💉ClipboardInject

Abusing the clipboard to inject code into remote processes

This PoC uses the clipboard to copy a payload into a remote process, eliminating the need for VirtualAllocEx/WriteProcessMemory

https://www.x86matthew.com/view_post?id=clipboard_inject

#maldev #injection #clipboard #redteam

🔑 Cobalt Strike Token Vault

This Beacon Object File (BOF) creates in-memory storage for stolen/duplicated Windows access tokens allow you to:

— Hot swap/re-use already stolen tokens without re-duplicating;
— Store tokens for later use in case of a person log out.

https://github.com/Henkru/cs-token-vault

#ad #tokens #c2 #cobalt #redteam

⚙️ Determining AD domain name via NTLM Auth

If you have nmap (http-ntlm-info) unable to determine the FQND of an Active Directory domain via OWA, for example due to Citrix NetScaler or other SSO solutions, do it manually!

1) curl -Isk -X POST -H 'Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKANc6AAAADw==' -H 'Content-Length: 0' https://autodiscover.exmaple.com/ews

2) echo 'TlRMTVNTUAACAAAADAAMAD...' | python2 ./ntlmdecoder.py

One-Liner function for bashrc\zshrc\etc-rc:

ntlm_decode() { curl -Isk -X POST -H 'Authorization: NTLM TlRMTVNTUAABAAAAB4IIogAAAAAAAAAAAAAAAAAAAAAKANc6AAAADw==' -H 'Content-Length: 0' "$1" | awk -F 'NTLM ' '/WWW-Authenticate: NTLM/ {print $2}' | python2 "$(locate ntlmdecoder.py)"; }

Source:
ntlmdecoder.py

#ntlm #auth #sso #tricks #pentest

📌 Save the Environment

Many applications appear to rely on Environment Variables such as %SYSTEMROOT% to load DLLs from protected locations.
By changing these variables on process level, it is possible to let a legitimate program load arbitrary DLLs.

Research:
https://www.wietzebeukema.nl/blog/save-the-environment-variables

Source Code:
https://github.com/wietze/windows-dll-env-hijacking

#maldev #dll #hijacking #environment

#api #params

> Ничего не могу найти на сайте, может ещё что-то посмотреть?

Иногда встречается сайт, на котором всего лишь несколько конечных точек. Казалось, все параметры были проверены на уязвимости, а в чек-листе отмечены любые возможные проверки на инъекции и логику.

Однако, бывают уязвимости, которые не видны с первого взгляда. Например (CAPEC-460) HTTP Parameter Pollution или (CWE-472) External Control of Assumed-Immutable Web Parameter. Данные ошибки возникают из-за неожиданного поведения в функциях обработки параметров.

Давайте рассмотрим первую атаку HTTP Parameter Pollution, она состоит из возможности добавления повторяющихся параметров с помощью специальных разделителей запроса.

Например, у нас открыт сайт по продаже арбузов в браузере

🌐 example.com/profile.jsp?client_id=1

Для кнопки "Открыть профиль" устанавливается динамически в ответе от сервера html:

<a href="profile.jsp?client_id=1&action=view

А теперь изменим запрос добавив в него параметр и закодировав разделитель & как %26:

🌐 example.com/profile.jsp?client_id=1%26action%3Ddelete

В результате для кнопки "Открыть профиль" задаётся html:

<a href="profile.jsp?client_id=1&action=delete&action=view

При нажатии на кнопку — профиль пользователя будет удалён. Для того чтобы заставить жертву удалить свой аккаунт, нам нужно отправить ей ссылку и подождать.

Это происходит, потому что Apache Tomcat 🐈 при анализе двух одинаковых параметров (action) берёт значение первого:

&action=delete&action=view

Вот так выглядит код на стороне сервера:

String client_id = request.getParameter("client_id");
GetMethod get = new GetMethod("https://example.com/profile");
get.setQueryString("client_id=" + client_id + "&action=" + action);

href_link=get.URL;

Разработчик должен был учесть такое поведение и проверить возможность внедрения параметра action в client_id

Вообще, приоритет и процесс обработки параметров можно взять из этой таблицы ниже:

Technology/HTTP backend        | Parsing Result    | Example         |
---------------------------------------------------------------------
ASP.NET/IIS                    | All occurrences   | par1=val1,val2  |
ASP/IIS                        | All occurrences   | par1=val1,val2  |
PHP/Apache                     | Last occurrence   | par1=val2       |
JSP Servlet/Apache Tomcat      | First occurrence  | par1=val1       |
JSP Servlet/Oracle Application | First occurrence  | par1=val1       |
IBM HTTP Server                | First occurrence  | par1=val1       |

Так, для Server: Apache Tomcat будет взято значение из первого совпадения action=delete
А для Server: Apache значение уже будет action=view — последний параметр

Но не все сервера используют приоритет порядка, так, например, ASP.NET/IIS конкатенирует значения. Поэтому в случаях, когда выполнению XSS мешает санитизация или WAF, можно составить следующий payload:

example.com/search?param=<audio/n="&param="src/onerror=alert()>

В результате на странице html будет <audio n="," src/onerror=alert()> и XSS успешно сработает 💣

Помимо приоритетов, нужно также вспомнить о разделителях для параметров. Существует не только привычный & (амперсанд) и , (запятая) но и ряд других символов, тут нужно обратиться к стандартам и поискать реализации. Если открыть (rfc6570) URI Template можно найти Path-Style Parameter

Обычный URL будет следующим:

example.com/users?role=admin&firstName=N

А теперь преобразуем его в вид Path-Style:

example.com/users;role=admin;firstName=N

Использование в качестве разделителя ; (точки с запятой) не повсеместно. Это приводит к различиям обработки во фреймворках и как следствие к уязвимостям, в частности, на микросервисных архитектурах:

• CVE-2021-23336 — Python библиотека urllib.parse.parse_qsl не игнорирует точку с запятой.

• ParseThru — Go библиотека net/url не игнорирует точку с запятой и выводит предупреждение http: URL query contains semicolon...

Следует помнить, что уязвимость HTTP Parameter Pollution может возникать не только в URL, но и в любой части POST/GET запроса, а также в теле JSON.

{"client_id":4, "client_id":17, "action":"delete"}

😈 EDRSandBlast: Update

— User-mode (API hooking) evasion;
— Kernel-mode (callbacks and ETW ThreatIntel events) evasion;
— Successively tested on market-leading EDR products.

https://github.com/wavestone-cdt/EDRSandblast/tree/DefCon30Release

#maldev #edr #lsass #evasion #redteam

🤖 BBOT: OSINT automation for hackers

This tools is capable of executing the entire OSINT process in a single command, including subdomain enumeration, port scanning, web screenshots (with its gowitness module), vulnerability scanning (with nuclei), and much more. BBOT currently has over 50 modules and counting.

Features:
— Recursive;
— Graphing;
— Modular;
— Multi-Target;
— Automatic Dependencies;
— Smart Dictionary Attacks;
— Scope Distance;
— Easily Configurable via YAML.

Blog:
https://blog.blacklanternsecurity.com/p/bbot

Source:
https://github.com/blacklanternsecurity/bbot

#external #recon #osint #redteam #bugbounty

🎭 Masky

Masky is a python library providing an alternative way to remotely dump domain users' credentials thanks to an ADCS. A command line tool has been built on top of this library in order to easily gather PFX, NT hashes and TGT on a larger scope.

This tool does not exploit any new vulnerability and does not work by dumping the LSASS process memory. Indeed, it only takes advantage of legitimate Windows and Active Directory features (token impersonation, certificate authentication via kerberos & NT hashes retrieval via PKINIT).

Blog:
https://z4ksec.github.io/posts/masky-release-v0.0.3/

Source:
https://github.com/Z4kSec/Masky

#ad #adcs #lsass #redteam

⚙️ Hackers No Hashing: Randomizing API Hashes to Evade Cobalt Strike Shellcode Detection

If you utilise API hashing in your malware or offensive security tooling. Try rotating your API hashes. This can have a significant impact on detection rates and improve your chances of remaining undetected by AV/EDR.

Blog:
https://www.huntress.com/blog/hackers-no-hashing-randomizing-api-hashes-to-evade-cobalt-strike-shellcode-detection

Source:
https://github.com/matthewB-huntress/APIHashReplace

#maldev #evasion #hinvoke #cobaltstrike #redteam

📡 NTLMv1 vs NTLMv2: Digging into an NTLM Downgrade Attack

This article discusses the NTLM specifications to better understand how various aspects of the NTLM protocol function. As well as bypassing the SMB signature, relaying SMB to LDAP, and relaying NTLMv1 authentication attempts to the ADFS service.

https://www.praetorian.com/blog/ntlmv1-vs-ntlmv2/

#ad #ntlm #smb #relay

MSSQL Analysis Services — Coerced Authentication

New technique to coerce an SMB authentication on Windows SQL Server as the machine account

PoC:
https://github.com/p0dalirius/MSSQL-Analysis-Coerce

#ad #mssql #smb #relay

🔎 GEOINT Protip

Landmark identification and pinpointing locations where an image or video was taken is a very good skill when investigating current and past events.

— geohints.com
— landmark.toolpie.com
— brueckenweb.de/2content/suchen/suche.php

#geoint #osint #tips

⚔️ Microsoft Teams C2 — Covert Attack Chain Utilizing GIFShell

Seven different insecure design elements/vulnerabilities present in Microsoft Teams, can be leveraged by an attacker, to execute a reverse shell between an attacker and victim, where no communication is directly exchanged between an attacker and a victim, but is entirely piped through malicious GIFs sent in Teams messages, and Out of Bounds (OOB) lookups of GIFs conducted by Microsoft’s own servers. This unique C2 infrastructure can be leveraged by sophisticated threat actors to avoid detection by EDR and other network monitoring tools. Particularly in secure network environments, where Microsoft Teams might be one of a handful of allowed, trusted hosts and programs, this attack chain can be particularly devastating.

Source:
https://medium.com/@bobbyrsec/gifshell-covert-attack-chain-and-c2-utilizing-microsoft-teams-gifs-1618c4e64ed7

#c2 #teams #gifshell #edr #redteam

🦊 CloudFox

Security firm BishopFox has open-sourced on Tuesday a new security tool named CloudFox that can find exploitable attack paths in cloud infrastructure.

Blog:
https://bishopfox.com/blog/introducing-cloudfox

Tool:
https://github.com/BishopFox/cloudfox

#cloud #aws #pentest #tools

Azure Threat Research Matrix

The purpose of the Azure Threat Research Matrix is to conceptualize the known TTP that adversaries may use against Azure

https://microsoft.github.io/Azure-Threat-Research-Matrix/

#azure #ttp #blueteam

🤤 LDAP Nom Nom

Stuck on a network with no credentials?
No worry, you can anonymously bruteforce Active Directory controllers for usernames over LDAP Pings (cLDAP) using new tool - with parallelization you'll get 10K usernames/sec. No Windows audit logs generated.

Features:
— Tries to autodetect DC from environment variables on domain joined machines or falls back to machine hostname FDQN DNS suffix
— Reads usernames to test from stdin (default) or file
— Outputs to stdout (default) or file
— Parallelized (defaults to 8 connections)
— Shows progressbar if you're using both input and output files

https://github.com/lkarlslund/ldapnomnom

#ad #ldap #userenum #tools

🎲 Fileless Remote PE

Loading Fileless Remote PE from URI to memory with argument passing and ETW patching and NTDLL unhooking and No New Thread technique

https://github.com/D1rkMtr/FilelessRemotePE

#maldev #evasion #fileless #pe

Just another Windows Local Privilege Escalation from Service Account to System. Full details at

https://decoder.cloud/2022/09/21/giving-juicypotato-a-second-chance-juicypotatong/

POC:
https://github.com/antonioCoco/JuicyPotatoNG

📞 Persistence on Skype for Business

This article provides a tool for Red Teams helping to achieve persistence on the latest patched version of Skype for Business 2019 server using a new method.

https://frycos.github.io/vulns4free/2022/09/22/skype-audit-part1.html

#ad #skype #persistence #redteam

Havoc is a modern and malleable post-exploitation command and control framework

Features:
Client
- Modern, dark theme based on Dracula
Teamserver
- Multiplayer
- Payload generation (exe/shellcode/dll)
- HTTP/HTTPS listeners
- Customizable C2 profiles
- External C2
Demon
- Sleep Obfuscation via Ekko or FOLIAGE
- x64 return address spoofing
- Indirect Syscalls for Nt* APIs
- SMB support
- Token vault
- Variety of built-in post-exploitation commands