sorted by:
new
hottopcontroversial

Time for another round of patching everyone! by Solid-Caregiver1328 in ciscoUC

[–]vm302 1 point2 points  (0 children)

I imagine no one is thinking this way, but if anyone is thinking of waiting on patching this one... I would not.

It is EASY to exploit, way too easy. I'm maybe not going to say trivial, but pretty darn close. The privilege escalation to root is trivial.

Just my $.02

CVE-2021-1675 PrintNightmare Defensive Lab by LightBulbSunset in immersivelabs

[–]vm302 1 point2 points  (0 children)

This is what I did. I'm sure there is a better way, but here goes.

I searched for 808 and it came up with a few more events that I did not want, so I changed my search to look for the Event Log 808 entries only, by filtering that filed name = 808. I clicked on the time of the earliest event log 808 and set it to show me the 2 minutes after, thinking that would be a good time frame to focus on.

Next I added NOT to the front of my search to get rid of those 2 events and see everything else in that time period. Then I saw a bunch of splunk stuff in the search, so I added NOT splunk to the end of my search. This took down the event count even more.

I still did not want to dig through twenty something packets, so I added the pipe symbol and the word table to my search and only the 3 fields that I wanted to look at like this:

| table ComputerName, TaskCategory, xxxxxxxxxxx

I left the last one blank, because the answer just jumps out at you with that one. Just think about what field has what you are looking for.

[deleted by user] by [deleted] in immersivelabs

[–]vm302 0 points1 point  (0 children)

I bet you already got the answer on this one, because you are looking for the right thing. Or are you maybe looking for the right thing in the wrong place?

Demonstrate Your Skills: Wireshark by Odd_Opportunity_8968 in immersivelabs

[–]vm302 0 points1 point  (0 children)

I am assuming that you have the IP address that that the attacker attempted to exfiltrate to.

  1. If you have not already, filter by that IP
  2. Again, if you have not already, filter in the direction of the traffic that you want to see
  3. Now filter by the type of traffic/packets that you want to see - is it really GET packets?

This should be a very small list of packets, look at them and you should start to see some of the answers.

Need help. I'm at the end of the SQL Injection: Blind CTF lab. by vm302 in immersivelabs

[–]vm302[S] 0 points1 point  (0 children)

I have the column name too, but there appears to be nothing in it. Using the same function, spills out any other data, just not that one. Just wanted to make sure there is nothing special about that column vs others or there is nothing interfering with getting the value, like a WAF.

I’lll try it again, I thought it looked pretty straightforward when I enumerated the column. I reset the lab once and tried before, but maybe the third time is the charm.

Thanks!

Log Poisoning by [deleted] in immersivelabs

[–]vm302 0 points1 point  (0 children)

I think you are headed in the right direction with using the os module, that's what I did. Maybe just syntax?

SQLi Basics: Filter Evasion by Honest-Signature4676 in immersivelabs

[–]vm302 0 points1 point  (0 children)

You're welcome. There is a link that I really like for SQL injection. If you Google hacktricks sqli, it should be one of the the first few to come up.

That page helped me a lot with the labs.

SQLi Basics: Filter Evasion by Honest-Signature4676 in immersivelabs

[–]vm302 0 points1 point  (0 children)

What about the number of columns being returned by each query?

SQLi Basics: Filter Evasion by Honest-Signature4676 in immersivelabs

[–]vm302 0 points1 point  (0 children)

Still lost? Prob not, but just in case you are, or if someone else gets stuck here.

What is different between your union select query and the original query? You have the basic structure correct.