VPNPivot - Explore Internal Networks

Sometime we do external penetration testing and when we compromise the remote target we would like to explore the internal network behind and getting such compromise like owning Active directory, accessing shared files, conducting MITM attacks ... etc. There are many techniques around like port...

Docker Daemon - Unprotected TCP Socket (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Docker Daemon - Unprotected TCP Socket Exploit', 'Description' = %q Utilizing Docker via unprotected tcp socket 2375/tcp, maybe 2376/tcp with tls...

Docker Daemon Unprotected TCP Socket Exploit

Utilizing Docker via unprotected tcp socket 2375/tcp, maybe 2376/tcp with tls but without tls-auth, an attacker can create a Docker container with the '/' path mounted with read/write permissions on the host server that is running the Docker container. As the Docker container executes command as...

Docker Daemon Unprotected TCP Socket

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Docker Daemon - Unprotected TCP Socket Exploit', 'Description' = %q Utilizing Docker via unprotected tcp socket 2375/tcp, maybe 2376/tcp with tls...

Docker Daemon - Unprotected TCP Socket Exploit

Utilizing Docker via unprotected tcp socket 2375/tcp, maybe 2376/tcp with tls but without tls-auth, an attacker can create a Docker container with the '/' path mounted with read/write permissions on the host server that is running the Docker container. As the Docker container executes command as...

Docker Daemon - Unprotected TCP Socket

Exploit Title: Docker Daemon - Unprotected TCP Socket Date: 20-07-2017 Exploit Author: Martin Pizala Vendor Homepage: https://www.docker.com Software Link: https://www.docker.com/get-docker Version: Since 0.4.7 2013-06-28 feature: mount host directories Tested on: Docker CE 17.06.0-ce and Docker...

Docker Daemon - Unprotected TCP Socket

Docker Daemon - Unprotected TCP Socket Exploit Title: Docker Daemon - Unprotected TCP Socket Date: 20-07-2017 Exploit Author: Martin Pizala Vendor Homepage: https://www.docker.com Software Link: https://www.docker.com/get-docker Version: Since 0.4.7 2013-06-28 feature: mount host directories Test...

[ASA-201706-5] libusbmuxd: access restriction bypass

Arch Linux Security Advisory ASA-201706-5 ========================================= Severity: Medium Date : 2017-06-05 CVE-ID : CVE-2016-5104 Package : libusbmuxd Type : access restriction bypass Remote : Yes Link : https://security.archlinux.org/AVG-7 Summary ======= The package libusbmuxd befor...

Code injection

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...

CVE-2017-5645

In Apache Log4j 2.x before 2.8.2, when using the TCP socket server or UDP socket server to receive serialized log events from another application, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code...

Exposure Of IOS Device To Attacker

libimobiledevice and libusbmuxd are vulnerable to exposure of iOS decive to attacker on the local network. The attack is possible because of a flaw in the socketcreate function in common/socket.c in libimobiledevice and libusbmuxd, leading to the bypass of intended access restrictions. Therefore,...

Disk Savvy Enterprise 9.1.14 - Login Remote Buffer Overflow

Disk Savvy Enterprise 9.1.14 - Login Remote Buffer Overflow !/usr/bin/python print "Disk Savvy Enterprise 9.1.14 Login Buffer Overflow" print "Author: Tulpa / tulpaattulpa-securitydotcom" Author website: www.tulpa-security.com Author twitter: @tulpasecurity Exploit will land you NT AUTHORITY\SYST...

SUSE SLES11 Security Update : dhcp (SUSE-SU-2016:1735-1)

This update for dhcp fixes the following issues : - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820. Note that Tenable Network Security has extract...

SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:1791-1)

This update for dhcp fixes the following issues : Security issue fixed : - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820. Non security issues fix...

SUSE SLED12 / SLES12 Security Update : dhcp (SUSE-SU-2016:1692-1)

This update for dhcp fixes the following issues : - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820. Note that Tenable Network Security has extract...

openSUSE Security Update : dhcp (openSUSE-2016-887)

This update for dhcp fixes the following issues : Security issue fixed : - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820. Non security issues fix...

SUSE-SU-2016:1692-1 Security update for dhcp

This update for dhcp fixes the following issues: - CVE-2016-2774: Fixed a denial of service attack against the DHCP server over the OMAPI TCP socket, which could be used by network adjacent attackers to make the DHCP server non-functional bsc969820...

CVE-2016-5104

The socketcreate function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket...

Design/Logic Flaw

The socketcreate function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket...

CVE-2016-5104

The socketcreate function in common/socket.c in libimobiledevice and libusbmuxd allows remote attackers to bypass intended access restrictions and communicate with services on iOS devices by connecting to an IPv4 TCP socket...