An exploit could allow the attacker to cause unexpected behaviors such as high CPU usage, process crashes, or even full system reboots of an affected device. For step-by-step instructions on installing this application in an IIS environment, see the Procedure section of this document.  (DotNetNuke Cookie Deserialization in Pentagon’s HackerOne Bug Bounty program), (DotNetNuke Cookie Deserialization in Government website). proof-of-concept exploit writeup 0day cve-2020-11519 cve-2020-11520 ... Star 8 Code Issues Pull requests MSF moudle DotNetNuke GetShell & execute exploit. You can also craft a custom payload using the DotNetNuke module within the ysoserial tool. 2020-02 (Critical) Telerik CVE-2019-19790 (Path Traversal) Published: 5/7/2020 Background DNN Platform includes the Telerik.Web.UI.dll as part of the default installation. Based on the extracted type, it creates a serializer using XmlSerializer. Reading Time: 10 minutes We looked at around 300 DotNetNuke deployments in the wild and discovered that one in five installations was vulnerable to CVE-2017-9822. You have to parse the plaintext portalID through the VERIFICATION_PLAIN variable, which you can extract by inspecting the source code of the “Edit Profile” page within any user settings page. Scan your web application periodically with our Website Scanner and also discover other common web application vulnerabilities and server configuration issues. Oh, wait… I forgot to mention the encryption remained the same (DES) and no changes were applied to it. Hello! You can get rid of this vulnerability by upgrading your DotNetNuke deployment to the latest version. Another important functionality DotNetNuke has is the ability to create or import 3rd party custom modules built with VB.NET or C#. by Ioana Rijnetu March 23, 2020 by Ioana Rijnetu March 23, 2020 For the past couple of weeks, a critical RCE vulnerability found in Microsoft Server Message… DotNetNuke CMS version 9.4.4 suffers from zip split issue where a directory traversal attack can be performed to overwrite files or execute malicious code. 6.1: 2019-09-26: CVE-2019-12562: Stored Cross-Site Scripting in DotNetNuke (DNN) Version before 9.4.0 allows remote attackers to store and embed the malicious script into the admin notification page. An attacker could exploit this vulnerability by sending traffic to the management interface (mgmt0) of an affected device at very high rates. The VERIFICATION_CODE value is the full path of the local file containing the codes you collected from the users you registered. is that it doesn’t work with types that have interface members (example: and build the payload using a method belonging to one of the following classes: , which can result in Remote Code Execution. method to open the calculator on the remote target. This module exploits a deserialization vulnerability in DotNetNuke (DNN) versions 5.0.0 to 9.3.0-RC. http://packetstormsecurity.com/files/156484/DotNetNuke-CMS-9.5.0-File-Extension-Check-Bypass.html Regardless of. Just continue searching until you find a positive integer). DotNetNukeEXPLOIT. You can still retrieve the encryption key by gathering a list of verification codes of various newly created users, launch a partial known-plaintext attack against them, and reduce the possible number of valid encryption keys. Later edit [June 11, 2020]: As part of this research, we discovered a Remote Code Execution vulnerability exploitable through DNN Cookie Deserialization in one of the … It’s an unprecedented series of events and we’ll be dealing with the aftermath for a long time to come. You have to get the unencrypted format of this code by logging in as the new user, navigating to the “Edit Profile” page, inspecting the source code, and searching for the values of “userID” and “portalID” (possible to return a negative value. Digitpol is licensed by the Ministry of Justice: Licence Number POB1557, Facebook paying for exploit to catch a predator, voting software security under the microscope… • The Register, Facebook paying for exploit to catch a predator, voting software security under the microscope… |, Database Management Systems Vulnerabilities, Pokazał jak prostym gif-em można w nieautoryzowany sposób dostać się na serwer. You can see an example payload below, using the, DotNetNuke.Common.Utilities.FileSystemUtils. (Default DotNetNuke 404 Error status page). Another important functionality DotNetNuke has is the ability to create or import 3rd party custom modules built with VB.NET or C#. Also, DNN supports verified registration of new users through email, but you need to configure a valid SMTP server in order for this security feature to be working. tags | exploit , arbitrary , bypass , file upload advisories | CVE-2020-5188 Actionable vulnerability intelligence; Over 30.000 software vendors monitored ... 2020 Low Not Patched. What is deserialization and what’s wrong with it? To help pentesters identify and report this issue and developers to prevent or fix it, we created this practical deep-dive into this Cookie Deserialization RCE vulnerability found in DotNetNuke (DNN).Â. Search for jobs related to Dotnetnuke exploit or hire on the world's largest freelancing marketplace with 18m+ jobs. Another important functionality DotNetNuke has is the ability to create or import 3rd party custom modules built with VB.NET or C#. msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set VERIFICATION_CODE , msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set VERIFICATION_PLAIN

, msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set ENCRYPTED true, msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set TARGET 2, The VERIFICATION_PLAIN value is in the following format: portalID-userID. Regardless of the official CVE details, this issue affects only the 9.1.1 DNN version. Having both the encrypted and plaintext codes, you can launch a known-plaintext attack and encrypt your payload with the recovered key. The VERIFICATION_PLAIN value is in the following format: : Remote Code Execution in DotNetNuke 9.2 through 9.2.1. added the session cookie as a participant in the encryption scheme. You can start by analyzing the vulnerable source code of how the application processes the DNNPersonalization cookie XML value. is still displayed in an unencrypted format. Get in touch +420 775 359 903. The exploitation is straightforward by passing the malicious payload through the DNNPersonalization cookie within a 404 error page. After having responsibly reported it through HackerOne, the DOD solved the high-severity vulnerability and disclosed the report, with all details now publicly available. Just continue searching until you find a positive integer). But this should not be a big issue if the encryption algorithm would be changed to a stronger and current one. Also, through this patch, the userID variables are no longer disclosed in a plaintext format and are now encrypted, but the portalID is still displayed in an unencrypted format. We have analyzed around 300 DotNetNuke deployments in the wild and found out that one in five installations was vulnerable to this issue, including governmental and banking websites. This cookie is used when the application serves a custom 404 Error page, which is also the default setting. 13 Feb 2020 — Reported DNN that, in v9.5.0-rc1 only vulnerability #3 is patched. Nagroda: ~20 000 PLN, Хакер продает доступ к учетным записям электронной почты сотен глав компаний, CVE-2020-26878 Ruckus Networks Ruckus 注入漏洞 -漏洞情报、漏洞详情、安全漏洞、CVE, The tech that might help cyclists and cars coexist safely, Edel Creely named person of the year at Technology Ireland Awards, Cybersecurity firm Sophos hit by data breach, says ‘small subset’ of customers affected, 2020-29072 | LiquidFiles cross site scripting, CologneBlue Skin up to 1.35 on MediaWiki qbfind Message CologneBlueTemplate.php cross site scripting, GitHub fixes high severity security flaw spotted by Google (ZDNet Latest News). 16 Feb 2020 — Technical details shared again!!!! class, to read files from the target system. and also discover other common web application vulnerabilities and server configuration issues. variables used within the application, disclosed in plaintext through the user profile. The main problem with deserialization is that most of the time it can take user input. This means you can inject maliciously crafted payloads in the requested format of the application and possibly manipulate its logic, disclose data, or even execute remote code. Bug Bounty Hunter. Chris Hammond 22,957 views The first patch consisted of a DES implementation, which is a vulnerable and weak encryption algorithm. You can find those issues in the DotNetNuke from 9.2.2 to 9.3.0-RC. Two weeks after Google disclosed a... Click to share on Facebook (Opens in new window), Click to share on Twitter (Opens in new window), Click to share on Pinterest (Opens in new window), Click to share on Tumblr (Opens in new window), We looked at around 300 DotNetNuke deployments in the wild and discovered that. According to them, over 750,000 organizations deployed web platforms powered by DotNetNuke worldwide. Learn how to find this issue in the wild by using Google dorks, determine the factors that indicate a DotNetNuke web app is vulnerable, go through hands-on examples, and much more! It is so popular and so widely used across the Internet because you can deploy a DNN web instance in minutes, without needing a lot of technical knowledge. Overview. You can gather the verification code by registering a new user and checking your email. Because the XML cookie value can be user-supplied through the request headers, you can control the type of the. (Default DotNetNuke 404 Error status page). The idea sounds good and effective, except if the DNNPersonalization key was derived from the registration code encryption key. CVE-2018-18326CVE-2018-18325CVE-2018-15812CVE-2018-15811CVE-2017-9822 . msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set VERIFICATION_CODE <FILE PATH>, msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set VERIFICATION_PLAIN <PORTALID>, msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set TARGET 4. You can use the following Google dorks to find available deployments across the Internet and test them against the DotNetNuke Cookie Deserialization CVE: Deserialization is the process of interpreting streams of bytes and transforming them into data that can be executed by an application. After that, you have to try each potential key until you find the one that works. In recent weeks we have noted a significant increase in the numbers of exploit attempts targeting two specific vulnerabilities: CVE-2017-5638 (a vulnerability in Apache Struts) and CVE-2017-9822 (a vulnerability in DotNetNuke). We looked at around 300 DotNetNuke deployments in the wild and discovered that one in five installations was vulnerable to CVE-2017-9822. The Exploit Database is a CVE compliant archive of public exploits and corresponding vulnerable software, developed for use by penetration testers and vulnerability researchers. Privacy  /   Terms and Policy   /   Site map  /   Contact. You can still retrieve the encryption key by gathering a list of verification codes of various newly created users, launch a partial known-plaintext attack against them, and reduce the possible number of valid encryption keys. We also display any CVSS information provided within the CVE List from the CNA. You can install DNN on a stack that includes a Windows Server, IIS, ASP.NET, and SQL Server for Windows. Multiple vulnerabilities in October CMS 30 Nov, 2020 Medium Patched. You can gather the verification code by registering a new user and checking your email. Please use the contact form below and send us your questions or inquiries. The fix for DotNetNuke Cookie Deserialization, We have analyzed around 300 DotNetNuke deployments in the wild and found out that. The following lines will provide you the details, technical aspects, and vulnerable versions of each DNN Cookie Deserialization CVE. The following lines will provide you the details, technical aspects, and vulnerable versions of each DNN Cookie Deserialization CVE. Patches for these vulnerabilities are already available. . The application will parse the XML input, deserialize, and execute it. We also reported the issues where possible. Because the XML cookie value can be user-supplied through the request headers, you can control the type of the XmlSerializer.Â. Spoofing attack in KDE Connect 30 Nov, 2020 Medium Patched. So besides the target host, target port, payload, encrypted verification code, and plaintext verification code, you also have to set the .DOTNETNUKE cookie of the user you registered within the Metasploit Console. This cryptography scheme was used to encrypt both the DNNPersonalization cookie and the registration code sent to the email when you sign up through a DotNetNuke application that uses Verified Registration. Advertisement. A big constraint of XmlSerializer is that it doesn’t work with types that have interface members (example: System.Diagnostic.Process). https://pentest-tools.com/about#contact. Oh, wait… I forgot to mention the encryption remained the same (DES) and no changes were applied to it. organizations deployed web platforms powered by DotNetNuke worldwide. You can install DNN on a stack that includes a Windows Server, IIS, ASP.NET, and SQL Server for Windows. (/DNN Platform/Library/Common/Utilities/XmlUtils.cs), The program looks for the “key” and “type” attribute of the “item” XML node. Great Job how could i contact pentest tools? The patch for CVE-2018-15811 added the session cookie as a participant in the encryption scheme. The following lines will provide you the details, technical aspects, and vulnerable versions of each DNN Cookie Deserialization CVE. If you want to exploit this CVE through the Metasploit module, you have to first set the target host, target port, payload, encrypted verification code, and plaintext verification code. DotNetNuke before 4.8.2, during installation or upgrade, does not warn the administrator when the default (1) ValidationKey and (2) DecryptionKey values cannot be modified in the web.config file, which allows remote attackers to bypass intended access restrictions by using the default keys. This is the official website of the DNN community. remote exploit … through the VERIFICATION_PLAIN variable, which you can extract by inspecting the source code of the “Edit Profile” page within any user settings page. The registration code is the encrypted form of the portalID and >userID variables used within the application, disclosed in plaintext through the user profile. If you want to exploit this CVE through the Metasploit module, you have to first set the target host, target port, payload, encrypted verification code, and plaintext verification code. We also reported the issues where possible. Affected Versions DNN Platform version 7.0.0 through 9.4.4 (2020-04) Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. , this issue affects only the 9.1.1 DNN version. After that, the other four CVEs were released based on the same issue, DotNetNuke Cookie Deserialization RCE, but they are only bypasses of the failed attempts at patching the first CVE. After that, you have to try each potential key until you find the one that works. To resolve the following Telerik Component vulnerabilities: CVE-2017-11317, CVE-2017-11357, CVE-2014-2217, you will need to apply a patch that has been developed by DNN from their Critical Security Update - September2017 blog post.Customers may also want to keep utilizing their Telerik module in DNN 9 without being forced to upgrade the whole instance. That includes governmental and banking websites. ), you only have to set the target host, target port, and a specific payload, as follows: You can also craft a custom payload using the DotNetNuke module within. If you get the “The target appears to be vulnerable” message after running the check, you can proceed by entering the “exploit” command within Metasploit Console. You can also craft a custom payload using the DotNetNuke module within the ysoserial tool. The encryption key also presented a poor randomness level (low-entropy). 23 CVE-2008-6399: 264: 2009-03-05: 2009-03-06 System.Data.Services.Internal.ExpandedWrapper`2[[System.Web.UI.ObjectStateFormatter, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089, ExpandedWrapperOfXamlReaderObjectDataProvider, http://www.w3.org/2001/XMLSchema-instance, http://schemas.microsoft.com/winfx/2006/xaml/presentation, http://schemas.microsoft.com/winfx/2006/xaml', clr-namespace:System.Diagnostics;assembly=system', , which can also result in Remote Code Execution. So besides the target host, target port, payload, encrypted verification code, and plaintext verification code, you also have to set the.DOTNETNUKE cookie of the user you registered within the Metasploit Console. DotNetNuke is a free and open-source web CMS (content management system) written in C# and based on the .NET framework. DotNetNuke uses the DNNPersonalization cookie to store anonymous users’ personalization options (the options for authenticated users are stored through their profile pages). We also reported the issues where possible. Details of vulnerability CVE-2020-5187.DNN (formerly DotNetNuke) through 9.4.4 allows Path Traversal (issue 2 of 2). This cookie is used when the application serves a custom 404 Error page, which is also the default setting. The idea sounds good and effective, except if the DNNPersonalization key was derived from the registration code encryption key. 2019. This cryptography scheme was used to encrypt both the DNNPersonalization cookie and the registration code sent to the email when you sign up through a DotNetNuke application that uses Verified Registration. For more information about DotNetNuke, refer to the DotNetNuke Web site. Having both the encrypted and plaintext codes, you can launch a known-plaintext attack and encrypt your payload with the recovered key. Later edit [June 11, 2020]: As part of this research, we discovered a Remote Code Execution vulnerability exploitable through DNN Cookie Deserialization in one of the U.S. Department Of Defense’s biggest websites. H1 2020 Threat Landscape Report 1H 2020 Overview and Key Findings Years down the road when we all reflect back on 2020, it’s unlikely that cybersecurity will displace the COVID-19 pandemic at the top of our collective memories. Check your Codebase security with multiple scanners from Scanmycode.today You can find this vulnerability in DotNetNuke versions from 9.2.0 to 9.2.1. msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set SESSION_TOKEN <.DOTNETNUKE>, msf5 exploit(windows/http/dnn_cookie_deserialization_rce) > set TARGET 3. 2020-02-24: CVE-2020-5186: DNN (formerly DotNetNuke) through 9.4.4 allows XSS (issue 1 of 2). You can start by analyzing the vulnerable source code of how the application processes the DNNPersonalization cookie XML value. Vulnerable versions store profile information for users in the DNNPersonalization cookie as XML. Affects DotNetNuke versions 5.0.0 to 9.1.0. How to exploit the DotNetNuke Cookie Deserialization, type="System.Data.Services.Internal.ExpandedWrapper`2[[System.Web.UI.ObjectStateFormatter, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a],[System.Windows.Data.ObjectDataProvider, PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35]], System.Data.Services, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089">, <ExpandedWrapperOfXamlReaderObjectDataProvider> You can get rid of this vulnerability by upgrading your DotNetNuke deployment to the latest version. This process could overwrite files that the user was not granted permissions to, and would be … We have analyzed around 300 DotNetNuke deployments in the wild and found out that one in five installations was vulnerable to this issue, including governmental and banking websites. You can find those issues in the DotNetNuke from 9.2.2 to 9.3.0-RC. Finally, if the message “The target appears to be vulnerable” is returned after you run the check, you can proceed by entering the “exploit” command within Metasploit Console. https://github.com/dnnsoftware/Dnn.Platform/releases; https://medium.com/@SajjadPourali/dnn-dotnetnuke-cms-not-as-secure-as-you-think-e8516f789175 DotNetNuke Cookie Deserialization in Pentagon’s HackerOne Bug Bounty program, Scan your web application periodically with. The exploitation is straightforward by passing the malicious payload through the DNNPersonalization cookie within a 404 error page. To help pentesters identify and report this issue and developers to prevent or fix it, we created this practical deep-dive into this Cookie Deserialization RCE vulnerability found in DotNetNuke (DNN). If the message “The target appears to be vulnerable” is returned after you run the check, you can proceed by entering the “exploit” command within Metasploit Console. (/DNN Platform/Library/Common/Utilities/XmlUtils.cs). After having responsibly reported it through HackerOne, the DOD solved the high-severity vulnerability and disclosed the report, with all details now publicly available. Based on the extracted type, it creates a serializer using XmlSerializer. 14 Feb 2020 — DNN asked for technical details again!! We won’t spam you with useless information. : Remote Code Execution in DotNetNuke 9.2.2 through 9.3.0-RC, variables are no longer disclosed in a plaintext format and are now encrypted, but the. To do this, log into the admin account, navigate to the “Admin” -> “Site Settings” -> “Advanced Settings” and look for the “404 Error Page” dropdown menu. DotNetNuke CMS version 9.5.0 suffers from file extension check bypass vulnerability that allows for arbitrary file upload. to CVE-2017-9822. Instead, you can use ObjectDataProvider and build the payload using a method belonging to one of the following classes: The first and original vulnerability was identified as CVE-2017-9822. The Community Blog is a personal opinion of community members and by no means the official standpoint of DNN Corp or DNN Platform. To upload a web shell and execute commands from it, place it inside of the DotNetNuke Exploit DB module, and import it into the Metasploit – as we did in the demo. If you get the “The target appears to be vulnerable” message after running the check, you can proceed by entering the “exploit” command within the Metasploit Console. How to find DNN installs using Google Hacking dorks, You can use the following Google dorks to find available deployments across the Internet and test them against, the DotNetNuke Cookie Deserialization CVE. You can still retrieve the encryption key by gathering a list of verification codes of various newly created users, launch a partial known-plaintext attack against them, and reduce the possible number of valid encryption keys. You have to expect the process to take some minutes, even hours. You have to get the unencrypted format of this code by logging in as the new user, navigating to the “Edit Profile” page, inspecting the source code, and searching for the values of “userID” and “portalID” (possible to return a negative value. According to them, over 750,000 organizations deployed web platforms powered by DotNetNuke worldwide. The first patch consisted of a DES implementation, which is a vulnerable and weak encryption algorithm. tags | exploit , file inclusion advisories | CVE-2020 … : Remote Code Execution in DotNetNuke before 9.1.1, If you want to exploit DotNetNuke Cookie Deserialization through the Metasploit module (which is available through. If you don’t want to update and prefer to stick with the current version, you have to change the page the users will be redirected to once they trigger a 404 error (the homepage is a usual recommendation). 本文首发于“合天网安实验室” 作者：合天网安学院 本文涉及靶场同款知识点练习 通过该实验了解漏洞产生的原因，掌握基本的漏洞利用及使用方法，并能给出加固方案。 简介 Dubbo是阿里巴巴公司开源的一个高性能优秀的服务框架，使得应用可通过高性能的RPC实现服务的输出和输入功能，可以和Spring框架无缝集成。它提供了三大核心能力：面向接口的远程方法调用，智能容错和负载均衡，以及服务自动注册和发现。 概述 2020年06月23日， Apache Dubbo 官方发布了Apache Dubbo 远程代码执行的风险通告，该漏洞编号为CVE-2020-1948，漏洞等级：高危。 Apache Dubbo是一款高性能、轻量级的开源Java... : oglądaj sekurakowe live-streamy o bezpieczeństwie IT. Based on the extracted type, it creates a serializer using, . You don’t have to bypass any patching mechanism. (Default DotNetNuke index page after installation). DNN is the largest and most popular open source CMS on the Microsoft ASP.NET stack. If the message “The target appears to be vulnerable” is returned after you run the check, you can proceed by entering the “exploit” command within Metasploit Console. The expected structure includes a "type" attribute to instruct the server which type of … The main problem with deserialization is that most of the time it can take user input. (DotNetNuke Cookie Deserialization in Pentagon’s HackerOne Bug Bounty program), (DotNetNuke Cookie Deserialization in Government website). Instead, you can use ObjectDataProvider and build the payload using a method belonging to one of the following classes: The first and original vulnerability was identified as CVE-2017-9822. Before we start, keep in mind the vulnerability was released under CVE-2017-9822, but the development team consistently failed at patching it, so they issued another four bypasses: We’ll look at all of them in the steps below. This means you can inject maliciously crafted payloads in the requested format of the application and possibly manipulate its logic, disclose data, or even execute remote code. Save my name, email, and website in this browser for the next time I comment. </p><p><a href="https://valuesofthewise.com/docs/viewtopic.php?tag=cabbage-soup-for-gastritis-86e241">Cabbage Soup For Gastritis</a>, <a href="https://valuesofthewise.com/docs/viewtopic.php?tag=my-last-words-lyrics-meaning-86e241">My Last Words Lyrics Meaning</a>, <a href="https://valuesofthewise.com/docs/viewtopic.php?tag=afwan-in-arabic-86e241">Afwan In Arabic</a>, <a href="https://valuesofthewise.com/docs/viewtopic.php?tag=public-water-bottle-filling-station-86e241">Public Water Bottle Filling Station</a>, <a href="https://valuesofthewise.com/docs/viewtopic.php?tag=caslon-typeface-history-86e241">Caslon Typeface History</a>, <a href="https://valuesofthewise.com/docs/viewtopic.php?tag=panic-of-1819-significance-86e241">Panic Of 1819 Significance</a>, <a href="https://valuesofthewise.com/docs/viewtopic.php?tag=horologium-dwarf-galaxy-86e241">Horologium Dwarf Galaxy</a>, </p><div class="addtoany_share_save_container addtoany_content addtoany_content_bottom"><div class="a2a_kit a2a_kit_size_16 addtoany_list" data-a2a-url="https://valuesofthewise.com/ker8nri5/" data-a2a-title="dotnetnuke exploit 2020"><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fvaluesofthewise.com%2Fker8nri5%2F&amp;linkname=%7B%7B%20keyword%20%7D%7D" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fvaluesofthewise.com%2Fker8nri5%2F&amp;linkname=%7B%7B%20keyword%20%7D%7D" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"><img src="https://static.addtoany.com/buttons/favicon.png" alt="Share" data-pagespeed-url-hash="87368962" onload="pagespeed.CriticalImages.checkImageForCriticality(this);"></a></div></div></div><div class="shapely-next-prev row"><div class="col-md-6 text-left"><div class="wrapper"><span class="fa fa-angle-left"></span> <a href="https://valuesofthewise.com/consolation-reliable-positive-values/" rel="prev">The Consolation of Reliable, Positive Values</a></div></div><div class="col-md-6 text-right"></div></div><hr class="section-divider"/><div class="shapely-related-posts"><div class="row"><div class="col-lg-11 col-sm-10 col-xs-12 shapely-related-posts-title"><h3><span>Related articles </span></h3></div></div><div class="shapely-carousel-navigation hidden-xs"><ul class="shapely-carousel-arrows clearfix"><li><a href="#" class="shapely-owl-prev fa fa-angle-left"></a></li><li><a href="#" class="shapely-owl-next fa fa-angle-right"></a></li></ul></div><div class="owlCarousel owl-carousel owl-theme" data-slider-id="7379" id="owlCarousel-7379" data-slider-items="3" data-slider-speed="400" data-slider-auto-play="1" data-slider-navigation="false"><div class="item"><a href="https://valuesofthewise.com/critiques-of-capitalism-part-3/" class="related-item-thumbnail" style="background-image:url(https://valuesofthewise.com/wp-content/uploads/2017/11/critique-of-cap-image.jpg)"><img width="262" height="215" src="https://valuesofthewise.com/wp-content/uploads/2017/11/critique-of-cap-image.jpg" class="attachment-shapely-grid size-shapely-grid wp-post-image" alt="critiques of capitalism" loading="lazy" srcset="https://valuesofthewise.com/wp-content/uploads/2017/11/critique-of-cap-image.jpg 262w, https://valuesofthewise.com/wp-content/uploads/2017/11/critique-of-cap-image-231x190.jpg 231w" sizes="(max-width: 262px) 100vw, 262px" data-pagespeed-url-hash="958028804" onload="pagespeed.CriticalImages.checkImageForCriticality(this);"/></a><div class="shapely-related-post-title"><a href="https://valuesofthewise.com/critiques-of-capitalism-part-3/">Critiques of Capitalism (Part 3)</a></div></div></div></div></article></div><aside id="secondary" class="widget-area col-md-3" role="complementary"><div id="quotescollection-2" class="widget widget_quotescollection"><h2 class="widget-title">Today's Quote</h2><div class="quotescollection-quote-wrapper" id="w_quotescollection_2"><p>I have never lost my faith to what seems to me is a materialism that leads nowhere—nowhere of value, anyway. I have never met a super-wealthy person for whom money obviated any of the basic challenges of finding happiness in the material world.</p><div class="attribution">&mdash;&nbsp;<cite class="author">Val Kilmer</cite></div><script type="text/javascript">var args_w_quotescollection_2={"instanceID":"w_quotescollection_2","currQuoteID":4,"showAuthor":1,"showSource":0,"tags":"","charLimit":500,"orderBy":"random","ajaxRefresh":1,"autoRefresh":0,"dynamicFetch":0,"before":"","after":"","beforeAttribution":"&lt;div class=\&quot;attribution\&quot;&gt;&amp;mdash;&amp;nbsp;","afterAttribution":"&lt;/div&gt;",};document.write("<div class=\"navigation\"><div class=\"nav-next\"><a class=\"next-quote-link\" style=\"cursor:pointer;\" onclick=\"quotescollectionRefresh(args_w_quotescollection_2)\">Next quote »</a></div></div>")</script> </div></div><div id="mc4wp_form_widget-2" class="widget widget_mc4wp_form_widget"><h2 class="widget-title">Make Wisdom Your Greatest Strength!</h2><script>(function(){window.mc4wp=window.mc4wp||{listeners:[],forms:{on:function(evt,cb){window.mc4wp.listeners.push({event:evt,callback:cb});}}}})();</script><form id="mc4wp-form-1" class="mc4wp-form mc4wp-form-2032" method="post" data-id="2032" data-name="Buy a Book, Get One Free for Subscribers!"><div class="mc4wp-form-fields"><p style="margin-bottom: 10px;"> <label>Email address: </label> <input type="email" name="EMAIL" placeholder="Your email address" required /> <strong>Sign Up and Receive Wisdom-Based Ideas, Tips, and Inspiration!</strong></p><p> <input type="submit" value="Subscribe!"/></p></div><label style="display: none !important;">Leave this field empty if you're human: <input type="text" name="_mc4wp_honeypot" value="" tabindex="-1" autocomplete="off"/></label><input type="hidden" name="_mc4wp_timestamp" value="1606921906"/><input type="hidden" name="_mc4wp_form_id" value="2032"/><input type="hidden" name="_mc4wp_form_element_id" value="mc4wp-form-1"/><div class="mc4wp-response"></div></form></div><div id="search-5" class="widget widget_search"><h2 class="widget-title">Search the VOW Blog</h2><form role="search" method="get" id="searchform" class="search-form" action="https://valuesofthewise.com/"> <label class="screen-reader-text" for="s">Search for:</label> <input type="text" placeholder="Type Here" value="" name="s" id="s"/> <button type="submit" class="searchsubmit"><i class="fa fa-search" aria-hidden="true"></i><span class="screen-reader-text">Search</span></button></form></div><div id="woocommerce_products-2" class="widget woocommerce widget_products"><h2 class="widget-title">Free! Life of Value Books</h2><ul class="product_list_widget"><li> <a href="https://valuesofthewise.com/books/contribute-to-values-of-the-wise/"> <img width="231" height="220" src="https://valuesofthewise.com/wp-content/uploads/2017/06/VOW-logo-copy-231x220.jpeg" class="attachment-woocommerce_thumbnail size-woocommerce_thumbnail" alt="Values of the Wise logo" loading="lazy" srcset="https://valuesofthewise.com/wp-content/uploads/2017/06/VOW-logo-copy-231x220.jpeg 231w, https://valuesofthewise.com/wp-content/uploads/2017/06/VOW-logo-copy.jpeg 237w" sizes="(max-width: 231px) 100vw, 231px" data-pagespeed-url-hash="873343673" onload="pagespeed.CriticalImages.checkImageForCriticality(this);"/> <span class="product-title">Contribute to Values of the Wise</span> </a> <span class="woocommerce-Price-amount amount"><bdi><span class="woocommerce-Price-currencySymbol">&#36;</span>5.00</bdi></span> &ndash; <span class="woocommerce-Price-amount amount"><bdi><span class="woocommerce-Price-currencySymbol">&#36;</span>100.00</bdi></span></li><li> <a href="https://valuesofthewise.com/books/values-and-ethics/"> <img width="231" height="324" src="https://valuesofthewise.com/wp-content/uploads/2017/05/Book-Dialogs5-231x324.jpg" class="attachment-woocommerce_thumbnail size-woocommerce_thumbnail" alt="Values &amp; Ethics - From Living Room to Boardroom" loading="lazy" srcset="https://valuesofthewise.com/wp-content/uploads/2017/05/Book-Dialogs5-231x324.jpg 231w, https://valuesofthewise.com/wp-content/uploads/2017/05/Book-Dialogs5-214x300.jpg 214w, https://valuesofthewise.com/wp-content/uploads/2017/05/Book-Dialogs5-768x1078.jpg 768w, https://valuesofthewise.com/wp-content/uploads/2017/05/Book-Dialogs5-729x1024.jpg 729w, https://valuesofthewise.com/wp-content/uploads/2017/05/Book-Dialogs5-600x842.jpg 600w, https://valuesofthewise.com/wp-content/uploads/2017/05/Book-Dialogs5-462x649.jpg 462w, https://valuesofthewise.com/wp-content/uploads/2017/05/Book-Dialogs5.jpg 834w" sizes="(max-width: 231px) 100vw, 231px" data-pagespeed-url-hash="26568090" onload="pagespeed.CriticalImages.checkImageForCriticality(this);"/> <span class="product-title">Values &amp; Ethics: From Living Room to Boardroom</span> </a> <span class="woocommerce-Price-amount amount"><bdi><span class="woocommerce-Price-currencySymbol">&#36;</span>0.00</bdi></span></li><li> <a href="https://valuesofthewise.com/books/building-a-life-of-value/"> <img width="231" height="324" src="https://valuesofthewise.com/wp-content/uploads/2017/01/Book-Building-a-Life-231x324.jpg" class="attachment-woocommerce_thumbnail size-woocommerce_thumbnail" alt="Building a Life of Value" loading="lazy" srcset="https://valuesofthewise.com/wp-content/uploads/2017/01/Book-Building-a-Life-231x324.jpg 231w, https://valuesofthewise.com/wp-content/uploads/2017/01/Book-Building-a-Life.jpg 422w" sizes="(max-width: 231px) 100vw, 231px" data-pagespeed-url-hash="8935491" onload="pagespeed.CriticalImages.checkImageForCriticality(this);"/> <span class="product-title">Building a Life of Value</span> </a> <span class="woocommerce-Price-amount amount"><bdi><span class="woocommerce-Price-currencySymbol">&#36;</span>0.00</bdi></span></li><li> <a href="https://valuesofthewise.com/books/living-a-life-of-value/"> <img width="231" height="323" src="https://valuesofthewise.com/wp-content/uploads/2017/01/Book-Living-a-Life-1-231x323.jpg" class="attachment-woocommerce_thumbnail size-woocommerce_thumbnail" alt="Living a Life of Value book cover" loading="lazy" srcset="https://valuesofthewise.com/wp-content/uploads/2017/01/Book-Living-a-Life-1-231x323.jpg 231w, https://valuesofthewise.com/wp-content/uploads/2017/01/Book-Living-a-Life-1-215x300.jpg 215w, https://valuesofthewise.com/wp-content/uploads/2017/01/Book-Living-a-Life-1.jpg 300w" sizes="(max-width: 231px) 100vw, 231px" data-pagespeed-url-hash="4102251101" onload="pagespeed.CriticalImages.checkImageForCriticality(this);"/> <span class="product-title">Living a Life of Value</span> </a> <span class="woocommerce-Price-amount amount"><bdi><span class="woocommerce-Price-currencySymbol">&#36;</span>0.00</bdi></span></li></ul></div><div id="text-16" class="widget widget_text"><h2 class="widget-title">Latest Blogs</h2><div class="textwidget"><ul class="display-posts-listing"><li class="listing-item"><a class="title" href="https://valuesofthewise.com/consolation-reliable-positive-values/">The Consolation of Reliable, Positive Values</a></li><li class="listing-item"><a class="title" href="https://valuesofthewise.com/existentialism-humanism/">Existentialism, Humanism, Responsibility and Freedom</a></li><li class="listing-item"><a class="title" href="https://valuesofthewise.com/will-durant-quotes-about-the-meaning-of-life/">Will Durant Quotes About the Meaning of Life</a></li><li class="listing-item"><a class="title" href="https://valuesofthewise.com/eight-myths-in-american-society/">Eight Myths That Undergird American Society</a></li><li class="listing-item"><a class="title" href="https://valuesofthewise.com/sometimes-you-cant-square-the-moral-circle/">Sometimes, You Can&#8217;t Square the Moral Circle</a></li></ul></div></div></aside></div></div></div></section><footer id="colophon" class="site-footer footer bg-dark" role="contentinfo"><div class="container footer-inner"><div class="row"><div class="footer-tag">Ancient Wisdom and Progressive Thinking Brought to Life</div><div class="footer-widget-area"><div class="col-md-3 col-sm-6 footer-widget" role="complementary"><div id="text-18" class="widget widget_text"><div class="textwidget">Values of the Wise, LLC <br/> 1605 Central Avenue, #6-321<br/> Summerville, South Carolina, 29483<br/> 843-614-2377</div></div></div></div></div><div class="row"><div class="site-info col-sm-9"><div class="copyright-text">© Copyright 2017-2020 Values of the Wise. All Rights Reserved. <br/> <span style="display:inline-block;"> <a href="//valuesofthewise.com/privacy-policy/"> Privacy Policy</a> | <a href="//valuesofthewise.com/terms-of-use/">Terms of Use</a></span></div></div><div class="text-right col-sm-3"><nav id="social" class="social-icons"><ul id="menu-social-items" class="list-inline social-list"><li id="menu-item-25" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-25"><a title="Follow us on Facebook!" target="_blank" rel="noopener noreferrer" href="https://www.facebook.com/Values-of-the-Wise-300382077060410/"><i class="social_icon fa"><span>Facebook</span></i></a></li><li id="menu-item-26" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-26"><a title="Follow us on Twitter!" target="_blank" rel="noopener noreferrer" href="https://twitter.com/ValuesOfTheWise"><i class="social_icon fa"><span>Twitter</span></i></a></li><li id="menu-item-7139" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-7139"><a title="Subscribe to our Feed" href="https://valuesofthewise.com/feed"><i class="social_icon fa"><span>RSS</span></i></a></li></ul></nav></div></div></div> <a class="btn btn-sm fade-half back-to-top inner-link" href="#top"><i class="fa fa-angle-up"></i></a></footer></div> <script type="text/javascript">jQuery(document).ready(function($){if($(window).width()>=767){$('.navbar-nav > li.menu-item > a').click(function(){window.location=$(this).attr('href');});}});</script> <script>(function(){function maybePrefixUrlField(){if(this.value.trim()!==''&&this.value.indexOf('http')!==0){this.value="http://"+this.value;}}var urlFields=document.querySelectorAll('.mc4wp-form input[type="url"]');if(urlFields){for(var j=0;j<urlFields.length;j++){urlFields[j].addEventListener('blur',maybePrefixUrlField);}}})();</script> <script type="text/javascript">(function(){var c=document.body.className;c=c.replace(/woocommerce-no-js/,'woocommerce-js');document.body.className=c;})()</script> <script type='text/javascript' id='wc-add-to-cart-js-extra'>var wc_add_to_cart_params={"ajax_url":"\/wp-admin\/admin-ajax.php","wc_ajax_url":"\/?wc-ajax=%%endpoint%%","i18n_view_cart":"View cart","cart_url":"https:\/\/valuesofthewise.com\/cart\/","is_cart":"","cart_redirect_after_add":"yes"};</script> <script type='text/javascript' id='woocommerce-js-extra'>var woocommerce_params={"ajax_url":"\/wp-admin\/admin-ajax.php","wc_ajax_url":"\/?wc-ajax=%%endpoint%%"};</script> <script type='text/javascript' id='wc-cart-fragments-js-extra'>var wc_cart_fragments_params={"ajax_url":"\/wp-admin\/admin-ajax.php","wc_ajax_url":"\/?wc-ajax=%%endpoint%%","cart_hash_key":"wc_cart_hash_e1fc9ce871675b50c8e43ada7d67900e","fragment_name":"wc_fragments_e1fc9ce871675b50c8e43ada7d67900e","request_timeout":"5000"};</script> <script type='text/javascript' id='shapely-scripts-js-extra'>var ShapelyAdminObject={"sticky_header":"1"};</script> <script>jQuery(document).ready(function($){$('.menu li a').click(function(){if(($(this).hasClass('vow-link'))&&(!$(this).parent().hasClass('dropdown'))){$(this).closest('.nav-bar').removeClass('nav-open');}});});</script> <script>jQuery(document).ready(function(){jQuery(document).on('click','#nf-field-8',function(){ga('send','event','Email List','Subscribed','New Subscriber');});});</script> <script defer src="https://valuesofthewise.com/wp-content/cache/autoptimize/js/autoptimize_c48d7d8455859eca970a9c5a6f69831d.js"></script></body></html>