -e '.[full]'
This should install the dependencies required to run PyRDP. If you choose to install without GUI or ffmpeg dependencies, it will not be possible to use pyrdp-player without headless mode (--headless) or pyrdp-convert. If you ever want to leave your virtual environment, you can simply deactivate it: deactivate
Note that you will have to activate your environment every time you want to have the PyRDP scripts available as shell commands.
Installing on Windows
The steps are almost the same. There are two additional prerequisites. Any C compiler OpenSSL (https://wiki.openssl.org/index.php/Binaries). Make sure it is reachable from your $PATH. Then, create your virtual environment in PyRDP's directory: cd pyrdp
python3 -m venv venv
DO NOT use the root PyRDP directory for the virtual environment folder (python3 -m venv .). You will make a mess, and using a directory name like venv is more standard anyway. Before installing the dependencies, you need to activate your virtual environment: venv\Scripts\activate
Finally, you can install the project with Pip: pip3 install -U pip setuptools wheel
pip3 install -U -e ".[full]"
This should install all the dependencies required to run PyRDP. If you ever want to leave your virtual environment, you can simply deactivate it: deactivate
Note that you will have to activate your environment every time you want to have the PyRDP scripts available as shell commands.
Building the Docker Image

First of all, build the image by executing this command at the root of PyRDP (where Dockerfile is located): docker build -t pyrdp .
As an alternative we have a slimmer image without the GUI and ffmpeg dependencies: docker build -f Dockerfile.slim -t pyrdp .
Afterwards, you can execute PyRDP by invoking the pyrdp docker container. See Usage instructions (https://github.com/GoSecure/pyrdp#using-pyrdp) and the Docker specific instructions (https://github.com/GoSecure/pyrdp#docker-specific-usage-instructions) for details. Cross-platform builds can be achieved using buildx: docker buildx build --platform linux/arm,linux/amd64 -t pyrdp -f Dockerfile.slim .

Migrating away from pycrypto
Since pycrypto isn't maintained anymore, we chose to migrate to pycryptodome. If you get this error, it means that you are using the module pycrypto instead of pycryptodome. from Crypto.PublicKey.RSA import RsaKey ImportError: cannot import name 'RsaKey' ">[...]
File "[...]/pyrdp/pyrdp/pdu/rdp/connection.py", line 10, in
from Crypto.PublicKey.RSA import RsaKey
ImportError: cannot import name 'RsaKey'
You will need to remove the module pycrypto and reinstall PyRDP. pip3 uninstall pycrypto
pip3 install -U -e .

Using PyRDP

Using the PyRDP Monster-in-the-Middle
Use pyrdp-mitm.py or pyrdp-mitm.py : to run the MITM. Assuming you have an RDP server running on 192.168.1.10 and listening on port 3389, you would run: pyrdp-mitm.py 192.168.1.10
When running the MITM for the first time on Linux, a private key and certificate should be generated for you in ~/.config/pyrdp. These are used when TLS security is used on a connection. You can use them to decrypt PyRDP traffic in Wireshark, for example.
Specifying the private key and certificate
If key generation didn't work or you want to use a custom key and certificate, you can specify them using the -c and -k arguments: pyrdp-mitm.py 192.168.1.10 -k private_key.pem -c certificate.pem

Connecting to the PyRDP player
If you want to see live RDP connections through the PyRDP player, you will need to specify the ip and port on which the player is listening using the -i and -d arguments. Note: the port argument is optional, the default port is 3000. pyrdp-mitm.py 192.168.1.10 -i 127.0.0.1 -d 3000

Connecting to a PyRDP player when the MITM is running on a server
If you are running the MITM on a server and still want to see live RDP connections, you should use SSH remote port forwarding (https://www.booleanworld.com/guide-ssh-port-forwarding-tunnelling/) to forward a port on your server to the player's port on your machine. Once this is done, you pass 127.0.0.1 and the forwarded port as arguments to the MITM. For example, if port 4000 on the server is forwarded to the player's port on your machine, this would be the command to use: pyrdp-mitm.py 192.168.1.10 -i 127.0.0.1 -d 4000

Running payloads on new connections
PyRDP has support for running console commands or PowerShell payloads automatically when new connections are made. Due to the nature of RDP, the process is a bit hackish and is not always 100% reliable. Here is how it works: Wait for the user to be authenticated. Block the client's input / output to hide the payload and prevent interference. Send a fake Windows+R sequence and run cmd.exe. Run the payload as a console command and exit the console. If a PowerShell payload is configured, it is run with powershell -enc . Wait a bit to allow the payload to complete. Restore the client's input / output. For this to work, you need to set 3 arguments: the payload the delay before the payload starts the payload's duration
Setting the payload
You can use one of the following arguments to set the payload to run: --payload, a string containing console commands --payload-powershell, a string containing PowerShell commands --payload-powershell-file, a path to a PowerShell script
Choosing when to start the payload