Kali Linux Tutorials
Ad-Honeypot-Autodeploy : Deploy A Small, Intentionally Insecure, Vulnerable Windows Domain For RDP Honeypot Fully Automatically

Ad-Honeypot-Autodeploy a tool to Deploy a small, intentionally insecure, vulnerable Windows Domain for RDP Honeypot fully automatically.

Runs on self-hosted virtualization using libvirt with QEMU/KVM (but it can be customized easily for cloud-based solutions).

Used for painlessly set up a small Windows Domain from scratch automatically (without user interaction) for the purpose of RDP Honeypot testing.

Features a Domain Controller, a Desktop Computer and a configured Graylog server for logging the actions of the bad guys. Automatic deployment phases

1. Packer: download the necessary install media and setup the automated base virtual machine images unattended.
2. Terraform: provision the libvirt virtualization infrastructure (network + virtual machines) using the packer-prepared virtual machine images.
3. Ansible: Configure the infrastructure (DC, Desktop, Graylog) automatically, without user interaction.

After going through the Packer+Terraform+Ansible pipeline, the configured Windows Domain should be up and running, you could attach the RDP service of the Desktop to the public internet, and let’s monitor the events through the Graylog. Features

Features of the running system are:

* a Windows Server 2016 as a Domain Controller
* a Windows 10 Desktop (version 2004) as a Domain Computer
* a Graylog 3.3 (Open Source edition) running as a Log Collector on Ubuntu 18.04 LTS
* Using VirtIO drivers for best performance
* Enabled RDP and WinRM Services
* Populated Windows Active Directory with random users
* Sysmon (from Windows Sysinternals) installed and running on Domain Computers
* NXLog Collector running a Domain Computers and forwarding logs to Graylog
* Configured Graylog GeoIP lookup table and pipeline for IP addresses (useful for showing a map of invalid RDP login attempts)
* Graylog World Map of RDP attacks Host System Requirements

Virtualization needs some power of your host system:

* ~80 GB disk space for the base images and the sparse images of the guest computers.
* at least 3 x 4 GB memory for the guest machines (may run with less than 12 GB because of overcommitment)
* installed up-to-date libvirt with QEMU/KVM (official current packages in Ubuntu 18.04 LTS should work)
* Python 3 (preferably with venv) for Ansible

Tested on Ubuntu 18.04 LTS host. Installation and Usage

First, clone the repo:

git clone https://github.com/tothi/ad-honeypot-autodeploy
cd ad-honeypot-autodeploy

Before starting with Packer, set up the intial passwords:

./init_passwords.sh

Packer

Now build the initial images.

cd packer

Windows Server 2016 and Ubuntu installation media should be downloaded by the Packer script. VirtIO needs to be downloaded by the attached get-virtio.sh script:

./get-virtio.sh

Windows 10 should be downloaded manually by getting a temporary download link and save it to the ISO folder. The download link could be obtained from here. Select the English (International), 64-bit version and save the ISO to ISO/Win10_2004_EnglishInternational_x64.iso.

For mapping IP locations on a World Map in Graylog, the MaxMind GeoIP database is needed. Unfortunately due to licensing terms it cannot be redistributed, so you have to download it manually (after registering) from the MaxMind site. The free GeoLite2 version should work, get the “GeoLite2 City” Database in MMDB format (download the GZIP and untar) and put it at resources/GeoLite2-City.mmdb.

If you do not have Packer, get the latest version from the packer.io site (download the pre-compiled binary) or try to add the Hashicorp repository to your packaging system (useful for Terrafrom also).

If you are rebuilding the images, do not forget to clea[...]

___________________________
@hacking_Attack
@Hacking_Video

n up previous builds:

rm -fr output_*

If you want to re-download the images, remove packer_cache:

rm -fr packer_cache

After these preparing steps, run the Packer builds in parallel:

./packer-build-all.sh

The images should be ready in a reasonable time (~20-30 mins depending on your host hardware power). Terraform

Now the infrastructure can be deployed using Terraform.

Get Terraform (>=0.13) if you do not have it (look at the install methods at Packer, above).

Terraform provider for libvirt is also needed, get the appropriate binary from the github releases page, and also look for Terraform v13 migration notes for proper installation.

Enter Terraform folder:

cd ../terraform

Initialize the working directory (only needed for first time use):

terraform init

Build and launch the infrastructure (“apply the changes”):

terraform apply

After a short time (~2-3 mins), the network and virtual machines are up and running.

WARNING: You should take care of protecting your private network. The terraform config (main.tf) provided here just contains a custom firewall rule for my own testing environment (blocking 192.168.0.0/16 destination traffic from the 192.168.3.0/24 honeypot network).

Next is the configuration phase. Ansible

Get into the ansible folder:

cd ../ansible

Recommended installation method is installing the latest Ansible with some required additional dependencies in a Python venv virtualized environment:

python3 -m venv venv
. ./venv/bin/activate
pip install ansible pywinrm faker

For later use just activate the venv by

. ./venv/bin/activate

And just deactivateif it is not needed anymore in your current session.

You should put an SSH public key with filename id.pubinto the ansible folder for accessing the Ubuntu Graylog machine with the ubuntu user (ansible will add it to ~ubuntu/.ssh/authorized_keys).

The wordlist.txtfile contains some (intentionally weak) passwords for the populated domain users which can be customized.

Run the configuration phase:

ansible-playbook -i hosts setup-domain.yml -v

After 20-25 mins everything is ready. The deployed system
hostnameip addressoperating systemroledc1192.168.3.100Windows Server 2016Domain Controllerdesktop12192.168.3.112Windows 10 (version 2004)Domain Member Workstationgraylog192.168.3.191Ubuntu 18.04 LTSGraylog Server
According to the libvirt network configuration (NAT), the hosts can access the public internet (if your host system allows it).

Accessing the hosts is possible through the host system. Practically using an SSH socks tunnel and proxychains for RDP or WinRM access is very comfortable.

For example, if your libvirt host IP is 192.168.0.10, create a socks tunnel listening on localhost:5000by

ssh 192.168.0.10 -D5000 -NTv

And access the Windows 10 desktop (using an appropriate /etc/proxychains.confconfigured for the :5000 tunnel):

proxychains xfreerdp /v:192.168.3.112 /u:administrator

Or, access the Graylog web interface listening on :9000 locally on the Graylog Ubuntu server by SSH ProxyJump and custom forward tunnel:

ssh -J 192.168.0.10 ubuntu@192.168.3.191 -NTv -L9000:127.0.0.1:9000

Then open URL http://localhost:9000and you reach the Graylog web interface.

For activating the RDP honeypot, just allow public access to 192.168.3.112:3389 (for example with some port forwarding configuration on your router and iptables rules on the host machine; my helper script is rdp_public.sh) and keep watching the Graylog. https://s.w.org/images/core/emoji/13.1.0/72x72/1f609.png Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Abaddon : Make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities

Abaddon is a Red team operations involve miscellaneous skills, last several months and are politically sensitive; they require a lot of monitoring, consolidating and caution. Wavestone’s red team operations management software, Abaddon, has been designed to make red team operations faster, more repeatable, stealthier, while including value-added tools and bringing numerous reporting capabilities.

Because:

* There are tons of tools used by red teamers
* … but no operation management (and free and open-source) software
* … and no aggregation between these tools, anyway
* … and “Operational security” failures are common

What did we want with Abaddon ?:

Abaddon aims at facilitating red team operations by:

* Reducing the time to build an infrastructure
* Enabling complex actions with 1 or 2 clicks
* Enabling easier reporting for long operations
* Reducing the “OPSEC failure” risk

The slides presenting Abaddon at RSAC2020 can be found here: (Abaddon, the red team angel) What You Can Deploy
https://blogger.googleusercontent.com/img/a/AVvXsEjd57Z7KZ8D3gnPG-DtW1oSyGO65xC-xImVYNdnS0A7X7Hc5iX-KqQNBh99Fc__qo8PwFvHV6crfxIxtYgBWn5GXEM_45Pe058iEwned9DGzm9XDSYPWtOYQ5XDThQFAWKrKyDJGF3uy9r5CFJa2Z5qzLtzZdS5lu1h15xJu2vZRewQmYslVaL_jIja=s1233
* Deployed within 30 minutes
* Throwable, authenticated, stealth
* Enables phishing as well as remote command execution Other Features

* Reconnaissance: graphical interface to NMAP, Recon-NG, HunterIO, and Amass
* Weaponization: generation of obfuscated payloads under development
* Delivery: one or two-clicks deployment of EC2 instances, Gophish, and of a fully functionnal, stealthy & dockerized C&C infrastructure as shown above
* Exploitation & Post-Exploitation: ideas under development https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png
* Reporting: a simple dashboard ready but still under development to follow your operations Installing And Launching Abaddon

Abaddon has been tested on Debian, LUbuntu, and of course KALI Linux (latest tests have been performed on the 5.4.0 amd64 version). You also need to have Internet access, and a public IP address if you want to deploy your C&C server locally.

Note that to configure your AWS environment, the easiest way is probably to install the aws-cli like indicated here: https://docs.aws.amazon.com/fr_fr/cli/latest/userguide/install-cliv2-linux.html

curl “https://awscli.amazonaws.com/awscli-exe-linux-x86_64.zip” -o “awscliv2.zip”
unzip awscliv2.zip
sudo ./aws/install

Clone this repository and move inside the repository folder

git clone git@github.com/wavestone-cdt/abaddon.git
cd abaddon

Create the files ~/.aws/credentials and ~/.aws/config with your AWS credentials and configuration, using the following command:

aws configure

Move settings.py.sample to settings.py. Add change the database user password (This password will be asked durring the setup process)

mv abaddon/settings.py.sample abaddon/settings.py
sed -i ‘s/yourPasswordHere//g’ abaddon/settings.py

Launch the following command in the abaddon/setup folder:

bash setup/install.sh

This script will:

* Update your OS
* Install the packages that are required by Django and Abaddon (including docker and docker-compose)
* Install all the python dependencies (including Django 3.X)
* Create a PostgreSQL database and a user with the right role (the password for the database that you need to give is inside the abaddon/settings.py file, it is recommended to change the password)
* Apply Django migrations
* Create a superuser for the Django application, that will be used to connect to the graphical interface of Abaddon.

Start the Red Team Angel !

bash abaddon.sh

Open a browser, and go t[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Canadian Furious Beaver : A Tool For Monitoring IRP Handler In Windows Drivers, And Facilitating The Process Of Analyzing, Replaying And Fuzzing Windows Drivers For Vulnerabilities

Canadian Furious Beaver is a distributed tool for capturing IRPs sent to any Windows driver. It operates in 2 parts:

1. the “Broker” combines both a user-land agent and a self-extractable driver (IrpDumper.sys) that will install itself on the targeted system. Once running it will expose (depending on the compilation options) a remote named pipe (reachable from \\target.ip.address\pipe\cfb), or a TCP port listening on TCP/1337. The communication protocol was made to be simple by design (i.e. not secure) allowing any 3rd party tool to dump the driver IRPs from the same Broker easily (via simple JSON messages).
2. the GUI is a Windows 10 UWP app made in a ProcMon-style: it will connect to wherever the broker is, and provide a convienent GUI for manipulating the broker (driver enumeration, hooking and IRP capturing). It also offers facililties for forging/replaying IRPs, auto-fuzzing (i.e. apply specific fuzzing policies on each IRP captured), or extract IRP in various formats (raw, as a Python script, as a PowerShell script) for further analysis. The captured data can be saved on disk in an easily parsable format (*.cfb = SQLite) for further analysis, and/or reload afterwards in the GUI.

Although the GUI obviously requires a Windows 10 environment (UWP App), the Broker itself can be deployed on any Windows 7+ host (x86 or x64). The target host must have testsigningBCD policy enabled, as the self-extracting driver is not WHQL friendly. Screenshots Intercepted IRP view
https://blogger.googleusercontent.com/img/a/AVvXsEhTdkv8WkSAWv7q4dKU-p7yduaX39G9fupngmIHv_a1_uljlxYvwek1w9TV6-XjU4mNjW7PZfbqEGkTBDwbNSWOL4ABgXd9lvbYlfl2Y--wfwOU2bsVsO98SItXtMUlPiTVcLJbvAln159ngmESueV44REwAEuUD39qCY9VE7933oE0_jWxVLpsUQfK=s2229
IRP details
https://blogger.googleusercontent.com/img/a/AVvXsEiqlu-HDxB_Lq990NsjB4sef6PBXsR6ca-O--2sfmpUsuaR9aUU07SvFrVO0J30AGeQzEz834cl6lAmyRy-GncMPfYOSaH8df4NLdnXq8NY25RkyoE1U6dT2G4n_jbiZl_5Ip4yf6YH4H6bBOqoa7TRwEmZ-tPAdrzKb0emmw8WhwyRtasFJnXIk-Ed=s2388 https://blogger.googleusercontent.com/img/a/AVvXsEhlpynB1xzPMnbfyAes9XVAFKltFI6cKFJDPQSPTmUv-QULWJdMqVIzuCWXO3ya54Jk63cKSu3_VnfITWXLwV37wgex8TISjzTiUQ555VftyLwWl2VwnHVttLX78wcCtL5tRDJ672PSv8i2q_rCHDtPD7KYsfQNuCXr3NNnc8_N660sPfZTaoAZkGLt=s2388
IRP replay
https://blogger.googleusercontent.com/img/a/AVvXsEiw68SmFEwW8xsyUnQUQYZLnMRDt-5BX-lz6z_iG-uYrSr_SnNPLsTCkQOgCbpT1bCWfIohmU5-v9NuVRBSDUexYi-pnkTYOs4AfpQ3G3OcpPRGTtk4wfAWgc2StmuI7jH7o_gH9GVdr0thBCTqF36JA33vgA0kFkwoLtZaQWKuPcu42iMhgJ3YI3-P=s2388
Concept IrpDumper.sysis the driver part of the CFB Broker that will auto-extract and install when launched. The driver will be responsible for hooking the IRP Major Function table of the driver that is requested to be hooked, via an IOCTL passed from the Broker. Upon success, the IRP table of the driver will then be pointing to IrpDumper.sysinterception routine, as we can easily see with a debugger or tools like WinObjEx64.
https://blogger.googleusercontent.com/img/a/AVvXsEgSU2Zgiv-iqjpZe9pa6lQv96He1mHvUS33aMwbPUHySQglZ3IsFsgMGGFzek3O63lKSvXPnLgE-xEuWGuY1fjyttj4q4Zt1N1l-o-gIVkm-WjCWxBzeTb5pEr2b4yl2zb4SdOZIyROKu_tlaB6Rqk6r2rS7XrmYME6UT8DMg2p666xXKXaNQm30_bw=s751 IrpDumper.sysin itself then acts a rootkit, proxy-ing all calls to the targeted driver(s). When a DeviceIoControlis sent to a hooked driver, IrpDumperwill simply capture the data if any, and push a message to the user-land agent (Broker), and yield the execution back to the legitimate drivers, allowing the intended code to continue as expected. The Brokerstores all[...]

___________________________
@hacking_Attack
@Hacking_Video

o the URL 127.0.0.1:8000 (connect with the Django superuser credentials created during the installation). Deployment Of A C&C Infrastructure Inside Abaddon

* If no EC2 instance has been deployed before from Abaddon (it is important that you deploy the EC2 from Abaddon, so that you have access to the SSH key, located in the aws folder), go to the Delivery/Let’s phish! page. Click on Deploy EC2!. Wait for the end of the deployment (you can check inside the terminal used to start Abaddon if the EC2 is ready to be used, all the deployment steps appear in the shell).
* Go to the misc/apache/default-ssl.conf file and UPDATE the domain name of the EC2 inside the second VirtualHost. To avoid the detection of your infrastructure, buy a new domain name and configure it to point to your EC2. Use this domain name in the Apache configuration file and UPDATE misc/apache/topsecret.key and misc/apache/topsecret.crt accordingly, which is with the private key and the certificate of your new domain.
* Go then to the Monitor current Scenarios page and click on Configure a RedELK infrastructure. Give this scenario a name. Abaddon supports actually only one scenario at the time. Choose an EC2 instance deployed from your Abaddon and choose Local Deployment (because you deploy your Apache docker locally). Then, choose the ports used by the deployed EC2 to receive the HTTP and SSL connections, and the port and the IP address the Apache reverse proxy will forward the traffic to (for instance, the IP and port your SILENTTRINITY server listens to). A common configuration would be the following:
* http port = 80ssl port = 443Listening Port= 9999C2 IP adress = 172.16.0.1* Wait for the end of the deployment and go back to the Monitor current Scenarios page. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
AzureHunter : A Cloud Forensics Powershell Module To Run Threat Hunting Playbooks On Data From Azure And O365

AzureHunter is a Powershell module to run threat hunting playbooks on data from Azure and O365 for Cloud Forensics purposes

Getting Started

Check that you have the right O365 Permissions

The following roles are required in Exchange Online, in order to be able to have read only access to the UnifiedAuditLog: View-Only Audit Logsor Audit Logs.

These roles are assigned by default to the Compliance Managementrole group in Exchange Admin Center.

NOTE: if you are a security analyst, incident responder or threat hunter and your organization is NOT giving you read-only access to these audit logs, you need to seriously question what their detection and response strategy is!

More information:

* How to search the Audit Log using the GUI
* Manage role groups in Exchange Online
* How to enable the UnifiedAuditLog

NOTE: your admin can verify these requirements by running Get-ManagementRoleEntry "*\Search-UnifiedAuditLog"in your Azure tenancy cloud shell or local powershell instance connected to Azure.

Ensure ExchangeOnlineManagement v2 PowerShell Module is installed

Please make sure you have ExchangeOnlineManagement (EXOv2) installed. You can find instructions on the web or go directly to my little KB on how to do it at the soc analyst scrolls

Either Clone the Repo or Install AzureHunter from the PSGallery

Cloning the Repo

1. Clone this repository
2. Import the module Import-Module .\source\AzureHunter.psd1Install AzureHunter from the PSGallery

All you need to do is:

Install-Module AzureHunter -Scope CurrentUser
Import-Module AzureHunter

What Is The UnifiedAuditLog?

The unified audit log contains user, group, application, domain, and directory activities performed in the Microsoft 365 admin center or in the Azure management portal. For a complete list of Azure AD events, see the list of RecordTypes.

The UnifiedAuditLog is a great source of cloud forensic information since it contains a wealth of data on multiple types of cloud operations like ExchangeItems, SharePoint, Azure AD, OneDrive, Data Governance, Data Loss Prevention, Windows Defender Alerts and Quarantine events, Threat intelligence events in Microsoft Defender for Office 365 and the list goes on and on! AzureHunter Data Consistency Checks

AzureHunter implements some useful logic to ensure that the highest log density is mined and exported from Azure & O365 Audit Logs. In order to do this, we run two different operations for each cycle (batch):

1. Automatic Window Time Reduction: this check ensures that the time interval is reduced to the optimal interval based on the ResultSizeUpperThreshold parameter which by default is 20k. This means, if the amounts of logs returned within your designated TimeInterval is higher than ResultSizeUpperThreshold, then an automatic adjustment will take place.
2. Sequential Data Check: are returned Record Indexes sequentially valid?
https://blogger.googleusercontent.com/img/a/AVvXsEj-qFED47rqcQy9G5lyRJx3zw5dIQSYotrXkwf0vx7KajGWpcnPuG_q4wPHG4VLnVodFK0s7Pb4AwqPUbDY2HgkwtWevXLbj93utu1PACxFmFqL4Z48Ztf_G5eHC4a8AVQVb2irxZrJcYQ2Q9P5Bsp7utRs1hnSdggonC9aECVzFnYlaaq1jLO81fqL=s2640
Usage Ensure you connect to ExchangeOnline

It’s recommended that you run Connect-ExchangeOnlinebefore running any AzureHuntercommands. The program checks for an active remote session and attempts to connect but some versions of Powershell don’t allow this and you need to do it yourself regardless. Run AzureHunter

AzureHunter has two main commands: Search-AzureCloudUnifiedLogand Invoke-AzHunterPlaybook.

The purpose of Search-AzureCloudUnifiedLogis to implement a complex logic[...]

___________________________
@hacking_Attack
@Hacking_Video

this data in user-land waiting for a event to ask for them. Build GUI

Clone the repository, and build the Brokerin the solution CFB.slnat the project root with Visual Studio (Debug – very verbose – or Release). Additionally, you can build the App GUI by building the GUI (Universal Windows)project. Command line

Clone the repository and in a VS prompt run

C:\cfb> msbuild CFB.sln /p:Configuration=$Conf

Where $Confcan be set to Releaseto Debug. Setup

A Windows 7+ machine (Windows 10 SDK VM is recommended)

On this target machine, simply enable BCD test signing flag (in cmd.exeas Admin):

C:> bcdedit.exe /set {whatever-profile} testsigning on

If using in Debug mode, IrpDumper.syswill provide a lot more valuable information as to what’s being hooked (the price of performance). All those info can be visible via tools like DebugView.exeor a kernel debugger like WinDbg. In either case, you must enable kernel debug BCD flag (in cmd.exeas Admin):

C:> bcdedit.exe /set {whatever-profile} debug on

It is also recommended to edit the KD verbosity level, via:

* the registry for a permanent effect (reg add "HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Debug Print Filter" /v DEFAULT /t REG_DWORD /d 0xf)
* directly from WinDbg for only the current session (ed nt!Kd_Default_Mask 0xf)

If you plan on (re-)compiling any of the tools, you must install VS (2019 preferred). If using the Release binaries, you only need VS C++ Redist installed (x86 or x64 depending on your VM architecture).

Follow the indications in the Docs/folder to improve your setup. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
EXOCET : AV-evading, Undetectable, Payload Delivery Tool

EXOCET is superior to Metasploit’s “Evasive Payloads” modules as EXOCET uses AES-256 in GCM Mode (Galois/Counter Mode). Metasploit’s Evasion Payloads uses a easy to detect RC4 encryption. While RC4 can decrypt faster, AES-256 is much more difficult to ascertain the intent of the malware.
https://blogger.googleusercontent.com/img/a/AVvXsEjr3X_IDfq6Ji0_r-BUagPu9k7MGRfvmAVrTeTKzWF5wWnXtNJLLDFuy9UiOs4pAvlPxW-oNEvvFNc8iXAZq595T7zg4vp-fQE0HE-g0HG2ugesD8GMUopqEoMW8aBqx94QNk92v-uofO4747iRs-HxdUkI82bUmOyrTNwTDA3cMuEcZ4xk7vbmEpSG=s1920
However, it is possible to use Metasploit to build a Evasive Payload, and then chain that with EXOCET. So EXOCET will decrypt via AES-256, and then the Metasploit Evasive Payload then decrypts itself from RC4.

Much like my previous project, DarkLordObama, this toolkit is designed to be a delivery/launch vehicle, much like Veil-Evasion does.

Dark Lord Obama Project

However, EXOCET is not limited to a single codebase or platforms that are running Python. EXOCET works on ALL supported platforms and architectures that Go supports. Exocet Overview

EXOCET, is effectively a crypter-type malware dropper that can recycle easily detectable payloads like WannaCry, encrypt them using AES-GCM (Galois/Counter Mode), which is more secure than AES-CBC, and then create a dropper file for a majority of architectures and platforms out there.

Basically…

1. It ingests dangerous malware that are now detectable by antivirus engines
2. It then encrypts them and produces it’s own Go file
3. Then that Go file can be cross-compiled to 99% of known architectures
4. Upon execution, the encrypted payload is written to the disk and immediately executed on the command line
5. Alternatively, instead of a file-drop, it will execute the reconstitute shellcode in memory using amenzhinsky’s go-memexec module github.com/amenzhinsky/go-memexec
6. A custom shellcode executor is in the works, it takes ordinary C shellcode and after num-transform, it will run it by creating a new process after allocating the correct virtual address space and granting it RWX permissions on Windows

That means 32-bit, and 64-bit architectures, and it works on Linux, Windows, Macs, Unix, Android, iPhone, etc. You take, anything, and I mean ANYTHING, like the 1988 Morris Worm that nearly brought down the internet (which exploited a flaw in the fingerd listener daemon on UNIX), and make it a viable cyberweapon again.

EXOCET is designed to be used with the DSX Program, or the “Cyber Metal Gear” as I envisioned it. Being able to launch and proliferate dangerous malware without a traceable launch trail.

EXOCET is written entirely in Go. How to use

EXOCET, regardless of which binary you use to run it, requires Golang to work. By default, it generates a crypter .go file.

1. Windows users: Install Go Here
2. Linux users: run sudo apt-get update && sudo apt-get install -y golang3. You must install the EXOCET source files in golang go get github.com/tanc7/EXOCET-AV-Evasion4. Sub-requirements will also be downloaded and installed
5. For Windows and Mac x64 Users, pre-compiled binaries are in the /bin folder To run it

go run EXOCET.go detectablemalware.exe outputmalware.go

A key is automatically generated for you. The key is 64-characters long and is entirely composed of bash and cmd.exe shell pipe redirectors to confuse and disrupt brute-forcing attempts against the key by causing unpredictable, destructive behavior on the forensic analyst’s device.

For 64-bit Windows Targets…

env GOOS=windows GOARCH=amd64 go build -ldflags “-s -w” -o outputMalware.exe outputmalware.go

And out comes a outputmalware.exefile

For 64-bit MacOS Targets

env GOOS=darwin GOARCH=amd64 go build -ldflags “-s -w” -o outputMalware.macho outputmalware.go

[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Clash : A Rule-Based Tunnel In Go

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cumulus : Web Application Weakness Monitoring, It Would Be Working By Add Just 3 Codelines

Cumulus is a service that helps you monitor and fix security weakness in realtime. The issues will be reported on web dashboard. It’s very simple and powerful.
https://blogger.googleusercontent.com/img/a/AVvXsEigWUCWSjHr8uaxdNbRTa6SltIWHhTYa0MDsgeL1PDhp9SN_iZlpkuwVtoMbYyd-p9ihQ_llWrF0Fw3LVSCZHXzQCdV_IlBL69ENWBQUFO-iiqy3ayhCL7eOLbqGEGID90X8Bpc-2qmmfQMd9yH6gfNAHvJ0TVkwRUfqDDB4P8dmfCWar9r1zFl0mOZ=s1893
Key features

Just install SDK to web front, can be found security weakness on service

* SDK detect weakness from Inner Layer, dynamically (ex_ DOM Event, XHR Request)
* Scanner detect weakness from Out Layer, statically (ex_ Web crawling based analysis)
NameOriginDescriptionXSSSDKWhen user input a xss pattern string, trigger detection of XSSSQLInjectionSDKWhen user input a sqlinjection pattern, trigger detection of SQLInjectionSensitive PayloadSDKWhen requesting with sensitive payload. for example, unencoded raw passwordFile UploadSDKWhen user embed any file worried for system. for example, web shellUnnecessary CommentScannerCode comments are on the served HTML or JSDirectory TraversalScannerDetect directory listing vulnerabilityGuessingScannerDetect sensitive page like adminUnobfuscated CodeScannerDetect unobfuscated vulnerable codes
If you think about able to detect additional weakness, please contribute on SDK or Scanner

Cumulus SDK for JavaScript

The official Cumulus SDK for JavaScript, providing as npm

Note: current version is unsupported version on typescript project but we considering now and gonna make it, quickly! (#2)

Installation

To install a SDK, simply add package like belows:

npm install –save https://github.com/tophat-cloud/cumulus
yarn add https://github.com/tophat-cloud/cumulus

Setup and usage of SDK always follow the same principle.

import { protect, captureMessage } from ‘cumulus’;
protect({
key: ‘key’,
});
captureMessage(‘Hello, world!’);

If you haven’t __key__, please sign-up and create project to get to key
Download

___________________________
@hacking_Attack
@Hacking_Video

to ensure that the highest percentage of UnifiedAuditLog records are mined from Azure. By default, it will export extracted and deduplicated records to a CSV file.

The purpose of Invoke-AzHunterPlaybookis to provide a flexible interface into hunting playbooks stored in the playbooksfolder. These playbooks are designed so that anyone can contribute with their own analytics and ideas. So far, only two very simple playbooks have been developed: AzHunter.Playbook.Exporterand AzHunter.Playbook.LogonAnalyser. The Exportertakes care of exporting records after applying de-duplication and sorting operations to the data. The LogonAnalyseris in beta mode and extracts events where the Operationsproperty is UserLoggedIn. It is an example of what can be done with the playbooks and how easy it is to construct one.

When running Search-AzureCloudUnifiedLog, you can pass in a list of playbooks to run per log batch. Search-AzureCloudUnifiedLogwill pass on the batch to the playbooks via Invoke-AzHunterPlaybook.

Finally Invoke-AzHunterPlaybookcan, be used standalone. If you have an export of UnifiedAuditLog records, you can load them into a Powershell Array and pass them on to this command and specify the relevant playbooks. Example 1 | Run search on Azure UnifiedAuditLog and extract records to CSV file (default behaviour)

Search-AzureCloudUnifiedLog -StartDate “2020-03-06T10:00:00” -EndDate “2020-06-09T12:40:00” -TimeInterval 12 -AggregatedResultsFlushSize 5000 -Verbose

This command will:

* Search data between the dates in StartDate and EndDate
* Implement a window of 12 hours between these dates, which will be used to sweep the entire length of the time interval (StartDate –> EndDate). This window will be automatically reduced and adjusted to provide the maximum amount of records within the window, thus ensuring higher quality of output. The time window slides sequentially until reaching the EndDate.
* The AggregatedResultsFlushSizeparameter speficies the batches of records that will be processed by downstream playbooks. We are telling AzureHunter here to process the batch of records once the total amount reaches 5000. This way, you can get results on the fly, without having to wait for hours until a huge span of records is exported to CSV files. Example 2 | Run Hunting Playbooks on CSV File

We assume that you have exported UnifiedAuditLog records to a CSV file, if so you can then do:

$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-AzHunterPlaybook -Records $RecordArray -Playbooks ‘AzHunter.Playbook.UAL.LogonAnalyser’

You can run more than one playbook by separating them via commas, they will run sequentially:

$RecordArray = Import-Csv .\my-exported-records.csv
Invoke-AzHunterPlaybook -Records $RecordArray -Playbooks ‘AzHunter.Playbook.UAL.Exporter’, ‘AzHunter.Playbook.UAL.LogonAnalyser’

Example 3 | Run Hunting Playbook to produce a clean eDiscovery Summary Report

We assume that you have exported an eDiscovery Summary Report to a CSV file, if so you can then do:

$eDiscoReportFile = .\eDisco-Summary-Report-PersonOfInterest.csv
Invoke-AzHunterPlaybook -Records $eDiscoReportFile -Playbooks ‘AzHunter.Playbook.eDisco.SummaryReportCleaner’

Optionally we can pass some parameters to the playbook like so:

$eDiscoReportFile = .\eDisco-Summary-Report-PersonOfInterest.csv
Invoke-AzHunterPlaybook -Records $eDiscoReportFile -Playbooks ‘AzHunter.Playbook.eDisco.SummaryReportCleaner’ -PlayBookParameters @{“CsvRecordsBatchSize” = 700}

The paramenter “CsvRecordsBatchSize” will tell the playbook to flush records to disk in batches of 700 records. Why?

Since the aftermath of the SolarWinds Supply Chain Compromise many tools have emerged out of deep forges of cyberforensicators, carefully developed by cyber blacksmith ninj[...]

___________________________
@hacking_Attack
@Hacking_Video