Hacking on Medium
TryHackMe write-up: Anonymous

https://cdn-images-1.medium.com/max/640/0*EEisfy6ZGqLGgoPE.png
Introduction

Continue reading on Medium »

Black Hat Ethical Hacking
Bugs in NVIDIA’s Jetson Chipset Opens Door to DoS Attacks, Data Theft

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Bugs in NVIDIA’s Jetson Chipset Opens Door to DoS Attacks, Data TheftPost Views: 65
Reading Time: 1 Minute
Flaws impacting millions of internet of things (IoT) devices running NVIDIA’s Jetson chips open the door for a variety of hacks, including denial-of-service (DoS) attacks or the siphoning of data.
NVIDIA released patches addressing nine high-severity vulnerabilities including eight additional bugs of less severity. The patches fix a wide swath of NVIDIA’s chipsets typically used for embedded computing systems, machine-learning applications and autonomous devices such as robots and drones.

Impacted products include Jetson chipset series; AGX Xavier, Xavier NX/TX1, Jetson TX2 (including Jetson TX2 NX), and Jetson Nano devices (including Jetson Nano 2GB) found in the NVIDIA JetPack software developers kit. The patches were delivered as part of NVIDIA’s June security bulletin, released Friday. Most Important PatchThe most severe bug, tracked as CVE‑2021‑34372, opens the Jetson framework to a buffer-overflow attack by an adversary. According to the NVIDIA security bulletin, the attacker would need network access to a system to carry out an attack, but the company warned the vulnerability is not complex to exploit and that an adversary with little to low access rights could launch it. It added that an attack could give an adversary persistent access to components – other than the NVIDIA chipset targeted – and allow a hacker to manipulate and or sabotage a targeted system.

“[The Jetson] driver contains a vulnerability in the NVIDIA OTE protocol message parsing code where an integer overflow in a malloc() size calculation leads to a buffer overflow on the heap, which might result in information disclosure, escalation of privileges and denial of service (DoS),” according to the security bulletin, posted on Friday.

Oblivious transfer extensions (OTE) are low-level cryptographic algorithms used by Jetson chipsets to process private-set-intersection protocols used to secure data as the chip processes data.
See Also: New iPhone Bug Breaks Your WiFi: Here’s The Fix High-Severity RoundupOther high-severity bugs patched by NVIDIA include vulnerabilities with severity ratings of between 7.9 and 7, which include CVE‑2021‑34373, CVE‑2021‑34374, CVE‑2021‑34375, CVE‑2021‑34376,  CVE‑2021‑34377, CVE‑2021‑34378, CVE‑2021‑34379 and CVE‑2021‑34380. Six of the bugs, if exploited, could allow a local attacker to trigger a DoS attack.

One of the bugs (CVE‑2021‑34373), with a 7.9 severity rating, impacts Jetson’s trusted Linux kernel and opens the door to a heap-based buffer overflow attack. This type attack is directed at the chip’s heap data memory framework, where the component is manipulated to generate errors.

“Trusty trusted Linux kernel (TLK) contains a vulnerability in the NVIDIA TLK kernel where a lack of heap hardening could cause heap overflows, which might lead to information disclosure and denial of service,” NVIDIA wrote.
See Also: Offensive Security Tool: CloudFail Besides firmware, the chipmaker issued patches (CVE‑2021‑34372 through CVE‑2021‑34397) to address endpoint software for Jetson TX1, TX2 series, TX2 NX, AGX Xavier series, Xavier NX, Nano and Nano 2GB. For those bugs, NVIDIA credited bug hunter Frédéric Perriot of the Apple Media Products RedTeam for reporting the issues.

“[Updates address] security issues that may lead to escalation of privileges, denial of service and information disclosure. To pr[...]

otect your system, download and install the latest Debian packages from the APT repositories,” NVIDIA wrote. See Also: Jeff Moss, aka Dark Tangent, the person who founded DEF CON and Black Hat Source: threatpost.com (Click Link)Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/14.4.2-90x90.png New iPhone Bug Breaks Your WiFi: Here’s The Fix23 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/cisco-patch-90x90.png Cisco Smart Switches Riddled with Severe Security Holes4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-5-90x90.png Millions of Connected Cameras Open to Eavesdropping5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/ezgif-6-446db01f6f32-90x90.jpg Apple Hurries Patches for Safari Bugs Under Active Attack6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Microsoft-Teams-e1623702241390-90x90.png Microsoft Teams: Very Bad Tabs Could Have Led to BEC1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/FIFA-21-90x90.jpg Hackers Steal FIFA 21 Source Code, Tools in EA Breach1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-3-90x90.png Chrome Browser Bug Under Active Attack – Update your chrome now2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-2-1-90x90.png Intel Plugs 29 Holes in CPUs, Bluetooth, Security2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/vtornik-patchej-Microsoft-90x90.jpg Microsoft Patch Tuesday Fixes 6 In-The-Wild Exploits, 50 Flaws2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/06/Untitled-design-1-1-90x90.png RockYou2021: largest password compilation of all time leaked online – 8.4 billion entries2 weeks ago
The post Bugs in NVIDIA’s Jetson Chipset Opens Door to DoS Attacks, Data Theft first appeared on Black Hat Ethical Hacking.

Finding Vulnerabilities
https://www.reddit.com/r/Pentesting/comments/o5l5il/finding_vulnerabilities/

<!-- SC_OFF -->Hi, I have some queries. If we want to check or find websites having vulnerabilities ,do we have to try every website one by one and try exploit vulnerabilities method (for eg. Php shell upload) on each? Or there are specific tools to find vulnerability. Suppose if I found 700 subdomains for a website ,So do I need to do as I said above (one by one for every subdomain.? For eg. If I am trying php shell upload to a website but I am not able to see the file location address . So does it mean the website is not vulnerable to a php shell upload attack.? <!-- SC_ON --> submitted by /u/Arav_b (https://www.reddit.com/user/Arav_b)
[link] (https://www.reddit.com/r/Pentesting/comments/o5l5il/finding_vulnerabilities/) [comments] (https://www.reddit.com/r/Pentesting/comments/o5l5il/finding_vulnerabilities/)

Swift-Attack - Unit Tests For Blue Teams To Aid With Building Detections For Some Common macOS Post Exploitation Methods
http://www.kitploit.com/2021/06/swift-attack-unit-tests-for-blue-teams.html

Unit tests for blue teams (https://www.kitploit.com/search/label/Blue%20Teams) to aid with building detections for some common macOS post exploitation (https://www.kitploit.com/search/label/Post%20Exploitation) methods. I have included some post exploitation (https://www.kitploit.com/search/label/Exploitation) examples using both command line (https://www.kitploit.com/search/label/Command%20Line) history (https://www.kitploit.com/search/label/History) and on disk binaries (which should be easier for detection) as well as post exploitation examples using API calls only (which will be more difficult for detection). The post exploitation examples included here are not all encompassing. Instead these are just some common examples that I thought w ould be useful to conduct unit tests around. I plan to continue to add to this project over time with additional unit tests. All of these tests run locally and return results to stdout (i.e., Swift-Attack does not connect to a server).
Steps:
git clone https://github.com/cedowens/Swift-Attack Ensure you have installed swift and developer tools (can install from the mac app store) open the xcodeproj file in XCode Build in XCode The compiled app will be dropped to something like: Users//Library/Developer/Xcode/DerivedData/Swift-Attack-[random]/Build/Products/Debug/Swift-Attack.app cd to the directory above cd Swift-Attack.app/Contents/MacOS (you can run the macho from here or copy it elsewhere and run...up to you) grant the Swift-Attack macho full disk access to ensure you can run all of the tests without TCC issues run the following to remove any quarantine attributes: xattr -c Swift-Attack Run Swift-Attack: ./Swift-Attack -h

Usage:
You can run Swift-Attack with a single option or multiple options ./Swift-Attack [option1] [option2]... I also included a simple macro.txt file (unobfuscated) for testing parent-child relationships around office macro executions on macOS. I did not obfuscate it since the focus is on parent-child relationship visibility/detection. If you want to test with an obfuscated macro, I have a repo at github.com/cedowens/MacC2 that contains an obfuscated macro. I also did not include any persistence items, since in my opinion it is best to just clone and test persistence using Leo Pitt's persistent JXA repo https://github.com/D00MFist/PersistentJXA. This repo is by far the most comprehensive and current repo that I know of for macOS persistence. I recently ported some of the PersistentJXA repos over to Swift: https://github.com/cedowens/Persistent-Swift
Unit Tests Included:
Prompt using osascript binary Prompt via API calls Clipboard dump using osascript binary Clipboard dump using API calls Screenshot using screencapture binary Screenshot using API calls Shell commands Dumping zsh history Security tool enumeration Grabbing system info using osascript binary Grabbing system info via API calls Dumping ssh, aws, gcp, and azure keys on disk Dumping browser history (Chrome, Safari, Firefox) Dumping Quarantine history Office Macro: I included a simple office macro that connects to local host. Note: the macro will invoke curl to make a GET request using python to http://127.0.0.1/testing when executed by clicking the "Enable Macros" button. This will allow you to test detections for parent-child relationships around macro execution. Note: this simple test does not include any obfuscation, since the test is really more geared towards parent-child relationships. You can use another repo of mine at https://github.com/cedowens/MacC2 to test with obfuscated macros. To use, just simply paste the contents of "macro.txt" into an office Doc, save as a macro enabled document or as 97-2004 document format (ex: .doc, .xls, etc.), and click "Enable Macros" when opening the doc to execute. Installer Package: I included TestInstaller.pkg file to test for detections around a basic installer package. This installer package includes a preinstall script which runs in bash and drops com.simple.agent.plist to /Library/LaunchDaemons/ and drops test.js (simple popup prompt) to /Library/Application Support/. The com.simple.agent.plist file simply runs osascript against /Library/Application Support/test.js. It also includes a postinstall script which runs in bash and loads the com.simple.agent.plis using launchctl load. While holding the Control button click Open on TestInstaller.pkg to run it. TestInstaller.pkg will drop the aforementioned files as root. CVE-2021-30657 Bypass Payloads: Two sample payloads (both make curl requests to localhost when detonated) to test two different types of payloads that abuse cve-2021-30657. More info here: https://cedowens.medium.com/macos-gatekeeper-bypass-2021-edition-5256a2955508

Download Swift-Attack (https://github.com/cedowens/Swift-Attack)

hacking: security in practice
finding someone's IP through twitter

want to send a homophobe his home address so he'll shut the fuck up, how do I go about this?

submitted by /u/Jackity_Flackity
[link] [comments]

hacking: security in practice
Advice

Hacker is obsessed with me I believe he has access to all my accounts and somehow is hacked into my phone. How do I protect myself. He’s very smart

submitted by /u/Imaginary-Purpose170
[link] [comments]

Install Go Lang on Ubuntu Server
https://medium.com/@sherlock297/install-go-lang-on-ubuntu-server-5c183d8fd791?source=rss------bug_bounty-5

▶ Visit : https://golang.org/dl/ 
▶ Download : wget https://golang.org/dl/go1.16.5.linux-amd64.tar.gz
▶ Extract : rm -rf /usr/local/go &&…Continue reading on Medium » (https://medium.com/@sherlock297/install-go-lang-on-ubuntu-server-5c183d8fd791?source=rss------bug_bounty-5)

Dark Reading: Attacks/Breaches
Does Your Cyberattack Plan Include a Crisis Communications Strategy? 5 Tips to Get Started

Don't overlook crisis communications in your cybersecurity incident response planning.

Kali Linux Tutorials
TotP-SSH-Fluxer : Take Security By Obscurity To The Next Level

Totp-Ssh-Fluxer will take Security By Obscurity To The Next Level. Some people change their SSH port on their servers so that it is slightly harder to find for bots or other nasties, and while that is generally viewed as an action of security through obscurity it does work very well at killing a lot of the automated […]

The post TotP-SSH-Fluxer : Take Security By Obscurity To The Next Level appeared first on Kali Linux Tutorials.

Kali Linux Tutorials
Krane : Kubernetes RBAC Static Analysis And Visualisation Tool

Krane is a simple Kubernetes RBAC static analysis tool. It identifies potential security risks in K8s RBAC design and makes suggestions on how to mitigate them. Krane dashboard presents current RBAC security posture and lets you navigate through its definition. Features RBAC Risk rules – Krane evaluates a set of built-in RBAC risk rules. These can be modified or extended with […]

The post Krane : Kubernetes RBAC Static Analysis And Visualisation Tool appeared first on Kali Linux Tutorials.