UnChleuHacker

IntroductionIn a previous article, we detailed how Local Hollowing works—a technique that allows a malicious PE file to be executed in memory without ever writing it in plaintext to the disk. The loader is compiled using OLLVM to obfuscate the machine code, and the payload (Mimikatz) is encrypted with AES-256 In theory, this combination should be sufficient to bypass static detection. In practice, Microsoft Defender detects the loader immediately: The MTB (Machine Learning Based Threat) suffi...

IntroductionDuring Red Team exercises, once initial access has been gained, one of the first obstacles is static detection. Deploying tools like Mimikatz to the disk is immediately detected by EDR because the signatures for these tools have long been known to EDR systems. Local Hollowing allows you to bypass this problem. The principle: a loader embeds the malicious PE (Portable Executable) encrypted with AES-256, decrypts it in memory at runtime, manually maps it to replace the Windows loade...

BypassAMSI BYPASS12Set-Item ('Va'+'rI'+'a'+'blE:1'+'q2'+'uZx') ([TYpE]("F"+'rE')) (Get-variable (('1Q'+'2U') +'zX'))."A`ss`Embly"."GET`TY`Pe"(('Uti'+'l','A',('Am'+'si'),('.Man'+'age'+'men'+'t.'),('u'+'to'+'mation.'),'s',('Syst'...

Sidecar is a chain made up of two machines, WS01 and DC01, classified as difficult. Initial access to WS01 is gained via a booby-trapped .lnk file, set up to limit antivirus detection. Once the first machine has been compromised, the absence of an LDAP signature combined with the presence of WebDAV enables a Shadow Credentials attack to be carried out, resulting in a much deeper compromise of the infrastructure. By compromising WS01, the recovery of a password made it possible to reach an acc...

Vigilant is a chain of Vulnlab-hardened machines, consisting of a Linux machine and a Windows machine. Anonymous access to the domain controller (DC) shares is used to retrieve a PDF file encrypted with ADAudit. By recovering the DLLs linked to the ADAudit executable, we can use ILSpy to identify the way in which the PDF is encrypted, and thus decrypt it. The identifiers contained in the PDF then allow us to access an Elasticsearch administration interface which, once exploited, gives us a sh...

IntroductionThe NTDS.dit file is the Active Directory database which contains : Data on all domain accounts Group membership relationships domain user password hashesThe retrieval of this file by an attacker is equivalent to the total compromise of the domain, as it means that the attacker has compromised the domain controller. In fact, this file is stored only on domain controllers and does not exist on other machines in the domain. How the NTDS dump works2.1 LocalizationThe default file p...

**Kaiju” is a Hard chain made up of three Windows machines, where you have to exploit various advanced techniques to compromise the domain.Initial access is gained through the use of default credentials on an FTP server, retrieving files that give an insight into how administrators construct their passwords.By building a wordlist from this information, it is possible to compromise the backup account, which provides SSH access to the machine.Then, by browsing the FileZilla FTP server logs, we ...

1. introductionKeeFarce Reborn is an offensil tool for extracting the contents of an unencrypted KeePass database when it is opened on the target machine.It is based on the work of several well-known projects: KeeFarce (extraction via DLL and CLrMD injection) KeeThief (master key recovery) KeePassHax (decryption via reflection) The aim of KeeFarce Reborn is to simplify and modernize the method, while remaining compatible with as many environments as possible. 2. How it worksThe tool takes t...

Intercept is a chain of machines consisting of two Windows servers. Initial access is gained via an SCF attack, compromising the account of a domain user. With this access, several notable elements are observed: the domain controller does not enforce LDAP signing, the compromised user has the necessary rights to join a machine to the domain, one of the servers is vulnerable to PetitPotam and has the WebClient service enabled. By combining these vulnerabilities, a Relay (RCBD) attack can be ...

Tengu is a chain of medium level machines, consisting of one Linux machine and two Windows machines. An instance of Node-RED was used to execute code on the Linux machine. The recovery of a database password was then used to compromise a domain account, which was administrator on the Linux machine. The latter had constrained delegation for the MSSQL service, making it possible to compromise the associated MSSQL server. Finally, by recovering information protected by DPAPI, it was possible to ...