Hacking on Medium
Adrian Lamo: The Boy Inside the Man

https://cdn-images-1.medium.com/max/600/1*psgNgSIB369QxE-sZjNSzA.jpeg
He was among the first celebrity hackers, a genius to some and a traitor to others— a spy who tried to come in from the cold but found…

Continue reading on ILLUMINATION »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
EARN BIG TODAY!

HOT DEALS!!!!! WhatsApp:+1(202) 503–9187? HOT DEALS!!I

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Log4Shell vulnerability in AWS allows full host takeover

Log4Shell vulnerability in AWS allows full host takeoverPost Views: 11
Premium Content

https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
Due to the severity of Log4Shell, AWS released “hot patch” services that run on servers and spot and fix unpatched Java applications and containers on the fly.
The hot patches apply to standalone servers, Kubernetes clusters, and Elastic Container Service (ECS) clusters. Aside from AWS, these patches can also be installed in other cloud environments or standalone servers. Escaping the containerResearchers at Palo Alto Networks Unit 42 discovered the vulnerability, which could be exploited to take over the server or cluster running the patch service.

According to their findings, every container in a cluster can exploit the vulnerability for container escape and privilege escalation. Aside from containers, unprivileged processes can also exploit the patch service to escalate privileges and gain root code execution.

“We discovered this vulnerability soon after the tool was released as we were curious on how it patched containers,” Yuval Avrahami, principal security researcher at Palo Alto Networks, told The Daily Swig.

“We quickly reported the issue to the AWS security team and worked closely with the AWS engineering team as they developed patches.”
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
The hot patch searches for ‘java’ binaries inside containers and invokes them with its own server-level privileges and without containerizing them. This means the process runs without the limitations normally applied to container processes.

A malicious container can include a java binary to trick the patch into invoking it with elevated privileges, escape the container, and take over the underlying host.

The researchers posted a proof-of-concept that exploits the vulnerability to escape container limits, gain root code execution on the underlying host, and send a reverse shell to an attacker-controlled server. Possible ramificationsAvrahami said he was concerned about two main attack scenarios. First, if a publicly exposed container is compromised via some type of network attack, the threat actor can exploit the vulnerability to take over the underlying host, all neighboring containers, and possibly the hosting Kubernetes cluster.

“Unfortunately, it’s not uncommon for one container escape to be enough to take over an entire Kubernetes cluster,” Avrahami said.

“The vulnerability drastically increases the opportunity for lateral movement from a single compromised container to dozens and possibly hundreds.”

A second possible threat is an attacker infiltrating a container image registry to stage a supply-chain attack.

“The attacker injects the exploit to a container image, facilitating the compromise of any environment that runs the image and has the hot patch installed,” Avrahami said.

AWS has fixed the hot patch and released new versions.

“Organizations running container environments need to act as quickly as possible to confirm whether they’re using this tool and quickly patch if they are,” Avrahami said.
See Also: Cisco vulnerability lets hackers craft their own login credentials The challenges of container securityHot patches are makeshift solutions that are meant as short-term fixes until a permanent patch is installed.

Given the urgency surrounding Log4Shell, many users may have install[...]

___________________________
@hacking_Attack
@Hacking_Video

ed the hot patch at scale, putting container environments at risk, Avrahami warns. Even after patching their Java applications, they may have kept the hot patch running for added safety.

“Container isolation is difficult, and there are always risks involved when developing solutions that interact with containers,” Avrahami said.

“This also is a strong reminder that cloud security demands multiple layers of protections and that organizations should invest in security in depth as they increasingly transfer workloads to the cloud.” See Also: Offensive Security Tool: KeeThief Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
See Also: Write up: How to schedule tasks the right way in Linux, using crontab Source: portswigger.net Source Linkhttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch-1024x1024.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/New-Java-Framework-Vulnerability-and-Mitigations-90x90.jpg Java encryption implementation error made it trivial to forge credentials4 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-3-90x90.jpg CISA warns of attackers now exploiting Windows Print Spooler bug5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-3-90x90.jpg Newly found zero-click iPhone exploit used in NSO spyware attacks6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/2b93-article-220121-cisco-90x90.jpg Cisco vulnerability lets hackers craft their own login credentials1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/windows-patch-update-90x90.jpg Microsoft Zero-Days, Wormable Bugs Spark Concern1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-2-90x90.jpg Git security vulnerabilities prompt updates2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Amazon-EC2-90x90.jpg Internal AWS credentials swiped by researcher via SQL payload2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/spring4shell-90x90.jpg Attackers are abusing Spring4Shell vulnerability to spread Mirai botnet malware2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/ezgif.com-gif-maker-2-1-90x90.jpg Attackers Spoof WhatsApp Voice-Message Alerts to Steal Info2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/f956-article-211015-apple-body-text-90x90.jpg Apple paid out $36,000 bug bounty for HTTP request smuggling flaws2 weeks ago
The post Log4Shell vulnerability in AWS allows full host takeover first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
powershell -executionpolicy remotesigned purpose in malware

I've recently encountered a malware that executes:
powershell -executionpolicy remotesigned on a powershell file he downloads from the internet.
after reading what remotesigned is, I found out the meaning is that Downloaded scripts must be signed by a trusted publisher before they can be run.

but if the malware being downloaded probably not signed, why would the malware execute this command? (does the script downloaded from the internet can be signed manually by the malware creator?)

submitted by /u/HybridToxic
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Possible hacking attempts in Wp website

Hello. I don't know if there is a better sub for that but ... I have a website under Wordpress + Woocommerce in which the Limit Login Attempts Reloaded plugin is also active. In the past few days I have been warned of several connexion attempts followed by lockouts from a IP which I was unable to trace. What really bother me is that the two IDs used for these attempts were existing ID and one with the admin rights. How could the potential hacker have found these IDs ? How could I increase the level of protection ? Thanks for your help.

submitted by /u/Best_Witness6682
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How do I use hashcat to restore a mistaken password while I know the password targeted ?

When I set the password I made a mistake , How do I use hashcat with the password i wanted to use in the first place to find the one I set .

submitted by /u/bruno_thesonofmoses
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
SSTI Flask/Jinja2

Alright so I’m doing a machine on HackTheBox. I won’t mention the name so as not to spoil. I’m basically struggling a little with SSTI on Flask. I completely understand how it works and how to exploit it, but the issue is that I have to exploit it by uploading an image which is scanned by flask for text. The problem I’m getting is that I think adding quotes around the command run by subprocess.Popen() is causing the injection to not work. This is because it keeps saying something along the lines of “unexpected token at 49: “‘“” My question is: is there any way to bypass this? Maybe by using urlsafe injections or base64 or hex or something idk?

Edit 1: If any pictures of the error I’m running into need to be provided, I can provide them so just lmk.

submitted by /u/Garlic-George-420
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Website that studies in detail latest hacks?
https://www.reddit.com/r/Pentesting/comments/ubhirj/website_that_studies_in_detail_latest_hacks/

Hi, does anyone know a website which goes into technical detail of the latest cybernews? What I mean by this is the full explanation of the latest hacks (how they got a foothold, the vulns they found, malware analysis etc). submitted by /u/ErikDz11 (https://www.reddit.com/user/ErikDz11)
[link] (https://www.reddit.com/r/Pentesting/comments/ubhirj/website_that_studies_in_detail_latest_hacks/) [comments] (https://www.reddit.com/r/Pentesting/comments/ubhirj/website_that_studies_in_detail_latest_hacks/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
T-mobile Systems breached by cybercrime group LAPSUS$

https://cdn-images-1.medium.com/max/769/0*CVg3vcQCU_DAa-LN
In a series of intrusions in March, the Lapsus$ hacker group acquired T-source Mobile’s code. The hackers acquired access to T-internal…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

DDexec - A Technique To Run Binaries Filelessly And Stealthily On Linux Using Dd To Replace The Shell With Another Process
http://www.kitploit.com/2022/04/ddexec-technique-to-run-binaries.html

___________________________
@hacking_Attack
@Hacking_Video

In Linux in order to run a program it must exist as a file, it must be accessible in some way through the file system hierarchy (this is just how execve() works). This file may reside on disk or in ram (tmpfs, memfd) but you need a filepath. This has made very easy to control what is run on a Linux system, it makes easy to detect threats and attacker's tools or to prevent them from trying to execute anything of theirs at all (e. g. not allowing unprivileged users to place executable files anywhere). But this technique is here to change all of this. If you can not start the process you want... then you hijack one already existing.
Usage Pipe into the ddexec.sh script the base64 of the binary (https://www.kitploit.com/search/label/Binary) you want to run (without newlines). The arguments for the script are the arguments for the program (starting with argv[0]). Here, try this: base64 -w0 /bin/ls | bash ddexec.sh /bin/ls -lA There is also the ddsc.sh script that allows you to run binary code directly. The following is a "Hello world" shellcode. bash ddsc.sh -x <<< "4831c0fec089c7488d3510000000ba0c0000000f054831c089c7b03c0f0548656c6c6f20776f726c640a00" or bash ddsc.sh < <(xxd -ps -r <<< "4831c0fec089c7488d3510000000ba0c0000000f054831c089c7b03c0f0548656c6c6f20776f726c640a00") And yes. It works with meterpreter. Tested Linux distributions are Debian, Alpine and Arch. Supported shells are bash, zsh and ash over x86_64 and aarch64 (arm64) architectures. Dependencies This script depends on the following tools to work. dd bash | zsh | ash (busybox) head tail cut grep od readlink wc tr base64 The technique If you are able to modify arbitrarily the memory (https://www.kitploit.com/search/label/Memory) of a process then you can take over it. This can be used to hijack an already existing process and replace it with another program. We can achieve this either by using the ptrace() syscall (which requires you to have the ability to execute syscalls (https://www.kitploit.com/search/label/Syscalls) or to have gdb available on the system) or, more interestingly, writing to /proc/$pid/mem. The file /proc/$pid/mem is a one-to-one mapping of the entire address space of a process (e. g. from 0x0000000000000000 to 0x7ffffffffffff000 in x86-64). This means that reading from or writing to this file at an offset x is the same as reading from or modifying the contents at the virtual address x. Now, we have four basic problems to face: In general, only root and the program owner of the file may modify it. ASLR. If we try to read or write to an address not mapped in the address space of the program we will get an I/O error. This problems have solutions that, although they are not perfect, are good: Most shell interpreters allow the creation of file descriptors that will then be inherited by child processes. We can create a fd pointing to the mem file of the sell with write permissions... so child processes that use that fd will be able to modify the shell's memory. ASLR isn't even a problem, we can check the shell's maps file or any other from the procfs in order to gain information about the address space of the process. So we need to lseek() over the file. From the shell this cannot be done unless using the infamous dd. In more detail The steps are relatively easy and do not require any kind of expertise to understand them: Parse the binary we want to run and the loader to find out what mappings they need. Then craft a "shell"code that will perform, broadly speaking, the same steps that the kernel (https://www.kitploit.com/search/label/Kernel) does upon each call to execve(): Create said mappings. Read the binaries into them. Set up permissions. Finally initialize the stack with the arguments for the program and place the auxiliary vector (needed by the loader). Jump into the loader and let it do the rest (load libraries needed by the program). Obtain from the syscall file the

___________________________
@hacking_Attack
@Hacking_Video

address to which the process will return after the syscall it is executing. Overwrite that place, which will be executable, with our shellcode (through mem we can modify unwritable pages). Pass the program we want to run to the stdin of the process (will be read() by said "shell"code). At this point it is up to the loader to load the necessary libraries for our program and jump into it. Oh, and all of this must be done in shell scripting, or what would be the point? Contribute Well, there are a couple of TODOs. Besides this, you may have noticed that I do not know much about shell scripting (https://www.kitploit.com/search/label/Scripting) (I am more of a C programmer) and I am sure I must have won a decade worth of "useless use of an echo" (https://porkmail.org/era/unix/award.html) awards and the rest of variants just with a fraction of this project. Improve code style and performance. Port to other shells. Allow run the program with a non-empty environment. Anyway, all contribution is welcome. Feel free to fork and PR. Credit Recently I have come to know that Sektor7 (https://www.sektor7.net/) had already published (https://blog.sektor7.net/#!res/2018/pure-in-memory-linux.md) this almost-exact same technique on their blog a few years ago. Despite this, I thought this technique independently in, now almost, its entirety. Probably the smarter piece of this technique is the use of the inherited file descriptor, idea provided by David Buchanan (https://github.com/DavidBuchanan314) (inspired, I think, by Sektor7's blog) almost a year before I even started thinking about this topic. This alone not only makes the technique much simpler and neat, it also makes it far deadlier by eliminating the need to disable ASLR. His tweet (https://twitter.com/David3141593/status/1386661837073174532) also made me realize how stupid I was for not noticing that mem allowed to write to non-writable pages, hence making the ROP unnecessary... This ultimately also has the desired effect of making this significantly easier to port to other ISAs. Either way, I hope I will be able to spread this technique much further, which is what matters. I would like to thank Carlos Polop (https://github.com/carlospolop), a great pentester and better friend, for making me think about this subject, and for his helpful feedback and interest, oh and the name of the project. I am sure that if you are reading this you have already used his awesome tool PEASS (https://github.com/carlospolop/PEASS-ng) and found helpful some article in his book HackTricks (https://book.hacktricks.xyz/). I also thank him for helping me with the talk at the RootedCon 2022 (https://rootedcon.com/). Now what? This technique can be prevented in several ways. Not installing dd (maybe even go distroless?). Placing dd where only root can run it. Using a kernel compiled without support for the mem file. Questions? Death threats? Feel free to send me an email to arget@protonmail.ch (mailto:arget@protonmail.ch).

Download DDexec (https://github.com/arget13/DDexec)

___________________________
@hacking_Attack
@Hacking_Video

fuzzing and credentials leakage..nice bug hunting writeup

Here you find a beautiful write-up with useful tips :)Continue reading on Medium »
Read more...

hacking: security in practice
MacOS specific thick client pentesting methodology/tips?

Hello!

I'm working on a multiplatform thick client app pentest that is available on Windows, Android and MacOS. I'm testing all of the variants, which also includes MacOS that I have very limited experience with, since I'm not a Apple user. My question is, are there any MacOS specific checks or tools that I should definitely perform and look into? Be it access control, services created by the appliaction and their access level, etc?

Most of the communication towards the server has already been tested on the Win and Android builds, but I should look into some Mac-specific risks, which I have very limited experience with, so any tip or a book/guide recommendation would be greatly appreciated.

Thank you!

submitted by /u/Mikina
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video