🧩 ما به اشتراکگذاری آسیبپذیریهای پرطرفدار و تهدیدات مرتبط با آنها ادامه میدهیم:
۱. گوگل جزئیات فنی درباره آسیبپذیری EntrySign (CVE-2024-56161) در سیستم بررسی امضای میکروکد AMD Zen را منتشر کرد. این آسیبپذیری به مهاجمان اجازه میدهد تا Firmware (نرمافزار داخلی) مخرب را نصب کنند.
گوگل همچنین ابزاری به نام Zentool را منتشر کرده است که برای جیلبریک (دسترسی غیرمجاز) پردازندههای AMD استفاده میشود.
۲. محققان Assetnote یک آسیبپذیری در سیستم مدیریت محتوای Sitecore کشف کردند که میتواند منجر به اجرای کد از راه دور (Remote Code Execution) شود. این آسیبپذیری با شناسه CVE-2025-27218 ثبت شده است.
۳. توسعهدهندگان Jenkins یک بهروزرسانی امنیتی منتشر کردند که چهار آسیبپذیری در هسته این پلتفرم را برطرف میکند.
۴. شرکت Elastic یک بهروزرسانی امنیتی برای Kibana منتشر کرد. این بهروزرسانی یک آسیبپذیری را برطرف میکند که میتواند منجر به اجرای کد دلخواه از طریق آپلود فایلهای مخرب یا درخواستهای HTTP دستکاریشده شود.
۵. یک گروه از محققان جزئیات یک نوع جدید از حمله الکترونیکی به اینورترهای (مبدلهای) نصبشده در نیروگاههای خورشیدی را ارائه کردند.
این حمله که ReThink نام دارد، میتواند به اینورترها آسیب فیزیکی وارد کند و عملکرد سیستمهای خورشیدی را مختل کند.
۶. محققان SEC Consult جزئیات یک آسیبپذیری به نام "زیبای خفته" را فاش کردند که میتواند حسگر CrowdStrike Falcon را غیرفعال کند.
SEC Consult
این مشکل را در پایان سال ۲۰۲۳ به تامینکننده گزارش داد، اما تامینکننده بدون رفع مشکل، آن را به عنوان یک "خلاء در تشخیص" عنوان کرد.
با این حال، این آسیبپذیری در سال ۲۰۲۵ برطرف شد و علیرغم سکوت تامینکننده، SEC Consult جزئیات آن را به صورت عمومی منتشر کرد.
۷. محققان SquareX یک افزونه پلیمورفیک (چندشکلی) برای کروم توسعه دادهاند که میتواند هر افزونه نصبشده محلی را تقلید کند.
این افزونهها یک کپی دقیق از آیکون، پنجرههای پاپآپ HTML و پروسس های افزونه اصلی ایجاد میکنند و حتی ممکن است افزونه اصلی را موقتاً غیرفعال کنند. این کار باعث میشود قربانیان باور کنند که در حال وارد کردن اطلاعات ورود به یک افزونه واقعی هستند.
#CVE
@TryHackBox
Try Hack Box

1399/08/11
https://www.linkedin.com/company/tryhackbox/
Learn penetration testing
Channels :
@TryHackBoxOfficial ( RoadMap )
@TryHackBoxStory ( Story Hacking )
Contact : @Unique_exploitBot
کانالهای مشابه



The Rise of TryHackBox: A Comprehensive Guide to Learning Penetration Testing
In an era where cyber threats loom larger than ever, the demand for proficient penetration testers and ethical hackers has skyrocketed. TryHackBox is an online learning platform that facilitates the exploration of penetration testing through comprehensive, hands-on exercises. Launched to bridge the gap between theoretical learning and practical application, TryHackBox empowers users to engage in real-world simulations of cybersecurity challenges. The platform features a variety of channels, including @TryHackBoxOfficial for roadmap guidance and @TryHackBoxStory for captivating hacking narratives, making it a multifaceted resource for learners at different levels. The integration of interactive learning coupled with a supportive community transforms the often intimidating subject of cybersecurity into an accessible and engaging experience. By utilizing TryHackBox, aspiring hackers can cultivate their skills in a structured yet flexible environment, paving the way for careers in the ever-evolving landscape of cybersecurity. This article delves into the workings of TryHackBox, its core features, and answers key questions that potential users may have about utilizing the platform effectively.
What is TryHackBox and how does it work?
TryHackBox is an online platform specifically designed for individuals who want to learn and enhance their skills in penetration testing and cybersecurity. Users engage with a variety of virtual machines that simulate real-world scenarios, allowing them to practice exploiting vulnerabilities and defending against attacks. Each box offers a unique challenge, ranging from beginner to advanced levels, ensuring that learners can progress at their own pace. The platform features detailed write-ups and community contributions, providing insights that enhance the educational experience.
To get started on TryHackBox, users sign up for an account which grants them access to a myriad of rooms, each dedicated to specific skills or concepts in penetration testing. Once logged in, they can access a variety of learning materials, including walkthroughs and video tutorials, which guide them in understanding the tools and techniques used in ethical hacking. Additionally, the social aspect of the platform allows learners to collaborate and discuss strategies with peers, facilitating a rich learning environment.
What types of challenges can users expect on TryHackBox?
The challenges on TryHackBox, referred to as 'boxes,' encompass a wide range of cybersecurity topics and skills. These challenges are designed to replicate real-world security scenarios, including web application testing, network exploitation, and post-exploitation techniques. The platform constantly updates its content to introduce fresh challenges that reflect current threats and vulnerabilities, keeping the learning experience relevant and rewarding. Users can expect different formats, such as capture-the-flag (CTF) challenges and real machine exploitation.
In addition to the standard challenges, TryHackBox also hosts themed events and competitions, encouraging users to put their skills to the test and compete against others. These events not only enhance learning but also build a sense of community among participants. By tackling various challenges, users are equipped to handle diverse cybersecurity tasks they may encounter in their professional careers.
Is TryHackBox suitable for beginners?
Yes, TryHackBox is highly suitable for beginners looking to dive into the world of cybersecurity and penetration testing. The platform offers a structured learning path with rooms specifically designed for newcomers. These beginner-level challenges are equipped with hints and walkthroughs that guide users through the foundational concepts and techniques they need to understand. The gradual introduction of more complex scenarios ensures that learners do not feel overwhelmed.
Furthermore, the community support available on TryHackBox plays a crucial role in helping beginners. Users can engage in forums and discussions, where they can ask questions and receive assistance from more experienced members. By fostering a collaborative learning environment, TryHackBox ensures that beginners are welcomed and equipped with the necessary tools to succeed as they progress in their learning journey.
How does TryHackBox support advanced learners?
For advanced learners, TryHackBox provides a wealth of resources and challenges that delve into more complex aspects of penetration testing. These users can engage with advanced boxes that incorporate intricate vulnerabilities and require a deeper understanding of various tools and techniques. Additionally, TryHackBox often collaborates with industry experts to create specialized content that addresses emerging threats and sophisticated exploitation methods.
Moreover, advanced learners can benefit from participating in collaborative projects, webinars, and competitions that challenge their existing skills. The platform fosters a competitive spirit where users can compete in Capture the Flag (CTF) events, allowing them to not only test their skills but also learn from others in the field. This continuous learning and skill enhancement ensure that advanced learners remain at the forefront of the cybersecurity industry.
Can TryHackBox help prepare for cybersecurity certification exams?
Absolutely! TryHackBox can be a valuable resource for individuals preparing for various cybersecurity certification exams, such as CompTIA Security+, CEH (Certified Ethical Hacker), or OSCP (Offensive Security Certified Professional). The hands-on experience gained through practical challenges aligns with the skills tested in these certifications. By working through the diverse scenarios provided on the platform, aspiring certificants can solidify their understanding of penetration testing principles and practices.
Additionally, TryHackBox offers tailored learning paths that coincide with the objectives of specific certifications. Users can approach their studies more effectively by focusing on areas that require improvement, while also gaining practical experience that is crucial for demonstrating competence in real-world situations. The platform's flexible approach allows users to balance their study schedules with hands-on practice, making it a compelling choice for certification preparation.
کانال تلگرام Try Hack Box
Are you interested in learning about penetration testing and stepping into the world of cybersecurity? Look no further than the Try Hack Box Telegram channel! This channel, created on 1st Nov 2020, is your go-to source for all things related to penetration testing. Whether you're a beginner looking to start your journey or an experienced professional seeking to expand your knowledge, Try Hack Box has something for everyone. The channel provides valuable resources, tips, and tools to help you enhance your skills and stay updated on the latest trends in cybersecurity.
By joining Try Hack Box, you'll have access to other related channels such as @TryHackBoxOfficial for a comprehensive roadmap to guide you through your learning process, and @TryHackBoxStory for captivating stories about hacking incidents. These additional channels will complement your experience and provide a well-rounded approach to learning penetration testing.
If you have any questions or want to engage with like-minded individuals, you can reach out to @Unique_exploitBot for assistance. The Try Hack Box Telegram channel is not just a platform for learning, but also a community where you can connect with professionals in the field and exchange knowledge and ideas.
Don't miss out on this opportunity to enhance your skills and become a proficient penetration tester. Join Try Hack Box today and take your cybersecurity expertise to the next level!
آخرین پستهای Try Hack Box

# Detection script for CVE-2024-49112
Write-Output "Checking system configuration for CVE-2024-49112..."
# بررسی اینکه آیا سیستم یک کنترلر دامنه است یا نه
$isDomainController = (Get-WmiObject Win32_ComputerSystem).DomainRole -eq 4 -or (Get-WmiObject Win32_ComputerSystem).DomainRole -eq 5
if (-not $isDomainController) {
Write-Output "This system is not a Domain Controller. No action needed."
exit
}
# بررسی اینکه آیا اتصالات RPC ورودی از شبکههای غیرقابل اعتماد مسدود شدهاند یا نه
$rpcsrvstatus = Get-NetFirewallRule -DisplayName "*RPC*" | Where-Object {$_.Direction -eq "Inbound" -and $_.Enabled -eq "True"}
if ($rpcsrvstatus) {
Write-Output "Warning: Inbound RPC connections from untrusted networks are allowed. This configuration is vulnerable."
} else {
Write-Output "Inbound RPC connections from untrusted networks are blocked."
}
# بررسی اینکه آیا کنترلر دامنه دسترسی به اینترنت دارد یا نه
$internetAccess = Test-Connection -ComputerName "1.1.1.1" -Count 2 -Quiet
if ($internetAccess) {
Write-Output "Warning: Domain Controller has internet access. This configuration is vulnerable."
} else {
Write-Output "Domain Controller does not have internet access."
}
Write-Output "Detection complete."
#CVE
@TryHackBox