Metasploit Weekly Wrap-Up 01/19/24

Post Syndicated from Brendan Watters original https://blog.rapid7.com/2024/01/19/metasploit-weekly-wrap-up-01-19-24/

Unicode your way to a php payload and three modules to add to your playbook for Ansible

Metasploit Weekly Wrap-Up 01/19/24

Our own jheysel-r7 added an exploit leveraging the fascinating tool of php filter chaining to prepend a payload using encoding conversion characters and h00die et. al. have come through and added 3 new Ansible post modules to gather configuration information, read files, and deploy payloads. While none offer instantaneous answers across the universe, they will certainly help in red team exercises.

New module content (4)

Ansible Agent Payload Deployer (1 of 3 Ansible post modules)

Authors: h00die and n0tty
Type: Exploit
Pull request: #18627 contributed by h00die
Path: linux/local/ansible_node_deployer

Ansible Config Gather (2 of 3 Ansible post modules)

Author: h00die
Type: Post
Pull request: #18627 contributed by h00die
Path: linux/gather/ansible

Ansible Playbook Error Message File Reader (3 of 3 Ansible post modules)

Authors: h00die and rioasmara
Type: Post
Pull request: #18627 contributed by h00die
Path: linux/gather/ansible_playbook_error_message_file_reader

Description: This adds 3 post-exploitation modules for Ansible. The first one gathers information and configuration. The second exploits an arbitrary file read that enables an attacker to read the first line of a file (typically /etc/shadow), when the compromised account is configured with password-less sudo permissions. The last one is an exploit that can deploy a payload to all the nodes in the network.

WordPress Backup Migration Plugin PHP Filter Chain RCE

Authors: Nex Team, Valentin Lobstein, and jheysel-r7
Type: Exploit
Pull request: #18633 contributed by jheysel-r7
Path: multi/http/wp_backup_migration_php_filter

Description: This adds an exploit module that leverages an unauthenticated RCE in the WordPress plugin Backup Migration versions prior to 1.3.7. This vulnerability is identified as CVE-2023-6553. This also adds a library that implements a technique called PHP Filter Chaining which allows an attacker to prepend bytes to a string by continuously chaining character encoding conversion.

Enhancements and features (2)

  • #18596 from dwelch-r7 – Updates multiple SMB modules to work with the new upcoming SMB session type support. This beta functionality is currently behind a feature flag, and can be enabled with features set smb_session_type true.
  • #18682 from adfoster-r7 – Add tests for Msf::Exploit::Local module types to ensure that sysinfo will not break again in the future.

Bugs fixed (2)

  • #18655 from adfoster-r7 – Ensures the module will automatically be used when the hierarchical search functionality is enabled and only one module result is found.
  • #18710 from adfoster-r7 – Fixes an uninitialized constant Msf::Simple::Exploit::ExploitDriver exception that could sometimes occur when running Metasploit framework’s payload modules.

Documentation added (1)

  • #18702 from Sh3llSp4wn – Updates the documentation for the private and public fields in lib/metasploit/framework/credential.rb to be correct.

You can always find more documentation on our docsite at docs.metasploit.com.

Missing rn-* label on Github (1)

PLEASE ADD RN-TAGS TO THESE PULL REQUESTS BEFORE RELEASING THE WRAP UP, AND RERUN THE WRAPUP SCRIPT

  • #18398 from errorxyz – Fixes deprecation warnings when running the auxiliary/admin/scada/modicon_password_recovery, auxiliary/scanner/lotus/lotus_domino_hashes, auxiliary/sniffer/psnuffle, exploits/unix/webapp/vbulletin_vote_sqli_exec exploit modules with a database connected.

Get it

As always, you can update to the latest Metasploit Framework with msfupdate
and you can get more details on the changes since the last blog post from
GitHub:

If you are a git user, you can clone the Metasploit Framework repo (master branch) for the latest.
To install fresh without using git, you can use the open-source-only Nightly Installers or the
commercial edition Metasploit Pro

SourceHut outage post-mortem

Post Syndicated from daroc original https://lwn.net/Articles/958794/

SourceHut has published

a post-mortem of its
outage earlier this month.
The post-mortem covers the causes of the outage and what steps SourceHut
took to mitigate it, ending by saying:

As unfortunate as these events were, we welcome opportunities to stress-test
our emergency procedures; we found them to be compatible with our objectives
for the alpha and we learned a lot of ways to improve our reliability
further for the future. We are going to continue working on our
post-incident tasks, building up our infrastructure’s resilience,
reliability, and scalability as planned. Once we address the high-priority
tasks, though, our first order of business in the immediate future will be
to get some rest.

[$] Jujutsu: a new, Git-compatible version control system

Post Syndicated from daroc original https://lwn.net/Articles/958468/

Jujutsu is a Git-compatible
distributed version control system originally started as a hobby project by
Martin von Zweigbergk in 2019. It is intended to be a simpler, more performant
Git replacement. Jujutsu boasts a radically simplified user interface and integrates
ideas from patch-based version control systems for a novel take on resolving
merge conflicts. It is written in Rust and available under an Apache 2.0 license.

Zelle Is Using My Name and Voice without My Consent

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2024/01/zelle-is-using-my-name-and-voice-without-my-consent.html

Okay, so this is weird. Zelle has been using my name, and my voice, in audio podcast ads—without my permission. At least, I think it is without my permission. It’s possible that I gave some sort of blanket permission when speaking at an event. It’s not likely, but it is possible.

I wrote to Zelle about it. Or, at least, I wrote to a company called Early Warning that owns Zelle about it. They asked me where the ads appeared. This seems odd to me. Podcast distribution networks drop ads in podcasts depending on the listener—like personalized ads on webpages—so the actual podcast doesn’t matter. And shouldn’t they know their own ads? Annoyingly, it seems time to get attorneys involved.

What would help is to have a copy of the actual ad. (Or ads, I’m assuming there’s only one.) So, has anyone else heard me in a Zelle ad? Does anyone happen to have an audio recording? Please email me.

And I will update this post if I learn anything more. Or if there is some actual legal action. (And if this post ever disappears, you’ll know I was required to take it down for some reason.)

Latest PCI DSS v4.0 compliance package available in AWS Artifact

Post Syndicated from Nivetha Chandran original https://aws.amazon.com/blogs/security/latest-pci-dss-v4-0-compliance-package-available-in-aws-artifact/

Amazon Web Services is pleased to announce that eight additional AWS services have been added to the scope of our Payment Card Industry Data Security Standard (PCI DSS) v4.0 certification:

Coalfire, a third-party Qualified Security Assessor (QSA), evaluated AWS. For the full list of services in scope, see AWS Services in Scope by Compliance Program.

Customers can access the PCI DSS package in AWS Artifact. The package includes the following:

  • Attestation of Compliance (AoC) — shows that AWS has been successfully validated against the PCI DSS standard.
  • AWS Responsibility Summary – provides information to help you effectively manage a PCI cardholder environment on AWS and better understand your responsibility regarding operating controls to effectively develop and operate a secure environment on AWS.

To learn more about our PCI program and other compliance and security programs, see the AWS Compliance Programs page. As always, we value your feedback and questions; reach out to the AWS Compliance team through the Contact Us page.

Want more AWS Security news? Follow us on Twitter.

Author

Nivetha Chandran

Nivetha is a Security Assurance Manager at Amazon Web Services. She leads multiple security and compliance initiatives within AWS. Nivetha has over ten years of experience in security assurance and holds a Master’s degree in Information Management from the University of Washington.

Dave Mills RIP

Post Syndicated from jake original https://lwn.net/Articles/958781/

Internet pioneer and Network Time Protocol (NTP) inventor Dave Mills has died, as reported by Vint Cerf:

His daughter, Leigh, just sent me the news that Dave passed away peacefully
on January 17, 2024. He was such an iconic element of the early Internet.
Network Time Protocol, the Fuzzball routers of the early NSFNET, INARG
taskforce lead, COMSAT Labs and University of Delaware and so much more.

More information about Mills can be found on his Wikipedia page.

Critical CVEs in Outdated Versions of Atlassian Confluence and VMware vCenter Server

Post Syndicated from Rapid7 original https://blog.rapid7.com/2024/01/19/etr-critical-cves-in-outdated-versions-of-atlassian-confluence-and-vmware-vcenter-server/

Critical CVEs in Outdated Versions of Atlassian Confluence and VMware vCenter Server

Rapid7 is highlighting two critical vulnerabilities in outdated versions of widely deployed software this week. Atlassian disclosed CVE-2023-22527, a template injection vulnerability in Confluence Server with a maxed-out CVSS score of 10, while VMware pushed a fresh update to its October 2023 vCenter Server advisory on CVE-2023-34048 to note that the vulnerability has now been exploited in the wild.

VMware and Atlassian technologies are mainstays in many corporate environments, and they have historically been targeted by a wide range of adversaries, including in large-scale ransomware campaigns. Rapid7 urges customers to ensure that they are using supported, fixed versions of vCenter Server and Confluence Server in their environments, and that, wherever possible, they are adhering to a high-urgency patching schedule for these products.

VMware vCenter Server CVE-2023-34048

CVE-2023-34048 is a critical out-of-bounds write vulnerability that affects VMware vCenter Server and VMware Cloud Foundation. The vulnerability arises from an out-of-bounds write flaw in vCenter’s implementation of DCERPC, which, if exploited successfully, could lead to remote code execution. It was originally disclosed in October 2023 alongside fixed versions, including for several end-of-life products. Earlier this week, VMware updated their advisory to note that exploitation of CVE-2023-34048 has been observed in the wild. Fixed versions of vCenter Server that remediate CVE-2023-34048 have been available since October 2023.

Per VMware’s advisory, all versions of vCenter Server are vulnerable to CVE-2023-34048 except the following fixed versions (or later):

Customers should update on an emergency basis if they have not done so before now. Patches are also available for the following end-of-life versions of vCenter Server: 6.7U3, 6.5U3, and VCF 3.x. VMware has information on applying individual product updates to Cloud Foundation environments here.

For more information, see VMware’s original advisory and FAQ. A list of vCenter Server versions and builds is available here.

Atlassian Confluence Server and Data Center CVE-2023-22527

CVE-2023-22527 is a critical template injection vulnerability in Atlassian Confluence that allows for unauthenticated remote code execution when exploited successfully in vulnerable target environments. As of January 19, 2024, we are not aware of exploitation in the wild targeting CVE-2023-22527.

Affected versions from Atlassian’s advisory:

  • 8.0.x
  • 8.1.x
  • 8.2.x
  • 8.3.x
  • 8.4.x
  • 8.5.0-8.5.3

The most recent supported versions of Confluence Server (as of January 16, 2024) are not affected. Fixed versions for Confluence Server are 8.5.4 and 8.5.5, both of which are on long-term support. For Confluence Data Center, fixed versions are 8.6.0, 8.7.1, and 8.7.2, all of which apply to Confluence Data Center only.

We strongly recommend that Atlassian Confluence customers update to the latest version in their product’s version stream. Customers should refer to the vendor advisory as the source of truth on affected products and fixed versions.

Rapid7 customers

Vulnerability checks for CVE-2023-34048 have been available to InsightVM and Nexpose customers since October 27, 2023. Vulnerability checks for CVE-2023-22527 have been available to InsightVM and Nexpose customers since January 17, 2024.

Clarifying Misunderstandings of Slowroll (openSUSE News)

Post Syndicated from corbet original https://lwn.net/Articles/958759/

The openSUSE News site has put up a
brief article on how Slowroll fits into the spectrum of openSUSE
distributions.

The idea behind Slowroll is to offer a distribution that improves
stability without losing access to new features in the base
packages such as the kernel, desktop environments and
packaging. These slower update cycles allow for more extensive
testing and validation of packages before their inclusion. Think of
Slowroll as more of a skip than a Leap.

Security updates for Friday

Post Syndicated from jake original https://lwn.net/Articles/958760/

Security updates have been issued by Fedora (chromium, golang-github-facebook-time, podman, and xorg-x11-server-Xwayland), Oracle (.NET 6.0, java-1.8.0-openjdk, java-11-openjdk, and python3.11-cryptography), Red Hat (java-11-openjdk, python-requests, and python-urllib3), SUSE (chromium, kernel, libcryptopp, libuev, perl-Spreadsheet-ParseExcel, suse-module-tools, and xwayland), and Ubuntu (filezilla and xerces-c).

The collective thoughts of the interwebz