Hacking Articles Tips Tricks Videos Tutorials

Vimana : An Experimental Security Framework That Provide Resources

Vimana is a modular security framework designed to audit Python web applications. The base of the Vimana is composed of crawlers.

4 viewsedited 19:13

3 views19:13

Kali Linux Tutorials
ADLab : Custom PowerShell Module To Setup An Active Directory Lab Environment To Practice Penetration Testing

ADLab, the purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing.

Credits to Joe Helle and his PowerShell for Pentesters course regarding the generation of the attack vectors. Instructions Preparation Optional but recommended: Move Module into PSModulePath# Display PSModulePath
$env:PSModulePath.split(“;”)
# Move module to path
Move-Item .\ADLab\ “C:\Windows\system32\WindowsPowerShell\v1.0\Modules\”

Import-Module

#Import global module
Import-Module ADLab
#Import local module
Import-Module .\ADLab.psm1

Initial Lab Setup Invoke-DCPrep

This function prepares the current VM/computer to be used as a domain controller for the new forest. It sets a static IP address, sets the DNS server to be the localhost and renames the computer.

#Prepare the current VM with all default values while displaying verbose output
Invoke-DCPrep -Verbose
#Set custom hostname and use Google DNS for Internet access
Invoke-DCPrep -Hostname “DC” -NewIPv4DNSServer “8.8.8.8”
#Use custom IP and default gateway and display verbose output
Invoke-DCPrep -Verbose -NewIPv4Address “192.168.1.99” -NewIPv4Gateway “192.168.1.1”

Invoke-ForestDeploy

The function installs the AD DS feature and sets up a new Active Directory forest, without requiring any user input. Restarts the computer upon completion.

Installs a new forest with FQDN of “bufu-sec.local” with default DSRM password of “Password!”
Invoke-ForestDeploy -Domain bufu-sec.local
Installs a new forest with FQDN of “bufu-sec.local” with the DSRM password set to “P@ssword!” and displaying debug messages
Invoke-ForestDeploy -Domain “bufu-sec.local” -DSRMPassword “P@ssword!” -Verbose

Invoke-DNSDeploy

The function begins by installing the DNS feature. It then adds the primary zone and configures the server forwarder.

Install and configure DNS on the current host and display verbose output.

Invoke-DNSDeploy -Verbose -NetworkID 192.168.47.0/24 -ZoneFile “192.168.47.2.in-addr.arpa.dns” -ServerForwarder 1.1.1.1

Invoke-DHCPDeploy

The function begins by installing the DHCP feature on the current machine. It then adds the necesarry security groups and authorizes the new DHCP server with the domain controller. Finally, it configures the new DHCP scope with the supplied values.

Install and configure DHCP on the local DC.
Invoke-DHCPDeploy -Verbose -ScopeName “Default” -ScopeID 192.168.47.0 -StartIP 192.168.47.100 -EndIP 192.168.47.200 -SubnetMask 255.255.255.0 -DNSServer 192.168.47.10 -Router 192.168.47.10
Install and configure DHCP on the specified DC.
Invoke-DHCPDeploy -Verbose -ScopeName “Default” -ScopeID 192.168.47.0 -StartIP 192.168.47.100 -EndIP 192.168.47.200 -SubnetMask 255.255.255.0 -DNSServer 192.168.47.10 -Router 192.168.47.10 -DCFQDN DC01.bufu-sec.local

Content Invoke-ADLabFill

The function begins by creating the groups and OUs defined in the global Groups variable. It then generates 10 user objects for each OU by default.

Fill forest with objects and display verbose output
Invoke-ADLabConfig -Verbose
Create 50 users for each OU and display verbose output
Invoke-ADLabConfig -Verbose -UserCount 50

Attack Vectors Set-ASREP Roasting

The function gets a certain amount of random user from the domain and sets the DoesNotRequirePreAuth flag for each. Excludes default accounts like Administrator and krbtgt. Makes 5% of users ASREP-Roastable by default.

Make 5% of users ASREP-Roastable and display verbose output
Set-ASREPRoasting -Verbose
Make 10 random users in the domain ASREP-Roastable
Set-ASREPRoasting -VulnerableUsersCount 10
Make user bufu ASREP-Roastable and display verbose output
Set-ASREPRoasting -Users bufu -Verbose
Make supplied list of users [...]

___________________________
@hacking_Attack
@Hacking_Video

ADLab : Custom PowerShell Module To Setup An Active Directory Lab

ADLab, the purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration testing.

3 viewsedited 19:13

Kali Linux Tutorials ADLab : Custom PowerShell Module To Setup An Active Directory Lab Environment To Practice Penetration Testing ADLab, the purpose of this module is to automate the deployment of an Active Directory lab for practicing internal penetration…

ASREP-roastable and display verbose output
Set-ASREPRoasting -Users (“bufu”, “pepe”) -Verbose

Set-BadACLs

The function begins by granting the Chads group GenericAll rights on the Domain Admins. It then grants the Degens group GenericALl rights on the Chads group. Finally, it grants GenericAll rights on some users from the Degens group to some users of the Normies group.

#Create vulnerable ACLs and display verbose output
Set-BadACLs -Verbose

Set-PSRemoting

The function first configures GPO to allow WinRM over TCP port 5985 to domain-joined systems. It then enables PS Remoting through GPO.

#Enable PS Remoting and display verbose output
Set-PSRemoting -Verbose Download

___________________________
@hacking_Attack
@Hacking_Video

3 viewsedited 19:13

3 views19:13

5 views19:13

Kali Linux Tutorials
HandleKatz : PIC Lsass Dumper Using Cloned Handles

HandleKatz tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass in order to create an obfuscated memory dump of the same.

It compiles down to an executable living fully in its text segment. Thus, the extracted .text segment of the PE file is fully position independent code (=PIC), meaning that it can be treated like any shellcode.

The execution of HandleKatz in memory has a very small footprint, as itself does not allocate any more executable memory and can therefore efficiently be combined with concepts such as (Phantom)DLL-Hollowing as described by @_ForrestOrr. This is in contrast to PIC PE loaders, such as Donut, SRDI or Reflective Loaders which, during PE loading, allocate more executable memory. Additionally, it makes use of a modified version of ReactOS MiniDumpWriteDumpA using direct system calls to write an obfuscated dump to disk.

For detailed information please refer to the PDF file PICYourMalware.pdf in this repository.

Usage

* make all to build HandleKatzPIC.exe, HandleKatz.bin and loader.exe

Please note that different compiler (versions) yield different results. This might produce a PE file with relocations.

All tests were carried out using x86_64-w64-mingw32-gcc mingw-gcc version 11.2.0 (GCC). The produced PIC was successfully tested on: Windows 10 Pro 10.0.17763. On other versions of windows, API hashes might differ.

To use the PIC, cast a pointer to the shellcode in executable memory and call it according to the definition:
DWORD handleKatz(BOOL b_only_recon, char* ptr_output_path, uint32_t pid, char* ptr_buf_output);
* b_only_recon If set, HandleKatz will only enumerate suitable handles without dumping
* ptr_output_path Determines where the obfuscated dump will be written to
* pid What PID to clone a handle from
* ptr_buf_output A char pointer to which HandleKatz writes its internal output

For deobfuscation of the dump file, the script Decoder.py can be used.

Loader implements a sample loader for HandleKatz:

loader.exe –pid:7331 –outfile:C:\Temp\dump.obfuscated
https://blogger.googleusercontent.com/img/a/AVvXsEilwBKv6Ob3eDjUPi3vbqmmegbYXYQm34nw_sXhM7H0gHFzpB-954SvW8krrOMBdU8FcrjQvnJScSw1smECX1yt326ENdffoTQhSn8zCpikWXnNEz3acTOS_ymRE8coa_htjof-Wiu7u3E7TQlNc5UljHnw2DGE1w4tZgre7Ls7H5om1PEscick9JVH=s699
Detection

As cloned handles are used along with modified ReactOS code, no ProcessAccess events can be observed on Lsass. However, ProcessAccess events on programs which hold a handle to Lsass can be observed.

Defenders can monitor for Process Access masks with set PROCESS_DUP_HANDLE (0x0040) to identify the usage of this tool.
Download

___________________________
@hacking_Attack
@Hacking_Video

HandleKatz : PIC Lsass Dumper Using Cloned Handles

HandleKatz tool was implemented as part of our Brucon2021 conference talk and demonstrates the usage of cloned handles to Lsass .

5 viewsedited 19:13

Kali Linux Tutorials
aDLL : Adventure of Dynamic Link Library

aDLL is a binary analysis tool focused on the automatic discovery of DLL Hijacking vulnerabilities. The tool analyzes the image of the binary loaded in memory to search for DLLs loaded at load-time and makes use of the Microsoft Detours library to intercept calls to the Load Library/Load LibraryEx functions to analyze the DLLs loaded at run-time. The purpose is to obtain a list of DLLs that are not found by the executable in those folders where they are searched.

Getting Started

To start using aDLL a compiled executable is available in the Binaries folder. It is recommended to use the version whose architecture (32-bit or 64-bit) matches the version of the executable to be analyzed.

For the correct functioning of the tool, it is necessary that the DLLs “hook32”, “hook64”, “informer32” and “informer64” are located in the same directory as the executable aDLL.exe.

Prerequisites

aDLL has been developed and tested on Windows 10 systems. If the system is old and/or Visual Studio is not installed, it is possible that the tool will throw an error like “VCRUNTIME140.dll not found”. In this case the Visual C++ Redistributable update must be installed. Update can be found here: https://www.microsoft.com/es-ES/download/details.aspx?id=49984.

Compilation

To modify/recompile the tool it is recommended the use of Visual Studio 2015 or later. The Visual Studio solution consists of three projects: aDLL, Hook e Informer. _ -aDLL: must be compiled as an executable. If linking errors occur, it will be necessary to add the shlwapi.lib library using the Visual Studio linker as an additional dependency._ _ -Hook: must be compiled as a DLL with the same architecture as the executable to be analyzed. The resulting Hook file must be renamed to hook32.dll or hook64.dll as appropriate. If you wish to analyze executables of both architectures it will be necessary to have both DLLs in the same directory as aDLL.exe._ _ -Informer: same as Hook. Must be compiled as a DLL and renamed to informer32.dll or informer64.dll._

Usage

The tool has a -h option to print a brief description of the available options on the screen..

.\aDLL -h

As a common example of usage aDLL should receive at least the path to the executable to be analyzed.

.\aDLL -e “C:\System32\notepad.exe”

OPTIONS:

-h Displays the tool’s help with a brief description of each option.
-e Specifies the path to the executable to be analyzed by aDLL.
-t Specifies a path to a text file with a list of executable paths.
-o Specifies a path to a directory in which a report will be stored for each executable scanned.
-m Searches for the executable’s manifest and displays it on the screen. aDLL searches for the manifest embedded in the binary, it will not find the manifest if it exists as an external file.
-w Defines the number of seconds the executable process will be kept open while searching for DLLs loaded at runtime. The default time is 20 seconds.
-aDLL will automatically test if a malicious DLL is executed by impersonating the legitimate DLL in the search order if a candidate DLL has been found.
-d Used in conjunction with the -a option, this option allows you to select a path to a DLL that will be used as the malicious DLL.
-r Each DLL imported by the executable can in turn import other DLLs as dependencies. A search “n” times recursive will be made on all those DLLs found by aDLL that are not redirected (ApiSetSchema or WinSxS) and do not belong to the list of Known DLL of the system.
Download

___________________________
@hacking_Attack
@Hacking_Video

aDLL : Adventure of Dinamic Link Library !!! Kali Linux

aDLL is a binary analysis tool focused on the automatic discovery of DLL Hijacking vulnerabilities. The tool analyzes the image of the binary

4 viewsedited 19:13

4 views20:08