If You Don’t Have 2, You Don’t Have 1

If You Don’t Have 2, You Don’t Have 1 “If you don’t have 2, you don’t have 1” is something you hear often in our engineering group. This is our team’s way of stressing the importance of persistence in data engineering. If a stream goes down, you lose it. You have to get confirmation that data is...

Apple iTunes and iCloud for Windows 0-Day Exploited in Ransomware Attacks

Watch out Windows users! The cybercriminal group behind BitPaymer and iEncrypt ransomware attacks has been found exploiting a zero-day vulnerability affecting a little-known component that comes bundled with Apple's iTunes and iCloud software for Windows to evade antivirus detection. The vulnerab...

Important: Red Hat Security Advisory: Red Hat A-MQ Broker 7.5 release and security update

Red Hat A-MQ Broker 7.5 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability fr...

Chrome 0-day exploit CVE-2019-13720 used in Operation WizardOpium

Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Google Chrome is a web browser used to access the Internet. Successful exploitation of the most severe vulnerabilities could allow an attacker to execute arbitrary co...

CVE-2019-17375

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated SEC-517...

Code injection

cPanel before 82.0.15 allows API token credentials to persist after an account has been renamed or terminated SEC-517...

CVE-2019-3688

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain...

CVE-2019-3688

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain...

Code injection

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain...

CVE-2019-3688

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain...

Persistence – New Service

Services in a Windows environment can lead to privilege escalation if these are not configured properly or can be used as a persistence method. Creating a new service requires Administrator level privileges and it is not considered the stealthier of persistence techniques. However in red team...

PT-2019-16649

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise Server 15 versions prior to 4.8-5.8.1 SUSE Linux Enterprise Server 12 versions prior to 3.5.21-26.17.1 Description The issue concerns the /usr/sbin/pinger binary packaged with squid, which had squid:root and 0750...

Microsoft Windows Silent Process Exit Persistence Exploit

This Metasploit module uploads a payload and declares that it is the debug process to launch when a specified process exits. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/post/file' require...

CVE-2019-3688: Incorrect Default Permissions

The /usr/sbin/pinger binary packaged with squid in SUSE Linux Enterprise Server 15 before and including version 4.8-5.8.1 and in SUSE Linux Enterprise Server 12 before and including 3.5.21-26.17.1 had squid:root, 0750 permissions. This allowed an attacker that compromissed the squid user to gain...

Microsoft Windows Silent Process Exit Persistence

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/post/file' require 'msf/core/exploit/exe' class MetasploitModule 'Windows Silent Process Exit Persistence', 'Description' = %q Windows allows you to se...

HTTP/2: 0-length headers lead to denial of service

A flaw was found in HTTP/2. An attacker, sending a stream of header with a 0-length header name and a 0-length header value, could cause some implementations to allocate memory for these headers and keep the allocations alive until the session dies. The can consume excess memory, potentially...

Persistence – Registry Run Keys

Getting an initial foothold inside a network during a red team operation is a time consuming task. Therefore persistence is key to a successful red team operation as will enable the team to focus on the objectives of the engagement without losing the communication with the command and control...

Windows Silent Process Exit Persistence

Windows allows you to set up a debug process when a process exits. This module uploads a payload and declares that it is the debug process to launch when a specified process exits. This module requires Metasploit: https://metasploit.com/download Current source:...

UPDATE: Covenant v0.3.2

PenTestIT RSS Feed A few weeks ago an update – Covenant v0.3.2 was released. There was a brief mention about Covenant in my post titled – List of Open Source C2 Post-Exploitation Frameworks. This updated version includes new persistence modules - PersistWMI, PersistAutorun, PersistStartup, a...

CB TAU Threat Intelligence Notification: JSWorm Ransomware Encrypts Files, Amends File Extensions

JSWorm Ransomware is a well known ransomware malware that has been seen in the wild for years and has been discovered updated to version 4. After it performs file encryption, it will append “.Generated IDContact Email.JSWRM” as file extension to the encrypted file and display the ransom note in...