VulnHub Walkthrough’s : BOX 1
https://medium.com/@adeesh08/vulnhub-walkthroughs-box-1-7b633b898a1f?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://medium.com/@adeesh08/vulnhub-walkthroughs-box-1-7b633b898a1f?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
VulnHub Walkthrough’s : BOX 1
Vulnhub Walkthrough — Basic Pentesting 1 Box
Vulnhub Walkthrough — Basic Pentesting 1 BoxContinue reading on Medium » (https://medium.com/@adeesh08/vulnhub-walkthroughs-box-1-7b633b898a1f?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
VulnHub Walkthrough’s : BOX 1
Vulnhub Walkthrough — Basic Pentesting 1 Box
Solution to my $20 egg hunt (Part 3)
My latest article gave a significant hint towards solving the $20 challenge. This one will help you a few steps further…Continue reading on Medium »
Read more...
My latest article gave a significant hint towards solving the $20 challenge. This one will help you a few steps further…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Sharp Cookie Monster : Extracts Cookies From Chrome
Sharp Cookie Monster is a Sharp port of @defaultnamehere’s cookie-crimes module – full credit for their awesome work!
This C# project will dump cookies for all sites, even those with http Only/secure/session flags.
Usage
Simply run the binary.
SharpCookieMonster.exe [https://sitename.com] [chrome-debugging-port] [user data dir]
An optional first argument sepcifies the site that chrome will initially connect to when launched (default https://www.google.com).
An optional second argument specifies the port to launch the chrome debugger on (by default 9142).
Finally, an optional third argument specifies the path to the user data directory, which can be overridden in order to access different profiles etc (default %APPDATALOCAL%\Google\Chrome\User Data).
Building
The binary has been built to be compatible with .NET 3.5 in order to be compatible with victims with older versions of .NET installed. However in order to use WebSockets to communicate with Chrome the WebSocket4Net package was added.
If you want to run this down C2 such as using PoshC2’s
First rename the original binary then run:
ILMerge.exe /targetplatform:”v2,C:\Windows\Microsoft.NET\Framework\v2.0.50727″ /out:SharpCookieMonster.exe SharpCookieMonsterOriginal.exe WebSocket4Net.dll
Download
Sharp Cookie Monster : Extracts Cookies From Chrome
Sharp Cookie Monster is a Sharp port of @defaultnamehere’s cookie-crimes module – full credit for their awesome work!
This C# project will dump cookies for all sites, even those with http Only/secure/session flags.
Usage
Simply run the binary.
SharpCookieMonster.exe [https://sitename.com] [chrome-debugging-port] [user data dir]
An optional first argument sepcifies the site that chrome will initially connect to when launched (default https://www.google.com).
An optional second argument specifies the port to launch the chrome debugger on (by default 9142).
Finally, an optional third argument specifies the path to the user data directory, which can be overridden in order to access different profiles etc (default %APPDATALOCAL%\Google\Chrome\User Data).
Building
The binary has been built to be compatible with .NET 3.5 in order to be compatible with victims with older versions of .NET installed. However in order to use WebSockets to communicate with Chrome the WebSocket4Net package was added.
If you want to run this down C2 such as using PoshC2’s
sharpcookiemonstercommand or via CobaltStrike’s execute-assemblythen use ILMerge to merge the built executable with the WebSocket4Net.dll library.First rename the original binary then run:
ILMerge.exe /targetplatform:”v2,C:\Windows\Microsoft.NET\Framework\v2.0.50727″ /out:SharpCookieMonster.exe SharpCookieMonsterOriginal.exe WebSocket4Net.dll
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious
Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer’s workstation.
It validates the outgoing changeset for things that look suspicious – such as potential SSH keys, authorization tokens, private keys etc. InstallationTalisman supports MAC OSX, Linux and Windows.
Talisman can be installed and used in one of the following ways:
* As a git hook as a global git hook template and a CLI utility (for git repo scanning)
* As a git hook into a single git repository
Talisman can be set up as either a pre-commit or pre-push hook on the git repositories.
Find the instructions below.
Disclaimer: Secrets creeping in via a forced push in a git repository cannot be detected by Talisman. A forced push is believed to be notorious in its own ways, and we suggest git repository admins to apply appropriate measures to authorize such activities. [Recommended approach]Installation as a global hook templateWe recommend installing Talisman as a pre-commit git hook template, as that will cause Talisman to be present, not only in your existing git repositories, but also in any new repository that you ‘init’ or ‘clone’.
* Run the following command on your terminal, to download and install the binary at $HOME/.talisman/bin
As a pre-commit hook:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash
OR
As a pre-push hook:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash pre-push
* If you do not have TALISMAN_HOME set up in your
Remember to execute source on the path file or restart your terminal. If you choose to set the
* Choose a base directory where Talisman should scan for all git repositories, and setup a git hook (pre-commit or pre-push, as chosen in step 1) as a symlink. This script will not clobber pre-existing hooks. If you have existing hooks, look for ways to chain Talisman into them.
* you can set SEARCH_ROOT environment variable with the path of the base directory before executing the installation so you don’t need to input it manually during the installation Handling existing hooksInstallation of Talisman globally does not clobber pre-existing hooks on repositories.
If the installation script finds any existing hooks, it will only indicate so on the console.
To achieve running multiple hooks we suggest (but not limited to) the following two tools
* Pre-commit (Linux/Unix)
Use pre-commit tool to manage all the existing hooks along with Talisman. In the suggestion, it will prompt the following code to be included in .pre-commit-config.yaml
repo: local
hooks:
id: talisman-precommit
name: talisman
entry: bash -c ‘if [ -n “${TALISMAN_HOME:-}” ]; then ${TALISMAN_HOME}/talisman_hook_script pre-commit; else echo “TALISMAN does not exist. Consider installing from https://github.com/thoughtworks/talisman . If you already have talisman installed, please ensure TALISMAN_HOME variable is set to where talisman_hook_script resides, for example, TALISMAN_HOME=${HOME}/.talisman/bin”; fi’
language: system
pass_filenames: false
types: [text]
verbose: true
* Husky (Linux/Unix/Windows)
husky is an npm module for managing git hooks. In order to use husky, make sure you have already set TALISMAN_HOME to
* Existing Users
If you already a[...]
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious
Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer’s workstation.
It validates the outgoing changeset for things that look suspicious – such as potential SSH keys, authorization tokens, private keys etc. InstallationTalisman supports MAC OSX, Linux and Windows.
Talisman can be installed and used in one of the following ways:
* As a git hook as a global git hook template and a CLI utility (for git repo scanning)
* As a git hook into a single git repository
Talisman can be set up as either a pre-commit or pre-push hook on the git repositories.
Find the instructions below.
Disclaimer: Secrets creeping in via a forced push in a git repository cannot be detected by Talisman. A forced push is believed to be notorious in its own ways, and we suggest git repository admins to apply appropriate measures to authorize such activities. [Recommended approach]Installation as a global hook templateWe recommend installing Talisman as a pre-commit git hook template, as that will cause Talisman to be present, not only in your existing git repositories, but also in any new repository that you ‘init’ or ‘clone’.
* Run the following command on your terminal, to download and install the binary at $HOME/.talisman/bin
As a pre-commit hook:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash
OR
As a pre-push hook:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/install.bash > /tmp/install_talisman.bash && /bin/bash /tmp/install_talisman.bash pre-push
* If you do not have TALISMAN_HOME set up in your
$PATH, you will be asked an appropriate place to set it up. Choose the option number where you set the profile source on your machine.Remember to execute source on the path file or restart your terminal. If you choose to set the
$PATHlater, please export TALISMAN_HOME=$HOME/.talisman/bin to the path.* Choose a base directory where Talisman should scan for all git repositories, and setup a git hook (pre-commit or pre-push, as chosen in step 1) as a symlink. This script will not clobber pre-existing hooks. If you have existing hooks, look for ways to chain Talisman into them.
* you can set SEARCH_ROOT environment variable with the path of the base directory before executing the installation so you don’t need to input it manually during the installation Handling existing hooksInstallation of Talisman globally does not clobber pre-existing hooks on repositories.
If the installation script finds any existing hooks, it will only indicate so on the console.
To achieve running multiple hooks we suggest (but not limited to) the following two tools
* Pre-commit (Linux/Unix)
Use pre-commit tool to manage all the existing hooks along with Talisman. In the suggestion, it will prompt the following code to be included in .pre-commit-config.yaml
repo: local
hooks:
id: talisman-precommit
name: talisman
entry: bash -c ‘if [ -n “${TALISMAN_HOME:-}” ]; then ${TALISMAN_HOME}/talisman_hook_script pre-commit; else echo “TALISMAN does not exist. Consider installing from https://github.com/thoughtworks/talisman . If you already have talisman installed, please ensure TALISMAN_HOME variable is set to where talisman_hook_script resides, for example, TALISMAN_HOME=${HOME}/.talisman/bin”; fi’
language: system
pass_filenames: false
types: [text]
verbose: true
* Husky (Linux/Unix/Windows)
husky is an npm module for managing git hooks. In order to use husky, make sure you have already set TALISMAN_HOME to
$PATH.* Existing Users
If you already a[...]
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information do not leave the developer’s…
re using husky, add the following lines to husky pre-commit in package.json Windows
“bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'”
Linux/Unix
$TALISMAN_HOME/talisman_hook_script pre-commit
* New Users
If you want to use husky with multiple hooks along with talisman, add the following snippet to you package json. Windows
{
“husky”: {
“hooks”: {
“pre-commit”: “bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'” && “other-scripts”
}
}
Linux/Unix
{
“husky”: {
“hooks”: {
“pre-commit”: “$TALISMAN_HOME/talisman_hook_script pre-commit” && “other-scripts”
}
}
} Installation to a single project#Download the talisman installer script
curl https://thoughtworks.github.io/talisman/install.sh > ~/install-talisman.sh
chmod +x ~/install-talisman.sh
#Install to a single project
cd my-git-project
as a pre-push hook
#~/install-talisman.sh
or as a pre-commit hook
#~/install-talisman.sh pre-commit Handling existing hooksTalisman will need to be chained with any existing git hooks.You can use pre-commit git hooks framework to handle this.
Add this to your
repo: https://github.com/thoughtworks/talisman
rev: ” # Update me!
hooks:
either
id: talisman-commit
id: talisman-push UpgradingSince release v0.4.4, Talisman automatically updates the binary to the latest release, when the hook is invoked (at pre-commit/pre-push, as set up). So, just sit back, relax, and keep using the latest Talisman without any extra efforts.
The following environment variables can be set:
* TALISMAN_SKIP_UPGRADE: Set to true if you want to skip the automatic upgrade check. Default is false
* TALISMAN_UPGRADE_CONNECT_TIMEOUT: Max connect timeout before the upgrade is cancelled(in seconds). Default is 10 seconds.
If at all you need to manually upgrade, here are the steps:
[Recommended] Update Talisman binary and hook scripts to the latest release:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash
Update only Talisman binary by executing:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash talisman-binary Talisman in actionAfter the installation is successful, Talisman will run checks for obvious secrets automatically before each commit or push (as chosen during installation). In case there are any security breaches detected, talisman will display a detailed report of the errors:
$ git push
Talisman Report:
+—————–+——————————————————————————-+
| FILE | ERRORS |
+—————–+——————————————————————————-+
| danger.pem | The file name “danger.pem” |
| | failed checks against the |
| | pattern ^.+.pem$ |
+—————–+——————————————————————————-+
| danger.pem | Expected file to not to contain hex encoded texts such as: |
| | awsSecretKey=c64e8c79aacf5ddb02f1274db2d973f363f4f553ab1692d8d203b4cc09692f79 |
+—————–+——————————————————————————-+
In the above example, the file danger.pem has been flagged as a security breach due to the following reasons:
* The filename matches one of the pre-configured patterns.
* The file contains an awsSecretKey which is scanned and flagged by Talisman
If you have installed Talisman as a pre-commit hook, it will scan only the diff within each commit. This means that it would only report errors for parts of the file that were changed.
In case you have installed Talisman as a pre-push hook, it will scan the complete file in which changes are made. As mentioned above, it is recommended that you use Talisman as a pre-commit hook. ValidationsThe following detectors execute against the changesets to detect secrets/sensit[...]
“bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'”
Linux/Unix
$TALISMAN_HOME/talisman_hook_script pre-commit
* New Users
If you want to use husky with multiple hooks along with talisman, add the following snippet to you package json. Windows
{
“husky”: {
“hooks”: {
“pre-commit”: “bash -c ‘\”%TALISMAN_HOME%\${TALISMAN_BINARY_NAME}\” –githook pre-commit'” && “other-scripts”
}
}
Linux/Unix
{
“husky”: {
“hooks”: {
“pre-commit”: “$TALISMAN_HOME/talisman_hook_script pre-commit” && “other-scripts”
}
}
} Installation to a single project#Download the talisman installer script
curl https://thoughtworks.github.io/talisman/install.sh > ~/install-talisman.sh
chmod +x ~/install-talisman.sh
#Install to a single project
cd my-git-project
as a pre-push hook
#~/install-talisman.sh
or as a pre-commit hook
#~/install-talisman.sh pre-commit Handling existing hooksTalisman will need to be chained with any existing git hooks.You can use pre-commit git hooks framework to handle this.
Add this to your
.pre-commit-config.yaml(be sure to update revto point to a real git revision!)repo: https://github.com/thoughtworks/talisman
rev: ” # Update me!
hooks:
either
commitor pushsupportid: talisman-commit
id: talisman-push UpgradingSince release v0.4.4, Talisman automatically updates the binary to the latest release, when the hook is invoked (at pre-commit/pre-push, as set up). So, just sit back, relax, and keep using the latest Talisman without any extra efforts.
The following environment variables can be set:
* TALISMAN_SKIP_UPGRADE: Set to true if you want to skip the automatic upgrade check. Default is false
* TALISMAN_UPGRADE_CONNECT_TIMEOUT: Max connect timeout before the upgrade is cancelled(in seconds). Default is 10 seconds.
If at all you need to manually upgrade, here are the steps:
[Recommended] Update Talisman binary and hook scripts to the latest release:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash
Update only Talisman binary by executing:
curl –silent https://raw.githubusercontent.com/thoughtworks/talisman/master/global_install_scripts/update_talisman.bash > /tmp/update_talisman.bash && /bin/bash /tmp/update_talisman.bash talisman-binary Talisman in actionAfter the installation is successful, Talisman will run checks for obvious secrets automatically before each commit or push (as chosen during installation). In case there are any security breaches detected, talisman will display a detailed report of the errors:
$ git push
Talisman Report:
+—————–+——————————————————————————-+
| FILE | ERRORS |
+—————–+——————————————————————————-+
| danger.pem | The file name “danger.pem” |
| | failed checks against the |
| | pattern ^.+.pem$ |
+—————–+——————————————————————————-+
| danger.pem | Expected file to not to contain hex encoded texts such as: |
| | awsSecretKey=c64e8c79aacf5ddb02f1274db2d973f363f4f553ab1692d8d203b4cc09692f79 |
+—————–+——————————————————————————-+
In the above example, the file danger.pem has been flagged as a security breach due to the following reasons:
* The filename matches one of the pre-configured patterns.
* The file contains an awsSecretKey which is scanned and flagged by Talisman
If you have installed Talisman as a pre-commit hook, it will scan only the diff within each commit. This means that it would only report errors for parts of the file that were changed.
In case you have installed Talisman as a pre-push hook, it will scan the complete file in which changes are made. As mentioned above, it is recommended that you use Talisman as a pre-commit hook. ValidationsThe following detectors execute against the changesets to detect secrets/sensit[...]
Kali Linux Tutorials
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious
Talisman : By Hooking Talisman Validates The Outgoing Changeset For Things That Look Suspicious
Kali Linux Tutorials
Talisman : By Hooking Talisman Validates The Outgoing Changeset
Talisman is a tool that installs a hook to your repository to ensure that potential secrets or sensitive information.
Solution to my $20 egg hunt (Part 3)
https://ethr.medium.com/solution-to-my-20-egg-hunt-part-3-705baa900df5?source=rss------bug_bounty-5
https://ethr.medium.com/solution-to-my-20-egg-hunt-part-3-705baa900df5?source=rss------bug_bounty-5
My latest article gave a significant hint towards solving the $20 challenge. This one will help you a few steps further…Continue reading on Medium » (https://ethr.medium.com/solution-to-my-20-egg-hunt-part-3-705baa900df5?source=rss------bug_bounty-5)
Hacking on Medium
VulnHub Walkthrough’s : BOX 1
https://cdn-images-1.medium.com/max/1000/1*9ySzR89nWySWx0LlSNvgfw.png
Vulnhub Walkthrough — Basic Pentesting 1 Box
Continue reading on Medium »
VulnHub Walkthrough’s : BOX 1
https://cdn-images-1.medium.com/max/1000/1*9ySzR89nWySWx0LlSNvgfw.png
Vulnhub Walkthrough — Basic Pentesting 1 Box
Continue reading on Medium »
Medium
VulnHub Walkthrough’s : BOX 1
Vulnhub Walkthrough — Basic Pentesting 1 Box
Hacking on Medium
How do you spy on a cheating spouse?
https://cdn-images-1.medium.com/max/1920/1*cUMUnRXhB0t9u-YIE3ED3g.jpeg
Cheating in a relationship can be caused by many different things. Some people may cheat because they are not satisfied with their current…
Continue reading on Medium »
How do you spy on a cheating spouse?
https://cdn-images-1.medium.com/max/1920/1*cUMUnRXhB0t9u-YIE3ED3g.jpeg
Cheating in a relationship can be caused by many different things. Some people may cheat because they are not satisfied with their current…
Continue reading on Medium »
Medium
How do you spy on a cheating spouse?
Cheating in a relationship can be caused by many different things. Some people may cheat because they are not satisfied with their current…
Hacking on Medium
Triton malware indictments, more Lapsus$ chaos and ShmooCon’s revival
https://cdn-images-1.medium.com/max/2500/1*G0nOwhSUcv-B-fbC9i-eLw.png
Welcome to Changelog for 3/27/22, published by Synack!
Continue reading on README_ »
Triton malware indictments, more Lapsus$ chaos and ShmooCon’s revival
https://cdn-images-1.medium.com/max/2500/1*G0nOwhSUcv-B-fbC9i-eLw.png
Welcome to Changelog for 3/27/22, published by Synack!
Continue reading on README_ »
Medium
Triton malware indictments, more Lapsus$ chaos and ShmooCon’s revival
Welcome to Changelog for 3/27/22, published by Synack! It’s me, Blake, your loyal ShmooCon correspondent. The celebrated D.C. cybersecurity…
Hacking on Medium
How Do Hackers access a Facebook Account?
https://cdn-images-1.medium.com/max/2600/1*Sy-PW8huuQLBHLCs9H24ZQ.jpeg
Facebook is a social networking service that allows its users to connect with friends and family as well as make new connections. Facebook…
Continue reading on Medium »
How Do Hackers access a Facebook Account?
https://cdn-images-1.medium.com/max/2600/1*Sy-PW8huuQLBHLCs9H24ZQ.jpeg
Facebook is a social networking service that allows its users to connect with friends and family as well as make new connections. Facebook…
Continue reading on Medium »
Medium
How Do Hackers access a Facebook Account?
Facebook is a social networking service that allows its users to connect with friends and family as well as make new connections. Facebook…
hacking: security in practice
The BLST Security openAPI specification scanner is now available. With it, you can upload your openAPI Swagger .json files and check for unused schemas, for any required parameters that are undefined, valid response codes, and many others.
submitted by /u/Glass_Guitar1959
[link] [comments]
The BLST Security openAPI specification scanner is now available. With it, you can upload your openAPI Swagger .json files and check for unused schemas, for any required parameters that are undefined, valid response codes, and many others.
submitted by /u/Glass_Guitar1959
[link] [comments]
reddit
The BLST Security openAPI specification scanner is now available....
Posted in r/hacking by u/Glass_Guitar1959 • 1 point and 0 comments
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Lateral Movement: Remote Services (Mitre:T1021)
IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral movement is possible through the use of many binaries/services/processes. In this article, we will be solely focusing on Lateral Movement using Remote Services, i.e., services that can help in code/command execution on remote systems by taking invalid set of credentials. Oftentimes, the same set of credentials are used within an organization and this type of lateral movement becomes very easy and effective.
MITRE TACTIC: Lateral Movement (TA0008)
MITRE TECHNIQUE ID: T1021 (Remote Services)
SUBTITLE: Multiple Titles (T1021.001, T1021.002, T1021.003, T1021.004, T1021.005, T1021.006) Table of Content* Background
* Understanding Attack Lab
* Lateral Movement through RDP (T1021.001)
* RDP Hijacking using Task Manager
* RDP Hijacking using Tscon
* RDP Hijacking using Mimikatz
* SharpRDP Authenticated Code Execution
* Lateral Movement through SMB (T1021.002)
* PsExec SMB RCE
* exe process creation
* Metasploit SMB Remote PsExec
* exe SMB RCE
* exe SMB RCE
* Lateral Movement through DCOM (T1021.003)
* application remote DCOM
* Lateral Movement through SSH (T1021.004)
* SSH Port Forwarding
* Lateral Movement through VNC (T1021.005)
* VNCinject payload
* Lateral Movement through WinRM (T1021.006)
* New-PSSession Powershell
* Invoke-Command Powershell
* Winrs
* Evil-Winrm
* Lateral Movement through Mimikatz
* Lateral Movement through WMI
* Lateral Movement through Invoke-WmiMethod
* Conclusion BackgroundLateral movement is very helpful in gathering more data by compromising more systems rather than relying on just a single system to gain higher privileges and eventually compromise entire network.
Certain services are specifically designed to provide remote sessions and they accept connections if valid credentials are provided. In domain networks, this basic authentication is replaced with Kerberos however, a set of valid credentials can still be used across the network and on multiple devices. For example, an HR admin account can be logged on to any HR system and more data can be fetched this way by moving laterally.
The aim of this article is to demonstrate as many methods as possible by exploiting most well-known remote services including RDP, SSH etc. By the end of the article, we will talk about services like mimikatz and wmi. These services essentially use one or more combinations of remote services to provide remote sessions.
Let’s start with RDP first and gradually move on to other services. Understanding Attack LabFor the article I have two setups in hand. One is an Active Directory setup with the domain “ignite.local” and the other is simple 2 windows devices connected on bridged with a Kali system in a non-domain environment. The details are as follows:
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmbm8u2riPC9F4WQYqIjZtwxz-BPaIkwLy51CQoeR1eihOSvqgJx9l4uzmjotKUwdp-FJh7l2zCUoZMSnsOX3boXUg-KXJMXb33yYAZHRMdn_mdGnr-bfRaavrxkS-LjoHzDbsJO2zXpvjsw0BIBVZHlOOSpUwGQ07AixZ-WXEbIIY1uUIOaV9J6bhFw/s16000/0.png?w=640&ssl=1 Lateral Movement through RDP (T1021.001)According to Microsoft, RDP is based on, and is an extension of, the T-120 family of protocol standards. A multichannel capable protocol allows for separate virtual channels for carrying the following information:
* presentation data
* serial device communication
* licensing information
* highly encrypted data, such as keyboard, mouse activity
In other words, it lets a user communicate with a remote server by providing him a fully functional GUI.
RDP Hijacking using Task Manager
When you connect to a user “Administrator” and open task manager-> [...]
Lateral Movement: Remote Services (Mitre:T1021)
IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral movement is possible through the use of many binaries/services/processes. In this article, we will be solely focusing on Lateral Movement using Remote Services, i.e., services that can help in code/command execution on remote systems by taking invalid set of credentials. Oftentimes, the same set of credentials are used within an organization and this type of lateral movement becomes very easy and effective.
MITRE TACTIC: Lateral Movement (TA0008)
MITRE TECHNIQUE ID: T1021 (Remote Services)
SUBTITLE: Multiple Titles (T1021.001, T1021.002, T1021.003, T1021.004, T1021.005, T1021.006) Table of Content* Background
* Understanding Attack Lab
* Lateral Movement through RDP (T1021.001)
* RDP Hijacking using Task Manager
* RDP Hijacking using Tscon
* RDP Hijacking using Mimikatz
* SharpRDP Authenticated Code Execution
* Lateral Movement through SMB (T1021.002)
* PsExec SMB RCE
* exe process creation
* Metasploit SMB Remote PsExec
* exe SMB RCE
* exe SMB RCE
* Lateral Movement through DCOM (T1021.003)
* application remote DCOM
* Lateral Movement through SSH (T1021.004)
* SSH Port Forwarding
* Lateral Movement through VNC (T1021.005)
* VNCinject payload
* Lateral Movement through WinRM (T1021.006)
* New-PSSession Powershell
* Invoke-Command Powershell
* Winrs
* Evil-Winrm
* Lateral Movement through Mimikatz
* Lateral Movement through WMI
* Lateral Movement through Invoke-WmiMethod
* Conclusion BackgroundLateral movement is very helpful in gathering more data by compromising more systems rather than relying on just a single system to gain higher privileges and eventually compromise entire network.
Certain services are specifically designed to provide remote sessions and they accept connections if valid credentials are provided. In domain networks, this basic authentication is replaced with Kerberos however, a set of valid credentials can still be used across the network and on multiple devices. For example, an HR admin account can be logged on to any HR system and more data can be fetched this way by moving laterally.
The aim of this article is to demonstrate as many methods as possible by exploiting most well-known remote services including RDP, SSH etc. By the end of the article, we will talk about services like mimikatz and wmi. These services essentially use one or more combinations of remote services to provide remote sessions.
Let’s start with RDP first and gradually move on to other services. Understanding Attack LabFor the article I have two setups in hand. One is an Active Directory setup with the domain “ignite.local” and the other is simple 2 windows devices connected on bridged with a Kali system in a non-domain environment. The details are as follows:
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmbm8u2riPC9F4WQYqIjZtwxz-BPaIkwLy51CQoeR1eihOSvqgJx9l4uzmjotKUwdp-FJh7l2zCUoZMSnsOX3boXUg-KXJMXb33yYAZHRMdn_mdGnr-bfRaavrxkS-LjoHzDbsJO2zXpvjsw0BIBVZHlOOSpUwGQ07AixZ-WXEbIIY1uUIOaV9J6bhFw/s16000/0.png?w=640&ssl=1 Lateral Movement through RDP (T1021.001)According to Microsoft, RDP is based on, and is an extension of, the T-120 family of protocol standards. A multichannel capable protocol allows for separate virtual channels for carrying the following information:
* presentation data
* serial device communication
* licensing information
* highly encrypted data, such as keyboard, mouse activity
In other words, it lets a user communicate with a remote server by providing him a fully functional GUI.
RDP Hijacking using Task Manager
When you connect to a user “Administrator” and open task manager-> [...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Lateral Movement: Remote Services (Mitre:T1021) IntroductionDuring Red Team assessments, after a compromise has been done, attackers tend to laterally move through the network gaining more relevant information on other systems. This lateral…
go to users-> you’d see this if a user “hex” is signed out currently but exists.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8UwTnXTVBDoJIjvbmNR2wVOpyBjxZoHi2H3efnroI-nXxB7kUsFN-yaVec8VGkog8a6Ps86vnXrKhb9O8cVeYz0qhExKwBAwnnoTUkSgL-plzCxUJNl6CCpNZRCRFUlMmop5m2VgT-gGHfgBqpC4HhXEhVCbIkwdau5dYM2OjzZLnrSN1WJ7gx1JOZg/s16000/1.png?w=640&ssl=1
You can click on hex and choose to connect
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibL5nZrGGyfCAps2TlKLNiAjRYg_su3zeB5tBGgebKAciUzvRxtNQ-P3CZu_AYkV57ihHm_4DK6zxvidYZB0ekllfJ2Xla73_Ub2kHxTGEDd_bRknCXSL51qjeZPF8N2jpU84hRkslynhC7A9pI3YnnleqJ4Bcn2m2RS9UjQw1crer7SNU1E1t6bZkmQ/s16000/2.png?w=640&ssl=1
Task manager would now ask for the credentials for user hex
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOL1KvSBTPA7VWHj-vFpl8WZheO3AQ8RWNJKUwjtPGlkXarXB7UOGTPanni_zc77neoPokrj5yMEpnrkazzEbKZCSW3dXeuN_spIO5jnDFK8WnDU5N5MVgBp9y21lbe6aFwmibwBhpTn6D0SyzUogMuvVEkNw8Yt1uXpcG-qgtCr3O8j2K_SHVxxHQAQ/s16000/3.png?w=640&ssl=1
You’d be successfully connected to hex now. As it can be confirmed in cmd
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglIxlueqtXN4zDUoDORnryr9mfxhRtBpgwRxoC1Vi5gEfMfnsf1QO-zkCd_FY1XEliDDR1uN9dLdr2ppdg_Q2C6z-FFTuLLQG9LFlcB2pHfVEpKRXhkuhZPBUKxsdgA38f0kM5CY8zxPFHl7HQGWpAW_jQiRpf1RszJBDwmInuRkFyX_K62DH5CN5nwA/s16000/4.png?w=640&ssl=1
RDP Hijacking using Tscon
tscon is a Microsoft Windows utility that was introduced the release of Windows Server 2012. It is used to connect to another session on a Remote Desktop Session Host server. It requires the destination and the session id to work. The User credentials can also be passed as parameters in tscon. Read more about it here.
Now the interesting thing is, if you have managed to achieve SYSTEM level permissions (NT AUTHORITY\SYSTEM), you could switch RDP sessions using tscon without needing password. This worked on older versions of Windows 10 flawlessly. In newer versions, there is still a need for passwords.
So, we first achieve NT AUTHORITY\SYSTEM on our compromised system using psexec and then see interactive sessions. We switch to the desired session (number 3 here) and use /DEST switch to switch current connection (rdp-tcp#9) with the user in 3rd session.
whoami
psexec64.exe -s cmd
whoami
query user
cmd /k tscon 3 /DEST:rdp-tcp#9
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiR326WYaKMMD0mTHM4wdWejoNGaDT05rM3T8J2rSzJgpwuI7mqL-UI1jHe7AOg643hyK2bB9ieuGEpx92_RSu849B-T90AEh6upm6XkYMXhPlf-WIMeQtg3wUrN5AVyA6KJ-axFr_Ix4KG5jM5HXQIJ2dNtB2eMANxO0j98C7S-tki05FEo-3L0gehQw/s16000/5.png?w=640&ssl=1
It will immediately open a new user “hex” in the same Remote Desktop Connection! This can be verified by whoami
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdbDxe9AfbBr_ofCuAkIAuh2V7r5ibgLzFouT5mB7gkiK7hM5k93WQ0PFqFsoiPQpqRGNRuk6O7TFiPdwvpQA_7xKAgm7TCTKuSWiHyoUQuVgVc_BunPFa5l1H7cb9D65eMk1hizsN4PlntKlD7EWf5be28LVYZZdsUWXWVGKQCOkIA7FxEssxQc77jQ/s16000/6.png?w=640&ssl=1
RDP Hijacking using Mimikatz
Mimikatz includes a module “ts” to play with RDP sessions. It is an implementation of tscon only with added features of mimikatz. We can see active user sessions using
ts::sessions
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXUsKIuox50VQD0kpqSvOqqw0zP1zEp2mFxHtH1p_GizC0Q-bFTR_9kpn9kdaYY_ZmkPEf2F_j7v4RisWVsocc6oqpXsFKkcNfK3H3sNBoc6iVs7MtB6Z8yCGAZ8uFvrl4rIEiBsCdTnOIrAsA9GYqsWBVU-AEeaGuYwBwO4eX5ADaddiSO_UsyGh-Tw/s16000/7.png?w=640&ssl=1
We have a disconnected user hex on session ID 3. Let’s connect to it. What we did using psexec, mimikatz does it automatically by using token impersonation to elevate privileges.
privilege::debug
token::elevate
ts::remote /id:3
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4JX5G2XMtXbPPgEt7WW9un2I5tQ2hZwtX6YxXhk20HDIptBpKPMMlIOCci4XHxo4aoE_F_PhF48e0f58jU0bcOSidHC1qg8EvaGuouO55qq1mPYDNrRH-n_6yH6PnyUJhHH4XdHKYyfXnCZUlxi5rZ6lJEkQta[...]
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8UwTnXTVBDoJIjvbmNR2wVOpyBjxZoHi2H3efnroI-nXxB7kUsFN-yaVec8VGkog8a6Ps86vnXrKhb9O8cVeYz0qhExKwBAwnnoTUkSgL-plzCxUJNl6CCpNZRCRFUlMmop5m2VgT-gGHfgBqpC4HhXEhVCbIkwdau5dYM2OjzZLnrSN1WJ7gx1JOZg/s16000/1.png?w=640&ssl=1
You can click on hex and choose to connect
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEibL5nZrGGyfCAps2TlKLNiAjRYg_su3zeB5tBGgebKAciUzvRxtNQ-P3CZu_AYkV57ihHm_4DK6zxvidYZB0ekllfJ2Xla73_Ub2kHxTGEDd_bRknCXSL51qjeZPF8N2jpU84hRkslynhC7A9pI3YnnleqJ4Bcn2m2RS9UjQw1crer7SNU1E1t6bZkmQ/s16000/2.png?w=640&ssl=1
Task manager would now ask for the credentials for user hex
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhOL1KvSBTPA7VWHj-vFpl8WZheO3AQ8RWNJKUwjtPGlkXarXB7UOGTPanni_zc77neoPokrj5yMEpnrkazzEbKZCSW3dXeuN_spIO5jnDFK8WnDU5N5MVgBp9y21lbe6aFwmibwBhpTn6D0SyzUogMuvVEkNw8Yt1uXpcG-qgtCr3O8j2K_SHVxxHQAQ/s16000/3.png?w=640&ssl=1
You’d be successfully connected to hex now. As it can be confirmed in cmd
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglIxlueqtXN4zDUoDORnryr9mfxhRtBpgwRxoC1Vi5gEfMfnsf1QO-zkCd_FY1XEliDDR1uN9dLdr2ppdg_Q2C6z-FFTuLLQG9LFlcB2pHfVEpKRXhkuhZPBUKxsdgA38f0kM5CY8zxPFHl7HQGWpAW_jQiRpf1RszJBDwmInuRkFyX_K62DH5CN5nwA/s16000/4.png?w=640&ssl=1
RDP Hijacking using Tscon
tscon is a Microsoft Windows utility that was introduced the release of Windows Server 2012. It is used to connect to another session on a Remote Desktop Session Host server. It requires the destination and the session id to work. The User credentials can also be passed as parameters in tscon. Read more about it here.
Now the interesting thing is, if you have managed to achieve SYSTEM level permissions (NT AUTHORITY\SYSTEM), you could switch RDP sessions using tscon without needing password. This worked on older versions of Windows 10 flawlessly. In newer versions, there is still a need for passwords.
So, we first achieve NT AUTHORITY\SYSTEM on our compromised system using psexec and then see interactive sessions. We switch to the desired session (number 3 here) and use /DEST switch to switch current connection (rdp-tcp#9) with the user in 3rd session.
whoami
psexec64.exe -s cmd
whoami
query user
cmd /k tscon 3 /DEST:rdp-tcp#9
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiR326WYaKMMD0mTHM4wdWejoNGaDT05rM3T8J2rSzJgpwuI7mqL-UI1jHe7AOg643hyK2bB9ieuGEpx92_RSu849B-T90AEh6upm6XkYMXhPlf-WIMeQtg3wUrN5AVyA6KJ-axFr_Ix4KG5jM5HXQIJ2dNtB2eMANxO0j98C7S-tki05FEo-3L0gehQw/s16000/5.png?w=640&ssl=1
It will immediately open a new user “hex” in the same Remote Desktop Connection! This can be verified by whoami
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdbDxe9AfbBr_ofCuAkIAuh2V7r5ibgLzFouT5mB7gkiK7hM5k93WQ0PFqFsoiPQpqRGNRuk6O7TFiPdwvpQA_7xKAgm7TCTKuSWiHyoUQuVgVc_BunPFa5l1H7cb9D65eMk1hizsN4PlntKlD7EWf5be28LVYZZdsUWXWVGKQCOkIA7FxEssxQc77jQ/s16000/6.png?w=640&ssl=1
RDP Hijacking using Mimikatz
Mimikatz includes a module “ts” to play with RDP sessions. It is an implementation of tscon only with added features of mimikatz. We can see active user sessions using
ts::sessions
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXUsKIuox50VQD0kpqSvOqqw0zP1zEp2mFxHtH1p_GizC0Q-bFTR_9kpn9kdaYY_ZmkPEf2F_j7v4RisWVsocc6oqpXsFKkcNfK3H3sNBoc6iVs7MtB6Z8yCGAZ8uFvrl4rIEiBsCdTnOIrAsA9GYqsWBVU-AEeaGuYwBwO4eX5ADaddiSO_UsyGh-Tw/s16000/7.png?w=640&ssl=1
We have a disconnected user hex on session ID 3. Let’s connect to it. What we did using psexec, mimikatz does it automatically by using token impersonation to elevate privileges.
privilege::debug
token::elevate
ts::remote /id:3
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4JX5G2XMtXbPPgEt7WW9un2I5tQ2hZwtX6YxXhk20HDIptBpKPMMlIOCci4XHxo4aoE_F_PhF48e0f58jU0bcOSidHC1qg8EvaGuouO55qq1mPYDNrRH-n_6yH6PnyUJhHH4XdHKYyfXnCZUlxi5rZ6lJEkQta[...]