Kali Linux Tutorials
RPC Firewall : Stopping Lateral Movement via the RPC Firewall

RPC Firewall is the underlying mechanism which is used for numerous lateral movement techniques,
reconnaissances, relay attacks, or simply to exploit vulnerable RPC services.

DCSync attack? over RPC. Remote DCOM? over RPC. WMIC? over RPC. SharpHound? over RPC. PetitPotam? over RPC. PsExec? over RPC. ZeroLogon? over RPC… well, you get the idea https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png What is it used for? Research

Install the RPC Firewall and configure it to audit all remote RPC calls. Once executing any remote attack tools, you will see which RPC UUIDs and Opnums were called remotely. Remote RPC Attacks Detection

When the RPC Firewall is configured to audit, it write events to the Windows Event Log.

Forward this log to your SIEM, and use it to create baselines of remote RPC traffic for your servers.

Once an abnormal RPC call is audited, use it to trigger an alert for your SOC team. Remote RPC Attacks Protection

The RPC Firewall can be configured to block & audit only potentially malicious RPC calls. All other RPC calls are not audited to reduce noise and improve performance.

Once a potentially malicious RPC call is detected, it is blocked and audited. This could be used to alert your SOC team, while keeping your servers protected. What are the RPC Firewall Components?

It is made up from 3 components:

* RpcFwManager.exe – In charge of managing the RPC Firewall.
* RpcFirewall.dll – Injected DLL which performs the audit & filtering of RPC calls.
* RpcMessages.dll – A common library for sharing functions, and logic that writes data into Windows Event Viewer. How to use? Installing / Uninstalling

Installation simply drops the RPC Firewall DLLs into the %SystemRoot%\System32, and configures the RPCFWP application log for the Event Viewer.

Make sure the event viewer is closed during install/uninstall.

RpcFwManager.exe /install

Uninstalling does the opposite.

RpcFwManager.exe /uninstall

Protecting Process(es)

The RpcFwManager tried to inject the rpcFirewall.dll only to processes which have the RPCRT4.DLL loaded into them.

Once the rpcFirewall.dll is loaded, it verifies that the host process has a valid RPC interface, and is listening for remote connections.

Otherwise, the rpcFirewall.dll unloaded itself from the target process.

If the process is a valid RPC server, the rpcFirewall starts to audit & monitor incoming RPC calls, according to the configuration file.

To protect a single process by pid:

RpcFwManager.exe /pid

To protect a single process by name:

RpcFwManager.exe /process

To protect all process, simply leave the or parametes blank.

RpcFwManager.exe /process
RpcFwManager.exe /pid

Unprotecting Processes

To disable the RPC Firewall, either uninstall it, or use the unprotect parameter:

RpcFwManager.exe /unprotect

This will unload the rpcFirewall.dll from all processes. Persistency
RPC Firewall is not persistent on its own. One method of making sure that processes are continuesly protected is to create a scheduled task that executes a protection command. The following is a powershell command which does just that, just replace match a specific uuid
* opnum -> match a RPC opnum
* addr -> match a remote IP address
* action -> can be either allo[...]

___________________________
@hacking_Attack
@Hacking_Video

w or block (default allow)
* audit -> true or false, controls whether events are written to the RPCFWP log (default false)
* verbose -> when true, outputs debug informaiton for specific RPC calls (default false)

The configuration order is important, as the first match determines the outcome of the RPC call.

For example, the following configuration will protect a DC from a DCSync attack by disabling the MS-DRSR UUID from non-domain machines. Also, notice that audit is enabled only for blocked MS-DRSR attempts, which could alert your SOC to a potential attack!

uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 addr: action:allow
uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 addr: action:allow
uuid:e3514235-4b06-11d1-ab04-00c04fc2dcd2 action:block audit:true

Whenever the configuration changes, you need to notify the rpcFirewall.dll via the update command:

RpcFwManager.exe /update Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Msmailprobe : Office 365 And Exchange Enumeration

Msmailprobe is widely known that OWA (Outlook Web app) is vulnerable to time-based user enumeration attacks. This tool leverages all known, and even some lesser-known services exposed by default Exchange installations to enumerate users. It also targets Office 365 for error-based user enumeration.

Getting Started

If you want to download and compile the simple, non-dependant code, you must first install GoLang! I will let the incredible documentation, and other online resources help you with this task.

https://golang.org/doc/install

You may also download the compiled release here.

Syntax

List examples of commands for this applications, but simply running the binary with the examplescommand:

./msmailprobe examples

You can also get more specific help by running the binary with the arguments you are interested in:

./msmailprobe identify
./msmailprobe userenum
./msmailprobe userenum –onprem
./msmailprobe userenum –o365

Usage

Identify Command

* Used for gathering information about a host that may be pointed towards an Exchange or o365 tied domain
* Queries for specific DNS records related to Office 365 integration
* Attempts to extract internal domain name for onprem instance of Exchange
* Identifies services vulnerable to time-based user enumeration for onprem Exchange
* Lists password-sprayable services exposed for onprem Exchange host

Flag to use:
-t to specify target host
Example:
./msmailprobe identify -t mail.target.com

Userenum (o365) Command

* Error-based user enumeration for Office 365 integrated email addresses

Flags to use:
-E for email list OR -e for single email address
-o [optional]to specify an out file for valid emails identified
–threads [optional] for setting amount of requests to be made concurrently
Examples:
./msmailprobe userenum –o365 -E emailList.txt -o validemails.txt –threads 25
./msmailprobe userenum –o365 -e admin@target.com

Userenum (onprem) Command

* Time-based user enumeration against multiple onprem Exchange services

Flags to use:
-t to specify target host
-U for user list OR -u for single username
-o [optional]to specify an out file for valid users identified
–threads [optional] for setting amount of requests to be made concurrently
Examples:
./msmailprobe userenum –onprem -t mail.target.com -U userList.txt -o validusers.txt –threads 25
./msmailprobe userenum –onprem -t mail.target.com -u admin
Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SSH using Your Apple IIe Retro Computer & Get Stuff Done!

https://cdn-images-1.medium.com/max/1536/1*cluixlYh3mria7M5HPPJRw.jpeg
Want to do something completely pointless yet a lot of fun? Or perhaps you just want to use alternative tech to get away from the ads…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to make Canned Pasta Sauce Taste Homemade

https://cdn-images-1.medium.com/max/1125/1*i-7KX3R7lHRXAEby8N9ujA.jpeg
There are lots of ways to jazz up and inject some extra flavor to your canned Pasta Sauce.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

For people who do pentesting as a job, how frequently do you use Hydra?
https://www.reddit.com/r/Pentesting/comments/t23oox/for_people_who_do_pentesting_as_a_job_how/

Hello all of your wonderful red teamers, I'm on the blue side of the house. I'm going through hackthebox to widen my skills and better understand what's attackers are doing, and to have a bit of fun. I'm wondering how much people really use tools like Hydra in their pentesting gigs. ​ Kind regards submitted by /u/sma92878 (https://www.reddit.com/user/sma92878)
[link] (https://www.reddit.com/r/Pentesting/comments/t23oox/for_people_who_do_pentesting_as_a_job_how/) [comments] (https://www.reddit.com/r/Pentesting/comments/t23oox/for_people_who_do_pentesting_as_a_job_how/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Mifare classic card reading data

I have a mifare classic card I want to view the data from. I tried mfoc and it's ending with a error. So I tried milazycracker and that also ends with the same error after the first 13 keys. It does not go through to hardnested, just does mfoc.

So now I have mfcuk running and the guide says approx 30min but it's been running for more than 3 hours now and all I see is

Let me entertain you Uid 96475b1e Type 08 Key 000000000000 Block 03 Diff Nt 20798 (counting up) Auths 20798 (counting up)

Am I on the right track or just waisting time here?

Kali Linux Live usb on Intel i7 16gb ram, pn532 usb version.

submitted by /u/Dutchy_79
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How save is this, Mr and Mrs Hackers?

submitted by /u/FukoPup
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Gmail Critical Security Alert

Hello, I got an alert about my password being compromised for http://127.0.0.1:5000 . I don't really remember setting the username or password. The password looks auto generated

From what I've read, it seems like I should be fine since it's a local thing but wanted to hear some thoughts for peace of mind.

Thanks

submitted by /u/llllllXllllll
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Likelihood of 🇺🇸 looking the other for those taking a stand for 🇺🇦?

My red hat days are over but I read a headline the other day of 🇺🇦 pleading for the community to help. I can’t ignore this and I know I’m not the only one. What’s everyone’s take on this. Thinking we get some sort of immunity if things escalate?

submitted by /u/Dontnotknow
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking group ‘Anonymous’ declares cyber war against Vladimir Putin’s government before taking down website of Russian TV channel RT (Photos)

submitted by /u/wawwuly
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
anti virus software

what anti software virus protection do you guys use i need to find a good one

submitted by /u/xKitsu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Official Kremlin website down amid war in Ukraine

https://external-preview.redd.it/qibhD3Ks6SOFM3EKwfYI21AEikvlaLF0pMhlxmSuW-0.jpg?width=640&crop=smart&auto=webp&s=77d1c4738bd368539faf173e663dbfe1351d5063 submitted by /u/Motor-Ad-8858
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Ukraine is creating an IT army.

submitted by /u/Haldane-FRS
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Katoolin3 - Get Your Favourite Kali Linux Tools On Debian/Ubuntu/Linux Mint
http://www.kitploit.com/2022/02/katoolin3-get-your-favourite-kali-linux.html

___________________________
@hacking_Attack
@Hacking_Video

Katoolin3 brings all programs available in Kali Linux (https://www.kitploit.com/search/label/Kali%20Linux) to Debian and Ubuntu.
Description This program is a port of katoolin (https://github.com/LionSec/katoolin) from LionSec (https://github.com/LionSec) to python3. Katoolin3 offers several improvements over katoolin: Up to date packages
The old katoolin (https://www.kitploit.com/search/label/Katoolin) uses an outdated package list. Katoolin3 always keeps its package list up to date.
(Last updated: 18 Feb 2020) Improved handling of missing packages
The old katoolin breaks if a package isn't available in the repositories (https://www.kitploit.com/search/label/Repositories) anymore. Katoolin3 detects those and simply ignores them. Removal of packages
You can now remove all packages installed by katoolin3 (individually or all at once). Upgrading wont break your system anymore
...because the Kali repositories only get enabled during the runtime of katoolin3. Better utilization of the APT ecosystem
The old katoolin does potentially dangerous operations (https://www.kitploit.com/search/label/Operations) such as modifying and deleting important system configuration files. This has been changed. Easier maintenance of Kalis packages
The old katoolin makes it difficult to add new packages to the package list due to the way katoolin was programmed. Maintaining the package list is now a lot easier. Cleaner code
Due to poor code quality (https://www.kitploit.com/search/label/Code%20Quality) katoolin was unmaintainable and had to be rewritten from scratch. katoolin3 aims to be more readable and easier to maintain. Warning for Ubuntu users Installing programs from repositories for different operating systems is generally considered dangerous!
Some packages might (and probably will) break your system. Be careful when installing the tools and don't blame katoolin3 for any inconveniences.
The optimal solution is to install specific tools from tools.kali.org (https://tools.kali.org/tools-listing).
It is not recommended to install all tools. Requirements apt as a package manager Python >= 3.5 Root privileges sh, bash python3-apt Installation git clone https://github.com/s-h-3-l-l/katoolin3;
cd katoolin3;
chmod +x ./install.sh;
sudo ./install.sh; Important: If you get the error Please install the python3-apt package please make sure katoolin3 runs with exactly the same python3 version as the python3-apt package. On modern distributions python3-apt is only for python3.7 and on older distributions python3-apt is only for python3.5. Katoolin3 has to be run accordingly with python3.7 or python3.5. Usage The program flow of katoolin3 is realized by presenting a list of options that you can choose from. These lists look like that: 0) ...
1) ...
2) ...
Installing tools To install a package enter the corresponding number. To install multiple packages at once specify a range like 3-5, a list like 1,2,3 or combine them like 1,2,5-7,9. You can also install all packages at once. Uninstalling tools This works just like installing except that you have to prepend a ~ before your selection. You can also uninstall all packages at once. Searching Katoolin3 supports searching the package cache.
E.g. if you want to install some tools related to SQL injections you can go into the search menu and search for sql injection.
If you want to have specific information about a package just enter the package name in the same search menu. For more functionalities see the help dialogue inside the program. Updating To update your tool list execute chmod +x ./update.sh;
sudo ./update.sh; Something doesn't work? Hit me up on Github (https://github.com/s-h-3-l-l/katoolin3/issues/new/choose). Uninstalling To uninstall katoolin3 execute chmod +x ./uninstall.sh;
sudo ./uninstall.sh; Uninstalling the Kali tools can be done inside katoolin3.

___________________________
@hacking_Attack
@Hacking_Video