Shared posts

23 May 23:01

Fowsniff 1: CTF walkthrough

by Nikhil Kumar

In this article, we will solve a Capture the Flag (CTF) challenge that was posted on VulnHub by berzerk0. As per the description given by the author, this is a beginner-level CTF but requires more than just an ExploitDB search or Metasploit to run. This makes this CTF especially interesting. You can check my previous […]

The post Fowsniff 1: CTF walkthrough appeared first on Infosec Resources.


Fowsniff 1: CTF walkthrough was first posted on April 18, 2019 at 8:00 am.
©2017 "InfoSec Resources". Use of this feed is for personal non-commercial use only. If you are not reading this article in your feed reader, then the site is guilty of copyright infringement. Please contact me at darren.dalasta@infosecinstitute.com
22 May 19:58

BSidesCharm 2019 Videos

Link: http://www.irongeek.com/i.php?page=videos/bsidescharm2019/mainlist
These are the videos BSidesCharm (Baltimore) 2019. Thanks for inviting me down to record. Thanks to my video team Robert, Ethan, Cory, Tim Steven, Trevor, Tom, Menachem and Josh.

Opening

Keynote
Matt Blaze

Embrace the Red: Enhancing detection capabilities with adversary simulation
Mauricio Velazco

I'lll Complete My Threat Model Later Mom!: Infosec in Middle School
Ashley Benitez Smith

Cleaning the Apple Orchard - Using Venator to Detect macOS Compromise
Richie Cyrus

More Tales From the Crypt...Analyst
Jeffrey Man

Anatomy & Evolution of a Fast Flux Malware Campaign
Emily Crose

COM Under The Radar: Circumventing Application Control Solutions
Jimmy Bayne

On The Line: What Phishing Really Impacts
Steven Becker

Automated Adversary Emulation
David Hunt

Comparing Malicious Files
Robert Simmons

How to Start a Cyber War: Lessons from Brussels
Chris Kubecka

You Moved to Office 365, Now What?
Sean Metcalf

You're Not as Safe as You Think: Clearing Up Common Security Misconceptions
Joshua Meyer

Keynote: The Declarative Future
Liam Randall

Exploring Community Volunteering Through a Career Development Lens
Kathleen Smith and Doug Munro

Defense in Depth Against DDoS Diminishes Dollars Destroyed
Daniel Gordon

Reasonable Rapid Recognition and Response to Rogues
Craig Bowser

BloodHound From Red to Blue
Mathieu Saulnier

A Code Pirate's Cutlass: Recovering Software Architecture from Embedded Binaries
evm

Technical Leadership: It's Not All Ones and Zeros
Timothy Schulz

Hunting for Threats in Industrial Environments and Other Scary Places
Nick Tsamis

It's Malware Time - A Bar Crawl from Skunked Homebrew to Rotten Apples
Erika Noerenberg

J-J-J-JEA Power
James Honeycutt

What did the SIEM Say?
JR Presmy and Shawn Thomas

Using Bashfuscator to Generate Bash Obfuscation
capnspacehook

Closing

17 May 19:00

Fileless UAC Bypass in Windows Store Binary

**Update** - 9/13/2019
Metasploit has added a module for the UAC Bypass in Windows! Most of Metasploit modules are built by community contributors for free (i. e. modules that are worth the effort to be included to make Metasploit users life easier). This UAC bypass was chosen due to the fact it a) does not require user interaction and b) it’s file-less (no dropping files on disk is needed). It’s common practice to give credit when its due when creating modules hence the reference to ACTIVELabs for the discovery. Find the module here.
**Update** - 5/23/2019
Please note Microsoft has released a behavioral detection for this attack vector in Windows Defender Antivirus with an alert level of “SEVERE."  We can confirm it works as expected. See the link here.

Based on the increased interest in User Account Control (UAC) bypass research as of late, we've decided to read more on the subject and attempt to identify some sort of a pattern which ultimately led to finding our first UAC (still valid as of this writing) bypass. The following is a walkthrough of said finding. Please note we will not discuss UAC internals as there are plenty of well-written posts out there. In addition, will be using Windows 10 Version 1803 (OS Build 17134.590) as an example.
The problematic binary is WSReset.exe, the Microsoft signed executable is used to reset Windows Store settings according to its manifest file but most importantly has “autoElevate” property set to true.
Now, let’s set Procmon64.exe with the following self-explanatory filters.
Running WSReset.exe (medium-integrity) shows the missing parameter for verb open under the HKEY_CLASSES_ROOT (HKCR) virtual registry hive which if found will be run in (high-integrity) context.
Now according to Microsoft documentation here there are two characteristics that we need to be aware of in regards to HKEY_CLASSES_ROOT (HKCR) virtual registry hive:

  • On Windows 2000 and above, HKEY_CLASSES_ROOT (HKCR) is a compilation of user-based HKCU\Software\Classes and machine-based HKLM\Software\Classes.
  • If a given value exists in both of the subkeys above, the one in HKCU\Software\Classes takes precedence.

The Component Object Model (COM) leverages HKEY_CLASSES_ROOT (HKCR) to maintain information about all of the COM objects installed on a computer, which allows for both per-user and per-machine object registration. In other words, the current user can write to HKEY_CURRENT_USER\Software\Classes (HKCU) which will effectively end up in HKEY_CLASSES_ROOT (HKCR) virtual registry hive. Here's the proof-of-concept code using PowerShell:
Invoke-WSResetBypass.ps1
    
And the obligatory demonstration of the attack:
​For what it's worth, we did report this to MSRC and received the following response:
Although we haven’t tested it ourselves, this particular technique can be remediated by setting the UAC level to “Always Notify” or taking away local administrative rights. We hope this post was worth your time and feel free to reach out at labs@activecyber.us if you have any questions.
 
Affected/tested Products
  • Windows 10 Version 1803 OS Build 17134.590
  • Windows 10 Version 1809 OS Build 17763.316

Disclosure Timeline
  • 02-19-19: Report sent to MSRC
  • 02-19-19: MSRC acknowledged report and case manager was assigned
  • 02-26-19: Requested status update
  • 02-27-19: MSRC responded the report is subpar, and the case will be closed out
  • 03-14-19: Blog post released
  • 05-23-19: Updated with Windows Defender Antivirus detection
08 Apr 21:29

Introducing Paged Out! magazine (also CFP)


Long story short: I've started a new project - Paged Out! - a free deeply technical magazine about programming/retro/hacking/security/electronics/demoscene/etc, where each article is limited to exactly one page. And today we're officially starting the Call For Pages (or call for papers/articles/whatever you want to call it) for the first issue.

Here's the website with all you need to know: https://pagedout.institute/.

Please help up spread the word - I don't know every amazing potential author on our technical scene, but all of you together DO! Plz help :)
(If you're also interested in helping out in another way, please also take a look at this page.)

Long story long:

As some of you know for several years I've been a technical reviewer for the "Programista" magazine (as the name implies, it's a Polish magazine about programming), and before that I helped in a similar role (for shorter time periods) in other magazines as well (HITB Magazine, and another one which we don't name nowadays). One common thing I've noticed about the articles is that almost all of them are pretty long (like 10 pages in print, or 20 pages in "source" form). The length is usually the result of the selected topic, author's desire to explain everything in sufficient detail, and lengthy well formatted code listings with verbose comments.

That's just how programming articles must be, right?

Well, not really. For example in late '80 one magazine page could house 2-3 programming articles. How was that possible? Usually there just wasn't a lot of text in the article - a paragraph or two of introduction, or a note on an especially tricky part in the presented code, followed by a long manually minimized (sic!) program listing. This required the reader to actually try to reverse-engineer the code in order to understand it - but readers are smart and it was actually pretty fun to do it too. The selected topics were commonly also quite different - instead of "everything you need to know about XYZ", the articles were more about individual code snippets or short programs that did or showcased something useful, fun (games!), clever or otherwise entertaining.

This led me to the idea of somehow convincing folks (hi!) to try and write short articles on different kind of topics - and thus (after playing with the idea for a couple of months) I decided to start a new free "zin" with a one-page-per-article limit.

If you think about it, there is another benefit to the limit itself: it takes way less time to write a 1 page article than a longer one. It's also easier to review it. And it doesn't take too much time to read it top-to-bottom. I would also like to believe that there is less pressure to write about Typical Big Topics - there is just no way to do a complete C++24 tutorial on a single page, so how about just showcase this one fun new thing?

Of course 1 page articles will never replace full sized ones, but then again, that's not really the goal here. The goal is to see if we can create informative 1 page articles that are fun to make, fun to read and don't require to allocate a lot of time on any front.

While setting up the framework for the project I had in mind both the classic demoscene/reverse-engineering zins (though these came usually as standalone executables, and I decided not to go this way), as well as the hacking scene ones - like Phrack or PoC||GTFO. What I always loved about these was that they were created with heart - from the community, for the community. And this is also what I wanted for the Paged Out! maga*zin*.

Given the above, the project is created as a not-for-profit one, with a focus on both readers and authors (and not $$$). This means that the issues will be downloadable for free, and the readers will be able to print them in larger amounts to give them away for free (yes, this was directly inspired by PoC||GTFO). This also means that we want the author to keep the copyrights, and only grant us a non-exclusive license (and optionally allow others to do an audio recording of the article).

Unfortunately there are two downsides here. First of all, we won't be able to pay the authors, and we also offset additional work on the authors (mainly: the layout of the page). And I personally also have to pocket out all expenses for the zin (not complaining, just stating a fact). To address this a little we do have plans to make the zin self-sustaining if possible (e.g. by selling ad space or special nicely printed editions) and to share most of the profit with authors. If you're interested, check out our proposed Standard Author's Agreement (note: authors are free to choose other licenses as well).

Eventually we hope to gather around 50-100 pages per issue, and publish an issue once per quarter (subject to delay if we have too few articles submitted).

I'll end this opening blog post with a big Thank You to all the folks who already believed in my vision and decided to join the project as volunteers - i.e. members of the Paged Out! Institute:

foxtrot_charlie,
KrzaQ,
• and j00ru.

I would also like to thank q3k for writing the initial article to help us both get an example to show, as well as test the process, and countless others from my discord server / IRC channels for the initial feedback on everything.

The next few weeks will be spent on trying to find articles, and then around June/July we hope to be able to present you with the first issue of the Paged Out! zin.
18 Mar 12:06

Pull apart an EXE file with Ghidra (NSA Tool) (Reverse Engineering)

by /u/mickyj_j
17 Mar 17:43

SEGA Genesis ROM Hacking with GHIDRA

by /u/zznop_
17 Mar 17:39

Trying to understand num % 1000 in assembly

by /u/unigee

I cannot work out for the life of me what the compiler is doing on a simple c line

int b = num % 1000; 

my full function is

int mod(int num) { int b = num % 1000; return b; } 

This produces the assembly https://godbolt.org/z/Zw3tzt

 push rbp mov rbp, rsp mov DWORD PTR [rbp-20], edi mov ecx, DWORD PTR [rbp-20] mov edx, 274877907 mov eax, ecx imul edx sar edx, 6 mov eax, ecx sar eax, 31 sub edx, eax mov eax, edx imul eax, eax, 1000 sub ecx, eax mov eax, ecx mov DWORD PTR [rbp-4], eax mov eax, DWORD PTR [rbp-4] pop rbp ret 

This is what I have deciphered so far

Line 6-8: Takes my input number and multiplies by a large arbitrary number 274877907

Why is this constant chosen? It changes if I change the 1000 in my source

This result is too big to fit into 32bits, so EDX = the higher bits, and EAX contains the lower bits.

Line 9: Shifts the value of EDX to the right by arbitrary number 6

Why is 6 chosen here? This too changes depending on the value of 1000 in source

So in English, assuming my input number is 2234

  1. it works out how many 1000's are in my input number. (2)
  2. it multiplies this by 1000 (2*1000 = 2000)
  3. it subtracts my input number by step 2, to produce the remainder (2234-2000= 234)

So I can see what it is doing, what I can't work out is why it does this to give me my correct answer.

Thanks

submitted by /u/unigee to r/asm
[link] [comments]
17 Mar 12:11

Fileless UAC Bypass in Windows Store Binary

by /u/IUsedToBeACave
14 Mar 12:28

Life of a SQL query

by /u/fagnerbrack
07 Mar 15:13

An Hour With Ghidra : The Good and The Ugly

by /u/fady_othman
07 Mar 14:54

Simultaneously querying two binary trees without merging

by /u/lukedanzxy

Hi guys, I ran into this problem the other day:

Suppose you have two binary trees A and B that contain different data but have the same form: each node stores two integers: p and n. p is used to order the nodes and n is the number of nodes in the whole subtree whose root is this node. You can also assume that the p values of all nodes in both trees are unique.

Given two nodes nA in A and nB in B (which may be past-the-end nodes), let A- and B- be the set of nodes 'before' nA and nB, and A+ and B+ be the set of nodes 'after' and including nA and nB. What I want to achieve is, given an integer n0, find nA and nB such that |A-| + |B-| = n0, and all p values of nodes in A- and B- are less than those of nodes in A+ and B+. In other words, I want to find the first n0 nodes with the smallest p values among all nodes in A and B. More importantly, I want to achieve this without merging the two trees.

I have come up with and implemented an O(log|A| × log|B|) algorithm myself. My question is, is there an O(log|A| + log|B|) algorithm? Thanks in advance.

submitted by /u/lukedanzxy to r/algorithms
[link] [comments]
07 Mar 14:44

An Exercise in Practical Container Escapology [Exploit]

by /u/elon2020
21 Feb 14:52

Extracting a 19 Year Old Code Execution from WinRAR

by /u/rolfr
25 Jan 14:36

Anti Debugging Tricks #5 – Inlined Timing - Game Phreakers

by /u/timb3r1
09 Nov 14:07

Entombed: An archaeological examination of an Atari 2600 game

by /u/corysama
02 Nov 22:55

.:: Phrack Magazine ::. Viewer Discretion Advised

by /u/VonNaturAustreVe
02 Nov 22:50

John Hammond

by /u/CaveVenom1

Shameless plug for my friend John Hammond.

https://www.youtube.com/channel/UCVeW9qkBjo3zosnqUbG7CFw

He's a great youtube for new people who want to do CTFS, and creates video write ups. He focuses on CTFS, so it's a good compliment to Live Overflow.

Check him out! Mods add him to the side bar!

submitted by /u/CaveVenom1 to r/securityCTF
[link] [comments]
27 Oct 04:21

Microsoft obliquely acknowledges Windows 0-day bug published on Twitter

by Peter Bright

A privilege escalation flaw in Windows 10 was disclosed earlier this week on Twitter. The flaw allows anyone with the ability to run code on a system to elevate their privileges to "SYSTEM" level, the level used by most parts of the operating system and the nearest thing that Windows has to an all-powerful superuser. This kind of privilege escalation flaw enables attackers to break out of sandboxes and unprivileged user accounts so they can more thoroughly compromise the operating system.

Microsoft has not exactly acknowledged the flaw exists; instead it offered a vague and generic statement: "Windows has a customer commitment to investigate reported security issues, and proactively update impacted devices as soon as possible. Our standard policy is to provide solutions via our current Update Tuesday schedule." So, if the flaw is acknowledged (and it's certainly real!) then the company will most likely fix it in a regular update released on the second Tuesday of each month.

The tweet links to a GitHub repository that contains a write-up of the issue and demonstration code to exploit the flaw. The bug lies in the Task Scheduler service: it includes an improperly secured API that allows an attacker to overwrite most files on the system with contents of their choosing. By overwriting a file that's subsequently loaded into a privileged SYSTEM-level process, the attacker can run code of their choosing with SYSTEM privileges. The proof of concept overwrites a file used by Windows' printing subsystem—Windows will then run the attacker's code when an attempt is made to print.

Read 1 remaining paragraphs | Comments

16 Oct 20:13

Hack The Box – DevOops Walkthrough

by /u/m4v3r1ck-
12 Oct 14:50

What's New in Lighthouse v0.8: Binary Ninja support, HTML coverage reports, and more

by /u/gaasedelen
12 Oct 14:47

FlareOn Level 6 Writeup: Binary Ninja + symbolic execution

by /u/thebarbershopper
16 Aug 20:21

Welcome to the New Order: A DEF CON 2018 Retrospective by PPP

by /u/centinibroninthesky
14 Aug 20:12

Crypton: an educational library to learn and practice offensive and defensive crypto(graphy)

by /u/ashutosh1206

GitHub source
Blog post on the library development

Got the opportunity to talk about the library at CryptoVillage, DEF CON 26, but could not present it due to Visa issues. Thanks to CryptoVillage for the support. I released it on August 12 anyway ;)

A lot more attacks to be added soon. Any sort of reviews/suggestions is highly appreciated :)

submitted by /u/ashutosh1206 to r/crypto
[link] [comments]
13 Aug 22:53

Slides of the BlackHat talk “Reversing a Japanese Wireless SD Card - From Zero to Code Execution”

by /u/guedou
10 Aug 20:39

Ryan's CTF Has Come to an End...

by RyanANicholson

Thanks everyone!

My Google Cloud Platform trial is very low on funds, so it's time to end the CTF. I hope everyone had a great time. Here are the results:

372 teams!


Only 17% got the NINJA challenge... All but 8 were solved AFTER John Hammond's video walkthrough.

3142 flag submissions!

First 10 with a perfect score of 1000!

True CTF NINJAs with perfect scores!




To all that played and provided feedback, THANK YOU! There will be more of this to come!


03 Aug 14:08

How the US Military Can Better Keep Hackers

by Bruce Schneier

Interesting commentary:

The military is an impossible place for hackers thanks to antiquated career management, forced time away from technical positions, lack of mission, non-technical mid- and senior-level leadership, and staggering pay gaps, among other issues.

It is possible the military needs a cyber corps in the future, but by accelerating promotions, offering graduate school to newly commissioned officers, easing limited lateral entry for exceptional private-sector talent, and shortening the private/public pay gap, the military can better accommodate its most technical members now.

The model the author uses is military doctors.

31 Jul 20:06

A tcpdump Tutorial and Primer with Examples

by /u/danielrm26
27 Jul 19:04

Solving the Atredis BlackHat 2018 CTF Challenge

by /u/rolfr
26 Jul 19:01

Reverse Engineering the XignCode Anti-Cheat Library | XEM and XEL File Analysis

by /u/rotlogix_
24 Jul 14:07

Exploiting a Windows 10 PagedPool off-by-one overflow (WCTF 2018) [xpost /r/WindowsSecurity]

by /u/m8urn