i hacked the company i work at

I am 20 and 3 months ago i landed this backend dev job at a local chinese company. They have departments of chinese and "my nationality"team. I am underpaid young fuarrrk doing all the job while the bitches with discuss astrology for 8 hours in the ktichen. From what i understand my department is just coverage for the chinese team because they are running gambling business targeting China. A month ago i scanned the network just for the fuarrrk of it (picrel) after some research i realised that the ubiquiti devices are teh CCTVS and the network switches in the office. Obviously i couldn't hold myself so i fired nmap on the 192.168.0.8 and... (picrel) It had 80 and 443 ports open so i figured out that it might be the WEBUI for the cctvs and the network and yes it was the webui for this cucksoftware. After a simple search for "unifi video cve" we get. "Ubiquiti officially discontinued UniFi Video and designated it End-of-Life (EOL) in early 2021—months before Log4Shell was discovered in December 2021—the final official release (v3.10.13) never received an official vendor patch. It remains permanently vulnerable out of the box. If you are running an old instance (on an NVR appliance, Ubuntu/Debian, or Windows), here is what you need to know about the vulnerability mechanics in this environment and how to handle it." unifi video is an END-OF-LFE software and is vulnerable to LOG4SHELL. I fired up JNDIExploit, got a callback to my LDAP server, but the HTTP second stage was blocked because my machine was on a different subnet. Classic firewall hell. I switched to the Deserialize/CommonsCollections1 payload, no HTTP callback needed. It worked. I had RCE on the video server as the unifi-video user. Long story short i was able to dump my ssh keys through the RCE and i created a new admin for unifi-video through mongodb. i am able to watch ALL the livestreams from all the CCTVS, recordings do not work because there is not enough space left on the server. I was able to get all the SSH passwords from all the switches and gateways and cctvs from the mongodb, i used it to get access to the main gateway at 192.168.0.1. The same server that is running Unifi Video is also running Unifi Network so i made a new admin for the Unifi Network and logined successfully. Now i dont know how to escalate this whole soykaf, one option could be to secretly record everything because it seems like they did it on purpose so there will be no recordings of their illegal activitiy and then blackmail them because they are generating millions of dollars per month with their business. Another option could be to turn myself in and tell them all this soykaf but i just dont know lains, I DONT KNOW WHAT TO DO

Pick a random EU country and send this soykaf to its intelligence service. Try France's DGSE they are said to be quite capable, send a clapback at the chinkese for killing harambe or whatever. Just to be sure you are talking about CCTV of in-business cameras for the company?

>>28075 I'm not gonna read all that, but even a bare glance and I can see how incredibly stupid it is to post this to public internet. If it's possible, you should delete this thread asap. Next time try to ask your soykaf abstractly, without making it so easy to identify you for glowies.

you already posted this to the www, might as well leak it all now. or don't. bug it seems that you hacking some chinese company is less of a big deal than whatever they're up to

伙计们，我们抓住了他。打包起来

>>28075 > [S]ecretly record everything... and then blackmail them because they are generating millions of dollars per month with their business. Don't be daft. You're a broke 20 year old without the proper influence to leverage this for anything meaningful (I assume this since you're asking here instead of going through with the blackmail). If you try and blackmail the company they will respond with either a lawsuit that will destroy you financially (best outcome) or they will send people to your home that will beat you with a wrench (worst outcome) or both. They are a business, so anything or anyone that disrupts the cash flow is an obstacle to be removed, not an asset to be used. You mentioned that they run some sort of gambling operation in China, which means they will be especially hostile. And since you mentioned "my nationality" instead of "American" or "West European" I assume you're in a place where the laws are lax enough that they can retaliate with force. Even if you're in the US or some other first world country, the threat of force isn't out of the question, and the threat of legal trouble is almost certainly implied. Long and short of it, do not try and blackmail them, you will only get hurt one way or another and be worse off for it. > Another option could be to turn myself in and tell them all this soykaf This is the better option. First, start looking for a better/different job if you can find one. You're smart enough to run nmap and use existing exploits so your main limitation is going to be the employment market in your country. Apologies if this comes off as patronizing but it's important to have something lined up in case your company decides to fire you from what you found. Worst case, if they fire you you can switch to the new job you've found. Write up a report on what you did, what you found, how you'd fix it, etc. and set up a meeting with your company's IT team. Get everything in writing so you have receipts in case something goes wrong, record the meeting on your phone (voice recording, put your phone in your pocket. Test this first), etc. Cover your arse as much as possible. Finally, present it to them as a fix to add, rather than something you're blaming on them. Give them AI slop on how to fix it, whatever, just don't let it seem like you're blaming them for an insecure system or they'll dislike you and want you gone. The third option is to simply sit on the knowledge and not mention it if you don't have to. Erase your tracks (logs, SSH login, admin account, etc.) and move on. If it becomes an issue, it wasn't your fault, it was IT's fault. Don't be daft and blackmail them, you'll suffer for it and be made an example of.

>>28075 You're going to put all of us on a watchlist.

>>28087 actually, i changed my mind after writing this reply. you should just post every evidence on Lainchan. we need to conclude whether it is appropriate for good ol rich blackmail. rich as in getting you money, got it? money. MONEY. losing your job? getting a sincere, "thank you"?.. MONEY. money money money MONEY. blackmail the soykaf out of them, is what i say. yup, that was what i actually meant to say, until some momentary mini-stroke struck me, and made me write total nonsense rambling, sorry for that!

>>28088 on a chinese gambling company's watchlist? lol

>>28075 >hacking your place of employment If you did this locally on their machines or through your remote login credentials then it's very likely to be traced back to you if you try to sell anything and they investigate it. Don't turn yourself in, the company is likely to report you anyway and law enforcement doesn't care. It's best to just forget about it.

Never ever do anything like that (hacking company where you werking). They got 1) a suspect 2) motives 3) network logs As soon as they hire someone to investigate after blackmailing or whatever sh1t, you'll get troubles

Cash out and leak it. fuarrrk 'em.

didn't we warn you not to do this before in another thread you previously made? am i imagining things?

>non-chinese >works in a chinese company involved in gambling, targetting China anon, are you working in the Golden Triangle?

>i am able to watch ALL the livestreams from all the CCTVS lmao isn't there a thread to post about exposed cameras somewhere here? oh yeah it's on /sec/ here >16254 you know what to do lainon :)

>>28075 Don't soykaf where you eat, dummy. Cover up your tracks and forget about it.

>>28112 no, you're not imagining things, I was there warning him not to do it

I'm probably too late for the OP, but whatever. This sounds so dumb, I would tell CISO or head of IT or someone like that. Also tell them that you are a dumb 20 year-old hacking out of boredom while your colleagues discuss astrology. Then maybe they have an inch of understanding. Also it is a good idea to propose fixes.