t is highly recommended to apply the security updates as soon as possible. PoC exploits availableThe Cisco “Product Security Incident Response Team (PSIRT) states that they are aware of proof-of-concept exploit code available for several of the vulnerabilities fixed in these updates.

The CVE-2022-20699 vulnerability was discovered and used by the FlashBack Team during the Pwn2Own Austin 2021 hacking contest.

FlashBack’s Pedro Ribeiro says they will be demonstrating the exploit and releasing a public PoC as part of their talk at OffensiveCon 2022 titled “Pwn2Own’ing Your Router Over the Internet.

It is unknown what PoC exploits are available for the other vulnerabilities, however once security updates are released, these PoCs tend to become publicly fairly quickly.

Once they are public, threat actors will quickly utilize them in attacks, making it important to update any RV routers as soon as possible.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: How ILOVEYOU worm became the first global computer virus pandemic Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/b2b-90x90.jpg ESET antivirus bug let attackers gain Windows SYSTEM privileges1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/image6-90x90.png Cloudflare launches a paid public bug bounty program2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/do-any-web-page-convert-into-elementor-pro-template-90x90.jpg 600K WordPress sites impacted by critical plugin RCE vulnerability3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/hacking-windows-10-evade-detection-netstat-tasklist.1280x600-90x90.jpg Windows vulnerability with new public exploits lets you become admin4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ryanpickrenapplehack-768x768-1-90x90.jpg Apple pays out $100k bounty for Safari webcam hack that imperiled victims’ online accounts1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Apple-glitch-90x90.jpg Apple fixes new zero-day exploited to hack macOS, iOS devices1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/new-linux-kernel-memory-corruption-bug-causes-full-system-compromise-90x90.jpg Linux system service bug gives root on all major distros, exploit released1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/centos1-90x90.png CWP bugs allow code execution as root on Linux servers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/mcafee-d2c-90x90.jpg McAfee Bug Can Be Exploited to Gain Windows SYSTEM Privileges2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/ezgif.com-gif-maker-12-90x90.jpg Cisco bug gives remote attackers root privileges via debug mode2 weeks ago
The post Cisco patches critical vulnerabilities in SMB routers, exploitation available first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Kali Intelligence Suite : Shall Aid In The Fast, Autonomous, Central, And Comprehensive Collection Of Intelligence By Executing Standard Penetration Testing Tools

Kali Intelligence Suite (KIS) is an intelligence gathering and data mining tool for penetration testers. It shall aid in the fast, autonomous, central, and comprehensive collection of intelligence by automatically:

* executing Kali Linux tools (e.g., dnsrecon, gobuster, hydra, nmap, etc.)
* querying publicly available APIs (e.g., Censys.io, Haveibeenpwned.com, Hunter.io, Securitytrails.com, DNSdumpster.com, Shodan.io, etc.)
* storing the collected data in a central PostgreSQL database (see next section)
* providing an interface to query and analyze the gathered intelligence

After the execution of each Kali Linux tool or querying APIs, KIS analyses the collected information and extracts as well as reports interesting information like newly identified user credentials, hosts/domains, TCP/UDP services, HTTP directories, etc. The extracted information is then internally stored in different PostgreSql database tables, which enables the continuous, structured enhancement and re-use of the collected intelligence by subsequently executed Kali Linux tools.

Additional features are:

* pre-defined dependencies between Kali Linux tools ensure that relevant information like SNMP default community strings or default credentials is known to KIS before trying to access the respective services
* remembering the execution status of each Kali Linux tool and API query ensures that already executed OS commands are not automatically executed again
* data imports of scan results of external scanners like Masscan, Nessus, or Nmap
* supporting the intelligence collection based on virtual hosts (vhost)
* using a modular approach that allows the fast integration of new Kali Linux tools
* parallel Kali Linux command execution by using a specifiable number of threads
* enables users to kill Kali commands via the KIS user interface in case they take too long
* access public APIs to enhance data with OSINT Setup and Installation

The latest version of KIS is available at Docker.com. Follow the installation instructions there.

Information about manual installations can be obtained at INSTALL. KIS’ Data and Collection Model

The following figure illustrates KIS’ data and collection model. Thereby, each node represents a table in the rational database and each solid line between the nodes documents the corresponding relationship. The dashed directed graphs document based on which already collected intelligence (source node) KIS is able to collect further information (destination node). The labels of the directed graphs document the techniques used by KIS to perform the collection.
https://blogger.googleusercontent.com/img/a/AVvXsEjdI67woA8-oZ1clplx6NfNF5HfDwbT0IGb0LauN9aiNKEZI_-tairL4TyBXON2binuPdmV1vYdciYtYvlZFyOjIiSinUYuoPxvwzFIqDIzK8LP8QRM8Vh-bppcQBla9fWuMfOtkGkggVK2ZG9eQHuI4daRZbgHUZF94Y_IBSeBbnsticoEFRBhZOiW=s1039
Scoping the Engagement

Scoping is an essential feature of KIS, which specifies on which IP networks, IP addresses, host names, etc.,
KIS is allowed to collect data (e.g., via OSINT or active scans) from. Before diving into scoping, it is important to understand the following collection types, which are supported by KIS:

* Passive: Passive collections do not directly interact with the targets but obtain the information from third-party sources like whois. Per default, KIS automatically executes these collections and, thereby, no scoping is required.
* Active: Active collections directly interact with the targets by for example actively scanning them. Thus, in contrast to passive collections, these type of collection requires permission from the target’s owner and, therefore, KIS does not automatically perform active collections unless the[...]

___________________________
@hacking_Attack
@Hacking_Video

targets are explicitly marked as in scope.
* Active*: Active* collections are actually passive collections. Nevertheless, as accessing some third-party sources is somehow limited (e.g., querying certain sources like Shodan.io cost credits), they are treated like active collectors, and, as a result, targets must be marked as in scope in order to perform active* collections on them.

Scopes can be set on the following items by using the script kismanage:

* IP networks and IP addresses: For IP networks the following scope types can be set:
* all: Sets the given IP network (e.g., 192.168.1.0/24) together with all IP addresses (e.g., 192.168.1.1) that are within this network range in scope. As a result, KIS automatically executes any active and active* collectors on such IP networks and IP address. This scope type is useful during penetration tests where the scope is limited to certain IP networks and all their IP address. The following listing provides an example on how this scope type is set during the initial intel collection setup:
#create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
#add the network 192.168.1.0/24 to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage network -w example -a 192.168.1.0/24
#add new IP address 192.168.1.1 to workspace example. IP address is automatically in scope due to the network’s scope all
docker exec -it kaliintelsuite kismanage host -w example -a 192.168.1.1
#verify the initial setup
docker exec -it kaliintelsuite bash
kis_shell> kisreport host -w example –csv | csvcut -c “Network (NW)”,”Scope (NW)”,”IP Address (IP)”,”In Scope (IP)” | csvlook
Network (NW) Scope (NW) IP Address (IP) “In Scope (IP)”
192.168.1.0/24 all 192.168.1.1 True
kis_shell> exit

* exclude: Sets the given IP network (e.g., 192.168.1.0/24) together with all IP addresses (e.g., 192.168.1.1) that are within this network range out of scope. As a result, KIS does not execute any active and active* collectors on this IP network and its IP address.This scope type is the default type for all IP networks and IP addresses that are automatically identified by KIS (e.g., via whois, DNS resolution, etc.). Nevertheless, this scope type can be used to manually exclude networks from scope at a later time.

create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain megacorpone.com to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage domain -w example -a megacorpone.com
add new host names to workspace example. The host names are automatically in scope due to the second-level
domain’s scope all
docker exec -it kaliintelsuite kismanage hostname -w example -a www.megacorpone.com ftp.megacorpone.com
verify the initial setup
docker exec -it kaliintelsuite bash
kis_shell> kisreport domain -w example –csv | csvcut -c “Second-Level Domain (SLD)”,”Scope (SLD)”,”Host Name (HN)”,”In Scope (HN)” | csvlook
Second-Level Domain (SLD) | Scope (SLD) | Host Name (HN) | In Scope (HN) |
| megacorpone.com | all | megacorpone.com | True |
| megacorpone.com | all | www.megacorpone.com | True |
| megacorpone.com | all | ftp.megacorpone.com | True |
kis_shell> exit strict: Sets the given second-level domains (e.g., megacorpone.com) in scope. In contrast to type all, any sub-level domains (e.g., www.megacorpone.com) are not automatically in scope, unless they are explicitly added. As a result, KIS automatically executes any active or active* collectors on such in-scope second-level domains and additionally on those sub-level domains that are explicitly added to the scope.

This type is useful during penetration tests where the scope is limited to certain sub-level domains.

The following listing provides an example on how this scope type is set during the initial [...]

___________________________
@hacking_Attack
@Hacking_Video

intel collection setup:

create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain megacorpone.com to workspace example and set the scope to strict
docker exec -it kaliintelsuite kismanage domain -w example -a megacorpone.com -s strict
add new host names to workspace example. They are automatically in scope due to kismanage’s default value.
docker exec -it kaliintelsuite kismanage hostname -w example -a www.megacorpone.com ftp.megacorpone.com
verify the initial setup
docker exec -it kaliintelsuite bash
kis_shell> kisreport domain -w example –csv | csvcut -c “Second-Level Domain (SLD)”,”Scope (SLD)”,”Host Name (HN)”,”In Scope (HN)” | csvlook
Second-Level Domain (SLD) | Scope (SLD) | Host Name (HN) | In Scope (HN) |
| megacorpone.com | strict | megacorpone.com | False |
| megacorpone.com | strict | www.megacorpone.com | True |
| megacorpone.com | strict | ftp.megacorpone.com | True |
kis_shell> exit
Note that KIS treats the second-level domain also as a host name. As it has not been explicitly put in scope, it
is still out of scope.

* exclude: Sets the given second-level domains (e.g., megacorpone.com) together with all sub-level domains out of scope. As a result, KIS does not execute any active and active* collectors on these second-level domains. This scope type is the default type for all second-level domains and their sub-level domains that are automatically identified by KIS (e.g., via extraction from certificates, etc.). Thus, it is not necessary to explicitly set this scope type. Nevertheless, this scope type can be used to manually exclude second-level domains at a later time.

create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain google.com to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage domain -w example -a google.com

In this case, KIS is able to, among other things, enumerate any sub-level domains as well as resolve their corresponding IP addresses. In addition, to ensure that KIS scans any host with an IP address within the IP network range 172.217.0.0/16, this network range must be added to KIS with scope type allas well:

add the network 172.217.0.0/16 to workspace example and set the scope to all (default)

docker exec -it kaliintelsuite kismanage network -w example -a 172.217.0.0/16

Example 2: Let’s assume the second-level domain google.com together with all sub-level domains that resolve to any network range are in scope. In this case, the top-level domain google.com is added to the KIS database with scope type allas documented below:

create a new workspace example
docker exec -it kaliintelsuite kismanage workspace -a example
add the second-level domain google.com to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage domain -w example -a google.com

In this case, KIS is able to, among other things, enumerate any sub-level domains as well as resolve their corresponding IP addresses. In addition, to ensure that KIS scans any host, the network range 0.0.0.0/0 must be added to KIS with scope type allas well:

add network 0.0.0.0/0 to workspace example and set the scope to all (default)
docker exec -it kaliintelsuite kismanage network -w example -a 0.0.0.0/0

List of KIS Collectors

The following table shows the list of existing collectors that are supported by KIS. These collectors are executed by the script kiscollectto create and execute actual OS commands.

The Priority column provides information about the order of execution; the lower the number, the earlier the respective OS commands are created and executed and subsequent collectors can profit from the already collected information. Collectors with a priority of -are not automatically executed as they ei[...]

___________________________
@hacking_Attack
@Hacking_Video

ther require user interaction or additional information (e.g., domain credentials) for execution.

The Name column contains the name of the collector. These names can be added as command line arguments to kiscollect(e.g. --httpnikto). The name also indicates, which underlying OS command is executed.

Column Level specifies whether the collector is operating on:

* services: Scans services by using IPv4/IPv6 addresses and UDP/TCP port numbers
* vhosts: Scans web services by using host names (instead of IP addresses) and TCP port numbers
* hosts: Obtains information based on IPv4/IPv6 addresses
* domains: Obtains information based on second-level domains and optionally sub-level domains
* networks: Obtains information based on IPv4/IPv6 network ranges
* emails: Obtains information based on emails
* companies: Obtains information based on companies

Column Type specifies whether the collector actively approaches the target (active) or obtains the information from third-party sources (passive and active*).

The IP Support column specifies the IP versions, which are supported by the underlying Kali tool (e.g., gobuster). Kali uses this information to decide which operating systems commands can be created and successfully executed. This column is only relevant for host, network, service, and vhost collectors (see column Level).

Column Timeout specifies the number of seconds after which the collector is automatically terminated.

The column User specifies the user with which the respective operating system commands are executed.
PriorityNameLevelTypeIP SupportTimeoutUser–ftpdotdotpwnserviceActiveIPv4, IPv6–nobody–httpdotdotpwnserviceActiveIPv4, IPv6–nobody–tftpdotdotpwnserviceActiveIPv4, IPv6–nobody–httphydraserviceActiveIPv4, IPv6–nobody–rdphydraserviceActiveIPv4, IPv6–nobody–smbhydraserviceActiveIPv4, IPv6–nobody–smbmedusaserviceActiveIPv4–nobody–smbmsfloginserviceActiveIPv4, IPv6–root–sshhydraserviceActiveIPv4, IPv6–nobody125builtwithdomainActive*––nobody127hostiodomainActive*––nobody130censysdomaindomainActive*––kali131securitytrailsdomainActive*––nobody132dnsdumpsterdomainActive*––nobody133certspotterdomainActive*––nobody134crtshdomaindomainActive*––nobody135virustotaldomainActive*––nobody140dnssublist3rdomainActive––nobody141dnsamasspassivedomainActive*––nobody142dnsamassactivedomainActive––nobody143dnscrobatdomaindomainActive*––nobody144dnscrobattlddomainActive*––nobody150theharvesterdomainPassive––kali155awsslurpdomainActive––nobody160dnsenumdomainActive––nobody170dnsgobusterdomainActive––nobody180dnsrecondomainActive––nobody210whoisdomaindomainActive–30nobody215dnsspfdomainActive––nobody220dnsdmarcdomainActive––nobody235dnsdkimdomainActive––nobody240dnstakeoverdomainActive––nobody310dnshostdomainActive––nobody312dnshostpublicdomainPassive––nobody320dnsreverselookuphostActiveIPv4, IPv6–nobody360dnscrobatreversehosthostActive*IPv4, IPv6–nobody410hunterdomainActive*––nobody420haveibeenbreachemailActive*––nobody430haveibeenpasteemailActive*––nobody510whoishosthostPassiveIPv4, IPv630nobody512whoisnetworknetworkPassiveIPv4, IPv630nobody515reversewhoiscompanyActive*––nobody520shodanhosthostActive*IPv4, IPv6–nobody521shodannetworknetworkActive*IPv4, IPv6–nobody530censyshosthostActive*IPv4–kali540crtshcompanycompanyActive*––nobody550dnscrobatreversenetworknetworkActive*IPv4, IPv6–nobody1100tcpnmapnetworknetworkActiveIPv4, IPv6–root1150tcpnmapdomaindomainActiveIPv4, IPv6–root1200udpnmapnetworknetworkActiveIPv4, IPv6–root1250udpnmapdomaindomainActiveIPv4, IPv6–root1270icmpnmapnetworknetworkActiveIPv4, IPv6–root1300tcpmasscannetworknetworkActiveIPv4–root1305dnsaxfrdomaindomainActive––nobody1306dnsaxfrserviceserviceActive*Ipv4, Ipv6–nobody1320vhostgobusterserviceActiveIPv4, IPv6–nobody1350anyservicenmapserviceActiveIPv4, IPv6–root1820tcptraceroutehostActiveIPv4, IPv6–nobody1900httpmsfrobotstxtservice, vhostActiveIPv4, IPv6–root2000dnsnmapserv[...]

___________________________
@hacking_Attack
@Hacking_Video

iceActiveIPv4, IPv6–root2020telnetnmapserviceActiveIPv4, IPv6–root2040vncnmapserviceActiveIPv4, IPv6–root2100mssqlnmapserviceActiveIPv4, IPv6–root2150mysqlnmapserviceActiveIPv4, IPv6–root2200smbnmapserviceActiveIPv4, IPv6–root2250ftpnmapserviceActiveIPv4, IPv6–root2300smtpnmapserviceActiveIPv4, IPv6–root2400rpcnmapserviceActiveIPv4, IPv6–root2500rdpnmapserviceActiveIPv4, IPv6–root2700pop3nmapserviceActiveIPv4, IPv6–root2750msrpcenumserviceActiveIPv4, IPv6–root2800imapnmapserviceActiveIPv4, IPv6–root2850x11nmapserviceActiveIPv4, IPv6–root2900tftpnmapserviceActiveIPv4, IPv6–root2950nfsnmapserviceActiveIPv4, IPv6–root3100fingerserviceActiveIPv4–nobody3200ntpdateserviceActiveIPv4, IPv6–nobody3300ntpqserviceActiveIPv4, IPv6–nobody4000h323versionserviceActiveIPv4, IPv6–root4100sipnmapserviceActiveIPv4, IPv6–root4120sipmsfserviceActiveIPv4, IPv6–root4200stunnmapserviceActiveIPv4, IPv6–root11000vncmsfnoneauthserviceActiveIPv4, IPv6–root11010vncmsfloginserviceActiveIPv4, IPv6–root11100ftphydraserviceActiveIPv4, IPv6–nobody11200mssqlhydraserviceActiveIPv4, IPv6–nobody11400pgsqlhydraserviceActiveIPv4, IPv6–nobody11500snmphydraserviceActiveIPv4, IPv6–nobody11600sshchangemeserviceActiveIPv4, IPv6–kali11610httpchangemeservice, vhostActiveIPv4, IPv6–kali11700ipmiserviceActiveIPv4, IPv6–root11750rmiregistrymsfgatherserviceActiveIPv4, IPv6–root11760rmiregistrynmapserviceActiveIPv4, IPv6–root12100ftpfilelistserviceActiveIPv4, IPv6–nobody13000showmountserviceActiveIPv4, IPv6300nobody13090smbcmeserviceActiveIpv4, Ipv6–kali13100smbclientserviceActiveIPv4, IPv6–nobody13200smbfilelistserviceActiveIPv4, IPv6–nobody13210smbmapserviceActiveIPv4–nobody21500nbtscanserviceActiveIPv4–nobody21600ldapsearchserviceActiveIPv4, IPv6–nobody21610ldapnmapserviceActiveIPv4, IPv6–root31100snmpcheckserviceActiveIPv4300nobody31110snmpnmapserviceActiveIPv4, IPv6–root31200onesixtyoneserviceActiveIPv460nobody31300snmpwalkserviceActiveIPv4–nobody31400oraclesidguessserviceActiveIPv4–nobody41200sshnmapserviceActiveIPv4, IPv6–root41300certnmapservice, vhostActiveIPv4, IPv6–root41310tlsnmapservice, vhostActiveIPv4, IPv6–root41315sslyzeservice, vhostActiveIPv4–nobody41320sslscanservice, vhostActiveIPv4, IPv6–nobody41330certopensslservice, vhostActiveIPv4, IPv6120nobody51100httpgobusterservice, vhostActiveIPv4, IPv6–nobody51110httpgobustersmartservice, vhostActiveIPv4, IPv6–nobody51150httpkiterunnerservice, vhostActiveIpv4–kali51200httpnmapservice, vhostActiveIPv4, IPv6–root51205httpntlmnmapservice, vhostActiveIPv4, IPv6–root61400rpcclientserviceActiveIPv4, IPv6–nobody61500rpcinfoserviceActiveIPv4, IPv6–nobody71100ikescanserviceActiveIPv4–root91050httpwpscanserviceActiveIPv4, IPv6–kali91100enum4linuxserviceActiveIPv4–nobody91200httpniktoservice, vhostActiveIPv4–nobody91225httpburpsuiteprodomain, hostActiveIPv4, IPv6–nobody91250httpdavtestservice, vhostActiveIPv4, IPv6–nobody91260httpwhatwebserviceActiveIPv4, IPv6–nobody91300httpsqlmapservice, vhostActiveIPv4, IPv6–nobody91400smtpuserenumserviceActiveIPv4–nobody91600mysqlhydraserviceActiveIPv4, IPv6–nobody92200httpwapitiservice, vhostActiveIPv4, IPv6–nobody100000vncviewerserviceActiveIPv4–nobody100100httpeyewitnessservice, vhostActiveIPv4, IPv63600kali Usage

After the setup, the following KIS commands are available. kismanage

This script allows:

* setting up and testing KIS
* managing the database (re-creation, creating backups, restoring backups, etc.)
* creating workspaces, networks, host names, emails, companies, etc.
* importing Nmap, Nessus, and Masscan scan results
* defining the scope

Run the following command to obtain more information and examples:

docker exec -it kaliintelsuite kismanage -h

kiscollect

This script implements a commandline interface to collect the intelligence.

Run the following command to obtain more information and examples:

docker exec -it kaliintelsuite kiscollect -h

kisreport

This script allows the analysis of the collected data via various filtering op[...]

___________________________
@hacking_Attack
@Hacking_Video

tions. Supported report formats are:

* Character-separated values (CSV): Export of the collected intelligence in the structured CSV format. This allows further processing via tools like grep, csvcut, or Aquatone
* Microsoft Excel: Export of all collected intelligence into a Microsoft Excel file.
* Text: Export of the collected raw text intelligence (e.g., text output of tool Nikto).
* Raw: Export of additionally collected files like JSON objects from APIs like Shodan.io, or certificate files.

Run the following command to obtain more information and examples:

docker exec -it kaliintelsuite kisreport -h Download

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How OpenBullet is Used And Abused By Cybercriminals

https://cdn-images-1.medium.com/max/940/0*_TDcdPdYFII-CSl-.png
Although designed to aid security professionals, in the wrong hands OpenBullet can be abused for the opposite purpose.

Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Anatomy Of An Email Scam

https://cdn-images-1.medium.com/max/640/1*8uEgDQ3CHSPWabhq0BNk-w.jpeg
Tell-tale signs an email is a scam and what to do if you’ve responded to one

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to not be a script kiddie in 2022

https://cdn-images-1.medium.com/max/600/0*h7PVAWMXNmbu0o0e
If you are interested in InfoSec/Cyber security you have probably heard the term “script kiddie/skiddie”. You might’ve wondered what that…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Lessons We Can Learn From The Wormhole Bridge Hack

https://cdn-images-1.medium.com/max/2600/0*RvmGtnWh55w_5lH5
This week one of the largest DeFi bridge between Solana and Ethereum has been hacked in what deemed to be the second largest hack ever:

Continue reading on Godly Dev »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Elfloader - An Architecture-Agnostic ELF File Flattener For Shellcode

___________________________
@hacking_Attack
@Hacking_Video

Elfloader - An Architecture-Agnostic ELF File Flattener For Shellcode
http://www.kitploit.com/2022/02/elfloader-architecture-agnostic-elf.html

___________________________
@hacking_Attack
@Hacking_Video

--binary - Don't output a FELF, output the raw loaded image with no
metadata
--base= - Force the output to start at ``, zero padding from
the base to the start of the first LOAD segment if needed.
`` is default hex, can be overrided with `0d`, `0b`,
`0x`, or `0o` prefixes.
Warning: This does not _relocate_ to base, it simply starts
the output at `` (adding zero bytes such that the
output image can be loaded at `` instead of the
original ELF base)
- Path to input ELF
- Path to output file
To install this tool run: cargo install --path . Now you can use elfloader from anywhere in your shell! Dev This project was developed live here: https://www.youtube.com/watch?v=x0V-CEmXQCQ Example There's an example in example_small_program, simply run make or nmake and this should generate an example.bin which is 8 bytes. : 133700b0: 8b000020 add x0, x1, x0 133700b4: d65f03c0 ret">pleb@gamey ~/elfloader/example_small_program $ make
cargo build --release
Finished release [optimized] target(s) in 0.03s
elfloader --binary target/aarch64-unknown-none/release/example_small_program example.bin
pleb@gamey ~/elfloader/example_small_program $ ls -l ./example.bin
-rw-r--r-- 1 pleb pleb 8 Nov 8 12:27 ./example.bin

pleb@gamey ~/elfloader/example_small_program $ objdump -d target/aarch64-unknown-none/release/example_small_program

target/aarch64-unknown-none/release/example_small_program: file format elf64-littleaarch64


Disassembly of section .text:

00000000133700b0 :
133700b0: 8b000020 add x0, x1, x0
133700b4: d65f03c0 ret
Now you can write your shellcode in Rust, and you don't have to worry about whether you emit .data, .rodata, .bss, etc. This will handle it all for you! There's also an example with .bss and .rodata : 13370124: 90000000 adrp x0, 13370000 13370128: 90000008 adrp x8, 13370000 1337012c: 52800029 mov w9, #0x1 // #1 13370130: 91048000 add x0, x0, #0x120 13370134: 3904f109 strb w9, [x8, #316] 13370138: d65f03c0 ret pleb@gamey ~/elfloader/example_program_with_data $ readelf -l target/aarch64-unknown-none/release/example_program_with_data Elf file type is EXEC (Executable file) Entry point 0x13370124 There are 4 program headers, starting at offset 64 Program Headers: Type Offset VirtAddr PhysAddr FileSiz MemSiz Flags Align LOAD 0x0000000000000120 0x0000000013370120 0x0000000013370120 0x0000000000000004 0x0000000000000004 R 0x1 LOAD 0x0000000000000124 0x0000000013370124 0x0000000013370124 0x0000000000000018 0x0000000000000018 R E 0x4 LOAD 0x000000000000013c 0x000000001337013c 0x000000001337013c 0x0000000000000000 0x0000000000000001 RW 0x4 GNU_STACK 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 RW 0x0 Section to Segment mapping: Segment Sections... 00 .rodata 01 .text 02 .bss 03 ">pleb@gamey ~/elfloader/example_program_with_data $ make
cargo build --release
Finished release [optimized] target(s) in 0.04s
elfloader --binary target/aarch64-unknown-none/release/example_program_with_data example.bin
pleb@gamey ~/elfloader/example_program_with_data $ ls -l ./example.bin
-rw-r--r-- 1 pleb pleb 29 Nov 8 12:39 ./example.bin
pleb@gamey ~/elfloader/example_program_with_data $ objdump -d target/aarch64-unknown-none/release/example_program_with_data

___________________________
@hacking_Attack
@Hacking_Video