▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑INTERESTING NEW BUG- DESCRIPTION :

> "WonderCMS is a free simple website builder. Aimed to be extremely easy
to install (1 step), light and simple to use.It's an open source flat
file CMS (Content Management System), built with PHP and developed
since 2008."

> Vulnerability overview/description:
-----------------------------------
1. Stored Cross Site Scripting via Filename (Authenticated user)
This vulnerability allows an authenticated user (admin) to upload files
with a malicious client side script as filename. It will be executed in
the browser of a user if he visits the manipulated URL.

2. Directory Traversal (Authenticated user)
This vulnerability allows an authenticated user (admin) to delete arbitrary
files via directory traversal on the operating system with the access rights
of the web server.

3. Upload of arbitrary files (Authenticated user)
It was identified that an authenticated user (admin) can bypass file type
checks and upload malicious files. In this specific case, arbitrary server
side PHP code such as web shells can be uploaded. As a result the attacker
can run arbitrary code on the server side with the privileges of the web
server. This could lead to a full system compromise.


🦑Proof of concept:
-----------------
1. Stored Cross Site Scripting via Filename (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

2. Directory Traversal (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

3. Upload of arbitrary files (Authenticated user)

[ PoC has been removed as no patch is available and the vendor is unresponsive ]

🦑Vulnerable / tested versions:
-----------------------------
WonderCMS version 3.0.7 has been tested, which was the latest version
available at the time of the test. Previous versions may also be affected.

On 18-05-2020, the vendor released a newer version 3.1.0. However, the latest
version are still vulnerable to the above vulnerabilities.

source deeepweb
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑MongoDB database backup and recovery

//The entire database is backed up to the specified directory
mongodump -h dbhost -d dbname -o dbdirectory
mongodump -h 192.168.0.1 -d mydatabase -o D:\bak

//Restore the entire library
mongodump -h dbhost -u user -p pass -d dbdirectory
mongorestore -h 192.168.0.2 -u “root” -p “123” D:\bak
—————————————— —————————————
//Only backup the table of mytable to the specified directory
mongodump -h dbhost -d dbname -c collectionname -o dbdirectory
mongodump -h 192.168.0.1 -d mydatabase -c mytable -o D:\bak\mytable

//Restore a single table
mongorestore -h 192.168.0.2 -d mydatabase D:\bak\mytable
———————————————————————
// Can also be used mongoexport backs up a single table, but the file
mongoexport -h dbhost -d dbname -c collectionname -o dbdirectoryfile
mongoexport -h 192.168.0.1 -d mydatabase -c mytable -o E:\bak\mytable.bak

//Use mongoimport to restore the specified file to the library
mongoimport -h dbhost -d dbname -c collectionname -file
mongoimport -h 192.168.0.2 -d mydatabase -c mytable -file E:\bak\mytable.bak



▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

Support & Share ❤️👍🏻

T.me/UndercodeTesting

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑SOME IMPORTANT TERMS BY UNDERCODE :

1) Weak password

Refers to the passwords that are not strong enough and easy to guess. Passwords (passwords) like 123456, abc123, abcdefg, and woainixiaofeng are common intrusion methods for hackers. About 20 of 100 passwords are such weak passwords.

2) shell

Refers to a command execution environment. For example, when we press the "windows key + R" on the keyboard, the "Run" dialog box appears. Entering "cmd" in it will present a black window where you can run commands. This window is basically I have used it on the Internet or watched it in a hacker movie. This is the Windows Shell execution environment. In the past, when there was no mouse and only a keyboard, all computer operations were completed by this!

3) WebShell

WebShell is a command environment that exists in the form of asp, php, jsp and other web files, and it can also be called a web page backdoor. After hackers invade a website, they will usually mix these asp or php backdoor files with the normal webpage files in the web directory of the website server, and they will usually hide deeper, because they cannot be found by the administrator, and the website cannot be obtained if they are deleted. Control it. A website is linked to the webshell backdoor, basically you can do whatever you want, you can modify any part of the website or delete it. The website transactions between hackers are carried out by webshell. For example, how much money do I spend to buy the webshell permission of this website, and the attacker is responsible for finding a way to put the webshell backdoor in this website, so everyone should understand.

4) injection

With the website environment developed by the B/S structure, basically all websites need a database. The user can submit a piece of database query code and obtain some data he wants to know according to the results returned by the program. This is normal. However, if the query statement is modified into malicious code, it is destructive. This is The so-called SQL injection, the most offensive web page vulnerability, is the culprit for countless enterprise sites being invaded.

5) Injection point

Refers to the place where SQL injection can be performed, generally a web page address with parameters. Depending on the account permissions of the injection point database, the permissions you get are also different.


6) Intranet

Generally speaking, it is a local area network, such as Internet cafes, campus networks, and company intranets. If the IP address is within the following three ranges, it means that we are in the intranet: 10.0.0.0-10.255.255.255, 172.16.0.0-172.31.255.255, 192.168.0.0-192.168.255.255.


7) Extranet

Connect directly to the internet (Internet), allowing any computer to access each other, and the external network needs to be connected to broadband to achieve.

8) Kill

It is to change the program through operations such as packing, encrypting, modifying feature codes, adding flower instructions, etc., so that it can escape the detection and killing of anti-virus software. The Trojans generated by the remote control we mentioned earlier are often found by anti-virus software and cannot achieve the effect of controlling the computer. Therefore, anti-virus technology must be used to avoid scanning by anti-virus software, so that anti-virus software mistakes it for safe software and does not proceed. Intercept.

9) Flower instruction

It is just a few assembly instructions to make some jumps in the assembly statement, so that the anti-virus software cannot normally judge the structure of the virus file. The popular point is that "antivirus software searches for viruses in order from head to toe. If we reverse the head and foot of the virus, the antivirus software will not find the virus.

WRITTEN BY UNDERCODE
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Detailed explanation of DS28E01 typical applications and cracking methods BY Undercode :
#ExpertHacking

DS28E01 is generally used in encryption protection to prevent products from being easily copied and pirated

1️⃣Brief introduction to DS28E01:

The DS28E01 communicates with the MCU through a single bus. Not much to say about the single bus. The time is very strict and accurate to us level.

> DS28E01 has four storage areas:

1) Data memory (EEPROM) (4 pages, 32 bytes per page)

2) Key storage (secret) (8 bytes)

3) Register page containing specific functions and user bytes

4) Volatile scratchpad (scratchpad) (8 bytes)


2️⃣The MCU can only read and write scratchpad through a single bus, but cannot directly read and write other storage areas.

3️⃣When writing data to the data memory, loading the initial key, or writing data to the register page, first write the data to the scratchpad, and then use the corresponding command to let the chip copy the data from the scratchpad to the destination address.

4️⃣working principle:

1) There is a SHA-160 encryption module inside the chip, and the 55-byte data in a specific format that participates in the SHA algorithm,

2) These data include 8 bytes of key, 5 bytes of user-specified random number, 32 bytes of EEPROM content, 7 bytes of ROMID, 2 bytes of fixed data (0xFF) and 1 byte of EEPROM address TA1.

3) The MCU can read the 20-byte hash value encrypted by the chip through SHA, and compare it with the hash value calculated by the MCU itself through the same algorithm.

4) Since the MCU wants to perform the same encryption operation, or it must generate the 55-byte message exactly the same as inside the chip, how can it be obtained?

5) The 8-byte key is generated and written in. ->OK

6) The 5-byte random number is the value written into the scratchpad before the chip performs SHA. ->OK

7) The 32-byte EEPROM data, before reading back the 20-byte hash value, the chip will return the 32-byte content. ->OK

7 bytes ROMID, you can read the ROMID of the chip at any time. ->OK

2 bytes fixed value, see the manual to know ->OK

1 byte TA1, write it in yourself. ->OK

🦑The Cracking process:
#expertHACKing

1️⃣Process 1: Initialize the DS28E01 key

The initialization key is only operated at the factory before the product is produced, and only needs to be operated once.

Procedure flow chart:

1) Read the chip ROMID

2) Generate a unique 64-bit key through a certain algorithm to ensure that the key generated by each motherboard is different.

3) Write the key to the chip temporary storage area, and read back to verify whether the writing is correct

4) Execute the chip load key command to let the chip save the 64-bit key in the temporary storage area to the key storage area

5) Finish.

2️⃣Process 2: verify the DS28E01 key

The verification key is carried out in the product application. Every time the product is started, the DS28E01 key is verified to be correct.

If the verification is passed, it will work normally. If the verification is not correct, the product will not work properly through certain means.

3️⃣Procedure flow chart:

1) Read the chip ROMID

2) Generate the 64-bit key by the same algorithm as in the initialization process

3) Write an 8-byte random number to the chip temporary storage area (only 5 bytes are used), and read back to verify

4) Send encrypted authentication commands to the chip, you can read back 32 bytes of EEPROM data and 20 bytes of hash value

5) Use the data read above to generate a 55-byte digest message and perform SHA1 operations

6) Compare whether the calculated hash value is consistent with the hash value read back from the chip

🦑 Crack method:

1) As can be seen from the above application process, the key algorithm here is SHA1, and there are two copies of the data involved in the SHA calculation. One copy is inside the chip, and we cannot read it.

2) But the other one is generated inside the MCU, so as long as the process of generating messages inside the MCU is obtained, there is a possibility of cracking.

3) The key data is the 8-byte key, because the 8-byte key is generally bound to the ROMID and CPUID,

4) Therefore, we must first be able to read the binary code of the program from the chip, and then disassemble and analyze the algorithm for key generation to achieve the purpose of cracking.

5) However, disassembling and analyzing the algorithm is not easy.

WRITTEN BY UNDERCODE
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Detailed explanation of DS28E01 typical applications and cracking methods BY Undercode

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑CISA ordered federal agencies to install patches to fix serious Windows vulnerabilities within 24 hours

> The Cybersecurity Department of the US Department of Homeland Security (DHS) issued an executive order on Thursday that requires federal civil agencies to immediately fix security for the newly discovered Windows vulnerability SIGRed on the grounds that the vulnerability constitutes "unacceptable" for the security of these agencies. Major risks of

> This is the third order ever issued by the Cybersecurity and Infrastructure Security Agency (CISA) under the DHS, requiring major institutions to patch Windows servers used for the domain name system within 24 hours . Or deploy other mitigation solutions. The organization is not used for DNS, but the affected servers must be patched before July 24.

>The directive is very urgent, CISA emphasized: "Based on the possibility of the vulnerability being exploited, the widespread use of the affected software in the entire federal enterprise, the possibility of damage to the organization’s information system is high, and the serious impact of successful destruction ".

#News
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑The main reasons for the slow functioning of a computer on Windows 7-8-10:

Rarely, this is caused by only one specific reason, since most often PC braking is caused by a number of minor problems, among which it is necessary to pay attention to the following factors:

1️⃣Lack of any targeted actions on the part of the user to optimize the operation of the operating system;

2️⃣Infection with malicious applications;

3️⃣Poor computer cooling system;

4️⃣Periodic defragmentation of hard disk partitions is not performed;

5️⃣Malfunction of some PC components.

6️⃣As you can see, the list of the main factors is not very long, but all of them usually take place in the average PC just a few years after purchase.

🦑Conventionally, all problems are divided into 2 groups:

1) Hardware

> Impaired cooling;

> Winchester defects;

> Damage to the rest of the PC components.

2) Systemic

> Errors in the OS configuration or BIOS;

> Infection with viral applications;

> Lack of system memory, overload.

Share us❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑How to properly install Windows 10 on your Lumia smartphone-BY Undercode ?

> We will update the operating system on the basis of the previous version of the OS, which we will consider Windows 8.1 (although it could be the "Seven") build no lower than 8.10.14219.341. Before starting the installation, you need to make sure that all the latest service packs are installed on the system, as well as that you have an active Windows Insider account.

> If this is not the case, then you need to go to https://insider.Windows.com/ and register. There are no complex points in the registration procedure - everything should go smoothly. Then download the Windows Insider application, which can be taken from here: https://www.microsoft.com/uk-ua/store/apps/Windows-insider/9wzdncrfjbhk - this is the address of the Microsoft application store for this application.

> These preparations should be enough to get a fresh version of the OS on your computer. Another question: do you need it? Worth a try anyway. Without trying Win10 at work, it is difficult to form any idea about it, even if you shove through a mountain of materials on the Internet. So, let's put the tenth version.

1️⃣Launch the Windows Insider application - it is specifically designed for this purpose.

2️⃣Click on the inscription “Get assemblies”

3️⃣Select a method for receiving patches for the system. There are two possibilities here: set the "Fast" option - and then you will be overwhelmed with patches up to your ears (keep in mind that not all of them will work correctly) or select the "Slow" option - then you will be sent only verified updates.

4️⃣Proceed to the “Phone Updates” settings item and click on the “Check” button.

5️⃣After that, the process of downloading the new version will begin, and after its completion you will see the Windows 10 interface on your screen. Sometimes the download stops halfway. For example, the system is upgraded to some intermediate version of the "Eight" and gets stuck there. You can get out of this situation by repeating all the above steps again.


Enjoy ❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁

🦑Anonymity and privacy tip :
#FastTips

1) You can break your anonymity very badly by using VPN / SSH in addition to Tor. (Proxies are described below.) But if you know what you are doing, you can improve anonymity, security, and privacy.

2) VPN / SSH providers keep a history of financial transactions and you will leave traces if you don't choose a truly anonymous payment method. VPN / SSH acts as a persistent ingress or persistent egress node. This may solve some problems, but create new risks.

3) Who is your opponent? Against a global adversary with unlimited resources, adding new intermediate nodes makes passive attacks (a bit) harder, but active attacks become easier as you provide more surface to attack and send more data that you can use. Adding nodes strengthens you against collusion of Tor nodes and against blackhat hackers targeting Tor client code (especially if Tor and VPN are running on two different systems).

4) If the VPN / SSH server is under the control of an attacker, you are weakening the protection provided by Tor. If the server is trustworthy, you can increase the anonymity and / or privacy (depending on the settings) provided by Tor.

5) VPN / SSH can also be used to bypass Tor censorship (if your ISP is blocking access to Tor, or if the end node is blocking connections from the Tor network).

Enjoy ❤️👍🏻
@UndercodeTesting
@UndercodeSecurity
@UndercodeHacking
▁ ▂ ▄ U𝕟𝔻Ⓔ𝐫Ć𝔬𝓓ⓔ ▄ ▂ ▁