Exploit Collector
CVE-2021-27850_POC - A Proof Of Concept For CVE-2021-27850 Affecting Apache Tapestry And Leading To Unauthencticated Remote Code Execution

CVE-2021-27850 is a critical unauthenticated remote code execution vulnerability that was found in all recent versions of Apache Tapestry, by downloading the AppModule.class file we can leak the HMAC Secret key used to sign all the serialized objects in apache Tapestry.

We encountered this CVE in a real life assessment and as far as I know there are no public exploits available on how Tapestry signs the serialized objects so we decided to publish the following POC that we have used after digging in apache Tapestry source code for a long time x) .

Kudos to my senpai Fares

Usage

1- Clone this repo

2- Run the following command

javac -classpath commons-codec-1.15/commons-codec-1.15.jar:. Exploit.java

3- Finally run the following:

java -cp commons-codec-1.15/commons-codec-1.15.jar:. Exploit [Tapestry Key] [Ysoserial Payload] [Command To Execute]

Where [Tapestry Key] is the Hmac key leaked from the AppModule.class , [Ysoserial Payload] is the payload you want to use from ysoserial and [Command To Execute] the command you want to execute.

http://3.bp.blogspot.com/-oT248hEmxFM/YORrwT4fnII/AAAAAAAAhI4/9vcZt2QOJRIVD3QS0OlL6azyCHQtVGauACK4BGAYYCw/w640-h52/CVE-2021-27850_POC_1-724289.png

Note: Unlike the usual Java deserialization exploits where the commands you run are limited ( no pipes or special chars .. ) you can use here any complex command you want since we are appending the following before executing the command sh -c $@|sh . echo.

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-27850

https://github.com/apache/tapestry-5
Download CVE-2021-27850_POC

Leveraging Burp Suite extension for finding HTTP request smuggling.
https://infosecwriteups.com/leveraging-burp-suite-extension-for-finding-http-request-smuggling-2c0b5321f06d?source=rss------bug_bounty-5

HTTP Request Smuggling is often left behind in bug bounty findings.Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/leveraging-burp-suite-extension-for-finding-http-request-smuggling-2c0b5321f06d?source=rss------bug_bounty-5)

Hacking on Medium
Bastion-HTB-Writeup

https://cdn-images-1.medium.com/max/600/1*VbDQIFrXjU7FfNpy6WL83A.png
Today I am solving the machine called Bastion on HTB platform let’s start with scanning

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

Hacking on Medium
CyberTalent — Exploiting MS17_010(Eternal Blue) on a Remote Server(Mature Blue Lab)

https://cdn-images-1.medium.com/max/1200/1*gruWm7TwnL-qT3Psk7HtPg.png
Mature Blue is a machine on cyber talent that is rated as a difficult machine. It presents a Microsoft vulnerability (CVE-2017–0143)…

Continue reading on InfoSec Write-ups »
➖ Sent by @TheFeedReaderBot ➖

Arm or x86 ???
https://www.reddit.com/r/Pentesting/comments/ofbw03/arm_or_x86/

<!-- SC_OFF -->Guys, please be patient and read this dilemma of mine. I started my pentest journey about 2 months ago and my main system was 2017 MBA. Having an i5 and 8 gigs memory was not bad as I was able to ran multiple VMs simultaneously (giving a gig or less ram to each VMs). But as the journey continues, my mac was also getting old and was not able to cope with the increasing demand for the lab setup. So, it's time for me to buy a new machine. Now, my requirements are: *A bigger display, as 13" is definitely not enough. *At least 16gigs of memory. *A processor better than i9 10th gen. Seeing all this i came to two machines, one is Asus rog g17 with Ryzen 5900hx and second one is M1 iMac. Now, M1 is arm based but, the performance is really better that i9 10th gen and even beats the i9 11th gen in single core performance. It is debatable in multi core performance as the wattage which M1 uses is way lower than that of i9 11th gen. So, I find M1 iMac to be the perfect choice and offering overall the best value for money. It's having 24" 4.5k retina display (100%P3 - great clarity in reading small texts), 16gigs memory (skhynix LPDDR4X 4200MHz), very power efficient processor, offering surprisingly great performance. Also kali and Ubuntu have released native support for M1 with kernel v5.13. So, it's great to dual boot also. But..but..but, I didn't talked about the ROG. So, rog is offering 16gigs of ram with Ryzen 9 5900hx processor which is faster than i9 10th gen but not from 11th gen i9. Also am getting RTX3070 8 gb graphics memory. Display is FHD 17". This is not a bad machine and also price point is good. But in terms of what Apple iMac is offering, it doesn't meets that level. Also, am not really into gaming so having an RTX (which am also paying the price included ) is not really useful to me. Now I know you guys are thinking about password cracking stuff and all. The point is, I have to know the commands for how to crack passwords, am not going to actually sit 20 minutes to crack the password. I just have to practice it so for that I can make my own list and practice on that. Also am horrible with windows os. Now, by here am very confident that I will go with iMac but the architecture difference is holding me up. I was thinking, if I will create windows labs in M1 then it will be arm based so, does the vulnerability/exploit discovered for x86 will work on the arm based lab also ??? This thought horrified me and I was thinking "no way, I have to buy ROG now." Please anyone, help me out here. I can buy the iMac with student discount and also being a middle class family I can't really buy both to mitigate this confusion. Thanks! <!-- SC_ON --> submitted by /u/Shang_the_Monk (https://www.reddit.com/user/Shang_the_Monk)
[link] (https://www.reddit.com/r/Pentesting/comments/ofbw03/arm_or_x86/) [comments] (https://www.reddit.com/r/Pentesting/comments/ofbw03/arm_or_x86/)

hacking: security in practice
Do I know networks enough?

Hi I'm a 14-year-old who want to get into ethical hacking but wherever I go they tell me to learn some networks heck some say get a networks certification and while I'm getting the network+ I just wanna know how much?

how much do I gotta know of networks to start actual ethical hacking and not being a skiddie? to what extent do I gotta know of networks to start actually learning ethical hacking?

I just want to be an ethical hacker not a networks engineer.

submitted by /u/Fandeeno207
[link] [comments]

Broken Link Hijacking.

How I accidently Found a Bug called Broken Link Hijacking.Continue reading on Medium »
Read more...

Leveraging Burp Suite extension for finding HTTP Request Smuggling.

HTTP Request Smuggling is often left behind in bug bounty findings.Continue reading on InfoSec Write-ups »
Read more...

Quick Guide to Web Penetration Testing
https://corneacristian.medium.com/quick-guide-to-web-penetration-testing-546c6196c909?source=rss------bug_bounty-5

Through this article, we will discuss some tests and guidelines that are part of my Web Penetration Testing methodology.Continue reading on Medium » (https://corneacristian.medium.com/quick-guide-to-web-penetration-testing-546c6196c909?source=rss------bug_bounty-5)

Hacking on Medium
Launch your CyberSec career with TryHackMe !

https://cdn-images-1.medium.com/max/824/1*1xQIcXZHHUFPXCi2sCkjfA.png
TryHackMe recently released a new learning path named ‘Pre-Security’, which aims at encapsulating fundamental concepts essential for a…

Continue reading on Medium »