Black Hat Ethical Hacking
New Windows Subsystem for Linux malware steals browser auth cookies

New Windows Subsystem for Linux malware steals browser auth cookiesPost Views: 2
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Hackers are showing an increased interest in the Windows Subsystem for Linux (WSL) as an attack surface as they build new malware, the more advanced samples being suitable for espionage and downloading additional malicious modules.
As the name of the feature implies, WSL allows running native Linux binaries to run on Windows in an environment that emulates the Linux kernel.

WSL-based malware samples discovered recently rely on open-source code that routes communication through the Telegram messaging service and gives the threat actor remote access to the compromised system. RATs and shellsMalicious Linux binaries for WSL were first discovered over a year ago, with researchers at Lumen Technologies’ Black Lotus Labs publishing a report on this new type of threat in September 2021.

Since then, their number has grown constantly, with all variants enjoying low detection rates, despite being based on publicly available code.

Black Lotus Labs researchers told BleepingComputer this week that they have tracked more than 100 samples of WSL-based malware since last fall.

Some are more advanced than others, the researchers said, adding that threat actors “show continued interest” in the malware they are tracking.

Of the samples analyzed, two of them are more notable due to their capabilities to function as a remote access tool (RAT) or to establish a reverse shell on the infected host.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png The two samples were discovered after the Black Lotus Labs report in March that warned about WSL becoming a favored attack surface for adversaries of various technical skills levels.

One of the more recent samples relied on a Python-based open-source tool called RAT-via-Telegram Bot that allows control over Telegram and comes with functions for stealing authentication cookies from Google Chrome and Opera web browsers, running commands, or downloading files.

Black Lotus Labs researchers told BleepingComputer that the malware came with a live bot token and chat ID, indicating an active command and control mechanism.
https://www.bleepstatic.com/images/news/u/1100723/2022/WSL_new_sample.png
<figcaptionsource: Lumen Technologies Black Lotus Labs
Additional functions in this variant include taking screenshots and grabbing user and system information (username, IP address, OS version), which helps the attacker determine what malware or utilities they can use in the next phase of the compromise.

When Black Lotus Labs analyzed the sample, only two antivirus engines out of 57 on Virus Total flagged it as malicious, the researchers noted.

A second recently discovered WSL-based malware sample was built to set up a reverse TCP shell on the infected machine to communicate with the attacker.

Looking at the code, the researchers noticed that it used an IP address from Amazon Web Services that had been used previously by several entities.

One particularity that the researchers observed with this sample was that it displayed a pop-up message in Turkish, which translated to: “you’re screwed and there’s not much you can do.”

However, neither the pop-up message, which could indicate Turkish-speaking targets nor the code provided a clue about the author of the malware.

Both malware pieces could be used for espionage purposes and can downloa[...]

d files that would extend their functionality, the researchers said.
See Also: Malicious PyPI package opens backdoors on Windows, Linux, and Macs WSL-based malware taking offBlack Lotus Labs warned in the past that threat actors are exploring the WSL vector deeper, even if many of the samples analyzed “did not yet appear to be fully functional due to the use of internal or non-routable IPs.”

Nevertheless, malware authors are making progress and have already created variants that work on both Windows and Linux and can upload and download files, or execute attacker commands.

Unlike previous WSL-based malware, the latest samples that Black Lotus Labs analyzed “would prove effective with an active C2 [command and control] infrastructure in place given the low detection rates of AV providers.” See Also: Offensive Security Tool: Arjun Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
The general recommendation for defending against WSL-based threats is to keep a close eye on the system activity (e.g. SysMon) to determine suspicious activity and investigate commands.
See Also: The Difference between Vulnerability Assessment and Pentesting
Source: www.bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/shutterstock_176459972-90x90.jpg LinkedIn bug bounty program goes public with rewards of up to $18k3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/vmware-cloudnerve-90x90.jpg New ‘Cheers’ Linux ransomware targets VMware ESXi servers4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/mozilla-releases-fixes-for-firefox-thunderbird-vulnerabilities-exploited-during-pwn2own-vancouver-2022-hacking-contest-90x90.jpg Mozilla fixes Firefox, Thunderbird zero-days exploited at Pwn2Own5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/4x3_1600x1200_highres-Word_Snake_News-90x90.jpg Snake Keylogger Spreads Through Malicious PDFs6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/FTYM512XsAArcFs-90x90.jpg Malicious PyPI package opens backdoors on Windows, Linux, and Macs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/WordPress_headpic-90x90.jpg Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/3e41-article-210226-vmware-body-text-90x90.jpg April VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/iphone-low-power-hacking_068D000001681697-90x90.jpg iPhones Vulnerable to Attack Even When Turned Off2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-90x90.jpg Apple emergency update fixes zero-day used to hack Macs, Watches2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/banner-2022.2-release-90x90.jpg Kali Linux 2022.2 released with new tools, terminal tweaks and more2 weeks ago
The post New Windows Subsystem for Linux malware steals browser auth cookies first appeared on Black Hat Ethical Hacking.

Introducing Melos Bug Bounty Program

We’re happy to see how quickly Melos Studio has grown so far, but with that comes some concerns. We have seen many recent crises and fraud…Continue reading on Medium »
Read more...

How I found my first ever XSS on a website.
https://medium.com/@shellyshubh/how-i-found-my-first-ever-xss-on-a-website-e3a0d02e7649?source=rss------bug_bounty-5

So, I have been into web hacking lately. While into it, I have explored bug bounties but never found a bug in real website. I have tested…Continue reading on Medium » (https://medium.com/@shellyshubh/how-i-found-my-first-ever-xss-on-a-website-e3a0d02e7649?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Password Cracking

https://cdn-images-1.medium.com/max/863/0*VzcjBp_R1DAGmPnj.jpg
On hearing the term “password-cracking,” many will think this post will be about how to guess someone’s password or somewhat similar, but…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hunting Usernames With Sherlock

https://cdn-images-1.medium.com/max/1280/1*C_-Xr0fZF0f0hQQS9zkTXg.png
Learn how to use sherlock, a powerful command line OSINT tool used for hunting down usernames across social networks.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
EDRSandblast : Tool That Weaponize A Vulnerable Signed Driver To Bypass EDR Detections And LSASS Protection

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
365Inspect : A PowerShell Script That Automates The Security Assessment Of Microsoft Office 365 Environments

365Inspect requires the administrative PowerShell modules for Microsoft Online, Azure AD (We recommend installing the AzureADPreview module), Exchange administration, Microsoft Graph, Microsoft Intune, Microsoft Teams, and Sharepoint administration.

The 365Inspect.ps1 PowerShell script will validate the installed modules.

If you do not have these modules installed, you will be prompted to install them, and with your approval, the script will attempt installation. Otherwise, you should be able to install them with the following commands in an administrative PowerShell prompt, or by following the instructions at the references below:

Install-Module -Name MSOnline
Install-Module -Name AzureADPreview
Install-Module -Name ExchangeOnlineManagement
Install-Module -Name Microsoft.Online.SharePoint.PowerShell
Install-Module -Name Microsoft.Graph
Install-Module -Name MicrosoftTeams
Install-Module -Name Microsoft.Graph.Intune

Once the above are installed, download the 365Inspect source code folder from Github using your browser or by using git clone.

As you will run 365Inspect with administrative privileges, you should place it in a logical location and make sure the contents of the folder are readable and writable only by the administrative user. This is especially important if you intend to install 365Inspect in a location where it will be executed frequently or used as part of an automated process. UsageTo run 365Inspect, open a PowerShell console and navigate to the folder you downloaded 365Inspect into:

cd 365Inspect

You will interact with 365Inspect by executing the main script file, 365Inspect.ps1, from within the PowerShell command prompt.

All 365Inspect requires to inspect your O365 tenant is access via an O365 account with proper permissions, so most of the command line parameters relate to the organization being assessed and the method of authentication.

Execution of 365Inspect looks like this:

.\365Inspect.ps1 -OrgName -OutPath -Auth

For example, to log in by entering your credentials in a browser with MFA support:

.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA

365Inspect can be run with only specified Inspector modules, or conversely, by excluding specified modules.

For example, to log in by entering your credentials in a browser with MFA support:

.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA -SelectedInspectors inspector1, inspector2

or

.\365Inspect.ps1 -OrgName mycompany -OutPath ..\365_report -Auth MFA -ExcludedInspectors inspector1, inspector2, inspector3

To break down the parameters further:

* OrgName is the name of the core organization or “company” of your O365 instance, which will be inspected.
* If you do not know your organization name, you can navigate to the list of all Exchange domains in O365. The topmost domain should be named domain_name.onmicrosoft.com. In that example, domain_name is your organization name and should be used when executing 365Inspect.

* OutPath is the path to a folder where the report generated by 365Inspect will be placed.
* Auth is a selector that should be one of the literal values “MFA”, “CMDLINE”, or “ALREADY_AUTHED”.
* Auth controls how 365Inspect will authenticate to all of the Office 365 services.
* Auth MFA will produce a graphical popup in which you can type your credentials and even enter an MFA code for MFA-enabled accounts.
* Auth ALREADY_AUTHED instructs 365Inspect not to authenticate before scanning. This may be preferable if you are executing 365Inspect from a PowerShell prompt where you already have valid sessions for all of the described services, such as one where you have already executed 365Inspect.

* SelectedInspectors is the name or names of the inspector or inspectors you wish to run with 365Inspec[...]

___________________________
@hacking_Attack
@Hacking_Video

t. If multiple inspectors are selected they must be comma separated. Only the named inspectors will be run.
* ExcludedInspectors is the name or names of the inspector or inspectors you wish to prevent from running with 365Inspect. If multiple inspectors are selected they must be comma separated. All modules other included modules will be run.

When you execute 365Inspect with -Auth MFA, it may produce several graphical login prompts that you must sequentially log into. This is normal behavior as Exchange, SharePoint etc. have separate administration modules and each requires a different login session. If you simply log in the requested number of times, 365Inspect should begin to execute. This is the opposite of fun and we’re seeking a workaround, but needless to say we feel the results are worth the minute spent looking at MFA codes.

As 365Inspect executes, it will steadily print status updates indicating which inspection task is running.

365Inspect may take some time to execute. This time scales with the size and complexity of the environment under test. For example, some inspection tasks involve scanning the account configuration of all users. This may occur near-instantly for an organization with 50 users, or could take entire minutes (!) for an organization with 10000. Output365Inspect creates the directory specified in the out_path parameter. This directory is the result of the entire 365Inspect inspection. It contains four items of note:

* Report.html: graphical report that describes the O365 security issues identified by 365Inspect, lists O365 objects that are misconfigured, and provides remediation advice.
* Various text files named [Inspector-Name]: these are raw output from inspector modules and contain a list (one item per line) of misconfigured O365 objects that contain the described security flaw. For example, if a module Inspect-FictionalMFASettings were to detect all users who do not have MFA set up, the file “Inspect-FictionalMFASettings” in the report ZIP would contain one user per line who does not have MFA set up. This information is only dumped to a file in cases where more than 15 affected objects are discovered. If less than 15 affected objects are discovered, the objects are listed directly in the main HTML report body.
* Report.zip: zipped version of this entire directory, for convenient distribution of the results in cases where some inspector modules generated a large amount of findings.
* Log directory: 365Inspect logs any errors encountered during the scripts execution to a timestamped log file found in the Log directory Necessary Privileges365Inspect can’t run properly unless the O365 account you authenticate with has appropriate privileges. 365Inspect requires, at minimum, the following:

* Global Administrator
* SharePoint Administrator

We realize that these are extremely permissive roles, unfortunately due to the use of Microsoft Graph, we are restricted from using lesser prileges by Microsoft. Application and Cloud Application Administrator roles (used to grant delegated and application permissions) are restricted from granting permissions for Microsoft Graph or Azure AD PowerShell modules. https://docs.microsoft.com/en-us/azure/active-directory/roles/permissions-reference#application-administrator Developing Inspector Modules365Inspect is designed to be easy to expand, with the hope that it enables individuals and organizations to either utilize their own 365Inspect modules internally, or publish those modules for the O365 community.

All of 365Inspect‘s inspector modules are stored in the .\inspectors folder.

It is simple to create an inspector module. Inspectors have two files:

* ModuleName.ps1: the PowerShell source code of the inspector module. Should return a list of all O365 objects affected by a specific issue, represented as strings.
* ModuleName.json: metadata about the inspector itself. For example, the finding name, description, remediation information, and references.

The Power[...]

___________________________
@hacking_Attack
@Hacking_Video

Shell and JSON file names must be identical for 365Inspect to recognize that the two belong together. There are numerous examples in 365Inspect‘s built-in suite of modules, but we’ll put an example here too.

Example .ps1 file, BypassingSafeAttachments.ps1:

Define a function that we will later invoke.
365Inspect’s built-in modules all follow this pattern.
function Inspect-BypassingSafeAttachments {
Query some element of the O365 environment to inspect. Note that we did not have to authenticate to Exchange
to fetch these transport rules within this module; assume main 365Inspect harness has logged us in already.
$safe_attachment_bypass_rules = (Get-TransportRule | Where { $_.SetHeaderName -eq “X-MS-Exchange-Organization-SkipSafeAttachmentProcessing” }).Identity
If some of the parsed O365 objects were found to have the security flaw this module is inspecting for,
return a list of strings representing those objects. This is what will end up as the “Affected Objects”
field in the report.
If ($safe_attachment_bypass_rules.Count -ne 0) {
return $safe_attachment_bypass_rules
}
If none of the parsed O365 objects were found to have the security flaw this module is inspecting for,
returning $null indicates to 365Inspect that there were no findings for this module.
return $null
}
Return the results of invoking the inspector function.
return Inspect-BypassingSafeAttachments

Example .json file, BypassingSafeAttachments.json:

{
“FindingName”: “Do Not Bypass the Safe Attachments Filter”,
“Description”: “In Exchange, it is possible to create mail transport rules that bypass the Safe Attachments detection capability. The rules listed above bypass the Safe Attachments capability. Consider revie1wing these rules, as bypassing the Safe Attachments capability even for a subset of senders could be considered insecure depending on the context or may be an indicator of compromise.”,
“Remediation”: “Navigate to the Mail Flow -> Rules screen in the Exchange Admin Center. Look for the offending rules and begin the process of assessing who created them and whether they are necessary to the continued function of your organization. If they are not, remove the rules.”,
“AffectedObjects”: “”,
“References”: [
{
“Url”: “https://docs.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/manage-mail-flow-rules”,
“Text”: “Manage Mail Flow Rules in Exchange Online”
},
{
“Url”: “https://www.undocumented-features.com/2018/05/10/atp-safe-attachments-safe-links-and-anti-phishing-policies-or-all-the-policies-you-can-shake-a-stick-at/#Bypass_Safe_Attachments_Processing”,
“Text”: “Undocumented Features: Safe Attachments, Safe Links, and Anti-Phishing Policies”
}
]
}

Once you drop these two files in the .\inspectors folder, they are considered part of 365Inspect‘s module inventory and will run the next time you execute 365Inspect.

You have just created the BypassingSafeAttachments Inspector module. That’s all!

365Inspect will throw a pretty loud and ugly error if something in your module doesn’t work or doesn’t follow 365Inspect conventions, so monitor the command line output. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
vAPI : Vulnerable Adversely Programmed Interface Which Is Self-Hostable API

vAPI is Vulnerable Adversely Programmed Interface which is Self-Hostable API that mimics OWASP API Top 10 scenarios in the means of Exercises.

Requirements

* PHP
* MySQL
* PostMan
* MITM Proxy

Installation (Docker)

docker-compose up -d

Installation (Manual)

Copying the Code

cd Setting up the Database

Import vapi.sqlinto MySQL Database

Configure the DB Credentials in the vapi/.env

Starting MySQL service

Run following command (Linux)

service mysqld start

Starting Laravel Server

Go to vapidirectory and Run

php artisan serve

Setting Up Postman

* Import vAPI.postman_collection.jsonin Postman
* Import vAPI_ENV.postman_environment.jsonin Postman

OR

Use Public Workspace

Usage

Browse http://localhost/vapi/for Documentation

After Sending requests, refer to the Postman Tests or Environment for Generated Tokens

Deployment

Helm can be used to deploy to a Kubernetes namespace. The chart is in the vapi-chartfolder. The chart requires one secret named vapiwith the following values:

DB_PASSWORD:
DB_USERNAME:

Sample Helm Install Command: helm upgrade --install vapi ./vapi-chart --values=./vapi-chart/values.yaml

*** Important ***

The MYSQL_ROOT_PASSWORD on line 232 in the values.yamlmust match that on line 184 in order to work.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Kraken : A Multi-Platform Distributed Brute-Force Password Cracking System

Kraken is an online distributed brute force password cracking tool. It allows you to parallelize dictionaries and crunch word generator based cracking across multiple machines both as a web app in a web browser and as a standalone electron based client. Kraken aims to be easy to use, fault tolerant and scalable.

I wrote Kraken because I wanted to learn more about offensive security and to write an easy solution to overcome the limitation of using a single device when attempting distribute brute force workloads.

Installation

Server and Browser Client

Kraken is a dockerized application using docker-compose which will launch the db (Postgres), s3 compliant file storage (Minio), the server and the browser client. You can find the docker-compose file at the root directory of the repository. You can deploy it using the following command:

docker-compose up

Kraken’s Browser Client should be accessible at:

* HTTP : localhost:8080 (use server url http://localhost:5000/api [default])
* HTTPS : https://localhost:8443 (use server url https://localhost:8443/api)

Note: To run the Browser Client from a remote machine, you MUST use HTTPS for both server url and browser url. Eg. If you are hosting the server on 192.168.1.2, then browser client will be available at https://192.168.1.2:8443 and the server url should be https://192.168.1.2:8443/api

To upload password lists or dictionaries, upload them to Minio Console at localhost:9001. View steps below for a detailed guide Otherwise, you can generate word lists dynamically using crunch. See crunch options and how to use them here: crunch man page

Kraken’s server runs on localhost:5000 and also hosts swagger documentation at localhost:5000/swagger.

Portable Desktop Client

The desktop client is an electron based portable application and can be run on Mac, Windows and Linux. Due to sensitive permissions required to function, it is highly recommended that you compile and it yourself by cloning the repo and using :

cd kraken-client
npm install
npm run electron-start
Windows
Note: Window EXE portable client needs to run in the folder with its hashcat dependencies. Hashcat files can be dowloaded from their home page or here. Ive included a compressed zip file with the portable executable and required hashcat files. They can be downloaded:

* Portable Exe
* Compressed Zip
Linux
Releases include a Linux AppImage which only requires hashcat to be installed.

* AppImage

Install hashcat:

sudo apt-get install hashcat

You will have to give AppImage permission via properties to execute.
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
OWASP Coraza WAF : A Golang Modsecurity Compatible Web Application Firewall Library

OWASP Coraza Web Application Firewall, OWASP Coraza is a golang enterprise-grade Web Application Firewall framework that supports Modsecurity’s seclang language and is 100% compatible with OWASP Core Ruleset.

Prerequisites

* Linux distribution (Debian and Centos are recommended, Windows is not supported yet)
* Golang compiler v1.16+

Migrate from v1

* Rollback SecAuditLog to the legacy syntax (serial/concurrent)
* Attach an error log handler using waf.SetErrorLogCb(cb)(optional)
* the function Transaction.Clean() must be used to clear transaction data, files and take them back to the sync pool.
* If you are using low level APIs check the complete changelog as most of them were removed.
* OWASP CRS does not require any external dependency anymore

Running the tests

Run the go tests:

go test ./…
go test -race ./…

Using pre-commit

pip install pre-commit
pre-commit run –all-files

ou can also install the pre-commit git hook by running

pre-commit install

Coraza v2 differences with v1

* Full internal API refactor, public API has not changed
* Full audit engine refactor with plugins support
* New enhanced plugins interface for transformations, actions, body processors, and operators
* We are fully compliant with Seclang from modsecurity v2
* Many features removed and transformed into plugins: XML (Mostly), GeoIP and PCRE regex
* Better debug logging
* New error logging (like modsecurity)
* Better performance

Your first Coraza WAF project

package main
import(
“fmt”
“github.com/corazawaf/coraza/v2”
“github.com/corazawaf/coraza/v2/seclang”
)
func main() {
// First we initialize our waf and our seclang parser
waf := coraza.NewWaf()
parser, _ := seclang.NewParser(waf)
// Now we parse our rules
if err := parser.FromString(SecRule REMOTE_ADDR "@rx .*" "id:1,phase:1,deny,status:403"); err != nil {
fmt.Println(err)
}
// Then we create a transaction and assign some variables
tx := waf.NewTransaction()
defer func(){
tx.ProcessLogging()
tx.Clean()
}()
tx.ProcessConnection(“127.0.0.1”, 8080, “127.0.0.1”, 12345)
// Finally we process the request headers phase, which may return an interruption
if it := tx.ProcessRequestHeaders(); it != nil {
fmt.Printf(“Transaction was interrupted with status %d\n”, it.Status)
}
}
Download

___________________________
@hacking_Attack
@Hacking_Video