Posts by lkarlslund@infosec.exchange
(DIR) Post #APTTFlY3aZdPzUibeS by lkarlslund@infosec.exchange
2022-11-10T22:19:36Z
0 likes, 0 repeats
@textfiles awesome. Did you mirror Twitter yet?
(DIR) Post #APXbL85emZO9cJLJRY by lkarlslund@infosec.exchange
2022-11-12T22:00:56Z
0 likes, 1 repeats
FTX: Let's vaporize $38BElon: Hold my beer
(DIR) Post #APZkrgYxRAsXhaZBqq by lkarlslund@infosec.exchange
2022-11-13T22:26:05Z
1 likes, 1 repeats
Twitter queen of graphql doesn't take any shit
(DIR) Post #APZkri2lvoK0ILWVxg by lkarlslund@infosec.exchange
2022-11-13T22:40:41Z
0 likes, 0 repeats
What a hero 😍
(DIR) Post #APhQNLRawqCJhI3brk by lkarlslund@infosec.exchange
2022-11-17T15:04:09Z
1 likes, 0 repeats
Today I coded a keylogger and clipboard monitor in Go. Compiled it to obfuscated binary. It took less than an hour, everything included. Running it on a target system (red team exercise) with Defender gave no detections :-) Just because I was curious, I added a check for target domain and an exit if it didn't match to avoid sandboxes, then I tried uploading it to Virus Total - here's how that went:- 12 detections based on it being "suspicious" (heavily obfuscated is my guess)- 59 clean verdicts- absolutely unusable sandbox output: claiming outbound network, drops temp files, Go screenshot ability, and it setting something in the registry ... no to all, the binary does nothing on their systems!Conclusion? IDK, it's not pretty, that's for sure. #malware #virustotal #hacking
(DIR) Post #APis1VWLnIrASAcJaC by lkarlslund@infosec.exchange
2022-11-18T07:30:24Z
0 likes, 0 repeats
Easily transfer files from one computer to another using croc. It uses a broker, so two machines that are both behind NAT also can do it. For security it uses a random phrase to do the initial connect, and PAKE to set up encryption. If you don't trust the public broker, you can just set up your own.Written in Go, so it's available for any major platform you're likely to use, binaries are available and source code too of course.https://github.com/schollz/croc
(DIR) Post #APis1WQMR3exFsp2sy by lkarlslund@infosec.exchange
2022-11-18T07:32:54Z
0 likes, 0 repeats
@r000t It's using TCP so the broker handles all the traffic I think. Using UDP and STUN could possibly make this even more worthwhile. Also it doesn't handle two clients on the same LAN efficiently in my experience. But it *is* still very easy to use.
(DIR) Post #APq0ZcSobvOiUpHzH6 by lkarlslund@infosec.exchange
2022-11-21T11:38:30Z
1 likes, 1 repeats
Don't want to link your fresh install of Windows 11 with a Microsoft account? (VM for test, reinstalled laptop or whatever)Easy peasy! You have two options:# First option: Provide locked Microsoft account (minimum hassle, requires internet)When asked to provide a Microsoft account, use no@thankyou.com and a random password. This account is locked, and Windows will error out, and tell you that.You can then proceed to use any local only account.# Second option: No internet trick (can also be used if you actually *don't* have internet)Make sure there's no ethernet cable in the machine. Install like you'd normally do, right up to the point where it whines about internet connectivity requirement.Press Shift-F10, and you get a command prompt. Enter this command:OOBE\BYPASSNROYour installation will now restart, but at the network requirement part, theres a "I don't have internet" option. Click on that, and you can create a local only user.Both tricks works for the latest Windows 11 22H2 too!#windows11
(DIR) Post #APq2FtwS7NUiotsRXM by lkarlslund@infosec.exchange
2022-11-21T19:22:54Z
1 likes, 0 repeats
@xerz yep, no problem
(DIR) Post #AQC7nr6Rx8d16sgK6i by lkarlslund@infosec.exchange
2022-12-02T11:21:14Z
0 likes, 0 repeats
@stux the flight went great, except for the landing, and it was a ship not a plane
(DIR) Post #AQuCzGa0cTwC2J0Mue by lkarlslund@infosec.exchange
2022-12-23T16:57:36Z
1 likes, 0 repeats
Using my rescued-from-death DesignJet T520 and StableDiffusion, I'm adding quirky ML generated stickers to my presents this year
(DIR) Post #AQuCzI70vFvsmxSEzo by lkarlslund@infosec.exchange
2022-12-23T17:21:29Z
0 likes, 0 repeats
These are the best ones with snowmen on them. They all have personality, and they will go on packages.
(DIR) Post #AQuCzJRxwqHowEGUIC by lkarlslund@infosec.exchange
2022-12-23T17:24:48Z
0 likes, 0 repeats
If you open your door and one of these guys are standing outside, just go back into the house until they're melted away. I especially like the reindeer snowman top left and the murder scene center bottom. Merry Christmas to all snowmen that participated in this experiment.
(DIR) Post #ARkH9m55NzYm0DOWcy by lkarlslund@infosec.exchange
2023-01-17T20:20:46Z
0 likes, 1 repeats
If you think the news about ChatGPT being used to automatically post questions on StackOverflow, and then automatically post wrong answers is bad, just wait until the ChatGPT people start crawling the internet again so they can update the model using all the wrong crap that came out of the earlier model to train the new model.
(DIR) Post #Ack88uNPyBYZxztlFg by lkarlslund@infosec.exchange
2023-12-12T07:58:23Z
2 likes, 4 repeats
I've been tinkering with 8.7 billion passwords the last couple of weeks - and done lots of thinking, coding and debugging too. This resulted in a cool thing that I'm sharing today.Here's the technical background: On the Windows platform your stored passwords are hashed as NTLM, which is basically just a Microsoft way of saying "MD4 sum of the UTF16 encoded password". As this was invented more than 25 years ago, this algorithm is simple.Here's why this matters: When hackers break into your network, both configuration mistakes and weak passwords are in the very top of risks that enable a successful way for bad guys to get control over everything.This is how you can remedy this: When I do Active Directory assessments, some of the time I also do a password audit, to find accounts that use the same password or highly privileged accounts with way too simple passwords. And I don't really care about regular users, but the ones that impact security do matter.This is the challenge: To crack these passwords requires equipment and machine power, as going from an NTLM hash to a password is not something you can do by other means than throwing some GPU power after it. You simply try any password you can imagine, and compare it to the NTLM hash - it takes some time, and you don't get all passwords (complex ones survive these attacks).And here's my solution: There is a faster way - maybe not providing you with exactly the same results - but it trades some of the precision with less time and hardware required. Because NTLM hashing is "unsalted", it means that the password 123456 will have the exact same hash on any system you encounter in the world. So why not just look the most obvious ones up in a database?Now you can, because I coded up a specialized database, grabbed everything I could find from leaks, dictionaries and wordlists on the internet, and compiled it up for you.It's free to use, there is no sign up required - and you can look up 1 password every second (batch look up 1000 in a few seconds every 15 minutes if you're in a hurry). It's even easy to use from command line using curl or PowerShell if you're into that.Have fun, and I hope it can help make the world safer a little step at a time. If you like this, please re-share and spread the word (not the password!)https://ntlm.pw/