Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking Microsoft Exchange servers hacked to deploy BlackByte ransomware https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Microsoft Exchange servers hacked to deploy BlackByte ransomwarePost Views:…

s used in the particular attack.

Red Canary has seen multiple “fresh” variants of BlackByte in the wild, so there’s clearly an effort from the malware authors to evade detection, analysis, and decryption.
See Also: Offensive Security Tool: Hashcat From ProxyShell to ransomwareExploiting ProxyShell vulnerabilities to drop ransomware is not new, and in fact, we saw something similar at the start of November by actors who deployed the Babuk strain.

The ProxyShell set has been under active exploitation from multiple actors since at least March 2021, so the time to apply the security updates is well overdue.
See Also: Hacking stories – Operation Troy – How researchers linked the cyberattacks If that’s impossible for any reason, admins are advised to monitor their exposed systems for precursor activity such as the deletion of shadow copies, suspicious registry modification, and PowerShell execution that bypasses restriction policies.
Source: www.bleepingcomputer.com (Click Link)https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Untitled-design.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/80-percent-e-commerce-android-apps-leak-personal-data-765x383-1-90x90.jpg Android banking malware infects 300,000 Google Play users1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/PKM201070290_resize-90x90.jpg Panasonic discloses data breach after network hack2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/0_Windows-headpic-90x90.jpg New Windows 10 zero-day gives admin rights, gets unofficial patch3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/1_pD_YMyWDg8A2grOrbaNS6g-90x90.jpg New Linux malware hides in cron jobs with invalid dates6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Microsoft-Vulnerability-RCE-MSHTML-90x90.jpg Hackers exploit Microsoft MSHTML bug to steal Google, Instagram creds1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/windows-hacking-90x90.jpg Malware now trying to exploit new Windows Installer zero-day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/https___specials-images.forbesimg.com_imageserve_503493618_Green-binary-code-on-screen-with-Zero-Day-highlighted-in-red-as-viewed-under-a_960x0-90x90.jpg New Windows zero-day with public exploit lets you become an admin1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/ezgif.com-gif-maker-2-90x90.jpg Microsoft Exchange servers hacked in internal reply-chain attacks1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/slembunk-android-banking-trojan-targets-31-banks-across-the-world-497808-3-90x90.jpg Android malware BrazKing returns as a stealthier banking trojan2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/redcurl-90x90.jpg RedCurl corporate espionage hackers resume attacks with updated tools2 weeks ago
The post Microsoft Exchange servers hacked to deploy BlackByte ransomware first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 09:26

Hacking Articles Tips Tricks Videos Tutorials

Kerberoast - Kerberoast Attack -Pure Python-
http://www.kitploit.com/2021/12/kerberoast-kerberoast-attack-pure-python.html

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Kitploit – Maintenance in Progress

Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.

4 viewsedited 11:30

Hacking Articles Tips Tricks Videos Tutorials

5 views11:30

Hacking Articles Tips Tricks Videos Tutorials

Kerberos attack toolkit -pure python-
Install pip3 install kerberoast Prereqirements Python 3.6 See requirements.txt For the impatient IMPORTANT: the accepted target url formats for LDAP and Kerberos (https://www.kitploit.com/search/label/Kerberos) are the following
: +://\:@/?=
: +://\:@/?= Steps -with SSPI-: kerberoast auto Steps -SSPI not used-: Look for vulnerable (https://www.kitploit.com/search/label/Vulnerable) users via LDAP
kerberoast ldap all -o ldapenum Use ASREP roast against users in the ldapenum_asrep_users.txt file
kerberoast asreproast -t ldapenum_asrep_users.txt Use SPN roast against users in the ldapenum_spn_users.txt file
kerberoast spnroast -t ldapenum_spn_users.txt Crack SPN roast and ASPREP roast output with hashcat Commands ldap This command group is for enumerating potentially vulnerable users via LDAP. Command structure     kerberoast ldap Type: It supports three types of users to be enumerated spn Enumerates users with servicePrincipalName attribute set. asrep Enumerates users with DONT_REQ_PREAUTH flag set in their UAC attribute. all Startes all the above mentioned enumerations. ldap_connection_url: Specifies the usercredential and the target server in the msldap url format (see help) options:
    -o: Output file base name brute This command is to perform username (https://www.kitploit.com/search/label/Username) enumeration (https://www.kitploit.com/search/label/Enumeration) by brute-forcing the kerberos service with possible username candidates Command structure     kerberoast brute realm: The kerberos realm usually looks like COMPANY.corp
dc_ip: IP or hostname of the domain controller
targets: Path to the file which contains the possible username candidates
options:
    -o: Output file base name asreproast This command is to perform ASREProast attack Command structure     kerberoast asreproast dc_ip: IP or hostname of the domain controller
options:
    -r: Specifies the kerberos realm to be used. It overrides all other realm info.
    -o: Output file base name
    -t: Path to the file which contains the usernames (https://www.kitploit.com/search/label/Usernames) to perform the attack on
    -u: Specifies the user to perform the attack on. Format is either or @ but in the first case, the -r option must be used to specify the realm spnroast This command is to perform SPNroast (AKA kerberoast) attack. Command structure     kerberoast spnroast kerberos_connection_url: Specifies the usercredential and the target server in the kerberos URL format (see help) options:
    -r: Specifies the kerberos realm to be used. It overrides all other realm info.
    -o: Output file base name
    -t: Path to the file which contains the usernames to perform the attack on
    -u: Specifies the user to perform the attack on. Format is either or @ but in the first case, the -r option must be used to specify the realm

Download Kerberoast (https://github.com/skelsec/kerberoast)

___________________________
@hacking_Attack
@Hacking_Video