t of view), to effectively use the original instructions the EDR has probably allocated itself a trampoline somewhere to execute the original function after having intercepted the call.

This trampoline can be searched for and used as a replacement for the hooked function, without the need to allocate executable memory, or call any API except VirtualQuery, which is most likely not monitored being an innocuous function.

To find the trampoline in memory, we browse the whole address space using VirtualQuerylooking for commited and executable memory. For each such region of memory, we scan it to look for a jump instruction that targets the address following the overwritten instructions (NtProtectVirtualMemory+8 in our previous example). The trampoline can then be used to call the hooked function without triggering the hook.

This technique works surprisingly well as it recovers nearly all trampolines on tested EDR. For implementation details, check the unhook()function's code path when unhook_methodis UNHOOK_WITH_EDR_NTPROTECTVIRTUALMEMORY_TRAMPOLINE. Hook bypass using duplicate DLLAnother simple method to get access to an unmonitored version of NtProtectVirtualMemoryfunction is to load a duplicate version of the ntdll.dlllibrary into the process address space. Since two identical DLLs can be loaded in the same process, provided they have different names, we can simply copy the legitimate ntdll.dllfile into another location, load it using LoadLibrary(or reimplement the loading process), and access the function using GetProcAddressfor example.

This technique is very simple to understand and implement, and have a decent chance of success, since most of EDR products does not re-install hooks on newly loaded DLLs once the process is running. However, the major drawback is that copying Microsoft signed binaries under a different name is often considered as suspicious by EDR products as itself.

This technique is nevertheless implemented in EDRSandblast. For implementation details, check the unhook()function's code path when unhook_methodis UNHOOK_WITH_DUPLICATE_NTPROTECTVIRTUALMEMORY. Hook bypass using direct syscallsIn order to use system calls related functions, one program can reimplement syscalls (in assembly) in order to call the corresponding OS features without actually touching the code in ntdll.dll, which might be monitored by the EDR. This completely bypasses any userland hooking done on syscall functions in ntdll.dll.

This nevertheless has some drawbacks. First, this implies being able to know the list of syscall numbers of functions the program needs, which changes for each version of Windows. Also, functions that are not technically syscalls (e.g. LoadLibraryX/LdrLoadDLL) could be monitored as well, and cannot simply be reimplemented using a syscall.

This technique is implemented in EDRSandblast. As previously stated, it is only used to execute NtProtectVirtualMemorysafely, and remove all detected hooks. However, in order not to rely on hardcoded offsets, a small heuristic is implemented to search for mov eax, imm32instruction at the start of the NtProtectVirtualMemoryfunction and recover the syscall number from it if found (otherwise relying on hardcoded offset for known Windows versions).

For implementation details, check the unhook()function's code path when unhook_methodis UNHOOK_WITH_DIRECT_SYSCALL. RunAsPPL bypassThe Local Security Authority (LSA) Protectionmechanism, first introduced in Windows 8.1 and Windows Server 2012 R2, leverage the Protected Process Light (PPL)technology to restrict access to the LSASSprocess. The PPLp[...]

___________________________
@hacking_Attack
@Hacking_Video

rotection regulates and restricts operations, such as memory injection or memory dumping of protected processes, even from a process holding the SeDebugPrivilegeprivilege. Under the process protection model, only processes running with higher protection levels can perform operations on protected processes.

The _EPROCESSstructure, used by the Windows kernel to represent a process in kernel memory, includes a _PS_PROTECTIONfield defining the protection level of a process through its Type(_PS_PROTECTED_TYPE) and Signer(_PS_PROTECTED_SIGNER) attributes.

By writing in kernel memory, the EDRSandblast process is able to upgrade its own protection level to PsProtectedSignerWinTcb-Light. This level is sufficient to dump the LSASSprocess memory, since it "dominates" to PsProtectedSignerLsa-Light, the protection level of the LSASSprocess running with the RunAsPPLmechanism. EDRSandBlastimplements the self protection as follow:

* open a handle to the current process
* leak all system handles using NtQuerySystemInformationto find the opened handle on the current process, and the address of the current process' EPROCESSstructure in kernel memory.
* use the arbitrary read / write vulnerability of the Micro-Star MSI Afterburnerdriver to overwrite the _PS_PROTECTIONfield of the current process in kernel memory. The offsets of the _PS_PROTECTIONfield relative to the EPROCESSstructure (defined by the ntoskrnlversion in use) are hardcoded in the NtoskrnlOffsets.csvfile. Credential Guard bypassMicrosoft Credential Guardis a virtualization-based isolation technology, introduced in Microsoft's Windows 10 (Enterprise edition)which prevents direct access to the credentials stored in the LSASSprocess.

When Credentials Guardis activated, an LSAIso(LSA Isolated) process is created in Virtual Secure Mode, a feature that leverages the virtualization extensions of the CPU to provide added security of data in memory. Access to the LSAIsoprocess are restricted even for an access with the NT AUTHORITY\SYSTEMsecurity context. When processing a hash, the LSAprocess perform a RPCcall to the LSAIsoprocess, and waits for the LSAIsoresult to continue. Thus, the LSASSprocess won't contain any secrets and in place will store LSA Isolated Data.

As stated in original research conducted by N4kedTurtle: "Wdigest can be enabled on a system with Credential Guard by patching the values of g_fParameter_useLogonCredentialand g_IsCredGuardEnabledin memory". The activation of Wdigestwill result in cleartext credentials being stored in LSASSmemory for any new interactive logons (without requiring a reboot of the system). Refer to the original research blog post for more details on this technique. EDRSandBlastsimply make the original PoC a little more opsec friendly and provide support for a number of wdigest.dllversions (through hardcoded offsets for g_fParameter_useLogonCredentialand g_IsCredGuardEnabled). ntoskrnl and wdigest offsetsThe required ntoskrnl.exeand wdigest.dlloffsets (mentioned above) are extracted using r2pipe, as implemented in the ExtractOffsets.pyPythonscript. In order to support more Windows versions, the ntoskrnl.exeand wdigest.dllreferenced by Winbindex can be automatically downloaded (and their offsets extracted). This allows to extract offsets from nearly all files that were ever publ[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
EDRSandblast - Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protections

___________________________
@hacking_Attack
@Hacking_Video

Hello... I have been given a wordpress website powerd by bitnami in my final exam. I got credentuals logged in, but couldn't make a shell....
https://www.reddit.com/r/Pentesting/comments/u4zpbq/hello_i_have_been_given_a_wordpress_website/

submitted by /u/ssaanaaaa (https://www.reddit.com/user/ssaanaaaa)
[link] (https://www.reddit.com/r/Pentesting/comments/u4zpbq/hello_i_have_been_given_a_wordpress_website/) [comments] (https://www.reddit.com/r/Pentesting/comments/u4zpbq/hello_i_have_been_given_a_wordpress_website/)

___________________________
@hacking_Attack
@Hacking_Video

How I Hacked My School’s Students Portal to get access to any student’s details?

IntroductionContinue reading on Medium »
Read more...

Pandora Swap is launching a Bug Bounty Program

Hi, Pandora Legion! We are very impressed and mesmerized by your love, support, and interactions. and we have a new announcement to makeContinue reading on Medium »
Read more...

How I Hacked My School’s Students Portal to get access to any student’s details?
https://abhayvis.medium.com/how-i-hacked-my-schools-students-portal-to-get-access-to-any-student-s-details-d58f10cfe596?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

IntroductionContinue reading on Medium » (https://abhayvis.medium.com/how-i-hacked-my-schools-students-portal-to-get-access-to-any-student-s-details-d58f10cfe596?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pandora Swap is launching a Bug Bounty Program
https://pandoraswap.medium.com/pandora-swap-is-launching-a-bug-bounty-program-8fcf433dfe52?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi, Pandora Legion! We are very impressed and mesmerized by your love, support, and interactions. and we have a new announcement to makeContinue reading on Medium » (https://pandoraswap.medium.com/pandora-swap-is-launching-a-bug-bounty-program-8fcf433dfe52?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is an ethernet connection required for mitm attacks?

I tried sniffing traffic through wifi and mitm a few months ago but was never able to sniff anything beyond basic traffic. Is an ethernet connection required for getting http requests and the like?

submitted by /u/unknovvn_wolfkiller
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Similar style to the wifi pinaple

Hello all, do any of you guys know any of or software perhaps that can be used as an os for an rpi4 to mimic the feel of a wifi pineapple? Id love to have a os on my rpi that is basically a wifi pineapple so that i could just simply turn on my rasberry pi and access it through another web interface on a different device. Maybe you guys know like a software for kali that does this job well (ideally with a GUI/Web interface for conveniece). Basically anything that is like the wifi pinaple. Thanks in advancefor any suggestions.

submitted by /u/danielsuperone
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/zJMh-2z8cVWTu0yIM29ZmsDLQflkiLCpaTO4GWjZbUI.jpg submitted by /u/Turkishmemer07
[link] [comments]

hacking: security in practice
Changing Account Info Illegal?

So to make a VERY LONG story short I was given the password to an account that manages internet service that is not my own, think the portal for paying your bill, etc. Well this particular internet service provider allowed you to manage your router in this portal, so I paused a devices WiFi, changed all the login, and contact info, and then logged out. Next day the owner of the account notices WiFi isn't working on a device so they call the ISP, they tell them how all the information was changed etc.

Is what I did technically illegal if I was GIVEN the password to this account a while back and I didn't use any exploits or hacks to gain access or change the info? Just the GUI of the website really lol.

Thank you in advance.

submitted by /u/Fury3879
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Earn Thousands per Hour Hacking Smart Contracts

https://external-preview.redd.it/3fc8jQ-uJ2BGqtT7OeW5n1Vh27ucxj3EIJM8pIhUHdA.jpg?width=640&crop=smart&auto=webp&s=d2330f9008b5cea9970028bd80dbf56f8afd0288 submitted by /u/binaryfor
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Canary Tokens

Hey I recently created a custom version of the canary tokens from canarytokens.org which is using the flask restful api library.

I know about 'request.environ' to get the basic data from a users request including IP etc., but is anyone aware of how to implement other calls to get more specific data from users requests?

The tool will be free when complete and I'll follow up with the link to deployed site where you can register and create your own tracking tokens (for educational purposes.....)

submitted by /u/Snoshberry
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
GambiConf — Why do we need a new tech event?

https://cdn-images-1.medium.com/max/2600/1*8xK_M1trnkKLP8aHxsL0-w.png
It's the event fitting a specific unmet demand in tech confs: It features projects and ideas that are definitely outside the box

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Detecting and Preventing DLL Hijacking

https://cdn-images-1.medium.com/max/1600/0*3FKIIXvEKUiweXZn
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video