Hi everyone, I hope you all are doing well and great! In this article we are going to talk about a weird xss that i found in one of the…Continue reading on Medium » (https://faiyazhacks.medium.com/story-of-an-encoded-xss-e83c7ea9e02?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
STORY OF AN ENCODED XSS
Hi everyone, I hope you all are doing well and great! In this article we are going to talk about a weird xss that i found in one of the…
STORY OF AN ENCODED XSS
Hi everyone, I hope you all are doing well and great! In this article we are going to talk about a weird xss that i found in one of the…Continue reading on Medium »
Read more...
Hi everyone, I hope you all are doing well and great! In this article we are going to talk about a weird xss that i found in one of the…Continue reading on Medium »
Read more...
Whoc - A Container Image That Extracts The Underlying Container Runtime
http://www.kitploit.com/2021/11/whoc-container-image-that-extracts.html
___________________________
@hacking_Attack
@Hacking_Video
http://www.kitploit.com/2021/11/whoc-container-image-that-extracts.html
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.
A container (https://www.kitploit.com/search/label/Container) image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!WhoC at Defcon 29 Cloud Village (https://www.youtube.com/watch?v=DF0qoCsHKT4)Azurescape (https://unit42.paloaltonetworks.com/azure-container-instances/) - whoc-powered research, the first cross-account container takeover (https://www.kitploit.com/search/label/Takeover) in the public cloud (70,000$ bounty)
How does it work?
As shown by runc CVE-2019-5736 (https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/), traditional Linux container runtimes expose themselves to the containers (https://www.kitploit.com/search/label/Containers) they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.
Dynamic Mode
This is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic (https://www.kitploit.com/search/label/Dynamic) linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.
___________________________
@hacking_Attack
@Hacking_Video
How does it work?
As shown by runc CVE-2019-5736 (https://unit42.paloaltonetworks.com/breaking-docker-via-runc-explaining-cve-2019-5736/), traditional Linux container runtimes expose themselves to the containers (https://www.kitploit.com/search/label/Containers) they're running through /proc/self/exe. whoc uses this link to read the container runtime executing it.
Dynamic Mode
This is whoc default mode that works against dynamically linked container runtimes.The whoc image entrypoint is set to /proc/self/exe, and the image's dynamic (https://www.kitploit.com/search/label/Dynamic) linker (ld.so) is replaced with fake_ld.Once the image is run, the container runtime re-executes itself inside the container.Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.fake_ld obtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.upload_runtime reads the runtime binary from /proc/self/fd/ and sends it to the configured remote server.
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Wait-For-Exec Mode
For statically linked container runtimes, whoc comes in another flavor: whoc:waitforexec.upload_runtime is the image entrypoint, and runs as the whoc container PID 1.The user is expected to exec into the whoc container and invoke a file pointing to /proc/self/exe (e.g. docker exec whoc-ctr /proc/self/exe)Once the exec occurs, the container runtime re-executes itself inside the containerupload_runtime reads the runtime binary through /proc//exe and sends it to the configured remote server
___________________________
@hacking_Attack
@Hacking_Video
For statically linked container runtimes, whoc comes in another flavor: whoc:waitforexec.upload_runtime is the image entrypoint, and runs as the whoc container PID 1.The user is expected to exec into the whoc container and invoke a file pointing to /proc/self/exe (e.g. docker exec whoc-ctr /proc/self/exe)Once the exec occurs, the container runtime re-executes itself inside the containerupload_runtime reads the runtime binary through /proc//exe and sends it to the configured remote server
___________________________
@hacking_Attack
@Hacking_Video
Try Locally
You'll need docker and python3 installed. Clone the repository:$ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime:$ cd whoc
$ mkdir -p stash && cd stash
$ ln -s ../util/fileserver.py fileserver
$ ./fileserverFrom another shell, run the whoc image in your container environment of choice, for example Docker:$ cd whoc
$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh
$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.shSee that the file server received the container runtime. Since we run whoc under vanilla (https://www.kitploit.com/search/label/vanilla) Docker, the received container runtime should be runc (https://github.com/opencontainers/runc).--net=host is only used in local tests so that the whoc container could easily reach the fileserver on the host via 127.0.0.1.
Help
Help for whoc's main binary, upload_runtime: Options: -p, --port Port of remote server, defaults to 8080 -e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred -b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter -a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly -r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime), find the runtime by searching for new processes under '/proc' ">Usage: upload_runtime [options]
Options:
-p, --port Port of remote server, defaults to 8080
-e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred
-b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter
-a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly
-r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime),
find the runtime by searching for new processes under '/proc'
Download Whoc (https://github.com/twistlock/whoc)
___________________________
@hacking_Attack
@Hacking_Video
You'll need docker and python3 installed. Clone the repository:$ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime:$ cd whoc
$ mkdir -p stash && cd stash
$ ln -s ../util/fileserver.py fileserver
$ ./fileserverFrom another shell, run the whoc image in your container environment of choice, for example Docker:$ cd whoc
$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh
$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.shSee that the file server received the container runtime. Since we run whoc under vanilla (https://www.kitploit.com/search/label/vanilla) Docker, the received container runtime should be runc (https://github.com/opencontainers/runc).--net=host is only used in local tests so that the whoc container could easily reach the fileserver on the host via 127.0.0.1.
Help
Help for whoc's main binary, upload_runtime: Options: -p, --port Port of remote server, defaults to 8080 -e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred -b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter -a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly -r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime), find the runtime by searching for new processes under '/proc' ">Usage: upload_runtime [options]
Options:
-p, --port Port of remote server, defaults to 8080
-e, --exec Wait-for-exec mode for static container runtimes, waits until an exec to the container occurred
-b, --exec-bin In exec mode, overrides the default binary created for the exec, default is /bin/enter
-a, --exec-extra-argument In exec mode, pass an additional argument to the runtime so it won't exit quickly
-r, --exec-readdir-proc In exec mode, instead of guessing the runtime pid (which gives whoc one shot of catching the runtime),
find the runtime by searching for new processes under '/proc'
Download Whoc (https://github.com/twistlock/whoc)
___________________________
@hacking_Attack
@Hacking_Video
KitPloit - PenTest & Hacking Tools
Leading source of security tools, hacking tools, cybersecurity and network security. Learn about new tools and updates in one place.
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Whoc - A Container Image That Extracts The Underlying Container Runtime
https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!
* WhoC at Defcon 29 Cloud Village
* Azurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through
1. The
2. Once the image is run, the container runtime re-executes itself inside the container.
3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.
4.
5.
1.
2. The user is expected to exec into the
3. Once the exec occurs, the container runtime re-executes itself inside the container
4.
___________________________
@hacking_Attack
@Hacking_Video
Whoc - A Container Image That Extracts The Underlying Container Runtime
https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 A container image that extracts the underlying container runtime and sends it to a remote server. Poke at the underlying container runtime of your favorite CSP container platform!
* WhoC at Defcon 29 Cloud Village
* Azurescape - whoc-powered research, the first cross-account container takeover in the public cloud (70,000$ bounty) How does it work?As shown by runc CVE-2019-5736, traditional Linux container runtimes expose themselves to the containers they're running through
/proc/self/exe. whocuses this link to read the container runtime executing it. Dynamic ModeThis is whocdefault mode that works against dynamically linked container runtimes.1. The
whocimage entrypoint is set to /proc/self/exe, and the image's dynamic linker (ld.so) is replaced with fake_ld.2. Once the image is run, the container runtime re-executes itself inside the container.
3. Given the runtime is dynamically linked, the kernel loads our fake dynamic linker to the runtime process and passes execution to it.
4.
fake_ldobtains a file descriptor for the runtime binary by opening /proc/self/exe, and executes upload_runtime.5.
upload_runtimereads the runtime binary from /proc/self/fd/and sends it to the configured remote server. https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814hdlYdazoGq5kcijHfXEySNffebbB1_wbu5wzuX_AmycCum_3VhhEtw1pRAS4lwLZumzqgUCJt0kHrev2Ew=w640-h360 Wait-For-Exec ModeFor statically linked container runtimes, whoccomes in another flavor: whoc:waitforexec.1.
upload_runtimeis the image entrypoint, and runs as the whoccontainer PID 1.2. The user is expected to exec into the
whoccontainer and invoke a file pointing to /proc/self/exe(e.g. docker exec whoc-ctr /proc/self/exe)3. Once the exec occurs, the container runtime re-executes itself inside the container
4.
upload_runtimereads the runtime binary through /proc/and sends it to the configured remote server https://blogger.googleusercontent.com/img/a/AVvXsEhbfCLFL3NwU1sTB4vduEhYxUm-_xbrXLOUlsfrgj0TSnTdcpcBZIDprF7te-xGhkLaYz1t7nttgwg-pZ2wCIzjawRmgpRK7-qwpL95QTsOooSZIgvX68UQb1pJVjNiqvhN_QstbYC0Z99gVA4ECkzjQ0pXXm-hhAb6xXqUUU5MhAJAU5fMs5d07rbu_Q=w640-h372 Try LocallyYou'll need dockerand python3installed. Clone the repository: $ git clone git@github.com:twistlock/whoc.gitSet up a file server to receive the extracted container runtime: $ cd whoc
$ mkdir -p stash && cd stash
$ ln -s ../util/fileserver.py fileserver
$ ./fileserverFrom another shell, run the whocimage in your container environment of choice, for example Docker: $ cd whoc
$ docker build -f Dockerfile_dynamic -t whoc:latest src # or ./util/build.sh
$ docker run --rm -it --net=host whoc:latest 127.0.0.1 # or ./util/run_local.shSee that the file server received the container runtime. Since we run whocunder vanilla Docker, the received container runtime should be runc. --net=hostis only used in local tests so that the whoccontainer could easily reach the fileserver on the host via 127.0.0.1. HelpHelp[...]___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Kitploit – Maintenance in Progress
Kitploit is temporarily under maintenance. We’ll be back shortly with improvements.
Hacking Articles Tips Tricks Videos Tutorials
KitPloit - PenTest Tools! Whoc - A Container Image That Extracts The Underlying Container Runtime https://blogger.googleusercontent.com/img/a/AVvXsEi_95e_qg5fMsbP6treVFuqoow00IkE5tY4k2v5rsmgUjnDB1ca-bidnn2ZtSOCXuYiZ9cUbI7VZ04PibinnHx0rHSvAZbNVZKfc7BUJ814…
for
___________________________
@hacking_Attack
@Hacking_Video
whoc's main binary, upload_runtime: Usage: upload_runtime [options] Download Whoc___________________________
@hacking_Attack
@Hacking_Video
CMD nedir? Nasıl kullanılır?
https://mirabbasagalarov.medium.com/cmd-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-2d98f7709902?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
https://mirabbasagalarov.medium.com/cmd-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-2d98f7709902?source=rss------bug_bounty-5
___________________________
@hacking_Attack
@Hacking_Video
Medium
CMD nedir? Nasıl kullanılır?
Cmd nedir?
Cmd nedir?Continue reading on Medium » (https://mirabbasagalarov.medium.com/cmd-nedir-nas%C4%B1l-kullan%C4%B1l%C4%B1r-2d98f7709902?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
CMD nedir? Nasıl kullanılır?
Cmd nedir?
Auto(It)mating your .NET tradecraft
https://www.reddit.com/r/redteamsec/comments/r15van/autoitmating_your_net_tradecraft/
submitted by /u/hanbei-undying (https://www.reddit.com/user/hanbei-undying)
[link] (https://thevivi.net/blog/pentesting/2021-11-24-autoitmating-your-dotnet-tradecraft/) [comments] (https://www.reddit.com/r/redteamsec/comments/r15van/autoitmating_your_net_tradecraft/)
___________________________
@hacking_Attack
@Hacking_Video
https://www.reddit.com/r/redteamsec/comments/r15van/autoitmating_your_net_tradecraft/
submitted by /u/hanbei-undying (https://www.reddit.com/user/hanbei-undying)
[link] (https://thevivi.net/blog/pentesting/2021-11-24-autoitmating-your-dotnet-tradecraft/) [comments] (https://www.reddit.com/r/redteamsec/comments/r15van/autoitmating_your_net_tradecraft/)
___________________________
@hacking_Attack
@Hacking_Video
reddit
Auto(It)mating your .NET tradecraft
Posted in r/redteamsec by u/hanbei-undying • 1 point and 0 comments