Cybersecurity news about "Telegram Client"

T3SF is a framework that offers a modular structure for the orchestration of events based on a master scenario events list (MSEL) together with a set of rules defined for each exercise (optional) and a configuration that allows defining the parameters of the corresponding platform. The main module performs the communication with the specific module (Discord, Slack, Telegram, etc.) that allows the events to present the events in the input channels as injects for each platform. In addition, the framework supports different use cases: "single organization, multiple areas", "multiple organization, single area" and "multiple organization, multiple areas". Getting Things Ready To use the framework with your desired platform, whether it's Slack or Discord, you will need to install the required modules for that platform. But don't worry, installing these modules is easy and straightforward. To do this, you can follow this simple step-by-step guide, or if you're already comfortable installing packages with pip, you can skip to the last step! # Python 3.6+ requiredpython -m venv .venv # We will create a python virtual environmentsource .venv/bin/activate # Let's get inside itpip install -U pip # Upgrade pip Once you have created a Python virtual environment and activated it, you can install the T3SF framework for your desired platform by running the following command: pip install "T3SF[Discord]" # Install the framework to work with Discord or pip install "T3SF[Slack]" # Install the framework to work with Slack This will install the T3SF framework along with the required dependencies for your chosen platform. Once the installation is complete, you can start using the framework with your platform of choice. We strongly recommend following the platform-specific guidance within our Read The Docs! Here are the links: Discord Slack Telegram WhatsApp Usage We created this framework to simplify all your work! Using Docker Supported Tags slack → This image has all the requirements to perform an exercise in Slack. discord → This image has all the requirements to perform an exercise in Discord. Using it with Slack $ docker run --rm -t --env-file .env -v $(pwd)/MSEL.json:/app/MSEL.json base4sec/t3sf:slack Inside your .env file you have to provide the SLACK_BOT_TOKEN and SLACK_APP_TOKEN tokens. Read more about it here. There is another environment variable to set, MSEL_PATH. This variable tells the framework in which path the MSEL is located. By default, the container path is /app/MSEL.json. If you change the mount location of the volume then also change the variable. Using it with Discord $ docker run --rm -t --env-file .env -v $(pwd)/MSEL.json:/app/MSEL.json base4sec/t3sf:discord Inside your .env file you have to provide the DISCORD_TOKEN token. Read more about it here. There is another environment variable to set, MSEL_PATH. This variable tells the framework in which path the MSEL is located. By default, the container path is /app/MSEL.json. If you change the mount location of the volume then also change the variable. Once you have everything ready, use our template for the main.py, or modify the following code: Here is an example if you want to run the framework with the Discord bot and a GUI. from T3SF import T3SFimport asyncioasync def main(): await T3SF.start(MSEL="MSEL_TTX.json", platform="Discord", gui=True)if __name__ == '__main__': asyncio.run(main()) Or if you prefer to run the framework without GUI and with Slack instead, you can modify the arguments, and that's it! Yes, that simple! await T3SF.start(MSEL="MSEL_TTX.json", platform="Slack", gui=False) If you need more help, you can always check our documentation here! Download T3SF

MSEL Slack

Let's play a game. How long does it take you to learn something new in this video? // YouTube VIDEOS mentioned // Decrypting TLS HTTP/2 and QUIC with Wireshark: https://youtu.be/yodDbgoCnLM // YouTube PLAYLIST // Wireshark with Chris Greer: https://www.youtube.com/watch?v=rmFX1V49K8U&list=PLhfrWIlLOoKO8522T1OAhR5Bb2mD6Qy_l&pp=iAQB // David SOCIAL // Discord: https://discord.com/invite/usKSyzb Twitter: https://www.twitter.com/davidbombal Instagram: https://www.instagram.com/davidbombal LinkedIn: https://www.linkedin.com/in/davidbombal Facebook: https://www.facebook.com/davidbombal.co TikTok: http://tiktok.com/@davidbombal YouTube: https://www.youtube.com/@davidbombal // MY STUFF // https://www.amazon.com/shop/davidbombal // MENU // 00:00 - Introduction 00:28 - My Setup 00:43 - Do You Know? 01:26 - Start of Demonstration with Telnet 03:54 - Port Numbers Further Explained 04:55 - Using Apache2 06:29 - How Are Port Numbers Assigned? 08:39 - Ephemeral Ports 10:42 - Using Fing 11:34 - Restarting Apache2 and Denying TCP 15:54 - Which Port Numbers to Clients Actually Use? 17:46 - On Ubuntu 19:01 - Theory vs Reality 23:37 - Difference Between Port Number and Socket 26:07 - Demonstration Continued 29:04 - What You've Learned So Far 29:54 - One Last Demonstration 32:34 - Conclusion and Outro // Detailed MENU // 00:00:00 - Introduction to the Game - David introduces a game where viewers comment on the timestamp or topic where they learn something new. 00:00:11 - Importance of Port Numbers - Emphasis on understanding port numbers for those interested in cybersecurity, networking, or other fields. 00:00:24 - Network Setup - David describes the network setup involving Kali Linux, Cisco routers, a Windows computer, and mobile devices. 00:00:48- Understanding Ports and Sockets - Queries about the difference between port numbers and sockets, and their relevance in TCP/IP. 00:01:28 - Demonstration with PuTTY and Telnet - A practical demonstration using PuTTY and Telnet to connect to a specific port on a Cisco router. 00:03:04 - Character Generator Protocol (CHARGEN) Discussion - Explaining CHARGEN Protocol and its historical significance. 00:03:11 - Disabling TCP Small Services and Testing Connection Refusal - The process of disabling TCP small services on a router and testing the impact on connectivity. 00:04:01 - Kali Linux Server Setup and Apache Service Start - Setting up a server on Kali Linux and starting the Apache service. 00:05:09 - Analyzing Network Traffic with Wireshark - Using Wireshark to analyze traffic and understand port numbers in network communications. 00:06:39 - Understanding IANA Port Numbers and Ephemeral Ports - A look at IANA's list of port numbers and an explanation of ephemeral ports. 00:07:54 - FCs and Operating System Differences in Port Usage - Discussing RFCs and how different operating systems use various port ranges. 00:08:54 - Testing Port Accessibility with Mobile Devices - Using mobile devices to test the accessibility of ports on a network. 00:11:38 - Implementing Access Lists on Cisco Router - Creating and modifying access lists on a Cisco router to control network traffic. 00:14:06 - Difference Between Port Numbers and Sockets - Explaining the conceptual difference between port numbers and sockets. 00:16:00 - Demonstrating SSH Connections and Port Usage - Demonstrating SSH connections from different devices and analyzing the port usage. 00:18:03 - Blocking SSH Traffic with Access Lists - Blocking SSH traffic using access lists on a router and observing the effects. 00:21:37 - Discussion on DNS Protocol and Traffic Blocking - Discussion on DNS protocols and the impact of blocking DNS traffic with access lists. 00:27:41 - Exploring HTTPS and QUIC Protocols with Browser Examples - Exploring HTTPS and QUIC protocols using various web browsers and analyzing network traffic. 00:32:11 - Conclusion and Future Content Ideas - Concluding remarks and thoughts on future networking-related content. kali linux linux nmap ssl http https ssh telnet chargen port port numbers wireshark #kalilinux #cybersecurity #hacker

Access Lists Ephemeral Ports Port Usage

Register today to be a part of the coolest Cybersecurity conference and end 2023 on a bang!Hello hackers!IWCon 2023 — the internet's biggest virtual cybersecurity conference and networking event is happening on 16–17 December 2023.It's a wonderful opportunity for cybersecurity professionals, bug bounty hunters, and students from all over the world to learn, connect, and network. The best part? The entry ticket is just (INR 800 if you're from India)!We have some amazing speakers sharing their cutting-edge research and unique experiences of how they established themselves in Infosec.Be a part of this cool bunch, and book your spot here.Check out our amazing speaker sessionsJason Haddix, BuddoBot CISO & Hacker in Charge will speak on “Recon Like an Adversary.”This is a live workshop where we select an organization and demonstrate how adversaries can use open-source tools and methods to conduct reconnaissance on web infrastructure.Date: December 16, 2023Time: 09:30–10:00 PM ISTSaikrishna Budamgunta, Ex-IRS | Founder @ Saptang Labs, Divsight Intelligence, Maitravaruna & Pinaca Technologies, will speak on “Understanding Chinese Cyber Threats.”Date: December 17, 2023Time: 7:30–8:00 PM ISTDylan Ayrey, Security researcher, public speaker and founder of Truffle Security will speak on “Google Oauth is broken; keep access after leaving..”Talk description: When an Oauth vulnerability is documented, is it still a vulnerability? I think it is, but you can decide for yourselfDate: December 16, 2023Time: 10:30–11:00 PM ISTRenzon Cruz, Principal IR/Forensic Consultant @Unit42_Intel | Co-Founder @guidemtraining will speak on “Navigating the RaaS Threat Landscape: Effective Detection and Response Techniques”Talk description: In this talk, Renzon will cover the latest tactics, techniques, and procedures (TTPs) of ransomware threat actors, delving into essential forensic artifact collection and analysis, detection strategies across ransomware incident phases, and insights into the critical process of ransomware negotiation from his daily experience.Date: December 17, 2023Time: 7:30–11:00 PM ISTCheck the full speaker line-up here.All the sessions will be followed by 20 minutes of Q&A, and value-packed networking sessions where you can match up with cool peeps in Infosec from all over the world.Are you excited?Save your seat today.Got any questions? We're here to address them.If you have any questions, doubts, or blockers stopping you from being a part of IWCON 2023, we'll be happy to answer them.Leave a reply to this email (or drop a comment below) and we'll get back to you as soon as possible.Looking forward to seeing you at IWCON 2023.Book your seat today.Best,Editorial teamInfosec Writeups.Announcing IWCON 2023 Speakers Final Batch was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Final Batch Speakers Final

If you're just beginning your journey in the tech field or seeking to enhance your knowledge further, I have some top recommendations that are entirely free. While there are advantages to opting for the premium versions, remember that spending a lot of money isn't necessary to learn and broaden your knowledge in this field. These resources can definitely assist in landing your dream job and enhancing your growth on your Journey, if you invest the time and effort daily into your studying.For more tips and the latest updates, feel free to check out my Twitter. https://twitter.com/secure_cornerhttps://medium.com/media/ceb4fd2380af661521a6e88c61bea3a3/hrefCybersecurity & Ethical Hacking Learning PlatformsTryhackme — This platform is known for its excellent hands-on modules. I particularly appreciate their extensive learning paths, which allow you to focus on specific areas. Additionally, they offer plenty of amazing rooms that are constantly updated or added, helping you to refine specific skills. After months of enjoying the platform, I personally bought their premium membership.Hackthebox — This platform also offers numerous hands-on modules for learning. It not only features modules within its own academy but also provides a variety of excellent labs where you can put your skills to the test with numerous machines and lab environments. Additionally, you can engage in battlegrounds to challenge and compare your skills with other users.Honing Your Skills with Capture the Flag ChallengesPicoctf — It's an excellent free computer security website for learning. Within its built-in PicoGym, you'll find numerous CTFs (Capture the Flag challenges) that offer practice on a variety of top security vulnerabilities commonly exploited by hackers.Hackthebox — Again, with its multitude of machines and battleground competitions, it's an outstanding CTF platform for testing and honing your skills.PentestersLab — PentesterLab is a platform I find myself returning to time and time again to test my skills with their free exercises. While the pro version offers many benefits, you can definitely make the most out of it by focusing on and filtering through the free exercisesCyberDefenders — One of my favorite blue team defense platforms is Cyber Defenders. It's excellent for learning how to be on the defensive side and helps expand your knowledge through their free challenges and labs.Bug Bounty/Web SecurityHacker101 — Hacker101 offers its own CTFs and is powered by one of the top bug bounty programs, HackerOne. This specific site features comprehensive learning materials that explain everything about the bug bounty world. If you prefer learning through videos, their lessons typically include hands-on experience videos, which help in visualizing and understanding the content more effectively.PortSwigger Web Security Academy — If you're familiar with Burp Suite, you should know about their excellent learning academy for web security. I often return to their site to read their material, which has been immensely helpful in deepening my understanding of SQL injection, XSS, CSRF, and many more web security concepts.Infosec Writeups — It's a write-up website, but I came across an outstanding article that provided an in-depth explanation of various helpful bug bounty tips, tools, blogs, and more. It was exceptionally informative and greatly assisted me in understanding this field.https://infosecwriteups.com/bug-bounty-hunting-methodology-toolkit-tips-tricks-blogs-ef6542301c65CodingI highly recommend learning coding to anyone entering these fields. Python is an excellent starting language, particularly for developing your own tools. HTML, CSS, and JavaScript are also crucial, especially for web hacking, as they provide a deeper understanding of web page creation and functionality.FreeCodeCamp- FreeCodeCamp is one of the top free coding learning platforms. It offers a wide range of modules that provide hands-on experience, helping you understand the mechanics of coding. Moreover, it enables you to build small projects, allowing you to apply and test what you've learned.Codecademy — One of my go-to coding sites, it offers a vast array of topics including programming languages, web development, career paths, and more. There are plenty of free resources available, along with hands-on learning materials that consistently test and reinforce the skills you acquire.Harvard CS50 Introduction to Computer Science- Highly recommended by many who have pursued computer science, this course is taught by one of the top computer science professors, David J. Malan. There's no need to spend any money to learn from this perfect entry-level and fundamental course.YouTubeYouTube has it all, offering a wealth of learning opportunities. There are many incredible creators to watch and learn from. While I could provide a comprehensive list, here are several to get you started, and you can expand your exploration from there.David BombalDavid Bombal2. STÖKSTÖK3. NahamSecNahamSec4. NetworkChuckNetworkChuck5. Professor MesserProfessor Messer6. John HammondJohn HammondThank you for reading this article and I wish you the best of luck on your journey. :)Remember, in your journey through cybersecurity and technology, the key is to never give up and continuously learn. Every challenge is a stepping stone to mastery.Feel free to explore my work and support it if you enjoy it.Website — https://thecybersecurecorner.com/twitter — https://twitter.com/secure_cornerTop Free Resources for Ethical Hacking and Bug Bounty Beginners & Experts was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

Bounty Beginners

Analyzing how Nmap -sV probes give your assessment awayThis investigation was triggered during my last blog about Nmap. Where I mentioned how a specific URI gets sent to endpoints called nmaplowercheck. This could be a clear indication for the blue team that their application is scanned and could blow the cover for a red team investigation. This blog will uncover how the Service Probes will be a clear indication that your system is scanned.IntroductionBut first, how does Nmap service probes work? This is important information to better understand why and how you can research it yourself in the future for other ports and newer versions to come.In the install folder of Nmap there is a file which is called nmap-service-probes. This is an important file because it holds all probes which will be performed by Nmap. Based upon three items:Which ports are discovered as openHow aggressive is your scan isIf there was already a hard or soft match based on the previously performed probe on the specified port.Let us take a look at 2 probes in the specified file.The first one as mentioned in the provided command is the NULL based probe. This is the probe that is sent to all ports which are open. It just waits for 6 seconds and waits if the application behind the port is so nice to leak the header information on its own.It shows the information Probe is a TCP based connection with the name NULL. Where it just sends nothing (seen at q||)It afterwards tries to match it based on the received information. This you can see at the lines starting with match. followed by the information on which Nmap should match the results on.The next example shows some extra information. It is a TLSv1.2 prob. Where it is specified that the Probe again is sent on TCP with the name TLSSessionReq followed by the message in hex. Important to note that the message contains random1random2random3random4. Already one extra clear indicator that Nmap is used for scanning!a new property is included as well rarity: this indicates the rarity that that this message is sent. With rarity one being the highest. Indicating that it is the most common and rarity 9 that it is uncommon.Important site information: By default, Nmap runs all probes when -sV is used till rarity 7. It starts with rarity 1 and the rarity keeps increasing till a hard or soft match is found!It also specifies on which ports it will run: so this probe is sent to the following open ports:ports 443,444,465,636,989,990,992,993,994,995,1241,1311,2252,3388,3389,4433,4444,5061,6679,6697,8443,8883,9001Now that we know how Nmap will determine which probes to send let us investigate a server that has ports 80,443 and 3389 open.We perform two scans by using the following commands. The big difference between both is the — version-all command. This forces Nmap to perform all Service-probe connections even when a soft match is found and even if the rarity is above 7, (so rarity 8 and 9 are also included)nmap -sV <ip> -Pn --version-tracenmap -sV --version-all <ip> -Pn --version-traceFurthermore, we use the — version-trace property which shows more information about the probes being sent. It shows information about the probe being sent to which IP / port and if was successful or not.There is a drastic amount of probes already sent with just -sV. In the case of open ports 80, 443 and 3389 it resulted in 36 probes being sent (including the 3 Null probes which are always sent when a port is open) If we compare that to running all possible probes even with high rarity these combined to 101 probes. These values can of course change based on the rarity of the service run against. As mentioned if a hard or soft match is found it will stop performing the assessment. In this case, Nmap couldn't determine the service of 443. Resulting in the 36 probes.Showing the amount of probes send with different settingsShowing a port of the service scope listNow that we have the basic idea of how we can determine which service probes will be sent. Let us dive into how these could give away that an Nmap application was used.Radom1Random2Random3random4As mentioned above there is a TLS probe that sends a specific message. it adds for the request random1random2random3random4. This is something that you will probably never receive from a normal application.Probe message showing a clear message random1random2random3random4 in the TCP probe requestIf we look at Whireshark we can indeed see that a message was sent to the party inside an SSLv3 Client hello using these specific characters. While filtering within Whireshark searching for the random1random2random3random4 in a frame we get a hit.The SSLv3 Client hello message is found containing the frame contains random1random2random3random4 messageframe contains random1random2random3random4KerberosThere is also a Kerberos message sent to the system. Which can be found by making use of the following frame contains message.frame contains 00:00:71:6a:81:6e:30:81:6b:a1:03:02:01:05:a2:03:02:01:0a:a4:81:5e:30:5c:a0:07:03:05:00:50:80:00:10:a2:04:1b:02:4e:4d:a3:17:30:15:a0:03:02:01:00:a1:0e:30:0c:1b:06:6b:72:62:74:67:74:1b:02:4e:4d:a5:11:18:0f:31:39:37:30:30:31:30:31:30:30:30It describes a Kerberos authentication request (AS_REQ)where the hex string is the contents of the Kerberos request packet.The realm is identified as “NM” and the server name is “krbtgt/NM”. However, the client's name is unspecified. Checking for this information on your ports can also help you identify scans on your system.A Kerberos message.GIOPAlso, the GIOP protocol was sent: The CORBA General Inter-ORB Protocol (GIOP) is the standard protocol used to communicate between different CORBA systems that use different object request brokers (ORBs).It contains a header and a body. Where in the body the message abcdef is sent. Also atypical for a normal system and again a clear indication of an Nmap scanThis can be found by making use of:giop && frame contains abcdefSIPThe SIP request also uses some specific takes which are also a clear indication of a strange request. The SIP call has a specific message: SIP:nm@nm and the tag is root and branch = foo. If we look into that.SIP (Session Initiation Protocol) is a communication protocol used for setting up and managing voice or video calls over IP networks.sip:nm@nm is a SIP URI (Uniform Resource Identifier) that specifies the destination of the SIP message. In this case, the URI consists of a username "nm" and a domain "nm".tag=root is a parameter in the SIP message that identifies a unique identifier for the SIP message. The tag is used to match responses from servers and to indicate the dialog between SIP entities.call-id 50000 is another parameter in the SIP message that identifies a unique identifier for the SIP call. The call-id header field is used to relate a particular SIP message to a specific call.So, branch=foo would typically be used as part of a Via header field in an SIP message to identify the specific session to which the message belongs.again a not default message that could clearly indicate that a Nmap scan took place:This could have been found by using the following search parameter:sip && frame contains "branch=foo" && frame contains "<sip:nm@nm>;tag=root" && frame contains "To: <sip:nm2@nm2>"The probe could also have been discovered from the nmap-probe-scan fileThe nmap-probe-scan file lists al probes the SIP Options call is one of them.RDPStrangely there is also a cookie being set on port 443. When performing an rdp request. This can be found in the rdp.lua code. The cookie name mstshash with the value nmap is also a clear indication that an Nmap scan is being performed.and the code in the rdp.lua file containing the reference to Nmap in the cookie string:ConnectionRequest = {new = function(self, proto) local o = { proto = proto } setmetatable(o, self) self.__index = self return o end,__tostring = function(self) local cookie = "mstshash=nmap"local data = string.pack(">I2I2B", 0x0000, -- dst reference 0x0000, -- src reference 0x00) -- class and options .. ("Cookie: %srn"):format(cookie)if ( self.proto ) then data = data .. string.pack("<BBI2I4", 0x01, -- TYPE_RDP_NEG_REQ 0x00, -- flags 0x0008, -- length self.proto -- protocol ) end return tostring(Packet.TPKT:new(Packet.ITUT:new(0xE0, data))) end },If we look at the logs from the version trace we see that the TerminalServerCookie is being performed and that it afterward matches with the ms-wbt-server. I don't know why it is sent on port 443 though. In the logs, it does state that it had a successful write on both 443 and 3389.Trinity.bakI came across another URI specific for Nmap. GET /nice%20ports%2C/Tri%6Eity.txt%2ebak HTTP/1.0Again a clear indication that an Nmap scan has been performed.The codeIf we look at the code of Nmap. Where we can find some logic that could leak information. For example in versant.lua if a user is not specified the default Nmap user will be used.Versant.luaVersant = { -- fallback to these constants when version and user are not given USER = "nmap", VERSION = "8.0.2", -- Creates an instance of the Versant class -- @param host table -- @param port table -- @return o new instance of Versant new = function(self, host, port) local o = { host = host, port = port, socket = nmap.new_socket() } setmetatable(o, self) self.__index = self return o end, -- Connects a socket to the Versant server -- @return status true on success, false on failure -- @return err string containing the error message if status is false connect = function(self) return self.socket:connect(self.host, self.port) end, -- Closes the socket -- @return status true on success, false on failure -- @return err string containing the error message if status is false close = function(self) return self.socket:close() end, -- Sends command to the server -- @param cmd string containing the command to run -- @param arg string containing any arguments -- @param user [optional] string containing the user name -- @param ver [optional] string containing the version number -- @return status true on success, false on failure -- @return data opaque string containing the response sendCommand = function(self, cmd, arg, user, ver) user = user or Versant.USER ver = ver or Versant.VERSION arg = arg or "" local data = stdnse.fromhex("000100000000000000020002000000010000000000000000000000000000000000010000") .. string.pack("zzz", cmd, user, ver ) -- align to even 4 bytes data = data .. string.rep("", 4 - ((#data % 4) or 0))tns.luaThe same with Tns.lua code. In the connection string also the Nmap user will be used when no specific user is specified.- Initiates the connection to the listenerPacket.Connect = { CONN_STR = [[ (DESCRIPTION=(ADDRESS=(PROTOCOL=TCP)(HOST=%s)(PORT=%d)) (CONNECT_DATA=(SERVER=DEDICATED)(SERVICE_NAME=%s)(CID= (PROGRAM=sqlplus)(HOST=%s)(USER=nmap))))]], version = 314, version_comp = 300,NetworkAlso, a clear giveaway is that every request always contains the following network settings:MSS (Maximum Segment Size): 1460TCP window size: 64240SACK_perm (Selective Acknowledgement Permitted): 1 (which means this option is enabled and the receiver can acknowledge multiple non-consecutive segments as well)WS (Window Scaling): 128 (which means the receiver is using window scaling option and the window size should be multiplied by 2¹²⁸)This is important information because normally the first connection request sent to a remote host uses a window size of 16K (16,384 bytes).If there are problems it will be scaled up 4 times to eventually reach 64Kb. Starting with 64 Kb each therefore uncommon and can especially with short succession on different ports be an indicator that someone is scanning your application.Wireshark image showing the TCP windows size and other information on SYN messages.Conclusion:The last blog motivated me to perform a deep dive into this tool. Interesting how much you can learn if you sit and watch what your tool is doing. Nmap has some great documentation which was a real help.This information can be used by the Blue team to create better triggers for security alarms. And it clearly shows for red teamers that you probably should never use -sV. It just leaks too much information or you should change the probes.I should really learn more about YARA or snort and how this could be detected for verification. In my opinion, it would really help my red teaming/malware writing knowledge. In the case of Nmap I would advise looking at the specific sends probes and writing a detection script for every unique message with a rarity below or equal to 7.Happy testing!If you want to discuss anything related to infosec I'm on LinkedIn: https://www.linkedin.com/in/bobvanderstaak/Resources:https://nmap.org/book/man.htmlhttps://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/description-tcp-featuresEvading Detection With Nmap Part 2 was originally published in InfoSec Write-ups on Medium, where people are continuing the conversation by highlighting and responding to this story.

probes SIP SIP message

Hidden Desktop (often referred to as HVNC) is a tool that allows operators to interact with a remote desktop session without the user knowing. The VNC protocol is not involved, but the result is a similar experience. This Cobalt Strike BOF implementation was created as an alternative to TinyNuke/forks that are written in C++. There are four components of Hidden Desktop: BOF initializer: Small program responsible for injecting the HVNC code into the Beacon process. HVNC shellcode: PIC implementation of TinyNuke HVNC. Server and operator UI: Server that listens for connections from the HVNC shellcode and a UI that allows the operator to interact with the remote desktop. Currently only supports Windows. Application launcher BOFs: Set of Beacon Object Files that execute applications in the new desktop. Usage Download the latest release or compile yourself using make. Start the HVNC server on a Windows machine accessible from the teamserver. You can then execute the client with: HiddenDesktop <server> <port> You should see a new blank window on the server machine. The BOF does not execute any applications by default. You can use the application launcher BOFs to execute common programs on the new desktop: hd-launch-edgehd-launch-explorerhd-launch-runhd-launch-cmdhd-launch-chrome You can also launch programs through File Explorer using the mouse and keyboard. Other applications can be executed using the following command: hd-launch <command> [args] Demo Hidden.Desktop.mp4 Implementation Details The Aggressor script generates random pipe and desktop names. These are passed to the BOF initializer as arguments. The desktop name is stored in CS preferences at execution and is used by the application launcher BOFs. HVNC traffic is forwarded back to the team server using rportfwd. Status updates are sent back to Beacon through a named pipe. The BOF initializer starts by resolving the required modules and functions. Arguments from the Aggressor script are resolved. A pointer to a structure containing the arguments and function addresses is passed to the InputHandler function in the HVNC shellcode. It uses BeaconInjectProcess to execute the shellcode, meaning the behavior can be customized in a Malleable C2 profile or with process injection BOFs. You could modify Hidden Desktop to target remote processes, but this is not currently supported. This is done so the BOF can exit and the HVNC shellcode can continue running. InputHandler creates a new named pipe for Beacon to connect to. Once a connection has been established, the specified desktop is opened (OpenDesktopA) or created (CreateDesktopA). A new socket is established through a reverse port forward (rportfwd) to the HVNC server. The input handler creates a new thread for the DesktopHandler function described below. This thread will receive mouse and keyboard input from the HVNC server and forward it to the desktop. DesktopHandler establishes an additional socket connection to the HVNC server through the reverse port forward. This thread will monitor windows for changes and forward them to the HVNC server. Compatibility The HiddenDesktop BOF was tested using example.profile on the following Windows versions/architectures: Windows Server 2022 x64 Windows Server 2016 x64 Windows Server 2012 R2 x64 Windows Server 2008 x86 Windows 7 SP1 x64 Known Issues The start menu is not functional. Credits Heavily based on TinyNuke Included improvements/fixes from Meltedd/HVNC Uses Beacon job interface and project structure from SecIdiot/netntlm Download HiddenDesktop

HVNC HVNC server

Search results for Telegram Client