Hacks have become the new norm in crypto; from Twitter jokes about getting rugged, to sad posts about people losing their most prized…Continue reading on Medium » (https://hatsfinance.medium.com/community-owned-bug-bounties-e2ae85c757ac?source=rss------bug_bounty-5)

LayerZero Security Update — April 2022

If this past week has shown us anything, it’s that there is nothing more critical in this space than an absolute commitment to…Continue reading on LayerZero Official »
Read more...

Auto-Elevate - Escalate From A Low-Integrity Administrator Account To NT AUTHORITY\SYSTEM Without An LPE Exploit By Combining A COM UAC Bypass And Token Impersonation
http://www.kitploit.com/2022/04/auto-elevate-escalate-from-low.html

This tool demonstrates the power of UAC bypasses and built-in features of Windows. This utility auto-locates winlogon.exe, steals and impersonates it's process TOKEN, and spawns a new SYSTEM-level process with the stolen token. Combined with UAC bypass method #41 (ICMLuaUtil UAC bypass) from hfiref0x's UACME (https://www.kitploit.com/search/label/UACME) utility, this utility can auto-elevate a low privileged Administrative account to NT AUTHORITY\SYSTEM.
The following image demonstrates using UACME combined with Auto-Elevate to go from a low-privileged Administrator account to NT AUTHORITY\SYSTEM on Windows 10 (https://www.kitploit.com/search/label/Windows%2010) 21H1.

The following image demonstrates escalation (https://www.kitploit.com/search/label/Escalation) from a high-privileged Administrator account to SYSTEM without a UAC bypass

Technical Explanation The following steps are performed by Auto-Elevate to escalate from a low-privileged Administrator to SYSTEM:

Auto-Elevate The winlogon.exe process is located by enumerating the systems running processes with CreateToolhelp32Snapshot, Process32First, and Process32Next SeDebugPrivilege is enabled for the current process via a call to AdjustTokenPrivileges, as it's required to open a HANDLE to winlogon.exe A handle to the winlogon.exe process is opened by calling OpenProcess, for this call PROCESS_ALL_ACCESS is used (however, it's overkill) A handle to winlogon's process token is retrieved by calling OpenProcessToken combined with the previously obtained process handle  The user (SYSTEM) of winlogon (https://www.kitploit.com/search/label/Winlogon) is impersonated by calling ImpersonateLoggedOnUser The impersonated token handle is duplicated by calling DuplicateTokenEx with SecurityImpersonation, this creates a duplicated token we can use Using the duplicated, and impersonated token a new CMD instance is spawned by calling CreateProcessWithTokenW To-Do Implement a standalone version of method 41 from UACME (or similar) to automate the process further MITRE ATT&CK Mapping Token Manipulation: T1134 (https://attack.mitre.org/techniques/T1134/) Access Token Manipulation: Token Impersonation/Theft: T1134.001 (https://attack.mitre.org/techniques/T1134/001/) Access Token Manipulation: Create Process with Token: T1134.002 (https://attack.mitre.org/techniques/T1134/002/) Access Token Manipulation: Make and Impersonate Token: T1134.003 (https://attack.mitre.org/techniques/T1134/003/)

Download Auto-Elevate (https://github.com/FULLSHADE/Auto-Elevate)

pync - Netcat for Python
https://www.reddit.com/r/Pentesting/comments/tu0vm6/pync_netcat_for_python/

submitted by /u/brenw0rth (https://www.reddit.com/user/brenw0rth)
[link] (https://www.github.com/brenw0rth/pync) [comments] (https://www.reddit.com/r/Pentesting/comments/tu0vm6/pync_netcat_for_python/)

Dark Reading: Attacks/Breaches
What You Need to Know About PCI DSS 4.0's New Requirements

The updated security payment standard's goal is to “address emerging threats and technologies and enable innovative methods to combat new threats” to customer payment information, the PCI Security Standards Council says.

Dark Reading: Attacks/Breaches
NSA Employee Indicted for Sending Classified Data Outside the Agency

Even the NSA has a malicious insider problem. The employee used his personal emails to send classified data to unauthorized outsiders on 13 different occasions.

LayerZero Security Update — April 2022
https://medium.com/layerzero-official/layerzero-security-update-april-2022-4c27a22380b4?source=rss------bug_bounty-5

If this past week has shown us anything, it’s that there is nothing more critical in this space than an absolute commitment to…Continue reading on LayerZero Official » (https://medium.com/layerzero-official/layerzero-security-update-april-2022-4c27a22380b4?source=rss------bug_bounty-5)

Hacking on Medium
Python Security “logging.config” code execution

Python’s Security Considerations document lists following about the logging module

Continue reading on Medium »

Hacking on Medium
What a $600 million hack reveals about the status of crypto, as per Ronin Network

https://cdn-images-1.medium.com/max/640/1*6CrpZM9SW7IdwaNvFz6kEA.jpeg
Thousands, if not millions, of people, could have lost funds as a result of the world’s second-largest crypto breach.

Continue reading on Medium »