Show Posts

This section allows you to view all posts made by this member. Note that you can only see posts made in areas you currently have access to.


Messages - Mordred

Pages: [1] 2 3 ... 16
1
.NET Framework / Re: [C#] Thread Safe Random and CryptoRandom
« on: December 14, 2015, 04:37:36 pm »
Cool share, thank you!

@skruf
I'm a bit rusty on my C#, but doesn't using a static class screw up unit tests? You can't mockup a static object if I recall correctly, no?
The lock solution seems nice though, I think I remember reading an article about it a while back as well.

L.E.: Found the article. It's from 2009 so it might be a bit dated, but the guy suggests both the lock solution as well as using one Random instance per thread, rather than one per AppDomain (which he claims is faster).


2
Networking / Re: ip adress and subnetting
« on: December 08, 2015, 10:17:25 am »
RBA was way faster to post a solution, but I vouch for the correctness of his method.

To be of at least a bit of help, I recommend also checking out subnetting using the magic box method and subnetting using the square method.

Both of these give exactly the same results as if you computed it by hand, but they rely more on intuition and computing with decimal numbers rather than on computing with binary numbers.

3
Anonymity and Privacy / Re: vpn discussion
« on: December 07, 2015, 11:32:01 am »
Maybe this will help: https://evilzone.org/anonymity/%28review%29-torguard-vpn/msg50262/#msg50262

It's a bit outdated (they have more servers and stuff now) but still generally correct.

4
General discussion / Re: Lets talk about names?
« on: December 04, 2015, 10:14:09 am »
Quote from: kenjoe41 on December 04, 2015, 04:15:57 am
I agree, she has read alot od DarkVision's posts. That is a fricking wall of text. Oh, probably the old Mordred posts too.

/offtopic Hahaha, shit son. Me and DarkVision are gonna crew up and make the biggest wall of text known to man.

/ontopic Mordred killed King Arthur in the Arthurian Legend. (Probably the most concise I've ever been in my life). Fukk da poleec.

5
Found it on the Webs / Re: Hacker scripts
« on: November 23, 2015, 12:36:33 pm »
That's hilarious. I'd love to be able to SSH into our coffee machine at work and make it pour me a hot one :(.

However, smack-my-bitch-up.sh is defo 10/10. Still laughing over here.

6
Projects and Discussion / Re: I Programmed a BF4 Hack
« on: November 13, 2015, 01:35:36 pm »
Sorry for the necro, but I still wanna see as much of the source of this as you are willing to release Matriplex!

Any chance for an update? :)

7
Found it on the Webs / Linux ransomware debut fails on predictable Encryption Key
« on: November 11, 2015, 11:55:38 am »
Quote
No need to crack RSA when you can guess the key

File-encrypting ransomware Trojans are almost ubiquitous on Windows, and it was only a matter of time until the advent of the first piece targeting Linux. Dubbed Linux.Encoder.1, this first piece of Linux ransomware is extremely similar in behavior to CryptoWall, TorLocker and other notorious ransomware families for Windows.

How does it work?

Linux.Encoder.1 is executed on the victim’s Linux box after remote attackers leverage a flaw in the popular Magento content management system app. Once executed, the Trojan looks for the /home, /root and /var/lib/mysql folders and starts encrypting their contents. Just like Windows-based ransomware, it encrypts the contents of these files using AES (a symmetric key encryption algorithm), which provides enough strength and speed while keeping system resources usage to a minimum. The symmetric key is then encrypted with an asymmetric encryption algorithm (RSA) and is prepended to the file, along with the initialization vector used by AES.

Once the files have been encrypted, the Trojan attempts to also encrypt the contents of the root (/), skipping only critical system files, so the operating system will be able to boot up again.

At this point, it would be safe to assume that users can’t get their data back unless they pay the operators a fee in exchange for the RSA private key to decrypt the AES symmetric one. However, a major flaw in the way the Encoder Trojan is designed allowed Bitdefender researchers to recover the AES key without having to decrypt it with the RSA private key.


Source: Labs.Bitdefender.com Article - "Linux Ransomware Debut Fails on Predictable Encryption Key"

8
General discussion / Re: To porn or not to porn
« on: November 11, 2015, 11:48:15 am »
I vote no as well. It's funny in a way, but not THAT funny. I personally browse the forums a lot from work and used to browse a lot from school as well. If there was porn background I probably couldn't read that particular tutorial while I was there which is kind of lame.

9
Found it on the Webs / A closer look at the Angler Exploit Kit
« on: November 09, 2015, 05:42:30 pm »
Quote
Over the past few years exploit kits have been widely adopted by criminals looking to infect users with malware. They are used in a process known as a drive-by download, which invisibly directs a user’s browser to a malicious website that hosts an exploit kit.

The exploit kit then proceeds to exploit security holes, known as vulnerabilities, in order to infect the user with malware. The entire process can occur completely invisibly, requiring no user action.

In this research article we will take a closer look at one of the more notorious exploit kits used to facilitate drive-by downloads – a kit known as Angler exploit kit (Angler hereafter).


Source: Blogs.Sophos.com Article - "A closer look at the Angler Exploit Kit"

10
Beginner's Corner / Re: Game modding! WHERE TO BEGIN?
« on: November 02, 2015, 03:06:08 pm »
Although the title is related to modding, I see that your example is an Aimbot. Cheating and modding are, to a certain extent, different.

As a rule of thumb (although not exclusively) cheating is done via memory manipulation or DLL injection (as Sheogorath and RBA mentioned) and it involves mostly knowledge of addressing spaces, memory addressing in general, how DLL's work, how you can inject one, how can you bypass anti-cheating efforts (and implicitly how do anti-cheat such as PunkBuster, VAC (Steam/Valve) and Fairfight (Origin/EA) work).

Modding is usually done via APIs or tools that have been directly exposed by the developer of the original game. This is also not exclusive, as many mods for many games have been done through reverse engineering and techniques usually used for cheating.

If I were to give a suggestion, I would reinforce Sheogorath's suggestion to download, install and do the tutorials of Cheat Engine (http://www.cheatengine.org/) if your goal is to develop cheats or trainers. Whilst doing this deepen your knowledge of the topics that you are not familiar with that are presented in the aforementioned tutorials. Once you've done that you can go onto trying to build a custom Cheat Engine script (LUA) for a more modern game (2013+) to see how the lessons apply in a "real-world" scenario.

If modding is your thing, unfortunately I have no good advice as I've never done/worked on/read about how a mod is built. Although, intuition-wise, object oriented programming, C++, C#/Java spring to mind as relevant topics.

L.E.: If creating cheats & co. is indeed your goal, a nice place to start from is studying how DLL injection works (it's a technique used very, very often) when injecting into the affected process's mem space, then read on how DLL injection works when you inject into a different process other than your target (i.e. inject into Skype to cheat in Counter Strike with the goal of avoiding detection). Afterwards I for one would try to build my own DLL injector and use it to see how the technique works. Finally, a study on WINAPI hooking and building a working function hook will definitely be of use.

11
High Quality Tutorials / Re: A Brief Look into Shellcoding
« on: November 02, 2015, 10:19:38 am »
Nice tutorial parad0x.

But if I may, I have a suggestion. Shellcoding goes hand-in-hand with exploiting, and as such I personally believe it's nicer to teach/learn both at the same time. A tutorial (or a series of tutorials) on exploiting with everything that goes along (egg hunting, ASLR bypass, DEP bypass, etc) would be super nice for sure.

But still, good job!  :)

12
Found it on the Webs / Re: Have I been pwned?
« on: October 30, 2015, 10:36:03 am »
Saw this a few days back as well.

My junk e-mail has been pwned in Adobe and CTF365, but my main e-mail hasn't been.

13
Creative Arts / Re: Board of Shame
« on: October 30, 2015, 10:34:24 am »
Quote from: puddi on October 29, 2015, 11:23:52 pm
cause you are disgraced in so many ways
so imma jerk you off till you cum in ma face!

Wat...
That's... beautiful!

14
Operating System / Re: Hashcat String Help
« on: October 29, 2015, 11:04:36 am »
It's great that you solved it!

However just for clarity I would like to also suggest (and strengthen) white-knight's suggestion of using oclHashCat (cudaHashCat in your case) as GPU's can crack hashes orders of magnitude faster than CPU's.
Do note however that the syntax of cudaHashCat, although very very similar, is not exactly identical to the one of the standard HashCat, so certain changes will have to be made.

For instance, 3c439fe413fee66d50d46846b56c022c is the md5 hash of "AString".

Cracking this with cudaHashCat (this is from Windows, but the syntax is the same), assuming certain knowledge (such as that the original string is 7 characters long), would look like this:
Code: [Select]
cudaHashcat64.exe -m 0 -w 3 -a 3 680635dee5365c3a0aa55c6dc7bc86db -1 ?l?u?d ?1?1?1?1?1?1?1
-m 0
A value of 0 means the hash is MD5. A table of the values for each type of hash can be found here.

-w 3
Maximum performance out of the GPU. With this value my desktop PC starts framing hard in Windows (mouse movements) while cracking. 99% resource usage goes to cudaHashCat.

-a 3
Use a mask-attack.

680635dee5365c3a0aa55c6dc7bc86db
Self explanatory.

-1 ?l?u?d
You can set up to 4 custom charsets. Each charset can occupy one or more positions in the mask. In the above link you can see that ?l stands for lowercase letters, ?u stands for uppercase letters and ?d stands for digits. How this is used is explained below.

?1?1?1?1?1?1?1
7 times the "1" charset. This means that the original string had 7 characters, and that each of those characters can be either a lowercase letter (?l), uppercase letter (?u) or a digit (?d).

On my laptop (which is way, way, way weaker than my desktop) cracking the MD5 hash from above, with the mask I mention (i.e. we don't iterate from 2 chars to 7 chars, we just do a mask attack on the 7 char space) had the following results:

Code: [Select]
Session.Name...: cudaHashcat
Status.........: Cracked
Input.Mode.....: Mask (?1?1?1?1?1?1?1) [7]
Hash.Target....: 680635dee5365c3a0aa55c6dc7bc86db
Hash.Type......: MD5
Time.Started...: Thu Oct 29 11:55:36 2015 (36 secs)
Speed.GPU.#1...:   799.7 MH/s
Recovered......: 1/1 (100.00%) Digests, 1/1 (100.00%) Salts
Progress.......: 28991029248/3938980639167 (0.74%)
Rejected.......: 0/28991029248 (0.00%)
Restore.Point..: 0/15752961 (0.00%)
HWMon.GPU.#1...:  0% Util, 51c Temp, N/A Fan

Started: Thu Oct 29 11:55:36 2015
Stopped: Thu Oct 29 11:56:13 2015
For reference, the video card is an NVIDIA Quadro K2100M, so nothing too special.
If you want to do a more serious benchmark, crack an MD5 hash with exactly the same settings, only let it iterate char spaces (don't set it fixed, let it bruteforce it) and you'll see MAJOR differences in performance. What takes minutes with the GPU can take hours with the CPU.
The command in oclHashCat, as nrael mentioned above is basically identical with one extra parameter:
Code: [Select]
cudaHashcat64.exe -m 0 -w 3 -a 3 680635dee5365c3a0aa55c6dc7bc86db -1 ?l?u?d ?1?1?1?1?1?1?1 --increment

So as you can see the syntax between HashCat and oclHashCat is almost identical, with small differences. Just be a bit watchful and you'll have it in no time!
Good luck!

15
General discussion / Re: Anyone working in the penetration testing industry?
« on: October 27, 2015, 01:43:28 pm »
Hey gentlemanscratch and welcome to EZ first of all! (Nice nickname btw  ;D).

I sort of fit in your profile, with the exception of not working for a company which outsources penetration testing, but rather I work for a software development company and conduct penetration testing on internal products before they hit the market.

Now on to the questions (answers in italics):

1) How did you get your foot in the door? (Did you specifically look for a pen testing job, did someone come to you, etc?)
After doing a Bachelor of Engineering (I.T. specialization) and in parallel studying relevant sub-fields of the Security domain I set up my LinkedIn profile in such a way that it would come up as a hit for headhunters/recruiters looking to hire in the Sec industry (I wasn't fixed on pen-testing at the time and was interested in working in basically any field of Sec - RE, Malware Analysis, AV development, Pen Testing, Red Team, Blue Team, etc.). Apart from that I also looked at what skills are required at entry level for the jobs I was interested in, focused hard on broadening my knowledge in that particular field as fast as possible and applied to those particular companies as well.
In the end I got my previous job by applying (I didn't like it much) and got my current job (which I love) by getting recruited.

2) Were there any specific qualifications your employers looked for? (Degree in some area, published papers, code, etc?)
Degree in I.T. or related. Everything else was interview-based. No requirements for certifications, papers or code although they can be useful. But because I did not have any hard proof of my knowledge I had to undergo a more rigorous technical interview (like a multiple-choice exam combined with a couple of hypothetical case studies).

3) What's the pay like?
In my country it's great. Entry level pay is somewhere in the vicinity of 4-5 times the minimum wage. With experience and time it can go as high as 15-20 times the minimum wage.

4) Do you enjoy your job?
My current job, yes, yes I do. I actually love it and come to work happy and go home happy. Of course no job is without its idiots/fucktards/autistic fuckers, but knowledge and confidence pwn in the Sec industry. Prove you got dem skillz and people tend to listen.

5) What exactly is your position and what do your specific duties entail?
Penetration Tester. Part of Red Team. Duties entail conducting full penetration testing for any application that gets produced by my company, as well as various other Red Team tasks (custom protocol reverse engineering, exploit development, reverse engineering for the purpose of testing anti-cracking hardening, etc.). The applications range is quite broad and I've had projects which involved auditing web apps, PC client apps, PC server apps and mobile apps with everything that this entails (client-side, server-side, server posture, communications, etc.).

6) Do you work for a company or do you do freelance work?
I work for a company. Never did or tried freelancing.


I hope this answers some of your questions.

Pages: [1] 2 3 ... 16