Lem E. Tweakit superswan

WestFAX Porting Portal – IDOR & Sensitive Document Access

This issue was responsibly disclosed to the vendor, acknowledged, and subsequently remediated

Summary

A set of access control vulnerabilities was identified in the WestFAX porting portal allowing unauthorized access to sensitive customer porting data and uploaded documents. The issues include:

Insecure Direct Object Reference (IDOR) in port request viewing
IDOR in port request modification endpoint

Opencode Desktop Ralph Wiggum hack

Python Persistent Shell + Connection Manager (Go)

Reverse Shell

Python reverse shell that reconnects to server (ncat/socat/connection manager/etc)

Connection Manager

A neat little server written in Go. It can handle multiple sessions from the client.py script or any other valid reverse shell (not tested).

Requires paramiko, paramiko-expect

** Fabric doesn't work on SonicWall as it doesn't support exec_command() **

Get ASN Blocklist from

https://www.enjen.net/asn-blocklist/index.php?asn=22363&type=iplist add &api=1 to URL for text file

Reddit thread on creating address objects from cli

start by SSH'ing to the device and type

Windows Defender Configuration/Hardening

https://docs.microsoft.com/en-us/powershell/module/defender/set-mppreference?view=windowsserver2022-ps&viewFallbackFrom=win10-ps

Get Current Config

Get-MpPreference

Configuring

Signature update

Set-MpPreference -SignatureUpdateInterval 1

Ansible adhoc commands (One Liners)

Make a note of below assumptions for one liners explained on this page are as below,

User root - the superhero, superuser User normaluser - user that has root sudo privilege and all ansible required connectivity in place User user1 - user that has root sudo privilege

##Understanding basic differences in commands using various users with various rights

To run command on all servers to check reach ability from ansible point of view with 25 parallel forks with current user (i.e. root or normaluser)

Migrating from Ubuntu on WSL to ArchLinux on WSL2

Upgrading to WSL 2

Download WSL2 Kernel
run wsl --set-default-version 2 in windows command line, so that all future WSL machine will use WSL2.

	{
	"background": "#000000",
	"black": "#000000",
	"blue": "#557755",
	"brightBlack": "#223322",
	"brightBlue": "#77DD88",
	"brightCyan": "#88EE99",
	"brightGreen": "#77DD88",
	"brightPurple": "#55AF66",
	"brightRed": "#55AF66",

	<html>
	<head>
	<style>
	body {
	overflow-y: hidden; /* Hide vertical scrollbar */
	overflow-x: hidden; /* Hide horizontal scrollbar */
	}
	#dvd {
	position: absolute;
	transform-origin: center center;

	// SPDX-License-Identifier: MIT
	pragma solidity ^0.8.4;

	import "@openzeppelin/contracts/token/ERC721/ERC721.sol";
	import "@openzeppelin/contracts/token/ERC721/extensions/ERC721Enumerable.sol";
	import "@openzeppelin/contracts/token/ERC721/extensions/ERC721URIStorage.sol";
	import "@openzeppelin/contracts/access/Ownable.sol";
	import "@openzeppelin/contracts/utils/Counters.sol";

	contract TREEMINTTEST is ERC721, ERC721URIStorage, ERC721URIStorage, Ownable {