Create an account


Welcome, Guest
You have to register before you can post on our site.

Username
  

Password
  





Search Forums

(Advanced Search)

Forum Statistics
» Members: 20,114
» Latest member: gfhfhfh
» Forum threads: 21,815
» Forum posts: 22,681

Full Statistics

Online Users
There are currently 478 online users.
» 0 Member(s) | 473 Guest(s)
Applebot, Baidu, Bing, Google, Yandex

 
  [Tut] Road Walkthrough TryHackMe – A Black Box Pentesting Challenge
Posted by: xSicKxBot - 02-09-2023, 10:42 AM - Forum: Python - No Replies

Road Walkthrough TryHackMe – A Black Box Pentesting Challenge

5/5 – (1 vote)

YouTube Video

CHALLENGE OVERVIEW


  • Link: https://tryhackme.com/room/road
  • Difficulty: Medium
  • Target: user/root flags
  • Highlights: retrieving user credentials from a Mongo DB, privilege escalation by exploiting a glitch in the pkexec bin
  • Tools used: nmap, dirb, burpsuite
  • Tags: pentesting, security, mongoDB, SSH

BACKGROUND


? What is black box pentesting?


The term black box refers to a challenge where only the target machine IP is known to the penetration tester. Nothing else about the server is disclosed to the attacker, so everything must be discovered during the enumeration stage.

On the other end of the spectrum is white box pentesting, where information about the internal workings of a server is shared with the pentester.

ENUMERATION/RECON



Let’s kick things off with some standard nmap and dirb scans.

sudo nmap -p- -A $targetIP -O -o /home/kalisurfer/THM/road-walkthrough/nmap.txt

It looks like they are running SSH and HTTP services. No surprises here!

dirb http://$targetIP



Our dirb scan sniffed out a few interesting directories: /assets /phpMyAdmin/ChangeLog and /v2. We’ll look into each of these in more detail.

INVESTIGATING /phpMyAdmin


We discover a login portal at /phpMyAdmin/index.php


INVESTIGATING /assets


When we browse the changelogs, we can identify the version number (5.1.0) for phpMyAdmin.

We also find a link to a Git repo with changelogs going back all the way to the year 2000!

This is a potential treasure trove of interesting information. We’ll check exploit-db to see if there are any known vulnerabilities. There are a bunch, but nothing for version 5.1.0.

For now, let’s move on.



INVESTIGATING /v2


We discover another login portal /v2/admin/login.html. This one has a register option, so we can go ahead and create a new user and see what else we can view from within a standard user account.


INITIAL FOOTHOLD



We pivoted from our new user to the admin account by intercepting the TCP request to change the password using burpsuite and modifying the parameters to the admin’s email address before forwarding the request.

After successfully changing it to the admin’s password, we can login as admin with our new password and upload a revshell via the profile pic upload option.


From our admin dashboard, let’s go ahead and upload a revshell (from PHP pentest monkey, naming it revshell.php), start up a netcat listener on the corresponding port, and finally trigger it by loading the following address in our browser.

http://10.10.154.107/v2/profileimages/revshell.php

We caught the revshell and now we have our initial foothold!

EXTRACTING USER CREDENTIALS FROM MONGO DB





And now we have user webdeveloper’s password in plaintext from Mongo DB! We can use “su webdeveloper” to switch users with our new password.

LOCAL RECON



We easily found our first flag, user.txt, in the /home/webdeveloper directory.

63—-omitted—---45

After uploading Linpeas to the target machine via a python3 simple HTTP server, let’s run it and analyze the results.


The first CVE is the one we will use to privesc. Instead of using the three file method that is outlined on exploit-db, we’ll do it manually using two terminals logged in as webuser.


Let’s also check sudo privileges.


The LD_PRELOAD and sky_backup_utility are both interesting findings. We’ll save these for later in case we hit a dead end with CVE 2021-4034.

PRIV-ESC



We’ll execute privilege escalation by exploiting a glitch in the pkexec bin (policykit vulnerability – cve-2021-4034). Open a second shell as webdeveloper.

Issue the following commands one-by-one in the corresponding terminals.


Terminal 1 Terminal 2
echo $$
pkttyagent --process <number of the process ID from echo $$>
pkexec "/bin/bash"
password for webdeveloper
(recieve the root shell in terminal 1)

POST-EXPLOITATION


Let’s grab the root flag:


FINAL THOUGHTS



This box was fairly challenging and really pushed me to take careful notes about my findings during enumeration and also to thoughtfully plan my strategy for gaining the initial foothold and for the priv-esc stage.

These more advanced boxes are forcing me to start putting together longer sequences of hacking tricks that were used more in isolation on the easier boxes.



https://www.sickgaming.net/blog/2023/02/...challenge/

Print this item

  (Indie Deal) IMGN Giveaways, Hogwarts Keys Ready, Fatal Fram Deal
Posted by: xSicKxBot - 02-09-2023, 10:41 AM - Forum: Deals or Specials - No Replies

IMGN Giveaways, Hogwarts Keys Ready, Fatal Fram Deal

IMGN PRO Giveaways
[www.indiegala.com]

Hogwarts Legacy Deluxe Edition Early Access available!
[www.indiegala.com]
https://www.youtube.com/watch?v=BtyBjOW8sGY
Dear Villagers Sale, up to 90% OFF
[www.indiegala.com]

https://www.youtube.com/watch?v=YxGWC4AqmJA
Movie Games Sale, up to 90% OFF
[www.indiegala.com]


https://www.youtube.com/watch?v=UeNyjr2q5RE



https://steamcommunity.com/groups/indieg...8575235515

Print this item

  News - Elizabeth Banks Asked To Direct Thor: Ragnarok, Marvel Never Replied
Posted by: xSicKxBot - 02-09-2023, 10:41 AM - Forum: Lounge - No Replies

Elizabeth Banks Asked To Direct Thor: Ragnarok, Marvel Never Replied

As she makes the rounds promoting Cocaine Bear, director Elizabeth Banks has let the cat out of the bag about a couple of her superhero film ambitions. For starters, she reached out to Marvel Studios about directing Thor: Ragnarok several years ago.

But Banks told Variety she never heard back about her Thor inquiry. "Nothing ever happened," she said. "No one called me. Taika Waititi got the job. Rightfully so." Part of the reason why she was attracted to the Marvel movie was to work on a more CGI-focused project, something that she's finally doing with Cocaine Bear. She previously helmed Pitch Perfect 2 and Charlie's Angels.

"I definitely wanted to make something muscular and masculine," Banks said. "I wanted to break down some of the mythology around what kinds of movies women are interested in making. For some bizarre reason, there are still executives in Hollywood who are like, 'I don't know if women can do technical stuff.'"

Continue Reading at GameSpot

https://www.gamespot.com/articles/elizab...01-10abi2f

Print this item

  PC - Deliver Us Mars
Posted by: xSicKxBot - 02-09-2023, 10:41 AM - Forum: New Game Releases - No Replies

Deliver Us Mars



Sequel to the award-winning Deliver Us The Moon, Deliver Us Mars is an atmospheric sci-fi adventure offering an immersive astronaut experience. Explore new frontiers on a suspense-fuelled, high-stakes mission to recover the ARK colony ships stolen by the mysterious Outward.

Publisher: Frontier Foundry

Release Date: Feb 02, 2023




https://www.metacritic.com/game/pc/deliver-us-mars

Print this item

  [Oracle Blog] Announcing GraalVM Enterprise in Oracle Cloud Infrastructure DevOps
Posted by: xSicKxBot - 02-08-2023, 04:01 AM - Forum: Java Language, JVM, and the JRE - No Replies

Announcing GraalVM Enterprise in Oracle Cloud Infrastructure DevOps

Today, we are announcing that you can use GraalVM Enterprise directly in Oracle Cloud Infrastructure (OCI) DevOps build pipelines to build high-performance Java applications, at no additional cost. 


https://blogs.oracle.com/java/post/annou...oci-devops

Print this item

  [Tut] The Innovator’s Dilemma [Summary]
Posted by: xSicKxBot - 02-08-2023, 04:01 AM - Forum: Python - No Replies

The Innovator’s Dilemma [Summary]

5/5 – (1 vote)

1-Sentence Summary


The Innovator’s Dilemma provides a critical analysis of how disruptive technologies can revolutionize markets and explains how companies can stay competitive in the face of disruptive change.

Short Summary



Quote: “One theme common to all of these failures, however, is that the decisions that led to failure were made when the leaders in question were widely regarded as among the best companies in the world.”

The Innovator’s Dilemma by Clayton Christensen is a classic management book that explores the dilemma of disruptive innovation:

? The idea that established companies can miss out on the benefits of disruptive technologies because they cannot make the necessary changes to their existing business models.

Christensen examines how disruptive innovations can overtake established companies and suggests strategies for how these companies can remain competitive.

He argues that companies must be proactive and focus on developing new products and services that cater to customers’ changing needs.

He also explains how companies can manage innovation processes to capitalize on disruptive technologies.

Overall, The Innovator’s Dilemma is an important book for managers and entrepreneurs looking to stay ahead of the competition.

Most Important Book Excerpt



The following may be the most important book excerpt of The Innovator’s Dilemma that talks about the reason why great companies failed:

“The reason is that good management itself was the root cause. Managers played the game the way it’s supposed to be played. The very decision-making and resource allocation processes that are key to the success of established companies are the very processes that reject disruptive technologies: listening to customers; tracking competitors actions carefully; and investing resources to design and build higher-performance, higher-quality products that will yield greater profit. These are the reasons why great firms stumbled or failed when confronted with disruptive technology change.

Successful companies want their resources to be focused on activities that address customers’ needs, that promise higher profits, that are technologically feasible, and that help them play in substantial markets. Yet, to expect the processes that accomplish those things also to do something like nurturing disruptive technologies – to focus resources on proposals that customers reject, that offer lower profit, that underperform existing technologies and can only be sold in insignificant markets– is akin to flapping one’s arms with wings strapped to them in an attempt to fly. Such expectations involve fighting some fundamental tendencies about the way successful organizations work and about how their performance is evaluated.”

This is not only my preferred part of the book, it’s also the ones proposed by many others such as this Wired author.

Now, you already have a good idea or grasp on the book, don’t you? Let’s dive deeper into the individual chapters next:

Chapter Summaries



Without further ado, let’s dive into the first chapter:

Chapter 1. How Can Great Firms Fail? Insights from the Hard Disk Drive Industry



In Chapter 1 of The Innovator’s Dilemma, Christensen examines why big firms fail to capitalize on disruptive technologies, using the history of the hard disk drive industry as an example.

He explains that while leading firms may have an advantage in sustaining innovations, they often struggle with disruptive innovations.

Christensen also points to the 109 firms out of 129 who failed from 1980 to 1995 due to their inability to adapt to disruptive technologies, highlighting the difficulty established firms have in responding to disruptive change.

Ultimately, Christensen shows that even if firms are well managed and focus on meeting customer needs, they may still be unable to capitalize on disruptive technologies and this is the Innovator’s Dilemma.

Chapter 2. Value Networks and the Impetus to Innovate



In Chapter 2, Christensen examines the concept of value networks and the impetus to innovate.

He defines a value network as a collection of upstream suppliers, downstream channels to market, and ancillary providers that support a common business model within an industry

He explains how organizations that become overly specialized in certain products can struggle to adapt to new technologies, as the skills and culture they have developed are no longer applicable.

Christensen also explains how different industries will have different criteria when measuring a product’s performance and that disruptive technologies are often developed within successful firms.

Ultimately, Christensen argues that established companies often miss out on the benefits of disruptive technologies because they cannot make the necessary changes to their existing business models.

Chapter 3. Disruptive Technological Change in the Mechanical Excavator Industry



In Chapter 3, Christensen examines how disruptive technology can upend established companies, using the mechanical excavator industry as an example.

He explains how introducing hydraulic-powered excavators was a major disruptive change, with the traditional steam and gasoline-powered excavators not being able to compete with the new technology.

Christensen also notes how diesel and electric motors were later overtaken by hydraulics, with established companies failing to make the necessary changes in time.

Ultimately, Christensen shows how even well-managed companies can fail if they cannot keep up with disruptive technologies.

Chapter 4. What Goes Up, Can’t Go Down



In Chapter 4, Christensen examines the concept of the “northeastern pull” and how leading companies can struggle to move to lower-end markets.

He explains how the image of a company, the promise of a higher margin, and the need to cut costs can make it difficult for established companies to make the transition.

Quote: “Creating an independent organization, with a cost structure honed to achieve profitability at the low margins characteristic of most disruptive technologies, is the only viable way for established firms to harness this principle.”

Christensen then uses the example of integrated steel mills and minimills to demonstrate how companies can focus on the premium sectors of the market to remain profitable.

Ultimately, Christensen shows how companies can be “pulled” in the direction of higher-end markets, making it difficult for them to make the transition to lower-end markets.

Chapter 5. Give Responsibility for Disruptive Technologies to Organizations Whose Customers Need Them



In Chapter 5, Christensen discusses the Resource Dependence Theory, which states that customers, although external forces have more power over a company than its own staff.

He suggests that companies should use resource allocation to identify disruptive innovations that may not be beneficial to customers and to allocate responsibility for these technologies to organizations where customers require them.

Christensen further argues that leadership is crucial to successfully implementing disruptive technologies and recommends setting up an independent executive team to manage them in a separate business unit.

Chapter 6. Match the Size of the Organization to the Size of the Market



In Chapter 6, the importance of matching the size of the organization to the size of the target market is discussed.

Managers are encouraged to take the role of a leader when dealing with disruptive technologies and to create new markets rather than entering into those that are already established.

History has shown that larger, more successful companies often find it difficult to foray into emerging markets due to the competition. To combat this, management should consider the size of their organization and the size of the market they are trying to target.

A larger organization will not have the same enthusiasm and willingness to build relationships with smaller customers as compared to a smaller company.

Chapter 7. Discovering New and Emerging Markets



In Chapter 7, the focus is on discovering new and emerging markets related to disruptive technologies.

Traditional sustaining technologies typically follow a plan that is based on customer inputs, but disruptive technologies require action taken before any plans are made.

To overcome this challenge, managers must use agnostic marketing strategies that involve discovery-driven tactics to learn more about potential applications and customers. This requires leaving the comfort zone and gathering knowledge about unknown and unpredictable markets.

Chapter 8. How to Appraise your Organization’s Capabilities and Disabilities



In Chapter 8, Christensen explains how managers can assess the capabilities and disabilities of their organizations.

He states that organizations are defined by their resources, processes, and values and that managers should be adept at choosing the right people for the right job. Moreover, they must be able to motivate and train employees to maximize success, especially when disruptive technology enters the picture.

Christensen breaks down the key elements of an organization into three classes: Resources, Processes, and Values (RPV).

  1. Resources refer to people, technology, equipment, brands, designs, and cash,
  2. Processes are patterns of elements like coordination, interaction, decision-making, and communication that transform resources into products.
  3. Values refer to the criteria used to determine decision priorities.

He further explains that successful firms evolve in two predictable ways: gross margins and size.

Over time, spectacular profits can become insignificant, and opportunities that seem large for small organizations seem minuscule for larger ones, making it difficult for bigger players to enter small markets.

Chapter 9. Performance Provided, Market Demand, and the Product Life Cycle



In Chapter 9, the discussion revolves around how an oversupply of performance can open up new opportunities for disruptive technologies to creep into successful markets.

This is achieved by making use of four different dimensions, such as functionality, convenience, price, and reliability.

Disruptive technologies, although often seen as inferior in mainstream markets, can benefit emerging markets due to their user-friendliness and cost-effectiveness.

Companies can counter these disruptive technologies by attempting to improve them for the markets they are strong in, but are more likely to succeed when they treat them as marketing challenges within new markets.

Chapter 10. Managing Disruptive Technological Change: A Case Study



In Chapter 10, the principles used in previous chapters are applied to explore how managers can successfully address disruptive challenges.

A case study of the electric automobile industry illustrates how innovators must first understand their customer’s needs and the niche they are targeting before developing a new distribution model.

To determine if a technology is disruptive, managers need to analyze the market behavior, track the performance of the new technology, and compare it to the performance of the market.

If the improvement in the performance of the new technology is faster than the market’s growth, it could be considered disruptive.

We’re all seeing this play out with Tesla’s gain in market share in the EV space.

Chapter 11. The Dilemmas of Innovation: A Summary



In summary, Christensen outlines the challenges of innovation, including the disconnect between the progress of the market and the progress of technology, the difficulty of allocating resources to disruptive technologies, and the incompatibility of old customers and new markets.

He further notes that the knowledge needed to make educated investment decisions often does not exist and that it is never wise to be either exclusively a leader or a follower.

Lastly, Christensen points out that small firms can benefit from disruptive technologies, as major industry players may not understand their operations.

Here are some points to consider:

  • The pace of progress that markets absorb can be different than the progress that technological advances offer.
  • Managing innovation is the mirror image of managing the resource allocation process.
  • Matching the market to the technology is another important aspect of innovation.
  • The capabilities of most organizations are far more specialized and context-specific than most managers are inclined to believe.
  • In many instances, the information required to take decisive action in the face of disruptive technologies simply does not exist.
  • It is not wise to adopt a blanket technology strategy to always be a leader or to always be a follower.
  • Small entrant firms can enjoy protection to entry as they build the emerging markets for disruptive technologies due to the fact that what they are doing may not make sense for the established leaders to do.

Concluding Thoughts on the Book



With The Innovator’s Dilemma, Clayton M. Christensen delivers a fascinating exploration of why businesses succeed or fail in the face of new technologies. With a focus on the disk drive industry since the 1950s, Christensen offers a unique perspective on why some firms thrive while others falter. He quickly discovers why some firms choose to ignore the new technology while others adapt and fail to find a recipe for success when disruptive technologies enter the market.

Despite this, Christensen provides a wealth of evidence across different industries to support his claims.

At its core, this book is designed to educate business people on how new technologies affect firms and to provide a new way of thinking about disruptive technologies. Christensen argues that leading firms often fail because they fail to find new markets for disruptive technologies and instead continue serving current customers with what they currently need.

The book also presents evidence that not all firms that adapt to new technologies are successful while some firms that ignore the new technology manage to stay afloat. This is the fundamental dilemma in the book.

For those interested in business, The Innovator’s Dilemma is a must-read.

It offers a creative and complex conclusion backed up with hard evidence. Managers facing disruptive technologies in their industry can benefit from the book’s direct advice. Christensen does a great job of making the book engaging, though some of the chapters may be dry and confusing for those unaccustomed to the business world.

Despite the challenge, the insights and advice brought up are valuable knowledge for any student of business.

The Innovator’s Dilemma is a book that is sure to stay with you and one that you will want to recommend to others.

Resources and Further Reading



The following lists a couple of resources that have been of great help for me and, I hope, will be for you too!



https://www.sickgaming.net/blog/2023/02/...a-summary/

Print this item

  (Indie Deal) FREE Grab the Bottle | Nioh, THQ & Nacon Sales
Posted by: xSicKxBot - 02-08-2023, 04:01 AM - Forum: Deals or Specials - No Replies

FREE Grab the Bottle | Nioh, THQ & Nacon Sales

Grab the Bottle FREEbie
[freebies.indiegala.com]
https://www.youtube.com/watch?v=82Bmnm0_fSs
THQ Nordic RPGs & Open Worlds Sale, up to 80% OFF
[www.indiegala.com]

https://www.youtube.com/watch?v=RHNOKvKco_g
Nacon Sale, up to 90% OFF
[www.indiegala.com]

https://www.youtube.com/watch?v=KVpremaIEwI
Taco House Bundle Happy Hour
[www.indiegala.com]


https://steamcommunity.com/groups/indieg...8577547685

Print this item

  PC - Tails: The Backbone Preludes
Posted by: xSicKxBot - 02-08-2023, 04:01 AM - Forum: New Game Releases - No Replies

Tails: The Backbone Preludes



Tails: The Backbone Preludes is a post-noir narrative adventure with branching choices. It is an intertwined series of vignettes about change, circumstance, and consequence. Guide four characters through formative moments in their lives in a dystopian Vancouver inhabited by anthropomorphic animals.

Publisher: Raw Fury

Release Date: Feb 02, 2023




https://www.metacritic.com/game/pc/tails...e-preludes

Print this item

  News - Elijah Wood Doesn't Like AMC's Proposed Ticket Price Changes
Posted by: xSicKxBot - 02-08-2023, 04:01 AM - Forum: Lounge - No Replies

Elijah Wood Doesn't Like AMC's Proposed Ticket Price Changes

Elijah Wood (the Lord Of The Rings trilogy) has fired back on Twitter at AMC Theatres over the chain's recent announcement that this coming weekend will introduce a new ticket-pricing initiative based on seat location. The program, called Sightline, is slated to come to New York, Chicago, and Kansas City on February 10 before expanding to the rest of the United States.

"The movie theater is and always has been a sacred democratic space," Wood tweeted. "This new initiative… would essentially penalize people for lower income and reward for higher income."

Sightline has reportedly already been tested in select markets. AMC Stubs A-List members will be able to reserve seats in the Preferred Sightline Section at no additional cost. Preferred seats are "in the middle of the auditorium and are priced at a premium to standard sightline seats," and there are other pricing tiers for the front row and another for "the most common… available for the traditional cost of a ticket."

Continue Reading at GameSpot

https://www.gamespot.com/articles/elijah...01-10abi2f

Print this item

  [Oracle Blog] Java Card Forum 25 years anniversary
Posted by: xSicKxBot - 02-07-2023, 06:30 AM - Forum: Java Language, JVM, and the JRE - No Replies

Java Card Forum 25 years anniversary

The Java Card Forum (JCF) celebrates the 25 years of its creation. Members of the Forum use this opportunity to reflect how far the Oracle Java Card technology had gone over this period. Actually, it is very enthusiastic to see how much a product meets its customers, its users and enable a worldwide ecosystem changing day to day life of billions of people. This is what this anniversary is about.



https://blogs.oracle.com/java/post/java-...nniversary

Print this item

 
Latest Threads
Working TℰℳU Discount Co...
Last Post: gfhfhfh
2 hours ago
Official TℰℳU Promo Code...
Last Post: gfhfhfh
2 hours ago
Verified TℰℳU Discount C...
Last Post: gfhfhfh
2 hours ago
Latest TℰℳU Promo Code 【...
Last Post: gfhfhfh
2 hours ago
Current TℰℳU Discount Co...
Last Post: gfhfhfh
2 hours ago
Exclusive TℰℳU Promo Cod...
Last Post: gfhfhfh
2 hours ago
Best Savings TℰℳU Coupon...
Last Post: gfhfhfh
2 hours ago
Ultimate Savings TℰℳU Co...
Last Post: gfhfhfh
2 hours ago
Save More TℰℳU Coupon Co...
Last Post: gfhfhfh
2 hours ago
Shop Smart TℰℳU Coupon C...
Last Post: gfhfhfh
2 hours ago

Forum software by © MyBB Theme © iAndrew 2016