Is this you? As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.
Claim your profile
Articles by Bobby Cooke
Defining the Cobalt Strike Reflective Loader
The Challenge with Using Cobalt Strike for Advanced Red Team Exercises While next-generation AI and machine-learning components of security solutions continue to enhance behavioral-based detection capabilities, at their core many still rely on signature-based detections. Cobalt Strike being a popular red team Command and Control (C2) framework used by both threat actors and red teams since its debut, continues to be heavily signatured by security solutions.
macOS/x64 Execve Caesar Cipher String Null-Free Shellcode
# Shellcode Title: macOS/x64 - Execve Caesar Cipher String Null-Free Shellcode (286 Bytes) # Shellcode Author: Bobby Cooke (boku) @0xBoku github.com/boku7 # Date: 12/20/2022 # Tested on: macOS Monterey; 21.6.0 Darwin Kernel Version; x86_64 # Shellcode Description: # macOS 64 bit shellcode. Uses execve syscall to spawn bash. The string is ceasar cipher crypted with the increment key of 7 within the shellcode.
Beginners Guide to 0day/CVE AppSec Research
30 minute read Blog Contributors: Adeeb Shah @hyd3sec & John Jackson(@johnjhacking) A while ago I took up the challenge to get Offensive Security Web Expert (OSWE) certified. During this journey I learned many awesome things. The most important lesson learned was that with source code and a debugger, I could find vulnerabilities exponentially faster than by using traditional Blackbox/Bug-Bounty methods. This made me fall in love with hunting for 0days in web applications.
Library Management System 1.0 SQL Injection
# Exploit Title: Library Management System 1.0 - Blind Time-Based SQL Injection (Unauthenticated) # Exploit Author: Bobby Cooke (@0xBoku) & Adeeb Shah (@hyd3sec) # Date: 16/09/2021 # Vendor Homepage: https://www.sourcecodester.com/php/12469/library-management-system-using-php-mysql.html # Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/librarymanagement.zip # Vendor: breakthrough2 # Tested on: Kali Linux, Apache, Mysql # Version: v1.0 # Exploit...
Red Hat Security Advisory 2021-1546-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: .NET 5.0 on Red Hat Enterprise Linux security and bugfix update Advisory ID: RHSA-2021:1546-01 Product: .NET Core on Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:1546 Issue date: 2021-05-12 CVE Names: CVE-2021-31204 ==================================================================== 1.
Red Hat Security Advisory 2021-1540-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Service Mesh 1.1.14 security update Advisory ID: RHSA-2021:1540-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2021:1540 Issue date: 2021-05-11 CVE Names: CVE-2021-29492 CVE-2021-31920 ==================================================================== 1.
Red Hat Security Advisory 2021-1544-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Service Mesh 2.0.4 security update Advisory ID: RHSA-2021:1544-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2021:1544 Issue date: 2021-05-11 CVE Names: CVE-2021-3495 ==================================================================== 1.
Ubuntu Security Notice USN-4951-1
========================================================================= Ubuntu Security Notice USN-4951-1 May 12, 2021 flatpak vulnerability ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: A Flatpak application could access files that it would not normally be permitted to access.
Red Hat Security Advisory 2021-1538-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat OpenShift Service Mesh 2.0.4 security update Advisory ID: RHSA-2021:1538-01 Product: Red Hat OpenShift Service Mesh Advisory URL: https://access.redhat.com/errata/RHSA-2021:1538 Issue date: 2021-05-11 CVE Names: CVE-2021-29492 CVE-2021-31920 ==================================================================== 1.
Backdoor.Win32.Delf.zho Authentication Bypass / Code Execution
Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/6b9f5a0512af3ab33c26eaa4bdf94f1f.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.Delf.zho Vulnerability: Authentication Bypass RCE Description: The malware listens on TCP port 21 and TCP ports 14920 to 14923. Third-party attackers who can reach the system can logon using any username/password combination.
Ubuntu Security Notice USN-4945-1
========================================================================= Ubuntu Security Notice USN-4945-1 May 11, 2021 linux, linux-aws, linux-aws-5.4, linux-azure, linux-azure-5.4, linux-gcp, linux-gcp-5.4, linux-gke, linux-gke-5.4, linux-gkeop, linux-gkeop-5.4, linux-hwe-5.4, linux-kvm, linux-oracle, linux-oracle-5.4 vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu...
Windows Container Manager Service CmsRpcSrv_MapNamedPipeToContainer Privilege Escalation
what you don't know can hurt you
Splinterware System Scheduler Professional 5.30 Unquoted Service Path
# Exploit Title: Splinterware System Scheduler Professional 5.30 - Unquoted Service Path # Date: 2021-05-11 # Exploit Author: Andrea Intilangelo # Vendor Homepage: https://www.splinterware.com # Software Link: https://www.splinterware.com/download/ssproeval.exe # Version: 5.30 Professional # Tested on: Windows 10 Pro 20H2 x64 System Scheduler Professional 5.30 is subject to privilege escalation due to insecure file permissions, impacting where the service 'WindowsScheduler' calls its executable.
Odoo 12.0.20190101 Unquoted Service Path
# Exploit Title: Odoo 12.0.20190101 - 'nssm.exe' Unquoted Service Path # Exploit Author: 1F98D # Vendor Homepage: https://www.odoo.com/ # Software Link: https://nightly.odoo.com/12.0/nightly/windows/odoo_12.0.20190101.exe # Tested Version: 12.0.20190101 # Tested on OS: Windows # Step to discover Unquoted Service Path: C:\> icacls "C:\Program Files (x86)\Odoo 12.0\nssm" C:\Program Files (x86)\Odoo 12.0\nssm pc-1\user-1:(OI)(CI)(M) NT SERVICE\TrustedInstaller:(I)(F) NT...
Windows Container Manager Service CmsRpcSrv_CreateContainer Privilege Escalation
The Container Manager Service accepts an access token provided by the user without verification allowing an arbitrary process to be created with another user identity leading to privilege escalation.
Windows Container Manager Service CmsRpcSrv_MapVirtualDiskToContainer Privilege Escalation
The Container Manager Service does not impersonate the caller when granting access to virtual disk images leading to privilege escalation.
Chevereto 3.17.1 Cross Site Scripting
# Exploit Title: Chevereto 3.17.1 - Cross Site Scripting (Stored) # Google Dork: "powered by chevereto" # Date: 19.04.2021 # Exploit Author: Akıner Kısa # Vendor Homepage: https://chevereto.com/ # Software Link: https://chevereto.com/releases # Version: 3.17.1 # Tested on: Windows 10 / Xampp Proof of Concept: 1. Press the Upload image button and upload any image. 2. After uploading the image, press the pencil icon on the top right of the image and write "><svg/onload=alert(1)> instead of the title.
Ubuntu Security Notice USN-4944-1
========================================================================== Ubuntu Security Notice USN-4944-1 May 11, 2021 mariadb-10.1, mariadb-10.3, mariadb-10.5 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.04 - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in MariaDB.
Customer Relationship Management (CRM) System 1.0 SQL Injection
# Exploit Title: Customer Relationship Management (CRM) System 1.0 - Admin Bypass (SQLi) # Date: 11/05/2021 # Exploit Author: Richard Jones # Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html # Software Link: https://www.sourcecodester.com/download-code?nid=14794&title=Customer+Relationship+Management+%28CRM%29+System+in+PHP+with+Source+Code # Version: 1.0 # Tested on: # Tested on: windows 10 (build 19041) + xampp v3.2.4...
Hexagon G!nius Auskunftsportal SQL Injection
CVE-2021-32051 Hexagon G!nius Auskunftsportal before 5.0.0.0 allows SQL injection via the GiPWorkflow/Service/DownloadPublicFile id parameter.
MikroTik RouterOS Memory Corruption
Advisory: four vulnerabilities found in MikroTik's RouterOS Details ======= Product: MikroTik's RouterOS Vendor URL: https://mikrotik.com/ Vendor Status: only CVE-2020-20227 is fixed CVE: CVE-2020-20220, CVE-2020-20227, CVE-2020-20245, CVE-2020-20246 Credit: Qian Chen(@cq674350529) of Qihoo 360 Nirvan Team Product Description ================== RouterOS is the operating system used on the MikroTik's devices, such as switch, router and access point.
Red Hat Security Advisory 2021-1531-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: kernel security and bug fix update Advisory ID: RHSA-2021:1531-01 Product: Red Hat Enterprise Linux Advisory URL: https://access.redhat.com/errata/RHSA-2021:1531 Issue date: 2021-05-11 CVE Names: CVE-2019-19532 CVE-2020-25211 CVE-2020-25705 CVE-2020-28374 CVE-2021-27363 CVE-2021-27364 CVE-2021-27365...
Ubuntu Security Notice USN-4943-1
========================================================================= Ubuntu Security Notice USN-4943-1 May 11, 2021 libxstream-java vulnerabilities ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.04 - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in XStream library.
TOR Virtual Network Tunneling Tool 0.4.5.8
Tor is a network of virtual tunnels that allows people and groups to improve their privacy and security on the Internet. It also enables software developers to create new communication tools with built-in privacy features. It provides the foundation for a range of applications that allow organizations and individuals to share information over public networks without compromising their privacy. Individuals can use it to keep remote Websites from tracking them and their family members.
Mozilla Windows Maintenance Service Weak DACL
what you don't know can hurt you
Backdoor.Win32.Antilam.13.a Code Execution
Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/1ef711b34cc278449f1997e4ed06334a.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.Antilam.13.a Vulnerability: Unauthenticated Remote Command Execution Description: The malware drops an executable named "scandisk.exe" that listens on TCP ports 47891 and 29559. Third party attackers who can reach infected systems can execute commands made available by the backdoor.
Human Resource Information System 0.1 Remote Code Execution
# Exploit Title: Human Resource Information System 0.1 - Remote Code Execution (Unauthenticated) # Date: 04-05-2021 # Exploit Author: Reza Afsahi # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/14714/human-resource-information-using-phpmysqliobject-orientedcomplete-free-sourcecode.html # Software Download: https://www.sourcecodester.com/download-code?nid=14714&title=Human+Resource+Information+System+Using+PHP+with+Source+Code # Version:...
Gentoo Linux Security Advisory 202105-01
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 202105-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Exim: Multiple vulnerabilities Date: May 04, 2021 Bugs: #786945 ID: 202105-01 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======== Multiple...
Ubuntu Security Notice USN-4935-1
========================================================================== Ubuntu Security Notice USN-4935-1 May 04, 2021 nvidia-graphics-drivers-390, nvidia-graphics-drivers-418-server, nvidia-graphics-drivers-450, nvidia-graphics-drivers-450-server, nvidia-graphics-drivers-460, nvidia-graphics-drivers-460-server vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.04 -...
Red Hat Security Advisory 2021-1509-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-eclipse-jetty security update Advisory ID: RHSA-2021:1509-01 Product: Red Hat Developer Tools Advisory URL: https://access.redhat.com/errata/RHSA-2021:1509 Issue date: 2021-05-05 CVE Names: CVE-2021-28163 CVE-2021-28164 CVE-2021-28165 ==================================================================== 1.
Microweber CMS 1.1.20 Remote Code Execution
# Exploit Title: Microweber CMS 1.1.20 - Remote Code Execution (Authenticated) # Date: 2020-10-31 # Exploit Author: sl1nki # Vendor Homepage: https://microweber.org/ # Software Link: https://github.com/microweber/microweber/tree/1.1.20 # Version: <=1.1.20 # Tested on: Ubuntu 18.04 # CVE : CVE-2020-28337 # # Example usage with default phpinfo() payload: # ./microweber_rce.py \ # --hostname "http://microwebertest.com" \ # --username "admin" \ # --password "password123" # # # Example usage with...
Ubuntu Security Notice USN-4918-3
========================================================================= Ubuntu Security Notice USN-4918-3 May 03, 2021 clamav regression ========================================================================= A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.04 - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS - Ubuntu 16.04 ESM - Ubuntu 14.04 ESM Summary: USN-4918-1 introduced a regression in ClamAV that could cause it to fail to scan.
TestSSL 3.0.5 ≈ Packet Storm
testssl.sh is a free command line tool which checks a server's service on any port for the support of TLS/SSL ciphers, protocols as well as recent cryptographic flaws, and much more. It is written in (pure) bash, makes only use of standard Unix utilities, openssl and last but not least bash sockets.
TFTP Broadband 4.3.0.1465 Unquoted Service Path
# Exploit Title: TFTP Broadband 4.3.0.1465 - 'tftpt.exe' Unquoted Service Path # Discovery by: Erick Galindo # Discovery Date: 2020-05-07 # Vendor Homepage: https://www.weird-solutions.com # Software : https://www.weird-solutions.com/download/products/tftpbbv4_retail_x64.exe # Tested Version: 4.3.0.1465 # Vulnerability Type: Unquoted Service Path # Tested on OS: Windows 10 Pro x64 es # Step to discover Unquoted Service Path: C:\>wmic service get name, displayname, pathname, startmode |...
Red Hat Security Advisory 2021-1511-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: AMQ Clients 2.9.1 release and security update Advisory ID: RHSA-2021:1511-01 Product: Red Hat AMQ Clients Advisory URL: https://access.redhat.com/errata/RHSA-2021:1511 Issue date: 2021-05-06 CVE Names: CVE-2021-21290 CVE-2021-21295 CVE-2021-21409 ==================================================================== 1.
Voting System 1.0 SQL Injection
# Exploit Title: Voting System 1.0 - Authentication Bypass (SQLI) # Date: 06/05/2021 # Exploit Author: secure77 # Vendor Homepage: https://www.sourcecodester.com/php/12306/voting-system-using-php.html # Software Link: https://www.sourcecodester.com/download-code?nid=12306&title=Voting+System+using+PHP%2FMySQLi+with+Source+Code # Version: 1.0 # Tested on: Linux Debian 5.10.28-1kali1 (2021-04-12) x86_64 // PHP Version 7.4.15 & Built-in HTTP server // mysql Ver 15.1 Distrib 10.5.9-MariaDB You...
Linux/x86 setreuid(0) / execve("/bin/sh") Shellcode
/* Author: Artur [ajes] Szymczak (2021) Function: Linux x86 shellcode, setreuid to 0 and then execute /bin/sh Size: 29 bytes Testing: $ gcc -fno-stack-protector -z execstack shellcode_tester.c -o shellcode shellcode_tester.c: In function ‘main’: shellcode_tester.c:25:2: warning: incompatible implicit declaration of built-in function ‘printf’ [enabled by default] shellcode_tester.c:25:24: warning: incompatible implicit declaration of built-in function ‘strlen’ [enabled by default] $ sudo chown...
Android Memory Disclosure / Out-Of-Bounds Write / Double-Free
Android suffers from memory disclosure, out-of-bounds write, and double-free vulnerabilities in NFC's Felica tag handling.
Sandboxie 5.49.7 Denial Of Service
# Exploit Title: Sandboxie 5.49.7 - Denial of Service (PoC) # Date: 06/05/2021 # Author: Erick Galindo # Vendor Homepage: https://sandboxie-plus.com/ # Software https://github.com/sandboxie-plus/Sandboxie/releases/download/0.7.4/Sandboxie-Classic-x64-v5.49.7.exe # Version: 5.49.7 # Tested on: Windows 10 Pro x64 es # Proof of Concept: #1.- Copy printed "AAAAA..." string to clipboard! #2.- Sandboxie Control->Sandbox->Set Container Folder #3.- Paste the buffer in the input then press ok buffer =...
Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation
Epic Games Easy Anti-Cheat 4.0 Local Privilege Escalation Vendor: Epic Games, Inc. Product web page: https://www.epicgames.com https://www.easy.ac Affected version: 4.0.0.0 Summary: Easy Anti-Cheat is the industry-leading anti–cheat service, countering hacking and cheating in multiplayer PC games through the use of hybrid anti–cheat mechanisms.
Apple Security Advisory 2021-05-03-1
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 APPLE-SA-2021-05-03-1 iOS 14.5.1 and iPadOS 14.5.1 iOS 14.5.1 and iPadOS 14.5.1 addresses the following issues. Information about the security content is also available at https://support.apple.com/HT212336.
Ubuntu Security Notice USN-4934-1
========================================================================== Ubuntu Security Notice USN-4934-1 May 04, 2021 exim4 vulnerabilities ========================================================================== A security issue affects these releases of Ubuntu and its derivatives: - Ubuntu 21.04 - Ubuntu 20.10 - Ubuntu 20.04 LTS - Ubuntu 18.04 LTS Summary: Several security issues were fixed in Exim.
Botan C++ Crypto Algorithms Library 2.18.1
Botan is a C++ library of cryptographic algorithms, including AES, DES, SHA-1, RSA, DSA, Diffie-Hellman, and many others. It also supports X.509 certificates and CRLs, and PKCS #10 certificate requests, and has a high level filter/pipe message processing system. The library is easily portable to most systems and compilers, and includes a substantial tutorial and API reference. This is the current stable release.
macOS Gatekeeper Check Bypass
## # This module requires Metasploit: https://metasploit.com/download # Current source: https://github.com/rapid7/metasploit-framework ## class MetasploitModule < Msf::Exploit::Remote Rank = ManualRanking include Msf::Exploit::EXE include Msf::Exploit::Remote::HttpServer def initialize(info = {}) super( update_info( info, 'Name' => 'macOS Gatekeeper check bypass', 'Description' => %q{ This module serves an OSX app (as a zip) that contains no Info.plist, which bypasses gatekeeper in macOS <...
Red Hat Security Advisory 2021-1518-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ===================================================================== Red Hat Security Advisory Synopsis: Important: Red Hat Ceph Storage 3.3 Security and Bug Fix Update Advisory ID: RHSA-2021:1518-01 Product: Red Hat Ceph Storage Advisory URL: https://access.redhat.com/errata/RHSA-2021:1518 Issue date: 2021-05-06 CVE Names: CVE-2020-12059 CVE-2020-13379 CVE-2020-27781 CVE-2021-3139...
Red Hat Security Advisory 2021-1515-01
-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ==================================================================== Red Hat Security Advisory Synopsis: Important: Openshift Logging Bug Fix Release (5.0.3) Advisory ID: RHSA-2021:1515-01 Product: Red Hat OpenShift Enterprise Advisory URL: https://access.redhat.com/errata/RHSA-2021:1515 Issue date: 2021-05-06 CVE Names: CVE-2018-14718 CVE-2018-14719 CVE-2018-14720 CVE-2018-14721 CVE-2018-19360 CVE-2018-19361 CVE-2018-19362 CVE-2019-14379...
Backdoor.Win32.MotivFTP.12 Authentication Bypass / Code Execution
Discovery / credits: Malvuln - malvuln.com (c) 2021 Original source: https://malvuln.com/advisory/88785a093b8fa00893214dd220ac255d.txt Contact: malvuln13@gmail.com Media: twitter.com/malvuln Threat: Backdoor.Win32.MotivFTP.12 Vulnerability: Authentication Bypass RCE Description: The malware listens on TCP port 21. Third-party attackers who can reach the system can logon using any username/password combination.
PHP Timeclock 1.04 SQL Injection
# Exploit Title: PHP Timeclock 1.04 - Time and Boolean Based Blind SQL Injection # Date: 03.05.2021 # Exploit Author: Tyler Butler # Vendor Homepage: http://timeclock.sourceforge.net # Software Link: https://sourceforge.net/projects/timeclock/files/PHP%20Timeclock/PHP%20Timeclock%201.04/ # Version: 1.04 # Tested on: PHP 4.4.9/5.3.3 Apache 2.2 MySql 4.1.22/5 Description: PHP Timeclock is vulnerable to both Boolean and Time Based SQL Injection on login.php via the login_userid parameter.
AWS CloudShell Terminal Escape Injection / Remote Code Execution
Terminal escape injection in AWS CloudShell The javascript terminal emulator used by AWS CloudShell handles certain terminal escape codes incorrectly. This can lead to remote code execution if attacker controlled data is displayed in a CloudShell instance.
Human Resource Information System 0.1 Cross Site Scripting
# Exploit Title: Human Resource Information System 0.1 - 'First Name' Persistent Cross-Site Scripting (Authenticated) # Date: 04-05-2021 # Exploit Author: Reza Afsahi # Vendor Homepage: https://www.sourcecodester.com # Software Link: https://www.sourcecodester.com/php/14714/human-resource-information-using-phpmysqliobject-orientedcomplete-free-sourcecode.html # Software Download:...
Show More
loading
Actions
Is this you?
As a journalist, you can create a free Muck Rack account to customize your profile, list your contact preferences, and upload a portfolio of your best work.Get in touch with Bobby
Contact Bobby, search articles and posts on X, monitor coverage, and track replies from one place.
Learn more about Muck Rack