Black Hat Ethical Hacking
Most QNAP NAS Devices Affected by ‘Dirty Pipe’ Linux Flaw

https://www.blackhatethicalhacking.com/wp-content/uploads/2021/08/Untitled-design-2-1.png Most QNAP NAS Devices Affected by ‘Dirty Pipe’ Linux FlawPost Views: 1
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/02/Patreon.png
Reading Time: 2 Minutes
The “Dirty Pipe” Linux kernel flaw – a high-severity vulnerability in all major distros that grants root access to unprivileged users who have local access – affects most of QNAP’s network-attached storage (NAS) appliances.
The “Dirty Pipe” Linux kernel flaw – a high-severity vulnerability in all major distros that grants root access to unprivileged users who have local access – affects most of QNAP’s network-attached storage (NAS) appliances, the Taiwanese manufacturer warned on Monday.

Dirty Pipe, a recently reported local privilege-escalation vulnerability, affects the Linux kernel on QNAP NAS running QTS 5.0.x and QuTS hero h5.0.x, QNAP advised. If exploited, an unprivileged, local user can gain admin privileges and inject malicious code.

The situation is grim: QNAP said that as of yesterday, there was no mitigation.

“Currently there is no mitigation available for this vulnerability. We recommend users to check back and install security updates as soon as they become available.” –QNAP
See Also: Complete Offensive Security and Ethical Hacking Course
The following versions of QTS and QuTS hero are affected:

* QTS 5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS
* QuTS hero h5.0.x on all QNAP x86-based NAS and certain QNAP ARM-based NAS

QNAP NAS running QTS 4.x aren’t affected. The company pointed users to a full list of the affected models: check “Kernel Version 5.10.60” in this link, it said in its advisory.

“QNAP is thoroughly investigating the vulnerability. We will release security updates and provide further information as soon as possible,” the advisory said. As Bad as It SoundsSecurity researcher Max Kellermann of CM4all discovered and reported the bug eight days ago. Tracked as CVE-2022-0847, the vulnerability has been in the Linux kernel since 5.8. Fortunately, the vulnerability has been fixed in Linux kernel 5.10.102, 5.15.25, and 5.16.11. If you’re at or above that version, you’re fine.

But as pointed out by Linux news site Linuxiac, Dirty Pipe doesn’t just threaten Linux machines: Since Android is based on the Linux kernel, any device running version 5.8 or later is also vulnerable, endangering a slew of people. Linuxiac pointed to the Google Pixel 6 and Samsung Galaxy S22 as examples: The massively popular phones use Linux kernel 5.10.43, which makes them vulnerable.

Dirty Pipe allows for overwriting of data in arbitrary read-only files, which leads to privilege escalation because unprivileged processes can inject code into root processes.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH The Common Vulnerabilities and Exposures (CVE) database describes it as a “flaw in the way the ‘flags’ member of the new pipe buffer structure was lacking proper initialization in copy_page_to_iter_pipe and push_pipe functions in the Linux kernel and could thus contain stale values.

“An unprivileged local user could use this flaw to write to pages in the page cache backed by read only files and as such escalate their privileges on the system,” according to the CVE description.

“If you’re not sure what that means but you think it sounds bad – you are correct!” MalwareBytes malware intelligence researcher Pieter Arntz wrote on Friday.

Keiderman offered a full technical analysis in his CM4all post. For his part, Arntz gave this TL;DR version: “The confusion in t[...]

___________________________
@hacking_Attack
@Hacking_Video

he Linux kernel is created by making use of the caching pages. Caching pages are temporary copies of files in a system’s memory that are created to make the handling of frequently used files faster. The vulnerability allows the attacker to make changes to the cached copy of a file that should be ‘read-only’ for a user without root permissions.

“In this way, it is possible for an attacker to gain root privileges, which ultimately allows him to take control of an affected system,” Arntz said. QNAP Problems Redux“Mike Parkin, senior technical engineer at Vulcan Cyber, told Threatpost on Tuesday that QNAP will hopefully release a kernel update quickly for the vulnerability. This is the second issue that the storage device vendor has reported recently, Parkin pointed out via email.”

In January, QNAP told users to immediately yank their internet-exposed NAS devices off the internet, as ransomware and brute-force attacks widely targeted all network devices. See Also: Offensive Security Tool: Scapy
“The Dirty Pipe vulnerability requires local user access to exploit, which does reduce the risk somewhat,” Parkin granted. But the Dirty Pipe issue again points out the need to make sure devices are “properly configured, maintained, and deployed in a manner that meets business needs while remaining secure,” he said.

“Ultimately systems need to be configured so they are only accessible by the people and systems that need access, and then only with the degree of access required to get the job done,” Parkin said.

That sounds about right to Hank Schless, senior manager of security solutions at Lookout.

NAS devices that provide storage and retrieval of data from a centralized location for authorized users and clients enable productivity, bringing the benefits of cloud computing inside networks, Schless said. The caveat: It also introduces “serious risk” if not done correctly, he added.

“Not only could attackers compromise the data within the particular resources they discover, but they could also move laterally around your network after initial compromise,” Schless told Threatpost on Tuesday. “Much like the main challenge with VPNs, which allow unbridled access to the infrastructure, NAS assets could act as a springboard for threat actors. It’s important to be able to segment access to particular apps, data, and resources to ensure that one compromised account or resource doesn’t lead to compromise of the entire infrastructure. This is a key reason that organizations use zero trust network access (ZTNA) as a piece of their modern security posture.” Are you a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet ImpactPeople have been comparing Dirty Pipe to Dirty Cow. That’s an earlier privilege escalation vulnerability (CVE-2016-5195) that had already been in Linux for nine years – since 2007 – when it came under public attacks against web-facing Linux servers in 2016.

Dirty Pipe is similar to Dirty Cow, except that it’s worse: It’s easier to exploit, Keiderman said.

Vulcan Cyber’s Parkin noted that any exploit that gives root level access to a Linux system is “problematic.”

“An attacker that gains root gains full control over the target system and may be able to leverage that control to reach other systems,” he said.

The mitigating factor with this vulnerability is that it requires local access, which slightly lowers the risk, Parkin said. As well, the Dirty Pipe flaw has been fixed in the latest Linux kernel code, and patches should be available soon for the major distributions.

Privilege escalation is just the first step in attack[...]

___________________________
@hacking_Attack
@Hacking_Video

ers getting “full control” of a system, Parkin said. “Escalating privileges to root (POSIX family) or Admin (Windows) is often an attacker’s first priority when they gain access to a system, as it gives them full control of the target and can help them extend their foothold to other victims. That hasn’t changed for ages and is unlikely to change in the foreseeable future.”

Shweta Khare, cybersecurity evangelist at Delinea, told Threatpost that 2022 has already flung several serious, widespread bugs at us, including several Windows kernel, DNS server RCE, and Adobe vulnerabilities of high severity rating: bugs that let attackers gain elevated local system or admin privileges.

“Such OS bugs and application-level vulnerabilities can allow attackers to elevate privileges, move laterally inside the network, execute arbitrary code, and completely take over devices,” Khare noted via email.

The security expert said that containers offer a higher degree of security, but even they aren’t foolproof: “Recent incidents have demonstrated that containers are being exploited often via such vulnerabilities,” Khare said.

“In most organizations, microservices and containers are not yet covered under the enterprise security plan,” she said.

Khare advised that granular privilege management is one defense to minimize the risk exposure of these types of cyberattacks: “A Privileged Access Management (PAM) solution can secure container architectures to centrally manage user access rights and privileges to Linux Docker hosts, including hosts running CoreOS Container Linux,” she explained. “A best practice is to implement multi-factor authentication (MFA) and temporary privilege escalation to gain access to individual containers and container hosts. Enabling granular privilege management at the container platform and the container operating system layers across the development environments provides the best option for container security.”​​
Source: threatpost.com Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Lapsus-group-has-hacked-Ubisoft-as-well-90x90.jpg Ubisoft has confirmed it was hacked by Lapsus$ group1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/raccoon-stealer-90x90.jpg Raccoon Stealer Crawls Into Telegram2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/kali-bright-90x90.jpg Kali Unkaputtbar – a new feature on Kali Linux4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/wolf-in-sheps-clothing-2-scaled-e1646927438585-90x90.jpeg Malware Posing as Russia DDoS Tool Bites Ukraine Hackers5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/FTDZNGKMCJPIDKR5RE7MSLIMB4-scaled-90x90.jpg Agencies in Ukraine targeted with MicroBackdoor malware6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/NINTCHDBPICT000622539771-90x90.png Microsoft Addresses 3 Zero-Days & 3 Critical Bugs for March1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/linux-kernel-double-free-vulnerability-90x90.png New Linux bug gives root on all major distros, exploit released1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/firefox-90x90.jpg Mozilla Firefox 97.0.2 fixes two actively exploited zero-day bugs1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/small-business-internet-security-90x90.jpg Google WAF bypassed via oversized POST requests2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/ezgif.com-gif-maker-4-90x90.jpg Ukraine invasion: WordPress-hosted university websites hacked in ‘targeted attacks’2 weeks ago
The post Most QNAP NAS Devices Affected by ‘Dirty Pipe’ Linux Flaw firs[...]

___________________________
@hacking_Attack
@Hacking_Video

t appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

WMEye - A Post Exploitation Tool That Uses WMI Event Filter And MSBuild Execution For Lateral Movement
http://www.kitploit.com/2022/03/wmeye-post-exploitation-tool-that-uses.html

___________________________
@hacking_Attack
@Hacking_Video

WMEye is an experimental tool that was developed when exploring about Windows (https://www.kitploit.com/search/label/Windows) WMI. The tool is developed for performing Lateral Movement (https://www.kitploit.com/search/label/Lateral%20Movement) using WMI and remote MSBuild Execution. It uploads the encoded/encrypted shellcode into remote targets WMI Class Property, create an event filter that when triggered writes an MSBuild based Payload (https://www.kitploit.com/search/label/Payload) using a special WMI Class called LogFileEventConsumer and finally executes the payload remotely.
UseCase Fileless Lateral Movement using WMI, can be used with Cobalt Strike's Execute-Assembly Note: This is still in experimental stage and no where near to be used in a real engagement.
Current Working Creates a Remote (https://www.kitploit.com/search/label/Remote) WMI Class Writes Shellcode as property value to the above created Fake WMI Class Creates a WMI Event Filter to trigger on powershell.exe process creation On Event Trigger, it Uploads MSBuild Payload into remote system using LogFileEventConsumer (A WMI Consumer type to write Log Files) Finally Invoke Win32_Process Create to call MSbuild remotely The MSBuild Payload fetches encoded shellcode from WMI Class Property, decodes and executes it. Upcoming Features Replace WIN32_Process Create method of invocation with something better Add GZIP Compression for Shellcode and XML File Bytes Add NTLM (https://www.kitploit.com/search/label/NTLM) PTH Support Add CleanUp Functions for removing event filter after the logfileeventconsumer finished writing the MSBuild Payload Whats Unique in this Project ? Uploads the encoded/encrypted shellcode to remote machines WMI property on a Created Fake Class (can maybe tweak to write shellcode into existing class's Property) Uses LogFileEventConsumer to upload MSBuild File , instead of relying in spawning Powershell.exe using win32_process Create Credits https://www.fireeye.de/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf

Download WMEye (https://github.com/pwn1sher/WMEye)

___________________________
@hacking_Attack
@Hacking_Video

WMEye - A Post Exploitation Tool That Uses WMI Event Filter And MSBuild Execution For Lateral Movement

WMEye is an experimental tool that was developed when exploring about Windows WMI. The tool is developed for performing Lateral Movement using WMI and remote MSBuild Execution. It uploads the encoded/encrypted shellcode into remote targets WMI Class Property, create an event filter that when triggered writes an MSBuild based Payload using a special WMI Class called LogFileEventConsumer and finally executes the payload remotely. UseCase Fileless Lateral Movement using WMI, can be used with Cobalt Strike's Execute-Assembly Note: This is still in experimental stage and no where near to be used in a real engagement. Current Working Creates a Remote WMI Class Writes Shellcode as property value to the above created Fake WMI Class Creates a WMI Event Filter to trigger on powershell.exe process creation On Event Trigger, it Uploads MSBuild Payload into remote system using LogFileEventConsumer (A WMI Consumer type to write Log Files) Finally Invoke Win32_Process Create to call MSbuild remotely The MSBuild Payload fetches encoded shellcode from WMI Class Property, decodes and executes it. Upcoming Features Replace WIN32_Process Create method of invocation with something better Add GZIP Compression for Shellcode and XML File Bytes Add NTLM PTH Support Add CleanUp Functions for removing event filter after the logfileeventconsumer finished writing the MSBuild Payload Whats Unique in this Project ? Uploads the encoded/encrypted shellcode to remote machines WMI property on a Created Fake Class (can maybe tweak to write shellcode into existing class's Property) Uses LogFileEventConsumer to upload MSBuild File , instead of relying in spawning Powershell.exe using win32_process Create Credits https://www.fireeye.de/content/dam/fireeye-www/global/en/current-threats/pdfs/wp-windows-management-instrumentation.pdf Download WMEye
Read more...

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Ipsourcebypass : This Python Script Can Be Used To Bypass IP Source Restrictions Using HTTP Headers

Ipsourcebypass is a Python script that can be used to bypass IP source restrictions using HTTP headers.

Features

* 17 HTTP headers.
* Multithreading.
* JSON export with --json outputfile.json.
* Auto-detecting most successful bypasses.

Usage

$ ./ipsourcebypass.py -h
[~] IP source bypass using HTTP headers, v1.2
usage: ipsourcebypass.py [-h] [-v] -i IP [-t THREADS] [-x PROXY] [-k] [-L] [-j JSONFILE] [-C] [-H HEADERS] [-S] url
This Python script can be used to test for IP source bypass using HTTP headers
positional arguments:
url e.g. https://example.com:port/path
optional arguments:
-h, –help show this help message and exit
-v, –verbose arg1 help message
-i IP, –ip IP IP to spoof.
-t THREADS, –threads THREADS
Number of threads (default: 5)
-x PROXY, –proxy PROXY
Specify a proxy to use for requests (e.g., http://localhost:8080)
-k, –insecure Allow insecure server connections when using SSL (default: False)
-L, –location Follow redirects (default: False)
-j JSONFILE, –jsonfile JSONFILE
Save results to specified JSON file.
-C, –curl Generate curl commands for each request.
-H HEADERS, –header HEADERS
arg1 help message
-S, –save Save all HTML responses.

Auto-detecting responses that stands out

Results are sorted by uniqueness of their response’s length. This means that the results with unique response length will be on top, and results with response’s length occurring multiple times at the bottom:
https://blogger.googleusercontent.com/img/a/AVvXsEgxBhFQ5FJtOaOabHz8rQ03DE05PLDajkFbEqhzUlaoVR_Idx3PxGyFD54iav5aioGEcKveqRVV7wIqdQECKbHXQ9sHarO3yIo38iKXqGABOhd5Pyz9hwHOk0OR1yfqxYEM2e6-5Tf2BEFuR6ECmzCgHoP0jfK_FGRr1K40-Mn7L8abEol6aARp43IR=s1390

Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Phant0m : Windows Event Log Killer

Phant0m is a Windows Event Log Killer. Svchost is essential in the implementation of so-called shared service processes, where a number of services can share a process in order to reduce resource consumption. Grouping multiple services into a single process conserves computing resources, and this consideration was of particular concern to NT designers because creating Windows processes takes more time and consumes more memory than in other operating systems, e.g. in the Unix family.1

This means briefly that; On Windows operating systems, svchost.exe manages the services and services are actually running under svchost.exe’s as threads. Phant0m targets the Event Log service and finding the process responsible for the Event Log service, it detects and kills the threads responsible for the Event Log service. Thus, while the Event Log service appears to be running in the system (because Phant0m didn’t kill process), it does not actually run (because Phant0m killed threads) and the system does not collect logs. How It Works & How To Usehttps://blogger.googleusercontent.com/img/a/AVvXsEg2_01thzc67nquNTBaDgQjr-F1V0s3y1AGMdmqa7rfTxsOiEg9qrzEOOUW-qt3H0hwYHldkgC9W2mdQzjNWZ24uhLEdSCh0CA7QMK4GXynvnEI7_hFdFP80e9Nhp45FGPhJhJzw6mg2ZHFvbAdGYupT-YazVCgfcuCJskJB0UyeZSSNjJLV4r3zzSL=s1367 Detecting Event Log ServicePhant0m uses two different options to detect the Process ID of the Event Log service. The first is to detect via the SCM (Service Control Manager) and the second is to detect via WMI (Windows Management Instrumentation). With which method you want Phant0m to detect the Process ID of the Event Log service, change the following lines in the main.cpp file.

For example, if you want the Process ID to be detected via SCM, you should edit it as follows. (Do not set all values at the same time, set only the one technique you want.

// PID detection techniques configuration section.
define PID_FROM_SCM 1 // If you set it to 1, the PID of the Event Log service is obtained from the Service Manager.
define PID_FROM_WMI 0 // If you set it to 1, the PID of the Event Log service is obtained from the WMI.

For example, if you want threads to be killed using Technique-1, you should edit it as follows. (Do not set all values at the same time, set only the one technique you want.

TID detection and kill techniques configuration section.
define KILL_WITH_T1 1 // If you set it to 1, Technique-1 will be use. For more information; https://github.com/hlldz/Phant0m
define KILL_WITH_T2 0 // If you set it to 1, Technique-2 will be use. For more information; https://github.com/hlldz/Phant0m Detecting and Killing ThreadsPhant0m uses two different options to detect and kill the threads of the Event Log service. Technique-1When each service is registered on a machine running Windows Vista or later, the Service Control Manager (SCM) assigns a unique numeric tag to the service (in ascending order). Then, at service creation time, the tag is assigned to the TEB of the main service thread. This tag will then be propagated to every thread created by the main service thread. For example, if the Foo service thread creates an RPC worker thread (note: RPC worker threads don’t use the thread pool mechanism more on that later), that thread will have the Service Tag of the Foo service.2

So, in this technique Phant0m will detect threads of Event Log service with NtQueryInformationThread API to get the thread’s TEB address and read the SubProcessTag from the TEB. Then it kills the threads related to the Event Log service. The codes for this technique are in the technique_1.hfile. Technique-2In this technique, Phant0m detects the names of DLLs associated with threads. Windows Event Log Service uses wevtsvc.dll. Full path is %WinDir%\System32\wevtsvc.dll. If the [...]

___________________________
@hacking_Attack
@Hacking_Video

thread is using that DLL, it is the Windows Event Log Service’s thread and then Phant0m kills the thread. The codes for this technique are in the technique_2.hfile. UsageYou can use Phant0m both as a standalone EXE and as a Reflective DLL. Open the project in Microsoft Visual Studio, make the settings (select the detection and kill techniques) and compile. You can also use the Reflective DLL version with Cobalt Strike, for this there is an Aggressor Script file (phant0m.cna) in the repository.
https://blogger.googleusercontent.com/img/a/AVvXsEjEAD06NNvKnW7yusHdosZc6pyh_Uk8U39gTFTzg4q81vSIWQksfm7hBYx_bKroVn1bWrHFKNOTq7mEovXnILtIdGa2vOABRLi-9YJuTjrq3C8_M8uIKdQDXUzM8HALCAMA-wiJSoL5GDLjx1tHTifqyQDpPQZ57b6zjru2qT_355FAdVZQy5hpIUsZ=s2400
Fork and inject method was used with bdllspawnin the execution type of Aggressor Script (phant0m.cna) for Cobalt Strike. If you want to inject Phant0m into your existing process and run it, you can review this project (https://github.com/rxwx/cs-rdll-ipc-example) and you can do it easily. You can also convert the code to DLL and then to Shellcode with Donut.

NOTE: The project only supports x64 architecture. Download

___________________________
@hacking_Attack
@Hacking_Video

How I was able to find 50+ Cross site scripting(XSS) Security Vulnerabilities on Bugcrowd Public…
https://medium.com/@takshalpentester/how-i-was-able-to-find-50-cross-site-scripting-xss-security-vulnerabilities-on-bugcrowd-public-ba33db2b0ab1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone, I hope by the grace of God everyone who is reading this blog post is doing well and their families during this pandemic…Continue reading on Medium » (https://medium.com/@takshalpentester/how-i-was-able-to-find-50-cross-site-scripting-xss-security-vulnerabilities-on-bugcrowd-public-ba33db2b0ab1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hello

Recently a great Australian cricketer Shane Warne died at at young 52 from a heart attack, all over Australian instagram accounts a disgusting person with the name @shanewarnedeservesdeathhaha is mocking his death, I’m just wondering if anyone is able to get his IP address and leak his address or fuck up his internet. Cheers the account

submitted by /u/RevolutionSouthern34
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I update ruby to 2.7+ on kali Linux

Every time I try find a tutorial it’s on everything except kali, macOS, windows legit anything but kali

Anyone know how

submitted by /u/retro_Ztro
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
we can beat putin by trolling him

submitted by /u/throwawaypersec117
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Termux-Torrent : Download Torrent Movies and Files with Termux

https://cdn-images-1.medium.com/max/600/0*whwaI9HtblsyLqPT
HomeUseful-Tools Termux-Torrent : Download Torrent Movies and Files with Termux

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Stepping in the Unknown

https://cdn-images-1.medium.com/max/1201/1*GBBIBK8mVeng1xvLQv5iZw.png
There is a say in Cyber security “To stop a hacker, one needs to think like one” and penetration testing is what is all about thinking the…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video