Black Hat Ethical Hacking
QNAP NAS Devices at Risk of Remote Malicious Code Injection

QNAP NAS Devices at Risk of Remote Malicious Code InjectionPost Views: 237 Premium Contenthttps://www.blackhatethicalhacking.com/wp-content/uploads/2022/12/Patreon.png Subscribe to Patreon to watch this episode.
Reading Time: 3 Minutes QNAP, a provider of Network-Attached Storage (NAS) devices, has issued a warning to its customers to install firmware updates that resolve a critical security vulnerability on its devices. The flaw, tracked as CVE-2022-27596, is rated as “Critical” by QNAP, with a CVSS v3 score of 9.8, and is described as a SQL injection flaw.
The vulnerability impacts the QTS 5.0.1 and QuTS hero h5.0.1 versions of the operating system and could allow remote attackers to inject malicious code.
See Also: So you want to be a hacker? Offensive Security, Bug Bounty Courses QNAP advise for device protectionQNAP has advised users running the affected versions of the operating system to upgrade to QTS 5.0.1.2234 build 20221201 or later, and QuTS hero h5.0.1.2248 build 20221215 or later, to ensure the protection of their devices.

The update can be performed by logging in as the admin user and navigating to the firmware update section in the Control Panel, or by downloading the update from QNAP’s Download Center.

It is important for users to apply these security updates as soon as possible, as threat actors are known to target vulnerabilities in QNAP devices.
The company’s devices are already the target of ongoing ransomware campaigns, such as DeadBolt and eCh0raix, which abuse vulnerabilities to encrypt data on exposed NAS devices.
Trending: How to Exploit “improper error handling” in Web Applications Trending: Offensive Security Tool: XSSRocket Always check for updatesIn conclusion, the critical security vulnerability reported by QNAP highlights the importance of keeping device firmware updated to ensure the protection of sensitive data.
Trending: Cisco VPN Routers: 19,000 Devices Left Exposed to Remote Command Execution Exploit Chain
Are u a security researcher? Or a company that writes articles or write ups about Cyber Security, Offensive Security (related to information security in general) that match with our specific audience and is worth sharing?

If you want to express your idea in an article contact us here for a quote: info@blackhatethicalhacking.com
Source: bleepingcomputer.com Source Link https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Merch.png Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/02/Images-for-the-News-posts-4-300x150.png Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed ChromebooksFebruary 1, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-10-1-300x150.png PlugX Variant Uncovered: Document-Stealing Malware Targets USB DrivesJanuary 30, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library’s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post QNAP NAS Devices at Risk of Remote Malicious Code Injection first appeared on Black Hat Ethical Hacking.

, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-8-1-300x150.png Ransack Library’s Search and Sort Feature Puts Ruby on Rails Applications at Risk of Information TheftJanuary 27, 2023
* https://www.blackhatethicalhacking.com/wp-content/uploads/2023/01/Images-for-the-News-posts-7-2-300x150.png Windows CryptoAPI Flaw Allows Attackers to Spoof Identity, PoC Exploit ReleasedJanuary 26, 2023
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/06/OffSec-Course.png Offensive Security & Ethical Hacking CourseBegin the learning curve of hacking now!
The post Sh1mmer: A New Exploit Enables Unenrollment of Enterprise-Managed Chromebooks first appeared on Black Hat Ethical Hacking.

Monomorph - MD5-Monomorphic Shellcode Packer - All Payloads Have The Same MD5 Hash
http://www.kitploit.com/2023/02/monomorph-md5-monomorphic-shellcode.html

════════════════════════════════════╦═══
╔═╦═╗ ╔═╗ ╔═╗ ╔═╗ ╔═╦═╗ ╔═╗ ╔══╔═╗ ╠═╗
═╩ ╩ ╩═╚═╝═╩ ╩═╚═╝═╩ ╩ ╩═╚═╝═╩ ╠═╝═╩ ╩═
════════════════════════════════╩═══════
By Retr0id

═══ MD5-Monomorphic Shellcode Packer (https://www.kitploit.com/search/label/Packer) ═ ══


USAGE: python3 monomorph.py input_file output_file [payload_file]
What does it do? It packs up to 4KB of compressed shellcode into an executable binary, near-instantly. The output file will always have the same MD5 hash: 3cebbe60d91ce760409bbe513593e401 Currently, only Linux x86-64 is supported. It would be trivial to port this technique to other platforms, although each version would end up with a different MD5. It would also be possible to use a multi-platform polyglot (https://www.kitploit.com/search/label/Polyglot) file like APE (https://justine.lol/ape.html). Example usage: $ python3 monomorph.py bin/monomorph.linux.x86-64.benign bin/monomorph.linux.x86-64.meterpreter sample_payloads/bin/linux.x64.meterpreter.bind_tcp.bin
Why? People have previously (https://www.mscs.dal.ca/~selinger/md5collision/) used single collisions to toggle a binary (https://www.kitploit.com/search/label/Binary) between "good" and "evil" modes. Monomorph takes this concept to the next level. Some people still insist on using MD5 to reference file samples, for various reasons that don't make sense to me. If any of these people end up investigating code packed using Monomorph, they're going to get very confused. How does it work? For every bit we want to encode, a colliding MD5 block has been pre-calculated using FastColl (https://github.com/cr-marcstevens/hashclash/tree/master/src/md5fastcoll). As summarised here (https://github.com/corkami/collisions/tree/master/hashquines#read-an-encoded-value), each collision gives us a pair of blocks that we can swap out without changing the overall MD5 hash. The loader checks which block was chosen at runtime, to decode (https://www.kitploit.com/search/label/Decode) the bit. To encode 4KB of data, we need to generate 4*1024*8 collisions (which takes a few hours), taking up 4MB of space in the final file. To speed this up, I made some small tweaks to FastColl to make it even faster in practice, enabling it to be run in parallel. I'm sure there are smarter ways to parallelise it, but my naive approach is to start N instances simultaneously and wait for the first one to complete, then kill all the others. Since I've already done the pre-computation, reconfiguring the payload (https://www.kitploit.com/search/label/Payload) can be done near-instantly. Swapping the state of the pre-computed blocks is done using a technique (https://github.com/corkami/collisions/blob/master/hashquines/scripts/collisions.py) implemented by Ange Albertini. Is it detectable? Yes. It's not very stealthy at all, nor does it try to be. You can detect the collision blocks using detectcoll (https://github.com/cr-marcstevens/hashclash/tree/collisiondetection/src/collisiondetection).

Download Monomorph (https://github.com/DavidBuchanan314/monomorph)

Privilege Escalation Lead to Data Breach
https://medium.com/@ibnu1337/privilege-escalation-lead-to-data-breach-1e4975c3edaa?source=rss------bug_bounty-5

Assalamualaikum, Bug Hunter!
Bagaimana Kabarnya ? Semoga Baik-baik saja ya, kali ini saya mau membuat Write Up yang menurut saya Bug ini…Continue reading on Medium » (https://medium.com/@ibnu1337/privilege-escalation-lead-to-data-breach-1e4975c3edaa?source=rss------bug_bounty-5)

Don’t Give Up On XSS! | Fun Firefox XSS
https://infosecwriteups.com/dont-give-up-on-xss-fun-firefox-xss-3fce0ee297a?source=rss------bug_bounty-5

There’s always a way to exploit xss in different contextsContinue reading on InfoSec Write-ups » (https://infosecwriteups.com/dont-give-up-on-xss-fun-firefox-xss-3fce0ee297a?source=rss------bug_bounty-5)

What is Ethereum? Mastering Ethereum Chapter 1 Summary
https://web3doctor.medium.com/what-is-ethereum-mastering-ethereum-chapter-1-summary-233183828f5?source=rss------bug_bounty-5

What is Ethereum Everything you need to know?Continue reading on Medium » (https://web3doctor.medium.com/what-is-ethereum-mastering-ethereum-chapter-1-summary-233183828f5?source=rss------bug_bounty-5)

Account Takeover Guide
https://infosecwriteups.com/account-takeover-guide-eaff94d4ffe8?source=rss------bug_bounty-5

Hey guys, in this tutorial, I will be sharing my learning about account takeover which I have learned after reading some blogs only on…Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/account-takeover-guide-eaff94d4ffe8?source=rss------bug_bounty-5)

Stored XSS — PARK TICKETING MANAGEMENT SYSTEM(Phpgurukul)

# Exploit Title: PARK TICKETING MANAGEMENT SYSTEM — Stored XSS Vulnreability. # Date: 25–01–2023 # Exploit Author: Venkata Siva Kumar…Continue reading on Medium »
Read more...

KitPloit - PenTest Tools!
Monomorph - MD5-Monomorphic Shellcode Packer - All Payloads Have The Same MD5 Hash

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnwjNE0lyLEzAnqddmf6LIbUH381tCsODiPQ2DC3OLrtlLh5M80qBZicWGIYcGUBoFBgEOyDCF4yhHzGZ7hJiPkqHfpzQoGHb9rU5mylhb7Dk55E-G8WnXSm69ebU5OniUXwwRo4PeLMNcm7oTc7yISuZbbPVx7B9XndFedxqJ_MYmaBzxaJAARvnPZg/w640-h354/monomorph.png


════════════════════════════════════╦═══
╔═╦═╗ ╔═╗ ╔═╗ ╔═╗ ╔═╦═╗ ╔═╗ ╔══╔═╗ ╠═╗
═╩ ╩ ╩═╚═╝═╩ ╩═╚═╝═╩ ╩ ╩═╚═╝═╩ ╠═╝═╩ ╩═
════════════════════════════════╩═══════
By Retr0id

═══ MD5-Monomorphic Shellcode Packer ═ ══
USAGE: python3 monomorph.py input_file output_file [payload_file]


What does it do?

It packs up to 4KB of compressed shellcode into an executable binary, near-instantly. The output file will always have the same MD5 hash: 3cebbe60d91ce760409bbe513593e401

Currently, only Linux x86-64 is supported. It would be trivial to port this technique to other platforms, although each version would end up with a different MD5. It would also be possible to use a multi-platform polyglot file like APE.

Example usage:

$ python3 monomorph.py bin/monomorph.linux.x86-64.benign bin/monomorph.linux.x86-64.meterpreter sample_payloads/bin/linux.x64.meterpreter.bind_tcp.bin


Why?

People have previously used single collisions to toggle a binary between "good" and "evil" modes. Monomorph takes this concept to the next level.

Some people still insist on using MD5 to reference file samples, for various reasons that don't make sense to me. If any of these people end up investigating code packed using Monomorph, they're going to get very confused.

How does it work?

For every bit we want to encode, a colliding MD5 block has been pre-calculated using FastColl. As summarised here, each collision gives us a pair of blocks that we can swap out without changing the overall MD5 hash. The loader checks which block was chosen at runtime, to decode the bit.

To encode 4KB of data, we need to generate 4*1024*8 collisions (which takes a few hours), taking up 4MB of space in the final file.

To speed this up, I made some small tweaks to FastColl to make it even faster in practice, enabling it to be run in parallel. I'm sure there are smarter ways to parallelise it, but my naive approach is to start N instances simultaneously and wait for the first one to complete, then kill all the others.

Since I've already done the pre-computation, reconfiguring the payload can be done near-instantly. Swapping the state of the pre-computed blocks is done using a technique implemented by Ange Albertini.

Is it detectable?

Yes. It's not very stealthy at all, nor does it try to be. You can detect the collision blocks using detectcoll.
Download Monomorph