Hacking Articles Tips Tricks Videos Tutorials

5 views22:55

KitPloit - PenTest Tools!
SMB-Session-Spoofing - Tool To Create A Fake SMB Session

https://blogger.googleusercontent.com/img/a/AVvXsEjFiqtTKKMCShzFHl0nh1VOZ4pPzz5U5IsfKFLdm2HXUDsuw2cvkSalbZuBn7EEtyyRGTO3O8LN-kjNg4zigrz2lgyj3sB4xf1LEdILLCOSzw30N-7WsBlkUJnY-tfJLwhGzmfzM0-LZJs_444z_R1ERiLixW4n7ukfRDOZEs4AWUh1wGv2eGBHQ9MR=w640-h260 Welcome! This is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees. Program Modifications InstructionsThis program will require you to modify the code slightly. On line 144, the Windows API CreateProcessWithLogonW API is called, there are two parameters that have been supplied by default - svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network. CreateProcessWithLogonW(L"DomainAdminUser", L"YourDomain.com", NULL, LOGON_NETCREDENTIALS_ONLY, Implementation InstructionsAfter modifying the code and compiling it, you must then install the service. You can do so with the following command: sc create servicename binpath="C:\ProgramData\Services\Inject\service.exe" start="auto" Verification StepsTo verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command:

C:\ProgramData\Services\Inject> net sessions
Computer               User name            Client Type       Opens Idle time

-------------------------------------------------------------------------------
\\[::1]                svc-admin                                  0 00:00:04
The command completed successfully.

You should check back in about 13 minutes to verify that a new session has been created and the program is working properly. What an Attacker SeesThe theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (Workstations), which (it appears) they can then access and dump credentials on to gain Domain Admin access. https://blogger.googleusercontent.com/img/a/AVvXsEjFiqtTKKMCShzFHl0nh1VOZ4pPzz5U5IsfKFLdm2HXUDsuw2cvkSalbZuBn7EEtyyRGTO3O8LN-kjNg4zigrz2lgyj3sB4xf1LEdILLCOSzw30N-7WsBlkUJnY-tfJLwhGzmfzM0-LZJs_444z_R1ERiLixW4n7ukfRDOZEs4AWUh1wGv2eGBHQ9MR=w640-h260 In the scenario above, an attacker has compromised the user "wadm-tom@contoso.com" who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this? How you Should Configure MonitoringImplementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question. CreditsThank you to Microsoft for providing the service template code and for the excellent Windows API Documentation.

* https://docs.microsoft.com/en-us/windows/win32/services/the-complete-service-sample
* https://docs.microsoft.com/en-us/windows/win32/services/svc-cpp
* https://docs.microsoft.com/en-us/windows/win32/api/winbase/nf-winbase-createprocesswithlogonw Download SMB-Session-Spoofing

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

SMB-Session-Spoofing - Tool To Create A Fake SMB Session

4 viewsedited 22:55

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Is it bad to torrent a game?

Hey everyone, a favorite game of mine (call of duty black ops 1) just came out on a site where you can play without hackers. I don’t have the game and don’t wanna pay $40 for a 7 year old game so I followed a video how to torrent it and get it for free. I saw a vpn is reccomended but many said it’s not necessary. Can this get me in legal trouble? I’m in the U.S., I do know it’s technically illegal but like many said treyarch the company isn’t likely or at all to sue some kid over pirating a game from that long ago but others mentioned a “isp” can and might take action? Please help

submitted by /u/SebWilder16
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Is it bad to torrent a game?

Hey everyone, a favorite game of mine (call of duty black ops 1) just came out on a site where you can play without hackers. I don’t have the game...

5 viewsedited 00:03

Hacking Articles Tips Tricks Videos Tutorials

5 views00:03

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
A detailed analysis of North Korea's Lazarus APT malware disguised as Notepad++ Shell Extension

https://external-preview.redd.it/hs1lagKj0DGkg2pVL26jq0gofV4YOYqydwmNElzhExg.jpg?width=640&crop=smart&auto=webp&s=f3b38bc8381e1dd3ba43df2b2156da9c945f37e3 submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

A detailed analysis of North Korea's Lazarus APT malware disguised...

Posted in r/hacking by u/CyberMasterV • 424 points and 17 comments

4 viewsedited 00:03

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Find open webcams in a location

I recently moved to a new country, and I'm really missing the place that I used to live. So I was thinking, if I could find some live webcams to watch my hometown, something like a "window" to my city.

I already tried that insecurecam website without luck... Other than that, I only found a weather website which had a live stream, I grabbed the rtsp.me link but that stopped working some days ago.

So, any suggestions of ways to find open webcams? I really don't have any bad intentions, just missing my hometown.

submitted by /u/tehlegend1937
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Find open webcams in a location

I recently moved to a new country, and I'm really missing the place that I used to live. So I was thinking, if I could find some live webcams to...

5 viewsedited 00:03

Hacking Articles Tips Tricks Videos Tutorials

6 views02:35

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
HackThisSite Basic Mission 9

https://cdn-images-1.medium.com/max/700/0*EmeHUMpoTHBYqPgJ.jpg
Sam upgraded his security by rejecting certain characters to prevent another Server Sides Includes (SSI) injection. So Sam did great, he…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

HackThisSite Basic Mission 9

Sam upgraded his security by rejecting certain characters to prevent another Server Sides Includes (SSI) injection. So Sam did great, he…

7 viewsedited 02:35

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
DiGi SM-5000 Scale firmware research

Digi SM-5000 scale is not in my posession yet many vulnerable shops need my assistance, I want to demonstrate the impact of default vendor passwords through emulating the Digi SM-5000 with firmadyne (and installing doom 2 on it). However, without breaching any system not owned by me for a firmware dump or testing. If anyone can point to where I can get the firmware so I can conduct further research that would be very helpful.

If anyone ever found or did previous research on the firmware / OS Internals (it's based on linux) and can share papers that would also be helpful. I already have the official manuals.

submitted by /u/UndergroundParty
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

DiGi SM-5000 Scale firmware research

Digi SM-5000 scale is not in my posession yet many vulnerable shops need my assistance, I want to demonstrate the impact of default vendor...

8 viewsedited 04:03

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Should I tell “tech support” my IP?

I got locked out of my Instagram account and posted on Reddit about it, a redditor dmed me and told me about this cyber tech support who helped him and I got into talking with him. He asked for my username and email which I gave him and now he’s asking for my Reddit account access? I asked if I could create a new account and give him access to that one but he said he’d need the older one since the IP is the same as the Instagram account. Shouldn’t both IPs be the same?

Idk I’m lowkey panicking rn should I give him the account or not? Thank u for reading!

submitted by /u/applesstories
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Should I tell “tech support” my IP?

I got locked out of my Instagram account and posted on Reddit about it, a redditor dmed me and told me about this cyber tech support who helped...

12 viewsedited 04:03

Hacking Articles Tips Tricks Videos Tutorials

9 views06:36

Hacking Articles Tips Tricks Videos Tutorials

Photo