vasion Dropper Autostart.vbaDrops a file to the Startup directory bypassing file write monitoring via renamed folder operationEvasion MsiInstallProduct.vbaInstalls a remote MSI package using WindowsInstaller ActiveXObject avoiding spawning suspicious office child process, the msi installation will be executed as a child of the MSIEXEC /V serviceStealNetNTLMv2.vbaSteal NetNTLMv2 Hash via share connection – credit to https://book.hacktricks.xyz/windows/ntlm/places-to-steal-ntlm-credsParse-Outlook.vbaParses Outlook for sensitive keywords and file extensions, and exfils them via email – credit to JohnWoodmanReverse-Shell.vbaReverse shell written entirely in VBA using Windows API calls – credit to JohnWoodman Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Chisel-Strike : A .NET XOR Encrypted Cobalt Strike Aggressor Implementation For Chisel To Utilize Faster Proxy

Chisel-Strike is a .NET XOR encrypted cobalt strike aggressor implementation for chisel to utilize faster proxy and advanced socks5 capabilities. Why write this?In my experience I found socks4/socks4a proxies quite slow in comparison to its socks5 counterparts and a lack of implementation of socks5 in most C2 frameworks. There is a C# wrapper around the go version of chisel called SharpChisel. This wrapper has a few issues and isn’t maintained to the latest version of chisel. It didn’t allow using shellcode with donut, reflection methods or execute-assembly. I found a fix for this using the SharpChisel-NG project.

Since the SharpChisel assembly is around 16.7 MB, execute-assembly(has a hidden size limitation of 1 MB) and similar in memory methods wouldn’t work. To maintain most of the execution in memory I incorporated the NetLoader project by Flangvik which is executed via execute-assemblyto reflectively host and load a XOR encrypted version of SharpChiselwith base64 arguments in memory.

As an alternative, it is also possible to implement similar C# proxies like SharpSocks by replacing the appropriate chisel binaries in the project. SetupNote: If using a Windows teamserver skip steps 2 and 3.

* Clone/download the repository: git clone https://github.com/m3rcer/Chisel-Strike.git* Make all binaries executable:

* cd Chisel-Strike* chmod +x -R chisel-modules* chmod +x -R tools* Install Mingw-w64and mono:

* sudo apt-get install mingw-w64* sudo apt install mono-complete* Import ChiselStrike.cnain cobalt strike using the Script ManagerRecompile binaries from the srcfolder if needed. Usagechisel can be executed on both the teamserver (windows/linux) and the beacon. With either acting as the server/client. A normal execution flow would be to setup a chisel server on the teamserver and create a client on the beacon connecting back to the teamserver. Commands* chisel <client: Run Chisel on a beacon
* chisel-tms <client: Run Chisel on your teamserver
* chisel-enc: XOR Encrypt SharpChisel.exewith a password of choice
* chisel-jobs: List active chisel jobs on the teamserver and beacon
* chisel-kill: Kill active chisel jobs on a beacon
* chisel-tms-kill: Kill active chisel jobs on teamserver Examplehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiP8RBkIwca5n2SB5jny1A2fnkvG5icMUcVlPjdzcnbXLwMqzwLdi7vOEig11YY9r9NyVxDdPSna2LVmIGruGtP498daxDCyWazZO8sbY27jt-0PJ-uUvLG65PCDTc7WwPovs0DM0uHu1ySA1FcVc7-1VkYpfl0MjIDjzT_L-vMPso2p3kN82PC5BVY/s1280/chiselstrike.gif OPSECNetLoader can easily be obfuscated and used to bypass defender using projects like NimCrypt2 and the like.

Yet SharpChisel.exedrops a dllon disk due to the use of Costura/Fodypackages at a location similar to: C:\Users\m3rcer\AppData\Local\Temp\Costura\CB9433C24E75EC539BF34CD1AA12B236\64\main.dllwhich is detected by defender. It is advised to obfuscate chisel dll’s using projects like gobfuscate in the SharpChisel-NG project and re-build new SharpChisel-NG binaries as shown here. Download

Session Hijacking
https://medium.com/@pentesterclubpvtltd/session-hijacking-3e64b3aa5fcd?source=rss------bug_bounty-5

Session hijacking is defined as taking over an active TCP/IP communication session without the user’s permission. When implemented…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/session-hijacking-3e64b3aa5fcd?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

What Is Session Fixation
https://medium.com/@pentesterclubpvtltd/what-is-session-fixation-d7d27839f306?source=rss------bug_bounty-5

Session fixation is a web attack technique. The attacker tricks the user into using a specific session ID. After the user logs in to the…Continue reading on Medium » (https://medium.com/@pentesterclubpvtltd/what-is-session-fixation-d7d27839f306?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Session Hijacking

Session hijacking is defined as taking over an active TCP/IP communication session without the user’s permission. When implemented…Continue reading on Medium »
Read more...

What Is Session Fixation

Session fixation is a web attack technique. The attacker tricks the user into using a specific session ID. After the user logs in to the…Continue reading on Medium »
Read more...

Making small things BIG

Hacking Salesforce sites.Continue reading on Medium »
Read more...

hacking: security in practice
NodeMCU upgrade possibilities?

I have the deauther set up in the NodeMCU, but I want to find a way to hook it into an old router that I couldn't mod the firmware, just to extend its range or maybe start a new project including both. Idk, I just want to make something amazing out of that router. Any suggestions?

submitted by /u/Black_Sorcerer
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
activator patching cracking

How I use the activator when I try to hack a cracked programm?

submitted by /u/andreaskavos
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
downloaded and re downloaded kali linux a hundred times

I've been downloading and redownloading kali linux but whenever I open it the file still doesn't work. I'm always getting vmx file is corrupt. Please help!!

submitted by /u/Glittering-Target-87
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Making small things BIG
https://clarkvoss.medium.com/making-small-things-big-972cf772bb5a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hacking Salesforce sites.Continue reading on Medium » (https://clarkvoss.medium.com/making-small-things-big-972cf772bb5a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The secret of successful two-factor authentication (2FA) on Linux

https://cdn-images-1.medium.com/max/600/1*k5VUr6apHXtJkSrbJgvlkw.png
In this post, we want to inform you how to enable and successfully setup 2FA on Linux.

Continue reading on sail.black »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Flag challenge writeup on pwnable.kr

https://cdn-images-1.medium.com/max/600/1*DdgpZBBZjmTiMjGbrzb_Pw.png
This is a reversing task, so all we have is the binary itself. Let’s “chmod +x” it so we can run it, and run it to get a “feel” for it…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe | Attacktive Directory CTF write-up

https://cdn-images-1.medium.com/max/823/1*UurjDxc7cPPgzsokZWjzJQ.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video