Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
MICROCHIPS ARE GETTING UNDER THE SKIN OF THOUSANDS IN SWEDEN
https://cdn-images-1.medium.com/max/1023/0*isR1Q1NWgMw7KOBQ
Microchips implanted into one’s body is considered to make everyday life convenient and they open a perspective to replace traditional…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
MICROCHIPS ARE GETTING UNDER THE SKIN OF THOUSANDS IN SWEDEN
https://cdn-images-1.medium.com/max/1023/0*isR1Q1NWgMw7KOBQ
Microchips implanted into one’s body is considered to make everyday life convenient and they open a perspective to replace traditional…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
MICROCHIPS ARE GETTING UNDER THE SKIN OF THOUSANDS IN SWEDEN
Microchips implanted into one’s body is considered to make everyday life convenient and they open a perspective to replace traditional…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Termux COVID-19 Tracker : Get Instant Covid Case Report in Termux CLI
https://cdn-images-1.medium.com/max/600/0*s9Q3Ay6gyD8HkwCL
HomeScripts Termux COVID-19 Tracker : Get Instant Covid Case Report in Termux CLI 📲
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Termux COVID-19 Tracker : Get Instant Covid Case Report in Termux CLI
https://cdn-images-1.medium.com/max/600/0*s9Q3Ay6gyD8HkwCL
HomeScripts Termux COVID-19 Tracker : Get Instant Covid Case Report in Termux CLI 📲
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Termux COVID-19 Tracker : Get Instant Covid Case Report in Termux CLI 📲
HomeScripts Termux COVID-19 Tracker : Get Instant Covid Case Report in Termux CLI 📲
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Process Ghosting Attack
IntroductionGabriel Landau released a post on Elastic Security here which talks about a technique through which antivirus evasion was found to be possible. The technique deals with creating a ghost process which is a term used by the author to describe the mechanism of deleting the payload from the disk before running it, essentially making it a ghost. Table of Content* Process Creation and Security Gap
* Executables, Processes, and Threads
* Creation of Process
* Process Ghosting
* Process Ghosting demo using SharpGhosting
* Conclusion Process Creation and Security GapIn the Windows ecosystem, anti-virus solution developers call APIs (like PsSetCreateProcessNotifyRoutineEx) that can intimate their AV solution about the execution of a particular process, however, the callbacks are not sent when the process executes, rather when the first thread within that process is executed. Hence, this gap between the creation of process and sending of notification of their creation to the anti-virus solution is where attackers can implement process ghosting. Executables, Processes, and ThreadsAn executable is that compiled file that contains the program that is to be run by the machine. Executables can have multiple functions to be performed and when each of these functions are run, it is called a process.
A process, in the simplest terms, is an executing program. Each process is linked to a specific PE (exe, dll etc). There can also be multiple processes from a single executable. This can be viewed in task manager -> details.
A thread is the basic unit of a process to which the OS allocates processor time. A thread can execute any part of the process code. Multiple threads exist in a process. Multi-threading means multiple threads running the same part of the process code. Windows supports multi-tasking thus as many threads can be created as many processors are available to run them simultaneously. It can have three states: running, ready and blocked. Creation of ProcessA process can be created in Windows using CreateProcess or NtCreateUserProcess function. This function is a combination of individually modifiable other functions that can operate on handles, section images, threads etc.
For example, CreateProcess (lpApplicationName) defines which application to execute. Process GhostingNow that we have covered the basics, let’s understand how to process ghosting works. It is a technique in which an attacker creates a file (malware), mark it for deletion (delete-pending state), copies/maps a malware into the memory (image section), close the handle (which deletes it from the disk), then create a process from the now-fileless section. Before understanding the attack we must know the following:
* Handles: Used for memory management, these are references to a resource in kernel space. These not only hold the information about a resource but also provides access rights.
int fh = open(“/etc/passwd”, O_RDWR);
fh is a file handle. When we opened a file using the open() function it returned a handle to variable fh. Now fh can be used to perform functions on the file like:
fh.read()
fh.append()
fh.close()
And also, a file being accessed by fh can’t be read, written in or executed by any other handle (or by any other process). fh.close() will close the handle to the file, i.e, the file won’t be accessed.
* Image Section: A section is the mapping of a file into memory. An image section is a special type of section that corresponds to Portable Executable (PE) files, and can only be created from PE (EXE, DLL, etc) files.
* Delete_Pending State: Like read, write, delete state that may exist for a file, Delete_Pending is a state in which a file is yet to be deleted. The file is not deleted yet because a handle may have kept it opened. As soon as[...]
___________________________
@hacking_Attack
@Hacking_Video
Process Ghosting Attack
IntroductionGabriel Landau released a post on Elastic Security here which talks about a technique through which antivirus evasion was found to be possible. The technique deals with creating a ghost process which is a term used by the author to describe the mechanism of deleting the payload from the disk before running it, essentially making it a ghost. Table of Content* Process Creation and Security Gap
* Executables, Processes, and Threads
* Creation of Process
* Process Ghosting
* Process Ghosting demo using SharpGhosting
* Conclusion Process Creation and Security GapIn the Windows ecosystem, anti-virus solution developers call APIs (like PsSetCreateProcessNotifyRoutineEx) that can intimate their AV solution about the execution of a particular process, however, the callbacks are not sent when the process executes, rather when the first thread within that process is executed. Hence, this gap between the creation of process and sending of notification of their creation to the anti-virus solution is where attackers can implement process ghosting. Executables, Processes, and ThreadsAn executable is that compiled file that contains the program that is to be run by the machine. Executables can have multiple functions to be performed and when each of these functions are run, it is called a process.
A process, in the simplest terms, is an executing program. Each process is linked to a specific PE (exe, dll etc). There can also be multiple processes from a single executable. This can be viewed in task manager -> details.
A thread is the basic unit of a process to which the OS allocates processor time. A thread can execute any part of the process code. Multiple threads exist in a process. Multi-threading means multiple threads running the same part of the process code. Windows supports multi-tasking thus as many threads can be created as many processors are available to run them simultaneously. It can have three states: running, ready and blocked. Creation of ProcessA process can be created in Windows using CreateProcess or NtCreateUserProcess function. This function is a combination of individually modifiable other functions that can operate on handles, section images, threads etc.
For example, CreateProcess (lpApplicationName) defines which application to execute. Process GhostingNow that we have covered the basics, let’s understand how to process ghosting works. It is a technique in which an attacker creates a file (malware), mark it for deletion (delete-pending state), copies/maps a malware into the memory (image section), close the handle (which deletes it from the disk), then create a process from the now-fileless section. Before understanding the attack we must know the following:
* Handles: Used for memory management, these are references to a resource in kernel space. These not only hold the information about a resource but also provides access rights.
int fh = open(“/etc/passwd”, O_RDWR);
fh is a file handle. When we opened a file using the open() function it returned a handle to variable fh. Now fh can be used to perform functions on the file like:
fh.read()
fh.append()
fh.close()
And also, a file being accessed by fh can’t be read, written in or executed by any other handle (or by any other process). fh.close() will close the handle to the file, i.e, the file won’t be accessed.
* Image Section: A section is the mapping of a file into memory. An image section is a special type of section that corresponds to Portable Executable (PE) files, and can only be created from PE (EXE, DLL, etc) files.
* Delete_Pending State: Like read, write, delete state that may exist for a file, Delete_Pending is a state in which a file is yet to be deleted. The file is not deleted yet because a handle may have kept it opened. As soon as[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Process Ghosting Attack IntroductionGabriel Landau released a post on Elastic Security here which talks about a technique through which antivirus evasion was found to be possible. The technique deals with creating a ghost process which is…
the handle will close, the file will be deleted. No other process can operate on this file in the Delete_Pending state.
Thus, the entire Process Ghosting flow looks like this:
1. Step 1: Create a file using NtCreateFile() function. This would create our intended malware. Also, would give us a file handle. like: hFile = NtCreateFile(C:\Users\a_cha\Desktop\random.exe)
hFile is the handle for this file
1. Step 2: Put the file in a delete_pending state. This can be done using NtSetInformationFile() function. By using the FileDispositionInformation flag, the file will be put in delete pending state. We can use hFile to perform this task on our file.
https://blogger.googleusercontent.com/img/a/AVvXsEjRLF861fOE-s2nlyPQEq0-iaiDQ2O84rdauQpABsio6lxxzUAoZlS6e5fXBA2bizAKHWCtjgDKDucFB1mEIOtM5L-TfMkeF1igO2qbYZ7WlUE6A7YJy92f1D8ar0VW4IqIqpjtY6J69ncsGVNunFj0-9NaMlhbnjKQF47ZBTNysQQxbVIiVldQGp1ZTA=s16000
1. Step 3: Write the payload (malware) to this newly created file. Since the file is in a delete_pending state, as soon as it closes, the data will vanish. But we’ll perform Step 4 before it vanishes!
2. Step 4: Image section of the file is created using function NtCreateSection(hFile, SEC_IMAGE). It can be done like: hSection = NtCreateSection(hFile, SEC_IMAGE). This is why our handle was needed, as NtCreateSection() takes in file handle as input. Now we can delete our handle safely.
3. Step 5: Delete our newly created handle. This would also delete our corresponding file (malware) from the disk, however, a copy of it still exists in the image section.
4. Step 6: Create a new process from the image section. As the code exists in virtual memory, new process can be created using NtCreateProcessEx(hSection) It will be done like hProcess = NtCreateProcessEx(hSection)
5. Step 7: Assign process arguments and environment variables. This is important as, without process arguments and environment variables, OS won’t execute the process and the code stays in a suspended state.
6. Step 8: Create a thread to execute in the process. Can be done using CreateThread() function and supplying starting address of the process to be executed.
Anti-Virus callbacks are invoked and the file blocked as soon as the thread is created for the malware’s execution. Since the thread is created after the file is deleted, anti-virus callbacks will never be invoked. Any attempts by anti-virus to open this file will throw a STATUS_FILE_DELETED error.
IkerSaint created a proof of concept for process ghosting attack called “KingHamlet” which can be downloaded here. This tool first encrypts the file and then perform the attack. Let’s run a quick demo and see how to process ghosting works. Process Ghosting demo using SharpGhostingBased on the methodology explained above, many POCs have come onto the surface since Gabriel’s post on Elastic Security. In this demo, we will be using a C# implementation of Process Ghosting developed by Wra7h. Before you try it, it is essential that you have an older Windows 10 version as Microsoft patched defender detection after this technique came onto the surface. If you are pentesting and find an older Windows 10, well you know what to do!
You can read the code on the github repo here.
https://blogger.googleusercontent.com/img/a/AVvXsEikNpOudadiRpNOSc5N7Ebn6nDftiI6J0ixNlSyykhzE2B6CdD5vF_ODgfobqwgWSUj7VDan97XMjkfFFSwwMqmedJ43Q_klSrsqC9hIIDp1W1Qd2uzlkjsLQCEOoaERlS_wd4up9SJ3HH-kj9NfcJ9ngN3yftP50rmDD6Wod7QRIgypWb3VVEIkGs0HA=s16000
You can compile this source code using the following command:
C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe /out:SharpGhost.exe /unsafe C:\ProcessGhosting\SharpGhosting-main\*.cs
Feel free to change the path as you please. Also, you’d need .NET framework v3.5 to compile it yourself
https://blogger.googleusercontent.com/img/a/AVvXsEj9fRoAZJn1v6hqaKzBP-SpmAQhvjnK26MqIdqcLjRtrlznZEJ5DRzhFNcQFV3ZU0gLMXWhfTGucVOHrUi6xYdb5eg-fOToJRI4Vsv0lKfXHb3Zhe2yzJjOObd_UD6ejs1O6L[...]
___________________________
@hacking_Attack
@Hacking_Video
Thus, the entire Process Ghosting flow looks like this:
1. Step 1: Create a file using NtCreateFile() function. This would create our intended malware. Also, would give us a file handle. like: hFile = NtCreateFile(C:\Users\a_cha\Desktop\random.exe)
hFile is the handle for this file
1. Step 2: Put the file in a delete_pending state. This can be done using NtSetInformationFile() function. By using the FileDispositionInformation flag, the file will be put in delete pending state. We can use hFile to perform this task on our file.
https://blogger.googleusercontent.com/img/a/AVvXsEjRLF861fOE-s2nlyPQEq0-iaiDQ2O84rdauQpABsio6lxxzUAoZlS6e5fXBA2bizAKHWCtjgDKDucFB1mEIOtM5L-TfMkeF1igO2qbYZ7WlUE6A7YJy92f1D8ar0VW4IqIqpjtY6J69ncsGVNunFj0-9NaMlhbnjKQF47ZBTNysQQxbVIiVldQGp1ZTA=s16000
1. Step 3: Write the payload (malware) to this newly created file. Since the file is in a delete_pending state, as soon as it closes, the data will vanish. But we’ll perform Step 4 before it vanishes!
2. Step 4: Image section of the file is created using function NtCreateSection(hFile, SEC_IMAGE). It can be done like: hSection = NtCreateSection(hFile, SEC_IMAGE). This is why our handle was needed, as NtCreateSection() takes in file handle as input. Now we can delete our handle safely.
3. Step 5: Delete our newly created handle. This would also delete our corresponding file (malware) from the disk, however, a copy of it still exists in the image section.
4. Step 6: Create a new process from the image section. As the code exists in virtual memory, new process can be created using NtCreateProcessEx(hSection) It will be done like hProcess = NtCreateProcessEx(hSection)
5. Step 7: Assign process arguments and environment variables. This is important as, without process arguments and environment variables, OS won’t execute the process and the code stays in a suspended state.
6. Step 8: Create a thread to execute in the process. Can be done using CreateThread() function and supplying starting address of the process to be executed.
Anti-Virus callbacks are invoked and the file blocked as soon as the thread is created for the malware’s execution. Since the thread is created after the file is deleted, anti-virus callbacks will never be invoked. Any attempts by anti-virus to open this file will throw a STATUS_FILE_DELETED error.
IkerSaint created a proof of concept for process ghosting attack called “KingHamlet” which can be downloaded here. This tool first encrypts the file and then perform the attack. Let’s run a quick demo and see how to process ghosting works. Process Ghosting demo using SharpGhostingBased on the methodology explained above, many POCs have come onto the surface since Gabriel’s post on Elastic Security. In this demo, we will be using a C# implementation of Process Ghosting developed by Wra7h. Before you try it, it is essential that you have an older Windows 10 version as Microsoft patched defender detection after this technique came onto the surface. If you are pentesting and find an older Windows 10, well you know what to do!
You can read the code on the github repo here.
https://blogger.googleusercontent.com/img/a/AVvXsEikNpOudadiRpNOSc5N7Ebn6nDftiI6J0ixNlSyykhzE2B6CdD5vF_ODgfobqwgWSUj7VDan97XMjkfFFSwwMqmedJ43Q_klSrsqC9hIIDp1W1Qd2uzlkjsLQCEOoaERlS_wd4up9SJ3HH-kj9NfcJ9ngN3yftP50rmDD6Wod7QRIgypWb3VVEIkGs0HA=s16000
You can compile this source code using the following command:
C:\Windows\Microsoft.NET\Framework64\v3.5\csc.exe /out:SharpGhost.exe /unsafe C:\ProcessGhosting\SharpGhosting-main\*.cs
Feel free to change the path as you please. Also, you’d need .NET framework v3.5 to compile it yourself
https://blogger.googleusercontent.com/img/a/AVvXsEj9fRoAZJn1v6hqaKzBP-SpmAQhvjnK26MqIdqcLjRtrlznZEJ5DRzhFNcQFV3ZU0gLMXWhfTGucVOHrUi6xYdb5eg-fOToJRI4Vsv0lKfXHb3Zhe2yzJjOObd_UD6ejs1O6L[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
the handle will close, the file will be deleted. No other process can operate on this file in the Delete_Pending state. Thus, the entire Process Ghosting flow looks like this: 1. Step 1: Create a file using NtCreateFile() function. This would create our…
h4qNp-q8w63AW2KjcF7rOnOb9m0OKnM64RRdaQaWErlN31OL50jfer5Q=s16000
To make things simple and save you the hassle of compilation, I have forked the repo and created an EXE for you, which can be downloaded here. Once you have downloaded the file, we can continue with our demo. As you can see, we have defender active and working.
https://blogger.googleusercontent.com/img/a/AVvXsEhMTJQkdeQTMqCiwr2TGLJ2p523fa0cKSiU1CdzzD2540KnJc3cuQY7Slw_bfegN8poNpYAGPSTGSB4adNvqDvKUYVhqVDhvnLY76MT8vbmuJtXOqqihdFW6mP2j7Js6euYtfW5OsY-yUTBPfALNYZrEpmhcrk3eAPINzlUpTIZri8P4erkpqvGx43nMA=s16000
Now, we can launch our ghost process using the following command:
.\SharpGhost.exe -real ConclusionThe article covered an easy to comprehend theoretical explanation of the nitty-gritty and various coding functions used while launching Process Ghosting PE injection attacks. Soon after this technique was released, Microsoft rolled out patches to fix this issue. This no longer works in the latest windows 10 and windows 11, however, older windows 10 is still being used in organizations and home systems and a smart attacker can take advantage of this. Hence, one must always keep their systems updated and the latest patch installed in their systems. Hope you liked the article. Subscribe to the blog to receive daily updates and thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Process Ghosting Attack appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
To make things simple and save you the hassle of compilation, I have forked the repo and created an EXE for you, which can be downloaded here. Once you have downloaded the file, we can continue with our demo. As you can see, we have defender active and working.
https://blogger.googleusercontent.com/img/a/AVvXsEhMTJQkdeQTMqCiwr2TGLJ2p523fa0cKSiU1CdzzD2540KnJc3cuQY7Slw_bfegN8poNpYAGPSTGSB4adNvqDvKUYVhqVDhvnLY76MT8vbmuJtXOqqihdFW6mP2j7Js6euYtfW5OsY-yUTBPfALNYZrEpmhcrk3eAPINzlUpTIZri8P4erkpqvGx43nMA=s16000
Now, we can launch our ghost process using the following command:
.\SharpGhost.exe -real ConclusionThe article covered an easy to comprehend theoretical explanation of the nitty-gritty and various coding functions used while launching Process Ghosting PE injection attacks. Soon after this technique was released, Microsoft rolled out patches to fix this issue. This no longer works in the latest windows 10 and windows 11, however, older windows 10 is still being used in organizations and home systems and a smart attacker can take advantage of this. Hence, one must always keep their systems updated and the latest patch installed in their systems. Hope you liked the article. Subscribe to the blog to receive daily updates and thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Process Ghosting Attack appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
hacking: security in practice
Is THC-Hydra Speed based on GPU?
is THC-HYDRA based on GPU speed and "how many attepmts one is allowed to send to the login page per second" ?
submitted by /u/TobaksPipa
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Is THC-Hydra Speed based on GPU?
is THC-HYDRA based on GPU speed and "how many attepmts one is allowed to send to the login page per second" ?
submitted by /u/TobaksPipa
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Is THC-Hydra Speed based on GPU?
is THC-HYDRA based on GPU speed and "how many attepmts one is allowed to send to the login page per second" ?
hacking: security in practice
Where should I start ?
Hey guys I am interested to get into bug bounties.
I am living in a poor country and my end GOAL is to be able to make 300-500 / month by doing bug bounties. This would be more then enough to replace my 9 to 5 job here
I do have some minimum knowledge sort of speak ( ive been playing with kali for over a month )
But the thing is I want to learn everything I need to in a chronological order if that makes sense
To set up a schedule and say okay now I have to learn this and after that I have to pick up this etc
Can someone guide me ?
What should I learn first?
Where should I start ?
submitted by /u/LEggENDE
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
Where should I start ?
Hey guys I am interested to get into bug bounties.
I am living in a poor country and my end GOAL is to be able to make 300-500 / month by doing bug bounties. This would be more then enough to replace my 9 to 5 job here
I do have some minimum knowledge sort of speak ( ive been playing with kali for over a month )
But the thing is I want to learn everything I need to in a chronological order if that makes sense
To set up a schedule and say okay now I have to learn this and after that I have to pick up this etc
Can someone guide me ?
What should I learn first?
Where should I start ?
submitted by /u/LEggENDE
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
Where should I start ?
Hey guys I am interested to get into bug bounties. I am living in a poor country and my end GOAL is to be able to make 300-500 / month by doing...
Whatfiles - Log What Files Are Accessed By Any Linux Process
http://www.kitploit.com/2022/01/whatfiles-log-what-files-are-accessed.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/01/whatfiles-log-what-files-are-accessed.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Whatfiles - Log What Files Are Accessed By Any Linux Process
mode: read, file: /home/theron/.gimp-2.8/tool-options/gimp-dodge-burn-tool, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /home/theron/.gimp-2.8/tool-options/gimp-desaturate-tool, syscall: openat(), PID: 8566, process: gim p
mode: read, file: /home/theron/.gimp-2.8/plug-ins, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /usr/lib/gimp/2.0/plug-ins, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /home/theron/.gimp-2.8/pluginrc, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /usr/share/locale/en_US/LC_MESSAGES/gimp20-std-plug-ins.mo, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /usr/lib/gimp/2.0/plug-ins/script-fu, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /etc/ld.so.cache, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /etc/ld.so.cache, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimpui-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimpwidgets-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/g imp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimpwidgets-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimp-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimpcolor-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
Use: basic use, launches ls and writes output to a log file in the current directory: $ whatfiles ls -lah ~/Documents specify output file location with -o: $ whatfiles -o MyLogFile cd .. include debug output, print to stdout rather than log file: $ whatfiles -d -s apt install zoom attach to currently running process (requires root privileges): $ sudo whatfiles -p 1234 Distribution Ready-to-use binaries are on the releases (https://github.com/spieglt/whatfiles/releases) page! Someone also kindly added it to the Arch (https://aur.archlinux.org/packages/whatfiles-git/) repository, and letompouce (https://github.com/letompouce) set up a GitLab (https://gitlab.com/l3tompouce/builders/whatfiles) pipeline (https://www.kitploit.com/search/label/Pipeline) as well. Compilation (requires gcc and make): $ cd whatfiles
$ make
$ sudo make install
Supports x86, x86_64, ARM32, and ARM64 architectures. Questions that could be asked at some point: Isn't this just a reimplementation of strace -fe trace=creat,open,openat,unlink,unlinkat ./program? Yes. Though it aims to be simpler and more user friendly. Are there Mac and Windows (https://www.kitploit.com/search/label/Windows) versions? No. Tracing (https://www.kitploit.com/search/label/Tracing) syscalls (https://www.kitploit.com/search/label/Syscalls) on Mac requires task_for_pid(), which requires code signing, which I can't get to work, and anyway I have no interest in paying Apple $100/year to write free software. dtruss on Mac can be used to follow a single process and its children, though the -t flag seems to only accept a single syscall to filter on. fs_usage does something similar though I'm not sure if it follows child processes/threads. Process Monitor for Windows is pretty great. Known issues: Tabs crash when whatfiles is used to launch Firefox. (Attaching with -p [PID] once it's running works fine, as does using whatfiles to launch a second Firefox (https://www.kitploit.com/search/label/Firefox) window if one's already open.) Planned features: None currently, open to requests and PRs. Thank you for your interest, and please also check out Cloaker (https://github.com/spieglt/cloaker), Nestur (https://github.com/spieglt/nestur), and Flying Carpet (https://github.com/spieglt/flyingcarpet)!
___________________________
@hacking_Attack
@Hacking_Video
mode: read, file: /home/theron/.gimp-2.8/tool-options/gimp-desaturate-tool, syscall: openat(), PID: 8566, process: gim p
mode: read, file: /home/theron/.gimp-2.8/plug-ins, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /usr/lib/gimp/2.0/plug-ins, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /home/theron/.gimp-2.8/pluginrc, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /usr/share/locale/en_US/LC_MESSAGES/gimp20-std-plug-ins.mo, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /usr/lib/gimp/2.0/plug-ins/script-fu, syscall: openat(), PID: 8566, process: gimp
mode: read, file: /etc/ld.so.cache, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /etc/ld.so.cache, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimpui-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimpwidgets-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/g imp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimpwidgets-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimp-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
mode: read, file: /usr/lib/libgimpcolor-2.0.so.0, syscall: openat(), PID: 8574, process: /usr/lib/gimp/2.0/plug-ins/script-fu
Use: basic use, launches ls and writes output to a log file in the current directory: $ whatfiles ls -lah ~/Documents specify output file location with -o: $ whatfiles -o MyLogFile cd .. include debug output, print to stdout rather than log file: $ whatfiles -d -s apt install zoom attach to currently running process (requires root privileges): $ sudo whatfiles -p 1234 Distribution Ready-to-use binaries are on the releases (https://github.com/spieglt/whatfiles/releases) page! Someone also kindly added it to the Arch (https://aur.archlinux.org/packages/whatfiles-git/) repository, and letompouce (https://github.com/letompouce) set up a GitLab (https://gitlab.com/l3tompouce/builders/whatfiles) pipeline (https://www.kitploit.com/search/label/Pipeline) as well. Compilation (requires gcc and make): $ cd whatfiles
$ make
$ sudo make install
Supports x86, x86_64, ARM32, and ARM64 architectures. Questions that could be asked at some point: Isn't this just a reimplementation of strace -fe trace=creat,open,openat,unlink,unlinkat ./program? Yes. Though it aims to be simpler and more user friendly. Are there Mac and Windows (https://www.kitploit.com/search/label/Windows) versions? No. Tracing (https://www.kitploit.com/search/label/Tracing) syscalls (https://www.kitploit.com/search/label/Syscalls) on Mac requires task_for_pid(), which requires code signing, which I can't get to work, and anyway I have no interest in paying Apple $100/year to write free software. dtruss on Mac can be used to follow a single process and its children, though the -t flag seems to only accept a single syscall to filter on. fs_usage does something similar though I'm not sure if it follows child processes/threads. Process Monitor for Windows is pretty great. Known issues: Tabs crash when whatfiles is used to launch Firefox. (Attaching with -p [PID] once it's running works fine, as does using whatfiles to launch a second Firefox (https://www.kitploit.com/search/label/Firefox) window if one's already open.) Planned features: None currently, open to requests and PRs. Thank you for your interest, and please also check out Cloaker (https://github.com/spieglt/cloaker), Nestur (https://github.com/spieglt/nestur), and Flying Carpet (https://github.com/spieglt/flyingcarpet)!
___________________________
@hacking_Attack
@Hacking_Video
GitHub
Releases · spieglt/whatfiles
Log what files are accessed by any Linux process. Contribute to spieglt/whatfiles development by creating an account on GitHub.
Download Whatfiles (https://github.com/spieglt/whatfiles)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
GitHub
GitHub - spieglt/whatfiles: Log what files are accessed by any Linux process
Log what files are accessed by any Linux process. Contribute to spieglt/whatfiles development by creating an account on GitHub.
PORTSWIGGER WEB SECURITY - XSS (CROSS SITE SCRIPTING) LAB ÇÖZÜMLERİ
Cross Site Scripting (Siteler Arası Komut Dosyası Çalıştırma), saldırganın bir web uygulamasında çalıştırdığı zararlı komutlar sonucunda…Continue reading on Medium »
Read more...
Cross Site Scripting (Siteler Arası Komut Dosyası Çalıştırma), saldırganın bir web uygulamasında çalıştırdığı zararlı komutlar sonucunda…Continue reading on Medium »
Read more...
Creating easy proof-of-concept scripts with Python and Curl.
Hello Hunters!Continue reading on Medium »
Read more...
Hello Hunters!Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Process Ghosting Attack
IntroductionGabriel Landau released a post on Elastic Security here which talks about a technique through which antivirus evasion was found to be possible. The technique deals with creating a ghost process which is a term used by the author to describe the mechanism of deleting the payload from the disk before running it, essentially making it a ghost.Table of Content· Process Creation and Security Gap· Executables, Processes, and Threads· Creation of Process· Process Ghosting· Process Ghosting demo using SharpGhosting· ConclusionIn Windows ecosystem, anti-virus solution developers call APIs (like PsSetCreateProcessNotifyRoutineEx) that can intimate their AV solution about the execution of a particular process, however, the callbacks are not sent when the process executes, rather when the first thread within that process is executed. Hence, this gap between the creation of process and sending of notification of their creation to the anti-virus solution is where attackers can implement process ghosting.Executables, Processes, and ThreadsAn executable is that compiled file which contains the program that is to be run by the machine. Executables can have multiple functions to be performed and when each of these functions are run, it is called a process.process, in the simplest terms, is an executing program. Each process is linked to a specific PE (exe, dll etc). There can also be multiple processes from a single executable. This can be viewed in task manager -> details. thread is the basic unit of a process to which the OS allocates processor time. A thread can execute any part of the process code. Multiple threads exist in a process. Multi-threading means multiple threads running the same part of the process code. Windows supports multi-tasking thus as many threads can be created as many processors are available to run them simultaneously. It can have three states: running, ready and blocked.Creation of ProcessA process can be created in Windows using CreateProcessor NtCreateUserProcessfunction. This function is a combination of individually modifyable other functions that can operate on handles, section images, threads etc.CreateProcess (lpApplicationName) defines which application to execute.Process GhostingNow that we have covered basics, let’s understand how process ghosting works. It is a technique in which an attacker creates a file (malware), mark it for deletion (delete-pending state), copies/maps a malware into the memory (image section), close the handle (which deletes it from the disk), then create a process from the now-fileless section. Before understanding the attack we must know the following:Handles: Used for memory management, these are references to a resource in kernel space. These not only hold the information about a resource but also provides access rights.int fh = open("/etc/passwd", O_RDWR);fh is a file handle. When we opened a file using open() function it returned a handle to variable fh. Now fh can be used to perform functions on the file like:Image Section: A section is the mapping of a file into memory. An image section is a special type of section that corresponds to Portable Executabl[...]
___________________________
@hacking_Attack
@Hacking_Video
Process Ghosting Attack
IntroductionGabriel Landau released a post on Elastic Security here which talks about a technique through which antivirus evasion was found to be possible. The technique deals with creating a ghost process which is a term used by the author to describe the mechanism of deleting the payload from the disk before running it, essentially making it a ghost.Table of Content· Process Creation and Security Gap· Executables, Processes, and Threads· Creation of Process· Process Ghosting· Process Ghosting demo using SharpGhosting· ConclusionIn Windows ecosystem, anti-virus solution developers call APIs (like PsSetCreateProcessNotifyRoutineEx) that can intimate their AV solution about the execution of a particular process, however, the callbacks are not sent when the process executes, rather when the first thread within that process is executed. Hence, this gap between the creation of process and sending of notification of their creation to the anti-virus solution is where attackers can implement process ghosting.Executables, Processes, and ThreadsAn executable is that compiled file which contains the program that is to be run by the machine. Executables can have multiple functions to be performed and when each of these functions are run, it is called a process.process, in the simplest terms, is an executing program. Each process is linked to a specific PE (exe, dll etc). There can also be multiple processes from a single executable. This can be viewed in task manager -> details. thread is the basic unit of a process to which the OS allocates processor time. A thread can execute any part of the process code. Multiple threads exist in a process. Multi-threading means multiple threads running the same part of the process code. Windows supports multi-tasking thus as many threads can be created as many processors are available to run them simultaneously. It can have three states: running, ready and blocked.Creation of ProcessA process can be created in Windows using CreateProcessor NtCreateUserProcessfunction. This function is a combination of individually modifyable other functions that can operate on handles, section images, threads etc.CreateProcess (lpApplicationName) defines which application to execute.Process GhostingNow that we have covered basics, let’s understand how process ghosting works. It is a technique in which an attacker creates a file (malware), mark it for deletion (delete-pending state), copies/maps a malware into the memory (image section), close the handle (which deletes it from the disk), then create a process from the now-fileless section. Before understanding the attack we must know the following:Handles: Used for memory management, these are references to a resource in kernel space. These not only hold the information about a resource but also provides access rights.int fh = open("/etc/passwd", O_RDWR);fh is a file handle. When we opened a file using open() function it returned a handle to variable fh. Now fh can be used to perform functions on the file like:Image Section: A section is the mapping of a file into memory. An image section is a special type of section that corresponds to Portable Executabl[...]
___________________________
@hacking_Attack
@Hacking_Video
Blogspot
Process Ghosting Attack
Hacking Articles is a very interesting blog about information security, penetration testing and vulnerability assessment managed by Raj Chandel.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Process Ghosting Attack IntroductionGabriel Landau released a post on Elastic Security here which talks about a technique through which antivirus evasion was found to be possible. The technique deals with creating a ghost…
e (PE) files, and can only be created from PE (EXE, DLL, etc) files.Delete_Pending State: Like read, write, delete state that may exist for a file, Delete_Pending is a state in which a file is yet to be deleted. The file is not deleted yet because a handle may have kept it opened. As soon as the handle will close, the file will be deleted. No other process can operate on this file in Delete_Pending state.Process Ghosting flow looks like:Step 1: Create a file using NtCreateFile() function. This would create our intended malware. Also, would give us a file handle. like: hFile = NtCreateFile(C:\Users\a_cha\Desktop\random.exe)Step 2: Put the file in a delete_pending state. This can be done using NtSetInformationFile() function. By using FileDispositionInformationflag, file will be put in a delete pending state. We can use hFile to perform this task on our file.
Step 3: Write the payload (malware) to this newly created file. Since the file is in delete_pending state, as soon as it closes, the data will vanish. But we’ll perform Step 4 before it vanishes!Step 4: Image section of the file is created using function NtCreateSection(hFile, SEC_IMAGE). It can be done like: hSection = NtCreateSection(hFile, SEC_IMAGE). This is why our handle was needed, as NtCreateSection() takes in file handle as input. Now we can delete our handle safely.Step 5: Delete our newly created handle. This would also delete our corresponding file (malware) from the disk, however, a copy of it still exists in the image section.Step 6: Create a new process from the image section. As the code exists in virtual memory, new process can be created using NtCreateProcessEx(hSection)function. It will be done like hProcess = NtCreateProcessEx(hSection)Step 7: Assign process arguments and environment variables. This is important as without process arguments and environment variables, OS won’t execute the process and the code stays in suspended state.Step 8: Create a thread to execute in the process. Can be done using CreateThread() function and supplying starting address of the process to be executed.Process Ghosting demo using SharpGhostingBased on the methodology explained above, many POCs have come onto the surface since Gabriel’s post on Elastic Security. In this demo, we will be using a C# implementation of Process Ghosting developed by Wra7h. Before you try it, it is essential that you have an older Windows 10 version as Microsoft patched defender detection after this technique came onto the surface. If you are pentesting and find an older Windows 10, well you know what to do!___________________________
@hacking_Attack
@Hacking_Video
Step 3: Write the payload (malware) to this newly created file. Since the file is in delete_pending state, as soon as it closes, the data will vanish. But we’ll perform Step 4 before it vanishes!Step 4: Image section of the file is created using function NtCreateSection(hFile, SEC_IMAGE). It can be done like: hSection = NtCreateSection(hFile, SEC_IMAGE). This is why our handle was needed, as NtCreateSection() takes in file handle as input. Now we can delete our handle safely.Step 5: Delete our newly created handle. This would also delete our corresponding file (malware) from the disk, however, a copy of it still exists in the image section.Step 6: Create a new process from the image section. As the code exists in virtual memory, new process can be created using NtCreateProcessEx(hSection)function. It will be done like hProcess = NtCreateProcessEx(hSection)Step 7: Assign process arguments and environment variables. This is important as without process arguments and environment variables, OS won’t execute the process and the code stays in suspended state.Step 8: Create a thread to execute in the process. Can be done using CreateThread() function and supplying starting address of the process to be executed.Process Ghosting demo using SharpGhostingBased on the methodology explained above, many POCs have come onto the surface since Gabriel’s post on Elastic Security. In this demo, we will be using a C# implementation of Process Ghosting developed by Wra7h. Before you try it, it is essential that you have an older Windows 10 version as Microsoft patched defender detection after this technique came onto the surface. If you are pentesting and find an older Windows 10, well you know what to do!___________________________
@hacking_Attack
@Hacking_Video