Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
How ILOVEYOU worm became the first global computer virus pandemic
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png How ILOVEYOU worm became the first global computer virus pandemicPost Views: 131 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 6 Minutes
Almost two months after the .com bubble burst, on May 5, 2000, many users using Windows machines received an email with the subject “ILOVEYOU”.
The email contained a malicious attachment, and ten days later, around 50 million infections were reported. The number of infections represented 10% of the global internet-connected computers in the world at the time.
Just like the ongoing Covid-19 pandemic, the spread of the infection accelerated rapidly due to the simple reason that the victims were not suspicious about the threat it posed initially and were not ready/unaware to face such a threat.
Most of the internet users ignored the experts’ warnings years before “ILOVEYOU” dominated the news headlines globally.
How ILOVEYOU became the first global computer virus pandemic
ILOVEOU payload
“ILOVEYOU” or “Love Bug at the time, it’s a computer worm. Unlike the common viruses, that require a “host-file” to be activated for the infection to take place, worms are stand-alone malicious programs that can self-replicate and propagate independently as soon as they have been in a computer system. They do not require activation or any human intervention to execute or spread their code.
Worms can propagate by spreading multiple copies of themselves across the network or through an internet connection. These copies will infect any inadequately protected computer system on the network or internet.
The infection started on May 5, 2000, and was first discovered in Hong Kong and the Philippines.
Messages which were generated in the Philippines began spreading in the west through corporate email systems.
The subject line of the email was ILOVEYOU, along with body text instructions (The message body is “kindly check the attached LOVELETTER coming from me.”) encouraging users to open the attachment “LOVE-LETTER-FOR-YOU.TXT.vbs”, which was supposedly a love letter from the sender.
The Subject: ILOVEYOU
Message body: kindly check the attached LOVELETTER coming from me.
Attached file name: LOVE-LETTER-FOR-YOU.TXT.vbs
The suffix .vbs was not visible to the users by default on Windows machines, and in this case, the attachment appeared to be a normal text file as the last file extension wasn’t displayed.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/https___specials-images.forbesimg.com_imageserve_51344539_The-ILOVEYOU-computer-virus-email-from-the-year-2000_960x0.jpg
Spreading
The attachment was a Visual Basic script file, and by opening it, the worm was activated. It will then gain access to the Microsoft Outlook Windows address book of the user and send a copy of itself to all the contacts listed in the address book of the infected victim and also overwrite a random set of files from documents, to images/music files.
Replaces Files with Copies of the Worm
When the worm is executed, the malicious worm copies itself in the Windows directory as a WIN32DLL.VBS file, and in the Windows system directory as LOVE-LETTER-FOR-YOU.TXT.VBS and MSKERNEL32.VBS.
These files are then registered in the Windows auto-run section in the system registry.
* HKLMSoftwareMicrosoftWindowsCurrentVersionRunMSKernel32 = MSKERNEL32.VBS
* HKLMSoftwareMicrosoftWindowsCurrentVersionRunServicesWin32DLL = Win32DLL.VBS
As a result, the worm is r[...]
___________________________
@hacking_Attack
@Hacking_Video
How ILOVEYOU worm became the first global computer virus pandemic
https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png How ILOVEYOU worm became the first global computer virus pandemicPost Views: 131 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 6 Minutes
Almost two months after the .com bubble burst, on May 5, 2000, many users using Windows machines received an email with the subject “ILOVEYOU”.
The email contained a malicious attachment, and ten days later, around 50 million infections were reported. The number of infections represented 10% of the global internet-connected computers in the world at the time.
Just like the ongoing Covid-19 pandemic, the spread of the infection accelerated rapidly due to the simple reason that the victims were not suspicious about the threat it posed initially and were not ready/unaware to face such a threat.
Most of the internet users ignored the experts’ warnings years before “ILOVEYOU” dominated the news headlines globally.
How ILOVEYOU became the first global computer virus pandemic
ILOVEOU payload
“ILOVEYOU” or “Love Bug at the time, it’s a computer worm. Unlike the common viruses, that require a “host-file” to be activated for the infection to take place, worms are stand-alone malicious programs that can self-replicate and propagate independently as soon as they have been in a computer system. They do not require activation or any human intervention to execute or spread their code.
Worms can propagate by spreading multiple copies of themselves across the network or through an internet connection. These copies will infect any inadequately protected computer system on the network or internet.
The infection started on May 5, 2000, and was first discovered in Hong Kong and the Philippines.
Messages which were generated in the Philippines began spreading in the west through corporate email systems.
The subject line of the email was ILOVEYOU, along with body text instructions (The message body is “kindly check the attached LOVELETTER coming from me.”) encouraging users to open the attachment “LOVE-LETTER-FOR-YOU.TXT.vbs”, which was supposedly a love letter from the sender.
The Subject: ILOVEYOU
Message body: kindly check the attached LOVELETTER coming from me.
Attached file name: LOVE-LETTER-FOR-YOU.TXT.vbs
The suffix .vbs was not visible to the users by default on Windows machines, and in this case, the attachment appeared to be a normal text file as the last file extension wasn’t displayed.
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/https___specials-images.forbesimg.com_imageserve_51344539_The-ILOVEYOU-computer-virus-email-from-the-year-2000_960x0.jpg
Spreading
The attachment was a Visual Basic script file, and by opening it, the worm was activated. It will then gain access to the Microsoft Outlook Windows address book of the user and send a copy of itself to all the contacts listed in the address book of the infected victim and also overwrite a random set of files from documents, to images/music files.
Replaces Files with Copies of the Worm
When the worm is executed, the malicious worm copies itself in the Windows directory as a WIN32DLL.VBS file, and in the Windows system directory as LOVE-LETTER-FOR-YOU.TXT.VBS and MSKERNEL32.VBS.
These files are then registered in the Windows auto-run section in the system registry.
* HKLMSoftwareMicrosoftWindowsCurrentVersionRunMSKernel32 = MSKERNEL32.VBS
* HKLMSoftwareMicrosoftWindowsCurrentVersionRunServicesWin32DLL = Win32DLL.VBS
As a result, the worm is r[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
How ILOVEYOU worm became the first global computer virus pandemic | Black Hat Ethical Hacking
Almost two months after the .com bubble burst, on May 5, 2000, many users using Windows machines began receiving an email with the subject "ILOVEYOU".
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking How ILOVEYOU worm became the first global computer virus pandemic https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png How ILOVEYOU worm became the first global computer virus pandemicPost Views:…
e-activated each time the system boots up.
HTM dropper – Downloading a Trojan
The worm also creates an HTM dropper in the Windows system directory to use while spreading to mIRC channels.
In order for the Trojan to be installed, the worm modifies the URL of the Internet Explorer start page and points to a Website that forces the Explorer to download a .exe file. The .exe file is the trojan file with the name WIN-BUGSFIX.EXE.
The Trojan files eventually get control of the system and copy themselves to the Windows system directory as WINFAT32.exe.
The trojan installed is actually a password-stealing Trojan that obtains the local machine name, network logins, passwords, etc., and sends them to the Trojan host.
IRC channels spread
Another feature of the malware was the spreading through the IRC channels. It will also scan the local drives for files such as MIRC32.EXE, MLINK32.EXE, MIRC.INI, SCRIPT.INI, etc.
If it finds any of the files, it will drop a new SCRIPT.INI file that contains mIRC instructions that send a copy of the worm to all the users that joined the infected IRC channel.
When an IRC user received the infected HTML, it will be copied to an IRC download directory and it will be activated if the user clicks on it.
The worm was even able to work around the security settings of the Internet Explorer that didn’t allow scripts to access disk files by displaying a warning when they try to. The workaround involved a fake message which prompt the user to give ActiveX control to the .htm file.
If the user clicks “Yes”, the worm infects the system, if the user clicks on “No”, then, an infinite loop that reloads the message will appear until the user clicks on “Yes”, allowing the infection to take place.
Destructive actions
The worm also scans the subdirectories on all available local and mapped drives on the infected system and lists all the files there.
It will then perform certain actions depending on the filename extension such as:
Mp2, Mp3: The worm will create a new file with a .vbs extension and write its code there while setting the file attribute as hidden for the original file.
Vbs, Vbe: It overwrites all files with its .vbs body.
Css, Wsh, Sct, Ht, Js, Jse: It deletes the original file and creates a new file with the original filename plus the .vbs extension. e.g. from hello.css to hello.vbs
Jpg, Jpeg: It also deletes the original files, but adds the .vbs extension to the full file name. e.g. from hello.jpg to hello.jpg.vbs.
Who was behind ILOVEYOU
The worm was written by two computer programmers named Reonel Ramones and Onel de Guzma, students at AMA computer University in Makati, Philippines.
On May 5, 2000, the authors of the worm became targets of a criminal investigation by the Philippines National Bureau of Investigation after the local ISP, Sky Internet, had reported receiving complaints from European computer users, alleging that the worm had been sent via the ISP’s servers.
The Philippines NBI traced a telephone number to Ramones’ apartment in Manila, and he was arrested for further investigation along with Onel de Guzman.
The authors of the worm said to the authorities that he may have released the malware by “accident”. Guzman dropped out at the very end of the final year of his AMA computer college and it was found that for his undergraduate thesis, he proposed the implementation of a trojan to steal internet login passwords so a user would be able to afford an Internet connection, the trojan he proposed was a part of the ILOVEYOU worm.
Since there were no laws in the Philippines at the time for writing malware, both Ramones and Guzman were released with all the charges dropped by the state prosecutors. To address this legislative deficiency, the Philippine authorities enacted the E-Commerce Law, in July of the same year.
20 years later, in 2020, De Guzman admitted that he created and release the virus to the investigative journa[...]
___________________________
@hacking_Attack
@Hacking_Video
HTM dropper – Downloading a Trojan
The worm also creates an HTM dropper in the Windows system directory to use while spreading to mIRC channels.
In order for the Trojan to be installed, the worm modifies the URL of the Internet Explorer start page and points to a Website that forces the Explorer to download a .exe file. The .exe file is the trojan file with the name WIN-BUGSFIX.EXE.
The Trojan files eventually get control of the system and copy themselves to the Windows system directory as WINFAT32.exe.
The trojan installed is actually a password-stealing Trojan that obtains the local machine name, network logins, passwords, etc., and sends them to the Trojan host.
IRC channels spread
Another feature of the malware was the spreading through the IRC channels. It will also scan the local drives for files such as MIRC32.EXE, MLINK32.EXE, MIRC.INI, SCRIPT.INI, etc.
If it finds any of the files, it will drop a new SCRIPT.INI file that contains mIRC instructions that send a copy of the worm to all the users that joined the infected IRC channel.
When an IRC user received the infected HTML, it will be copied to an IRC download directory and it will be activated if the user clicks on it.
The worm was even able to work around the security settings of the Internet Explorer that didn’t allow scripts to access disk files by displaying a warning when they try to. The workaround involved a fake message which prompt the user to give ActiveX control to the .htm file.
If the user clicks “Yes”, the worm infects the system, if the user clicks on “No”, then, an infinite loop that reloads the message will appear until the user clicks on “Yes”, allowing the infection to take place.
Destructive actions
The worm also scans the subdirectories on all available local and mapped drives on the infected system and lists all the files there.
It will then perform certain actions depending on the filename extension such as:
Mp2, Mp3: The worm will create a new file with a .vbs extension and write its code there while setting the file attribute as hidden for the original file.
Vbs, Vbe: It overwrites all files with its .vbs body.
Css, Wsh, Sct, Ht, Js, Jse: It deletes the original file and creates a new file with the original filename plus the .vbs extension. e.g. from hello.css to hello.vbs
Jpg, Jpeg: It also deletes the original files, but adds the .vbs extension to the full file name. e.g. from hello.jpg to hello.jpg.vbs.
Who was behind ILOVEYOU
The worm was written by two computer programmers named Reonel Ramones and Onel de Guzma, students at AMA computer University in Makati, Philippines.
On May 5, 2000, the authors of the worm became targets of a criminal investigation by the Philippines National Bureau of Investigation after the local ISP, Sky Internet, had reported receiving complaints from European computer users, alleging that the worm had been sent via the ISP’s servers.
The Philippines NBI traced a telephone number to Ramones’ apartment in Manila, and he was arrested for further investigation along with Onel de Guzman.
The authors of the worm said to the authorities that he may have released the malware by “accident”. Guzman dropped out at the very end of the final year of his AMA computer college and it was found that for his undergraduate thesis, he proposed the implementation of a trojan to steal internet login passwords so a user would be able to afford an Internet connection, the trojan he proposed was a part of the ILOVEYOU worm.
Since there were no laws in the Philippines at the time for writing malware, both Ramones and Guzman were released with all the charges dropped by the state prosecutors. To address this legislative deficiency, the Philippine authorities enacted the E-Commerce Law, in July of the same year.
20 years later, in 2020, De Guzman admitted that he created and release the virus to the investigative journa[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
e-activated each time the system boots up. HTM dropper – Downloading a Trojan The worm also creates an HTM dropper in the Windows system directory to use while spreading to mIRC channels. In order for the Trojan to be installed, the worm modifies the URL…
list Geoff White while he was researching for his cybercrime book Crime Dot Com.
Impact
The ILOVEYOUJ worm caused global email outages and affected more than 50 million computers around the world.
Many industries were affected including media, stock brokerages, food companies, auto, and technology giants, as well as government agencies, medical institutions, and universities.
CNET News published a partial list of the affected companies and organizations like the Pentagon, the Motion Picture Association of America, Federal Reserve, and also it was also reported that the White House website suffered a dos attack as a result of the worm.
The damages were estimated to be 5.5-8.7 billion dollars worldwide.
The shift in the cyber security landscape
The shift in the cyber security landscape was enormous, just like the consequences that the ILOVEYOU worm caused, it was the first wake-up call in the cybersecurity landscape.
The need for user education on how to defend against social engineering attacks and not to get tricked became the number one priority in all the major corporations and government agencies around the world after the attack.
20 years on, to this day, the simple way to drop an email with a .vbs attachment is still optional on a lot of systems while the business case for allowing a .vbs file attachment is rare to non-existent.
Today, user training is still the key to defending these kinds of attacks as the cybercriminals’ abilities and methods evolved. Just by taking a look into the history we can learn and be prepared for the next computer virus pandemic.
References:
⦿ 2000 CERT Advisories ⦿ EMAIL-WORM.VBS.LOVELETTER – Kaspersky ⦿ ILoveYou – Malware Wiki ⦿ ILOVEYOU virus – Techtarget Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Stuxnet-90x90.png Stuxnet – A weapon made out of code that almost started WW31 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Article-90x90.png Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/operation-troy-90x90.png Hacking stories – Operation Troy – How researchers linked the cyberattacks3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Operation-Aurora-90x90.png Hacking stories – Operation Aurora: When China hacked Google4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/The-first-botnet-hijacker-90x90.png Hacking stories – The first botnet hijacker aka the Zombie King5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/featured_image_jonathan_james_hacker-90x90.png Hacking Stories: Jonathan James – The teenager who hacked NASA for fun6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-4-90x90.png Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/photo-1468436139062-f60a71c5c892-scaled-90x90.jpg “Worst” MacOS Security Bug Recently Patched by Apple8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/wallpaperflare.com_wallpaper-90x90.jpg Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat9 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Xbox-Underground-90x90.png Hacking Stories: Xbox Underground9 months ago
The post How ILOVEYOU worm became the first global computer virus pandemic first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
Impact
The ILOVEYOUJ worm caused global email outages and affected more than 50 million computers around the world.
Many industries were affected including media, stock brokerages, food companies, auto, and technology giants, as well as government agencies, medical institutions, and universities.
CNET News published a partial list of the affected companies and organizations like the Pentagon, the Motion Picture Association of America, Federal Reserve, and also it was also reported that the White House website suffered a dos attack as a result of the worm.
The damages were estimated to be 5.5-8.7 billion dollars worldwide.
The shift in the cyber security landscape
The shift in the cyber security landscape was enormous, just like the consequences that the ILOVEYOU worm caused, it was the first wake-up call in the cybersecurity landscape.
The need for user education on how to defend against social engineering attacks and not to get tricked became the number one priority in all the major corporations and government agencies around the world after the attack.
20 years on, to this day, the simple way to drop an email with a .vbs attachment is still optional on a lot of systems while the business case for allowing a .vbs file attachment is rare to non-existent.
Today, user training is still the key to defending these kinds of attacks as the cybercriminals’ abilities and methods evolved. Just by taking a look into the history we can learn and be prepared for the next computer virus pandemic.
References:
⦿ 2000 CERT Advisories ⦿ EMAIL-WORM.VBS.LOVELETTER – Kaspersky ⦿ ILoveYou – Malware Wiki ⦿ ILOVEYOU virus – Techtarget Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Stuxnet-90x90.png Stuxnet – A weapon made out of code that almost started WW31 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Article-90x90.png Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/operation-troy-90x90.png Hacking stories – Operation Troy – How researchers linked the cyberattacks3 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Operation-Aurora-90x90.png Hacking stories – Operation Aurora: When China hacked Google4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/The-first-botnet-hijacker-90x90.png Hacking stories – The first botnet hijacker aka the Zombie King5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/featured_image_jonathan_james_hacker-90x90.png Hacking Stories: Jonathan James – The teenager who hacked NASA for fun6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-4-90x90.png Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/photo-1468436139062-f60a71c5c892-scaled-90x90.jpg “Worst” MacOS Security Bug Recently Patched by Apple8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/wallpaperflare.com_wallpaper-90x90.jpg Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat9 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Xbox-Underground-90x90.png Hacking Stories: Xbox Underground9 months ago
The post How ILOVEYOU worm became the first global computer virus pandemic first appeared on Black Hat Ethical Hacking.
___________________________
@hacking_Attack
@Hacking_Video
XSS Discovery and Exploitation With BurpSuite
I’ve recently completed TryHackMe’s cross-site-scripting room and PortSwigger’s XSS labs and here’s what I’ve learned! This piece assumes…Continue reading on Medium »
Read more...
I’ve recently completed TryHackMe’s cross-site-scripting room and PortSwigger’s XSS labs and here’s what I’ve learned! This piece assumes…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
GIF
KitPloit - PenTest Tools!
Bluffy - Convert Shellcode Into Different Formats!
http://4.bp.blogspot.com/-xMCJfkkPAK4/Yd0Mx-YxzJI/AAAAAAAA77k/Hqst89l7iFYl_zgA1Hv2pwC8B0U-hlHjQCK4BGAYYCw/w508-h640/bluffy_4_bluffy-779523.gif Bluffy is a utility which was used in experiments to bypass Anti-Virus products (statically) by formatting shellcode into realistic looking data formats.
Proof-of-concept tools, such as 0xBoku's Ninja_UUID_Runner and ChoiSG's UuidShellcodeExec, inspired the initial concept for Bluffy.
So far, we implemented:
1. UUID
2. CLSID
3. SVG
4. CSS
5. CSV Helppayload prior to C formatting --list List all the available masks">
Written by:
* Michael Ranaldo
* Mez0 Requirements and installationThe following items must be installed prior to using Bluff: python3.9 or greater:
For us on Ubuntu, it was developed on:
The simplest way to thus acquire and install is to run the following commands (after double checking your architecture etc.):
Run
___________________________
@hacking_Attack
@Hacking_Video
Bluffy - Convert Shellcode Into Different Formats!
http://4.bp.blogspot.com/-xMCJfkkPAK4/Yd0Mx-YxzJI/AAAAAAAA77k/Hqst89l7iFYl_zgA1Hv2pwC8B0U-hlHjQCK4BGAYYCw/w508-h640/bluffy_4_bluffy-779523.gif Bluffy is a utility which was used in experiments to bypass Anti-Virus products (statically) by formatting shellcode into realistic looking data formats.
Proof-of-concept tools, such as 0xBoku's Ninja_UUID_Runner and ChoiSG's UuidShellcodeExec, inspired the initial concept for Bluffy.
So far, we implemented:
1. UUID
2. CLSID
3. SVG
4. CSS
5. CSV Helppayload prior to C formatting --list List all the available masks">
$ python3 bluffy.py -h
⣇⣿⠘⣿⣿⣿⡿⡿⣟⣟⢟⢟⢝⠵⡝⣿⡿⢂⣼⣿⣷⣌⠩⡫⡻⣝⠹⢿⣿⣷
⡆⣿⣆⠱⣝⡵⣝⢅⠙⣿⢕⢕⢕⢕⢝⣥⢒⠅⣿⣿⣿⡿⣳⣌⠪⡪⣡⢑⢝⣇
⡆⣿⣿⣦⠹⣳⣳⣕⢅⠈⢗⢕⢕⢕⢕⢕⢈⢆⠟⠋⠉⠁⠉⠉⠁⠈⠼⢐⢕⢽
⡗⢰⣶⣶⣦⣝⢝⢕⢕⠅⡆⢕⢕⢕⢕⢕⣴⠏⣠& #10358;⠛⡉⡉⡛⢶⣦⡀⠐⣕⢕
⡝⡄⢻⢟⣿⣿⣷⣕⣕⣅⣿⣔⣕⣵⣵⣿⣿⢠⣿⢠⣮⡈⣌⠨⠅⠹⣷⡀⢱⢕
⡝⡵⠟⠈⢀⣀⣀⡀⠉⢿⣿⣿⣿⣿⣿⣿⣿⣼⣿⢈⡋⠴⢿⡟⣡⡇⣿⡇⡀⢕
⡝⠁⣠⣾⠟⡉⡉⡉⠻⣦⣻⣿⣿⣿⣿⣿⣿⣿⣿⣧⠸⣿⣦⣥⣿⡇⡿⣰⢗⢄
⠁⢰⣿⡏⣴⣌⠈⣌⠡⠈⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣬⣉⣉⣁⣄⢖⢕⢕⢕
⡀⢻⣿⡇⢙⠁⠴⢿⡟⣡⡆⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣵⣵⣿
⡻⣄⣻⣿⣌⠘⢿⣷⣥⣿⠇⣿⣿⣿⣿⣿⣿⠛⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
⣷⢄⠻⣿⣟⠿⠦⠍⠉⣡⣾⣿⣿⣿⣿⣿⣿⢸⣿⣦⠙⣿⣿⣿⣿⣿⣿⣿⣿⠟
⡕⡑⣑⣈⣻⢗⢟⢞⢝⣻⣿⣿⣿⣿⣿⣿⣿⠸⣿⠿⠃ 0495;⣿⣿⣿⣿⣿⡿⠁⣠
⡝⡵⡈⢟⢕⢕⢕⢕⣵⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⠿⠋⣀⣈⠙
⡝⡵⡕⡀⠑⠳⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⢉⡠⡲⡫⡪⡪⡣
Convert shellcode into ✨ different ✨ formats!
Written by:
~ Mez0
~ Michael Ranaldo
usage: Bluffy [-h] -b -o -m
optional arguments:
-h, --help show this help message and exit
-b , --bin Specify bin file to load
-m , --mask Specify the mask for the shellcode
-x , --xor XOR the payload
-p , --preview Preview the created format
-pp, --payload_preview Preview the payload prior to C formatting
--list List all the available masks Written by:
* Michael Ranaldo
* Mez0 Requirements and installationThe following items must be installed prior to using Bluff: python3.9 or greater:
sudo apt install python3.9rich:sudo pip3 install richpcre2.8:Depending on whether its going to be ran on Kali, Ubuntu 18, 19, 20, and so on, the process of getting and building with pcre2.8may be different.For us on Ubuntu, it was developed on:
$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 21.04
Release: 21.04
Codename: hirsute In order to link libpcre2-8.a, the .afile had to be included within: /usr/lib/gcc/x86_64-w64-mingw32/10-win32 As for obtaining the header and lib files, MSYS2 was used. But if you're smarter than us, then just do it from source for Mingw64: https://pcre.org/.The simplest way to thus acquire and install is to run the following commands (after double checking your architecture etc.):
sudo apt install mingw-64
sudo wget https://packages.msys2.org/package/mingw-w64-x86_64-pcre2?repo=mingw64 -P /usr/lib/gcc/x86_64-w64-mingw32/10-win32Using BluffyTo build a payload, get your binary file. For this example, we used calc.bin, which just loads calc.exe as a proof of concept. As Bluffy only seeks to evade static analysis using steganography, by hiding the binary within an otherwise innocuous file, you will need to do further research to ensure that your payload also evades dynamic detection.Run
bluffy, choosing a mask of your choice and providing your .bin file: python ./bluffy.py -b calc.bin -m css -xCheck your payload, then build it. To build your payload, copy the .h file bluffy creates, rename it css.c, run make to build it to an executable, then test using the included examples directory: mv css.h examples/css/css.h
cd examples/css
make This will use the included "main.c" to build an Windows executable. Test this to confirm. If you have also used calc.bin, you should be greeted by a new Calc window opening. If so, congratulat[...]___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Bluffy - Convert Shellcode Into Different Formats!
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! Bluffy - Convert Shellcode Into Different Formats! http://4.bp.blogspot.com/-xMCJfkkPAK4/Yd0Mx-YxzJI/AAAAAAAA77k/Hqst89l7iFYl_zgA1Hv2pwC8B0U-hlHjQCK4BGAYYCw/w508-h640/bluffy_4_bluffy-779523.gif Bluffy is a utility which was used…
ions!
For more details on using Bluffy and a walkthrough of how it works and what the output looks like, check out our blog
Here is a full example: http://4.bp.blogspot.com/-xMCJfkkPAK4/Yd0Mx-YxzJI/AAAAAAAA77k/Hqst89l7iFYl_zgA1Hv2pwC8B0U-hlHjQCK4BGAYYCw/w508-h640/bluffy_4_bluffy-779523.gif Download Bluffy
___________________________
@hacking_Attack
@Hacking_Video
For more details on using Bluffy and a walkthrough of how it works and what the output looks like, check out our blog
Here is a full example: http://4.bp.blogspot.com/-xMCJfkkPAK4/Yd0Mx-YxzJI/AAAAAAAA77k/Hqst89l7iFYl_zgA1Hv2pwC8B0U-hlHjQCK4BGAYYCw/w508-h640/bluffy_4_bluffy-779523.gif Download Bluffy
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
XSS Discovery and Exploitation With BurpSuite
https://cdn-images-1.medium.com/max/2600/1*iu2i1qPggcUBBvKJu_0YVw.jpeg
I’ve recently completed TryHackMe’s cross-site-scripting room and PortSwigger’s XSS labs and here’s what I’ve learned! This piece assumes…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
XSS Discovery and Exploitation With BurpSuite
https://cdn-images-1.medium.com/max/2600/1*iu2i1qPggcUBBvKJu_0YVw.jpeg
I’ve recently completed TryHackMe’s cross-site-scripting room and PortSwigger’s XSS labs and here’s what I’ve learned! This piece assumes…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
XSS Discovery and Exploitation With BurpSuite
I’ve recently completed TryHackMe’s cross-site-scripting room and PortSwigger’s XSS labs and here’s what I’ve learned! This piece assumes…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
OSI Model and its Layers
OSI stands for open system interconnection , it describes how information goes from one computer to the other . we are going to see how…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
OSI Model and its Layers
OSI stands for open system interconnection , it describes how information goes from one computer to the other . we are going to see how…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
OSI Model and its Layers
OSI stands for open system interconnection , it describes how information goes from one computer to the other . we are going to see how…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Anti-Cheat Systems: Security through Obscurity
https://cdn-images-1.medium.com/max/1110/0*Ht0aNT9fvx_PMzhJ.jpg
Anti-cheat solutions are a common sight in online games. Most studios even have their own proprietary anti-cheat system.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Anti-Cheat Systems: Security through Obscurity
https://cdn-images-1.medium.com/max/1110/0*Ht0aNT9fvx_PMzhJ.jpg
Anti-cheat solutions are a common sight in online games. Most studios even have their own proprietary anti-cheat system.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Anti-Cheat Systems: Security through Obscurity
Anti-cheat solutions are a common sight in online games. Most studios even have their own proprietary anti-cheat system.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Vulnerability Capstone — Tryhackme
https://cdn-images-1.medium.com/max/2600/0*t9yz4dzMCbnMAvBx
Vulnerability Researching
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Vulnerability Capstone — Tryhackme
https://cdn-images-1.medium.com/max/2600/0*t9yz4dzMCbnMAvBx
Vulnerability Researching
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Vulnerability Capstone — Tryhackme
Vulnerability Researching
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
IAM Vulnerable : Use Terraform To Create Your Own Vulnerable By Design AWS IAM Privilege Escalation Playground
IAM Vulnerable is to use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.. IAM Vulnerable uses the Terraform binary and your AWS credentials to deploy over 250 IAM resources into your selected AWS account. Within minutes, you can start learning how to identify and exploit vulnerable IAM configurations that allow for privilege escalation.
Recommended Approach
1. Select or create an AWS account – Do NOT use an account that has any production resources or sensitive data.
2. Create your vulnerable playground – Use this repo to create the IAM principals and policies that support 31 unique AWS IAM privesc paths.
3. Do your homework – Learn about the 21 original privesc paths pioneered by Spencer Gietzen.
4. Hacky, hack – Practice exploitation in your new playground using Gerben Kleijn’s guide.
5. Level up – Run your tools against your new IAM privesc playground account (i.e., Cloudsplaining, AWSPX, Principal Mapper, Pacu).
Quick Start
This quick start outlines an opinionated approach to getting IAM Vulnerable up and running in your AWS account as quickly as possible. You might have many of these steps already completed, or you might want to tweak things to work with your current configuration. Check out the Other Use Cases section in this repository for some additional configuration options.
1. Select or create an AWS account. (Do NOT use an account that has any production resources or sensitive data!)
2. Create a non-root user with administrative access that you will use when running Terraform.
3. Create an access key for that user.
4. Install the AWS CLI.
5. Configure your AWS CLI with your newly created admin user as the default profile.
6. Confirm your CLI is working as expected by executing
7. Install the Terraform binary and add the binary location to your path.
8.
* The following commands make a backup of your current AWS credentials file, then takes the example credentials file from the repo and replaces the placeholder account with your target account number, and finally adds all of the IAM Vulnerable privesc profiles to your credentials file so you can use them:
*
Whenever you want to remove all of the IAM Vulnerable-created resources, you can run these commands:
1.
The Terraform binary just used your default AWS account profile credentials to create:
* 31 users, roles, and policies each with a unique exploit path to administrative access of the playground account
* Some additional users, groups, roles, and policies that are required to fully realize certain exploit paths
* Some additional users, roles, and policies that test the detection capabilities of other tools
By default, every role created by this Terraform module is assumable by the user or role you used to run Terraform.
* If you’d like Terraform to use a profile other than the default pr[...]
___________________________
@hacking_Attack
@Hacking_Video
IAM Vulnerable : Use Terraform To Create Your Own Vulnerable By Design AWS IAM Privilege Escalation Playground
IAM Vulnerable is to use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.. IAM Vulnerable uses the Terraform binary and your AWS credentials to deploy over 250 IAM resources into your selected AWS account. Within minutes, you can start learning how to identify and exploit vulnerable IAM configurations that allow for privilege escalation.
Recommended Approach
1. Select or create an AWS account – Do NOT use an account that has any production resources or sensitive data.
2. Create your vulnerable playground – Use this repo to create the IAM principals and policies that support 31 unique AWS IAM privesc paths.
3. Do your homework – Learn about the 21 original privesc paths pioneered by Spencer Gietzen.
4. Hacky, hack – Practice exploitation in your new playground using Gerben Kleijn’s guide.
5. Level up – Run your tools against your new IAM privesc playground account (i.e., Cloudsplaining, AWSPX, Principal Mapper, Pacu).
Quick Start
This quick start outlines an opinionated approach to getting IAM Vulnerable up and running in your AWS account as quickly as possible. You might have many of these steps already completed, or you might want to tweak things to work with your current configuration. Check out the Other Use Cases section in this repository for some additional configuration options.
1. Select or create an AWS account. (Do NOT use an account that has any production resources or sensitive data!)
2. Create a non-root user with administrative access that you will use when running Terraform.
3. Create an access key for that user.
4. Install the AWS CLI.
5. Configure your AWS CLI with your newly created admin user as the default profile.
6. Confirm your CLI is working as expected by executing
aws sts get-caller-identity.7. Install the Terraform binary and add the binary location to your path.
8.
git clone https://github.com/BishopFox/iam-vulnerable9. cd iam-vulnerable/10. terraform init11. (Optional) export TF_VAR_aws_local_profile=PROFILE_IN_AWS_CREDENTIALS_FILE_IF_OTHER_THAN_DEFAULT12. (Optional) export TF_VAR_aws_local_creds_file=FILE_LOCATION_IF_NON_DEFAULT13. (Optional) terraform plan14. terraform apply15. (Optional) Add the IAM vulnerable profiles to your AWS credentials file, and change the account number.* The following commands make a backup of your current AWS credentials file, then takes the example credentials file from the repo and replaces the placeholder account with your target account number, and finally adds all of the IAM Vulnerable privesc profiles to your credentials file so you can use them:
*
cp ~/.aws/credentials ~/.aws/credentials.backup* tail -n +7 aws_credentials_file_example | sed s/111111111111/$(aws sts get-caller-identity | grep Account | awk -F\" '{print $4}')/g >> ~/.aws/credentialsCleanupWhenever you want to remove all of the IAM Vulnerable-created resources, you can run these commands:
1.
cd iam-vulnerable/2. terraform destroyWhat resources were just created?The Terraform binary just used your default AWS account profile credentials to create:
* 31 users, roles, and policies each with a unique exploit path to administrative access of the playground account
* Some additional users, groups, roles, and policies that are required to fully realize certain exploit paths
* Some additional users, roles, and policies that test the detection capabilities of other tools
By default, every role created by this Terraform module is assumable by the user or role you used to run Terraform.
* If you’d like Terraform to use a profile other than the default pr[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
IAM Vulnerable : Use Terraform To Create Your Own Vulnerable
IAM Vulnerable is to use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials IAM Vulnerable : Use Terraform To Create Your Own Vulnerable By Design AWS IAM Privilege Escalation Playground IAM Vulnerable is to use Terraform to create your own vulnerable by design AWS IAM privilege escalation playground.. IAM Vulnerable…
ofile, or you’d like to hard-code the
Deploying IAM vulnerable in its default configuration will cost nothing. See the next section to learn how to enable non-default modules that do incur cost, and how much each module will cost per month if you deploy it. A Modular Approach
IAM Vulnerable groups certain resources together in modules. Some of the modules are enabled by default (the ones that don’t have any cost implications), and others are disabled by default (the ones that incur cost if deployed). This way, you can enable specific modules as needed.
For example, when you are ready to play with the exploit paths like
Uncomment the next four lines to create an ec2 instance and related resources
module “ec2” {
source = “./modules/non-free-resources/ec2”
aws_assume_role_arn = (var.aws_assume_role_arn != “” ? var.aws_assume_role_arn : data.aws_caller_identity.current.arn)
}
After you uncomment the
terraform init
terraform apply
You have now deployed the required components to try the SSM privesc paths. Free Resource Modules
There is no cost to anything deployed within
NameDefault StatusEstimated CostDescriptionprivesc-pathsEnabledNoneContains all of the IAM privesc pathstool-testingEnabledNoneContains test cases that evaluate the capabilities of the different IAM privesc tools Non-free Resource Modules
Deploying these additional modules can result in cost:
NameDefault StatusEstimated CostDescriptionRequired forEC2Disabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png
$4.50/monthCreates an EC2 instance and a security group that allows SSH from anywhere
Monthly cost depends on usage (cost should be zero)Creates a Lambda function
$4/hourCreates a Glue dev endpoint
$0.40/month for the secret created via CloudFormation. Nothing or barely nothing for the stack itselfCreates a CloudFormation stack that creates a secret in secret manager
Path NameIAM Vulnerable Profile NameNon-Default Modules RequiredExploitation ReferencesCategory: IAM Permissions on Other UsersIAM-CreateAccessKeyprivesc4Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 04
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3IAM-CreateLoginProfileprivesc5Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 05
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3IAM-UpdateLoginProfileprivesc6Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 06
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3Category: PassRole to ServiceCloudFormation-PassExistingRoleToCloudFormationprivesc20Nonehttps://s.w.org/imag[...]
___________________________
@hacking_Attack
@Hacking_Video
assume_role_policyARN, see Other Use Cases. How much is this going to cost?Deploying IAM vulnerable in its default configuration will cost nothing. See the next section to learn how to enable non-default modules that do incur cost, and how much each module will cost per month if you deploy it. A Modular Approach
IAM Vulnerable groups certain resources together in modules. Some of the modules are enabled by default (the ones that don’t have any cost implications), and others are disabled by default (the ones that incur cost if deployed). This way, you can enable specific modules as needed.
For example, when you are ready to play with the exploit paths like
ssm:StartSessionthat involve resources outside of IAM, you can deploy and tear down these resources on demand by uncommenting the module in the iam-vulnerable/main.tffile, and re-running terraform apply:Uncomment the next four lines to create an ec2 instance and related resources
module “ec2” {
source = “./modules/non-free-resources/ec2”
aws_assume_role_arn = (var.aws_assume_role_arn != “” ? var.aws_assume_role_arn : data.aws_caller_identity.current.arn)
}
After you uncomment the
ec2module, run:terraform init
terraform apply
You have now deployed the required components to try the SSM privesc paths. Free Resource Modules
There is no cost to anything deployed within
free-resources:NameDefault StatusEstimated CostDescriptionprivesc-pathsEnabledNoneContains all of the IAM privesc pathstool-testingEnabledNoneContains test cases that evaluate the capabilities of the different IAM privesc tools Non-free Resource Modules
Deploying these additional modules can result in cost:
NameDefault StatusEstimated CostDescriptionRequired forEC2Disabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png
$4.50/monthCreates an EC2 instance and a security group that allows SSH from anywhere
ssm-SendCommand ssm-StartSessionec2InstanceConnect-SendSSHPublicKeyLambdaDisabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png Monthly cost depends on usage (cost should be zero)Creates a Lambda function
Lambda-EditExistingLambdaFunctionWithRoleGlueDisabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png https://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png https://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png https://s.w.org/images/core/emoji/13.1.0/72x72/1f4b2.png $4/hourCreates a Glue dev endpoint
Glue-UpdateExistingGlueDevEndpointSageMakerDisabledNot sure yetCreates a SageMaker notebooksageMakerCreatePresignedNotebookURLCloudFormationDisabledhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png $0.40/month for the secret created via CloudFormation. Nothing or barely nothing for the stack itselfCreates a CloudFormation stack that creates a secret in secret manager
privesc-cloudFormationUpdateStack Supported Privilege Escalation PathsPath NameIAM Vulnerable Profile NameNon-Default Modules RequiredExploitation ReferencesCategory: IAM Permissions on Other UsersIAM-CreateAccessKeyprivesc4Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 04
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3IAM-CreateLoginProfileprivesc5Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 05
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3IAM-UpdateLoginProfileprivesc6Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 06
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 3Category: PassRole to ServiceCloudFormation-PassExistingRoleToCloudFormationprivesc20Nonehttps://s.w.org/imag[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
ofile, or you’d like to hard-code the assume_role_policyARN, see Other Use Cases. How much is this going to cost? Deploying IAM vulnerable in its default configuration will cost nothing. See the next section to learn how to enable non-default modules that…
es/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 20CodeBuild-CreateProjectPassRoleprivesc-codeBuildProjectNoneDataPipeline-PassExistingRoleToNewDataPipelineprivesc21Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 21EC2-CreateInstanceWithExistingProfileprivesc3Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 03
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 2Glue-PassExistingRoleToNewGlueDevEndpointprivesc18Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 18Lambda-PassExistingRoleToNewLambdaThenInvokeprivesc15Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 15Lambda-PassRoleToNewLambdaThenTriggerprivesc16Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 16SageMaker-CreateNotebookPassRoleprivesc-sageNotebookNonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98f.png AWS IAM Privilege Escalation – Method 2SageMaker-CreateTrainingJobPassRoleprivesc-sageTrainingNoneSageMaker-CreateProcessingJobPassRoleprivesc-sageProcessingNoneCategory: Permissions on PoliciesIAM-AddUserToGroupprivesc13Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 13IAM-AttachGroupPolicyprivesc8Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 08IAM-AttachRolePolicyprivesc9Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 09IAM-AttachUserPolicyprivesc7Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 07IAM-CreateNewPolicyVersionprivesc1Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 01
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 1IAM-PutGroupPolicyprivesc11Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 11IAM-PutRolePolicyprivesc12Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 12IAM-PutUserPolicyprivesc10Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 10IAM-SetExistingDefaultPolicyVersionprivesc2Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 02
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 2Category: Privilege Escalation using AWS ServicesEC2InstanceConnect-SendSSHPublicKeyprivesc-instanceConnectEC2CloudFormation-UpdateStackprivesc-cfUpdateStackCloudFormationGlue-UpdateExistingGlueDevEndpointprivesc19Gluehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 19Lambda-EditExistingLambdaFunctionWithRoleprivesc17Lambdahttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 17
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 4SageMakerCreatePresignedNotebookURLprivesc-sageUpdateURLSagemakerhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98f.png AWS IAM Privilege Escalation – Method 3SSM-SendCommandprivesc-ssm-commandEC2SSM-StartSessionprivesc-ssm-sessionEC2STS-AssumeRoleprivesc-assumeroleNoneCategory: Updating an AssumeRole PolicyIAM-UpdatingAssumeRolePolicyprivesc14Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 14 Other Use Cases Default – No
* All created roles are assumable by the principal used to run Terraform (specified in your default profile) Use a profile other than the default to run Terraform*[...]
___________________________
@hacking_Attack
@Hacking_Video
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 2Glue-PassExistingRoleToNewGlueDevEndpointprivesc18Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 18Lambda-PassExistingRoleToNewLambdaThenInvokeprivesc15Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 15Lambda-PassRoleToNewLambdaThenTriggerprivesc16Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 16SageMaker-CreateNotebookPassRoleprivesc-sageNotebookNonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98f.png AWS IAM Privilege Escalation – Method 2SageMaker-CreateTrainingJobPassRoleprivesc-sageTrainingNoneSageMaker-CreateProcessingJobPassRoleprivesc-sageProcessingNoneCategory: Permissions on PoliciesIAM-AddUserToGroupprivesc13Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 13IAM-AttachGroupPolicyprivesc8Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 08IAM-AttachRolePolicyprivesc9Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 09IAM-AttachUserPolicyprivesc7Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 07IAM-CreateNewPolicyVersionprivesc1Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 01
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 1IAM-PutGroupPolicyprivesc11Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 11IAM-PutRolePolicyprivesc12Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 12IAM-PutUserPolicyprivesc10Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 10IAM-SetExistingDefaultPolicyVersionprivesc2Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 02
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 2Category: Privilege Escalation using AWS ServicesEC2InstanceConnect-SendSSHPublicKeyprivesc-instanceConnectEC2CloudFormation-UpdateStackprivesc-cfUpdateStackCloudFormationGlue-UpdateExistingGlueDevEndpointprivesc19Gluehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 19Lambda-EditExistingLambdaFunctionWithRoleprivesc17Lambdahttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 17
https://s.w.org/images/core/emoji/13.1.0/72x72/1f512.png s3cur3.it IAMVulnerable – Part 4SageMakerCreatePresignedNotebookURLprivesc-sageUpdateURLSagemakerhttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98f.png AWS IAM Privilege Escalation – Method 3SSM-SendCommandprivesc-ssm-commandEC2SSM-StartSessionprivesc-ssm-sessionEC2STS-AssumeRoleprivesc-assumeroleNoneCategory: Updating an AssumeRole PolicyIAM-UpdatingAssumeRolePolicyprivesc14Nonehttps://s.w.org/images/core/emoji/13.1.0/72x72/1f98a.png Well, That Escalated Quickly – Privesc 14 Other Use Cases Default – No
terraform.tfvarsconfigured* Deploy using your default AWS profile (Default)* All created roles are assumable by the principal used to run Terraform (specified in your default profile) Use a profile other than the default to run Terraform*[...]
___________________________
@hacking_Attack
@Hacking_Video
