Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta
Lapsus$ Data Kidnappers Claim Snatches From Microsoft, OktaPost Views: 49
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
Lapsus$ shared screenshots of internal Okta systems and 40Gb of purportedly stolen Microsoft data on Bing, Bing Maps and Cortana.
Both Microsoft and Okta are investigating claims by the new, precocious data extortion group Lapsus$ that the gang has breached their systems.
Lapsus$ claimed to have gotten itself “superuser/admin” access to internal systems at authentication firm Okta. It also posted 40GB worth of files to its Telegram channel, including screenshots and source code, of what the group said is Microsoft’s internal projects and systems.
The news was first reported by Vice and Reuters.
Okta confirmed on Tuesday that it had been hit and that some customers may have been affected. The scope of the breach isn’t yet clear, but it could be huge: According to Okta, it has hundreds of millions of users that use its platform to provide access to networks, including employees at thousands of large companies such as Fedex, Moody’s, T-Mobile, Hewlett Packard Enterprise and GrubHub, to name a few.
A Microsoft spokesperson told Threatpost that its investigation found that an account had been compromised, “granting limited access.” Its cybersecurity response teams quickly engaged to remediate the compromised account and prevent further activity, the spokesperson said.
“We do not rely on the secrecy of code as a security measure and viewing source code isn’t tied to elevation of risk,” Microsoft said. The Microsoft Threat Intelligence team on Tuesday published a blog detailing observed activity of the Lapsus$, which Microsoft tracks as DEV-0537. ‘Very Worrisome’ ScreenshotsThe purported Okta screenshots included one that appears to show Okta’s Slack channels and another with a Cloudflare interface. In an accompanying message, the group said its focus was “ONLY on Okta customers.”
Bill Demirkapi, an independent security researcher, tweeted that the screenshots “are very worrisome. … LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords.”
Cloudflare announced on Tuesday that it’s not up for risking its employees’ Okta credentials. The company, which uses Okta for employee authentication, is resetting its employees credentials, Co-founder and CEO Matthew Prince said on Twitter, “out of an abundance of caution.”
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
We are resetting the @Okta credentials of any employees who’ve changed their passwords in the last 4 months, out of abundance of caution. We’ve confirmed no compromise. Okta is one layer of security. Given they may have an issue we’re evaluating alternatives for that layer.
— Matthew Prince 🌥 (@eastdakota) March 22, 2022 Breach Dates to JanuaryDemirkapi noted another scary thing about the screenshots: Namely, they indicate a date of Jan. 21, 2022. If the date is correct, it suggests that Okta “failed to publicly acknowledge any breach for at least two months,” he said.
The LAPSUS$ ransomware group has claimed to breach Okta sharing the following images from internal systems. pic.twitter.com/eTtpgRzer7
— Bill Demirkapi (@BillDemirkapi) March 22, 2022
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Yes, the dates could mean that Lapsus$ has had access to Okta for months, but then again, they could instead indicate that Lapsus$ enjoyed a brief [...]
Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta
Lapsus$ Data Kidnappers Claim Snatches From Microsoft, OktaPost Views: 49
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
Lapsus$ shared screenshots of internal Okta systems and 40Gb of purportedly stolen Microsoft data on Bing, Bing Maps and Cortana.
Both Microsoft and Okta are investigating claims by the new, precocious data extortion group Lapsus$ that the gang has breached their systems.
Lapsus$ claimed to have gotten itself “superuser/admin” access to internal systems at authentication firm Okta. It also posted 40GB worth of files to its Telegram channel, including screenshots and source code, of what the group said is Microsoft’s internal projects and systems.
The news was first reported by Vice and Reuters.
Okta confirmed on Tuesday that it had been hit and that some customers may have been affected. The scope of the breach isn’t yet clear, but it could be huge: According to Okta, it has hundreds of millions of users that use its platform to provide access to networks, including employees at thousands of large companies such as Fedex, Moody’s, T-Mobile, Hewlett Packard Enterprise and GrubHub, to name a few.
A Microsoft spokesperson told Threatpost that its investigation found that an account had been compromised, “granting limited access.” Its cybersecurity response teams quickly engaged to remediate the compromised account and prevent further activity, the spokesperson said.
“We do not rely on the secrecy of code as a security measure and viewing source code isn’t tied to elevation of risk,” Microsoft said. The Microsoft Threat Intelligence team on Tuesday published a blog detailing observed activity of the Lapsus$, which Microsoft tracks as DEV-0537. ‘Very Worrisome’ ScreenshotsThe purported Okta screenshots included one that appears to show Okta’s Slack channels and another with a Cloudflare interface. In an accompanying message, the group said its focus was “ONLY on Okta customers.”
Bill Demirkapi, an independent security researcher, tweeted that the screenshots “are very worrisome. … LAPSUS$ appears to have gotten access to the @Cloudflare tenant with the ability to reset employee passwords.”
Cloudflare announced on Tuesday that it’s not up for risking its employees’ Okta credentials. The company, which uses Okta for employee authentication, is resetting its employees credentials, Co-founder and CEO Matthew Prince said on Twitter, “out of an abundance of caution.”
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
We are resetting the @Okta credentials of any employees who’ve changed their passwords in the last 4 months, out of abundance of caution. We’ve confirmed no compromise. Okta is one layer of security. Given they may have an issue we’re evaluating alternatives for that layer.
— Matthew Prince 🌥 (@eastdakota) March 22, 2022 Breach Dates to JanuaryDemirkapi noted another scary thing about the screenshots: Namely, they indicate a date of Jan. 21, 2022. If the date is correct, it suggests that Okta “failed to publicly acknowledge any breach for at least two months,” he said.
The LAPSUS$ ransomware group has claimed to breach Okta sharing the following images from internal systems. pic.twitter.com/eTtpgRzer7
— Bill Demirkapi (@BillDemirkapi) March 22, 2022
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Yes, the dates could mean that Lapsus$ has had access to Okta for months, but then again, they could instead indicate that Lapsus$ enjoyed a brief [...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta Lapsus$ Data Kidnappers Claim Snatches From Microsoft, OktaPost Views: 49 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 2…
romp before it got kicked out. The latter is the case, Okta CEO Todd McKinnon.
On Tuesday, the CEO tweeted that in January 2022, Okta detected an attempted compromise of “a third-party customer support engineer working for one of our subprocessors” but that “the matter was investigated and contained by the subprocessor.”
Okta believes the screenshots Lapsus$ shared online are connected to the January incident. “Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January,” McKinnon said.
We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January. (2 of 2)
— Todd McKinnon (@toddmckinnon) March 22, 2022
See Also: Offensive Security Tool: Scapy Did Rogue Employees Pitch In?If the dates are accurate, it means that Lapsus$ may well have been successful when it put up a “help wanted” notice on its Telegram channel on March 10. The group posted that it recruiting company insiders – including those at Microsoft; other big software/gaming companies such as Apple, IBM or EA; telecoms such as Telefonica, ATT; and more – to help it carry out its dirty work.
From its March 10 Telegram post:
“We recruit employees/insider at the following!!!! … TO NOTE: WE ARE NOT LOOKING FOR DATA, WE ARE LOOKING FOR THE EMPLOYEE TO PROVIDE US A VPN OR CITRIX TO THE NETWORK, or some anydesk” – references to technologies that the cybercriminals could use to penetrate targets’ networks with insiders’ help. Data on Bing, Bing Maps, Cortana Allegedly StolenOn Monday, Lapsus$ began to circulate a 10GB compressed archive that purportedly contains internal data on Microsoft’s Bing search engine and Bing Maps, along with the source code to the company’s voice assistant software Cortana.
The leaked data is dated March 20, 2022.
“Bing maps is 90% complete dump. Bing and Cortana around 45%,” Lapsus$ wrote on its Telegram channel.
Microsoft acknowledged the claims and said that it’s investigating. Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: threatpost.com Full posthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/79ohvicqaKcVP9KT2mDdTH-90x90.jpg Most QNAP NAS Devices Affected by ‘Dirty Pipe’ Linux Flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Lapsus-group-has-hacked-Ubisoft-as-well-90x90.jpg Ubisoft has confirmed it was hacked by Lapsus$ group1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/raccoon-stealer-90x90.jpg Raccoon Stealer Crawls Into Telegram1 week ago
* h[...]
On Tuesday, the CEO tweeted that in January 2022, Okta detected an attempted compromise of “a third-party customer support engineer working for one of our subprocessors” but that “the matter was investigated and contained by the subprocessor.”
Okta believes the screenshots Lapsus$ shared online are connected to the January incident. “Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January,” McKinnon said.
We believe the screenshots shared online are connected to this January event. Based on our investigation to date, there is no evidence of ongoing malicious activity beyond the activity detected in January. (2 of 2)
— Todd McKinnon (@toddmckinnon) March 22, 2022
See Also: Offensive Security Tool: Scapy Did Rogue Employees Pitch In?If the dates are accurate, it means that Lapsus$ may well have been successful when it put up a “help wanted” notice on its Telegram channel on March 10. The group posted that it recruiting company insiders – including those at Microsoft; other big software/gaming companies such as Apple, IBM or EA; telecoms such as Telefonica, ATT; and more – to help it carry out its dirty work.
From its March 10 Telegram post:
“We recruit employees/insider at the following!!!! … TO NOTE: WE ARE NOT LOOKING FOR DATA, WE ARE LOOKING FOR THE EMPLOYEE TO PROVIDE US A VPN OR CITRIX TO THE NETWORK, or some anydesk” – references to technologies that the cybercriminals could use to penetrate targets’ networks with insiders’ help. Data on Bing, Bing Maps, Cortana Allegedly StolenOn Monday, Lapsus$ began to circulate a 10GB compressed archive that purportedly contains internal data on Microsoft’s Bing search engine and Bing Maps, along with the source code to the company’s voice assistant software Cortana.
The leaked data is dated March 20, 2022.
“Bing maps is 90% complete dump. Bing and Cortana around 45%,” Lapsus$ wrote on its Telegram channel.
Microsoft acknowledged the claims and said that it’s investigating. Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?
If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: threatpost.com Full posthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/79ohvicqaKcVP9KT2mDdTH-90x90.jpg Most QNAP NAS Devices Affected by ‘Dirty Pipe’ Linux Flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Lapsus-group-has-hacked-Ubisoft-as-well-90x90.jpg Ubisoft has confirmed it was hacked by Lapsus$ group1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/raccoon-stealer-90x90.jpg Raccoon Stealer Crawls Into Telegram1 week ago
* h[...]
Hacking Articles Tips Tricks Videos Tutorials
romp before it got kicked out. The latter is the case, Okta CEO Todd McKinnon. On Tuesday, the CEO tweeted that in January 2022, Okta detected an attempted compromise of “a third-party customer support engineer working for one of our subprocessors” but that…
ttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/kali-bright-90x90.jpg Kali Unkaputtbar – a new feature on Kali Linux2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/wolf-in-sheps-clothing-2-scaled-e1646927438585-90x90.jpeg Malware Posing as Russia DDoS Tool Bites Ukraine Hackers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-90x90.jpg Agencies in Ukraine targeted with MicroBackdoor malware2 weeks ago
The post Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta first appeared on Black Hat Ethical Hacking.
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/wolf-in-sheps-clothing-2-scaled-e1646927438585-90x90.jpeg Malware Posing as Russia DDoS Tool Bites Ukraine Hackers2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-90x90.jpg Agencies in Ukraine targeted with MicroBackdoor malware2 weeks ago
The post Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta first appeared on Black Hat Ethical Hacking.
ShellcodeTemplate - An Easily Modifiable Shellcode Template For Windows X64/X86
http://www.kitploit.com/2022/03/shellcodetemplate-easily-modifiable.html
http://www.kitploit.com/2022/03/shellcodetemplate-easily-modifiable.html
An easily modifiable shellcode template for Windows (https://www.kitploit.com/search/label/Windows) x64/x86 How does it work? This template is heavily based on Austin Hudson's (aka SecIdiot) (https://twitter.com/ilove2pwn_) TitanLdr (https://github.com/SecIdiot/TitanLdr) It compiles the project into a PE Executable and extracts the .text section
Example The entrypoint of the shellcode looks like this. Of course, this can be changed for your need. First we need to initialize needed libraries and functions by using our custom written GetModuleHandle and GetProcAddress. SEC( text, B ) VOID Entry( VOID )
{
INSTANCE Instance = { };
Instance.Modules.Kernel32 = TGetModuleHandle( HASH_KERNEL32 );
Instance.Modules.Ntdll = TGetModuleHandle( HASH_NTDLL );
if ( Instance.Modules.Kernel32 != NULL )
{
// Load needed functions
Instance.Win32.LoadLibraryA = TGetProcAddr( Instance.Modules.Kernel32, 0xb7072fdb );
// Load needed Libraries
Instance.Modules.User32 = Instance.Win32.LoadLibraryA( GET_SYMBOL( "User32" ) );
if ( Instance.Modules.User32 != NULL )
{
Instance.Win32.MessageBoxA = TGetProcAddr( Instance.Modules.User32, 0xb303ebb4 );
}
}
// ------ Code ------
Instance.Win32.MessageBoxA( NULL, GET_SYMBOL( "Hello World" ), GET_SYMBOL( "MessageBox Title" ), MB_OK );
} Btw as you can see we can use normal strings in our shellcode. This is because we include the .rdata section into our shellcode at linking time. And GET_SYMBOL gets the pointer to the function or string via its relative offset to GetRIP()
Example The entrypoint of the shellcode looks like this. Of course, this can be changed for your need. First we need to initialize needed libraries and functions by using our custom written GetModuleHandle and GetProcAddress. SEC( text, B ) VOID Entry( VOID )
{
INSTANCE Instance = { };
Instance.Modules.Kernel32 = TGetModuleHandle( HASH_KERNEL32 );
Instance.Modules.Ntdll = TGetModuleHandle( HASH_NTDLL );
if ( Instance.Modules.Kernel32 != NULL )
{
// Load needed functions
Instance.Win32.LoadLibraryA = TGetProcAddr( Instance.Modules.Kernel32, 0xb7072fdb );
// Load needed Libraries
Instance.Modules.User32 = Instance.Win32.LoadLibraryA( GET_SYMBOL( "User32" ) );
if ( Instance.Modules.User32 != NULL )
{
Instance.Win32.MessageBoxA = TGetProcAddr( Instance.Modules.User32, 0xb303ebb4 );
}
}
// ------ Code ------
Instance.Win32.MessageBoxA( NULL, GET_SYMBOL( "Hello World" ), GET_SYMBOL( "MessageBox Title" ), MB_OK );
} Btw as you can see we can use normal strings in our shellcode. This is because we include the .rdata section into our shellcode at linking time. And GET_SYMBOL gets the pointer to the function or string via its relative offset to GetRIP()
Get Started Clone this project and you are ready to start git clone https://www.github.com/Cracked5pider/ShellcodeTemplate
Next you would need to change the project name in the makefile from ShellcodeTemplate to whatever you want Then you can compile the project by using make make // to compile x64 and x86
make x64 // to compile only x64
make x86 // to compile only x86
Credit Huge credit goes to Austin Hudson (aka SecIdiot) (https://twitter.com/ilove2pwn_)!!!
Download ShellcodeTemplate (https://github.com/Cracked5pider/ShellcodeTemplate)
Next you would need to change the project name in the makefile from ShellcodeTemplate to whatever you want Then you can compile the project by using make make // to compile x64 and x86
make x64 // to compile only x64
make x86 // to compile only x86
Credit Huge credit goes to Austin Hudson (aka SecIdiot) (https://twitter.com/ilove2pwn_)!!!
Download ShellcodeTemplate (https://github.com/Cracked5pider/ShellcodeTemplate)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Dive : A Tool For Exploring Each Layer In A Docker Image
Dive is a tool for exploring a docker image, layer contents, and discovering ways to shrink the size of your Docker/OCI image.
To analyze a Docker image simply run dive with an image tag/id/digest:
dive <your-image-tag
or if you want to build your image then jump straight into analyzing it:
dive build -t <some-tag
Building on Macbook (supporting only the Docker container engine)
docker run –rm -it \
-v /var/run/docker.sock:/var/run/docker.sock \
-v “$(pwd)”:”$(pwd)” \
-w “$(pwd)” \
-v “$HOME/.dive.yaml”:”$HOME/.dive.yaml” \
wagoodman/dive:latest build -t .
Additionally you can run this in your CI pipeline to ensure you’re keeping wasted space to a minimum (this skips the UI):
CI=true dive <your-image Basic FeaturesShow Docker image contents broken down by layer
As you select a layer on the left, you are shown the contents of that layer combined with all previous layers on the right. Also, you can fully explore the file tree with the arrow keys.
Indicate what’s changed in each layer
Files that have changed, been modified, added, or removed are indicated in the file tree. This can be adjusted to show changes for a specific layer, or aggregated changes up to this layer.
Estimate “image efficiency”
The lower left pane shows basic layer info and an experimental metric that will guess how much wasted space your image contains. This might be from duplicating files across layers, moving files across layers, or not fully removing files. Both a percentage “score” and total wasted file space is provided.
Quick build/analysis cycles
You can build a Docker image and do an immediate analysis with one command:
CI Integration
Analyze an image and get a pass/fail result based on the image efficiency and wasted space. Simply set
Multiple Image Sources and Container Engines Supported
With the
dive <your-image–source
With valid
*
*
*
wget https://github.com/wagoodman/dive/releases/download/v0.9.2/dive_0.9.2_linux_amd64.deb
sudo apt install ./dive_0.9.2_linux_amd64.deb
RHEL/Centos
curl -OL https://github.com/wagoodman/dive/releases/download/v0.9.2/dive_0.9.2_linux_amd64.rpm
rpm -i dive_0.9.2_linux_amd64.rpm
Arch Linux
Available as dive in the Arch User Repository (AUR).
yay -S dive
The above example assumes
Mac
If you use Homebrew:
brew install dive
If you use MacPorts:
sudo port install dive
Or download the latest Darwin build from the releases page.
Windows
Download the latest release.
Go tools Requires Go version 1.10 or higher. CI IntegrationWhen running dive with the environment variable
rules:
# If the efficiency is measured below X%, mark as failed.
# Expressed as a ratio between 0-1.
lowestEfficiency: 0.95
# If the amount of wasted space is at least X or larger than X, mark as failed.
# Expressed in B, KB, MB, and GB.
highestWastedBytes: 20MB
# If the amount of wasted space makes up for [...]
Dive : A Tool For Exploring Each Layer In A Docker Image
Dive is a tool for exploring a docker image, layer contents, and discovering ways to shrink the size of your Docker/OCI image.
To analyze a Docker image simply run dive with an image tag/id/digest:
dive <your-image-tag
or if you want to build your image then jump straight into analyzing it:
dive build -t <some-tag
Building on Macbook (supporting only the Docker container engine)
docker run –rm -it \
-v /var/run/docker.sock:/var/run/docker.sock \
-v “$(pwd)”:”$(pwd)” \
-w “$(pwd)” \
-v “$HOME/.dive.yaml”:”$HOME/.dive.yaml” \
wagoodman/dive:latest build -t .
Additionally you can run this in your CI pipeline to ensure you’re keeping wasted space to a minimum (this skips the UI):
CI=true dive <your-image Basic FeaturesShow Docker image contents broken down by layer
As you select a layer on the left, you are shown the contents of that layer combined with all previous layers on the right. Also, you can fully explore the file tree with the arrow keys.
Indicate what’s changed in each layer
Files that have changed, been modified, added, or removed are indicated in the file tree. This can be adjusted to show changes for a specific layer, or aggregated changes up to this layer.
Estimate “image efficiency”
The lower left pane shows basic layer info and an experimental metric that will guess how much wasted space your image contains. This might be from duplicating files across layers, moving files across layers, or not fully removing files. Both a percentage “score” and total wasted file space is provided.
Quick build/analysis cycles
You can build a Docker image and do an immediate analysis with one command:
dive build -t some-tag .You only need to replace your docker buildcommand with the same dive buildcommand.CI Integration
Analyze an image and get a pass/fail result based on the image efficiency and wasted space. Simply set
CI=truein the environment when invoking any valid dive command.Multiple Image Sources and Container Engines Supported
With the
--sourceoption, you can select where to fetch the container image from:dive <your-image–source
With valid
sourceoptions as such:*
docker: Docker engine (the default option)*
docker-archive: A Docker Tar Archive from disk*
podman: Podman engine (linux only) InstallationUbuntu/Debianwget https://github.com/wagoodman/dive/releases/download/v0.9.2/dive_0.9.2_linux_amd64.deb
sudo apt install ./dive_0.9.2_linux_amd64.deb
RHEL/Centos
curl -OL https://github.com/wagoodman/dive/releases/download/v0.9.2/dive_0.9.2_linux_amd64.rpm
rpm -i dive_0.9.2_linux_amd64.rpm
Arch Linux
Available as dive in the Arch User Repository (AUR).
yay -S dive
The above example assumes
yayas the tool for installing AUR packages.Mac
If you use Homebrew:
brew install dive
If you use MacPorts:
sudo port install dive
Or download the latest Darwin build from the releases page.
Windows
Download the latest release.
Go tools Requires Go version 1.10 or higher. CI IntegrationWhen running dive with the environment variable
CI=truethen the dive UI will be bypassed and will instead analyze your docker image, giving it a pass/fail indication via return code. Currently there are three metrics supported via a .dive-cifile that you can put at the root of your repo:rules:
# If the efficiency is measured below X%, mark as failed.
# Expressed as a ratio between 0-1.
lowestEfficiency: 0.95
# If the amount of wasted space is at least X or larger than X, mark as failed.
# Expressed in B, KB, MB, and GB.
highestWastedBytes: 20MB
# If the amount of wasted space makes up for [...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Dive : A Tool For Exploring Each Layer In A Docker Image Dive is a tool for exploring a docker image, layer contents, and discovering ways to shrink the size of your Docker/OCI image. To analyze a Docker image simply run dive with an…
X% or more of the image, mark as failed.
# Note: the base image layer is NOT included in the total image size.
# Expressed as a ratio between 0-1; fails if the threshold is met or crossed.
highestUserWastedPercent: 0.20 KeyBindingsKey BindingDescriptionCtrl + CExitTabSwitch between the layer and filetree viewsCtrl + FFilter filesPageUpScroll up a pagePageDownScroll down a pageCtrl + ALayer view: see aggregated image modificationsCtrl + LLayer view: see current layer modificationsSpaceFiletree view: collapse/uncollapse a directoryCtrl + SpaceFiletree view: collapse/uncollapse all directoriesCtrl + AFiletree view: show/hide added filesCtrl + RFiletree view: show/hide removed filesCtrl + MFiletree view: show/hide modified filesCtrl + UFiletree view: show/hide unmodified filesCtrl + BFiletree view: show/hide file attributesPageUpFiletree view: scroll up a pagePageDownFiletree view: scroll down a page UI ConfigurationNo configuration is necessary, however, you can create a config file and override values: supported options are “docker” and “podman”container-engine: docker continue with analysis even if there are errors parsing the image archiveignore-errors: false
log:
enabled: true
path: ./dive.log
level: info Note: you can specify multiple bindings by separating values with a comma.Note: UI hinting is derived from the first bindingkeybinding:
# Global bindings
quit: ctrl+c
toggle-view: tab
filter-files: ctrl+f, ctrl+slash
# Layer view specific bindings
compare-all: ctrl+a
compare-layer: ctrl+l
# File view specific bindings
toggle-collapse-dir: space
toggle-collapse-all-dir: ctrl+space
toggle-added-files: ctrl+a
toggle-removed-files: ctrl+r
toggle-modified-files: ctrl+m
toggle-unmodified-files: ctrl+u
toggle-filetree-attributes: ctrl+b
page-up: pgup
page-down: pgdn
diff:
# You can change the default files shown in the filetree (right pane). All diff types are shown by default.
hide:
– added
– removed
– modified
– unmodified
filetree:
# The default directory-collapse state
collapse-dir: false
# The percentage of screen width the filetree should take on the screen (must be >0 and
pane-width: 0.5
# Show the file attributes next to the filetree
show-attributes: true
layer:
# Enable showing all changes from this layer and every previous layer
show-aggregated-changes: false
dive will search for configs in the following locations:
*
# Note: the base image layer is NOT included in the total image size.
# Expressed as a ratio between 0-1; fails if the threshold is met or crossed.
highestUserWastedPercent: 0.20 KeyBindingsKey BindingDescriptionCtrl + CExitTabSwitch between the layer and filetree viewsCtrl + FFilter filesPageUpScroll up a pagePageDownScroll down a pageCtrl + ALayer view: see aggregated image modificationsCtrl + LLayer view: see current layer modificationsSpaceFiletree view: collapse/uncollapse a directoryCtrl + SpaceFiletree view: collapse/uncollapse all directoriesCtrl + AFiletree view: show/hide added filesCtrl + RFiletree view: show/hide removed filesCtrl + MFiletree view: show/hide modified filesCtrl + UFiletree view: show/hide unmodified filesCtrl + BFiletree view: show/hide file attributesPageUpFiletree view: scroll up a pagePageDownFiletree view: scroll down a page UI ConfigurationNo configuration is necessary, however, you can create a config file and override values: supported options are “docker” and “podman”container-engine: docker continue with analysis even if there are errors parsing the image archiveignore-errors: false
log:
enabled: true
path: ./dive.log
level: info Note: you can specify multiple bindings by separating values with a comma.Note: UI hinting is derived from the first bindingkeybinding:
# Global bindings
quit: ctrl+c
toggle-view: tab
filter-files: ctrl+f, ctrl+slash
# Layer view specific bindings
compare-all: ctrl+a
compare-layer: ctrl+l
# File view specific bindings
toggle-collapse-dir: space
toggle-collapse-all-dir: ctrl+space
toggle-added-files: ctrl+a
toggle-removed-files: ctrl+r
toggle-modified-files: ctrl+m
toggle-unmodified-files: ctrl+u
toggle-filetree-attributes: ctrl+b
page-up: pgup
page-down: pgdn
diff:
# You can change the default files shown in the filetree (right pane). All diff types are shown by default.
hide:
– added
– removed
– modified
– unmodified
filetree:
# The default directory-collapse state
collapse-dir: false
# The percentage of screen width the filetree should take on the screen (must be >0 and
pane-width: 0.5
# Show the file attributes next to the filetree
show-attributes: true
layer:
# Enable showing all changes from this layer and every previous layer
show-aggregated-changes: false
dive will search for configs in the following locations:
*
$XDG_CONFIG_HOME/dive/*.yaml* $XDG_CONFIG_DIRS/dive/*.yaml* ~/.config/dive/*.yaml* ~/.dive.yamlDownload
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Get-RBCD-Threaded : Tool To Discover Resource-Based Constrained Delegation Attack Paths
Get-RBCD-Threaded is a tool to discover Resource-Based Constrained Delegation attack paths in Active Directory Environments
Based almost entirely on wonderful blog posts “Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory” by Elad Shamir and “A Case Study in Wagging the Dog: Computer Takeover” by harmj0y. Read these two blog posts if you actually want to understand what is going on here. I honestly only half understand it all myself (and that’s being generous).
I don’t know how to C# well so I figured out how to communicate with a domain in C# by reading through the source code of SharpSploit and SharpView. How it works
Get-RBCD-Thread will query all Active Directory users, groups (minus privileged groups like “Domain Admins” and “BUILTIN\Administrators”), and computer objects in your current domain and compile a list of their SIDs. Get-RBCD-Threaded will then query AD for all DACLs on the computer objects in the domain. Each ACE in the DACLs will be checked to see if one of the user/group/computer SIDS has either “GenericAll”, “GenericWrite”, “WriteOwner”, or “WriteDacl” privileges on the computer object, or if the SIDS have “WriteProp” permissions on the ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity attribute (GUID:3f78c3e5-f79a-46bd-a0b8-9d18116ddc79). If it does, then, well, you my friend are on your way to a Resource-Based Constrained Delegation attack! UsageCompile in Visual Studio. This uses Parallel.ForEach to spead up searching through the DACL object, so .NET v4 is minimum required. Options-u|-username=, Username to authenticate as
-p|-password=, Password for the user
-d|-domain=, Fully qualified domain name to authenticate to
-s|-searchforest, Discover domains and forests through trust relationships. Enumerate all domains and forests
-pwdlastset=, Filter computers based on pwdLastSet to remove stale computer objects. If you set this to 90, it will filter out computer objects whose pwdLastSet date is more than 90 days ago
-i|-insecure, Force insecure LDAP connect if LDAPS is causing connection issues.
-o|-outputfile=, Output to a CSV file. Provided full path to file and file name.
-h|-?|-help, Show the help options
You can now specify the username, password, and domain to authenticate to. If u/p/d options are blank, Get-RBCD-Threaded will atempt to authenticate to the domain in your current user context.
-o will output to a CSV file. Provide the full file path and file name to save the output to.
The default search specifies that port 636 be used to force LDAPS. This may cause issues. If you get an error saying something about the server not being available or similar, try the “-i” flag to remove the 636 port from the connect string.
“pwdLastSet” has been added as a filtering option. In larger environments you can get a lot of stale computer objects that no longer exist as the “destination” object int he ACL, and can’t really be used for the RBCD attack (at least not that I am aware of). Set pwdLastSet to a number of days. Example: “-pwdlastset=90” will filter out any computer objects from your results where the pwdLastSet date is greater or equal to 90 days ago from the current date and time.
Tested in an environment with 20k+ uses, groups, and computers (over 60k total objects). Get-RBCD-Thread took ~60 seconds to complete. By comparison, my hacked together PowerView commands in this gist to perform a similar search ran for several hours and never completed.
This tool will not perform the delegation attack for you. You’ll need to read Elad Shamir’s and harmj0y’s blogs to figure out how to do that. This will only help you find possible targets for the RBCD attack.
Example usage from my AD lab:
https://blogger.googleuser[...]
Get-RBCD-Threaded : Tool To Discover Resource-Based Constrained Delegation Attack Paths
Get-RBCD-Threaded is a tool to discover Resource-Based Constrained Delegation attack paths in Active Directory Environments
Based almost entirely on wonderful blog posts “Wagging the Dog: Abusing Resource-Based Constrained Delegation to Attack Active Directory” by Elad Shamir and “A Case Study in Wagging the Dog: Computer Takeover” by harmj0y. Read these two blog posts if you actually want to understand what is going on here. I honestly only half understand it all myself (and that’s being generous).
I don’t know how to C# well so I figured out how to communicate with a domain in C# by reading through the source code of SharpSploit and SharpView. How it works
Get-RBCD-Thread will query all Active Directory users, groups (minus privileged groups like “Domain Admins” and “BUILTIN\Administrators”), and computer objects in your current domain and compile a list of their SIDs. Get-RBCD-Threaded will then query AD for all DACLs on the computer objects in the domain. Each ACE in the DACLs will be checked to see if one of the user/group/computer SIDS has either “GenericAll”, “GenericWrite”, “WriteOwner”, or “WriteDacl” privileges on the computer object, or if the SIDS have “WriteProp” permissions on the ms-DS-Allowed-To-Act-On-Behalf-Of-Other-Identity attribute (GUID:3f78c3e5-f79a-46bd-a0b8-9d18116ddc79). If it does, then, well, you my friend are on your way to a Resource-Based Constrained Delegation attack! UsageCompile in Visual Studio. This uses Parallel.ForEach to spead up searching through the DACL object, so .NET v4 is minimum required. Options-u|-username=, Username to authenticate as
-p|-password=, Password for the user
-d|-domain=, Fully qualified domain name to authenticate to
-s|-searchforest, Discover domains and forests through trust relationships. Enumerate all domains and forests
-pwdlastset=, Filter computers based on pwdLastSet to remove stale computer objects. If you set this to 90, it will filter out computer objects whose pwdLastSet date is more than 90 days ago
-i|-insecure, Force insecure LDAP connect if LDAPS is causing connection issues.
-o|-outputfile=, Output to a CSV file. Provided full path to file and file name.
-h|-?|-help, Show the help options
You can now specify the username, password, and domain to authenticate to. If u/p/d options are blank, Get-RBCD-Threaded will atempt to authenticate to the domain in your current user context.
-o will output to a CSV file. Provide the full file path and file name to save the output to.
The default search specifies that port 636 be used to force LDAPS. This may cause issues. If you get an error saying something about the server not being available or similar, try the “-i” flag to remove the 636 port from the connect string.
“pwdLastSet” has been added as a filtering option. In larger environments you can get a lot of stale computer objects that no longer exist as the “destination” object int he ACL, and can’t really be used for the RBCD attack (at least not that I am aware of). Set pwdLastSet to a number of days. Example: “-pwdlastset=90” will filter out any computer objects from your results where the pwdLastSet date is greater or equal to 90 days ago from the current date and time.
Tested in an environment with 20k+ uses, groups, and computers (over 60k total objects). Get-RBCD-Thread took ~60 seconds to complete. By comparison, my hacked together PowerView commands in this gist to perform a similar search ran for several hours and never completed.
This tool will not perform the delegation attack for you. You’ll need to read Elad Shamir’s and harmj0y’s blogs to figure out how to do that. This will only help you find possible targets for the RBCD attack.
Example usage from my AD lab:
https://blogger.googleuser[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Get-RBCD-Threaded : Tool To Discover Resource-Based Constrained Delegation Attack Paths Get-RBCD-Threaded is a tool to discover Resource-Based Constrained Delegation attack paths in Active Directory Environments Based almost entirely…
content.com/img/a/AVvXsEiaULH3JrJZVATe0m9FgbwMPWJovTNr9ByX9UgoH1V7xD2pO4fJJ_2jh3DdO0XzNTdD0of2C5GAKidopqwRiX8Hb-yNsjfpevuVXz5rPoi_Xd_ZzusKlbl39dIv-oLA734zL6SWz6el7dN0NF6bFyvhmktbTNgK_XgKCfSz9NdmBX69m8UDsAjywuhv=s829 DetectionsThis tool does nothing more than query Active Directory using LDAP queries, which may not be easy to detect. Netflow could possibly be used to detect large numbers of LDAP queries / traffic to one system.
The other possible way to detect this is through honeypot accounts. The idea would be to create a computer object that some user / group has write privileges to. The RBCD attack relies on modifying a computer object and then delegating kerberos tickets to it. The possible points of detection for the honeypot computer object could be:
1. Monitor modifications to the honeypot computer object, specifically to the “msds-allowedtoactonbehalfofotheridentity” property
2. Monitor for kerberos tickets requested for services on the honeypot computer object, specifically any kerberos tickets for administrator users
I made this tool to help me on penetration tests. However, defenders / blue teams / sysadmins can easily use this to help find weaknesses in their environments and (hopefully) move to remediate them. Download
The other possible way to detect this is through honeypot accounts. The idea would be to create a computer object that some user / group has write privileges to. The RBCD attack relies on modifying a computer object and then delegating kerberos tickets to it. The possible points of detection for the honeypot computer object could be:
1. Monitor modifications to the honeypot computer object, specifically to the “msds-allowedtoactonbehalfofotheridentity” property
2. Monitor for kerberos tickets requested for services on the honeypot computer object, specifically any kerberos tickets for administrator users
I made this tool to help me on penetration tests. However, defenders / blue teams / sysadmins can easily use this to help find weaknesses in their environments and (hopefully) move to remediate them. Download
Hacking on Medium
TCS Hackquest Season 6 -Forensics Writeup
https://cdn-images-1.medium.com/max/1349/1*dez6yPL8-gIcvt91BaX_kA.png
Let’s Take a look at some forensic and steganography #5 challenges from TCS Hackquest season 6 ( 26/02/2022)
Continue reading on Medium »
TCS Hackquest Season 6 -Forensics Writeup
https://cdn-images-1.medium.com/max/1349/1*dez6yPL8-gIcvt91BaX_kA.png
Let’s Take a look at some forensic and steganography #5 challenges from TCS Hackquest season 6 ( 26/02/2022)
Continue reading on Medium »
Medium
TCS Hackquest Season 6 -Forensics Writeup
Let’s Take a look at some forensic and steganography #5 challenges from TCS Hackquest season 6 ( 26/02/2022)