Category: Shell

Shell

Operational information regarding the Spring4Shell vulnerability in the Spring Core Framework

Operational information regarding the Spring4Shell vulnerability (CVE-2022-22965) in the Spring Core Framework. Repository contents README.md: contains general information and detection and mitigation measures software/README.md: contains a list of known vulnerable and not vulnerable software. services/README.md: contains a list of known vulnerable and not vulnerable services. NCSC-NL has published a HIGH/HIGH advisory for the Spring4shell vulnerability. Normally we would update a HIGH/HIGH advisory for vulnerable software packages, however due to the expected number of updates we have created a list of […]

Read more
Shell

Webmin CVE-2022-0824 Post-Auth Reverse Shell

Vulnerability Description Webmin 1.984 and below – File Manager privilege exploit (CVE-2022-0824 and CVE-2022-0829)Less privileged Webmin users who do not have any File Manager module restrictions configured can access files with root privileges, if using the default Authentic theme. All systems with additional untrusted Webmin users should upgrade immediately. Note that Virtualmin systems are not effected by this bug, due to the way domain owner Webmin users are configured.Source: https://www.webmin.com/security.html Exploit Description This exploit takes advantage of the post-auth Improper […]

Read more
Shell

Detector for Log4Shell exploitation attempts

Detector for Log4Shell exploitation attempts Idea The problem with the log4j CVE-2021-44228 exploitation is that the string can be heavily obfuscated in many different ways. It is impossible to cover all possible forms with a reasonable regular expression. The idea behind this detector is that the respective characters have to appear in a log line in a certain order to match. Split up into a list it would look like this: [‘$’, ‘{‘, ‘j’, ‘n’, ‘d’, ‘i’, ‘:’, ‘l’, ‘d’, […]

Read more