VPN bypass vulnerability in Apple iOS
https://www.reddit.com/r/Pentesting/comments/y2vwfu/vpn_bypass_vulnerability_in_apple_ios/

___________________________
@hacking_Attack
@Hacking_Video

submitted by /u/Blue_Master (https://www.reddit.com/user/Blue_Master)
[link] (https://protonvpn.com/blog/apple-ios-vulnerability-disclosure/) [comments] (https://www.reddit.com/r/Pentesting/comments/y2vwfu/vpn_bypass_vulnerability_in_apple_ios/)

___________________________
@hacking_Attack
@Hacking_Video

FUD-UUID-Shellcode - Another shellcode injection technique using C++ that attempts to bypass Windows Defender using XOR encryption sorcery and UUID strings madness
http://www.kitploit.com/2022/10/fud-uuid-shellcode-another-shellcode.html

___________________________
@hacking_Attack
@Hacking_Video

Introduction Another shellcode injection (https://www.kitploit.com/search/label/Injection) technique using C++ that attempts to bypass Windows Defender (https://www.kitploit.com/search/label/Windows%20Defender) using XOR encryption (https://www.kitploit.com/search/label/Encryption) sorcery and UUID strings madness :).
How it works Shellcode generation Firstly, generate a payload in binary format( using either CobaltStrike or msfvenom ) for instance, in msfvenom, you can do it like so( the payload I'm using is for illustration purposes, you can use whatever payload you want ): msfvenom -p windows/messagebox -f raw -o shellcode.bin Then convert the shellcode( in binary/raw format ) into a UUID string format using the Python3 script, bin_to_uuid.py: ./bin_to_uuid.py -p shellcode.bin > uuid.txt xor encrypt the UUID strings in the uuid.txt using the Python3 script, xor_encryptor.py. ./xor_encryptor.py uuid.txt > xor_crypted_out.txt Copy the C-style array in the file, xor_crypted_out.txt, and paste it in the C++ file as an array of unsigned char i.e. unsigned char payload[]{your_output_from_xor_crypted_out.txt} Execution This shellcode injection technique comprises the following subsequent steps: First things first, it allocates virtual memory for payload execution and residence via VirtualAlloc It xor decrypts the payload using the xor key value Uses UuidFromStringA to convert UUID strings into their binary representation and store them in the previously allocated memory. This is used to avoid the usage of suspicious APIs like WriteProcessMemory or memcpy. Use EnumChildWindows to execute the payload previously loaded into memory( in step 1 ) What makes it unique? It doesn't use standard functions like memcpy or WriteProcessMemory which are known to raise alarms to AVs/EDRs, this program uses the Windows API (https://www.kitploit.com/search/label/Windows%20API) function called UuidFromStringA which can be used to decode data as well as write it to memory( Isn't that great folks? And please don't say "NO!" :) ). It uses the function call obfuscation trick to call the Windows API functions Lastly, because it looks unique :) ( Isn't it? :) ) Important You have to change the xor key(row 86) to what you wish. This can be done in the ./xor_encryptor.py python3 script by changing the KEY variable. You have to change the default executable filename value(row 90) to your filename. The command for compiling is provided in the C++ file( around the top ). NB: mingw was used but you can use whichever compiler (https://www.kitploit.com/search/label/Compiler) you prefer. :) Compile make Proof-of-Concept( PoC )

___________________________
@hacking_Attack
@Hacking_Video

Static Analysis

___________________________
@hacking_Attack
@Hacking_Video

AV Scan results The binary was scanned using antiscan.me (https://antiscan.me/scan/new/result?id=3IYj6CtMq6h8) on 01/08/2022.

___________________________
@hacking_Attack
@Hacking_Video

Credits https://research.nccgroup.com/2021/01/23/rift-analysing-a-lazarus-shellcode-execution-method/

Download FUD-UUID-Shellcode (https://github.com/Bl4ckM1rror/FUD-UUID-Shellcode)

___________________________
@hacking_Attack
@Hacking_Video

Fall account takeover via Amazon Cognito misconfiguration
https://medium.com/@iknowhatodo/fall-account-takeover-via-amazon-cognito-misconfiguration-ba5975b06c24?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello reader,
I hope you are doing well. Today I want to talk about one of my findings. It was a public program and the bug is not fixed…Continue reading on Medium » (https://medium.com/@iknowhatodo/fall-account-takeover-via-amazon-cognito-misconfiguration-ba5975b06c24?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
What the Uber Breach Verdict Means for CISOs in the US

Can already beleaguered CISOs now add possible legal charges to their smorgasbord of job considerations? Disclose a breach to comply and face dismissal, or cover it up and face personal punishment.

hacking: security in practice
Exploitation of Zimbra 0Day CVE 2022-41352

https://external-preview.redd.it/0sqGSR6-frsoVTDkcSoNCA70Iym9DfUxSJWSMOPQTg0.jpg?width=640&crop=smart&auto=webp&s=748ea3d5773b9a9f495bd5df8784102c516f9f25 submitted by /u/EspoJ
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Cloudfox – Automating Situational Awareness For Cloud Penetration Tests

CloudFox helps you gain situational awareness in unfamiliar cloud environments. It’s an open source command line tool created to help penetration testers and other offensive security professionals find exploitable attack paths in cloud infrastructure. CloudFox helps you answer the following common questions (and many more):* What regions is this AWS account using and roughly how many resources are in the account?
* What secrets are lurking in EC2 userdata or service specific environment variables?
* What actions/permissions does this [principal] have?
* What roles trusts are overly permissive or allow cross-account assumption?
* What endpoints/hostnames/IPs can I attack from an external starting point (public internet)?
* What endpoints/hostnames/IPs can I attack from an internal starting point (assumed breach within the VPC)?
* What filesystems can I potentially mount from a compromised resource inside the VPC? Quick StartCloudFox is modular (you can run one command at a time), but there is an aws all-checkscommand that will run the other aws commands for you with sane defaults:

cloudfox aws –profile [profile-name] all-checks
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjcFGgykuWe-W6_kEnUOlLoyRhiccYxQOjoRg_oiae1VTN9gXMe1wEiSwPm8Nhnuid3smlkEJdfey4Hol9YVsvm-Wv4OJVdNTdDBS-KBzrI-ouf0l0XAH4h-6mmiG6gxP2Cqv_IoUqrzz2Z1dpj6S4dZ1tHcY-BzRK_Os96vN2b5Q3ZmFl55GMwMbCL/s728/CloudFox.png
CloudFox is designed to be executed by a principal with limited read-only permissions, but it’s purpose is to help you find attack paths that can be exploited in simulated compromise scenarios (aka, objective based penetration testing).

For the full documentation please refer to our wiki. Supported Cloud ProvidersProviderCloudFox CommandsAWS15Azure2 (alpha)GCPSupport PlannedKubernetesSupport Planned InstallOption 1: Download the latest binary release for your platform.

Option 2: Install Go, clone the CloudFox repository and compile from source
# git clone https://github.com/BishopFox/cloudfox.git
...omitted for brevity...
# cd ./cloudfox
# go build .
# ./cloudfox PrerequisitesAWS* AWS CLI installed
* Supports AWS profiles, AWS environment variables, or metadata retrieval (on an ec2 instance)
* To run commands on multiple profiles at once, you can specify the path to a file with a list of profile names seperated by a new line using the -lflag or pass all stored profiles with the -aflag.

* A principal with one recommended policies attached (described below)
* Recommended attached policies: SecurityAudit+ CloudFox custom policy

Additional policy notes (as of 09/2022):
PolicyNotesCloudFox custom policyHas a complete list of every permission cloudfox uses and nothing elsearn:aws:iam::aws:policy/SecurityAuditCovers most cloudfox checks but is missing newer services or permissions like apprunner:*, grafana:*, lambda:GetFunctionURL, lightsail:GetContainerServicesarn:aws:iam::aws:policy/job-function/ViewOnlyAccessCovers most cloudfox checks but is missing newer services or permissions like AppRunner:*, grafana:*, lambda:GetFunctionURL, lightsail:GetContainerServices – and is also missing iam:SimulatePrincipalPolicy.arn:aws:iam::aws:policy/ReadOnlyAccessOnly missing AppRunner, but also grants things like “s3:Get*” which can be overly permissive.arn:aws:iam::aws:policy/AdministratorAccessThis will work just fine with CloudFox, but if you were handed this level of access as a penetration tester, that should probably be a finding in itself https://s.w.org/images/core/emoji/14.0.0/72x72/1f642.png Azure* Viewer or similar permissions applied. Supported CommandsProviderCommand NameDescriptionAWSall-checksRun [...]

___________________________
@hacking_Attack
@Hacking_Video

all of the other commands using reasonable defaults. You’ll still want to check out the non-default options of each command, but this is a great place to start.AWSaccess-keysLists active access keys for all users. Useful for cross referencing a key you found with which in-scope account it belongs to.AWSbucketsLists the buckets in the account and gives you handy commands for inspecting them further.AWSecrList the most recently pushed image URI from all repositories. Use the loot file to pull selected images down with docker/nerdctl for inspection.AWSendpointsEnumerates endpoints from various services. Scan these endpoints from both an internal and external position to look for things that don’t require authentication, are misconfigured, etc.AWSenv-varsGrabs the environment variables from services that have them (App Runner, ECS, Lambda, Lightsail containers, Sagemaker are supported. If you find a sensitive secret, use cloudfox iam-simulatorAND pmapperto see who has access to them.AWSfilesystemsEnumerate the EFS and FSx filesystems that you might be able to mount without creds (if you have the right network access). For example, this is useful when you have ec:RunInstancebut not iam:PassRole.AWSiam-simulatorLike pmapper, but uses the IAM policy simulator. It uses AWS’s evaluation logic, but notably, it doesn’t consider transitive access via privesc, which is why you should also always also use pmapper.AWSinstancesEnumerates useful information for EC2 Instances in all regions like name, public/private IPs, and instance profiles. Generates loot files you can feed to nmap and other tools for service enumeration.AWSinventoryGain a rough understanding of size of the account and preferred regions.AWSoutbound-assumed-rolesList the roles that have been assumed by principals in this account. This is an excellent way to find outbound attack paths that lead into other accounts.AWSpermissionsEnumerates IAM permissions associated with all users and roles. Grep this output to figure out what permissions a particular principal has rather than logging into the AWS console and painstakingly expanding each policy attached to the principal you are investigating.AWSprincipalsEnumerates IAM users and Roles so you have the data at your fingertips.AWSrole-trustsEnumerates IAM role trust policies so you can look for overly permissive role trusts or find roles that trust a specific service.AWSroute53Enumerate all records from all route53 managed zones. Use this for application and service enumeration.AWSsecretsList secrets from SecretsManager and SSM. Look for interesting secrets in the list and then see who has access to them using use cloudfox iam-simulatorand/or pmapper.Azureinstances-mapEnumerates useful information for Compute instances in all available resource groups and subscriptionsAzurerbac-mapEnumerates Role Assignments for all tenants Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video