Hacking Articles Tips Tricks Videos Tutorials

https://b.thumbs.redditmedia.com/ZjLfBGJ_hlIjoNnEcxK3sL758hcy1UNB0QMh-B_aEFc.jpg Hey all, I should provide some context before asking my question. So I am currently researching and trying to find a vulnerability in an IoT device, it's pretty secure and sandboxed quite well. The only potential attack vector i have found is a JavaScript Injection vulnerability which I have explored and messed around with tons, but nothing crazy outside of getting more information on the device. However, I have deployed this JS payload (which is supposed to spawn a reverse shell, i generated this payload from using JSshell, however it really only opens a TCP connection and not a shell environment):

Jsshell payload used

And after listening on the host and port 4848, I get the incoming connection:

Incoming connection from IoT device > me

This looks good, except I would like to spawn a shell through JS, not just the TCP connection, is there anything I can do to leverage this into a shell environment using JS? Lots of research points me toward using Node.js however Node runs server side and tends to only open a shell on the server and not the client (the IoT device), and obviously in this case I would like a shell on the client and not the server. Any help/Ideas is greatly appreciated!

submitted by /u/dxrk-kali
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

How to leverage my current connection

Posted in r/hacking by u/dxrk-kali • 1 point and 0 comments

5 viewsedited 18:05

5 views18:05

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Popular vehicle GPS tracker gives hackers admin privileges over SMS

https://external-preview.redd.it/-f-vVzQkPmZwLNORqcl8vyalSAFQkcgg_yDPpw9wy6k.jpg?width=640&crop=smart&auto=webp&s=cd7c33001eebe33a8d29f12781bba5b684bf9583 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/hacking by u/DrinkMoreCodeMore • 1 point and 0 comments

5 viewsedited 18:05

Hacking Articles Tips Tricks Videos Tutorials

3 views18:21

Hacking Articles Tips Tricks Videos Tutorials

3 views18:21

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Asus GameSDK 1.0.0.4 Unquoted Service Path

https://3.bp.blogspot.com/-Qhp4qePCt4w/WWlvgnoLBHI/AAAAAAAAIQQ/Pg-5D4V1nfk8Sq6EZO_I88mZqTiN0MsZgCLcBGAs/s1600/h89.png
Asus GameSDK version 1.0.0.4 suffers from an unquoted service path vulnerability in GameSDK.exe.

SHA-256 | cd88ac76d033405e5a3e34567ef8fd43237dddbf5f9d43a3e92a2f447d70a461

Download

# Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path (Privilege Escalation)
# Date: 07/14/2022
# Exploit Author: Angelo Pio Amirante
# Version: 1.0.0.4
# Tested on: Windows 10
# Patched version: 1.0.5.0
# CVE: CVE-2022-35899
# Step to discover the unquoted service path:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# Info on the service:

C:\>sc qc "GameSDK Service"
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: GameSDK Service
TIPO                      : 10  WIN32_OWN_PROCESS
TIPO_AVVIO                : 2   AUTO_START
CONTROLLO_ERRORE          : 1   NORMAL
NOME_PERCORSO_BINARIO     : C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG                       : 0
NOME_VISUALIZZATO         : GameSDK Service
DIPENDENZE                :
SERVICE_START_NAME : LocalSystem

# Exploit
If an attacker had already compromised the system and the current user has the privileges to write in the "C:\Program Files (x86)\ASUS\" folder or in "C:\" , he could place his own "Program.exe" or "GameSDK.exe" files respectively, and when the service starts, it would launch the malicious file, rather than the original "GameSDK.exe".

# Impact
An attacker can elevate his privileges on the system and become NTAUTHORITY\SYSTEM.

# Poc Video

https://youtu.be/u_8JMIgn-5g