CM Security App Lock Bypass on Samsung Galaxy Grand Prime

Hi,

In Samsung galaxy grand prime, there is setting called "Ultra Power Saving Mode"
which will save your battery by utilizing minimum application on your android phones.

This option is specific to Samsung new smartphones.

If you have installed CM Security App Lock to lock your Whats-app/Facebook messages you are at Risk!


1. Samsung Phone with Ultra Power Saving Mode
2. CM Security APP lock must be installed on android device
3. Open Ultra Power Saving Mode from Settings and Enable this functionality.
4. As soon as you enable this functionality Android device will only start selected applications Ex. Browser/Call/SMS
5. There is option to add WhatsApp/Facebook App, you can add WhatsApp and thats it!, you can access private messages locked with CM Security App Lock

This is because when you put your android device in Ultra Power Saving Mode, all processes apart from selected once are closed, and CM Security App Lock process is one of them :)













Access to Whats App Messages

Regards,
eXpl0i13r

From XSS to Domain Admin

Hi,

Recently attended elearning security Webinar, it was quite interesting, where researcher demonstrated way to Domain admin from simple stored XSS attack.

Inspired by that, I thought to create my own scenario and landed up creating this video of around
41 Min 15 Seconds!

My Setup :

Active Directory - Windows 2008 Server
Domain Machine - XP Machine [ With limited User Access ]
Web Server - Apache hosted with vulnerable application [ Ruubikcms ]
Pentester's Machine - Kali Linux


It was fun to create this scenario, setting up Active Directory, Web server and much more!

For reference I have created small PPT which depicts overall scenario.

Download It Here



From XSS to Domain Admin :

1. Stored XSS Malicious script injection.
2. Get access to Victim Computer [ Shell Access ]
3. Privilege Escalation
4. Domain Access


From XSS to Domain Admin - Part 1

From XSS to Domain Admin - Part 2

From XSS to Domain Admin - Part 3

Hope this will be helpful....

I will really appreciate if you can comment on this video and will be helpful for me to work on those areas.


Regards,
eXpl0i13r

Android Meterpreter Shell Hack

It is fun to hack android phones, Its not new but still interesting and thought to put it here...
Metasploit framework has different Android Payloads mentioned below :

I have my HTC One V phone and its rooted , first thing we going to do is create Evil.apk file which will be deployed in android phone, once installed and executed by user we get reverse shell !!

Creating "evil.apk" file and uploaded to HTTP root directory :

evil.apk downloaded in my android phone :

evil.apk download location :

Installing Malicious APK containing reverse shell ;)

Its interesting my CM Security real time protection not detecting any malicious activity! 

After executin "MainActivity" application here is our reverse shell :

Interesting commands from Anroid Meterpreter shell :

Capturing screenshot through meterpreter shell :

Regards,
eXpl0i13r

Wlan Password through Metasploit post exploitation module

In Scenario based hacking, if we get meterpreter session of Victim, we can quickly Enumerate Wlan profiles and their passwords through Metasploit modules present under  : "post/windows/wlan/"


Wlan modules available inside Metasploit framework :

Password Hash Dump Tools Comprehensive List

I came across a website:  http://www.whatsmypass.com/
Which lists windows Password Hash Dump tools Here  this may be handy while doing pen testing, so thought to post it here.

Nice work Guys Keep it up!

Wifi Password using Command Line Windows

Imagine a scenario where you get access to remote machine command prompt, and you want to retrieve WiFi Password so that you can connect to WiFi Network and perform your further penetration testing...

Yes, you can enumerate WiFi profiles and retrieve their passwords in Clear Text through windows commands.

   Command : "netsh wlan show profiles"

    

   Command : "netsh show profiles samsung key=clear"

 

These are very small things, But really powerful when you are working on penetration testing assignments, of course this is all scenario based hacking, hope this is helpful.

Regards,
eXpl0i13r

Sniffing RDP Session Keystrokes with Cain & Able

Cain & Able is very easy to use tool for ARP Poisoning Attack, and at the same time it is powerful.

It has ability to do Man-In-The Middle against the RDP “Remote Desktop Protocol” using which attacker can actually sniff Keystrokes being typed in RDP session, and believe me this can be used in most of real environment while doing Penetration testing

Although ARP Generates lot of traffic, it is worth if you can get hold of credentials ;) in some cases.


Below screenshot shows option where you will find ARP RDP Session details.

   Once captured RDP Session, you can look for "Key released" and in below screenshot you can find
   "cd \" command is executed in RDP session.

Imagine if someone is trying to Log in to other machine from RDP using SMB....or SSH ;)

Hope this helps.