Hacking Articles Tips Tricks Videos Tutorials
GIF
Kali Linux Tutorials
Ostorlab : A Security Scanning Platform That Enables Running Complex Security Scanning Tasks
Ostorlab is a Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing it to another tool. Several tools have tried to make the process less painful. Ostorlab addresses the same challenge by simplifying the hardest part and automating the boring and tedious part.
To do that, Ostorlab focuses on the following:
* Ease of use with simple one command-line to perform all tasks
* Developer Experience through project documentation, tutorials, SDK and templates
* Scalability and Performance by using efficient serialisation format and proven industry standard for all of its components
To do that, Ostorlab ships with:
* A simple, yet powerful SDK to make simple cases effortless while supporting the complex one, like distributed locking, QPS limiting, multiple instance parallelization …
* A battle-tested framework that has been powering Ostorlab Platform for years and used to perform complex dynamic analysis setup and demanding static analysis workloads running on multiple machines.
* Performant and scalable design, thanks to the use of message queue with dynamic routing, binary and compact message serialisation with protobuf, universal file format using docker image and resilient deployment thanks to docker swarm.
* A store of agents that makes it easy to use and discover tools to add your toolset.
* An automated builder to take the hassle away of building and publishing.
* A GUI to prepare and write down your tool collection setup.
* Focus on documentation, multiple tutorials and upcoming videos and conference presentations.
* A ready to use one-click template repo to get started.
Requirements
For some tasks, like running scans locally, Docker is required. To install docker, please see the following instructions.
Installing
Ostorlab is shipped as a Python package on Pypi. To install, simply run the following command if you have
pip install -U ostorlab
Getting Started
To perform your first scan, simply run the following command:
ostorlab scan run –install –agent agent/ostorlab/nmap –agent agent/ostorlab/openvas –agent agent/ostorlab/tsunami –agent agent/ostorlab/nuclei ip 8.8.8.8
This command will download and install the following scanning agents:
*
*
*
*
And will scan the target IP address
To check the scan status:
ostorlab scan list
Once the scan has completed, to access the scan results:
ostorlab vulnz list –scan-id
ostorlab vulnz describe –vuln-id
The Store
Ostorlab lists all agents on a public store where you can search and also publish your own agents.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1se-Ah34nAUYH9MEwDZ2A_GM-j4fq6YPm_m8a5AFC0h3xYBs6LijkgoHqktyZIipX-E_jvoEq_9h2c4yz7-Xfo1g9cSu5JKqgswv_RNK8Psf1fojpfuVb6a80L2ckI2Ht3f2DijW55KoOYDplCnez0qiQUMjZ0UHSs-Rr68jlqxYotIdKMWI-BqYW/s1719/store2.gif
Download
___________________________
@hacking_Attack
@Hacking_Video
Ostorlab : A Security Scanning Platform That Enables Running Complex Security Scanning Tasks
Ostorlab is a Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing it to another tool. Several tools have tried to make the process less painful. Ostorlab addresses the same challenge by simplifying the hardest part and automating the boring and tedious part.
To do that, Ostorlab focuses on the following:
* Ease of use with simple one command-line to perform all tasks
* Developer Experience through project documentation, tutorials, SDK and templates
* Scalability and Performance by using efficient serialisation format and proven industry standard for all of its components
To do that, Ostorlab ships with:
* A simple, yet powerful SDK to make simple cases effortless while supporting the complex one, like distributed locking, QPS limiting, multiple instance parallelization …
* A battle-tested framework that has been powering Ostorlab Platform for years and used to perform complex dynamic analysis setup and demanding static analysis workloads running on multiple machines.
* Performant and scalable design, thanks to the use of message queue with dynamic routing, binary and compact message serialisation with protobuf, universal file format using docker image and resilient deployment thanks to docker swarm.
* A store of agents that makes it easy to use and discover tools to add your toolset.
* An automated builder to take the hassle away of building and publishing.
* A GUI to prepare and write down your tool collection setup.
* Focus on documentation, multiple tutorials and upcoming videos and conference presentations.
* A ready to use one-click template repo to get started.
Requirements
For some tasks, like running scans locally, Docker is required. To install docker, please see the following instructions.
Installing
Ostorlab is shipped as a Python package on Pypi. To install, simply run the following command if you have
pipalready installed.pip install -U ostorlab
Getting Started
To perform your first scan, simply run the following command:
ostorlab scan run –install –agent agent/ostorlab/nmap –agent agent/ostorlab/openvas –agent agent/ostorlab/tsunami –agent agent/ostorlab/nuclei ip 8.8.8.8
This command will download and install the following scanning agents:
*
agent/ostorlab/nmap*
agent/ostorlab/tsunami*
agent/ostorlab/nuclei*
agent/ostorlab/openvasAnd will scan the target IP address
8.8.8.8To check the scan status:
ostorlab scan list
Once the scan has completed, to access the scan results:
ostorlab vulnz list –scan-id
ostorlab vulnz describe –vuln-id
The Store
Ostorlab lists all agents on a public store where you can search and also publish your own agents.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj1se-Ah34nAUYH9MEwDZ2A_GM-j4fq6YPm_m8a5AFC0h3xYBs6LijkgoHqktyZIipX-E_jvoEq_9h2c4yz7-Xfo1g9cSu5JKqgswv_RNK8Psf1fojpfuVb6a80L2ckI2Ht3f2DijW55KoOYDplCnez0qiQUMjZ0UHSs-Rr68jlqxYotIdKMWI-BqYW/s1719/store2.gif
Download
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Ostorlab : A Security Scanning Platform That Enables Running Complex
Ostorlab is a Security testing requires often chaining tools together, taking the output from one, mangling it, filtering it and then pushing
Hacking Articles Tips Tricks Videos Tutorials
Photo
Kali Linux Tutorials
Nimcrypt2 : .NET, PE, And Raw Shellcode Packer/Loader Written In Nim
Nimcrypt2 is yet another PE packer/loader designed to bypass AV/EDR. It is an improvement on my original Nimcrypt project, with the main improvements being the use of direct syscalls and the ability to load regular PE files as well as raw shellcode.
Before going any further, I must acknowledge those who did the VAST majority of work and research that this project depends on. Firstly, I must thank @byt3bl33d3r for his Offensive Nim repo, and @ShitSecure for all of the code snippets he’s publicly released. That is what the original version of this tool was created from, and the current version is no different. Particularly, the new PE loading functionality used in this tool is just an implementation of ShitSecure’s recently released Nim-RunPE code. As of 3/14/22, this code also uses his GetSyscallStub code for dynamic syscall usage. I highly encourage sponsoring him for access to his own Nim PE Packer, which is no doubt a much better and more featureful version of this.
Additionally, I would like to thank @ajpc500 for his NimlineWhispers2 project that this tool uses for direct syscalls. I cannot stress enough how this project is simply an amalgamation of the public work of those previously mentioned, so all credit must go to them.
Nimcrypt v 2.0
Usage:
nimcrypt -f file_to_load -t csharp/raw/pe [-o ] [-p ] [-n] [-u] [-s] [-e] [-g] [-l] [-v]
nimcrypt (-h | –help)
Options:
-h –help Show this screen.
–version Show version.
-f –file filename File to load
-t –type filetype Type of file (csharp, raw, or pe)
-p –process process Name of process for shellcode injection
-o –output filename Filename for compiled exe
-u –unhook Unhook ntdll.dll
-v –verbose Enable verbose messages during execution
-e –encrypt-strings Encrypt strings using the strenc module
-g –get-syscallstub Use GetSyscallStub instead of NimlineWhispers2
-l –llvm-obfuscator Use Obfuscator-LLVM to compile binary
-n –no-randomization Disable syscall name randomization
-s –no-sandbox Disable sandbox checks Features* NtQueueApcThread Shellcode Execution w/ PPID Spoofing & 3rd Party DLL Blocking
* NimlineWhispers2 & GetSyscallStub for Syscall Use
* Syscall Name Randomization
* Ability to load .NET and Regular PE Files
* AES Encryption with Dynamic Key Generation
* LLVM-Obfuscator Compatibility
* String Encryption
* Sandbox Evasion Tested and Confirmed Working on* Windows 11 (10.0.22000)
* Windows 10 21H2 (10.0.19044)
* Windows 10 21H1 (10.0.19043)
* Windows 10 20H2 (10.0.19042)
* Windows 10 19H2 (10.0.18363)
* Windows Server 2019 (10.0.17763) Installation/DependenciesNimcrypt2 is designed to be used on Linux systems with Nim installed. Before installing Nim, you must ensure that you have the following packages installed via your package manager:
sudo apt install gcc mingw-w64 xz-utils git
To install Nim, I prefer to use choosenim as follows:
curl https://nim-lang.org/choosenim/init.sh -sSf | sh
echo “export PATH=$HOME/.nimble/bin:$PATH” >> ~/.bashrc
export PATH=$HOME/.nimble/bin:$PATH
Nimcrypt2 also depends on a few packages that can be installed via Nimble. This can be done like so:
nimble install winim nimcrypto docopt ptr_math strenc
With all the dependencies now installed, Nimcrypt2 can be compiled like so:
nim c -d=release –cc:gcc –embedsrc=on –hints=on –app=console –cpu=amd64 –out=nimcrypt nimcrypt.nim
OPTIONAL: To use the Obfuscator-LLVM flag, you must have it installed on your system alongside wclang. I’ve found this to be a bit of a pain but you should be able to do it with a little perseverance. Here’s a quick step-by-step that worked on my Kali Linux system:
* Clone desired version of Obfuscator-LLVM and build it
* Once compiled, backup the existing version of clang and move the new Obfuscator-LLVM version of clang to /usr/bin/
* Install wclang and add it’s binaries to your P[...]
___________________________
@hacking_Attack
@Hacking_Video
Nimcrypt2 : .NET, PE, And Raw Shellcode Packer/Loader Written In Nim
Nimcrypt2 is yet another PE packer/loader designed to bypass AV/EDR. It is an improvement on my original Nimcrypt project, with the main improvements being the use of direct syscalls and the ability to load regular PE files as well as raw shellcode.
Before going any further, I must acknowledge those who did the VAST majority of work and research that this project depends on. Firstly, I must thank @byt3bl33d3r for his Offensive Nim repo, and @ShitSecure for all of the code snippets he’s publicly released. That is what the original version of this tool was created from, and the current version is no different. Particularly, the new PE loading functionality used in this tool is just an implementation of ShitSecure’s recently released Nim-RunPE code. As of 3/14/22, this code also uses his GetSyscallStub code for dynamic syscall usage. I highly encourage sponsoring him for access to his own Nim PE Packer, which is no doubt a much better and more featureful version of this.
Additionally, I would like to thank @ajpc500 for his NimlineWhispers2 project that this tool uses for direct syscalls. I cannot stress enough how this project is simply an amalgamation of the public work of those previously mentioned, so all credit must go to them.
Nimcrypt v 2.0
Usage:
nimcrypt -f file_to_load -t csharp/raw/pe [-o ] [-p ] [-n] [-u] [-s] [-e] [-g] [-l] [-v]
nimcrypt (-h | –help)
Options:
-h –help Show this screen.
–version Show version.
-f –file filename File to load
-t –type filetype Type of file (csharp, raw, or pe)
-p –process process Name of process for shellcode injection
-o –output filename Filename for compiled exe
-u –unhook Unhook ntdll.dll
-v –verbose Enable verbose messages during execution
-e –encrypt-strings Encrypt strings using the strenc module
-g –get-syscallstub Use GetSyscallStub instead of NimlineWhispers2
-l –llvm-obfuscator Use Obfuscator-LLVM to compile binary
-n –no-randomization Disable syscall name randomization
-s –no-sandbox Disable sandbox checks Features* NtQueueApcThread Shellcode Execution w/ PPID Spoofing & 3rd Party DLL Blocking
* NimlineWhispers2 & GetSyscallStub for Syscall Use
* Syscall Name Randomization
* Ability to load .NET and Regular PE Files
* AES Encryption with Dynamic Key Generation
* LLVM-Obfuscator Compatibility
* String Encryption
* Sandbox Evasion Tested and Confirmed Working on* Windows 11 (10.0.22000)
* Windows 10 21H2 (10.0.19044)
* Windows 10 21H1 (10.0.19043)
* Windows 10 20H2 (10.0.19042)
* Windows 10 19H2 (10.0.18363)
* Windows Server 2019 (10.0.17763) Installation/DependenciesNimcrypt2 is designed to be used on Linux systems with Nim installed. Before installing Nim, you must ensure that you have the following packages installed via your package manager:
sudo apt install gcc mingw-w64 xz-utils git
To install Nim, I prefer to use choosenim as follows:
curl https://nim-lang.org/choosenim/init.sh -sSf | sh
echo “export PATH=$HOME/.nimble/bin:$PATH” >> ~/.bashrc
export PATH=$HOME/.nimble/bin:$PATH
Nimcrypt2 also depends on a few packages that can be installed via Nimble. This can be done like so:
nimble install winim nimcrypto docopt ptr_math strenc
With all the dependencies now installed, Nimcrypt2 can be compiled like so:
nim c -d=release –cc:gcc –embedsrc=on –hints=on –app=console –cpu=amd64 –out=nimcrypt nimcrypt.nim
OPTIONAL: To use the Obfuscator-LLVM flag, you must have it installed on your system alongside wclang. I’ve found this to be a bit of a pain but you should be able to do it with a little perseverance. Here’s a quick step-by-step that worked on my Kali Linux system:
* Clone desired version of Obfuscator-LLVM and build it
* Once compiled, backup the existing version of clang and move the new Obfuscator-LLVM version of clang to /usr/bin/
* Install wclang and add it’s binaries to your P[...]
___________________________
@hacking_Attack
@Hacking_Video
Kali Linux Tutorials
Nimcrypt2 : .NET, PE, And Raw Shellcode Packer/Loader Written In Nim
Nimcrypt2 is yet another PE packer/loader designed to bypass AV/EDR. It is an improvement on my original Nimcrypt project.
Hacking Articles Tips Tricks Videos Tutorials
Kali Linux Tutorials Nimcrypt2 : .NET, PE, And Raw Shellcode Packer/Loader Written In Nim Nimcrypt2 is yet another PE packer/loader designed to bypass AV/EDR. It is an improvement on my original Nimcrypt project, with the main improvements being the use of…
ATH
* Backup existing clang library files, copy new newly built Obfuscator-LLVM library includes to /usr/lib/clang/OLD_VERSION/
In addition, you must add the following lines to your
amd64.windows.clang.exe = “x86_64-w64-mingw32-clang”
amd64.windows.clang.linkerexe = “x86_64-w64-mingw32-clang”
amd64.windows.clang.cpp.exe = “x86_64-w64-mingw32-clang++”
amd64.windows.clang.cpp.linkerexe = “x86_64-w64-mingw32-clang++”
___________________________
@hacking_Attack
@Hacking_Video
* Backup existing clang library files, copy new newly built Obfuscator-LLVM library includes to /usr/lib/clang/OLD_VERSION/
In addition, you must add the following lines to your
nim.cfgfile to point nim to your wclang binaries:amd64.windows.clang.exe = “x86_64-w64-mingw32-clang”
amd64.windows.clang.linkerexe = “x86_64-w64-mingw32-clang”
amd64.windows.clang.cpp.exe = “x86_64-w64-mingw32-clang++”
amd64.windows.clang.cpp.linkerexe = “x86_64-w64-mingw32-clang++”
amd64.windows.clang.cpp.linkerexe = "x86_64-w64-mingw32-clang++" There is probably a better way to do this but this is what worked for me. If you have issues, just keep trying and ensure that you can run x86_64-w64-mingw32-clang -vand it shows “Obfuscator-LLVM” in the output. Also ensure MinGW is using the Obfuscator-LLVM library files: Nim will give you an error if not. Download___________________________
@hacking_Attack
@Hacking_Video
Exploit Collector
Ransom.Conti MVID-2022-0601 Code Execution
___________________________
@hacking_Attack
@Hacking_Video
Ransom.Conti MVID-2022-0601 Code Execution
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Ransom.Conti MVID-2022-0601 Code Execution
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Exploit Collector
Ransom.Conti MVID-2022-0606 Code Execution
___________________________
@hacking_Attack
@Hacking_Video
Ransom.Conti MVID-2022-0606 Code Execution
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Ransom.Conti MVID-2022-0606 Code Execution
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
WordPress WP Event Manager 3.1.27 Cross Site Scripting
https://3.bp.blogspot.com/-jrxagBWWEzc/WWlvX2ct0sI/AAAAAAAAIOc/SeYUuYsvaHQ6pP3Hky0NtyeOgPg6HpFpgCLcBGAs/s1600/h54.png
WordPress WP Event Manager plugin version 3.1.27 suffers from a persistent cross site scripting vulnerability.
SHA-256 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
WordPress WP Event Manager 3.1.27 Cross Site Scripting
https://3.bp.blogspot.com/-jrxagBWWEzc/WWlvX2ct0sI/AAAAAAAAIOc/SeYUuYsvaHQ6pP3Hky0NtyeOgPg6HpFpgCLcBGAs/s1600/h54.png
WordPress WP Event Manager plugin version 3.1.27 suffers from a persistent cross site scripting vulnerability.
SHA-256 |
cb5312a73f5b91f714b3b64a7d4a985e9b27b678feeae51e27a65c49cef79597Download
# Exploit Title: WordPress Plugin WP Event Manager - Stored Cross Site
Scripting
# Date: 15-05-2022
# Exploit Author: Mariam Tariq - HunterSherlock
# Vendor Homepage: https://wordpress.org/plugins/wp-event-manager/
# Version: 3.1.27
# Tested on: Firefox
# Contact me: mariamtariq404@gmail.com
#Steps To Reproduce :
1 - First Install the plugins - wp-event-manager and activate it.
2 - Go to event manager —> Add New
3 - Inside the “”Event Title” at the top, enter XSS payload “>
onerror=alert(1)> and hit publish.
4 - Check the newly made event’s URL /event/{id}/ , XSS will trigger.
#Poc Image :
https://imgur.com/J1Q3x5u
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
WordPress WP Event Manager 3.1.27 Cross Site Scripting
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Zyxel Remote Command Execution
https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Victorian Machinery is a proof of concept exploit for CVE-2022-30525. The vulnerability is an unauthenticated and remote command injection vulnerability affecting Zyxel firewall's that support zero touch provisioning. Zyxel pushed a fix for this issue on April 28, 2022. Multiple models are affected.
SHA-256 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Zyxel Remote Command Execution
https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Victorian Machinery is a proof of concept exploit for CVE-2022-30525. The vulnerability is an unauthenticated and remote command injection vulnerability affecting Zyxel firewall's that support zero touch provisioning. Zyxel pushed a fix for this issue on April 28, 2022. Multiple models are affected.
SHA-256 |
d85780bb5daa2abd4c685fc1f2bd14ad0bfe7fbd9a5a6a99b45f1efcddb6a0bfDownload
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Zyxel Remote Command Execution
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Exploit Collector
Ransom.Conti MVID-2022-0602 Code Execution
___________________________
@hacking_Attack
@Hacking_Video
Ransom.Conti MVID-2022-0602 Code Execution
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Ransom.Conti MVID-2022-0602 Code Execution
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Exploit Collector
Zyxel Firewall ZTP Unauthenticated Command Injection
___________________________
@hacking_Attack
@Hacking_Video
Zyxel Firewall ZTP Unauthenticated Command Injection
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Zyxel Firewall ZTP Unauthenticated Command Injection
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Exploit Collector
Chrome 100 extensions::ExtensionApiFrameIdMap::GetFrameId Heap Use-After-Free
https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
A use-after-free issue exists in Chrome 100 and earlier versions. A malicious extension can achieve arbitrary code execution in the browser process.
SHA-256 |
Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Chrome 100 extensions::ExtensionApiFrameIdMap::GetFrameId Heap Use-After-Free
https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
A use-after-free issue exists in Chrome 100 and earlier versions. A malicious extension can achieve arbitrary code execution in the browser process.
SHA-256 |
595428413ed6af41648e85f12bfacfc4d3b4b659dea62dab16b66777c9ddb014Download
Source:packetstormsecurity.com
___________________________
@hacking_Attack
@Hacking_Video
Kitploit
Chrome 100 extensions::ExtensionApiFrameIdMap::GetFrameId Heap Use-After-Free
Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.