Black Hat Ethical Hacking
New Linux bug gives root on all major distros, exploit released

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png New Linux bug gives root on all major distros, exploit releasedPost Views: 2
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
A new Linux vulnerability known as ‘Dirty Pipe’ allows local users to gain root privileges through publicly available exploits.
Today, security researcher Max Kellermann responsibly disclosed the ‘Dirty Pipe’ vulnerability and stated that it affects Linux Kernel 5.8 and later versions, even on Android devices.

The vulnerability is tracked as CVE-2022-0847 and allows a non-privileged user to inject and overwrite data in read-only files, including SUID processes that run as root.

Kellerman discovered the bug after tracking down a bug that was corrupting web server access logs for one of his customers.

Kellerman states that the vulnerability is similar to the Dirty COW vulnerability (CVE-2016-5195) fixed in 2016.
See Also: Complete Offensive Security and Ethical Hacking Course Public exploits give root privileges As part of the Dirty Pipe disclosure, Kellerman released a proof-of-concept (PoC) exploit that allows local users to inject their own data into sensitive read-only files, removing restrictions or modifying configurations to provide greater access than they usually would have.

For example, security researcher Phith0n illustrated how they could use the exploit to modify the /etc/passwd file so that the root user does not have a password. Once this change is made, the non-privileged user could simply execute the ‘su root‘ command to gain access to the root account.
Why did I overwrite the /etc/passwd?
Because this file saves all the user information on Linux.
I remove the "x" flag behind the "root" user, it means that I set an empty password for this user. So I can use "su root" to escalate privilege without credentials.

— Phith0n (@phithon_xg) March 7, 2022
However, an updated exploit by security researcher BLASTY was also publicly released today that makes it even easier to gain root privileges by patching the /usr/bin/su command to drop a root shell at /tmp/sh and then executing the script.

Once executed, the user gains root privileges, as demonstrated by BleepingComputer below in Ubuntu 20.04.3 LTS running the 5.13.0-27-generic kernel.
https://www.bleepstatic.com/images/news/security/attacks/l/linux/dirtypipe/dirtypipe-poc.jpg
___________________________
@hacking_Attack
@Hacking_Video

These include privilege elevation vulnerabilities in the Linux iSCSI subsystem, another kernel bug, the Extended Berkeley Packet Filter (eBPF), and Polkit’s pkexec component. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: bleepingcomputer.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/01/merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/firefox-90x90.jpg Mozilla Firefox 97.0.2 fixes two actively exploited zero-day bugs22 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/small-business-internet-security-90x90.jpg Google WAF bypassed via oversized POST requests4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-4-90x90.jpg Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-3-90x90.jpg RCE Bugs in WhatsApp, Other Hugely Popular VoIP Apps: Patch Now!6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/download-90x90.jpg Cyber-attack on Nvidia linked to Lapsus$ ransomware gang1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/GettyImages-802535150-1-90x90.jpg Conti ransomware’s internal chats leaked after siding with Russia1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/6469-article-220223-ukraine-body-text-90x90.jpg Data wiper deployed in cyber-attacks targeting Ukrainian systems2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/T8F9rL5Ub6TRWHtQwsVCK6-1200-80-90x90.jpg Samsung Shattered Encryption on 100M Phones2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/4346-article-220222-airtags-body-text-90x90.jpg AirTag clone bypassed Apple’s tracking-protection features, claims researcher2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Banner-Img-AWS-90x90.jpg Introducing Ghostbuster – AWS security tool protects against dangling elastic IP takeovers2 weeks ago
The post New Linux bug gives root on all major distros, exploit released first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Full Account Takeover due to improper validation of old password
https://medium.com/@vamshivaran110/full-account-takeover-due-to-improper-validation-of-old-password-d4b9f4eec3f8?source=rss------bug_bounty-5

Hello Hackers and Security community. I’m going to share how I’m able find the bug.Continue reading on Medium » (https://medium.com/@vamshivaran110/full-account-takeover-due-to-improper-validation-of-old-password-d4b9f4eec3f8?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

GraphQL Cop - Security Auditor Utility For GraphQL APIs

GraphQL Cop is a small Python utility to run common security tests against GraphQL APIs. Requirements Python3 Requests Library Detections Alias Overloading (DoS) Batch Queries (DoS) GET based Queries (CSRF) GraphQL Tracing / Debug Modes (Info Leak) Field Duplication (DoS) Field Suggestions (Info Leak) GraphiQL (Info Leak) Introspection (Info Leak) Directives Overloading (DoS) Usage CSRF (GET)': {'severity': 'LOW', 'impact': 'Possible CSRF', 'description': 'HTTP GET method supported (maybe CSRF)'}, 'Alias Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Alias Overloading with 100+ aliases is allowed'}, 'Field Duplication': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Queries are allowed with 1000+ of the same repeated field'}, 'Directive Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Multiple duplicated directives allowed in a query'}}">python3 main.py -t https://mywebsite.com/graphql GraphQL Cop 1.0 Security Auditor for GraphQL Dolev Farhi Starting...HIGH Introspection Query Enabled (Information Leakage)LOW GraphQL Playground UI (Information Leakage)HIGH Alias Overloading with 100+ aliases is allowed (Denial of Service)HIGH Queries are allowed with 1000+ of the same repeated field (Denial of Service)python3 main.py -t https://mywebsite.com/graphql -o json{'Field Suggestions': {'severity': 'LOW', 'impact': 'Information Leakage', 'description': 'Field Suggestions are Enabled'}, 'Introspection': {'severity': 'HIGH', 'impact': 'Information Leakage', 'description': 'Introspection Query Enabled'}, 'Possible CSRF (GET)': {'severity': 'LOW', 'impact': 'Possible CSRF', 'description': 'HTTP GET method supported (maybe CSRF)'}, 'Alias Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Alias Overloading with 100+ aliases is allowed'}, 'Field Duplication': {'severity': ' HIGH', 'impact': 'Denial of Service', 'description': 'Queries are allowed with 1000+ of the same repeated field'}, 'Directive Overloading': {'severity': 'HIGH', 'impact': 'Denial of Service', 'description': 'Multiple duplicated directives allowed in a query'}} Download Graphql-Cop
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Full Account Takeover due to improper validation of old password

Hello Hackers and Security community. I’m going to share how I’m able find the bug.Continue reading on Medium »
Read more...

Kali Linux Tutorials
Considerations When Building A Future-Proof Security Strategy For Your Business

Developing a security strategy for your business shouldn’t just be about the here and now. If you want your business to grow, you need a security system to scale with you. If computer speeds double every 18 months, what does that mean for other technical aspects?

While there is no way to completely keep up with technological advancements, you can future-proof your security strategy to minimise disruption. Why Do You Need to Future-Proof Your Security? The security system you implement today will likely become outdated a few years down the line, if not more. While there is little you can do about that, you can ensure that your strategy stands the test of time. You may have to update security technology and software to keep up. However, this is part of your security strategy.

Here are a few reasons future-proofing your security strategy is a must:

* Reduce the risk of cyber and physical threats
* Enable your security system to scale with you
* Stay up to date on all your security matters
* React quickly to new threats
* Save yourself time and energy implementing new technology What Security Threats Will You Face?Traditionally, we thought of security as a physical presence, such as hiring a guard or using video security cameras to deter physical threats. Now, we might think of firewalls and software preventing phishing, hacking, or other cyber threats. However, cyber and physical threats are not two separate entities.

Security threats you might face:

* Internal security incidents
* External hacking attempts
* Accidental employee data breach
* Third-party risks
* Poor incident response

Your security strategy should detail each potential threat and the steps to mitigate risks. As time goes on, new types of security threats may emerge. Outlining a solid incident response will help prevent damage in such cases. Compliance Isn’t the EndgameEvery industry has its form of compliance. Usually, these are regulations that you’re legally bound to follow. However, laws change. Just because there are a particular set of rules in place today (e.g., GDPR) doesn’t mean that these will stay the same forever.

Relying on sticking to compliance as a baseline will lead to complacency. Instead, implementing your own set of rules will help manage your security and protect you if compliance regulations change. Proactively Manage Systems Proactively managing your networks will help you prevent threats before they arise. Even minor disruptions, such as high traffic causing slow loading times on your website, should be dealt with immediately. If you employ real-time management security, you can prevent downtime from causing a significant issue.

Additionally, proactive management will help you spot new threats as they appear. Your security strategy should always include a proactive management plan. Implement and Update Security TechnologySecurity technology improves day by day. While you cannot always buy the latest technology, your future-proofed security strategy should allow for regular updates. Plan to conduct routine analysis of your physical and cyber security systems. Check whether they’re still doing the job they’re supposed to and if there are more cost-effective solutions available. Merging Cyber and Physical SecurityThe best way to future-proof your security strategy is to start merging your cyber and physical security technology. Cloud-based physical security can integrate with your cyber platforms to keep all your data in one place. As technology advances, integrated systems are increasingly popular.

Physical and cyber security have the same goal: to prevent and respond to threats. When you start viewing them as the same[...]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Driftwood : Private Key Usage Verification

Driftwood is a tool that can enable you to lookup whether a private key is used for things like TLS or as a GitHub SSH key for a user.

Driftwood performs lookups with the computed public key, so the private key never leaves where you run the tool. Additionally it supports some basic password cracking for encrypted keys.
https://blogger.googleusercontent.com/img/a/AVvXsEgNo8jKSIPoFj6tOWBdseggWS-fK1EPfFbHRL2dJ4XlWi0sM3o9JAYh3tWUvRkcC2XeRM9aYmEtJay6sP_8hW0Y-5kM9p6YaJMNxjUpGk7sL3aD2aXkV2kQWkmI87ctVfSHKxS23B6mi3j9FnJGVpSHNVwZz5NcPKg5Uxb8h8NNXb8y6Umzm9WZoAn6=s652
Installation

Three easy ways to get started.

Run with Docker

cat private.key | docker run –rm -i trufflesecurity/driftwood –pretty-json –

Run pre-built binary

Download the binary from the releases page and run it.

Build yourself

go install github.com/trufflesecurity/driftwood@latest

Usage

Minimal usage is

$ driftwood path/to/privatekey.pem

Run with --helpto see more options.
Download

___________________________
@hacking_Attack
@Hacking_Video

entity, you can optimize your overall safety. Cloud-Based Security PlatformsCloud-based security platforms are far more manageable than in-house computer systems. Not only is the world turning to more remote working, but it’s inconvenient only to check your security when on the premises. As your business scales, it’s easier to adapt and tailor your security system from an online management platform.

Plus, you can install cloud-based physical security so that all your data insights are in one place. Integrating PlatformsIntegrating your platforms allows for automated workflows and easier management. As your business scales, checking multiple security software platforms isn’t practical. Whereas, if you combine access control with video security cameras, you can save yourself time and money. Future LegislationAs we mentioned, future compliance and legislation may change. We cannot predict when or what new rules may drop. There is only so much we can do to ensure our security systems abide by future legislation. However, by implementing a flexible strategy, we can ensure that new regulations won’t cause significant disruption to our security systems. Bottom LineFuture-proofing your security strategy is vital. As technology advances at an incomprehensible rate, cyber and physical threats also increase. However, by adopting a flexible, comprehensive, and proactive security strategy, you can ensure that your business is always in the best position to manage threats.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
ReFlutter : Flutter Reverse Engineering Framework

ReFlutter framework helps with Flutter apps reverse engineering using the patched version of the Flutter library which is already compiled and ready for app repacking. This library has snapshot deserialization process modified to allow you perform dynamic analysis in a convenient way.

Key features:

* socket.ccis patched for traffic monitoring and interception;
* dart.ccis modified to print classes, functions and some fields;
* contains minor changes for successful compilation;
* if you would like to implement your own patches, there is manual Flutter code change is supported using specially crafted DockerfileSupported Engines

* Android: arm64, arm32;
* iOS: arm64;
* Release: Stable, Beta Install Linux, Windows, MacOSpip3 install reflutter

Usage

impact@f:~$ reflutter main.apk
Please enter your Burp Suite IP:
SnapshotHash: 8ee4ef7a67df9845fba331734198a953
The resulting apk file: ./release.RE.apk
Please sign the apk file
Configure Burp Suite proxy server to listen on *:8083
Proxy Tab -> Options -> Proxy Listeners -> Edit -> Binding Tab
Then enable invisible proxying in Request Handling Tab
Support Invisible Proxying -> true
impact@f:~$ reflutter main.ipa

Traffic Interception

You need to specify the IP of your Burp Suite Proxy Server located in the same network where the device with the flutter application is. Next, you should configure the Proxy in BurpSuite -> Listener Proxy -> Options tab* Add port: 8083* Bind to address: All interfaces* Request handling: Support invisible proxying = Truehttps://blogger.googleusercontent.com/img/a/AVvXsEg24NwPTN4xEnSQW1yr6dLEQ_Kja_QV0yzmVTzmhw51Ts-l346yYRv7E-0maiKq1HSm_C7Ac1djvrtbqHk8i0d7DrJT4h2zwMRhvj7krApV-gE4aGqhw8KUOdFu8ekjkRnfDdV3tyiijveW_BKoH80coODTe2auEBWO4sUWVFl2c8buuTqzWoCEl1Fq=s1231
You don’t need to install any certificates. On an Android device, you don’t need root access as well. reFlutter also allows to bypass some of the flutter certificate pinning implementations. Usage On Android

The resulting apk must be aligned and signed. I use uber-apk-signer java -jar uber-apk-signer.jar --allowResign -a release.RE.apk. To see which code is loaded through DartVM, you need to run the application on the device. reFlutter prints its output in logcat with the refluttertag

impact@f:~$ adb logcat -e reflutter | sed ‘s/.*DartVM//’ >> reflutter.txt

Code output

Library:’package:anyapp/navigation/DeepLinkImpl.dart’ Class: Navigation extends Object {
String* DeepUrl = anyapp://evil.com/ ;
Function ‘Navigation.’: constructor. (dynamic, dynamic, dynamic, dynamic) => NavigationInteractor {
}
Function ‘initDeepLinkHandle’:. (dynamic) => Future* {
}
Function ‘_navigateDeepLink@547106886’:. (dynamic, dynamic, {dynamic navigator}) => void {
}
}
Library:’package:anyapp/auth/navigation/AuthAccount.dart’ Class: AuthAccount extends Account {
PlainNotificationToken* _instance = sentinel;
Function ‘getAuthToken’:. (dynamic, dynamic, dynamic, dynamic) => Future> { } Function ‘checkEmail’:. (dynamic, dynamic) => Future> { } Function ‘validateRestoreCode’:. (dynamic, dynamic, dynamic) => Future> { } Function ‘sendSmsRestorePassword’:. (dynamic, dynamic) => Future> {
}
}

Usage on iOS

Use the IPA file created after the execution of reflutter main.ipacommand. To see which code is loaded through DartVM, you need to run the application on the device. reFlutter prints its output in console logs in XCode with the refluttertag.
https://blogger.googleusercontent.com/img/a/AVvXsEhoei2na33P3rmeQy2Cz5N9EDE99sQnJSludWaHtmKSY9Vf8h-xxKA3m14q84lvjuIa-gGn4yuMxnEGAH6bjHXmf_N_8n6E-0Dzd3Nn0KLATnlh4RmRb5u0UwJyBF2k45l5ZyAqUZTg7Iic5OoAszS_Mzz6bcQTAqraAOdURert8Cg3Z25R1l00GRjP=s18[...]

___________________________
@hacking_Attack
@Hacking_Video

99
Build Engine

The engines are built using reFlutter in Github Actions to build the desired version, commits and snapshot hashes are used from this table. The hash of the snapshot is extracted from storage.googleapis.com/flutter_infra_release/flutter/Custom Build

If you would like to implement your own patches, manual Flutter code change is supported using specially crafted Docker sudo docker pull ptswarm/reflutterLinux, Windows
EXAMPLE BUILD ANDROID ARM64:
sudo docker run -e WAIT=300 -e x64=0 -e arm=0 -e HASH_PATCH= -e COMMIT= –rm -iv${PWD}:/t ptswarm/reflutter
FLAGS:
-e x64=0
-e arm=0
-e WAIT=300
-e HASH_PATCH=[Snapshot_Hash]
-e COMMIT=[Engine_commit] Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Russian FSB and military are not using encrypted communications

https://external-preview.redd.it/fhYa8i5w0Txq4OYVyy0X5DAikWDvxc0WBoJDTvy5wVk.jpg?width=108&crop=smart&auto=webp&s=80de6d8ee154631117e9ec1313e2151d833677a2 submitted by /u/User929293
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Brute force app in iOS

Hello! I wanted to ask if it’s in any way possible to brute force a pin code in an app in iOS.

I have this one app that requires 4-digit passcode to enter, and I forgot the code (yeah, stupid).

This app doesn’t allow any option other than just enter the code. It also provides unlimited amount of attempts.

Is there any way to brute force the passcode? On iPhone 11 Pro Max, iOS 15.0

submitted by /u/MelodicBad2665
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Remote Emulation Optimization

I have a rather powerful main pc that I setup to run Emulators on and would like to access it remotely for remote play on a bigger tv screen in another room.

So far I have set it up with Remote Desktop as it is running win 10 Professional.

I was wondering if there is a better cleaner way to do this that keeps a steady connection and minimal fps drops.

If anyone has had any experience with remote viewing of applications, optimization for remote gaming and graphic intensive applications KVM like applications etc. Please let me know what would be the ideal tool.

submitted by /u/SuperSoakerGuyx
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to retrieve deleted videos from Youtube?

I'm not sure if this is right place for this question, but...

I want to download some deleted videos from Youtube. Wayback machine (archive.org) doesn't help. I have links from my Youtube history. So, how to retrieve this videos? I guess it's not impossible, but I can't find anything useful about the topic on google.

Thanks in advance!

submitted by /u/No-Independent2629
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to get Beef script to inject into websites

Ubuntu 20.04

i have beef and i am familiar with it i want to test it out (ethically of course) outside my home network.

i saw some videos online using Beef-Over-Wan and Ngrok but it did not seem to work. I tried many Port forwarding services and none seem to work well. Please do not bully me i am super new to this field.

submitted by /u/thegoatkai
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Full Account Takeover due to improper validation of old password

Hello Hackers and Security community. I’m going to share how I’m able find the bug.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Samsung data breach: Hackers steal data from microchip giant Nvidia

https://cdn-images-1.medium.com/max/744/1*8Q2VbglGdk3-vxg_Jj4M_w.jpeg
Samsung has confirmed that a hacking group that stole data from microchip giant Nvidia last week has also infiltrated its systems and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video