Exploit Collector
ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure

https://2.bp.blogspot.com/-S-N0q2XL8x8/WWlu5FDj1eI/AAAAAAAAIJA/vGskVQb_QegQZ0-UZMHSDeFJ08ju6pdGQCLcBGAs/s1600/h104.png
ICT Protege GX/WX version 2.08 suffers from a client-side SHA1 password hash disclosure vulnerability.

MD5 | f76c2764154deda7e495e4c51aad1032

Download

ICT Protege GX/WX 2.08 Client-Side SHA1 Password Hash Disclosure
Vendor: Integrated Control Technology Ltd.
Product web page: https://www.ict.co
Affected version: GX: Ver: 2.08.1002 K1B3
Lib: 04.00.217
Int: 2.3.235.J013
OS: 2.0.20
WX: Ver: 4.00 284 H062
App: 02.08.766
Lib: 04.00.169
Int: 02.2.208

Summary: Protege GX is an enterprise level integrated access control, intrusion
detection and building automation solution with a feature set that is easy to
operate, simple to integrate and effortless to extend. Protege WX is an all-in-one,
web-based, cross-platform system that gives you a fully functional access control
and intrusion detection solution in a fraction of the time of conventional software.
With no software to install, setup is quick and simple. Connect the Controller and
system components, then open a web browser to launch the intuitive wizard-driven
interface which guides you through the process of configuring your system.

Desc: The application is vulnerable to improper access control that allows an
authenticated operator to disclose SHA1 password hashes (client-side) of other
users/operators.

Tested on: Microsoft-WinCE/6.00
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5700
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5700.php
08.02.2022

--
Navigate to http://CONTROLLER_IP/operator.htm

Source:
Password

...
...

...

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
White House Warns of New Intel on Russia Mulling Cyberattack 'Options' Against US

Biden administration doubles down on its previous warnings of possible Russian cyberattacks in the wake of hefty economic sanctions imposed on Russia by the US.

Dark Reading: Attacks/Breaches
'Unique Attack Chain' Drops Backdoor in New Phishing Campaign

A threat group combines the use of steganography, open source tools, and Python scripts to target organizations in France.

Dark Reading: Attacks/Breaches
Binarly Coordinates Patches for 3 Firmware Flaws With Dell

The latest three memory corruption flaws in Dell BIOS highlights the challenges of fixing firmware vulnerabilities.

Dark Reading: Attacks/Breaches
ForAllSecure Raises $21M to Secure the World’s Software

Strong demand for application security that supports DevSecOps initiatives drives investment from Koch Disruptive Technologies and New Enterprise Associates.

___________________________
@hacking_Attack
@Hacking_Video

Help cracking registry dumped hashes.
https://www.reddit.com/r/Pentesting/comments/tjr3qr/help_cracking_registry_dumped_hashes/

Need a little help. I am doing a controlled pentest and its my first time. I have dumped the registry passwords one being a domain administrator. I have the hashes in the 3 files but I am not sure how to use impackt or other tools to Crack the hashes for a password. Any insight would be great! submitted by /u/Upstairs_Lie_9379 (https://www.reddit.com/user/Upstairs_Lie_9379)
[link] (https://www.reddit.com/r/Pentesting/comments/tjr3qr/help_cracking_registry_dumped_hashes/) [comments] (https://www.reddit.com/r/Pentesting/comments/tjr3qr/help_cracking_registry_dumped_hashes/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Penetration Testing guide for Muggles (cause once you know, it’s magic..)

Hi, I am Prashant. This is my first blog on medium. I hope you guys will enjoy, if you find something missing, you know where to go…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
None

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Top 100 Hacking Tools.

Burp SuiteContinue reading on Medium »
Read more...

hacking: security in practice
Hello security profs, I like to make things in python and c# in my off time, what are some tools you wish you had but lack the ability to make yourself that would make your profession a smoother transition?

Your suggestions also aid my capstone ideas for school. Please no suggestions in breaking things, its not my forte.

submitted by /u/inert-
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Would a Russian cyber attack be a lot more serious than what a group like anonymous can do to countries?

I’m unfamiliar with how hacking works… sorry. But with the Biden press conference today stating that Russia cyberattacks on the USA are moreless imminent.. I was curious of examples for how these attacks would look and work?

submitted by /u/whattaUwant
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Support Ethical Hacking

This war is being fought more in cyberspace than at any time in history. Truly a revolutionary time in World history. China and Russia are more prepared for this than the US. The American public is vulnurable.

http://supportethicalhacking.com/

submitted by /u/zenneson
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Windows 10 password bypass?

Hey y’all, my cousin passed away a few weeks ago and I’m trying to get into his computer. I don’t know the password and every video I’ve seen trying to utilize command prompt isn’t working for me… I always get that it can’t find the files. Does anyone have a super dumbed down tutorial for me? Thank you.

submitted by /u/LlamaGaming1127
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How would I check if my laptop is monitored by my Company

As the title says. I am not 100% sure if my company is monitoring my laptop uptime and work hours. There are no obvious programs installed, and after checking task manager there is also no obvious processes that look like "trackers". I downloaded TCPview just to make sure, but I could use a lot of advice on how to completely make sure the employer is not monitoring me.

The account I log in is an Admin account and I have all the privileges like its my own laptop.

submitted by /u/lovatoariana
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Redirecting IPTV Channels?

A friend’s mother doesn’t watch anything except Russian state media and totally buys into their propaganda regarding the invasion of Ukraine. The kicked is she is Ukrainian herself and it’s breaking my friends heart not to be able to get through to her with the truth. I was thinking today whether there is a way I could help her daughter redirect some of those IPTV channels without making it look too obvious. So if she tries to pull up RT, she gets Al Jazeera or the beeb instead for example.

submitted by /u/WePwnTheSky
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Story about more than 3.5 million PII leakage in Yahoo!!!

Hello GUYS,Continue reading on Medium »
Read more...

Top 100 Hacking Tools.
https://thenurhabib.medium.com/top-100-hacking-tools-c355b77001df?source=rss------bug_bounty-5

Burp SuiteContinue reading on Medium » (https://thenurhabib.medium.com/top-100-hacking-tools-c355b77001df?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Story about more than 3.5 million PII leakage in Yahoo!!!
https://dhakalbibek.medium.com/story-about-more-than-3-5-million-pii-leakage-in-yahoo-3a530210dcc6?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video