BuzzSec

As the world continues to navigate the post-pandemic shift in work environments, Rapid7 is operating on a hybrid-first approach that balances flexibility and productivity with collaboration and optimizing for customer success. In the spirit of cross-collaboration, the People Development and Workplace Experience teams partnered with managers across the company to record an internal podcast series. The series, dubbed “ Have You Herd? Navigating Our Hybrid-First World!, ” captures the stories and experiences of our managers adapting to hybrid work and how they support their teams. ‘Herd’ is a nod to our moose, the term we use to describe our people. Since the word ‘moose’ is both singular and plural, it means that we respect everyone’s individuality while working together as one team towards a common goal. Chatting with our host, Senior Director of UX for the Detection and Response practice Gwen Betts, managers shared tips and tricks for building strong cross-functional teams, staying ...

The tide rolls in and out. The flood of new modules last week crested leaving ample time for documentation updates this week. The team and the community seem to have focused on getting those sweet sprinkles of information that help everyone understand Metasploit out to the world. Enhancements and features (1) #17458 from steve-embling - Updates the exploit/multi/misc/weblogic_deserialize_badattrval module to enable support for SSL/TLS. Bugs fixed (4) #17778 from adfoster-r7 - Updates the Metasploit database migration code to no longer break the test suite when running locally. #17823 from bcoles - This fixes an issue in the check method where targets with files containing no PHP code were falsely reported as safe. #17835 from bcoles - Fixes a bug in auxiliary/admin/networking/cisco_dcnm_auth_bypass where the bypass_auth method would break if a user supplied a TARGETURI path without a trailing / . #17844 from SubcomandanteMeowcos - Fixes broken documentation r...

Windows 11 ADF WinSock Priv Esc The new windows/local/cve_2023_21768_afd_lpe exploit makes use of a brand new Windows kernel exploitation technique that leverages the new I/O ring feature introduced in Windows 11 21H2. This technique comes from Yarden Shafir research and provides a full read/write primitive on Windows 11. This exploit is a write-where bug that allows arbitrary write of one byte in kernel memory. This is enough to modify the I/O ring internal structures and get remote code execution as the NT AUTHORITY\SYSTEM user. The Metasploit module is based on the exploit PoC authored by chompie1337 and b33f . Example running with Windows 11 Version 22H2 Build 22621.963 x64: msf6 exploit(windows/local/cve_2023_21768_afd_lpe) > run verbose=true [*] Started reverse TCP handler on 192.168.100.9:4444 [*] Running automatic check ("set AutoCheck false" to disable) [*] Windows Build Number = 22621.963 [+] The target appears to be vulnerable. [*] Launching netsh to...

In Q1, our team continued to focus on driving better customer outcomes with InsightVM and Nexpose by further improving efficiency and performance. While many of these updates are under the hood, you may have started to notice faster vulnerability checks available for the recent ETRs or an upgraded user interface for the console Admin page. Let’s take a look at some of the key updates in InsightVM and Nexpose from Q1. [InsightVM and Nexpose] View expiration date for Scan Assistant digital certificates Scan Assistant , a lightweight service deployed on the asset, leverages the Scan Engine and digital certificates to securely deliver the core benefits of authenticated scanning without the need to manage traditional account-based credentials. Customers can now easily determine the validity of a Scan Assistant digital certificate by viewing the Expiration Date on the Shared Scan Credential Configuration page. [InsightVM and Nexpose] A new look for the Console Administration page We...

Emergent threats evolve quickly. We will update this blog with new information as it comes to light and we are able to verify it. Erick Galinkin, Ted Samuels, Zach Dayton, Caitlin Condon, Stephen Fewer, and Christiaan Beek all contributed to this blog. On Wednesday, March 29, 2023, multiple security firms issued warnings about malicious activity coming from a legitimate, signed binary from communications technology company 3CX. The binary, 3CXDesktopApp, is popular video-conferencing software available for download on all major platforms. Several analyses have attributed the threat campaign to state-sponsored threat actors. Rapid7’s threat research teams analyzed the 3CXDesktopApp Windows binary and confirmed that the 3CX MSI installer drops the following files: 3CXDesktopApp.exe , a benign file that loads the backdoored ffmpeg.dll , which reads an RC4-encrypted blob after the hexadecimal demarcation of fe ed fa ce in d3dcompiler.dll . The RC4-encrypted blob in d3dcompiler.dll i...

Wowza, a new credential gatherer and login scanner! This week Metasploit Framework gained a credential gatherer for Wowza Streaming Engine Manager. Credentials for this application are stored in a file named admin.password in a known location and the file is readable by default by BUILTIN\Users on Windows and is world readable on Linux.. The module was written by community contributor bcoles who also wrote a login scanner for Wowza this week. The login scanner can be used to validate the credentials found by the gatherer. The two modules complement each other quite nicely. New module content (3) Wowza Streaming Engine Manager Login Utility Author: bcoles Type: Auxiliary Pull request: #17733 contributed by bcoles Description: This adds a login scanner module to brute force credentials of Wowza Streaming Engine Manager. SugarCRM unauthenticated Remote Code Execution (RCE) Authors: Sw33t.0day and h00die-gr3y Type: Exploit Pull request: #17507 contributed by h00die-gr3y A...

It’s 2023, and according to Gartner, ESG, and everybody else, the vendor consolidation trend continues. Throwing tools at the problem isn’t working well, and creates problems of its own. So, this season of “Lost Bots” starts with Jeffrey Gardner, Detection and Response Practice Advisor and Stephen Davis, Lead D&R Sales Technical Advisor, talking the many upsides of consolidation—deals, integration, one throat to choke—and what they call the “gotchas” too. At the 4:00 mark, there’s a good discussion of consolidation of layers vs. function. Pay attention: some consolidation decisions can actually increase your risk.  And because these guys are more than valuable fonts of free tips, the episode is packed with air quotes, bacon, and other surprises. NEVER MISS A BLOG Get the latest stories, expertise, and news about security today. Subscribe from Rapid7 Blog https://blog.rapid7.com/2023/03/09/the-lost-bots-s03e01-tech-stack-consolidation-and-bacon/

Taking a stroll down memory lane (Tomcat Init Script Privilege Escalation) Do you remember the issue with Tomcat init script that was originally discovered by Dawid Golunski back in 2016 that led to privilege escalation? This week's Metasploit release includes an exploit module for CVE-2016-1240 by h00die . This vulnerability allows any local users who already have tomcat accounts to perform privilege escalation and gain access to a target system as a root user. This exploit can be used against the following tomcat versions Tomcat 8 (8.0.36-2), Tomcat 7 (7.0.70-2) and Tomcat 6 (6.0.45+dfsg-1~deb8u1). Lenovo Diagnostics Driver IOCTL memmove Our own Jack Heysel contributed an exploit module for CVE-2022-3699 using the proof of concept created by alfarom256 . A vulnerability within Lenovo Diagnostics Driver due to incorrect access control allows low-privileged users to issue device IOCTLs to perform arbitrary physical/virtual memory read/write. New module content (8) Nagios ...

Last week, multiple organizations issued warnings that a ransomware campaign dubbed “ESXiArgs” was targeting VMware ESXi servers by leveraging CVE-2021-21974—a nearly two-year-old heap overflow vulnerability. Two years. And yet, Rapid7 research has found that a significant number of ESXi servers likely remain vulnerable. We believe, with high confidence, that there are at least 18,581 vulnerable internet-facing ESXi servers at the time of this writing. That 18,581 number is based on Project Sonar telemetry. We leverage the TLS certificate Recog signature to determine that a particular server is a legitimate ESXi server. Then, after removing likely honeypots from the results, we checked the build ids of the scanned servers against a list of vulnerable build ids. Project Sonar is a Rapid7 research effort aimed at improving security through the active analysis of public networks. As part of the project, we conduct internet-wide surveys across more than 70 different services and protoc...

Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. Rapid7 is responding to various compromises arising from the exploitation of CVE-2022-21587 , a critical arbitrary file upload vulnerability (rated 9.8 on the CVSS v3 risk metric) impacting Oracle E-Business Suite (EBS). Oracle published a Critical Patch Update Advisory in October 2022 which included a fix, meanwhile, CISA added CVE-2022-21587 to its Known Exploited Vulnerabilities (KEV) catalog on February 2, 2023. Oracle E-Business Suite is a packaged collection of enterprise applications for a wide variety of tasks such as customer relationship management (CRM), enterprise resource planning (ERP), and human capital management (HCM). CVE-2022-21587 can lead to unauthenticated remote code execution. On January 16, 2023, Viettel Security published an analysis of the issue detailing both the vulnerability's root cause and a method of leveraging the vulnerability ...

Emergent threats evolve quickly, and as we learn more about this vulnerability, this blog post will evolve, too. On February 1, 2023, Atlassian published an advisory for CVE-2023-22501, a critical broken authentication vulnerability affecting its Jira Service Management Server and Data Center offerings. Jira Service Management Server and Jira Service Management Data Center run on top of Jira Core and offer additional features. According to Atlassian’s advisory , the vulnerability “allows an attacker to impersonate another user and gain access to a Jira Service Management instance under certain circumstances. With write access to a User Directory and outgoing email enabled on a Jira Service Management instance, an attacker could gain access to sign-up tokens sent to users with accounts that have never been logged into. Access to these tokens can be obtained in two cases: If the attacker is included on Jira issues or requests with these users, or If the attacker is forwarded or o...

Emergent threats evolve quickly. As we learn more about this vulnerability, we will update this blog post with relevant information about technical findings, product coverage, and other information that can assist you with assessment and mitigation. On Thursday, February 2, 2023, security reporter Brian Krebs published a warning on Mastodon about an actively exploited zero-day vulnerability affecting on-premise instances of Fortra’s GoAnywhere MFT managed file transfer solution. Fortra (formerly HelpSystems) evidently published an advisory on February 1 behind authentication; there is no publicly accessible advisory. According to the advisory, which Krebs quoted directly in his Mastodon post, the vulnerability is a remote code injection flaw that requires administrative console access for successful exploitation. Fortra said that the Web Client interface itself is not exploitable. While administrative consoles and management interfaces should ideally never be exposed to the inter...

For complete visibility into the vulnerabilities in your environment, proper authentication to web apps in InsightAppSec is essential. In this article, we’ll look at issues you might encounter with macro, traffic, and selenium authentication and how to troubleshoot them. Additionally, you’ll get practical and actionable tips on using InsightAppSec to its full potential. The first step to troubleshooting InsightAppSec authentication is to look over the scan logs. The scan logs can be located under the scan in the upper left hand corner. The logs can give you useful information such as if the authentication fails, the website is unavailable, or if any other problems arose during the scan. Event log will give you information about the scan itself. Platform event log will give you information about the scan engine and if it encountered any issues during the scan. Download additional logs: If you wanted to dive even deeper into what happened during the scan, you can to to look int...