hacking: security in practice
Anybody want some low profile hacking tech? (Hardware)

If you want some high quality, low profile hacking tech like packet sniffers, key loggers, or general hacking usb (like the rubber ducky on Mr. Robot) start a chat with me and I’ll give you a link to a website.
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Windows Exploitation Resources

https://github.com/FULLSHADE/WindowsExploitationResources

READ

submitted by /u/saqfi
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Domain Escalation: Unconstrained Delegation

IntroductionPost-Windows 2000, Microsoft introduced an option where users could authenticate to one system via Kerberos and work with another system. This was made possible via the delegation option. Unconstrained delegation is achieved via TGT forwarding technique which is what we’ll talk about in this article. Kerberos DelegationKerberos Delegation enables a service to impersonate a computer or user in order to engage with a second service using the user’s privileges and permissions.

The classic illustration of why delegating is necessary, for instance when a user authenticates to a web server using Kerberos or other protocols, and the server wishes to interact with a SQL backend or file server.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiT6dkXPLddG5IuKSagZR5txZ9p5bLDh32OrC3BxJJb_XiZCBEFRfPmvSA8dKfgAFqBzCztEpTUjjkJ3KH7MXd6MORZzXEqOBefk3gwqKjKioiB1vOA6dMsDEO5KgtRFo5IjLy24Ibus1hyhZXiBh5qaiJUhCOt7xlqhj4lhSHpfz7bq-NWB3OuFN1XGw/s16000/0.1.png

Type of Kerberos Delegation:

* Unconstrained delegation
* Constrained delegation
* RBCD (Resource-Based Constrained Delegation) Service Principal NameA unique name (identifier) of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have an account name. Unconstrained DelegationThe feature debuted initially in Windows Server 2000 but it is still there for backwards compatibility. Basically, if a user requests a service ticket for a service on a server set with unconstrained delegation, that server will extract the user’s TGT and cache it in its memory for later use. This means the server can pretend to be that user to any resource on the domain.

On a computer account, an admin can set the following property for unconstrained delegation.

* AD Users and Computers -> Computers -> Trust this computer for delegation to any service.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiXngS6FPbtTdwbHQ687LfOcd_uZABKNSedSHmsro5f3SgCVKyjgItHMwPAoP6HS-9E8_kycr7VmDrwh7FQ4ocyg-R5o46Lncuo3-cLi_J4URGZ5aklxjW8v6Zz2o5pRAI5SGptpRRD0wiqQe2cweaI1-fNhF9XUoKrjAZri2nnOdd9_sCwOT75_pvSWA/s16000/0.png

Key features of the unconstrained delegation are:

* Usually, the privilege is given to computers running services like IIS, and MSSQL because these computers usually require some back-end connectivity to other resources.
* When given Delegation rights, these computers ask for a user’s TGT and store them in their cached memory.
* With this TGT, they can access back-end resources on behalf of the authenticated user.
* Catch is that these systems can also request access to any resource on the domain using this TGT!
* https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqFAGuNirtaPHgWk_LvIt9f-qm8EJwKOdqfzL_wzG-Qr_5En7FzemiCuQBNGXfWxOJ1Zse_1A2zduOZLsMb2NJrDINCVtSPmGfosm0icublTCa4ZJmngjYJzIOcu5txGUQl8Eo62XbMGlBlobsRR9gRUO9Un3Ih1YQVOeJoBHva3GDI6Bf3JQhn02UMg/s16000/0.2.png

An attacker may Abuse Unconstrained Delegation by requesting TGS for any domain services (SPN) using user delegated TGT.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiiE4Wvh2cFkn0IbfCy2Gz9rPLB03qMnHJAW6q3pJ10ccC7Pu3TUvAT6JxiNfRCKMDcJUVJu_TDh2D2kHD00POOd28EGW9xaKPvxmm6SvKxyCqoWHQ7pIJvkKr0VnlRb8R6kkMB2Nsp93__hiCLnH-P-s1bRIVUEaTGsk4fJOQp5X0Ka3mEpHNTnt4qNA/s16000/0.3.png TGT extraction via Unconstrained DelegationIt is obvious that we need to run our attack on the machine that has delegation enabled. So we are assuming the attacker has compromised one such machine. Assumption 1: Attacker compromised DC1$ system running IIS on Kerberos authentication.

* Assumption 2: Attacker has access to a domain-joined system (Here, powershell window running on that s[...]

___________________________
@hacking_Attack
@Hacking_Video

ystem)
* User: Administrator
Now, in real-life scenario, you might not have direct access to the DC system for simplicity we have installed IIS on DC and using that only so that you get the gist.

Moving on with our extraction, we need to learn the systems that have unconstrained delegation enabled. This can be done by using PowerShell and AD module.
Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties trustedfordelegation,serviceprincipalname,description
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVnK7rS34mzNVUEiA9a8iFu-AWGIa1769BQ5rhHzo4SP7EbvihjQp8w8dUSECl3vxQYp3YZxsWhPRRj9yQnycufs-Oz0puzoYimptCyRR-tvb4yd2v2vdA4vyK4GEZOTf5BNPMidKow9FWbIIoVooMsbXuYDHAr_psusYrohNuoHGHfzlimbxJvJXKBQ/s16000/1.png

The same can also be achieved by using the powerview script which is part of the PowerSploit framework created for offensive security using PowerShell. You can find it here.

Once an AD system is compromised, you can install and use powerview.
Import-Module .\powerview.ps1
Get-NetComputer -Unconstrained
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6OQ9WL5m9pj7MTD6OV-I3k1JRSPYRi_oNLBHHBTbDLlKs20gkF7ucGDcc2e_P6FlLq1wOxv15MgqpAhkFV5xxV-N0G749iWdV3Tr1Bj77-xfFSUqrb8MKnvOOgO5-4SaLmdAOqmRIHkfeVue6F4_0WKwn1qBFAOaCd-30xxHDJO13r3VepawQDneUAA/s16000/2.png

Now, on the target system we need to run Rubeus in monitor mode on the dc1 system. After that, whenever a user connects/authenticates to dc1$ Rubeus will dump TGT of the user.
rubeus.exe monitor /monitorinterval:10 /targetuser:dc1$ /nowrap
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiI9fqrYrtznEJtRXkIbdKMbwUatKKh_PeDTxcSpTgotlMeT4oj6ytWQOXV8nxKW9oJLHKNiEEnJML5en_gSdXMREzbULMa19Tz48ZUsq-dalm7uBdDWTX3tGG3iK7OL33qWxnKhcij6u9kUfFtZP6kPRQkrpY5bT6IPk-1UsnY6RtlE-O0C9f62i2AXg/s16000/3.png

Now, let’s wait for genuine users to connect to dc1$ running IIS service. For simplicity, let’s do that manually using the IWR module.
Invoke-WebRequest http://dc1.offense.local -UseDefaultCredentials -UseBasicParsing
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp_YUQfI-8qvUbBWr9ife7GS2VzpcXEi97j6Xci64URJ1-nugreRG3ljY8DRP8kwxlCIYfdGz_CEuETmTQL6zqRHRH1LmvI8LpOz-o5gIADMM3VbC3DRD0Pzu6K0tTpgxApaPS_ZV2dsdnI0QoHgB7Oxesv9eMwLdttMpvhLqThgdY072ubnIcITj0Mg/s16000/4.png

As you can see, Rubeus has now captured a new ticket granting ticket (TGT) from the user IGNITE\Administrator.

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj-nDccubWmWTErFBCqYxzNhZTWpDkhP-iTwG4ntW-SaJhyG9nmBcNOsMqk2wpD_YZZWqs3C-I10whKM6wgcqnyUAAxrwpT9HeMFbOP8UNr2NZmMSzxMQwO6AvC6D3KMaG5zHwAuYTJneVJcHmTVi_uuKzrYOZI02k0cNY-gj184-CfG6pAp4aTyMdu7w/s16000/5.png

Now, you can use this TGT to request access to any resource by requesting a TGS to that resource. You can use Rubeus asktgs for that purpose. Follow the detailed Rubeus guide here for more. ConclusionThe article demonstrated a delegation technique called Unconstrained Delegation because as the name suggests, there are no restrictions upon how the system that has delegation rights use a user’s authentication information. The security loopholes made Microsoft introduce Constrained Delegation. You’ll read more about that in the next article. Hope you liked the article. Thanks for reading.

References: https://www.harmj0y.net/blog/activedirectory/

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Domain Escalation: Unconstrained Delegation appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

BinAbsInspector - Vulnerability Scanner For Binaries
http://www.kitploit.com/2022/05/binabsinspector-vulnerability-scanner.html

___________________________
@hacking_Attack
@Hacking_Video

BinAbsInspector (Binary Abstract Inspector) is a static analyzer (https://www.kitploit.com/search/label/Static%20Analyzer) for automated reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) and scanning vulnerabilities in binaries, which is a long-term research project (https://www.kitploit.com/search/label/Research%20Project) incubated at Keenlab (https://keenlab.tencent.com/). It is based on abstract interpretation (https://www.kitploit.com/search/label/Abstract%20Interpretation) with the support from Ghidra. It works on Ghidra's Pcode instead of assembly. Currently it supports binaries on x86,x64, armv7 and aarch64.
Installation Install Ghidra according to Ghidra's documentation (https://github.com/NationalSecurityAgency/ghidra#install) Install Z3 (https://github.com/Z3Prover/z3) (tested version: 4.8.15) Note that generally there are two parts for Z3 library: one is Java package, the other one is native library. The Java package is already included in "/lib" directory, but we suggest that you replace it with your own Java package for version compatibility. For Windows, download a pre-built package from here (https://github.com/Z3Prover/z3/releases), extract the zip file and add a PATH environment variable pointing to z3-${version}-win/bin For Linux, install with package manager is NOT recommended, there are two options: You can download suitable pre-build package from here (https://github.com/Z3Prover/z3/releases), extract the zip file and copy z3-${version}-win/bin/*.so to /usr/local/lib/ or you can build and install z3 according to Building Z3 using make and GCC/Clang (https://github.com/Z3Prover/z3#building-z3-using-make-and-gccclang) For MacOS, it is similar to Linux. Download the extension zip file from release page (https://github.com/KeenSecurityLab/BinAbsInspector/releases) Install the extension according to Ghidra Extension Notes (https://ghidra-sre.org/InstallationGuide.html#GhidraExtensionNotes) Building Build the extension by yourself, if you want to develop a new feature, please refer to development guide (https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Developer-Guide). Install Ghidra and Z3 Install Gradle 7.x (https://gradle.org/releases/) (tested version: 7.4) Pull the repository Run gradle buildExtension under repository root The extension will be generated at dist/${GhidraVersion}_${date}_BinAbsInspector.zip Usage You can run BinAbsInspector in headless mode, GUI mode, or with docker. With Ghidra headless mode. $GHIDRA_INSTALL_DIR/support/analyzeHeadless -import -postScript BinAbsInspector "@@"
-- Ghidra project path.
-- Ghidra project name.
-- The argument for our analyzer, provides following options: Parameter Description [-K ] KSet size limit K (https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details#kset) [-callStringK ] Call string maximum length K (https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details#context) [-Z3Timeout ] Z3 timeout [-timeout ] Analysis timeout [-entry ] Entry address [-externalMap ] External function model config [-json] Output in json format [-disableZ3] Disable Z3 [-all] Enable all checkers [-debug] Enable debugging log output [-check "[;...]"] Enable specific checkers With Ghidra GUI Run Ghidra and import the target binary into a project Analyze the binary with default settings When the analysis is done, open Window -> Script Manager and find BinAbsInspector.java Double-click on BinAbsInspector.java entry, set the parameters in configuration window and click OK When the analysis is done, you can see the CWE reports in console window, double-click the addresses from the report can jump to corresponding address With Docker " -import '>git clone git@github.com:KeenSecurityLab/BinAbsInspector.git
cd BinAbsInspector
docker build . -t bai

___________________________
@hacking_Attack
@Hacking_Video

docker run -v $(pwd):/data/workspace bai "@@" -import Implemented Checkers So far BinAbsInspector supports following checkers: CWE78 (https://cwe.mitre.org/data/definitions/78.html) (OS Command Injection) CWE119 (https://cwe.mitre.org/data/definitions/119.html) (Buffer Overflow (generic case)) CWE125 (https://cwe.mitre.org/data/definitions/125.html) (Buffer Overflow (Out-of-bounds Read)) CWE134 (https://cwe.mitre.org/data/definitions/134.html) (Use of Externally-Controlled Format string) CWE190 (https://cwe.mitre.org/data/definitions/190.html) (Integer overflow or wraparound) CWE367 (https://cwe.mitre.org/data/definitions/367.html) (Time-of-check Time-of-use (TOCTOU)) CWE415 (https://cwe.mitre.org/data/definitions/415.html) (Double free) CWE416 (https://cwe.mitre.org/data/definitions/416.html) (Use After Free) CWE426 (https://cwe.mitre.org/data/definitions/426.html) (Untrusted Search Path) CWE467 (https://cwe.mitre.org/data/definitions/467.html) (Use of sizeof() on a pointer type) CWE476 (https://cwe.mitre.org/data/definitions/476.htmll) (NULL Pointer Dereference) CWE676 (https://cwe.mitre.org/data/definitions/676.html) (Use of Potentially Dangerous Function) CWE787 (https://cwe.mitre.org/data/definitions/787.html) (Buffer Overflow (Out-of-bounds Write)) Project Structure The structure of this project is as follows, please refer to technical details (https://github.com/KeenSecurityLab/BinAbsInspector/wiki/Technical-Details) for more details. ├── main
│ ├── java
│ │ └── com
│ │ └── bai
│ │ ├── checkers checker implementatiom
│ │ ├── env
│ │ │ ├── funcs function modeling
│ │ │ │ ├── externalfuncs external function modeling
│ │ │ │ └── stdfuncs cpp std modeling
│ │ │ └── region memory modeling
│ │ ├── solver analyze core and grpah module
│ │ └── util utilities
│ └── resources
└── test
You can also build the javadoc with gradle javadoc, the API documentation will be generated in ./build/docs/javadoc. Acknowledgement We employ Ghidra (https://ghidra-sre.org/) as our foundation and frequently leverage JImmutable Collections (http://brianburton.github.io/java-immutable-collections/) for better performance.
Here we would like to thank them for their great help!

Download BinAbsInspector (https://github.com/KeenSecurityLab/BinAbsInspector)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What’s DDOS Attack?

https://cdn-images-1.medium.com/max/750/1*LjmRuOLY7skPyYoQvNFuKQ.png
If you want the clear understanding of distributed denial-of-service (DDoS) attack, let’s start with this short story, Essam is a very…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
BinAbsInspector - Vulnerability Scanner For Binaries

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi_Vf77SEegN9hd3L-1LH__qKHmso-Umr6OXBz1Nb9B5MkgKlSLbxOrUGBdoSyZ0DxJnhNC0ObMqASuMmr2Lb0qxzOLfgOyvcwU5YxB7r1VQ5DEYyU6vDgxZbP2o-15P5cWcD5wsKYWn997GoL9V9xfeFp8Bku8UVgxlk7Z9YryxtLu66XQKeCDV-S0/w640-h358/binary.png BinAbsInspector (Binary Abstract Inspector) is a static analyzer for automated reverse engineering and scanning vulnerabilities in binaries, which is a long-term research project incubated at Keenlab. It is based on abstract interpretation with the support from Ghidra. It works on Ghidra's Pcode instead of assembly. Currently it supports binaries on x86,x64, armv7 and aarch64. Installation* Install Ghidra according to Ghidra's documentation
* Install Z3 (tested version: 4.8.15)
* Note that generally there are two parts for Z3 library: one is Java package, the other one is native library. The Java package is already included in "/lib" directory, but we suggest that you replace it with your own Java package for version compatibility.
* For Windows, download a pre-built package from here, extract the zip file and add a PATH environment variable pointing to z3-${version}-win/bin* For Linux, install with package manager is NOT recommended, there are two options:
1. You can download suitable pre-build package from here, extract the zip file and copy z3-${version}-win/bin/*.soto /usr/local/lib/2. or you can build and install z3 according to Building Z3 using make and GCC/Clang

* For MacOS, it is similar to Linux.

* Download the extension zip file from release page
* Install the extension according to Ghidra Extension Notes BuildingBuild the extension by yourself, if you want to develop a new feature, please refer to development guide.

* Install Ghidra and Z3
* Install Gradle 7.x (tested version: 7.4)
* Pull the repository
* Run gradle buildExtensionunder repository root
* The extension will be generated at dist/${GhidraVersion}_${date}_BinAbsInspector.zipUsageYou can run BinAbsInspector in headless mode, GUI mode, or with docker.

* With Ghidra headless mode. $GHIDRA_INSTALL_DIR/support/analyzeHeadless -- Ghidra project path. -- Ghidra project name. -- The argument for our analyzer, provides following options:
Parameter Description [-K KSet size limit K [-callStringK Call string maximum length K [-Z3Timeout Z3 timeout [-timeout Analysis timeout [-entry
] Entry address [-externalMap External function model config [-json]Output in json format [-disableZ3]Disable Z3 [-all]Enable all checkers [-debug]Enable debugging log output [-check "Enable specific checkers
*
With Ghidra GUI

1. Run Ghidra and import the target binary into a project
2. Analyze the binary with default settings
3. When the analysis is done, open Window -> Script Managerand find BinAbsInspector.java4. Double-click on BinAbsInspector.javaentry, set the parameters in configuration window and click OK
5. When the analysis is done, you can see the CWE reports in console window, double-click the addresses from the report can jump to corresponding address

*
With Docker

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Domain Escalation: Unconstrained Delegation

IntroductionPost Windows 2000, Microsoft introduced an option where users could authenticate to one system via Kerberos and work with another system. This was made possible via delegation option. Unconstrained delegation is achieved via TGT forwarding technique which is what we’ll talk about in this article.Kerberos DelegationKerberos Delegation enables a service to impersonate a computer or user in order to engage with a second service using the user's privileges and permissions.Service Principal NameA unique name (identifier) of a service instance. SPNs are used by Kerberos authentication to associate a service instance with a service logon account. This allows a client application to request that the service authenticate an account even if the client does not have account name.Unconstrained DelegationThe feature debut initially in Windows Server 2000 but it is still there for backwards compatibility. Basically, if a user requests a service ticket for a service on a server set with unconstrained delegation, that server will extract user’s TGT and cache it in its memory for later use. Which means, server can pretend to be that user to any resource on the domain. Computers -> Trust this computer for delegation to any service.TGT extraction via Unconstrained DelegationIt is obvious that we need to run our attack on the machine that has delegation enabled. So we are assuming the attacker has compromised one such machine. Assumption 1: At[...]

___________________________
@hacking_Attack
@Hacking_Video

tacker compromised DC1$ system running IIS on Kerberos authentication.Get-ADComputer -Filter {TrustedForDelegation -eq $true} -Properties trustedfordelegation,serviceprincipalname,descriptionhttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhVnK7rS34mzNVUEiA9a8iFu-AWGIa1769BQ5rhHzo4SP7EbvihjQp8w8dUSECl3vxQYp3YZxsWhPRRj9yQnycufs-Oz0puzoYimptCyRR-tvb4yd2v2vdA4vyK4GEZOTf5BNPMidKow9FWbIIoVooMsbXuYDHAr_psusYrohNuoHGHfzlimbxJvJXKBQ/s16000/1.png The same can also be achieved by using the powerview script which is part of the PowerSploit framework created for offensive security using PowerShell. You can find it here.Import-Module .\powerview.ps1https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj6OQ9WL5m9pj7MTD6OV-I3k1JRSPYRi_oNLBHHBTbDLlKs20gkF7ucGDcc2e_P6FlLq1wOxv15MgqpAhkFV5xxV-N0G749iWdV3Tr1Bj77-xfFSUqrb8MKnvOOgO5-4SaLmdAOqmRIHkfeVue6F4_0WKwn1qBFAOaCd-30xxHDJO13r3VepawQDneUAA/s16000/2.png Now, on the target system we need to run Rubeus in monitor mode on the dc1 system. After that, whenever a user connects/authenticates to dc1$ Rubeus will dump TGT of the user.rubeus.exe monitor /monitorinterval:10 /targetuser:dc1$ /nowraphttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiI9fqrYrtznEJtRXkIbdKMbwUatKKh_PeDTxcSpTgotlMeT4oj6ytWQOXV8nxKW9oJLHKNiEEnJML5en_gSdXMREzbULMa19Tz48ZUsq-dalm7uBdDWTX3tGG3iK7OL33qWxnKhcij6u9kUfFtZP6kPRQkrpY5bT6IPk-1UsnY6RtlE-O0C9f62i2AXg/s16000/3.png Now, let’s wait for genuine users to connect to dc1$ running IIS service. For simplicity, let’s do that manually using the IWR module.Invoke-WebRequest http://dc1.offense.local -UseDefaultCredentials -UseBasicParsinghttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgp_YUQfI-8qvUbBWr9ife7GS2VzpcXEi97j6Xci64URJ1-nugreRG3ljY8DRP8kwxlCIYfdGz_CEuETmTQL6zqRHRH1LmvI8LpOz-o5gIADMM3VbC3DRD0Pzu6K0tTpgxApaPS_ZV2dsdnI0QoHgB7Oxesv9eMwLdttMpvhLqThgdY072ubnIcITj0Mg/s16000/4.png As you can see, Rubeus has now captured a new ticket granting ticket (TGT) from the user IGNITE\Administrator.ConclusionThe article demonstrated a delegation technique called Unconstrained Delegation because as the name suggests, there are no restrictions upon how the system that has delegation rights use a user’s authentication information. The security loopholes made Microsoft introduce Constrained Delegation. You’ll read more about that in the next article. Hope you liked the article. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
$ where backdoor -[heroctf 2022] by sudo_von

https://cdn-images-1.medium.com/max/1117/1*rcr80p5kkEzWXSr8erMiVg.png
Hello, in this challenge we need to find a backdoor so let’s inspect the website.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to stop an IP accessing your website

Hi all,

I wasn't sure where to post this, so if someone could direct me to a more appropriate sub that would be awesome.

Long story short I run a business and have a malicious stalker who is trying to ruin me. Is there a way I can block her IP address from accessing my website? I believe I have her mobile and home IP.

I know it will not stop her using someone else device but it's a start.

submitted by /u/youngmanmyra
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video