Hacking Articles Tips Tricks Videos Tutorials

5 views10:54

Black Hat Ethical Hacking
Windows Kerberos authentication breaks after November updates

Windows Kerberos authentication breaks after November updatesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Microsoft is investigating a new known issue causing enterprise domain controllers to experience Kerberos sign-in failures and other authentication problems after installing cumulative updates released during this month’s Patch Tuesday.Kerberos has replaced the NTLM protocol as the default authentication protocol for domain-connected devices on all Windows versions above Windows 2000.

BleepingComputer readers also reported three days ago that the November updates break Kerberos “in situations where you have set the ‘This account supports Kerberos AES 256 bit encryption’ or ‘This account supports Kerberos AES 128 bit encryption’ Account Options set (i.e., msDS-SupportedEncryptionTypes attribute) on user accounts in AD.”

The known issue, actively investigated by Redmond, can affect any Kerberos authentication scenario within affected enterprise environments.

“After installing updates released on November 8, 2022 or later on Windows Servers with the Domain Controller role, you might have issues with Kerberos authentication,” Microsoft explained.

“When this issue is encountered you might receive a Microsoft-Windows-Kerberos-Key-Distribution-Center Event ID 14 error event in the System section of Event Log on your Domain Controller with the below text.”

Errors logged in system event logs on impacted systems will be tagged with a “the missing key has an ID of 1” keyphrase.
“While processing an AS request for target service Affects both client and server platformsThe complete list of affected platforms includes both client and server releases:

* Client: Windows 7 SP1, Windows 8.1, Windows 10 Enterprise LTSC 2019, Windows 10 Enterprise LTSC 2016, Windows 10 Enterprise 2015 LTSB, Windows 10 20H2 or later, and Windows 11 21H2 or later
* Server: Windows Server 2008 SP2 or later, including the latest release, Windows Server 2022.

While Microsoft has started enforcing security hardening for Netlogon and Kerberos beginning with the November 2022 Patch Tuesday, the company says this known issue is not an expected result.

The issue does not impact devices used by home customers and those that aren’t enrolled in an on-premises domain. Also, it doesn’t impact mom-hybrid Azure Active Directory environments and those that don’t have on-premises Active Directory servers.
Trending: A primer on OS Command Injection Attacks
Trending: Offensive Security Tool: Mangle
Microsoft is working on a fix for this known issue and estimates that a solution will be available in the coming weeks.

Redmond has also addressed similar Kerberos authentication problems affecting W[...]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking

Windows Kerberos authentication breaks after November updates | Black Hat Ethical Hacking

Microsoft is investigating a new known issue causing enterprise domain controllers to experience Kerberos sign-in failures and other authentication problems after installing cumulative updates released during this month's Patch Tuesday.

7 viewsedited 10:54

Hacking Articles Tips Tricks Videos Tutorials

Black Hat Ethical Hacking Windows Kerberos authentication breaks after November updates Windows Kerberos authentication breaks after November updatesPost Views: 1 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/09/Patreon.png…

indows systems caused by security updates released as part of November 2020 Patch Tuesday.
Trending: Azov Ransomware is a wiper, destroying data 666 bytes at a time Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-4-300x150.png Russian hacktivists use new Somnia ransomwareNovember 14, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-3-300x150.png Google Pixel screen-lock hack with $70k bug bounty payoutNovember 11, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-2-300x150.png New StrelaStealer malware steals your Outlook, Thunderbird accountsNovember 10, 2022
Reading Time: 4 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/11/Images-for-the-News-posts-1-300x150.png Malicious extension lets attackers control Google Chrome remotelyNovember 9, 2022
Reading Time: 4 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Windows Kerberos authentication breaks after November updates first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 10:54

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials
TeamFiltration : Cross-Platform Framework For Enumerating, Spraying, Exfiltrating, And Backdooring O365 AAD Accounts

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts. See the TeamFiltration wiki page for an introduction into how TeamFiltration works and the Quick Start Guide for how to get up and running!

This tool has been used internally since January 2021 and was publicly released in my talk “Taking a Dumb In The Cloud” during DefCON30. DownloadYou can download the latest precompiled release for Linux, Windows and MacOSX X64

The releases are precompiled into a single application-dependent binary. The size go up, but you do not need DotNetCore or any other dependencies to run them. Usage[�] TeamFiltration V0.3.3.7 PUBLIC, created by @Flangvik @TrustedSec
Usage:

--outpath Output path to store database and exfiltrated information (Needed for all modules)

--config Local path to your TeamFiltration.json configuration file, if not provided will load from the current path

--exfil Load the exfiltration module

--username Override to target a given username that does not exist in the database
--password Override to target a given password that does not exist in the database
--cookie-dump Override to target a given account using it's refresk-cookie-collection

--all Exfiltrate information from ALL SSO resources (Graph, OWA, SharePoint, OneDrive, Teams)
--aad Exfiltrate information from Graph API (domain users and groups)
--teams Exfiltrate information from Teams API (files, chatlogs, attachments, contactlist)
--onedrive Exfiltrate information from OneDrive/SharePoint API (accessible SharePoint files and the users entire OneDrive directory)
--owa Exfiltrate information from the Outlook REST API (The last 2k emails, both sent and received)
--owa-limit Set the max amount of emails to exfiltrate, default is 2k.
--jwt-tokens Exfiltrate JSON formated JTW-tokens for SSO resources (MsGraph,AdGraph, Outlook, SharePoint, OneDrive, Teams)

--spray Load the spraying module

--aad-sso Use SecureWorks recent Azure Active Directory password brute-forcing vuln for spraying
--us-cloud When spraying companies attached to US Tenants (https://login.microsoftonline.us/)
--time-window Defines a time windows where spraying should accour, in the military time format <12:00-19:00--passwords Path to a list of passwords, common weak-passwords will be generated if not supplied
--seasons-only Password generated for spraying will only be based on seasons
--months-only Password generated for spraying will only be based on months
--common-only Spray with the top 20 most common passwords
--combo Path to a combolist of username:password
--exclude Path to a list of emails to exclude from spraying

--sleep-min Minimum minutes to sleep between each full rotation of spraying default=60
--sleep-max Maximum minutes to sleep between each full rotation of spraying default=100
--delay Delay in seconds between each individual authentication attempt. default=0
--push Get Pushover notifications when valid credentials are found (requires pushover keys in config)
--push-locked Get Pushover notifications when an sprayed account gets locked (requires pushover keys in config)
--force Force the spraying to proceed even if there is less the ___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

TeamFiltration : Cross-Platform Framework For Enumerating, Spraying, Exfiltrating, And Backdooring O365 AAD Accounts

TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts.

8 viewsedited 12:33

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials TeamFiltration : Cross-Platform Framework For Enumerating, Spraying, Exfiltrating, And Backdooring O365 AAD Accounts TeamFiltration is a cross-platform framework for enumerating, spraying, exfiltrating, and backdooring O365 AAD accounts.…

ule

--domain Domain to perfom enumeration against, names pulled from statistically-likely-usernames if not provided with --usernames
--usernames Path to a list of usernames to enumerate (emails)
--dehashed Use the dehashed submodule in order to enumerate emails from a basedomain
--validate-msol Validate that the given o365 accounts exists using the public GetCredentialType method (Very RateLimited - Slow 20 e/s)
--validate-teams Validate that the given o365 accounts exists using the Teams API method (Recommended - Super Fast 300 e/s)
--validate-login Validate that the given o365 accounts by attemping to login (Noisy - triggers logins - Fast 100 e/s)

--backdoor Loads the interactive backdoor module

--database Loads the interactive database browser module

--debug Add burp as a proxy on 127.0.0.1:8080

Examples:

--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --spray --sleep-min 120 --sleep-max 200 --push
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --spray --push-locked --months-only --exclude C:\Clients\2021\FooBar\Exclude_Emails.txt
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --spray --passwords C:\Clients\2021\FooBar\Generic\Passwords.txt --time-window 13:00-22:00
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --exfil --all
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --exfil --aad
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --exfil --teams --owa --owa-limit 5000
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --debug --exfil --onedrive
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --enum --validate-teams
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --enum --validate-msol --usernames C:\Clients\2021\FooBar\OSINT\Usernames.txt
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --backdoor
--outpath C:\Clients\2021\FooBar\TFOutput --config myCustomConfig.json --database Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

5 viewsedited 12:33

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
run system from repair console windows 10/11

Hi. I'm trying to add administrator rights to existing local account using console from repair mode, but it opens in another system. How can I come into system where are sawed my account and use there net command

submitted by /u/michael_947
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

run system from repair console windows 10/11

Hi. I'm trying to add administrator rights to existing local account using console from repair mode, but it opens in another system. How can I...

6 viewsedited 13:08

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Motivated young man with an assortment of skills I believe uniquely qualifies me to be work as a CIA case officer or similar position. I am self trained and highly disciplined self described modern day James Bond.

I would like to utilize my natural born talents as a case officer working abroad. Recruiting assets and extracting intelligence. Ideally I would like to go under "deep cover". I am not sure if you call it "deep cover", but they say that a lot in the movies. You can fill me in on the proper terminology, and all the highly classified information I will need working as a case officer abroad.

How can I prove myself? Like prove myself as a James Bond level asset?

submitted by /u/Key_Abbreviations971
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Motivated young man with an assortment of skills I believe...

I would like to utilize my natural born talents as a case officer working abroad. Recruiting assets and extracting intelligence. Ideally I would...

6 viewsedited 13:08

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
understanding IT stack at my employer

I have been meaning to ask this for a while but wasn't sure how to phrase it; so I work in an IT company in a non-tech role.

It is a somewhat mid-sized company with about 350 employees. If I want to dig around on the technology, architecture, source code, and basically the IT stack of the company, how should I begin - just general guidelines?

IT and non-IT functions are somewhat insulated & we get to know about tech updates only through product announcements. This company makes products for customer support functions & basically everything is on AWS.

I have a working knowledge of shell scripting & can dabble in Python.

submitted by /u/privategod
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

understanding IT stack at my employer

I have been meaning to ask this for a while but wasn't sure how to phrase it; so I work in an IT company in a non-tech role. It is a somewhat...

5 viewsedited 13:08

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Is it possible to see someone’s location with iPhone even if they haven’t shared it with you?

One of our close friends who lives abroad has not answered their phone in over a week. They were supposed to be visiting home yesterday, but they did not come off their flight. Is it possible to track someone’s last known location ?

submitted by /u/Ihatebuttonss
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Is it possible to see someone’s location with iPhone even if they...

One of our close friends who lives abroad has not answered their phone in over a week. They were supposed to be visiting home yesterday, but they...

5 viewsedited 13:08

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Possible email verification phishing attempt through iOS?

Hello reddit 👋

A family member recently sent me a message asking about a notification they are receiving on iPhone. It's a pretty standard Gmail popup asking for account rights, as you'd find with any other time an app tries to access your Gmail account.

However, the rights request is sent by "iOS"...not Apple. So in the main flag of the notification, it shows "iOS wants to access your Gmail account". They claim they've done nothing that would logically trigger this and also strangely, in the footnote, it indicates "see iOS's privacy policy". Would this not say Apple instead of iOS?

Anyway, long story short, I wonder if this is some type of sophisticated phishing attempt using malware to produce these notifications. We both live in a country that has been the target of many cyber attacks of late and they work in a particularly "valuable" industry.

Sorry in advance if this seems a bit vague, I've attempted to research this but as of current there doesn't seem to be anyone else posting / writing about this.

submitted by /u/deazy97
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Possible email verification phishing attempt through iOS?

Hello reddit 👋 A family member recently sent me a message asking about a notification they are receiving on iPhone. It's a pretty standard Gmail...

5 viewsedited 13:08

Hacking Articles Tips Tricks Videos Tutorials

Dismember - Scan Memory For Secrets And More
http://www.kitploit.com/2022/11/dismember-scan-memory-for-secrets-and.html

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Dismember - Scan Memory For Secrets And More

4 viewsedited 13:10

Hacking Articles Tips Tricks Videos Tutorials

6 views13:10

Hacking Articles Tips Tricks Videos Tutorials

Dismember is a command-line toolkit for Linux that can be used to scan the memory of all processes (or particular ones) for common secrets (https://www.kitploit.com/search/label/Secrets) and custom regular expressions, among other things. It will eventually become a full /proc toolkit. Using the grep command, it can match a regular expression (https://www.kitploit.com/search/label/Regular%20Expression) across all memory for all (accessible) processes. This could be used to find sensitive data in memory, identify a process by something included in its memory, or to interrogate a processes' memory for interesting information. There are many built-in patterns included via the scan command, which effectively works as a secret scanner (https://www.kitploit.com/search/label/Scanner) against the memory on your machine. Dismember can be used to search memory of all processes it has access to, so running it as root is the most effective method. Commands are also included to list processes, explore process status and related information, draw process trees, and more...
Main Commands Command Description grep Search process memory for a given string or regex scan Search process memory for a set of predefined secret patterns Utility Commands Command Description files Show a list of files being accessed by a process find Find a PID given a process name. If multiple processes match, the first one is returned. info Show information about a process kernel Show information about the kernel kill Kill a process (or processes) using SIGKILL list List all processes currently available on the system resume Resume a suspended process using SIGCONT suspend Suspend a process using SIGSTOP (use 'dismember resume' to leave suspension) tree Show a tree diagram (https://www.kitploit.com/search/label/Diagram) of a process and all children (defaults to PID 1). Installation Grab a binary from the latest release (https://github.com/liamg/dismember/releases/latest) and add it to your path. Usage Examples Search for a pattern in a process by PID # search memory owned by process 1234
dismember grep -p 1234 'the password is .*' Search for a pattern in a process by name # search memory owned by processes named "nginx" for a login form submission
dismember grep -n nginx 'username=liamg&password=.*' Search for a pattern across all processes # find a github api token across all processes
dismember grep 'gh[pousr]_[0-9a-zA-Z]{36}' Search for secrets in memory across all processes # search all accessible memory for common secrets
dismember scan FAQ Isn't this information all just sitting in /proc? Pretty much. Dismember just reads and presents it for the most part. If you can get away with grep whatever /proc/[pid]/blah then go for it! I built this as an educational experience because I couldn't sleep one night and stayed up late reading the proc man-pages (I live an extremely rock 'n' roll lifestyle). It's not a replacement for existing tools, but perhaps it can complement them. Do you know how horrific some of these commands seem when read out of context? Yes (https://twitter.com/liam_galvin/status/1540375769049960448).

Download Dismember (https://github.com/liamg/dismember)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.

6 viewsedited 13:10

Hacking Articles Tips Tricks Videos Tutorials

Encryption which i don't know help please
https://www.reddit.com/r/Pentesting/comments/yvwpmw/encryption_which_i_dont_know_help_please/

Do anyone have idea about this encryption start with = “U2FsdGVk5X11” submitted by /u/l_l__R4v4N__l__l (https://www.reddit.com/user/l_l__R4v4N__l__l)
[link] (https://www.reddit.com/r/Pentesting/comments/yvwpmw/encryption_which_i_dont_know_help_please/) [comments] (https://www.reddit.com/r/Pentesting/comments/yvwpmw/encryption_which_i_dont_know_help_please/)

___________________________
@hacking_Attack
@Hacking_Video

Encryption which i don't know help please

Do anyone have idea about this encryption start with = “U2FsdGVk5X11”

6 viewsedited 13:41

Hacking Articles Tips Tricks Videos Tutorials

4 views13:55

Hacking Articles Tips Tricks Videos Tutorials

4 views13:55