Recently for Christmas my 4 year old daughter got an Amazon Kids tablet. So far the tablet has been great and Kids+ seems like a pretty decent value for what you get. I’m very wary of the types of content available on the internet, and as a parent it’s my duty to ensure that my…
Practical Attacks against NTLMv1
This blog is meant to serve as a guide for practical exploitation of systems that allow for the NTLMv1 authentication protocol. While NTLMv1 is hardly ever needed anymore, a surprising number of organizations still use it, perhaps unknowingly. There are however some VPN products that still currently instruct their users to downgrade NLTM authentication to…
Unauthenticated Dumping of Usernames via Cisco Unified Call Manager (CUCM)
This blog is about something I found recently regarding Cisco Unified Call Manager (CUCM). While playing around with SeeYouCM Thief, which is designed to download parse configuration files from Cisco phone systems, I noticed something interesting within a configuration file. There was an XML element in the configuration files named <secureUDSUsersAccessURL>. The value pointed to…
Exploiting LDAP Server NULL Bind
I was recently on a penetration test that was completely locked down, I was completely alone in my subnet, and almost all of my scope targets were firewalled off. After running a bunch of port scans, I was left only with a few SSH services on port 22, and one Secure LDAP server on port…
Zero day vulnerabilities in Determine Selectica Contract Lifecycle Management (SCLM)
Recently I discovered multiple high severity vulnerabilities in Selectica Contract Lifecycle Management (SCLM) version 5.4. Cross-site Scripting (XSS) There was no shortage of XSS in this app. Here’s an example from a light scan with Burp Suite: This is pretty easy to leverage for account takeover, even more so because the HTTPOnly flag was not…
Exploiting Genuitec Secure Delivery Center (SDC) < Version 5.4.7 (Local File Inclusion)
A local file inclusion vulnerability exists in Genuitec Secure Delivery Center (SDC) in versions lower than 5.4.7. This vulnerability can be exploited to gain admin access to the application. To Exploit the LFI, an attacker can insert a series of “..\”‘s into the URL to move up the directory structure. The attacker will need to…
Microsoft Word upload to Stored XSS
Anytime I find a file upload form I test it. Best case scenario is that I can upload a reverse shell in a scripting language available on the webserver. If the application is running in PHP or ASP for example, it becomes quite easy. If I can’t get a backdoor uploaded, I will attempt to…
Exploiting blind Java deserialization with Burp and Ysoserial
While performing a web application penetration test, I stumbled upon a parameter with some base64 encoded data within a POST parameter. Curious as to what it was, I send it over to Burp decoder. After two rounds of URL decoding and one round of Base64 decoding, I had what appeared to be a serialized Java…
VulnHub Walkthrough: Donkey Docker
I’m always on the lookout for VulnHub VMs that teach real pentesting skills, and are not just puzzles. I like them to be practical, and force you to learn techniques that you would use in the real world. I feel Donkey Docker is one of these challenges. As always we can begin with an nmap…
Exploiting Server Side Include Injection
Recently I was performing a penetration test and came across a Server Side Include injection bug (SSI). If you are familiar with cross-site scripting (XSS) this type of vulnerability will sound familiar. This is caused by an application taking input form the user, and supplying it in the response from the server. The mitigations are…
Exploiting an unsecured Dell Foglight server
Dell Foglight for Virtualization is an infrastructure performance monitoring tool that can also be used to manage systems as well. It comes configured with a default username and password of “foglight”. It is possible to execute code on the host itself through an integrated scripting console. By browsing to Homes -> Administration And then…
Phishing with Maldocs
There are many ways to run a phishing campaign. The most common of them all is a typical credential harvesting attack, where the attacker sends an email to the target enticing them to click a link to a spoofed website. Running these campaigns are fairly straight forward, and a couple of tools make this…
VulnHub Walkthrough: hackfest2016: Sedna
Sedna is the second vulnerable VM released by hackfest.ca this month. Much of the first steps of enumeration will be similar to that of my write up for the first VM in the series. The first thing I start with is an Nmap scan. The output is below, shortened for brevity. root@kali:~# nmap 10.0.1.22 -p-…
VulnHub Walkthrough: hackfest2016: Quaoar
A relatively new set of VulnHub CTFs came online in March 2017. This post is about the first and easiest one, named “Quaoar“. This post will be a walk-through of my exploitation of this system. The first thing I like to start off with on any box is a full TCP port scan. When you…
Compromising Synergy clients with a rogue Synergy server
Synergy is a type of mouse an keyboard sharing software. When configured, moving your mouse off the screen will allow you to control another system that is also set up with Synergy. Below is a YouTube video from Synergy on how it works: The way this works is one host acts as the Synergy…
From OSINT to Internal – Gaining Access from outside the perimeter
During an external penetration test, you may be tasked with gaining access from the internet with no knowledge of the a target environment. After hitting all known servers and web applications with various scanning tools, you have nothing. Searching open source information such as database breaches…
Control your Mac with an iPhone app – An analysis of HippoRemote
Applications that are in use on Macs often times are under less scrutiny for security compared to their Windows alternatives. When researching popular apps in use on OS X I found an app on the iPhone called HippoRemote. It appears to be quite popular, with a combined 7,558…
Categories
n00py Blog- The SOCKS We Have at Home
- Bypassing Amazon Kids+ Parental Controls
- Bypassing Okta MFA Credential Provider for Windows
- CactusCon 2023: BloodHound Unleashed
- Exploiting Resource Based Constrained Delegation (RBCD) with Pure Metasploit
- Practical Attacks against NTLMv1
- Password Spraying RapidIdentity Logon Portal
- Manipulating User Passwords Without Mimikatz
- Unauthenticated Dumping of Usernames via Cisco Unified Call Manager (CUCM)
- Adding DCSync Permissions from Linux
April 2024 M T W T F S S 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 Archives
- January 2024
- April 2023
- February 2023
- January 2023
- October 2022
- March 2022
- January 2022
- September 2021
- May 2021
- December 2020
- August 2020
- May 2020
- February 2020
- January 2020
- December 2019
- June 2019
- March 2019
- October 2018
- August 2018
- June 2018
- April 2018
- March 2018
- January 2018
- December 2017
- November 2017
- October 2017
- September 2017
- August 2017
- June 2017
- April 2017
- March 2017
- January 2017
- October 2016