Hi. In this write up, i will be showing you, how to hack games by editing the memory with cheat engine and will also write a program in…Continue reading on Medium » (https://noob3xploiter.medium.com/game-hacking-with-python-and-cheat-engine-5000369e27b9?source=rss------bug_bounty-5)
Black Hat Ethical Hacking
Microsoft patches Excel zero-day used in attacks, asks Mac users to wait
Microsoft patches Excel zero-day used in attacks, asks Mac users to wait
Black Hat Ethical Hacking
Microsoft patches Excel zero-day used in attacks, asks Mac users to wait | Black Hat Ethical Hacking
Microsoft warned admins today to immediately patch a high severity Exchange Server vulnerability that may allow authenticated attackers to execute code remotely on vulnerable servers.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Obfuscated Payloads can be undetected even if you have real-time protection
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Obfuscated Payloads can be undetected even if you have real-time protectionPost Views: 34
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png
Reading Time: 3 Minutes
Fact: Obfuscated Payloads can be undetected even if you have real-time protection
There is a certain reason why successful attacks still happen every day, even though you use various security solutions in some cases based on AI and different heuristic algorithms.
Experienced Hackers can craft more sophisticated payloads that can bypass any real-time protection no matter what security measures are implemented by any vendor. Whenever such payload is crafted as we will share some techniques known to do so, it will always be ahead of the way it gets handled, until it studies the behavior pattern and blocks it for the next time they get attacked using the same technique. However, that is too late, because the machine is already bypassed and criminals would have done their damage.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks
Going technically on this, the way it’s done is using several sophisticated methods that are implemented on a payload based on the way it gets delivered, the encryption used, and the time or where it is loaded.
It’s kinda vital that we have to encrypt the malware, not cause there’s any real cryptographic need, but just because if we leave a whole copy of our malware hanging around inside our binary which it will still gonna get detected. So instead of going down the AES/RSA route with our encryption (kinda pointless as we want obfuscation through encryption.) Therefore using XOR with multiple layers is one way to encrypt the payload at first. Next comes Parsing it into the Payload by checking magic bytes inside the malware through IAT tables. By doing this, it then gets written to run only on Memory without touching disks, which bypasses a lot of solutions.
See Also: Microsoft urges Exchange admins to patch bug exploited in the wild
Obfuscation can be done using various techniques, including backdooring official .exe files, changing the size making it much bigger so it could bypass the trigger, and finally making the code that contains the payload/malware executes in a timed interval.
That last step is huge when it comes to bypassing better defensive systems. This means if a user gets infected with such payload, it will run normally if it’s bound to another known application, and the trigger could be hours or days after it passes through the sandbox, and other measures would mark it safe to run, until the malware triggers after that time, giving shell to an attacker.
This is an issue that is unique to each piece of malware, and that’s defenders’ ability to detect common behavior of malware and use that to detect and shut down the malware. This is why we still see payloads execute successfully, and that is because of the detection that happens after the malware has been executed, meaning that the only way to bypass it is by changing the actual behavior of the malware.
See Also: OSINT Tool: Osintgram
Security works continuously using a variety of solutions that relies on automated software. Even if we see AI getting integrated using certain algorithms from different vendors consuming budgets on the protection side, we still see Offensive Security being a huge role in the evolution of Cyber Security, because of the skill & the mindset of building sophisticated Pa[...]
Obfuscated Payloads can be undetected even if you have real-time protection
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Obfuscated Payloads can be undetected even if you have real-time protectionPost Views: 34
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png
Reading Time: 3 Minutes
Fact: Obfuscated Payloads can be undetected even if you have real-time protection
There is a certain reason why successful attacks still happen every day, even though you use various security solutions in some cases based on AI and different heuristic algorithms.
Experienced Hackers can craft more sophisticated payloads that can bypass any real-time protection no matter what security measures are implemented by any vendor. Whenever such payload is crafted as we will share some techniques known to do so, it will always be ahead of the way it gets handled, until it studies the behavior pattern and blocks it for the next time they get attacked using the same technique. However, that is too late, because the machine is already bypassed and criminals would have done their damage.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks
Going technically on this, the way it’s done is using several sophisticated methods that are implemented on a payload based on the way it gets delivered, the encryption used, and the time or where it is loaded.
It’s kinda vital that we have to encrypt the malware, not cause there’s any real cryptographic need, but just because if we leave a whole copy of our malware hanging around inside our binary which it will still gonna get detected. So instead of going down the AES/RSA route with our encryption (kinda pointless as we want obfuscation through encryption.) Therefore using XOR with multiple layers is one way to encrypt the payload at first. Next comes Parsing it into the Payload by checking magic bytes inside the malware through IAT tables. By doing this, it then gets written to run only on Memory without touching disks, which bypasses a lot of solutions.
See Also: Microsoft urges Exchange admins to patch bug exploited in the wild
Obfuscation can be done using various techniques, including backdooring official .exe files, changing the size making it much bigger so it could bypass the trigger, and finally making the code that contains the payload/malware executes in a timed interval.
That last step is huge when it comes to bypassing better defensive systems. This means if a user gets infected with such payload, it will run normally if it’s bound to another known application, and the trigger could be hours or days after it passes through the sandbox, and other measures would mark it safe to run, until the malware triggers after that time, giving shell to an attacker.
This is an issue that is unique to each piece of malware, and that’s defenders’ ability to detect common behavior of malware and use that to detect and shut down the malware. This is why we still see payloads execute successfully, and that is because of the detection that happens after the malware has been executed, meaning that the only way to bypass it is by changing the actual behavior of the malware.
See Also: OSINT Tool: Osintgram
Security works continuously using a variety of solutions that relies on automated software. Even if we see AI getting integrated using certain algorithms from different vendors consuming budgets on the protection side, we still see Offensive Security being a huge role in the evolution of Cyber Security, because of the skill & the mindset of building sophisticated Pa[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Obfuscated Payloads can be undetected even if you have real-time protection https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Obfuscated Payloads can be undetected even if you have real-time…
yloads in a certain way that can bypass, even the biggest vendors in the market.
Offensive Security is the answer and must be demanded more often, so much that it has to be a part of every company that hires defensive teams, and that is because the Offense is always the best defense.
See Also: Complete Offensive Security & Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent Facts* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Not-all-Phishing-attack-types-can-be-protected-using-software-solutions.-Fact_Website-Template-90x90.png Not all Phishing attack types can be protected using software solutions1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Cyber-Attacks-do-not-discriminate-when-choosing-victims.-90x90.png Cyber Attacks do not discriminate when choosing victims.3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Pentesting-alone-cannot-identify-the-maximum-number-of-vulnerabilities-in-an-application.-90x90.png Penetration Testing alone cannot identify the maximum number of vulnerabilities in an application.4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/73-of-Hackers-said-traditional-Firewall-and-Antivirus-Security-is-irrelevant-or-obsolete.-Fact_Website-Template-90x90.png 73% of Hackers said traditional Firewall and Antivirus Security is irrelevant or obsolete.5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/7-out-of-10-businesses-are-not-prepared-to-respond-to-a-Cyber-Attack-Fact_Website-Template-90x90.png 7 out of 10 businesses are not prepared to respond to a Cyber Attack6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Hacking-has-Evolved-Fact_Website-Template-90x90.png Hacking has Evolved7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/You-cant-protect-what-you-cant-see-Fact_Website-Template-90x90.png You can’t protect what you can’t see8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/02/Fact_Website-Template-90x90.png Manual Pentesting is more Effective than the Automated9 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/01/Fact_Website-Template-90x90.png 90% of the hacking process involves the Reconnaissance Phase10 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2020/11/Website-90x90.png A Hacker needs only one loophole to hack any system.12 months ago
The post Obfuscated Payloads can be undetected even if you have real-time protection first appeared on Black Hat Ethical Hacking.
Offensive Security is the answer and must be demanded more often, so much that it has to be a part of every company that hires defensive teams, and that is because the Offense is always the best defense.
See Also: Complete Offensive Security & Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent Facts* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Not-all-Phishing-attack-types-can-be-protected-using-software-solutions.-Fact_Website-Template-90x90.png Not all Phishing attack types can be protected using software solutions1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Cyber-Attacks-do-not-discriminate-when-choosing-victims.-90x90.png Cyber Attacks do not discriminate when choosing victims.3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/Pentesting-alone-cannot-identify-the-maximum-number-of-vulnerabilities-in-an-application.-90x90.png Penetration Testing alone cannot identify the maximum number of vulnerabilities in an application.4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/73-of-Hackers-said-traditional-Firewall-and-Antivirus-Security-is-irrelevant-or-obsolete.-Fact_Website-Template-90x90.png 73% of Hackers said traditional Firewall and Antivirus Security is irrelevant or obsolete.5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/7-out-of-10-businesses-are-not-prepared-to-respond-to-a-Cyber-Attack-Fact_Website-Template-90x90.png 7 out of 10 businesses are not prepared to respond to a Cyber Attack6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Hacking-has-Evolved-Fact_Website-Template-90x90.png Hacking has Evolved7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/You-cant-protect-what-you-cant-see-Fact_Website-Template-90x90.png You can’t protect what you can’t see8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/02/Fact_Website-Template-90x90.png Manual Pentesting is more Effective than the Automated9 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/01/Fact_Website-Template-90x90.png 90% of the hacking process involves the Reconnaissance Phase10 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2020/11/Website-90x90.png A Hacker needs only one loophole to hack any system.12 months ago
The post Obfuscated Payloads can be undetected even if you have real-time protection first appeared on Black Hat Ethical Hacking.
Game Hacking with Python and cheat engine
Hi. In this write up, i will be showing you, how to hack games by editing the memory with cheat engine and will also write a program in…Continue reading on Medium »
Read more...
Hi. In this write up, i will be showing you, how to hack games by editing the memory with cheat engine and will also write a program in…Continue reading on Medium »
Read more...
Thorstarter Meluncurkan Program Bug Bounty dengan Immunefi
Sebagian proyek THORfi akan segera melakukan ekspansi ke Terra dan chain sejenis, Thorstarter berkomitmen untuk memberikan keamanan untuk…Continue reading on Medium »
Read more...
Sebagian proyek THORfi akan segera melakukan ekspansi ke Terra dan chain sejenis, Thorstarter berkomitmen untuk memberikan keamanan untuk…Continue reading on Medium »
Read more...
Covert-Control - Google Drive, OneDrive And Youtube As Covert-Channels - Control Systems Remotely By Uploading Files To Google Drive, OneDrive, Youtube Or Telegram
http://www.kitploit.com/2021/11/covert-control-google-drive-onedrive.html
http://www.kitploit.com/2021/11/covert-control-google-drive-onedrive.html
Control systems remotely by uploading files to Google Drive, OneDrive, Youtube (https://www.kitploit.com/search/label/Youtube) or Telegram (https://www.kitploit.com/search/label/Telegram) using Python to create the files and the listeners. It allows to create text files, images, audio (https://www.kitploit.com/search/label/Audio) or videos, with the commands in cleartext or encrypted using AES.covert-googledrive.py - Control systems uploading files to a public folder in Google Drive.covert-onedrive.py - Control systems uploading files to a public folder in OneDrive.covert-youtube.py - Control systems uploading videos to Youtube (updated from covert-tube (https://github.com/ricardojoserf/covert-tube)).covert-telegram.py - Control systems with a Telegram bot.
Create files to upload
You can find example files in the folder test_files (https://github.com/ricardojoserf/covert-control/tree/reduced/test_files) or create new ones with generate_file.py:python3 generate_file.py -t TYPE [-o OUTPUTFILE] [-c COMMAND] [-e]
-t (--type) [Required]: Types of file: "text", "image", "audio" or "video".-o (--outputfile) [Optional]: Output file.-c (--command) [Optional]: Command to execute.-e (--encrypted) [Optional]: Add this flag to encrypt the command with AES.Examples:python3 generate_file.py -t text -c "whoami" -o text.txt
python3 generate_file.py -t text -c "whoami" -o text_encrypted.txt -e
python3 generate_file.py -t audio -c "whoami" -o audio.wav
python3 generate_file.py -t audio -c "whoami" -o audio_encrypted.wav -e
python3 generate_file.py -t image -c "whoami" -o image.png
python3 generate_file.py -t image -c "whoami" -o image_encrypted.png -e
python3 generate_file.py -t video -c "whoami" -o video.avi
python3 generate_file.py -t video -c "whoami" -o video_encrypted.avi -e
Configuration
Common configuration values:data_type (Optional. Default: "text"):data_typeFile typeEncryptedValid forExtensiontextText fileNoGoogle Drive, OneDrive.txttext_encryptedText fileYesGoogle Drive, OneDrive.txtimageImageNoGoogle Drive, OneDrive.pngimage_encryptedImageYesGoogle Drive, OneDrive.pngaudioAudioNoGoogle Drive, OneDrive.wavaudio_encryptedAudioYesGoogle Drive, OneDrive.wavvideoVideoNoGoogle Drive, OneDrive, Youtube.avivideo_encryptedVideoYesGoogle Drive, OneDrive, Youtube.avidelay_seconds (Optional. Default: 300): Seconds between checks of new files uploaded to the Google Drive or OneDrive folder or new videos in the Youtube channel.aes_key (Optional. Default: "covert-control21"): Key for AES encryption.debug (Optional. Default: True): Print messages and timestamps in the listener (https://www.kitploit.com/search/label/Listener) or not.Specific configuration values:googledrive_folder: Url of public Google Drive folder to monitor (for covert-googledrive.py).onedrive_folder: Url of public OneDrive folder to monitor (for covert-onedrive.py).youtube_channel_id: Youtube channel ID of the channel to monitor. You can get it from here (https://www.youtube.com/account_advanced) (for covert-youtube.py).youtube_api_key: Get an API key creating an application and generating the key in here (https://console.cloud.google.com/apis/credentials) (for covert-youtube.py).telegram_token: Bot token, create it using BotFather (https://github.com/ricardojoserf/covert-control/blob/master/t.me/BotFather). Write "/newbot", then send a name for the bot (for example, "botname") and a username (https://www.kitploit.com/search/label/Username) for the bot ending in "-bot" (for example, "somethingrandombot") (for covert-telegram.py).telegram_username: Specify a Telegram username so it only executes commands received from this user (without "@").
Google Drive
It allows to execute commands uploading text files, images, audio and videos, unencrypted or encrypted with AES. The optional input argument is the public folder url, which can be also configured in config.py:python3 covert-googledrive.py [FOLDER_URL]
Create files to upload
You can find example files in the folder test_files (https://github.com/ricardojoserf/covert-control/tree/reduced/test_files) or create new ones with generate_file.py:python3 generate_file.py -t TYPE [-o OUTPUTFILE] [-c COMMAND] [-e]
-t (--type) [Required]: Types of file: "text", "image", "audio" or "video".-o (--outputfile) [Optional]: Output file.-c (--command) [Optional]: Command to execute.-e (--encrypted) [Optional]: Add this flag to encrypt the command with AES.Examples:python3 generate_file.py -t text -c "whoami" -o text.txt
python3 generate_file.py -t text -c "whoami" -o text_encrypted.txt -e
python3 generate_file.py -t audio -c "whoami" -o audio.wav
python3 generate_file.py -t audio -c "whoami" -o audio_encrypted.wav -e
python3 generate_file.py -t image -c "whoami" -o image.png
python3 generate_file.py -t image -c "whoami" -o image_encrypted.png -e
python3 generate_file.py -t video -c "whoami" -o video.avi
python3 generate_file.py -t video -c "whoami" -o video_encrypted.avi -e
Configuration
Common configuration values:data_type (Optional. Default: "text"):data_typeFile typeEncryptedValid forExtensiontextText fileNoGoogle Drive, OneDrive.txttext_encryptedText fileYesGoogle Drive, OneDrive.txtimageImageNoGoogle Drive, OneDrive.pngimage_encryptedImageYesGoogle Drive, OneDrive.pngaudioAudioNoGoogle Drive, OneDrive.wavaudio_encryptedAudioYesGoogle Drive, OneDrive.wavvideoVideoNoGoogle Drive, OneDrive, Youtube.avivideo_encryptedVideoYesGoogle Drive, OneDrive, Youtube.avidelay_seconds (Optional. Default: 300): Seconds between checks of new files uploaded to the Google Drive or OneDrive folder or new videos in the Youtube channel.aes_key (Optional. Default: "covert-control21"): Key for AES encryption.debug (Optional. Default: True): Print messages and timestamps in the listener (https://www.kitploit.com/search/label/Listener) or not.Specific configuration values:googledrive_folder: Url of public Google Drive folder to monitor (for covert-googledrive.py).onedrive_folder: Url of public OneDrive folder to monitor (for covert-onedrive.py).youtube_channel_id: Youtube channel ID of the channel to monitor. You can get it from here (https://www.youtube.com/account_advanced) (for covert-youtube.py).youtube_api_key: Get an API key creating an application and generating the key in here (https://console.cloud.google.com/apis/credentials) (for covert-youtube.py).telegram_token: Bot token, create it using BotFather (https://github.com/ricardojoserf/covert-control/blob/master/t.me/BotFather). Write "/newbot", then send a name for the bot (for example, "botname") and a username (https://www.kitploit.com/search/label/Username) for the bot ending in "-bot" (for example, "somethingrandombot") (for covert-telegram.py).telegram_username: Specify a Telegram username so it only executes commands received from this user (without "@").
Google Drive
It allows to execute commands uploading text files, images, audio and videos, unencrypted or encrypted with AES. The optional input argument is the public folder url, which can be also configured in config.py:python3 covert-googledrive.py [FOLDER_URL]
The listener will check the Google Drive folder every 300 seconds by default (can be updated in config.py). In this case a video, "video.avi", is uploaded with the command in the QR of the video:
After finding there is a new file uploaded to the folder, it is downloaded, processed and the commands are executed:
Onedrive
It allows to execute commands uploading text files, images, audio and videos, unencrypted or encrypted with AES. The optional input argument is the public folder url, which can be also configured in config.py:python3 covert-onedrive.py [FOLDER_URL]
The listener will check the OneDrive folder every 300 seconds by default (this can be updated in config.py). In this case an audio, "audio_encrypted.wav", is uploaded with the command encrypted with AES:
It allows to execute commands uploading text files, images, audio and videos, unencrypted or encrypted with AES. The optional input argument is the public folder url, which can be also configured in config.py:python3 covert-onedrive.py [FOLDER_URL]
The listener will check the OneDrive folder every 300 seconds by default (this can be updated in config.py). In this case an audio, "audio_encrypted.wav", is uploaded with the command encrypted with AES:
After finding there is a new file uploaded to the folder, it is downloaded, processed and the commands are executed:
NOTE: This will only work if you do not delete any file in the folder, if you do it you must create a new one. It could be possible to implement it to work even after deleting files, but it would be necessary to create many requests and would be less stealthy.
Youtube
It allows to execute commands uploading videos, unencrypted or encrypted with AES. The optional input arguments are the Youtube channel ID to monitor and the API key, which can be also configured in config.py:python3 covert-youtube.py [CHANNEL_ID] [API_KEY]
The listener will check the Youtube channel every 300 seconds by default (this can be updated in config.py). First the video is uploaded:
Youtube
It allows to execute commands uploading videos, unencrypted or encrypted with AES. The optional input arguments are the Youtube channel ID to monitor and the API key, which can be also configured in config.py:python3 covert-youtube.py [CHANNEL_ID] [API_KEY]
The listener will check the Youtube channel every 300 seconds by default (this can be updated in config.py). First the video is uploaded: