RECONNAISSANCE IS THE KEY IN BUG BOUNTIESContinue reading on Medium » (https://faiyazhacks.medium.com/how-recon-helped-me-to-get-a-stored-xss-26c7be17ccfa?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Telegram group to find partners or knowledge

Yesterday I made a post about creating a telegram group to help serious people find partners or simply just knowledge anyway I’ve created that group and it doesn’t have too many members but if anyone wants to join hmu.

submitted by /u/JazzyLandlord
[link] [comments]

hacking: security in practice
Tool to search for deleted or overwritten data

Hi!
Just a quick share of a tool I recently discovered in hakin9 blog. It is a data recovery tool which aims to recover not only deleted but also overwritten data.
As we all know tools to recover deleted data but recovering overwritten data was until then, as far as I know, impossible.

Well, cool for recovering your lost file but also searching for anything on a disk! I've tested it and it's quite powerful, it will find anything you search, a deleted file or a string hidden in a dark binary file.

So here is it, just think you might want to bookmark it as I did:

https://github.com/PabloLec/RecoverPy

submitted by /u/ThenChoice2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Have you or someone you know system ever been compromised?

I've been compromised one time when i was a early haxxor running scripts and shit but after that it's never happened again, what's are some of you guys story?

Please share!

submitted by /u/Saajaadeen
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/F6r7Mt3oDXFFbuo0bRs3UcqYSmU_7wDCIse8e0a1w0k.jpg submitted by /u/Saajaadeen
[link] [comments]

Is a pentester work stressful?
https://www.reddit.com/r/Pentesting/comments/u4y7ic/is_a_pentester_work_stressful/

May in some companies be a penetration tester a stressful job? submitted by /u/Lestrange007 (https://www.reddit.com/user/Lestrange007)
[link] (https://www.reddit.com/r/Pentesting/comments/u4y7ic/is_a_pentester_work_stressful/) [comments] (https://www.reddit.com/r/Pentesting/comments/u4y7ic/is_a_pentester_work_stressful/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CLAMP-1 VM WalkThrough

https://cdn-images-1.medium.com/max/858/0*iJLtn8OABcvMyWUC
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tech_Supp0rt: 1 (Tryhackme)

https://cdn-images-1.medium.com/max/600/1*HxMde2gkALloIVqTSDzNug.png
Hack into the scammer’s under-development website to foil their plans.

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAMzRHxJsuayYfmlgYJ40ZPtgY0mQX_fJ-1XWkdNeiicxSAw8cPQ3Kig390B1yD2NgyUGLg6nsd-oF0MRo3JVR5j7pBbRbMB_bL7NEOi7hdPfYidDlrP7XFKEh3bkv4dbtgCSY3SSq_EN2IMa_YNmVs785PfHxb69R4MfBvxTSIJHc-WlEy6RC6lxi/w640-h314/EDRSandblast.png EDRSandBlastis a tool written in Cthat weaponize a vulnerable signed driver to bypass EDR detections (Kernel callbacks and ETW TIprovider) and LSASSprotections. Multiple userland unhooking techniques are also implemented to evade userland monitoring.

As of release, combination of userland (--usermode) and Kernel-land (--kernelmode) techniques were used to dump LSASSmemory under EDR scrutiny, without being blocked nor generating "OS Credential Dumping"-related events in the product (cloud) console. The tests were performed on 3 distinct EDR products and were successful in each case. DescriptionEDR bypass through Kernel callbacks removalEDR products use Kernel callbacks on Windows to be notified by the kernel of system activity, such as process and thread creation and loading of images (exe / DLL).

The Kernel callbacks are defined from user-land using a number of documented APIs (nt!PsSetCreateProcessNotifyRoutine, nt!PsSetCreateThreadNotifyRoutine, etc.). The user-land APIs add driver-supplied callback routines to undocumented arrays of routines in Kernel-space:

* PspCreateProcessNotifyRoutinefor process creation
* PspCreateThreadNotifyRoutinefor thread creation
* PspLoadImageNotifyRoutinefor image loading EDRSandBlastenumerates the routines defined in those arrays and remove any callback routine linked to a predefined list of EDR drivers (more than 1000 thousands drivers of security products from the allocated filter altitudes). The enumeration and removal are made possible through the exploitation of an arbitrary Kernel memory read / write vulnerability of the Micro-Star MSI Afterburnerdriver (CVE-2019-16098). The enumeration and removal code is largely inspired from br-sn's CheekyBlinder project.

The offsets of the aforementioned arrays are hardcoded in the NtoskrnlOffsets.csvfile for more than 350 versions of the Windows Kernel ntoskrnl.exe. The choice of going with hardcoded offsets instead of pattern searches is justified by the fact that the undocumented APIs responsible for Kernel callbacks addition / removal are subject to change and that any attempt to write Kernel memory at the wrong address may (and often will) result in a Bug Check(Blue Screen of Death). For more information on how the offsets were gathered, refer to Offsets section. EDR bypass through deactivation of the ETW Microsoft-Windows-Threat-Intelligence providerThe ETW Microsoft-Windows-Threat-Intelligenceprovider log data about the usages of some Windows API commonly used maliciously. This include the nt!MiReadWriteVirtualMemoryAPI, called by nt!NtReadVirtualMemory(which is used to dump LSASSmemory) and monitored by the nt!EtwTiLogReadWriteVmfunction.

EDR products can consume the logs produced by the ETW TIprovider through services or processes running as, respectively, SERVICE_LAUNCH_PROTECTED_ANTIMALWARE_LIGHTor PS_PROTECTED_ANTIMALWARE_LIGHT, and associated with an Early Launch Anti Malware (ELAM)driver.

As published by slaeryanin a CNO Development Labsblog post, the ETW TIprovider can be disabled altogether by patching, i[...]

___________________________
@hacking_Attack
@Hacking_Video

n kernel memory, its ProviderEnableInfoattribute to 0x0. Refer to the great aforementioned blog post for more information on the technique.

Similarly to the Kernel callbacks removal, the necessary ntoskrnl.exeoffsets (nt!EtwThreatIntProvRegHandleOffset, _ETW_REG_ENTRY's GuidEntry, and _ETW_GUID_ENTRY's ProviderEnableInfo) are hardcoded in the NtoskrnlOffsets.csvfile for a number of the Windows Kernel versions. EDR bypass through userland hooking bypassHow userland hooking worksIn order to easily monitor actions that are performed by processes, EDR products often deploy a mechanism called userland hooking. First, EDR products register a kernel callback (usually image loading or process creation callbacks, see above) that allows them to be notified upon each process start.

When a process is loaded by Windows, and before it actually starts, the EDR is able to inject some custom DLL into the process address space, which contains its monitoring logic. While loading, this DLL injects "hooks" at the start of every function that is to be monitored by the EDR. At runtime, when the monitored functions are called by the process under surveillance, these hooks redirect the control flow to some supervision code present in the EDR's DLL, which allows it to inspect arguments and return values of these calls.

Most of the time, monitored functions are system calls (such as NtReadVirtualMemory, NtOpenProcess, etc.), whose implementations reside in ntdll.dll. Intercepting calls to Nt*functions allows products to be as close as possible to the userland / kernel-land boundary (while remaining in userland), but functions from some higher-level DLLs may also be monitored as well.

Bellow are examples of the same function, before and after beeing hooked by the EDR product: NtProtectVirtualMemory proc near
mov r10, rcx
mov eax, 50h
test byte ptr ds:7FFE0308h, 1
jnz short loc_18009D1E5
syscall
retn
loc_18009D1E5:
int 2Eh
retn
NtProtectVirtualMemory endp <--NtProtectVirtualMemory proc near
jmp sub_7FFC74490298 ; --> "hook", jump to EDR analysis function
int 3 ; overwritten instructions
int 3 ; overwritten instructions
int 3 ; overwritten instructions
test byte_7FFE0308, 1 ; <--
jnz short loc_7FFCB44AD1E5
syscall
retn
loc_7FFCB44AD1E5:
int 2Eh
retn
NtProtectVirtualMemory endp Hooks detectionUserland hooks have the "weakness" to be located in userland memory, which means they are directly observable and modifiable by the process under scrutiny. To automatically detect hooks in the process address space, the main idea is to compare the differences between the original DLL on disk and the library residing in memory, that has been potentially altered by an EDR. To perform this comparison, the following steps are followed by EDRSandblast:

* The list of all loaded DLLs is enumerated thanks to the InLoadOrderModuleListlocated int the PEB(to avoid calling any API that could be monitored and suspicious)
* For each loaded DLL, its content on disk is read and its headers parsed. The corresponding library, residing in memory, is also parsed to identify sections, exports, etc.
* Relocations of the DLL are parsed and applied, by taking the base address of the corresponding loaded library into account. This allows the content of both the in-memory library and DLL originating from disk to have the exact same content (on sections where relocations are applied), and thus making the comparison reliable.
* Exported functions are enumerated and the first bytes of the "in-memory" and "on-disk" versions are compared. Any difference indicates an alteration that has been made after the DLL was loaded, and thus is very probably an [...]

___________________________
@hacking_Attack
@Hacking_Video

EDR hook.

Note: The process can be generalized to find differences anywhere in non-writable sections and not only at the start of exported functions, for example if EDR products start to apply hooks in the middle of function :) Thus not used by the tool, this has been implemented in findDiffsInNonWritableSections.

In order to bypass the monitoring performed by these hooks, multiples techniques are possible, and each has benefits and drawbacks. Hook bypass using ... unhookingThe most intuitive method to bypass the hook-based monitoring is to remove the hooks. Since the hooks are present in memory that is reachable by the process itself, to remove a hook, the process can simply:

* Change the permissions on the page where the hook is located (RX -> RWX or RW)
* Write the original bytes that are known thanks to the on-disk DLL content
* Change back the permissions to RX

This approach is fairly simple, and can be used to remove every detected hook all at once. Performed by an offensive tool at its beginning, this allows the rest of the code to be completely unaware of the hooking mechnanism and perform normally without being monitored.

However, it has two main drawbacks. The EDR is probably monitoring the use of NtProtectVirtualMemory, so using it to change the permissions of the page where the hooks have been installed is (at least conceptually) a bad idea. Also, if a thread is executed by the EDR and periodically check the integrity of the hooks, this could also trigger some detection.

For implementation details, check the unhook()function's code path when unhook_methodis UNHOOK_WITH_NTPROTECTVIRTUALMEMORY.

Important note: for simplicity, this technique is implemented in EDRSandblast as the base technique used to showcase the other bypass techniques; each of them demonstrates how to obtain an unmonitored version of NtProtectVirtualMemory, but performs the same operation afterward (unhooking a specific hook). Hook bypass using a custom trampolineTo bypass a specific hook, it is possible to simply "jump over" and execute the rest of the function as is. First, the original bytes of the monitored function, that have been overwritten by the EDR to install the hook, must be recovered from the DLL file. In our previous code example, this would be the bytes corresponding to the following instructions: mov r10, rcx
mov eax, 50hIdentifying these bytes is a simple task since we are able to perform a clean diff of both the memory and disk versions of the library, as previously described. Then, we assemble a jump instruction that is built to redirect the control flow to the code following immediately the hook, at address NtProtectVirtualMemory + sizeof(overwritten_instructions)jmp NtProtectVirtualMemory+8Finally, we concatenate these opcodes, store them in (newly) executable memory and keep a pointer to them. This object is called a "trampoline" and can then be used as a function pointer, strictly equivalent to the original NtProtectVirtualMemoryfunction.

The main benefit of this technique as for every techniques bellow, is that the hook is never erased, so any integrity check performed on the hooks by the EDR should pass. However, it requires to allocate writable then executable memory, which is typical of a shellcode allocation, thus attracting the EDR's scrutiny.

For implementation details, check the unhook()function's code path when unhook_methodis UNHOOK_WITH_INHOUSE_NTPROTECTVIRTUALMEMORY_TRAMPOLINE. Please remember the technique is only showcased in our implementation and is, in the end, used to remove hooks from memory, as every technique bellow. Hook bypass using the own EDR's trampolineThe EDR product, in order for its hook to work, must save somewhere in memory the opcodes that it has removed. Worst (or "better", from the attacker poin[...]

___________________________
@hacking_Attack
@Hacking_Video

t of view), to effectively use the original instructions the EDR has probably allocated itself a trampoline somewhere to execute the original function after having intercepted the call.

This trampoline can be searched for and used as a replacement for the hooked function, without the need to allocate executable memory, or call any API except VirtualQuery, which is most likely not monitored being an innocuous function.

To find the trampoline in memory, we browse the whole address space using VirtualQuerylooking for commited and executable memory. For each such region of memory, we scan it to look for a jump instruction that targets the address following the overwritten instructions (NtProtectVirtualMemory+8 in our previous example). The trampoline can then be used to call the hooked function without triggering the hook.

This technique works surprisingly well as it recovers nearly all trampolines on tested EDR. For implementation details, check the unhook()function's code path when unhook_methodis UNHOOK_WITH_EDR_NTPROTECTVIRTUALMEMORY_TRAMPOLINE. Hook bypass using duplicate DLLAnother simple method to get access to an unmonitored version of NtProtectVirtualMemoryfunction is to load a duplicate version of the ntdll.dlllibrary into the process address space. Since two identical DLLs can be loaded in the same process, provided they have different names, we can simply copy the legitimate ntdll.dllfile into another location, load it using LoadLibrary(or reimplement the loading process), and access the function using GetProcAddressfor example.

This technique is very simple to understand and implement, and have a decent chance of success, since most of EDR products does not re-install hooks on newly loaded DLLs once the process is running. However, the major drawback is that copying Microsoft signed binaries under a different name is often considered as suspicious by EDR products as itself.

This technique is nevertheless implemented in EDRSandblast. For implementation details, check the unhook()function's code path when unhook_methodis UNHOOK_WITH_DUPLICATE_NTPROTECTVIRTUALMEMORY. Hook bypass using direct syscallsIn order to use system calls related functions, one program can reimplement syscalls (in assembly) in order to call the corresponding OS features without actually touching the code in ntdll.dll, which might be monitored by the EDR. This completely bypasses any userland hooking done on syscall functions in ntdll.dll.

This nevertheless has some drawbacks. First, this implies being able to know the list of syscall numbers of functions the program needs, which changes for each version of Windows. Also, functions that are not technically syscalls (e.g. LoadLibraryX/LdrLoadDLL) could be monitored as well, and cannot simply be reimplemented using a syscall.

This technique is implemented in EDRSandblast. As previously stated, it is only used to execute NtProtectVirtualMemorysafely, and remove all detected hooks. However, in order not to rely on hardcoded offsets, a small heuristic is implemented to search for mov eax, imm32instruction at the start of the NtProtectVirtualMemoryfunction and recover the syscall number from it if found (otherwise relying on hardcoded offset for known Windows versions).

For implementation details, check the unhook()function's code path when unhook_methodis UNHOOK_WITH_DIRECT_SYSCALL. RunAsPPL bypassThe Local Security Authority (LSA) Protectionmechanism, first introduced in Windows 8.1 and Windows Server 2012 R2, leverage the Protected Process Light (PPL)technology to restrict access to the LSASSprocess. The PPLp[...]

___________________________
@hacking_Attack
@Hacking_Video

rotection regulates and restricts operations, such as memory injection or memory dumping of protected processes, even from a process holding the SeDebugPrivilegeprivilege. Under the process protection model, only processes running with higher protection levels can perform operations on protected processes.

The _EPROCESSstructure, used by the Windows kernel to represent a process in kernel memory, includes a _PS_PROTECTIONfield defining the protection level of a process through its Type(_PS_PROTECTED_TYPE) and Signer(_PS_PROTECTED_SIGNER) attributes.

By writing in kernel memory, the EDRSandblast process is able to upgrade its own protection level to PsProtectedSignerWinTcb-Light. This level is sufficient to dump the LSASSprocess memory, since it "dominates" to PsProtectedSignerLsa-Light, the protection level of the LSASSprocess running with the RunAsPPLmechanism. EDRSandBlastimplements the self protection as follow:

* open a handle to the current process
* leak all system handles using NtQuerySystemInformationto find the opened handle on the current process, and the address of the current process' EPROCESSstructure in kernel memory.
* use the arbitrary read / write vulnerability of the Micro-Star MSI Afterburnerdriver to overwrite the _PS_PROTECTIONfield of the current process in kernel memory. The offsets of the _PS_PROTECTIONfield relative to the EPROCESSstructure (defined by the ntoskrnlversion in use) are hardcoded in the NtoskrnlOffsets.csvfile. Credential Guard bypassMicrosoft Credential Guardis a virtualization-based isolation technology, introduced in Microsoft's Windows 10 (Enterprise edition)which prevents direct access to the credentials stored in the LSASSprocess.

When Credentials Guardis activated, an LSAIso(LSA Isolated) process is created in Virtual Secure Mode, a feature that leverages the virtualization extensions of the CPU to provide added security of data in memory. Access to the LSAIsoprocess are restricted even for an access with the NT AUTHORITY\SYSTEMsecurity context. When processing a hash, the LSAprocess perform a RPCcall to the LSAIsoprocess, and waits for the LSAIsoresult to continue. Thus, the LSASSprocess won't contain any secrets and in place will store LSA Isolated Data.

As stated in original research conducted by N4kedTurtle: "Wdigest can be enabled on a system with Credential Guard by patching the values of g_fParameter_useLogonCredentialand g_IsCredGuardEnabledin memory". The activation of Wdigestwill result in cleartext credentials being stored in LSASSmemory for any new interactive logons (without requiring a reboot of the system). Refer to the original research blog post for more details on this technique. EDRSandBlastsimply make the original PoC a little more opsec friendly and provide support for a number of wdigest.dllversions (through hardcoded offsets for g_fParameter_useLogonCredentialand g_IsCredGuardEnabled). ntoskrnl and wdigest offsetsThe required ntoskrnl.exeand wdigest.dlloffsets (mentioned above) are extracted using r2pipe, as implemented in the ExtractOffsets.pyPythonscript. In order to support more Windows versions, the ntoskrnl.exeand wdigest.dllreferenced by Winbindex can be automatically downloaded (and their offsets extracted). This allows to extract offsets from nearly all files that were ever publ[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections

___________________________
@hacking_Attack
@Hacking_Video

Hello... I have been given a wordpress website powerd by bitnami in my final exam. I got credentuals logged in, but couldn't make a shell....
https://www.reddit.com/r/Pentesting/comments/u4zpbq/hello_i_have_been_given_a_wordpress_website/

submitted by /u/ssaanaaaa (https://www.reddit.com/user/ssaanaaaa)
[link] (https://www.reddit.com/r/Pentesting/comments/u4zpbq/hello_i_have_been_given_a_wordpress_website/) [comments] (https://www.reddit.com/r/Pentesting/comments/u4zpbq/hello_i_have_been_given_a_wordpress_website/)

___________________________
@hacking_Attack
@Hacking_Video

How I Hacked My School’s Students Portal to get access to any student’s details?

IntroductionContinue reading on Medium »
Read more...

Pandora Swap is launching a Bug Bounty Program

Hi, Pandora Legion! We are very impressed and mesmerized by your love, support, and interactions. and we have a new announcement to makeContinue reading on Medium »
Read more...

How I Hacked My School’s Students Portal to get access to any student’s details?
https://abhayvis.medium.com/how-i-hacked-my-schools-students-portal-to-get-access-to-any-student-s-details-d58f10cfe596?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video