Sparse plaintext If you know little contiguous plaintext (between 8 and 11 bytes), but know some bytes at some other known offsets, you can provide this information to reach the requirement of a total of 12 known bytes. To do so, use the -x flag followed by an offset and bytes in hexadecimal. bkcrack -c cipherfile -p plainfile -x 25 4b4f -x 30 21
Number of threads If bkcrack was built with parallel mode enabled, the number of threads used can be set through the environment variable OMP_NUM_THREADS. Decipher If the attack is successful, the deciphered data associated to the ciphertext used for the attack can be saved: bkcrack -c cipherfile -p plainfile -d decipheredfile
If the keys are known from a previous attack, it is possible to use bkcrack to decipher data: bkcrack -c cipherfile -k 12345678 23456789 34567890 -d decipheredfile
Decompress The deciphered data might be compressed depending on whether compression (https://www.kitploit.com/search/label/Compression) was used or not when the zip file was created. If deflate compression was used, a Python 3 script provided in the tools folder may be used to decompress data. python3 tools/inflate.py < decipheredfile > decompressedfile
Unlock encrypted archive It is also possible to generate a new encrypted archive with the password of your choice: bkcrack -C encrypted.zip -k 12345678 23456789 34567890 -U unlocked.zip password
The archive generated this way can be extracted using any zip file utility with the new password. It assumes that every entry was originally encrypted with the same password. Recover password Given the internal keys, bkcrack can try to find the original password. You can look for a password up to a given length using a given character set: bkcrack -k 1ded830c 24454157 7213b8c5 -r 10 ?p
You can be more specific by specifying a minimal password length: bkcrack -k 18f285c6 881f2169 b35d661d -r 11..13 ?p
Learn A tutorial is provided in the example folder. For more information, have a look at the documentation and read the source. Contribute Do not hesitate to suggest improvements or submit pull requests on GitHub (https://github.com/kimci86/bkcrack). License This project is provided under the terms of the zlib/png license (http://opensource.org/licenses/Zlib).
Download Bkcrack (https://github.com/kimci86/bkcrack)
Number of threads If bkcrack was built with parallel mode enabled, the number of threads used can be set through the environment variable OMP_NUM_THREADS. Decipher If the attack is successful, the deciphered data associated to the ciphertext used for the attack can be saved: bkcrack -c cipherfile -p plainfile -d decipheredfile
If the keys are known from a previous attack, it is possible to use bkcrack to decipher data: bkcrack -c cipherfile -k 12345678 23456789 34567890 -d decipheredfile
Decompress The deciphered data might be compressed depending on whether compression (https://www.kitploit.com/search/label/Compression) was used or not when the zip file was created. If deflate compression was used, a Python 3 script provided in the tools folder may be used to decompress data. python3 tools/inflate.py < decipheredfile > decompressedfile
Unlock encrypted archive It is also possible to generate a new encrypted archive with the password of your choice: bkcrack -C encrypted.zip -k 12345678 23456789 34567890 -U unlocked.zip password
The archive generated this way can be extracted using any zip file utility with the new password. It assumes that every entry was originally encrypted with the same password. Recover password Given the internal keys, bkcrack can try to find the original password. You can look for a password up to a given length using a given character set: bkcrack -k 1ded830c 24454157 7213b8c5 -r 10 ?p
You can be more specific by specifying a minimal password length: bkcrack -k 18f285c6 881f2169 b35d661d -r 11..13 ?p
Learn A tutorial is provided in the example folder. For more information, have a look at the documentation and read the source. Contribute Do not hesitate to suggest improvements or submit pull requests on GitHub (https://github.com/kimci86/bkcrack). License This project is provided under the terms of the zlib/png license (http://opensource.org/licenses/Zlib).
Download Bkcrack (https://github.com/kimci86/bkcrack)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Evil-Twin attack With Airgeddon
https://cdn-images-1.medium.com/max/711/1*OWsrTPskUGbTmzHXZGbXnQ.png
An Evil Twin attack is a type of wireless network attack in which an attacker sets up a fake wireless access point (AP) that mimics the…
Continue reading on Medium »
Evil-Twin attack With Airgeddon
https://cdn-images-1.medium.com/max/711/1*OWsrTPskUGbTmzHXZGbXnQ.png
An Evil Twin attack is a type of wireless network attack in which an attacker sets up a fake wireless access point (AP) that mimics the…
Continue reading on Medium »
Hacking on Medium
Ransomware Simulation with PowerShell: Psransom
https://cdn-images-1.medium.com/max/938/1*vq-ui7TK_kjqoytMWXT_WA.png
I’m back again this year with a new concept for a project that you can use in your organisation as a table top exercise.This helps cyber…
Continue reading on Medium »
Ransomware Simulation with PowerShell: Psransom
https://cdn-images-1.medium.com/max/938/1*vq-ui7TK_kjqoytMWXT_WA.png
I’m back again this year with a new concept for a project that you can use in your organisation as a table top exercise.This helps cyber…
Continue reading on Medium »
Medium
Ransomware Simulation with PowerShell: Psransom
I’m back again this year with a new concept for a project that you can use in your organisation as a table top exercise.This helps cyber…
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Hack Into Random CCTV Cameras
https://cdn-images-1.medium.com/max/1071/1*M2EMZCyIxPN19XKi2Mc6Aw.png
We can scan the web for random CCTV cameras around the world and start to view them based on their geolocation or countries.
Continue reading on Medium »
Hack Into Random CCTV Cameras
https://cdn-images-1.medium.com/max/1071/1*M2EMZCyIxPN19XKi2Mc6Aw.png
We can scan the web for random CCTV cameras around the world and start to view them based on their geolocation or countries.
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Connecting to WIFI Router Using MAC Address Filter is A Bad Idea (Real Life Scenario)
https://cdn-images-1.medium.com/max/854/1*JWVVK8R2mbLQLGmGJh5a3w.png
What happened is, I went to my cousin house and asked to connect to his WIFI router, the thing is, he asked me for my phone MAC address…
Continue reading on Medium »
Connecting to WIFI Router Using MAC Address Filter is A Bad Idea (Real Life Scenario)
https://cdn-images-1.medium.com/max/854/1*JWVVK8R2mbLQLGmGJh5a3w.png
What happened is, I went to my cousin house and asked to connect to his WIFI router, the thing is, he asked me for my phone MAC address…
Continue reading on Medium »
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
Bug Bounty Guide and Tools
https://cdn-images-1.medium.com/max/762/1*5uRoSFWjhO-V8ldiAqegrA.png
What is Bug Bounty Program?
Continue reading on Medium »
Bug Bounty Guide and Tools
https://cdn-images-1.medium.com/max/762/1*5uRoSFWjhO-V8ldiAqegrA.png
What is Bug Bounty Program?
Continue reading on Medium »
Hacking on Medium
How To Hack Social Media Accounts Using AdvPhishing
https://cdn-images-1.medium.com/max/2128/1*x37VA-crobdWObTAkyosMA.png
AdvPhishing is a phishing tool which allows the user to access accounts on social media even if two-factor authentication is activated…
Continue reading on Medium »
How To Hack Social Media Accounts Using AdvPhishing
https://cdn-images-1.medium.com/max/2128/1*x37VA-crobdWObTAkyosMA.png
AdvPhishing is a phishing tool which allows the user to access accounts on social media even if two-factor authentication is activated…
Continue reading on Medium »
Medium
How To Hack Social Media Accounts Using AdvPhishing
AdvPhishing is a phishing tool which allows the user to access accounts on social media even if two-factor authentication is activated…
Hacking on Medium
Understanding Wi-Fi Deauthentication
https://cdn-images-1.medium.com/max/960/1*f-etcEbkNSr-ArbWuIWRzA.jpeg
Wi-Fi deauthentication is a technique used by hackers to disconnect a device from a Wi-Fi network. This can be done by exploiting…
Continue reading on Medium »
Understanding Wi-Fi Deauthentication
https://cdn-images-1.medium.com/max/960/1*f-etcEbkNSr-ArbWuIWRzA.jpeg
Wi-Fi deauthentication is a technique used by hackers to disconnect a device from a Wi-Fi network. This can be done by exploiting…
Continue reading on Medium »
Medium
Understanding Wi-Fi Deauthentication
Wi-Fi deauthentication is a technique used by hackers to disconnect a device from a Wi-Fi network. This can be done by exploiting…
Hacking on Medium
10 Most Dangerous Commands in Linux
https://cdn-images-1.medium.com/max/728/1*gEhvn-23a9v_VNXjGbVt2A.jpeg
WARNNING NEVER TRY THIS AT HOME … OR WORK
Continue reading on Medium »
10 Most Dangerous Commands in Linux
https://cdn-images-1.medium.com/max/728/1*gEhvn-23a9v_VNXjGbVt2A.jpeg
WARNNING NEVER TRY THIS AT HOME … OR WORK
Continue reading on Medium »
Medium
10 Most Dangerous Commands in Linux
WARNNING NEVER TRY THIS AT HOME … OR WORK
✅ Best commands for Port Scanning — For OSCP, pentests, bug bounties
In a penetration testing engagement, scanning is a very important phase in which we get to know better the potential vulnerabilities of…Continue reading on Medium »
Read more...
In a penetration testing engagement, scanning is a very important phase in which we get to know better the potential vulnerabilities of…Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Offensive Security Tool: Freeze
Offensive Security Tool: FreezePost Views: 109 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes FreezeFreeze by Optiv is a payload creation tool used for circumventing EDR security controls to execute shellcode in a stealthy manner. Freeze utilizes multiple techniques to not only remove Userland EDR hooks but to also execute shellcode in such a way that it circumvents other endpoint monitoring controls. A great tool for the Red Team, Pentesters for Post Exploitation techniques, especially bypassing methodologies used with hooks and shellcode being executed to get a shell.
See Also: So you want to be a hacker? Offensive Security Courses Creating A Suspended ProcessWhen a process is created, Ntdll.dll is the first DLL that is loaded. This happens before any EDR DLLs are loaded. This means that there is a bit of a delay before an EDR can be loaded and start hooking and modifying the assembly of system DLLs. In looking at Windows syscalls in Ntdll.dll, we can see that nothing is hooked yet. If we create a process in a suspend state (one that is frozen in time), we can see that no other DLLs are loaded, except for Ntdll.dll. You can also see that no EDR DLLs are loaded, meaning that the syscalls located in Ntdll.dll are unmodified.
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Suspended_Process.png Address Space Layout RandomizationIn order to use this clean suspended process to remove hooks from Freeze loader, we need a way to programmatically find and read the clean suspended process’ memory. This is where address space layout randomization (ASLR) comes into play. ASLR is a security mechanism to prevent stack memory corruption-based vulnerabilities. ASLR randomizes the address space inside of a process, to ensure that all memory-mapped objects, the stack, the heap, and the executable program itself, are unique. Now, this is where it gets interesting because while ASLR works, it does not work for position-independent code such as DLLs. What happens with DLLs, (specifically known system DLLs) is that the address space is randomized once at boot time. This means that we don’t need to enumerate a remote process information to find the base address of its ntdll.dll because it is the same in all processes including the one that we control. Since the address of every DLL is the same place per boot, we can pull this information from our own process and never have to enumerate the suspended process to find the address.
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Base_Address-1024x385.png
With this information, we can use the API ReadProcessMemory to read a process’ memory. This API call is commonly associated with the reading of LSASS as part of any credential-based attack; however, on its own it is inherently not malicious, especially if we are just reading an arbitrary section of memory. The only time ReadProcessMemory will be flagged as part of something suspicious is if you are reading something you shouldn’t (like the contents of LSASS). EDR products should never flag the fact that ReadProcessMemory was called, as there are legitimate operational uses for this function and would result in many false positives.
We can take this a step further by only reading a section of Ntdll.dll where all syscalls are stored – its .text section, rather than reading the entire DLL.
Combining these elements, we can programmatically get a copy of the .text section of Ntdll.dll to overwrite our existing hooked .text section prior to executing shellcode.
Trending: Digital Forensics Tool: Dangerzone
Trending: Offensive Security Tool: OrbitalDump ETW PatchingETW utilizes built-in syscalls to generate this telem[...]
Offensive Security Tool: Freeze
Offensive Security Tool: FreezePost Views: 109 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes FreezeFreeze by Optiv is a payload creation tool used for circumventing EDR security controls to execute shellcode in a stealthy manner. Freeze utilizes multiple techniques to not only remove Userland EDR hooks but to also execute shellcode in such a way that it circumvents other endpoint monitoring controls. A great tool for the Red Team, Pentesters for Post Exploitation techniques, especially bypassing methodologies used with hooks and shellcode being executed to get a shell.
See Also: So you want to be a hacker? Offensive Security Courses Creating A Suspended ProcessWhen a process is created, Ntdll.dll is the first DLL that is loaded. This happens before any EDR DLLs are loaded. This means that there is a bit of a delay before an EDR can be loaded and start hooking and modifying the assembly of system DLLs. In looking at Windows syscalls in Ntdll.dll, we can see that nothing is hooked yet. If we create a process in a suspend state (one that is frozen in time), we can see that no other DLLs are loaded, except for Ntdll.dll. You can also see that no EDR DLLs are loaded, meaning that the syscalls located in Ntdll.dll are unmodified.
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Suspended_Process.png Address Space Layout RandomizationIn order to use this clean suspended process to remove hooks from Freeze loader, we need a way to programmatically find and read the clean suspended process’ memory. This is where address space layout randomization (ASLR) comes into play. ASLR is a security mechanism to prevent stack memory corruption-based vulnerabilities. ASLR randomizes the address space inside of a process, to ensure that all memory-mapped objects, the stack, the heap, and the executable program itself, are unique. Now, this is where it gets interesting because while ASLR works, it does not work for position-independent code such as DLLs. What happens with DLLs, (specifically known system DLLs) is that the address space is randomized once at boot time. This means that we don’t need to enumerate a remote process information to find the base address of its ntdll.dll because it is the same in all processes including the one that we control. Since the address of every DLL is the same place per boot, we can pull this information from our own process and never have to enumerate the suspended process to find the address.
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Base_Address-1024x385.png
With this information, we can use the API ReadProcessMemory to read a process’ memory. This API call is commonly associated with the reading of LSASS as part of any credential-based attack; however, on its own it is inherently not malicious, especially if we are just reading an arbitrary section of memory. The only time ReadProcessMemory will be flagged as part of something suspicious is if you are reading something you shouldn’t (like the contents of LSASS). EDR products should never flag the fact that ReadProcessMemory was called, as there are legitimate operational uses for this function and would result in many false positives.
We can take this a step further by only reading a section of Ntdll.dll where all syscalls are stored – its .text section, rather than reading the entire DLL.
Combining these elements, we can programmatically get a copy of the .text section of Ntdll.dll to overwrite our existing hooked .text section prior to executing shellcode.
Trending: Digital Forensics Tool: Dangerzone
Trending: Offensive Security Tool: OrbitalDump ETW PatchingETW utilizes built-in syscalls to generate this telem[...]
Hacking Articles Tips Tricks Videos Tutorials
Black Hat Ethical Hacking Offensive Security Tool: Freeze Offensive Security Tool: FreezePost Views: 109 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode. Reading Time:…
etry. Since ETW is also a native feature built into Windows, security products do not need to “hook” the ETW syscalls to access the information. As a result, to prevent ETW, Freeze patches numerous ETW syscalls, flushing out the registers and returning the execution flow to the next instruction. Patching ETW is now default in all loaders. ShellcodeSince only Ntdll.dll is restored, all subsequent calls to execute shellcode need to reside in Ntdll.dll. Using Go (note you can do this in other languages but in Go, its quite easy to implement) we can define and call the NT syscalls needed to allocate, write, and protect the shellcode, effectively skipping the standard calls that are located in kernel32d.dll, and Kernelbase.dll, as these may still be hooked.
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Syscalls-1024x172.png
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Userland_EDR-1024x548.png
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Kernel_EDR-1024x659.png
See Also: Hacking Stories: Operation OpRussia – Anonymous attacks on Russia InstallTo install Freeze, run the following commands, or use the compiled binary:
If the -console command-line option is selected, Freeze will not hide the process in the background. Instead, Freeze will add several debug messages displaying what the loader is doing. More InformationIf you want to learn more about the techniques utilized in this framework, please take a look at SourceZero Blog
Clone the repo from here: GitHub Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Dangerzone-300x150.png Digital Forensics Tool: DangerzoneJanuary 6, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/psudohash-300x150.png Offensive Security Tool: PsudohashDecember 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/OrbitalDump-300x150.png Offensive Security Tool: OrbitalDumpDecember 29, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/image-300x150.png Recon Tool: MFASweepDecember 23, 2022 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Offensive Security Tool: Freeze first appeared on Black Hat Ethical Hacking.
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Syscalls-1024x172.png
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Userland_EDR-1024x548.png
https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Kernel_EDR-1024x659.png
See Also: Hacking Stories: Operation OpRussia – Anonymous attacks on Russia InstallTo install Freeze, run the following commands, or use the compiled binary:
go build Freeze.goHelphttps://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Help-1024x505.png Binary vs DLLFreeze can generate either a .exe or .dll file. In order to specify this, ensure that the -O command line option ends with either a .exe for binaries or .dll for dlls. No other file types are currently supported. In the case of DLL files, Freeze can also add additional export functionality. To do this use the -export with specific export function name. ConsoleFreeze utilizes a technique to first create the process and then move it into the background. This does two things – first it helps keep the process hidden, and second, avoids being detected by any EDR product. Spawning a process right away in the background can be very suspicious and an indicator of maliciousness. Freeze does this by calling the ‘GetConsoleWindow’ and ‘ShowWindow’ Windows function after the process is created and the EDR’s hooks are loaded, and then changes the windows attributes to hidden. Freeze utilizes these APIs rather than using the traditional -ldflags -H=windowsgui, as this is highly signatured and classified in most security products as an Indicator of Compromise.If the -console command-line option is selected, Freeze will not hide the process in the background. Instead, Freeze will add several debug messages displaying what the loader is doing. More InformationIf you want to learn more about the techniques utilized in this framework, please take a look at SourceZero Blog
Clone the repo from here: GitHub Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Dangerzone-300x150.png Digital Forensics Tool: DangerzoneJanuary 6, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/psudohash-300x150.png Offensive Security Tool: PsudohashDecember 30, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/OrbitalDump-300x150.png Offensive Security Tool: OrbitalDumpDecember 29, 2022
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/image-300x150.png Recon Tool: MFASweepDecember 23, 2022 https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Offensive Security Tool: Freeze first appeared on Black Hat Ethical Hacking.