FarsightAD - PowerShell Script That Aim To Help Uncovering (Eventual) Persistence Mechanisms Deployed By A Threat Actor Following An Active Directory Domain Compromise
http://www.kitploit.com/2022/12/farsightad-powershell-script-that-aim.html

Non-default (as defined in the Microsoft documentation) ACLs are identified and potentially dangerous ACEs are highlighted. Export-ADHuntingACLPrivilegedObjects Export the ACL configured on the privileged objects in the domain and highlight potentially dangerous access rights. Export-ADHuntingADCSCertificateTemplates Export information and access rights (https://www.kitploit.com/search/label/Access%20Rights) on certificate templates.

The following notable parameters are retrieved: certificate template publish status, certificate usage, if the subject is constructed from user-supplied data, and access control (enrollment / modification). Export-ADHuntingADCSPKSObjects Export information and access rights on sensitive PKS objects (NTAuthCertificates, certificationAuthority, and pKIEnrollmentService). Export-ADHuntingGPOObjectsAndFilesACL Export ACL access rights information on GPO objects and files, highlighting GPOs are applied on privileged users or computers. Export-ADHuntingGPOSettings Export information on various settings configured by GPOs that could be leveraged for persistence (privileges and logon rights, restricted groups membership, scheduled and immediate tasks V1 / V2, machine and user logon / logoff scripts). Export-ADHuntingHiddenObjectsWithDRSRepData Export the objects' attributes that are accessible through replication (with the Directory Replication Service (DRS) protocol) but not by direct query.

Access control are not taken into account for replication operations, which allows to identify access control blocking access to specific objects attribute(s).

Only a limited set of sensitive attributes are assessed. Export-ADHuntingKerberosDelegations Export the Kerberos delegations that are considered dangerous (unconstrained, constrained to a privileged service, or resources-based constrained on a privileged service). Export-ADHuntingPrincipalsAddedViaMachineAccountQuota Export the computers that were added to the domain by non-privileged principals (using the ms-DS-MachineAccountQuota mechanism). Export-ADHuntingPrincipalsCertificates Export parsed accounts' certificate(s) (for accounts having a non empty userCertificate attribute).

The certificates (https://www.kitploit.com/search/label/Certificates) are parsed to retrieve a number of parameters: certificate validity timestamps, certificate purpose, certificate subject and eventual SubjectAltName(s), ... Export-ADHuntingPrincipalsDontRequirePreAuth Export the accounts that do not require Kerberos pre-authentication. Export-ADHuntingPrincipalsOncePrivileged Export the accounts that were once member of privileged groups. Export-ADHuntingPrincipalsPrimaryGroupID Export the accounts that have a non default primaryGroupID attribute, highlighting RID linked to privileged groups. Export-ADHuntingPrincipalsPrivilegedAccounts Export detailed information about members of privileged groups. Export-ADHuntingPrincipalsPrivilegedGroupsMembership Export privileged groups' current and past members, retrieved using replication metadata. Export-ADHuntingPrincipalsSIDHistory Export the accounts that have a non-empty SID History attribute, with resolution of the associated domain and highlighting of privileged SIDs. Export-ADHuntingPrincipalsShadowCredentials Export parsed Key Credentials (https://www.kitploit.com/search/label/Credentials) information (of accounts having a non-empty msDS-KeyCredentialLink attribute). Export-ADHuntingPrincipalsTechnicalPrivileged Export the technical privileged accounts (SERVER_TRUST_ACCOUNT and INTERDOMAIN_TRUST_ACCOUNT). Export-ADHuntingPrincipalsUPNandAltSecID Export the accounts that define a UserPrincipalName or AltSecurityIdentities attribute, highlighting potential anomalies. Export-ADHuntingTrusts Export the trusts of all the domains in the forest.

A number of parameters are retrieved for each trust: transivity, SID filtering, TGT delegation. More information on each cmdlet usage can be retrieved using Get-Help -Full . Demo Fully / partially hidden objects detection

Adding a fully hidden user

Hacking on Medium
FreeBSD: The Ultimate Solution for Frustrated Users

https://cdn-images-1.medium.com/max/728/1*4yvjqnmA4i9WKI6PK8r82w.jpeg
Tired of feeling like your system is out of control? Switch to FreeBSD for stability, security, and performance!

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
TGA Weekly Newsletter [12/14/22]

https://cdn-images-1.medium.com/max/842/1*B0Evnj_FH8GfslhT5984dA.png
The Gray Area’s newsletter from 12/07/22 → 12/14/22, with this week’s must-reads.

Continue reading on The Gray Area »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Bluebugging Explained and How can we safeguard our devices from it?

https://cdn-images-1.medium.com/max/1181/0*Mkk0I5kC14pw3ciQ.jpg
Bluetooth is an incredibly convenient technology that allows us to connect our devices wirelessly. But, while it’s a great tool, there are…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
Setting up the Arduino RP2040 Connect to use with MicroPython

https://cdn-images-1.medium.com/max/1920/1*3uaFX3X-YXMl0TmImt5qBQ.png
After my initial excitement and subsequent purchase following the release of the RP2040 Connect with support for micropython, that…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
HACK THE BOX — MetaTwo WALKTHROUGH

https://cdn-images-1.medium.com/max/700/1*W9KKMdPvgTt7E6x7tVYGKQ.png
In this write up we’re going to solve a box on hack the box called “MetaTwo”

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Dark Reading: Attacks/Breaches
Cybersecurity Drives Improvements in Business Goals

Deloitte's Future of Cyber study highlights the fact that cybersecurity is an essential part of business success and should not be limited to just mitigating IT risks.

Black Hat Ethical Hacking
Apple security update fixes new iOS zero-day used to hack iPhones

Apple security update fixes new iOS zero-day used to hack iPhonesPost Views: 114 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes In security updates released today, Apple has fixed the tenth zero-day vulnerability since the start of the year, with this latest one actively used in attacks against iPhones.The vulnerability was disclosed in security bulletins released today for iOS/iPadOS 15.7.2, Safari 16.2, tvOS 16.2, and macOS Ventura 13.1, with Apple warning that the flaw “may have been actively exploited” against previous versions.

The bug (CVE-2022-42856) is a type confusion issue in Apple’s Webkit web browser browsing engine.

The flaw was discovered by Clément Lecigne of Google’s Threat Analysis Group, allowing maliciously crafted web content to perform arbitrary code execution on a vulnerable device.

Arbitrary code execution could allow the malicious site to execute commands in the operating system, deploy additional malware or spyware, or perform other malicious actions.

Apple addressed the zero-day vulnerability with improved state handling for the following devices iPhone 6s (all models), iPhone 7 (all models), iPhone SE (1st generation), iPad Pro (all models), iPad Air 2 and later, iPad 5th generation and later, iPad mini 4 and later, and iPod touch (7th generation).
See Also: So you want to be a hacker? Complete Offensive Security and Ethical Hacking Course Patch your iPhones, iPads, and macOS VenturaWhile Apple has disclosed that threat actors actively exploited the vulnerability, they have yet to provide any details on the attacks.

However, as the vulnerability was discovered by Clément Lecigne of Google’s Threat Intelligence Team, we will likely learn more in a future blog post.

This delay in providing details is commonly done to allow users to patch their devices before other threat actors analyze the fixes and develop their own exploits.

Even though this zero-day flaw was likely used in highly-targeted attacks, it is still suggested to install today’s security updates as soon as possible.
Trending: Exploit XSS Injections in a one-line powerful Technique Trending: Offensive Security Tool: Pycrypt This is the tenth zero-day fixed by Apple since the start of the year:

* In October, Apple fixed a zero-day in the iOS Kernel (CVE-2022-42827).
* In September, Apple addressed a flaw in the iOS Kernel (CVE-2022-32917).
* In August, it fixed two more zero-days in the iOS Kernel (CVE-2022-32894) and WebKit (CVE-2022-32893)
* In March, Apple patched two zero-day in the Intel Graphics Driver (CVE-2022-22674) and AppleAVD (CVE-2022-22675).
* In February, Apple released security updates to address another WebKit zero-day bug exploited to target iPhones, iPads, and Macs.
* In January, Apple patched another pair of zero-days allowing code execution with kernel privileges (CVE-2022-22587) and web browsing activity tracking (CVE-2022-22594).
Trending: Kali Linux 2022.4 – New Release adds 6 new tools, Kali NetHunter Update, Azure Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-po[...]

sts-300x150.png New Python malware backdoors VMware ESXi servers for remote accessDecember 13, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/1-300x150.png JSON syntax hack allowed SQL injection payloads to be smuggled past WAFsDecember 12, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-21-300x150.png Cisco discloses high-severity IP phone bug with exploit codeDecember 9, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Images-for-the-News-posts-20-300x150.png New Zerobot malware has 21 exploits for BIG-IP, Zyxel, D-Link devicesDecember 8, 2022
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Apple security update fixes new iOS zero-day used to hack iPhones first appeared on Black Hat Ethical Hacking.