Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Anyone else here keeps getting hacked by someone owning an iOS 13?

On Chrome iOS 13.

Same with my Discord and Twitter.

Don't know how they got in and why discord isn't texting me or twitter.

I use Yandex. I don't know where the security breach was and how I got hacked.

submitted by /u/RedditislikeFB
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Anyone else here keeps getting hacked by someone owning an iOS 13?

On Chrome iOS 13. Same with my Discord and Twitter. Don't know how they got in and why discord isn't texting me or twitter. I use Yandex. I...

3 viewsedited 08:42

https://a.thumbs.redditmedia.com/KjkEKowXrXTOK2iXl5i6qEGfb3WQcvd_im7ozi-AFM4.jpg I know 6E stand for outsb, but what does 2 byte 65 4F means? In the hex view from 54 to 79 stand for a string(TimeBubbleOnApply), but comparing it with assembly code above, there's also some opcode i know inside (69 for imul, 6D for [RSP+BYTE], 6C for insb,...) and i get confused by this. So which one these bytes actually stand for? The opcode or the string?

https://preview.redd.it/lwu5hhb4nab91.jpg?width=750&format=pjpg&auto=webp&s=23b413ca04c96a9beadbdc4878ffee29e019099f

https://preview.redd.it/qdzgnkb4nab91.jpg?width=596&format=pjpg&auto=webp&s=51ce0b6751baf5c7de635e53e62038bea9b13cdd

submitted by /u/lenghia143
[link] [comments]

3 views08:42

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Interface reservation failed error on fluxion 6.9

I would like to use Fluxion 6.9 to create a fake access point if my home network just for testing purposes and I run kali in a vm with nat network. I also have one Realtek RTL8812AU adapter but Fluxion gives me an error saying “Interface reservation failed”. Has anyone experienced this issue before? Please help me!

submitted by /u/TheAppleSpot
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Interface reservation failed error on fluxion 6.9

I would like to use Fluxion 6.9 to create a fake access point if my home network just for testing purposes and I run kali in a vm with nat...

5 viewsedited 08:42

Hacking Articles Tips Tricks Videos Tutorials

6 views09:49

Hacking Articles Tips Tricks Videos Tutorials

8 views09:49

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
News – new template post

News – new template postPost Views: 31 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Researchers have discovered a malicious campaign utilizing a never-before-seen technique for quietly planting fileless malware on target machines.The technique involves injecting shellcode directly into Windows event logs. This allows adversaries to use the Windows event logs as a cover for malicious late stage trojans, according to a Kaspersky research report released Wednesday

Researchers uncovered the campaign in February and believe the unidentified adversaries have been active for the past month.

“We consider the event logs technique, which we haven’t seen before, the most innovative part of this campaign,” wrote Denis Legezo, senior security researcher with Kaspersky’s Global Research and Analysis Team.

The attackers behind the campaign use a series of injection tools and anti-detection technique to deliver the malware payload. “With at least two commercial products in use, plus several types of last-stage RAT and anti-detection wrappers, the actor behind this campaign is quite capable,” Legezo wrote.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Fileless Malware Hides in Plain Sight (Event Logs)The first stage of the attack involves the adversary driving targets to a legitimate website and enticing the target to download a compressed .RAR file boobytrapped with the network penetration testing tools called Cobalt Strike and SilentBreak. Both tools are popular among hackers who use them as a vehicle for delivering shellcode to target machines.

Cobalt Strike and SilentBreak utilizing separate anti-detection AES decryptors, compiled with Visual Studio.

The digital certificate for the Cobalt Strike module varies. According to Kaspersky, “15 different stagers from wrappers to last stagers were signed.”

Next, attackers are then able to leverage Cobalt Strike and SilentBreak to “inject code into any process” and can inject additional modules into Windows system processes or trusted applications such as DLP.

“This layer of infection chain decrypts, maps into memory and launches the code,” they said.

The ability to inject malware into system’s memory classifies it as fileless. As the name suggests, fileless malware infects targeted computers leaving behind no artifacts on the local hard drive, making it easy to sidestep traditional signature-based security and forensics tools. The technique, where attackers hide their activities in a computer’s random-access memory and use a native Windows tools such as PowerShell and Windows Management Instrumentation (WMI), isn’t new.

What is new is new, however, is how the encrypted shellcode containing the malicious payload is embedded into Windows event logs. To avoid detection, the code “is divided into 8 KB blocks and saved in the binary part of event logs.”

Legezo said, “The dropper not only puts the launcher on disk for side-loading, but also writes information messages with shellcode into existing Windows KMS event log.”

“The dropped wer.dll is a loader and wouldn’t do any harm without the shellcode hidden in Windows event logs,” he continues. “The dropper searches the event logs for records with category 0x4142 (“AB” in ASCII) and having the Key Management Service as a source. If none is found, the 8KB chunks of shellcode are written into the information logging messages via the ReportEvent() Windows API function (lpRawData parameter).”

Next, a launcher is dropped into the Windows Tasks directory. “At the entry point, a separate thread combines all the aforementioned 8KB pieces into a complete shellcode and runs it,” the researcher wrote.

“Such[...]

___________________________
@hacking_Attack
@Hacking_Video

9 viewsedited 09:49

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs

Microsoft fixes dozens of Azure Site Recovery privilege escalation bugsPost Views: 33 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Microsoft has fixed 32 vulnerabilities in the Azure Site Recovery suite that could have allowed attackers to gain elevated privileges or perform remote code execution.

The Azure Site Recovery service is a disaster recovery service that will automatically fail-over workloads to secondary locations when a problem is detected.

As part of the July 2022 Patch Tuesday, Microsoft fixed 84 flaws, with Azure Site Recovery vulnerability accounting for more than a third of the bugs fixed today.

Of the thirty-two vulnerabilities fixed in Azure Site Recovery, two allow remote code execution, and a whopping thirty vulnerabilities allow for elevation of privileges.

In an advisory released today, Microsoft states that SQL injection vulnerabilities caused most of the privilege escalation bugs.

However, Microsoft also highlighted a CVE-2022-33675 vulnerability caused by a DLL hijacking vulnerability discovered by Tenable.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course A DLL hijacking flawThe DLL hijacking flaw is tracked as CVE-2022-33675 and has a CVSS v3 severity rating of 7.8. It was discovered by researchers at Tenable, who disclosed it to Microsoft on April 8, 2022.

DLL hijacking attacks exploit vulnerabilities caused by insecure permission on folders that a Windows OS searches and loads DLLs required when an application is launched.

To perform the attack, a threat actor can create a custom, malicious DLL using the same name as a regular DLL loaded by the Azure Site Recovery application. This malicious DLL is then stored in a folder that Windows searches, causing it to be loaded and executed when the application starts.

According to Tenable, the “cxprocessserver” service of ASR runs with SYSTEM level privileges by default, and its executable lies in a directory that has been incorrectly set to allow ‘write’ permissions to any user.

https://www.bleepstatic.com/images/news/u/1220909/Security/wrong-permissions(1).png
Potential implicationsBy acquiring admin-level privileges on a target system, an attacker would be free to change the OS security settings, make changes to user accounts, access all files on the system without restrictions, and install additional software.

Considering how widely ASR is used in corporate environments that rely on uninterrupted cloud applications and services, it could serve as a crucial weak point [...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs | Black Hat Ethical Hacking

Microsoft has fixed 32 vulnerabilities in the Azure Site Recovery suite that could have allowed attackers to gain elevated privileges or perform remote code execution.

6 viewsedited 09:49

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking News – new template post News – new template postPost Views: 31 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Patreon.png Subscribe to Patreon to watch this episode. Reading Time: 3 Minutes Researchers…

attention to the event logs in the campaign isn’t limited to storing shellcodes,” the researchers added. “Dropper modules also patch Windows native API functions, related to event tracing (ETW) and anti-malware scan interface (AMSI), to make the infection process stealthier.
Trending: How do QR Codes work and how criminal hackers use them to generate phishing attacks – Demo
Trending: OSINT Tool: Pagodo Unidentified Adversary Delivers Payload of PainUsing this stealthy approach, the attackers can deliver either of their two remote access trojans (RATs), each one a combination of complex, custom code and elements of publicly available software.

In all, with their “ability to inject code into any process using Trojans, the attackers are free to use this feature widely to inject the next modules into Windows system processes or trusted applications.”

Attribution in cyberspace is tricky. The best that analysts can do is dig deep into attackers’ tactics, techniques and procedures (TTPs), and the code they write. If those TTPs or that code overlaps with past campaigns from known actors, it might be the basis for incriminating a suspect.

In this case, the researchers found attribution difficult.

That’s because, beyond the unprecedented technique of injecting shellcode into Windows event logs, there’s one other unique component to this campaign: the code itself. While the droppers are commercially available products, the anti-detection wrappers and RATs they come paired with are custom made (though, the researchers hedged, “some modules which we consider custom, such as wrappers and last stagers, could possibly be parts of commercial products”).

According to the report, “the code is quite unique, with no similarities to known malware.” For that reason, the researchers have yet to determine the identity of the attackers.

“If new modules appear and allow us to connect the activity to some actor we will update the name accordingly.”
Trending: New RedAlert Ransomware targets Windows, Linux VMware ESXi servers
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: threatpost.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/Images_for_the_Website_posts-300x150.png Microsoft fixes dozens of Azure Site Recovery privilege escalation bugsJuly 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-3-300x150.jpg Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie InfinityJuly 11, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ban6-Recovered-Recovered-Recovered-300x150.png New stealthy OrBit malware steals data from Linux devicesJuly 8, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post News – new template post first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 09:49

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs Microsoft fixes dozens of Azure Site Recovery privilege escalation bugsPost Views: 33 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploa…

in network intrusions.

Tenable highlights the scenario of ransomware attacks where the threat actors could leverage CVE-2022-33675 to wipe backups and make free data restoration impossible. However, this is just one of the many examples.

Microsoft has also published an advisory to provide an overview of all the issues fixed in ASR this month, mentioning SQL injection and remote code execution in the impact section.

For these attacks, administrative credentials on the VMs are required; hence, CVE-2022-33675 can’t be used as a funnel to widen the scope of impact, but it could help lay the ground for acquiring those credentials on the target.

To address all security issues, make sure to apply this month’s updates. Those who can’t apply the patches could mitigate the risk by manually changing the write permission setting on the impacted directory. Trending: New RedAlert Ransomware targets Windows, Linux VMware ESXi servers
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-300x150.jpg News – new template postJuly 13, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/remotelyunlock-honda-1-1-300x150.jpg Hackers Say They Can Unlock and Start Honda Cars RemotelyJuly 12, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ezgif.com-gif-maker-3-300x150.jpg Hackers Used Fake LinkedIn Job Offer to Hack Off $625M from Axie InfinityJuly 11, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/ban6-Recovered-Recovered-Recovered-300x150.png New stealthy OrBit malware steals data from Linux devicesJuly 8, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Microsoft fixes dozens of Azure Site Recovery privilege escalation bugs first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 09:49

Hacking Articles Tips Tricks Videos Tutorials

COLIZEUM Bug-Bounty Program
https://medium.com/@colizeum/colizeum-bug-bounty-program-717dc437d3c0?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

COLIZEUM Bug-Bounty Program

Report a bug and get Whitelisted for Colizeum ELITE NFT sale, this is an opportunity to get hands-on ELITE NFT before anybody else does.

7 viewsedited 09:55

About

Blog

Apps

Platform