Exploit Collector
WordPress Elementor 3.6.2 Remote Code Execution

https://1.bp.blogspot.com/-93ZP4TpCwBw/WWlu7wGG0SI/AAAAAAAAIJg/yDCONAkAMz8MX1TtbGL6KFo1njFu_UyvACLcBGAs/s1600/h111.png
WordPress Elementor versions 3.6.0 through 3.6.2 suffer from a remote code execution vulnerability.

MD5 | e3c26b5f04706dd80b2cb9e18d638d8a

Download
Description: Insufficient Access Control leading to Subscriber+ Remote Code Execution

Affected Plugin: Elementor

Plugin Slug: elementor

Plugin Developer: Elementor

Affected Versions: 3.6.0 – 3.6.2

CVE ID: CVE-2022-1329

CVSS Score: 9.9(Critical)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Researcher/s: Ramuel Gall

Fully Patched Version: 3.6.3

The Elementor plugin for WordPress introduced an Onboarding module in version 3.6.0, designed to simplify the initial setup of the plugin. The module uses an unusual method to register AJAX actions, adding an admin_init listener in its constructor that first checks whether or not a request was to the AJAX endpoint and contains a valid nonce before calling the maybe_handle_ajax function.

Unfortunately no capability checks were used in the vulnerable versions. There are a number of ways for an authenticated user to obtain the Ajax::NONCE_KEY, but one of the simplest ways is to view the source of the admin dashboard as a logged-in user, as it is present for all authenticated users, even for subscriber-level users.

This means that any logged-in user could use any of the onboarding functions. Additionally, an unauthenticated attacker with access to the Ajax::NONCE_KEY could use any of the functions called from maybe_handle_ajax, though this would likely require a separate vulnerability.

The function with the most severe impact was the upload_and_install_pro function. An attacker could craft a fake malicious “Elementor Pro” plugin zip and use this function to install it. Any code present in the fake plugin would be executed, which could be used to take over the site or access additional resources on the server.

In addition to this functionality, a less sophisticated attacker could simply deface the site by using the maybe_update_site_name, maybe_upload_logo_image, and maybe_update_site_logo functions to change the site name and logo.

Timeline

March 29, 2022 – We finish our investigation and deploy a firewall rule to protect Wordfence Premium, Wordfence Care, and Wordfence Response customers. We send our full disclosure to the plugin developer’s official security contact.

April 5, 2022 – We follow up with the plugin developer’s security contact as we have not yet received a response.

April 11, 2022 – We send our full disclosure to the WordPress Plugins team.

April 12, 2022 – A patched version of Elementor is released.

April 28, 2022 – The firewall rule becomes available to free Wordfence users.

Conclusion

In today’s post, we covered a Critical vulnerability that allows any authenticated user to upload and execute malicious code on a site running a vulnerable version of the Elementor plugin. If your site is using the Elementor plugin, we urge you to update immediately. The good news is that the vulnerability is not present in versions prior to 3.6.0 and was successfully patched in 3.6.3.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
More Than 60% of Organizations Suffered a Breach in the Past 12 Months

Firms focus too narrowly on external attackers when it's insiders, third parties, and stolen assets that cause many breaches, new study shows.

Dark Reading: Attacks/Breaches
Microsoft Leads Operation to Disrupt Zloader Botnet

The banking Trojan-turned-ransomware-distribution tool has been a potent threat since late 2019.

Dark Reading: Attacks/Breaches
Secure Systems Need Hardware-Enhanced Tools, Intel Says

A new Intel study finds that while adoption of hardware-assisted security is still low, there is a lot of interest in how it can secure system layers such as the operating system and hypervisor.

Hacking on Medium
Chrome Grabber

https://cdn-images-1.medium.com/max/729/1*l7QfhOLyRtSH4ZW3eLjrYg.png
How to extract chrome saved user information

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Microsoft Exposes Evasive Chinese Tarrask Malware Attacking Windows Computers. The Chinese-backed Hafnium hacking group has been linked to a piece of a new malware that's used to maintain persistence on compromised Windows environments.

https://external-preview.redd.it/lQCBcDpFQue0pDtilhzmjKFPhuASpj7jM-ZizpUD88g.jpg?width=640&crop=smart&auto=webp&s=407d97886fffb55f6a93bb9bd6ff14c6a7df5191 submitted by /u/Late_Ice_9288
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Why does it say PMKID found instead of WPA Handshake

So I used the traditional airodump-ng handshake capturing method and to generate a handshake i deauthenticated users off that wifi network using a completely different device. When I stopped deauthentication it said "PMKID found" where it should say WPA Handshake. What is PMKID and is that of any benefit?

submitted by /u/h4cks1n
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Google Dorks or Hack…

https://cdn-images-1.medium.com/max/800/0*pt4OONgUIcGx4kZ9.jpg
Google Dorks or Hack is a technique for creating queries on the Google search engine to discover hidden information and vulnerabilities…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: [Day 12] Networking Sharing Without Caring

https://cdn-images-1.medium.com/max/1920/1*psaTaSfd9sQyajFeYTLO-w.png
Scan the target server with the IP MACHINE_IP. Remember that MS Windows hosts block pings by default, so we need to add -Pn, for example…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to not dox myself in a new side project

Not sure if this is the right place, but y’all are the best of the pros. I’m looking to start a brand and YouTube channel which whatever millions of people do. Anyway my job, it disallows me from “working there” only certain people can be known to work there. I don’t want to dox myself. It’s bad enough if you search me, I do show up from linked in and several other like directory platforms (just discovered). So Anyway, for my brand how do I go about this? I did get it approved, but I don’t want to fuck my self and have people calling my employer and spamming them etc then cost me and my family our livelihoods. But I’d also like to use it as a resume builder (if possible). How do I do this without doxing myself? What is best practice? Suggestions?

submitted by /u/Steeler_Train
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do you organise your knowledge on long engagements?

How do you organise your knowledge on long engagements?

For CTFs, I use cherrytree for notes, but it doesn't scale to a group.

At the company, we use text files in folders, and regular files in folders. And do a full text index on the whole mess. (Of course some stuff, like bloodhound data, can't be easily indexed)

And we can't even agree on folder names. Sometimes you know the host name of a box, sometimes only the IP. Boxes have more than one IP. The same windows box may get a different IP the next day via DHCP. The company may have two 192.168.1.X subnets, that just don't route to each other.

- How do you organise your knowledge?

- Any workflows or tools that work well?

submitted by /u/MOVSQ
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Youtube Video Closed My Computer

I was trying to watch a Youtube video about current forum raid. Whenever i clicked that link my pc closed itself. It happened twice. Now it does not even open itself. What the hell is this?

My PC does not have malware. I would knew if there was one. I guess Windows 10 even collects data of what we do on our browsers. I am going to try again if i can find the video.

submitted by /u/E_DU
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Sites like i-hacking.com still alive today?

I found great interest in this site, but the waybackmachine doesnt fulfil my interest. Are there any similar sites still active today?

submitted by /u/slezzzy
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Git security vulnerabilities prompt updates

Git security vulnerabilities prompt updatesPost Views: 3
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.
Reading Time: 1 Minute
Software developers are advised to upgrade their systems to Git v2.35.2 in order to guard against potential attacks, which would rely on an attacker first gaining write access on a targeted system.
It’s time for developers to update their local Git installations following the discovery of a brace of vulnerabilities.

The worst of the two flaws (CVE-2022-24765) carries the potential of allowing an attacker to execute arbitrary commands.

Developers using Git for Windows or Git on a multi-user machine are most at risk, as an advisory by GitHub explains:

This vulnerability affects users working on multi-user machines where a malicious actor could create a .git directory in a shared location above a victim’s current working directory. On Windows, for example, an attacker could create C:\.git\config, which would cause all git invocations that occur outside of a repository to read its configured values.

Since some configuration variables (such as core.fsmonitor) cause Git to execute arbitrary commands, this can lead to arbitrary command execution when working on a shared machine.”
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
Developers who use Git on Linux or macOS are also affected by the CVE-2022-24765 flaw, albeit to a lesser extent. Patching in all cases is the recommended course of action but short of this, various mitigations are available, as detailed in GitHub’s advisory.

A second vulnerability (CVE-2022-24767) is limited to the Git for Windows uninstaller. As with the previous flaw, some level of compromised access is a prerequisite to potential attacks, as GitHub’s advisory explains.

Attacks would rely on planting malicious .dll files on a targeted system.
See Also: Kali Linux 2022.1 Release with Visual Updates, New Tools, Legacy SSH Users are advised to update to Git for Windows v2.35.2 but, again, a number of temporary mitigations offer a viable alternative.

Credit for discovering the vulnerability was given to Lockheed Martin’s red team. GitHub offers a centralized location for Git repositories, hence its role in flagging up the requirement for software updates. See Also: Offensive Security Tool: Scapy Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Hacking stories: MafiaBoy, the hacker who took down the Internet
Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Amazon-EC2-90x90.jpg Internal AWS credentials swiped by researcher via SQL payload24 hours ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info3 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-b[...]

___________________________
@hacking_Attack
@Hacking_Video

ody-text-90x90.jpg Apple paid out $36,000 bug bounty for HTTP request smuggling flaws6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/3e41-article-210226-vmware-body-text-90x90.jpg VMware warns of critical vulnerabilities in multiple products1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/A-New-Borat-RAT-Capable-Of-Conducting-Ransomware-DDOS-Activities-90x90.png No-Joke Borat RAT Propagates Ransomware, DDoS1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-pear-hacked-packages-malware-90x90.png Supply chain flaws in PHP package manager PEAR lay undiscovered for 15 years1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/php-hack-90x90.jpg PHP bug allows attackers to bypass domain filters, stage DoS attacks against servers1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/apple-iphone-hacking-90x90.jpg Apple emergency update fixes zero-days used to hack iPhones, Macs2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Google-Campus-90x90.jpg Google Chrome Bug Actively Exploited as Zero-Day2 weeks ago
The post Git security vulnerabilities prompt updates first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Subdomain Enumeration
https://medium.com/@reconshell.com/subdomain-enumeration-19e4f8b8299c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Open Source Intelligence gathering toolContinue reading on Medium » (https://medium.com/@reconshell.com/subdomain-enumeration-19e4f8b8299c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video