KitPloit - PenTest Tools!
Spring4Shell-POC - Dockerized Spring4Shell (CVE-2022-22965) PoC Application And Exploit

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjaq3n6pTYJadYNCpjVegHxZFc8ZwiZUtKbPgpxPlbSd7vQgjUEfKFw0cO8jrAjpHsv_tzZAG_chVh9Mwrrh9UpIHbkniKAjKptmjj-rJ2uOjSxvBrPfVn3H2AZpIjCO-1Lrt4HnOxh7SS5SrMbbIttLpUzw7xDtIat1yKhbVk_0JgC8RDhwEXTMEuY/w640-h308/Spring4Shell.png This is a dockerized application that is vulnerable to the Spring4Shell vulnerability (CVE-2022-22965). Full Java source for the war is provided and modifiable, the war will get re-built whenever the docker image is built. The built WAR will then be loaded by Tomcat. There is nothing special about this application, it's a simple hello world that's based off Spring tutorials.

Details: https://www.lunasec.io/docs/blog/spring-rce-vulnerabilities

Having issues with the POC? Check out the LunaSec fork at: https://github.com/lunasec-io/Spring4Shell-POC, it's more actively maintained. Requirements1. Docker
2. Python3 + requests library Instructions1. Clone the repository
2. Build and run the container: docker build . -t spring4shell && docker run -p 8080:8080 spring4shell3. App should now be available at http://localhost:8080/helloworld/greeting https://blogger.googleusercontent.com/img/a/AVvXsEgiSKKOBdAf-H6x6nvFmF2wHQ0WkAKdimGQcO3ortF_UVrOhKDkUDmIr4gxFzpaEaodNjEbpOo2z05EuGygz6K7atd6sXZYvXGfs60tMvLY5ZPxKOwuFrODicy7AbrL7kskqnDMETdZ2FPvJ1mD0gw2LxfG-qch-LSC8tBo7hIW-JM4Jj9jGhkehhhD=w640-h124 1. Run the exploit.py script: python exploit.py --url "http://localhost:8080/helloworld/greeting"https://blogger.googleusercontent.com/img/a/AVvXsEhXbcvigqvcJMzQzqHzuPqv8kDD2hEASz5zefNLhrnslPL6PVh8EdqWR0NFrOVdonBf7kBvzydhbiiPpBmFXSQun215RFALW4ijb3ucOIgmJKqELuISNRn59h8q-FHSlsEeoc594Ns_vIAkKrrogsoVbif_ufTU9Udrr2Umykdeyz9b0o3y5DkRXVhj=w640-h50 1. Visit the created webshell! Modify the cmdGET parameter for your commands. (http://localhost:8080/shell.jsp by default) https://blogger.googleusercontent.com/img/a/AVvXsEgTxfQevfT3YeenETl-w22eGNM_pdTzRn-0Nr0fwMbrmE7CLOkf33fpWA0N4zEloY3M1qI7ja7sQ-MziwLKY0FoiMoJ1e1kPhHSTMnyCU8L358ZRZTXcLmZDM7U9FHf7YuvY_3Nu3l17zdYcxQC4C9UgkypJ82wWMrgZt1jZ1cS_-2kOH7GfPdZgu6F=w640-h118 NotesFixed! As of this writing, the container (possibly just Tomcat) must be restarted between exploitations. I'm actively trying to resolve this.

Re-running the exploit will create an extra artifact file of {old_filename}_.jsp.

PRs/DMs @Rezn0k are welcome for improvements! Credits* @esheavyind for help on building a PoC. Check out their writeup at: https://gist.github.com/esell/c9731a7e2c5404af7716a6810dc33e1a
* @LunaSecIO for improving the documentation and exploit
* @rwincey for making the exploit replayable without requiring a Tomcat restart Download Spring4Shell-POC

___________________________
@hacking_Attack
@Hacking_Video

Business Logic Vulnerabilities (easy hit) Bug-Bounty
https://medium.com/@gandhim373/business-logic-vulnerabilities-easy-hit-bug-bounty-8cbfbb5af9eb?source=rss------bug_bounty-5

Hello Cybersecurity Researchers,Continue reading on Medium » (https://medium.com/@gandhim373/business-logic-vulnerabilities-easy-hit-bug-bounty-8cbfbb5af9eb?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Building your own app
https://www.reddit.com/r/Pentesting/comments/umj285/building_your_own_app/

Hello, I have to build for my master's degree my own application in pen testing... I'm extremely lost and confused, in all fairness I don't know where to start, and I'm also not thinking of doing anything impressive. I wanted to ask you guys if anyone could kindly refer me any materials in order to build something from scratch. I would be complacent even with the simplest thing that a student can make. Thank you submitted by /u/Kiddas (https://www.reddit.com/user/Kiddas)
[link] (https://www.reddit.com/r/Pentesting/comments/umj285/building_your_own_app/) [comments] (https://www.reddit.com/r/Pentesting/comments/umj285/building_your_own_app/)

___________________________
@hacking_Attack
@Hacking_Video

Diving into pre-created computer accounts
https://www.reddit.com/r/redteamsec/comments/umiike/diving_into_precreated_computer_accounts/

submitted by /u/oddvarmoe (https://www.reddit.com/user/oddvarmoe)
[link] (https://www.trustedsec.com/blog/diving-into-pre-created-computer-accounts/) [comments] (https://www.reddit.com/r/redteamsec/comments/umiike/diving_into_precreated_computer_accounts/)

___________________________
@hacking_Attack
@Hacking_Video

Introducing pyCobaltHound
https://www.reddit.com/r/redteamsec/comments/umj4wl/introducing_pycobalthound/

pyCobaltHound is an Aggressor script extension for Cobalt Strike which aims to provide a deep integration between Cobalt Strike and Bloodhound. https://blog.nviso.eu/2022/05/09/introducing-pycobalthound/ submitted by /u/A32AN (https://www.reddit.com/user/A32AN)
[link] (https://www.reddit.com/r/redteamsec/comments/umj4wl/introducing_pycobalthound/) [comments] (https://www.reddit.com/r/redteamsec/comments/umj4wl/introducing_pycobalthound/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Printix 1.3.1106.0 Privilege Escalation

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
A "Creation of Temporary Files in Directory with Insecure Permissions" vulnerability in PrintixService.exe in Printix's "Printix Secure Cloud Print Management" versions 1.3.1106.0 and below allows any logged in user to elevate any executable or file to the SYSTEM context. This is achieved by exploiting race conditions in the creation of the Installer's temp.ini file.

SHA-256 | 962985a116482c4dadbf77096ef08deaadaf5eff443d79735b06e3812d725e3e

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Spring4Shell Spring Framework Class Property Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Printix 1.3.1106.0 Privileged API Abuse

https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
An "Incorrect Use of a Privileged API" vulnerability in PrintixService.exe in Printix's "Printix Secure Cloud Print Management" versions 1.3.1106.0 and below allows a local or remote attacker the ability change all HKEY Windows Registry values as SYSTEM context via the UITasks.PersistentRegistryData parameter.

SHA-256 | e26119f8d98f860e7ac7059a0d25e15dfc9acdbc0d49faa1f612da8efaf64cdc

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

RCE via Dependency Confusion
https://sm4rty.medium.com/rce-via-dependency-confusion-e0ed2a127013?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey there, I am Samrat Gupta aka Sm4rty, a Security Researcher and a Bug Bounty Hunter. In this Blog I will be sharing my recent finding…Continue reading on Medium » (https://sm4rty.medium.com/rce-via-dependency-confusion-e0ed2a127013?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Mastering the New CISO Playbook

How can you safeguard your organization amid global conflict and uncertainty?

Dark Reading: Attacks/Breaches
Onapsis Announces New Offering to Jumpstart Security for SAP Customers

Company delivers new vulnerability management offering to help resource-constrained organizations combat increasing attacks on mission-critical SAP applications .

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
5-Buck DCRat Malware Foretells a Worrying Cyber Future

The Dark Crystal remote access Trojan (aka DCRat) breaks a few stereotypes, with coding done by a solo developer, using an obscure Web language and offering it at a frighteningly low price.

Dark Reading: Attacks/Breaches
Arctic Wolf Launches Arctic Wolf Labs Focused on Security Operations Research and Intelligence Reporting

New research-focused division focused on advancing innovation in the field of security operations.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cybercriminals Are Increasingly Exploiting Vulnerabilities in Windows Print Spooler

Kaspersky researchers discovered that cybercriminals made approximately 65,000 attacks between July 2021 and April 2022.

___________________________
@hacking_Attack
@Hacking_Video