Kali Linux Tutorials
SMB-Session-Spoofing : Tool To Create A Fake SMB Session

SMB-Session-Spoofing is a utility that can be compiled with Visual Studio 2019 (or newer). The goal of this program is to create a fake SMB Session. The primary purpose of this is to serve as a method to lure attackers into accessing a honey-device. This program comes with no warranty or guarantees.

Program Modifications Instructions

This program will require you to modify the code slightly. On line 144, the Windows API Create Process With LogonW API is called, there are two parameters that have been supplied by default – svc-admin (the Username) and contoso.com (the domain). It is necessary that you change these values to something that matches your production network.

CreateProcessWithLogonW(L”DomainAdminUser”, L”YourDomain.com”, NULL, LOGON_NETCREDENTIALS_ONLY, );

Implementation Instructions

After modifying the code and compiling it, you must then install the service. You can do so with the following command:

sc create servicename binpath=”C:\ProgramData\Services\Inject\service.exe” start=”auto”

Verification Steps

To verify the program is functioning correctly, you should check and see what sessions exist on the system. This can be done with the following command:

C:\ProgramData\Services\Inject> net sessions
Computer User name Client Type Opens Idle time
\[::1] svc-admin 0 00:00:04
The command completed successfully.

You should check back in about 13 minutes to verify that a new session has been created and the program is working properly.

What an Attacker Sees

The theory behind this is when an adversary runs SharpHound and collects sessions and analyzes attack paths from owned principals, they can identify that a high privileged user is signed in on Tier-2 infrastructure (Workstations), which (it appears) they can then access and dump credentials on to gain Domain Admin access.

In the scenario above, an attacker has compromised the user “wadm-tom@contoso.com” who is a Local Administrator on lab-wkst-2.contoso.com. The user svc-admin is logged in on lab-wkst-2.contoso.com, meaning that all the attacker has to do is sign into the Workstation, run Mimikatz and dump credentials. So, how do you monitor for this?

How you Should Configure Monitoring

Implementation of this tool is important, so is monitoring. If you implement the tool with no monitoring, it is effectively useless; therefore monitoring is a must. The most effective way to monitor this host is to alert on any logon. This program is best utilized on a host with no user activity that is joined to the domain with standard corporate monitoring tools (EDR, AV, Windows Event Log Forwarding, etc). It is highly recommended that you have an email alert, SMS alert, and many others if possible to ensure that incidents involving this machine are triaged as quickly as possible since this has the highest probability for a real adversary to engage with the workstation in question.
Download

Bug Bounty is scam on HackerOne
https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5

submitted a low severity bug a on a subdomain and got a bounty for that , the 
next day i have submitted a critical bug on same subdomain…Continue reading on Medium » (https://thinkermaruf.medium.com/bug-bounty-is-scam-on-hackerone-abddb92362cb?source=rss------bug_bounty-5)

Hacking on Medium
Hacking OSCP ! Roadmap 2022 (AD included)

https://cdn-images-1.medium.com/max/1000/1*vTEHMIY-fRpLAtky_CWR6w.jpeg
I got lots of DM about how to crack OSCP or which roadmap to follow for preparing new OSCP pattern. So I making this blog

Continue reading on Medium »

Hacking on Medium
Re-Hacking Wordle

https://cdn-images-1.medium.com/max/1270/0*G6H37mlVwHlbBTII.png
Have you heard about Wordle? I hacked it (again) to get a solution in a first try every day.

Continue reading on Medium »

Hacking on Medium
‍IW Weekly #10: 5 Articles, 4 Threads, 3 Videos, 2 Github Repos, 1 Job Alert

https://cdn-images-1.medium.com/max/2000/1*boxlJdlZkaYK8Ps5I-NGMA.jpeg
Hey 👋

Continue reading on InfoSec Write-ups »

Dumpscan - Tool To Extract And Dump Secrets From Kernel And Windows Minidump Formats
http://www.kitploit.com/2022/07/dumpscan-tool-to-extract-and-dump.html

Dumpscan is a command-line tool designed to extract and dump secrets from kernel and Windows Minidump formats. Kernel-dump parsing is provided by volatility3 (https://github.com/volatilityfoundation/volatility3).
Features x509 Public and Private key (PKCS #8/PKCS #1) parsing SymCrypt (https://github.com/microsoft/SymCrypt) parsing Supported structures SYMCRYPT_RSAKEY - Determines if the key structure also has a private key Matching to public certificates (https://www.kitploit.com/search/label/Certificates) found in the same process More SymCrypt structures to come Environment variables Command line arguments Note: Testing has only been performed on Windows 10 and 11 64-bit hosts and processes. Feel free to file an issue for additional versions. Linux testing TBD. Installation As a command-line tool, installation is recommended using pipx (https://github.com/pypa/pipx). This allows for easy updates and well and ensuring it is installed in its own virtual environment. pipx install dumpscan
pipx inject dumpscan git+https://github.com/volatilityfoundation/volatility3#39e812a
Usage Usage: dumpscan [OPTIONS] COMMAND [ARGS]...

Scan memory dumps for secrets and keys

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. &#9474 ;
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ kernel Scan kernel dump using volatility │
│ minidump Scan a user-mode minidump │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
In the case for subcommands that extract certificates, you can provide --output/-o to output any discovered certificates to disk. Kernel Mode As mentioned, kernel analysis is performed by Volatility3. cmdline, envar, and pslist are direct calls to the Volatility3 plugins, while symcrypt and x509 are custom plugins. Usage: dumpscan kernel [OPTIONS] COMMAND [ARGS]...

Scan kernel dump using volatility

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. ╰
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline List command line (https://www.kitploit.com/search/label/Command%20Line) for processes (Only for Windows) │
│ envar List process environment variables (Only for Windows) │
│ pslist List all the processes and their command lin e arguments │
│ symcrypt Scan a kernel-mode dump for symcrypt objects │

│ x509 Scan a kernel-mode dump for x509 certificates │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Minidump Mode Supports Windows Minidump format. Note: This has only been tested on 64-bit processes on Windows 10+. 32-bit processes requires additional work but isn't a priority. Usage: dumpscan minidump [OPTIONS] COMMAND [ARGS]...

Scan a user-mode minidump

╭─ Options ────────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ --help Show this message and exit. │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
╭─ Commands ───────────────────────────────────────────────────────────────────────────────────────╮
│ │
│ cmdline Dump the command line string │
│ envar Dump the environment variables in a minidump │
│ symcrypt Scan a minidump for symcrypt objects │
│ x509 Scan a minidump for x509 objects │
│ │
╰──────────────────────────────────────────────────────────────────────────────────────────────────╯
Built With volatility3 (https://github.com/volatilityfoundation/volatility3) construct (https://github.com/construct/construct) yara-python (https://github.com/VirusTotal/yara-python) typer (https://github.com/tiangolo/typer) rich (https://github.com/Textualize/rich) rich_click (https://github.com/ewels/rich-click) Acknowledgements Thanks to F-Secure (https://github.com/FSecureLABS) and the physmem2profit (https://github.com/FSecureLABS/physmem2profit) project for providing the idea to use construct for parsing minidumps. Thanks to Skelsec (https://github.com/skelsec) and his minidump (https://github.com/skelsec/minidump) project which helped me figure out to parse minidumps. To-Do Verify use against 32-bit minidumps Create a coredump parser for Linux process dumps Verify volatility plugins (https://www.kitploit.com/search/label/Volatility%20Plugins) work against Linux kernel dumps Add an HTML report that shows all plugins Code refactoring to make more extensible MORE SECRETS

Download Dumpscan (https://github.com/daddycocoaman/dumpscan)

hacking: security in practice
My account was pwned

What can I do if my account has been pwned for three times? Im not sure if this is the right place to ask questions, but I hope some of you can help.

submitted by /u/nocapdaddyugh
[link] [comments]

hacking: security in practice
PDF Malware and protection

Hi, I heard about the hack of the Ronin network, which was accomplished via a malicious PDF file. So I asked myself if there are ways of protection to prevent an infiltration like this. Besides the obvious ways of deactivating JavaScript and making the staff more aware, is there more that could be done? Like opening a PDF in a sandbox like environment? I don't mean virtual machines, since that would be overkill to open a PDF, but something more lightweight like docker.

submitted by /u/Cano_7_7
[link] [comments]

hacking: security in practice
Are there unethical hackers for hire out there?

Are there any unethical hackers that actually provide proof of their work before they ask for money? Or is true that it's a service that you can't really hire?

submitted by /u/Klxpp
[link] [comments]

hacking: security in practice
Can my parents see internet traffic of specific apps on my Windows 10 pc?

I have a question, I have fairly strict parents that like to monitor what I do with my computer. So I’m wondering if they could also see the certain requests that some apps are making to the internet if they wanted to. For example, if I want to update Photoshop to its newest version, can they see that I downloaded that update? And if so, how do they see this and can intervene somehow?

Thank you in advance

submitted by /u/Vaizyyy
[link] [comments]

Black Hat Ethical Hacking
Recon Tool: WayMore

Recon Tool: WayMorePost Views: 70 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png
Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes
Anyone who does Bug Bounty will have likely used the amazing waybackurls by TomNomNom. The idea behind waymore by xnlh4ck3r is to find even more links from the Wayback Machine than other existing tools.

The biggest difference between waymore and other tools is that it can also download the archived responses for URLs on wayback machine so that you can then search these for even more links, developer comments, extra parameters, and so on.

This tool gets URLs from:

* Wayback Machine (web.archive.org)
* Common Crawl (index.commoncrawl.org)
* Alien Vault OTX (otx.alienvault.com)
* URLScan (urlscan.io) Installationwaymore supports Python 3.

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/installation-1-1024x427.png

if you’re having a problem running the setup.py for whatever reason you can run the following to install the dependencies:

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/07/dependencies.png
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course UsageArg Long Arg Description -i –input The target domain to find links for. This can be a domain only, or a domain with a specific path. If it is a domain only to get everything for that domain, don;t prefix with www. -mode The mode to run: U (retrieve URLs only), R (download Responses only) or B (Both). If -i is a domain only, then -mode will default to B. If -i is a domain with path then -mode will default to R. -n –no-subs Don’t include subdomains of the target domain (only used if input is not a domain with a specific path). -f –filter-responses-only The initial links from Wayback Machine will not be filtered, only the responses that are downloaded, , e.g. it maybe useful to still see all available paths from the links even if you don’t want to check the content. -l –limit How many responses will be saved (if -b is not passed). A positive value will get the first N results, a negative value will will get the last N results. A value of 0 will get ALL responses (default: 5000) -from –from-date What date to get responses from. If not specified it will get from the earliest possible results. A partial value can be passed, e.g. 2016, 201805, etc. -to –to-date What date to get responses to. If not specified it will get to the latest possible results. A partial value can be passed, e.g. 2021, 202112, etc. -ci –capture-interval Filters the search on archive.org to only get at most 1 capture per hour (h), day (d) or month (m). This filter is used for responses only. The default is ‘d’ but can also be set to ‘none’ to not filter anything and get all responses. -ra –regex-after RegEx for filtering purposes against links found from archive.org/commoncrawl.org AND responses downloaded. Only positive matches will be output. -url-filename Set the file name of downloaded responses to the URL that generated the response, otherwise it will be set to the hash value of the response. Using the hash value means multiple URLs that generated the same response will only result in one file being saved for that response. -xcc Exclude checks to commoncrawl.org. Searching all their index collections can take a while, and often it may not return any extra URLs that weren’t already found on archive.org -xav Exclude checks to alienvault.com. Searching all their pages can take a while, and often it may not return any extra URLs that weren’t already found on archive.org -lcc Limit the number of Common Crawl index collections searched, e.g. -lcc 10 will just search the latest 10 collections.. As of June 2022 there are currently 88 collections. Setting to 0 (def[...]