Cybersecurity Q&A
Browse concise answers derived from our published, source-linked cybersecurity coverage.
What are the advantages of using Boolang for shellcode execution compared to traditional methods?
The main advantages include: no need for compiled binaries with malicious imports, dynamic compilation in memory to evade static analysis, and the ability to separate the payload script from the launcher. The launcher (e.g., a PowerShell script) appears benign, while the actual shellcode is loaded from another file. This technique, explored in the article [Exploitation Analysis of Executing Shellcode via Boolang Language](/news/exploitation-analysis-of-executing-shellcode-via-boolang-language), reduces the chance of detection by antivirus and EDR solutions.
How does the Boolang-based shellcode execution technique work in practice?
The technique uses a C# or PowerShell wrapper that loads the Boolang compiler DLLs via reflection. The Boolang script contains shellcode and injection functions (e.g., QueueUserAPC, CreateThread). At runtime, the wrapper compiles the script in memory and invokes the injection method, such as injecting into explorer.exe. This approach avoids dropping executables and can be launched from a single PowerShell script, as shown in the [BooLang exploit analysis](/news/exploitation-analysis-of-executing-shellcode-via-boolang-language).
What is the Boolang language and why is it useful for executing shellcode?
Boolang is an object-oriented language that combines Python's syntax with C#'s speed and security, running on the .NET Framework. It is useful for executing shellcode because it allows dynamic compilation of scripts in memory, enabling attackers to load and execute malicious payloads without writing traditional malicious files. This technique, detailed in the [Exploitation Analysis of Executing Shellcode via Boolang Language](/news/exploitation-analysis-of-executing-shellcode-via-boolang-language), leverages the .NET DLR to bypass signature-based defenses.
What is the significance of obtaining PPTP passwords in penetration testing?
Acquiring a user's PPTP password allows an attacker to remotely dial into the corporate intranet, enabling further infiltration and lateral movement. This technique is a key step in network penetration, as described in [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords). Once inside, attackers can combine this with other methods like [Domain Penetration - Remote Execution via Scheduled Tasks in GPO](/news/domain-penetration-remote-execution-via-scheduled-tasks-in-gpo-command-line-implementation-principles-and-script-details) to execute commands remotely.
How can I brute-force PPTP passwords? What tools are available?
Two approaches are mentioned: using `thc-pptp-bruter` (available in Kali) for dictionary attacks, or writing a Python script that calls `pptpsetup` and checks for a `ppp0` interface after a 10-second wait to determine success. The Python method handles cases where `thc-pptp-bruter` fails. Both techniques are explained with code in [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords).
What are the steps to connect to a PPTP VPN on Kali Linux?
Kali Linux supports two methods: via GUI (install `network-manager-pptp` and configure VPN settings, ensuring to remove PAP/CHAP/EAP and enable MPPE) or via command line using `pptpsetup --create vpn --server <IP> --username <user> --password <pass> --encrypt --start`. After connecting, adjust the routing table with `route add default gw <remote-ip>`. For full details, refer to the Kali section in [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords).
How can I export PPTP configuration and password from a Windows system during penetration testing?
You can obtain PPTP configuration from `%APPDATA%\Microsoft\Network\Connections\Pbk\rasphone.pbk` and extract the password using [mimikatz](https://github.com/gentilkiwi/mimikatz) with the command `privilege::debug token::elevate lsadump::secrets`. This technique is covered in detail in the article [Penetration Techniques - Acquisition and Brute-Force of PPTP Passwords](/news/penetration-techniques-acquisition-and-brute-force-of-pptp-passwords). Mimikatz is also commonly used for other privilege escalation attacks, such as those described in [Penetration Techniques - Exploitation of Nine Windows Privileges](/news/penetration-techniques-exploitation-of-nine-windows-privileges).
How can you detect and defend against BHO-based attacks?
Detection involves checking IE's add-ons under Tools > Manage Add-ons and examining the DLLs loaded by the IE process. Defense relies on preventing the initial compromise that grants administrator privileges, as BHO exploitation requires admin rights to register the component. The article provides testing and defense insights: [Implementing IE Browser Hijacking Using BHO](/news/implementing-ie-browser-hijacking-using-bho).
What are some exploitation techniques using BHO after gaining system administrator privileges?
Once administrator privileges are obtained, attackers can forge Microsoft Authenticode signatures to make the BHO appear verified, or capture browser POST data (such as plaintext passwords) by handling the `BeforeNavigate2` event. They can also download files through IE's context to bypass firewalls, and inject JavaScript into IE pages. These techniques leverage the BHO's access to browser internals. For code examples, refer to the article: [Implementing IE Browser Hijacking Using BHO](/news/implementing-ie-browser-hijacking-using-bho).
How do you register a BHO DLL in Windows, and where is it stored in the registry?
To register a BHO, you use the command `regsvr32 helloworld.dll /s` with administrator privileges. This writes the BHO's CLSID to the registry under `HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{GUID}` and `HKEY_CLASSES_ROOT\CLSID\{GUID}`. Unregistration is done with `regsvr32 helloworld.dll /s /u` or by deleting the registry keys. See the original article for the full development process: [Implementing IE Browser Hijacking Using BHO](/news/implementing-ie-browser-hijacking-using-bho).
What is a Browser Helper Object (BHO) and how does it work in Internet Explorer?
A BHO is a Microsoft standard that allows third-party developers to interact with Internet Explorer. It runs in the same process and lifecycle as the browser, meaning it starts and ends with the browser page. BHOs can capture and control browser behaviors like navigation events. For more details on BHO implementation, refer to [Implementing IE Browser Hijacking Using BHO](/news/implementing-ie-browser-hijacking-using-bho).
What are the typical steps to extract the NTDS.dit file from a domain controller using built-in vssadmin?
First, create a snapshot of the system drive with `vssadmin create shadow /for=c:`, which returns a Shadow Copy Volume Name like `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12`. Then copy the NTDS.dit file using `copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\windows\NTDS\ntds.dit c:\ntds.dit`. Finally, clean up by deleting the snapshot with `vssadmin delete shadows /for=c: /quiet`. This method is simple and uses tools already present on Windows Server. For a comprehensive overview of all methods, refer to [Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers](/news/domain-penetration-obtaining-the-ntds-dit-file-from-domain-controller-servers).
How can vshadow.exe be abused for both persistence and evasion in a penetration test?
`vshadow.exe` from the Windows SDK carries a Microsoft signature, allowing it to bypass some application whitelisting controls. It can be used to execute arbitrary commands (e.g., `vshadow -nw -exec=notepad.exe c:`) within a snapshot context, leaving VSSVC.exe running as a background process. This can be leveraged for persistence by setting it as a startup item, and it does not appear in Autoruns' default startup list, making it harder to detect. The full exploitation approach is detailed in [Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers](/news/domain-penetration-obtaining-the-ntds-dit-file-from-domain-controller-servers) and related resources.
What advantage does NinjaCopy offer over Volume Shadow Copy methods when extracting the NTDS.dit file, especially regarding log generation?
NinjaCopy, part of the PowerSploit framework, does not rely on the Volume Shadow Copy Service (VSS), so it avoids generating Event ID 7036 logs that VSS operations typically produce. This makes it a stealthier option for extracting the NTDS.dit file during domain penetration. However, note that NinjaCopy requires administrative privileges and may be detected by advanced security solutions. More on stealth techniques can be found in [Penetration Basics - Extracting Credentials from lsass.exe Process](/news/penetration-basics-extracting-credentials-from-lsass-exe-process).
How can you access files inside a Volume Shadow Copy snapshot without mounting it as a drive letter?
You can access snapshot files by using the device path `\\?\GLOBALROOT\Device\HarddiskVolumeShadowCopyXX` directly in `copy` commands, or by creating a symbolic link with `mklink /d c:\testvsc \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy12\`. This allows browsing the snapshot like a normal folder, as demonstrated in the original article. After finishing, delete the link with `rd c:\testvsc`. This technique is often used in [Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers](/news/domain-penetration-obtaining-the-ntds-dit-file-from-domain-controller-servers) to quietly extract the NTDS.dit file.
What are the main built-in Windows tools for obtaining the NTDS.dit file via Volume Shadow Copy, and how do they differ?
The main built-in tools are `ntdsutil` and `vssadmin`, both preinstalled on Windows Server. `ntdsutil` is specific to Active Directory and can create, mount, and manage snapshots of the NTDS database, as detailed in [Domain Penetration - Obtaining the NTDS.dit File from Domain Controller Servers](/news/domain-penetration-obtaining-the-ntds-dit-file-from-domain-controller-servers). `vssadmin` is a general Volume Shadow Copy command-line tool that creates system snapshots. Additionally, `vshadow.exe` from the Windows SDK is not built-in but offers persistent snapshots and can be used for execution bypass. For a broader context on abusing VSS, see [Volume Shadow Copy in Penetration Testing](/news/volume-shadow-copy-in-penetration-testing).
After adding an administrator user via LDAP, how can the new account be used to interact with vCenter?
The newly added administrator user can log in to the vCenter Web management interface directly or be used to authenticate to the vSphere API for programmatic control. This circumvents the need to crack or reuse the original admin password, providing full access to manage virtual machines and other resources. This technique is part of a broader attack chain discussed in the [vSphere Development Guide series](/news/vsphere-development-guide-6-vcenter-saml-certificates).
What LDAP commands are used to add a user, set their password, and assign them to the Administrators group in vCenter?
Use `ldapadd` with an LDIF file containing the user's attributes (e.g., `userPassword`) to create the user. Then use `ldapmodify` with another LDIF file that adds the user's DN as a `member` of `cn=Administrators,cn=Builtin,dc=aaa,dc=bbb`. For example: `ldapadd -f adduser.ldif` followed by `ldapmodify -f addadmin.ldif`. Passwords are set via the `userPassword` attribute, not `nTSecurityDescriptor`.
How do you export LDAP credential information from a vCenter appliance using the Likewise shell?
Run the command `/opt/likewise/bin/lwregshell list_values '[HKEY_THIS_MACHINE\services\vmdir]'` to export the LDAP credential information. This provides the necessary bind DN and password (e.g., `cn=192.168.1.1,ou=Domain Controllers,dc=aaa,dc=bbb` with password `P@ssWord123@@`) needed to connect to the LDAP database. A detailed walkthrough is available in [vSphere Development Guide 5 - LDAP](/news/vsphere-development-guide-5-ldap).
What is the prerequisite for exploiting vCenter's LDAP database to add an administrator user, and how does this method bypass the need for an existing admin password?
The prerequisite is obtaining the administrator user's password, often through previous methods like the [vSphere Automation API](/news/vsphere-development-guide-1-vsphere-automation-api) or PowerCLI. However, once you have the LDAP credentials (exported via `lwregshell`), you can directly connect to the LDAP database and use `ldapadd` to create a new user with administrative privileges, effectively bypassing the need to know the current admin password.