Ability to login as google staff in Google Cloud Community
https://medium.com/@bhatiagaurav1211/ability-to-login-as-google-staff-in-google-cloud-community-57c45809de05?source=rss------bug_bounty-5
https://medium.com/@bhatiagaurav1211/ability-to-login-as-google-staff-in-google-cloud-community-57c45809de05?source=rss------bug_bounty-5
-Gaurav Bhatia (Bug Hunter, CTF Player)Continue reading on Medium » (https://medium.com/@bhatiagaurav1211/ability-to-login-as-google-staff-in-google-cloud-community-57c45809de05?source=rss------bug_bounty-5)
Bug Bounty is scam on HackerOne
submitted a low severity bug a on a subdomain and got a bounty for that , the next day i have submitted a critical bug on same subdomain…Continue reading on Medium »
Read more...
submitted a low severity bug a on a subdomain and got a bounty for that , the next day i have submitted a critical bug on same subdomain…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Notionterm : Embed Reverse Shell In Notion Pages
Notionterm is a Embed Reverse Shell In Notion Pages
* Hiding attacker IP in reverse shell (No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell)
* Demo/Quick proof insertion within report
* High available and shareable reverse shell (desktop, browser, mobile)
* Encrypted and authenticated remote shell
The focus was on making something fun while still being usable, but that’s not meant to be THE solution for reverse shell in the pentester’s arsenal
Requirements
* Notion software and API key
* Allowed HTTP communication from the target to the notion domain
* Prior RCE on target
Set-up
* Create a page and give to the integration API key the permissions to have page write access
* Build
Run
There are 3 main ways to run
Get terminal, stop/unstop it, etc…
Start the shell with the button widget: turn
Ease notionterm embedding in any page
Start a shell session in any page by creating an embed block with URL containing the page id (
Only perform HTTP traffic from target → notion
Install
As
Thus set env var to fit with the target requirement:
GOOS=[windows/linux/darwin]
Simple build
git clone https://github.com/ariary/notionterm.git && cd notionterm
GOOS=$GOOS go build notionterm.go
You will need to set API key and notion page URL using either env var (
“All-inclusive” build
Embed directly the notion integration API token and notion page url in the binary. https://s.w.org/images/core/emoji/14.0.0/72x72/26a0.png everybody with access to the binary can retrieved the token. For security reason don’t share it and remove it after use.
Set according env var:
export NOTION_PAGE_URL=[NOTION_PAGE_URL]
export NOTION_TOKEN=[INTEGRATION_NOTION_TOKEN]
And build it:
git clone https://github.com/ariary/notionterm.git && cd notionterm
./static-build.sh $NOTION_PAGE_URL $NOTION_TOKEN $GOOS go build notionterm.go
Download
Notionterm : Embed Reverse Shell In Notion Pages
Notionterm is a Embed Reverse Shell In Notion Pages
* Hiding attacker IP in reverse shell (No direct interaction between attacker and target machine. Notion is used as a proxy hosting the reverse shell)
* Demo/Quick proof insertion within report
* High available and shareable reverse shell (desktop, browser, mobile)
* Encrypted and authenticated remote shell
The focus was on making something fun while still being usable, but that’s not meant to be THE solution for reverse shell in the pentester’s arsenal
Requirements
* Notion software and API key
* Allowed HTTP communication from the target to the notion domain
* Prior RCE on target
Set-up
* Create a page and give to the integration API key the permissions to have page write access
* Build
notiontermand transfer it on target machine (see install)Run
There are 3 main ways to run
notionterm:“normal” modeGet terminal, stop/unstop it, etc…
notionterm [flags]Start the shell with the button widget: turn
ON, do you reverse shell stuff, turn OFFto pause, turn ONto resume etc…“server” modeEase notionterm embedding in any page
notionterm --server [flags]Start a shell session in any page by creating an embed block with URL containing the page id (
CTRL+Lto get it): https://[TARGET_URL]/notionterm?url=[NOTION_PAGE_ID].light modeOnly perform HTTP traffic from target → notion
notionterm light [flags]Install
As
notiontermis aimed to be run on target machine it must be built to fit with it.Thus set env var to fit with the target requirement:
GOOS=[windows/linux/darwin]
Simple build
git clone https://github.com/ariary/notionterm.git && cd notionterm
GOOS=$GOOS go build notionterm.go
You will need to set API key and notion page URL using either env var (
NOTION_TOKEN & NOTION_PAGE_URL) or flags (--token & --page-url)“All-inclusive” build
Embed directly the notion integration API token and notion page url in the binary. https://s.w.org/images/core/emoji/14.0.0/72x72/26a0.png everybody with access to the binary can retrieved the token. For security reason don’t share it and remove it after use.
Set according env var:
export NOTION_PAGE_URL=[NOTION_PAGE_URL]
export NOTION_TOKEN=[INTEGRATION_NOTION_TOKEN]
And build it:
git clone https://github.com/ariary/notionterm.git && cd notionterm
./static-build.sh $NOTION_PAGE_URL $NOTION_TOKEN $GOOS go build notionterm.go
Download
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
SMB-Session-Spoofing : Tool To Create A Fake SMB Session
SMB-Session-Spoofing is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees.
Program Modifications Instructions
This program will require you to modify the code slightly. On line 144, the Windows API Create Process With LogonW API is called, there are two parameters that have been supplied by default – svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network.
CreateProcessWithLogonW(L”DomainAdminUser”, L”YourDomain.com”, NULL, LOGON_NETCREDENTIALS_ONLY, );
Implementation Instructions
After modifying the code and compiling it, you must then install the service. You can do so with the following command:
sc create servicename binpath=”C:\ProgramData\Services\Inject\service.exe” start=”auto”
Verification Steps
To verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command:
C:\ProgramData\Services\Inject> net sessions
Computer User name Client Type Opens Idle time
\[::1] svc-admin 0 00:00:04
The command completed successfully.
You should check back in about 13 minutes to verify that a new session has been created and the program is working properly.
What an Attacker Sees
The theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (Workstations), which (it appears) they can then access and dump credentials on to gain Domain Admin access.
In the scenario above, an attacker has compromised the user “wadm-tom@contoso.com” who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this?
How you Should Configure Monitoring
Implementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question.
Download
SMB-Session-Spoofing : Tool To Create A Fake SMB Session
SMB-Session-Spoofing is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees.
Program Modifications Instructions
This program will require you to modify the code slightly. On line 144, the Windows API Create Process With LogonW API is called, there are two parameters that have been supplied by default – svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network.
CreateProcessWithLogonW(L”DomainAdminUser”, L”YourDomain.com”, NULL, LOGON_NETCREDENTIALS_ONLY, );
Implementation Instructions
After modifying the code and compiling it, you must then install the service. You can do so with the following command:
sc create servicename binpath=”C:\ProgramData\Services\Inject\service.exe” start=”auto”
Verification Steps
To verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command:
C:\ProgramData\Services\Inject> net sessions
Computer User name Client Type Opens Idle time
\[::1] svc-admin 0 00:00:04
The command completed successfully.
You should check back in about 13 minutes to verify that a new session has been created and the program is working properly.
What an Attacker Sees
The theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (Workstations), which (it appears) they can then access and dump credentials on to gain Domain Admin access.
In the scenario above, an attacker has compromised the user “wadm-tom@contoso.com” who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this?
How you Should Configure Monitoring
Implementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question.
Download
Bug Bounty is scam on HackerOne
https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5
submitted a low severity bug a on a subdomain and got a bounty for that , the
next day i have submitted a critical bug on same subdomain…Continue reading on Medium » (https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5)
https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5
submitted a low severity bug a on a subdomain and got a bounty for that , the
next day i have submitted a critical bug on same subdomain…Continue reading on Medium » (https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hacking OSCP ! Roadmap 2022 (AD included)
https://cdn-images-1.medium.com/max/1000/1*vTEHMIY-fRpLAtky_CWR6w.jpeg
I got lots of DM about how to crack OSCP or which roadmap to follow for preparing new OSCP pattern. So I making this blog
Continue reading on Medium »
Hacking OSCP ! Roadmap 2022 (AD included)
https://cdn-images-1.medium.com/max/1000/1*vTEHMIY-fRpLAtky_CWR6w.jpeg
I got lots of DM about how to crack OSCP or which roadmap to follow for preparing new OSCP pattern. So I making this blog
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Re-Hacking Wordle
https://cdn-images-1.medium.com/max/1270/0*G6H37mlVwHlbBTII.png
Have you heard about Wordle? I hacked it (again) to get a solution in a first try every day.
Continue reading on Medium »
Re-Hacking Wordle
https://cdn-images-1.medium.com/max/1270/0*G6H37mlVwHlbBTII.png
Have you heard about Wordle? I hacked it (again) to get a solution in a first try every day.
Continue reading on Medium »
Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats
http://www.kitploit.com/2022/07/dumpscan-tool-to-extract-and-dump.html
http://www.kitploit.com/2022/07/dumpscan-tool-to-extract-and-dump.html
Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3 (https://github.com/volatilityfoundation/volatility3).
Features x509 Public and Private key (PKCS #8/PKCS #1) parsing SymCrypt (https://github.com/microsoft/SymCrypt) parsing Supported structures SYMCRYPT_RSAKEY - Determines if the key structure also has a private key Matching to public certificates (https://www.kitploit.com/search/label/Certificates) found in the same process More SymCrypt structures to come Environment variables Command line arguments Note: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD. Installation As a command-line tool, installation is recommended using pipx (https://github.com/pypa/pipx). This allows for easy updates and well and ensuring it is installed in its own virtual environment. pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812a
Usage Usage: dumpscan [OPTIONS] COMMAND [ARGS]...
Scan memory dumps for secrets and keys
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │ ;
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ kernel Scan kernel dump using volatility │
│ minidump Scan a user-mode minidump │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
In the case for subcommands that extract certificates, you can provide --output/-o to output any discovered certificates to disk. Kernel Mode As mentioned, kernel analysis is performed by Volatility3. cmdline, envar, and pslist are direct calls to the Volatility3 plugins, while symcrypt and x509 are custom plugins. Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...
Scan kernel dump using volatility
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. ╰
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline List command line (https://www.kitploit.com/search/label/Command%20Line) for processes (Only for Windows) │
│ envar List process environment variables (Only for Windows) │
│ pslist List all the processes and their command lin e arguments │
│ symcrypt Scan a kernel-mode dump for symcrypt objects │
Features x509 Public and Private key (PKCS #8/PKCS #1) parsing SymCrypt (https://github.com/microsoft/SymCrypt) parsing Supported structures SYMCRYPT_RSAKEY - Determines if the key structure also has a private key Matching to public certificates (https://www.kitploit.com/search/label/Certificates) found in the same process More SymCrypt structures to come Environment variables Command line arguments Note: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD. Installation As a command-line tool, installation is recommended using pipx (https://github.com/pypa/pipx). This allows for easy updates and well and ensuring it is installed in its own virtual environment. pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812a
Usage Usage: dumpscan [OPTIONS] COMMAND [ARGS]...
Scan memory dumps for secrets and keys
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │ ;
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ kernel Scan kernel dump using volatility │
│ minidump Scan a user-mode minidump │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
In the case for subcommands that extract certificates, you can provide --output/-o to output any discovered certificates to disk. Kernel Mode As mentioned, kernel analysis is performed by Volatility3. cmdline, envar, and pslist are direct calls to the Volatility3 plugins, while symcrypt and x509 are custom plugins. Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...
Scan kernel dump using volatility
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. ╰
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline List command line (https://www.kitploit.com/search/label/Command%20Line) for processes (Only for Windows) │
│ envar List process environment variables (Only for Windows) │
│ pslist List all the processes and their command lin e arguments │
│ symcrypt Scan a kernel-mode dump for symcrypt objects │
│ x509 Scan a kernel-mode dump for x509 certificates │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Minidump Mode Supports Windows Minidump format. Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority. Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...
Scan a user-mode minidump
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline Dump the command line string │
│ envar Dump the environment variables in a minidump │
│ symcrypt Scan a minidump for symcrypt objects │
│ x509 Scan a minidump for x509 objects │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Built With volatility3 (https://github.com/volatilityfoundation/volatility3) construct (https://github.com/construct/construct) yara-python (https://github.com/VirusTotal/yara-python) typer (https://github.com/tiangolo/typer) rich (https://github.com/Textualize/rich) rich_click (https://github.com/ewels/rich-click) Acknowledgements Thanks to F-Secure (https://github.com/FSecureLABS) and the physmem2profit (https://github.com/FSecureLABS/physmem2profit) project for providing the idea to use construct for parsing minidumps. Thanks to Skelsec (https://github.com/skelsec) and his minidump (https://github.com/skelsec/minidump) project which helped me figure out to parse minidumps. To-Do Verify use against 32-bit minidumps Create a coredump parser for Linux process dumps Verify volatility plugins (https://www.kitploit.com/search/label/Volatility%20Plugins) work against Linux kernel dumps Add an HTML report that shows all plugins Code refactoring to make more extensible MORE SECRETS
Download Dumpscan (https://github.com/daddycocoaman/dumpscan)
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Minidump Mode Supports Windows Minidump format. Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority. Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...
Scan a user-mode minidump
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline Dump the command line string │
│ envar Dump the environment variables in a minidump │
│ symcrypt Scan a minidump for symcrypt objects │
│ x509 Scan a minidump for x509 objects │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Built With volatility3 (https://github.com/volatilityfoundation/volatility3) construct (https://github.com/construct/construct) yara-python (https://github.com/VirusTotal/yara-python) typer (https://github.com/tiangolo/typer) rich (https://github.com/Textualize/rich) rich_click (https://github.com/ewels/rich-click) Acknowledgements Thanks to F-Secure (https://github.com/FSecureLABS) and the physmem2profit (https://github.com/FSecureLABS/physmem2profit) project for providing the idea to use construct for parsing minidumps. Thanks to Skelsec (https://github.com/skelsec) and his minidump (https://github.com/skelsec/minidump) project which helped me figure out to parse minidumps. To-Do Verify use against 32-bit minidumps Create a coredump parser for Linux process dumps Verify volatility plugins (https://www.kitploit.com/search/label/Volatility%20Plugins) work against Linux kernel dumps Add an HTML report that shows all plugins Code refactoring to make more extensible MORE SECRETS
Download Dumpscan (https://github.com/daddycocoaman/dumpscan)