Kali Linux Tutorials
LACheck : Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration

LACheck is a Multithreaded C# .NET Assembly Local Administrative Privilege Enumeration.

Arguments

./LACheck.exe help _ _ _ | | /\ / | | | |
| | / \ | | | |_ _ | |
| | / /\ \ | | | ‘_ \ / _ \/ | |/ / | | / \ | || | | | / (| < |// _\ _|| ||___|___|_|_\
Usage:
LACheck.exe smb rpc /targets:hostname,fqdn.domain.tld,10.10.10.10 /ldap:all /ou:”OU=Special Servers,DC=example,DC=local” /verbose /bloodhound /user:bob@contoso.lab
Local Admin Checks:
smb – Attempts to access C$ share
rpc – Attempts WMI query of Win32_ComputerSystem Class provider over RPC
winrm – Attempts WMI query of Win32_ComputerSystem Class Provider over WinRM Session
Arguments:
/bloodhound – generate bloodhound-digestible AdminTo and Session collection file
output file is zipped and enypted with randomized name and password
/dc – specify domain controller to query (if not ran on a domain-joined host)
/domain – specify domain name (if not ran on a domain-joined host)
/edr – check host for EDR (requires smb, rpc, or winrm)
/logons – return logged on users on a host (requires smb, rpc, or winrm)
/registry – enumerate sessions from registry hive (requires smb)
/services – return services running as users (requires smb, rpc, or winrm)
/socket – send bloodhound output to TCP socket instead of writing to disk
ex: “”127.0.0.1:8080″”
/targets – comma-separated list of hostnames to check
/threads – specify maximum number of parallel threads (default=25)
/user – specify username that collection was run under (useful during token manipulation)
/validate – check credentials against Domain prior to scanning targets (useful during token manipulation)
/verbose – print additional logging information
/ou – specify LDAP OU to query enabled computer objects from
ex: “OU=Special Servers,DC=example,DC=local”
/ldap – query hosts from the following LDAP filters:
:all – All enabled computers with ‘primary’ group ‘Domain Computers’
:dc – All enabled Domain Controllers (not read-only DCs)
:exclude-dc – All enabled computers that are not Domain Controllers or read-only DCs
:servers – All enabled servers
:servers-exclude-dc – All enabled servers excluding Domain Controllers or read-only DCs

Execute Assembly

execute-assembly /opt/SharpTools/LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose

Output

[*] Tasked beacon to run .NET program: LACheck smb rpc winrm /ldap:servers-exclude-dc /targets:WEB01,DEV02.contoso.com,10.10.10.10 /logons /threads:10 /verbose
[+] host called home, sent: 111705 bytes
[+] received Output
[+] Parsed Aguments:
rpc: True
smb: True
winrm: True
/bloodhound: False
/edr: False
/logons: True
/registry: False
/services: False
/ldap: servers-exclude-dc
/ou:
/targets:
/threads: 10
/user: svcadmin
/validate: False
/verbose: False
[+] Performing LDAP query for all enabled computers that are not Domain Controllers or read-only DCs…
[+] This may take some time depending on the size of the environment
[+] LDAP Search Results: 2
[SMB] Admin Success: WEB01 as svcadmin
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[session] WEB01 – contoso\WEB01$ (svcadmin)
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[rdp] WEB01 – contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input: 00:00:00:00 (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 – contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)
[WinRM] Admin Success: DESKTOP[...]

-118GDCE as svcadmin
[WinRM] Admin Success: DEV02.contoso.com as svcadmin
[!] RPC on DEV02.contoso.com – Access denied.
[!] SMB on DEV02.contoso.com – Attempted to perform an unauthorized operation.
[RPC] Admin Success: 10.10.10.10 as svcadmin
[!] SMB on 10.10.10.10 – Attempted to perform an unauthorized operation.
[!] WinRM on 10.10.10.10 – The WinRM client cannot process the request. Default authentication may be used with an IP address under the following conditions: the transport is HTTPS or the destination is in the TrustedHosts list, and explicit credentials are provided. Use winrm.cmd to configure TrustedHosts. Note that computers in the TrustedHosts list might not be authenticated. For more information on how to set TrustedHosts run the following command: winrm help config.

WinRM Authentication

As seen in the above example output, attempting to check WinRM on the host at IP address 10.10.10.10will error due to the WinRM client not attempting to authenticate to a host via IP address.

Use hostnames when attempting to check WinRM Access. Specifying Targets

The /targets, /ldap, and /ouflags can all be used together or separately to generate a list of hosts to enumerate.

All hosts returned from these flags are combined and deduplicated before enumeration starts. Bloodhound

LACheck supports writing AdminTo and Session collected into json output that can be uploaded to BloodHound

This output is only meant to augment an existing BloodHound collection with updated Administrative privileges for a single user and Sessions collected from hosts that Administrative privileges have been identified

The /bloodhoundswitch will write a randomly-named encrypted zip file to disk which can be downloaded, extracted, and uploaded to BloodHound /user

BloodHound requires resolving users and computers to SIDs. Due to impersonation techniques such as Cobalt Strike’s make_tokenand kerberos_ticket_use, LACheck may not be able to accurately determine the user context for a collection. The /userarguement is required to supply LACheck with the user principal name (format = samaccountname@domain.tld) of the context it is ran under in order to accurately correlate the collection information. /socket

BloodHound output can be sent to a TCP socket instead of being written to disk.

If the TCP connection fails, BloodHound output will be written to disk.

In a Cobalt Strike beacon, TCP connections can be forwarded from a host back to the operator’s local machine using rportfwd_local:

rportfwd_local 8888 127.0.0.1 8888

An operator may then pipe the output of the TCP stream to a local file using netcat:

nc -lvnp 8888 > computers.json

Enumeration Methods Performance Summary
SMBWMIWinRM/edrfastfastfast/logonsfastfastfast/servicesslowfastfast/registryslowfast–
– = not implemented SMB /edr

Inspired by harleyQu1nn’s EDR.cna script

Directory.GetFiles Method returns a list of drivers from:

* \\host\C$\windows\system32\drivers
* \\host\C$\windows\sysnative\drivers

Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user

[EDR] WEB01 – Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 – no EDR found (svcadmin)

/logons

NetWkstaUserEnum returns a list of users with interactive, service and batch logons

WTSEnumerateSessionsA returns a list of RDP sessions on a host

WTSQuerySessionInformationA retrieves detailed information for each RDP session Example Output ran as svcadmin user

[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[session] WEB01 – contoso\WEB01$ (svcadmin)
[session] WEB01 – contoso\devadmin (svcadmin)
[session] WEB01 – contoso\devuser (svcadmin)
[rdp] WEB01 – contoso\devadmin rdp-tcp#2 Active Last Connection: 00:00:50:26 Last Input:[...]

00:00:00:00 (svcadmin)

/registry

Iterate through SIDs in \\Computer\HKEY_USERS\hive, attempts to access Volatile Environmentfor each SID, and retrieves values from USERDOMAINand USERNAMEkeys.

This method requires the Remote Registry service to be running on a remote host. If it is not:

1. initial start type of the Remote Registry service is recorded
2. start type is changed to Automatic3. Remote Registry service is started
4. registry hives are enumerated
5. Remote Registry service is stopped
6. start type is reverted to its initially recorded value

Due to the potentially multi-step process to enumerate each host, this method may be slower compared to alternative techniques. smb /logonsis faster Example Output ran as svcadmin user

[registry] WEB01 – contoso\devadmin (svcadmin)

/services

ServiceController.GetServices Method retrieves a list of services on a host

Each service is queried to determine the user it is configured to run as.

Due to each service having to be queried individually, this method may be slower compared to alternative techniques. wmi /servicesis faster Example Output ran as svcadmin user

[service] WEB01 – devadmin@consoso.com Service: secretsvc State: Running (svcadmin)

WMI /edr

Inspired by harleyQu1nn’s EDR.cna script

CIM_DataFile class returns a list of drivers from:

* \host\C$\windows\system32\drivers
* \host\C$\windows\sysnative\drivers

Drivers are looked up against a list of known drivers used by EDR vendors. Example Output ran as svcadmin user

[EDR] WEB01 – Found: CrowdStrike, SentinelOne (svcadmin)
[EDR] DEV02 – no EDR found (svcadmin)

/logons

Win32_LoggedOnUser class returns a list of logged on sessions Win32_LogonSession class returns detailed information for each session Example Output ran as svcadmin user

[session] WEB01 – contoso\devadmin 4/20/2021 11:00:05 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 1:40:52 PM (svcadmin)
[session] WEB01 – contoso\WEB01$ 4/20/2021 5:51:43 PM (svcadmin)
[session] WEB01 – contoso\devadmin 4/20/2021 09:54:38 AM (svcadmin)
[session] WEB01 – contoso\devuser 4/20/2021 10:14:32 AM (svcadmin)

/registry

Queries the Win32_UserProfile class to retrieve SIDs for user profiles on a system.

The EnumKey method of the StdRegProv class retrieves the \\Computer\HKEY_USERS\hive and attempts to access Volatile Environmentfor each returned SID to retrieve values from the USERDOMAINand USERNAMEkeys. Example Output ran as svcadmin user

[registry] WEB01 – contoso\devadmin (svcadmin)

/services

Queries the Win32_Service class to retrieve the name, user, and state of services Example Output ran as svcadmin user

[service] WEB01 – devadmin@consoso.com Service: secretsvc State: Running (svcadmin) Download

Hacking on Medium
PicoCTF \\ Obedient Cat \\ General Skills

https://cdn-images-1.medium.com/max/618/1*-4ByvVzNW1HhlSdEajuexA.png
Write-up for PicoCTF challanges

Continue reading on Medium »

Hacking on Medium
CISA and the FBI have issued warnings about the possibility of data wiping attacks

https://cdn-images-1.medium.com/max/768/1*q8f9uPqlsEXl9lVSkK9Qlg.jpeg
Data wiping assaults targeting Ukraine could spread to targets in other countries, according to the Cybersecurity and Infrastructure…

Continue reading on Medium »

Hacking on Medium
How I Cracked CONTI Ransomware Group’s Leaked Source Code ZIP File

https://cdn-images-1.medium.com/max/836/1*KSlIAwWlPGWplbZiJ0z5PA.png
Leaker posted full zip with password

Continue reading on Medium »

Password Reset to Admin Access

While testing a web application that used a web GUI over the top of an API, I noted the calls to the API where authorized with a JWT token…Continue reading on Medium »
Read more...

Password Reset to Admin Access

While testing a web application that used a web GUI over the top of an API, I noted the calls to the API where authorized with a JWT token…Continue reading on Medium »
Read more...

Exploit Collector
Rufus 3.17.1846 DLL Hijacking

https://4.bp.blogspot.com/-jEyO8wrBbtw/WWlvSr9oRmI/AAAAAAAAINg/irp20P4NPo4dOJoHHzIQ0XpAovWCMUh6wCLcBGAs/s1600/h38.png
Rufus version 3.17.1846 suffers from a dll hijacking vulnerability for both the executable and portable executable versions.

MD5 | 7400017ae2e5420d56dc998e4cc514eb

Download
Hi all,

I would like to disclose a vulnerability that I just found today.

Details below:

Vulnerable Software and Version:

1. Rufus 3.17.1846 executable
2. Rufus 3.17.1846 portable executable

Vulnerable software download link:
https://rufus.ie/en/

https://github.com/pbatard/rufus/releases/tag/v3.17

Date discovered and reported:
25 Feb 2022

Description:
Both Rufus 3.17.1846 executable AND portable executable are suffering from DLL
Hijacking by placing x86 MSASN1.dll or VERSION.dll in the same directory as
the executables, which could cause arbitrary code execution and privilege
escalation.

Taking MSASN1.dll as an example, craft a malicious x86 DLL with an entry
point with DllMain and place in the same directory, once double click the
executable, an x86 admin shell could be obtained as the executable requires
admin right to run by design.

Attack vector:
Taking MSASN1.dll as an example PoC code of dll can be found in my
repository

Attack steps:

1.

Craft and drop a malicious DLL named as "MSASN1.dll" with entry point
DllMain [image: image]
<https:
2.

Double click the executable "Rufus", administrator privilege is required
to run
3.

Malicious DLL has been called and an admin shell can be obtained as
PoC [image:
image]
<https:
This issue has been submitted to github as well and is acknowledged by the
owner,
https://github.com/pbatard/rufus/issues/1877

Thanks and regards,
James Tsz Ko Yeung

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Beyond the Hype: AI's Future in Defensive Cybersecurity

Hybridizing signatures with artificial intelligence is making a significant difference in our ability to detect cyberattacks, including ransomware.

hacking: security in practice
Tor bridges from 2022-02-19 to 2022-02-26 - all up & running and reachable in Russia for now…

Basically all of the bridges are up and running: https://metrics.torproject.org/rs.html#details/A0872A7FABF80812D29CA8AD18FA0415E73F05CE https://metrics.torproject.org/rs.html#details/2B7109812DC92CD5F448D755F4DAB2E8656B916F https://metrics.torproject.org/rs.html#details/8E3B4F4A4203866EFC984BC22CC2B1C4D97FECAA https://metrics.torproject.org/rs.html#details/EE16ABDD9EC8BF430F471917B2F9AA521133031B https://metrics.torproject.org/rs.html#details/4B8EF7EBF7392BE08D94C6290DBF3C647E95382B https://metrics.torproject.org/rs.html#details/E314AF558EC26A505C84CCF4C70F2030BE59C793 https://metrics.torproject.org/rs.html#details/E0DA515E727924C8E23E25B9262B46B3C19811A5 https://metrics.torproject.org/rs.html#details/7F0576510A411BC58CC9FDC5C0722ABCE472CD68 https://metrics.torproject.org/rs.html#details/F473F114E7CCF82599102F9EC51E4047448D1799 https://metrics.torproject.org/rs.html#details/F54A81923E07316E35197C10F7731FFB77DE8286 https://metrics.torproject.org/rs.html#details/A11445333CB8CA31E2AFBB68C60058DB025728DD https://metrics.torproject.org/rs.html#details/3AEED207EC3D29B71541CEAED18B3D8639CA0D07 https://metrics.torproject.org/rs.html#details/66469139C4772B3B224CBC8E6370E3DF8760F147 https://metrics.torproject.org/rs.html#details/77E2191A541DB1F40F63EF53189915DEC1D5F4D0 https://metrics.torproject.org/rs.html#details/6CF18408BAB497E90FBE8B9118500AB12D74DAAF https://metrics.torproject.org/rs.html#details/FC79259148975A1331D1565691AF7FED0849147B https://metrics.torproject.org/rs.html#details/8F3C610A19F7EB3726B04E993D475663367DB0F6 https://metrics.torproject.org/rs.html#details/AF746CF5EC1A5DB668CB87205F41262E6F980E17 https://metrics.torproject.org/rs.html#details/31A072D8A5BF805408B04903C0E850F134B20C91 https://metrics.torproject.org/rs.html#details/60C5238C4290438B643D70B1B026E8688B82C115 https://metrics.torproject.org/rs.html#details/EF37E0443B17F0D69536ED7FE2DFFA017F0A2488 https://metrics.torproject.org/rs.html#details/128C61C1D2B36C21B2B1443BF49BB0EA1C632870 https://metrics.torproject.org/rs.html#details/15D642315E798B0B7DF8DFBF00CECF8608A55D9B https://metrics.torproject.org/rs.html#details/B58AAD104B47DF815E9158634F62B9A7B5F6AC2F https://metrics.torproject.org/rs.html#details/1D2A14EC5C660B9D6F70836480CC1FA7AC344B16 https://metrics.torproject.org/rs.html#details/78E5386B72DF91F1ED7E71A2EF45ADEFFD8D0202 https://metrics.torproject.org/rs.html#details/E7EF3CD6CBE07D322E97F3DD8C7C795EDBC20F76 https://metrics.torproject.org/rs.html#details/DB794AC83A787F5C427CD35A63DAB48061AAE901 https://metrics.torproject.org/rs.html#details/CF011A88087C307F2D6F745EFF8CC85FC1C67073 https://metrics.torproject.org/rs.html#details/B0185A20A52A43E7505C40A07A0623FF2D476179 https://metrics.torproject.org/rs.html#details/700EEEA97E5D465310C407BECA3D0876B214428A https://metrics.torproject.org/rs.html#details/619CE905DF37E8B0C2439414E68D979F627F50A5 https://metrics.torproject.org/rs.html#details/5DA3023733BFEA667FF96678C810A7AB02434674 https://metrics.torproject.org/rs.html#details/C2A82F6E81EAEB2BD881ADAD8FDCDD5F77EBEEF7 https://metrics.torproject.org/rs.html#details/7C155C23B939BC0B4F4AF048C8CA87F7962E58F7 https://metrics.torproject.org/rs.html#details/4ADA63EA721C16DC0704C2ED2D6C39901A576337 https://metrics.torproject.org/rs.html#details/2FD5FACC242350DB30316D591E7AA590EED725B9 https://metrics.torproject.org/rs.html#details/36A8A0D2768AB06CC6DAA056B60F002D94E0D182 https://metrics.torproject.org/rs.html#details/596BC461AB5E0DBB0F07BFF5F1DBC24CD6C817B2 https://metrics.torproject.org/rs.html#details/97876C18AF7CE8C3E06B63B9883CF4A612FE9FD7 https://metrics.torproject.org/rs.html#details/DA0009C3F02250DBF135BCAFFFAEE6796699BB23 https://metrics.torproject.org/rs.html#details/477BF9DE55231154A3CD28BD65252228F6B65EBC
[...]

hacking: security in practice
Hackers rename Putin’s £73million superyacht 'FCKPTN' and change destination to 'Hell'

https://external-preview.redd.it/QyBxNv3aVbFFujtBtP1DyE06VM3oslV-CIq0Eg8gMCU.jpg?width=640&crop=smart&auto=webp&s=7b9e2f158cf053a546b25c31222c228f0c038cf8 submitted by /u/lboog423
[link] [comments]

Support: https://opensea.io/collection/bridges-of-ukraine

submitted by /u/taxtonia [link] [comments]

hacking: security in practice
Is it illegal to possess data leaked from a breach?

Let's say Company X was breached, and the attackers leaked the data publicly (or to the dark web). Could you get in legal trouble for downloading that data? I guess it's like possession of stolen goods, which is a crime, but what if you're a security researcher? Of if you're a customer of Company X, and want to see if any of your data is included in the breach?

submitted by /u/bigmetsfan
[link] [comments]

hacking: security in practice
Am I the only one that feels like NetworkChuck is overrated?

When I started my hacking journey, I came across NetworkChuck a couple times in Youtube. When you look at their titles, they look very promising, but when you actually check the content of the video and try it out practically, around 80% of things often don't work or doesn't work you expect to do so.

I don't know if it's a good place to talk about it here, but I'm just wondering what you guys think about that

submitted by /u/407PrxAuthReq
[link] [comments]

Password Reset to Admin Access
https://hogarth45.medium.com/password-reset-to-admin-access-3b2a649bdc3?source=rss------bug_bounty-5