Pinned Tweet
On a recent assessment I found a Pentaho webapp using default creds, which sent me down a rabbit hole.
I return with a tool decrypt 'Encrypted' passwords from .KTR files and a method to recover non-default encryption keys.
github.com/stumblebot/ktr_pa…
stumblebot retweeted
A few hours left - leaving it open until the morning on West Coast. Only 3 winners 🤭. Congrats @malware_owl and @_dru1d !!
Player weaponized_autism (@droogie1xp) has won the Phrack CTF!
CTF is 2 binary exploitation challenges containing realistic vulns across 2 different targets. It began on Aug 7 and remained unsolved until now. So 1337 😎
Keep playing - all who finish will get a special prize!
ALT Player weaponized_autism won the Phrack CTF
stumblebot retweeted
hashcat v7.0.0 released!
After nearly 3 years of development and over 900,000 lines of code changed, this is easily the largest release we have ever had.
Detailed writeup is available here: hashcat.net/forum/thread-133…
stumblebot retweeted
Had some fun with PDQ deploy/inventory credential decryption and wrote about it here: unsigned-sh0rt.net/posts/pdq… thanks to @_dru1d for write a BOF out of the POC
tl;dr get admin on PDQ box, decrypt privileged creds
stumblebot retweeted
tables.blurbdust.pw/netntlmv…
It might be a bit rocky for the next couple days as I work out a couple issues with magnet links and the self-hosted tracker but its up and working
This was a fun bit of research and it got me a few privileged database user creds, which led to code exec.
Thx to haicen for pointing out the XOR key recovery process.
blog.haicen.me/
Have fun and good luck!
stumblebot retweeted
I did not approve of the timing of this release but here it is. Blog coming soon.
github.com/ly4k/Certipy/pull…
stumblebot retweeted
CMIYC 2024 has finished! HashMob won first place in Pro:
infosec.exchange/@CrackMeIfY…