Hacking on Medium
HOW NOT TO GET HACKED

https://cdn-images-1.medium.com/max/720/0*UCnLKn6iuCOHG8oa.png
Recently, I have been seeing so many people getting hacked/phished easily on Instagram and other social media platforms. Hence, I decided…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
PyPI package ‘keep’ mistakenly included a password stealer

PyPI package ‘keep’ mistakenly included a password stealerPost Views: 54
Premium Content https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-3.png Subscribe to Patreon to watch this episode.
Reading Time: 4 Minutes
PyPI packages ‘keep,’ ‘pyanxdns,’ ‘api-res-py’ were found to be containing a backdoor due to the presence of malicious ‘request’ dependency within some versions.
For example, while most versions of ‘keep’ project use the legitimate Python module requests for making HTTP requests, ‘keep’ v.1.2 contains ‘request’ (without s) which is malware.

BleepingComputer reached out to the authors of each of these packages to understand if this was caused by a mere typographical error,  self-sabotage, or by maintainer accounts getting hijacked. PyPI package ‘keep’ uses malicious ‘request’Some versions of PyPI packages, ‘keep,’ ‘pyanxdns,’ and ‘api-res-py’ were caught using a malicious dependency, ‘request,’

Back in May, GitHub user duxinglin1 noticed the vulnerable versions contained the misspelled ‘request’ dependency, as opposed to the legitimate requests library.

As such, the following CVEs have been assigned this week with regards to the vulnerable versions:

* CVE-2022-30877 – ‘keep’ version 1.2 contains the backdoor ‘request’, contrary to what the advisory implies.
* CVE-2022-30882 – ‘pyanxdns’ version 0.2 impacted
* CVE-2022-31313 – ‘api-res-py’ version 0.1 impacted

Although ‘pyanxdns’ and ‘api-res-py’ might be small scale projects,  the ‘keep’ package, in particular, gets downloaded over 8,000 times in a week on average—with its version 1.2 using the malicious dependency:
https://www.bleepstatic.com/images/news/u/1164866/2022/jun-2022/pypi-request-keep-backdoor/pypi-keep-page.jpeg
___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
PyPI package ‘keep’ mistakenly included a password stealer

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Pool on the roof - {{%B %d, %Y}}

Have a no0b question? New to hacking? Looking for a script? Need help with your github project? Something wrong with your payload? Stuck on a CTF or bug bounty?

This is a weekly recurring post to make friends with other hackers, ask questions, and get any type of help you may need.

Make sure to read our wiki as it's full of resources for you.

Keep all beginner questions in this weekly stickied post.

submitted by /u/AutoModerator
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
SSH beyond login and port forwarding?

One of my NAS devices allows SSH logins with a username/password belonging to the manufacturer. I have the credentials. My attempts to login have been a complete failure.

Can you suggest anything beyond a normal login or port forwarding?

Interactive login and SCP succeed but I immediately get "ERROR: Connection refused" from some internal application. Port forwarding doesn't drop but its disabled in the config file and can't be used.

submitted by /u/caravandog
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
finding people OSINT

I am starting to learn about the osint framework, Searching for people outside the US is not working because the majority of the websites that i encouter are US based so if i want to search myself i couldn't . So what to do when i encounter this kind of problem

submitted by /u/__hiken__
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
using tor

I am starting to learn about tor browser most of the tutorials just guides you how to install it and the settings that you need to change but what is .onion ?

And if by doing reverse image in tor the result will be different from standard search engine? Searching for people and companies will it also result in different results ?

submitted by /u/__hiken__
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
how to stop school monitoring me

So, I have recently been able to get access to the CMD on my school windows computer. However, I know that school monitors all activity on computers, so I wouldn't actually be able to do anything without being caught. Is there any way that I could ask my presence, or make it look like I was doing something else? Thanks

submitted by /u/Queer_Gerblin
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How to get unbanned from a website?

Any help is much appreciated.

Thanks!

submitted by /u/wahsgood
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

confluencePot - Simple Honeypot For Atlassian Confluence (CVE-2022-26134)
http://www.kitploit.com/2022/06/confluencepot-simple-honeypot-for.html

___________________________
@hacking_Attack
@Hacking_Video

ConfluencePot is a simple honeypot (https://www.kitploit.com/search/label/HoneyPot) for the Atlassian Confluence unauthenticated and remote OGNL injection (https://www.kitploit.com/search/label/Injection) vulnerability (https://www.kitploit.com/search/label/Vulnerability) (CVE-2022-26134 (https://nvd.nist.gov/vuln/detail/CVE-2022-26134)).
About the vulnerability You can find the official advisory by Atlassian to this vulerability here (https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html). For details about the inner workings and exploits (https://www.kitploit.com/search/label/Exploits) in the wild you should refer to the reports by Rapid7 (https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/) and Cloudflare (https://blog.cloudflare.com/cloudflare-observations-of-confluence-zero-day-cve-2022-26134/). Affected but not yet patched systems should be deemed compromised until further investigation. About the tool ConfluencePot is written in Golang and implements its own HTTPS server to minimize the overall attack surface. To make it appear like a legit Confluence instance it returns a bare-bones version of a Confluence landing page. Log output is written to stdout and a log file on disk. ConfluencePot DOES NOT allow attackers to execute commands/code on your machine, it only logs requests and returns a bogus response. Building & Running it You need a recent version of Golang to run/build confluencePot and the appropriate privileges to bind to port 443. We recommend to execute it in a tmux session for easier handling. To run ConfluencePot you either need to create a self-signed TLS certificate with openssl or request one from e.g. Let's Encrypt. go build confluencePot.go
./confluencePot
Testing and Issues ConfluencePot was tested using the public exploit by Nwqda (https://github.com/Nwqda/CVE-2022-26134), which seems to be the most used variant in the wild at the time of writing. If you find anything wrong with confluencePot please feel free to open an issue or send us a pull request. Follow us on Twitter (https://www.kitploit.com/search/label/Twitter) --> @SI_FalconTeam (https://twitter.com/SI_FalconTeam) <-- to stay up to date with our latest research. Stay safe!

Download confluencePot (https://github.com/SIFalcon/confluencePot)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Wpgarlic : A Proof-Of-Concept WordPress Plugin Fuzzer

Wpgarlic is a proof-of-concept WordPress plugin fuzzer used in the research described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html that helped to discover more than 140 vulnerablities in WordPress plugins installed on almost 15 million sites.

If you want to continue the research, start with less popular plugins – if a plugin achieved at least 10k active installs between October 2021 and January 2022, I have most probably looked at the fuzzer reports (and most focus has been put on plugins having at least 20k active installs). Because there is a lot of randomness in how fuzzer works, some vulnerabilities in these plugins remain undiscovered – but fewer ones.

Fuzzer reports contain a lot of false positives – most of them don’t indicate a vulnerability. After seeing a report, first analyze whether the behavior you’re observing is indeed a vulnerability or a false positive. Don’t spam WPScan/vendors with raw fuzzer reports – provide a PoC exploit instead. ExamplesFor obvious reasons, the examples will contain only vulnerabilities that have already been fixed. Arbitrary file readLet’s assume you are fuzzing responsive-vector-mapsin version 6.4.0:

./bin/fuzz_plugin responsive-vector-maps –version 6.4.0

(to fuzz the latest version, just skip --version).

After the fuzzing finishes (which would take 10-30 minutes for this plugin) you can call:

./bin/print_findings data/plugin_fuzz_results/

That means that the fuzzer detected executing fopen()on a known payload. Most of the payloads contain the word GARLICin them to facilitate automatic detection in output. You may see or configure them in docker_image/magic_payloads.php.

Then, you may browse the source code and see that indeed the wp_ajax_rvm_import_markersendpoint uses the file content to render output, thus allowing you to read arbitrary files on the server: CVE-2021-24947.

What you see in white is a crash considered interesting (you may modify them or add new ones in crash_detectors.py). Green is the context. In blue you see the report file name (with plugin name), plugin popularity and endpoint name (here: the ajax action name).

The data in yellow are what payloads were injected into what variables. Reflected XSSLet’s assume you are fuzzing page-builder-addin version 1.4.9.4:

./bin/fuzz_plugin page-builder-add –version 1.4.9.4

Option update leading to stored XSS

./bin/fuzz_plugin duplicate-page-or-post –version 1.4.6 False positivesUnfortunately, for most of the plugins the fuzzer doesn’t find any interesting crashes, and for the rest, most of the reports are false positives. For example, if you see:

Call: wp_mail arguments={‘to’: ‘plugin@pluginvendor.com’, ‘subject’: ‘[Plugin contact] – http://GARLICGARLICGARLIC.example.com’}

This can mean, that wp_mailis indeed called, but you don’t control the recipient and most of the subject. If you want to be sure, look at the plugin source. Additional tips for reading fuzzer reports* If you see the message; May as well be equal: … and … – that means that the mechanism to pretend that a known payload is equal to any other string (described in https://kazet.cc/2022/02/03/fuzzing-wordpress-plugins.html#patched-equality) was triggered.
* If you see __GARLIC_ACCESSED__ _FILES[files] __ENDGARLIC__– that means that an uploaded file access was detected. No further checks are currently made – to check whether this is a vulnerability, look at the code.
* Sometimes what the fuzzer injects into GET, POST etc. parameters is not reproducible in the real world: for example, you can’t inject anything into $_GET['page']if you want a particular menu page to be displayed. Usage cheatsheetThe first run of fuzzing or of the test[...]

___________________________
@hacking_Attack
@Hacking_Video

s may take about an hour, because we need to build the Docker image with instrumented PHP and WordPress. Fuzzing a plugin by name./bin/fuzz_plugin PLUGIN_SLUG Fuzzing a plugin from fileYou can also install a plugin from a local zip file:

./bin/fuzz_plugin PLUGIN_FILE_NAME.zip Printing findingsTo print what the fuzzer found, use:

./bin/print_findings data/plugin_fuzz_results/ Running testsTo run the tests, use:

./bin/test Manual testing environmentYou may start a test environment with only one plugin installed using:

./bin/manual_testing PLUGIN_SLUG|PLUGIN_PATH.zip [version]

You can install a plugin using its slug or from a local zip file.

It will listen on http://127.0.0.1:8001/

There will be two test users in the database:

* username: admin, password: admin, privileges: administrator
* username: subscriber, password: subscriber, privileges: subscriber Extending and configuring the fuzzerThis tool is a proof of concept – this section contains places where it can be improved to find more vulnerabilities.

You may want to edit filtering.py— it contains the rules that deem a particular crash important or not. If you change them, you may have more false positives, but find more vulnerabilities as well. For example, the only header that I consider interesting when emitted is the Location header, to detect Open Redirect vulnerabilities. That is just one idea and you may have others.

Another file that may be worth extending is docker_image/patch_wordpress.sh. It describes calls to which functions will be logged as interesting.

If you want to inject other payloads (or change the probabilities with which they are injected) edit docker_image/magic_payloads.phpand docker_image/fuzz/config.py. crash_detector.pycontans regular expressions that find interesting crashes or interesting information (e.g. e-mails) being exposed.

Fuzzing files (i.e. executing each PHP file with injected payloads) has been disabled because it didn’t lead to many findings. Uncomment filesin config.DEFAULT_ENABLED_FEATURESto change that. Fuzzer internalsBlocklistsSome plugins need other ones (e.g. woocommerce) as a dependency. When fuzzing a plugin that has a dependency, we want to fuzz only the chosen plugin and skip the dependency AJAX actions, REST routes and menu pages. We want to fuzz woocommerce actions/routes/pages only when we picked woocommerce to fuzz.

List of dependency actions/routes/pages are called blocklists and are listed in docker_image/blocklists/. Files named commoncontain the WordPress core actions/routes/pages – we don’t want to fuzz these as well.

To update these blocklists, use ./bin/update_blocklists. Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
DDexec : A Technique To Run Binaries Filelessly And Stealthily On Linux Using Dd To Replace The Shell With Another Process

DDexec is a Technique To Run Binaries Filelessly And Stealthily On Linux Using Dd To Replace The Shell With Another Process. In Linux in order to run a program it must exist as a file, it must be accessible in some way through the file system hierarchy (this is just how execve()works). This file may reside on disk or in ram (tmpfs, memfd) but you need a filepath. This has made very easy to control what is run on a Linux system, it makes easy to detect threats and attacker’s tools or to prevent them from trying to execute anything of theirs at all (e. g. not allowing unprivileged users to place executable files anywhere).

But this technique is here to change all of this. If you can not start the process you want… then you hijack one already existing. UsagePipe into the ddexec.shscript the base64 of the binary you want to run (without newlines). The arguments for the script are the arguments for the program (starting with argv[0]).

Here, try this:

base64 -w0 /bin/ls | bash ddexec.sh /bin/ls -lA

There is also the ddsc.shscript that allows you to run binary code directly. The following is a “Hello world” shellcode.

bash ddsc.sh -x <<

or

bash ddsc.sh < <(xxd<<

And yes. It works with meterpreter.

Tested Linux distributions are Debian, Alpine and Arch. Supported shells are bash, zsh and ash over x86_64 and aarch64 (arm64) architectures. DependenciesThis script depends on the following tools to work.

dd
bash | zsh | ash (busybox)
head
tail
cut
grep
od
readlink
wc
tr
base64 The techniqueIf you are able to modify arbitrarily the memory of a process then you can take over it. This can be used to hijack an already existing process and replace it with another program. We can achieve this either by using the ptrace()syscall (which requires you to have the ability to execute syscalls or to have gdb available on the system) or, more interestingly, writing to /proc/$pid/mem.

The file /proc/$pid/memis a one-to-one mapping of the entire address space of a process (e. g. from 0x0000000000000000to 0x7ffffffffffff000in x86-64). This means that reading from or writing to this file at an offset xis the same as reading from or modifying the contents at the virtual address x.

Now, we have four basic problems to face:

* In general, only root and the program owner of the file may modify it.
* ASLR.
* If we try to read or write to an address not mapped in the address space of the program we will get an I/O error.

This problems have solutions that, although they are not perfect, are good:

* Most shell interpreters allow the creation of file descriptors that will then be inherited by child processes. We can create a fd pointing to the memfile of the sell with write permissions… so child processes that use that fd will be able to modify the shell’s memory.
* ASLR isn’t even a problem, we can check the shell’s mapsfile or any other from the procfs in order to gain information about the address space of the process.
* So we need to lseek()over the file. From the shell this cannot be done unless using the infamous dd. In more detailThe steps are relatively easy and do not require any kind of expertise to understand them:

* Parse the binary we want to run and the loader to find out what mappings they need. Then craft a “shell”code that will perform, broadly speaking, the same steps that the kernel does upon each call to execve():
* Create said mappings.
* Read the binaries into them.
* Set up permissions.
* Finally initialize the stack with the arguments for the program and place the auxiliary[...]

___________________________
@hacking_Attack
@Hacking_Video

vector (needed by the loader).
* Jump into the loader and let it do the rest (load libraries needed by the program).

* Obtain from the syscallfile the address to which the process will return after the syscall it is executing.
* Overwrite that place, which will be executable, with our shellcode (through memwe can modify unwritable pages).
* Pass the program we want to run to the stdin of the process (will be read()by said “shell”code).
* At this point it is up to the loader to load the necessary libraries for our program and jump into it.

Oh, and all of this must be done in shell scripting, or what would be the point? Download

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Security Leaders Discuss Industry Drivers at Dark Reading's News Desk at RSAC 2022

Tune into Dark Reading's News Desk interviews with the industry’s leaders, discussing news and hot topics, such as this year’s "Transofrm" theme, at RSA Conference 2022 in San Francisco

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
DoS Vulnerability Allows Easy Envoy Proxy Crashes

The DoS vulnerability allows an attacker to create a Brotli "zip bomb," resulting in acute performance issues on Envoy proxy servers.