Exploit Collector
Reprise License Manager 14.2 Remote Binary Execution

https://4.bp.blogspot.com/-mkcU-A73eZ4/WWlu7eKaHEI/AAAAAAAAIJY/m_4841aOwNcKGKR9ykgWprFWjwy04TKNACLcBGAs/s1600/h11.png
Reprise License Manager version 14.2 suffers from an authenticated remote binary execution vulnerability.

MD5 | 168a71810d65bf8de3fe62438600faa2

Download
# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44153
# Vulnerability Title: Authenticated Remote Binary Execution
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################

Introduction:

When editing the license file, it is possible for an admin user to enable an option to run arbitrary executables.
An attacker can exploit this to run a malicious binary on startup, or when triggering the "Reread/Restart Servers" function on the webserver. (Exploitation does not require CVE-2018-15573, because the license file is meant to be changed in the application.)

Vulnerability:

A license file containing the following, would execute calc.exe as an example of this vulnerability, it is also possible to provide arguments to the executables:

ISV demo "C:\Windows\System32\calc.exe"

If CVE-2018-15573 remains unpatched, files could be created on the system and then executed.

Recommendation:
Don't allow user-specified binaries to be run. Use a allow-list if absolutely required.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Grafana Arbitrary File Reading

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
Grafana suffers from an unauthorized arbitrary file reading vulnerability. Version 8.3.1 addresses this issue.

MD5 | b07119f68d1f96828ea48a5529ee09b5

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 Unauthenticated Password Change

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
Reprise License Manager version 14.2 suffers from a missing authentication vulnerability that allows for password changing of any existing user.

MD5 | 6e10e8f8887bc874e1ca493b558c5168

Download

# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44152
# Vulnerability Title: Unauthenticated Password Change
# Severity: High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
Because /goform/change_password_process does not verify authentication or authorization, an unauthenticated user can change the password of any existing user. This allows an attacker to change the password of any known user, thereby preventing valid users from accessing the system and granting the attacker full access to that user's account.

Vulnerability:
If an unauthenticated user sends the following HTTP request they can change the password of any user:

POST /goform/change_password_process HTTP/1.1
Host: 127.0.0.1:5054
Content-Length: 53

pw1=passwd&pw2=passwd&user=admin&ok=CHANGE%2BPASSWORD

Recommendation:
Ensure that authentication is required prior to password change requests and that users cannot modify or change passwords of others users.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Docker runc Command Execution Proof Of Concept

https://3.bp.blogspot.com/-XNOhyhmygqg/WWlvTLzMLRI/AAAAAAAAINo/1vKZqL-UEc0yrpuP08mTX_Jxjx_k32PvQCLcBGAs/s1600/h41.png
Docker proof of concept command execution exploit that leverages runc.

MD5 | 5b4cd873fd1dfaac2aa0a05de3311410

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reprise License Manager 14.2 Session Hijacking

https://4.bp.blogspot.com/-OTiSJPLOhfQ/WWlvdFudhmI/AAAAAAAAIPg/Ji3s4Viv0XwGl76TD9pbO-WowW5kHfgewCLcBGAs/s1600/h78.png
Reprise License Manager version 14.2 suffers from an unauthenticated session hijacking vulnerability via brute forcing.

MD5 | a1dffd2c337ea3b468c88a04bf944708

Download

# Product: Reprise License Manager 14.2
# Vendor: Reprise Software
# CVE ID: CVE-2021-44151
# Vulnerability Title: Unauthenticated Session Hijacking
# Severity: Medium/High
# Author(s): Mark Staal Steenberg, Bilal El Ghoul, Gionathan Armando Reale, Andreas Fyhn Andersen, Oliver Lind Nordestgaard
# Date: 2021-11-25
#############################################################
Introduction:
As the session cookies are short and simple, an attacker can hijack any existing sessions by bruteforcing the 4 hex-character session cookie on the Windows version (the Linux version appears to have 8 characters). An attacker can obtain the static part of the cookie (cookie name) by first making a request to any page on the application (e.g.,/goforms/menu) and saving the name of the cookie sent with the response.
The attacker can then use the name of the cookie and try to request that same page, setting a random value for the cookie. If any user has an active session, the page should return with the authorized content, when a valid cookie value is hit.

Vulnerability:
Due to the session cookies being rather simple and predictable, a single session, can be brute forced in less than 3 minutes, on a laptop, and can therefore be considered very insecure.

Recommendation:
It is recommended to follow industry standards and use secure randomized complex session cookies which expire when not in use or the user de-authenticates.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Steghide Hidden Data Extraction

https://2.bp.blogspot.com/-Nz8u9CyJbsU/WWlveW9d4WI/AAAAAAAAIPw/tdSVtwWBcYIHlgRN6nbdKVd_fE-UdNKsACLcBGAs/s1600/h80.png
Stegcrack is an open-source program for exploiting a vulnerability in Steghide. Stegcrack detects whether a given file contains data hidden with Steghide, and can sometimes fully extract the hidden data, all with no password.

MD5 | 21ac61b8540814dd9c2f98ff906b7e38

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
5 Tips to Stay on the Offensive and Safeguard Your Attack Surface

New, global-scale attacks aren't a security problem; they're a big data problem requiring a data-led solution.

Dark Reading: Attacks/Breaches
Why Cloud Service Providers Are a Single Point of Failure

In a matter of days, a large-scale outage of cloud and other online services could cause $15 billion in losses.

Kali Linux Tutorials
LOLBins : PyQT5 App For LOLBAS And GTFOBins

PyQT app to list all Living Off The Land Binaries and Scripts for Windows from LOLBAS and Unix binaries that can be used to bypass local security restrictions in misconfigured systems from GTFOBins.
https://blogger.googleusercontent.com/img/a/AVvXsEgu0Nz9DKcgdQ349eEdGNzeLgleCUBdSFh64r4Vhxzwqv0Qwqwt0kgCfsuznsfW1jT4gikkeK_BrO4_MvzWA_cxmtzsufg56qT_bc8ZVBDH83eA-5X3phreGCBi_9p3__xv15QiVpK5BgpOQ7OYc1smEyZcd9AbME6RVi8VCIGx4xDkBoOq4prYvMXB=s728 Download

___________________________
@hacking_Attack
@Hacking_Video

Process Ghosting - EDR Evasion
https://www.reddit.com/r/redteamsec/comments/rbyh82/process_ghosting_edr_evasion/

submitted by /u/netbiosX (https://www.reddit.com/user/netbiosX)
[link] (https://pentestlaboratories.com/2021/12/08/process-ghosting/) [comments] (https://www.reddit.com/r/redteamsec/comments/rbyh82/process_ghosting_edr_evasion/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Boost your productivity with this JupyterLab Hack!

https://cdn-images-1.medium.com/max/1920/1*xTSstrClcAZ79szeBoK0qQ.jpeg
Do you ever start a new project by typingjupterlab in the Terminal only to get this error:

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Building your own Termux with a custom package name

Termux is an awesome Android app which emulates a linux environment. It allows you to run command line applications which is very useful…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
META is a dream world!

https://cdn-images-1.medium.com/max/600/0*ilQNrV-zbQw_yq2b.jpeg
Mark Zuckerberg has caused an explosion in the world, which is a significant event of the 21st century. Especially a milestone on the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video