#pentest #web

BurpSuite hotkeys cheatsheet by @ptswarm

#pentest #web

Acunetix Windows v23.9 - 28 Sep 2023

Download: https://ponies.cloud/scanner_web/acunetix/Acunetix-v23.9-Windows-Pwn3rzs-CyberArsenal.7z
Password: Pwn3rzs

Setup:
See README.txt

Enjoy!

NOTE:
The job _not_found issue seems to be fixed.
Practically it was caused by the telemetry multiple fails to reach destination (since we've set it to localhost) and was restarting the whole server.
To fix you set any IP that will answer on port 443 with any status code and any ssl cert.
No need to be 200 or whatever, just to be alive and reachable.
We've set the IP to Google's ones, but you can change it to whatever you'd like.
We've tested the solution with long scans , and the issue never happened once.

Changelog:
Too long for a post, refer here:
https://www.acunetix.com/changelogs/acunetix-premium/v23-9-28-september-2023/

🥔 Coerced Potato

New tool for local privilege escalation on a Windows machine, from a service account to NT SYSTEM. Should work on any recent versions of Windows.

⚙️ Tool:
https://github.com/hackvens/CoercedPotato

📝 Research:
https://blog.hackvens.fr/articles/CoercedPotato.html

#windows #lpe #seimpersonateprivilege #potato

#pentest #web

CVE-2023-22515 Exploit Script 🔐

This script is designed to exploit the CVE-2023-22515 vulnerability in Confluence, which allows for unauthorized access to Confluence Server and Confluence Data Center instances.

The script will provide information about the exploitation process, such as whether the vulnerability was successfully triggered, whether a new administrator was created, and whether authentication was successful.

🔐 Crack.sh is dead, Long Live Shuck.sh

Recently, many of you might've noticed that Crack.sh is currently unavailable. While it's been an invaluable tool in our arsenal, the landscape is ever-changing, and we need to pivot. Meet Shuck.sh, an emerging service that offers similar capabilities, leveraging the extensive Have I Been Pwned (HIBP) database.

🚀 Key Features:

— Shuck It: Instantly shuck NetNTLMv1, PPTP VPN, and WPA-Enterprise MSCHAPv2 challenges against HIBP's NT-hash database.
— Tech Insight: Efficient binary search for DES-keys collisions from a subset of the HIBP database.
— Fast & Free: Got around 100 NetNTLMv1 challenges? Extract their corresponding NT-Hashes in roughly 10 seconds.

One significant advantage of Shuck.sh over other tools is its ability to be deployed locally. For those concerned about security and privacy, you can set up Shuck.sh on your own environment using its script from the GitHub repository.

🔗 Shuck.sh
🔗 GitHub Repository
🔗 Pwned Passwords Version 8 (Torrent)

#ntlmv1 #des #mschapv2 #bruteforce

🔥Exploitation

Часто бывает нужным найти эксплоит под конкретную CVE или продукт. В таких случаях не стоит ограничивать себя поиском только по exploit-db.

Список баз данных, которые агрегируют в себе эксплоиты.

https://www.exploitalert.com/browse-exploit.html
https://cxsecurity.com/
https://packetstormsecurity.com/files/tags/exploit/
https://0day.today/
https://www.exploit-db.com/
https://cvexploits.io/

Репозитории, которые агрегируют PoC для различных CVE.

https://github.com/tg12/PoC_CVEs
https://github.com/nu11secur1ty/CVE-mitre
https://github.com/trickest/cve

Ресурсы, на которых можно получить информацию по конкретной CVE или уязвимостям продукта.

https://attackerkb.com/
https://cve.mitre.org/cve/
https://security.snyk.io/
https://vuldb.com/
https://www.opencve.io/

Поиск по версии продукта:

https://nvd.nist.gov/
https://www.cvedetails.com/cve/
https://vulners.com/

Также не стоит забывать про дорки:

CVE-2021-44228 site:github.com

#exploit #CVE

#windows

Дожили!
Microsoft отказывается от NTLM в пользу Kerberos

💬 Читать

#pentest #linux

#linux #ad #mimikatz

[ linikatzV2 ]

Post-exploitation tool for Unix machines attached to a Windows active directory, based on Tim (Wadhwa-)Brown Linikatz tool.
It extracts domain secrets from compromised machines, such as :
— User and machine hashes (SHA-512)
— Machine hash (NTLM) and AES keys
— Kerberos tickets
— Clear text passwords.

This tool needs root privileges to be run on the host system.

Author: 4zrm

https://github.com/Orange-Cyberdefense/LinikatzV2

Мало кто знает, что для осинта можно использовать поиск коллекций в Postman. Часто разработчики оставляют публичные репозитории, содержащие в себе как описание всех API ручек, так и токены авторизации, пароли от админок и бд, сертификаты.

https://www.postman.com/search?q=%D0%B1%D0%B4&scope=all&type=all

#pentest #windows

CVE-2023-36745: Microsoft Exchange Server RCE

https://securityonline.info/microsoft-exchange-server-rce-cve-2023-36745-flaw-gets-poc-exploit/

PoC: https://github.com/N1k0la-T/CVE-2023-36745

#exploit #ad #redteam #pentest