Ethical Hackers Vol. 2

Secator - The Pentester'S Swiss Knife http://www.kitploit.com/2024/09/secator-pentesters-swiss-knife.html

Download Damn-Vulnerable-Drone (https://github.com/nicholasaleks/Damn-Vulnerable-Drone)

About the Damn Vulnerable Drone What is the Damn Vulnerable Drone? The Damn Vulnerable Drone is a virtually simulated environment designed for offensive security professionals to safely learn and practice drone hacking techniques. It simulates real-world ArduPilot (https://ardupilot.org/) & MAVLink (https://mavlink.io/en/) drone architectures and vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities), offering a hands-on experience in exploiting drone systems. Why was it built? The Damn Vulnerable Drone aims to enhance offensive security skills within a controlled environment, making it an invaluable tool for intermediate-level security professionals, pentesters, and hacking enthusiasts. Similar to how pilots utilize flight simulators for training, we can use the Damn Vulnerable Drone simulator to gain in-depth knowledge of real-world drone systems, understand their vulnerabilities, and learn effective methods to exploit them. The Damn Vulnerable Drone platform is open-source and available at no cost and was specifically designed to address the substantial expenses often linked with drone hardware, hacking tools, and maintenance. Its cost-free nature allows users to immerse themselves in drone hacking without financial concerns. This accessibility makes the Damn Vulnerable Drone a crucial resource for those in the fields of information security and penetration testing, promoting the development of offensive cybersecurity (https://www.kitploit.com/search/label/Cybersecurity) skills in a safe environment. How does it work? The Damn Vulnerable Drone platform operates on the principle of Software-in-the-Loop (SITL) (https://ardupilot.org/dev/docs/sitl-simulator-software-in-the-loop.html), a simulation technique that allows users to run drone software as if it were executing on an actual drone, thereby replicating authentic drone behaviors and responses. ArduPilot's SITL allows for the execution of the drone's firmware within a virtual environment, mimicking the behavior of a real drone without the need for physical hardware. This simulation is further enhanced with Gazebo, a dynamic 3D robotics simulator, which provides a realistic environment and physics engine for the drone to interact with. Together, ArduPilot's SITL and Gazebo lay the foundation for a sophisticated and authentic drone simulation experience. While the current Damn Vulnerable Drone setup doesn't mirror every drone architecture or configuration, the integrated tactics, techniques and scenarios are broadly applicable across various drone systems, models and communication protocols. Features Docker-based Environment: Runs in a completely virtualized docker-based setup, making it accessible and safe for drone hacking experimentation. Simulated Wireless Networking: Simulated Wifi (802.11) interfaces to practice wireless drone attacks. Onboard Camera Streaming & Gimbal: Simulated RTSP drone onboard camera stream with gimbal and companion computer integration. Companion Computer Web Interface: Companion Computer configuration management via web interface and simulated serial connection to Flight Controller. QGroundControl/MAVProxy Integration: One-click QGroundControl UI launching (only supported on x86 architecture) with MAVProxy GCS integration. MAVLink Router Integration: Telemetry forwarding via MAVLink Router on the Companion Computer Web Interface. Dynamic Flight Logging: Fully dynamic Ardupilot flight bin logs stored on a simulated SD Card. Management Web Console: Simple to use simulator management web console used to trigger scenarios and drone flight states. Comprehensive Hacking Scenarios: Ideal for practicing a wide range of drone hacking techniques, from basic reconnaissance to advanced exploitation. Detailed Walkthroughs: If you need help hacking against a particular scenario you can leverage the detailed walkthrough documentation as a spoiler.

Damn-Vulnerable-Drone - An Intentionally Vulnerable Drone Hacking Simulator Based On The Popular ArduPilot/MAVLink Architecture, Providing A Realistic Environment For Hands-On Drone Hacking http://www.kitploit.com/2024/09/damn-vulnerable-drone-intentionally.html

file-unpumper is a powerful command-line utility designed to clean and analyze Portable Executable (PE) files. It provides a range of features to help developers and security professionals work with PE files more effectively. Features PE Header Fixing: file-unpumper can fix and align the PE headers (https://www.kitploit.com/search/label/Headers) of a given executable file. This is particularly useful for resolving issues caused by packers or obfuscators that modify the headers (https://www.kitploit.com/search/label/Headers). Resource Extraction: The tool can extract embedded resources from a PE file, such as icons, bitmaps, or other data resources. This can be helpful for reverse engineering or analyzing the contents of an executable. Metadata (https://www.kitploit.com/search/label/Metadata) Analysis (https://www.kitploit.com/search/label/Analysis): file-unpumper provides a comprehensive analysis of the PE file's metadata, including information about the machine architecture, number of sections, timestamp, subsystem, image base, and section details. File Cleaning: The core functionality of file-unpumper is to remove any "pumped" or padded data from a PE file, resulting in a cleaned version of the executable. This can aid in malware (https://www.kitploit.com/search/label/Malware) analysis, reverse engineering, or simply reducing the file size. Parallel Processing: To ensure efficient performance, file-unpumper leverages the power of parallel processing using the rayon crate, allowing it to handle large files with ease. Progress Tracking (https://www.kitploit.com/search/label/Tracking): During the file cleaning process, a progress bar is displayed, providing a visual indication of the operation's progress and estimated time remaining. Installation file-unpumper is written in Rust and can be easily installed using the Cargo package manager: cargo install file-unpumper Usage : The path to the input PE file. Options --fix-headers: Fix and align the PE headers of the input file. --extract-resources: Extract embedded resources from the input file. --analyze-metadata: Analyze and display the PE file's metadata. -h, --help: Print help information. -V, --version: Print version information. Examples Clean a PE file and remove any "pumped" data: bash file-unpumper path/to/input.exe Fix the PE headers and analyze the metadata of a file: bash file-unpumper --fix-headers --analyze-metadata path/to/input.exe Extract resources from a PE file: bash file-unpumper --extract-resources path/to/input.exe Perform all available operations on a file: bash file-unpumper --fix-headers --extract-resources --analyze-metadata path/to/input.exe Contributing Contributions to file-unpumper are welcome! If you encounter any issues or have suggestions for improvements, please open an issue or submit a pull request on the GitHub repository (https://github.com/0x11DFE/file-unpumper). Changelog The latest changelogs can be found in CHANGELOG.md (https://github.com/0x11DFE/CHANGELOG.md) License file-unpumper is released under the MIT License (https://opensource.org/license/MIT). Download File-Unpumper (https://github.com/0x11DFE/file-unpumper)

File-Unpumper - Tool That Can Be Used To Trim Useless Things From A PE File Such As The Things A File Pumper Would Add http://www.kitploit.com/2024/09/file-unpumper-tool-that-can-be-used-to.html

Mass Assigner is a powerful tool designed to identify and exploit mass assignment vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities) in web applications. It achieves this by first retrieving data from a specified request, such as fetching user profile data. Then, it systematically attempts to apply each parameter (https://www.kitploit.com/search/label/Parameter) extracted from the response to a second request provided, one parameter (https://www.kitploit.com/search/label/Parameter) at a time. This approach allows for the automated (https://www.kitploit.com/search/label/Automated) testing and exploitation of potential mass assignment vulnerabilities (https://www.kitploit.com/search/label/vulnerabilities). Disclaimer This tool actively modifies server-side data. Please ensure you have proper authorization (https://www.kitploit.com/search/label/Authorization) before use. Any unauthorized or illegal activity using this tool is entirely at your own risk. Features Enables the addition of custom headers within requests Offers customization of various HTTP methods for both origin and target requests Supports rate-limiting to manage request thresholds effectively Provides the option to specify "ignored parameters" which the tool will ignore during execution Improved the support in nested arrays/objects inside JSON data in responses What's Next Support additional content types, such as "application/x-www-form-urlencoded" Installation & Usage Install requirements pip3 install -r requirements.txt Run the script python3 mass_assigner.py --fetch-from "http://example.com/path-to-fetch-data" --target-req "http://example.com/path-to-probe-the-data" Arguments Forbidden (https://www.kitploit.com/search/label/Forbidden) Buster accepts the following arguments: -h, --help show this help message and exit --fetch-from FETCH_FROM URL to fetch data from --target-req TARGET_REQ URL to send modified data to -H HEADER, --header HEADER Add a custom header. Format: 'Key: Value' -p PROXY, --proxy PROXY Use Proxy, Usage i.e: http://127.0.0.1:8080. -d DATA, --data DATA Add data to the request body. JSON is supported with escaping. --rate-limit RATE_LIMIT Number of requests per second --source-method SOURCE_METHOD HTTP method for the initial request. Default is GET. --target-method TARGET_METHOD HTTP method for the modified request. Default is PUT. --ignore-params IGNORE_PARAMS Parameters to ignore during modification, separated by comma. Example Usage: python3 mass_assigner.py --fetch-from "http://example.com/api/v1/me" --target-req "http://example.com/api/v1/me" --header "Authorization: Bearer XXX" --proxy "http://proxy.example.com" --data '{\"param1\": \"test\", \"param2\":true}' Download Mass-Assigner (https://github.com/Sn1r/Mass-Assigner)

Mass-Assigner - Simple Tool Made To Probe For Mass Assignment Vulnerability Through JSON Field Modification In HTTP Requests http://www.kitploit.com/2024/09/mass-assigner-simple-tool-made-to-probe.html

A make an LKM rootkit (https://www.kitploit.com/search/label/Rootkit) visible again. This tool is part of research on LKM rootkits that will be launched. It involves getting the memory address of a rootkit's "show_module" function, for example, and using that to call it, adding it back to lsmod, making it possible to remove an LKM rootkit. We can obtain the function address in very simple kernel (https://www.kitploit.com/search/label/Kernel)s using /sys/kernel (https://www.kitploit.com/search/label/Kernel)/tracing/available_filter_functions_addrs, however, it is only available from kernel (https://www.kitploit.com/search/label/Kernel) 6.5x onwards. An alternative to this is to scan (https://www.kitploit.com/search/label/Scan) the kernel memory, and later add it to lsmod again, so it can be removed. So in summary, this LKM abuses the function of lkm rootkits that have the functionality to become visible again. OBS: There is another trick of removing/defusing a LKM rootkit, but it will be in the research (https://www.kitploit.com/search/label/Research) that will be launched. Download Imperius (https://github.com/MatheuZSecurity/Imperius)

Imperius - Make An Linux Kernel Rootkit Visible Again http://www.kitploit.com/2024/09/imperius-make-linux-kernel-rootkit.html

Evade EDR's the simple way, by not touching any of the API's they hook. Theory I've noticed that most EDRs fail to scan scripting (https://www.kitploit.com/search/label/Scripting) files, treating them merely as text files. While this might be unfortunate for them, it's an opportunity for us to profit. Flashy methods like residing in memory or thread injection (https://www.kitploit.com/search/label/Injection) are heavily monitored. Without a binary signed by a valid Certificate Authority, execution is nearly impossible. Enter BYOSI (Bring Your Own Scripting Interpreter). Every scripting interpreter is signed by its creator, with each certificate being valid. Testing in a live environment revealed surprising results: a highly signatured PHP script from this repository not only ran on systems monitored by CrowdStrike and Trellix but also established an external connection without triggering any EDR detections. EDRs typically overlook script files, focusing instead on binaries for implant delivery. They're configured to detect high entropy (https://www.kitploit.com/search/label/Entropy) or suspicious sections in binaries, not simple scripts. This attack method capitalizes on that oversight for significant profit. The PowerShell (https://www.kitploit.com/search/label/PowerShell) script's steps mirror what a developer might do when first entering an environment. Remarkably, just four lines of PowerShell (https://www.kitploit.com/search/label/PowerShell) code completely evade EDR detection, with Defender/AMSI also blind to it. Adding to the effectiveness, GitHub serves as a trusted deployer. What this script does The PowerShell script achieves EDR/AV evasion (https://www.kitploit.com/search/label/Evasion) through four simple steps (technically 3): 1.) It fetches the PHP archive for Windows and extracts it into a new directory named 'php' within 'C:\Temp'. 2.) The script then proceeds to acquire the implant PHP script or shell, saving it in the same 'C:\Temp\php' directory. 3.) Following this, it executes the implant or shell, utilizing the whitelisted PHP binary (which exempts the binary from most restrictions in place that would prevent the binary from running to begin with.) With these actions completed, congratulations: you now have an active shell on a Crowdstrike-monitored system. What's particularly amusing is that, if my memory serves me correctly, Sentinel One is unable to scan PHP file types. So, feel free to let your imagination run wild. Disclaimer. I am in no way responsible for the misuse of this. This issue is a major blind spot in EDR protection, i am only bringing it to everyones attention. Thanks Section A big thanks to @im4x5yn74x for affectionately giving it the name BYOSI, and helping with the env to test in bringing this attack method to life. Edit It appears as though MS Defender is now flagging the PHP script as malicious, but still fully allowing the Powershell script full execution. so, modify the PHP script. Edit hello sentinel one :) might want to make sure that you are making links not embed. Download BYOSI (https://github.com/oldkingcone/BYOSI)

BYOSI - Evade EDR's The Simple Way, By Not Touching Any Of The API's They Hook http://www.kitploit.com/2024/09/byosi-evade-edrs-simple-way-by-not.html

Install go install github.com/TaurusOmar/psobf@latest Example of Obfuscation Levels The obfuscation levels are divided into 5 options. First, you need to have a PowerShell file that you want to obfuscate. Let's assume you have a file named script.ps1 with the following content: Write-Host "Hello, World!" Level 1: Basic Obfuscation Run the script with level 1 obfuscation. ./obfuscator -i script.ps1 -o obfuscated_level1.ps1 -level 1 This will generate a file named obfuscated_level1.ps1 with the obfuscated content. The result will be a version of your script where each character is separated by commas and combined at runtime. Result (level 1) $obfuscated = $([char[]]("`W`,`r`,`i`,`t`,`e`,`-`,`H`,`o`,`s`,`t`,` `,`"`,`H`,`e`,`l`,`l`,`o`,`,` `,`W`,`o`,`r`,`l`,`d`,`!`,`"`") -join ''); Invoke-Expression $obfuscated Level 2: Base64 Encoding Run the script with level 2 obfuscation: ./obfuscator -i script.ps1 -o obfuscated_level2.ps1 -level 2 This will generate a file named obfuscated_level2.ps1 with the content encoded in base64. When executing this script, it will be decoded and run at runtime. Result (level 2) $obfuscated = [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String('V3JpdGUtSG9zdCAiSGVsbG8sIFdvcmxkISI=')); Invoke-Expression $obfuscated Level 3: Alternative Base64 Encoding Execute the script with level 3 obfuscation: ./obfuscator -i script.ps1 -o obfuscated_level3.ps1 -level 3 This level uses a slightly different form of base64 encoding (https://www.kitploit.com/search/label/Encoding) and decoding (https://www.kitploit.com/search/label/Decoding) in PowerShell, adding an additional layer of obfuscation. Result (level 3) $e = [System.Convert]::FromBase64String('V3JpdGUtSG9zdCAiSGVsbG8sIFdvcmxkISI='); $obfuscated = [System.Text.Encoding]::UTF8.GetString($e); Invoke-Expression $obfuscated Level 4: Compression and Base64 Encoding Execute the script with level 4 obfuscation: ./obfuscator -i script.ps1 -o obfuscated_level4.ps1 -level 4 This level compresses the script before encoding it in base64, making analysis more complicated. The result will be decoded and decompressed at runtime. Result (level 4) $compressed = 'H4sIAAAAAAAAC+NIzcnJVyjPL8pJUQQAlRmFGwwAAAA='; $bytes = [System.Convert]::FromBase64String($compressed); $stream = New-Object IO.MemoryStream(, $bytes); $decompressed = New-Object IO.Compression.GzipStream($stream, [IO.Compression.CompressionMode]::Decompress); $reader = New-Object IO.StreamReader($decompressed); $obfuscated = $reader.ReadToEnd(); Invoke-Expression $obfuscated Level 5: Script Fragmentation Run the script with level 5 obfuscation: ./obfuscator -i script.ps1 -o obfuscated_level5.ps1 -level 5 This level fragments the script into multiple parts and reconstructs it at runtime. Result (level 5) $fragments = @( 'Write-', 'Output "', 'Hello,', ' Wo', 'rld!', '"' ); $script = $fragments -join ''; Invoke-Expression $script This program is provided for educational and research purposes. It should not be used for malicious activities. Download Psobf (https://github.com/TaurusOmar/psobf)