Hacking on Medium
DC-4 VM WalkThrough

https://cdn-images-1.medium.com/max/716/0*ODdMgQHywig85BrG
Makineyi indirebilirsiniz.

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
¿Qué es el malware?

https://cdn-images-1.medium.com/max/800/1*OWCel0y6ppxgG6URK_FbRg.jpeg
La palabra malware es una contracción de “software malicioso”, que en inglés significa código de programa malicioso. El malware cubre una…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How do i hack one of the famous Virtual Youtuber Agencies in Indonesia

https://cdn-images-1.medium.com/max/640/1*4vLdJ3cseEydRuN6EEi57Q.gif
Hello guys, hope u are fine. It’s been almost 5 months i haven’t done any hacking activity *lol . The last few years the internet world is…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Some critical vulnerabilities found with passive analysis on bug bounty programs explained

https://cdn-images-1.medium.com/max/1327/1*wgNKbh2qJC5DfTsTE_Q4ow.png
This post describes three vulnerabilities found on paid bounty programs along with an overview about how it was found and the performed…

Continue reading on InfoSec Write-ups »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Some critical vulnerabilities found with passive analysis on bug bounty programs explained

This post describes three vulnerabilities found on paid bounty programs along with an overview about how it was found and the performed…Continue reading on InfoSec Write-ups »
Read more...

The Bad Twin: a peculiar case of JWT exploitation scenario

Hey Everyone,Continue reading on Medium »
Read more...

Black Hat Ethical Hacking
Mozilla Firefox 97.0.2 fixes two actively exploited zero-day bugs

___________________________
@hacking_Attack
@Hacking_Video

PwnKit-Exploit - Proof Of Concept (PoC) CVE-2021-4034
http://www.kitploit.com/2022/03/pwnkit-exploit-proof-of-concept-poc-cve.html

___________________________
@hacking_Attack
@Hacking_Video

Proof Of Concept (PoC) CVE-2021-4034  @c0br40x help to make this section in README!!
Proof of Concept

___________________________
@hacking_Attack
@Hacking_Video

debian@debian:~/PwnKit-Exploit$ make
cc -Wall exploit.c -o exploit
debian@debian:~/PwnKit-Exploit$ whoami
debian
debian@debian:~/PwnKit-Exploit$ ./exploit
Current User before execute exploit
hacker@victim$whoami: debian
Exploit written by @luijait (0x6c75696a616974)
[+] Enjoy your root if exploit was completed succesfully
root@debian:/home/debian/PwnKit-Exploit# whoami
root
root@debian:/home/debian/PwnKit-Exploit#
Fix Command Use sudo chmod 0755 pkexec Fix CVE (https://www.kitploit.com/search/label/CVE) 2021-4034 Installation & Use git clone https://github.com/luijait/PwnKit-Exploit cd PwnKit-Exploit make ./exploit whoami Command Utility make clean Clean build to test code modified Explanation Based blog.qualys.com The beginning of pkexec’s main() function processes the command-line arguments (lines 534-568), and searches for the program to be executed, if its path is not absolute, in the directories of the PATH environment variable (lines 610-640): 435 main (int argc, char *argv[])
436 {
...
534 for (n = 1; n < (guint) argc; n++)
535 {
...
568 }
...
610 path = g_strdup (argv[n]);
...
629 if (path[0] != '/')
630 {
...
632 s = g_find_program_in_path (path);
...
639 argv[n] = path = s;
640 } unfortunately, if the number of command-line arguments argc is 0 – which means if the argument list argv that we pass to execve() is empty, i.e. {NULL} – then argv[0] is NULL. This is the argument list’s terminator. Therefore: at line 534, the integer n is permanently set to 1; at line 610, the pointer path is read out-of-bounds from argv[1]; at line 639, the pointer s is written out-of-bounds to argv[1]. But what exactly is read from and written to this out-of-bounds argv[1]? To answer this question, we must digress briefly. When we execve() a new program, the kernel (https://www.kitploit.com/search/label/Kernel) copies our argument, environment strings, and pointers (argv and envp) to the end of the new program’s stack; for example: |---------+---------+-----+------------|---------+---------+-----+------------|
| argv[0] | argv[1] | ... | argv[argc] | envp[0] | envp[1] | ... | envp[envc] |
|----|----+----|----+-----+-----|------|----|----+----|----+-----+-----|------|
V V V V V V

"program" "-option" NULL "value" "PATH=name" NULL
Clearly, because the argv and envp pointers are contiguous in memory, if argc is 0, then the out-of-bounds argv[1] is actually envp[0], the pointer to our first environment variable, “value”. Consequently: At line 610, the path of the program to be executed is read out-of-bounds from argv[1] (i.e. envp[0]), and points to “value”; At line 632, this path “value” is passed to g_find_program_in_path() (because “value” does not start with a slash, at line 629); Then, g_find_program_in_path() searches for an executable file named “value” in the directories of our PATH environment variable; If such an executable file is found, its full path is returned to pkexec’s main() function (at line 632); Finally, at line 639, this full path is written out-of-bounds to argv[1] (i.e. envp[0]), thus overwriting our first environment variable. So, stated more precisely: If our PATH environment variable is “PATH=name”, and if the directory (https://www.kitploit.com/search/label/Directory) “name” exists (in the current working directory) and contains an executable file named “value”, then a pointer to the string “name/value” is written out-of-bounds to envp[0]; OR If our PATH is “PATH=name=.”, and if the directory “name=.” exists and contains an executable file named “value”, then a pointer to the string “name=./value” is written out-of-bounds to envp[0]. In other words, this out-of-bounds write allows us to re-introduce an “unsecure” environment variable (for example, LD_PRELOAD) into pkexec’s environment. These “unsecure” variables are normally

___________________________
@hacking_Attack
@Hacking_Video

removed (by ld.so) from the environment of SUID programs before the main() function is called. We will exploit this powerful primitive in the following section. Last-minute note: polkit also supports non-Linux operating systems such as Solaris (https://www.kitploit.com/search/label/Solaris) and *BSD, but we have not investigated their exploitability. However, we note that OpenBSD (https://www.kitploit.com/search/label/OpenBSD) is not exploitable, because its kernel refuses to execve() a program if argc is 0.

Download PwnKit-Exploit (https://github.com/luijait/PwnKit-Exploit)

___________________________
@hacking_Attack
@Hacking_Video

My First Bug Bounty Reward

A blog about how I found my first blog and Some learning about bug bounty, which is very important for every bug bounty hunter.
Read more...

Methods to Bypass two-factor Authentication

There are multiple ways to bypass two-factor authentication. One of its kind here.
Read more...

hacking: security in practice
How likely is it that some if not most of the Anonymous campaign regarding the invasion of Ukraine are done by gov agencies under the disguise of Anonymous ?

I've heard this rumour multiple times but are there any evidence sustaining this ? Were there actions done that only a large institution could have executed? Or are maybe some hacker groups claiming the attacks (similar to some terrorist attacks) to gain recognition.

I have no doubt that private individuals have done a lot to help Ukraine and I'm not trying to minimise this, but is it possible/likely that some were done by state organisations but use the Anonymous as a decoy (Anonymous being only an organisationin name)?

submitted by /u/harrynadir
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Express TestNet Bug Bounty Program

The Express Protocol Testnet is LIVE! With this launch, we have got one step closer to achieving our grand vision of building a…Continue reading on Pandora Finance »
Read more...

Kali Linux Tutorials
Iptable_Evil : An Evil Bit Backdoor For Iptables

Iptable_Evilis a very specific backdoor for iptablesthat allows all packets with the evil bit set, no matter the firewall rules.

The initial implementation is in iptable_evil.c, which adds a table to iptablesand requires modifying a kernel header to insert a spot for it. The second implementation is a modified version of the ip_tablescore module and its dependents to allow all Evil packets.

I have tested it on Linux kernel version 5.8.0-48, but this should be appliciable to pretty much any kernel version with a full implementation of iptables. Explanation of the Evil Bit

RFC3514, published April 1st, 2003, defines the previously-unused high-order bit of the IP fragment offset field as a security flag. To RFC-compliant systems, a 1in that bit position indicates evil entent and will cause the packet to be blocked.

By default, this bit is turned off, but can be turned on in your software if you’re assembling the entirety of your IP packet (as some hacking tools do), or in the Linux kernel using this patch (mirrored in this repository here). How does the backdoor work?

When a packet is received by the Linux kernel, it is processed by iptablesand either sent to user space, rejected, or modified based on the rules configured.

In particular, each iptablestable uses the function ipt_do_tablein ip_tables.cto decide whether to accept a given packet. I have modified that to automatically accept any packet with the evil bit set and skip all further processing.

I also attempted to add another table (iptable_evil.c) that would accept all evil packets and hand others off to the standard tables for processing, but I never figured out how to pass the packets to the next table and decided that the ipt_do_tablebackdoor was enough as a proof of concept. Why did you do this?

I needed to do and write up a decently large project in computing security for one of my classes, and this seemed like a cool idea. This is probably more work than he was expecting for this but ¯\_(ツ)_/¯. Build In-Tree Build

The eviltable requires modification of kernel headers, so installing it requires running with a kernel produced through the full tree build.

* Copy the contents of replace-existingto your kernel source tree, overwriting existing files.
* Copy iptable_evil.cto linux-X.Y.Z/net/ipv4/netfilter* (optional) copy ip_tables.cto linux-X.Y.Z/net/ipv4/netfilter* Compile the kernel according to your distro’s process (should produce a package)
* Install the package file
* Reboot into your new kernel
* iptables -t filter -L* iptables -t evil -L(this will have confused output, but it will load the module) Out-of-Tree Build

This is significantly easier and faster, but does not support the eviltable and marks the kernel as “tainted”. It should be possible to copy the kofiles produced by this to another computer with the exact same kernel version, but I haven’t tested it.

* Run make* rmmod iptable_** rmmod ip_tables* insmod ip_tables.ko* insmod iptable_filter.koTesting/Demo

To test this, you either need to rebuild your entire kernel with this patch or create your own packets using a tool like Scapy. I went with the first option because I was already building the kernel for the eviltable.

In the first screenshot, I have blocked all traffic to this VM in iptables, but I am still able to connect over SSH because my packets have the evil bit set, as the second screenshot shows.
https://blogger.googleusercontent.com/img/a/AVvXsEhUVZq[...]

___________________________
@hacking_Attack
@Hacking_Video