Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: DnsAdmins to DomainAdmin

In this article, we will show you a method for Escalating Privilege on Windows-based Devices when it contains a compromised user of the DnsAdmins Group. Table of Content· Introduction· Setting Up · Enumeration· Exploitation· Indicator of Compromise· ConclusionIn our long series in search for methods to elevate privileges on Windows Devices. Today, we look at DnsAdmins. To able to understand this you need to understand the implantation of DNS on Windows by Microsoft. The Microsoft Team designing DNS integration decided to make the Domain Controller a DNS server by default. To manage that DNS service a group was created by the name of DnsAdmins. Then came the ability for the users of DnsAdmins to run code with elevated privileges that in their eyes was a feature. The DNS Management protocol lies on top of RPC. An executable by the name of dns.exe can be found under C:\Windows\System32\ in Domain Controllers. In an essence, on Domain Controller the DNS server runs as a server. As with every service, it is possible to manage it using an interface that can be found at the dnsmgmt.msc. If you search for all the operations that are required to be supported by the server a R_DnssrvOperation comes into light. It contains the pszOperation parameter. This parameter enables the user that is a part of the DnsAdmins group to load a DLL which it doesn’t even monitor for content. DnsAdmins users can execute this DLL with elevated privilege which makes them susceptible to Privilege Escalation.Setting UpTo set up the conditions in our local environment for able to test the possibility of privilege escalation, we need to create a user. Then add that particular user to the DnsAdmins Group. In the demonstration, we have a domain controller that is all set up with a bunch of devices and users connected to it. We take the jeenali user and select the Add to a group option from the drop-down menu.Enumeration/DetectionThe setup is complete with the jeenali user being a member of the DnsAdmins group. To verify in this case or case we do this demonstration from an attacker perspective to understand what would be the indicators that will point towards and the process through which the attacker would figure out if the target is vulnerable to this kind of privilege escalation. We connect to the jeenali user. We assume that the attacker has control or credentials for this user. After establishing a connection through Evil-WinRM we use the whoami command with the group parameter to enumerate for the groups that the current user i.e., belong to. We see that the jeenali user is a part of the DnsAdmins group. This verifies the setup we did earlier. ExploitationFrom the introduction, we know that the member of the DnsAdmins group can run the DLL file with elevated privileges. To exploit that privilege, we need to craft a malicious DLL file. We will be using msfvenom with the shell_reverse_tc[...]

___________________________
@hacking_Attack
@Hacking_Video

p payload. We name the file raj.dll. The file we created is on our Kali machine. We use the smbserver.py python script from Impacket to host the /root directory as demonstrated below.Indicator of CompromiseWhen the attack using this method is performed, there is an indicator that can help identify the incident. During the attach when we run the command dnscmd.exe, it creates an entry in the Registry of the Target Machine. The same can be checked to obtain the IP address from which the attack was mounted and the DLL file that was used for the compromise. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\DNS\Parameters\ServerLevelPluginDll.https://1.bp.blogspot.com/-TMELLcQqAkI/YJsFvNnt-qI/AAAAAAAAv9s/QZtHAv0yAGYpgnY0pvnJzyPgTdfALj6FwCLcBGAsYHQ/s16000/51.png ConclusionThis article/demonstration presents the attacker with an opportunity to escalate its access after the initial foothold. Being a member of a group can provide direct exploitation to the SYSTEM. Hence, from Blue Teamer’s perspective, it is advised to always authorize proper permissions and make sure the users are not assigned groups that they are not supposed to access. Also, treating the DnsAdmins group with the same attention as the Administrator group.

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
VAST - Visibility Across Space And Time

https://1.bp.blogspot.com/-grMdlRj97Qs/YJgWwgsLzDI/AAAAAAAAWHY/TumORKtPoW8s-pS97L2YTc6TyOOJop90gCNcBGAsYHQ/w640-h370/vast.png The network telemetry engine for data-driven security investigations. Getting Started — Installation — Documentation — Development — Changelog — License and Scientific Use

Chat with us on Gitter, or join us on Matrix at #tenzir_vast:gitter.im. Key Features*
High-Throughput Ingestion: import numerous log formats over 100k events/second, including Zeek, Suricata, JSON, and CSV.

*
Low-Latency Queries: sub-second response times over the entire data lake, thanks to multi-level bitmap indexing and actor model concurrency. Particularly helpful for instant indicator checking over the entire dataset.

*
Flexible Export: access data in common text formats (ASCII, JSON, CSV), in binary form (MRT, PCAP), or via zero-copy relay through Apache Arrow for arbitrary downstream analysis.

*
Powerful Data Model and Query Language: the generic semi-structured data model allows for expressing complex data in a typed fashion. An intuitive query language that feels like grep and awk at scale enables powerful subsetting of data with domain-specific operations, such as top-k prefix search for IP addresses and subset relationships.

*
Schema Pivoting: the missing link to navigate between related events, e.g., extracting a PCAP for a given IDS alert, or locating all related logs for a given query. Get VASTLinux users can download our latest static binary release via browser or cURL. curl -L -O https://storage.googleapis.com/tenzir-public-data/vast-static-builds/vast-static-latest.tar.gzUnpack the archive. It contains three folders bin, etc, and share. To get started invoke the binary in the bindirectory directly. tar xfz vast-static-latest.tar.gz
bin/vast --helpTo install VAST properly for your local user simly place the unpacked folders in /usr/local/.

FreeBSD and macOS users have to build from source. Clone the masterbranch to get the most recent version of VAST. git clone --recursive https://github.com/tenzir/vastOnce you have all dependencies in place, build VAST with the following commands: ./configure
cmake --build build
cmake --build build --target test
cmake --build build --target integration
cmake --build build --target installThe installation guide contains more detailed and platform-specific instructions on how to build and install VAST. Getting StartedHere are some commands to get a first glimpse of what VAST can do for you.

Start a VAST node: vast startIngest Zeek logs of various kinds: zcat *.log.gz | vast import zeekRun a query over the last hour, rendered as JSON: vast export json ':timestamp > 1 hour ago && (6.6.6.6 || 5353/udp)'Ingest a PCAP trace with a 1024-byte flow cutoff: vast import pcap -c 1024 < trace.pcapRun a query over PCAP data, sort the packets by time, and feed them into tcpdump: vast export pcap "sport > 60000/tcp && src !in 10.0.0.0/8" \
| ipsumdump --collate -w - \
| tcpdump -r - -nlLicense and Scientific UseVAST comes with a 3-clause BSD license. When referring to VAST in a scientific context, please use the following citation: @InProceedings{nsdi16:vast,
author = {Matthias Vallentin and Vern Paxson and Robin Sommer},
title = {{VAST: A Unified Platform for Interactive Network Forensics}},
booktitle = {Proceedings of the USENIX Symposium on Networked Systems
Design and Implementation (NSDI)},
month = {March},
year = {2016}
}You can download the paper from the NSDI '16 proceedings.[...]

___________________________
@hacking_Attack
@Hacking_Video

Developed with ❤️ by Tenzir Download Vast

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
A Startup With NSA Roots Wants Silently Disarming Cyberattacks on the Wire to Become the Norm

Trinity Cyber takes a new spin on some traditional network-security techniques, but can its approach catch on widely?

___________________________
@hacking_Attack
@Hacking_Video

Short story about Clubhouse user scraping and social graphs
http://www.kitploit.com/2021/05/short-story-about-clubhouse-user.html

___________________________
@hacking_Attack
@Hacking_Video

TL;DRDuring this RedTeam testing, Hexway team (https://hexway.io/) used Clubhouse as a social engineering tool to find out more about their client’s employees.
UPDATE:While Hexway were preparing this article for publication, cybernews.com reported: 1.3 million scraped user records leaked online for free (https://cybernews.com/security/clubhouse-data-leak-1-3-million-user-records-leaked-for-free-online/)In this research, Hexway didn’t attack Clubhouse users and didn’t exploit any Clubhouse vulnerabilities

___________________________
@hacking_Attack
@Hacking_Video

IntroHi!RedTeam projects have become routine for many pentest companies quite a long time ago. In Hexway, we don’t do them a lot only because our main focus is our collaborative pentesting platform, Hive (https://hexway.io/hive/). But in this case, we couldn’t resist - the project seemed to be very interesting.We won’t go into detail on the project itself but rather focus on one of its parts. So, in this ReadTeam testing, our goal was to compromise the computer of the CTO of a large financial organization, X corp. To achieve that, we needed the CTO to open a docx file with our payload. Naturally, the question was: what’s the best way to deliver that file?Here are some obvious options: - Corporate email - LinkedIn - FacebookInstead, we wanted to try something new. And that’s where Clubhouse comes in.
Clubhouse? What?!Clubhouse is a voice-based social network. It was popular for a couple of weeks in February 2021.At that time, Clubhouse offered us a few advantages: - Huge popularity - Users mostly sign up with their real names, photos, and links to other social media - It’s quite easy to get into a room with interesting people, who are often hard to reach through traditional channels like email, LinkedIn, etc. - Our experience tells us that people are suspicious of cold emails with attachments and don’t open them. But in the context of an informal social platform, they seem to be less alert, which is good for RedTeam.Here’s the plan:Sign up in ClubhouseFind our target in ClubhouseWait until they participate in a room as a speakerJoin the roomTry to engage them in a conversation. Get them interested and move the conversation over to emailSend them an email with the attachment and payloadThe target opens our docxProfit!
First problemsFirst, we registered in Clubhouse. That was easy! We’re looking for our target … and find nothing. We couldn’t find them by their name or nicknames on other platforms. Unfortunately, you can’t search users by profile description or Twitter/Instagram accounts. So, they are not on Clubhouse? Maybe they have an Android? (when this article is written, 06.04.21, Clubhouse is officially available only for iOS)?
This is the way!Okay, chin up. Our target could be using a fake name not to reveal themselves and participate in rooms dedicated to non-work-related topics. It’s time to find out. Let’s try to use the power of social graphs.Here’s the new plan: - Find any X corp employee - Get their list of followers and their accounts - Get the list of users they follow and their accounts - Get the lists of users of the clubs these accounts are in - Filter all these users by “X corp” in the About profile section - Make social graphs to find our target in someone’s connections + invitation chains (down to the first Clubhouse users) + “following” connections + “follower” connectionsTo do all that, we have to parse Clubhouse. There’s no official API, so we used an unofficial API (https://github.com/stypr/clubhouse-py) (thanks to stypr (https://github.com/stypr))!)The library clubhouse-py is pretty easy to use, and we could set up a parser script in no time. Clubhouse returns the following json in response to the API-request get_profileWarning! To demonstrate how graphs work, we’re not going to use real X corp employees’ data.{
"user_profile":{
"user_id":4,
"name":"Rohan Seth",
"displayname":"",
"photo_url":"https://clubhouseprod.s3.amazonaws.com:443/4_b471abef-7c14-43af-999a-6ecd1dd1709c",
"username":"rohan",
"bio":"Cofounder at Clubhouse 👋🏽 (this app!) and Lydian Accelerator 🧬 (non profit for fixing genetic diseases)",
"twitter":"rohanseth",
"instagram":"None",
"num_followers":5502888,
"num_following":636,
"time_created":"2020-03-17T07:51:28.085566+00:00",
"follows_me":false,
"is_blocked_by_network":false,
"mutual_follows_count":0,
"mutual_follows":[],
"notification_type":3,
"invited_by_user_profile":"None",

___________________________
@hacking_Attack
@Hacking_Video

"invited_by_club":"None",
"clubs":[],
"url":"https://www.joinclubhouse.com/@rohan",
"can_receive_direct_payment":true,
"direct_payment_fee_rate":0.029,
"direct_payment_fee_fixed":0.3
},
"success":true
}
Example 1. Get the information about the user chipik and all of their followers and followed the accounts. ~python3 clubhouse-graphs.py -u chipik --followers --following
|------------|-----------|-------------|--------------------------------------------------------------------------------------------|----------|------------------------|---------|-----------|-----------|-----------|------------|-----------------|
| user_id | name | displayname | photo_url | username | bio | twitter | instagram | followers | following | invited by | invited by name |
|------------|-----------|-------------|--------------------------------------------------------------------------------------------|----------|------------------------|---------|-----------|-----------|-----------|------------|-----------------|
| 1964245387 | Dmitry Ch | | https://clubhouseprod.s3.amazonaws.com:443/1964245387_428c3161-1d0e-456e-b2a7-66f82b143094 | chipik | - hacker | _chipik | | 110 | 96 | 854045411 | Al Fova |
| | | | | | - researcher | | | | | | |
| | | | | | - speaker | | | | | | |
| | | | | | | | | | | | |
| | | | | | Do things at hexway.io | | | | | | |
| | | | | | tg: @chpkk | | | | | | |
|------------|-----------|-------------|--------------------------------------------------------------------------------------------|----------|------------------------|---------|-----------|-----------|-----------|------------|-----------------|
Example 2. Get the list of the participants of “Cybersecurity Club”~python3 clubhouse-graphs.py --group 444701692
[INFO ] Getting info about group Cybersecurity Club
[INFO ] Adding member: 1/750
[INFO ] Adding member: 2/750
...
[INFO ] Adding member: 749/750
Done!
Check file ch-group-444701692.html with group's users graphThat’s a graph for all the group members. When hovering over a node, we see the information about the user.

___________________________
@hacking_Attack
@Hacking_Video

We’ve experimented with server request frequency to see if there are any request limits. A few times, we were temporarily blocked for “too frequent use of API”, but the block expired quickly. For all the time we spent testing, our account wasn’t permanently blocked.A few days later, we had a base of 300,000 Clubhouse users somehow connected to X corp.Now, we can search users by different patterns in their bio:
Example 3. Find all users who allegedly work/worked at the WIRED magazine and their followers and followed the accounts.~python3 clubhouse-graphs.py --find_by_bio wired
[INFO ] Searching users with wired in bio
[INFO ] Adding 1/100
[INFO ] Adding 2/100
...
[INFO ] Adding 100/100
Done!
Find graph in ch-search-wired.html fileHere’s the interactive graph with user profiles.

___________________________
@hacking_Attack
@Hacking_Video

wired

Example 4. Clubhouse invitation chainTo sign up in Clubhouse, you need an invitation from a Clubhouse user. We can use that fact as additional evidence of connections between accounts.
~ python3 clubhouse-graphs.py -I kevinmitnick
[INFO ] Getting invite graph for user kevinmitnick
Kevin Mitnick<--Maite Robles
Maite Robles<--Roni Broyde
Roni Broyde<--Alex Eick
Alex Eick<--Summer Elsayed
Summer Elsayed<--Dena Mekawi
Dena Mekawi<--Eric Parker
Eric Parker<--Global Mogul Chale
Kojo Terry Oppong<--Shaka Senghor
Shaka Senghor<--Andrew Chen
Done! Find graph in ch-invitechain-kevinmitnick.html file
Here’s the interactive graph of invitations leading us to Kevin Mitnick.

___________________________
@hacking_Attack
@Hacking_Video

kevin-graph
ResultsWe collected the users, filtered them by jobs, and built a graph showing connections between them (followers, followed, invitations). Thus, we found a user with a dog on a scooter as their profile pic and no bio. This user is followed by almost all the found X corp employees but follows just one of them. Finally, the user’s name contained the target’s initials, so we felt safe to assume it’s them.The hardest part is done. We followed the target from one account and used another one to engage them in a conversation in some small room.Some social engineering magic, and we got their email. After a short chain of letters, we sent them the docx with a payload. A few hours later, we got a shell on their laptop. It’s done!
TakeawaysDo not limit yourself to “standard” social engineering channels.Be careful with the information you put out on social media, especially if it concerns your current or previous employment.Most likely, the popularity of Clubhouse has passed. But there are a lot of users with real data, which can be parsed easily. All that makes us think that someone could already have collected a database of Clubhouse users, and some time later it may end up leaked.P.S. The scripts developed during this project are available in our repository Clubhouse dummy parser and graph generator (CDPaGG) (https://github.com/hexway/Clubhouse-dummy-parser-and-graph-generator)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacker group that goes by “TurtleCorp” has come back to wreak more havoc.

https://cdn-images-1.medium.com/max/828/1*iMtgwh3rjavfMVVt-pigoQ@2x.jpeg
The members go by: “Eagle”, “Trap”, “Verism”, “Plasma”, and “Lith”. The motives behind their attacks are still unclear but they must be…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video