https://www.qualys.com/2023/10/03/cve-2023-4911/looney-tunables-local-privilege-escalation-glibc-ld-so.txt

Fedora 37 и 38, Ubuntu 22.04 и 23.04, Debian 12 и 13, и все остальные дистрибутивы, использующие Glibc.

Проверить у себя

env -i "GLIBC_TUNABLES=glibc.malloc.mxfast=glibc.malloc.mxfast=A" "Z=`printf '%08192x' 1`" /usr/bin/su --help

CVE-2023-36845
Fileless Remote Code Execution on Juniper Firewalls

Blog: https://vulncheck.com/blog/juniper-cve-2023-36845
PoC: https://github.com/kljunowsky/CVE-2023-36845
Shodan: title:"Juniper" http.favicon.hash:2141724739

CVE-2023-36845 represents a notable PHP environment variable manipulation vulnerability that impacts Juniper SRX firewalls and EX switches. While Juniper has categorized this vulnerability as being of medium severity, in this article, we will elucidate how this singular vulnerability can be leveraged for remote, unauthenticated code execution.

#pentest #books #web

#pentest #web

BurpSuite hotkeys cheatsheet by @ptswarm

#pentest #web

Acunetix Windows v23.9 - 28 Sep 2023

Download: https://ponies.cloud/scanner_web/acunetix/Acunetix-v23.9-Windows-Pwn3rzs-CyberArsenal.7z
Password: Pwn3rzs

Setup:
See README.txt

Enjoy!

NOTE:
The job _not_found issue seems to be fixed.
Practically it was caused by the telemetry multiple fails to reach destination (since we've set it to localhost) and was restarting the whole server.
To fix you set any IP that will answer on port 443 with any status code and any ssl cert.
No need to be 200 or whatever, just to be alive and reachable.
We've set the IP to Google's ones, but you can change it to whatever you'd like.
We've tested the solution with long scans , and the issue never happened once.

Changelog:
Too long for a post, refer here:
https://www.acunetix.com/changelogs/acunetix-premium/v23-9-28-september-2023/

🥔 Coerced Potato

New tool for local privilege escalation on a Windows machine, from a service account to NT SYSTEM. Should work on any recent versions of Windows.

⚙️ Tool:
https://github.com/hackvens/CoercedPotato

📝 Research:
https://blog.hackvens.fr/articles/CoercedPotato.html

#windows #lpe #seimpersonateprivilege #potato

#pentest #web

CVE-2023-22515 Exploit Script 🔐

This script is designed to exploit the CVE-2023-22515 vulnerability in Confluence, which allows for unauthorized access to Confluence Server and Confluence Data Center instances.

The script will provide information about the exploitation process, such as whether the vulnerability was successfully triggered, whether a new administrator was created, and whether authentication was successful.

🔐 Crack.sh is dead, Long Live Shuck.sh

Recently, many of you might've noticed that Crack.sh is currently unavailable. While it's been an invaluable tool in our arsenal, the landscape is ever-changing, and we need to pivot. Meet Shuck.sh, an emerging service that offers similar capabilities, leveraging the extensive Have I Been Pwned (HIBP) database.

🚀 Key Features:

— Shuck It: Instantly shuck NetNTLMv1, PPTP VPN, and WPA-Enterprise MSCHAPv2 challenges against HIBP's NT-hash database.
— Tech Insight: Efficient binary search for DES-keys collisions from a subset of the HIBP database.
— Fast & Free: Got around 100 NetNTLMv1 challenges? Extract their corresponding NT-Hashes in roughly 10 seconds.

One significant advantage of Shuck.sh over other tools is its ability to be deployed locally. For those concerned about security and privacy, you can set up Shuck.sh on your own environment using its script from the GitHub repository.

🔗 Shuck.sh
🔗 GitHub Repository
🔗 Pwned Passwords Version 8 (Torrent)

#ntlmv1 #des #mschapv2 #bruteforce

🔥Exploitation

Часто бывает нужным найти эксплоит под конкретную CVE или продукт. В таких случаях не стоит ограничивать себя поиском только по exploit-db.

Список баз данных, которые агрегируют в себе эксплоиты.

https://www.exploitalert.com/browse-exploit.html
https://cxsecurity.com/
https://packetstormsecurity.com/files/tags/exploit/
https://0day.today/
https://www.exploit-db.com/
https://cvexploits.io/

Репозитории, которые агрегируют PoC для различных CVE.

https://github.com/tg12/PoC_CVEs
https://github.com/nu11secur1ty/CVE-mitre
https://github.com/trickest/cve

Ресурсы, на которых можно получить информацию по конкретной CVE или уязвимостям продукта.

https://attackerkb.com/
https://cve.mitre.org/cve/
https://security.snyk.io/
https://vuldb.com/
https://www.opencve.io/

Поиск по версии продукта:

https://nvd.nist.gov/
https://www.cvedetails.com/cve/
https://vulners.com/

Также не стоит забывать про дорки:

CVE-2021-44228 site:github.com

#exploit #CVE

#windows

Дожили!
Microsoft отказывается от NTLM в пользу Kerberos

💬 Читать

#pentest #linux