Hacking on Medium
Major Cyber-Crime Cases occurred in INDIA

https://cdn-images-1.medium.com/max/1680/1*yn7tntmqw_yLT5Jz5S8kNw.jpeg
In the todays world where data is like a gold for IT industry, when we here words like data breach, one can’t think of impact it would…

Continue reading on Medium »

Hacking on Medium
How to reset Parrot os or kali Linux forgot password 2023

https://cdn-images-1.medium.com/max/909/0*Vqm7niYw5HqRDZbP.png
There are a few various methods you can use to reset your password for Parrot OS ( also you can use this technique with Kali ), a…

Continue reading on Medium »

Hacking on Medium
Github dorks

GitHub dorks are specialized search queries that allow users to find repositories that contain specific types of information.

Continue reading on Medium »

Hacking on Medium
Top 10 Cybersecurity Threats to Watch Out for in 2023

https://cdn-images-1.medium.com/max/2600/1*NSUPWXluvxAL3YRSYIBvyg.jpeg
I. Introduction

Continue reading on Medium »

Hacking on Medium
What does cyber security do? — VoltronAI

https://cdn-images-1.medium.com/max/1280/0*2hL_eOxpu9mbwEq0.jpg
Cybersecurity is the practice of protecting computer systems, networks, and sensitive information from unauthorized access, theft, and…

Continue reading on Medium »

Hacking on Medium
ARITHMETIC UNDERFLOW AND OVERFLOW VULNERABILITIES

In this article, we will focus on vulnerabilities resulting from improper handling of mathematical operations in Solidity, specifically…

Continue reading on Medium »

Hacking on Medium
10 Best FREE DDoS Attack Tools Online (2023)

https://cdn-images-1.medium.com/max/1280/1*bPtJROX0M9L6ZxPhtFptPQ.png
That Hackers Don’t Want You to Know About!

Continue reading on DataDrivenInvestor »

Hacking on Medium
Uncovering the World of Ethical Hacking: The Importance and Implications

https://cdn-images-1.medium.com/max/2600/0*qvCsUQFTsHkqIsJ9
Ethical hacking is the practice of using hacking techniques to identify vulnerabilities and weaknesses in computer systems and networks…

Continue reading on Bug Zero »

Hacking on Medium
ChatGPT Linux Privilege Escalation

https://cdn-images-1.medium.com/max/2600/0*OUk0mwYBujR-LgxS
ChatGPT can give you tips on privilege escalation—though you will need to prompt it to help you avoid privilege escalantion. You will…

Continue reading on System Weakness »

KitPloit - PenTest Tools!
MSI Dump - A Tool That Analyzes Malicious MSI Installation Packages, Extracts Files, Streams, Binary Data And Incorporates YARA Scanner

https://blogger.googleusercontent.com/img/a/AVvXsEgM3GPqoxWRk_oXWsIEAGGkQ-qFdYrfSy8DqbkXhYs5qDTZXyknQv2ymRzRhwgH0XIjwf0HUIEPRE90-lEDrmRX8WEv0rp1x_clrXFhXHZlVP0hFoVQWNowUUjjGJZp9T71pQGDgC8cojcY_56wit267Wrm8yQg0SYsoLxLJkUGjQctR4aVMXsiwXJoKQ=w640-h496 MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.

On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we could bring in oletools olevba or oledump.

To dissect malicious MSI files, so far we had only one, but reliable and trustworthy lessmsi. However, lessmsidoesn't implement features I was looking for:

* quick triage
* Binary data extraction
* YARA scanning

Hence this is where msidumpcomes into play. FeaturesThis tool helps in quick triages as well as detailed examinations of malicious MSIs corpora. It lets us:

* Quickly determine whether file is suspicious or not.
* List all MSI tables as well as dump specific records
* Extract Binary data, all files from CABs, scripts from CustomActions
* scan all inner data and records with YARA rules
* Uses file/MIME type deduction to determine inner data type

It was created as a companion tool to the blog post I released here:

* MSI Shenanigans. Part 1 - Offensive Capabilities Overview Limitations* The program is still in an early alpha version, things are expected to break and triaging/parsing logic to change
* Due to this tool heavy relience on Win32 COM WindowsInstaller.Installerinterfaces, currently it is not possible to support native Linux platforms. Maybe wine python msidump.pycould help, but haven't tried that yet. Use Cases1. Perform quick triage of a suspicious MSI augmented with YARA rule: cmd> python msidump.py evil.msi -y rules.yara https://blogger.googleusercontent.com/img/a/AVvXsEhahaCxGqgvrV3lAJWntPvdGbdML3GgLm1Gq_pMjvNKheq8eDqqW36ENND_fFOyfjZIsJrmmBSczb-BA3T81m5UhlpJf7-WD7DHOeR2EE6-wTpxLeF1PHf2NkbptzYLXu4tFhcCfrrvGrrlQAZDYy4cXkVEW8eEjGlcVxQD1AKUqJGOdMIhiprW6q1vvg=w640-h620 Here we can see that input MSI is injected with suspicious VBScript and contains numerous executables in it.

1. Now we want to take a closer look at this VBScript by extracting only that record.

We see from the triage table that it was present in Binarytable. Lets get him: python msidump.py putty-backdoored.msi -l binary -i UBXtHArj We can specify which to record dump either by its name/ID or its index number (here that would be 7). https://blogger.googleusercontent.com/img/a/AVvXsEi16P67Hckw4pp7zQT-qINoX8fjBQ1QMc_knDD1SIiVQUqs_ffXwfJonnubnpnb5C0iH2adomr0EcoZkrKkuZ5CRU2nO2HmGh0pxuIxTIHYuhkE5Q31CKYEQGgceKZthyZxwaeil0APQYE4mza7908qB_Y6qHBMP2-IvZZWfyiQsKLxvoSQS9TFfZD0SA=w518-h640 Lets have a look at another example. This time there is executable stored in Binarytable that will be executed during installation: https://blogger.googleusercontent.com/img/a/AVvXsEjWXXRnjhq9IYrBOL9hWwyAEd24Hy6ulRDMCZoyR7wj_fg7Uw7LfTuTYlUdzRw3L8cLBFYa2N9xtOlYlMBExNeMd9l5Gu5F13gD_Qmt7VmxFP-_cDX_B7-Owp_ZsShgoDijJKddxA-UKnTHRxfC8uezEu5Xr5hKhVgoN5B_ZuPBuVIbPL4vqZUK132eFg=w640-h302 To extract that file we're gonna go with python msidump.py evil2.msi -x binary -i lmskBju -O extracted Where

* -x binarytells to extract contents of Binarytable
* -i lmskBjuspecifies which record exactly to extract
* -O extractedsets output directory https://blogger.googleusercontent.com/img/a/AVvXsEgM3GPqoxWRk_oXWsIEAGGkQ-qFdYrfSy8DqbkXhYs5qDTZXyknQv2ymRzRhwgH0XIjwf0HUIEPRE90-lEDrmRX8W[...]