Ralf Hacker Channel
27.8K subscribers
455 photos
16 videos
503 files
568 links
Download Telegram
CVE-2025-23120: Domain-Level RCE in Veeam Backup & Replication

https://labs.watchtowr.com/by-executive-order-we-are-banning-blacklists-domain-level-rce-in-veeam-backup-replication-cve-2025-23120/

Affected Product:
Veeam Backup & Replication 12.3.0.310 and all earlier version 12 builds.

Patched: March 19, 2025

#ad #pentest #redteam #rce
🔥17👍7🤯3
Вчера пошумел IngressNightmare: Unauth RCE в Ingress NGINX Controller, что может привести к захвату кластера Kubernetes.

Patched: Feb 7, 2025

Blog: https://www.wiz.io/blog/ingress-nginx-kubernetes-vulnerabilities

PoC: https://github.com/sandumjacob/IngressNightmare-POCs

А вас тоже расстраивают ресерчи без кода PoC??


#rce #kuber #pentest #exploit
👍30🔥7😱6🙏1
Ralf Hacker Channel
CVE-2025-33073: Reflective Kerberos Relay (LPE) Blog: https://blog.redteam-pentesting.de/2025/reflective-kerberos-relay-attack/ Patched: June 10, 2025 Интересная LPE с релеем на себя... Даже CVE есть) #lpe #ad #relay #pentest #redteam
В продолжение все той же темы CVE-2025-33073...

https://www.synacktiv.com/publications/ntlm-reflection-is-dead-long-live-ntlm-reflection-an-in-depth-analysis-of-cve-2025

Еще один ресерч, на это раз от Synactiv. Вот только у них не LPE, а Auth RCE от имени SYSTEM (если подпись SMB на машине не требуется).

Even though CVE-2025-33073 is referred by Microsoft as an elevation of privilege, it is actually an authenticated remote command execution as SYSTEM on any machine which does not enforce SMB signing.


#rce #lpe #ad #relay #pentest #redteam
🔥16👍10😱1
CVE-2025-25257: Pre-Auth SQLi to RCE - Fortinet FortiWeb

PoC: https://github.com/watchtowrlabs/watchTowr-vs-FortiWeb-CVE-2025-25257

Blog: https://labs.watchtowr.com/pre-auth-sql-injection-to-rce-fortinet-fortiweb-fabric-connector-cve-2025-25257/

Affected:
7.6.0 through 7.6.3
7.4.0 through 7.4.7
7.2.0 through 7.2.10
7.0.0 through 7.0.10

#rce #pentest #redteam #fortinet #cve
🔥28😁11👍5🤯2😱2