rootend

rootend rootend는 파이썬 nix 열거자 및 자동 권한 상승 도구입니다. 전체 도구 목록은 저희 웹사이트https://www.twelvesec.com/를 방문해주세요. 작성자: nickvourd twitter maldevel twitter servo 사용법 . \ / | | / / | | \ / / // | |\ / // \ \ / / \ | | \ /\ /| |\ /\ / / \ /\ \ || // \ // \ /\ \ / / / / / rootend v.2.0.3 - Enumeration &...

Fennec

Fennec 🦊 fennec는 nix 기반 시스템에서 사고 대응 시 사용되는 Rust로 작성된 아티팩트 수집 도구입니다. fennec은 아티팩트 수집 방법을 포함하는 구성 파일을 작성할 수 있습니다. 기능 🌟 🦀 단일 정적 컴파일 바이너리 🔬 모든 osquery SQL 쿼리 실행 💻 시스템 명령 실행 및 출력 파싱 📚 정규식을 사용하여 모든 텍스트 파일 파싱 🧰 시스템 로그 및 파일 수집 기능 🧱 구조화된 방식으로 데이터 반환 🃏 여러 출력 형식 지원 JSONL, CSV, KJSON 🤸‍♀️ 유연한 구성 파일 💾 공간 절약을 위해...

Hwacha

Hwacha https://www.n00py.io/2017/12/raining-shells-on-linux-environments-with-hwacha/ Hwacha는 Nix 기반 시스템에서 페이로드를 빠르게 실행하기 위한 도구입니다. 자격 증명을 획득한 전체 서브넷의 시스템에서 아티팩트를 쉽게 수집하거나 셸코드를 실행할 수 있습니다. $python hwacha.py &&&& && && && &&&&&&&&&&&& && && && Created by Esteban Rodriguez /\ &&&&&& && &&&&&&&&&& &...

ELFLoader

ELFLoader 이것은 ELF 객체를 메모리에서 로드/실행하는 로더/러너입니다. 목표는 모든 x8664 및 x86 nix 운영 체제에서 후속 기능을 실행하는 데 사용할 수 있는 단일 ELF 로더를 만드는 것입니다. 작동 방식 이 로더가 작동하는 방식은, 컴파일된 OS용 ELF 객체를 빌드하고 로드하는 데 필요한 모든 코드를 포함하고 있다는 것입니다. 전달된 항목이 ELF 파일이 아니거나, 올바른 아키텍처용이 아니거나, 해결할 수 없는 무언가에 링크되는 경우에는 실행을 시도하지 않고 종료됩니다. 심볼 해석 COFFLoader와...

EUVD-2015-3282

Malware in sbrugna...

Fennec - Artifact Collection Tool For *Nix Systems

fennec is an artifact collection tool written in Rust to be used during incident response on nix based systems. fennec allows you to write a configuration file that contains how to collect artifacts. Features A single statically compiled binary Execute any osquery SQL query Execute system command...

Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and *nix Systems? | McAfee Blogs

Babuk: Biting off More than they Could Chew by Aiming to Encrypt VM and nix Systems? Thibault Seret · JUL 28, 2021 Co-written with Northwave’s Noël Keijzer. Executive Summary For a long time, ransomware gangs were mostly focused on Microsoft Windows operating systems. Yes, we observed the...

Linux Variant of REvil Ransomware Targets VMware’s ESXi, NAS Devices

UPDATE Cybercriminals behind a string of high-profile ransomware attacks, including one extorting $11 million from JBS Foods last month, have ported their malware code to the Linux operating system. The unusual move is an attempt to target VMware’s ESXi virtual machine management software and...

Hwacha - Deploy Payloads To *Nix Systems En Masse

Hwacha is a tool to quickly execute payloads on Nix based systems. Easily collect artifacts or execute shellcode on an entire subnet of systems for which credentials are obtained. $python hwacha.py &&&& && && && &&&&&&&&&&&& && && && Created by Esteban Rodriguez /\ &&&&&& && &&&&&&&&&& && Web:...

CVE-2015-3222

syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root...

Code injection

syscheck/seechanges.c in OSSEC 2.7 through 2.8.1 on NIX systems allows local users to execute arbitrary code as root...

CVE-2015-3222

OSSEC CVE-2015-3222 affects OSSEC 2.7–2.8.1 on UNIX: the syscheck/seechanges.c code uses a shell diff command via system(), enabling a local user to escalate to root by exploiting this differential reporting feature. The issue is addressed in OSSEC 2.8.2 (fixes noted in release and FreeBSD VuXML/...

The Artillery Project

Artillery is a combination of a honeypot, monitoring tool, and alerting system. Eventually this will evolve into a hardening monitoring platform as well to detect insecure configurations from nix systems. It’s relatively simple, run ./setup.py and hit yes, this will install Artillery in...

OSSEC 2.7 < 2.8.1 - 'diff' Local Privilege Escalation

Fix for CVE-2015-3222 which allows for root escalation via syscheck - https://github.com/ossec/ossec-hids/releases/tag/2.8.2 Affected versions: 2.7 - 2.8.1 Beginning is OSSEC 2.7 d88cf1c9 a feature was added to syscheck, which is the daemon that monitors file changes on a system, called...

OSSEC 2.7 <= 2.8.1 - Local Root Escalation Vulnerability

Exploit for linux platform in category local exploits Fix for CVE-2015-3222 which allows for root escalation via syscheck - https://github.com/ossec/ossec-hids/releases/tag/2.8.2 Affected versions: 2.7 - 2.8.1 Beginning is OSSEC 2.7 d88cf1c9 a feature was added to syscheck, which is the daemon th...

GoAccess - Real-time Web Log Analyzer and Interactive Viewer

GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal in nix systems. It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. Features GoAccess parses the specified web log file and...

Open Source Log Analysis: GoAccess

GoAccess is an open source real-time web log analyzer and interactive viewer that runs in a terminal in nix systems . It provides fast and valuable HTTP statistics for system administrators that require a visual server report on the fly. Features GoAccess parses the specified web log file and...

NCSA httpd 1.x Buffer Overflow Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/3158/info NCSA HTTPd is a free, open-source web server for nix systems. NCSA HTTPd versions 1.3 and earlier are prone to an exploitable buffer overflowin the username field which will allow malicious remote users to execu...

phpBB2 remote execution command

phpBB2 is vulnerable to remote execution command All nix running phpBB2 versoion 2.0. Bug could be found at "phpBB2 root path" which is allowed remote attacker to execute any command remotely. The vulnerability of this attack start with '/phpBB2/includes/db.php?phpbbrootpath=' but some backdoor...

PerlCal &#40;CGI&#41; show files vulnerability

whizkunde security advisory: PerlCal CGI http://www.whizkunde.org | [email protected] ---------------------------------------------------------- Release date: April 27th 2001 Subject: PerlCal CGI security problem Systems affected: NIX not windows systems running PerlCal CGI script Vendor:...