Open Sourcing Pulsar, the Runtime Security Observability Tool for IoT, Powered by eBPF

blog.exein.io/pulsar

Tool website: pulsar.sh
GitHub: github.com/exein-io/pulsar

Reading an arbitrary ThinkPHP 5.X file

Nuclei Template :https://github.com/momika233/TP5_Arbitrary_file_read/blob/main/TP5_Arbitrary_file_read.yaml


PoCs: {{BaseURL}}/?s=index/think\\Error/appError&errno=1&errstr=1&errline=1&errfile=../../../etc/passwd


Dork for Shodan: "X-Powered By: ThinkPHP"

A standalone noscript that adds information about unpatched vulnerabilities to BloodHound based on parsed vulnerability scanners reports. Security teams can then use this data to define starting points for paths (e.g. paths to Domain Admins from vulnerable hosts) or write queries that consider lateral movement to vulnerable hosts.

Supported Scanners

Tenable Nessus

Qualys

Greenbone OpenVAS

Nmap Vuln NSE Script


https://github.com/zeronetworks/BloodHound-Tools/tree/main/VulnerabilitiesDataImport

Stealer in just 3 lines with sending to telegram
https://github.com/FallenAstaroth/stink

Apache Spark Shell Command Injection CVE-2022-33891

The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. An authentication filter checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilter can allow someone to perform impersonation by providing an arbitrary user name. A malicious user might then be able to reach a permission check function that will ultimately build a Unix shell command based on their input, and execute it. This will result in arbitrary shell command execution as the user Spark is currently running as. This affects Apache Spark versions 3.0.3 and earlier, versions 3.1.1 to 3.1.2, and versions 3.2.0 to 3.2.1.

https://github.com/AmoloHT/CVE-2022-33891

#Apache #spark

CVE-2022-26712: The POC for SIP-Bypass
https://jhftss.github.io/CVE-2022-26712-The-POC-For-SIP-Bypass-Is-Even-Tweetable/

wget-root :

If the wget binary has the SUID bit set, It does not drop the elevated privileges and may be abused to access the file system. It may be used to do privileged writes or write files outside a restricted file system. This noscript automates the rewriting of the passwd file of the victim's machine.

https://github.com/CopernicusPY/wget-root

Apache Tomcat Vulnerability Scanner:
https://github.com/p0dalirius/ApacheTomcatScanner

ATLAS - Malware Analysis Denoscription
https://github.com/MALWARE-ATLAS/ATLAS

Linux kernel through 5.18.9 LPE

POC:

https://github.com/veritas501/CVE-2022-34918

#Linux #Kernel #LPE

Powershell noscript that can be used by Blue Teams, Incident Responders and System Administrators to hunt persistences implanted in Windows machines.
https://github.com/last-byte/PersistenceSniper/

Certipy 4.0: ESC9 & ESC10, BloodHound GUI, New Authentication and Request Methods — and more!
https://research.ifcr.dk/certipy-4-0-esc9-esc10-bloodhound-gui-new-authentication-and-request-methods-and-more-7237d88061f7
https://github.com/ly4k/Certipy

This noscript allows to find MySQLi vulnerabilities Based on Errors with nuclei
https://github.com/HernanRodriguez1/ScanMySQLiErrorBased-Nuclei

redteam infra

https://github.com/chipmanfu/RGI-redteam-noscripts

PersistAssist is a fully modular persistence framework written in C#. All persistence techniques contain a cleanup method which will server to remove the persistence aside from the persistence code. This is a WIP so there are many empty classes, the main object of this project initially was to build out a fully modular framework meant to make adding new features as simple as inheriting a class and adding the code.
https://github.com/FortyNorthSecurity/PersistAssist

GoAVBypass
https://github.com/TideSec/GoBypassAV

JMX enumeration and attacking tool
https://github.com/qtc-de/beanshooter

winapi search:

https://dennisbabkin.com/winapisearch/

A Python noscript to exploit CVE-2022-36446 Software Package Updates RCE (Authenticated) on Webmin < 1.997
for mitigation Update to Webmin >= 1.997

https://github.com/p0dalirius/CVE-2022-36446-Webmin-Software-Package-Updates-RCE
#webmin #rce

An automatic unpacker and logger for DotNet Framework targeting files! This tool has been unveiled at Black Hat USA 2022.

https://github.com/advanced-threat-research/DotDumper

#unpacker #DotNet