Hacking on Medium
Bounty Hacker Walkthrough — Try Hack Me

https://cdn-images-1.medium.com/max/1200/1*1mtQwkgfzGNK8xB5RxWY5A.jpeg
You were boasting on and on about your elite hacker skills in the bar and a few Bounty Hunters decided they'd take you up on claims! Prove…

Continue reading on System Weakness »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Proving Grounds Sirol walkthrough

https://cdn-images-1.medium.com/max/608/1*7jjzmp49VZ8HsE3Ud-wuDw.png
Hello, today i am going to walk you through Sirol, a hard rated proving grounds practice box.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Challenges.re Linux e24 Writeup — Discovering Undocumented Features with Ghidra

https://cdn-images-1.medium.com/max/649/1*ypwOWk_xkDtOsdks7fkTkw.png
This is the second post on my journey to learn software reverse engineering, the first is by no means required reading but I still wanted…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Enable Root Access In Kali Linux 2021–2022

https://cdn-images-1.medium.com/max/842/1*KJcaucZVR-j6zKYCMcWhLQ.png
By default the we cannot login to Kali Linux as root, but it is very easy to enable root login as we can see here.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to get admin password/rights while not having admin privileges

I am on a school computer managed by the school, who have admin rights. I know the admin domain name is 'admin' but I don't the password. I've tried net user admin password but access is denied. If anyone knows how to get admin rights or get the password on a non-admin account, tell me please.

submitted by /u/GenZBoiii
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Which one I should choose?

Hey everyone. I'm trying to built a career but my time is limited because of my education and my business life. So I need an advice. I have Practical Ethical Hacking, Windows Privilege Escalation, Linux Privilege Escalation and Open-Source Intelligence Fundamentals courses from TCM academy. Also I can purchase TryHackMe and I can try to finish all educational contents. Which way is best? Thanks in advance.

submitted by /u/centuriof
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to make zphisher or SEToolkit to use a domain so I don't get a random cloudflare url?

I'm trying to make Zphisher use my domain that I own on cloudflare when it generates the link so it looks "legit" as opposed to a long string of words. How would I go about doing this?

submitted by /u/FaDe_Flamez
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Chlonium - Chromium Cookie Import / Export Tool

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEitH1-xU-Dw_THRp--0NLkhN4KN3bTcfK0_37SI5lAvNLvbstP6__q1_nNMxDWkLMq31r5tQknw5Hh0lwh753IqmgzhWSg8gMOyaFwNXxRPEEteWjYXKDTmOcT_GefCgLfUbrfeDuhk30Kef_dPA85h6-l9qZmfgsWs196dkIfa70Yh7UAB5JMbdDhh/w640-h426/Chromium%20Cookies.jpg Chlonium is an application designed for cloning Chromium Cookies.

From Chromium 80 and upwards, cookies are encrypted using AES-256 GCM, with a state key which is stored in the Local State file. This state key is encrypted using DPAPI. This is a change from older versions, which used DPAPI to encrypt each cookie item in the cookie database. What this means is that if you have the state key, you will always be able to decrypt the cookie database offline, without needing continual access to DPAPI keys.

This essentially makes cookie databases "portable", meaning they can be moved from machine to machine, provided you have dumped the state key. The cookies themselves need to be re-encrypted when they are imported, because the state keys will differ on each user profile & machine. This can be done using the same process as decryption, by first decrypting the state key from the "target" browser, and then re-encrypting each item with the new key.

The project is written in C# and has two separate components to it. The first component, chlonium.exeis the collector binary. It simply decrypts the state key and prints it. Keep a note of this key and you can decrypt cookies in the future by downloading the Cookiesdatabase file whenever you need updated cookies. By default it will attempt to decrypt the Chrome state key. If you want to dump the state key for another browser (e.g. Edge), you can specify a path to the key.

For example: > Chlonium.exe "c:\users\user\AppData\Local\Microsoft\Edge\User Data\Local State" [+] Statekey = 3Cms3YxFXVyJRUbulYCnxqY2dO/jubDkYBQBoYIvqfc= The second component, ChloniumUI.exeis the "importer" tool. This takes care of decrypting a given Cookies database file with a given state key, re-encrypting the values with the current users state key, and importing the cookies into your chosen browser. You run this on the machine you want to import the cookies into.

To use it, run the ChloniumUI.exeexecutable. Enter the previously extracted state key, choose the Cookiesfile you wish to import, and select the browser you wish the import the cookies into. Now click "Import Cookies" and the cookies will be imported. ChloniumUIcurrently supports three Chromium based browsers: Edge, Chrome and Vivaldi. Additional browsers can be added in Browsers.cs. This adds the unintended benefit of being able to import an Edge cookie file into Chrome, or vice versa (for example), though it's probably not a good idea given that the user-agent will mismatch.

Important Note: When importing the cookie file into your browser, all old cookies are cleared! A backup is copied to the current directory (with relevant time stamp). If you need to restore the previous cookies, simply copy the backup file over the Cookiesfile. WhyTools such as Mimikatz and SharpChromium already have the capability to dump Chrome 80 cookies, why another tool?

This tool is specifically aimed at making it easier to import cookies into another browser. Whilst these tools do a great job of dumping Chromium cookies (and more!), I wanted to have something that let me easily import into another browser. Third-party cookie manager plugins exist, but I've always found these fiddly and prone to failure. CloniumUIis designed to make this process easier by importing the cookies directly into your browser's sqlite database.

Whilst this project comes with the chlonium.execollector, which aids in dumping the state k[...]

___________________________
@hacking_Attack
@Hacking_Video

ey, this is really only an example. Other tools such as Mimikatz will also dump the state key for you, in a potentially stealthier way (depending on your operating environment, execution method etc.). Additionally, SharpDPAPI will allow you to decrypt the Chromium state key file if you have DPAPI state keys, current password, or domain backup key - allowing you to dump cookies remotely over SMB!

When carrying out Red Teaming, I sometimes need to dump a user's cookies multiple times over a sustained period (e.g. daily/weekly). Using a .NET assembly, Reflective DLL or other in-memory execution technique to extract individual cookies from the cookie file directly on the target system is unneccesary and exposes the operator to increased risk of detection. Instead you can simply dump the state key once, and copy the Cookiesdatabase file off whenever you need fresh cookies, without requiring additional execution. DemoSee here for a video demo. Password Import/ExportChloniumUIalso supports password import and export. To use this feature, simply supply the Login Datadatabase path instead of the Cookiesdb, along with the state key, and select the browser you wish to import them into (for export this doesn't matter). This allows you to either export passwords in plaintext to a file, or import them into your browser. As with cookies, you can import Chrome passwords into Edge, Edge passwords into Vivaldi etc. Offline Statekey DecryptionChlonium supports offline state key decryption whereby you can decrypt the users statekey offline if you have all of the following files:

* The Local State file from: C:\Users\* The DPAPI masterkey files from: C:\Users\and one of the following:

* Domain backup key .pvk file (e.g. from NTDS.dit)
* Domain backup key in base64 (e.g. from Mimikatz/SharpDPAPI LsaRetrievePrivateDataAPI method)
* The user's password

Now simply provide these values under the "Offline statekey decryption" tab, and Chlonium will attempt to decrypt the encrypted statekey by first decrypting the DPAPI masterkeys (using the backup key or password), and then using these keys to decrypt the statekey. Once the statekey is decrypted, this can be used in the "Import or Export Database" tab to retrieve cookies/passwords.

Usage Note: When using the user's password to decrypt the DPAPI masterkey, Chlonium will first attempt to extract the user's SID from the BK-file from within the DPAPI masterkey folder. If this fails (or if the file does not exist), it will try to get the SID from the DPAPI masterkey folder name instead (which by default will be named after the user's SID). If you have renamed the folder, or do not have a copy of the BK file, you will not be able to decrypt the masterkey using a password.

This feature makes use of the excellent SharpChrome and SharpDPAPI projects by @harmj0y. Full credit goes to the original authors of SharpDPAPI. DetectionSet a SACL on the Chrome Local Stateand Cookiesfiles (as well as other sensitive files such as Login Dataand History). Look for suspicious (e.g. non browser related) processes opening any of these files.

Take a look at this great blog post from @cryps1s about setting up SACLs for detection.

For AV vendors that use a file system filter driver, consider blocking non browser-related processes from opening these files. e.g. PowerShell opening the Cookiesfile. References* https://github.com/gentilkiwi/mimikatz/wiki/module-~-dpapi
* https://github.com/djhohnstein/SharpChromium
* https://github.com/GhostPack/SharpDPAPI
* https://www.harmj0y.net/blog/redteaming/operational-guidance-for-offensive-user-dpapi-abuse/
* https://medium.com/@cryps1s/detecting-windows-endpoint-compromise-with-sacls-c[...]

___________________________
@hacking_Attack
@Hacking_Video

d748e10950 Download Chlonium

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Ostorlab : A Security Scanning Platform That Enables Running Complex Security Scanning Tasks

Ostorlab is a Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing it to another tool. Several tools have tried to make the process less painful. Ostorlab addresses the same challenge by simplifying the hardest part and automating the boring and tedious part.

To do that, Ostorlab focuses on the following:

* Ease of use with simple one command-line to perform all tasks
* Developer Experience through project documentation, tutorials, SDK and templates
* Scalability and Performance by using efficient serialisation format and proven industry standard for all of its components

To do that, Ostorlab ships with:

* A simple, yet powerful SDK to make simple cases effortless while supporting the complex one, like distributed locking, QPS limiting, multiple instance parallelization …
* A battle-tested framework that has been powering Ostorlab Platform for years and used to perform complex dynamic analysis setup and demanding static analysis workloads running on multiple machines.
* Performant and scalable design, thanks to the use of message queue with dynamic routing, binary and compact message serialisation with protobuf, universal file format using docker image and resilient deployment thanks to docker swarm.
* A store of agents that makes it easy to use and discover tools to add your toolset.
* An automated builder to take the hassle away of building and publishing.
* A GUI to prepare and write down your tool collection setup.
* Focus on documentation, multiple tutorials and upcoming videos and conference presentations.
* A ready to use one-click template repo to get started.

Requirements

For some tasks, like running scans locally, Docker is required. To install docker, please see the following instructions.

Installing

Ostorlab is shipped as a Python package on Pypi. To install, simply run the following command if you have pipalready installed.

pip install -U ostorlab

Getting Started

To perform your first scan, simply run the following command:

ostorlab scan run –install –agent agent/ostorlab/nmap –agent agent/ostorlab/openvas –agent agent/ostorlab/tsunami –agent agent/ostorlab/nuclei ip 8.8.8.8

This command will download and install the following scanning agents:

* agent/ostorlab/nmap
* agent/ostorlab/tsunami
* agent/ostorlab/nuclei
* agent/ostorlab/openvas

And will scan the target IP address 8.8.8.8

To check the scan status:

ostorlab scan list

Once the scan has completed, to access the scan results:

ostorlab vulnz list –scan-id
ostorlab vulnz describe –vuln-id

The Store

Ostorlab lists all agents on a public store where you can search and also publish your own agents.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1se-Ah34nAUYH9MEwDZ2A_GM-j4fq6YPm_m8a5AFC0h3xYBs6LijkgoHqktyZIipX-E_jvoEq_9h2c4yz7-Xfo1g9cSu5JKqgswv_RNK8Psf1fojpfuVb6a80L2ckI2Ht3f2DijW55KoOYDplCnez0qiQUMjZ0UHSs-Rr68jlqxYotIdKMWI-BqYW/s1719/store2.gif

Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Nimcrypt2 : .NET, PE, And Raw Shellcode Packer/Loader Written In Nim

Nimcrypt2 is yet another PE packer/loader designed to bypass AV/EDR. It is an improvement on my original Nimcrypt project, with the main improvements being the use of direct syscalls and the ability to load regular PE files as well as raw shellcode.

Before going any further, I must acknowledge those who did the VAST majority of work and research that this project depends on. Firstly, I must thank @byt3bl33d3r for his Offensive Nim repo, and @ShitSecure for all of the code snippets he’s publicly released. That is what the original version of this tool was created from, and the current version is no different. Particularly, the new PE loading functionality used in this tool is just an implementation of ShitSecure’s recently released Nim-RunPE code. As of 3/14/22, this code also uses his GetSyscallStub code for dynamic syscall usage. I highly encourage sponsoring him for access to his own Nim PE Packer, which is no doubt a much better and more featureful version of this.

Additionally, I would like to thank @ajpc500 for his NimlineWhispers2 project that this tool uses for direct syscalls. I cannot stress enough how this project is simply an amalgamation of the public work of those previously mentioned, so all credit must go to them.

Nimcrypt v 2.0
Usage:
nimcrypt -f file_to_load -t csharp/raw/pe [-o ] [-p ] [-n] [-u] [-s] [-e] [-g] [-l] [-v]
nimcrypt (-h | –help)
Options:
-h –help Show this screen.
–version Show version.
-f –file filename File to load
-t –type filetype Type of file (csharp, raw, or pe)
-p –process process Name of process for shellcode injection
-o –output filename Filename for compiled exe
-u –unhook Unhook ntdll.dll
-v –verbose Enable verbose messages during execution
-e –encrypt-strings Encrypt strings using the strenc module
-g –get-syscallstub Use GetSyscallStub instead of NimlineWhispers2
-l –llvm-obfuscator Use Obfuscator-LLVM to compile binary
-n –no-randomization Disable syscall name randomization
-s –no-sandbox Disable sandbox checks Features* NtQueueApcThread Shellcode Execution w/ PPID Spoofing & 3rd Party DLL Blocking
* NimlineWhispers2 & GetSyscallStub for Syscall Use
* Syscall Name Randomization
* Ability to load .NET and Regular PE Files
* AES Encryption with Dynamic Key Generation
* LLVM-Obfuscator Compatibility
* String Encryption
* Sandbox Evasion Tested and Confirmed Working on* Windows 11 (10.0.22000)
* Windows 10 21H2 (10.0.19044)
* Windows 10 21H1 (10.0.19043)
* Windows 10 20H2 (10.0.19042)
* Windows 10 19H2 (10.0.18363)
* Windows Server 2019 (10.0.17763) Installation/DependenciesNimcrypt2 is designed to be used on Linux systems with Nim installed. Before installing Nim, you must ensure that you have the following packages installed via your package manager:

sudo apt install gcc mingw-w64 xz-utils git

To install Nim, I prefer to use choosenim as follows:

curl https://nim-lang.org/choosenim/init.sh -sSf | sh
echo “export PATH=$HOME/.nimble/bin:$PATH” >> ~/.bashrc
export PATH=$HOME/.nimble/bin:$PATH

Nimcrypt2 also depends on a few packages that can be installed via Nimble. This can be done like so:

nimble install winim nimcrypto docopt ptr_math strenc

With all the dependencies now installed, Nimcrypt2 can be compiled like so:

nim c -d=release –cc:gcc –embedsrc=on –hints=on –app=console –cpu=amd64 –out=nimcrypt nimcrypt.nim

OPTIONAL: To use the Obfuscator-LLVM flag, you must have it installed on your system alongside wclang. I’ve found this to be a bit of a pain but you should be able to do it with a little perseverance. Here’s a quick step-by-step that worked on my Kali Linux system:

* Clone desired version of Obfuscator-LLVM and build it
* Once compiled, backup the existing version of clang and move the new Obfuscator-LLVM version of clang to /usr/bin/
* Install wclang and add it’s binaries to your P[...]

___________________________
@hacking_Attack
@Hacking_Video

ATH
* Backup existing clang library files, copy new newly built Obfuscator-LLVM library includes to /usr/lib/clang/OLD_VERSION/

In addition, you must add the following lines to your nim.cfgfile to point nim to your wclang binaries:

amd64.windows.clang.exe = “x86_64-w64-mingw32-clang”
amd64.windows.clang.linkerexe = “x86_64-w64-mingw32-clang”
amd64.windows.clang.cpp.exe = “x86_64-w64-mingw32-clang++”
amd64.windows.clang.cpp.linkerexe = “x86_64-w64-mingw32-clang++” amd64.windows.clang.cpp.linkerexe = "x86_64-w64-mingw32-clang++" There is probably a better way to do this but this is what worked for me. If you have issues, just keep trying and ensure that you can run x86_64-w64-mingw32-clang -vand it shows “Obfuscator-LLVM” in the output. Also ensure MinGW is using the Obfuscator-LLVM library files: Nim will give you an error if not. Download

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ransom.Conti MVID-2022-0601 Code Execution

___________________________
@hacking_Attack
@Hacking_Video