Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
SMB-Session-Spoofing : Tool To Create A Fake SMB Session
SMB-Session-Spoofing is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees.
Program Modifications Instructions
This program will require you to modify the code slightly. On line 144, the Windows API Create Process With LogonW API is called, there are two parameters that have been supplied by default – svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network.
CreateProcessWithLogonW(L”DomainAdminUser”, L”YourDomain.com”, NULL, LOGON_NETCREDENTIALS_ONLY, );
Implementation Instructions
After modifying the code and compiling it, you must then install the service. You can do so with the following command:
sc create servicename binpath=”C:\ProgramData\Services\Inject\service.exe” start=”auto”
Verification Steps
To verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command:
C:\ProgramData\Services\Inject> net sessions
Computer User name Client Type Opens Idle time
\[::1] svc-admin 0 00:00:04
The command completed successfully.
You should check back in about 13 minutes to verify that a new session has been created and the program is working properly.
What an Attacker Sees
The theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (Workstations), which (it appears) they can then access and dump credentials on to gain Domain Admin access.
In the scenario above, an attacker has compromised the user “wadm-tom@contoso.com” who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this?
How you Should Configure Monitoring
Implementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question.
Download
SMB-Session-Spoofing : Tool To Create A Fake SMB Session
SMB-Session-Spoofing is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees.
Program Modifications Instructions
This program will require you to modify the code slightly. On line 144, the Windows API Create Process With LogonW API is called, there are two parameters that have been supplied by default – svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network.
CreateProcessWithLogonW(L”DomainAdminUser”, L”YourDomain.com”, NULL, LOGON_NETCREDENTIALS_ONLY, );
Implementation Instructions
After modifying the code and compiling it, you must then install the service. You can do so with the following command:
sc create servicename binpath=”C:\ProgramData\Services\Inject\service.exe” start=”auto”
Verification Steps
To verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command:
C:\ProgramData\Services\Inject> net sessions
Computer User name Client Type Opens Idle time
\[::1] svc-admin 0 00:00:04
The command completed successfully.
You should check back in about 13 minutes to verify that a new session has been created and the program is working properly.
What an Attacker Sees
The theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (Workstations), which (it appears) they can then access and dump credentials on to gain Domain Admin access.
In the scenario above, an attacker has compromised the user “wadm-tom@contoso.com” who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this?
How you Should Configure Monitoring
Implementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question.
Download
Bug Bounty is scam on HackerOne
https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5
submitted a low severity bug a on a subdomain and got a bounty for that , the
next day i have submitted a critical bug on same subdomain…Continue reading on Medium » (https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5)
https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5
submitted a low severity bug a on a subdomain and got a bounty for that , the
next day i have submitted a critical bug on same subdomain…Continue reading on Medium » (https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hacking OSCP ! Roadmap 2022 (AD included)
https://cdn-images-1.medium.com/max/1000/1*vTEHMIY-fRpLAtky_CWR6w.jpeg
I got lots of DM about how to crack OSCP or which roadmap to follow for preparing new OSCP pattern. So I making this blog
Continue reading on Medium »
Hacking OSCP ! Roadmap 2022 (AD included)
https://cdn-images-1.medium.com/max/1000/1*vTEHMIY-fRpLAtky_CWR6w.jpeg
I got lots of DM about how to crack OSCP or which roadmap to follow for preparing new OSCP pattern. So I making this blog
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Re-Hacking Wordle
https://cdn-images-1.medium.com/max/1270/0*G6H37mlVwHlbBTII.png
Have you heard about Wordle? I hacked it (again) to get a solution in a first try every day.
Continue reading on Medium »
Re-Hacking Wordle
https://cdn-images-1.medium.com/max/1270/0*G6H37mlVwHlbBTII.png
Have you heard about Wordle? I hacked it (again) to get a solution in a first try every day.
Continue reading on Medium »
Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats
http://www.kitploit.com/2022/07/dumpscan-tool-to-extract-and-dump.html
http://www.kitploit.com/2022/07/dumpscan-tool-to-extract-and-dump.html
Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3 (https://github.com/volatilityfoundation/volatility3).
Features x509 Public and Private key (PKCS #8/PKCS #1) parsing SymCrypt (https://github.com/microsoft/SymCrypt) parsing Supported structures SYMCRYPT_RSAKEY - Determines if the key structure also has a private key Matching to public certificates (https://www.kitploit.com/search/label/Certificates) found in the same process More SymCrypt structures to come Environment variables Command line arguments Note: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD. Installation As a command-line tool, installation is recommended using pipx (https://github.com/pypa/pipx). This allows for easy updates and well and ensuring it is installed in its own virtual environment. pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812a
Usage Usage: dumpscan [OPTIONS] COMMAND [ARGS]...
Scan memory dumps for secrets and keys
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │ ;
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ kernel Scan kernel dump using volatility │
│ minidump Scan a user-mode minidump │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
In the case for subcommands that extract certificates, you can provide --output/-o to output any discovered certificates to disk. Kernel Mode As mentioned, kernel analysis is performed by Volatility3. cmdline, envar, and pslist are direct calls to the Volatility3 plugins, while symcrypt and x509 are custom plugins. Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...
Scan kernel dump using volatility
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. ╰
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline List command line (https://www.kitploit.com/search/label/Command%20Line) for processes (Only for Windows) │
│ envar List process environment variables (Only for Windows) │
│ pslist List all the processes and their command lin e arguments │
│ symcrypt Scan a kernel-mode dump for symcrypt objects │
Features x509 Public and Private key (PKCS #8/PKCS #1) parsing SymCrypt (https://github.com/microsoft/SymCrypt) parsing Supported structures SYMCRYPT_RSAKEY - Determines if the key structure also has a private key Matching to public certificates (https://www.kitploit.com/search/label/Certificates) found in the same process More SymCrypt structures to come Environment variables Command line arguments Note: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD. Installation As a command-line tool, installation is recommended using pipx (https://github.com/pypa/pipx). This allows for easy updates and well and ensuring it is installed in its own virtual environment. pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812a
Usage Usage: dumpscan [OPTIONS] COMMAND [ARGS]...
Scan memory dumps for secrets and keys
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │ ;
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ kernel Scan kernel dump using volatility │
│ minidump Scan a user-mode minidump │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
In the case for subcommands that extract certificates, you can provide --output/-o to output any discovered certificates to disk. Kernel Mode As mentioned, kernel analysis is performed by Volatility3. cmdline, envar, and pslist are direct calls to the Volatility3 plugins, while symcrypt and x509 are custom plugins. Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...
Scan kernel dump using volatility
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. ╰
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline List command line (https://www.kitploit.com/search/label/Command%20Line) for processes (Only for Windows) │
│ envar List process environment variables (Only for Windows) │
│ pslist List all the processes and their command lin e arguments │
│ symcrypt Scan a kernel-mode dump for symcrypt objects │
│ x509 Scan a kernel-mode dump for x509 certificates │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Minidump Mode Supports Windows Minidump format. Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority. Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...
Scan a user-mode minidump
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline Dump the command line string │
│ envar Dump the environment variables in a minidump │
│ symcrypt Scan a minidump for symcrypt objects │
│ x509 Scan a minidump for x509 objects │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Built With volatility3 (https://github.com/volatilityfoundation/volatility3) construct (https://github.com/construct/construct) yara-python (https://github.com/VirusTotal/yara-python) typer (https://github.com/tiangolo/typer) rich (https://github.com/Textualize/rich) rich_click (https://github.com/ewels/rich-click) Acknowledgements Thanks to F-Secure (https://github.com/FSecureLABS) and the physmem2profit (https://github.com/FSecureLABS/physmem2profit) project for providing the idea to use construct for parsing minidumps. Thanks to Skelsec (https://github.com/skelsec) and his minidump (https://github.com/skelsec/minidump) project which helped me figure out to parse minidumps. To-Do Verify use against 32-bit minidumps Create a coredump parser for Linux process dumps Verify volatility plugins (https://www.kitploit.com/search/label/Volatility%20Plugins) work against Linux kernel dumps Add an HTML report that shows all plugins Code refactoring to make more extensible MORE SECRETS
Download Dumpscan (https://github.com/daddycocoaman/dumpscan)
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Minidump Mode Supports Windows Minidump format. Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority. Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...
Scan a user-mode minidump
╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline Dump the command line string │
│ envar Dump the environment variables in a minidump │
│ symcrypt Scan a minidump for symcrypt objects │
│ x509 Scan a minidump for x509 objects │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Built With volatility3 (https://github.com/volatilityfoundation/volatility3) construct (https://github.com/construct/construct) yara-python (https://github.com/VirusTotal/yara-python) typer (https://github.com/tiangolo/typer) rich (https://github.com/Textualize/rich) rich_click (https://github.com/ewels/rich-click) Acknowledgements Thanks to F-Secure (https://github.com/FSecureLABS) and the physmem2profit (https://github.com/FSecureLABS/physmem2profit) project for providing the idea to use construct for parsing minidumps. Thanks to Skelsec (https://github.com/skelsec) and his minidump (https://github.com/skelsec/minidump) project which helped me figure out to parse minidumps. To-Do Verify use against 32-bit minidumps Create a coredump parser for Linux process dumps Verify volatility plugins (https://www.kitploit.com/search/label/Volatility%20Plugins) work against Linux kernel dumps Add an HTML report that shows all plugins Code refactoring to make more extensible MORE SECRETS
Download Dumpscan (https://github.com/daddycocoaman/dumpscan)
hacking: security in practice
My account was pwned
What can I do if my account has been pwned for three times? Im not sure if this is the right place to ask questions, but I hope some of you can help.
submitted by /u/nocapdaddyugh
[link] [comments]
My account was pwned
What can I do if my account has been pwned for three times? Im not sure if this is the right place to ask questions, but I hope some of you can help.
submitted by /u/nocapdaddyugh
[link] [comments]
reddit
My account was pwned
What can I do if my account has been pwned for three times? Im not sure if this is the right place to ask questions, but I hope some of you can help.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
PDF Malware and protection
Hi, I heard about the hack of the Ronin network, which was accomplished via a malicious PDF file. So I asked myself if there are ways of protection to prevent an infiltration like this. Besides the obvious ways of deactivating JavaScript and making the staff more aware, is there more that could be done? Like opening a PDF in a sandbox like environment? I don't mean virtual machines, since that would be overkill to open a PDF, but something more lightweight like docker.
submitted by /u/Cano_7_7
[link] [comments]
PDF Malware and protection
Hi, I heard about the hack of the Ronin network, which was accomplished via a malicious PDF file. So I asked myself if there are ways of protection to prevent an infiltration like this. Besides the obvious ways of deactivating JavaScript and making the staff more aware, is there more that could be done? Like opening a PDF in a sandbox like environment? I don't mean virtual machines, since that would be overkill to open a PDF, but something more lightweight like docker.
submitted by /u/Cano_7_7
[link] [comments]
hacking: security in practice
Are there unethical hackers for hire out there?
Are there any unethical hackers that actually provide proof of their work before they ask for money? Or is true that it's a service that you can't really hire?
submitted by /u/Klxpp
[link] [comments]
Are there unethical hackers for hire out there?
Are there any unethical hackers that actually provide proof of their work before they ask for money? Or is true that it's a service that you can't really hire?
submitted by /u/Klxpp
[link] [comments]
reddit
Are there unethical hackers for hire out there?
Are there any unethical hackers that actually provide proof of their work before they ask for money? Or is true that it's a service that you can't...
hacking: security in practice
Can my parents see internet traffic of specific apps on my Windows 10 pc?
I have a question, I have fairly strict parents that like to monitor what I do with my computer. So I’m wondering if they could also see the certain requests that some apps are making to the internet if they wanted to. For example, if I want to update Photoshop to its newest version, can they see that I downloaded that update? And if so, how do they see this and can intervene somehow?
Thank you in advance
submitted by /u/Vaizyyy
[link] [comments]
Can my parents see internet traffic of specific apps on my Windows 10 pc?
I have a question, I have fairly strict parents that like to monitor what I do with my computer. So I’m wondering if they could also see the certain requests that some apps are making to the internet if they wanted to. For example, if I want to update Photoshop to its newest version, can they see that I downloaded that update? And if so, how do they see this and can intervene somehow?
Thank you in advance
submitted by /u/Vaizyyy
[link] [comments]
reddit
Can my parents see internet traffic of specific apps on my Windows...
I have a question, I have fairly strict parents that like to monitor what I do with my computer. So I’m wondering if they could also see the...