Hacking Articles Tips Tricks Videos Tutorials

hacking: security in practice
Hacktivist Group GhostSec Compromises 55 Berghof PLCs Across Israel

https://external-preview.redd.it/nms4jySs42blGIaeBZEIyocXO-sqjK5KxM88MlPhChU.jpg?width=640&crop=smart&auto=webp&s=968c0cc4e94ab5b373c232095dc6e5887f54e069 submitted by /u/p3tr00v
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

Hacktivist Group GhostSec Compromises 55 Berghof PLCs Across Israel

Posted in r/hacking by u/p3tr00v • 1 point and 0 comments

15 viewsedited 16:42

Hacking Articles Tips Tricks Videos Tutorials

15 views16:42

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
TIL that Pentera has developed an alternative to PsExec that instead uses a fileless implementation over DCE/RPC (port 135), completely dodging surveilance that companies commonly enforce on SMB (port 445).

https://external-preview.redd.it/vmntqCjNxK8eFMX2aoCDewpaesSJF2Rmt4z1Rw46DXI.jpg?width=640&crop=smart&auto=webp&s=9854eade07a16c26575f353ace60c7bc8793cc4d submitted by /u/SpacePilot8888
[link] [comments]
➖ Sent by @TheFeedReaderBot ➖

___________________________
@hacking_Attack
@Hacking_Video

TIL that Pentera has developed an alternative to PsExec that...

Posted in r/hacking by u/SpacePilot8888 • 1 point and 1 comment

16 viewsedited 16:42

Hacking Articles Tips Tricks Videos Tutorials

Showcasing Sliver C2, Bypassing Win Defender and Establishing Persistence
https://www.reddit.com/r/redteamsec/comments/xe6u60/showcasing_sliver_c2_bypassing_win_defender_and/

To be honest, sliver is the big deal. It's a brand new C2 Framework (still in development) and really have a lot of potential. We showcased how to work with it and perform various TTPs, like persistence with exe hijacking or registry tweaking. The very default beacon was able to bypass Windows 10 Defender. I learned a lot (and was learning in real time while streaming, so I put timestamps for you to navigate it easier) and hope you will learn something new from the video too. It is available on my Youtube: https://youtu.be/QO_1UMaiWHk submitted by /u/lsecqt (https://www.reddit.com/user/lsecqt)
[link] (https://www.reddit.com/r/redteamsec/comments/xe6u60/showcasing_sliver_c2_bypassing_win_defender_and/) [comments] (https://www.reddit.com/r/redteamsec/comments/xe6u60/showcasing_sliver_c2_bypassing_win_defender_and/)

___________________________
@hacking_Attack
@Hacking_Video

From the redteamsec community on Reddit: Showcasing Sliver C2, Bypassing Win Defender and Establishing Persistence

Explore this post and more from the redteamsec community

15 viewsedited 16:50

Hacking Articles Tips Tricks Videos Tutorials

11 views18:36

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
WordPress WPGateway 3.5 Privilege Escalation

https://4.bp.blogspot.com/-5kb4UTwsKkE/WWlvjussFoI/AAAAAAAAIQs/uqojaqb90NcMo4ROOoH-c5uvdKeDdbGswCLcBGAs/s1600/h94.png WordPress WPGateway plugin versions 3.5 and below suffer from an unauthenticated privilege escalation vulnerability.

SHA-256 | 715990b9ee833ca498f918bbbc57126f80aebb00320ec587bbd2652d95d95513Download

Description: Unauthenticated Privilege Escalation

Affected Plugin: WPGateway

Plugin Slug: wpgateway

Plugin Developer: Jack Hopman/WPGateway

Affected Versions: <=

CVE ID: CVE-2022-3180

CVSS Score: 9.8 (Critical)

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Fully Patched Version: N/A

The WPGateway plugin is a premium plugin tied to the WPGateway cloud service, which offers its users a way to setup and manage WordPress sites from a single dashboard. Part of the plugin functionality exposes a vulnerability that allows unauthenticated attackers to insert a malicious administrator.

We obtained a current copy of the plugin on September 9, 2022, and determined that it is vulnerable, at which time we contacted the plugin vendor with our initial disclosure. We have reserved vulnerability identifier CVE-2022-3180 for this issue.

As this is an actively exploited zero-day vulnerability, and attackers are already aware of the mechanism required to exploit it, we are releasing this public service announcement (PSA) to all of our users. We are intentionally withholding certain details to prevent further exploitation. As a reminder, an attacker with administrator privileges has effectively achieved a complete site takeover.

Indicators of compromise

If you are working to determine whether a site has been compromised using this vulnerability, the most common indicator of compromise is a malicious administrator with the username of rangex.

If you see this user added to your dashboard, it means that your site has been compromised.

Additionally, you can check your site’s access logs for requests to //wp-content/plugins/wpgateway/wpgateway-webservice-new.php?wp_new_credentials=1

If these requests are present in your logs, they indicate that your site has been attacked using an exploit targeting this vulnerability, but do not necessarily indicate that it has been successfully compromised.

Conclusion

In today’s post, we detailed a zero-day vulnerability being actively exploited in the WPGateway plugin.

Wordfence Premium, Wordfence Care, and Wordfence Response customers received a firewall rule on September 8, 2022, protecting against this vulnerability, while sites still using the free version of Wordfence will receive the same protection 30 days later, on October 8, 2022.

If you have the WPGateway plugin installed, we urge you to remove it immediately until a patch is made available and to check for malicious administrator users in your WordPress dashboard.

If you know a friend or colleague who is using this plugin on their site, we highly recommend forwarding this advisory to them to help keep their sites protected, as this is a serious vulnerability that is actively being exploited in the wild. Please help make the WordPress community aware of this issue.

If you believe your site has been compromised as a result of this vulnerability or any other vulnerability, we offer Incident Response services via Wordfence Care. If you need your site cleaned immediately, Wordfence Response offers the same service with 24/7/365 availability and a 1-hour response time. Both these products include hands-on support in case you need further assistance.

Our investigation is ongoing, and we will provide more information in an additional blog post when it becomes available.

Special thanks to Threat Intelligence Lead Chloe Chamberland for spotting this exploit in the wild.