Hacker Notes

Bypass 2FA over RDP (product: Kaspersky Security Center) Sample command:

reg.py domain.local/pentest@ksc01 -k -no-pass add -keyName 'HKCR\CLSID\{7a6b350e-2fb5-4b07-bcc2-7413ced94def}' -v 'NetworkBypassList' -vt REG_SZ -vd 10.10.10.11,10.10.8.22

Brief:

More and more often in projects I come across 2FA on critical servers, which I want to log in to via RDP, for example, Kaspersky Security Center. The most popular solution I come across which is Multifactor. On one of the last projects with a colleague, we got into just such a situation - we already had domain admin rights, but we couldn’t log in via RDP, we had to look for ways around it. And the box was easy to open. We go to the product website in the documentation section and see an interesting parameter NetworkBypassList. Yes, that’s right, it determines which IP addresses can be used, ignoring 2FA. Using reg.py, we can write an exception to the registry on the desired server and connect without problems, ignoring Multifactor. reg.py domain.local/pentest@ksc01 -k -no-pass add -keyName 'HKCR\CLSID\{7a6b350e-2fb5-4b07-bcc2-7413ced94def}' -v 'NetworkBypassList' -vt REG_SZ -vd 10.10.10.11,10.10.8.22 The moral: very often deep research is not needed, just reading the documentation is enough :)

🔗 @hackern0tes

EDR Remote Kill! Krueger: Proof of Concept (PoC) .NET tool for remotely killing EDR with WDAC

Krueger is a Proof of Concept (PoC) .NET post-exploitation tool for remotely killing Endpoint Detection and Response (EDR) as apart of lateral movement procedures. Krueger accomplishes this task by utilizing Windows Defender Application Control (WDAC), which is a built in Microsoft created application control utility that has the ability to block code at the user and kernel-mode levels. Using Krueger with administrative permissions over a target remote device, an adversary can quickly place a WDAC policy to disk and perform a remote reboot, preventing the EDR service from starting on boot.

Read More 🔗 @hackern0tes

CrystalDump Dump LSASS Using Only NTAPIs with Crystal Language

CrystalDump is a port of NativeDump written in Crystal lang, designed to dump the LSASS process using only NTAPI functions: • NtOpenProcessToken and NtAdjustPrivilegesToken to enable the SeDebugPrivilege privilege • NtGetNextProcess and NtQueryInformationProcess to get a handle to the lsass process • RtlGetVersion to get OS information • NtReadVirtualMemory and NtQueryInformationProcess to get modules information • NtQueryVirtualMemory and NtQueryInformationProcess to get memory regions information The tool supports remapping ntdll.dll using a process created in debug mode. For this it uses the NTAPI functions NtQueryInformationProcess, NtReadVirtualMemory, NtProtectVirtualMemory, NtClose, NtTerminateProcess and NtRemoveProcessDebug; and the Kernel32 function CreateProcessW.

Github 🔗 @hackern0tes

RustSoliloquy Capture NetNTLM hashes by interacting locally with the NTLM authentication package without touching LSASS

RustSoliloquy is a Rust implementation of the Internal-Monologue, designed to capture NetNTLM hashes by interacting locally with the NTLM authentication package without touching LSASS. This project combines the use of native APIs for most operations with the Security Support Provider Interface (SSPI) specifically for handling NTLM negotiation. At its core, RustSoliloquy is a personal learning project aimed at deepening the understanding of NTLM authentication using the SSPI (Security Support Provider Interface) API.

Read More 🔗@hackern0tes

Attacking Cortex XDR from an unprivileged user perspective CVEs: CVE-2024-5907 Cortex XDR Agent: Local Privilege Escalation (PE) Vulnerability CVE-2024-9469 Cortex XDR Agent: Local Windows User Can Disable the Agent Brief:

In this context, we put some effort into the analysis of Cortex XDR and identified some interesting findings. This blog post details two vulnerabilities (CVE-2024-5907 and CVE-2024-9469) that have now been fixed by Palo Alto and which could at the time be exploited by a low privileged user. This research on Cortex XDR was performed by Florian Audon (@Nodauf) and Romain Melchiorre (@PMa1n).

Read More #Redteam #Cortex #EDR 🔗 @hackern0tes

Use Windows UI Framework to Evade EDR

A newly devised technique leverages a Windows accessibility framework called UI Automation (UIA) to perform a wide range of malicious activities without tipping off endpoint detection and response (EDR) solutions.

Read More #redteam #edr_bypass 🔗 @hackern0tes

DCOM Upload & Execute

DCOM Lateral movement POC abusing the IMsiServer interface https://www.deepinstinct.com/blog/forget-psexec-dcom-upload-execute-backdoor The solution contains 2 projects • DCOMUploadExec - A C++ project which hosts the lateral movement attack code • AssemblyPayload - A .NET DLL that pops a MessageBox. It is the default payload DCOMUploadExec uses

Read More Tool: Github 🔗 @hackern0tes

Maltrak | Course: In-Depth Red Teaming: APT Adversary Simulation 🔗 @hackern0tes

Black and white: Glutton Trojan lurks in mainstream PHP frameworks, secretly invading for a year Target Frameworks: Laravel Thinkphp Yii …

Glutton has been operating outside the security community's monitoring for at least one year. In addition to traditional cybercrime activities targeting "white parties", Glutton also shows a strong interest in "black parties". Its author clearly has the ambition to "win three times", which is reflected in the following three aspects: 1 Steal high-value sensitive information of the initiators of black and gray industries ; 2 Reap the huge economic benefits brought by the black and gray industries themselves ; 3 Collect sensitive data of black and gray market participants to lay the foundation for subsequent phishing or social engineering activities .

Read More 🔗 @hackern0tes

AppSec Engineer DevSecOps Masterclass by Blackhat, ripped by HexleakWorld, 2024 This training is a comprehensive, focused and practical approach at implementing Security for your Continuous Delivery Pipeline. The training is backed by tons of hands-on labs, original research and real-world implementations of DevSecOps that work. The training starts with Application Security Automation for SAST, DAST, SCA, IAST and RASP, apart from Vulnerability Management and Correlation. Subsequently, the training focuses on Cloud Security and automating security processes in the cloud. Finally the training closes with a deep-dive of DevSecOps Practices for Kubernetes and Containers, with detailed perspectives of implementing scalable security for these deployments. Participants get a free (OSS) toolkit for DevSecOps Implementations and a 2 month access to our online lab environment for DevSecOps training ❗️ Official page + Virtual edition 📌 Announce 2024 Pass: @hexleakworld 🔗 @hackern0tes

Timeroasting and its applicability in a real world case of red-teaming !

Timeroasting is a relatively new attack vector (by @SecuraBV) in Active Directory environments which lets an unauthenticated attacker to query a DC for an NTP Response encrypted with the NT hash of a machine account for every computer in the domain by RID. It is possible due to the ability of abusing the [MS-SNTP] extension designed to prevent AitM attacks on computers’ clock synchronization procedure.

Read More 🔗 @hackern0tes

Bypassing WAFs with the phantom $Version cookie

HTTP cookies often control critical website features, but their long and convoluted history exposes them to parser discrepancy vulnerabilities. In this post, I'll explore some dangerous, lesser-known features of modern cookie parsers and show how they can be abused to bypass web application firewalls. This is the first part of a series of blog posts on cookie parsing.

Read More 🔗 @hackern0tes

CapibaraZero Firmware With ESP32-S3 Low Cost Flipper Zero alternative Project Website: https://capibarazero.com/ 🔗 @hackern0tes

SuperdEye: Making Indirect Syscall with Go to bypass AV and EDR

SuperdEye is the implementation of HellHall (a revised version of TartarusGate) in pure Go and Go Assembler. The purpose is to scan hooked NTDLL and retrieve the Syscall number to then do an indirect Syscall with it, thus allowing the bypass of AV/EDR that put hooks on functions.

Read More 🔗 @hackern0tes

Exfiltration of personal information from ChatGPT via prompt injection

We report that ChatGPT 4 and 4o are susceptible to a prompt injection attack that allows an attacker to exfiltrate users’ personal data. It is applicable without the use of any 3rd party tools and all users are currently affected. This vulnerability is exacerbated by the recent introduction of ChatGPT’s memory feature, which allows an attacker to command ChatGPT to monitor the user for the desired personal data.

Link To Paper 🔗 @hackern0tes