KitPloit - PenTest Tools!
Scemu - X86 32bits Emulator, For Securely Emulating Shellcodes

http://4.bp.blogspot.com/-N71EhQnNmmU/Yd0IiZNfNrI/AAAAAAAA7rE/Nvnbcz3-2Jc6ood3LxnZkR8sqOKAN2AyACK4BGAYYCw/w640-h590/scemu_6_msgbox-792923.png x86 32bits emulator, for securely emulating shellcodes. Features*

rust safety, good for malware.
* All dependencies are in rust.
* zero unsafe{} blocks.

*
very fast emulation (much faster than unicorn)

* 3,000,000 instructions/second
* 100,000 instructions/second printing every instruction -vv.

* powered by iced-x86 rust dissasembler awesome library.
* iteration detector.
* memory and register tracking.
* colorized.
* stop at specific moment and explore the state or modify it.
* 105 instructions implemented.
* 112 winapi implemented of 5 dlls.
* all linux syscalls.
* SEH chains.
* vectored exception handler.
* PEB, TEB structures.
* memory allocator.
* react with int3.
* non debugged cpuid.
* tests with known payloads:
* metasploit shellcodes.
* metasploit encoders.
* cobalt strike.
* shellgen.
* guloader (not totally for now, but arrive further than the debugger) TODO- more fpu
- mmx
- 64 bits
- scripting? Usageemulator for Shellcodes 0.2.5 @sha0coder USAGE: scemu [FLAGS] [OPTIONS] FLAGS: -e, --endpoint perform communications with the endpoint, use tor or vpn! -h, --help Prints help information -l, --loops show loop interations, it is slow. -m, --memory trace all the memory accesses read and write. -n, --nocolors print without colors for redirectin to a file >out -r, --regs print the register values in every step. -V, --version Prints version information -v, --verbose -vv for view the assembly, -v only messages, without verbose only see the api calls and goes faster OPTIONS: -b, --base
set base address for code -c, --console SCEMU 32bits emulator for Shellcodes 0.2.5
@sha0coder

USAGE:
scemu [FLAGS] [OPTIONS]

FLAGS:
-e, --endpoint perform communications with the endpoint, use tor or vpn!
-h, --help Prints help information
-l, --loops show loop interations, it is slow.
-m, --memory trace all the memory accesses read and write.
-n, --nocolors print without colors for redirectin to a file >out
-r, --regs print the register values in every step.
-V, --version Prints version information
-v, --verbose -vv for view the assembly, -v only messages, without verbose only see the api calls and goes
faster

OPTIONS:
-b, --base
set base address for code
-c, --console Some use casesscemu emulates a simple shellcode detecting the execve() interrupt. http://2.bp[...]

___________________________
@hacking_Attack
@Hacking_Video

.blogspot.com/-qNQ5q3Spbf0/Yd0IhCYWZYI/AAAAAAAA7qA/oniux8_y6JYbLl-sgPDvuX2nHvLPQsQYwCK4BGAYYCw/s320/scemu_1_basic_shellcode1-788247.png We select the line to stop and inspect the memory. http://4.bp.blogspot.com/-51pZyNz0qCE/Yd0IhRwPxKI/AAAAAAAA7qQ/WuCftH0l-wUvdSKZH-Fs0hq8v6yciAeeQCK4BGAYYCw/s320/scemu_2_basic_shellcode2-788892.png After emulating near 2 million instructions of GuLoader win32 in linux, faking cpuid's and other tricks in the way, arrives to a sigtrap to confuse debuggers. http://3.bp.blogspot.com/--6w8xZy_ZyI/Yd0IhnPldGI/AAAAAAAA7qg/CMO8Xa6nF8YDKam2crKPJZDfTEbetwf1wCK4BGAYYCw/s320/scemu_3_guloader1-790431.png Example of memory dump on the api loader. http://1.bp.blogspot.com/-fXj45mxTZJM/Yd0IhwWu4pI/AAAAAAAA7qw/1MOO6eys_GYUJvMhje6j2mJxPa-pLQFzwCK4BGAYYCw/s320/scemu_4_memdump-791285.png There are several maps by default, and can be created more with apis like LoadLibraryA or manually from the console. http://2.bp.blogspot.com/-7lPZV5BxcAA/Yd0IiBAuAHI/AAAAAAAA7q8/t_Y4KBHWeEwztnhohR_61VGz5pZ00LwAACK4BGAYYCw/s320/scemu_5_maps-792226.png Emulating basic windows shellcode based on LdrLoadDLl() that prints a message: http://4.bp.blogspot.com/-N71EhQnNmmU/Yd0IiZNfNrI/AAAAAAAA7rE/Nvnbcz3-2Jc6ood3LxnZkR8sqOKAN2AyACK4BGAYYCw/s320/scemu_6_msgbox-792923.png The console allow to view an edit the current state of the cpu: --- console ---
=>h
--- help ---
q ...................... quit
cls .................... clear screen
h ...................... help
s ...................... stack
v ...................... vars
r ...................... register show all
r reg .................. show reg
rc ..................... register change
f ...................... show all flags
fc ..................... clear all flags
fz ..................... toggle flag zero
fs ..................... toggle flag sign
c ...................... continue
ba ..................... breakpoint on address
bi ..................... breakpoint on instruction number
bmr .................... breakpoint on read memory
bmw .................... breakpoint on write memory
bc ..................... clear breakpoint
n ...................... next instruction
eip .................... change eip
push .............. ..... push dword to the stack
pop .................... pop dword from stack
fpu .................... fpu view
md5 .................... check the md5 of a memory map
seh .................... view SEH
veh .................... view vectored execption pointer
m ...................... memory maps
ma ..................... memory allocs
mc ..................... memory create map
mn ..................... memory name of an address
ml ..................... memory load file content to map
mr ..................... memory read, speficy ie: dword ptr [esi]
mw ..................... memory read, speficy ie: dword ptr [esi] and then: 1af
md ..................... memory dump
mrd .................... memory read dwords
mds .................... memory dump string
mdw .................... memory dump wide string
mdd .................... memory dump to disk
mt ..................... memory test
ss ..................... search str ing
sb ..................... search bytes
sba .................... search bytes in all the maps
ssa .................... search string in all the maps
ll ..................... linked list walk
d ...................... dissasemble
dt ..................... dump structure
enter .................. step into The cobalt strike api loader is the same that metasploit, emulating it: http://1.bp.blogspot.com/-pFYtmmYQB8Q/Yd0Iifp0uhI/AAAAAAAA7rM/12pwFZ8cY_IH1LhLcDBTnh312_uxG8JvACK4BGAYYCw/s320/scemu_7_metasploit_api_loader-793605.png Cobalt Strike API called: http://3.bp.blogspot.com/-Gthz8MdUevo/Yd0Iioc5S3I/AAAAAAAA7rU/74uJ-hrqYrs7t9FqTGvltQl-va3IbGpHgCK4BGAYYCw/s320/scemu_8_cobalt_strike-794286.png Metasploit rshell API called: http://4.bp.blogspot.com/-GXThx5RgZVw/Yd0Ii6qhRtI/AAAAAAAA7rc/6wiR8-k1A[...]

___________________________
@hacking_Attack
@Hacking_Video

n4tgJzVmceaPOqhQ2WlahhqACK4BGAYYCw/s320/scemu_9_metasploit_rshell-794960.png Metasploit SGN encoder using few fpu to hide the polymorfism: http://2.bp.blogspot.com/-OEs6DY_9l94/Yd0IjGtGNeI/AAAAAAAA7rk/Oym8ekDdqSML4MbfuXJn83xOfboH3Q4MwCK4BGAYYCw/s320/scemu_10_msf_encoded-795915.png Metasploit shikata-ga-nai encoder that also starts with fpu: http://1.bp.blogspot.com/-Mt_mI5BeyUU/Yd0IjcjMHzI/AAAAAAAA7rs/l--mcJCKcCg2eSCOs9dOkHgeroNBkIsywCK4BGAYYCw/s320/scemu_11_shikata-796838.png Displaying PEB structure: =>dt
structure=>peb
address=>0x7ffdf000
PEB {
reserved1: [
0x0,
0x0,
],
being_debugged: 0x0,
reserved2: 0x0,
reserved3: [
0xffffffff,
0x400000,
],
ldr: 0x77647880,
process_parameters: 0x2c1118,
reserved4: [
0x0,
0x2c0000,
0x77647380,
],
alt_thunk_list_ptr: 0x0,
reserved5: 0x0,
reserved6: 0x6,
reserved7: 0x773cd568,
reserved8: 0x0,
alt_thunk_list_ptr_32: 0x0,
reserved9: [
0x0,
... Displaying PEB_LDR_DATA structure: =>dt
structure=>PEB_LDR_DATA
address=>0x77647880
PebLdrData {
length: 0x30,
initializated: 0x1,
sshandle: 0x0,
in_load_order_module_list: ListEntry {
flink: 0x2c18b8,
blink: 0x2cff48,
},
in_memory_order_module_list: ListEntry {
flink: 0x2c18c0,
blink: 0x2cff50,
},
in_initialization_order_module_list: ListEntry {
flink: 0x2c1958,
blink: 0x2d00d0,
},
entry_in_progress: ListEntry {
flink: 0x0,
blink: 0x0,
},
}
=> Displaying LDR_DATA_TABLE_ENTRY and first module name =>dt
structure=>LDR_DATA_TABLE_ENTRY
address=>0x2c18c0
LdrDataTableEntry {
reserved1: [
0x2c1950,
0x77647894,
],
in_memory_order_module_links: ListEntry {
flink: 0x0,
blink: 0x0,
},
reserved2: [
0x0,
0x400000,
],
dll_base: 0x4014e0,
entry_point: 0x1d000,
reserved3: 0x40003e,
full_dll_name: 0x2c1716,
reserved4: [
0x0,
0x0,
0x0,
0x0,
0x0,
0x0,
0x0,
0x0,
],
reserved5: [
0x17440012,
0x4000002c,
0xffff0000,
],
checksum: 0x1d6cffff,
reserved6: 0xa640002c,
time_date_stamp: 0xcdf27764,
}
=> A malware is hiding something in an exception 3307726 0x4f9673: push ebp
3307727 0x4f9674: push edx
3307728 0x4f9675: push eax
3307729 0x4f9676: push ecx
3307730 0x4f9677: push ecx
3307731 0x4f9678: push 4F96F4h
3307732 0x4f967d: push dword ptr fs:[0]
Reading SEH 0x0
-------
3307733 0x4f9684: mov eax,[51068Ch]
--- console ---
=> Let's inspect exception structures: --- console ---
=>r esp
esp: 0x22de98
=>dt
structure=>cppeh_record
address=>0x22de98
CppEhRecord {
old_esp: 0x0,
exc_ptr: 0x4f96f4,
next: 0xfffffffe,
exception_handler: 0xfffffffe,
scope_table: PScopeTableEntry {
enclosing_level: 0x278,
filter_func: 0x51068c,
handler_func: 0x288,
},
try_level: 0x288,
}
=> And here we have the error routine 0x4f96f4 and the filter 0x51068c Download Scemu

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
vx-underground on Twitter

https://external-preview.redd.it/gnwjcns0s0-kvzIb3x03uiPo_53XNfCveoKYoaUxGGk.jpg?width=320&crop=smart&auto=webp&s=0b8c4874e237aaf3f2efe6b5aae1a7c0ad9e97dd submitted by /u/bawlachora
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What Is the Common Vulnerability Scoring System (CVSS) in Cybersecurity?

https://external-preview.redd.it/9FxDKxXElc5UgxaVcTe6FK4RzLeYepLoKeuOCxoTI1Y.jpg?width=640&crop=smart&auto=webp&s=2c62834d6ad627cbd4280379f66317670de17dad submitted by /u/joe691013
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Androids and offer walls

ok so im sure most people have seen offer walls such as adgem, theres gotta be a way to hack the games on these to make some quick bucks especially offline games. so say i used a rooted phone disconnected from internet changed some values then reconnect and complete the offer do you think this would work or would they know i tampered with it.

submitted by /u/93GrimReefer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Am I too worried?

I encounter something like a 80/20 ratio of people interested in learning about hacking for curiosity and making the world safer. The latter simply want a quick solution to some petty problem: "help me hack into my gf IG" etc. Or they want to know how to do black hat things.

Anyone who's done HTB knows it's trivial to exploit many things, and generally causing damage is easy compared to defending.

So what happens in the future? Who's gonna play defense? If there's 8 attackers for every 2 defenders and they only need one payload to slip through... Are we doomed?

submitted by /u/x21x23
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Lend a hand?

Does anyone know how to remove an improperly placed Apple mdm profile. Someone who had access to my devices set up profiles on my Mac and iPhone and now I can’t log into my MacBook. Any advice would be great.

submitted by /u/BangoutBlanc
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cybersecurity Sessions #2: Drone Safety and Cybersecurity

https://cdn-images-1.medium.com/max/1920/0*k9CIVSgDNhnLuS-X.jpg
Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Steganography — যেভাবে হ্যাকাররা তথ্য লুকায়

https://cdn-images-1.medium.com/max/1640/1*TQKH8oLRNSj0u227h_oaPg.png
প্রাচীনকাল থেকেই যোগাযোগ বা তথ্য সংগ্রহ করে রাখার জন্য গোপনীয়তার প্রয়োজন হয়ে আসছে। যুদ্ধক্ষেত্রে গোপন নির্দেশনা পাঠানো, শত্রুর চোখের আড়াল…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Launching Collector Portal for a closed beta group

We are proud to announce our beta platform launch for selected users starting on the 26th of January.Continue reading on Envoy »
Read more...

Launching Collector Portal for a closed beta group
https://medium.com/envoynetwork/launching-collector-portal-for-a-closed-beta-group-5f06a50a42fb?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

We are proud to announce our beta platform launch for selected users starting on the 26th of January.Continue reading on Envoy » (https://medium.com/envoynetwork/launching-collector-portal-for-a-closed-beta-group-5f06a50a42fb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Why Bugfix Postmortems Are Good For Web3
https://medium.com/immunefi/why-bugfix-postmortems-are-good-for-web3-a400f350adb0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This past year has been eventful for anyone building on the Web3 stack — over the course of the year, DeFi has grown from a nascent…Continue reading on Immunefi » (https://medium.com/immunefi/why-bugfix-postmortems-are-good-for-web3-a400f350adb0?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video