Hacking on Medium
Latest news on next-gen Auth Tech in Korea (May 14, 2021) #Cybersecurity in Korea #White Hat…

https://cdn-images-1.medium.com/max/2600/1*40YUEp6eRdnbUZNXMNOQug.jpeg
Latest news on next-gen Auth Tech in Korea

Continue reading on Medium »

Hacking on Medium
My OSCP Journey

https://cdn-images-1.medium.com/max/1024/1*ycKnjUGZgufiMEbs0Al9rQ.jpeg
How I passed my OSCP on the first attempt. I have written a blog that summarises my journey to get OSCP. This blog contains important…

Continue reading on Medium »

Free Course Site
Developing a Multithreaded Kernel From Scratch!

https://freecoursesite.com/wp-content/uploads/2021/05/985214555.jpg
Build a multitasking operating system and kernel with an interactive shell! What you’ll learn How to create a kernel from scratch How to create a multi-tasking kernel How to handle malicious or problematic programs in your operating system. Terminating them if they misbehave. How memory works in computers The difference between kernel land, user land […]

The post Developing a Multithreaded Kernel From Scratch! appeared first on Free Course Site.

KitPloit - PenTest Tools!
R77-Rootkit - Fileless Ring 3 Rootkit With Installer And Persistence That Hides Processes, Files, Network Connections, Etc...

https://1.bp.blogspot.com/-nUpYJ0HKJJI/YJgjUPPxPcI/AAAAAAAAWIU/Q8DfwgNYBdY0_CWji-F3bnFm6yfGhg5DACNcBGAsYHQ/w640-h402/r77-rootkit_1.png Ring 3 rootkitr77 is a ring 3 Rootkit that hides following entities from all processes:

* Files, directories, junctions, named pipes, scheduled tasks
* Processes
* CPU usage
* Registry keys & values
* Services
* TCP & UDP connections

It is compatible with Windows 7 and Windows 10 in both x64 and x86 editions. Hiding by prefixAll entities where the name starts with "$77"are hidden. https://1.bp.blogspot.com/-t6nvUPFnhvo/YJgjeGyw35I/AAAAAAAAWIc/cXowU9ZVysEmEg1pBoCAQgMZR0QvZD6egCNcBGAsYHQ/w640-h402/r77-rootkit_1.png Configuration SystemThe dynamic configuration system allows to hide processes by PID and by name, file system items by full path, TCP & UDP connections of specific ports, etc. https://1.bp.blogspot.com/-2x8F6vzxiuY/YJgjh5CqpVI/AAAAAAAAWIg/KCalED57W_UAmqFABBagBwIainHM2mHSACNcBGAsYHQ/w640-h348/r77-rootkit_2.png The configuration is stored in HKEY_LOCAL_MACHINE\SOFTWARE\$77configand is writable by any process without elevated privileges. The DACL of this key is set to grant full access to any user.

The $77configkey is hidden when RegEdit is injected with the rootkit. Installerr77 is deployable using a single file "Install.exe". It installs the r77 service that starts before the first user is logged on. This background process injects all currently running processes, as well as processes that spawn later. Two processes are needed to inject both 32-bit and 64-bit processes. Both processes are hidden by ID using the configuration system. Uninstall.exeremoves r77 from the system and gracefully detaches the rootkit from all processes. Child process hookingWhen a process creates a child process, the new process is injected before it can run any of its own instructions. The function NtResumeThreadis always called when a new process is created. Therefore, it's a suitable target to hook. Because a 32-bit process can spawn a 64-bit child process and vice versa, the r77 service provides a named pipe to handle child process injection requests.

In addition, there is a periodic check every 100ms for new processes that might have been missed by child process hooking. This is necessary because some processes are protected and cannot be injected, such as services.exe. In-memory injectionThe rootkit DLL (r77-x86.dll and r77-x64.dll) can be injected into a process from memory and doesn't need to be stored on the disk. Reflective DLL injection is used to achieve this. The DLL provides an exported function that when called, loads all sections of the DLL, handles dependency loading and relocations, and finally calls DllMain. Fileless persistenceThe rootkit resides in the system memory and does not write any files to the disk. This is achieved in multiple stages.

Stage 1: The installer creates two scheduled tasks for the 32-bit and the 64-bit r77 service. A scheduled task does require a file, named $77svc32.joband $77svc64.jobto be stored, which is the only exception to the fileless concept. However, scheduled tasks are also hidden by prefix once the rootkit is running.

The scheduled tasks start powershell.exewith following command line: [Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey('SOFTWARE').GetValue('$77stager')).EntryPoint.Invoke($Null,$Null) The command is inline and does not require a .ps1 script. Here, the .NET Framework capabilities of PowerShell are utilized in order to load a[...]

C# executable from the registry and execute it in memory. Because the command line has a maximum length of 260 (MAX_PATH), there is only enough room to perform a simple Assembly.Load().EntryPoint.Invoke(). https://1.bp.blogspot.com/-Qs9jiVd3h90/YJgjmSczOQI/AAAAAAAAWIo/AVRzugf7K5gDqcYqGCz3gT9qoW8FBny8wCNcBGAsYHQ/w640-h280/r77-rootkit_3.png https://1.bp.blogspot.com/-1Xz7qgcaA0w/YJgjmXMq_0I/AAAAAAAAWIk/Zlk2ZqrCjCs9BH-xZH-fNjwQkaSkBliCwCNcBGAsYHQ/w640-h328/r77-rootkit_4.png Stage 2: The executed C# binary is the stager. It will create the r77 service processes using process hollowing. The r77 service is a native executable compiled in both 32-bit and 64-bit separately. The parent process is spoofed and set to winlogon.exe for additional obscurity. In addition, the two processes are hidden by ID and are not visible in the task manager. https://1.bp.blogspot.com/-5iBktGERTAw/YJgjp9q2PvI/AAAAAAAAWIs/6CypmVISpJo6oa00GMPBZtXNygPJs4Z9ACNcBGAsYHQ/w640-h300/r77-rootkit_5.png No executables or DLL's are ever stored on the disk. The stager is stored in the registry and loads the r77 service executable from its resources.

The PowerShell and .NET dependencies are present in a fresh installation of Windows 7 and Windows 10. Please review the documentation for a complete description of the fileless initialization. HookingDetours is used to hook several functions from ntdll.dll. These low-level syscall wrappers are called by any WinAPI or framework implementation.

* NtQuerySystemInformation
* NtResumeThread
* NtQueryDirectoryFile
* NtQueryDirectoryFileEx
* NtEnumerateKey
* NtEnumerateValueKey
* EnumServiceGroupW
* EnumServicesStatusExW
* NtDeviceIoControlFile

The only exception is advapi32.dll. Two functions are hooked to hide services. This is because the actual service enumeration happens in services.exe, which cannot be injected. Test environmentThe Test Console can be used to inject r77 to or detach r77 from individual processes. https://1.bp.blogspot.com/-2uYmMhxNltk/YJgjtL87hdI/AAAAAAAAWIw/J5_Dm5A9fAQZjYJSTIlzArGqRcKWCruUgCNcBGAsYHQ/w640-h486/r77-rootkit_6.png Technical DocumentationPlease read the technical documentation to get a comprehensive and full overview of r77 and its internals, and how to deploy and integrate it. Project Pagebytecode77.com/r77-rootkit Download R77-Rootkit

Black Hat Ethical Hacking
Offensive Security Tool: Breacher

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Offensive Security Tool: BreacherPost Views: 140 https://www.blackhatethicalhacking.com/wp-content/uploads/2020/11/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-8-1-300x120.png Reading Time: 2 Minutes
Offensive Security Tool: Breacher GitHub Link
Breacher

Breacher by s0md3v, is a script in order to find admin login pages and EAR vulnerabilities. It works fast by probing with an included path wordlist of 500 known locations, that admin pages could exist. It sends a request to a webpage, supports multi-threading & parses the output on your terminal. It works real fast and also adds the prefixes automatically when testing a specific website URL you give it (http / https), it checks also for Robots.txt and EAR (Execution After Redirect) vulnerabilities which can be exploited for further take overs, known also as CVE-2013-1402. This quickly can find hidden admin login pages, which allows bug bounty hunters, penetration testers and the red team to perform traffic analysis on the login mechanisms, bruteforcing and more.
See Also: GitHub Prepares to Move Beyond Passwords
Features
⦿ Multi-threading on demand
⦿ Big path list (482 paths)
⦿ Supports php, asp and html extensions
⦿ Checks for potential EAR vulnerabilities
⦿ Checks for robots.txt
⦿ Support for custom patns
See Also: Hacking Stories: Xbox Underground
Usages
⦿ Check all paths with php extension python breacher -u example.com --type php⦿ Check all paths with php extension with threads python breacher -u example.com --type php --fast⦿ Check all paths without threads python breacher -u example.com⦿ Adding a custom path. For example if you want all paths to start with /data (example.com/data/…) you can do this: python breacher -u example.com --path /dataNote: When you specify an extension using –typeoption, Breacher includes paths of that extension as well as paths with no extensions like /admin/loginSee Also: Offensive Security Tool: EyeWitness Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/05/image_2021-05-07_124858-90x90.png Offensive Security Tool: EyeWitness1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/Selection_017-90x90.png Offensive Security Tool: SSHPry2.02 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/image1-90x90.png Offensive Security Tool: ADFSBrute3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/logo-90x90.png Offensive Security Tool: Hunt4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/85207007-711b0b80-b343-11ea-82f3-49aa5d5d719b-90x90.png Offensive Security Tool: CVE Binary Tool by Intel1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/04/help-1-90x90.png Offensive Security Tool: DirDar1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/intro-90x90.png Information Security Tool: Chameleon2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/skipfish_screenshot-90x90.png Offensive Security Tool: Skipfish2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/sparta2-90x90.png Offensive Security Tool: Sparta2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/02/ScareCrow2-90x90.png Offensive Security Tool: ScareCrow3 months ago
style="display:block; text-align:center;"
data-ad-layout="in-article"
data-ad-format="fluid"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="4517761481">
The post Offen[...]

Black Hat Ethical Hacking
Apple’s ‘Find My’ Network Exploited via Bluetooth

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Apple’s ‘Find My’ Network Exploited via BluetoothPost Views: 218
Reading Time: 1 Minute
Apple’s “Find My device” function for helping people track their iOS and macOS devices can be exploited to transfer data to and from random passing devices without using the internet, a security researcher has demonstrated.
Security researcher Fabian Bräunlein with Positive Security developed a proof of concept, using a microcontroller and a custom MacOS app, that can broadcast data from one device to another via Bluetooth Low Energy (BLE). Once connected to the internet, the receiving device can then forward the data to an attacker-controlled Apple iCloud server.

Bräunlein called the method “Send My,” and posited several use cases for the method — including the benign building of a network for internet-of-things (IoT) sensors, or as way to deplete people’s mobile-data plans over time.

The misuse of Find My in this way seems nearly impossible for Apple to prevent, he said, given that the capability is “inherent to the privacy and security-focused design of the Find My offline finding system,” Bräunlein observed.
See Also: GitHub Prepares to Move Beyond Passwords How It WorksBräunlein said he was inspired by the release of Apple AirTags — an item tracker that can be attached to something like a backpack or keychain to allow it to be “found” if within Bluetooth range using the Find My service — to see if arbitrary data also could be sent this way.

The researcher leveraged previous research (PDF) from a team with Technical University of Darmstadt in Germany, who had already reverse-engineered Apple’s Find My network to develop a tool called OpenHaystack. OpenHaystack allows people to create their own accessories that can be found and tracked by the locator service. Along the way, the researchers also found flaws with the system that can expose user identities.

When used over Bluetooth, Apple’s Find My feature basically crowdsources the ability to find someone’s device or item over BLE — devices communicate among themselves using location beacons. The owner of the device can then receive location reports about devices enrolled in Apple’s iCloud-based Find My iPhone or iOS/MacOS Find My app.
See Also: Offensive Security Tool: EyeWitness The researcher laid out the steps:

1. When pairing an AirTag with an Apple Device, an Elliptic Curve key pair is generated and the public key is pushed to the AirTag (and a shared secret to generate rolling public keys)
2. Every 2 seconds, the AirTag sends a Bluetooth Low Energy broadcast with the public key as content (changes every 15 minute deterministically using the previously shared secret)
3. Nearby iPhones, Macbooks, etc. recognize the Find My broadcast, retrieve their current location, encrypt the location with the broadcasted public key (using ECIES) and upload the encrypted location report
4. During device search, the paired Owner Device generates the list of the rolling public keys that the AirTag would have used in the last days and queries an Apple service for their SHA256 hashes. The Apple backend returns the encrypted location reports for the requested key ids
5. The Owner Device decrypts the location reports and shows an approximate location

To use the service in the way Bräunlein outlined requires a number of engineering steps and custom hardware. To send data, he programmed a low-cost ESP32 microcontroller as a modem, using OpenHaystack-based firmware to broadcast a hardcoded default message and then listen on the serial interface for any new data to broadcast in a [...]

sive Security Tool: Breacher first appeared on Black Hat Ethical Hacking.

Leveraging Microsoft Teams to persist and cover up Cobalt Strike traffic
https://www.reddit.com/r/redteamsec/comments/nc6ff1/leveraging_microsoft_teams_to_persist_and_cover/

submitted by /u/NoUseForANick (https://www.reddit.com/user/NoUseForANick)
[link] (https://www.blackarrow.net/leveraging-microsoft-teams-to-persist-and-cover-up-cobalt-strike-traffic/) [comments] (https://www.reddit.com/r/redteamsec/comments/nc6ff1/leveraging_microsoft_teams_to_persist_and_cover/)

R77-Rootkit - Fileless Ring 3 Rootkit With Installer And Persistence That Hides Processes, Files, Network Connections, Etc...
http://www.kitploit.com/2021/05/r77-rootkit-fileless-ring-3-rootkit.html

Ring 3 rootkit
r77 is a ring 3 Rootkit that hides following entities from all processes: Files, directories, junctions, named pipes, scheduled tasks Processes CPU usage Registry keys & values Services TCP & UDP connections It is compatible with Windows 7 and Windows 10 (https://www.kitploit.com/search/label/Windows%2010) in both x64 and x86 editions.
Hiding by prefix
All entities where the name starts with "$77" are hidden.

Configuration System
The dynamic configuration system allows to hide processes by PID and by name, file system items by full path, TCP & UDP connections of specific ports, etc.