KitPloit - PenTest Tools!
SilentMoonwalk - PoC Implementation Of A Fully Dynamic Call Stack Spoofer

https://blogger.googleusercontent.com/img/a/AVvXsEhmSfRk3ueboBYs7Ns4as2tc1nPt_hjpY6G69_Z_jEZlF4fgo6ptapaRxxl5sBPzAU0r0wxzs2umTbKbvguUJ0DFS_4ccFbQ7einfQw63uZrYSWjLFfdUp2wTUX3ko51mrKEYGpMBR1PUdN9bh_P5GyRnAiv51GocaQy6hu7YbtbXuZ92fQxU0G7VxPeg=w640-h334 PoC Implementation of a fully dynamic call stack spoofer TL;DRSilentMoonwalk is a PoC implementation of a fully dynamic call stack spoofer, implementing a technique to remove the original caller from the call stack, using ROP to desynchronize unwinding from control flow. AuthorsThis PoC is the result of a joint research done on the topic of stack spoofing. The authors of the research are:

* KlezVirus
* Waldo-IRC
* Trickster0

I want to stress that this work would have been impossible without the work of Waldo-IRC and Trickster0, which both contributed to the early stages of the PoC, and to the research behind the PoC. OverviewThis repository demonstrates a PoC implementation to spoof the call stack when calling arbitrary Windows APIs.

This attempt was inspired by this Twitter thread, and this Twitter thread, where sensei namazso showed and suggested to extend the stack unwinding approach with a ROP chain to both desynchronize the unwinding from real control flow and restore the original stack afterwards.

This PoC attempts to do something similar to the above, and uses a desync stack to completely hide the original call stack, also removing the EXE image base from it. Upon return, a ROP gadget is invoked to restore the original stack. In the code, this process is repeated 10 times in a loop, using different frames at each iteration, to prove stability. Supported ModesThe tool currently supports 2 modes, where one is actually a wrong patch to a non-working pop RBP frame identified, which operates by shifting the current RSP and adding two fake frames to the call stack. As it operates using synthetic frames, I refer to this mode as "SYNTHETIC".

When selecting the frame that unwinds by popping the RBP register from the stack, the tool might select an unsuitable frame, ending up in an abruptly cut call stack, as observable below. https://blogger.googleusercontent.com/img/a/AVvXsEgt64mTK4Wd7s7QLYBGU1EarC8kUNEoBqWxT0e7dR7fRT3yqqDVWySIrmdC7pePnhN7U0VoUiYR9YUWpD_cE0RaX1w0gnRilBt4G5MbRk51b4xQ9u66dHo0FnFQ0K_lvBsAcfNnqWTf4wFZpqSNNy2NpeJ1XACEdbVvfF2wRrapUdlhkb7xTHCeBJTfDw=w640-h308 Synthetic Call Stack ModeA silly solution to the problem would be to create two fake frames and link them back to the cut call stack. This would create a sort of apparently legit call stack, even without a suitable frame which unwinds calling POP RBP, but:

* You would lose the advantage of the desync technique
* The stack would be still unwindable
* The resulting call stack could seem legit just on the first glance, but it would probably not pass a strict check

The result of the _synthetic spoof can be observed in the image below: https://blogger.googleusercontent.com/img/a/AVvXsEjYXJZU-bj7MCgeMQ0fzznA3UMdP36Wv63MaKHuZ4z1daiFlVn0fLsh4dm1kNsv3pm8r3Q_dmsRvrtOvW4eMyyxHZ9ZXbgv6VyPC2-pUIEB9m3ndOWDAWDooMrf7Vgy0Wm1lEDS_ui5uPiFJNzFxbdTIcTrGHkGBZN1-U5HELCTvKLiBKmgkOObuy1fMg=w640-h284 Figure 1: Windows 10 - Apparently Legit, non unwoundable call stack whereby the EXE module was completely removed (calling no parameters function getchar)

Note: This operation mode is disabled by default. To enable this mode, change the CALLSTACK_TYPE to 1 Desync Stack ModeThis mode is the right solution to the above problem, whereby the non-suitable frame is simply replaced by another, suitable one. https://blogger.googleusercontent.com/img/a/AVvXsEhmSfRk3ueboBYs7Ns4as2tc1nPt_hjpY6G69_Z_jEZlF4fgo6ptapaRxxl5sBPzAU0r0wxzs2umTbKbvguUJ0DFS_4ccFbQ7einfQw63uZrYSWjLFfdUp2wTUX3ko51mrKEYGpMBR1PUdN9bh_P5GyRnAiv51GocaQy6hu7YbtbXuZ92fQ[...]

xU0G7VxPeg=w640-h334 Figure 2: Windows 10 - Legit, unwoundable call stack whereby the EXE module was completely removed (calling 4 parameters function MessageBoxA) UtilityIn the repository, you can find also a little util to inspect runtime functions, which might be useful to analyse runtime function entries. UnwindInspector.exe -h

Unwind Inspector v0.100000

Mandatory args:
-m <module: Target DLL
-f <function: Target Function
-a <function-address: Target Function Address Sample Output: UnwindInspector.exe -m kernelbase -a 0x7FFAAE12182C
[*] Using function address 0x7ffaae12182c

Runtime Function (0x000000000000182C, 0x00000000000019ED)
Unwind Info Address: 0x000000000026AA88
Version: 0
Ver + Flags: 00000000
SizeOfProlog: 0x1f
CountOfCodes: 0xc
FrameRegister: 0x0
FrameOffset: 0x0
UnwindCodes:
[00h] Frame: 0x741f - 0x04 - UWOP_SAVE_NONVOL (RDI, 0x001f)
[01h] Frame: 0x0015 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0015)
[02h] Frame: 0x641f - 0x04 - UWOP_SAVE_NONVOL (RSI, 0x001f)
[03h] Frame: 0x0014 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0014)
[04h] Frame: 0x341f - 0x04 - UWOP_SAVE_NONVOL (RBX, 0x001f)
[05h] Frame: 0x0012 - 0x00 - UWOP_PUSH_NONVOL (RAX, 0x0012)
[06h] Frame: 0xb21f - 0x02 - UWOP_ALLOC_SMALL (R11, 0x001f)
[07h] Frame: 0xf018 - 0x00 - UWOP_PUSH_NONVOL (R15, 0x0018)
[0 8h] Frame: 0xe016 - 0x00 - UWOP_PUSH_NONVOL (R14, 0x0016)
[09h] Frame: 0xd014 - 0x00 - UWOP_PUSH_NONVOL (R13, 0x0014)
[0ah] Frame: 0xc012 - 0x00 - UWOP_PUSH_NONVOL (R12, 0x0012)
[0bh] Frame: 0x5010 - 0x00 - UWOP_PUSH_NONVOL (RBP, 0x0010) BuildIn order to build the POC and observe a similar behaviour to the one in the picture, ensure to:

* Disable GS (/GS-)
* Disable Code Optimisation (/Od)
* Disable Whole Program Optimisation (Remove /GL)
* Disable size and speed preference (Remove /Os, /Ot)
* Enable intrinsic if not enabled (/Oi) Previous WorkIt's worth mentioning previous work done on this topic, which built the foundation of this work.

* Return Address Spoofing: Original technique and idea, by Namaszo. Every other PoC I'm aware of was built on top of that.
* YouMayPasser: This amazing work by Arash is the first properly done extension of the Return Address Spoofing PoC by Namaszo.
* VulcanRaven: A call stack spoofer that operates the spoofing by synthetically creating a Thread Stack mirroring another real call stack.
* Unwinder: A very nice Rust PoC implementation of a call stack spoofer which operates by parsing unwind code information to replace frames in the call stack. Credits* Huge shoutout to waldo-irc and trickster0, which collaborated with me on this research. I owe everything to them.
* All the credit for the idea behind this goes to namaszo, which I personally consider a genius. He also cross checked this PoC before release, so huge thanks to him. Notes* [SYNTHETIC STACK ONLY]: For a limitation in the way I'm locating the gadgets, the maximum number of arguments is 8 for now (it is TRIVIAL to modify and add more params, but I couldn't bother).
* [DSESYNC STACK ONLY]: For a limitation in how I'm setting up the spoofer, the maximum number of supported arguments is 4 for now.
* Testing on this one was pretty limited. There might be exceptions I'm not aware of at the moment.
* Unwinding involving 128-bit registers was no tested.
* Calling functions that use 128-bit registers is not officially supported. Download SilentMoonwalk

hacking: security in practice
Jammer for pretexting?

I understand wifi and cell jammers are illegal in most jurisdictions but lets assume that’s not the case where I am.

Has it ever been known to use these devices in pretexting? Imagine I use one to jam my neighbors wifi intermittently and then one day over the garden fence I mention to him how my wifi kept going down but I found a way to fix it. You know what if you want I’ll come round and fix it for him too, just let me have a look at your router and laptop account ….

You get the picture. Is this a thing?

submitted by /u/valeria1923
[link] [comments]

hacking: security in practice
Safe browsing, how should i start

Hi folks,

Lets assume someone has a laptop. He walks in a coffee shop open his laptop, boots up his live os turns on tor with proxychain and does his safe browsing experience.

Later when he finished his safe browsing stuff he walks home and boots up his regular os on the same laptop and does his regular stuff on his home network.

Can this two be connected somehow?

(Im kinda noob in this and want some starting point to do my own research in the topic… can you recommend me a way to browse the net in a very anonym manner?)

submitted by /u/OxEmpress
[link] [comments]

Hacking on Medium
Anonymous Shell for Command Execution

https://cdn-images-1.medium.com/max/627/1*eVTg7F0Us18HOD4hc24RWg.png
Introduction

Continue reading on Medium »

Hacking on Medium
SIGSALY Cipher: The Top-Secret Encryption System of WWII | 2023

https://cdn-images-1.medium.com/max/640/0*7YfdRN6FMb5vd11l.jpg
Exploring the History, Functionality, and Legacy of SIGSALY Cipher | Karthikeyan Nagaraj

Continue reading on Medium »

Hacking on Medium
1.8k+ subscribers through broken link hijacking.

https://cdn-images-1.medium.com/max/2600/1*dSmyTSi-ToHxpWOvbbPUKA.png
How I got 1.8k+ youtube subscribers through BLH.

Continue reading on Medium »

Hacking on Medium
What is PhoneInfoga and setup it up ( part 2 )

https://cdn-images-1.medium.com/max/1920/1*Dy8JEnfkmYkfPWZ88P53Sg.png
This is the second part of What is PhoneInfoga and set up. In this blog, we are going to config API keys of phoneinfoga so we can get…

Continue reading on Medium »

Hacking on Medium
We provide a wide range monitoring program, specially made for suspected cheating, lying and…

https://cdn-images-1.medium.com/max/739/1*K1xenVf19EVDEG-Bhnl8jA@2x.jpeg
Chat Us live from the message icon below this web post on the right screen side or Phone Text INFO. to +1240–257–6872. for detailed…

Continue reading on Medium »

Hacking on Medium
JWT Hacking | Command Injection with Insecure KID Parameter Processing

https://cdn-images-1.medium.com/max/1400/0*LS5PeT75HTCTu2qB.png
The “KID” (Key ID) header claim in a JWT is optional and serves to identify the key that was used to sign the token. This is particularly…

Continue reading on Medium »

Hacking on Medium
Top 5 State-Sponsored Hacking Groups: An Overview of Their Capabilities and Operations

https://cdn-images-1.medium.com/max/2600/0*jVktNIlS9iYqmgxE
State-sponsored hacking groups have become an essential component of the modern cyber landscape. These groups, often supported by their…

Continue reading on Lincoln Cyber Security »

Advanced Web Application Security: Exploiting SSTI Vulnerabilities

Server-Side Template Injection (SSTI) vulnerabilities are often overlooked, but they can have severe consequences if exploited by an…Continue reading on InfoSec Write-ups »
Read more...