This tool is an alternative to traditional fork and run execution for Cobalt Strike. The loader can be injected into any process, including the current Beacon. Long-running assemblies (https://www.kitploit.com/search/label/Assemblies) will continue to run and send output back to the Beacon, similar to the behavior of execute-assembly.
There are two components of inject-assembly: BOF initializer: A small program responsible for injecting the assembly (https://www.kitploit.com/search/label/Assembly) loader into a remote process with any arguments passed. It uses BeaconInjectProcess to perform the injection, meaning this behavior can be customized in a Malleable C2 profile or with process injection (https://www.kitploit.com/search/label/Injection) BOFs (as of version 4.5). PIC assembly loader: The bulk of the project. The loader will initialize the .NET runtime, load the provided assembly, and execute the assembly. The loader will create a new AppDomain in the target process so that the loaded assembly can be totally unloaded when execution is complete. Communication between the remote process and Beacon occurs through a named pipe. The Aggressor (https://www.kitploit.com/search/label/Aggressor) script generates a pipe name and then passes it to the BOF initializer. Notable Features Patches Environment.Exit() to prevent the remote process from exiting. .NET assembly header stomping (MZ bytes, e_lfanew, DOS Header, Rich Text, PE Header). Random pipe name generation based on SourcePoint (https://github.com/Tylous/SourcePoint). No blocking of the Beacon, even if the assembly is loaded into the current process. Usage Download (https://github.com/kyleavery/inject-assembly/releases) and load the inject-assembly.cna Aggressor script into Cobalt Strike. You can then execute assemblies using the following command: inject-assembly pid assembly [args...]
Specify 0 as the PID to execute in the current Beacon process. It is recommended to use another tool, like FindObjects-BOF (https://github.com/outflanknl/FindObjects-BOF), to locate a process that already loads the .NET runtime, but this is not a requirement for inject-assembly to function. Warnings Currently only supports x64 remote processes. There are several checks throughout the program to reduce the likelihood of crashing the remote process, but it could still happen. The default Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) process injection may get you caught. Consider a custom injection BOF or UDRL IAT hook. Some assemblies rely on Environment.Exit() to finish executing. This will prevent the loader's cleanup phase from occurring, but you can still disconnect the named pipe using jobkill. Uncomment lines 3 or 4 of scmain.c to enable error or verbose modes, respectively. These are disabled by default to reduce the shellcode size. References This project would not have been possible without the following projects: CLR-related definitions and implementation - https://github.com/TheWover/donut Beacon job interface and project structure - https://github.com/SecIdiot/netntlm (https://github.com/SolomonSklash/netntlm) Other features and inspiration were taken from the following resources: https://github.com/med0x2e/ExecuteAssembly https://github.com/anthemtotheego/InlineExecute-Assembly https://www.mdsec.co.uk/2020/08/massaging-your-clr-preventing-environment-exit-in-in-process-net-assemblies

Download Inject-Assembly (https://github.com/kyleavery/inject-assembly)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Mastering the Art of Cloud Tagging Using Data Science

Cloud tagging, the process of labeling cloud assets by certain attributes or operational values, can unlock behavioral insights to optimize and automate cyber asset management at scale.

Notetaking Question
https://www.reddit.com/r/Pentesting/comments/s677i5/notetaking_question/

Based off your experience or what you've seen at employers, with colleagues, etc. how do you organize your notes? I started using Obsidian and have been pondering the following question: How I should organize my notes? I've been absorbing as much practical knowledge, labs, content as possible and should I be doing a hierarchical or zettlekasten method of storing these notes or should I be doing a mix? I do utilize linking the pages together and using tags in Obsidian. And to add to this, probably what numerous users have asked....should I be using a different note taking app as well, I was split between Notion and Obsidian before I started Obsidian. I'd like some input and help on how you organize notes. And I suppose I should mention, when I get a pentesting job, I'll probably utilize the company recommended software or something separate for actual engagements so this post is simply for personal note taking. Thanks for taking the time to help, anything helps! Thanks! submitted by /u/kevinj895 (https://www.reddit.com/user/kevinj895)
[link] (https://www.reddit.com/r/Pentesting/comments/s677i5/notetaking_question/) [comments] (https://www.reddit.com/r/Pentesting/comments/s677i5/notetaking_question/)

___________________________
@hacking_Attack
@Hacking_Video

PORTSWIGGER WEB SECURITY - SQL INJECTION LAB ÇÖZÜMLERİ
https://ariarif.medium.com/portswigger-web-security-sql-injection-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-556a81c53dd5?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

PortSwigger Web Security, web güvenliği zafiyetlerini barındıran, Owasp top 10 zafiyetlerinin yer aldığı laboratuvarlardan oluşan bir web…Continue reading on Medium » (https://ariarif.medium.com/portswigger-web-security-sql-injection-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-556a81c53dd5?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Attacking RDP from Inside: How we abused named pipes for smart-card hijacking, unauthorized file system access to client machines and more
https://www.reddit.com/r/redteamsec/comments/s67ctt/attacking_rdp_from_inside_how_we_abused_named/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.cyberark.com/resources/threat-research-blog/attacking-rdp-from-inside) [comments] (https://www.reddit.com/r/redteamsec/comments/s67ctt/attacking_rdp_from_inside_how_we_abused_named/)

___________________________
@hacking_Attack
@Hacking_Video

IDOR leads to 2fa Bypass
https://medium.com/@arthbajpai277/idor-leads-to-2fa-bypass-3331cec2db64?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Everyone my name is Arth Bajpai and , I’m back with my another writeupContinue reading on Medium » (https://medium.com/@arthbajpai277/idor-leads-to-2fa-bypass-3331cec2db64?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Day 14, Set Up Environment for Pentesting #100DaysofHacking
https://infosecwriteups.com/day-14-set-up-environment-for-pentesting-100daysofhacking-f8069e91fcd2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Get all the writeups from Day 1 to 13, Click Here Or Click Here.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/day-14-set-up-environment-for-pentesting-100daysofhacking-f8069e91fcd2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Worktime 10.20 Build 4967 DLL Hijacking

https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
Worktime version 10.20 Build 4967 suffers from a dll hijacking vulnerability.

MD5 | 1b4f869012ea77e97e2c873843b08c74

Download
/*
Description:
A vulnerability exists in windows that allows other applications dynamic link libraries
to execute malicious code without the users consent, in the privelage context of the targeted application.

Exploit Title: Worktime 10.20 Build 4967 DLL Hijacking Exploit
Date: 15/01/2022
Author: Yehia Elghaly
Vendor: https://www.worktime.com/
Software: https://www.worktime.com/download/worktime_corporate.exe
Version: Latest Worktime 10.20 Build 4967
Tested on: Windows 7 Pro x86 - Windows 10 x64
Vulnerable extensions: .htm .html
Vulnerable DLL: (ibxml.dll - WINSTA.dll)
*/
Instructions:

1. Create dll using msfvenom (sudo msfvenom --platform windows -p windows/messagebox TEXT="Work Time Hacked - YME" -f dll > ibxml.dll) or compile the code
2. Replace ibxml.dll in Worktime directory C:\Program Files\WorkTimeAdministrator or C:\WorkTime with your newly dll
3. Launch WorkTimeServer.exe or WorkTimeAdministrator.exe
4. PoP UP MessageBox!
#include
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video