BackBox News
Latest news and insights on Security
Company Blogs
Hacking Tools
[wp-rss-aggregator feeds="kitploit" limit="10" pagination="off"]
Exploit DB
[wp-rss-aggregator feeds="exploit-db" limit="10" pagination="off"]
Latest news and insights on Security
HTB Stocker Walkthrough
/in General NewsSimple BOX on both flags, much more root than the user, still fun and great for beginners.
The nmap scan:
It can be said that only port 80 of the portal is available. Directly towards the goal, then. Let’s put stocker.htb in the /et/hosts file and take a look at the portal. It seems to be an e-commerce portal (but there don’t seem to be any functional features), let’s immediately identify a possible user “Angoose Garden, Head of IT at Stockers Ltd“, keep that in mind. Let’s scan with dirb, looking for hidden routes.
Nothing interesting, let’s try subdomains.
Bingo, let’s add dev.stocker.htb to the /etc/hosts file and browse the new portal. This time we find something, a login form, probably managed by a back-end in node.js.
I make some first attempts, but it doesn’t seem to be vulnerable to standard SLQi (SQL injection) attacks, even sqlmap doesn’t find anything. In addition to the technologies already mentioned, there is also the HUGO framework. I investigate.
This is a framework for creating portals, but it doesn’t seem to help me. Let’s keep that in mind, we’ll come back to it later if necessary. Let’s do another session with the dirb on this second domain as well.
Again nothing, I have to bypass the login first. Let’s go over what we did a bit and understand. Reviewing the past steps, it occurs to me that it is probably not an SQLi attack that is needed, but NOSQLi. And here I have to admit that I had some difficulty, not in the search for the vulnerability, but in the use of the tools, where once again, the fact was revealed that doing it manually brings its benefits, but let’s proceed step by step and so here are my stubborn mistakes in the desire to use existing tools (because I am convinced that they work better than I can do), to find than the right path in that manual activity which has always paid off.
After a myriad of additional packages to install, I finally succeed, with python 2.7 and pip 2.7. Here’s how to install pip 2.7:
Finally, the launch of the NOSQLi vulnerability scan command.
Despite everything, nothing emerges for the two most popular NOSQL databases; mongodb and couchdb. Let’s go ahead, let’s rely on the best-stocked portal of tricks we know at the moment…
…and find another couple of interesting tools.
Again, however, they don’t seem to work for me. I decide on a few manual steps, so the BurpSuite is a must.
Here’s the call to login, still referring to the hacktricks guidelines, I start going through all the listed payloads and finally find the right one.
And finally, we are in. Now I can buy and request a receipt. The invoice is returned in pdf format, there must be a conversion process. Need to understand which tools are being used to make the conversion. so let’s download the pdf and take a closer look at the metadata.
The producer field provides us with the necessary information, so I search for “skia/pdf exploit” and immediately a series of interesting links are revealed to my eyes.
Ok, the portal cart seems to have remained full, it is not emptied after the purchase, which could make my life easier. Let’s see if I can modify the data inside it in a simple and fast way.
The products are placed in a javascript array named basket. Just change the information contained therein and make a new purchase. Let’s start by passing the most classic payload, just to understand if the vulnerability actually exists: <iframe src=file:////etc/passwd>.
When you open the cart again, the set payload appears.
And when we go to download the invoice, the magic happens.
Do you remember the name of the Head of IT? Ok, needless to say, I immediately tried to reach the user flag file (<iframe width=’1200′ height=’700′ src=file:////home/angoose/user.txt>), but obviously to no avail. At this point the only thing I can do is go look for interesting files such as configuration files, DB connection, credentials, etc… Let’s focus on the technologies that we had identified with the wappalyzer.
Trying with <iframe width=’1200′ height=’1000′ src=file:////etc/nginx/nginx.conf>:
I’d like to see a few more lines of the file, but I think this could be a good starting point; the path in which the portal is published. Let’s cross this information with the fact that the back-end is in node.js and we can try to retrieve the most common filenames used for a project like this: app.js, server.js and index.js.
And using <iframe width=’1200′ height=’1000′ src=file:////var/www/dev/index.js>:
In addition to the mongodb address, in which the application user’s credentials are evident, I have also reported the block of code used to login, in which the point where we attacked via the NOSQLi payload is visible. It’s evident that there is not a dev user who has access via shell, but knowing the nature of the BOX, we can easily apply the password to the one that can use a shell from the list of users (/etc/passwd) obviously excluding the user of root.
And first flag was captured, next step is really very fast, not even an advanced scan was needed. Let’s look at what this user can do as root without a password.
Apparently, we can run node scripts contained in a particular folder. That asterisk, however, highlights an unequivocal traversal path. So I prepare my malicious script. I initially tried to spawn a shell as root, but quickly reverted (child_process didn’t seem to work), so I chose a script that simply reads the root flag file.
And that’s all folks, see you soon my readers and happy hacking activities.
Secjuice – Read More
Start-up Security 101: How to Protect Your Venture from Cybersecurity Risk
/in General NewsDid you know that 43% of cyberattacks target small businesses, yet only 14% are prepared to defend themselves?…
Hackread – Latest Cybersecurity, Tech, AI, Crypto & Hacking News – Read More
Intel’s Secure Data Tunnel Moves AI Training Models to Data Sources
/in General NewsThe chip maker’s Tiber Secure Federated AI service creates a secure tunnel between AI models on remote servers and data sources on origin systems.
darkreading – Read More
LockBit Developer Rostislav Panev Extradited from Israel to the US
/in General NewsThe US extradites LockBit ransomware developer, Rostislav Panev, from Israel. Learn how his arrest impacts the fight against…
Hackread – Latest Cybersecurity, Tech, AI, Crypto & Hacking News – Read More
End-to-End Encrypted Texts Between Android and iPhone Are Coming
/in General NewsPlus: A nominee to lead CISA emerges, Elon Musk visits the NSA, a renowned crypto cracking firm’s secret (and problematic) cofounder is revealed, and more.
Security Latest – Read More
Cybersecurity in Crypto: Best Practices to Prevent Theft and Fraud
/in General NewsCybersecurity tips to protect your cryptocurrency from hackers, scams, and fraud. Learn best practices for securing digital assets…
Hackread – Latest Cybersecurity, Tech, AI, Crypto & Hacking News – Read More
Malicious PyPI Packages Stole Cloud Tokens—Over 14,100 Downloads Before Removal
/in General NewsCybersecurity researchers have warned of a malicious campaign targeting users of the Python Package Index (PyPI) repository with bogus libraries masquerading as “time” related utilities, but harboring hidden functionality to steal sensitive data such as cloud access tokens.
Software supply chain security firm ReversingLabs said it discovered two sets of packages totaling 20 of them. The packages
The Hacker News – Read More
ClickFix: How to Infect Your PC in Three Easy Steps
/in General NewsA clever malware deployment scheme first spotted in targeted attacks last year has now gone mainstream. In this scam, dubbed “ClickFix,” the visitor to a hacked or malicious website is asked to distinguish themselves from bots by pressing a combination of keyboard keys that causes Microsoft Windows to download password-stealing malware.
ClickFix attacks mimic the “Verify You are a Human” tests that many websites use to separate real visitors from content-scraping bots. This particular scam usually starts with a website popup that looks something like this:
This malware attack pretends to be a CAPTCHA intended to separate humans from bots.
Clicking the “I’m not a robot” button generates a pop-up message asking the user to take three sequential steps to prove their humanity.
Executing this series of keypresses prompts Windows to download password-stealing malware.
Step 1 involves simultaneously pressing the keyboard key with the Windows icon and the letter “R,” which opens a Windows “Run” prompt that will execute any specified program that is already installed on the system.
Step 2 asks the user to press the “CTRL” key and the letter “V” at the same time, which pastes malicious code from the site’s virtual clipboard.
Step 3 — pressing the “Enter” key — causes Windows to download and launch malicious code through “mshta.exe,” a Windows program designed to run Microsoft HTML application files.
“This campaign delivers multiple families of commodity malware, including XWorm, Lumma stealer, VenomRAT, AsyncRAT, Danabot, and NetSupport RAT,” Microsoft wrote in a blog post on Thursday. “Depending on the specific payload, the specific code launched through mshta.exe varies. Some samples have downloaded PowerShell, JavaScript, and portable executable (PE) content.”
According to Microsoft, hospitality workers are being tricked into downloading credential-stealing malware by cybercriminals impersonating Booking.com. The company said attackers have been sending malicious emails impersonating Booking.com, often referencing negative guest reviews, requests from prospective guests, or online promotion opportunities — all in a bid to convince people to step through one of these ClickFix attacks.
In November 2024, KrebsOnSecurity reported that hundreds of hotels that use booking.com had been subject to targeted phishing attacks. Some of those lures worked, and allowed thieves to gain control over booking.com accounts. From there, they sent out phishing messages asking for financial information from people who’d just booked travel through the company’s app.
Earlier this month, the security firm Arctic Wolf warned about ClickFix attacks targeting people working in the healthcare sector. The company said those attacks leveraged malicious code stitched into the widely used physical therapy video site HEP2go that redirected visitors to a ClickFix prompt.
An alert (PDF) released in October 2024 by the U.S. Department of Health and Human Services warned that the ClickFix attack can take many forms, including fake Google Chrome error pages and popups that spoof Facebook.
ClickFix tactic used by malicious websites impersonating Google Chrome, Facebook, PDFSimpli, and reCAPTCHA. Source: Sekoia.
The ClickFix attack — and its reliance on mshta.exe — is reminiscent of phishing techniques employed for years that hid exploits inside Microsoft Office macros. Malicious macros became such a common malware threat that Microsoft was forced to start blocking macros by default in Office documents that try to download content from the web.
Alas, the email security vendor Proofpoint has documented plenty of ClickFix attacks via phishing emails that include HTML attachments spoofing Microsoft Office files. When opened, the attachment displays an image of Microsoft Word document with a pop-up error message directing users to click the “Solution” or “How to Fix” button.
HTML files containing ClickFix instructions. Examples for attachments named “Report_” (on the left) and “scan_doc_” (on the right). Image: Proofpoint.
Organizations that wish to do so can take advantage of Microsoft Group Policy restrictions to prevent Windows from executing the “run” command when users hit the Windows key and the “R” key simultaneously.
Krebs on Security – Read More
Update Your iPhone Now to Fix Safari Security Flaw
/in General NewsThe vulnerability allowed malicious code running inside the Web Content sandbox, an isolated environment for web processes designed to limit security risks, to impact other parts of the device.
Security | TechRepublic – Read More
Threat Actor Impersonates Booking.com in Phishing Scheme
/in General NewsMicrosoft detailed a sophisticated campaign that relies on a social engineering technique, “ClickFix,” in which a phisher uses security verification like captcha to give the target a false sense of safety.
darkreading – Read More