I got a really convincing phish today from
@PayPal
. And when I say "from Paypal", the from address is service
@paypal
.com. I knew right away that I didn't have a PayPal account for this email, so I was sure it was fake. It took me a minute to figure out what I was looking at. 🧵
The important thing I always tell people: Never call a phone number you get from an email / text / phone call that could be suspicious. If you think account may be hacked, go get the number from the official website and call that. Same goes for links to login pages.
It's not immediately clear to me how they got their email to show as billing.dprt
@paypal
.com. That said, given the rest of this, I'm sure it's some trick in settings somewhere of company accounts that can send invoices like this. Probably something
@PayPal
should look at.
The clever / evil part is that they managed to register the account "Billing Department of PayPal", and then to use an invoice (which is designed to say "hello, I'm requesting $1000") as an email from the security team saying "hello, you've already been charged $1000"
This is a real paypal site. It just happens to be an invoice from someone to me, asking for $1000. I doubt anyone reads this text and clicks the "Pay $1,000" button. Rather, the intent is to scare you with official looking emails with large $$$ in them into making that call.
Scrolling down, here's the clever part. I'm presented with urgency and large but not too large dollar amounts. Who wouldn't act now to prevent being charged $1000?
I don't know what they do once you call. I would guess that they ask for your username and password, and then try to get into your account and drain it that way. Or ask for your credit card number etc to "issue a refund".
I don't have access to a
@PayPal
business account, but
@atjontv
does, and was able to recreate this exact attack, explaining the one part I was unsure on, and confirming the rest. (Screenshots in thread, shared with permission) 🧵
This of course is harder when you get a scam phone call from "Microsoft". You can't just look up a number for them and call back, since MS doesn't offer that.
Still be skeptical of people who reach out to you, where you can, ensure you are talking to who you think you are.
I don't have access to a
@PayPal
business account, but
@atjontv
does, and was able to recreate this exact attack, explaining the one part I was unsure on, and confirming the rest. (Screenshots in thread, shared with permission) 🧵
I got a really convincing phish today from
@PayPal
. And when I say "from Paypal", the from address is service
@paypal
.com. I knew right away that I didn't have a PayPal account for this email, so I was sure it was fake. It took me a minute to figure out what I was looking at. 🧵
@akrembasha
@PayPal
It's not. They went into PayPal and generated an invoice to send me, and PayPal did. They just used the custom text space to make it look like a security alert.
Building a new Windows FlareVM today. Most difficult part is disabling Defender (the instructions in the README don't work anymore).
In case it helps anyone in the future, the instructions in this post do:
RE just retired from
@hackthebox_eu
. As the creator of the box, I tried to bring phishing/macro obfuscation concepts to the initial access. The intended privescs were the WinRar ACE file exploit, and XXE in Ghidra. I'll show two unintended privescs too.
Blog from
@ippsec
and me on the
@hackthebox_eu
blog - Finding that balance between not giving up too early and being pointlessly stuck is important. But the answer isn't "never seek help". Trying harder isn't always the answer when you're trying to learn.
So they generate an invoice to a bogus "
@paypal
" email, and CC me (and probably lots of other people), and hope my eye skips over the fact that "billing.dprt
@paypal
.com" is the "bill to" and focus on the scary language with urgency and call the number.
If you play CTFs with a fake TLD (like *.htb), you're probably used to typing siteisup.htb into firefox and getting a google search. Just learned you can add this key in about:config, and now it will stop searching!
I'm overly excited about this.
I learned so much about Kerberos solving Rebound. It was very difficult, but such a great experience. There's Kerberoasting without auth, cross session with RemotePotato0, and abusing delegation, both constrained and RBCD!
Earlier today, I pushed a blog post for the 2017 HackTheBox machine Jail. With that, has a blog post for every retired
@hackthebox_eu
machine. To celebrate, a thread on about my blog, including some stats, goals, and a thank you. 🧵
1/13
Just discovered faketime, and it's super useful when you need to sync with another host but dont want to muck with your system time. Will change the time for just the command that follows (which can be bash if you want to do a bunch of stuff).
Hackback just retired from
@hackthebox_eu
. This is the hardest HTB box. Web exploitation, socks proxy over aspx, named pipe injection, and root via arbitrary write and DiagHub. In Beyond root, I'll show an unintended root, look at the aspx shell, and rdp.
A thread about box reviews on HackTheBox.
I (and many others) read every review submitted for machines on HackTheBox. I get genuine joy from every 5 star review. It means someone learned something, and probably had fun at the same time! And that's the point of HackTheBox. 1/8
Until recently, Ethereal was the hardest box I'd completed on
@hackthebox_eu
. I'm a huge fan, great work by
@egre55
and
@MinatoTW_
. It took me three blog posts to write it all up. Start here: . Then check out posts on brute forcing pbox and writing a shell
@atjontv
went into PayPal and generated an invoice, a feature in PayPal business accounts. The invoice was to "a
@thismymail
.com", and "b
@thismymail
.com" is put in the "CC" field.
With the real phish, a -> billing.dprt
@paypal
.com, and b -> me.
Response was a truly insane box from
@hackthebox_eu
. I'll decrypt Meterpreter traffic from a PCAP, directory traverse via a TLS certificate, read FTP over a POST request, write a HTTP proxy to exploit a HMAC oracle/SSRF, and rebuild a partial SSH key.
nmap scanning is a foundational skill for hacking. UDP scanning can be slow and/or unreliable. A quick video with some tips and tricks for scanning UDP with nmap in a reasonable time frame, as well as some exploration of unexpected data.
I first solved Kotarak while watching
@ippsec
when I had no idea how to solve this stuff. Now, almost three years later, I had a lot of fun going back and solving it again toward my goal of having a writeup for every retired machine from
@hackthebox_eu
.
Sizzle was one of my favorites on
@hackthebox_eu
. scf + responder to catch NetNTLMs, WinRM with Certificate, Kerberoasting, and DCSync. So much fun! In Beyond Root, I'll show two unintended paths for the box, and explore why Burp breaks NTLM HTTP auth.
I was surprised last week that
@hackthebox_eu
retired its first Endgame lab, P.O.O. I cobbled together my notes from 1.5 years ago into a writeup. Some really neat MSSQL and IIS exploitation, with a little sprinkle of AD thrown in at the end.
RopeTwo was the hardest box yet on
@hackthebox_eu
. Only three steps, all binary exploitation: JavaScript v8 engine, heap pwn, kernel module.
In Beyond root, I'll show the unintended route (since patched) that led to first blood.
It says "Hello, a
@thismymail
.com". If a is a contact in the senders email account, they can also give them a name. In the real phish, this was "PayPal User", hence why it says "Hello, PayPal User".
EndGame Xen writeup posted:
A neat lab with phishing, Citrix virtual desktops, Active Directory, packet capture, kerberoasting, etc, from
@hackthebox_eu
.
I tried to show the commands I used a year ago, and highlight what I might do differently today.
One of my favorite things about
@hackthebox_eu
is that they were one of the first to make hacking Active Directory accessible all. Sauna is another in that line, where I'll get access via AS-REP Roast, escalate via autologon creds, and perform a DCSync.
In Forge from
@hackthebox_eu
, I'll chain a redirect and two SSRFs together to read files from a private FTP server. Then I'll abuse pdb in a Python script to get root. In Beyond Root, I'll bypass the filter on the website, and look at the webserver config
The link leads to the invoice, which shows the "a
@thismymail
.com" email as the bill to. In the real phish, this said "PayPal User", and then on the next line, "billing.dprt
@paypal
.com".
Inspired by the page growing so huge, some work on another project, and some conversions with
@ippsec
about his site (), I've added a live updating as you type filter to the tags page on my blog. Feedback welcome! Check it out at:
Explore is the first Android box on
@hackthebox_eu
. There's a simple unauthenticated read in ES File Explorer that leaks information to enable SSH, and
then a port forward to the debug port. The most interesting part was the filesystem.
Attended was another monster insane box from
@hackthebox_eu
. Phishing with a vim exploit and most outbound blocked, exploiting malicious SSH config, and a relatively contrived yet fun and challenging buffer overflow using SSH keys on a remote host.
Absolute is a very difficult Windows box from
@hackthebox_eu
that is all about Kerberos exploitation. There's user enumeration, as-rep-roasting, LDAP enum, dynamic binary analysis, shadow credentials, and krbrelay.
Docker is a technology I use sometimes, but my knowledge is very basic. I learned a ton from this video on the different docker networks.
Thanks,
@NetworkChuck
Everytime someone tells me they found some value in something I've written, it absolutely makes my day. I'm not a new years resolution person, but I am resolving to try to tell people when I find something they did useful. 30 seconds can really make someone else feel great.
Earlier this week
@_JohnHammond
's analysis of a phishing email identifed a malicious domain. I take the analysis a couple steps further using
@PassiveTotal
and
@MaltegoHQ
.
PS - There's a YouTube video in this one. Let me know if you find that useful.
Just reached 1000 subscribers on YouTube. 🥳🎉🍾
Still humbles me that so many are interested in what I have to share. I'm having a lot of fun practicing talking and presenting. And of course, having a lot of fun solving the challenges 😊
APT didn't have that many steps, but all of them relied on deep understanding of Windows, and the ability to modify tools to get what was needed. Leaking IPv6 over RPC, brute force NTLM hashes over Kerberos, and forcing crackable Net-NTLMv1.
Spent a bunch of time this weekend finishing up a video explaining what happens when you do a "shell upgrade". It's a breakdown of TTYs, why you want one, how you start one, raw vs cooked modes. Hopefully can wrap it up tonight and get it out by tomorrow! Excited about this one!
Search is a really nice AD box from
@hackthebox_eu
. There's Kerberoasting, password reuse/sprays, GMSA, PowerShell Web Access, and client-certificates. I'll use Bloodhound and LDAP through out as a guide.
Oh, and a short YouTube video on using jq!
I've run into a lot of JavaScript obfuscation in CTFs and in life in general. Came across this video which is a brilliant walk through of how one such method works.
Cerberus from
@hackthebox_eu
involves exploiting several CVEs. I'll get into an Ubuntu VM by exploiting Icinga, then escalate via Firejail. I'll get creds from SSSD, and pivot to the Windows host, escalating again via ADSelfService Plus.
Scrambled from
@hackthebox_eu
disabled NTLM auth, breaking how I typically interact with a Windows host. .NET RE, Silver Tickets, Kerberoasting. I'll show attacking from both Windows and Linux. And JuicyPotatoNG in Beyond Root.
Json just retired from
@hackthebox_eu
. There's a .NET deserialization vulnerability, and three paths to privesc, including abusing filezilla, reversing a custom binary to get creds, and juicy potato.
The ZeroLogon exploit has blown up over the last week as POCs have been published. Quick post with some background and taking it for a spin on the Monteverde machine from
@hackthebox_eu
.
I just learned that Chisel updated to include a socks option (I know I'm way behind here...). Updated version of my chisel post, now with a cheat sheet at the top:
If there are other common scenarios that should be in the cheat sheet, leave a comment.
A windows VM is something that's really useful for CTFs, even if used only a small percentage of the time.
@ippsec
showed off networking his Win and Parrot VMs so that he didn't have to take his VPN down and up to switch in
@hackthebox_eu
. I did the same.
This week its Bankrobber from
@hackthebox_eu
. I'll use the XSS first to get the admin's cookie, then to do a XSRF to get code execution. The privesc is a buffer overflow without RE. In Beyond Root, I'll examine the automation for the XSS and the binary.
Knocked out the Offshore Prolab from
@hackthebox_eu
over the last few weeks. Really a lot of fun. Provided a good way to learn a lot of active directory concepts, and a chance to work on pivoting and tunnels. Thanks to
@mrb3n813
and everyone else at HTB for the neat lab.
I've been unhappy with how terminals look on my site for a while now. I've tried to change it before, but got overwhelmed in Jekyll / Rouge.
This weekend, I figured it out! New CSS terminal look! I checked a few hundred posts, but let me know if you find something broken.
Alamot's writeup of LaCasaDePapel introduced me to a new tool - Chankro. It is a way to bypass php disable_functions and get execution on Linux. I wanted to try it myself:
Patents was a crazy box, involving XXE in a word doc, LFI, log poisoning, and then pivoting out of a docker container exploiting a custom binary with ROP. Should have been rated insane, not hard. It's retired from
@hackthebox_eu
, so here's my write-up:
Support will be the fourth box I've had the honor to have go live on
@hackthebox_eu
! It's based on a real life PenTest story, and I had a lot of fun building it.
I hope you all enjoy it!
Bookworm from
@hackthebox_eu
has a crazy interesting insane foothold where I exploit a directory traversal to read files though an exploit combining file upload, XSS, and IDOR. After that, there's symlink abuse and sqli injection to postscript injection.
Anubis from
@hackthebox_eu
was an insane Windows box. The root step is all about abusing certificates based on a blog post from
@elkement
. Before that, there's Windows dockers, ASP injection, and Jamovi exploitation.
Resolute sent me into a rabbit hole. I'll look at why cme reports Pwn3d! for ryan, and at an unintended PSExec exploit that gives a system shell, and try to show why.
Fingerprint was truly an insane machine from
@hackthebox_eu
. Lots of combining exploits to make progress. EAR, XSS, directory traversal, custom Java serialization, browser fingerprints, aes padding attacks, and more.
PlayerTwo just retired from
@hackthebox_eu
. This box had so many steps, and pushed enumeration, fuzzing, and binary exploitation to the limits. To get root, heap exploitation! Plus, lots of Beyond Root, with a couple unintended paths and digging deeper.
The exploit for initial access to Smasher2 involves identifying an error in reference counting in a custom Python library written in C. This is probably the hardest step I've done on
@hackthebox_eu
. For root, I'll exploit a kernel driver to get a shell.
Helpline just retired from
@hackthebox_eu
. This box found a way to have a ton of paths, all of which were quite hard. I'll show as many as I can, broken across three posts. Start here:
After enumeration, you can choose to continue on windows or kali.
Took a look at the PwnBox VIP feature from
@hackthebox_eu
. They did some amazing stuff providing a Parrot VM in a browser, with really cool features for persisting files between sessions. Probably won't be my daily VM, but it has a place in my toolbox.
Postman writeup is live. Easy Linux box, but the Metasploit Redis exploit doesn't work. I'll use Redis to write an SSH key, and look at why the Metasploit exploit failed in Beyond Root:
@hackthebox_eu
"Pros are just amateurs who know how to gracefully recover from their mistakes".
Heard this today and thought of
@ippsec
. I learn the most in his videos when something goes wrong and I get to watch him recover.
I learned some neat stuff about SNMP and SeLinux working on Pit from
@hackthebox_eu
. SeLinux is so powerful, this just scratches the surface. Thanks to
@ippsec
for some lessons :)
In Visual from
@hackthebox_eu
I'll exploit a Visual Studio build service. The most interesting part is recovering SeImpersonate for the local service account using FullPower so that I can run a Potato exploit.
There's a reason Travel from
@hackthebox_eu
has a rating of 4.9/5. It was just a great box from
@ATeamJKR
and
@xct_de
. The best of the several stages was sending a SSRF to use Gopher to poison memcache with a serialized PHP payload to write a webshell.
I'm doing a thing. Don't have a good camera set up, so you don't have to look at my face, and you get to learn about my love for reversing phishing documents.
Delivery from
@hackthebox_eu
was an easy-rated box from
@ippsec
. It did a nice job of requiring some creative thinking without being technically complex. I'll use a helpdesk ticket to register and confirm a mattermost account, and hashcat rules for root.
The best part of Catch from
@hackthebox_eu
is poisoning a config such that the server uses my VM for Redis, and serving a serialized PHP object to get RCE. There's several paths, and lots of interesting exploitation.
Developer provided a chance to hack a CTF website. The reverse tab-nabbing exploit is one that was once reported on
@hackthebox_eu
's website. Then there's a serialization attack, some RE, and of course the mini challenges from the site. Very fun box!
There's a new(ish) technique for exploiting PHP LFI to get RCE without uploading a webshell. I showed it in Beyond Root on UpDown, but wanted to go into more detail. We'll look at LFI2RCE and how it uses PHP filters to generate executed PHP from nothing.
In the Ready post this weekend I used a POC that abused cgroups to escape a privileged docker container. I wanted to understand more, and it led to this post: