hacking: security in practice
Understanding Container Architecture from Infosec Point of View

Docker containers are widely used in the deployment of moderns apps. In this post, you will learn the concept of containerizing, the security mechanism used by the docker community and how to interact with containers via docker

https://tbhaxor.com/understanding-container-architecture/

submitted by /u/tbhaxor
[link] [comments]

hacking: security in practice
how do I get around the school system

hello I want to hack or go around a system from my school on there chrome books that stops me from playing games like the Dino game so how do I do this

submitted by /u/brendanvds2007
[link] [comments]

Hacking on Medium
HackTheBox — Explore Writeup

https://cdn-images-1.medium.com/max/1261/1*7Db9_3kyuOV1KDEDFP60lw.png
So this is my write-up on one of the HackTheBox machines called Explore. This is my first ever android machine, so I hope I will learn a…

Continue reading on Medium »

Accessing Grofers Grafana Instance Using Shodan

Hello People….Continue reading on Medium »
Read more...

Exploit Collector
Rencode Denial Of Service

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png
The Rencode python module for object serialization suffers from a 3-byte denial of service vulnerability.

MD5 | 68fe69c1f12b00f7861dfcf881e40d0c

Download
1) About Rencode
Rencode is a "Python module for fast (basic) object serialization
similar to bencode".
https://github.com/aresch/rencode
This library is used as a faster and more efficient data encoder than
bencode.
There are implementations in other languages: Golang, Javascript, Java,
Ruby, dart, etc
Some of these ports carry the same bug, the Go port does.
(as an aside - not all of these derived works have preserved the
original copyright and license)

2) Vulnerability
https://github.com/aresch/rencode/pull/29
Given malformed input, the rencode parser enters an infinite loop.
The shortest rencoded string to trigger this bug is ';\x2f\x7f' but
there is an infinite number of possibilities.
Although the library is accelerated in Cython, it cannot release the
global interpreter lock so the Python interpreter process is irreparably
locked up once the loop is entered.
The software becomes unresponsive and consumes CPU until the process
runs out of memory and is terminated - which can take a *very* long time.

3) Affected software
There are at least two active open-source network facing projects using
the vulnerable python rencode library in their transport layer: xpra and
deluge.
Xpra is a remote desktop access tool - aka "screen for X11" and Deluge
is a bittorrent client.
There are other programs out there using this library but they are less
prominent or not network facing, though there may well be more
vulnerable software written in other languages.

4) Example DoS against xpra
Xpra uses rencode for structured messages between its processes,
typically between clients and servers.
Given an xpra process listening on a TCP port, sending this tiny (11
bytes) malformed packet triggers the DoS:
'P\x01\x00\x00\x00\x00\x00\x03;/\x7f'
This does not require any authentication.
Some packaged installations create a system wide proxy server which runs
as root and listens on the IANA assigned TCP port 14500.
Other socket types don't make it any harder to trigger (ie: websockets,
SSL), only requiring extra packet encapsulation.
Local users may also have access to other user's unix domain sockets.

5) Mitigation
The easiest way is to remove the Cython accelerated version of rencode:
rm `python3 -c "from rencode import _rencode;print(_rencode.__file__)"`
As the pure Python fallback implementation does not have this bug.

6) Disclosure timeline
2021-08-05 bug discovered, fix provided
2021-08-06 requested a CVE from mitre
2021-08-10 fix applied in rencode
2021-09-07 disclosure

Source:packetstormsecurity.com

Exploit Collector
WordPress TablePress 1.14 CSV Injection

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
WordPress TablePress plugin version 1.14 suffers from a csv injection vulnerability.

MD5 | 9dace92f496f8d0627979edd65671809

Download
# Exploit Title: WordPress Plugin TablePress 1.14 - CSV Injection
# Date: 07/09/2021
# Exploit Author: Nikhil Kapoor
# Vendor Homepage:
# Software Link: https://wordpress.org/plugins/tablepress/
# Version: 1.14
# Category: Web Application
# Tested on Windows

How to Reproduce this Vulnerability:

1. Install WordPress 5.8.0
2. Install and activate TablePress
3. Navigate to TablePress >> Add New >> Enter Table Name and Description (If You want this is Optional) >> Select Number of Rows and Columns
4. Click on Add Table
5. Now in Table Content Input Field Enter CSV Injection Payload
6. Click on Save Changes
6. Now go to All Table in TablePress select our entered table >> Click on Export >> Select CSV as an Export Format.
7. Click on Download Export File
8. Open the exported CSV file you will see that CSV Injection got Successfully Executed.

Payload Used :- @SUM(1+9)*cmd|' /C calc'!A0


Source:packetstormsecurity.com

Kali Linux Tutorials
Process-Dump : Windows Tool For Dumping Malware PE Files From Memory Back To Disk For Analysis

Process Dump is a Windows reverse-engineering command-line tool to dump malware memory components back to disk for analysis. Often malware files are packed and obfuscated before they are executed in order to avoid AV scanners, however when these files are executed they will often unpack or inject a clean version of the malware code in memory. A common task for malware researchers when analyzing malware is to dump this unpacked code back from memory to disk for scanning with AV products or for analysis with static analysis tools such as IDA.

Process Dump works for Windows 32 and 64 bit operating systems and can dump memory components from specific processes or from all processes currently running. Process Dump supports creation and use of a clean-hash database, so that dumping of all the clean files such as kernel32.dll can be skipped. It’s main features include:

* Dumps code from a specific process or all processes.
* Finds and dumps hidden modules that are not properly loaded in processes.
* Finds and dumps loose code chunks even if they aren’t associated with a PE file. It builds a PE header and import table for the chunks.
* Reconstructs imports using an aggressive approach.
* Can run in close dump monitor mode (‘-closemon’), where processes will be paused and dumped just before they terminate.
* Multi-threaded, so when you are dumping all running processes it will go pretty quickly.
* Can generate a clean hash database. Generate this before a machine is infected with malware so Process Dump will only dump the new malicious malware components.

I’m maintaining an official compiled release on my website here: http://split-code.com/processdump.html Installation

You can download the latest compiled release of Process Dump here:

* http://www.split-code.com/files/pd_v2_1.zip

This tool requires Microsoft Visual C++ Redistributable for Visual Studio 2015 to be installed to work:

* https://www.microsoft.com/en-ca/download/details.aspx?id=48145

Compiling Source Code

This is designed for Visual Studio 2019 and works with the free Community edition. Just open the project file with VS2019 and compile, it should be that easy! Example Usage

Dump all modules and hidden code chunks from all processes on your system (ignoring known clean modules):

* pd64.exe -system

Run in terminate monitor mode. Until cancelled (CTRL-C), Process Dump will dump any process just before the termination:

* pd64.exe -closemon

Dump all modules and hidden code chunks from a specific process identifier:

* pd64.exe -pid 0x18A

Dump all modules and hidden code chunk by process name:

* pd64.exe -p .*chrome.*

Build clean-hash database. These hashes will be used to exclude modules from dumping with the above commands:

* pd64.exe -db gen

Dump code from a specific address in PID 0x1a3:

* pd64.exe -pid 0x1a3 -a 0xffb4000
* Generates two files (32 and 64 bit) that can be loaded for analysis in IDA with generated PE headers and generated import table:
* notepad_exe_x64_hidden_FFB40000.exe
* notepad_exe_x86_hidden_FFB40000.exe Example sandbox usage

If you are running an automated sandbox or manual anti-malware research environment, I recommend running the following process with Process Dump, run all commands as Administrator:

* On your clean environment build the clean hash database:
* pd64.exe -db gen
* (or more quickly) pd64 -db genquick
* Begin the Process Dump terminate monitor. Leave this running in the background to dump all the intermediate processes used by the malware:
* pd64.exe -closemon
* Run the malware file
* Watch the malware install (and pd64 dumping any process that tries to close)
* When you are ready to [...]

Kali Linux Tutorials
TsharkVM : Tshark + ELK Analytics Virtual Machine

tsharkVM, this project builds virtual machine which can be used for analytics of tshark -T ek (ndjson) output. The virtual appliance is built using vagrant, which builds Debian 10 with pre-installed and pre-configured ELK stack.

After the VM is up, the process is simple:

* decoded pcaps (tshark -T ek output / ndjson) are sent over TCP/17570to the VM
* ELK stack in VM will process and index the data
* Kibana is running in VM and can be accessed on http://127.0.0.1:15601/app/kibana#/dashboards

Instructions To Build VM From Ubuntu Desktop

Clone source code

git clone https://github.com/H21lab/tsharkVM.git

Build tshark VM

sudo apt update
sudo apt install tshark virtualbox vagrant
bash ./build.sh

Upload pcaps to VM

#copy your pcaps into ./Trace
#run following script
bash upload_pcaps.sh
#or use tshark directly towards 127.0.0.1 17570/tcp
tshark -r trace.pcapng -x -T ek > /dev/tcp/localhost/17570

Open Kibana with browser

firefox http://127.0.0.1:15601/app/kibana#/dashboards

Open Main Dashboard and increase time window to e.g. last 100 years to see there the sample pcaps.
https://1.bp.blogspot.com/--GYJNfCKk1Q/YQd4NzcvxhI/AAAAAAAAKUQ/DDpZn0hzRoAREwAinIKpRi1LmXyrMSeqACLcBGAsYHQ/s800/tshark_vm_dashboard.png
SSH to VM

cd ./VM
vagrant ssh

Delete VM

cd ./VM
vagrant destroy default

Start VM

cd ./VM
vagrant up

Stop VM

cd ./VM
vagrant halt

SSH into VM and check if ELK is running correctly

cd ./VM
vagrant ssh
sudo systemctl status kibana.service
sudo systemctl status elasticsearch.service
sudo systemctl status logstash.service

Elasticsearch Mapping Template

In the project is included simple Elasticseacrh mapping template generated for the frame,eth,ip,udp,tcp,dhcpprotocols. To handle additional protocols efficiently it can be required to update the mapping template in the following way:

* Create custom mapping, by selecting required protocols
tshark -G elastic-mapping –elastic-mapping-filter frame,eth,ip,udp,tcp,dns > ./Kibana/custom_tshark_mapping.json
* Deduplicate and post-process the mapping to fit current Elasticsearch version
ruby ./Public/process_tshark_mapping_json.rb
* Upload file to vagrant VM
cd VM
vagrant upload ../Kibana/custom_tshark_mapping_deduplicated.json /home/vagrant/tsharkVM/Kibana/custom_tshark_mapping_deduplicated.json
cd ..
* Connect to VM and upload template in the Elasticsearch
cd VM
vagrant ssh
cd tsharkVM/Kibana
curl -X PUT “localhost:9200/_index_template/packets_template” -H ‘Content-Type: application/json’ -d@custom_tshark_mapping_deduplicated.json

Alternative can be using the dynamic mapping. See template ./Kibana/template_tshark_mapping_dynamic.json. And consider setting the numeric_detection parameter true/false depending on the mapping requirements and pcaps used. Upload the template into Elasticsearch in similar way as described above.

Limitations

tshark -G elastic-mapping –elastic-mapping-filter mapping could be outdated, it is not following properly the Elasticsearch changes and the output can be duplicated. The manual configuration and post-processing of the mapping template is required.

Program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY.
Download

Kali Linux Tutorials
PickleC2 : A Post-Exploitation And Lateral Movements Framework

PickleC2 is a simple C2 framework written in python3 used to help the community in Penetration Testers in their red teaming engagements.

PickleC2 has the ability to import your own PowerShell module for Post-Exploitation and Lateral Movement or automate the process.

Features

There is a one implant for the beta version which is powershell.

1. PickleC2 is fully encrypted communications, protecting the confidentiality and integrity of the C2 traffic even when communicating over HTTP.
2. PickleC2 can handle multiple listeners and implants with no issues
3. PickleC2 supports anyone who would like to add his own PowerShell Module

Future Features

In the up coming updates pickle will support:

1. Go Implant
2. Powershell-Less Implant that don’t use System.Management.Automation.dll.
3. Malleable C2 Profile will be supported.
4. HTTPS communications will be supported. NOTE: Even HTTP communications is fully encrypted.

Install

PickleC2 is a opensource can be found on Github. PickleC2 is only supported for linux for now and you can download it through https://github.com/xRET2pwn/PickleC2

Installation and Setup

PickleC2 is written in Python3 and developed and tested on Kali Linux.

Install PickleC2 On Linux

Picklec2 is can be found on Github. git clone https://github.com/xRET2pwn/PickleC2.gitcd PickleC2Install Python3 and pip3 sudo apt install python3 python3-pipInstall PickleC2 requirements python3 -m pip install -r requirements.txtRun PickleC2 ./run.pyOR python3 run.pyHow To Use PickleC2

PickleC2 is so simple and easy to use and everything you need will be found in help option

How to help

The help command will show you everything you need and help can be used to show any option’s help through help https://1.bp.blogspot.com/-382uRy5jEbE/YSIXlEAcE8I/AAAAAAAAKfQ/EP_ML6ADxU4WOz-9TtUkWrmzAi2aX-VFwCLcBGAsYHQ/s901/help.png
How to Listener

You can use help listenercommand to show all the listener commands.
https://1.bp.blogspot.com/-WgP0DY0HaQc/YSIYDQw3BJI/AAAAAAAAKfY/MjzE3FtN8ekcy9utWoUXYMLsZo2begcNACLcBGAsYHQ/s774/help_option.png
Listeners is built on flask.

FLASK is a popular Python web framework, meaning it is a third-party Python library used for developing web applications.

Start Listener

You can start your listener through

listener start [Listener_Name] [Listener_Interface] [Listener_Port]
https://1.bp.blogspot.com/-DkvHzRvo7qY/YSRrULmPoNI/AAAAAAAAKfw/7r8xIKGuH0wbZK1glyjo0n-tOe69bAB8QCLcBGAsYHQ/s730/start_listener%2B%25281%2529.png
Stop Listener

You can stop your listener through

listener stop [Listener_Name]
https://1.bp.blogspot.com/-v4accDXhYhU/YSRrmAvD53I/AAAAAAAAKf4/uA8aKh8eWm0FKBeYYcHLJTRnhovuCfvcACLcBGAsYHQ/s322/stop_listener%2B%25281%2529.png
List Listeners

You can list all the listeners through

listener list
https://1.bp.blogspot.com/-5_N2W6MdBOo/YSRr1hPSn2I/AAAAAAAAKf8/cYjv7s_2tx4NtjQV0ZNElLNcgMl9LqanQCLcBGAsYHQ/s414/list_listener%2B%25281%2529.png
Load Listener

You can use load listener if you have a not active listeners and you need to active them.

listener load
https://1.bp.blogspot.com/-DXFVBUW6j5A/YSRsMEI1NgI/AAAAAAAAKgI/xS7bdmwlbrkKuakp_BzDGVWvMM4DZxZ7QCLcBGAsYHQ/s853/load_listener%2B%25281%2529.png
How to Implant

In this section you will be able to create your implant.

Generate Implant

You can generate implant through.

implant generate [listener_name] [Implant_Lang] [Implant_Name]
https://1.bp.blogspot.com/-Lj6z6mGi5p4/YSRs4RG0wII/AAAAAAAAKgU/WjLX_g9Fp-MKEHO7Nc6VHn2QhEFfdxrlQCLcBGAsYHQ/s1128/generate_implant.png
List Active Implant

You can list all the active implant through implant listhttps://1.bp.blogspot.com/-VFHY3g9XQwU/YSRtM_tF[...]

dump the running malware from memory, run the following command to dump all processes:
* pd64.exe -system
* All the dumped components will be in the working directory of pd64.exe. You can change the output path using the ‘-o’ flag, Notes on the naming convention of dumped modules

* ‘hiddemodule’ in the filename instead of the module name indicates the module was not properly registered in the process.
* ‘codechunk’ in the filename means that it is a reconstructed dump from a loose executable region. This can be for example injected code that did not have a PE header. Codechunks will be dumped twice, once with a reconstructed x86 and again with a reconstructed x64 header.

Example filenames of dumped files

* notepad_exe_PID2990_hiddenmodule_16B8ABB0000_x86.dll
* notepad_exe_PID3b5c_notepad.exe_7FF6E6630000_x64.exe
* notepad_exe_PID2c54_codechunk_17BD0000_x86.dll
* notepad_exe_PID2c54_codechunk_17BD0000_x64.dll Help Page

Process Dump v2.1 Copyright ® 2017, Geoff McDonald http://www.split-code.com/

Process Dump (pd.exe) is a tool used to dump both 32 and 64 bit executable modules back to disk from memory within a process address space. This tool is able to find and dump hidden modules as well as loose executable code chunks, and it uses a clean hash database to exclude dumping of known clean files. This tool uses an aggressive import reconstruction approach that links all DWORD/QWORDs that point to an export in the process to the corresponding export function. Process dump can be used to dump all unknown code from memory (‘-system’ flag), dump specific processes, or run in a monitoring mode that dumps all processes just before they terminate.

Before first usage of this tool, when on the clean workstation the clean exclusing hash database can be generated by either:

* pd -db gen
* pd -db genquick

Example Usage:

* pd -system
* pd -pid 419
* pd -pid 0x1a3
* pd -pid 0x1a3 -a 0x401000 -o c:\dump\ -c c:\dump\test\clean.db
* pd -p chrome.exe
* pd -p “(?i).*chrome.*”
* pd -closemon

Options:

* -system

Dumps all modules not matching the clean hash databas from all accessible processes into the working directory.

* -pid <pid

Dumps all modules not matching the clean hash database from the specified pid into the current working directory. Use a ‘0x’ prefix to specify a hex PID.

* -closemon

Runs in monitor mode. When any processes are terminating process dump will first dump the process.

* -p <regex

Dumps all modules not matching the clean hash database from the process name found to match the filter into specified pid into the current working directory.

* -a <module

Dumps a module at the specified base address from the process.

* -g

Forces generation of PE headers from scratch, ignoring existing headers.

* -o <path

Sets the default output root folder for dumped components.

* -v

Verbose.

* -nh

No header is printed in the output.

* -nr

Disable recursion on hash database directory add or remove commands.

* -ni

Disable import reconstruction.

* -nc

Disable dumping of loose code regions.

* -nt

Disable multithreading.

* -nep

Disable entry point hashing.

* -eprec

Force the entry point to be reconstructed, even if a valid one appears to exist.

* -t <thread

Sets the number of threads to use (default 16).

* -cdb <filepath

Full filepath to the clean hash database to use for this run.

* -edb <filepath

Full filepath to the entrypoint hash database to use for this run.

* -esdb <filepath

Full filepath to the entrypoint short hash database to use for this run.

* -db gen

Automatically processes a few common folders as well as all the currently running processes and adds the found module hashes to the clean hash database. It will add all files recursively in: %WINDIR% %HOMEPATH% C:\Program Files
C:\Program Files (x86)
As well as all modules in all running processes
[...]