KitPloit - PenTest Tools!
RefleXXion - A Utility Designed To Aid In Bypassing User-Mode Hooks Utilised By AV/EPP/EDR Etc

https://blogger.googleusercontent.com/img/a/AVvXsEiZXQO4yXgWyvIrcgJyLEj07jeVp1034eERhXSx9bywRBaybCmX9NeMdR9eKR9TyVhvDAXPgfPaonwHxkuFfGfgzDJRUzdW_fFpVY3xQAJ85lOHd0V0O5Ba2czlKwS97iqmX45LkgaCKtAZEcO3qRnbVzrzmMtvs3Cpki_5sQjKjscrX-tuSXzSngyw=w640-h208 IntroductionRefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature array. After that, there are two techniques that the user can choose to bypass the user-mode hooks.
Technique-1, reads the NTDLL as a file from C:\Windows\System32\ntdll.dll. After parsing, the .TEXT section of the already loaded NTDLL (where the hooks are performed) in memory is replaced with the .TEXT section of the clean NTDLL.

In Technique-2, NTDLL reads as Section from KnownDlls, \KnownDlls\ntdll.dll. (beacuse DLL files are cached in KnownDlls as Section.) After parsing, the .TEXT section of the already loaded NTDLL (where the hooks are performed) in memory is replaced with the .TEXT section of the clean NTDLL.

The detailed flow of the methodology and all techniques is given below. https://blogger.googleusercontent.com/img/a/AVvXsEhWJBdHkXQWBpa-8dXdlzlh19GBgKkDvoobwm9_2wjBB2kMJhr2VpzTc2LvDU_6R4Sg_VldfoJPSSs8Eq3ELyJOle5eaTvdbuadHPdT8gOusJbWJnL4xO9MOxyhs5N6mhiCPVjNKFlt2ldSFSiPgpOvRv7rq_1hY5eRqHud021kj9SVNXqlNvun6OJW=w624-h640 How to UseYou can open and compile the project with Visual Studio. The whole project supports x64 architecture for both Debug and Release modes.

The RefleXXion-EXE solution generates the EXE for PoC purpose. If you want to understand how the project works step by step, it will make your job easier. Main function contains Technique1 and Technique2 functions definations. Comment one of them and compile. Do not use both functions at the same time.

The RefleXXion-DLL solution generates the DLL that you inject into the process you want to bypass the user-mode hooks for NTDLL. At the beginning of the main.cppfile, there are definitions of which technique to use. You can choose one of them and compile it. Do not set all values at the same time, set only the one technique you want. Example configuration is given below. // Techniques configuration section
#define FROM_DISK 1 // If you set it to 1, the Technique-1 will be used. For more information; https://github.com/hlldz/RefleXXion
#define FROM_KNOWNDLLS 0 // If you set it to 1, the Technique-2 will be used. For more information; https://github.com/hlldz/RefleXXionOperational Usage Notes & OPSEC Concerns*
RefleXXion currently is only supports for x64 architecture.

*
RefleXXion only unhooks NTDLL functions, you may need to unhook other DLLs (kernel32.dll, advapi32.dll etc.) as well. For this, you can easily edit the necessary places in the project.

*
The RefleXXion only uses the RWX memory region when overwriting the .TEXT section process starts. For this process a new memory reginon is not created, the existing memory region (the TEXT section of the NTDLL that is already loaded) is RWXed and then converted to RX. ULONG oldProtection;
ntStatus = NtProtectVirtualMemory(NtCurrentProcess(), &lpBaseAddress, &uSize, PAGE_EXECUTE_READWRITE, &oldProtection);
memcpy()...
ntStatus = NtProtectVirtualMemory(NtCurrentProcess(), &lpBaseAddress, &uSize, oldProtection, &oldProtection);P.S. The RefleXXion invokes the NtProtectVirtualMemory API over the cleanly installed NTDLL. It uses the CustomGetProcAddress function for this because the clean NTDLL is not in the InLoadOrderModuleList even though it is[...]

___________________________
@hacking_Attack
@Hacking_Video

loaded into memory. So a solution like here (https://stackoverflow.com/questions/6734095/how-to-get-module-handle-from-func-ptr-in-win32) will not work. That's why the custom GetProcAddress function exists and is used.

*
You can load RefleXXion DLL from disk to target process. You may not prefer a run like this for sensitive work such as a Red Team operation. Therefore, you can convert the RefleXXion DLL to shellcode using the sRDI project or integrate the RefleXXion code into your own loader or project.

*
Even if NTDLL (as file or as section) is reloaded to the injected process, it does not remain loaded. RefleXXion close all opened handles (file & section handles) for own processes. Special Thanks & Credits* Research & PoC for collecting clean system calls with LdrpThunkSignature by Peter Winter-Smith, @peterwintrsmith. EDR Parallel-asis through Analysis, https://www.mdsec.co.uk/2022/01/edr-parallel-asis-through-analysis/
* Windows 10 Parallel Loading Breakdown by Jeffrey Tang. https://blogs.blackberry.com/en/2017/10/windows-10-parallel-loading-breakdown
* https://stackoverflow.com/questions/42789199/why-there-are-three-unexpected-worker-threads-when-a-win32-console-application-s
* Shellycoat by Upayan, @slaeryan. https://github.com/slaeryan/AQUARMOURY/tree/master/Shellycoat Download RefleXXion

___________________________
@hacking_Attack
@Hacking_Video

X-XSS-Protection headers. Protection or vulnerability?

What is it?Continue reading on Medium »
Read more...

X-XSS-Protection headers. Protection or vulnerability?

What is it?Continue reading on Medium »
Read more...

Have Your Cake and Eat it Too? An Overview of UNC2891
https://www.reddit.com/r/redteamsec/comments/tfv5zj/have_your_cake_and_eat_it_too_an_overview_of/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.mandiant.com/resources/unc2891-overview) [comments] (https://www.reddit.com/r/redteamsec/comments/tfv5zj/have_your_cake_and_eat_it_too_an_overview_of/)

___________________________
@hacking_Attack
@Hacking_Video

X-XSS-Protection headers. Protection or vulnerability?
https://thexssrat.medium.com/x-xss-protection-headers-protection-or-vulnerability-bc7213951320?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What is it?Continue reading on Medium » (https://thexssrat.medium.com/x-xss-protection-headers-protection-or-vulnerability-bc7213951320?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
VPNs Give Russians an End Run Around Censorship

As the invasion of Ukraine continues, Russian citizens have turned to virtual private networks — boosting demand for the software by 27x — to circumvent the government's blocks on social media and news sites critical of the war.

Dark Reading: Attacks/Breaches
What the Newly Signed US Cyber-Incident Law Means for Security

Bipartisan cybersecurity legislation comes amid increased worries over ransomware, and fears of cyberattacks from Russia in the wake of its invasion of Ukraine.

Dark Reading: Attacks/Breaches
Microsoft the No. 1 Most-Spoofed Brand in Phishing Attacks

New Barracuda Networks data shows attackers sent some 3 million emails from around 12,000 pilfered accounts.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Pen Testing Gains Critical Security Buy-in and Defense Insight

It's more important than ever for companies to challenge their defenses, learning about new gaps and opportunities for improvement along the way.

Dark Reading: Attacks/Breaches
4 Critical Capabilities for a SaaS Security Posture Management (SSPM) Solution

The need for deep visibility and remediation for SaaS security settings is critical. If you're considering a SaaS Security Posture Management solution, here’s a checklist of what to look for.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
CSC Unveils 3D Domain Monitoring Solution on DomainSec Platform

Continuing CSC research indicates over 70% of brand-specific domains are fake.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
TAC Security Survey Reveals: 88% of Businesses Rely on Manual Processes to Identify Network Vulnerabilities

___________________________
@hacking_Attack
@Hacking_Video

TOOL: ntlmrelayx2proxychains
https://www.reddit.com/r/redteamsec/comments/tfwjf3/tool_ntlmrelayx2proxychains/

ntlmrelayx2proxychains (https://github.com/He-No/ntlmrelayx2proxychains) aims to connect the tool of the SecureAuthCorps' (https://github.com/SecureAuthCorp) impacket (https://github.com/SecureAuthCorp/impacket) suite, ntlmrelayx.py (hereafter referred to as "ntlmrelayx"), along with @byt3bl33d3r (https://github.com/byt3bl33d3r)'s tool, CrackMapExec (https://github.com/byt3bl33d3r/CrackMapExec) (hereafter referred to as "CME"), over proxychains (https://github.com/haad/proxychains), developped by haad (https://github.com/haad). Currently, when having active relays via ntlmrelayx.py, you need to manually provide user, domain, and ip address in CME over proxychains. The idea behind this tool is to automate this process. So have you ever felt too lazy to explore all shares, loggedin users, sessions, disks, and/or password policy manually after using ntlmrelayx or felt too lazy to dump the lsa, sam, and/or ntds on all systems where you found a local administrator? If so, you'll for sure enjoy ntlmrelayx2proxychains (https://github.com/He-No/ntlmrelayx2proxychains)! :) Link: https://github.com/He-No/ntlmrelayx2proxychains submitted by /u/BugbearB (https://www.reddit.com/user/BugbearB)
[link] (https://www.reddit.com/r/redteamsec/comments/tfwjf3/tool_ntlmrelayx2proxychains/) [comments] (https://www.reddit.com/r/redteamsec/comments/tfwjf3/tool_ntlmrelayx2proxychains/)

___________________________
@hacking_Attack
@Hacking_Video

The 13 Best Vulnerable Web Applications & Vulnerable Websites for Testing

This list contains a variety of vulnerable websites, vulnerable web apps, battlegrounds and wargames communities.Continue reading on Medium »
Read more...