Exploit Collector
SOYAL Biometric Access Control System 5.0 Cross Site Request Forgery

https://2.bp.blogspot.com/-LETyKySuDgQ/WWlvb4o-z5I/AAAAAAAAIPU/5gCHtKhwhLoet_fHEL-XnPuLlDk7q9atQCLcBGAs/s1600/h76.png
SOYAL Biometric Access Control System version 5.0 suffers from a cross site request forgery vulnerability.

MD5 | 2893ad78302b33102388b180dc19506d

Download

SOYAL Biometric Access Control System 5.0 CSRF Change Admin Password
Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: AR-727 i/CM - F/W: 5.0
AR837E/EF - F/W: 4.3
AR725Ev2 - F/W: 4.3 191231
AR331/725E - F/W: 4.2
AR837E/EF - F/W: 4.1
AR-727CM /i - F/W: 4.09
AR-727CM /i - F/W: 4.06
AR-837E - F/W: 3.03

Summary: Soyal Access systems are built into Raytel Door Entry Systems
and are providing access and lift control to many buildings from public
and private apartment blocks to prestigious public buildings.

Desc: The application interface allows users to perform certain actions
via HTTP requests without performing any validity checks to verify the
requests. This can be exploited to perform certain actions with administrative
privileges if a logged-in user visits a malicious web site.

Tested on: SOYAL Technology WebServer 2.0
SOYAL Serial Device Server 4.03A
SOYAL Serial Device Server 4.01n
SOYAL Serial Device Server 3.07n
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5632
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5632.php
25.01.2021

--
...

Source:packetstormsecurity.com

Exploit Collector
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Unauthenticated Device Reboot

https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE version 2.0.1 allows unauthenticated attackers to restart the device with an HTTP GET request to /goform/RestartDevice page.

MD5 | bdaea7da6759d7010755dac41c4e9199

Download

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Unauthenticated Device Reboot (DoS)
Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd.
Product web page: http://www.kzbtech.com | http://www.jatontec.com | https://www.neotel.mk
http://www.jatontec.com/products/show.php?itemid=258
http://www.jatontech.com/CAT12.html#_pp=105_564
http://www.kzbtech.com/AM3300V.html
https://neotel.mk/ostanati-paketi-2/

Affected version: Model | Firmware
-------|---------
JT3500V | 2.0.1B1064
JT3300V | 2.0.1B1047
AM6200M | 2.0.0B3210
AM6000N | 2.0.0B3042
AM5000W | 2.0.0B3037
AM4200M | 2.0.0B2996
AM4100V | 2.0.0B2988
AM3500MW | 2.0.0B1092
AM3410V | 2.0.0B1085
AM3300V | 2.0.0B1060
AM3100E | 2.0.0B981
AM3100V | 2.0.0B946
AM3000M | 2.0.0B21
KZ7621U | 2.0.0B14
KZ3220M | 2.0.0B04
KZ3120R | 2.0.0B01

Summary: JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi
& VoIP CPE product specially designed to enable quick and easy
LTE fixed data service deployment for residential and SOHO customers.
It provides high speed LAN, Wi-Fi and VoIP integrated services
to end users who need both bandwidth and multi-media data service
in residential homes or enterprises. The device has 2 Gigabit LAN
ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and
CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing
and firewall software for security. It provides an effective
all-in-one solution to SOHO or residential customers. It can
deliver up to 1Gbps max data throughput which can be very
competitive to wired broadband access service.

Desc: The device allows unauthenticated attackers to restart the
device with an HTTP GET request to /goform/RestartDevice page.

Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN
Linux 2.6.36+ (mips)
Mediatek APSoC SDK v4.3.1.0
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5643
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5643.php
03.02.2021

--
$ curl -sk https://192.168.1.1/goform/RestartDevice
success
$

Source:packetstormsecurity.com

Exploit Collector
SOYAL 701Server 9.0.1 Insecure Permissions

https://2.bp.blogspot.com/-Nz8u9CyJbsU/WWlveW9d4WI/AAAAAAAAIPw/tdSVtwWBcYIHlgRN6nbdKVd_fE-UdNKsACLcBGAs/s1600/h80.png
SOYAL 701Server version 9.0.1 suffers from an insecure permissions vulnerability.

MD5 | 3b51fa9ee0f73925df5fd8339e92606f

Download

SOYAL 701Server 9.0.1 Insecure Permissions
Vendor: SOYAL Technology Co., Ltd
Product web page: https://www.soyal.com.tw | https://www.soyal.com
Affected version: 9.0.1 190322
8.0.6 181227

Summary: 701 Server is the program used to set up and configure LAN
and IP based access control systems, from the COM port used to the
quantity and type of controllers connected. It is also used for
programming some of the more complex controllers such as the AR-716E
and the AR-829E.

Desc: The application suffers from an elevation of privileges vulnerability
which can be used by a simple authenticated user that can change the
executable file with a binary of choice. The vulnerability exist due
to the improper permissions, with the 'F' flag (Full) for 'Everyone'
and 'Authenticated Users' group.

Tested on: Microsoft Windows 10 Enterprise
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5633
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5633.php
25.01.2021

--
C:\Program Files (x86)\701Server>cacls McuServer.exe
C:\Program Files (x86)\701Server\McuServer.exe Everyone:F
NT AUTHORITY\Authenticated Users:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Administrators:(ID)F
BUILTIN\Users:(ID)R
APPLICATION PACKAGE AUTHORITY\ALL APPLICATION PACKAGES:(ID)R
APPLICATION PACKAGE AUTHORITY\ALL RESTRICTED APPLICATION PACKAGES:(ID)R

C:\Program Files (x86)\701Server>

Source:packetstormsecurity.com

Reverse-Shell-Generator - Hosted Reverse Shell Generator With A Ton Of Functionality
http://www.kitploit.com/2021/03/reverse-shell-generator-hosted-reverse.html

Hosted Reverse (https://www.kitploit.com/search/label/Reverse) Shell generator (https://www.kitploit.com/search/label/Generator) with a ton of functionality -- (great for CTFs)

Hosted Instance
https://revshells.com (https://revshells.com/)
Features
Generate common listeners and reverse shells Automatically copy to clipboard Button to increment the listening port number by 1 URI and Base64 encoding LocalStorage to persist your configuration Dark and Light Modes
Credits
weibell briskets papadope 0day 0x03f3

Download Reverse-Shell-Generator (https://github.com/0dayCTF/reverse-shell-generator)

KitPloit - PenTest Tools!
Reverse-Shell-Generator - Hosted Reverse Shell Generator With A Ton Of Functionality

https://1.bp.blogspot.com/-e6daj4fXTXA/YE6InY9pDNI/AAAAAAAAVnI/jNlpJHs-78IrXYlztNxv1y-j72mtaa89gCNcBGAsYHQ/w640-h530/reverse-shell-generator_2.png
Hosted Reverse Shell generator with a ton of functionality -- (great for CTFs)
Hosted Instance

https://revshells.com

Features

* Generate common listeners and reverse shells
* Automatically copy to clipboard
* Button to increment the listening port number by 1
* URI and Base64 encoding
* LocalStorage to persist your configuration
* Dark and Light Modes

Credits

* weibell
* briskets
* papadope
* 0day
* 0x03f3
Download Reverse-Shell-Generator

OAuth Misconfiguration found in small time-window of attack
https://muhammad-aamir.medium.com/oauth-misconfiguration-found-in-small-time-window-of-attack-b585afcb94c6?source=rss------bug_bounty-5

Hi Everyone,Continue reading on Medium » (https://muhammad-aamir.medium.com/oauth-misconfiguration-found-in-small-time-window-of-attack-b585afcb94c6?source=rss------bug_bounty-5)

hacking: security in practice
Recover my own password Windows 7 login user

Hello I forgot my own password to very old VMware with windows 7 user logon But it auto logins with netplwiz Is there a smart way to brute force by patterns or recover password? I really need to remember recover password.... Reset won't do it

submitted by /u/redditusermazafaka
[link] [comments]

hacking: security in practice
Hack Windows 10 In Under 5 Seconds! (BadUSB)

Hello guys,

Thanks for watching my video. This was a quick tutorial on how to gain access to a windows 10 machine using a bad USB in under 5 seconds. If you would like to see more BadUSB videos please let me know.

https://www.youtube.com/watch?v=hrWVo19l7Ag

​

​

https://preview.redd.it/r1czyedbm5o61.png?width=1920&format=png&auto=webp&s=ea571322b9b66649ef78d5e5152a3f3fee69296b

submitted by /u/Delicious_Piece_2216
[link] [comments]

hacking: security in practice
Weird buzzing noise

I always use my earphones to listen to an asmr video on YouTube before I sleep. Usually I wake up with earphones still on my ears, and the video already finished, so the earphones just hanging there without playing anything but sometimes when I'm too lazy to get up I heard quick and loud static noise. The sound is like the buzz sound when you use walkie talkie. Usually only happen once and didn't repeat even if I wait and listen for it to happen again. This happen every day. I thought it was my earphones, so I changed my samsung earphones with a new gaming earphones I just bought. But I still hear that quick random buzz.

I'm worried in case if my phone is tapped, because when I brought it to Samsung center I was like "my phone is still new, all settings is still factory setting" and their technician replied with a joke that maybe someone is tapping my phone. Is it true tho? Is there a tool to check it? Or is it just something normal like phone signals interference?

submitted by /u/More_Ant4463
[link] [comments]

Bashrc Linux Privilege Escalation
https://www.reddit.com/r/Pentesting/comments/m95q3k/bashrc_linux_privilege_escalation/

<!-- SC_OFF -->Hope this can be helpful to some of you, it's not a very common privesc method in CTFs although it can be fairly common in real-life engagements when system admins get lazy. Let me know if there are other less common methods you know of! https://steflan-security.com/?p=2330 <!-- SC_ON --> submitted by /u/cantchooseone96 (https://www.reddit.com/user/cantchooseone96)
[link] (https://www.reddit.com/r/Pentesting/comments/m95q3k/bashrc_linux_privilege_escalation/) [comments] (https://www.reddit.com/r/Pentesting/comments/m95q3k/bashrc_linux_privilege_escalation/)

OAuth Misconfiguration found in small time-window of attack

Hi Everyone,Continue reading on Medium »
Read more...

Reverse-Shell-Generator - Hosted Reverse Shell Generator With A Ton Of Functionality

Hosted Reverse Shell generator with a ton of functionality -- (great for CTFs) Hosted Instance https://revshells.com Features Generate common listeners and reverse shells Automatically copy to clipboard Button to increment the listening port number by 1 URI and Base64 encoding LocalStorage to persist your configuration Dark and Light Modes Credits weibell briskets papadope 0day 0x03f3 Download Reverse-Shell-Generator
Read more...