Dark Reading: Attacks/Breaches
APT Groups Adopt New Phishing Method. Will Cybercriminals Follow?

APT actors from Russia, China, and India have been observed using the RTF-template injection technique that researchers say is poised for wider adoption.

Dark Reading: Attacks/Breaches
Neustar Security Services Spins Out as Own Company

The company plans to offer newly integrated services into its Ultra Secure portfolio and expand its sales, marketing, and service capabilities.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Military Vets Share Lessons That Helped Them Build Infosec Startups

Startup founders say serving in the military taught them how to defend against cyberattacks and how to build teams. These lessons are serving them well as they run their own companies.

Dark Reading: Attacks/Breaches
Russian Man Sentenced to 60 Months in Prison for Running 'Bulletproof' Hosting for Cybercrime

Service hosted Zeus, SpyEye, Citadel, Blackhole Exploit Kit malware aimed at US companies and financial institutions.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Deciphering A Caesar Cipher with Python

https://cdn-images-1.medium.com/max/600/1*XyBRlIjzQK1Z7SJJLdWmng.png
Caesar ciphers map out characters to other characters based on a number key chosen by the designer of the Caesar cipher. There are many…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sorry for the wait..

https://cdn-images-1.medium.com/max/1132/0*0LqE4AOAoYzS3oNX
A huge part of my study schedule is working out before I sit down for hours. I highly suggest this! Not only for health and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it Really that possible? Hacking so many passwords in such little time.

This Article scares me and I gotta know if this is actually a thing that is easy for people to do.

submitted by /u/gajandran619
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What’s the point of unshadow vs cracking directly?

After using John to crack passwords directly from the hashed password as well as combing the passwd and shadow file and I’m wondering why we use unshadow/or any benefits.

I’ve read a couple reasons but there didn’t seem to be a consensus why or if one method was better than others.

Some said unshadow also takes the GECOS field and uses it for key words.

Others said John was written before there was a separate shadow file and the passwd file stood alone. So John was designed to crack a single combined file.

Anyway…what gives?

submitted by /u/space_wiener
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Microsoft Exchange servers hacked to deploy BlackByte ransomware

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views: 118 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 1 Minute
The BlackByte ransomware gang is now breaching corporate networks by exploiting Microsoft Exchange servers using the ProxyShell vulnerabilities.
ProxyShell is the name for a set of three Microsoft Exchange vulnerabilities that allow unauthenticated, remote code execution on the server when chained together.

These vulnerabilities are listed below and were fixed by security updates released in April and May 2021:

* CVE-2021-34473 – Pre-auth Path Confusion leads to ACL Bypass (Patched in April by KB5001779)
* CVE-2021-34523 – Elevation of Privilege on Exchange PowerShell Backend (Patched in April by KB5001779)
* CVE-2021-31207 – Post-auth Arbitrary-File-Write leads to RCE (Patched in May by KB5003435)

Since researchers disclosed the vulnerabilities, threat actors have begun to exploit them to breach servers and install web shells, coin miners, and ransomware.
See Also: Complete Offensive Security and Ethical Hacking Course BlackByte begins exploiting ProxyShellIn a detailed report by Red Canary, researchers analyzed a BlackByte ransomware attack where they saw them exploiting the ProxyShell vulnerabilities to install web shells on a compromised Microsoft Exchange server.

Web Shells are small scripts uploaded to web servers that allow a threat actor to gain persistence to a device and remotely execute commands or upload additional files to the server.
https://www.bleepstatic.com/images/news/security/webshell-example.jpg
BlackByte is still a severe threatWhen conducting ransomware attacks, threat actors commonly use third-party tools to gain elevated privileges or deploy the ransomware on a network.

However, the actual BlackByte ransomware executable plays a central role as it handles both privilege escalation and the ability to worm, or perform lateral movement, within the compromised environment.

The malware sets three registry values, one for local privilege elevation, one for enabling network connection sharing between all privilege levels, and one to allow long path values for file paths, names, and namespaces.

Before encryption, the malware deletes the “Raccine Rules Updater” scheduled task to prevent last-minute interceptions and also wipes shadow copies directly through WMI objects using an obfuscated PowerShell command.

Finally, stolen files are exfiltrated using WinRAR to archive files and anonymous file-sharing platforms such as “file.io” or “anonymfiles.com.”

Although Trustwave released a decryptor for BlackByte ransomware in October 2021, it is unlikely that the operators are still using the same encryption tactics that allowed victims to restore their files for free.

As such, you may or may not be able to restore your files using that decryptor, depending on what key wa[...]

___________________________
@hacking_Attack
@Hacking_Video

s used in the particular attack.

Red Canary has seen multiple “fresh” variants of BlackByte in the wild, so there’s clearly an effort from the malware authors to evade detection, analysis, and decryption.
See Also: Offensive Security Tool: Hashcat From ProxyShell to ransomwareExploiting ProxyShell vulnerabilities to drop ransomware is not new, and in fact, we saw something similar at the start of November by actors who deployed the Babuk strain.

The ProxyShell set has been under active exploitation from multiple actors since at least March 2021, so the time to apply the security updates is well overdue.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks If that’s impossible for any reason, admins are advised to monitor their exposed systems for precursor activity such as the deletion of shadow copies, suspicious registry modification, and PowerShell execution that bypasses restriction policies.
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/80-percent-e-commerce-android-apps-leak-personal-data-765x383-1-90x90.jpg Android banking malware infects 300,000 Google Play users1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/PKM201070290_resize-90x90.jpg Panasonic discloses data breach after network hack2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/0_Windows-headpic-90x90.jpg New Windows 10 zero-day gives admin rights, gets unofficial patch3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers hacked in internal reply-chain attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/slembunk-android-banking-trojan-targets-31-banks-across-the-world-497808-3-90x90.jpg Android malware BrazKing returns as a stealthier banking trojan2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools2 weeks ago
The post Microsoft Exchange servers hacked to deploy BlackByte ransomware first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Kerberoast - Kerberoast Attack -Pure Python-
http://www.kitploit.com/2021/12/kerberoast-kerberoast-attack-pure-python.html

___________________________
@hacking_Attack
@Hacking_Video

Kerberos attack toolkit -pure python- 
Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos (https://www.kitploit.com/search/label/Kerberos) are the following
: +://\:@/?=
: +://\:@/?= Steps -with SSPI-: kerberoast auto Steps -SSPI not used-: Look for vulnerable (https://www.kitploit.com/search/label/Vulnerable) users via LDAP
kerberoast ldap all -o ldapenum Use ASREP roast against users in the ldapenum_asrep_users.txt file
kerberoast asreproast -t ldapenum_asrep_users.txt Use SPN roast against users in the ldapenum_spn_users.txt file
kerberoast spnroast -t ldapenum_spn_users.txt Crack SPN roast and ASPREP roast output with hashcat Commands ldap This command group is for enumerating potentially vulnerable users via LDAP. Command structure     kerberoast ldap Type: It supports three types of users to be enumerated spn Enumerates users with servicePrincipalName attribute set. asrep Enumerates users with DONT_REQ_PREAUTH flag set in their UAC attribute. all Startes all the above mentioned enumerations. ldap_connection_url: Specifies the usercredential and the target server in the msldap url format (see help) options:
    -o: Output file base name brute This command is to perform username (https://www.kitploit.com/search/label/Username) enumeration (https://www.kitploit.com/search/label/Enumeration) by brute-forcing the kerberos service with possible username candidates Command structure     kerberoast brute realm: The kerberos realm usually looks like COMPANY.corp
dc_ip: IP or hostname of the domain controller
targets: Path to the file which contains the possible username candidates
options:
    -o: Output file base name asreproast This command is to perform ASREProast attack Command structure     kerberoast asreproast dc_ip: IP or hostname of the domain controller
options:
    -r: Specifies the kerberos realm to be used. It overrides all other realm info.
    -o: Output file base name
    -t: Path to the file which contains the usernames (https://www.kitploit.com/search/label/Usernames) to perform the attack on
    -u: Specifies the user to perform the attack on. Format is either or @ but in the first case, the -r option must be used to specify the realm spnroast This command is to perform SPNroast (AKA kerberoast) attack. Command structure     kerberoast spnroast kerberos_connection_url: Specifies the usercredential and the target server in the kerberos URL format (see help) options:
    -r: Specifies the kerberos realm to be used. It overrides all other realm info.
    -o: Output file base name
    -t: Path to the file which contains the usernames to perform the attack on
    -u: Specifies the user to perform the attack on. Format is either or @ but in the first case, the -r option must be used to specify the realm

Download Kerberoast (https://github.com/skelsec/kerberoast)

___________________________
@hacking_Attack
@Hacking_Video