Hacking Articles Tips Tricks Videos Tutorials

Gadget Works Online Ordering System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 21:12

Exploit Collector
Epic Games Rocket League 1.95 Insecure Permissions

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
Epic Games Rocket League versions 1.95 and below suffer from an insecure permissions vulnerability.

MD5 | 9ed5a4f67cb00f02b0ffb67ded384d2c

Download


Epic Games Psyonix Rocket League <=1.95
Vendor: Epic Games Inc. | Psyonix, LLC
Product web page: https://www.epicgames.com
https://www.psyonix.com
https://www.rocketleague.com
Affected version: 

Summary: Rocket League is a high-powered hybrid of arcade-style soccer
and vehicular mayhem with easy-to-understand controls and fluid, physics-driven
competition.

Desc: The application suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the executable
file with a binary of choice. The vulnerability exist due to the improper
permissions, with the 'F' flag (Full) for 'Authenticated Users' group.

Tested on: Microsoft Windows 10
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5650
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5650.php
20.04.2021

--
E:\Epic Games\rocketleague\Binaries\Win64>cacls RocketLeague.exe
E:\Epic Games\rocketleague\Binaries\Win64\RocketLeague.exe BUILTIN\Administrators:F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\Authenticated Users:C
BUILTIN\Users:R
E:\Epic Games\rocketleague>cacls Binaries
E:\Epic Games\rocketleague\Binaries BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
NT AUTHORITY\Authenticated Users:C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)C
BUILTIN\Users:R
BUILTIN\Users:(OI)(CI)(IO)(special access:)
GENERIC_READ
GENERIC_EXECUTE
E:\Epic Games\rocketleague>cacls TAGame
E:\Epic Games\rocketleague\TAGame BUILTIN\Administrators:F
BUILTIN\Administrators:(OI)(CI)(IO)F
NT AUTHORITY\SYSTEM:F
NT AUTHORITY\SYSTEM:(OI)(CI)(IO)F
NT AUTHORITY\Authenticated Users:C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)C
BUILTIN\Users:R
BUILTIN\Users:(OI)(CI)(IO)(special access:)
GENERIC_READ
GENERIC_EXECUTE

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Epic Games Rocket League 1.95 Insecure Permissions

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 21:12

Exploit Collector
Windows/x64 Inject All Processes With Meterpreter Reverse Shell Shellcode

___________________________
@hacking_Attack
@Hacking_Video

Windows/x64 Inject All Processes With Meterpreter Reverse Shell Shellcode

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 21:12

Exploit Collector
Voting System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Voting System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 21:12

8 views21:12

9 views21:12

9 views21:12

Exploit Collector
GitLab Community Edition (CE) 13.10.3 User Enumeration

___________________________
@hacking_Attack
@Hacking_Video

GitLab Community Edition (CE) 13.10.3 User Enumeration

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 21:12

9 views21:12

9 views21:12

8 views21:19

Buer Malware Variant Rewritten in Rust Programming Language

Dark Reading: Attacks/Breaches
Buer Malware Variant Rewritten in Rust Programming Language

Researchers suggest a few reasons why operators rewrote Buer in an entirely new language

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Researchers suggest a few reasons why operators rewrote Buer in an entirely new language

8 viewsedited 21:19

8 views21:44

Australia wants to introduce cybersecurity into its school curriculum

hacking: security in practice
Australia wants to introduce cybersecurity into its school curriculum

https://external-preview.redd.it/ftk5R7YkJYe-iVD4yRb3PcnGgsBbYPjGQs8MvRpFkl4.jpg?width=640&crop=smart&auto=webp&s=227442ea74054d19e63641c0911ac11d9820b4d0 submitted by /u/cenotaphx
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/hacking by u/cenotaphx • 1 point and 0 comments

9 viewsedited 21:44

9 views21:44

I don’t know anyting about hacking but if you want to hack a...

hacking: security in practice
I don’t know anyting about hacking but if you want to hack a scammer here you go

(https://t.me/Markaugustine1). On telegram Is a scammer that is not his real name i am pretty shure. But he scams people all over the world by acting like a drug dealer. I just don’t like these people so feel free to hack him. If this is possable and legal and you feel like it. Tims vince is also a name of someone he is working with.

submitted by /u/Sebasss99
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

(https://t.me/Markaugustine1). On telegram Is a scammer that is not his real name i am pretty shure. But he scams people all over the world by...

9 viewsedited 21:44

For roughly 29 hours now I have been constantly ddos’s due to xresolver allowing someone to option my ip through my Xbox gamer tag. I have nord...

hacking: security in practice
Ddos attack

For roughly 29 hours now I have been constantly ddos’s due to xresolver allowing someone to option my ip through my Xbox gamer tag. I have nord which is doing literally nothing and my internet service provider cannot see the attack through firewall logs. Can someone direct me on what to do? I clearly am not experienced enough with security to handle this and I’d also like to find out how I can find a ‘blacklisted’ ip in hopes sending him his ip will get him to fuck off. Thank you for any information in advanced. I know a lot of you on here are super talented and if I need to pay someone to help me I would be happy to, I don’t want someone’s time wasted.

submitted by /u/BIIIG_DOIIINKS
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Ddos attack

12 viewsedited 21:44

CyberArk, the undisputed leader in Privileged Account Security, secures secrets used by machines and users to protect traditional and cloud-native apps. - CyberArk

Evasor - A Tool To Be Used In Post Exploitation Phase For Blue And Red Teams To Bypass APPLICATIONCONTROL Policies

The Evasor is an automated security assessment tool which locates existing executables on the Windows operating system that can be used to bypass any Application Control rules. It is very easy to use, quick, saves time and fully automated which generates for you a report including description, screenshots and mitigations suggestions, suites for both blue and red teams in the assessment of a post-exploitation phase.Requirements Windows OS. Visual studio 2017 installed. Usage instructions Download the Evasor project and complie it. Verify to exclude from the project the App.config file from the reference tree. run Evasor.exe from the bin folder. Choose your numeric option from the follwoing: Locating executable files that can be used to bypass the Application Control! Retrieving the all running processes relative paths Checking every process (executable file) if it vulnerable to DLL Injection by: Running “MavInject” Microsoft component from path C:\Windows\System32\mavinject.exe with default parameters. Checking the exit code of the MavInject execution, if the process exited normally it means that the process is vulnerable to DLL Injection and can be used to bypass the Application Control. Locating processes that vulnerable to DLL Hijacking! Retrieving the all running processes For each running Process: Retrieving the loaded process modules Checking if there is a permission to write data into the directory of the working process by creating an empty file with the name of the loaded module (DLL) or overwriting an existence module file on the working process directory. If the write operation succeeds – it seems that the process is vulnerable to DLL Hijacking. Locating for potential hijackable resource files Searching for specific files on the computer by their extension. Trying to replace that files to another place in order to validate that the file can be replaceable and finally, potentially vulnerable to Resource Hijacking. Extensions: xml,config,json,bat,cmd,ps1,vbs,ini,js,exe,dll,msi,yaml,lib,inf,reg,log,htm,hta,sys,rsp Generating an automatic assessment report word document includes a description of tests and screenshots taken. Contributing We welcome contributions of all kinds to this repository. For instructions on how to get started and descriptions of our development workflows, please see our contributing guide. Share Your Thoughts And Feedback For more comments, suggestions or questions, you can contact Arik Kublanov from CyberArk Labs: Copyright © 2020 CyberArk Software Ltd. All rights reserved. Labs. You can find more projects developed by us in https://github.com/cyberark/. Notes The original code developed and being used on CyberArk Labs: Copyright © 2020 CyberArk Software Ltd. All rights reserved. internaly, makes full automation and exploitation of the informative results. The original code contains part of activation and exploitation but we removed it from here. The files content under the DLLs folder are empty and not contains any exploitation code also and it's for the Cyber Security community Red and Blue teams to be used and to be implemented according to their own needs and can be a starting point for their assessment objectives. Download Evasor
Read more...

___________________________
@hacking_Attack
@Hacking_Video

GitHub

CyberArk

12 viewsedited 21:46

12 views22:26