Classic Cars

Aryo Bjards

The eCPTX - Advanced Penetration Testing course from the popular eLearnSecurity Institute and INE is Advanced Penetration Testing. Prerequisites for this course Completion of eJPT and eCPPTv2 Is. The eCPTX course is one of the most popular and difficult courses in the field of penetration testing. This course has four sections including 1. Preparing for attacks | 2. Test the penetration of Active Directory Red Teaming and 3. Red Teaming on important infrastructures | 4. Evasion or bypassing techniques. In this course you will gain a deep understanding of the Red Team, Backdoor, client-side exploitation, build personalized Payloads, Active Directory penetration testing, Evasion techniques of defense tools such as anti Viruses or IDS / IPS, complete scrutiny of the target to find misconfigurations and weaknesses, as well as covert operations and stability. The eLearnSecurity Institute Roadmap is included in the High Quality Images section.

Course pre requisites

EJPT course
ECPPTv2 course
Course specifications
Course level: Advanced
Time: 7 hours and 57 minutes
Includes: ‌ 9 videos | 8 labs | ‌ 7 slides
Professor: Andres Doreste
ECPTX Course Content - Advanced Penetration Testing
Preparing the Attack
Social Engineering Attack Vectors
Red Teaming Active Directory
Advanced Active Directory Reconnaissance & Enumeration
Red Teaming Active Directory
Red Teaming Critical Domain Infrastructure
Red Teaming MS SQL Server
Red Teaming Exchange
Red Teaming WSUS
Evasion
Defense Evasion

Link do Download

Related links

Aryo Bjards

Just connecting to the service, a 64bit cpu registers dump is received, and so does several binary code as you can see:

The registers represent an initial cpu state, and we have to reply with the registers result of the binary code execution. This must be automated becouse of the 10 seconds server socket timeout.

The exploit is quite simple, we have to set the cpu registers to this values, execute the code and get resulting registers.

In python we created two structures for the initial state and the ending state.

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}
finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

We inject at the beginning several movs for setting the initial state:

for r in cpuRegs.keys():

code.append('mov %s, %s' % (r, cpuRegs[r]))

The 64bit compilation of the movs and the binary code, but changing the last ret instruction by a sigtrap "int 3"

We compile with nasm in this way:

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

And use GDB to execute the code until the sigtrap, and then get the registers

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

for x in finalRegs.keys():

...

We just parse the registers and send the to the server in the same format, and got the key.

The code:

from libcookie import *

from asm import *

import os

import sys

host = 'catwestern_631d7907670909fc4df2defc13f2057c.quals.shallweplayaga.me'

port = 9999

cpuRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

finalRegs = {'rax':'','rbx':'','rcx':'','rdx':'','rsi':'','rdi':'','r8':'','r9':'','r10':'','r11':'','r12':'','r13':'','r14':'','r15':''}

fregs = 15

s = Sock(TCP)

s.timeout = 999

s.connect(host,port)

data = s.readUntil('bytes:')

#data = s.read(sz)

#data = s.readAll()

sz = 0

for r in data.split('\n'):

for rk in cpuRegs.keys():

if r.startswith(rk):

cpuRegs[rk] = r.split('=')[1]

if 'bytes' in r:

sz = int(r.split(' ')[3])

binary = data[-sz:]

code = []

print '[',binary,']'

print 'given size:',sz,'bin size:',len(binary)

print cpuRegs

for r in cpuRegs.keys():

code.append('mov %s, %s' % (r, cpuRegs[r]))

#print code

fd = open('code.asm','w')

fd.write('\n'.join(code)+'\n')

fd.close()

Capstone().dump('x86','64',binary,'code.asm')

print 'Compilando ...'

os.popen('nasm -f elf64 code.asm')

os.popen('ld -o code code.o ')

print 'Ejecutando ...'

fd = os.popen("gdb code -ex 'r' -ex 'i r' -ex 'quit'",'r')

for l in fd.readlines():

for x in finalRegs.keys():

if x in l:

l = l.replace('\t',' ')

try:

i = 12

spl = l.split(' ')

if spl[i] == '':

i+=1

print 'reg: ',x

finalRegs[x] = l.split(' ')[i].split('\t')[0]

except:

print 'err: '+l

fregs -= 1

if fregs == 0:

#print 'sending regs ...'

#print finalRegs

buff = []

for k in finalRegs.keys():

buff.append('%s=%s' % (k,finalRegs[k]))

print '\n'.join(buff)+'\n'

print s.readAll()

s.write('\n'.join(buff)+'\n\n\n')

print 'waiting flag ....'

print s.readAll()

print '----- yeah? -----'

s.close()

fd.close()

s.close()

More information

Aryo Bjards

Today on BaT: Wednesday, May 31, 2023

Click here and go to Today on BaT to see today's full activity including auctions closing today, newly open, and closed yesterday.

119 auctions closing today:

1,900-Mile 2006 Ford GT Heritage Edition

1969 Plymouth GTX Hemi Convertible

7,500-Mile 2005 Ferrari F430 Spider 6-Speed

2005 Ford GT

7k-Mile 1994 Ferrari 348 Spider

No Reserve: 2006 Ferrari F430 Challenge Race Car

1968 Mercury Cougar XR-7 7.0-Liter GT-E

24k-Mile 2008 Ferrari 599 GTB Fiorano

4,500-Mile 2008 Tesla Roadster Signature 100 Edition

No Reserve: 429-Powered 1966 Ford Mustang Fastback 6-Speed

Coyote-Powered 1974 Ford Bronco

29k-Mile 1996 Porsche 911 Carrera Coupe 6-Speed

No Reserve: 1957 Continental Mark ll

23k-Mile 1996 Ferrari F355 Spider 6-Speed

No Reserve: 1983 Ferrari Mondial Quattrovalvole Coupe

1971 Porsche 914-6

1968 Triumph TR250	1992 Mercedes-Benz 250GD Wolf 5-Speed	Modified 1972 BMW 2002 5-Speed
1996 Lotus Elise S1	2020 McLaren GT	1993 Toyota Celica GT 5-Speed
3,100-Mile 2019 Karma Revero	1991 BMW M5	14k-Mile 2007 Mercedes-Benz SL55 AMG
2021 Mercedes-Benz Sprinter 3500XD Mobile Office Van	Porsche 914–Powered Dirtrix DT2 Off-Road Race Car	2006 Jaguar Super V8 Portfolio
No Reserve: 2002 Porsche 911 Turbo Coupe 6-Speed	1968 Jaguar XKE Series 1.5 Roadster	1968 Ford Galaxie 500 Fastback Hardtop
29k-Mile 2012 Mercedes-Benz SLS AMG Roadster	2007 Porsche 911 Targa 4	LS2-Powered 1967 Chevrolet Camaro Coupe
Modified 2012 Cadillac CTS-V Coupe 6-Speed	2006 Mini Cooper S JCW 6-Speed	34k-Mile 2008 Toyota Land Cruiser URJ200
9k-Mile 2016 Mercedes-AMG GT S Edition 1	No Reserve: Single-Family-Owned 1987 Volvo 240 DL Sedan	6k-Mile 2019 Ford Mustang Shelby GT350R
1963 Chevrolet Corvette Convertible 327/300 4-Speed	No Reserve: 9k-Mile 2006 Volkswagen New Beetle 5-Speed	No Reserve: Modified 1977 BMW R100/7
2003 Porsche 911 Carrera 4S Coupe 6-Speed	Modified 2006 Ford E-350 Super Duty Power Stroke 4×4	No Reserve: 1979 Ford Bronco 4x4 4-Speed
No Reserve: 2001 Honda CBR1100XX Super Blackbird	No Reserve: 1995 Toyota 4Runner SR5 4WD 5-Speed	No Reserve: 1963 Chevrolet Impala Sport Coupe
1979 Porsche 911SC Targa	33k-Mile 2012 Audi A8L W12	1951 Ariel Square Four
49k-Mile 2013 Jaguar XKR Convertible	2020 BMW M8 Competition Coupe	1974 Land Rover Range Rover 2-Door 4-Speed
No Reserve: 550 Spyder Replica by Automotive Legends	1968 Harley-Davidson XLCH Sportster	2018 Alfa Romeo Giulia Quadrifoglio
No Reserve: 1973 Cadillac Eldorado Convertible	1964 Studebaker Avanti R1	No Reserve: 1971 Porsche 914 Project
No Reserve: 2000 Mercedes-Benz E430 Sedan	No Reserve: 15x7" Fuchs Wheels for Porsche	1969 Buick Electra 225 Custom Convertible
4,300-Mile 2015 Chevrolet Corvette Z06 Convertible 3LZ Z07 7-Speed	1954 Allgaier A133 Porsche-Diesel Tractor	No Reserve: 19k-Mile 2007 Chrysler Crossfire Roadster
1963 Buick Wildcat Convertible	No Reserve: 2011 BMW 335i xDrive Sedan M Sport 6-Speed	No Reserve: Porsche 911 Carrera RS Owner's Manual and Literature Collection
1990 Ford Bronco Eddie Bauer	One-Owner 1997 Toyota Land Cruiser FZJ80 Collector's Edition	1970 Ford Mustang Mach 1
Subaru-Powered 1986 Volkswagen Vanagon Westfalia	35k-Mile 2003 Mercedes-Benz SL500	44k-Mile 2008 Mercedes-Benz E350 4MATIC Sport Sedan
Original-Owner 2006 BMW Z4 M Roadster	32k-Mile 2005 Lotus Elise	No Reserve: 29k-Mile 1998 Mercedes-Benz SL500
No Reserve: Illuminated Moto Guzzi Sign	No Reserve: 2015 Audi Q7 Prestige S-Line	43k-Mile 1997 Jaguar XK8 Coupe
1964 Chevrolet Corvair Monza Spyder Convertible 4-Speed	1975 Ford Bronco 302	1983 Porsche 944 5-Speed
1991 Jeep Grand Wagoneer	No Reserve: 2008 BMW M3 Coupe 6-Speed	No Reserve: 1973 Suzuki GT185 Adventurer
11k-Mile 2003 Ford Mustang GT Coupe 5-Speed	No Reserve: 23k-Mile 1999 Mercedes-Benz SLK230 Kompressor	1947 Norton Model 18
No Reserve: Whale-Tail Spoiler and Decklid for Porsche 911	1996 Chevrolet Impala SS	No Reserve: 17x9.5" BBS RS 178 Wheels for C4 Corvette
No Reserve: 1968 BSA 650 Lightning	No Reserve: 17x8.5" and 17x10" AMG Aero III Wheels by OZ Racing for Mercedes-Benz	No Reserve: 1993 Porsche 968 Coupe 6-Speed
No Reserve: Mobil Pegasus Sign	34k-Mile 2002 Mazda MX-5 Miata Special Edition	13k-Mile 1988 Jaguar XJ-S Hess & Eisenhardt Convertible V12
No Reserve: 33k-Mile 2013 BMW 750i M Sport	No Reserve: 1981 Toyota Land Cruiser FJ40	2005 Ford Excursion XLT Power Stroke 4x4
No Reserve: 33k-Mile 2006 BMW 325Ci Convertible	No Reserve: 1991 Honda CRX 1.6i-16 5-Speed	No Reserve: 2010 Land Rover Range Rover Sport HSE
No Reserve: 2008 Maserati Quattroporte	No Reserve: 1984 Ford F-250 Standard SuperCab 4-Speed	1959 Triumph TR3A
1970 Fiat 500L	2008 Porsche Cayenne Turbo	No Reserve: 1983 BMW 528e 5-Speed
2009 Ford Mustang Shelby GT500 Convertible	No Reserve: Volkswagen-Powered Dune Buggy	1989 Mercedes-Benz 560SL
1977 Triumph Spitfire 1500	No Reserve: 2002 Lexus LX470	No Reserve: 1970 Mercedes-Benz 250C 4-Speed
Ibis White 2007 Audi RS4

110 new auctions now open:

2021 Aston Martin DBS Superleggera 007 Edition

27k-Mile Supercharged 2000 BMW M Coupe

Ex–12 Hours of Sebring 1962 Sunbeam Alpine Factory Race Car

1-Mile 2000 Honda RVT1000R RC51

18k-Mile 1990 Chevrolet 454 SS Pickup

2,500-Mile 2003 Lotus Esprit V8

1993 Porsche 911 Carrera 2 Coupe 5-Speed

No Reserve: 1991 Acura NSX 5-Speed

20k-Mile 2006 Lamborghini Gallardo

Euro 1978 Porsche 930 Turbo

No Reserve: 1964 Porsche 356C Coupe Project

1957 Jaguar XK140 MC Roadster	No Reserve: 1953 Mercedes-Benz 170Sb Project	1966 Chevrolet Corvette Convertible 427/390 4-Speed
302-Powered 1974 TVR 2500M 5-Speed	No Reserve: 300-Piece Porsche and Mercedes-Benz Scale-Model Car Collection	2019 Audi RS5 Sportback Panther Edition
No Reserve: 1975 Ford F-250 Highboy 4×4 4-Speed	9k-Mile 1994 Dodge Ram 3500 Laramie SLT Cummins Dually 5-Speed	502-Powered 1969 Chevrolet Chevelle Malibu Sport Coupe 5-Speed
1959 MG MGA Roadster	No Reserve: 1978 Kawasaki KV75	1982 Datsun 280ZX 5-Speed
1986 Ferrari 328 GTS	1966 Buick Skylark Gran Sport Coupe 4-Speed	Original-Owner 1973 Pontiac LeMans Sport Coupe
2008 Mercedes-Benz G500	383-Powered 1969 Chevrolet Camaro Convertible	2014 Audi RS5
View 81 more auctions now open…

Comment of the day:

"Another historical picture of the true one owner of this bike, dad. Hopefully he's watching and enjoying this BaT auction. Hard to believe that during Dec 94 he strolled in to Munroe Motors, put $200 deposit down, and 2 months later picked up a 916. Thank you to all of the experts who have chimed in and made my job easy and fun. Happy bidding."

12RonnieC commented on 595-Mile 1995 Ducati 916

118 auctions closed yesterday:

No Reserve: 7k-Mile 2009 Mercedes-Benz SL65 AMG Black Series		Sold for $341,000
1969 Chevrolet Camaro Z/28 4-Speed		Sold for $152,500
1994 Porsche 911 Carrera 2 Coupe 5-Speed		Sold for $123,000
2022 Lucid Air Grand Touring		Sold for $100,000
642-Mile 2020 Ford Mustang Shelby GT350R		Sold for $96,000
2014 Porsche 911 Turbo S Coupe		Sold for $94,997
1982 Toyota Land Cruiser FJ43 5-Speed		Sold for $82,000
1967 Chevrolet Corvette Coupe 327 4-Speed		Sold for $77,000
2022 Land Rover Defender 90 X-Dynamic S		Sold for $71,500
No Reserve: Twin-Turbocharged 2015 Chevrolet Camaro Z/28		Sold for $69,690
View 108 more completed auctions…