Hacker Notes

Privilege Escalation on Zabbix! Escalate from regular user using SQLi!

This script demonstrates the exploitation of the vulnerability CVE-2024-42327, registered by Zabbix as ZBX-25623. This vulnerability allows unauthorized access to sensitive user information by abusing the JSON-RPC API. References: - CVE: CVE-2024-42327 - Zabbix Issue Tracker: https://support.zabbix.com/browse/ZBX-25623 Functionality: 1. Logs in to the Zabbix JSON-RPC API to obtain a session token using a valid username and password. 2. Iterates over a range of user IDs (1 to 40), fetching user details for each ID.

Read More 🔗 @hackern0tes

Using Symantec Management Agent for lateral movement! When the knife cuts its handle :)

On a recent Red Team for a particularly hardened client, we were looking to escalate our privileges in order to move off the endpoint and pivot into the server subnets. When none of the usual paths bore fruit, we began to look into the management software installed on the endpoint, specifically Symantec Management Agent (previously known as “Altiris”). Indeed this was something we had run into before and were keen to see what could be done from a privilege escalation perspective. Reviewing the online documentation revealed the use of a “Account Connectivity Credential (ACC)”. This account is used to facilitate network access to the Symantec Site Server in order to download package, policy and task configuration data. This immediately reminded us of another three letter acronym used to perform an almost identical task within Microsoft SCCM, the Network Access Account (NAA).

Read More Tool: EvilAltiris 🔗 @hackern0tes

NativeBypassCredGuard

A tool designed to bypass Credential Guard by patching WDigest.dll using only NTAPI functions (exported by ntdll.dll). It is available in two flavours: C# and C++.

Read More 🔗 @hackern0tes

RedEDR

Display events from Windows to see the detection surface of your malware. Same data as an EDR sees. • Find the telemetry your malware generates • Verify your anti-EDR techniques work • Debug and analyze malware

#EDR #ETW #Redteam Read More 🔗 @hackern0tes

List of 142 hardcoded security process names used in a malware! Source: Trellix Report 🔗 @hackern0tes

Bypassing Antivirus using Game Engine! Intresting part:

This new technique allows threat actors to target and infect devices across multiple platforms, such as Windows, macOS, Linux, Android, and iOS. 

Brief:

Check Point Research discovered a new technique taking advantage of Godot Engine, a popular open-source game engine, to execute crafted GDScript, code which triggers malicious commands and delivers malware. The technique remains undetected by almost all antivirus engines in VirusTotal.  Check Point identified GodLoader

,

a loader that employs this new technique. The threat actor behind this malware has been utilizing it since June 29, 2024, infecting over 17,000 machines. The malicious GodLoader is distributed by the

Stargazers Ghost Network

,

 a GitHub network that distributes malware as a service. Throughout September and October, approximately 200 repositories and over 225 Stargazers were used to legitimize the repositories distributing the malware. 

This new technique allows threat actors to target and infect devices across multiple platforms, such as Windows, macOS, Linux, Android, and iOS. 

Read More 🔗 @hackern0tes

Portable Flying Jammer! This drone uses a Raspberry Pi tactical Software Defined Radio. Read More Reddit Discussion 🔗 @hackern0tes

KrbRelayEx Lets play Man-in-the-Middle on Kerberos!

KrbRelayEx is a tool designed for performing Man-in-the-Middle (MitM) attacks by relaying Kerberos AP-REQ tickets. It listens for incoming SMB connections and forwards the AP-REQ to the target host, enabling access to SMB shares or HTTP ADCS (Active Directory Certificate Services) endpoints on behalf of the targeted identity.

Read More 🔗 @hackern0tes

How To Use MSSQL CLR Assembly To Bypass EDR

A few days ago, I dealt with a blackmail incident involving an MSSQL database, which potentially evaded EDR detection. I intend to share the entire process. Upon analyzing the situation, I found that the root cause was a weak password—essentially a type of dictionary password. The hacker was able to log in to the database using this weak password and injected his Cobalt Strike shellcode, gaining complete control over the MSSQL Server.

#EDR #Bypass #RedTeam Read More 🔗 @hackern0tes

Living off the VPN — Exploring VPN Post-Exploitation Techniques What can an attacker accomplish while using only the VPN management interface?

• In this blog post, Akamai researchers highlight the overlooked threat of VPN post-exploitation; that is, we address techniques that can be used by threat actors after compromising a VPN server to further escalate their intrusion. • Our findings include several vulnerabilities that affected Ivanti Connect Secure and FortiGate VPNs. • In addition to the vulnerabilities, we detail a set of no-fix techniques that can affect the Ivanti Connect Secure and FortiGate products, and potentially other VPN servers, as well. • Our research shows that, in many cases, a compromised VPN server could allow attackers to easily gain control over other critical assets in the network.

Read More

Windows Critical CVE CVE-2024-43447 Windows SMBv3 Server Remote Code Execution Vulnerability Its really fun that microsoft announced before its planning to make the exploitation of SMB harder in V3 but seems like its not going to work 😂 Seems like Microsoft is still in love with RedTeamers 💔 Read More 🔗 @hackern0tes

ADCS Attack Techniques Cheatsheet This is a handy table outlining the various methods of attack against Active Directory Certificate Services (ADCS) Link 🔗 @hackern0tes

4,000,000 WordPress Sites Using Really Simple Security Free and Pro Versions Affected by Critical Authentication Bypass Vulnerability Read More 🔗 @hackern0tes

gSigFlip (Golang SigFlip) A tool to bypass Hash-based driver blocklists (Authenticode Signature)

SigFlip is a tool for patching authenticode signed PE files (exe, dll, sys ..etc) in a way that doesn't affect or break the existing authenticode signature, in other words you can change PE file checksum/hash by embedding data (i.e shellcode) without breaking the file signature, integrity checks or PE file functionality.

Read More 🔗 @hackern0tes

RustiveDump

RustiveDump is a Rust-based tool designed to dump the memory of the lsass.exe process using only NT system calls. It creates a minimal minidump file from scratch, containing essential components like SystemInfo, ModuleList, and Memory64List, with support for XOR encryption and remote transmission.

Read More 🔗 @hackern0tes

Ghost 👻 Shellcode #loader project designed to #bypass multiple detection capabilities that are usually implemented by an EDR. Read More 🔗 @hackern0tes

Mozilla Firefox 0-day: URL protocol handler leak CVE IDs: [CVE-2024-9398, CVE-2024-5690]

This article describes the " Mozilla Firefox Information Disclosure 0-day Vulnerability (CVE-2024-9398, CVE-2024-5690) " announced at AVTOKYO2024 . The vulnerability described in this article allows the presence or absence of URL protocol handler settings, which should be kept secret by the browser, to be leaked via the page. As a result, an attacker can identify various applications installed on the target user's machine.

Read More 🔗 @hackern0tes