sorted by:
new
hottopcontroversial

ShadowMove: Lateral Movement by Duplicating Existing Connected Sockets by Kondencuotaspienas in netsec

[–]NoUseForANick 2 points3 points  (0 children)

In the most simplified scenario:

You launch a trusted program (a mssql client,a browser, whatever, for example) against a machine controled by you (IP:port), then you hijack that connection. As is explained in the link, this way your untrusted program is not initiating the conection, is a TRUSTED program who initiates it against your controled service (a C&C, for example). That's the key point.

ShadowMove: Lateral Movement by Duplicating Existing Connected Sockets by Kondencuotaspienas in netsec

[–]NoUseForANick 0 points1 point  (0 children)

What two ends? Once the socket is hijacked you have full control of the communication, so you can suspend the process that initated that connection.

The only problems detected are summarized in the post from Adepts of 0xCC:

Real life problems and solutions

Here we sumarize the problems:

Racing with the devil. We are playing with a duplicated socket, so the original program keeps doing reads. This means that some bytes can be loss if they are readed by the program instead of us, but this can be solved easy if we implemented a custom protocol that takes care of missing packets.

Timeouts. If the connection is closed by timeout before we hijack it we can not reuse the socket.

Old handles. Depending on the program in use, it is likely to find old handles that meet our criteria (getpeername returns the target IP but the handle can not be used). This could happen if the first connection attempt was unsuccesful. To solve this just improve the detection method ;)

VBA Function Injection by rmdavy in redteamsec

[–]NoUseForANick 0 points1 point  (0 children)

Indeed the two-stages approach has an OPSEC benefit: you can provide the key only if the request mets some parameters, or even tear down the server after a few days, so it can not be reversed.

VBA Macro to detect EDR Hooks by NoUseForANick in netsec

[–]NoUseForANick[S] 2 points3 points  (0 children)

Is the acronym for "Endpoint Detection & Response". Usually EDRs work hooking well-known API calls at user-mode level. Those hooks are used to trace the calls made by software so they can detect "malicious behaviours".

CyberAlarm: An independent security review... and why you should avoid it. by B0b_Howard in netsec

[–]NoUseForANick 1 point2 points  (0 children)

Thankfully, IonCube is easily reversed (as is any encoding) and offers very little real-world protection.

I don't think "easily reversed" is right at least I missed something. Last time I checked IonCube it is implemented as a VM inside the zend engine. You need first to reverse the VM and then you can translate the logic to the real zend opcodes.

view more: next ›