Hacking on Medium
ARITHMETIC UNDERFLOW AND OVERFLOW VULNERABILITIES

In this article, we will focus on vulnerabilities resulting from improper handling of mathematical operations in Solidity, specifically…

Continue reading on Medium »

Hacking on Medium
10 Best FREE DDoS Attack Tools Online (2023)

https://cdn-images-1.medium.com/max/1280/1*bPtJROX0M9L6ZxPhtFptPQ.png
That Hackers Don’t Want You to Know About!

Continue reading on DataDrivenInvestor »

Hacking on Medium
Uncovering the World of Ethical Hacking: The Importance and Implications

https://cdn-images-1.medium.com/max/2600/0*qvCsUQFTsHkqIsJ9
Ethical hacking is the practice of using hacking techniques to identify vulnerabilities and weaknesses in computer systems and networks…

Continue reading on Bug Zero »

Hacking on Medium
ChatGPT Linux Privilege Escalation

https://cdn-images-1.medium.com/max/2600/0*OUk0mwYBujR-LgxS
ChatGPT can give you tips on privilege escalation—though you will need to prompt it to help you avoid privilege escalantion. You will…

Continue reading on System Weakness »

KitPloit - PenTest Tools!
MSI Dump - A Tool That Analyzes Malicious MSI Installation Packages, Extracts Files, Streams, Binary Data And Incorporates YARA Scanner

https://blogger.googleusercontent.com/img/a/AVvXsEgM3GPqoxWRk_oXWsIEAGGkQ-qFdYrfSy8DqbkXhYs5qDTZXyknQv2ymRzRhwgH0XIjwf0HUIEPRE90-lEDrmRX8WEv0rp1x_clrXFhXHZlVP0hFoVQWNowUUjjGJZp9T71pQGDgC8cojcY_56wit267Wrm8yQg0SYsoLxLJkUGjQctR4aVMXsiwXJoKQ=w640-h496 MSI Dump - a tool that analyzes malicious MSI installation packages, extracts files, streams, binary data and incorporates YARA scanner.

On Macro-enabled Office documents we can quickly use oletools mraptor to determine whether document is malicious. If we want to dissect it further, we could bring in oletools olevba or oledump.

To dissect malicious MSI files, so far we had only one, but reliable and trustworthy lessmsi. However, lessmsidoesn't implement features I was looking for:

* quick triage
* Binary data extraction
* YARA scanning

Hence this is where msidumpcomes into play. FeaturesThis tool helps in quick triages as well as detailed examinations of malicious MSIs corpora. It lets us:

* Quickly determine whether file is suspicious or not.
* List all MSI tables as well as dump specific records
* Extract Binary data, all files from CABs, scripts from CustomActions
* scan all inner data and records with YARA rules
* Uses file/MIME type deduction to determine inner data type

It was created as a companion tool to the blog post I released here:

* MSI Shenanigans. Part 1 - Offensive Capabilities Overview Limitations* The program is still in an early alpha version, things are expected to break and triaging/parsing logic to change
* Due to this tool heavy relience on Win32 COM WindowsInstaller.Installerinterfaces, currently it is not possible to support native Linux platforms. Maybe wine python msidump.pycould help, but haven't tried that yet. Use Cases1. Perform quick triage of a suspicious MSI augmented with YARA rule: cmd> python msidump.py evil.msi -y rules.yara https://blogger.googleusercontent.com/img/a/AVvXsEhahaCxGqgvrV3lAJWntPvdGbdML3GgLm1Gq_pMjvNKheq8eDqqW36ENND_fFOyfjZIsJrmmBSczb-BA3T81m5UhlpJf7-WD7DHOeR2EE6-wTpxLeF1PHf2NkbptzYLXu4tFhcCfrrvGrrlQAZDYy4cXkVEW8eEjGlcVxQD1AKUqJGOdMIhiprW6q1vvg=w640-h620 Here we can see that input MSI is injected with suspicious VBScript and contains numerous executables in it.

1. Now we want to take a closer look at this VBScript by extracting only that record.

We see from the triage table that it was present in Binarytable. Lets get him: python msidump.py putty-backdoored.msi -l binary -i UBXtHArj We can specify which to record dump either by its name/ID or its index number (here that would be 7). https://blogger.googleusercontent.com/img/a/AVvXsEi16P67Hckw4pp7zQT-qINoX8fjBQ1QMc_knDD1SIiVQUqs_ffXwfJonnubnpnb5C0iH2adomr0EcoZkrKkuZ5CRU2nO2HmGh0pxuIxTIHYuhkE5Q31CKYEQGgceKZthyZxwaeil0APQYE4mza7908qB_Y6qHBMP2-IvZZWfyiQsKLxvoSQS9TFfZD0SA=w518-h640 Lets have a look at another example. This time there is executable stored in Binarytable that will be executed during installation: https://blogger.googleusercontent.com/img/a/AVvXsEjWXXRnjhq9IYrBOL9hWwyAEd24Hy6ulRDMCZoyR7wj_fg7Uw7LfTuTYlUdzRw3L8cLBFYa2N9xtOlYlMBExNeMd9l5Gu5F13gD_Qmt7VmxFP-_cDX_B7-Owp_ZsShgoDijJKddxA-UKnTHRxfC8uezEu5Xr5hKhVgoN5B_ZuPBuVIbPL4vqZUK132eFg=w640-h302 To extract that file we're gonna go with python msidump.py evil2.msi -x binary -i lmskBju -O extracted Where

* -x binarytells to extract contents of Binarytable
* -i lmskBjuspecifies which record exactly to extract
* -O extractedsets output directory https://blogger.googleusercontent.com/img/a/AVvXsEgM3GPqoxWRk_oXWsIEAGGkQ-qFdYrfSy8DqbkXhYs5qDTZXyknQv2ymRzRhwgH0XIjwf0HUIEPRE90-lEDrmRX8W[...]

Ev0rp1x_clrXFhXHZlVP0hFoVQWNowUUjjGJZp9T71pQGDgC8cojcY_56wit267Wrm8yQg0SYsoLxLJkUGjQctR4aVMXsiwXJoKQ=w640-h496 For the best output experience, run the tool on a maximized console window or redirect output to file: python msidump.py [...] -o analysis.log Full UsagePS D:\> python .\msidump.py --help
options:
-h, --help show this help message and exit

Required arguments:
infile Input MSI file (or directory) for analysis.

Options:
-q, --quiet Surpress banner and unnecessary information. In triage mode, will display only verdict.
-v, --verbose Verbose mode.
-d, --debug Debug mode.
-N, --nocolor Dont use colors in text output.
-n PRINT_LEN, --print-len PRINT_LEN
When previewing data - how many bytes to include in preview/hexdump. Default: 128
-f {text,json,csv}, --format {text,json,csv}
Output format: text, json, csv. Default: text
-o path, --outfile path
Redirect program output to this file.
-m, --mime When sniffing inner data type, report MIME types

Analysis Modes:
-l what, --list what List specific table contents. See help message to learn what can be listed.
-x what, --extract what
Extract data from MSI. For what can be extracted, refer to help message.

Analysis Specific options:
-i number|name, --record number|name
Can be a number or name. In --list mode, specifies which record to dump/display entirely. In --extract mode dumps only this particular record to --outdir
-O path, --outdir path
When --extract mode is used, specifies output location where to extract data.
-y path, --yara path Path to YARA rule/directory with rules. YARA will be matched against Binary data, streams and inner files

------------------------------------------------------

- What can be listed:
--list CustomAction - Specific table
--lis t Registry,File - List multiple tables
--list stats - Print MSI database statistics
--list all - All tables and their contents
--list olestream - Prints all OLE streams & storages.
To display CABs embedded in MSI try: --list _Streams
--list cabs - Lists embedded CAB files
--list binary - Lists binary data embedded in MSI for its own purposes.
That typically includes EXEs, DLLs, VBS/JS scripts, etc

- What can be extracted:
--extract all - Extracts Binary data, all files from CABs, scripts from CustomActions
--extract binary - Extracts Binary data
--extract files - Extracts files
--extract cabs - Extracts cabinets
--extract scripts - Extrac ts scripts

------------------------------------------------------ TODO* Triaging logic is still a bit flakey, I'm not very proud of it. Hence it will be subject for constant redesigns and further ramifications
* Test it on a wider test samples corpora
* Add support for input ZIP archives with passwords
* Add support for ingesting entire directory full of YARA rules instead of working with a single file only
* Currently, the tool matches malicious CustomAction Types based on assessing their numbers, which is prone to being evaded.
* It needs to be reworked to properly consume Type number and decompose it onto flags Tool's NameApparently when naming my tool, I didn't think on checking whether it was already taken. There is another tool named msidumpbeing part of msitools GNU package:

* msidump Show Support This and other projects are outcome of sleepless nights and plenty of hard work. If you like what I do and appreciate that I always give back to the community, Consider buying me a coffee (or better a beer) just to say thank you! Mariusz Banach / mgeeky, (@mariuszbit)
<mb Download Msidump

hacking: security in practice
Linux distro recommendations

Hello guys sorry if this question is often asked or if im in the wrong sub. So, i started learning pentesting a few weeks ago. Im currently using a Thinkpad x395 on W10 and i run Vms on it. I want to change my os to linux but i dont really know which distro. I want something clean with a desktop environment (Mac os style), capable of running Multiple Vms. I was looking into pop so is it a good thing ? should i stay on w10 ? Thanks guys

submitted by /u/Sayzito
[link] [comments]

hacking: security in practice
Does anyone know how to decrypt a PPVM file?

I recently saw a youtube tutorial in which he decrypts a password protected video file. When asked about his ppvm decryptor software, he said it's for his personal use only and he has no plans making the software public. This is the video. If any one knows how to crack a ppvm file please let us know.

submitted by /u/Strong_Muffin1433
[link] [comments]

hacking: security in practice
Here's a fast tool for checking domains to see if they are behind Cloudflare, based on five criteria: SSL issuer, IP and 3 headers.

https://external-preview.redd.it/yrmI-E0-vU5f3UwfQQRSqgYnNyuHu3YijIuMNqAwtis.jpg?width=640&crop=smart&auto=webp&s=fedfe6e4e15411dff9eaefe0500caf78a761b47f submitted by /u/agaliullin
[link] [comments]

hacking: security in practice
How to Create a Virtual Hacking Lab

https://external-preview.redd.it/oNd2ms62J_jfPOBzYZueSNQ-QbAQHGwVpWpT2gG2qBU.jpg?width=640&crop=smart&auto=webp&s=712fb7ae9f62d8c6256c2c4c8a324f5040b42510 submitted by /u/nick313
[link] [comments]

hacking: security in practice
Cracking A Password Prompt In EXE From ~2001

I was curious if anyone could help guide me on potentially uncovering the admin tools password of a program called Serials 2000. Versions 7.0b or even better, 7.1 (though they could be same pass for all i know). I have the software. I am guessing many of you know what it was for. I am interested in this purely for nostalgia sake. I know the admin password for previous versions and have all the tools that were made to not need access to that menu but I just want to know it. This ware was a huge part of my teen computing years lol.

I have minimal programming knowledge but I have messed around with decompiling it with IDA and trying stuff with memory and debugging with Olly. But I honestly know very little about what I am doing. I have seen the dialog using Resource Hacker but I want to experience using it. I have reached out to some of the crew members from that software's golden era but either have not received replies or the person did not know or remember it at this point.

I also believe the code is obfuscated or encrypted to some degree but am not certain of this.

If reverse engineering is not the solution or too difficult or impossible due to possible obfuscation or encryption is there a brute force tool that would work well with a password prompt that would need a actions taken between each password try? Like it would need to OK the error box after failed attempt then do File -> Administration Tools and then enter another pass and hit enter again. So I guess something like a macro that can pull words from a dictionary file like rockyou or something? I don't know. Any help or advice is greatly appreciated. Thank you for taking the time to read.

Edit: exe is 32bit windows executable. unknown language/compiler...

submitted by /u/GroundbreakingEar450
[link] [comments]

hacking: security in practice
Revisiting Heaven's Gate with Lumma Stealer

https://external-preview.redd.it/qv0ttx2ckLobZq7AwLeX64YhxT0JHeQTiqfpngWVBIw.jpg?width=320&crop=smart&auto=webp&s=da38a0f357ed33a9b9c5cff9f6a10e968927ac9d submitted by /u/CyberMasterV
[link] [comments]

hacking: security in practice
Bought 1984.hosting domain and hosting, but when I click on Administer Wordpress it takes me to page that says 404 Not found. What should I do?

So I bought hosting and domain from 1984.hosting but when on their dashboard I am clicking on Wordpress option it’s taking me to page that says 404 not found, and doesn’t open the Wordpress.

Please help

submitted by /u/wolfme1997
[link] [comments]

Dark Reading: Attacks/Breaches
Stop Blaming the End User for Security Risk

Don't count on securing end users for system security. Instead, focus on better securing the systems — make them closed by default and build with a security-first approach.

Privilege Escalation via Broken Authentication: A Story of $$$

Hi Fellow Hunters, Hope you are doing well and taking care of your health, this side V3D. I want to write a quick write-up with my friends…Continue reading on Medium »
Read more...