A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (https://www.kitploit.com/search/label/Hijacking) (User), and Junction Folder (User)
Usage Clone, run make, add .cna to Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) client. run: help persist-ice in CS console Syntax: persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] [dll / lnk exe name]; Technique Overview All of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part of the BOF. Print Monitor The Dll MUST be on disk and in a location in PATH (Dll search order) BEFORE you run the BOF. It will fail otherwise. The Dll will immediately be loaded by spoolsv.exe as SYSTEM. This can be used to elevate from admin to SYSTEM as well as for persistence. Will execute on system startup. Must be elevated to run. Demo Print Monitor Dll in project Example: upload NotMalware.dll to C:\Windows\NotMalware.dll persist-ice PrintMon persist TotesLegitMonitor NotMalware.dll Immediately executes as SYSTEM Will execute on startup until removed persist-ice PrintMon clean TotesLegitMonitor C:\Windows\NotMalware.dll > Will delete the registery keys and unload the Dll, then attempt to delete the dll if provided the correct path. Should succeed. Time Provider Loaded by svchost.exe as NETWORK SERVICE (get your potatoes ready!) on startup after running the BOF. Must be elevated to run. Demo Time Provider Dll in project Example: persist-ice TimeProv persist TotesLegitTimeProvider C:\anywhere\NotMalware.dll persist-ice TimeProv cleanup TotesLegitTimeProvider C:\anywhere\NotMalware.dll > Will delete the registry (https://www.kitploit.com/search/label/Registry) keys and attempt to delete the dll if provided the correct path. Will probably fail because the dll is not unloaded by the process. Junction Folder Same technique as demonstrated in Vault 7 leaks. Executed on user login. Non-elevated. Dll will be loaded into explorer.exe Example: persist-ice Juction persist TotesLegitFolder C:\user-writable-folder\NotMalware.dll Save CLSID persist-ice Juction clean TotesLegitFolder C:\user-writable-folder\NotMalware.dll 6be5e092-90cc-452d-be83-208029e259e0 > Will delete the registry keys, junction folder, and attempt to delete the dll. Start Folder Hijack Create a new, user writeable folder, copy a hijackable windows (https://www.kitploit.com/search/label/Windows) binary (https://www.kitploit.com/search/label/Binary) to the folder, then create a shortcut in the startup folder. Executed on user login. Non-elevated. Example: persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > upload your Dll as a proxy dll to dismcore.dll into C:\TotesLegitFolder persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > Will attempt delete all files in new folder then delete the folder itself. If the Dll is still loaded in the process then this will fail. References https://stmxcsr.com/persistence/print-monitor.html https://stmxcsr.com/persistence/time-provider.html https://pentestlab.blog/2019/10/28/persistence-port-monitors/ https://blog.f-secure.com/hunting-for-junction-folder-persistence/ https://attack.mitre.org/techniques/T1547/010/ https://attack.mitre.org/techniques/T1547/003/ https://attack.mitre.org/techniques/T1547/009/

Download PersistBOF (https://github.com/IcebreakerSecurity/PersistBOF)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to find & access Admin Panel by digging into JS files…

https://cdn-images-1.medium.com/max/1206/0*gWmf1S7O7TT5Ctt3.jpeg
Hello All,🙂

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Indian Hackers are being hired by the Israeli Private Detective Service for Russian Oligarchs!

https://cdn-images-1.medium.com/max/640/0*LSo_3bDCLpCMSv2q.jpg
The Israeli Private Detective used Indian hackers!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Top 5 Hacking Book , Must Read !!

https://cdn-images-1.medium.com/max/800/1*BNbCYjofq0JDtmslfaMkkg.jpeg
A Hacking and cybersecurity books guide which tells you about top 10 Hacking books .

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Uma dádiva dos espiões

https://cdn-images-1.medium.com/max/2600/1*Z_Jq9G9xYAqAwLYff4Ztbw.jpeg
Quantas pessoas já pensaram sobre estarem sendo espionadas sem o seu consentimento?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Hydra co-owner’s crypto wallet

https://cdn-images-1.medium.com/max/2000/0*JlRgk-mMgani_P0J.jpg
A Moscow court can confiscate a record amount for Russia from a drug dealer’s crypto wallet, but he does not give the password. We are…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack Quaoar Machine and get Admin Access.

https://cdn-images-1.medium.com/max/1086/1*Fc093DF5jMiZ1NINagUIDg.png
Quaoar is a boot2root virtual machine hosted in vulnhub, created by Viper for Hackfest 2016 CTF. This machine is good for those who have…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

During a pentest, how do you bypass AV to get tools in? I have worked in easier environments but when you run into crowdstrike how do you bypass to do work?
https://www.reddit.com/r/Pentesting/comments/v10efk/during_a_pentest_how_do_you_bypass_av_to_get/

submitted by /u/Upstairs_Lie_9379 (https://www.reddit.com/user/Upstairs_Lie_9379)
[link] (https://www.reddit.com/r/Pentesting/comments/v10efk/during_a_pentest_how_do_you_bypass_av_to_get/) [comments] (https://www.reddit.com/r/Pentesting/comments/v10efk/during_a_pentest_how_do_you_bypass_av_to_get/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PersistBOF - Tool To Help Automate Common Persistence Mechanisms

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEggeS9H-8KfNEiS7wmPPWLTznqdP3xgqDqCQV8y_JrqW3xRX5AakIYR1avV_l8dcAdDFX4JSqdDIAVkrDp-FfgqEgduT7qhn1zpXJzxeZ3r2bqujWZ1OptNNnbXx7H9Dwtfy-J1d4t-tsYfo9KtEZ0FkyZaPGfcxeTct3WGCnYLf3p7lmv-MZnBgJn9/w640-h176/PersistBOF.png A tool to help automate common persistence mechanisms. Currently supports Print Monitor (SYSTEM), Time Provider (Network Service), Start folder shortcut hijacking (User), and Junction Folder (User) UsageClone, run make, add .cna to Cobalt Strike client.

run: help persist-ice in CS console

Syntax:

* persist-ice [PrintMon, TimeProv, Shortcut, Junction] [persist or clean] [key/folder name] [dll / lnk exe name]; Technique OverviewAll of these techniques rely on a Dll file to be seperately placed on disk. It is intentially not part of the BOF. Print MonitorThe Dll MUST be on disk and in a location in PATH (Dll search order) BEFORE you run the BOF. It will fail otherwise. The Dll will immediately be loaded by spoolsv.exe as SYSTEM. This can be used to elevate from admin to SYSTEM as well as for persistence. Will execute on system startup. Must be elevated to run.

* Demo Print Monitor Dll in project

Example:

1. upload NotMalware.dll to C:\Windows\NotMalware.dll
2. persist-ice PrintMon persist TotesLegitMonitor NotMalware.dll
3. Immediately executes as SYSTEM
4. Will execute on startup until removed
5. persist-ice PrintMon clean TotesLegitMonitor C:\Windows\NotMalware.dll > Will delete the registery keys and unload the Dll, then attempt to delete the dll if provided the correct path. Should succeed. Time ProviderLoaded by svchost.exe as NETWORK SERVICE (get your potatoes ready!) on startup after running the BOF. Must be elevated to run.

* Demo Time Provider Dll in project

Example:

* persist-ice TimeProv persist TotesLegitTimeProvider C:\anywhere\NotMalware.dll
* persist-ice TimeProv cleanup TotesLegitTimeProvider C:\anywhere\NotMalware.dll > Will delete the registry keys and attempt to delete the dll if provided the correct path. Will probably fail because the dll is not unloaded by the process. Junction FolderSame technique as demonstrated in Vault 7 leaks. Executed on user login. Non-elevated. Dll will be loaded into explorer.exe

Example:

* persist-ice Juction persist TotesLegitFolder C:\user-writable-folder\NotMalware.dll Save CLSID
* persist-ice Juction clean TotesLegitFolder C:\user-writable-folder\NotMalware.dll 6be5e092-90cc-452d-be83-208029e259e0 > Will delete the registry keys, junction folder, and attempt to delete the dll. Start Folder HijackCreate a new, user writeable folder, copy a hijackable windows binary to the folder, then create a shortcut in the startup folder. Executed on user login. Non-elevated.

Example:

* persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > upload your Dll as a proxy dll to dismcore.dll into C:\TotesLegitFolder
* persist-ice Shortcut persist C:\TotesLegitFolder C:\Windows\System32\Dism.exe > Will attempt delete all files in new folder then delete the folder itself. If the Dll is still loaded in the process then this will fail. Referenceshttps://stmxcsr.com/persistence/print-monitor.html https://stmxcsr.com/persistence/time-provider.html https://pentestlab.blog/2019/10/28/persistence-port-monitors/ https://blog.f-secure.com/hunting-for-junction-folder-persistence/ https://attack.mitre.org/techniques/T1547/010/ https://attack.mitre.org/techniques/T1547/003/ https://attack.mitre.org/techniques/T1547/009/ Download PersistBOF

___________________________
@hacking_Attack
@Hacking_Video

Top 5 Hacking Book , Must Read !!
https://infosecwriteups.com/top-5-hacking-book-must-read-72b37d7f885a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A Hacking and cybersecurity books guide which tells you about top 10 Hacking books .Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/top-5-hacking-book-must-read-72b37d7f885a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video