Another way to exploit “GenericWrite” ACL’s
Pivoting For Pentesters
Here I will be showing the easiest and most useful pivot techniques I use on penetration testing engagements as well as HackTheBox Pro Lab networks. We will not be discussing other types of pivots, including the myriad ways to bend SSH to your will as those topics are already well documented.
Nakivo Stored Xss
A Review Of Enterprise Attack Initial Access Training
I recently had the pleasure of attending Steve Borosh’s “Enterprise Attack Initial Access” course offered through Antisyphon. This is my review.
Nim Convert Shellcode To Uuid
NCC Group published an article titled “RIFT: Analysing a Lazarus Shellcode Execution Method”. This shellcode execution method bypasses some of the usual Sysmon/ETW detections on VirtualAlloc, WriteProcessMemory or CreateThread by encoding the shellcode in UUID’s before creating space on the heap and using some relatively benign WinAPI calls to execute the shellcode. At the moment I’m not sure how many EDR’s this will evade, but I do know that this method will evade detection by most if not all antivirus products. The only detection I’ve found after using Sysmon with a common public domain ruleset is a crash found in the Application log after the shellcode has already executed, which the user never sees.
Offensive Nim Dll Injection
I’ve been learning Nim programming and love how easy and productive Nim development is compared to C/C++, while also giving you low-level control and a fantastic Windows FFI. There are already some great examples out there on Offensive Nim, including Byt3bl33d3r’s OffensiveNim GitHub repository. I recently found that there didn’t seem to be any examples of how to use Nim to inject a DLL from disk into a process. After spending more than a day debugging my code, I stumbled on waldo-irc’s NimMusings example. This post is a simple explanation on the Windows API call differences between injecting shellcode and DLL’s into a process using Nim.
Hackthebox Jeeves Pwn Challenge
Jeeves is a HackTheBox (binary) Pwn challenge, and is now retired. It’s an easy challenge:
Symbol Resolution On Linux
This post discusses how a compiled C program (Elf) on Linux resolves the location in memory for shared libraries and includes a walkthrough of the Procedure Linkage Table (PLT) and Global Offset Table (GOT).
Tips On Building A Pentest Appliance
This article doesn’t cover HOW to build a pentest appliance virtual machine although it does link to another article that I followed. What I do cover here is after you’ve built a pentest appliance virtual machine in vmware, how to reduce the file size so that when you export it to OVA and give it to your customer it will be as small as possible. I started out with a 20 GB OVA file even though the disk usage was only 9 GB, and through the following steps I reduced it down to 4 GB.
This is my walkthrough of HackTheBox Doctor, 10.10.10.209.
Kali Command Line Logging
Kali Linux recently switched from the Bash shell to Zsh. I log the output of every command run during a pentest to a logfile, in addition to saving screenshots. Pentesters are frequently asked by the client or Blue Team for information to correlate with SIEM alerts, so it’s a good idea to update your Zsh prompt to include the date, time, and IP address.
Test Ios Apps On Linux
In the past I’d use a Mac when I needed to test iOS apps on a jailbroken device due to getting an error in Linux about needing to mount an Apple Developer Disk image when trying to use Frida and Objection on Ubuntu or Kali to test an iOS device:
Thick Client Testing
Kickoff call: During the kickoff call, ask if any user input in the thick client app can be viewed by backend web interfaces, or if there is a web client that complements the thick client. If yes, ask if they want to add it to be tested. This should be scoped to another assessment, as we don’t want to give away free work. Additionally, there is a possible attack vector if user input in the thick client is not sanitized and can trigger attacks such as XSS in the web client.
Docker For Pentesters
Docker has some very good use cases for pentesters. I cover what is Docker, how to install it, basic usage, and some interesting use cases for penetration testers. This video covers using Docker to run pentesting tools, not how to exploit docker containers.
Golang Convert Cidr Address To Hosts
The following Golang code demonstrates how to take a network address string in CIDR format and return a slice of strings containing host addresses. Note that I found this code on the Golang Playground (I don’t know specifically who to attribute it to) and edited it slightly and added my own comments so that I was sure to understand what the code was doing before posting it here for my notes.
Nessus Exploitable Parser
Nessus-Exploitable is a simple Ruby script to parse Nessus .nessus files and output all exploitable vulnerabilities in tab separated values format for import into Excel.
Configure Pentest Dropbox Dns Tunneling
I was working for a very large corporation that has many subsidiaries and they were buying up smaller companies. We needed to send out a dropbox (Raspberry Pi or Intel NUC) that we could have a remote office plug into the network for internal pentesting and it establishes a ssh tunnel to our server regardless of network restrictions in the remote office.
Android Testing Cheatsheet
Android Testing Cheatsheet - Configuring tools and mobile device for Android app testing and find vulnerabilities. Updated on 4/20/2020
Bypass Android Root Detection Using Objection
How to use the Objection framework with Frida to reverse engineer an Android app to bypass root detection.
Mobile Pentesting Tools
This is my listing of iOS and Android assessment tools for my personal bookmarks.
Ruby-Nessus is a ruby interface for the popular Nessus vulnerability scanner. Ruby-Nessus aims to deliver an easy yet powerful interface for interacting and manipulating Nessus scan results and configurations. Ruby-Nessus currently supports both version 1.0 and 2.0 of the .nessus file format.
Parsing Creds From Lsass.exe Dumps Using Pypykatz
Update: CrackMapExec now includes the ‘lsassy’ module which automates the following steps. While the article below still works, if you need dump lsass across multiple hosts, I’d use CrackMapExec as the steps below take a lot more time.
TLS Decryption in Wireshark
While testing web applications, I monitor the application using Wireshark to see if the app is using a protocol that lacks support in Burp Suite, like HTTP2. This post shows how to decrypt TLS traffic in Wireshark on Kali Linux.
Error Flashing CrazyRadio PA USB Dongle on VMWare
One of the prerequisites for using jackit with a CrazyRadio PA USB dongle is first flashing it using mousejack. This has always been problematic when using VMware. I was getting the error “The connection for the USB device ‘Nordic ASA nRF24LU1P-F32 BOOT LDR’ was unsuccessful.” which looked like a VMware dialog, not a dialog generated by the virtual machine (Kali Linux).
Install Powershell On Kali Linux
Update: This post is outdated. The Kali repo’s are fixed and now the best way to install PowerShell on Kali is to run this command:
apt update && apt -y install powershell
Howto Arp Spoof Using Scapy
Sure there are already some pretty good security tools that can pull off ARP spoofing: Ettercap, Bettercap, etc. This post details what I learned when I wanted to do it myself using Scapy, in the hopes that I can help someone else who’s also trying to learn how to use Scapy. After a while you get tired of using other people’s tools and want to learn how to do it yourself, even if you’re just creating yet another tool to do ‘X’, at least you’re learning something new.
Easy Scapy Tcp Handshakes
Sometimes you may want to manually establish TCP 3-way handshakes when you’re using Python Scapy, but wouldn’t it be nice to use sockets to maintain the TCP handshake and pass the data to/from Scapy? If you don’t really care about the TCP handshake and want that taken care of while you fuzz the data, here’s an easy way using a StreamSocket with Scapy:
Password Spraying Active Directory Authenticated Websites With Python And Burp Suite
I frequently use the Intruder tab in Burp Suite Pro to password spray websites which use Active Directory authentication. One of the problems of using Burp Suite is that there doesn’t seem to be a way to avoid lockout when using a long password list. Frequently I don’t get a hit on valid password on the first try with Season/Year stuff like “Winter2018!” and need to run through a list of 51 common AD passwords that I have in a file. Sure, I can paste in a list of three or four passwords (depending on my client’s lockout policy), but then I have to wait X minutes and then replace those passwords with three of four more, track the time between password spray runs, etc. That’s a manual process, and I’d prefer something that I can setup and just let it run to completion.
ScanCannon - Runs Masscan, followed up by Nmap for service version info. This should finish scans much faster than Nmap alone while providing service version info that Masscan doesn’t provide.
Interested vs. Committed
The one thing that changed my life was when I read about interest vs commitment. Too often I hear people wish that things were different, or they want things they will never have or accomplish. They don’t know what it means to be committed to something, so they wander through life like a leaf on a stream, never knowing they’re holding themselves back and maybe they blame others or circumstance.
Welcome to my blog!
I tired of maintaining my own Wordpress blog, and issues with Wordpress on Digital Ocean resulted in my database going down repeatedly. Now I’m hosting on github.io and don’t have to worry about site security, databases, etc., just write and publish!