Welcome! This is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees.
Program Modifications Instructions This program will require you to modify the code slightly. On line 144, the Windows API (https://www.kitploit.com/search/label/Windows%20API) CreateProcessWithLogonW API is called, there are two parameters that have been supplied by default - svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network. CreateProcessWithLogonW(L"DomainAdminUser", L"YourDomain.com", NULL, LOGON_NETCREDENTIALS_ONLY, );
Implementation Instructions After modifying the code and compiling it, you must then install the service. You can do so with the following command: sc create servicename binpath="C:\ProgramData\Services\Inject\service.exe" start="auto"
Verification Steps To verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command: C:\ProgramData\Services\Inject> net sessions
Computer User name Client Type Opens Idle time

-------------------------------------------------------------------------------
\\[::1] svc-admin 0 00:00:04
The command completed successfully.

You should check back in about 13 minutes to verify that a new session has been created and the program is working properly. What an Attacker Sees The theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (https://www.kitploit.com/search/label/Infrastructure) (Workstations), which (it appears) they can then access and dump credentials (https://www.kitploit.com/search/label/Dump%20Credentials) on to gain Domain Admin access. 

___________________________
@hacking_Attack
@Hacking_Video

In the scenario above, an attacker has compromised the user "wadm-tom@contoso.com (mailto:wadm-tom@contoso.com)" who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this? How you Should Configure Monitoring Implementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question. Credits Thank you to Microsoft (https://www.kitploit.com/search/label/Microsoft) for providing the service template code and for the excellent Windows API Documentation. https://docs.microsoft.com/en-us/windows/win32/services/the-complete-service-sample https://docs.microsoft.com/en-us/windows/win32/services/svc-cpp https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithlogonw

Download SMB-Session-Spoofing (https://github.com/Sq00ky/SMB-Session-Spoofing)

___________________________
@hacking_Attack
@Hacking_Video

LoveTok — HackTheBox — Web Exploitation — Challenge — Writeup
https://0x1rootjkqsta.medium.com/lovetok-hackthebox-web-exploitation-challenge-writeup-fe558f9942ed?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello guys I am back to posting another writeup. So usually I don’t post writeups about HackTheBox challenges. But this was one of the…Continue reading on Medium » (https://0x1rootjkqsta.medium.com/lovetok-hackthebox-web-exploitation-challenge-writeup-fe558f9942ed?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Did you know that you can hijack all the passwords on someone else’s computer, including their…

https://cdn-images-1.medium.com/max/1280/1*r-X9MEiuXxu8lI8Zqi3iKw.png
This article was originally published in the Turkish language on 16 February 2022.

Continue reading on Medium »

Hacking on Medium
LoveTok — HackTheBox — Web Exploitation — Challenge — Writeup

https://cdn-images-1.medium.com/max/1198/1*A_YxAs2tK76IMywuI-t1GA.jpeg
Hello guys I am back to posting another writeup. So usually I don’t post writeups about HackTheBox challenges. But this was one of the…

Continue reading on Medium »

Hacking on Medium
How to use LinkedIn to market your business

https://cdn-images-1.medium.com/max/640/1*UPr7f6Dk1Pwr0zcpNFuWoA.jpeg
How to use LinkedIn to market your business

Continue reading on Medium »

Hacking on Medium
Microsoft bloquea a piratas informáticos libaneses vinculados a Irán que apuntan a empresas…

https://cdn-images-1.medium.com/max/1596/0*vQHE2KUyWnUqEhn0
PUBLICADO EN 3 JUNIO, 2022POR EHACKING

Continue reading on Medium »

Hacking on Medium
What is the ultimate guide on how to hire a hacker?

https://cdn-images-1.medium.com/max/1124/0*wpVZy6AF5lZD8MME
If you need a hacker to break into your target’s system, you should hire professional hackers with The American Forensic Firm…

Continue reading on Medium »

Hacking on Medium
Burp Suite: Do I need the professional edition?

https://cdn-images-1.medium.com/max/2600/0*7JfYkiizRLxtE-LP
No but it helps

Continue reading on Medium »

KitPloit - PenTest Tools!
SMB-Session-Spoofing - Tool To Create A Fake SMB Session

https://blogger.googleusercontent.com/img/a/AVvXsEjFiqtTKKMCShzFHl0nh1VOZ4pPzz5U5IsfKFLdm2HXUDsuw2cvkSalbZuBn7EEtyyRGTO3O8LN-kjNg4zigrz2lgyj3sB4xf1LEdILLCOSzw30N-7WsBlkUJnY-tfJLwhGzmfzM0-LZJs_444z_R1ERiLixW4n7ukfRDOZEs4AWUh1wGv2eGBHQ9MR=w640-h260 Welcome! This is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees. Program Modifications InstructionsThis program will require you to modify the code slightly. On line 144, the Windows API CreateProcessWithLogonW API is called, there are two parameters that have been supplied by default - svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network. CreateProcessWithLogonW(L"DomainAdminUser", L"YourDomain.com", NULL, LOGON_NETCREDENTIALS_ONLY, Implementation InstructionsAfter modifying the code and compiling it, you must then install the service. You can do so with the following command: sc create servicename binpath="C:\ProgramData\Services\Inject\service.exe" start="auto" Verification StepsTo verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command: C:\ProgramData\Services\Inject> net sessions
Computer User name Client Type Opens Idle time

-------------------------------------------------------------------------------
\\[::1] svc-admin 0 00:00:04
The command completed successfully. You should check back in about 13 minutes to verify that a new session has been created and the program is working properly. What an Attacker SeesThe theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (Workstations), which (it appears) they can then access and dump credentials on to gain Domain Admin access. https://blogger.googleusercontent.com/img/a/AVvXsEjFiqtTKKMCShzFHl0nh1VOZ4pPzz5U5IsfKFLdm2HXUDsuw2cvkSalbZuBn7EEtyyRGTO3O8LN-kjNg4zigrz2lgyj3sB4xf1LEdILLCOSzw30N-7WsBlkUJnY-tfJLwhGzmfzM0-LZJs_444z_R1ERiLixW4n7ukfRDOZEs4AWUh1wGv2eGBHQ9MR=w640-h260 In the scenario above, an attacker has compromised the user "wadm-tom@contoso.com" who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this? How you Should Configure MonitoringImplementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question. CreditsThank you to Microsoft for providing the service template code and for the excellent Windows API Documentation.

* https://docs.microsoft.com/en-us/windows/win32/services/the-complete-service-sample
* https://docs.microsoft.com/en-us/windows/win32/services/svc-cpp
* https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithlogonw Download SMB-Session-Spoofing

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is it bad to torrent a game?

Hey everyone, a favorite game of mine (call of duty black ops 1) just came out on a site where you can play without hackers. I don’t have the game and don’t wanna pay $40 for a 7 year old game so I followed a video how to torrent it and get it for free. I saw a vpn is reccomended but many said it’s not necessary. Can this get me in legal trouble? I’m in the U.S., I do know it’s technically illegal but like many said treyarch the company isn’t likely or at all to sue some kid over pirating a game from that long ago but others mentioned a “isp” can and might take action? Please help

submitted by /u/SebWilder16
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video