Kali Linux Tutorials
wmiexec-RegOut : Modify Version Of Impacket Wmiexec.Py, Get Output(Data,Response) From Registry

wmiexec-RegOut is the modify version of impacket wmiexec.py, wmipersist.py. Got output(data, response) from registry, don’t need SMB connection, but I’m in the bad code.

Overview

In original wmiexec.py, it get response from smb connection (port 445,139). Unfortunately, some antivirus software are monitoring these ports as high risk.
In this case, I drop smb connection function and use others method to execute command.

* wmiexec-reg-sch-UnderNT6-wip.py: Executed command by using win32-scheduledjob class. According to xiangshan, win32-scheduledjob class only works under windows NT6 (windows-server 2003).
BTW, win32_scheduledjob has been disabled by default after windows NT6. Here is the way how to enable it.

Key: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\Configuration
Name: EnableAt
Type: REG_DWORD
Value: 1

* wmipersist-wip.py (Highly recommend, !!!only works on impacket v0.9.24!!!): A Python version of WMIHACKER, which I picked the vbs template from it. Attacker can use it to do lateral movement safety under antivirus-software running.
* wmiexec-regOut.py: Just a simple Win32_Process.create method example .

How it works?

* wmiexec-wip.py workflow:Step 1:
* WMIC authenticated remotly
Step 2:
* Use win32process class and call create method to execute command. Then, write down the result into C:\windows\temp directory named [uuid].txt
Step 3:
* Encode the file content to base64 strings (need to wait a few seconds)
Step 4:
* Add the converted base64 string into registry, and key name call [uuid]
Step 5:
* Get the base64 strings remotly and decode it locally.

* wmipersist-wip.py workflow:Step 1:
* Add custom vbs script into ActiveScriptEventConsumer class.
Step 2:
* Creating an Event Filter.
Step 3:
* Trigger FilterToConsumerBinding class to PWNED!
Requirements

Generally, you just need to install official impacket.

* Portal

Usage

* wmiexec-wip.py usage:With cleartext password

python3 wmiexec-reg.py administrator:111qqq…@192.168.10.90 ‘whoami’

wmipersist-wip.py usage (Default is no output):

With cleartext password (without output)

python3 wmipersist-wip.py administrator:111qqq…@192.168.10.20 ‘command’
Download

___________________________
@hacking_Attack
@Hacking_Video

Cansina — Open Source Hidden Content Discovery Tool on Linux

Reconnaissance is one of the first steps to conduct within a pen test engagement. During this stage, information is gathered using…Continue reading on Medium »
Read more...

Cansina — Open Source Hidden Content Discovery Tool on Linux
https://thenurhabib.medium.com/cansina-open-source-hidden-content-discovery-tool-on-linux-c2bfb3bfce17?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Reconnaissance is one of the first steps to conduct within a pen test engagement. During this stage, information is gathered using…Continue reading on Medium » (https://thenurhabib.medium.com/cansina-open-source-hidden-content-discovery-tool-on-linux-c2bfb3bfce17?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Parameter Pollution - Zero Day
https://shahjerry33.medium.com/parameter-pollution-zero-day-3feb86ee8a02?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Summary :Continue reading on Medium » (https://shahjerry33.medium.com/parameter-pollution-zero-day-3feb86ee8a02?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What is your favorite automation tools?

Title

submitted by /u/void02241
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tryhackme : biteme

https://cdn-images-1.medium.com/max/1066/1*uxUHgFB-7avNTdwlqjAxFQ.png
Hola Hackers, Sigma here and I am writing my first blog about a tryhackme box called biteme. This box is rated medium on the platform and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to install Android in Windows PC & Laptop’s

https://cdn-images-1.medium.com/max/1440/1*zw6tF8Ph5RkCfIKkWSCp0w.jpeg
In this write-up I’m show you how to Install (Windows subsystem for Android) in simple 5 step’s.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Cansina — Open Source Hidden Content Discovery Tool on Linux

https://cdn-images-1.medium.com/max/1000/0*DcrT7GqsC6Rwvdpp.jpg
Reconnaissance is one of the first steps to conduct within a pen test engagement. During this stage, information is gathered using…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Secure Software Summit: The State of OSS Supply Chain Security

https://cdn-images-1.medium.com/max/2600/0*0JpaIJxznXkL7ZIF
By Dan Lorenc, Chainguard

Continue reading on ShiftLeft Blog »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Moving executable to startup folder triggers windows defender on Windows 10. Is there a way to stay undetected?

Just coding a program for myself and when I copy my executable to the startup folder windows defender automatically blocks it. 6 years ago this was undetected but times have changed

submitted by /u/Letsgoandexplore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
beginning

hey guys lI'm trying to get into hacking, i downloaded an app called Ethical Hacking and it's asking me to download virtual box with Kali Linux but i don't know which one it is. any suggestions?

submitted by /u/RoyaleKnightGaming
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/T-tavwUrYdLDj8nhaUXgBptZMqaocP8PBOcv7qUY_Ws.jpg submitted by /u/quesoboi21
[link] [comments]

hacking: security in practice
Clickjacking method that bypassed CORS for multi-step

https://external-preview.redd.it/KsrlIWF5nHc865UWAdaB5kAv62i-nUH8p4u2QVYYsMc.jpg?width=320&crop=smart&auto=webp&s=39fc846348814f6f4871b92c4f1fb9c073830be3 submitted by /u/AntoinetMartin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PurplePanda - Identify Privilege Escalation Paths Within And Across Different Clouds

https://blogger.googleusercontent.com/img/a/AVvXsEidFt5ibzldwSMn7USOdo2gx3oMcsxByF3lgUJoDBOC4Z2ptdk7eIPaXW2X6QRdSTtetxUYTJwyHDW3ACkPHjuUI6UpAlExnhjmilPS4P4RqWW5a8Diy5wyN_2auA2qrkrJsS9v-buM25PYe77IiapDqWL_Xamjgr8LNGGSRcsFBaGdJKgiYlZ9Z5f1=w640-h400 This tool fetches resources from different cloud/saas applications focusing on permissions in order to identify privilege escalation paths and dangerous permissions in the cloud/saas configurations. Note that PurplePanda searches both privileges escalation paths within a platform and across platforms.

The name comes from the animal Red Panda. This panda eats peas, just like Purple Panda, which can ingest API keys/tokens found by these PEASS. The color was changed to purple because this tool is meant mainly for Purple Teams (because it can be highly useful for both Blue and Red Teams). How to useEach folder inside /inteldefines one platform that can be enumerated and contains a README.md file explaining how to use that specific module.

Download Neo4jDesktop and create a database. Then export the env variables PURPLEPANDA_NEO4J_URLand PURPLEPANDA_PWDwith the URL to the neo4j database and the password.

If you want shodan to be used with public IPs discovered during the enumeration export a env variable called SHODAN_KEY with a valid api key of shodan.

Then just install and launch the program indicating the platforms you want to enumerate comma separated like: git clone https://github.com/carlospolop/PurplePanda
cd PurplePanda
python3 -m venv .
source bin/activate
python3 -m pip install -r requirements.txt
export PURPLEPANDA_NEO4J_URL="bolt://neo4j@localhost:7687"
export PURPLEPANDA_PWD="neo4j_pwd_4_purplepanda"
python3 main.py -h # Get help
python3 main.py -e --enumerate google,github,k8s --github-only-org --k8s-get-secret-values --gcp-get-secret-values # Enumerate google, github and k8sPurplePanda has 2 analysis modes:

* -e(enumerate): This is the main one, it will try to gather data and analyze it.
* -a(analyze): This will perform a quick analysis of the provided credentials. Video tutorialCheck how to use and inspect the data gathered by PurplePanda: For Blue/Purple TeamsUse credentials for each platform with at least admin read access to all the resources of the platform. This will help you to see exactly the privesc paths that can be abused within your configurations in each platform and across For Red TeamsPurplePanda is also designed to be used by Red Teams. In general, cloud/saas platforms won't give everyone access to read the configuration of the platform, that's why PurplePanda supports the use of several keys for the same platform, in order to try to enumerate everything with all the keys you compromised and have the most accurate view of the configuration of the platform. Supported platforms* Google Cloud Platform (GCP): To understand how GCP security works and how to abuse roles and permissions read https://book.hacktricks.xyz/cloud-security/gcp-security
* Github: To understand how Github security works and how to bypass branch protections, steal secrets, privesc... read https://book.hacktricks.xyz/cloud-security/github-security
* Kubernetes (K8s): To understand how Kubernetes RBAC security works and how to abuse roles, privesc to other clouds... read https://book.hacktricks.xyz/cloud-security/pentesting-kubernetes How to use the dataUse the -dparameter indicating a directory. Then, PurplePanda will write in this directory several interesting analysis in csvformat of the information obtained from all the platforms. The recommendation is to find interesting and unexpected things in those files an[...]

___________________________
@hacking_Attack
@Hacking_Video