Exploit Collector
ProtonVPN 1.26.0 Unquoted Service Path

https://4.bp.blogspot.com/-xWCWgAV3Ny0/WWlvBhL9TTI/AAAAAAAAIKY/j6Iuv-WtlEAbM80hi5qIKa1OI4pChiwSgCLcBGAs/s1600/h124.png
ProtonVPN version 1.26.0 suffers from an unquoted service path vulnerability.

MD5 | c12107cb30eb62adf4de5b85415d6148

Download
# Exploit Title: ProtonVPN 1.26.0 - Unquoted Service Path
# Date: 22/03/2022
# Exploit Author: gemreda (@gemredax)
# Vendor Homepage: https://protonvpn.com/
# Software Link: https://protonvpn.com/
# Version: 1.26.0
# Tested: Windows 10 x64
# Contact: gemredax@pm.me

PS C:\Users\Emre> sc.exe qc "ProtonVPN Wireguard"
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ProtonVPN Wireguard
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 3 DEMAND_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Proton Technologies\ProtonVPN\ProtonVPN.WireGuardService.exe C:\ProgramData\ProtonVPN\WireGuard\ProtonVPN.conf
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : ProtonVPN WireGuard
DEPENDENCIES : Nsi
: TcpIp
SERVICE_START_NAME : LocalSystem
#Exploit:

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
If a malicious individual has access to the file system, it is possible to elevate privileges by inserting such a file as "C:\Program.exe" to be run by a privileged program making use of WinExec.


Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Cyber Insurance and War Exclusions

Here's what a cybersecurity lawyer thinks security pros need to know in light of Russia's invasion of Ukraine.

Dark Reading: Attacks/Breaches
Could Gaming Close the Cyberskills Gap?

The Wicked6 hackathon helps women to develop their professional cybersecurity skills while networking and playing games.

Dark Reading: Attacks/Breaches
Okta Says 366 Customers Impacted via Third-Party Breach

Microsoft meanwhile confirms Lapsus$ group compromised it as well and issues warning on threat actor.

Dark Reading: Attacks/Breaches
FBI: Cybercrime Victims Suffered Losses of Over $6.9B in 2021

The Internet Crime Complaint Center fielded 847,376 cybercrime reports last year, an increase of 7% from 2020.

Hacking on Medium
Vulnerabilidad LPE en Windows que se niega a morir

https://cdn-images-1.medium.com/max/1511/0*HIWvwwhwFufwzBK6
PUBLICADO EN 23 MARZO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
‘Dirty Pipe’ Linux Kernel Privilege Escalation Vulnerability (CVE-2022–0847)

https://cdn-images-1.medium.com/max/612/1*EkagVhRY9G9ip_0fpnumjg.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
So You Want to be a Penetration Tester

https://cdn-images-1.medium.com/max/2186/1*oB8XmuUPH0UFZJ_tBg69cA.jpeg
Better work on your soft skills first

Continue reading on The Mayor »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sequel HackTheBox Ctf

https://cdn-images-1.medium.com/max/800/1*7wKPc8akx5oPyBSDs3sSfg.png
writeup of Sequel room from hack the box.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CYBER CRIME TRENDS 2020–2021

https://cdn-images-1.medium.com/max/2600/0*1cRUhL7R-clG63nc
Cyber criminals are taking advantage of the covid-19 pandemic as many staff work from home. criminal shifted from targeting individuals to…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Compromisso HackTheBox Ctf

https://cdn-images-1.medium.com/max/800/1*-cxgJeChe6grKkpLuJDW2A.png
writeup da sala de compromissos do hack the box.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Bounty Hacker Walkthrough

https://cdn-images-1.medium.com/max/808/0*w6ZrhpUTQJ2Lm6cP
Pentest Metodolojisi

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Raspberry Pi Pico as a BadUSB with built in executable storage

Has anyone ever tried using the pi pico as a mass storage device while being an HID device? It would help with running really long scripts fully offline. This could help a lot with for example placing a persistant backdoor with full system access rather than downloading the files on the spot, making our jobs a lot easier.

If you have links to any articles/suggestions on how I coudl figure this out, please comment.

submitted by /u/leavewhileyoucan
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What does cracking a hash mean? What am i doing wrong?

Hey everyone, I have been working on this for days. Im really confused, but let me get to the point. Here is what ive done so far. 1.Booted my windows7 hdd to Kali Linux, mounted the drives. 2. Used samdump2 on The system and sam file to get the hashes. Now i got something like this disabled Administrator, disabled Guest Me:1000:aad3b435b51404eeaad3b435b51404ee:-45076b3d0847ae6212e48b2896ac3c01::: Ok so Forget the disabled admin and guest im just trying to get the password for "Me" from what i understand the first "aad3b and so on is an LM hash. two repeating chunks max 7 characters each containing only uppercase letter. The second one is an NT hash. So far im correct i think. Now heres where im having problems. When i use john --format=LM /home/kali/Desktop/hashfile I get the SAME THING Me:1000:aad3b435b51404eeaad3b435b51404ee:-45076b3d0847ae6212e48b2896ac3c01 1 password hashes cracked, 0 left. same thing with john --show --format LM . even when i try to put the output to a john.pot file, it gives me the same thing, for example heres the output for LM in the john.pot $LM$aad3b435b51404ee: same thing with NT $NT$45076b3d0847ae6212e48b2896ac3c01 What exactly is john doing here, It is supposedly "cracking the hashes" all it is doing is reading the first LM and NT hashes that are shown in the hash file. I thought cracking the hash was bruteforcing/wordlist attacks that generated a plaintext password, What am i doing wrong? How can i successfully crack these hashes to get the plaintext password. Any info would be greatly appreciated. If anyone has done this before and understands it and can give me some steps, i would be sooo appreciative. (BTW the second hash is one letter/number different so my password isnt out in the world) Anyone got any ideas/ can explain? Its a windows7 pass

submitted by /u/GuyfromQueensnyc
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

I found a deal about a laptop
https://www.reddit.com/r/Pentesting/comments/tljdxr/i_found_a_deal_about_a_laptop/

So i found a Razer blade 15 base model with: I7 10750h (6/12) 16gb ram Rtx3060 512gb ssd For 1469€ And a Asus rog Strix G15 with R9 5900x (8/16) 16hb ram Rtx2060 1tb ssd For 1399€ Which one should i get? Im going to use it for pentesting and gaming And also, which one is worth it? HTB academy subscription Or TryHackeMe VIP submitted by /u/Clyde253 (https://www.reddit.com/user/Clyde253)
[link] (https://www.reddit.com/r/Pentesting/comments/tljdxr/i_found_a_deal_about_a_laptop/) [comments] (https://www.reddit.com/r/Pentesting/comments/tljdxr/i_found_a_deal_about_a_laptop/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Crocodile HackTheBox Ctf

https://cdn-images-1.medium.com/max/800/1*ymyNebTC85d9gYu8xktbLQ.png
writeup of Crocodile room from hack the box.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
3 Easy Ways Your Phone’s SIM Card Can Be Hacked

https://cdn-images-1.medium.com/max/2600/0*VPN9kyeLijzQliZr
SIM cards can be a security risk. Learn how to protect your phone.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Github repo of a windows 11 AV bypass with reverse shell

someone shared this on twitter and it came up on my feed and thought that it was interesting enough to leave here. https://github.com/tihanyin/PSSW100AVB

submitted by /u/Apprehensive_Self481
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video