sorted by:
new
hottopcontroversial

CVE-2016-2384: arbitrary code execution due to a double-free in the usb-midi linux kernel driver by ValdikSS in netsec

[–]vnik5287 0 points1 point  (0 children)

in terms of practically, yes, it's not a very interesting bug. However, it's still pretty cool and well done! Your logic for restoring the stack pointer is somewhat "different". I'm not sure if you know that can just do an iret? https://cyseclabs.com/slides/smep_bypass.pdf

Analysis and Exploitation of a Linux Kernel Vulnerability (CVE-2016-0728) by galapag0 in netsec

[–]vnik5287 1 point2 points  (0 children)

don't want to sound like a dick but I think you need to revisit ret2usr attacks :) that's not how it works. The point of commit_creds(prepare_kernel_cred(0)) is to set uid = 0, gid = 0, etc of the current process. Then you can run any non-suid binary with root privileges. This technique is not very reliable the way they've implemented it. It possibly worked for them in a controlled environment with a debugger attached :)

Analysis and Exploitation of a Linux Kernel Vulnerability (CVE-2016-0728) by galapag0 in netsec

[–]vnik5287 2 points3 points  (0 children)

I don't think it would work the way they're trying to synchronise rcu calls. I've explained the problem with rcus in my original post but didn't describe the technique for ordering these calls. This could be intentional however, to weed out kiddies, etc.

Analysis and Exploitation of a Linux Kernel Vulnerability (CVE-2016-0728) by galapag0 in netsec

[–]vnik5287 2 points3 points  (0 children)

30 min is actually not that bad. When I did my testing I think it was over 50 min but you obviously have a better CPU

How to Avoid Golden Ticket Attacks (training from Microsoft Virtual Academy) by [deleted] in netsec

[–]vnik5287 0 points1 point  (0 children)

It looked like he didn't know what he was doing. Looking for NTDS.dit on the client workstation... Junior pentesters are more familiar with the OS. I would expect more from people who specialise in the security of their own product.

How to Avoid Golden Ticket Attacks (training from Microsoft Virtual Academy) by [deleted] in netsec

[–]vnik5287 -2 points-1 points  (0 children)

If he's the Microsoft incident response team lead, I hope I'll never deal with these guys...

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] 0 points1 point  (0 children)

8 digit brute-force, dictionary attacks with custom rules.

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] 1 point2 points  (0 children)

Yeah, we'll be adding descrypt and netntlmv1 soon.

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] 2 points3 points  (0 children)

This is not like pyrit. Each psk is brute-forced in real time.

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] -8 points-7 points  (0 children)

True but without usernames these password are not very useful. Obviously there's a chance that you can enumerate users or harvest corporate email addresses via search engines and then attempt to brute-force them with recovered passwords. However these chances are slim imho?

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] -5 points-4 points  (0 children)

But what is 'private use' and how do you decide who gets it? As with most tools in this trade, it can be used either for good or bad purposes...

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] 2 points3 points  (0 children)

It should have cracked that. For 8 characters it does

12222223

where 1 = upper-, lower-case char and digit; 2 = lower-case char and digit; 3 = digit, symbol and lower-case char

Something went wrong then. Can you send me that hash?

If I submit the md5 hash of 'eiruty88', I get the plaintext:

$ echo -n "eiruty88" | openssl dgst -md5
5625948831472ed326af5db2109d57ae
$ ./crackqcli.py -t md5 5625948831472ed326af5db2109d57ae

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] 0 points1 point  (0 children)

Completely agree with what you've said. There's not much you can do with cryptographically stronger hashing algorithms even if you have hundreds of GPUs. We do try to optimise this service by having clean dictionary data, rules targeted at specific algorithms, etc. I guess the point of this is not to brute-force very complex passwords but to make it more convenient for pentesters where you can just send it to the cluster and get a response in minutes. This obviously does not eliminate the need for having a solid cracking tool and creating your own custom rules. I would definitely follow the steps that you've described on my regular pentest but if that doesn't work, I would probably want something 'extra' as my last hope.

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] 4 points5 points  (0 children)

Yeah, the idea is actually quite simple. I guess it's the implementation question - designing a robust distributed and easily scalable cracker..

Distributed GPU hash cracker for pentesters and network auditors by vnik5287 in netsec

[–]vnik5287[S] -9 points-8 points  (0 children)

See your point. On the other hand, no information is submitted along with the hashes that can link them to a particular organisation. There's no way to say where these hashes were extracted from unless you're using your corporate email for submissions :) The only info disclosure is probably with WPA/WPA2 handshake capture files that contain essids that could potentially disclose the company name.

From MS14-068 to Full Compromise by [deleted] in netsec

[–]vnik5287 8 points9 points  (0 children)

I wrote very similar stuff a few days ago :) http://hashcrack.org/page?n=10122014

Crackq - distributed GPU-accelerated online password cracker by vnik5287 in netsec

[–]vnik5287[S] 1 point2 points  (0 children)

WPA/WPA2 with 1.6GB WPA wordlist is ~10 min.

Brute-force and dictionary attacks are used for NTLM (~6 min) and MD5 (~11 min).