public void rebind(java.lang.String $param_String_1, java.rmi.Remote $param_Remote_2): rebind() replaces the binding of the passed name with the supplied remote reference, also returns void, Ermir returns an exception just like bind(). public void unbind(java.lang.String $param_String_1): unbind() unbinds a remote object by name in the RMI registry, this one also returns void. PoC

___________________________
@hacking_Attack
@Hacking_Video

Contributing Bug reports and pull requests are welcome on GitHub at https://github.com/hakivvi/ermir. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct (https://github.com/hakivvi/ermir/blob/main/CODE_OF_CONDUCT.md). License The gem is available as open source under the terms of the MIT License (https://opensource.org/licenses/MIT). Code of Conduct Everyone interacting in the Ermir project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct (https://github.com/hakivvi/ermir/blob/main/CODE_OF_CONDUCT.md).

Download Ermir (https://github.com/hakivvi/ermir)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackme | ToolsRus — Write-up

https://cdn-images-1.medium.com/max/1000/0*v5jOkrDpu3F3lLdN.png
Today I will walk you through completing the TryHackMe room ToolsRus. First time I have done a write up and it’s mainly to reinforce my…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
IPHONES ARE Seriously Open to IOS 16.1, IPADS As well

Mac carried out the hotly anticipated iOS 16.1 and iPadOS 16.1 updates for qualified iPhones and iPads. iPadOS 16.1 was the primary…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Basic Acronym in Networking

1. TCP — Transfer Control Protocol

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WhatsApp discharges highlight showing profile photographs in bunch talks to certain iOS beta…

WhatsApp is dealing with a few energizing updates to give a superior encounter to its clients. The texting application is delivering…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Blogs — A Blog On Writing Blogs

https://cdn-images-1.medium.com/max/2468/1*_pIYWJQJPNJ_leCzcUGPPw.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
WhatsApp dealing with capacity to permit clients to alter sent messages.

The component is accessible just to a few beta clients who introduce the most recent update of WhatsApp beta for iOS from the Test Flight…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
CTF Journal 14 — Try Hack Me — Upload Vulnerability(3/?)

2022/10/29

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How To Create a Virtual Machine.

https://cdn-images-1.medium.com/max/1440/1*mKsCUrg33jkyPshFRDPnhQ.png
what is a virtual machine?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Registrations Open for IWCON2022 Version 2.0 — the Online International Cybersecurity Conference

https://cdn-images-1.medium.com/max/1080/1*o9oaTaLd_cMRS5x_bk_cjA.png
Book your seats today!

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Android Pentesting 101 — Part 3

https://cdn-images-1.medium.com/max/600/0*ceacFcCmu_iDQWxt
Welcome to Part 3 of Android Pentesting. This series is about how you can hack into Android and find vulnerabilities in it using various…

Continue reading on InfoSec Write-ups »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
Ermir - An Evil Java RMI Registry

https://blogger.googleusercontent.com/img/a/AVvXsEi5M-qQI0jAEcuuEEaopyFsMT-DMUz_w8NCvWLibYBeKWmHqfFEISZ1QrpwKYbDsj9O2cETouE06Wb9Wr-l92evRmVVr7m8-WuwFUlIBfB8fut9CBzNd8O1_MtnY6KP74dSl93h-wphZJe1kp9PnDkcAhekIREIf6gWToGMGaZR0NCPtqsuSCMOZZKSug=w640-h310 Ermir is an Evil/Rogue RMI Registry, it exploits unsecure deserialization on any Java code calling standard RMI methods on it (list()/lookup()/bind()/rebind()/unbind()). Requirements* Ruby v3 or newer. InstallationInstall Ermir from rubygems.org: $ gem install ermir or clone the repo and build the gem: $ git clone https://github.com/hakivvi/ermir.git
$ rake install UsageErmir is a cli gem, it comes with 2 cli files ermirand gadgetmarshal, ermiris the actual gem and the latter is just a pretty interface to GadgetMarshaller.java file which rewrites the gadgets of Ysoserial to match MarshalInputStreamrequirements, the output should be then piped into ermiror a file, in case of custom gadgets use MarshalOutputStreaminstead of ObjectOutputStreamto write your serialized object to the output stream. ermirusage:

RMI Registry which exploits unsecure Java deserialization on any Java code calling standard RMI methods on it. Usage: ermir [options] -l, --listen bind the RMI Registry to this ip and port (default: 0.0.0.0:1099). -f, --file path to file containing the gadget to be deserialized. -p, --pipe read the serialized gadget from the standard input stream. -v, --version print Ermir version. -h, --help print options help. Example: $ gadgetmarshal /path/to/ysoserial.jar Groovy1 calc.exe | ermir --listen 127.0.0.1:1099 --pipe" dir="auto">➜ ~ ermir
Ermir by @hakivvi * https://github.com/hakivvi/ermir.
Info:
Ermir is a Rogue/Evil RMI Registry which exploits unsecure Java deserialization on any Java code calling standard RMI methods on it.
Usage: ermir [options]
-l, --listen bind the RMI Registry to this ip and port (default: 0.0.0.0:1099).
-f, --file path to file containing the gadget to be deserialized.
-p, --pipe read the serialized gadget from the standard input stream.
-v, --version print Ermir version.
-h, --help print options help.
Example:
$ gadgetmarshal /path/to/ysoserial.jar Groovy1 calc.exe | ermir --listen 127.0.0.1:1099 --pipe gadgetmarshalusage: ➜ ~ gadgetmarshal
Usage: gadgetmarshal /path/to/ysoserial.jar Gadget1 cmd (optional)/path/to/output/fileHow does it work?java.rmi.registry.Registryoffers 5 methods: list(), lookup(), bind(), rebind(), unbind():

* public Remote lookup(String name): lookup() searches for a bound object in the registry by its name, the registry returns a Remoteobject which references the remote object that was looked up, the returned object is read using MarshalInputStream.readObject()which is just another layer on top of ObjectInputStream, basically it excpects after each class/proxy descriptor (TC_CLASSDESC/TC_PROXYCLASSDESC) an URL that will be used to load this class or proxy class. this is the same wild bug that was fixed in jdk7u21. (Ermir does not specify this URL as only old Java version are vulnerable, instead it just write null). as Ysoserial gadgets are being serialized using ObjectOutputStream, Ermir uses gadgetmarshal-a wrapper around GadgetMarshaller.java- to serialize the specified gagdet to match MarshalInputStreamrequirements. https://blogger.googleusercontent.com/img/a/AVvXsEi5M-qQI0jAEcuuEEaopyFsMT-DMUz_w8NCvWL[...]

___________________________
@hacking_Attack
@Hacking_Video

ibYBeKWmHqfFEISZ1QrpwKYbDsj9O2cETouE06Wb9Wr-l92evRmVVr7m8-WuwFUlIBfB8fut9CBzNd8O1_MtnY6KP74dSl93h-wphZJe1kp9PnDkcAhekIREIf6gWToGMGaZR0NCPtqsuSCMOZZKSug=w640-h310 * public String[] list(): list() asks the registry for all the bound objects names, while Stringtype cannot be subsitued with a malicious gadget as it is not like any ordinary object and it is not read using readObject()but rather readUTF(), however as list()returns String[]which is an actual object and it is read using readObject(), Ermir sends the gadget instead of this String[]type. https://blogger.googleusercontent.com/img/a/AVvXsEj93Qx7mmrlzWQ87KJmdGmkJzluP6DjaA5tZ6hAMOD-ijZyY9xxGRJv9u6PH_ugtdGiAwMHuH91UxhLhLH5XdmJFkRvNuqGFktkEbblWiSftuF7cS1eqWXtPQJnc0eyMEJ8Gk7qLFhcq3vCJrpqd99pO0rM_kqvoSJRCb9nEAkK8qQYKVC--5_vsqo3Ow=w640-h266 * public void bind(java.lang.String $param_String_1, java.rmi.Remote $param_Remote_2): bind() binds an object to a name on the registry, in bind() case the return type is voidand there is nothing being returned, however if the registry specifies in the RMI return data packet that this return is an execptional return, the client/server client will call readObject()despite the return type is void, this is how the regitry sends exceptions to its client (usually java.lang.ClassNotFoundException), once again Ermir will deliver the serialized gadget instead of a legitimate Exception object. https://blogger.googleusercontent.com/img/a/AVvXsEjoE87SuTKFsZT_34AoMztCeFwP2G6yxoQeNSor2bl7mrxnYEwxMSCgjVBSUOk7gtBmnh2dCOTP2dxrQTPdvkVos3VxXK7gpcAllslTJcPc6jiuYekVZKKyTtSXVpPZmzssuh5dRo4qqqIH8AD72eCfEUvqcBnayzrL6bAy7LE-_T5agvw8do8y1QKf7g=w640-h282 * public void rebind(java.lang.String $param_String_1, java.rmi.Remote $param_Remote_2): rebind() replaces the binding of the passed name with the supplied remote reference, also returns void, Ermir returns an exception just like bind().

* public void unbind(java.lang.String $param_String_1): unbind() unbinds a remote object by name in the RMI registry, this one also returns void. PoChttps://blogger.googleusercontent.com/img/a/AVvXsEj2ZO33eAXzM617JjH2u1Oez0aCH-VPGy1au_v9xoBdkFg4E3N5rm7OcKt3_CdTsdJ1rsXlyUD6v9KIDuKNTP2DxWdesAEq6AUTNAbVtQmyNrA6HlWXCOBAZmjQYhDVZ44S4e-LxcfONRwEi_h0b7JYuLVh_rlvzCFDiDqA4Tn7y1OSXYLOnpoCu6cxqA=w640-h332 ContributingBug reports and pull requests are welcome on GitHub at https://github.com/hakivvi/ermir. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the code of conduct. LicenseThe gem is available as open source under the terms of the MIT License. Code of ConductEveryone interacting in the Ermir project's codebases, issue trackers, chat rooms and mailing lists is expected to follow the code of conduct. Download Ermir

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
If I use a trusted no-log VPN, there is absolutely no way my ISP/the gov/anyone can know what I did online. Is this correct?

If so, is there any VPN you trust?

submitted by /u/AlainAlam
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video