Exploit Collector
SonicWall NetExtender 10.2.0.300 Unquoted Service Path

https://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png
SonicWall NetExtender version 10.2.0.300 suffers from an unquoted service path vulnerability.

MD5 | fa624f197df2e6cb5729e670d942f864

Download
# Exploit Title: SonicWall NetExtender 10.2.0.300 - Unquoted Service Path
# Exploit Author: shinnai
# Software Link: https://www.sonicwall.com/products/remote-access/vpn-clients/
# Version: 10.2.0.300
# Tested On: Windows
# CVE: CVE-2020-5147

---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Title: SonicWall NetExtender windows client unquoted service path
vulnerability
Vers.: 10.2.0.300
Down.: https://www.sonicwall.com/products/remote-access/vpn-clients/

Advisory:
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2020-0023
CVE ID: CVE-2020-5147 (https://nvd.nist.gov/vuln/detail/CVE-2020-5147)

URLs:
https://besteffortteam.it/sonicwall-netextender-windows-client-unquoted-service-path-vulnerability/
https://shinnai.altervista.org/exploits/SH-029-20210109.html

Desc.:
SonicWall NetExtender Windows client vulnerable to unquoted service path
vulnerability, this allows a local attacker to gain elevated privileges
in the host operating system.
This vulnerability impact SonicWall NetExtender Windows client version
10.2.300 and earlier.

Poc:

C:\>sc qc sonicwall_client_protection_svc
[SC] QueryServiceConfig OPERAZIONI RIUSCITE
NOME_SERVIZIO: sonicwall_client_protection_svc
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 1 NORMAL
NOME_PERCORSO_BINARIO : C:\Program Files\SonicWall\Client
Protection Service\SonicWallClientProtectionService.exe <--
Service Path Vulnerability
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : SonicWall Client Protection Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem
C:\>

----------------------------------------------------------------------------------------------------------------------------------------------------------------------

C:\>wmic service get name,displayname,pathname,startmode |findstr /i
"auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
SonicWall Client Protection Service
sonicwall_client_protection_svc C:\Program Files\SonicWall\Client
Protection Service\SonicWallClientProtectionService.exe Auto

C:\>
----------------------------------------------------------------------------------------------------------------------------------------------------------------------


Source:packetstormsecurity.com

Exploit Collector
TOR Virtual Network Tunneling Tool 0.4.6.7

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members. They can also use it to connect to resources such as news sites or instant messaging services that are blocked by their local Internet service providers (ISPs). This is the source code release.

MD5 | ff80309cfaa0719b197fdaf83f9d5443

Download
Source:packetstormsecurity.com

Hacking on Medium
Pentesting an API for Fun and Learning

https://cdn-images-1.medium.com/max/1450/1*ZiTLsR9WlXUHhUgbb4hfEg@2x.png
Want to learn API pentesting? This post will answer most of the questions you have been craving for and give great tips on API pentesting!

Continue reading on Medium »

Hacking on Medium
TryHackMe Write-up: Boiler CTF.

https://cdn-images-1.medium.com/max/962/1*xnnuMpZNYnTRSvrV2lwXMw.png
Dificultad: Media

Continue reading on Medium »

Hacking on Medium
O que é privacidade!?

https://cdn-images-1.medium.com/max/1125/1*pR1NjXrr-yte3zw8rHnafQ.jpeg
Acredito que muitos já tem conhecimento de que ninguém tem uma real e completa segurança ou privacidade, mas para aqueles que buscam um…

Continue reading on Medium »

Hacking on Medium
Why Does Cyber Security Seem As Headache?

https://cdn-images-1.medium.com/max/2600/0*s69jcYwB5Oj3eYMm
Is it impossible or too hard to handle?

Continue reading on PrimeThreat »

SGXRay - Automating Vulnerability Detection for SGX Apps

Intel SGX protects isolated application logic and sensitive data inside an enclave with hardware-based memory encryption. To use such hardware-based security mechanism requires a strict programming model on memory usage， with complex APIs in and out the enclave boundary. Enclave developers are required to apply careful programming practices to ensure enclave security, especially when dealing with data flowing across the enclave's trusted boundary. Trusted boundary violations can further cause memory corruption and are exploitable by attackers to retrieve and manipulate protected data. Currently, no publicly available tools can effectively detect such issues for real-world enclaves.SGXRay is an automated reasoning tool based on the SMACK verifier that automatically detects SGX enclave bugs rooting from violations of trusted boundaries. It recompiles a given enclave code and starts the analysis from a user-specified enclave function entry. After the analysis, it either finds an invalid pointer handling inside an SGX software stack such as deferencing unchecked pointer inside an enclave, invalid memory deallocation, and TOCTOU bugs, or prove the absense of such bugs up to a user-specified loop and recursion bound. Currently, SGXRay SGX applications built on two SGX SDKs: Intel SGX SDK and openenclave SDK. Users can opt in SDK code for a more thorough analysis. Getting Started For a quick start, please follow a step-by-step tutorial on using SGXRay over one of the demo examples here. The following figure demonstrates the workflow of SGXRay. Running SGXRay is a two-step process. The first step is to obtain an LLVM IR file for the application. The second step is to invoke SGXRay CLI for verification. For the first step, we provide two Docker images for each SDK, respectively. docker pull baiduxlab/sgx-ray-frontend-inteldocker pull baiduxlab/sgx-ray-frontend-oe The detailed instructions to run the first step can be found here. For the second step, we also provide a Docker image. docker pull baiduxlab/sgx-ray-distro:latest The detailed instructions to run the second step can be found here. Docker Build We provide a Dockerfile that builds the image for the verification step. git clone https://github.com/baiduxlab/sgxray.git && cd sgxraydocker build . -t sgx-ray-distro-local --build-arg hostuid=$UID -f Dockerfiles/Dockerfile-CLI Successful build should produce an image named sgx-ray-distro-local which has an user user with the same user id as the host account. Documentations Detailed documentations of SGXRay can be found as follows. LLVM IR Generation Verification Download Sgxray
Read more...

SGXRay - Automating Vulnerability Detection for SGX Apps
http://www.kitploit.com/2021/08/sgxray-automating-vulnerability.html

Intel SGX protects isolated application logic and sensitive data inside an enclave with hardware-based memory encryption. To use such hardware-based security mechanism requires a strict programming model on memory usage， with complex APIs in and out the enclave boundary. Enclave developers are required to apply careful programming practices to ensure enclave security, especially when dealing with data flowing across the enclave's trusted boundary. Trusted boundary violations can further cause memory corruption and are exploitable by attackers to retrieve and manipulate protected data. Currently, no publicly available tools can effectively detect such issues for real-world enclaves.
SGXRay is an automated (https://www.kitploit.com/search/label/Automated) reasoning tool based on the SMACK (http://smackers.github.io/) verifier that automatically detects SGX enclave bugs rooting from violations of trusted boundaries. It recompiles a given enclave code and starts the analysis (https://www.kitploit.com/search/label/Analysis) from a user-specified enclave function entry. After the analysis, it either finds an invalid pointer handling inside an SGX software stack such as deferencing unchecked pointer inside an enclave, invalid memory deallocation, and TOCTOU bugs, or prove the absense of such bugs up to a user-specified loop and recursion bound. Currently, SGXRay SGX applications built on two SGX SDKs: Intel SGX SDK and openenclave SDK. Users can opt in SDK code for a more thorough analysis.
Getting Started
For a quick start, please follow a step-by-step tutorial on using SGXRay over one of the demo examples here (https://github.com/baiduxlab/sgxray/blob/main/docs/tutorial.md). The following figure demonstrates the workflow of SGXRay.

Running SGXRay is a two-step process. The first step is to obtain an LLVM IR file for the application. The second step is to invoke SGXRay CLI for verification. For the first step, we provide two Docker images for each SDK, respectively. docker pull baiduxlab/sgx-ray-frontend-intel
docker pull baiduxlab/sgx-ray-frontend-oe The detailed instructions to run the first step can be found here (https://github.com/baiduxlab/sgxray/blob/main/docs/bc-production.md). For the second step, we also provide a Docker image. docker pull baiduxlab/sgx-ray-distro:latest The detailed instructions to run the second step can be found here (https://github.com/baiduxlab/sgxray/blob/main/docs/verification.md).
Docker Build
We provide a Dockerfile (https://www.kitploit.com/search/label/Dockerfile) that builds the image for the verification step. git clone https://github.com/baiduxlab/sgxray.git && cd sgxray
docker build . -t sgx-ray-distro-local --build-arg hostuid=$UID -f Dockerfiles/Dockerfile-CLI Successful build should produce an image named sgx-ray-distro-local which has an user user with the same user id as the host account.
Documentations
Detailed documentations of SGXRay can be found as follows. LLVM IR Generation (https://github.com/baiduxlab/sgxray/blob/main/docs/bc-production.md) Verification (https://github.com/baiduxlab/sgxray/blob/main/docs/verification.md)

Download Sgxray (https://github.com/baiduxlab/sgxray)

hacking: security in practice
Using an Android Phone as a Rubber Ducky

https://external-preview.redd.it/tIRXlv39aCLHeLjE1K6dJwK8VfL2s7SHuitQBiNqxJI.jpg?width=640&crop=smart&auto=webp&s=adc92b70c006f5335dcbecaeecb095ab6fa57287 submitted by /u/PCtheawesome1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
File upload filter

Hi guys, need some info. For pen-testing purposes, I have been trying to upload a php shell but there is a filter which only allows jpg files. I tried all the techniques (double extension, hex numbers) but it won’t work. It is a server side filter. Please advice, thanks.

submitted by /u/Air_Direct
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video