Horizon3 Attack Team @Horizon3Attack Twitter profile

Last Seen Profiles

@liushaoqi666

@PhStockExchange

@boss149161

@TheDeanFitz

@DamienHaas

@JoenWoen_09

@abdulrhaman7891

@DurantsHesi

@M7asuneh

@mahaaaaae

@LunaLoveXXX

@bokeplokalmalam

@BridgesCapital

@naohironiiyama

@eali44517126544

@Mklembara1

@BrianEtema35362

@chriss2118

@Qleendert

@boyscommunity1

@Janice059542952

@scottrees_1989

@1200_degrees

@RonPears

@McCourtInst

@DopamineFueled

@lov23563

@stakewolle

@mirshroom

@MasodeHassenali

@ale894609171

@Humor_Legame

@GrovoguiPe32267

@bokeplokalmalam

@andrealbriziom

@TheGingerHeed

Horizon3 Attack Team

@Horizon3Attack

2 years

Another appliance vuln down... CVE-2022-40684, affecting multiple #Fortinet solutions, is an auth bypass that allows remote attackers to interact with all management API endpoints. Blog post and POC coming later this week. Patch now.

18

459

1K

Horizon3 Attack Team

@Horizon3Attack

2 years

The new F5 RCE vulnerability, CVE-2022-1388, is trivial to exploit. We spent some time chasing unrelated diffs within the newest version, but @jameshorseman2 ultimately got first blood. We'll release a POC next week to give more time for orgs to patch. #f5 #CyberSecurity

14

341

1K

Horizon3 Attack Team

@Horizon3Attack

1 year

CVE-2022-39952, announced today, allows for unauthenticated RCE against #Fortinet FortiNAC as the root user. Blog post and POC to be released soon. See Fortinet's PSIRT:

19

374

976

Horizon3 Attack Team

@Horizon3Attack

2 years

Here is our technical deep dive for the #Fortinet CVE-2022-40684 Auth Bypass. POC within. This year has been filled with interesting HTTP header abuse!

13

354

833

Horizon3 Attack Team

@Horizon3Attack

2 years

Check out a recent finding by one of our own, Naveen Sunkavally. CVE-2022-28219 is an unauth RCE for ManageEngine ADAudit Plus. This XXE -> Deserialization chain often leads to host compromise as well as priv'd AD creds. Check out the blog post and POC:

CVE-2022-28219: Unauthenticated XXE to RCE and Domain Compromise in ManageEngine ADAudit Plus –...

CVE-2022-28219 is an unauthenticated remote code execution vulnerability affecting Zoho ManageEngine ADAudit Plus, a compliance tool used by enterprises to monitor changes to Active Directory.

www.horizon3.ai

6

258

710

Horizon3 Attack Team

@Horizon3Attack

1 year

Our technical deep-dive for the recent #Fortinet FortiNAC CVE-2022-39952 🔺 POC Exploit for RCE 🔺 Reversing the Patch 🔺 Indicators of Compromise

Fortinet FortiNAC CVE-2022-39952 Deep-Dive and IOCs – Horizon3.ai

Fortinet FortiNAC CVE-2022-39952 Deep-Dive and IOCs. This vulnerability allows remote code execution as the root user.

www.horizon3.ai

4

206

497

Horizon3 Attack Team

@Horizon3Attack

1 year

Exploitation of multiple vulnerabilities affecting #VMware vRealize Log Insight leads to unauth RCE 🔺 CVE-2022-31704, CVE-2022-31706, CVE-2022-31711 🔺 IOC Blog tomorrow 🔺 POC / Deep-Dive Blog next week See VMware Security Advisory:

4

137

393

Horizon3 Attack Team

@Horizon3Attack

2 years

Our technical analysis and POC for CVE-2022-22972 Authentication Bypass for #VMware Workspace ONE, vIDM, and vRealize Automation 7.6. We've again passed our POC to @GreyNoiseIO to build early detections. #CyberSecurity

VMware Authentication Bypass Vulnerability (CVE-2022-22972) Technical Deep Dive – Horizon3.ai

Technical deep dive into VMware's recently patched authentication bypass vulnerability allowing an attacker to login as any known local user.

www.horizon3.ai

3

179

362

Horizon3 Attack Team

@Horizon3Attack

2 years

With reports of #Fortinet CVE-2022-40684 being exploited in the wild, we have detailed some early Indicators of Compromise in the following blog to help organizations assess their environments.

FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass IOCs (CVE-2022-40684) – Horizon...

The recent FortiOS / FortiProxy / FortiSwitchManager CVE has been reportedly exploited in the wild. We would like to provide additional insight into the vulnerability so users can begin to determine...

www.horizon3.ai

6

164

363

Horizon3 Attack Team

@Horizon3Attack

2 years

And finally, a technical analysis on how @JamesHorseman2 and @hacks_zach reversed the patch and developed the POC for CVE-2022-1388: #f5 #CyberSecurity

F5 iControl REST Endpoint Authentication Bypass Technical Deep Dive – Horizon3.ai

F5 recently patched a critical vulnerability in their BIG-IP iControl REST endpoint CVE-2022-1388. It is simple to exploit and provides an attacker with a method to execute arbitrary system commands.

www.horizon3.ai

2

158

332

Horizon3 Attack Team

@Horizon3Attack

2 years

The team is back at it successfully reproducing CVE-2022-22972 affecting multiple #VMware products such as Workspace ONE. Technical writeup and POC soon to follow. Recommend to patch or mitigate immediately. #CyberSecurity

6

102

293

Horizon3 Attack Team

@Horizon3Attack

9 months

🔍 New POC Available! We’ve developed a Proof of Concept for CVE-2023-20198 in #Cisco IOS XE. This authentication-bypass allows an attacker to create new users with privilege level 15. Check out the details in

2

120

261

Horizon3 Attack Team

@Horizon3Attack

2 years

Reproducing the recent #ManageEngine CVE-2022-47966 pre-auth RCE, which affects nearly all of their products, has definitely been eye-opening about some recent SAML research that flew under our radar. POC and blog to come. Credit to the original researcher @_l0gg , nice find!

3

74

243

Horizon3 Attack Team

@Horizon3Attack

4 months

Our deep-dive for the recent #Fortinet #FortiClient EMS SQL injection vulnerability, CVE-2023-48788, that leads to RCE as SYSTEM.

CVE-2023-48788: Fortinet FortiClient EMS SQL Injection Deep Dive – Horizon3.ai

CVE-2023-48788 Fortinet FortiClient EMS SQL Injection Deep-Dive and Indicators of Compromise. This blog details the SQL injection which allows an unauthenticated attacker to access the FortiClient...

www.horizon3.ai

8

105

241

Horizon3 Attack Team

@Horizon3Attack

2 years

Our technical deep-dive of the recent #ManageEngine Pre-Auth RCE CVE-2022-47966. POC exploit included for xmlsec <= 1.4.1. Other versions also exploitable.

ManageEngine CVE-2022-47966 Technical Deep Dive – Horizon3.ai

On January 10, 2023, ManageEngine released a security advisory for CVE-2022-47966 (discovered by Khoadha of Viettel Cyber Security) affecting a wide range of products. The vulnerability allows an...

www.horizon3.ai

2

88

234

Horizon3 Attack Team

@Horizon3Attack

5 months

The recent #ConnectWise #ScreenConnect authentication bypass vulnerability is extremely trivial to reverse and exploit. Blog and exploit POC will drop soon.

4

60

235

Horizon3 Attack Team

@Horizon3Attack

4 months

The recent #Fortinet #FortiClient Endpoint Management Server (EMS) SQL injection vulnerability, CVE-2023-48788, allows an unauth attacker to obtain RCE as SYSTEM on the server. IOCs, POC, and deep-dive blog to be released next week. In the meantime, check DAS service logs for

0

109

222

Horizon3 Attack Team

@Horizon3Attack

1 year

CVE-2023-27524, a dangerous default configuration in #Apache #Superset , allows an unauth attacker to: 🔺 Gain RCE 🔺 Harvest Creds 🔺 Compromise Data We estimate there are roughly 2K+ servers on the Internet affected by this issue.

1

97

219

Horizon3 Attack Team

@Horizon3Attack

6 months

CVE-2024-0204, announced today but silently patched in December, details an authentication bypass in #Fortra #GoAnywhere MFT. Check out our latest deep-dive where we detail the exploit and how /..;/ strikes again. 🔺 Patch Diffing 🔺 Exploit POC 🔺 Indicators of Compromise

2

91

218

Horizon3 Attack Team

@Horizon3Attack

2 months

Our deep-dive, IOCs, and exploit for CVE-2023-34992, an unauth command injection as root, effecting #Fortinet #FortiSIEM appliances.

CVE-2023-34992: Fortinet FortiSIEM Command Injection Deep-Dive – Horizon3.ai

CVE-2023-34992 Fortinet FortiSIEM Command Injection Deep-Dive and Indicators of Compromise. This blog details a command injection vulnerability which allows an unauthenticated attacker to access the...

www.horizon3.ai

0

110

211

Horizon3 Attack Team

@Horizon3Attack

1 year

Our technical deep-dive blog post for the recent #VMware vRealize Log Insight RCE vulnerability chain leading to root privileges. 💥CVE-2022-31704, CVE-2022-31706, CVE-2022-31711 💥POC exploit in post

VMware vRealize Log Insight VMSA-2023-0001 Technical Deep Dive – Horizon3.ai

Technical deep-dive and exploit POC for VMware vRealize Log Insight RCE as reported in VMSA-2023-0001. This series of vulnerabilities leads to remote code execution and full system compromise....

www.horizon3.ai

6

85

204

Horizon3 Attack Team

@Horizon3Attack

1 year

CVE-2023-34362, affecting MOVEit Transfer, enables unauth RCE through a series of issues: 🔺 Custom Header abuse to SSRF 🔺 SQL injection 🔺 Forging External Trusted IdP Tokens 🔺 .NET Deserialization to RCE Check out our latest post by @JamesHorseman2 and @hacks_zach

3

82

202

Horizon3 Attack Team

@Horizon3Attack

1 year

The recent #Veeam vuln, CVE-2023-27532, enables an unauth attacker to interact with an API to obtain creds as well as RCE as SYSTEM. Our blog detailing the research and process of adapting the exploit to be cross-platform as well as the POC to dump creds:

Veeam Backup and Replication CVE-2023-27532 Deep Dive – Horizon3.ai

Veeam has recently released an advisory for CVE-2023-27532 for Veeam Backup and Replication which allows an unauthenticated user with access to the Veeam backup service (TCP 9401 by default) to...

www.horizon3.ai

3

88

200

Horizon3 Attack Team

@Horizon3Attack

1 year

CVE-2023-27350, affecting #PaperCut ’s enterprise print mgmt software, enables an unauth attacker to achieve RCE as SYSTEM. See our latest blog which details: 🔺 Analyzing the Patch 🔺 Developing an Exploit 🔺 Indicators of Compromise 🔺 Shodan Exposure

0

68

180

Horizon3 Attack Team

@Horizon3Attack

4 months

Today we are disclosing a critical SSRF vulnerability, CVE-2023-49785, in a popular Gen AI chatbot, NextChat a.k.a ChatGPT-Next-Web. This disclosure comes 107 days after initial report. There is no patch at this time.

NextChat: An AI Chatbot That Lets You Talk to Anyone You Want To – Horizon3.ai

NextChat a.k.a ChatGPT-Next-Web, a popular Gen AI ChatBot, is vulnerable to a critical server-side request forgery (SSRF) vulnerability.

www.horizon3.ai

4

58

144

Horizon3 Attack Team

@Horizon3Attack

2 years

Indicators of Compromise for #ManageEngine CVE-2022-47966: 🔺Log File Entries 🔺Shodan Exposure 🔺Potential Post-Exploitation Activities Deep-dive blog and POC will be released next week. Awesome effort by @JamesHorseman2 , Naveen, and @hacks_zach

ManageEngine CVE-2022-47966 IOCs – Horizon3.ai

Indicators of Compromise for ManageEngine CVE-2022-47966, a pre-authentication remote code execution vulnerability. Depending on the specific ManageEngine product, this vulnerability is exploitable...

www.horizon3.ai

3

54

145

Horizon3 Attack Team

@Horizon3Attack

2 months

Back again - more cmd injections for the #Fortinet #FortiSIEM ! Today we’re disclosing the details surrounding CVE-2024-23108 and CVE-2024-23109. These result from the use of Python’s os.system() in scripts which an unauth attacker controls arguments.

CVE-2024-23108: Fortinet FortiSIEM 2nd Order Command Injection Deep-Dive – Horizon3.ai

CVE-2024-23108 Fortinet FortiSIEM Command Injection Deep-Dive and Indicators of Compromise. This blog details a command injection vulnerability which allows an unauthenticated attacker to access the...

www.horizon3.ai

3

78

148

Horizon3 Attack Team

@Horizon3Attack

11 months

CVE-2023-38035, announced yesterday, effects #Ivanti #Sentry and enables a remote attacker to achieve remote code execution as root. Blog post detailing IOCs, technical deep-dive, and exploit POC to be released later this week.

1

54

138

Horizon3 Attack Team

@Horizon3Attack

11 months

Check out our latest blog detailing CVE-2023-38035, effecting #Ivanti #Sentry .📷 🔺 Auth Bypass to root RCE 🔺 Limited Logs for IOCs 🔺 Internet Exposure

3

64

130

Horizon3 Attack Team

@Horizon3Attack

2 years

Last Friday we passed our POC to @GreyNoiseIO to build early detections. With reports of exploitation and multiple POCs now public here ours is. Advise to apply mitigations or patch immediately. #f5 #CyberSecurity

GitHub - horizon3ai/CVE-2022-1388: POC for CVE-2022-1388

POC for CVE-2022-1388. Contribute to horizon3ai/CVE-2022-1388 development by creating an account on GitHub.

github.com

2

46

129

Horizon3 Attack Team

@Horizon3Attack

1 year

CVE-2023-39143, assigned for a series of security issues effecting #PaperCut NG/MF, allows an unauth attacker to obtain RCE in the most common deployment configurations. Today, we are releasing details to determine if the PaperCut server is vulnerable.

CVE-2023-39143: PaperCut Path Traversal/File Upload RCE Vulnerability – Horizon3.ai

CVE-2023-39143 is a critical vulnerability we disclosed to PaperCut that affects the widely used PaperCut NG/MF print management software. It affects PaperCut NG/MF running on Windows, prior to...

www.horizon3.ai

5

49

119

Horizon3 Attack Team

@Horizon3Attack

4 months

Today we are disclosing several vulnerabilities effecting the #Fortinet #FortiWLM (Wireless LAN Manager). The vulnerabilities span from command injection, SQL injection, to file reads. While most were patched late last year, 2 remain unpatched after 307 days from our initial

4

56

117

Horizon3 Attack Team

@Horizon3Attack

2 months

Our latest post by one of our recent team additions, Luke Harding, revisits CVE-2023-48788 - a SQL injection for #Fortinet #FortiClient EMS. He details exploitation obstacles and payload crafting between the two mainline versions of the software.

CVE-2023-48788: Revisiting Fortinet FortiClient EMS to Exploit 7.2.X – Horizon3.ai

Revisiting CVE-2023-48788, a SQL injection in Fortinet FortiClient EMS Server. This blog details bypassing several restrictions to achieve arbitrary command execution as SYSTEM.

www.horizon3.ai

0

58

114

Horizon3 Attack Team

@Horizon3Attack

9 months

While we haven’t reversed the Cisco 0-day just yet, we do have the deep-dive and IOCs for CVE-2023-34051 affecting #VMware Aria Operations for Logs. This vulnerability is a patch bypass discovered by @JamesHorseman2 that allows for RCE as root under certain conditions.

1

38

109

Horizon3 Attack Team

@Horizon3Attack

2 years

It's been half a year since #Log4Shell broke. Our latest post details how common CVE-2021-44228 still is and how easy it is to exploit for low-skilled attackers. POCs for: 💥 VMware Site Recovery Manager 💥 Elasticsearch 5 💥 OpenNMS #CyberSecurity

The Long Tail of Log4Shell Exploitation – Horizon3.ai

It's been more than six months since the Log4Shell vulnerability (CVE-2021-44228) was disclosed, and a number of post-mortems have come out talking about lessons learned and ways to prevent the next...

www.horizon3.ai

1

43

97

Horizon3 Attack Team

@Horizon3Attack

5 months

The recent #Progress #OpenEdge auth bypass, CVE-2024-1403, allows an unauth user to obtain admin perms to control svcs. While a path to RCE was not discovered in the limited time we dedicated, it is likely possible. The gist, if username == “NT AUTHORITY/SYSTEM”: you may pass.

0

40

93

Horizon3 Attack Team

@Horizon3Attack

9 months

CVE-2023-43208 addresses an easily exploitable unauth RCE as SYSTEM in #NextGen Mirth Connect, an application commonly used by healthcare companies. This is bypass for a fix to a vuln previously reported by @IHTeam_ . Update your Mirth Connect instances to 4.4.1! This advisory

1

34

86

Horizon3 Attack Team

@Horizon3Attack

9 months

With the patches to #Cisco IOS XE’s CVE-2023-20198 and CVE-2023-20273 being released this week, we took a deep-dive into Cisco’s internal workings. This post details: 🔺 WebUI Internals 🔺 Patch Diff’s 🔺 Exploit Theory-Crafting We hope this information leads to other

0

27

80

Horizon3 Attack Team

@Horizon3Attack

5 months

Our deep-dive for the recent #ConnectWise #SecureConnect authentication bypass vulnerability:

ConnectWise ScreenConnect: Authentication Bypass Deep Dive – Horizon3.ai

An analysis of the recent ConnectWise ScreenConnect authentication bypass vulnerability assigned as CVE-2024-1709, its root cause, and indicators of compromise.

www.horizon3.ai

3

25

78

Horizon3 Attack Team

@Horizon3Attack

1 year

Our Indicators of Compromise blog post for the recent #VMware vRealize Log Insight RCE vulnerability chain. 🔹Log File Entries 🔹Packet Capture 🔹Shodan Exposure 🔹CVE-2022-31704, CVE-2022-31706, CVE-2022-31711

VMware vRealize Log Insight VMSA-2023-0001 IOCs – Horizon3.ai

Indicators of Compromise for VMware vRealize Log Insight affected by VMSA-2023-0001. This series of vulnerabilities leads to remote code execution and full system compromise. CVE-2022-31704, CVE-20...

www.horizon3.ai

1

37

75

Horizon3 Attack Team

@Horizon3Attack

6 months

Our latest blog details a root-cause analysis of 2023’s @CISACyber 's Known Exploited Vulnerabilities. Leading root causes: 🔺 Insecure Exposed Function 🔺 Memory Corruption 🔺 URL Path / Routing Abuse

Rust Won't Save Us: An Analysis of 2023's Known Exploited Vulnerabilities – Horizon3.ai

A technical and root cause analysis of CISA's Known Exploited Vulnerabilities from 2023.

www.horizon3.ai

1

29

67

Horizon3 Attack Team

@Horizon3Attack

6 months

Last year, we disclosed two critical vulnerabilities affecting #PaperCut and NextGen #Mirth Connect. 🔺 CVE-2023-39143 affects PaperCut and allows attackers to download, delete, and potentially upload files leading to RCE in certain configurations 🔺 CVE-2023-43208 is a

2

29

67

Horizon3 Attack Team

@Horizon3Attack

11 months

The 2.1.1 release of #Apache #Superset fixes vulnerabilities we reported for admin RCE, LFI, and cred harvesting. These are exploitable in conjunction with the auth bypass issue we previously reported CVE-2023-27524. We’re seeing 2K+ Internet-facing servers still affected by

0

29

65

Horizon3 Attack Team

@Horizon3Attack

1 year

The latest PaperCut NG/MF release 22.1.3 fixes several security issues we reported that allow attackers with no privileges to read/write arbitrary files in certain common configurations, leading to RCE. CVE pending, more details in the coming weeks. Patch now!

1

12

33

Horizon3 Attack Team

@Horizon3Attack

2 years

A change-up this time around: A spook's take on the upcoming #OpenSSL vulnerability by @hacks_zach

OpenSSL Critical Vulnerability: Should You Be Spooked? – Horizon3.ai

On Tuesday, October 25 a new OpenSSL hot-fix release was announced which will patch a critical vulnerability that exists within the v3.0.X branch. OpenSSL 3.0.7 will be released on Tuesday, November...

www.horizon3.ai

1

23

31

Horizon3 Attack Team

@Horizon3Attack

1 year

If you missed @JamesHorseman2 and @hacks_zach at their #DEFCON presentation recounting their first #Pwn2Own competition and research methodology, the blog detailing reversing the Lexmark printer and a POC for dumping credentials is now out!

Lexmark Command Injection Vulnerability ZDI-CAN-19470 Pwn2Own Toronto 2022 – Horizon3.ai

Introduction In December 2022, we competed at our first pwn2own. We were able to successfully exploit the Lexmark MC3224i using a command injection 0-day. This post will detail the process we used to...

www.horizon3.ai

0

11

30

Horizon3 Attack Team

@Horizon3Attack

2 years

Check out the recent Samba CVE-2021-44142 vuln check by @JamesHorseman2 . This POC extends the work of @0xsha and identifies the vuln given write permissions on a share and bypasses some Western Digital specific hurdles to confirm the vulnerability.

GitHub - horizon3ai/CVE-2021-44142

Contribute to horizon3ai/CVE-2021-44142 development by creating an account on GitHub.

github.com

2

6

26

Horizon3 Attack Team

@Horizon3Attack

2 years

Check out @GreyNoiseIO for recent trends in exploitation of this vulnerability.

GreyNoise

@GreyNoiseIO

2 years

GreyNoise has observed the first IP exploiting CVE-2022-40684, FortiOS Authentication Bypass Attempt. The IP leveraged the authentication bypass and attempted to export a backup of the FortiOS configuration.

2

35

81

2

7

25

Horizon3 Attack Team

@Horizon3Attack

2 years

Check out this isSafeExpression() bypass by @MCKSysAr which works even up until Confluence 7.18 for CVE-2022-26134

MCKSys Argentina

@MCKSysAr

2 years

5

11

66

0

4

20

Horizon3 Attack Team

@Horizon3Attack

6 months

PaperCut CVE-2023-39143:

Writeup for CVE-2023-39143: PaperCut WebDAV Vulnerability – Horizon3.ai

Introduction Back in Aug. 2023 we released an advisory for CVE-2023-39143, a critical vulnerability that affects Windows installs of the PaperCut NG/MF print management software. Attackers can...

www.horizon3.ai

1

11

20

Horizon3 Attack Team

@Horizon3Attack

3 years

Another #log4shell #RCE POC. Apereo CAS 6.3 and 6.4 vuln in the X-Forwarded-For and username field. Typically deployed external facing to provide SSO. Rough @shodanhq query shows ~4.5K hosts. Apereo has released patches to address #log4j last month. #cybersecurity #BugBounty

0

10

20

Horizon3 Attack Team

@Horizon3Attack

2 years

Also check out our Indicators of Compromise blog to assess if your devices may have been exploited.

FortiOS, FortiProxy, and FortiSwitchManager Authentication Bypass IOCs (CVE-2022-40684) – Horizon...

The recent FortiOS / FortiProxy / FortiSwitchManager CVE has been reportedly exploited in the wild. We would like to provide additional insight into the vulnerability so users can begin to determine...

www.horizon3.ai

0

10

18

Horizon3 Attack Team

@Horizon3Attack

2 years

Check out the original research by @_l0gg also released today

1

5

17

Horizon3 Attack Team

@Horizon3Attack

3 years

#VMware #vROps trivially vulnerable to RCE with #log4shell CVE-2021-44228 in the username field. #cybersecurity #BugBounty #log4j #log4jrce

0

7

16

Horizon3 Attack Team

@Horizon3Attack

2 years

Find a user within the Backup Operators group? Remotely dump the DC's SAM, SECURITY, and SYSTEM with this PoC that extends impacket to achieve domain admin. Thanks to @filip_dragovic for the TTP and @mpgn_x64 for the Windows PoC. #CyberSecurity #redteam

GitHub - horizon3ai/backup_dc_registry: A simple POC that abuses Backup Operator privileges to...

A simple POC that abuses Backup Operator privileges to remote dump SAM, SYSTEM, and SECURITY - horizon3ai/backup_dc_registry

github.com

0

4

15

Horizon3 Attack Team

@Horizon3Attack

1 year

Check out @GreyNoiseIO 's tag for this CVE for exploitation activity

0

2

14

Horizon3 Attack Team

@Horizon3Attack

6 months

NextGen Mirth Connect CVE-2023-43208:

Writeup for CVE-2023-43208: NextGen Mirth Connect Pre-Auth RCE – Horizon3.ai

Mirth Connect, by NextGen HealthCare, versions prior to 4.4.1 are vulnerable to an unauthenticated RCE vulnerability, CVE-2023-43208.

www.horizon3.ai

0

9

14

Horizon3 Attack Team

@Horizon3Attack

3 years

Another day, another Zoho RCE. CVE-2021-44077 for #ManageEngine ServiceDesk Plus * PoC: * Research Credit:

0

8

12

Horizon3 Attack Team

@Horizon3Attack

2 years

Credit also to the researchers who found the vulnerability! @orange_8361 @hi_im_d4rkn3ss @st424204

0

3

12

Horizon3 Attack Team

@Horizon3Attack

3 years

1/n We're a week into #log4shell . Here's what to know going into the weekend: 1. Log4j < 2.15 is widely exploitable to RCE via CVE-2021-44228. 2. The Log4j 2.15 patch was insufficient and in some cases allows RCE via CVE-2021-45046.

1

12

11

Horizon3 Attack Team

@Horizon3Attack

2 years

Curious how to remotely enumerate antivirus exclusions for Defender? Like @n00py1 says, it's more common than you think. Microsoft even has official recommendations for exceptions and IT implements them poorly.

n00py

@n00py1

2 years

Don’t forget to check the exclusions on AV configuration. I was getting blocked dumping LSASS but then I ended up downloading mimikatz.exe straight to an excluded file path and it worked like a charm.

7

30

166

0

5

10

Horizon3 Attack Team

@Horizon3Attack

3 years

While the world is chasing #log4j , don't forget to also patch your Domain Controllers for CVE-2021-42278 which allows domain users to priv esc to domain admin. Check out some POCs on github: #pentest #redteam #cybersecurity

GitHub - Ridter/noPac: Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard...

Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domain user - GitHub - Ridter/noPac: Exploiting CVE-2021-42278 and CVE-2021-42287 to impersonate DA from standard domai...

github.com

0

5

9

Horizon3 Attack Team

@Horizon3Attack

3 years

Researching the impacts of CVE-2021-44228, the most interesting insight is that prior 2018 (Java8 u191) Java shipped easily exploitable and log4j2 has been vuln since 2012. From 2012-2018 any Java app that included log4j is in the sweet spot for attackers.

Understanding Log4Shell: the Apache log4j2 Remote Code Execution Vulnerability (CVE-2021-44228,...

Understanding Log4Shell: the Apache log4j2 Remote Code Execution Vulnerability (CVE-2021-44228)

www.horizon3.ai

0

7

9

Horizon3 Attack Team

@Horizon3Attack

2 years

Also check out @GreyNoiseIO , who we shared the POC with and has a tag available for monitoring it's exploitation.

0

2

8

Horizon3 Attack Team

@Horizon3Attack

1 year

This is made possible by the great prior research of @HuntressLabs , @Y4er_ChaBug , @codewhitesec !

0

8

Horizon3 Attack Team

@Horizon3Attack

2 years

#DEFCON 30 did not disappoint! We enjoyed meeting a lot of the community and putting faces to names! Till next year!

Zach Hanley

@hacks_zach

2 years

Had an awesome time out at #DEFCON 30 with the many of @Horizon3Attack team! Met some for the first time in person and for some was their first DEFCON! Looking forward to the next!

0

1

3

1

7

Horizon3 Attack Team

@Horizon3Attack

1 year

Check out @GreyNoiseIO 's recent tag for this vulnerability

0

1

7

Horizon3 Attack Team

@Horizon3Attack

2 years

Yesterday at #Pwn2Own @JamesHorseman2 and @hacks_zach successfully demonstrated a 0-day they discovered for a Lexmark printer to play a song using toner beeps!

Zero Day Initiative

@thezdi

2 years

Highlights from Day 1 of #Pwn2Own Toronto 2022: Zach Hanley and James Horseman from the Horizon3 AI team vs the #Lexmark printer #ItsAMe

0

4

19

0

5

Horizon3 Attack Team

@Horizon3Attack

3 years

4. Look for IOCs a. @GreyNoiseIO again has great resources for observed payloads from attackers 7/n

Sample Log4Shell (CVE-2021-44228) payloads observed in the wild by GreyNoise Intelligence

Sample Log4Shell (CVE-2021-44228) payloads observed in the wild by GreyNoise Intelligence - payload_samples.md

gist.github.com

1

4

5

Horizon3 Attack Team

@Horizon3Attack

2 years

The VMware security advisory with patch and mitigations:

Support Content Notification - Support Portal - Broadcom support portal

support.broadcom.com

0

5

6

Horizon3 Attack Team

@Horizon3Attack

3 years

3. Block Known Malicious IPs a. @GreyNoiseIO has a well maintained IP list 6/n

CVE-2021-44228 Apache Log4j RCE Attempts Dec 20th 9:27PM ET

CVE-2021-44228 Apache Log4j RCE Attempts Dec 20th 9:27PM ET - CVE-2021-44228_IPs.csv

gist.github.com

1

3

5

Horizon3 Attack Team

@Horizon3Attack

6 months

The data collected was made possible by other companies and individuals such as: @rapid7 , @Mandiant , @pdiscoveryio , @VulnCheckAI , @HuntressLabs , @SonarSource , @assetnote , @bishopfox , @LexfoSecurite , @PaloAltoNtwks , @SinSinology , and many more

0

4

Horizon3 Attack Team

@Horizon3Attack

5 months

We also shared our findings with @GreyNoiseIO yesterday so check out their tag

0

1

5

Horizon3 Attack Team

@Horizon3Attack

3 years

Should I worry? State of Exploitation: 1. Attackers are “spraying and praying” for RCE on old Java versions 2. Attackers are easily dumping environment variables like AWS keys 3. Attackers are targeting specific apps like vCenter with vulnerable dependencies 2/n

1

2

4

Horizon3 Attack Team

@Horizon3Attack

3 years

What can I do? Practice Defense in Depth: 1. Locate Known Vulnerable Software a. Check out the Netherlands CERT page for a comprehensive list of vendor applications and if they are vulnerable: 3/n

1

2

4

Horizon3 Attack Team

@Horizon3Attack

3 years

b. @PortSwigger #BurpSuite plugin for general fuzzing: c. @pdnuclei App Specific Scans in #Nuclei : 4/n

GitHub - projectdiscovery/nuclei: Fast and customizable vulnerability scanner based on simple YAML...

Fast and customizable vulnerability scanner based on simple YAML based DSL. - projectdiscovery/nuclei

github.com

1

2

4

Horizon3 Attack Team

@Horizon3Attack

3 years

Looking Ahead: The coming weeks will see more targeted attacks greatly increasing the risk of RCE. Get ahead now by taking a holistic approach to security. 8/n

0

2

4

Horizon3 Attack Team

@Horizon3Attack

2 years

@kevin_dylla Yes, we’ve confirmed upgrading to those versions does mitigate the underlying issue.

1

0

4

Horizon3 Attack Team

@Horizon3Attack

3 years

2. Address the Vulnerable Package a. Patch to #Log4j 2.16 if possible b. Remove the JndiLookup class if not in use 5/n

1

2

4

Horizon3 Attack Team

@Horizon3Attack

2 years

Check out next week as @JamesHorseman2 and @hacks_zach will participate in their first #Pwn2Own !

Zach Hanley

@hacks_zach

2 years

Very excited that @JamesHorseman2 and I will be participating in our first #Pwn2Own in Toronto next week! It’s been an interesting couple months, some lessons learned, looking forward to meeting other researchers, and sharing our research when we can!

0

15

0

3