پچ غیر رسمی فعلا ارایه شده !
گزارش مرکز CERT امریکا
https://us-cert.cisa.gov/ncas/current-activity/2021/06/30/printnightmare-critical-windows-print-spooler-vulnerability
گزارش مایکروسافت تغییر از CVE-2021-1675 به CVE-202134527
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
تنها راه حلی که گفته تا زمان پچ سرویس print Spool را Disable کنید حتی اگر پشت فایروال هستید و ..... حتی دیگر اگر یک وب شل از شما داشته باشن امکان Add کردن یوزر با قدرت ادمین و port forwarding و ادامه ماجرا وجود دارد ! کافیه C++ کامپایل کنند :)
مقاله کامل در مورد علت وقوع آسیب پذیری و همچنین اکسپلویت ها گذاشته البته امکان داره مایکروسافت پاک کنه از گیت هاب
https://doublepulsar.com/zero-day-for-every-supported-windows-os-version-in-the-wild-printnightmare-b3fdb82f840c
پچ unoffecial توسط 0ptach
طبق گفته خودشون باید در سایت ثبت نام کنید exe میدند ران میکنید بدون ریستارت پچ میشه! که توصیه نمیشه تا زمانی که مایکروسافت خودش زحمت بکشه پچ ارایه کنه !

https://blog.0patch.com/2021/07/free-micropatches-for-printnightmare.html

اکسپلویت در یک ماژول ارایه شده
https://github.com/calebstewart/CVE-2021-1675
روی ویندوز 11 چک کردم LPE جواب داد
خود ایمپورت کردن دسترسی ادمین میخواد ! مگه با سوشیال بچ فایل
set-executionpolicy byass
توسط ادمین زده بشه حواستون باشه که همچین کاری نکنید !

وین پان بعد از میمکتز nightmareprint به ابزار اضافه کرد
#winpwn
یک اسکریپت برای Post Exploitation و Privilege escalation می باشد که تشکیل شده از mimikatz powersploit nishang و ...
https://github.com/S3cur3Th1sSh1t/WinPwn/

#LPE #windows #RCE #0day #winpwn #postexploit #exploit

همان طور که می دونید تو دنیای امنیت اطلاع از یک آسیب پذیری جهت PATCH یا Mitigation شما را می تونه از یک فاجعه مثل باج افزار یا افشای اطلاعات نجات بده . SECMON این کمک می کنه تمامی CVE که کشف شده اند در یک جا جمع کرده قابلیت سرچ بر اساس Vendor رو نیز فراهم کرده.
SECMON: web-based tool for the automation of infosec watching and vulnerability management
Mail alerting when a new CVE is published and which concerns your product list
Mail alerting when “cyber-security” news is published: new threats, recent attacks, events, etc.
Visualize the high-security risk products present on your IT infrastructure
Download CVE Excel report by date range
Display top cybersecurity subject (Light cyber landscape)
Logs easy to integrate into a SIEM (verified on Splunk and Graylog)
View the latest CVE and latest news related to cybersecurity are published
Assign a buffer of management status of a CVE
Search all the details of a CVE
Check if there is an exploit on Github or Exploit-DB concerning a CVE
Search for vulnerabilities for a specified product
Manage your product list: search/add/delete a product, display your referenced product list
Monitor the sources used by pollers
https://github.com/Guezone/SECMON/blob/master/DOCS.md
#Secmon
#CVE
#vulnerablity
#blueteam

Seems #Kaseya VSA as a cloud-based patch management solution has become a #victim of another #SupplyChain attack (almost a year after the discovery of #SolarWinds hack) via #REvil #ransomware that targeted #MSPs with thousands of customers. #Russia
کاسیا که یک پلتفورم ابری Patch management می باشد نیز قربانی Supply chain Attack شده است بعد از گذشت یک سال از هک solarwinds یکی از بزرگترین حمله بوده است.
همچنین توسط Revil کلیه اطلاعات بیش از هزاران مشتری رمز شده است .
رد پای هکرهای روسی پشت REVIL است.

https://www.zdnet.com/article/kaseya-urges-customers-to-immediately-shut-down-vsa-servers-after-ransomware-attack/

2FA Bypass Techniques
تکنیک های بایپس احراز هویت دو مرحله ای
Credit : https://www.xmind.net/m/8Hkymg/#
#2FA
#bypasstechniques
#mind

نشت اطلاعات بیش از 1.6 میلیون رکورد مرسدس بنز از طریق بستر کلاد
https://www.cybersecurity-insiders.com/mercedes-benz-data-breach-details/
#Mercedes
#Leak
#DataBreach

Taking over Uber accounts through voicemail
https://blog.assetnote.io/2021/06/27/uber-account-takeover-voicemail/

This is a list of victim organizations that #REvil ransomware gang has posted on its leaked blog on the #DarkWeb.
A total of 273 victims they claim are posted on their darkweb leak blog site. REvil ransomware gang's Tor Network Infrastructure on Darkweb. They run 1 leak blog site and 22 data hosting sites on the DarkWeb.
لیست قربانیان Revil و لیست بلاگهای دارک وب
هکرا درخواست 70 میلیون دلار بیت کوین برای تحویل Decryptor کردند!
Credit : https://darktracer.com/

Scour - AWS Exploitation Framework
https://github.com/grines/scour
onaws is a simple tool to check if an IP/hostname belongs to the AWS IP space or not. It uses the AWS IP address ranges data published by AWS to perform the search.
https://github.com/amalmurali47/onaws
Lightspin AWS IAM Vulnerability Scanner
https://github.com/lightspin-tech/red-shadow
#AWS #Explotation #Framework

Invoke-DNSteal is a Simple & Customizable DNS Data Exfiltrator.
https://github.com/JoelGMSec/Invoke-DNSteal
Exfiltrator یا Covert channel
روش هایی جهت انتقال اطلاعات به بیرون از شبکه می باشند و برای دور زدن فایروال DLP استفاده می شوند.
اطلاعات بیشتر:
https://en.wikipedia.org/wiki/Covert_channel
https://attack.mitre.org/tactics/TA0010/
#Exfiltration #Covertchannel #DNS

Post Exploit :
mimikatz new version Workgroup and Domain now .... !
https://github.com/gentilkiwi/mimikatz/releases/tag/2.2.0-20210704
Rubeus is a C# toolset for raw Kerberos interaction and abuses.
Source :
https://github.com/GhostPack/Rubeus
Binary :
https://github.com/r3motecontrol/Ghostpack-CompiledBinaries
PS1 :
https://github.com/LuemmelSec/Pentest-Tools-Collection/tree/main/tools
Post Exploit Collection :
https://github.com/LuemmelSec/Pentest-Tools-Collection
Awesome Post Exploit include #printnightmare :
https://github.com/S3cur3Th1sSh1t/WinPwn
For Convert exe to PS1
https://github.com/cfalta/PowerShellArmoury
#postexploit #kerberos #mimikatz

Resources for DFIR Professionals Responding to the REvil Ransomware Kaseya Supply Chain Attack
#DFIR #Revil
https://github.com/cado-security/DFIR_Resources_REvil_Kaseya/

Brute Ratel v0.5.0 (Syndicate) is now available for download and provides a major update towards several features and the user interface of Brute Ratel. Commander comes with a new user interface providing a much more granular information on the metadata of the C4 features which can be seen in the figure below.
New Shellcode and DLL Loader
PowerShell Payload
Windows Remote Management (WinRM) Pivoting
Windows Management Instrumentation Queries and Pivots
LDAP Sentinel Re-Write and Raw Queries
Mimikatz
DCSync
Share Enumeration
AMSI and ETW Patching
Click Scripting and Automation
Commander
https://bruteratel.com/release/2021/07/03/Release-Syndicate/
#PostExploit #BRc4

Disabling spooler on just your DC's is not enough #PrintNightmare
https://threadreaderapp.com/thread/1411364227089117185.html

Reverse Engineers' Hex Editor

Large (1TB+) file support
Decoding of integer/floating point value types
Inline disassembly of machine code
Highlighting and annotation of ranges of bytes
Side by side comparision of selections
Lua scripting support
Virtual address mapping support
https://github.com/solemnwarning/rehex

Free
کورس مجانی زمان محدود
The OWASP top 10 demystified
https://www.udemy.com/course/the-owasp-top-10-demystified/?couponCode=81E0D38A002319EAD0B1
#bugbounty

Here it is ! End of #printnightmare ? Some links are down, but we can hope for something... in next hours?
بالاخره پچ داد !
Microsoft has released updates to protect against CVE-2021-34527. Please see:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34527
#patch
https://blog.peneter.com/printnightmare-0day/
https://blog.peneter.com/printnightmare-patched/

Sharperner - Simple Executable Generator With Encrypted Shellcode
Sharperner is a tool written in CSharp that generate .NET dropper with AES and XOR obfuscated shellcode. Generated executable can possibly bypass signature check but I cant be sure it can bypass heuristic scanning.
https://github.com/aniqfakhrul/Sharperner
#redteaming