How we spoofed ENS domains

TL;DR: We found a flaw that allowed us to spoof Ethereum domain names and received a $15k bounty.Continue reading on Medium »
Read more...

Port scanning and service discovery in 2022 — we have failed as a humanity

There have been a lot of popular port scanning projects lately. In particular, these are projects that seek to combine fast port discovery…Continue reading on Medium »
Read more...

How we spoofed ENS domains
https://medium.com/@hacxyk/how-we-spoofed-ens-domains-52acea2079f6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

TL;DR: We found a flaw that allowed us to spoof Ethereum domain names and received a $15k bounty.Continue reading on Medium » (https://medium.com/@hacxyk/how-we-spoofed-ens-domains-52acea2079f6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Port scanning and service discovery in 2022 — we have failed as a humanity
https://medium.com/@nullt3r/port-scanning-and-service-discovery-in-2022-we-have-failed-as-a-humanity-9d0fe4503c18?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

There have been a lot of popular port scanning projects lately. In particular, these are projects that seek to combine fast port discovery…Continue reading on Medium » (https://medium.com/@nullt3r/port-scanning-and-service-discovery-in-2022-we-have-failed-as-a-humanity-9d0fe4503c18?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Linux User Controls

https://cdn-images-1.medium.com/max/1344/0*pHN3DHTkD58ADCXf.jpg
What is Linux

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Blog(MEDIUM)-THM

https://cdn-images-1.medium.com/max/1280/1*Ow9T3grRtiWSwv26KEyyiA.png
It is instructed to make an entry in the etc/hosts file so let's make it

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Linux User Controls

What is LinuxContinue reading on Medium »
Read more...

HOW RECON HELPED ME TO GET A STORED XSS!

RECONNAISSANCE IS THE KEY IN BUG BOUNTIESContinue reading on Medium »
Read more...

EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections
http://www.kitploit.com/2022/04/edrsandblast-tool-that-weaponize.html

___________________________
@hacking_Attack
@Hacking_Video

int 3 ; overwritten instructions
test byte_7FFE0308, 1 ; <-- execution resumes here after analysis
jnz short loc_7FFCB44AD1E5
syscall
retn
loc_7FFCB44AD1E5:
int 2Eh
retn
NtProtectVirtualMemory endp Hooks detection Userland hooks have the "weakness" to be located in userland memory, which means they are directly observable and modifiable by the process under scrutiny. To automatically detect hooks in the process address space, the main idea is to compare the differences between the original DLL on disk and the library residing in memory, that has been potentially altered by an EDR. To perform this comparison, the following steps are followed by EDRSandblast: The list of all loaded DLLs is enumerated thanks to the InLoadOrderModuleList located int the PEB (to avoid calling any API that could be monitored and suspicious) For each loaded DLL, its content on disk is read and its headers parsed. The corresponding library, residing in memory, is also parsed to identify sections, exports, etc. Relocations of the DLL are parsed and applied, by taking the base address of the corresponding loaded library into account. This allows the content of both the in-memory library and DLL originating from disk to have the exact same content (on sections where relocations are applied), and thus making the comparison reliable. Exported functions are enumerated and the first bytes of the "in-memory" and "on-disk" versions are compared. Any difference indicates an alteration that has been made after the DLL was loaded, and thus is very probably an EDR hook. Note: The process can be generalized to find differences anywhere in non-writable sections and not only at the start of exported functions, for example if EDR products start to apply hooks in the middle of function :) Thus not used by the tool, this has been implemented in findDiffsInNonWritableSections. In order to bypass the monitoring performed by these hooks, multiples techniques are possible, and each has benefits and drawbacks. Hook bypass using ... unhooking The most intuitive method to bypass the hook-based monitoring is to remove the hooks. Since the hooks are present in memory that is reachable by the process itself, to remove a hook, the process can simply: Change the permissions on the page where the hook is located (RX -> RWX or RW) Write the original bytes that are known thanks to the on-disk DLL content Change back the permissions to RX This approach is fairly simple, and can be used to remove every detected hook all at once. Performed by an offensive tool at its beginning, this allows the rest of the code to be completely unaware of the hooking mechnanism and perform normally without being monitored. However, it has two main drawbacks. The EDR is probably monitoring the use of NtProtectVirtualMemory, so using it to change the permissions of the page where the hooks have been installed is (at least conceptually) a bad idea. Also, if a thread is executed by the EDR and periodically check the integrity of the hooks, this could also trigger some detection. For implementation details, check the unhook() function's code path when unhook_method is UNHOOK_WITH_NTPROTECTVIRTUALMEMORY. Important note: for simplicity, this technique is implemented in EDRSandblast as the base technique used to showcase the other bypass techniques; each of them demonstrates how to obtain an unmonitored version of NtProtectVirtualMemory, but performs the same operation afterward (unhooking a specific hook). Hook bypass using a custom trampoline To bypass a specific hook, it is possible to simply "jump over" and execute the rest of the function as is. First, the original bytes of the monitored function, that have been overwritten by the EDR to install the hook, must be recovered from the DLL file. In our previous code example, this would be the bytes corresponding to the following instructions: mov r10, rcx

___________________________
@hacking_Attack
@Hacking_Video

Quick usage Usage: EDRSandblast.exe [-h | --help] [-v | --verbose] [--usermode [--unhook-method ]] [--kernelmode] [--dont-unload-driver] [--dont-restore-callbacks] [--driver ] [--service ] [--nt-offsets ] [--wdigest-offsets ] [--add-dll ]* [-o | --dump-output ]
Options . cmd Open a cmd.exe prompt. credguard Patch the LSASS process' memory to enable Wdigest cleartext passwords caching even if Credential Guard is enabled on the host. No kernel-land actions required. --usermode Perform user-land operations (DLL unhooking). --kernelmode Perform kernel-land operations (Kernel callbacks removal and ETW TI disabling). --unhook-method Choose the userland un-hooking technique, from the following: 1 (Default) Uses the (probably monitored) NtProtectVirtualMemory function in ntdll to remove all present userland hooks. 2 Constructs a 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, by allocating an executable trampoline jumping over the hook, and remove all present userland hooks. 3 Searches for an existing trampoline allocated by the EDR itself, to get an 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, and remove all present userland hooks. 4 Loads an additional version of ntdll library into memory, and use the (hopefully unmonitored) version of NtProtectVirtualMemory present in this library to remove all present userland hooks. 5 Allocates a shellcode that uses a direct syscall to call NtProtectVirtualMemory, and uses it to remove all detected hooks Other options: --dont-unload-driver Keep the Micro-Star MSI Afterburner vulnerable driver installed on the host Default to automatically unsinstall the driver. --dont-restore-callbacks Do not restore the EDR drivers' Kernel Callbacks that were removed. Default to restore the callbacks. --driver Path to the Micro-Star MSI Afterburner vulnerable driver file. Default to 'RTCore64.sys' in the current directory. --service Name of the vulnerable service to intall / start. --nt-offsets Path to the CSV file containing the required ntoskrnl.exe's offsets. Default to 'NtoskrnlOffsets.csv' in the current directory. --wdigest-offsets Path to the CSV file containing the required wdigest.dll's offsets (only for the 'credguard' mode). Default to 'WdigestOffsets.csv' in the current directory. --add-dll Loads arbitrary libraries into the process' address space, before starting anything. This can be useful to audit userland hooking for DLL that are not loaded by default by this program. Use this option multiple times to load multiple DLLs all at once. Example of interesting DLLs to look at: user32.dll, ole32.dll, crypt32.dll, samcli.dll, winhttp.dll, urlmon.dll, secur32.dll, shell32.dll... -o | --output Output path to the dump file that will be generated by the 'dump' mode. Default to 'lsass' in the current directory.">-h | --help Show this help message and exit.
-v | --verbose Enable a more verbose output.

Actions mode:

___________________________
@hacking_Attack
@Hacking_Video

audit Display the user-land hooks and / or Kernel callbacks without taking actions.
dump Dump the LSASS process, by default as 'lsass' in the current directory or at the
specified file using -o | --output .
cmd Open a cmd.exe prompt.
credguard Patch the LSASS process' memory to enable Wdigest cleartext passwords caching even if
Credential Guard is enabled on the host. No kernel-land actions required.

--usermode Perform user-land operations (DLL unhooking).
--kernelmode Perform kernel-land operations (Kernel callbacks removal and ETW TI disabling).

--unhook-method
Choose the userland un-hooking technique, from the following:

1 (Default) Uses the (probably monitored) NtProtectVirtualMemory function in ntdll to remove all
present userland hooks.
2 Constructs a 'unhooked' (i.e. unmonitored) version of NtProtectVirtualMemory, by
allocating an executable trampoline jumping over the hook, and remove all present
userland hooks.
3 Searches for an existing trampoline allocated by the EDR itself, to get an 'unhooked'
(i.e. unmonitored) version of NtProtectVirtualMemory, and remove all present userland
hooks.
4 Loads an additional version of ntdll library into memory, and use the (hopefully
unmonitored) version of NtProtectVirtualMemory present in this l ibrary to remove all
present userland hooks.
5 Allocates a shellcode that uses a direct syscall to call NtProtectVirtualMemory,
and uses it to remove all detected hooks

Other options:

--dont-unload-driver Keep the Micro-Star MSI Afterburner vulnerable driver installed on the host
Default to automatically unsinstall the driver.
--dont-restore-callbacks Do not restore the EDR drivers' Kernel Callbacks that were removed.
Default to restore the callbacks.

--driver Path to the Micro-Star MSI Afterburner vulnerable driver file.
Default to 'RTCore64.sys' in the current directory.
--service Name of the vulnerable service to intall / start.
--nt-offsets Path to the CSV file containing the required ntoskrnl.exe's offsets.
Default to 'NtoskrnlOffsets.csv' in the current directory.
--wdigest-offsets Path to the CSV file containing the required wdigest.dll's offsets
(only for the 'credguard' mode).
Default to 'WdigestOffsets.csv' in the current directory.

--add-dll Loads arbitrary libraries into the process' address space, before starting
anything. This can be useful to audit userland hooking for DLL that are not
loaded by default by this program. Use this option multiple times to load
multiple DLLs all at once.
Example of interesting DLLs to look at: user32.dll, ole32.dll, crypt32.dll,
samcli.dll, winhttp.dll, urlmon.dll, secur32.dll, shell32.dll...

-o | --output Output path to the dump file that will be generated by the 'dump' mode.
Default to 'lsass' in the current directory.

___________________________
@hacking_Attack
@Hacking_Video

Detection From the defender (EDR vendor, Microsoft, SOC analysts looking at EDR's telemetry, ...) point of view, multiple indicators can be used to detect or prevent this kind of techniques. Driver whitelisting Since every action performed by the tool in kernel-mode memory relies on a vulnerable driver to read/write arbitrary content, driver loading events should be heaviliy scrutinized by EDR product (or SOC analysts), and raise an alert at any uncommon driver loading, or even block known vulnerable drivers. This latter approach is even recommended by Microsoft themselves (https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-defender-application-control/microsoft-recommended-driver-block-rules): any HVCI (Hypervisor-protected code integrity) enabled Windows device embeds a drivers blocklist, and this will be progressively become a default behaviour on Windows (it already is on Windows 11). Kernel-memory integrity checks Since an attacker could still use an unknown vulnerable driver to perform the same actions in memory, the EDR driver could periodically check that its kernel callbacks are still registered, directly by inspecting kernel memory (like this tool does), or simply by triggering events (process creation, thread creation, image loading, etc.) and checking the callback functions are indeed called by the executive kernel. As a side note, this type of data structure could be protected via the recent Kernel Data Protection (KDP) (https://www.microsoft.com/security/blog/2020/07/08/introducing-kernel-data-protection-a-new-platform-security-technology-for-preventing-data-corruption/) mechanism, which relies on Virtual Based Security, in order to make the kernel callbacks array non-writable without calling the right APIs. The same logic could apply to sensitive ETW variables such as the ProviderEnableInfo, abused by this tool to disable the ETW Threat Intelligence (https://www.kitploit.com/search/label/Threat%20Intelligence) events generation. User-mode detection The first indicator that a process is actively trying to evade user-land hooking is the file accesses to each DLL corresponding to loaded modules; in a normal execution, a userland process rarely needs to read DLL files outside of a LoadLibrary call, especially ntdll.dll. In order to protect API hooking from being bypassed, EDR products could periodically check that hooks are not altered in memory, inside each monitored process. Finally, to detect hooking bypass (abusing a trampoline, using direct syscalls, etc.) that does not imply the hooks removal, EDR products could potentially rely on kernel callbacks associated to the abused syscalls (ex. PsCreateProcessNotifyRoutine for NtCreateProcess syscall, ObRegisterCallbacks for NtOpenProcess syscall, etc.), and perform user-mode call-stack analysis in order to determine if the syscall was triggered from a normal path (kernel32.dll -> ntdll.dll -> syscall) or an abnormal one (ex. program.exe -> direct syscall). Acknowledgements Kernel callbacks enumeration and removal: https://github.com/br-sn/CheekyBlinder Kernel memory Read / Write primitives through the vulnerable Micro-Star MSI Afterburner driver: https://github.com/Barakat/CVE-2019-16098/ Disabling of the ETW Threat Intelligence provider: https://public.cnotools.studio/bring-your-own-vulnerable-kernel-driver-byovkd/exploits/data-only-attack-neutralizing-etwti-provider Driver install / uninstall: https://github.com/gentilkiwi/mimikatz Initial list of EDR drivers names: https://github.com/SadProcessor/SomeStuff/blob/master/Invoke-EDRCheck.ps1 Credential Guard bypass by re-enabling Wdigest through LSASS memory patching: https://teamhydra.blog/2020/08/25/bypassing-credential-guard/ Authors Thomas DIOT (Qazeer) (https://github.com/Qazeer/) Maxime MEIGNAN (themaks) (https://github.com/themaks) Licence CC BY 4.0 licence - https://creativecommons.org/licenses/by/4.0/

___________________________
@hacking_Attack
@Hacking_Video

Download EDRSandblast (https://github.com/wavestone-cdt/EDRSandblast)

___________________________
@hacking_Attack
@Hacking_Video

Linux User Controls
https://akash-venky091.medium.com/linux-user-controls-fc88b82a359f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video