Archive | March, 2016

TempRacer – Windows Privilege Escalation Tool

Use Netsparker


TempRacer is a Windows Privilege Escalation Tool written in C# designed to automate the process of injecting user creation commands into batch files with administrator level privileges.

tempracer - Windows Privilege Escalation Tool

The code itself is not using that many resources because it relies on callbacks from the OS. You can keep it running for the the whole day to try and catch the creation of an admin level batch file. It’s especially useful (and very successful) in environments where automated patching systems like BigFix are running. If you are able to trigger updates or new software installs you should give it a try.

Usage

You can use this tool to watch for *.bat file creation and try to inject “add user” to it, so that you can get local admin privs. Usage example:

Test it with:

If successful it will inject the code to add the user “alex” with password “Hack123123” and add him to the local administrator group. It will also block the file for further changes, so the privilege escalation code stays inside.

You can also find some Windows Privilege Escalation Tools in: PowerSploit – A PowerShell Post-Exploitation Framework

And if you want to scan for privilege issues or misconfiguration, use this – windows-privesc-check – Windows Privilege Escalation Scanner

You can download tempracer here:

TempRacer.exe
tempracer-1.zip (Source)

Or read more here.

Posted in: Hacking Tools, Windows Hacking

Topic: Hacking Tools, Windows Hacking


Latest Posts:


Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.


PEiD Download – Detect PE Packers, Cryptors & Compilers

Use Netsparker


PEiD is an intuitive application that relies on its user-friendly interface to detect PE packers, cryptors and compilers found in executable files – its detection rate is higher than that of other similar tools since the app packs more than 600 different signatures in PE files.

PEiD - Detect PE Packers, Cryptors & Compilers


What is PEiD?

PEiD comes with three different scanning methods, each suitable for a distinct purpose. The Normal one scans the user-specified PE file at its Entry Point for all its included signatures. The so-called Deep Mode comes with increased detection ratio since it scans the file’s Entry Point containing section, whereas the Hardcore mode scans the entire file for all the documented signatures.

When users need to get their results right away, they can rely on the Normal or the Deep modes, and they can turn to the Hardcore one when they are willing to wait the time it takes for the scan to complete – regardless of the chosen type, the generated results are as accurate as possible due to the error control method.

In addition to the intuitive interface, its functions can also be accessed via command-line, and the detailed documentation can help users get familiarized to the proper commands and parameters.

This tool also allows users to explore all the currently running processes and terminate them with a single mouse click. One can also dump a module then scan then dumped image, or analyze the dependent modules of a process.

You can also check out:

Malware Analyser v3.0 – A Static & Dynamic Malware Analysis Tool


How to use PEiD

The best results can be obtained if each file is analysed separately as it takes less time to complete the scan, but PEiD also supports batch processing. Users can choose a folder, then set PEiD to select the PE files and scan them.

To sum it up, PEiD is a feature-packed application that can scan PE files and identify packers and compilers, while also featuring a HEX viewer and a task manager.

Update your PEiD Signatures

Update your signatures (initial file is empty). Replace the initial userdb.txt file with one of these files:

http://handlers.sans.org/jclausing/userdb.txt
https://raw.githubusercontent.com/ynadji/peid/master/userdb.txt

Download PEiD

You can download PEiD here:

PEiD-0.95-20081103.zip

Or read more here.

Posted in: Malware

Topic: Malware


Latest Posts:


Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.


FBI Backed Off Apple In iPhone Cracking Case

Use Netsparker


So the big furore this week is because the FBI backed off Apple in the whole Apple vs the World privacy case regarding cracking the iPhone Passcode of the phone belonging to the San Bernardino gunman Syed Farook.

If you’re not familiar with the case, catch up with it here: FBI–Apple encryption dispute.

FBI Backed Off Apple In iPhone Cracking Case

The latest turn in this case is that the FBI have said basically a 3rd party has demonstrated them a way to unlock the phone without Apple building a specific iOS version with weaker password back-off algorithms (which is what they were proposing) to allow brute forcing.

The FBI has come to a sudden and surprising all-stop in its legal war with Apple.

Rather than compel the Cupertino giant to help it unlock an iPhone belonging to one of the San Bernardino killers, the Feds say they may be able to break into the handset without the company’s assistance after all.

In a filing [PDF] submitted late Monday in a central California federal court, the Feds asked for a crunch hearing due to take place on Tuesday be vacated and proceedings be suspended at least until next month. The court has granted the request.

The FBI will use that time to test an alternate method for unlocking the iPhone that will not involve, as it had originally sought, Apple building a specially crafted version of the iOS firmware.

That custom operating system, when installed on the phone during boot up, would allow agents to guess the passcode by brute force without the device wiping itself after too many wrong attempts.

Now, despite insisting repeatedly that Apple were the only ones on the planet who could help its investigation, the Feds may use someone else’s unlock method instead, apparently.

“On Sunday, March 20, 2016, an outside party demonstrated to the FBI a possible method for unlocking [San Bernardino gunman Syed] Farook’s iPhone,” the FBI said in its filing.

“Testing is required to determine whether it is a viable method that will not compromise data on Farook’s iPhone. If the method is viable, it should eliminate the need for the assistance from Apple Inc.”

Apple did not immediately respond to a request for comment.


It’s an interesting turn in the case, and a collective sigh of relief is being exhausted from the security community as NO ONE wanted to Apple to compromise their own security standards just because of an iPhone 5C which may or may not have any pertinent data on it.

We will have to wait a little longer to see what actually happens right now as the Feds have just put a pause on proceedings now, citing they need time to validate the attack vector provided by this mysterious 3rd party.

The FBI said in its filing that it would be able to provide a progress report on the unlocking efforts on April 5, at which point the case could proceed or it could be dropped.

The move will be seen as a win for Apple, which has for weeks been fighting, both in court and in the press, against claims by the US government that it should comply with the FBI and craft deliberately weakened software.

“The FBI always had the option of hacking the phone the expensive way, using forensic tools; they never needed Apple for this,” Holmes Wilson, cofounder of digital rights campaign group Fight for the Future, told The Register.

“What they wanted was a legal precedent that let them force any company to issue malicious updates. So if they’re saying ‘maybe there’s another way’ that means they’re walking away with their tail between their legs, hopefully for good.”

Apple boss Tim Cook and his attorneys have been the public face of Apple’s opposition in this legal showdown. However, thousands of supporters within Apple’s own ranks and at fellow tech giants including Google, Amazon and Microsoft, have been resisting what they see as a power grab that would have a chilling effect on privacy and security, should engineers be forced to compromise their own products at the behest of governments.

There’s an interesting analysis by iOS chap Jonathan Zdziarski here: My Take on FBI’s “Alternative” Method, although it is of course all speculation, it’s speculation from a fairly well informed standpoint.

So we shall see, as with anything USG related – we are extremely unlikely to get any details on what is actually happening or the methods used whichever way the case goes.

Source: The Register

Posted in: Apple, Legal Issues

Topic: Apple, Legal Issues


Latest Posts:


Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.


NAXSI – Open-Source WAF For Nginx

Use Netsparker


NAXSI is an open-source WAF for Nginx (Web Application Firewall) which by default can block 99% of known patterns involved in website vulnerabilities. NAXSI means Nginx Anti XSS & SQL Injection

NAXSI - Open-Source WAF For Nginx

Technically, it is a third party Nginx module, available as a package for many UNIX-like platforms. This module, by default, reads a small subset of simple (and readable) rules containing 99% of known patterns involved in websites vulnerabilities. For example, <, | or drop are not supposed to be part of a URI.

Being very simple, those patterns may match legitimate queries, it is NAXSI's administrator duty to add specific rules that will whitelist those legitimate behaviours. The administrator can either add whitelists manually by analyzing Nginx's error log, or (recommended) start the project by an intensive auto-learning phase that will automatically generate whitelisting rules regarding website's behaviour.


In short, NAXSI behaves like a DROP-by-default firewall, the only job needed is to add required ACCEPT rules for the target website to work properly. I love Nginx and use it for everything, so having a bit of extra protection for it, without too much hassle is great.

Why is it Different?

On the contrary of most Web Application Firewall, Naxsi doesn't rely on a signature base, like an antivirus, and thus cannot be circumvented by an "unknown" attack pattern. Another main difference between NAXSI and other WAF, NAXSI filters only GET and POST resquests, is a Free software (as in freedom) and free (as in free beer) to use.

Do note though, this model requires a bit more effort as you have to whitelist to get things to work but it will block more obfuscated and uncommon attacks without updates or modifications.

You can download the latest version of the module source code here:

naxsi-0.54.zip

But it's most easily installed with an optional distro friendly NAXSI included version of Nginx, which you just need to tweak the config for. On Ubuntu systems for example you'd just do:

One downside of this is you won't get the newest version of NAXSI (or most likely the latest Nginx either) but it will be stable. As Nginx doesn't support runtime module loading you can't update NAXSI outside of recompiling Nginx (not ideal).

You can also read more here.

Posted in: Countermeasures, Security Software

Topic: Countermeasures, Security Software


Latest Posts:


Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.


Frida – Dynamic Code Instrumentation Toolkit

The New Acunetix V12 Engine


Frida is basically Greasemonkey for native apps, or, put in more technical terms, it’s a dynamic code instrumentation toolkit. It lets you inject snippets of JavaScript into native apps on Windows, Mac, Linux, iOS and Android. Frida also provides you with some simple tools built on top of the Frida API. These can be used as-is, tweaked to your needs, or serve as examples of how to use the API.

Frida - Dynamic Code Instrumentation Toolkit

What?

Frida has a whole set of features but the main strengths it has are:

  • Scriptable – Your own scripts get injected into black box processes to execute custom debugging logic. Hook any function, spy on crypto APIs or trace private application code, no source code needed!
  • Stalking – Stealthy code tracing without relying on software or hardware breakpoints. Think DTrace in user-space, based on dynamic recompilation, like DynamoRIO and PIN.
  • Portable – Works on Windows, Mac, Linux, iOS and Android. Grab a Python package from PyPI or use Frida through its .NET binding, browser plugin or C API.

Tools

There’s 4 main tools in Frida:

  • frida-CLI – This is a REPL interface that aims to emulate a lot of the nice features of IPython (or Cycript), which tries to get you closer to your code for rapid prototyping and easy debugging.
  • frida-ps – This is a command-line tool for listing processes, which is very useful when interacting with a remote system.
  • frida-trace – This is is a tool for dynamically tracing function calls.
  • frida-discover – This is a tool for discovering internal functions in a program, which can then be traced by using frida-trace.

Why?

Here are some use cases in which you could utilise Frida:

  • There’s this new hot app everybody’s so excited about, but it’s only available for iOS and you’d love to interop with it. You realize it’s relying on encrypted network protocols and tools like Wireshark just won’t cut it. You pick up Frida and use it for API tracing.
  • You’re building a desktop app which has been deployed at a customer’s site. There’s a problem but the built-in logging code just isn’t enough. You need to send your customer a custom build with lots of expensive logging code. Then you realize you could just use Frida and build an application- specific tool that will add all the diagnostics you need, and in just a few lines of Python. No need to send the customer a new custom build – you just send the tool which will work on many versions of your app.
  • You’d like to build a Wireshark on steroids with support for sniffing encrypted protocols. It could even manipulate function calls to fake network conditions that would otherwise require you to set up a test lab.
  • Your in-house app could use some black-box tests without polluting your production code with logic only required for exotic testing.

How?

Frida’s core is written in C and injects Google’s V8 engine into the target processes, where your JS gets executed with full access to memory, hooking functions and even calling native functions inside the process. There’s a bi-directional communication channel that is used to talk between your app (Python?) and the JS running inside the target process.

On top of this C core there are multiple language bindings, e.g. Python, Node.js, .NET, Qml, etc., and it is very easy to build additional bindings for other languages and environments.

You can download Frida here:

frida-7.0.9.zip

Or read more here.

Posted in: Hacking Tools, Secure Coding

Topic: Hacking Tools, Secure Coding


Latest Posts:


Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.


Defence In Depth For Web Applications

The New Acunetix V12 Engine


Defence in depth for web applications is something that not many companies apply even though the model itself is nothing new. Defence in depth refers to applying security controls across multiple layers, typically Data, Application, Host, Internal Network, Perimeter, Physical + Policies/Procedures/Awareness.

Defence In Depth For Web Applications

Defence in depth is a principle of adding security in layers in order to increase the security posture of a system as a whole. In other words, if an attack causes one security mechanism to fail, the other measures in place take arms to further deter and even prevent an attack.

Comprehensive strategies for applying the defence in depth principle extend well beyond technology and fall into the realm of the physical. These can take the form of appropriate policies and procedures being set up, training and awareness, physical and personnel security, as well as risk assessments and procedures to detect and respond to attacks in time. These measures, crucial though they might be, are only but physical measures to preventing what is ostensibly an information security problem.

This article on the other hand will focus on how defense in depth principles could apply to web applications and the network infrastructure they operate within. This article will also offer a number of pointers (that is by no means exhaustive) which can be used to improve the security of web applications.

Most of the points in the article would be classified as common sense if you are pretty experienced in the infosec line, but sadly as know all too well. Common sense is actually very uncommon and any organisation you probe will fail on multiple layers.

And yes, never, ever roll your own crypto implementation – even for hashing passwords. We’ve all seen how that’s turned out in the past.

Read the full article by Acunetix here: Defence in depth and how it applies to web applications

Posted in: Countermeasures

Topic: Countermeasures


Latest Posts:


Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.
CTFR - Abuse Certificate Transparency Logs For HTTPS Subdomains CTFR – Abuse Certificate Transparency Logs For HTTPS Subdomains
CTFR is a Python-based tool to Abuse Certificate Transparency Logs to get subdomains from a HTTPS website in a few seconds.