Kali Linux Tutorials
Kit_Hunter : A Basic Phishing Kit Scanner For Dedicated And Semi-Dedicated Hosting

Kit_Hunter is a personal project to learn Python, and a basic scanning tool that will search directories and locate phishing kits based on established markers. As detection happens, a report is generated for administrators.

By default the script will generate a report that shows the files that were detected as potentially problematic, list the markers that indicated them as problematic (a.k.a. tags), and then show the exact line of code where the detection happened.
https://blogger.googleusercontent.com/img/a/AVvXsEhoP2qqV0hUngEm6LanuEVG_d1Q1OpTURRUGx2tjCbam9C88uP3XUnWM-OtRpwizI4J7ewLmKKs3r2NjFiQjvC3yeXmGCok_Uj8kxc-aGJlyk4VwTngpivZKFpA6H-9ZSH1wDWhQ-0Uv-W1izzNZTGOLBuxh-lFa6IjM--90IOUW1oKdV4ituQ_zU8E=s707
Usage

Help

To get quick help: python3 kit_hunter_2.py -hDefault scan

To launch a full scan using the default settings: python3 kit_hunter_2.pyQuick scan

To launch a quick scan, using minimal detection rules: python3 kit_hunter_2.py -qCustom scan

To launch a custom scan: python3 kit_hunter_2.py -cNote: When using the -cswitch, you must place a tag file in the same location as Kit Hunter. You can name this file whatever you want, but the extension must be .tag. Please remember that the formatting is important. There should only be one item per line, and no whitespaces. You can look at the other tag files if you need examples. Directory selected scanning

You can run kit_hunter_2.pyfrom any location using the -dswitch to select a directory to scan: python3 kit_hunter_2.py -d /path/to/directoryHowever, it is easier if you place kit_hunter_2.pyin the directory above your web root (e.g. /www/or /public_html/) and call the script from there.

The final report will be generated in the directory being scanned.

In my usage, I call Kit Hunter from my /kit/download/directory where new phishing kits are saved. My reports are then generated and saved to that folder. However, if I call Kit Hunter and scan my /PHISHING/Archive/folder using the -dswitch, then the report will save to /PHISHING/Archive/. Shell detection

This latest release of Kit Hunter comes with shell detection. Shell scripts are often packaged with phishing kits, or used to deploy phishing kits on webservers. Kit Hunter will scan for some common shell script elements. The process works exactly the same way as regular scanning, only the shell detections are called with the -sswitch. This is a standalone scan, so you can’t run it with other types. You can however leverage the -mand -lflags with shell scanning. See the script’s help section for more details.

Once scanning is complete, output from the script will point you to the location of the saved scan report. Tag Files

When it comes to the tag files, there are 41 tag files shipping with v2.5.8 Kit Hunter. These tag files detect targeted phishing campaigns, as well as various types of phishing tricks, such as obfuscation, templating, theming, and even branded kits like Kr3pto and Ex-Robotos. New tag files will be added, and existing tag files will be updated on a semi-regular basis. See the changelog for details.

As was the case with v1.0, the longer the tag file is, the longer it will take for the script to read it. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Digital-Forensics-Lab : Free Hands-On Digital Forensics Labs For Students And Faculty

Digital-Forensics-Lab is a Free Hands-On Digital Forensics Labs For Students And Faculty.

Features Of Repository

* Hands-on Digital Forensics Labs: designed for Students and Faculty
* Linux-based lab: All labs are purely based on Kali Linux
* Lab screenshots: Each lab has PPTs with instruction screenshots
* Comprehensive: Cover many topics in digital forensics
* Free: All tools are open source
* Updated: The project is funded by DOJ and will keep updating
* Two formalized forensic intelligence in JSON files based-on case studies

Tool Installation (newly added on 12/6/2021) Method 1: Importing customized Kali VM image

The customized Kali VM = Kali (2020.4) + tools used for completing most of the labs listed above (except p2p Data Leakage case)

* Install Virtualbox
* Import the customized Kali 2020.4. Notes: the default harddisk size is 80G. Method 2: Installing tools using the customized script (the script ONLY is tested on Kali 2020.4)

The following script will install tools needed for completing most of the labs listed above (except p2p Data Leakage case, which has its own script described in PPTs). Please let us know if you need us to add more tools to the script.

* Install Virtualbox
* Install Kali 2020.4. Notes: Suggest You configure the disk size of Kali VM 80G because the size of each leakage cases image is 30G+
* How to run the installation script instructions, or you can simply follow the commands below

wget https://raw.githubusercontent.com/frankwxu/digital-forensics-lab/main/Help/tool-install-zsh.sh
chmod +x tool-install-zsh.sh
./tool-install-zsh.sh

Installed tools. Note that most of the commands for tools can executed globally. Now you can skip most of tool installation steps in PPTs.

Investigating NIST Data Leakage

The case study is to investigate an image involving intellectual property theft. The study include

* A large and complex case study created by NIST. You can access the Scenario, DD/Encase images. You can also find the solutions on their website.
* 14 hands-on labs/topics in digital forensics

Topics Covered
LabsTopics CoveredSize of PPTsLab 0Environment Setting Up2MLab 1Windows Registry3MLab 2Windows Event and XML3MLab 3Web History and SQL3MLab 4Email Investigation3MLab 5File Change History and USN Journal2MLab 6Network Evidence and shellbag2MLab 7Network Drive and Cloud5MLab 8Master File Table ($MFT) and Log File ($logFile) Analysis13MLab 9Windows Search History4MLab 10Windows Volume Shadow Copy Analysis6MLab 11Recycle Bin and Anti-Forensics3MLab 12Data Carving3MLab 13Crack Windows Passwords2M Investigating P2P Data Leakage

The P2P data leakage case study is to help students to apply various forensic techniques to investigate intellectual property theft involving P2P. The study includes

* A large and complex case involving a uTorrent client. The case is similar to NIST data leakage lab. However, it provides a clearer and more detailed timeline.
* Solid evidence with explanations. Each evidence that is associated with each activity is explained along with the timeline.
* 10 hands-on labs/topics in digital forensics

Topics Covered
LabsTopics CoveredSize of PPTsLab 0Lab Environment Setting Up4MLab 1Disk Image and Partitions5MLab 2Windows Registry and File Directory15MLab 3MFT Timeline6MLab 4USN Journal Timeline3MLab 5uTorrent Log File9MLab 6File Signature8MLab 7Emails9MLab 8Web History11MLab 9Website Analysis2MLab 10Timeline (Summary)13K Investigating Illegal Possession of Images

The case study is to investigate the illegal possession of Rhino images. This image was contributed by Dr. Golden G. Richard III, and was originally used in the DFRWS 2005 RODEO CHALLENGE. NIST hosts the USB DD image. A copy of the image is also available in the repository.[...]

___________________________
@hacking_Attack
@Hacking_Video

Topics Covered
LabsTopics CoveredSize of PPTsLab 0HTTP Analysis using Wireshark (text)3MLab 1HTTP Analysis using Wireshark (image)6MLab 2Rhion Possession Investigation 1: File recovering9MLab 3Rhion Possession Investigation 2: Steganography4MLab 4Rhion Possession Investigation 3: Extract Evidence from FTP Traffic3MLab 5Rhion Possession Investigation 4: Extract Evidence from HTTP Traffic5M Investigating Email Harassment

The case study is to investigate the harassment email sent by a student to a faculty member. The case is hosted by digitalcorpora.org. You can access the senario description and network traffic from their website. The repository only provides lab instructions.

Topics Covered
LabsTopics CoveredSize of PPTsLab 0Investigating Harassment Email using Wireshark3MLab 1t-shark Forensic Introduction2MLab 2Investigating Harassment Email using t-shark2M Investigating Illegal File Transferring

The case study is to investigate computer memory for reconstructing a timeline of illegal data transferring. The case includes a scenario of transfer sensitive files from a server to a USB.

Topics Covered
LabsTopics CoveredSize of PPTsLab 0Memory Forensics11Mpart 1Understand the Suspect and Accountspart 2Understand the Suspect’s PCpart 3Network Forensicspart 4Investigate Command Historypart 5Investigate Suspect’s USBpart 6Investigate Internet Explorer Historypart 7Investigate File Explorer Historypart 8Timeline Analysis Investigating Hacking Case

The case study, including a disk image provided by NIST is to investigate a hacker who intercepts internet traffic within range of Wireless Access Points.

Topics Covered
LabsTopics CoveredSize of PPTsLab 0Hacking Case8M Investigating Android 10

The image is created by Joshua Hickman and hosted by digital corpora.
LabsTopics CoveredSize of PPTsLab 0Intro Pixel 33MLab 1Pixel 3 Image2MLab 2Pixel 3 Device4MLab 3Pixel 3 System Setting5MLab 4Overview: App Life Cycle11MLab 5.1.1AOSP App Investigations: Messaging4MLab 5.1.2AOSP App Investigations: Contacts3MLab 5.1.3AOSP App Investigations: Calendar1MLab 5.2.1GMS App Investigations: Messaging6MLab 5.2.2GMS App Investigations: Dialer2MLab 5.2.3GMS App Investigations: Maps8MLab 5.2.4GMS App Investigations: Photos6MLab 5.3.1Third-Party App Investigations: Kik4MLab 5.3.2Third-Party App Investigations: textnow1MLab 5.3.3Third-Party App Investigations: whatapp3MLab 6Pixel 3 Rooting5M Investigating Drone DJI

The dataset includes logical files extracted from a DJI controller (mobile device) and a SD card image used by the device. The Drone dataset is created by VTO Labs. The lab covers GPS investigation and cached image retrieval. Note that it is a draft. We will improve the lab later.
LabsTopics CoveredSize of PPTsLab 0DJI Mavic Air Mobile13MLab 1DJI Mavic Air MicroSD Raw2MLab 2DJI Mavic Air MicroSD Encase Format2M Tools

* Commands tested
NameCommandRepositoryInstallation MethodWinewine –versionhttps://source.winehq.org/git/wine.git/CustomVinettovinetto -hhttps://github.com/AtesComp/VinettoCustomimgclipimgclip -hhttps://github.com/Arthelon/imgclipapt installRegRipperrip.pl -hhttps://github.com/keydet89/RegRipper3.0Customized scirptWindows-Prefetch-Parserprefetch.py -hhttps://github.com/PoorBillionaire/Windows-Prefetch-Parser.gitCustompython-evtxevtx_dump.py -hhttps://github.com/williballenthin/python-evtxapt installlibesedb-utilsesedbexport -hhttps://github.com/libyal/libesedbapt installlibpffpffexport -hhttps://github.com/libyal/libpffapt installUSN-Record-Carverusncarve.py -hhttps://github.com/PoorBillionaire/USN-Record-Carverapt installUSN-Journal-Parserusn.py -hhttps://github.com/PoorBillionaire/USN-Journal-Parserapt installtime_decodetime_decode.py -hhttps://github.com/digitalsleuth/time_decodeGit cloneanalyzeMFTanalyzeMFT.py -hhttps://github.com/dkovar/analyzeMFTCustomized scirptlibvshadowvshadowinfo -hhttps://github.com/libyal/libvshadowCustomized scirptINDXParseINDXParse.py –Customized scirptcarving sq[...]

___________________________
@hacking_Attack
@Hacking_Video

lite .dbundark -hhttps://github.com/inflex/undark.gitCustomized scirptstegdetectstegdetect -VCustomized scirptstegbreakstegbreak -VCustomized scirptstego-toolkitjphideCustomized scirptjpsestego-toolkitekjpseekCustomized scirptvolatility-2vol.py -hhttps://github.com/volatilityfoundation/volatility.gitCustomized scirptliblnk-utilslnkinfo -hapt installJLECmdhttps://f001.backblazeb2.com/file/EricZimmermanTools/JLECmd.zipGit clonerecentfilecache-parserhttps://github.com/prolsen/recentfilecache-parserLogFileParserhttps://github.com/jschicht/LogFileParser.gitGit cloneUsnJrnl2Csvttps://github.com/jschicht/UsnJrnl2Csv.gitGit clone
* Other tools installed via apt install python3-pip, leafpad, terminator, sqlite3, tree, xmlstarlet, libhivex-bin, pasco, libhivex-bin, npm, binwalk, foremost, hashdeep, ewf-tools, nautilus Download

___________________________
@hacking_Attack
@Hacking_Video

Creating easy proof-of-concept scripts with Python and Curl.
https://medium.com/@wyv3rn/creating-easy-proof-of-concept-scripts-with-python-and-curl-5dca489c596b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Hunters!Continue reading on Medium » (https://medium.com/@wyv3rn/creating-easy-proof-of-concept-scripts-with-python-and-curl-5dca489c596b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My Pentest Log -4-
https://hcibo.medium.com/my-pentest-log-4-82286fe42994?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Greetings from Constantinople to all,Continue reading on Medium » (https://hcibo.medium.com/my-pentest-log-4-82286fe42994?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Without Permit: Multichain’s exploit explained

https://cdn-images-1.medium.com/max/2312/1*4GCKLregfgjnkzinTd7izA.png
A few days ago Multichain’s users were hacked by several attackers groups, all abusing the same vulnerability in Multichain (previously…

Continue reading on ZenGo »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Enumerating Domain Trusts in Active Directory

https://cdn-images-1.medium.com/max/2600/1*T73uQze7HG-aqyS17VBAYg.jpeg
Understanding Active Directory trusts within domains and forests using PowerView

Continue reading on R3d Buck3T »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
MICROCHIPS ARE GETTING UNDER THE SKIN OF THOUSANDS IN SWEDEN

https://cdn-images-1.medium.com/max/1023/0*isR1Q1NWgMw7KOBQ
Microchips implanted into one’s body is considered to make everyday life convenient and they open a perspective to replace traditional…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Termux COVID-19 Tracker : Get Instant Covid Case Report in Termux CLI

https://cdn-images-1.medium.com/max/600/0*s9Q3Ay6gyD8HkwCL
HomeScripts Termux COVID-19 Tracker : Get Instant Covid Case Report in Termux CLI 📲

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Process Ghosting Attack

IntroductionGabriel Landau released a post on Elastic Security here which talks about a technique through which antivirus evasion was found to be possible. The technique deals with creating a ghost process which is a term used by the author to describe the mechanism of deleting the payload from the disk before running it, essentially making it a ghost. Table of Content* Process Creation and Security Gap
* Executables, Processes, and Threads
* Creation of Process
* Process Ghosting
* Process Ghosting demo using SharpGhosting
* Conclusion Process Creation and Security GapIn the Windows ecosystem, anti-virus solution developers call APIs (like PsSetCreateProcessNotifyRoutineEx) that can intimate their AV solution about the execution of a particular process, however, the callbacks are not sent when the process executes, rather when the first thread within that process is executed. Hence, this gap between the creation of process and sending of notification of their creation to the anti-virus solution is where attackers can implement process ghosting. Executables, Processes, and ThreadsAn executable is that compiled file that contains the program that is to be run by the machine. Executables can have multiple functions to be performed and when each of these functions are run, it is called a process.

A process, in the simplest terms, is an executing program. Each process is linked to a specific PE (exe, dll etc). There can also be multiple processes from a single executable. This can be viewed in task manager -> details.

A thread is the basic unit of a process to which the OS allocates processor time. A thread can execute any part of the process code. Multiple threads exist in a process. Multi-threading means multiple threads running the same part of the process code. Windows supports multi-tasking thus as many threads can be created as many processors are available to run them simultaneously. It can have three states: running, ready and blocked. Creation of ProcessA process can be created in Windows using CreateProcess or NtCreateUserProcess function. This function is a combination of individually modifiable other functions that can operate on handles, section images, threads etc.

For example, CreateProcess (lpApplicationName) defines which application to execute. Process GhostingNow that we have covered the basics, let’s understand how to process ghosting works. It is a technique in which an attacker creates a file (malware), mark it for deletion (delete-pending state), copies/maps a malware into the memory (image section), close the handle (which deletes it from the disk), then create a process from the now-fileless section. Before understanding the attack we must know the following:

* Handles: Used for memory management, these are references to a resource in kernel space. These not only hold the information about a resource but also provides access rights.

int fh = open(“/etc/passwd”, O_RDWR);

fh is a file handle. When we opened a file using the open() function it returned a handle to variable fh. Now fh can be used to perform functions on the file like:

fh.read()

fh.append()

fh.close()

And also, a file being accessed by fh can’t be read, written in or executed by any other handle (or by any other process). fh.close() will close the handle to the file, i.e, the file won’t be accessed.

* Image Section: A section is the mapping of a file into memory. An image section is a special type of section that corresponds to Portable Executable (PE) files, and can only be created from PE (EXE, DLL, etc) files.
* Delete_Pending State: Like read, write, delete state that may exist for a file, Delete_Pending is a state in which a file is yet to be deleted. The file is not deleted yet because a handle may have kept it opened. As soon as[...]

___________________________
@hacking_Attack
@Hacking_Video

the handle will close, the file will be deleted. No other process can operate on this file in the Delete_Pending state.

Thus, the entire Process Ghosting flow looks like this:

1. Step 1: Create a file using NtCreateFile() function. This would create our intended malware. Also, would give us a file handle. like: hFile = NtCreateFile(C:\Users\a_cha\Desktop\random.exe)

hFile is the handle for this file

1. Step 2: Put the file in a delete_pending state. This can be done using NtSetInformationFile() function. By using the FileDispositionInformation flag, the file will be put in delete pending state. We can use hFile to perform this task on our file.

https://blogger.googleusercontent.com/img/a/AVvXsEjRLF861fOE-s2nlyPQEq0-iaiDQ2O84rdauQpABsio6lxxzUAoZlS6e5fXBA2bizAKHWCtjgDKDucFB1mEIOtM5L-TfMkeF1igO2qbYZ7WlUE6A7YJy92f1D8ar0VW4IqIqpjtY6J69ncsGVNunFj0-9NaMlhbnjKQF47ZBTNysQQxbVIiVldQGp1ZTA=s16000

1. Step 3: Write the payload (malware) to this newly created file. Since the file is in a delete_pending state, as soon as it closes, the data will vanish. But we’ll perform Step 4 before it vanishes!
2. Step 4: Image section of the file is created using function NtCreateSection(hFile, SEC_IMAGE). It can be done like: hSection = NtCreateSection(hFile, SEC_IMAGE). This is why our handle was needed, as NtCreateSection() takes in file handle as input. Now we can delete our handle safely.
3. Step 5: Delete our newly created handle. This would also delete our corresponding file (malware) from the disk, however, a copy of it still exists in the image section.
4. Step 6: Create a new process from the image section. As the code exists in virtual memory, new process can be created using NtCreateProcessEx(hSection) It will be done like hProcess = NtCreateProcessEx(hSection)
5. Step 7: Assign process arguments and environment variables. This is important as, without process arguments and environment variables, OS won’t execute the process and the code stays in a suspended state.
6. Step 8: Create a thread to execute in the process. Can be done using CreateThread() function and supplying starting address of the process to be executed.

Anti-Virus callbacks are invoked and the file blocked as soon as the thread is created for the malware’s execution. Since the thread is created after the file is deleted, anti-virus callbacks will never be invoked. Any attempts by anti-virus to open this file will throw a STATUS_FILE_DELETED error.

IkerSaint created a proof of concept for process ghosting attack called “KingHamlet” which can be downloaded here. This tool first encrypts the file and then perform the attack. Let’s run a quick demo and see how to process ghosting works. Process Ghosting demo using SharpGhostingBased on the methodology explained above, many POCs have come onto the surface since Gabriel’s post on Elastic Security. In this demo, we will be using a C# implementation of Process Ghosting developed by Wra7h. Before you try it, it is essential that you have an older Windows 10 version as Microsoft patched defender detection after this technique came onto the surface. If you are pentesting and find an older Windows 10, well you know what to do!

You can read the code on the github repo here.

https://blogger.googleusercontent.com/img/a/AVvXsEikNpOudadiRpNOSc5N7Ebn6nDftiI6J0ixNlSyykhzE2B6CdD5vF_ODgfobqwgWSUj7VDan97XMjkfFFSwwMqmedJ43Q_klSrsqC9hIIDp1W1Qd2uzlkjsLQCEOoaERlS_wd4up9SJ3HH-kj9NfcJ9ngN3yftP50rmDD6Wod7QRIgypWb3VVEIkGs0HA=s16000

You can compile this source code using the following command:
C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe /out:SharpGhost.exe /unsafe C:\ProcessGhosting\SharpGhosting-main\*.cs
Feel free to change the path as you please. Also, you’d need .NET framework v3.5 to compile it yourself

https://blogger.googleusercontent.com/img/a/AVvXsEj9fRoAZJn1v6hqaKzBP-SpmAQhvjnK26MqIdqcLjRtrlznZEJ5DRzhFNcQFV3ZU0gLMXWhfTGucVOHrUi6xYdb5eg-fOToJRI4Vsv0lKfXHb3Zhe2yzJjOObd_UD6ejs1O6L[...]

___________________________
@hacking_Attack
@Hacking_Video