With ProtectMyTooling you can quickly obfuscate your binaries without having to worry about clicking through all the Dialogs, interfaces, menus, creating projects to obfuscate a single binary, clicking through all the options available and wasting time about all that nonsense. It takes you straight to the point - to obfuscate your tool. Aim is to offer the most convenient interface possible and allow to leverage a daisy-chain of multiple packers combined on a single binary. That's right - we can launch ProtectMyTooling with several packers at once: C:\> py ProtectMyTooling.py hyperion,upx mimikatz.exe mimikatz-obf.exe
The above example will firstly pass mimikatz.exe to the Hyperion for obfuscation, and then the result will be provided to UPX for compression. Resulting with UPX(Hyperion(file)) Features Supports multiple different PE Packers, .NET Obfuscators, Shellcode Loaders/Builders Allows daisy-chaining packers where output from a packer is passed to the consecutive one: callobf,hyperion,upx will produce artifact UPX(Hyperion(CallObf(file))) Collects IOCs at every obfuscation step so that auditing & Blue Team requests can be satisfied Offers functionality to inject custom Watermarks to resulting PE artifacts - in DOS Stub, Checksum, as a standalone PE Section, to file's Overlay Comes up with a handy Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) aggressor script bringing protected-upload and protected-execute-assembly commands Straightforward command line (https://www.kitploit.com/search/label/Command%20Line) usage Installation This tool was designed to work on Windows, as most packers natively target that platform. Some features may work however on Linux just fine, nonetheless that support is not fully tested, please report bugs and issues. First, disable your AV and add contrib directory to exclusions. That directory contains obfuscators, protectors which will get flagged by AV and removed. Then clone this repository PS C:\> git clone --recurse https://github.com/Binary-Offensive/ProtectMyTooling
Actual installation is straightforward: Windows PS C:\ProtectMyTooling> .\install.ps1
Linux bash# ./install.sh
Gimmicks For ScareCrow packer to run on Windows 10, there needs to be WSL installed and bash.exe available (in %PATH%). Then, in WSL one needs to have golang installed in version at least 1.16: cmd> bash
bash$ sudo apt update ; sudo apt upgrade -y ; sudo apt install golang=2:1.18~3 -y
Configuration To plug-in supported obfuscators, change default options or point ProtectMyTooling to your obfuscator executable path, you will need to adjust config\ProtectMyTooling.yaml configuration file. There is also config\sample-full-config.yaml file containing all the available options for all the supported packers, serving as reference point. Friendly reminder If your produced binary crashes or doesn't run as expected - try using different packers chain. Packers don't guarantee stability of produced binaries, therefore ProtectMyTooling cannot as well. While chaining, carefully match output->input payload formats according to what consecutive packer expects. Usage Before ProtectMyTooling's first use, it is essential to adjust program's YAML configuration file ProtectMyTooling.yaml. The order of parameters processal is following: Firstly default parameters are used Then they're overwritten by values coming from YAML Finally, whatever is provided in command line will overwrite corresponding values There, supported packer paths and options shall be set to enable. Scenario 1: Simple ConfuserEx obfuscation Usage is very simple, all it takes is to pass the name of obfuscator to choose, input and output file paths: C:\> py ProtectMyTooling.py confuserex Rubeus.exe Rubeus-obf.exe

::::::::::.:::::::.. ... :::::::::::.,:::::: .,-::::::::::::::::
`;;;```.;;;;;;``;;;; .;;;;;;;;;;;;;;;\''';;;;\'\''',;;;'````;;;;;;;;\'\'''

___________________________
@hacking_Attack
@Hacking_Video

`]]nnn]]' [[[,/[[[' ,[[ \[[, [[ [[cccc [[[ [[
$$$"" $$$$$$c $$$, $$$ $$ $$"""" $$$ $$
888o 888b "88bo"888,_ _,88P 88, 888oo,_`88bo,__,o, 88,
. YMMMb :.-:.MM ::-. "YMMMMMP" MMM """"YUMMM"YUMMMMMP" MMM
;;,. ;;;';;. ;;;;'
[[[[, ,[[[[, '[[,[[['
$$$$$$$$"$$$ c$$"
888 Y88" 888o,8P"`
::::::::::::mM... ... ::: :::::. :::. .,-:::::/
;;;;;;;;\'''.;;;;;;;. .;;;;;;;. ;;; ;;`;;;;, `;;,;;-'````'
[[ ,[[ \[[,[[ \[[,[[[ [[[ [[[[[. '[[[[ [[[[[[/
$$ $$$, $$$$$, $$$$$' $$$ $$$ "Y$c$"$$c. "$$
88, "888,_ _,88" 888,_ _,88o88oo,._888 888 Y88`Y8bo,,,o88o
MMM "YMMMMMP" "YMMMMMP"""""YUMMMMM MMM YM `'YMUP"YMM

Red Team implants protection swiss knife.

Multi-Packer wrapping around multitude of packers, protectors, shellcode loaders, encoders.
Mariusz Banach / mgeeky '20-'22,
v0.15

[.] Processing x86 file: "\Rubeus.exe"
[.] Generating output of ConfuserEx()...

[+] SUCCEEDED. Original file size: 417280 bytes, new file size ConfuserEx(): 756224, ratio: 181.23%
Scenario 2: Simple ConfuserEx obfuscation followed by artifact test One can also obfuscate the file and immediately attempt to launch it (also with supplied optional parameters) to ensure it runs fine with options -r --cmdline CMDLINE: Scenario 3: Complex malware obfuscation with watermarking and IOCs collection Below use case takes beacon.exe on input and feeds it consecutively into CallObf -> UPX -> Hyperion packers. Then it will inject specified fooobar watermark to the final generated output artifact's DOS Stub as well as modify that artifact's checksum with value 0xAABBCCDD. Finally, ProtectMyTooling will capture all IOCs (md5, sha1, sha256, imphash, and other metadata) and save them in auxiliary CSV file. That file can be used for IOC matching as engagement unfolds. PS> py .\ProtectMyTooling.py callobf,upx,hyperion beacon.exe beacon-obf.exe -i -I operation_chimera -w dos-stub=fooobar -w checksum=0xaabbccdd

[...]

[.] Processing x64 file: "beacon.exe"
[>] Generating output of CallObf()...

[.] Before obfuscation file's PE IMPHASH: 17b461a082950fc6332228572138b80c
[.] After obfuscation file's PE IMPHASH: 378d9692fe91eb54206e98c224a25f43
[>] Generating output of UPX(CallObf())...

[>] Generating output of Hyperion(UPX(CallObf()))...

[+] Setting PE checksum to 2864434397 (0xaabbccdd)
[+] Successfully watermarked resulting artifact file.
[+] IOCs written to: beacon-obf-ioc.csv

[+] SUCCEEDED. Original file size: 288256 bytes, new file size Hyperion(UPX(CallObf())): 175616, ratio: 60.92%
Produced IOCs evidence CSV file will look as follows: timestamp,filename,author,context,comment,md5,sha1,sha256,imphash
2022-06-10 03:15:52,beacon.exe,mgeeky@commandoVM,Input File,test,dcd6e13754ee753928744e27e98abd16,298de19d4a987d87ac83f5d2d78338121ddb3cb7,0a64768c46831d98c5667d26dc731408a5871accefd38806b2709c66cd9d21e4,17b461a082950fc6332228572138b80c
2022-06-10 03:15:52,y49981l3.bin,mgeeky@commandoVM,Obfuscation artifact: CallObf(),test,50bbce4c3cc928e274ba15bff0795a8c,15bde0d7fbba1841f7433510fa9aa829f8441aeb,e216cd8205f13a5e3c5320ba7fb88a3dbb6f53ee8490aa8b4e1baf2c6684d27b,378d9692fe91eb54206e98c224a25f43
2022-06-10 03:15:53,nyu2rbyx.bin,mgeeky@commandoVM,Obfuscation artifact: UPX(CallObf()),test,4d3584f10084cded5c6da7a63d42f758,e4966576bdb67e389ab1562e24079ba9bd565d32,97ba4b17c9bd9c12c06c7ac2dc17428d509b64fc8ca9e88ee2de02c36532be10,9aebf3da4677af9275c461261e5abde3
2022-06-10 03:15:53,beacon-obf.exe,mgeeky@commandoVM,Obfuscation artifact: Hyperion(UPX(CallObf())),te st,8b706ff39dd4c8f2b031c8fa6e3c25f5,c64aad468b1ecadada3557cb3f6371e899d59790,087c6353279eb5cf04715ef096a18f83ef8184aa52bc1d5884e33980028bc365,a46ea633057f9600559d5c6b328bf83d

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Bank Australia scam calls/SMS...

If you are with Bank Australia be aware there is a very convincing scam

they know your name, who you bank with and your address and email address and they call from a Bank Australia number. 03 9854 4666

​

https://www.bankaust.com.au/support/alerts?_gl=1*xd01n1*_ga*MTM3NTA0OTYyMS4xNjY2MjU0NTIw*_ga_B543QCRRQK*MTY2Njc3Nzc4MC4yLjEuMTY2Njc3ODI1MC4wLjAuMA..#Scam-alerts

submitted by /u/bulwynkl
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

CRTP Detection and Defense Part
https://www.reddit.com/r/Pentesting/comments/ydxmav/crtp_detection_and_defense_part/

Hi , just wanted to ask those who cleared PentesterAcademy CRTP. How relevant is detection and defense part from exam POV.. Why I am asking is coz I did not want to spend time on covering detection and defense. I will get back to them later if not relevant for exam prep. submitted by /u/koortix (https://www.reddit.com/user/koortix)
[link] (https://www.reddit.com/r/Pentesting/comments/ydxmav/crtp_detection_and_defense_part/) [comments] (https://www.reddit.com/r/Pentesting/comments/ydxmav/crtp_detection_and_defense_part/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ERP Sankhya 4.13.x Cross Site Scripting

https://2.bp.blogspot.com/-OQpvXY0U-U0/WWlvZUlJM8I/AAAAAAAAIOw/4zP2-mVc-vo2HWf5V3aXS_jzwpZLTa24QCLcBGAs/s1600/h59.png
ERP Sankhya versions 4.13.x and below suffer from a cross site scripting vulnerability.

SHA-256 | 1744ed67564a520b1a5d65928e4721a6bdd822c0125cd9c31ecb715595b6e46a

Download
# Exploit Title: ERP Sankhya - XSS to Account Takeover
# Google Dork: N/A
# Date: 19/10/2022
# Exploit Author: Lucas Alves Da Cunha - (0xLucas)
# Vendor Homepage: https://www.sankhya.com.br
# Version: Sankhya Om <=
# Tested on: Sankhya Om 4.11
# CVE: CVE-2022-42989

# Descrição:
Um usuário comum no ERP Sankhya pode enviar uma mensagem para qualquer outro usuário do sistema inclusive administradores, através da função "Caixa de Entrada". No corpo da mensagem, podemos injetar códigos html/javascript levando para um cross site scripting.

Payload para verificar existência da vulnerabilidade:
1

Payload utilizado para capturar os dados da sessão do usuário:
1

# Passos para reprodução:
1 - Encontrando a funcionalidade: https://i.imgur.com/B9SWknH.png

2 - Enviando payload para verificar existência da vulnerabilidade: https://i.imgur.com/ZKSkLmx.png
2.1 - Vulnerabilidade comprovada: https://i.imgur.com/1KiAa1m.png

3 - Explorando a vulnerabilidade: https://i.imgur.com/n8Jevum.png
3.1 - Sessão capturada: https://i.imgur.com/aDatjyN.png

Podemos utilizar os dados da sessão capturada e manipular a sessão utilizando a ferramenta: Cookie-Editor do Google Chrome, e assim entraremos na sessão do usuário desejado. Conforme a imagem a seguir: https://i.imgur.com/L10Yf9f.png

# Impacto:
Explorando essa vulnerabilidade, podemos comprometer qualquer conta de usuário do sistema, desde uma simples conta até mesmo uma conta de administrador do sistema, causando assim um grande impacto de negócio.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Dinstar FXO Analog VoIP Gateway DAG2000-16O Cross Site Scripting

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Dinstar FXO Analog VoIP Gateway version DAG2000-16O suffers from a persistent cross site scripting vulnerability.

SHA-256 | 97eaa1028dd6a201c66d40bfa6162f161c2586c5696100d18bc50025c51b3882

Download
# Exploit Title: Dinstar FXO Analog VoIP Gateway DAG2000-16O Stored Cross Site Scripting
# Google Dork: NA
# Date: 25/10/2022
# Exploit Author: Yehia Elghaly
# Vendor Homepage: https://www.dinstar.com/
# Software Link: https://www.dinstar.com/analog-voip-gateway/16-fxo/
# Version: DAG2000-16O
# CVE: N/A
Summary: DAG1000-16O FXO analog gateway is a type of access gateway offering seamless connectivity between IP-based telephony networks and legacy telephones (POTS) and PBX systems. The analog gateway has 16 FXO ports and is used to connect to analog PBX or the PSTN lines of telecom carriers. With the standard SIP protocol, it's compatible with leading IMS/NGN platforms and SIP-based IP Phone systems. It provides low-cost and easy-to-use VoIP solutions for small and medium businesses, call centers, SOHO, remote offices as well as enterprises with multiple branches.

Description: The attacker can able to convince a victim to visit a URL referencing a vulnerable page, malicious JavaScript content may be executed within the context of the victim's browser.: Stored XSS found on when (Add new Port) affected field is (Primary Authenticate ID)

Payload:

[Affected Component]
(Add new Port)--> (Primary Authenticate ID)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Do any of you guys know of any pen testing jobs that would hire you w/o a degree?
https://www.reddit.com/r/Pentesting/comments/ye0scr/do_any_of_you_guys_know_of_any_pen_testing_jobs/

Hi my parents and I live in NY, and I would like to know about some jobs that would hire a pen tester w/o a degree. I’ve looked on Glassdoor and other sites and they said that it’s required to have a bachelors degree or at least a few years of working in the IT or any computer related field. The reason why I’m asking is because I asked my dad if he would like to get into cybersecurity particularly pen testing in about 2 to 3 years from now and he said that he would see about it, and think about it. He’s an electrician but I think that he’s interested in cybersecurity and because he told me that he used to work on programming computers when he was younger. And he also knows a little bit about cybersecurity like not to connect to a public WIFI, and to use a VPN whenever you connect to one. He also knows about the dark web as well. So do any of y’all know about any pen testing jobs that would hire someone w/o a degree only certificates? submitted by /u/ELIDAL99 (https://www.reddit.com/user/ELIDAL99)
[link] (https://www.reddit.com/r/Pentesting/comments/ye0scr/do_any_of_you_guys_know_of_any_pen_testing_jobs/) [comments] (https://www.reddit.com/r/Pentesting/comments/ye0scr/do_any_of_you_guys_know_of_any_pen_testing_jobs/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Content Security Market Worth $2.2 Million by 2027 - Exclusive Study by MarketsandMarkets(TM)

Concerns about breaches of sensitive information due to execution of malware scripts and growing adoption of cloud-based services are fueling growth of the content security market.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Google Enters Into Stipulated Agreement to Improve Legal Process Compliance Program

Google admitted to loss of data responsive to 2016 search warrant and agreed to program enhancements, reporting obligations, and a first-of-its-kind Independent Compliance Professional.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
54% of Staff Would Reconsider Working for a Firm That Had Experienced a Cyber Breach, Research Finds

Independent research from Encore uncovers hidden costs of cyber attacks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Valence Security Announces $25M Series A to Scale Delivery of Collaborative SaaS Security Remediation Solutions to Customers

Led by Microsoft's M12 venture fund, Valence's Series A round accelerates the company's ability to help customers secure their SaaS mesh from risk created by democratized end-user adoption, third-party integrations, unmanaged identities, and external data sharing.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Open Source Is Just the Tip of the Iceberg in Software Supply Chain Security

As more of the software stack consists of third-party code, it's time for a more-advanced open source vetting system.

Dark Reading: Attacks/Breaches
Top 10 Kubernetes Security Risks Every DevSecOps Pro Should Know

The mission to run any containerized application on any infrastructure makes security a challenge on Kubernetes.

Dark Reading: Attacks/Breaches
Rezilion Vulnerability Scanner Benchmark Report Finds Top Scanners Only 73% Accurate

Majority of vulnerability scanner tools overwhelming teams with false positives and missing exploitable vulnerabilities.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
BlackBerry Launches Cyber Threat Intelligence Service to Strengthen Cyber Defenses

New service from BlackBerry's Threat Research and Intelligence Team reduces unknowns to enhance detection and response.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Baltimore/Washington International Thurgood Marshall Airport Selects Telos to Process Background Checks for Aviation Workers

Telos' aviation channeling service offers increased efficiency and flexibility in credentialing operations at the busiest airport in the Washington-Baltimore region.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
The Most Dangerous Cyber Attacks of 2022

https://cdn-images-1.medium.com/max/634/1*nXU5WQ3SPXO2UJsUjj4hCg.jpeg
TL;DR- Billions of dollars are stolen every year because of cyber attacks, but what are they and how are hackers so successful in…

Continue reading on The Gray Area »

___________________________
@hacking_Attack
@Hacking_Video