Kali Linux Tutorials
ThreadBoat : Program Uses Thread Execution Hijacking To Inject Native Shell-code Into A Standard Win32 Application

ThreadBoat is a Program uses Thread Hijacking to Inject Native Shellcode into a Standard Win32 Application.

About

I developed this small project to continue my experiences of different code injection methods and to allow RedTeam security professionals to utilize this method as a unique way to perform software penetration testing. With Thread hijacking, it allows the hijacker.exe program to susepend a thread within the target.exe program allowing us to write shellcode to that target thread, and later be executed (via; WriteProcessMemory(), SetThreadContext(), ResumeThread(), CreateThread()).

Example GIF (Credits To Endgame)
https://blogger.googleusercontent.com/img/a/AVvXsEirSHxMxNwF5KmUw5oEQMobIsnih0D4pqb_uUL47Ab7v3UVuVOlcg3pba7R4cIKABISJrMdRJYEgWt9meeQgKoqYhvoUoVdJL5UmpmJhIbtAzSYbJ6llJwbDEU8h4FiMh9srkg7aB0nAg4lnztQOTfDop6CLe11qb61nVHP3n9hyWpiER3I4DHgRhYi=s640
Usage

int main()
{
System sys;
Interceptor incp;
Exception exp;
sys.returnVersionState();
if (sys.returnPrivilegeEscalationState())
{
std::cout <<
}
if (DWORD m_procId = incp.FindWin32ProcessId((PCHAR)m_win32ProcessName))
{
incp.ExecuteWin32Shellcode(m_procId);
}
system(“PAUSE”);
return 0;
}

Environment

* Windows Vista+sssss
* Visual C++

Libs

* Winapi
* user32.dll
* kernel32.dll

* ntdll.dll
Download

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Ivy

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: IvyPost Views: 110 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 5 Minutes

Offensive Security Tool: Ivy GitHub Link DescriptionStill, Social Engineering Attacks such as Phishing attacks that take place as part of an Offensive Security Solution require manually testing and crafting a payload that goes with the scenario. Although many FUDs (Fully Undetectable Payloads) in EXE formats can still be crafted, using VBS and Microsoft Office Files and this specific technique can bypass several mechanisms due to the way it executes arbitrary macro code into Visual Basic directly in Memory. The loader does this by utilizing programmatical access in the VBA object environment to load, decrypt and execute shellcode.

Ivy by optiv is a payload creation framework for the execution of arbitrary VBA (macro) source code in memory. Ivy’s loader does this by abusing programmatical access in the VBA object environment to load, decrypt, and execute shellcode. This technique is as close as possible to be truly fileless, as most fileless attacks these days require some sort of files being dropped on disk, as a result bypassing standard signature-based rules for detecting VBA code. Typical VBA payloads have the following characteristics:

* Exist in Macro enabled Office Documents
* These Macro Documents exist on disk
By running purely in memory, these behavior characteristics makes it harder to be detected by EDRs.

Ivy’s loaders are encrypted using RC4 encryption (AES encryption causes a lot of bloat and takes forever for VBA to decrypt) and then broken into separate strings, preventing any sandboxing from recognizing these strings as encrypted strings that should be investigated. This also prevents any decoding mechanism from recognizing these payloads as anything but garbage characters.

Ivy’s loader first performs a registry query to enable “Trust access to the VBA project object mode”. This registry key value is stored in user-mode which allows the user to modify the value without requiring any elevated permissions. The registry value is set from a zero to 1; if the registry key does not exist Ivy will create it with a value of “1”. With this value enabled, programmatical access is allowed to the VBA object environment from a different process.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Trusted-Access.png

Once this is done the loader will then spawn a hidden Excel process and load the encrypted strings into a VBA function. This is done by using ActiveX to simulate the GUI actions of doing the same task. This helps bypass a lot of traditional controls in place to monitor for execution. As a result, the decrypt function and shellcode are moved from one memory buffer to another, never touching disk. Finally, the loader uses command-GUI calls and executes the run function, which simulates the act of clicking on the run macro button in the GUI panel of VBA, beginning the decryption function, followed by the actual execution of the shellcode. IMPORTANTThe target endpoint must have Microsoft Office installed and activated in order to run because Ivy relies on a abusing the programmatically access to the VBA environment of Microsoft office.
See Also: AWS fixes security flaws that exposed AWS customer data EDR Unhook ModeThis allows Ivy to use low-level system calls to build its own version of the Windows function WriteProcessMemory by referencing the direct memory address and register values indirectly. Ivy can overwrite sections of memory that are not writable without calling any of the memory ch[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tool: Ivy

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Raven - Advanced Cyber Threat Map (Simplified, Customizable, Responsive)

___________________________
@hacking_Attack
@Hacking_Video

https://a.thumbs.redditmedia.com/62MjFeue5RSEGbO9rGqsnoI2dyhBOWwQVVrYXSSyG-8.jpg submitted by /u/GidonC
[link] [comments]

https://b.thumbs.redditmedia.com/oU9MeGpIdhchFm5s1XwESEuNFQbvekHYVIDSvdY4DTw.jpg I have just set up the raspberry os and trying to access the internet. So initially I found that it sets default nameserver as local router gateway IP (here 192.168.1.1)

So I tried updating it with google DNS servers from here https://developers.google.com/speed/public-dns/docs/using and showing below.

​

https://preview.redd.it/gnrjqnzronb81.png?width=1280&format=png&auto=webp&s=66a2a602b903fa2760d4781a0602e216dab5c114

Even after restarting the networking network manager and rebooting, I am unable to ping the domains but IP addresses are working

submitted by /u/tbhaxor
[link] [comments]

hacking: security in practice
A good updated book to start and learn hacking in 2022.

Any recommendations?

submitted by /u/Electronic_Leopard_2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What does it mean when the dumped yahoo passwords contain two characters ?

I browsed the Exploit.In data breach for curiosity. I checked for "yahoo" emails.

I found a lot of yahoo 2 - 3 characters passwords.

For example :

testemail@yahoo.fr:xyz

Yahoo used to allow any number of chars as password back then ?

​

Thanks in advance

submitted by /u/SnekIrl
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
11 Big Predictions for Cybersecurity in 2022

https://cdn-images-1.medium.com/max/1400/0*ongbLvVxLN9TPqeE.jpg
Cybersecurity ramps up in 2022

Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
So, this is PentestSuite 3

https://cdn-images-1.medium.com/max/2000/1*FEZqjQAFyyvwKkiC6JwtMA.png
Yes, the next version of Pentestsuite is on the way.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 5 Reasons Why Python Useful for Cybersecurity in 2022

https://cdn-images-1.medium.com/max/2600/1*bQKTs6RvBSCX7oTIw9-KyQ.jpeg
Cybersecurity is becoming increasingly crucial as firms become more digital. Hackers put confidential information at risk on a regular…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
1CAT CTF Writups (Մաս #1) — — Granny, MorisoCodvoram, Quack

https://cdn-images-1.medium.com/max/600/0*LEOQhc_y3UGyJ21G
Ահա երկար սպասումից հետո հրապարակում ենք 1CAT CTF մրցույթի խնդիրների լուծումները, գրված մասնակցող թիմերի կողմից։ Այս մասում Granny…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What's Next for Patch Management: Automation

The next five years will bring the widespread use of hyperautomation in patch management. Part 3 of 3.

Nim variant of MDSec's Parallel Syscalls EDR hook bypass
https://www.reddit.com/r/redteamsec/comments/s3x1ay/nim_variant_of_mdsecs_parallel_syscalls_edr_hook/

submitted by /u/DarkGrejuva (https://www.reddit.com/user/DarkGrejuva)
[link] (https://github.com/frkngksl/ParallelNimcalls) [comments] (https://www.reddit.com/r/redteamsec/comments/s3x1ay/nim_variant_of_mdsecs_parallel_syscalls_edr_hook/)

___________________________
@hacking_Attack
@Hacking_Video

My Pentest Log -2-
https://hcibo.medium.com/my-pentest-log-2-1d3bef931729?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video