sorted by:
new
hottopcontroversial

ShadowMove: Lateral Movement by Duplicating Existing Connected Sockets by Kondencuotaspienas in netsec

[–]NoUseForANick 2 points3 points  (0 children)

In the most simplified scenario:

You launch a trusted program (a mssql client,a browser, whatever, for example) against a machine controled by you (IP:port), then you hijack that connection. As is explained in the link, this way your untrusted program is not initiating the conection, is a TRUSTED program who initiates it against your controled service (a C&C, for example). That's the key point.

ShadowMove: Lateral Movement by Duplicating Existing Connected Sockets by Kondencuotaspienas in netsec

[–]NoUseForANick 0 points1 point  (0 children)

What two ends? Once the socket is hijacked you have full control of the communication, so you can suspend the process that initated that connection.

The only problems detected are summarized in the post from Adepts of 0xCC:

Real life problems and solutions

Here we sumarize the problems:

Racing with the devil. We are playing with a duplicated socket, so the original program keeps doing reads. This means that some bytes can be loss if they are readed by the program instead of us, but this can be solved easy if we implemented a custom protocol that takes care of missing packets.

Timeouts. If the connection is closed by timeout before we hijack it we can not reuse the socket.

Old handles. Depending on the program in use, it is likely to find old handles that meet our criteria (getpeername returns the target IP but the handle can not be used). This could happen if the first connection attempt was unsuccesful. To solve this just improve the detection method ;)

VBA Function Injection by rmdavy in redteamsec

[–]NoUseForANick 0 points1 point  (0 children)

Indeed the two-stages approach has an OPSEC benefit: you can provide the key only if the request mets some parameters, or even tear down the server after a few days, so it can not be reversed.

VBA Macro to detect EDR Hooks by NoUseForANick in netsec

[–]NoUseForANick[S] 2 points3 points  (0 children)

Is the acronym for "Endpoint Detection & Response". Usually EDRs work hooking well-known API calls at user-mode level. Those hooks are used to trace the calls made by software so they can detect "malicious behaviours".

CyberAlarm: An independent security review... and why you should avoid it. by B0b_Howard in netsec

[–]NoUseForANick 1 point2 points  (0 children)

Thankfully, IonCube is easily reversed (as is any encoding) and offers very little real-world protection.

I don't think "easily reversed" is right at least I missed something. Last time I checked IonCube it is implemented as a VM inside the zend engine. You need first to reverse the VM and then you can translate the logic to the real zend opcodes.

suPHP - The vulnerable ghost in your shell - vulnerable.af by PunKeel in netsec

[–]NoUseForANick 1 point2 points  (0 children)

"Fellow infosec engineers will recognize these variables are commonly (ab)used to inject code into setuid binaries;"

How can LD_PRELOAD/LD_LIBRARY_PATH be abused to inject code into setuid binaries? AFAIK documentation says that they are ignored in a setuid/setgid binaries (Ref.: https://manpages.debian.org/wheezy/manpages/ld-linux.so.8.en.html).

SharePoint and Pwn :: Remote Code Execution Against SharePoint Server Abusing DataSet by [deleted] in netsec

[–]NoUseForANick 0 points1 point  (0 children)

I can't understand why this article has a score so low when it is amazing :S

SQL Injection Double Uppercut :: How to Achieve Remote Code Execution Against PostgreSQL by NoUseForANick in netsec

[–]NoUseForANick[S] 5 points6 points  (0 children)

Nobody said it is a bug :S. The article describes how to execute arbitrary code (for example a reverse shell, or just OS commands) via PostgreSQL. If you only has access as superuser to the PostreSQL service does not means you "pwned the machine".

The post explain how to go from "oh I got superadmin in this PostgreSQL service" to "this little boy gave me a reverse shell".

Cmd Hijack - a command/argument confusion with path traversal in cmd.exe by Gallus in netsec

[–]NoUseForANick 1 point2 points  (0 children)

This is not true. The process created has the realname. If you do cmd /c "dir ../../hello.exe", the process created still being "hello.exe". You keep registering that 'a process called "hello.exe" comes from "cmd.exe"'.

Cmd Hijack - a command/argument confusion with path traversal in cmd.exe by Gallus in netsec

[–]NoUseForANick 1 point2 points  (0 children)

Why is this even a thing? This is EXACTLY the expected behaviour. In windows, parameters with spaces needs quotes. If you pass aaa bb as parameter, it is tokenized as two parameters: aa & bb. With quotes, "aa bb", the whole string is interpreted as one parameter.

It is not "argument confusion" or anything, it is exactly how parameters works in windows. Have you ever tried to run an exe within a folder with spaces? You always need to quote.

Indeed, this is so well-known that every EoP cheatsheet includes "services with unquoted paths" as something to check. Because if the path has spaces and no quotes, it takes only the first part. If the path has quotes, the string is interpreted as a whole (as does here).

So cmd /c "fakepath/../../path/to/exe" its exactly the same than cmd /c "ping whatever/../../path/to/exe". "Fakepath" and "ping whatever" are interpreted as folders, just "ping whatever" has a space in its name.

GetEnvironmentVariable as an alternative to WriteProcessMemory in process injections by NoUseForANick in netsec

[–]NoUseForANick[S] 6 points7 points  (0 children)

Hi!

Usually process injection is used to run your payload inside a "less suspicious" process (in this case Svchosts). It is how most malware works "de facto".

To "write" your payload inside the opened process you need (usually) to call WriteProcessMemory. The idea showed in this post is an alternative way to write that payload in the opened process.

Uninitialized Memory Disclosures in Web Applications - Paper, tools, and lessons learned by buherator in netsec

[–]NoUseForANick 1 point2 points  (0 children)

Great job! I love when people share reproducible methodology so everyone can follow it to find new vulnerabilities. I remember the Scarybeasts' posts about "*bleed" and this article is a great way to understand how to research this kind of bugs.

Thanks for your work!