SharpEventPersist - Persistence By Writing/Reading Shellcode From Event Log
http://www.kitploit.com/2022/06/sharpeventpersist-persistence-by.html

___________________________
@hacking_Attack
@Hacking_Video

Persistence by writing/reading shellcode from Event Log.
Usage The SharpEventPersist tool takes 4 case-sensitive parameters: -file "C:\path\to\shellcode.bin" -instanceid 1337 -source Persistence -eventlog "Key Management (https://www.kitploit.com/search/label/Management) Service". The shellcode is converted to hex (https://www.kitploit.com/search/label/Hex) and written to the "Key Management Service", event level is set to "Information" and source is "Persistence".
Run the SharpEventLoader tool to fetch shellcode from event log and execute it. Ideally this should be converted to a DLL (https://www.kitploit.com/search/label/DLL) and sideloaded on program start/boot.
Remember to change the Event Log name and instanceId in the loader, if not running with default values. Default values will leave the following artifact: A new key will be written to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service named "Persistance". This new "Persistance" key will not have a provider GUID or TypesSupported which the default key "KmsRequests" have. This can be used to build detections.

Download SharpEventPersist (https://github.com/improsec/SharpEventPersist)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tenable CTF 2022 — Strange Packets (Forensics)

Download the pcap file and open it in wireshark. download it if you do not have it installed.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack the Box: Bashed — Writeup

https://cdn-images-1.medium.com/max/1221/1*m_caChV59oud9k5kOq5gIg.png
Bashed is an easy-rated retired Linux Hack the Box machine that has OS Command Injection vulnerabilities, sudo exploitation…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Nmap nedir ve ne işe yarar?

https://cdn-images-1.medium.com/max/600/0*OM885aEvOGlerFJe.jpg
Nmap açılımı Network Mapper olan, ağ uzmanı Gordon Lyon takma adıyla “Fyodor” tarafından geliştirilmiş bir ağ güvenliği tarayıcısıdır…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Magic Word You Should Use Instead of Or

https://cdn-images-1.medium.com/max/640/1*gkhKGseArGFyN4XWcaEJ3g.jpeg
The world is mostly either or.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Tenable CTF 2022 — Top Secret (Forensics)

I had to download adobe so I could follow along with some instructions if found (will try to add the link)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
SharpEventPersist - Persistence By Writing/Reading Shellcode From Event Log

https://blogger.googleusercontent.com/img/a/AVvXsEgRMfk37AblQZmbdBi2KHVlWBTt4K-pOc5azb7oHK5IJ7Lr1HjKxciOtwaxutVVJhVG9-fMfhqaVASAEFL9LjXPWgqPD2Ao5TP416HB5ZykoQ52Z3ST2zyxiwtJa4Fdpg969MT5KFPZpaPBuYz1qUetD82_A6m7AR_m0mdykUOza0UsG_g84f_FXbRW=w640-h506

Persistence by writing/reading shellcode from Event Log.
Usage

The SharpEventPersist tool takes 4 case-sensitive parameters:

* -file "C:\path\to\shellcode.bin"
* -instanceid 1337
* -source Persistence
* -eventlog "Key Management Service".

The shellcode is converted to hex and written to the "Key Management Service", event level is set to "Information" and source is "Persistence".
Run the SharpEventLoader tool to fetch shellcode from event log and execute it. Ideally this should be converted to a DLL and sideloaded on program start/boot.
Remember to change the Event Log name and instanceId in the loader, if not running with default values.

Default values will leave the following artifact:

* A new key will be written to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\EventLog\Key Management Service named "Persistance".
* This new "Persistance" key will not have a provider GUID or TypesSupported which the default key "KmsRequests" have. This can be used to build detections.
Download SharpEventPersist

___________________________
@hacking_Attack
@Hacking_Video

Analysis Report on Recent Hidden Malicious Code Sites on a Chinese HFS HTTP File Servers
https://www.reddit.com/r/redteamsec/comments/vbrmrb/analysis_report_on_recent_hidden_malicious_code/

submitted by /u/Late_Ice_9288 (https://www.reddit.com/user/Late_Ice_9288)
[link] (https://blog.criminalip.io/2022/05/18/criminal-ip-analysis-report-on-recent-hidden-malicious-code-sites-on-a-chinese-hfs-http-file-servers/) [comments] (https://www.reddit.com/r/redteamsec/comments/vbrmrb/analysis_report_on_recent_hidden_malicious_code/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Corel Acquires Awingu

The combination of Awingu and the Parallels Remote Application Server platform will enable end users to securely work from anywhere, at any time, on any device, or OS.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Hacker Inc?

https://cdn-images-1.medium.com/max/770/1*X_ojoixQJjfwjaQtt1sDzA.jpeg
What is Hacker, Inc? Simply put, Hacker, Inc is a black hat firm dedicated to aggressively and offensively serving the needs of its global…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video