Monday, April 13, 2020

BeEF: Browser Exploitation Framework


"BeEF is the browser exploitation framework. A professional tool to demonstrate the real-time impact of XSS browser vulnerabilities. Development has focused on creating a modular structure making new module development a trivial process with the intelligence residing within BeEF. Current modules include the first public Inter-protocol Exploit, a traditional browser overflow exploit, port scanning, keylogging, clipboard theft and more." read more...


Website: http://www.bindshell.net/tools/beef


Related articles


  1. Hacker Tools For Pc
  2. Hacking Tools For Windows Free Download
  3. Hacking App
  4. Hacker Tools Free Download
  5. Best Hacking Tools 2020
  6. Hack And Tools
  7. Hacker Tools Hardware
  8. Hacker Tool Kit
  9. Pentest Tools Bluekeep
  10. Pentest Tools For Mac
  11. Hacking Tools Windows
  12. Pentest Tools Find Subdomains
  13. Hack Tools Mac
  14. Hacker Tools Github
  15. Pentest Tools For Ubuntu
  16. Hacker Tools For Windows
  17. Nsa Hack Tools

DeepEnd Research: Analysis Of Trump's Secret Server Story


 We posted our take on the Trump's server story. If you have any feedback or corrections, send me an email (see my blog profile on Contagio or DeepEnd Research)

Analysis of Trump's secret server story...



More info


Hacking Windows 95, Part 2

In the Hacking Windows 95, part 1 blog post, we covered that through a nasty bug affecting Windows 95/98/ME, the share password can be guessed in no time. In this article, I'm going to try to use this vulnerability to achieve remote code execution (with the help of publicly available tools only).

The first thing we can do when we have read access to the Windows directory through the share, is to locate all the *.pwl files on the c:\windows directory, copy them to your machine where Cain is installed, switch to Cracker tab, pwl files, load the pwl file, add username based on the filename, and try to crack it. If you can't crack it you might still try to add a .pwl file where you already know the password in the remote windows directory. Although this is a fun post-exploitation task, but still, no remote code execution. These passwords are useless without physical access.


One might think that after having a share password and user password, it is easy to achieve remote code execution. The problem is:
  • there is no "at" command (available since Windows 95 plus!)
  • there is no admin share
  • there is no RPC
  • there is no named pipes
  • there is no remote registry
  • there is no remote service management
If you think about security best practices, disabling unnecessary services is always the first task you should do. Because Windows 95 lacks all of these services, it is pretty much secure!

During my quest for a tool to hack Windows 95, I came across some pretty cool stuff:
LanSpy

But the best of the best is Fluxay, which has been written by chinese hackers. It is the metasploit from the year 2000. A screenshot is worth more than a 1000 words. 4 screenshot > 4 thousand words :)





It is pretty hard to find the installer, but it is still out there!

But at the end, no remote code execution for me.

My idea here was that if I can find a file which executes regularly (on a scheduled basis), I can change that executable to my backdoor and I'm done. Although there is no scheduler in the default Windows 95, I gave it a try. 

Let's fire up taskman.exe to get an idea what processes are running:


Looks like we need a more powerful tool here, namely Process Explorer. Let's try to download this from oldapps.com:


LOL, IE3 hangs, can't render the page. Copying files to the Win95 VM is not that simple, because there are no shared folders in Win95 VM. And you can't use pendrives either, Win95 can't handle USB (at least the retail version). After downloading the application with a newer browser from oldapps, let's start Process Explorer on the test Windows 95.


Don't try to download the Winsocks 2 patch from the official MS site, it is not there anymore, but you can download it from other sites. 

Now let's look at the processes running:


After staring it for minutes, turned out it is constant, no new processes appeared.
Looking at the next screenshot, one can notice this OS was not running a lot of background processes ...


My current Win7 has 1181 threads and 84 processes running, no wonder it is slow as hell :)

We have at least the following options:
  1. You are lucky and not the plain Windows 95 is installed, but Windows 95 Plus! The main difference here is that Windows 95 Plus! has built-in scheduler, especially the "at" command. Just overwrite a file which is scheduled to execution, and wait. Mission accomplished!
  2. Ping of death - you can crash the machine (no BSOD, just crash) with long (over 65535 bytes) ICMP ping commands, and wait for someone to reboot it. Just don't forget to put your backdoor on the share and add it to autoexec.bat before crashing it. 
  3. If your target is a plain Windows 95, I believe you are out of luck. No at command, no named pipes, no admin share, nothing. Meybe you can try to fuzz port 137 138 139, and write an exploit for those. Might be even Ping of Death is exploitable?
Let's do the first option, and hack Windows 95 plus!
Look at the cool features we have by installing Win95 Plus!


Cool new boot splash screen!


But our main interest is the new, scheduled tasks!


Now we can replace diskalm.exe with our backdoor executable, and wait maximum one hour to be scheduled.

Instead of a boring text based tutorial, I created a YouTube video for you. Based on the feedbacks on my previous tutorialz, it turned out I'm way too old, and can't do interesting tutorials. That's why I analyzed the cool skiddie videoz, and found that I have to do the followings so my vidz won't suck anymore:
  • use cool black windows theme
  • put meaningless performance monitor gadgets on the sidebar
  • use a cool background, something related with hacking and skullz
  • do as many opsec fails as possible
  • instead of captions, use notepad with spelling errorz
  • there is only one rule of metal: Play it fuckin' loud!!!!
Related posts

WordPress 5.0.0 Crop-Image Shell Upload Exploit

Related links

  1. Hacker Tools For Pc
  2. Hacking Tools Hardware
  3. Hack Tools Online
  4. Pentest Tools Online
  5. Pentest Tools Review
  6. Best Hacking Tools 2020
  7. Pentest Tools For Mac
  8. Hacker Tools Linux
  9. Pentest Tools Port Scanner
  10. Physical Pentest Tools
  11. Pentest Tools Nmap
  12. Hack Tools For Games
  13. Hacker Tools Online
  14. Hacker Tools Windows
  15. Nsa Hack Tools
  16. Hack Rom Tools
  17. Computer Hacker
  18. Tools Used For Hacking
  19. Tools For Hacker
  20. Hacker Tools Free
  21. Pentest Tools Online
  22. Hacking Tools Free Download
  23. Hacking Tools For Windows Free Download
  24. Hacker Techniques Tools And Incident Handling
  25. Pentest Box Tools Download
  26. Top Pentest Tools

Ettercap: Man In The Middle (MITM)


"Ettercap is a suite for man in the middle attacks on LAN. It features sniffing of live connections, content filtering on the fly and many other interesting tricks. It supports active and passive dissection of many protocols (even ciphered ones) and includes many feature for network and host analysis." read more...


Website: http://ettercap.sourceforge.net

Related word

Sunday, April 12, 2020

Re:Traffic is money! Want huge traffic to your site?

Traffic is money!
Want huge traffic to your site?
Order from us your newsletter,
e-mail letters in any country of the World.
Or buy e-mail databases from us and do the mailing yourself.
And then you will receive the long-awaited traffic.
Write to us now and get a -20% discount.
email.business.group@gmail.com

Saturday, April 11, 2020

Riders Of The Pony Express - Current Status And New Ideas

Back in August I had found an old strategy article I'd been looking for, which applied directly to one of my game designs, but I didn't revisit the game itself at the time.

The other day I posted about a playtest session in which I took that old prototype off the back burner and got it to the table: Riders of the Pony Express (BGG link - looks like I ought to edit that description a little bit!).

As I mentioned in the August post, I have experienced an issue, mostly with the 5-player game. And as I mentioned in the playtest report post, I found a hand-written rules edit that I don't remember every trying before, which may solve the 5p problem for me as well, at least in the blind bid version of the game (the one which is the most gamer-y, and which I will probably stick with):
The winner of the bid must leave their winning bid card face up on the table, it is not available to them for the rest of the round.
That's it! It's so simple, and it made for some very interesting bidding dynamics all around.

With respect to the 5p problem I outlined in the August post, I had showed some math which explained why winning each bid for the minimum of $3 was fairly dominant -- you would get $24 while each opponent would get only $14. Sure, you would have to spend more traveling, and you would get a lower bonus upon returning to the post office, but even if that did kind of even things out, it isn't fun for the other players to just go through the motions of riding across the board while you visit town after town to deliver all your parcels.

In the comments on that post, I posited two solutions which could change the math, evening up the amount of money you would get compared to each opponent if you won all the bids at $3: upping the total amount from $10 to $15 in a 5p game, or allowing a minimum bid of $2 instead of $3. Neither of these really solve the problem, they just punish the player who does the annoying thing. That's a sort of "soft" solution, in that players who are trying to win probably won't do something so bad, therefore the game won't be ruined. However, the reality is that, whether they want to or not, players don't always "play to win" as much as you might think. This is especially true in the case that they haven't played before, or fully analyzed the costs of delivering.

This new solution of leaving the winning bid card face up DOES solve the problem, because it means you simply CAN'T bid $3 on every auction! If players really think that bidding the minimum is the way to go, then at least the parcels will be spread around between the players. And savvy players may start to realize they can do better if they bid higher (though if a different non-savvy player does undercut them every time, it might not be very fun, even if they do win).

I'll note also that the current rules give each player a mandatory parcel to deliver. This may be thematically awkward, but it means everyone is going SOMEWHERE each round, making certain other parcels "on the way."

Things to try in the next test
As I mentioned in the last post, I had a hard time finding something I thought really needed changing. Here are a few changes I'll try for the next playtest:
* Increase value of Bears from +2 to +3. This should make them more distinct from Bandits, and will make the Shotgun item more valuable (currently it is probably not really valuable enough)
* Deal round 1 mandatory parcels face up instead of face down, to see if that makes the auction phase any more interesting (it might actually be worse, but it's worth a try!)
* Instead of dealing mandatory parcels for rounds 2 and 3, layout N+1 face up and let players take one when they arrive at the post office (so drafting them in the order they finish the round).
* Treat the mandatory parcel just like the ones obtained by auction - keep it face up and you're required to deliver it that round

Currently the mandatory parcels are face down, they take up space in your inventory, and they aren't required to be delivered until the end of the game, while face-up parcels obtained in the auction phase are required to be delivered that round, but they don't take up your inventory space. Here's a quote from a previous post when I implemented it:

One issue that's come up in the past is the face down parcel cards. Some players feel they "force" a certain path, and I can see that... so I tried a change. Face down parcels aren't from your boss, they're like side jobs. You're not REQUIRED to deliver them each round, but they take up space in your inventory. I made player boards to help show this - you have room for 1 face down card and 4 items (expanded from 3), and if you don't deliver your 1st face down card, then the next one takes up 2 of your item slots (this is obvious graphically). Currently I'm saying that you have to deliver them by the end of the game, but another option is to simply apply a penalty if you don't (so if it's more expensive to deliver than to take the penalty, maybe you just take the penalty).

But you do get the mandatory parcel before having to claim other parcels, and now maybe you'll have chosen it (per tweak listed above), so maybe it'll be fine to treat them the same as the parcels you get in the auctions. I could do with more elegant rules here, so maybe all parcels should just be face up, required to deliver that round.

* Treat each hazard and each town as a space, and let players move from space to space, rather than from town to town. One of my players thought this would be way more intuitive, and it does have the advantage that if 2 players arrive at the same town at about the same time, the one that fiddles around less (spends less time acting int he town) will leave first, irrespective of turn order.

Originally, I had players moving from town to town. Here's another quote from a previous post about why I changed that:
to better represent what's going on (and to make fair races between players), I specified that you don't move from town to town - you move from town to hazard tile, then on your next turn you arrive in the town, discard any parcels, pick up an item if you like, and then move to the next hazard.
So now you basically move from hazard to hazard, and do some stuff in a town as yo pass through. Though it has't bothered me at all, it IS a little weird. So I'll try alternating (move from hazard to town, town to hazard, etc). I thought it might be odd to have twice as many turns, where half of them are 0-1 time cost. When paying 0 time, do you just go again right away? If that's the case more often than not, then why make it a separate turn? But maybe I should make town turns a little more costly -- like you spend 1 time for each thing you do, minimum 1. So like, you had to rest or change out your horse at the very least (1 time), and if you go around making deliveries or shopping for items, it'll cost you more time.

So for a hazard space you spend the listed amount, plus hazard modifier, minus item modifiers (minimum 1). And for a town space you spend 1, plus 1 for each delivery you make, and for at most 1 item you pick up. Which means you could spend 1, 2, 3, even 4 time in a town (in fact, I think it could theoretically max out at 5 if you have both parcels and a package item to deliver, and if you pick up an item).

This change will make longer, more circuitous routes quite a bit more expensive, which might have the side effect of encouraging players to bid higher on parcels, or more often say "no thanks" and let the auctioneer take the parcel. I'd like that to be something that can happen if you choose wisely and want it to, or choose poorly and get stuck with it, but hopefully not too often because things are just too expensive! I'll have to see if that goes too far.