Hacking Articles Tips Tricks Videos Tutorials

3 views18:21

Exploit Collector
Asus GameSDK 1.0.0.4 Unquoted Service Path

https://3.bp.blogspot.com/-Qhp4qePCt4w/WWlvgnoLBHI/AAAAAAAAIQQ/Pg-5D4V1nfk8Sq6EZO_I88mZqTiN0MsZgCLcBGAs/s1600/h89.png
Asus GameSDK version 1.0.0.4 suffers from an unquoted service path vulnerability in GameSDK.exe.

SHA-256 | cd88ac76d033405e5a3e34567ef8fd43237dddbf5f9d43a3e92a2f447d70a461

Download

# Exploit Title: Asus GameSDK v1.0.0.4 - 'GameSDK.exe' Unquoted Service Path (Privilege Escalation)
# Date: 07/14/2022
# Exploit Author: Angelo Pio Amirante
# Version: 1.0.0.4
# Tested on: Windows 10
# Patched version: 1.0.5.0
# CVE: CVE-2022-35899
# Step to discover the unquoted service path:

wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """

# Info on the service:

C:\>sc qc "GameSDK Service"
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: GameSDK Service
TIPO                      : 10  WIN32_OWN_PROCESS
TIPO_AVVIO                : 2   AUTO_START
CONTROLLO_ERRORE          : 1   NORMAL
NOME_PERCORSO_BINARIO     : C:\Program Files (x86)\ASUS\GameSDK Service\GameSDK.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG                       : 0
NOME_VISUALIZZATO         : GameSDK Service
DIPENDENZE                :
SERVICE_START_NAME : LocalSystem

# Exploit
If an attacker had already compromised the system and the current user has the privileges to write in the "C:\Program Files (x86)\ASUS\" folder or in "C:\" , he could place his own "Program.exe" or "GameSDK.exe" files respectively, and when the service starts, it would launch the malicious file, rather than the original "GameSDK.exe".

# Impact
An attacker can elevate his privileges on the system and become NTAUTHORITY\SYSTEM.

# Poc Video

https://youtu.be/u_8JMIgn-5g

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Asus GameSDK 1.0.0.4 Unquoted Service Path

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:21

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Spryker Commerce OS Remote Command Execution

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Spryker Commerce OS Remote Command Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 18:21

Hacking Articles Tips Tricks Videos Tutorials

My Essential Recon Commands
https://medium.com/@xsanjay/my-essential-recon-commands-93d37f4e1b91?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

My Essential Recon Commands

Resolution

4 viewsedited 19:05

Hacking Articles Tips Tricks Videos Tutorials

4 views19:05

Hacking Articles Tips Tricks Videos Tutorials

ResolutionContinue reading on Medium » (https://medium.com/@xsanjay/my-essential-recon-commands-93d37f4e1b91?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium

My Essential Recon Commands

Resolution

4 viewsedited 19:05

Hacking Articles Tips Tricks Videos Tutorials

The AMSI bypass i got from CRTP doesn't work, any help?
https://www.reddit.com/r/Pentesting/comments/w31wnt/the_amsi_bypass_i_got_from_crtp_doesnt_work_any/

just signed for the CRTP and their AMSI bypass doesnt work on their lab, tried a bunch of bypasses from github as well and none worked, help ? submitted by /u/watermelonSoundsNice (https://www.reddit.com/user/watermelonSoundsNice)
[link] (https://www.reddit.com/r/Pentesting/comments/w31wnt/the_amsi_bypass_i_got_from_crtp_doesnt_work_any/) [comments] (https://www.reddit.com/r/Pentesting/comments/w31wnt/the_amsi_bypass_i_got_from_crtp_doesnt_work_any/)

___________________________
@hacking_Attack
@Hacking_Video

The AMSI bypass i got from CRTP doesn't work, any help?

just signed for the CRTP and their AMSI bypass doesnt work on their lab, tried a bunch of bypasses from github as well and none worked, help ?

4 viewsedited 20:19

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Will Your Cyber-Insurance Premiums Protect You in Times of War?

Multiple cyber-insurance carriers have adopted act-of-war exclusions due to global political instability and are seeking to stretch the definition of war to deny coverage.

4 views21:07

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Okta Exposes Passwords in Clear Text for Possible Theft

Researchers say Okta could allow attackers to easily exfiltrate passwords, impersonate other users, and alter logs to cover their tracks.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Okta Exposes Passwords in Clear Text for Possible Theft

Researchers say Okta could allow attackers to easily exfiltrate passwords, impersonate other users, and alter logs to cover their tracks.

3 viewsedited 21:07

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Post-Breakup, Conti Ransomware Members Remain Dangerous

The gang's members have moved into different criminal activities, and could regroup once law-enforcement attention has simmered down a bit, researchers say.

2 views21:08

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Ongoing Magecart Campaign Targets Online Ordering at Local Restaurants

More than 311 local eateries have been breached through online ordering platforms MenuDrive, Harbortouch, and InTouchPOS, impacting 50K records — and counting.

2 views21:08

Source

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Startup Aims to Secure AI, Machine Learning Development

With security experts warning against attacks on machine learning models and data, startup HiddenLayer aims to protect the neural networks powering AI-augmented products.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Startup Aims to Secure AI, Machine Learning Development

With security experts warning against attacks on machine learning models and data, startup HiddenLayer aims to protect the neural networks powering AI-augmented products.

2 viewsedited 21:09

Hacking Articles Tips Tricks Videos Tutorials

3 views21:11

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Offensive Security “Sar” Makinesi Çözümü

https://cdn-images-1.medium.com/max/1200/0*AJsGOZIg1uezX3wB.png
Merhabalar. Bu yazı da Offensive Security şirketinin hazırlamış ve yayınlamış olduğu “Sar” makinesini nasıl çözdüğümü anlatacağım.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Offensive Security “Sar” Makinesi Çözümü

Merhabalar. Bu yazı da Offensive Security şirketinin hazırlamış ve yayınlamış olduğu “Sar” makinesini nasıl çözdüğümü anlatacağım.