Log4j CVE-2021-44228
https://www.reddit.com/r/redteamsec/comments/tm2ted/log4j_cve202144228/

Hi all! I'm making an assignment for my university which consists in executing a pentest on a docker. By scanning with nessus I found a Log4j vulnerability and I'm trying to get the PoC of it. I searched on the web but I didn't find any interesting info about how to do that. Anyone has got some ideas? According to nessus, it seems to be related to LDAP service. (vulnerability got found on tcp port 80) https://preview.redd.it/m4vk6psk6bp81.png?width=1345&format=png&auto=webp&s=6d0e5541c4aa627f4c610943d185342a7c269909 submitted by /u/_1NiCk1_ (https://www.reddit.com/user/_1NiCk1_)
[link] (https://www.reddit.com/r/redteamsec/comments/tm2ted/log4j_cve202144228/) [comments] (https://www.reddit.com/r/redteamsec/comments/tm2ted/log4j_cve202144228/)

___________________________
@hacking_Attack
@Hacking_Video

Instagram and Facebook Account Takeover if another user account is logged into your system/mobile
https://medium.com/@deshamonep.kumar/instagram-and-facebook-account-takeover-if-another-user-account-is-logged-into-your-system-mobile-faabcdc02648?source=rss------bug_bounty-5

Hi, I'm Praveen Kumar, let's start with how we can take complete takeover and access to other Facebook and Instagram accounts if it's…Continue reading on Medium » (https://medium.com/@deshamonep.kumar/instagram-and-facebook-account-takeover-if-another-user-account-is-logged-into-your-system-mobile-faabcdc02648?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Instagram and Facebook Account Takeover if another user account is logged into your system/mobile

Hi, I'm Praveen Kumar, let's start with how we can take complete takeover and access to other Facebook and Instagram accounts if it's…Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
DeadBolt Ransomware Resurfaces to Hit QNAP Again

DeadBolt Ransomware Resurfaces to Hit QNAP AgainPost Views: 38
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
DeadBolt ransomware has resurfaced in a new wave of attacks on QNAP that begin in mid-March and signals a new targeting of the Taiwan-based network-attached storage (NAS) devices by the fledgling threat, researchers said.
Researchers from Censys, which provides attack-surface management solutions, said they observed DeadBolt infections on QNAP gear ramp up slowly starting March 16, with a total of 373 infections that day. That number that rose to 1,146 devices by March 19, according to a blog post by Censys senior security researcher Mark Ellzey.

The current attacks harken back to January, when the company had to push out an unplanned update to its NAS devices, one that not all customers welcomed. The update was meant to clean up after DeadBolt attacks that were greeting customers with the ransomware group’s screen when they logged in, effectively locking them out of the device.

The new wave of attacks ostensibly follow the same pattern as January’s wave, but the majority of the victims are running the QNAP QTS Linux kernel version 5.10.60, Ellzey said. That’s a later version than the update (QTS 5.0.0.1891) pushed out to customers in January.

That said, “at this time, Censys cannot state whether this is a new attack targeting different versions of the QTS operating system, or if it’s the original exploit targeting unpatched QNAP devices,” he acknowledged.

Moreover, the new infections do not seem to be targeting a specific organization or country; they seem to be evenly split between subscribers of various consumer internet service providers, Ellzey added.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Déjà Vu for QNAP CustomersThe attacks behave the same as the January attacks as far as what the customers experience — and they ask for the same ransom as previous DeadBolt attacks on QNAP devices, Ellzey said.

“Except for the [Bitcoin] addresses used to send ransoms to, the attack remains the same: backup files are encrypted, the web administration interface is modified, and victims are greeted with [ransom] messages,” he wrote in the post.

The attackers are asking for 0.03 Bitcoin for a decryption key, which is about $1,223 at today’s exchange rate. They’re also asking for a ransom from QNAP itself: 5 bitcoin or $203,988, for information related to the vulnerabilities; and 50 bitcoin, or about $2 million, for a master key to unlock all affected victims, Ellzey said.

QNAP is not the only company in the crosshairs of DeadBolt, which first came to researchers’ attention due to the January attacks. In mid-February, Reddit users began reporting that the ransomware was targeting ASUSTOR ADM devices, according to Censys.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Attack DetectionCensys researchers picked up on the latest wave of QNAP attacks due to the unique way the current DeadBolt ransomware variant communicates with victims, according to the post.

“Instead of encrypting the entire device, which effectively takes the device offline (and out of the purview of Censys), the ransomware only targets specific backup directories for encryption, and vandalizes the web-administration interface with an informational message explaining how to remove the infection,” Ellzey wrote.

Therefore, using a simple search query, Censys “could easily find infected devices exposed on the public inte[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Recon Tool: SwaggerHole

Recon Tool: SwaggerHolePost Views: 11 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png Reading Time: 2 Minutes

Recon Tool: SwaggerHole GitHub Link IntroductionSwaggerHole by Liodeus, based on whispers tool is written to automate the process of retrieving secrets in the public APIs on swaggerHub. This tool is multithreaded and pipe mode is available which can be used in various flexible ways due to this, in order to detect and prevent sensitive information that can be found such as discovering API Keys, hardcoded credentials secrets like passwords, tokens within the code itself. Requirements* python3 (sudo apt install python3)
* pip3 (sudo apt install python3-pip)
See Also: Complete Offensive Security and Ethical Hacking Course Installationpip3 install swaggerhole
or cloning this repository and running
git clone https://github.com/Liodeus/swaggerHole.git
pip3 install . Usage/ ___/| | /| / // __ `// __ `// __ `// _ \ / ___/ (__ ) | |/ |/ // /_/ // /_/ // /_/ // __// / /____/ |__/|__/ \__,_/ \__, / \__, / \___//_/ __ __ __ /____/ /____/ / / / /____ / /___ / /_/ // __ \ / // _ \ / __ // /_/ // // __/ /_/ /_/ \____//_/ \___/ usage: swaggerhole [-h] [-s SEARCH] [-o OUT] [-t THREADS] [-j] [-q] [-du] [-de] optional arguments: -h, --help show this help message and exit -s SEARCH, --search SEARCH Term to search -o OUT, --out OUT Output directory -t THREADS, --threads THREADS Threads number (Default 25) -j, --json Json ouput -q, --quiet Remove banner -du, --deactivate_url Deactivate the URL filtering -de, --deactivate_email Deactivate the email filtering
See Also: Recon Tool: Uncover Search for secret about a domainswaggerHole -s test.com echo test.com | swaggerHole Search for secret about a domain and output to jsonswaggerHole -s test.com --json echo test.com | swaggerHole --json Search for secret about a domain and do it fastswaggerHole -s test.com -t 100 echo test.com | swaggerHole -t 100 Output explanationNormal outputFinding_Type – Finding – [Swagger_Name][Date_Last_Update][Line:Number] Json output{“Finding_Type”: Finding, “File”: File_path, “Date”: Date_Last_Update, “Line”: Number} Deactivate url/emailUsing -du or -de remove the filtering done by the tool. There is more false positive with those options.
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/uncover-90x90.png Recon Tool: Uncover6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Fibratus_-90x90.png Offensive Security Tool: Fibratus2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/animation-scapy-themes-demo-90x90.gif Offensive Security Tool: Scapy3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Red-Teaming-Tactics-and-Techniques-90x90.png Offensive Security Tools Collection: Red Teaming Tactics and Techniques4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/metagoofil-90x90.png Recon Tool: Metagoofil4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/swaks-1-90x90.png Offensive Security Tool: Swaks – Swiss Army Knife for SMTP1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Odin-90x90.png OSINT & Recon Tool: Odin1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/pre-90x90.png Offensive Security Tool: Sandbox Defender1 month ago
* https://www.blackhatethic[...]

___________________________
@hacking_Attack
@Hacking_Video

rnet,” according to the post.

Along with general information about what hosts were infected with DeadBolt, researchers also obtained and tracked every unique Bitcoin wallet address used as a ransom drop, Ellzey added. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/hackers-90x90.jpg Lapsus$ Data Kidnappers Claim Snatches From Microsoft, Okta1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Invisible-man-scaled-e1647906959971-90x90.jpg Browser-in-the-Browser Attack Makes Phishing Nearly Invisible2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/pdf-export-90x90.png Workaround offered for unpatched HTML-to-PDF rendering vulnerability3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-2-scaled-90x90.jpg Caketap, a New Unix rootkit for stealing ATM banking data6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/AdobeStock_390895150_Editorial_Use_Only-1-1-min-scaled-1-90x90.jpeg Hundreds of GoDaddy-hosted sites backdoored in a single day1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/79ohvicqaKcVP9KT2mDdTH-90x90.jpg Most QNAP NAS Devices Affected by ‘Dirty Pipe’ Linux Flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Lapsus-group-has-hacked-Ubisoft-as-well-90x90.jpg Ubisoft has confirmed it was hacked by Lapsus$ group1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/raccoon-stealer-90x90.jpg Raccoon Stealer Crawls Into Telegram1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/kali-bright-90x90.jpg Kali Unkaputtbar – a new feature on Kali Linux2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/wolf-in-sheps-clothing-2-scaled-e1646927438585-90x90.jpeg Malware Posing as Russia DDoS Tool Bites Ukraine Hackers2 weeks ago
The post DeadBolt Ransomware Resurfaces to Hit QNAP Again first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

alhacking.com/wp-content/uploads/2022/02/unknown-90x90.png Offensive Security Tool: Stratus Red Team2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Working-of-Digital-Steganography-90x90.png Offensive Security Tool: Crypto Steganography2 months ago
The post Recon Tool: SwaggerHole first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
truffleHog : Searches Through Git Repositories For High Entropy Strings And Secrets

truffleHog previously functioned by running entropy checks on git diffs. This functionality still exists, but high signal regex checks have been added, and the ability to suppress entropy checking has also been added.

trufflehog –regex –entropy=False https://github.com/dxa4481/truffleHog.git

or

trufflehog file:///user/dxa4481/codeprojects/truffleHog/

With the --include_pathsand --exclude_pathsoptions, it is also possible to limit scanning to a subset of objects in the Git history by defining regular expressions (one per line) in a file to match the targeted object paths. To illustrate, see the example include and exclude files below:

include-patterns.txt:

src/
lines beginning with “#” are treated as comments and are ignored
gradle/
regexes must match the entire path, but can use python’s regex syntax for
case-insensitive matching and other advanced options
(?i)..(properties|conf|ini|txt|y(a)?ml)$ (./)?id_[rd]sa$

exclude-patterns.txt:

(./)?.classpath$ ..jmx$
(./)?test/(./)?resources/

These filter files could then be applied by:

trufflehog –include_paths include-patterns.txt –exclude_paths exclude-patterns.txt file://path/to/my/repo.git

With these filters, issues found in files in the root-level srcdirectory would be reported, unless they had the .classpathor .jmxextension, or if they were found in the src/test/dev/resources/directory, for example. Additional usage information is provided when calling trufflehogwith the -hor --helpoptions.

These features help cut down on noise, and makes the tool easier to shove into a devops pipeline.
https://blogger.googleusercontent.com/img/a/AVvXsEieJEoWU-DRJkFxYSeMYZjbyHibjQdQ4iB-O8IyDTJiXREgO7lvzIPs0rWDJqJgp5ogZErRufthpYGYevYrUKV2tWql947CREr6sIENT-_7jdDnBVAx5dyJAS_4n1MbY1FIzyZ5sEPD8uGok7eTgF-czbUxcHuy-I0f4ibITQAjdi2Bfx-9WPOEUC8E=s1708
Install

pip install truffleHog CustomizingCustom regexes can be added with the following flag --rules /path/to/rules. This should be a json file of the following format:

{
“RSA private key”: “—–BEGIN EC PRIVATE KEY—–“
}

Things like subdomain enumeration, s3 bucket detection, and other useful regexes highly custom to the situation can be added.

Feel free to also contribute high signal regexes upstream that you think will benefit the community. Things like Azure keys, Twilio keys, Google Compute keys, are welcome, provided a high signal regex can be constructed.

trufflehog’s base rule set sources from https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json

To explicitly allow particular secrets (e.g. self-signed keys used only for local testing) you can provide an allow list --allow /path/to/allowin the following format:

{
“local self signed test key”: “—–BEGIN EC PRIVATE KEY—–\nfoobar123\n—–END EC PRIVATE KEY—–“,
“git cherry pick SHAs”: “regex:Cherry picked from .*”,
}

Note that values beginning with regex:will be used as regular expressions. Values without this will be literal, with some automatic conversions (e.g. flexible newlines). How it worksThis module will go through the entire commit history of each branch, and check each diff from each commit, and check for secrets. This is both by regex and by entropy. For entropy checks, truffleHog will evaluate the shannon entropy for both the base64 char set and hexidecimal char set for every blob of text greater than 20 characters comprised of those character sets in each diff. If at any point a high entropy string >20 characters is detected, it will print to the screen. Running with DockerFirst, enter the directory containing the git repository

cd /pa[...]

___________________________
@hacking_Attack
@Hacking_Video

th/to/git

To launch the trufflehog with the docker image, run the following”

docker run –rm -v “$(pwd):/proj” dxa4481/trufflehog file:///proj -vmounts the current working dir (pwd) to the /projdir in the Docker container file:///projreferences that very same /projdir in the container (which is also set as the default working dir in the Dockerfile) Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Exrop : Automatic ROP Chain Generation

Exrop is automatic ROP chains generator tool which can build gadget chain automatically from given binary and constraints

Requirements : Triton, ROPGadget

Only support for x86-64 for now! Features* handling non-return gadgets (jmp reg, call reg)
* set registers (rdi=0xxxxxx, rsi=0xxxxxx)
* set register to register (rdi=rax)
* write to mem
* write string/bytes to mem
* function call (open('/etc/passwd',0))
* pass register in function call (read('rax', bss, 0x100))
* avoiding badchars
* stack pivoting (Exrop.stack_pivot)
* syscall (Exrop.syscall)
* see examples Installation* install python (3.6 is recomended and tested)
* install triton (https://triton.quarkslab.com/documentation/doxygen/index.html#linux_install_sec), make sure you add -DPYTHON36=onas cmake option
* install ropgadget (https://github.com/JonathanSalwan/ROPgadget)
* to install exrop, easily add export PYTHONPATH=/path/to/exrop:$PYTHONPATHin your .bashrc(depends on your shell) Demofrom Exrop import Exrop
rop = Exrop(“/bin/ls”)
rop.find_gadgets(cache=True)
print(“write-regs gadgets: rdi=0x41414141, rsi:0x42424242, rdx: 0x43434343, rax:0x44444444, rbx=0x45454545”)
chain = rop.set_regs({‘rdi’:0x41414141, ‘rsi’: 0x42424242, ‘rdx’:0x43434343, ‘rax’:0x44444444, ‘rbx’: 0x45454545})
chain.dump()
print(“write-what-where gadgets: [0x41414141]=0xdeadbeefff, [0x43434343]=0x110011”)
chain = rop.set_writes({0x41414141: 0xdeadbeefff, 0x43434343: 0x00110011})
chain.dump()
print(“write-string gadgets 0x41414141=\”Hello world!\n\””)
chain = rop.set_string({0x41414141: “Hello world!\n”})
chain.dump()
print(“func-call gadgets 0x41414141(0x20, 0x30, \”Hello\”)”)
chain = rop.func_call(0x41414141, (0x20, 0x30, “Hello”), 0x7fffff00)
chain.dump()

Output:

write-regs gadget: rdi=0x41414141, rsi:0x42424242, rdx: 0x43434343, rax:0x44444444, rbx=0x45454545
$RSP+0x0000 : 0x00000000000060d0 # pop rbx; ret
$RSP+0x0008 : 0x0000000044444444
$RSP+0x0010 : 0x0000000000014852 # mov rax, rbx; pop rbx; ret
$RSP+0x0018 : 0x0000000000000000
$RSP+0x0020 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0028 : 0x0000000041414141
$RSP+0x0030 : 0x000000000000629c # pop rsi; ret
$RSP+0x0038 : 0x0000000042424242
$RSP+0x0040 : 0x0000000000003a62 # pop rdx; ret
$RSP+0x0048 : 0x0000000043434343
$RSP+0x0050 : 0x00000000000060d0 # pop rbx; ret
$RSP+0x0058 : 0x0000000045454545
write-what-where gadgets: [0x41414141]=0xdeadbeefff, [0x43434343]=0x110011
$RSP+0x0000 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0008 : 0x000000deadbeefff
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x0000000041414139
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000000110011
$RSP+0x0040 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0048 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0050 : 0x000000004343433b
$RSP+0x0058 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
write-string gadgets 0x41414141=”Hello world!\n”
$RSP+0x0000 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0008 : 0x6f77206f6c6c6548
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x0000000041414139
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000a21646c72
$RSP+0x0040 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0048 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0050 : 0x0000000041414141
$RSP+0x0058 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
func-call gadgets 0x41414141(0x20, 0x30, “Hello”)
$RSP+0x0000 : 0x0000[...]

___________________________
@hacking_Attack
@Hacking_Video

000000004ce5 # pop rdi; ret
$RSP+0x0008 : 0x0000006f6c6c6548
$RSP+0x0010 : 0x000000000000d91f # mov rax, rdi; ret
$RSP+0x0018 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0020 : 0x000000007ffffef8
$RSP+0x0028 : 0x000000000000e0fb # mov qword ptr [rdi + 8], rax; ret
$RSP+0x0030 : 0x0000000000004ce5 # pop rdi; ret
$RSP+0x0038 : 0x0000000000000020
$RSP+0x0040 : 0x000000000000629c # pop rsi; ret
$RSP+0x0048 : 0x0000000000000030
$RSP+0x0050 : 0x0000000000003a62 # pop rdx; ret
$RSP+0x0058 : 0x000000007fffff00
$RSP+0x0060 : 0x0000000041414141
python3 tests.py 1,48s user 0,05s system 97% cpu 1,566 total

Another example: open-read-write gadgets!

from pwn import *
import time
from Exrop import Exrop
binname = “/lib/x86_64-linux-gnu/libc.so.6”
libc = ELF(binname, checksec=False)
open = libc.symbols[‘open’]
read = libc.symbols[‘read’]
write = libc.symbols[‘write’]
bss = libc.bss()
t = time.mktime(time.gmtime())
rop = Exrop(binname)
rop.find_gadgets(cache=True)
print(“open(‘/etc/passwd’, 0)”)
chain = rop.func_call(open, (“/etc/passwd”, 0), bss)
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“read(‘rax’, bss, 0x100)”) # register can be used as argument too!
chain = rop.func_call(read, (‘rax’, bss, 0x100))
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“write(1, bss, 0x100)”)
chain = rop.func_call(write, (1, bss, 0x100))
chain.set_base_addr(0x00007ffff79e4000)
chain.dump()
print(“done in {}s”.format(time.mktime(time.gmtime()) – t))

Output:

open(‘/etc/passwd’, 0)
$RSP+0x0000 : 0x00007ffff7a05a45 # pop r13 ; ret
$RSP+0x0008 : 0x00000000003ec860
$RSP+0x0010 : 0x00007ffff7a7630c # xor edi, edi ; pop rbx ; mov rax, rdi ; pop rbp ; pop r12 ; ret
$RSP+0x0018 : 0x00007ffff7a0555f
$RSP+0x0020 : 0x0000000000000000
$RSP+0x0028 : 0x0000000000000000
$RSP+0x0030 : 0x00007ffff7a06b8a # mov r9, r13 ; call rbx: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0038 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0040 : 0x7361702f6374652f
$RSP+0x0048 : 0x00007ffff7b251c7 # mov qword ptr [r9], rdi ; ret
$RSP+0x0050 : 0x00007ffff7a05a45 # pop r13 ; ret
$RSP+0x0058 : 0x00000000003ec868
$RSP+0x0060 : 0x00007ffff7a7630c # xor edi, edi ; pop rbx ; mov rax, rdi ; pop rbp ; pop r12 ; ret
$RSP+0x0068 : 0x00007ffff7a0555f
$RSP+0x0070 : 0x0000000000000000
$RSP+0x0078 : 0x0000000000000000
$RSP+0x0080 : 0x00007ffff7a06b8a # mov r9, r13 ; call rbx: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0088 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0090 : 0x0000000000647773
$RSP+0x0098 : 0x00007ffff7b251c7 # mov qword ptr [r9], rdi ; ret
$RSP+0x00a0 : 0x00007ffff7a62c70 # xor esi, esi ; mov rax, rsi ; ret
$RSP+0x00a8 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x00b0 : 0x00000000003ec860
$RSP+0x00b8 : 0x000000000010fc40
read(‘rax’, bss, 0x100)
$RSP+0x0000 : 0x00007ffff7a71362 # mov dh, 0xc5 ; pop rbx ; pop rbp ; pop r12 ; ret
$RSP+0x0008 : 0x0000000000000000
$RSP+0x0010 : 0x0000000000000000
$RSP+0x0018 : 0x00007ffff7a0555f
$RSP+0x0020 : 0x00007ffff7aea899 # mov r8, rax ; call r12: next -> (0x0002155f) # pop rdi ; ret
$RSP+0x0028 : 0x00007ffff7b4a3b1 # pop rax ; pop rdx ; pop rbx ; ret
$RSP+0x0030 : 0x00007ffff79e5b96
$RSP+0x0038 : 0x0000000000000000
$RSP+0x0040 : 0x0000000000000000
$RSP+0x0048 : 0x00007ffff7a7fa08 # mov rdi, r8 ; call rax: next -> (0x00001b96) # pop rdx ; ret
$RSP+0x0050 : 0x00007ffff79e5b96 # pop rdx ; ret
$RSP+0x0058 : 0x0000000000000100
$RSP+0x0060 : 0x00007ffff7a07e6a # pop rsi ; ret
$RSP+0x0068 : 0x00000000003ec860
$RSP+0x0070 : 0x0000000000110070
write(1, bss, 0x100)
$RSP+0x0000 : 0x00007ffff7a0555f # pop rdi ; ret
$RSP+0x0008 : 0x0000000000000001
$RSP+0x0010 : 0x00007ffff79e5b96 # pop rdx ; ret
$RSP+0x0018 : 0x0000000000000100
$RSP+0x0020 : 0x00007ffff7a07e6a # pop rsi ; ret
$RSP+0x0028 : 0x00000000003ec860
$RSP+0x0030 : 0x0000000000110140
done in 3.0s (Running on: A9-9420 RADEON R5 2C+3G (2) @ 3.000GHz (using cached)) Download

___________________________
@hacking_Attack
@Hacking_Video

ADExplorerSnapshot.py - An AD Explorer Snapshot Parser. It Is Made As An Ingestor For BloodHound, And Also Supports Full-Object Dumping To NDJSON
http://www.kitploit.com/2022/03/adexplorersnapshotpy-ad-explorer.html

___________________________
@hacking_Attack
@Hacking_Video

ADExplorerSnapshot.py is an AD Explorer (https://www.kitploit.com/search/label/Explorer) snapshot parser. It is made as an ingestor for BloodHound (https://bloodhound.readthedocs.io/), and also supports full-object dumping to NDJSON. AD Explorer allows you to connect to a DC and browse LDAP data. It can also create snapshots of the server you are currently attached to. This tool allows you to convert those snapshots to BloodHound-compatible JSON files, or dump all available objects in the snapshot to NDJSON for easier processing.
What is supported In BloodHound output mode: Users collection Groups collection Computers collection Trusts collection (as visible from the LDAP DC you are connected to) In Objects output mode, all attributes for every object are parsed and outputted to NDJSON format. Limitations The ingestor for BloodHound (https://www.kitploit.com/search/label/BloodHound) only supports offline information collection from the snapshot file and won't interact with systems on the network. That means features like session and localadmin collection are not available. GPO/OU collection is missing. The ingestor processes all data it possibly can from the snapshot (including ACLs), but will only output the JSON data that can be interpreted by BloodHound. You will only have the data available of the LDAP/DC that you ran the snapshot against. Installation ADExplorerSnapshot.py supports Python 3.6+. Dependencies are managed via pip. git clone https://github.com/c3c/ADExplorerSnapshot.py.git
cd ADExplorerSnapshot.py
pip3 install --user .
Usage usage: ADExplorerSnapshot.py [-h] [-o OUTPUT] [-m {BloodHound,Objects}] snapshot

ADExplorerSnapshot.py is an AD Explorer snapshot parser. It is made as an ingestor for BloodHound, and also supports full-object dumping to NDJSON.

positional arguments:
snapshot Path to the snapshot .dat file.

optional arguments:
-h, --help show this help message and exit
-o OUTPUT, --output OUTPUT
Path to the *.json output folder. Folder will be created if it doesn't exist.
Defaults to the current directory.
-m {BloodHound,Objects}, --mode {BloodHound,Objects}
The output mode to use. Besides BloodHound JSON output files, it is possible
to dump all objects with all attributes to NDJSON.
Defaults to BloodHound output mode .

___________________________
@hacking_Attack
@Hacking_Video

Notes This library (https://www.kitploit.com/search/label/Library) is now supporting the BloodHound v4.1+ output format (JSON format v4). For the old v3 output format, you can use the code in the v3-format branch (https://github.com/c3c/ADExplorerSnapshot.py/tree/v3-format). Making snapshots in AD Explorer is more network-intensive than the traditional BloodHound ingestors as it attempts to retrieve all objects it can from the LDAP. ADExplorerSnapshot.py will create caches of information for quicker lookups while processing the data. Especially when processing larger snapshots (e.g. 4GB+) you will also need to have sufficient RAM available. In my tests, about half of the snapshot file size was required in RAM. The library was tested with a number of data sets, please create an issue report if you run into problems. The AD Explorer snapshot parser is implemented as its own module, which could also be used individually. The format in which snapshots are stored by AD Explorer is proprietary and led to a fun reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) journey. A 010 editor template is included in this repository, which I used for iteratively mapping out the contents of the snapshot into structs. License and credits This code is licensed under the MIT license (https://opensource.org/licenses/MIT) and makes use of code that is also licensed under the MIT license. ADExplorerSnapshot.py relies on the following projects: BloodHound.py (https://github.com/fox-it/BloodHound.py) (the Python BloodHound ingestor): for processing LDAP data. dissect.cstruct (https://github.com/fox-it/dissect.cstruct) (C-style binary struct parser): for parsing (https://www.kitploit.com/search/label/Parsing) the binary snapshot data. Credits: Cedric Van Bockhaven (Deloitte) for implementation Marat Nigmatullin (Deloitte) for the idea

Download ADExplorerSnapshot.py (https://github.com/c3c/ADExplorerSnapshot.py)

___________________________
@hacking_Attack
@Hacking_Video

One Month Bug Bounty Journey Update

My goal with this is to explain some of my thoughts and how they changed as I progressed and how I modified my path along the way. For we…Continue reading on Medium »
Read more...