Sunday, January 28, 2024

DSploit

DSploit

After playing with the applications installed on the Pwn Pad, I found that the most important application (at least for me) was missing from the pre-installed apps. Namely, DSploit. Although DSploit has tons of features, I really liked the multiprotocol password sniffing (same as dsniff) and the session hijacking functionality.

The DSploit APK in the Play Store was not working for me, but the latest nightly on http://dsploit.net worked like a charm.

Most features require that you and your target uses the same WiFi network, and that's it. It can be Open, WEP, WPA/WPA2 Personal. On all of these networks, DSploit will sniff the passwords - because of the active attacks. E.g. a lot of email clients still use IMAP with clear text passwords, or some webmails, etc. 

First, DSploit lists the AP and the known devices on the network. In this case, I chose one victim client.


In the following submenu, there are tons of options, but the best features are in the MITM section. 


Stealthiness warning: in some cases, I received the following popup on the victim Windows:


This is what we have under the MITM submenu:


Password sniffing

For example, let's start with the Password Sniffer. It is the same as EvilAP and DSniff in my previous post. With the same results for the popular Hungarian webmail with the default secure login checkbox turned off. Don't forget, this is not an Open WiFi network, but one with WPA2 protection!


Session hijack

Now let's assume that the victim is very security-aware and he checks the secure login checkbox. Another cause can be that the victim already logged in, long before we started to attack. The session hijacking function is similar to the Firesheep tool, but it works with every website where the session cookies are sent in clear text, and there is no need for any additional support.

In a session hijacking attack (also called "sidejacking"), after the victim browser sends the authentication cookies in clear text, DSploit copies these cookies into its own browser, and opens the website with the same cookies, which results in successful login most of the time. Let's see session hijacking in action!

Here, we can see that the session cookies have been sniffed from the air:


Let's select that session, and be amazed that we logged into the user's webmail session.




Redirect traffic

This feature can be used both for fun or profit. For fun, you can redirect all the victim traffic to http://www.kittenwar.com/. For-profit, you can redirect your victim to phishing pages.


Replace images, videos

I think this is just for fun here. Endless Rick Rolling possibilities.


Script injection

This is mostly for profit. client-side injection, drive-by-exploits, endless possibilities.

Custom filter

If you are familiar with ettercap, this has similar functionalities (but dumber), with string or regex replacements. E.g. you can replace the news, stock prices, which pizza the victim ordered, etc. If you know more fun stuff here, please leave a comment (only HTTP scenario - e.g. attacking Facebook won't work).

Additional fun (not in DSploit) - SSLStrip 

From the MITM section of DSploit, I really miss the SSLStrip functionality. Luckily, it is built into the Pwn Pad. With the help of SSLStrip, we can remove the references to HTTPS links in the clear text HTTP traffic, and replace those with HTTP. So even if the user checks the secure login checkbox at freemail.hu, the password will be sent in clear text - thus it can be sniffed with DSniff.

HTML source on the client-side without SSLstrip:


HTML source on the client-side with SSL strip:


With EvilAP, SSLStrip, and DSniff, the password can be stolen. No hacking skillz needed.

Lessons learned here

If you are a website operator where you allow your users to login, always:
  1. Use HTTPS with a trusted certificate, and redirect all unencrypted traffic to HTTPS ASAP
  2. Mark the session cookies with the secure flag
  3. Use HSTS to prevent SSLStrip attacks
If you are a user:
  1. Don't trust sites with your confidential data if the above points are not fixed. Choose a more secure alternative
  2. Use HTTPS everywhere plugin
  3. For improved security, use VPN
Because hacking has never been so easy before.
And last but not least, if you like the DSploit project, don't forget to donate them!

More articles


ShellForge


"ShellForge is a python program that builds shellcodes from C. It is inspired from Stealth's Hellkit. Some wrapper functions arround system calls are defined in header files. The C program uses them instead of libc calls. ShellForge uses gcc to convert it into assembler. It then modifies it a bit, compiles it, extract code from the object, may encode it and add a loader at the begining." read more...
Related news
  1. Hacker Tools For Windows
  2. Pentest Tools Github
  3. Hacking Tools Free Download
  4. Free Pentest Tools For Windows
  5. Underground Hacker Sites
  6. Hacker Tools Windows
  7. Wifi Hacker Tools For Windows
  8. Hacker Tools For Ios
  9. Hacking Tools Mac
  10. Computer Hacker
  11. Hack And Tools
  12. Best Pentesting Tools 2018
  13. Pentest Tools Free
  14. Pentest Tools For Mac
  15. Pentest Tools Online
  16. Computer Hacker
  17. Hack Website Online Tool
  18. Hacker Tools List
  19. Hacker Tools Apk Download
  20. Easy Hack Tools
  21. Hacking Tools Github
  22. Hack Tools Github
  23. Hacking Tools For Windows 7
  24. How To Make Hacking Tools
  25. Pentest Automation Tools
  26. Pentest Tools Download
  27. Tools For Hacker
  28. Free Pentest Tools For Windows
  29. Free Pentest Tools For Windows
  30. Pentest Tools
  31. Hacking Tools For Games
  32. Hacker Tools List
  33. Physical Pentest Tools
  34. Hacker Tools For Windows
  35. What Is Hacking Tools
  36. Hacker Hardware Tools
  37. Android Hack Tools Github
  38. Hacking App
  39. Pentest Tools Linux
  40. Pentest Tools
  41. Hack Tools
  42. Pentest Tools Download
  43. Hacking Tools Software
  44. Hacking Tools For Beginners
  45. Usb Pentest Tools
  46. What Is Hacking Tools
  47. Pentest Tools For Ubuntu
  48. Pentest Tools For Windows
  49. Hacker Tools For Pc
  50. Hacker Security Tools
  51. Nsa Hack Tools
  52. Pentest Tools Android
  53. Hacker Tools 2020
  54. Best Hacking Tools 2019
  55. Github Hacking Tools
  56. Hacking Tools
  57. Ethical Hacker Tools
  58. Hack Tools For Ubuntu
  59. Hacking Tools Usb
  60. Pentest Tools Review
  61. Pentest Tools Url Fuzzer
  62. Hacker Tools For Windows
  63. Pentest Tools Port Scanner
  64. Hack Tools Online
  65. Pentest Tools Alternative
  66. Nsa Hack Tools Download
  67. New Hacker Tools
  68. Pentest Tools Apk
  69. Hacker Hardware Tools
  70. Hacker Tools For Mac
  71. How To Make Hacking Tools
  72. Hacker Tools For Ios
  73. Tools Used For Hacking
  74. Growth Hacker Tools
  75. Game Hacking
  76. Best Hacking Tools 2019
  77. Nsa Hack Tools Download
  78. Hack Tools For Pc
  79. Pentest Tools List
  80. Hack Tools For Ubuntu
  81. Hacking Apps
  82. Hacker Tool Kit
  83. Hack And Tools
  84. Hacking Tools For Mac
  85. Hacker Tools For Windows
  86. Install Pentest Tools Ubuntu
  87. Hacking Tools For Windows Free Download
  88. Hack Tools Pc
  89. Pentest Tools Windows
  90. Pentest Tools Nmap
  91. Pentest Tools Online
  92. How To Make Hacking Tools
  93. Computer Hacker
  94. Nsa Hack Tools
  95. Hacking Tools For Kali Linux

Saturday, January 27, 2024

SolarMarker Malware Uses Novel Techniques To Persist On Hacked Systems

 In a sign that threat actors continuously shift tactics and update their defensive measures, the operators of the SolarMarker information stealer and backdoor have been found leveraging stealthy Windows Registry tricks to establish long-term persistence on compromised systems.

Cybersecurity firm Sophos, which spotted the new behavior, said that the remote access implants are still being detected on targeted networks despite the campaign witnessing a decline in November 2021.

Boasting of information harvesting and backdoor capabilities, the .NET-based malware has been linked to at least three different attack waves in 2021. The first set, reported in April, took advantage of search engine poisoning techniques to trick business professionals into visiting sketchy Google sites that installed SolarMarker on the victim's machines.

Then in August, the malware was observed targeting healthcare and education sectors with the goal of gathering credentials and sensitive information. Subsequent infection chains documented by Morphisec in September 2021 highlighted the use of MSI installers to ensure the delivery of the malware.

The SolarMarker modus operandi commences with redirecting victims to decoy sites that drop the MSI installer payloads, which, while executing seemingly legitimate install programs such as Adobe Acrobat Pro DC, Wondershare PDFelement, or Nitro Pro, also launches a PowerShell script to deploy the malware.


"These SEO efforts, which leveraged a combination of Google Groups discussions and deceptive web pages and PDF documents hosted on compromised (usually WordPress) websites, were so effective that the SolarMarker lures were usually at or near the top of search results for phrases the SolarMarker actors targeted," Sophos researchers Gabor Szappanos and Sean Gallagher said in a report shared with The Hacker News.

The PowerShell installer is designed to alter the Windows Registry and drop a .LNK file into Windows' startup directory to establish persistence. This unauthorized change results in the malware getting loaded from an encrypted payload hidden amongst what the researchers called a "smokescreen" of 100 to 300 junk files created specifically for this purpose.

"Normally, one would expect this linked file to be an executable or script file," the researchers detailed. "But for these SolarMarker campaigns the linked file is one of the random junk files, and cannot be executed itself."

What's more, the unique and random file extension used for the linked junk file is utilized to create a custom file type key, which is ultimately employed to execute the malware during system startup by running a PowerShell command from the Registry.

The backdoor, for its part, is ever-evolving, featuring an array of functionalities that allow it to steal information from web browsers, facilitate cryptocurrency theft, and execute arbitrary commands and binaries, the results of which are exfiltrated back to a remote server.

"Another important takeaway […], which was also seen in the ProxyLogon vulnerabilities targeting Exchange servers, is that defenders should always check whether attackers have left something behind in the network that they can return to later," Gallagher said. "For ProxyLogon this was web shells, for SolarMarker this is a stealthy and persistent backdoor that according to Sophos telematics is still active months after the campaign ended."

Related posts

ECDX - Exploit Development Student


ECDX - Exploit Development Student from the popular eLearnSecurity Institute and INE is an Exploit Development training at the beginner level. Prerequisites for this course Completion of the eJPT courseIs. The eCXD course is a hands-on course with many examples of exploit development for both Windows and Windows operating systems. In this course, you will not only learn the basics but also the important Windows and Linux exploration techniques. You will also learn how to bypass anti-exploitation technologies such as antivirus. In this course you will gain an in-depth understanding of topics such as Software Debugging, Shellcoding, Windows and Linux exploration, how to search for Zero Day vulnerabilities, bypassing modern anti-exploitation technologies, and work. With Immunity Debugger, x32dbg, Mona, Pwntools, GDB, Ropper software. 

  • Course prerequisites
  • Completion of the eJPT course
  • Course specifications
  • Course level: Beginner
  • Time: 18 hours and 48 minutes
  • Includes: ‌ 6 videos | 19 laboratories | ‌ 31 slides
  • Professor: Lukasz Mikula
  • ECXD Course Content - Exploit Development Student
  •  Linux Exploit Development
  • Linux Stack Smashing
  • Linux Exploit Countermeasures & Bypasses
  • Linux Return Oriented Programming
  • Linux Shellcoding
  • Linux Advanced Exploitation
  • Windows Exploit Development
  • Windows Stack Smashing
  • Windows SEH-based Overflows
  • Windows Egghunting
  • Unicode Buffer Overflows
  • Windows Shellcoding
  • Windows Return Oriented Programming


Link to Download

More articles