Fileless-Xec - Stealth Dropper Executing Remote Binaries Without Dropping Them On Disk
http://www.kitploit.com/2021/12/fileless-xec-stealth-dropper-executing.html

___________________________
@hacking_Attack
@Hacking_Video

Certainly useful , mainly for fun, rougly inspired by 0x00 article (https://0x00sec.org/t/super-stealthy-droppers/3715)
Pentest use: fileless-xec is used on target machine to stealthy execute a binary file located on attacker machine
Short story fileless-xec enable us to execute a remote binary on a local machine directly from memory without dropping them on disk ➪ Install (https://github.com/ariary/fileless-xec/blob/main/install.md) simple usage fileless-xec (~curl | sh for binaries) execute binary with specified program name: fileless-xec -n /usr/sbin/sshd detach program execution from tty: setsid fileless-xec [...]

___________________________
@hacking_Attack
@Hacking_Video

Explanation We want to execute writeNsleep binary locate on a remote machine, locally. We first start a python http server on remote. Locally we use fileless-xec and impersonate the /usr/sbin/sshd name for the execution of the binary writeNsleep(for stealthiness & fun). Once writeNsleep started fileless-xec will delete itself (--self-remove) Other use cases Execute binary with stdout/stdin (https://github.com/ariary/fileless-xec/blob/main/usage.md#execute-binary-with-stdoutstdin) Execute binary with arguments (https://github.com/ariary/fileless-xec/blob/main/usage.md#execute-binary-with-arguments) fileless-xec self remove Bypass network restriction using ICMP (https://github.com/ariary/fileless-xec/blob/main/usage.md#bypass-network-restriction-with-icmp) Bypass firewall with HTTP3 (https://github.com/ariary/fileless-xec/blob/main/usage.md#bypass-firewall-with-http3) "Remote go": execute go binaries without having go installed locally (https://github.com/ariary/fileless-xec/blob/main/usage.md#remote-go-execute-go-binaries-without-having-go-installed-locally) Execute a shell script (https://github.com/ariary/fileless-xec/blob/main/usage.md#execute-a-shell-script) fileless-xec server mode RAT (Remote Access Trojan) scenario (https://github.com/ariary/fileless-xec/blob/main/usage.md#rat-remote-access-trojan-scenario) fileless-xec on windows Stealthiness story The binary file is not mapped into the host file system The execution program name could be customizable Bypass 3rd generation firewall could be done with http3 support fileless-xec self removes once launched memfd_create The remote binary file is stored locally using memfd_create syscall, which store it within a memory disk which is not mapped into the file system (ie you can't find it using ls). fexecve Then we execute it using fexecve syscall (as it is currently not provided by syscall golang library (https://www.kitploit.com/search/label/Golang%20Library) we implem it). With fexecve , we could but we reference the program to run using a file descriptor, instead of the full path. HTTP3/QUIC Enable it with -Q/http3 flag.
You can setup a light web rootfs server supporting http3 by running go run ./test/http3/light-server.go -p LISTENING PORT (This is http3 equivalent of python3 -m http.server )
use test/http3/genkey.sh to generate cert and key. QUIC UDP aka http3 is a new generation Internet protocol that speeds online web applications that are susceptible to delay, such as searching, video streaming etc., by reducing the round-trip time (RTT) needed to connect to a server. Because QUIC uses proprietary encryption (https://www.kitploit.com/search/label/Encryption) equivalent to TLS (this will change in the future with a standardized version), 3rd generation firewalls (https://www.kitploit.com/search/label/Firewalls) that provide application control and visibility (https://www.kitploit.com/search/label/Visibility) encounter difficulties to control and monitor QUIC traffic. If you actually use fileless-xec as a dropper (Only for testing purpose or with the authorization), you likely want to execute some type of malwares or other file that could be drop by packet analysis. Hence, with Quic enables you could bypass packet analysis (https://www.kitploit.com/search/label/Packet%20Analysis) and GET a malware. Also, in case firewall is only used for allowing/blocking traffic it could happen that firewall rules forget the udp protocol making your requests go under the radars other skill for stealthiness Although not present on the memory disk, the running program can still be detected using ps command for example. Cover the tracks with a fake program name fileless-xec --name by default the name is [kworker/u:0] Detach from tty to map behaviour of deamon process setsid fileless-xec . WIP call setsid from code Caveats You could still be detected with: $ lsof | grep memfd

___________________________
@hacking_Attack
@Hacking_Video

Download Fileless-Xec (https://github.com/ariary/fileless-xec)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Recommended WiFi adaptor with monitor mode that runs fine on Windows 10

Hello all, I've previously used an Alfa AWUS036NHA WiFi adaptor in monitor mode on my Linux machine without any issue. However, I'm looking into a project for which I can't get certain libraries to run on Linux, and I suspect the easiest thing to do would be to create my application in Windows.

..but, the previously mentioned Alfa adaptor doesn't seem to play nicely on Windows 10. I know there's not a hardware issue since it's fine on the Linux box, and attempts to install the drivers in Windows 7 compatability-mode, as some posts have suggested, also didn't work.

At this point I'm happy to cut my losses and just purchase a new adaptor for my Windows 10 machine. Can anyone recommend a make and model that they've used successfully in monitor mode on Windows 10?

Many TIA

submitted by /u/jddddddddddd
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Fileless-Xec - Stealth Dropper Executing Remote Binaries Without Dropping Them On Disk

http://3.bp.blogspot.com/-tz50D7qAN80/YZ3UJhIVkPI/AAAAAAAA4Vs/Cqfd4D3bxuU1ruoKYc6ae_RqI0mhg-w3ACK4BGAYYCw/w640-h282/fileless-xec_1_fileless-xec-706129.gif Certainly useful , mainly for fun, rougly inspired by 0x00 articlePentest use: fileless-xecis used on target machine to stealthy execute a binary file located on attacker machine Short storyfileless-xecenable us to execute a remote binary on a local machine directly from memory without dropping them on disk ➪ Install

* simple usage fileless-xec (~curl | sh for binaries)
* execute binary with specified program name: fileless-xec -n /usr/sbin/sshd * detach program execution from tty: setsid fileless-xec [...]http://3.bp.blogspot.com/-tz50D7qAN80/YZ3UJhIVkPI/AAAAAAAA4Vs/Cqfd4D3bxuU1ruoKYc6ae_RqI0mhg-w3ACK4BGAYYCw/w640-h282/fileless-xec_1_fileless-xec-706129.gif ExplanationWe want to execute writeNsleepbinary locate on a remote machine, locally.
We first start a python http server on remote. Locally we use fileless-xecand impersonate the /usr/sbin/sshdname for the execution of the binary writeNsleep(for stealthiness & fun). Once writeNsleep started fileless-xec will delete itself (--self-remove) Other use cases* Execute binary with stdout/stdin
* Execute binary with arguments
* fileless-xecself remove
* Bypass network restriction using ICMP
* Bypass firewall with HTTP3
* "Remote go": execute go binaries without having go installed locally
* Execute a shell script
* fileless-xecserver mode
* RAT (Remote Access Trojan) scenario

* fileless-xecon windows Stealthiness story* The binary file is not mapped into the host file system
* The execution program name could be customizable
* Bypass 3rd generation firewall could be done with http3 support
* fileless-xecself removes once launched memfd_createThe remote binary file is stored locally using memfd_createsyscall, which store it within a memory disk which is not mapped into the file system (ie you can't find it using ls). fexecveThen we execute it using fexecvesyscall (as it is currently not provided by syscallgolang library we implem it).

With fexecve, we could but we reference the program to run using a file descriptor, instead of the full path. HTTP3/QUICEnable it with -Q/http3 flag.
You can setup a light web rootfs server supporting http3 by running go run ./test/http3/light-server.go -p LISTENING PORT(This is http3 equivalent of python3 -m http.server )
use test/http3/genkey.shto generate cert and key. QUICUDP aka http3is a new generation Internet protocol that speeds online web applications that are susceptible to delay, such as searching, video streaming etc., by reducing the round-trip time (RTT) needed to connect to a server.

Because QUIC uses proprietary encryption equivalent to TLS (this will change in the future with a standardized version), 3rd generation firewalls that provide application control and visibility encounter difficulties to control and monitor QUIC traffic.

If you actually use fileless-xecas a dropper (Only for testing purpose or with the authorization), you likely want to execute some type of malwares or other file that could be drop by packet analysis. Hence, with Quic enables you could bypass packet analysis and GET a malware.

Also, in case firewall is only used for allowing/blocking t[...]

___________________________
@hacking_Attack
@Hacking_Video

raffic it could happen that firewall rules forget the udp protocol making your requests go under the radars other skill for stealthinessAlthough not present on the memory disk, the running program can still be detected using pscommand for example.

1. Cover the tracks with a fake program name fileless-xec --name by default the name is [kworker/u:0]1. Detach from tty to map behaviour of deamon process setsid fileless-xec . WIP call setsidfrom code CaveatsYou could still be detected with: $ lsof | grep memfd Download Fileless-Xec

___________________________
@hacking_Attack
@Hacking_Video

How I made $8OO in 0.0001 sec from bug bounty

Hey, I am ski mask also this is my first writeup enjoy !! :)Continue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
Ripple Effects Felt Across the Internet With AWS Outage

AWS Console was among the many services that were unavailable during the outage at Amazon Web Services.

Kali Linux Tutorials
goEnumBruteSpray : User Enumeration And Password Bruteforce On Azure, ADFS, OWA, O365 And Gather Emails On Linkedin

goEnumBruteSpray is recommended module is o365 for user enumeration and passwords bruteforce / spray . Additional information can be retrieved to avoid account lockout, to know that the password is good but expired, MFA enabled,…

Linkedin

This module should be used to retrieve a list of email addresses before validating them through a user enumeration module. The company will be searched on Linkedin and all people working at these companies will be returned in the specified format.

The Linkedin’s session cookie li_atis required.
https://blogger.googleusercontent.com/img/a/AVvXsEi1FJWRYc4oN_pNFJixk8kkUB4yzF4tu44RcgsPYeXK3MUF9IujRqHN13FvZP41RhNbclrn5JT2mPAs9uwFXGQNX85DmQTGKA9YBXLJK1NlV1-wcAThBTwRz8RiG1PB0Vng6UfiugPZDN43G2aK9_SqXoTtlzycgpAW4yhlCOtE33fHBqMJxnXFeC0h=s1007
SearchEngine

This module should be used to retrieve a list of email addresses before validating them through a user enumeration module. The company name will be searched on Google and Bing with a dork to find people working in the company (site:linkedin.com/in+"%s"). The results title will be parsed to output email addresses in the specified format.
https://blogger.googleusercontent.com/img/a/AVvXsEi_eYGFWzCUg8S4ySwZR_9sfHmGlgep1StyB6nu_khEJDpCFA1jqS082C6VLNGqW0taNdCrKUpmBO0lHdfGUYZFy8kxiJlGFZSd4SLiptrU4yQS_pmHqV-QF27SpvgttCAGfw6D0ynHh0lKOlJYp8MgU4rHu-PLp5j9fjMAMaRWGm7rpbUqA6ynjCKp=s1066
Azure

User enumeration

The Azure module is only available to enumerate the users of a tenant. The authentication request will be made on https://autologon.microsoftazuread-sso.com, a detailed response shows if the account does not exist, a MFA is required, if the account is locked, …
https://blogger.googleusercontent.com/img/a/AVvXsEiYyMYaly8QbfT5CA97L0OiPe3U80Rjye_DzO9512jOCIYs9TGQuoObvUdxsE55qsb2FSiXAH87IWcx5DRoW1vLJMkKm_wBGY1TD04bwxXE_Eo96MbIshLUHH4FLXrKMfqLViesDRajD54uJA-mCVN9Xe9uFo4g-VzpEd_qMZNZEaopO9Dd4r6aqOBD=s1524
ADFS

Passwords bruteforce / spray

The ADFS module is only available to bruteforce or spray a password. The authentication request is sent to https://. An error message can informs the user if the password is expired
https://blogger.googleusercontent.com/img/a/AVvXsEiTAnumon70TzBGZHHKr1gxnWYO-rtuwvedrBxXo02cQQMaUL25VBxzC0bjayCCUqgLuBr_N1GhFsGqLPbs2VV7lVcUZHgN1KuDso__BgN7YklP7vgizAVW_pTJGchP9dSY6J2jYEWkVHHkIuqIAxVcYOxpJkARIC2x70QlNPlHkI6Q1cXpajH-zNxx=s1154
O365

This module allows to enumerate users and bruteforce / spray passwords.

User enumeration

Several modes are available: office, oauth2 and onedrive (not implemented yet). The office mode is recommended as no authentication is made. Oauth2 can retrieve additional information through AADSTS error code (MFA enable, locked account, disabled account)
https://blogger.googleusercontent.com/img/a/AVvXsEiUFkQ1eUWtW9yfQx8rl69KVNzj4y4-SC9tPm_6lMwo1CAM9Ys7-UoR8Uf5Vk5zMsNu14R3-a437hM3R9vmaBsyajg7QpCrgzM3WHJsZhZ3ooNln0kK1B-ZkI1P-scG0Rcvli2pyC_v0iQCi_KZBvc6VOzT5kebikJrS125gQ608RgxLcd4YOfdL3K-=s1319
Passwords bruteforce / spray

As for the user enumeration, two modes are available: oauth2 and autodiscover (not implemented yet). The Oauth2 is the recommended mode, it allows to get much information thanks to the AADSTS error code.
https://blogger.googleusercontent.com/img/a/AVvXsEg0CPqFE9w4AKrGeedarxu5ctuP3xE_16eKEFgXNUeGVI0AhoYlpvNiGLgsgLbVc2ucvLrZrMSBrVucPuAvlCBFQKqrPO9C1rs6xT3C_Rnu3pJ5Av8i8vJd3FYFOnBbWpES_PG1S-XElhUD77zVgyCRDv_UjjQI64qLLzLzfNfAWI-MgrkKDZ6hosO-=s1472
OWA

This module allows to enumerate users and bruteforce / spray passwords.

User enumeration

Enumeration is made with authentication requests. Aut[...]

___________________________
@hacking_Attack
@Hacking_Video

hentication for a non-existent user will take longer than for a valid user. At first, the average response time for an invalid user will be calculated and then the response time for each authentication request will be compared.
https://blogger.googleusercontent.com/img/a/AVvXsEhFY8lTqa37f8j7lTGEpX5hNfRgGbc8uYUK9qnEfcyR_kb3QEkib6a5RpHvEQ611vCFKTBaIykLkDipBo5YhOJDiA79prG_3XV086UwyI2qcz6R3CYXnNkwaRWjruzwvmWA6uf5vGahI9jBACLLvcMQvethql7UvpZLR8Ka7kEiVcr0D83o5jXcMQO-=s831
Passwords bruteforce / spray

Please note that no account locking mechanism can be implemented because no information about it is returned.
https://blogger.googleusercontent.com/img/a/AVvXsEjmTnjW0ZNXvTSMzYKYi4kYh639SLyUhpOo6Qna8_PlgV6ZIvSkDYSim0_3_lnBiMlHBLYZfP_tqd0UTGT2CRSpeJx-fS_cBE0iijFCEXxZ0bbmgN6NpLqrwFgrAVvuZ2L_zPHF2QGXsO1TagGTBea3cbBELdDZxkJfLZ1KtjrgpaCklBv3-PF3uWr1=s1070 Download

___________________________
@hacking_Attack
@Hacking_Video

Bypassing Login Page in 2 Mins

Hi ppl! This is Gnana Aravind with another write-up on the most curious “Login Page Bypass”. Let’s jump into the story…Continue reading on Medium »
Read more...

Hacking on Medium
Discord: $7 billion Gamers Heaven at Risk

https://cdn-images-1.medium.com/max/768/1*I9UfCzGCUVoAg09P4GY4bQ.jpeg
What is the Discord Virus?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Network Sniffing

https://cdn-images-1.medium.com/max/1400/0*vHhCO3Jz1Mt-Q7Jg
Sniffing

Continue reading on FAUN Publication »

___________________________
@hacking_Attack
@Hacking_Video