hacking: security in practice
What kind of services does ESXI SLP port advertise to locally connected hosts?

I got enthusiastic about the last exploitations of ESXI CVE-2021-21974 (heap overflow exploitation) and after researching the SLP service which is the weak point in this CVE I tried to turn it off, after which everything was working perfectly fine, so I had a logical question, what kind of services SLP port on ESXI advertises about?

submitted by /u/rubenamizyan
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Part 1 of Trying to Hack a Scammer

https://external-preview.redd.it/F6zApWHbpm1AP4jQTM-I3NrEhszQL8zEQ1yosjjuzXk.jpg?width=320&crop=smart&auto=webp&s=6bd80349141ffcfdb42d0c1f0d62dbe5e14811ad submitted by /u/Sina5105
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escaslation: HiveNightmare

IntroductionCVE-2021-36934 also known as SeriousSAM and HiveNightmare vulnerability was discovered by Jonas Lykkegaard in July 2021. Due to an ACL misconfiguration in Windows 10 post build 1809 and Windows 11, non-admin users are granted read access to the holy trio of SAM, SYSTEM and SECURITY files under %windir%\system32\configdirectory. For this to be true, however, system protection has to be turned on and a volume shadow copy has to be created. The name ‘HiveNightmare’ is derived from a common name ‘hives’ which refers to the files that have registry data stored.Table of Contents· System protection and creating restore pointsSystem protection and creating restore pointsThis feature is available post Windows ME and XP, and allows a user to create backups, snapshots or restore points in their windows system. Should you feel the need to restore your windows to a previous point in time, you can do so. Microsoft mentions which files, settings and configurations are backed up here.Volume Shadow Copy: Post Windows 7 and Win Server 2003, a VSS (Volume Shadow Copy Service) accompanies users in their quest to properly create backups of their servers, shared folders, and restore points on local or remote systems is NTFS or ReFS is being used. In our case, volume shadow copy refers to a local restore point created by a user.net user administrator /active:yes system and security->system->system protection and configure___________________________
@hacking_Attack
@Hacking_Video

4AFLQA4LCw=s16000 We’re good to go nowExploitation Method 1: HiveNightmare.exe (C++ exploit)Now, to exploit the vulnerability, Kevin Beaumont created a zero day (and PoC) for the same. This exploit looks for the shadow copy in the system and reads it for SAM, SYSTEM and SECURITY hives.Exploitation Method 2: serioussam.ps1 (Powershell exploit)The script created by romarroca can be found here. It is created in powershell and is more portable than the exe variant created by Kevin Beaumont. This copies the SAM and SYSTEM hives from the restore point dump created. Execution is fairly simple, just run the script like soExploitation Method 3: hive.exe (Go exploit)Christian Mehlmauer translated the same exploit in Go and created a ready to be executed exe file which can be found here. It dumps the holy trio in current directory simply by executing the exe file like soPrivilege EscalationTill now, we have obtained the SAM, SECURITY and SYSTEM hive dumps and now we will use these files to extract the hashes and conduct a pass the hash attack. First, we are using impacket toolkit’s secretsdump.py script to dump the hashes. Scenario is that the attacker (us) has successfully obtained hives from the victim’s machine.python3 secretsdump.py -sam /root/SAM -system /root/SAM -security /root/SAM LOCALhttps://blogger.googleusercontent.com/img/a/AVvXsEg6yNAp7IEy6IdySFU7qMk6WDwsOgJJ8I6uHbeLLLGqv062V1oxuMOJcwEEMVCHTKTNVp1PWEGKD3v7CcHqiQuSmd9mFdnF1jS_kmPHXww1tE341VWn4pcHK53tZUnYNEMavP1rura9VDZ87jU-sMdmg1lV8u5HtF-OnMO-M_fRfTR1Xbd-BwXgqD73tA=s16000 As you can see in the screenshot above, we have obtained the NTLM hash for the administrator’s account. Obviously, we knew the password in this case (1234) but ideally, the attacker now cracks this hash using John or other likes of hash cracking tools, or he conducts “pass the hash” attack.PassTheHash (PtH): In this type of attack, the attacker can bypass/flout with authentication mechanisms by providing the hash of a password rather than the password itself. This weakness is the most prevalent in Windows systems. At the time of login to a network service in Windows, the backend ultimately convers a plain text string into a hash and compares it with the existing hash in the database (hives); similarly, in PtH attack, the backend code, due to an in[...]

___________________________
@hacking_Attack
@Hacking_Video

herent weakness, gets fooled when a user enters the hash instead of the password string and allows authentication. Refer the guide here for an in-depth understanding of this attack.PsExec – In Windows, PsTools are used for a number of different process related functions like listing, logging, monitoring etc. PsExec is used to execute processes remotely. According to sysinternals (here), “PsExec's most powerful uses include launching interactive command-prompts on remote systems and remote-enabling tools like IpConfig that otherwise do not have the ability to show information about remote systems.”python3 psexec.py -hashes 00000000000000000000000000000000:7ce21f17c0aee7fb9ceba532d0546ad6 administrator@192.168.1.145https://blogger.googleusercontent.com/img/a/AVvXsEiFo_ZFCa4wPUJSRmoC88J5fnRrK1tjudybiM2ZfKBNg3QhT6GnPXyI_J1ClWma2vESKdUG7IEpzna-b60AvNNS9XedwH9j2YNF6Zb25AfWRArYABLajFQM4xty08uOTJlzgvGAQKyxzBxWrjXrKsqTvsOGX8ZQKlzlyXWW0EWmSJLE9gKow3Kk4AivAw=s16000 And it has worked its magic!Conclusion and MitigationThe ease of exploitation makes this vulnerability a critical threat to any organisation. Microsoft has released security patches for the same, however, one other workaround is to restrict access to the contents of %windir%\system32\configby typing the command in cmd prompt:icacls %windir%\system32\config\*.* /inheritance:eThanks for reading.___________________________
@hacking_Attack
@Hacking_Video

Canadian Furious Beaver - A Tool For Monitoring IRP Handler In Windows Drivers, And Facilitating The Process Of Analyzing, Replaying And Fuzzing Windows Drivers For Vulnerabilities
http://www.kitploit.com/2021/11/canadian-furious-beaver-tool-for.html

___________________________
@hacking_Attack
@Hacking_Video

Furious Beaver is a distributed (https://www.kitploit.com/search/label/Distributed) tool for capturing IRPs sent to any Windows driver. It operates in 2 parts:the "Broker" combines both a user-land agent and a self-extractable driver (IrpDumper.sys) that will install itself on the targeted system. Once running it will expose (depending on the compilation options) a remote named pipe (reachable from \\target.ip.address\pipe\cfb), or a TCP port listening on TCP/1337. The communication protocol was made to be simple by design (i.e. not secure) allowing any 3rd party tool (https://github.com/hugsy/cfb-cli) to dump the driver IRPs from the same Broker easily (via simple JSON messages).the GUI is a Windows 10 (https://www.kitploit.com/search/label/Windows%2010) UWP app made in a ProcMon-style: it will connect to wherever the broker is, and provide a convienent GUI for manipulating the broker (driver enumeration, hooking and IRP capturing). It also offers facililties for forging/replaying IRPs, auto-fuzzing (i.e. apply specific fuzzing policies on each IRP captured), or extract IRP in various formats (raw, as a Python script, as a PowerShell (https://www.kitploit.com/search/label/PowerShell) script) for further analysis. The captured data can be saved on disk in an easily parsable format (*.cfb = SQLite) for further analysis, and/or reload afterwards in the GUI.Although the GUI obviously requires a Windows 10 environment (UWP App), the Broker itself can be deployed on any Windows 7+ host (x86 or x64). The target host must have testsigning BCD policy enabled, as the self-extracting driver is not WHQL friendly.
Screenshots

Intercepted IRP view

___________________________
@hacking_Attack
@Hacking_Video

IRP details

___________________________
@hacking_Attack
@Hacking_Video

IRP replay

___________________________
@hacking_Attack
@Hacking_Video

Concept
IrpDumper.sys is the driver part of the CFB Broker that will auto-extract and install when launched. The driver will be responsible for hooking the IRP Major Function table of the driver that is requested to be hooked, via an IOCTL passed from the Broker. Upon success, the IRP table of the driver will then be pointing to IrpDumper.sys interception routine, as we can easily see with a debugger (https://www.kitploit.com/search/label/Debugger) or tools like WinObjEx64.

___________________________
@hacking_Attack
@Hacking_Video

IrpDumper.sys in itself then acts a rootkit, proxy-ing all calls to the targeted driver(s). When a DeviceIoControl is sent to a hooked driver, IrpDumper will simply capture the data if any, and push a message to the user-land agent (Broker), and yield the execution back to the legitimate drivers, allowing the intended code to continue as expected. The Broker stores all this data in user-land waiting for a event to ask for them.
Build

GUI
Clone the repository, and build the Broker in the solution CFB.sln at the project root with Visual Studio (Debug - very verbose - or Release). Additionally, you can build the App GUI by building the GUI (Universal Windows) project.
Command line
Clone the repository and in a VS prompt run msbuild CFB.sln /p:Configuration=$Conf ">C:\cfb\> msbuild CFB.sln /p:Configuration=$Conf
Where $Conf can be set to Release to Debug.
Setup
A Windows 7+ machine (Windows 10 SDK VM (https://developer.microsoft.com/en-us/windows/downloads/virtual-machines) is recommended)On this target machine, simply enable BCD test signing flag (in cmd.exe as Admin): bcdedit.exe /set {whatever-profile} testsigning on ">C:\> bcdedit.exe /set {whatever-profile} testsigning on
If using in Debug mode, IrpDumper.sys will provide a lot more valuable information as to what's being hooked (the price of performance). All those info can be visible via tools like DebugView.exe or a kernel debugger like WinDbg. In either case, you must enable kernel debug BCD flag (in cmd.exe as Admin): bcdedit.exe /set {whatever-profile} debug on ">C:\> bcdedit.exe /set {whatever-profile} debug on
It is also recommended to edit the KD verbosity level, via:the registry for a permanent effect (reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter" /v DEFAULT /t REG_DWORD /d 0xf)directly from WinDbg for only the current session (ed nt!Kd_Default_Mask 0xf)If you plan on (re-)compiling any of the tools, you must install VS (2019 preferred). If using the Release binaries, you only need VS C++ Redist installed (x86 or x64 depending on your VM architecture).Follow the indications in the Docs/ folder to improve your setup.
Command-line client
Several command line (https://www.kitploit.com/search/label/Command%20Line) tools (such as dumping all data to SQLite database, fuzzing IRP, etc.) can be found in the external repository CFB-cli (https://github.com/hugsy/CFB-cli).
Why the name?
Because I had no idea for the name of this tool, so it was graciously generated by a script of mine (https://github.com/hugsy/stuff/tree/master/random-word).

Download CFB (https://github.com/hugsy/CFB)

___________________________
@hacking_Attack
@Hacking_Video

Broken Link Hijacking — 404 Google Play Store— xxx$ Bounty
https://proviesec.medium.com/broken-link-hijacking-404-google-play-store-xxx-bounty-96e79a8dfd71?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video