TREVORproxy is a SOCKS proxy that round-robins requests through SSH hosts. TREVORspray is a A featureful Python O365 sprayer based on MSOLSpray (https://github.com/dafthack/MSOLSpray) which uses the Microsoft Graph API (https://docs.microsoft.com/en-us/graph/overview)By @thetechr0mancer (https://twitter.com/thetechr0mancer)
Microsoft is getting better and better about blocking password spraying attacks against O365. TREVORspray can solve this by proxying its requests through an unlimited number of --ssh hosts. No weird dependencies or cumbersome setup required - all you need is a cloud VM with port 22 open.CREDIT WHERE CREDIT IS DUE - MANY THANKS TO:@dafthack (https://twitter.com/dafthack) for writing MSOLSpray (https://github.com/dafthack/MSOLSpray)@Mrtn9 (https://twitter.com/Mrtn9) for his Python port of MSOLSpray (https://github.com/MartinIngesen/MSOLSpray)@KnappySqwurl (https://twitter.com/KnappySqwurl) for being a splunk wizard and showing me how heckin loud I was being :)
Features
Tells you the status of each account: if it exists, is locked, has MFA enabled, etc.Automatic cancel/resume (attempted user/pass combos are remembered in ./logs/tried_logins.txt)Round-robin proxy through multiple IPs using only vanilla --sshAutomatic infinite reconnect/retry if a proxy goes down (or if you lose internet)Spoofs User-Agent and client_id to look like legitimate auth trafficLogs everything to ./logs/trevorspray.logSaves valid usernames (https://www.kitploit.com/search/label/Usernames) to ./logs/valid_usernames.txtOptional --delay between request to bypass M$ lockout countermeasures
Installation:
$ git clone https://github.com/blacklanternsecurity/trevorspray
$ cd trevorspray
$ pip install -r requirements.txt

Example: Spray O365 with 5-second delay between requests
$ trevorspray.py -e bob@evilcorp.com -p Fall2020! --delay 5

Example: Spray O365 and round-robin between 3 IPs (the current IP is used as well.)
$ trevorspray.py -e emails.txt -p Fall2020! --ssh root@1.2.3.4 root@4.3.2.1

TREVORspray - Help:
traffic through SSH hosts optional arguments: -h, --help show this help message and exit -e EMAILS [EMAILS ...], --emails EMAILS [EMAILS ...] Emails(s) and/or file(s) filled with emails -p PASSWORDS [PASSWORDS ...], --passwords PASSWORDS [PASSWORDS ...] Password(s) that will be used to perform the password spray -f, --force Forces the spray to continue and not stop when multiple account lockouts are detected -d DELAY, --delay DELAY Sleep for this many seconds between requests -u URL, --url URL The URL to spray against (default is https://login.microsoft.com) -v, --verbose Show which proxy is being used for each request -s SSH [SSH ...], --ssh SSH [SSH ...] Round-robin load-balance through these SSH hosts (user@host) NOTE: Current IP address is also used once per round -k KEY, --key KEY Use this SSH key when connecting to proxy hosts -b BASE_PORT, --base-port BASE_PORT Base listening port to use for SOCKS proxies -n, --no-current-ip Don't spray from the current IP, only use SSH proxies ">$ ./trevorspray.py --help
usage: trevorspray.py [-h] -e EMAILS [EMAILS ...] -p PASSWORDS [PASSWORDS ...] [-f] [-d DELAY] [-u URL] [-v] [-s SSH [SSH ...]] [-k KEY] [-b BASE_PORT] [-n]

Execute password sprays against O365, optionally proxying the traffic through SSH hosts

optional arguments:
-h, --help show this help message and exit
-e EMAILS [EMAILS ...], --emails EMAILS [EMAILS ...]
Emails(s) and/or file(s) filled with emails
-p PASSWORDS [PASSWORDS ...], --passwords PASSWORDS [PASSWORDS ...]
Password(s) that will be used to perform the password spray
-f, --force Forces the spray to continue and not stop when multiple account lockouts are detected
-d DELAY, --delay DELAY

Sleep for this many seconds between requests
-u URL, --url URL The URL to spray against (default is https://login.microsoft.com)
-v, --verbose Show which proxy is being used for each request
-s SSH [SSH ...], --ssh SSH [SSH ...]
Round-robin load-balance through these SSH hosts (user@host) NOTE: Current IP address is also used once per round
-k KEY, --key KEY Use this SSH key when connecting to proxy hosts
-b BASE_PORT, --base-port BASE_PORT
Base listening port to use for SOCKS proxies
-n, --no-current-ip Don't spray from the current IP, only use SSH proxies

Known Limitations:
Untested on WindowsCurrently only works against the M$ Graph API
TREVORproxy - Help:
debugging info -k KEY, --key KEY Use this SSH key when connecting to proxy hosts --base-port BASE_PORT Base listening port to use for SOCKS proxies ">$ ./trevorproxy.py --help
usage: trevorproxy.py [-h] [-p PORT] [-l LISTEN_ADDRESS] [-v] [-k KEY] [--base-port BASE_PORT] ssh_hosts [ssh_hosts ...]

Spawns a SOCKS server which round-robins requests through the specified SSH hosts

positional arguments:
ssh_hosts Round-robin load-balance through these SSH hosts (user@host)

optional arguments:
-h, --help show this help message and exit
-p PORT, --port PORT Port for SOCKS server to listen on (default: 1080)
-l LISTEN_ADDRESS, --listen-address LISTEN_ADDRESS
Listen address for SOCKS server (default: 127.0.0.1)
-v, --verbose Print extra debugging info
-k KEY, --key KEY Use this SSH key when connecting to proxy hosts
--base-port BASE_PORT
Base listening port to use for SOCKS proxies


Download TREVORspray (https://github.com/blacklanternsecurity/TREVORspray)

Facebook email disclosure and account takeover
https://rikeshbaniyaaa.medium.com/facebook-email-disclosure-and-account-takeover-ecdb44ee12e9?source=rss------bug_bounty-5

I have a preference for apps over web when it comes to hunting, so in January I decided to dive deep into apk endpoints hoping to find…Continue reading on Medium » (https://rikeshbaniyaaa.medium.com/facebook-email-disclosure-and-account-takeover-ecdb44ee12e9?source=rss------bug_bounty-5)

hacking: security in practice
Understanding Container Architecture from Infosec Point of View

Docker containers are widely used in the deployment of moderns apps. In this post, you will learn the concept of containerizing, the security mechanism used by the docker community and how to interact with containers via docker

https://tbhaxor.com/understanding-container-architecture/

submitted by /u/tbhaxor
[link] [comments]

hacking: security in practice
how do I get around the school system

hello I want to hack or go around a system from my school on there chrome books that stops me from playing games like the Dino game so how do I do this

submitted by /u/brendanvds2007
[link] [comments]

Hacking on Medium
HackTheBox — Explore Writeup

https://cdn-images-1.medium.com/max/1261/1*7Db9_3kyuOV1KDEDFP60lw.png
So this is my write-up on one of the HackTheBox machines called Explore. This is my first ever android machine, so I hope I will learn a…

Continue reading on Medium »

Accessing Grofers Grafana Instance Using Shodan

Hello People….Continue reading on Medium »
Read more...

Exploit Collector
Rencode Denial Of Service

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png
The Rencode python module for object serialization suffers from a 3-byte denial of service vulnerability.

MD5 | 68fe69c1f12b00f7861dfcf881e40d0c

Download
1) About Rencode
Rencode is a "Python module for fast (basic) object serialization
similar to bencode".
https://github.com/aresch/rencode
This library is used as a faster and more efficient data encoder than
bencode.
There are implementations in other languages: Golang, Javascript, Java,
Ruby, dart, etc
Some of these ports carry the same bug, the Go port does.
(as an aside - not all of these derived works have preserved the
original copyright and license)

2) Vulnerability
https://github.com/aresch/rencode/pull/29
Given malformed input, the rencode parser enters an infinite loop.
The shortest rencoded string to trigger this bug is ';\x2f\x7f' but
there is an infinite number of possibilities.
Although the library is accelerated in Cython, it cannot release the
global interpreter lock so the Python interpreter process is irreparably
locked up once the loop is entered.
The software becomes unresponsive and consumes CPU until the process
runs out of memory and is terminated - which can take a *very* long time.

3) Affected software
There are at least two active open-source network facing projects using
the vulnerable python rencode library in their transport layer: xpra and
deluge.
Xpra is a remote desktop access tool - aka "screen for X11" and Deluge
is a bittorrent client.
There are other programs out there using this library but they are less
prominent or not network facing, though there may well be more
vulnerable software written in other languages.

4) Example DoS against xpra
Xpra uses rencode for structured messages between its processes,
typically between clients and servers.
Given an xpra process listening on a TCP port, sending this tiny (11
bytes) malformed packet triggers the DoS:
'P\x01\x00\x00\x00\x00\x00\x03;/\x7f'
This does not require any authentication.
Some packaged installations create a system wide proxy server which runs
as root and listens on the IANA assigned TCP port 14500.
Other socket types don't make it any harder to trigger (ie: websockets,
SSL), only requiring extra packet encapsulation.
Local users may also have access to other user's unix domain sockets.

5) Mitigation
The easiest way is to remove the Cython accelerated version of rencode:
rm `python3 -c "from rencode import _rencode;print(_rencode.__file__)"`
As the pure Python fallback implementation does not have this bug.

6) Disclosure timeline
2021-08-05 bug discovered, fix provided
2021-08-06 requested a CVE from mitre
2021-08-10 fix applied in rencode
2021-09-07 disclosure

Source:packetstormsecurity.com

Exploit Collector
WordPress TablePress 1.14 CSV Injection

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
WordPress TablePress plugin version 1.14 suffers from a csv injection vulnerability.

MD5 | 9dace92f496f8d0627979edd65671809

Download
# Exploit Title: WordPress Plugin TablePress 1.14 - CSV Injection
# Date: 07/09/2021
# Exploit Author: Nikhil Kapoor
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/tablepress/
# Version: 1.14
# Category: Web Application
# Tested on Windows

How to Reproduce this Vulnerability:

1. Install WordPress 5.8.0
2. Install and activate TablePress
3. Navigate to TablePress >> Add New >> Enter Table Name and Description (If You want this is Optional) >> Select Number of Rows and Columns
4. Click on Add Table
5. Now in Table Content Input Field Enter CSV Injection Payload
6. Click on Save Changes
6. Now go to All Table in TablePress select our entered table >> Click on Export >> Select CSV as an Export Format.
7. Click on Download Export File
8. Open the exported CSV file you will see that CSV Injection got Successfully Executed.

Payload Used :- @SUM(1+9)*cmd|' /C calc'!A0


Source:packetstormsecurity.com

Kali Linux Tutorials
Process-Dump : Windows Tool For Dumping Malware PE Files From Memory Back To Disk For Analysis

Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often unpack or inject a clean version of the malware code in memory. A common task for malware researchers when analyzing malware is to dump this unpacked code back from memory to disk for scanning with AV products or for analysis with static analysis tools such as IDA.

Process Dump works for Windows 32 and 64 bit operating systems and can dump memory components from specific processes or from all processes currently running. Process Dump supports creation and use of a clean-hash database, so that dumping of all the clean files such as kernel32.dll can be skipped. It’s main features include:

* Dumps code from a specific process or all processes.
* Finds and dumps hidden modules that are not properly loaded in processes.
* Finds and dumps loose code chunks even if they aren’t associated with a PE file. It builds a PE header and import table for the chunks.
* Reconstructs imports using an aggressive approach.
* Can run in close dump monitor mode (‘-closemon’), where processes will be paused and dumped just before they terminate.
* Multi-threaded, so when you are dumping all running processes it will go pretty quickly.
* Can generate a clean hash database. Generate this before a machine is infected with malware so Process Dump will only dump the new malicious malware components.

I’m maintaining an official compiled release on my website here: http://split-code.com/processdump.html Installation

You can download the latest compiled release of Process Dump here:

* http://www.split-code.com/files/pd_v2_1.zip

This tool requires Microsoft Visual C++ Redistributable for Visual Studio 2015 to be installed to work:

* https://www.microsoft.com/en-ca/download/details.aspx?id=48145

Compiling Source Code

This is designed for Visual Studio 2019 and works with the free Community edition. Just open the project file with VS2019 and compile, it should be that easy! Example Usage

Dump all modules and hidden code chunks from all processes on your system (ignoring known clean modules):

* pd64.exe -system

Run in terminate monitor mode. Until cancelled (CTRL-C), Process Dump will dump any process just before the termination:

* pd64.exe -closemon

Dump all modules and hidden code chunks from a specific process identifier:

* pd64.exe -pid 0x18A

Dump all modules and hidden code chunk by process name:

* pd64.exe -p .*chrome.*

Build clean-hash database. These hashes will be used to exclude modules from dumping with the above commands:

* pd64.exe -db gen

Dump code from a specific address in PID 0x1a3:

* pd64.exe -pid 0x1a3 -a 0xffb4000
* Generates two files (32 and 64 bit) that can be loaded for analysis in IDA with generated PE headers and generated import table:
* notepad_exe_x64_hidden_FFB40000.exe
* notepad_exe_x86_hidden_FFB40000.exe Example sandbox usage

If you are running an automated sandbox or manual anti-malware research environment, I recommend running the following process with Process Dump, run all commands as Administrator:

* On your clean environment build the clean hash database:
* pd64.exe -db gen
* (or more quickly) pd64 -db genquick
* Begin the Process Dump terminate monitor. Leave this running in the background to dump all the intermediate processes used by the malware:
* pd64.exe -closemon
* Run the malware file
* Watch the malware install (and pd64 dumping any process that tries to close)
* When you are ready to [...]