Hacking Articles Tips Tricks Videos Tutorials

Broken Access Control vulnerabilities are common in modern applications since the design and implementation of access control mechanisms…Continue reading on Medium » (https://medium.com/@rajeevranjancom/broken-access-control-6eb3224d1546?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Broken Access Control

Broken Access Control vulnerabilities are common in modern applications since the design and implementation of access control mechanisms…

4 viewsedited 17:44

Hacking Articles Tips Tricks Videos Tutorials

4 views17:54

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
OffensiveVBA : Code Execution And AV Evasion Methods For Macros In Office Documents

OffensiveVBA, In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques.

The list got longer and longer and I found no central place for offensive VBA templates – so this repo can be used for such. It is very far away from being complete. If you know any other cool technique or useful template feel free to contribute and create a pull request!

Most of the templates in this repo were already published somewhere. I just copy pasted most templates from ms-docs sites, blog posts or from other tools. Templates in this repoFileDescriptionShellApplication_ShellExecute.vbaExecute an OS command via ShellApplication object and ShellExecute methodShellApplication_ShellExecute_privileged.vbaExecute an privileged OS command via ShellApplication object and ShellExecute method – UAC promptShellcode_CreateThread.vbaExecute shellcode in the current process via Win32 CreateThreadShellcode_EnumChildWindowsCallback.vbaExecute shellcode in the current process via EnumChildWindowsWin32_CreateProcess.vbaCreate a new process for code execution via Win32 CreateProcess functionWin32_ShellExecute.vbaCreate a new process for code execution via Win32 ShellExecute functionWMI_Process_Create.vbaCreate a new process via WMI for code executionWMI_Process_Create2.vbaAnother WMI code execution exampleWscriptShell_Exec.vbaExecute an OS command via WscriptShell object and Exec methodWscriptShell_run.vbaExecute an OS command via WscriptShell object and Run methodVBA-RunPE@itm4n’s RunPE technique in VBAGadgetToJScriptmed0x2e’s C# script for generating .NET serialized gadgets that can trigger .NET assembly load/execution when deserialized using BinaryFormatter from JS/VBS/VBA based scripts.PPID_Spoof.vbachristophetd’s spoofing-office-macro copyAMSIBypass_AmsiScanBuffer_ordinal.vbarmdavy’s AMSI Bypass to patch AmsiScanBuffer using ordinal values for a signature bypassAMSIBypass_AmsiScanBuffer_Classic.vbarasta-mouse’s classic AmsiScanBuffer patchAMSIBypass_Heap.vbarmdavy’s HeapsOfFun repo copyAMSIbypasses.vbaoutflanknl’s AMSI bypass blogCOMHijack_DLL_Load.vbaLoad DLL via COM HijackingCOM_Process_create.vbaCreate process via COM objectDownload_Autostart.vbaDownload a file from a remote webserver and put it into the StartUp folderDownload_Autostart_WinAPI.vbaDownload a file from a remote webserver via URLDownloadtoFileA and put it into the StartUp folderDropper_Autostart.vbaDrop batch file into the StartUp folderRegistry_Persist_wmi.vbaCreate StartUp registry key for persistence via WMIRegistry_Persist_wscript.vbaCreate StartUp registry key for persistence via wscript objectScheduledTask_Create.vbaCreate and start sheduled task for code execution/persistenceXMLDOM_Load_XSL_Process_create.vbaLoad XSL from a remote webserver to execute coderegsvr32_sct_DownloadExecute.vbaExecute regsvr32 to download a remote webservers SCT file for code executionBlockETW.vbaPatch EtwEventWrite in ntdll.dll to block ETW data collectionBlockETW_COMPLUS_ETWEnabled_ENV.vbaBlock ETW data collection by setting the environment variable COMPLUS_ETWEnabled to 0, credit to @xpnShellWindows_Process_create.vbaShellWindows Process create to get explorer.exe as parent processAES.vbaAn example to use AES encryption/decryption in VBA from HereDropper_Executable_Autostart.vbaGet executable bytes from VBA and drop into Autostart – no download in this caseMarauderDrop.vbaDrop a COM registered .NET DLL into temp, import the function and execute code – in this case loads a remote C# binary from a webserver to memory and executes it – credit to @Jean_Maes_1994 for MaraudersMapDropper_Workfolders_lolbas_Execute.vbaDrop an embedded executable into the TEMP directory and execute it using C:\windows\system32\Workfolders.exe as LOLBAS – credit to @YoSignalsSandBoxEvasionSome SandBox Evasion templatesE[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

OffensiveVBA : Code Execution And AV Evasion Methods For Macros

OffensiveVBA, In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion .

6 viewsedited 17:54

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials OffensiveVBA : Code Execution And AV Evasion Methods For Macros In Office Documents OffensiveVBA, In preparation for a VBS AV Evasion Stream/Video I was doing some research for Office Macro code execution methods and evasion techniques.…

vasion Dropper Autostart.vbaDrops a file to the Startup directory bypassing file write monitoring via renamed folder operationEvasion MsiInstallProduct.vbaInstalls a remote MSI package using WindowsInstaller ActiveXObject avoiding spawning suspicious office child process, the msi installation will be executed as a child of the MSIEXEC /V serviceStealNetNTLMv2.vbaSteal NetNTLMv2 Hash via share connection – credit to https://book.hacktricks.xyz/windows/ntlm/places-to-steal-ntlm-credsParse-Outlook.vbaParses Outlook for sensitive keywords and file extensions, and exfils them via email – credit to JohnWoodmanReverse-Shell.vbaReverse shell written entirely in VBA using Windows API calls – credit to JohnWoodman Download

___________________________
@hacking_Attack
@Hacking_Video

4 viewsedited 17:54

Hacking Articles Tips Tricks Videos Tutorials

4 views17:54

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Chisel-Strike : A .NET XOR Encrypted Cobalt Strike Aggressor Implementation For Chisel To Utilize Faster Proxy

Chisel-Strike is a .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities. Why write this?In my experience I found socks4/socks4a proxies quite slow in comparison to its socks5 counterparts and a lack of implementation of socks5 in most C2 frameworks. There is a C# wrapper around the go version of chisel called SharpChisel. This wrapper has a few issues and isn’t maintained to the latest version of chisel. It didn’t allow using shellcode with donut, reflection methods or execute-assembly. I found a fix for this using the SharpChisel-NG project.

Since the SharpChisel assembly is around 16.7 MB, execute-assembly(has a hidden size limitation of 1 MB) and similar in memory methods wouldn’t work. To maintain most of the execution in memory I incorporated the NetLoader project by Flangvik which is executed via execute-assemblyto reflectively host and load a XOR encrypted version of SharpChiselwith base64 arguments in memory.

As an alternative, it is also possible to implement similar C# proxies like SharpSocks by replacing the appropriate chisel binaries in the project. SetupNote: If using a Windows teamserver skip steps 2 and 3.

* Clone/download the repository: git clone https://github.com/m3rcer/Chisel-Strike.git* Make all binaries executable:

* cd Chisel-Strike* chmod +x -R chisel-modules* chmod +x -R tools* Install Mingw-w64and mono:

* sudo apt-get install mingw-w64* sudo apt install mono-complete* Import ChiselStrike.cnain cobalt strike using the Script ManagerRecompile binaries from the srcfolder if needed. Usagechisel can be executed on both the teamserver (windows/linux) and the beacon. With either acting as the server/client. A normal execution flow would be to setup a chisel server on the teamserver and create a client on the beacon connecting back to the teamserver. Commands* chisel <client: Run Chisel on a beacon
* chisel-tms <client: Run Chisel on your teamserver
* chisel-enc: XOR Encrypt SharpChisel.exewith a password of choice
* chisel-jobs: List active chisel jobs on the teamserver and beacon
* chisel-kill: Kill active chisel jobs on a beacon
* chisel-tms-kill: Kill active chisel jobs on teamserver Examplehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiP8RBkIwca5n2SB5jny1A2fnkvG5icMUcVlPjdzcnbXLwMqzwLdi7vOEig11YY9r9NyVxDdPSna2LVmIGruGtP498daxDCyWazZO8sbY27jt-0PJ-uUvLG65PCDTc7WwPovs0DM0uHu1ySA1FcVc7-1VkYpfl0MjIDjzT_L-vMPso2p3kN82PC5BVY/s1280/chiselstrike.gif OPSECNetLoader can easily be obfuscated and used to bypass defender using projects like NimCrypt2 and the like.

Yet SharpChisel.exedrops a dllon disk due to the use of Costura/Fodypackages at a location similar to: C:\Users\m3rcer\AppData\Local\Temp\Costura\CB9433C24E75EC539BF34CD1AA12B236\64\main.dllwhich is detected by defender. It is advised to obfuscate chisel dll’s using projects like gobfuscate in the SharpChisel-NG project and re-build new SharpChisel-NG binaries as shown here. Download

5 views17:54

Hacking Articles Tips Tricks Videos Tutorials

Session Hijacking
https://medium.com/@pentesterclubpvtltd/session-hijacking-3e64b3aa5fcd?source=rss------bug_bounty-5

Session hijacking is defined as taking over an active TCP/IP communication session without the user’s permission. When implemented…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/session-hijacking-3e64b3aa5fcd?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

Session Hijacking

Session hijacking is defined as taking over an active TCP/IP communication session without the user’s permission. When implemented…

4 viewsedited 19:32

Hacking Articles Tips Tricks Videos Tutorials

What Is Session Fixation
https://medium.com/@pentesterclubpvtltd/what-is-session-fixation-d7d27839f306?source=rss------bug_bounty-5

Session fixation is a web attack technique. The attacker tricks the user into using a specific session ID. After the user logs in to the…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/what-is-session-fixation-d7d27839f306?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

What Is Session Fixation

Session fixation is a web attack technique. The attacker tricks the user into using a specific session ID. After the user logs in to the…

4 viewsedited 19:33

Hacking Articles Tips Tricks Videos Tutorials

Session Hijacking

Session hijacking is defined as taking over an active TCP/IP communication session without the user’s permission. When implemented…Continue reading on Medium »
Read more...

3 views20:10

Hacking Articles Tips Tricks Videos Tutorials

What Is Session Fixation

Session fixation is a web attack technique. The attacker tricks the user into using a specific session ID. After the user logs in to the…Continue reading on Medium »
Read more...

3 views20:10

About

Blog

Apps

Platform